Formalization: Optimal Treatment Welfare under Local Privacy: Minimax Estimation and Honest Inference
The complete Lean development behind this paper — every definition, lemma, and theorem of its module, including helpers the paper text never cites. Identifiers link within this page, into the Causalean library, or out to the official Mathlib docs. Note: this index was generated at a different commit than the paper's audited pin (3a4c7a8) — statements may have moved since the audit.
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Basic 39 declarations Finite original-record private value frontiers: Basic.
Basic
Finite original-record private value frontiers: Basic.
Fix the sample size and the dimension and the privacy budget. Public resource tuples in the paper's domain.
Definition (Lean source)
parameters
n d :
ℕ
eps :
ℝ
def
Allowed n d eps :
Prop
given by
clause 1
2 ≤ n
clause 2
2 ≤ d
clause 3
0 < eps
clause 4
eps ≤ 1
def FullRecord
Fix the dimension. Full binary potential-outcome records, in the order X,A,Y,Y0,Y1.
def ObsRecord
Fix the dimension. Observed records.
def PairedSymbol
Fix the dimension. Paired input alphabet with Bool coding signs.
def cell
Fix the full participant record. Cell coordinate.
Definition (Lean source)
def arm
Fix the full participant record. Assignment coordinate.
Definition (Lean source)
def outcome
Fix the full participant record. Observed outcome coordinate.
Definition (Lean source)
def outcome0
Fix the full participant record. Control potential outcome.
Definition (Lean source)
def outcome1
Fix the full participant record. Treated potential outcome.
Definition (Lean source)
def potential
Fix the binary value a and the full participant record. Arm-indexed potential outcome.
Definition (Lean source)
parameters
def
def observe
Fix the full participant record. Observation projection.
Definition (Lean source)
parameters
d :
ℕ
w :
def
def bitVal
Fix the binary value a. Binary value in the real line.
Definition (Lean source)
def signVal
Fix the binary value s. Sign coding.
Definition (Lean source)
def obsSign
Fix the observed participant record. Signed observation.
def signedObserve
Fix the observed participant record. Paired observation projection.
Definition (Lean source)
parameters
d :
ℕ
o :
def
given by
(o.1, o.2.1 == o.2.2)
def observedLaw
Fix the probability law P. Observed marginal.
Definition (Lean source)
def armMean
Fix the probability law P, the binary value a, and the coordinate index. Conditional cell mean, with division at zero cells interpreted by Lean.
Definition (Lean source)
parameters
def
armMean P a j :
ℝ
given by
P.real {w | cell w = j ∧ potential a w = true} / P.real {w | cell w = j}
def contrast
Fix the probability law P and the coordinate index. Cellwise contrast.
Definition (Lean source)
parameters
def
contrast P j :
ℝ
def baseline
Fix the probability law P. Baseline mean.
Definition (Lean source)
def value
Fix the probability law P. First-best population value.
Definition (Lean source)
Fix the dimension. Parameter cube.
Fix the function theta. Signed average absolute norm.
Definition (Lean source)
parameters
d :
ℕ
theta :
Fin d → ℝ
def
signedNorm theta :
ℝ
given by
(d : ℝ)⁻¹ * ∑ j, |theta j|
def atomLaw
Fix the function w. Finite atomic law constructor.
Definition (Lean source)
Fix the function theta. Paired signed law.
Definition (Lean source)
Fix the dimension. Public uniform paired law.
Definition (Lean source)
Fix the probability law P. Uniform covariate marginal.
Definition (Lean source)
parameters
def
UniformCovariates P :
Prop
given by
P.real {w | cell w = j} = (d : ℝ)⁻¹
Fix the probability law P. Fair assignment conditional on both potential outcomes and the cell.
Fix the probability law P. Almost-sure consistency.
Definition (Lean source)
Fix the probability law P. Interior Bernoulli arm means.
Definition (Lean source)
structure CausalModel
Fix the probability law P. The four defining causal model atoms.
Definition (Lean source)
parameters
d :
ℕ
P :
Measure (FullRecord d)
assumes
uniform :
fair :
consistent :
Consistency P
interior :
def causalClass
Fix the dimension. The complete law class, including ambient probability typing.
Definition (Lean source)
def bernMass
Fix the density or prior under consideration and the binary value y. Bernoulli atom weight.
Definition (Lean source)
Fix the function theta. Uniform cells, independent arm potentials, independent fair assignment, and consistency.
Definition (Lean source)
inductive ProtocolClassLabel
Protocol class labels.
Definition (Lean source)
inductive ProtocolClassLabel where
| NI | SI
deriving DecidableEq -- @realizes \mathcal C(NI or SI)
instance instDecidableEqProtocolClassLabel
Equality of protocol-class labels is decidable.
Definition (Lean source)
deriving DecidableEq -- @realizes \mathcal C(NI or SI)
def logDim
Fix the dimension. Logarithmic dimension.
def rho
Fix the real parameter t and the dimension. Evaluated finite-resource rate.
Fix the protocol-class label, the sample size and the dimension, and the privacy budget. Class-independent squared-error rate.
Definition (Lean source)
parameters
def
rateR _C n d eps :
ℝ
given by
rho (n * eps^2) d
Fix the protocol-class label, the sample size and the dimension, and the privacy budget. Connected honest-length rate.
Definition (Lean source)
parameters
def
rateH C n d eps :
ℝ
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.AncillaryReconstruction 8 declarations The signed input and assignment bit factor as a product law.
Ancillary reconstruction of symmetric samples
The signed input and assignment bit factor as a product law. Coordinatewise reconstruction consequently recovers the full iid observed sample.
The ancillary assignment has the parameter-independent fair law.
theorem ancillaryBitLaw_singleton
Each assignment has probability one half.
Formal statement
Proof (Lean source)
-- @node: ancillaryBitLaw_singleton
lemma ancillaryBitLaw_singleton (a : Bool) :
ancillaryBitLaw {a} = ofReal (1/2 : ℝ) := by
simp [ancillaryBitLaw, atomLaw, Measure.dirac_apply']
cases a <;> simp
instance ancillaryBitLaw_probability
The ancillary bit law is a probability measure.
Definition (Lean source)
-- @node: ancillaryBitLaw_probability
instance ancillaryBitLaw_probability : IsProbabilityMeasure ancillaryBitLaw := by
constructor
simp only [ancillaryBitLaw, atomLaw, Measure.add_apply, Measure.smul_apply,
Measure.dirac_apply_of_mem, Set.mem_univ, smul_eq_mul, mul_one,
Fintype.sum_bool]
rw [← ENNReal.ofReal_add (by norm_num) (by norm_num)]
norm_num
theorem symmetricLaw_signed_assignment_law
Assume the stated htheta condition and positive dimension. Splitting an observed record produces a paired input and an independent fair assignment.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: symmetricLaw_signed_assignment_law
lemma symmetricLaw_signed_assignment_law (theta : Fin d → ℝ)
(htheta : theta ∈ parameterCube d) (hd : 0 < d) :
(observedLaw (symmetricLaw theta)).map (fun o => (signedObserve o, o.2.1)) =
(pairedLaw theta).prod ancillaryBitLaw := by
have := symmetricLaw_probability theta htheta hd
have : IsProbabilityMeasure (pairedLaw theta) :=
pairedFamily_subset_simplex hd (Set.mem_image_of_mem pairedLaw htheta)
apply Measure.ext_of_singleton
intro w
rcases w with ⟨v,a⟩
rw [Measure.map_apply (by fun_prop) (MeasurableSet.singleton _)]
have hpre : (fun o : ObsRecord d => (signedObserve o, o.2.1)) ⁻¹' {(v,a)} =
{recoverObs v a} := by
ext o
constructor
· intro ho
have heq : (signedObserve o, o.2.1) = (v,a) := ho
have hv := congrArg fst heq
have ha := congrArg snd heq
change signedObserve o = v at hv
change o.2.1 = a at ha
simpa [hv, ha] using (recoverObs_signedObserve o).symm
· intro ho
have heq : o = recoverObs v a := ho
subst o
change (signedObserve (recoverObs v a), a) = (v,a)
rw [signedObserve_recoverObs]
rw [hpre, symmetricLaw_observed_singleton theta htheta hd,
signedObserve_recoverObs]
have hprod : ((pairedLaw theta).prod ancillaryBitLaw) {(v,a)} =
pairedLaw theta {v} * ancillaryBitLaw {a} := by
rw [show ({(v,a)} : Set (PairedSymbol d × Bool)) = {v} ×ˢ {a} from
Set.singleton_prod_singleton.symm, Measure.prod_prod]
rw [hprod, ancillaryBitLaw_singleton, mul_comm]
theorem symmetricLaw_reconstruction_law
Assume the stated htheta condition and positive dimension. Reattaching the fair bit recovers exactly the original observed law.
Formal statement
hypotheses
conclusion
= observedLaw (symmetricLaw theta)
Proof (Lean source)
-- @node: symmetricLaw_reconstruction_law
lemma symmetricLaw_reconstruction_law (theta : Fin d → ℝ)
(htheta : theta ∈ parameterCube d) (hd : 0 < d) :
((pairedLaw theta).prod ancillaryBitLaw).map (fun w => recoverObs w.1 w.2) =
observedLaw (symmetricLaw theta) := by
rw [← symmetricLaw_signed_assignment_law theta htheta hd,
Measure.map_map (by fun_prop) (by fun_prop)]
have hf : (fun w : PairedSymbol d × Bool => recoverObs w.1 w.2) ∘
(fun o : ObsRecord d => (signedObserve o, o.2.1)) = id := by
funext o
exact recoverObs_signedObserve o
rw [hf, Measure.map_id]
theorem symmetricLaw_iid_signed_assignment_law
Assume the stated htheta condition and positive dimension. Splitting every participant preserves iid sampling and separates all ancillary bits.
Formal statement
hypotheses
conclusion
(Measure.pi (fun _ : Fin n => observedLaw (symmetricLaw theta))).map (fun o i => (signedObserve (o i), (o i).2.1))
Proof (Lean source)
-- @node: symmetricLaw_iid_signed_assignment_law
lemma symmetricLaw_iid_signed_assignment_law (theta : Fin d → ℝ)
(htheta : theta ∈ parameterCube d) (hd : 0 < d) :
(Measure.pi (fun _ : Fin n => observedLaw (symmetricLaw theta))).map
(fun o i => (signedObserve (o i), (o i).2.1)) =
Measure.pi (fun _ : Fin n => (pairedLaw theta).prod ancillaryBitLaw) := by
have := symmetricLaw_probability theta htheta hd
have : IsProbabilityMeasure (observedLaw (symmetricLaw theta)) :=
Measure.isProbabilityMeasure_map (show Measurable observe by fun_prop).aemeasurable
have : IsProbabilityMeasure ((observedLaw (symmetricLaw theta)).map
(fun o => (signedObserve o, o.2.1))) :=
Measure.isProbabilityMeasure_map (by fun_prop)
rw [Measure.pi_map_pi (fun _ => (show Measurable
(fun o : ObsRecord d => (signedObserve o, o.2.1)) by fun_prop).aemeasurable)]
simp only [symmetricLaw_signed_assignment_law theta htheta hd]
theorem symmetricLaw_iid_reconstruction_law
Assume the stated htheta condition and positive dimension. Reconstructing every participant recovers the full iid observed experiment.
Formal statement
hypotheses
conclusion
(Measure.pi (fun _ : Fin n => (pairedLaw theta).prod ancillaryBitLaw)).map (fun w i => recoverObs (w i).1 (w i).2)
= Measure.pi (fun _ : Fin n => observedLaw (symmetricLaw theta))
Proof (Lean source)
-- @node: symmetricLaw_iid_reconstruction_law
lemma symmetricLaw_iid_reconstruction_law (theta : Fin d → ℝ)
(htheta : theta ∈ parameterCube d) (hd : 0 < d) :
(Measure.pi (fun _ : Fin n => (pairedLaw theta).prod ancillaryBitLaw)).map
(fun w i => recoverObs (w i).1 (w i).2) =
Measure.pi (fun _ : Fin n => observedLaw (symmetricLaw theta)) := by
have := symmetricLaw_probability theta htheta hd
have : IsProbabilityMeasure (pairedLaw theta) :=
pairedFamily_subset_simplex hd (Set.mem_image_of_mem pairedLaw htheta)
have : IsProbabilityMeasure (((pairedLaw theta).prod ancillaryBitLaw).map
(fun w => recoverObs w.1 w.2)) :=
Measure.isProbabilityMeasure_map (by fun_prop)
rw [Measure.pi_map_pi (fun _ => (show Measurable
(fun w : PairedSymbol d × Bool => recoverObs w.1 w.2) by fun_prop).aemeasurable)]
simp only [symmetricLaw_reconstruction_law theta htheta hd]
theorem symmetricLaw_iid_ancillary_product
Assume the stated htheta condition and positive dimension. All signed inputs are independent of the entire vector of ancillary assignments.
Formal statement
hypotheses
conclusion
(Measure.pi (fun _ : Fin n => observedLaw (symmetricLaw theta))).map (fun o => ((fun i => signedObserve (o i)), (fun i => (o i).2.1)))
= (Measure.pi (fun _ : Fin n => pairedLaw theta)).prod (Measure.pi (fun _ : Fin n => ancillaryBitLaw))
Proof (Lean source)
-- @node: symmetricLaw_iid_ancillary_product
lemma symmetricLaw_iid_ancillary_product (theta : Fin d → ℝ)
(htheta : theta ∈ parameterCube d) (hd : 0 < d) :
(Measure.pi (fun _ : Fin n => observedLaw (symmetricLaw theta))).map
(fun o => ((fun i => signedObserve (o i)), (fun i => (o i).2.1))) =
(Measure.pi (fun _ : Fin n => pairedLaw theta)).prod
(Measure.pi (fun _ : Fin n => ancillaryBitLaw)) := by
have : IsProbabilityMeasure (pairedLaw theta) :=
pairedFamily_subset_simplex hd (Set.mem_image_of_mem pairedLaw htheta)
have hsplit := symmetricLaw_iid_signed_assignment_law (n := n) theta htheta hd
have hprod := (measurePreserving_arrowProdEquivProdArrow
(PairedSymbol d) Bool (Fin n) (fun _ => pairedLaw theta)
(fun _ => ancillaryBitLaw)).map_eq
rw [← hsplit, Measure.map_map (by fun_prop) (by fun_prop)] at hprod
exact hprod
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Bridge.AncillarySample 3 declarations The signed sample and the assignment vector factor into independent product laws.
Independent ancillary assignments for the entire sample
The signed sample and the assignment vector factor into independent product laws. Reconstruction therefore works simultaneously for all participants, before any adaptive transcript is generated.
theorem symmetricLaw_iid_reconstruction
Assume the stated htheta condition and positive dimension. Reconstructing the complete observed sample from the independent signed sample and fair assignment vector recovers its iid law.
Formal statement
hypotheses
conclusion
((Measure.pi (fun _ : Fin n => pairedLaw theta)).prod (Measure.pi (fun _ : Fin n => ancillaryBitLaw))).map (fun w => fun i => recoverObs (w.1 i) (w.2 i))
= Measure.pi (fun _ : Fin n => observedLaw (symmetricLaw theta))
Proof (Lean source)
-- @node: symmetricLaw_iid_reconstruction
lemma symmetricLaw_iid_reconstruction (theta : Fin d → ℝ)
(htheta : theta ∈ parameterCube d) (hd : 0 < d) :
((Measure.pi (fun _ : Fin n => pairedLaw theta)).prod
(Measure.pi (fun _ : Fin n => ancillaryBitLaw))).map
(fun w => fun i => recoverObs (w.1 i) (w.2 i)) =
Measure.pi (fun _ : Fin n => observedLaw (symmetricLaw theta)) := by
rw [← symmetricLaw_iid_ancillary_product theta htheta hd,
Measure.map_map (by fun_prop) (by fun_prop)]
have hid : (fun o : Fin n → ObsRecord d =>
fun i => recoverObs (signedObserve (o i)) (o i).2.1) = id := by
funext o i
exact recoverObs_signedObserve (o i)
change (Measure.pi (fun _ : Fin n => observedLaw (symmetricLaw theta))).map
(fun o => fun i => recoverObs (signedObserve (o i)) (o i).2.1) = _
rw [hid, Measure.map_id]
theorem symmetricLaw_iid_reconstruction_map
Assume the stated htheta condition, positive dimension, and measurability of f. The iid experiment identity also holds after arbitrary measurable processing of the complete original sample.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
Ω :
Type
theta :
Fin d → ℝ
htheta :
theta ∈ parameterCube d
hd :
0 < d
hf :
conclusion
((Measure.pi (fun _ : Fin n => pairedLaw theta)).prod (Measure.pi (fun _ : Fin n => ancillaryBitLaw))).map (fun w => f (fun i => recoverObs (w.1 i) (w.2 i)))
Proof (Lean source)
-- @node: symmetricLaw_iid_reconstruction_map
lemma symmetricLaw_iid_reconstruction_map {Ω : Type} [MeasurableSpace Ω]
(theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d) (hd : 0 < d)
(f : (Fin n → ObsRecord d) → Ω) (hf : Measurable f) :
((Measure.pi (fun _ : Fin n => pairedLaw theta)).prod
(Measure.pi (fun _ : Fin n => ancillaryBitLaw))).map
(fun w => f (fun i => recoverObs (w.1 i) (w.2 i))) =
(Measure.pi (fun _ : Fin n => observedLaw (symmetricLaw theta))).map f := by
rw [← symmetricLaw_iid_reconstruction theta htheta hd,
Measure.map_map hf (by fun_prop)]
rfl
theorem symmetricLaw_reconstructed_decisionLaw
Assume independent and identically distributed participant records, independent protocol randomness, positive dimension, and the stated htheta condition. Before any adaptive messages are generated, the original decision experiment can be represented by independent paired inputs, fair ancillary bits, and public coins.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
S :
SamplingScheme n d
hIID :
hRandom :
hd :
0 < d
Q :
LocalProtocol n (ObsRecord d)
theta :
Fin d → ℝ
htheta :
theta ∈ parameterCube d
conclusion
decisionLaw S Q (symmetricLaw theta)
= (((Measure.pi (fun _ : Fin n => pairedLaw theta)).prod (Measure.pi (fun _ : Fin n => ancillaryBitLaw))).prod (Q.seedLaw.prod uniform01)).bind (fun w => (fixedTranscriptLaw Q (fun i => recoverObs (w.1.1 i) (w.1.2 i)) w.2.1).map (fun z => (z,w.2.1,w.2.2)))
Proof (Lean source)
-- @node: symmetricLaw_reconstructed_decisionLaw
lemma symmetricLaw_reconstructed_decisionLaw (S : SamplingScheme n d)
(hIID : IidPeople S) (hRandom : IndependentRandomness S) (hd : 0 < d)
(Q : LocalProtocol n (ObsRecord d)) (theta : Fin d → ℝ)
(htheta : theta ∈ parameterCube d) :
decisionLaw S Q (symmetricLaw theta) =
(((Measure.pi (fun _ : Fin n => pairedLaw theta)).prod
(Measure.pi (fun _ : Fin n => ancillaryBitLaw))).prod
(Q.seedLaw.prod uniform01)).bind (fun w =>
(fixedTranscriptLaw Q (fun i => recoverObs (w.1.1 i) (w.1.2 i)) w.2.1).map
(fun z => (z,w.2.1,w.2.2))) := by
haveI := symmetricLaw_probability theta htheta hd
haveI : IsProbabilityMeasure uniform01 := ⟨by
simp [uniform01, Measure.restrict_apply, Real.volume_Icc]⟩
have hmodel := symmetricLaw_causalModel theta htheta hd
haveI : IsProbabilityMeasure (pairedLaw theta) :=
pairedFamily_subset_simplex hd (Set.mem_image_of_mem pairedLaw htheta)
let f : (((Fin n → PairedSymbol d) × (Fin n → Bool)) × Q.Seed × ℝ) →
((Fin n → ObsRecord d) × Q.Seed × ℝ) :=
fun w => (fun i => recoverObs (w.1.1 i) (w.1.2 i),w.2)
have hf : Measurable f := by fun_prop
have hinput : (((Measure.pi (fun _ : Fin n => pairedLaw theta)).prod
(Measure.pi (fun _ : Fin n => ancillaryBitLaw))).prod
(Q.seedLaw.prod uniform01)).map f =
(Measure.pi (fun _ : Fin n => observedLaw (symmetricLaw theta))).prod
(Q.seedLaw.prod uniform01) := by
have hmap := (Measure.map_prod_map
((Measure.pi (fun _ : Fin n => pairedLaw theta)).prod
(Measure.pi (fun _ : Fin n => ancillaryBitLaw)))
(Q.seedLaw.prod uniform01)
(show Measurable (fun w : (Fin n → PairedSymbol d) × (Fin n → Bool) =>
fun i => recoverObs (w.1 i) (w.2 i)) by fun_prop)
(measurable_id : Measurable (id : Q.Seed × ℝ → Q.Seed × ℝ))).symm
rw [symmetricLaw_iid_reconstruction theta htheta hd, Measure.map_id] at hmap
exact hmap
unfold decisionLaw
rw [hRandom Q.Seed Q.seedLaw (symmetricLaw theta) hmodel,
hIID Q.Seed Q.seedLaw (symmetricLaw theta) hmodel, ← hinput]
unfold Measure.bind
rw [Measure.map_map (measurable_protocol_decisionRows Q) hf]
rfl
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Bridge.AncillaryTranscript 5 declarations Independent fair reconstruction bits can be averaged one stage at a time, including when the next channel depends on the preceding messages.
Integrating ancillary bits through adaptive transcripts
Independent fair reconstruction bits can be averaged one stage at a time, including when the next channel depends on the preceding messages.
theorem ancillaryBits_flip_map
Flipping any one fair assignment preserves the entire independent bit law.
Formal statement
Proof (Lean source)
-- @node: ancillaryBits_flip_map
lemma ancillaryBits_flip_map (i : Fin n) :
(Measure.pi (fun _ : Fin n => ancillaryBitLaw)).map
(fun a => update a i (!(a i))) =
Measure.pi (fun _ : Fin n => ancillaryBitLaw) := by
have hbit : ancillaryBitLaw.map not = ancillaryBitLaw := by
apply Measure.ext_of_singleton
intro b
rw [Measure.map_apply (by fun_prop) (MeasurableSet.singleton _)]
have hp : not ⁻¹' {b} = {!b} := by
ext a
cases a <;> cases b <;> simp
rw [hp, ancillaryBitLaw_singleton, ancillaryBitLaw_singleton]
have hfun : (fun a : Fin n → Bool => update a i (!(a i))) =
(fun a j => (if j = i then not else id) (a j)) := by
funext a j
by_cases hj : j = i <;> simp [hj]
rw [hfun, Measure.pi_map_pi (fun j => (show Measurable
(if j = i then not else (id : Bool → Bool)) by
split <;> fun_prop).aemeasurable)]
congr 1
funext j
split <;> simp [hbit]
theorem ancillaryBits_lintegral_resample
Assume the function f. Resampling a single independent fair bit leaves every nonnegative expectation unchanged.
Formal statement
Proof (Lean source)
-- @node: ancillaryBits_lintegral_resample
lemma ancillaryBits_lintegral_resample (i : Fin n) (f : (Fin n → Bool) → ℝ≥0∞) :
(∫⁻ a, f a ∂Measure.pi (fun _ : Fin n => ancillaryBitLaw)) =
∫⁻ a, ofReal (1/2 : ℝ) * f (update a i false) +
ofReal (1/2 : ℝ) * f (update a i true)
∂Measure.pi (fun _ : Fin n => ancillaryBitLaw) := by
have hm : Measurable f := measurable_of_countable _
have hf : (∫⁻ a, f (update a i (!(a i)))
∂Measure.pi (fun _ : Fin n => ancillaryBitLaw)) =
∫⁻ a, f a ∂Measure.pi (fun _ : Fin n => ancillaryBitLaw) := by
rw [← lintegral_map hm (show Measurable
(fun a : Fin n → Bool => update a i (!(a i))) by fun_prop),
ancillaryBits_flip_map]
have hp (a : Fin n → Bool) :
ofReal (1/2 : ℝ) * f (update a i false) +
ofReal (1/2 : ℝ) * f (update a i true) =
ofReal (1/2 : ℝ) * f a +
ofReal (1/2 : ℝ) * f (update a i (!(a i))) := by
have hu : update a i (a i) = a := Function.update_eq_self i a
cases ha : a i <;> simp_all only [Bool.not_false, Bool.not_true, add_comm]
simp_rw [hp]
rw [lintegral_add_left (by fun_prop), lintegral_const_mul _ hm,
lintegral_const_mul _ (by fun_prop), hf, ← add_mul]
norm_num [← ENNReal.ofReal_add]
theorem averagedProtocol_prefix_lintegral
Assume order no larger than the sample size, the function f, and measurability of f. Averaging independent ancillary assignments commutes with every adaptive prefix.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
v :
Fin n → PairedSymbol d
r :
Q.Seed
k :
ℕ
hk :
k ≤ n
f :
History Q.Message k hk → ℝ≥0∞
hf :
conclusion
(∫⁻ a, ∫⁻ eta, f eta ∂prefixLaw Q.kernels (fun i => (recoverObs (v i) (a i),r)) k hk ∂Measure.pi (fun _ : Fin n => ancillaryBitLaw))
= ∫⁻ eta, f eta ∂prefixLaw (averagedProtocol Q).kernels (fun i => (v i,r)) k hk
Proof (Lean source)
-- @node: averagedProtocol_prefix_lintegral
lemma averagedProtocol_prefix_lintegral (Q : LocalProtocol n (ObsRecord d))
(v : Fin n → PairedSymbol d) (r : Q.Seed) (k : ℕ) (hk : k ≤ n)
(f : History Q.Message k hk → ℝ≥0∞) (hf : Measurable f) :
(∫⁻ a, ∫⁻ eta, f eta ∂prefixLaw Q.kernels
(fun i => (recoverObs (v i) (a i),r)) k hk
∂Measure.pi (fun _ : Fin n => ancillaryBitLaw)) =
∫⁻ eta, f eta ∂prefixLaw (averagedProtocol Q).kernels
(fun i => (v i,r)) k hk := by
induction k with
| zero =>
change (∫⁻ a : Fin n → Bool, ∫⁻ eta, f eta ∂Measure.dirac (fun j : Fin 0 => j.elim0)
∂Measure.pi (fun _ => ancillaryBitLaw)) = _
rw [lintegral_const, measure_univ, mul_one]
rfl
| succ k ih =>
let i := nextIndex hk
let mu (a : Fin n → Bool) := prefixLaw Q.kernels
(fun j => (recoverObs (v j) (a j),r)) k (le_of_succ_le hk)
haveI (a : Fin n → Bool) : IsProbabilityMeasure (mu a) :=
isProbabilityMeasure_prefixLaw Q.kernels Q.markov _ _ _
let K : Kernel (History Q.Message k (le_of_succ_le hk)) (Q.Message i) :=
(averagedKernel Q i).comap (fun eta => ((v i,r),eta)) (by fun_prop)
haveI : IsMarkovKernel K := by
dsimp [K]; haveI := averagedKernel_markov Q i; infer_instance
let g : History Q.Message k (le_of_succ_le hk) → ℝ≥0∞ :=
fun eta => ∫⁻ z, f (snoc hk eta z) ∂K eta
have hg : Measurable g := by
exact Measurable.lintegral_kernel_prod_right' (κ := K)
(hf.comp (measurable_snoc hk))
rw [ancillaryBits_lintegral_resample i]
have hstep (a : Fin n → Bool) :
ofReal (1/2 : ℝ) *
(∫⁻ eta, f eta ∂prefixLaw Q.kernels
(fun j => (recoverObs (v j) (update a i false j),r)) (k+1) hk) +
ofReal (1/2 : ℝ) *
(∫⁻ eta, f eta ∂prefixLaw Q.kernels
(fun j => (recoverObs (v j) (update a i true j),r)) (k+1) hk) =
∫⁻ eta, g eta ∂mu a := by
have hu (b : Bool) :
(fun j => (recoverObs (v j) (update a i b j),r)) =
update (fun j => (recoverObs (v j) (a j),r)) i
(recoverObs (v i) b,r) := by
funext j
by_cases hj : j = i <;> simp [hj]
rw [hu false, hu true]
have h := averagedKernel_prefix_step Q
(fun j => (recoverObs (v j) (a j),r)) k hk (v i) r
have hl := congrArg (fun m => ∫⁻ eta, f eta ∂m) h
rw [lintegral_add_measure, lintegral_smul_measure, lintegral_smul_measure,
lintegral_map hf (measurable_snoc hk)] at hl
change (∫⁻ p, f (snoc hk p.1 p.2) ∂(mu a ⊗ₘ K)) = _ at hl
rw [Measure.lintegral_compProd (μ := mu a) (κ := K)
(show Measurable (fun p => f (snoc hk p.1 p.2)) from hf.comp (measurable_snoc hk))] at hl
exact hl.symm
simp_rw [hstep]
rw [ih (le_of_succ_le hk) g hg, prefixLaw_succ]
change (∫⁻ eta, g eta ∂prefixLaw (averagedProtocol Q).kernels
(fun i => (v i,r)) k (le_of_succ_le hk)) =
∫⁻ eta, f eta ∂(prefixLaw (averagedProtocol Q).kernels
(fun i => (v i,r)) k (le_of_succ_le hk) ⊗ₘ K).map
(fun p => snoc hk p.1 p.2)
haveI := isProbabilityMeasure_prefixLaw (averagedProtocol Q).kernels
(averagedProtocol Q).markov (fun i => (v i,r)) k (le_of_succ_le hk)
simp only [averagedProtocol] at *
rw [lintegral_map hf (measurable_snoc hk),
Measure.lintegral_compProd (κ := K)
(show Measurable (fun p => f (snoc hk p.1 p.2)) from hf.comp (measurable_snoc hk))]
theorem averagedProtocol_fixedTranscript_lintegral
Assume the function f and measurability of f. The full transcript expectation averages the independent reconstruction bits.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
v :
Fin n → PairedSymbol d
r :
Q.Seed
f :
ProtocolTranscript Q → ℝ≥0∞
hf :
conclusion
(∫⁻ a, ∫⁻ z, f z ∂fixedTranscriptLaw Q (fun i => recoverObs (v i) (a i)) r ∂Measure.pi (fun _ : Fin n => ancillaryBitLaw))
= ∫⁻ z, f z ∂fixedTranscriptLaw (averagedProtocol Q) v r
Proof (Lean source)
-- @node: averagedProtocol_fixedTranscript_lintegral
lemma averagedProtocol_fixedTranscript_lintegral (Q : LocalProtocol n (ObsRecord d))
(v : Fin n → PairedSymbol d) (r : Q.Seed)
(f : ProtocolTranscript Q → ℝ≥0∞) (hf : Measurable f) :
(∫⁻ a, ∫⁻ z, f z ∂fixedTranscriptLaw Q
(fun i => recoverObs (v i) (a i)) r
∂Measure.pi (fun _ : Fin n => ancillaryBitLaw)) =
∫⁻ z, f z ∂fixedTranscriptLaw (averagedProtocol Q) v r :=
averagedProtocol_prefix_lintegral Q v r n le_rfl f hf
theorem averagedProtocol_reconstructed_decisionLaw
Averaging the ancillary bits preserves decisions jointly with both independent coins.
Formal statement
hypotheses
conclusion
(((Measure.pi (fun _ : Fin n => p)).prod (Measure.pi (fun _ : Fin n => ancillaryBitLaw))).prod (Q.seedLaw.prod uniform01)).bind (fun w => (fixedTranscriptLaw Q (fun i => recoverObs (w.1.1 i) (w.1.2 i)) w.2.1).map (fun z => (z,w.2.1,w.2.2)))
= canonicalDecisionLaw (averagedProtocol Q) p
Proof (Lean source)
-- @node: averagedProtocol_reconstructed_decisionLaw
lemma averagedProtocol_reconstructed_decisionLaw (Q : LocalProtocol n (ObsRecord d))
(p : Measure (PairedSymbol d)) [IsProbabilityMeasure p] :
(((Measure.pi (fun _ : Fin n => p)).prod
(Measure.pi (fun _ : Fin n => ancillaryBitLaw))).prod
(Q.seedLaw.prod uniform01)).bind (fun w =>
(fixedTranscriptLaw Q (fun i => recoverObs (w.1.1 i) (w.1.2 i)) w.2.1).map
(fun z => (z,w.2.1,w.2.2))) =
canonicalDecisionLaw (averagedProtocol Q) p := by
haveI : IsProbabilityMeasure uniform01 := ⟨by
simp [uniform01, Measure.restrict_apply, Real.volume_Icc]⟩
ext E hE
let f (w : ((Fin n → PairedSymbol d) × (Fin n → Bool)) × Q.Seed × ℝ) :=
(fixedTranscriptLaw Q (fun i => recoverObs (w.1.1 i) (w.1.2 i)) w.2.1).map
(fun z => (z,w.2.1,w.2.2))
have hf : Measurable f := (measurable_protocol_decisionRows Q).comp
(show Measurable (fun w : ((Fin n → PairedSymbol d) × (Fin n → Bool)) × Q.Seed × ℝ =>
((fun i => recoverObs (w.1.1 i) (w.1.2 i)),w.2)) by fun_prop)
rw [Measure.bind_apply hE hf.aemeasurable]
unfold canonicalDecisionLaw
rw [Measure.bind_apply hE (measurable_protocol_decisionRows (averagedProtocol Q)).aemeasurable]
change (∫⁻ w, f w E ∂((Measure.pi (fun _ : Fin n => p)).prod
(Measure.pi (fun _ : Fin n => ancillaryBitLaw))).prod (Q.seedLaw.prod uniform01)) =
∫⁻ w : (Fin n → PairedSymbol d) × Q.Seed × ℝ,
((transcriptLaw (averagedKernel Q) (fun i => (w.1 i,w.2.1))).map
(fun z => (z,w.2.1,w.2.2))) E
∂(Measure.pi (fun _ : Fin n => p)).prod (Q.seedLaw.prod uniform01)
rw [lintegral_prod (fun w => f w E) ((Measure.measurable_coe hE).comp hf).aemeasurable]
rw [lintegral_prod _ (measurable_of_countable _).aemeasurable, lintegral_prod _ (by
exact ((Measure.measurable_coe hE).comp
(measurable_protocol_decisionRows (averagedProtocol Q))).aemeasurable)]
apply lintegral_congr
intro v
have hswap : Measurable (fun w : (Fin n → Bool) × (Q.Seed × ℝ) => f ((v,w.1),w.2) E) :=
((Measure.measurable_coe hE).comp hf).comp
(show Measurable (fun w : (Fin n → Bool) × (Q.Seed × ℝ) => ((v,w.1),w.2)) by fun_prop)
rw [lintegral_lintegral_swap hswap.aemeasurable]
apply lintegral_congr
intro ru
have hmz : Measurable (fun z : ProtocolTranscript Q => (z,ru.1,ru.2)) := by fun_prop
simp only [f, Measure.map_apply hmz hE]
have hm : Measurable (fun z : ProtocolTranscript Q =>
indicator ((fun z => (z,ru.1,ru.2)) ⁻¹' E) (fun _ => (1 : ℝ≥0∞)) z) := by
exact measurable_const.indicator (hE.preimage hmz)
have h := averagedProtocol_fixedTranscript_lintegral Q v ru.1 _ hm
change (∫⁻ a, ∫⁻ z, indicator ((fun z => (z,ru.1,ru.2)) ⁻¹' E)
(fun _ => (1 : ℝ≥0∞)) z ∂fixedTranscriptLaw Q (fun i => recoverObs (v i) (a i)) ru.1
∂Measure.pi (fun _ : Fin n => ancillaryBitLaw)) =
∫⁻ z, indicator ((fun z => (z,ru.1,ru.2)) ⁻¹' E) (fun _ => (1 : ℝ≥0∞)) z
∂transcriptLaw (averagedKernel Q) (fun i => (v i,ru.1)) at h
simpa only [lintegral_indicator (hE.preimage hmz), lintegral_one,
Measure.restrict_apply_univ] using h
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Bridge.Identification 19 declarations Causal value identities and deterministic signed-input transcript preprocessing.
Causal bridge identification
Causal value identities and deterministic signed-input transcript preprocessing.
def signedCellMean
Fix the probability law P and the coordinate index. Conditional signed cell mean.
Definition (Lean source)
parameters
def
signedCellMean P j :
ℝ
given by
(∫ w, if cell w = j then obsSign (observe w) else 0 ∂P) / P.real {w | cell w = j}
theorem contrast_mem_parameterCube
Assume the causal-model conditions for the data law. Interior arm means put the causal contrast in the declared cube.
Formal statement
hypotheses
conclusion
contrast P ∈ parameterCube d
Proof (Lean source)
-- @node: contrast_mem_parameterCube
lemma contrast_mem_parameterCube (P : Measure (FullRecord d)) (hP : CausalModel P) :
contrast P ∈ parameterCube d := by
intro j
obtain ⟨h0l, h0u⟩ := hP.interior false j
obtain ⟨h1l, h1u⟩ := hP.interior true j
constructor <;> dsimp [contrast] <;> linarith
theorem value_arm_average_decomposition
The armwise maximum splits into the arm average and half the absolute contrast.
Formal statement
Proof (Lean source)
-- @node: value_arm_average_decomposition
lemma value_arm_average_decomposition (P : Measure (FullRecord d)) :
value P = (d : ℝ)⁻¹ * ∑ j, (armMean P false j + armMean P true j)/2 +
signedNorm (contrast P)/2 := by
have hmax (a b : ℝ) : max a b = (a+b)/2 + |b-a|/2 := by
rcases le_total a b with h | h
· rw [max_eq_right h, abs_of_nonneg (sub_nonneg.mpr h)]
ring
· rw [max_eq_left h, abs_of_nonpos (sub_nonpos.mpr h)]
ring
simp only [value, signedNorm, contrast, hmax, Finset.sum_add_distrib,
← Finset.sum_div]
ring
A finite event partitions into its two Boolean marks.
Formal statement
hypotheses
conclusion
P.real E = ∑ b : Bool, P.real {w | w ∈ E ∧ f w = b}
Proof (Lean source)
-- @node: fullRecord_real_split_bool
lemma fullRecord_real_split_bool (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(E : Set (FullRecord d)) (f : FullRecord d → Bool) :
P.real E = ∑ b : Bool, P.real {w | w ∈ E ∧ f w = b} := by
rw [Fintype.sum_bool, ← measureReal_union]
· congr 1
ext w
cases h : f w <;> simp [h]
· rw [Set.disjoint_left]
intro w ha hb
simp only [Set.mem_setOf_eq] at ha hb
simp [ha.2] at hb
· exact MeasurableSet.of_discrete
theorem fair_potential_event
Assume the causal-model conditions for the data law. Fair randomization also holds after marginalizing either potential outcome.
Formal statement
Proof (Lean source)
-- @node: fair_potential_event
lemma fair_potential_event (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(hP : CausalModel P) (j : Fin d) (a y : Bool) :
P.real {w | cell w = j ∧ arm w = a ∧ potential a w = y} =
(1/2 : ℝ) * P.real {w | cell w = j ∧ potential a w = y} := by
cases a
· simp only [potential, Bool.false_eq_true, ↓reduceIte]
rw [fullRecord_real_split_bool P _ outcome1,
fullRecord_real_split_bool P {w | cell w = j ∧ outcome0 w = y} outcome1,
Finset.mul_sum]
apply Finset.sum_congr rfl
intro y1 _
convert hP.fair j false y y1 using 1 <;> congr 2 <;> ext w <;>
simp only [Set.mem_setOf_eq] <;> tauto
· simp only [potential, ↓reduceIte]
rw [fullRecord_real_split_bool P _ outcome0,
fullRecord_real_split_bool P {w | cell w = j ∧ outcome1 w = y} outcome0,
Finset.mul_sum]
apply Finset.sum_congr rfl
intro y0 _
convert hP.fair j true y0 y using 1 <;> congr 2 <;> ext w <;>
simp only [Set.mem_setOf_eq] <;> tauto
theorem causal_consistency_ae
Assume the causal-model conditions for the data law. Consistency in the model gives the corresponding almost-everywhere identity.
Formal statement
hypotheses
Proof (Lean source)
-- @node: causal_consistency_ae
lemma causal_consistency_ae (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(hP : CausalModel P) : ∀ᵐ w ∂P, outcome w = potential (arm w) w := by
apply (ae_iff_prob_eq_one (Measurable.of_discrete)).2
have hh : P.real {w | outcome w = potential (arm w) w} = P.real univ := by
simpa [Consistency] using hP.consistent
exact ((measureReal_eq_measureReal_iff).1 hh).trans (measure_univ)
theorem fair_arm_event
Assume the causal-model conditions for the data law. Marginalizing the potential outcome leaves a fair assignment in each cell.
Formal statement
hypotheses
conclusion
P.real {w | cell w = j ∧ arm w = a} = (1/2 : ℝ) * P.real {w | cell w = j}
Proof (Lean source)
-- @node: fair_arm_event
lemma fair_arm_event (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(hP : CausalModel P) (j : Fin d) (a : Bool) :
P.real {w | cell w = j ∧ arm w = a} =
(1/2 : ℝ) * P.real {w | cell w = j} := by
rw [fullRecord_real_split_bool P {w | cell w = j ∧ arm w = a} (potential a)]
simp only [Set.mem_setOf_eq, and_assoc]
simp_rw [fair_potential_event P hP j a]
rw [← Finset.mul_sum]
simpa only [Set.mem_setOf_eq] using congrArg (fun x : ℝ => (1/2 : ℝ) * x)
(fullRecord_real_split_bool P {w | cell w = j} (potential a)).symm
Integrating a finite event's unit indicator recovers its real probability.
Formal statement
hypotheses
conclusion
(∫ w, if w ∈ E then (1 : ℝ) else 0 ∂P) = P.real E
Proof (Lean source)
-- @node: integral_fullRecord_event
lemma integral_fullRecord_event (P : Measure (FullRecord d)) (E : Set (FullRecord d)) :
(∫ w, if w ∈ E then (1 : ℝ) else 0 ∂P) = P.real E := by
classical
simpa [indicator] using integral_indicator_one (μ := P)
(s := E) MeasurableSet.of_discrete
theorem signedCellMean_eq_contrast
Assume the causal-model conditions for the data law. Signed cell means identify the causal contrast by fair assignment and consistency.
Formal statement
hypotheses
conclusion
signedCellMean P j = contrast P j
Proof (Lean source)
-- @node: signedCellMean_eq_contrast
lemma signedCellMean_eq_contrast (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(hP : CausalModel P) (j : Fin d) : signedCellMean P j = contrast P j := by
classical
have heq : (fun w => if cell w = j then obsSign (observe w) else 0) =ᵐ[P]
(fun w =>
2 * (if cell w = j ∧ arm w = true ∧ potential true w = true then (1 : ℝ) else 0) -
(if cell w = j ∧ arm w = true then (1 : ℝ) else 0) -
2 * (if cell w = j ∧ arm w = false ∧ potential false w = true then (1 : ℝ) else 0) +
(if cell w = j ∧ arm w = false then (1 : ℝ) else 0)) := by
filter_upwards [causal_consistency_ae P hP] with w hw
by_cases hj : cell w = j
· cases ha : arm w <;> cases hy0 : potential false w <;> cases hy1 : potential true w <;>
norm_num [obsSign, observe, hw, ha, hy0, hy1, hj, signVal]
· simp [hj]
have hnum : (∫ w, if cell w = j then obsSign (observe w) else 0 ∂P) =
P.real {w | cell w = j ∧ potential true w = true} -
P.real {w | cell w = j ∧ potential false w = true} := by
rw [integral_congr_ae heq]
have hlin : (∫ w,
2 * (if cell w = j ∧ arm w = true ∧ potential true w = true then (1 : ℝ) else 0) -
(if cell w = j ∧ arm w = true then (1 : ℝ) else 0) -
2 * (if cell w = j ∧ arm w = false ∧ potential false w = true then (1 : ℝ) else 0) +
(if cell w = j ∧ arm w = false then (1 : ℝ) else 0) ∂P) =
2 * P.real {w | cell w = j ∧ arm w = true ∧ potential true w = true} -
P.real {w | cell w = j ∧ arm w = true} -
2 * P.real {w | cell w = j ∧ arm w = false ∧ potential false w = true} +
P.real {w | cell w = j ∧ arm w = false} := by
simp only [← integral_fullRecord_event]
integral_linearity
simp only [Set.mem_setOf_eq]
rw [hlin, fair_potential_event P hP j true true,
fair_potential_event P hP j false true, fair_arm_event P hP j true,
fair_arm_event P hP j false]
ring
simp only [signedCellMean, contrast, armMean, hnum, sub_div]
A signed cell indicator is the difference of its positive and negative atoms.
Formal statement
hypotheses
conclusion
(∫ w, if cell w = j then obsSign (observe w) else 0 ∂P)
= P.real {w | signedObserve (observe w) = (j,true)}
- P.real {w | signedObserve (observe w) = (j,false)}
Proof (Lean source)
-- @node: signed_cell_integral_atoms
lemma signed_cell_integral_atoms (P : Measure (FullRecord d)) [IsProbabilityMeasure P] (j : Fin d) :
(∫ w, if cell w = j then obsSign (observe w) else 0 ∂P) =
P.real {w | signedObserve (observe w) = (j,true)} -
P.real {w | signedObserve (observe w) = (j,false)} := by
have heq : (fun w : FullRecord d => if cell w = j then obsSign (observe w) else 0) =
(fun w => (if signedObserve (observe w) = (j,true) then (1 : ℝ) else 0) -
(if signedObserve (observe w) = (j,false) then (1 : ℝ) else 0)) := by
funext w
rcases w with ⟨j', a, y, y0, y1⟩
by_cases hj : j' = j <;> cases a <;> cases y <;>
simp [cell, obsSign, observe, signedObserve, signVal, arm, outcome, hj]
rw [heq]
simp only [← integral_fullRecord_event]
integral_linearity
simp only [Set.mem_setOf_eq]
theorem causal_signed_atom
Assume the causal-model conditions for the data law and positive dimension. A sign-valued conditional mean determines both signed atom probabilities.
Formal statement
hypotheses
conclusion
P.real {w | signedObserve (observe w) = (j,s)} = (1 + signVal s * contrast P j)/(2*d)
Proof (Lean source)
-- @node: causal_signed_atom
lemma causal_signed_atom (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(hP : CausalModel P) (hd : 0 < d) (j : Fin d) (s : Bool) :
P.real {w | signedObserve (observe w) = (j,s)} =
(1 + signVal s * contrast P j)/(2*d) := by
have hsplit := fullRecord_real_split_bool P {w | cell w = j}
(fun w => (signedObserve (observe w)).2)
have hatom (b : Bool) : {w : FullRecord d | cell w = j ∧
(signedObserve (observe w)).2 = b} =
{w | signedObserve (observe w) = (j,b)} := by
ext w
simp [signedObserve, observe, cell]
simp only [Set.mem_setOf_eq, hatom, Fintype.sum_bool] at hsplit
rw [hP.uniform j] at hsplit
have hmean := signedCellMean_eq_contrast P hP j
simp only [signedCellMean, signed_cell_integral_atoms, hP.uniform j] at hmean
have hdR : (d : ℝ) ≠ 0 := by exact_mod_cast (Nat.ne_of_gt hd)
have hdiff := (div_eq_iff (inv_ne_zero hdR)).mp hmean
calc
_ = ((d : ℝ)⁻¹ + signVal s *
(P.real {w | signedObserve (observe w) = (j,true)} -
P.real {w | signedObserve (observe w) = (j,false)}))/2 := by
cases s <;> simp only [signVal, Bool.false_eq_true, ↓reduceIte] <;>
linarith [hsplit]
_ = _ := by rw [hdiff]; field_simp <;> ring
theorem causal_signed_law
Assume the causal-model conditions for the data law and positive dimension. The observed signed marginal is the paired law identified by the causal contrast.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: causal_signed_law
lemma causal_signed_law (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(hP : CausalModel P) (hd : 0 < d) :
(observedLaw P).map signedObserve = pairedLaw (contrast P) := by
have hprob : IsProbabilityMeasure (pairedLaw (contrast P)) :=
pairedFamily_subset_simplex hd
(Set.mem_image_of_mem pairedLaw (contrast_mem_parameterCube P hP))
letI := hprob
haveI : IsProbabilityMeasure (observedLaw P) := by
unfold observedLaw
exact Measure.isProbabilityMeasure_map (by fun_prop)
haveI : IsProbabilityMeasure ((observedLaw P).map signedObserve) :=
Measure.isProbabilityMeasure_map (by fun_prop)
apply Measure.ext_of_singleton
rintro ⟨j,s⟩
apply (measureReal_eq_measureReal_iff).mp
rw [observedLaw, Measure.map_map (by fun_prop) (by fun_prop),
Measure.real, Measure.map_apply (by fun_prop) MeasurableSet.of_discrete]
change P.real {w | signedObserve (observe w) = (j,s)} = _
rw [causal_signed_atom P hP hd]
unfold pairedLaw
rw [atomLaw_real_singleton]
intro v
have h := contrast_mem_parameterCube P hP v.1
apply div_nonneg _ (by positivity)
cases v.2 <;> simp only [signVal, Bool.false_eq_true, ↓reduceIte] <;> linarith [h.1, h.2]
theorem causal_cell_outcome_integral
Assume the causal-model conditions for the data law. The observed outcome in each cell averages the two potential-outcome marginals.
Formal statement
hypotheses
Proof (Lean source)
-- @node: causal_cell_outcome_integral
lemma causal_cell_outcome_integral (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(hP : CausalModel P) (j : Fin d) :
(∫ w, if cell w = j then bitVal (outcome w) else 0 ∂P) =
(P.real {w | cell w = j ∧ potential false w = true} +
P.real {w | cell w = j ∧ potential true w = true})/2 := by
classical
have heq : (fun w => if cell w = j then bitVal (outcome w) else 0) =ᵐ[P]
(fun w =>
(if cell w = j ∧ arm w = false ∧ potential false w = true then (1 : ℝ) else 0) +
(if cell w = j ∧ arm w = true ∧ potential true w = true then (1 : ℝ) else 0)) := by
filter_upwards [causal_consistency_ae P hP] with w hw
by_cases hj : cell w = j
· cases ha : arm w <;> cases hy0 : potential false w <;> cases hy1 : potential true w <;>
norm_num [bitVal, hw, ha, hy0, hy1, hj]
· simp [hj]
rw [integral_congr_ae heq]
integral_linearity
have hfalse := integral_fullRecord_event P
{w | cell w = j ∧ arm w = false ∧ potential false w = true}
have htrue := integral_fullRecord_event P
{w | cell w = j ∧ arm w = true ∧ potential true w = true}
simp only [Set.mem_setOf_eq] at hfalse htrue
rw [hfalse, htrue, fair_potential_event P hP j false true,
fair_potential_event P hP j true true]
ring
theorem baseline_eq_arm_average
Assume the causal-model conditions for the data law and dimension at least two. Uniform cells and randomization identify the outcome baseline with the mean arm average.
Formal statement
hypotheses
Proof (Lean source)
-- @node: baseline_eq_arm_average
lemma baseline_eq_arm_average (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(hP : CausalModel P) (hd : 2 ≤ d) :
baseline P = (d : ℝ)⁻¹ * ∑ j, (armMean P false j + armMean P true j)/2 := by
classical
have hd0 : (d : ℝ) ≠ 0 := by exact_mod_cast (by omega : d ≠ 0)
have hcell (a : Bool) (j : Fin d) :
P.real {w | cell w = j ∧ potential a w = true} = (d : ℝ)⁻¹ * armMean P a j := by
simp only [armMean, hP.uniform j]
field_simp
have hsum : (fun w => bitVal (outcome w)) =
(fun w => ∑ j : Fin d, if cell w = j then bitVal (outcome w) else 0) := by
funext w
simp
have hbase : baseline P = ∫ w, bitVal (outcome w) ∂P := by
simpa only [baseline, bitVal, Set.mem_setOf_eq] using (integral_fullRecord_event P {w | outcome w = true}).symm
rw [hbase, hsum]
integral_linearity
simp_rw [causal_cell_outcome_integral P hP, hcell]
rw [Finset.mul_sum]
apply Finset.sum_congr rfl
intro j _
ring
theorem causal_value_decomposition
Assume the causal-model conditions for the data law and dimension at least two. The causal value equals the observed baseline plus half the signed contrast norm.
Formal statement
hypotheses
conclusion
value P = baseline P + signedNorm (contrast P)/2
Proof (Lean source)
-- @node: causal_value_decomposition
lemma causal_value_decomposition (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(hP : CausalModel P) (hd : 2 ≤ d) :
value P = baseline P + signedNorm (contrast P)/2 := by
rw [value_arm_average_decomposition, baseline_eq_arm_average P hP hd]
theorem symmetricLaw_value
Assume the stated htheta condition and positive dimension. The symmetric arm means give contrast theta and average welfare one half.
Formal statement
hypotheses
conclusion
value (symmetricLaw theta) = 1/2 + signedNorm theta/2
Proof (Lean source)
-- @node: symmetricLaw_value
lemma symmetricLaw_value (theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d)
(hd : 0 < d) : value (symmetricLaw theta) = 1/2 + signedNorm theta/2 := by
have hcontrast : contrast (symmetricLaw theta) = theta := by
funext j
simp only [contrast, symmetricLaw_armMean theta htheta hd, signVal,
Bool.false_eq_true, ↓reduceIte]
ring
rw [value_arm_average_decomposition, hcontrast]
have havg : ∀ j : Fin d,
(armMean (symmetricLaw theta) false j + armMean (symmetricLaw theta) true j)/2 =
(1/2 : ℝ) := by
intro j
simp only [symmetricLaw_armMean theta htheta hd, signVal,
Bool.false_eq_true, ↓reduceIte]
ring
simp_rw [havg]
have hdR : (d : ℝ) ≠ 0 := by exact_mod_cast (Nat.ne_of_gt hd)
simp [hdR]
theorem pulledProtocol_prefixLaw
Assume order no larger than the sample size. Deterministic preprocessing preserves every recursively constructed prefix law.
Formal statement
hypotheses
conclusion
prefixLaw (pulledProtocol K).kernels (fun i => (o i,r)) k hk
= prefixLaw K.kernels (fun i => (signedObserve (o i),r)) k hk
Proof (Lean source)
-- @node: pulledProtocol_prefixLaw
lemma pulledProtocol_prefixLaw (K : LocalProtocol n (PairedSymbol d))
(o : Fin n → ObsRecord d) (r : K.Seed) (k : ℕ) (hk : k ≤ n) :
prefixLaw
(pulledProtocol K).kernels (fun i => (o i,r)) k hk =
prefixLaw
K.kernels (fun i => (signedObserve (o i),r)) k hk := by
induction k with
| zero => rfl
| succ k ih =>
rw [prefixLaw_succ,
prefixLaw_succ, ih]
congr 2
theorem pulledProtocol_fixedTranscriptLaw
Fixed transcripts under signed preprocessing are exactly paired-input transcripts.
Formal statement
hypotheses
conclusion
fixedTranscriptLaw (pulledProtocol K) o r
= fixedTranscriptLaw K (fun i => signedObserve (o i)) r
Proof (Lean source)
-- @node: pulledProtocol_fixedTranscriptLaw
lemma pulledProtocol_fixedTranscriptLaw (K : LocalProtocol n (PairedSymbol d))
(o : Fin n → ObsRecord d) (r : K.Seed) :
fixedTranscriptLaw (pulledProtocol K) o r =
fixedTranscriptLaw K (fun i => signedObserve (o i)) r :=
pulledProtocol_prefixLaw K o r n le_rfl
theorem pulledProtocol_decisionLaw
Assume independent and identically distributed participant records, independent protocol randomness, dimension at least two, and the stated htheta condition. Signed preprocessing pushes the full iid decision experiment to the paired one.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
S :
SamplingScheme n d
hIID :
hRandom :
hd :
2 ≤ d
K :
LocalProtocol n (PairedSymbol d)
theta :
Fin d → ℝ
htheta :
theta ∈ parameterCube d
conclusion
= canonicalDecisionLaw K (pairedLaw theta)
Proof (Lean source)
-- @node: pulledProtocol_decisionLaw
lemma pulledProtocol_decisionLaw (S : SamplingScheme n d) (hIID : IidPeople S)
(hRandom : IndependentRandomness S) (hd : 2 ≤ d)
(K : LocalProtocol n (PairedSymbol d)) (theta : Fin d → ℝ)
(htheta : theta ∈ parameterCube d) :
decisionLaw S (pulledProtocol K) (symmetricLaw theta) =
canonicalDecisionLaw K (pairedLaw theta) := by
haveI := symmetricLaw_probability theta htheta (by omega)
have hmodel := symmetricLaw_causalModel theta htheta (by omega)
have hcontrast : contrast (symmetricLaw theta) = theta := by
funext j
simp only [contrast, symmetricLaw_armMean theta htheta (by omega), signVal,
Bool.false_eq_true, ↓reduceIte]
ring
have hsigned : (observedLaw (symmetricLaw theta)).map signedObserve = pairedLaw theta := by
rw [causal_signed_law _ hmodel (by omega), hcontrast]
let f : ((Fin n → ObsRecord d) × K.Seed × ℝ) →
((Fin n → PairedSymbol d) × K.Seed × ℝ) :=
fun w => (fun i => signedObserve (w.1 i), w.2)
have hf : Measurable f := by fun_prop
haveI : IsProbabilityMeasure (observedLaw (symmetricLaw theta)) := by
exact Measure.isProbabilityMeasure_map (show Measurable observe by fun_prop).aemeasurable
haveI : IsProbabilityMeasure ((observedLaw (symmetricLaw theta)).map signedObserve) :=
Measure.isProbabilityMeasure_map (show Measurable signedObserve by fun_prop).aemeasurable
have hpi : (Measure.pi (fun _ : Fin n => observedLaw (symmetricLaw theta))).map
(fun o i => signedObserve (o i)) = Measure.pi (fun _ : Fin n => pairedLaw theta) := by
rw [Measure.pi_map_pi (fun _ => (show Measurable signedObserve by fun_prop).aemeasurable)]
simp only [hsigned]
haveI : IsProbabilityMeasure uniform01 := ⟨by
simp [uniform01, Measure.restrict_apply, Real.volume_Icc]⟩
have hinput : ((Measure.pi (fun _ : Fin n => observedLaw (symmetricLaw theta))).prod
(K.seedLaw.prod uniform01)).map f =
(Measure.pi (fun _ : Fin n => pairedLaw theta)).prod (K.seedLaw.prod uniform01) := by
rw [← hpi]
have hmap := (Measure.map_prod_map
(Measure.pi (fun _ : Fin n => observedLaw (symmetricLaw theta)))
(K.seedLaw.prod uniform01)
(show Measurable (fun o : Fin n → ObsRecord d => fun i => signedObserve (o i))
by fun_prop) (measurable_id : Measurable (id : K.Seed × ℝ → K.Seed × ℝ))).symm
have hfun : map (fun o : Fin n → ObsRecord d => fun i => signedObserve (o i))
(id : K.Seed × ℝ → K.Seed × ℝ) = f := by
funext w
cases w
rfl
rw [hfun, Measure.map_id] at hmap
exact hmap
unfold decisionLaw canonicalDecisionLaw
change ((S K.Seed K.seedLaw (symmetricLaw theta)).bind (fun w =>
(fixedTranscriptLaw (pulledProtocol K) w.1 w.2.1).map
(fun z => (z,w.2.1,w.2.2)))) = _
rw [hRandom K.Seed K.seedLaw (symmetricLaw theta) hmodel,
hIID K.Seed K.seedLaw (symmetricLaw theta) hmodel]
simp only [pulledProtocol_fixedTranscriptLaw]
rw [← hinput]
unfold Measure.bind
rw [Measure.map_map (measurable_protocol_decisionRows K) hf]
rfl
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Bridge.Protocol 34 declarations Causal identification, symmetric-law certificates, and private experiment equivalence.
Ancillary protocol preprocessing
Causal identification, symmetric-law certificates, and private experiment equivalence.
def recoverObs
Fix the parameter v and the binary value a. Reconstruct the original observation using an ancillary assignment bit.
Definition (Lean source)
parameters
def
given by
(v.1,a,if v.2 then a else !a)
theorem measurable_recoverInput
For a protocol, participant index, and ancillary bit, the recovered-input map is measurable.
Formal statement
hypotheses
conclusion
Measurable (fun w : (PairedSymbol d × Q.Seed) × ProtocolHistory Q i => ((recoverObs w.1.1 a,w.1.2),w.2))
Proof (Lean source)
-- @node: measurable_recoverInput
@[fun_prop] lemma measurable_recoverInput (Q : LocalProtocol n (ObsRecord d))
(i : Fin n) (a : Bool) :
Measurable (fun w : (PairedSymbol d × Q.Seed) × ProtocolHistory Q i =>
((recoverObs w.1.1 a,w.1.2),w.2)) := by
fun_prop
def recoveredKernel
Fix the local protocol Q, the participant index, and the binary value a. Original stage kernel evaluated on a recovered ancillary assignment.
Definition (Lean source)
parameters
def
given by
(Q.kernels i).comap (fun w => ((recoverObs w.1.1 a,w.1.2),w.2)) (measurable_recoverInput Q i a)
def averagedRows
Fix the local protocol Q, the participant index, and the parameter w. Fair mixture of original-record rows at a paired input.
Definition (Lean source)
parameters
n :
ℕ
d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
i :
Fin n
w :
(PairedSymbol d × Q.Seed) × ProtocolHistory Q i
def
given by
theorem averagedRows_measurable
For a protocol and participant index, the ancillary fair mixture is jointly measurable.
Formal statement
hypotheses
conclusion
Measurable (averagedRows Q i)
Proof (Lean source)
-- @node: averagedRows_measurable
@[fun_prop] lemma averagedRows_measurable (Q : LocalProtocol n (ObsRecord d)) (i : Fin n) :
Measurable (averagedRows Q i) := by
apply Measure.measurable_of_measurable_coe
intro E hE
simp only [averagedRows, Measure.add_apply, Measure.smul_apply, smul_eq_mul]
exact (measurable_const.mul ((recoveredKernel Q i false).measurable_coe hE)).add
(measurable_const.mul ((recoveredKernel Q i true).measurable_coe hE))
def averagedKernel
Fix the local protocol Q and the participant index. Averaged paired-input kernel with the ancillary fair bit integrated out.
Definition (Lean source)
theorem averagedKernel_markov
The average remains a Markov kernel.
Formal statement
hypotheses
conclusion
IsMarkovKernel (averagedKernel Q i)
Proof (Lean source)
-- @node: averagedKernel_markov
lemma averagedKernel_markov (Q : LocalProtocol n (ObsRecord d)) (i : Fin n) :
IsMarkovKernel (averagedKernel Q i) := by
constructor
intro w
constructor
change (ofReal (1/2 : ℝ) • recoveredKernel Q i false w +
ofReal (1/2 : ℝ) • recoveredKernel Q i true w) univ = 1
have hfalse : IsProbabilityMeasure (recoveredKernel Q i false w) := by
unfold recoveredKernel
infer_instance
have htrue : IsProbabilityMeasure (recoveredKernel Q i true w) := by
unfold recoveredKernel
infer_instance
simp only [Measure.add_apply, Measure.smul_apply, measure_univ, smul_eq_mul, mul_one]
rw [← ENNReal.ofReal_add (by norm_num) (by norm_num)]
norm_num
def averagedProtocol
Fix the local protocol Q. Averaged paired-input protocol, retaining the same seed and message spaces.
Definition (Lean source)
parameters
def
given by
clause 1
Seed := Q.Seed
clause 2
seedMeasurable := Q.seedMeasurable
clause 3
seedStandard := Q.seedStandard
clause 4
seedLaw := Q.seedLaw
clause 5
seedProbability := Q.seedProbability
clause 6
Message := Q.Message
clause 7
messageMeasurable := Q.messageMeasurable
clause 8
messageStandard := Q.messageStandard
clause 9
kernels := averagedKernel Q
clause 10
markov := averagedKernel_markov Q
theorem measurable_signedInput
For a paired protocol and participant index, the signed-observation pullback map is measurable.
Formal statement
hypotheses
conclusion
Measurable (fun w : (ObsRecord d × K.Seed) × ProtocolHistory K i => ((signedObserve w.1.1,w.1.2),w.2))
Proof (Lean source)
-- @node: measurable_signedInput
@[fun_prop] lemma measurable_signedInput (K : LocalProtocol n (PairedSymbol d)) (i : Fin n) :
Measurable (fun w : (ObsRecord d × K.Seed) × ProtocolHistory K i =>
((signedObserve w.1.1,w.1.2),w.2)) := by
fun_prop
def pulledKernel
Fix the local protocol K and the participant index. Pulled-back original-record kernel.
Definition (Lean source)
parameters
def
given by
(K.kernels i).comap (fun w => ((signedObserve w.1.1,w.1.2),w.2)) (measurable_signedInput K i)
theorem pulledKernel_markov
Pullback Markov certificate.
Formal statement
hypotheses
conclusion
IsMarkovKernel (pulledKernel K i)
Proof (Lean source)
-- @node: pulledKernel_markov
lemma pulledKernel_markov (K : LocalProtocol n (PairedSymbol d)) (i : Fin n) :
IsMarkovKernel (pulledKernel K i) := by
unfold pulledKernel
infer_instance
def pulledProtocol
Fix the local protocol K. Deterministic signed preprocessing in the reverse direction.
Definition (Lean source)
parameters
def
given by
clause 1
Seed := K.Seed
clause 2
seedMeasurable := K.seedMeasurable
clause 3
seedStandard := K.seedStandard
clause 4
seedLaw := K.seedLaw
clause 5
seedProbability := K.seedProbability
clause 6
Message := K.Message
clause 7
messageMeasurable := K.messageMeasurable
clause 8
messageStandard := K.messageStandard
clause 9
kernels := pulledKernel K
clause 10
markov := pulledKernel_markov K
theorem averagedProtocol_privacy
Assume the full participant record. Averaging the ancillary assignment preserves the all-history privacy inequality.
Formal statement
hypotheses
conclusion
FullRecordPrivacy (averagedProtocol Q) eps
Proof (Lean source)
-- @node: averagedProtocol_privacy
lemma averagedProtocol_privacy (Q : LocalProtocol n (ObsRecord d)) (eps : ℝ)
(hQ : FullRecordPrivacy Q eps) : FullRecordPrivacy (averagedProtocol Q) eps := by
unfold FullRecordPrivacy
dsimp only [averagedProtocol]
intro i v v' eta r E hE
change (averagedRows Q i ((v,r),eta)) E ≤
ofReal (exp eps) * (averagedRows Q i ((v',r),eta)) E
simp only [averagedRows, Measure.add_apply, Measure.smul_apply, smul_eq_mul,
recoveredKernel, Kernel.comap_apply, Measure.add_apply, Measure.smul_apply, smul_eq_mul]
have hf := hQ i (recoverObs v false) (recoverObs v' false) eta r E hE
have ht := hQ i (recoverObs v true) (recoverObs v' true) eta r E hE
calc
_ ≤ ofReal (1/2 : ℝ) *
(ofReal (exp eps) * Q.kernels i ((recoverObs v' false,r),eta) E) +
ofReal (1/2 : ℝ) *
(ofReal (exp eps) * Q.kernels i ((recoverObs v' true,r),eta) E) :=
add_le_add (by gcongr) (by gcongr)
_ = _ := by ring
theorem averagedProtocol_noninteraction
Assume the stated privacy condition for the protocol. Averaging the ancillary assignment preserves history independence.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: averagedProtocol_noninteraction
lemma averagedProtocol_noninteraction (Q : LocalProtocol n (ObsRecord d))
(hQ : Noninteraction Q) : Noninteraction (averagedProtocol Q) := by
intro i v eta eta' r
change averagedRows Q i ((v,r),eta) = averagedRows Q i ((v,r),eta')
simp only [averagedRows, recoveredKernel, Kernel.comap_apply]
rw [hQ i (recoverObs v false) eta eta' r, hQ i (recoverObs v true) eta eta' r]
theorem pulledProtocol_privacy
Assume the full participant record. Signed deterministic preprocessing preserves the all-history privacy inequality.
Formal statement
hypotheses
conclusion
FullRecordPrivacy (pulledProtocol K) eps
Proof (Lean source)
-- @node: pulledProtocol_privacy
lemma pulledProtocol_privacy (K : LocalProtocol n (PairedSymbol d)) (eps : ℝ)
(hK : FullRecordPrivacy K eps) : FullRecordPrivacy (pulledProtocol K) eps := by
intro i o o' eta r E hE
exact hK i (signedObserve o) (signedObserve o') eta r E hE
theorem pulledProtocol_noninteraction
Assume the stated privacy condition for the protocol. Signed deterministic preprocessing preserves history independence.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: pulledProtocol_noninteraction
lemma pulledProtocol_noninteraction (K : LocalProtocol n (PairedSymbol d))
(hK : Noninteraction K) : Noninteraction (pulledProtocol K) := by
intro i o eta eta' r
exact hK i (signedObserve o) eta eta' r
theorem signed_protocol_classes
Both directions of the ancillary-bit construction preserve the two protocol classes.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
eps :
ℝ
conclusion
conclusion 1
Q :
LocalProtocol n (ObsRecord d)
SequentialClass Q eps
SequentialClass (averagedProtocol Q) eps
NoninteractiveClass Q eps
NoninteractiveClass (averagedProtocol Q) eps
conclusion 2
K :
LocalProtocol n (PairedSymbol d)
SequentialClass K eps
SequentialClass (pulledProtocol K) eps
NoninteractiveClass K eps
NoninteractiveClass (pulledProtocol K) eps
Proof (Lean source)
-- @node: signed_protocol_classes
lemma signed_protocol_classes (eps : ℝ) :
(∀ Q : LocalProtocol n (ObsRecord d),
(SequentialClass Q eps → SequentialClass (averagedProtocol Q) eps) ∧
(NoninteractiveClass Q eps → NoninteractiveClass (averagedProtocol Q) eps)) ∧
(∀ K : LocalProtocol n (PairedSymbol d),
(SequentialClass K eps → SequentialClass (pulledProtocol K) eps) ∧
(NoninteractiveClass K eps → NoninteractiveClass (pulledProtocol K) eps)) := by
constructor
· intro Q
constructor
· intro hQ
exact ⟨averagedProtocol_privacy Q eps hQ.privacy⟩
· intro hQ
exact ⟨averagedProtocol_privacy Q eps hQ.privacy,
averagedProtocol_noninteraction Q hQ.noninteraction⟩
· intro K
constructor
· intro hK
exact ⟨pulledProtocol_privacy K eps hK.privacy⟩
· intro hK
exact ⟨pulledProtocol_privacy K eps hK.privacy,
pulledProtocol_noninteraction K hK.noninteraction⟩
Recovering an observation gives its specified paired input back.
Formal statement
Proof (Lean source)
-- @node: signedObserve_recoverObs
lemma signedObserve_recoverObs (v : PairedSymbol d) (a : Bool) :
signedObserve (recoverObs v a) = v := by
rcases v with ⟨j,s⟩
cases s <;> cases a <;> rfl
The observed outcome sign is reconstructed from the signed observation and assignment.
Formal statement
Proof (Lean source)
-- @node: outcome_sign_reconstruction
lemma outcome_sign_reconstruction (w : FullRecord d) :
signVal (outcome w) = obsSign (observe w) * signVal (arm w) := by
rcases w with ⟨j,a,y,y0,y1⟩
cases a <;> cases y <;> norm_num [outcome, obsSign, observe, arm, signVal]
theorem symmetricLaw_observed_recover_real
Assume the stated htheta condition. The recovered original-record atom has exactly half its paired-input mass. [](.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: symmetricLaw_observed_recover_real
lemma symmetricLaw_observed_recover_real (theta : Fin d → ℝ)
(htheta : theta ∈ parameterCube d) (v : PairedSymbol d) (a : Bool) :
(observedLaw (symmetricLaw theta)).real {recoverObs v a} =
(pairedLaw theta).real {v}/2 := by
rw [observedLaw, Measure.real, Measure.map_apply (by fun_prop)
(MeasurableSet.singleton _)]
change (symmetricLaw theta).real (observe ⁻¹' {recoverObs v a}) = _
have hevent : observe ⁻¹' {recoverObs v a} =
{w | cell w = v.1 ∧ signedObserve (observe w) = v ∧ arm w = a} := by
ext w
rcases v with ⟨j,s⟩
rcases w with ⟨j',a',y,y0,y1⟩
cases s <;> cases a <;> cases a' <;> cases y <;>
simp [observe, recoverObs, signedObserve, cell, arm]
rw [hevent]
exact symmetricLaw_ancillary theta htheta v.1 v.2 a
Every observed atom is reconstructed from its signed input and assignment.
Formal statement
Proof (Lean source)
-- @node: recoverObs_signedObserve
lemma recoverObs_signedObserve (o : ObsRecord d) :
recoverObs (signedObserve o) o.2.1 = o := by
rcases o with ⟨j,a,y⟩
cases a <;> cases y <;> rfl
theorem symmetricLaw_observed_singleton
Assume the stated htheta condition and positive dimension. Original-record singleton probabilities factor into paired mass and a fair bit.
Formal statement
hypotheses
conclusion
observedLaw (symmetricLaw theta) {o}
Proof (Lean source)
-- @node: symmetricLaw_observed_singleton
lemma symmetricLaw_observed_singleton (theta : Fin d → ℝ)
(htheta : theta ∈ parameterCube d) (hd : 0 < d) (o : ObsRecord d) :
observedLaw (symmetricLaw theta) {o} =
ofReal (1/2 : ℝ) * pairedLaw theta {signedObserve o} := by
haveI := symmetricLaw_probability theta htheta hd
haveI : IsProbabilityMeasure (observedLaw (symmetricLaw theta)) :=
Measure.isProbabilityMeasure_map (show Measurable observe by fun_prop).aemeasurable
haveI : IsProbabilityMeasure (pairedLaw theta) :=
pairedFamily_subset_simplex hd (Set.mem_image_of_mem pairedLaw htheta)
apply (ENNReal.toReal_eq_toReal_iff' (measure_ne_top _ _) (by finiteness)).mp
rw [ENNReal.toReal_mul, ENNReal.toReal_ofReal (by norm_num)]
change (observedLaw (symmetricLaw theta)).real {o} =
(1/2 : ℝ) * (pairedLaw theta).real {signedObserve o}
have h := symmetricLaw_observed_recover_real theta htheta (signedObserve o) o.2.1
rw [recoverObs_signedObserve] at h
linarith
theorem averagedKernel_integrated_row
Assume the stated htheta condition and positive dimension. At every history and seed, integrating the original row equals integrating its ancillary-bit average against the paired law. This is the one-stage experiment identity.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
theta :
Fin d → ℝ
htheta :
theta ∈ parameterCube d
hd :
0 < d
i :
Fin n
eta :
ProtocolHistory Q i
r :
Q.Seed
E :
Set (Q.Message i)
conclusion
(∫⁻ o, Q.kernels i ((o,r),eta) E ∂observedLaw (symmetricLaw theta))
= ∫⁻ v, averagedKernel Q i ((v,r),eta) E ∂pairedLaw theta
Proof (Lean source)
-- @node: averagedKernel_integrated_row
lemma averagedKernel_integrated_row (Q : LocalProtocol n (ObsRecord d))
(theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d) (hd : 0 < d)
(i : Fin n) (eta : ProtocolHistory Q i) (r : Q.Seed)
(E : Set (Q.Message i)) :
(∫⁻ o, Q.kernels i ((o,r),eta) E ∂observedLaw (symmetricLaw theta)) =
∫⁻ v, averagedKernel Q i ((v,r),eta) E ∂pairedLaw theta := by
rw [lintegral_fintype, lintegral_fintype]
simp_rw [symmetricLaw_observed_singleton theta htheta hd]
rw [Fintype.sum_prod_type, Fintype.sum_prod_type]
apply Finset.sum_congr rfl
intro j _
simp only [Fintype.sum_prod_type, Fintype.sum_bool, averagedKernel, averagedRows,
Kernel.coe_mk, Measure.add_apply, Measure.smul_apply, smul_eq_mul, recoveredKernel,
Kernel.comap_apply, signedObserve, recoverObs]
simp only [Bool.false_eq_true, ↓reduceIte, Bool.not_false, Bool.not_true,
show (true == true) = true from rfl, show (true == false) = false from rfl,
show (false == true) = false from rfl, show (false == false) = true from rfl]
ring
theorem averagedKernel_marginal_messageLaw
Assume the stated htheta condition and positive dimension. Integrating out the next iid participant gives the same message measure in both experiments, with no restriction on the history or public seed.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
theta :
Fin d → ℝ
htheta :
theta ∈ parameterCube d
hd :
0 < d
i :
Fin n
eta :
ProtocolHistory Q i
r :
Q.Seed
conclusion
(observedLaw (symmetricLaw theta)).bind (fun o => Q.kernels i ((o,r),eta))
Proof (Lean source)
-- @node: averagedKernel_marginal_messageLaw
lemma averagedKernel_marginal_messageLaw (Q : LocalProtocol n (ObsRecord d))
(theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d) (hd : 0 < d)
(i : Fin n) (eta : ProtocolHistory Q i) (r : Q.Seed) :
(observedLaw (symmetricLaw theta)).bind (fun o => Q.kernels i ((o,r),eta)) =
(pairedLaw theta).bind (fun v => averagedKernel Q i ((v,r),eta)) := by
ext E hE
rw [Measure.bind_apply hE (by fun_prop), Measure.bind_apply hE (by fun_prop)]
exact averagedKernel_integrated_row Q theta htheta hd i eta r E
theorem protocol_prefixLaw_congr_inputs
Assume order no larger than the sample size and the function hxy. An adaptive prefix uses only records from participants already queried.
Formal statement
hypotheses
n :
ℕ
α :
Type
Q :
LocalProtocol n α
x y :
Fin n → α × Q.Seed
k :
ℕ
hk :
k ≤ n
hxy :
∀ i : Fin n
if
i.val < k
then
x i = y i
Proof (Lean source)
-- @node: protocol_prefixLaw_congr_inputs
lemma protocol_prefixLaw_congr_inputs {α : Type} [MeasurableSpace α]
(Q : LocalProtocol n α) (x y : Fin n → α × Q.Seed)
(k : ℕ) (hk : k ≤ n) (hxy : ∀ i : Fin n, i.val < k → x i = y i) :
prefixLaw Q.kernels x k hk =
prefixLaw Q.kernels y k hk := by
induction k with
| zero => rfl
| succ k ih =>
rw [prefixLaw_succ,
prefixLaw_succ,
ih (le_of_succ_le hk) (fun i hi => hxy i (by omega))]
have hnext := hxy (nextIndex hk) (by
simp [nextIndex])
simp only [hnext]
theorem protocol_prefixLaw_update_next
Assume one plus the stage index no larger than the sample size. Changing the next participant cannot change the preceding adaptive history law.
Formal statement
hypotheses
n :
ℕ
α :
Type
Q :
LocalProtocol n α
x :
Fin n → α × Q.Seed
k :
ℕ
hk :
k + 1 ≤ n
v :
α × Q.Seed
conclusion
= prefixLaw Q.kernels x k (le_of_succ_le hk)
Proof (Lean source)
-- @node: protocol_prefixLaw_update_next
lemma protocol_prefixLaw_update_next {α : Type} [MeasurableSpace α]
(Q : LocalProtocol n α) (x : Fin n → α × Q.Seed)
(k : ℕ) (hk : k + 1 ≤ n) (v : α × Q.Seed) :
prefixLaw Q.kernels
(update x (nextIndex hk) v)
k (le_of_succ_le hk) =
prefixLaw Q.kernels x
k (le_of_succ_le hk) := by
apply protocol_prefixLaw_congr_inputs
intro i hi
apply Function.update_of_ne
intro heq
have := congrArg val heq
simp [nextIndex] at this
omega
theorem averagedKernel_extend_history
Averaging the ancillary assignment at a next step commutes with extending any previous history law, including an adaptive law.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
i :
Fin n
mu :
Measure (ProtocolHistory Q i)
v :
r :
Q.Seed
conclusion
mu ⊗ₘ (averagedKernel Q i).comap (fun eta => ((v,r),eta)) (by fun_prop)
= ofReal (1/2 : ℝ) • (mu ⊗ₘ (Q.kernels i).comap (fun eta => ((recoverObs v false,r),eta)) (by fun_prop))
+ ofReal (1/2 : ℝ) • (mu ⊗ₘ (Q.kernels i).comap (fun eta => ((recoverObs v true,r),eta)) (by fun_prop))
Proof (Lean source)
-- @node: averagedKernel_extend_history
lemma averagedKernel_extend_history (Q : LocalProtocol n (ObsRecord d))
(i : Fin n) (mu : Measure (ProtocolHistory Q i)) [IsFiniteMeasure mu]
(v : PairedSymbol d) (r : Q.Seed) :
mu ⊗ₘ (averagedKernel Q i).comap (fun eta => ((v,r),eta)) (by fun_prop) =
ofReal (1/2 : ℝ) •
(mu ⊗ₘ (Q.kernels i).comap (fun eta => ((recoverObs v false,r),eta)) (by fun_prop)) +
ofReal (1/2 : ℝ) •
(mu ⊗ₘ (Q.kernels i).comap (fun eta => ((recoverObs v true,r),eta)) (by fun_prop)) := by
haveI := averagedKernel_markov Q i
ext E hE
rw [Measure.compProd_apply hE, Measure.add_apply, Measure.smul_apply,
Measure.smul_apply, Measure.compProd_apply hE, Measure.compProd_apply hE]
simp only [Kernel.comap_apply, averagedKernel, Kernel.coe_mk, averagedRows,
recoveredKernel, Measure.add_apply, Measure.smul_apply, smul_eq_mul]
have hm (a : Bool) : Measurable (fun eta : ProtocolHistory Q i =>
Q.kernels i ((recoverObs v a,r),eta) (Prod.mk eta ⁻¹' E)) := by
exact Kernel.measurable_kernel_prodMk_left' (η := Q.kernels i) hE (recoverObs v a,r)
rw [lintegral_add_left ((hm false).const_mul _), lintegral_const_mul _ (hm false),
lintegral_const_mul _ (hm true)]
theorem averagedKernel_prefix_step
Assume one plus the stage index no larger than the sample size. The next adaptive prefix with the ancillary bit averaged is exactly the fair mixture of the two original-record prefixes, retaining the common past.
Formal statement
hypotheses
conclusion
((prefixLaw Q.kernels x k (le_of_succ_le hk)) ⊗ₘ (averagedKernel Q (nextIndex hk)).comap (fun eta => ((v,r),eta)) (by fun_prop)).map (fun p => snoc hk p.1 p.2)
Proof (Lean source)
-- @node: averagedKernel_prefix_step
lemma averagedKernel_prefix_step (Q : LocalProtocol n (ObsRecord d))
(x : Fin n → ObsRecord d × Q.Seed) (k : ℕ) (hk : k + 1 ≤ n)
(v : PairedSymbol d) (r : Q.Seed) :
((prefixLaw Q.kernels x
k (le_of_succ_le hk)) ⊗ₘ
(averagedKernel Q (nextIndex hk)).comap
(fun eta => ((v,r),eta)) (by fun_prop)).map
(fun p => snoc hk p.1 p.2) =
ofReal (1/2 : ℝ) •
prefixLaw Q.kernels
(update x (nextIndex hk)
(recoverObs v false,r)) (k+1) hk +
ofReal (1/2 : ℝ) •
prefixLaw Q.kernels
(update x (nextIndex hk)
(recoverObs v true,r)) (k+1) hk := by
have hprob := isProbabilityMeasure_prefixLaw
Q.kernels Q.markov x k (le_of_succ_le hk)
have hext := @averagedKernel_extend_history n d Q
(nextIndex hk)
(prefixLaw Q.kernels x
k (le_of_succ_le hk))
⟨hprob.measure_univ.trans_lt ENNReal.one_lt_top⟩ v r
have hmap := congrArg (fun mu : Measure (ProtocolHistory Q
(nextIndex hk) ×
Q.Message (nextIndex hk)) =>
mu.map (fun p => snoc hk p.1 p.2)) hext
have hm : Measurable (fun p : ProtocolHistory Q
(nextIndex hk) ×
Q.Message (nextIndex hk) =>
snoc hk p.1 p.2) :=
measurable_snoc hk
refine hmap.trans ?_
rw [Measure.map_add _ _ hm,
Measure.map_smul, Measure.map_smul]
congr 1 <;> congr 1
all_goals
rw [prefixLaw_succ,
protocol_prefixLaw_update_next]
simp only [Function.update_self]
rfl
theorem symmetricLaw_observed_lintegral
Assume the stated htheta condition, positive dimension, and the function f. Integrating any nonnegative observed-record function first integrates the parameter-independent ancillary assignment bit.
Formal statement
hypotheses
conclusion
(∫⁻ o, f o ∂observedLaw (symmetricLaw theta))
Proof (Lean source)
-- @node: symmetricLaw_observed_lintegral
lemma symmetricLaw_observed_lintegral (theta : Fin d → ℝ)
(htheta : theta ∈ parameterCube d) (hd : 0 < d)
(f : ObsRecord d → ℝ≥0∞) :
(∫⁻ o, f o ∂observedLaw (symmetricLaw theta)) =
∫⁻ v, ofReal (1/2 : ℝ) * f (recoverObs v false) +
ofReal (1/2 : ℝ) * f (recoverObs v true) ∂pairedLaw theta := by
rw [lintegral_fintype, lintegral_fintype]
simp_rw [symmetricLaw_observed_singleton theta htheta hd]
rw [Fintype.sum_prod_type, Fintype.sum_prod_type]
apply Finset.sum_congr rfl
intro j _
simp only [Fintype.sum_prod_type, Fintype.sum_bool, signedObserve, recoverObs,
Bool.false_eq_true, ↓reduceIte, Bool.not_false, Bool.not_true,
show (true == true) = true from rfl, show (true == false) = false from rfl,
show (false == true) = false from rfl, show (false == false) = true from rfl]
ring
theorem symmetricLaw_observed_bind
Assume the stated htheta condition, positive dimension, and measurability of f. Ancillary reconstruction applies to arbitrary measurable measure-valued rows, not merely to an event in a stage kernel.
Formal statement
hypotheses
conclusion
(observedLaw (symmetricLaw theta)).bind f
= (pairedLaw theta).bind (fun v => ofReal (1/2 : ℝ) • f (recoverObs v false) + ofReal (1/2 : ℝ) • f (recoverObs v true))
Proof (Lean source)
-- @node: symmetricLaw_observed_bind
lemma symmetricLaw_observed_bind {Ω : Type} [MeasurableSpace Ω]
(theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d) (hd : 0 < d)
(f : ObsRecord d → Measure Ω) (hf : Measurable f) :
(observedLaw (symmetricLaw theta)).bind f =
(pairedLaw theta).bind (fun v =>
ofReal (1/2 : ℝ) • f (recoverObs v false) +
ofReal (1/2 : ℝ) • f (recoverObs v true)) := by
have hmix : Measurable (fun v =>
ofReal (1/2 : ℝ) • f (recoverObs v false) +
ofReal (1/2 : ℝ) • f (recoverObs v true)) := by
apply Measure.measurable_of_measurable_coe
intro E hE
simp only [Measure.add_apply, Measure.smul_apply, smul_eq_mul]
exact (measurable_const.mul (((Measure.measurable_coe hE).comp hf).comp (by fun_prop))).add
(measurable_const.mul (((Measure.measurable_coe hE).comp hf).comp (by fun_prop)))
ext E hE
rw [Measure.bind_apply hE hf.aemeasurable, Measure.bind_apply hE hmix.aemeasurable]
simp only [Measure.add_apply, Measure.smul_apply, smul_eq_mul]
exact symmetricLaw_observed_lintegral theta htheta hd (fun o => f o E)
theorem symmetricLaw_observed_reconstruction
Assume the stated htheta condition and positive dimension. The original observed law is exactly the paired law followed by independent fair reconstruction.
Formal statement
hypotheses
conclusion
observedLaw (symmetricLaw theta)
= (pairedLaw theta).bind (fun v => ofReal (1/2 : ℝ) • Measure.dirac (recoverObs v false) + ofReal (1/2 : ℝ) • Measure.dirac (recoverObs v true))
Proof (Lean source)
-- @node: symmetricLaw_observed_reconstruction
lemma symmetricLaw_observed_reconstruction (theta : Fin d → ℝ)
(htheta : theta ∈ parameterCube d) (hd : 0 < d) :
observedLaw (symmetricLaw theta) =
(pairedLaw theta).bind (fun v =>
ofReal (1/2 : ℝ) • Measure.dirac (recoverObs v false) +
ofReal (1/2 : ℝ) • Measure.dirac (recoverObs v true)) := by
simpa only [Measure.bind_dirac] using
symmetricLaw_observed_bind theta htheta hd Measure.dirac Measure.measurable_dirac
theorem averagedKernel_integrated_historyLaw
Assume the stated htheta condition and positive dimension. Fresh iid input can be integrated before or after extending any adaptive history law; the two experiments give the same history-message joint measure.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
theta :
Fin d → ℝ
htheta :
theta ∈ parameterCube d
hd :
0 < d
i :
Fin n
mu :
Measure (ProtocolHistory Q i)
r :
Q.Seed
conclusion
(observedLaw (symmetricLaw theta)).bind (fun o => mu ⊗ₘ (Q.kernels i).comap (fun eta => ((o,r),eta)) (by fun_prop))
= (pairedLaw theta).bind (fun v => mu ⊗ₘ (averagedKernel Q i).comap (fun eta => ((v,r),eta)) (by fun_prop))
Proof (Lean source)
-- @node: averagedKernel_integrated_historyLaw
lemma averagedKernel_integrated_historyLaw (Q : LocalProtocol n (ObsRecord d))
(theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d) (hd : 0 < d)
(i : Fin n) (mu : Measure (ProtocolHistory Q i)) [IsFiniteMeasure mu] (r : Q.Seed) :
(observedLaw (symmetricLaw theta)).bind (fun o =>
mu ⊗ₘ (Q.kernels i).comap (fun eta => ((o,r),eta)) (by fun_prop)) =
(pairedLaw theta).bind (fun v =>
mu ⊗ₘ (averagedKernel Q i).comap (fun eta => ((v,r),eta)) (by fun_prop)) := by
rw [symmetricLaw_observed_bind theta htheta hd _ (by
first | fun_prop | exact measurable_of_countable _)]
congr 1
funext v
exact (averagedKernel_extend_history Q i mu v r).symm
theorem averagedKernel_integrated_historyLaw_map
Assume the stated htheta condition, positive dimension, and measurability of f. The same transition equality survives measurable transcript processing, including retention of histories and appending the next message.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
Ω :
Type
Q :
LocalProtocol n (ObsRecord d)
theta :
Fin d → ℝ
htheta :
theta ∈ parameterCube d
hd :
0 < d
i :
Fin n
mu :
Measure (ProtocolHistory Q i)
r :
Q.Seed
f :
ProtocolHistory Q i × Q.Message i → Ω
hf :
conclusion
(observedLaw (symmetricLaw theta)).bind (fun o => (mu ⊗ₘ (Q.kernels i).comap (fun eta => ((o,r),eta)) (by fun_prop)).map f)
= (pairedLaw theta).bind (fun v => (mu ⊗ₘ (averagedKernel Q i).comap (fun eta => ((v,r),eta)) (by fun_prop)).map f)
Proof (Lean source)
-- @node: averagedKernel_integrated_historyLaw_map
lemma averagedKernel_integrated_historyLaw_map {Ω : Type} [MeasurableSpace Ω]
(Q : LocalProtocol n (ObsRecord d)) (theta : Fin d → ℝ)
(htheta : theta ∈ parameterCube d) (hd : 0 < d)
(i : Fin n) (mu : Measure (ProtocolHistory Q i)) [IsFiniteMeasure mu] (r : Q.Seed)
(f : ProtocolHistory Q i × Q.Message i → Ω) (hf : Measurable f) :
(observedLaw (symmetricLaw theta)).bind (fun o =>
(mu ⊗ₘ (Q.kernels i).comap (fun eta => ((o,r),eta)) (by fun_prop)).map f) =
(pairedLaw theta).bind (fun v =>
(mu ⊗ₘ (averagedKernel Q i).comap (fun eta => ((v,r),eta)) (by fun_prop)).map f) := by
rw [symmetricLaw_observed_bind theta htheta hd _ (by
first | fun_prop | exact measurable_of_countable _)]
congr 1
funext v
rw [averagedKernel_extend_history, Measure.map_add _ _ hf,
Measure.map_smul, Measure.map_smul]
theorem averagedKernel_integrated_prefix_step
Assume the stated htheta condition, positive dimension, and one plus the stage index no larger than the sample size. Averaging a fresh participant's iid observed input gives precisely the paired next-prefix transition while leaving the previously queried records fixed.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
theta :
Fin d → ℝ
htheta :
theta ∈ parameterCube d
hd :
0 < d
k :
ℕ
hk :
k + 1 ≤ n
r :
Q.Seed
conclusion
(observedLaw (symmetricLaw theta)).bind (fun o => prefixLaw Q.kernels (update x (nextIndex hk) (o,r)) (k+1) hk)
= (pairedLaw theta).bind (fun v => ((prefixLaw Q.kernels x k (le_of_succ_le hk)) ⊗ₘ (averagedKernel Q (nextIndex hk)).comap (fun eta => ((v,r),eta)) (by fun_prop)).map (fun p => snoc hk p.1 p.2))
Proof (Lean source)
-- @node: averagedKernel_integrated_prefix_step
lemma averagedKernel_integrated_prefix_step (Q : LocalProtocol n (ObsRecord d))
(theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d) (hd : 0 < d)
(x : Fin n → ObsRecord d × Q.Seed) (k : ℕ) (hk : k + 1 ≤ n) (r : Q.Seed) :
(observedLaw (symmetricLaw theta)).bind (fun o =>
prefixLaw Q.kernels
(update x (nextIndex hk)
(o,r)) (k+1) hk) =
(pairedLaw theta).bind (fun v =>
((prefixLaw Q.kernels x
k (le_of_succ_le hk)) ⊗ₘ
(averagedKernel Q (nextIndex hk)).comap
(fun eta => ((v,r),eta)) (by fun_prop)).map
(fun p => snoc hk p.1 p.2)) := by
rw [symmetricLaw_observed_bind theta htheta hd _ (by fun_prop)]
congr 1
funext v
exact (averagedKernel_prefix_step Q x k hk v r).symm
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Calibration.Assembly 3 declarations Apply the arbitrary-column dependence bound to the combined pilot and evaluation rows, then add the squared average bias to obtain the finite hybrid MSE bound.
Finite polynomial calibration assembly
Apply the arbitrary-column dependence bound to the combined pilot and evaluation rows, then add the squared average bias to obtain the finite hybrid MSE bound.
theorem hybrid_average_variance_le
Assume independent and identically distributed participant records, the causal-model conditions for the data law, a privacy budget in the interval from zero to one, dimension at least two, positive block size, a block no larger than the sample, and the stated hvar condition. The dependence lemma controls the average hybrid variance on the combined rows.
Formal statement
hypotheses
n :
ℕ
m :
ℕ
d :
ℕ
S :
SamplingScheme n d
hIID :
P :
hP :
eps :
ℝ
heps :
eps ∈ Ioc 0 1
hd :
2 ≤ d
hm :
0 < m
hTwoBlocks :
2*m ≤ n
D :
ℕ
V :
ℝ
hvar :
conclusion
hybridVar (m := m) P eps (fun z => (d : ℝ)⁻¹ * ∑ j, hybridColumn eps D j z) ≤ 2*V/d
Proof (Lean source)
-- @node: hybrid_average_variance_le
lemma hybrid_average_variance_le (S : SamplingScheme n d) (hIID : IidPeople S)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(eps : ℝ) (heps : eps ∈ Ioc 0 1) (hd : 2 ≤ d)
(hm : 0 < m) (hTwoBlocks : 2*m ≤ n) (D : ℕ) (V : ℝ)
(hvar : ∀ j : Fin d, hybridVar (m := m) P eps (hybridColumn eps D j) ≤ V) :
hybridVar (m := m) P eps (fun z => (d : ℝ)⁻¹ * ∑ j, hybridColumn eps D j z) ≤
2*V/d := by
letI : Nonempty (Fin d) := ⟨⟨0, by omega⟩⟩
have hdep := (private_moment_and_dependence (m := m+m) S hIID P hP eps heps hd
(by omega) (by omega)).2.2.2.2.2 (combinedHybridStatistic (m := m) eps D)
(fun j => by fun_prop)
have h := hdep.2
have hcol (j : Fin d) : columnStatistic eps (combinedHybridStatistic (m := m) eps D) j =
fun z => hybridColumn eps D j (splitHybridRows z) := by
funext z
exact (hybridColumn_eq_combined_columnStatistic eps D j z).symm
simp_rw [hcol] at h
rw [← hybridVar_eq_combined_blockVar P eps
(fun z => (d : ℝ)⁻¹ * ∑ j, hybridColumn eps D j z)] at h
simp_rw [← hybridVar_eq_combined_blockVar] at h
have hs : sSup (range (fun j : Fin d =>
hybridVar (m := m) P eps (hybridColumn eps D j))) ≤ V := by
apply csSup_le
· exact Set.range_nonempty (fun j : Fin d =>
hybridVar (m := m) P eps (hybridColumn eps D j))
· rintro _ ⟨j, rfl⟩
exact hvar j
calc
_ ≤ (2/(d : ℝ)) * sSup (range (fun j =>
hybridVar (m := m) P eps (hybridColumn eps D j))) := h
_ ≤ (2/(d : ℝ)) * V := mul_le_mul_of_nonneg_left hs (by positivity)
_ = _ := by ring
theorem hybrid_average_mse_bound
Assume the bounded-mean concentration inequality, the Cai–Low Chebyshev approximation theorem, independent and identically distributed participant records, the causal-model conditions for the data law, an admissible sample size, dimension, and privacy budget, positive block size, the stated l condition, the stated d condition, the stated hm d condition, and a block no larger than the sample. Combined-row variance and the calibrated bias give the roadmap's final hybrid MSE.
Formal statement
hypotheses
n :
ℕ
m :
ℕ
d :
ℕ
hMean :
hCheb :
S :
SamplingScheme n d
hIID :
P :
hP :
eps :
ℝ
hAllowed :
Allowed n d eps
hm :
0 < m
D :
ℕ
hL :
4096 ≤ logDim d
hD :
D = 2*⌊(1/1024 : ℝ)*logDim d/2⌋₊
hmD :
2*D ≤ m
hTwoBlocks :
2*m ≤ n
conclusion
hybridMean (m := m) P eps (fun z => ((d : ℝ)⁻¹ * (∑ j, hybridColumn eps D j z) - signedNorm (contrast P))^2)
≤ 500000000 * sigmaSquared d m eps / logDim d
Proof (Lean source)
-- @node: hybrid_average_mse_bound
lemma hybrid_average_mse_bound (hMean : BoundedMeanConcentration)
(hCheb : CaiLowChebyshevApproximation) (S : SamplingScheme n d) (hIID : IidPeople S)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(eps : ℝ) (hAllowed : Allowed n d eps) (hm : 0 < m)
(D : ℕ) (hL : 4096 ≤ logDim d)
(hD : D = 2*⌊(1/1024 : ℝ)*logDim d/2⌋₊) (hmD : 2*D ≤ m)
(hTwoBlocks : 2*m ≤ n) :
hybridMean (m := m) P eps (fun z => ((d : ℝ)⁻¹ * (∑ j, hybridColumn eps D j z) -
signedNorm (contrast P))^2) ≤ 500000000 * sigmaSquared d m eps / logDim d := by
have hvar := hybrid_average_variance_le S hIID P hP eps hAllowed.2.2 hAllowed.2.1
hm hTwoBlocks D (400*sigmaSquared d m eps*logDim d*exp (logDim d/100))
(fun j => hybrid_variance_bound hMean hCheb P hP eps hAllowed.2.2.1
hAllowed.2.1 hm D hL hD hmD j)
have hd : 2 ≤ d := hAllowed.2.1
have henv := hybrid_average_variance_envelope_le (m := m) (d := d) eps (by omega) hL
have hvar' : hybridVar (m := m) P eps (fun z => (d : ℝ)⁻¹ * ∑ j, hybridColumn eps D j z) ≤
3200*sigmaSquared d m eps/logDim d := by
apply hvar.trans
convert henv using 1 <;> first | rfl | ring
have hbias := hybrid_average_bias_sq_bound hMean hCheb P hP eps hAllowed.2.2.1
hAllowed.2.1 hm D hL hD (by omega)
have hmse := hybrid_mse_le_variance_add_bias_bounds P eps (signedNorm (contrast P))
_ _ _ hvar' hbias
have hs : 0 ≤ sigmaSquared d m eps / logDim d := by
unfold sigmaSquared
positivity
calc
_ ≤ 3200*sigmaSquared d m eps/logDim d +
400000000*sigmaSquared d m eps/logDim d := hmse
_ = 400003200 * (sigmaSquared d m eps/logDim d) := by ring
_ ≤ 500000000 * (sigmaSquared d m eps/logDim d) :=
mul_le_mul_of_nonneg_right (by norm_num) hs
_ = _ := by ring
theorem finite_private_polynomial_calibration
Bounded mean concentration, Chebyshev approximation, iid sampling, causal-model validity, allowed resources, and positive block size within the sample imply both the global-polynomial and hybrid finite calibration bounds.
Formal statement
hypotheses
n :
ℕ
m :
ℕ
d :
ℕ
hMean_of_gate :
hCheb_of_gate :
S :
SamplingScheme n d
hIID :
P :
hP :
eps :
ℝ
hAllowed :
Allowed n d eps
hm :
0 < m
hmn :
m ≤ n
conclusion
conclusion 1
D :
ℕ
Even D
2 ≤ D
2*D ≤ m
(D : ℝ)
j :
Fin d
≤ 1/(D+1)
blockVar (m := m) P eps (fun z => (d : ℝ)⁻¹ * ∑ j, polynomialEstimate eps (1/2) D j z)
conclusion 2
j :
Fin d
hybridVar (m := m) P eps (hybridColumn eps D j)
hybridMean (m := m) P eps (fun z => ((d : ℝ)⁻¹ * (∑ j, hybridColumn eps D j z) - signedNorm (contrast P))^2)
≤ 500000000 * sigmaSquared d m eps/logDim d
Proof (Lean source)
lemma finite_private_polynomial_calibration
(hMean_of_gate : BoundedMeanConcentration) (hCheb_of_gate : CaiLowChebyshevApproximation)
(S : SamplingScheme n d) (hIID : IidPeople S)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(eps : ℝ) (hAllowed : Allowed n d eps) (hm : 0 < m) (hmn : m ≤ n) :
(∀ D : ℕ, Even D → 2 ≤ D → 2*D ≤ m →
(D : ℝ) ≤ (1/1024 : ℝ) * logDim d /
log (exp 1 + sigmaSquared d m eps * logDim d) →
(∀ j : Fin d, abs (blockMean (m := m) P eps (polynomialEstimate eps (1/2) D j) - abs
(contrast P j)) ≤
1/(D+1)) ∧
blockVar (m := m) P eps (fun z => (d : ℝ)⁻¹ * ∑ j, polynomialEstimate eps (1/2) D j z) ≤
exp (9*D*log (exp 1 + sigmaSquared d m eps * logDim d))/(2*d)) ∧
(∀ D : ℕ, 4096 ≤ logDim d → D = 2*⌊(1/1024 : ℝ)*logDim d/2⌋₊ →
2*D ≤ m → 2*m ≤ n →
(∀ j : Fin d,
abs (hybridMean (m := m) P eps (hybridColumn eps D j) - abs (contrast P j)) ≤
20000*sqrt (sigmaSquared d m eps)/sqrt (logDim d) ∧
hybridVar (m := m) P eps (hybridColumn eps D j) ≤
400*sigmaSquared d m eps * logDim d * exp (logDim d/100)) ∧
hybridMean (m := m) P eps (fun z => ((d : ℝ)⁻¹ * (∑ j, hybridColumn eps D j z) -
signedNorm (contrast P))^2) ≤ 500000000 * sigmaSquared d m eps/logDim d) := by
constructor
· intro D hEven hD hmD hDegree
exact global_polynomial_calibration_of_gate hCheb_of_gate hMean_of_gate
S hIID P hP eps hAllowed hm hmn D hEven hD hmD hDegree
· intro D hL hDegree hmD hTwoBlocks
constructor
· intro j
exact ⟨hybrid_bias_bound hMean_of_gate hCheb_of_gate P hP eps
hAllowed.2.2.1 hAllowed.2.1 hm D hL hDegree (by omega) j,
hybrid_variance_bound hMean_of_gate hCheb_of_gate P hP eps
hAllowed.2.2.1 hAllowed.2.1 hm D hL hDegree hmD j⟩
· exact hybrid_average_mse_bound hMean_of_gate hCheb_of_gate S hIID P hP eps
hAllowed hm D hL hDegree hmD hTwoBlocks
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Calibration.Average 8 declarations Linearity, finite averaging of the column bias bounds, and the bias--variance identity used in the last step of finite polynomial calibration.
Averaged hybrid bias and mean squared error
Linearity, finite averaging of the column bias bounds, and the bias--variance identity used in the last step of finite polynomial calibration.
Expectation commutes with the finite average of hybrid column statistics.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
P :
eps :
ℝ
conclusion
hybridMean P eps (fun z => (d : ℝ)⁻¹ * ∑ j, f j z)
= (d : ℝ)⁻¹ * ∑ j, hybridMean P eps (f j)
Proof (Lean source)
-- @node: hybridMean_average
lemma hybridMean_average (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(eps : ℝ) (f : Fin d → ((Fin m → Fin d → Bool) × (Fin m → Fin d → Bool)) → ℝ) :
hybridMean P eps (fun z => (d : ℝ)⁻¹ * ∑ j, f j z) =
(d : ℝ)⁻¹ * ∑ j, hybridMean P eps (f j) := by
letI := hybridLaw_probability (m := m) P eps
unfold hybridMean
integral_linearity
theorem hybrid_average_bias_le
Assume positive dimension and the stated hbias condition. Uniform column bias bounds persist under averaging, without column independence.
Formal statement
hypotheses
conclusion
|hybridMean P eps (fun z => (d : ℝ)⁻¹ * ∑ j, f j z) - signedNorm theta| ≤ B
Proof (Lean source)
-- @node: hybrid_average_bias_le
lemma hybrid_average_bias_le (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(eps B : ℝ) (hd : 0 < d)
(f : Fin d → ((Fin m → Fin d → Bool) × (Fin m → Fin d → Bool)) → ℝ)
(theta : Fin d → ℝ)
(hbias : ∀ j, abs (hybridMean P eps (f j) - abs (theta j)) ≤ B) :
|hybridMean P eps (fun z => (d : ℝ)⁻¹ * ∑ j, f j z) - signedNorm theta| ≤ B := by
rw [hybridMean_average, signedNorm, ← mul_sub, ← Finset.sum_sub_distrib, abs_mul]
rw [abs_of_nonneg (by positivity : 0 ≤ (d : ℝ)⁻¹)]
calc
_ ≤ (d : ℝ)⁻¹ * ∑ j, abs (hybridMean P eps (f j) - abs (theta j)) :=
mul_le_mul_of_nonneg_left (Finset.abs_sum_le_sum_abs _ _) (by positivity)
_ ≤ (d : ℝ)⁻¹ * ∑ _j : Fin d, B :=
mul_le_mul_of_nonneg_left (Finset.sum_le_sum (fun j _ => hbias j)) (by positivity)
_ = B := by simp [ne_of_gt (show (0 : ℝ) < d by exact_mod_cast hd)]
theorem hybrid_average_bias_bound
Assume the bounded-mean concentration inequality, the Cai–Low Chebyshev approximation theorem, the causal-model conditions for the data law, a positive privacy budget, dimension at least two, positive block size, the stated l condition, the stated d condition, and the stated dm condition. The specified hybrid estimator inherits the calibrated column bias bound.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
hMean :
hCheb :
P :
hP :
eps :
ℝ
heps :
0 < eps
hd :
2 ≤ d
hm :
0 < m
D :
ℕ
hL :
4096 ≤ logDim d
hD :
D = 2*⌊(1/1024 : ℝ)*logDim d/2⌋₊
hDm :
D ≤ m
conclusion
|hybridMean (m := m) P eps (fun z => (d : ℝ)⁻¹ * ∑ j, hybridColumn eps D j z)
- signedNorm (contrast P)|
Proof (Lean source)
-- @node: hybrid_average_bias_bound
lemma hybrid_average_bias_bound (hMean : BoundedMeanConcentration)
(hCheb : CaiLowChebyshevApproximation)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d) (hm : 0 < m)
(D : ℕ) (hL : 4096 ≤ logDim d)
(hD : D = 2*⌊(1/1024 : ℝ)*logDim d/2⌋₊) (hDm : D ≤ m) :
|hybridMean (m := m) P eps (fun z => (d : ℝ)⁻¹ * ∑ j, hybridColumn eps D j z) -
signedNorm (contrast P)| ≤
20000 * sqrt (sigmaSquared d m eps) / sqrt (logDim d) := by
apply hybrid_average_bias_le P eps _ (by omega)
intro j
exact hybrid_bias_bound hMean hCheb P hP eps heps hd hm D hL hD hDm j
theorem hybridMean_sq_error_eq_variance_add_bias Lemma hybridMean_sq_error_eq_variance_add_bias in the paper ↗
Centered hybrid squared error equals variance plus squared bias. the integrability condition.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
P :
eps x :
ℝ
conclusion
Proof (Lean source)
-- @node: hybridMean_sq_error_eq_variance_add_bias
lemma hybridMean_sq_error_eq_variance_add_bias
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (eps x : ℝ)
(f : ((Fin m → Fin d → Bool) × (Fin m → Fin d → Bool)) → ℝ) :
hybridMean P eps (fun z => (f z - x)^2) =
hybridVar P eps f + (hybridMean P eps f - x)^2 := by
letI := hybridLaw_probability (m := m) P eps
have hv := variance_eq_sub (μ := hybridLaw P eps m)
(X := fun z => f z - x) (MemLp.of_discrete)
rw [variance_sub_const (by fun_prop) x, variance_eq_integral (by fun_prop)] at hv
have hm : (∫ z, f z - x ∂hybridLaw P eps m) = hybridMean P eps f - x := by
unfold hybridMean
integral_linearity
simp
rw [hm] at hv
change hybridVar P eps f = hybridMean P eps (fun z => (f z - x)^2) -
(hybridMean P eps f - x)^2 at hv
linarith
theorem hybrid_average_bias_sq_bound
Assume the bounded-mean concentration inequality, the Cai–Low Chebyshev approximation theorem, the causal-model conditions for the data law, a positive privacy budget, dimension at least two, positive block size, the stated l condition, the stated d condition, and the stated dm condition. Squaring the calibrated average bias gives its exact contribution to the MSE.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
hMean :
hCheb :
P :
hP :
eps :
ℝ
heps :
0 < eps
hd :
2 ≤ d
hm :
0 < m
D :
ℕ
hL :
4096 ≤ logDim d
hD :
D = 2*⌊(1/1024 : ℝ)*logDim d/2⌋₊
hDm :
D ≤ m
conclusion
(hybridMean (m := m) P eps (fun z => (d : ℝ)⁻¹ * ∑ j, hybridColumn eps D j z) - signedNorm (contrast P))^2
≤ 400000000 * sigmaSquared d m eps / logDim d
Proof (Lean source)
-- @node: hybrid_average_bias_sq_bound
lemma hybrid_average_bias_sq_bound (hMean : BoundedMeanConcentration)
(hCheb : CaiLowChebyshevApproximation)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d) (hm : 0 < m)
(D : ℕ) (hL : 4096 ≤ logDim d)
(hD : D = 2*⌊(1/1024 : ℝ)*logDim d/2⌋₊) (hDm : D ≤ m) :
(hybridMean (m := m) P eps (fun z => (d : ℝ)⁻¹ * ∑ j, hybridColumn eps D j z) -
signedNorm (contrast P))^2 ≤ 400000000 * sigmaSquared d m eps / logDim d := by
have h := hybrid_average_bias_bound hMean hCheb P hP eps heps hd hm D hL hD hDm
have hs : 0 ≤ sigmaSquared d m eps := by unfold sigmaSquared; positivity
have hLpos : 0 < logDim d := by linarith
have hsq := mul_self_le_mul_self (abs_nonneg _) h
simp only [← pow_two, sq_abs] at hsq
have heq : (20000 * sqrt (sigmaSquared d m eps) / sqrt (logDim d))^2 =
400000000 * sigmaSquared d m eps / logDim d := by
rw [div_pow, mul_pow, Real.sq_sqrt hs, Real.sq_sqrt hLpos.le]
norm_num
nlinarith [heq]
theorem hybrid_mse_le_variance_add_bias_bounds Lemma hybrid_mse_le_variance_add_bias_bounds in the paper ↗
Assume the stated hvar condition and the stated hbias condition. Finite second moments allow separate bias and variance bounds to be added. the variance, integrability, and bias bounds.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
P :
eps x V B :
ℝ
hvar :
hybridVar P eps f ≤ V
hbias :
(hybridMean P eps f - x)^2 ≤ B
conclusion
hybridMean P eps (fun z => (f z - x)^2) ≤ V + B
Proof (Lean source)
-- @node: hybrid_mse_le_variance_add_bias_bounds
lemma hybrid_mse_le_variance_add_bias_bounds
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (eps x V B : ℝ)
(f : ((Fin m → Fin d → Bool) × (Fin m → Fin d → Bool)) → ℝ)
(hvar : hybridVar P eps f ≤ V) (hbias : (hybridMean P eps f - x)^2 ≤ B) :
hybridMean P eps (fun z => (f z - x)^2) ≤ V + B := by
rw [hybridMean_sq_error_eq_variance_add_bias]
exact add_le_add hvar hbias
Assume positive dimension and the stated l condition. On the hybrid resource domain, the column-variance exponential is absorbed by dimension.
Formal statement
Proof (Lean source)
-- @node: hybrid_dimension_exp_bound
lemma hybrid_dimension_exp_bound (hd : 0 < d) (hL : 4096 ≤ logDim d) :
(logDim d)^2 * exp (logDim d/100) ≤ 4 * (d : ℝ) := by
let L := logDim d
have hL0 : 0 ≤ L := by dsimp [L]; linarith
have hexp : L/4 ≤ exp (L/4) := by linarith [Real.add_one_le_exp (L/4)]
have hsq := mul_self_le_mul_self (by positivity : 0 ≤ L/4) hexp
have hexp2 : exp (L/4) * exp (L/4) = exp (L/2) := by
rw [← Real.exp_add]
congr 1
ring
rw [hexp2] at hsq
have hfour : 4 ≤ exp (49*L/100-1) := by
have := Real.add_one_le_exp (49*L/100-1)
dsimp [L] at *
linarith
have hdim : exp (L-1) = (d : ℝ) := by
have hdR : (0 : ℝ) < d := by exact_mod_cast hd
dsimp [L, logDim]
rw [Real.exp_sub, Real.exp_log (by positivity)]
exact mul_div_cancel_left₀ _ (Real.exp_pos _).ne'
calc
L^2 * exp (L/100) ≤ 16 * exp (L/2) * exp (L/100) := by
apply mul_le_mul_of_nonneg_right _ (Real.exp_pos _).le
nlinarith [hsq]
_ = 16 * exp (51*L/100) := by
rw [mul_assoc, ← Real.exp_add]
congr 2
ring
_ ≤ 4 * exp (L-1) := by
have h := mul_le_mul_of_nonneg_left hfour (by positivity : 0 ≤ 4 * exp (51*L/100))
calc
_ ≤ (4 * exp (51*L/100)) * exp (49*L/100-1) := by nlinarith [h]
_ = _ := by
rw [mul_assoc, ← Real.exp_add]
congr 2
ring
_ = 4 * (d : ℝ) := by rw [hdim]
theorem hybrid_average_variance_envelope_le Lemma hybrid_average_variance_envelope_le in the paper ↗
Assume positive dimension and the stated l condition. The roadmap's averaged-variance envelope is at most 3200 times sigma squared over L.
Formal statement
hypotheses
conclusion
≤ 3200 * sigmaSquared d m eps / logDim d
Proof (Lean source)
-- @node: hybrid_average_variance_envelope_le
lemma hybrid_average_variance_envelope_le (eps : ℝ) (hd : 0 < d)
(hL : 4096 ≤ logDim d) :
800 * sigmaSquared d m eps * logDim d * exp (logDim d/100) / d ≤
3200 * sigmaSquared d m eps / logDim d := by
have hdR : (0 : ℝ) < d := by exact_mod_cast hd
have hLpos : 0 < logDim d := by linarith
have hs : 0 ≤ sigmaSquared d m eps := by unfold sigmaSquared; positivity
rw [div_le_div_iff₀ hdR hLpos]
have h := mul_le_mul_of_nonneg_left (hybrid_dimension_exp_bound hd hL)
(by positivity : 0 ≤ 800 * sigmaSquared d m eps)
nlinarith [h]
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Calibration.Combined 7 declarations The independent two-block experiment is a split iid vector block.
Combining the pilot and evaluation rows
The independent two-block experiment is a split iid vector block. Hybrid statistics depend only on their own columns in this combined experiment.
Fix the function z. Split a combined vector block into its pilot and evaluation halves.
theorem splitHybridRows_measurePreserving
Splitting iid rows gives exactly the independent pilot/evaluation law.
Formal statement
hypotheses
conclusion
MeasurePreserving (splitHybridRows (m := m) (d := d)) (vectorBlockLaw P eps (m+m)) (hybridLaw P eps m)
Proof (Lean source)
-- @node: splitHybridRows_measurePreserving
lemma splitHybridRows_measurePreserving (P : Measure (FullRecord d))
[IsProbabilityMeasure P] (eps : ℝ) :
MeasurePreserving (splitHybridRows (m := m) (d := d))
(vectorBlockLaw P eps (m+m)) (hybridLaw P eps m) := by
letI := vectorMessageLaw_probability P eps
have hr := measurePreserving_piCongrLeft
(fun _ : Fin m ⊕ Fin m => vectorMessageLaw P eps)
(finSumFinEquiv : Fin m ⊕ Fin m ≃ Fin (m+m)).symm
have hs := measurePreserving_sumPiEquivProdPi
(fun _ : Fin m ⊕ Fin m => vectorMessageLaw P eps)
convert hs.comp hr using 1
· funext z
simp [splitHybridRows, Function.comp_def, MeasurableEquiv.sumPiEquivProdPi,
MeasurableEquiv.coe_piCongrLeft, Equiv.piCongrLeft]
· rfl
· rfl
theorem hybridMean_eq_combined_blockMean
Hybrid means can be evaluated in the combined-row experiment.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
P :
eps :
ℝ
conclusion
Proof (Lean source)
-- @node: hybridMean_eq_combined_blockMean
lemma hybridMean_eq_combined_blockMean (P : Measure (FullRecord d))
[IsProbabilityMeasure P] (eps : ℝ)
(f : ((Fin m → Fin d → Bool) × (Fin m → Fin d → Bool)) → ℝ) :
hybridMean P eps f = blockMean P eps (fun z => f (splitHybridRows z)) := by
unfold hybridMean blockMean
rw [← (splitHybridRows_measurePreserving P eps).map_eq]
exact integral_map (by fun_prop) (by fun_prop)
theorem hybridVar_eq_combined_blockVar
Hybrid variances can be evaluated in the combined-row experiment.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
P :
eps :
ℝ
conclusion
Proof (Lean source)
-- @node: hybridVar_eq_combined_blockVar
lemma hybridVar_eq_combined_blockVar (P : Measure (FullRecord d))
[IsProbabilityMeasure P] (eps : ℝ)
(f : ((Fin m → Fin d → Bool) × (Fin m → Fin d → Bool)) → ℝ) :
hybridVar P eps f = blockVar P eps (fun z => f (splitHybridRows z)) := by
unfold hybridVar blockVar
rw [← hybridMean_eq_combined_blockMean]
exact hybridMean_eq_combined_blockMean P eps _
Fix the privacy budget, the natural-number parameter D, the coordinate index, and the function w. The hybrid rule applied to a single combined scaled column.
Definition (Lean source)
parameters
def
combinedHybridStatistic eps D j w :
ℝ
given by
T :
pilot :
(m : ℝ)⁻¹ * ∑ i : Fin m, w (Fin.castAdd m i)
evaluation :
(m : ℝ)⁻¹ * ∑ i : Fin m, w (Fin.natAdd m i)
poly :
∑ v ∈ range (D+1), (chebyshevAbsPoly D).coeff v * (2*T)^((1 : ℤ) - (v : ℤ)) * privateMoment (fun i : Fin m => fun _ : Fin d => w (Fin.natAdd m i)) v j
if |pilot|
≤ T then poly else (if 0 < pilot then 1 else if pilot < 0 then -1 else 0) * evaluation
theorem hybridColumn_eq_combined_columnStatistic
Each split hybrid statistic is an own-column statistic of the combined block.
Formal statement
hypotheses
conclusion
hybridColumn eps D j (splitHybridRows z)
= columnStatistic eps (combinedHybridStatistic (m := m) eps D) j z
Proof (Lean source)
-- @node: hybridColumn_eq_combined_columnStatistic
lemma hybridColumn_eq_combined_columnStatistic (eps : ℝ) (D : ℕ) (j : Fin d)
(z : Fin (m+m) → Fin d → Bool) :
hybridColumn eps D j (splitHybridRows z) =
columnStatistic eps (combinedHybridStatistic (m := m) eps D) j z := by
rfl
theorem combinedHybridStatistic_measurable
The combined hybrid rule is measurable on real scaled columns.
Formal statement
hypotheses
conclusion
Measurable (combinedHybridStatistic (m := m) eps D j)
Proof (Lean source)
-- @node: combinedHybridStatistic_measurable
@[fun_prop]
lemma combinedHybridStatistic_measurable (eps : ℝ) (D : ℕ) (j : Fin d) :
Measurable (combinedHybridStatistic (m := m) eps D j) := by
unfold combinedHybridStatistic privateMoment
dsimp only
apply Measurable.ite (measurableSet_le (by fun_prop) (by fun_prop)) (by fun_prop)
apply mul _ (by fun_prop)
apply Measurable.ite (measurableSet_lt (by fun_prop) (by fun_prop)) (by fun_prop)
exact Measurable.ite (measurableSet_lt (by fun_prop) (by fun_prop))
(by fun_prop) (by fun_prop)
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Calibration.Global 12 declarations Finite original-record private value frontiers: Helpers/Calibration/Global.
Helpers/Calibration/Global
Finite original-record private value frontiers: Helpers/Calibration/Global.
def polynomialEstimate
Fix the privacy budget and the amplitude, the natural-number parameter D, the coordinate index, and the function z. Scaled explicit polynomial, lifted through distinct-person moments.
Definition (Lean source)
parameters
def
polynomialEstimate eps a D j z :
ℝ
given by
∑ v ∈ range (D+1), (chebyshevAbsPoly D).coeff v * a^((1 : ℤ) - (v : ℤ)) * privateMoment (scaledMessages eps z) v j
def sigmaSquared
Fix the dimension and the block size and the privacy budget. Squared-noise scale for one evaluation block.
Definition (Lean source)
The explicit truncated Chebyshev approximation has no coefficients above its degree.
Formal statement
Proof (Lean source)
-- @node: chebyshevAbsPoly_natDegree_le
lemma chebyshevAbsPoly_natDegree_le (D : ℕ) : (chebyshevAbsPoly D).natDegree ≤ D := by
unfold chebyshevAbsPoly
apply Polynomial.natDegree_add_le_of_degree_le
· simp
· apply Polynomial.natDegree_sum_le_of_forall_le
intro v hv
apply (Polynomial.natDegree_C_mul_le _ _).trans
rw [Polynomial.Chebyshev.natDegree_T]
have hvD := (Finset.mem_Icc.mp hv).2
norm_cast
omega
theorem blockMean_polynomialEstimate
Assume the causal-model conditions for the data law, a positive privacy budget, the stated ha condition, dimension at least two, and the stated dm condition. Moment unbiasedness evaluates the finite polynomial at the true scaled contrast.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
P :
hP :
eps a :
ℝ
heps :
0 < eps
ha :
a ≠ 0
hd :
2 ≤ d
D :
ℕ
hDm :
D ≤ m
j :
Fin d
conclusion
blockMean (m := m) P eps (polynomialEstimate eps a D j)
= a * (chebyshevAbsPoly D).eval (contrast P j / a)
Proof (Lean source)
-- @node: blockMean_polynomialEstimate
lemma blockMean_polynomialEstimate (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(hP : CausalModel P) (eps a : ℝ) (heps : 0 < eps) (ha : a ≠ 0)
(hd : 2 ≤ d) (D : ℕ) (hDm : D ≤ m) (j : Fin d) :
blockMean (m := m) P eps (polynomialEstimate eps a D j) =
a * (chebyshevAbsPoly D).eval (contrast P j / a) := by
classical
letI := vectorBlockLaw_probability P eps m
unfold blockMean polynomialEstimate
rw [integral_finset_sum _ (fun _ _ => Integrable.of_finite)]
simp_rw [integral_const_mul]
have hmom : ∀ v ∈ range (D+1),
(∫ z, privateMoment (scaledMessages eps z) v j ∂vectorBlockLaw P eps m) =
(contrast P j)^v := by
intro v hv
change blockMean P eps (fun z => privateMoment (scaledMessages eps z) v j) = _
rw [blockMean_privateMoment_eq_rowMean_pow P eps v (by
have := Finset.mem_range.mp hv
omega) j, vectorMessageLaw_scaled_sign_integral P hP eps heps hd j]
rw [Finset.sum_congr rfl (fun v hv => congrArg
(fun x => (chebyshevAbsPoly D).coeff v * a ^ ((1 : ℤ) - (v : ℤ)) * x) (hmom v hv))]
rw [Polynomial.eval_eq_sum_range' (n := D+1) (by
have := chebyshevAbsPoly_natDegree_le D
omega), Finset.mul_sum]
apply Finset.sum_congr rfl
intro v hv
rw [zpow_sub₀ ha, zpow_one, zpow_natCast, div_pow]
ring
theorem global_polynomial_bias_of_gate
Assume the Cai–Low Chebyshev approximation theorem, the causal-model conditions for the data law, a positive privacy budget, dimension at least two, the stated even condition, polynomial degree at least two, and the stated dm condition. On the global radius one half, the cited approximation controls the bias.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
hCheb :
P :
hP :
eps :
ℝ
heps :
0 < eps
hd :
2 ≤ d
D :
ℕ
hEven :
Even D
hD :
2 ≤ D
hDm :
D ≤ m
j :
Fin d
conclusion
≤ 1/(D+1)
Proof (Lean source)
-- @node: global_polynomial_bias_of_gate
lemma global_polynomial_bias_of_gate (hCheb : CaiLowChebyshevApproximation)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d)
(D : ℕ) (hEven : Even D) (hD : 2 ≤ D) (hDm : D ≤ m) (j : Fin d) :
abs (blockMean (m := m) P eps (polynomialEstimate eps (1/2) D j) -
abs (contrast P j)) ≤ 1/(D+1) := by
rw [blockMean_polynomialEstimate P hP eps (1/2) heps (by norm_num) hd D hDm j]
have hx := contrast_mem_parameterCube P hP j
have happ := (hCheb D hEven hD).1 (contrast P j / (1/2)) (by
constructor <;> norm_num <;> linarith [hx.1, hx.2])
have habs : abs (contrast P j / (1/2)) = 2 * abs (contrast P j) := by
rw [div_eq_mul_inv, abs_mul]
norm_num
ring
rw [habs] at happ
have hfactor : abs ((1/2 : ℝ) * (chebyshevAbsPoly D).eval
(contrast P j / (1/2)) - abs (contrast P j)) =
(1/2 : ℝ) * abs ((chebyshevAbsPoly D).eval
(contrast P j / (1/2)) - 2 * abs (contrast P j)) := by
rw [← abs_of_nonneg (by norm_num : (0 : ℝ) ≤ 1/2), ← abs_mul]
congr 1
ring
rw [hfactor]
have hden : (0 : ℝ) < D+1 := by positivity
have hpi : (1 : ℝ) ≤ pi := le_trans (by norm_num) (Real.pi_gt_three).le
have hnum : 2 / (pi * (D+1)) ≤ 2 / (D+1) := by
apply div_le_div_of_nonneg_left (by norm_num) hden
nlinarith
calc
_ ≤ (1/2 : ℝ) * (2 / (D+1)) := mul_le_mul_of_nonneg_left
(happ.trans hnum) (by norm_num)
_ = _ := by ring
Finite Cauchy--Schwarz controls a sum of possibly dependent statistics.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
P :
eps :
ℝ
D :
ℕ
Proof (Lean source)
-- @node: blockMean_sum_sq_le
lemma blockMean_sum_sq_le (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(eps : ℝ) (D : ℕ) (f : ℕ → (Fin m → Fin d → Bool) → ℝ) :
blockMean P eps (fun z => (∑ v ∈ range (D+1), f v z)^2) ≤
(D+1 : ℝ) * ∑ v ∈ range (D+1), blockMean P eps (fun z => (f v z)^2) := by
letI := vectorBlockLaw_probability P eps m
unfold blockMean
calc
_ ≤ ∫ z, (D+1 : ℝ) * ∑ v ∈ range (D+1), (f v z)^2
∂vectorBlockLaw P eps m := by
apply integral_mono (Integrable.of_finite) (Integrable.of_finite)
intro z
simpa using Finset.sum_mul_sq_le_sq_mul_sq (range (D+1))
(fun _ => (1 : ℝ)) (fun v => f v z)
_ = _ := by
rw [integral_const_mul, integral_finset_sum _ (fun _ _ => Integrable.of_finite)]
theorem global_scaled_moment_second_bound
Assume the causal-model conditions for the data law, a positive privacy budget, dimension at least two, positive block size, the stated hm d condition, and the stated hv condition. Half-radius rescaling converts the private moment bound to a common geometric bound.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
P :
hP :
eps :
ℝ
heps :
0 < eps
hd :
2 ≤ d
hm :
0 < m
D v :
ℕ
hmD :
2*D ≤ m
hv :
v ≤ D
j :
Fin d
conclusion
blockMean (m := m) P eps (fun z => ((1/2 : ℝ)^((1 : ℤ) - (v : ℤ)) * privateMoment (scaledMessages eps z) v j)^2)
≤ (1/4 : ℝ) * (1 + 8*D*sigmaSquared d m eps)^D
Proof (Lean source)
-- @node: global_scaled_moment_second_bound
lemma global_scaled_moment_second_bound (P : Measure (FullRecord d))
[IsProbabilityMeasure P] (hP : CausalModel P) (eps : ℝ) (heps : 0 < eps)
(hd : 2 ≤ d) (hm : 0 < m) (D v : ℕ) (hmD : 2*D ≤ m) (hv : v ≤ D)
(j : Fin d) :
blockMean (m := m) P eps (fun z =>
((1/2 : ℝ)^((1 : ℤ) - (v : ℤ)) * privateMoment (scaledMessages eps z) v j)^2) ≤
(1/4 : ℝ) * (1 + 8*D*sigmaSquared d m eps)^D := by
have hsigma : 0 ≤ sigmaSquared d m eps := by unfold sigmaSquared; positivity
have hx := contrast_mem_parameterCube P hP j
have hx2 : (contrast P j)^2 ≤ (1/4 : ℝ) := by
nlinarith [hx.1, hx.2]
have hmom := blockMean_privateMoment_sq_le P hP eps heps hd hm v (by omega) j
have hscale (x : ℝ) : ((1/2 : ℝ)^((1 : ℤ) - (v : ℤ)))^2 * x^v =
(1/4 : ℝ) * (4*x)^v := by
rw [zpow_sub₀ (by norm_num : (1/2 : ℝ) ≠ 0), zpow_one, zpow_natCast,
div_pow, pow_right_comm]
norm_num
rw [div_mul_eq_mul_div, mul_div_assoc, ← div_pow]
congr 1
congr 1
ring
have hbase : 4*((contrast P j)^2 + 2*v*(noiseScale d eps)^2/m) ≤
1 + 8*D*sigmaSquared d m eps := by
have hvR : (v : ℝ) ≤ D := by exact_mod_cast hv
rw [mul_div_assoc]
dsimp only [sigmaSquared] at hsigma ⊢
nlinarith [mul_le_mul_of_nonneg_right hvR hsigma]
have hnonneg : 0 ≤ 4*((contrast P j)^2 + 2*v*(noiseScale d eps)^2/m) := by positivity
have hone : 1 ≤ 1 + 8*D*sigmaSquared d m eps := by
linarith [mul_nonneg (by positivity : (0 : ℝ) ≤ 8*D) hsigma]
unfold blockMean
simp_rw [mul_pow]
rw [integral_const_mul]
change _ ≤ _
calc
_ ≤ ((1/2 : ℝ)^((1 : ℤ) - (v : ℤ)))^2 *
((contrast P j)^2 + 2*v*(noiseScale d eps)^2/m)^v :=
mul_le_mul_of_nonneg_left hmom (sq_nonneg _)
_ = _ := hscale _
_ ≤ (1/4 : ℝ) * (1 + 8*D*sigmaSquared d m eps)^D := by
apply mul_le_mul_of_nonneg_left _ (by norm_num)
exact (pow_le_pow_left₀ hnonneg hbase v).trans (pow_le_pow_right₀ hone hv)
Assume the Cai–Low Chebyshev approximation theorem, the stated even condition, polynomial degree at least two, and the stated hv condition. The cited coefficient bound has a convenient squared exponential form.
Formal statement
hypotheses
conclusion
((chebyshevAbsPoly D).coeff v)^2 ≤ exp (3*D)
Proof (Lean source)
-- @node: chebyshev_coefficient_sq_le_exp
lemma chebyshev_coefficient_sq_le_exp (hCheb : CaiLowChebyshevApproximation)
(D v : ℕ) (hEven : Even D) (hD : 2 ≤ D) (hv : v ≤ D) :
((chebyshevAbsPoly D).coeff v)^2 ≤ exp (3*D) := by
have hc := (hCheb D hEven hD).2 v hv
have hlog : log 2 ≤ 1 := by
have := Real.log_le_sub_one_of_pos (by norm_num : (0 : ℝ) < 2)
norm_num at this ⊢
exact this
rw [Real.rpow_def_of_pos (by norm_num)] at hc
have hc' : |(chebyshevAbsPoly D).coeff v| ≤ exp (3*D/2) :=
hc.trans (Real.exp_le_exp.mpr (by nlinarith [Nat.cast_nonneg (α := ℝ) D]))
have hs := mul_le_mul hc' hc' (abs_nonneg _) (Real.exp_pos _).le
rw [← pow_two, sq_abs, ← Real.exp_add] at hs
have he : 3*(D : ℝ)/2 + 3*D/2 = 3*D := by ring
rw [he] at hs
exact hs
theorem global_polynomial_second_bound
Assume the Cai–Low Chebyshev approximation theorem, the causal-model conditions for the data law, a positive privacy budget, dimension at least two, positive block size, the stated even condition, polynomial degree at least two, and the stated hm d condition. A finite polynomial second moment uses no independence between moment degrees.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
hCheb :
P :
hP :
eps :
ℝ
heps :
0 < eps
hd :
2 ≤ d
hm :
0 < m
D :
ℕ
hEven :
Even D
hD :
2 ≤ D
hmD :
2*D ≤ m
j :
Fin d
conclusion
blockMean (m := m) P eps (fun z => (polynomialEstimate eps (1/2) D j z)^2)
≤ (1/4 : ℝ) * exp (5*D) * (1 + 8*D*sigmaSquared d m eps)^D
Proof (Lean source)
-- @node: global_polynomial_second_bound
lemma global_polynomial_second_bound (hCheb : CaiLowChebyshevApproximation)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d) (hm : 0 < m)
(D : ℕ) (hEven : Even D) (hD : 2 ≤ D) (hmD : 2*D ≤ m) (j : Fin d) :
blockMean (m := m) P eps (fun z => (polynomialEstimate eps (1/2) D j z)^2) ≤
(1/4 : ℝ) * exp (5*D) * (1 + 8*D*sigmaSquared d m eps)^D := by
classical
letI := vectorBlockLaw_probability P eps m
have hsigma : 0 ≤ sigmaSquared d m eps := by unfold sigmaSquared; positivity
have hterm (v : ℕ) (hv : v ∈ range (D+1)) :
blockMean (m := m) P eps (fun z =>
((chebyshevAbsPoly D).coeff v * (1/2 : ℝ)^((1 : ℤ) - (v : ℤ)) *
privateMoment (scaledMessages eps z) v j)^2) ≤
exp (3*D) * ((1/4 : ℝ) * (1 + 8*D*sigmaSquared d m eps)^D) := by
have hvD : v ≤ D := by have := Finset.mem_range.mp hv; omega
have hmoment := global_scaled_moment_second_bound P hP eps heps hd hm D v hmD hvD j
have hc := chebyshev_coefficient_sq_le_exp hCheb D v hEven hD hvD
have heq : blockMean (m := m) P eps (fun z =>
((chebyshevAbsPoly D).coeff v * (1/2 : ℝ)^((1 : ℤ) - (v : ℤ)) *
privateMoment (scaledMessages eps z) v j)^2) =
((chebyshevAbsPoly D).coeff v)^2 * blockMean (m := m) P eps (fun z =>
((1/2 : ℝ)^((1 : ℤ) - (v : ℤ)) * privateMoment (scaledMessages eps z) v j)^2) := by
unfold blockMean
simp only [mul_assoc, mul_pow]
rw [integral_const_mul]
rw [heq]
exact mul_le_mul hc hmoment (integral_nonneg (fun _ => sq_nonneg _)) (Real.exp_pos _).le
have hcard : (D+1 : ℝ)^2 ≤ exp (2*D) := by
have hh : (D+1 : ℝ) ≤ exp D := by
linarith [Real.add_one_le_exp (D : ℝ)]
have hs := mul_le_mul hh hh (by positivity : (0 : ℝ) ≤ D+1) (Real.exp_pos _).le
rw [← Real.exp_add] at hs
simpa [← pow_two, two_mul] using hs
calc
_ ≤ (D+1 : ℝ) * ∑ v ∈ range (D+1),
blockMean P eps (fun z => ((chebyshevAbsPoly D).coeff v *
(1/2 : ℝ)^((1 : ℤ) - (v : ℤ)) * privateMoment (scaledMessages eps z) v j)^2) :=
blockMean_sum_sq_le P eps D _
_ ≤ (D+1 : ℝ) * ∑ _v ∈ range (D+1),
exp (3*D) * ((1/4 : ℝ) * (1 + 8*D*sigmaSquared d m eps)^D) := by
exact mul_le_mul_of_nonneg_left (Finset.sum_le_sum hterm) (by positivity)
_ = (D+1 : ℝ)^2 * exp (3*D) *
((1/4 : ℝ) * (1 + 8*D*sigmaSquared d m eps)^D) := by
simp only [Finset.sum_const, Finset.card_range, nsmul_eq_mul, Nat.cast_add, Nat.cast_one]
ring
_ ≤ exp (2*D) * exp (3*D) *
((1/4 : ℝ) * (1 + 8*D*sigmaSquared d m eps)^D) := by
gcongr
_ = _ := by
rw [← Real.exp_add]
have he : 2*(D : ℝ) + 3*D = 5*D := by ring
rw [he]
ring
theorem global_calibration_exponential_bound Lemma global_calibration_exponential_bound in the paper ↗
Assume dimension at least two and the stated degree condition. The degree restriction converts the geometric second-moment bound to the paper's exponent.
Formal statement
hypotheses
d m D :
ℕ
eps :
ℝ
hd :
2 ≤ d
hDegree :
(D : ℝ)
conclusion
exp (5*D) * (1 + 8*D*sigmaSquared d m eps)^D
Proof (Lean source)
-- @node: global_calibration_exponential_bound
lemma global_calibration_exponential_bound (d m D : ℕ) (eps : ℝ) (hd : 2 ≤ d)
(hDegree : (D : ℝ) ≤ (1/1024 : ℝ) * logDim d /
log (exp 1 + sigmaSquared d m eps * logDim d)) :
exp (5*D) * (1 + 8*D*sigmaSquared d m eps)^D ≤
exp (9*D*log (exp 1 + sigmaSquared d m eps * logDim d)) := by
let H := log (exp 1 + sigmaSquared d m eps * logDim d)
have hL := (logDim_bounds d hd).1
have hsigma : 0 ≤ sigmaSquared d m eps := by unfold sigmaSquared; positivity
have harg : exp 1 ≤ exp 1 + sigmaSquared d m eps * logDim d := by
nlinarith
have hH : 1 ≤ H := by
have := Real.log_le_log (Real.exp_pos 1) harg
simpa [H] using this
have hDL : (D : ℝ) ≤ logDim d := by
have hh := (le_div_iff₀ (show 0 < H by linarith)).mp hDegree
have hDH : (D : ℝ) ≤ D*H := by nlinarith [Nat.cast_nonneg (α := ℝ) D]
linarith
have heH : exp H = exp 1 + sigmaSquared d m eps * logDim d := by
exact Real.exp_log ((Real.exp_pos 1).trans_le harg)
have he1 : 1 ≤ exp 1 := (Real.one_le_exp_iff).mpr (by norm_num)
have hbase : 1 + 8*D*sigmaSquared d m eps ≤ 8*exp H := by
rw [heH]
nlinarith [mul_le_mul_of_nonneg_right hDL hsigma]
have h8 : (8 : ℝ) ≤ exp 3 := by
have h2 : (2 : ℝ) ≤ exp 1 := by
linarith [Real.add_one_le_exp (1 : ℝ)]
have hpow := pow_le_pow_left₀ (by norm_num : (0 : ℝ) ≤ 2) h2 3
rw [← Real.exp_nat_mul] at hpow
norm_num at hpow ⊢
exact hpow
have h8H : (8 : ℝ) ≤ exp (3*H) :=
h8.trans (Real.exp_le_exp.mpr (by linarith))
have hbase' : 1 + 8*D*sigmaSquared d m eps ≤ exp (4*H) := by
calc
_ ≤ 8*exp H := hbase
_ ≤ exp (3*H) * exp H :=
mul_le_mul_of_nonneg_right h8H (Real.exp_pos _).le
_ = _ := by rw [← Real.exp_add]; congr 1; ring
have hpow : (1 + 8*D*sigmaSquared d m eps)^D ≤ exp (4*D*H) := by
have hh := pow_le_pow_left₀ (by positivity : (0 : ℝ) ≤
1 + 8*D*sigmaSquared d m eps) hbase' D
rw [← Real.exp_nat_mul] at hh
have he : (D : ℝ) * (4*H) = 4*D*H := by ring
rwa [he] at hh
calc
_ ≤ exp (5*D) * exp (4*D*H) :=
mul_le_mul_of_nonneg_left hpow (Real.exp_pos _).le
_ = exp (5*D + 4*D*H) := (Real.exp_add _ _).symm
_ ≤ exp (9*D*H) := by
apply Real.exp_le_exp.mpr
nlinarith [Nat.cast_nonneg (α := ℝ) D]
theorem global_polynomial_second_calibrated
Assume the Cai–Low Chebyshev approximation theorem, the causal-model conditions for the data law, a positive privacy budget, dimension at least two, positive block size, the stated even condition, polynomial degree at least two, the stated hm d condition, and the stated degree condition. The global polynomial's second moment is at most one quarter of the calibrated exponent.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
hCheb :
P :
hP :
eps :
ℝ
heps :
0 < eps
hd :
2 ≤ d
hm :
0 < m
D :
ℕ
hEven :
Even D
hD :
2 ≤ D
hmD :
2*D ≤ m
hDegree :
(D : ℝ)
j :
Fin d
conclusion
blockMean (m := m) P eps (fun z => (polynomialEstimate eps (1/2) D j z)^2)
Proof (Lean source)
-- @node: global_polynomial_second_calibrated
lemma global_polynomial_second_calibrated (hCheb : CaiLowChebyshevApproximation)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d) (hm : 0 < m)
(D : ℕ) (hEven : Even D) (hD : 2 ≤ D) (hmD : 2*D ≤ m)
(hDegree : (D : ℝ) ≤ (1/1024 : ℝ) * logDim d /
log (exp 1 + sigmaSquared d m eps * logDim d)) (j : Fin d) :
blockMean (m := m) P eps (fun z => (polynomialEstimate eps (1/2) D j z)^2) ≤
(1/4 : ℝ) * exp (9*D*log (exp 1 + sigmaSquared d m eps * logDim d)) := by
refine (global_polynomial_second_bound hCheb P hP eps heps hd hm D hEven hD hmD j).trans ?_
rw [mul_assoc]
exact mul_le_mul_of_nonneg_left
(global_calibration_exponential_bound d m D eps hd hDegree) (by norm_num)
theorem global_polynomial_calibration_of_gate
Assume the Cai–Low Chebyshev approximation theorem, the bounded-mean concentration inequality, independent and identically distributed participant records, the causal-model conditions for the data law, an admissible sample size, dimension, and privacy budget, positive block size, a block no larger than the sample, the stated even condition, polynomial degree at least two, the stated hm d condition, and the stated degree condition. Global-radius calibration from the explicit approximation and bounded-mean gates.
Formal statement
hypotheses
n :
ℕ
m :
ℕ
d :
ℕ
hCheb_of_gate :
hMean_of_gate :
S :
SamplingScheme n d
hIID :
P :
hP :
eps :
ℝ
hAllowed :
Allowed n d eps
hm :
0 < m
hmn :
m ≤ n
D :
ℕ
hEven :
Even D
hD :
2 ≤ D
hmD :
2*D ≤ m
hDegree :
(D : ℝ)
conclusion
conclusion 2
blockVar (m := m) P eps (fun z => (d : ℝ)⁻¹ * ∑ j, polynomialEstimate eps (1/2) D j z)
Proof (Lean source)
-- @node: global_polynomial_calibration_of_gate
lemma global_polynomial_calibration_of_gate
(hCheb_of_gate : CaiLowChebyshevApproximation) (hMean_of_gate : BoundedMeanConcentration)
(S : SamplingScheme n d) (hIID : IidPeople S)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(eps : ℝ) (hAllowed : Allowed n d eps) (hm : 0 < m) (hmn : m ≤ n)
(D : ℕ) (hEven : Even D) (hD : 2 ≤ D) (hmD : 2*D ≤ m)
(hDegree : (D : ℝ) ≤ (1/1024 : ℝ) * logDim d /
log (exp 1 + sigmaSquared d m eps * logDim d)) :
(∀ j : Fin d, abs (blockMean (m := m) P eps (polynomialEstimate eps (1/2) D j) - abs
(contrast P j)) ≤
1/(D+1)) ∧
blockVar (m := m) P eps (fun z => (d : ℝ)⁻¹ * ∑ j, polynomialEstimate eps (1/2) D j z) ≤
exp (9*D*log (exp 1 + sigmaSquared d m eps * logDim d))/(2*d) := by
constructor
· intro j
exact global_polynomial_bias_of_gate hCheb_of_gate P hP eps hAllowed.2.2.1
hAllowed.2.1 D hEven hD (by omega) j
· classical
letI := vectorBlockLaw_probability P eps m
let E := exp (9*D*log (exp 1 + sigmaSquared d m eps * logDim d))
let g : Fin d → (Fin m → ℝ) → ℝ := fun j w =>
∑ v ∈ range (D+1), (chebyshevAbsPoly D).coeff v *
(1/2 : ℝ)^((1 : ℤ) - (v : ℤ)) * privateMoment (fun i _ => w i) v j
have hg : ∀ j, Measurable (g j) := by
intro j
dsimp only [g]
unfold privateMoment
fun_prop
have hcol : columnStatistic eps g = fun j => polynomialEstimate eps (1/2) D j := by
funext j z
unfold columnStatistic polynomialEstimate g privateMoment
rfl
have hvar (j : Fin d) : blockVar (m := m) P eps (polynomialEstimate eps (1/2) D j) ≤
(1/4 : ℝ)*E := by
calc
_ ≤ blockMean P eps (fun z => (polynomialEstimate eps (1/2) D j z)^2) := by
rw [blockVar_eq_variance]
exact variance_le_expectation_sq (by fun_prop)
_ ≤ _ := global_polynomial_second_calibrated hCheb_of_gate P hP eps
hAllowed.2.2.1 hAllowed.2.1 hm D hEven hD hmD hDegree j
have hmax : sSup (range (fun j : Fin d =>
blockVar (m := m) P eps (polynomialEstimate eps (1/2) D j))) ≤ (1/4 : ℝ)*E := by
apply csSup_le
· have hdpos : 0 < d := by have := hAllowed.2.1; omega
exact ⟨_, Set.mem_range_self (⟨0, hdpos⟩ : Fin d)⟩
· rintro _ ⟨j,rfl⟩
exact hvar j
have hdep := (private_moment_and_dependence S hIID P hP eps hAllowed.2.2
hAllowed.2.1 hm hmn).2.2.2.2.2 g hg
rw [hcol] at hdep
calc
_ ≤ (2/(d : ℝ)) * sSup (range (fun j : Fin d =>
blockVar (m := m) P eps (polynomialEstimate eps (1/2) D j))) := hdep.2
_ ≤ (2/(d : ℝ)) * ((1/4 : ℝ)*E) :=
mul_le_mul_of_nonneg_left hmax (by positivity)
_ = E/(2*d) := by ring
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Calibration.Hybrid 16 declarations Independent pilot/evaluation blocks, unbiased evaluation means, and exact three-branch identities for hybrid bias and centered squared error.
Helpers/Calibration/Hybrid
Independent pilot/evaluation blocks, unbiased evaluation means, and exact three-branch identities for hybrid bias and centered squared error. The C7 variance reduction, inside-window bias and second moment (C5/C8), and degree calibration (C2) are proved. Pilot tails (C4) and nonnegative inside-window bias and variance assembly are proved. Outside-window estimates remain open.
Independence factors a product of a pilot statistic and an evaluation statistic.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
P :
eps :
ℝ
conclusion
hybridMean P eps (fun z => f z.1 * g z.2)
Proof (Lean source)
-- @node: hybridMean_pilot_mul_evaluation
lemma hybridMean_pilot_mul_evaluation (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(eps : ℝ) (f g : (Fin m → Fin d → Bool) → ℝ) :
hybridMean P eps (fun z => f z.1 * g z.2) =
blockMean (m := m) P eps f * blockMean (m := m) P eps g := by
letI := vectorBlockLaw_probability P eps m
exact integral_prod_mul f g
Assume the stated t condition. The central, positive, and negative pilot events partition all outcomes, including ties.
Formal statement
hypotheses
T u :
ℝ
hT :
0 ≤ T
conclusion
(if |u| ≤ T then (1 : ℝ) else 0) + (if T < u then 1 else 0) + (if u < -T then 1 else 0)
= 1
Proof (Lean source)
-- @node: hybridPilot_partition
lemma hybridPilot_partition (T u : ℝ) (hT : 0 ≤ T) :
(if |u| ≤ T then (1 : ℝ) else 0) + (if T < u then 1 else 0) +
(if u < -T then 1 else 0) = 1 := by
by_cases hc : |u| ≤ T
· have hu := abs_le.mp hc
rw [if_pos hc, if_neg (by linarith), if_neg (by linarith)]
norm_num
· by_cases hp : T < u
· rw [if_neg hc, if_pos hp, if_neg (by linarith)]
norm_num
· have hn : u < -T := by
have := not_le.mp hc
rcases le_total 0 u with hu | hu
· rw [abs_of_nonneg hu] at this
exact False.elim (hp this)
· rw [abs_of_nonpos hu] at this
linarith
rw [if_neg hc, if_neg hp, if_pos hn]
norm_num
The implemented hybrid is exactly its three disjoint pilot branches.
Formal statement
hypotheses
conclusion
T :
hybridColumn eps D j z
= (if |scaledColumnMean eps j z.1| ≤ T then (1 : ℝ) else 0) * polynomialEstimate eps (2*T) D j z.2
+ (if T < scaledColumnMean eps j z.1 then 1 else 0) * scaledColumnMean eps j z.2
- (if scaledColumnMean eps j z.1 < -T then 1 else 0) * scaledColumnMean eps j z.2
Proof (Lean source)
-- @node: hybridColumn_three_branches
lemma hybridColumn_three_branches (eps : ℝ) (D : ℕ) (j : Fin d)
(z : (Fin m → Fin d → Bool) × (Fin m → Fin d → Bool)) :
let T := 4 * sqrt (sigmaSquared d m eps) * sqrt (logDim d)
hybridColumn eps D j z =
(if |scaledColumnMean eps j z.1| ≤ T then (1 : ℝ) else 0) *
polynomialEstimate eps (2*T) D j z.2 +
(if T < scaledColumnMean eps j z.1 then 1 else 0) * scaledColumnMean eps j z.2 -
(if scaledColumnMean eps j z.1 < -T then 1 else 0) * scaledColumnMean eps j z.2 := by
dsimp only
have hT := hybridThreshold_nonneg (m := m) (d := d) eps
unfold hybridColumn
dsimp only
by_cases hc : |scaledColumnMean eps j z.1| ≤
4 * sqrt (sigmaSquared d m eps) * sqrt (logDim d)
· have hu := abs_le.mp hc
rw [if_pos hc, if_pos hc, if_neg (by linarith), if_neg (by linarith)]
ring
· by_cases hp : 4 * sqrt (sigmaSquared d m eps) * sqrt (logDim d) <
scaledColumnMean eps j z.1
· have hpos : 0 < scaledColumnMean eps j z.1 := by linarith
rw [if_neg hc, if_neg hc, if_pos hpos, if_pos hp, if_neg (by linarith)]
ring
· have hn : scaledColumnMean eps j z.1 <
-(4 * sqrt (sigmaSquared d m eps) * sqrt (logDim d)) := by
have := not_le.mp hc
rcases le_total 0 (scaledColumnMean eps j z.1) with hu | hu
· rw [abs_of_nonneg hu] at this
exact False.elim (hp this)
· rw [abs_of_nonpos hu] at this
linarith
rw [if_neg hc, if_neg hc, if_neg (by linarith), if_pos (by linarith),
if_neg hp, if_pos hn]
ring
Assume the stated t condition. Exact pilot branch probabilities sum to one under the finite block law.
Formal statement
hypotheses
conclusion
blockMean (m := m) P eps (fun z => if |scaledColumnMean eps j z| ≤ T then (1 : ℝ) else 0)
+ blockMean (m := m) P eps (fun z => if T < scaledColumnMean eps j z then (1 : ℝ) else 0)
+ blockMean (m := m) P eps (fun z => if scaledColumnMean eps j z < -T then (1 : ℝ) else 0)
= 1
Proof (Lean source)
-- @node: hybridPilot_probability_partition
lemma hybridPilot_probability_partition (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(eps T : ℝ) (hT : 0 ≤ T) (j : Fin d) :
blockMean (m := m) P eps (fun z => if |scaledColumnMean eps j z| ≤ T then (1 : ℝ) else 0) +
blockMean (m := m) P eps (fun z => if T < scaledColumnMean eps j z then (1 : ℝ) else 0) +
blockMean (m := m) P eps (fun z => if scaledColumnMean eps j z < -T then (1 : ℝ) else 0) = 1 := by
letI := vectorBlockLaw_probability P eps m
unfold blockMean
rw [← integral_add (Integrable.of_finite) (Integrable.of_finite),
← integral_add (Integrable.of_finite) (Integrable.of_finite)]
simp_rw [hybridPilot_partition T _ hT]
simp
theorem hybridColumn_mean_error_identity
Assume the causal-model conditions for the data law, a positive privacy budget, dimension at least two, positive block size, and the stated dm condition. Independence and moment unbiasedness give the exact signed hybrid bias identity (C3).
Formal statement
hypotheses
m :
ℕ
d :
ℕ
P :
hP :
eps :
ℝ
heps :
0 < eps
hd :
2 ≤ d
hm :
0 < m
D :
ℕ
hDm :
D ≤ m
j :
Fin d
conclusion
T :
h :
blockMean (m := m) P eps (fun z => if |scaledColumnMean eps j z| ≤ T then (1 : ℝ) else 0)
w :
blockMean (m := m) P eps (fun z => if scaledColumnMean eps j z < -T then (1 : ℝ) else 0)
hybridMean (m := m) P eps (hybridColumn eps D j) - contrast P j
= h * ((2*T) * (chebyshevAbsPoly D).eval (contrast P j / (2*T)) - contrast P j)
- 2 * contrast P j * w
Proof (Lean source)
-- @node: hybridColumn_mean_error_identity
lemma hybridColumn_mean_error_identity (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(hP : CausalModel P) (eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d)
(hm : 0 < m) (D : ℕ) (hDm : D ≤ m) (j : Fin d) :
let T := 4 * sqrt (sigmaSquared d m eps) * sqrt (logDim d)
let h := blockMean (m := m) P eps (fun z => if |scaledColumnMean eps j z| ≤ T then (1 : ℝ) else 0)
let w := blockMean (m := m) P eps (fun z => if scaledColumnMean eps j z < -T then (1 : ℝ) else 0)
hybridMean (m := m) P eps (hybridColumn eps D j) - contrast P j =
h * ((2*T) * (chebyshevAbsPoly D).eval (contrast P j / (2*T)) - contrast P j) -
2 * contrast P j * w := by
letI := vectorBlockLaw_probability P eps m
dsimp only
have hTpos := hybridThreshold_pos eps heps hd hm
have hfun := funext (hybridColumn_three_branches (m := m) eps D j)
rw [hfun]
unfold hybridMean hybridLaw
rw [integral_sub (Integrable.of_finite) (Integrable.of_finite),
integral_add (Integrable.of_finite) (Integrable.of_finite)]
let T := 4 * sqrt (sigmaSquared d m eps) * sqrt (logDim d)
rw [integral_prod_mul (fun z => if |scaledColumnMean eps j z| ≤ T then (1 : ℝ) else 0)
(polynomialEstimate eps (2*T) D j),
integral_prod_mul (fun z => if T < scaledColumnMean eps j z then (1 : ℝ) else 0)
(scaledColumnMean eps j),
integral_prod_mul (fun z => if scaledColumnMean eps j z < -T then (1 : ℝ) else 0)
(scaledColumnMean eps j)]
change blockMean (m := m) P eps _ * blockMean (m := m) P eps _ + blockMean (m := m) P eps _ * blockMean (m := m) P eps _ -
blockMean (m := m) P eps _ * blockMean (m := m) P eps _ - _ = _
rw [blockMean_scaledColumnMean P hP eps heps hd hm,
blockMean_polynomialEstimate P hP eps _ heps (by dsimp [T]; positivity) hd D hDm]
have hparts := hybridPilot_probability_partition (m := m) P eps _ hTpos.le j
dsimp [T] at ⊢
linear_combination (contrast P j) * hparts
Squaring the hybrid error preserves the three disjoint pilot branches.
Formal statement
hypotheses
conclusion
T :
(hybridColumn eps D j z - x)^2
= (if |scaledColumnMean eps j z.1| ≤ T then (1 : ℝ) else 0) * (polynomialEstimate eps (2*T) D j z.2 - x)^2
+ (if T < scaledColumnMean eps j z.1 then 1 else 0) * (scaledColumnMean eps j z.2 - x)^2
+ (if scaledColumnMean eps j z.1 < -T then 1 else 0) * (-scaledColumnMean eps j z.2 - x)^2
Proof (Lean source)
-- @node: hybridColumn_sq_error_branches
lemma hybridColumn_sq_error_branches (eps x : ℝ) (D : ℕ) (j : Fin d)
(z : (Fin m → Fin d → Bool) × (Fin m → Fin d → Bool)) :
let T := 4 * sqrt (sigmaSquared d m eps) * sqrt (logDim d)
(hybridColumn eps D j z - x)^2 =
(if |scaledColumnMean eps j z.1| ≤ T then (1 : ℝ) else 0) *
(polynomialEstimate eps (2*T) D j z.2 - x)^2 +
(if T < scaledColumnMean eps j z.1 then 1 else 0) * (scaledColumnMean eps j z.2 - x)^2 +
(if scaledColumnMean eps j z.1 < -T then 1 else 0) * (-scaledColumnMean eps j z.2 - x)^2 := by
dsimp only
rw [hybridColumn_three_branches]
have hT := hybridThreshold_nonneg (m := m) (d := d) eps
by_cases hc : |scaledColumnMean eps j z.1| ≤
4 * sqrt (sigmaSquared d m eps) * sqrt (logDim d)
· have hu := abs_le.mp hc
rw [if_pos hc, if_neg (by linarith), if_neg (by linarith)]
ring
· by_cases hp : 4 * sqrt (sigmaSquared d m eps) * sqrt (logDim d) <
scaledColumnMean eps j z.1
· rw [if_neg hc, if_pos hp, if_neg (by linarith)]
ring
· have hn : scaledColumnMean eps j z.1 <
-(4 * sqrt (sigmaSquared d m eps) * sqrt (logDim d)) := by
have := not_le.mp hc
rcases le_total 0 (scaledColumnMean eps j z.1) with hu | hu
· rw [abs_of_nonneg hu] at this
exact False.elim (hp this)
· rw [abs_of_nonpos hu] at this
linarith
rw [if_neg hc, if_neg hp, if_pos hn]
ring
theorem blockMean_negative_scaledColumn_error
Assume the causal-model conditions for the data law, a positive privacy budget, dimension at least two, and positive block size. Reversing an unbiased evaluation mean adds exactly four squared contrasts to its error.
Formal statement
hypotheses
conclusion
blockMean (m := m) P eps (fun z => (-scaledColumnMean eps j z - contrast P j)^2)
= blockVar (m := m) P eps (scaledColumnMean eps j) + 4 * (contrast P j)^2
Proof (Lean source)
-- @node: blockMean_negative_scaledColumn_error
lemma blockMean_negative_scaledColumn_error (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(hP : CausalModel P) (eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d)
(hm : 0 < m) (j : Fin d) :
blockMean (m := m) P eps (fun z => (-scaledColumnMean eps j z - contrast P j)^2) =
blockVar (m := m) P eps (scaledColumnMean eps j) + 4 * (contrast P j)^2 := by
letI := vectorBlockLaw_probability P eps m
have hmean := blockMean_scaledColumnMean (m := m) P hP eps heps hd hm j
unfold blockVar
rw [hmean]
have hexp : (fun z : Fin m → Fin d → Bool => (-scaledColumnMean eps j z - contrast P j)^2) =
(fun z => (scaledColumnMean eps j z - contrast P j)^2 +
4 * contrast P j * scaledColumnMean eps j z) := by
funext z
ring
unfold blockMean
rw [hexp, integral_add (Integrable.of_finite) (Integrable.of_finite), integral_const_mul]
change _ + 4 * contrast P j * blockMean (m := m) P eps (scaledColumnMean eps j) = _
rw [hmean]
ring
theorem hybridColumn_centered_error_identity
Assume the causal-model conditions for the data law, a positive privacy budget, dimension at least two, and positive block size. The exact centered-error identity conditions on the three pilot branches (C7 precursor).
Formal statement
hypotheses
conclusion
T :
h :
blockMean (m := m) P eps (fun z => if |scaledColumnMean eps j z| ≤ T then (1 : ℝ) else 0)
w :
blockMean (m := m) P eps (fun z => if scaledColumnMean eps j z < -T then (1 : ℝ) else 0)
hybridMean (m := m) P eps (fun z => (hybridColumn eps D j z - contrast P j)^2)
= h * blockMean (m := m) P eps (fun z => (polynomialEstimate eps (2*T) D j z - contrast P j)^2)
+ (1-h) * blockVar (m := m) P eps (scaledColumnMean eps j)
+ 4 * (contrast P j)^2 * w
Proof (Lean source)
-- @node: hybridColumn_centered_error_identity
lemma hybridColumn_centered_error_identity (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(hP : CausalModel P) (eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d)
(hm : 0 < m) (D : ℕ) (j : Fin d) :
let T := 4 * sqrt (sigmaSquared d m eps) * sqrt (logDim d)
let h := blockMean (m := m) P eps (fun z => if |scaledColumnMean eps j z| ≤ T then (1 : ℝ) else 0)
let w := blockMean (m := m) P eps (fun z => if scaledColumnMean eps j z < -T then (1 : ℝ) else 0)
hybridMean (m := m) P eps (fun z => (hybridColumn eps D j z - contrast P j)^2) =
h * blockMean (m := m) P eps (fun z => (polynomialEstimate eps (2*T) D j z - contrast P j)^2) +
(1-h) * blockVar (m := m) P eps (scaledColumnMean eps j) + 4 * (contrast P j)^2 * w := by
letI := vectorBlockLaw_probability P eps m
dsimp only
rw [funext (hybridColumn_sq_error_branches (m := m) eps (contrast P j) D j)]
unfold hybridMean hybridLaw
rw [integral_add (Integrable.of_finite) (Integrable.of_finite),
integral_add (Integrable.of_finite) (Integrable.of_finite)]
let T := 4 * sqrt (sigmaSquared d m eps) * sqrt (logDim d)
rw [integral_prod_mul (fun z => if |scaledColumnMean eps j z| ≤ T then (1 : ℝ) else 0)
(fun z => (polynomialEstimate eps (2*T) D j z - contrast P j)^2),
integral_prod_mul (fun z => if T < scaledColumnMean eps j z then (1 : ℝ) else 0)
(fun z => (scaledColumnMean eps j z - contrast P j)^2),
integral_prod_mul (fun z => if scaledColumnMean eps j z < -T then (1 : ℝ) else 0)
(fun z => (-scaledColumnMean eps j z - contrast P j)^2)]
have hvar : blockMean (m := m) P eps (fun z => (scaledColumnMean eps j z - contrast P j)^2) =
blockVar (m := m) P eps (scaledColumnMean eps j) := by
unfold blockVar
rw [blockMean_scaledColumnMean P hP eps heps hd hm]
rfl
change blockMean (m := m) P eps _ * blockMean (m := m) P eps _ + blockMean (m := m) P eps _ * blockMean (m := m) P eps _ +
blockMean (m := m) P eps _ * blockMean (m := m) P eps _ = _
rw [hvar, blockMean_negative_scaledColumn_error P hP eps heps hd hm]
have hparts := hybridPilot_probability_partition (m := m) P eps T
(hybridThreshold_nonneg eps) j
dsimp [T] at *
linear_combination blockVar (m := m) P eps (scaledColumnMean eps j) * hparts
theorem hybridPilot_central_probability_range Lemma hybridPilot_central_probability_range in the paper ↗
A pilot branch indicator has expectation between zero and one.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: hybridPilot_central_probability_range
lemma hybridPilot_central_probability_range (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(eps T : ℝ) (j : Fin d) :
blockMean (m := m) P eps (fun z => if |scaledColumnMean eps j z| ≤ T then (1 : ℝ) else 0) ∈
Icc 0 1 := by
letI := vectorBlockLaw_probability P eps m
constructor
· exact integral_nonneg (fun z => by split <;> norm_num)
· calc
_ ≤ ∫ _z : Fin m → Fin d → Bool, (1 : ℝ) ∂vectorBlockLaw P eps m := by
apply integral_mono (Integrable.of_finite) (Integrable.of_finite)
intro z
dsimp only
split <;> norm_num
_ = 1 := by simp
Centering at any fixed target can only increase the hybrid second moment.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
P :
eps x :
ℝ
conclusion
hybridVar P eps f ≤ hybridMean P eps (fun z => (f z - x)^2)
Proof (Lean source)
-- @node: hybridVar_le_centered_error
lemma hybridVar_le_centered_error (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(eps x : ℝ) (f : ((Fin m → Fin d → Bool) × (Fin m → Fin d → Bool)) → ℝ) :
hybridVar P eps f ≤ hybridMean P eps (fun z => (f z - x)^2) := by
letI := hybridLaw_probability (m := m) P eps
have h := variance_le_expectation_sq (μ := hybridLaw P eps m)
(X := fun z => f z - x) (by fun_prop)
rw [variance_sub_const (by fun_prop) x] at h
rw [variance_eq_integral (by fun_prop)] at h
exact h
theorem hybridColumn_centered_error_le
Assume the causal-model conditions for the data law, a positive privacy budget, dimension at least two, and positive block size. The exact branch identity and evaluation variance yield the roadmap's bound (C7).
Formal statement
hypotheses
conclusion
T :
h :
blockMean (m := m) P eps (fun z => if |scaledColumnMean eps j z| ≤ T then (1 : ℝ) else 0)
w :
blockMean (m := m) P eps (fun z => if scaledColumnMean eps j z < -T then (1 : ℝ) else 0)
hybridVar (m := m) P eps (hybridColumn eps D j)
≤ 2*h * blockMean (m := m) P eps (fun z => (polynomialEstimate eps (2*T) D j z)^2)
+ 2*h*(contrast P j)^2
+ sigmaSquared d m eps
+ 4*(contrast P j)^2*w
Proof (Lean source)
-- @node: hybridColumn_centered_error_le
lemma hybridColumn_centered_error_le (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(hP : CausalModel P) (eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d)
(hm : 0 < m) (D : ℕ) (j : Fin d) :
let T := 4 * sqrt (sigmaSquared d m eps) * sqrt (logDim d)
let h := blockMean (m := m) P eps (fun z => if |scaledColumnMean eps j z| ≤ T then (1 : ℝ) else 0)
let w := blockMean (m := m) P eps (fun z => if scaledColumnMean eps j z < -T then (1 : ℝ) else 0)
hybridVar (m := m) P eps (hybridColumn eps D j) ≤
2*h * blockMean (m := m) P eps (fun z => (polynomialEstimate eps (2*T) D j z)^2) +
2*h*(contrast P j)^2 + sigmaSquared d m eps + 4*(contrast P j)^2*w := by
letI := vectorBlockLaw_probability P eps m
dsimp only
apply (hybridVar_le_centered_error P eps (contrast P j) _).trans
rw [hybridColumn_centered_error_identity P hP eps heps hd hm D j]
let T := 4 * sqrt (sigmaSquared d m eps) * sqrt (logDim d)
let h := blockMean (m := m) P eps (fun z => if |scaledColumnMean eps j z| ≤ T then (1 : ℝ) else 0)
have hrange := hybridPilot_central_probability_range (m := m) P eps T j
have hpoly : blockMean (m := m) P eps
(fun z => (polynomialEstimate eps (2*T) D j z - contrast P j)^2) ≤
2 * blockMean (m := m) P eps (fun z => (polynomialEstimate eps (2*T) D j z)^2) +
2 * (contrast P j)^2 := by
calc
_ ≤ ∫ z, 2 * (polynomialEstimate eps (2*T) D j z)^2 + 2 * (contrast P j)^2
∂vectorBlockLaw P eps m := by
apply integral_mono (Integrable.of_finite) (Integrable.of_finite)
intro z
nlinarith [sq_nonneg (polynomialEstimate eps (2*T) D j z + contrast P j)]
_ = _ := by
rw [integral_add (Integrable.of_finite) (Integrable.of_finite),
integral_const_mul, integral_const]
simp [blockMean]
have hv := blockVar_scaledColumnMean_le (m := m) P hP eps heps hd hm j
have hfirst := mul_le_mul_of_nonneg_left hpoly hrange.1
have hsecond := mul_le_mul_of_nonneg_left hv (sub_nonneg.mpr hrange.2)
have hsigma : 0 ≤ sigmaSquared d m eps := by unfold sigmaSquared; positivity
have hthird : (1-h) * sigmaSquared d m eps ≤ sigmaSquared d m eps := by
dsimp [h]
nlinarith [mul_nonneg hrange.1 hsigma]
dsimp [T, h] at *
linarith
Assume the stated l condition and the stated d condition. The stipulated even degree obeys both sides of the roadmap's window (C2).
Formal statement
hypotheses
L :
ℝ
hL :
4096 ≤ L
D :
ℕ
hD :
D = 2*⌊(1/1024 : ℝ)*L/2⌋₊
conclusion
conclusion 1
Even D
conclusion 2
2 ≤ D
conclusion 3
L/2048 ≤ (D : ℝ)
conclusion 4
(D : ℝ) ≤ L/1024
Proof (Lean source)
-- @node: hybridDegree_bounds
lemma hybridDegree_bounds (L : ℝ) (hL : 4096 ≤ L) (D : ℕ)
(hD : D = 2*⌊(1/1024 : ℝ)*L/2⌋₊) :
Even D ∧ 2 ≤ D ∧ L/2048 ≤ (D : ℝ) ∧ (D : ℝ) ≤ L/1024 := by
have hnonneg : 0 ≤ (1/1024 : ℝ)*L/2 := by linarith
have hfloor := Nat.floor_le hnonneg
have hlt := Nat.lt_floor_add_one ((1/1024 : ℝ)*L/2)
have hcast : (D : ℝ) = 2 * (⌊(1/1024 : ℝ)*L/2⌋₊ : ℝ) := by
exact_mod_cast hD
refine ⟨?_, ?_, ?_, ?_⟩
· exact ⟨⌊(1/1024 : ℝ)*L/2⌋₊, by omega⟩
· have : (2 : ℝ) ≤ D := by linarith
exact_mod_cast this
· linarith
· linarith
theorem hybrid_polynomial_inside_bias
Assume the Cai–Low Chebyshev approximation theorem, the causal-model conditions for the data law, a positive privacy budget, dimension at least two, positive block size, the stated l condition, the stated d condition, the stated dm condition, and the stated hx condition. Inside the pilot window, the approximation error has the explicit C5 rate.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
hCheb :
P :
hP :
eps :
ℝ
heps :
0 < eps
hd :
2 ≤ d
hm :
0 < m
D :
ℕ
hL :
4096 ≤ logDim d
hD :
D = 2*⌊(1/1024 : ℝ)*logDim d/2⌋₊
hDm :
D ≤ m
j :
Fin d
hx :
conclusion
abs (blockMean (m := m) P eps (polynomialEstimate eps (8 * sqrt (sigmaSquared d m eps) * sqrt (logDim d)) D j) - abs (contrast P j))
Proof (Lean source)
-- @node: hybrid_polynomial_inside_bias
lemma hybrid_polynomial_inside_bias (hCheb : CaiLowChebyshevApproximation)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d) (hm : 0 < m)
(D : ℕ) (hL : 4096 ≤ logDim d)
(hD : D = 2*⌊(1/1024 : ℝ)*logDim d/2⌋₊) (hDm : D ≤ m) (j : Fin d)
(hx : |contrast P j| ≤ 8 * sqrt (sigmaSquared d m eps) * sqrt (logDim d)) :
abs (blockMean (m := m) P eps
(polynomialEstimate eps (8 * sqrt (sigmaSquared d m eps) * sqrt (logDim d)) D j) -
abs (contrast P j)) ≤ 16384 * sqrt (sigmaSquared d m eps) / sqrt (logDim d) := by
obtain ⟨hEven, hDtwo, hDlower, _⟩ := hybridDegree_bounds (logDim d) hL D hD
have hLpos : 0 < logDim d := by linarith
have hsqrt : 0 < sqrt (logDim d) := Real.sqrt_pos.mpr hLpos
have ha : 0 < 8 * sqrt (sigmaSquared d m eps) * sqrt (logDim d) := by
have ht := hybridThreshold_pos (m := m) eps heps hd hm
linarith
apply (radius_polynomial_bias_of_gate hCheb P hP eps _ heps ha hd D hEven hDtwo hDm j hx).trans
rw [div_le_div_iff₀ (by positivity : (0 : ℝ) < D+1) hsqrt]
have hsq := Real.sq_sqrt hLpos.le
have hsigma : 0 ≤ sqrt (sigmaSquared d m eps) := Real.sqrt_nonneg _
nlinarith [mul_nonneg hsigma (show 0 ≤ 16384 * (D+1 : ℝ) - 8 * logDim d by linarith)]
theorem hybrid_polynomial_inside_second_bound
Assume the Cai–Low Chebyshev approximation theorem, the causal-model conditions for the data law, a positive privacy budget, dimension at least two, positive block size, the stated l condition, the stated d condition, the stated hm d condition, and the stated hx condition. Within the approximation window, C1 gives the calibrated second moment (C8).
Formal statement
hypotheses
m :
ℕ
d :
ℕ
hCheb :
P :
hP :
eps :
ℝ
heps :
0 < eps
hd :
2 ≤ d
hm :
0 < m
D :
ℕ
hL :
4096 ≤ logDim d
hD :
D = 2*⌊(1/1024 : ℝ)*logDim d/2⌋₊
hmD :
2*D ≤ m
j :
Fin d
hx :
Proof (Lean source)
-- @node: hybrid_polynomial_inside_second_bound
lemma hybrid_polynomial_inside_second_bound (hCheb : CaiLowChebyshevApproximation)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d) (hm : 0 < m)
(D : ℕ) (hL : 4096 ≤ logDim d)
(hD : D = 2*⌊(1/1024 : ℝ)*logDim d/2⌋₊) (hmD : 2*D ≤ m) (j : Fin d)
(hx : |contrast P j| ≤ 8 * sqrt (sigmaSquared d m eps) * sqrt (logDim d)) :
let a := 8 * sqrt (sigmaSquared d m eps) * sqrt (logDim d)
blockMean (m := m) P eps (fun z => (polynomialEstimate eps a D j z)^2) ≤
a^2 * exp (logDim d/100) := by
dsimp only
let a := 8 * sqrt (sigmaSquared d m eps) * sqrt (logDim d)
obtain ⟨hEven, hDtwo, _, hDupper⟩ := hybridDegree_bounds (logDim d) hL D hD
have hLpos : 0 < logDim d := by linarith
have hsigma : 0 ≤ sigmaSquared d m eps := by unfold sigmaSquared; positivity
have ha : 0 < a := by
have ht := hybridThreshold_pos (m := m) eps heps hd hm
dsimp [a]; linarith
have ha2 : a^2 = 64 * sigmaSquared d m eps * logDim d := by
dsimp [a]
nlinarith [Real.sq_sqrt hsigma, Real.sq_sqrt hLpos.le]
have hx2 : (contrast P j)^2 ≤ a^2 := by
have hh := sq_le_sq₀ (abs_nonneg (contrast P j)) ha.le |>.mpr hx
simpa using hh
have hbase : max 1 (((contrast P j)^2 + 2*D*sigmaSquared d m eps) / a^2) ≤ 2 := by
apply max_le (by norm_num)
rw [div_le_iff₀ (sq_pos_of_pos ha)]
have hh := mul_nonneg hsigma (show 0 ≤ 64 * logDim d - 2 * (D : ℝ) by linarith)
nlinarith [ha2]
have htwo : (2 : ℝ) ≤ exp 1 := by linarith [Real.add_one_le_exp (1 : ℝ)]
have hpow : (max 1 (((contrast P j)^2 + 2*D*sigmaSquared d m eps) / a^2))^D ≤ exp D := by
have hh := pow_le_pow_left₀ (le_trans zero_le_one (le_max_left _ _)) (hbase.trans htwo) D
rw [← Real.exp_nat_mul] at hh
simpa using hh
calc
_ ≤ a^2 * exp (5*D) *
(max 1 (((contrast P j)^2 + 2*D*sigmaSquared d m eps) / a^2))^D :=
radius_polynomial_second_bound hCheb P hP eps a heps ha hd hm D hEven hDtwo hmD j
_ ≤ a^2 * exp (5*D) * exp D :=
mul_le_mul_of_nonneg_left hpow (by positivity)
_ = a^2 * exp (6*D) := by
rw [mul_assoc, ← Real.exp_add]
congr 2
ring
_ ≤ a^2 * exp (logDim d/100) := by
apply mul_le_mul_of_nonneg_left _ (sq_nonneg a)
apply Real.exp_le_exp.mpr
linarith
theorem hybrid_inside_nonneg_bias
Assume the bounded-mean concentration inequality, the Cai–Low Chebyshev approximation theorem, the causal-model conditions for the data law, a positive privacy budget, dimension at least two, positive block size, the stated l condition, the stated d condition, the stated dm condition, the stated hx condition, and the stated hwindow condition. C3, C4 and C5 assemble the hybrid bias bound for nonnegative inside-window contrasts.
Formal statement
Proof (Lean source)
-- @node: hybrid_inside_nonneg_bias
lemma hybrid_inside_nonneg_bias (hMean : BoundedMeanConcentration)
(hCheb : CaiLowChebyshevApproximation)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d) (hm : 0 < m)
(D : ℕ) (hL : 4096 ≤ logDim d)
(hD : D = 2*⌊(1/1024 : ℝ)*logDim d/2⌋₊) (hDm : D ≤ m) (j : Fin d)
(hx : 0 ≤ contrast P j)
(hwindow : |contrast P j| ≤ 8 * sqrt (sigmaSquared d m eps) * sqrt (logDim d)) :
abs (hybridMean (m := m) P eps (hybridColumn eps D j) - abs (contrast P j)) ≤
20000 * sqrt (sigmaSquared d m eps) / sqrt (logDim d) := by
classical
let T := 4 * sqrt (sigmaSquared d m eps) * sqrt (logDim d)
let h := blockMean (m := m) P eps
(fun z => if |scaledColumnMean eps j z| ≤ T then (1 : ℝ) else 0)
let w := blockMean (m := m) P eps
(fun z => if scaledColumnMean eps j z < -T then (1 : ℝ) else 0)
have hwr : w = (vectorBlockLaw P eps m).real {z | scaledColumnMean eps j z < -T} := by
simpa only [w, blockMean, Set.indicator_apply, Set.mem_setOf_eq] using
(pilot_indicator_probability (m := m) P eps {z | scaledColumnMean eps j z < -T})
have hw := (hybridPilot_wrong_sign_weighted hMean P hP eps heps hd hm j hx).1
change contrast P j * (vectorBlockLaw P eps m).real
{z | scaledColumnMean eps j z < -T} ≤ _ at hw
rw [← hwr] at hw
have hw' : contrast P j * w ≤ sqrt (sigmaSquared d m eps) / sqrt (logDim d) := by
apply hw.trans
simpa [div_eq_mul_inv] using mul_le_mul_of_nonneg_left
(pilot_exp_tail_le_inv_sqrt (logDim d) (by linarith))
(Real.sqrt_nonneg (sigmaSquared d m eps))
have hrange := hybridPilot_central_probability_range (m := m) P eps T j
have hwp : 0 ≤ w := integral_nonneg (fun z => by split <;> norm_num)
have hpoly := hybrid_polynomial_inside_bias hCheb P hP eps heps hd hm D hL hD hDm j hwindow
have ha : 8 * sqrt (sigmaSquared d m eps) * sqrt (logDim d) = 2*T := by
dsimp [T]; ring
rw [ha, blockMean_polynomialEstimate P hP eps _ heps
(by have := hybridThreshold_pos (m := m) eps heps hd hm; dsimp [T]; positivity)
hd D hDm j, abs_of_nonneg hx] at hpoly
rw [abs_of_nonneg hx, hybridColumn_mean_error_identity P hP eps heps hd hm D hDm j]
change abs (h * ((2*T) * (chebyshevAbsPoly D).eval (contrast P j / (2*T)) -
contrast P j) - 2 * contrast P j * w) ≤ _
have herr := abs_sub (h * ((2*T) * (chebyshevAbsPoly D).eval (contrast P j / (2*T)) -
contrast P j)) (2 * contrast P j * w)
rw [abs_mul, abs_of_nonneg hrange.1,
abs_of_nonneg (by positivity : 0 ≤ 2 * contrast P j * w)] at herr
have hp := mul_le_mul_of_nonneg_left hpoly hrange.1
have hunit := mul_le_mul_of_nonneg_right hrange.2
(show 0 ≤ 16384 * sqrt (sigmaSquared d m eps) / sqrt (logDim d) by positivity)
dsimp only [h] at hp hunit herr ⊢
have hnonneg : 0 ≤ sqrt (sigmaSquared d m eps) / sqrt (logDim d) := by positivity
simp only [div_eq_mul_inv] at hw' hp hunit herr hnonneg ⊢
nlinarith
theorem hybrid_inside_nonneg_variance
Assume the bounded-mean concentration inequality, the Cai–Low Chebyshev approximation theorem, the causal-model conditions for the data law, a positive privacy budget, dimension at least two, positive block size, the stated l condition, the stated d condition, the stated hm d condition, the stated hx condition, and the stated hwindow condition. C4, C7 and C8 assemble the hybrid variance bound for nonnegative inside contrasts.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
hMean :
hCheb :
P :
hP :
eps :
ℝ
heps :
0 < eps
hd :
2 ≤ d
hm :
0 < m
D :
ℕ
hL :
4096 ≤ logDim d
hD :
D = 2*⌊(1/1024 : ℝ)*logDim d/2⌋₊
hmD :
2*D ≤ m
j :
Fin d
hx :
0 ≤ contrast P j
hwindow :
conclusion
hybridVar (m := m) P eps (hybridColumn eps D j)
Proof (Lean source)
-- @node: hybrid_inside_nonneg_variance
lemma hybrid_inside_nonneg_variance (hMean : BoundedMeanConcentration)
(hCheb : CaiLowChebyshevApproximation)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d) (hm : 0 < m)
(D : ℕ) (hL : 4096 ≤ logDim d)
(hD : D = 2*⌊(1/1024 : ℝ)*logDim d/2⌋₊) (hmD : 2*D ≤ m) (j : Fin d)
(hx : 0 ≤ contrast P j)
(hwindow : |contrast P j| ≤ 8 * sqrt (sigmaSquared d m eps) * sqrt (logDim d)) :
hybridVar (m := m) P eps (hybridColumn eps D j) ≤
400 * sigmaSquared d m eps * logDim d * exp (logDim d/100) := by
classical
let T := 4 * sqrt (sigmaSquared d m eps) * sqrt (logDim d)
let h := blockMean (m := m) P eps
(fun z => if |scaledColumnMean eps j z| ≤ T then (1 : ℝ) else 0)
let w := blockMean (m := m) P eps
(fun z => if scaledColumnMean eps j z < -T then (1 : ℝ) else 0)
have hs : 0 ≤ sigmaSquared d m eps := by unfold sigmaSquared; positivity
have hT2 : (2*T)^2 = 64 * sigmaSquared d m eps * logDim d := by
dsimp [T]
nlinarith [Real.sq_sqrt hs, Real.sq_sqrt (show 0 ≤ logDim d by linarith)]
have hwr : w = (vectorBlockLaw P eps m).real {z | scaledColumnMean eps j z < -T} := by
simpa only [w, blockMean, Set.indicator_apply, Set.mem_setOf_eq] using
(pilot_indicator_probability (m := m) P eps {z | scaledColumnMean eps j z < -T})
have hw := (hybridPilot_wrong_sign_weighted hMean P hP eps heps hd hm j hx).2
change (contrast P j)^2 * (vectorBlockLaw P eps m).real
{z | scaledColumnMean eps j z < -T} ≤ _ at hw
rw [← hwr] at hw
have he : exp (-8 * logDim d) ≤ 1 := by
rw [Real.exp_le_one_iff]; linarith
have hw' : (contrast P j)^2 * w ≤ sigmaSquared d m eps :=
hw.trans (by simpa using mul_le_mul_of_nonneg_left he hs)
have hrange := hybridPilot_central_probability_range (m := m) P eps T j
have ha : 8 * sqrt (sigmaSquared d m eps) * sqrt (logDim d) = 2*T := by
dsimp [T]; ring
have hp := hybrid_polynomial_inside_second_bound hCheb P hP eps heps hd hm
D hL hD hmD j hwindow
dsimp only at hp
rw [ha, hT2] at hp
have hC7 := hybridColumn_centered_error_le P hP eps heps hd hm D j
change hybridVar P eps (hybridColumn eps D j) ≤
2*h * blockMean P eps (fun z => (polynomialEstimate eps (2*T) D j z)^2) +
2*h*(contrast P j)^2 + sigmaSquared d m eps + 4*(contrast P j)^2*w at hC7
have hpoly := (mul_le_mul_of_nonneg_left hp hrange.1).trans
(by
simpa using mul_le_mul_of_nonneg_right hrange.2
(show 0 ≤ 64 * sigmaSquared d m eps * logDim d * exp (logDim d/100) by positivity))
have hx2 : (contrast P j)^2 ≤ 64 * sigmaSquared d m eps * logDim d := by
have hh := sq_le_sq₀ (abs_nonneg (contrast P j))
(show 0 ≤ 8 * sqrt (sigmaSquared d m eps) * sqrt (logDim d) by positivity) |>.mpr hwindow
rw [ha, hT2] at hh
simpa using hh
have hx2' := (mul_le_mul_of_nonneg_left hx2 hrange.1).trans
(by
simpa using mul_le_mul_of_nonneg_right hrange.2 (by positivity :
0 ≤ 64 * sigmaSquared d m eps * logDim d))
have he' : 1 ≤ exp (logDim d/100) := Real.one_le_exp_iff.mpr (by linarith)
have hscale : sigmaSquared d m eps * logDim d ≤
sigmaSquared d m eps * logDim d * exp (logDim d/100) := by
simpa using mul_le_mul_of_nonneg_left he' (by positivity : 0 ≤ sigmaSquared d m eps * logDim d)
have hsL : sigmaSquared d m eps ≤ sigmaSquared d m eps * logDim d := by
nlinarith [mul_nonneg hs (show 0 ≤ logDim d - 1 by linarith)]
change h * _ ≤ _ at hpoly
change h * _ ≤ _ at hx2'
nlinarith
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Calibration.HybridBasics 11 declarations Independent pilot/evaluation blocks, column means and their finite variance bounds.
Hybrid block basics
Independent pilot/evaluation blocks, column means and their finite variance bounds.
def scaledColumnMean
Fix the privacy budget, the coordinate index, and the function z. Mean of one scaled column.
Definition (Lean source)
def hybridLaw
Fix the probability law P, the privacy budget, and the block size. Independent pilot/evaluation blocks.
Definition (Lean source)
parameters
given by
def hybridColumn
Fix the privacy budget, the natural-number parameter D, the coordinate index, and the function z. Centered pilot/evaluation hybrid column statistic.
Definition (Lean source)
parameters
def
hybridColumn eps D j z :
ℝ
given by
sigma :
sqrt (sigmaSquared d m eps)
pilot :
scaledColumnMean eps j z.1
if |pilot|
≤ threshold then polynomialEstimate eps (2*threshold) D j z.2 else (if 0 < pilot then 1 else if pilot < 0 then -1 else 0) * scaledColumnMean eps j z.2
def hybridMean
Fix the probability law P, the privacy budget, and the function f. Hybrid expectation.
def hybridVar
Fix the probability law P, the privacy budget, and the function f. Hybrid variance.
Definition (Lean source)
parameters
def
hybridVar P eps f :
ℝ
given by
∫ z, (f z - hybridMean (m := m) P eps f)^2 ∂(hybridLaw P eps m)
The threshold includes zero, so the sign-zero convention is never used outside it.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
eps :
ℝ
conclusion
Proof (Lean source)
-- @node: hybridThreshold_nonneg
lemma hybridThreshold_nonneg (eps : ℝ) :
0 ≤ 4 * sqrt (sigmaSquared d m eps) * sqrt (logDim d) := by
positivity
Assume a positive privacy budget, dimension at least two, and positive block size. Allowed positive resources give a strictly positive pilot threshold.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
eps :
ℝ
heps :
0 < eps
hd :
2 ≤ d
hm :
0 < m
conclusion
Proof (Lean source)
-- @node: hybridThreshold_pos
lemma hybridThreshold_pos (eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d) (hm : 0 < m) :
0 < 4 * sqrt (sigmaSquared d m eps) * sqrt (logDim d) := by
have hdR : (2 : ℝ) ≤ d := by exact_mod_cast hd
have hmR : (0 : ℝ) < m := by exact_mod_cast hm
have hdelta : 0 < privacyDelta eps := by
rw [privacyDelta_exp_formula]
exact div_pos (sub_pos.mpr (Real.one_lt_exp_iff.mpr heps)) (by positivity)
have hb : 0 < noiseScale d eps := div_pos (by linarith) hdelta
have hs : 0 < sigmaSquared d m eps := div_pos (sq_pos_of_pos hb) hmR
have hL : 0 < logDim d := by
apply Real.log_pos
have he : 1 < exp (1 : ℝ) := Real.one_lt_exp_iff.mpr zero_lt_one
nlinarith
positivity
The independent two-block experiment is a probability measure.
Formal statement
hypotheses
conclusion
IsProbabilityMeasure (hybridLaw P eps m)
Proof (Lean source)
-- @node: hybridLaw_probability
lemma hybridLaw_probability (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(eps : ℝ) : IsProbabilityMeasure (hybridLaw P eps m) := by
letI := vectorBlockLaw_probability P eps m
unfold hybridLaw
infer_instance
theorem blockMean_scaledColumnMean
Assume the causal-model conditions for the data law, a positive privacy budget, dimension at least two, and positive block size. The evaluation column mean is unbiased for the causal contrast.
Formal statement
hypotheses
conclusion
blockMean (m := m) P eps (scaledColumnMean eps j) = contrast P j
Proof (Lean source)
-- @node: blockMean_scaledColumnMean
lemma blockMean_scaledColumnMean (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(hP : CausalModel P) (eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d)
(hm : 0 < m) (j : Fin d) :
blockMean (m := m) P eps (scaledColumnMean eps j) = contrast P j := by
have h := blockMean_privateMoment_eq_rowMean_pow (m := m) P eps 1 (by omega) j
simp only [privateMoment_one, pow_one] at h
exact h.trans (vectorMessageLaw_scaled_sign_integral P hP eps heps hd j)
Finite block variance is the second moment minus the squared mean.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
P :
eps :
ℝ
Proof (Lean source)
-- @node: blockVar_eq_secondMoment_sub_sq
lemma blockVar_eq_secondMoment_sub_sq (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(eps : ℝ) (f : (Fin m → Fin d → Bool) → ℝ) :
blockVar (m := m) P eps f = blockMean (m := m) P eps (fun z => (f z)^2) - (blockMean (m := m) P eps f)^2 := by
letI := vectorBlockLaw_probability P eps m
unfold blockVar
have hexp : (fun z => (f z - blockMean (m := m) P eps f)^2) =
(fun z => (f z)^2 - 2 * blockMean (m := m) P eps f * f z + (blockMean (m := m) P eps f)^2) := by
funext z
ring
rw [hexp, integral_add (Integrable.of_finite) (Integrable.of_finite),
integral_sub (Integrable.of_finite) (Integrable.of_finite), integral_const_mul,
integral_const]
simp only [probReal_univ, one_smul]
change blockMean (m := m) P eps (fun z => (f z)^2) -
2 * blockMean (m := m) P eps f * blockMean (m := m) P eps f + (blockMean (m := m) P eps f)^2 = _
ring
theorem blockVar_scaledColumnMean_le
Assume the causal-model conditions for the data law, a positive privacy budget, dimension at least two, and positive block size. The iid column mean has variance bounded by the declared noise variance.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: blockVar_scaledColumnMean_le
lemma blockVar_scaledColumnMean_le (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(hP : CausalModel P) (eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d)
(hm : 0 < m) (j : Fin d) :
blockVar (m := m) P eps (scaledColumnMean eps j) ≤ sigmaSquared d m eps := by
rw [blockVar_eq_secondMoment_sub_sq, blockMean_scaledColumnMean P hP eps heps hd hm]
have h := blockMean_privateMoment_one_sq P hP eps heps hd hm j
simp only [privateMoment_one] at h
change blockMean (m := m) P eps (fun z => (scaledColumnMean eps j z)^2) = _ at h
rw [h]
unfold sigmaSquared
rw [sub_div]
have hnonneg : 0 ≤ (contrast P j)^2 / (m : ℝ) := by positivity
linarith
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Calibration.Outside 15 declarations Polynomial growth and Gaussian pilot suppression for steps C6 and C9 of finite calibration.
Outside-window hybrid calibration
Polynomial growth and Gaussian pilot suppression for steps C6 and C9 of finite calibration. Bias and variance assembly for all causal contrasts, inside and outside the window, using reflection for negative contrasts. Combined-column MSE and the final finite-calibration theorem are assembled in Calibration.Assembly.
Assume the stated hy condition. The logarithmic growth of an outside-window parameter is at most half its square.
Formal statement
Proof (Lean source)
-- @node: hybrid_outside_log_bound
lemma hybrid_outside_log_bound (y : ℝ) (hy : 1 ≤ y) :
log y ≤ y^2/2 := by
have h := Real.log_le_sub_one_of_pos (show 0 < y by linarith)
nlinarith [sq_nonneg (y-1)]
Assume the Cai–Low Chebyshev approximation theorem, the stated even condition, polynomial degree at least two, and the stated hy condition. The finite coefficient envelope bounds the polynomial beyond its approximation window.
Formal statement
hypotheses
conclusion
|(chebyshevAbsPoly D).eval y| ≤ exp (3*D) * y^D
Proof (Lean source)
-- @node: hybrid_outside_polynomial_growth
lemma hybrid_outside_polynomial_growth (hCheb : CaiLowChebyshevApproximation)
(D : ℕ) (hEven : Even D) (hD : 2 ≤ D) (y : ℝ) (hy : 1 ≤ y) :
|(chebyshevAbsPoly D).eval y| ≤ exp (3*D) * y^D := by
classical
have hy0 : 0 ≤ y := by linarith
have hc (v : ℕ) (hv : v ∈ range (D+1)) :
|(chebyshevAbsPoly D).coeff v * y^v| ≤ exp (3*(D : ℝ)/2) * y^D := by
have hvD : v ≤ D := by have := Finset.mem_range.mp hv; omega
have hcoeff := (hCheb D hEven hD).2 v hvD
rw [Real.rpow_def_of_pos (by norm_num)] at hcoeff
have hlog : log 2 ≤ 1 := by
have := Real.log_le_sub_one_of_pos (by norm_num : (0 : ℝ) < 2)
norm_num at this
exact this
have hcoeff' : |(chebyshevAbsPoly D).coeff v| ≤ exp (3*(D : ℝ)/2) :=
hcoeff.trans (Real.exp_le_exp.mpr (by nlinarith [Nat.cast_nonneg (α := ℝ) D]))
rw [abs_mul, abs_of_nonneg (pow_nonneg hy0 v)]
exact mul_le_mul hcoeff' (pow_le_pow_right₀ hy hvD)
(pow_nonneg hy0 v) (Real.exp_pos _).le
rw [Polynomial.eval_eq_sum_range' (n := D+1) (by
have := chebyshevAbsPoly_natDegree_le D; omega)]
calc
_ ≤ ∑ v ∈ range (D+1), |(chebyshevAbsPoly D).coeff v * y^v| :=
Finset.abs_sum_le_sum_abs _ _
_ ≤ ∑ _v ∈ range (D+1), exp (3*(D : ℝ)/2) * y^D :=
Finset.sum_le_sum hc
_ = (D+1 : ℝ) * (exp (3*(D : ℝ)/2) * y^D) := by simp
_ ≤ exp D * (exp (3*(D : ℝ)/2) * y^D) :=
mul_le_mul_of_nonneg_right (by linarith [Real.add_one_le_exp (D : ℝ)]) (by positivity)
_ = exp ((D : ℝ)+3*D/2) * y^D := by rw [← mul_assoc, ← Real.exp_add]
_ ≤ _ := mul_le_mul_of_nonneg_right (Real.exp_le_exp.mpr (by nlinarith [Nat.cast_nonneg (α := ℝ) D]))
(pow_nonneg hy0 D)
Assume the stated l condition, the stated hy condition, and the stated d condition. At the calibrated degree, the outside pilot tail dominates polynomial growth (C6).
Formal statement
Proof (Lean source)
-- @node: hybrid_outside_growth_suppression
lemma hybrid_outside_growth_suppression (L y : ℝ) (hL : 1 ≤ L) (hy : 1 ≤ y)
(D : ℕ) (hD : (D : ℝ) ≤ L/1024) :
exp (-8*L*y^2) * (exp (3*D) * y^D) ≤ exp (-7*L*y^2) := by
have hypos : 0 < y := by linarith
have hlog := hybrid_outside_log_bound y hy
have hy2 : 1 ≤ y^2 := by nlinarith
have hpow : y^D = exp ((D : ℝ) * log y) := by
rw [Real.exp_nat_mul, Real.exp_log hypos]
rw [hpow, ← Real.exp_add, ← Real.exp_add]
apply Real.exp_le_exp.mpr
have hfirst : 3*(D : ℝ) ≤ 3*L/1024*y^2 := by
nlinarith [mul_nonneg (show 0 ≤ L by linarith) (show 0 ≤ y^2-1 by linarith)]
have hsecond := mul_le_mul_of_nonneg_left hlog (Nat.cast_nonneg (α := ℝ) D)
have hthird := mul_le_mul_of_nonneg_right hD (show 0 ≤ y^2/2 by positivity)
have hLy : 0 ≤ L*y^2 := by positivity
nlinarith
theorem hybridPilot_central_normalized_tail
Assume the bounded-mean concentration inequality, the causal-model conditions for the data law, a positive privacy budget, dimension at least two, positive block size, the stated l condition, and the stated hx condition. The actual outside-window pilot tail has the normalized exponent used in C6.
Formal statement
Proof (Lean source)
-- @node: hybridPilot_central_normalized_tail
lemma hybridPilot_central_normalized_tail (hMean : BoundedMeanConcentration)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d) (hm : 0 < m) (j : Fin d)
(hL : 1 ≤ logDim d)
(hx : 8 * sqrt (sigmaSquared d m eps) * sqrt (logDim d) ≤ contrast P j) :
let a := 8 * sqrt (sigmaSquared d m eps) * sqrt (logDim d)
let T := a/2
(vectorBlockLaw P eps m).real {z | |scaledColumnMean eps j z| ≤ T} ≤
exp (-8 * logDim d * (contrast P j / a)^2) := by
dsimp only
have hb := pilot_noiseScale_pos eps heps hd
have hmR : (0 : ℝ) < m := by exact_mod_cast hm
have hs : 0 < sigmaSquared d m eps := div_pos (sq_pos_of_pos hb) hmR
let a := 8 * sqrt (sigmaSquared d m eps) * sqrt (logDim d)
have ha : 0 < a := by dsimp [a]; positivity
have ha2 : a^2 = 64 * sigmaSquared d m eps * logDim d := by
dsimp [a]
nlinarith [Real.sq_sqrt hs.le, Real.sq_sqrt (show 0 ≤ logDim d by linarith)]
have ht : a/2 = 4 * sqrt (sigmaSquared d m eps) * sqrt (logDim d) := by
dsimp [a]; ring
change (vectorBlockLaw P eps m).real {z | |scaledColumnMean eps j z| ≤ a/2} ≤ _
rw [ht]
apply (hybridPilot_central_tail hMean P hP eps heps hd hm j hx).trans_eq
congr 1
rw [div_pow, ha2]
field_simp
<;> ring
theorem hybrid_outside_weighted_polynomial
Assume the bounded-mean concentration inequality, the Cai–Low Chebyshev approximation theorem, the causal-model conditions for the data law, a positive privacy budget, dimension at least two, positive block size, the stated l condition, the stated d condition, the stated dm condition, and the stated hx condition. Pilot suppression times unbiased polynomial growth gives the first outside C6 bound.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
hMean :
hCheb :
P :
hP :
eps :
ℝ
heps :
0 < eps
hd :
2 ≤ d
hm :
0 < m
D :
ℕ
hL :
4096 ≤ logDim d
hD :
D = 2*⌊(1/1024 : ℝ)*logDim d/2⌋₊
hDm :
D ≤ m
j :
Fin d
hx :
conclusion
a :
(vectorBlockLaw P eps m).real {z | |scaledColumnMean eps j z| ≤ a/2} * |blockMean (m := m) P eps (polynomialEstimate eps a D j)|
Proof (Lean source)
-- @node: hybrid_outside_weighted_polynomial
lemma hybrid_outside_weighted_polynomial (hMean : BoundedMeanConcentration)
(hCheb : CaiLowChebyshevApproximation)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d) (hm : 0 < m)
(D : ℕ) (hL : 4096 ≤ logDim d)
(hD : D = 2*⌊(1/1024 : ℝ)*logDim d/2⌋₊) (hDm : D ≤ m) (j : Fin d)
(hx : 8 * sqrt (sigmaSquared d m eps) * sqrt (logDim d) ≤ contrast P j) :
let a := 8 * sqrt (sigmaSquared d m eps) * sqrt (logDim d)
(vectorBlockLaw P eps m).real {z | |scaledColumnMean eps j z| ≤ a/2} *
|blockMean (m := m) P eps (polynomialEstimate eps a D j)| ≤
a * exp (-7 * logDim d * (contrast P j / a)^2) := by
dsimp only
let a := 8 * sqrt (sigmaSquared d m eps) * sqrt (logDim d)
have hb := pilot_noiseScale_pos eps heps hd
have hs : 0 < sigmaSquared d m eps := div_pos (sq_pos_of_pos hb) (by exact_mod_cast hm)
have ha : 0 < a := by dsimp [a]; positivity
have hy : 1 ≤ contrast P j / a := by
rw [le_div_iff₀ ha]; simpa [a] using hx
have hEven : Even D := ⟨⌊(1/1024 : ℝ)*logDim d/2⌋₊, by omega⟩
have hfloor := Nat.lt_floor_add_one ((1/1024 : ℝ)*logDim d/2)
have hcast : (D : ℝ) = 2 * (⌊(1/1024 : ℝ)*logDim d/2⌋₊ : ℝ) := by exact_mod_cast hD
have hDtwo : 2 ≤ D := by
have : (2 : ℝ) ≤ D := by linarith
exact_mod_cast this
have hDupper : (D : ℝ) ≤ logDim d/1024 := by
have hf := Nat.floor_le (show 0 ≤ (1/1024 : ℝ)*logDim d/2 by linarith)
linarith
have htail := hybridPilot_central_normalized_tail hMean P hP eps heps hd hm j (by linarith) hx
have hgrowth := hybrid_outside_polynomial_growth hCheb D hEven hDtwo _ hy
have hsuppress := hybrid_outside_growth_suppression (logDim d) (contrast P j/a)
(by linarith) hy D hDupper
rw [blockMean_polynomialEstimate P hP eps a heps ha.ne' hd D hDm j,
abs_mul, abs_of_pos ha]
calc
_ ≤ exp (-8 * logDim d * (contrast P j/a)^2) *
(a * (exp (3*D) * (contrast P j/a)^D)) :=
mul_le_mul htail (mul_le_mul_of_nonneg_left hgrowth ha.le)
(by positivity) (Real.exp_pos _).le
_ = a * (exp (-8 * logDim d * (contrast P j/a)^2) *
(exp (3*D) * (contrast P j/a)^D)) := by ring
_ ≤ _ := mul_le_mul_of_nonneg_left hsuppress ha.le
theorem hybrid_outside_weighted_contrast
Assume the bounded-mean concentration inequality, the causal-model conditions for the data law, a positive privacy budget, dimension at least two, positive block size, the stated l condition, and the stated hx condition. The outside pilot tail also suppresses the first and second contrast powers in C6.
Formal statement
Proof (Lean source)
-- @node: hybrid_outside_weighted_contrast
lemma hybrid_outside_weighted_contrast (hMean : BoundedMeanConcentration)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d) (hm : 0 < m) (j : Fin d)
(hL : 4096 ≤ logDim d)
(hx : 8 * sqrt (sigmaSquared d m eps) * sqrt (logDim d) ≤ contrast P j) :
let a := 8 * sqrt (sigmaSquared d m eps) * sqrt (logDim d)
let h := (vectorBlockLaw P eps m).real {z | |scaledColumnMean eps j z| ≤ a/2}
h * contrast P j ≤ a * exp (-7 * logDim d * (contrast P j/a)^2) ∧
h * (contrast P j)^2 ≤ a^2 * exp (-7 * logDim d * (contrast P j/a)^2) := by
dsimp only
let a := 8 * sqrt (sigmaSquared d m eps) * sqrt (logDim d)
let y := contrast P j/a
let h := (vectorBlockLaw P eps m).real {z | |scaledColumnMean eps j z| ≤ a/2}
have hb := pilot_noiseScale_pos eps heps hd
have hs : 0 < sigmaSquared d m eps := div_pos (sq_pos_of_pos hb) (by exact_mod_cast hm)
have ha : 0 < a := by dsimp [a]; positivity
have hy : 1 ≤ y := by dsimp [y]; rw [le_div_iff₀ ha]; simpa [a] using hx
have htail : h ≤ exp (-8*logDim d*y^2) :=
hybridPilot_central_normalized_tail hMean P hP eps heps hd hm j (by linarith) hx
have hweight (k : ℕ) (hk : k ≤ 2) : h * y^k ≤ exp (-7*logDim d*y^2) := by
have hkR : (k : ℝ) ≤ 2 := by exact_mod_cast hk
have he : 1 ≤ exp (3*k) := Real.one_le_exp_iff.mpr (by positivity)
have hy0 : 0 ≤ y^k := pow_nonneg (by linarith) k
calc
_ ≤ exp (-8*logDim d*y^2) * y^k := mul_le_mul_of_nonneg_right htail hy0
_ ≤ exp (-8*logDim d*y^2) * (exp (3*k) * y^k) :=
mul_le_mul_of_nonneg_left (by nlinarith [mul_le_mul_of_nonneg_right he hy0])
(Real.exp_pos _).le
_ ≤ _ := hybrid_outside_growth_suppression _ _ (by linarith) hy k (by linarith)
have hxy : contrast P j = a*y := by dsimp [y]; field_simp
change h * contrast P j ≤ a * exp (-7*logDim d*y^2) ∧
h * (contrast P j)^2 ≤ a^2 * exp (-7*logDim d*y^2)
constructor
· have hh := mul_le_mul_of_nonneg_left (hweight 1 (by omega)) ha.le
simpa only [pow_one, hxy, mul_left_comm] using hh
· have hh := mul_le_mul_of_nonneg_left (hweight 2 (by omega)) (sq_nonneg a)
rw [hxy, mul_pow]
nlinarith [hh]
Assume the stated l condition. The exponentially small C6 residual is at most the reciprocal log dimension.
Formal statement
Proof (Lean source)
-- @node: hybrid_outside_exp_residual
lemma hybrid_outside_exp_residual (L : ℝ) (hL : 1 ≤ L) :
exp (-7*L) ≤ 1/L := by
have hbound : L ≤ exp (7*L) := by linarith [Real.add_one_le_exp (7*L)]
apply (le_div_iff₀ (by linarith : 0 < L)).mpr
have hh := mul_le_mul_of_nonneg_right hbound (Real.exp_pos (-7*L)).le
rw [← Real.exp_add] at hh
have he : 7*L + -7*L = 0 := by ring
simpa [he, mul_comm] using hh
theorem hybrid_outside_nonneg_bias
Assume the bounded-mean concentration inequality, the Cai–Low Chebyshev approximation theorem, the causal-model conditions for the data law, a positive privacy budget, dimension at least two, positive block size, the stated l condition, the stated d condition, the stated dm condition, and the stated hx condition. C3, C4 and C6 give the hybrid bias bound outside the window for nonnegative contrasts.
Formal statement
Proof (Lean source)
-- @node: hybrid_outside_nonneg_bias
lemma hybrid_outside_nonneg_bias (hMean : BoundedMeanConcentration)
(hCheb : CaiLowChebyshevApproximation)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d) (hm : 0 < m)
(D : ℕ) (hL : 4096 ≤ logDim d)
(hD : D = 2*⌊(1/1024 : ℝ)*logDim d/2⌋₊) (hDm : D ≤ m) (j : Fin d)
(hx : 8 * sqrt (sigmaSquared d m eps) * sqrt (logDim d) ≤ contrast P j) :
abs (hybridMean (m := m) P eps (hybridColumn eps D j) - abs (contrast P j)) ≤
20000 * sqrt (sigmaSquared d m eps) / sqrt (logDim d) := by
let a := 8 * sqrt (sigmaSquared d m eps) * sqrt (logDim d)
let T := a/2
let h := blockMean (m := m) P eps
(fun z => if |scaledColumnMean eps j z| ≤ T then (1 : ℝ) else 0)
let w := blockMean (m := m) P eps
(fun z => if scaledColumnMean eps j z < -T then (1 : ℝ) else 0)
have ht : T = 4 * sqrt (sigmaSquared d m eps) * sqrt (logDim d) := by
dsimp [T, a]; ring
have hprob : h = (vectorBlockLaw P eps m).real {z | |scaledColumnMean eps j z| ≤ T} := by
simpa only [h, blockMean, Set.indicator_apply, Set.mem_setOf_eq] using
(pilot_indicator_probability (m := m) P eps {z | |scaledColumnMean eps j z| ≤ T})
have wprob : w = (vectorBlockLaw P eps m).real {z | scaledColumnMean eps j z < -T} := by
simpa only [w, blockMean, Set.indicator_apply, Set.mem_setOf_eq] using
(pilot_indicator_probability (m := m) P eps {z | scaledColumnMean eps j z < -T})
have hx0 : 0 ≤ contrast P j := by
have : 0 ≤ a := by dsimp [a]; positivity
dsimp [a] at this; linarith
have hwp : 0 ≤ w := integral_nonneg (fun z => by split <;> norm_num)
have hrange := hybridPilot_central_probability_range (m := m) P eps T j
have hp := hybrid_outside_weighted_polynomial hMean hCheb P hP eps heps hd hm D hL hD hDm j hx
have hxc := (hybrid_outside_weighted_contrast hMean P hP eps heps hd hm j hL hx).1
change _ ≤ a * exp (-7 * logDim d * (contrast P j/a)^2) at hp hxc
rw [← hprob] at hp hxc
have hy : 1 ≤ (contrast P j/a)^2 := by
have hb := pilot_noiseScale_pos eps heps hd
have hs : 0 < sigmaSquared d m eps := div_pos (sq_pos_of_pos hb) (by exact_mod_cast hm)
have ha : 0 < a := by dsimp [a]; positivity
have hh : 1 ≤ contrast P j/a := by rw [le_div_iff₀ ha]; simpa [a] using hx
nlinarith
have he : exp (-7 * logDim d * (contrast P j/a)^2) ≤ 1/logDim d :=
(Real.exp_le_exp.mpr (by nlinarith)).trans (hybrid_outside_exp_residual _ (by linarith))
have hscale : a * (1/logDim d) = 8 * sqrt (sigmaSquared d m eps)/sqrt (logDim d) := by
have hs := Real.sq_sqrt (show 0 ≤ logDim d by linarith)
have hp : 0 < sqrt (logDim d) := Real.sqrt_pos.mpr (by linarith)
dsimp [a]
field_simp
nlinarith
have hsmall := mul_le_mul_of_nonneg_left he (show 0 ≤ a by dsimp [a]; positivity)
rw [hscale] at hsmall
have hw := (hybridPilot_wrong_sign_weighted hMean P hP eps heps hd hm j hx0).1
rw [← ht] at hw
rw [← wprob] at hw
have hw' := hw.trans (mul_le_mul_of_nonneg_left
(pilot_exp_tail_le_inv_sqrt (logDim d) (by linarith)) (Real.sqrt_nonneg _))
have haeq : 2 * (4 * sqrt (sigmaSquared d m eps) * sqrt (logDim d)) = a := by
dsimp [a]; ring
rw [abs_of_nonneg hx0, hybridColumn_mean_error_identity P hP eps heps hd hm D hDm j, haeq, ← ht]
change abs (h * (a * (chebyshevAbsPoly D).eval (contrast P j/a) - contrast P j) -
2 * contrast P j * w) ≤ _
rw [blockMean_polynomialEstimate P hP eps a heps (by
have hb := pilot_noiseScale_pos eps heps hd
have hs : 0 < sigmaSquared d m eps := div_pos (sq_pos_of_pos hb) (by exact_mod_cast hm)
dsimp [a]; positivity) hd D hDm j] at hp
have hh0 : 0 ≤ h := hrange.1
have hsplit := abs_sub (h * (a * (chebyshevAbsPoly D).eval (contrast P j/a)))
(h * contrast P j + 2 * contrast P j * w)
rw [abs_mul, abs_of_nonneg hrange.1,
abs_of_nonneg (by positivity : 0 ≤ h * contrast P j + 2 * contrast P j * w)] at hsplit
have halg : h * (a * (chebyshevAbsPoly D).eval (contrast P j/a) - contrast P j) -
2 * contrast P j * w = h * (a * (chebyshevAbsPoly D).eval (contrast P j/a)) -
(h * contrast P j + 2 * contrast P j * w) := by ring
rw [halg]
have hn : 0 ≤ sqrt (sigmaSquared d m eps)/sqrt (logDim d) := by positivity
change abs (h * _ - _) ≤ h * _ + _ at hsplit
simp only [div_eq_mul_inv] at hw' hp hxc hsplit hsmall hn ⊢
nlinarith
theorem hybrid_nonneg_bias
Assume the bounded-mean concentration inequality, the Cai–Low Chebyshev approximation theorem, the causal-model conditions for the data law, a positive privacy budget, dimension at least two, positive block size, the stated l condition, the stated d condition, the stated dm condition, and the stated hx condition. The inside and outside C6 cases cover every nonnegative contrast, including the boundary.
Formal statement
Proof (Lean source)
-- @node: hybrid_nonneg_bias
lemma hybrid_nonneg_bias (hMean : BoundedMeanConcentration)
(hCheb : CaiLowChebyshevApproximation)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d) (hm : 0 < m)
(D : ℕ) (hL : 4096 ≤ logDim d)
(hD : D = 2*⌊(1/1024 : ℝ)*logDim d/2⌋₊) (hDm : D ≤ m) (j : Fin d)
(hx : 0 ≤ contrast P j) :
abs (hybridMean (m := m) P eps (hybridColumn eps D j) - abs (contrast P j)) ≤
20000 * sqrt (sigmaSquared d m eps) / sqrt (logDim d) := by
by_cases hwindow : |contrast P j| ≤ 8 * sqrt (sigmaSquared d m eps) * sqrt (logDim d)
· exact hybrid_inside_nonneg_bias hMean hCheb P hP eps heps hd hm D hL hD hDm j hx hwindow
· apply hybrid_outside_nonneg_bias hMean hCheb P hP eps heps hd hm D hL hD hDm j
rw [abs_of_nonneg hx] at hwindow
exact (not_le.mp hwindow).le
theorem hybrid_outside_second_growth_suppression Lemma hybrid_outside_second_growth_suppression in the paper ↗
Assume the stated l condition, the stated hy condition, and the stated d condition. Gaussian pilot suppression dominates the squared polynomial growth in C9.
Formal statement
Proof (Lean source)
-- @node: hybrid_outside_second_growth_suppression
lemma hybrid_outside_second_growth_suppression (L y : ℝ) (hL : 1 ≤ L) (hy : 1 ≤ y)
(D : ℕ) (hD : (D : ℝ) ≤ L/1024) :
exp (-8*L*y^2) * (exp (5*D) * (2*y^2)^D) ≤
exp (-7*L*y^2) := by
have hypos : 0 < y := by linarith
have hy2 : 1 ≤ y^2 := by nlinarith
have hlog := hybrid_outside_log_bound y hy
have htwo : (2 : ℝ) ≤ exp 1 := by linarith [Real.add_one_le_exp (1 : ℝ)]
have hpow : y^(2*D) = exp ((2*D : ℝ) * log y) := by
simpa only [Nat.cast_mul, Nat.cast_ofNat, Real.exp_log hypos] using
(Real.exp_nat_mul (log y) (2*D)).symm
have hp : (2*y^2)^D ≤ exp D * exp ((2*D : ℝ) * log y) := by
rw [mul_pow, ← pow_mul, hpow]
have hh := pow_le_pow_left₀ (by norm_num : (0 : ℝ) ≤ 2) htwo D
rw [← Real.exp_nat_mul] at hh
simpa using mul_le_mul_of_nonneg_right hh (Real.exp_pos _).le
calc
_ ≤ exp (-8*L*y^2) * (exp (5*D) *
(exp D * exp ((2*D : ℝ)*log y))) := by
gcongr
_ = exp (-8*L*y^2 + (6*D + 2*D*log y)) := by
rw [← Real.exp_add, ← Real.exp_add, ← Real.exp_add]
congr 1
ring
_ ≤ _ := by
apply Real.exp_le_exp.mpr
have hfirst : 6*(D : ℝ) ≤ 6*L/1024*y^2 := by
nlinarith [mul_nonneg (show 0 ≤ L by linarith) (show 0 ≤ y^2-1 by linarith)]
have hsecond := mul_le_mul_of_nonneg_left hlog (show 0 ≤ 2*(D : ℝ) by positivity)
have hthird := mul_le_mul_of_nonneg_right hD (sq_nonneg y)
have hLy : 0 ≤ L*y^2 := by positivity
nlinarith
theorem hybrid_outside_weighted_second_moment
Assume the bounded-mean concentration inequality, the Cai–Low Chebyshev approximation theorem, the causal-model conditions for the data law, a positive privacy budget, dimension at least two, positive block size, the stated l condition, the stated d condition, the stated hm d condition, and the stated hx condition. C1 and the actual pilot tail yield the outside-window weighted second moment (C9).
Formal statement
hypotheses
m :
ℕ
d :
ℕ
hMean :
hCheb :
P :
hP :
eps :
ℝ
heps :
0 < eps
hd :
2 ≤ d
hm :
0 < m
D :
ℕ
hL :
4096 ≤ logDim d
hD :
D = 2*⌊(1/1024 : ℝ)*logDim d/2⌋₊
hmD :
2*D ≤ m
j :
Fin d
hx :
conclusion
a :
(vectorBlockLaw P eps m).real {z | |scaledColumnMean eps j z| ≤ a/2} * blockMean (m := m) P eps (fun z => (polynomialEstimate eps a D j z)^2)
Proof (Lean source)
-- @node: hybrid_outside_weighted_second_moment
lemma hybrid_outside_weighted_second_moment (hMean : BoundedMeanConcentration)
(hCheb : CaiLowChebyshevApproximation)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d) (hm : 0 < m)
(D : ℕ) (hL : 4096 ≤ logDim d)
(hD : D = 2*⌊(1/1024 : ℝ)*logDim d/2⌋₊) (hmD : 2*D ≤ m) (j : Fin d)
(hx : 8 * sqrt (sigmaSquared d m eps) * sqrt (logDim d) ≤ contrast P j) :
let a := 8 * sqrt (sigmaSquared d m eps) * sqrt (logDim d)
(vectorBlockLaw P eps m).real {z | |scaledColumnMean eps j z| ≤ a/2} *
blockMean (m := m) P eps (fun z => (polynomialEstimate eps a D j z)^2) ≤
a^2 * exp (-7 * logDim d * (contrast P j/a)^2) := by
dsimp only
let a := 8 * sqrt (sigmaSquared d m eps) * sqrt (logDim d)
let y := contrast P j/a
obtain ⟨hEven, hDtwo, _, hDupper⟩ := hybridDegree_bounds (logDim d) hL D hD
have hb := pilot_noiseScale_pos eps heps hd
have hs : 0 < sigmaSquared d m eps := div_pos (sq_pos_of_pos hb) (by exact_mod_cast hm)
have ha : 0 < a := by dsimp [a]; positivity
have ha2 : a^2 = 64 * sigmaSquared d m eps * logDim d := by
dsimp [a]
nlinarith [Real.sq_sqrt hs.le, Real.sq_sqrt (show 0 ≤ logDim d by linarith)]
have hy : 1 ≤ y := by dsimp [y]; rw [le_div_iff₀ ha]; simpa [a] using hx
have hy2 : 1 ≤ y^2 := by nlinarith
have hxy : contrast P j = a*y := by dsimp [y]; field_simp
have hbase : max 1 (((contrast P j)^2 + 2*D*sigmaSquared d m eps)/a^2) ≤ 2*y^2 := by
apply max_le (by linarith)
rw [div_le_iff₀ (sq_pos_of_pos ha), hxy, mul_pow]
have hnoise : 2*(D : ℝ)*sigmaSquared d m eps ≤ a^2 := by
rw [ha2]
nlinarith [mul_nonneg hs.le (show 0 ≤ 64*logDim d - 2*(D : ℝ) by linarith)]
nlinarith [mul_nonneg (sq_nonneg a) (show 0 ≤ y^2-1 by linarith)]
have hpoly := radius_polynomial_second_bound hCheb P hP eps a heps ha hd hm
D hEven hDtwo hmD j
have htail := hybridPilot_central_normalized_tail hMean P hP eps heps hd hm j (by linarith) hx
have hp := pow_le_pow_left₀ (le_trans zero_le_one (le_max_left _ _)) hbase D
have hg := hybrid_outside_second_growth_suppression (logDim d) y (by linarith) hy D hDupper
have hsecond : 0 ≤ blockMean (m := m) P eps
(fun z => (polynomialEstimate eps a D j z)^2) := integral_nonneg (fun z => sq_nonneg _)
change _ ≤ a^2 * exp (-7 * logDim d * y^2)
calc
_ ≤ exp (-8*logDim d*y^2) * (a^2 * exp (5*D) * (2*y^2)^D) :=
mul_le_mul htail (hpoly.trans (mul_le_mul_of_nonneg_left hp (by positivity)))
hsecond (Real.exp_pos _).le
_ = a^2 * (exp (-8*logDim d*y^2) * (exp (5*D) * (2*y^2)^D)) := by ring
_ ≤ _ := mul_le_mul_of_nonneg_left hg (sq_nonneg a)
theorem hybrid_outside_nonneg_variance
Assume the bounded-mean concentration inequality, the Cai–Low Chebyshev approximation theorem, the causal-model conditions for the data law, a positive privacy budget, dimension at least two, positive block size, the stated l condition, the stated d condition, the stated hm d condition, and the stated hx condition. C4, C7 and C9 assemble the outside-window variance bound for nonnegative contrasts.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
hMean :
hCheb :
P :
hP :
eps :
ℝ
heps :
0 < eps
hd :
2 ≤ d
hm :
0 < m
D :
ℕ
hL :
4096 ≤ logDim d
hD :
D = 2*⌊(1/1024 : ℝ)*logDim d/2⌋₊
hmD :
2*D ≤ m
j :
Fin d
hx :
conclusion
hybridVar (m := m) P eps (hybridColumn eps D j)
Proof (Lean source)
-- @node: hybrid_outside_nonneg_variance
lemma hybrid_outside_nonneg_variance (hMean : BoundedMeanConcentration)
(hCheb : CaiLowChebyshevApproximation)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d) (hm : 0 < m)
(D : ℕ) (hL : 4096 ≤ logDim d)
(hD : D = 2*⌊(1/1024 : ℝ)*logDim d/2⌋₊) (hmD : 2*D ≤ m) (j : Fin d)
(hx : 8 * sqrt (sigmaSquared d m eps) * sqrt (logDim d) ≤ contrast P j) :
hybridVar (m := m) P eps (hybridColumn eps D j) ≤
400 * sigmaSquared d m eps * logDim d * exp (logDim d/100) := by
let a := 8 * sqrt (sigmaSquared d m eps) * sqrt (logDim d)
let T := a/2
let h := blockMean (m := m) P eps
(fun z => if |scaledColumnMean eps j z| ≤ T then (1 : ℝ) else 0)
let w := blockMean (m := m) P eps
(fun z => if scaledColumnMean eps j z < -T then (1 : ℝ) else 0)
have ht : T = 4 * sqrt (sigmaSquared d m eps) * sqrt (logDim d) := by
dsimp [T, a]; ring
have hs : 0 ≤ sigmaSquared d m eps := by unfold sigmaSquared; positivity
have ha2 : a^2 = 64 * sigmaSquared d m eps * logDim d := by
dsimp [a]
nlinarith [Real.sq_sqrt hs, Real.sq_sqrt (show 0 ≤ logDim d by linarith)]
have hx0 : 0 ≤ contrast P j := le_trans (by positivity) hx
have hprob : h = (vectorBlockLaw P eps m).real {z | |scaledColumnMean eps j z| ≤ T} := by
simpa only [h, blockMean, Set.indicator_apply, Set.mem_setOf_eq] using
(pilot_indicator_probability (m := m) P eps {z | |scaledColumnMean eps j z| ≤ T})
have wprob : w = (vectorBlockLaw P eps m).real {z | scaledColumnMean eps j z < -T} := by
simpa only [w, blockMean, Set.indicator_apply, Set.mem_setOf_eq] using
(pilot_indicator_probability (m := m) P eps {z | scaledColumnMean eps j z < -T})
have hp := hybrid_outside_weighted_second_moment hMean hCheb P hP eps heps hd hm
D hL hD hmD j hx
have hx2 := (hybrid_outside_weighted_contrast hMean P hP eps heps hd hm j hL hx).2
change _ ≤ a^2 * exp (-7 * logDim d * (contrast P j/a)^2) at hp hx2
rw [← hprob] at hp hx2
have he : exp (-7 * logDim d * (contrast P j/a)^2) ≤ 1 := by
apply Real.exp_le_one_iff.mpr
have : 0 ≤ logDim d * (contrast P j/a)^2 := by positivity
linarith
have hsmall := mul_le_mul_of_nonneg_left he (sq_nonneg a)
have hp' := hp.trans hsmall
have hx2' := hx2.trans hsmall
rw [ha2] at hp' hx2'
have hw := (hybridPilot_wrong_sign_weighted hMean P hP eps heps hd hm j hx0).2
rw [← ht, ← wprob] at hw
have hw' : (contrast P j)^2 * w ≤ sigmaSquared d m eps := hw.trans
(mul_le_mul_of_nonneg_left (Real.exp_le_one_iff.mpr (by linarith)) hs |>.trans_eq (mul_one _))
have hC7 := hybridColumn_centered_error_le P hP eps heps hd hm D j
rw [← ht] at hC7
have ha : 2*T = a := by dsimp [T]; ring
dsimp only at hC7
rw [ha] at hC7
change hybridVar P eps (hybridColumn eps D j) ≤
2*h * blockMean P eps (fun z => (polynomialEstimate eps a D j z)^2) +
2*h*(contrast P j)^2 + sigmaSquared d m eps + 4*(contrast P j)^2*w at hC7
have he' : 1 ≤ exp (logDim d/100) := Real.one_le_exp_iff.mpr (by linarith)
have hscale : sigmaSquared d m eps * logDim d ≤
sigmaSquared d m eps * logDim d * exp (logDim d/100) := by
simpa using mul_le_mul_of_nonneg_left he' (by positivity : 0 ≤ sigmaSquared d m eps * logDim d)
have hsL : sigmaSquared d m eps ≤ sigmaSquared d m eps * logDim d := by
nlinarith [mul_nonneg hs (show 0 ≤ logDim d - 1 by linarith)]
change h * _ ≤ _ at hp' hx2'
nlinarith
theorem hybrid_nonneg_variance
Assume the bounded-mean concentration inequality, the Cai–Low Chebyshev approximation theorem, the causal-model conditions for the data law, a positive privacy budget, dimension at least two, positive block size, the stated l condition, the stated d condition, the stated hm d condition, and the stated hx condition. C8 and C9 cover all nonnegative contrasts, including the window boundary.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
hMean :
hCheb :
P :
hP :
eps :
ℝ
heps :
0 < eps
hd :
2 ≤ d
hm :
0 < m
D :
ℕ
hL :
4096 ≤ logDim d
hD :
D = 2*⌊(1/1024 : ℝ)*logDim d/2⌋₊
hmD :
2*D ≤ m
j :
Fin d
hx :
0 ≤ contrast P j
conclusion
hybridVar (m := m) P eps (hybridColumn eps D j)
Proof (Lean source)
-- @node: hybrid_nonneg_variance
lemma hybrid_nonneg_variance (hMean : BoundedMeanConcentration)
(hCheb : CaiLowChebyshevApproximation)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d) (hm : 0 < m)
(D : ℕ) (hL : 4096 ≤ logDim d)
(hD : D = 2*⌊(1/1024 : ℝ)*logDim d/2⌋₊) (hmD : 2*D ≤ m) (j : Fin d)
(hx : 0 ≤ contrast P j) :
hybridVar (m := m) P eps (hybridColumn eps D j) ≤
400 * sigmaSquared d m eps * logDim d * exp (logDim d/100) := by
by_cases hwindow : |contrast P j| ≤ 8 * sqrt (sigmaSquared d m eps) * sqrt (logDim d)
· exact hybrid_inside_nonneg_variance hMean hCheb P hP eps heps hd hm D hL hD hmD j hx hwindow
· apply hybrid_outside_nonneg_variance hMean hCheb P hP eps heps hd hm D hL hD hmD j
rw [abs_of_nonneg hx] at hwindow
exact (not_le.mp hwindow).le
theorem hybrid_bias_bound
Assume the bounded-mean concentration inequality, the Cai–Low Chebyshev approximation theorem, the causal-model conditions for the data law, a positive privacy budget, dimension at least two, positive block size, the stated l condition, the stated d condition, and the stated dm condition. Reflection extends the C3--C6 bias assembly to both signs of every causal contrast.
Formal statement
Proof (Lean source)
-- @node: hybrid_bias_bound
lemma hybrid_bias_bound (hMean : BoundedMeanConcentration)
(hCheb : CaiLowChebyshevApproximation)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d) (hm : 0 < m)
(D : ℕ) (hL : 4096 ≤ logDim d)
(hD : D = 2*⌊(1/1024 : ℝ)*logDim d/2⌋₊) (hDm : D ≤ m) (j : Fin d) :
abs (hybridMean (m := m) P eps (hybridColumn eps D j) - abs (contrast P j)) ≤
20000 * sqrt (sigmaSquared d m eps) / sqrt (logDim d) := by
by_cases hx : 0 ≤ contrast P j
· exact hybrid_nonneg_bias hMean hCheb P hP eps heps hd hm D hL hD hDm j hx
· let P' := symmetricLaw (fun j => -contrast P j)
have hc := neg_contrast_mem_parameterCube P hP
letI : IsProbabilityMeasure P' := symmetricLaw_probability _ hc (by omega)
have hP' : CausalModel P' := symmetricLaw_causalModel _ hc (by omega)
have hneg : ∀ j, contrast P' j = -contrast P j := symmetricLaw_neg_contrast P hP hd
have h := hybrid_nonneg_bias hMean hCheb P' hP' eps heps hd hm D hL hD hDm j
(by rw [hneg]; linarith)
rw [hybridMean_reflection P P' hP hP' eps hd hneg, hneg j, abs_neg] at h
exact h
theorem hybrid_variance_bound
Assume the bounded-mean concentration inequality, the Cai–Low Chebyshev approximation theorem, the causal-model conditions for the data law, a positive privacy budget, dimension at least two, positive block size, the stated l condition, the stated d condition, and the stated hm d condition. Reflection extends the C4/C7--C9 variance assembly to both signs of every causal contrast.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
hMean :
hCheb :
P :
hP :
eps :
ℝ
heps :
0 < eps
hd :
2 ≤ d
hm :
0 < m
D :
ℕ
hL :
4096 ≤ logDim d
hD :
D = 2*⌊(1/1024 : ℝ)*logDim d/2⌋₊
hmD :
2*D ≤ m
j :
Fin d
conclusion
hybridVar (m := m) P eps (hybridColumn eps D j)
Proof (Lean source)
-- @node: hybrid_variance_bound
lemma hybrid_variance_bound (hMean : BoundedMeanConcentration)
(hCheb : CaiLowChebyshevApproximation)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d) (hm : 0 < m)
(D : ℕ) (hL : 4096 ≤ logDim d)
(hD : D = 2*⌊(1/1024 : ℝ)*logDim d/2⌋₊) (hmD : 2*D ≤ m) (j : Fin d) :
hybridVar (m := m) P eps (hybridColumn eps D j) ≤
400 * sigmaSquared d m eps * logDim d * exp (logDim d/100) := by
by_cases hx : 0 ≤ contrast P j
· exact hybrid_nonneg_variance hMean hCheb P hP eps heps hd hm D hL hD hmD j hx
· let P' := symmetricLaw (fun j => -contrast P j)
have hc := neg_contrast_mem_parameterCube P hP
letI : IsProbabilityMeasure P' := symmetricLaw_probability _ hc (by omega)
have hP' : CausalModel P' := symmetricLaw_causalModel _ hc (by omega)
have hneg : ∀ j, contrast P' j = -contrast P j := symmetricLaw_neg_contrast P hP hd
have h := hybrid_nonneg_variance hMean hCheb P' hP' eps heps hd hm D hL hD hmD j
(by rw [hneg]; linarith)
rw [hybridVar_reflection P P' hP hP' eps hd hneg] at h
exact h
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Calibration.PilotTails 11 declarations Hoeffding bounds for actual scaled vector-message column means, including the wrong-sign and central-window pilot events in the hybrid calibration roadmap (C4/C6).
Pilot concentration
Hoeffding bounds for actual scaled vector-message column means, including the wrong-sign and central-window pilot events in the hybrid calibration roadmap (C4/C6).
Assume a positive privacy budget and dimension at least two. Positive privacy and dimension give a positive noise scale.
Formal statement
Proof (Lean source)
-- @node: pilot_noiseScale_pos
lemma pilot_noiseScale_pos (eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d) :
0 < noiseScale d eps := by
have hdR : (0 : ℝ) < d := by exact_mod_cast (show 0 < d by omega)
have hdelta : 0 < privacyDelta eps := by
rw [privacyDelta_exp_formula]
exact div_pos (sub_pos.mpr (Real.one_lt_exp_iff.mpr heps)) (by positivity)
exact div_pos hdR hdelta
A pilot column has independent rows under the product release law.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: pilot_scaledMessages_independent
lemma pilot_scaledMessages_independent (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(eps : ℝ) (j : Fin d) :
iIndepFun (fun i : Fin m => fun z => scaledMessages eps z i j) (vectorBlockLaw P eps m) := by
letI := vectorMessageLaw_probability P eps
unfold vectorBlockLaw scaledMessages
exact iIndepFun_pi (fun _ => (show Measurable
(fun z : Fin d → Bool => noiseScale d eps * signVal (z j)) by fun_prop).aemeasurable)
theorem pilot_scaledColumnMean_tails
Assume the bounded-mean concentration inequality, the causal-model conditions for the data law, a positive privacy budget, dimension at least two, positive block size, and the stated hu condition. The Hoeffding gate applies to the actual pilot column, with the paper's variance scale.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
hMean :
P :
hP :
eps :
ℝ
heps :
0 < eps
hd :
2 ≤ d
hm :
0 < m
j :
Fin d
u :
ℝ
hu :
0 ≤ u
conclusion
conclusion 1
≤ exp (-u^2 / (2 * sigmaSquared d m eps))
conclusion 2
≤ exp (-u^2 / (2 * sigmaSquared d m eps))
Proof (Lean source)
-- @node: pilot_scaledColumnMean_tails
lemma pilot_scaledColumnMean_tails (hMean : BoundedMeanConcentration)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d) (hm : 0 < m) (j : Fin d)
(u : ℝ) (hu : 0 ≤ u) :
(vectorBlockLaw P eps m).real {z | u ≤ scaledColumnMean eps j z - contrast P j} ≤
exp (-u^2 / (2 * sigmaSquared d m eps)) ∧
(vectorBlockLaw P eps m).real {z | scaledColumnMean eps j z - contrast P j ≤ -u} ≤
exp (-u^2 / (2 * sigmaSquared d m eps)) := by
letI := vectorBlockLaw_probability P eps m
have hb := pilot_noiseScale_pos eps heps hd
have hbound (i : Fin m) (z : Fin m → Fin d → Bool) :
scaledMessages eps z i j ∈ Icc (-noiseScale d eps) (noiseScale d eps) := by
cases hz : z i j <;> simp [scaledMessages, hz, signVal] <;> linarith
have hmean (i : Fin m) :
(∫ z, scaledMessages eps z i j ∂vectorBlockLaw P eps m) = contrast P j := by
exact (blockMean_scaledMessages_eq_rowMean P eps i j).trans
(vectorMessageLaw_scaled_sign_integral P hP eps heps hd j)
have hcenter (z : Fin m → Fin d → Bool) :
(m : ℝ)⁻¹ * ∑ i, (scaledMessages eps z i j - contrast P j) =
scaledColumnMean eps j z - contrast P j := by
have hmR : (m : ℝ) ≠ 0 := by exact_mod_cast hm.ne'
simp [Finset.sum_sub_distrib, scaledColumnMean, mul_sub, hmR]
have hexponent : -(m : ℝ) * u^2 / (2 * (noiseScale d eps)^2) =
-u^2 / (2 * sigmaSquared d m eps) := by
unfold sigmaSquared
field_simp
have h := hMean (vectorBlockLaw P eps m) m hm (noiseScale d eps)
(fun i z => scaledMessages eps z i j) (pilot_scaledMessages_independent P eps j)
(fun _ => by fun_prop) hbound u hu
simp_rw [hmean, hcenter, hexponent] at h
exact h
theorem hybridPilot_wrong_sign_tail
Assume the bounded-mean concentration inequality, the causal-model conditions for the data law, a positive privacy budget, dimension at least two, positive block size, and the stated hx condition. The wrong-sign pilot branch has the one-sided C4 tail, including threshold ties.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
hMean :
P :
hP :
eps :
ℝ
heps :
0 < eps
hd :
2 ≤ d
hm :
0 < m
j :
Fin d
hx :
0 ≤ contrast P j
Proof (Lean source)
-- @node: hybridPilot_wrong_sign_tail
lemma hybridPilot_wrong_sign_tail (hMean : BoundedMeanConcentration)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d) (hm : 0 < m) (j : Fin d)
(hx : 0 ≤ contrast P j) :
let T := 4 * sqrt (sigmaSquared d m eps) * sqrt (logDim d)
(vectorBlockLaw P eps m).real {z | scaledColumnMean eps j z < -T} ≤
exp (-(contrast P j + T)^2 / (2 * sigmaSquared d m eps)) := by
dsimp only
letI := vectorBlockLaw_probability P eps m
have hT := hybridThreshold_nonneg (m := m) (d := d) eps
apply le_trans (measureReal_mono (fun z hz => ?_))
(pilot_scaledColumnMean_tails hMean P hP eps heps hd hm j
(contrast P j + 4 * sqrt (sigmaSquared d m eps) * sqrt (logDim d))
(by linarith)).2
change scaledColumnMean eps j z - contrast P j ≤ _
change scaledColumnMean eps j z < _ at hz
linarith
theorem hybridPilot_central_tail
Assume the bounded-mean concentration inequality, the causal-model conditions for the data law, a positive privacy budget, dimension at least two, positive block size, and the stated hx condition. Outside the approximation radius, the central pilot event has the C6 tail.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
hMean :
P :
hP :
eps :
ℝ
heps :
0 < eps
hd :
2 ≤ d
hm :
0 < m
j :
Fin d
hx :
Proof (Lean source)
-- @node: hybridPilot_central_tail
lemma hybridPilot_central_tail (hMean : BoundedMeanConcentration)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d) (hm : 0 < m) (j : Fin d)
(hx : 8 * sqrt (sigmaSquared d m eps) * sqrt (logDim d) ≤ contrast P j) :
let T := 4 * sqrt (sigmaSquared d m eps) * sqrt (logDim d)
(vectorBlockLaw P eps m).real {z | |scaledColumnMean eps j z| ≤ T} ≤
exp (-(contrast P j)^2 / (8 * sigmaSquared d m eps)) := by
dsimp only
letI := vectorBlockLaw_probability P eps m
have hT := hybridThreshold_nonneg (m := m) (d := d) eps
have hxpos : 0 ≤ contrast P j := by linarith
have htail := (pilot_scaledColumnMean_tails hMean P hP eps heps hd hm j
(contrast P j / 2) (by positivity)).2
have heq : -(contrast P j / 2)^2 / (2 * sigmaSquared d m eps) =
-(contrast P j)^2 / (8 * sigmaSquared d m eps) := by ring
rw [heq] at htail
apply le_trans (measureReal_mono (fun z hz => ?_)) htail
change |scaledColumnMean eps j z| ≤ _ at hz
have hzupper := (abs_le.mp hz).2
change scaledColumnMean eps j z - contrast P j ≤ _
linarith
theorem hybridPilot_wrong_sign_factor
Assume the bounded-mean concentration inequality, the causal-model conditions for the data law, a positive privacy budget, dimension at least two, positive block size, and the stated hx condition. The wrong-sign exponent separates into a Gaussian contrast factor and exp(-8L).
Formal statement
hypotheses
m :
ℕ
d :
ℕ
hMean :
P :
hP :
eps :
ℝ
heps :
0 < eps
hd :
2 ≤ d
hm :
0 < m
j :
Fin d
hx :
0 ≤ contrast P j
conclusion
T :
Proof (Lean source)
-- @node: hybridPilot_wrong_sign_factor
lemma hybridPilot_wrong_sign_factor (hMean : BoundedMeanConcentration)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d) (hm : 0 < m) (j : Fin d)
(hx : 0 ≤ contrast P j) :
let T := 4 * sqrt (sigmaSquared d m eps) * sqrt (logDim d)
(vectorBlockLaw P eps m).real {z | scaledColumnMean eps j z < -T} ≤
exp (-(contrast P j)^2 / (2 * sigmaSquared d m eps)) *
exp (-8 * logDim d) := by
dsimp only
have hb := pilot_noiseScale_pos eps heps hd
have hmR : (0 : ℝ) < m := by exact_mod_cast hm
have hs : 0 < sigmaSquared d m eps := div_pos (sq_pos_of_pos hb) hmR
have hL : 0 ≤ logDim d := by
have hdR : (1 : ℝ) ≤ d := by exact_mod_cast (show 1 ≤ d by omega)
apply Real.log_nonneg
nlinarith [Real.add_one_le_exp (1 : ℝ)]
have hT := hybridThreshold_nonneg (m := m) (d := d) eps
have hT2 : (4 * sqrt (sigmaSquared d m eps) * sqrt (logDim d))^2 =
16 * sigmaSquared d m eps * logDim d := by
nlinarith [Real.sq_sqrt hs.le, Real.sq_sqrt hL]
apply (hybridPilot_wrong_sign_tail hMean P hP eps heps hd hm j hx).trans
rw [← Real.exp_add]
apply Real.exp_le_exp.mpr
apply (div_le_iff₀ (by positivity : 0 < 2 * sigmaSquared d m eps)).mpr
have hsplit : (-(contrast P j)^2 / (2 * sigmaSquared d m eps) + -8 * logDim d) *
(2 * sigmaSquared d m eps) = -(contrast P j)^2 - 16 * sigmaSquared d m eps * logDim d := by
field_simp
<;> ring
rw [hsplit]
nlinarith [mul_nonneg hx hT]
Assume the stated hs condition. The elementary Gaussian first-moment envelope used in C4.
Formal statement
Proof (Lean source)
-- @node: pilot_gaussian_first_envelope
lemma pilot_gaussian_first_envelope (x sigma : ℝ) (hs : 0 < sigma) :
x * exp (-x^2 / (2 * sigma^2)) ≤ sigma := by
have hbound : x / sigma ≤ exp ((x / sigma)^2 / 2) := by
nlinarith [Real.add_one_le_exp ((x / sigma)^2 / 2), sq_nonneg (x / sigma - 1)]
have h := mul_le_mul_of_nonneg_right hbound
(Real.exp_pos (-((x / sigma)^2 / 2))).le
rw [← Real.exp_add] at h
have he : (x / sigma)^2 / 2 + -((x / sigma)^2 / 2) = 0 := by ring
rw [he, Real.exp_zero] at h
have he' : -((x / sigma)^2 / 2) = -x^2 / (2 * sigma^2) := by ring
rw [he'] at h
have hh := mul_le_mul_of_nonneg_right h hs.le
have heq : x / sigma * exp (-x^2 / (2 * sigma^2)) * sigma =
x * exp (-x^2 / (2 * sigma^2)) := by field_simp
simpa only [heq, one_mul] using hh
Assume the stated hs condition. The elementary Gaussian second-moment envelope used in C4.
Formal statement
Proof (Lean source)
-- @node: pilot_gaussian_second_envelope
lemma pilot_gaussian_second_envelope (x sigma : ℝ) (hs : 0 < sigma) :
x^2 * exp (-x^2 / (2 * sigma^2)) ≤ sigma^2 := by
have hexp : 2 * exp (-1) ≤ (1 : ℝ) := by
have hh := Real.add_one_le_exp (1 : ℝ)
rw [Real.exp_neg]
have h := mul_le_mul_of_nonneg_right hh (inv_nonneg.mpr (Real.exp_pos 1).le)
norm_num at h ⊢
exact h
have h := Real.mul_exp_neg_le_exp_neg_one (x^2 / (2 * sigma^2))
have hh := mul_le_mul_of_nonneg_left h (show 0 ≤ 2 * sigma^2 by positivity)
have heq : 2 * sigma^2 * (x^2 / (2 * sigma^2) * exp (-(x^2 / (2 * sigma^2)))) =
x^2 * exp (-x^2 / (2 * sigma^2)) := by
field_simp
rw [heq] at hh
exact hh.trans (by nlinarith [mul_le_mul_of_nonneg_left hexp (sq_nonneg sigma)])
theorem hybridPilot_wrong_sign_weighted
Assume the bounded-mean concentration inequality, the causal-model conditions for the data law, a positive privacy budget, dimension at least two, positive block size, and the stated hx condition. Both contrast-weighted wrong-sign bounds in C4 hold for the actual pilot.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
hMean :
P :
hP :
eps :
ℝ
heps :
0 < eps
hd :
2 ≤ d
hm :
0 < m
j :
Fin d
hx :
0 ≤ contrast P j
conclusion
T :
w :
Proof (Lean source)
-- @node: hybridPilot_wrong_sign_weighted
lemma hybridPilot_wrong_sign_weighted (hMean : BoundedMeanConcentration)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d) (hm : 0 < m) (j : Fin d)
(hx : 0 ≤ contrast P j) :
let T := 4 * sqrt (sigmaSquared d m eps) * sqrt (logDim d)
let w := (vectorBlockLaw P eps m).real {z | scaledColumnMean eps j z < -T}
contrast P j * w ≤ sqrt (sigmaSquared d m eps) * exp (-8 * logDim d) ∧
(contrast P j)^2 * w ≤ sigmaSquared d m eps * exp (-8 * logDim d) := by
dsimp only
have hb := pilot_noiseScale_pos eps heps hd
have hmR : (0 : ℝ) < m := by exact_mod_cast hm
have hs : 0 < sigmaSquared d m eps := div_pos (sq_pos_of_pos hb) hmR
have hsqrt := Real.sq_sqrt hs.le
have hfirst := pilot_gaussian_first_envelope (contrast P j)
(sqrt (sigmaSquared d m eps)) (Real.sqrt_pos.mpr hs)
have hsecond := pilot_gaussian_second_envelope (contrast P j)
(sqrt (sigmaSquared d m eps)) (Real.sqrt_pos.mpr hs)
rw [hsqrt] at hfirst hsecond
have hw := hybridPilot_wrong_sign_factor hMean P hP eps heps hd hm j hx
constructor
· calc
_ ≤ contrast P j * (exp (-(contrast P j)^2 / (2 * sigmaSquared d m eps)) *
exp (-8 * logDim d)) := mul_le_mul_of_nonneg_left hw hx
_ = (contrast P j * exp (-(contrast P j)^2 / (2 * sigmaSquared d m eps))) *
exp (-8 * logDim d) := by ring
_ ≤ _ := mul_le_mul_of_nonneg_right hfirst (Real.exp_pos _).le
· calc
_ ≤ (contrast P j)^2 * (exp (-(contrast P j)^2 / (2 * sigmaSquared d m eps)) *
exp (-8 * logDim d)) := mul_le_mul_of_nonneg_left hw (sq_nonneg _)
_ = ((contrast P j)^2 * exp (-(contrast P j)^2 / (2 * sigmaSquared d m eps))) *
exp (-8 * logDim d) := by ring
_ ≤ _ := mul_le_mul_of_nonneg_right hsecond (Real.exp_pos _).le
The indicator expectation equals the probability of the pilot event.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
P :
eps :
ℝ
conclusion
blockMean (m := m) P eps (E.indicator (fun _ => (1 : ℝ)))
= (vectorBlockLaw P eps m).real E
Proof (Lean source)
-- @node: pilot_indicator_probability
lemma pilot_indicator_probability (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(eps : ℝ) (E : Set (Fin m → Fin d → Bool)) :
blockMean (m := m) P eps (E.indicator (fun _ => (1 : ℝ))) =
(vectorBlockLaw P eps m).real E := by
classical
have hE : MeasurableSet E := Set.toFinite E |>.measurableSet
exact integral_indicator_one hE
Assume the stated l condition. At log dimension at least one, the C4 residual is bounded by inverse root dimension.
Proof (Lean source)
-- @node: pilot_exp_tail_le_inv_sqrt
lemma pilot_exp_tail_le_inv_sqrt (L : ℝ) (hL : 1 ≤ L) :
exp (-8 * L) ≤ 1 / sqrt L := by
have hs : 0 < sqrt L := Real.sqrt_pos.mpr (by linarith)
have hs2 := Real.sq_sqrt (show 0 ≤ L by linarith)
have hsle : sqrt L ≤ L := by nlinarith [Real.sqrt_nonneg L]
have hbound : sqrt L ≤ exp (8 * L) := by
linarith [Real.add_one_le_exp (8 * L)]
apply (le_div_iff₀ hs).mpr
have h := mul_le_mul_of_nonneg_right hbound (Real.exp_pos (-8 * L)).le
rw [← Real.exp_add] at h
have he : 8 * L + -8 * L = 0 := by ring
rw [he, Real.exp_zero] at h
simpa [mul_comm] using h
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Calibration.Radius 3 declarations Scaled approximation and finite second-moment bounds for the evaluation polynomial.
Calibration at an arbitrary positive radius
Scaled approximation and finite second-moment bounds for the evaluation polynomial. The radius is unrestricted relative to the causal parameter cube.
theorem radius_polynomial_bias_of_gate
Assume the Cai–Low Chebyshev approximation theorem, the causal-model conditions for the data law, a positive privacy budget, the stated ha condition, dimension at least two, the stated even condition, polynomial degree at least two, the stated dm condition, and the stated hx condition. The cited approximation scales to every positive window containing the contrast (C5).
Formal statement
hypotheses
m :
ℕ
d :
ℕ
hCheb :
P :
hP :
eps a :
ℝ
heps :
0 < eps
ha :
0 < a
hd :
2 ≤ d
D :
ℕ
hEven :
Even D
hD :
2 ≤ D
hDm :
D ≤ m
j :
Fin d
hx :
|contrast P j| ≤ a
conclusion
≤ a / (D+1)
Proof (Lean source)
-- @node: radius_polynomial_bias_of_gate
lemma radius_polynomial_bias_of_gate (hCheb : CaiLowChebyshevApproximation)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(eps a : ℝ) (heps : 0 < eps) (ha : 0 < a) (hd : 2 ≤ d)
(D : ℕ) (hEven : Even D) (hD : 2 ≤ D) (hDm : D ≤ m) (j : Fin d)
(hx : |contrast P j| ≤ a) :
abs (blockMean (m := m) P eps (polynomialEstimate eps a D j) - abs (contrast P j)) ≤
a / (D+1) := by
rw [blockMean_polynomialEstimate P hP eps a heps ha.ne' hd D hDm j]
have hunit : contrast P j / a ∈ Icc (-1 : ℝ) 1 := by
have hx' := abs_le.mp hx
constructor
· rw [le_div_iff₀ ha]; linarith [hx'.1]
· rw [div_le_iff₀ ha]; simpa using hx'.2
have happ := (hCheb D hEven hD).1 _ hunit
have hscale : abs (a * (chebyshevAbsPoly D).eval (contrast P j / a) - abs (contrast P j)) =
a * abs ((chebyshevAbsPoly D).eval (contrast P j / a) - abs (contrast P j / a)) := by
have heq : a * (chebyshevAbsPoly D).eval (contrast P j / a) - abs (contrast P j) =
a * ((chebyshevAbsPoly D).eval (contrast P j / a) - abs (contrast P j / a)) := by
rw [mul_sub, abs_div, abs_of_pos ha, mul_div_cancel₀ _ ha.ne']
rw [heq, abs_mul, abs_of_pos ha]
rw [hscale]
have hpi : (2 : ℝ) ≤ pi := le_trans (by norm_num) Real.pi_gt_three.le
have hden : (0 : ℝ) < D+1 := by positivity
have hnum : 2 / (pi * (D+1)) ≤ 1 / (D+1) := by
rw [div_le_div_iff₀ (by positivity) hden]
nlinarith
exact (mul_le_mul_of_nonneg_left (happ.trans hnum) ha.le).trans_eq (by ring)
theorem radius_scaled_moment_second_bound
Assume the causal-model conditions for the data law, a positive privacy budget, the stated ha condition, dimension at least two, positive block size, the stated hm d condition, and the stated hv condition. Rescaled moment degrees share one geometric bound, without degree independence.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
P :
hP :
eps a :
ℝ
heps :
0 < eps
ha :
0 < a
hd :
2 ≤ d
hm :
0 < m
D v :
ℕ
hmD :
2*D ≤ m
hv :
v ≤ D
j :
Fin d
conclusion
blockMean (m := m) P eps (fun z => (a^((1 : ℤ) - (v : ℤ)) * privateMoment (scaledMessages eps z) v j)^2)
≤ a^2 * (max 1 (((contrast P j)^2 + 2*D*sigmaSquared d m eps) / a^2))^D
Proof (Lean source)
-- @node: radius_scaled_moment_second_bound
lemma radius_scaled_moment_second_bound (P : Measure (FullRecord d))
[IsProbabilityMeasure P] (hP : CausalModel P) (eps a : ℝ) (heps : 0 < eps)
(ha : 0 < a) (hd : 2 ≤ d) (hm : 0 < m) (D v : ℕ)
(hmD : 2*D ≤ m) (hv : v ≤ D) (j : Fin d) :
blockMean (m := m) P eps (fun z =>
(a^((1 : ℤ) - (v : ℤ)) * privateMoment (scaledMessages eps z) v j)^2) ≤
a^2 * (max 1 (((contrast P j)^2 + 2*D*sigmaSquared d m eps) / a^2))^D := by
have hsigma : 0 ≤ sigmaSquared d m eps := by unfold sigmaSquared; positivity
have hmom := blockMean_privateMoment_sq_le P hP eps heps hd hm v (by omega) j
have hscale (x : ℝ) : (a^((1 : ℤ) - (v : ℤ)))^2 * x^v =
a^2 * (x/a^2)^v := by
rw [zpow_sub₀ ha.ne', zpow_one, zpow_natCast, div_pow, pow_right_comm, div_pow]
ring
have hbase : ((contrast P j)^2 + 2*v*(noiseScale d eps)^2/m) / a^2 ≤
max 1 (((contrast P j)^2 + 2*D*sigmaSquared d m eps) / a^2) := by
apply le_trans _ (le_max_right _ _)
apply div_le_div_of_nonneg_right _ (sq_nonneg a)
have hvR : (v : ℝ) ≤ D := by exact_mod_cast hv
have hh := mul_le_mul_of_nonneg_right hvR hsigma
dsimp only [sigmaSquared] at hh ⊢
rw [mul_div_assoc]
nlinarith
unfold blockMean
simp_rw [mul_pow]
rw [integral_const_mul]
calc
_ ≤ (a^((1 : ℤ) - (v : ℤ)))^2 *
((contrast P j)^2 + 2*v*(noiseScale d eps)^2/m)^v :=
mul_le_mul_of_nonneg_left hmom (sq_nonneg _)
_ = _ := hscale _
_ ≤ _ := by
apply mul_le_mul_of_nonneg_left _ (sq_nonneg a)
exact (pow_le_pow_left₀ (by positivity) hbase v).trans
(pow_le_pow_right₀ (le_max_left _ _) hv)
theorem radius_polynomial_second_bound
Assume the Cai–Low Chebyshev approximation theorem, the causal-model conditions for the data law, a positive privacy budget, the stated ha condition, dimension at least two, positive block size, the stated even condition, polynomial degree at least two, and the stated hm d condition. Arbitrary-radius counterpart of C1, with the sharper coefficient factor exp(5D).
Formal statement
hypotheses
m :
ℕ
d :
ℕ
hCheb :
P :
hP :
eps a :
ℝ
heps :
0 < eps
ha :
0 < a
hd :
2 ≤ d
hm :
0 < m
D :
ℕ
hEven :
Even D
hD :
2 ≤ D
hmD :
2*D ≤ m
j :
Fin d
conclusion
blockMean (m := m) P eps (fun z => (polynomialEstimate eps a D j z)^2)
Proof (Lean source)
-- @node: radius_polynomial_second_bound
lemma radius_polynomial_second_bound (hCheb : CaiLowChebyshevApproximation)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(eps a : ℝ) (heps : 0 < eps) (ha : 0 < a) (hd : 2 ≤ d) (hm : 0 < m)
(D : ℕ) (hEven : Even D) (hD : 2 ≤ D) (hmD : 2*D ≤ m) (j : Fin d) :
blockMean (m := m) P eps (fun z => (polynomialEstimate eps a D j z)^2) ≤
a^2 * exp (5*D) *
(max 1 (((contrast P j)^2 + 2*D*sigmaSquared d m eps) / a^2))^D := by
classical
letI := vectorBlockLaw_probability P eps m
let R := (max 1 (((contrast P j)^2 + 2*D*sigmaSquared d m eps) / a^2))^D
have hterm (v : ℕ) (hv : v ∈ range (D+1)) :
blockMean (m := m) P eps (fun z =>
((chebyshevAbsPoly D).coeff v * a^((1 : ℤ) - (v : ℤ)) *
privateMoment (scaledMessages eps z) v j)^2) ≤ exp (3*D) * (a^2 * R) := by
have hvD : v ≤ D := by have := Finset.mem_range.mp hv; omega
have hmom := radius_scaled_moment_second_bound P hP eps a heps ha hd hm D v hmD hvD j
have hc := chebyshev_coefficient_sq_le_exp hCheb D v hEven hD hvD
have heq : blockMean (m := m) P eps (fun z =>
((chebyshevAbsPoly D).coeff v * a^((1 : ℤ) - (v : ℤ)) *
privateMoment (scaledMessages eps z) v j)^2) =
((chebyshevAbsPoly D).coeff v)^2 * blockMean (m := m) P eps (fun z =>
(a^((1 : ℤ) - (v : ℤ)) * privateMoment (scaledMessages eps z) v j)^2) := by
unfold blockMean
simp only [mul_assoc, mul_pow]
rw [integral_const_mul]
rw [heq]
exact mul_le_mul hc hmom (integral_nonneg (fun _ => sq_nonneg _)) (Real.exp_pos _).le
have hcard : (D+1 : ℝ)^2 ≤ exp (2*D) := by
have hh : (D+1 : ℝ) ≤ exp D := by linarith [Real.add_one_le_exp (D : ℝ)]
have hs := mul_le_mul hh hh (by positivity : (0 : ℝ) ≤ D+1) (Real.exp_pos _).le
rw [← Real.exp_add] at hs
simpa [← pow_two, two_mul] using hs
calc
_ ≤ (D+1 : ℝ) * ∑ v ∈ range (D+1),
blockMean P eps (fun z => ((chebyshevAbsPoly D).coeff v *
a^((1 : ℤ) - (v : ℤ)) * privateMoment (scaledMessages eps z) v j)^2) :=
blockMean_sum_sq_le P eps D _
_ ≤ (D+1 : ℝ) * ∑ _v ∈ range (D+1), exp (3*D) * (a^2 * R) :=
mul_le_mul_of_nonneg_left (Finset.sum_le_sum hterm) (by positivity)
_ = (D+1 : ℝ)^2 * exp (3*D) * (a^2 * R) := by
simp only [Finset.sum_const, Finset.card_range, nsmul_eq_mul, Nat.cast_add, Nat.cast_one]
ring
_ ≤ exp (2*D) * exp (3*D) * (a^2 * R) := by
apply mul_le_mul_of_nonneg_right
(mul_le_mul_of_nonneg_right hcard (Real.exp_pos _).le)
dsimp [R]; positivity
_ = _ := by
rw [← Real.exp_add]
have he : 2*(D : ℝ) + 3*D = 5*D := by ring
rw [he]
ring
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Calibration.Reflection 17 declarations The explicit Chebyshev approximation is even.
Reflection of hybrid column statistics
The explicit Chebyshev approximation is even. Reflecting the bits in both blocks therefore preserves the hybrid column statistic, including threshold ties. The affine row integral identifies the reflected vector law, its iid block product, and the independent two-block law; hybrid means and variances are invariant.
Only even Chebyshev orders occur in the explicit approximation.
Formal statement
Proof (Lean source)
-- @node: chebyshevAbsPoly_eval_neg
lemma chebyshevAbsPoly_eval_neg (D : ℕ) (x : ℝ) :
(chebyshevAbsPoly D).eval (-x) = (chebyshevAbsPoly D).eval x := by
simp only [chebyshevAbsPoly, Polynomial.eval_add, Polynomial.eval_C, Polynomial.eval_finsetSum]
congr 1
apply Finset.sum_congr rfl
intro v hv
simp [Polynomial.Chebyshev.T_eval_neg]
Negating the input multiplies each monomial coefficient by its parity sign.
Formal statement
Proof (Lean source)
-- @node: reflection_coeff_comp_neg_X
lemma reflection_coeff_comp_neg_X (p : Polynomial ℝ) (v : ℕ) :
(p.comp (-Polynomial.X)).coeff v = (-1 : ℝ)^v * p.coeff v := by
induction p using Polynomial.induction_on' with
| add p q hp hq => simp [hp, hq, mul_add]
| monomial n a =>
have hpow : (-Polynomial.X : Polynomial ℝ)^n = C ((-1 : ℝ)^n) * Polynomial.X^n := by
calc
_ = (C (-1 : ℝ) * Polynomial.X)^n := by congr 1; simp
_ = _ := by rw [mul_pow, ← Polynomial.C_pow]
rw [Polynomial.monomial_comp, hpow]
simp only [← mul_assoc, ← Polynomial.C_mul, Polynomial.coeff_C_mul,
Polynomial.coeff_X_pow, Polynomial.coeff_monomial]
by_cases h : n = v
· subst v; simp [mul_comm]
· simp [h, Ne.symm h]
The parity-weighted coefficients of the even approximation are unchanged.
Formal statement
hypotheses
D v :
ℕ
conclusion
(-1 : ℝ)^v * (chebyshevAbsPoly D).coeff v = (chebyshevAbsPoly D).coeff v
Proof (Lean source)
-- @node: chebyshevAbsPoly_coeff_parity
lemma chebyshevAbsPoly_coeff_parity (D v : ℕ) :
(-1 : ℝ)^v * (chebyshevAbsPoly D).coeff v = (chebyshevAbsPoly D).coeff v := by
have hp : (chebyshevAbsPoly D).comp (-X) = chebyshevAbsPoly D := by
apply Polynomial.eq_of_infinite_eval_eq
have heq : {x : ℝ | ((chebyshevAbsPoly D).comp (-X)).eval x =
(chebyshevAbsPoly D).eval x} = univ := by
ext x
simp [chebyshevAbsPoly_eval_neg]
rw [heq]
exact Set.infinite_univ
rw [← reflection_coeff_comp_neg_X, hp]
theorem privateMoment_neg
Every distinct-person product acquires the sign of its degree under reflection.
Formal statement
hypotheses
conclusion
privateMoment (fun i j => -W i j) k j = (-1 : ℝ)^k * privateMoment W k j
Proof (Lean source)
-- @node: privateMoment_neg
lemma privateMoment_neg (W : Fin m → Fin d → ℝ) (k : ℕ) (j : Fin d) :
privateMoment (fun i j => -W i j) k j = (-1 : ℝ)^k * privateMoment W k j := by
classical
unfold privateMoment
rw [mul_comm ((-1 : ℝ)^k), mul_assoc]
congr 1
rw [Finset.sum_mul]
apply Finset.sum_congr rfl
intro J hJ
have hcard := (Finset.mem_powersetCard.mp hJ).2
simpa only [Finset.prod_neg, hcard] using
(mul_comm ((-1 : ℝ)^k) (∏ i ∈ J, W i j))
Reflecting every released bit negates every scaled entry.
Formal statement
hypotheses
conclusion
scaledMessages eps (fun i j => !(z i j)) i j = -scaledMessages eps z i j
Proof (Lean source)
-- @node: scaledMessages_not
lemma scaledMessages_not (eps : ℝ) (z : Fin m → Fin d → Bool) (i : Fin m) (j : Fin d) :
scaledMessages eps (fun i j => !(z i j)) i j = -scaledMessages eps z i j := by
cases h : z i j <;> simp [scaledMessages, signVal, h]
The pilot and evaluation means change sign under bit reflection.
Formal statement
hypotheses
conclusion
scaledColumnMean eps j (fun i j => !(z i j)) = -scaledColumnMean eps j z
Proof (Lean source)
-- @node: scaledColumnMean_not
lemma scaledColumnMean_not (eps : ℝ) (z : Fin m → Fin d → Bool) (j : Fin d) :
scaledColumnMean eps j (fun i j => !(z i j)) = -scaledColumnMean eps j z := by
simp [scaledColumnMean, scaledMessages_not, Finset.sum_neg_distrib]
Parity of the coefficients cancels parity of the reflected private moments.
Formal statement
hypotheses
conclusion
polynomialEstimate eps a D j (fun i j => !(z i j)) = polynomialEstimate eps a D j z
Proof (Lean source)
-- @node: polynomialEstimate_not
lemma polynomialEstimate_not (eps a : ℝ) (D : ℕ) (j : Fin d)
(z : Fin m → Fin d → Bool) :
polynomialEstimate eps a D j (fun i j => !(z i j)) = polynomialEstimate eps a D j z := by
have hW : scaledMessages eps (fun i j => !(z i j)) = fun i j => -scaledMessages eps z i j := by
funext i j
exact scaledMessages_not eps z i j
unfold polynomialEstimate
rw [hW]
simp_rw [privateMoment_neg]
apply Finset.sum_congr rfl
intro v hv
have hp := chebyshevAbsPoly_coeff_parity D v
calc
_ = ((-1 : ℝ)^v * (chebyshevAbsPoly D).coeff v) *
a^((1 : ℤ) - (v : ℤ)) * privateMoment (scaledMessages eps z) v j := by ring
_ = _ := by rw [hp]
Simultaneous reflection preserves both hybrid branches and threshold ties.
Formal statement
hypotheses
conclusion
hybridColumn eps D j ((fun i j => !(z.1 i j)), (fun i j => !(z.2 i j)))
= hybridColumn eps D j z
Proof (Lean source)
-- @node: hybridColumn_not
lemma hybridColumn_not (eps : ℝ) (D : ℕ) (j : Fin d)
(z : (Fin m → Fin d → Bool) × (Fin m → Fin d → Bool)) :
hybridColumn eps D j ((fun i j => !(z.1 i j)), (fun i j => !(z.2 i j))) =
hybridColumn eps D j z := by
unfold hybridColumn
simp only [scaledColumnMean_not, abs_neg, polynomialEstimate_not]
split
· rfl
· by_cases hp : 0 < scaledColumnMean eps j z.1
· simp [hp, show ¬scaledColumnMean eps j z.1 < 0 by linarith]
· by_cases hn : scaledColumnMean eps j z.1 < 0
· simp [hp, hn, show 0 < -scaledColumnMean eps j z.1 by linarith]
· have hz : scaledColumnMean eps j z.1 = 0 := by linarith
simp [hz]
theorem vectorMessageLaw_integral_affine
Assume the causal-model conditions for the data law and dimension at least two. Averaging an original-record vector row has an affine integral determined by the contrasts.
Formal statement
hypotheses
d :
ℕ
P :
hP :
eps :
ℝ
hd :
2 ≤ d
conclusion
(∫ z, f z ∂vectorMessageLaw P eps)
= (2 : ℝ)^(-(d : ℤ)) * (∑ z, f z)
+ (2 : ℝ)^(-(d : ℤ)) * privacyDelta eps * ∑ j, (contrast P j / d) * (∑ z, signVal (z j) * f z)
Proof (Lean source)
-- @node: vectorMessageLaw_integral_affine
lemma vectorMessageLaw_integral_affine (P : Measure (FullRecord d))
[IsProbabilityMeasure P] (hP : CausalModel P) (eps : ℝ) (hd : 2 ≤ d)
(f : (Fin d → Bool) → ℝ) :
(∫ z, f z ∂vectorMessageLaw P eps) =
(2 : ℝ)^(-(d : ℤ)) * (∑ z, f z) +
(2 : ℝ)^(-(d : ℤ)) * privacyDelta eps *
∑ j, (contrast P j / d) * (∑ z, signVal (z j) * f z) := by
letI := vectorKernel_markov d eps
letI : IsProbabilityMeasure (observedLaw P) := by
unfold observedLaw
exact Measure.isProbabilityMeasure_map (by fun_prop)
change (∫ z, f z ∂((vectorKernel d eps) ∘ₖ Kernel.const Unit (observedLaw P)) ()) = _
rw [Kernel.integral_comp Integrable.of_finite]
have hrow (o : ObsRecord d) :
(∫ z, f z ∂vectorKernel d eps o) =
(2 : ℝ)^(-(d : ℤ)) * (∑ z, f z) +
(2 : ℝ)^(-(d : ℤ)) * privacyDelta eps *
∑ j : Fin d, (if o.1 = j then obsSign o else 0) *
(∑ z, signVal (z j) * f z) := by
rw [integral_fintype Integrable.of_finite]
change (∑ z, (atomLaw (vectorMass eps o)).real {z} * f z) = _
simp only [measureReal_def, atomLaw_singleton,
ENNReal.toReal_ofReal (vectorMass_nonneg eps o _), smul_eq_mul]
simp only [ite_mul, zero_mul, Finset.sum_ite_eq, Finset.mem_univ, if_true]
simp only [vectorMass, mul_add, add_mul, one_mul, Finset.sum_add_distrib,
← Finset.mul_sum]
simp only [mul_assoc, ← Finset.mul_sum]
ring
simp_rw [hrow]
rw [integral_add Integrable.of_finite Integrable.of_finite, integral_const,
integral_const_mul, integral_finset_sum _ (fun _ _ => Integrable.of_finite)]
simp only [probReal_univ, one_smul]
congr 2
apply Finset.sum_congr rfl
intro j hj
rw [integral_mul_const]
have hcell := signedCellMean_eq_contrast P hP j
unfold signedCellMean at hcell
rw [hP.uniform j] at hcell
have hdR : (d : ℝ) ≠ 0 := by exact_mod_cast (show d ≠ 0 by omega)
have hmean : (∫ w, if cell w = j then obsSign (observe w) else 0 ∂P) =
contrast P j / d := by
apply (div_eq_iff (inv_ne_zero hdR)).mp at hcell
simpa [div_eq_mul_inv] using hcell
simp only [Kernel.const_apply]
unfold observedLaw
rw [integral_map (by fun_prop) (by fun_prop)]
change (∫ w, if cell w = j then obsSign (observe w) else 0 ∂P) * _ = _
rw [hmean]
theorem vectorMessageLaw_integral_not
Assume the causal-model conditions for the data law, the causal-model conditions for the second law, dimension at least two, and the stated hx condition. Negating all contrasts reflects every released vector bit in a one-row experiment.
Formal statement
hypotheses
d :
ℕ
P P' :
hP :
hP' :
CausalModel P'
eps :
ℝ
hd :
2 ≤ d
hx :
∀ j, contrast P' j = -contrast P j
conclusion
(∫ z, f (fun j => !(z j)) ∂vectorMessageLaw P eps) = ∫ z, f z ∂vectorMessageLaw P' eps
Proof (Lean source)
-- @node: vectorMessageLaw_integral_not
lemma vectorMessageLaw_integral_not (P P' : Measure (FullRecord d))
[IsProbabilityMeasure P] [IsProbabilityMeasure P']
(hP : CausalModel P) (hP' : CausalModel P') (eps : ℝ) (hd : 2 ≤ d)
(hx : ∀ j, contrast P' j = -contrast P j) (f : (Fin d → Bool) → ℝ) :
(∫ z, f (fun j => !(z j)) ∂vectorMessageLaw P eps) =
∫ z, f z ∂vectorMessageLaw P' eps := by
classical
let e : (Fin d → Bool) ≃ (Fin d → Bool) :=
⟨fun z j => !(z j), fun z j => !(z j), by intro z; ext j; simp,
by intro z; ext j; simp⟩
have hsum : (∑ z : Fin d → Bool, f (fun j => !(z j))) = ∑ z, f z := e.sum_comp f
have hsign (j : Fin d) :
(∑ z : Fin d → Bool, signVal (z j) * f (fun j => !(z j))) = -(∑ z, signVal (z j) * f z) := by
have h := e.sum_comp (fun (z : Fin d → Bool) => signVal (z j) * f z)
have hn (z : Fin d → Bool) : signVal (!(z j)) = -signVal (z j) := by
cases z j <;> norm_num [signVal]
change (∑ z : Fin d → Bool, signVal (!(z j)) * f (fun j => !(z j))) = _ at h
simp_rw [hn, neg_mul, Finset.sum_neg_distrib] at h
linarith
rw [vectorMessageLaw_integral_affine P hP eps hd,
vectorMessageLaw_integral_affine P' hP' eps hd, hsum]
simp_rw [hsign, hx, neg_div, mul_neg, neg_mul]
theorem vectorMessageLaw_map_not
Assume the causal-model conditions for the data law, the causal-model conditions for the second law, dimension at least two, and the stated hx condition. The reflected vector-message pushforward is the law with opposite contrasts.
Formal statement
hypotheses
d :
ℕ
P P' :
hP :
hP' :
CausalModel P'
eps :
ℝ
hd :
2 ≤ d
hx :
∀ j, contrast P' j = -contrast P j
conclusion
Proof (Lean source)
-- @node: vectorMessageLaw_map_not
lemma vectorMessageLaw_map_not (P P' : Measure (FullRecord d))
[IsProbabilityMeasure P] [IsProbabilityMeasure P']
(hP : CausalModel P) (hP' : CausalModel P') (eps : ℝ) (hd : 2 ≤ d)
(hx : ∀ j, contrast P' j = -contrast P j) :
(vectorMessageLaw P eps).map (fun z j => !(z j)) = vectorMessageLaw P' eps := by
classical
letI := vectorMessageLaw_probability P eps
letI := vectorMessageLaw_probability P' eps
ext E hE
have h := vectorMessageLaw_integral_not P P' hP hP' eps hd hx
(E.indicator (fun _ => (1 : ℝ)))
rw [← integral_map (Measurable.of_discrete.aemeasurable) (by fun_prop)] at h
simp only [integral_indicator hE, integral_const, smul_eq_mul, mul_one,
measureReal_def, Measure.restrict_apply_univ] at h
exact (ENNReal.toReal_eq_toReal_iff' (measure_ne_top _ _) (measure_ne_top _ _)).mp h
theorem vectorBlockLaw_map_not
Assume the causal-model conditions for the data law, the causal-model conditions for the second law, dimension at least two, and the stated hx condition. Reflection commutes with the iid product of participant rows.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
P P' :
hP :
hP' :
CausalModel P'
eps :
ℝ
hd :
2 ≤ d
hx :
∀ j, contrast P' j = -contrast P j
conclusion
Proof (Lean source)
-- @node: vectorBlockLaw_map_not
lemma vectorBlockLaw_map_not (P P' : Measure (FullRecord d))
[IsProbabilityMeasure P] [IsProbabilityMeasure P']
(hP : CausalModel P) (hP' : CausalModel P') (eps : ℝ) (hd : 2 ≤ d)
(hx : ∀ j, contrast P' j = -contrast P j) :
(vectorBlockLaw P eps m).map (fun z i j => !(z i j)) = vectorBlockLaw P' eps m := by
letI := vectorMessageLaw_probability P eps
unfold vectorBlockLaw
rw [Measure.pi_map_pi (fun _ => (show Measurable
(fun z : Fin d → Bool => fun j => !(z j)) by fun_prop).aemeasurable)]
simp_rw [vectorMessageLaw_map_not P P' hP hP' eps hd hx]
theorem hybridLaw_map_not
Assume the causal-model conditions for the data law, the causal-model conditions for the second law, dimension at least two, and the stated hx condition. Reflecting both independent blocks gives the hybrid law with opposite contrasts.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
P P' :
hP :
hP' :
CausalModel P'
eps :
ℝ
hd :
2 ≤ d
hx :
∀ j, contrast P' j = -contrast P j
Proof (Lean source)
-- @node: hybridLaw_map_not
lemma hybridLaw_map_not (P P' : Measure (FullRecord d))
[IsProbabilityMeasure P] [IsProbabilityMeasure P']
(hP : CausalModel P) (hP' : CausalModel P') (eps : ℝ) (hd : 2 ≤ d)
(hx : ∀ j, contrast P' j = -contrast P j) :
(hybridLaw P eps m).map
(fun z => ((fun i j => !(z.1 i j)), (fun i j => !(z.2 i j)))) =
hybridLaw P' eps m := by
letI := vectorBlockLaw_probability P eps m
unfold hybridLaw
change Measure.map (map (fun z i j => !(z i j)) (fun z i j => !(z i j)))
((vectorBlockLaw P eps m).prod (vectorBlockLaw P eps m)) = _
rw [← Measure.map_prod_map _ _ Measurable.of_discrete Measurable.of_discrete]
rw [vectorBlockLaw_map_not P P' hP hP' eps hd hx]
theorem hybridMean_reflection
Assume the causal-model conditions for the data law, the causal-model conditions for the second law, dimension at least two, and the stated hx condition. The hybrid mean is unchanged by reversing the entire contrast vector.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
P P' :
hP :
hP' :
CausalModel P'
eps :
ℝ
hd :
2 ≤ d
hx :
∀ j, contrast P' j = -contrast P j
D :
ℕ
j :
Fin d
conclusion
hybridMean (m := m) P' eps (hybridColumn eps D j)
= hybridMean (m := m) P eps (hybridColumn eps D j)
Proof (Lean source)
-- @node: hybridMean_reflection
lemma hybridMean_reflection (P P' : Measure (FullRecord d))
[IsProbabilityMeasure P] [IsProbabilityMeasure P']
(hP : CausalModel P) (hP' : CausalModel P') (eps : ℝ) (hd : 2 ≤ d)
(hx : ∀ j, contrast P' j = -contrast P j) (D : ℕ) (j : Fin d) :
hybridMean (m := m) P' eps (hybridColumn eps D j) =
hybridMean (m := m) P eps (hybridColumn eps D j) := by
unfold hybridMean
rw [← hybridLaw_map_not P P' hP hP' eps hd hx,
integral_map Measurable.of_discrete.aemeasurable (by fun_prop)]
simp_rw [hybridColumn_not]
theorem hybridVar_reflection
Assume the causal-model conditions for the data law, the causal-model conditions for the second law, dimension at least two, and the stated hx condition. The hybrid variance is unchanged by reversing the entire contrast vector.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
P P' :
hP :
hP' :
CausalModel P'
eps :
ℝ
hd :
2 ≤ d
hx :
∀ j, contrast P' j = -contrast P j
D :
ℕ
j :
Fin d
conclusion
hybridVar (m := m) P' eps (hybridColumn eps D j)
= hybridVar (m := m) P eps (hybridColumn eps D j)
Proof (Lean source)
-- @node: hybridVar_reflection
lemma hybridVar_reflection (P P' : Measure (FullRecord d))
[IsProbabilityMeasure P] [IsProbabilityMeasure P']
(hP : CausalModel P) (hP' : CausalModel P') (eps : ℝ) (hd : 2 ≤ d)
(hx : ∀ j, contrast P' j = -contrast P j) (D : ℕ) (j : Fin d) :
hybridVar (m := m) P' eps (hybridColumn eps D j) =
hybridVar (m := m) P eps (hybridColumn eps D j) := by
unfold hybridVar
rw [hybridMean_reflection P P' hP hP' eps hd hx,
← hybridLaw_map_not P P' hP hP' eps hd hx,
integral_map Measurable.of_discrete.aemeasurable (by fun_prop)]
simp_rw [hybridColumn_not]
theorem neg_contrast_mem_parameterCube
Assume the causal-model conditions for the data law. Reversing a causal contrast vector preserves the symmetric construction's parameter cube.
Formal statement
hypotheses
conclusion
(fun j => -contrast P j) ∈ parameterCube d
Proof (Lean source)
-- @node: neg_contrast_mem_parameterCube
lemma neg_contrast_mem_parameterCube (P : Measure (FullRecord d)) (hP : CausalModel P) :
(fun j => -contrast P j) ∈ parameterCube d := by
intro j
have h := contrast_mem_parameterCube P hP j
constructor <;> linarith [h.1, h.2]
theorem symmetricLaw_neg_contrast
Assume the causal-model conditions for the data law and dimension at least two. The symmetric law built from the reversed contrast has exactly that contrast.
Formal statement
hypotheses
conclusion
contrast (symmetricLaw (fun j => -contrast P j)) j = -contrast P j
Proof (Lean source)
-- @node: symmetricLaw_neg_contrast
lemma symmetricLaw_neg_contrast (P : Measure (FullRecord d)) (hP : CausalModel P)
(hd : 2 ≤ d) (j : Fin d) :
contrast (symmetricLaw (fun j => -contrast P j)) j = -contrast P j := by
change armMean (symmetricLaw (fun j => -contrast P j)) true j -
armMean (symmetricLaw (fun j => -contrast P j)) false j = -contrast P j
rw [symmetricLaw_armMean _ (neg_contrast_mem_parameterCube P hP) (by omega),
symmetricLaw_armMean _ (neg_contrast_mem_parameterCube P hP) (by omega)]
norm_num [signVal]
<;> ring
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.CitedGates 11 declarations Finite original-record private value frontiers: Helpers/CitedGates.
Helpers/CitedGates
Finite original-record private value frontiers: Helpers/CitedGates.
def bestAbsApproxError
Fix the local protocol. Best uniform polynomial error for the absolute-value function.
Definition (Lean source)
parameters
K :
ℕ
def
bestAbsApproxError K :
ℝ
given by
⨅ p : {p : Polynomial ℝ // p.natDegree ≤ K}, sSup ((fun x : ℝ => abs (p.1.eval x - abs x)) '' Icc (-1) 1)
def chebyshevAbsPoly
Fix the natural-number parameter D. Explicit truncated first-kind Chebyshev absolute-value approximation.
def MeasurableKernelRadonNikodym
Vákár and Ong (2018), Theorem 10 and proof, pp. 19–20; Definition 1 p. 8, finite-reference reduction p. 18. Handle: VakarOng2018SFinite, arXiv:1810.01837v2. Logical gate: jointly measurable density for finite dominated kernels.
Definition (Lean source)
def
MeasurableKernelRadonNikodym :
Sort 0
given by
∀ {H Z : Type} [MeasurableSpace H] [MeasurableSpace Z] [StandardBorelSpace Z] (K L : Kernel H Z) [IsFiniteKernel K] [IsFiniteKernel L],
(∀ h, K h ≪ L h) → ∃ f : H × Z → ℝ
≥0∞, Measurable f ∧ ∀ h E, MeasurableSet E → K h E = ∫⁻ z in E, f (h,z) ∂(L h)
def BoundedMeanConcentration
Hoeffding (1963), Theorem 2, equal-range specialization, printed p. 16. Handle: Hoeffding1963Bounded, DOI 10.1080/01621459.1963.10500830. Logical gate: upper, lower and hence two-sided bounded mean tails.
Definition (Lean source)
def
BoundedMeanConcentration :
Sort 0
given by
∀ {Ω : Type} [MeasurableSpace Ω] (mu : Measure Ω) [IsProbabilityMeasure mu] (m : ℕ) (_hm : 0 < m) (b : ℝ) (H : Fin m → Ω → ℝ),
iIndepFun H mu → (∀ i, Measurable (H i)) → (∀ i w, H i w ∈ Icc (-b) b) → ∀ x : ℝ, 0
≤ x → mu.real {w | x ≤ (m : ℝ)⁻¹ * ∑ i, (H i w - ∫ t, H i t ∂mu)} ≤ exp (-(m : ℝ) * x^2 / (2*b^2)) ∧
mu.real {w | (m : ℝ)⁻¹ * ∑ i, (H i w - ∫ t, H i t ∂mu) ≤ -x}
≤ exp (-(m : ℝ) * x^2 / (2*b^2))
def CaiLowChebyshevApproximation
Cai and Low (2011), Lemma 2, equations (24), (27), (28), p. 13, D=2K. Handle: CaiLow2011Nonsmooth, arXiv:1105.3039. Logical approximation gate.
Definition (Lean source)
def
CaiLowChebyshevApproximation :
Sort 0
given by
∀ D : ℕ
def CaiLowMomentDuality
Cai and Low (2011), Lemma 1, p. 10. Handle: CaiLow2011Nonsmooth, arXiv:1105.3039. Symmetric moment-matched probability measures with exact gap.
Definition (Lean source)
def
CaiLowMomentDuality :
Sort 0
given by
∀ K : ℕ
if
0 < K
and
Even K
then
∃ xi0 xi1 : Measure ℝ,
IsProbabilityMeasure xi0 ∧
IsProbabilityMeasure xi1 ∧
xi0 (Icc (-1 : ℝ) 1)ᶜ = 0 ∧
xi1 (Icc (-1 : ℝ) 1)ᶜ = 0 ∧
xi0.map (fun x => -x) = xi0 ∧
xi1.map (fun x => -x) = xi1 ∧
(∀ l : ℕ, l ≤ K → (∫ x, x^l ∂xi1) = ∫ x, x^l ∂xi0) ∧
(∫ x, |x| ∂xi1) - (∫ x, |x| ∂xi0) = 2 * bestAbsApproxError K
def BernsteinAbsoluteApproximationLimit Object lem:bernstein-absolute-approximation-limit in the paper ↗
Cai and Low (2011), Section 3.1, p. 8, Bernstein constant paragraph; Bernstein (1913), pp. 1–2 and 55–56. Handle: CaiLow2011Nonsmooth, arXiv:1105.3039. Positive even-degree absolute approximation limit.
Definition (Lean source)
def
BernsteinAbsoluteApproximationLimit :
Sort 0
given by
∃ betaStar : ℝ,
(0.278 : ℝ) < betaStar ∧
betaStar < (0.286 : ℝ) ∧
Every pointwise-dominated pair of finite kernels on a standard Borel target admits a jointly measurable Radon--Nikodym density representing each kernel measure.
Formal statement
conclusion
Proof (Lean source)
theorem measurableKernelRadonNikodym_proved : MeasurableKernelRadonNikodym := by
intro H Z _ _ _ K L _ _ hKL
refine ⟨fun hz ↦ K.rnDeriv L hz.1 hz.2, K.measurable_rnDeriv L, ?_⟩
intro h E hE
exact (Kernel.setLIntegral_rnDeriv (hKL h) hE).symm
Hoeffding's inequality for finite independent bounded real-valued families establishes the bounded-mean concentration gate.
Formal statement
conclusion
Proof (Lean source)
theorem boundedMeanConcentration_proved : BoundedMeanConcentration := by
unfold BoundedMeanConcentration
intro Ω _ mu _ m hm b H hInd hMeas hBdd x hx
have hb : 0 ≤ b := by
let i : Fin m := ⟨0, hm⟩
obtain ⟨w⟩ := nonempty_of_isProbabilityMeasure mu
exact le_trans (neg_le_self_iff.mp (le_trans (hBdd i w).1 (hBdd i w).2)) (le_refl b)
rcases hb.eq_or_lt with rfl | hb
· constructor <;> simpa using (measureReal_le_one (μ := mu))
have hmR : (0 : ℝ) < m := by exact_mod_cast hm
let c : NNReal := (‖b - (-b)‖₊ / 2) ^ 2
have hc : (c : ℝ) = b ^ 2 := by
simp only [c, NNReal.coe_pow, NNReal.coe_div, NNReal.coe_ofNat, coe_nnnorm,
Real.norm_eq_abs, sub_neg_eq_add]
rw [abs_of_pos (by linarith : 0 < b + b)]
ring
have upper (G : Fin m → Ω → ℝ) (hGInd : iIndepFun G mu)
(hGMeas : ∀ i, Measurable (G i))
(hGBdd : ∀ i w, G i w ∈ Icc (-b) b) :
mu.real {w | x ≤ (m : ℝ)⁻¹ * ∑ i, (G i w - ∫ t, G i t ∂mu)} ≤
exp (-(m : ℝ) * x ^ 2 / (2 * b ^ 2)) := by
let Y : Fin m → Ω → ℝ := fun i w => G i w - ∫ t, G i t ∂mu
have hYInd : iIndepFun Y mu :=
hGInd.comp (fun i y => y - ∫ t, G i t ∂mu)
(fun _ => measurable_id.sub measurable_const)
have hSubG : ∀ i ∈ univ, HasSubgaussianMGF (Y i) c mu := by
intro i _
simpa [Y, c] using hasSubgaussianMGF_of_mem_Icc
(μ := mu) (X := G i) (hGMeas i).aemeasurable (ae_of_all _ (hGBdd i))
have hmx : 0 ≤ (m : ℝ) * x := mul_nonneg hmR.le hx
have hTail := HasSubgaussianMGF.measure_sum_ge_le_of_iIndepFun
hYInd hSubG hmx
have hEvent :
{w | x ≤ (m : ℝ)⁻¹ * ∑ i, (G i w - ∫ t, G i t ∂mu)} =
{w | (m : ℝ) * x ≤ ∑ i, Y i w} := by
ext w
simp only [Set.mem_setOf_eq, Y]
constructor
· intro h
calc
(m : ℝ) * x ≤ (m : ℝ) * ((m : ℝ)⁻¹ * ∑ i, (G i w - ∫ t, G i t ∂mu)) :=
mul_le_mul_of_nonneg_left h hmR.le
_ = ∑ i, (G i w - ∫ t, G i t ∂mu) := by
field_simp
· intro h
calc
x = (m : ℝ)⁻¹ * ((m : ℝ) * x) := by
field_simp
_ ≤ (m : ℝ)⁻¹ * ∑ i, (G i w - ∫ t, G i t ∂mu) :=
mul_le_mul_of_nonneg_left h (inv_nonneg.mpr hmR.le)
rw [hEvent]
refine hTail.trans_eq ?_
congr 1
simp only [Finset.sum_const, Finset.card_univ, Fintype.card_fin, nsmul_eq_mul]
change -((m : ℝ) * x) ^ 2 / (2 * ((m : ℝ) * (c : ℝ))) =
-(m : ℝ) * x ^ 2 / (2 * b ^ 2)
rw [hc]
field_simp
constructor
· exact upper H hInd hMeas hBdd
· let G : Fin m → Ω → ℝ := fun i w => -H i w
have hGInd : iIndepFun G mu :=
hInd.comp (fun _ y => -y) (fun _ => measurable_neg)
have hGMeas : ∀ i, Measurable (G i) := fun i => (hMeas i).neg
have hGBdd : ∀ i w, G i w ∈ Icc (-b) b := by
intro i w
simpa [G] using intro (neg_le_neg (hBdd i w).2) (neg_le_neg (hBdd i w).1)
have h := upper G hGInd hGMeas hGBdd
have hEvent :
{w | (m : ℝ)⁻¹ * ∑ i, (H i w - ∫ t, H i t ∂mu) ≤ -x} =
{w | x ≤ (m : ℝ)⁻¹ * ∑ i, (G i w - ∫ t, G i t ∂mu)} := by
ext w
simp only [Set.mem_setOf_eq, G, integral_neg]
have hsum :
(∑ i, (-H i w - -∫ a, H i a ∂mu)) =
-∑ i, (H i w - ∫ a, H i a ∂mu) := by
rw [← Finset.sum_neg_distrib]
apply Finset.sum_congr rfl
intro i _
ring
rw [hsum, mul_neg]
constructor <;> intro h' <;> linarith
rw [hEvent]
exact h
The Cai--Low symmetric moment-matched prior gate follows from the extremal absolute-value approximation duality construction.
Formal statement
conclusion
Proof (Lean source)
theorem caiLowMomentDuality_proved : CaiLowMomentDuality := by
intro K _hK _hEven
obtain ⟨P⟩ := exists_symmetric_momentMatched_absGap (K := K)
refine ⟨P.ν₀, P.ν₁, P.probability₀, P.probability₁, P.supported₀, P.supported₁,
P.symmetric₀, P.symmetric₁, ?_, ?_⟩
· intro l hl
exact (P.moments_eq l hl).symm
· rw [bestAbsApproxError_eq_library]
exact P.abs_gap
The Cai--Low Chebyshev absolute-value approximation gate follows from the public half-degree truncation bounds.
Formal statement
conclusion
Proof (Lean source)
theorem caiLowChebyshevApproximation_proved : CaiLowChebyshevApproximation := by
intro D hD hD2
rw [chebyshevAbsPoly_eq_library]
constructor
· intro x hx
exact absChebPoly_halfDegree_error_le D hD hx
· intro v _hv
exact absChebPoly_halfDegree_coeff_le D hD v
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Contraction.CanonicalDensity 18 declarations This module constructs transcript densities from fixed-record row densities and the explicit affine masses of iid observed-record vectors.
Canonical finite-sum transcript densities
This module constructs transcript densities from fixed-record row densities and the explicit affine masses of iid observed-record vectors. The resulting density represents the conditional transcript law and is polynomial of degree at most the sample size in each parameter coordinate.
Fix the function theta and the observed participant record. The explicit affine mass of one observed record under the symmetric experiment.
Fix the function theta and the function o. The explicit iid mass of a complete observed-record vector.
Definition (Lean source)
Fix the function f and the function w. The finite sum of fixed-record transcript-row densities weighted by iid affine masses.
Definition (Lean source)
parameters
def
canonicalTranscriptDensity f w :
ℝ
given by
∑ o, iidAffineMass w.1 o * f ((o, w.2.1), w.2.2)
theorem observedAffineMass_nonneg
Assume the stated htheta condition. An observed-record affine mass is nonnegative throughout the parameter cube. [](.
Formal statement
hypotheses
conclusion
0 ≤ observedAffineMass theta o
Proof (Lean source)
-- @node: observedAffineMass_nonneg
lemma observedAffineMass_nonneg (theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d)
(o : ObsRecord d) : 0 ≤ observedAffineMass theta o := by
rcases o with ⟨j, a, y⟩
have hj := htheta j
cases a <;> cases y <;> simp only [observedAffineMass, obsSign, signVal,
Bool.false_eq_true, ↓reduceIte, one_mul, neg_one_mul] <;>
apply div_nonneg <;> linarith [hj.1, hj.2]
theorem iidAffineMass_nonneg
Assume the stated htheta condition. The product mass of an iid observed-record vector is nonnegative on the cube. [](.
Formal statement
hypotheses
conclusion
0 ≤ iidAffineMass theta o
Proof (Lean source)
-- @node: iidAffineMass_nonneg
lemma iidAffineMass_nonneg (theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d)
(o : Fin n → ObsRecord d) : 0 ≤ iidAffineMass theta o := by
exact Finset.prod_nonneg fun i _ => observedAffineMass_nonneg theta htheta (o i)
theorem measurable_canonicalTranscriptDensity
A finite sum of jointly measurable row densities with affine weights is measurable when the row-density family is measurable.
Formal statement
hypotheses
n :
ℕ
f :
hf :
conclusion
Proof (Lean source)
-- @node: measurable_canonicalTranscriptDensity
@[fun_prop] lemma measurable_canonicalTranscriptDensity
(f : ((Fin n → ObsRecord d) × Q.Seed) × ProtocolTranscript Q → ℝ)
(hf : Measurable f) : Measurable (canonicalTranscriptDensity f) := by
apply Finset.measurable_sum
intro o ho
apply mul
· apply Finset.measurable_prod
intro i hi
unfold observedAffineMass
fun_prop
· exact hf.comp (by fun_prop)
theorem observedAffineMass_eq_real
Assume the stated htheta condition and positive dimension. The explicit affine mass equals the observed symmetric-law singleton probability.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: observedAffineMass_eq_real
lemma observedAffineMass_eq_real (theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d)
(hd : 0 < d) (o : ObsRecord d) :
observedAffineMass theta o = (observedLaw (symmetricLaw theta)).real {o} := by
have h := symmetricLaw_observed_recover_real theta htheta (signedObserve o) o.2.1
rw [recoverObs_signedObserve] at h
rw [h]
unfold pairedLaw
rw [atomLaw_real_event]
· rcases o with ⟨j, a, y⟩
cases a <;> cases y <;>
simp [observedAffineMass, signedObserve, signVal, obsSign] <;> ring
· intro v
have hv := htheta v.1
apply div_nonneg _ (by positivity)
cases v.2 <;> simp only [signVal, Bool.false_eq_true, ↓reduceIte] <;>
linarith [hv.1, hv.2]
theorem fixedTranscriptLaw_absolutelyContinuous_reference
Assume positive dimension. Every fixed-record transcript row is dominated by the zero-contrast transcript law.
Formal statement
hypotheses
conclusion
fixedTranscriptLaw Q o r ≪ referenceLaw Q r
Proof (Lean source)
-- @node: fixedTranscriptLaw_absolutelyContinuous_reference
lemma fixedTranscriptLaw_absolutelyContinuous_reference
(Q : LocalProtocol n (ObsRecord d)) (o : Fin n → ObsRecord d) (r : Q.Seed)
(hd : 0 < d) : fixedTranscriptLaw Q o r ≪ referenceLaw Q r := by
have hcube : (fun _ : Fin d => (0 : ℝ)) ∈ parameterCube d := by
intro j; constructor <;> norm_num
haveI := symmetricLaw_probability (fun _ : Fin d => 0) hcube hd
haveI : IsProbabilityMeasure (observedLaw (symmetricLaw (fun _ : Fin d => 0))) :=
Measure.isProbabilityMeasure_map (by fun_prop)
let nu : Measure (Fin n → ObsRecord d) :=
Measure.pi (fun _ : Fin n => observedLaw (symmetricLaw (fun _ : Fin d => 0)))
have hpos : ∀ x : Fin n → ObsRecord d, nu {x} ≠ 0 := by
intro x
dsimp [nu]
rw [Measure.pi_singleton]
exact Finset.prod_ne_zero_iff.mpr fun i _ => observed_symmetric_zero_atom hd (x i)
have hac := finite_bind_absolutelyContinuous (Measure.dirac o) nu
(fun x => fixedTranscriptLaw Q x r) (by fun_prop) hpos
rw [Measure.dirac_bind (by fun_prop)] at hac
simpa [referenceLaw, conditionalTranscriptLaw, nu] using hac
theorem nonnegative_real_kernel_density_of_gate Lemma nonnegative_real_kernel_density_of_gate in the paper ↗
Assume measurable Radon–Nikodym densities for dominated kernels and the stated absolute-continuity property. The kernel RN gate admits a jointly measurable everywhere-nonnegative real density version.
Formal statement
hypotheses
H Z :
K L :
hac :
∀ h, K h ≪ L h
conclusion
∃ f : H × Z → ℝ,
conclusion 1
w :
0 ≤ f w
Proof (Lean source)
-- @node: nonnegative_real_kernel_density_of_gate
lemma nonnegative_real_kernel_density_of_gate (hRN : MeasurableKernelRadonNikodym)
{H Z : Type} [MeasurableSpace H] [MeasurableSpace Z] [StandardBorelSpace Z]
(K L : Kernel H Z) [IsMarkovKernel K] [IsMarkovKernel L]
(hac : ∀ h, K h ≪ L h) :
∃ f : H × Z → ℝ, Measurable f ∧ (∀ w, 0 ≤ f w) ∧ ∀ h,
(L h).withDensity (fun z => ofReal (f (h,z))) = K h := by
obtain ⟨g, hg, hrep⟩ := hRN K L hac
refine ⟨fun w => (g w).toReal, hg.ennreal_toReal, fun w => ENNReal.toReal_nonneg, ?_⟩
intro h
have hfin : (∫⁻ z, g (h,z) ∂L h) < ∞ := by
have hu := hrep h univ MeasurableSet.univ
rw [setLIntegral_univ] at hu
rw [← hu]
exact measure_lt_top _ _
have hae : ∀ᵐ z ∂L h, g (h,z) ≠ ∞ :=
(ae_lt_top (show Measurable (fun z => g (h,z)) by fun_prop) hfin.ne).mono
(fun z hz => hz.ne)
ext E hE
rw [withDensity_apply _ hE, hrep h E hE]
apply lintegral_congr_ae
filter_upwards [ae_restrict_of_ae hae] with z hz
exact ENNReal.ofReal_toReal hz
theorem fixedTranscript_row_densities_of_gate
Assume measurable Radon–Nikodym densities for dominated kernels and positive dimension. The RN gate supplies nonnegative densities for all fixed-record transcript rows at once.
Formal statement
hypotheses
conclusion
conclusion 1
w :
0 ≤ f w
conclusion 2
o r :
(referenceLaw Q r).withDensity (fun z => ofReal (f ((o, r), z)))
= fixedTranscriptLaw Q o r
Proof (Lean source)
-- @node: fixedTranscript_row_densities_of_gate
lemma fixedTranscript_row_densities_of_gate
(hRN_of_gate : MeasurableKernelRadonNikodym)
(Q : LocalProtocol n (ObsRecord d)) (hd : 0 < d) :
∃ f : ((Fin n → ObsRecord d) × Q.Seed) × ProtocolTranscript Q → ℝ,
Measurable f ∧ (∀ w, 0 ≤ f w) ∧ ∀ o r,
(referenceLaw Q r).withDensity (fun z => ofReal (f ((o, r), z))) =
fixedTranscriptLaw Q o r := by
let K : Kernel ((Fin n → ObsRecord d) × Q.Seed) (ProtocolTranscript Q) :=
⟨fun w => fixedTranscriptLaw Q w.1 w.2, by fun_prop⟩
let L : Kernel ((Fin n → ObsRecord d) × Q.Seed) (ProtocolTranscript Q) :=
⟨fun w => referenceLaw Q w.2, by
have hm := (measurable_conditionalTranscriptLaw_clipped Q hd).comp
(show Measurable (fun w : (Fin n → ObsRecord d) × Q.Seed =>
((fun _ : Fin d => (0 : ℝ)), w.2)) by fun_prop)
have hzero : densityCubeClamp (fun _ : Fin d => (0 : ℝ)) = fun _ => 0 :=
densityCubeClamp_eq _ (by intro j; constructor <;> norm_num)
simpa only [Function.comp_def, hzero, referenceLaw] using hm⟩
haveI : IsMarkovKernel K := ⟨fun w =>
isProbabilityMeasure_transcriptLaw
Q.kernels Q.markov (fun i => (w.1 i, w.2))⟩
haveI : IsMarkovKernel L := ⟨fun w =>
conditionalTranscriptLaw_probability Q _
(by intro j; constructor <;> norm_num) hd w.2⟩
haveI : StandardBorelSpace (ProtocolTranscript Q) := by
unfold ProtocolTranscript Transcript
History
infer_instance
simpa [K, L] using nonnegative_real_kernel_density_of_gate hRN_of_gate K L
(fun w => fixedTranscriptLaw_absolutelyContinuous_reference Q w.1 w.2 hd)
theorem iidAffineMass_ofReal
Assume the stated htheta condition and positive dimension. The extended-real iid affine mass is the product-law singleton mass on the cube.
Formal statement
hypotheses
conclusion
ofReal (iidAffineMass theta o)
= Measure.pi (fun _ : Fin n => observedLaw (symmetricLaw theta)) {o}
Proof (Lean source)
-- @node: iidAffineMass_ofReal
lemma iidAffineMass_ofReal (theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d)
(hd : 0 < d) (o : Fin n → ObsRecord d) :
ofReal (iidAffineMass theta o) =
Measure.pi (fun _ : Fin n => observedLaw (symmetricLaw theta)) {o} := by
haveI := symmetricLaw_probability theta htheta hd
haveI : IsProbabilityMeasure (observedLaw (symmetricLaw theta)) :=
Measure.isProbabilityMeasure_map (by fun_prop)
rw [Measure.pi_singleton, iidAffineMass,
ENNReal.ofReal_prod_of_nonneg (fun i _ => observedAffineMass_nonneg theta htheta (o i))]
apply Finset.prod_congr rfl
intro i hi
rw [observedAffineMass_eq_real theta htheta hd]
exact ENNReal.ofReal_toReal (measure_ne_top _ _)
theorem conditionalTranscriptLaw_eq_sum_rows
Assume the stated htheta condition and positive dimension. The conditional transcript law is the finite affine mixture of fixed-record rows.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
theta :
Fin d → ℝ
htheta :
theta ∈ parameterCube d
hd :
0 < d
r :
Q.Seed
conclusion
conditionalTranscriptLaw Q theta r
Proof (Lean source)
-- @node: conditionalTranscriptLaw_eq_sum_rows
lemma conditionalTranscriptLaw_eq_sum_rows (Q : LocalProtocol n (ObsRecord d))
(theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d) (hd : 0 < d) (r : Q.Seed) :
conditionalTranscriptLaw Q theta r =
∑ o : Fin n → ObsRecord d,
ofReal (iidAffineMass theta o) • fixedTranscriptLaw Q o r := by
haveI := symmetricLaw_probability theta htheta hd
haveI : IsProbabilityMeasure (observedLaw (symmetricLaw theta)) :=
Measure.isProbabilityMeasure_map (by fun_prop)
ext E hE
rw [conditionalTranscriptLaw, Measure.bind_apply hE
(show Measurable (fun o => fixedTranscriptLaw Q o r) by fun_prop).aemeasurable,
lintegral_fintype]
simp only [Measure.finsetSum_apply, Measure.smul_apply, smul_eq_mul]
apply Finset.sum_congr rfl
intro o ho
rw [iidAffineMass_ofReal theta htheta hd]
exact mul_comm _ _
theorem canonicalTranscriptDensity_nonneg
Assume the function hf and the stated htheta condition. Nonnegative fixed-row densities give a nonnegative canonical transcript density.
Formal statement
hypotheses
n :
ℕ
f :
hf :
∀ o r z, 0 ≤ f ((o, r), z)
theta :
Fin d → ℝ
htheta :
theta ∈ parameterCube d
r :
Q.Seed
z :
conclusion
0 ≤ canonicalTranscriptDensity f (theta, r, z)
Proof (Lean source)
-- @node: canonicalTranscriptDensity_nonneg
lemma canonicalTranscriptDensity_nonneg
(f : ((Fin n → ObsRecord d) × Q.Seed) × ProtocolTranscript Q → ℝ)
(hf : ∀ o r z, 0 ≤ f ((o, r), z))
(theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d)
(r : Q.Seed) (z : ProtocolTranscript Q) :
0 ≤ canonicalTranscriptDensity f (theta, r, z) := by
apply Finset.sum_nonneg
intro o ho
exact mul_nonneg (iidAffineMass_nonneg theta htheta o) (hf o r z)
theorem canonicalTranscriptDensity_withDensity
Assume measurability of f, the function hf0, the function hrep, the stated htheta condition, and positive dimension. The canonical finite-sum density represents the conditional transcript law.
Formal statement
hypotheses
n :
ℕ
f :
hf :
hf0 :
∀ o r z, 0 ≤ f ((o, r), z)
hrep :
theta :
Fin d → ℝ
htheta :
theta ∈ parameterCube d
hd :
0 < d
r :
Q.Seed
conclusion
= conditionalTranscriptLaw Q theta r
Proof (Lean source)
-- @node: canonicalTranscriptDensity_withDensity
lemma canonicalTranscriptDensity_withDensity
(f : ((Fin n → ObsRecord d) × Q.Seed) × ProtocolTranscript Q → ℝ)
(hf : Measurable f) (hf0 : ∀ o r z, 0 ≤ f ((o, r), z))
(hrep : ∀ o r,
(referenceLaw Q r).withDensity (fun z => ofReal (f ((o, r), z))) =
fixedTranscriptLaw Q o r)
(theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d) (hd : 0 < d) (r : Q.Seed) :
(referenceLaw Q r).withDensity
(fun z => ofReal (canonicalTranscriptDensity f (theta, r, z))) =
conditionalTranscriptLaw Q theta r := by
rw [conditionalTranscriptLaw_eq_sum_rows Q theta htheta hd r]
ext E hE
rw [withDensity_apply _ hE]
simp only [Measure.finsetSum_apply, Measure.smul_apply, smul_eq_mul]
have hpoint (z : ProtocolTranscript Q) :
ofReal (canonicalTranscriptDensity f (theta, r, z)) =
∑ o, ofReal (iidAffineMass theta o) *
ofReal (f ((o, r), z)) := by
rw [canonicalTranscriptDensity,
ENNReal.ofReal_sum_of_nonneg (fun o _ => mul_nonneg
(iidAffineMass_nonneg theta htheta o) (hf0 o r z))]
apply Finset.sum_congr rfl
intro o ho
rw [ENNReal.ofReal_mul (iidAffineMass_nonneg theta htheta o)]
simp_rw [hpoint]
rw [lintegral_finsetSum univ]
· apply Finset.sum_congr rfl
intro o ho
have hfr : Measurable (fun z : ProtocolTranscript Q => f ((o, r), z)) :=
hf.comp (show Measurable (fun z : ProtocolTranscript Q => ((o, r), z)) by fun_prop)
rw [lintegral_const_mul _ hfr.ennreal_ofReal]
have hh := congrArg (fun mu : Measure (ProtocolTranscript Q) => mu E) (hrep o r)
rw [withDensity_apply _ hE] at hh
exact congrArg (fun x => ofReal (iidAffineMass theta o) * x) hh
· intro o ho
have hfr : Measurable (fun z : ProtocolTranscript Q => f ((o, r), z)) :=
hf.comp (show Measurable (fun z : ProtocolTranscript Q => ((o, r), z)) by fun_prop)
exact measurable_const.mul hfr.ennreal_ofReal
theorem observedAffineMass_update
Updating one coordinate writes each observed-record mass as an affine function. [](.
Formal statement
hypotheses
conclusion
observedAffineMass (update theta j x) o
= observedAffineMass (update theta j 0) o
+ (if o.1 = j then obsSign o / (4 * d) else 0) * x
Proof (Lean source)
-- @node: observedAffineMass_update
lemma observedAffineMass_update (theta : Fin d → ℝ) (o : ObsRecord d) (j : Fin d) (x : ℝ) :
observedAffineMass (update theta j x) o =
observedAffineMass (update theta j 0) o +
(if o.1 = j then obsSign o / (4 * d) else 0) * x := by
by_cases h : o.1 = j
· subst j
simp [observedAffineMass]
ring
· simp [observedAffineMass, h]
theorem iidAffineMass_coordinate_polynomial
Every iid observed-vector mass has degree at most the sample size in one coordinate. [](.
Formal statement
Proof (Lean source)
-- @node: iidAffineMass_coordinate_polynomial
lemma iidAffineMass_coordinate_polynomial (theta : Fin d → ℝ)
(o : Fin n → ObsRecord d) (j : Fin d) :
∃ coeff : Fin (n + 1) → ℝ, ∀ x : ℝ,
iidAffineMass (update theta j x) o = ∑ k, coeff k * x ^ k.val := by
let factors : Fin n → Polynomial ℝ := fun i =>
C (observedAffineMass (update theta j 0) (o i)) +
C (if (o i).1 = j then obsSign (o i) / (4 * d) else 0) * Polynomial.X
let P : Polynomial ℝ := ∏ i, factors i
have hdeg : P.natDegree < n + 1 := by
apply Nat.lt_succ_of_le
calc
P.natDegree ≤ ∑ i : Fin n, (factors i).natDegree :=
Polynomial.natDegree_prod_le Finset.univ factors
_ ≤ ∑ _i : Fin n, 1 := by
apply Finset.sum_le_sum
intro i hi
exact (Polynomial.natDegree_add_le _ _).trans
(max_le (by simp) ((Polynomial.natDegree_mul_le (p := C
(if (o i).1 = j then obsSign (o i) / (4 * d) else 0))
(q := Polynomial.X)).trans (by simp)))
_ = n := by simp
refine ⟨fun k => P.coeff k, ?_⟩
intro x
have hsum : (∑ k : Fin (n + 1), P.coeff k.val * x ^ k.val) = P.eval x := by
rw [Fin.sum_univ_eq_sum_range (fun i => P.coeff i * x ^ i) (n + 1)]
exact (Polynomial.eval_eq_sum_range' hdeg x).symm
rw [hsum]
simp only [P, factors, Polynomial.eval_prod, Polynomial.eval_add, Polynomial.eval_C,
Polynomial.eval_mul, Polynomial.eval_X]
apply Finset.prod_congr rfl
intro i hi
rw [observedAffineMass_update]
theorem canonicalTranscriptDensity_coordinate_polynomial
A canonical finite-sum transcript density has degree at most the sample size coordinatewise. [](.
Formal statement
hypotheses
conclusion
∃ coeff : Fin (n + 1) → ℝ,
∀ x : ℝ,
canonicalTranscriptDensity f (update theta j x, r, z) = ∑ k, coeff k * x ^ k.val
Proof (Lean source)
-- @node: canonicalTranscriptDensity_coordinate_polynomial
lemma canonicalTranscriptDensity_coordinate_polynomial
(f : ((Fin n → ObsRecord d) × Q.Seed) × ProtocolTranscript Q → ℝ)
(theta : Fin d → ℝ) (r : Q.Seed) (z : ProtocolTranscript Q) (j : Fin d) :
∃ coeff : Fin (n + 1) → ℝ, ∀ x : ℝ,
canonicalTranscriptDensity f (update theta j x, r, z) =
∑ k, coeff k * x ^ k.val := by
choose c hc using fun o : Fin n → ObsRecord d =>
iidAffineMass_coordinate_polynomial theta o j
refine ⟨fun k => ∑ o, c o k * f ((o, r), z), ?_⟩
intro x
simp only [canonicalTranscriptDensity]
simp_rw [hc]
calc
(∑ o, (∑ k, c o k * x ^ k.val) * f ((o, r), z)) =
∑ o, ∑ k, c o k * x ^ k.val * f ((o, r), z) := by
apply Finset.sum_congr rfl
intro o ho
rw [Finset.sum_mul]
_ =
∑ o, ∑ k, (c o k * f ((o, r), z)) * x ^ k.val := by
apply Finset.sum_congr rfl
intro o ho
apply Finset.sum_congr rfl
intro k hk
ring
_ = ∑ k, ∑ o, (c o k * f ((o, r), z)) * x ^ k.val := by
rw [Finset.sum_comm]
_ = ∑ k, (∑ o, c o k * f ((o, r), z)) * x ^ k.val := by
apply Finset.sum_congr rfl
intro k hk
rw [Finset.sum_mul]
theorem canonical_density_polynomial_of_gate
Assume measurable Radon–Nikodym densities for dominated kernels and positive dimension. The RN gate yields a canonical measurable, nonnegative, coordinate-polynomial density version.
Formal statement
hypotheses
conclusion
∃ p : (Fin d → ℝ) × Q.Seed × ProtocolTranscript Q → ℝ,
conclusion 1
theta ∈ parameterCube d :
r :
z :
0 ≤ p (theta, r, z)
(referenceLaw Q r).withDensity (fun z => ofReal (p (theta, r, z)))
= conditionalTranscriptLaw Q theta r
Proof (Lean source)
-- @node: canonical_density_polynomial_of_gate
lemma canonical_density_polynomial_of_gate
(hRN_of_gate : MeasurableKernelRadonNikodym)
(Q : LocalProtocol n (ObsRecord d)) (hd : 0 < d) :
∃ p : (Fin d → ℝ) × Q.Seed × ProtocolTranscript Q → ℝ,
Measurable p ∧
(∀ theta ∈ parameterCube d, ∀ r,
(∀ z, 0 ≤ p (theta, r, z)) ∧
(referenceLaw Q r).withDensity (fun z => ofReal (p (theta, r, z))) =
conditionalTranscriptLaw Q theta r) ∧
(∀ theta r z j, ∃ coeff : Fin (n + 1) → ℝ,
∀ x : ℝ, p (update theta j x, r, z) = ∑ k, coeff k * x ^ k.val) := by
obtain ⟨f, hf, hf0, hrep⟩ := fixedTranscript_row_densities_of_gate hRN_of_gate Q hd
refine ⟨canonicalTranscriptDensity f, measurable_canonicalTranscriptDensity f hf, ?_, ?_⟩
· intro theta htheta r
exact ⟨fun z => canonicalTranscriptDensity_nonneg f
(fun o r z => hf0 ((o, r), z)) theta htheta r z,
canonicalTranscriptDensity_withDensity f hf (fun o r z => hf0 ((o, r), z))
hrep theta htheta hd r⟩
· exact canonicalTranscriptDensity_coordinate_polynomial f
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Contraction.CanonicalIdentification 9 declarations Countably many density identities identify the entire coordinate polynomial outside one reference-null set.
Simultaneous coordinate identification of transcript densities
Countably many density identities identify the entire coordinate polynomial outside one reference-null set. Thus the canonical finite-sum version and repaired stage product have the same derivatives, including at boundary parameters.
theorem polynomial_family_ae_eq_of_sequence Lemma polynomial_family_ae_eq_of_sequence in the paper ↗
Assume the stated hx condition and the stated heq condition. Equality at an injective sequence identifies measurable families of real polynomials outside one null set, simultaneously at every real argument.
Formal statement
hypotheses
Ω :
Type*
mu :
Measure Ω
P T :
Ω → Polynomial ℝ
x :
ℕ → ℝ
hx :
heq :
∀ m, (fun w => (P w).eval (x m)) =ᵐ[mu] (fun w => (T w).eval (x m))
conclusion
∀ᵐ w ∂mu, ∀ y, (P w).eval y = (T w).eval y
Proof (Lean source)
-- @node: polynomial_family_ae_eq_of_sequence
lemma polynomial_family_ae_eq_of_sequence {Ω : Type*} [MeasurableSpace Ω]
(mu : Measure Ω) (P T : Ω → Polynomial ℝ) (x : ℕ → ℝ)
(hx : Injective x)
(heq : ∀ m, (fun w => (P w).eval (x m)) =ᵐ[mu]
(fun w => (T w).eval (x m))) :
∀ᵐ w ∂mu, ∀ y, (P w).eval y = (T w).eval y := by
filter_upwards [ae_all_iff.mpr heq] with w hw
have hPT : P w = T w := Polynomial.eq_of_infinite_eval_eq _ _
((Set.infinite_range_of_injective hx).mono (by
rintro y ⟨m, rfl⟩
exact hw m))
intro y
rw [hPT]
theorem stageProduct_coordinate_polynomial_eval
A coordinate section of a finite affine stage product is an actual real polynomial, also outside the parameter cube. [](.
Formal statement
hypotheses
conclusion
∃ P : Polynomial ℝ,
∀ x, (∏ i, stageMixtureDensity (update theta j x) (f i)) = P.eval x
Proof (Lean source)
-- @node: stageProduct_coordinate_polynomial_eval
lemma stageProduct_coordinate_polynomial_eval (theta : Fin d → ℝ)
(f : Fin n → PairedSymbol d → ℝ) (j : Fin d) :
∃ P : Polynomial ℝ, ∀ x,
(∏ i, stageMixtureDensity (update theta j x) (f i)) = P.eval x := by
refine ⟨∏ i, (C (stageMixtureDensity (update theta j 0) (f i)) +
C (stageCoordinateSlope (f i) j) * X), ?_⟩
intro x
simp only [Polynomial.eval_prod, Polynomial.eval_add, Polynomial.eval_C,
Polynomial.eval_mul, Polynomial.eval_X]
apply Finset.prod_congr rfl
intro i hi
rw [stageMixtureDensity_update theta, stageMixtureDensity_update theta]
ring
theorem transcript_coordinate_ae_eq_stageProduct
Assume positive dimension, the stated htheta condition, measurability of p, the protocol transcript, the protocol transcript, measurability of f, the stated hf0 condition, and the stated hprod rep condition. Simultaneous coordinate equality of the canonical density and the repaired stage product follows from their density representations. The exceptional set is independent of the coordinate argument, so derivatives may be compared there.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
hd :
0 < d
theta :
Fin d → ℝ
htheta :
theta ∈ parameterCube d
r :
Q.Seed
j :
Fin d
p :
(Fin d → ℝ) × Q.Seed × ProtocolTranscript Q → ℝ
hp :
hpRep :
∀ t ∈ parameterCube d,
(∀ z, 0 ≤ p (t, r, z)) ∧
(referenceLaw Q r).withDensity (fun z => ofReal (p (t, r, z)))
= conditionalTranscriptLaw Q t r
f :
hf :
∀ i, Measurable (f i)
hf0 :
∀ i w, 0 ≤ f i w
hprodRep :
∀ t ∈ parameterCube d,
(referenceLaw Q r).withDensity (fun z => ofReal (∏ i, stageMixtureDensity t (fun a => f i (((a, r), take (le_of_lt i.isLt) z), z i))))
= conditionalTranscriptLaw Q t r
conclusion
∀ᵐ z ∂referenceLaw Q r, ∀ x, p (update theta j x, r, z)
= ∏ i, stageMixtureDensity (update theta j x) (fun a => f i (((a, r), take (le_of_lt i.isLt) z), z i))
Proof (Lean source)
-- @node: transcript_coordinate_ae_eq_stageProduct
lemma transcript_coordinate_ae_eq_stageProduct
(Q : LocalProtocol n (ObsRecord d)) (hd : 0 < d)
(theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d)
(r : Q.Seed) (j : Fin d)
(p : (Fin d → ℝ) × Q.Seed × ProtocolTranscript Q → ℝ)
(hp : Measurable p)
(hpRep : ∀ t ∈ parameterCube d,
(∀ z, 0 ≤ p (t, r, z)) ∧
(referenceLaw Q r).withDensity (fun z => ofReal (p (t, r, z))) =
conditionalTranscriptLaw Q t r)
(hpoly : ∀ z, ∃ c : Fin (n + 1) → ℝ, ∀ x,
p (update theta j x, r, z) = ∑ q, c q * x ^ q.val)
(f : (i : Fin n) →
((PairedSymbol d × Q.Seed) × ProtocolHistory Q i) × Q.Message i → ℝ)
(hf : ∀ i, Measurable (f i)) (hf0 : ∀ i w, 0 ≤ f i w)
(hprodRep : ∀ t ∈ parameterCube d,
(referenceLaw Q r).withDensity (fun z => ofReal
(∏ i, stageMixtureDensity t
(fun a => f i (((a, r), take (le_of_lt i.isLt) z), z i)))) =
conditionalTranscriptLaw Q t r) :
∀ᵐ z ∂referenceLaw Q r, ∀ x,
p (update theta j x, r, z) =
∏ i, stageMixtureDensity (update theta j x)
(fun a => f i (((a, r), take (le_of_lt i.isLt) z), z i)) := by
classical
haveI : IsProbabilityMeasure (referenceLaw Q r) :=
conditionalTranscriptLaw_probability Q _ (by intro a; constructor <;> norm_num) hd r
choose c hc using hpoly
let P : ProtocolTranscript Q → Polynomial ℝ := fun z =>
∑ q : Fin (n + 1), C (c z q) * X ^ q.val
have hP (z : ProtocolTranscript Q) (x : ℝ) :
p (update theta j x, r, z) = (P z).eval x := by
rw [hc]
simp only [P, Polynomial.eval_finsetSum, Polynomial.eval_mul,
Polynomial.eval_C, Polynomial.eval_pow, Polynomial.eval_X]
choose T hT using fun z : ProtocolTranscript Q =>
stageProduct_coordinate_polynomial_eval theta
(fun i a => f i (((a, r), take (le_of_lt i.isLt) z), z i)) j
let x : ℕ → ℝ := fun m => 1 / ((m : ℝ) + 2)
have hx : Injective x := by
intro a b hab
have h : (a : ℝ) + 2 = (b : ℝ) + 2 := by
apply inv_injective
simpa [x, one_div] using hab
exact_mod_cast (show (a : ℝ) = (b : ℝ) by linarith)
have hcube (m : ℕ) : update theta j (x m) ∈ parameterCube d := by
intro a
by_cases ha : a = j
· subst a
rw [Function.update_self]
have hm : (0 : ℝ) ≤ m := Nat.cast_nonneg _
dsimp [x]
constructor
· have : 0 ≤ 1 / ((m : ℝ) + 2) := by positivity
linarith
· apply (div_le_iff₀ (by positivity)).mpr
linarith
· rw [Function.update_of_ne ha]
exact htheta a
have heq (m : ℕ) : (fun z => (P z).eval (x m)) =ᵐ[referenceLaw Q r]
(fun z => (T z).eval (x m)) := by
let t := update theta j (x m)
have ht : t ∈ parameterCube d := hcube m
have hM := (measurable_originalTranscript_stageProduct Q f hf).comp
(show Measurable (fun z : ProtocolTranscript Q => (t, r, z)) by fun_prop)
have hmu := (hpRep t ht).2.trans (hprodRep t ht).symm
have hae := (withDensity_eq_iff_of_sigmaFinite
((hp.comp (show Measurable (fun z : ProtocolTranscript Q => (t, r, z))
by fun_prop)).ennreal_ofReal.aemeasurable)
hM.ennreal_ofReal.aemeasurable).mp hmu
filter_upwards [hae] with z hz
have h0 : 0 ≤ ∏ i : Fin n, stageMixtureDensity t
(fun a => f i (((a, r), take (le_of_lt i.isLt) z), z i)) := by
apply Finset.prod_nonneg
intro i hi
apply Finset.sum_nonneg
intro a ha
exact mul_nonneg (stageInputWeight_nonneg t ht a) (hf0 i _)
have hreal := (ENNReal.ofReal_eq_ofReal_iff ((hpRep t ht).1 z) h0).mp hz
rw [← hP, ← hT]
exact hreal
filter_upwards [polynomial_family_ae_eq_of_sequence (referenceLaw Q r) P T x hx heq]
with z hz
intro y
rw [hP, hT, hz]
theorem densityDerivative_ae_eq_of_coordinate_identity
Assume the protocol transcript. All orders of coordinate differentiation preserve the simultaneous canonical-to-product identity. No differentiation of a parameter-dependent null set is used.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
p :
(Fin d → ℝ) × Q.Seed × ProtocolTranscript Q → ℝ
g :
ℝ → ProtocolTranscript Q → ℝ
theta :
Fin d → ℝ
r :
Q.Seed
j :
Fin d
heq :
∀ᵐ z ∂referenceLaw Q r, ∀ x, p (update theta j x, r, z) = g x z
conclusion
∀ᵐ z ∂referenceLaw Q r, ∀ k, densityDerivative p theta r z j k
= iteratedDeriv k (fun x => g x z) (theta j)
Proof (Lean source)
-- @node: densityDerivative_ae_eq_of_coordinate_identity
lemma densityDerivative_ae_eq_of_coordinate_identity
(Q : LocalProtocol n (ObsRecord d))
(p : (Fin d → ℝ) × Q.Seed × ProtocolTranscript Q → ℝ)
(g : ℝ → ProtocolTranscript Q → ℝ)
(theta : Fin d → ℝ) (r : Q.Seed) (j : Fin d)
(heq : ∀ᵐ z ∂referenceLaw Q r, ∀ x,
p (update theta j x, r, z) = g x z) :
∀ᵐ z ∂referenceLaw Q r, ∀ k,
densityDerivative p theta r z j k = iteratedDeriv k (fun x => g x z) (theta j) := by
filter_upwards [heq] with z hz
intro k
unfold densityDerivative
rw [show (fun x => p (update theta j x, r, z)) = (fun x => g x z)
from funext hz]
theorem finite_stageProduct_coordinateDerivative_score
Assume the stated hpos condition. The elementary score formula for a finite stage family uses zero scores past the transcript horizon.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
theta :
Fin d → ℝ
f :
Fin n → PairedSymbol d → ℝ
j :
Fin d
hpos :
∀ i, 0 < stageMixtureDensity theta (f i)
k :
ℕ
conclusion
= (k.factorial : ℝ) * (∏ i : Fin n, stageMixtureDensity theta (f i)) * scoreElementary (fun i => if hi : i < n then stageCoordinateSlope (f ⟨i, hi⟩) j / stageMixtureDensity theta (f ⟨i, hi⟩) else 0) n k
Proof (Lean source)
-- @node: finite_stageProduct_coordinateDerivative_score
lemma finite_stageProduct_coordinateDerivative_score
(theta : Fin d → ℝ) (f : Fin n → PairedSymbol d → ℝ) (j : Fin d)
(hpos : ∀ i, 0 < stageMixtureDensity theta (f i)) (k : ℕ) :
iteratedDeriv k (fun x => ∏ i : Fin n,
stageMixtureDensity (update theta j x) (f i)) (theta j) =
(k.factorial : ℝ) * (∏ i : Fin n, stageMixtureDensity theta (f i)) *
scoreElementary (fun i => if hi : i < n then
stageCoordinateSlope (f ⟨i, hi⟩) j / stageMixtureDensity theta (f ⟨i, hi⟩)
else 0) n k := by
classical
let rows : ℕ → PairedSymbol d → ℝ := fun i => if hi : i < n then f ⟨i, hi⟩ else 0
have hprod (t : Fin d → ℝ) : (∏ i : Fin n, stageMixtureDensity t (f i)) =
∏ i ∈ range n, stageMixtureDensity t (rows i) := by
rw [Finset.prod_fin_eq_prod_range]
apply Finset.prod_congr rfl
intro i hi
simp only [Finset.mem_range] at hi
simp [rows, hi]
have hxi : (fun i => stageCoordinateSlope (rows i) j /
stageMixtureDensity theta (rows i)) =
(fun i => if hi : i < n then stageCoordinateSlope (f ⟨i, hi⟩) j /
stageMixtureDensity theta (f ⟨i, hi⟩) else 0) := by
funext i
by_cases hi : i < n
· simp [rows, hi]
· simp [rows, hi, stageCoordinateSlope]
simp_rw [hprod]
rw [stageProduct_coordinateDerivative_score theta rows j n k
(by intro i hi; simpa [rows, hi] using hpos ⟨i, hi⟩), hxi]
theorem canonical_densityDerivative_ae_score
Assume the stated hpos condition and the stated heq condition. The canonical density has the exact factorial-times-density-times-elementary score identity almost everywhere, simultaneously in the derivative order.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
p :
(Fin d → ℝ) × Q.Seed × ProtocolTranscript Q → ℝ
theta :
Fin d → ℝ
r :
Q.Seed
j :
Fin d
f :
hpos :
∀ z i, 0 < stageMixtureDensity theta (f z i)
heq :
∀ᵐ z ∂referenceLaw Q r, ∀ x, p (update theta j x, r, z)
conclusion
∀ᵐ z ∂referenceLaw Q r, ∀ k, densityDerivative p theta r z j k
= (k.factorial : ℝ) * p (theta, r, z) * scoreElementary (fun i => if hi : i < n then stageCoordinateSlope (f z ⟨i, hi⟩) j / stageMixtureDensity theta (f z ⟨i, hi⟩) else 0) n k
Proof (Lean source)
-- @node: canonical_densityDerivative_ae_score
lemma canonical_densityDerivative_ae_score
(Q : LocalProtocol n (ObsRecord d))
(p : (Fin d → ℝ) × Q.Seed × ProtocolTranscript Q → ℝ)
(theta : Fin d → ℝ) (r : Q.Seed) (j : Fin d)
(f : ProtocolTranscript Q → Fin n → PairedSymbol d → ℝ)
(hpos : ∀ z i, 0 < stageMixtureDensity theta (f z i))
(heq : ∀ᵐ z ∂referenceLaw Q r, ∀ x,
p (update theta j x, r, z) =
∏ i : Fin n, stageMixtureDensity (update theta j x) (f z i)) :
∀ᵐ z ∂referenceLaw Q r, ∀ k,
densityDerivative p theta r z j k = (k.factorial : ℝ) * p (theta, r, z) *
scoreElementary (fun i => if hi : i < n then
stageCoordinateSlope (f z ⟨i, hi⟩) j /
stageMixtureDensity theta (f z ⟨i, hi⟩) else 0) n k := by
have hderiv := densityDerivative_ae_eq_of_coordinate_identity Q p _ theta r j heq
filter_upwards [heq, hderiv] with z hz hdz
intro k
rw [hdz k, finite_stageProduct_coordinateDerivative_score theta (f z) j (hpos z)]
have hpz := hz (theta j)
simp only [Function.update_eq_self] at hpz
rw [← hpz]
theorem canonical_densityDerivative_integral_abs_score
Assume measurability of p, the stated hp0 condition, the stated hrep condition, the stated hpos condition, and the stated heq condition. The canonical derivative L1 integral is exactly the score first moment under the original parameter-specific transcript law. This identifies the measure needed for the adaptive martingale bound.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
p :
(Fin d → ℝ) × Q.Seed × ProtocolTranscript Q → ℝ
hp :
theta :
Fin d → ℝ
r :
Q.Seed
j :
Fin d
k :
ℕ
hp0 :
∀ z, 0 ≤ p (theta, r, z)
hrep :
(referenceLaw Q r).withDensity (fun z => ofReal (p (theta, r, z)))
= conditionalTranscriptLaw Q theta r
f :
hpos :
∀ z i, 0 < stageMixtureDensity theta (f z i)
heq :
∀ᵐ z ∂referenceLaw Q r, ∀ x, p (update theta j x, r, z)
conclusion
(∫ z, |densityDerivative p theta r z j k| ∂referenceLaw Q r)
= (k.factorial : ℝ) * (∫ z, |scoreElementary (fun i => if hi : i < n then stageCoordinateSlope (f z ⟨i, hi⟩) j / stageMixtureDensity theta (f z ⟨i, hi⟩) else 0) n k| ∂conditionalTranscriptLaw Q theta r)
Proof (Lean source)
-- @node: canonical_densityDerivative_integral_abs_score
lemma canonical_densityDerivative_integral_abs_score
(Q : LocalProtocol n (ObsRecord d))
(p : (Fin d → ℝ) × Q.Seed × ProtocolTranscript Q → ℝ) (hp : Measurable p)
(theta : Fin d → ℝ) (r : Q.Seed) (j : Fin d) (k : ℕ)
(hp0 : ∀ z, 0 ≤ p (theta, r, z))
(hrep : (referenceLaw Q r).withDensity (fun z => ofReal (p (theta, r, z))) =
conditionalTranscriptLaw Q theta r)
(f : ProtocolTranscript Q → Fin n → PairedSymbol d → ℝ)
(hpos : ∀ z i, 0 < stageMixtureDensity theta (f z i))
(heq : ∀ᵐ z ∂referenceLaw Q r, ∀ x,
p (update theta j x, r, z) =
∏ i : Fin n, stageMixtureDensity (update theta j x) (f z i)) :
(∫ z, |densityDerivative p theta r z j k| ∂referenceLaw Q r) =
(k.factorial : ℝ) * (∫ z,
|scoreElementary (fun i => if hi : i < n then
stageCoordinateSlope (f z ⟨i, hi⟩) j /
stageMixtureDensity theta (f z ⟨i, hi⟩) else 0) n k|
∂conditionalTranscriptLaw Q theta r) := by
let E := fun z => scoreElementary (fun i => if hi : i < n then
stageCoordinateSlope (f z ⟨i, hi⟩) j / stageMixtureDensity theta (f z ⟨i, hi⟩)
else 0) n k
have hscore := canonical_densityDerivative_ae_score Q p theta r j f hpos heq
calc
_ = ∫ z, |(k.factorial : ℝ) * p (theta, r, z) * E z| ∂referenceLaw Q r := by
apply integral_congr_ae
filter_upwards [hscore] with z hz
rw [hz k]
_ = (k.factorial : ℝ) * (∫ z, |E z| ∂conditionalTranscriptLaw Q theta r) := by
rw [integral_abs_density_score (referenceLaw Q r) (fun z => p (theta, r, z))
E _ (hp.comp (by fun_prop)) hp0 (k.factorial : ℝ) (by positivity)
(fun _ => rfl), hrep]
theorem canonical_stageProduct_coordinate_identification_of_gate
Assume measurable Radon–Nikodym densities for dominated kernels, positive dimension, a nonnegative privacy budget, and sequential local privacy of the protocol. The RN gate gives canonical finite-sum densities and repaired rows whose coordinate sections agree simultaneously outside one reference-null set. This certifies the identification needed before applying the martingale score bound.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
hd :
0 < d
eps :
ℝ
heps :
0 ≤ eps
hQ :
SequentialClass Q eps
conclusion
∃ p : (Fin d → ℝ) × Q.Seed × ProtocolTranscript Q → ℝ,
conclusion 4
i a r eta :
(stageReferenceKernel Q i (r, eta)).withDensity (fun z => ofReal (f i (((a, r), eta), z)))
= averagedKernel Q i ((a, r), eta)
conclusion 6
theta ∈ parameterCube d :
r :
(referenceLaw Q r).withDensity (fun z => ofReal (∏ i : Fin n, stageMixtureDensity theta (fun a => f i (((a, r), take (le_of_lt i.isLt) z), z i))))
= conditionalTranscriptLaw Q theta r
conclusion 7
theta ∈ parameterCube d :
r :
z :
0 ≤ p (theta, r, z)
(referenceLaw Q r).withDensity (fun z => ofReal (p (theta, r, z)))
= conditionalTranscriptLaw Q theta r
conclusion 8
theta r z j :
Proof (Lean source)
-- @node: canonical_stageProduct_coordinate_identification_of_gate
lemma canonical_stageProduct_coordinate_identification_of_gate
(hRN : MeasurableKernelRadonNikodym)
(Q : LocalProtocol n (ObsRecord d)) (hd : 0 < d)
(eps : ℝ) (heps : 0 ≤ eps) (hQ : SequentialClass Q eps) :
∃ p : (Fin d → ℝ) × Q.Seed × ProtocolTranscript Q → ℝ,
∃ f : (i : Fin n) →
((PairedSymbol d × Q.Seed) × ProtocolHistory Q i) × Q.Message i → ℝ,
Measurable p ∧ (∀ i, Measurable (f i)) ∧
(∀ i w, exp (-eps) ≤ f i w ∧ f i w ≤ exp eps) ∧
(∀ i a b r eta z,
f i (((a, r), eta), z) ≤ exp eps * f i (((b, r), eta), z)) ∧
(∀ i a r eta, (stageReferenceKernel Q i (r, eta)).withDensity
(fun z => ofReal (f i (((a, r), eta), z))) =
averagedKernel Q i ((a, r), eta)) ∧
(∀ r, stageReferenceTranscriptLaw Q r = referenceLaw Q r) ∧
(∀ theta ∈ parameterCube d, ∀ r,
(referenceLaw Q r).withDensity (fun z => ofReal
(∏ i : Fin n, stageMixtureDensity theta
(fun a => f i (((a, r), take (le_of_lt i.isLt) z), z i)))) =
conditionalTranscriptLaw Q theta r) ∧
(∀ theta ∈ parameterCube d, ∀ r,
(∀ z, 0 ≤ p (theta, r, z)) ∧
(referenceLaw Q r).withDensity (fun z => ofReal (p (theta, r, z))) =
conditionalTranscriptLaw Q theta r) ∧
(∀ theta r z j, ∃ c : Fin (n + 1) → ℝ, ∀ x,
p (update theta j x, r, z) = ∑ q, c q * x ^ q.val) ∧
∀ theta ∈ parameterCube d, ∀ r j,
∀ᵐ z ∂referenceLaw Q r, ∀ x,
p (update theta j x, r, z) = ∏ i : Fin n,
stageMixtureDensity (update theta j x)
(fun a => f i (((a, r), take (le_of_lt i.isLt) z), z i)) := by
obtain ⟨p, hp, hrep, hpoly⟩ := canonical_density_polynomial_of_gate hRN Q hd
obtain ⟨f, hf, hbound, hsum, hpriv, hrow, href, hprod⟩ :=
originalTranscript_stageProduct_of_gate hRN Q hd eps heps hQ
refine ⟨p, f, hp, hf, hbound, hpriv, hrow, href, hprod, hrep, hpoly, ?_⟩
intro theta htheta r j
exact transcript_coordinate_ae_eq_stageProduct Q hd theta htheta r j p hp
(fun t ht => hrep t ht r) (fun z => hpoly theta r z j) f hf
(fun i w => le_trans (le_of_lt (Real.exp_pos _)) (hbound i w).1)
(fun t ht => hprod t ht r)
theorem density_derivative_of_gate
Assume measurable Radon–Nikodym densities for dominated kernels, sequential local privacy of the protocol, sample size at least two, dimension at least two, and a privacy budget in the interval from zero to one. Full polynomial-density derivative certificate with the RN gate threaded.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
hRN_of_gate :
Q :
LocalProtocol n (ObsRecord d)
eps :
ℝ
hQ :
SequentialClass Q eps
hn :
2 ≤ n
hd :
2 ≤ d
heps :
eps ∈ Ioc 0 1
conclusion
Proof (Lean source)
-- @node: density_derivative_of_gate
lemma density_derivative_of_gate (hRN_of_gate : MeasurableKernelRadonNikodym)
(Q : LocalProtocol n (ObsRecord d)) (eps : ℝ) (hQ : SequentialClass Q eps)
(hn : 2 ≤ n) (hd : 2 ≤ d) (heps : eps ∈ Ioc 0 1) :
∃ p : (Fin d → ℝ) × Q.Seed × ProtocolTranscript Q → ℝ,
DensityCertificate Q eps p := by
obtain ⟨p, f, hp, hf, hbound, hpriv, hrow, href, hprod, hrep, hpoly, hcoord⟩ :=
canonical_stageProduct_coordinate_identification_of_gate hRN_of_gate Q
(by omega) eps (le_of_lt heps.1) hQ
refine ⟨p, hp, hrep, hpoly, ?_, ?_⟩
· intro theta htheta r j k hk hkn
have hpos (z : ProtocolTranscript Q) (i : Fin n) :
0 < stageMixtureDensity theta
(fun a => f i (((a, r), take (le_of_lt i.isLt) z), z i)) :=
(originalTranscript_stageScore_bound Q (by omega) theta htheta eps
(le_of_lt heps.1) f (fun i w => (hbound i w).1) hpriv r z i j).1
rw [canonical_densityDerivative_integral_abs_score Q p hp theta r j k
(hrep theta htheta r).1 (hrep theta htheta r).2
(fun z i a => f i (((a, r), take (le_of_lt i.isLt) z), z i))
hpos (hcoord theta htheta r j)]
have hchain := originalTranscript_eq_parameterChain Q (by omega) theta htheta r
f hf (fun i w => le_trans (le_of_lt (Real.exp_pos _)) (hbound i w).1)
(fun i a eta => hrow i a r eta) (href r) (hprod theta htheta r)
have hfirst := originalTranscript_scoreElementary_firstMoment Q (by omega)
theta htheta r eps (le_of_lt heps.1) f hf hbound hpriv
(fun i a eta => hrow i a r eta) hchain j k
change (∫ z, |scoreElementary (fun v => transcriptCoordinateScore Q theta r f j v z)
n k| ∂conditionalTranscriptLaw Q theta r) ≤ _ at hfirst
calc
_ ≤ (k.factorial : ℝ) *
(sqrt (choose n k) * (derivativeScale d eps)^k) :=
mul_le_mul_of_nonneg_left hfirst (by positivity)
_ = _ := by ring
· exact densityDerivative_eq_zero_of_coordinate_polynomial p hpoly
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Contraction.CanonicalTaylor 5 declarations The finite original-record representation has integrable coordinate coefficients.
Taylor remainders of the canonical transcript density
The finite original-record representation has integrable coordinate coefficients. Its derivative certificate therefore supplies the exact coordinate L1 Taylor remainder needed before moment cancellation and coordinate telescoping.
theorem integrable_fixedTranscript_row_density
Assume measurability of f, the function hf0, and the function hrow. Each nonnegative fixed-record RN density is integrable because its represented transcript law is a probability measure.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
f :
hf :
hf0 :
∀ w, 0 ≤ f w
hrow :
r :
Q.Seed
conclusion
Integrable (fun z => f ((o, r), z)) (referenceLaw Q r)
Proof (Lean source)
-- @node: integrable_fixedTranscript_row_density
lemma integrable_fixedTranscript_row_density (Q : LocalProtocol n (ObsRecord d))
(f : ((Fin n → ObsRecord d) × Q.Seed) × ProtocolTranscript Q → ℝ)
(hf : Measurable f) (hf0 : ∀ w, 0 ≤ f w)
(hrow : ∀ o r, (referenceLaw Q r).withDensity
(fun z => ofReal (f ((o, r), z))) = fixedTranscriptLaw Q o r)
(o : Fin n → ObsRecord d) (r : Q.Seed) :
Integrable (fun z => f ((o, r), z)) (referenceLaw Q r) := by
refine ⟨(hf.comp (by fun_prop)).aestronglyMeasurable, ?_⟩
rw [hasFiniteIntegral_iff_ofReal (Filter.Eventually.of_forall (fun z => hf0 _))]
have h := congrArg (fun mu : Measure (ProtocolTranscript Q) => mu univ) (hrow o r)
rw [withDensity_apply _ MeasurableSet.univ, setLIntegral_univ] at h
rw [h]
have : IsProbabilityMeasure (fixedTranscriptLaw Q o r) :=
isProbabilityMeasure_transcriptLaw
Q.kernels Q.markov (fun i => (o i, r))
exact measure_lt_top _ _
theorem canonicalTranscriptDensity_integrable_coordinate_polynomial
Assume measurability of f, the function hf0, and the function hrow. The canonical density's polynomial coefficients are finite linear combinations of integrable fixed-record row densities.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
f :
hf :
hf0 :
∀ w, 0 ≤ f w
hrow :
theta :
Fin d → ℝ
r :
Q.Seed
j :
Fin d
conclusion
∃ c : Fin (n + 1) → ProtocolTranscript Q → ℝ,
Proof (Lean source)
-- @node: canonicalTranscriptDensity_integrable_coordinate_polynomial
lemma canonicalTranscriptDensity_integrable_coordinate_polynomial
(Q : LocalProtocol n (ObsRecord d))
(f : ((Fin n → ObsRecord d) × Q.Seed) × ProtocolTranscript Q → ℝ)
(hf : Measurable f) (hf0 : ∀ w, 0 ≤ f w)
(hrow : ∀ o r, (referenceLaw Q r).withDensity
(fun z => ofReal (f ((o, r), z))) = fixedTranscriptLaw Q o r)
(theta : Fin d → ℝ) (r : Q.Seed) (j : Fin d) :
∃ c : Fin (n + 1) → ProtocolTranscript Q → ℝ,
(∀ q, Integrable (c q) (referenceLaw Q r)) ∧ ∀ x z,
canonicalTranscriptDensity f (update theta j x, r, z) =
∑ q, c q z * x^q.val := by
classical
choose c hc using fun o : Fin n → ObsRecord d =>
iidAffineMass_coordinate_polynomial theta o j
refine ⟨fun q z => ∑ o, c o q * f ((o, r), z), ?_, ?_⟩
· intro q
exact integrable_finsetSum _ (fun o _ =>
(integrable_fixedTranscript_row_density Q f hf hf0 hrow o r).const_mul _)
· intro x z
simp only [canonicalTranscriptDensity]
simp_rw [hc, Finset.sum_mul]
rw [Finset.sum_comm]
apply Finset.sum_congr rfl
intro q _
apply Finset.sum_congr rfl
intro o _
ring
theorem canonical_density_certificate_rows_of_gate
Assume measurable Radon–Nikodym densities for dominated kernels, sequential local privacy of the protocol, and an admissible sample size, dimension, and privacy budget. The explicitly constructed canonical density has the same adaptive martingale derivative certificate as the existing density version. This retains the finite original-record polynomial as the source of every derivative.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
eps :
ℝ
hQ :
SequentialClass Q eps
hAllowed :
Allowed n d eps
conclusion
conclusion 1
w :
0 ≤ f w
conclusion 2
o r :
(referenceLaw Q r).withDensity (fun z => ofReal (f ((o, r), z)))
= fixedTranscriptLaw Q o r
conclusion 3
DensityCertificate Q eps (canonicalTranscriptDensity f)
Proof (Lean source)
-- @node: canonical_density_certificate_rows_of_gate
lemma canonical_density_certificate_rows_of_gate (hRN : MeasurableKernelRadonNikodym)
(Q : LocalProtocol n (ObsRecord d)) (eps : ℝ) (hQ : SequentialClass Q eps)
(hAllowed : Allowed n d eps) :
∃ f : ((Fin n → ObsRecord d) × Q.Seed) × ProtocolTranscript Q → ℝ,
Measurable f ∧ (∀ w, 0 ≤ f w) ∧
(∀ o r, (referenceLaw Q r).withDensity
(fun z => ofReal (f ((o, r), z))) = fixedTranscriptLaw Q o r) ∧
DensityCertificate Q eps (canonicalTranscriptDensity f) := by
have hd : 0 < d := by have := hAllowed.2.1; omega
have heps : 0 ≤ eps := le_of_lt hAllowed.2.2.1
obtain ⟨f, hf, hf0, hrow⟩ := fixedTranscript_row_densities_of_gate hRN Q hd
let p := canonicalTranscriptDensity f
have hp : Measurable p := measurable_canonicalTranscriptDensity f hf
have hrep : ∀ theta ∈ parameterCube d, ∀ r,
(∀ z, 0 ≤ p (theta, r, z)) ∧
(referenceLaw Q r).withDensity (fun z => ofReal (p (theta, r, z))) =
conditionalTranscriptLaw Q theta r := by
intro theta htheta r
exact ⟨fun z => canonicalTranscriptDensity_nonneg f
(fun o r z => hf0 ((o, r), z)) theta htheta r z,
canonicalTranscriptDensity_withDensity f hf (fun o r z => hf0 ((o, r), z))
hrow theta htheta hd r⟩
have hpoly : ∀ theta r z j, ∃ c : Fin (n + 1) → ℝ, ∀ x,
p (update theta j x, r, z) = ∑ q, c q * x^q.val :=
canonicalTranscriptDensity_coordinate_polynomial f
obtain ⟨g, hg, hbound, hsum, hpriv, hgrow, href, hprod⟩ :=
originalTranscript_stageProduct_of_gate hRN Q hd eps heps hQ
have hcoord (theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d)
(r : Q.Seed) (j : Fin d) : ∀ᵐ z ∂referenceLaw Q r, ∀ x,
p (update theta j x, r, z) = ∏ i : Fin n,
stageMixtureDensity (update theta j x)
(fun a => g i (((a, r), take (le_of_lt i.isLt) z), z i)) :=
transcript_coordinate_ae_eq_stageProduct Q hd theta htheta r j p hp
(fun t ht => hrep t ht r) (fun z => hpoly theta r z j) g hg
(fun i w => le_trans (le_of_lt (Real.exp_pos _)) (hbound i w).1)
(fun t ht => hprod t ht r)
refine ⟨f, hf, hf0, hrow, hp, hrep, hpoly, ?_, ?_⟩
· intro theta htheta r j k hk hkn
have hpos (z : ProtocolTranscript Q) (i : Fin n) :
0 < stageMixtureDensity theta
(fun a => g i (((a, r), take (le_of_lt i.isLt) z), z i)) :=
(originalTranscript_stageScore_bound Q hd theta htheta eps heps g
(fun i w => (hbound i w).1) hpriv r z i j).1
rw [canonical_densityDerivative_integral_abs_score Q p hp theta r j k
(hrep theta htheta r).1 (hrep theta htheta r).2
(fun z i a => g i (((a, r), take (le_of_lt i.isLt) z), z i))
hpos (hcoord theta htheta r j)]
have hchain := originalTranscript_eq_parameterChain Q hd theta htheta r
g hg (fun i w => le_trans (le_of_lt (Real.exp_pos _)) (hbound i w).1)
(fun i a eta => hgrow i a r eta) (href r) (hprod theta htheta r)
have hfirst := originalTranscript_scoreElementary_firstMoment Q hd theta htheta r
eps heps g hg hbound hpriv (fun i a eta => hgrow i a r eta) hchain j k
change (∫ z, |scoreElementary (fun v => transcriptCoordinateScore Q theta r g j v z)
n k| ∂conditionalTranscriptLaw Q theta r) ≤ _ at hfirst
calc
_ ≤ (k.factorial : ℝ) *
(sqrt (choose n k) * (derivativeScale d eps)^k) :=
mul_le_mul_of_nonneg_left hfirst (by positivity)
_ = _ := by ring
· exact densityDerivative_eq_zero_of_coordinate_polynomial p hpoly
theorem canonical_density_coordinate_taylor_L1
Assume a nonnegative privacy budget, measurability of f, the function hf0, the function hrow, the stated hcert condition, the stated htheta condition, the stated hk condition, order no larger than the sample size, amplitude between zero and one half, and the stated hu condition. The canonical density certificate controls each coordinate Taylor remainder uniformly in the other coordinates, transcript seed, and signed amplitude.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
eps :
ℝ
heps :
0 ≤ eps
f :
hf :
hf0 :
∀ w, 0 ≤ f w
hrow :
hcert :
DensityCertificate Q eps (canonicalTranscriptDensity f)
theta :
Fin d → ℝ
htheta :
theta ∈ parameterCube d
r :
Q.Seed
j :
Fin d
k :
ℕ
hk :
1 ≤ k
hkn :
k ≤ n
a u :
ℝ
ha :
a ∈ Ioc 0 (1 / 2 : ℝ)
hu :
u ∈ Icc (-a) a
conclusion
(∫ z, |canonicalTranscriptDensity f (update theta j u, r, z) - ∑ q ∈ range k, densityDerivative (canonicalTranscriptDensity f) (update theta j 0) r z j q / (q.factorial : ℝ) * u^q| ∂referenceLaw Q r)
Proof (Lean source)
-- @node: canonical_density_coordinate_taylor_L1
lemma canonical_density_coordinate_taylor_L1
(Q : LocalProtocol n (ObsRecord d)) (eps : ℝ) (heps : 0 ≤ eps)
(f : ((Fin n → ObsRecord d) × Q.Seed) × ProtocolTranscript Q → ℝ)
(hf : Measurable f) (hf0 : ∀ w, 0 ≤ f w)
(hrow : ∀ o r, (referenceLaw Q r).withDensity
(fun z => ofReal (f ((o, r), z))) = fixedTranscriptLaw Q o r)
(hcert : DensityCertificate Q eps (canonicalTranscriptDensity f))
(theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d) (r : Q.Seed) (j : Fin d)
(k : ℕ) (hk : 1 ≤ k) (hkn : k ≤ n)
(a u : ℝ) (ha : a ∈ Ioc 0 (1 / 2 : ℝ)) (hu : u ∈ Icc (-a) a) :
(∫ z, |canonicalTranscriptDensity f (update theta j u, r, z) -
∑ q ∈ range k,
densityDerivative (canonicalTranscriptDensity f) (update theta j 0) r z j q /
(q.factorial : ℝ) * u^q| ∂referenceLaw Q r) ≤
|u|^k * sqrt (choose n k) * (derivativeScale d eps)^k := by
classical
obtain ⟨c, hc, heval⟩ := canonicalTranscriptDensity_integrable_coordinate_polynomial
Q f hf hf0 hrow theta r j
have hcube (x : ℝ) (hx : x ∈ Icc (-a) a) :
update theta j x ∈ parameterCube d := by
intro b
by_cases hb : b = j
· subst b
simp only [Function.update_self]
constructor <;> linarith [hx.1, hx.2, ha.2]
· rw [Function.update_of_ne hb]
exact htheta b
have hD (x : ℝ) (z : ProtocolTranscript Q) (v : ℕ) :
densityDerivative (canonicalTranscriptDensity f) (update theta j x) r z j v =
iteratedDeriv v (fun t : ℝ => ∑ q, c q z * t^q.val) x := by
simp only [densityDerivative, Function.update_idem, Function.update_self]
rw [show (fun t => canonicalTranscriptDensity f (update theta j t, r, z)) =
(fun t : ℝ => ∑ q, c q z * t^q.val) from funext (fun t => heval t z)]
have hbeta : 0 ≤ derivativeScale d eps := by
unfold derivativeScale
exact div_nonneg (sub_nonneg.mpr (Real.one_le_exp_iff.mpr heps)) (by positivity)
have hbound := finitePolynomial_taylor_remainder_L1 (referenceLaw Q r) (n + 1) c hc
k hk a (sqrt (choose n k) * (derivativeScale d eps)^k) u
(le_of_lt ha.1) hu (by positivity) (fun x hx => by
simpa only [hD, mul_assoc] using hcert.2.2.2.1
(update theta j x) (hcube x hx) r j k hk hkn)
simpa only [densityDerivative, Function.update_idem, Function.update_self, heval, mul_assoc]
using hbound
theorem density_coordinate_taylor_of_gate
Assume measurable Radon–Nikodym densities for dominated kernels, sequential local privacy of the protocol, and an admissible sample size, dimension, and privacy budget. The RN gate supplies a full density certificate together with the exact L1 Taylor remainder required by the moment-mixture argument.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
eps :
ℝ
hQ :
SequentialClass Q eps
hAllowed :
Allowed n d eps
conclusion
∃ p : (Fin d → ℝ) × Q.Seed × ProtocolTranscript Q → ℝ,
DensityCertificate Q eps p
conclusion 1
theta ∈ parameterCube d :
r j k :
1 ≤ k
k ≤ n
a ∈ Set.Ioc 0 (1 / 2 : ℝ) :
u ∈ Set.Icc (-a) a :
(∫ z, |p (update theta j u, r, z) - ∑ q ∈ range k, densityDerivative p (update theta j 0) r z j q / (q.factorial : ℝ) * u^q| ∂referenceLaw Q r)
Proof (Lean source)
-- @node: density_coordinate_taylor_of_gate
lemma density_coordinate_taylor_of_gate (hRN : MeasurableKernelRadonNikodym)
(Q : LocalProtocol n (ObsRecord d)) (eps : ℝ) (hQ : SequentialClass Q eps)
(hAllowed : Allowed n d eps) :
∃ p : (Fin d → ℝ) × Q.Seed × ProtocolTranscript Q → ℝ,
DensityCertificate Q eps p ∧ ∀ theta ∈ parameterCube d, ∀ r j k,
1 ≤ k → k ≤ n → ∀ a ∈ Ioc 0 (1 / 2 : ℝ), ∀ u ∈ Icc (-a) a,
(∫ z, |p (update theta j u, r, z) - ∑ q ∈ range k,
densityDerivative p (update theta j 0) r z j q /
(q.factorial : ℝ) * u^q| ∂referenceLaw Q r) ≤
|u|^k * sqrt (choose n k) * (derivativeScale d eps)^k := by
obtain ⟨f, hf, hf0, hrow, hcert⟩ :=
canonical_density_certificate_rows_of_gate hRN Q eps hQ hAllowed
refine ⟨canonicalTranscriptDensity f, hcert, ?_⟩
intro theta htheta r j k hk hkn a ha u hu
exact canonical_density_coordinate_taylor_L1 Q eps (le_of_lt hAllowed.2.2.1)
f hf hf0 hrow hcert theta htheta r j k hk hkn a u ha hu
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Contraction.Density 17 declarations Finite original-record private value frontiers: Helpers/Contraction/Density.
Helpers/Contraction/Density
Finite original-record private value frontiers: Helpers/Contraction/Density.
def derivativeScale
Fix the dimension and the privacy budget. Coordinate privacy derivative scale.
Definition (Lean source)
def productPrior
Fix the dimension and the probability law nu. Product prior, independent of the public seed.
def conditionalTranscriptLaw
Fix the local protocol Q, the function theta, and the public seed. Fixed-seed transcript law after integrating iid observed records.
Definition (Lean source)
parameters
def
given by
(Measure.pi (fun _ : Fin n => observedLaw (symmetricLaw theta))).bind (fun o => fixedTranscriptLaw Q o r)
def referenceLaw
Fix the local protocol Q and the public seed. Reference transcript law under the zero vector.
Definition (Lean source)
def mixtureLaw
Fix the sampling scheme S, the local protocol Q, and the probability law nu. Mixture seed/transcript law induced by a product prior.
Definition (Lean source)
parameters
def
given by
def AmplitudePrior
Fix the amplitude and the probability law nu. Support and probability requirements of an amplitude prior.
Definition (Lean source)
def MatchingMoments
Fix the order and the probability law nu0 and the probability law nu1. Moment equality below the cancellation degree.
Definition (Lean source)
parameters
def
MatchingMoments k nu0 nu1 :
Prop
given by
(∫ u, u^q ∂nu0) = ∫ u, u^q ∂nu1
def densityDerivative
Fix the function p, the function theta, the public seed, the protocol transcript, the coordinate index, and the order. Coordinate derivative of a proposed density version.
Definition (Lean source)
parameters
n :
ℕ
p :
(Fin d → ℝ) × Q.Seed × ProtocolTranscript Q → ℝ
theta :
Fin d → ℝ
r :
Q.Seed
z :
j :
Fin d
k :
ℕ
def
densityDerivative p theta r z j k :
ℝ
given by
iteratedDeriv k (fun x => p (update theta j x,r,z)) (theta j)
def DensityCertificate
Fix the local protocol Q, the privacy budget, and the function p. Full density version, polynomiality and derivative assertions.
Definition (Lean source)
parameters
n :
ℕ
d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
eps :
ℝ
p :
(Fin d → ℝ) × Q.Seed × ProtocolTranscript Q → ℝ
def
DensityCertificate Q eps p :
Prop
given by
clause 1
clause 2
theta ∈ parameterCube d :
r :
z :
0 ≤ p (theta,r,z)
(referenceLaw Q r).withDensity (fun z => ofReal (p (theta,r,z)))
= conditionalTranscriptLaw Q theta r
clause 3
theta r z j :
clause 4
theta ∈ parameterCube d :
r j k :
1 ≤ k
k ≤ n
(∫ z, |densityDerivative p theta r z j k| ∂(referenceLaw Q r))
Fix the function theta. Clipping extends cube-indexed probability experiments to the whole parameter space.
theorem measurable_densityCubeClamp
Coordinatewise parameter clipping is measurable.
Formal statement
Proof (Lean source)
-- @node: measurable_densityCubeClamp
@[fun_prop] lemma measurable_densityCubeClamp :
Measurable (densityCubeClamp : (Fin d → ℝ) → Fin d → ℝ) := by
unfold densityCubeClamp
fun_prop
theorem densityCubeClamp_mem
Clipped parameters belong to the declared cube. [](.
Formal statement
Proof (Lean source)
-- @node: densityCubeClamp_mem
lemma densityCubeClamp_mem (theta : Fin d → ℝ) : densityCubeClamp theta ∈ parameterCube d := by
intro j
exact ⟨le_max_left _ _, max_le (by norm_num) (min_le_left _ _)⟩
theorem densityCubeClamp_eq
Assume the stated htheta condition. Clipping fixes all parameters of the declared experiment. [](.
Formal statement
hypotheses
conclusion
densityCubeClamp theta = theta
Proof (Lean source)
-- @node: densityCubeClamp_eq
lemma densityCubeClamp_eq (theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d) :
densityCubeClamp theta = theta := by
funext j
exact max_eq_right ((htheta j).1.trans_eq (min_eq_right (htheta j).2).symm) |>.trans
(min_eq_right (htheta j).2)
theorem conditionalTranscriptLaw_probability
Assume the stated htheta condition and positive dimension. Integrating fixed-input probability transcript laws preserves total mass.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
theta :
Fin d → ℝ
htheta :
theta ∈ parameterCube d
hd :
0 < d
r :
Q.Seed
conclusion
IsProbabilityMeasure (conditionalTranscriptLaw Q theta r)
Proof (Lean source)
-- @node: conditionalTranscriptLaw_probability
lemma conditionalTranscriptLaw_probability (Q : LocalProtocol n (ObsRecord d))
(theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d) (hd : 0 < d) (r : Q.Seed) :
IsProbabilityMeasure (conditionalTranscriptLaw Q theta r) := by
haveI := symmetricLaw_probability theta htheta hd
haveI : IsProbabilityMeasure (observedLaw (symmetricLaw theta)) :=
Measure.isProbabilityMeasure_map (by fun_prop)
constructor
rw [conditionalTranscriptLaw, Measure.bind_apply MeasurableSet.univ
(show Measurable (fun o => fixedTranscriptLaw Q o r) by fun_prop).aemeasurable]
have hmass (o : Fin n → ObsRecord d) : fixedTranscriptLaw Q o r univ = 1 := by
have hprob := isProbabilityMeasure_transcriptLaw
Q.kernels Q.markov (fun i => (o i,r))
exact hprob.measure_univ
simp only [hmass, lintegral_one, measure_univ]
theorem measurable_conditionalTranscriptLaw_clipped
Finite input summation makes the clipped transcript experiment jointly measurable when the record dimension is positive.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: measurable_conditionalTranscriptLaw_clipped
@[fun_prop] lemma measurable_conditionalTranscriptLaw_clipped
(Q : LocalProtocol n (ObsRecord d)) (hd : 0 < d) :
Measurable (fun w : (Fin d → ℝ) × Q.Seed =>
conditionalTranscriptLaw Q (densityCubeClamp w.1) w.2) := by
apply Measure.measurable_of_measurable_coe
intro E hE
have hobs : Measurable (fun w : (Fin d → ℝ) × Q.Seed =>
observedLaw (symmetricLaw (densityCubeClamp w.1))) := by
exact (Measure.measurable_map observe (by fun_prop)).comp
(measurable_symmetricLaw_parameter.comp (measurable_densityCubeClamp.comp measurable_fst))
have hexpand (w : (Fin d → ℝ) × Q.Seed) :
conditionalTranscriptLaw Q (densityCubeClamp w.1) w.2 E =
∑ o : Fin n → ObsRecord d, fixedTranscriptLaw Q o w.2 E *
∏ i, observedLaw (symmetricLaw (densityCubeClamp w.1)) {o i} := by
haveI := symmetricLaw_probability _ (densityCubeClamp_mem w.1) hd
haveI : IsProbabilityMeasure (observedLaw (symmetricLaw (densityCubeClamp w.1))) :=
Measure.isProbabilityMeasure_map (by fun_prop)
rw [conditionalTranscriptLaw, Measure.bind_apply hE
(show Measurable (fun o => fixedTranscriptLaw Q o w.2) by fun_prop).aemeasurable,
lintegral_fintype]
simp only [Measure.pi_singleton]
simp_rw [hexpand]
apply Finset.measurable_sum
intro o _
apply mul
· exact (Measure.measurable_coe hE).comp
((measurable_fixedTranscriptLaw Q).comp
(show Measurable (fun w : (Fin d → ℝ) × Q.Seed => (o,w.2)) by fun_prop))
· apply Finset.measurable_prod
intro i _
exact (Measure.measurable_coe (measurableSet_singleton _)).comp hobs
theorem conditionalTranscriptLaw_absolutelyContinuous
Assume positive dimension. Full support of the zero-contrast iid input law dominates every transcript experiment. [](.
Formal statement
hypotheses
conclusion
conditionalTranscriptLaw Q theta r ≪ referenceLaw Q r
Proof (Lean source)
-- @node: conditionalTranscriptLaw_absolutelyContinuous
lemma conditionalTranscriptLaw_absolutelyContinuous (Q : LocalProtocol n (ObsRecord d))
(theta : Fin d → ℝ) (r : Q.Seed) (hd : 0 < d) :
conditionalTranscriptLaw Q theta r ≪ referenceLaw Q r := by
have hcube : (fun _ : Fin d => (0 : ℝ)) ∈ parameterCube d := by
intro j; constructor <;> norm_num
haveI := symmetricLaw_probability (fun _ : Fin d => 0) hcube hd
haveI : IsProbabilityMeasure (observedLaw (symmetricLaw (fun _ : Fin d => 0))) :=
Measure.isProbabilityMeasure_map (by fun_prop)
apply finite_bind_absolutelyContinuous _ _ _ (by fun_prop)
intro o
rw [Measure.pi_singleton]
exact Finset.prod_ne_zero_iff.mpr (fun i _ => observed_symmetric_zero_atom hd (o i))
theorem density_polynomial_of_gate
Assume measurable Radon–Nikodym densities for dominated kernels, sequential local privacy of the protocol, sample size at least two, dimension at least two, and a privacy budget in the interval from zero to one. Density polynomial existence with its version identities, conditional on the RN gate.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
hRN_of_gate :
Q :
LocalProtocol n (ObsRecord d)
eps :
ℝ
hQ :
SequentialClass Q eps
hn :
2 ≤ n
hd :
2 ≤ d
heps :
eps ∈ Ioc 0 1
conclusion
∃ p : (Fin d → ℝ) × Q.Seed × ProtocolTranscript Q → ℝ,
conclusion 1
theta ∈ parameterCube d :
r :
(referenceLaw Q r).withDensity (fun z => ofReal (p (theta,r,z)))
= conditionalTranscriptLaw Q theta r
Proof (Lean source)
-- @node: density_polynomial_of_gate
lemma density_polynomial_of_gate (hRN_of_gate : MeasurableKernelRadonNikodym)
(Q : LocalProtocol n (ObsRecord d)) (eps : ℝ) (hQ : SequentialClass Q eps)
(hn : 2 ≤ n) (hd : 2 ≤ d) (heps : eps ∈ Ioc 0 1) :
∃ p : (Fin d → ℝ) × Q.Seed × ProtocolTranscript Q → ℝ,
Measurable p ∧ ∀ theta ∈ parameterCube d, ∀ r,
(referenceLaw Q r).withDensity (fun z => ofReal (p (theta,r,z))) =
conditionalTranscriptLaw Q theta r := by
let K : Kernel ((Fin d → ℝ) × Q.Seed) (ProtocolTranscript Q) :=
⟨fun w => conditionalTranscriptLaw Q (densityCubeClamp w.1) w.2,
measurable_conditionalTranscriptLaw_clipped Q (by omega)⟩
let L : Kernel ((Fin d → ℝ) × Q.Seed) (ProtocolTranscript Q) :=
⟨fun w => referenceLaw Q w.2, by
have hzero : densityCubeClamp (fun _ : Fin d => (0 : ℝ)) = fun _ => 0 :=
densityCubeClamp_eq _ (by intro j; constructor <;> norm_num)
have hm := (measurable_conditionalTranscriptLaw_clipped Q (by omega)).comp
(show Measurable (fun w : (Fin d → ℝ) × Q.Seed =>
((fun _ : Fin d => (0 : ℝ)), w.2)) by fun_prop)
simpa only [Function.comp_def, hzero, referenceLaw] using hm⟩
haveI : IsMarkovKernel K := ⟨fun w =>
conditionalTranscriptLaw_probability Q _ (densityCubeClamp_mem w.1) (by omega) w.2⟩
haveI : IsMarkovKernel L := ⟨fun w =>
conditionalTranscriptLaw_probability Q _ (by intro j; constructor <;> norm_num)
(by omega) w.2⟩
haveI : StandardBorelSpace (ProtocolTranscript Q) := by
unfold ProtocolTranscript Transcript
History
infer_instance
obtain ⟨f, hf, hrep⟩ := real_kernel_density_of_gate hRN_of_gate K L
(fun w => conditionalTranscriptLaw_absolutelyContinuous Q _ w.2 (by omega))
refine ⟨fun w => f ((w.1,w.2.1),w.2.2), hf.comp (by fun_prop), ?_⟩
intro theta htheta r
have h := hrep (theta,r)
change (referenceLaw Q r).withDensity (fun z => ofReal (f ((theta,r),z))) =
conditionalTranscriptLaw Q (densityCubeClamp theta) r at h
rwa [densityCubeClamp_eq theta htheta] at h
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Contraction.Derivative 23 declarations Finite original-record private value frontiers: Helpers/Contraction/Derivative.
Helpers/Contraction/Derivative
Finite original-record private value frontiers: Helpers/Contraction/Derivative.
Fix the function xi. Higher-order elementary-symmetric score recursion.
Definition (Lean source)
parameters
xi :
ℕ → ℝ
def
scoreElementary xi :
ℕ → ℕ → ℝ
given by
clause 1
| 0, 0 => 1
clause 2
| 0, _+1 => 0
clause 3
| _+1, 0 => 1
clause 4
| v+1, k+1 => scoreElementary xi v (k + 1) + xi v * scoreElementary xi v k
theorem scoreElementary_zero
The zeroth elementary score is one at every sample size.
Formal statement
Proof (Lean source)
-- @node: scoreElementary_zero
lemma scoreElementary_zero (xi : ℕ → ℝ) (v : ℕ) : scoreElementary xi v 0 = 1 := by
cases v <;> rfl
theorem scoreElementary_above
Assume the stated h condition. No subset of a prefix has cardinality greater than that prefix.
Formal statement
Proof (Lean source)
-- @node: scoreElementary_above
lemma scoreElementary_above (xi : ℕ → ℝ) (v k : ℕ) (h : v < k) :
scoreElementary xi v k = 0 := by
induction v generalizing k with
| zero => cases k <;> simp_all [scoreElementary]
| succ v ih =>
cases k with
| zero => omega
| succ k =>
rw [scoreElementary, ih (k + 1) (by omega), ih k (by omega)]
ring
theorem scoreElementary_abs_le
Assume the stated hb condition and the stated hxi condition. The bounded-score subset expansion has its deterministic binomial bound.
Formal statement
hypotheses
xi :
ℕ → ℝ
beta :
ℝ
hb :
0 ≤ beta
hxi :
∀ i, |xi i| ≤ beta
v k :
ℕ
conclusion
|scoreElementary xi v k| ≤ (Nat.choose v k : ℝ) * beta^k
Proof (Lean source)
-- @node: scoreElementary_abs_le
lemma scoreElementary_abs_le (xi : ℕ → ℝ) (beta : ℝ) (hb : 0 ≤ beta)
(hxi : ∀ i, |xi i| ≤ beta) (v k : ℕ) :
|scoreElementary xi v k| ≤ (Nat.choose v k : ℝ) * beta^k := by
induction v generalizing k with
| zero => cases k <;> simp [scoreElementary]
| succ v ih =>
cases k with
| zero => simp [scoreElementary_zero]
| succ k =>
calc
|scoreElementary xi (v + 1) (k + 1)| ≤
|scoreElementary xi v (k + 1)| + |xi v| * |scoreElementary xi v k| := by
simpa only [scoreElementary, abs_mul] using
abs_add_le (scoreElementary xi v (k + 1)) (xi v * scoreElementary xi v k)
_ ≤ (Nat.choose v (k + 1) : ℝ) * beta^(k + 1) +
beta * ((Nat.choose v k : ℝ) * beta^k) :=
add_le_add (ih (k + 1)) (mul_le_mul (hxi v) (ih k) (abs_nonneg _) hb)
_ = (Nat.choose (v + 1) (k + 1) : ℝ) * beta^(k + 1) := by
rw [Nat.choose_succ_succ]
push_cast
ring
theorem scoreElementary_affineProduct
The recursion is the exact coefficient expansion of a finite product of affine factors.
Formal statement
hypotheses
xi :
ℕ → ℝ
v :
ℕ
t :
ℝ
conclusion
(∏ i ∈ range v, (1 + t*xi i))
= ∑ k ∈ range (v + 1), scoreElementary xi v k * t^k
Proof (Lean source)
-- @node: scoreElementary_affineProduct
lemma scoreElementary_affineProduct (xi : ℕ → ℝ) (v : ℕ) (t : ℝ) :
(∏ i ∈ range v, (1 + t*xi i)) =
∑ k ∈ range (v + 1), scoreElementary xi v k * t^k := by
induction v with
| zero => simp [scoreElementary]
| succ v ih =>
let S := ∑ k ∈ range (v + 1), scoreElementary xi v k * t^k
have hshift : (∑ k ∈ range (v + 1), scoreElementary xi v (k + 1) * t^(k + 1)) + 1 = S := by
rw [Finset.sum_range_succ]
rw [scoreElementary_above xi v (v + 1) (by omega)]
simp only [zero_mul, add_zero]
dsimp [S]
rw [Finset.sum_range_succ']
simp [scoreElementary_zero]
have hscale : (∑ k ∈ range (v + 1), xi v * scoreElementary xi v k * t^(k + 1)) =
xi v * t * S := by
dsimp [S]
rw [Finset.mul_sum]
apply Finset.sum_congr rfl
intro k _
rw [pow_succ]
ring
rw [Finset.prod_range_succ, ih]
change S * (1 + t*xi v) = _
conv_rhs => rw [Finset.sum_range_succ']
simp only [scoreElementary, add_mul, Finset.sum_add_distrib, pow_zero, mul_one]
rw [hscale]
have hshift' : (∑ k ∈ range (v + 1), scoreElementary xi v (k + 1) * t^(k + 1)) = S - 1 := by
linarith
rw [hshift']
ring
theorem stageMixtureDensity_shift_factor
Assume the stated hpos condition. A coordinate shift factors each positive affine stage density into its base density times one plus the shift times its conditional score. [](.
Formal statement
hypotheses
d :
ℕ
theta :
Fin d → ℝ
f :
PairedSymbol d → ℝ
j :
Fin d
t :
ℝ
hpos :
0 < stageMixtureDensity theta f
conclusion
stageMixtureDensity (update theta j (theta j + t)) f
Proof (Lean source)
-- @node: stageMixtureDensity_shift_factor
lemma stageMixtureDensity_shift_factor (theta : Fin d → ℝ) (f : PairedSymbol d → ℝ)
(j : Fin d) (t : ℝ) (hpos : 0 < stageMixtureDensity theta f) :
stageMixtureDensity (update theta j (theta j + t)) f =
stageMixtureDensity theta f *
(1 + t * (stageCoordinateSlope f j / stageMixtureDensity theta f)) := by
rw [stageMixtureDensity_update]
field_simp [ne_of_gt hpos]
<;> ring
theorem stageProduct_score_expansion
Assume the stated hpos condition. The explicit stage-density product has the elementary-score coefficient expansion at every parameter with positive stage densities.
Formal statement
hypotheses
d :
ℕ
theta :
Fin d → ℝ
f :
ℕ → PairedSymbol d → ℝ
j :
Fin d
v :
ℕ
t :
ℝ
hpos :
∀ i < v, 0 < stageMixtureDensity theta (f i)
conclusion
= (∏ i ∈ range v, stageMixtureDensity theta (f i)) * ∑ k ∈ range (v + 1), scoreElementary (fun i => stageCoordinateSlope (f i) j / stageMixtureDensity theta (f i)) v k * t^k
Proof (Lean source)
-- @node: stageProduct_score_expansion
lemma stageProduct_score_expansion (theta : Fin d → ℝ)
(f : ℕ → PairedSymbol d → ℝ) (j : Fin d) (v : ℕ) (t : ℝ)
(hpos : ∀ i < v, 0 < stageMixtureDensity theta (f i)) :
(∏ i ∈ range v,
stageMixtureDensity (update theta j (theta j + t)) (f i)) =
(∏ i ∈ range v, stageMixtureDensity theta (f i)) *
∑ k ∈ range (v + 1),
scoreElementary (fun i => stageCoordinateSlope (f i) j /
stageMixtureDensity theta (f i)) v k * t^k := by
calc
_ = ∏ i ∈ range v, stageMixtureDensity theta (f i) *
(1 + t * (stageCoordinateSlope (f i) j / stageMixtureDensity theta (f i))) := by
apply Finset.prod_congr rfl
intro i hi
exact stageMixtureDensity_shift_factor theta (f i) j t (hpos i (Finset.mem_range.mp hi))
_ = _ := by rw [Finset.prod_mul_distrib, scoreElementary_affineProduct]
theorem iteratedDeriv_score_polynomial_zero
Differentiation at zero extracts a finite polynomial coefficient with the factorial required by the density derivative bound.
Formal statement
Proof (Lean source)
-- @node: iteratedDeriv_score_polynomial_zero
lemma iteratedDeriv_score_polynomial_zero (xi : ℕ → ℝ) (v k : ℕ) :
iteratedDeriv k (fun t : ℝ =>
∑ q ∈ range (v + 1), scoreElementary xi v q * t^q) 0 =
(k.factorial : ℝ) * scoreElementary xi v k := by
rw [iteratedDeriv_fun_sum]
· simp_rw [iteratedDeriv_const_mul_field, iteratedDeriv_fun_pow_zero]
by_cases hk : k < v + 1
· simp [hk, mul_comm]
· have hzero := scoreElementary_above xi v k (by omega)
simp [hk, hzero]
· intro q _
fun_prop
theorem stageProduct_iteratedDeriv_score
Assume the stated hpos condition. Repeated coordinate differentiation of the explicit affine product is exactly factorial times the base product times the elementary conditional score.
Formal statement
hypotheses
d :
ℕ
theta :
Fin d → ℝ
f :
ℕ → PairedSymbol d → ℝ
j :
Fin d
v k :
ℕ
hpos :
∀ i < v, 0 < stageMixtureDensity theta (f i)
conclusion
iteratedDeriv k (fun t : ℝ => ∏ i ∈ range v, stageMixtureDensity (update theta j (theta j + t)) (f i)) 0
= (k.factorial : ℝ) * (∏ i ∈ range v, stageMixtureDensity theta (f i)) * scoreElementary (fun i => stageCoordinateSlope (f i) j / stageMixtureDensity theta (f i)) v k
Proof (Lean source)
-- @node: stageProduct_iteratedDeriv_score
lemma stageProduct_iteratedDeriv_score (theta : Fin d → ℝ)
(f : ℕ → PairedSymbol d → ℝ) (j : Fin d) (v k : ℕ)
(hpos : ∀ i < v, 0 < stageMixtureDensity theta (f i)) :
iteratedDeriv k (fun t : ℝ => ∏ i ∈ range v,
stageMixtureDensity (update theta j (theta j + t)) (f i)) 0 =
(k.factorial : ℝ) * (∏ i ∈ range v, stageMixtureDensity theta (f i)) *
scoreElementary (fun i => stageCoordinateSlope (f i) j /
stageMixtureDensity theta (f i)) v k := by
have hfun := funext (fun t => stageProduct_score_expansion theta f j v t hpos)
rw [hfun, iteratedDeriv_const_mul_field, iteratedDeriv_score_polynomial_zero]
ring
theorem stageProduct_coordinateDerivative_score
Assume the stated hpos condition. The product-score identity in the original coordinate, including boundary parameters where the polynomial defines the derivative.
Formal statement
hypotheses
d :
ℕ
theta :
Fin d → ℝ
f :
ℕ → PairedSymbol d → ℝ
j :
Fin d
v k :
ℕ
hpos :
∀ i < v, 0 < stageMixtureDensity theta (f i)
conclusion
iteratedDeriv k (fun x : ℝ => ∏ i ∈ range v, stageMixtureDensity (update theta j x) (f i)) (theta j)
= (k.factorial : ℝ) * (∏ i ∈ range v, stageMixtureDensity theta (f i)) * scoreElementary (fun i => stageCoordinateSlope (f i) j / stageMixtureDensity theta (f i)) v k
Proof (Lean source)
-- @node: stageProduct_coordinateDerivative_score
lemma stageProduct_coordinateDerivative_score (theta : Fin d → ℝ)
(f : ℕ → PairedSymbol d → ℝ) (j : Fin d) (v k : ℕ)
(hpos : ∀ i < v, 0 < stageMixtureDensity theta (f i)) :
iteratedDeriv k (fun x : ℝ => ∏ i ∈ range v,
stageMixtureDensity (update theta j x) (f i)) (theta j) =
(k.factorial : ℝ) * (∏ i ∈ range v, stageMixtureDensity theta (f i)) *
scoreElementary (fun i => stageCoordinateSlope (f i) j /
stageMixtureDensity theta (f i)) v k := by
have h := stageProduct_iteratedDeriv_score theta f j v k hpos
have hcomm : (fun t : ℝ => ∏ i ∈ range v,
stageMixtureDensity (update theta j (theta j + t)) (f i)) =
(fun t : ℝ => ∏ i ∈ range v,
stageMixtureDensity (update theta j (t + theta j)) (f i)) := by
funext t
rw [add_comm (theta j)]
rw [hcomm] at h
rw [iteratedDeriv_comp_add_const (f := fun x : ℝ => ∏ i ∈ range v,
stageMixtureDensity (update theta j x) (f i))] at h
simpa only [zero_add] using h
theorem measurable_scoreElementary
Elementary scores depend measurably only on the preceding increments when all increments before the cutoff are measurable.
Formal statement
hypotheses
conclusion
Measurable (fun w => scoreElementary (fun i => xi i w) v k)
Proof (Lean source)
-- @node: measurable_scoreElementary
@[fun_prop] lemma measurable_scoreElementary {Ω : Type*} [MeasurableSpace Ω]
(xi : ℕ → Ω → ℝ) (v k : ℕ) (hxi : ∀ i < v, Measurable (xi i)) :
Measurable (fun w => scoreElementary (fun i => xi i w) v k) := by
induction v generalizing k with
| zero => cases k <;> exact measurable_const
| succ v ih =>
cases k with
| zero => exact measurable_const
| succ k =>
change Measurable (fun w => scoreElementary (fun i => xi i w) v (k + 1) +
xi v w * scoreElementary (fun i => xi i w) v k)
first
| fun_prop
| exact (ih (k + 1) (fun i hi => hxi i (by omega))).add
((hxi v (by omega)).mul (ih k (fun i hi => hxi i (by omega))))
theorem integrable_scoreElementary_pow
Assume measurability of xi, the stated hb condition, and the stated hbound condition. Bounded score products have finite moments of every natural order.
Formal statement
hypotheses
Ω :
Type*
mu :
xi :
ℕ → Ω → ℝ
hxi :
∀ i, Measurable (xi i)
beta :
ℝ
hb :
0 ≤ beta
hbound :
∀ i w, |xi i w| ≤ beta
v k q :
ℕ
conclusion
Integrable (fun w => (scoreElementary (fun i => xi i w) v k)^q) mu
Proof (Lean source)
-- @node: integrable_scoreElementary_pow
lemma integrable_scoreElementary_pow {Ω : Type*} [MeasurableSpace Ω]
(mu : Measure Ω) [IsFiniteMeasure mu] (xi : ℕ → Ω → ℝ)
(hxi : ∀ i, Measurable (xi i)) (beta : ℝ) (hb : 0 ≤ beta)
(hbound : ∀ i w, |xi i w| ≤ beta) (v k q : ℕ) :
Integrable (fun w => (scoreElementary (fun i => xi i w) v k)^q) mu := by
apply Integrable.of_bound
((measurable_scoreElementary xi v k (fun i _ => hxi i)).pow_const q).aestronglyMeasurable
(((Nat.choose v k : ℝ) * beta^k)^q)
filter_upwards [] with w
rw [Real.norm_eq_abs, abs_pow]
exact pow_le_pow_left₀ (abs_nonneg _) (scoreElementary_abs_le _ beta hb
(fun i => hbound i w) v k) q
Assume the stated hm condition, measurability of f, the stated hg condition, the stated hfg condition, and the stated hmean condition. Conditional mean zero kills a bounded, past-measurable cross term.
Formal statement
hypotheses
Ω :
Type*
mu :
m :
hm :
m ≤ m0
f g :
Ω → ℝ
hf :
Measurable[m] f
hg :
Integrable g mu
hfg :
Integrable (f * g) mu
hmean :
mu[g | m] =ᵐ[mu] 0
conclusion
(∫ w, f w * g w ∂mu) = 0
Proof (Lean source)
-- @node: score_cross_integral_zero
lemma score_cross_integral_zero {Ω : Type*} {m0 : MeasurableSpace Ω}
(mu : Measure Ω) [IsProbabilityMeasure mu] (m : MeasurableSpace Ω) (hm : m ≤ m0)
(f g : Ω → ℝ) (hf : Measurable[m] f) (hg : Integrable g mu)
(hfg : Integrable (f * g) mu) (hmean : mu[g | m] =ᵐ[mu] 0) :
(∫ w, f w * g w ∂mu) = 0 := by
rw [← integral_condExp hm]
have hpull := condExp_mul_of_stronglyMeasurable_left hf.stronglyMeasurable hfg hg
have hzero : mu[f * g | m] =ᵐ[mu] 0 := by
filter_upwards [hpull, hmean] with w hw hw0
simp only [Pi.mul_apply, Pi.zero_apply] at hw hw0 ⊢
rw [hw, hw0, mul_zero]
exact (integral_congr_ae hzero).trans (by simp)
theorem scoreElementary_secondMoment_step
Assume measurability of xi, the stated hb condition, the stated hbound condition, and the stated hcross condition. Cross-term cancellation and bounded increments give the score second-moment recursion.
Formal statement
hypotheses
Ω :
Type*
mu :
xi :
ℕ → Ω → ℝ
hxi :
∀ i, Measurable (xi i)
beta :
ℝ
hb :
0 ≤ beta
hbound :
∀ i w, |xi i w| ≤ beta
v k :
ℕ
hcross :
(∫ w, scoreElementary (fun i => xi i w) v (k + 1) * (xi v w * scoreElementary (fun i => xi i w) v k) ∂mu)
= 0
conclusion
(∫ w, (scoreElementary (fun i => xi i w) (v + 1) (k + 1))^2 ∂mu)
≤ (∫ w, (scoreElementary (fun i => xi i w) v (k + 1))^2 ∂mu)
+ beta^2 * (∫ w, (scoreElementary (fun i => xi i w) v k)^2 ∂mu)
Proof (Lean source)
-- @node: scoreElementary_secondMoment_step
lemma scoreElementary_secondMoment_step {Ω : Type*} [MeasurableSpace Ω]
(mu : Measure Ω) [IsProbabilityMeasure mu] (xi : ℕ → Ω → ℝ)
(hxi : ∀ i, Measurable (xi i)) (beta : ℝ) (hb : 0 ≤ beta)
(hbound : ∀ i w, |xi i w| ≤ beta) (v k : ℕ)
(hcross : (∫ w, scoreElementary (fun i => xi i w) v (k + 1) *
(xi v w * scoreElementary (fun i => xi i w) v k) ∂mu) = 0) :
(∫ w, (scoreElementary (fun i => xi i w) (v + 1) (k + 1))^2 ∂mu) ≤
(∫ w, (scoreElementary (fun i => xi i w) v (k + 1))^2 ∂mu) +
beta^2 * (∫ w, (scoreElementary (fun i => xi i w) v k)^2 ∂mu) := by
let A := fun w => scoreElementary (fun i => xi i w) v (k + 1)
let B := fun w => xi v w * scoreElementary (fun i => xi i w) v k
have hA : Measurable A := measurable_scoreElementary xi _ _ (fun i _ => hxi i)
have hB : Measurable B := (hxi v).mul
(measurable_scoreElementary xi _ _ (fun i _ => hxi i))
have hAb : ∀ w, |A w| ≤ (Nat.choose v (k + 1) : ℝ) * beta^(k + 1) :=
fun w => scoreElementary_abs_le _ beta hb (fun i => hbound i w) _ _
have hBb : ∀ w, |B w| ≤ beta * ((Nat.choose v k : ℝ) * beta^k) := by
intro w
rw [abs_mul]
exact mul_le_mul (hbound v w)
(scoreElementary_abs_le _ beta hb (fun i => hbound i w) _ _) (abs_nonneg _) hb
have hB2 : Integrable (fun w => B w^2) mu := by
apply Integrable.of_bound (hB.pow_const 2).aestronglyMeasurable
((beta * ((Nat.choose v k : ℝ) * beta^k))^2)
filter_upwards [] with w
simpa only [Real.norm_eq_abs, abs_pow] using
pow_le_pow_left₀ (abs_nonneg (B w)) (hBb w) 2
have hAB : Integrable (fun w => A w * B w) mu := by
apply Integrable.of_bound (hA.mul hB).aestronglyMeasurable
(((Nat.choose v (k + 1) : ℝ) * beta^(k + 1)) *
(beta * ((Nat.choose v k : ℝ) * beta^k)))
filter_upwards [] with w
simp only [Real.norm_eq_abs, Pi.mul_apply, abs_mul]
exact mul_le_mul (hAb w) (hBb w) (abs_nonneg _) (by positivity)
have hA2 : Integrable (fun w => A w^2) mu :=
integrable_scoreElementary_pow mu xi hxi beta hb hbound v (k + 1) 2
have hE2 := integrable_scoreElementary_pow mu xi hxi beta hb hbound v k 2
have hexp : (fun w => (scoreElementary (fun i => xi i w) (v + 1) (k + 1))^2) =
(fun w => A w^2 + 2 * (A w * B w) + B w^2) := by
funext w
dsimp [A, B]
rw [scoreElementary]
ring
rw [hexp]
integral_linearity
change _ + 2 * (∫ w, A w * B w ∂mu) + _ ≤ _
have hcross' : (∫ w, A w * B w ∂mu) = 0 := hcross
rw [hcross']
simp only [mul_zero, add_zero]
apply add_le_add le_rfl
rw [← integral_const_mul]
apply integral_mono hB2 (hE2.const_mul (beta^2))
intro w
dsimp [B]
rw [mul_pow]
apply mul_le_mul_of_nonneg_right _ (sq_nonneg _)
have hh := pow_le_pow_left₀ (abs_nonneg (xi v w)) (hbound v w) 2
simpa only [sq_abs] using hh
theorem scoreElementary_secondMoment_le
Assume measurability of xi, the stated hb condition, the stated hbound condition, and the stated hcross condition. The martingale score recursion yields the binomial second-moment bound.
Formal statement
hypotheses
Ω :
Type*
mu :
xi :
ℕ → Ω → ℝ
hxi :
∀ i, Measurable (xi i)
beta :
ℝ
hb :
0 ≤ beta
hbound :
∀ i w, |xi i w| ≤ beta
hcross :
∀ v k,
(∫ w, scoreElementary (fun i => xi i w) v (k + 1) * (xi v w * scoreElementary (fun i => xi i w) v k) ∂mu)
= 0
v k :
ℕ
conclusion
(∫ w, (scoreElementary (fun i => xi i w) v k)^2 ∂mu) ≤ (Nat.choose v k : ℝ) * beta^(2*k)
Proof (Lean source)
-- @node: scoreElementary_secondMoment_le
lemma scoreElementary_secondMoment_le {Ω : Type*} [MeasurableSpace Ω]
(mu : Measure Ω) [IsProbabilityMeasure mu] (xi : ℕ → Ω → ℝ)
(hxi : ∀ i, Measurable (xi i)) (beta : ℝ) (hb : 0 ≤ beta)
(hbound : ∀ i w, |xi i w| ≤ beta)
(hcross : ∀ v k, (∫ w, scoreElementary (fun i => xi i w) v (k + 1) *
(xi v w * scoreElementary (fun i => xi i w) v k) ∂mu) = 0)
(v k : ℕ) :
(∫ w, (scoreElementary (fun i => xi i w) v k)^2 ∂mu) ≤
(Nat.choose v k : ℝ) * beta^(2*k) := by
induction v generalizing k with
| zero => cases k <;> simp [scoreElementary]
| succ v ih =>
cases k with
| zero => simp [scoreElementary_zero]
| succ k =>
calc
_ ≤ (∫ w, (scoreElementary (fun i => xi i w) v (k + 1))^2 ∂mu) +
beta^2 * (∫ w, (scoreElementary (fun i => xi i w) v k)^2 ∂mu) :=
scoreElementary_secondMoment_step mu xi hxi beta hb hbound v k (hcross v k)
_ ≤ (Nat.choose v (k + 1) : ℝ) * beta^(2*(k + 1)) +
beta^2 * ((Nat.choose v k : ℝ) * beta^(2*k)) :=
add_le_add (ih (k + 1)) (mul_le_mul_of_nonneg_left (ih k) (sq_nonneg beta))
_ = (Nat.choose (v + 1) (k + 1) : ℝ) * beta^(2*(k + 1)) := by
rw [Nat.choose_succ_succ]
push_cast
rw [show 2*(k + 1) = 2*k+2 by omega, pow_add]
ring
theorem measurable_scoreElementary_past
An adapted score prefix is measurable with respect to its own past when the filtration is monotone and each increment is adapted.
Formal statement
hypotheses
Ω :
Type*
F :
ℕ → MeasurableSpace Ω
hF :
Monotone F
xi :
ℕ → Ω → ℝ
hadapt :
∀ i, Measurable[F (i + 1)] (xi i)
v k :
ℕ
conclusion
Measurable[F v] (fun w => scoreElementary (fun i => xi i w) v k)
Proof (Lean source)
-- @node: measurable_scoreElementary_past
@[fun_prop] lemma measurable_scoreElementary_past {Ω : Type*}
(F : ℕ → MeasurableSpace Ω) (hF : Monotone F) (xi : ℕ → Ω → ℝ)
(hadapt : ∀ i, Measurable[F (i + 1)] (xi i)) (v k : ℕ) :
Measurable[F v] (fun w => scoreElementary (fun i => xi i w) v k) := by
let : MeasurableSpace Ω := F v
apply measurable_scoreElementary xi v k
intro i hi
exact (hadapt i).mono (hF (by omega)) le_rfl
theorem scoreElementary_martingale_cross
Assume the stated f condition, the stated hle condition, measurability of adapt, the stated hb condition, the stated hbound condition, and the stated hmean condition. Bounded adapted martingale increments cancel every elementary-score cross term.
Formal statement
hypotheses
Ω :
Type*
mu :
F :
ℕ → MeasurableSpace Ω
hF :
Monotone F
hle :
∀ v, F v ≤ m0
xi :
ℕ → Ω → ℝ
hadapt :
∀ i, Measurable[F (i + 1)] (xi i)
beta :
ℝ
hb :
0 ≤ beta
hbound :
∀ i w, |xi i w| ≤ beta
hmean :
∀ v, mu[xi v | F v] =ᵐ[mu] 0
v k :
ℕ
conclusion
(∫ w, scoreElementary (fun i => xi i w) v (k + 1) * (xi v w * scoreElementary (fun i => xi i w) v k) ∂mu)
= 0
Proof (Lean source)
-- @node: scoreElementary_martingale_cross
lemma scoreElementary_martingale_cross {Ω : Type*} [m0 : MeasurableSpace Ω]
(mu : Measure Ω) [IsProbabilityMeasure mu]
(F : ℕ → MeasurableSpace Ω) (hF : Monotone F) (hle : ∀ v, F v ≤ m0)
(xi : ℕ → Ω → ℝ) (hadapt : ∀ i, Measurable[F (i + 1)] (xi i))
(beta : ℝ) (hb : 0 ≤ beta) (hbound : ∀ i w, |xi i w| ≤ beta)
(hmean : ∀ v, mu[xi v | F v] =ᵐ[mu] 0) (v k : ℕ) :
(∫ w, scoreElementary (fun i => xi i w) v (k + 1) *
(xi v w * scoreElementary (fun i => xi i w) v k) ∂mu) = 0 := by
have hxi : ∀ i, Measurable (xi i) := fun i => (hadapt i).mono (hle _) le_rfl
let f := fun w => scoreElementary (fun i => xi i w) v (k + 1) *
scoreElementary (fun i => xi i w) v k
have hf : Measurable[F v] f := by fun_prop
have hg : Integrable (xi v) mu := by
apply Integrable.of_bound (hxi v).aestronglyMeasurable beta
filter_upwards [] with w
exact (Real.norm_eq_abs _).symm ▸ hbound v w
have hfg : Integrable (f * xi v) mu := by
apply Integrable.of_bound (((hf.mono (hle v) le_rfl).mul (hxi v)).aestronglyMeasurable)
(((Nat.choose v (k + 1) : ℝ) * beta^(k + 1)) *
((Nat.choose v k : ℝ) * beta^k) * beta)
filter_upwards [] with w
simp only [Pi.mul_apply, Real.norm_eq_abs, f, abs_mul]
exact mul_le_mul
(mul_le_mul (scoreElementary_abs_le _ beta hb (fun i => hbound i w) v (k + 1))
(scoreElementary_abs_le _ beta hb (fun i => hbound i w) v k)
(abs_nonneg _) (by positivity))
(hbound v w) (abs_nonneg _) (by positivity)
have hz := score_cross_integral_zero mu (F v) (hle v) f (xi v) hf hg hfg (hmean v)
convert hz using 1
congr 1
funext w
dsimp [f]
ring
theorem scoreElementary_martingale_secondMoment
Assume the stated f condition, the stated hle condition, measurability of adapt, the stated hb condition, the stated hbound condition, and the stated hmean condition. The binomial bound holds for adaptive martingale scores, without independence.
Formal statement
hypotheses
Ω :
Type*
mu :
F :
ℕ → MeasurableSpace Ω
hF :
Monotone F
hle :
∀ v, F v ≤ m0
xi :
ℕ → Ω → ℝ
hadapt :
∀ i, Measurable[F (i + 1)] (xi i)
beta :
ℝ
hb :
0 ≤ beta
hbound :
∀ i w, |xi i w| ≤ beta
hmean :
∀ v, mu[xi v | F v] =ᵐ[mu] 0
v k :
ℕ
conclusion
(∫ w, (scoreElementary (fun i => xi i w) v k)^2 ∂mu) ≤ (Nat.choose v k : ℝ) * beta^(2*k)
Proof (Lean source)
-- @node: scoreElementary_martingale_secondMoment
lemma scoreElementary_martingale_secondMoment {Ω : Type*} [m0 : MeasurableSpace Ω]
(mu : Measure Ω) [IsProbabilityMeasure mu]
(F : ℕ → MeasurableSpace Ω) (hF : Monotone F) (hle : ∀ v, F v ≤ m0)
(xi : ℕ → Ω → ℝ) (hadapt : ∀ i, Measurable[F (i + 1)] (xi i))
(beta : ℝ) (hb : 0 ≤ beta) (hbound : ∀ i w, |xi i w| ≤ beta)
(hmean : ∀ v, mu[xi v | F v] =ᵐ[mu] 0) (v k : ℕ) :
(∫ w, (scoreElementary (fun i => xi i w) v k)^2 ∂mu) ≤
(Nat.choose v k : ℝ) * beta^(2*k) := by
apply scoreElementary_secondMoment_le mu xi
(fun i => (hadapt i).mono (hle _) le_rfl) beta hb hbound
exact scoreElementary_martingale_cross mu F hF hle xi hadapt beta hb hbound hmean
theorem scoreElementary_martingale_firstMoment
Assume the stated f condition, the stated hle condition, measurability of adapt, the stated hb condition, the stated hbound condition, and the stated hmean condition. Cauchy–Schwarz converts the adaptive binomial second moment into the needed L1 bound.
Formal statement
hypotheses
Ω :
Type*
mu :
F :
ℕ → MeasurableSpace Ω
hF :
Monotone F
hle :
∀ v, F v ≤ m0
xi :
ℕ → Ω → ℝ
hadapt :
∀ i, Measurable[F (i + 1)] (xi i)
beta :
ℝ
hb :
0 ≤ beta
hbound :
∀ i w, |xi i w| ≤ beta
hmean :
∀ v, mu[xi v | F v] =ᵐ[mu] 0
v k :
ℕ
conclusion
Proof (Lean source)
-- @node: scoreElementary_martingale_firstMoment
lemma scoreElementary_martingale_firstMoment {Ω : Type*} [m0 : MeasurableSpace Ω]
(mu : Measure Ω) [IsProbabilityMeasure mu]
(F : ℕ → MeasurableSpace Ω) (hF : Monotone F) (hle : ∀ v, F v ≤ m0)
(xi : ℕ → Ω → ℝ) (hadapt : ∀ i, Measurable[F (i + 1)] (xi i))
(beta : ℝ) (hb : 0 ≤ beta) (hbound : ∀ i w, |xi i w| ≤ beta)
(hmean : ∀ v, mu[xi v | F v] =ᵐ[mu] 0) (v k : ℕ) :
(∫ w, |scoreElementary (fun i => xi i w) v k| ∂mu) ≤
sqrt (choose v k) * beta^k := by
let E := fun w => scoreElementary (fun i => xi i w) v k
let c := ∫ w, |E w| ∂mu
have hxi : ∀ i, Measurable (xi i) := fun i => (hadapt i).mono (hle _) le_rfl
have hi : Integrable E mu := by
simpa only [pow_one] using integrable_scoreElementary_pow mu xi hxi beta hb hbound v k 1
have hi2 : Integrable (fun w => |E w|^2) mu := by
simpa only [sq_abs] using integrable_scoreElementary_pow mu xi hxi beta hb hbound v k 2
have hnonneg : 0 ≤ ∫ w, (|E w| - c)^2 ∂mu :=
integral_nonneg (fun w => sq_nonneg _)
have hexp : (fun w => (|E w| - c)^2) =
(fun w => |E w|^2 - 2*c*|E w| + c^2) := by funext w; ring
rw [hexp] at hnonneg
have hiabs := hi.abs
have hilinear : Integrable (fun w => 2*c*|E w|) mu := hiabs.const_mul (2*c)
have hlin : (∫ w, |E w|^2 - 2*c*|E w| + c^2 ∂mu) =
(∫ w, |E w|^2 ∂mu) - 2*c*(∫ w, |E w| ∂mu) + (∫ _ : Ω, c^2 ∂mu) := by
integral_linearity
rw [hlin] at hnonneg
simp only [integral_const, probReal_univ, one_smul] at hnonneg
have hsq : c^2 ≤ ∫ w, (E w)^2 ∂mu := by
simp only [sq_abs] at hnonneg
change 0 ≤ (∫ w, E w^2 ∂mu) - 2*c*c + c^2 at hnonneg
nlinarith
have hsecond := scoreElementary_martingale_secondMoment mu F hF hle xi hadapt
beta hb hbound hmean v k
have hcs := Real.le_sqrt_of_sq_le (hsq.trans hsecond)
have hpower : beta^(2*k) = (beta^k)^2 := by rw [← pow_mul]; congr 1; omega
rw [hpower, Real.sqrt_mul (by positivity), Real.sqrt_sq (pow_nonneg hb k)] at hcs
exact hcs
Assume measurability of p, the stated hp0 condition, the stated hc condition, and the stated d condition. The density-times-score identity changes the derivative L1 integral into a factorial times the score first moment under the parameter-specific law.
Formal statement
Proof (Lean source)
-- @node: integral_abs_density_score
lemma integral_abs_density_score {Ω : Type*} [MeasurableSpace Ω]
(mu : Measure Ω) (p E D : Ω → ℝ) (hp : Measurable p)
(hp0 : ∀ w, 0 ≤ p w) (c : ℝ) (hc : 0 ≤ c)
(hD : ∀ w, D w = c * p w * E w) :
(∫ w, |D w| ∂mu) =
c * (∫ w, |E w| ∂mu.withDensity (fun w => ofReal (p w))) := by
rw [integral_withDensity_eq_integral_toReal_smul hp.ennreal_ofReal
(Filter.Eventually.of_forall (fun w => ENNReal.ofReal_lt_top))]
simp only [ENNReal.toReal_ofReal (hp0 _), smul_eq_mul]
rw [← integral_const_mul]
apply integral_congr_ae
filter_upwards [] with w
rw [hD w, abs_mul, abs_mul, abs_of_nonneg hc, abs_of_nonneg (hp0 w)]
ring
theorem stageProduct_coordinateDerivative_l1
Assume the stated hpos condition, measurability of p, the stated probability-measure property, the stated f condition, the stated hle condition, measurability of adapt, the stated hb condition, the stated hbound condition, and the stated hmean condition. The explicit affine stage product satisfies the sharp derivative L1 bound whenever its conditional scores are bounded martingale increments under its own density-weighted transcript law. This is the change-of-measure assembly used after identifying the stage product with the protocol density.
Formal statement
hypotheses
d :
ℕ
Ω :
Type*
mu :
Measure Ω
theta :
Fin d → ℝ
f :
ℕ → Ω → PairedSymbol d → ℝ
j :
Fin d
v k :
ℕ
hpos :
∀ i < v, ∀ w, 0 < stageMixtureDensity theta (f i w)
hp :
hprob :
IsProbabilityMeasure (mu.withDensity (fun w => ofReal (∏ i ∈ range v, stageMixtureDensity theta (f i w))))
F :
ℕ → MeasurableSpace Ω
hF :
Monotone F
hle :
∀ i, F i ≤ m0
hadapt :
∀ i,
beta :
ℝ
hb :
0 ≤ beta
hbound :
∀ i w, |stageCoordinateSlope (f i w) j / stageMixtureDensity theta (f i w)| ≤ beta
hmean :
∀ i,
condExp (F i) (mu.withDensity (fun w => ofReal (∏ q ∈ range v, stageMixtureDensity theta (f q w)))) (fun w => stageCoordinateSlope (f i w) j / stageMixtureDensity theta (f i w))
conclusion
(∫ w, |iteratedDeriv k (fun x : ℝ => ∏ i ∈ range v, stageMixtureDensity (update theta j x) (f i w)) (theta j)| ∂mu)
Proof (Lean source)
-- @node: stageProduct_coordinateDerivative_l1
lemma stageProduct_coordinateDerivative_l1 {Ω : Type*} [m0 : MeasurableSpace Ω]
(mu : Measure Ω) (theta : Fin d → ℝ)
(f : ℕ → Ω → PairedSymbol d → ℝ) (j : Fin d) (v k : ℕ)
(hpos : ∀ i < v, ∀ w, 0 < stageMixtureDensity theta (f i w))
(hp : Measurable (fun w => ∏ i ∈ range v,
stageMixtureDensity theta (f i w)))
(hprob : IsProbabilityMeasure (mu.withDensity (fun w => ofReal
(∏ i ∈ range v, stageMixtureDensity theta (f i w)))))
(F : ℕ → MeasurableSpace Ω) (hF : Monotone F) (hle : ∀ i, F i ≤ m0)
(hadapt : ∀ i, Measurable[F (i + 1)] (fun w =>
stageCoordinateSlope (f i w) j / stageMixtureDensity theta (f i w)))
(beta : ℝ) (hb : 0 ≤ beta)
(hbound : ∀ i w, |stageCoordinateSlope (f i w) j /
stageMixtureDensity theta (f i w)| ≤ beta)
(hmean : ∀ i, condExp (F i) (mu.withDensity (fun w => ofReal
(∏ q ∈ range v, stageMixtureDensity theta (f q w))))
(fun w => stageCoordinateSlope (f i w) j /
stageMixtureDensity theta (f i w)) =ᵐ[mu.withDensity (fun w => ofReal
(∏ q ∈ range v, stageMixtureDensity theta (f q w)))] 0) :
(∫ w, |iteratedDeriv k (fun x : ℝ => ∏ i ∈ range v,
stageMixtureDensity (update theta j x) (f i w)) (theta j)| ∂mu) ≤
(k.factorial : ℝ) * sqrt (choose v k) * beta^k := by
let p := fun w => ∏ i ∈ range v, stageMixtureDensity theta (f i w)
let xi := fun i w => stageCoordinateSlope (f i w) j / stageMixtureDensity theta (f i w)
let nu := mu.withDensity (fun w => ofReal (p w))
let : IsProbabilityMeasure nu := hprob
have hp0 : ∀ w, 0 ≤ p w := by
intro w
exact Finset.prod_nonneg fun i hi => le_of_lt (hpos i (Finset.mem_range.mp hi) w)
rw [integral_abs_density_score mu p
(fun w => scoreElementary (fun i => xi i w) v k) _ hp hp0
(k.factorial : ℝ) (by positivity)
(fun w => stageProduct_coordinateDerivative_score theta (fun i => f i w) j v k
(fun i hi => hpos i hi w))]
have hfirst := scoreElementary_martingale_firstMoment nu F hF hle xi hadapt
beta hb hbound hmean v k
calc
_ ≤ (k.factorial : ℝ) * (sqrt (choose v k) * beta^k) :=
mul_le_mul_of_nonneg_left hfirst (by positivity)
_ = _ := by ring
theorem iteratedDeriv_fin_polynomial_eq_zero Lemma iteratedDeriv_fin_polynomial_eq_zero in the paper ↗
Assume the stated hk condition. Every derivative above the degree bound of a finite coefficient polynomial vanishes.
Formal statement
hypotheses
conclusion
iteratedDeriv k (fun y : ℝ => ∑ q, coeff q * y ^ q.val) x = 0
Proof (Lean source)
-- @node: iteratedDeriv_fin_polynomial_eq_zero
lemma iteratedDeriv_fin_polynomial_eq_zero {n k : ℕ} (coeff : Fin (n + 1) → ℝ)
(hk : n < k) (x : ℝ) :
iteratedDeriv k (fun y : ℝ => ∑ q, coeff q * y ^ q.val) x = 0 := by
rw [iteratedDeriv_fun_sum]
· apply Finset.sum_eq_zero
intro q hq
rw [iteratedDeriv_const_mul_field, iteratedDeriv_pow]
have hqk : q.val < k := lt_of_le_of_lt (le_of_lt_succ q.isLt) hk
rw [Nat.descFactorial_eq_zero_iff_lt.mpr hqk]
simp
· intro q hq
fun_prop
theorem densityDerivative_eq_zero_of_coordinate_polynomial
Assume the function hpoly and the stated hk condition. Coordinate polynomiality forces transcript-density derivatives above the sample size to vanish.
Formal statement
hypotheses
n :
ℕ
p :
(Fin d → ℝ) × Q.Seed × ProtocolTranscript Q → ℝ
hpoly :
theta :
Fin d → ℝ
r :
Q.Seed
z :
j :
Fin d
k :
ℕ
hk :
n < k
conclusion
densityDerivative p theta r z j k = 0
Proof (Lean source)
-- @node: densityDerivative_eq_zero_of_coordinate_polynomial
lemma densityDerivative_eq_zero_of_coordinate_polynomial
{Q : LocalProtocol n (ObsRecord d)}
(p : (Fin d → ℝ) × Q.Seed × ProtocolTranscript Q → ℝ)
(hpoly : ∀ theta r z j, ∃ coeff : Fin (n + 1) → ℝ,
∀ x : ℝ, p (update theta j x, r, z) = ∑ q, coeff q * x ^ q.val)
(theta : Fin d → ℝ) (r : Q.Seed) (z : ProtocolTranscript Q)
(j : Fin d) (k : ℕ) (hk : n < k) :
densityDerivative p theta r z j k = 0 := by
obtain ⟨coeff, hcoeff⟩ := hpoly theta r z j
unfold densityDerivative
have hfun : (fun x => p (update theta j x, r, z)) =
(fun x : ℝ => ∑ q, coeff q * x ^ q.val) := funext hcoeff
rw [hfun]
exact iteratedDeriv_fin_polynomial_eq_zero coeff hk (theta j)
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Contraction.ExactCancellation 13 declarations Expanding the finite iid input probabilities into coordinate monomials shows that matching moments above the sample degree identify the prior predictive input law.
Exact cancellation of finite iid experiments
Expanding the finite iid input probabilities into coordinate monomials shows that matching moments above the sample degree identify the prior predictive input law. Applying the same sequential decision kernel preserves this equality.
Grouping repeated coordinates turns a sample monomial into a product of powers. [](.
Formal statement
Proof (Lean source)
-- @node: sampleMonomial_eq_coordinatePowers
lemma sampleMonomial_eq_coordinatePowers (s : Finset (Fin n)) (c : Fin n → Fin d)
(theta : Fin d → ℝ) :
(∏ i ∈ s, theta (c i)) = ∏ j, theta j ^ (s.filter (fun i => c i = j)).card := by
classical
rw [← Finset.prod_fiberwise' s c theta]
simp
Assume the stated hnk condition and the stated hmom condition. Product priors with matching moments give identical sample monomial means.
Formal statement
hypotheses
Proof (Lean source)
-- @node: matchingMoments_sampleMonomial
lemma matchingMoments_sampleMonomial (nu0 nu1 : Measure ℝ)
[IsProbabilityMeasure nu0] [IsProbabilityMeasure nu1]
(k : ℕ) (hnk : n < k) (hmom : MatchingMoments k nu0 nu1)
(s : Finset (Fin n)) (c : Fin n → Fin d) :
(∫ theta, ∏ i ∈ s, theta (c i) ∂productPrior d nu0) =
∫ theta, ∏ i ∈ s, theta (c i) ∂productPrior d nu1 := by
simp_rw [sampleMonomial_eq_coordinatePowers]
unfold productPrior
rw [integral_fintype_prod_eq_prod (fun (j : Fin d) (x : ℝ) => x ^ (s.filter (fun i => c i = j)).card),
integral_fintype_prod_eq_prod (fun (j : Fin d) (x : ℝ) => x ^ (s.filter (fun i => c i = j)).card)]
apply Finset.prod_congr rfl
intro j _
apply hmom
have hcard : (s.filter (fun i => c i = j)).card ≤ n :=
(Finset.card_filter_le _ _).trans (by simpa using Finset.card_le_card (Finset.subset_univ s))
omega
Assume the stated ha condition and the stated hnu condition. Supported sample monomials are integrable without an extra moment assumption.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: integrable_sampleMonomial
lemma integrable_sampleMonomial (a : ℝ) (ha : a ≤ (1/2 : ℝ))
(nu : Measure ℝ) (hnu : AmplitudePrior a nu)
(s : Finset (Fin n)) (c : Fin n → Fin d) :
Integrable (fun theta => ∏ i ∈ s, theta (c i)) (productPrior d nu) := by
letI := hnu.1
haveI : IsProbabilityMeasure (productPrior d nu) := by unfold productPrior; infer_instance
apply Integrable.of_bound
((Finset.measurable_prod s (fun i _ => measurable_pi_apply (c i))).aestronglyMeasurable) 1
filter_upwards [amplitude_productPrior_ae_cube (d := d) a ha nu hnu] with theta htheta
rw [Real.norm_eq_abs, Finset.abs_prod]
calc
(∏ i ∈ s, |theta (c i)|) ≤ ∏ _i ∈ s, (1 : ℝ) := by
apply Finset.prod_le_prod
· intro i _; exact abs_nonneg _
· intro i _
have hi := htheta (c i)
exact (abs_le.mpr hi).trans (by norm_num)
_ = 1 := by simp
Assume the stated ha condition, the stated hnu0 condition, the stated hnu1 condition, the stated hnk condition, and the stated hmom condition. The affine sample likelihood has the same mean under moment-matched product priors.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
a :
ℝ
ha :
a ≤ (1/2 : ℝ)
nu0 nu1 :
Measure ℝ
hnu0 :
AmplitudePrior a nu0
hnu1 :
AmplitudePrior a nu1
k :
ℕ
hnk :
n < k
hmom :
MatchingMoments k nu0 nu1
b :
Fin n → ℝ
Proof (Lean source)
-- @node: matchingMoments_affineSample
lemma matchingMoments_affineSample (a : ℝ) (ha : a ≤ (1/2 : ℝ))
(nu0 nu1 : Measure ℝ) (hnu0 : AmplitudePrior a nu0) (hnu1 : AmplitudePrior a nu1)
(k : ℕ) (hnk : n < k) (hmom : MatchingMoments k nu0 nu1)
(c : Fin n → Fin d) (b : Fin n → ℝ) :
(∫ theta, ∏ i, (1 + b i * theta (c i)) ∂productPrior d nu0) =
∫ theta, ∏ i, (1 + b i * theta (c i)) ∂productPrior d nu1 := by
classical
letI := hnu0.1
letI := hnu1.1
have hexpand (theta : Fin d → ℝ) :
(∏ i, (1 + b i * theta (c i))) =
∑ s ∈ (Finset.univ : Finset (Fin n)).powerset,
(∏ i ∈ s, b i) * ∏ i ∈ s, theta (c i) := by
simp_rw [add_comm (1 : ℝ)]
rw [Finset.prod_add]
simp only [Finset.prod_const_one, mul_one, Finset.prod_mul_distrib]
simp_rw [hexpand]
rw [integral_finsetSum, integral_finsetSum]
· apply Finset.sum_congr rfl
intro s _
rw [integral_const_mul, integral_const_mul,
matchingMoments_sampleMonomial nu0 nu1 k hnk hmom s c]
· intro s _
exact (integrable_sampleMonomial a ha nu1 hnu1 s c).const_mul _
· intro s _
exact (integrable_sampleMonomial a ha nu0 hnu0 s c).const_mul _
theorem observed_symmetric_atom_affine
Assume the stated htheta condition. The observed symmetric-law atom is affine in its cell contrast. [](.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: observed_symmetric_atom_affine
lemma observed_symmetric_atom_affine (theta : Fin d → ℝ)
(htheta : theta ∈ parameterCube d) (o : ObsRecord d) :
(observedLaw (symmetricLaw theta)).real {o} =
(d : ℝ)⁻¹ / 4 * (1 + obsSign o * theta o.1) := by
rw [observedLaw, Measure.real, Measure.map_apply (by fun_prop) MeasurableSet.of_discrete]
change (symmetricLaw theta).real (observe ⁻¹' {o}) = _
rw [symmetricLaw_real_event theta htheta]
rcases o with ⟨j,a,y⟩
cases a <;> cases y <;>
simp [Fintype.sum_prod_type, Fintype.sum_bool, observe, cell, arm, outcome,
outcome0, outcome1, potential, bernMass, obsSign, signVal]
<;> ring
Assume the stated ha condition, the stated hnu0 condition, the stated hnu1 condition, the stated hnk condition, and the stated hmom condition. Moment matching identifies the mean real mass of each iid input vector.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
a :
ℝ
ha :
a ≤ (1/2 : ℝ)
nu0 nu1 :
Measure ℝ
hnu0 :
AmplitudePrior a nu0
hnu1 :
AmplitudePrior a nu1
k :
ℕ
hnk :
n < k
hmom :
MatchingMoments k nu0 nu1
Proof (Lean source)
-- @node: matchingMoments_iid_realMass
lemma matchingMoments_iid_realMass (a : ℝ) (ha : a ≤ (1/2 : ℝ))
(nu0 nu1 : Measure ℝ) (hnu0 : AmplitudePrior a nu0) (hnu1 : AmplitudePrior a nu1)
(k : ℕ) (hnk : n < k) (hmom : MatchingMoments k nu0 nu1)
(o : Fin n → ObsRecord d) :
(∫ theta, ∏ i, (d : ℝ)⁻¹ / 4 * (1 + obsSign (o i) * theta (o i).1)
∂productPrior d nu0) =
∫ theta, ∏ i, (d : ℝ)⁻¹ / 4 * (1 + obsSign (o i) * theta (o i).1)
∂productPrior d nu1 := by
simp_rw [Finset.prod_mul_distrib]
rw [integral_const_mul, integral_const_mul,
matchingMoments_affineSample a ha nu0 nu1 hnu0 hnu1 k hnk hmom]
theorem iid_affineMass_range
Assume positive dimension and the stated htheta condition. The affine iid mass is nonnegative and at most one on the parameter cube.
Formal statement
Proof (Lean source)
-- @node: iid_affineMass_range
lemma iid_affineMass_range (hd : 0 < d) (theta : Fin d → ℝ)
(htheta : theta ∈ parameterCube d) (o : Fin n → ObsRecord d) :
(∏ i, (d : ℝ)⁻¹ / 4 * (1 + obsSign (o i) * theta (o i).1)) ∈ Icc 0 1 := by
haveI := symmetricLaw_probability theta htheta hd
haveI : IsProbabilityMeasure (observedLaw (symmetricLaw theta)) :=
Measure.isProbabilityMeasure_map (by fun_prop)
simp_rw [← observed_symmetric_atom_affine theta htheta]
constructor
· exact Finset.prod_nonneg (fun _ _ => measureReal_nonneg)
· calc
(∏ i, (observedLaw (symmetricLaw theta)).real {o i}) ≤ ∏ _i : Fin n, (1 : ℝ) :=
Finset.prod_le_prod (fun _ _ => measureReal_nonneg) (fun i _ => by
simpa using measureReal_mono (mu := observedLaw (symmetricLaw theta))
(Set.subset_univ ({o i} : Set (ObsRecord d))))
_ = 1 := by simp
Assume positive dimension, the stated ha condition, and the stated hnu condition. The affine iid mass is integrable under each supported product prior.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
hd :
0 < d
a :
ℝ
ha :
a ≤ (1/2 : ℝ)
nu :
Measure ℝ
hnu :
AmplitudePrior a nu
conclusion
Integrable (fun theta => ∏ i, (d : ℝ)⁻¹ / 4 * (1 + obsSign (o i) * theta (o i).1)) (productPrior d nu)
Proof (Lean source)
-- @node: integrable_iid_affineMass
lemma integrable_iid_affineMass (hd : 0 < d) (a : ℝ) (ha : a ≤ (1/2 : ℝ))
(nu : Measure ℝ) (hnu : AmplitudePrior a nu) (o : Fin n → ObsRecord d) :
Integrable (fun theta => ∏ i, (d : ℝ)⁻¹ / 4 *
(1 + obsSign (o i) * theta (o i).1)) (productPrior d nu) := by
letI := hnu.1
haveI : IsProbabilityMeasure (productPrior d nu) := by unfold productPrior; infer_instance
apply Integrable.of_bound
((Finset.measurable_prod univ (fun i _ => by fun_prop)).aestronglyMeasurable) 1
filter_upwards [amplitude_productPrior_ae_cube (d := d) a ha nu hnu] with theta htheta
have h := iid_affineMass_range hd theta htheta o
rw [Real.norm_eq_abs, abs_of_nonneg h.1]
exact h.2
theorem priorPredictive_iid_atom
Assume positive dimension, the stated ha condition, and the stated hnu condition. The clipped iid input mixture's atom equals the integral of its affine mass.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
hd :
0 < d
a :
ℝ
ha :
a ≤ (1/2 : ℝ)
nu :
Measure ℝ
hnu :
AmplitudePrior a nu
conclusion
((productPrior d nu).bind (fun theta => Measure.pi (fun _ : Fin n => observedLaw (symmetricLaw (densityCubeClamp theta))))) {o}
Proof (Lean source)
-- @node: priorPredictive_iid_atom
lemma priorPredictive_iid_atom (hd : 0 < d) (a : ℝ) (ha : a ≤ (1/2 : ℝ))
(nu : Measure ℝ) (hnu : AmplitudePrior a nu) (o : Fin n → ObsRecord d) :
((productPrior d nu).bind (fun theta => Measure.pi (fun _ : Fin n =>
observedLaw (symmetricLaw (densityCubeClamp theta))))) {o} =
ofReal (∫ theta, ∏ i, (d : ℝ)⁻¹ / 4 *
(1 + obsSign (o i) * theta (o i).1) ∂productPrior d nu) := by
have hmeas : Measurable (fun theta : Fin d → ℝ => Measure.pi (fun _ : Fin n =>
observedLaw (symmetricLaw (densityCubeClamp theta)))) := by
apply measurable_finite_iid_inputLaw
· exact (Measure.measurable_map observe (by fun_prop)).comp
(measurable_symmetricLaw_parameter.comp measurable_densityCubeClamp)
· intro theta
haveI := symmetricLaw_probability _ (densityCubeClamp_mem theta) hd
haveI : IsProbabilityMeasure (observedLaw (symmetricLaw (densityCubeClamp theta))) :=
Measure.isProbabilityMeasure_map (by fun_prop)
infer_instance
rw [Measure.bind_apply (measurableSet_singleton _) hmeas.aemeasurable]
rw [ofReal_integral_eq_lintegral_ofReal (integrable_iid_affineMass hd a ha nu hnu o)]
· apply lintegral_congr_ae
filter_upwards [amplitude_productPrior_ae_cube (d := d) a ha nu hnu] with theta htheta
haveI := symmetricLaw_probability theta htheta hd
haveI : IsProbabilityMeasure (observedLaw (symmetricLaw theta)) :=
Measure.isProbabilityMeasure_map (by fun_prop)
rw [densityCubeClamp_eq theta htheta, Measure.pi_singleton]
simp_rw [← observed_symmetric_atom_affine theta htheta]
rw [ENNReal.ofReal_prod_of_nonneg (fun _ _ => measureReal_nonneg)]
apply Finset.prod_congr rfl
intro i _
exact (ENNReal.ofReal_toReal (measure_ne_top (observedLaw (symmetricLaw theta)) {o i})).symm
· filter_upwards [amplitude_productPrior_ae_cube (d := d) a ha nu hnu] with theta htheta
exact (iid_affineMass_range hd theta htheta o).1
theorem matchingMoments_iid_inputLaw
Assume positive dimension, the stated ha condition, the stated hnu0 condition, the stated hnu1 condition, the stated hnk condition, and the stated hmom condition. Matching moments through the sample degree identify the entire finite input mixture.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
hd :
0 < d
a :
ℝ
ha :
a ≤ (1/2 : ℝ)
nu0 nu1 :
Measure ℝ
hnu0 :
AmplitudePrior a nu0
hnu1 :
AmplitudePrior a nu1
k :
ℕ
hnk :
n < k
hmom :
MatchingMoments k nu0 nu1
conclusion
(productPrior d nu0).bind (fun theta => Measure.pi (fun _ : Fin n => observedLaw (symmetricLaw (densityCubeClamp theta))))
= (productPrior d nu1).bind (fun theta => Measure.pi (fun _ : Fin n => observedLaw (symmetricLaw (densityCubeClamp theta))))
Proof (Lean source)
-- @node: matchingMoments_iid_inputLaw
lemma matchingMoments_iid_inputLaw (hd : 0 < d) (a : ℝ) (ha : a ≤ (1/2 : ℝ))
(nu0 nu1 : Measure ℝ) (hnu0 : AmplitudePrior a nu0) (hnu1 : AmplitudePrior a nu1)
(k : ℕ) (hnk : n < k) (hmom : MatchingMoments k nu0 nu1) :
(productPrior d nu0).bind (fun theta => Measure.pi (fun _ : Fin n =>
observedLaw (symmetricLaw (densityCubeClamp theta)))) =
(productPrior d nu1).bind (fun theta => Measure.pi (fun _ : Fin n =>
observedLaw (symmetricLaw (densityCubeClamp theta)))) := by
apply Measure.ext_of_singleton
intro o
rw [priorPredictive_iid_atom hd a ha nu0 hnu0, priorPredictive_iid_atom hd a ha nu1 hnu1,
matchingMoments_iid_realMass a ha nu0 nu1 hnu0 hnu1 k hnk hmom]
Assume measurability of rows and measurability of f. Mapping the output of a measurable mixture commutes with mixing its rows.
Formal statement
hypotheses
Proof (Lean source)
-- @node: map_bind_measurable_rows
lemma map_bind_measurable_rows {I Z W : Type} [MeasurableSpace I]
[MeasurableSpace Z] [MeasurableSpace W] (mu : Measure I) (rows : I → Measure Z)
(hrows : Measurable rows) (f : Z → W) (hf : Measurable f) :
(mu.bind rows).map f = mu.bind (fun i => (rows i).map f) := by
have hm : Measurable (fun i => (rows i).map f) :=
(Measure.measurable_map f hf).comp hrows
ext E hE
rw [Measure.map_apply hf hE, Measure.bind_apply (hf hE) hrows.aemeasurable,
Measure.bind_apply hE hm.aemeasurable]
simp_rw [Measure.map_apply hf hE]
theorem canonicalDecisionLaw_input_bind
Integrate the independent public seed and analyst coin after fixing the iid input vector.
Formal statement
hypotheses
conclusion
= (Measure.pi (fun _ : Fin n => p)).bind (fun o => (Q.seedLaw.prod uniform01).bind (fun ru => (fixedTranscriptLaw Q o ru.1).map (fun z => (z,ru.1,ru.2))))
Proof (Lean source)
-- @node: canonicalDecisionLaw_input_bind
lemma canonicalDecisionLaw_input_bind (Q : LocalProtocol n (ObsRecord d))
(p : Measure (ObsRecord d)) [IsProbabilityMeasure p] :
canonicalDecisionLaw Q p =
(Measure.pi (fun _ : Fin n => p)).bind (fun o =>
(Q.seedLaw.prod uniform01).bind (fun ru =>
(fixedTranscriptLaw Q o ru.1).map (fun z => (z,ru.1,ru.2)))) := by
haveI : IsProbabilityMeasure uniform01 := ⟨by
simp [uniform01, Measure.restrict_apply, Real.volume_Icc]⟩
have hrows (o : Fin n → ObsRecord d) : Measurable (fun ru : Q.Seed × ℝ =>
(fixedTranscriptLaw Q o ru.1).map (fun z => (z,ru.1,ru.2))) :=
(measurable_protocol_decisionRows Q).comp
(show Measurable (fun ru : Q.Seed × ℝ => (o,ru)) by fun_prop)
unfold canonicalDecisionLaw
ext E hE
have hmeas := (Measure.measurable_coe hE).comp (measurable_protocol_decisionRows Q)
simp only [Function.comp_def] at hmeas
rw [Measure.bind_apply hE (measurable_protocol_decisionRows Q).aemeasurable,
lintegral_prod _ hmeas.aemeasurable,
Measure.bind_apply hE (measurable_of_finite _).aemeasurable]
apply lintegral_congr
intro o
rw [Measure.bind_apply hE (hrows o).aemeasurable]
theorem mixtureLaw_eq_of_matching_above_sample
Assume independent and identically distributed participant records, independent protocol randomness, positive dimension, the stated ha condition, the stated hnu0 condition, the stated hnu1 condition, the stated hnk condition, and the stated hmom condition. Exact input cancellation survives arbitrary sequential channels and independent seeds.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
S :
SamplingScheme n d
hIID :
hRandom :
Q :
LocalProtocol n (ObsRecord d)
hd :
0 < d
a :
ℝ
ha :
a ≤ (1/2 : ℝ)
nu0 nu1 :
Measure ℝ
hnu0 :
AmplitudePrior a nu0
hnu1 :
AmplitudePrior a nu1
k :
ℕ
hnk :
n < k
hmom :
MatchingMoments k nu0 nu1
conclusion
mixtureLaw S Q nu0 = mixtureLaw S Q nu1
Proof (Lean source)
-- @node: mixtureLaw_eq_of_matching_above_sample
lemma mixtureLaw_eq_of_matching_above_sample
(S : SamplingScheme n d) (hIID : IidPeople S) (hRandom : IndependentRandomness S)
(Q : LocalProtocol n (ObsRecord d)) (hd : 0 < d)
(a : ℝ) (ha : a ≤ (1/2 : ℝ))
(nu0 nu1 : Measure ℝ) (hnu0 : AmplitudePrior a nu0) (hnu1 : AmplitudePrior a nu1)
(k : ℕ) (hnk : n < k) (hmom : MatchingMoments k nu0 nu1) :
mixtureLaw S Q nu0 = mixtureLaw S Q nu1 := by
let inputRows := fun theta : Fin d → ℝ => Measure.pi (fun _ : Fin n =>
observedLaw (symmetricLaw (densityCubeClamp theta)))
let decisionRows := fun o : Fin n → ObsRecord d =>
(Q.seedLaw.prod uniform01).bind (fun ru =>
(fixedTranscriptLaw Q o ru.1).map (fun z => (z,ru.1,ru.2)))
let seedRows := fun o : Fin n → ObsRecord d =>
(decisionRows o).map (fun w => (w.2.1,w.1))
have hinput : Measurable inputRows := by
apply measurable_finite_iid_inputLaw
· exact (Measure.measurable_map observe (by fun_prop)).comp
(measurable_symmetricLaw_parameter.comp measurable_densityCubeClamp)
· intro theta
haveI := symmetricLaw_probability _ (densityCubeClamp_mem theta) hd
haveI : IsProbabilityMeasure (observedLaw (symmetricLaw (densityCubeClamp theta))) :=
Measure.isProbabilityMeasure_map (by fun_prop)
infer_instance
have hdecision : Measurable decisionRows := measurable_of_finite _
have hseed : Measurable seedRows := measurable_of_finite _
have hcanonical (theta : Fin d → ℝ) :
(canonicalDecisionLaw Q (observedLaw (symmetricLaw (densityCubeClamp theta)))).map
(fun w => (w.2.1,w.1)) = (inputRows theta).bind seedRows := by
haveI := symmetricLaw_probability _ (densityCubeClamp_mem theta) hd
haveI : IsProbabilityMeasure (observedLaw (symmetricLaw (densityCubeClamp theta))) :=
Measure.isProbabilityMeasure_map (by fun_prop)
rw [canonicalDecisionLaw_input_bind]
exact map_bind_measurable_rows _ decisionRows hdecision _ (by fun_prop)
have hmixture (nu : Measure ℝ) (hnu : AmplitudePrior a nu) :
mixtureLaw S Q nu = ((productPrior d nu).bind inputRows).bind seedRows := by
rw [Measure.bind_bind hinput.aemeasurable hseed.aemeasurable]
apply Measure.bind_congr_right
filter_upwards [amplitude_productPrior_ae_cube (d := d) a ha nu hnu] with theta htheta
rw [← hcanonical]
unfold seedTranscriptLaw
rw [clipped_canonicalDecisionLaw_eq S hIID hRandom Q hd theta htheta]
rw [hmixture nu0 hnu0, hmixture nu1 hnu1]
rw [show (productPrior d nu0).bind inputRows = (productPrior d nu1).bind inputRows from
matchingMoments_iid_inputLaw hd a ha nu0 nu1 hnu0 hnu1 k hnk hmom]
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Contraction.FiniteDensity 5 declarations Measurability, domination and real-valued density versions for finite input experiments.
Finite-mixture density helpers
Measurability, domination and real-valued density versions for finite input experiments.
Finite atomic laws depend measurably on their real weights when each atom's weight is measurable in the parameter.
Formal statement
hypotheses
conclusion
Measurable (fun h => atomLaw (w h))
Proof (Lean source)
-- @node: measurable_atomLaw_weights
@[fun_prop] lemma measurable_atomLaw_weights {H I : Type} [MeasurableSpace H]
[MeasurableSpace I] [Fintype I] (w : H → I → ℝ)
(hw : ∀ i, Measurable (fun h => w h i)) : Measurable (fun h => atomLaw (w h)) := by
unfold atomLaw
exact Finset.measurable_sum _ (fun i _ => (hw i).ennreal_ofReal.smul_measure _)
theorem measurable_symmetricLaw_parameter
The symmetric finite full-data construction is measurable in its parameter.
Formal statement
Proof (Lean source)
-- @node: measurable_symmetricLaw_parameter
@[fun_prop] lemma measurable_symmetricLaw_parameter {d : ℕ} :
Measurable (symmetricLaw : (Fin d → ℝ) → Measure (FullRecord d)) := by
unfold symmetricLaw
apply measurable_atomLaw_weights
intro w
unfold bernMass
split_ifs <;> fun_prop
theorem observed_symmetric_zero_atom
Assume positive dimension. At zero contrast every observed record has strictly positive mass.
Formal statement
hypotheses
conclusion
(observedLaw (symmetricLaw (fun _ : Fin d => 0))) {o} ≠ 0
Proof (Lean source)
-- @node: observed_symmetric_zero_atom
lemma observed_symmetric_zero_atom {d : ℕ} (hd : 0 < d) (o : ObsRecord d) :
(observedLaw (symmetricLaw (fun _ : Fin d => 0))) {o} ≠ 0 := by
have hcube : (fun _ : Fin d => (0 : ℝ)) ∈ parameterCube d := by
intro j; constructor <;> norm_num
haveI := symmetricLaw_probability (fun _ : Fin d => 0) hcube hd
haveI : IsProbabilityMeasure (observedLaw (symmetricLaw (fun _ : Fin d => 0))) :=
Measure.isProbabilityMeasure_map (by fun_prop)
have hatom : (observedLaw (symmetricLaw (fun _ : Fin d => 0))).real {o} =
(d : ℝ)⁻¹ / 4 := by
rw [observedLaw, Measure.real, Measure.map_apply (by fun_prop) MeasurableSet.of_discrete]
change (symmetricLaw (fun _ : Fin d => 0)).real (observe ⁻¹' {o}) = _
rw [symmetricLaw_real_event _ hcube]
rcases o with ⟨j,a,y⟩
cases a <;> cases y <;>
simp [Fintype.sum_prod_type, Fintype.sum_bool, observe, cell, arm, outcome,
outcome0, outcome1, potential, bernMass]
<;> ring
intro hz
have : (0 : ℝ) < (d : ℝ)⁻¹ / 4 := by positivity
rw [Measure.real, hz, ENNReal.toReal_zero] at hatom
linarith
Assume measurability of rows and the stated hpos condition. A mixture with positive mass on every finite input dominates every other mixture of the same rows, regardless of the output space.
Formal statement
hypotheses
conclusion
mu.bind rows ≪ nu.bind rows
Proof (Lean source)
-- @node: finite_bind_absolutelyContinuous
lemma finite_bind_absolutelyContinuous {I Z : Type} [Fintype I]
[MeasurableSpace I] [MeasurableSingletonClass I] [MeasurableSpace Z]
(mu nu : Measure I) (rows : I → Measure Z) (hrows : Measurable rows)
(hpos : ∀ i, nu {i} ≠ 0) : mu.bind rows ≪ nu.bind rows := by
intro E hE
have hEm := measurableSet_toMeasurable (nu.bind rows) E
have hzero : (nu.bind rows) (toMeasurable (nu.bind rows) E) = 0 := by
rwa [measure_toMeasurable]
rw [Measure.bind_apply hEm hrows.aemeasurable, lintegral_fintype] at hzero
have hrow : ∀ i, rows i (toMeasurable (nu.bind rows) E) = 0 := by
intro i
have hi := (Finset.sum_eq_zero_iff.mp hzero) i (Finset.mem_univ i)
exact (mul_eq_zero.mp hi).resolve_right (hpos i)
apply le_antisymm _ zero_le
calc
_ ≤ (mu.bind rows) (toMeasurable (nu.bind rows) E) :=
measure_mono (subset_toMeasurable _ _)
_ = 0 := by
rw [Measure.bind_apply hEm hrows.aemeasurable, lintegral_fintype]
simp [hrow]
Assume measurable Radon–Nikodym densities for dominated kernels and the stated absolute-continuity property. The cited kernel RN gate supplies jointly measurable real densities for dominated Markov kernels; finiteness of each row permits conversion from extended densities.
Formal statement
hypotheses
H Z :
K L :
hac :
∀ h, K h ≪ L h
conclusion
∃ f : H × Z → ℝ,
Proof (Lean source)
-- @node: real_kernel_density_of_gate
lemma real_kernel_density_of_gate (hRN : MeasurableKernelRadonNikodym)
{H Z : Type} [MeasurableSpace H] [MeasurableSpace Z] [StandardBorelSpace Z]
(K L : Kernel H Z) [IsMarkovKernel K] [IsMarkovKernel L]
(hac : ∀ h, K h ≪ L h) :
∃ f : H × Z → ℝ, Measurable f ∧ ∀ h,
(L h).withDensity (fun z => ofReal (f (h,z))) = K h := by
obtain ⟨f, hf, hrep⟩ := hRN K L hac
refine ⟨fun w => (f w).toReal, hf.ennreal_toReal, ?_⟩
intro h
have hfin : (∫⁻ z, f (h,z) ∂L h) < ∞ := by
have hu := hrep h univ MeasurableSet.univ
rw [setLIntegral_univ] at hu
rw [← hu]
exact measure_lt_top _ _
have hae : ∀ᵐ z ∂L h, f (h,z) ≠ ∞ := by
exact (ae_lt_top (show Measurable (fun z => f (h,z)) by fun_prop) hfin.ne).mono
(fun z hz => hz.ne)
ext E hE
rw [withDensity_apply _ hE, hrep h E hE]
apply lintegral_congr_ae
filter_upwards [ae_restrict_of_ae hae] with z hz
exact ENNReal.ofReal_toReal hz
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Contraction.HistoryScore 15 declarations Fresh-input message kernels and the structural product density identify the actual history-message law.
Transcript-history martingale scores
Fresh-input message kernels and the structural product density identify the actual history-message law. Repaired row scores are adapted bounded martingale differences, giving the binomial elementary-score first-moment bound.
theorem transcript_score_condExp_zero_of_jointLaw Lemma transcript_score_condExp_zero_of_jointLaw in the paper ↗
Assume measurability of x, measurability of y, the stated hlaw condition, measurability of s, the stated hb condition, and the stated hzero condition. A bounded score centered in each conditional message law is centered given history under any transcript law with the corresponding history-message marginal.
Formal statement
hypotheses
Ω H Z :
mu :
rho :
K :
Kernel H Z
X :
Ω → H
Y :
Ω → Z
hX :
hY :
hlaw :
mu.map (fun w => (X w, Y w)) = rho ⊗ₘ K
s :
H × Z → ℝ
hs :
b :
ℝ
hb :
∀ w, |s w| ≤ b
hzero :
∀ h, (∫ z, s (h, z) ∂K h) = 0
conclusion
mu[(fun w => s (X w, Y w)) | comap X inferInstance] =ᵐ[mu] 0
Proof (Lean source)
-- @node: transcript_score_condExp_zero_of_jointLaw
lemma transcript_score_condExp_zero_of_jointLaw
{Ω H Z : Type*} [MeasurableSpace Ω] [MeasurableSpace H] [MeasurableSpace Z]
(mu : Measure Ω) [IsProbabilityMeasure mu]
(rho : Measure H) [IsProbabilityMeasure rho] (K : Kernel H Z) [IsMarkovKernel K]
(X : Ω → H) (Y : Ω → Z) (hX : Measurable X) (hY : Measurable Y)
(hlaw : mu.map (fun w => (X w, Y w)) = rho ⊗ₘ K)
(s : H × Z → ℝ) (hs : Measurable s) (b : ℝ)
(hb : ∀ w, |s w| ≤ b) (hzero : ∀ h, (∫ z, s (h, z) ∂K h) = 0) :
mu[(fun w => s (X w, Y w)) | comap X inferInstance] =ᵐ[mu] 0 := by
have hint : Integrable (fun w => s (X w, Y w)) mu :=
Integrable.of_bound (hs.comp (hX.prodMk hY)).aestronglyMeasurable b
(Filter.Eventually.of_forall fun w => by simpa only [Real.norm_eq_abs] using hb _)
apply (ae_eq_condExp_of_forall_setIntegral_eq hX.comap_le hint
(fun t _ _ => (integrable_const (0 : ℝ)).integrableOn) ?_
(stronglyMeasurable_const.aestronglyMeasurable)).symm
intro t ht hfinite
obtain ⟨A, hA, rfl⟩ := MeasurableSpace.measurableSet_comap.mp ht
rw [integral_zero]
let g : H × Z → ℝ := (A ×ˢ univ).indicator s
have hg : Measurable g := hs.indicator (hA.prod MeasurableSet.univ)
have hgb : ∀ w, |g w| ≤ max b 0 := by
intro w
by_cases hw : w ∈ A ×ˢ univ
· simpa [g, Set.indicator_of_mem hw] using (hb w).trans (le_max_left b 0)
· simp [g, Set.indicator_of_notMem hw]
have heq : (fun w => (X ⁻¹' A).indicator (fun w => s (X w, Y w)) w) =
(fun w => g (X w, Y w)) := by
funext w
by_cases hw : X w ∈ A <;> simp [g, indicator, hw]
rw [← integral_indicator (hX hA), heq,
← integral_map (hX.prodMk hY).aemeasurable hg.aestronglyMeasurable, hlaw]
rw [integral_compProd_bounded
rho K _ rfl g hg (max b 0) hgb]
symm
calc
_ = ∫ h, (0 : ℝ) ∂rho := by
apply integral_congr_ae
filter_upwards [] with h
by_cases hh : h ∈ A
· simpa [g, indicator, hh] using hzero h
· simp [g, indicator, hh]
_ = 0 := by simp
def stageParameterKernel
Fix the local protocol Q, the function theta, and the participant index. The conditional message kernel obtained by integrating a fresh paired input.
Definition (Lean source)
parameters
def
given by
⟨fun w
=> (pairedLaw theta).bind (fun a => averagedKernel Q i ((a, w.1), w.2)), by apply Measure.measurable_of_measurable_coe intro E hE have hr (w : Q.Seed × ProtocolHistory Q i) : Measurable (fun a : PairedSymbol d => averagedKernel Q i ((a, w.1), w.2)) := by fun_prop simp_rw [Measure.bind_apply hE (hr _).aemeasurable, lintegral_fintype] exact Finset.measurable_sum _ (fun a _ => ((averagedKernel Q i).measurable_coe hE |>.comp (by fun_prop)).mul measurable_const)⟩
theorem stageParameterKernel_markov
Assume the stated htheta condition and positive dimension. The fresh-input message kernels have unit mass on the parameter cube.
Formal statement
hypotheses
n d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
theta :
Fin d → ℝ
htheta :
theta ∈ parameterCube d
hd :
0 < d
i :
Fin n
conclusion
IsMarkovKernel (stageParameterKernel Q theta i)
Proof (Lean source)
-- @node: stageParameterKernel_markov
lemma stageParameterKernel_markov {n d : ℕ} (Q : LocalProtocol n (ObsRecord d))
(theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d) (hd : 0 < d)
(i : Fin n) : IsMarkovKernel (stageParameterKernel Q theta i) := by
haveI : IsProbabilityMeasure (pairedLaw theta) :=
pairedFamily_subset_simplex hd (Set.mem_image_of_mem pairedLaw htheta)
constructor
intro w
change IsProbabilityMeasure ((pairedLaw theta).bind
(fun a => averagedKernel Q i ((a, w.1), w.2)))
constructor
rw [Measure.bind_apply MeasurableSet.univ (by fun_prop)]
have hm (a : PairedSymbol d) : averagedKernel Q i ((a, w.1), w.2) univ = 1 := by
letI := averagedKernel_markov Q i
exact measure_univ
simp [hm]
theorem stageParameterKernel_withDensity
Assume the stated htheta condition, measurability of f, the stated hf0 condition, and the Markov kernel hrow. Repaired row densities represent the fresh-input message kernel.
Formal statement
hypotheses
n d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
theta :
Fin d → ℝ
htheta :
theta ∈ parameterCube d
i :
Fin n
r :
Q.Seed
eta :
ProtocolHistory Q i
f :
((PairedSymbol d × Q.Seed) × ProtocolHistory Q i) × Q.Message i → ℝ
hf :
hf0 :
∀ w, 0 ≤ f w
hrow :
∀ a,
(stageReferenceKernel Q i (r, eta)).withDensity (fun z => ofReal (f (((a, r), eta), z)))
= averagedKernel Q i ((a, r), eta)
conclusion
(stageReferenceKernel Q i (r, eta)).withDensity (fun z => ofReal (stageMixtureDensity theta (fun a => f (((a, r), eta), z))))
= stageParameterKernel Q theta i (r, eta)
Proof (Lean source)
-- @node: stageParameterKernel_withDensity
lemma stageParameterKernel_withDensity {n d : ℕ} (Q : LocalProtocol n (ObsRecord d))
(theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d) (i : Fin n)
(r : Q.Seed) (eta : ProtocolHistory Q i)
(f : ((PairedSymbol d × Q.Seed) × ProtocolHistory Q i) × Q.Message i → ℝ)
(hf : Measurable f) (hf0 : ∀ w, 0 ≤ f w)
(hrow : ∀ a, (stageReferenceKernel Q i (r, eta)).withDensity
(fun z => ofReal (f (((a, r), eta), z))) = averagedKernel Q i ((a, r), eta)) :
(stageReferenceKernel Q i (r, eta)).withDensity
(fun z => ofReal (stageMixtureDensity theta (fun a => f (((a, r), eta), z)))) =
stageParameterKernel Q theta i (r, eta) := by
exact finite_weighted_density_bind _ (stageInputWeight theta)
(stageInputWeight_nonneg theta htheta) _
(fun a => hf.comp (by fun_prop)) (fun a z => hf0 _) _ (by fun_prop) hrow
theorem originalTranscript_eq_parameterChain
Assume positive dimension, the stated htheta condition, measurability of f, the stated hf0 condition, the Markov kernel hrow, the stated href condition, and the stated hprod condition. Structural iteration of the conditional message densities identifies the parameter-specific chain with the original-record transcript experiment.
Formal statement
hypotheses
n d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
hd :
0 < d
theta :
Fin d → ℝ
htheta :
theta ∈ parameterCube d
r :
Q.Seed
f :
hf :
∀ i, Measurable (f i)
hf0 :
∀ i w, 0 ≤ f i w
hrow :
∀ i a eta,
(stageReferenceKernel Q i (r, eta)).withDensity (fun z => ofReal (f i (((a, r), eta), z)))
= averagedKernel Q i ((a, r), eta)
href :
stageReferenceTranscriptLaw Q r = referenceLaw Q r
hprod :
(referenceLaw Q r).withDensity (fun z => ofReal (∏ i : Fin n, stageMixtureDensity theta (fun a => f i (((a, r), take (le_of_lt i.isLt) z), z i))))
= conditionalTranscriptLaw Q theta r
conclusion
conditionalTranscriptLaw Q theta r
= transcriptLaw (stageParameterKernel Q theta) (fun _ => r)
Proof (Lean source)
-- @node: originalTranscript_eq_parameterChain
lemma originalTranscript_eq_parameterChain {n d : ℕ}
(Q : LocalProtocol n (ObsRecord d)) (hd : 0 < d)
(theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d) (r : Q.Seed)
(f : (i : Fin n) →
((PairedSymbol d × Q.Seed) × ProtocolHistory Q i) × Q.Message i → ℝ)
(hf : ∀ i, Measurable (f i)) (hf0 : ∀ i w, 0 ≤ f i w)
(hrow : ∀ i a eta, (stageReferenceKernel Q i (r, eta)).withDensity
(fun z => ofReal (f i (((a, r), eta), z))) = averagedKernel Q i ((a, r), eta))
(href : stageReferenceTranscriptLaw Q r = referenceLaw Q r)
(hprod : (referenceLaw Q r).withDensity (fun z => ofReal
(∏ i : Fin n, stageMixtureDensity theta
(fun a => f i (((a, r), take (le_of_lt i.isLt) z), z i)))) =
conditionalTranscriptLaw Q theta r) :
conditionalTranscriptLaw Q theta r =
transcriptLaw (stageParameterKernel Q theta) (fun _ => r) := by
let g := fun (i : Fin n) (w : ProtocolHistory Q i × Q.Message i) =>
ofReal (stageMixtureDensity theta (fun a => f i (((a, r), w.1), w.2)))
have hg : ∀ i, Measurable (g i) := by
intro i
unfold g stageMixtureDensity
exact (Finset.measurable_sum _ (fun a _ =>
measurable_const.mul ((hf i).comp (by fun_prop)))).ennreal_ofReal
have hchain := sequentialPrefixDensity_withDensity (stageReferenceKernel Q)
(stageParameterKernel Q theta) (fun i => stageReferenceKernel_markov Q i hd)
(stageParameterKernel_markov Q theta htheta hd) (fun _ => r) (fun _ => r) g hg
(fun i eta => stageParameterKernel_withDensity Q theta htheta i r eta (f i)
(hf i) (hf0 i) (fun a => hrow i a eta)) n le_rfl
change (stageReferenceTranscriptLaw Q r).withDensity
(sequentialPrefixDensity g n le_rfl) = _ at hchain
have hfun : sequentialPrefixDensity g n le_rfl =
(fun z : ProtocolTranscript Q => ofReal (∏ i : Fin n,
stageMixtureDensity theta
(fun a => f i (((a, r), take (le_of_lt i.isLt) z), z i)))) := by
funext z
rw [sequentialPrefixDensity_eq_prod, ENNReal.ofReal_prod_of_nonneg]
· rfl
· intro i hi
exact Finset.sum_nonneg (fun a _ =>
mul_nonneg (stageInputWeight_nonneg theta htheta a) (hf0 i _))
rw [href, hfun, hprod] at hchain
exact hchain
theorem originalTranscript_map_take_next
Assume positive dimension, the stated htheta condition, and the Markov kernel hchain. The actual transcript law has the fresh-input history-message marginal, including on adaptive histories in arbitrary standard-Borel message spaces.
Formal statement
hypotheses
n d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
hd :
0 < d
theta :
Fin d → ℝ
htheta :
theta ∈ parameterCube d
r :
Q.Seed
hchain :
conditionalTranscriptLaw Q theta r
= transcriptLaw (stageParameterKernel Q theta) (fun _ => r)
i :
Fin n
conclusion
= (prefixLaw (stageParameterKernel Q theta) (fun _ => r) i.val (le_of_lt i.isLt)) ⊗ₘ (stageParameterKernel Q theta i).comap (fun eta => (r, eta)) (by fun_prop)
Proof (Lean source)
-- @node: originalTranscript_map_take_next
lemma originalTranscript_map_take_next {n d : ℕ}
(Q : LocalProtocol n (ObsRecord d)) (hd : 0 < d)
(theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d) (r : Q.Seed)
(hchain : conditionalTranscriptLaw Q theta r =
transcriptLaw (stageParameterKernel Q theta) (fun _ => r)) (i : Fin n) :
(conditionalTranscriptLaw Q theta r).map
(fun z => (take (le_of_lt i.isLt) z, z i)) =
(prefixLaw (stageParameterKernel Q theta) (fun _ => r) i.val
(le_of_lt i.isLt)) ⊗ₘ
(stageParameterKernel Q theta i).comap (fun eta => (r, eta)) (by fun_prop) := by
rw [hchain]
exact transcriptLaw_map_take_next (stageParameterKernel Q theta)
(stageParameterKernel_markov Q theta htheta hd) (fun _ => r) i.val i.isLt
theorem originalTranscript_stageScore_condExp_zero
Assume positive dimension, the stated htheta condition, a nonnegative privacy budget, measurability of f, the stated hbound condition, the stated hpriv condition, the Markov kernel hrow, and the Markov kernel hchain. The repaired coordinate score has zero conditional expectation given the actual original-record transcript history.
Formal statement
hypotheses
n d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
hd :
0 < d
theta :
Fin d → ℝ
htheta :
theta ∈ parameterCube d
r :
Q.Seed
eps :
ℝ
heps :
0 ≤ eps
f :
hf :
∀ i, Measurable (f i)
hpriv :
∀ i a b r eta z, f i (((a, r), eta), z) ≤ exp eps * f i (((b, r), eta), z)
hrow :
∀ i a eta,
(stageReferenceKernel Q i (r, eta)).withDensity (fun z => ofReal (f i (((a, r), eta), z)))
= averagedKernel Q i ((a, r), eta)
hchain :
conditionalTranscriptLaw Q theta r
= transcriptLaw (stageParameterKernel Q theta) (fun _ => r)
i :
Fin n
j :
Fin d
conclusion
(conditionalTranscriptLaw Q theta r)[(fun z => stageCoordinateSlope (fun a => f i (((a, r), take (le_of_lt i.isLt) z), z i)) j / stageMixtureDensity theta (fun a => f i (((a, r), take (le_of_lt i.isLt) z), z i))) | comap (take (le_of_lt i.isLt) : ProtocolTranscript Q → ProtocolHistory Q i) inferInstance]
=ᵐ[ conditionalTranscriptLaw Q theta r] 0
Proof (Lean source)
-- @node: originalTranscript_stageScore_condExp_zero
lemma originalTranscript_stageScore_condExp_zero {n d : ℕ}
(Q : LocalProtocol n (ObsRecord d)) (hd : 0 < d)
(theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d) (r : Q.Seed)
(eps : ℝ) (heps : 0 ≤ eps)
(f : (i : Fin n) →
((PairedSymbol d × Q.Seed) × ProtocolHistory Q i) × Q.Message i → ℝ)
(hf : ∀ i, Measurable (f i))
(hbound : ∀ i w, exp (-eps) ≤ f i w ∧ f i w ≤ exp eps)
(hpriv : ∀ i a b r eta z,
f i (((a, r), eta), z) ≤ exp eps * f i (((b, r), eta), z))
(hrow : ∀ i a eta, (stageReferenceKernel Q i (r, eta)).withDensity
(fun z => ofReal (f i (((a, r), eta), z))) = averagedKernel Q i ((a, r), eta))
(hchain : conditionalTranscriptLaw Q theta r =
transcriptLaw (stageParameterKernel Q theta) (fun _ => r)) (i : Fin n) (j : Fin d) :
(conditionalTranscriptLaw Q theta r)[(fun z =>
stageCoordinateSlope (fun a => f i (((a, r), take (le_of_lt i.isLt) z), z i)) j /
stageMixtureDensity theta (fun a => f i (((a, r), take (le_of_lt i.isLt) z), z i))) |
comap (take (le_of_lt i.isLt) :
ProtocolTranscript Q → ProtocolHistory Q i) inferInstance] =ᵐ[
conditionalTranscriptLaw Q theta r] 0 := by
letI := conditionalTranscriptLaw_probability Q theta htheta hd r
letI := stageParameterKernel_markov Q theta htheta hd i
letI := isProbabilityMeasure_prefixLaw (stageParameterKernel Q theta)
(stageParameterKernel_markov Q theta htheta hd) (fun _ => r) i.val (le_of_lt i.isLt)
let s := fun w : ProtocolHistory Q i × Q.Message i =>
stageCoordinateSlope (fun a => f i (((a, r), w.1), w.2)) j /
stageMixtureDensity theta (fun a => f i (((a, r), w.1), w.2))
have hs : Measurable s := by
unfold s stageCoordinateSlope stageMixtureDensity
fun_prop
have hscore (eta : ProtocolHistory Q i) (z : Q.Message i) :=
stageCoordinateScore_bound hd theta htheta (fun a => f i (((a, r), eta), z))
(fun a => lt_of_lt_of_le (Real.exp_pos _) (hbound i _).1) eps heps
(fun a b => hpriv i a b r eta z) j
apply transcript_score_condExp_zero_of_jointLaw _ _
((stageParameterKernel Q theta i).comap (fun eta => (r, eta)) (by fun_prop))
(take (le_of_lt i.isLt)) (fun z => z i)
(measurable_restrictHistory _ _ _) (by fun_prop)
(originalTranscript_map_take_next Q hd theta htheta r hchain i)
s hs (derivativeScale d eps) (fun w => (hscore w.1 w.2).2)
intro eta
change (∫ z, s (eta, z) ∂stageParameterKernel Q theta i (r, eta)) = 0
rw [← stageParameterKernel_withDensity Q theta htheta i r eta (f i) (hf i)
(fun w => le_trans (le_of_lt (Real.exp_pos _)) (hbound i w).1)
(fun a => hrow i a eta)]
letI := stageReferenceKernel_markov Q i hd
letI := averagedKernel_markov Q i
apply stageCoordinateScore_integral_zero (stageReferenceKernel Q i (r, eta))
(fun a z => f i (((a, r), eta), z))
(fun a => (hf i).comp (by fun_prop))
(fun a z => le_trans (le_of_lt (Real.exp_pos _)) (hbound i _).1)
(exp eps)
· intro a z
rw [abs_of_nonneg (le_trans (le_of_lt (Real.exp_pos _)) (hbound i _).1)]
exact (hbound i _).2
· intro a
rw [hrow]
infer_instance
· intro z
exact (hscore eta z).1
def transcriptHistorySpace
Fix the local protocol Q and the natural-number parameter v. Transcript information available by a stage, held constant after the horizon.
Definition (Lean source)
parameters
def
given by
if hv : v
≤ n then comap (take hv : ProtocolTranscript Q → History Q.Message v hv) inferInstance else inferInstance
theorem transcriptHistorySpace_le
Every history sigma-algebra is contained in the full transcript sigma-algebra.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: transcriptHistorySpace_le
lemma transcriptHistorySpace_le {n d : ℕ} (Q : LocalProtocol n (ObsRecord d)) (v : ℕ) :
transcriptHistorySpace Q v ≤ (inferInstance : MeasurableSpace (ProtocolTranscript Q)) := by
unfold transcriptHistorySpace
split_ifs with hv
· exact (measurable_restrictHistory _ _ _).comap_le
· exact le_rfl
theorem transcriptHistorySpace_mono
Transcript histories form an increasing family of sub-sigma-algebras.
Formal statement
Proof (Lean source)
-- @node: transcriptHistorySpace_mono
lemma transcriptHistorySpace_mono {n d : ℕ} (Q : LocalProtocol n (ObsRecord d)) :
Monotone (transcriptHistorySpace Q) := by
intro v w hvw
by_cases hw : w ≤ n
· have hv : v ≤ n := hvw.trans hw
unfold transcriptHistorySpace
rw [dif_pos hv, dif_pos hw]
apply Measurable.comap_le
have htake : Measurable[comap (take hw :
ProtocolTranscript Q → History Q.Message w hw) inferInstance]
(take hw : ProtocolTranscript Q → History Q.Message w hw) :=
Measurable.of_comap_le le_rfl
exact (measurable_restrictHistory _ _ hvw).comp htake
· simpa only [transcriptHistorySpace, dif_neg hw] using transcriptHistorySpace_le Q v
def transcriptCoordinateScore
Fix the local protocol Q, the function theta, the public seed, the function f, the coordinate index, the natural-number parameter v, and the protocol transcript. The conditional coordinate scores are extended by zero after the horizon.
Definition (Lean source)
parameters
def
transcriptCoordinateScore Q theta r f j v z :
ℝ
given by
if hv : v < n then stageCoordinateSlope (fun a => f ⟨v, hv⟩ (((a, r), take (le_of_lt hv) z), z ⟨v, hv⟩)) j / stageMixtureDensity theta (fun a => f ⟨v, hv⟩ (((a, r), take (le_of_lt hv) z), z ⟨v, hv⟩)) else 0
theorem transcriptCoordinateScore_adapted
Each stage score is measurable once its message has been observed when the repaired row densities are measurable.
Formal statement
hypotheses
n d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
theta :
Fin d → ℝ
r :
Q.Seed
f :
hf :
∀ i, Measurable (f i)
j :
Fin d
v :
ℕ
conclusion
Proof (Lean source)
-- @node: transcriptCoordinateScore_adapted
@[fun_prop] lemma transcriptCoordinateScore_adapted {n d : ℕ}
(Q : LocalProtocol n (ObsRecord d)) (theta : Fin d → ℝ) (r : Q.Seed)
(f : (i : Fin n) →
((PairedSymbol d × Q.Seed) × ProtocolHistory Q i) × Q.Message i → ℝ)
(hf : ∀ i, Measurable (f i)) (j : Fin d) (v : ℕ) :
Measurable[transcriptHistorySpace Q (v + 1)] (transcriptCoordinateScore Q theta r f j v) := by
unfold transcriptCoordinateScore transcriptHistorySpace
by_cases hv : v < n
· rw [dif_pos (succ_le_of_lt hv)]
simp only [dif_pos hv]
have htake : Measurable[comap (take (succ_le_of_lt hv) :
ProtocolTranscript Q → History Q.Message (v + 1) (succ_le_of_lt hv)) inferInstance]
(take (succ_le_of_lt hv) : ProtocolTranscript Q →
History Q.Message (v + 1) (succ_le_of_lt hv)) :=
Measurable.of_comap_le le_rfl
have hs : Measurable (fun u : History Q.Message (v + 1) (succ_le_of_lt hv) =>
stageCoordinateSlope
(fun a => f ⟨v, hv⟩ (((a, r), init (succ_le_of_lt hv) u), last (succ_le_of_lt hv) u)) j /
stageMixtureDensity theta
(fun a => f ⟨v, hv⟩ (((a, r), init (succ_le_of_lt hv) u), last (succ_le_of_lt hv) u))) := by
have hi := (measurable_fst.comp (measurable_init_last (Z := Q.Message) (succ_le_of_lt hv)))
have hl := (measurable_snd.comp (measurable_init_last (Z := Q.Message) (succ_le_of_lt hv)))
unfold stageCoordinateSlope stageMixtureDensity
fun_prop
convert hs.comp htake using 1
funext z
have hi : init (succ_le_of_lt hv) (take (succ_le_of_lt hv) z) =
take (le_of_lt hv) z := by
funext a
rfl
simp only [Function.comp_apply, hi]
rfl
· simp only [dif_neg hv]
exact measurable_const
theorem transcriptCoordinateScore_bound
Assume positive dimension, the stated htheta condition, a nonnegative privacy budget, the stated hbound condition, and the stated hpriv condition. The sharp privacy envelope bounds all scores, including their zero extension.
Formal statement
hypotheses
n d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
hd :
0 < d
theta :
Fin d → ℝ
htheta :
theta ∈ parameterCube d
r :
Q.Seed
eps :
ℝ
heps :
0 ≤ eps
f :
hbound :
∀ i w, exp (-eps) ≤ f i w
hpriv :
∀ i a b r eta z, f i (((a, r), eta), z) ≤ exp eps * f i (((b, r), eta), z)
j :
Fin d
v :
ℕ
z :
conclusion
|transcriptCoordinateScore Q theta r f j v z| ≤ derivativeScale d eps
Proof (Lean source)
-- @node: transcriptCoordinateScore_bound
lemma transcriptCoordinateScore_bound {n d : ℕ}
(Q : LocalProtocol n (ObsRecord d)) (hd : 0 < d)
(theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d) (r : Q.Seed)
(eps : ℝ) (heps : 0 ≤ eps)
(f : (i : Fin n) →
((PairedSymbol d × Q.Seed) × ProtocolHistory Q i) × Q.Message i → ℝ)
(hbound : ∀ i w, exp (-eps) ≤ f i w)
(hpriv : ∀ i a b r eta z,
f i (((a, r), eta), z) ≤ exp eps * f i (((b, r), eta), z))
(j : Fin d) (v : ℕ) (z : ProtocolTranscript Q) :
|transcriptCoordinateScore Q theta r f j v z| ≤ derivativeScale d eps := by
by_cases hv : v < n
· simp only [transcriptCoordinateScore, dif_pos hv]
exact (originalTranscript_stageScore_bound Q hd theta htheta eps heps f hbound hpriv
r z ⟨v, hv⟩ j).2
· simp only [transcriptCoordinateScore, dif_neg hv, abs_zero]
unfold derivativeScale
exact div_nonneg (sub_nonneg.mpr (Real.one_le_exp_iff.mpr heps)) (by positivity)
theorem transcriptCoordinateScore_condExp_zero
Assume positive dimension, the stated htheta condition, a nonnegative privacy budget, measurability of f, the stated hbound condition, the stated hpriv condition, the Markov kernel hrow, and the Markov kernel hchain. The extended scores are martingale differences for transcript history.
Formal statement
hypotheses
n d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
hd :
0 < d
theta :
Fin d → ℝ
htheta :
theta ∈ parameterCube d
r :
Q.Seed
eps :
ℝ
heps :
0 ≤ eps
f :
hf :
∀ i, Measurable (f i)
hpriv :
∀ i a b r eta z, f i (((a, r), eta), z) ≤ exp eps * f i (((b, r), eta), z)
hrow :
∀ i a eta,
(stageReferenceKernel Q i (r, eta)).withDensity (fun z => ofReal (f i (((a, r), eta), z)))
= averagedKernel Q i ((a, r), eta)
hchain :
conditionalTranscriptLaw Q theta r
= transcriptLaw (stageParameterKernel Q theta) (fun _ => r)
j :
Fin d
v :
ℕ
conclusion
(conditionalTranscriptLaw Q theta r)[transcriptCoordinateScore Q theta r f j v | transcriptHistorySpace Q v]
=ᵐ[conditionalTranscriptLaw Q theta r] 0
Proof (Lean source)
-- @node: transcriptCoordinateScore_condExp_zero
lemma transcriptCoordinateScore_condExp_zero {n d : ℕ}
(Q : LocalProtocol n (ObsRecord d)) (hd : 0 < d)
(theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d) (r : Q.Seed)
(eps : ℝ) (heps : 0 ≤ eps)
(f : (i : Fin n) →
((PairedSymbol d × Q.Seed) × ProtocolHistory Q i) × Q.Message i → ℝ)
(hf : ∀ i, Measurable (f i))
(hbound : ∀ i w, exp (-eps) ≤ f i w ∧ f i w ≤ exp eps)
(hpriv : ∀ i a b r eta z,
f i (((a, r), eta), z) ≤ exp eps * f i (((b, r), eta), z))
(hrow : ∀ i a eta, (stageReferenceKernel Q i (r, eta)).withDensity
(fun z => ofReal (f i (((a, r), eta), z))) = averagedKernel Q i ((a, r), eta))
(hchain : conditionalTranscriptLaw Q theta r =
transcriptLaw (stageParameterKernel Q theta) (fun _ => r)) (j : Fin d) (v : ℕ) :
(conditionalTranscriptLaw Q theta r)[transcriptCoordinateScore Q theta r f j v |
transcriptHistorySpace Q v] =ᵐ[conditionalTranscriptLaw Q theta r] 0 := by
unfold transcriptCoordinateScore transcriptHistorySpace
by_cases hv : v < n
· simpa only [dif_pos hv, dif_pos (le_of_lt hv)] using
originalTranscript_stageScore_condExp_zero Q hd theta htheta r eps heps f hf hbound
hpriv hrow hchain ⟨v, hv⟩ j
· simp only [dif_neg hv]
change (conditionalTranscriptLaw Q theta r)[(0 : ProtocolTranscript Q → ℝ) | _] =ᵐ[_] 0
rw [condExp_zero]
theorem originalTranscript_scoreElementary_firstMoment
Assume positive dimension, the stated htheta condition, a nonnegative privacy budget, measurability of f, the stated hbound condition, the stated hpriv condition, the Markov kernel hrow, and the Markov kernel hchain. Transcript martingale certification gives the binomial first-moment bound for the elementary score polynomial under the actual experiment law.
Formal statement
hypotheses
n d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
hd :
0 < d
theta :
Fin d → ℝ
htheta :
theta ∈ parameterCube d
r :
Q.Seed
eps :
ℝ
heps :
0 ≤ eps
f :
hf :
∀ i, Measurable (f i)
hpriv :
∀ i a b r eta z, f i (((a, r), eta), z) ≤ exp eps * f i (((b, r), eta), z)
hrow :
∀ i a eta,
(stageReferenceKernel Q i (r, eta)).withDensity (fun z => ofReal (f i (((a, r), eta), z)))
= averagedKernel Q i ((a, r), eta)
hchain :
conditionalTranscriptLaw Q theta r
= transcriptLaw (stageParameterKernel Q theta) (fun _ => r)
j :
Fin d
k :
ℕ
conclusion
(∫ z, |scoreElementary (fun v => transcriptCoordinateScore Q theta r f j v z) n k| ∂conditionalTranscriptLaw Q theta r)
Proof (Lean source)
-- @node: originalTranscript_scoreElementary_firstMoment
lemma originalTranscript_scoreElementary_firstMoment {n d : ℕ}
(Q : LocalProtocol n (ObsRecord d)) (hd : 0 < d)
(theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d) (r : Q.Seed)
(eps : ℝ) (heps : 0 ≤ eps)
(f : (i : Fin n) →
((PairedSymbol d × Q.Seed) × ProtocolHistory Q i) × Q.Message i → ℝ)
(hf : ∀ i, Measurable (f i))
(hbound : ∀ i w, exp (-eps) ≤ f i w ∧ f i w ≤ exp eps)
(hpriv : ∀ i a b r eta z,
f i (((a, r), eta), z) ≤ exp eps * f i (((b, r), eta), z))
(hrow : ∀ i a eta, (stageReferenceKernel Q i (r, eta)).withDensity
(fun z => ofReal (f i (((a, r), eta), z))) = averagedKernel Q i ((a, r), eta))
(hchain : conditionalTranscriptLaw Q theta r =
transcriptLaw (stageParameterKernel Q theta) (fun _ => r)) (j : Fin d) (k : ℕ) :
(∫ z, |scoreElementary (fun v => transcriptCoordinateScore Q theta r f j v z) n k|
∂conditionalTranscriptLaw Q theta r) ≤
sqrt (choose n k) * (derivativeScale d eps)^k := by
letI := conditionalTranscriptLaw_probability Q theta htheta hd r
refine scoreElementary_martingale_firstMoment _ (transcriptHistorySpace Q)
(transcriptHistorySpace_mono Q) (transcriptHistorySpace_le Q)
(transcriptCoordinateScore Q theta r f j)
(transcriptCoordinateScore_adapted Q theta r f hf j) (derivativeScale d eps) ?_ ?_ ?_ n k
· unfold derivativeScale
exact div_nonneg (sub_nonneg.mpr (Real.one_le_exp_iff.mpr heps)) (by positivity)
· exact transcriptCoordinateScore_bound Q hd theta htheta r eps heps f
(fun i w => (hbound i w).1) hpriv j
· exact transcriptCoordinateScore_condExp_zero Q hd theta htheta r eps heps f hf hbound
hpriv hrow hchain j
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Contraction.JointSeed 8 declarations The sampling atoms identify the joint seed/transcript law with the fixed-seed experiment integrated against the same independent public-seed law.
Public-seed disintegration of supported transcript mixtures
The sampling atoms identify the joint seed/transcript law with the fixed-seed experiment integrated against the same independent public-seed law. Supported product priors can then be integrated before the public seed.
theorem measurable_clipped_seedTranscriptRows
Appending the public seed to the clipped conditional experiment is jointly measurable when the record dimension is positive.
Formal statement
hypotheses
conclusion
Measurable (fun w : (Fin d → ℝ) × Q.Seed => (conditionalTranscriptLaw Q (densityCubeClamp w.1) w.2).map (fun z => (w.2,z)))
Proof (Lean source)
-- @node: measurable_clipped_seedTranscriptRows
@[fun_prop] lemma measurable_clipped_seedTranscriptRows
(Q : LocalProtocol n (ObsRecord d)) (hd : 0 < d) :
Measurable (fun w : (Fin d → ℝ) × Q.Seed =>
(conditionalTranscriptLaw Q (densityCubeClamp w.1) w.2).map
(fun z => (w.2,z))) := by
let κ : Kernel ((Fin d → ℝ) × Q.Seed) (ProtocolTranscript Q) :=
⟨fun w => conditionalTranscriptLaw Q (densityCubeClamp w.1) w.2,
measurable_conditionalTranscriptLaw_clipped Q hd⟩
haveI : IsMarkovKernel κ := ⟨fun w =>
conditionalTranscriptLaw_probability Q _ (densityCubeClamp_mem w.1) hd w.2⟩
let η : Kernel (((Fin d → ℝ) × Q.Seed) × ProtocolTranscript Q)
(Q.Seed × ProtocolTranscript Q) :=
Kernel.deterministic (fun w => (w.1.2,w.2)) (by fun_prop)
have heq : (fun w : (Fin d → ℝ) × Q.Seed =>
(conditionalTranscriptLaw Q (densityCubeClamp w.1) w.2).map (fun z => (w.2,z))) =
((κ ⊗ₖ η).map snd) := by
funext w
rw [Kernel.map_apply _ measurable_snd]
ext E hE
rw [Measure.map_apply (by fun_prop) hE,
Measure.map_apply measurable_snd hE, Kernel.compProd_apply (measurable_snd hE)]
simp only [η, Kernel.deterministic_apply]
change _ = ∫⁻ z, (Measure.dirac (w.2,z)) E ∂κ w
simp only [Measure.dirac_apply' _ hE]
change _ = ∫⁻ z, indicator ((fun z => (w.2,z)) ⁻¹' E) 1 z ∂κ w
rw [lintegral_indicator
((show Measurable (fun z : ProtocolTranscript Q => (w.2,z)) by fun_prop) hE)]
simp [κ]
rw [heq]
exact Kernel.measurable _
theorem seedTranscriptLaw_conditional_bind
Assume independent and identically distributed participant records, independent protocol randomness, positive dimension, and the stated htheta condition. The sampling assumptions give the common-seed representation at every cube parameter.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
S :
SamplingScheme n d
hIID :
hRandom :
Q :
LocalProtocol n (ObsRecord d)
hd :
0 < d
theta :
Fin d → ℝ
htheta :
theta ∈ parameterCube d
conclusion
seedTranscriptLaw S Q (symmetricLaw theta)
= Q.seedLaw.bind (fun r => (conditionalTranscriptLaw Q theta r).map (fun z => (r,z)))
Proof (Lean source)
-- @node: seedTranscriptLaw_conditional_bind
lemma seedTranscriptLaw_conditional_bind
(S : SamplingScheme n d) (hIID : IidPeople S) (hRandom : IndependentRandomness S)
(Q : LocalProtocol n (ObsRecord d)) (hd : 0 < d)
(theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d) :
seedTranscriptLaw S Q (symmetricLaw theta) =
Q.seedLaw.bind (fun r => (conditionalTranscriptLaw Q theta r).map (fun z => (r,z))) := by
haveI := symmetricLaw_probability theta htheta hd
haveI : IsProbabilityMeasure (observedLaw (symmetricLaw theta)) :=
Measure.isProbabilityMeasure_map (by fun_prop)
haveI := sampling_decisionLaw_probability S hIID hRandom Q _
(symmetricLaw_causalModel theta htheta hd)
haveI : IsProbabilityMeasure (seedTranscriptLaw S Q (symmetricLaw theta)) :=
Measure.isProbabilityMeasure_map (by fun_prop)
haveI : IsProbabilityMeasure uniform01 := ⟨by
simp [uniform01, Measure.restrict_apply, Real.volume_Icc]⟩
have hrows : Measurable (fun r : Q.Seed =>
(conditionalTranscriptLaw Q theta r).map (fun z => (r,z))) := by
simpa only [Function.comp_def, densityCubeClamp_eq theta htheta] using
(measurable_clipped_seedTranscriptRows Q hd).comp
(show Measurable (fun r : Q.Seed => (theta,r)) by fun_prop)
apply Measure.ext_prod
intro F E hF hE
rw [seedTranscriptLaw, Measure.map_apply (by fun_prop) (hF.prod hE)]
have hpre : (fun w : DecisionSpace Q => (w.2.1,w.1)) ⁻¹' (F ×ˢ E) =
E ×ˢ F ×ˢ univ := by ext w; simp [and_comm]
rw [hpre, decisionLaw, iid_sampling_inputLaw S hIID hRandom Q _
(symmetricLaw_causalModel theta htheta hd),
product_decisionRows_rectangle Q _ E F univ hE hF MeasurableSet.univ]
simp only [measure_univ, mul_one]
rw [Measure.bind_apply (hF.prod hE) hrows.aemeasurable]
have hr (r : Q.Seed) :
((conditionalTranscriptLaw Q theta r).map (fun z => (r,z))) (F ×ˢ E) =
F.indicator (fun r => conditionalTranscriptLaw Q theta r E) r := by
rw [Measure.map_apply (by fun_prop) (hF.prod hE)]
by_cases h : r ∈ F
· simp [h, preimage, Set.indicator_of_mem]
· simp [h, preimage, Set.indicator_of_notMem]
simp_rw [hr]
have hm : Measurable (fun w : (Fin n → ObsRecord d) × Q.Seed =>
F.indicator (fun r => fixedTranscriptLaw Q w.1 r E) w.2) :=
((Measure.measurable_coe hE).comp (measurable_fixedTranscriptLaw Q)).indicator
(measurable_snd hF)
rw [lintegral_lintegral_swap hm.aemeasurable]
apply lintegral_congr
intro r
by_cases h : r ∈ F
· simp only [Set.indicator_of_mem h]
rw [conditionalTranscriptLaw, Measure.bind_apply hE
(show Measurable (fun o => fixedTranscriptLaw Q o r) by fun_prop).aemeasurable]
· simp [h]
Assume measurability of rows. Jointly measurable measure rows remain measurable after integrating one independent index.
Formal statement
hypotheses
conclusion
Measurable (fun a => nu.bind (fun b => rows (a,b)))
Proof (Lean source)
-- @node: measurable_bind_product_rows
lemma measurable_bind_product_rows {A B Z : Type} [MeasurableSpace A]
[MeasurableSpace B] [MeasurableSpace Z] (nu : Measure B) [SFinite nu]
(rows : A × B → Measure Z) (hrows : Measurable rows) :
Measurable (fun a => nu.bind (fun b => rows (a,b))) := by
apply Measure.measurable_of_measurable_coe
intro E hE
have hsection (a : A) : Measurable (fun b => rows (a,b)) :=
hrows.comp (by fun_prop)
simp_rw [Measure.bind_apply hE (hsection _).aemeasurable]
exact ((Measure.measurable_coe hE).comp hrows).lintegral_prod_right'
Assume measurability of rows. Independent mixing indices commute for jointly measurable measure rows.
Formal statement
Proof (Lean source)
-- @node: bind_product_rows_swap
lemma bind_product_rows_swap {A B Z : Type} [MeasurableSpace A]
[MeasurableSpace B] [MeasurableSpace Z] (mu : Measure A) (nu : Measure B)
[SFinite mu] [SFinite nu] (rows : A × B → Measure Z) (hrows : Measurable rows) :
mu.bind (fun a => nu.bind (fun b => rows (a,b))) =
nu.bind (fun b => mu.bind (fun a => rows (a,b))) := by
have hleft := measurable_bind_product_rows nu rows hrows
have hright := measurable_bind_product_rows mu (fun w : B × A => rows (w.2,w.1))
(hrows.comp measurable_swap)
ext E hE
rw [Measure.bind_apply hE hleft.aemeasurable,
Measure.bind_apply hE hright.aemeasurable]
have ha (a : A) : Measurable (fun b => rows (a,b)) := hrows.comp (by fun_prop)
have hb (b : B) : Measurable (fun a => rows (a,b)) := hrows.comp (by fun_prop)
simp_rw [Measure.bind_apply hE (ha _).aemeasurable,
Measure.bind_apply hE (hb _).aemeasurable]
exact lintegral_lintegral_swap ((Measure.measurable_coe hE).comp hrows).aemeasurable
theorem mixtureLaw_common_seed_bind
Assume independent and identically distributed participant records, independent protocol randomness, positive dimension, the stated ha condition, and the stated hnu condition. Supported product priors mix conditionally before the independent public seed.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
S :
SamplingScheme n d
hIID :
hRandom :
Q :
LocalProtocol n (ObsRecord d)
hd :
0 < d
a :
ℝ
ha :
a ≤ (1 / 2 : ℝ)
nu :
Measure ℝ
hnu :
AmplitudePrior a nu
conclusion
mixtureLaw S Q nu
= Q.seedLaw.bind (fun r => (productPrior d nu).bind (fun theta => (conditionalTranscriptLaw Q (densityCubeClamp theta) r).map (fun z => (r,z))))
Proof (Lean source)
-- @node: mixtureLaw_common_seed_bind
lemma mixtureLaw_common_seed_bind
(S : SamplingScheme n d) (hIID : IidPeople S) (hRandom : IndependentRandomness S)
(Q : LocalProtocol n (ObsRecord d)) (hd : 0 < d)
(a : ℝ) (ha : a ≤ (1 / 2 : ℝ)) (nu : Measure ℝ) (hnu : AmplitudePrior a nu) :
mixtureLaw S Q nu = Q.seedLaw.bind (fun r =>
(productPrior d nu).bind (fun theta =>
(conditionalTranscriptLaw Q (densityCubeClamp theta) r).map (fun z => (r,z)))) := by
letI := hnu.1
haveI : IsProbabilityMeasure (productPrior d nu) := by
unfold productPrior
infer_instance
rw [← bind_product_rows_swap (productPrior d nu) Q.seedLaw _
(measurable_clipped_seedTranscriptRows Q hd)]
apply Measure.bind_congr_right
filter_upwards [amplitude_productPrior_ae_cube (d := d) a ha nu hnu] with theta htheta
rw [densityCubeClamp_eq theta htheta]
exact seedTranscriptLaw_conditional_bind S hIID hRandom Q hd theta htheta
theorem probability_bind_withDensity_average Lemma probability_bind_withDensity_average in the paper ↗
Assume measurability of rows, the stated probability-measure property, measurability of p, the stated hnonneg condition, and the stated hdensity condition. A probability mixture has the prior-averaged real density against its common reference. This is the arbitrary-parameter version of the scalar-prior mixture likelihood identity.
Formal statement
hypotheses
T Z :
pi :
mu :
Measure Z
SigmaFinite mu
rows :
T → Measure Z
hrows :
Measurable rows
hprob :
∀ t, IsProbabilityMeasure (rows t)
p :
T × Z → ℝ
hp :
hnonneg :
∀ w, 0 ≤ p w
hdensity :
∀ t, rows t = mu.withDensity (fun z => ofReal (p (t,z)))
conclusion
pi.bind rows = mu.withDensity (fun z => ofReal (∫ t, p (t,z) ∂pi))
Proof (Lean source)
-- @node: probability_bind_withDensity_average
lemma probability_bind_withDensity_average {T Z : Type} [MeasurableSpace T]
[MeasurableSpace Z] (pi : Measure T) [IsProbabilityMeasure pi]
(mu : Measure Z) [SigmaFinite mu] (rows : T → Measure Z) (hrows : Measurable rows)
(hprob : ∀ t, IsProbabilityMeasure (rows t)) (p : T × Z → ℝ)
(hp : Measurable p) (hnonneg : ∀ w, 0 ≤ p w)
(hdensity : ∀ t, rows t = mu.withDensity (fun z => ofReal (p (t,z)))) :
pi.bind rows = mu.withDensity (fun z => ofReal (∫ t, p (t,z) ∂pi)) := by
have hmass (t : T) : ∫⁻ z, ofReal (p (t,z)) ∂mu = 1 := by
rw [← Measure.restrict_univ (μ := mu), ← withDensity_apply _ MeasurableSet.univ, ← hdensity t]
exact (hprob t).measure_univ
have hjoint : Integrable p (pi.prod mu) := by
refine ⟨hp.aestronglyMeasurable, ?_⟩
apply (hasFiniteIntegral_iff_ofReal (ae_of_all _ hnonneg)).2
rw [lintegral_prod _ hp.ennreal_ofReal.aemeasurable]
simp_rw [hmass]
simp
have havg : ∀ᵐ z ∂mu,
ofReal (∫ t, p (t,z) ∂pi) = ∫⁻ t, ofReal (p (t,z)) ∂pi := by
filter_upwards [hjoint.prod_left_ae] with z hz
exact ofReal_integral_eq_lintegral_ofReal hz (ae_of_all _ (fun t => hnonneg (t,z)))
ext E hE
rw [Measure.bind_apply hE hrows.aemeasurable, withDensity_apply _ hE]
simp_rw [hdensity, withDensity_apply _ hE]
calc
_ = ∫⁻ z in E, ∫⁻ t, ofReal (p (t,z)) ∂pi ∂mu :=
lintegral_lintegral_swap hp.ennreal_ofReal.aemeasurable
_ = _ := by
apply lintegral_congr_ae
filter_upwards [ae_restrict_of_ae havg] with z hz
exact hz.symm
theorem conditionalMixture_withDensity_average
Assume positive dimension, the stated hp condition, the stated ha condition, and the stated hnu condition. The supported fixed-seed mixture is represented by the average of the given density version.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
hd :
0 < d
eps :
ℝ
p :
(Fin d → ℝ) × Q.Seed × ProtocolTranscript Q → ℝ
hp :
DensityCertificate Q eps p
r :
Q.Seed
a :
ℝ
ha :
a ≤ (1 / 2 : ℝ)
nu :
Measure ℝ
hnu :
AmplitudePrior a nu
conclusion
Proof (Lean source)
-- @node: conditionalMixture_withDensity_average
lemma conditionalMixture_withDensity_average
(Q : LocalProtocol n (ObsRecord d)) (hd : 0 < d) (eps : ℝ)
(p : (Fin d → ℝ) × Q.Seed × ProtocolTranscript Q → ℝ)
(hp : DensityCertificate Q eps p) (r : Q.Seed)
(a : ℝ) (ha : a ≤ (1 / 2 : ℝ)) (nu : Measure ℝ) (hnu : AmplitudePrior a nu) :
(productPrior d nu).bind (fun theta =>
conditionalTranscriptLaw Q (densityCubeClamp theta) r) =
(referenceLaw Q r).withDensity (fun z =>
ofReal (∫ theta, p (theta,r,z) ∂productPrior d nu)) := by
letI := hnu.1
haveI : IsProbabilityMeasure (productPrior d nu) := by
unfold productPrior
infer_instance
have hzero : (fun _ : Fin d => (0 : ℝ)) ∈ parameterCube d := by
intro j; constructor <;> norm_num
haveI : IsProbabilityMeasure (referenceLaw Q r) :=
conditionalTranscriptLaw_probability Q _ hzero hd r
have hrows : Measurable (fun theta : Fin d → ℝ =>
conditionalTranscriptLaw Q (densityCubeClamp theta) r) := by
simpa only [Function.comp_def] using
(measurable_conditionalTranscriptLaw_clipped Q hd).comp
(show Measurable (fun theta : Fin d → ℝ => (theta,r)) from
measurable_id.prodMk measurable_const)
have hmeas : Measurable (fun w : (Fin d → ℝ) × ProtocolTranscript Q =>
p (densityCubeClamp w.1,r,w.2)) := by
simpa only [Function.comp_def] using hp.1.comp
((measurable_densityCubeClamp.comp measurable_fst).prodMk
(measurable_const.prodMk measurable_snd))
have heq := probability_bind_withDensity_average (productPrior d nu) (referenceLaw Q r)
(fun theta : Fin d → ℝ => conditionalTranscriptLaw Q (densityCubeClamp theta) r) hrows
(fun theta => conditionalTranscriptLaw_probability Q _ (densityCubeClamp_mem theta) hd r)
(fun w : (Fin d → ℝ) × ProtocolTranscript Q => p (densityCubeClamp w.1,r,w.2))
hmeas
(fun w => (hp.2.1 _ (densityCubeClamp_mem w.1) r).1 w.2)
(fun theta => (hp.2.1 _ (densityCubeClamp_mem theta) r).2.symm)
refine heq.trans ?_
congr 1
funext z
congr 1
apply integral_congr_ae
filter_upwards [amplitude_productPrior_ae_cube (d := d) a ha nu hnu] with theta htheta
rw [densityCubeClamp_eq theta htheta]
theorem mixtureLaw_seed_density_average
Assume independent and identically distributed participant records, independent protocol randomness, positive dimension, the stated hp condition, the stated ha condition, and the stated hnu condition. Joint seed/transcript mixtures use the same seed law and the prior-integrated conditional density, including arbitrary public seeds of law-zero mass.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
S :
SamplingScheme n d
hIID :
hRandom :
Q :
LocalProtocol n (ObsRecord d)
hd :
0 < d
eps :
ℝ
p :
(Fin d → ℝ) × Q.Seed × ProtocolTranscript Q → ℝ
hp :
DensityCertificate Q eps p
a :
ℝ
ha :
a ≤ (1 / 2 : ℝ)
nu :
Measure ℝ
hnu :
AmplitudePrior a nu
conclusion
mixtureLaw S Q nu
= Q.seedLaw.bind (fun r => ((referenceLaw Q r).withDensity (fun z => ofReal (∫ theta, p (theta,r,z) ∂productPrior d nu))).map (fun z => (r,z)))
Proof (Lean source)
-- @node: mixtureLaw_seed_density_average
lemma mixtureLaw_seed_density_average
(S : SamplingScheme n d) (hIID : IidPeople S) (hRandom : IndependentRandomness S)
(Q : LocalProtocol n (ObsRecord d)) (hd : 0 < d) (eps : ℝ)
(p : (Fin d → ℝ) × Q.Seed × ProtocolTranscript Q → ℝ)
(hp : DensityCertificate Q eps p)
(a : ℝ) (ha : a ≤ (1 / 2 : ℝ)) (nu : Measure ℝ) (hnu : AmplitudePrior a nu) :
mixtureLaw S Q nu = Q.seedLaw.bind (fun r =>
((referenceLaw Q r).withDensity (fun z =>
ofReal (∫ theta, p (theta,r,z) ∂productPrior d nu))).map
(fun z => (r,z))) := by
rw [mixtureLaw_common_seed_bind S hIID hRandom Q hd a ha nu hnu]
apply Measure.bind_congr_right
apply Filter.Eventually.of_forall
intro r
change (productPrior d nu).bind (fun theta =>
(conditionalTranscriptLaw Q (densityCubeClamp theta) r).map (fun z => (r,z))) =
((referenceLaw Q r).withDensity (fun z =>
ofReal (∫ theta, p (theta,r,z) ∂productPrior d nu))).map (fun z => (r,z))
rw [← conditionalMixture_withDensity_average Q hd eps p hp r a ha nu hnu]
exact (map_bind_measurable_rows (productPrior d nu) _
(by
simpa only [Function.comp_def] using
(measurable_conditionalTranscriptLaw_clipped Q hd).comp
(show Measurable (fun theta : Fin d → ℝ => (theta,r)) from
measurable_id.prodMk measurable_const)) _
(by fun_prop)).symm
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Contraction.Mixture 7 declarations Finite original-record private value frontiers: Helpers/Contraction/Mixture.
Helpers/Contraction/Mixture
Finite original-record private value frontiers: Helpers/Contraction/Mixture.
Assume measurability of p, measurability of q, the stated hp0 condition, the stated hq0 condition, the stated hmu condition, and the stated hnu condition. Probability densities against a common reference obey the half-L1 TV bound.
Formal statement
Proof (Lean source)
-- @node: probability_density_tv_le_half_L1
lemma probability_density_tv_le_half_L1 {Z : Type*} [MeasurableSpace Z]
(mu nu xi : Measure Z) [IsProbabilityMeasure mu] [IsProbabilityMeasure nu]
[IsProbabilityMeasure xi] (p q : Z → ℝ) (hp : Measurable p) (hq : Measurable q)
(hp0 : ∀ z, 0 ≤ p z) (hq0 : ∀ z, 0 ≤ q z)
(hmu : mu = xi.withDensity (fun z => ofReal (p z)))
(hnu : nu = xi.withDensity (fun z => ofReal (q z))) :
tvDist mu nu ≤ (1/2 : ℝ) * ∫ z, |p z - q z| ∂xi := by
have hacp : mu ≪ xi := hmu ▸ withDensity_absolutelyContinuous xi _
have hacq : nu ≪ xi := hnu ▸ withDensity_absolutelyContinuous xi _
have hrp : (fun z => (mu.rnDeriv xi z).toReal) =ᵐ[xi] p := by
have h := hmu ▸ Measure.rnDeriv_withDensity xi hp.ennreal_ofReal
filter_upwards [h] with z hz
rw [hz, ENNReal.toReal_ofReal (hp0 z)]
have hrq : (fun z => (nu.rnDeriv xi z).toReal) =ᵐ[xi] q := by
have h := hnu ▸ Measure.rnDeriv_withDensity xi hq.ennreal_ofReal
filter_upwards [h] with z hz
rw [hz, ENNReal.toReal_ofReal (hq0 z)]
have hpi : Integrable p xi := Measure.integrable_toReal_rnDeriv.congr hrp
have hqi : Integrable q xi := Measure.integrable_toReal_rnDeriv.congr hrq
have hp1 : ∫ z, p z ∂xi = 1 := by
rw [← integral_congr_ae hrp, Measure.integral_toReal_rnDeriv hacp]; simp
have hq1 : ∫ z, q z ∂xi = 1 := by
rw [← integral_congr_ae hrq, Measure.integral_toReal_rnDeriv hacq]; simp
refine ciSup_le fun E => ?_
have hgap : mu.real E.1 - nu.real E.1 = ∫ z in E.1, (p z - q z) ∂xi := by
rw [← Measure.setIntegral_toReal_rnDeriv hacp,
← Measure.setIntegral_toReal_rnDeriv hacq,
integral_congr_ae (ae_restrict_of_ae hrp),
integral_congr_ae (ae_restrict_of_ae hrq),
integral_sub hpi.integrableOn hqi.integrableOn]
rw [hgap]
exact abs_setIntegral_le_half_integral_abs_of_integral_eq_zero
(hpi.sub hqi) (by change (∫ z, p z - q z ∂xi) = 0; rw [integral_sub hpi hqi, hp1, hq1, sub_self]) E.2
Assume measurability of m, the stated probability-measure property, and the set hE. Real event masses of measurable probability mixtures are averages of row masses.
Formal statement
hypotheses
A Z :
mu :
rows :
A → Measure Z
hm :
Measurable rows
hprob :
∀ a, IsProbabilityMeasure (rows a)
E :
Set Z
hE :
Proof (Lean source)
-- @node: probability_bind_real_event
lemma probability_bind_real_event {A Z : Type*} [MeasurableSpace A] [MeasurableSpace Z]
(mu : Measure A) [IsProbabilityMeasure mu] (rows : A → Measure Z)
(hm : Measurable rows) (hprob : ∀ a, IsProbabilityMeasure (rows a))
(E : Set Z) (hE : MeasurableSet E) :
(mu.bind rows).real E = ∫ a, (rows a).real E ∂mu := by
letI : ∀ a, IsProbabilityMeasure (rows a) := hprob
rw [measureReal_def, Measure.bind_apply hE hm.aemeasurable]
exact (integral_toReal
(((Measure.measurable_coe hE).comp hm).aemeasurable)
(ae_of_all _ (fun a => measure_lt_top (rows a) E))).symm
Assume measurability of m0, measurability of m1, the stated probability-measure property, the stated probability-measure property, and the stated b condition. A uniform rowwise TV bound survives mixing with the same independent seed law.
Formal statement
hypotheses
A Z :
mu :
rows0 rows1 :
A → Measure Z
hm0 :
Measurable rows0
hm1 :
Measurable rows1
hprob0 :
∀ a, IsProbabilityMeasure (rows0 a)
hprob1 :
∀ a, IsProbabilityMeasure (rows1 a)
B :
ℝ
hB :
∀ a, tvDist (rows0 a) (rows1 a) ≤ B
conclusion
tvDist (mu.bind rows0) (mu.bind rows1) ≤ B
Proof (Lean source)
-- @node: probability_bind_tv_le_constant
lemma probability_bind_tv_le_constant {A Z : Type*} [MeasurableSpace A] [MeasurableSpace Z]
(mu : Measure A) [IsProbabilityMeasure mu] (rows0 rows1 : A → Measure Z)
(hm0 : Measurable rows0) (hm1 : Measurable rows1)
(hprob0 : ∀ a, IsProbabilityMeasure (rows0 a))
(hprob1 : ∀ a, IsProbabilityMeasure (rows1 a))
(B : ℝ) (hB : ∀ a, tvDist (rows0 a) (rows1 a) ≤ B) :
tvDist (mu.bind rows0) (mu.bind rows1) ≤ B := by
letI : ∀ a, IsProbabilityMeasure (rows0 a) := hprob0
letI : ∀ a, IsProbabilityMeasure (rows1 a) := hprob1
refine ciSup_le fun E => ?_
have hi0 : Integrable (fun a => (rows0 a).real E.1) mu :=
Integrable.of_bound (((Measure.measurable_coe E.2).comp hm0).ennreal_toReal.aestronglyMeasurable)
1 (ae_of_all _ fun a => by
rw [Real.norm_eq_abs, abs_of_nonneg measureReal_nonneg]; exact measureReal_le_one)
have hi1 : Integrable (fun a => (rows1 a).real E.1) mu :=
Integrable.of_bound (((Measure.measurable_coe E.2).comp hm1).ennreal_toReal.aestronglyMeasurable)
1 (ae_of_all _ fun a => by
rw [Real.norm_eq_abs, abs_of_nonneg measureReal_nonneg]; exact measureReal_le_one)
rw [probability_bind_real_event mu rows0 hm0 hprob0 E.1 E.2,
probability_bind_real_event mu rows1 hm1 hprob1 E.1 E.2,
← integral_sub hi0 hi1]
calc
_ ≤ ∫ a, |(rows0 a).real E.1 - (rows1 a).real E.1| ∂mu := abs_integral_le_integral_abs
_ ≤ ∫ _a, B ∂mu := integral_mono_ae (hi0.sub hi1).abs (integrable_const B)
(ae_of_all _ fun a => (abs_measureReal_sub_le_tvDist E.2).trans (hB a))
_ = B := by simp
Assume measurability of f. Applying a measurable transcript map cannot increase TV.
Formal statement
hypotheses
X Y :
mu nu :
f :
X → Y
hf :
Proof (Lean source)
-- @node: probability_tv_map_le
lemma probability_tv_map_le {X Y : Type*} [MeasurableSpace X] [MeasurableSpace Y]
(mu nu : Measure X) [IsProbabilityMeasure mu] [IsProbabilityMeasure nu]
(f : X → Y) (hf : Measurable f) :
tvDist (mu.map f) (nu.map f) ≤ tvDist mu nu := by
refine ciSup_le fun E => ?_
simp only [measureReal_def, Measure.map_apply hf E.2]
exact abs_measureReal_sub_le_tvDist (E.2.preimage hf)
theorem conditionalMixture_density_measurable_nonneg
Assume the stated hp condition, the stated ha condition, and the stated hnu condition. The supported conditional mixture has a measurable, nonnegative real density.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
eps :
ℝ
p :
(Fin d → ℝ) × Q.Seed × ProtocolTranscript Q → ℝ
hp :
DensityCertificate Q eps p
r :
Q.Seed
a :
ℝ
ha :
a ≤ (1/2 : ℝ)
nu :
Measure ℝ
hnu :
AmplitudePrior a nu
conclusion
conclusion 1
Proof (Lean source)
-- @node: conditionalMixture_density_measurable_nonneg
lemma conditionalMixture_density_measurable_nonneg
(Q : LocalProtocol n (ObsRecord d)) (eps : ℝ)
(p : (Fin d → ℝ) × Q.Seed × ProtocolTranscript Q → ℝ)
(hp : DensityCertificate Q eps p) (r : Q.Seed)
(a : ℝ) (ha : a ≤ (1/2 : ℝ)) (nu : Measure ℝ) (hnu : AmplitudePrior a nu) :
Measurable (fun z => ∫ theta, p (theta,r,z) ∂productPrior d nu) ∧
∀ z, 0 ≤ ∫ theta, p (theta,r,z) ∂productPrior d nu := by
letI := hnu.1
haveI : IsProbabilityMeasure (productPrior d nu) := by unfold productPrior; infer_instance
constructor
· exact (hp.1.comp (show Measurable
(fun w : (Fin d → ℝ) × ProtocolTranscript Q => (w.1,r,w.2)) by fun_prop)
).stronglyMeasurable.integral_prod_left' (μ := productPrior d nu) |>.measurable
· intro z
apply integral_nonneg_of_ae
filter_upwards [amplitude_productPrior_ae_cube (d := d) a ha nu hnu] with theta htheta
exact (hp.2.1 theta htheta r).1 z
theorem conditionalMixture_tv_le_half_L1
Assume positive dimension, the stated hp condition, the stated ha condition, the stated hnu0 condition, and the stated hnu1 condition. Fixed-seed supported transcript mixtures obey their density L1 bound.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
hd :
0 < d
eps :
ℝ
p :
(Fin d → ℝ) × Q.Seed × ProtocolTranscript Q → ℝ
hp :
DensityCertificate Q eps p
r :
Q.Seed
a :
ℝ
ha :
a ≤ (1/2 : ℝ)
nu0 nu1 :
Measure ℝ
hnu0 :
AmplitudePrior a nu0
hnu1 :
AmplitudePrior a nu1
conclusion
tvDist ((productPrior d nu0).bind (fun theta => conditionalTranscriptLaw Q (densityCubeClamp theta) r)) ((productPrior d nu1).bind (fun theta => conditionalTranscriptLaw Q (densityCubeClamp theta) r))
Proof (Lean source)
-- @node: conditionalMixture_tv_le_half_L1
lemma conditionalMixture_tv_le_half_L1
(Q : LocalProtocol n (ObsRecord d)) (hd : 0 < d) (eps : ℝ)
(p : (Fin d → ℝ) × Q.Seed × ProtocolTranscript Q → ℝ)
(hp : DensityCertificate Q eps p) (r : Q.Seed)
(a : ℝ) (ha : a ≤ (1/2 : ℝ)) (nu0 nu1 : Measure ℝ)
(hnu0 : AmplitudePrior a nu0) (hnu1 : AmplitudePrior a nu1) :
tvDist
((productPrior d nu0).bind (fun theta => conditionalTranscriptLaw Q (densityCubeClamp theta) r))
((productPrior d nu1).bind (fun theta => conditionalTranscriptLaw Q (densityCubeClamp theta) r)) ≤
(1/2 : ℝ) * ∫ z, |(∫ theta, p (theta,r,z) ∂productPrior d nu0) -
∫ theta, p (theta,r,z) ∂productPrior d nu1| ∂referenceLaw Q r := by
have hm : Measurable (fun theta => conditionalTranscriptLaw Q (densityCubeClamp theta) r) := by
simpa only [Function.comp_def] using (measurable_conditionalTranscriptLaw_clipped Q hd).comp
(show Measurable (fun theta : Fin d → ℝ => (theta,r)) by fun_prop)
have hprob (nu : Measure ℝ) (hnu : AmplitudePrior a nu) :
IsProbabilityMeasure ((productPrior d nu).bind
(fun theta => conditionalTranscriptLaw Q (densityCubeClamp theta) r)) := by
letI := hnu.1
haveI : IsProbabilityMeasure (productPrior d nu) := by unfold productPrior; infer_instance
exact isProbabilityMeasure_bind hm.aemeasurable (ae_of_all _ fun theta =>
conditionalTranscriptLaw_probability Q _ (densityCubeClamp_mem theta) hd r)
letI := hprob nu0 hnu0
letI := hprob nu1 hnu1
have hzero : (fun _ : Fin d => (0 : ℝ)) ∈ parameterCube d := by
intro j; constructor <;> norm_num
haveI : IsProbabilityMeasure (referenceLaw Q r) :=
conditionalTranscriptLaw_probability Q _ hzero hd r
obtain ⟨hm0, hn0⟩ := conditionalMixture_density_measurable_nonneg Q eps p hp r a ha nu0 hnu0
obtain ⟨hm1, hn1⟩ := conditionalMixture_density_measurable_nonneg Q eps p hp r a ha nu1 hnu1
exact probability_density_tv_le_half_L1 _ _ _ _ _ hm0 hm1 hn0 hn1
(conditionalMixture_withDensity_average Q hd eps p hp r a ha nu0 hnu0)
(conditionalMixture_withDensity_average Q hd eps p hp r a ha nu1 hnu1)
theorem adaptive_moment_contraction
Adaptive higher-order transcript contraction holds for arbitrary public seeds and randomized tests when the measurable-kernel Radon–Nikodym property, iid sampling, independent randomness, sequential ε-local privacy, and the admissible parameter regime hold.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
hRN_of_gate :
S :
SamplingScheme n d
hIID :
hRandom :
Q :
LocalProtocol n (ObsRecord d)
eps :
ℝ
hQ :
SequentialClass Q eps
hAllowed :
Allowed n d eps
conclusion
conclusion 1
conclusion 2
a :
ℝ
a ∈ Ioc 0 (1/2 : ℝ)
nu0 nu1 :
Measure ℝ
AmplitudePrior a nu0
AmplitudePrior a nu1
k :
ℕ
1 ≤ k
MatchingMoments k nu0 nu1
k ≤ n
n < k
mixtureLaw S Q nu0 = mixtureLaw S Q nu1
|(∫ w, f w ∂(mixtureLaw S Q nu0)) - (∫ w, f w ∂(mixtureLaw S Q nu1))|
Proof (Lean source)
lemma adaptive_moment_contraction (hRN_of_gate : MeasurableKernelRadonNikodym)
(S : SamplingScheme n d) (hIID : IidPeople S) (hRandom : IndependentRandomness S)
(Q : LocalProtocol n (ObsRecord d)) (eps : ℝ) (hQ : SequentialClass Q eps)
(hAllowed : Allowed n d eps) :
(∃ p : (Fin d → ℝ) × Q.Seed × ProtocolTranscript Q → ℝ,
DensityCertificate Q eps p) ∧
(∀ (a : ℝ), a ∈ Ioc 0 (1/2 : ℝ) → -- @realizes \alpha(0<amplitude≤1/2)
∀ (nu0 nu1 : Measure ℝ), AmplitudePrior a nu0 → AmplitudePrior a nu1 →
∀ k : ℕ, 1 ≤ k → MatchingMoments k nu0 nu1 →
(k ≤ n → tvDist (mixtureLaw S Q nu0) (mixtureLaw S Q nu1) ≤
min 1 (d * a^k * sqrt (choose n k) * (derivativeScale d eps)^k)) ∧
(n < k → mixtureLaw S Q nu0 = mixtureLaw S Q nu1) ∧
(∀ f : Q.Seed × ProtocolTranscript Q → ℝ, Measurable f →
(∀ w, f w ∈ Icc 0 1) →
|(∫ w, f w ∂(mixtureLaw S Q nu0)) - (∫ w, f w ∂(mixtureLaw S Q nu1))| ≤
tvDist (mixtureLaw S Q nu0) (mixtureLaw S Q nu1))) := by
obtain ⟨p, hp, hProduct⟩ := density_product_matching_of_gate hRN_of_gate Q eps hQ hAllowed
constructor
· exact ⟨p, hp⟩
· intro a ha nu0 nu1 hnu0 hnu1 k hk hmom
refine ⟨?_, ?_, ?_⟩
· intro hkn
have hL1 (r : Q.Seed) := hProduct r a ha nu0 nu1 hnu0 hnu1 k hk hkn hmom
have hd : 0 < d := by have := hAllowed.2.1; omega
let m (nu : Measure ℝ) (r : Q.Seed) := (productPrior d nu).bind
(fun theta => conditionalTranscriptLaw Q (densityCubeClamp theta) r)
let rows (nu : Measure ℝ) (r : Q.Seed) := (productPrior d nu).bind
(fun theta => (conditionalTranscriptLaw Q (densityCubeClamp theta) r).map (fun z => (r,z)))
have hm (r : Q.Seed) : Measurable
(fun theta => conditionalTranscriptLaw Q (densityCubeClamp theta) r) := by
simpa only [Function.comp_def] using (measurable_conditionalTranscriptLaw_clipped Q hd).comp
(show Measurable (fun theta : Fin d → ℝ => (theta,r)) by fun_prop)
have hprob (nu : Measure ℝ) (hnu : AmplitudePrior a nu) (r : Q.Seed) :
IsProbabilityMeasure (m nu r) := by
letI := hnu.1
haveI : IsProbabilityMeasure (productPrior d nu) := by unfold productPrior; infer_instance
exact isProbabilityMeasure_bind (hm r).aemeasurable (ae_of_all _ fun theta =>
conditionalTranscriptLaw_probability Q _ (densityCubeClamp_mem theta) hd r)
have hmap (nu : Measure ℝ) (hnu : AmplitudePrior a nu) (r : Q.Seed) :
rows nu r = (m nu r).map (fun z => (r,z)) := by
letI := hnu.1
haveI : IsProbabilityMeasure (productPrior d nu) := by unfold productPrior; infer_instance
exact (map_bind_measurable_rows (productPrior d nu) _ (hm r) _ (by fun_prop)).symm
have hrprob (nu : Measure ℝ) (hnu : AmplitudePrior a nu) (r : Q.Seed) :
IsProbabilityMeasure (rows nu r) := by
rw [hmap nu hnu r]
letI := hprob nu hnu r
exact Measure.isProbabilityMeasure_map (by fun_prop)
have hrmeas (nu : Measure ℝ) (hnu : AmplitudePrior a nu) : Measurable (rows nu) := by
letI := hnu.1
haveI : IsProbabilityMeasure (productPrior d nu) := by unfold productPrior; infer_instance
exact measurable_bind_product_rows (productPrior d nu)
(fun w : Q.Seed × (Fin d → ℝ) =>
(conditionalTranscriptLaw Q (densityCubeClamp w.2) w.1).map (fun z => (w.1,z)))
((measurable_clipped_seedTranscriptRows Q hd).comp measurable_swap)
have hrowbound (r : Q.Seed) : tvDist (rows nu0 r) (rows nu1 r) ≤
d * a^k * sqrt (choose n k) * (derivativeScale d eps)^k := by
rw [hmap nu0 hnu0 r, hmap nu1 hnu1 r]
letI := hprob nu0 hnu0 r
letI := hprob nu1 hnu1 r
calc
_ ≤ tvDist (m nu0 r) (m nu1 r) := probability_tv_map_le _ _ _ (by fun_prop)
_ ≤ (1/2 : ℝ) * ∫ z, |(∫ theta, p (theta,r,z) ∂productPrior d nu0) -
∫ theta, p (theta,r,z) ∂productPrior d nu1| ∂referenceLaw Q r :=
conditionalMixture_tv_le_half_L1 Q hd eps p hp r a ha.2 nu0 nu1 hnu0 hnu1
_ ≤ _ := by nlinarith [hL1 r]
haveI := mixtureLaw_probability S hIID hRandom Q hd a ha.2 nu0 hnu0
haveI := mixtureLaw_probability S hIID hRandom Q hd a ha.2 nu1 hnu1
apply le_min (tvDist_le_one)
rw [mixtureLaw_common_seed_bind S hIID hRandom Q hd a ha.2 nu0 hnu0,
mixtureLaw_common_seed_bind S hIID hRandom Q hd a ha.2 nu1 hnu1]
exact probability_bind_tv_le_constant Q.seedLaw (rows nu0) (rows nu1)
(hrmeas nu0 hnu0) (hrmeas nu1 hnu1) (hrprob nu0 hnu0) (hrprob nu1 hnu1) _ hrowbound
· intro hnk
exact mixtureLaw_eq_of_matching_above_sample S hIID hRandom Q
(by have := hAllowed.2.1; omega) a ha.2 nu0 nu1 hnu0 hnu1 k hnk hmom
· intro f hf hrange
exact mixtureLaw_bounded_test S hIID hRandom Q (by have := hAllowed.2.1; omega)
a ha.2 nu0 nu1 hnu0 hnu1 f hf hrange
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Contraction.MixtureProbability 6 declarations Clipped measurable experiment versions agree with the original sampling scheme on the parameter cube.
Probability laws for supported transcript mixtures
Clipped measurable experiment versions agree with the original sampling scheme on the parameter cube. Supported product priors therefore induce probability mixtures, to which the bounded-statistic total-variation inequality applies.
Finite iid input laws vary measurably with their atom probabilities when the one-sample laws vary measurably and each such law is finite.
Formal statement
hypotheses
conclusion
Measurable (fun h => Measure.pi (fun _ : Fin n => mu h))
Proof (Lean source)
-- @node: measurable_finite_iid_inputLaw
@[fun_prop] lemma measurable_finite_iid_inputLaw {H I : Type}
[MeasurableSpace H] [Fintype I] [MeasurableSpace I] [MeasurableSingletonClass I]
(mu : H → Measure I) (hmu : Measurable mu) (hfin : ∀ h, IsFiniteMeasure (mu h)) :
Measurable (fun h => Measure.pi (fun _ : Fin n => mu h)) := by
classical
apply Measure.measurable_of_measurable_coe
intro E hE
have hexpand (h : H) : (Measure.pi (fun _ : Fin n => mu h)) E =
∑ o : Fin n → I, E.indicator (fun o => ∏ i, mu h {o i}) o := by
letI := hfin h
rw [← Measure.tsum_indicator_apply_singleton _ E hE, tsum_fintype]
simp only [Measure.pi_singleton]
simp_rw [hexpand]
apply Finset.measurable_sum
intro o _
by_cases ho : o ∈ E
· simp only [Set.indicator_of_mem ho]
exact Finset.measurable_prod _ (fun i _ =>
(Measure.measurable_coe (measurableSet_singleton _)).comp hmu)
· simp only [Set.indicator_of_notMem ho]
exact measurable_const
theorem measurable_clipped_canonicalDecisionLaw
Clipping gives a globally measurable canonical decision experiment when the record dimension is positive.
Formal statement
hypotheses
conclusion
Measurable (fun theta : Fin d → ℝ => canonicalDecisionLaw Q (observedLaw (symmetricLaw (densityCubeClamp theta))))
Proof (Lean source)
-- @node: measurable_clipped_canonicalDecisionLaw
@[fun_prop] lemma measurable_clipped_canonicalDecisionLaw
(Q : LocalProtocol n (ObsRecord d)) (hd : 0 < d) :
Measurable (fun theta : Fin d → ℝ =>
canonicalDecisionLaw Q (observedLaw (symmetricLaw (densityCubeClamp theta)))) := by
have hobs : Measurable (fun theta : Fin d → ℝ =>
observedLaw (symmetricLaw (densityCubeClamp theta))) := by
exact (Measure.measurable_map observe (by fun_prop)).comp
(measurable_symmetricLaw_parameter.comp measurable_densityCubeClamp)
have hprob (theta : Fin d → ℝ) :
IsProbabilityMeasure (observedLaw (symmetricLaw (densityCubeClamp theta))) := by
haveI := symmetricLaw_probability _ (densityCubeClamp_mem theta) hd
exact Measure.isProbabilityMeasure_map (by fun_prop)
have hpi := measurable_finite_iid_inputLaw (n := n) _ hobs
(fun theta => by haveI := hprob theta; infer_instance)
haveI : IsProbabilityMeasure uniform01 := ⟨by
simp [uniform01, Measure.restrict_apply, Real.volume_Icc]⟩
have hinput : Measurable (fun theta : Fin d → ℝ =>
(Measure.pi (fun _ : Fin n =>
observedLaw (symmetricLaw (densityCubeClamp theta)))).prod
(Q.seedLaw.prod uniform01)) := by
conv => arg 1; ext theta; rw [Measure.prod_def]
exact (Measure.measurable_bind'
(Measurable.map_prodMk_left (ν := Q.seedLaw.prod uniform01))).comp hpi
unfold canonicalDecisionLaw
exact (Measure.measurable_bind' (measurable_protocol_decisionRows Q)).comp hinput
theorem clipped_canonicalDecisionLaw_eq
Assume independent and identically distributed participant records, independent protocol randomness, positive dimension, and the stated htheta condition. The sampling hypotheses identify decision laws with their clipped versions on the cube.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
S :
SamplingScheme n d
hIID :
hRandom :
Q :
LocalProtocol n (ObsRecord d)
hd :
0 < d
theta :
Fin d → ℝ
htheta :
theta ∈ parameterCube d
conclusion
= decisionLaw S Q (symmetricLaw theta)
Proof (Lean source)
-- @node: clipped_canonicalDecisionLaw_eq
lemma clipped_canonicalDecisionLaw_eq (S : SamplingScheme n d) (hIID : IidPeople S)
(hRandom : IndependentRandomness S) (Q : LocalProtocol n (ObsRecord d))
(hd : 0 < d) (theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d) :
canonicalDecisionLaw Q (observedLaw (symmetricLaw (densityCubeClamp theta))) =
decisionLaw S Q (symmetricLaw theta) := by
rw [densityCubeClamp_eq theta htheta]
haveI := symmetricLaw_probability theta htheta hd
unfold canonicalDecisionLaw decisionLaw
rw [iid_sampling_inputLaw S hIID hRandom Q _
(symmetricLaw_causalModel theta htheta hd)]
theorem amplitude_productPrior_ae_cube
Assume the stated ha condition and the stated hnu condition. A supported coordinate prior places its entire product mass in the parameter cube.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: amplitude_productPrior_ae_cube
lemma amplitude_productPrior_ae_cube (a : ℝ) (ha : a ≤ (1/2 : ℝ))
(nu : Measure ℝ) (hnu : AmplitudePrior a nu) :
∀ᵐ theta ∂productPrior d nu, theta ∈ parameterCube d := by
letI := hnu.1
have hcoord : ∀ᵐ u ∂nu, u ∈ Icc (-a) a := ae_iff.mpr hnu.2
have hall : ∀ᵐ theta ∂productPrior d nu, ∀ j, theta j ∈ Icc (-a) a :=
Filter.eventually_all.mpr (fun j => Measure.tendsto_eval_ae_ae.eventually hcoord)
filter_upwards [hall] with theta htheta
intro j
exact ⟨by linarith [(htheta j).1], (htheta j).2.trans ha⟩
theorem mixtureLaw_probability
Assume independent and identically distributed participant records, independent protocol randomness, positive dimension, the stated ha condition, and the stated hnu condition. Every supported mixture is a probability law, even for a sampling scheme specified only through its iid and independent-randomness properties.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
S :
SamplingScheme n d
hIID :
hRandom :
Q :
LocalProtocol n (ObsRecord d)
hd :
0 < d
a :
ℝ
ha :
a ≤ (1/2 : ℝ)
nu :
Measure ℝ
hnu :
AmplitudePrior a nu
conclusion
IsProbabilityMeasure (mixtureLaw S Q nu)
Proof (Lean source)
-- @node: mixtureLaw_probability
lemma mixtureLaw_probability (S : SamplingScheme n d) (hIID : IidPeople S)
(hRandom : IndependentRandomness S) (Q : LocalProtocol n (ObsRecord d))
(hd : 0 < d) (a : ℝ) (ha : a ≤ (1/2 : ℝ))
(nu : Measure ℝ) (hnu : AmplitudePrior a nu) :
IsProbabilityMeasure (mixtureLaw S Q nu) := by
letI := hnu.1
let rows := fun theta : Fin d → ℝ =>
(canonicalDecisionLaw Q (observedLaw (symmetricLaw (densityCubeClamp theta)))).map
(fun w => (w.2.1,w.1))
have hm : Measurable rows :=
(Measure.measurable_map _ (by fun_prop)).comp
(measurable_clipped_canonicalDecisionLaw Q hd)
have heq : mixtureLaw S Q nu = (productPrior d nu).bind rows := by
apply Measure.bind_congr_right
filter_upwards [amplitude_productPrior_ae_cube (d := d) a ha nu hnu] with theta htheta
dsimp [rows, seedTranscriptLaw]
rw [clipped_canonicalDecisionLaw_eq S hIID hRandom Q hd theta htheta]
rw [heq]
haveI : IsProbabilityMeasure (productPrior d nu) := by
unfold productPrior
infer_instance
apply isProbabilityMeasure_bind hm.aemeasurable
filter_upwards [amplitude_productPrior_ae_cube (d := d) a ha nu hnu] with theta htheta
haveI := symmetricLaw_probability theta htheta hd
haveI := sampling_decisionLaw_probability S hIID hRandom Q _
(symmetricLaw_causalModel theta htheta hd)
dsimp [rows]
rw [clipped_canonicalDecisionLaw_eq S hIID hRandom Q hd theta htheta]
exact Measure.isProbabilityMeasure_map (by fun_prop)
theorem mixtureLaw_bounded_test
Assume independent and identically distributed participant records, independent protocol randomness, positive dimension, the stated ha condition, the stated hnu0 condition, the stated hnu1 condition, measurability of f, and the protocol transcript. Arbitrary Borel randomized transcript statistics obey the mixture TV bound.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
S :
SamplingScheme n d
hIID :
hRandom :
Q :
LocalProtocol n (ObsRecord d)
hd :
0 < d
a :
ℝ
ha :
a ≤ (1/2 : ℝ)
nu0 nu1 :
Measure ℝ
hnu0 :
AmplitudePrior a nu0
hnu1 :
AmplitudePrior a nu1
f :
Q.Seed × ProtocolTranscript Q → ℝ
hf :
hrange :
∀ w, f w ∈ Icc 0 1
conclusion
|(∫ w, f w ∂mixtureLaw S Q nu0) - (∫ w, f w ∂mixtureLaw S Q nu1)|
Proof (Lean source)
-- @node: mixtureLaw_bounded_test
lemma mixtureLaw_bounded_test (S : SamplingScheme n d) (hIID : IidPeople S)
(hRandom : IndependentRandomness S) (Q : LocalProtocol n (ObsRecord d))
(hd : 0 < d) (a : ℝ) (ha : a ≤ (1/2 : ℝ))
(nu0 nu1 : Measure ℝ) (hnu0 : AmplitudePrior a nu0) (hnu1 : AmplitudePrior a nu1)
(f : Q.Seed × ProtocolTranscript Q → ℝ) (hf : Measurable f)
(hrange : ∀ w, f w ∈ Icc 0 1) :
|(∫ w, f w ∂mixtureLaw S Q nu0) - (∫ w, f w ∂mixtureLaw S Q nu1)| ≤
tvDist (mixtureLaw S Q nu0) (mixtureLaw S Q nu1) := by
haveI := mixtureLaw_probability S hIID hRandom Q hd a ha nu0 hnu0
haveI := mixtureLaw_probability S hIID hRandom Q hd a ha nu1 hnu1
simpa using tvDist_integral_range
(mixtureLaw S Q nu0) (mixtureLaw S Q nu1) f hf 0 1 (by norm_num)
(by simpa using hrange)
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Contraction.PriorAverage 6 declarations The canonical finite-row representation justifies Fubini for a coordinate replacement averaged over any probability law supported on the parameter cube.
Averaging coordinate replacements
The canonical finite-row representation justifies Fubini for a coordinate replacement averaged over any probability law supported on the parameter cube. The exact single-coordinate L1 cost is preserved by this averaging.
theorem parameterCube_update_amplitude
Assume the stated htheta condition, the stated ha condition, and the stated hu condition. Replacing a cube coordinate by a supported amplitude stays in the cube.
Formal statement
hypotheses
d :
ℕ
theta :
Fin d → ℝ
htheta :
theta ∈ parameterCube d
j :
Fin d
a :
ℝ
ha :
a ≤ (1 / 2 : ℝ)
u :
ℝ
hu :
u ∈ Icc (-a) a
conclusion
update theta j u ∈ parameterCube d
Proof (Lean source)
-- @node: parameterCube_update_amplitude
lemma parameterCube_update_amplitude (theta : Fin d → ℝ)
(htheta : theta ∈ parameterCube d) (j : Fin d) (a : ℝ)
(ha : a ≤ (1 / 2 : ℝ)) (u : ℝ) (hu : u ∈ Icc (-a) a) :
update theta j u ∈ parameterCube d := by
intro b
by_cases hb : b = j
· subst b
simp only [Function.update_self]
constructor <;> linarith [hu.1, hu.2]
· rw [Function.update_of_ne hb]
exact htheta b
theorem iidAffineMass_abs_le_one
Assume positive dimension and the stated htheta condition. An iid affine input mass lies between zero and one on the cube.
Formal statement
hypotheses
conclusion
|iidAffineMass theta o| ≤ 1
Proof (Lean source)
-- @node: iidAffineMass_abs_le_one
lemma iidAffineMass_abs_le_one (hd : 0 < d) (theta : Fin d → ℝ)
(htheta : theta ∈ parameterCube d) (o : Fin n → ObsRecord d) :
|iidAffineMass theta o| ≤ 1 := by
rw [abs_of_nonneg (iidAffineMass_nonneg theta htheta o)]
unfold iidAffineMass
calc
(∏ i, observedAffineMass theta (o i)) ≤ ∏ _i : Fin n, (1 : ℝ) := by
apply Finset.prod_le_prod
· intro i _; exact observedAffineMass_nonneg theta htheta (o i)
· intro i _
rw [observedAffineMass_eq_real theta htheta hd]
haveI := symmetricLaw_probability theta htheta hd
haveI : IsProbabilityMeasure (observedLaw (symmetricLaw theta)) :=
Measure.isProbabilityMeasure_map (by fun_prop)
exact measureReal_le_one
_ = 1 := by simp
theorem integrable_coordinate_prior_mass
Assume positive dimension, the function hpi, the stated ha condition, and the stated hnu condition. Supported coordinate-averaged affine masses are integrable over any probability law on the remaining contrasts.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
hd :
0 < d
pi :
hpi :
j :
Fin d
a :
ℝ
ha :
a ≤ (1 / 2 : ℝ)
nu :
Measure ℝ
hnu :
AmplitudePrior a nu
conclusion
Proof (Lean source)
-- @node: integrable_coordinate_prior_mass
lemma integrable_coordinate_prior_mass (hd : 0 < d)
(pi : Measure (Fin d → ℝ)) [IsProbabilityMeasure pi]
(hpi : ∀ᵐ theta ∂pi, theta ∈ parameterCube d) (j : Fin d)
(a : ℝ) (ha : a ≤ (1 / 2 : ℝ)) (nu : Measure ℝ)
(hnu : AmplitudePrior a nu) (o : Fin n → ObsRecord d) :
Integrable (fun theta => ∫ u, iidAffineMass (update theta j u) o ∂nu) pi := by
letI := hnu.1
have hm : Measurable (fun w : (Fin d → ℝ) × ℝ =>
iidAffineMass (update w.1 j w.2) o) := by
unfold iidAffineMass observedAffineMass
fun_prop
apply Integrable.of_bound hm.stronglyMeasurable.integral_prod_right'.aestronglyMeasurable 1
filter_upwards [hpi] with theta htheta
rw [Real.norm_eq_abs]
calc
|∫ u, iidAffineMass (update theta j u) o ∂nu| ≤
∫ u, |iidAffineMass (update theta j u) o| ∂nu :=
abs_integral_le_integral_abs
_ ≤ ∫ _u : ℝ, (1 : ℝ) ∂nu := by
apply integral_mono_of_nonneg (Filter.Eventually.of_forall (fun _ => abs_nonneg _)) (integrable_const 1)
filter_upwards [show ∀ᵐ u ∂nu, u ∈ Icc (-a) a from
ae_iff.mpr hnu.2] with u hu
exact iidAffineMass_abs_le_one hd _
(parameterCube_update_amplitude theta htheta j a ha u hu) o
_ = 1 := by simp
Assume the stated f condition and the stated b condition. Probability averaging preserves a uniform L1 bound.
Formal statement
hypotheses
T Z :
pi :
F :
T → Z → ℝ
hF :
Integrable (uncurry F) (pi.prod mu)
B :
ℝ
hB :
∀ᵐ t ∂pi, (∫ z, |F t z| ∂mu) ≤ B
conclusion
(∫ z, |∫ t, F t z ∂pi| ∂mu) ≤ B
Proof (Lean source)
-- @node: probability_average_L1_le
lemma probability_average_L1_le {T Z : Type*} [MeasurableSpace T] [MeasurableSpace Z]
(pi : Measure T) [IsProbabilityMeasure pi] (mu : Measure Z) [SFinite mu]
(F : T → Z → ℝ) (hF : Integrable (uncurry F) (pi.prod mu))
(B : ℝ) (hB : ∀ᵐ t ∂pi, (∫ z, |F t z| ∂mu) ≤ B) :
(∫ z, |∫ t, F t z ∂pi| ∂mu) ≤ B := by
have hleft : Integrable (fun z => |∫ t, F t z ∂pi|) mu :=
hF.integral_prod_right.abs
have hright : Integrable (fun z => ∫ t, |F t z| ∂pi) mu :=
hF.abs.integral_prod_right
calc
_ ≤ ∫ z, ∫ t, |F t z| ∂pi ∂mu := by
apply integral_mono hleft hright
intro z
exact abs_integral_le_integral_abs
_ = ∫ t, ∫ z, |F t z| ∂mu ∂pi := (integral_integral_swap hF.abs).symm
_ ≤ ∫ _t, B ∂pi := integral_mono_ae hF.abs.integral_prod_left (integrable_const B) hB
_ = B := by simp
theorem canonical_density_averaged_coordinate_matching_L1
Assume a nonnegative privacy budget, positive dimension, measurability of f, the function hf0, the function hrow, the stated hcert condition, the function hpi, amplitude between zero and one half, the stated hnu0 condition, the stated hnu1 condition, the stated hk condition, order no larger than the sample size, and the stated hmom condition. Integrating the remaining contrasts under any cube-supported probability law preserves the exact single-coordinate matched-prior contraction cost.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
eps :
ℝ
heps :
0 ≤ eps
hd :
0 < d
f :
hf :
hf0 :
∀ w, 0 ≤ f w
hrow :
hcert :
DensityCertificate Q eps (canonicalTranscriptDensity f)
pi :
hpi :
r :
Q.Seed
j :
Fin d
a :
ℝ
ha :
a ∈ Ioc 0 (1 / 2 : ℝ)
nu0 nu1 :
Measure ℝ
hnu0 :
AmplitudePrior a nu0
hnu1 :
AmplitudePrior a nu1
k :
ℕ
hk :
1 ≤ k
hkn :
k ≤ n
hmom :
MatchingMoments k nu0 nu1
conclusion
(∫ z, |∫ theta, ((∫ u, canonicalTranscriptDensity f (update theta j u, r, z) ∂nu0) - (∫ u, canonicalTranscriptDensity f (update theta j u, r, z) ∂nu1)) ∂pi| ∂referenceLaw Q r)
Proof (Lean source)
-- @node: canonical_density_averaged_coordinate_matching_L1
lemma canonical_density_averaged_coordinate_matching_L1
(Q : LocalProtocol n (ObsRecord d)) (eps : ℝ) (heps : 0 ≤ eps) (hd : 0 < d)
(f : ((Fin n → ObsRecord d) × Q.Seed) × ProtocolTranscript Q → ℝ)
(hf : Measurable f) (hf0 : ∀ w, 0 ≤ f w)
(hrow : ∀ o r, (referenceLaw Q r).withDensity
(fun z => ofReal (f ((o, r), z))) = fixedTranscriptLaw Q o r)
(hcert : DensityCertificate Q eps (canonicalTranscriptDensity f))
(pi : Measure (Fin d → ℝ)) [IsProbabilityMeasure pi]
(hpi : ∀ᵐ theta ∂pi, theta ∈ parameterCube d) (r : Q.Seed) (j : Fin d)
(a : ℝ) (ha : a ∈ Ioc 0 (1 / 2 : ℝ))
(nu0 nu1 : Measure ℝ) (hnu0 : AmplitudePrior a nu0) (hnu1 : AmplitudePrior a nu1)
(k : ℕ) (hk : 1 ≤ k) (hkn : k ≤ n) (hmom : MatchingMoments k nu0 nu1) :
(∫ z, |∫ theta,
((∫ u, canonicalTranscriptDensity f (update theta j u, r, z) ∂nu0) -
(∫ u, canonicalTranscriptDensity f (update theta j u, r, z) ∂nu1))
∂pi| ∂referenceLaw Q r) ≤
2 * a^k * sqrt (choose n k) * (derivativeScale d eps)^k := by
classical
haveI : IsProbabilityMeasure (referenceLaw Q r) :=
conditionalTranscriptLaw_probability Q (fun _ => 0)
(by intro b; constructor <;> norm_num) hd r
let F := fun theta z =>
(∫ u, canonicalTranscriptDensity f (update theta j u, r, z) ∂nu0) -
(∫ u, canonicalTranscriptDensity f (update theta j u, r, z) ∂nu1)
have hexpand (nu : Measure ℝ) (hnu : AmplitudePrior a nu)
(theta : Fin d → ℝ) (z : ProtocolTranscript Q) :
(∫ u, canonicalTranscriptDensity f (update theta j u, r, z) ∂nu) =
∑ o, (∫ u, iidAffineMass (update theta j u) o ∂nu) * f ((o,r),z) := by
unfold canonicalTranscriptDensity
rw [integral_finsetSum]
· simp_rw [integral_mul_const]
· intro o _
apply integrable_continuous_amplitudePrior a nu hnu
simp only [fst, snd]
unfold iidAffineMass observedAffineMass
fun_prop
have hF : Integrable (uncurry F) (pi.prod (referenceLaw Q r)) := by
have heq : uncurry F = (fun w => ∑ o,
((∫ u, iidAffineMass (update w.1 j u) o ∂nu0) -
(∫ u, iidAffineMass (update w.1 j u) o ∂nu1)) * f ((o,r),w.2)) := by
ext w
simp only [uncurry, F, hexpand nu0 hnu0, hexpand nu1 hnu1,
← Finset.sum_sub_distrib, sub_mul]
rw [heq]
apply integrable_finsetSum
intro o _
exact ((integrable_coordinate_prior_mass hd pi hpi j a ha.2 nu0 hnu0 o).sub
(integrable_coordinate_prior_mass hd pi hpi j a ha.2 nu1 hnu1 o)).mul_prod
(integrable_fixedTranscript_row_density Q f hf hf0 hrow o r)
apply probability_average_L1_le pi (referenceLaw Q r) F hF
filter_upwards [hpi] with theta htheta
exact canonical_density_coordinate_matching_L1 Q eps heps f hf hf0 hrow hcert
theta htheta r j a ha nu0 nu1 hnu0 hnu1 k hk hkn hmom
theorem density_averaged_coordinate_matching_of_gate
Assume measurable Radon–Nikodym densities for dominated kernels, sequential local privacy of the protocol, and an admissible sample size, dimension, and privacy budget. The RN gate supplies a canonical certificate whose coordinate contraction is already averaged over every supported remaining-coordinate prior.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
eps :
ℝ
hQ :
SequentialClass Q eps
hAllowed :
Allowed n d eps
conclusion
∃ p : (Fin d → ℝ) × Q.Seed × ProtocolTranscript Q → ℝ,
DensityCertificate Q eps p
conclusion 1
r j :
a ∈ Set.Ioc 0 (1 / 2 : ℝ) :
nu0 nu1 :
Measure ℝ
AmplitudePrior a nu0
AmplitudePrior a nu1
k :
ℕ
1 ≤ k
k ≤ n
MatchingMoments k nu0 nu1
Proof (Lean source)
-- @node: density_averaged_coordinate_matching_of_gate
lemma density_averaged_coordinate_matching_of_gate (hRN : MeasurableKernelRadonNikodym)
(Q : LocalProtocol n (ObsRecord d)) (eps : ℝ) (hQ : SequentialClass Q eps)
(hAllowed : Allowed n d eps) :
∃ p : (Fin d → ℝ) × Q.Seed × ProtocolTranscript Q → ℝ,
DensityCertificate Q eps p ∧
∀ (pi : Measure (Fin d → ℝ)), IsProbabilityMeasure pi →
(∀ᵐ theta ∂pi, theta ∈ parameterCube d) → ∀ r j,
∀ a ∈ Ioc 0 (1 / 2 : ℝ), ∀ nu0 nu1 : Measure ℝ,
AmplitudePrior a nu0 → AmplitudePrior a nu1 → ∀ k : ℕ,
1 ≤ k → k ≤ n → MatchingMoments k nu0 nu1 →
(∫ z, |∫ theta,
((∫ u, p (update theta j u, r, z) ∂nu0) -
(∫ u, p (update theta j u, r, z) ∂nu1)) ∂pi|
∂referenceLaw Q r) ≤
2 * a^k * sqrt (choose n k) * (derivativeScale d eps)^k := by
obtain ⟨f, hf, hf0, hrow, hcert⟩ :=
canonical_density_certificate_rows_of_gate hRN Q eps hQ hAllowed
refine ⟨canonicalTranscriptDensity f, hcert, ?_⟩
intro pi hprob hpi r j a ha nu0 nu1 hnu0 hnu1 k hk hkn hmom
letI := hprob
exact canonical_density_averaged_coordinate_matching_L1 Q eps (le_of_lt hAllowed.2.2.1)
(by have := hAllowed.2.1; omega) f hf hf0 hrow hcert pi hpi r j
a ha nu0 nu1 hnu0 hnu1 k hk hkn hmom
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Contraction.PriorCoordinate 3 declarations Testing a finite polynomial family against the sign of its prior density difference reduces its L1 contraction to scalar moment cancellation.
Single-coordinate matched-prior integration
Testing a finite polynomial family against the sign of its prior density difference reduces its L1 contraction to scalar moment cancellation. All integration exchanges are finite coefficient sums.
theorem finitePolynomial_matchingMoments_L1 Lemma finitePolynomial_matchingMoments_L1 in the paper ↗
Assume the stated hc condition, nonnegative amplitude, a nonnegative bias bound, the stated hnu0 condition, the stated hnu1 condition, the stated hk condition, the stated hmom condition, and the stated hderiv condition. Matched supported priors contract an integrable finite polynomial density family by twice the uniform coordinate Taylor remainder radius.
Formal statement
hypotheses
Ω :
Type*
mu :
Measure Ω
m :
ℕ
c :
Fin m → Ω → ℝ
hc :
∀ q, Integrable (c q) mu
a B :
ℝ
ha :
0 ≤ a
hB :
0 ≤ B
nu0 nu1 :
Measure ℝ
hnu0 :
AmplitudePrior a nu0
hnu1 :
AmplitudePrior a nu1
k :
ℕ
hk :
1 ≤ k
hmom :
MatchingMoments k nu0 nu1
hderiv :
∀ x ∈ Icc (-a) a,
(∫ z, |iteratedDeriv k (fun t : ℝ => ∑ q, c q z * t^q.val) x| ∂mu) ≤ (k.factorial : ℝ) * B
conclusion
(∫ z, |(∫ u, ∑ q, c q z * u^q.val ∂nu0) - (∫ u, ∑ q, c q z * u^q.val ∂nu1)| ∂mu)
≤ 2 * a^k * B
Proof (Lean source)
-- @node: finitePolynomial_matchingMoments_L1
lemma finitePolynomial_matchingMoments_L1 {Ω : Type*} [MeasurableSpace Ω]
(mu : Measure Ω) (m : ℕ) (c : Fin m → Ω → ℝ)
(hc : ∀ q, Integrable (c q) mu) (a B : ℝ) (ha : 0 ≤ a) (hB : 0 ≤ B)
(nu0 nu1 : Measure ℝ) (hnu0 : AmplitudePrior a nu0) (hnu1 : AmplitudePrior a nu1)
(k : ℕ) (hk : 1 ≤ k) (hmom : MatchingMoments k nu0 nu1)
(hderiv : ∀ x ∈ Icc (-a) a,
(∫ z, |iteratedDeriv k (fun t : ℝ => ∑ q, c q z * t^q.val) x| ∂mu) ≤
(k.factorial : ℝ) * B) :
(∫ z, |(∫ u, ∑ q, c q z * u^q.val ∂nu0) -
(∫ u, ∑ q, c q z * u^q.val ∂nu1)| ∂mu) ≤ 2 * a^k * B := by
let F := fun x : ℝ => fun z : Ω => ∑ q, c q z * x^q.val
have hprior (nu : Measure ℝ) (hnu : AmplitudePrior a nu) (z : Ω) :
(∫ u, F u z ∂nu) = ∑ q, c q z * (∫ u, u^q.val ∂nu) := by
rw [integral_finsetSum _ (fun q _ =>
integrable_continuous_amplitudePrior a nu hnu _ (by fun_prop))]
simp_rw [integral_const_mul]
let R := fun z : Ω => (∫ u, F u z ∂nu0) - ∫ u, F u z ∂nu1
have hR : Integrable R mu := by
dsimp [R]
simp_rw [hprior nu0 hnu0, hprior nu1 hnu1]
exact (integrable_finsetSum _ (fun q _ => (hc q).mul_const _)).sub
(integrable_finsetSum _ (fun q _ => (hc q).mul_const _))
let g := fun z : Ω => R z / |R z|
have hg : AEStronglyMeasurable g mu :=
hR.aestronglyMeasurable.div₀ hR.abs.aestronglyMeasurable
have hgb (z : Ω) : |g z| ≤ 1 := by
dsimp [g]
rw [abs_div, abs_abs]
by_cases hz : R z = 0
· simp [hz]
· rw [div_self (abs_ne_zero.mpr hz)]
have hgR (z : Ω) : g z * R z = |R z| := by
dsimp [g]
by_cases hz : R z = 0
· simp [hz]
· field_simp [abs_ne_zero.mpr hz]
nlinarith [sq_abs (R z)]
have hgc (q : Fin m) : Integrable (fun z => g z * c q z) mu :=
(hc q).bdd_mul hg (Filter.Eventually.of_forall (fun z => by simpa using hgb z))
let f := fun x : ℝ => ∫ z, g z * F x z ∂mu
have hfpoly (x : ℝ) : f x = ∑ q, (∫ z, g z * c q z ∂mu) * x^q.val := by
dsimp [f, F]
simp_rw [Finset.mul_sum, ← mul_assoc]
rw [integral_finsetSum _ (fun q _ => (hgc q).mul_const _)]
simp_rw [integral_mul_const]
have hf : ContDiff ℝ k f := by
rw [show f = _ from funext hfpoly]
fun_prop
have hD (v : ℕ) (x : ℝ) : Integrable (fun z => iteratedDeriv v (fun t => F t z) x) mu :=
integrable_finitePolynomial_iteratedDeriv mu m c hc v x
have hfD (v : ℕ) (x : ℝ) : iteratedDeriv v f x =
∫ z, g z * iteratedDeriv v (fun t => F t z) x ∂mu := by
have heq : f = (fun t : ℝ => ∫ z, ∑ q, (g z * c q z) * t^q.val ∂mu) := by
ext t
simp [f, F, Finset.mul_sum, mul_assoc]
rw [heq, finitePolynomial_iteratedDeriv_integral mu m _ hgc]
apply integral_congr_ae
filter_upwards [] with z
have heqz : (fun t : ℝ => ∑ q, (g z * c q z) * t^q.val) =
(fun t : ℝ => g z * F t z) := by
ext t
simp [F, Finset.mul_sum, mul_assoc]
rw [heqz, iteratedDeriv_const_mul_field]
have hfd (x : ℝ) (hx : x ∈ Icc (-a) a) :
|iteratedDeriv k f x| ≤ (k.factorial : ℝ) * B := by
rw [hfD]
calc
_ ≤ ∫ z, |g z * iteratedDeriv k (fun t => F t z) x| ∂mu :=
abs_integral_le_integral_abs
_ ≤ ∫ z, |iteratedDeriv k (fun t => F t z) x| ∂mu := by
apply integral_mono_ae ((hD k x).bdd_mul hg
(Filter.Eventually.of_forall (fun z => by simpa using hgb z))).abs (hD k x).abs
filter_upwards [] with z
rw [abs_mul]
exact mul_le_of_le_one_left (abs_nonneg _) (hgb z)
_ ≤ _ := hderiv x hx
have hswap (nu : Measure ℝ) (hnu : AmplitudePrior a nu) :
(∫ u, f u ∂nu) = ∫ z, g z * (∫ u, F u z ∂nu) ∂mu := by
simp_rw [hfpoly, hprior nu hnu]
rw [integral_finsetSum _ (fun q _ =>
integrable_continuous_amplitudePrior a nu hnu _ (by fun_prop))]
simp_rw [integral_const_mul, Finset.mul_sum, ← mul_assoc]
rw [integral_finsetSum _ (fun q _ => (hgc q).mul_const _)]
simp_rw [integral_mul_const]
have hscalar := matchingMoments_smooth_integral_sub_le a B ha hB
nu0 nu1 hnu0 hnu1 k hk hmom f hf hfd
have heq : (∫ u, f u ∂nu0) - (∫ u, f u ∂nu1) = ∫ z, |R z| ∂mu := by
rw [hswap nu0 hnu0, hswap nu1 hnu1, ← integral_sub]
· simp_rw [← mul_sub]
change (∫ z, g z * R z ∂mu) = _
simp_rw [hgR]
· simp_rw [hprior nu0 hnu0, Finset.mul_sum, ← mul_assoc]
exact integrable_finsetSum _ (fun q _ => (hgc q).mul_const _)
· simp_rw [hprior nu1 hnu1, Finset.mul_sum, ← mul_assoc]
exact integrable_finsetSum _ (fun q _ => (hgc q).mul_const _)
rw [heq, abs_of_nonneg (integral_nonneg (fun z => abs_nonneg (R z)))] at hscalar
exact hscalar
theorem canonical_density_coordinate_matching_L1
Assume a nonnegative privacy budget, measurability of f, the function hf0, the function hrow, the stated hcert condition, the stated htheta condition, amplitude between zero and one half, the stated hnu0 condition, the stated hnu1 condition, the stated hk condition, order no larger than the sample size, and the stated hmom condition. A single coordinate replacement between moment-matched priors has the exact L1 cost, uniformly over the other contrasts and every public seed.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
eps :
ℝ
heps :
0 ≤ eps
f :
hf :
hf0 :
∀ w, 0 ≤ f w
hrow :
hcert :
DensityCertificate Q eps (canonicalTranscriptDensity f)
theta :
Fin d → ℝ
htheta :
theta ∈ parameterCube d
r :
Q.Seed
j :
Fin d
a :
ℝ
ha :
a ∈ Ioc 0 (1 / 2 : ℝ)
nu0 nu1 :
Measure ℝ
hnu0 :
AmplitudePrior a nu0
hnu1 :
AmplitudePrior a nu1
k :
ℕ
hk :
1 ≤ k
hkn :
k ≤ n
hmom :
MatchingMoments k nu0 nu1
conclusion
(∫ z, |(∫ u, canonicalTranscriptDensity f (update theta j u, r, z) ∂nu0) - (∫ u, canonicalTranscriptDensity f (update theta j u, r, z) ∂nu1)| ∂referenceLaw Q r)
Proof (Lean source)
-- @node: canonical_density_coordinate_matching_L1
lemma canonical_density_coordinate_matching_L1
(Q : LocalProtocol n (ObsRecord d)) (eps : ℝ) (heps : 0 ≤ eps)
(f : ((Fin n → ObsRecord d) × Q.Seed) × ProtocolTranscript Q → ℝ)
(hf : Measurable f) (hf0 : ∀ w, 0 ≤ f w)
(hrow : ∀ o r, (referenceLaw Q r).withDensity
(fun z => ofReal (f ((o, r), z))) = fixedTranscriptLaw Q o r)
(hcert : DensityCertificate Q eps (canonicalTranscriptDensity f))
(theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d) (r : Q.Seed) (j : Fin d)
(a : ℝ) (ha : a ∈ Ioc 0 (1 / 2 : ℝ))
(nu0 nu1 : Measure ℝ) (hnu0 : AmplitudePrior a nu0) (hnu1 : AmplitudePrior a nu1)
(k : ℕ) (hk : 1 ≤ k) (hkn : k ≤ n) (hmom : MatchingMoments k nu0 nu1) :
(∫ z, |(∫ u, canonicalTranscriptDensity f (update theta j u, r, z) ∂nu0) -
(∫ u, canonicalTranscriptDensity f (update theta j u, r, z) ∂nu1)|
∂referenceLaw Q r) ≤
2 * a^k * sqrt (choose n k) * (derivativeScale d eps)^k := by
classical
obtain ⟨c, hc, heval⟩ := canonicalTranscriptDensity_integrable_coordinate_polynomial
Q f hf hf0 hrow theta r j
have hcube (x : ℝ) (hx : x ∈ Icc (-a) a) :
update theta j x ∈ parameterCube d := by
intro b
by_cases hb : b = j
· subst b
simp only [Function.update_self]
constructor <;> linarith [hx.1, hx.2, ha.2]
· rw [Function.update_of_ne hb]
exact htheta b
have hD (x : ℝ) (z : ProtocolTranscript Q) :
densityDerivative (canonicalTranscriptDensity f) (update theta j x) r z j k =
iteratedDeriv k (fun t : ℝ => ∑ q, c q z * t^q.val) x := by
simp only [densityDerivative, Function.update_idem, Function.update_self]
rw [show (fun t => canonicalTranscriptDensity f (update theta j t, r, z)) =
(fun t : ℝ => ∑ q, c q z * t^q.val) from funext (fun t => heval t z)]
have hbeta : 0 ≤ derivativeScale d eps := by
unfold derivativeScale
exact div_nonneg (sub_nonneg.mpr (Real.one_le_exp_iff.mpr heps)) (by positivity)
have hbound := finitePolynomial_matchingMoments_L1 (referenceLaw Q r) (n + 1) c hc
a (sqrt (choose n k) * (derivativeScale d eps)^k) (le_of_lt ha.1)
(by positivity) nu0 nu1 hnu0 hnu1 k hk hmom (fun x hx => by
simpa only [hD, mul_assoc] using hcert.2.2.2.1
(update theta j x) (hcube x hx) r j k hk hkn)
simpa only [heval, mul_assoc] using hbound
theorem density_coordinate_matching_of_gate
Assume measurable Radon–Nikodym densities for dominated kernels, sequential local privacy of the protocol, and an admissible sample size, dimension, and privacy budget. The RN construction provides one canonical density certificate and all single-coordinate matched-prior L1 bounds needed for product-prior telescoping.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
eps :
ℝ
hQ :
SequentialClass Q eps
hAllowed :
Allowed n d eps
conclusion
∃ p : (Fin d → ℝ) × Q.Seed × ProtocolTranscript Q → ℝ,
DensityCertificate Q eps p
conclusion 1
theta ∈ parameterCube d :
r j :
a ∈ Set.Ioc 0 (1 / 2 : ℝ) :
nu0 nu1 :
Measure ℝ
AmplitudePrior a nu0
AmplitudePrior a nu1
k :
ℕ
1 ≤ k
k ≤ n
MatchingMoments k nu0 nu1
Proof (Lean source)
-- @node: density_coordinate_matching_of_gate
lemma density_coordinate_matching_of_gate (hRN : MeasurableKernelRadonNikodym)
(Q : LocalProtocol n (ObsRecord d)) (eps : ℝ) (hQ : SequentialClass Q eps)
(hAllowed : Allowed n d eps) :
∃ p : (Fin d → ℝ) × Q.Seed × ProtocolTranscript Q → ℝ,
DensityCertificate Q eps p ∧ ∀ theta ∈ parameterCube d, ∀ r j,
∀ a ∈ Ioc 0 (1 / 2 : ℝ), ∀ nu0 nu1 : Measure ℝ,
AmplitudePrior a nu0 → AmplitudePrior a nu1 → ∀ k : ℕ,
1 ≤ k → k ≤ n → MatchingMoments k nu0 nu1 →
(∫ z, |(∫ u, p (update theta j u, r, z) ∂nu0) -
(∫ u, p (update theta j u, r, z) ∂nu1)| ∂referenceLaw Q r) ≤
2 * a^k * sqrt (choose n k) * (derivativeScale d eps)^k := by
obtain ⟨f, hf, hf0, hrow, hcert⟩ :=
canonical_density_certificate_rows_of_gate hRN Q eps hQ hAllowed
refine ⟨canonicalTranscriptDensity f, hcert, ?_⟩
intro theta htheta r j a ha nu0 nu1 hnu0 hnu1 k hk hkn hmom
exact canonical_density_coordinate_matching_L1 Q eps (le_of_lt hAllowed.2.2.1)
f hf hf0 hrow hcert theta htheta r j a ha nu0 nu1 hnu0 hnu1 k hk hkn hmom
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Contraction.PriorTelescoping 13 declarations Intervening product priors replace coordinates one at a time.
Product-prior coordinate telescoping
Intervening product priors replace coordinates one at a time. Independent coordinate replacement identifies each adjacent density difference with the averaged coordinate difference, so the exact L1 costs add over the dimension.
Replacing a coordinate by an independent draw updates its product-law factor.
Formal statement
hypotheses
Proof (Lean source)
-- @node: productPrior_update_map
lemma productPrior_update_map (mu : Fin d → Measure ℝ)
[∀ j, IsProbabilityMeasure (mu j)] (nu : Measure ℝ) [IsProbabilityMeasure nu]
(j : Fin d) :
((Measure.pi mu).prod nu).map (fun w => update w.1 j w.2) =
Measure.pi (update mu j nu) := by
classical
haveI : ∀ i, IsProbabilityMeasure (update mu j nu i) := by
intro i
by_cases hi : i = j
· subst i; simpa using (inferInstance : IsProbabilityMeasure nu)
· simpa [Function.update_of_ne hi] using (inferInstance : IsProbabilityMeasure (mu i))
apply (Measure.pi_eq (μ := update mu j nu) (fun s hs => ?_)).symm
let t : Fin d → Set ℝ := fun i => if i = j then Set.univ else s i
have hpre : (fun w : (Fin d → ℝ) × ℝ => update w.1 j w.2) ⁻¹'
(Set.univ.pi s) = (Set.univ.pi t) ×ˢ s j := by
ext w
simp only [Set.mem_preimage, Set.mem_pi, Set.mem_univ, forall_true_left,
Set.mem_prod, t]
constructor
· intro hw
constructor
· intro i
by_cases hi : i = j
· simp [hi]
· simpa [hi] using hw i
· simpa using hw j
· rintro ⟨hw, hj⟩ i
by_cases hi : i = j
· simpa [hi] using hj
· simpa [hi] using hw i
rw [Measure.map_apply (by fun_prop) (MeasurableSet.univ_pi hs), hpre,
Measure.prod_prod, Measure.pi_pi]
rw [← Finset.prod_erase_mul (s := univ)
(f := fun i => mu i (t i)) (a := j) (by simp)]
simp only [t, if_true, measure_univ, mul_one]
rw [← Finset.prod_erase_mul (s := univ)
(f := fun i => update mu j nu i (s i)) (a := j) (by simp),
Function.update_self]
congr 1
apply Finset.prod_congr rfl
intro i hi
simp [Finset.ne_of_mem_erase hi]
Assume the probability law hg. Fubini turns an independent coordinate replacement into an updated product integral.
Formal statement
hypotheses
d :
ℕ
mu :
∀ j, IsProbabilityMeasure (mu j)
nu :
j :
Fin d
g :
(Fin d → ℝ) → ℝ
hg :
Integrable g (Measure.pi (update mu j nu))
Proof (Lean source)
-- @node: productPrior_update_integral
lemma productPrior_update_integral (mu : Fin d → Measure ℝ)
[∀ j, IsProbabilityMeasure (mu j)] (nu : Measure ℝ) [IsProbabilityMeasure nu]
(j : Fin d) (g : (Fin d → ℝ) → ℝ)
(hg : Integrable g (Measure.pi (update mu j nu))) :
(∫ theta, ∫ u, g (update theta j u) ∂nu ∂Measure.pi mu) =
∫ theta, g theta ∂Measure.pi (update mu j nu) := by
have hmp : MeasurePreserving (fun w : (Fin d → ℝ) × ℝ =>
update w.1 j w.2) ((Measure.pi mu).prod nu)
(Measure.pi (update mu j nu)) :=
⟨by fun_prop, productPrior_update_map mu nu j⟩
calc
_ = ∫ w, g (update w.1 j w.2) ∂(Measure.pi mu).prod nu := by
simpa only [Function.comp_def] using
(integral_prod _ (hmp.integrable_comp_of_integrable hg)).symm
_ = ∫ theta, g theta ∂Measure.pi (update mu j nu) := by
rw [← productPrior_update_map mu nu j]
exact (integral_map (by fun_prop) (by
rw [productPrior_update_map mu nu j]
exact hg.aestronglyMeasurable)).symm
Fix the probability law nu0 and the probability law nu1, the natural-number parameter v, and the coordinate index. The first v coordinates use the second prior and all others use the first.
theorem hybridCoordinatePrior_amplitude
Assume the stated hnu0 condition and the stated hnu1 condition. All intervening coordinate laws remain supported probability measures.
Formal statement
hypotheses
d :
ℕ
a :
ℝ
nu0 nu1 :
Measure ℝ
hnu0 :
AmplitudePrior a nu0
hnu1 :
AmplitudePrior a nu1
v :
ℕ
j :
Fin d
conclusion
AmplitudePrior a (hybridCoordinatePrior nu0 nu1 v j)
Proof (Lean source)
-- @node: hybridCoordinatePrior_amplitude
lemma hybridCoordinatePrior_amplitude (a : ℝ) (nu0 nu1 : Measure ℝ)
(hnu0 : AmplitudePrior a nu0) (hnu1 : AmplitudePrior a nu1) (v : ℕ) (j : Fin d) :
AmplitudePrior a (hybridCoordinatePrior nu0 nu1 v j) := by
unfold hybridCoordinatePrior
split <;> assumption
theorem amplitude_hybridPrior_ae_cube
Assume the stated ha condition, the stated hnu0 condition, and the stated hnu1 condition. Intervening product laws give full mass to the parameter cube.
Formal statement
hypotheses
d :
ℕ
a :
ℝ
ha :
a ≤ (1 / 2 : ℝ)
nu0 nu1 :
Measure ℝ
hnu0 :
AmplitudePrior a nu0
hnu1 :
AmplitudePrior a nu1
v :
ℕ
conclusion
Proof (Lean source)
-- @node: amplitude_hybridPrior_ae_cube
lemma amplitude_hybridPrior_ae_cube (a : ℝ) (ha : a ≤ (1 / 2 : ℝ))
(nu0 nu1 : Measure ℝ) (hnu0 : AmplitudePrior a nu0) (hnu1 : AmplitudePrior a nu1)
(v : ℕ) :
∀ᵐ theta ∂Measure.pi (hybridCoordinatePrior (d := d) nu0 nu1 v),
theta ∈ parameterCube d := by
haveI : ∀ j : Fin d, IsProbabilityMeasure (hybridCoordinatePrior nu0 nu1 v j) :=
fun j => (hybridCoordinatePrior_amplitude a nu0 nu1 hnu0 hnu1 v j).1
have hcoord (j : Fin d) : ∀ᵐ u ∂hybridCoordinatePrior nu0 nu1 v j,
u ∈ Icc (-a) a :=
ae_iff.mpr (hybridCoordinatePrior_amplitude a nu0 nu1 hnu0 hnu1 v j).2
have hall := Filter.eventually_all.mpr (fun j : Fin d =>
Measure.tendsto_eval_ae_ae.eventually (hcoord j))
filter_upwards [hall] with theta htheta
intro j
exact ⟨by linarith [(htheta j).1], (htheta j).2.trans ha⟩
theorem hybridCoordinatePrior_succ
Assume the stated hv condition. The next hybrid law changes exactly the next coordinate.
Formal statement
hypotheses
conclusion
hybridCoordinatePrior (d := d) nu0 nu1 (v + 1)
= update (hybridCoordinatePrior nu0 nu1 v) ⟨v, hv⟩ nu1
Proof (Lean source)
-- @node: hybridCoordinatePrior_succ
lemma hybridCoordinatePrior_succ (nu0 nu1 : Measure ℝ) (v : ℕ) (hv : v < d) :
hybridCoordinatePrior (d := d) nu0 nu1 (v + 1) =
update (hybridCoordinatePrior nu0 nu1 v) ⟨v, hv⟩ nu1 := by
classical
funext j
by_cases hj : j = ⟨v, hv⟩
· subst j; simp [hybridCoordinatePrior]
· have hval : j.val ≠ v := fun h => hj (Fin.ext h)
simp only [Function.update_of_ne hj, hybridCoordinatePrior]
have heq : (j.val < v + 1) ↔ (j.val < v) := by omega
rw [if_congr heq rfl rfl]
theorem hybridCoordinatePrior_update_first
Assume the stated hv condition. Resampling the next coordinate from the first prior leaves the current hybrid law unchanged.
Formal statement
hypotheses
conclusion
update (hybridCoordinatePrior (d := d) nu0 nu1 v) ⟨v, hv⟩ nu0
= hybridCoordinatePrior nu0 nu1 v
Proof (Lean source)
-- @node: hybridCoordinatePrior_update_first
lemma hybridCoordinatePrior_update_first (nu0 nu1 : Measure ℝ) (v : ℕ) (hv : v < d) :
update (hybridCoordinatePrior (d := d) nu0 nu1 v) ⟨v, hv⟩ nu0 =
hybridCoordinatePrior nu0 nu1 v := by
classical
apply Function.update_eq_self_iff.mpr
simp [hybridCoordinatePrior]
theorem integrable_iidAffineMass_cube_prior
Assume positive dimension and the function hpi. A cube-supported probability law integrates every affine sample mass.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
hd :
0 < d
pi :
hpi :
conclusion
Proof (Lean source)
-- @node: integrable_iidAffineMass_cube_prior
lemma integrable_iidAffineMass_cube_prior (hd : 0 < d)
(pi : Measure (Fin d → ℝ)) [IsProbabilityMeasure pi]
(hpi : ∀ᵐ theta ∂pi, theta ∈ parameterCube d) (o : Fin n → ObsRecord d) :
Integrable (fun theta => iidAffineMass theta o) pi := by
apply Integrable.of_bound (by
have hm : Measurable (fun theta => iidAffineMass theta o) := by
unfold iidAffineMass observedAffineMass
fun_prop
exact hm.aestronglyMeasurable) 1
filter_upwards [hpi] with theta htheta
exact iidAffineMass_abs_le_one hd theta htheta o
theorem integrable_canonicalTranscriptDensity_prior
Assume positive dimension and the function hpi. Canonical densities are integrable in the prior parameter at every transcript.
Formal statement
hypotheses
n :
ℕ
hd :
0 < d
f :
pi :
hpi :
r :
Q.Seed
z :
conclusion
Proof (Lean source)
-- @node: integrable_canonicalTranscriptDensity_prior
lemma integrable_canonicalTranscriptDensity_prior {Q : LocalProtocol n (ObsRecord d)} (hd : 0 < d)
(f : ((Fin n → ObsRecord d) × Q.Seed) × ProtocolTranscript Q → ℝ)
(pi : Measure (Fin d → ℝ)) [IsProbabilityMeasure pi]
(hpi : ∀ᵐ theta ∂pi, theta ∈ parameterCube d)
(r : Q.Seed) (z : ProtocolTranscript Q) :
Integrable (fun theta => canonicalTranscriptDensity f (theta, r, z)) pi := by
unfold canonicalTranscriptDensity
apply integrable_finsetSum
intro o _
exact (integrable_iidAffineMass_cube_prior hd pi hpi o).mul_const (f ((o,r),z))
theorem integrable_canonicalTranscriptDensity_average
Assume positive dimension, measurability of f, the function hf0, the function hrow, and the function hpi. The finite-row representation makes each prior-averaged density integrable in the transcript.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
hd :
0 < d
f :
hf :
hf0 :
∀ w, 0 ≤ f w
hrow :
pi :
hpi :
r :
Q.Seed
conclusion
Proof (Lean source)
-- @node: integrable_canonicalTranscriptDensity_average
lemma integrable_canonicalTranscriptDensity_average
(Q : LocalProtocol n (ObsRecord d)) (hd : 0 < d)
(f : ((Fin n → ObsRecord d) × Q.Seed) × ProtocolTranscript Q → ℝ)
(hf : Measurable f) (hf0 : ∀ w, 0 ≤ f w)
(hrow : ∀ o r, (referenceLaw Q r).withDensity
(fun z => ofReal (f ((o, r), z))) = fixedTranscriptLaw Q o r)
(pi : Measure (Fin d → ℝ)) [IsProbabilityMeasure pi]
(hpi : ∀ᵐ theta ∂pi, theta ∈ parameterCube d) (r : Q.Seed) :
Integrable (fun z => ∫ theta, canonicalTranscriptDensity f (theta, r, z) ∂pi)
(referenceLaw Q r) := by
have heq (z : ProtocolTranscript Q) :
(∫ theta, canonicalTranscriptDensity f (theta, r, z) ∂pi) =
∑ o, (∫ theta, iidAffineMass theta o ∂pi) * f ((o,r),z) := by
unfold canonicalTranscriptDensity
rw [integral_finsetSum]
· simp_rw [integral_mul_const]
· intro o _
exact (integrable_iidAffineMass_cube_prior hd pi hpi o).mul_const (f ((o,r),z))
simp_rw [heq]
apply integrable_finsetSum
intro o _
exact (integrable_fixedTranscript_row_density Q f hf hf0 hrow o r).const_mul _
Assume the stated h condition and the stated hstep condition. The L1 triangle inequality adds the costs along a finite chain of densities.
Formal statement
hypotheses
Z :
Type*
mu :
Measure Z
H :
ℕ → Z → ℝ
hH :
∀ v, Integrable (H v) mu
D :
ℕ
B :
ℝ
hstep :
∀ v < D, (∫ z, |H v z - H (v+1) z| ∂mu) ≤ B
conclusion
(∫ z, |H 0 z - H D z| ∂mu) ≤ D * B
Proof (Lean source)
-- @node: integral_abs_chain_le
lemma integral_abs_chain_le {Z : Type*} [MeasurableSpace Z] (mu : Measure Z)
(H : ℕ → Z → ℝ) (hH : ∀ v, Integrable (H v) mu) (D : ℕ) (B : ℝ)
(hstep : ∀ v < D, (∫ z, |H v z - H (v+1) z| ∂mu) ≤ B) :
(∫ z, |H 0 z - H D z| ∂mu) ≤ D * B := by
have hchain : ∀ v ≤ D, (∫ z, |H 0 z - H v z| ∂mu) ≤ v * B := by
intro v
induction v with
| zero => intro _; simp
| succ v ih =>
intro hv
calc
_ ≤ ∫ z, |H 0 z - H v z| + |H v z - H (v+1) z| ∂mu := by
apply integral_mono ((hH 0).sub (hH (v+1))).abs
(((hH 0).sub (hH v)).abs.add ((hH v).sub (hH (v+1))).abs)
intro z
change |H 0 z - H (v+1) z| ≤ |H 0 z - H v z| + |H v z - H (v+1) z|
have heq : H 0 z - H (v+1) z = (H 0 z - H v z) + (H v z - H (v+1) z) := by ring
rw [heq]
exact abs_add_le _ _
_ = (∫ z, |H 0 z - H v z| ∂mu) +
∫ z, |H v z - H (v+1) z| ∂mu :=
integral_add ((hH 0).sub (hH v)).abs ((hH v).sub (hH (v+1))).abs
_ ≤ v * B + B := add_le_add (ih (by omega)) (hstep v (by omega))
_ = (v+1 : ℕ) * B := by push_cast; ring
exact hchain D le_rfl
theorem canonical_density_product_matching_L1
Assume a nonnegative privacy budget, positive dimension, measurability of f, the function hf0, the function hrow, the stated hcert condition, amplitude between zero and one half, the stated hnu0 condition, the stated hnu1 condition, the stated hk condition, order no larger than the sample size, and the stated hmom condition. Coordinate replacement and the exact averaged-coordinate bound telescope to an L1 bound for the two full product-prior densities at each fixed seed.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
eps :
ℝ
heps :
0 ≤ eps
hd :
0 < d
f :
hf :
hf0 :
∀ w, 0 ≤ f w
hrow :
hcert :
DensityCertificate Q eps (canonicalTranscriptDensity f)
r :
Q.Seed
a :
ℝ
ha :
a ∈ Ioc 0 (1 / 2 : ℝ)
nu0 nu1 :
Measure ℝ
hnu0 :
AmplitudePrior a nu0
hnu1 :
AmplitudePrior a nu1
k :
ℕ
hk :
1 ≤ k
hkn :
k ≤ n
hmom :
MatchingMoments k nu0 nu1
conclusion
(∫ z, |(∫ theta, canonicalTranscriptDensity f (theta,r,z) ∂productPrior d nu0) - (∫ theta, canonicalTranscriptDensity f (theta,r,z) ∂productPrior d nu1)| ∂referenceLaw Q r)
Proof (Lean source)
-- @node: canonical_density_product_matching_L1
lemma canonical_density_product_matching_L1
(Q : LocalProtocol n (ObsRecord d)) (eps : ℝ) (heps : 0 ≤ eps) (hd : 0 < d)
(f : ((Fin n → ObsRecord d) × Q.Seed) × ProtocolTranscript Q → ℝ)
(hf : Measurable f) (hf0 : ∀ w, 0 ≤ f w)
(hrow : ∀ o r, (referenceLaw Q r).withDensity
(fun z => ofReal (f ((o, r), z))) = fixedTranscriptLaw Q o r)
(hcert : DensityCertificate Q eps (canonicalTranscriptDensity f))
(r : Q.Seed) (a : ℝ) (ha : a ∈ Ioc 0 (1 / 2 : ℝ))
(nu0 nu1 : Measure ℝ) (hnu0 : AmplitudePrior a nu0) (hnu1 : AmplitudePrior a nu1)
(k : ℕ) (hk : 1 ≤ k) (hkn : k ≤ n) (hmom : MatchingMoments k nu0 nu1) :
(∫ z, |(∫ theta, canonicalTranscriptDensity f (theta,r,z) ∂productPrior d nu0) -
(∫ theta, canonicalTranscriptDensity f (theta,r,z) ∂productPrior d nu1)|
∂referenceLaw Q r) ≤
2 * d * a^k * sqrt (choose n k) * (derivativeScale d eps)^k := by
classical
letI := hnu0.1
letI := hnu1.1
let mu := hybridCoordinatePrior (d := d) nu0 nu1
haveI hprob : ∀ v j, IsProbabilityMeasure (mu v j) :=
fun v j => (hybridCoordinatePrior_amplitude a nu0 nu1 hnu0 hnu1 v j).1
have hcube (v : ℕ) : ∀ᵐ theta ∂Measure.pi (mu v), theta ∈ parameterCube d :=
amplitude_hybridPrior_ae_cube a ha.2 nu0 nu1 hnu0 hnu1 v
let H := fun v z => ∫ theta, canonicalTranscriptDensity f (theta,r,z) ∂Measure.pi (mu v)
have hH (v : ℕ) : Integrable (H v) (referenceLaw Q r) :=
integrable_canonicalTranscriptDensity_average Q hd f hf hf0 hrow _ (hcube v) r
have hstep (v : ℕ) (hv : v < d) :
(∫ z, |H v z - H (v+1) z| ∂referenceLaw Q r) ≤
2 * a^k * sqrt (choose n k) * (derivativeScale d eps)^k := by
let j : Fin d := ⟨v,hv⟩
have heq (z : ProtocolTranscript Q) : H v z - H (v+1) z =
∫ theta, ((∫ u, canonicalTranscriptDensity f (update theta j u,r,z) ∂nu0) -
(∫ u, canonicalTranscriptDensity f (update theta j u,r,z) ∂nu1))
∂Measure.pi (mu v) := by
have h0 : update (mu v) j nu0 = mu v :=
hybridCoordinatePrior_update_first nu0 nu1 v hv
have h1 : update (mu v) j nu1 = mu (v+1) :=
(hybridCoordinatePrior_succ nu0 nu1 v hv).symm
have hi0 := integrable_canonicalTranscriptDensity_prior (Q := Q) hd f _ (hcube v) r z
have hi1 := integrable_canonicalTranscriptDensity_prior (Q := Q) hd f _ (hcube (v+1)) r z
have hp0 := productPrior_update_integral (mu v) nu0 j
(fun theta => canonicalTranscriptDensity f (theta,r,z)) (h0.symm ▸ hi0)
have hp1 := productPrior_update_integral (mu v) nu1 j
(fun theta => canonicalTranscriptDensity f (theta,r,z)) (h1.symm ▸ hi1)
have hmp0 : MeasurePreserving (fun w : (Fin d → ℝ) × ℝ => update w.1 j w.2)
((Measure.pi (mu v)).prod nu0) (Measure.pi (mu v)) :=
⟨by fun_prop, by rw [productPrior_update_map, h0]⟩
have hmp1 : MeasurePreserving (fun w : (Fin d → ℝ) × ℝ => update w.1 j w.2)
((Measure.pi (mu v)).prod nu1) (Measure.pi (mu (v+1))) :=
⟨by fun_prop, by rw [productPrior_update_map, h1]⟩
have hInt0 : Integrable (fun theta => ∫ u,
canonicalTranscriptDensity f (update theta j u,r,z) ∂nu0)
(Measure.pi (mu v)) := by
simpa only [Function.comp_def] using
(hmp0.integrable_comp_of_integrable hi0).integral_prod_left
have hInt1 : Integrable (fun theta => ∫ u,
canonicalTranscriptDensity f (update theta j u,r,z) ∂nu1)
(Measure.pi (mu v)) := by
simpa only [Function.comp_def] using
(hmp1.integrable_comp_of_integrable hi1).integral_prod_left
rw [integral_sub hInt0 hInt1, hp0, hp1, h0, h1]
simp_rw [heq]
exact canonical_density_averaged_coordinate_matching_L1 Q eps heps hd f hf hf0 hrow hcert
(Measure.pi (mu v)) (hcube v) r j a ha nu0 nu1 hnu0 hnu1 k hk hkn hmom
have hbound := integral_abs_chain_le (referenceLaw Q r) H hH d
(2 * a^k * sqrt (choose n k) * (derivativeScale d eps)^k) hstep
have h0 : mu 0 = fun _ => nu0 := by funext j; simp [mu, hybridCoordinatePrior]
have hd' : mu d = fun _ => nu1 := by
funext j
simp [mu, hybridCoordinatePrior, j.isLt]
simpa only [H, h0, hd', productPrior] using
(hbound.trans_eq (by ring))
theorem density_product_matching_of_gate
Assume measurable Radon–Nikodym densities for dominated kernels, sequential local privacy of the protocol, and an admissible sample size, dimension, and privacy budget. The RN gate supplies a canonical density certificate with the full product-prior L1 contraction bound at every seed.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
eps :
ℝ
hQ :
SequentialClass Q eps
hAllowed :
Allowed n d eps
conclusion
∃ p : (Fin d → ℝ) × Q.Seed × ProtocolTranscript Q → ℝ,
DensityCertificate Q eps p
conclusion 1
r :
a ∈ Set.Ioc 0 (1 / 2 : ℝ) :
nu0 nu1 :
Measure ℝ
AmplitudePrior a nu0
AmplitudePrior a nu1
k :
ℕ
1 ≤ k
k ≤ n
MatchingMoments k nu0 nu1
Proof (Lean source)
-- @node: density_product_matching_of_gate
lemma density_product_matching_of_gate (hRN : MeasurableKernelRadonNikodym)
(Q : LocalProtocol n (ObsRecord d)) (eps : ℝ) (hQ : SequentialClass Q eps)
(hAllowed : Allowed n d eps) :
∃ p : (Fin d → ℝ) × Q.Seed × ProtocolTranscript Q → ℝ,
DensityCertificate Q eps p ∧
∀ r, ∀ a ∈ Ioc 0 (1 / 2 : ℝ), ∀ nu0 nu1 : Measure ℝ,
AmplitudePrior a nu0 → AmplitudePrior a nu1 → ∀ k : ℕ,
1 ≤ k → k ≤ n → MatchingMoments k nu0 nu1 →
(∫ z, |(∫ theta, p (theta,r,z) ∂productPrior d nu0) -
(∫ theta, p (theta,r,z) ∂productPrior d nu1)| ∂referenceLaw Q r) ≤
2 * d * a^k * sqrt (choose n k) * (derivativeScale d eps)^k := by
obtain ⟨f, hf, hf0, hrow, hcert⟩ :=
canonical_density_certificate_rows_of_gate hRN Q eps hQ hAllowed
refine ⟨canonicalTranscriptDensity f, hcert, ?_⟩
intro r a ha nu0 nu1 hnu0 hnu1 k hk hkn hmom
exact canonical_density_product_matching_L1 Q eps (le_of_lt hAllowed.2.2.1)
(by have := hAllowed.2.1; omega) f hf hf0 hrow hcert r a ha
nu0 nu1 hnu0 hnu1 k hk hkn hmom
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Contraction.StageDensity 11 declarations Uniform finite averages dominate each input row.
Stagewise reference densities
Uniform finite averages dominate each input row. Applying the measurable kernel Radon–Nikodym gate to these stage references gives jointly measurable nonnegative real densities, at every history and seed, for the ancillary-averaged protocol.
Fix the Markov kernel K. Uniform averaging of finitely many probability kernels at a common parameter.
Definition (Lean source)
parameters
I H Z :
K :
I → Kernel H Z
def
given by
⟨fun h
=> (Fintype.card I : ℝ≥0∞)⁻¹ • ∑ a, K a h, by apply Measure.measurable_of_measurable_coe intro E hE simp only [Measure.smul_apply, smul_eq_mul, Measure.finsetSum_apply] exact measurable_const.mul (Finset.measurable_sum _ (fun a _ => (K a).measurable_coe hE))⟩
theorem uniformRowAverage_markov
Assume the Markov kernel hK. A uniform average of a nonempty finite family of Markov kernels is Markov.
Formal statement
Proof (Lean source)
-- @node: uniformRowAverage_markov
lemma uniformRowAverage_markov {I H Z : Type} [Fintype I] [Nonempty I]
[MeasurableSpace H] [MeasurableSpace Z] (K : I → Kernel H Z)
(hK : ∀ a, IsMarkovKernel (K a)) : IsMarkovKernel (uniformRowAverage K) := by
constructor
intro h
constructor
have hmass (a : I) : K a h univ = 1 := by
let := hK a
exact measure_univ
change ((Fintype.card I : ℝ≥0∞)⁻¹ • ∑ a, K a h) univ = 1
simp only [Measure.smul_apply, smul_eq_mul, Measure.finsetSum_apply, hmass,
Finset.sum_const, Finset.card_univ, nsmul_eq_mul, mul_one]
exact ENNReal.inv_mul_cancel (by exact_mod_cast Fintype.card_ne_zero) (by simp)
theorem row_absolutelyContinuous_uniformRowAverage
Every row is dominated by the uniform finite average, with no privacy premise.
Formal statement
hypotheses
conclusion
K a h ≪ uniformRowAverage K h
Proof (Lean source)
-- @node: row_absolutelyContinuous_uniformRowAverage
lemma row_absolutelyContinuous_uniformRowAverage {I H Z : Type} [Fintype I]
[Nonempty I] [MeasurableSpace H] [MeasurableSpace Z]
(K : I → Kernel H Z) (a : I) (h : H) : K a h ≪ uniformRowAverage K h := by
intro E hE
change ((Fintype.card I : ℝ≥0∞)⁻¹ • ∑ b, K b h) E = 0 at hE
simp only [Measure.smul_apply, smul_eq_mul, Measure.finsetSum_apply] at hE
have hsum : ∑ b, K b h E = 0 :=
(mul_eq_zero.mp hE).resolve_left (by simp)
exact (Finset.sum_eq_zero_iff.mp hsum) a (Finset.mem_univ a)
theorem uniformRowAverage_density_sum_ae
Assume the Markov kernel hK, measurability of f, the stated hf0 condition, and the stated hrep condition. Finite row densities have average one almost everywhere under their reference.
Formal statement
hypotheses
I H Z :
K :
I → Kernel H Z
hK :
∀ a, IsMarkovKernel (K a)
h :
H
f :
I → Z → ℝ
hf :
∀ a, Measurable (f a)
hf0 :
∀ a z, 0 ≤ f a z
hrep :
∀ a, (uniformRowAverage K h).withDensity (fun z => ofReal (f a z)) = K a h
conclusion
∀ᵐ z ∂uniformRowAverage K h, ∑ a, f a z = (Fintype.card I : ℝ)
Proof (Lean source)
-- @node: uniformRowAverage_density_sum_ae
lemma uniformRowAverage_density_sum_ae {I H Z : Type} [Fintype I] [Nonempty I]
[MeasurableSpace H] [MeasurableSpace Z] (K : I → Kernel H Z)
(hK : ∀ a, IsMarkovKernel (K a)) (h : H) (f : I → Z → ℝ)
(hf : ∀ a, Measurable (f a)) (hf0 : ∀ a z, 0 ≤ f a z)
(hrep : ∀ a, (uniformRowAverage K h).withDensity
(fun z => ofReal (f a z)) = K a h) :
∀ᵐ z ∂uniformRowAverage K h, ∑ a, f a z = (Fintype.card I : ℝ) := by
let := uniformRowAverage_markov K hK
let c : ℝ≥0∞ := (Fintype.card I : ℝ≥0∞)⁻¹
have hc : c ≠ 0 := by simp [c]
have hdens : (uniformRowAverage K h).withDensity
(fun z => c * ∑ a, ofReal (f a z)) = uniformRowAverage K h := by
ext E hE
rw [withDensity_apply _ hE]
rw [lintegral_const_mul _ (Finset.measurable_sum _
(fun a _ => (hf a).ennreal_ofReal)), lintegral_finsetSum]
· change c * (∑ a, ∫⁻ z in E, ofReal (f a z) ∂uniformRowAverage K h) =
((Fintype.card I : ℝ≥0∞)⁻¹ • ∑ a, K a h) E
simp only [Measure.smul_apply, smul_eq_mul, Measure.finsetSum_apply]
congr 1
apply Finset.sum_congr rfl
intro a _
rw [← withDensity_apply _ hE, hrep a]
· intro a _
exact (hf a).ennreal_ofReal
have heq := (withDensity_eq_iff_of_sigmaFinite
(measurable_const.mul (Finset.measurable_sum _
(fun a _ => (hf a).ennreal_ofReal))).aemeasurable
measurable_const.aemeasurable).mp (hdens.trans withDensity_one.symm)
filter_upwards [heq] with z hz
change c * (∑ a, ofReal (f a z)) = 1 at hz
have hsum : ∑ a, ofReal (f a z) = (Fintype.card I : ℝ≥0∞) := by
have hh := congrArg (fun x : ℝ≥0∞ => (Fintype.card I : ℝ≥0∞) * x) hz
simpa only [c, ← mul_assoc, ENNReal.mul_inv_cancel (a := (Fintype.card I : ℝ≥0∞))
(by exact_mod_cast Fintype.card_ne_zero) (by simp), one_mul, mul_one] using hh
have hh := congrArg toReal hsum
simpa only [ENNReal.toReal_sum (fun a _ => ENNReal.ofReal_ne_top),
ENNReal.toReal_ofReal (hf0 _ _), ENNReal.toReal_natCast] using hh
Assume measurability of f, measurability of g, the stated hg0 condition, the stated hc condition, and the set hpriv. An all-event privacy inequality transfers to any measurable density versions.
Formal statement
hypotheses
Z :
Type
mu :
f g :
Z → ℝ
hf :
hg :
hg0 :
∀ z, 0 ≤ g z
c :
ℝ
hc :
0 ≤ c
hpriv :
∀ E
if
conclusion
∀ᵐ z ∂mu, f z ≤ c * g z
Proof (Lean source)
-- @node: row_density_privacy_ae
lemma row_density_privacy_ae {Z : Type} [MeasurableSpace Z]
(mu : Measure Z) [IsFiniteMeasure mu] (f g : Z → ℝ)
(hf : Measurable f) (hg : Measurable g) (hg0 : ∀ z, 0 ≤ g z)
(c : ℝ) (hc : 0 ≤ c)
(hpriv : ∀ E, MeasurableSet E →
mu.withDensity (fun z => ofReal (f z)) E ≤
ofReal c * mu.withDensity (fun z => ofReal (g z)) E) :
∀ᵐ z ∂mu, f z ≤ c * g z := by
have hh : (fun z => ofReal (f z)) ≤ᵐ[mu]
(fun z => ofReal (c * g z)) := by
apply ae_le_of_forall_setLIntegral_le_of_sigmaFinite hf.ennreal_ofReal
intro E hE _
simp only [ENNReal.ofReal_mul hc]
rw [lintegral_const_mul _ hg.ennreal_ofReal]
simpa only [withDensity_apply _ hE] using hpriv E hE
filter_upwards [hh] with z hz
exact (ENNReal.ofReal_le_ofReal_iff (mul_nonneg hc (hg0 z))).mp hz
theorem repair_uniform_row_densities
Assume the stated privacy condition for the protocol, measurability of f, the stated hf0 condition, the stated hrep condition, a privacy factor at least one, and the stated hpriv condition. A common measurable null-set repair makes normalization and privacy pointwise, without changing any represented row at any parameter.
Formal statement
hypotheses
I H Z :
K :
I → Kernel H Z
hK :
∀ a, IsMarkovKernel (K a)
f :
I → H × Z → ℝ
hf :
∀ a, Measurable (f a)
hf0 :
∀ a w, 0 ≤ f a w
hrep :
∀ a h, (uniformRowAverage K h).withDensity (fun z => ofReal (f a (h, z))) = K a h
c :
ℝ
hc :
1 ≤ c
hpriv :
∀ a b h E
if
then
K a h E ≤ ofReal c * K b h E
conclusion
∃ g : I → H × Z → ℝ,
conclusion 2
a w :
0 ≤ g a w
conclusion 3
w :
∑ a, g a w = (Fintype.card I : ℝ)
conclusion 4
a b w :
g a w ≤ c * g b w
Proof (Lean source)
-- @node: repair_uniform_row_densities
lemma repair_uniform_row_densities {I H Z : Type} [Fintype I] [Nonempty I]
[MeasurableSpace H] [MeasurableSpace Z] (K : I → Kernel H Z)
(hK : ∀ a, IsMarkovKernel (K a)) (f : I → H × Z → ℝ)
(hf : ∀ a, Measurable (f a)) (hf0 : ∀ a w, 0 ≤ f a w)
(hrep : ∀ a h, (uniformRowAverage K h).withDensity
(fun z => ofReal (f a (h, z))) = K a h)
(c : ℝ) (hc : 1 ≤ c)
(hpriv : ∀ a b h E, MeasurableSet E → K a h E ≤ ofReal c * K b h E) :
∃ g : I → H × Z → ℝ, (∀ a, Measurable (g a)) ∧
(∀ a w, 0 ≤ g a w) ∧
(∀ w, ∑ a, g a w = (Fintype.card I : ℝ)) ∧
(∀ a b w, g a w ≤ c * g b w) ∧
∀ a h, (uniformRowAverage K h).withDensity
(fun z => ofReal (g a (h, z))) = K a h := by
classical
let good : Set (H × Z) := {w | (∑ a, f a w) = (Fintype.card I : ℝ) ∧
∀ a b, f a w ≤ c * f b w}
have hgood : MeasurableSet good := by
have hp : MeasurableSet {w : H × Z | ∀ a b, f a w ≤ c * f b w} := by
simpa only [Set.ofPred_forall, Pi.mul_apply] using (MeasurableSet.iInter fun a =>
MeasurableSet.iInter fun b => measurableSet_le (hf a)
((measurable_const : Measurable (fun _ : H × Z => c)).mul (hf b)))
exact (measurableSet_eq_fun (Finset.measurable_sum _ (fun a _ => hf a))
measurable_const).inter hp
have hae (h : H) : ∀ᵐ z ∂uniformRowAverage K h, (h, z) ∈ good := by
let := uniformRowAverage_markov K hK
have hsum := uniformRowAverage_density_sum_ae K hK h
(fun a z => f a (h, z)) (fun a => (hf a).comp (by fun_prop))
(fun a z => hf0 a (h, z)) (fun a => hrep a h)
have hp : ∀ a b, ∀ᵐ z ∂uniformRowAverage K h, f a (h, z) ≤ c * f b (h, z) := by
intro a b
apply row_density_privacy_ae _ _ _ ((hf a).comp (by fun_prop))
((hf b).comp (by fun_prop)) (fun z => hf0 b (h, z)) c (by linarith)
intro E hE
simp only [Function.comp_def]
rw [hrep a h, hrep b h]
exact hpriv a b h E hE
have hpall : ∀ᵐ z ∂uniformRowAverage K h, ∀ a b, f a (h, z) ≤ c * f b (h, z) :=
ae_all_iff.mpr (fun a => ae_all_iff.mpr (hp a))
filter_upwards [hsum, hpall] with z hz hpz
exact ⟨hz, hpz⟩
let g : I → H × Z → ℝ := fun a w => if w ∈ good then f a w else 1
refine ⟨g, fun a => (hf a).piecewise hgood measurable_const, ?_, ?_, ?_, ?_⟩
· intro a w
dsimp [g]
split_ifs
· exact hf0 a w
· norm_num
· intro w
by_cases hw : w ∈ good
· simpa only [g, if_pos hw] using hw.1
· simp [g, hw]
· intro a b w
by_cases hw : w ∈ good
· simpa only [g, if_pos hw] using hw.2 a b
· simpa only [g, if_neg hw, mul_one] using hc
· intro a h
have heq : (fun z => ofReal (g a (h, z))) =ᵐ[uniformRowAverage K h]
(fun z => ofReal (f a (h, z))) := by
filter_upwards [hae h] with z hz
simp only [g, if_pos hz]
exact withDensity_congr_ae heq |>.trans (hrep a h)
def stageReferenceKernel
Fix the local protocol Q and the participant index. Stage reference rows are the uniform average of all paired-input rows, with the ancillary assignment already integrated out.
Definition (Lean source)
parameters
def
given by
uniformRowAverage (fun a : PairedSymbol d => (averagedKernel Q i).comap (fun h => ((a, h.1), h.2)) (by fun_prop))
theorem stageReferenceKernel_markov
Assume positive dimension. Each stage reference is a probability kernel, including at null histories.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: stageReferenceKernel_markov
lemma stageReferenceKernel_markov {n d : ℕ} (Q : LocalProtocol n (ObsRecord d))
(i : Fin n) (hd : 0 < d) : IsMarkovKernel (stageReferenceKernel Q i) := by
let : Nonempty (Fin d) := ⟨⟨0, hd⟩⟩
let := averagedKernel_markov Q i
apply uniformRowAverage_markov
intro a
infer_instance
theorem stage_density_of_gate
Assume measurable Radon–Nikodym densities for dominated kernels and positive dimension. The measurable RN gate gives nonnegative stage densities jointly in input, seed, history and message. The reference is the uniform input average, rather than a whole-transcript RN witness.
Formal statement
hypotheses
conclusion
∃ f : ((PairedSymbol d × Q.Seed) × ProtocolHistory Q i) × Q.Message i → ℝ,
conclusion 1
w :
0 ≤ f w
conclusion 2
a r eta :
(stageReferenceKernel Q i (r, eta)).withDensity (fun z => ofReal (f (((a, r), eta), z)))
= averagedKernel Q i ((a, r), eta)
Proof (Lean source)
-- @node: stage_density_of_gate
lemma stage_density_of_gate (hRN : MeasurableKernelRadonNikodym)
{n d : ℕ} (Q : LocalProtocol n (ObsRecord d)) (i : Fin n) (hd : 0 < d) :
∃ f : ((PairedSymbol d × Q.Seed) × ProtocolHistory Q i) × Q.Message i → ℝ,
Measurable f ∧ (∀ w, 0 ≤ f w) ∧ ∀ a r eta,
(stageReferenceKernel Q i (r, eta)).withDensity
(fun z => ofReal (f (((a, r), eta), z))) =
averagedKernel Q i ((a, r), eta) := by
let : Nonempty (Fin d) := ⟨⟨0, hd⟩⟩
let := averagedKernel_markov Q i
let := stageReferenceKernel_markov Q i hd
let L := (stageReferenceKernel Q i).comap
(fun w : (PairedSymbol d × Q.Seed) × ProtocolHistory Q i => (w.1.2, w.2))
(by fun_prop)
have hac : ∀ w, averagedKernel Q i w ≪ L w := by
intro w
exact row_absolutelyContinuous_uniformRowAverage
(fun a : PairedSymbol d => (averagedKernel Q i).comap
(fun h : Q.Seed × ProtocolHistory Q i => ((a, h.1), h.2)) (by fun_prop))
w.1.1 (w.1.2, w.2)
obtain ⟨f, hf, hrep⟩ := real_kernel_density_of_gate hRN (averagedKernel Q i) L hac
refine ⟨fun w => max (f w) 0, hf.max measurable_const, fun w => le_max_right _ _, ?_⟩
intro a r eta
simpa only [ENNReal.ofReal_max, ENNReal.ofReal_zero, max_zero, L, Kernel.comap_apply]
using hrep ((a, r), eta)
Assume the stated hc condition, the stated hsum condition, and the stated hpriv condition. Uniform normalization and pairwise privacy bound each row away from zero and above by the privacy factor.
Formal statement
hypotheses
I :
f :
I → ℝ
c :
ℝ
hc :
0 < c
hsum :
∑ a, f a = (Fintype.card I : ℝ)
hpriv :
∀ a b, f a ≤ c * f b
a :
I
conclusion
conclusion 1
c⁻¹ ≤ f a
conclusion 2
f a ≤ c
Proof (Lean source)
-- @node: normalized_private_row_bounds
lemma normalized_private_row_bounds {I : Type} [Fintype I] [Nonempty I]
(f : I → ℝ) (c : ℝ) (hc : 0 < c)
(hsum : ∑ a, f a = (Fintype.card I : ℝ))
(hpriv : ∀ a b, f a ≤ c * f b) (a : I) : c⁻¹ ≤ f a ∧ f a ≤ c := by
have hcard : (0 : ℝ) < Fintype.card I := by exact_mod_cast Fintype.card_pos
have hlo := Finset.sum_le_sum (s := univ) (fun b _ => hpriv b a)
have hhi := Finset.sum_le_sum (s := univ) (fun b _ => hpriv a b)
simp only [Finset.sum_const, Finset.card_univ, nsmul_eq_mul, hsum] at hlo
rw [← Finset.mul_sum, hsum] at hhi
simp only [Finset.sum_const, Finset.card_univ, nsmul_eq_mul] at hhi
constructor
· rw [← one_div, div_le_iff₀ hc]
nlinarith
· nlinarith
theorem stage_density_repaired_of_gate
Assume measurable Radon–Nikodym densities for dominated kernels, positive dimension, a nonnegative privacy budget, and sequential local privacy of the protocol. Repaired stage densities jointly represent every private paired-input row and satisfy exact uniform normalization and privacy at every message, history and seed.
Formal statement
hypotheses
n d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
i :
Fin n
hd :
0 < d
eps :
ℝ
heps :
0 ≤ eps
hQ :
SequentialClass Q eps
conclusion
∃ f : ((PairedSymbol d × Q.Seed) × ProtocolHistory Q i) × Q.Message i → ℝ,
conclusion 1
w :
0 ≤ f w
conclusion 5
a r eta :
(stageReferenceKernel Q i (r, eta)).withDensity (fun z => ofReal (f (((a, r), eta), z)))
= averagedKernel Q i ((a, r), eta)
Proof (Lean source)
-- @node: stage_density_repaired_of_gate
lemma stage_density_repaired_of_gate (hRN : MeasurableKernelRadonNikodym)
{n d : ℕ} (Q : LocalProtocol n (ObsRecord d)) (i : Fin n) (hd : 0 < d)
(eps : ℝ) (heps : 0 ≤ eps) (hQ : SequentialClass Q eps) :
∃ f : ((PairedSymbol d × Q.Seed) × ProtocolHistory Q i) × Q.Message i → ℝ,
Measurable f ∧ (∀ w, 0 ≤ f w) ∧
(∀ r eta z, (∑ a : PairedSymbol d, f (((a, r), eta), z)) = (2*d : ℝ)) ∧
(∀ a b r eta z, f (((a, r), eta), z) ≤ exp eps * f (((b, r), eta), z)) ∧
(∀ w, exp (-eps) ≤ f w ∧ f w ≤ exp eps) ∧
∀ a r eta, (stageReferenceKernel Q i (r, eta)).withDensity
(fun z => ofReal (f (((a, r), eta), z))) = averagedKernel Q i ((a, r), eta) := by
let : Nonempty (Fin d) := ⟨⟨0, hd⟩⟩
let := averagedKernel_markov Q i
let K : PairedSymbol d → Kernel (Q.Seed × ProtocolHistory Q i) (Q.Message i) :=
fun a => (averagedKernel Q i).comap (fun h => ((a, h.1), h.2)) (by fun_prop)
obtain ⟨f, hf, hf0, hrep⟩ := stage_density_of_gate hRN Q i hd
obtain ⟨g, hg, hg0, hsum, hpriv, hgrep⟩ := repair_uniform_row_densities K
(fun _ => by dsimp [K]; infer_instance)
(fun a w => f (((a, w.1.1), w.1.2), w.2))
(fun a => hf.comp (by fun_prop)) (fun a w => hf0 _)
(fun a h => hrep a h.1 h.2) (exp eps) (Real.one_le_exp_iff.mpr heps)
(fun a b h E hE => averagedProtocol_privacy Q eps hQ.privacy i a b h.2 h.1 E hE)
have hjoint : Measurable (fun w : PairedSymbol d ×
((Q.Seed × ProtocolHistory Q i) × Q.Message i) => g w.1 w.2) := by
apply measurable_from_prod_countable_right
exact hg
refine ⟨fun w => g w.1.1.1 ((w.1.1.2, w.1.2), w.2),
hjoint.comp (show Measurable (fun w : ((PairedSymbol d × Q.Seed) ×
ProtocolHistory Q i) × Q.Message i =>
(w.1.1.1, ((w.1.1.2, w.1.2), w.2))) by fun_prop), ?_, ?_, ?_, ?_, ?_⟩
· intro w
exact hg0 _ _
· intro r eta z
simpa only [PairedSymbol, Fintype.card_prod, Fintype.card_fin, Fintype.card_bool,
Nat.cast_mul, Nat.cast_ofNat, mul_comm] using hsum ((r, eta), z)
· intro a b r eta z
exact hpriv a b ((r, eta), z)
· intro w
simpa only [Real.exp_neg] using normalized_private_row_bounds
(fun a => g a ((w.1.1.2, w.1.2), w.2)) (exp eps) (Real.exp_pos eps)
(hsum _) (fun a b => hpriv a b _) w.1.1.1
· intro a r eta
exact hgrep a (r, eta)
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Contraction.StageIdentification 7 declarations At each fixed public seed, ancillary reconstruction identifies the paired adaptive experiment with the original-record experiment.
Original-record identification of stage products
At each fixed public seed, ancillary reconstruction identifies the paired adaptive experiment with the original-record experiment. Consequently the structural stage product represents the transcript law relative to its zero-contrast reference.
theorem conditionalTranscriptLaw_eq_paired
Assume the stated htheta condition and positive dimension. Integrating the independent reconstruction bits identifies the full transcript law at every fixed seed, including seeds of public-law measure zero.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
theta :
Fin d → ℝ
htheta :
theta ∈ parameterCube d
hd :
0 < d
r :
Q.Seed
conclusion
conditionalTranscriptLaw Q theta r
= (Measure.pi (fun _ : Fin n => pairedLaw theta)).bind (fun a => fixedTranscriptLaw (averagedProtocol Q) a r)
Proof (Lean source)
-- @node: conditionalTranscriptLaw_eq_paired
lemma conditionalTranscriptLaw_eq_paired (Q : LocalProtocol n (ObsRecord d))
(theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d) (hd : 0 < d)
(r : Q.Seed) :
conditionalTranscriptLaw Q theta r =
(Measure.pi (fun _ : Fin n => pairedLaw theta)).bind
(fun a => fixedTranscriptLaw (averagedProtocol Q) a r) := by
haveI : IsProbabilityMeasure (pairedLaw theta) :=
pairedFamily_subset_simplex hd (Set.mem_image_of_mem pairedLaw htheta)
ext E hE
rw [conditionalTranscriptLaw, Measure.bind_apply hE
(show Measurable (fun o => fixedTranscriptLaw Q o r) by fun_prop).aemeasurable,
Measure.bind_apply hE
(show Measurable (fun a => fixedTranscriptLaw (averagedProtocol Q) a r)
by fun_prop).aemeasurable]
rw [← symmetricLaw_iid_reconstruction theta htheta hd,
lintegral_map (by fun_prop) (by fun_prop)]
rw [lintegral_prod _ (by fun_prop)]
apply lintegral_congr
intro a
have h := averagedProtocol_fixedTranscript_lintegral Q a r
(E.indicator (fun _ => (1 : ℝ≥0∞))) (measurable_const.indicator hE)
change (∫⁻ b, ∫⁻ z, E.indicator (fun _ => (1 : ℝ≥0∞)) z
∂fixedTranscriptLaw Q (fun i => recoverObs (a i) (b i)) r
∂Measure.pi (fun _ : Fin n => ancillaryBitLaw)) =
∫⁻ z : ProtocolTranscript Q, E.indicator (fun _ => (1 : ℝ≥0∞)) z
∂fixedTranscriptLaw (averagedProtocol Q) a r at h
simpa only [lintegral_indicator hE, lintegral_one, Measure.restrict_apply_univ] using h
theorem stageReferenceTranscriptLaw_eq_reference
Assume positive dimension, measurability of f, the stated hf0 condition, the stated hsum condition, and the function hrep. The uniform stage chain is the actual zero-contrast reference experiment.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
hd :
0 < d
r :
Q.Seed
f :
hf :
∀ i, Measurable (f i)
hf0 :
∀ i w, 0 ≤ f i w
hsum :
∀ i eta z, (∑ a : PairedSymbol d, f i (((a,r),eta),z)) = (2*d : ℝ)
hrep :
∀ (a : Fin n → PairedSymbol d),
(stageReferenceTranscriptLaw Q r).withDensity (fun z => ofReal (∏ i : Fin n, f i (((a i,r),take (le_of_lt i.isLt) z),z i)))
= fixedTranscriptLaw (averagedProtocol Q) a r
conclusion
stageReferenceTranscriptLaw Q r = referenceLaw Q r
Proof (Lean source)
-- @node: stageReferenceTranscriptLaw_eq_reference
lemma stageReferenceTranscriptLaw_eq_reference (Q : LocalProtocol n (ObsRecord d))
(hd : 0 < d) (r : Q.Seed)
(f : (i : Fin n) →
((PairedSymbol d × Q.Seed) × ProtocolHistory Q i) × Q.Message i → ℝ)
(hf : ∀ i, Measurable (f i)) (hf0 : ∀ i w, 0 ≤ f i w)
(hsum : ∀ i eta z, (∑ a : PairedSymbol d, f i (((a,r),eta),z)) = (2*d : ℝ))
(hrep : ∀ (a : Fin n → PairedSymbol d),
(stageReferenceTranscriptLaw Q r).withDensity (fun z =>
ofReal (∏ i : Fin n,
f i (((a i,r),take (le_of_lt i.isLt) z),z i))) =
fixedTranscriptLaw (averagedProtocol Q) a r) :
stageReferenceTranscriptLaw Q r = referenceLaw Q r := by
rw [referenceLaw, conditionalTranscriptLaw_eq_paired Q _
(by intro j; constructor <;> norm_num) hd r]
exact stageReferenceTranscriptLaw_eq_zero_paired Q hd r f hf hf0 hsum hrep
theorem originalTranscript_stageProduct_withDensity
Assume the stated htheta condition, positive dimension, measurability of f, the stated hf0 condition, the stated hsum condition, and the function hrep. The explicit affine stage product represents the original-record transcript law with the exact reference measure used by the derivative certificate.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
theta :
Fin d → ℝ
htheta :
theta ∈ parameterCube d
hd :
0 < d
r :
Q.Seed
f :
hf :
∀ i, Measurable (f i)
hf0 :
∀ i w, 0 ≤ f i w
hsum :
∀ i eta z, (∑ a : PairedSymbol d, f i (((a,r),eta),z)) = (2*d : ℝ)
hrep :
∀ (a : Fin n → PairedSymbol d),
(stageReferenceTranscriptLaw Q r).withDensity (fun z => ofReal (∏ i : Fin n, f i (((a i,r),take (le_of_lt i.isLt) z),z i)))
= fixedTranscriptLaw (averagedProtocol Q) a r
conclusion
(referenceLaw Q r).withDensity (fun z => ofReal (∏ i : Fin n, stageMixtureDensity theta (fun a => f i (((a,r),take (le_of_lt i.isLt) z),z i))))
= conditionalTranscriptLaw Q theta r
Proof (Lean source)
-- @node: originalTranscript_stageProduct_withDensity
lemma originalTranscript_stageProduct_withDensity (Q : LocalProtocol n (ObsRecord d))
(theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d) (hd : 0 < d)
(r : Q.Seed)
(f : (i : Fin n) →
((PairedSymbol d × Q.Seed) × ProtocolHistory Q i) × Q.Message i → ℝ)
(hf : ∀ i, Measurable (f i)) (hf0 : ∀ i w, 0 ≤ f i w)
(hsum : ∀ i eta z, (∑ a : PairedSymbol d, f i (((a,r),eta),z)) = (2*d : ℝ))
(hrep : ∀ (a : Fin n → PairedSymbol d),
(stageReferenceTranscriptLaw Q r).withDensity (fun z =>
ofReal (∏ i : Fin n,
f i (((a i,r),take (le_of_lt i.isLt) z),z i))) =
fixedTranscriptLaw (averagedProtocol Q) a r) :
(referenceLaw Q r).withDensity (fun z => ofReal
(∏ i : Fin n, stageMixtureDensity theta
(fun a => f i (((a,r),take (le_of_lt i.isLt) z),z i)))) =
conditionalTranscriptLaw Q theta r := by
rw [← stageReferenceTranscriptLaw_eq_reference Q hd r f hf hf0 hsum hrep,
conditionalTranscriptLaw_eq_paired Q theta htheta hd r]
exact pairedTranscript_stageProduct_withDensity Q theta htheta hd r f hf hf0 hrep
theorem originalTranscript_stageProduct_of_gate
Assume measurable Radon–Nikodym densities for dominated kernels, positive dimension, a nonnegative privacy budget, and sequential local privacy of the protocol. Repaired protocol rows give the original experiment an explicit stage-product RN density, while retaining the row normalization and privacy needed by scores.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
hd :
0 < d
eps :
ℝ
heps :
0 ≤ eps
hQ :
SequentialClass Q eps
conclusion
conclusion 5
i a r eta :
(stageReferenceKernel Q i (r,eta)).withDensity (fun z => ofReal (f i (((a,r),eta),z)))
= averagedKernel Q i ((a,r),eta)
conclusion 7
theta ∈ parameterCube d :
r :
(referenceLaw Q r).withDensity (fun z => ofReal (∏ i : Fin n, stageMixtureDensity theta (fun a => f i (((a,r),take (le_of_lt i.isLt) z),z i))))
= conditionalTranscriptLaw Q theta r
Proof (Lean source)
-- @node: originalTranscript_stageProduct_of_gate
lemma originalTranscript_stageProduct_of_gate (hRN : MeasurableKernelRadonNikodym)
(Q : LocalProtocol n (ObsRecord d)) (hd : 0 < d)
(eps : ℝ) (heps : 0 ≤ eps) (hQ : SequentialClass Q eps) :
∃ f : (i : Fin n) →
((PairedSymbol d × Q.Seed) × ProtocolHistory Q i) × Q.Message i → ℝ,
(∀ i, Measurable (f i)) ∧
(∀ i w, exp (-eps) ≤ f i w ∧ f i w ≤ exp eps) ∧
(∀ i r eta z, (∑ a : PairedSymbol d, f i (((a,r),eta),z)) = (2*d : ℝ)) ∧
(∀ i a b r eta z,
f i (((a,r),eta),z) ≤ exp eps * f i (((b,r),eta),z)) ∧
(∀ i a r eta, (stageReferenceKernel Q i (r,eta)).withDensity
(fun z => ofReal (f i (((a,r),eta),z))) =
averagedKernel Q i ((a,r),eta)) ∧
(∀ r, stageReferenceTranscriptLaw Q r = referenceLaw Q r) ∧
∀ theta ∈ parameterCube d, ∀ r,
(referenceLaw Q r).withDensity (fun z => ofReal
(∏ i : Fin n, stageMixtureDensity theta
(fun a => f i (((a,r),take (le_of_lt i.isLt) z),z i)))) =
conditionalTranscriptLaw Q theta r := by
obtain ⟨f, hf, hbound, hsum, hpriv, hrow, hfixed⟩ :=
fixedPairedTranscript_product_density_of_gate hRN Q hd eps heps hQ
have hf0 : ∀ i w, 0 ≤ f i w := fun i w =>
le_trans (le_of_lt (Real.exp_pos _)) (hbound i w).1
refine ⟨f, hf, hbound, hsum, hpriv, hrow, ?_, ?_⟩
· intro r
exact stageReferenceTranscriptLaw_eq_reference Q hd r f hf hf0
(fun i eta z => hsum i r eta z) (fun a => hfixed a r)
· intro theta htheta r
exact originalTranscript_stageProduct_withDensity Q theta htheta hd r f hf hf0
(fun i eta z => hsum i r eta z) (fun a => hfixed a r)
theorem measurable_originalTranscript_stageProduct
The affine product of the repaired rows is jointly measurable in the parameter, public seed, and complete adaptive transcript when every repaired row is measurable.
Formal statement
hypotheses
conclusion
Measurable (fun w : (Fin d → ℝ) × Q.Seed × ProtocolTranscript Q => ∏ i : Fin n, stageMixtureDensity w.1 (fun a => f i (((a,w.2.1),take (le_of_lt i.isLt) w.2.2),w.2.2 i)))
Proof (Lean source)
-- @node: measurable_originalTranscript_stageProduct
@[fun_prop] lemma measurable_originalTranscript_stageProduct
(Q : LocalProtocol n (ObsRecord d))
(f : (i : Fin n) →
((PairedSymbol d × Q.Seed) × ProtocolHistory Q i) × Q.Message i → ℝ)
(hf : ∀ i, Measurable (f i)) :
Measurable (fun w : (Fin d → ℝ) × Q.Seed × ProtocolTranscript Q =>
∏ i : Fin n, stageMixtureDensity w.1
(fun a => f i (((a,w.2.1),take (le_of_lt i.isLt) w.2.2),w.2.2 i))) := by
apply Finset.measurable_prod
intro i hi
unfold stageMixtureDensity
apply Finset.measurable_sum
intro a ha
apply mul
· unfold stageInputWeight
fun_prop
· apply (hf i).comp
apply prodMk
· apply prodMk (by fun_prop)
exact (measurable_restrictHistory _ _ _).comp (by fun_prop)
· fun_prop
theorem originalTranscript_stageScore_bound
Assume positive dimension, the stated htheta condition, a nonnegative privacy budget, the stated hbound condition, and the stated hpriv condition. Every score of the actual adaptive transcript has the sharp deterministic privacy bound, with a strictly positive denominator at all histories.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
hd :
0 < d
theta :
Fin d → ℝ
htheta :
theta ∈ parameterCube d
eps :
ℝ
heps :
0 ≤ eps
f :
hbound :
∀ i w, exp (-eps) ≤ f i w
hpriv :
∀ i a b r eta z, f i (((a,r),eta),z) ≤ exp eps * f i (((b,r),eta),z)
r :
Q.Seed
z :
i :
Fin n
j :
Fin d
conclusion
0 < stageMixtureDensity theta row
Proof (Lean source)
-- @node: originalTranscript_stageScore_bound
lemma originalTranscript_stageScore_bound (Q : LocalProtocol n (ObsRecord d))
(hd : 0 < d) (theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d)
(eps : ℝ) (heps : 0 ≤ eps)
(f : (i : Fin n) →
((PairedSymbol d × Q.Seed) × ProtocolHistory Q i) × Q.Message i → ℝ)
(hbound : ∀ i w, exp (-eps) ≤ f i w)
(hpriv : ∀ i a b r eta z,
f i (((a,r),eta),z) ≤ exp eps * f i (((b,r),eta),z))
(r : Q.Seed) (z : ProtocolTranscript Q) (i : Fin n) (j : Fin d) :
let row := fun a => f i (((a,r),take (le_of_lt i.isLt) z),z i)
0 < stageMixtureDensity theta row ∧
|stageCoordinateSlope row j / stageMixtureDensity theta row| ≤
derivativeScale d eps := by
exact stageCoordinateScore_bound hd theta htheta _
(fun a => lt_of_lt_of_le (Real.exp_pos _) (hbound i _))
eps heps (fun a b => hpriv i a b r _ _) j
theorem transcript_density_ae_eq_stageProduct
Assume positive dimension, the stated htheta condition, measurability of p, the protocol transcript, the stated hp rep condition, measurability of f, the stated hf0 condition, the stated hsum condition, and the function hrep. Any nonnegative measurable density certificate agrees almost everywhere with the explicit product. This applies to the existing canonical finite-sum version without selecting another whole-transcript Radon–Nikodym witness.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
hd :
0 < d
theta :
Fin d → ℝ
htheta :
theta ∈ parameterCube d
r :
Q.Seed
p :
(Fin d → ℝ) × Q.Seed × ProtocolTranscript Q → ℝ
hp :
hp0 :
∀ z, 0 ≤ p (theta,r,z)
hpRep :
(referenceLaw Q r).withDensity (fun z => ofReal (p (theta,r,z)))
= conditionalTranscriptLaw Q theta r
f :
hf :
∀ i, Measurable (f i)
hf0 :
∀ i w, 0 ≤ f i w
hsum :
∀ i eta z, (∑ a : PairedSymbol d, f i (((a,r),eta),z)) = (2*d : ℝ)
hrep :
∀ (a : Fin n → PairedSymbol d),
(stageReferenceTranscriptLaw Q r).withDensity (fun z => ofReal (∏ i : Fin n, f i (((a i,r),take (le_of_lt i.isLt) z),z i)))
= fixedTranscriptLaw (averagedProtocol Q) a r
conclusion
(fun z => p (theta,r,z))
=ᵐ[referenceLaw Q r] (fun z => ∏ i : Fin n, stageMixtureDensity theta (fun a => f i (((a,r),take (le_of_lt i.isLt) z),z i)))
Proof (Lean source)
-- @node: transcript_density_ae_eq_stageProduct
lemma transcript_density_ae_eq_stageProduct (Q : LocalProtocol n (ObsRecord d))
(hd : 0 < d) (theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d)
(r : Q.Seed)
(p : (Fin d → ℝ) × Q.Seed × ProtocolTranscript Q → ℝ)
(hp : Measurable p) (hp0 : ∀ z, 0 ≤ p (theta,r,z))
(hpRep : (referenceLaw Q r).withDensity (fun z => ofReal (p (theta,r,z))) =
conditionalTranscriptLaw Q theta r)
(f : (i : Fin n) →
((PairedSymbol d × Q.Seed) × ProtocolHistory Q i) × Q.Message i → ℝ)
(hf : ∀ i, Measurable (f i)) (hf0 : ∀ i w, 0 ≤ f i w)
(hsum : ∀ i eta z, (∑ a : PairedSymbol d, f i (((a,r),eta),z)) = (2*d : ℝ))
(hrep : ∀ (a : Fin n → PairedSymbol d),
(stageReferenceTranscriptLaw Q r).withDensity (fun z =>
ofReal (∏ i : Fin n,
f i (((a i,r),take (le_of_lt i.isLt) z),z i))) =
fixedTranscriptLaw (averagedProtocol Q) a r) :
(fun z => p (theta,r,z)) =ᵐ[referenceLaw Q r]
(fun z => ∏ i : Fin n, stageMixtureDensity theta
(fun a => f i (((a,r),take (le_of_lt i.isLt) z),z i))) := by
haveI : IsProbabilityMeasure (referenceLaw Q r) := by
exact conditionalTranscriptLaw_probability Q _
(by intro j; constructor <;> norm_num) hd r
have hprod := originalTranscript_stageProduct_withDensity Q theta htheta hd r
f hf hf0 hsum hrep
have hm := (measurable_originalTranscript_stageProduct Q f hf).comp
(show Measurable (fun z : ProtocolTranscript Q => (theta,r,z)) by fun_prop)
have heq := (withDensity_eq_iff_of_sigmaFinite
((hp.comp (by fun_prop)).ennreal_ofReal.aemeasurable)
(hm.ennreal_ofReal.aemeasurable)).mp (hpRep.trans hprod.symm)
filter_upwards [heq] with z hz
have hnonneg : 0 ≤ ∏ i : Fin n, stageMixtureDensity theta
(fun a => f i (((a,r),take (le_of_lt i.isLt) z),z i)) := by
apply Finset.prod_nonneg
intro i hi
apply Finset.sum_nonneg
intro a ha
exact mul_nonneg (stageInputWeight_nonneg theta htheta a) (hf0 i _)
exact (ENNReal.ofReal_eq_ofReal_iff (hp0 z) hnonneg).mp hz
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Contraction.StageProduct 11 declarations A structural prefix construction carries row-level Radon–Nikodym densities through adaptive history extension.
Sequential products of stage densities
A structural prefix construction carries row-level Radon–Nikodym densities through adaptive history extension. The density is an explicit product of the stage factors.
Assume the density or prior under consideration, measurability of p, the function f, measurability of f, and the stated hrow condition. Weighting the preceding history and the conditional next-message law multiplies their densities, including for kernels depending on the whole history.
Formal statement
hypotheses
H Z :
K L :
p :
H → ℝ≥0∞
hp :
SFinite (mu.withDensity p)
f :
H × Z → ℝ≥0∞
hf :
hrow :
∀ h, (K h).withDensity (fun z => f (h,z)) = L h
conclusion
(mu.withDensity p) ⊗ₘ L = (mu ⊗ₘ K).withDensity (fun w => p w.1 * f w)
Proof (Lean source)
-- @node: stage_density_compProd
lemma stage_density_compProd {H Z : Type*} [MeasurableSpace H] [MeasurableSpace Z]
(mu : Measure H) [SFinite mu] (K L : Kernel H Z)
[IsSFiniteKernel K] [IsSFiniteKernel L]
(p : H → ℝ≥0∞) (hp : Measurable p) [SFinite (mu.withDensity p)]
(f : H × Z → ℝ≥0∞) (hf : Measurable f)
(hrow : ∀ h, (K h).withDensity (fun z => f (h,z)) = L h) :
(mu.withDensity p) ⊗ₘ L =
(mu ⊗ₘ K).withDensity (fun w => p w.1 * f w) := by
ext E hE
rw [Measure.compProd_apply hE,
lintegral_withDensity_eq_lintegral_mul _ hp (Kernel.measurable_kernel_prodMk_left hE),
withDensity_apply _ hE, ← lintegral_indicator hE,
]
rw [Measure.lintegral_compProd]
swap
· exact (((hp.comp measurable_fst).mul hf).indicator hE)
apply lintegral_congr
intro h
change p h * (L h) (Prod.mk h ⁻¹' E) = _
rw [← hrow h, withDensity_apply _ (hE.preimage measurable_prodMk_left)]
rw [← lintegral_indicator (hE.preimage measurable_prodMk_left)]
rw [← lintegral_const_mul]
rotate_left
· exact ((hf.comp (measurable_prodMk_left (x := h))).indicator
(hE.preimage measurable_prodMk_left))
apply lintegral_congr
intro z
by_cases hw : (h,z) ∈ E <;> simp [indicator, hw]
Assume measurability of g, the density or prior under consideration, and measurability of p. A density which is measurable on the target space commutes with pushforward when pulled back along the history-extension map.
Formal statement
Proof (Lean source)
-- @node: stage_density_map
lemma stage_density_map {H Z : Type*} [MeasurableSpace H] [MeasurableSpace Z]
(mu : Measure H) (g : H → Z) (hg : Measurable g)
(p : Z → ℝ≥0∞) (hp : Measurable p) :
(mu.withDensity (fun h => p (g h))).map g = (mu.map g).withDensity p := by
ext E hE
rw [Measure.map_apply hg hE, withDensity_apply _ (hE.preimage hg),
withDensity_apply _ hE, ← lintegral_indicator hE,
lintegral_map (hp.indicator hE) hg,
← lintegral_indicator (hE.preimage hg)]
apply lintegral_congr
intro h
rfl
Fix the function f, the order, and order no larger than the sample size. The prefix density is constructed structurally by multiplying the next factor by the density of the preceding prefix.
Definition (Lean source)
theorem measurable_sequentialPrefixDensity
The prefix product formed from a stage-density family is measurable when each stage density is measurable and the prefix length does not exceed the horizon.
Formal statement
hypotheses
conclusion
Measurable (sequentialPrefixDensity f k hk)
Proof (Lean source)
-- @node: measurable_sequentialPrefixDensity
@[fun_prop] lemma measurable_sequentialPrefixDensity {n : ℕ} {Z : Fin n → Type*}
[∀ i, MeasurableSpace (Z i)]
(f : (i : Fin n) → History Z i.val (le_of_lt i.isLt) × Z i → ℝ≥0∞)
(hf : ∀ i, Measurable (f i)) (k : ℕ) (hk : k ≤ n) :
Measurable (sequentialPrefixDensity f k hk) := by
induction k with
| zero => exact measurable_const
| succ k ih =>
exact ((ih _).comp (measurable_fst.comp (measurable_init_last hk))).mul
((hf _).comp (measurable_init_last hk))
theorem sequentialPrefixDensity_snoc
Assume the function f and one plus the stage index no larger than the sample size. Appending a message exposes exactly the preceding product and the new factor.
Formal statement
hypotheses
conclusion
sequentialPrefixDensity f (k+1) hk (snoc hk u z)
Proof (Lean source)
-- @node: sequentialPrefixDensity_snoc
lemma sequentialPrefixDensity_snoc {n : ℕ} {Z : Fin n → Type*}
(f : (i : Fin n) → History Z i.val (le_of_lt i.isLt) × Z i → ℝ≥0∞)
(k : ℕ) (hk : k + 1 ≤ n)
(u : History Z k (le_of_succ_le hk)) (z : Z (nextIndex hk)) :
sequentialPrefixDensity f (k+1) hk (snoc hk u z) =
sequentialPrefixDensity f k (le_of_succ_le hk) u * f (nextIndex hk) (u,z) := by
have hi : init hk (snoc hk u z) = u := by
exact Fin.init_snoc (α := fun j : Fin (k+1) => Z (castLE hk j)) (p := u) (x := z)
have hl : last hk (snoc hk u z) = z := by
exact Fin.snoc_last (α := fun j : Fin (k+1) => Z (castLE hk j)) (p := u) (x := z)
change sequentialPrefixDensity f k _ (init hk (snoc hk u z)) *
f (nextIndex hk) (init hk (snoc hk u z), last hk (snoc hk u z)) = _
rw [hi, hl]
theorem sequentialPrefixDensity_withDensity
Assume the Markov kernel hK, the Markov kernel hL, the function f, measurability of f, the stated hrow condition, and order no larger than the sample size. Iterating the row density identities gives an explicit density for every finite prefix of the adaptive experiment. No transcript RN witness is chosen.
Formal statement
hypotheses
n :
ℕ
X Y :
Type*
Z :
Fin n → Type*
∀ i, MeasurableSpace (Z i)
K :
KernelFamily X Z
L :
KernelFamily Y Z
hK :
∀ i, IsMarkovKernel (K i)
hL :
∀ i, IsMarkovKernel (L i)
x :
Fin n → X
y :
Fin n → Y
hf :
∀ i, Measurable (f i)
hrow :
∀ i u, (K i (x i,u)).withDensity (fun z => f i (u,z)) = L i (y i,u)
k :
ℕ
hk :
k ≤ n
conclusion
Proof (Lean source)
-- @node: sequentialPrefixDensity_withDensity
lemma sequentialPrefixDensity_withDensity {n : ℕ} {X Y : Type*} {Z : Fin n → Type*}
[MeasurableSpace X] [MeasurableSpace Y] [∀ i, MeasurableSpace (Z i)]
(K : KernelFamily X Z) (L : KernelFamily Y Z) (hK : ∀ i, IsMarkovKernel (K i))
(hL : ∀ i, IsMarkovKernel (L i)) (x : Fin n → X) (y : Fin n → Y)
(f : (i : Fin n) → History Z i.val (le_of_lt i.isLt) × Z i → ℝ≥0∞)
(hf : ∀ i, Measurable (f i))
(hrow : ∀ i u, (K i (x i,u)).withDensity (fun z => f i (u,z)) = L i (y i,u))
(k : ℕ) (hk : k ≤ n) :
(prefixLaw K x k hk).withDensity (sequentialPrefixDensity f k hk) =
prefixLaw L y k hk := by
induction k with
| zero => change (Measure.dirac _).withDensity (fun _ => 1) = Measure.dirac _
exact withDensity_one
| succ k ih =>
let i : Fin n := ⟨k, Nat.lt_of_succ_le hk⟩
let K' := (K i).comap (fun u => (x i,u)) (by fun_prop)
let L' := (L i).comap (fun u => (y i,u)) (by fun_prop)
let mu := prefixLaw K x k (le_of_succ_le hk)
let p := sequentialPrefixDensity f k (le_of_succ_le hk)
have := hK i
have := hL i
have := isProbabilityMeasure_prefixLaw K hK x k (le_of_succ_le hk)
have := isProbabilityMeasure_prefixLaw L hL y k (le_of_succ_le hk)
have hprev : mu.withDensity p = prefixLaw L y k (le_of_succ_le hk) := ih _
have : IsProbabilityMeasure (mu.withDensity p) := hprev ▸ inferInstance
have : IsMarkovKernel K' := by dsimp [K']; infer_instance
have : IsMarkovKernel L' := by dsimp [L']; infer_instance
have hstep := stage_density_compProd mu K' L' p
(measurable_sequentialPrefixDensity f hf _ _) (f i) (hf i) (hrow i)
rw [prefixLaw_succ, prefixLaw_succ]
change ((mu ⊗ₘ K').map (fun w => snoc hk w.1 w.2)).withDensity
(sequentialPrefixDensity f (k+1) hk) =
((prefixLaw L y k _ ⊗ₘ L').map (fun w => snoc hk w.1 w.2))
rw [← hprev, hstep]
have hpull : (fun w => p w.1 * f i w) =
(fun w => sequentialPrefixDensity f (k+1) hk (snoc hk w.1 w.2)) := by
funext w
exact (sequentialPrefixDensity_snoc f k hk w.1 w.2).symm
rw [hpull]
simpa only [i, nextIndex] using
(stage_density_map (mu ⊗ₘ K') (fun w => snoc hk w.1 w.2)
(measurable_snoc hk) _ (measurable_sequentialPrefixDensity f hf _ _)).symm
theorem sequentialPrefixDensity_eq_prod
Assume the function f and order no larger than the sample size. The structural prefix construction is the finite product of the densities evaluated at their own stage message and preceding history.
Formal statement
Proof (Lean source)
-- @node: sequentialPrefixDensity_eq_prod
lemma sequentialPrefixDensity_eq_prod {n : ℕ} {Z : Fin n → Type*}
(f : (i : Fin n) → History Z i.val (le_of_lt i.isLt) × Z i → ℝ≥0∞)
(k : ℕ) (hk : k ≤ n) (u : History Z k hk) :
sequentialPrefixDensity f k hk u = ∏ i : Fin k,
f (castLE hk i)
(restrictHistory (le_of_lt (castLE hk i).isLt) hk (le_of_lt i.isLt) u, u i) := by
induction k with
| zero => simp [sequentialPrefixDensity]
| succ k ih =>
change sequentialPrefixDensity f k _ (init hk u) *
f (nextIndex hk) (init hk u, last hk u) = _
rw [ih, Fin.prod_univ_castSucc]
congr 1
def stageReferenceTranscriptLaw
Fix the local protocol Q and the public seed. The uniform next-message kernels generate a fixed-seed reference chain.
Definition (Lean source)
theorem fixedPairedTranscript_product_density_of_gate
Assume measurable Radon–Nikodym densities for dominated kernels, positive dimension, a nonnegative privacy budget, and sequential local privacy of the protocol. Repaired stage rows yield explicit product densities for every fixed paired input transcript, relative to the same uniform reference chain.
Formal statement
hypotheses
n d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
hd :
0 < d
eps :
ℝ
heps :
0 ≤ eps
hQ :
SequentialClass Q eps
conclusion
conclusion 5
i a r eta :
(stageReferenceKernel Q i (r,eta)).withDensity (fun z => ofReal (f i (((a,r),eta),z)))
= averagedKernel Q i ((a,r),eta)
conclusion 6
a :
Fin n → PairedSymbol d
r :
Q.Seed
(stageReferenceTranscriptLaw Q r).withDensity (fun z => ofReal (∏ i : Fin n, f i (((a i,r),take (le_of_lt i.isLt) z),z i)))
= fixedTranscriptLaw (averagedProtocol Q) a r
Proof (Lean source)
-- @node: fixedPairedTranscript_product_density_of_gate
lemma fixedPairedTranscript_product_density_of_gate (hRN : MeasurableKernelRadonNikodym)
{n d : ℕ} (Q : LocalProtocol n (ObsRecord d)) (hd : 0 < d)
(eps : ℝ) (heps : 0 ≤ eps) (hQ : SequentialClass Q eps) :
∃ f : (i : Fin n) →
((PairedSymbol d × Q.Seed) × ProtocolHistory Q i) × Q.Message i → ℝ,
(∀ i, Measurable (f i)) ∧
(∀ i w, exp (-eps) ≤ f i w ∧ f i w ≤ exp eps) ∧
(∀ i r eta z, (∑ a : PairedSymbol d, f i (((a,r),eta),z)) = (2*d : ℝ)) ∧
(∀ i a b r eta z,
f i (((a,r),eta),z) ≤ exp eps * f i (((b,r),eta),z)) ∧
(∀ i a r eta, (stageReferenceKernel Q i (r,eta)).withDensity
(fun z => ofReal (f i (((a,r),eta),z))) =
averagedKernel Q i ((a,r),eta)) ∧
∀ (a : Fin n → PairedSymbol d) (r : Q.Seed),
(stageReferenceTranscriptLaw Q r).withDensity (fun z =>
ofReal (∏ i : Fin n,
f i (((a i,r),take (le_of_lt i.isLt) z),z i))) =
fixedTranscriptLaw (averagedProtocol Q) a r := by
choose f hf hf0 hsum hpriv hbound hrep using
(fun i => stage_density_repaired_of_gate hRN Q i hd eps heps hQ)
refine ⟨f, hf, hbound, hsum, hpriv, hrep, ?_⟩
intro a r
let g := fun (i : Fin n) (w : ProtocolHistory Q i × Q.Message i) =>
ofReal (f i (((a i,r),w.1),w.2))
have hg : ∀ i, Measurable (g i) := fun i => (hf i |>.comp (by fun_prop)).ennreal_ofReal
have hprod := sequentialPrefixDensity_withDensity (stageReferenceKernel Q)
(averagedKernel Q) (fun i => stageReferenceKernel_markov Q i hd)
(averagedKernel_markov Q) (fun _ => r) (fun i => (a i,r)) g hg
(fun i eta => hrep i (a i) r eta) n le_rfl
change (stageReferenceTranscriptLaw Q r).withDensity
(sequentialPrefixDensity g n le_rfl) = _ at hprod
have hfun : (fun z : ProtocolTranscript Q => ofReal (∏ i : Fin n,
f i (((a i,r),take (le_of_lt i.isLt) z),z i))) =
sequentialPrefixDensity g n le_rfl := by
funext z
rw [sequentialPrefixDensity_eq_prod]
rw [ENNReal.ofReal_prod_of_nonneg (fun i _ => hf0 i _)]
rfl
rw [hfun]
exact hprod
theorem pairedTranscript_stageProduct_withDensity
Assume the stated htheta condition, positive dimension, measurability of f, the stated hf0 condition, and the function hrep. The density of a paired iid transcript factors into the affine conditional message densities at its actual adaptive histories.
Formal statement
hypotheses
n d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
theta :
Fin d → ℝ
htheta :
theta ∈ parameterCube d
hd :
0 < d
r :
Q.Seed
f :
hf :
∀ i, Measurable (f i)
hf0 :
∀ i w, 0 ≤ f i w
hrep :
∀ (a : Fin n → PairedSymbol d),
(stageReferenceTranscriptLaw Q r).withDensity (fun z => ofReal (∏ i : Fin n, f i (((a i,r),take (le_of_lt i.isLt) z),z i)))
= fixedTranscriptLaw (averagedProtocol Q) a r
conclusion
(stageReferenceTranscriptLaw Q r).withDensity (fun z => ofReal (∏ i : Fin n, stageMixtureDensity theta (fun a => f i (((a,r),take (le_of_lt i.isLt) z),z i))))
= (Measure.pi (fun _ : Fin n => pairedLaw theta)).bind (fun a => fixedTranscriptLaw (averagedProtocol Q) a r)
Proof (Lean source)
-- @node: pairedTranscript_stageProduct_withDensity
lemma pairedTranscript_stageProduct_withDensity {n d : ℕ}
(Q : LocalProtocol n (ObsRecord d)) (theta : Fin d → ℝ)
(htheta : theta ∈ parameterCube d) (hd : 0 < d) (r : Q.Seed)
(f : (i : Fin n) →
((PairedSymbol d × Q.Seed) × ProtocolHistory Q i) × Q.Message i → ℝ)
(hf : ∀ i, Measurable (f i)) (hf0 : ∀ i w, 0 ≤ f i w)
(hrep : ∀ (a : Fin n → PairedSymbol d),
(stageReferenceTranscriptLaw Q r).withDensity (fun z =>
ofReal (∏ i : Fin n,
f i (((a i,r),take (le_of_lt i.isLt) z),z i))) =
fixedTranscriptLaw (averagedProtocol Q) a r) :
(stageReferenceTranscriptLaw Q r).withDensity (fun z => ofReal
(∏ i : Fin n, stageMixtureDensity theta
(fun a => f i (((a,r),take (le_of_lt i.isLt) z),z i)))) =
(Measure.pi (fun _ : Fin n => pairedLaw theta)).bind
(fun a => fixedTranscriptLaw (averagedProtocol Q) a r) := by
let w := fun a : Fin n → PairedSymbol d => ∏ i : Fin n, stageInputWeight theta (a i)
have hw : ∀ a, 0 ≤ w a := fun a =>
Finset.prod_nonneg (fun i _ => stageInputWeight_nonneg theta htheta (a i))
have hinput : atomLaw w = Measure.pi (fun _ : Fin n => pairedLaw theta) := by
have : IsProbabilityMeasure (pairedLaw theta) := pairedFamily_subset_simplex hd (Set.mem_image_of_mem pairedLaw htheta)
apply Measure.ext_of_singleton
intro a
have hatom {I : Type} [Fintype I] [MeasurableSpace I] [MeasurableSingletonClass I]
(v : I → ℝ) (a : I) : atomLaw v {a} = ofReal (v a) := by
classical
simp [atomLaw, Measure.finsetSum_apply, Measure.smul_apply, Measure.dirac_apply', Pi.single_apply]
rw [hatom, Measure.pi_singleton]
simp_rw [pairedLaw, hatom]
exact ENNReal.ofReal_prod_of_nonneg (fun i _ =>
stageInputWeight_nonneg theta htheta (a i))
have hfinite := finite_weighted_density_bind (stageReferenceTranscriptLaw Q r) w hw
(fun a z => ∏ i : Fin n, f i (((a i,r),take (le_of_lt i.isLt) z),z i))
(fun a => by
apply Finset.measurable_prod
intro i _
exact (hf i).comp (by
apply prodMk
· apply prodMk measurable_const
exact measurable_restrictHistory _ _ _
· exact measurable_pi_apply i))
(fun a z => Finset.prod_nonneg (fun i _ => hf0 i _))
(fun a => fixedTranscriptLaw (averagedProtocol Q) a r) (by fun_prop) hrep
rw [hinput] at hfinite
have hfactor (z : ProtocolTranscript Q) :
(∑ a : Fin n → PairedSymbol d, w a *
(∏ i : Fin n, f i (((a i,r),take (le_of_lt i.isLt) z),z i))) =
∏ i : Fin n, stageMixtureDensity theta
(fun a => f i (((a,r),take (le_of_lt i.isLt) z),z i)) := by
simp only [w, ← Finset.prod_mul_distrib, stageMixtureDensity]
simpa using Finset.sum_prod_piFinset (Finset.univ : Finset (PairedSymbol d))
(fun (i : Fin n) a => stageInputWeight theta a *
f i (((a,r),take (le_of_lt i.isLt) z),z i))
have heq : (fun z : ProtocolTranscript Q => ofReal
(∑ a : Fin n → PairedSymbol d, w a *
(∏ i : Fin n, f i (((a i,r),take (le_of_lt i.isLt) z),z i)))) =
(fun z : ProtocolTranscript Q => ofReal (∏ i : Fin n,
stageMixtureDensity theta (fun a => f i (((a,r),take (le_of_lt i.isLt) z),z i)))) :=
funext (fun z => congrArg ofReal (hfactor z))
have hmeasure := congrArg (fun p : ProtocolTranscript Q → ℝ≥0∞ =>
(stageReferenceTranscriptLaw Q r).withDensity p) heq
exact hmeasure.symm.trans hfinite
theorem stageReferenceTranscriptLaw_eq_zero_paired
Assume positive dimension, measurability of f, the stated hf0 condition, the stated hsum condition, and the function hrep. Exact uniform normalization identifies the reference chain as the zero-contrast iid paired experiment, at every seed.
Formal statement
hypotheses
n d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
hd :
0 < d
r :
Q.Seed
f :
hf :
∀ i, Measurable (f i)
hf0 :
∀ i w, 0 ≤ f i w
hsum :
∀ i eta z, (∑ a : PairedSymbol d, f i (((a,r),eta),z)) = (2*d : ℝ)
hrep :
∀ (a : Fin n → PairedSymbol d),
(stageReferenceTranscriptLaw Q r).withDensity (fun z => ofReal (∏ i : Fin n, f i (((a i,r),take (le_of_lt i.isLt) z),z i)))
= fixedTranscriptLaw (averagedProtocol Q) a r
conclusion
= (Measure.pi (fun _ : Fin n => pairedLaw (fun _ => 0))).bind (fun a => fixedTranscriptLaw (averagedProtocol Q) a r)
Proof (Lean source)
-- @node: stageReferenceTranscriptLaw_eq_zero_paired
lemma stageReferenceTranscriptLaw_eq_zero_paired {n d : ℕ}
(Q : LocalProtocol n (ObsRecord d)) (hd : 0 < d) (r : Q.Seed)
(f : (i : Fin n) →
((PairedSymbol d × Q.Seed) × ProtocolHistory Q i) × Q.Message i → ℝ)
(hf : ∀ i, Measurable (f i)) (hf0 : ∀ i w, 0 ≤ f i w)
(hsum : ∀ i eta z, (∑ a : PairedSymbol d, f i (((a,r),eta),z)) = (2*d : ℝ))
(hrep : ∀ (a : Fin n → PairedSymbol d),
(stageReferenceTranscriptLaw Q r).withDensity (fun z =>
ofReal (∏ i : Fin n,
f i (((a i,r),take (le_of_lt i.isLt) z),z i))) =
fixedTranscriptLaw (averagedProtocol Q) a r) :
stageReferenceTranscriptLaw Q r =
(Measure.pi (fun _ : Fin n => pairedLaw (fun _ => 0))).bind
(fun a => fixedTranscriptLaw (averagedProtocol Q) a r) := by
have hcube : (fun _ : Fin d => (0 : ℝ)) ∈ parameterCube d := by
intro j; constructor <;> norm_num
have hzero (i : Fin n) (eta : ProtocolHistory Q i) (z : Q.Message i) :
stageMixtureDensity (fun _ => 0) (fun a => f i (((a,r),eta),z)) = 1 := by
rw [stageMixtureDensity_normalized hd _ _ (hsum i eta z)]
simp
have h := pairedTranscript_stageProduct_withDensity Q _ hcube hd r f hf hf0 hrep
simp only [hzero, Finset.prod_const_one, ENNReal.ofReal_one] at h
change (stageReferenceTranscriptLaw Q r).withDensity 1 = _ at h
rw [withDensity_one] at h
exact h
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Contraction.StageScore 13 declarations The repaired finite row densities give positive affine stage mixtures.
Conditional stage scores
The repaired finite row densities give positive affine stage mixtures. Their coordinate scores have the sharp privacy bound and zero mean under the parameter-specific conditional message law.
Fix the function theta and the amplitude. The affine paired-input probability weights.
Definition (Lean source)
Fix the function theta and the function f. The parameter-specific stage density relative to the uniform row average.
Definition (Lean source)
Fix the function f and the coordinate index. The coordinate slope of the affine conditional density.
Definition (Lean source)
parameters
def
stageCoordinateSlope f j :
ℝ
theorem stageInputWeight_nonneg
Assume the stated htheta condition. Cube parameters give nonnegative conditional input weights. [](.
Formal statement
hypotheses
conclusion
0 ≤ stageInputWeight theta a
Proof (Lean source)
-- @node: stageInputWeight_nonneg
lemma stageInputWeight_nonneg {d : ℕ} (theta : Fin d → ℝ)
(htheta : theta ∈ parameterCube d) (a : PairedSymbol d) :
0 ≤ stageInputWeight theta a := by
have ha := htheta a.1
unfold stageInputWeight
apply div_nonneg _ (by positivity)
cases a.2 <;> simp only [signVal, Bool.false_eq_true, ↓reduceIte,
one_mul, neg_one_mul] <;> linarith [ha.1, ha.2]
theorem stageInputWeight_sum
Assume positive dimension. The affine input weights sum to one, even outside the cube. [](.
Formal statement
hypotheses
conclusion
∑ a : PairedSymbol d, stageInputWeight theta a = 1
Proof (Lean source)
-- @node: stageInputWeight_sum
lemma stageInputWeight_sum {d : ℕ} (hd : 0 < d) (theta : Fin d → ℝ) :
∑ a : PairedSymbol d, stageInputWeight theta a = 1 := by
have hd0 : (2*d : ℝ) ≠ 0 := by positivity
rw [Fintype.sum_prod_type]
have hpair (j : Fin d) : ∑ s : Bool, stageInputWeight theta (j, s) = (d : ℝ)⁻¹ := by
simp only [Fintype.sum_bool, stageInputWeight, signVal, Bool.false_eq_true, ↓reduceIte, one_mul, neg_one_mul]
field_simp
<;> ring
simp only [hpair, Finset.sum_const, Finset.card_univ, Fintype.card_fin, nsmul_eq_mul]
exact mul_inv_cancel₀ (by positivity)
theorem stageMixtureDensity_affine
Splitting the two signs exposes the affine coordinate coefficients. [](.
Formal statement
hypotheses
conclusion
stageMixtureDensity theta f = (∑ a, f a) / (2*d) + ∑ j, theta j * stageCoordinateSlope f j
Proof (Lean source)
-- @node: stageMixtureDensity_affine
lemma stageMixtureDensity_affine {d : ℕ} (theta : Fin d → ℝ)
(f : PairedSymbol d → ℝ) :
stageMixtureDensity theta f = (∑ a, f a) / (2*d) +
∑ j, theta j * stageCoordinateSlope f j := by
unfold stageMixtureDensity stageInputWeight stageCoordinateSlope
rw [Fintype.sum_prod_type, Fintype.sum_prod_type, Finset.sum_div]
rw [← Finset.sum_add_distrib]
apply Finset.sum_congr rfl
intro j _
simp only [Fintype.sum_bool, signVal, Bool.false_eq_true, ↓reduceIte]
ring
theorem stageMixtureDensity_normalized
Assume positive dimension and the stated hsum condition. Exact row normalization makes the zero-contrast conditional density one.
Formal statement
hypotheses
conclusion
stageMixtureDensity theta f = 1 + ∑ j, theta j * stageCoordinateSlope f j
Proof (Lean source)
-- @node: stageMixtureDensity_normalized
lemma stageMixtureDensity_normalized {d : ℕ} (hd : 0 < d)
(theta : Fin d → ℝ) (f : PairedSymbol d → ℝ)
(hsum : ∑ a, f a = (2*d : ℝ)) :
stageMixtureDensity theta f = 1 + ∑ j, theta j * stageCoordinateSlope f j := by
rw [stageMixtureDensity_affine, hsum, div_self (by positivity)]
theorem stageMixtureDensity_update
Replacing one parameter coordinate changes a stage density by its exact slope. [](.
Formal statement
hypotheses
conclusion
stageMixtureDensity (update theta j x) f
= stageMixtureDensity theta f + (x - theta j) * stageCoordinateSlope f j
Proof (Lean source)
-- @node: stageMixtureDensity_update
lemma stageMixtureDensity_update {d : ℕ} (theta : Fin d → ℝ)
(f : PairedSymbol d → ℝ) (j : Fin d) (x : ℝ) :
stageMixtureDensity (update theta j x) f =
stageMixtureDensity theta f + (x - theta j) * stageCoordinateSlope f j := by
classical
rw [stageMixtureDensity_affine, stageMixtureDensity_affine]
have hterm (a : Fin d) : update theta j x a * stageCoordinateSlope f a =
theta a * stageCoordinateSlope f a +
(if a = j then (x - theta j) * stageCoordinateSlope f j else 0) := by
by_cases ha : a = j
· subst a; simp; ring
· simp [Function.update_of_ne ha, ha]
simp_rw [hterm]
rw [Finset.sum_add_distrib]
simp
ring
Assume the stated hw condition, the stated hsum condition, the stated hf condition, a privacy factor at least one, and the stated hpriv condition. A convex mixture of private rows inherits their minimum, and every row difference is bounded by the privacy excess times that same minimum.
Formal statement
hypotheses
I :
w f :
I → ℝ
hw :
∀ a, 0 ≤ w a
hsum :
∑ a, w a = 1
hf :
∀ a, 0 < f a
c :
ℝ
hc :
1 ≤ c
hpriv :
∀ a b, f a ≤ c * f b
a b :
I
conclusion
conclusion 1
0 < (∑ x, w x * f x)
conclusion 2
|f a - f b| ≤ (c - 1) * (∑ x, w x * f x)
Proof (Lean source)
-- @node: private_row_score_bound
lemma private_row_score_bound {I : Type*} [Fintype I] [Nonempty I]
(w f : I → ℝ) (hw : ∀ a, 0 ≤ w a) (hsum : ∑ a, w a = 1)
(hf : ∀ a, 0 < f a) (c : ℝ) (hc : 1 ≤ c)
(hpriv : ∀ a b, f a ≤ c * f b) (a b : I) :
0 < (∑ x, w x * f x) ∧
|f a - f b| ≤ (c - 1) * (∑ x, w x * f x) := by
classical
obtain ⟨x, _, hx⟩ := Finset.exists_min_image Finset.univ f Finset.univ_nonempty
have hmin : f x ≤ ∑ y, w y * f y := by
calc
f x = ∑ y, w y * f x := by rw [← Finset.sum_mul, hsum, one_mul]
_ ≤ ∑ y, w y * f y := Finset.sum_le_sum fun y hy =>
mul_le_mul_of_nonneg_left (hx y hy) (hw y)
refine ⟨lt_of_lt_of_le (hf x) hmin, ?_⟩
have ha := hpriv a x
have hb := hpriv b x
have hxa := hx a (Finset.mem_univ a)
have hxb := hx b (Finset.mem_univ b)
have hdiff : |f a - f b| ≤ (c - 1) * f x := by
rw [abs_le]
constructor <;> nlinarith
exact hdiff.trans (mul_le_mul_of_nonneg_left hmin (sub_nonneg.mpr hc))
theorem stageCoordinateScore_bound
Assume positive dimension, the stated htheta condition, the stated hf condition, a nonnegative privacy budget, and the stated hpriv condition. The sharp coordinate score bound follows from privacy and convex weighting, without losing a factor from the lower bound on each input weight.
Formal statement
hypotheses
d :
ℕ
hd :
0 < d
theta :
Fin d → ℝ
htheta :
theta ∈ parameterCube d
f :
PairedSymbol d → ℝ
hf :
∀ a, 0 < f a
eps :
ℝ
heps :
0 ≤ eps
hpriv :
∀ a b, f a ≤ exp eps * f b
j :
Fin d
Proof (Lean source)
-- @node: stageCoordinateScore_bound
lemma stageCoordinateScore_bound {d : ℕ} (hd : 0 < d) (theta : Fin d → ℝ)
(htheta : theta ∈ parameterCube d) (f : PairedSymbol d → ℝ)
(hf : ∀ a, 0 < f a) (eps : ℝ) (heps : 0 ≤ eps)
(hpriv : ∀ a b, f a ≤ exp eps * f b) (j : Fin d) :
0 < stageMixtureDensity theta f ∧
|stageCoordinateSlope f j / stageMixtureDensity theta f| ≤ derivativeScale d eps := by
let : Nonempty (Fin d) := ⟨⟨0, hd⟩⟩
obtain ⟨hpos, hdiff⟩ := private_row_score_bound (stageInputWeight theta) f
(stageInputWeight_nonneg theta htheta) (stageInputWeight_sum hd theta)
hf (exp eps) (Real.one_le_exp_iff.mpr heps) hpriv (j, true) (j, false)
change 0 < stageMixtureDensity theta f at hpos
refine ⟨hpos, ?_⟩
have hden : (0 : ℝ) < 2*d := by positivity
change |((f (j, true) - f (j, false)) / (2*d)) / stageMixtureDensity theta f| ≤
(exp eps - 1) / (2*d)
rw [abs_div, abs_div, abs_of_pos hden, abs_of_pos hpos]
apply (div_le_iff₀ hpos).mpr
apply (div_le_iff₀ hden).mpr
calc
|f (j, true) - f (j, false)| ≤
(exp eps - 1) * stageMixtureDensity theta f := hdiff
_ = ((exp eps - 1) / (2*d) * stageMixtureDensity theta f) * (2*d) := by
field_simp
Assume measurability of f, the stated hf0 condition, and the stated probability-measure property. Every normalized probability-row density has real integral one.
Formal statement
hypotheses
Z :
Type*
mu :
Measure Z
f :
Z → ℝ
hf :
hf0 :
∀ z, 0 ≤ f z
hprob :
IsProbabilityMeasure (mu.withDensity (fun z => ofReal (f z)))
conclusion
(∫ z, f z ∂mu) = 1
Proof (Lean source)
-- @node: integral_probability_row_density
lemma integral_probability_row_density {Z : Type*} [MeasurableSpace Z]
(mu : Measure Z) (f : Z → ℝ) (hf : Measurable f) (hf0 : ∀ z, 0 ≤ f z)
(hprob : IsProbabilityMeasure (mu.withDensity (fun z => ofReal (f z)))) :
(∫ z, f z ∂mu) = 1 := by
letI := hprob
have hmass : (∫⁻ z, ofReal (f z) ∂mu) = 1 := by
have h := measure_univ (μ := mu.withDensity (fun z => ofReal (f z)))
simpa only [withDensity_apply _ MeasurableSet.univ, setLIntegral_univ] using h
rw [integral_eq_lintegral_of_nonneg_ae (Filter.Eventually.of_forall hf0)
hf.aestronglyMeasurable, hmass]
simp
theorem stageCoordinateScore_integral_zero
Assume measurability of f, the stated hf0 condition, the stated hb condition, the stated hbound condition, the stated probability-measure property, and the stated hpos condition. Under the parameter-specific conditional law, dividing the zero-integral coordinate slope by its positive density preserves zero mean.
Formal statement
hypotheses
d :
ℕ
Z :
Type*
mu :
f :
PairedSymbol d → Z → ℝ
hf :
∀ a, Measurable (f a)
hf0 :
∀ a z, 0 ≤ f a z
hb :
ℝ
hbound :
∀ a z, |f a z| ≤ hb
hprob :
∀ a, IsProbabilityMeasure (mu.withDensity (fun z => ofReal (f a z)))
theta :
Fin d → ℝ
hpos :
∀ z, 0 < stageMixtureDensity theta (fun a => f a z)
j :
Fin d
conclusion
(∫ z, stageCoordinateSlope (fun a => f a z) j / stageMixtureDensity theta (fun a => f a z) ∂mu.withDensity (fun z => ofReal (stageMixtureDensity theta (fun a => f a z))))
= 0
Proof (Lean source)
-- @node: stageCoordinateScore_integral_zero
lemma stageCoordinateScore_integral_zero {d : ℕ} {Z : Type*} [MeasurableSpace Z]
(mu : Measure Z) [IsFiniteMeasure mu] (f : PairedSymbol d → Z → ℝ)
(hf : ∀ a, Measurable (f a)) (hf0 : ∀ a z, 0 ≤ f a z)
(hb : ℝ) (hbound : ∀ a z, |f a z| ≤ hb)
(hprob : ∀ a, IsProbabilityMeasure (mu.withDensity (fun z => ofReal (f a z))))
(theta : Fin d → ℝ) (hpos : ∀ z, 0 < stageMixtureDensity theta (fun a => f a z))
(j : Fin d) :
(∫ z, stageCoordinateSlope (fun a => f a z) j /
stageMixtureDensity theta (fun a => f a z)
∂mu.withDensity (fun z => ofReal
(stageMixtureDensity theta (fun a => f a z)))) = 0 := by
have hM : Measurable (fun z => stageMixtureDensity theta (fun a => f a z)) := by
unfold stageMixtureDensity
fun_prop
rw [integral_withDensity_eq_integral_toReal_smul hM.ennreal_ofReal
(Filter.Eventually.of_forall (fun z => ENNReal.ofReal_lt_top))]
simp only [ENNReal.toReal_ofReal (le_of_lt (hpos _)), smul_eq_mul]
have hcancel : (fun z => stageMixtureDensity theta (fun a => f a z) *
(stageCoordinateSlope (fun a => f a z) j /
stageMixtureDensity theta (fun a => f a z))) =
(fun z => (f (j, true) z - f (j, false) z) / (2*d)) := by
funext z
rw [mul_div_cancel₀ _ (ne_of_gt (hpos z))]
rfl
rw [hcancel, integral_div]
have hi (a : PairedSymbol d) : Integrable (f a) mu := by
apply Integrable.of_bound (hf a).aestronglyMeasurable hb
filter_upwards [] with z
simpa only [Real.norm_eq_abs] using hbound a z
rw [integral_sub (hi _) (hi _),
integral_probability_row_density mu _ (hf _) (hf0 _) (hprob _),
integral_probability_row_density mu _ (hf _) (hf0 _) (hprob _)]
simp
theorem stage_score_certificate_of_gate
Assume measurable Radon–Nikodym densities for dominated kernels, positive dimension, a nonnegative privacy budget, and sequential local privacy of the protocol. The RN gate supplies actual jointly measurable protocol-row versions whose conditional coordinate scores satisfy both martingale prerequisites, at every history and seed (including reference-null histories).
Formal statement
hypotheses
n d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
i :
Fin n
hd :
0 < d
eps :
ℝ
heps :
0 ≤ eps
hQ :
SequentialClass Q eps
conclusion
∃ f : ((PairedSymbol d × Q.Seed) × ProtocolHistory Q i) × Q.Message i → ℝ,
conclusion 1
a r eta :
(stageReferenceKernel Q i (r, eta)).withDensity (fun z => ofReal (f (((a, r), eta), z)))
= averagedKernel Q i ((a, r), eta)
conclusion 2
theta :
r eta z :
stageMixtureDensity theta (fun a => f (((a, r), eta), z))
= 1 + ∑ j, theta j * stageCoordinateSlope (fun a => f (((a, r), eta), z)) j
conclusion 3
theta ∈ parameterCube d :
r eta z j :
0 < stageMixtureDensity theta (fun a => f (((a, r), eta), z))
|stageCoordinateSlope (fun a => f (((a, r), eta), z)) j / stageMixtureDensity theta (fun a => f (((a, r), eta), z))|
≤ derivativeScale d eps
conclusion 4
theta ∈ parameterCube d :
r eta j :
(∫ z, stageCoordinateSlope (fun a => f (((a, r), eta), z)) j / stageMixtureDensity theta (fun a => f (((a, r), eta), z)) ∂(stageReferenceKernel Q i (r, eta)).withDensity (fun z => ofReal (stageMixtureDensity theta (fun a => f (((a, r), eta), z)))))
= 0
Proof (Lean source)
-- @node: stage_score_certificate_of_gate
lemma stage_score_certificate_of_gate (hRN : MeasurableKernelRadonNikodym)
{n d : ℕ} (Q : LocalProtocol n (ObsRecord d)) (i : Fin n) (hd : 0 < d)
(eps : ℝ) (heps : 0 ≤ eps) (hQ : SequentialClass Q eps) :
∃ f : ((PairedSymbol d × Q.Seed) × ProtocolHistory Q i) × Q.Message i → ℝ,
Measurable f ∧
(∀ a r eta, (stageReferenceKernel Q i (r, eta)).withDensity
(fun z => ofReal (f (((a, r), eta), z))) =
averagedKernel Q i ((a, r), eta)) ∧
(∀ theta, ∀ r eta z,
stageMixtureDensity theta (fun a => f (((a, r), eta), z)) =
1 + ∑ j, theta j * stageCoordinateSlope (fun a => f (((a, r), eta), z)) j) ∧
(∀ theta ∈ parameterCube d, ∀ r eta z j,
0 < stageMixtureDensity theta (fun a => f (((a, r), eta), z)) ∧
|stageCoordinateSlope (fun a => f (((a, r), eta), z)) j /
stageMixtureDensity theta (fun a => f (((a, r), eta), z))| ≤ derivativeScale d eps) ∧
∀ theta ∈ parameterCube d, ∀ r eta j,
(∫ z, stageCoordinateSlope (fun a => f (((a, r), eta), z)) j /
stageMixtureDensity theta (fun a => f (((a, r), eta), z))
∂(stageReferenceKernel Q i (r, eta)).withDensity (fun z => ofReal
(stageMixtureDensity theta (fun a => f (((a, r), eta), z))))) = 0 := by
obtain ⟨f, hf, hf0, hsum, hpriv, hbound, hrep⟩ :=
stage_density_repaired_of_gate hRN Q i hd eps heps hQ
have hscore (theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d)
(r : Q.Seed) (eta : ProtocolHistory Q i) (z : Q.Message i) (j : Fin d) :=
stageCoordinateScore_bound hd theta htheta (fun a => f (((a, r), eta), z))
(fun a => lt_of_lt_of_le (Real.exp_pos (-eps)) (hbound _).1)
eps heps (fun a b => hpriv a b r eta z) j
refine ⟨f, hf, hrep, ?_, ?_, ?_⟩
· intro theta r eta z
exact stageMixtureDensity_normalized hd theta _ (hsum r eta z)
· exact hscore
· intro theta htheta r eta j
letI := stageReferenceKernel_markov Q i hd
letI := averagedKernel_markov Q i
apply stageCoordinateScore_integral_zero (stageReferenceKernel Q i (r, eta))
(fun a z => f (((a, r), eta), z))
(fun a => hf.comp (by fun_prop)) (fun a z => hf0 _) (exp eps)
· intro a z
rw [abs_of_nonneg (hf0 _)]
exact (hbound _).2
· intro a
rw [hrep]
infer_instance
· intro z
exact (hscore theta htheta r eta z j).1
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Contraction.StageTransition 5 declarations The affine mixtures of repaired stage rows represent the actual next-message laws of the symmetric iid experiment, at every history and public seed.
Conditional message density identification
The affine mixtures of repaired stage rows represent the actual next-message laws of the symmetric iid experiment, at every history and public seed.
Assume the stated hw condition, measurability of f, the stated hf0 condition, measurability of rows, and the stated hrep condition. Mixing finitely many nonnegative row densities commutes with taking the message law, with the original finite input weights retained.
Formal statement
hypotheses
I Z :
mu :
Measure Z
w :
I → ℝ
hw :
∀ a, 0 ≤ w a
f :
I → Z → ℝ
hf :
∀ a, Measurable (f a)
hf0 :
∀ a z, 0 ≤ f a z
rows :
I → Measure Z
hrows :
Measurable rows
hrep :
∀ a, mu.withDensity (fun z => ofReal (f a z)) = rows a
Proof (Lean source)
-- @node: finite_weighted_density_bind
lemma finite_weighted_density_bind {I Z : Type} [Fintype I]
[MeasurableSpace I] [MeasurableSingletonClass I] [MeasurableSpace Z]
(mu : Measure Z) (w : I → ℝ) (hw : ∀ a, 0 ≤ w a)
(f : I → Z → ℝ) (hf : ∀ a, Measurable (f a)) (hf0 : ∀ a z, 0 ≤ f a z)
(rows : I → Measure Z) (hrows : Measurable rows)
(hrep : ∀ a, mu.withDensity (fun z => ofReal (f a z)) = rows a) :
mu.withDensity (fun z => ofReal (∑ a, w a * f a z)) =
(atomLaw w).bind rows := by
ext E hE
rw [withDensity_apply _ hE, Measure.bind_apply hE hrows.aemeasurable]
simp_rw [ENNReal.ofReal_sum_of_nonneg (fun a _ => mul_nonneg (hw a) (hf0 a _)),
ENNReal.ofReal_mul (hw _)]
rw [lintegral_finsetSum]
· simp_rw [lintegral_const_mul _ (hf _).ennreal_ofReal,
← withDensity_apply _ hE, hrep]
simp [atomLaw, lintegral_finsetSum_measure, lintegral_smul_measure, lintegral_dirac]
· intro a _
exact measurable_const.mul (hf a).ennreal_ofReal
theorem stageMixtureDensity_messageLaw
Assume positive dimension, the stated htheta condition, measurability of f, the stated hf0 condition, and the Markov kernel hrep. The affine paired mixture is the conditional next-message density for the original-record experiment after the ancillary bit is integrated out.
Formal statement
hypotheses
n d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
i :
Fin n
hd :
0 < d
theta :
Fin d → ℝ
htheta :
theta ∈ parameterCube d
r :
Q.Seed
eta :
ProtocolHistory Q i
f :
((PairedSymbol d × Q.Seed) × ProtocolHistory Q i) × Q.Message i → ℝ
hf :
hf0 :
∀ w, 0 ≤ f w
hrep :
∀ a,
(stageReferenceKernel Q i (r, eta)).withDensity (fun z => ofReal (f (((a, r), eta), z)))
= averagedKernel Q i ((a, r), eta)
conclusion
(stageReferenceKernel Q i (r, eta)).withDensity (fun z => ofReal (stageMixtureDensity theta (fun a => f (((a, r), eta), z))))
= (observedLaw (symmetricLaw theta)).bind (fun o => Q.kernels i ((o, r), eta))
Proof (Lean source)
-- @node: stageMixtureDensity_messageLaw
lemma stageMixtureDensity_messageLaw {n d : ℕ}
(Q : LocalProtocol n (ObsRecord d)) (i : Fin n) (hd : 0 < d)
(theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d)
(r : Q.Seed) (eta : ProtocolHistory Q i)
(f : ((PairedSymbol d × Q.Seed) × ProtocolHistory Q i) × Q.Message i → ℝ)
(hf : Measurable f) (hf0 : ∀ w, 0 ≤ f w)
(hrep : ∀ a, (stageReferenceKernel Q i (r, eta)).withDensity
(fun z => ofReal (f (((a, r), eta), z))) =
averagedKernel Q i ((a, r), eta)) :
(stageReferenceKernel Q i (r, eta)).withDensity
(fun z => ofReal (stageMixtureDensity theta
(fun a => f (((a, r), eta), z)))) =
(observedLaw (symmetricLaw theta)).bind (fun o => Q.kernels i ((o, r), eta)) := by
rw [averagedKernel_marginal_messageLaw Q theta htheta hd i eta r]
exact finite_weighted_density_bind _ (stageInputWeight theta)
(stageInputWeight_nonneg theta htheta) _
(fun a => hf.comp (by fun_prop)) (fun a z => hf0 _)
_ (by fun_prop) hrep
theorem stageReferenceKernel_eq_zero_messageLaw
Assume positive dimension. The zero-contrast next-message law is exactly the uniform row reference, including at histories that have zero transcript probability.
Formal statement
hypotheses
conclusion
stageReferenceKernel Q i (r, eta)
= (observedLaw (symmetricLaw (fun _ => 0))).bind (fun o => Q.kernels i ((o, r), eta))
Proof (Lean source)
-- @node: stageReferenceKernel_eq_zero_messageLaw
lemma stageReferenceKernel_eq_zero_messageLaw {n d : ℕ}
(Q : LocalProtocol n (ObsRecord d)) (i : Fin n) (hd : 0 < d)
(r : Q.Seed) (eta : ProtocolHistory Q i) :
stageReferenceKernel Q i (r, eta) =
(observedLaw (symmetricLaw (fun _ => 0))).bind
(fun o => Q.kernels i ((o, r), eta)) := by
have hcube : (fun _ : Fin d => (0 : ℝ)) ∈ parameterCube d := by
intro j; constructor <;> norm_num
rw [averagedKernel_marginal_messageLaw Q _ hcube hd i eta r]
ext E hE
rw [Measure.bind_apply hE (by fun_prop)]
simp [stageReferenceKernel, uniformRowAverage, Kernel.comap_apply,
Measure.smul_apply, Measure.finsetSum_apply, pairedLaw, atomLaw,
lintegral_finsetSum_measure, lintegral_smul_measure, lintegral_dirac,
ENNReal.ofReal_mul, Finset.mul_sum]
rw [ENNReal.mul_inv (by simp) (by simp)]
simp [mul_assoc, ENNReal.ofReal_inv_of_pos (show (0 : ℝ) < d by positivity)]
theorem stageMixtureDensity_bounds
Assume positive dimension, the stated htheta condition, and the stated hbound condition. A convex stage mixture inherits the deterministic positive bounds on all its rows. These bounds make every finite transcript product integrable.
Formal statement
hypotheses
d :
ℕ
hd :
0 < d
theta :
Fin d → ℝ
htheta :
theta ∈ parameterCube d
f :
PairedSymbol d → ℝ
lo hi :
ℝ
hbound :
∀ a, lo ≤ f a ∧ f a ≤ hi
Proof (Lean source)
-- @node: stageMixtureDensity_bounds
lemma stageMixtureDensity_bounds {d : ℕ} (hd : 0 < d)
(theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d)
(f : PairedSymbol d → ℝ) (lo hi : ℝ)
(hbound : ∀ a, lo ≤ f a ∧ f a ≤ hi) :
lo ≤ stageMixtureDensity theta f ∧ stageMixtureDensity theta f ≤ hi := by
have hw := stageInputWeight_nonneg theta htheta
have hsum := stageInputWeight_sum hd theta
have hconst (c : ℝ) : (∑ a, stageInputWeight theta a * c) = c := by
rw [← Finset.sum_mul, hsum, one_mul]
constructor
· calc
lo = ∑ a, stageInputWeight theta a * lo := (hconst lo).symm
_ ≤ stageMixtureDensity theta f := Finset.sum_le_sum fun a _ =>
mul_le_mul_of_nonneg_left (hbound a).1 (hw a)
· calc
stageMixtureDensity theta f ≤ ∑ a, stageInputWeight theta a * hi :=
Finset.sum_le_sum fun a _ => mul_le_mul_of_nonneg_left (hbound a).2 (hw a)
_ = hi := hconst hi
theorem stage_message_score_certificate_of_gate
Assume measurable Radon–Nikodym densities for dominated kernels, positive dimension, a nonnegative privacy budget, and sequential local privacy of the protocol. The repaired jointly measurable stage densities simultaneously represent the actual original-record next-message law and give bounded zero-mean coordinate scores under that law. This identifies the measures needed by the transcript martingale argument, rather than an abstract density-weighted proxy.
Formal statement
hypotheses
n d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
i :
Fin n
hd :
0 < d
eps :
ℝ
heps :
0 ≤ eps
hQ :
SequentialClass Q eps
conclusion
∃ f : ((PairedSymbol d × Q.Seed) × ProtocolHistory Q i) × Q.Message i → ℝ,
conclusion 2
theta :
r eta z :
stageMixtureDensity theta (fun a => f (((a, r), eta), z))
= 1 + ∑ j, theta j * stageCoordinateSlope (fun a => f (((a, r), eta), z)) j
conclusion 3
theta ∈ parameterCube d :
r eta :
(stageReferenceKernel Q i (r, eta)).withDensity (fun z => ofReal (stageMixtureDensity theta (fun a => f (((a, r), eta), z))))
= (observedLaw (symmetricLaw theta)).bind (fun o => Q.kernels i ((o, r), eta))
conclusion 4
theta ∈ parameterCube d :
r eta z :
exp (-eps) ≤ stageMixtureDensity theta (fun a => f (((a, r), eta), z))
stageMixtureDensity theta (fun a => f (((a, r), eta), z)) ≤ exp eps
conclusion 5
theta ∈ parameterCube d :
r eta z j :
|stageCoordinateSlope (fun a => f (((a, r), eta), z)) j / stageMixtureDensity theta (fun a => f (((a, r), eta), z))|
≤ derivativeScale d eps
conclusion 6
theta ∈ parameterCube d :
r eta j :
(∫ z, stageCoordinateSlope (fun a => f (((a, r), eta), z)) j / stageMixtureDensity theta (fun a => f (((a, r), eta), z)) ∂(observedLaw (symmetricLaw theta)).bind (fun o => Q.kernels i ((o, r), eta)))
= 0
Proof (Lean source)
-- @node: stage_message_score_certificate_of_gate
lemma stage_message_score_certificate_of_gate (hRN : MeasurableKernelRadonNikodym)
{n d : ℕ} (Q : LocalProtocol n (ObsRecord d)) (i : Fin n) (hd : 0 < d)
(eps : ℝ) (heps : 0 ≤ eps) (hQ : SequentialClass Q eps) :
∃ f : ((PairedSymbol d × Q.Seed) × ProtocolHistory Q i) × Q.Message i → ℝ,
Measurable f ∧
(∀ w, exp (-eps) ≤ f w ∧ f w ≤ exp eps) ∧
(∀ theta, ∀ r eta z,
stageMixtureDensity theta (fun a => f (((a, r), eta), z)) =
1 + ∑ j, theta j * stageCoordinateSlope (fun a => f (((a, r), eta), z)) j) ∧
(∀ theta ∈ parameterCube d, ∀ r eta,
(stageReferenceKernel Q i (r, eta)).withDensity
(fun z => ofReal (stageMixtureDensity theta
(fun a => f (((a, r), eta), z)))) =
(observedLaw (symmetricLaw theta)).bind (fun o => Q.kernels i ((o, r), eta))) ∧
(∀ theta ∈ parameterCube d, ∀ r eta z,
exp (-eps) ≤ stageMixtureDensity theta (fun a => f (((a, r), eta), z)) ∧
stageMixtureDensity theta (fun a => f (((a, r), eta), z)) ≤ exp eps) ∧
(∀ theta ∈ parameterCube d, ∀ r eta z j,
|stageCoordinateSlope (fun a => f (((a, r), eta), z)) j /
stageMixtureDensity theta (fun a => f (((a, r), eta), z))| ≤ derivativeScale d eps) ∧
∀ theta ∈ parameterCube d, ∀ r eta j,
(∫ z, stageCoordinateSlope (fun a => f (((a, r), eta), z)) j /
stageMixtureDensity theta (fun a => f (((a, r), eta), z))
∂(observedLaw (symmetricLaw theta)).bind
(fun o => Q.kernels i ((o, r), eta))) = 0 := by
obtain ⟨f, hf, hf0, hsum, hpriv, hbound, hrep⟩ :=
stage_density_repaired_of_gate hRN Q i hd eps heps hQ
have hscore (theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d)
(r : Q.Seed) (eta : ProtocolHistory Q i) (z : Q.Message i) (j : Fin d) :=
stageCoordinateScore_bound hd theta htheta (fun a => f (((a, r), eta), z))
(fun a => lt_of_lt_of_le (Real.exp_pos (-eps)) (hbound _).1)
eps heps (fun a b => hpriv a b r eta z) j
have hmessage (theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d)
(r : Q.Seed) (eta : ProtocolHistory Q i) :=
stageMixtureDensity_messageLaw Q i hd theta htheta r eta f hf hf0
(fun a => hrep a r eta)
refine ⟨f, hf, hbound, ?_, hmessage, ?_, ?_, ?_⟩
· intro theta r eta z
exact stageMixtureDensity_normalized hd theta _ (hsum r eta z)
· intro theta htheta r eta z
exact stageMixtureDensity_bounds hd theta htheta _ _ _ (fun a => hbound _)
· intro theta htheta r eta z j
exact (hscore theta htheta r eta z j).2
· intro theta htheta r eta j
rw [← hmessage theta htheta r eta]
let := stageReferenceKernel_markov Q i hd
let := averagedKernel_markov Q i
apply stageCoordinateScore_integral_zero (stageReferenceKernel Q i (r, eta))
(fun a z => f (((a, r), eta), z))
(fun a => hf.comp (by fun_prop)) (fun a z => hf0 _) (exp eps)
· intro a z
rw [abs_of_nonneg (hf0 _)]
exact (hbound _).2
· intro a
rw [hrep]
infer_instance
· intro z
exact (hscore theta htheta r eta z j).1
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Contraction.TaylorRemainder 8 declarations Taylor expansion at zero works on either side of zero with the exact factorial constant.
Exact Taylor cancellation for the contraction argument
Taylor expansion at zero works on either side of zero with the exact factorial constant. Matching moments cancel its finite polynomial; only the remainders contribute to a difference of supported prior means.
Assume the stated hf condition and the stated hu condition. On a nondegenerate interval, the Taylor polynomial of a globally smooth function uses its ordinary derivatives, including at an endpoint.
Formal statement
hypotheses
conclusion
taylorWithinEval f k (uIcc 0 u) 0 u
= ∑ q ∈ range (k + 1), iteratedDeriv q f 0 / (q.factorial : ℝ) * u^q
Proof (Lean source)
-- @node: taylorWithinEval_zero_eq_sum
lemma taylorWithinEval_zero_eq_sum (f : ℝ → ℝ) (k : ℕ)
(hf : ContDiff ℝ k f) (u : ℝ) (hu : u ≠ 0) :
taylorWithinEval f k (uIcc 0 u) 0 u =
∑ q ∈ range (k + 1), iteratedDeriv q f 0 / (q.factorial : ℝ) * u^q := by
rw [taylor_within_apply]
apply Finset.sum_congr rfl
intro q hq
rw [iteratedDerivWithin_eq_iteratedDeriv
(uniqueDiffOn_uIcc (Ne.symm hu))
((hf.of_le (by exact_mod_cast (show q ≤ k by simpa using Finset.mem_range.mp hq))).contDiffAt)
Set.left_mem_uIcc]
simp only [sub_zero, smul_eq_mul, div_eq_mul_inv]
ring
Assume the stated hk condition, the stated hf condition, nonnegative amplitude, the stated hu condition, a nonnegative bias bound, and the stated hderiv condition. A uniform kth derivative bound gives the exact Taylor remainder bound at zero, for positive and negative coordinates alike.
Formal statement
hypotheses
f :
ℝ → ℝ
k :
ℕ
hk :
1 ≤ k
hf :
ContDiff ℝ k f
a B u :
ℝ
ha :
0 ≤ a
hu :
u ∈ Icc (-a) a
_hB :
0 ≤ B
hderiv :
∀ x ∈ Icc (-a) a, |iteratedDeriv k f x| ≤ (k.factorial : ℝ) * B
conclusion
|f u - ∑ q ∈ range k, iteratedDeriv q f 0 / (q.factorial : ℝ) * u^q| ≤ |u|^k * B
Proof (Lean source)
-- @node: coordinate_taylor_remainder_abs_le
lemma coordinate_taylor_remainder_abs_le (f : ℝ → ℝ) (k : ℕ) (hk : 1 ≤ k)
(hf : ContDiff ℝ k f) (a B u : ℝ) (ha : 0 ≤ a)
(hu : u ∈ Icc (-a) a) (_hB : 0 ≤ B)
(hderiv : ∀ x ∈ Icc (-a) a,
|iteratedDeriv k f x| ≤ (k.factorial : ℝ) * B) :
|f u - ∑ q ∈ range k,
iteratedDeriv q f 0 / (q.factorial : ℝ) * u^q| ≤ |u|^k * B := by
obtain ⟨l, rfl⟩ : ∃ l, k = l + 1 := ⟨k - 1, by omega⟩
by_cases hu0 : u = 0
· subst u
simp [Finset.sum_range_succ', iteratedDeriv_zero]
have hsegment : uIcc 0 u ⊆ Icc (-a) a :=
Set.uIcc_subset_Icc (by constructor <;> linarith) hu
obtain ⟨x, hx, heq⟩ := taylor_mean_remainder_lagrange_iteratedDeriv
(f := f) (n := l) (Ne.symm hu0) hf.contDiffOn
rw [taylorWithinEval_zero_eq_sum f l (hf.of_le (by exact_mod_cast le_succ l)) u hu0,
sub_zero] at heq
rw [heq, abs_div, abs_mul, abs_pow,
abs_of_nonneg (a := ((l + 1).factorial : ℝ)) (by positivity)]
calc
|iteratedDeriv (l + 1) f x| * |u|^(l + 1) / ((l + 1).factorial : ℝ) ≤
(((l + 1).factorial : ℝ) * B) * |u|^(l + 1) / ((l + 1).factorial : ℝ) := by
apply div_le_div_of_nonneg_right _ (Nat.cast_nonneg _)
exact mul_le_mul_of_nonneg_right (hderiv x (hsegment ⟨le_of_lt hx.1, le_of_lt hx.2⟩))
(by positivity)
_ = |u|^(l + 1) * B := by
field_simp
theorem integrable_continuous_amplitudePrior Lemma integrable_continuous_amplitudePrior in the paper ↗
Assume the stated hnu condition and the stated hf condition. Compactly supported probability priors integrate every continuous scalar coordinate function; no extra moment hypothesis is needed.
Formal statement
hypotheses
conclusion
Integrable f nu
Proof (Lean source)
-- @node: integrable_continuous_amplitudePrior
lemma integrable_continuous_amplitudePrior (a : ℝ) (nu : Measure ℝ)
(hnu : AmplitudePrior a nu) (f : ℝ → ℝ) (hf : Continuous f) :
Integrable f nu := by
have : IsProbabilityMeasure nu := hnu.1
have hmem : ∀ᵐ u ∂nu, u ∈ Icc (-a) a := by
rw [ae_iff]
exact hnu.2
have h := hf.integrableOn_Icc (μ := nu) (a := -a) (b := a)
rwa [IntegrableOn, Measure.restrict_eq_self_of_ae_mem hmem] at h
Assume the stated hnu0 condition, the stated hnu1 condition, and the stated hmom condition. Matching moments cancel any finite Taylor polynomial of degree below k.
Formal statement
hypotheses
a :
ℝ
nu0 nu1 :
Measure ℝ
hnu0 :
AmplitudePrior a nu0
hnu1 :
AmplitudePrior a nu1
k :
ℕ
hmom :
MatchingMoments k nu0 nu1
c :
ℕ → ℝ
Proof (Lean source)
-- @node: matchingMoments_taylor_polynomial
lemma matchingMoments_taylor_polynomial (a : ℝ) (nu0 nu1 : Measure ℝ)
(hnu0 : AmplitudePrior a nu0) (hnu1 : AmplitudePrior a nu1)
(k : ℕ) (hmom : MatchingMoments k nu0 nu1) (c : ℕ → ℝ) :
(∫ u, ∑ q ∈ range k, c q * u^q ∂nu0) =
∫ u, ∑ q ∈ range k, c q * u^q ∂nu1 := by
have hint (nu : Measure ℝ) (hnu : AmplitudePrior a nu) (q : ℕ) :
Integrable (fun u : ℝ => c q * u^q) nu :=
integrable_continuous_amplitudePrior a nu hnu _ (by fun_prop)
rw [integral_finsetSum _ (fun q _ => hint nu0 hnu0 q),
integral_finsetSum _ (fun q _ => hint nu1 hnu1 q)]
apply Finset.sum_congr rfl
intro q hq
rw [integral_const_mul, integral_const_mul, hmom q (Finset.mem_range.mp hq)]
theorem matchingMoments_smooth_integral_sub_le Lemma matchingMoments_smooth_integral_sub_le in the paper ↗
Assume nonnegative amplitude, a nonnegative bias bound, the stated hnu0 condition, the stated hnu1 condition, the stated hk condition, the stated hmom condition, the stated hf condition, and the stated hderiv condition. A matched pair of supported priors differs only through Taylor remainders. The exact derivative bound yields twice the single-prior remainder radius.
Formal statement
hypotheses
a B :
ℝ
ha :
0 ≤ a
hB :
0 ≤ B
nu0 nu1 :
Measure ℝ
hnu0 :
AmplitudePrior a nu0
hnu1 :
AmplitudePrior a nu1
k :
ℕ
hk :
1 ≤ k
hmom :
MatchingMoments k nu0 nu1
f :
ℝ → ℝ
hf :
ContDiff ℝ k f
hderiv :
∀ x ∈ Icc (-a) a, |iteratedDeriv k f x| ≤ (k.factorial : ℝ) * B
conclusion
|(∫ u, f u ∂nu0) - (∫ u, f u ∂nu1)| ≤ 2 * a^k * B
Proof (Lean source)
-- @node: matchingMoments_smooth_integral_sub_le
lemma matchingMoments_smooth_integral_sub_le (a B : ℝ) (ha : 0 ≤ a) (hB : 0 ≤ B)
(nu0 nu1 : Measure ℝ) (hnu0 : AmplitudePrior a nu0) (hnu1 : AmplitudePrior a nu1)
(k : ℕ) (hk : 1 ≤ k) (hmom : MatchingMoments k nu0 nu1)
(f : ℝ → ℝ) (hf : ContDiff ℝ k f)
(hderiv : ∀ x ∈ Icc (-a) a,
|iteratedDeriv k f x| ≤ (k.factorial : ℝ) * B) :
|(∫ u, f u ∂nu0) - (∫ u, f u ∂nu1)| ≤ 2 * a^k * B := by
let T := fun u : ℝ => ∑ q ∈ range k,
iteratedDeriv q f 0 / (q.factorial : ℝ) * u^q
have hT : Continuous T := by fun_prop
have hcancel : (∫ u, T u ∂nu0) = ∫ u, T u ∂nu1 :=
matchingMoments_taylor_polynomial a nu0 nu1 hnu0 hnu1 k hmom _
have hrem (nu : Measure ℝ) (hnu : AmplitudePrior a nu) :
|∫ u, f u - T u ∂nu| ≤ a^k * B := by
have : IsProbabilityMeasure nu := hnu.1
have hi := integrable_continuous_amplitudePrior a nu hnu _ (hf.continuous.sub hT)
have hmem : ∀ᵐ u ∂nu, u ∈ Icc (-a) a := by
rw [ae_iff]; exact hnu.2
calc
_ ≤ ∫ u, |f u - T u| ∂nu := abs_integral_le_integral_abs
_ ≤ ∫ _u, a^k * B ∂nu := by
apply integral_mono_ae hi.abs (integrable_const _)
filter_upwards [hmem] with u hu
exact (coordinate_taylor_remainder_abs_le f k hk hf a B u ha hu hB hderiv).trans
(mul_le_mul_of_nonneg_right
(pow_le_pow_left₀ (abs_nonneg u) (abs_le.mpr hu) k) hB)
_ = a^k * B := by simp
have heq : (∫ u, f u ∂nu0) - (∫ u, f u ∂nu1) =
(∫ u, f u - T u ∂nu0) - (∫ u, f u - T u ∂nu1) := by
rw [integral_sub (integrable_continuous_amplitudePrior a nu0 hnu0 f hf.continuous)
(integrable_continuous_amplitudePrior a nu0 hnu0 T hT),
integral_sub (integrable_continuous_amplitudePrior a nu1 hnu1 f hf.continuous)
(integrable_continuous_amplitudePrior a nu1 hnu1 T hT), hcancel]
ring
rw [heq]
exact (abs_sub _ _).trans (by linarith [hrem nu0 hnu0, hrem nu1 hnu1])
theorem integrable_finitePolynomial_iteratedDeriv Lemma integrable_finitePolynomial_iteratedDeriv in the paper ↗
Assume the stated hc condition. Derivatives of a finite polynomial density family are integrable whenever its coefficients are integrable.
Formal statement
hypotheses
conclusion
Integrable (fun z => iteratedDeriv k (fun x : ℝ => ∑ q, c q z * x^q.val) u) mu
Proof (Lean source)
-- @node: integrable_finitePolynomial_iteratedDeriv
lemma integrable_finitePolynomial_iteratedDeriv {Ω : Type*} [MeasurableSpace Ω]
(mu : Measure Ω) (m : ℕ) (c : Fin m → Ω → ℝ)
(hc : ∀ q, Integrable (c q) mu) (k : ℕ) (u : ℝ) :
Integrable (fun z => iteratedDeriv k (fun x : ℝ => ∑ q, c q z * x^q.val) u) mu := by
have hexpand (z : Ω) :
iteratedDeriv k (fun x : ℝ => ∑ q, c q z * x^q.val) u =
∑ q, c q z * iteratedDeriv k (fun x : ℝ => x^q.val) u := by
rw [iteratedDeriv_fun_sum (by intro q _; fun_prop)]
simp_rw [iteratedDeriv_const_mul_field]
simp_rw [hexpand]
exact integrable_finsetSum _ (fun q _ => (hc q).mul_const _)
theorem finitePolynomial_iteratedDeriv_integral Lemma finitePolynomial_iteratedDeriv_integral in the paper ↗
Assume the stated hc condition. Coefficientwise integration commutes with every coordinate derivative of an integrable finite polynomial density family.
Formal statement
hypotheses
conclusion
iteratedDeriv k (fun x : ℝ => ∫ z, ∑ q, c q z * x^q.val ∂mu) u
= ∫ z, iteratedDeriv k (fun x : ℝ => ∑ q, c q z * x^q.val) u ∂mu
Proof (Lean source)
-- @node: finitePolynomial_iteratedDeriv_integral
lemma finitePolynomial_iteratedDeriv_integral {Ω : Type*} [MeasurableSpace Ω]
(mu : Measure Ω) (m : ℕ) (c : Fin m → Ω → ℝ)
(hc : ∀ q, Integrable (c q) mu) (k : ℕ) (u : ℝ) :
iteratedDeriv k (fun x : ℝ => ∫ z, ∑ q, c q z * x^q.val ∂mu) u =
∫ z, iteratedDeriv k (fun x : ℝ => ∑ q, c q z * x^q.val) u ∂mu := by
have hint (x : ℝ) : (∫ z, ∑ q, c q z * x^q.val ∂mu) =
∑ q, (∫ z, c q z ∂mu) * x^q.val := by
rw [integral_finsetSum _ (fun q _ => (hc q).mul_const _)]
simp_rw [integral_mul_const]
simp_rw [hint]
rw [iteratedDeriv_fun_sum (by intro q _; fun_prop)]
simp_rw [iteratedDeriv_const_mul_field]
have hexpand (z : Ω) :
iteratedDeriv k (fun x : ℝ => ∑ q, c q z * x^q.val) u =
∑ q, c q z * iteratedDeriv k (fun x : ℝ => x^q.val) u := by
rw [iteratedDeriv_fun_sum (by intro q _; fun_prop)]
simp_rw [iteratedDeriv_const_mul_field]
simp_rw [hexpand]
rw [integral_finsetSum _ (fun q _ => (hc q).mul_const _)]
simp_rw [integral_mul_const]
theorem finitePolynomial_taylor_remainder_L1 Lemma finitePolynomial_taylor_remainder_L1 in the paper ↗
Assume the stated hc condition, the stated hk condition, nonnegative amplitude, the stated hu condition, a nonnegative bias bound, and the stated hderiv condition. A finite polynomial family with a uniform kth-derivative L1 bound has the exact coordinate Taylor remainder bound in L1. Testing against the sign of the remainder reduces the assertion to scalar Taylor's theorem, avoiding any parameter-dependent exceptional sets.
Formal statement
hypotheses
Ω :
Type*
mu :
Measure Ω
m :
ℕ
c :
Fin m → Ω → ℝ
hc :
∀ q, Integrable (c q) mu
k :
ℕ
hk :
1 ≤ k
a B u :
ℝ
ha :
0 ≤ a
hu :
u ∈ Icc (-a) a
hB :
0 ≤ B
hderiv :
∀ x ∈ Icc (-a) a,
(∫ z, |iteratedDeriv k (fun t : ℝ => ∑ q, c q z * t^q.val) x| ∂mu) ≤ (k.factorial : ℝ) * B
conclusion
(∫ z, |(∑ q, c q z * u^q.val) - ∑ v ∈ range k, iteratedDeriv v (fun t : ℝ => ∑ q, c q z * t^q.val) 0 / (v.factorial : ℝ) * u^v| ∂mu)
≤ |u|^k * B
Proof (Lean source)
-- @node: finitePolynomial_taylor_remainder_L1
lemma finitePolynomial_taylor_remainder_L1 {Ω : Type*} [MeasurableSpace Ω]
(mu : Measure Ω) (m : ℕ) (c : Fin m → Ω → ℝ)
(hc : ∀ q, Integrable (c q) mu) (k : ℕ) (hk : 1 ≤ k)
(a B u : ℝ) (ha : 0 ≤ a) (hu : u ∈ Icc (-a) a) (hB : 0 ≤ B)
(hderiv : ∀ x ∈ Icc (-a) a,
(∫ z, |iteratedDeriv k (fun t : ℝ => ∑ q, c q z * t^q.val) x| ∂mu) ≤
(k.factorial : ℝ) * B) :
(∫ z, |(∑ q, c q z * u^q.val) - ∑ v ∈ range k,
iteratedDeriv v (fun t : ℝ => ∑ q, c q z * t^q.val) 0 /
(v.factorial : ℝ) * u^v| ∂mu) ≤ |u|^k * B := by
let F := fun x : ℝ => fun z : Ω => ∑ q, c q z * x^q.val
let R := fun z : Ω => F u z - ∑ v ∈ range k,
iteratedDeriv v (fun t => F t z) 0 / (v.factorial : ℝ) * u^v
have hF (x : ℝ) : Integrable (F x) mu :=
integrable_finsetSum _ (fun q _ => (hc q).mul_const _)
have hD (v : ℕ) (x : ℝ) : Integrable (fun z => iteratedDeriv v (fun t => F t z) x) mu :=
integrable_finitePolynomial_iteratedDeriv mu m c hc v x
have hR : Integrable R mu := (hF u).sub (integrable_finsetSum _
(fun v _ => ((hD v 0).div_const _).mul_const _))
let g := fun z : Ω => R z / |R z|
have hg : AEStronglyMeasurable g mu :=
hR.aestronglyMeasurable.div₀ hR.abs.aestronglyMeasurable
have hgb (z : Ω) : |g z| ≤ 1 := by
dsimp [g]
rw [abs_div, abs_abs]
by_cases hz : R z = 0
· simp [hz]
· rw [div_self (abs_ne_zero.mpr hz)]
have hgR (z : Ω) : g z * R z = |R z| := by
dsimp [g]
by_cases hz : R z = 0
· simp [hz]
· field_simp [abs_ne_zero.mpr hz]
nlinarith [sq_abs (R z)]
have hgc (q : Fin m) : Integrable (fun z => g z * c q z) mu :=
(hc q).bdd_mul hg (Filter.Eventually.of_forall (fun z => by simpa using hgb z))
let f := fun x : ℝ => ∫ z, g z * F x z ∂mu
have hfpoly (x : ℝ) : f x = ∑ q, (∫ z, g z * c q z ∂mu) * x^q.val := by
dsimp [f, F]
simp_rw [Finset.mul_sum, ← mul_assoc]
rw [integral_finsetSum _ (fun q _ => (hgc q).mul_const _)]
simp_rw [integral_mul_const]
have hf : ContDiff ℝ k f := by
have heq := funext hfpoly
rw [heq]
fun_prop
have hfD (v : ℕ) (x : ℝ) : iteratedDeriv v f x =
∫ z, g z * iteratedDeriv v (fun t => F t z) x ∂mu := by
have heq : f = (fun t : ℝ => ∫ z, ∑ q, (g z * c q z) * t^q.val ∂mu) := by
ext t
simp [f, F, Finset.mul_sum, mul_assoc]
rw [heq, finitePolynomial_iteratedDeriv_integral mu m _ hgc]
apply integral_congr_ae
filter_upwards [] with z
have heqz : (fun t : ℝ => ∑ q, (g z * c q z) * t^q.val) =
(fun t : ℝ => g z * F t z) := by
ext t
simp [F, Finset.mul_sum, mul_assoc]
rw [heqz, iteratedDeriv_const_mul_field]
have hfd (x : ℝ) (hx : x ∈ Icc (-a) a) :
|iteratedDeriv k f x| ≤ (k.factorial : ℝ) * B := by
rw [hfD]
calc
_ ≤ ∫ z, |g z * iteratedDeriv k (fun t => F t z) x| ∂mu :=
abs_integral_le_integral_abs
_ ≤ ∫ z, |iteratedDeriv k (fun t => F t z) x| ∂mu := by
apply integral_mono_ae ((hD k x).bdd_mul hg
(Filter.Eventually.of_forall (fun z => by simpa using hgb z))).abs (hD k x).abs
filter_upwards [] with z
rw [abs_mul]
exact mul_le_of_le_one_left (abs_nonneg _) (hgb z)
_ ≤ _ := hderiv x hx
have hscalar := coordinate_taylor_remainder_abs_le f k hk hf a B u ha hu hB hfd
have heq : f u - ∑ v ∈ range k,
iteratedDeriv v f 0 / (v.factorial : ℝ) * u^v = ∫ z, |R z| ∂mu := by
rw [show (∫ z, |R z| ∂mu) = ∫ z, g z * R z ∂mu by simp_rw [hgR]]
simp_rw [R, mul_sub, Finset.mul_sum, div_eq_mul_inv, ← mul_assoc]
rw [integral_sub ((hF u).bdd_mul hg
(Filter.Eventually.of_forall (fun z => by simpa using hgb z)))
(integrable_finsetSum _ (fun v _ =>
(((hD v 0).bdd_mul hg (Filter.Eventually.of_forall
(fun z => by simpa using hgb z))).mul_const _).mul_const _))]
rw [integral_finsetSum]
· simp_rw [hfD, integral_mul_const, mul_assoc]
rfl
· intro v _
simpa only [mul_assoc] using (((hD v 0).bdd_mul hg
(Filter.Eventually.of_forall (fun z => by simpa using hgb z))).mul_const
((v.factorial : ℝ)⁻¹)).mul_const (u^v)
rw [heq, abs_of_nonneg (integral_nonneg (fun z => abs_nonneg (R z)))] at hscalar
exact hscalar
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Decision 13 declarations Finite original-record private value frontiers: Helpers/Decision.
Helpers/Decision
Finite original-record private value frontiers: Helpers/Decision.
def Estimator
Fix the local protocol Q. Measurable decisions using only transcript, seed and analyst randomizer.
Definition (Lean source)
Fix the local protocol Q and the real parameter lower and the real parameter upper. Connected, ordered, closed interval decisions in a fixed range.
Definition (Lean source)
parameters
fields
lo :
DecisionSpace Q → ℝ
hi :
DecisionSpace Q → ℝ
measurable_lo :
Measurable lo
measurable_hi :
Measurable hi
ordered :
∀ w, lo w ≤ hi w
range_lo :
∀ w, lo w ∈ Icc lower upper
@realizes I(lower endpoint range); @realizes J_{\mathrm{TV}}(lower endpoint range)
range_hi :
∀ w, hi w ∈ Icc lower upper
def squaredRisk
Fix the probability law L, the estimator T, and the real parameter v. Extended nonnegative squared-error expectation; infinite risks stay infinite.
Definition (Lean source)
def expectedLength
Fix the probability law L and the interval procedure I. Expected connected interval length.
Definition (Lean source)
parameters
def
expectedLength L I :
ℝ≥0∞
given by
∫⁻ w, ofReal (intervalLength (I.lo w) (I.hi w)) ∂L
def coverage
Fix the probability law L, the interval procedure I, and the real parameter v. Coverage of a deterministic population target.
Definition (Lean source)
parameters
def
coverage L I v :
ℝ
given by
L.real (coverageEvent I.lo I.hi v)
def riskValue
Fix the probability law M, the probability law target, the local protocol laws, the protocol-class label, and the privacy budget. Generic decision value over a law class and a population target.
Definition (Lean source)
parameters
def
riskValue M target laws C eps :
ℝ≥0∞
given by
minimaxValueENNReal (fun (e : (Q : {Q : LocalProtocol n α // protocolClass C Q eps}) × Estimator Q.1) (p : {p : Measure Ω // p ∈ M}) => squaredRisk (laws e.1.1 p.1) e.2 (target p.1))
def lengthValue
Fix the probability law M, the probability law target, the local protocol laws, the protocol-class label, and the privacy budget and the real parameter lower and the real parameter upper. Generic globally honest connected-interval value.
Definition (Lean source)
parameters
def
lengthValue M target laws C eps lower upper :
ℝ≥0∞
given by
minimaxValueENNReal (fun (e : (Q : {Q : LocalProtocol n α // protocolClass C Q eps}) × {I : IntervalDecision Q.1 lower upper // ∀ p ∈ M, (0.90 : ℝ) ≤ coverage (laws Q.1 p) I (target p)}) (p : {p : Measure Ω // p ∈ M}) => expectedLength (laws e.1.1 p.1) e.2.1)
def minimaxRisk
Fix the sampling scheme S, the protocol-class label, and the privacy budget. Mechanism-optimal scalar causal risk.
Definition (Lean source)
parameters
def
minimaxRisk S C eps :
ℝ≥0∞
given by
def honestLength
Fix the sampling scheme S, the protocol-class label, and the privacy budget. Globally 0.90-honest connected causal interval length.
Definition (Lean source)
parameters
def
honestLength S C eps :
ℝ≥0∞
given by
Fix the local protocol Q. Finite alphabet certificate for attaining protocols.
Definition (Lean source)
parameters
def
FiniteMessages Q :
Prop
given by
Finite (Q.Message i)
Fix the local protocol Q and the estimator T. A decision is transcript-only when the public and analyst coins do not alter it.
Definition (Lean source)
parameters
def
TranscriptOnly Q T :
Prop
Fix the sampling scheme S and the privacy budget and the public seed and the stated h condition and the constant C0. A concrete NI protocol and decisions attaining both upper orders.
Definition (Lean source)
parameters
def
CausalAttainment S eps r h C0 :
Prop
given by
∃ (Q : LocalProtocol n (ObsRecord d)),
NoninteractiveClass Q eps
clause 1
∃ (T : Estimator Q) (I : IntervalDecision Q (1/4) (3/4)),
TranscriptOnly Q T
P ∈ causalClass d :
squaredRisk (decisionLaw S Q P) T (value P) ≤ ofReal (C0 * r)
(0.90 : ℝ) ≤ coverage (decisionLaw S Q P) I (value P)
theorem ni_si_values
NI optimization is over a smaller protocol class.
Formal statement
hypotheses
conclusion
conclusion 1
minimaxRisk S .SI eps ≤ minimaxRisk S .NI eps
conclusion 2
honestLength S .SI eps ≤ honestLength S .NI eps
Proof (Lean source)
-- @node: ni_si_values
lemma ni_si_values (S : SamplingScheme n d) (eps : ℝ) :
minimaxRisk S .SI eps ≤ minimaxRisk S .NI eps ∧
honestLength S .SI eps ≤ honestLength S .NI eps := by
constructor
· unfold minimaxRisk riskValue Causalean.Stat.minimaxValueENNReal
apply le_iInf
intro e
let q : {Q : LocalProtocol n (ObsRecord d) // protocolClass .SI Q eps} :=
⟨e.1.1, NoninteractiveClass.toSequentialClass e.1.1 eps e.1.2⟩
exact iInf_le_of_le ⟨q, e.2⟩ le_rfl
· unfold honestLength lengthValue Causalean.Stat.minimaxValueENNReal
apply le_iInf
intro e
let q : {Q : LocalProtocol n (ObsRecord d) // protocolClass .SI Q eps} :=
⟨e.1.1, NoninteractiveClass.toSequentialClass e.1.1 eps e.1.2⟩
exact iInf_le_of_le ⟨q, e.2⟩ le_rfl
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.DecisionCompletion 3 declarations Finite atomic sampling weights extend the canonical experiment to all population measures.
A measurable completion of the iid decision experiment
Finite atomic sampling weights extend the canonical experiment to all population measures. On probability laws this extension is exactly the iid experiment.
def completedDecisionLaw
Fix the local protocol Q and the probability law P. Atomic iid weights followed by the fixed protocol and its independent coins.
Definition (Lean source)
parameters
def
theorem measurable_completedDecisionLaw
For every protocol, the completed finite atomic decision law is measurable even off the probability model.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: measurable_completedDecisionLaw
@[fun_prop] lemma measurable_completedDecisionLaw (Q : LocalProtocol n (ObsRecord d)) :
Measurable (completedDecisionLaw Q) := by
apply Measure.measurable_of_measurable_coe
intro E hE
simp only [completedDecisionLaw, Measure.sum_apply _ hE, Measure.smul_apply,
smul_eq_mul]
apply Measurable.tsum
intro o
apply mul _ measurable_const
apply Finset.measurable_prod
intro i hi
exact (Measure.measurable_coe (measurableSet_singleton (o i))).comp
(Measure.measurable_map observe (by fun_prop))
theorem completedDecisionLaw_eq_canonical
On probability populations, atomic sampling is the canonical iid experiment.
Formal statement
Proof (Lean source)
-- @node: completedDecisionLaw_eq_canonical
lemma completedDecisionLaw_eq_canonical (Q : LocalProtocol n (ObsRecord d))
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] :
completedDecisionLaw Q P = decisionLaw (canonicalScheme n d) Q P := by
haveI : IsProbabilityMeasure (observedLaw P) :=
Measure.isProbabilityMeasure_map (show Measurable observe by fun_prop).aemeasurable
haveI : IsProbabilityMeasure uniform01 := ⟨by
simp [uniform01, Measure.restrict_apply, Real.volume_Icc]⟩
have hAtomic : Measure.pi (fun _ : Fin n => observedLaw P) =
Measure.sum (fun o : Fin n → ObsRecord d =>
(∏ i, observedLaw P {o i}) • Measure.dirac o) := by
conv_lhs => rw [← Measure.sum_smul_dirac
(Measure.pi (fun _ : Fin n => observedLaw P))]
simp only [Measure.pi_singleton]
unfold decisionLaw canonicalScheme
rw [hAtomic, Measure.prod_sum_left,
Measure.bind_sum _ _ (measurable_protocol_decisionRows Q).aemeasurable]
simp only [Measure.prod_smul_left, Measure.bind_smul, completedDecisionLaw]
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.DecisionSampling 6 declarations Probability, measurability and independent analyst-coin factorization of causal decision laws.
Sampling and analyst randomness
Probability, measurability and independent analyst-coin factorization of causal decision laws.
The finite causal value is measurable in the population law.
Formal statement
Proof (Lean source)
-- @node: measurable_causal_value
@[fun_prop] lemma measurable_causal_value : Measurable (value (d := d)) := by
unfold value armMean Measure.real
have h (E : Set (FullRecord d)) : Measurable (fun P : Measure (FullRecord d) => (P E).toReal) :=
(Measure.measurable_coe (MeasurableSet.of_discrete : MeasurableSet E)).ennreal_toReal
fun_prop
theorem measurable_sampling_decisionLaw
A sampling scheme whose law is measurable induces a measurable decision experiment.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
S :
SamplingScheme n d
Q :
LocalProtocol n (ObsRecord d)
hS :
Measurable (S Q.Seed Q.seedLaw)
conclusion
Measurable (decisionLaw S Q)
Proof (Lean source)
-- @node: measurable_sampling_decisionLaw
@[fun_prop] lemma measurable_sampling_decisionLaw
(S : SamplingScheme n d) (Q : LocalProtocol n (ObsRecord d))
(hS : Measurable (S Q.Seed Q.seedLaw)) : Measurable (decisionLaw S Q) := by
exact (Measure.measurable_bind' (measurable_protocol_decisionRows Q)).comp hS
theorem iid_sampling_inputLaw
Assume independent and identically distributed participant records, independent protocol randomness, and the causal-model conditions for the data law. The two sampling conditions identify the input law, including both independent coins.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
S :
SamplingScheme n d
hIID :
hRandom :
Q :
LocalProtocol n (ObsRecord d)
P :
hP :
Proof (Lean source)
-- @node: iid_sampling_inputLaw
lemma iid_sampling_inputLaw (S : SamplingScheme n d) (hIID : IidPeople S)
(hRandom : IndependentRandomness S) (Q : LocalProtocol n (ObsRecord d))
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P) :
S Q.Seed Q.seedLaw P =
(Measure.pi (fun _ : Fin n => observedLaw P)).prod (Q.seedLaw.prod uniform01) := by
rw [hRandom Q.Seed Q.seedLaw P hP, hIID Q.Seed Q.seedLaw P hP]
theorem sampling_decisionLaw_probability
Assume independent and identically distributed participant records, independent protocol randomness, and the causal-model conditions for the data law. Every causal decision row is a probability law under the stated sampling scheme.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
S :
SamplingScheme n d
hIID :
hRandom :
Q :
LocalProtocol n (ObsRecord d)
P :
hP :
conclusion
IsProbabilityMeasure (decisionLaw S Q P)
Proof (Lean source)
-- @node: sampling_decisionLaw_probability
lemma sampling_decisionLaw_probability (S : SamplingScheme n d) (hIID : IidPeople S)
(hRandom : IndependentRandomness S) (Q : LocalProtocol n (ObsRecord d))
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P) :
IsProbabilityMeasure (decisionLaw S Q P) := by
haveI : IsProbabilityMeasure uniform01 := ⟨by
simp [uniform01, Measure.restrict_apply, Real.volume_Icc]⟩
haveI : IsProbabilityMeasure (observedLaw P) :=
Measure.isProbabilityMeasure_map (show Measurable observe by fun_prop).aemeasurable
haveI : IsProbabilityMeasure (S Q.Seed Q.seedLaw P) := by
rw [iid_sampling_inputLaw S hIID hRandom Q P hP]
infer_instance
apply isProbabilityMeasure_bind (measurable_protocol_decisionRows Q).aemeasurable
exact Filter.Eventually.of_forall (fun w => by
haveI : IsProbabilityMeasure (fixedTranscriptLaw Q w.1 w.2.1) :=
isProbabilityMeasure_transcriptLaw
Q.kernels Q.markov (fun i => (w.1 i,w.2.1))
exact Measure.isProbabilityMeasure_map (by fun_prop))
theorem product_decisionRows_rectangle
Assume the set hE, the set hF, and the set hG. Rectangle probabilities separate the independent analyst coin from the transcript experiment.
Formal statement
hypotheses
conclusion
((mu.prod (Q.seedLaw.prod uniform01)).bind (fun w => (fixedTranscriptLaw Q w.1 w.2.1).map (fun z => (z,w.2.1,w.2.2)))) (E ×ˢ F ×ˢ G)
= (∫⁻ o, ∫⁻ r, F.indicator (fun r => fixedTranscriptLaw Q o r E) r ∂Q.seedLaw ∂mu) * uniform01 G
Proof (Lean source)
-- @node: product_decisionRows_rectangle
lemma product_decisionRows_rectangle {α : Type} [MeasurableSpace α]
(Q : LocalProtocol n α) (mu : Measure (Fin n → α)) [IsProbabilityMeasure mu]
(E : Set (ProtocolTranscript Q)) (F : Set Q.Seed) (G : Set ℝ)
(hE : MeasurableSet E) (hF : MeasurableSet F) (hG : MeasurableSet G) :
((mu.prod (Q.seedLaw.prod uniform01)).bind (fun w =>
(fixedTranscriptLaw Q w.1 w.2.1).map (fun z => (z,w.2.1,w.2.2))))
(E ×ˢ F ×ˢ G) =
(∫⁻ o, ∫⁻ r, F.indicator (fun r => fixedTranscriptLaw Q o r E) r ∂Q.seedLaw ∂mu) *
uniform01 G := by
classical
haveI : IsProbabilityMeasure uniform01 := ⟨by
simp [uniform01, Measure.restrict_apply, Real.volume_Icc]⟩
rw [Measure.bind_apply (hE.prod (hF.prod hG))
(measurable_protocol_decisionRows Q).aemeasurable]
have hmap (o : Fin n → α) (r : Q.Seed) (u : ℝ) :
((fixedTranscriptLaw Q o r).map (fun z => (z,r,u))) (E ×ˢ F ×ˢ G) =
(fixedTranscriptLaw Q o r) ((fun z => (z,r,u)) ⁻¹' (E ×ˢ F ×ˢ G)) :=
Measure.map_apply (by fun_prop) (hE.prod (hF.prod hG))
have hmeas := (Measure.measurable_coe (hE.prod (hF.prod hG))).comp
(measurable_protocol_decisionRows Q)
simp only [Function.comp_def] at hmeas
rw [lintegral_prod _ hmeas.aemeasurable]
have htonelli (o : Fin n → α) :
(∫⁻ p : Q.Seed × ℝ,
((fixedTranscriptLaw Q o p.1).map (fun z => (z,p.1,p.2)))
(E ×ˢ F ×ˢ G) ∂Q.seedLaw.prod uniform01) =
∫⁻ r, ∫⁻ u, ((fixedTranscriptLaw Q o r).map (fun z => (z,r,u)))
(E ×ˢ F ×ˢ G) ∂uniform01 ∂Q.seedLaw :=
lintegral_prod _ (hmeas.comp (show Measurable (fun p : Q.Seed × ℝ => (o,p))
by fun_prop)).aemeasurable
simp_rw [htonelli, hmap]
have hpre (r : Q.Seed) (u : ℝ) :
(fun z : ProtocolTranscript Q => (z,r,u)) ⁻¹' (E ×ˢ F ×ˢ G) =
if r ∈ F ∧ u ∈ G then E else ∅ := by
ext z
simp only [Set.mem_preimage, Set.mem_prod]
split_ifs <;> simp_all
simp_rw [hpre]
have hinner (o : Fin n → α) (r : Q.Seed) :
(∫⁻ u, (fixedTranscriptLaw Q o r) (if r ∈ F ∧ u ∈ G then E else ∅) ∂uniform01) =
F.indicator (fun r => fixedTranscriptLaw Q o r E) r * uniform01 G := by
by_cases hr : r ∈ F
· simp only [hr, true_and, Set.indicator_of_mem hr, apply_ite, measure_empty]
change (∫⁻ u, G.indicator (fun _ => fixedTranscriptLaw Q o r E) u ∂uniform01) = _
rw [lintegral_indicator_const hG]
· simp [hr]
simp_rw [hinner]
simp_rw [lintegral_mul_const' _ _ (measure_ne_top uniform01 G)]
theorem sampling_decisionLaw_randomizer
Assume independent and identically distributed participant records, independent protocol randomness, and the causal-model conditions for the data law. The analyst coin remains independent after any sequential transcript is generated.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
S :
SamplingScheme n d
hIID :
hRandom :
Q :
LocalProtocol n (ObsRecord d)
P :
hP :
conclusion
decisionLaw S Q P
= (((decisionLaw S Q P).map (fun w => (w.1,w.2.1))).prod uniform01).map (fun w : (ProtocolTranscript Q × Q.Seed) × ℝ => (w.1.1,w.1.2,w.2))
Proof (Lean source)
-- @node: sampling_decisionLaw_randomizer
lemma sampling_decisionLaw_randomizer (S : SamplingScheme n d) (hIID : IidPeople S)
(hRandom : IndependentRandomness S) (Q : LocalProtocol n (ObsRecord d))
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P) :
decisionLaw S Q P =
(((decisionLaw S Q P).map (fun w => (w.1,w.2.1))).prod uniform01).map
(fun w : (ProtocolTranscript Q × Q.Seed) × ℝ => (w.1.1,w.1.2,w.2)) := by
haveI := sampling_decisionLaw_probability S hIID hRandom Q P hP
haveI : IsProbabilityMeasure uniform01 := ⟨by
simp [uniform01, Measure.restrict_apply, Real.volume_Icc]⟩
haveI : IsProbabilityMeasure (observedLaw P) :=
Measure.isProbabilityMeasure_map (show Measurable observe by fun_prop).aemeasurable
have hrect (E : Set (ProtocolTranscript Q)) (F : Set Q.Seed) (G : Set ℝ)
(hE : MeasurableSet E) (hF : MeasurableSet F) (hG : MeasurableSet G) :
(decisionLaw S Q P) (E ×ˢ F ×ˢ G) =
(∫⁻ o, ∫⁻ r, F.indicator (fun r => fixedTranscriptLaw Q o r E) r
∂Q.seedLaw ∂Measure.pi (fun _ : Fin n => observedLaw P)) * uniform01 G := by
unfold decisionLaw
rw [iid_sampling_inputLaw S hIID hRandom Q P hP]
exact product_decisionRows_rectangle Q _ E F G hE hF hG
apply Measure.ext_prod₃
intro E F G hE hF hG
rw [Measure.map_apply (by fun_prop) (hE.prod (hF.prod hG))]
have hpre : (fun w : (ProtocolTranscript Q × Q.Seed) × ℝ => (w.1.1,w.1.2,w.2)) ⁻¹'
(E ×ˢ F ×ˢ G) = (E ×ˢ F) ×ˢ G := by ext w; simp [and_assoc]
rw [hpre, Measure.prod_prod, Measure.map_apply (by fun_prop) (hE.prod hF)]
have hmarg : (fun w : DecisionSpace Q => (w.1,w.2.1)) ⁻¹' (E ×ˢ F) =
E ×ˢ F ×ˢ univ := by ext w; simp
rw [hmarg, hrect E F G hE hF hG, hrect E F univ hE hF MeasurableSet.univ]
simp
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Frontier.BaselineCalibration 11 declarations The first block releases randomized-response outcomes.
Binary baseline calibration
The first block releases randomized-response outcomes. Its estimate is unbiased, and independence of different people gives the baseline squared-error bound.
Every attaining row is a probability kernel, including the constant branch.
Formal statement
Proof (Lean source)
-- @node: frontierKernel_markov
lemma frontierKernel_markov (n d : ℕ) (eps : ℝ) (i : Fin n) :
IsMarkovKernel (frontierKernel n d eps i) := by
exact ⟨fun o => (frontierStage_markov n d eps i).isProbabilityMeasure
((o, (0 : Fin 1)), fun _ => (false, fun _ => false))⟩
Assume the stated hn condition and the stated hi condition. A baseline row releases a sign with the randomized-response conditional mean.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: frontierKernel_baseline_sign_mean
lemma frontierKernel_baseline_sign_mean (n d : ℕ) (eps : ℝ) (hn : n ≠ 2)
(i : Fin n) (hi : i.val < (frontierResources n d eps).m0) (o : ObsRecord d) :
(∫ z, signVal z.1 ∂frontierKernel n d eps i o) =
privacyDelta eps * signVal o.2.2 := by
classical
letI := frontierKernel_markov n d eps i
rw [integral_fintype Integrable.of_finite]
change (∑ z, (atomLaw (frontierMass n d eps i o)).real {z} * signVal z.1) = _
have hm : ∀ z, 0 ≤ frontierMass n d eps i o z := by
intro z
simp only [frontierMass, hn, hi, ↓reduceIte]
exact mul_nonneg (binaryOutcomeMass_nonneg eps o.2.2 z.1) (by split <;> positivity)
simp only [measureReal_def, atomLaw_singleton, ENNReal.toReal_ofReal (hm _)]
simp only [frontierMass, hn, hi, ↓reduceIte]
rw [Fintype.sum_prod_type]
simp only [Fintype.sum_bool]
simp [signVal]
ring
The observed outcome sign has mean twice the baseline minus one.
Formal statement
hypotheses
d :
ℕ
P :
Proof (Lean source)
-- @node: observed_outcome_sign_mean
lemma observed_outcome_sign_mean (d : ℕ) (P : Measure (FullRecord d))
[IsProbabilityMeasure P] :
(∫ o, signVal o.2.2 ∂observedLaw P) = 2 * baseline P - 1 := by
rw [observedLaw, integral_map (by fun_prop) (by fun_prop)]
have heq : (fun w : FullRecord d => signVal (observe w).2.2) =
(fun w => 2 * (if outcome w = true then (1 : ℝ) else 0) - 1) := by
funext w
cases h : outcome w <;> norm_num [observe, signVal, h]
rw [heq]
integral_linearity
have hevent := integral_fullRecord_event P {w | outcome w = true}
simp only [Set.mem_setOf_eq] at hevent
rw [hevent]
simp [baseline]
Assume the stated hn condition and the stated hi condition. Averaging original records gives the baseline row's unconditional mean.
Formal statement
hypotheses
conclusion
= privacyDelta eps * (2 * baseline P - 1)
Proof (Lean source)
-- @node: frontier_baseline_row_mean
lemma frontier_baseline_row_mean (n d : ℕ) (eps : ℝ) (hn : n ≠ 2)
(i : Fin n) (hi : i.val < (frontierResources n d eps).m0)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] :
(∫ z, signVal z.1 ∂(observedLaw P).bind (frontierKernel n d eps i)) =
privacyDelta eps * (2 * baseline P - 1) := by
letI := frontierKernel_markov n d eps i
letI : IsProbabilityMeasure (observedLaw P) :=
Measure.isProbabilityMeasure_map (by fun_prop)
change (∫ z, signVal z.1
∂((frontierKernel n d eps i) ∘ₖ Kernel.const Unit (observedLaw P)) ()) = _
rw [Kernel.integral_comp Integrable.of_finite]
simp_rw [frontierKernel_baseline_sign_mean n d eps hn i hi]
rw [integral_const_mul]
change privacyDelta eps * (∫ o, signVal o.2.2 ∂observedLaw P) = _
rw [observed_outcome_sign_mean]
Averaging any attaining row over a probability input law preserves mass one.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: frontier_averaged_row_probability
lemma frontier_averaged_row_probability (n d : ℕ) (eps : ℝ)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (i : Fin n) :
IsProbabilityMeasure ((observedLaw P).bind (frontierKernel n d eps i)) := by
letI := frontierKernel_markov n d eps i
letI : IsProbabilityMeasure (observedLaw P) :=
Measure.isProbabilityMeasure_map (by fun_prop)
exact isProbabilityMeasure_bind (Kernel.measurable _).aemeasurable
(Filter.Eventually.of_forall (fun _ => inferInstance))
Assume the stated hn condition, the stated hg condition, and the stated hbase condition. Distinct baseline rows have additive variances and the prescribed total mean.
Formal statement
hypotheses
Proof (Lean source)
-- @node: frontier_baseline_sum_moments
lemma frontier_baseline_sum_moments {n d k : ℕ} (eps : ℝ) (hn : n ≠ 2)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(g : Fin k → Fin n) (hg : Injective g)
(hbase : ∀ i, (g i).val < (frontierResources n d eps).m0) :
let L := Measure.pi (fun i => (observedLaw P).bind (frontierKernel n d eps i))
(∫ z, ∑ i, signVal (z (g i)).1 ∂L) =
(k : ℝ) * (privacyDelta eps * (2 * baseline P - 1)) ∧
variance (fun z => ∑ i, signVal (z (g i)).1) L ≤ k := by
classical
let μ := fun i => (observedLaw P).bind (frontierKernel n d eps i)
letI : ∀ i, IsProbabilityMeasure (μ i) :=
fun i => frontier_averaged_row_probability n d eps P i
change (∫ z, ∑ i, signVal (z (g i)).1 ∂Measure.pi μ) = _ ∧ _
have hmean : ∀ i, (∫ z, signVal (z (g i)).1 ∂Measure.pi μ) =
privacyDelta eps * (2 * baseline P - 1) := by
intro i
rw [integral_comp_eval (μ := μ) (i := g i)
(f := fun z : FrontierMessage d => signVal z.1) (by fun_prop)]
exact frontier_baseline_row_mean n d eps hn (g i) (hbase i) P
have hind := (iIndepFun_pi (μ := μ)
(X := fun (_ : Fin n) (z : FrontierMessage d) => signVal z.1)
(fun _ => (by fun_prop))).precomp hg
have hvar : ∀ i, variance (fun z => signVal (z (g i)).1) (Measure.pi μ) ≤ 1 := by
intro i
have h := variance_le_expectation_sq
(μ := Measure.pi μ) (X := fun z => signVal (z (g i)).1)
((show MemLp (fun z => signVal (z (g i)).1) 2 (Measure.pi μ)
from MemLp.of_discrete).aestronglyMeasurable)
have hs : ∀ z : Fin n → FrontierMessage d, (signVal (z (g i)).1)^2 = 1 := by
intro z
cases h : (z (g i)).1 <;> norm_num [signVal, h]
simpa [Pi.pow_apply, hs] using h
constructor
· rw [integral_finset_sum _ (fun _ _ => Integrable.of_finite)]
simp only [hmean, Finset.sum_const, Finset.card_univ, Fintype.card_fin, nsmul_eq_mul]
· have hv := IndepFun.variance_sum (s := univ)
(X := fun i z => signVal (z (g i)).1) (μ := Measure.pi μ)
(fun _ _ => MemLp.of_discrete) (fun i _ j _ hij => hind.indepFun hij)
change variance (fun z => ∑ i, signVal (z (g i)).1) (Measure.pi μ) ≤ _
have hv' : variance (fun z => ∑ i, signVal (z (g i)).1) (Measure.pi μ) =
∑ i, variance (fun z => signVal (z (g i)).1) (Measure.pi μ) := by
convert hv using 1
congr 1
funext z
simp
rw [hv']
calc
_ ≤ ∑ _i : Fin k, (1 : ℝ) := Finset.sum_le_sum (fun i _ => hvar i)
_ = _ := by simp
The baseline block lies in the declared participant horizon.
Formal statement
Proof (Lean source)
-- @node: frontier_baseline_block_le
lemma frontier_baseline_block_le (n d : ℕ) (eps : ℝ) :
(frontierResources n d eps).m0 ≤ n := by
simp only [frontierResources]
omega
theorem frontierBaselineEstimate_eq_fin_sum
The transcript's natural-number sum is exactly its in-horizon baseline block.
Formal statement
hypotheses
conclusion
frontierBaselineEstimate n d eps z
= 1/2
+ ((frontierResources n d eps).m0 : ℝ)⁻¹ * (∑ i : Fin (frontierResources n d eps).m0, signVal (z (castLE (frontier_baseline_block_le n d eps) i)).1) / (2 * privacyDelta eps)
Proof (Lean source)
-- @node: frontierBaselineEstimate_eq_fin_sum
lemma frontierBaselineEstimate_eq_fin_sum (n d : ℕ) (eps : ℝ)
(z : ProtocolTranscript (frontierProtocol n d eps)) :
frontierBaselineEstimate n d eps z = 1/2 +
((frontierResources n d eps).m0 : ℝ)⁻¹ *
(∑ i : Fin (frontierResources n d eps).m0,
signVal (z (castLE (frontier_baseline_block_le n d eps) i)).1) /
(2 * privacyDelta eps) := by
change Fin n → FrontierMessage d at z
dsimp only [frontierBaselineEstimate]
rw [← Fin.sum_univ_eq_sum_range]
congr 3
apply Finset.sum_congr rfl
intro i _
have hi : i.val < n := lt_of_lt_of_le i.isLt (frontier_baseline_block_le n d eps)
simp only [messageAt, hi, ↓reduceDIte]
rfl
Assume the stated hn3 condition and a privacy budget in the interval from zero to one. The actual binary baseline estimate has the roadmap's finite-block MSE.
Formal statement
hypotheses
conclusion
(∫ z, (frontierBaselineEstimate n d eps z - baseline P)^2 ∂Measure.pi (fun i => (observedLaw P).bind (frontierKernel n d eps i)))
≤ 1 / (4 * (frontierResources n d eps).m0 * (privacyDelta eps)^2)
Proof (Lean source)
-- @node: frontierBaselineEstimate_mse
lemma frontierBaselineEstimate_mse (n d : ℕ) (eps : ℝ)
(hn3 : 3 ≤ n) (heps : eps ∈ Ioc 0 1)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] :
(∫ z, (frontierBaselineEstimate n d eps z - baseline P)^2
∂Measure.pi (fun i => (observedLaw P).bind (frontierKernel n d eps i))) ≤
1 / (4 * (frontierResources n d eps).m0 * (privacyDelta eps)^2) := by
classical
let m0 := (frontierResources n d eps).m0
have hm0 : 0 < m0 := by dsimp [m0, frontierResources]; omega
have hm0r : (0 : ℝ) < m0 := by exact_mod_cast hm0
have hdelta : 0 < privacyDelta eps := by
have h := privacyDelta_lower_quarter eps heps
linarith [heps.1]
let g : Fin m0 → Fin n := castLE (frontier_baseline_block_le n d eps)
let f : (Fin n → FrontierMessage d) → ℝ := fun z => ∑ i, signVal (z (g i)).1
let L := Measure.pi (fun i => (observedLaw P).bind (frontierKernel n d eps i))
let c : ℝ := (m0 : ℝ)⁻¹ / (2 * privacyDelta eps)
letI : ∀ i, IsProbabilityMeasure ((observedLaw P).bind (frontierKernel n d eps i)) :=
fun i => frontier_averaged_row_probability n d eps P i
obtain ⟨hmean, hvar⟩ := frontier_baseline_sum_moments eps (by omega : n ≠ 2) P g
(by intro i j h; apply Fin.ext; exact congrArg (fun x : Fin n => x.val) h)
(fun i => i.isLt)
change (∫ z, f z ∂L) = (m0 : ℝ) * (privacyDelta eps * (2 * baseline P - 1)) at hmean
change variance f L ≤ (m0 : ℝ) at hvar
have hrepr : ∀ z : Fin n → FrontierMessage d,
frontierBaselineEstimate n d eps z - baseline P = c * (f z - ∫ w, f w ∂L) := by
intro z
rw [frontierBaselineEstimate_eq_fin_sum n d eps z, hmean]
dsimp [c, f, g]
change 1/2 + (m0 : ℝ)⁻¹ * (∑ i : Fin m0, signVal (z (castLE _ i)).1) /
(2 * privacyDelta eps) - baseline P = _
field_simp
<;> ring
have hv : (∫ z, (frontierBaselineEstimate n d eps z - baseline P)^2 ∂L) =
c^2 * variance f L := by
simp_rw [hrepr, mul_pow]
rw [integral_const_mul, variance_eq_integral (by fun_prop)]
change (∫ z, (frontierBaselineEstimate n d eps z - baseline P)^2 ∂L) ≤ _
rw [hv]
calc
_ ≤ c^2 * m0 := mul_le_mul_of_nonneg_left hvar (sq_nonneg c)
_ = _ := by
dsimp [c]
change ((m0 : ℝ)⁻¹ / (2 * privacyDelta eps))^2 * m0 =
1 / (4 * m0 * (privacyDelta eps)^2)
field_simp
<;> ring
The baseline block contains at least one third of the people.
Formal statement
Proof (Lean source)
-- @node: frontier_baseline_block_lower
lemma frontier_baseline_block_lower (n d : ℕ) (eps : ℝ) :
(n : ℝ) / 3 ≤ (frontierResources n d eps).m0 := by
have h : n ≤ 3 * (n - 2 * (n / 3)) := by omega
have hr : (n : ℝ) ≤ 3 * (n - 2 * (n / 3) : ℕ) := by exact_mod_cast h
change (n : ℝ) / 3 ≤ (n - 2 * (n / 3) : ℕ)
linarith
theorem frontierBaselineEstimate_mse_rate
Assume an admissible sample size, dimension, and privacy budget and the stated hn condition. Equation (11)'s binary counterpart: baseline MSE is at most twelve over t.
Formal statement
hypotheses
conclusion
(∫ z, (frontierBaselineEstimate n d eps z - baseline P)^2 ∂Measure.pi (fun i => (observedLaw P).bind (frontierKernel n d eps i)))
≤ 12 / ((n : ℝ) * eps^2)
Proof (Lean source)
-- @node: frontierBaselineEstimate_mse_rate
lemma frontierBaselineEstimate_mse_rate (n d : ℕ) (eps : ℝ)
(hAllowed : Allowed n d eps) (hn : n ≠ 2)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] :
(∫ z, (frontierBaselineEstimate n d eps z - baseline P)^2
∂Measure.pi (fun i => (observedLaw P).bind (frontierKernel n d eps i))) ≤
12 / ((n : ℝ) * eps^2) := by
apply (frontierBaselineEstimate_mse n d eps (by have := hAllowed.1; omega)
hAllowed.2.2 P).trans
have hnpos : (0 : ℝ) < n := by exact_mod_cast (by have := hAllowed.1; omega : 0 < n)
have heps := hAllowed.2.2.1
have hb := frontier_baseline_block_lower n d eps
have hd := privacyDelta_lower_quarter eps hAllowed.2.2
have hdelta : 0 < privacyDelta eps := by linarith [hAllowed.2.2.1]
have hm : (0 : ℝ) < (frontierResources n d eps).m0 := by linarith
have hdsq : eps^2 / 16 ≤ (privacyDelta eps)^2 := by
nlinarith [hAllowed.2.2.1]
calc
_ ≤ 1 / (4 * ((n : ℝ)/3) * (eps^2/16)) := by
apply div_le_div_of_nonneg_left (by norm_num) (by positivity)
apply mul_le_mul (mul_le_mul_of_nonneg_left hb (by norm_num)) hdsq
(by positivity) (by positivity)
_ = _ := by field_simp; ring
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Frontier.BlockSampling 5 declarations Selecting distinct vector-release rows recovers the iid vector experiment used by the finite moment calibration.
Vector blocks extracted from the attaining transcript
Selecting distinct vector-release rows recovers the iid vector experiment used by the finite moment calibration.
theorem frontierKernel_vector_marginal
Assume the stated hn condition and the stated hi condition. A vector-release row has exactly the signed-vector marginal.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: frontierKernel_vector_marginal
lemma frontierKernel_vector_marginal (n d : ℕ) (eps : ℝ) (hn : n ≠ 2)
(i : Fin n) (hi : (frontierResources n d eps).m0 ≤ i.val) (o : ObsRecord d) :
(frontierKernel n d eps i o).map snd = vectorKernel d eps o := by
classical
apply Measure.ext
intro E hE
rw [Measure.map_apply measurable_snd hE]
change atomLaw (frontierMass n d eps i o) (snd ⁻¹' E) =
atomLaw (vectorMass eps o) E
simp only [frontierMass, hn, not_lt.mpr hi, ↓reduceIte, atomLaw,
Measure.finsetSum_apply, Measure.smul_apply, smul_eq_mul,
Measure.dirac_apply' _ (measurable_snd hE),
Measure.dirac_apply' _ hE]
rw [Fintype.sum_prod_type]
simp [indicator, Set.mem_preimage]
Assume the stated hn condition and the stated hi condition. Averaging inputs preserves the vector marginal of every vector-release row.
Formal statement
hypotheses
n d :
ℕ
eps :
ℝ
hn :
n ≠ 2
i :
Fin n
hi :
(frontierResources n d eps).m0 ≤ i.val
P :
Measure (FullRecord d)
conclusion
Proof (Lean source)
-- @node: frontier_averaged_vector_marginal
lemma frontier_averaged_vector_marginal (n d : ℕ) (eps : ℝ) (hn : n ≠ 2)
(i : Fin n) (hi : (frontierResources n d eps).m0 ≤ i.val)
(P : Measure (FullRecord d)) :
((observedLaw P).bind (frontierKernel n d eps i)).map snd =
vectorMessageLaw P eps := by
apply Measure.ext
intro E hE
rw [Measure.map_apply measurable_snd hE]
unfold vectorMessageLaw
rw [Measure.bind_apply (measurable_snd hE) (Kernel.measurable _).aemeasurable,
Measure.bind_apply hE (Kernel.measurable _).aemeasurable]
apply lintegral_congr
intro o
have h := congrArg (fun L => L E) (frontierKernel_vector_marginal n d eps hn i hi o)
rw [Measure.map_apply measurable_snd hE] at h
exact h
Assume the stated hn condition, the stated hg condition, and the stated hvec condition. Selecting distinct vector-release rows yields independent vector messages.
Formal statement
hypotheses
conclusion
(Measure.pi (fun i => (observedLaw P).bind (frontierKernel n d eps i))).map (fun z i => (z (g i)).2)
= vectorBlockLaw P eps k
Proof (Lean source)
-- @node: frontier_vector_selection_law
lemma frontier_vector_selection_law {n d k : ℕ} (eps : ℝ) (hn : n ≠ 2)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(g : Fin k → Fin n) (hg : Injective g)
(hvec : ∀ i, (frontierResources n d eps).m0 ≤ (g i).val) :
(Measure.pi (fun i => (observedLaw P).bind (frontierKernel n d eps i))).map
(fun z i => (z (g i)).2) = vectorBlockLaw P eps k := by
have : IsProbabilityMeasure (observedLaw P) :=
Measure.isProbabilityMeasure_map (show Measurable observe by fun_prop).aemeasurable
have : ∀ i, IsMarkovKernel (frontierKernel n d eps i) := by
intro i
exact ⟨fun o => (frontierStage_markov n d eps i).isProbabilityMeasure
((o,(0 : Fin 1)), fun _ => (false,fun _ => false))⟩
have : ∀ i, IsProbabilityMeasure ((observedLaw P).bind (frontierKernel n d eps i)) :=
fun i => isProbabilityMeasure_bind (Kernel.measurable _).aemeasurable
(Filter.Eventually.of_forall (fun _ => inferInstance))
have hind := (iIndepFun_pi
(μ := fun i => (observedLaw P).bind (frontierKernel n d eps i))
(X := fun (_ : Fin n) (z : FrontierMessage d) => z.2)
(fun _ => measurable_snd.aemeasurable)).precomp hg
have hlaw := hind.map_fun_eq_pi_map
(fun i => (measurable_snd.comp (measurable_pi_apply (g i))).aemeasurable)
refine hlaw.trans ?_
unfold vectorBlockLaw
congr 1
funext i
have hmap := (measurePreserving_eval
(fun i => (observedLaw P).bind (frontierKernel n d eps i)) (g i)).map_eq
rw [← Measure.map_map measurable_snd (measurable_pi_apply (g i)), hmap]
exact frontier_averaged_vector_marginal n d eps hn (g i) (hvec i) P
Assume the stated hn condition, the stated hstart condition, and the stated hend condition. Any in-horizon contiguous vector block has the calibrated iid block law.
Formal statement
hypotheses
n d :
ℕ
eps :
ℝ
hn :
n ≠ 2
P :
offset :
ℕ
hstart :
(frontierResources n d eps).m0 ≤ offset
hend :
offset + n / 3 ≤ n
conclusion
(Measure.pi (fun i => (observedLaw P).bind (frontierKernel n d eps i))).map (frontierBlock n d eps offset)
= vectorBlockLaw P eps (n / 3)
Proof (Lean source)
-- @node: frontierBlock_law
lemma frontierBlock_law (n d : ℕ) (eps : ℝ) (hn : n ≠ 2)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(offset : ℕ) (hstart : (frontierResources n d eps).m0 ≤ offset)
(hend : offset + n / 3 ≤ n) :
(Measure.pi (fun i => (observedLaw P).bind (frontierKernel n d eps i))).map
(frontierBlock n d eps offset) = vectorBlockLaw P eps (n / 3) := by
let g : Fin (n / 3) → Fin n := fun i => ⟨offset + i.val, by omega⟩
have hg : Injective g := by
intro i j hij
apply Fin.ext
have := congrArg val hij
dsimp [g] at this
omega
have hfun : frontierBlock n d eps offset =
(fun z i => (z (g i)).2) := by
funext z i
simp only [frontierBlock, messageAt, show offset + i.val < n by omega, ↓reduceDIte]
rfl
rw [hfun]
exact frontier_vector_selection_law eps hn P g hg (fun i => by dsimp [g]; omega)
Assume the stated hn condition, the stated hstart condition, and the stated hend condition. Expectations of extracted vector-block statistics equal their calibration expectations.
Formal statement
hypotheses
n d :
ℕ
eps :
ℝ
hn :
n ≠ 2
P :
offset :
ℕ
hstart :
(frontierResources n d eps).m0 ≤ offset
hend :
offset + n / 3 ≤ n
conclusion
(∫ z, f (frontierBlock n d eps offset z) ∂Measure.pi (fun i => (observedLaw P).bind (frontierKernel n d eps i)))
= blockMean P eps f
Proof (Lean source)
-- @node: frontierBlock_integral
lemma frontierBlock_integral (n d : ℕ) (eps : ℝ) (hn : n ≠ 2)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(offset : ℕ) (hstart : (frontierResources n d eps).m0 ≤ offset)
(hend : offset + n / 3 ≤ n) (f : (Fin (n / 3) → Fin d → Bool) → ℝ) :
(∫ z, f (frontierBlock n d eps offset z)
∂Measure.pi (fun i => (observedLaw P).bind (frontierKernel n d eps i))) =
blockMean P eps f := by
unfold blockMean
rw [← frontierBlock_law n d eps hn P offset hstart hend]
exact (integral_map (by fun_prop) (by fun_prop)).symm
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Frontier.CausalPriorDecision 5 declarations Supported symmetric-law priors retain the transcript contraction bound after passing to law space.
Causal product priors in the measurable decision experiment
Supported symmetric-law priors retain the transcript contraction bound after passing to law space. The measurable completion lets the separated-mixture reduction apply to every sampling scheme satisfying iid and independent coins.
The finite causal model is a Borel set of population laws.
Formal statement
Proof (Lean source)
-- @node: measurableSet_causalClass
lemma measurableSet_causalClass (d : ℕ) : MeasurableSet (causalClass d) := by
have hm (E : Set (FullRecord d)) : Measurable (fun P : Measure (FullRecord d) => P.real E) :=
(Measure.measurable_coe (MeasurableSet.of_discrete : MeasurableSet E)).ennreal_toReal
have ha (a : Bool) (j : Fin d) : Measurable (fun P : Measure (FullRecord d) => armMean P a j) := by
unfold armMean
exact (hm _).div (hm _)
have heq : causalClass d = {P : Measure (FullRecord d) | P univ = 1} ∩
({P | UniformCovariates P} ∩ ({P | FairRandomization P} ∩
({P | Consistency P} ∩ {P | InteriorMeans P}))) := by
ext P
simp only [causalClass, Set.mem_setOf_eq, Set.mem_inter_iff, isProbabilityMeasure_iff]
constructor
· rintro ⟨hp, h⟩
exact ⟨hp, h.uniform, h.fair, h.consistent, h.interior⟩
· rintro ⟨hp, hu, hf, hc, hi⟩
exact ⟨hp, ⟨hu, hf, hc, hi⟩⟩
rw [heq]
refine (measurableSet_eq_fun (Measure.measurable_coe MeasurableSet.univ) measurable_const).inter
(MeasurableSet.inter ?_ (MeasurableSet.inter ?_ (MeasurableSet.inter ?_ ?_)))
· simp only [UniformCovariates, Set.setOf_forall]
exact MeasurableSet.iInter fun j => measurableSet_eq_fun (hm _) measurable_const
· simp only [FairRandomization, Set.setOf_forall]
exact MeasurableSet.iInter fun j => MeasurableSet.iInter fun a =>
MeasurableSet.iInter fun y0 => MeasurableSet.iInter fun y1 =>
measurableSet_eq_fun (hm _) ((hm _).const_mul _)
· exact measurableSet_eq_fun (hm _) measurable_const
· simp only [InteriorMeans, Set.setOf_forall]
exact MeasurableSet.iInter fun a => MeasurableSet.iInter fun j =>
isClosed_Icc.measurableSet.preimage (ha a j)
theorem symmetricLaw_productPrior_support
Assume positive dimension, the stated ha condition, and the stated hnu condition. Supported parameter priors push forward into the unchanged causal class.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: symmetricLaw_productPrior_support
lemma symmetricLaw_productPrior_support (hd : 0 < d) (a : ℝ) (ha : a ≤ (1/2 : ℝ))
(nu : Measure ℝ) (hnu : AmplitudePrior a nu) :
((productPrior d nu).map symmetricLaw) (causalClass d)ᶜ = 0 := by
rw [Measure.map_apply measurable_symmetricLaw_parameter (measurableSet_causalClass d).compl]
apply ae_iff.mp
filter_upwards [amplitude_productPrior_ae_cube a ha nu hnu] with theta ht
exact ⟨symmetricLaw_probability theta ht hd, symmetricLaw_causalModel theta ht hd⟩
theorem causal_prior_completed_marginal
Assume positive dimension, the stated ha condition, and the stated hnu condition. The completed law-space decision marginal equals the parameter transcript mixture.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
hd :
0 < d
a :
ℝ
ha :
a ≤ (1/2 : ℝ)
nu :
Measure ℝ
hnu :
AmplitudePrior a nu
conclusion
= mixtureLaw (canonicalScheme n d) Q nu
Proof (Lean source)
-- @node: causal_prior_completed_marginal
lemma causal_prior_completed_marginal (Q : LocalProtocol n (ObsRecord d))
(hd : 0 < d) (a : ℝ) (ha : a ≤ (1/2 : ℝ))
(nu : Measure ℝ) (hnu : AmplitudePrior a nu) :
(((productPrior d nu).map symmetricLaw).bind (completedDecisionLaw Q)).map
(fun w => (w.2.1,w.1)) = mixtureLaw (canonicalScheme n d) Q nu := by
have hm : Measurable (fun theta : Fin d → ℝ => completedDecisionLaw Q (symmetricLaw theta)) :=
(measurable_completedDecisionLaw Q).comp measurable_symmetricLaw_parameter
have hbind : ((productPrior d nu).map symmetricLaw).bind (completedDecisionLaw Q) =
(productPrior d nu).bind (fun theta => completedDecisionLaw Q (symmetricLaw theta)) := by
ext E hE
rw [Measure.bind_apply hE (measurable_completedDecisionLaw Q).aemeasurable,
Measure.bind_apply hE hm.aemeasurable]
exact lintegral_map ((Measure.measurable_coe hE).comp
(measurable_completedDecisionLaw Q)) measurable_symmetricLaw_parameter
rw [hbind, map_bind_measurable_rows _ _ hm _ (by fun_prop)]
apply Measure.bind_congr_right
filter_upwards [amplitude_productPrior_ae_cube a ha nu hnu] with theta ht
haveI := symmetricLaw_probability theta ht hd
rw [completedDecisionLaw_eq_canonical]
rfl
theorem causal_lawspace_resource_contraction
Assume measurable Radon–Nikodym densities for dominated kernels, sequential local privacy of the protocol, an admissible sample size, dimension, and privacy budget, the stated hnu0 condition, the stated hnu1 condition, and the stated hmatch condition. Prescribed amplitude and matching degree make the causal law-space transcript mixtures at most one hundredth apart, including orders beyond the sample size.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
Q :
LocalProtocol n (ObsRecord d)
eps :
ℝ
hQ :
SequentialClass Q eps
hAllowed :
Allowed n d eps
nu0 nu1 :
Measure ℝ
hnu0 :
AmplitudePrior (frontierResources n d eps).converseAmp nu0
hnu1 :
AmplitudePrior (frontierResources n d eps).converseAmp nu1
hmatch :
MatchingMoments (frontierResources n d eps).converseDegree nu0 nu1
conclusion
tvDist ((((productPrior d nu0).map symmetricLaw).bind (completedDecisionLaw Q)).map (fun w => (w.2.1,w.1))) ((((productPrior d nu1).map symmetricLaw).bind (completedDecisionLaw Q)).map (fun w => (w.2.1,w.1)))
≤ (1/100 : ℝ)
Proof (Lean source)
-- @node: causal_lawspace_resource_contraction
lemma causal_lawspace_resource_contraction (hRN : MeasurableKernelRadonNikodym)
(Q : LocalProtocol n (ObsRecord d)) (eps : ℝ)
(hQ : SequentialClass Q eps) (hAllowed : Allowed n d eps)
(nu0 nu1 : Measure ℝ)
(hnu0 : AmplitudePrior (frontierResources n d eps).converseAmp nu0)
(hnu1 : AmplitudePrior (frontierResources n d eps).converseAmp nu1)
(hmatch : MatchingMoments (frontierResources n d eps).converseDegree nu0 nu1) :
tvDist
((((productPrior d nu0).map symmetricLaw).bind (completedDecisionLaw Q)).map
(fun w => (w.2.1,w.1)))
((((productPrior d nu1).map symmetricLaw).bind (completedDecisionLaw Q)).map
(fun w => (w.2.1,w.1))) ≤ (1/100 : ℝ) := by
have hd : 0 < d := by have := hAllowed.2.1; omega
have ha := frontier_converse_amplitude_domain n d eps hAllowed
rw [causal_prior_completed_marginal Q hd _ ha.2 nu0 hnu0,
causal_prior_completed_marginal Q hd _ ha.2 nu1 hnu1]
let k := (frontierResources n d eps).converseDegree
have hk : 1 ≤ k := by have := frontier_converse_degree_domain n d eps hAllowed; dsimp [k]; omega
have hcontract := (adaptive_moment_contraction hRN (canonicalScheme n d)
canonicalScheme_iidPeople canonicalScheme_independentRandomness Q eps hQ hAllowed).2
_ ha nu0 nu1 hnu0 hnu1 k hk hmatch
by_cases hkn : k ≤ n
· exact ((hcontract.1 hkn).trans (min_le_right _ _)).trans
((contraction_coefficient_geometric_le n d k hd (by omega) eps _
hAllowed.2.2 ha.1.le).trans (frontier_converse_geometric_small n d eps hAllowed))
· rw [hcontract.2.1 (by omega)]
simpa [tvDist] using (show (0 : ℝ) ≤ 1/100 by norm_num)
theorem causal_separated_lawspace_decisions
Assume independent and identically distributed participant records, independent protocol randomness, the stated support condition, the stated support condition, strict separation of the two target values, the stated concentration near the target value, the stated concentration near the target value, and the probability law hTV. Law-space separated priors give the stated causal risk and honest interval bounds for every iid scheme with independent public and analyst randomness.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
S :
SamplingScheme n d
hIID :
hRandom :
Q :
LocalProtocol n (ObsRecord d)
pi0 pi1 :
hSupport0 :
pi0 (causalClass d)ᶜ = 0
hSupport1 :
pi1 (causalClass d)ᶜ = 0
v0 v1 eta omega :
ℝ
hv :
v0 < v1
hEscape0 :
pi0.real {P | (v1-v0)/8 < |value P-v0|} ≤ eta
hEscape1 :
pi1.real {P | (v1-v0)/8 < |value P-v1|} ≤ eta
hTV :
tvDist ((pi0.bind (completedDecisionLaw Q)).map (fun w => (w.2.1,w.1))) ((pi1.bind (completedDecisionLaw Q)).map (fun w => (w.2.1,w.1)))
≤ omega
conclusion
conclusion 1
T :
≤ ⨆ P : {P : Measure (FullRecord d) // P ∈ causalClass d}, squaredRisk (decisionLaw S Q P.1) T (value P.1)
Proof (Lean source)
-- @node: causal_separated_lawspace_decisions
lemma causal_separated_lawspace_decisions
(S : SamplingScheme n d) (hIID : IidPeople S) (hRandom : IndependentRandomness S)
(Q : LocalProtocol n (ObsRecord d))
(pi0 pi1 : Measure (Measure (FullRecord d)))
[IsProbabilityMeasure pi0] [IsProbabilityMeasure pi1]
(hSupport0 : pi0 (causalClass d)ᶜ = 0) (hSupport1 : pi1 (causalClass d)ᶜ = 0)
(v0 v1 eta omega : ℝ) (hv : v0 < v1)
(hEscape0 : pi0.real {P | (v1-v0)/8 < |value P-v0|} ≤ eta)
(hEscape1 : pi1.real {P | (v1-v0)/8 < |value P-v1|} ≤ eta)
(hTV : tvDist
((pi0.bind (completedDecisionLaw Q)).map (fun w => (w.2.1,w.1)))
((pi1.bind (completedDecisionLaw Q)).map (fun w => (w.2.1,w.1))) ≤ omega) :
(∀ T : Estimator Q,
ofReal (9*(v1-v0)^2/128 * max 0 (1-omega-2*eta)) ≤
⨆ P : {P : Measure (FullRecord d) // P ∈ causalClass d},
squaredRisk (decisionLaw S Q P.1) T (value P.1)) ∧
(∀ I : IntervalDecision Q (1/4) (3/4),
(∀ P ∈ causalClass d, (0.90 : ℝ) ≤ coverage (decisionLaw S Q P) I (value P)) →
ofReal (3*(v1-v0)/4 * max 0 ((0.80 : ℝ)-2*eta-omega)) ≤
⨆ P : {P : Measure (FullRecord d) // P ∈ causalClass d},
expectedLength (decisionLaw S Q P.1) I) := by
have hEq (P : Measure (FullRecord d)) (hP : P ∈ causalClass d) :
completedDecisionLaw Q P = decisionLaw S Q P := by
haveI := hP.1
rw [completedDecisionLaw_eq_canonical]
unfold decisionLaw
rw [iid_sampling_inputLaw S hIID hRandom Q P hP.2]
rfl
have hProb (P : Measure (FullRecord d)) (hP : P ∈ causalClass d) :
IsProbabilityMeasure (completedDecisionLaw Q P) := by
haveI := hP.1
rw [hEq P hP]
exact sampling_decisionLaw_probability S hIID hRandom Q P hP.2
have hProduct (P : Measure (FullRecord d)) (hP : P ∈ causalClass d) :
completedDecisionLaw Q P =
(((completedDecisionLaw Q P).map (fun w => (w.1,w.2.1))).prod uniform01).map
(fun w : (ProtocolTranscript Q × Q.Seed) × ℝ => (w.1.1,w.1.2,w.2)) := by
haveI := hP.1
rw [hEq P hP]
exact sampling_decisionLaw_randomizer S hIID hRandom Q P hP.2
have hsep := separated_value_mixtures_generic Q (causalClass d) value
(completedDecisionLaw Q) hProduct hProb pi0 pi1 hSupport0 hSupport1
measurable_causal_value (measurable_completedDecisionLaw Q)
v0 v1 eta omega hv hEscape0 hEscape1 hTV (1/4) (3/4)
constructor
· intro T
convert hsep.1 T using 1
congr 1
funext P
rw [hEq P.1 P.2]
· intro I hCov
have hCov' : ∀ P ∈ causalClass d, (0.90 : ℝ) ≤
coverage (completedDecisionLaw Q P) I (value P) := by
intro P hP
rw [hEq P hP]
exact hCov P hP
convert hsep.2 I hCov' using 1
congr 1
funext P
rw [hEq P.1 P.2]
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Frontier.ContractionCalibration 8 declarations The binomial and privacy bounds turn the adaptive contraction coefficient into its resource-normalized geometric form, as in equation (15) of the proof.
Geometric calibration of adaptive contraction
The binomial and privacy bounds turn the adaptive contraction coefficient into its resource-normalized geometric form, as in equation (15) of the proof.
Assume the stated hk condition. The exponential-series bound gives the classical exponential upper bound on a binomial coefficient.
Formal statement
Proof (Lean source)
-- @node: contraction_choose_le_exp_power
lemma contraction_choose_le_exp_power (n k : ℕ) (hk : 0 < k) :
(Nat.choose n k : ℝ) ≤ (exp 1 * n / k)^k := by
have hkR : (0 : ℝ) < k := by exact_mod_cast hk
have hf : (0 : ℝ) < k.factorial := by exact_mod_cast k.factorial_pos
have hexp := Real.pow_div_factorial_le_exp (k : ℝ) (show (0 : ℝ) ≤ k by positivity) k
have hfactor : (k : ℝ)^k / (k.factorial : ℝ) ≤ (exp 1)^k := by
simpa only [← Real.exp_nat_mul, mul_one] using hexp
calc
(Nat.choose n k : ℝ) ≤ (n : ℝ)^k / (k.factorial : ℝ) := Nat.choose_le_pow_div k n
_ = ((n : ℝ)/k)^k * ((k : ℝ)^k / (k.factorial : ℝ)) := by
rw [div_pow]
field_simp
_ ≤ ((n : ℝ)/k)^k * (exp 1)^k :=
mul_le_mul_of_nonneg_left hfactor (by positivity)
_ = (exp 1 * n / k)^k := by rw [← mul_pow]; congr 1; ring
Assume the stated hk condition. Taking square roots gives the factor appearing in the higher-order adaptive first-moment bound.
Formal statement
Proof (Lean source)
-- @node: contraction_sqrt_choose_le
lemma contraction_sqrt_choose_le (n k : ℕ) (hk : 0 < k) :
sqrt (choose n k) ≤ (sqrt (exp 1 * n / k))^k := by
have hbase : 0 ≤ exp 1 * (n : ℝ) / k := by positivity
have hs : ((sqrt (exp 1 * n / k))^k)^2 =
(exp 1 * (n : ℝ) / k)^k := by
rw [← pow_mul, Nat.mul_comm k 2, pow_mul, Real.sq_sqrt hbase]
have hchoose := contraction_choose_le_exp_power n k hk
have hsq := Real.sq_sqrt (show (0 : ℝ) ≤ choose n k by positivity)
nlinarith [Real.sqrt_nonneg (choose n k),
pow_nonneg (Real.sqrt_nonneg (exp 1 * (n : ℝ) / k)) k]
Assume positive dimension and a privacy budget in the interval from zero to one. Pure local privacy on the stated budget range bounds the coordinate score scale by epsilon divided by dimension.
Formal statement
Proof (Lean source)
-- @node: contraction_derivativeScale_le
lemma contraction_derivativeScale_le (d : ℕ) (hd : 0 < d) (eps : ℝ)
(heps : eps ∈ Ioc 0 1) : derivativeScale d eps ≤ eps / d := by
have hdR : (0 : ℝ) < d := by exact_mod_cast hd
have h := Real.abs_exp_sub_one_le (show |eps| ≤ 1 by
rw [abs_of_pos heps.1]; exact heps.2)
rw [abs_of_pos heps.1] at h
have hbound := (le_abs_self (exp eps - 1)).trans h
unfold derivativeScale
apply (div_le_div_iff₀ (by positivity : (0 : ℝ) < 2*d) hdR).mpr
nlinarith
theorem contraction_coefficient_geometric_le Lemma contraction_coefficient_geometric_le in the paper ↗
Assume positive dimension, the stated hk condition, a privacy budget in the interval from zero to one, and nonnegative amplitude. Equation (15): the binomial contraction coefficient is bounded by a geometric power of the resource-normalized amplitude.
Formal statement
Proof (Lean source)
-- @node: contraction_coefficient_geometric_le
lemma contraction_coefficient_geometric_le (n d k : ℕ) (hd : 0 < d)
(hk : 0 < k) (eps a : ℝ) (heps : eps ∈ Ioc 0 1) (ha : 0 ≤ a) :
(d : ℝ)*a^k*sqrt (choose n k)*(derivativeScale d eps)^k ≤
(d : ℝ)*(a*sqrt (exp 1*n/k)*(eps/d))^k := by
have hbeta : 0 ≤ derivativeScale d eps := by
unfold derivativeScale
exact div_nonneg (sub_nonneg.mpr (Real.one_le_exp_iff.mpr heps.1.le)) (by positivity)
calc
_ ≤ (d : ℝ)*a^k*(sqrt (exp 1*n/k))^k*(eps/d)^k := by
apply mul_le_mul
· exact mul_le_mul_of_nonneg_left (contraction_sqrt_choose_le n k hk) (by positivity)
· exact pow_le_pow_left₀ hbeta (contraction_derivativeScale_le d hd eps heps) k
· positivity
· positivity
_ = _ := by simp only [mul_pow]; ring
Assume the stated hz condition, the stated hw condition, the stated hk condition, a nonnegative bias bound, the stated hround condition, the stated hsq condition, and the stated hbudget condition. A rounded matching order turns a squared geometric coefficient bound into exponential decay in the resource logarithm.
Formal statement
Proof (Lean source)
-- @node: converse_geometric_base_decay
lemma converse_geometric_base_decay (L z w a B : ℝ) (k : ℕ)
(hz : 0 < z) (hw : 0 < w) (hk : 0 < k) (hB : 0 ≤ B)
(hround : 32*L ≤ (k : ℝ)*w)
(hsq : B^2 ≤ a^2*exp 1*L/((k : ℝ)*z))
(hbudget : a^2*exp 1*w*exp (w/2) ≤ 32*z) :
B ≤ exp (-w/4) := by
have hkR : (0 : ℝ) < k := by exact_mod_cast hk
have hE : 0 < exp (w/2) := Real.exp_pos _
have hm := mul_le_mul_of_nonneg_left hround
(show 0 ≤ a^2*exp 1*exp (w/2) by positivity)
have hb := mul_le_mul_of_nonneg_left hbudget hkR.le
have hnum : a^2*exp 1*L*exp (w/2) ≤ (k : ℝ)*z := by
nlinarith only [hm, hb]
have hratio : a^2*exp 1*L/((k : ℝ)*z) ≤ 1/exp (w/2) := by
apply (div_le_div_iff₀ (mul_pos hkR hz) hE).mpr
simpa using hnum
have hident : (exp (-w/4))^2 = 1/exp (w/2) := by
rw [← Real.exp_nat_mul, one_div, ← Real.exp_neg]
congr 1
push_cast
ring
have hfinal := hsq.trans hratio
rw [← hident] at hfinal
nlinarith [Real.exp_pos (-w/4)]
theorem converse_nondense_exponential_budget Lemma converse_nondense_exponential_budget in the paper ↗
Assume the stated hz condition. The logarithm in the nondense branch has the exponential budget needed for the fixed amplitude one hundredth.
Formal statement
Proof (Lean source)
-- @node: converse_nondense_exponential_budget
lemma converse_nondense_exponential_budget (z : ℝ) (hz : 1 ≤ z) :
(1/100 : ℝ)^2*exp 1*log (exp 1+z)*
exp (log (exp 1+z)/2) ≤ 32*z := by
let w := log (exp 1+z)
have hE : 0 < exp (w/2) := Real.exp_pos _
have hlog : exp w = exp 1+z := Real.exp_log (by positivity)
have hsq : (exp (w/2))^2 = exp 1+z := by
rw [← Real.exp_nat_mul]
convert hlog using 1 <;> congr 1 <;> push_cast <;> ring
have hlin : w ≤ 2*exp (w/2) := by
linarith [Real.add_one_le_exp (w/2)]
have hprod : w*exp (w/2) ≤ 8*z := by
have hm := mul_le_mul_of_nonneg_right hlin hE.le
nlinarith [Real.exp_one_lt_three]
have hwp : 0 ≤ w*exp (w/2) := by
apply mul_nonneg _ hE.le
exact (Real.log_nonneg (by linarith [Real.add_one_le_exp 1]))
change (1/100 : ℝ)^2*exp 1*w*exp (w/2) ≤ _
nlinarith [mul_le_mul_of_nonneg_right Real.exp_one_lt_three.le hwp]
theorem frontier_converse_geometric_base
Assume an admissible sample size, dimension, and privacy budget. At the prescribed public amplitude and matching order, the geometric coefficient has exponentially small base in each resource branch.
Formal statement
hypotheses
conclusion
z :
(d : ℝ)^2*logDim d/((n : ℝ)*eps^2)
k :
(frontierResources n d eps).converseDegree
Proof (Lean source)
-- @node: frontier_converse_geometric_base
lemma frontier_converse_geometric_base (n d : ℕ) (eps : ℝ)
(hAllowed : Allowed n d eps) :
let z := (d : ℝ)^2*logDim d/((n : ℝ)*eps^2)
let w := if z ≤ 1 then 1 else log (exp 1+z)
let k := (frontierResources n d eps).converseDegree
(frontierResources n d eps).converseAmp * sqrt (exp 1*n/k)*(eps/d) ≤
exp (-w/4) ∧ 32*logDim d ≤ (k : ℝ)*w := by
let L := logDim d
let t := (n : ℝ)*eps^2
let z := (d : ℝ)^2*L/t
let k := (frontierResources n d eps).converseDegree
let a := (frontierResources n d eps).converseAmp
let B := a*sqrt (exp 1*n/k)*(eps/d)
have hL : 0 < L := logDim_pos d hAllowed.2.1
have hn : (0 : ℝ) < n := by exact_mod_cast (by have := hAllowed.1; omega : 0 < n)
have hd : (0 : ℝ) < d := by exact_mod_cast (by have := hAllowed.2.1; omega : 0 < d)
have ht : 0 < t := mul_pos hn (sq_pos_of_pos hAllowed.2.2.1)
have hz : 0 < z := by dsimp [z]; positivity
have hk : 0 < k := by
have h := (frontier_converse_degree_domain n d eps hAllowed).1
dsimp [k]
omega
have hkR : (0 : ℝ) < k := by exact_mod_cast hk
have ha : 0 < a := (frontier_converse_amplitude_domain n d eps hAllowed).1
have heps : 0 < eps := hAllowed.2.2.1
have hB : 0 ≤ B := by dsimp [B]; positivity
have hsq : B^2 = a^2*exp 1*L/((k : ℝ)*z) := by
dsimp only [B]
rw [mul_pow, mul_pow, Real.sq_sqrt (by positivity), div_pow]
dsimp [z, t]
field_simp
change B ≤ exp (-(if z ≤ 1 then 1 else log (exp 1+z))/4) ∧
32*L ≤ (k : ℝ)*(if z ≤ 1 then 1 else log (exp 1+z))
by_cases hs : z ≤ 1
· have hak : a = (1/100 : ℝ)*sqrt z ∧ k = 2*⌈16*L⌉₊+1 := by
dsimp only [a, k, frontierResources]
simp only [z, t, L] at hs ⊢
simp only [if_pos hs, and_self]
have hround : 32*L ≤ (k : ℝ)*1 := by
rw [hak.2]
have hc := Nat.le_ceil (16*L)
push_cast
linarith
have hbudget : a^2*exp 1*1*exp (1/2) ≤ 32*z := by
rw [hak.1, mul_pow, Real.sq_sqrt hz.le]
have hhalf : exp ((1 : ℝ)/2) ≤ 3 :=
(Real.exp_le_exp.mpr (by norm_num)).trans Real.exp_one_lt_three.le
have hm := mul_le_mul Real.exp_one_lt_three.le hhalf
(Real.exp_pos _).le (by norm_num : (0 : ℝ) ≤ 3)
nlinarith
rw [if_pos hs]
exact ⟨converse_geometric_base_decay L z 1 a B k hz (by norm_num)
hk hB hround hsq.le hbudget, hround⟩
· let w := log (exp 1+z)
have hw : 0 < w := by
apply Real.log_pos
linarith [Real.add_one_le_exp 1]
have hak : a = (1/100 : ℝ) ∧ k = 2*⌈16*L/w⌉₊+1 := by
dsimp only [a, k, frontierResources]
simp only [z, t, L, w] at hs ⊢
simp only [if_neg hs, and_self]
have hround : 32*L ≤ (k : ℝ)*w := by
have hc := Nat.le_ceil (16*L/w)
have hm := (div_le_iff₀ hw).mp hc
rw [hak.2]
push_cast
nlinarith
have hbudget : a^2*exp 1*w*exp (w/2) ≤ 32*z := by
rw [hak.1]
exact converse_nondense_exponential_budget z (le_of_not_ge hs)
rw [if_neg hs]
exact ⟨converse_geometric_base_decay L z w a B k hz hw hk hB
hround hsq.le hbudget, hround⟩
theorem frontier_converse_geometric_small
Assume an admissible sample size, dimension, and privacy budget. The exact prescribed amplitude and rounded matching order make equation (15)'s geometric transcript bound at most one hundredth, in both branches.
Formal statement
hypotheses
conclusion
(d : ℝ)*((frontierResources n d eps).converseAmp * sqrt (exp 1*n/(frontierResources n d eps).converseDegree)*(eps/d))^ (frontierResources n d eps).converseDegree
≤ (1/100 : ℝ)
Proof (Lean source)
-- @node: frontier_converse_geometric_small
lemma frontier_converse_geometric_small (n d : ℕ) (eps : ℝ)
(hAllowed : Allowed n d eps) :
(d : ℝ)*((frontierResources n d eps).converseAmp *
sqrt (exp 1*n/(frontierResources n d eps).converseDegree)*(eps/d))^
(frontierResources n d eps).converseDegree ≤ (1/100 : ℝ) := by
let L := logDim d
let z := (d : ℝ)^2*L/((n : ℝ)*eps^2)
let w := if z ≤ 1 then 1 else log (exp 1+z)
let k := (frontierResources n d eps).converseDegree
let B := (frontierResources n d eps).converseAmp * sqrt (exp 1*n/k)*(eps/d)
obtain ⟨hbase, hround⟩ := frontier_converse_geometric_base n d eps hAllowed
change B ≤ exp (-w/4) at hbase
change 32*L ≤ (k : ℝ)*w at hround
have hd : (0 : ℝ) < d := by exact_mod_cast (by have := hAllowed.2.1; omega : 0 < d)
have heps := hAllowed.2.2.1
have ha := (frontier_converse_amplitude_domain n d eps hAllowed).1
have hB : 0 ≤ B := by dsimp [B]; positivity
have hp := pow_le_pow_left₀ hB hbase k
rw [← Real.exp_nat_mul] at hp
have hexp : exp ((k : ℝ)*(-w/4)) ≤ exp (-8*L) :=
Real.exp_le_exp.mpr (by linarith)
have hdim : (d : ℝ) ≤ exp L := by
have he : 1 ≤ exp 1 := Real.one_le_exp_iff.mpr (by norm_num)
have hlog : exp L = exp 1*d := Real.exp_log (by positivity)
rw [hlog]
nlinarith
have hL : 1 ≤ L := (logDim_bounds d hAllowed.2.1).1
have hseven : 100 ≤ exp (7 : ℝ) := by
have htwo : (2 : ℝ) ≤ exp 1 := by linarith [Real.exp_one_gt_d9]
have hh := pow_le_pow_left₀ (by norm_num : (0 : ℝ) ≤ 2) htwo 7
rw [← Real.exp_nat_mul] at hh
norm_num at hh ⊢
linarith
change (d : ℝ)*B^k ≤ _
calc
_ ≤ (d : ℝ)*exp (-8*L) := mul_le_mul_of_nonneg_left (hp.trans hexp) hd.le
_ ≤ exp L*exp (-8*L) := mul_le_mul_of_nonneg_right hdim (Real.exp_pos _).le
_ = exp (-7*L) := by rw [← Real.exp_add]; congr 1; ring
_ ≤ exp (-7) := Real.exp_le_exp.mpr (by linarith)
_ ≤ 1/100 := by
rw [Real.exp_neg]
rw [← one_div]
exact one_div_le_one_div_of_le (by norm_num) hseven
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Frontier.ConverseResources 8 declarations The prescribed amplitude and rounded moment degree yield separation at the square-root frontier rate, in both resource branches including saturation.
Converse resource calibration
The prescribed amplitude and rounded moment degree yield separation at the square-root frontier rate, in both resource branches including saturation.
Assume the stated hx condition. Rounding the even approximation degree costs at most a factor thirty-four.
Formal statement
hypotheses
x :
ℝ
hx :
0 < x
conclusion
conclusion 1
0 < 2 * ⌈16*x⌉₊
conclusion 2
Even (2 * ⌈16*x⌉₊)
conclusion 3
(2 * ⌈16*x⌉₊ : ℕ) ≤ 34 * max 1 x
Proof (Lean source)
-- @node: converse_even_degree_bound
lemma converse_even_degree_bound (x : ℝ) (hx : 0 < x) :
0 < 2 * ⌈16*x⌉₊ ∧ Even (2 * ⌈16*x⌉₊) ∧
(2 * ⌈16*x⌉₊ : ℕ) ≤ 34 * max 1 x := by
have hceil := Nat.le_ceil (16*x)
have hceilpos : 0 < ⌈16*x⌉₊ := by
by_contra h
have hz : ⌈16*x⌉₊ = 0 := by omega
rw [hz] at hceil
norm_num at hceil
linarith
refine ⟨by omega, ⟨⌈16*x⌉₊, by omega⟩, ?_⟩
have hround := Nat.ceil_lt_add_one (show 0 ≤ 16*x by positivity)
push_cast
have hm1 : 1 ≤ max 1 x := le_max_left _ _
have hmx : x ≤ max 1 x := le_max_right _ _
linarith
theorem frontier_converse_amplitude_domain
Assume an admissible sample size, dimension, and privacy budget. The public amplitude is positive and remains inside the paired parameter cube.
Formal statement
hypotheses
conclusion
(frontierResources n d eps).converseAmp ∈ Ioc 0 (1/2 : ℝ)
Proof (Lean source)
-- @node: frontier_converse_amplitude_domain
lemma frontier_converse_amplitude_domain (n d : ℕ) (eps : ℝ)
(hAllowed : Allowed n d eps) :
(frontierResources n d eps).converseAmp ∈ Ioc 0 (1/2 : ℝ) := by
have hL := logDim_pos d hAllowed.2.1
have hn : (0 : ℝ) < n := by exact_mod_cast (by have := hAllowed.1; omega : 0 < n)
have ht : 0 < (n : ℝ)*eps^2 := mul_pos hn (sq_pos_of_pos hAllowed.2.2.1)
have hd : (0 : ℝ) < d := by exact_mod_cast (by have := hAllowed.2.1; omega : 0 < d)
have hz : 0 < (d : ℝ)^2 * logDim d / (n*eps^2) := by positivity
change (if (d : ℝ)^2 * logDim d / (n*eps^2) ≤ 1 then
(1/100 : ℝ)*sqrt ((d : ℝ)^2 * logDim d / (n*eps^2)) else 1/100) ∈ _
split_ifs with hsmall
· have hs := Real.sqrt_pos.mpr hz
have hu : sqrt ((d : ℝ)^2 * logDim d / (n*eps^2)) ≤ 1 := by
exact (Real.sqrt_le_one).mpr hsmall
constructor
· positivity
· linarith
· constructor <;> norm_num
theorem frontier_converse_degree_domain
Assume an admissible sample size, dimension, and privacy budget. The chosen approximation degree is a positive even number, before adding one to obtain the matching order in the contraction theorem.
Formal statement
hypotheses
conclusion
conclusion 1
0 < (frontierResources n d eps).converseDegree - 1
conclusion 2
Even ((frontierResources n d eps).converseDegree - 1)
Proof (Lean source)
-- @node: frontier_converse_degree_domain
lemma frontier_converse_degree_domain (n d : ℕ) (eps : ℝ)
(hAllowed : Allowed n d eps) :
0 < (frontierResources n d eps).converseDegree - 1 ∧
Even ((frontierResources n d eps).converseDegree - 1) := by
have hL := logDim_pos d hAllowed.2.1
have hn : (0 : ℝ) < n := by exact_mod_cast (by have := hAllowed.1; omega : 0 < n)
have ht : 0 < (n : ℝ)*eps^2 := mul_pos hn (sq_pos_of_pos hAllowed.2.2.1)
have hz : 0 ≤ (d : ℝ)^2 * logDim d / (n*eps^2) := by positivity
have hw : 0 < log (exp 1 + (d : ℝ)^2 * logDim d / (n*eps^2)) := by
have he := Real.one_lt_exp_iff.mpr (show (0 : ℝ) < 1 by norm_num)
apply Real.log_pos
linarith
dsimp only [frontierResources]
split_ifs
· have h := converse_even_degree_bound (logDim d) hL
have hp := intro h.1 h.2.1
simpa only [Nat.add_sub_cancel] using hp
· have h := converse_even_degree_bound
(logDim d/log (exp 1+(d : ℝ)^2*logDim d/(n*eps^2))) (div_pos hL hw)
have hp := intro h.1 h.2.1
simpa only [Nat.add_sub_cancel, mul_div_assoc] using hp
Assume the stated hx condition, the stated hr0 condition, the stated hr1 condition, and the stated hrx condition. A normalized rate factor cancels the reciprocal resource scale in the rounded degree.
Formal statement
hypotheses
x r :
ℝ
hx :
0 < x
hr0 :
0 ≤ r
hr1 :
r ≤ 1
hrx :
r * x ≤ 1
conclusion
r * (2 * ⌈16*x⌉₊ : ℕ) ≤ 34
Proof (Lean source)
-- @node: converse_even_degree_normalized
lemma converse_even_degree_normalized (x r : ℝ) (hx : 0 < x)
(hr0 : 0 ≤ r) (hr1 : r ≤ 1) (hrx : r * x ≤ 1) :
r * (2 * ⌈16*x⌉₊ : ℕ) ≤ 34 := by
have hround := Nat.ceil_lt_add_one (show 0 ≤ 16*x by positivity)
have hm := mul_le_mul_of_nonneg_left hround.le hr0
push_cast
nlinarith
theorem frontier_converse_gap_rate
Assume an admissible sample size, dimension, and privacy budget. The prescribed amplitude divided by the approximation degree dominates one thirty-four-hundredth of the square-root frontier rate.
Formal statement
hypotheses
conclusion
(1/3400 : ℝ) * rateH .SI n d eps
≤ (frontierResources n d eps).converseAmp / (((frontierResources n d eps).converseDegree - 1 : ℕ) : ℝ)
Proof (Lean source)
-- @node: frontier_converse_gap_rate
lemma frontier_converse_gap_rate (n d : ℕ) (eps : ℝ)
(hAllowed : Allowed n d eps) :
(1/3400 : ℝ) * rateH .SI n d eps ≤
(frontierResources n d eps).converseAmp /
(((frontierResources n d eps).converseDegree - 1 : ℕ) : ℝ) := by
let L := logDim d
let t := (n : ℝ)*eps^2
let z := (d : ℝ)^2*L/t
let w := log (exp 1+z)
have hL : 0 < L := logDim_pos d hAllowed.2.1
have hL1 : 1 ≤ L := (logDim_bounds d hAllowed.2.1).1
have hn : (0 : ℝ) < n := by exact_mod_cast (by have := hAllowed.1; omega : 0 < n)
have ht : 0 < t := mul_pos hn (sq_pos_of_pos hAllowed.2.2.1)
have hd : (0 : ℝ) < d := by exact_mod_cast (by have := hAllowed.2.1; omega : 0 < d)
have hz : 0 < z := by dsimp [z]; positivity
have hw : 0 < w := by
have he := Real.one_lt_exp_iff.mpr (show (0 : ℝ) < 1 by norm_num)
apply Real.log_pos
linarith
have hdegree : (0 : ℝ) < ((frontierResources n d eps).converseDegree - 1 : ℕ) :=
by exact_mod_cast (frontier_converse_degree_domain n d eps hAllowed).1
apply (le_div_iff₀ hdegree).mpr
by_cases hsmall : z ≤ 1
· have hbranch : (d : ℝ)^2*L ≤ t := (div_le_one ht).mp hsmall
have hrate : rateH .SI n d eps = sqrt z/L := by
unfold rateH rateR rho
rw [if_pos hbranch]
have heq : (d : ℝ)^2/(t*L) = z/L^2 := by dsimp [z]; field_simp
change sqrt ((d : ℝ)^2/(t*L)) = _
rw [heq, Real.sqrt_div hz.le, Real.sqrt_sq hL.le]
have hbound := (converse_even_degree_bound L hL).2.2
rw [max_eq_right hL1] at hbound
have hm := mul_le_mul_of_nonneg_left hbound (div_nonneg (Real.sqrt_nonneg z) hL.le)
have heq : (sqrt z/L)*(34*L) = 34*sqrt z := by field_simp
rw [heq] at hm
have hamp : (frontierResources n d eps).converseAmp = (1/100 : ℝ)*sqrt z := by
dsimp only [frontierResources]
exact if_pos hsmall
have hdeg : (frontierResources n d eps).converseDegree - 1 = 2*⌈16*L⌉₊ := by
dsimp only [frontierResources]
rw [if_pos hsmall, Nat.add_sub_cancel]
rw [hrate, hamp, hdeg]
nlinarith
· have hbranch : ¬ (d : ℝ)^2*L ≤ t := by
intro h
exact hsmall ((div_le_one ht).mpr h)
let r := min 1 (w/L)
have hr0 : 0 ≤ r := le_min (by norm_num) (div_pos hw hL).le
have hr1 : r ≤ 1 := min_le_left _ _
have hrx : r*(L/w) ≤ 1 := by
have h := mul_le_mul_of_nonneg_right (min_le_right 1 (w/L)) (div_pos hL hw).le
have heq : (w/L)*(L/w) = 1 := by field_simp
rwa [heq] at h
have hbound := converse_even_degree_normalized (L/w) r (div_pos hL hw) hr0 hr1 hrx
have hrate : rateH .SI n d eps = r := by
unfold rateH rateR rho
rw [if_neg hbranch]
change sqrt (r^2) = r
exact Real.sqrt_sq hr0
have hamp : (frontierResources n d eps).converseAmp = (1/100 : ℝ) := by
dsimp only [frontierResources]
exact if_neg hsmall
have hdeg : (frontierResources n d eps).converseDegree - 1 = 2*⌈16*(L/w)⌉₊ := by
dsimp only [frontierResources]
rw [if_neg hsmall, Nat.add_sub_cancel]
simp only [mul_div_assoc, L, w, z, t]
rw [hrate, hamp, hdeg]
nlinarith
theorem frontier_converse_degree_log_bound
Assume an admissible sample size, dimension, and privacy budget. In either resource branch, the positive even approximation degree is at most thirty-four times the logarithmic dimension, uniformly in sample size and privacy.
Formal statement
hypotheses
conclusion
(((frontierResources n d eps).converseDegree - 1 : ℕ) : ℝ) ≤ 34 * logDim d
Proof (Lean source)
-- @node: frontier_converse_degree_log_bound
lemma frontier_converse_degree_log_bound (n d : ℕ) (eps : ℝ)
(hAllowed : Allowed n d eps) :
(((frontierResources n d eps).converseDegree - 1 : ℕ) : ℝ) ≤ 34 * logDim d := by
have hL := logDim_pos d hAllowed.2.1
have hL1 := (logDim_bounds d hAllowed.2.1).1
have hn : (0 : ℝ) < n := by exact_mod_cast (by have := hAllowed.1; omega : 0 < n)
have ht : 0 < (n : ℝ)*eps^2 := mul_pos hn (sq_pos_of_pos hAllowed.2.2.1)
have hz : 0 ≤ (d : ℝ)^2 * logDim d / (n*eps^2) := by positivity
have hw : 1 ≤ log (exp 1 + (d : ℝ)^2*logDim d/(n*eps^2)) := by
calc
1 = log (exp 1) := (Real.log_exp 1).symm
_ ≤ _ := Real.log_le_log (Real.exp_pos _) (by linarith)
dsimp only [frontierResources]
split_ifs
· simpa only [Nat.add_sub_cancel, max_eq_right hL1] using
(converse_even_degree_bound (logDim d) hL).2.2
· have hwpos : 0 < log (exp 1 + (d : ℝ)^2*logDim d/(n*eps^2)) :=
lt_of_lt_of_le (by norm_num) hw
have hx : logDim d / log (exp 1 + (d : ℝ)^2*logDim d/(n*eps^2)) ≤
logDim d := (div_le_iff₀ hwpos).mpr (by nlinarith)
have hm : max 1 (logDim d /
log (exp 1 + (d : ℝ)^2*logDim d/(n*eps^2))) ≤ logDim d :=
max_le hL1 hx
have hb := (converse_even_degree_bound _ (div_pos hL hwpos)).2.2
simp only [Nat.add_sub_cancel, mul_div_assoc] at *
exact hb.trans (mul_le_mul_of_nonneg_left hm (by norm_num))
Squared logarithmic dimension divided by dimension vanishes, giving a universal cutoff for concentration of the prescribed product priors.
Proof (Lean source)
-- @node: logDim_sq_div_tendsto_zero
lemma logDim_sq_div_tendsto_zero :
Tendsto (fun d : ℕ => (logDim d)^2 / (d : ℝ))
atTop (nhds 0) := by
have h := (Real.tendsto_pow_log_div_mul_add_atTop
(exp 1)⁻¹ 0 2 (by positivity)).comp
((tendsto_natCast_atTop_atTop (R := ℝ)).const_mul_atTop (Real.exp_pos 1))
simpa only [Function.comp_def, logDim, mul_assoc, inv_mul_cancel_left₀
(ne_of_gt (Real.exp_pos 1)), add_zero] using h
theorem frontier_converse_concentration_cutoff
Assume the stated hb condition. Once the dimension exceeds a constant depending only on the universal approximation constant, the prior escape bound is at most one hundredth, uniformly over every allowed resource tuple.
Formal statement
hypotheses
b :
ℝ
hb :
0 < b
conclusion
∃ D : ℕ,
2 ≤ D
conclusion 1
16 * (((frontierResources n d eps).converseDegree - 1 : ℕ) : ℝ)^2 / (b^2*d) ≤ (1/100 : ℝ)
Proof (Lean source)
-- @node: frontier_converse_concentration_cutoff
lemma frontier_converse_concentration_cutoff (b : ℝ) (hb : 0 < b) :
∃ D : ℕ, 2 ≤ D ∧ ∀ n d eps, Allowed n d eps → D < d →
16 * (((frontierResources n d eps).converseDegree - 1 : ℕ) : ℝ)^2 /
(b^2*d) ≤ (1/100 : ℝ) := by
have hlim := logDim_sq_div_tendsto_zero.const_mul (16*34^2/b^2)
simp only [mul_zero] at hlim
have hsmall := hlim.eventually_lt_const (show (0 : ℝ) < 1/100 by norm_num)
obtain ⟨D, hD⟩ := Filter.eventually_atTop.mp hsmall
refine ⟨max 2 D, le_max_left _ _, ?_⟩
intro n d eps hAllowed hdim
have hd : (0 : ℝ) < d := by exact_mod_cast (by have := hAllowed.2.1; omega : 0 < d)
have hdegree := frontier_converse_degree_log_bound n d eps hAllowed
have hsq := pow_le_pow_left₀ (by positivity :
(0 : ℝ) ≤ (((frontierResources n d eps).converseDegree - 1 : ℕ) : ℝ)) hdegree 2
have htail := hD d (by omega)
calc
_ ≤ 16 * (34*logDim d)^2 / (b^2*d) :=
div_le_div_of_nonneg_right (mul_le_mul_of_nonneg_left hsq (by norm_num))
(by positivity)
_ = (16*34^2/b^2) * ((logDim d)^2/(d : ℝ)) := by ring
_ ≤ 1/100 := by simpa using htail.le
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Frontier.GlobalResources 6 declarations The selected even degree has the roadmap's rounding bounds and fits in the finite evaluation block.
Intermediate global-polynomial resources
The selected even degree has the roadmap's rounding bounds and fits in the finite evaluation block. Its exponential variance and approximation error are compared with the nonsaturated intermediate rate.
Assume dimension at least two. The noise logarithm is at least one.
Formal statement
hypotheses
n d :
ℕ
eps :
ℝ
hd :
2 ≤ d
conclusion
Proof (Lean source)
-- @node: frontier_noise_log_one
lemma frontier_noise_log_one (n d : ℕ) (eps : ℝ) (hd : 2 ≤ d) :
1 ≤ log (exp 1 + sigmaSquared d (n / 3) eps * logDim d) := by
have hs : 0 ≤ sigmaSquared d (n / 3) eps := by unfold sigmaSquared; positivity
have hL := (logDim_pos d hd).le
simpa using Real.log_le_log (Real.exp_pos 1)
(show exp 1 ≤ exp 1 + sigmaSquared d (n / 3) eps * logDim d by
nlinarith [mul_nonneg hs hL])
theorem frontier_global_rounding
Assume an admissible sample size, dimension, and privacy budget, the stated hn condition, the stated l condition, the stated hdense condition, and the stated hf condition. Intermediate resources that avoid the fallback select the global branch and an even degree between half and all of the unrounded budget.
Formal statement
hypotheses
n d :
ℕ
eps :
ℝ
hAllowed :
Allowed n d eps
hn :
n ≠ 2
hL :
4096 ≤ logDim d
hdense :
¬ (d : ℝ)^2 * logDim d ≤ (n : ℝ) * eps^2
hf :
(frontierResources n d eps).branch ≠ .fallbackQuarter
conclusion
conclusion 1
(frontierResources n d eps).branch = .globalPoly
conclusion 2
Even (frontierResources n d eps).degree
conclusion 3
2 ≤ (frontierResources n d eps).degree
conclusion 4
((frontierResources n d eps).degree : ℝ)
conclusion 5
≤ (frontierResources n d eps).degree
Proof (Lean source)
-- @node: frontier_global_rounding
lemma frontier_global_rounding (n d : ℕ) (eps : ℝ)
(hAllowed : Allowed n d eps) (hn : n ≠ 2) (hL : 4096 ≤ logDim d)
(hdense : ¬ (d : ℝ)^2 * logDim d ≤ (n : ℝ) * eps^2)
(hf : (frontierResources n d eps).branch ≠ .fallbackQuarter) :
(frontierResources n d eps).branch = .globalPoly ∧
Even (frontierResources n d eps).degree ∧
2 ≤ (frontierResources n d eps).degree ∧
((frontierResources n d eps).degree : ℝ) ≤ logDim d /
(1024 * log (exp 1 + sigmaSquared d (n / 3) eps * logDim d)) ∧
logDim d / (2048 * log (exp 1 + sigmaSquared d (n / 3) eps * logDim d)) ≤
(frontierResources n d eps).degree := by
let H := log (exp 1 + sigmaSquared d (n / 3) eps * logDim d)
have hH : 0 < H := lt_of_lt_of_le (by norm_num) (frontier_noise_log_one n d eps hAllowed.2.1)
have hsmall : ¬ logDim d < 4096 := not_lt.mpr hL
have hf' : ¬ logDim d / (1024 * H) < 4 := by
intro h
apply hf
simp [frontierResources, hn, hsmall, hdense, H, h]
have hx : 2 ≤ logDim d / (2048 * H) := by
have := le_of_not_gt hf'
have heq : logDim d / (1024 * H) = 2 * (logDim d / (2048 * H)) := by ring
linarith
have hdeg : (frontierResources n d eps).degree = 2 * ⌊logDim d / (2048 * H)⌋₊ := by
simp [frontierResources, hdense, H]
have hfloor := Nat.floor_le (show 0 ≤ logDim d / (2048 * H) by linarith)
have hsucc := Nat.lt_floor_add_one (logDim d / (2048 * H))
have hnat : 2 ≤ ⌊logDim d / (2048 * H)⌋₊ := Nat.le_floor hx
refine ⟨by simp [frontierResources, hn, hsmall, hdense, H, hf'], ?_, ?_, ?_, ?_⟩
· rw [hdeg]; exact even_two_mul _
· rw [hdeg]; omega
· rw [hdeg]; push_cast
change 2 * (⌊logDim d / (2048 * H)⌋₊ : ℝ) ≤ logDim d / (1024 * H)
have heq : logDim d / (1024 * H) = 2 * (logDim d / (2048 * H)) := by ring
rw [heq]; linarith
· rw [hdeg]; push_cast
have hnatR : (2 : ℝ) ≤ ⌊logDim d / (2048 * H)⌋₊ := by exact_mod_cast hnat
change logDim d / (2048 * H) ≤ 2 * (⌊logDim d / (2048 * H)⌋₊ : ℝ)
linarith
Assume a positive privacy budget. The vector noise is at least the dimension squared divided by block size, since the randomized-response signal is below one.
Formal statement
hypotheses
n d :
ℕ
eps :
ℝ
heps :
0 < eps
conclusion
(d : ℝ)^2 / (n / 3 : ℕ) ≤ sigmaSquared d (n / 3) eps
Proof (Lean source)
-- @node: frontier_sigmaSquared_lower_block
lemma frontier_sigmaSquared_lower_block (n d : ℕ) (eps : ℝ)
(heps : 0 < eps) :
(d : ℝ)^2 / (n / 3 : ℕ) ≤ sigmaSquared d (n / 3) eps := by
have hdelta := privacyDelta_bounds eps heps.le
have hpos : 0 < privacyDelta eps := by
rw [privacyDelta_exp_formula]
exact div_pos (sub_pos.mpr (Real.one_lt_exp_iff.mpr heps)) (by positivity)
have hscale : (d : ℝ) ≤ noiseScale d eps := by
unfold noiseScale
apply (le_div_iff₀ hpos).mpr
nlinarith [show (0 : ℝ) ≤ d from Nat.cast_nonneg d]
unfold sigmaSquared
apply div_le_div_of_nonneg_right _ (Nat.cast_nonneg _)
exact pow_le_pow_left₀ (Nat.cast_nonneg _) hscale 2
theorem frontier_global_moment_fit
Assume an admissible sample size, dimension, and privacy budget, the stated hn condition, the stated d condition, and the stated degree condition. The selected global degree fits its distinct-person moments in the block. An undersized block would make the noise logarithm at least the dimension logarithm, contradicting the nonfallback degree budget.
Formal statement
hypotheses
n d :
ℕ
eps :
ℝ
hAllowed :
Allowed n d eps
hn :
n ≠ 2
hD :
2 ≤ (frontierResources n d eps).degree
hDegree :
((frontierResources n d eps).degree : ℝ)
conclusion
2 * (frontierResources n d eps).degree ≤ n / 3
Proof (Lean source)
-- @node: frontier_global_moment_fit
lemma frontier_global_moment_fit (n d : ℕ) (eps : ℝ)
(hAllowed : Allowed n d eps) (hn : n ≠ 2)
(hD : 2 ≤ (frontierResources n d eps).degree)
(hDegree : ((frontierResources n d eps).degree : ℝ) ≤ logDim d /
(1024 * log (exp 1 + sigmaSquared d (n / 3) eps * logDim d))) :
2 * (frontierResources n d eps).degree ≤ n / 3 := by
let H := log (exp 1 + sigmaSquared d (n / 3) eps * logDim d)
have hHone : 1 ≤ H := frontier_noise_log_one n d eps hAllowed.2.1
have hHp : 0 < H := by linarith
have hLp := logDim_pos d hAllowed.2.1
have hm : 0 < n / 3 := by have := hAllowed.1; omega
have hmR : (0 : ℝ) < (n / 3 : ℕ) := by exact_mod_cast hm
have hdR : (2 : ℝ) ≤ d := by exact_mod_cast hAllowed.2.1
have hDp : (2 : ℝ) ≤ (frontierResources n d eps).degree := by exact_mod_cast hD
have hbudget : ((frontierResources n d eps).degree : ℝ) * (1024 * H) ≤ logDim d :=
(le_div_iff₀ (by positivity)).mp hDegree
by_contra hfit
have hmSmall : (n / 3 : ℕ) < 2 * (frontierResources n d eps).degree := by omega
have hmSmallR : ((n / 3 : ℕ) : ℝ) < 2 * (frontierResources n d eps).degree := by
exact_mod_cast hmSmall
have hmL : (n / 3 : ℕ) < logDim d / 512 := by
nlinarith [mul_le_mul_of_nonneg_left hHone
(show 0 ≤ ((frontierResources n d eps).degree : ℝ) by positivity)]
have hs := frontier_sigmaSquared_lower_block n d eps hAllowed.2.2.1
have hsprod : (d : ℝ)^2 ≤ sigmaSquared d (n / 3) eps * (n / 3 : ℕ) :=
(div_le_iff₀ hmR).mp hs
have hs0 : 0 ≤ sigmaSquared d (n / 3) eps := by unfold sigmaSquared; positivity
have hnoise : exp 1 * d ≤ exp 1 + sigmaSquared d (n / 3) eps * logDim d := by
have he := Real.exp_one_lt_d9
have hmul := mul_le_mul_of_nonneg_left (le_of_lt hmL) hs0
nlinarith
have hLH : logDim d ≤ H := by
unfold logDim
exact Real.log_le_log (by positivity) hnoise
nlinarith
theorem frontier_nonsaturated_baseline_comparison
Assume an admissible sample size, dimension, and privacy budget and the protocol-class label. Below saturation, the elementary parametric comparison absorbs baseline noise without imposing any new estimator assumptions.
Formal statement
Proof (Lean source)
-- @node: frontier_nonsaturated_baseline_comparison
lemma frontier_nonsaturated_baseline_comparison (n d : ℕ) (eps : ℝ)
(hAllowed : Allowed n d eps) (hs : rateR .NI n d eps ≠ 1) :
1 / ((n : ℝ) * eps^2) ≤ rateR .NI n d eps := by
have hnp : (0 : ℝ) < n := by exact_mod_cast (by have := hAllowed.1; omega : 0 < n)
have ht := mul_pos hnp (sq_pos_of_pos hAllowed.2.2.1)
have hr : rateR .NI n d eps ≤ 1 := rho_le_one d _ hAllowed.2.1 ht
have hl := (rho_elementary_comparisons n d eps hAllowed).1
have hi : 1 / ((n : ℝ) * eps^2) < 1 := by
by_contra h
have he : min 1 (1 / ((n : ℝ) * eps^2)) = 1 := min_eq_left (le_of_not_gt h)
rw [he] at hl
exact hs (le_antisymm hr hl)
simpa only [min_eq_right hi.le, rateR] using hl
theorem frontier_global_resource_bound
Assume an admissible sample size, dimension, and privacy budget, the stated hn condition, the stated l condition, the stated hdense condition, the protocol-class label, the stated degree condition, and the stated lower condition. The global polynomial variance and approximation bias have intermediate rate order. This uses the rounded degree, the eighty-fold noise comparison, and the established exponential dimension bound.
Formal statement
hypotheses
n d :
ℕ
eps :
ℝ
hAllowed :
Allowed n d eps
hn :
n ≠ 2
hL :
4096 ≤ logDim d
hdense :
¬ (d : ℝ)^2 * logDim d ≤ (n : ℝ) * eps^2
hs :
rateR .NI n d eps ≠ 1
hDegree :
((frontierResources n d eps).degree : ℝ)
hLower :
≤ (frontierResources n d eps).degree
conclusion
24 / ((n : ℝ) * eps^2)
+ (1/2 : ℝ) * (exp (9*(frontierResources n d eps).degree * log (exp 1 + sigmaSquared d (n / 3) eps * logDim d))/(2*d) + (1/((frontierResources n d eps).degree+1 : ℝ))^2)
≤ (10 : ℝ)^16 * rateR .NI n d eps
Proof (Lean source)
-- @node: frontier_global_resource_bound
lemma frontier_global_resource_bound (n d : ℕ) (eps : ℝ)
(hAllowed : Allowed n d eps) (hn : n ≠ 2) (hL : 4096 ≤ logDim d)
(hdense : ¬ (d : ℝ)^2 * logDim d ≤ (n : ℝ) * eps^2)
(hs : rateR .NI n d eps ≠ 1)
(hDegree : ((frontierResources n d eps).degree : ℝ) ≤ logDim d /
(1024 * log (exp 1 + sigmaSquared d (n / 3) eps * logDim d)))
(hLower : logDim d /
(2048 * log (exp 1 + sigmaSquared d (n / 3) eps * logDim d)) ≤
(frontierResources n d eps).degree) :
24 / ((n : ℝ) * eps^2) + (1/2 : ℝ) *
(exp (9*(frontierResources n d eps).degree *
log (exp 1 + sigmaSquared d (n / 3) eps * logDim d))/(2*d) +
(1/((frontierResources n d eps).degree+1 : ℝ))^2) ≤
(10 : ℝ)^16 * rateR .NI n d eps := by
let L := logDim d
let H := log (exp 1 + sigmaSquared d (n / 3) eps * L)
let z := (d : ℝ)^2 * L / ((n : ℝ) * eps^2)
let w := log (exp 1 + z)
let D := (frontierResources n d eps).degree
have hLp : 0 < L := logDim_pos d hAllowed.2.1
have hHp : 0 < H := lt_of_lt_of_le (by norm_num)
(frontier_noise_log_one n d eps hAllowed.2.1)
have hz : 0 ≤ z := by dsimp [z]; positivity
have hw : 1 ≤ w := by
dsimp [w]
simpa using Real.log_le_log (Real.exp_pos 1)
(show exp 1 ≤ exp 1 + z by linarith)
have hs0 : 0 ≤ sigmaSquared d (n / 3) eps := by unfold sigmaSquared; positivity
have hnoise : sigmaSquared d (n / 3) eps * L ≤ 80 * z := by
have hh := mul_le_mul_of_nonneg_right (frontier_sigmaSquared_upper n d eps hAllowed hn) hLp.le
dsimp [z]
convert hh using 1 <;> first | rfl | ring
have hH : H ≤ 6 * w := frontier_noise_log_upper L z _ hLp.le hz hs0 hnoise
have hr : rateR .NI n d eps = (w/L)^2 := by
have hm : w / L < 1 := by
by_contra h
apply hs
change rho ((n : ℝ) * eps^2) d = 1
rw [rho, if_neg hdense]
change (min 1 (w/L))^2 = 1
rw [min_eq_left (le_of_not_gt h)]; norm_num
change rho ((n : ℝ) * eps^2) d = _
rw [rho, if_neg hdense]
change (min 1 (w/L))^2 = _
rw [min_eq_right hm.le]
have hbudget : (D : ℝ) * (1024 * H) ≤ L :=
(le_div_iff₀ (by positivity)).mp hDegree
have hvariance : exp (9*(D : ℝ)*H)/(2*d) ≤ 2/L^2 := by
have hexp : exp (9*(D : ℝ)*H) ≤ exp (L/100) := by
apply Real.exp_le_exp.mpr
have hD0 : (0 : ℝ) ≤ D := Nat.cast_nonneg _
nlinarith
have hdim := hybrid_dimension_exp_bound (by have := hAllowed.2.1; omega) hL
have hdR : (0 : ℝ) < d := by exact_mod_cast (by have := hAllowed.2.1; omega : 0 < d)
calc
_ ≤ exp (L/100)/(2*d) := div_le_div_of_nonneg_right hexp (by positivity)
_ ≤ _ := by
apply (div_le_div_iff₀ (by positivity) (sq_pos_of_pos hLp)).mpr
dsimp [L] at *
nlinarith [hdim]
have hinv : 1/((D : ℝ)+1) ≤ 2048*H/L := by
have hlower : L ≤ (D : ℝ) * (2048 * H) :=
(div_le_iff₀ (by positivity)).mp hLower
apply (div_le_div_iff₀ (by positivity) hLp).mpr
nlinarith
have hbias : (1/((D : ℝ)+1))^2 ≤ (12288 * (w/L))^2 := by
have hratio : 2048*H/L ≤ 12288*(w/L) := by
apply (div_le_iff₀ hLp).mpr
have heq : (12288*(w/L))*L = 12288*w := by field_simp
rw [heq]; linarith
exact pow_le_pow_left₀ (by positivity) (hinv.trans hratio) 2
have hvarianceRate : 2/L^2 ≤ 2 * rateR .NI n d eps := by
rw [hr]
have hratio : 1/L ≤ w/L := div_le_div_of_nonneg_right hw hLp.le
have hsq := pow_le_pow_left₀ (by positivity : 0 ≤ 1/L) hratio 2
have heq : 2/L^2 = 2*(1/L)^2 := by ring
rw [heq]; linarith
have hbase := frontier_nonsaturated_baseline_comparison n d eps hAllowed hs
have hr0 : 0 ≤ rateR .NI n d eps := by rw [hr]; positivity
change 24 / ((n : ℝ) * eps^2) + (1/2 : ℝ) *
(exp (9*(D : ℝ)*H)/(2*d) + (1/((D : ℝ)+1))^2) ≤ _
have hbiasRate : (1/((D : ℝ)+1))^2 ≤ 150994944 * rateR .NI n d eps := by
rw [hr]; nlinarith [hbias]
have hbase24 : 24 / ((n : ℝ) * eps^2) ≤ 24 * rateR .NI n d eps := by
convert mul_le_mul_of_nonneg_left hbase (by norm_num : (0 : ℝ) ≤ 24) using 1 <;> first | rfl | ring
nlinarith [hvariance.trans hvarianceRate]
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Frontier.Lower 15 declarations Finite original-record private value frontiers: Helpers/Frontier/Lower.
Helpers/Frontier/Lower
Finite original-record private value frontiers: Helpers/Frontier/Lower.
theorem bestAbsApproxError_eq_library
The paper's indexed infimum agrees with the library's best uniform error.
Formal statement
Proof (Lean source)
-- @node: bestAbsApproxError_eq_library
lemma bestAbsApproxError_eq_library (K : ℕ) :
bestAbsApproxError K =
bestUniformApproxErrorAbs K := by
unfold bestAbsApproxError
bestUniformApproxErrorAbs
change sInf (range (fun p : {p : Polynomial ℝ // p.natDegree ≤ K} =>
sSup ((fun x : ℝ => abs (p.1.eval x - abs x)) '' Icc (-1) 1))) = _
congr 1
ext e
constructor
· rintro ⟨p, rfl⟩
refine ⟨p.1, p.2, ?_⟩
simp only [uniformApproxErrorAbs,
symmUnitInterval, abs_sub_comm]
· rintro ⟨p, hp, rfl⟩
refine ⟨⟨p, hp⟩, ?_⟩
simp only [uniformApproxErrorAbs,
symmUnitInterval, abs_sub_comm]
Increasing the degree enlarges the candidate space and decreases the best error.
Formal statement
conclusion
Proof (Lean source)
-- @node: bestAbsApproxError_antitone
lemma bestAbsApproxError_antitone : Antitone bestAbsApproxError := by
intro K L hKL
rw [bestAbsApproxError_eq_library, bestAbsApproxError_eq_library]
exact bestUniformApproxErrorAbs_antitone hKL
theorem bernstein_uniform_positive_of_gate
Assume the Bernstein absolute-approximation limit. Positive universal absolute-approximation scale, including each finite even degree.
Formal statement
hypotheses
hBernstein_of_gate :
Proof (Lean source)
-- @node: bernstein_uniform_positive_of_gate
lemma bernstein_uniform_positive_of_gate (hBernstein_of_gate :
BernsteinAbsoluteApproximationLimit) :
∃ bStar : ℝ, 0 < bStar ∧ ∀ K : ℕ, 0 < K → Even K → bStar/K ≤ bestAbsApproxError K := by
obtain ⟨betaStar, hbeta, _hupper, hlimit⟩ := hBernstein_of_gate
have htail : ∀ᶠ k : ℕ in atTop,
(1/10 : ℝ) ≤ (2*k : ℝ) * bestAbsApproxError (2*k) :=
hlimit.eventually_const_le (by linarith)
obtain ⟨N0, hN0⟩ := Filter.eventually_atTop.mp htail
let N := max N0 1
have hN : 0 < N := by dsimp [N]; omega
have hcut := hN0 N (by dsimp [N]; omega)
have hcutpos : 0 < bestAbsApproxError (2*N) := by
have hNreal : (0 : ℝ) < N := by exact_mod_cast hN
by_contra h
have hmul : (2*N : ℝ) * bestAbsApproxError (2*N) ≤ 0 :=
mul_nonpos_of_nonneg_of_nonpos (by positivity) (le_of_not_gt h)
linarith
refine ⟨min (1/10) (bestAbsApproxError (2*N)), lt_min (by norm_num) hcutpos, ?_⟩
intro K hK hEven
have hKreal : (0 : ℝ) < K := by exact_mod_cast hK
rw [div_le_iff₀ hKreal]
obtain ⟨k, hk⟩ := hEven
have hKk : K = 2*k := by omega
by_cases hlarge : N ≤ k
· have hbound := hN0 k (by dsimp [N] at hlarge; omega)
rw [hKk]
exact (min_le_left _ _).trans (by simpa [mul_comm] using hbound)
· have hdegree : K ≤ 2*N := by omega
have hmono := bestAbsApproxError_antitone hdegree
have herrpos : 0 < bestAbsApproxError K := hcutpos.trans_le hmono
have hKone : (1 : ℝ) ≤ K := by exact_mod_cast hK
calc
min (1/10) (bestAbsApproxError (2*N)) ≤ bestAbsApproxError (2*N) := min_le_right _ _
_ ≤ bestAbsApproxError K := hmono
_ ≤ bestAbsApproxError K * K := le_mul_of_one_le_right herrpos.le hKone
Assume the stated hxi condition and the stated ha condition. Positive scaling transports a unit-interval probability to the amplitude interval.
Formal statement
hypotheses
conclusion
AmplitudePrior a (xi.map (fun x => a*x))
Proof (Lean source)
-- @node: amplitudePrior_map_scale
lemma amplitudePrior_map_scale (xi : Measure ℝ) [IsProbabilityMeasure xi]
(hxi : xi (Icc (-1 : ℝ) 1)ᶜ = 0) (a : ℝ) (ha : 0 < a) :
AmplitudePrior a (xi.map (fun x => a*x)) := by
have hscale : Measurable (fun x : ℝ => a*x) := by fun_prop
constructor
· exact Measure.isProbabilityMeasure_map hscale.aemeasurable
· rw [Measure.map_apply hscale (isClosed_Icc.measurableSet.compl)]
apply measure_mono_null _ hxi
intro x hx
simp only [Set.mem_preimage, Set.mem_compl_iff, Set.mem_Icc] at hx ⊢
intro hunit
apply hx
constructor <;> nlinarith [hunit.1, hunit.2]
Pushforward scaling multiplies the q-th raw moment by the q-th power of the scale.
Formal statement
hypotheses
conclusion
(∫ x, x^q ∂xi.map (fun x => a*x)) = a^q * ∫ x, x^q ∂xi
Proof (Lean source)
-- @node: integral_pow_map_scale
lemma integral_pow_map_scale (xi : Measure ℝ) (a : ℝ) (q : ℕ) :
(∫ x, x^q ∂xi.map (fun x => a*x)) = a^q * ∫ x, x^q ∂xi := by
rw [integral_map (by fun_prop) (by fun_prop)]
simp only [mul_pow]
exact integral_const_mul _ _
Assume nonnegative amplitude. Positive pushforward scaling multiplies the absolute moment by the scale.
Formal statement
hypotheses
conclusion
(∫ x, |x| ∂xi.map (fun x => a*x)) = a * ∫ x, |x| ∂xi
Proof (Lean source)
-- @node: integral_abs_map_scale
lemma integral_abs_map_scale (xi : Measure ℝ) (a : ℝ) (ha : 0 ≤ a) :
(∫ x, |x| ∂xi.map (fun x => a*x)) = a * ∫ x, |x| ∂xi := by
rw [integral_map (by fun_prop) (by fun_prop)]
simp only [abs_mul, abs_of_nonneg ha]
exact integral_const_mul _ _
Assume the Cai–Low moment-duality theorem, the stated privacy condition for the protocol, the stated even condition, and the stated ha condition. Scaled symmetric duality priors retain exact moment matching and target separation.
Formal statement
hypotheses
conclusion
∃ nu0 nu1 : Measure ℝ,
conclusion 1
AmplitudePrior a nu0
conclusion 2
AmplitudePrior a nu1
conclusion 3
MatchingMoments (K+1) nu0 nu1
conclusion 4
(∫ u, |u| ∂nu1) - (∫ u, |u| ∂nu0) = 2*a*bestAbsApproxError K
Proof (Lean source)
-- @node: scaled_dual_priors_of_gate
lemma scaled_dual_priors_of_gate (hDual_of_gate : CaiLowMomentDuality)
(K : ℕ) (hK : 0 < K) (hEven : Even K) (a : ℝ) (ha : 0 < a) :
∃ nu0 nu1 : Measure ℝ, AmplitudePrior a nu0 ∧ AmplitudePrior a nu1 ∧
MatchingMoments (K+1) nu0 nu1 ∧
(∫ u, |u| ∂nu1) - (∫ u, |u| ∂nu0) = 2*a*bestAbsApproxError K := by
obtain ⟨xi0, xi1, hprob0, hprob1, hsupp0, hsupp1, _hsym0, _hsym1, hmom, hgap⟩ :=
hDual_of_gate K hK hEven
let := hprob0
let := hprob1
refine ⟨xi0.map (fun x => a*x), xi1.map (fun x => a*x),
amplitudePrior_map_scale xi0 hsupp0 a ha,
amplitudePrior_map_scale xi1 hsupp1 a ha, ?_, ?_⟩
· intro q hq
rw [integral_pow_map_scale, integral_pow_map_scale, hmom q (by omega)]
· rw [integral_abs_map_scale xi1 a ha.le, integral_abs_map_scale xi0 a ha.le,
← mul_sub, hgap]
ring
theorem dual_product_priors_target_concentration_of_gate
Assume the Cai–Low moment-duality theorem and the Bernstein absolute-approximation limit. The scaled dual priors have separated half-norm means and both targets concentrate within one eighth of their actual mean gap. The escape bound is uniform in amplitude, as required before choosing the dimension cutoff.
Formal statement
hypotheses
hDual :
hBernstein :
conclusion
∃ b : ℝ,
0 < b
conclusion 1
d K :
ℕ
0 < d
0 < K
Even K
a :
ℝ
0 < a
∃ nu0 nu1 : Measure ℝ,
AmplitudePrior a nu0
AmplitudePrior a nu1
MatchingMoments (K+1) nu0 nu1
∃ gap : ℝ,
Proof (Lean source)
-- @node: dual_product_priors_target_concentration_of_gate
lemma dual_product_priors_target_concentration_of_gate
(hDual : CaiLowMomentDuality) (hBernstein : BernsteinAbsoluteApproximationLimit) :
∃ b : ℝ, 0 < b ∧ ∀ (d K : ℕ), 0 < d → 0 < K → Even K →
∀ a : ℝ, 0 < a →
∃ nu0 nu1 : Measure ℝ, AmplitudePrior a nu0 ∧ AmplitudePrior a nu1 ∧
MatchingMoments (K+1) nu0 nu1 ∧
∃ gap : ℝ, 0 < gap ∧ b*a/K ≤ gap ∧
(∫ theta, signedNorm theta/2 ∂productPrior d nu1) -
(∫ theta, signedNorm theta/2 ∂productPrior d nu0) = gap ∧
(∀ nu ∈ ({nu0, nu1} : Set (Measure ℝ)),
(productPrior d nu) {theta | gap/8 ≤
|signedNorm theta/2 - (∫ u, |u| ∂nu)/2|} ≤
ofReal (16*(K : ℝ)^2/(b^2*d))) := by
obtain ⟨b, hb, happrox⟩ := bernstein_uniform_positive_of_gate hBernstein
refine ⟨b, hb, ?_⟩
intro d K hd hK hEven a ha
obtain ⟨nu0, nu1, hnu0, hnu1, hmatch, hgap⟩ :=
scaled_dual_priors_of_gate hDual K hK hEven a ha
let gap := a * bestAbsApproxError K
have hKR : (0 : ℝ) < K := by exact_mod_cast hK
have hdR : (0 : ℝ) < d := by exact_mod_cast hd
have hlower : b*a/K ≤ gap := by
dsimp [gap]
have h := mul_le_mul_of_nonneg_left (happrox K hK hEven) ha.le
calc
b*a/K = a*(b/K) := by ring
_ ≤ a * bestAbsApproxError K := h
have hpos : 0 < gap := (by positivity : (0 : ℝ) < b*a/K).trans_le hlower
refine ⟨nu0, nu1, hnu0, hnu1, hmatch, gap, hpos, hlower, ?_, ?_⟩
· rw [productPrior_halfNorm_mean d hd a nu1 hnu1,
productPrior_halfNorm_mean d hd a nu0 hnu0]
have h := hgap
dsimp [gap]
linarith
· intro nu hnu
have hamp : AmplitudePrior a nu := by
rcases hnu with rfl | hnu
· exact hnu0
· have heq : nu = nu1 := Set.mem_singleton_iff.mp hnu
simpa [heq] using hnu1
refine (productPrior_halfNorm_gap_escape d hd a nu hamp gap hpos).trans
(ENNReal.ofReal_le_ofReal ?_)
have hmul : b*a ≤ gap*K := (div_le_iff₀ hKR).mp hlower
have hsq : (b*a)^2 ≤ (gap*K)^2 :=
pow_le_pow_left₀ (by positivity) hmul 2
apply (div_le_div_iff₀ (by positivity : (0 : ℝ) < d*gap^2)
(by positivity : (0 : ℝ) < b^2*d)).mpr
have h := mul_le_mul_of_nonneg_left hsq (by positivity : (0 : ℝ) ≤ 16*d)
nlinarith
theorem symmetricLaw_productPrior_value_mean
Assume positive dimension, the stated ha condition, and the stated hnu condition. Mapping a supported coordinate prior to symmetric causal laws shifts its half-norm mean by the common baseline one half.
Formal statement
hypotheses
conclusion
(∫ P, value P ∂(productPrior d nu).map symmetricLaw) = 1/2 + (∫ u, |u| ∂nu)/2
Proof (Lean source)
-- @node: symmetricLaw_productPrior_value_mean
lemma symmetricLaw_productPrior_value_mean (d : ℕ) (hd : 0 < d)
(a : ℝ) (ha : a ≤ (1/2 : ℝ)) (nu : Measure ℝ) (hnu : AmplitudePrior a nu) :
(∫ P, value P ∂(productPrior d nu).map symmetricLaw) =
1/2 + (∫ u, |u| ∂nu)/2 := by
letI := hnu.1
haveI : IsProbabilityMeasure (productPrior d nu) := by
unfold productPrior
infer_instance
have hint : Integrable (fun theta : Fin d → ℝ => signedNorm theta/2)
(productPrior d nu) := by
unfold signedNorm
apply Integrable.div_const
apply Integrable.const_mul
apply integrable_finsetSum
intro j hj
exact ((amplitudePrior_abs_memLp a nu hnu).comp_measurePreserving
(measurePreserving_eval (fun _ : Fin d => nu) j)).integrable
(by norm_num)
rw [integral_map measurable_symmetricLaw_parameter.aemeasurable
measurable_causal_value.aestronglyMeasurable]
calc
_ = ∫ theta, (1/2 : ℝ) + signedNorm theta/2 ∂productPrior d nu := by
apply integral_congr_ae
filter_upwards [amplitude_productPrior_ae_cube a ha nu hnu] with theta htheta
exact symmetricLaw_value theta htheta hd
_ = 1/2 + (∫ theta, signedNorm theta/2 ∂productPrior d nu) := by
rw [integral_add (integrable_const _) hint, integral_const]
simp
_ = _ := by rw [productPrior_halfNorm_mean d hd a nu hnu]
theorem symmetricLaw_productPrior_value_escape
Assume positive dimension, the stated ha condition, and the stated hnu condition. A common baseline shift preserves target-neighborhood escape probabilities when the coordinate prior is pushed to full-data causal laws.
Formal statement
hypotheses
d :
ℕ
hd :
0 < d
a :
ℝ
ha :
a ≤ (1/2 : ℝ)
nu :
Measure ℝ
hnu :
AmplitudePrior a nu
radius center :
ℝ
conclusion
((productPrior d nu).map symmetricLaw) {P | radius < |value P - (1/2 + center)|}
Proof (Lean source)
-- @node: symmetricLaw_productPrior_value_escape
lemma symmetricLaw_productPrior_value_escape (d : ℕ) (hd : 0 < d)
(a : ℝ) (ha : a ≤ (1/2 : ℝ)) (nu : Measure ℝ) (hnu : AmplitudePrior a nu)
(radius center : ℝ) :
((productPrior d nu).map symmetricLaw)
{P | radius < |value P - (1/2 + center)|} =
(productPrior d nu) {theta | radius < |signedNorm theta/2 - center|} := by
have hE : MeasurableSet {P : Measure (FullRecord d) |
radius < |value P - (1/2 + center)|} := by
apply measurableSet_lt measurable_const
fun_prop
rw [Measure.map_apply measurable_symmetricLaw_parameter hE]
apply measure_congr
filter_upwards [amplitude_productPrior_ae_cube a ha nu hnu] with theta htheta
change (radius < |value (symmetricLaw theta) - (1/2 + center)|) =
(radius < |signedNorm theta/2 - center|)
rw [symmetricLaw_value theta htheta hd]
congr 2
ring
theorem causal_dual_product_priors_target_concentration_of_gate
Assume the Cai–Low moment-duality theorem and the Bernstein absolute-approximation limit. Moment-dual coordinate priors produce a positive gap between actual welfare means and the same quantitative escape bound on causal law space.
Formal statement
hypotheses
hDual :
hBernstein :
conclusion
∃ b : ℝ,
0 < b
conclusion 1
d K :
ℕ
0 < d
0 < K
Even K
a :
ℝ
0 < a
a ≤ (1/2 : ℝ)
∃ nu0 nu1 : Measure ℝ,
AmplitudePrior a nu0
AmplitudePrior a nu1
MatchingMoments (K+1) nu0 nu1
∃ gap : ℝ,
0 < gap
b*a/K ≤ gap
(∫ P, value P ∂(productPrior d nu1).map symmetricLaw)
- (∫ P, value P ∂(productPrior d nu0).map symmetricLaw)
= gap
nu ∈ ({nu0, nu1} : Set (Measure ℝ)) :
≤ 16*(K : ℝ)^2/(b^2*d)
Proof (Lean source)
-- @node: causal_dual_product_priors_target_concentration_of_gate
lemma causal_dual_product_priors_target_concentration_of_gate
(hDual : CaiLowMomentDuality) (hBernstein : BernsteinAbsoluteApproximationLimit) :
∃ b : ℝ, 0 < b ∧ ∀ (d K : ℕ), 0 < d → 0 < K → Even K →
∀ a : ℝ, 0 < a → a ≤ (1/2 : ℝ) →
∃ nu0 nu1 : Measure ℝ, AmplitudePrior a nu0 ∧ AmplitudePrior a nu1 ∧
MatchingMoments (K+1) nu0 nu1 ∧
∃ gap : ℝ, 0 < gap ∧ b*a/K ≤ gap ∧
(∫ P, value P ∂(productPrior d nu1).map symmetricLaw) -
(∫ P, value P ∂(productPrior d nu0).map symmetricLaw) = gap ∧
(∀ nu ∈ ({nu0, nu1} : Set (Measure ℝ)),
((productPrior d nu).map symmetricLaw).real
{P | gap/8 < |value P - (1/2 + (∫ u, |u| ∂nu)/2)|} ≤
16*(K : ℝ)^2/(b^2*d)) := by
obtain ⟨b, hb, hpriors⟩ :=
dual_product_priors_target_concentration_of_gate hDual hBernstein
refine ⟨b, hb, ?_⟩
intro d K hd hK hEven a ha haHalf
obtain ⟨nu0, nu1, hnu0, hnu1, hmatch, gap, hgap, hlower, hmean, hescape⟩ :=
hpriors d K hd hK hEven a ha
refine ⟨nu0, nu1, hnu0, hnu1, hmatch, gap, hgap, hlower, ?_, ?_⟩
· rw [symmetricLaw_productPrior_value_mean d hd a haHalf nu1 hnu1,
symmetricLaw_productPrior_value_mean d hd a haHalf nu0 hnu0]
rw [productPrior_halfNorm_mean d hd a nu1 hnu1,
productPrior_halfNorm_mean d hd a nu0 hnu0] at hmean
linarith
· intro nu hnu
have hamp : AmplitudePrior a nu := by
rcases hnu with rfl | hnu
· exact hnu0
· have heq : nu = nu1 := Set.mem_singleton_iff.mp hnu
simpa [heq] using hnu1
have hstrict : (productPrior d nu)
{theta | gap/8 < |signedNorm theta/2 - (∫ u, |u| ∂nu)/2|} ≤
ofReal (16*(K : ℝ)^2/(b^2*d)) :=
(measure_mono (show
{theta : Fin d → ℝ | gap/8 < |signedNorm theta/2 - (∫ u, |u| ∂nu)/2|} ⊆
{theta | gap/8 ≤ |signedNorm theta/2 - (∫ u, |u| ∂nu)/2|} from by
intro theta ht
change gap/8 < |signedNorm theta/2 - (∫ u, |u| ∂nu)/2| at ht
change gap/8 ≤ |signedNorm theta/2 - (∫ u, |u| ∂nu)/2|
exact ht.le)).trans (hescape nu hnu)
unfold Measure.real
rw [symmetricLaw_productPrior_value_escape d hd a haHalf nu hamp]
exact (ENNReal.toReal_mono ENNReal.ofReal_ne_top hstrict).trans_eq
(ENNReal.toReal_ofReal (by positivity))
theorem causal_concentrated_resource_priors_of_gate
Assume the Cai–Low moment-duality theorem and the Bernstein absolute-approximation limit. At the prescribed resource amplitude and moment order, causal law-space priors have a frontier-sized welfare gap and escape probability at most one hundredth above a universal dimension cutoff.
Formal statement
hypotheses
hDual :
hBernstein :
conclusion
∃ b : ℝ,
0 < b
conclusion 1
∃ D : ℕ,
2 ≤ D
n d :
ℕ
eps :
ℝ
Allowed n d eps
D < d
a :
(frontierResources n d eps).converseAmp
q :
(frontierResources n d eps).converseDegree - 1
∃ nu0 nu1 : Measure ℝ,
AmplitudePrior a nu0
AmplitudePrior a nu1
MatchingMoments (q+1) nu0 nu1
∃ gap : ℝ,
0 < gap
(b/3400)*rateH .SI n d eps ≤ gap
(∫ P, value P ∂(productPrior d nu1).map symmetricLaw)
- (∫ P, value P ∂(productPrior d nu0).map symmetricLaw)
= gap
nu ∈ ({nu0, nu1} : Set (Measure ℝ)) :
≤ (1/100 : ℝ)
Proof (Lean source)
-- @node: causal_concentrated_resource_priors_of_gate
lemma causal_concentrated_resource_priors_of_gate
(hDual : CaiLowMomentDuality) (hBernstein : BernsteinAbsoluteApproximationLimit) :
∃ b : ℝ, 0 < b ∧ ∃ D : ℕ, 2 ≤ D ∧
∀ (n d : ℕ) (eps : ℝ), Allowed n d eps → D < d →
let a := (frontierResources n d eps).converseAmp
let q := (frontierResources n d eps).converseDegree - 1
∃ nu0 nu1 : Measure ℝ, AmplitudePrior a nu0 ∧ AmplitudePrior a nu1 ∧
MatchingMoments (q+1) nu0 nu1 ∧
∃ gap : ℝ, 0 < gap ∧ (b/3400)*rateH .SI n d eps ≤ gap ∧
(∫ P, value P ∂(productPrior d nu1).map symmetricLaw) -
(∫ P, value P ∂(productPrior d nu0).map symmetricLaw) = gap ∧
(∀ nu ∈ ({nu0, nu1} : Set (Measure ℝ)),
((productPrior d nu).map symmetricLaw).real
{P | gap/8 < |value P - (1/2 + (∫ u, |u| ∂nu)/2)|} ≤ (1/100 : ℝ)) := by
obtain ⟨b, hb, hpriors⟩ :=
causal_dual_product_priors_target_concentration_of_gate hDual hBernstein
obtain ⟨D, hD, hcutoff⟩ := frontier_converse_concentration_cutoff b hb
refine ⟨b, hb, D, hD, ?_⟩
intro n d eps hAllowed hdim
obtain ⟨hq, heven⟩ := frontier_converse_degree_domain n d eps hAllowed
obtain ⟨ha, haHalf⟩ := frontier_converse_amplitude_domain n d eps hAllowed
obtain ⟨nu0, nu1, hnu0, hnu1, hmatch, gap, hgap, hlower, hmean, hescape⟩ :=
hpriors d _ (by have := hAllowed.2.1; omega) hq heven _ ha haHalf
refine ⟨nu0, nu1, hnu0, hnu1, hmatch, gap, hgap, ?_, hmean, ?_⟩
· calc
(b/3400)*rateH .SI n d eps = b*((1/3400)*rateH .SI n d eps) := by ring
_ ≤ b*((frontierResources n d eps).converseAmp /
(((frontierResources n d eps).converseDegree - 1 : ℕ) : ℝ)) :=
mul_le_mul_of_nonneg_left (frontier_converse_gap_rate n d eps hAllowed) hb.le
_ = b*(frontierResources n d eps).converseAmp /
(((frontierResources n d eps).converseDegree - 1 : ℕ) : ℝ) := by ring
_ ≤ gap := hlower
· intro nu hnu
exact (hescape nu hnu).trans (hcutoff n d eps hAllowed hdim)
theorem bounded_dimension_frontier_comparisons
Assume polynomial degree at least two, dimension no larger than the polynomial degree, and an admissible sample size, dimension, and privacy budget. Below any fixed dimension cutoff, the frontier is controlled by the two-point rate.
Formal statement
Proof (Lean source)
-- @node: bounded_dimension_frontier_comparisons
lemma bounded_dimension_frontier_comparisons (D n d : ℕ) (eps : ℝ)
(hD : 2 ≤ D) (hdD : d ≤ D) (hAllowed : Allowed n d eps) :
rateR .SI n d eps ≤ 4*(D : ℝ)^2 * min 1 (1/(n*eps^2)) ∧
rateH .SI n d eps ≤ 4*(D : ℝ)^2 * min 1 (1/(sqrt n*eps)) := by
have hDR : (2 : ℝ) ≤ D := by exact_mod_cast hD
have hdR : (0 : ℝ) ≤ d := by positivity
have hdDR : (d : ℝ) ≤ D := by exact_mod_cast hdD
have hnR : (0 : ℝ) < n := by exact_mod_cast (show 0 < n by have := hAllowed.1; omega)
have ht : 0 < (n : ℝ)*eps^2 := mul_pos hnR (sq_pos_of_pos hAllowed.2.2.1)
have hfactor : 1 ≤ (D : ℝ)^2 := by nlinarith
have hbound : min 1 ((d : ℝ)^2/(n*eps^2)) ≤
(D : ℝ)^2 * min 1 (1/(n*eps^2)) := by
by_cases hsmall : (n : ℝ)*eps^2 ≤ 1
· rw [show min 1 (1/(n*eps^2)) = 1 from min_eq_left ((le_div_iff₀ ht).mpr (by simpa using hsmall))]
simpa only [mul_one] using (min_le_left 1 ((d : ℝ)^2/(n*eps^2))).trans hfactor
· rw [show min 1 (1/(n*eps^2)) = 1/(n*eps^2) from min_eq_right ((div_le_iff₀ ht).mpr (by linarith))]
refine (min_le_right _ _).trans ?_
rw [mul_one_div]
exact div_le_div_of_nonneg_right (by nlinarith) ht.le
have hr : rateR .SI n d eps ≤ 4*(D : ℝ)^2 * min 1 (1/(n*eps^2)) := by
exact (rho_elementary_comparisons n d eps hAllowed).2.1.trans (by nlinarith [hbound])
refine ⟨hr, ?_⟩
have hs : 0 < sqrt n*eps := mul_pos (Real.sqrt_pos.mpr hnR) hAllowed.2.2.1
have hsq := min_one_reciprocal_sq (sqrt n*eps) hs
rw [mul_pow, Real.sq_sqrt hnR.le] at hsq
have hm : 0 ≤ min 1 (1/(sqrt n*eps)) := by positivity
have hr0 : 0 ≤ rateR .SI n d eps :=
(by positivity : (0 : ℝ) ≤ min 1 (1/(n*eps^2))).trans
(rho_elementary_comparisons n d eps hAllowed).1
have hroot := Real.sq_sqrt hr0
have hroot0 := Real.sqrt_nonneg (rateR .SI n d eps)
have hrootle : sqrt (rateR .SI n d eps) ≤
2*(D : ℝ)*min 1 (1/(sqrt n*eps)) := by
have hsqbound : (sqrt (rateR .SI n d eps))^2 ≤
(2*(D : ℝ)*min 1 (1/(sqrt n*eps)))^2 := by
rw [hroot]
calc
_ ≤ 4*(D : ℝ)^2 * min 1 (1/(n*eps^2)) := hr
_ = _ := by rw [← hsq]; ring
nlinarith [mul_nonneg (by positivity : (0 : ℝ) ≤ 2*(D : ℝ)) hm]
exact hrootle.trans (by nlinarith)
theorem bounded_dimension_frontier_lower
Assume measurable Radon–Nikodym densities for dominated kernels, polynomial degree at least two, dimension no larger than the polynomial degree, an admissible sample size, dimension, and privacy budget, independent and identically distributed participant records, independent protocol randomness, and sequential local privacy of the protocol. A fixed dimension cutoff gives both per-decision frontier converses with one constant.
Formal statement
hypotheses
D n d :
ℕ
eps :
ℝ
hD :
2 ≤ D
hdD :
d ≤ D
hAllowed :
Allowed n d eps
S :
SamplingScheme n d
hIID :
hRandom :
Q :
LocalProtocol n (ObsRecord d)
hQ :
SequentialClass Q eps
conclusion
conclusion 1
T :
≤ ⨆ P : {P : Measure (FullRecord d) // P ∈ causalClass d}, squaredRisk (decisionLaw S Q P.1) T (value P.1)
Proof (Lean source)
-- @node: bounded_dimension_frontier_lower
lemma bounded_dimension_frontier_lower (hRN : MeasurableKernelRadonNikodym)
(D n d : ℕ) (eps : ℝ) (hD : 2 ≤ D) (hdD : d ≤ D) (hAllowed : Allowed n d eps)
(S : SamplingScheme n d) (hIID : IidPeople S) (hRandom : IndependentRandomness S)
(Q : LocalProtocol n (ObsRecord d)) (hQ : SequentialClass Q eps) :
(∀ T : Estimator Q, ofReal ((1/(32768*(D : ℝ)^2))*rateR .SI n d eps) ≤
⨆ P : {P : Measure (FullRecord d) // P ∈ causalClass d},
squaredRisk (decisionLaw S Q P.1) T (value P.1)) ∧
(∀ I : IntervalDecision Q (1/4) (3/4),
(∀ P ∈ causalClass d, (0.90 : ℝ) ≤ coverage (decisionLaw S Q P) I (value P)) →
ofReal ((1/(32768*(D : ℝ)^2))*rateH .SI n d eps) ≤
⨆ P : {P : Measure (FullRecord d) // P ∈ causalClass d},
expectedLength (decisionLaw S Q P.1) I) := by
obtain ⟨hr, hh⟩ := bounded_dimension_frontier_comparisons D n d eps hD hdD hAllowed
have hDpos : (0 : ℝ) < D := by exact_mod_cast (show 0 < D by omega)
have hscale : (1/(32768*(D : ℝ)^2))*(4*(D : ℝ)^2) = 1/8192 := by
field_simp
<;> ring
have hscaledR := mul_le_mul_of_nonneg_left hr
(by positivity : (0 : ℝ) ≤ 1/(32768*(D : ℝ)^2))
have hscaledH := mul_le_mul_of_nonneg_left hh
(by positivity : (0 : ℝ) ≤ 1/(32768*(D : ℝ)^2))
rw [← mul_assoc, hscale] at hscaledR hscaledH
have hdec := dimension_free_private_two_point_decisions hRN n d eps hAllowed S hIID hRandom Q hQ
exact ⟨fun T => (ENNReal.ofReal_le_ofReal hscaledR).trans (hdec.1 T),
fun I hCov => (ENNReal.ofReal_le_ofReal hscaledH).trans (hdec.2 I hCov)⟩
theorem frontier_lower_of_gate
Assume measurable Radon–Nikodym densities for dominated kernels, the Cai–Low moment-duality theorem, and the Bernstein absolute-approximation limit. Per-protocol and per-decision causal lower bounds, including connected honest intervals.
Formal statement
hypotheses
hRN_of_gate :
hDual_of_gate :
hBernstein_of_gate :
conclusion
∃ c : ℝ,
0 < c
conclusion 1
n d :
ℕ
eps :
ℝ
Allowed n d eps
S :
SamplingScheme n d
Q :
LocalProtocol n (ObsRecord d)
SequentialClass Q eps
T :
≤ ⨆ P : {P : Measure (FullRecord d) // P ∈ causalClass d}, squaredRisk (decisionLaw S Q P.1) T (value P.1)
I :
IntervalDecision Q (1/4) (3/4)
Proof (Lean source)
-- @node: frontier_lower_of_gate
lemma frontier_lower_of_gate (hRN_of_gate : MeasurableKernelRadonNikodym)
(hDual_of_gate : CaiLowMomentDuality) (hBernstein_of_gate :
BernsteinAbsoluteApproximationLimit) :
∃ c : ℝ, 0 < c ∧ ∀ (n d : ℕ) (eps : ℝ), Allowed n d eps →
∀ (S : SamplingScheme n d), IidPeople S → IndependentRandomness S →
∀ Q : LocalProtocol n (ObsRecord d), SequentialClass Q eps →
(∀ T : Estimator Q, ofReal (c*rateR .SI n d eps) ≤
⨆ P : {P : Measure (FullRecord d) // P ∈ causalClass d},
squaredRisk (decisionLaw S Q P.1) T (value P.1)) ∧
(∀ I : IntervalDecision Q (1/4) (3/4),
(∀ P ∈ causalClass d, (0.90 : ℝ) ≤ coverage (decisionLaw S Q P) I (value P)) →
ofReal (c*rateH .SI n d eps) ≤
⨆ P : {P : Measure (FullRecord d) // P ∈ causalClass d},
expectedLength (decisionLaw S Q P.1) I) := by
-- Concentrated product priors give the converse above a universal cutoff.
have hLarge :
∃ D : ℕ, 2 ≤ D ∧ ∃ c : ℝ, 0 < c ∧ ∀ (n d : ℕ) (eps : ℝ), Allowed n d eps → D < d →
∀ (S : SamplingScheme n d), IidPeople S → IndependentRandomness S →
∀ Q : LocalProtocol n (ObsRecord d), SequentialClass Q eps →
(∀ T : Estimator Q, ofReal (c*rateR .SI n d eps) ≤
⨆ P : {P : Measure (FullRecord d) // P ∈ causalClass d},
squaredRisk (decisionLaw S Q P.1) T (value P.1)) ∧
(∀ I : IntervalDecision Q (1/4) (3/4),
(∀ P ∈ causalClass d, (0.90 : ℝ) ≤ coverage (decisionLaw S Q P) I (value P)) →
ofReal (c*rateH .SI n d eps) ≤
⨆ P : {P : Measure (FullRecord d) // P ∈ causalClass d},
expectedLength (decisionLaw S Q P.1) I) := by
obtain ⟨b, hb, D, hD, hpriors⟩ :=
causal_concentrated_resource_priors_of_gate hDual_of_gate hBernstein_of_gate
let scale : ℝ := b/3400
have hs : 0 < scale := by dsimp [scale]; positivity
refine ⟨D, hD, min (scale^2/100) (scale/100),
lt_min (by positivity) (by positivity), ?_⟩
intro n d eps hAllowed hdim S hIID hRandom Q hQ
obtain ⟨nu0, nu1, hnu0, hnu1, hmatch, gap, hgap,
hlower, hmean, hescape⟩ :=
hpriors n d eps hAllowed hdim
letI := hnu0.1
letI := hnu1.1
haveI : IsProbabilityMeasure (productPrior d nu0) := by unfold productPrior; infer_instance
haveI : IsProbabilityMeasure (productPrior d nu1) := by unfold productPrior; infer_instance
haveI : IsProbabilityMeasure ((productPrior d nu0).map symmetricLaw) :=
Measure.isProbabilityMeasure_map measurable_symmetricLaw_parameter.aemeasurable
haveI : IsProbabilityMeasure ((productPrior d nu1).map symmetricLaw) :=
Measure.isProbabilityMeasure_map measurable_symmetricLaw_parameter.aemeasurable
have hd : 0 < d := by have := hAllowed.2.1; omega
have ha := (frontier_converse_amplitude_domain n d eps hAllowed).2
have hdegree : (frontierResources n d eps).converseDegree - 1 + 1 =
(frontierResources n d eps).converseDegree := by
have := frontier_converse_degree_domain n d eps hAllowed
omega
rw [hdegree] at hmatch
let v0 : ℝ := 1/2 + (∫ u, |u| ∂nu0)/2
let v1 : ℝ := 1/2 + (∫ u, |u| ∂nu1)/2
have hcenters : v1-v0 = gap := by
rw [symmetricLaw_productPrior_value_mean d hd _ ha nu1 hnu1,
symmetricLaw_productPrior_value_mean d hd _ ha nu0 hnu0] at hmean
exact hmean
have hTV := causal_lawspace_resource_contraction hRN_of_gate Q eps hQ hAllowed
nu0 nu1 hnu0 hnu1 hmatch
have hdec := causal_separated_lawspace_decisions S hIID hRandom Q
((productPrior d nu0).map symmetricLaw) ((productPrior d nu1).map symmetricLaw)
(symmetricLaw_productPrior_support hd _ ha nu0 hnu0)
(symmetricLaw_productPrior_support hd _ ha nu1 hnu1)
v0 v1 (1/100) (1/100) (by linarith)
(by simpa only [hcenters] using hescape nu0 (by simp))
(by simpa only [hcenters] using hescape nu1 (by simp)) hTV
rw [hcenters] at hdec
have htest : max (0 : ℝ) (1-1/100-2*(1/100)) = 97/100 := by norm_num
have hlength : max (0 : ℝ) ((0.80 : ℝ)-2*(1/100)-1/100) = 77/100 := by norm_num
rw [htest, hlength] at hdec
have hr0 : 0 ≤ rateR .SI n d eps :=
(by positivity : (0 : ℝ) ≤ min 1 (1/(n*eps^2))).trans
(rho_elementary_comparisons n d eps hAllowed).1
have hh0 : 0 ≤ rateH .SI n d eps := Real.sqrt_nonneg _
have hsq : (rateH .SI n d eps)^2 = rateR .SI n d eps :=
Real.sq_sqrt hr0
have hlower' : scale * rateH .SI n d eps ≤ gap := hlower
have hgapSq : scale^2 * rateR .SI n d eps ≤ gap^2 := by
have h := mul_self_le_mul_self (mul_nonneg hs.le hh0) hlower'
simpa only [← pow_two, mul_pow, hsq] using h
have hr : min (scale^2/100) (scale/100) * rateR .SI n d eps ≤
9*gap^2/128 * (97/100) := by
have h := mul_le_mul_of_nonneg_right
(min_le_left (scale^2/100) (scale/100)) hr0
nlinarith [sq_nonneg gap]
have hh : min (scale^2/100) (scale/100) * rateH .SI n d eps ≤
3*gap/4 * (77/100) := by
have h := mul_le_mul_of_nonneg_right
(min_le_right (scale^2/100) (scale/100)) hh0
nlinarith
exact ⟨fun T => (ENNReal.ofReal_le_ofReal hr).trans (hdec.1 T),
fun J hCov => (ENNReal.ofReal_le_ofReal hh).trans (hdec.2 J hCov)⟩
obtain ⟨D, hD, cLarge, hcLarge, hLarge⟩ := hLarge
let cSmall : ℝ := 1/(32768*(D : ℝ)^2)
have hDpos : (0 : ℝ) < D := by exact_mod_cast (show 0 < D by omega)
have hcSmall : 0 < cSmall := by dsimp [cSmall]; positivity
refine ⟨min cLarge cSmall, lt_min hcLarge hcSmall, ?_⟩
intro n d eps hAllowed S hIID hRandom Q hQ
have hr0 : 0 ≤ rateR .SI n d eps :=
(by positivity : (0 : ℝ) ≤ min 1 (1/(n*eps^2))).trans
(rho_elementary_comparisons n d eps hAllowed).1
have hh0 : 0 ≤ rateH .SI n d eps := Real.sqrt_nonneg _
by_cases hdD : d ≤ D
· have hSmall := bounded_dimension_frontier_lower hRN_of_gate D n d eps hD hdD
hAllowed S hIID hRandom Q hQ
constructor
· intro T
exact (ENNReal.ofReal_le_ofReal (mul_le_mul_of_nonneg_right
(min_le_right cLarge cSmall) hr0)).trans (hSmall.1 T)
· intro I hCov
exact (ENNReal.ofReal_le_ofReal (mul_le_mul_of_nonneg_right
(min_le_right cLarge cSmall) hh0)).trans (hSmall.2 I hCov)
· have hBig := hLarge n d eps hAllowed (by omega) S hIID hRandom Q hQ
constructor
· intro T
exact (ENNReal.ofReal_le_ofReal (mul_le_mul_of_nonneg_right
(min_le_left cLarge cSmall) hr0)).trans (hBig.1 T)
· intro I hCov
exact (ENNReal.ofReal_le_ofReal (mul_le_mul_of_nonneg_right
(min_le_left cLarge cSmall) hh0)).trans (hBig.2 I hCov)
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Frontier.NormCalibration 16 declarations The structural moment computation agrees with the calibrated polynomial statistic.
Squared-error calibration of the concrete norm statistics
The structural moment computation agrees with the calibrated polynomial statistic. Finite averaging and the bias--variance identity give its global polynomial MSE. Selecting the actual evaluation and disjoint pilot rows transfers all three norm calibrations to the attaining transcript.
theorem frontierPolynomialEstimate_eq_polynomialEstimate Lemma frontierPolynomialEstimate_eq_polynomialEstimate in the paper ↗
The executable structural moment recursion computes the calibrated statistic exactly.
Formal statement
hypotheses
conclusion
frontierPolynomialEstimate eps a D j z = polynomialEstimate eps a D j z
Proof (Lean source)
-- @node: frontierPolynomialEstimate_eq_polynomialEstimate
lemma frontierPolynomialEstimate_eq_polynomialEstimate (eps a : ℝ) (D : ℕ)
(j : Fin d) (z : Fin m → Fin d → Bool) :
frontierPolynomialEstimate eps a D j z = polynomialEstimate eps a D j z := by
unfold frontierPolynomialEstimate polynomialEstimate
simp_rw [privateMoment_eq_recursion]
theorem blockMean_sq_error_eq_variance_add_bias Lemma blockMean_sq_error_eq_variance_add_bias in the paper ↗
Centered finite-block error splits into variance and squared bias.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
P :
eps x :
ℝ
Proof (Lean source)
-- @node: blockMean_sq_error_eq_variance_add_bias
lemma blockMean_sq_error_eq_variance_add_bias
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (eps x : ℝ)
(f : (Fin m → Fin d → Bool) → ℝ) :
blockMean P eps (fun z => (f z - x)^2) =
blockVar P eps f + (blockMean P eps f - x)^2 := by
letI := vectorBlockLaw_probability P eps m
have hv := variance_eq_sub (μ := vectorBlockLaw P eps m)
(X := fun z => f z - x) (MemLp.of_discrete)
rw [variance_sub_const (by fun_prop) x, variance_eq_integral (by fun_prop)] at hv
have hm : (∫ z, f z - x ∂vectorBlockLaw P eps m) = blockMean P eps f - x := by
unfold blockMean
integral_linearity
simp
rw [hm] at hv
change blockVar P eps f = blockMean P eps (fun z => (f z - x)^2) -
(blockMean P eps f - x)^2 at hv
linarith
theorem blockMean_average_bias_le
Assume positive dimension and the stated hbias condition. Column bias bounds persist under finite averaging without independent columns.
Formal statement
hypotheses
conclusion
|blockMean P eps (fun z => (d : ℝ)⁻¹ * ∑ j, f j z) - signedNorm theta| ≤ B
Proof (Lean source)
-- @node: blockMean_average_bias_le
lemma blockMean_average_bias_le (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(eps B : ℝ) (hd : 0 < d) (f : Fin d → (Fin m → Fin d → Bool) → ℝ)
(theta : Fin d → ℝ)
(hbias : ∀ j, abs (blockMean P eps (f j) - abs (theta j)) ≤ B) :
|blockMean P eps (fun z => (d : ℝ)⁻¹ * ∑ j, f j z) - signedNorm theta| ≤ B := by
letI := vectorBlockLaw_probability P eps m
have havg : blockMean P eps (fun z => (d : ℝ)⁻¹ * ∑ j, f j z) =
(d : ℝ)⁻¹ * ∑ j, blockMean P eps (f j) := by
unfold blockMean
integral_linearity
rw [havg, signedNorm, ← mul_sub, ← Finset.sum_sub_distrib, abs_mul,
abs_of_nonneg (by positivity : 0 ≤ (d : ℝ)⁻¹)]
calc
_ ≤ (d : ℝ)⁻¹ * ∑ j, abs (blockMean P eps (f j) - abs (theta j)) :=
mul_le_mul_of_nonneg_left (Finset.abs_sum_le_sum_abs _ _) (by positivity)
_ ≤ (d : ℝ)⁻¹ * ∑ _j : Fin d, B :=
mul_le_mul_of_nonneg_left (Finset.sum_le_sum (fun j _ => hbias j)) (by positivity)
_ = B := by simp [ne_of_gt (show (0 : ℝ) < d by exact_mod_cast hd)]
theorem frontierPolynomial_average_mse_bound
Assume the bounded-mean concentration inequality, the Cai–Low Chebyshev approximation theorem, independent and identically distributed participant records, the causal-model conditions for the data law, an admissible sample size, dimension, and privacy budget, positive block size, a block no larger than the sample, the stated even condition, polynomial degree at least two, the stated hm d condition, and the stated degree condition. The roadmap's global polynomial MSE applies to the actual recursive computation.
Formal statement
hypotheses
n :
ℕ
m :
ℕ
d :
ℕ
hMean :
hCheb :
S :
SamplingScheme n d
hIID :
P :
hP :
eps :
ℝ
hAllowed :
Allowed n d eps
hm :
0 < m
hmn :
m ≤ n
D :
ℕ
hEven :
Even D
hD :
2 ≤ D
hmD :
2*D ≤ m
hDegree :
(D : ℝ)
conclusion
blockMean (m := m) P eps (fun z => ((d : ℝ)⁻¹ * ∑ j, frontierPolynomialEstimate eps (1/2) D j z - signedNorm (contrast P))^2)
+ (1/(D+1 : ℝ))^2
Proof (Lean source)
-- @node: frontierPolynomial_average_mse_bound
lemma frontierPolynomial_average_mse_bound
(hMean : BoundedMeanConcentration) (hCheb : CaiLowChebyshevApproximation)
(S : SamplingScheme n d) (hIID : IidPeople S)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(eps : ℝ) (hAllowed : Allowed n d eps) (hm : 0 < m) (hmn : m ≤ n)
(D : ℕ) (hEven : Even D) (hD : 2 ≤ D) (hmD : 2*D ≤ m)
(hDegree : (D : ℝ) ≤ (1/1024 : ℝ) * logDim d /
log (exp 1 + sigmaSquared d m eps * logDim d)) :
blockMean (m := m) P eps (fun z => ((d : ℝ)⁻¹ *
∑ j, frontierPolynomialEstimate eps (1/2) D j z - signedNorm (contrast P))^2) ≤
exp (9*D*log (exp 1 + sigmaSquared d m eps * logDim d))/(2*d) +
(1/(D+1 : ℝ))^2 := by
simp_rw [frontierPolynomialEstimate_eq_polynomialEstimate]
obtain ⟨hbias, hvar⟩ := (finite_private_polynomial_calibration hMean hCheb S hIID
P hP eps hAllowed hm hmn).1 D hEven hD hmD hDegree
have hb := blockMean_average_bias_le P eps (1/(D+1 : ℝ))
(by have := hAllowed.2.1; omega) (fun j => polynomialEstimate eps (1/2) D j)
(contrast P) hbias
have hbsq := mul_self_le_mul_self (abs_nonneg _) hb
simp only [← pow_two, sq_abs] at hbsq
rw [blockMean_sq_error_eq_variance_add_bias]
exact add_le_add hvar hbsq
Assume positive dimension. Cauchy--Schwarz bounds a squared finite average by the average squared error.
Formal statement
hypotheses
conclusion
((d : ℝ)⁻¹ * ∑ j, x j)^2 ≤ (d : ℝ)⁻¹ * ∑ j, (x j)^2
Proof (Lean source)
-- @node: finite_average_sq_le
lemma finite_average_sq_le (hd : 0 < d) (x : Fin d → ℝ) :
((d : ℝ)⁻¹ * ∑ j, x j)^2 ≤ (d : ℝ)⁻¹ * ∑ j, (x j)^2 := by
have hdR : (0 : ℝ) < d := by exact_mod_cast hd
have hcs : (∑ j, x j)^2 ≤ (d : ℝ) * ∑ j, (x j)^2 := by
simpa using Finset.sum_mul_sq_le_sq_mul_sq (Finset.univ : Finset (Fin d))
(fun _ => (1 : ℝ)) x
calc
_ = (d : ℝ)⁻¹^2 * (∑ j, x j)^2 := mul_pow _ _ _
_ ≤ (d : ℝ)⁻¹^2 * ((d : ℝ) * ∑ j, (x j)^2) :=
mul_le_mul_of_nonneg_left hcs (sq_nonneg _)
_ = _ := by field_simp
Absolute value is a contraction in squared error at every true column mean.
Formal statement
hypotheses
x y :
ℝ
conclusion
(|x| - |y|)^2 ≤ (x-y)^2
Proof (Lean source)
-- @node: abs_sub_abs_sq_le
lemma abs_sub_abs_sq_le (x y : ℝ) : (|x| - |y|)^2 ≤ (x-y)^2 := by
have h := abs_abs_sub_abs_le x y
have hsq := mul_self_le_mul_self (abs_nonneg _) h
simpa only [← pow_two, sq_abs] using hsq
theorem absolute_column_average_mse_bound
Assume the causal-model conditions for the data law, a positive privacy budget, dimension at least two, and positive block size. The roadmap's absolute evaluation means have signed-norm MSE at most sigma squared.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
P :
hP :
eps :
ℝ
heps :
0 < eps
hd :
2 ≤ d
hm :
0 < m
conclusion
blockMean (m := m) P eps (fun z => ((d : ℝ)⁻¹ * ∑ j, |scaledColumnMean eps j z| - signedNorm (contrast P))^2)
≤ sigmaSquared d m eps
Proof (Lean source)
-- @node: absolute_column_average_mse_bound
lemma absolute_column_average_mse_bound
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d) (hm : 0 < m) :
blockMean (m := m) P eps (fun z => ((d : ℝ)⁻¹ *
∑ j, |scaledColumnMean eps j z| - signedNorm (contrast P))^2) ≤
sigmaSquared d m eps := by
letI := vectorBlockLaw_probability P eps m
have hpoint (z : Fin m → Fin d → Bool) :
((d : ℝ)⁻¹ * ∑ j, |scaledColumnMean eps j z| - signedNorm (contrast P))^2 ≤
(d : ℝ)⁻¹ * ∑ j, (scaledColumnMean eps j z - contrast P j)^2 := by
unfold signedNorm
rw [← mul_sub, ← Finset.sum_sub_distrib]
exact (finite_average_sq_le (by omega) _).trans
(mul_le_mul_of_nonneg_left
(Finset.sum_le_sum (fun j _ => abs_sub_abs_sq_le _ _)) (by positivity))
have hcol (j : Fin d) :
blockMean (m := m) P eps (fun z => (scaledColumnMean eps j z - contrast P j)^2) ≤
sigmaSquared d m eps := by
rw [blockMean_sq_error_eq_variance_add_bias,
blockMean_scaledColumnMean P hP eps heps hd hm]
simpa using blockVar_scaledColumnMean_le P hP eps heps hd hm j
calc
_ ≤ blockMean P eps (fun z => (d : ℝ)⁻¹ *
∑ j, (scaledColumnMean eps j z - contrast P j)^2) :=
integral_mono (Integrable.of_finite) (Integrable.of_finite) hpoint
_ = (d : ℝ)⁻¹ * ∑ j,
blockMean P eps (fun z => (scaledColumnMean eps j z - contrast P j)^2) := by
unfold blockMean
integral_linearity
rw [integral_finset_sum _ (fun _ _ => Integrable.of_finite)]
_ ≤ (d : ℝ)⁻¹ * ∑ _j : Fin d, sigmaSquared d m eps :=
mul_le_mul_of_nonneg_left (Finset.sum_le_sum (fun j _ => hcol j)) (by positivity)
_ = _ := by simp [ne_of_gt (show (0 : ℝ) < d by exact_mod_cast (by omega : 0 < d))]
Assume the stated hb condition. On the global branch the concrete transcript norm is exactly the calibrated recursive average.
Formal statement
hypotheses
n d :
ℕ
eps :
ℝ
hb :
(frontierResources n d eps).branch = .globalPoly
z :
ProtocolTranscript (frontierProtocol n d eps)
conclusion
frontierNormEstimate n d eps z
= (d : ℝ)⁻¹ * ∑ j, polynomialEstimate eps (frontierResources n d eps).radius (frontierResources n d eps).degree j (frontierBlock n d eps ((frontierResources n d eps).m0 + (frontierResources n d eps).m) z)
Proof (Lean source)
-- @node: frontierNormEstimate_globalPoly
lemma frontierNormEstimate_globalPoly (n d : ℕ) (eps : ℝ)
(hb : (frontierResources n d eps).branch = .globalPoly)
(z : ProtocolTranscript (frontierProtocol n d eps)) :
frontierNormEstimate n d eps z = (d : ℝ)⁻¹ * ∑ j,
polynomialEstimate eps (frontierResources n d eps).radius
(frontierResources n d eps).degree j
(frontierBlock n d eps ((frontierResources n d eps).m0 +
(frontierResources n d eps).m) z) := by
simp only [frontierNormEstimate, hb, frontierPolynomialEstimate_eq_polynomialEstimate]
Assume the stated hb condition. On the absolute-mean branch the concrete transcript norm is the calibrated mean statistic.
Formal statement
hypotheses
n d :
ℕ
eps :
ℝ
hb :
(frontierResources n d eps).branch = .absMean
z :
ProtocolTranscript (frontierProtocol n d eps)
conclusion
frontierNormEstimate n d eps z
= (d : ℝ)⁻¹ * ∑ j, |scaledColumnMean eps j (frontierBlock n d eps ((frontierResources n d eps).m0 + (frontierResources n d eps).m) z)|
Proof (Lean source)
-- @node: frontierNormEstimate_absMean
lemma frontierNormEstimate_absMean (n d : ℕ) (eps : ℝ)
(hb : (frontierResources n d eps).branch = .absMean)
(z : ProtocolTranscript (frontierProtocol n d eps)) :
frontierNormEstimate n d eps z = (d : ℝ)⁻¹ * ∑ j,
|scaledColumnMean eps j (frontierBlock n d eps
((frontierResources n d eps).m0 + (frontierResources n d eps).m) z)| := by
simp only [frontierNormEstimate, hb]
Assume the stated hn condition. The disjoint pilot and evaluation extracts have the independent hybrid expectation.
Formal statement
hypotheses
n d :
ℕ
eps :
ℝ
hn :
n ≠ 2
P :
conclusion
(∫ z, f (frontierBlock n d eps (frontierResources n d eps).m0 z, frontierBlock n d eps ((frontierResources n d eps).m0 + (frontierResources n d eps).m) z) ∂Measure.pi (fun i => (observedLaw P).bind (frontierKernel n d eps i)))
= hybridMean P eps f
Proof (Lean source)
-- @node: frontierBlocks_integral
lemma frontierBlocks_integral (n d : ℕ) (eps : ℝ) (hn : n ≠ 2)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(f : ((Fin (n / 3) → Fin d → Bool) × (Fin (n / 3) → Fin d → Bool)) → ℝ) :
(∫ z, f (frontierBlock n d eps (frontierResources n d eps).m0 z,
frontierBlock n d eps ((frontierResources n d eps).m0 +
(frontierResources n d eps).m) z)
∂Measure.pi (fun i => (observedLaw P).bind (frontierKernel n d eps i))) =
hybridMean P eps f := by
let g : Fin (n / 3 + n / 3) → Fin n := fun i =>
⟨(frontierResources n d eps).m0 + i.val, by
have hi := i.isLt
simp only [frontierResources]
omega⟩
have hg : Injective g := by
intro i j hij
apply Fin.ext
have := congrArg val hij
dsimp [g] at this
omega
have hlaw := frontier_vector_selection_law eps hn P g hg
(fun i => by dsimp [g]; omega)
have htransfer :
(∫ z, f (splitHybridRows (fun i => (z (g i)).2))
∂Measure.pi (fun i => (observedLaw P).bind (frontierKernel n d eps i))) =
blockMean P eps (fun z => f (splitHybridRows z)) := by
unfold blockMean
rw [← hlaw]
exact (integral_map
(μ := Measure.pi (fun i => (observedLaw P).bind (frontierKernel n d eps i)))
(φ := fun z i => (z (g i)).2) (f := fun z => f (splitHybridRows z))
((measurable_pi_lambda _ (fun i =>
measurable_snd.comp (measurable_pi_apply (g i)))).aemeasurable)
(by fun_prop)).symm
have hpair (z : Fin n → FrontierMessage d) :
(frontierBlock n d eps (frontierResources n d eps).m0 z,
frontierBlock n d eps ((frontierResources n d eps).m0 +
(frontierResources n d eps).m) z) =
splitHybridRows (fun i => (z (g i)).2) := by
apply Prod.ext
· funext i
have hi : (frontierResources n d eps).m0 + i.val < n := by
have := i.isLt
simp only [frontierResources]
omega
simp only [frontierBlock, messageAt, hi, ↓reduceDIte, splitHybridRows]
rfl
· funext i
have hi : (frontierResources n d eps).m0 +
(frontierResources n d eps).m + i.val < n := by
have := i.isLt
simp only [frontierResources]
omega
simp only [frontierBlock, messageAt, hi, ↓reduceDIte, splitHybridRows]
congr 2
apply Fin.ext
simp [g, frontierResources, Nat.add_assoc, Nat.add_comm]
simp_rw [hpair]
exact htransfer.trans (hybridMean_eq_combined_blockMean P eps f).symm
theorem frontierNormEstimate_absMean_mse
Assume the stated hn condition, the stated hb condition, the causal-model conditions for the data law, a positive privacy budget, dimension at least two, and the stated hm condition. The actual absolute-mean transcript branch inherits its calibrated norm MSE.
Formal statement
hypotheses
n d :
ℕ
eps :
ℝ
hn :
n ≠ 2
hb :
(frontierResources n d eps).branch = .absMean
P :
hP :
heps :
0 < eps
hd :
2 ≤ d
hm :
0 < n / 3
conclusion
(∫ z, (frontierNormEstimate n d eps z - signedNorm (contrast P))^2 ∂Measure.pi (fun i => (observedLaw P).bind (frontierKernel n d eps i)))
≤ sigmaSquared d (n / 3) eps
Proof (Lean source)
-- @node: frontierNormEstimate_absMean_mse
lemma frontierNormEstimate_absMean_mse (n d : ℕ) (eps : ℝ) (hn : n ≠ 2)
(hb : (frontierResources n d eps).branch = .absMean)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(heps : 0 < eps) (hd : 2 ≤ d) (hm : 0 < n / 3) :
(∫ z, (frontierNormEstimate n d eps z - signedNorm (contrast P))^2
∂Measure.pi (fun i => (observedLaw P).bind (frontierKernel n d eps i))) ≤
sigmaSquared d (n / 3) eps := by
have hstat (z : Fin n → FrontierMessage d) := frontierNormEstimate_absMean n d eps hb z
simp_rw [hstat]
have htransfer := frontierBlock_integral n d eps hn P
((frontierResources n d eps).m0 + (frontierResources n d eps).m)
(by simp only [frontierResources]; omega)
(by simp only [frontierResources]; omega)
(fun z => ((d : ℝ)⁻¹ * ∑ j, |scaledColumnMean eps j z| -
signedNorm (contrast P))^2)
exact htransfer.le.trans (absolute_column_average_mse_bound P hP eps heps hd hm)
theorem frontierNormEstimate_globalPoly_mse
Assume the bounded-mean concentration inequality, the Cai–Low Chebyshev approximation theorem, the stated hn condition, the stated hb condition, independent and identically distributed participant records, the causal-model conditions for the data law, an admissible sample size, dimension, and privacy budget, the stated hm condition, the stated even condition, the stated d condition, the stated hm d condition, and the stated degree condition. The actual global-polynomial transcript branch inherits its calibrated norm MSE.
Formal statement
hypotheses
hMean :
hCheb :
n d :
ℕ
eps :
ℝ
hn :
n ≠ 2
hb :
(frontierResources n d eps).branch = .globalPoly
S :
SamplingScheme n d
hIID :
P :
hP :
hAllowed :
Allowed n d eps
hm :
0 < n / 3
hEven :
Even (frontierResources n d eps).degree
hD :
2 ≤ (frontierResources n d eps).degree
hmD :
2*(frontierResources n d eps).degree ≤ n / 3
hDegree :
((frontierResources n d eps).degree : ℝ)
conclusion
(∫ z, (frontierNormEstimate n d eps z - signedNorm (contrast P))^2 ∂Measure.pi (fun i => (observedLaw P).bind (frontierKernel n d eps i)))
≤ exp (9*(frontierResources n d eps).degree* log (exp 1 + sigmaSquared d (n / 3) eps * logDim d))/(2*d)
+ (1/((frontierResources n d eps).degree+1 : ℝ))^2
Proof (Lean source)
-- @node: frontierNormEstimate_globalPoly_mse
lemma frontierNormEstimate_globalPoly_mse
(hMean : BoundedMeanConcentration) (hCheb : CaiLowChebyshevApproximation)
(n d : ℕ) (eps : ℝ) (hn : n ≠ 2)
(hb : (frontierResources n d eps).branch = .globalPoly)
(S : SamplingScheme n d) (hIID : IidPeople S)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(hAllowed : Allowed n d eps) (hm : 0 < n / 3)
(hEven : Even (frontierResources n d eps).degree)
(hD : 2 ≤ (frontierResources n d eps).degree)
(hmD : 2*(frontierResources n d eps).degree ≤ n / 3)
(hDegree : ((frontierResources n d eps).degree : ℝ) ≤
(1/1024 : ℝ) * logDim d /
log (exp 1 + sigmaSquared d (n / 3) eps * logDim d)) :
(∫ z, (frontierNormEstimate n d eps z - signedNorm (contrast P))^2
∂Measure.pi (fun i => (observedLaw P).bind (frontierKernel n d eps i))) ≤
exp (9*(frontierResources n d eps).degree*
log (exp 1 + sigmaSquared d (n / 3) eps * logDim d))/(2*d) +
(1/((frontierResources n d eps).degree+1 : ℝ))^2 := by
have hradius : (frontierResources n d eps).radius = (1/2 : ℝ) := by
by_cases hsmall : logDim d < 4096
· simp [frontierResources, hn, hsmall] at hb
· by_cases hdense : (d : ℝ)^2 * logDim d ≤ (n : ℝ)*eps^2
· simp [frontierResources, hn, hsmall, hdense] at hb
· simp [frontierResources, hdense]
have hstat (z : Fin n → FrontierMessage d) := frontierNormEstimate_globalPoly n d eps hb z
simp_rw [hstat, hradius,
← frontierPolynomialEstimate_eq_polynomialEstimate]
have htransfer := frontierBlock_integral n d eps hn P
((frontierResources n d eps).m0 + (frontierResources n d eps).m)
(by simp only [frontierResources]; omega)
(by simp only [frontierResources]; omega)
(fun z => ((d : ℝ)⁻¹ * ∑ j, frontierPolynomialEstimate eps (1/2)
(frontierResources n d eps).degree j z - signedNorm (contrast P))^2)
exact htransfer.le.trans (frontierPolynomial_average_mse_bound hMean hCheb S hIID P hP
eps hAllowed hm (by omega) _ hEven hD hmD hDegree)
Assume the stated hb condition. On the hybrid branch the transcript computation is the calibrated pilot rule.
Formal statement
hypotheses
conclusion
frontierNormEstimate n d eps z
= (d : ℝ)⁻¹ * ∑ j, hybridColumn eps (frontierResources n d eps).degree j (frontierBlock n d eps (frontierResources n d eps).m0 z, frontierBlock n d eps ((frontierResources n d eps).m0 + (frontierResources n d eps).m) z)
Proof (Lean source)
-- @node: frontierNormEstimate_hybrid
lemma frontierNormEstimate_hybrid (n d : ℕ) (eps : ℝ)
(hb : (frontierResources n d eps).branch = .hybrid)
(z : Fin n → FrontierMessage d) :
frontierNormEstimate n d eps z = (d : ℝ)⁻¹ * ∑ j,
hybridColumn eps (frontierResources n d eps).degree j
(frontierBlock n d eps (frontierResources n d eps).m0 z,
frontierBlock n d eps ((frontierResources n d eps).m0 +
(frontierResources n d eps).m) z) := by
have hradius : (frontierResources n d eps).radius =
2*(frontierResources n d eps).threshold := by
by_cases hsmall : logDim d < 4096
· by_cases hn : n = 2
· simp [frontierResources, hn] at hb
· simp [frontierResources, hn, hsmall] at hb
· by_cases hdense : (d : ℝ)^2 * logDim d ≤ (n : ℝ)*eps^2
· simp [frontierResources, hdense]
ring
· by_cases hn : n = 2
· simp [frontierResources, hn] at hb
· simp only [frontierResources, hn, hsmall, hdense, ↓reduceIte] at hb
split_ifs at hb
simp only [frontierNormEstimate, hb]
apply congrArg ((d : ℝ)⁻¹ * ·)
apply Finset.sum_congr rfl
intro j _
simp only [hybridColumn, frontierPolynomialEstimate_eq_polynomialEstimate]
rw [hradius]
rfl
theorem frontierNormEstimate_hybrid_mse
Assume the bounded-mean concentration inequality, the Cai–Low Chebyshev approximation theorem, the stated hn condition, the stated hb condition, independent and identically distributed participant records, the causal-model conditions for the data law, an admissible sample size, dimension, and privacy budget, the stated hm condition, the stated l condition, the stated d condition, and the stated hm d condition. The actual hybrid transcript branch inherits its finite calibrated norm MSE.
Formal statement
hypotheses
hMean :
hCheb :
n d :
ℕ
eps :
ℝ
hn :
n ≠ 2
hb :
(frontierResources n d eps).branch = .hybrid
S :
SamplingScheme n d
hIID :
P :
hP :
hAllowed :
Allowed n d eps
hm :
0 < n / 3
hL :
4096 ≤ logDim d
hD :
hmD :
2*(frontierResources n d eps).degree ≤ n / 3
conclusion
(∫ z, (frontierNormEstimate n d eps z - signedNorm (contrast P))^2 ∂Measure.pi (fun i => (observedLaw P).bind (frontierKernel n d eps i)))
≤ 500000000 * sigmaSquared d (n / 3) eps / logDim d
Proof (Lean source)
-- @node: frontierNormEstimate_hybrid_mse
lemma frontierNormEstimate_hybrid_mse
(hMean : BoundedMeanConcentration) (hCheb : CaiLowChebyshevApproximation)
(n d : ℕ) (eps : ℝ) (hn : n ≠ 2)
(hb : (frontierResources n d eps).branch = .hybrid)
(S : SamplingScheme n d) (hIID : IidPeople S)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(hAllowed : Allowed n d eps) (hm : 0 < n / 3) (hL : 4096 ≤ logDim d)
(hD : (frontierResources n d eps).degree = 2*⌊(1/1024 : ℝ)*logDim d/2⌋₊)
(hmD : 2*(frontierResources n d eps).degree ≤ n / 3) :
(∫ z, (frontierNormEstimate n d eps z - signedNorm (contrast P))^2
∂Measure.pi (fun i => (observedLaw P).bind (frontierKernel n d eps i))) ≤
500000000 * sigmaSquared d (n / 3) eps / logDim d := by
simp_rw [frontierNormEstimate_hybrid n d eps hb]
have htransfer := frontierBlocks_integral n d eps hn P
(fun z => ((d : ℝ)⁻¹ * ∑ j, hybridColumn eps
(frontierResources n d eps).degree j z - signedNorm (contrast P))^2)
exact htransfer.le.trans (hybrid_average_mse_bound hMean hCheb S hIID P hP eps
hAllowed hm _ hL hD hmD (by omega))
theorem frontierEstimate_sq_error_le_components
Assume the stated hn condition, the causal-model conditions for the data law, and dimension at least two. Projection and the signed causal bridge reduce value error to baseline and norm errors.
Formal statement
hypotheses
conclusion
(frontierEstimate n d eps (z,(0 : Fin 1),0) - value P)^2
≤ 2*(frontierBaselineEstimate n d eps z - baseline P)^2
+ (1/2 : ℝ)*(frontierNormEstimate n d eps z - signedNorm (contrast P))^2
Proof (Lean source)
-- @node: frontierEstimate_sq_error_le_components
lemma frontierEstimate_sq_error_le_components (n d : ℕ) (eps : ℝ) (hn : n ≠ 2)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(hd : 2 ≤ d) (z : ProtocolTranscript (frontierProtocol n d eps)) :
(frontierEstimate n d eps (z,(0 : Fin 1),0) - value P)^2 ≤
2*(frontierBaselineEstimate n d eps z - baseline P)^2 +
(1/2 : ℝ)*(frontierNormEstimate n d eps z - signedNorm (contrast P))^2 := by
have hv := causal_value_range P hP (by omega)
simp only [frontierEstimate, hn, ↓reduceIte]
apply (twoCell_projection_sq_le _ _ hv).trans
rw [causal_value_decomposition P hP hd]
nlinarith [sq_nonneg ((frontierBaselineEstimate n d eps z - baseline P) -
(frontierNormEstimate n d eps z - signedNorm (contrast P))/2)]
theorem frontier_product_risk_le_components
Assume the stated hn condition, the causal-model conditions for the data law, and dimension at least two. Finite-product value risk is controlled by the two actual component MSEs.
Formal statement
hypotheses
n d :
ℕ
eps :
ℝ
hn :
n ≠ 2
P :
hP :
hd :
2 ≤ d
L :
conclusion
≤ ofReal (2*(∫ z, (frontierBaselineEstimate n d eps z - baseline P)^2 ∂L) + (1/2 : ℝ)*(∫ z, (frontierNormEstimate n d eps z - signedNorm (contrast P))^2 ∂L))
Proof (Lean source)
-- @node: frontier_product_risk_le_components
lemma frontier_product_risk_le_components (n d : ℕ) (eps : ℝ) (hn : n ≠ 2)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(hd : 2 ≤ d) (L : Measure (Fin n → FrontierMessage d)) [IsFiniteMeasure L] :
(∫⁻ z, ofReal ((frontierEstimate n d eps (z,(0 : Fin 1),0) - value P)^2) ∂L) ≤
ofReal (2*(∫ z, (frontierBaselineEstimate n d eps z - baseline P)^2 ∂L) +
(1/2 : ℝ)*(∫ z, (frontierNormEstimate n d eps z - signedNorm (contrast P))^2 ∂L)) := by
calc
_ ≤ ∫⁻ z, ofReal (2*(frontierBaselineEstimate n d eps z - baseline P)^2 +
(1/2 : ℝ)*(frontierNormEstimate n d eps z - signedNorm (contrast P))^2) ∂L := by
apply lintegral_mono
intro z
exact ENNReal.ofReal_le_ofReal (frontierEstimate_sq_error_le_components n d eps hn P hP hd z)
_ = _ := by
rw [← ofReal_integral_eq_lintegral_ofReal (Integrable.of_finite)
(Filter.Eventually.of_forall (fun z => by positivity))]
congr 1
have hB : Integrable (fun z : Fin n → FrontierMessage d =>
2*(frontierBaselineEstimate n d eps z - baseline P)^2) L := Integrable.of_finite
have hF : Integrable (fun z : Fin n → FrontierMessage d =>
(1/2 : ℝ)*(frontierNormEstimate n d eps z - signedNorm (contrast P))^2) L :=
Integrable.of_finite
integral_linearity
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Frontier.ProductPriorConcentration 5 declarations Mean, variance and escape bounds for the half absolute-norm target under independent amplitude-supported coordinates.
Product-prior target concentration
Mean, variance and escape bounds for the half absolute-norm target under independent amplitude-supported coordinates. The causal symmetric target is this statistic plus one half; the paired TV target is this statistic itself.
Assume the stated hnu condition. An amplitude-supported scalar absolute value is square integrable.
Formal statement
Proof (Lean source)
-- @node: amplitudePrior_abs_memLp
lemma amplitudePrior_abs_memLp (a : ℝ) (nu : Measure ℝ)
(hnu : AmplitudePrior a nu) : MemLp (fun u : ℝ => |u|) 2 nu := by
letI := hnu.1
apply MemLp.of_bound (by fun_prop) a
filter_upwards [ae_iff.mpr hnu.2] with u hu
simpa only [Real.norm_eq_abs, abs_abs] using abs_le.mpr hu
theorem productPrior_halfNorm_mean
Assume positive dimension and the stated hnu condition. The half-norm prior mean is one half of the scalar absolute moment.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: productPrior_halfNorm_mean
lemma productPrior_halfNorm_mean (d : ℕ) (hd : 0 < d) (a : ℝ)
(nu : Measure ℝ) (hnu : AmplitudePrior a nu) :
(∫ theta, signedNorm theta / 2 ∂productPrior d nu) =
(∫ u, |u| ∂nu) / 2 := by
letI := hnu.1
have hmem := amplitudePrior_abs_memLp a nu hnu
have hcoord (j : Fin d) :
Integrable (fun theta : Fin d → ℝ => |theta j|) (productPrior d nu) :=
(hmem.comp_measurePreserving (measurePreserving_eval (fun _ : Fin d => nu) j)).integrable
(by norm_num)
have hmean (j : Fin d) :
(∫ theta : Fin d → ℝ, |theta j| ∂productPrior d nu) = ∫ u, |u| ∂nu := by
have hm := (measurePreserving_eval (fun _ : Fin d => nu) j).map_eq
calc
_ = ∫ u, |u| ∂(productPrior d nu).map (fun theta => theta j) :=
(integral_map (φ := fun theta : Fin d → ℝ => theta j)
(f := fun u : ℝ => |u|) (measurable_pi_apply j).aemeasurable
(by fun_prop)).symm
_ = _ := by rw [show (productPrior d nu).map (fun theta => theta j) = nu from hm]
simp only [signedNorm, div_eq_mul_inv]
rw [integral_mul_const, integral_const_mul, integral_finset_sum _ (fun j _ => hcoord j)]
simp only [hmean, Finset.sum_const, Finset.card_univ, Fintype.card_fin, nsmul_eq_mul]
have hd0 : (d : ℝ) ≠ 0 := by exact_mod_cast hd.ne'
field_simp
theorem productPrior_halfNorm_variance
Assume positive dimension and the stated hnu condition. Independence of prior coordinates bounds the half-norm variance by the paper's amplitude-squared over four times the dimension.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: productPrior_halfNorm_variance
lemma productPrior_halfNorm_variance (d : ℕ) (hd : 0 < d) (a : ℝ)
(nu : Measure ℝ) (hnu : AmplitudePrior a nu) :
variance (fun theta => signedNorm theta / 2) (productPrior d nu) ≤ a^2/(4*d) := by
letI := hnu.1
have hmem := amplitudePrior_abs_memLp a nu hnu
have hscalar : variance (fun u : ℝ => |u|) nu ≤ a^2 := by
have hbound : ∀ᵐ u ∂nu, |u| ∈ Icc 0 a := by
filter_upwards [ae_iff.mpr hnu.2] with u hu
exact ⟨abs_nonneg _, abs_le.mpr hu⟩
have hv := variance_le_sq_of_bounded hbound (by fun_prop)
exact hv.trans (by nlinarith [sq_nonneg a])
have heq : (fun theta : Fin d → ℝ => signedNorm theta / 2) =
fun theta => ((d : ℝ)⁻¹ / 2) * ∑ j, |theta j| := by
funext theta
simp only [signedNorm]
ring
rw [heq, variance_const_mul]
have hsum : variance (fun theta : Fin d → ℝ => ∑ j, |theta j|)
(productPrior d nu) = (d : ℝ) * variance (fun u : ℝ => |u|) nu := by
have hv := variance_sum_pi (μ := fun _ : Fin d => nu)
(X := fun _ => fun u : ℝ => |u|) (fun _ => hmem)
convert hv using 1 <;> simp [productPrior]
congr 1
funext theta
simp
rw [hsum]
calc
_ ≤ ((d : ℝ)⁻¹ / 2)^2 * ((d : ℝ) * a^2) :=
mul_le_mul_of_nonneg_left (mul_le_mul_of_nonneg_left hscalar (by positivity))
(sq_nonneg _)
_ = a^2/(4*d) := by
have hd0 : (d : ℝ) ≠ 0 := by exact_mod_cast hd.ne'
field_simp
<;> ring
theorem productPrior_halfNorm_escape
Assume positive dimension, the stated hnu condition, and the stated ht condition. Chebyshev's inequality controls escape from the scalar absolute-moment center under the coordinate product prior.
Formal statement
hypotheses
conclusion
≤ ofReal (a^2 / (4*d*t^2))
Proof (Lean source)
-- @node: productPrior_halfNorm_escape
lemma productPrior_halfNorm_escape (d : ℕ) (hd : 0 < d) (a : ℝ)
(nu : Measure ℝ) (hnu : AmplitudePrior a nu) (t : ℝ) (ht : 0 < t) :
(productPrior d nu) {theta | t ≤ |signedNorm theta / 2 - (∫ u, |u| ∂nu) / 2|} ≤
ofReal (a^2 / (4*d*t^2)) := by
letI := hnu.1
letI : IsProbabilityMeasure (productPrior d nu) := by
unfold productPrior
infer_instance
have hcoord (j : Fin d) : MemLp (fun theta : Fin d → ℝ => |theta j|) 2
(productPrior d nu) :=
(amplitudePrior_abs_memLp a nu hnu).comp_measurePreserving
(measurePreserving_eval (fun _ : Fin d => nu) j)
have hsum := memLp_finsetSum (s := univ) (fun j _ => hcoord j)
have hmem : MemLp (fun theta : Fin d → ℝ => signedNorm theta / 2) 2
(productPrior d nu) := by
simpa only [signedNorm, div_eq_mul_inv] using (hsum.const_mul (d : ℝ)⁻¹).mul_const (2 : ℝ)⁻¹
have hcheb := meas_ge_le_variance_div_sq hmem ht
rw [productPrior_halfNorm_mean d hd a nu hnu] at hcheb
refine hcheb.trans (ENNReal.ofReal_le_ofReal ?_)
calc
_ ≤ (a^2/(4*d)) / t^2 :=
div_le_div_of_nonneg_right (productPrior_halfNorm_variance d hd a nu hnu)
(sq_nonneg _)
_ = _ := by ring
theorem productPrior_halfNorm_gap_escape
Assume positive dimension, the stated hnu condition, and the stated hgap condition. At radius one eighth of a positive target gap, the escape probability is at most sixteen times amplitude squared divided by dimension and gap squared.
Formal statement
hypotheses
conclusion
≤ ofReal (16*a^2/(d*gap^2))
Proof (Lean source)
-- @node: productPrior_halfNorm_gap_escape
lemma productPrior_halfNorm_gap_escape (d : ℕ) (hd : 0 < d) (a : ℝ)
(nu : Measure ℝ) (hnu : AmplitudePrior a nu) (gap : ℝ) (hgap : 0 < gap) :
(productPrior d nu) {theta | gap/8 ≤ |signedNorm theta/2 - (∫ u, |u| ∂nu)/2|} ≤
ofReal (16*a^2/(d*gap^2)) := by
have h := productPrior_halfNorm_escape d hd a nu hnu (gap/8) (by positivity)
convert h using 1 <;> congr 1 <;> ring
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Frontier.Resources 8 declarations The deterministic third split and randomized-response signal bound control the vector noise.
Resource comparisons for the frontier fallback
The deterministic third split and randomized-response signal bound control the vector noise. Comparing its logarithm with the rate logarithm certifies the insufficient-degree fallback without any sampling moment assumptions.
Assume the stated hn condition. The third split used by the frontier has at least one fifth of the people.
Formal statement
hypotheses
n :
ℕ
hn :
3 ≤ n
conclusion
conclusion 1
0 < n / 3
conclusion 2
(n : ℝ)/5 ≤ (n / 3 : ℕ)
Proof (Lean source)
-- @node: frontier_third_block_lower
lemma frontier_third_block_lower (n : ℕ) (hn : 3 ≤ n) :
0 < n / 3 ∧ (n : ℝ)/5 ≤ (n / 3 : ℕ) := by
have hm : 0 < n / 3 := by omega
have hb : n ≤ 5 * (n / 3) := by omega
refine ⟨hm, ?_⟩
have hr : (n : ℝ) ≤ 5 * (n / 3 : ℕ) := by exact_mod_cast hb
linarith
theorem frontier_sigmaSquared_upper
Assume an admissible sample size, dimension, and privacy budget and the stated hn condition. The evaluation-block noise obeys the upper half of equation (11).
Formal statement
hypotheses
conclusion
sigmaSquared d (n / 3) eps ≤ 80 * (d : ℝ) ^ 2/((n : ℝ) * eps ^ 2)
Proof (Lean source)
-- @node: frontier_sigmaSquared_upper
lemma frontier_sigmaSquared_upper (n d : ℕ) (eps : ℝ)
(hAllowed : Allowed n d eps) (hn : n ≠ 2) :
sigmaSquared d (n / 3) eps ≤ 80 * (d : ℝ) ^ 2/((n : ℝ) * eps ^ 2) := by
have hn3 : 3 ≤ n := by have := hAllowed.1; omega
obtain ⟨hm, hb⟩ := frontier_third_block_lower n hn3
have hnp : (0 : ℝ) < n := by exact_mod_cast (by omega : 0 < n)
have hmp : (0 : ℝ) < (n / 3 : ℕ) := by exact_mod_cast hm
have heps := hAllowed.2.2.1
have hdelta := privacyDelta_lower_quarter eps hAllowed.2.2
have hdp : 0 < privacyDelta eps := by linarith
unfold sigmaSquared noiseScale
calc
(d / privacyDelta eps) ^ 2 / (n / 3 : ℕ) ≤
(d / privacyDelta eps) ^ 2 / ((n : ℝ)/5) :=
div_le_div_of_nonneg_left (sq_nonneg _) (by positivity) hb
_ = 80 * (d : ℝ) ^ 2/((n : ℝ) * (4 * privacyDelta eps) ^ 2) := by
field_simp
ring
_ ≤ _ := by
apply div_le_div_of_nonneg_left (by positivity) (by positivity)
apply mul_le_mul_of_nonneg_left _ hnp.le
nlinarith
Assume the stated l condition, the stated hz condition, the stated hs0 condition, and the stated hs condition. A noise inflation of at most eighty inflates the rate logarithm by at most six.
Formal statement
Proof (Lean source)
-- @node: frontier_noise_log_upper
lemma frontier_noise_log_upper (L z s : ℝ) (hL : 0 ≤ L) (hz : 0 ≤ z) (hs0 : 0 ≤ s)
(hs : s * L ≤ 80 * z) :
log (exp 1+s * L) ≤ 6 * log (exp 1+z) := by
have he : 0 < exp 1 := Real.exp_pos _
have hw : 1 ≤ log (exp 1+z) := by
simpa using Real.log_le_log he (show exp 1 ≤ exp 1+z by linarith)
have h80 : log (80 : ℝ) ≤ 5 := by
apply (Real.log_le_iff_le_exp (by norm_num)).mpr
have hp := pow_le_pow_left₀ (by norm_num : (0 : ℝ) ≤ 2.7)
(show (2.7 : ℝ) ≤ exp 1 by linarith [Real.exp_one_gt_d9]) 5
rw [← Real.exp_nat_mul] at hp
norm_num at hp ⊢
linarith
calc
_ ≤ log (80 * (exp 1+z)) :=
Real.log_le_log (by positivity) (by linarith)
_ = log 80 + log (exp 1+z) :=
Real.log_mul (by norm_num) (by positivity)
_ ≤ _ := by linarith
theorem frontier_fallback_rate_lower
Assume an admissible sample size, dimension, and privacy budget, the stated hn condition, the stated hbranch condition, and the stated hfallback condition. The insufficient-degree branch keeps the intermediate rate uniformly positive.
Formal statement
Proof (Lean source)
-- @node: frontier_fallback_rate_lower
lemma frontier_fallback_rate_lower (n d : ℕ) (eps : ℝ)
(hAllowed : Allowed n d eps) (hn : n ≠ 2)
(hbranch : (n : ℝ) * eps ^ 2 < (d : ℝ) ^ 2* logDim d)
(hfallback : logDim d / (1024 *
log (exp 1 + sigmaSquared d (n / 3) eps * logDim d)) < 4) :
(1 / 24576 : ℝ) ^ 2 ≤ rateR .NI n d eps := by
let L := logDim d
let t := (n : ℝ) * eps ^ 2
let z := (d : ℝ) ^ 2* L / t
let w := log (exp 1+z)
let H := log (exp 1+sigmaSquared d (n / 3) eps * L)
have hLp : 0 < L := logDim_pos d hAllowed.2.1
have htp : 0 < t := by
dsimp [t]
have hnpos : (0 : ℝ) < n := by exact_mod_cast (by have := hAllowed.1; omega : 0 < n)
exact mul_pos hnpos (sq_pos_of_pos hAllowed.2.2.1)
have hz : 0 ≤ z := by dsimp [z]; positivity
have hs : 0 ≤ sigmaSquared d (n / 3) eps := by unfold sigmaSquared; positivity
have hHp : 0 < H := by
have hh : 1 ≤ H := by
dsimp [H]
simpa using Real.log_le_log (Real.exp_pos 1)
(show exp 1 ≤ exp 1 + sigmaSquared d (n / 3) eps * L by
nlinarith [mul_nonneg hs hLp.le])
linarith
have hnoise : sigmaSquared d (n / 3) eps * L ≤ 80 * z := by
have hh := mul_le_mul_of_nonneg_right (frontier_sigmaSquared_upper n d eps hAllowed hn) hLp.le
dsimp [z, t]
convert hh using 1 <;> first | rfl | ring
have hH : H ≤ 6 * w := frontier_noise_log_upper L z _ hLp.le hz hs hnoise
have hLH : L < 4096 * H := by
have hh := (div_lt_iff₀ (show 0 < 1024 * H by positivity)).mp hfallback
dsimp [L, H] at *
linarith
have hratio : (1 / 24576 : ℝ) ≤ w / L := by
apply (le_div_iff₀ hLp).mpr
linarith
change rho t d ≥ _
rw [rho, if_neg (not_le.mpr hbranch)]
change _ ≤ (min 1 (w / L)) ^ 2
have hm : (1 / 24576 : ℝ) ≤ min 1 (w / L) := le_min (by norm_num) hratio
exact pow_le_pow_left₀ (by norm_num) hm 2
theorem frontier_smallDim_intermediate_rate_lower
Assume an admissible sample size, dimension, and privacy budget, the stated l condition, and the stated hbranch condition. In the intermediate branch a bounded logarithmic dimension bounds the rate away from zero.
Formal statement
Proof (Lean source)
-- @node: frontier_smallDim_intermediate_rate_lower
lemma frontier_smallDim_intermediate_rate_lower (n d : ℕ) (eps : ℝ)
(hAllowed : Allowed n d eps) (hL : logDim d < 4096)
(hbranch : (n : ℝ) * eps ^ 2 < (d : ℝ) ^ 2 * logDim d) :
(1 / 4096 : ℝ) ^ 2 ≤ rateR .NI n d eps := by
have hLp := logDim_pos d hAllowed.2.1
have hnp : (0 : ℝ) < n := by exact_mod_cast (by have := hAllowed.1; omega : 0 < n)
have htp : 0 < (n : ℝ) * eps ^ 2 := mul_pos hnp (sq_pos_of_pos hAllowed.2.2.1)
have hz : 0 ≤ (d : ℝ) ^ 2 * logDim d / ((n : ℝ) * eps ^ 2) := by positivity
have hw : 1 ≤ log (exp 1 +
(d : ℝ) ^ 2 * logDim d / ((n : ℝ) * eps ^ 2)) := by
simpa using Real.log_le_log (Real.exp_pos 1)
(show exp 1 ≤ exp 1 +
(d : ℝ) ^ 2 * logDim d / ((n : ℝ) * eps ^ 2) by linarith)
have hr : (1 / 4096 : ℝ) ≤ log (exp 1 +
(d : ℝ) ^ 2 * logDim d / ((n : ℝ) * eps ^ 2)) / logDim d := by
apply (le_div_iff₀ hLp).mpr
linarith
unfold rateR rho
rw [if_neg (not_le.mpr hbranch)]
exact pow_le_pow_left₀ (by norm_num) (le_min (by norm_num) hr) 2
Assume the stated hb condition. Reading the branch selector exposes the fallback's two resource inequalities.
Formal statement
hypotheses
Proof (Lean source)
-- @node: frontier_fallback_resources
lemma frontier_fallback_resources (n d : ℕ) (eps : ℝ)
(hb : (frontierResources n d eps).branch = .fallbackQuarter) :
n ≠ 2 ∧ (n : ℝ) * eps ^ 2 < (d : ℝ) ^ 2 * logDim d ∧
logDim d / (1024 * log
(exp 1 + sigmaSquared d (n / 3) eps * logDim d)) < 4 := by
simp only [frontierResources] at hb
split_ifs at hb with hn hL hd hf
exact ⟨hn, lt_of_not_ge hd, hf⟩
theorem frontier_hybrid_resources
Assume an admissible sample size, dimension, and privacy budget, the stated hn condition, the stated l condition, and the stated hdense condition. Dense resources select exactly the calibrated hybrid degree and fit its moments in the evaluation block, as in the upper-bound roadmap.
Formal statement
hypotheses
n d :
ℕ
eps :
ℝ
hAllowed :
Allowed n d eps
hn :
n ≠ 2
hL :
4096 ≤ logDim d
hdense :
(d : ℝ)^2 * logDim d ≤ (n : ℝ) * eps^2
conclusion
conclusion 1
(frontierResources n d eps).branch = .hybrid
conclusion 2
conclusion 3
2*(frontierResources n d eps).degree ≤ n / 3
Proof (Lean source)
-- @node: frontier_hybrid_resources
lemma frontier_hybrid_resources (n d : ℕ) (eps : ℝ)
(hAllowed : Allowed n d eps) (hn : n ≠ 2) (hL : 4096 ≤ logDim d)
(hdense : (d : ℝ)^2 * logDim d ≤ (n : ℝ) * eps^2) :
(frontierResources n d eps).branch = .hybrid ∧
(frontierResources n d eps).degree = 2*⌊(1/1024 : ℝ)*logDim d/2⌋₊ ∧
2*(frontierResources n d eps).degree ≤ n / 3 := by
have hsmall : ¬ logDim d < 4096 := not_lt.mpr hL
have hdegree : (frontierResources n d eps).degree = 2*⌊logDim d/2048⌋₊ := by
simp only [frontierResources, if_pos hdense]
refine ⟨by simp [frontierResources, hn, hsmall, hdense], ?_, ?_⟩
· rw [hdegree]
congr 2
ring
· have hn3 : 3 ≤ n := by have := hAllowed.1; omega
have hblock := (frontier_third_block_lower n hn3).2
have hd : (2 : ℝ) ≤ d := by exact_mod_cast hAllowed.2.1
have hnp : (0 : ℝ) ≤ n := Nat.cast_nonneg _
have ht : (n : ℝ) * eps^2 ≤ n := by
have he2 : eps^2 ≤ 1 := by nlinarith [hAllowed.2.2.1, hAllowed.2.2.2]
nlinarith
have hfloor := Nat.floor_le (show 0 ≤ logDim d / 2048 by linarith)
rw [hdegree]
have hfit : (2 * (2 * ⌊logDim d/2048⌋₊) : ℝ) ≤ (n / 3 : ℕ) := by
have hdim : 4 * logDim d ≤ (d : ℝ)^2 * logDim d :=
mul_le_mul_of_nonneg_right (by nlinarith) (by linarith)
nlinarith
exact_mod_cast hfit
theorem frontier_hybrid_dense_resource_bound
Assume an admissible sample size, dimension, and privacy budget, the stated hn condition, and the stated hdense condition. The calibrated hybrid MSE and binary baseline noise have dense rate order.
Formal statement
hypotheses
n d :
ℕ
eps :
ℝ
hAllowed :
Allowed n d eps
hn :
n ≠ 2
hdense :
(d : ℝ)^2 * logDim d ≤ (n : ℝ) * eps^2
conclusion
24 / ((n : ℝ) * eps^2) + (1/2 : ℝ) * (500000000 * sigmaSquared d (n / 3) eps / logDim d)
≤ (10 : ℝ)^16 * rateR .NI n d eps
Proof (Lean source)
-- @node: frontier_hybrid_dense_resource_bound
lemma frontier_hybrid_dense_resource_bound (n d : ℕ) (eps : ℝ)
(hAllowed : Allowed n d eps) (hn : n ≠ 2)
(hdense : (d : ℝ)^2 * logDim d ≤ (n : ℝ) * eps^2) :
24 / ((n : ℝ) * eps^2) + (1/2 : ℝ) *
(500000000 * sigmaSquared d (n / 3) eps / logDim d) ≤
(10 : ℝ)^16 * rateR .NI n d eps := by
have hLp := logDim_pos d hAllowed.2.1
have hnp : (0 : ℝ) < n := by
exact_mod_cast (by have := hAllowed.1; omega : 0 < n)
have ht := mul_pos hnp (sq_pos_of_pos hAllowed.2.2.1)
have hnoise := frontier_sigmaSquared_upper n d eps hAllowed hn
have hr : rateR .NI n d eps =
(d : ℝ)^2 / (((n : ℝ) * eps^2) * logDim d) := by
simp only [rateR, rho, if_pos hdense]
have hr0 : 0 ≤ rateR .NI n d eps := by rw [hr]; positivity
have hbase : 1 / ((n : ℝ) * eps^2) ≤ rateR .NI n d eps := by
have hLd := (logDim_bounds d hAllowed.2.1).2
have hd : (2 : ℝ) ≤ d := by exact_mod_cast hAllowed.2.1
rw [hr]
apply (div_le_div_iff₀ ht (mul_pos ht hLp)).mpr
have hdim : logDim d ≤ (d : ℝ)^2 := by nlinarith
simpa only [one_mul, mul_comm, mul_left_comm, mul_assoc] using
mul_le_mul_of_nonneg_left hdim ht.le
have hnorm : 500000000 * sigmaSquared d (n / 3) eps / logDim d ≤
40000000000 * rateR .NI n d eps := by
calc
_ ≤ 500000000 * (80 * (d : ℝ)^2 / ((n : ℝ) * eps^2)) / logDim d := by
gcongr
_ = _ := by rw [hr]; ring
calc
_ ≤ 24 * rateR .NI n d eps + (1/2 : ℝ) *
(40000000000 * rateR .NI n d eps) := by
apply add_le_add
· convert mul_le_mul_of_nonneg_left hbase (by norm_num : (0 : ℝ) ≤ 24) using 1 <;> ring
· exact mul_le_mul_of_nonneg_left hnorm (by norm_num)
_ ≤ _ := by nlinarith
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Frontier.Sampling 4 declarations The concrete noninteractive transcript law factors into participant row laws.
Independent message rows in the attaining experiment
The concrete noninteractive transcript law factors into participant row laws. Averaging the iid inputs preserves this product structure, allowing the finite vector-block moment calculations to apply to the actual private transcript.
theorem frontier_fixedTranscriptLaw_product Lemma frontier_fixedTranscriptLaw_product in the paper ↗
For fixed records the concrete transcript consists of independent message rows.
Formal statement
hypotheses
conclusion
fixedTranscriptLaw (frontierProtocol n d eps) o r
= Measure.pi (fun i => frontierKernel n d eps i (o i))
Proof (Lean source)
-- @node: frontier_fixedTranscriptLaw_product
lemma frontier_fixedTranscriptLaw_product (n d : ℕ) (eps : ℝ)
(o : Fin n → ObsRecord d) (r : (frontierProtocol n d eps).Seed) :
fixedTranscriptLaw (frontierProtocol n d eps) o r =
Measure.pi (fun i => frontierKernel n d eps i (o i)) := by
letI : Countable (ProtocolTranscript (frontierProtocol n d eps)) := by
change Countable (Fin n → FrontierMessage d)
infer_instance
haveI : ∀ i, IsProbabilityMeasure (frontierKernel n d eps i (o i)) :=
fun i => (frontierStage_markov n d eps i).isProbabilityMeasure
((o i,r), fun _ => (false,fun _ => false))
change (fixedTranscriptLaw (frontierProtocol n d eps) o r :
Measure (Fin n → FrontierMessage d)) = _
apply Measure.ext_of_singleton
intro z
change Fin n → FrontierMessage d at z
erw [Measure.pi_singleton]
exact transcriptLaw_singleton
(frontierProtocol n d eps).kernels (frontierProtocol n d eps).markov
(fun i => (o i,r)) z
Averaging independent input records preserves the product of private row laws.
Formal statement
hypotheses
conclusion
(Measure.pi (fun _ : Fin n => mu)).bind (fun o => fixedTranscriptLaw (frontierProtocol n d eps) o r)
= Measure.pi (fun i => mu.bind (frontierKernel n d eps i))
Proof (Lean source)
-- @node: frontier_iidTranscriptLaw_product
lemma frontier_iidTranscriptLaw_product (n d : ℕ) (eps : ℝ)
(mu : Measure (ObsRecord d)) [IsProbabilityMeasure mu]
(r : (frontierProtocol n d eps).Seed) :
(Measure.pi (fun _ : Fin n => mu)).bind
(fun o => fixedTranscriptLaw (frontierProtocol n d eps) o r) =
Measure.pi (fun i => mu.bind (frontierKernel n d eps i)) := by
classical
letI : Countable (ProtocolTranscript (frontierProtocol n d eps)) := by
change Countable (Fin n → FrontierMessage d)
infer_instance
letI : MeasurableSingletonClass (ProtocolTranscript (frontierProtocol n d eps)) := by
change MeasurableSingletonClass (Fin n → FrontierMessage d)
infer_instance
haveI : ∀ i, IsMarkovKernel (frontierKernel n d eps i) := by
intro i
exact ⟨fun o => (frontierStage_markov n d eps i).isProbabilityMeasure
((o,r), fun _ => (false,fun _ => false))⟩
haveI : ∀ i, IsProbabilityMeasure (mu.bind (frontierKernel n d eps i)) :=
fun i => isProbabilityMeasure_bind (frontierKernel n d eps i).measurable.aemeasurable
(Filter.Eventually.of_forall (fun _ => inferInstance))
apply Measure.ext_of_singleton
intro z
change Fin n → FrontierMessage d at z
erw [Measure.bind_apply (measurableSet_singleton z)
((measurable_fixedTranscriptLaw (frontierProtocol n d eps)).comp
(show Measurable (fun o : Fin n → ObsRecord d => (o,r)) by fun_prop)).aemeasurable,
Measure.pi_singleton]
simp only [frontier_fixedTranscriptLaw_product]
change (∫⁻ o, (Measure.pi (fun i => frontierKernel n d eps i (o i))) {z} ∂Measure.pi (fun _ : Fin n => mu)) = _
simp_rw [ Measure.pi_singleton,
Measure.bind_apply (measurableSet_singleton _) (Kernel.measurable _).aemeasurable]
simp_rw [lintegral_fintype, Measure.pi_singleton]
simp_rw [← Finset.prod_mul_distrib]
exact (Fintype.prod_sum (fun i o => frontierKernel n d eps i o {z i} * mu {o})).symm
theorem frontier_sampling_transcript_product
Assume independent and identically distributed participant records, independent protocol randomness, and the causal-model conditions for the data law. The actual sampling decision law has the independent averaged message-row marginal.
Formal statement
hypotheses
conclusion
= Measure.pi (fun i => (observedLaw P).bind (frontierKernel n d eps i))
Proof (Lean source)
-- @node: frontier_sampling_transcript_product
lemma frontier_sampling_transcript_product (n d : ℕ) (eps : ℝ)
(S : SamplingScheme n d) (hIID : IidPeople S) (hRandom : IndependentRandomness S)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P) :
(decisionLaw S (frontierProtocol n d eps) P).map
(fun w => w.1) =
Measure.pi (fun i => (observedLaw P).bind (frontierKernel n d eps i)) := by
haveI : IsProbabilityMeasure (observedLaw P) :=
Measure.isProbabilityMeasure_map (show Measurable observe by fun_prop).aemeasurable
apply Measure.ext
intro E hE
erw [Measure.map_apply measurable_fst hE]
have hpre : (fun w : DecisionSpace (frontierProtocol n d eps) => w.1) ⁻¹' E =
E ×ˢ univ ×ˢ univ := by ext w; simp
rw [hpre]
unfold decisionLaw
rw [iid_sampling_inputLaw S hIID hRandom (frontierProtocol n d eps) P hP,
product_decisionRows_rectangle _ _ E univ univ hE
MeasurableSet.univ MeasurableSet.univ]
simp only [Set.indicator_univ, frontier_fixedTranscriptLaw_product]
simp only [lintegral_const, measure_univ, mul_one, uniform01,
Measure.restrict_apply MeasurableSet.univ, Set.univ_inter, Real.volume_Icc]
have hmix := congrArg (fun L => L E)
(frontier_iidTranscriptLaw_product n d eps (observedLaw P) (0 : Fin 1))
erw [Measure.bind_apply hE
((measurable_fixedTranscriptLaw (frontierProtocol n d eps)).comp
(show Measurable (fun o : Fin n → ObsRecord d => (o,(0 : Fin 1))) by fun_prop)).aemeasurable]
at hmix
simp only [frontier_fixedTranscriptLaw_product] at hmix
norm_num only [sub_zero, ENNReal.ofReal_one, mul_one]
exact hmix
theorem frontierEstimator_risk_product
Assume independent and identically distributed participant records, independent protocol randomness, and the causal-model conditions for the data law. The risk of the actual transcript-only frontier estimate is a finite product-law integral.
Formal statement
hypotheses
conclusion
= ∫⁻ z : Fin n → FrontierMessage d, ofReal ((frontierEstimate n d eps (z,(0 : Fin 1),0) - value P)^2) ∂Measure.pi (fun i => (observedLaw P).bind (frontierKernel n d eps i))
Proof (Lean source)
-- @node: frontierEstimator_risk_product
lemma frontierEstimator_risk_product (n d : ℕ) (eps : ℝ)
(S : SamplingScheme n d) (hIID : IidPeople S) (hRandom : IndependentRandomness S)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P) :
squaredRisk (decisionLaw S (frontierProtocol n d eps) P)
(frontierEstimator n d eps) (value P) =
∫⁻ z : Fin n → FrontierMessage d,
ofReal ((frontierEstimate n d eps (z,(0 : Fin 1),0) - value P)^2)
∂Measure.pi (fun i => (observedLaw P).bind (frontierKernel n d eps i)) := by
let f : ProtocolTranscript (frontierProtocol n d eps) → ℝ≥0∞ := fun z =>
ofReal ((frontierEstimate n d eps (z,(0 : Fin 1),0) - value P)^2)
have hf : Measurable f := by
letI : Countable (ProtocolTranscript (frontierProtocol n d eps)) := by
change Countable (Fin n → FrontierMessage d)
infer_instance
letI : MeasurableSingletonClass (ProtocolTranscript (frontierProtocol n d eps)) := by
change MeasurableSingletonClass (Fin n → FrontierMessage d)
infer_instance
exact measurable_of_countable f
have htrans := frontier_sampling_transcript_product n d eps S hIID hRandom P hP
change _ = ∫⁻ z, f z ∂Measure.pi (fun i => (observedLaw P).bind (frontierKernel n d eps i))
rw [← htrans]
erw [lintegral_map hf measurable_fst]
unfold squaredRisk
apply lintegral_congr
intro w
rfl
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Frontier.Upper 37 declarations Finite original-record private value frontiers: Helpers/Frontier/Upper.
Helpers/Frontier/Upper
Finite original-record private value frontiers: Helpers/Frontier/Upper.
inductive FrontierBranch
Explicit fallback and polynomial branches of the attaining construction.
Definition (Lean source)
inductive FrontierBranch where
| constant | absMean | hybrid | fallbackQuarter | globalPoly
deriving DecidableEq
instance instDecidableEqFrontierBranch
Equality of the explicit frontier-construction branches is decidable.
Definition (Lean source)
deriving DecidableEq
Resource-selected design including converse amplitude and matching degree.
Definition (Lean source)
fields
m :
ℕ
m0 :
ℕ
branch :
degree :
ℕ
threshold :
ℝ
radius :
ℝ
converseAmp :
ℝ
converseDegree :
ℕ
def frontierResources
Fix the sample size and the dimension and the privacy budget. Fixed public-resource choices: the first applicable branch is used, with the constants and rounding rules of the frozen construction. In the n=2 branch the block and polynomial entries are unused by the constant estimator.
Definition (Lean source)
parameters
n d :
ℕ
eps :
ℝ
def
given by
m :
n/3
m0 :
n - 2*m
L :
logDim d
t :
n*eps^2
sigma2 :
sigmaSquared d m eps
z :
(d : ℝ)^2 * L / t
dense :
(d : ℝ)^2 * L ≤ t
{ m := m, m0 := m0, branch := if n = 2 then .constant else if L < 4096 then .absMean else if dense then .hybrid else if L/(1024*H) < 4 then .fallbackQuarter else .globalPoly, degree := if dense then 2*⌊L/2048⌋₊ else 2*⌊L/(2048*H)⌋₊, threshold := 4*sqrt sigma2*sqrt L, radius := if dense then 8*sqrt sigma2*sqrt L else 1/2, converseAmp := if z ≤ 1 then (1/100 : ℝ)*sqrt z else 1/100, converseDegree := if z ≤ 1 then 2*⌈16*L⌉₊+1 else 2*⌈16*L/w⌉₊+1 }
def FrontierMessage
Fix the dimension. Combined binary/vector message alphabet.
def frontierMass
Fix the sample size and the dimension, the privacy budget, the participant index, the observed participant record, and the parameter z. Original-input participant-specific finite atom channel.
Definition (Lean source)
parameters
def
frontierMass n d eps i o z :
ℝ
given by
if n
= 2 then if z = (false,fun _ => false) then 1 else 0 else if i.val < (frontierResources n d eps).m0 then (1+privacyDelta eps*signVal o.2.2*signVal z.1)/2 * (if z.2 = (fun _ => false) then 1 else 0) else vectorMass eps o z.2 * (if z.1 = false then 1 else 0)
def frontierKernel
Fix the sample size and the dimension, the privacy budget, and the participant index. Finite participant channel ignoring histories.
Definition (Lean source)
def frontierStageKernel
Fix the sample size and the dimension, the privacy budget, and the participant index. Participant stage with ignored histories.
Definition (Lean source)
parameters
def
frontierStageKernel n d eps i :
Kernel ((ObsRecord d × Fin 1) × History (fun _ : Fin n => FrontierMessage d) i.val (le_of_lt i.isLt)) (FrontierMessage d)
given by
(frontierKernel n d eps i).comap (fun w => w.1.1) (measurable_fst.comp measurable_fst)
Binary randomized-response masses are nonnegative.
Formal statement
Proof (Lean source)
-- @node: binaryOutcomeMass_nonneg
lemma binaryOutcomeMass_nonneg (eps : ℝ) (y z : Bool) :
0 ≤ (1 + privacyDelta eps * signVal y * signVal z)/2 := by
have hlo := (abs_lt.mp (Real.abs_tanh_lt_one (eps/2))).1
have hhi := (abs_lt.mp (Real.abs_tanh_lt_one (eps/2))).2
unfold privacyDelta signVal
cases y <;> cases z <;> norm_num <;> linarith
The two binary response probabilities sum to one.
Formal statement
hypotheses
eps :
ℝ
y :
conclusion
Proof (Lean source)
-- @node: binaryOutcomeMass_sum
lemma binaryOutcomeMass_sum (eps : ℝ) (y : Bool) :
∑ z : Bool, (1 + privacyDelta eps * signVal y * signVal z)/2 = 1 := by
simp only [Fintype.sum_bool, signVal, Bool.false_eq_true, ↓reduceIte]
ring
The binary outcome channel is a probability kernel.
Formal statement
Proof (Lean source)
-- @node: binaryOutcomeKernel_markov
lemma binaryOutcomeKernel_markov (d : ℕ) (eps : ℝ) :
IsMarkovKernel (binaryOutcomeKernel d eps) := by
constructor
intro o
constructor
change atomLaw _ univ = 1
simp only [atomLaw, Measure.finsetSum_apply, MeasurableSet.univ,
Measure.smul_apply, Measure.dirac_apply_of_mem, Set.mem_univ, smul_eq_mul, mul_one]
rw [← ENNReal.ofReal_sum_of_nonneg (fun z _ => binaryOutcomeMass_nonneg eps o.2.2 z),
binaryOutcomeMass_sum]
simp
Stage Markov certificate.
Formal statement
Proof (Lean source)
-- @node: frontierStage_markov
lemma frontierStage_markov (n d : ℕ) (eps : ℝ) (i : Fin n) :
IsMarkovKernel (frontierStageKernel n d eps i) := by
classical
have hm : ∀ o z, 0 ≤ frontierMass n d eps i o z := by
intro o z
unfold frontierMass
split
· split <;> positivity
· split
· exact mul_nonneg (binaryOutcomeMass_nonneg eps o.2.2 z.1) (by split <;> positivity)
· exact mul_nonneg (vectorMass_nonneg eps o z.2) (by split <;> positivity)
have hs : ∀ o, ∑ z, frontierMass n d eps i o z = 1 := by
intro o
unfold frontierMass
by_cases hn : n = 2
· simp [hn]
· simp only [hn, ↓reduceIte]
by_cases hi : i.val < (frontierResources n d eps).m0
· simp only [hi, ↓reduceIte]
rw [Fintype.sum_prod_type]
simp only [← Finset.mul_sum]
simpa [Fintype.sum_bool] using binaryOutcomeMass_sum eps o.2.2
· simp only [hi, ↓reduceIte]
rw [Fintype.sum_prod_type]
simp [vectorMass_sum]
have hk : IsMarkovKernel (frontierKernel n d eps i) := by
constructor
intro o
constructor
change atomLaw _ univ = 1
simp only [atomLaw, Measure.finsetSum_apply, MeasurableSet.univ,
Measure.smul_apply, Measure.dirac_apply_of_mem, Set.mem_univ, smul_eq_mul, mul_one]
rw [← ENNReal.ofReal_sum_of_nonneg (fun z _ => hm o z), hs]
simp
letI := hk
unfold frontierStageKernel
infer_instance
def frontierProtocol
Fix the sample size and the dimension and the privacy budget. Explicit noninteractive original-record attaining protocol.
Definition (Lean source)
parameters
n d :
ℕ
eps :
ℝ
def
given by
clause 1
Seed := Fin 1
clause 2
seedMeasurable := inferInstance
clause 3
seedStandard := inferInstance
clause 4
seedLaw := Measure.dirac 0
clause 5
seedProbability := inferInstance
clause 6
Message := fun _ => FrontierMessage d
clause 7
messageMeasurable := fun _ => inferInstance
clause 8
messageStandard := fun _ => inferInstance
clause 9
kernels := frontierStageKernel n d eps
clause 10
markov := frontierStage_markov n d eps
def messageAt
Fix the protocol transcript and the participant index. Safe extraction from a finite transcript, returning a fixed unused message past the horizon.
Definition (Lean source)
parameters
def
def frontierBlock
Fix the sample size and the dimension, the privacy budget, the natural-number parameter offset, and the protocol transcript. Scaled vector block extracted from a transcript.
Definition (Lean source)
parameters
given by
fun i => (messageAt z (offset+i.val)).2
def frontierPolynomialEstimate
Fix the privacy budget and the amplitude, the natural-number parameter D, the coordinate index, and the function z. Finite polynomial computation using the prescribed elementary-symmetric recursion.
Definition (Lean source)
parameters
def
frontierPolynomialEstimate eps a D j z :
ℝ
given by
∑ v ∈ range (D+1), (chebyshevAbsPoly D).coeff v * a^((1 : ℤ) - (v : ℤ)) * ((Nat.choose m v : ℝ)⁻¹ * elementaryMoment (fun i => if hi : i < m then scaledMessages eps z ⟨i,hi⟩ j else 0) m v)
def frontierNormEstimate
Fix the sample size and the dimension, the privacy budget, and the protocol transcript. Raw norm estimate from the chosen pilot/evaluation branch.
Definition (Lean source)
parameters
def
frontierNormEstimate n d eps z :
ℝ
given by
design :
frontierResources n d eps
pilot :
frontierBlock n d eps design.m0 z
eval :
frontierBlock n d eps (design.m0+design.m) z
match design.branch with | .constant
=> 0 | .fallbackQuarter => 1/4 | .absMean => (d : ℝ)⁻¹ * ∑ j, |scaledColumnMean eps j eval| | .globalPoly => (d : ℝ)⁻¹ * ∑ j, frontierPolynomialEstimate eps design.radius design.degree j eval | .hybrid => (d : ℝ)⁻¹ * ∑ j, let M := scaledColumnMean eps j pilot if |M| ≤ design.threshold then frontierPolynomialEstimate eps design.radius design.degree j eval else (if 0 < M then 1 else if M < 0 then -1 else 0) * scaledColumnMean eps j eval
def frontierBaselineEstimate
Fix the sample size and the dimension, the privacy budget, and the protocol transcript. Fresh-person randomized-response estimate of the baseline.
Definition (Lean source)
def frontierEstimate
Fix the sample size and the dimension, the privacy budget, and the protocol decision. Projected causal estimator using only private messages.
Definition (Lean source)
parameters
def
frontierEstimate n d eps w :
ℝ
given by
if n
= 2 then 1/2 else max (1/4) (min (3/4) (frontierBaselineEstimate n d eps w.1 + frontierNormEstimate n d eps w.1/2))
Measurability of the concrete finite transcript estimate.
Formal statement
Proof (Lean source)
-- @node: frontierEstimate_measurable
lemma frontierEstimate_measurable (n d : ℕ) (eps : ℝ) :
Measurable (frontierEstimate n d eps) := by
classical
letI : Countable (ProtocolTranscript (frontierProtocol n d eps)) := by
change Countable (Fin n → FrontierMessage d)
infer_instance
letI : MeasurableSingletonClass (ProtocolTranscript (frontierProtocol n d eps)) := by
change MeasurableSingletonClass (Fin n → FrontierMessage d)
infer_instance
let f : ProtocolTranscript (frontierProtocol n d eps) → ℝ :=
fun z => frontierEstimate n d eps (z, (0 : Fin 1), 0)
have hf : Measurable f := measurable_of_countable f
exact hf.comp measurable_fst
def frontierEstimator
Fix the sample size and the dimension and the privacy budget. Attaining Borel estimator packaged without any unproved definitional payload.
Definition (Lean source)
parameters
n d :
ℕ
eps :
ℝ
def
given by
⟨frontierEstimate n d eps, frontierEstimate_measurable n d eps⟩
def frontierHonestyRadius
Fix the sample size and the dimension and the privacy budget. The fixed honesty radius prescribed for every branch, including n=2.
Definition (Lean source)
parameters
n d :
ℕ
eps :
ℝ
def
frontierHonestyRadius n d eps :
ℝ
given by
sqrt ((10 : ℝ)^17 * rho (n * eps^2) d)
def frontierLo
Fix the sample size and the dimension, the privacy budget, and the protocol decision. Lower endpoint with the prescribed fixed honesty radius.
Definition (Lean source)
parameters
def
frontierLo n d eps w :
ℝ
given by
def frontierHi
Fix the sample size and the dimension, the privacy budget, and the protocol decision. Upper endpoint of the concrete connected interval.
Definition (Lean source)
parameters
def
frontierHi n d eps w :
ℝ
given by
Endpoint regularity and range certificate for the actual interval.
Formal statement
hypotheses
n d :
ℕ
eps :
ℝ
Proof (Lean source)
-- @node: frontier_interval_certificate
lemma frontier_interval_certificate (n d : ℕ) (eps : ℝ) :
Measurable (frontierLo n d eps) ∧ Measurable (frontierHi n d eps) ∧
(∀ w, frontierLo n d eps w ≤ frontierHi n d eps w) ∧
(∀ w, frontierLo n d eps w ∈ Icc (1/4 : ℝ) (3/4)) ∧
(∀ w, frontierHi n d eps w ∈ Icc (1/4 : ℝ) (3/4)) := by
have hm := frontierEstimate_measurable n d eps
have hrad : 0 ≤ frontierHonestyRadius n d eps := Real.sqrt_nonneg _
have hrange : ∀ w, frontierEstimate n d eps w ∈ Icc (1/4 : ℝ) (3/4 : ℝ) := by
intro w
dsimp [frontierEstimate]
split_ifs
· norm_num
· exact ⟨le_max_left _ _, max_le (by norm_num) (min_le_left _ _)⟩
refine ⟨?_, ?_, ?_, ?_, ?_⟩
· change Measurable (fun w =>
max (1/4) (frontierEstimate n d eps w - frontierHonestyRadius n d eps))
fun_prop
· change Measurable (fun w =>
min (3/4) (frontierEstimate n d eps w + frontierHonestyRadius n d eps))
fun_prop
· intro w
have hw := hrange w
dsimp [frontierLo, frontierHi]
apply max_le
· apply le_min
· norm_num
· linarith [hw.1]
· apply le_min
· linarith [hw.2]
· linarith
· intro w
have hw := hrange w
change (1/4 : ℝ) ≤
max (1/4 : ℝ) (frontierEstimate n d eps w - frontierHonestyRadius n d eps) ∧ _
exact ⟨le_max_left _ _, max_le (by norm_num) (by linarith [hw.2])⟩
· intro w
have hw := hrange w
change (1/4 : ℝ) ≤
min (3/4 : ℝ) (frontierEstimate n d eps w + frontierHonestyRadius n d eps) ∧ _
exact ⟨le_min (by norm_num) (by linarith [hw.1]), min_le_left _ _⟩
def frontierInterval
Fix the sample size and the dimension and the privacy budget. The resource-selected closed connected interval.
Definition (Lean source)
parameters
n d :
ℕ
eps :
ℝ
def
given by
{ lo := frontierLo n d eps, hi := frontierHi n d eps, measurable_lo := (frontier_interval_certificate n d eps).1, measurable_hi := (frontier_interval_certificate n d eps).2.1, ordered := (frontier_interval_certificate n d eps).2.2.1, range_lo := (frontier_interval_certificate n d eps).2.2.2.1, range_hi := (frontier_interval_certificate n d eps).2.2.2.2 }
Fix the sample size and the dimension. Data of the fixed constructive and converse handle. Kernel normalization, Borel decisions and interval range are typing obligations; privacy, moment identities, risk and global honesty are proved later rather than defining membership. The prior maps are applied to the symmetric moment-duality measures at degree k-1.
Definition (Lean source)
parameters
n d :
ℕ
fields
resources :
protocol :
LocalProtocol n (ObsRecord d)
estimator :
Estimator protocol
interval :
IntervalDecision protocol (1/4) (3/4)
causalLaw :
def frontierDesign
Fix the sample size and the dimension and the privacy budget. The fixed original-input construction for the public tuple (n,d,ε): singleton seed, binary baseline and two disjoint sign-vector blocks, transcript-only clipped estimate, fixed-radius connected interval, and scaled coordinate product priors. Selection is deterministic in public resources, by the ordered branches of frontierResources; there is no optimization over designs. Admissibility, calibration, risk and coverage are subsequent construction obligations, not assumed performance fields of this mathematical object.
Definition (Lean source)
parameters
n d :
ℕ
eps :
ℝ
def
given by
resources :
frontierResources n d eps
scaled :
fun xi : Measure ℝ => xi.map (fun u => resources.converseAmp * u)
{ resources := resources, protocol := frontierProtocol n d eps, estimator := frontierEstimator n d eps, interval := frontierInterval n d eps, scaledPrior := scaled, productPrior := fun xi => Measure.pi (fun _ : Fin d => scaled xi), causalLaw := symmetricLaw }
Assume a nonnegative privacy budget. The binary outcome response obeys the same extreme-sign ratio as the vector release.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: binaryOutcomeMass_privacy
lemma binaryOutcomeMass_privacy (eps : ℝ) (heps : 0 ≤ eps) (y y' z : Bool) :
(1 + privacyDelta eps * signVal y * signVal z)/2 ≤
exp eps * ((1 + privacyDelta eps * signVal y' * signVal z)/2) := by
have hd := (privacyDelta_bounds eps heps).1
have hs : ∀ b : Bool, -privacyDelta eps ≤ privacyDelta eps * signVal b * signVal z ∧
privacyDelta eps * signVal b * signVal z ≤ privacyDelta eps := by
intro b
cases b <;> cases z <;> norm_num [signVal] <;> linarith
have hh : 1 + privacyDelta eps * signVal y * signVal z ≤
exp eps * (1 + privacyDelta eps * signVal y' * signVal z) := by
calc
_ ≤ 1 + privacyDelta eps := by linarith [(hs y).2]
_ = exp eps * (1 - privacyDelta eps) := privacyDelta_odds_identity eps
_ ≤ _ := mul_le_mul_of_nonneg_left (by linarith [(hs y').1]) (Real.exp_pos eps).le
linarith
Assume a nonnegative privacy budget. Each branch of the combined finite message channel satisfies the atomwise privacy bound.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: frontierMass_privacy
lemma frontierMass_privacy (n d : ℕ) (eps : ℝ) (heps : 0 ≤ eps)
(i : Fin n) (o o' : ObsRecord d) (z : FrontierMessage d) :
frontierMass n d eps i o z ≤ exp eps * frontierMass n d eps i o' z := by
have he : 1 ≤ exp eps := Real.one_le_exp_iff.mpr heps
unfold frontierMass
by_cases hn : n = 2
· simp only [hn, ↓reduceIte]
split_ifs <;> simpa using he
· simp only [hn, ↓reduceIte]
by_cases hi : i.val < (frontierResources n d eps).m0
· simp only [hi, ↓reduceIte]
split_ifs
· simpa using binaryOutcomeMass_privacy eps heps o.2.2 o'.2.2 z.1
· simp
· simp only [hi, ↓reduceIte]
split_ifs
· simpa using vectorMass_privacy eps heps o o' z.2
· simp
Assume a nonnegative privacy budget. Summing the finite atom inequalities proves privacy for every message event.
Formal statement
hypotheses
conclusion
frontierKernel n d eps i o E
Proof (Lean source)
-- @node: frontierKernel_privacy
lemma frontierKernel_privacy (n d : ℕ) (eps : ℝ) (heps : 0 ≤ eps)
(i : Fin n) (o o' : ObsRecord d) (E : Set (FrontierMessage d)) :
frontierKernel n d eps i o E ≤
ofReal (exp eps) * frontierKernel n d eps i o' E := by
classical
change (atomLaw (frontierMass n d eps i o)) E ≤
ofReal (exp eps) * (atomLaw (frontierMass n d eps i o')) E
simp only [atomLaw, Measure.finsetSum_apply, Measure.smul_apply, smul_eq_mul,
Finset.mul_sum]
apply Finset.sum_le_sum
intro z _
rw [← mul_assoc, ← ENNReal.ofReal_mul (Real.exp_pos eps).le]
simpa only [mul_comm] using
mul_le_mul_right (ENNReal.ofReal_le_ofReal (frontierMass_privacy n d eps heps i o o' z))
((Measure.dirac z) E)
theorem frontierProtocol_noninteractive
Assume a nonnegative privacy budget. The entire resource-selected original-input procedure is noninteractive and pure private.
Formal statement
hypotheses
n d :
ℕ
eps :
ℝ
heps :
0 ≤ eps
conclusion
NoninteractiveClass (frontierProtocol n d eps) eps
Proof (Lean source)
-- @node: frontierProtocol_noninteractive
lemma frontierProtocol_noninteractive (n d : ℕ) (eps : ℝ) (heps : 0 ≤ eps) :
NoninteractiveClass (frontierProtocol n d eps) eps := by
constructor
· intro i o o' eta r E _
exact frontierKernel_privacy n d eps heps i o o' E
· intro i o eta eta' r
rfl
Clipping the endpoints can only shorten the fixed-radius interval.
Formal statement
hypotheses
conclusion
≤ 2 * frontierHonestyRadius n d eps
Proof (Lean source)
-- @node: frontierInterval_length_le
lemma frontierInterval_length_le (n d : ℕ) (eps : ℝ)
(w : DecisionSpace (frontierProtocol n d eps)) :
intervalLength ((frontierInterval n d eps).lo w)
((frontierInterval n d eps).hi w) ≤ 2 * frontierHonestyRadius n d eps := by
have hr := Real.sqrt_nonneg ((10 : ℝ)^17 * rho (n * eps^2) d)
change max 0 (min (3/4) (frontierEstimate n d eps w + frontierHonestyRadius n d eps) -
max (1/4) (frontierEstimate n d eps w - frontierHonestyRadius n d eps)) ≤ _
apply max_le
· exact mul_nonneg (by norm_num) hr
· have hu := min_le_right (3/4 : ℝ) (frontierEstimate n d eps w + frontierHonestyRadius n d eps)
have hl := le_max_right (1/4 : ℝ) (frontierEstimate n d eps w - frontierHonestyRadius n d eps)
linarith
Integrating the deterministic length bound requires only that the decision law be a probability.
Formal statement
hypotheses
conclusion
expectedLength L (frontierInterval n d eps)
≤ ofReal (2 * frontierHonestyRadius n d eps)
Proof (Lean source)
-- @node: frontierInterval_expectedLength_le
lemma frontierInterval_expectedLength_le (n d : ℕ) (eps : ℝ)
(L : Measure (DecisionSpace (frontierProtocol n d eps))) [IsProbabilityMeasure L] :
expectedLength L (frontierInterval n d eps) ≤
ofReal (2 * frontierHonestyRadius n d eps) := by
unfold expectedLength
calc
_ ≤ ∫⁻ _w, ofReal (2 * frontierHonestyRadius n d eps) ∂L :=
lintegral_mono (fun w => ENNReal.ofReal_le_ofReal (frontierInterval_length_le n d eps w))
_ = _ := by simp
theorem frontierInterval_rate_length
The interval radius has exactly the prescribed square-root rate, for all resource tuples.
Formal statement
hypotheses
conclusion
expectedLength L (frontierInterval n d eps)
Proof (Lean source)
-- @node: frontierInterval_rate_length
lemma frontierInterval_rate_length (n d : ℕ) (eps : ℝ)
(L : Measure (DecisionSpace (frontierProtocol n d eps))) [IsProbabilityMeasure L] :
expectedLength L (frontierInterval n d eps) ≤
ofReal (sqrt (40 * (10 : ℝ)^16) * rateH .NI n d eps) := by
have hs : 2 * sqrt ((10 : ℝ)^17) = sqrt (40 * (10 : ℝ)^16) := by
rw [← Real.sqrt_sq (by norm_num : (0 : ℝ) ≤ 2), ← Real.sqrt_mul (by norm_num)]
congr 1
norm_num
have heq : 2 * frontierHonestyRadius n d eps =
sqrt (40 * (10 : ℝ)^16) * rateH .NI n d eps := by
dsimp [frontierHonestyRadius, rateH, rateR]
rw [Real.sqrt_mul (by positivity), ← mul_assoc, hs]
rw [← heq]
exact frontierInterval_expectedLength_le n d eps L
theorem causal_value_range
Assume the causal-model conditions for the data law and positive dimension. The causal target lies in the interval's fixed output domain.
Formal statement
hypotheses
conclusion
value P ∈ Icc (1/4 : ℝ) (3/4)
Proof (Lean source)
-- @node: causal_value_range
lemma causal_value_range (P : Measure (FullRecord d)) (hP : CausalModel P) (hd : 0 < d) :
value P ∈ Icc (1/4 : ℝ) (3/4) := by
have hdR : (0 : ℝ) < d := by exact_mod_cast hd
have hcell : ∀ j : Fin d, max (armMean P false j) (armMean P true j) ∈
Icc (1/4 : ℝ) (3/4) := by
intro j
exact ⟨(hP.interior false j).1.trans (le_max_left _ _),
max_le (hP.interior false j).2 (hP.interior true j).2⟩
have hlo : ∑ _j : Fin d, (1/4 : ℝ) ≤ ∑ j, max (armMean P false j) (armMean P true j) :=
Finset.sum_le_sum (fun j _ => (hcell j).1)
have hhi : ∑ j : Fin d, max (armMean P false j) (armMean P true j) ≤ ∑ _j : Fin d, (3/4 : ℝ) :=
Finset.sum_le_sum (fun j _ => (hcell j).2)
simp only [Finset.sum_const, Finset.card_univ, Fintype.card_fin, nsmul_eq_mul] at hlo hhi
change (1/4 : ℝ) ≤ (d : ℝ)⁻¹ * _ ∧ (d : ℝ)⁻¹ * _ ≤ (3/4 : ℝ)
constructor
· calc
(1/4 : ℝ) = (d : ℝ)⁻¹ * ((d : ℝ) * (1/4)) := by field_simp
_ ≤ _ := mul_le_mul_of_nonneg_left hlo (inv_nonneg.mpr hdR.le)
· calc
_ ≤ (d : ℝ)⁻¹ * ((d : ℝ) * (3/4)) := mul_le_mul_of_nonneg_left hhi (inv_nonneg.mpr hdR.le)
_ = (3/4 : ℝ) := by field_simp
theorem frontierInterval_coverage_of_risk
Assume an admissible sample size, dimension, and privacy budget, the stated hv condition, and the estimator hRisk. Markov's inequality converts the finite MSE bound into ninety-percent coverage.
Formal statement
hypotheses
n d :
ℕ
eps :
ℝ
hAllowed :
Allowed n d eps
L :
v :
ℝ
hv :
v ∈ Icc (1/4 : ℝ) (3/4)
hRisk :
squaredRisk L (frontierEstimator n d eps) v
conclusion
(0.90 : ℝ) ≤ coverage L (frontierInterval n d eps) v
Proof (Lean source)
-- @node: frontierInterval_coverage_of_risk
lemma frontierInterval_coverage_of_risk (n d : ℕ) (eps : ℝ) (hAllowed : Allowed n d eps)
(L : Measure (DecisionSpace (frontierProtocol n d eps))) [IsProbabilityMeasure L]
(v : ℝ) (hv : v ∈ Icc (1/4 : ℝ) (3/4))
(hRisk : squaredRisk L (frontierEstimator n d eps) v ≤
ofReal ((10 : ℝ)^16 * rateR .NI n d eps)) :
(0.90 : ℝ) ≤ coverage L (frontierInterval n d eps) v := by
let q := frontierHonestyRadius n d eps
have hn : (0 : ℝ) < n := by exact_mod_cast (by have := hAllowed.1; omega : 0 < n)
have ht : 0 < (n : ℝ) * eps^2 := mul_pos hn (sq_pos_of_pos hAllowed.2.2.1)
have hrho : 0 < rho (n*eps^2) d :=
(lt_min (by norm_num) (one_div_pos.mpr ht)).trans_le
(rho_elementary_comparisons n d eps hAllowed).1
have hq : 0 < q := Real.sqrt_pos.mpr (mul_pos (by positivity) hrho)
have hq2 : q^2 = (10 : ℝ)^17 * rho (n*eps^2) d :=
Real.sq_sqrt (mul_nonneg (by positivity) hrho.le)
let f := fun w : DecisionSpace (frontierProtocol n d eps) =>
ofReal ((frontierEstimate n d eps w - v)^2)
have hf : Measurable f := by
dsimp [f]
have hm := frontierEstimate_measurable n d eps
fun_prop
have hm := mul_meas_ge_le_lintegral (μ := L) hf (ofReal (q^2))
have hm' : ofReal (q^2) * L {w | ofReal (q^2) ≤ f w} ≤
ofReal ((10 : ℝ)^16 * rateR .NI n d eps) := hm.trans hRisk
have hmR := ENNReal.toReal_mono ENNReal.ofReal_ne_top hm'
rw [ENNReal.toReal_mul, ENNReal.toReal_ofReal (sq_nonneg q),
ENNReal.toReal_ofReal (by dsimp [rateR]; positivity)] at hmR
change q^2 * L.real {w | ofReal (q^2) ≤ f w} ≤ _ at hmR
let E := coverageEvent (frontierInterval n d eps).lo
(frontierInterval n d eps).hi v
have hE : MeasurableSet E := measurableSet_coverageEvent
(frontierInterval n d eps).measurable_lo (frontierInterval n d eps).measurable_hi
have hsub : Eᶜ ⊆ {w | ofReal (q^2) ≤ f w} := by
intro w hw
have herr : q < |frontierEstimate n d eps w - v| := by
by_contra hh
have ha := abs_le.mp (le_of_not_gt hh)
apply hw
change max (1/4) (frontierEstimate n d eps w - q) ≤ v ∧
v ≤ min (3/4) (frontierEstimate n d eps w + q)
exact ⟨max_le hv.1 (by linarith [ha.2]), le_min hv.2 (by linarith [ha.1])⟩
apply ENNReal.ofReal_le_ofReal
nlinarith [sq_abs (frontierEstimate n d eps w - v)]
have hmono := measureReal_mono (μ := L) hsub
have hbad : L.real Eᶜ ≤ (1/10 : ℝ) := by
have hmR' : q^2 * L.real {w | ofReal (q^2) ≤ f w} ≤ q^2/10 := by
dsimp [rateR] at hmR
calc
_ ≤ (10 : ℝ)^16 * rho (n*eps^2) d := hmR
_ = q^2/10 := by rw [hq2]; ring
have hpos : 0 < q^2 := sq_pos_of_pos hq
nlinarith
rw [measureReal_compl hE, probReal_univ] at hbad
change (0.90 : ℝ) ≤ L.real E
linarith
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Frontier.UpperCalibration 14 declarations Projection bounds the loss without moment calibration in the saturated regime.
Bounded-loss branches of the concrete frontier construction
Projection bounds the loss without moment calibration in the saturated regime. The two-participant constant procedure also satisfies the prescribed risk rate. Resource comparisons also close the insufficient-degree fallback and both bounded-logarithmic-dimension branches. The dense absolute-mean and hybrid proofs combine the actual transcript component MSEs. The intermediate global-polynomial proof uses the selected degree and finite-block resource comparisons.
Every branch of the concrete estimate lies in the causal target domain.
Formal statement
hypotheses
conclusion
frontierEstimate n d eps w ∈ Icc (1/4 : ℝ) (3/4)
Proof (Lean source)
-- @node: frontierEstimate_range
lemma frontierEstimate_range (n d : ℕ) (eps : ℝ)
(w : DecisionSpace (frontierProtocol n d eps)) :
frontierEstimate n d eps w ∈ Icc (1/4 : ℝ) (3/4) := by
unfold frontierEstimate
split_ifs
· norm_num
· exact ⟨le_max_left _ _, max_le (by norm_num) (min_le_left _ _)⟩
Assume the stated hv condition. Projection bounds squared risk uniformly, under any probability decision law.
Formal statement
hypotheses
conclusion
squaredRisk L (frontierEstimator n d eps) v ≤ ofReal (1/4 : ℝ)
Proof (Lean source)
-- @node: frontierEstimator_risk_le_quarter
lemma frontierEstimator_risk_le_quarter (n d : ℕ) (eps : ℝ)
(L : Measure (DecisionSpace (frontierProtocol n d eps))) [IsProbabilityMeasure L]
(v : ℝ) (hv : v ∈ Icc (1/4 : ℝ) (3/4)) :
squaredRisk L (frontierEstimator n d eps) v ≤ ofReal (1/4 : ℝ) := by
unfold squaredRisk
calc
_ ≤ ∫⁻ _w, ofReal (1/4 : ℝ) ∂L := by
apply lintegral_mono
intro w
apply ENNReal.ofReal_le_ofReal
have hw := frontierEstimate_range n d eps w
have hdist := abs_sub_le_of_le_of_le hw.1 hw.2 hv.1 hv.2
change (frontierEstimate n d eps w - v)^2 ≤ (1/4 : ℝ)
nlinarith [sq_abs (frontierEstimate n d eps w - v),
abs_nonneg (frontierEstimate n d eps w - v)]
_ = _ := by simp
theorem frontierEstimator_twoParticipants_risk Lemma frontierEstimator_twoParticipants_risk in the paper ↗
Assume the stated hv condition. The two-participant constant estimate has worst-case squared risk at most 1/16.
Formal statement
hypotheses
conclusion
squaredRisk L (frontierEstimator 2 d eps) v ≤ ofReal (1/16 : ℝ)
Proof (Lean source)
-- @node: frontierEstimator_twoParticipants_risk
lemma frontierEstimator_twoParticipants_risk (d : ℕ) (eps : ℝ)
(L : Measure (DecisionSpace (frontierProtocol 2 d eps))) [IsProbabilityMeasure L]
(v : ℝ) (hv : v ∈ Icc (1/4 : ℝ) (3/4)) :
squaredRisk L (frontierEstimator 2 d eps) v ≤ ofReal (1/16 : ℝ) := by
have hloss : (1/2 - v)^2 ≤ (1/16 : ℝ) := by
nlinarith [hv.1, hv.2, mul_nonneg (sub_nonneg.mpr hv.1) (sub_nonneg.mpr hv.2)]
unfold squaredRisk
calc
_ ≤ ∫⁻ _w, ofReal (1/16 : ℝ) ∂L := by
apply lintegral_mono
intro w
apply ENNReal.ofReal_le_ofReal
simpa only [frontierEstimator, frontierEstimate, ↓reduceIte] using hloss
_ = _ := by simp
theorem rateR_twoParticipants_lower
Assume the stated allowed condition. With two participants the elementary lower comparison keeps the rate above 1/2.
Formal statement
Proof (Lean source)
-- @node: rateR_twoParticipants_lower
lemma rateR_twoParticipants_lower (d : ℕ) (eps : ℝ) (hAllowed : Allowed 2 d eps) :
(1/2 : ℝ) ≤ rateR .NI 2 d eps := by
have ht : 0 < (2 : ℝ) * eps^2 := mul_pos (by norm_num) (sq_pos_of_pos hAllowed.2.2.1)
have htUpper : (2 : ℝ) * eps^2 ≤ 2 := by
nlinarith [hAllowed.2.2.1, hAllowed.2.2.2]
have hinv : (1/2 : ℝ) ≤ 1 / ((2 : ℝ) * eps^2) := by
apply (le_div_iff₀ ht).mpr
nlinarith
exact (le_min (by norm_num) hinv).trans
(rho_elementary_comparisons 2 d eps hAllowed).1
theorem frontierEstimator_twoParticipants_rate
Assume the stated allowed condition and the stated hv condition. The constant branch attains the same universal upper-risk constant.
Formal statement
hypotheses
conclusion
squaredRisk L (frontierEstimator 2 d eps) v
Proof (Lean source)
-- @node: frontierEstimator_twoParticipants_rate
lemma frontierEstimator_twoParticipants_rate (d : ℕ) (eps : ℝ)
(hAllowed : Allowed 2 d eps)
(L : Measure (DecisionSpace (frontierProtocol 2 d eps))) [IsProbabilityMeasure L]
(v : ℝ) (hv : v ∈ Icc (1/4 : ℝ) (3/4)) :
squaredRisk L (frontierEstimator 2 d eps) v ≤
ofReal ((10 : ℝ)^16 * rateR .NI 2 d eps) := by
apply (frontierEstimator_twoParticipants_risk d eps L v hv).trans
apply ENNReal.ofReal_le_ofReal
have hr := rateR_twoParticipants_lower d eps hAllowed
nlinarith
theorem frontierEstimator_saturated_rate
Assume the protocol-class label and the stated hv condition. At saturation, projection alone attains the prescribed upper-risk bound.
Formal statement
hypotheses
conclusion
squaredRisk L (frontierEstimator n d eps) v
Proof (Lean source)
-- @node: frontierEstimator_saturated_rate
lemma frontierEstimator_saturated_rate (n d : ℕ) (eps : ℝ)
(hsaturated : rateR .NI n d eps = 1)
(L : Measure (DecisionSpace (frontierProtocol n d eps))) [IsProbabilityMeasure L]
(v : ℝ) (hv : v ∈ Icc (1/4 : ℝ) (3/4)) :
squaredRisk L (frontierEstimator n d eps) v ≤
ofReal ((10 : ℝ)^16 * rateR .NI n d eps) := by
apply (frontierEstimator_risk_le_quarter n d eps L v hv).trans
apply ENNReal.ofReal_le_ofReal
rw [hsaturated]
norm_num
theorem frontierEstimator_fallback_rate
Assume an admissible sample size, dimension, and privacy budget, the stated hb condition, and the stated hv condition. The insufficient-degree fallback satisfies the fixed final risk constant.
Formal statement
hypotheses
n d :
ℕ
eps :
ℝ
hAllowed :
Allowed n d eps
hb :
(frontierResources n d eps).branch = .fallbackQuarter
L :
v :
ℝ
hv :
v ∈ Icc (1/4 : ℝ) (3/4)
conclusion
squaredRisk L (frontierEstimator n d eps) v
Proof (Lean source)
-- @node: frontierEstimator_fallback_rate
lemma frontierEstimator_fallback_rate (n d : ℕ) (eps : ℝ)
(hAllowed : Allowed n d eps)
(hb : (frontierResources n d eps).branch = .fallbackQuarter)
(L : Measure (DecisionSpace (frontierProtocol n d eps))) [IsProbabilityMeasure L]
(v : ℝ) (hv : v ∈ Icc (1/4 : ℝ) (3/4)) :
squaredRisk L (frontierEstimator n d eps) v ≤
ofReal ((10 : ℝ)^16 * rateR .NI n d eps) := by
obtain ⟨hn, hdense, hf⟩ := frontier_fallback_resources n d eps hb
have hr := frontier_fallback_rate_lower n d eps hAllowed hn hdense hf
apply (frontierEstimator_risk_le_quarter n d eps L v hv).trans
apply ENNReal.ofReal_le_ofReal
nlinarith
theorem frontierEstimator_smallDim_intermediate_rate
Assume an admissible sample size, dimension, and privacy budget, the stated l condition, the stated hbranch condition, and the stated hv condition. In bounded logarithmic dimension the intermediate branch needs only projection.
Formal statement
hypotheses
n d :
ℕ
eps :
ℝ
hAllowed :
Allowed n d eps
hL :
logDim d < 4096
hbranch :
(n : ℝ) * eps ^ 2 < (d : ℝ)^2 * logDim d
L :
v :
ℝ
hv :
v ∈ Icc (1/4 : ℝ) (3/4)
conclusion
squaredRisk L (frontierEstimator n d eps) v
Proof (Lean source)
-- @node: frontierEstimator_smallDim_intermediate_rate
lemma frontierEstimator_smallDim_intermediate_rate (n d : ℕ) (eps : ℝ)
(hAllowed : Allowed n d eps) (hL : logDim d < 4096)
(hbranch : (n : ℝ) * eps ^ 2 < (d : ℝ)^2 * logDim d)
(L : Measure (DecisionSpace (frontierProtocol n d eps))) [IsProbabilityMeasure L]
(v : ℝ) (hv : v ∈ Icc (1/4 : ℝ) (3/4)) :
squaredRisk L (frontierEstimator n d eps) v ≤
ofReal ((10 : ℝ)^16 * rateR .NI n d eps) := by
have hr := frontier_smallDim_intermediate_rate_lower n d eps hAllowed hL hbranch
apply (frontierEstimator_risk_le_quarter n d eps L v hv).trans
apply ENNReal.ofReal_le_ofReal
nlinarith
theorem frontierInterval_twoParticipants_full
Assume the stated allowed condition. The two-participant interval is the full target domain, as prescribed by the roadmap.
Formal statement
hypotheses
conclusion
conclusion 1
(frontierInterval 2 d eps).lo w = (1/4 : ℝ)
conclusion 2
(frontierInterval 2 d eps).hi w = (3/4 : ℝ)
Proof (Lean source)
-- @node: frontierInterval_twoParticipants_full
lemma frontierInterval_twoParticipants_full (d : ℕ) (eps : ℝ)
(hAllowed : Allowed 2 d eps)
(w : DecisionSpace (frontierProtocol 2 d eps)) :
(frontierInterval 2 d eps).lo w = (1/4 : ℝ) ∧
(frontierInterval 2 d eps).hi w = (3/4 : ℝ) := by
have hr := rateR_twoParticipants_lower d eps hAllowed
have hqnonneg : 0 ≤ frontierHonestyRadius 2 d eps := Real.sqrt_nonneg _
have hq2 : (frontierHonestyRadius 2 d eps)^2 =
(10 : ℝ)^17 * rateR .NI 2 d eps := by
apply Real.sq_sqrt
exact mul_nonneg (by positivity) (le_trans (by norm_num) hr)
have hq : (1/4 : ℝ) ≤ frontierHonestyRadius 2 d eps := by
nlinarith
change max (1/4) (frontierEstimate 2 d eps w - frontierHonestyRadius 2 d eps) = _ ∧
min (3/4) (frontierEstimate 2 d eps w + frontierHonestyRadius 2 d eps) = _
simp only [frontierEstimate, ↓reduceIte]
exact ⟨max_eq_left (by linarith), min_eq_left (by linarith)⟩
Assume the stated hn condition and the stated l condition. Small logarithmic dimension selects the absolute evaluation means.
Formal statement
hypotheses
conclusion
(frontierResources n d eps).branch = .absMean
Proof (Lean source)
-- @node: frontier_absMean_resources
lemma frontier_absMean_resources (n d : ℕ) (eps : ℝ) (hn : n ≠ 2)
(hL : logDim d < 4096) :
(frontierResources n d eps).branch = .absMean := by
simp only [frontierResources, if_neg hn, if_pos hL]
theorem frontier_absMean_dense_resource_bound
Assume an admissible sample size, dimension, and privacy budget, the stated hn condition, the stated l condition, and the stated hdense condition. The dense small-dimension comparison absorbs baseline and vector noise, with the constant stated in the constructive proof roadmap.
Formal statement
hypotheses
n d :
ℕ
eps :
ℝ
hAllowed :
Allowed n d eps
hn :
n ≠ 2
hL :
logDim d < 4096
hdense :
(d : ℝ)^2 * logDim d ≤ (n : ℝ) * eps^2
conclusion
24 / ((n : ℝ) * eps^2) + (1/2 : ℝ) * sigmaSquared d (n / 3) eps
≤ (64 * 4096 : ℝ) * rateR .NI n d eps
Proof (Lean source)
-- @node: frontier_absMean_dense_resource_bound
lemma frontier_absMean_dense_resource_bound (n d : ℕ) (eps : ℝ)
(hAllowed : Allowed n d eps) (hn : n ≠ 2) (hL : logDim d < 4096)
(hdense : (d : ℝ)^2 * logDim d ≤ (n : ℝ) * eps^2) :
24 / ((n : ℝ) * eps^2) + (1/2 : ℝ) * sigmaSquared d (n / 3) eps ≤
(64 * 4096 : ℝ) * rateR .NI n d eps := by
have ht : 0 < (n : ℝ) * eps^2 := by
have hnp : (0 : ℝ) < n := by
exact_mod_cast (by have := hAllowed.1; omega : 0 < n)
exact mul_pos hnp (sq_pos_of_pos hAllowed.2.2.1)
have hLp := logDim_pos d hAllowed.2.1
have hd : (2 : ℝ) ≤ d := by exact_mod_cast hAllowed.2.1
have hnoise := frontier_sigmaSquared_upper n d eps hAllowed hn
have hinv : 1 / ((n : ℝ) * eps^2) ≤ (d : ℝ)^2 / ((n : ℝ) * eps^2) :=
div_le_div_of_nonneg_right (by nlinarith) ht.le
have hr : rateR .NI n d eps =
(d : ℝ)^2 / (((n : ℝ) * eps^2) * logDim d) := by
simp only [rateR, rho, if_pos hdense]
have hr0 : 0 ≤ rateR .NI n d eps := by rw [hr]; positivity
have hscale : (d : ℝ)^2 / ((n : ℝ) * eps^2) =
logDim d * rateR .NI n d eps := by
rw [hr]
field_simp
calc
_ ≤ 24 * (1 / ((n : ℝ) * eps^2)) +
(1/2 : ℝ) * (80 * ((d : ℝ)^2 / ((n : ℝ) * eps^2))) := by
apply add_le_add
· exact le_of_eq (by ring)
· apply mul_le_mul_of_nonneg_left _ (by norm_num)
simpa only [mul_div_assoc] using hnoise
_ ≤ 64 * ((d : ℝ)^2 / ((n : ℝ) * eps^2)) := by linarith
_ = 64 * logDim d * rateR .NI n d eps := by rw [hscale]; ring
_ ≤ _ := by nlinarith
theorem frontierEstimator_absMean_dense_rate
Assume an admissible sample size, dimension, and privacy budget, the stated hn condition, the stated l condition, the stated hdense condition, independent and identically distributed participant records, independent protocol randomness, and the causal-model conditions for the data law. The concrete absolute-mean branch attains the dense small-dimension risk bound by combining its calibrated norm MSE with the binary baseline MSE.
Formal statement
hypotheses
n d :
ℕ
eps :
ℝ
hAllowed :
Allowed n d eps
hn :
n ≠ 2
hL :
logDim d < 4096
hdense :
(d : ℝ)^2 * logDim d ≤ (n : ℝ) * eps^2
S :
SamplingScheme n d
hIID :
hRandom :
P :
hP :
conclusion
Proof (Lean source)
-- @node: frontierEstimator_absMean_dense_rate
lemma frontierEstimator_absMean_dense_rate (n d : ℕ) (eps : ℝ)
(hAllowed : Allowed n d eps) (hn : n ≠ 2) (hL : logDim d < 4096)
(hdense : (d : ℝ)^2 * logDim d ≤ (n : ℝ) * eps^2)
(S : SamplingScheme n d) (hIID : IidPeople S) (hRandom : IndependentRandomness S)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P) :
squaredRisk (decisionLaw S (frontierProtocol n d eps) P)
(frontierEstimator n d eps) (value P) ≤
ofReal ((10 : ℝ)^16 * rateR .NI n d eps) := by
haveI := sampling_decisionLaw_probability S hIID hRandom (frontierProtocol n d eps) P hP
have hm : 0 < n / 3 := by have := hAllowed.1; omega
haveI : IsProbabilityMeasure
(Measure.pi (fun i => (observedLaw P).bind (frontierKernel n d eps i))) := by
rw [← frontier_sampling_transcript_product n d eps S hIID hRandom P hP]
exact Measure.isProbabilityMeasure_map measurable_fst.aemeasurable
rw [frontierEstimator_risk_product n d eps S hIID hRandom P hP]
apply (frontier_product_risk_le_components n d eps hn P hP hAllowed.2.1 _).trans
apply ENNReal.ofReal_le_ofReal
have hBaseline := frontierBaselineEstimate_mse_rate n d eps hAllowed hn P
have hNorm := frontierNormEstimate_absMean_mse n d eps hn
(frontier_absMean_resources n d eps hn hL) P hP hAllowed.2.2.1 hAllowed.2.1 hm
have hResource := frontier_absMean_dense_resource_bound n d eps hAllowed hn hL hdense
have hLp := logDim_pos d hAllowed.2.1
have hr0 : 0 ≤ rateR .NI n d eps := by
simp only [rateR, rho, if_pos hdense]
positivity
calc
_ ≤ 24 / ((n : ℝ) * eps^2) + (1/2 : ℝ) * sigmaSquared d (n / 3) eps := by
apply add_le_add
· convert mul_le_mul_of_nonneg_left hBaseline
(by norm_num : (0 : ℝ) ≤ 2) using 1 <;> ring
· exact mul_le_mul_of_nonneg_left hNorm (by norm_num)
_ ≤ (64 * 4096 : ℝ) * rateR .NI n d eps := hResource
_ ≤ _ := by nlinarith
theorem frontierEstimator_hybrid_dense_rate
Assume the bounded-mean concentration inequality, the Cai–Low Chebyshev approximation theorem, an admissible sample size, dimension, and privacy budget, the stated hn condition, the stated l condition, the stated hdense condition, independent and identically distributed participant records, independent protocol randomness, and the causal-model conditions for the data law. The dense hybrid branch combines actual component calibration with the resource comparisons, using the same public design as the roadmap.
Formal statement
hypotheses
hMean :
hCheb :
n d :
ℕ
eps :
ℝ
hAllowed :
Allowed n d eps
hn :
n ≠ 2
hL :
4096 ≤ logDim d
hdense :
(d : ℝ)^2 * logDim d ≤ (n : ℝ) * eps^2
S :
SamplingScheme n d
hIID :
hRandom :
P :
hP :
conclusion
Proof (Lean source)
-- @node: frontierEstimator_hybrid_dense_rate
lemma frontierEstimator_hybrid_dense_rate
(hMean : BoundedMeanConcentration) (hCheb : CaiLowChebyshevApproximation)
(n d : ℕ) (eps : ℝ) (hAllowed : Allowed n d eps) (hn : n ≠ 2)
(hL : 4096 ≤ logDim d)
(hdense : (d : ℝ)^2 * logDim d ≤ (n : ℝ) * eps^2)
(S : SamplingScheme n d) (hIID : IidPeople S) (hRandom : IndependentRandomness S)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P) :
squaredRisk (decisionLaw S (frontierProtocol n d eps) P)
(frontierEstimator n d eps) (value P) ≤
ofReal ((10 : ℝ)^16 * rateR .NI n d eps) := by
haveI := sampling_decisionLaw_probability S hIID hRandom (frontierProtocol n d eps) P hP
have hm : 0 < n / 3 := by have := hAllowed.1; omega
obtain ⟨hb, hD, hmD⟩ := frontier_hybrid_resources n d eps hAllowed hn hL hdense
haveI : IsProbabilityMeasure
(Measure.pi (fun i => (observedLaw P).bind (frontierKernel n d eps i))) := by
rw [← frontier_sampling_transcript_product n d eps S hIID hRandom P hP]
exact Measure.isProbabilityMeasure_map measurable_fst.aemeasurable
rw [frontierEstimator_risk_product n d eps S hIID hRandom P hP]
apply (frontier_product_risk_le_components n d eps hn P hP hAllowed.2.1 _).trans
apply ENNReal.ofReal_le_ofReal
have hBaseline := frontierBaselineEstimate_mse_rate n d eps hAllowed hn P
have hNorm := frontierNormEstimate_hybrid_mse hMean hCheb n d eps hn hb S hIID
P hP hAllowed hm hL hD hmD
calc
_ ≤ 24 / ((n : ℝ) * eps^2) + (1/2 : ℝ) *
(500000000 * sigmaSquared d (n / 3) eps / logDim d) := by
apply add_le_add
· convert mul_le_mul_of_nonneg_left hBaseline
(by norm_num : (0 : ℝ) ≤ 2) using 1 <;> ring
· exact mul_le_mul_of_nonneg_left hNorm (by norm_num)
_ ≤ _ := frontier_hybrid_dense_resource_bound n d eps hAllowed hn hdense
theorem frontier_upper_of_gate
Assume the Cai–Low Chebyshev approximation theorem and the bounded-mean concentration inequality. Upper orders attained by the explicit original-input construction.
Formal statement
hypotheses
hCheb_of_gate :
hMean_of_gate :
conclusion
∃ C0 : ℝ,
0 < C0
conclusion 1
NoninteractiveClass (frontierProtocol n d eps) eps
P ∈ causalClass d :
(0.90 : ℝ)
Proof (Lean source)
-- @node: frontier_upper_of_gate
lemma frontier_upper_of_gate (hCheb_of_gate : CaiLowChebyshevApproximation)
(hMean_of_gate : BoundedMeanConcentration) :
∃ C0 : ℝ, 0 < C0 ∧ ∀ (n d : ℕ) (eps : ℝ), Allowed n d eps →
∀ (S : SamplingScheme n d), IidPeople S → IndependentRandomness S →
NoninteractiveClass (frontierProtocol n d eps) eps ∧
∀ P ∈ causalClass d,
squaredRisk (decisionLaw S (frontierProtocol n d eps) P) (frontierEstimator n d eps)
(value P) ≤
ofReal (C0*rateR .NI n d eps) ∧
(0.90 : ℝ) ≤ coverage (decisionLaw S (frontierProtocol n d eps) P)
(frontierInterval n d eps) (value P) ∧
expectedLength (decisionLaw S (frontierProtocol n d eps) P) (frontierInterval n d eps) ≤
ofReal (sqrt (40*C0)*rateH .NI n d eps) := by
refine ⟨(10 : ℝ)^16, by positivity, ?_⟩
intro n d eps hAllowed S hIID hRandom
refine ⟨frontierProtocol_noninteractive n d eps hAllowed.2.2.1.le, ?_⟩
intro P hP
letI := hP.1
haveI := sampling_decisionLaw_probability S hIID hRandom (frontierProtocol n d eps) P hP.2
have hRisk : squaredRisk (decisionLaw S (frontierProtocol n d eps) P)
(frontierEstimator n d eps) (value P) ≤
ofReal ((10 : ℝ)^16 * rateR .NI n d eps) := by
by_cases hn : n = 2
· subst n
exact frontierEstimator_twoParticipants_rate d eps hAllowed _ (value P)
(causal_value_range P hP.2 (by have := hAllowed.2.1; omega))
· by_cases hsaturated : rateR .NI n d eps = 1
· exact frontierEstimator_saturated_rate n d eps hsaturated _ (value P)
(causal_value_range P hP.2 (by have := hAllowed.2.1; omega))
· by_cases hf : (frontierResources n d eps).branch = .fallbackQuarter
· exact frontierEstimator_fallback_rate n d eps hAllowed hf _ (value P)
(causal_value_range P hP.2 (by have := hAllowed.2.1; omega))
· by_cases hSmall : logDim d < 4096 ∧
(n : ℝ) * eps ^ 2 < (d : ℝ)^2 * logDim d
· exact frontierEstimator_smallDim_intermediate_rate n d eps hAllowed
hSmall.1 hSmall.2 _ (value P)
(causal_value_range P hP.2 (by have := hAllowed.2.1; omega))
· by_cases hL : logDim d < 4096
· exact frontierEstimator_absMean_dense_rate n d eps hAllowed hn hL
(by by_contra hdense; exact hSmall ⟨hL, lt_of_not_ge hdense⟩)
S hIID hRandom P hP.2
· by_cases hdense : (d : ℝ)^2 * logDim d ≤ (n : ℝ) * eps^2
· exact frontierEstimator_hybrid_dense_rate hMean_of_gate hCheb_of_gate
n d eps hAllowed hn (le_of_not_gt hL) hdense S hIID hRandom P hP.2
· haveI : IsProbabilityMeasure
(Measure.pi (fun i => (observedLaw P).bind (frontierKernel n d eps i))) := by
rw [← frontier_sampling_transcript_product n d eps S hIID hRandom P hP.2]
exact Measure.isProbabilityMeasure_map measurable_fst.aemeasurable
rw [frontierEstimator_risk_product n d eps S hIID hRandom P hP.2]
apply (frontier_product_risk_le_components n d eps hn P hP.2
(by have := hAllowed.2.1; omega) _).trans
apply ENNReal.ofReal_le_ofReal
have hBaseline := frontierBaselineEstimate_mse_rate n d eps hAllowed hn P
calc
_ ≤ 24 / ((n : ℝ) * eps^2) + (1/2 : ℝ) *
(∫ z, (frontierNormEstimate n d eps z - signedNorm (contrast P))^2
∂Measure.pi (fun i => (observedLaw P).bind (frontierKernel n d eps i))) := by
apply add_le_add
· convert mul_le_mul_of_nonneg_left hBaseline
(by norm_num : (0 : ℝ) ≤ 2) using 1 <;> first | rfl | ring
· exact le_rfl
_ ≤ _ := by
have hm : 0 < n / 3 := by have := hAllowed.1; omega
obtain ⟨hb, hEven, hD, hDegree, hLower⟩ := frontier_global_rounding
n d eps hAllowed hn (le_of_not_gt hL) hdense hf
have hmD := frontier_global_moment_fit n d eps hAllowed hn hD hDegree
have hDegree' : ((frontierResources n d eps).degree : ℝ) ≤
(1/1024 : ℝ) * logDim d /
log (exp 1 + sigmaSquared d (n / 3) eps * logDim d) := by
convert hDegree using 1 <;> first | rfl | ring
have hNorm := frontierNormEstimate_globalPoly_mse hMean_of_gate
hCheb_of_gate n d eps hn hb S hIID P hP.2 hAllowed hm
hEven hD hmD hDegree'
calc
_ ≤ 24 / ((n : ℝ) * eps^2) + (1/2 : ℝ) *
(exp (9*(frontierResources n d eps).degree *
log (exp 1 + sigmaSquared d (n / 3) eps * logDim d))/(2*d) +
(1/((frontierResources n d eps).degree+1 : ℝ))^2) := by
apply add_le_add
· exact le_rfl
· exact mul_le_mul_of_nonneg_left hNorm (by norm_num)
_ ≤ _ := frontier_global_resource_bound n d eps hAllowed hn
(le_of_not_gt hL) hdense hsaturated hDegree hLower
exact ⟨hRisk, frontierInterval_coverage_of_risk n d eps hAllowed _ (value P)
(causal_value_range P hP.2 (by have := hAllowed.2.1; omega)) hRisk,
frontierInterval_rate_length n d eps _⟩
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.MomentDependence.AffineCovariance 7 declarations Exact covariance and variance calculations for affine functions of a single private row.
Affine column covariance
Exact covariance and variance calculations for affine functions of a single private row. These give the degree-zero and one-row cases of the finite Walsh covariance argument.
Fix the probability law P, the privacy budget, and the function f and the function g. Covariance on the finite message block.
Definition (Lean source)
parameters
def
blockCov P eps f g :
ℝ
given by
∫ z, (f z - blockMean (m := m) P eps f) * (g z - blockMean (m := m) P eps g) ∂(vectorBlockLaw P eps m)
theorem blockMean_affine_scaled
Assume the causal-model conditions for the data law, a positive privacy budget, and dimension at least two. The private block mean of an affine coordinate is its affine contrast.
Formal statement
hypotheses
conclusion
blockMean P eps (fun z => a + c * scaledMessages eps z i j) = a + c * contrast P j
Proof (Lean source)
-- @node: blockMean_affine_scaled
lemma blockMean_affine_scaled (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(hP : CausalModel P) (eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d)
(i : Fin m) (j : Fin d) (a c : ℝ) :
blockMean P eps (fun z => a + c * scaledMessages eps z i j) = a + c * contrast P j := by
letI := vectorBlockLaw_probability P eps m
have hmean := blockMean_scaledMessages_eq_rowMean P eps i j
rw [vectorMessageLaw_scaled_sign_integral P hP eps heps hd j] at hmean
unfold blockMean at hmean ⊢
integral_linearity
rw [hmean]
simp
theorem blockVar_affine_scaled
Assume the causal-model conditions for the data law, a positive privacy budget, and dimension at least two. Centered affine coordinates have the exact scaled-coordinate variance.
Formal statement
hypotheses
conclusion
blockVar P eps (fun z => a + c * scaledMessages eps z i j)
= c^2 * ((noiseScale d eps)^2 - (contrast P j)^2)
Proof (Lean source)
-- @node: blockVar_affine_scaled
lemma blockVar_affine_scaled (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(hP : CausalModel P) (eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d)
(i : Fin m) (j : Fin d) (a c : ℝ) :
blockVar P eps (fun z => a + c * scaledMessages eps z i j) =
c^2 * ((noiseScale d eps)^2 - (contrast P j)^2) := by
letI := vectorBlockLaw_probability P eps m
have hmean := blockMean_scaledMessages_eq_rowMean P eps i j
rw [vectorMessageLaw_scaled_sign_integral P hP eps heps hd j] at hmean
have hsecond := blockMean_scaledMessages_sq P eps i j
unfold blockMean at hmean hsecond
unfold blockVar
rw [blockMean_affine_scaled P hP eps heps hd]
have hp (z : Fin m → Fin d → Bool) :
(a + c * scaledMessages eps z i j - (a + c * contrast P j))^2 =
c^2 * (scaledMessages eps z i j)^2 -
(2*c^2*contrast P j) * scaledMessages eps z i j + c^2*(contrast P j)^2 := by ring
simp_rw [hp]
simp (disch := exact Integrable.of_finite) only [integral_add, integral_sub,
integral_const_mul, integral_const, probReal_univ, one_smul]
rw [hmean, hsecond]
ring
theorem blockCov_affine_scaled
Assume the causal-model conditions for the data law, a positive privacy budget, dimension at least two, and the stated hjj condition. Distinct affine coordinates have covariance coming solely from their nonzero means.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
P :
hP :
eps :
ℝ
heps :
0 < eps
hd :
2 ≤ d
i :
Fin m
j j' :
Fin d
hjj :
j ≠ j'
a c a' c' :
ℝ
conclusion
blockCov P eps (fun z => a + c * scaledMessages eps z i j) (fun z => a' + c' * scaledMessages eps z i j')
= -(c*c' * contrast P j * contrast P j')
Proof (Lean source)
-- @node: blockCov_affine_scaled
lemma blockCov_affine_scaled (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(hP : CausalModel P) (eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d)
(i : Fin m) (j j' : Fin d) (hjj : j ≠ j') (a c a' c' : ℝ) :
blockCov P eps (fun z => a + c * scaledMessages eps z i j)
(fun z => a' + c' * scaledMessages eps z i j') =
-(c*c' * contrast P j * contrast P j') := by
letI := vectorBlockLaw_probability P eps m
have hmean (l : Fin d) := blockMean_scaledMessages_eq_rowMean P eps i l
simp_rw [vectorMessageLaw_scaled_sign_integral P hP eps heps hd] at hmean
have hcross := blockMean_scaledMessages_cross P eps i j j' hjj
unfold blockMean at hmean hcross
unfold blockCov
rw [blockMean_affine_scaled P hP eps heps hd,
blockMean_affine_scaled P hP eps heps hd]
have hp (z : Fin m → Fin d → Bool) :
(a + c * scaledMessages eps z i j - (a + c * contrast P j)) *
(a' + c' * scaledMessages eps z i j' - (a' + c' * contrast P j')) =
(c*c') * (scaledMessages eps z i j * scaledMessages eps z i j') -
(c*c'*contrast P j') * scaledMessages eps z i j -
(c*c'*contrast P j) * scaledMessages eps z i j' + c*c'*contrast P j*contrast P j' := by ring
simp_rw [hp]
simp (disch := exact Integrable.of_finite) only [integral_add, integral_sub,
integral_const_mul, integral_const, probReal_univ, one_smul]
rw [hmean j, hmean j', hcross]
ring
Assume the stated hb condition. A nonzero scaled sign supports affine interpolation of any one-row column statistic.
Formal statement
hypotheses
conclusion
∃ a c : ℝ,
columnStatistic eps g j
Proof (Lean source)
-- @node: columnStatistic_one_affine
lemma columnStatistic_one_affine (eps : ℝ) (hb : noiseScale d eps ≠ 0)
(g : Fin d → (Fin 1 → ℝ) → ℝ) (j : Fin d) :
∃ a c : ℝ, columnStatistic eps g j =
(fun z : Fin 1 → Fin d → Bool => a + c * scaledMessages eps z 0 j) := by
let p := g j (fun _ => noiseScale d eps)
let q := g j (fun _ => -noiseScale d eps)
refine ⟨(p+q)/2, (p-q)/(2*noiseScale d eps), ?_⟩
funext z
have hcol : (fun i : Fin 1 => scaledMessages eps z i j) =
(fun _ : Fin 1 => noiseScale d eps * signVal (z 0 j)) := by
funext i
have hi : i = 0 := Subsingleton.elim _ _
subst i
rfl
unfold columnStatistic
rw [hcol]
change g j (fun _ => noiseScale d eps * signVal (z 0 j)) = _
cases hz : z 0 j <;> simp only [scaledMessages, hz, signVal, Bool.false_eq_true,
↓reduceIte, mul_neg_one, mul_one]
· change q = _
field_simp
<;> ring
· change p = _
field_simp
<;> ring
On an empty block every column statistic is constant.
Formal statement
Proof (Lean source)
-- @node: columnStatistic_zero_constant
lemma columnStatistic_zero_constant (eps : ℝ)
(g : Fin d → (Fin 0 → ℝ) → ℝ) (j : Fin d) :
columnStatistic eps g j = (fun _ : Fin 0 → Fin d → Bool => g j (fun _ => 0)) := by
funext z
unfold columnStatistic
congr 1
funext i
exact elim0 i
theorem blockCov_const_left
A constant statistic has zero covariance with every finite block statistic.
Formal statement
Proof (Lean source)
-- @node: blockCov_const_left
lemma blockCov_const_left (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(eps a : ℝ) (f : (Fin m → Fin d → Bool) → ℝ) :
blockCov P eps (fun _ => a) f = 0 := by
letI := vectorBlockLaw_probability P eps m
simp [blockCov, blockMean]
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.MomentDependence.CenteredProducts 9 declarations Independence of participant rows diagonalizes the centered product moments, both within one column and between distinct columns.
Centered finite column products
Independence of participant rows diagonalizes the centered product moments, both within one column and between distinct columns. These are the finite Walsh calculations used by the column covariance proof.
Fix the probability law P, the privacy budget, the coordinate index, and the function z. The centered scaled sign in a single released row.
Definition (Lean source)
Fix the probability law P, the privacy budget, the coordinate index, the finite index set J, and the function z. A product of centered entries indexed by a participant subset.
Definition (Lean source)
parameters
def
centeredColumnProduct P eps j J z :
ℝ
given by
∏ i ∈ J, centeredRow P eps j (z i)
theorem integral_centeredRow
Assume the causal-model conditions for the data law, a positive privacy budget, and dimension at least two. Centering removes the one-row mean.
Formal statement
hypotheses
conclusion
(∫ z, centeredRow P eps j z ∂vectorMessageLaw P eps) = 0
Proof (Lean source)
-- @node: integral_centeredRow
lemma integral_centeredRow (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(hP : CausalModel P) (eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d) (j : Fin d) :
(∫ z, centeredRow P eps j z ∂vectorMessageLaw P eps) = 0 := by
letI := vectorMessageLaw_probability P eps
unfold centeredRow
rw [integral_sub Integrable.of_finite Integrable.of_finite,
vectorMessageLaw_scaled_sign_integral P hP eps heps hd]
simp
theorem integral_centeredRow_sq
Assume the causal-model conditions for the data law, a positive privacy budget, and dimension at least two. The centered one-row second moment is its exact variance.
Formal statement
hypotheses
conclusion
(∫ z, (centeredRow P eps j z)^2 ∂vectorMessageLaw P eps)
= (noiseScale d eps)^2 - (contrast P j)^2
Proof (Lean source)
-- @node: integral_centeredRow_sq
lemma integral_centeredRow_sq (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(hP : CausalModel P) (eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d) (j : Fin d) :
(∫ z, (centeredRow P eps j z)^2 ∂vectorMessageLaw P eps) =
(noiseScale d eps)^2 - (contrast P j)^2 := by
letI := vectorMessageLaw_probability P eps
have hp (z : Fin d → Bool) : (noiseScale d eps * signVal (z j))^2 =
(noiseScale d eps)^2 := by cases z j <;> simp [signVal]
have heq (z : Fin d → Bool) : (centeredRow P eps j z)^2 =
(noiseScale d eps)^2 - 2*contrast P j * (noiseScale d eps * signVal (z j)) +
(contrast P j)^2 := by unfold centeredRow; nlinarith [hp z]
have hmean (l : Fin d) := vectorMessageLaw_scaled_sign_integral P hP eps heps hd l
simp only [integral_const_mul] at hmean
simp_rw [heq]
simp (disch := exact Integrable.of_finite) only [integral_add, integral_sub,
integral_const_mul, integral_const, probReal_univ, one_smul]
rw [hmean j]
ring
theorem integral_centeredRow_cross
Assume the causal-model conditions for the data law, a positive privacy budget, dimension at least two, and the stated hjj condition. Distinct centered row coordinates have the negative product of contrasts as their moment.
Formal statement
hypotheses
conclusion
(∫ z, centeredRow P eps j z * centeredRow P eps j' z ∂vectorMessageLaw P eps)
= -(contrast P j * contrast P j')
Proof (Lean source)
-- @node: integral_centeredRow_cross
lemma integral_centeredRow_cross (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(hP : CausalModel P) (eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d)
(j j' : Fin d) (hjj : j ≠ j') :
(∫ z, centeredRow P eps j z * centeredRow P eps j' z ∂vectorMessageLaw P eps) =
-(contrast P j * contrast P j') := by
letI := vectorMessageLaw_probability P eps
have heq (z : Fin d → Bool) : centeredRow P eps j z * centeredRow P eps j' z =
(noiseScale d eps)^2 * (signVal (z j) * signVal (z j')) -
contrast P j' * (noiseScale d eps * signVal (z j)) -
contrast P j * (noiseScale d eps * signVal (z j')) +
contrast P j * contrast P j' := by unfold centeredRow; ring
have hmean (l : Fin d) := vectorMessageLaw_scaled_sign_integral P hP eps heps hd l
simp only [integral_const_mul] at hmean
simp_rw [heq]
simp (disch := exact Integrable.of_finite) only [integral_add, integral_sub,
integral_const_mul, integral_const, probReal_univ, one_smul]
rw [vectorMessageLaw_cross_sign_integral P eps j j' hjj,
hmean j, hmean j']
ring
theorem blockMean_centeredColumnProduct_mul
Products over iid rows factor into their centered one-row moments.
Formal statement
hypotheses
conclusion
= ∏ i : Fin m, ∫ z, (if i ∈ J then centeredRow P eps j z else 1) * (if i ∈ K then centeredRow P eps j' z else 1) ∂vectorMessageLaw P eps
Proof (Lean source)
-- @node: blockMean_centeredColumnProduct_mul
lemma blockMean_centeredColumnProduct_mul (P : Measure (FullRecord d))
[IsProbabilityMeasure P] (eps : ℝ) (j j' : Fin d) (J K : Finset (Fin m)) :
blockMean P eps (fun z => centeredColumnProduct P eps j J z *
centeredColumnProduct P eps j' K z) =
∏ i : Fin m, ∫ z, (if i ∈ J then centeredRow P eps j z else 1) *
(if i ∈ K then centeredRow P eps j' z else 1) ∂vectorMessageLaw P eps := by
classical
letI := vectorMessageLaw_probability P eps
unfold blockMean vectorBlockLaw centeredColumnProduct
simp_rw [← Finset.prod_ite_mem_eq J, ← Finset.prod_ite_mem_eq K,
← Finset.prod_mul_distrib]
exact integral_fintype_prod_eq_prod (μ := fun _ : Fin m => vectorMessageLaw P eps)
(fun (i : Fin m) (z : Fin d → Bool) =>
(if i ∈ J then centeredRow P eps j z else 1) *
(if i ∈ K then centeredRow P eps j' z else 1))
theorem blockMean_centeredColumnProduct_mul_ne
Assume the causal-model conditions for the data law, a positive privacy budget, dimension at least two, and the stated jk condition. Unequal participant subsets have zero mixed moment, even across different columns.
Formal statement
hypotheses
conclusion
= 0
Proof (Lean source)
-- @node: blockMean_centeredColumnProduct_mul_ne
lemma blockMean_centeredColumnProduct_mul_ne (P : Measure (FullRecord d))
[IsProbabilityMeasure P] (hP : CausalModel P) (eps : ℝ) (heps : 0 < eps)
(hd : 2 ≤ d) (j j' : Fin d) (J K : Finset (Fin m)) (hJK : J ≠ K) :
blockMean P eps (fun z => centeredColumnProduct P eps j J z *
centeredColumnProduct P eps j' K z) = 0 := by
classical
rw [blockMean_centeredColumnProduct_mul]
have hex : ∃ i, (i ∈ J ∧ i ∉ K) ∨ (i ∉ J ∧ i ∈ K) := by
by_contra h
apply hJK
ext i
have hi := not_exists.mp h i
tauto
obtain ⟨i, hi⟩ := hex
apply Finset.prod_eq_zero (Finset.mem_univ i)
rcases hi with ⟨hJ,hK⟩ | ⟨hJ,hK⟩
· simpa only [hJ, hK, ↓reduceIte, mul_one] using integral_centeredRow P hP eps heps hd j
· simpa only [hJ, hK, ↓reduceIte, one_mul] using integral_centeredRow P hP eps heps hd j'
theorem blockMean_centeredColumnProduct_sq
Assume the causal-model conditions for the data law, a positive privacy budget, and dimension at least two. Equal-subset within-column moments are powers of the coordinate variance.
Formal statement
hypotheses
conclusion
blockMean P eps (fun z => (centeredColumnProduct P eps j J z)^2)
= ((noiseScale d eps)^2 - (contrast P j)^2)^J.card
Proof (Lean source)
-- @node: blockMean_centeredColumnProduct_sq
lemma blockMean_centeredColumnProduct_sq (P : Measure (FullRecord d))
[IsProbabilityMeasure P] (hP : CausalModel P) (eps : ℝ) (heps : 0 < eps)
(hd : 2 ≤ d) (j : Fin d) (J : Finset (Fin m)) :
blockMean P eps (fun z => (centeredColumnProduct P eps j J z)^2) =
((noiseScale d eps)^2 - (contrast P j)^2)^J.card := by
classical
letI := vectorMessageLaw_probability P eps
rw [show (fun z => (centeredColumnProduct P eps j J z)^2) =
(fun z => centeredColumnProduct P eps j J z * centeredColumnProduct P eps j J z)
from by funext z; exact pow_two _]
rw [blockMean_centeredColumnProduct_mul]
have hrow (i : Fin m) :
(∫ z, (if i ∈ J then centeredRow P eps j z else 1) *
(if i ∈ J then centeredRow P eps j z else 1) ∂vectorMessageLaw P eps) =
if i ∈ J then (noiseScale d eps)^2 - (contrast P j)^2 else 1 := by
by_cases hi : i ∈ J
· simpa only [hi, ↓reduceIte, ← pow_two] using integral_centeredRow_sq P hP eps heps hd j
· simp [hi]
simp_rw [hrow]
rw [Finset.prod_ite_mem_eq, Finset.prod_const]
theorem blockMean_centeredColumnProduct_cross
Assume the causal-model conditions for the data law, a positive privacy budget, dimension at least two, and the stated hjj condition. Equal-subset cross-column moments are powers of the exact one-row covariance.
Formal statement
hypotheses
conclusion
= (-(contrast P j * contrast P j'))^J.card
Proof (Lean source)
-- @node: blockMean_centeredColumnProduct_cross
lemma blockMean_centeredColumnProduct_cross (P : Measure (FullRecord d))
[IsProbabilityMeasure P] (hP : CausalModel P) (eps : ℝ) (heps : 0 < eps)
(hd : 2 ≤ d) (j j' : Fin d) (hjj : j ≠ j') (J : Finset (Fin m)) :
blockMean P eps (fun z => centeredColumnProduct P eps j J z *
centeredColumnProduct P eps j' J z) = (-(contrast P j * contrast P j'))^J.card := by
classical
letI := vectorMessageLaw_probability P eps
rw [blockMean_centeredColumnProduct_mul]
have hrow (i : Fin m) :
(∫ z, (if i ∈ J then centeredRow P eps j z else 1) *
(if i ∈ J then centeredRow P eps j' z else 1) ∂vectorMessageLaw P eps) =
if i ∈ J then -(contrast P j * contrast P j') else 1 := by
by_cases hi : i ∈ J
· simpa only [hi, ↓reduceIte] using integral_centeredRow_cross P hP eps heps hd j j' hjj
· simp [hi]
simp_rw [hrow]
rw [Finset.prod_ite_mem_eq, Finset.prod_const]
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.MomentDependence.Counting 5 declarations Inclusion probabilities and a finite union bound control squared private moments.
Finite subset-overlap counting
Inclusion probabilities and a finite union bound control squared private moments.
Assume positive block size, the stated hkm condition, and the stated hv condition. The inclusion probability of a specified subset is bounded by the paper's sampling-without-replacement factor, including the empty subset.
Formal statement
hypotheses
m k v :
ℕ
hm :
0 < m
hkm :
2 * k ≤ m
hv :
v ≤ k
conclusion
(Nat.choose (m - v) (k - v) : ℝ) ≤ (Nat.choose m k : ℝ) * (2 * k/ (m : ℝ))^v
Proof (Lean source)
-- @node: choose_inclusion_le
lemma choose_inclusion_le (m k v : ℕ) (hm : 0 < m) (hkm : 2 * k ≤ m) (hv : v ≤ k) :
(Nat.choose (m - v) (k - v) : ℝ) ≤ (Nat.choose m k : ℝ) * (2 * k/ (m : ℝ))^v := by
induction v with
| zero => simp
| succ v ih =>
have hvk : v < k := by omega
have hvm : v < m := by omega
have hrec := Nat.add_one_mul_choose_eq (m - v- 1) (k - v- 1)
have hmshift : m - v- 1 + 1 = m - v := by omega
have hkshift : k - v- 1 + 1 = k - v := by omega
rw [hmshift, hkshift] at hrec
have hrecR : ((m - v : ℕ) : ℝ) * (Nat.choose (m-(v + 1)) (k-(v + 1)) : ℝ) =
(Nat.choose (m - v) (k - v) : ℝ) * ((k - v : ℕ) : ℝ) := by
exact_mod_cast hrec
have hmR : (0 : ℝ) < m := by exact_mod_cast hm
have hmvR : (0 : ℝ) < (m - v : ℕ) := by exact_mod_cast (by omega : 0 < m - v)
have hvR : (v : ℝ) ≤ k := by exact_mod_cast hvk.le
have hkmR : 2 * (k : ℝ) ≤ m := by exact_mod_cast hkm
have hfrac : ((k - v : ℕ) : ℝ) / ((m - v : ℕ) : ℝ) ≤ 2 * k/ (m : ℝ) := by
rw [div_le_div_iff₀ hmvR hmR]
rw [Nat.cast_sub hvk.le, Nat.cast_sub hvm.le]
nlinarith
have heq : (Nat.choose (m-(v + 1)) (k-(v + 1)) : ℝ) =
(Nat.choose (m - v) (k - v) : ℝ) * (((k - v : ℕ) : ℝ) / ((m - v : ℕ) : ℝ)) := by
rw [← mul_div_assoc]
apply (eq_div_iff hmvR.ne').mpr
nlinarith [hrecR]
rw [heq]
calc
_ ≤ ((Nat.choose m k : ℝ) * (2 * k/ (m : ℝ))^v) * (2 * k/ (m : ℝ)) :=
mul_le_mul (ih (by omega)) hfrac (by positivity) (by positivity)
_ = _ := by rw [pow_succ]; ring
Assume the stated hm condition, the stated hkm condition, the stated hs condition, and the stated hk condition. A specified subset is contained in at most the inclusion-factor fraction of all uniformly weighted subsets of the required size.
Formal statement
hypotheses
conclusion
(∑ K ∈ s.powersetCard k, if H ⊆ K then (1 : ℝ) else 0)
≤ (Nat.choose s.card k : ℝ) * (2 * k/ (s.card : ℝ))^H.card
Proof (Lean source)
-- @node: sum_subset_indicator_le
lemma sum_subset_indicator_le {α : Type*} [DecidableEq α] (s H : Finset α)
(k : ℕ) (hm : 0 < s.card) (hkm : 2 * k ≤ s.card)
(hHs : H ⊆ s) (hHk : H.card ≤ k) :
(∑ K ∈ s.powersetCard k, if H ⊆ K then (1 : ℝ) else 0) ≤
(Nat.choose s.card k : ℝ) * (2 * k/ (s.card : ℝ))^H.card := by
classical
rw [← Finset.sum_filter]
simp only [Finset.sum_const, nsmul_eq_mul, mul_one]
rw [Finset.card_filter_powersetCard_subset H s k hHs hHk]
exact choose_inclusion_le s.card k H.card hm hkm hHk
Assume nonnegative amplitude and a nonnegative bias bound. The term for an exact intersection is dominated by the sum of all included subsets; this is the finite union bound with nonnegative moment weights.
Formal statement
hypotheses
conclusion
B^(J ∩ K).card * a^(k - (J ∩ K).card)
≤ ∑ H ∈ J.powerset, if H ⊆ K then B^H.card * a^(k - H.card) else 0
Proof (Lean source)
-- @node: overlap_term_le_subset_sum
lemma overlap_term_le_subset_sum {α : Type*} [DecidableEq α] (J K : Finset α)
(k : ℕ) (a B : ℝ) (ha : 0 ≤ a) (hB : 0 ≤ B) :
B^(J ∩ K).card * a^(k - (J ∩ K).card) ≤
∑ H ∈ J.powerset, if H ⊆ K then B^H.card * a^(k - H.card) else 0 := by
have h := Finset.single_le_sum
(s := J.powerset)
(f := fun H => if H ⊆ K then B^H.card * a^(k - H.card) else 0)
(a := J ∩ K) (by intro H _; split_ifs <;> positivity)
(Finset.mem_powerset.mpr Finset.inter_subset_left)
simpa only [if_pos inter_subset_right] using h
Assume the stated hm condition, the stated hkm condition, the stated js condition, the stated j condition, nonnegative amplitude, and a nonnegative bias bound. Summing the union bound over a uniform subset and applying the binomial expansion gives the second-moment row bound.
Formal statement
hypotheses
α :
Type*
s J :
Finset α
k :
ℕ
hm :
0 < s.card
hkm :
2 * k ≤ s.card
hJs :
J ⊆ s
hJ :
J.card = k
a B :
ℝ
ha :
0 ≤ a
hB :
0 ≤ B
conclusion
(∑ K ∈ s.powersetCard k, B^(J ∩ K).card * a^(k - (J ∩ K).card))
≤ (Nat.choose s.card k : ℝ) * (a + 2 * k * B/ (s.card : ℝ))^k
Proof (Lean source)
-- @node: overlap_row_sum_le
lemma overlap_row_sum_le {α : Type*} [DecidableEq α] (s J : Finset α)
(k : ℕ) (hm : 0 < s.card) (hkm : 2 * k ≤ s.card) (hJs : J ⊆ s)
(hJ : J.card = k) (a B : ℝ) (ha : 0 ≤ a) (hB : 0 ≤ B) :
(∑ K ∈ s.powersetCard k, B^(J ∩ K).card * a^(k - (J ∩ K).card)) ≤
(Nat.choose s.card k : ℝ) * (a + 2 * k * B/ (s.card : ℝ))^k := by
classical
calc
_ ≤ ∑ K ∈ s.powersetCard k,
∑ H ∈ J.powerset, if H ⊆ K then B^H.card * a^(k - H.card) else 0 :=
Finset.sum_le_sum (fun K _ => overlap_term_le_subset_sum J K k a B ha hB)
_ = ∑ H ∈ J.powerset, (B^H.card * a^(k - H.card)) *
∑ K ∈ s.powersetCard k, if H ⊆ K then (1 : ℝ) else 0 := by
rw [Finset.sum_comm]
apply Finset.sum_congr rfl
intro H _
rw [Finset.mul_sum]
apply Finset.sum_congr rfl
intro K _
split_ifs <;> simp
_ ≤ ∑ H ∈ J.powerset, (B^H.card * a^(k - H.card)) *
((Nat.choose s.card k : ℝ) * (2 * k/ (s.card : ℝ))^H.card) := by
apply Finset.sum_le_sum
intro H hH
have hHJ := Finset.mem_powerset.mp hH
exact mul_le_mul_of_nonneg_left
(sum_subset_indicator_le s H k hm hkm (hHJ.trans hJs)
(hJ ▸ Finset.card_le_card hHJ)) (by positivity)
_ = (Nat.choose s.card k : ℝ) * (a + 2 * k * B/ (s.card : ℝ))^k := by
have hterm : ∀ H : Finset α,
(B^H.card * a^(k - H.card)) *
((Nat.choose s.card k : ℝ) * (2 * k/ (s.card : ℝ))^H.card) =
(Nat.choose s.card k : ℝ) *
((2 * k * B/ (s.card : ℝ))^H.card * a^(k - H.card)) := by
intro H
rw [show 2 * (k : ℝ) * B/ (s.card : ℝ) = B * (2 * k/ (s.card : ℝ)) by ring, mul_pow]
ring
simp_rw [hterm]
rw [← Finset.mul_sum, ← hJ, Finset.sum_pow_mul_eq_add_pow, add_comm]
Assume the stated hm condition, the stated hkm condition, nonnegative amplitude, and a nonnegative bias bound. Averaging the row bound twice cancels both subset-count normalizers.
Formal statement
hypotheses
conclusion
((Nat.choose s.card k : ℝ)⁻¹)^2 * (∑ J ∈ s.powersetCard k, ∑ K ∈ s.powersetCard k, B^(J ∩ K).card * a^(k - (J ∩ K).card))
≤ (a + 2 * k * B/ (s.card : ℝ))^k
Proof (Lean source)
-- @node: overlap_average_le
lemma overlap_average_le {α : Type*} [DecidableEq α] (s : Finset α)
(k : ℕ) (hm : 0 < s.card) (hkm : 2 * k ≤ s.card)
(a B : ℝ) (ha : 0 ≤ a) (hB : 0 ≤ B) :
((Nat.choose s.card k : ℝ)⁻¹)^2 *
(∑ J ∈ s.powersetCard k, ∑ K ∈ s.powersetCard k,
B^(J ∩ K).card * a^(k - (J ∩ K).card)) ≤
(a + 2 * k * B/ (s.card : ℝ))^k := by
have hc : (Nat.choose s.card k : ℝ) ≠ 0 := by
exact_mod_cast (Nat.choose_pos (by omega : k ≤ s.card)).ne'
calc
_ ≤ ((Nat.choose s.card k : ℝ)⁻¹)^2 *
∑ J ∈ s.powersetCard k,
(Nat.choose s.card k : ℝ) * (a + 2 * k * B/ (s.card : ℝ))^k := by
apply mul_le_mul_of_nonneg_left _ (sq_nonneg _)
apply Finset.sum_le_sum
intro J hJ
exact overlap_row_sum_le s J k hm hkm (Finset.mem_powersetCard.mp hJ).1
(Finset.mem_powersetCard.mp hJ).2 a B ha hB
_ = _ := by
rw [Finset.sum_const, Finset.card_powersetCard, nsmul_eq_mul]
field_simp
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.MomentDependence.Covariance 6 declarations Finite original-record private value frontiers: Helpers/MomentDependence/Covariance.
Helpers/MomentDependence/Covariance
Finite original-record private value frontiers: Helpers/MomentDependence/Covariance.
theorem blockCov_affine_scaled_abs
Assume the causal-model conditions for the data law, a positive privacy budget, dimension at least two, and the stated hjj condition. Affine statistics of distinct coordinates attain the one-row correlation bound exactly.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
P :
hP :
eps :
ℝ
heps :
0 < eps
hd :
2 ≤ d
i :
Fin m
j j' :
Fin d
hjj :
j ≠ j'
a c a' c' :
ℝ
conclusion
|blockCov P eps (fun z => a + c * scaledMessages eps z i j) (fun z => a' + c' * scaledMessages eps z i j')|
= |contrast P j * contrast P j'| / sqrt (((noiseScale d eps)^2 - (contrast P j)^2) * ((noiseScale d eps)^2 - (contrast P j')^2)) * sqrt (blockVar P eps (fun z => a + c * scaledMessages eps z i j) * blockVar P eps (fun z => a' + c' * scaledMessages eps z i j'))
Proof (Lean source)
-- @node: blockCov_affine_scaled_abs
lemma blockCov_affine_scaled_abs (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(hP : CausalModel P) (eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d)
(i : Fin m) (j j' : Fin d) (hjj : j ≠ j') (a c a' c' : ℝ) :
|blockCov P eps (fun z => a + c * scaledMessages eps z i j)
(fun z => a' + c' * scaledMessages eps z i j')| =
|contrast P j * contrast P j'| /
sqrt (((noiseScale d eps)^2 - (contrast P j)^2) *
((noiseScale d eps)^2 - (contrast P j')^2)) *
sqrt (blockVar P eps (fun z => a + c * scaledMessages eps z i j) *
blockVar P eps (fun z => a' + c' * scaledMessages eps z i j')) := by
rw [blockCov_affine_scaled P hP eps heps hd i j j' hjj,
blockVar_affine_scaled P hP eps heps hd,
blockVar_affine_scaled P hP eps heps hd]
let v := (noiseScale d eps)^2 - (contrast P j)^2
let v' := (noiseScale d eps)^2 - (contrast P j')^2
have hv : 0 < v := column_scale_variance_pos P hP eps heps hd j
have hv' : 0 < v' := column_scale_variance_pos P hP eps heps hd j'
have hroot : sqrt (v*v') ≠ 0 := (Real.sqrt_pos.2 (mul_pos hv hv')).ne'
change |-(c*c'*contrast P j*contrast P j')| =
|contrast P j * contrast P j'| / sqrt (v*v') * sqrt ((c^2*v)*(c'^2*v'))
have hprod : (c^2*v)*(c'^2*v') = (c*c')^2*(v*v') := by ring
rw [hprod, Real.sqrt_mul (sq_nonneg _), Real.sqrt_sq_eq_abs]
rw [abs_neg]
have habs : |c*c'*contrast P j*contrast P j'| =
|c*c'| * |contrast P j*contrast P j'| := by simp only [abs_mul, mul_assoc]
rw [habs]
field_simp
theorem column_covariance_bound_one
Assume the causal-model conditions for the data law, a positive privacy budget, dimension at least two, and the stated hjj condition. The full arbitrary-column covariance inequality for a block containing one participant.
Formal statement
hypotheses
conclusion
≤ |contrast P j * contrast P j'| / sqrt (((noiseScale d eps)^2 - (contrast P j)^2) * ((noiseScale d eps)^2 - (contrast P j')^2)) * sqrt (blockVar P eps (columnStatistic eps g j) * blockVar P eps (columnStatistic eps g j'))
Proof (Lean source)
-- @node: column_covariance_bound_one
lemma column_covariance_bound_one (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(hP : CausalModel P) (eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d)
(g : Fin d → (Fin 1 → ℝ) → ℝ) (j j' : Fin d) (hjj : j ≠ j') :
|blockCov P eps (columnStatistic eps g j) (columnStatistic eps g j')| ≤
|contrast P j * contrast P j'| /
sqrt (((noiseScale d eps)^2 - (contrast P j)^2) *
((noiseScale d eps)^2 - (contrast P j')^2)) *
sqrt (blockVar P eps (columnStatistic eps g j) *
blockVar P eps (columnStatistic eps g j')) := by
have hb : noiseScale d eps ≠ 0 := by
have hb := noiseScale_gt_dimension (d := d) eps heps (by omega)
have hdR : (2 : ℝ) ≤ d := by exact_mod_cast hd
linarith
obtain ⟨a,c,h⟩ := columnStatistic_one_affine eps hb g j
obtain ⟨a',c',h'⟩ := columnStatistic_one_affine eps hb g j'
rw [h,h']
exact (blockCov_affine_scaled_abs P hP eps heps hd 0 j j' hjj a c a' c').le
theorem column_correlation_le_inv_dimension
Assume the causal-model conditions for the data law, a positive privacy budget, and dimension at least two. A dimension bound on the exact cross-column correlation coefficient.
Formal statement
hypotheses
conclusion
|contrast P j * contrast P j'| / sqrt (((noiseScale d eps)^2 - (contrast P j)^2) * ((noiseScale d eps)^2 - (contrast P j')^2))
≤ (d : ℝ)⁻¹
Proof (Lean source)
-- @node: column_correlation_le_inv_dimension
lemma column_correlation_le_inv_dimension (P : Measure (FullRecord d))
(hP : CausalModel P) (eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d)
(j j' : Fin d) :
|contrast P j * contrast P j'| /
sqrt (((noiseScale d eps)^2 - (contrast P j)^2) *
((noiseScale d eps)^2 - (contrast P j')^2)) ≤ (d : ℝ)⁻¹ := by
have hdR : (2 : ℝ) ≤ d := by exact_mod_cast hd
have hb := noiseScale_gt_dimension (d := d) eps heps (by omega)
have ht (l : Fin d) : |contrast P l| ≤ (1/2 : ℝ) :=
abs_le.mpr (contrast_mem_parameterCube P hP l)
have hs (l : Fin d) : (contrast P l)^2 ≤ (1/4 : ℝ) := by
have := ht l
have := sq_abs (contrast P l)
nlinarith [mul_nonneg (abs_nonneg (contrast P l)) (by linarith : 0 ≤ 1/2 - |contrast P l|)]
have hden (l : Fin d) : (d : ℝ) ≤ (noiseScale d eps)^2 - (contrast P l)^2 := by
have := hs l
nlinarith [sq_nonneg ((d : ℝ) - 1)]
have hprod : (d : ℝ)^2 ≤
((noiseScale d eps)^2 - (contrast P j)^2) *
((noiseScale d eps)^2 - (contrast P j')^2) := by
simpa [pow_two] using mul_le_mul (hden j) (hden j') (by linarith) (by linarith [hden j])
have hroot : (d : ℝ) ≤ sqrt
(((noiseScale d eps)^2 - (contrast P j)^2) *
((noiseScale d eps)^2 - (contrast P j')^2)) := by
have := Real.sqrt_le_sqrt hprod
simpa [Real.sqrt_sq (by linarith : (0 : ℝ) ≤ d)] using this
have hnum : |contrast P j * contrast P j'| ≤ (1 : ℝ) := by
rw [abs_mul]
have := mul_le_mul (ht j) (ht j') (abs_nonneg _) (by norm_num : (0 : ℝ) ≤ 1/2)
norm_num at this
linarith
calc
_ ≤ 1 / (d : ℝ) := div_le_div₀ (by norm_num : (0 : ℝ) ≤ 1) hnum (by linarith) hroot
_ = _ := one_div _
theorem blockVar_average_le_of_covariance
Assume positive dimension and the function hcov. Summing diagonal variances and bounded cross-column covariances gives the paper's factor-two bound for the average. This step does not assume independent columns.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
P :
eps :
ℝ
hd :
0 < d
Proof (Lean source)
-- @node: blockVar_average_le_of_covariance
lemma blockVar_average_le_of_covariance (P : Measure (FullRecord d))
[IsProbabilityMeasure P] (eps : ℝ) (hd : 0 < d)
(f : Fin d → (Fin m → Fin d → Bool) → ℝ)
(hcov : ∀ j j', j ≠ j' → |blockCov P eps (f j) (f j')| ≤
(d : ℝ)⁻¹ * sqrt (blockVar P eps (f j) * blockVar P eps (f j'))) :
blockVar P eps (fun z => (d : ℝ)⁻¹ * ∑ j, f j z) ≤
(2/(d : ℝ)) * sSup (range (fun j => blockVar P eps (f j))) := by
classical
let v := sSup (range (fun j => blockVar P eps (f j)))
have hdR : (0 : ℝ) < d := by exact_mod_cast hd
have hvar (j : Fin d) : 0 ≤ blockVar P eps (f j) := by
exact integral_nonneg (fun _ => sq_nonneg _)
have hvj (j : Fin d) : blockVar P eps (f j) ≤ v :=
le_csSup (Set.finite_range _).bddAbove (Set.mem_range_self j)
have hv : 0 ≤ v := (hvar ⟨0,hd⟩).trans (hvj ⟨0,hd⟩)
have hsqrt (j j' : Fin d) :
sqrt (blockVar P eps (f j) * blockVar P eps (f j')) ≤ v := by
have h := Real.sqrt_le_sqrt (mul_le_mul (hvj j) (hvj j') (hvar j') hv)
simpa [← pow_two, Real.sqrt_sq hv] using h
have hrow (j : Fin d) : ∑ j', blockCov P eps (f j) (f j') ≤ 2*v := by
calc
_ ≤ ∑ j' : Fin d, ((if j' = j then v else 0) + (d : ℝ)⁻¹*v) := by
apply Finset.sum_le_sum
intro j' _
by_cases heq : j' = j
· subst j'
rw [blockCov_self]
simp only [if_true]
nlinarith [hvj j, mul_nonneg (inv_nonneg.mpr hdR.le) hv]
· simp only [heq, if_false, zero_add]
exact (le_abs_self _).trans ((hcov j j' (Ne.symm heq)).trans
(mul_le_mul_of_nonneg_left (hsqrt j j') (inv_nonneg.mpr hdR.le)))
_ = 2*v := by
rw [Finset.sum_add_distrib]
simp [hdR.ne', ← mul_assoc]
ring
rw [blockVar_average_eq_covariance_sum]
calc
_ ≤ ((d : ℝ)⁻¹)^2 * ∑ j : Fin d, 2*v :=
mul_le_mul_of_nonneg_left (Finset.sum_le_sum (fun j _ => hrow j)) (sq_nonneg _)
_ = (2/(d : ℝ))*v := by
simp only [Finset.sum_const, Finset.card_univ, Fintype.card_fin, nsmul_eq_mul]
field_simp
theorem column_covariance_bound
Assume the causal-model conditions for the data law, a privacy budget in the interval from zero to one, dimension at least two, and measurability of g. The remaining finite Walsh-basis calculation controls arbitrary column statistics. This is the dependence step in the paper's private-moment proof roadmap.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
P :
hP :
eps :
ℝ
heps :
eps ∈ Ioc 0 1
hd :
2 ≤ d
hg :
∀ j, Measurable (g j)
j j' :
Fin d
j ≠ j'
conclusion
≤ |contrast P j * contrast P j'| / sqrt (((noiseScale d eps)^2 - (contrast P j)^2) * ((noiseScale d eps)^2 - (contrast P j')^2)) * sqrt (blockVar (m := m) P eps (columnStatistic eps g j) * blockVar (m := m) P eps (columnStatistic eps g j'))
Proof (Lean source)
-- @node: column_covariance_bound
lemma column_covariance_bound (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(hP : CausalModel P) (eps : ℝ) (heps : eps ∈ Ioc 0 1)
(hd : 2 ≤ d) (g : Fin d → (Fin m → ℝ) → ℝ) (hg : ∀ j, Measurable (g j)) :
∀ j j' : Fin d, j ≠ j' →
|blockCov (m := m) P eps (columnStatistic eps g j) (columnStatistic eps g j')| ≤
|contrast P j * contrast P j'| /
sqrt (((noiseScale d eps)^2 - (contrast P j)^2) *
((noiseScale d eps)^2 - (contrast P j')^2)) *
sqrt (blockVar (m := m) P eps (columnStatistic eps g j) *
blockVar (m := m) P eps (columnStatistic eps g j')) := by
classical
intro j j' hjj
obtain ⟨c, hc0, hc⟩ := columnStatistic_centered_walsh_expansion P hP eps heps.1 hd g j
obtain ⟨c', hc0', hc'⟩ := columnStatistic_centered_walsh_expansion P hP eps heps.1 hd g j'
let r := -(contrast P j * contrast P j') /
sqrt (((noiseScale d eps)^2 - (contrast P j)^2) *
((noiseScale d eps)^2 - (contrast P j')^2))
have hrabs : |r| = |contrast P j * contrast P j'| /
sqrt (((noiseScale d eps)^2 - (contrast P j)^2) *
((noiseScale d eps)^2 - (contrast P j')^2)) := by
simp only [r, abs_div, abs_neg, abs_of_nonneg (Real.sqrt_nonneg _)]
have hr : |r| ≤ 1 := by
rw [hrabs]
have hdim := column_correlation_le_inv_dimension P hP eps heps.1 hd j j'
have hdR : (2 : ℝ) ≤ d := by exact_mod_cast hd
have hinv : (d : ℝ)⁻¹ ≤ 1 := by
rw [inv_le_one₀ (by linarith : (0 : ℝ) < d)]
linarith
exact hdim.trans hinv
rw [blockCov_walsh_expansion P hP eps heps.1 hd j j' hjj _ _ c c' hc hc',
blockVar_walsh_expansion P hP eps heps.1 hd j _ c hc,
blockVar_walsh_expansion P hP eps heps.1 hd j' _ c' hc']
exact (walsh_diagonal_sum_abs_le c c' hc0 r hr).trans_eq (by rw [hrabs])
theorem private_moment_and_dependence
For iid sampling, a causal population law, privacy in the calibrated range, at least two cells, and a positive block size bounded by the sample size, the vector channel satisfies privacy, its moment identities, and both column-dependence bounds.
Formal statement
hypotheses
n :
ℕ
m :
ℕ
d :
ℕ
S :
SamplingScheme n d
hIID :
P :
hP :
eps :
ℝ
heps :
eps ∈ Ioc 0 1
hd :
2 ≤ d
hm :
0 < m
hmn :
m ≤ n
conclusion
conclusion 1
NoninteractiveClass (vectorProtocol n d eps) eps
conclusion 2
blockMean (m := m) P eps (fun z => scaledMessages eps z i j) = contrast P j
conclusion 3
= 0
conclusion 4
= (contrast P j)^k
conclusion 5
≤ ((contrast P j)^2 + 2*k*(noiseScale d eps)^2/m)^k
conclusion 6
(∀ j, Measurable (g j))
j j' :
Fin d
j ≠ j'
≤ |contrast P j * contrast P j'| / sqrt (((noiseScale d eps)^2 - (contrast P j)^2) * ((noiseScale d eps)^2 - (contrast P j')^2)) * sqrt (blockVar (m := m) P eps (columnStatistic eps g j) * blockVar (m := m) P eps (columnStatistic eps g j'))
blockVar (m := m) P eps (fun z => (d : ℝ)⁻¹ * ∑ j, columnStatistic eps g j z)
Proof (Lean source)
lemma private_moment_and_dependence (S : SamplingScheme n d) (hIID : IidPeople S)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(eps : ℝ) (heps : eps ∈ Ioc 0 1) (hd : 2 ≤ d) (hm : 0 < m) (hmn : m ≤ n) :
NoninteractiveClass (vectorProtocol n d eps) eps ∧
(∀ (i : Fin m) (j : Fin d),
blockMean (m := m) P eps (fun z => scaledMessages eps z i j) = contrast P j ∧
blockMean (m := m) P eps (fun z => (scaledMessages eps z i j)^2) = (noiseScale d eps)^2) ∧
(∀ (i : Fin m) (j j' : Fin d), j ≠ j' →
blockMean (m := m) P eps (fun z => scaledMessages eps z i j * scaledMessages eps z i j')
= 0) ∧
(∀ k : ℕ, k ≤ m → ∀ j : Fin d,
blockMean (m := m) P eps (fun z => privateMoment (scaledMessages eps z) k j) = (contrast
P j)^k) ∧
(∀ k : ℕ, 2*k ≤ m → ∀ j : Fin d,
blockMean (m := m) P eps (fun z => (privateMoment (scaledMessages eps z) k j)^2) ≤
((contrast P j)^2 + 2*k*(noiseScale d eps)^2/m)^k) ∧
(∀ g : Fin d → (Fin m → ℝ) → ℝ, (∀ j, Measurable (g j)) →
(∀ j j' : Fin d, j ≠ j' → -- @realizes j'(second cell index)
|blockCov (m := m) P eps (columnStatistic eps g j) (columnStatistic eps g j')| ≤
|contrast P j * contrast P j'| /
sqrt (((noiseScale d eps)^2 - (contrast P j)^2) *
((noiseScale d eps)^2 - (contrast P j')^2)) *
sqrt (blockVar (m := m) P eps (columnStatistic eps g j) *
blockVar (m := m) P eps (columnStatistic eps g j'))) ∧
blockVar (m := m) P eps (fun z => (d : ℝ)⁻¹ * ∑ j, columnStatistic eps g j z) ≤
(2/(d : ℝ)) * sSup (range (fun j => blockVar (m := m) P eps (columnStatistic eps g
j)))) := by
obtain ⟨hNI, hfirst, hcross, hpower, hsecond⟩ :=
vector_private_moments S hIID P hP eps heps hd hm hmn
refine ⟨hNI, hfirst, hcross, hpower, hsecond, ?_⟩
intro g hg
have hpair := column_covariance_bound (m := m) P hP eps heps hd g hg
refine ⟨hpair, ?_⟩
apply blockVar_average_le_of_covariance P eps (by omega) (columnStatistic eps g)
intro j j' hjj
exact (hpair j j' hjj).trans (mul_le_mul_of_nonneg_right
(column_correlation_le_inv_dimension P hP eps heps.1 hd j j')
(Real.sqrt_nonneg _))
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.MomentDependence.Moments 28 declarations Finite original-record private value frontiers: Helpers/MomentDependence/Moments.
Helpers/MomentDependence/Moments
Finite original-record private value frontiers: Helpers/MomentDependence/Moments.
def blockMean
Fix the probability law P, the privacy budget, and the function f. Expectations on finite message blocks.
Definition (Lean source)
def blockVar
Fix the probability law P, the privacy budget, and the function f. Variance on finite message blocks.
Definition (Lean source)
parameters
def
blockVar P eps f :
ℝ
given by
∫ z, (f z - blockMean (m := m) P eps f)^2 ∂(vectorBlockLaw P eps m)
def columnStatistic
Fix the privacy budget, the function g, the coordinate index, and the function z. Own-column statistics.
Squaring a scaled sign removes all dependence on the released bit.
Formal statement
hypotheses
conclusion
(scaledMessages eps z i j)^2 = (noiseScale d eps)^2
Proof (Lean source)
-- @node: scaledMessages_sq
lemma scaledMessages_sq (eps : ℝ) (z : Fin m → Fin d → Bool)
(i : Fin m) (j : Fin d) :
(scaledMessages eps z i j)^2 = (noiseScale d eps)^2 := by
unfold scaledMessages signVal
cases z i j <;> simp
The second scaled-message moment is the squared noise scale.
Proof (Lean source)
-- @node: blockMean_scaledMessages_sq
lemma blockMean_scaledMessages_sq (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(eps : ℝ) (i : Fin m) (j : Fin d) :
blockMean P eps (fun z => (scaledMessages eps z i j)^2) = (noiseScale d eps)^2 := by
letI := vectorBlockLaw_probability P eps m
simp [blockMean, scaledMessages_sq]
Assume the stated hjj condition. Uniform signs have zero mixed second moment in distinct coordinates.
Formal statement
Proof (Lean source)
-- @node: sum_vector_two_signs
lemma sum_vector_two_signs (j j' : Fin d) (hjj : j ≠ j') :
∑ z : Fin d → Bool, signVal (z j) * signVal (z j') = 0 := by
classical
apply Finset.sum_ninvolution (fun z => update z j (!(z j)))
· intro z
simp only [Function.update_self, Function.update_of_ne hjj.symm]
cases hj : z j <;> cases hj' : z j' <;> simp [signVal, hj, hj']
· intro z _ heq
have h := congrFun heq j
cases hz : z j <;> simp [hz] at h
· intro z
exact Finset.mem_univ _
· intro z
ext l
by_cases h : l = j
· subst l
simp
· simp [Function.update_of_ne h]
Global sign reversal cancels every product of three signs, including repeated indices.
Formal statement
Proof (Lean source)
-- @node: sum_vector_three_signs
lemma sum_vector_three_signs (j j' l : Fin d) :
∑ z : Fin d → Bool, signVal (z j) * signVal (z j') * signVal (z l) = 0 := by
classical
apply Finset.sum_ninvolution (fun z i => !(z i))
· intro z
cases hj : z j <;> cases hj' : z j' <;> cases hl : z l <;>
norm_num [signVal, hj, hj', hl]
· intro z _ heq
have h := congrFun heq j
cases hz : z j <;> simp [hz] at h
· intro z
exact Finset.mem_univ _
· intro z
ext i
simp
Assume the stated hjj condition. Cancellation of both the uniform and affine parts of a channel's cross moment.
Formal statement
Proof (Lean source)
-- @node: sum_vectorMass_cross
lemma sum_vectorMass_cross (eps : ℝ) (o : ObsRecord d)
(j j' : Fin d) (hjj : j ≠ j') :
∑ z : Fin d → Bool, vectorMass eps o z * (signVal (z j) * signVal (z j')) = 0 := by
have hexpand : ∀ z : Fin d → Bool,
vectorMass eps o z * (signVal (z j) * signVal (z j')) =
(2 : ℝ)^(-(d : ℤ)) * (signVal (z j) * signVal (z j')) +
((2 : ℝ)^(-(d : ℤ)) * privacyDelta eps * obsSign o) *
(signVal (z j) * signVal (z j') * signVal (z o.1)) := by
intro z
unfold vectorMass
ring
simp_rw [hexpand]
rw [Finset.sum_add_distrib, ← Finset.mul_sum, ← Finset.mul_sum,
sum_vector_two_signs j j' hjj, sum_vector_three_signs]
ring
theorem vectorKernel_cross_sign_integral
Assume the stated hjj condition. A channel row has zero cross-coordinate sign expectation for every original record.
Formal statement
Proof (Lean source)
-- @node: vectorKernel_cross_sign_integral
lemma vectorKernel_cross_sign_integral (eps : ℝ) (o : ObsRecord d)
(j j' : Fin d) (hjj : j ≠ j') :
(∫ z, signVal (z j) * signVal (z j') ∂vectorKernel d eps o) = 0 := by
letI := vectorKernel_markov d eps
rw [integral_fintype Integrable.of_finite]
change (∑ z, (atomLaw (vectorMass eps o)).real {z} *
(signVal (z j) * signVal (z j'))) = 0
simp only [measureReal_def, atomLaw_singleton,
ENNReal.toReal_ofReal (vectorMass_nonneg eps o _), smul_eq_mul]
exact sum_vectorMass_cross eps o j j' hjj
theorem vectorMessageLaw_cross_sign_integral Lemma vectorMessageLaw_cross_sign_integral in the paper ↗
Assume the stated hjj condition. Averaging channel rows preserves the zero cross-coordinate expectation.
Formal statement
hypotheses
Proof (Lean source)
-- @node: vectorMessageLaw_cross_sign_integral
lemma vectorMessageLaw_cross_sign_integral (P : Measure (FullRecord d))
[IsProbabilityMeasure P] (eps : ℝ) (j j' : Fin d) (hjj : j ≠ j') :
(∫ z, signVal (z j) * signVal (z j') ∂vectorMessageLaw P eps) = 0 := by
letI := vectorMessageLaw_probability P eps
letI := vectorKernel_markov d eps
letI : IsProbabilityMeasure (observedLaw P) := by
unfold observedLaw
exact Measure.isProbabilityMeasure_map (by fun_prop)
change (∫ z, signVal (z j) * signVal (z j')
∂((vectorKernel d eps) ∘ₖ Kernel.const Unit (observedLaw P)) ()) = 0
rw [Kernel.integral_comp Integrable.of_finite]
simp_rw [vectorKernel_cross_sign_integral eps _ j j' hjj]
simp
Assume the stated hjj condition. The independent row law transfers the channel cross moment to scaled block messages.
Formal statement
Proof (Lean source)
-- @node: blockMean_scaledMessages_cross
lemma blockMean_scaledMessages_cross (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(eps : ℝ) (i : Fin m) (j j' : Fin d) (hjj : j ≠ j') :
blockMean P eps (fun z => scaledMessages eps z i j * scaledMessages eps z i j') = 0 := by
letI := vectorMessageLaw_probability P eps
unfold blockMean vectorBlockLaw scaledMessages
rw [integral_comp_eval (μ := fun _ : Fin m => vectorMessageLaw P eps) (i := i) (f := fun z : Fin d → Bool =>
noiseScale d eps * signVal (z j) * (noiseScale d eps * signVal (z j'))) (by fun_prop)]
have hfactor : ∀ z : Fin d → Bool,
noiseScale d eps * signVal (z j) * (noiseScale d eps * signVal (z j')) =
(noiseScale d eps)^2 * (signVal (z j) * signVal (z j')) := by
intro z
ring
simp_rw [hfactor]
rw [integral_const_mul, vectorMessageLaw_cross_sign_integral P eps j j' hjj, mul_zero]
Products using distinct participant rows factor under the independent block law.
Formal statement
hypotheses
conclusion
blockMean P eps (fun z => ∏ i ∈ J, scaledMessages eps z i j)
= (∫ z, noiseScale d eps * signVal (z j) ∂vectorMessageLaw P eps)^J.card
Proof (Lean source)
-- @node: blockMean_scaledMessages_product
lemma blockMean_scaledMessages_product (P : Measure (FullRecord d))
[IsProbabilityMeasure P] (eps : ℝ) (J : Finset (Fin m)) (j : Fin d) :
blockMean P eps (fun z => ∏ i ∈ J, scaledMessages eps z i j) =
(∫ z, noiseScale d eps * signVal (z j) ∂vectorMessageLaw P eps)^J.card := by
classical
letI := vectorMessageLaw_probability P eps
unfold blockMean vectorBlockLaw scaledMessages
simp_rw [← Finset.prod_ite_mem_eq J]
rw [integral_fintype_prod_eq_prod (μ := fun _ : Fin m => vectorMessageLaw P eps)
(fun (i : Fin m) (z : Fin d → Bool) => if i ∈ J then
noiseScale d eps * signVal (z j) else 1)]
have hrow : ∀ i : Fin m,
(∫ z, (if i ∈ J then noiseScale d eps * signVal (z j) else 1)
∂vectorMessageLaw P eps) =
if i ∈ J then (∫ z, noiseScale d eps * signVal (z j)
∂vectorMessageLaw P eps) else 1 := by
intro i
split_ifs <;> simp
simp_rw [hrow]
rw [Finset.prod_ite_mem_eq, Finset.prod_const]
theorem blockMean_privateMoment_eq_rowMean_pow
Assume the stated hkm condition. Averaging distinct-row products gives the corresponding power of the one-row mean.
Formal statement
hypotheses
conclusion
= (∫ z, noiseScale d eps * signVal (z j) ∂vectorMessageLaw P eps)^k
Proof (Lean source)
-- @node: blockMean_privateMoment_eq_rowMean_pow
lemma blockMean_privateMoment_eq_rowMean_pow (P : Measure (FullRecord d))
[IsProbabilityMeasure P] (eps : ℝ) (k : ℕ) (hkm : k ≤ m) (j : Fin d) :
blockMean (m := m) P eps (fun z => privateMoment (scaledMessages eps z) k j) =
(∫ z, noiseScale d eps * signVal (z j) ∂vectorMessageLaw P eps)^k := by
classical
letI := vectorBlockLaw_probability P eps m
unfold blockMean privateMoment
rw [integral_const_mul, integral_finset_sum _ (fun _ _ => Integrable.of_finite)]
have hterm : ∀ J ∈ (Finset.univ : Finset (Fin m)).powersetCard k,
(∫ z, ∏ i ∈ J, scaledMessages eps z i j ∂vectorBlockLaw P eps m) =
(∫ z, noiseScale d eps * signVal (z j) ∂vectorMessageLaw P eps)^k := by
intro J hJ
change blockMean P eps (fun z => ∏ i ∈ J, scaledMessages eps z i j) = _
rw [blockMean_scaledMessages_product, (Finset.mem_powersetCard.mp hJ).2]
rw [Finset.sum_congr rfl hterm]
simp only [Finset.sum_const, Finset.card_powersetCard, Finset.card_univ,
Fintype.card_fin, nsmul_eq_mul]
have hchoose : (Nat.choose m k : ℝ) ≠ 0 := by
exact_mod_cast (Nat.choose_pos hkm).ne'
rw [← mul_assoc, inv_mul_cancel₀ hchoose, one_mul]
theorem blockMean_scaledMessages_eq_rowMean Lemma blockMean_scaledMessages_eq_rowMean in the paper ↗
A selected participant has the common one-row mean.
Formal statement
hypotheses
conclusion
blockMean P eps (fun z => scaledMessages eps z i j)
= ∫ z, noiseScale d eps * signVal (z j) ∂vectorMessageLaw P eps
Proof (Lean source)
-- @node: blockMean_scaledMessages_eq_rowMean
lemma blockMean_scaledMessages_eq_rowMean (P : Measure (FullRecord d))
[IsProbabilityMeasure P] (eps : ℝ) (i : Fin m) (j : Fin d) :
blockMean P eps (fun z => scaledMessages eps z i j) =
∫ z, noiseScale d eps * signVal (z j) ∂vectorMessageLaw P eps := by
letI := vectorMessageLaw_probability P eps
unfold blockMean vectorBlockLaw scaledMessages
exact integral_comp_eval (μ := fun _ : Fin m => vectorMessageLaw P eps)
(i := i) (f := fun z : Fin d → Bool => noiseScale d eps * signVal (z j))
Integrable.of_finite.aestronglyMeasurable
theorem vectorKernel_sign_integral
A channel row biases precisely the coordinate named by its original input.
Formal statement
hypotheses
conclusion
(∫ z, signVal (z j) ∂vectorKernel d eps o)
= if o.1 = j then privacyDelta eps * obsSign o else 0
Proof (Lean source)
-- @node: vectorKernel_sign_integral
lemma vectorKernel_sign_integral (eps : ℝ) (o : ObsRecord d) (j : Fin d) :
(∫ z, signVal (z j) ∂vectorKernel d eps o) =
if o.1 = j then privacyDelta eps * obsSign o else 0 := by
classical
letI := vectorKernel_markov d eps
rw [integral_fintype Integrable.of_finite]
change (∑ z, (atomLaw (vectorMass eps o)).real {z} * signVal (z j)) = _
simp only [measureReal_def, atomLaw_singleton,
ENNReal.toReal_ofReal (vectorMass_nonneg eps o _), smul_eq_mul]
have hexpand : ∀ z : Fin d → Bool,
vectorMass eps o z * signVal (z j) =
(2 : ℝ)^(-(d : ℤ)) * signVal (z j) +
((2 : ℝ)^(-(d : ℤ)) * privacyDelta eps * obsSign o) *
(signVal (z o.1) * signVal (z j)) := by
intro z
unfold vectorMass
ring
simp_rw [hexpand]
rw [Finset.sum_add_distrib, ← Finset.mul_sum, ← Finset.mul_sum,
sum_vector_coordinate_sign, mul_zero, zero_add]
by_cases h : o.1 = j
· have hsquare : ∀ z : Fin d → Bool, signVal (z j) * signVal (z j) = 1 := by
intro z
cases z j <;> norm_num [signVal]
simp_rw [h, hsquare]
simp only [Finset.sum_const, Finset.card_univ, Fintype.card_fun,
Fintype.card_fin, Fintype.card_bool, nsmul_eq_mul, mul_one, if_true,
zpow_neg, zpow_natCast]
field_simp
push_cast
ring
· rw [sum_vector_two_signs o.1 j h]
simp [h]
Averaging the original-input rows expresses a coordinate bias as a signed cell integral.
Formal statement
hypotheses
conclusion
(∫ z, signVal (z j) ∂vectorMessageLaw P eps)
= privacyDelta eps * ∫ w, if cell w = j then obsSign (observe w) else 0 ∂P
Proof (Lean source)
-- @node: vectorMessageLaw_sign_integral
lemma vectorMessageLaw_sign_integral (P : Measure (FullRecord d))
[IsProbabilityMeasure P] (eps : ℝ) (j : Fin d) :
(∫ z, signVal (z j) ∂vectorMessageLaw P eps) =
privacyDelta eps * ∫ w, if cell w = j then obsSign (observe w) else 0 ∂P := by
letI := vectorMessageLaw_probability P eps
letI := vectorKernel_markov d eps
letI : IsProbabilityMeasure (observedLaw P) := by
unfold observedLaw
exact Measure.isProbabilityMeasure_map (by fun_prop)
change (∫ z, signVal (z j)
∂((vectorKernel d eps) ∘ₖ Kernel.const Unit (observedLaw P)) ()) = _
rw [Kernel.integral_comp Integrable.of_finite]
simp_rw [vectorKernel_sign_integral]
have hfactor : ∀ o : ObsRecord d,
(if o.1 = j then privacyDelta eps * obsSign o else 0) =
privacyDelta eps * (if o.1 = j then obsSign o else 0) := by
intro o
split_ifs <;> ring
simp_rw [hfactor]
rw [integral_const_mul]
congr 1
unfold observedLaw
change (∫ o, if o.1 = j then obsSign o else 0 ∂P.map observe) = _
rw [integral_map (by fun_prop) (by fun_prop)]
rfl
theorem vectorMessageLaw_scaled_sign_integral
Assume the causal-model conditions for the data law, a positive privacy budget, and dimension at least two. The signed causal bridge identifies the scaled one-row coordinate mean. The causal input mean is supplied by the proved signedCellMean_eq_contrast.
Formal statement
hypotheses
conclusion
(∫ z, noiseScale d eps * signVal (z j) ∂vectorMessageLaw P eps) = contrast P j
Proof (Lean source)
-- @node: vectorMessageLaw_scaled_sign_integral
lemma vectorMessageLaw_scaled_sign_integral (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(hP : CausalModel P) (eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d) (j : Fin d) :
(∫ z, noiseScale d eps * signVal (z j) ∂vectorMessageLaw P eps) = contrast P j := by
letI := vectorMessageLaw_probability P eps
have hdelta : privacyDelta eps ≠ 0 := by
rw [privacyDelta_exp_formula]
exact div_ne_zero (ne_of_gt (sub_pos.mpr (Real.one_lt_exp_iff.mpr heps)))
(ne_of_gt (by positivity))
have hdreal : (d : ℝ) ≠ 0 := by
exact_mod_cast (show d ≠ 0 by omega)
have hcell := signedCellMean_eq_contrast P hP j
unfold signedCellMean at hcell
rw [hP.uniform j] at hcell
have hmean : (∫ w, if cell w = j then obsSign (observe w) else 0 ∂P) =
contrast P j / d := by
apply (div_eq_iff (inv_ne_zero hdreal)).mp at hcell
simpa [div_eq_mul_inv] using hcell
rw [integral_const_mul, vectorMessageLaw_sign_integral, hmean]
unfold noiseScale
field_simp
theorem privateMoment_zero
The degree-zero distinct-person statistic is identically one.
Formal statement
hypotheses
conclusion
privateMoment W 0 j = 1
Proof (Lean source)
-- @node: privateMoment_zero
lemma privateMoment_zero (W : Fin m → Fin d → ℝ) (j : Fin d) :
privateMoment W 0 j = 1 := by
simp [privateMoment]
theorem privateMoment_one
The degree-one statistic is the average of the scaled participant messages.
Formal statement
hypotheses
conclusion
privateMoment W 1 j = (m : ℝ)⁻¹ * ∑ i, W i j
Proof (Lean source)
-- @node: privateMoment_one
lemma privateMoment_one (W : Fin m → Fin d → ℝ) (j : Fin d) :
privateMoment W 1 j = (m : ℝ)⁻¹ * ∑ i, W i j := by
classical
simp [privateMoment, Finset.powersetCard_one, Finset.sum_image]
theorem blockMean_scaledMessages_distinct_rows Lemma blockMean_scaledMessages_distinct_rows in the paper ↗
Assume the stated hii condition. Independent distinct rows factor their common-coordinate cross moment.
Formal statement
hypotheses
conclusion
= (∫ z, noiseScale d eps * signVal (z j) ∂vectorMessageLaw P eps)^2
Proof (Lean source)
-- @node: blockMean_scaledMessages_distinct_rows
lemma blockMean_scaledMessages_distinct_rows (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(eps : ℝ) (i i' : Fin m) (hii : i ≠ i') (j : Fin d) :
blockMean P eps (fun z => scaledMessages eps z i j * scaledMessages eps z i' j) =
(∫ z, noiseScale d eps * signVal (z j) ∂vectorMessageLaw P eps)^2 := by
classical
have h := blockMean_scaledMessages_product P eps {i, i'} j
simpa [Finset.prod_insert, hii] using h
The squared column sum separates the diagonal noise terms from distinct-row means.
Formal statement
hypotheses
conclusion
blockMean (m := m) P eps (fun z => (∑ i, scaledMessages eps z i j)^2)
= (m : ℝ) * (noiseScale d eps)^2
+ (m : ℝ) * (m-1 : ℝ) * (∫ z, noiseScale d eps * signVal (z j) ∂vectorMessageLaw P eps)^2
Proof (Lean source)
-- @node: blockMean_scaledMessages_sum_sq
lemma blockMean_scaledMessages_sum_sq (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(eps : ℝ) (j : Fin d) :
blockMean (m := m) P eps (fun z => (∑ i, scaledMessages eps z i j)^2) =
(m : ℝ) * (noiseScale d eps)^2 + (m : ℝ) * (m-1 : ℝ) *
(∫ z, noiseScale d eps * signVal (z j) ∂vectorMessageLaw P eps)^2 := by
classical
letI := vectorBlockLaw_probability P eps m
simp only [pow_two, Finset.sum_mul, Finset.mul_sum]
unfold blockMean
rw [integral_finset_sum _ (fun _ _ => Integrable.of_finite)]
simp_rw [integral_finset_sum _ (fun _ _ => Integrable.of_finite)]
have hrow : ∀ i i' : Fin m,
(∫ z, scaledMessages eps z i j * scaledMessages eps z i' j
∂vectorBlockLaw P eps m) =
(∫ z, noiseScale d eps * signVal (z j) ∂vectorMessageLaw P eps)^2 +
if i' = i then (noiseScale d eps)^2 -
(∫ z, noiseScale d eps * signVal (z j) ∂vectorMessageLaw P eps)^2 else 0 := by
intro i i'
by_cases h : i' = i
· subst i'
rw [if_pos rfl]
have hs := blockMean_scaledMessages_sq P eps i j
simp only [blockMean, pow_two] at hs
rw [hs]
ring
· rw [if_neg h]
have hs := blockMean_scaledMessages_distinct_rows P eps i i' (Ne.symm h) j
simpa [blockMean] using hs
simp_rw [hrow]
simp [Finset.sum_add_distrib]
ring
theorem blockMean_privateMoment_one_sq
Assume the causal-model conditions for the data law, a positive privacy budget, dimension at least two, and positive block size. The squared first private moment has the exact iid mean-square formula.
Formal statement
hypotheses
conclusion
= (contrast P j)^2 + ((noiseScale d eps)^2 - (contrast P j)^2)/m
Proof (Lean source)
-- @node: blockMean_privateMoment_one_sq
lemma blockMean_privateMoment_one_sq (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(hP : CausalModel P) (eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d)
(hm : 0 < m) (j : Fin d) :
blockMean (m := m) P eps (fun z => (privateMoment (scaledMessages eps z) 1 j)^2) =
(contrast P j)^2 + ((noiseScale d eps)^2 - (contrast P j)^2)/m := by
simp_rw [privateMoment_one, mul_pow]
unfold blockMean
rw [integral_const_mul]
change ((m : ℝ)⁻¹)^2 *
blockMean P eps (fun z => (∑ i, scaledMessages eps z i j)^2) = _
rw [blockMean_scaledMessages_sum_sq, vectorMessageLaw_scaled_sign_integral P hP eps heps hd j]
have hmR : (m : ℝ) ≠ 0 := by exact_mod_cast hm.ne'
field_simp
<;> ring
theorem blockMean_privateMoment_one_sq_le
Assume the causal-model conditions for the data law, a positive privacy budget, dimension at least two, and positive block size. The exact first-moment formula implies the declared degree-one second-moment bound.
Formal statement
hypotheses
conclusion
≤ (contrast P j)^2 + 2*(noiseScale d eps)^2/m
Proof (Lean source)
-- @node: blockMean_privateMoment_one_sq_le
lemma blockMean_privateMoment_one_sq_le (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(hP : CausalModel P) (eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d)
(hm : 0 < m) (j : Fin d) :
blockMean (m := m) P eps (fun z => (privateMoment (scaledMessages eps z) 1 j)^2) ≤
(contrast P j)^2 + 2*(noiseScale d eps)^2/m := by
rw [blockMean_privateMoment_one_sq P hP eps heps hd hm j]
apply add_le_add_right
apply div_le_div_of_nonneg_right _ (by positivity)
nlinarith [sq_nonneg (noiseScale d eps), sq_nonneg (contrast P j)]
theorem blockMean_scaledMessages_subset_product
Assume the causal-model conditions for the data law, a positive privacy budget, and dimension at least two. The product of two subset statistics factors into its one-row moments.
Formal statement
hypotheses
conclusion
blockMean P eps (fun z => (∏ i ∈ J, scaledMessages eps z i j) * (∏ i ∈ K, scaledMessages eps z i j))
= ∏ i : Fin m, if i ∈ J then (if i ∈ K then (noiseScale d eps)^2 else contrast P j) else (if i ∈ K then contrast P j else 1)
Proof (Lean source)
-- @node: blockMean_scaledMessages_subset_product
lemma blockMean_scaledMessages_subset_product (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(hP : CausalModel P) (eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d)
(J K : Finset (Fin m)) (j : Fin d) :
blockMean P eps (fun z => (∏ i ∈ J, scaledMessages eps z i j) *
(∏ i ∈ K, scaledMessages eps z i j)) =
∏ i : Fin m, if i ∈ J then
(if i ∈ K then (noiseScale d eps)^2 else contrast P j)
else (if i ∈ K then contrast P j else 1) := by
classical
letI := vectorMessageLaw_probability P eps
unfold blockMean vectorBlockLaw scaledMessages
simp_rw [← Finset.prod_ite_mem_eq J, ← Finset.prod_ite_mem_eq K, ← Finset.prod_mul_distrib]
rw [integral_fintype_prod_eq_prod (μ := fun _ : Fin m => vectorMessageLaw P eps)
(fun (i : Fin m) (z : Fin d → Bool) =>
(if i ∈ J then noiseScale d eps * signVal (z j) else 1) *
(if i ∈ K then noiseScale d eps * signVal (z j) else 1))]
apply Finset.prod_congr rfl
intro i _
by_cases hJ : i ∈ J <;> by_cases hK : i ∈ K
· simp only [hJ, hK, ↓reduceIte]
have hs : ∀ z : Fin d → Bool,
(noiseScale d eps * signVal (z j)) * (noiseScale d eps * signVal (z j)) =
(noiseScale d eps)^2 := by
intro z
cases z j <;> simp [signVal, pow_two]
simp_rw [hs]
simp
· simp only [hJ, hK, ↓reduceIte, mul_one]
exact vectorMessageLaw_scaled_sign_integral P hP eps heps hd j
· simp only [hJ, hK, ↓reduceIte, one_mul]
exact vectorMessageLaw_scaled_sign_integral P hP eps heps hd j
· simp [hJ, hK]
theorem blockMean_scaledMessages_subset_overlap
Assume the causal-model conditions for the data law, a positive privacy budget, and dimension at least two. Shared participant rows contribute squared noise and unshared rows contribute contrast powers.
Formal statement
hypotheses
conclusion
blockMean P eps (fun z => (∏ i ∈ J, scaledMessages eps z i j) * (∏ i ∈ K, scaledMessages eps z i j))
= ((noiseScale d eps)^2)^(J ∩ K).card * (contrast P j)^((J \ K).card + (K \ J).card)
Proof (Lean source)
-- @node: blockMean_scaledMessages_subset_overlap
lemma blockMean_scaledMessages_subset_overlap (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(hP : CausalModel P) (eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d)
(J K : Finset (Fin m)) (j : Fin d) :
blockMean P eps (fun z => (∏ i ∈ J, scaledMessages eps z i j) *
(∏ i ∈ K, scaledMessages eps z i j)) =
((noiseScale d eps)^2)^(J ∩ K).card *
(contrast P j)^((J \ K).card + (K \ J).card) := by
classical
rw [blockMean_scaledMessages_subset_product P hP eps heps hd J K j]
have hf : ∀ i : Fin m,
(if i ∈ J then (if i ∈ K then (noiseScale d eps)^2 else contrast P j)
else (if i ∈ K then contrast P j else 1)) =
(if i ∈ J ∩ K then (noiseScale d eps)^2 else 1) *
(if i ∈ J \ K then contrast P j else 1) *
(if i ∈ K \ J then contrast P j else 1) := by
intro i
by_cases hJ : i ∈ J <;> by_cases hK : i ∈ K <;> simp [hJ, hK]
simp_rw [hf, Finset.prod_mul_distrib, Finset.prod_ite_mem_eq, Finset.prod_const]
rw [pow_add]
ring
theorem blockMean_privateMoment_sq_overlap_sum
Assume the causal-model conditions for the data law, a positive privacy budget, and dimension at least two. The squared private moment is the normalized finite sum over subset overlaps.
Formal statement
hypotheses
conclusion
= ((Nat.choose m k : ℝ)⁻¹)^2 * ∑ J ∈ (Finset.univ : Finset (Fin m)).powersetCard k, ∑ K ∈ (Finset.univ : Finset (Fin m)).powersetCard k, ((noiseScale d eps)^2)^(J ∩ K).card * (contrast P j)^((J \ K).card + (K \ J).card)
Proof (Lean source)
-- @node: blockMean_privateMoment_sq_overlap_sum
lemma blockMean_privateMoment_sq_overlap_sum (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(hP : CausalModel P) (eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d)
(k : ℕ) (j : Fin d) :
blockMean (m := m) P eps (fun z => (privateMoment (scaledMessages eps z) k j)^2) =
((Nat.choose m k : ℝ)⁻¹)^2 *
∑ J ∈ (Finset.univ : Finset (Fin m)).powersetCard k,
∑ K ∈ (Finset.univ : Finset (Fin m)).powersetCard k,
((noiseScale d eps)^2)^(J ∩ K).card *
(contrast P j)^((J \ K).card + (K \ J).card) := by
classical
letI := vectorBlockLaw_probability P eps m
have hexpand : ∀ z : Fin m → Fin d → Bool,
(privateMoment (scaledMessages eps z) k j)^2 =
((Nat.choose m k : ℝ)⁻¹)^2 *
∑ J ∈ (Finset.univ : Finset (Fin m)).powersetCard k,
∑ K ∈ (Finset.univ : Finset (Fin m)).powersetCard k,
(∏ i ∈ J, scaledMessages eps z i j) *
(∏ i ∈ K, scaledMessages eps z i j) := by
intro z
unfold privateMoment
rw [mul_pow]
congr 1
rw [pow_two, Finset.sum_mul]
simp_rw [Finset.mul_sum]
unfold blockMean
simp_rw [hexpand]
rw [integral_const_mul, integral_finset_sum _ (fun _ _ => Integrable.of_finite)]
simp_rw [integral_finset_sum _ (fun _ _ => Integrable.of_finite)]
congr 1
apply Finset.sum_congr rfl
intro J hJ
apply Finset.sum_congr rfl
intro K hK
exact blockMean_scaledMessages_subset_overlap P hP eps heps hd J K j
theorem blockMean_privateMoment_sq_le
Assume the causal-model conditions for the data law, a positive privacy budget, dimension at least two, positive block size, and the stated hkm condition. The exact overlap expansion and finite inclusion bound give the second moment for every degree, without dividing by the cell contrast.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
P :
hP :
eps :
ℝ
heps :
0 < eps
hd :
2 ≤ d
hm :
0 < m
k :
ℕ
hkm :
2*k ≤ m
j :
Fin d
conclusion
≤ ((contrast P j)^2 + 2*k*(noiseScale d eps)^2/m)^k
Proof (Lean source)
-- @node: blockMean_privateMoment_sq_le
lemma blockMean_privateMoment_sq_le (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(hP : CausalModel P) (eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d)
(hm : 0 < m) (k : ℕ) (hkm : 2*k ≤ m) (j : Fin d) :
blockMean (m := m) P eps (fun z => (privateMoment (scaledMessages eps z) k j)^2) ≤
((contrast P j)^2 + 2*k*(noiseScale d eps)^2/m)^k := by
by_cases hk0 : k = 0
· subst k
letI := vectorBlockLaw_probability P eps m
simp [blockMean, privateMoment_zero]
by_cases hk1 : k = 1
· subst k
simpa using blockMean_privateMoment_one_sq_le P hP eps heps hd hm j
rw [blockMean_privateMoment_sq_overlap_sum P hP eps heps hd k j]
have hterm : ∀ J ∈ (Finset.univ : Finset (Fin m)).powersetCard k,
∀ K ∈ (Finset.univ : Finset (Fin m)).powersetCard k,
(contrast P j)^((J \ K).card + (K \ J).card) =
((contrast P j)^2)^(k-(J ∩ K).card) := by
intro J hJ K hK
have hJcard := (Finset.mem_powersetCard.mp hJ).2
have hKcard := (Finset.mem_powersetCard.mp hK).2
have hleft : (J \ K).card = k-(J ∩ K).card := by
rw [← Finset.sdiff_inter_self_left, Finset.card_sdiff_of_subset
Finset.inter_subset_left, hJcard]
have hright : (K \ J).card = k-(J ∩ K).card := by
rw [← Finset.sdiff_inter_self_left, Finset.card_sdiff_of_subset
Finset.inter_subset_left, hKcard, Finset.inter_comm]
rw [hleft, hright, ← pow_mul]
congr 1
omega
simp_rw [Finset.sum_congr rfl (fun J hJ =>
Finset.sum_congr rfl (fun K hK => congrArg
(fun x => ((noiseScale d eps)^2)^(J ∩ K).card * x) (hterm J hJ K hK)))]
simpa using overlap_average_le (Finset.univ : Finset (Fin m)) k
(by simpa using hm) (by simpa using hkm)
((contrast P j)^2) ((noiseScale d eps)^2) (sq_nonneg _) (sq_nonneg _)
theorem vector_private_moments
Assume independent and identically distributed participant records, the causal-model conditions for the data law, a privacy budget in the interval from zero to one, dimension at least two, positive block size, and a block no larger than the sample. First, second, cross and distinct-person power moments of the vector channel.
Formal statement
hypotheses
n :
ℕ
m :
ℕ
d :
ℕ
S :
SamplingScheme n d
hIID :
P :
hP :
eps :
ℝ
heps :
eps ∈ Ioc 0 1
hd :
2 ≤ d
hm :
0 < m
hmn :
m ≤ n
conclusion
conclusion 1
NoninteractiveClass (vectorProtocol n d eps) eps
conclusion 2
blockMean (m := m) P eps (fun z => scaledMessages eps z i j) = contrast P j
conclusion 3
= 0
conclusion 4
= (contrast P j)^k
conclusion 5
≤ ((contrast P j)^2 + 2*k*(noiseScale d eps)^2/m)^k
Proof (Lean source)
-- @node: vector_private_moments
lemma vector_private_moments (S : SamplingScheme n d) (hIID : IidPeople S)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(eps : ℝ) (heps : eps ∈ Ioc 0 1) (hd : 2 ≤ d) (hm : 0 < m) (hmn : m ≤ n) :
NoninteractiveClass (vectorProtocol n d eps) eps ∧
(∀ (i : Fin m) (j : Fin d),
blockMean (m := m) P eps (fun z => scaledMessages eps z i j) = contrast P j ∧
blockMean (m := m) P eps (fun z => (scaledMessages eps z i j)^2) = (noiseScale d eps)^2) ∧
(∀ (i : Fin m) (j j' : Fin d), j ≠ j' →
blockMean (m := m) P eps (fun z => scaledMessages eps z i j * scaledMessages eps z i j')
= 0) ∧
(∀ k : ℕ, k ≤ m → ∀ j : Fin d,
blockMean (m := m) P eps (fun z => privateMoment (scaledMessages eps z) k j) = (contrast
P j)^k) ∧
(∀ k : ℕ, 2*k ≤ m → ∀ j : Fin d,
blockMean (m := m) P eps (fun z => (privateMoment (scaledMessages eps z) k j)^2) ≤
((contrast P j)^2 + 2*k*(noiseScale d eps)^2/m)^k) := by
have hfirst : ∀ (i : Fin m) (j : Fin d),
blockMean P eps (fun z => scaledMessages eps z i j) = contrast P j := by
intro i j
rw [blockMean_scaledMessages_eq_rowMean]
exact vectorMessageLaw_scaled_sign_integral P hP eps heps.1 hd j
refine ⟨vectorProtocol_noninteractive n d eps heps.1.le, ?_, ?_, ?_, ?_⟩
· intro i j
exact ⟨hfirst i j, blockMean_scaledMessages_sq P eps i j⟩
· intro i j j' hjj
exact blockMean_scaledMessages_cross P eps i j j' hjj
· intro k hkm j
rw [blockMean_privateMoment_eq_rowMean_pow P eps k hkm j]
have hrow := hfirst ⟨0, hm⟩ j
rw [blockMean_scaledMessages_eq_rowMean] at hrow
rw [hrow]
· intro k hkm j
exact blockMean_privateMoment_sq_le P hP eps heps.1 hd hm k hkm j
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.MomentDependence.WalshExpansion 11 declarations Completeness of the tilted Boolean product basis and exact expansions of column statistics.
Finite Walsh expansion
Completeness of the tilted Boolean product basis and exact expansions of column statistics.
Fix the probability law P, the privacy budget, the coordinate index, the finite index set J, and the function x. The tilted Walsh product as a function of one Boolean column.
Definition (Lean source)
parameters
def
booleanColumnWalsh P eps j J x :
ℝ
given by
∏ i ∈ J, (noiseScale d eps * signVal (x i) - contrast P j) / sqrt ((noiseScale d eps)^2 - (contrast P j)^2)
theorem booleanColumnWalsh_pullback
Pulling a Boolean Walsh function back to released rows gives the column basis.
Formal statement
hypotheses
conclusion
booleanColumnWalsh P eps j J (fun i => z i j) = columnWalsh P eps j J z
Proof (Lean source)
-- @node: booleanColumnWalsh_pullback
lemma booleanColumnWalsh_pullback (P : Measure (FullRecord d)) (eps : ℝ) (j : Fin d)
(J : Finset (Fin m)) (z : Fin m → Fin d → Bool) :
booleanColumnWalsh P eps j J (fun i => z i j) = columnWalsh P eps j J z := by
rfl
theorem booleanColumnWalsh_linearIndependent
Assume the causal-model conditions for the data law, a positive privacy budget, and dimension at least two. Orthogonality detects every coefficient, so the Boolean product functions are independent.
Formal statement
hypotheses
conclusion
LinearIndependent ℝ (booleanColumnWalsh (m := m) P eps j)
Proof (Lean source)
-- @node: booleanColumnWalsh_linearIndependent
lemma booleanColumnWalsh_linearIndependent (P : Measure (FullRecord d))
[IsProbabilityMeasure P] (hP : CausalModel P) (eps : ℝ) (heps : 0 < eps)
(hd : 2 ≤ d) (j : Fin d) :
LinearIndependent ℝ (booleanColumnWalsh (m := m) P eps j) := by
classical
letI := vectorBlockLaw_probability P eps m
rw [Fintype.linearIndependent_iff]
intro c hc J
have hzero (z : Fin m → Fin d → Bool) :
(∑ K : Finset (Fin m), c K * columnWalsh P eps j K z) = 0 := by
have h := congrFun hc (fun i => z i j)
simpa only [Finset.sum_apply, Pi.smul_apply, smul_eq_mul,
booleanColumnWalsh_pullback, Pi.zero_apply] using h
have h := congrArg (fun f : (Fin m → Fin d → Bool) → ℝ => blockMean P eps f)
(show (fun z => (∑ K : Finset (Fin m), c K * columnWalsh P eps j K z) *
columnWalsh P eps j J z) = fun _ => 0 by funext z; rw [hzero z, zero_mul])
simp only [Finset.sum_mul] at h
simp only [mul_assoc, blockMean] at h
rw [integral_finset_sum _ (fun _ _ => Integrable.of_finite)] at h
simp only [integral_const_mul, integral_zero] at h
change (∑ K : Finset (Fin m), c K * blockMean P eps
(fun z => columnWalsh P eps j K z * columnWalsh P eps j J z)) = 0 at h
simp_rw [blockMean_columnWalsh_orthonormal P hP eps heps hd] at h
simpa using h
def booleanColumnWalshBasis
Fix the probability law P, the causal-model conditions for the data law, the privacy budget, a positive privacy budget, dimension at least two, and the coordinate index. Counting Boolean configurations makes the independent product family a full basis.
Definition (Lean source)
parameters
given by
basisOfLinearIndependentOfCardEqFinrank (booleanColumnWalsh_linearIndependent P hP eps heps hd j) (by rw [Module.finrank_fintype_fun_eq_card] simp [Fintype.card_finset, Fintype.card_fun])
theorem columnStatistic_walsh_expansion
Assume the causal-model conditions for the data law, a positive privacy budget, and dimension at least two. Every statistic of one column has a finite tilted Walsh expansion.
Formal statement
hypotheses
conclusion
∀ z, columnStatistic eps g j z = ∑ J, c J * columnWalsh P eps j J z
Proof (Lean source)
-- @node: columnStatistic_walsh_expansion
lemma columnStatistic_walsh_expansion (P : Measure (FullRecord d))
[IsProbabilityMeasure P] (hP : CausalModel P) (eps : ℝ) (heps : 0 < eps)
(hd : 2 ≤ d) (g : Fin d → (Fin m → ℝ) → ℝ) (j : Fin d) :
∃ c : Finset (Fin m) → ℝ, ∀ z,
columnStatistic eps g j z = ∑ J, c J * columnWalsh P eps j J z := by
classical
let B := booleanColumnWalshBasis (m := m) P hP eps heps hd j
let f : (Fin m → Bool) → ℝ := fun x => g j (fun i => noiseScale d eps * signVal (x i))
refine ⟨fun J => B.repr f J, ?_⟩
intro z
have h := congrFun (B.sum_repr f) (fun i => z i j)
have hB : ∀ J, B J = booleanColumnWalsh P eps j J := by
intro J
exact congrFun (coe_basisOfLinearIndependentOfCardEqFinrank _ _) J
simp only [Finset.sum_apply, Pi.smul_apply, smul_eq_mul, hB,
booleanColumnWalsh_pullback] at h
exact h.symm
theorem blockMean_walsh_sum
Assume the causal-model conditions for the data law, a positive privacy budget, and dimension at least two. Only the empty Walsh subset contributes to a column mean.
Formal statement
hypotheses
conclusion
blockMean P eps (fun z => ∑ J, c J * columnWalsh P eps j J z) = c ∅
Proof (Lean source)
-- @node: blockMean_walsh_sum
lemma blockMean_walsh_sum (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(hP : CausalModel P) (eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d)
(j : Fin d) (c : Finset (Fin m) → ℝ) :
blockMean P eps (fun z => ∑ J, c J * columnWalsh P eps j J z) = c ∅ := by
classical
letI := vectorBlockLaw_probability P eps m
have hmean (J : Finset (Fin m)) : blockMean P eps (columnWalsh P eps j J) =
if J = ∅ then 1 else 0 := by
by_cases hJ : J = ∅
· subst J
simp [columnWalsh, blockMean]
· rw [if_neg hJ]
exact blockMean_columnWalsh_nonempty P hP eps heps hd j J
(Finset.nonempty_iff_ne_empty.mpr hJ)
unfold blockMean
rw [integral_finset_sum _ (fun _ _ => Integrable.of_finite)]
simp only [integral_const_mul]
change (∑ J, c J * blockMean P eps (columnWalsh P eps j J)) = _
simp_rw [hmean]
simp
theorem columnStatistic_centered_walsh_expansion
Assume the causal-model conditions for the data law, a positive privacy budget, and dimension at least two. Centering deletes precisely the empty-subset coefficient in the finite expansion.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: columnStatistic_centered_walsh_expansion
lemma columnStatistic_centered_walsh_expansion (P : Measure (FullRecord d))
[IsProbabilityMeasure P] (hP : CausalModel P) (eps : ℝ) (heps : 0 < eps)
(hd : 2 ≤ d) (g : Fin d → (Fin m → ℝ) → ℝ) (j : Fin d) :
∃ c : Finset (Fin m) → ℝ, c ∅ = 0 ∧ ∀ z,
columnStatistic eps g j z - blockMean P eps (columnStatistic eps g j) =
∑ J, c J * columnWalsh P eps j J z := by
classical
obtain ⟨c, hc⟩ := columnStatistic_walsh_expansion P hP eps heps hd g j
have hmean : blockMean P eps (columnStatistic eps g j) = c ∅ := by
rw [show columnStatistic eps g j = (fun z => ∑ J, c J * columnWalsh P eps j J z)
from funext hc]
exact blockMean_walsh_sum P hP eps heps hd j c
refine ⟨fun J => c J - if J = ∅ then c ∅ else 0, by simp, ?_⟩
intro z
rw [hmean, hc]
simp only [sub_mul, Finset.sum_sub_distrib]
congr 1
simp [ite_mul, columnWalsh]
theorem blockMean_walsh_sum_mul
Assume the causal-model conditions for the data law, a positive privacy budget, and dimension at least two. All off-diagonal subset terms vanish in the product of two finite expansions.
Formal statement
hypotheses
conclusion
blockMean P eps (fun z => (∑ J, c J * columnWalsh P eps j J z) * (∑ K, c' K * columnWalsh P eps j' K z))
Proof (Lean source)
-- @node: blockMean_walsh_sum_mul
lemma blockMean_walsh_sum_mul (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(hP : CausalModel P) (eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d)
(j j' : Fin d) (c c' : Finset (Fin m) → ℝ) :
blockMean P eps (fun z => (∑ J, c J * columnWalsh P eps j J z) *
(∑ K, c' K * columnWalsh P eps j' K z)) =
∑ J, c J * c' J * blockMean P eps
(fun z => columnWalsh P eps j J z * columnWalsh P eps j' J z) := by
classical
letI := vectorBlockLaw_probability P eps m
simp only [Finset.sum_mul, Finset.mul_sum, blockMean]
rw [integral_finset_sum _ (fun _ _ => Integrable.of_finite)]
apply Finset.sum_congr rfl
intro J _
rw [integral_finset_sum _ (fun _ _ => Integrable.of_finite)]
have halg (K : Finset (Fin m)) (z : Fin m → Fin d → Bool) :
c K * columnWalsh P eps j K z * (c' J * columnWalsh P eps j' J z) =
(c K * c' J) * (columnWalsh P eps j K z * columnWalsh P eps j' J z) := by ring
simp_rw [halg, integral_const_mul]
change (∑ K, (c K * c' J) * blockMean P eps
(fun z => columnWalsh P eps j K z * columnWalsh P eps j' J z)) = _
rw [Finset.sum_eq_single J]
· rfl
· intro K _ hK
rw [blockMean_columnWalsh_mul_ne P hP eps heps hd j j' K J hK, mul_zero]
· simp
theorem blockVar_walsh_expansion
Assume the causal-model conditions for the data law, a positive privacy budget, dimension at least two, and the function hf. Parseval's identity expresses each centered column variance as a finite sum of squares.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
P :
hP :
eps :
ℝ
heps :
0 < eps
hd :
2 ≤ d
j :
Fin d
hf :
∀ z, f z - blockMean P eps f = ∑ J, c J * columnWalsh P eps j J z
conclusion
blockVar P eps f = ∑ J, (c J)^2
Proof (Lean source)
-- @node: blockVar_walsh_expansion
lemma blockVar_walsh_expansion (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(hP : CausalModel P) (eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d)
(j : Fin d) (f : (Fin m → Fin d → Bool) → ℝ) (c : Finset (Fin m) → ℝ)
(hf : ∀ z, f z - blockMean P eps f = ∑ J, c J * columnWalsh P eps j J z) :
blockVar P eps f = ∑ J, (c J)^2 := by
change blockMean P eps (fun z => (f z - blockMean P eps f)^2) = _
simp_rw [hf, pow_two]
rw [blockMean_walsh_sum_mul P hP eps heps hd]
simp_rw [blockMean_columnWalsh_orthonormal P hP eps heps hd]
simp
theorem blockCov_walsh_expansion
Assume the causal-model conditions for the data law, a positive privacy budget, dimension at least two, the stated hjj condition, the function hf, and the function hf'. Cross-column covariance is the diagonal coefficient sum weighted by row-correlation powers.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
P :
hP :
eps :
ℝ
heps :
0 < eps
hd :
2 ≤ d
j j' :
Fin d
hjj :
j ≠ j'
hf :
∀ z, f z - blockMean P eps f = ∑ J, c J * columnWalsh P eps j J z
hf' :
∀ z, f' z - blockMean P eps f' = ∑ J, c' J * columnWalsh P eps j' J z
conclusion
blockCov P eps f f'
= ∑ J, c J * c' J * (-(contrast P j * contrast P j') / sqrt (((noiseScale d eps)^2 - (contrast P j)^2) * ((noiseScale d eps)^2 - (contrast P j')^2)))^J.card
Proof (Lean source)
-- @node: blockCov_walsh_expansion
lemma blockCov_walsh_expansion (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(hP : CausalModel P) (eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d)
(j j' : Fin d) (hjj : j ≠ j') (f f' : (Fin m → Fin d → Bool) → ℝ)
(c c' : Finset (Fin m) → ℝ)
(hf : ∀ z, f z - blockMean P eps f = ∑ J, c J * columnWalsh P eps j J z)
(hf' : ∀ z, f' z - blockMean P eps f' = ∑ J, c' J * columnWalsh P eps j' J z) :
blockCov P eps f f' = ∑ J, c J * c' J *
(-(contrast P j * contrast P j') /
sqrt (((noiseScale d eps)^2 - (contrast P j)^2) *
((noiseScale d eps)^2 - (contrast P j')^2)))^J.card := by
change blockMean P eps (fun z => (f z - blockMean P eps f) *
(f' z - blockMean P eps f')) = _
simp_rw [hf, hf']
rw [blockMean_walsh_sum_mul P hP eps heps hd]
simp_rw [blockMean_columnWalsh_cross P hP eps heps hd j j' hjj]
Assume the stated hc condition and the stated hr condition. Cauchy–Schwarz bounds the diagonal expansion after the constant coefficient is removed.
Formal statement
Proof (Lean source)
-- @node: walsh_diagonal_sum_abs_le
lemma walsh_diagonal_sum_abs_le (c c' : Finset (Fin m) → ℝ) (hc : c ∅ = 0)
(r : ℝ) (hr : |r| ≤ 1) :
|∑ J, c J * c' J * r^J.card| ≤
|r| * sqrt ((∑ J, (c J)^2) * ∑ J, (c' J)^2) := by
classical
have hp : ∀ k : ℕ, |r|^(k+1) ≤ |r| := by
intro k
induction k with
| zero => simp
| succ k ih =>
rw [pow_succ]
calc
_ ≤ |r| * |r| := mul_le_mul_of_nonneg_right ih (abs_nonneg r)
_ ≤ |r| := by nlinarith [abs_nonneg r]
have hterm (J : Finset (Fin m)) :
|c J * c' J * r^J.card| ≤ |r| * (|c J| * |c' J|) := by
by_cases hJ : J = ∅
· subst J
simp [hc]
· have hcard : J.card ≠ 0 := by simpa using hJ
obtain ⟨k, hk⟩ := Nat.exists_eq_succ_of_ne_zero hcard
rw [abs_mul, abs_mul, abs_pow, hk]
have h := mul_le_mul_of_nonneg_left (hp k) (mul_nonneg (abs_nonneg (c J)) (abs_nonneg (c' J)))
simpa [mul_comm] using h
have hCS : (∑ J, |c J| * |c' J|) ≤
sqrt ((∑ J, (c J)^2) * ∑ J, (c' J)^2) := by
apply Real.le_sqrt_of_sq_le
simpa only [sq_abs] using Finset.sum_mul_sq_le_sq_mul_sq
(Finset.univ : Finset (Finset (Fin m))) (fun J => |c J|) (fun J => |c' J|)
calc
_ ≤ ∑ J, |c J * c' J * r^J.card| := Finset.abs_sum_le_sum_abs _ _
_ ≤ ∑ J, |r| * (|c J| * |c' J|) := Finset.sum_le_sum (fun J _ => hterm J)
_ = |r| * ∑ J, |c J| * |c' J| := (Finset.mul_sum ..).symm
_ ≤ _ := mul_le_mul_of_nonneg_left hCS (abs_nonneg _)
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.MomentDependence.WalshMoments 12 declarations Exact orthogonality and cross-column moments for the finite product basis.
Tilted Walsh moments
Exact orthogonality and cross-column moments for the finite product basis.
Fix the probability law P, the privacy budget, the coordinate index, the finite index set J, and the function z. Standardized tilted sign product basis within a column.
Definition (Lean source)
parameters
def
columnWalsh P eps j J z :
ℝ
given by
The integral block variance agrees with Mathlib's variance on this finite space.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
P :
eps :
ℝ
conclusion
Proof (Lean source)
-- @node: blockVar_eq_variance
lemma blockVar_eq_variance (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(eps : ℝ) (f : (Fin m → Fin d → Bool) → ℝ) :
blockVar P eps f = variance f (vectorBlockLaw P eps m) := by
rw [variance_eq_integral (by fun_prop)]
rfl
theorem blockCov_self
The covariance diagonal is exactly the block variance.
Formal statement
Proof (Lean source)
-- @node: blockCov_self
lemma blockCov_self (P : Measure (FullRecord d)) (eps : ℝ)
(f : (Fin m → Fin d → Bool) → ℝ) : blockCov P eps f f = blockVar P eps f := by
simp only [blockCov, blockVar, pow_two]
theorem blockVar_average_eq_covariance_sum
Finite covariance expansion of the average, with no independence between columns.
Formal statement
hypotheses
m :
ℕ
d :
ℕ
P :
eps :
ℝ
Proof (Lean source)
-- @node: blockVar_average_eq_covariance_sum
lemma blockVar_average_eq_covariance_sum (P : Measure (FullRecord d))
[IsProbabilityMeasure P] (eps : ℝ) (f : Fin d → (Fin m → Fin d → Bool) → ℝ) :
blockVar P eps (fun z => (d : ℝ)⁻¹ * ∑ j, f j z) =
((d : ℝ)⁻¹)^2 * ∑ j, ∑ j', blockCov P eps (f j) (f j') := by
letI := vectorBlockLaw_probability P eps m
rw [blockVar_eq_variance, variance_const_mul,
variance_fun_sum (fun _ => MemLp.of_discrete)]
rfl
Assume a positive privacy budget and positive dimension. The signed-vector scale exceeds the number of cells.
Formal statement
Proof (Lean source)
-- @node: noiseScale_gt_dimension
lemma noiseScale_gt_dimension (eps : ℝ) (heps : 0 < eps) (hd : 0 < d) :
(d : ℝ) < noiseScale d eps := by
have hdelta : 0 < privacyDelta eps := by
rw [privacyDelta_exp_formula]
exact div_pos (sub_pos.mpr (Real.one_lt_exp_iff.mpr heps)) (by positivity)
have hlt := (privacyDelta_bounds eps heps.le).2
have hdR : (0 : ℝ) < d := by exact_mod_cast hd
unfold noiseScale
apply (lt_div_iff₀ hdelta).mpr
nlinarith
theorem column_scale_variance_pos
Assume the causal-model conditions for the data law, a positive privacy budget, and dimension at least two. The variance of a scaled sign is strictly positive throughout the causal cube.
Formal statement
hypotheses
conclusion
0 < (noiseScale d eps)^2 - (contrast P j)^2
Proof (Lean source)
-- @node: column_scale_variance_pos
lemma column_scale_variance_pos (P : Measure (FullRecord d)) (hP : CausalModel P)
(eps : ℝ) (heps : 0 < eps) (hd : 2 ≤ d) (j : Fin d) :
0 < (noiseScale d eps)^2 - (contrast P j)^2 := by
have hb := noiseScale_gt_dimension (d := d) eps heps (by omega)
have hdR : (2 : ℝ) ≤ d := by exact_mod_cast hd
have ht := contrast_mem_parameterCube P hP j
have hs : 0 ≤ (1/2 - contrast P j) * (contrast P j + 1/2) :=
mul_nonneg (by linarith [ht.2]) (by linarith [ht.1])
nlinarith
theorem columnWalsh_eq_centeredColumnProduct
Normalized products are centered column products divided by their scale power.
Formal statement
hypotheses
conclusion
columnWalsh P eps j J z
Proof (Lean source)
-- @node: columnWalsh_eq_centeredColumnProduct
lemma columnWalsh_eq_centeredColumnProduct (P : Measure (FullRecord d)) (eps : ℝ)
(j : Fin d) (J : Finset (Fin m)) (z : Fin m → Fin d → Bool) :
columnWalsh P eps j J z = centeredColumnProduct P eps j J z /
(sqrt ((noiseScale d eps)^2 - (contrast P j)^2))^J.card := by
simp [columnWalsh, centeredColumnProduct, centeredRow, scaledMessages,
Finset.prod_div_distrib]
theorem blockMean_columnWalsh_mul_ne
Assume the causal-model conditions for the data law, a positive privacy budget, dimension at least two, and the stated jk condition. Unequal Walsh subsets have zero mixed moment in any pair of columns.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: blockMean_columnWalsh_mul_ne
lemma blockMean_columnWalsh_mul_ne (P : Measure (FullRecord d))
[IsProbabilityMeasure P] (hP : CausalModel P) (eps : ℝ) (heps : 0 < eps)
(hd : 2 ≤ d) (j j' : Fin d) (J K : Finset (Fin m)) (hJK : J ≠ K) :
blockMean P eps (fun z => columnWalsh P eps j J z * columnWalsh P eps j' K z) = 0 := by
simp_rw [columnWalsh_eq_centeredColumnProduct, div_mul_div_comm]
unfold blockMean
rw [integral_div]
change blockMean P eps (fun z => centeredColumnProduct P eps j J z *
centeredColumnProduct P eps j' K z) / _ = 0
rw [blockMean_centeredColumnProduct_mul_ne P hP eps heps hd j j' J K hJK, zero_div]
theorem blockMean_columnWalsh_sq
Assume the causal-model conditions for the data law, a positive privacy budget, and dimension at least two. Every Walsh product has unit second moment, including the empty subset.
Formal statement
hypotheses
conclusion
blockMean P eps (fun z => (columnWalsh P eps j J z)^2) = 1
Proof (Lean source)
-- @node: blockMean_columnWalsh_sq
lemma blockMean_columnWalsh_sq (P : Measure (FullRecord d))
[IsProbabilityMeasure P] (hP : CausalModel P) (eps : ℝ) (heps : 0 < eps)
(hd : 2 ≤ d) (j : Fin d) (J : Finset (Fin m)) :
blockMean P eps (fun z => (columnWalsh P eps j J z)^2) = 1 := by
simp_rw [columnWalsh_eq_centeredColumnProduct, div_pow]
unfold blockMean
rw [integral_div]
change blockMean P eps (fun z => (centeredColumnProduct P eps j J z)^2) / _ = 1
rw [blockMean_centeredColumnProduct_sq P hP eps heps hd]
have hv := column_scale_variance_pos P hP eps heps hd j
rw [← pow_mul, mul_comm J.card 2, pow_mul, Real.sq_sqrt hv.le]
exact div_self (pow_ne_zero _ hv.ne')
theorem blockMean_columnWalsh_nonempty
Assume the causal-model conditions for the data law, a positive privacy budget, dimension at least two, and the stated j condition. Nonempty Walsh products are centered.
Formal statement
hypotheses
conclusion
blockMean P eps (columnWalsh P eps j J) = 0
Proof (Lean source)
-- @node: blockMean_columnWalsh_nonempty
lemma blockMean_columnWalsh_nonempty (P : Measure (FullRecord d))
[IsProbabilityMeasure P] (hP : CausalModel P) (eps : ℝ) (heps : 0 < eps)
(hd : 2 ≤ d) (j : Fin d) (J : Finset (Fin m)) (hJ : J.Nonempty) :
blockMean P eps (columnWalsh P eps j J) = 0 := by
have h := blockMean_columnWalsh_mul_ne P hP eps heps hd j j J ∅ hJ.ne_empty
change blockMean P eps (fun z => columnWalsh P eps j J z) = 0
simpa only [columnWalsh, Finset.prod_empty, mul_one] using h
theorem blockMean_columnWalsh_orthonormal
Assume the causal-model conditions for the data law, a positive privacy budget, and dimension at least two. The finite within-column product family is orthonormal.
Formal statement
hypotheses
conclusion
= if J = K then 1 else 0
Proof (Lean source)
-- @node: blockMean_columnWalsh_orthonormal
lemma blockMean_columnWalsh_orthonormal (P : Measure (FullRecord d))
[IsProbabilityMeasure P] (hP : CausalModel P) (eps : ℝ) (heps : 0 < eps)
(hd : 2 ≤ d) (j : Fin d) (J K : Finset (Fin m)) :
blockMean P eps (fun z => columnWalsh P eps j J z * columnWalsh P eps j K z) =
if J = K then 1 else 0 := by
classical
by_cases hJK : J = K
· subst K
simpa only [if_true, ← pow_two] using blockMean_columnWalsh_sq P hP eps heps hd j J
· rw [if_neg hJK]
exact blockMean_columnWalsh_mul_ne P hP eps heps hd j j J K hJK
theorem blockMean_columnWalsh_cross
Assume the causal-model conditions for the data law, a positive privacy budget, dimension at least two, and the stated hjj condition. Equal-subset cross-column Walsh moments are powers of the exact row correlation.
Formal statement
hypotheses
conclusion
= (-(contrast P j * contrast P j') / sqrt (((noiseScale d eps)^2 - (contrast P j)^2) * ((noiseScale d eps)^2 - (contrast P j')^2)))^J.card
Proof (Lean source)
-- @node: blockMean_columnWalsh_cross
lemma blockMean_columnWalsh_cross (P : Measure (FullRecord d))
[IsProbabilityMeasure P] (hP : CausalModel P) (eps : ℝ) (heps : 0 < eps)
(hd : 2 ≤ d) (j j' : Fin d) (hjj : j ≠ j') (J : Finset (Fin m)) :
blockMean P eps (fun z => columnWalsh P eps j J z * columnWalsh P eps j' J z) =
(-(contrast P j * contrast P j') /
sqrt (((noiseScale d eps)^2 - (contrast P j)^2) *
((noiseScale d eps)^2 - (contrast P j')^2)))^J.card := by
simp_rw [columnWalsh_eq_centeredColumnProduct, div_mul_div_comm]
unfold blockMean
rw [integral_div]
change blockMean P eps (fun z => centeredColumnProduct P eps j J z *
centeredColumnProduct P eps j' J z) / _ = _
rw [blockMean_centeredColumnProduct_cross P hP eps heps hd j j' hjj,
← mul_pow, ← Real.sqrt_mul (column_scale_variance_pos P hP eps heps hd j).le,
div_pow]
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.PairedDecisionCompletion 10 declarations Finite atomic sampling weights extend the canonical experiment to all input measures.
A measurable completion of the paired decision experiment
Finite atomic sampling weights extend the canonical experiment to all input measures. On probability laws this extension is exactly the iid experiment.
def completedPairedDecisionLaw
Fix the local protocol Q and the probability law P. Atomic iid weights followed by the fixed protocol and its independent coins.
Definition (Lean source)
parameters
def
given by
Measure.sum fun o : Fin n → PairedSymbol d
=> (∏ i, P {o i}) • (((Measure.dirac o).prod (Q.seedLaw.prod uniform01)).bind (fun w => (fixedTranscriptLaw Q w.1 w.2.1).map (fun z => (z,w.2.1,w.2.2))))
theorem measurable_completedPairedDecisionLaw
For every paired protocol, the completed finite atomic decision law is measurable even off the probability model.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: measurable_completedPairedDecisionLaw
@[fun_prop] lemma measurable_completedPairedDecisionLaw (Q : LocalProtocol n (PairedSymbol d)) :
Measurable (completedPairedDecisionLaw Q) := by
apply Measure.measurable_of_measurable_coe
intro E hE
simp only [completedPairedDecisionLaw, Measure.sum_apply _ hE, Measure.smul_apply,
smul_eq_mul]
apply Measurable.tsum
intro o
apply mul _ measurable_const
apply Finset.measurable_prod
intro i hi
exact (Measure.measurable_coe (measurableSet_singleton (o i))).comp
(measurable_id)
theorem completedPairedDecisionLaw_eq_canonical
On probability inputs, atomic sampling is the canonical iid experiment.
Formal statement
Proof (Lean source)
-- @node: completedPairedDecisionLaw_eq_canonical
lemma completedPairedDecisionLaw_eq_canonical (Q : LocalProtocol n (PairedSymbol d))
(P : Measure (PairedSymbol d)) [IsProbabilityMeasure P] :
completedPairedDecisionLaw Q P = canonicalDecisionLaw Q P := by
haveI : IsProbabilityMeasure uniform01 := ⟨by
simp [uniform01, Measure.restrict_apply, Real.volume_Icc]⟩
have hAtomic : Measure.pi (fun _ : Fin n => P) =
Measure.sum (fun o : Fin n → PairedSymbol d =>
(∏ i, P {o i}) • Measure.dirac o) := by
conv_lhs => rw [← Measure.sum_smul_dirac
(Measure.pi (fun _ : Fin n => P))]
simp only [Measure.pi_singleton]
unfold canonicalDecisionLaw
rw [hAtomic, Measure.prod_sum_left,
Measure.bind_sum _ _ (measurable_protocol_decisionRows Q).aemeasurable]
simp only [Measure.prod_smul_left, Measure.bind_smul, completedPairedDecisionLaw]
theorem paired_prior_bind_map
A measurable experiment commutes with pushing its parameter prior forward.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: paired_prior_bind_map
lemma paired_prior_bind_map (nu : Measure (Fin d → ℝ))
(K : LocalProtocol n (PairedSymbol d)) :
(nu.map pairedLaw).bind (completedPairedDecisionLaw K) =
nu.bind (fun theta => completedPairedDecisionLaw K (pairedLaw theta)) := by
have hm : Measurable (fun theta : Fin d → ℝ =>
completedPairedDecisionLaw K (pairedLaw theta)) :=
(measurable_completedPairedDecisionLaw K).comp measurable_pairedLaw_parameter
ext E hE
rw [Measure.bind_apply hE (measurable_completedPairedDecisionLaw K).aemeasurable,
Measure.bind_apply hE hm.aemeasurable]
exact lintegral_map ((Measure.measurable_coe hE).comp
(measurable_completedPairedDecisionLaw K)) measurable_pairedLaw_parameter
theorem paired_prior_completed_marginal
Assume positive dimension, the stated ha condition, and the stated hnu condition. The measurable law-space completion has precisely the original product-prior seed/transcript mixture on the supported paired cube.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
K :
LocalProtocol n (PairedSymbol d)
hd :
0 < d
a :
ℝ
ha :
a ≤ (1/2 : ℝ)
nu :
Measure ℝ
hnu :
AmplitudePrior a nu
conclusion
(((productPrior d nu).map pairedLaw).bind (completedPairedDecisionLaw K)).map (fun w => (w.2.1,w.1))
Proof (Lean source)
-- @node: paired_prior_completed_marginal
lemma paired_prior_completed_marginal (K : LocalProtocol n (PairedSymbol d))
(hd : 0 < d) (a : ℝ) (ha : a ≤ (1/2 : ℝ))
(nu : Measure ℝ) (hnu : AmplitudePrior a nu) :
(((productPrior d nu).map pairedLaw).bind (completedPairedDecisionLaw K)).map
(fun w => (w.2.1,w.1)) =
(productPrior d nu).bind (fun theta => canonicalSeedTranscriptLaw K (pairedLaw theta)) := by
have hm : Measurable (fun theta : Fin d → ℝ =>
completedPairedDecisionLaw K (pairedLaw theta)) :=
(measurable_completedPairedDecisionLaw K).comp measurable_pairedLaw_parameter
rw [paired_prior_bind_map, map_bind_measurable_rows _ _ hm _ (by fun_prop)]
apply Measure.bind_congr_right
filter_upwards [amplitude_productPrior_ae_cube a ha nu hnu] with theta htheta
haveI : IsProbabilityMeasure (pairedLaw theta) :=
pairedFamily_subset_simplex hd ⟨theta, htheta, rfl⟩
rw [completedPairedDecisionLaw_eq_canonical]
rfl
theorem paired_lawspace_resource_contraction
Assume measurable Radon–Nikodym densities for dominated kernels, sequential local privacy of the protocol, an admissible sample size, dimension, and privacy budget, the stated hnu0 condition, the stated hnu1 condition, and the stated hmatch condition. The exact one-hundredth contraction bound now applies to the measurable law-space experiment required by the separated-decision reduction.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
K :
LocalProtocol n (PairedSymbol d)
eps :
ℝ
hK :
SequentialClass K eps
hAllowed :
Allowed n d eps
nu0 nu1 :
Measure ℝ
hnu0 :
AmplitudePrior (frontierResources n d eps).converseAmp nu0
hnu1 :
AmplitudePrior (frontierResources n d eps).converseAmp nu1
hmatch :
MatchingMoments (frontierResources n d eps).converseDegree nu0 nu1
Proof (Lean source)
-- @node: paired_lawspace_resource_contraction
lemma paired_lawspace_resource_contraction (hRN : MeasurableKernelRadonNikodym)
(K : LocalProtocol n (PairedSymbol d)) (eps : ℝ)
(hK : SequentialClass K eps) (hAllowed : Allowed n d eps)
(nu0 nu1 : Measure ℝ)
(hnu0 : AmplitudePrior (frontierResources n d eps).converseAmp nu0)
(hnu1 : AmplitudePrior (frontierResources n d eps).converseAmp nu1)
(hmatch : MatchingMoments (frontierResources n d eps).converseDegree nu0 nu1) :
tvDist
((((productPrior d nu0).map pairedLaw).bind (completedPairedDecisionLaw K)).map
(fun w => (w.2.1,w.1)))
((((productPrior d nu1).map pairedLaw).bind (completedPairedDecisionLaw K)).map
(fun w => (w.2.1,w.1))) ≤ (1/100 : ℝ) := by
have hd : 0 < d := by have := hAllowed.2.1; omega
have ha := (frontier_converse_amplitude_domain n d eps hAllowed).2
rw [paired_prior_completed_marginal K hd _ ha nu0 hnu0,
paired_prior_completed_marginal K hd _ ha nu1 hnu1]
exact paired_productPrior_resource_contraction hRN K eps hK hAllowed
nu0 nu1 hnu0 hnu1 hmatch
theorem completedPairedDecisionLaw_randomizer
Assume dimension at least two and the stated hp condition. Paired cube laws retain the independent analyst randomizer in the completed experiment.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
K :
LocalProtocol n (PairedSymbol d)
hd :
2 ≤ d
p :
Measure (PairedSymbol d)
hp :
p ∈ pairedFamily d
conclusion
= (((completedPairedDecisionLaw K p).map (fun w => (w.1,w.2.1))).prod uniform01).map (fun w : (ProtocolTranscript K × K.Seed) × ℝ => (w.1.1,w.1.2,w.2))
Proof (Lean source)
-- @node: completedPairedDecisionLaw_randomizer
lemma completedPairedDecisionLaw_randomizer (K : LocalProtocol n (PairedSymbol d))
(hd : 2 ≤ d) (p : Measure (PairedSymbol d)) (hp : p ∈ pairedFamily d) :
completedPairedDecisionLaw K p =
(((completedPairedDecisionLaw K p).map (fun w => (w.1,w.2.1))).prod uniform01).map
(fun w : (ProtocolTranscript K × K.Seed) × ℝ => (w.1.1,w.1.2,w.2)) := by
rcases hp with ⟨theta, htheta, rfl⟩
haveI : IsProbabilityMeasure (pairedLaw theta) :=
pairedFamily_subset_simplex (by omega) ⟨theta, htheta, rfl⟩
rw [completedPairedDecisionLaw_eq_canonical]
have hEq := pulledProtocol_decisionLaw (canonicalScheme n d) canonicalScheme_iidPeople
canonicalScheme_independentRandomness hd K theta htheta
haveI := symmetricLaw_probability theta htheta (by omega)
have h := sampling_decisionLaw_randomizer (canonicalScheme n d) canonicalScheme_iidPeople
canonicalScheme_independentRandomness (pulledProtocol K) (symmetricLaw theta)
(symmetricLaw_causalModel theta htheta (by omega))
rw [hEq] at h
exact h
theorem measurableSet_pairedFamily
Assume positive dimension. The paired family is Borel, as can be checked through its finite atomic masses.
Formal statement
Proof (Lean source)
-- @node: measurableSet_pairedFamily
lemma measurableSet_pairedFamily (hd : 0 < d) : MeasurableSet (pairedFamily d) := by
let weights : Measure (PairedSymbol d) → PairedSymbol d → ℝ≥0∞ := fun p v => p {v}
have hw : Measurable weights := by
apply measurable_pi_lambda
intro v
exact Measure.measurable_coe (measurableSet_singleton v)
have hc : MeasurableSet (parameterCube d) := by
unfold parameterCube
simp only [Set.setOf_forall]
exact MeasurableSet.iInter fun j =>
isClosed_Icc.measurableSet.preimage (measurable_pi_apply j)
have hinj : InjOn (fun theta : Fin d → ℝ => weights (pairedLaw theta))
(parameterCube d) := by
intro theta ht phi hp heq
have hmass (t : Fin d → ℝ) (ht : t ∈ parameterCube d) (v : PairedSymbol d) :
0 ≤ (1 + signVal v.2 * t v.1) / (2*d) := by
apply div_nonneg _ (by positivity)
have h := ht v.1
cases v.2 <;> simp only [signVal, Bool.false_eq_true, ↓reduceIte] <;>
linarith [h.1, h.2]
funext j
have h := congrArg (fun w : PairedSymbol d → ℝ≥0∞ => (w (j,true)).toReal) heq
change (pairedLaw theta).real {(j,true)} = (pairedLaw phi).real {(j,true)} at h
unfold pairedLaw at h
rw [atomLaw_real_singleton _ (hmass theta ht),
atomLaw_real_singleton _ (hmass phi hp)] at h
simp only [signVal, ↓reduceIte, one_mul] at h
have hdR : (0 : ℝ) < d := by exact_mod_cast hd
have h' := (div_left_inj' (by positivity : (2*(d : ℝ)) ≠ 0)).mp h
linarith
have himage := hc.image_of_measurable_injOn
(hw.comp measurable_pairedLaw_parameter) hinj
have heq : pairedFamily d = weights ⁻¹'
((fun theta : Fin d → ℝ => weights (pairedLaw theta)) '' parameterCube d) := by
ext p
constructor
· rintro ⟨theta, ht, rfl⟩
exact ⟨theta, ht, rfl⟩
· rintro ⟨theta, ht, heq⟩
refine ⟨theta, ht, ?_⟩
apply Measure.ext_of_singleton
intro v
exact congrFun heq v
rw [heq]
exact himage.preimage hw
theorem pairedLaw_productPrior_support
Assume positive dimension, the stated ha condition, and the stated hnu condition. Supported coordinate priors push forward to probability laws in the paired model.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: pairedLaw_productPrior_support
lemma pairedLaw_productPrior_support (hd : 0 < d) (a : ℝ) (ha : a ≤ (1/2 : ℝ))
(nu : Measure ℝ) (hnu : AmplitudePrior a nu) :
((productPrior d nu).map pairedLaw) (pairedFamily d)ᶜ = 0 := by
rw [Measure.map_apply measurable_pairedLaw_parameter (measurableSet_pairedFamily hd).compl]
apply measure_mono_null _
(show (productPrior d nu) (parameterCube d)ᶜ = 0 from
ae_iff.mp (amplitude_productPrior_ae_cube a ha nu hnu))
intro theta ht hcube
exact ht ⟨theta, hcube, rfl⟩
theorem paired_separated_lawspace_decisions
Assume dimension at least two, the stated support condition, the stated support condition, strict separation of the two target values, the stated concentration near the target value, the stated concentration near the target value, and the stated total-variation bound. The generic testing and connectedness reductions apply to completed paired experiments and yield bounds on the canonical paired decision risks.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
K :
LocalProtocol n (PairedSymbol d)
hd :
2 ≤ d
pi0 pi1 :
hSupport0 :
pi0 (pairedFamily d)ᶜ = 0
hSupport1 :
pi1 (pairedFamily d)ᶜ = 0
v0 v1 eta omega :
ℝ
hv :
v0 < v1
hEscape0 :
pi0.real {p | (v1-v0)/8 < |tvFromUniform p-v0|} ≤ eta
hEscape1 :
pi1.real {p | (v1-v0)/8 < |tvFromUniform p-v1|} ≤ eta
hTV :
tvDist ((pi0.bind (completedPairedDecisionLaw K)).map (fun w => (w.2.1,w.1))) ((pi1.bind (completedPairedDecisionLaw K)).map (fun w => (w.2.1,w.1)))
≤ omega
conclusion
conclusion 1
T :
≤ ⨆ p : {p : Measure (PairedSymbol d) // p ∈ pairedFamily d}, squaredRisk (canonicalDecisionLaw K p.1) T (tvFromUniform p.1)
conclusion 2
J :
IntervalDecision K 0 1
≤ ⨆ p : {p : Measure (PairedSymbol d) // p ∈ pairedFamily d}, expectedLength (canonicalDecisionLaw K p.1) J
Proof (Lean source)
-- @node: paired_separated_lawspace_decisions
lemma paired_separated_lawspace_decisions
(K : LocalProtocol n (PairedSymbol d)) (hd : 2 ≤ d)
(pi0 pi1 : Measure (Measure (PairedSymbol d)))
[IsProbabilityMeasure pi0] [IsProbabilityMeasure pi1]
(hSupport0 : pi0 (pairedFamily d)ᶜ = 0)
(hSupport1 : pi1 (pairedFamily d)ᶜ = 0)
(v0 v1 eta omega : ℝ) (hv : v0 < v1)
(hEscape0 : pi0.real {p | (v1-v0)/8 < |tvFromUniform p-v0|} ≤ eta)
(hEscape1 : pi1.real {p | (v1-v0)/8 < |tvFromUniform p-v1|} ≤ eta)
(hTV : tvDist
((pi0.bind (completedPairedDecisionLaw K)).map (fun w => (w.2.1,w.1)))
((pi1.bind (completedPairedDecisionLaw K)).map (fun w => (w.2.1,w.1))) ≤ omega) :
(∀ T : Estimator K,
ofReal (9*(v1-v0)^2/128 * max 0 (1-omega-2*eta)) ≤
⨆ p : {p : Measure (PairedSymbol d) // p ∈ pairedFamily d},
squaredRisk (canonicalDecisionLaw K p.1) T (tvFromUniform p.1)) ∧
(∀ J : IntervalDecision K 0 1,
(∀ p ∈ pairedFamily d, (0.90 : ℝ) ≤ coverage (canonicalDecisionLaw K p) J
(tvFromUniform p)) →
ofReal (3*(v1-v0)/4 * max 0 ((0.80 : ℝ)-2*eta-omega)) ≤
⨆ p : {p : Measure (PairedSymbol d) // p ∈ pairedFamily d},
expectedLength (canonicalDecisionLaw K p.1) J) := by
have hEq (p : Measure (PairedSymbol d)) (hp : p ∈ pairedFamily d) :
completedPairedDecisionLaw K p = canonicalDecisionLaw K p := by
haveI : IsProbabilityMeasure p := pairedFamily_subset_simplex (by omega) hp
exact completedPairedDecisionLaw_eq_canonical K p
have hProb (p : Measure (PairedSymbol d)) (hp : p ∈ pairedFamily d) :
IsProbabilityMeasure (completedPairedDecisionLaw K p) := by
haveI : IsProbabilityMeasure p := pairedFamily_subset_simplex (by omega) hp
rw [hEq p hp]
exact canonicalDecisionLaw_probability K p
have hsep := separated_value_mixtures_generic K (pairedFamily d) tvFromUniform
(completedPairedDecisionLaw K) (completedPairedDecisionLaw_randomizer K hd)
hProb pi0 pi1 hSupport0 hSupport1 measurable_tvFromUniform
(measurable_completedPairedDecisionLaw K) v0 v1 eta omega hv hEscape0 hEscape1 hTV 0 1
constructor
· intro T
convert hsep.1 T using 1
congr 1
funext p
rw [hEq p.1 p.2]
· intro J hCov
have hCov' : ∀ p ∈ pairedFamily d, (0.90 : ℝ) ≤
coverage (completedPairedDecisionLaw K p) J (tvFromUniform p) := by
intro p hp
rw [hEq p hp]
exact hCov p hp
convert hsep.2 J hCov' using 1
congr 1
funext p
rw [hEq p.1 p.2]
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.PairedProductPrior 13 declarations Signed preprocessing identifies the paired product-prior transcript experiment with the causal symmetric experiment.
Paired product-prior experiments
Signed preprocessing identifies the paired product-prior transcript experiment with the causal symmetric experiment. Moment duality, target concentration and adaptive contraction then supply the three ingredients for the paired converse.
theorem measurable_pairedLaw_parameter
The paired finite law depends measurably on its contrast coordinates.
Formal statement
Proof (Lean source)
-- @node: measurable_pairedLaw_parameter
@[fun_prop] lemma measurable_pairedLaw_parameter :
Measurable (pairedLaw : (Fin d → ℝ) → Measure (PairedSymbol d)) := by
unfold pairedLaw
first
| fun_prop
| apply measurable_atomLaw_weights
intro v
fun_prop
theorem measurable_tvFromUniform
The finite total-variation target is measurable on the space of input laws.
Formal statement
Proof (Lean source)
-- @node: measurable_tvFromUniform
@[fun_prop] lemma measurable_tvFromUniform :
Measurable (tvFromUniform : Measure (PairedSymbol d) → ℝ) := by
unfold tvFromUniform
first
| fun_prop
| apply Measurable.const_mul
apply Finset.measurable_sum
intro v _
exact continuous_abs.measurable.comp
((Measure.measurable_coe (measurableSet_singleton v)).ennreal_toReal.sub measurable_const)
theorem pairedLaw_prior_target_mean
Assume positive dimension, the stated ha condition, and the stated hnu condition. Pushing the product prior to paired laws preserves its scalar TV center.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: pairedLaw_prior_target_mean
lemma pairedLaw_prior_target_mean (hd : 0 < d) (a : ℝ) (ha : a ≤ (1/2 : ℝ))
(nu : Measure ℝ) (hnu : AmplitudePrior a nu) :
(∫ p, tvFromUniform p ∂(productPrior d nu).map pairedLaw) =
(∫ u, |u| ∂nu)/2 := by
rw [integral_map measurable_pairedLaw_parameter.aemeasurable
measurable_tvFromUniform.aestronglyMeasurable]
calc
_ = ∫ theta, signedNorm theta/2 ∂productPrior d nu := by
apply integral_congr_ae
filter_upwards [amplitude_productPrior_ae_cube a ha nu hnu] with theta htheta
exact tvFromUniform_pairedLaw theta htheta hd
_ = _ := productPrior_halfNorm_mean d hd a nu hnu
theorem pairedLaw_prior_target_escape
Escape probabilities transfer to law-space priors with the same radius and center.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: pairedLaw_prior_target_escape
lemma pairedLaw_prior_target_escape (nu : Measure ℝ) (r v : ℝ) :
((productPrior d nu).map pairedLaw) {p | r < |tvFromUniform p-v|} =
(productPrior d nu) {theta | r < |tvFromUniform (pairedLaw theta)-v|} := by
apply Measure.map_apply measurable_pairedLaw_parameter
exact measurableSet_lt measurable_const
(continuous_abs.measurable.comp (measurable_tvFromUniform.sub measurable_const))
theorem paired_productPrior_transcript_eq
Assume dimension at least two, the stated ha condition, and the stated hnu condition. Averaging signed preprocessing over a supported product prior preserves the joint public-seed and transcript law, including sequential histories.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
K :
LocalProtocol n (PairedSymbol d)
hd :
2 ≤ d
a :
ℝ
ha :
a ≤ (1 / 2 : ℝ)
nu :
Measure ℝ
hnu :
AmplitudePrior a nu
conclusion
Proof (Lean source)
-- @node: paired_productPrior_transcript_eq
lemma paired_productPrior_transcript_eq
(K : LocalProtocol n (PairedSymbol d)) (hd : 2 ≤ d)
(a : ℝ) (ha : a ≤ (1 / 2 : ℝ)) (nu : Measure ℝ) (hnu : AmplitudePrior a nu) :
(productPrior d nu).bind (fun theta =>
canonicalSeedTranscriptLaw K (pairedLaw theta)) =
mixtureLaw (canonicalScheme n d) (pulledProtocol K) nu := by
unfold mixtureLaw
apply Measure.bind_congr_right
filter_upwards [amplitude_productPrior_ae_cube a ha nu hnu] with theta htheta
have h := pulledProtocol_decisionLaw (canonicalScheme n d) canonicalScheme_iidPeople
canonicalScheme_independentRandomness hd K theta htheta
simp only [canonicalSeedTranscriptLaw, seedTranscriptLaw, h]
rfl
theorem paired_productPrior_contraction
Assume measurable Radon–Nikodym densities for dominated kernels, sequential local privacy of the protocol, an admissible sample size, dimension, and privacy budget, amplitude between zero and one half, the stated hnu0 condition, the stated hnu1 condition, the stated hk condition, and the stated hmatch condition. Arbitrary paired sequential protocols obey the same higher-order product-prior contraction and exact above-sample moment cancellation as the causal experiment.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
K :
LocalProtocol n (PairedSymbol d)
eps :
ℝ
hK :
SequentialClass K eps
hAllowed :
Allowed n d eps
a :
ℝ
ha :
a ∈ Ioc 0 (1 / 2 : ℝ)
nu0 nu1 :
Measure ℝ
hnu0 :
AmplitudePrior a nu0
hnu1 :
AmplitudePrior a nu1
k :
ℕ
hk :
1 ≤ k
hmatch :
MatchingMoments k nu0 nu1
Proof (Lean source)
-- @node: paired_productPrior_contraction
lemma paired_productPrior_contraction (hRN : MeasurableKernelRadonNikodym)
(K : LocalProtocol n (PairedSymbol d)) (eps : ℝ)
(hK : SequentialClass K eps) (hAllowed : Allowed n d eps)
(a : ℝ) (ha : a ∈ Ioc 0 (1 / 2 : ℝ))
(nu0 nu1 : Measure ℝ) (hnu0 : AmplitudePrior a nu0) (hnu1 : AmplitudePrior a nu1)
(k : ℕ) (hk : 1 ≤ k) (hmatch : MatchingMoments k nu0 nu1) :
(k ≤ n → tvDist
((productPrior d nu0).bind (fun theta => canonicalSeedTranscriptLaw K (pairedLaw theta)))
((productPrior d nu1).bind (fun theta => canonicalSeedTranscriptLaw K (pairedLaw theta))) ≤
min 1 (d * a^k * sqrt (choose n k) * (derivativeScale d eps)^k)) ∧
(n < k →
(productPrior d nu0).bind (fun theta => canonicalSeedTranscriptLaw K (pairedLaw theta)) =
(productPrior d nu1).bind (fun theta => canonicalSeedTranscriptLaw K (pairedLaw theta))) := by
rw [paired_productPrior_transcript_eq K hAllowed.2.1 a ha.2 nu0 hnu0,
paired_productPrior_transcript_eq K hAllowed.2.1 a ha.2 nu1 hnu1]
have h := (adaptive_moment_contraction hRN (canonicalScheme n d) canonicalScheme_iidPeople
canonicalScheme_independentRandomness (pulledProtocol K) eps
((signed_protocol_classes eps).2 K |>.1 hK) hAllowed).2
a ha nu0 nu1 hnu0 hnu1 k hk hmatch
exact ⟨h.1, h.2.1⟩
theorem paired_productPrior_geometric_contraction
Assume measurable Radon–Nikodym densities for dominated kernels, sequential local privacy of the protocol, an admissible sample size, dimension, and privacy budget, amplitude between zero and one half, the stated hnu0 condition, the stated hnu1 condition, the stated hk condition, and the stated hmatch condition. The paired adaptive contraction has the geometric resource form of equation (15), for every matching order. Orders beyond the sample size use exact mixture cancellation rather than an artificial binomial estimate.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
K :
LocalProtocol n (PairedSymbol d)
eps :
ℝ
hK :
SequentialClass K eps
hAllowed :
Allowed n d eps
a :
ℝ
ha :
a ∈ Ioc 0 (1/2 : ℝ)
nu0 nu1 :
Measure ℝ
hnu0 :
AmplitudePrior a nu0
hnu1 :
AmplitudePrior a nu1
k :
ℕ
hk :
1 ≤ k
hmatch :
MatchingMoments k nu0 nu1
Proof (Lean source)
-- @node: paired_productPrior_geometric_contraction
lemma paired_productPrior_geometric_contraction (hRN : MeasurableKernelRadonNikodym)
(K : LocalProtocol n (PairedSymbol d)) (eps : ℝ)
(hK : SequentialClass K eps) (hAllowed : Allowed n d eps)
(a : ℝ) (ha : a ∈ Ioc 0 (1/2 : ℝ))
(nu0 nu1 : Measure ℝ) (hnu0 : AmplitudePrior a nu0) (hnu1 : AmplitudePrior a nu1)
(k : ℕ) (hk : 1 ≤ k) (hmatch : MatchingMoments k nu0 nu1) :
tvDist
((productPrior d nu0).bind (fun theta => canonicalSeedTranscriptLaw K (pairedLaw theta)))
((productPrior d nu1).bind (fun theta => canonicalSeedTranscriptLaw K (pairedLaw theta))) ≤
min 1 ((d : ℝ)*(a*sqrt (exp 1*n/k)*(eps/d))^k) := by
have hcontract := paired_productPrior_contraction hRN K eps hK hAllowed
a ha nu0 nu1 hnu0 hnu1 k hk hmatch
by_cases hkn : k ≤ n
· exact (hcontract.1 hkn).trans (min_le_min_left 1
(contraction_coefficient_geometric_le n d k
(by have := hAllowed.2.1; omega) (by omega) eps a hAllowed.2.2 ha.1.le))
· rw [hcontract.2 (by omega)]
have hzero : tvDist
((productPrior d nu1).bind (fun theta => canonicalSeedTranscriptLaw K (pairedLaw theta)))
((productPrior d nu1).bind (fun theta => canonicalSeedTranscriptLaw K (pairedLaw theta))) = 0 := by
simp [tvDist]
rw [hzero]
apply le_min (by norm_num)
exact mul_nonneg (Nat.cast_nonneg d) (pow_nonneg
(mul_nonneg (mul_nonneg ha.1.le (Real.sqrt_nonneg _))
(div_nonneg hAllowed.2.2.1.le (Nat.cast_nonneg d))) k)
theorem paired_productPrior_resource_contraction
Assume measurable Radon–Nikodym densities for dominated kernels, sequential local privacy of the protocol, an admissible sample size, dimension, and privacy budget, the stated hnu0 condition, the stated hnu1 condition, and the stated hmatch condition. At the prescribed frontier amplitude and matching degree, every paired sequential protocol has product-prior transcript TV at most one hundredth. Matching beyond the sample horizon uses exact cancellation.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
K :
LocalProtocol n (PairedSymbol d)
eps :
ℝ
hK :
SequentialClass K eps
hAllowed :
Allowed n d eps
nu0 nu1 :
Measure ℝ
hnu0 :
AmplitudePrior (frontierResources n d eps).converseAmp nu0
hnu1 :
AmplitudePrior (frontierResources n d eps).converseAmp nu1
hmatch :
MatchingMoments (frontierResources n d eps).converseDegree nu0 nu1
Proof (Lean source)
-- @node: paired_productPrior_resource_contraction
lemma paired_productPrior_resource_contraction (hRN : MeasurableKernelRadonNikodym)
(K : LocalProtocol n (PairedSymbol d)) (eps : ℝ)
(hK : SequentialClass K eps) (hAllowed : Allowed n d eps)
(nu0 nu1 : Measure ℝ)
(hnu0 : AmplitudePrior (frontierResources n d eps).converseAmp nu0)
(hnu1 : AmplitudePrior (frontierResources n d eps).converseAmp nu1)
(hmatch : MatchingMoments (frontierResources n d eps).converseDegree nu0 nu1) :
tvDist
((productPrior d nu0).bind (fun theta => canonicalSeedTranscriptLaw K (pairedLaw theta)))
((productPrior d nu1).bind (fun theta => canonicalSeedTranscriptLaw K (pairedLaw theta))) ≤
(1/100 : ℝ) := by
have hk : 1 ≤ (frontierResources n d eps).converseDegree := by
have h := (frontier_converse_degree_domain n d eps hAllowed).1
omega
have hgeo := paired_productPrior_geometric_contraction hRN K eps hK hAllowed
_ (frontier_converse_amplitude_domain n d eps hAllowed) nu0 nu1 hnu0 hnu1
_ hk hmatch
exact hgeo.trans ((min_le_right _ _).trans
(frontier_converse_geometric_small n d eps hAllowed))
theorem productPrior_paired_tv_mean
Assume positive dimension, the stated ha condition, and the stated hnu condition. The paired TV prior center is half the scalar absolute moment.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: productPrior_paired_tv_mean
lemma productPrior_paired_tv_mean (hd : 0 < d) (a : ℝ) (ha : a ≤ (1 / 2 : ℝ))
(nu : Measure ℝ) (hnu : AmplitudePrior a nu) :
(∫ theta, tvFromUniform (pairedLaw theta) ∂productPrior d nu) =
(∫ u, |u| ∂nu) / 2 := by
calc
_ = ∫ theta, signedNorm theta / 2 ∂productPrior d nu := by
apply integral_congr_ae
filter_upwards [amplitude_productPrior_ae_cube a ha nu hnu] with theta htheta
exact tvFromUniform_pairedLaw theta htheta hd
_ = _ := productPrior_halfNorm_mean d hd a nu hnu
theorem paired_dual_product_priors_of_gate
Assume measurable Radon–Nikodym densities for dominated kernels, the Cai–Low moment-duality theorem, and the Bernstein absolute-approximation limit. The dual product priors simultaneously separate and concentrate the paired TV target and contract its private transcript experiment. This leaves the public amplitude, degree and dimension-cutoff calculations to the frontier assembly.
Formal statement
hypotheses
hDual :
hBernstein :
conclusion
∃ b : ℝ,
0 < b
conclusion 1
n d Kdeg :
ℕ
eps :
ℝ
Allowed n d eps
K :
LocalProtocol n (PairedSymbol d)
SequentialClass K eps
0 < Kdeg
Even Kdeg
a :
ℝ
a ∈ Ioc 0 (1 / 2 : ℝ)
∃ nu0 nu1 : Measure ℝ,
AmplitudePrior a nu0
AmplitudePrior a nu1
MatchingMoments (Kdeg+1) nu0 nu1
∃ gap : ℝ,
0 < gap
b*a/Kdeg ≤ gap
= gap
nu ∈ ({nu0, nu1} : Set (Measure ℝ)) :
≤ ofReal (16*(Kdeg : ℝ)^2/(b^2*d))
Kdeg+1 ≤ n
n < Kdeg+1
Proof (Lean source)
-- @node: paired_dual_product_priors_of_gate
lemma paired_dual_product_priors_of_gate
(hRN : MeasurableKernelRadonNikodym) (hDual : CaiLowMomentDuality)
(hBernstein : BernsteinAbsoluteApproximationLimit) :
∃ b : ℝ, 0 < b ∧ ∀ (n d Kdeg : ℕ) (eps : ℝ), Allowed n d eps →
∀ K : LocalProtocol n (PairedSymbol d), SequentialClass K eps →
0 < Kdeg → Even Kdeg → ∀ a : ℝ, a ∈ Ioc 0 (1 / 2 : ℝ) →
∃ nu0 nu1 : Measure ℝ, AmplitudePrior a nu0 ∧ AmplitudePrior a nu1 ∧
MatchingMoments (Kdeg+1) nu0 nu1 ∧
∃ gap : ℝ, 0 < gap ∧ b*a/Kdeg ≤ gap ∧
(∫ theta, tvFromUniform (pairedLaw theta) ∂productPrior d nu1) -
(∫ theta, tvFromUniform (pairedLaw theta) ∂productPrior d nu0) = gap ∧
(∀ nu ∈ ({nu0, nu1} : Set (Measure ℝ)),
(productPrior d nu) {theta | gap/8 ≤
|tvFromUniform (pairedLaw theta) - (∫ u, |u| ∂nu)/2|} ≤
ofReal (16*(Kdeg : ℝ)^2/(b^2*d))) ∧
(Kdeg+1 ≤ n → tvDist
((productPrior d nu0).bind
(fun theta => canonicalSeedTranscriptLaw K (pairedLaw theta)))
((productPrior d nu1).bind
(fun theta => canonicalSeedTranscriptLaw K (pairedLaw theta))) ≤
min 1 (d * a^(Kdeg+1) * sqrt (choose n (Kdeg+1)) *
(derivativeScale d eps)^(Kdeg+1))) ∧
(n < Kdeg+1 →
(productPrior d nu0).bind
(fun theta => canonicalSeedTranscriptLaw K (pairedLaw theta)) =
(productPrior d nu1).bind
(fun theta => canonicalSeedTranscriptLaw K (pairedLaw theta))) := by
obtain ⟨b, hb, hpriors⟩ := dual_product_priors_target_concentration_of_gate hDual hBernstein
refine ⟨b, hb, ?_⟩
intro n d Kdeg eps hAllowed K hK hdegree heven a ha
have hd : 0 < d := by have := hAllowed.2.1; omega
obtain ⟨nu0, nu1, hnu0, hnu1, hmatch, gap, hgap, hlower, hmean, hescape⟩ :=
hpriors d Kdeg hd hdegree heven a ha.1
have hmeanTV :
(∫ theta, tvFromUniform (pairedLaw theta) ∂productPrior d nu1) -
(∫ theta, tvFromUniform (pairedLaw theta) ∂productPrior d nu0) = gap := by
rw [productPrior_halfNorm_mean d hd a nu1 hnu1,
productPrior_halfNorm_mean d hd a nu0 hnu0] at hmean
rw [productPrior_paired_tv_mean hd a ha.2 nu1 hnu1,
productPrior_paired_tv_mean hd a ha.2 nu0 hnu0]
exact hmean
have hcontract := paired_productPrior_contraction hRN K eps hK hAllowed
a ha nu0 nu1 hnu0 hnu1 (Kdeg+1) (by omega) hmatch
refine ⟨nu0, nu1, hnu0, hnu1, hmatch, gap, hgap, hlower, hmeanTV, ?_,
hcontract.1, hcontract.2⟩
intro nu hnu
have hamp : AmplitudePrior a nu := by
rcases hnu with rfl | hnu
· exact hnu0
· have heq : nu = nu1 := Set.mem_singleton_iff.mp hnu
simpa [heq] using hnu1
have heq : (productPrior d nu) {theta | gap/8 ≤
|tvFromUniform (pairedLaw theta) - (∫ u, |u| ∂nu)/2|} =
(productPrior d nu) {theta | gap/8 ≤
|signedNorm theta/2 - (∫ u, |u| ∂nu)/2|} := by
apply measure_congr
filter_upwards [amplitude_productPrior_ae_cube a ha.2 nu hamp] with theta htheta
change (gap/8 ≤ |tvFromUniform (pairedLaw theta) - (∫ u, |u| ∂nu)/2|) =
(gap/8 ≤ |signedNorm theta/2 - (∫ u, |u| ∂nu)/2|)
rw [tvFromUniform_pairedLaw theta htheta hd]
rw [heq]
exact hescape nu hnu
theorem paired_resource_product_priors_of_gate
Assume measurable Radon–Nikodym densities for dominated kernels, the Cai–Low moment-duality theorem, and the Bernstein absolute-approximation limit. At the exact public resource choices, dual priors have a positive paired TV center gap at least a universal multiple of the square-root rate. Their concentration and transcript-contraction bounds retain the explicit degree, so subsequent dimension-cutoff calculations use the same priors.
Formal statement
hypotheses
hDual :
hBernstein :
conclusion
∃ b : ℝ,
0 < b
conclusion 1
n d :
ℕ
eps :
ℝ
Allowed n d eps
K :
LocalProtocol n (PairedSymbol d)
SequentialClass K eps
a :
(frontierResources n d eps).converseAmp
q :
(frontierResources n d eps).converseDegree - 1
∃ nu0 nu1 : Measure ℝ,
AmplitudePrior a nu0
AmplitudePrior a nu1
MatchingMoments (q+1) nu0 nu1
∃ gap : ℝ,
0 < gap
(b/3400)*rateH .SI n d eps ≤ gap
= gap
nu ∈ ({nu0, nu1} : Set (Measure ℝ)) :
≤ ofReal (16*(q : ℝ)^2/(b^2*d))
q+1 ≤ n
n < q+1
Proof (Lean source)
-- @node: paired_resource_product_priors_of_gate
lemma paired_resource_product_priors_of_gate
(hRN : MeasurableKernelRadonNikodym) (hDual : CaiLowMomentDuality)
(hBernstein : BernsteinAbsoluteApproximationLimit) :
∃ b : ℝ, 0 < b ∧ ∀ (n d : ℕ) (eps : ℝ), Allowed n d eps →
∀ K : LocalProtocol n (PairedSymbol d), SequentialClass K eps →
let a := (frontierResources n d eps).converseAmp
let q := (frontierResources n d eps).converseDegree - 1
∃ nu0 nu1 : Measure ℝ, AmplitudePrior a nu0 ∧ AmplitudePrior a nu1 ∧
MatchingMoments (q+1) nu0 nu1 ∧
∃ gap : ℝ, 0 < gap ∧ (b/3400)*rateH .SI n d eps ≤ gap ∧
(∫ theta, tvFromUniform (pairedLaw theta) ∂productPrior d nu1) -
(∫ theta, tvFromUniform (pairedLaw theta) ∂productPrior d nu0) = gap ∧
(∀ nu ∈ ({nu0, nu1} : Set (Measure ℝ)),
(productPrior d nu) {theta | gap/8 ≤
|tvFromUniform (pairedLaw theta) - (∫ u, |u| ∂nu)/2|} ≤
ofReal (16*(q : ℝ)^2/(b^2*d))) ∧
(q+1 ≤ n → tvDist
((productPrior d nu0).bind
(fun theta => canonicalSeedTranscriptLaw K (pairedLaw theta)))
((productPrior d nu1).bind
(fun theta => canonicalSeedTranscriptLaw K (pairedLaw theta))) ≤
min 1 (d * a^(q+1) * sqrt (choose n (q+1)) *
(derivativeScale d eps)^(q+1))) ∧
(n < q+1 →
(productPrior d nu0).bind
(fun theta => canonicalSeedTranscriptLaw K (pairedLaw theta)) =
(productPrior d nu1).bind
(fun theta => canonicalSeedTranscriptLaw K (pairedLaw theta))) := by
obtain ⟨b, hb, hpriors⟩ := paired_dual_product_priors_of_gate hRN hDual hBernstein
refine ⟨b, hb, ?_⟩
intro n d eps hAllowed K hK
obtain ⟨hq, heven⟩ := frontier_converse_degree_domain n d eps hAllowed
obtain ⟨nu0, nu1, hnu0, hnu1, hmatch, gap, hgap, hgaplower, hmean,
hescape, hcontract, hcancel⟩ :=
hpriors n d _ eps hAllowed K hK hq heven _
(frontier_converse_amplitude_domain n d eps hAllowed)
refine ⟨nu0, nu1, hnu0, hnu1, hmatch, gap, hgap, ?_, hmean,
hescape, hcontract, hcancel⟩
calc
(b/3400)*rateH .SI n d eps = b*((1/3400)*rateH .SI n d eps) := by ring
_ ≤ b*((frontierResources n d eps).converseAmp /
(((frontierResources n d eps).converseDegree - 1 : ℕ) : ℝ)) :=
mul_le_mul_of_nonneg_left (frontier_converse_gap_rate n d eps hAllowed) hb.le
_ = b*(frontierResources n d eps).converseAmp /
(((frontierResources n d eps).converseDegree - 1 : ℕ) : ℝ) := by ring
_ ≤ gap := hgaplower
theorem paired_concentrated_resource_priors_of_gate
Assume measurable Radon–Nikodym densities for dominated kernels, the Cai–Low moment-duality theorem, and the Bernstein absolute-approximation limit. The prescribed paired priors simultaneously achieve the frontier gap, matching moments, adaptive transcript contraction and escape probability at most one hundredth above one universal dimension cutoff.
Formal statement
hypotheses
hDual :
hBernstein :
conclusion
∃ b : ℝ,
0 < b
conclusion 1
∃ D : ℕ,
2 ≤ D
n d :
ℕ
eps :
ℝ
Allowed n d eps
D < d
K :
LocalProtocol n (PairedSymbol d)
SequentialClass K eps
a :
(frontierResources n d eps).converseAmp
q :
(frontierResources n d eps).converseDegree - 1
∃ nu0 nu1 : Measure ℝ,
AmplitudePrior a nu0
AmplitudePrior a nu1
MatchingMoments (q+1) nu0 nu1
∃ gap : ℝ,
0 < gap
(b/3400)*rateH .SI n d eps ≤ gap
= gap
nu ∈ ({nu0, nu1} : Set (Measure ℝ)) :
≤ ofReal (1/100 : ℝ)
q+1 ≤ n
n < q+1
Proof (Lean source)
-- @node: paired_concentrated_resource_priors_of_gate
lemma paired_concentrated_resource_priors_of_gate
(hRN : MeasurableKernelRadonNikodym) (hDual : CaiLowMomentDuality)
(hBernstein : BernsteinAbsoluteApproximationLimit) :
∃ b : ℝ, 0 < b ∧ ∃ D : ℕ, 2 ≤ D ∧ ∀ (n d : ℕ) (eps : ℝ), Allowed n d eps → D < d →
∀ K : LocalProtocol n (PairedSymbol d), SequentialClass K eps →
let a := (frontierResources n d eps).converseAmp
let q := (frontierResources n d eps).converseDegree - 1
∃ nu0 nu1 : Measure ℝ, AmplitudePrior a nu0 ∧ AmplitudePrior a nu1 ∧
MatchingMoments (q+1) nu0 nu1 ∧
∃ gap : ℝ, 0 < gap ∧ (b/3400)*rateH .SI n d eps ≤ gap ∧
(∫ theta, tvFromUniform (pairedLaw theta) ∂productPrior d nu1) -
(∫ theta, tvFromUniform (pairedLaw theta) ∂productPrior d nu0) = gap ∧
(∀ nu ∈ ({nu0, nu1} : Set (Measure ℝ)),
(productPrior d nu) {theta | gap/8 ≤
|tvFromUniform (pairedLaw theta) - (∫ u, |u| ∂nu)/2|} ≤
ofReal (1/100 : ℝ)) ∧
(q+1 ≤ n → tvDist
((productPrior d nu0).bind
(fun theta => canonicalSeedTranscriptLaw K (pairedLaw theta)))
((productPrior d nu1).bind
(fun theta => canonicalSeedTranscriptLaw K (pairedLaw theta))) ≤
min 1 (d * a^(q+1) * sqrt (choose n (q+1)) *
(derivativeScale d eps)^(q+1))) ∧
(n < q+1 →
(productPrior d nu0).bind
(fun theta => canonicalSeedTranscriptLaw K (pairedLaw theta)) =
(productPrior d nu1).bind
(fun theta => canonicalSeedTranscriptLaw K (pairedLaw theta))) := by
obtain ⟨b, hb, hpriors⟩ := paired_resource_product_priors_of_gate hRN hDual hBernstein
obtain ⟨D, hD, hcutoff⟩ := frontier_converse_concentration_cutoff b hb
refine ⟨b, hb, D, hD, ?_⟩
intro n d eps hAllowed hdim K hK
obtain ⟨nu0, nu1, hnu0, hnu1, hmatch, gap, hgap, hgaplower,
hmean, hescape, hcontract, hcancel⟩ := hpriors n d eps hAllowed K hK
refine ⟨nu0, nu1, hnu0, hnu1, hmatch, gap, hgap, hgaplower,
hmean, ?_, hcontract, hcancel⟩
intro nu hnu
exact (hescape nu hnu).trans
(ENNReal.ofReal_le_ofReal (hcutoff n d eps hAllowed hdim))
theorem paired_lawspace_resource_priors_of_gate
Assume measurable Radon–Nikodym densities for dominated kernels, the Cai–Low moment-duality theorem, and the Bernstein absolute-approximation limit. The prescribed concentrated priors, pushed to paired input laws, have the same center gap and the strict real escape bounds used by the decision reduction. The underlying scalar priors are retained for transcript contraction.
Formal statement
hypotheses
hDual :
hBernstein :
conclusion
∃ b : ℝ,
0 < b
conclusion 1
∃ D : ℕ,
2 ≤ D
n d :
ℕ
eps :
ℝ
Allowed n d eps
D < d
K :
LocalProtocol n (PairedSymbol d)
SequentialClass K eps
a :
(frontierResources n d eps).converseAmp
q :
(frontierResources n d eps).converseDegree - 1
∃ nu0 nu1 : Measure ℝ,
AmplitudePrior a nu0
AmplitudePrior a nu1
MatchingMoments (q+1) nu0 nu1
∃ gap : ℝ,
0 < gap
(b/3400)*rateH .SI n d eps ≤ gap
(∫ p, tvFromUniform p ∂pi1) - (∫ p, tvFromUniform p ∂pi0) = gap
nu ∈ ({nu0, nu1} : Set (Measure ℝ)) :
≤ (1/100 : ℝ)
q+1 ≤ n
n < q+1
Proof (Lean source)
-- @node: paired_lawspace_resource_priors_of_gate
lemma paired_lawspace_resource_priors_of_gate
(hRN : MeasurableKernelRadonNikodym) (hDual : CaiLowMomentDuality)
(hBernstein : BernsteinAbsoluteApproximationLimit) :
∃ b : ℝ, 0 < b ∧ ∃ D : ℕ, 2 ≤ D ∧ ∀ (n d : ℕ) (eps : ℝ), Allowed n d eps → D < d →
∀ K : LocalProtocol n (PairedSymbol d), SequentialClass K eps →
let a := (frontierResources n d eps).converseAmp
let q := (frontierResources n d eps).converseDegree - 1
∃ nu0 nu1 : Measure ℝ, AmplitudePrior a nu0 ∧ AmplitudePrior a nu1 ∧
MatchingMoments (q+1) nu0 nu1 ∧
let pi0 := (productPrior d nu0).map pairedLaw
let pi1 := (productPrior d nu1).map pairedLaw
IsProbabilityMeasure pi0 ∧ IsProbabilityMeasure pi1 ∧
∃ gap : ℝ, 0 < gap ∧ (b/3400)*rateH .SI n d eps ≤ gap ∧
(∫ p, tvFromUniform p ∂pi1) - (∫ p, tvFromUniform p ∂pi0) = gap ∧
(∀ nu ∈ ({nu0, nu1} : Set (Measure ℝ)),
((productPrior d nu).map pairedLaw).real
{p | gap/8 < |tvFromUniform p - (∫ u, |u| ∂nu)/2|} ≤ (1/100 : ℝ)) ∧
(q+1 ≤ n → tvDist
((productPrior d nu0).bind
(fun theta => canonicalSeedTranscriptLaw K (pairedLaw theta)))
((productPrior d nu1).bind
(fun theta => canonicalSeedTranscriptLaw K (pairedLaw theta))) ≤
min 1 (d * a^(q+1) * sqrt (choose n (q+1)) *
(derivativeScale d eps)^(q+1))) ∧
(n < q+1 →
(productPrior d nu0).bind
(fun theta => canonicalSeedTranscriptLaw K (pairedLaw theta)) =
(productPrior d nu1).bind
(fun theta => canonicalSeedTranscriptLaw K (pairedLaw theta))) := by
obtain ⟨b, hb, D, hD, hpriors⟩ :=
paired_concentrated_resource_priors_of_gate hRN hDual hBernstein
refine ⟨b, hb, D, hD, ?_⟩
intro n d eps hAllowed hdim K hK
obtain ⟨nu0, nu1, hnu0, hnu1, hmatch, gap, hgap, hlower,
hmean, hescape, hcontract, hcancel⟩ := hpriors n d eps hAllowed hdim K hK
have ha := (frontier_converse_amplitude_domain n d eps hAllowed).2
have hd : 0 < d := by have := hAllowed.2.1; omega
letI := hnu0.1
letI := hnu1.1
haveI : IsProbabilityMeasure (productPrior d nu0) := by unfold productPrior; infer_instance
haveI : IsProbabilityMeasure (productPrior d nu1) := by unfold productPrior; infer_instance
refine ⟨nu0, nu1, hnu0, hnu1, hmatch,
Measure.isProbabilityMeasure_map measurable_pairedLaw_parameter.aemeasurable,
Measure.isProbabilityMeasure_map measurable_pairedLaw_parameter.aemeasurable,
gap, hgap, hlower, ?_, ?_, hcontract, hcancel⟩
· rw [pairedLaw_prior_target_mean hd _ ha nu1 hnu1,
pairedLaw_prior_target_mean hd _ ha nu0 hnu0]
rw [productPrior_paired_tv_mean hd _ ha nu1 hnu1,
productPrior_paired_tv_mean hd _ ha nu0 hnu0] at hmean
exact hmean
· intro nu hnu
have hstrict : (productPrior d nu)
{theta | gap/8 < |tvFromUniform (pairedLaw theta) - (∫ u, |u| ∂nu)/2|} ≤
ofReal (1/100 : ℝ) :=
(measure_mono (show
{theta : Fin d → ℝ | gap/8 < |tvFromUniform (pairedLaw theta) - (∫ u, |u| ∂nu)/2|} ⊆
{theta | gap/8 ≤ |tvFromUniform (pairedLaw theta) - (∫ u, |u| ∂nu)/2|}
from by
intro theta ht
change gap/8 < |tvFromUniform (pairedLaw theta) - (∫ u, |u| ∂nu)/2| at ht
change gap/8 ≤ |tvFromUniform (pairedLaw theta) - (∫ u, |u| ∂nu)/2|
exact ht.le)).trans (hescape nu hnu)
unfold Measure.real
rw [pairedLaw_prior_target_escape]
exact (ENNReal.toReal_mono ENNReal.ofReal_ne_top hstrict).trans_eq
(ENNReal.toReal_ofReal (by norm_num))
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.PairedTV 8 declarations Normalization, singleton masses and the half-L1 formula for the paired family.
Finite paired total variation
Normalization, singleton masses and the half-L1 formula for the paired family.
Fix the dimension. All probability laws on the finite paired alphabet.
Definition (Lean source)
Fix the dimension. The closed paired contrast family.
Definition (Lean source)
def tvFromUniform
Fix the probability law p. Scalar total variation from the public uniform law on the paired alphabet.
Definition (Lean source)
parameters
d :
ℕ
p :
Measure (PairedSymbol d)
def
tvFromUniform p :
ℝ
given by
(1/2 : ℝ) * ∑ v : PairedSymbol d, |p.real {v} - 1/(2*d)|
theorem pairedFamily_subset_simplex
Assume positive dimension. Probability membership of every paired law.
Formal statement
Proof (Lean source)
-- @node: pairedFamily_subset_simplex
lemma pairedFamily_subset_simplex (hd : 0 < d) : pairedFamily d ⊆ simplexModel d := by
rintro p ⟨theta, hTheta, rfl⟩
have hdR : (0 : ℝ) < d := by exact_mod_cast hd
have hmass : ∀ v : PairedSymbol d,
0 ≤ (1 + signVal v.2 * theta v.1) / (2 * d) := by
intro v
apply div_nonneg _ (by positivity)
have h := hTheta v.1
cases v.2 <;> simp only [signVal, Bool.false_eq_true, ↓reduceIte] <;> linarith [h.1, h.2]
have hsum : ∑ v : PairedSymbol d,
(1 + signVal v.2 * theta v.1) / (2 * d) = (1 : ℝ) := by
rw [Fintype.sum_prod_type]
have hcell : ∀ j : Fin d, ∑ s : Bool,
(1 + signVal s * theta j) / (2 * d) = (d : ℝ)⁻¹ := by
intro j
simp only [Fintype.sum_bool, signVal, Bool.false_eq_true, ↓reduceIte]
field_simp
<;> ring
simp_rw [hcell]
simp [ne_of_gt hdR]
change IsProbabilityMeasure (pairedLaw theta)
constructor
simp only [pairedLaw, atomLaw, Measure.finsetSum_apply, MeasurableSet.univ,
Measure.smul_apply, Measure.dirac_apply_of_mem, Set.mem_univ, smul_eq_mul, mul_one]
rw [← ENNReal.ofReal_sum_of_nonneg (fun v _ => hmass v), hsum]
simp
Assume the stated hw condition. Singleton masses of a nonnegative finite atomic law.
Formal statement
hypotheses
Proof (Lean source)
-- @node: atomLaw_real_singleton
lemma atomLaw_real_singleton {α : Type} [Fintype α] [MeasurableSpace α]
[MeasurableSingletonClass α] (w : α → ℝ) (hw : ∀ a, 0 ≤ w a) (a : α) :
(atomLaw w).real {a} = w a := by
classical
simp [Measure.real, atomLaw, Measure.finsetSum_apply, Measure.smul_apply,
Measure.dirac_apply', Pi.single_apply, ENNReal.toReal_ofReal (hw a)]
A finite probability experiment attains its half-L1 distance on positive atoms.
Formal statement
Proof (Lean source)
-- @node: finite_tvDist_eq_half_sum
lemma finite_tvDist_eq_half_sum {α : Type} [Fintype α] [MeasurableSpace α]
[MeasurableSingletonClass α] (p q : Measure α)
[IsProbabilityMeasure p] [IsProbabilityMeasure q] :
tvDist p q = (1/2 : ℝ) * ∑ x, |p.real {x} - q.real {x}| := by
classical
let A : Set α := {x | 0 ≤ p.real {x} - q.real {x}}
have hA : MeasurableSet A := Set.toFinite A |>.measurableSet
have hzero : ∑ x : α, (p.real {x} - q.real {x}) = 0 := by
rw [Finset.sum_sub_distrib]
have hp := probability_real_singleton_tsum p
have hq := probability_real_singleton_tsum q
simp only [tsum_fintype] at hp hq
rw [hp, hq]; ring
have hgap : p.real A - q.real A =
(1/2 : ℝ) * ∑ x, |p.real {x} - q.real {x}| := by
rw [probability_measureReal_eq_tsum_singletons p A hA,
probability_measureReal_eq_tsum_singletons q A hA]
simp only [tsum_fintype, ← Finset.sum_sub_distrib]
have hpoint : ∀ x : α,
A.indicator (fun x => p.real {x}) x - A.indicator (fun x => q.real {x}) x =
(|p.real {x} - q.real {x}| + (p.real {x} - q.real {x}))/2 := by
intro x
by_cases hx : 0 ≤ p.real {x} - q.real {x}
· simp [indicator, A, sub_nonneg.mp hx, abs_of_nonneg hx]
· simp [indicator, A,
show ¬ q.real {x} ≤ p.real {x} from fun h => hx (sub_nonneg.mpr h),
abs_of_neg (lt_of_not_ge hx)]
simp_rw [hpoint]
rw [← Finset.sum_div, Finset.sum_add_distrib, hzero]
ring
apply le_antisymm
· simpa only [tsum_fintype] using tvDist_le_half_tsum_singleton_abs p q
· rw [← hgap]
exact (le_abs_self _).trans (abs_measureReal_sub_le_tvDist hA)
theorem tvFromUniform_eq_tvDist
Assume positive dimension. Finite-sum TV agrees with the measure-theoretic testing distance.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: tvFromUniform_eq_tvDist
lemma tvFromUniform_eq_tvDist (p : Measure (PairedSymbol d)) [IsProbabilityMeasure p] (hd : 0 < d) :
tvFromUniform p = tvDist p (pairedUniform d) := by
have hcube : (fun _ : Fin d => (0 : ℝ)) ∈ parameterCube d := by
intro j; norm_num
have hprob := pairedFamily_subset_simplex hd (Set.mem_image_of_mem pairedLaw hcube)
have : IsProbabilityMeasure (pairedUniform d) := hprob
have hmass : ∀ v : PairedSymbol d, (pairedUniform d).real {v} = 1/(2*d) := by
intro v
unfold pairedUniform pairedLaw
rw [atomLaw_real_singleton]
· simp
· intro a; simp
rw [finite_tvDist_eq_half_sum]
simp_rw [hmass]
rfl
theorem tvFromUniform_pairedLaw
Assume the stated theta condition and positive dimension. The paired target is one half of the signed norm.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: tvFromUniform_pairedLaw
lemma tvFromUniform_pairedLaw (theta : Fin d → ℝ) (hTheta : theta ∈ parameterCube d) (hd : 0 < d) :
tvFromUniform (pairedLaw theta) = signedNorm theta/2 := by
have hdR : (0 : ℝ) < d := by exact_mod_cast hd
have hmass : ∀ v : PairedSymbol d,
0 ≤ (1 + signVal v.2 * theta v.1) / (2*d) := by
intro v
apply div_nonneg _ (by positivity)
have h := hTheta v.1
cases v.2 <;> simp only [signVal, Bool.false_eq_true, ↓reduceIte] <;> linarith [h.1, h.2]
unfold tvFromUniform pairedLaw
simp_rw [atomLaw_real_singleton _ hmass]
rw [Fintype.sum_prod_type]
have hcell : ∀ j : Fin d, ∑ s : Bool,
|(1 + signVal s * theta j)/(2*d) - 1/(2*d)| = |theta j| / d := by
intro j
simp only [Fintype.sum_bool, signVal, Bool.false_eq_true, ↓reduceIte, one_mul]
have hp : (1 + theta j)/(2*d) - 1/(2*d) = theta j/(2*d) := by ring
have hn : (1 + -1 * theta j)/(2*d) - 1/(2*d) = -(theta j/(2*d)) := by ring
rw [hp, hn, abs_neg, abs_div, abs_of_pos (by positivity : (0 : ℝ) < 2*d)]
field_simp
<;> ring
simp_rw [hcell]
rw [← Finset.sum_div]
unfold signedNorm
ring
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.PairedTwoPoint 4 declarations Direct squared-risk and honest-length reductions on the paired model, including all dimensions below a fixed universal cutoff.
Paired two-point converse
Direct squared-risk and honest-length reductions on the paired model, including all dimensions below a fixed universal cutoff.
theorem paired_constant_contrast_tv_bound
Assume measurable Radon–Nikodym densities for dominated kernels, sequential local privacy of the protocol, an admissible sample size, dimension, and privacy budget, and amplitude between zero and one half. Constant paired parameters inherit the arbitrary-channel contraction through signed preprocessing of the original records.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
K :
LocalProtocol n (PairedSymbol d)
eps a :
ℝ
hK :
SequentialClass K eps
hAllowed :
Allowed n d eps
ha :
a ∈ Ioc 0 (1/2 : ℝ)
conclusion
tvDist (canonicalSeedTranscriptLaw K (pairedLaw (fun _ => 0))) (canonicalSeedTranscriptLaw K (pairedLaw (fun _ => a)))
≤ a*sqrt n*eps
Proof (Lean source)
-- @node: paired_constant_contrast_tv_bound
lemma paired_constant_contrast_tv_bound (hRN : MeasurableKernelRadonNikodym)
(K : LocalProtocol n (PairedSymbol d)) (eps a : ℝ)
(hK : SequentialClass K eps) (hAllowed : Allowed n d eps)
(ha : a ∈ Ioc 0 (1/2 : ℝ)) :
tvDist (canonicalSeedTranscriptLaw K (pairedLaw (fun _ => 0)))
(canonicalSeedTranscriptLaw K (pairedLaw (fun _ => a))) ≤ a*sqrt n*eps := by
have h0 : (fun _ : Fin d => (0 : ℝ)) ∈ parameterCube d := by
intro j; constructor <;> norm_num
have h1 : (fun _ : Fin d => a) ∈ parameterCube d := by
intro j; exact ⟨by linarith [ha.1], ha.2⟩
have h := constant_contrast_tv_bound hRN (canonicalScheme n d)
canonicalScheme_iidPeople canonicalScheme_independentRandomness (pulledProtocol K)
eps a ((signed_protocol_classes eps).2 K |>.1 hK) hAllowed ha
simp only [seedTranscriptLaw, canonicalSeedTranscriptLaw,
pulledProtocol_decisionLaw _ canonicalScheme_iidPeople
canonicalScheme_independentRandomness hAllowed.2.1 K _ h0,
pulledProtocol_decisionLaw _ canonicalScheme_iidPeople
canonicalScheme_independentRandomness hAllowed.2.1 K _ h1] at h
dsimp [pulledProtocol, canonicalSeedTranscriptLaw] at h ⊢
exact h
theorem paired_constant_contrast_decision_lower
Assume amplitude between zero and one half, dimension at least two, and the stated total-variation bound. The two point-prior reduction is applied on the symmetric submodel, so the interval premise asks for honesty only on paired laws.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
K :
LocalProtocol n (PairedSymbol d)
a :
ℝ
ha :
a ∈ Ioc 0 (1/2 : ℝ)
hd :
2 ≤ d
hTV :
tvDist (canonicalSeedTranscriptLaw K (pairedLaw (fun _ => 0))) (canonicalSeedTranscriptLaw K (pairedLaw (fun _ => a)))
≤ 1/8
conclusion
conclusion 1
T :
ofReal (63*a^2/4096)
≤ ⨆ p : {p : Measure (PairedSymbol d) // p ∈ pairedFamily d}, squaredRisk (canonicalDecisionLaw K p.1) T (tvFromUniform p.1)
conclusion 2
J :
IntervalDecision K 0 1
ofReal (81*a/320)
≤ ⨆ p : {p : Measure (PairedSymbol d) // p ∈ pairedFamily d}, expectedLength (canonicalDecisionLaw K p.1) J
Proof (Lean source)
-- @node: paired_constant_contrast_decision_lower
lemma paired_constant_contrast_decision_lower
(K : LocalProtocol n (PairedSymbol d)) (a : ℝ)
(ha : a ∈ Ioc 0 (1/2 : ℝ)) (hd : 2 ≤ d)
(hTV : tvDist
(canonicalSeedTranscriptLaw K (pairedLaw (fun _ => 0)))
(canonicalSeedTranscriptLaw K (pairedLaw (fun _ => a))) ≤ 1/8) :
(∀ T : Estimator K, ofReal (63*a^2/4096) ≤
⨆ p : {p : Measure (PairedSymbol d) // p ∈ pairedFamily d},
squaredRisk (canonicalDecisionLaw K p.1) T (tvFromUniform p.1)) ∧
(∀ J : IntervalDecision K 0 1,
(∀ p ∈ pairedFamily d, (0.90 : ℝ) ≤ coverage (canonicalDecisionLaw K p) J
(tvFromUniform p)) →
ofReal (81*a/320) ≤
⨆ p : {p : Measure (PairedSymbol d) // p ∈ pairedFamily d},
expectedLength (canonicalDecisionLaw K p.1) J) := by
let Q := pulledProtocol K
let M := symmetricLaw '' parameterCube d
let laws := completedDecisionLaw Q
let target := fun P : Measure (FullRecord d) => value P - 1/2
have h0 : (fun _ : Fin d => (0 : ℝ)) ∈ parameterCube d := by
intro j; constructor <;> norm_num
have h1 : (fun _ : Fin d => a) ∈ parameterCube d := by
intro j; exact ⟨by linarith [ha.1], ha.2⟩
have hEq (theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d) :
laws (symmetricLaw theta) = canonicalDecisionLaw K (pairedLaw theta) := by
haveI := symmetricLaw_probability theta htheta (by omega)
rw [show laws (symmetricLaw theta) = decisionLaw (canonicalScheme n d) Q
(symmetricLaw theta) from completedDecisionLaw_eq_canonical Q _]
exact pulledProtocol_decisionLaw _ canonicalScheme_iidPeople
canonicalScheme_independentRandomness hd K theta htheta
have hTarget (theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d) :
target (symmetricLaw theta) = tvFromUniform (pairedLaw theta) := by
dsimp [target]
rw [symmetricLaw_value theta htheta (by omega),
tvFromUniform_pairedLaw theta htheta (by omega)]
ring
have hProduct : ∀ P ∈ M, laws P =
(((laws P).map (fun w => (w.1,w.2.1))).prod uniform01).map
(fun w : (ProtocolTranscript Q × Q.Seed) × ℝ => (w.1.1,w.1.2,w.2)) := by
rintro P ⟨theta, htheta, rfl⟩
haveI := symmetricLaw_probability theta htheta (by omega)
dsimp [laws]
rw [completedDecisionLaw_eq_canonical]
exact sampling_decisionLaw_randomizer _ canonicalScheme_iidPeople
canonicalScheme_independentRandomness Q _
(symmetricLaw_causalModel theta htheta (by omega))
have hProb : ∀ P ∈ M, IsProbabilityMeasure (laws P) := by
rintro P ⟨theta, htheta, rfl⟩
haveI := symmetricLaw_probability theta htheta (by omega)
dsimp [laws]
rw [completedDecisionLaw_eq_canonical]
exact sampling_decisionLaw_probability _ canonicalScheme_iidPeople
canonicalScheme_independentRandomness Q _
(symmetricLaw_causalModel theta htheta (by omega))
have hv0 : target (symmetricLaw (fun _ : Fin d => (0 : ℝ))) = 0 := by
rw [hTarget _ h0, tvFromUniform_pairedLaw _ h0 (by omega), signedNorm_constant _ (by omega)]
norm_num
have hv1 : target (symmetricLaw (fun _ : Fin d => a)) = a/2 := by
rw [hTarget _ h1, tvFromUniform_pairedLaw _ h1 (by omega),
signedNorm_constant _ (by omega), abs_of_pos ha.1]
have hmem0 : symmetricLaw (fun _ : Fin d => (0 : ℝ)) ∈ M := ⟨_, h0, rfl⟩
have hmem1 : symmetricLaw (fun _ : Fin d => a) ∈ M := ⟨_, h1, rfl⟩
have hbind (P : Measure (FullRecord d)) : (Measure.dirac P).bind laws = laws P := by
rw [Measure.bind_congr_right (ae_eq_dirac laws)]
change (Measure.dirac P).bind (fun _ => laws P) = _
simp
have hescape0 : (Measure.dirac (symmetricLaw (fun _ : Fin d => (0 : ℝ)))).real
{P | (a/2-0)/8 < |target P-0|} ≤ 0 := by
have hnot : symmetricLaw (fun _ : Fin d => (0 : ℝ)) ∉
{P | (a/2-0)/8 < |target P-0|} := by
simp only [Set.mem_ofPred_eq, hv0, sub_self, abs_zero]; linarith [ha.1]
simp only [Measure.real, Measure.dirac_apply, Set.indicator_of_notMem hnot,
ENNReal.toReal_zero, le_refl]
have hescape1 : (Measure.dirac (symmetricLaw (fun _ : Fin d => a))).real
{P | (a/2-0)/8 < |target P-a/2|} ≤ 0 := by
have hnot : symmetricLaw (fun _ : Fin d => a) ∉
{P | (a/2-0)/8 < |target P-a/2|} := by
simp only [Set.mem_ofPred_eq, hv1, sub_self, abs_zero]; linarith [ha.1]
simp only [Measure.real, Measure.dirac_apply, Set.indicator_of_notMem hnot,
ENNReal.toReal_zero, le_refl]
have htv : tvDist
(((Measure.dirac (symmetricLaw (fun _ : Fin d => (0 : ℝ)))).bind laws).map
(fun w => (w.2.1,w.1)))
(((Measure.dirac (symmetricLaw (fun _ : Fin d => a))).bind laws).map
(fun w => (w.2.1,w.1))) ≤ 1/8 := by
rw [hbind, hbind, hEq _ h0, hEq _ h1]
dsimp [Q, pulledProtocol] at *
exact hTV
have hsep := separated_value_mixtures_generic Q M target laws hProduct hProb
(Measure.dirac (symmetricLaw (fun _ : Fin d => (0 : ℝ))))
(Measure.dirac (symmetricLaw (fun _ : Fin d => a)))
(by simp [hmem0]) (by simp [hmem1])
(by dsimp [target]; fun_prop) (measurable_completedDecisionLaw Q)
0 (a/2) 0 (1/8) (by linarith [ha.1]) hescape0 hescape1 htv 0 1
have hr : 9*(a/2-0)^2/128 * max 0 (1-(1/8 : ℝ)-2*0) = 63*a^2/4096 := by
norm_num; ring
have hl : 3*(a/2-0)/4 * max 0 ((0.80 : ℝ)-2*0-1/8) = 81*a/320 := by
norm_num; ring
rw [hr, hl] at hsep
constructor
· intro T
refine (hsep.1 T).trans ?_
apply iSup_le
rintro ⟨P, theta, htheta, rfl⟩
rw [hEq _ htheta, hTarget _ htheta]
exact le_iSup_of_le ⟨pairedLaw theta, theta, htheta, rfl⟩ le_rfl
· intro J hCov
let JQ : IntervalDecision Q 0 1 :=
⟨J.lo, J.hi, J.measurable_lo, J.measurable_hi, J.ordered, J.range_lo, J.range_hi⟩
have hCovM : ∀ P ∈ M, (0.90 : ℝ) ≤ coverage (laws P) JQ (target P) := by
rintro P ⟨theta, htheta, rfl⟩
rw [hEq _ htheta, hTarget _ htheta]
exact hCov _ ⟨theta, htheta, rfl⟩
refine (hsep.2 JQ hCovM).trans ?_
apply iSup_le
rintro ⟨P, theta, htheta, rfl⟩
rw [hEq _ htheta]
exact le_iSup_of_le ⟨pairedLaw theta, theta, htheta, rfl⟩ le_rfl
theorem paired_dimension_free_two_point_decisions
Assume measurable Radon–Nikodym densities for dominated kernels, an admissible sample size, dimension, and privacy budget, and sequential local privacy of the protocol. The paired two-point experiment gives both per-decision inverse-information bounds for every sequential channel and independent public seed.
Formal statement
hypotheses
n d :
ℕ
eps :
ℝ
hAllowed :
Allowed n d eps
K :
LocalProtocol n (PairedSymbol d)
hK :
SequentialClass K eps
conclusion
conclusion 1
T :
≤ ⨆ p : {p : Measure (PairedSymbol d) // p ∈ pairedFamily d}, squaredRisk (canonicalDecisionLaw K p.1) T (tvFromUniform p.1)
conclusion 2
J :
IntervalDecision K 0 1
≤ ⨆ p : {p : Measure (PairedSymbol d) // p ∈ pairedFamily d}, expectedLength (canonicalDecisionLaw K p.1) J
Proof (Lean source)
-- @node: paired_dimension_free_two_point_decisions
lemma paired_dimension_free_two_point_decisions (hRN : MeasurableKernelRadonNikodym)
(n d : ℕ) (eps : ℝ) (hAllowed : Allowed n d eps)
(K : LocalProtocol n (PairedSymbol d)) (hK : SequentialClass K eps) :
(∀ T : Estimator K, ofReal ((1/8192 : ℝ)*min 1 (1/(n*eps^2))) ≤
⨆ p : {p : Measure (PairedSymbol d) // p ∈ pairedFamily d},
squaredRisk (canonicalDecisionLaw K p.1) T (tvFromUniform p.1)) ∧
(∀ J : IntervalDecision K 0 1,
(∀ p ∈ pairedFamily d, (0.90 : ℝ) ≤ coverage (canonicalDecisionLaw K p) J
(tvFromUniform p)) →
ofReal ((1/8192 : ℝ)*min 1 (1/(sqrt n*eps))) ≤
⨆ p : {p : Measure (PairedSymbol d) // p ∈ pairedFamily d},
expectedLength (canonicalDecisionLaw K p.1) J) := by
let a := min 1 (1/(sqrt n*eps))/8
obtain ⟨ha, hsmall, hr, hl⟩ := two_point_amplitude_calibration n eps
(by have := hAllowed.1; omega) hAllowed.2.2.1
have hTV := (paired_constant_contrast_tv_bound hRN K eps a hK hAllowed ha).trans hsmall
have hsep := paired_constant_contrast_decision_lower K a ha hAllowed.2.1 hTV
exact ⟨fun T => (ENNReal.ofReal_le_ofReal hr).trans (hsep.1 T),
fun J hCov => (ENNReal.ofReal_le_ofReal hl).trans (hsep.2 J hCov)⟩
theorem paired_bounded_dimension_frontier_lower
Assume measurable Radon–Nikodym densities for dominated kernels, polynomial degree at least two, dimension no larger than the polynomial degree, an admissible sample size, dimension, and privacy budget, and sequential local privacy of the protocol. Below a fixed dimension cutoff the two-point bounds control the full paired frontier, with the same universal cutoff factor for risk and honest length.
Formal statement
hypotheses
D n d :
ℕ
eps :
ℝ
hD :
2 ≤ D
hdD :
d ≤ D
hAllowed :
Allowed n d eps
K :
LocalProtocol n (PairedSymbol d)
hK :
SequentialClass K eps
conclusion
conclusion 1
T :
≤ ⨆ p : {p : Measure (PairedSymbol d) // p ∈ pairedFamily d}, squaredRisk (canonicalDecisionLaw K p.1) T (tvFromUniform p.1)
conclusion 2
J :
IntervalDecision K 0 1
≤ ⨆ p : {p : Measure (PairedSymbol d) // p ∈ pairedFamily d}, expectedLength (canonicalDecisionLaw K p.1) J
Proof (Lean source)
-- @node: paired_bounded_dimension_frontier_lower
lemma paired_bounded_dimension_frontier_lower (hRN : MeasurableKernelRadonNikodym)
(D n d : ℕ) (eps : ℝ) (hD : 2 ≤ D) (hdD : d ≤ D) (hAllowed : Allowed n d eps)
(K : LocalProtocol n (PairedSymbol d)) (hK : SequentialClass K eps) :
(∀ T : Estimator K, ofReal ((1/(32768*(D : ℝ)^2))*rateR .SI n d eps) ≤
⨆ p : {p : Measure (PairedSymbol d) // p ∈ pairedFamily d},
squaredRisk (canonicalDecisionLaw K p.1) T (tvFromUniform p.1)) ∧
(∀ J : IntervalDecision K 0 1,
(∀ p ∈ pairedFamily d, (0.90 : ℝ) ≤ coverage (canonicalDecisionLaw K p) J
(tvFromUniform p)) →
ofReal ((1/(32768*(D : ℝ)^2))*rateH .SI n d eps) ≤
⨆ p : {p : Measure (PairedSymbol d) // p ∈ pairedFamily d},
expectedLength (canonicalDecisionLaw K p.1) J) := by
obtain ⟨hr, hh⟩ := bounded_dimension_frontier_comparisons D n d eps hD hdD hAllowed
have hDpos : (0 : ℝ) < D := by exact_mod_cast (show 0 < D by omega)
have hscale : (1/(32768*(D : ℝ)^2))*(4*(D : ℝ)^2) = 1/8192 := by
field_simp
<;> ring
have hscaledR := mul_le_mul_of_nonneg_left hr
(by positivity : (0 : ℝ) ≤ 1/(32768*(D : ℝ)^2))
have hscaledH := mul_le_mul_of_nonneg_left hh
(by positivity : (0 : ℝ) ≤ 1/(32768*(D : ℝ)^2))
rw [← mul_assoc, hscale] at hscaledR hscaledH
have hdec := paired_dimension_free_two_point_decisions hRN n d eps hAllowed K hK
exact ⟨fun T => (ENNReal.ofReal_le_ofReal hscaledR).trans (hdec.1 T),
fun J hCov => (ENNReal.ofReal_le_ofReal hscaledH).trans (hdec.2 J hCov)⟩
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.PrivateMoments 5 declarations Finite original-record private value frontiers: Helpers/PrivateMoments.
Helpers/PrivateMoments
Finite original-record private value frontiers: Helpers/PrivateMoments.
def privateMoment
Fix the function W, the order, and the coordinate index. Distinct-person unbiased power statistic including degree zero.
def elementaryMoment
Fix the function w. Structural elementary-symmetric recursion, avoiding subset enumeration.
Definition (Lean source)
parameters
w :
ℕ → ℝ
def
elementaryMoment w :
ℕ → ℕ → ℝ
given by
clause 1
| 0, 0 => 1
clause 2
| 0, _+1 => 0
clause 3
| _+1, 0 => 1
clause 4
| m+1, k+1 => elementaryMoment w m (k+1) + w m * elementaryMoment w m k
Assume the stated hx condition. Splitting subsets according to whether they contain the new participant.
Formal statement
Proof (Lean source)
-- @node: sum_powersetCard_insert_product
lemma sum_powersetCard_insert_product (w : ℕ → ℝ) (s : Finset ℕ) (x k : ℕ)
(hx : x ∉ s) :
(∑ J ∈ (insert x s).powersetCard (k+1), ∏ i ∈ J, w i) =
(∑ J ∈ s.powersetCard (k+1), ∏ i ∈ J, w i) +
w x * (∑ J ∈ s.powersetCard k, ∏ i ∈ J, w i) := by
classical
have hnot : ∀ J ∈ s.powersetCard k, x ∉ J := by
intro J hJ hxJ
exact hx ((Finset.mem_powersetCard.mp hJ).1 hxJ)
rw [Finset.powersetCard_succ_insert hx]
rw [Finset.sum_union]
· congr 1
rw [Finset.sum_image]
· rw [Finset.mul_sum]
apply Finset.sum_congr rfl
intro J hJ
exact Finset.prod_insert (hnot J hJ)
· intro J hJ K hK hJK
apply Finset.ext
intro i
have hi := Finset.ext_iff.mp hJK i
by_cases hix : i = x
· subst i
simp [hnot J hJ, hnot K hK]
· simpa [hix] using hi
· apply Finset.disjoint_left.mpr
intro J hJ hJi
obtain ⟨K, hK, rfl⟩ := Finset.mem_image.mp hJi
exact hx ((Finset.mem_powersetCard.mp hJ).1 (Finset.mem_insert_self _ _))
The structural recursion enumerates products over subsets of a finite range.
Formal statement
hypotheses
w :
ℕ → ℝ
m k :
ℕ
conclusion
elementaryMoment w m k = ∑ J ∈ (range m).powersetCard k, ∏ i ∈ J, w i
Proof (Lean source)
-- @node: elementaryMoment_eq_range_sum
lemma elementaryMoment_eq_range_sum (w : ℕ → ℝ) (m k : ℕ) :
elementaryMoment w m k = ∑ J ∈ (range m).powersetCard k, ∏ i ∈ J, w i := by
classical
induction m generalizing k with
| zero =>
cases k with
| zero => simp [elementaryMoment]
| succ k =>
have hempty : (∅ : Finset ℕ).powersetCard (k+1) = ∅ :=
Finset.powersetCard_eq_empty.mpr (by simp)
simp [elementaryMoment, hempty]
| succ m ih =>
cases k with
| zero => simp [elementaryMoment]
| succ k =>
rw [elementaryMoment, ih, ih, Finset.range_add_one,
sum_powersetCard_insert_product w (range m) m k (by simp)]
theorem privateMoment_eq_recursion
Recursion agrees with the private moment subset formula.
Formal statement
hypotheses
conclusion
privateMoment W k j
= (Nat.choose m k : ℝ)⁻¹ * elementaryMoment (fun i => if h : i < m then W ⟨i,h⟩ j else 0) m k
Proof (Lean source)
-- @node: privateMoment_eq_recursion
lemma privateMoment_eq_recursion (W : Fin m → Fin d → ℝ) (k : ℕ) (j : Fin d) :
privateMoment W k j = (Nat.choose m k : ℝ)⁻¹ *
elementaryMoment (fun i => if h : i < m then W ⟨i,h⟩ j else 0) m k := by
classical
unfold privateMoment
congr 1
rw [elementaryMoment_eq_range_sum]
let e : Fin m ↪ ℕ := ⟨Fin.val, Fin.val_injective⟩
have he : (Finset.univ : Finset (Fin m)).map e = range m := by
ext i
simp only [Finset.mem_map, Finset.mem_univ, true_and, Finset.mem_range]
exact ⟨fun ⟨a, ha⟩ => ha ▸ a.isLt, fun hi => ⟨⟨i, hi⟩, rfl⟩⟩
rw [← he, Finset.powersetCard_map, Finset.sum_map]
apply Finset.sum_congr rfl
intro J hJ
change (∏ i ∈ J, W i j) =
∏ i ∈ J.map e, (if h : i < m then W ⟨i,h⟩ j else 0)
rw [Finset.prod_map]
apply Finset.prod_congr rfl
intro i hi
simp [e, i.isLt]
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.Protocol 22 declarations Finite original-record private value frontiers: Helpers/Protocol.
Helpers/Protocol
Finite original-record private value frontiers: Helpers/Protocol.
Fix the sample size and the parameter α. All law-independent choices of a one-message sequential protocol.
Definition (Lean source)
parameters
n :
ℕ
α :
Type
fields
Seed :
Type
seedMeasurable :
MeasurableSpace Seed
seedStandard :
@StandardBorelSpace Seed seedMeasurable
seedLaw :
@Measure Seed seedMeasurable
seedProbability :
@IsProbabilityMeasure Seed seedMeasurable seedLaw
Message :
Fin n → Type
messageMeasurable :
∀ i, MeasurableSpace (Message i)
messageStandard :
∀ i, @StandardBorelSpace (Message i) (messageMeasurable i)
kernels :
letI := seedMeasurable; letI := messageMeasurable; KernelFamily (α × Seed) Message
markov :
letI := seedMeasurable; letI := messageMeasurable; ∀ i, IsMarkovKernel (kernels i)
def ProtocolHistory
Fix the local protocol Q and the participant index. History immediately preceding a participant.
Definition (Lean source)
def ProtocolTranscript
Fix the local protocol Q. Complete dependent transcript.
Definition (Lean source)
def FullRecordPrivacy
Fix the local protocol Q and the privacy budget. Pure privacy for every input pair, seed, history and measurable output event.
Definition (Lean source)
parameters
n :
ℕ
α :
Type
Q :
LocalProtocol n α
eps :
ℝ
i :
Fin n
o o' :
α
eta :
ProtocolHistory Q i
r :
Q.Seed
E :
Set (Q.Message i)
def
FullRecordPrivacy Q eps :
Prop
def Noninteraction
Fix the local protocol Q. Constancy in all message histories.
Definition (Lean source)
parameters
n :
ℕ
α :
Type
Q :
LocalProtocol n α
i :
Fin n
o :
α
eta eta' :
ProtocolHistory Q i
r :
Q.Seed
def
Noninteraction Q :
Prop
given by
Q.kernels i ((o,r),eta) = Q.kernels i ((o,r),eta')
structure SequentialClass
Fix the local protocol Q and the privacy budget. The declared sequential class.
Definition (Lean source)
parameters
assumes
privacy :
FullRecordPrivacy Q eps
structure NoninteractiveClass
Fix the local protocol Q and the privacy budget. The declared noninteractive class.
Definition (Lean source)
parameters
assumes
privacy :
FullRecordPrivacy Q eps
noninteraction :
Fix the protocol-class label, the local protocol Q, and the privacy budget. Select one of the two protocol classes.
Definition (Lean source)
parameters
def
protocolClass C Q eps :
Prop
given by
match C with | .NI => NoninteractiveClass Q eps | .SI => SequentialClass Q eps
theorem toSequentialClass
NI protocols are sequential protocols.
Formal statement
hypotheses
conclusion
SequentialClass Q eps
Proof (Lean source)
-- @node: NoninteractiveClass.toSequentialClass
lemma NoninteractiveClass.toSequentialClass (Q : LocalProtocol n α) (eps : ℝ)
(h : NoninteractiveClass Q eps) : SequentialClass Q eps := by
exact ⟨h.privacy⟩
def uniform01
Analyst's uniform randomizer law.
Fix the sample size and the dimension. Scheme for the joint input, public seed and analyst randomizer.
Definition (Lean source)
parameters
n d :
ℕ
def
SamplingScheme n d :
Type 1
given by
(R : Type) → [MeasurableSpace R] → Measure R → Measure (FullRecord d) → Measure ((Fin n → ObsRecord d) × R × ℝ)
def IidPeople
Fix the sampling scheme S. On the declared causal model and standard-Borel public-seed spaces, the records marginal is the n-fold observed product law.
Definition (Lean source)
def IndependentRandomness
Fix the sampling scheme S. On the declared causal model and standard-Borel public-seed spaces, the seed and analyst randomizer form a product independent of the record vector.
Definition (Lean source)
parameters
def
IndependentRandomness S :
Prop
def canonicalScheme
Fix the sample size and the dimension. Canonical iid scheme, displaying non-vacuity of the sampling atoms.
Definition (Lean source)
parameters
n d :
ℕ
def
theorem canonicalScheme_iidPeople
Canonical iid certificate.
Formal statement
Proof (Lean source)
-- @node: canonicalScheme_iidPeople
lemma canonicalScheme_iidPeople : IidPeople (canonicalScheme n d) := by
intro R _ _ lam _ P _ _
simp [canonicalScheme, Measure.map_fst_prod, uniform01, Real.volume_Icc, Measure.prod_apply]
theorem canonicalScheme_independentRandomness
Canonical independent-randomness certificate.
Formal statement
Proof (Lean source)
-- @node: canonicalScheme_independentRandomness
lemma canonicalScheme_independentRandomness : IndependentRandomness (canonicalScheme n d) := by
intro R _ _ lam _ P _ hP
rw [canonicalScheme_iidPeople R lam P hP]
rfl
def fixedTranscriptLaw
Fix the local protocol Q, the function o, and the public seed. Conditional transcript law for fixed records and seed.
Definition (Lean source)
def DecisionSpace
Fix the local protocol Q. Private decision observation space.
Definition (Lean source)
def decisionLaw
Fix the sampling scheme S, the local protocol Q, and the probability law P. Joint transcript, seed and analyst randomizer law induced by any sampling scheme.
Definition (Lean source)
parameters
n :
ℕ
d :
ℕ
S :
SamplingScheme n d
Q :
LocalProtocol n (ObsRecord d)
P :
Measure (FullRecord d)
def
given by
(S Q.Seed Q.seedLaw P).bind (fun w => (fixedTranscriptLaw Q w.1 w.2.1).map (fun z => (z,w.2.1,w.2.2)))
def canonicalDecisionLaw
Fix the local protocol Q and the probability law p. Canonical decision law for an arbitrary input alphabet.
Definition (Lean source)
parameters
def
given by
((Measure.pi (fun _ : Fin n => p)).prod (Q.seedLaw.prod uniform01)).bind (fun w => (fixedTranscriptLaw Q w.1 w.2.1).map (fun z => (z,w.2.1,w.2.2)))
def seedTranscriptLaw
Fix the sampling scheme S, the local protocol Q, and the probability law P. Joint seed/transcript marginal.
Definition (Lean source)
parameters
n :
ℕ
d :
ℕ
S :
SamplingScheme n d
Q :
LocalProtocol n (ObsRecord d)
P :
Measure (FullRecord d)
def
given by
(decisionLaw S Q P).map (fun w => (w.2.1,w.1))
def canonicalSeedTranscriptLaw
Fix the local protocol Q and the probability law p. Canonical joint seed/transcript law on an arbitrary alphabet.
Definition (Lean source)
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.RateAlgebra 22 declarations Finite original-record private value frontiers: Helpers/RateAlgebra.
Helpers/RateAlgebra
Finite original-record private value frontiers: Helpers/RateAlgebra.
Fix the function f and the function g. Eventual comparison of two real numerical sequences by fixed positive constants.
Definition (Lean source)
parameters
f g :
ℕ → ℝ
def
Comparable f g :
Prop
All numerical resource conclusions carried by rho.
Definition (Lean source)
def
RateResourceConclusions :
Prop
given by
clause 1
clause 2
Comparable (fun k => rho (ns k*(es k)^2) (ds k)) (fun k => 1/(ns k*(es k)^2))
↔ (∃ a : ℝ, 0 < a ∧ ∀ᶠ k in atTop, a ≤ ns k*(es k)^2) ∧
Comparable (fun k => rho (ns k*(es k)^2) (ds k)) (fun k => 1/(ns k*(es k)^2))
↔ ∃ M : ℕ, ∀ᶠ k in atTop, ds k ≤ M
Assume dimension at least two. The logarithmic dimension is positive on the declared dimension domain.
Formal statement
Proof (Lean source)
-- @node: logDim_pos
lemma logDim_pos (d : ℕ) (hd : 2 ≤ d) : 0 < logDim d := by
have hdR : (2 : ℝ) ≤ d := by exact_mod_cast hd
have he : 1 < exp (1 : ℝ) := Real.one_lt_exp_iff.mpr zero_lt_one
apply Real.log_pos
nlinarith
Assume dimension at least two, the stated ht condition, and the stated hbranch condition. In the nondense branch, the rate saturates exactly at the paper's threshold.
Formal statement
Proof (Lean source)
-- @node: rho_saturation_iff
lemma rho_saturation_iff (d : ℕ) (t : ℝ) (hd : 2 ≤ d) (ht : 0 < t)
(hbranch : t < (d : ℝ)^2 * logDim d) :
rho t d = 1 ↔ t ≤ (d : ℝ)^2 * logDim d / (exp 1*d - exp 1) := by
have hdR : (2 : ℝ) ≤ d := by exact_mod_cast hd
have he : 0 < exp (1 : ℝ) := Real.exp_pos 1
have hL : 0 < logDim d := logDim_pos d hd
have ha : 0 < (d : ℝ)^2 * logDim d := mul_pos (by positivity) hL
have hb : 0 < exp 1 * d - exp 1 := by nlinarith
have hw : 0 < log (exp 1 + (d : ℝ)^2 * logDim d / t) := by
apply Real.log_pos
have he1 : 1 < exp (1 : ℝ) := Real.one_lt_exp_iff.mpr zero_lt_one
have hz : 0 < (d : ℝ)^2 * logDim d / t := div_pos ha ht
linarith
rw [rho, if_neg (not_le.mpr hbranch)]
have hratio : 0 ≤ log (exp 1 + (d : ℝ)^2 * logDim d / t) / logDim d :=
(div_pos hw hL).le
have hmin : min 1 (log (exp 1 + (d : ℝ)^2 * logDim d / t) / logDim d)^2 = 1 ↔
1 ≤ log (exp 1 + (d : ℝ)^2 * logDim d / t) / logDim d := by
constructor
· intro h
have hlo := le_min (show (0 : ℝ) ≤ 1 by norm_num) hratio
have hhi := min_le_left (1 : ℝ)
(log (exp 1 + (d : ℝ)^2 * logDim d / t) / logDim d)
have heq : min 1 (log (exp 1 + (d : ℝ)^2 * logDim d / t) / logDim d) = 1 := by
nlinarith
calc
1 = min 1 (log (exp 1 + (d : ℝ)^2 * logDim d / t) / logDim d) := heq.symm
_ ≤ _ := min_le_right _ _
· intro h
rw [min_eq_left h]
norm_num
rw [hmin]
rw [le_div_iff₀ hL, one_mul]
change log (exp 1 * d) ≤
log (exp 1 + (d : ℝ)^2 * logDim d / t) ↔ _
rw [Real.log_le_log_iff (by positivity) (by positivity), le_div_iff₀ hb]
constructor
· intro h
have h' : exp 1 * d - exp 1 ≤ (d : ℝ)^2 * logDim d / t := by linarith
have h'' := (le_div_iff₀ ht).mp h'
nlinarith
· intro h
have h' : exp 1 * d - exp 1 ≤ (d : ℝ)^2 * logDim d / t := by
apply (le_div_iff₀ ht).mpr
nlinarith
linarith
Assume dimension at least two. The logarithmic dimension lies between one and the dimension itself.
Formal statement
Proof (Lean source)
-- @node: logDim_bounds
lemma logDim_bounds (d : ℕ) (hd : 2 ≤ d) : 1 ≤ logDim d ∧ logDim d ≤ d := by
have hdR : (2 : ℝ) ≤ d := by exact_mod_cast hd
have hdpos : (0 : ℝ) < d := by linarith
rw [logDim, Real.log_mul (Real.exp_pos 1).ne' hdpos.ne', Real.log_exp]
have hlo : 0 ≤ log (d : ℝ) := Real.log_nonneg (by linarith)
have hhi := Real.log_le_sub_one_of_pos hdpos
constructor <;> linarith
Assume dimension at least two, the stated ht condition, and the stated hbranch condition. All three elementary resource comparisons hold in the dense branch.
Formal statement
Proof (Lean source)
-- @node: rho_dense_comparisons
lemma rho_dense_comparisons (d : ℕ) (t : ℝ) (hd : 2 ≤ d) (ht : 0 < t)
(hbranch : (d : ℝ)^2 * logDim d ≤ t) :
min 1 (1/t) ≤ rho t d ∧
rho t d ≤ 4 * min 1 ((d : ℝ)^2/t) ∧
(1/4 : ℝ) * min t (d : ℝ) ≤ t * rho t d := by
have hdR : (2 : ℝ) ≤ d := by exact_mod_cast hd
have hdpos : (0 : ℝ) < d := by linarith
have hL := logDim_pos d hd
obtain ⟨hLone, hLd⟩ := logDim_bounds d hd
have hLd2 : logDim d ≤ (d : ℝ)^2 := by nlinarith
have hrho : rho t d = (d : ℝ)^2 / (t * logDim d) := by rw [rho, if_pos hbranch]
have hparam : 1/t ≤ rho t d := by
rw [hrho, div_le_div_iff₀ ht (mul_pos ht hL)]
nlinarith
have hunit : rho t d ≤ 1 := by
rw [hrho, div_le_one (mul_pos ht hL)]
have hdt : (d : ℝ)^2 ≤ t := by nlinarith
nlinarith
have hdim : rho t d ≤ (d : ℝ)^2/t := by
rw [hrho, div_le_div_iff₀ (mul_pos ht hL) ht]
have hp : 0 ≤ (d : ℝ)^2 * t := by positivity
nlinarith
have hscale : t * rho t d = (d : ℝ)^2/logDim d := by
rw [hrho]
field_simp
have hscaled : (1/4 : ℝ) * d ≤ t * rho t d := by
rw [hscale, le_div_iff₀ hL]
nlinarith
refine ⟨(min_le_right _ _).trans hparam, ?_, ?_⟩
· rw [mul_min_of_nonneg _ _ (by norm_num : (0 : ℝ) ≤ 4)]
apply le_min
· linarith
· have : 0 ≤ (d : ℝ)^2 / t := by positivity
linarith
· exact (mul_le_mul_of_nonneg_left (min_le_right _ _) (by norm_num)).trans hscaled
Assume the stated hv condition. The logarithmic derivative factor in the weighted resource comparison is nonnegative.
Proof (Lean source)
-- @node: log_shift_score_nonneg
lemma log_shift_score_nonneg (v : ℝ) (hv : 0 ≤ v) :
0 ≤ log (exp 1 + v) - 2*v/(exp 1 + v) := by
have he := Real.exp_pos (1 : ℝ)
have hx : 0 < exp 1 + v := by positivity
have hh := Real.one_sub_inv_le_log_of_pos (div_pos hx he)
rw [Real.log_div hx.ne' he.ne', Real.log_exp, inv_div] at hh
have hsum : exp 1 / (exp 1 + v) + v / (exp 1 + v) = 1 := by
rw [← add_div, div_self hx.ne']
have hp : 0 ≤ exp 1 / (exp 1 + v) := (div_pos he hx).le
rw [mul_div_assoc]
linarith
Assume the stated ha condition. The squared weighted logarithm increases with the positive resource variable.
Formal statement
Proof (Lean source)
-- @node: weighted_log_square_monotone
lemma weighted_log_square_monotone (a : ℝ) (ha : 0 < a) :
MonotoneOn (fun t : ℝ => t * (log (exp 1 + a/t))^2) (Ioi 0) := by
have hd (t : ℝ) (ht : 0 < t) :
HasDerivAt (fun t : ℝ => t * (log (exp 1 + a/t))^2)
(log (exp 1 + a/t) *
(log (exp 1 + a/t) - 2*(a/t)/(exp 1 + a/t))) t := by
have hx : 0 < exp 1 + a/t := by positivity
have hg := ((hasDerivAt_const t a).div (hasDerivAt_id t) ht.ne').const_add (exp 1)
have hw := hg.log hx.ne'
convert (hasDerivAt_id t).mul (hw.pow 2) using 1 <;> try dsimp
all_goals first | rfl | (field_simp; ring)
apply monotoneOn_of_deriv_nonneg (convex_Ioi 0)
· intro t ht
exact (hd t ht).continuousAt.continuousWithinAt
· intro t ht
exact (hd t (interior_subset ht)).differentiableAt.differentiableWithinAt
· intro t ht
have htpos : 0 < t := interior_subset ht
rw [(hd t htpos).deriv]
apply mul_nonneg
· apply Real.log_nonneg
have he1 : 1 < exp (1 : ℝ) := Real.one_lt_exp_iff.mpr zero_lt_one
have hv : 0 ≤ a/t := (div_pos ha htpos).le
linarith
· exact log_shift_score_nonneg (a/t) (by positivity)
Assume the stated hz condition. For z at least one, the squared shifted logarithm is at most four times z.
Proof (Lean source)
-- @node: log_shift_square_upper
lemma log_shift_square_upper (z : ℝ) (hz : 1 ≤ z) :
(log (exp 1 + z))^2 ≤ 4*z := by
have hzpos : 0 < z := by linarith
have he := Real.exp_pos (1 : ℝ)
have hroot : 0 < sqrt z := Real.sqrt_pos.mpr hzpos
have hlogs := Real.log_le_sub_one_of_pos hroot
rw [Real.log_sqrt hzpos.le] at hlogs
have hlog2 : log (exp 1 + 1) ≤ 2 := by
apply (Real.log_le_iff_le_exp (by positivity)).mpr
rw [show (2 : ℝ) = 1+1 by norm_num, Real.exp_add]
nlinarith [Real.exp_one_gt_two]
have hupper := Real.log_le_log (by positivity : 0 < exp 1 + z)
(show exp 1 + z ≤ (exp 1 + 1)*z by nlinarith)
rw [Real.log_mul (by positivity) hzpos.ne'] at hupper
have hw : 0 ≤ log (exp 1 + z) := Real.log_nonneg (by linarith)
have hs := Real.sq_sqrt hzpos.le
nlinarith
Assume the stated hx condition. Squaring commutes with truncation at one for a nonnegative argument.
Proof (Lean source)
-- @node: sq_min_one_nonneg
lemma sq_min_one_nonneg (x : ℝ) (hx : 0 ≤ x) : (min 1 x)^2 = min 1 (x^2) := by
by_cases h : x ≤ 1
· rw [min_eq_right h, min_eq_right (show x^2 ≤ 1 by nlinarith)]
· have hh : 1 ≤ x := le_of_not_ge h
rw [min_eq_left hh, min_eq_left (show 1 ≤ x^2 by nlinarith)]
norm_num
Assume dimension at least two. The dimension times its logarithmic dimension is at least the exponential constant.
Proof (Lean source)
-- @node: dimension_log_product_ge_exp
lemma dimension_log_product_ge_exp (d : ℕ) (hd : 2 ≤ d) :
exp 1 ≤ (d : ℝ)*logDim d := by
have hdR : (2 : ℝ) ≤ d := by exact_mod_cast hd
have hdpos : (0 : ℝ) < d := by linarith
have hlog := Real.one_sub_inv_le_log_of_pos hdpos
have hL : logDim d = 1 + log d := by
rw [logDim, Real.log_mul (Real.exp_pos 1).ne' hdpos.ne', Real.log_exp]
have hh := mul_le_mul_of_nonneg_left hlog hdpos.le
have hi : (d : ℝ) * (d : ℝ)⁻¹ = 1 := mul_inv_cancel₀ hdpos.ne'
nlinarith [Real.exp_one_lt_three]
Assume dimension at least two. The shifted logarithm at resource t = d is at least half the logarithmic dimension.
Formal statement
Proof (Lean source)
-- @node: log_shift_dimension_half
lemma log_shift_dimension_half (d : ℕ) (hd : 2 ≤ d) :
logDim d / 2 ≤ log (exp 1 + (d : ℝ)*logDim d) := by
have hdR : (2 : ℝ) ≤ d := by exact_mod_cast hd
have hdpos : (0 : ℝ) < d := by linarith
obtain ⟨hLone, _⟩ := logDim_bounds d hd
have he := Real.exp_pos (1 : ℝ)
have h1 := Real.log_le_log he (show exp 1 ≤ exp 1 + (d : ℝ)*logDim d by nlinarith)
rw [Real.log_exp] at h1
have h2 := Real.log_le_log hdpos
(show (d : ℝ) ≤ exp 1 + (d : ℝ)*logDim d by nlinarith)
have hL : logDim d = 1 + log d := by
rw [logDim, Real.log_mul he.ne' hdpos.ne', Real.log_exp]
linarith
Assume dimension at least two, the stated ht condition, and the stated hbranch condition. All three elementary resource comparisons hold in the nondense branch.
Formal statement
Proof (Lean source)
-- @node: rho_nondense_comparisons
lemma rho_nondense_comparisons (d : ℕ) (t : ℝ) (hd : 2 ≤ d) (ht : 0 < t)
(hbranch : ¬ (d : ℝ)^2 * logDim d ≤ t) :
min 1 (1/t) ≤ rho t d ∧
rho t d ≤ 4 * min 1 ((d : ℝ)^2/t) ∧
(1/4 : ℝ) * min t (d : ℝ) ≤ t * rho t d := by
have hdR : (2 : ℝ) ≤ d := by exact_mod_cast hd
have hdpos : (0 : ℝ) < d := by linarith
have hL := logDim_pos d hd
obtain ⟨hLone, _⟩ := logDim_bounds d hd
let a : ℝ := (d : ℝ)^2 * logDim d
let w : ℝ := log (exp 1 + a/t)
let x : ℝ := w / logDim d
have ha : 0 < a := by dsimp [a]; positivity
have he := Real.exp_pos (1 : ℝ)
have hw : 0 < w := by
apply Real.log_pos
have he1 : 1 < exp (1 : ℝ) := Real.one_lt_exp_iff.mpr zero_lt_one
have hz := div_pos ha ht
linarith
have hx : 0 ≤ x := (div_pos hw hL).le
have hrho : rho t d = min 1 (x^2) := by
rw [rho, if_neg hbranch]
exact sq_min_one_nonneg x hx
have hbase1 : logDim d ≤ log (exp 1 + a) := by
have had := mul_le_mul_of_nonneg_left (dimension_log_product_ge_exp d hd) hdpos.le
apply Real.log_le_log (mul_pos he hdpos)
dsimp [a]
nlinarith
have hadiv : a / (d : ℝ) = (d : ℝ)*logDim d := by dsimp [a]; field_simp <;> ring
have hbaseD : logDim d/2 ≤ log (exp 1 + a/(d : ℝ)) := by
rw [hadiv]
exact log_shift_dimension_half d hd
have hupper : x^2 ≤ 4 * ((d : ℝ)^2/t) := by
have hz : 1 ≤ a/t := (le_div_iff₀ ht).mpr (by dsimp [a]; nlinarith)
have hlog := log_shift_square_upper (a/t) hz
dsimp [x]
rw [div_pow, div_le_iff₀ (sq_pos_of_pos hL)]
have hcompare : 4*(a/t) ≤ (4*((d : ℝ)^2/t))*(logDim d)^2 := by
dsimp [a]
simp only [← mul_div_assoc, div_mul_eq_mul_div]
rw [div_le_div_iff_of_pos_right ht]
have hd2 : 0 ≤ (d : ℝ)^2 := sq_nonneg _
nlinarith
exact hlog.trans hcompare
have hparam : min 1 (1/t) ≤ rho t d := by
rw [hrho]
by_cases ht1 : t ≤ 1
· have hfrac : a ≤ a/t := (le_div_iff₀ ht).mpr (by nlinarith)
have hlog := Real.log_le_log (show 0 < exp 1 + a by positivity)
(show exp 1 + a ≤ exp 1 + a/t by linarith)
have hx1 : 1 ≤ x := (le_div_iff₀ hL).mpr (by dsimp [w]; linarith)
rw [min_eq_left (show 1 ≤ x^2 by nlinarith)]
exact min_le_left _ _
· have ht1' : 1 ≤ t := le_of_not_ge ht1
have hm := weighted_log_square_monotone a ha (show 0 < (1 : ℝ) by norm_num) ht ht1'
simp only [div_one, one_mul] at hm
have hbasepos : 0 ≤ log (exp 1 + a) := by linarith
have hparam' : 1/t ≤ x^2 := by
dsimp [x]
rw [div_pow, div_le_div_iff₀ ht (sq_pos_of_pos hL)]
dsimp [w]
nlinarith
exact le_min (min_le_left _ _) ((min_le_right _ _).trans hparam')
have hscaled : (1/4 : ℝ) * min t (d : ℝ) ≤ t*x^2 := by
by_cases htd : t ≤ (d : ℝ)
· have hfrac : a/(d : ℝ) ≤ a/t := div_le_div_of_nonneg_left ha.le ht htd
have hlog := Real.log_le_log (show 0 < exp 1 + a/(d : ℝ) by positivity)
(show exp 1 + a/(d : ℝ) ≤ exp 1 + a/t by linarith)
have hquarter : (1/4 : ℝ) ≤ x^2 := by
dsimp [x]
rw [div_pow, le_div_iff₀ (sq_pos_of_pos hL)]
have hwbase : logDim d/2 ≤ w := by dsimp [w]; linarith
nlinarith
rw [min_eq_left htd]
nlinarith
· have hdt : (d : ℝ) ≤ t := le_of_not_ge htd
have hm := weighted_log_square_monotone a ha hdpos ht hdt
have hbasepos : 0 ≤ log (exp 1 + a/(d : ℝ)) := by linarith
rw [min_eq_right hdt]
dsimp [x]
rw [div_pow, ← mul_div_assoc, le_div_iff₀ (sq_pos_of_pos hL)]
have hs : (logDim d)^2/4 ≤ (log (exp 1 + a/(d : ℝ)))^2 := by nlinarith
have hmul := mul_le_mul_of_nonneg_left hs hdpos.le
dsimp [w]
nlinarith
refine ⟨hparam, ?_, ?_⟩
· rw [hrho, mul_min_of_nonneg _ _ (by norm_num : (0 : ℝ) ≤ 4)]
exact le_min ((min_le_left _ _).trans (by norm_num)) ((min_le_right _ _).trans hupper)
· rw [hrho, mul_min_of_nonneg _ _ ht.le, mul_one]
apply le_min
· have hmin := min_le_left t (d : ℝ)
have hm0 : 0 ≤ min t (d : ℝ) := le_min ht.le hdpos.le
nlinarith
· exact hscaled
theorem rho_elementary_comparisons
Elementary global rate comparisons used for small dimensions.
Formal statement
Proof (Lean source)
-- @node: rho_elementary_comparisons
lemma rho_elementary_comparisons (n d : ℕ) (eps : ℝ) (h : Allowed n d eps) :
min 1 (1/(n*eps^2)) ≤ rho (n*eps^2) d ∧
rho (n*eps^2) d ≤ 4 * min 1 ((d : ℝ)^2/(n*eps^2)) ∧
(1/4 : ℝ) * min (n*eps^2) (d : ℝ) ≤ n*eps^2 * rho (n*eps^2) d := by
have hn : (0 : ℝ) < n := by exact_mod_cast (lt_of_lt_of_le (by omega : 0 < 2) h.1)
have ht : 0 < (n : ℝ) * eps^2 := mul_pos hn (sq_pos_of_pos h.2.2.1)
by_cases hbranch : (d : ℝ)^2 * logDim d ≤ (n : ℝ)*eps^2
· exact rho_dense_comparisons d (n*eps^2) h.2.1 ht hbranch
· exact rho_nondense_comparisons d (n*eps^2) h.2.1 ht hbranch
Assume dimension at least two and the stated ht condition. The rate is at most one at every positive allowed resource.
Formal statement
hypotheses
d :
ℕ
t :
ℝ
hd :
2 ≤ d
ht :
0 < t
conclusion
rho t d ≤ 1
Proof (Lean source)
-- @node: rho_le_one
lemma rho_le_one (d : ℕ) (t : ℝ) (hd : 2 ≤ d) (ht : 0 < t) :
rho t d ≤ 1 := by
by_cases hb : (d : ℝ)^2 * logDim d ≤ t
· have hL := (logDim_bounds d hd).1
have hLp := logDim_pos d hd
rw [rho, if_pos hb, div_le_one (mul_pos ht hLp)]
have hd2 : 0 ≤ (d : ℝ)^2 := sq_nonneg _
have hdt : (d : ℝ)^2 ≤ t := by nlinarith
nlinarith
· rw [rho, if_neg hb]
have hx : 0 ≤ log (exp 1 + (d : ℝ)^2 * logDim d / t) / logDim d := by
apply div_nonneg _ (logDim_pos d hd).le
apply Real.log_nonneg
have he := Real.one_lt_exp_iff.mpr (show (0 : ℝ) < 1 by norm_num)
have hz : 0 ≤ (d : ℝ)^2 * logDim d / t :=
div_nonneg (mul_nonneg (sq_nonneg _) (logDim_pos d hd).le) ht.le
linarith
have hlo : 0 ≤ min 1 (log (exp 1 + (d : ℝ)^2 * logDim d / t) / logDim d) :=
le_min (by norm_num) hx
have hhi := min_le_left (1 : ℝ)
(log (exp 1 + (d : ℝ)^2 * logDim d / t) / logDim d)
nlinarith
theorem rho_parametric_comparable_iff
Assume the stated h condition. The elementary comparisons characterize parametric order even for oscillating resources.
Formal statement
hypotheses
conclusion
Comparable (fun k => rho (ns k*(es k)^2) (ds k)) (fun k => 1/(ns k*(es k)^2))
↔ (∃ a : ℝ, 0 < a ∧ ∀ᶠ k in atTop, a ≤ ns k*(es k)^2) ∧
Proof (Lean source)
-- @node: rho_parametric_comparable_iff
lemma rho_parametric_comparable_iff (ns ds : ℕ → ℕ) (es : ℕ → ℝ)
(h : ∀ k, Allowed (ns k) (ds k) (es k)) :
Comparable (fun k => rho (ns k*(es k)^2) (ds k)) (fun k => 1/(ns k*(es k)^2)) ↔
(∃ a : ℝ, 0 < a ∧ ∀ᶠ k in atTop, a ≤ ns k*(es k)^2) ∧
(∃ M : ℝ, ∀ᶠ k in atTop, min (ns k*(es k)^2) (ds k : ℝ) ≤ M) := by
have ht (k : ℕ) : 0 < (ns k : ℝ)*(es k)^2 := by
have hn : (0 : ℝ) < ns k := by exact_mod_cast (lt_of_lt_of_le (by omega : 0 < 2) (h k).1)
exact mul_pos hn (sq_pos_of_pos (h k).2.2.1)
constructor
· rintro ⟨c, C, hc, hcC, he⟩
constructor
· refine ⟨c, hc, he.mono ?_⟩
intro k hk
have hu := rho_le_one (ds k) (ns k*(es k)^2) (h k).2.1 (ht k)
have hh : c / (ns k*(es k)^2) ≤ 1 := by simpa [div_eq_mul_inv] using hk.1.trans hu
exact (div_le_one (ht k)).mp hh
· refine ⟨4*C, he.mono ?_⟩
intro k hk
have hb := (rho_elementary_comparisons (ns k) (ds k) (es k) (h k)).2.2
have hu := mul_le_mul_of_nonneg_left hk.2 (ht k).le
have heq : (ns k : ℝ)*(es k)^2*(C*(1/(ns k*(es k)^2))) = C := by
calc
_ = C * (((ns k : ℝ)*(es k)^2) * ((ns k : ℝ)*(es k)^2)⁻¹) := by ring
_ = C := by rw [mul_inv_cancel₀ (ht k).ne', mul_one]
rw [heq] at hu
linarith
· rintro ⟨⟨a, ha, hea⟩, ⟨M, heM⟩⟩
let B : ℝ := max 1 M
have hB : 1 ≤ B := le_max_left _ _
have hMB : M ≤ B := le_max_right _ _
let c : ℝ := min 1 a
have hc : 0 < c := lt_min (by norm_num) ha
have hc1 : c ≤ 1 := min_le_left _ _
have hca : c ≤ a := min_le_right _ _
refine ⟨c, 4*B^2, hc, by nlinarith, ?_⟩
filter_upwards [hea, heM] with k hka hkM
obtain ⟨hlo, hhi, _⟩ := rho_elementary_comparisons (ns k) (ds k) (es k) (h k)
constructor
· apply le_trans _ hlo
apply le_min
· rw [mul_one_div, div_le_one (ht k)]
exact hca.trans hka
· exact mul_le_of_le_one_left (by positivity) hc1
· have hm : min ((ns k : ℝ)*(es k)^2) (ds k : ℝ) ≤ B := hkM.trans hMB
rcases le_total ((ns k : ℝ)*(es k)^2) (ds k : ℝ) with hk | hk
· rw [min_eq_left hk] at hm
have hu := rho_le_one (ds k) (ns k*(es k)^2) (h k).2.1 (ht k)
apply hu.trans
rw [mul_one_div, le_div_iff₀ (ht k)]
nlinarith
· rw [min_eq_right hk] at hm
apply hhi.trans
have hs : (ds k : ℝ)^2 ≤ B^2 := by
have hd0 : (0 : ℝ) ≤ ds k := Nat.cast_nonneg _
nlinarith
calc
4 * min 1 ((ds k : ℝ)^2 / (ns k*(es k)^2)) ≤
4 * ((ds k : ℝ)^2 / (ns k*(es k)^2)) :=
mul_le_mul_of_nonneg_left (min_le_right _ _) (by norm_num)
_ ≤ 4*B^2*(1/(ns k*(es k)^2)) := by
rw [mul_one_div, ← mul_div_assoc, div_le_div_iff_of_pos_right (ht k)]
linarith
Assume the stated ht condition. Diverging resources turn an eventual bound on the minimum into bounded dimension.
Formal statement
Proof (Lean source)
-- @node: bounded_min_iff_bounded_dimension
lemma bounded_min_iff_bounded_dimension (t : ℕ → ℝ) (ds : ℕ → ℕ)
(ht : Tendsto t atTop atTop) :
(∃ M : ℝ, ∀ᶠ k in atTop, min (t k) (ds k : ℝ) ≤ M) ↔
∃ M : ℕ, ∀ᶠ k in atTop, ds k ≤ M := by
constructor
· rintro ⟨M, he⟩
obtain ⟨N, hN⟩ := exists_nat_ge M
refine ⟨N, ?_⟩
filter_upwards [he, ht.eventually_gt_atTop M] with k hk htk
have hd : (ds k : ℝ) ≤ M := by
by_contra hn
have hh := lt_min htk (lt_of_not_ge hn)
exact (not_lt_of_ge hk) hh
exact_mod_cast hd.trans hN
· rintro ⟨M, he⟩
refine ⟨M, he.mono ?_⟩
intro k hk
exact (min_le_right _ _).trans (by exact_mod_cast hk)
theorem rho_parametric_iff_bounded_dimension
Assume the stated h condition and the stated ht condition. Along diverging resources, parametric order holds exactly for bounded dimensions.
Formal statement
Proof (Lean source)
-- @node: rho_parametric_iff_bounded_dimension
lemma rho_parametric_iff_bounded_dimension (ns ds : ℕ → ℕ) (es : ℕ → ℝ)
(h : ∀ k, Allowed (ns k) (ds k) (es k))
(ht : Tendsto (fun k => (ns k : ℝ) * (es k) ^ 2) atTop atTop) :
Comparable (fun k => rho (ns k*(es k)^2) (ds k)) (fun k => 1/(ns k*(es k)^2)) ↔
∃ M : ℕ, ∀ᶠ k in atTop, ds k ≤ M := by
rw [rho_parametric_comparable_iff ns ds es h,
bounded_min_iff_bounded_dimension _ ds ht]
have ha : ∃ a : ℝ, 0 < a ∧ ∀ᶠ k in atTop, a ≤ (ns k : ℝ)*(es k)^2 :=
⟨1, by norm_num, ht.eventually_ge_atTop 1⟩
exact and_iff_right ha
The logarithmic dimension diverges with the number of cells.
Assume the stated ha condition, the stated hu condition, the stated l condition, the stated hb condition, and the stated ha l condition. At resources comparable to squared dimension, the shifted logarithm is comparable with the logarithm of the logarithmic dimension.
Formal statement
Proof (Lean source)
-- @node: elbow_log_comparisons
lemma elbow_log_comparisons (a b L u : ℝ) (ha : 0 < a) (hu : u ∈ Icc a b)
(hL : 1 ≤ L) (hb : 2 * log b ≤ log L)
(haL : log (exp 1 + 1 / a) ≤ log L) :
log L / 2 ≤ log (exp 1 + L/u) ∧
log (exp 1 + L/u) ≤ 2 * log L := by
have hu0 : 0 < u := ha.trans_le hu.1
have hb0 : 0 < b := hu0.trans_le hu.2
have hL0 : 0 < L := lt_of_lt_of_le (by norm_num) hL
constructor
· have hdiv : L/b ≤ L/u := div_le_div_of_nonneg_left hL0.le hu0 hu.2
have hh := Real.log_le_log (div_pos hL0 hb0)
(show L/b ≤ exp 1 + L/u by linarith [Real.exp_pos (1 : ℝ)])
rw [Real.log_div hL0.ne' hb0.ne'] at hh
linarith
· have hdiv : L/u ≤ L/a := div_le_div_of_nonneg_left hL0.le ha hu.1
have hexp : exp 1 ≤ L * exp 1 := by
nlinarith [Real.exp_pos (1 : ℝ)]
have hh := Real.log_le_log (show 0 < exp 1 + L/u by positivity)
(show exp 1 + L/u ≤ L * (exp 1 + 1/a) by
rw [mul_add, mul_one_div]
linarith)
rw [Real.log_mul hL0.ne' (show exp 1 + 1/a ≠ 0 by positivity)] at hh
linarith
Assume the stated ha condition and the stated hab assumption. The numerical rate at resources comparable to squared dimension has the squared log-log over log order, uniformly once the dimension is large enough.
Formal statement
Proof (Lean source)
-- @node: rho_elbow_comparison
lemma rho_elbow_comparison (a b : ℝ) (ha : 0 < a) (_hab : a ≤ b) :
∃ c C0 : ℝ, 0 < c ∧ c ≤ C0 ∧ ∃ D0 : ℕ,
∀ d : ℕ, D0 ≤ d → 2 ≤ d → ∀ t : ℝ,
t/(d : ℝ)^2 ∈ Icc a b →
c * (log (logDim d)/logDim d)^2 ≤ rho t d ∧
rho t d ≤ C0 * (log (logDim d)/logDim d)^2 := by
have hlogL := Real.tendsto_log_atTop.comp logDim_tendsto_atTop
have he : ∀ᶠ d : ℕ in atTop,
b + 1 ≤ logDim d ∧ 2 * log b ≤ log (logDim d) ∧
log (exp 1 + 1 / a) ≤ log (logDim d) := by
filter_upwards [logDim_tendsto_atTop.eventually_ge_atTop (b+1),
hlogL.eventually_ge_atTop (2 * log b),
hlogL.eventually_ge_atTop (log (exp 1 + 1 / a))] with d h1 h2 h3
exact ⟨h1, h2, h3⟩
obtain ⟨D0, hD0⟩ := Filter.eventually_atTop.mp he
refine ⟨1/4, 4, by norm_num, by norm_num, D0, ?_⟩
intro d hd0 hd t ht
have hdpos : (0 : ℝ) < d := by exact_mod_cast (show 0 < d by omega)
have hd2 : 0 < (d : ℝ)^2 := sq_pos_of_pos hdpos
have hL := (logDim_bounds d hd).1
have hLp := logDim_pos d hd
obtain ⟨hbL, hbLog, haLog⟩ := hD0 d hd0
have htpos : 0 < t := (div_pos_iff_of_pos_right hd2).mp (ha.trans_le ht.1)
have htupper : t ≤ b * (d : ℝ)^2 := (div_le_iff₀ hd2).mp ht.2
have hbranch : ¬ (d : ℝ)^2 * logDim d ≤ t := by
have hb : b < logDim d := by linarith
have hh := mul_lt_mul_of_pos_left hb hd2
nlinarith
have heq : (d : ℝ)^2 * logDim d / t = logDim d / (t/(d : ℝ)^2) := by
field_simp
obtain ⟨hlo, hhi⟩ := elbow_log_comparisons a b (logDim d) (t/(d : ℝ)^2)
ha ht hL hbLog haLog
rw [rho, if_neg hbranch, heq]
have hlog0 : 0 ≤ log (logDim d) := Real.log_nonneg hL
have hlogle : log (logDim d) ≤ logDim d := by
linarith [Real.log_le_sub_one_of_pos hLp]
have hlo' : log (logDim d) / logDim d / 2 ≤
log (exp 1 + logDim d / (t/(d : ℝ)^2)) / logDim d := by
simpa only [div_div, mul_comm] using div_le_div_of_nonneg_right hlo hLp.le
have hhi' : log (exp 1 + logDim d / (t/(d : ℝ)^2)) / logDim d ≤
2 * (log (logDim d) / logDim d) := by
simpa only [mul_div_assoc] using div_le_div_of_nonneg_right hhi hLp.le
have hratio0 : 0 ≤ log (logDim d) / logDim d := div_nonneg hlog0 hLp.le
have hratio1 : log (logDim d) / logDim d ≤ 1 := (div_le_one hLp).mpr hlogle
have hmlo : log (logDim d) / logDim d / 2 ≤
min 1 (log (exp 1 + logDim d / (t/(d : ℝ)^2)) / logDim d) :=
le_min (by linarith) hlo'
have hmhi := (min_le_right (1 : ℝ)
(log (exp 1 + logDim d / (t/(d : ℝ)^2)) / logDim d)).trans hhi'
constructor <;> nlinarith
Fix the function risk and the function length. Resource conclusions transferred to actual finite minimax values.
Definition (Lean source)
parameters
risk length :
(n d : ℕ) → ℝ → ℝ
def
ValueSequenceConclusions risk length :
Prop
given by
clause 1
Comparable (fun k => risk (ns k) (ds k) (es k)) (fun k => 1/(ns k*(es k)^2))
↔ (∃ a : ℝ, 0 < a ∧ ∀ᶠ k in atTop, a ≤ ns k*(es k)^2) ∧
Comparable (fun k => risk (ns k) (ds k) (es k)) (fun k => 1/(ns k*(es k)^2))
↔ ∃ M : ℕ, ∀ᶠ k in atTop, ds k ≤ M
clause 2
a b :
ℝ
0 < a
a ≤ b
∃ c C0 : ℝ,
0 < c
c ≤ C0
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.RateConsistency 6 declarations Logarithmic comparisons and the consistency criterion for arbitrary resource sequences.
Numerical consistency of the private value rate
Logarithmic comparisons and the consistency criterion for arbitrary resource sequences.
Assume the stated l condition and the stated hx condition. The shifted logarithm lies between the unshifted logarithm and its logarithmic correction.
Formal statement
Proof (Lean source)
-- @node: consistency_log_comparisons
lemma consistency_log_comparisons (L x : ℝ) (hL : 1 ≤ L) (hx : 0 ≤ x) :
log (1+x) ≤ log (exp 1+L*x) ∧
log (exp 1+L*x) ≤ log (1+x) + log (exp 1+L) := by
have he : 1 < exp (1 : ℝ) := Real.one_lt_exp_iff.mpr zero_lt_one
have hp : 0 < exp 1+L*x := by positivity
constructor
· apply Real.log_le_log (by positivity)
nlinarith
· rw [← Real.log_mul (by positivity : (1+x : ℝ) ≠ 0)
(by positivity : (exp 1+L : ℝ) ≠ 0)]
apply Real.log_le_log hp
nlinarith
Assume dimension at least two, the stated ht condition, and the stated hr condition. Off saturation the desired logarithmic ratio is bounded by the square root of the rate.
Formal statement
Proof (Lean source)
-- @node: consistency_ratio_sq_le_rho
lemma consistency_ratio_sq_le_rho (d : ℕ) (t : ℝ) (hd : 2 ≤ d) (ht : 0 < t)
(hr : rho t d < 1) :
(log (1+(d : ℝ)^2/t)/logDim d)^2 ≤ rho t d := by
have hLp := logDim_pos d hd
have hL := (logDim_bounds d hd).1
have hx : 0 ≤ (d : ℝ)^2/t := div_nonneg (sq_nonneg _) ht.le
have hg : 0 ≤ log (1+(d : ℝ)^2/t)/logDim d :=
div_nonneg (Real.log_nonneg (by linarith)) hLp.le
by_cases hb : (d : ℝ)^2 * logDim d ≤ t
· rw [rho, if_pos hb]
have hxL : (d : ℝ)^2/t * logDim d ≤ 1 := by
apply (div_le_one ht).mpr at hb
simpa [div_mul_eq_mul_div] using hb
have hlog : log (1+(d : ℝ)^2/t) ≤ (d : ℝ)^2/t := by
have hh := Real.log_le_sub_one_of_pos (show 0 < 1+(d : ℝ)^2/t by positivity)
linarith
have hgx : log (1+(d : ℝ)^2/t)/logDim d ≤ ((d : ℝ)^2/t)/logDim d :=
div_le_div_of_nonneg_right hlog hLp.le
have hxg : (d : ℝ)^2/t / logDim d ≤ 1 := by
apply (div_le_one hLp).mpr
nlinarith
have hpow : (log (1+(d : ℝ)^2/t)/logDim d)^2 ≤ ((d : ℝ)^2/t)/logDim d := by
nlinarith
simpa [div_div] using hpow
· rw [rho, if_neg hb] at hr ⊢
have hw := (consistency_log_comparisons (logDim d) ((d : ℝ)^2/t) hL hx).1
have hwg : log (1+(d : ℝ)^2/t)/logDim d ≤
log (exp 1+(d : ℝ)^2*logDim d/t)/logDim d := by
apply div_le_div_of_nonneg_right _ hLp.le
simpa [div_mul_eq_mul_div, mul_comm] using hw
have hmin : min 1 (log (exp 1+(d : ℝ)^2*logDim d/t)/logDim d) =
log (exp 1+(d : ℝ)^2*logDim d/t)/logDim d := by
apply min_eq_right
by_contra hn
rw [min_eq_left (le_of_not_ge hn)] at hr
norm_num at hr
rw [hmin]
nlinarith
Assume dimension at least two and the stated ht condition. Both branches are bounded by the logarithmic ratio, its correction, and a dense remainder.
Formal statement
Proof (Lean source)
-- @node: consistency_rho_upper
lemma consistency_rho_upper (d : ℕ) (t : ℝ) (hd : 2 ≤ d) (ht : 0 < t) :
rho t d ≤
(log (1+(d : ℝ)^2/t)/logDim d +
log (exp 1+logDim d)/logDim d)^2 + (1/logDim d)^2 := by
have hLp := logDim_pos d hd
have hL := (logDim_bounds d hd).1
have hx : 0 ≤ (d : ℝ)^2/t := div_nonneg (sq_nonneg _) ht.le
have hg : 0 ≤ log (1+(d : ℝ)^2/t)/logDim d :=
div_nonneg (Real.log_nonneg (by linarith)) hLp.le
have he : 0 ≤ log (exp 1+logDim d)/logDim d := by
apply div_nonneg _ hLp.le
apply Real.log_nonneg
have he := Real.exp_pos (1 : ℝ)
linarith
by_cases hb : (d : ℝ)^2*logDim d ≤ t
· rw [rho, if_pos hb]
have hden : 0 < t*logDim d := mul_pos ht hLp
have hbound : (d : ℝ)^2/(t*logDim d) ≤ (1/logDim d)^2 := by
apply (div_le_iff₀ hden).mpr
field_simp
nlinarith
exact hbound.trans (le_add_of_nonneg_left (sq_nonneg _))
· rw [rho, if_neg hb]
have hw := (consistency_log_comparisons (logDim d) ((d : ℝ)^2/t) hL hx).2
have hwg : log (exp 1+(d : ℝ)^2*logDim d/t)/logDim d ≤
log (1+(d : ℝ)^2/t)/logDim d +
log (exp 1+logDim d)/logDim d := by
rw [← add_div]
apply div_le_div_of_nonneg_right _ hLp.le
simpa [div_mul_eq_mul_div, mul_comm] using hw
have hm := (min_le_right (1 : ℝ)
(log (exp 1+(d : ℝ)^2*logDim d/t)/logDim d)).trans hwg
have hm0 : 0 ≤ min 1 (log (exp 1+(d : ℝ)^2*logDim d/t)/logDim d) := by
apply le_min (by norm_num)
apply div_nonneg _ hLp.le
apply Real.log_nonneg
have he := Real.one_lt_exp_iff.mpr (show (0 : ℝ) < 1 by norm_num)
have hz : 0 ≤ (d : ℝ)^2*logDim d/t := by positivity
linarith
nlinarith [sq_nonneg (1/logDim d)]
The logarithmic correction vanishes with dimension.
Proof (Lean source)
-- @node: consistency_correction_tendsto
lemma consistency_correction_tendsto :
Tendsto (fun d : ℕ => log (exp 1+logDim d)/logDim d)
atTop (nhds 0) := by
have hshift : Tendsto (fun d => logDim d + exp 1)
atTop atTop := by
apply Filter.tendsto_atTop.mpr
intro b
filter_upwards [logDim_tendsto_atTop.eventually_ge_atTop (b-exp 1)] with d hd
linarith
have hh := (Real.tendsto_pow_log_div_mul_add_atTop 1 (-exp 1) 1 (by norm_num)).comp
hshift
simpa [Function.comp_def, add_comm, add_left_comm, add_assoc] using hh
theorem rho_consistency_iff
Assume the stated h condition. The paper's exact consistency criterion holds for arbitrary, possibly oscillating resources.
Formal statement
Proof (Lean source)
-- @node: rho_consistency_iff
lemma rho_consistency_iff (ns ds : ℕ → ℕ) (es : ℕ → ℝ)
(h : ∀ k, Allowed (ns k) (ds k) (es k)) :
(Filter.Tendsto (fun k => rho (ns k*(es k)^2) (ds k)) atTop (nhds 0) ↔
Filter.Tendsto (fun k => (ns k : ℝ)*(es k)^2) atTop atTop ∧
Filter.Tendsto (fun k => log (1+(ds k : ℝ)^2/(ns k*(es k)^2))/logDim (ds k))
atTop (nhds 0)) := by
let t : ℕ → ℝ := fun k => ns k*(es k)^2
let g : ℕ → ℝ := fun k => log (1+(ds k : ℝ)^2/t k)/logDim (ds k)
have ht (k : ℕ) : 0 < t k := by
have hn : (0 : ℝ) < ns k := by exact_mod_cast (show 0 < ns k by have := (h k).1; omega)
exact mul_pos hn (sq_pos_of_pos (h k).2.2.1)
have hg (k : ℕ) : 0 ≤ g k := by
apply div_nonneg _ (logDim_pos _ (h k).2.1).le
apply Real.log_nonneg
have hx : 0 ≤ (ds k : ℝ)^2/t k := by positivity
linarith
have hr (k : ℕ) : 0 ≤ rho (t k) (ds k) :=
(le_min (by norm_num) (by positivity)).trans (rho_elementary_comparisons _ _ _ (h k)).1
change Filter.Tendsto (fun k => rho (t k) (ds k)) _ _ ↔
Filter.Tendsto t _ _ ∧ Filter.Tendsto g _ _
constructor
· intro hρ
constructor
· apply Filter.tendsto_atTop.mpr
intro b
have hB : 0 < max b 1 := lt_of_lt_of_le zero_lt_one (le_max_right _ _)
have hsmall := hρ.eventually_lt_const (show (0 : ℝ) < 1/max b 1 by positivity)
filter_upwards [hsmall] with k hk
by_contra hbt
have htB : t k ≤ max b 1 := (le_of_not_ge hbt).trans (le_max_left _ _)
have hinv : 1/max b 1 ≤ 1/t k :=
div_le_div_of_nonneg_left (by norm_num) (ht k) htB
have hcap : 1/max b 1 ≤ 1 := (div_le_one hB).mpr (le_max_right _ _)
have hlo := (rho_elementary_comparisons _ _ _ (h k)).1
change min 1 (1/t k) ≤ rho (t k) (ds k) at hlo
exact (not_lt_of_ge ((le_min hcap hinv).trans hlo)) hk
· apply tendsto_order.mpr
constructor
· intro a ha
exact Filter.Eventually.of_forall (fun k => ha.trans_le (hg k))
· intro b hb
filter_upwards [hρ.eventually_lt_const (sq_pos_of_pos hb),
hρ.eventually_lt_const (show (0 : ℝ) < 1 by norm_num)] with k hk hk1
have hsq := consistency_ratio_sq_le_rho (ds k) (t k) (h k).2.1 (ht k) hk1
change (g k)^2 ≤ rho (t k) (ds k) at hsq
nlinarith [hg k]
· rintro ⟨hT,hG⟩
apply tendsto_order.mpr
constructor
· intro a ha
exact Filter.Eventually.of_forall (fun k => ha.trans_le (hr k))
· intro b hb
let q : ℝ := sqrt b / 4
have hq : 0 < q := by dsimp [q]; positivity
have hq2 : q^2 = b/16 := by
dsimp [q]
rw [div_pow, Real.sq_sqrt hb.le]
norm_num
have hE := consistency_correction_tendsto.eventually_lt_const hq
have hInv : Filter.Tendsto (fun d : ℕ => 1/logDim d) atTop (nhds (0 : ℝ)) := by
simpa [one_div, Function.comp_def] using (tendsto_inv_atTop_zero.comp logDim_tendsto_atTop)
obtain ⟨D, hD⟩ := Filter.eventually_atTop.mp (hE.and (hInv.eventually_lt_const hq))
filter_upwards [hG.eventually_lt_const hq,
hT.eventually_ge_atTop (4*(D : ℝ)^2/b+1)] with k hgq htk
by_cases hd : D ≤ ds k
· obtain ⟨heq, hiq⟩ := hD (ds k) hd
have he0 : 0 ≤ log (exp 1+logDim (ds k))/logDim (ds k) := by
apply div_nonneg _ (logDim_pos _ (h k).2.1).le
apply Real.log_nonneg
have hL := (logDim_bounds _ (h k).2.1).1
have he := Real.exp_pos (1 : ℝ)
linarith
have hi0 : 0 ≤ 1/logDim (ds k) := by positivity [logDim_pos _ (h k).2.1]
have hupper := consistency_rho_upper (ds k) (t k) (h k).2.1 (ht k)
change rho (t k) (ds k) ≤
(g k + log (exp 1+logDim (ds k))/logDim (ds k))^2 +
(1/logDim (ds k))^2 at hupper
nlinarith [hg k, sq_nonneg (g k + log (exp 1+logDim (ds k))/logDim (ds k))]
· have hdR : (ds k : ℝ) ≤ D := by exact_mod_cast (le_of_not_ge hd)
have hu := (rho_elementary_comparisons _ _ _ (h k)).2.1
change rho (t k) (ds k) ≤ 4*min 1 ((ds k : ℝ)^2/t k) at hu
have hmin := min_le_right (1 : ℝ) ((ds k : ℝ)^2/t k)
have htarget : 4*((ds k : ℝ)^2/t k) < b := by
rw [← mul_div_assoc, div_lt_iff₀ (ht k)]
have hbmul := (div_le_iff₀ hb).mp (show 4*(D : ℝ)^2/b ≤ t k-1 by linarith)
nlinarith [sq_nonneg (D : ℝ), sq_nonneg (ds k : ℝ)]
exact lt_of_le_of_lt (hu.trans (mul_le_mul_of_nonneg_left hmin (by norm_num))) htarget
theorem rate_resource_conclusions
Pure numerical branch, consistency, parametric boundary and elbow assertions.
Formal statement
conclusion
Proof (Lean source)
-- @node: rate_resource_conclusions
lemma rate_resource_conclusions : RateResourceConclusions := by
refine ⟨rho_saturation_iff, ?_, ?_⟩
· intro ns ds es h
refine ⟨?_, rho_parametric_comparable_iff ns ds es h, ?_⟩
· exact rho_consistency_iff ns ds es h
· exact rho_parametric_iff_bounded_dimension ns ds es h
· exact rho_elbow_comparison
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.SeparatedMixtures 11 declarations Finite original-record private value frontiers: Helpers/SeparatedMixtures.
Helpers/SeparatedMixtures
Finite original-record private value frontiers: Helpers/SeparatedMixtures.
def analystRandomizerKernel
Fix the local protocol Q. Reattach an independent uniform analyst coin to a seed/transcript pair.
Definition (Lean source)
parameters
def
given by
((Kernel.id : Kernel (Q.Seed × ProtocolTranscript Q) (Q.Seed × ProtocolTranscript Q)) ×ₖ Kernel.const _ uniform01).map (fun w => (w.1.2,w.1.1,w.2))
theorem analystRandomizerKernel_markov
The reattachment channel is Markov, including for arbitrary public seeds.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: analystRandomizerKernel_markov
lemma analystRandomizerKernel_markov {n : ℕ} {α : Type} [MeasurableSpace α]
(Q : LocalProtocol n α) : IsMarkovKernel (analystRandomizerKernel Q) := by
haveI : IsProbabilityMeasure uniform01 := ⟨by
simp [uniform01, Measure.restrict_apply, Real.volume_Icc]⟩
unfold analystRandomizerKernel
exact Kernel.IsMarkovKernel.map _ (by fun_prop)
theorem analystRandomizerKernel_reconstruct
The reconstruction kernel is exactly the declared product with the analyst coin.
Formal statement
hypotheses
conclusion
(mu.map (fun w => (w.2.1,w.1))).bind (analystRandomizerKernel Q)
= (((mu.map (fun w => (w.1,w.2.1))).prod uniform01).map (fun w : (ProtocolTranscript Q × Q.Seed) × ℝ => (w.1.1,w.1.2,w.2)))
Proof (Lean source)
-- @node: analystRandomizerKernel_reconstruct
lemma analystRandomizerKernel_reconstruct {n : ℕ} {α : Type} [MeasurableSpace α]
(Q : LocalProtocol n α) (mu : Measure (DecisionSpace Q)) [IsProbabilityMeasure mu] :
(mu.map (fun w => (w.2.1,w.1))).bind (analystRandomizerKernel Q) =
(((mu.map (fun w => (w.1,w.2.1))).prod uniform01).map
(fun w : (ProtocolTranscript Q × Q.Seed) × ℝ => (w.1.1,w.1.2,w.2))) := by
haveI : IsProbabilityMeasure uniform01 := ⟨by
simp [uniform01, Measure.restrict_apply, Real.volume_Icc]⟩
ext E hE
rw [Measure.bind_apply hE (Kernel.measurable _).aemeasurable,
lintegral_map (show Measurable (fun x => analystRandomizerKernel Q x E) from
(analystRandomizerKernel Q).measurable_coe hE) (by fun_prop)]
have hpre : MeasurableSet
((fun w : (ProtocolTranscript Q × Q.Seed) × ℝ => (w.1.1,w.1.2,w.2)) ⁻¹' E) :=
(show Measurable (fun w : (ProtocolTranscript Q × Q.Seed) × ℝ =>
(w.1.1,w.1.2,w.2)) by fun_prop) hE
rw [Measure.map_apply (by fun_prop) hE, Measure.prod_apply hpre]
rw [lintegral_map (measurable_measure_prodMk_left hpre) (by fun_prop)]
apply lintegral_congr
intro w
rw [analystRandomizerKernel, Kernel.map_apply _ (by fun_prop),
Measure.map_apply (by fun_prop) hE,
Kernel.id_prod_apply' _ _
((show Measurable (fun w : (Q.Seed × ProtocolTranscript Q) × ℝ =>
(w.1.2,w.1.1,w.2)) by fun_prop) hE), Kernel.const_apply]
rfl
theorem supported_mixture_randomizer_reconstruct
Assume measurability of laws, the stated probability-measure property, the product-law representation, and the stated support condition. Supported rowwise coin independence also holds for a predictive mixture.
Formal statement
hypotheses
n :
ℕ
α Ω :
Q :
LocalProtocol n α
laws :
hLaws :
Measurable laws
hProbability :
∀ p ∈ M, IsProbabilityMeasure (laws p)
hProduct :
∀ p ∈ M,
laws p
= (((laws p).map (fun w => (w.1,w.2.1))).prod uniform01).map (fun w : (ProtocolTranscript Q × Q.Seed) × ℝ => (w.1.1,w.1.2,w.2))
pi :
hSupport :
pi Mᶜ = 0
conclusion
= pi.bind laws
Proof (Lean source)
-- @node: supported_mixture_randomizer_reconstruct
lemma supported_mixture_randomizer_reconstruct {n : ℕ} {α Ω : Type}
[MeasurableSpace α] [MeasurableSpace Ω]
(Q : LocalProtocol n α) (M : Set (Measure Ω))
(laws : Measure Ω → Measure (DecisionSpace Q)) (hLaws : Measurable laws)
(hProbability : ∀ p ∈ M, IsProbabilityMeasure (laws p))
(hProduct : ∀ p ∈ M, laws p =
(((laws p).map (fun w => (w.1,w.2.1))).prod uniform01).map
(fun w : (ProtocolTranscript Q × Q.Seed) × ℝ => (w.1.1,w.1.2,w.2)))
(pi : Measure (Measure Ω)) [IsProbabilityMeasure pi] (hSupport : pi Mᶜ = 0) :
((pi.bind laws).map (fun w => (w.2.1,w.1))).bind (analystRandomizerKernel Q) =
pi.bind laws := by
have hg : Measurable (fun w : DecisionSpace Q => (w.2.1,w.1)) := by fun_prop
have hH := (analystRandomizerKernel Q).measurable
ext E hE
rw [Measure.bind_apply hE hH.aemeasurable,
lintegral_map ((analystRandomizerKernel Q).measurable_coe hE) hg,
Measure.bind_apply hE hLaws.aemeasurable]
have hlin := Measure.lintegral_bind (m := pi) hLaws.aemeasurable
(((analystRandomizerKernel Q).measurable_coe hE).comp hg).aemeasurable
simp only [Function.comp_def] at hlin
rw [hlin]
apply lintegral_congr_ae
filter_upwards [ae_iff.mpr hSupport] with p hp
haveI := hProbability p hp
have hr := (analystRandomizerKernel_reconstruct Q (laws p)).trans (hProduct p hp).symm
have hh := congrArg (fun mu : Measure (DecisionSpace Q) => mu E) hr
rw [Measure.bind_apply hE hH.aemeasurable,
lintegral_map ((analystRandomizerKernel Q).measurable_coe hE) hg] at hh
exact hh
theorem supported_mixture_randomizer_tv
Assume measurability of laws, the stated probability-measure property, the product-law representation, the stated support condition, and the stated support condition. Appending independent analyst randomness cannot increase predictive total variation.
Formal statement
hypotheses
n :
ℕ
α Ω :
Q :
LocalProtocol n α
laws :
hLaws :
Measurable laws
hProbability :
∀ p ∈ M, IsProbabilityMeasure (laws p)
hProduct :
∀ p ∈ M,
laws p
= (((laws p).map (fun w => (w.1,w.2.1))).prod uniform01).map (fun w : (ProtocolTranscript Q × Q.Seed) × ℝ => (w.1.1,w.1.2,w.2))
pi0 pi1 :
hSupport0 :
pi0 Mᶜ = 0
hSupport1 :
pi1 Mᶜ = 0
Proof (Lean source)
-- @node: supported_mixture_randomizer_tv
lemma supported_mixture_randomizer_tv {n : ℕ} {α Ω : Type}
[MeasurableSpace α] [MeasurableSpace Ω]
(Q : LocalProtocol n α) (M : Set (Measure Ω))
(laws : Measure Ω → Measure (DecisionSpace Q)) (hLaws : Measurable laws)
(hProbability : ∀ p ∈ M, IsProbabilityMeasure (laws p))
(hProduct : ∀ p ∈ M, laws p =
(((laws p).map (fun w => (w.1,w.2.1))).prod uniform01).map
(fun w : (ProtocolTranscript Q × Q.Seed) × ℝ => (w.1.1,w.1.2,w.2)))
(pi0 pi1 : Measure (Measure Ω)) [IsProbabilityMeasure pi0] [IsProbabilityMeasure pi1]
(hSupport0 : pi0 Mᶜ = 0) (hSupport1 : pi1 Mᶜ = 0) :
tvDist (pi0.bind laws) (pi1.bind laws) ≤
tvDist
((pi0.bind laws).map (fun w => (w.2.1,w.1)))
((pi1.bind laws).map (fun w => (w.2.1,w.1))) := by
haveI : IsProbabilityMeasure (pi0.bind laws) := isProbabilityMeasure_bind
hLaws.aemeasurable ((ae_iff.mpr hSupport0).mono (fun p hp => hProbability p hp))
haveI : IsProbabilityMeasure (pi1.bind laws) := isProbabilityMeasure_bind
hLaws.aemeasurable ((ae_iff.mpr hSupport1).mono (fun p hp => hProbability p hp))
haveI : IsProbabilityMeasure ((pi0.bind laws).map (fun w => (w.2.1,w.1))) :=
Measure.isProbabilityMeasure_map (by fun_prop)
haveI : IsProbabilityMeasure ((pi1.bind laws).map (fun w => (w.2.1,w.1))) :=
Measure.isProbabilityMeasure_map (by fun_prop)
haveI := analystRandomizerKernel_markov Q
have ht := tvDist_bind_le
((pi0.bind laws).map (fun w => (w.2.1,w.1)))
((pi1.bind laws).map (fun w => (w.2.1,w.1))) (analystRandomizerKernel Q)
rw [supported_mixture_randomizer_reconstruct Q M laws hLaws hProbability hProduct pi0 hSupport0,
supported_mixture_randomizer_reconstruct Q M laws hLaws hProbability hProduct pi1 hSupport1] at ht
exact ht
Assume the stated hsupport condition. A supported prior averages no more risk than the supremum on its support.
Formal statement
hypotheses
conclusion
bayesSquaredRisk pi K target T
≤ ⨆ p : {p : Θ // p ∈ M}, squaredRisk K target T p.1
Proof (Lean source)
-- @node: supported_prior_risk_le
lemma supported_prior_risk_le {Θ X : Type*} [MeasurableSpace Θ] [MeasurableSpace X]
(pi : Measure Θ) [IsProbabilityMeasure pi] (M : Set Θ)
(hsupport : pi Mᶜ = 0) (K : Kernel Θ X) (target : Θ → ℝ) (T : X → ℝ) :
Causalean.Stat.Minimax.FuzzyHypotheses.bayesSquaredRisk pi K target T ≤
⨆ p : {p : Θ // p ∈ M},
squaredRisk K target T p.1 := by
apply lintegral_le_const
have hs : ∀ᵐ p ∂pi, p ∈ M := ae_iff.mpr hsupport
filter_upwards [hs] with p hp
exact le_iSup (fun p : {p : Θ // p ∈ M} =>
squaredRisk K target T p.1) ⟨p,hp⟩
theorem separated_prior_squared_risk
Assume the stated probability-measure property, the stated support condition, the stated support condition, measurability of target, measurability of laws, strict separation of the two target values, the stated concentration near the target value, the stated concentration near the target value, and the stated total-variation bound. The exact paper risk constant follows from classification at the midpoint. Rows outside the model are completed to probability rows without changing either prior.
Formal statement
hypotheses
n :
ℕ
α Ω :
Q :
LocalProtocol n α
target :
Measure Ω → ℝ
laws :
hLawProbability :
∀ p ∈ M, IsProbabilityMeasure (laws p)
pi0 pi1 :
hSupport0 :
pi0 Mᶜ = 0
hSupport1 :
pi1 Mᶜ = 0
hTarget :
Measurable target
hLaws :
Measurable laws
v0 v1 eta0 omega :
ℝ
hv :
v0 < v1
hEscape0 :
pi0.real {p | (v1-v0)/8 < |target p - v0|} ≤ eta0
hEscape1 :
pi1.real {p | (v1-v0)/8 < |target p - v1|} ≤ eta0
hTV :
tvDist (pi0.bind laws) (pi1.bind laws) ≤ omega
T :
Proof (Lean source)
-- @node: separated_prior_squared_risk
lemma separated_prior_squared_risk {n : ℕ} {α Ω : Type}
[MeasurableSpace α] [MeasurableSpace Ω]
(Q : LocalProtocol n α) (M : Set (Measure Ω)) (target : Measure Ω → ℝ)
(laws : Measure Ω → Measure (DecisionSpace Q))
(hLawProbability : ∀ p ∈ M, IsProbabilityMeasure (laws p))
(pi0 pi1 : Measure (Measure Ω)) [IsProbabilityMeasure pi0] [IsProbabilityMeasure pi1]
(hSupport0 : pi0 Mᶜ = 0) (hSupport1 : pi1 Mᶜ = 0)
(hTarget : Measurable target) (hLaws : Measurable laws)
(v0 v1 eta0 omega : ℝ) (hv : v0 < v1)
(hEscape0 : pi0.real {p | (v1-v0)/8 < |target p - v0|} ≤ eta0)
(hEscape1 : pi1.real {p | (v1-v0)/8 < |target p - v1|} ≤ eta0)
(hTV : tvDist (pi0.bind laws) (pi1.bind laws) ≤ omega)
(T : Estimator Q) :
ofReal (9*(v1-v0)^2/128 * max 0 (1-omega-2*eta0)) ≤
⨆ p : {p : Measure Ω // p ∈ M}, squaredRisk (laws p.1) T (target p.1) := by
classical
have hnonempty : M.Nonempty := by
by_contra h
have hM : M = ∅ := Set.not_nonempty_iff_eq_empty.mp h
simpa [hM] using hSupport0
obtain ⟨p0,hp0⟩ := hnonempty
let K : Kernel (Measure Ω) (DecisionSpace Q) :=
⟨fun p => if (laws p) univ = 1 then laws p else laws p0,
hLaws.ite (measurableSet_eq_fun
((Measure.measurable_coe MeasurableSet.univ).comp hLaws) measurable_const)
measurable_const⟩
have hK : ∀ p, IsProbabilityMeasure (K p) := by
intro p
change IsProbabilityMeasure (if (laws p) univ = 1 then laws p else laws p0)
split_ifs with h
· exact ⟨h⟩
· exact hLawProbability p0 hp0
have hKM : ∀ p ∈ M, K p = laws p := by
intro p hp
haveI := hLawProbability p hp
simp [K]
have hbind (pi : Measure (Measure Ω)) (hsupport : pi Mᶜ = 0) :
pi.bind K = pi.bind laws := by
apply Measure.bind_congr_right
filter_upwards [ae_iff.mpr hsupport] with p hp
exact hKM p hp
haveI : IsProbabilityMeasure (pi0.bind laws) :=
isProbabilityMeasure_bind hLaws.aemeasurable
((ae_iff.mpr hSupport0).mono (fun p hp => hLawProbability p hp))
haveI : IsProbabilityMeasure (pi1.bind laws) :=
isProbabilityMeasure_bind hLaws.aemeasurable
((ae_iff.mpr hSupport1).mono (fun p hp => hLawProbability p hp))
have heta : 0 ≤ eta0 := (measureReal_nonneg).trans hEscape0
have homega : 0 ≤ omega := (tvDist_nonneg).trans hTV
have htvK : tvDist
(priorPredictive pi0 K)
(priorPredictive pi1 K) ≤ omega := by
simpa only [priorPredictive,
hbind pi0 hSupport0, hbind pi1 hSupport1] using hTV
have hbayes := twoFuzzyHypotheses_bayesRisk_lower
pi0 pi1 K target hK T.1 T.2 hTarget v0 v1 (v1-v0) ((v1-v0)/8)
eta0 eta0 omega (by linarith) le_rfl
hEscape0 hEscape1 htvK
have hconst : (((v1-v0)/2 - (v1-v0)/8)^2 * (1-omega-eta0-eta0))/2 =
9*(v1-v0)^2/128 * (1-omega-2*eta0) := by ring
rw [hconst] at hbayes
have hupper : max
(bayesSquaredRisk pi0 K target T.1)
(bayesSquaredRisk pi1 K target T.1) ≤
⨆ p : {p : Measure Ω // p ∈ M}, squaredRisk (laws p.1) T (target p.1) := by
apply max_le
all_goals
refine (supported_prior_risk_le _ M ?_ K target T.1).trans ?_
first | exact hSupport0 | exact hSupport1
apply iSup_le
intro p
have heq : squaredRisk K target T.1 p.1 =
squaredRisk (laws p.1) T (target p.1) := by
simp only [squaredRisk, squaredRisk,
hKM p.1 p.2]
rw [heq]
exact le_iSup (fun p : {p : Measure Ω // p ∈ M} =>
squaredRisk (laws p.1) T (target p.1)) p
by_cases hpos : 0 ≤ 1-omega-2*eta0
· rw [max_eq_right hpos]
exact hbayes.trans hupper
· rw [max_eq_left (le_of_not_ge hpos), mul_zero, ENNReal.ofReal_zero]
exact zero_le
theorem supported_prior_neighborhood_mass
Assume measurability of laws, the stated probability-measure property, the stated support condition, measurability of target, the stated concentration near the target value, and uniform ninety-percent coverage. Integrating global coverage loses at most the prior's target escape probability.
Formal statement
hypotheses
n :
ℕ
α Ω :
Q :
LocalProtocol n α
target :
Measure Ω → ℝ
laws :
hLaws :
Measurable laws
hProbability :
∀ p ∈ M, IsProbabilityMeasure (laws p)
pi :
hSupport :
pi Mᶜ = 0
hTarget :
Measurable target
v r eta :
ℝ
hEscape :
pi.real {p | r < |target p - v|} ≤ eta
lower upper :
ℝ
I :
IntervalDecision Q lower upper
hCoverage :
∀ p ∈ M, (0.90 : ℝ) ≤ coverage (laws p) I (target p)
conclusion
(0.90 : ℝ) - eta ≤ (pi.bind laws).real {w | I.lo w ≤ v+r ∧ v-r ≤ I.hi w}
Proof (Lean source)
-- @node: supported_prior_neighborhood_mass
lemma supported_prior_neighborhood_mass {n : ℕ} {α Ω : Type}
[MeasurableSpace α] [MeasurableSpace Ω]
(Q : LocalProtocol n α) (M : Set (Measure Ω)) (target : Measure Ω → ℝ)
(laws : Measure Ω → Measure (DecisionSpace Q)) (hLaws : Measurable laws)
(hProbability : ∀ p ∈ M, IsProbabilityMeasure (laws p))
(pi : Measure (Measure Ω)) [IsProbabilityMeasure pi] (hSupport : pi Mᶜ = 0)
(hTarget : Measurable target) (v r eta : ℝ)
(hEscape : pi.real {p | r < |target p - v|} ≤ eta)
{lower upper : ℝ} (I : IntervalDecision Q lower upper)
(hCoverage : ∀ p ∈ M, (0.90 : ℝ) ≤ coverage (laws p) I (target p)) :
(0.90 : ℝ) - eta ≤ (pi.bind laws).real
{w | I.lo w ≤ v+r ∧ v-r ≤ I.hi w} := by
let A : Set (DecisionSpace Q) := {w | I.lo w ≤ v+r ∧ v-r ≤ I.hi w}
let B : Set (Measure Ω) := {p | r < |target p-v|}
have hA : MeasurableSet A :=
(measurableSet_le I.measurable_lo measurable_const).inter
(measurableSet_le measurable_const I.measurable_hi)
have hB : MeasurableSet B := measurableSet_lt measurable_const
(continuous_abs.measurable.comp (hTarget.sub measurable_const))
have hs : ∀ᵐ p ∂pi, p ∈ M := ae_iff.mpr hSupport
have hrow : Integrable (fun p => (laws p).real A) pi := by
apply Integrable.of_bound
(((Measure.measurable_coe hA).comp hLaws).ennreal_toReal.aestronglyMeasurable) 1
filter_upwards [hs] with p hp
haveI := hProbability p hp
change ‖(laws p).real A‖ ≤ 1
rw [Real.norm_eq_abs, abs_of_nonneg measureReal_nonneg]
exact (measureReal_mono (Set.subset_univ A)).trans (by simp)
have hind : Integrable (B.indicator (fun _ => (1 : ℝ))) pi :=
(integrable_const _).indicator hB
have hpoint : ∀ᵐ p ∂pi,
(0.90 : ℝ) ≤ (laws p).real A + B.indicator (fun _ => (1 : ℝ)) p := by
filter_upwards [hs] with p hp
haveI := hProbability p hp
by_cases hb : p ∈ B
· rw [Set.indicator_of_mem hb]
linarith [measureReal_nonneg (μ := laws p) (s := A)]
· rw [Set.indicator_of_notMem hb, add_zero]
have hgood : |target p-v| ≤ r := le_of_not_gt hb
refine (hCoverage p hp).trans (measureReal_mono ?_)
intro w hw
rcases hw with ⟨hwlo,hwhi⟩
exact ⟨by linarith [(abs_le.mp hgood).2], by linarith [(abs_le.mp hgood).1]⟩
have hint := integral_mono_ae (integrable_const (0.90 : ℝ)) (hrow.add hind) hpoint
simp only [Pi.add_apply] at hint
rw [integral_add hrow hind] at hint
have hindval : (∫ p, B.indicator (fun _ => (1 : ℝ)) p ∂pi) = pi.real B := by
simpa only [Pi.one_def] using integral_indicator_one (μ := pi) hB
rw [hindval] at hint
simp only [integral_const, probReal_univ, one_smul] at hint
have hreal : (pi.bind laws).real A = ∫ p, (laws p).real A ∂pi := by
rw [Measure.real, Measure.bind_apply hA hLaws.aemeasurable]
symm
apply integral_toReal ((Measure.measurable_coe hA).comp hLaws).aemeasurable
filter_upwards [hs] with p hp
haveI := hProbability p hp
exact measure_lt_top _ _
change (0.90 : ℝ) - eta ≤ (pi.bind laws).real A
rw [hreal]
change pi.real B ≤ eta at hEscape
linarith
theorem separated_prior_interval_length
Assume the stated probability-measure property, the stated support condition, the stated support condition, measurability of target, measurability of laws, strict separation of the two target values, the stated concentration near the target value, the stated concentration near the target value, the stated total-variation bound, and uniform ninety-percent coverage. Two concentrated target neighborhoods force the paper's connected-interval length bound.
Formal statement
hypotheses
n :
ℕ
α Ω :
Q :
LocalProtocol n α
target :
Measure Ω → ℝ
laws :
hProbability :
∀ p ∈ M, IsProbabilityMeasure (laws p)
pi0 pi1 :
hSupport0 :
pi0 Mᶜ = 0
hSupport1 :
pi1 Mᶜ = 0
hTarget :
Measurable target
hLaws :
Measurable laws
v0 v1 eta0 omega :
ℝ
hv :
v0 < v1
hEscape0 :
pi0.real {p | (v1-v0)/8 < |target p - v0|} ≤ eta0
hEscape1 :
pi1.real {p | (v1-v0)/8 < |target p - v1|} ≤ eta0
hTV :
tvDist (pi0.bind laws) (pi1.bind laws) ≤ omega
lower upper :
ℝ
I :
IntervalDecision Q lower upper
hCoverage :
∀ p ∈ M, (0.90 : ℝ) ≤ coverage (laws p) I (target p)
conclusion
≤ ⨆ p : {p : Measure Ω // p ∈ M}, expectedLength (laws p.1) I
Proof (Lean source)
-- @node: separated_prior_interval_length
lemma separated_prior_interval_length {n : ℕ} {α Ω : Type}
[MeasurableSpace α] [MeasurableSpace Ω]
(Q : LocalProtocol n α) (M : Set (Measure Ω)) (target : Measure Ω → ℝ)
(laws : Measure Ω → Measure (DecisionSpace Q))
(hProbability : ∀ p ∈ M, IsProbabilityMeasure (laws p))
(pi0 pi1 : Measure (Measure Ω)) [IsProbabilityMeasure pi0] [IsProbabilityMeasure pi1]
(hSupport0 : pi0 Mᶜ = 0) (hSupport1 : pi1 Mᶜ = 0)
(hTarget : Measurable target) (hLaws : Measurable laws)
(v0 v1 eta0 omega : ℝ) (hv : v0 < v1)
(hEscape0 : pi0.real {p | (v1-v0)/8 < |target p - v0|} ≤ eta0)
(hEscape1 : pi1.real {p | (v1-v0)/8 < |target p - v1|} ≤ eta0)
(hTV : tvDist (pi0.bind laws) (pi1.bind laws) ≤ omega)
{lower upper : ℝ} (I : IntervalDecision Q lower upper)
(hCoverage : ∀ p ∈ M, (0.90 : ℝ) ≤ coverage (laws p) I (target p)) :
ofReal (3*(v1-v0)/4 * max 0 ((0.80 : ℝ)-2*eta0-omega)) ≤
⨆ p : {p : Measure Ω // p ∈ M}, expectedLength (laws p.1) I := by
haveI : IsProbabilityMeasure (pi0.bind laws) := isProbabilityMeasure_bind
hLaws.aemeasurable ((ae_iff.mpr hSupport0).mono (fun p hp => hProbability p hp))
haveI : IsProbabilityMeasure (pi1.bind laws) := isProbabilityMeasure_bind
hLaws.aemeasurable ((ae_iff.mpr hSupport1).mono (fun p hp => hProbability p hp))
let A := fun v : ℝ => {w : DecisionSpace Q |
I.lo w ≤ v+(v1-v0)/8 ∧ v-(v1-v0)/8 ≤ I.hi w}
have hA (v : ℝ) : MeasurableSet (A v) :=
(measurableSet_le I.measurable_lo measurable_const).inter
(measurableSet_le measurable_const I.measurable_hi)
have hm0 := supported_prior_neighborhood_mass Q M target laws hLaws hProbability
pi0 hSupport0 hTarget v0 ((v1-v0)/8) eta0 hEscape0 I hCoverage
have hm1 := supported_prior_neighborhood_mass Q M target laws hLaws hProbability
pi1 hSupport1 hTarget v1 ((v1-v0)/8) eta0 hEscape1 I hCoverage
change (0.90 : ℝ)-eta0 ≤ (pi0.bind laws).real (A v0) at hm0
change (0.90 : ℝ)-eta0 ≤ (pi1.bind laws).real (A v1) at hm1
have htransfer := (abs_le.mp
((abs_measureReal_sub_le_tvDist (μ := pi0.bind laws)
(ν := pi1.bind laws) (hA v1)).trans hTV)).1
have hinter : (0.80 : ℝ)-2*eta0-omega ≤
(pi0.bind laws).real (A v0 ∩ A v1) := by
have hsplit := measureReal_inter_add_sdiff (μ := pi0.bind laws) (s := A v0) (hA v1)
have hdiff := measureReal_mono (μ := pi0.bind laws)
(show A v0 \ A v1 ⊆ (A v1)ᶜ from fun _ h => h.2)
rw [probReal_compl_eq_one_sub (hA v1)] at hdiff
linarith
have hc : 0 ≤ 3*(v1-v0)/4 := by linarith
have hmass : max 0 ((0.80 : ℝ)-2*eta0-omega) ≤
(pi0.bind laws).real (A v0 ∩ A v1) := max_le measureReal_nonneg hinter
have hlength : ofReal (3*(v1-v0)/4) *
(pi0.bind laws) (A v0 ∩ A v1) ≤ expectedLength (pi0.bind laws) I := by
rw [← lintegral_indicator_const (hA v0 |>.inter (hA v1))]
apply lintegral_mono
intro w
by_cases hw : w ∈ A v0 ∩ A v1
· rw [Set.indicator_of_mem hw]
apply ENNReal.ofReal_le_ofReal
apply le_trans _ (le_max_right _ _)
change 3*(v1-v0)/4 ≤ I.hi w - I.lo w
rcases hw with ⟨h0,h1⟩
dsimp [A] at h0 h1
linarith [h0.1,h1.2]
· rw [Set.indicator_of_notMem hw]
exact zero_le
have hbayes : expectedLength (pi0.bind laws) I ≤
⨆ p : {p : Measure Ω // p ∈ M}, expectedLength (laws p.1) I := by
unfold expectedLength
have hmeas : Measurable (fun w =>
ofReal (intervalLength (I.lo w) (I.hi w))) :=
(measurable_intervalLength I.measurable_lo I.measurable_hi).ennreal_ofReal
rw [Measure.lintegral_bind hLaws.aemeasurable hmeas.aemeasurable]
apply lintegral_le_const
filter_upwards [ae_iff.mpr hSupport0] with p hp
exact le_iSup (fun p : {p : Measure Ω // p ∈ M} =>
∫⁻ w, ofReal (intervalLength (I.lo w) (I.hi w)) ∂laws p.1) ⟨p,hp⟩
refine (ENNReal.ofReal_le_ofReal (mul_le_mul_of_nonneg_left hmass hc)).trans ?_
rw [ENNReal.ofReal_mul hc, Measure.real, ENNReal.ofReal_toReal (measure_ne_top _ _)]
exact hlength.trans hbayes
theorem separated_value_mixtures_generic
Assume the product-law representation, the stated probability-measure property, the stated support condition, the stated support condition, measurability of target, measurability of laws, strict separation of the two target values, the stated concentration near the target value, the stated concentration near the target value, and the stated total-variation bound. Generic concentrated-prior squared-risk and connected honest-length lower bounds.
Formal statement
hypotheses
n :
ℕ
α :
Type
Ω :
Type
Q :
LocalProtocol n α
target :
Measure Ω → ℝ
laws :
hProduct :
∀ p ∈ M,
laws p
= (((laws p).map (fun w => (w.1,w.2.1))).prod uniform01).map (fun w : (ProtocolTranscript Q × Q.Seed) × ℝ => (w.1.1,w.1.2,w.2))
hLawProbability :
∀ p ∈ M, IsProbabilityMeasure (laws p)
pi0 pi1 :
hSupport0 :
pi0 Mᶜ = 0
hSupport1 :
pi1 Mᶜ = 0
hTarget :
Measurable target
hLaws :
Measurable laws
v0 v1 eta0 omega :
ℝ
hv :
v0 < v1
hEscape0 :
pi0.real {p | (v1-v0)/8 < |target p - v0|} ≤ eta0
hEscape1 :
pi1.real {p | (v1-v0)/8 < |target p - v1|} ≤ eta0
hTV :
lower upper :
ℝ
conclusion
conclusion 1
T :
conclusion 2
I :
IntervalDecision Q lower upper
(∀ p ∈ M, (0.90 : ℝ) ≤ coverage (laws p) I (target p))
≤ ⨆ p : {p : Measure Ω // p ∈ M}, expectedLength (laws p.1) I
Proof (Lean source)
-- @node: separated_value_mixtures_generic
lemma separated_value_mixtures_generic
(Q : LocalProtocol n α) (M : Set (Measure Ω)) (target : Measure Ω → ℝ)
(laws : Measure Ω → Measure (DecisionSpace Q))
(hProduct : ∀ p ∈ M, laws p =
(((laws p).map (fun w => (w.1,w.2.1))).prod uniform01).map
(fun w : (ProtocolTranscript Q × Q.Seed) × ℝ => (w.1.1,w.1.2,w.2)))
(hLawProbability : ∀ p ∈ M, IsProbabilityMeasure (laws p))
(pi0 pi1 : Measure (Measure Ω)) [IsProbabilityMeasure pi0] [IsProbabilityMeasure pi1]
(hSupport0 : pi0 Mᶜ = 0) (hSupport1 : pi1 Mᶜ = 0)
(hTarget : Measurable target) (hLaws : Measurable laws)
(v0 v1 eta0 omega : ℝ) (hv : v0 < v1)
(hEscape0 : pi0.real {p | (v1-v0)/8 < |target p - v0|} ≤ eta0)
(hEscape1 : pi1.real {p | (v1-v0)/8 < |target p - v1|} ≤ eta0)
(hTV : tvDist
((pi0.bind laws).map (fun w => (w.2.1,w.1)))
((pi1.bind laws).map (fun w => (w.2.1,w.1))) ≤ omega)
(lower upper : ℝ) :
(∀ T : Estimator Q,
ofReal (9*(v1-v0)^2/128 * max 0 (1-omega-2*eta0)) ≤
⨆ p : {p : Measure Ω // p ∈ M}, squaredRisk (laws p.1) T (target p.1)) ∧
(∀ I : IntervalDecision Q lower upper,
(∀ p ∈ M, (0.90 : ℝ) ≤ coverage (laws p) I (target p)) →
ofReal (3*(v1-v0)/4 * max 0 ((0.80 : ℝ)-2*eta0-omega)) ≤
⨆ p : {p : Measure Ω // p ∈ M}, expectedLength (laws p.1) I) := by
have hFullTV : tvDist (pi0.bind laws) (pi1.bind laws) ≤ omega :=
(supported_mixture_randomizer_tv Q M laws hLaws hLawProbability hProduct
pi0 pi1 hSupport0 hSupport1).trans hTV
constructor
· intro T
exact separated_prior_squared_risk Q M target laws hLawProbability pi0 pi1
hSupport0 hSupport1 hTarget hLaws v0 v1 eta0 omega hv hEscape0 hEscape1 hFullTV T
· intro I hCoverage
exact separated_prior_interval_length Q M target laws hLawProbability pi0 pi1
hSupport0 hSupport1 hTarget hLaws v0 v1 eta0 omega hv hEscape0 hEscape1
hFullTV I hCoverage
theorem separated_value_mixtures
Under iid sampling and independent randomization, two priors with causal support, probability decision mixtures, separated target centers, small escape probabilities, and nearby transcript mixtures, the causal experiment obeys squared-risk and connected honest-length lower bounds.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
S :
SamplingScheme n d
hIID :
hRandom :
Q :
LocalProtocol n (ObsRecord d)
pi0 pi1 :
hSupport0 :
pi0 (causalClass d)ᶜ = 0
hSupport1 :
pi1 (causalClass d)ᶜ = 0
hMixture0 :
IsProbabilityMeasure (pi0.bind (decisionLaw S Q))
hMixture1 :
IsProbabilityMeasure (pi1.bind (decisionLaw S Q))
v0 v1 eta0 omega :
ℝ
hv :
v0 < v1
hEscape0 :
pi0.real {P | (v1-v0)/8 < |value P - v0|} ≤ eta0
hEscape1 :
pi1.real {P | (v1-v0)/8 < |value P - v1|} ≤ eta0
hTV :
tvDist ((pi0.bind (decisionLaw S Q)).map (fun w => (w.2.1,w.1))) ((pi1.bind (decisionLaw S Q)).map (fun w => (w.2.1,w.1)))
≤ omega
conclusion
conclusion 1
T :
≤ ⨆ P : {P : Measure (FullRecord d) // P ∈ causalClass d}, squaredRisk (decisionLaw S Q P.1) T (value P.1)
Proof (Lean source)
lemma separated_value_mixtures {d : ℕ}
(S : SamplingScheme n d) (hIID : IidPeople S) (hRandom : IndependentRandomness S)
(Q : LocalProtocol n (ObsRecord d))
(pi0 pi1 : Measure (Measure (FullRecord d)))
[IsProbabilityMeasure pi0] [IsProbabilityMeasure pi1]
(hSupport0 : pi0 (causalClass d)ᶜ = 0) (hSupport1 : pi1 (causalClass d)ᶜ = 0)
(hMixture0 : IsProbabilityMeasure (pi0.bind (decisionLaw S Q)))
(hMixture1 : IsProbabilityMeasure (pi1.bind (decisionLaw S Q)))
(v0 v1 eta0 omega : ℝ) (hv : v0 < v1)
(hEscape0 : pi0.real {P | (v1-v0)/8 < |value P - v0|} ≤ eta0)
(hEscape1 : pi1.real {P | (v1-v0)/8 < |value P - v1|} ≤ eta0)
(hTV : tvDist
((pi0.bind (decisionLaw S Q)).map (fun w => (w.2.1,w.1)))
((pi1.bind (decisionLaw S Q)).map (fun w => (w.2.1,w.1))) ≤ omega) :
(∀ T : Estimator Q,
ofReal (9*(v1-v0)^2/128 * max 0 (1-omega-2*eta0)) ≤
⨆ P : {P : Measure (FullRecord d) // P ∈ causalClass d},
squaredRisk (decisionLaw S Q P.1) T (value P.1)) ∧
(∀ I : IntervalDecision Q (1/4) (3/4),
(∀ P ∈ causalClass d, (0.90 : ℝ) ≤ coverage (decisionLaw S Q P) I (value P)) →
ofReal (3*(v1-v0)/4 * max 0 ((0.80 : ℝ)-2*eta0-omega)) ≤
⨆ P : {P : Measure (FullRecord d) // P ∈ causalClass d},
expectedLength (decisionLaw S Q P.1) I) := by
-- Use a measurable completion of the canonical iid law on the supported causal model.
obtain ⟨laws, hLaws, hCanonical⟩ :
∃ laws : Measure (FullRecord d) → Measure (DecisionSpace Q),
Measurable laws ∧ ∀ P ∈ causalClass d,
laws P = decisionLaw (canonicalScheme n d) Q P := by
refine ⟨completedDecisionLaw Q, measurable_completedDecisionLaw Q, ?_⟩
intro P hP
haveI := hP.1
exact completedDecisionLaw_eq_canonical Q P
have hEq (P : Measure (FullRecord d)) (hP : P ∈ causalClass d) :
laws P = decisionLaw S Q P := by
haveI := hP.1
rw [hCanonical P hP]
unfold decisionLaw
rw [iid_sampling_inputLaw S hIID hRandom Q P hP.2]
rfl
have hPriorEq (pi : Measure (Measure (FullRecord d)))
(hSupport : pi (causalClass d)ᶜ = 0) :
pi.bind laws = pi.bind (decisionLaw S Q) := by
apply Measure.bind_congr_right
filter_upwards [ae_iff.mpr hSupport] with P hP
exact hEq P hP
have hProbability (P : Measure (FullRecord d)) (hP : P ∈ causalClass d) :
IsProbabilityMeasure (decisionLaw S Q P) := by
haveI := hP.1
exact sampling_decisionLaw_probability S hIID hRandom Q P hP.2
have hProduct (P : Measure (FullRecord d)) (hP : P ∈ causalClass d) :
decisionLaw S Q P =
(((decisionLaw S Q P).map (fun w => (w.1,w.2.1))).prod uniform01).map
(fun w : (ProtocolTranscript Q × Q.Seed) × ℝ => (w.1.1,w.1.2,w.2)) := by
haveI := hP.1
exact sampling_decisionLaw_randomizer S hIID hRandom Q P hP.2
have hLawsProbability (P : Measure (FullRecord d)) (hP : P ∈ causalClass d) :
IsProbabilityMeasure (laws P) := by
rw [hEq P hP]
exact hProbability P hP
have hLawsProduct (P : Measure (FullRecord d)) (hP : P ∈ causalClass d) :
laws P = (((laws P).map (fun w => (w.1,w.2.1))).prod uniform01).map
(fun w : (ProtocolTranscript Q × Q.Seed) × ℝ => (w.1.1,w.1.2,w.2)) := by
rw [hEq P hP]
exact hProduct P hP
have hLawsTV : tvDist
((pi0.bind laws).map (fun w => (w.2.1,w.1)))
((pi1.bind laws).map (fun w => (w.2.1,w.1))) ≤ omega := by
rw [hPriorEq pi0 hSupport0, hPriorEq pi1 hSupport1]
exact hTV
have hReduction := separated_value_mixtures_generic Q (causalClass d) value laws
hLawsProduct hLawsProbability pi0 pi1 hSupport0 hSupport1 measurable_causal_value hLaws
v0 v1 eta0 omega hv hEscape0 hEscape1 hLawsTV (1/4) (3/4)
constructor
· intro T
have hRisk : (⨆ P : {P : Measure (FullRecord d) // P ∈ causalClass d},
squaredRisk (laws P.1) T (value P.1)) =
⨆ P : {P : Measure (FullRecord d) // P ∈ causalClass d},
squaredRisk (decisionLaw S Q P.1) T (value P.1) := by
apply iSup_congr
intro P
rw [hEq P.1 P.2]
rw [← hRisk]
exact hReduction.1 T
· intro I hCoverage
have hLawsCoverage (P : Measure (FullRecord d)) (hP : P ∈ causalClass d) :
(0.90 : ℝ) ≤ coverage (laws P) I (value P) := by
rw [hEq P hP]
exact hCoverage P hP
have hLength : (⨆ P : {P : Measure (FullRecord d) // P ∈ causalClass d},
expectedLength (laws P.1) I) =
⨆ P : {P : Measure (FullRecord d) // P ∈ causalClass d},
expectedLength (decisionLaw S Q P.1) I := by
apply iSup_congr
intro P
rw [hEq P.1 P.2]
rw [← hLength]
exact hReduction.2 I hLawsCoverage
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.SymmetricLaw 11 declarations Finite Bernoulli sums establish normalization and the ancillary assignment law.
Symmetric causal law certificates
Finite Bernoulli sums establish normalization and the ancillary assignment law.
theorem symmetric_weight_nonneg
Assume the stated htheta condition. Every weight in the symmetric construction is nonnegative on the parameter cube. [](.
Formal statement
hypotheses
Proof (Lean source)
-- @node: symmetric_weight_nonneg
lemma symmetric_weight_nonneg (theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d)
(w : FullRecord d) :
0 ≤ (d : ℝ)⁻¹ * (1/2) *
bernMass ((1 - theta (cell w))/2) (outcome0 w) *
bernMass ((1 + theta (cell w))/2) (outcome1 w) *
(if outcome w = potential (arm w) w then 1 else 0) := by
have h := htheta (cell w)
have h0 : 0 ≤ bernMass ((1 - theta (cell w))/2) (outcome0 w) := by
cases outcome0 w <;> simp only [bernMass, Bool.false_eq_true, ↓reduceIte] <;> linarith [h.1, h.2]
have h1 : 0 ≤ bernMass ((1 + theta (cell w))/2) (outcome1 w) := by
cases outcome1 w <;> simp only [bernMass, Bool.false_eq_true, ↓reduceIte] <;> linarith [h.1, h.2]
positivity
Assume the stated hw condition. Real probabilities of finite atomic events are sums of the nonnegative weights.
Formal statement
hypotheses
Proof (Lean source)
-- @node: atomLaw_real_event
lemma atomLaw_real_event {α : Type} [Fintype α] [MeasurableSpace α]
[MeasurableSingletonClass α] (weights : α → ℝ) (hw : ∀ a, 0 ≤ weights a)
(E : Set α) : (atomLaw weights).real E = ∑ a, if a ∈ E then weights a else 0 := by
classical
simp only [Measure.real, atomLaw, Measure.finsetSum_apply, Measure.smul_apply,
smul_eq_mul, Measure.dirac_apply]
rw [ENNReal.toReal_sum (by intro a ha; by_cases h : a ∈ E <;> simp [h])]
apply Finset.sum_congr rfl
intro a _
by_cases h : a ∈ E <;> simp [h, ENNReal.toReal_ofReal (hw a)]
theorem symmetricLaw_real_event
Assume the stated htheta condition. Event probabilities in the symmetric construction have their explicit Bernoulli expansion. [](.
Formal statement
hypotheses
conclusion
(symmetricLaw theta).real E
Proof (Lean source)
-- @node: symmetricLaw_real_event
lemma symmetricLaw_real_event (theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d)
(E : Set (FullRecord d)) :
(symmetricLaw theta).real E = ∑ w : FullRecord d,
if w ∈ E then (d : ℝ)⁻¹ * (1/2) *
bernMass ((1 - theta (cell w))/2) (outcome0 w) *
bernMass ((1 + theta (cell w))/2) (outcome1 w) *
(if outcome w = potential (arm w) w then 1 else 0) else 0 := by
exact atomLaw_real_event _ (symmetric_weight_nonneg theta htheta) E
theorem symmetricLaw_probability
Assume the stated htheta condition and positive dimension. Summing the Bernoulli potentials and consistent outcome gives unit total mass.
Formal statement
hypotheses
conclusion
IsProbabilityMeasure (symmetricLaw theta)
Proof (Lean source)
-- @node: symmetricLaw_probability
lemma symmetricLaw_probability (theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d)
(hd : 0 < d) : IsProbabilityMeasure (symmetricLaw theta) := by
have hdR : (d : ℝ) ≠ 0 := by exact_mod_cast (Nat.ne_of_gt hd)
have hmass : (symmetricLaw theta).real univ = 1 := by
rw [symmetricLaw_real_event theta htheta]
simp only [Set.mem_univ, ↓reduceIte]
rw [Fintype.sum_prod_type]
have hcell : ∀ j : Fin d, (∑ w : Bool × Bool × Bool × Bool,
(d : ℝ)⁻¹ * (1/2) *
bernMass ((1 - theta (cell (j,w)))/2) (outcome0 (j,w)) *
bernMass ((1 + theta (cell (j,w)))/2) (outcome1 (j,w)) *
(if outcome (j,w) = potential (arm (j,w)) (j,w) then 1 else 0)) = (d : ℝ)⁻¹ := by
intro j
simp [Fintype.sum_prod_type, Fintype.sum_bool, cell, outcome0, outcome1, outcome,
potential, arm, bernMass]
<;> ring
simp_rw [hcell]
simp [hdR]
constructor
exact (ENNReal.toReal_eq_one_iff _).mp hmass
theorem symmetricLaw_ancillary
Assume the stated htheta condition. A fair assignment is ancillary to the signed input under the symmetric law. [](.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: symmetricLaw_ancillary
lemma symmetricLaw_ancillary (theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d)
(j : Fin d) (s a : Bool) :
(symmetricLaw theta).real
{w | cell w = j ∧ signedObserve (observe w) = (j,s) ∧ arm w = a} =
(pairedLaw theta).real {(j,s)}/2 := by
rw [symmetricLaw_real_event theta htheta]
have hpaired : (pairedLaw theta).real {(j,s)} = (1 + signVal s * theta j)/(2*d) := by
unfold pairedLaw
rw [atomLaw_real_event]
· simp
· intro v
have h := htheta v.1
apply div_nonneg _ (by positivity)
cases v.2 <;> simp only [signVal, Bool.false_eq_true, ↓reduceIte] <;> linarith [h.1, h.2]
rw [hpaired, Fintype.sum_prod_type]
simp only [Set.mem_setOf_eq, cell, observe, arm, outcome, signedObserve, Prod.mk.injEq]
cases s <;> cases a <;>
simp [Fintype.sum_prod_type, Fintype.sum_bool, outcome0, outcome1, potential,
outcome, arm, cell, bernMass, signVal]
<;> ring
theorem symmetricLaw_uniform
Assume the stated htheta condition. Each public cell has mass one over the dimension. [](.
Formal statement
hypotheses
conclusion
UniformCovariates (symmetricLaw theta)
Proof (Lean source)
-- @node: symmetricLaw_uniform
lemma symmetricLaw_uniform (theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d) :
UniformCovariates (symmetricLaw theta) := by
intro j
rw [symmetricLaw_real_event theta htheta]
simp [Fintype.sum_prod_type, Fintype.sum_bool, cell, outcome0, outcome1, outcome,
potential, arm, bernMass]
<;> ring
theorem symmetricLaw_potential_mass
Assume the stated htheta condition. The cellwise potential marginals are the two declared Bernoulli arm means. [](.
Formal statement
hypotheses
conclusion
= (d : ℝ)⁻¹ * ((1 + signVal a * theta j)/2)
Proof (Lean source)
-- @node: symmetricLaw_potential_mass
lemma symmetricLaw_potential_mass (theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d)
(j : Fin d) (a : Bool) :
(symmetricLaw theta).real {w | cell w = j ∧ potential a w = true} =
(d : ℝ)⁻¹ * ((1 + signVal a * theta j)/2) := by
rw [symmetricLaw_real_event theta htheta]
cases a <;>
simp [Fintype.sum_prod_type, Fintype.sum_bool, cell, outcome0, outcome1, outcome,
potential, arm, bernMass, signVal]
<;> ring
theorem symmetricLaw_fair
Assume the stated htheta condition. Independent fair assignment remains fair conditional on both potential outcomes. [](.
Formal statement
hypotheses
conclusion
FairRandomization (symmetricLaw theta)
Proof (Lean source)
-- @node: symmetricLaw_fair
lemma symmetricLaw_fair (theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d) :
FairRandomization (symmetricLaw theta) := by
intro j a y0 y1
rw [symmetricLaw_real_event theta htheta, symmetricLaw_real_event theta htheta]
cases a <;> cases y0 <;> cases y1 <;>
simp [Fintype.sum_prod_type, Fintype.sum_bool, cell, outcome0, outcome1, outcome,
potential, arm, bernMass]
<;> ring
theorem symmetricLaw_consistent
Assume the stated htheta condition and positive dimension. All symmetric-law mass is supported on consistent records.
Formal statement
hypotheses
conclusion
Consistency (symmetricLaw theta)
Proof (Lean source)
-- @node: symmetricLaw_consistent
lemma symmetricLaw_consistent (theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d)
(hd : 0 < d) : Consistency (symmetricLaw theta) := by
haveI := symmetricLaw_probability theta htheta hd
have heq : (symmetricLaw theta).real {w | outcome w = potential (arm w) w} =
(symmetricLaw theta).real univ := by
rw [symmetricLaw_real_event theta htheta, symmetricLaw_real_event theta htheta]
apply Finset.sum_congr rfl
intro w _
by_cases h : outcome w = potential (arm w) w <;> simp [h]
exact heq.trans (by simp)
theorem symmetricLaw_armMean
Assume the stated htheta condition and positive dimension. The symmetric construction has the specified arm means in every nonempty cell.
Formal statement
hypotheses
conclusion
armMean (symmetricLaw theta) a j = (1 + signVal a * theta j)/2
Proof (Lean source)
-- @node: symmetricLaw_armMean
lemma symmetricLaw_armMean (theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d)
(hd : 0 < d) (a : Bool) (j : Fin d) :
armMean (symmetricLaw theta) a j = (1 + signVal a * theta j)/2 := by
unfold armMean
rw [symmetricLaw_potential_mass theta htheta, symmetricLaw_uniform theta htheta j]
have hdR : (d : ℝ) ≠ 0 := by exact_mod_cast (Nat.ne_of_gt hd)
field_simp
theorem symmetricLaw_causalModel
Assume the stated htheta condition and positive dimension. Cube parameters give the interior means required by the causal model.
Formal statement
hypotheses
conclusion
CausalModel (symmetricLaw theta)
Proof (Lean source)
-- @node: symmetricLaw_causalModel
lemma symmetricLaw_causalModel (theta : Fin d → ℝ) (htheta : theta ∈ parameterCube d)
(hd : 0 < d) : CausalModel (symmetricLaw theta) := by
refine ⟨symmetricLaw_uniform theta htheta, symmetricLaw_fair theta htheta,
symmetricLaw_consistent theta htheta hd, ?_⟩
intro a j
rw [symmetricLaw_armMean theta htheta hd]
have h := htheta j
cases a <;> simp only [signVal, Bool.false_eq_true, ↓reduceIte, Set.mem_Icc] <;>
constructor <;> linarith [h.1, h.2]
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.TVCalibration 11 declarations The paired releases omit the baseline block.
Calibration of the paired transcript norm
The paired releases omit the baseline block. Shifting them into the common norm computation preserves the evaluation block law and its absolute-mean calibration.
theorem tvToNormTranscript_block_law
Assume the causal-model conditions for the data law, positive dimension, and the stated hend condition. Either shifted norm block selects the corresponding active paired participants.
Formal statement
hypotheses
n d :
ℕ
eps :
ℝ
P :
hP :
hd :
0 < d
offset :
ℕ
hend :
offset + n / 3 ≤ 2*(n / 3)
conclusion
(canonicalDecisionLaw (tvFrontierProtocol n d eps) (pairedLaw (contrast P))).map (fun w => frontierBlock n d eps ((frontierResources n d eps).m0 + offset) (tvToNormTranscript n d eps w.1))
= vectorBlockLaw P eps (n / 3)
Proof (Lean source)
-- @node: tvToNormTranscript_block_law
lemma tvToNormTranscript_block_law (n d : ℕ) (eps : ℝ)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(hP : CausalModel P) (hd : 0 < d)
(offset : ℕ) (hend : offset + n / 3 ≤ 2*(n / 3)) :
(canonicalDecisionLaw (tvFrontierProtocol n d eps) (pairedLaw (contrast P))).map
(fun w => frontierBlock n d eps ((frontierResources n d eps).m0 + offset)
(tvToNormTranscript n d eps w.1)) = vectorBlockLaw P eps (n / 3) := by
let g : Fin (n / 3) → Fin n := fun i => ⟨offset + i.val, by
have := i.isLt
omega⟩
have hg : Injective g := by
intro i j hij
apply Fin.ext
have := congrArg val hij
dsimp [g] at this
omega
have hfun : (fun w : DecisionSpace (tvFrontierProtocol n d eps) =>
frontierBlock n d eps ((frontierResources n d eps).m0 + offset)
(tvToNormTranscript n d eps w.1)) = (fun w i => w.1 (g i)) := by
funext w i
have hi : (frontierResources n d eps).m0 + offset + i.val < n := by
have := i.isLt
simp only [frontierResources]
omega
have hlo : ¬(frontierDesign n d eps).resources.m0 + offset + i.val <
(frontierDesign n d eps).resources.m0 := by omega
have hidx : (frontierDesign n d eps).resources.m0 + offset + i.val -
(frontierDesign n d eps).resources.m0 < n := by
have := i.isLt
simp only [frontierDesign, frontierResources]
omega
simp only [frontierBlock, messageAt, hi, ↓reduceDIte, tvToNormTranscript,
show (frontierResources n d eps).m0 = (frontierDesign n d eps).resources.m0 from rfl,
hlo, ↓reduceIte, hidx,
show (frontierDesign n d eps).resources.m0 + offset + i.val < n from hi,
Nat.add_sub_cancel_left]
apply congrArg w.1
apply Fin.ext
simp [g, frontierDesign, Nat.add_assoc]
rw [hfun]
exact tvFrontier_vector_selection_law eps P hP hd g hg (fun i => by
have := i.isLt
dsimp [g]
change offset + i.val < 2*(n / 3)
omega)
theorem tvToNormTranscript_block_integral
Assume the causal-model conditions for the data law, positive dimension, and the stated hend condition. Expectations of shifted evaluation statistics are their iid calibration expectations.
Formal statement
hypotheses
n d :
ℕ
eps :
ℝ
P :
hP :
hd :
0 < d
offset :
ℕ
hend :
offset + n / 3 ≤ 2*(n / 3)
conclusion
(∫ w, f (frontierBlock n d eps ((frontierResources n d eps).m0 + offset) (tvToNormTranscript n d eps w.1)) ∂canonicalDecisionLaw (tvFrontierProtocol n d eps) (pairedLaw (contrast P)))
= blockMean P eps f
Proof (Lean source)
-- @node: tvToNormTranscript_block_integral
lemma tvToNormTranscript_block_integral (n d : ℕ) (eps : ℝ)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(hP : CausalModel P) (hd : 0 < d)
(offset : ℕ) (hend : offset + n / 3 ≤ 2*(n / 3))
(f : (Fin (n / 3) → Fin d → Bool) → ℝ) :
(∫ w, f (frontierBlock n d eps ((frontierResources n d eps).m0 + offset)
(tvToNormTranscript n d eps w.1))
∂canonicalDecisionLaw (tvFrontierProtocol n d eps) (pairedLaw (contrast P))) =
blockMean P eps f := by
unfold blockMean
rw [← tvToNormTranscript_block_law n d eps P hP hd offset hend]
have hmeas : Measurable (fun w : DecisionSpace (tvFrontierProtocol n d eps) =>
frontierBlock n d eps ((frontierResources n d eps).m0 + offset)
(tvToNormTranscript n d eps w.1)) := by
letI : Countable (ProtocolTranscript (tvFrontierProtocol n d eps)) := by
change Countable (Fin n → Fin d → Bool)
infer_instance
letI : MeasurableSingletonClass (ProtocolTranscript (tvFrontierProtocol n d eps)) := by
change MeasurableSingletonClass (Fin n → Fin d → Bool)
infer_instance
exact (measurable_of_countable (fun z => frontierBlock n d eps
((frontierResources n d eps).m0 + offset) (tvToNormTranscript n d eps z))).comp
measurable_fst
exact (integral_map hmeas.aemeasurable (by fun_prop)).symm
theorem tvFrontierNormEstimate_absMean_mse
Assume the stated hb condition, the causal-model conditions for the data law, a positive privacy budget, dimension at least two, and the stated hm condition. The paired absolute evaluation means inherit the finite signed-norm MSE.
Formal statement
hypotheses
n d :
ℕ
eps :
ℝ
hb :
(frontierResources n d eps).branch = .absMean
P :
hP :
heps :
0 < eps
hd :
2 ≤ d
hm :
0 < n / 3
conclusion
(∫ w, (frontierNormEstimate n d eps (tvToNormTranscript n d eps w.1) - signedNorm (contrast P))^2 ∂canonicalDecisionLaw (tvFrontierProtocol n d eps) (pairedLaw (contrast P)))
≤ sigmaSquared d (n / 3) eps
Proof (Lean source)
-- @node: tvFrontierNormEstimate_absMean_mse
lemma tvFrontierNormEstimate_absMean_mse (n d : ℕ) (eps : ℝ)
(hb : (frontierResources n d eps).branch = .absMean)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(heps : 0 < eps) (hd : 2 ≤ d) (hm : 0 < n / 3) :
(∫ w, (frontierNormEstimate n d eps (tvToNormTranscript n d eps w.1) -
signedNorm (contrast P))^2
∂canonicalDecisionLaw (tvFrontierProtocol n d eps) (pairedLaw (contrast P))) ≤
sigmaSquared d (n / 3) eps := by
simp_rw [frontierNormEstimate_absMean n d eps hb]
have htransfer := tvToNormTranscript_block_integral n d eps P hP (by omega)
(n / 3) (by omega)
(fun z => ((d : ℝ)⁻¹ * ∑ j, |scaledColumnMean eps j z| -
signedNorm (contrast P))^2)
change (∫ w, ((d : ℝ)⁻¹ * ∑ j, |scaledColumnMean eps j
(frontierBlock n d eps ((frontierResources n d eps).m0 + n / 3)
(tvToNormTranscript n d eps w.1))| - signedNorm (contrast P))^2
∂canonicalDecisionLaw (tvFrontierProtocol n d eps) (pairedLaw (contrast P))) ≤ _
exact htransfer.le.trans (absolute_column_average_mse_bound P hP eps heps hd hm)
theorem tvFrontierEstimator_risk_le_norm_mse
Assume the stated hn condition, the causal-model conditions for the data law, dimension at least two, and the protocol decision. Projecting the norm statistic divided by two costs one quarter of its MSE.
Formal statement
hypotheses
n d :
ℕ
eps :
ℝ
hn :
n ≠ 2
P :
hP :
hd :
2 ≤ d
B :
ℝ
hMSE :
(∫ w, (frontierNormEstimate n d eps (tvToNormTranscript n d eps w.1) - signedNorm (contrast P))^2 ∂canonicalDecisionLaw (tvFrontierProtocol n d eps) (pairedLaw (contrast P)))
≤ B
conclusion
squaredRisk (canonicalDecisionLaw (tvFrontierProtocol n d eps) (pairedLaw (contrast P))) (tvFrontierEstimator n d eps) (tvFromUniform (pairedLaw (contrast P)))
≤ ofReal (B / 4)
Proof (Lean source)
-- @node: tvFrontierEstimator_risk_le_norm_mse
lemma tvFrontierEstimator_risk_le_norm_mse (n d : ℕ) (eps : ℝ) (hn : n ≠ 2)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(hd : 2 ≤ d) (B : ℝ)
(hMSE : (∫ w, (frontierNormEstimate n d eps (tvToNormTranscript n d eps w.1) -
signedNorm (contrast P))^2
∂canonicalDecisionLaw (tvFrontierProtocol n d eps) (pairedLaw (contrast P))) ≤ B) :
squaredRisk (canonicalDecisionLaw (tvFrontierProtocol n d eps) (pairedLaw (contrast P)))
(tvFrontierEstimator n d eps) (tvFromUniform (pairedLaw (contrast P))) ≤
ofReal (B / 4) := by
have htheta := contrast_mem_parameterCube P hP
haveI : IsProbabilityMeasure (pairedLaw (contrast P)) :=
pairedFamily_subset_simplex (by omega)
(Set.mem_image_of_mem pairedLaw htheta)
haveI : ∀ i, IsMarkovKernel (tvFrontierKernel n d eps i) := by
intro i
exact ⟨fun v => (tvFrontierStage_markov n d eps i).isProbabilityMeasure
((v,(0 : Fin 1)), fun _ => fun _ => false)⟩
haveI : ∀ i, IsProbabilityMeasure
((pairedLaw (contrast P)).bind (tvFrontierKernel n d eps i)) :=
fun i => isProbabilityMeasure_bind (Kernel.measurable _).aemeasurable
(Filter.Eventually.of_forall (fun _ => inferInstance))
let L := Measure.pi (fun i => (pairedLaw (contrast P)).bind (tvFrontierKernel n d eps i))
let f : (Fin n → Fin d → Bool) → ℝ := fun z =>
(frontierNormEstimate n d eps (tvToNormTranscript n d eps z) - signedNorm (contrast P))^2
have hf : Measurable f := measurable_of_countable f
have htransfer : (∫ z, f z ∂L) =
∫ w, f w.1 ∂canonicalDecisionLaw (tvFrontierProtocol n d eps) (pairedLaw (contrast P)) := by
dsimp only [L]
erw [← tvFrontier_sampling_transcript_product n d eps (pairedLaw (contrast P))]
exact integral_map measurable_fst.aemeasurable hf.aestronglyMeasurable
have hnorm : (∫ z, f z ∂L) ≤ B := by
rw [htransfer]
exact hMSE
have htarget : signedNorm (contrast P)/2 ∈ Icc (0 : ℝ) (1/4) := by
have hdR : (0 : ℝ) < d := by exact_mod_cast (by omega : 0 < d)
have hsum : ∑ j : Fin d, |contrast P j| ≤ (d : ℝ)*(1/2) := by
calc
_ ≤ ∑ _j : Fin d, (1/2 : ℝ) := Finset.sum_le_sum (fun j _ =>
abs_le.mpr (htheta j))
_ = _ := by simp
have hnonneg : 0 ≤ signedNorm (contrast P) := by unfold signedNorm; positivity
have hupper : signedNorm (contrast P) ≤ 1/2 := by
unfold signedNorm
calc
_ ≤ (d : ℝ)⁻¹ * ((d : ℝ)*(1/2)) :=
mul_le_mul_of_nonneg_left hsum (by positivity)
_ = _ := by field_simp
constructor <;> linarith
rw [tvFrontierEstimator_risk_product n d eps (pairedLaw (contrast P)),
tvFromUniform_pairedLaw _ htheta (by omega)]
calc
_ ≤ ∫⁻ z, ofReal (f z / 4) ∂L := by
apply lintegral_mono
intro z
apply ENNReal.ofReal_le_ofReal
change (tvFrontierEstimate n d eps (z,(0 : Fin 1),0) -
signedNorm (contrast P)/2)^2 ≤ f z / 4
simp only [tvFrontierEstimate, hn, ↓reduceIte]
let x := frontierNormEstimate n d eps (tvToNormTranscript n d eps z)/2
have hproj : (max 0 (min (1/4 : ℝ) x) - signedNorm (contrast P)/2)^2 ≤
(x - signedNorm (contrast P)/2)^2 := by
by_cases hlo : x ≤ 0
· rw [min_eq_right (by linarith), max_eq_left hlo]
nlinarith [htarget.1]
· by_cases hhi : 1/4 ≤ x
· rw [min_eq_left hhi, max_eq_right (by norm_num)]
nlinarith [htarget.2]
· rw [min_eq_right (le_of_not_ge hhi), max_eq_right (le_of_not_ge hlo)]
exact hproj.trans_eq (by dsimp [x, f]; ring)
_ = ofReal ((∫ z, f z ∂L)/4) := by
rw [← ofReal_integral_eq_lintegral_ofReal (Integrable.of_finite)
(Filter.Eventually.of_forall (fun z => by dsimp [f]; positivity))]
congr 1
integral_linearity
_ ≤ _ := ENNReal.ofReal_le_ofReal (div_le_div_of_nonneg_right hnorm (by norm_num))
theorem tvFrontierEstimator_absMean_risk
Assume the stated hn condition, the stated hb condition, the causal-model conditions for the data law, a positive privacy budget, dimension at least two, and the stated hm condition. Projecting the norm statistic divided by two costs one quarter of its MSE.
Formal statement
hypotheses
n d :
ℕ
eps :
ℝ
hn :
n ≠ 2
hb :
(frontierResources n d eps).branch = .absMean
P :
hP :
heps :
0 < eps
hd :
2 ≤ d
hm :
0 < n / 3
conclusion
squaredRisk (canonicalDecisionLaw (tvFrontierProtocol n d eps) (pairedLaw (contrast P))) (tvFrontierEstimator n d eps) (tvFromUniform (pairedLaw (contrast P)))
≤ ofReal (sigmaSquared d (n / 3) eps / 4)
Proof (Lean source)
-- @node: tvFrontierEstimator_absMean_risk
lemma tvFrontierEstimator_absMean_risk (n d : ℕ) (eps : ℝ) (hn : n ≠ 2)
(hb : (frontierResources n d eps).branch = .absMean)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(heps : 0 < eps) (hd : 2 ≤ d) (hm : 0 < n / 3) :
squaredRisk (canonicalDecisionLaw (tvFrontierProtocol n d eps) (pairedLaw (contrast P)))
(tvFrontierEstimator n d eps) (tvFromUniform (pairedLaw (contrast P))) ≤
ofReal (sigmaSquared d (n / 3) eps / 4) := by
exact tvFrontierEstimator_risk_le_norm_mse n d eps hn P hP hd _
(tvFrontierNormEstimate_absMean_mse n d eps hb P hP heps hd hm)
theorem tvFrontierEstimator_absMean_dense_rate
Assume an admissible sample size, dimension, and privacy budget, the stated hn condition, the stated l condition, the stated hdense condition, and the stated hp condition. The dense bounded-logarithmic branch attains the paired TV risk rate on every law in the paired family, with the specified common upper constant.
Formal statement
hypotheses
n d :
ℕ
eps :
ℝ
hAllowed :
Allowed n d eps
hn :
n ≠ 2
hL :
logDim d < 4096
hdense :
(d : ℝ)^2 * logDim d ≤ (n : ℝ) * eps^2
p :
Measure (PairedSymbol d)
hp :
p ∈ pairedFamily d
conclusion
squaredRisk (canonicalDecisionLaw (tvFrontierProtocol n d eps) p) (tvFrontierEstimator n d eps) (tvFromUniform p)
Proof (Lean source)
-- @node: tvFrontierEstimator_absMean_dense_rate
lemma tvFrontierEstimator_absMean_dense_rate (n d : ℕ) (eps : ℝ)
(hAllowed : Allowed n d eps) (hn : n ≠ 2) (hL : logDim d < 4096)
(hdense : (d : ℝ)^2 * logDim d ≤ (n : ℝ) * eps^2)
(p : Measure (PairedSymbol d)) (hp : p ∈ pairedFamily d) :
squaredRisk (canonicalDecisionLaw (tvFrontierProtocol n d eps) p)
(tvFrontierEstimator n d eps) (tvFromUniform p) ≤
ofReal ((10 : ℝ)^16 * rateR .NI n d eps) := by
obtain ⟨theta, htheta, rfl⟩ := hp
have hd : 0 < d := by have := hAllowed.2.1; omega
haveI := symmetricLaw_probability theta htheta hd
have hmodel := symmetricLaw_causalModel theta htheta hd
have hcontrast : contrast (symmetricLaw theta) = theta := by
funext j
simp only [contrast, symmetricLaw_armMean theta htheta hd, signVal,
Bool.false_eq_true, ↓reduceIte]
ring
have hm : 0 < n / 3 := by have := hAllowed.1; omega
have hrisk := tvFrontierEstimator_absMean_risk n d eps hn
(frontier_absMean_resources n d eps hn hL) (symmetricLaw theta) hmodel
hAllowed.2.2.1 hAllowed.2.1 hm
rw [hcontrast] at hrisk
apply hrisk.trans
apply ENNReal.ofReal_le_ofReal
have hresource := frontier_absMean_dense_resource_bound n d eps hAllowed hn hL hdense
have ht : 0 < (n : ℝ)*eps^2 := by
have hnp : (0 : ℝ) < n := by exact_mod_cast (by have := hAllowed.1; omega : 0 < n)
exact mul_pos hnp (sq_pos_of_pos hAllowed.2.2.1)
have hLp := logDim_pos d hAllowed.2.1
have hrate : 0 ≤ rateR .NI n d eps := by
simp only [rateR, rho, if_pos hdense]
positivity
have hnoise : 0 ≤ sigmaSquared d (n / 3) eps := by unfold sigmaSquared; positivity
have hbase : 0 ≤ 24 / ((n : ℝ)*eps^2) := by positivity
nlinarith
theorem tvFrontierNormEstimate_globalPoly_mse
Assume the bounded-mean concentration inequality, the Cai–Low Chebyshev approximation theorem, the stated hn condition, the stated hb condition, independent and identically distributed participant records, the causal-model conditions for the data law, an admissible sample size, dimension, and privacy budget, the stated hm condition, the stated even condition, the stated d condition, the stated hm d condition, and the stated degree condition. The shifted paired evaluation block inherits the global polynomial MSE, including its finite-degree variance and approximation terms.
Formal statement
hypotheses
hMean :
hCheb :
n d :
ℕ
eps :
ℝ
hn :
n ≠ 2
hb :
(frontierResources n d eps).branch = .globalPoly
S :
SamplingScheme n d
hIID :
P :
hP :
hAllowed :
Allowed n d eps
hm :
0 < n / 3
hEven :
Even (frontierResources n d eps).degree
hD :
2 ≤ (frontierResources n d eps).degree
hmD :
2*(frontierResources n d eps).degree ≤ n / 3
hDegree :
((frontierResources n d eps).degree : ℝ)
conclusion
(∫ w, (frontierNormEstimate n d eps (tvToNormTranscript n d eps w.1) - signedNorm (contrast P))^2 ∂canonicalDecisionLaw (tvFrontierProtocol n d eps) (pairedLaw (contrast P)))
≤ exp (9*(frontierResources n d eps).degree* log (exp 1 + sigmaSquared d (n / 3) eps * logDim d))/(2*d)
+ (1/((frontierResources n d eps).degree+1 : ℝ))^2
Proof (Lean source)
-- @node: tvFrontierNormEstimate_globalPoly_mse
lemma tvFrontierNormEstimate_globalPoly_mse
(hMean : BoundedMeanConcentration) (hCheb : CaiLowChebyshevApproximation)
(n d : ℕ) (eps : ℝ) (hn : n ≠ 2)
(hb : (frontierResources n d eps).branch = .globalPoly)
(S : SamplingScheme n d) (hIID : IidPeople S)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(hAllowed : Allowed n d eps) (hm : 0 < n / 3)
(hEven : Even (frontierResources n d eps).degree)
(hD : 2 ≤ (frontierResources n d eps).degree)
(hmD : 2*(frontierResources n d eps).degree ≤ n / 3)
(hDegree : ((frontierResources n d eps).degree : ℝ) ≤
(1/1024 : ℝ) * logDim d /
log (exp 1 + sigmaSquared d (n / 3) eps * logDim d)) :
(∫ w, (frontierNormEstimate n d eps (tvToNormTranscript n d eps w.1) -
signedNorm (contrast P))^2
∂canonicalDecisionLaw (tvFrontierProtocol n d eps) (pairedLaw (contrast P))) ≤
exp (9*(frontierResources n d eps).degree*
log (exp 1 + sigmaSquared d (n / 3) eps * logDim d))/(2*d) +
(1/((frontierResources n d eps).degree+1 : ℝ))^2 := by
have hradius : (frontierResources n d eps).radius = (1/2 : ℝ) := by
by_cases hsmall : logDim d < 4096
· simp [frontierResources, hn, hsmall] at hb
· by_cases hdense : (d : ℝ)^2 * logDim d ≤ (n : ℝ)*eps^2
· simp [frontierResources, hn, hsmall, hdense] at hb
· simp [frontierResources, hdense]
simp_rw [frontierNormEstimate_globalPoly n d eps hb, hradius,
← frontierPolynomialEstimate_eq_polynomialEstimate]
have htransfer := tvToNormTranscript_block_integral n d eps P hP
(by have := hAllowed.2.1; omega) (n / 3) (by omega)
(fun z => ((d : ℝ)⁻¹ * ∑ j, frontierPolynomialEstimate eps (1/2)
(frontierResources n d eps).degree j z - signedNorm (contrast P))^2)
simp only [frontierResources] at htransfer ⊢
exact htransfer.le.trans (frontierPolynomial_average_mse_bound hMean hCheb S hIID P hP
eps hAllowed hm (by omega) _ hEven hD hmD hDegree)
theorem tvFrontierEstimator_globalPoly_rate
Assume the bounded-mean concentration inequality, the Cai–Low Chebyshev approximation theorem, an admissible sample size, dimension, and privacy budget, the stated hn condition, the stated l condition, the stated hdense condition, the protocol-class label, the stated hf condition, independent and identically distributed participant records, and the causal-model conditions for the data law. The concrete paired global-polynomial branch attains the finite-resource risk rate after projection, using the same selected degree as the causal norm.
Formal statement
hypotheses
hMean :
hCheb :
n d :
ℕ
eps :
ℝ
hAllowed :
Allowed n d eps
hn :
n ≠ 2
hL :
4096 ≤ logDim d
hdense :
¬ (d : ℝ)^2 * logDim d ≤ (n : ℝ)*eps^2
hsaturated :
rateR .NI n d eps ≠ 1
hf :
(frontierResources n d eps).branch ≠ .fallbackQuarter
S :
SamplingScheme n d
hIID :
P :
hP :
conclusion
squaredRisk (canonicalDecisionLaw (tvFrontierProtocol n d eps) (pairedLaw (contrast P))) (tvFrontierEstimator n d eps) (tvFromUniform (pairedLaw (contrast P)))
Proof (Lean source)
-- @node: tvFrontierEstimator_globalPoly_rate
lemma tvFrontierEstimator_globalPoly_rate
(hMean : BoundedMeanConcentration) (hCheb : CaiLowChebyshevApproximation)
(n d : ℕ) (eps : ℝ) (hAllowed : Allowed n d eps) (hn : n ≠ 2)
(hL : 4096 ≤ logDim d)
(hdense : ¬ (d : ℝ)^2 * logDim d ≤ (n : ℝ)*eps^2)
(hsaturated : rateR .NI n d eps ≠ 1)
(hf : (frontierResources n d eps).branch ≠ .fallbackQuarter)
(S : SamplingScheme n d) (hIID : IidPeople S)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P) :
squaredRisk (canonicalDecisionLaw (tvFrontierProtocol n d eps) (pairedLaw (contrast P)))
(tvFrontierEstimator n d eps) (tvFromUniform (pairedLaw (contrast P))) ≤
ofReal ((10 : ℝ)^16 * rateR .NI n d eps) := by
have hm : 0 < n / 3 := by have := hAllowed.1; omega
obtain ⟨hb, hEven, hD, hDegree, hLower⟩ := frontier_global_rounding
n d eps hAllowed hn hL hdense hf
have hmD := frontier_global_moment_fit n d eps hAllowed hn hD hDegree
have hDegree' : ((frontierResources n d eps).degree : ℝ) ≤
(1/1024 : ℝ) * logDim d /
log (exp 1 + sigmaSquared d (n / 3) eps * logDim d) := by
convert hDegree using 1 <;> first | rfl | ring
have hNorm := tvFrontierNormEstimate_globalPoly_mse hMean hCheb n d eps hn hb
S hIID P hP hAllowed hm hEven hD hmD hDegree'
apply (tvFrontierEstimator_risk_le_norm_mse n d eps hn P hP hAllowed.2.1 _ hNorm).trans
apply ENNReal.ofReal_le_ofReal
have hresource := frontier_global_resource_bound n d eps hAllowed hn hL hdense
hsaturated hDegree hLower
have hnoise : 0 ≤ exp (9*(frontierResources n d eps).degree *
log (exp 1 + sigmaSquared d (n / 3) eps * logDim d))/(2*d) +
(1/((frontierResources n d eps).degree+1 : ℝ))^2 := by positivity
have hbase : 0 ≤ 24 / ((n : ℝ)*eps^2) := by positivity
nlinarith
theorem tvToNormTranscript_blocks_integral
Assume the causal-model conditions for the data law and positive dimension. The two shifted paired blocks have the calibrated independent hybrid expectation.
Formal statement
hypotheses
n d :
ℕ
eps :
ℝ
P :
hP :
hd :
0 < d
conclusion
(∫ w, f (frontierBlock n d eps (frontierResources n d eps).m0 (tvToNormTranscript n d eps w.1), frontierBlock n d eps ((frontierResources n d eps).m0 + (frontierResources n d eps).m) (tvToNormTranscript n d eps w.1)) ∂canonicalDecisionLaw (tvFrontierProtocol n d eps) (pairedLaw (contrast P)))
= hybridMean P eps f
Proof (Lean source)
-- @node: tvToNormTranscript_blocks_integral
lemma tvToNormTranscript_blocks_integral (n d : ℕ) (eps : ℝ)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(hP : CausalModel P) (hd : 0 < d)
(f : ((Fin (n / 3) → Fin d → Bool) × (Fin (n / 3) → Fin d → Bool)) → ℝ) :
(∫ w, f (frontierBlock n d eps (frontierResources n d eps).m0
(tvToNormTranscript n d eps w.1),
frontierBlock n d eps ((frontierResources n d eps).m0 +
(frontierResources n d eps).m) (tvToNormTranscript n d eps w.1))
∂canonicalDecisionLaw (tvFrontierProtocol n d eps) (pairedLaw (contrast P))) =
hybridMean P eps f := by
let g : Fin (n / 3 + n / 3) → Fin n := fun i => ⟨i.val, by
have := i.isLt
omega⟩
have hg : Injective g := by
intro i j hij
apply Fin.ext
have h := congrArg val hij
exact h
have hlaw := tvFrontier_vector_selection_law eps P hP hd g hg
(fun i => by have := i.isLt; dsimp [g]; simp only [frontierDesign, frontierResources]; omega)
have htransfer :
(∫ w, f (splitHybridRows (fun i => w.1 (g i)))
∂canonicalDecisionLaw (tvFrontierProtocol n d eps) (pairedLaw (contrast P))) =
blockMean P eps (fun z => f (splitHybridRows z)) := by
unfold blockMean
rw [← hlaw]
exact (integral_map (μ := canonicalDecisionLaw (tvFrontierProtocol n d eps) (pairedLaw (contrast P)))
(φ := fun w : DecisionSpace (tvFrontierProtocol n d eps) =>
(fun i => w.1 (g i) : Fin (n / 3 + n / 3) → Fin d → Bool))
(f := fun z => f (splitHybridRows z)) (by fun_prop)
(by
change AEStronglyMeasurable
(fun z : Fin (n / 3 + n / 3) → Fin d → Bool => f (splitHybridRows z)) _
exact (measurable_of_countable _).aestronglyMeasurable)).symm
have hblock (z : ProtocolTranscript (tvFrontierProtocol n d eps))
(offset : ℕ) (hend : offset + n / 3 ≤ 2*(n / 3)) (i : Fin (n / 3)) :
frontierBlock n d eps ((frontierResources n d eps).m0 + offset)
(tvToNormTranscript n d eps z) i =
z ⟨offset + i.val, by have := i.isLt; omega⟩ := by
have hi : (frontierResources n d eps).m0 + offset + i.val < n := by
have := i.isLt
simp only [frontierResources]
omega
have hlo : ¬(frontierDesign n d eps).resources.m0 + offset + i.val <
(frontierDesign n d eps).resources.m0 := by omega
have hidx : (frontierDesign n d eps).resources.m0 + offset + i.val -
(frontierDesign n d eps).resources.m0 < n := by
have := i.isLt
simp only [frontierDesign, frontierResources]
omega
simp only [frontierBlock, messageAt, hi, ↓reduceDIte, tvToNormTranscript,
show (frontierResources n d eps).m0 = (frontierDesign n d eps).resources.m0 from rfl,
hlo, ↓reduceIte, hidx,
show (frontierDesign n d eps).resources.m0 + offset + i.val < n from hi,
Nat.add_sub_cancel_left]
apply congrArg z
apply Fin.ext
simp [frontierDesign, Nat.add_assoc]
have hpair (w : DecisionSpace (tvFrontierProtocol n d eps)) :
(frontierBlock n d eps (frontierResources n d eps).m0 (tvToNormTranscript n d eps w.1),
frontierBlock n d eps ((frontierResources n d eps).m0 +
(frontierResources n d eps).m) (tvToNormTranscript n d eps w.1)) =
splitHybridRows (fun i => w.1 (g i)) := by
apply Prod.ext
· funext i
have h := hblock w.1 0 (by omega) i
change frontierBlock n d eps (frontierResources n d eps).m0
(tvToNormTranscript n d eps w.1) i = w.1 (g (Fin.castAdd (n / 3) i))
simpa only [Nat.add_zero] using h.trans (congrArg w.1 (by
apply Fin.ext
simp [g]))
· funext i
simpa only [frontierResources, splitHybridRows, g, Nat.add_comm, Fin.val_natAdd] using
hblock w.1 (n / 3) (by omega) i
simp_rw [hpair]
exact htransfer.trans (hybridMean_eq_combined_blockMean P eps f).symm
theorem tvFrontierNormEstimate_hybrid_mse
Assume the bounded-mean concentration inequality, the Cai–Low Chebyshev approximation theorem, the stated hb condition, independent and identically distributed participant records, the causal-model conditions for the data law, an admissible sample size, dimension, and privacy budget, the stated hm condition, the stated l condition, the stated d condition, and the stated hm d condition. The paired hybrid statistic inherits the finite pilot/evaluation norm calibration.
Formal statement
hypotheses
hMean :
hCheb :
n d :
ℕ
eps :
ℝ
hb :
(frontierResources n d eps).branch = .hybrid
S :
SamplingScheme n d
hIID :
P :
hP :
hAllowed :
Allowed n d eps
hm :
0 < n / 3
hL :
4096 ≤ logDim d
hD :
hmD :
2*(frontierResources n d eps).degree ≤ n / 3
conclusion
(∫ w, (frontierNormEstimate n d eps (tvToNormTranscript n d eps w.1) - signedNorm (contrast P))^2 ∂canonicalDecisionLaw (tvFrontierProtocol n d eps) (pairedLaw (contrast P)))
≤ 500000000 * sigmaSquared d (n / 3) eps / logDim d
Proof (Lean source)
-- @node: tvFrontierNormEstimate_hybrid_mse
lemma tvFrontierNormEstimate_hybrid_mse
(hMean : BoundedMeanConcentration) (hCheb : CaiLowChebyshevApproximation)
(n d : ℕ) (eps : ℝ)
(hb : (frontierResources n d eps).branch = .hybrid)
(S : SamplingScheme n d) (hIID : IidPeople S)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(hAllowed : Allowed n d eps) (hm : 0 < n / 3) (hL : 4096 ≤ logDim d)
(hD : (frontierResources n d eps).degree = 2*⌊(1/1024 : ℝ)*logDim d/2⌋₊)
(hmD : 2*(frontierResources n d eps).degree ≤ n / 3) :
(∫ w, (frontierNormEstimate n d eps (tvToNormTranscript n d eps w.1) -
signedNorm (contrast P))^2
∂canonicalDecisionLaw (tvFrontierProtocol n d eps) (pairedLaw (contrast P))) ≤
500000000 * sigmaSquared d (n / 3) eps / logDim d := by
have hstat (w : DecisionSpace (tvFrontierProtocol n d eps)) :=
frontierNormEstimate_hybrid n d eps hb (tvToNormTranscript n d eps w.1)
simp_rw [hstat]
have htransfer := tvToNormTranscript_blocks_integral n d eps P hP
(by have := hAllowed.2.1; omega)
(fun z => ((d : ℝ)⁻¹ * ∑ j, hybridColumn eps
(frontierResources n d eps).degree j z - signedNorm (contrast P))^2)
exact htransfer.le.trans (hybrid_average_mse_bound hMean hCheb S hIID P hP eps
hAllowed hm _ hL hD hmD (by omega))
theorem tvFrontierEstimator_hybrid_dense_rate
Assume the bounded-mean concentration inequality, the Cai–Low Chebyshev approximation theorem, an admissible sample size, dimension, and privacy budget, the stated hn condition, the stated l condition, the stated hdense condition, independent and identically distributed participant records, and the causal-model conditions for the data law. Projection of the paired hybrid norm attains the dense large-dimension TV rate.
Formal statement
hypotheses
hMean :
hCheb :
n d :
ℕ
eps :
ℝ
hAllowed :
Allowed n d eps
hn :
n ≠ 2
hL :
4096 ≤ logDim d
hdense :
(d : ℝ)^2 * logDim d ≤ (n : ℝ) * eps^2
S :
SamplingScheme n d
hIID :
P :
hP :
conclusion
squaredRisk (canonicalDecisionLaw (tvFrontierProtocol n d eps) (pairedLaw (contrast P))) (tvFrontierEstimator n d eps) (tvFromUniform (pairedLaw (contrast P)))
Proof (Lean source)
-- @node: tvFrontierEstimator_hybrid_dense_rate
lemma tvFrontierEstimator_hybrid_dense_rate
(hMean : BoundedMeanConcentration) (hCheb : CaiLowChebyshevApproximation)
(n d : ℕ) (eps : ℝ) (hAllowed : Allowed n d eps) (hn : n ≠ 2)
(hL : 4096 ≤ logDim d)
(hdense : (d : ℝ)^2 * logDim d ≤ (n : ℝ) * eps^2)
(S : SamplingScheme n d) (hIID : IidPeople S)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P) :
squaredRisk (canonicalDecisionLaw (tvFrontierProtocol n d eps) (pairedLaw (contrast P)))
(tvFrontierEstimator n d eps) (tvFromUniform (pairedLaw (contrast P))) ≤
ofReal ((10 : ℝ)^16 * rateR .NI n d eps) := by
have hm : 0 < n / 3 := by have := hAllowed.1; omega
obtain ⟨hb, hD, hmD⟩ := frontier_hybrid_resources n d eps hAllowed hn hL hdense
have hNorm := tvFrontierNormEstimate_hybrid_mse hMean hCheb n d eps hb S hIID
P hP hAllowed hm hL hD hmD
apply (tvFrontierEstimator_risk_le_norm_mse n d eps hn P hP hAllowed.2.1 _ hNorm).trans
apply ENNReal.ofReal_le_ofReal
have hresource := frontier_hybrid_dense_resource_bound n d eps hAllowed hn hdense
have hnoise : 0 ≤ 500000000 * sigmaSquared d (n / 3) eps / logDim d := by
have := logDim_pos d hAllowed.2.1
unfold sigmaSquared
positivity
have hbase : 0 ≤ 24 / ((n : ℝ)*eps^2) := by positivity
nlinarith
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.TVModel 22 declarations Finite original-record private value frontiers: Helpers/TVModel.
Helpers/TVModel
Finite original-record private value frontiers: Helpers/TVModel.
def tvMinimaxRisk
Fix the protocol-class label, the probability law M, the sample size, and the privacy budget. Paired-input pure-local minimax squared-error value, with canonical iid sampling.
Definition (Lean source)
parameters
def
tvMinimaxRisk C M n eps :
ℝ≥0∞
given by
Fix the protocol-class label, the probability law M, the sample size, and the privacy budget. Globally honest TV interval value on the specified model, interval range [0,1].
Definition (Lean source)
parameters
def
tvHonestLength C M n eps :
ℝ≥0∞
given by
Fix the sample size and the dimension and the privacy budget and the public seed and the stated h condition and the constant C0. Paired finite sign-vector protocol and attaining transcript-only decisions in [0,1/4].
Definition (Lean source)
parameters
n d :
ℕ
eps r h C0 :
ℝ
def
TvAttainment n d eps r h C0 :
Prop
given by
∃ K : LocalProtocol n (PairedSymbol d),
NoninteractiveClass K eps
clause 2
∃ (T : Estimator K) (J : IntervalDecision K 0 (1/4)),
TranscriptOnly K T
p ∈ pairedFamily d :
def tvFrontierKernel
Fix the sample size and the dimension, the privacy budget, and the participant index. Paired-input signed-vector channel, with constant unused releases.
Definition (Lean source)
parameters
def
given by
⟨fun v
=> atomLaw (fun z => if i.val < 2*(frontierDesign n d eps).resources.m then (2 : ℝ)^(-(d : ℤ)) * (1 + privacyDelta eps * signVal v.2 * signVal (z v.1)) else if z = (fun _ => false) then 1 else 0), measurable_of_countable _⟩
def tvFrontierStageKernel
Fix the sample size and the dimension, the privacy budget, and the participant index. Paired participant stage ignoring seed and histories.
Definition (Lean source)
parameters
def
given by
(tvFrontierKernel n d eps i).comap (fun w => w.1.1) (measurable_fst.comp measurable_fst)
Markov certificate of the concrete paired participant channel.
Formal statement
Proof (Lean source)
-- @node: tvFrontierStage_markov
lemma tvFrontierStage_markov (n d : ℕ) (eps : ℝ) (i : Fin n) :
IsMarkovKernel (tvFrontierStageKernel n d eps i) := by
classical
have hk : IsMarkovKernel (tvFrontierKernel n d eps i) := by
constructor
intro v
constructor
change atomLaw _ univ = 1
by_cases h : i.val < 2*(frontierDesign n d eps).resources.m
· let o : ObsRecord d := (v.1, true, v.2)
change atomLaw (fun z => if i.val < 2*(frontierDesign n d eps).resources.m then
_ else _) univ = 1
simp only [h, ↓reduceIte]
have ho := (vectorKernel_markov d eps).isProbabilityMeasure o |>.measure_univ
change atomLaw (vectorMass eps o) univ = 1 at ho
have hm : vectorMass eps o = (fun z => (2 : ℝ)^(-(d : ℤ)) *
(1 + privacyDelta eps * signVal v.2 * signVal (z v.1))) := by
funext z
simp [vectorMass, o, obsSign, signVal]
rw [hm] at ho
exact ho
· simp [h, atomLaw, Measure.finsetSum_apply, Measure.smul_apply,
Measure.dirac_apply_of_mem, apply_ite ofReal]
letI := hk
unfold tvFrontierStageKernel
infer_instance
def tvFrontierProtocol
Fix the sample size and the dimension and the privacy budget. Resource-selected finite sign-vector NI protocol for the paired model.
Definition (Lean source)
parameters
n d :
ℕ
eps :
ℝ
def
given by
clause 1
Seed := Fin 1
clause 2
seedMeasurable := inferInstance
clause 3
seedStandard := inferInstance
clause 4
seedLaw := Measure.dirac 0
clause 5
seedProbability := inferInstance
clause 7
messageMeasurable := fun _ => inferInstance
clause 8
messageStandard := fun _ => inferInstance
clause 9
kernels := tvFrontierStageKernel n d eps
clause 10
markov := tvFrontierStage_markov n d eps
Assume a nonnegative privacy budget and the set hE. Active paired rows are signed-vector rows after a deterministic record embedding; unused participants release the same constant for every input.
Formal statement
hypotheses
conclusion
tvFrontierKernel n d eps i v E
Proof (Lean source)
-- @node: tvFrontierKernel_privacy
lemma tvFrontierKernel_privacy (n d : ℕ) (eps : ℝ) (heps : 0 ≤ eps)
(i : Fin n) (v v' : PairedSymbol d) (E : Set (Fin d → Bool))
(hE : MeasurableSet E) :
tvFrontierKernel n d eps i v E ≤
ofReal (exp eps) * tvFrontierKernel n d eps i v' E := by
classical
by_cases hi : i.val < 2*(frontierDesign n d eps).resources.m
· have hmass (u : PairedSymbol d) :
vectorMass eps (u.1, true, u.2) =
(fun z => (2 : ℝ)^(-(d : ℤ)) *
(1 + privacyDelta eps * signVal u.2 * signVal (z u.1))) := by
funext z
simp [vectorMass, obsSign, signVal]
simpa only [tvFrontierKernel, Kernel.coe_mk, hi, ↓reduceIte,
vectorKernel, hmass] using
vectorKernel_privacy eps heps (v.1, true, v.2) (v'.1, true, v'.2) E hE
· have he : (1 : ℝ≥0∞) ≤ ofReal (exp eps) := by
simpa only [ENNReal.ofReal_one] using
ENNReal.ofReal_le_ofReal (Real.one_le_exp_iff.mpr heps)
change atomLaw _ E ≤ ofReal (exp eps) * atomLaw _ E
simp only [hi, ↓reduceIte]
exact le_mul_of_one_le_left' he
theorem tvFrontierProtocol_noninteractive
Assume a nonnegative privacy budget. The resource-selected paired sign-vector protocol is noninteractive and pure private at every history, including constant unused releases.
Formal statement
hypotheses
n d :
ℕ
eps :
ℝ
heps :
0 ≤ eps
conclusion
NoninteractiveClass (tvFrontierProtocol n d eps) eps
Proof (Lean source)
-- @node: tvFrontierProtocol_noninteractive
lemma tvFrontierProtocol_noninteractive (n d : ℕ) (eps : ℝ) (heps : 0 ≤ eps) :
NoninteractiveClass (tvFrontierProtocol n d eps) eps := by
constructor
· intro i v v' eta r E hE
exact tvFrontierKernel_privacy n d eps heps i v v' E hE
· intro i v eta eta' r
rfl
def tvToNormTranscript
Fix the sample size and the dimension, the privacy budget, and the protocol transcript. Embed paired vector messages in the common private polynomial computation.
Definition (Lean source)
parameters
def
def tvFrontierEstimate
Fix the sample size and the dimension, the privacy budget, and the protocol decision. Explicit projected TV polynomial decision, using no baseline block.
Definition (Lean source)
parameters
def
tvFrontierEstimate n d eps w :
ℝ
given by
if n
= 2 then 1/8 else max 0 (min (1/4) (frontierNormEstimate n d eps (tvToNormTranscript n d eps w.1)/2))
Borel measurability of the concrete paired polynomial decision.
Formal statement
Proof (Lean source)
-- @node: tvFrontierEstimate_measurable
lemma tvFrontierEstimate_measurable (n d : ℕ) (eps : ℝ) :
Measurable (tvFrontierEstimate n d eps) := by
classical
letI : Countable (ProtocolTranscript (tvFrontierProtocol n d eps)) := by
change Countable (Fin n → Fin d → Bool)
infer_instance
letI : MeasurableSingletonClass (ProtocolTranscript (tvFrontierProtocol n d eps)) := by
change MeasurableSingletonClass (Fin n → Fin d → Bool)
infer_instance
let f : ProtocolTranscript (tvFrontierProtocol n d eps) → ℝ :=
fun z => tvFrontierEstimate n d eps (z, (0 : Fin 1), 0)
have hf : Measurable f := measurable_of_countable f
exact hf.comp measurable_fst
def tvFrontierEstimator
Fix the sample size and the dimension and the privacy budget. The measurable transcript-only paired estimator.
Definition (Lean source)
parameters
n d :
ℕ
eps :
ℝ
def
given by
⟨tvFrontierEstimate n d eps, tvFrontierEstimate_measurable n d eps⟩
def tvFrontierLo
Fix the sample size and the dimension, the privacy budget and the constant C0, and the protocol decision. Lower endpoint in the sharper paired interval range.
Definition (Lean source)
parameters
def
tvFrontierLo n d eps C0 w :
ℝ
given by
def tvFrontierHi
Fix the sample size and the dimension, the privacy budget and the constant C0, and the protocol decision. Upper endpoint in the sharper paired interval range.
Definition (Lean source)
parameters
def
tvFrontierHi n d eps C0 w :
ℝ
given by
Regularity, order and range certificate for the concrete paired interval.
Formal statement
hypotheses
n d :
ℕ
eps C0 :
ℝ
conclusion
conclusion 1
Measurable (tvFrontierLo n d eps C0)
conclusion 2
Measurable (tvFrontierHi n d eps C0)
Proof (Lean source)
-- @node: tvFrontier_interval_certificate
lemma tvFrontier_interval_certificate (n d : ℕ) (eps C0 : ℝ) :
Measurable (tvFrontierLo n d eps C0) ∧ Measurable (tvFrontierHi n d eps C0) ∧
(∀ w, tvFrontierLo n d eps C0 w ≤ tvFrontierHi n d eps C0 w) ∧
(∀ w, tvFrontierLo n d eps C0 w ∈ Icc (0 : ℝ) (1/4)) ∧
(∀ w, tvFrontierHi n d eps C0 w ∈ Icc (0 : ℝ) (1/4)) := by
have hm := tvFrontierEstimate_measurable n d eps
have hrad : 0 ≤ sqrt (10*C0*rateR .NI n d eps) := by positivity
have hrange : ∀ w, tvFrontierEstimate n d eps w ∈ Icc (0 : ℝ) (1/4 : ℝ) := by
intro w
dsimp [tvFrontierEstimate]
split_ifs
· norm_num
· exact ⟨le_max_left _ _, max_le (by norm_num) (min_le_left _ _)⟩
refine ⟨?_, ?_, ?_, ?_, ?_⟩
· change Measurable (fun w =>
max 0 (tvFrontierEstimate n d eps w - sqrt (10*C0*rateR .NI n d eps)))
fun_prop
· change Measurable (fun w =>
min (1/4) (tvFrontierEstimate n d eps w + sqrt (10*C0*rateR .NI n d eps)))
fun_prop
· intro w
have hw := hrange w
dsimp [tvFrontierLo, tvFrontierHi]
apply max_le
· apply le_min
· norm_num
· linarith [hw.1]
· apply le_min
· linarith [hw.2]
· linarith
· intro w
have hw := hrange w
change (0 : ℝ) ≤
max (0 : ℝ) (tvFrontierEstimate n d eps w - sqrt (10*C0*rateR .NI n d eps)) ∧ _
exact ⟨le_max_left _ _, max_le (by norm_num) (by linarith [hw.2])⟩
· intro w
have hw := hrange w
change (0 : ℝ) ≤
min (1/4 : ℝ) (tvFrontierEstimate n d eps w + sqrt (10*C0*rateR .NI n d eps)) ∧ _
exact ⟨le_min (by norm_num) (by linarith [hw.1]), min_le_left _ _⟩
def tvFrontierInterval
Fix the sample size and the dimension and the privacy budget and the constant C0. Actual paired globally honest closed connected interval.
Definition (Lean source)
parameters
n d :
ℕ
eps C0 :
ℝ
def
given by
{ lo := tvFrontierLo n d eps C0, hi := tvFrontierHi n d eps C0, measurable_lo := (tvFrontier_interval_certificate n d eps C0).1, measurable_hi := (tvFrontier_interval_certificate n d eps C0).2.1, ordered := (tvFrontier_interval_certificate n d eps C0).2.2.1, range_lo := (tvFrontier_interval_certificate n d eps C0).2.2.2.1, range_hi := (tvFrontier_interval_certificate n d eps C0).2.2.2.2 }
Fix the sample size and the dimension and the privacy budget and the constant C0. Concrete attainment by the resource-selected sign-vector polynomial decisions.
Definition (Lean source)
parameters
n d :
ℕ
eps C0 :
ℝ
def
ConcreteTvAttainment n d eps C0 :
Prop
given by
clause 1
NoninteractiveClass (tvFrontierProtocol n d eps) eps
clause 2
p ∈ pairedFamily d :
squaredRisk (canonicalDecisionLaw (tvFrontierProtocol n d eps) p) (tvFrontierEstimator n d eps) (tvFromUniform p)
(0.90 : ℝ)
≤ coverage (canonicalDecisionLaw (tvFrontierProtocol n d eps) p) (tvFrontierInterval n d eps C0) (tvFromUniform p)
expectedLength (canonicalDecisionLaw (tvFrontierProtocol n d eps) p) (tvFrontierInterval n d eps C0)
Assume the stated hv condition. The two-participant fallback has squared error at most one sixty-fourth throughout the paired target range.
Formal statement
hypotheses
conclusion
squaredRisk L (tvFrontierEstimator 2 d eps) v ≤ ofReal (1/64 : ℝ)
Proof (Lean source)
-- @node: tvFrontierEstimator_two_risk
lemma tvFrontierEstimator_two_risk (d : ℕ) (eps : ℝ)
(L : Measure (DecisionSpace (tvFrontierProtocol 2 d eps))) [IsProbabilityMeasure L]
(v : ℝ) (hv : v ∈ Icc (0 : ℝ) (1/4)) :
squaredRisk L (tvFrontierEstimator 2 d eps) v ≤ ofReal (1/64 : ℝ) := by
have hpoint : ∀ w : DecisionSpace (tvFrontierProtocol 2 d eps),
((tvFrontierEstimator 2 d eps).1 w - v)^2 ≤ (1/64 : ℝ) := by
intro w
change (tvFrontierEstimate 2 d eps w - v)^2 ≤ _
simp only [tvFrontierEstimate, ↓reduceIte]
nlinarith [hv.1, hv.2, mul_nonneg hv.1 (sub_nonneg.mpr hv.2)]
unfold squaredRisk
calc
_ ≤ ∫⁻ _w, ofReal (1/64 : ℝ) ∂L :=
lintegral_mono (fun w => ENNReal.ofReal_le_ofReal (hpoint w))
_ = _ := by simp
theorem tvFrontierInterval_length_le
Clipping the paired interval to its target range can only shorten it.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: tvFrontierInterval_length_le
lemma tvFrontierInterval_length_le (n d : ℕ) (eps C0 : ℝ)
(w : DecisionSpace (tvFrontierProtocol n d eps)) :
intervalLength ((tvFrontierInterval n d eps C0).lo w)
((tvFrontierInterval n d eps C0).hi w) ≤
2 * sqrt (10*C0*rateR .NI n d eps) := by
have hr := Real.sqrt_nonneg (10*C0*rateR .NI n d eps)
change max 0 (min (1/4) (tvFrontierEstimate n d eps w +
sqrt (10*C0*rateR .NI n d eps)) - max 0 (tvFrontierEstimate n d eps w -
sqrt (10*C0*rateR .NI n d eps))) ≤ _
apply max_le
· positivity
· have hu := min_le_right (1/4 : ℝ) (tvFrontierEstimate n d eps w +
sqrt (10*C0*rateR .NI n d eps))
have hl := le_max_right (0 : ℝ) (tvFrontierEstimate n d eps w -
sqrt (10*C0*rateR .NI n d eps))
linarith
theorem tvFrontierInterval_expectedLength_le
Assume the stated c0 condition. Integrating the deterministic paired length bound yields the square-root rate.
Formal statement
hypotheses
n d :
ℕ
eps C0 :
ℝ
hC0 :
0 ≤ C0
L :
conclusion
expectedLength L (tvFrontierInterval n d eps C0)
Proof (Lean source)
-- @node: tvFrontierInterval_expectedLength_le
lemma tvFrontierInterval_expectedLength_le (n d : ℕ) (eps C0 : ℝ) (hC0 : 0 ≤ C0)
(L : Measure (DecisionSpace (tvFrontierProtocol n d eps))) [IsProbabilityMeasure L] :
expectedLength L (tvFrontierInterval n d eps C0) ≤
ofReal (sqrt (40*C0) * rateH .NI n d eps) := by
have hs : 2 * sqrt (10*C0) = sqrt (40*C0) := by
rw [← Real.sqrt_sq (by norm_num : (0 : ℝ) ≤ 2),
← Real.sqrt_mul (by norm_num)]
congr 1
ring
have heq : 2 * sqrt (10*C0*rateR .NI n d eps) =
sqrt (40*C0) * rateH .NI n d eps := by
rw [Real.sqrt_mul (by positivity), ← mul_assoc, hs]
rfl
unfold expectedLength
calc
_ ≤ ∫⁻ _w, ofReal (2 * sqrt (10*C0*rateR .NI n d eps)) ∂L :=
lintegral_mono (fun w => ENNReal.ofReal_le_ofReal
(tvFrontierInterval_length_le n d eps C0 w))
_ = _ := by simp [heq]
theorem tvFrontierInterval_coverage_of_risk
Assume an admissible sample size, dimension, and privacy budget, the stated c0 condition, the stated hv condition, and the estimator hRisk. Markov's inequality converts the finite MSE bound into ninety-percent coverage.
Formal statement
hypotheses
n d :
ℕ
eps :
ℝ
hAllowed :
Allowed n d eps
C0 :
ℝ
hC0 :
0 < C0
L :
v :
ℝ
hv :
v ∈ Icc (0 : ℝ) (1/4)
hRisk :
conclusion
(0.90 : ℝ) ≤ coverage L (tvFrontierInterval n d eps C0) v
Proof (Lean source)
-- @node: tvFrontierInterval_coverage_of_risk
lemma tvFrontierInterval_coverage_of_risk (n d : ℕ) (eps : ℝ) (hAllowed : Allowed n d eps)
(C0 : ℝ) (hC0 : 0 < C0)
(L : Measure (DecisionSpace (tvFrontierProtocol n d eps))) [IsProbabilityMeasure L]
(v : ℝ) (hv : v ∈ Icc (0 : ℝ) (1/4))
(hRisk : squaredRisk L (tvFrontierEstimator n d eps) v ≤
ofReal (C0 * rateR .NI n d eps)) :
(0.90 : ℝ) ≤ coverage L (tvFrontierInterval n d eps C0) v := by
let q := sqrt (10*C0*rateR .NI n d eps)
have hn : (0 : ℝ) < n := by exact_mod_cast (by have := hAllowed.1; omega : 0 < n)
have ht : 0 < (n : ℝ) * eps^2 := mul_pos hn (sq_pos_of_pos hAllowed.2.2.1)
have hrho : 0 < rho (n*eps^2) d :=
(lt_min (by norm_num) (one_div_pos.mpr ht)).trans_le
(rho_elementary_comparisons n d eps hAllowed).1
have hq : 0 < q := Real.sqrt_pos.mpr (by dsimp [rateR]; positivity)
have hq2 : q^2 = (10*C0) * rho (n*eps^2) d :=
Real.sq_sqrt (by positivity)
let f := fun w : DecisionSpace (tvFrontierProtocol n d eps) =>
ofReal ((tvFrontierEstimate n d eps w - v)^2)
have hf : Measurable f := by
dsimp [f]
have hm := tvFrontierEstimate_measurable n d eps
fun_prop
have hm := mul_meas_ge_le_lintegral (μ := L) hf (ofReal (q^2))
have hm' : ofReal (q^2) * L {w | ofReal (q^2) ≤ f w} ≤
ofReal (C0 * rateR .NI n d eps) := hm.trans hRisk
have hmR := ENNReal.toReal_mono ENNReal.ofReal_ne_top hm'
rw [ENNReal.toReal_mul, ENNReal.toReal_ofReal (sq_nonneg q),
ENNReal.toReal_ofReal (by dsimp [rateR]; positivity)] at hmR
change q^2 * L.real {w | ofReal (q^2) ≤ f w} ≤ _ at hmR
let E := coverageEvent (tvFrontierInterval n d eps C0).lo
(tvFrontierInterval n d eps C0).hi v
have hE : MeasurableSet E := measurableSet_coverageEvent
(tvFrontierInterval n d eps C0).measurable_lo (tvFrontierInterval n d eps C0).measurable_hi
have hsub : Eᶜ ⊆ {w | ofReal (q^2) ≤ f w} := by
intro w hw
have herr : q < |tvFrontierEstimate n d eps w - v| := by
by_contra hh
have ha := abs_le.mp (le_of_not_gt hh)
apply hw
change max 0 (tvFrontierEstimate n d eps w - q) ≤ v ∧
v ≤ min (1/4) (tvFrontierEstimate n d eps w + q)
exact ⟨max_le hv.1 (by linarith [ha.2]), le_min hv.2 (by linarith [ha.1])⟩
apply ENNReal.ofReal_le_ofReal
nlinarith [sq_abs (tvFrontierEstimate n d eps w - v)]
have hmono := measureReal_mono (μ := L) hsub
have hbad : L.real Eᶜ ≤ (1/10 : ℝ) := by
have hmR' : q^2 * L.real {w | ofReal (q^2) ≤ f w} ≤ q^2/10 := by
dsimp [rateR] at hmR
calc
_ ≤ C0 * rho (n*eps^2) d := hmR
_ = q^2/10 := by rw [hq2]; ring
have hpos : 0 < q^2 := sq_pos_of_pos hq
nlinarith
rw [measureReal_compl hE, probReal_univ] at hbad
change (0.90 : ℝ) ≤ L.real E
linarith
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.TVSampling 6 declarations The finite paired sign-vector transcript factors into averaged participant rows.
Independent rows in the paired attaining experiment
The finite paired sign-vector transcript factors into averaged participant rows. Its transcript-only squared risk is the corresponding finite product integral.
theorem tvFrontier_fixedTranscriptLaw_product Lemma tvFrontier_fixedTranscriptLaw_product in the paper ↗
For fixed records the concrete transcript consists of independent message rows.
Formal statement
hypotheses
conclusion
fixedTranscriptLaw (tvFrontierProtocol n d eps) o r
= Measure.pi (fun i => tvFrontierKernel n d eps i (o i))
Proof (Lean source)
-- @node: tvFrontier_fixedTranscriptLaw_product
lemma tvFrontier_fixedTranscriptLaw_product (n d : ℕ) (eps : ℝ)
(o : Fin n → PairedSymbol d) (r : (tvFrontierProtocol n d eps).Seed) :
fixedTranscriptLaw (tvFrontierProtocol n d eps) o r =
Measure.pi (fun i => tvFrontierKernel n d eps i (o i)) := by
letI : Countable (ProtocolTranscript (tvFrontierProtocol n d eps)) := by
change Countable (Fin n → (Fin d → Bool))
infer_instance
haveI : ∀ i, IsProbabilityMeasure (tvFrontierKernel n d eps i (o i)) :=
fun i => (tvFrontierStage_markov n d eps i).isProbabilityMeasure
((o i,r), fun _ => fun _ => false)
change (fixedTranscriptLaw (tvFrontierProtocol n d eps) o r :
Measure (Fin n → (Fin d → Bool))) = _
apply Measure.ext_of_singleton
intro z
change Fin n → (Fin d → Bool) at z
erw [Measure.pi_singleton]
exact transcriptLaw_singleton
(tvFrontierProtocol n d eps).kernels (tvFrontierProtocol n d eps).markov
(fun i => (o i,r)) z
theorem tvFrontier_iidTranscriptLaw_product Lemma tvFrontier_iidTranscriptLaw_product in the paper ↗
Averaging independent input records preserves the product of private row laws.
Formal statement
hypotheses
conclusion
(Measure.pi (fun _ : Fin n => mu)).bind (fun o => fixedTranscriptLaw (tvFrontierProtocol n d eps) o r)
= Measure.pi (fun i => mu.bind (tvFrontierKernel n d eps i))
Proof (Lean source)
-- @node: tvFrontier_iidTranscriptLaw_product
lemma tvFrontier_iidTranscriptLaw_product (n d : ℕ) (eps : ℝ)
(mu : Measure (PairedSymbol d)) [IsProbabilityMeasure mu]
(r : (tvFrontierProtocol n d eps).Seed) :
(Measure.pi (fun _ : Fin n => mu)).bind
(fun o => fixedTranscriptLaw (tvFrontierProtocol n d eps) o r) =
Measure.pi (fun i => mu.bind (tvFrontierKernel n d eps i)) := by
classical
letI : Countable (ProtocolTranscript (tvFrontierProtocol n d eps)) := by
change Countable (Fin n → (Fin d → Bool))
infer_instance
letI : MeasurableSingletonClass (ProtocolTranscript (tvFrontierProtocol n d eps)) := by
change MeasurableSingletonClass (Fin n → (Fin d → Bool))
infer_instance
haveI : ∀ i, IsMarkovKernel (tvFrontierKernel n d eps i) := by
intro i
exact ⟨fun o => (tvFrontierStage_markov n d eps i).isProbabilityMeasure
((o,r), fun _ => fun _ => false)⟩
haveI : ∀ i, IsProbabilityMeasure (mu.bind (tvFrontierKernel n d eps i)) :=
fun i => isProbabilityMeasure_bind (tvFrontierKernel n d eps i).measurable.aemeasurable
(Filter.Eventually.of_forall (fun _ => inferInstance))
apply Measure.ext_of_singleton
intro z
change Fin n → (Fin d → Bool) at z
erw [Measure.bind_apply (measurableSet_singleton z)
((measurable_fixedTranscriptLaw (tvFrontierProtocol n d eps)).comp
(show Measurable (fun o : Fin n → PairedSymbol d => (o,r)) by fun_prop)).aemeasurable,
Measure.pi_singleton]
simp only [tvFrontier_fixedTranscriptLaw_product]
change (∫⁻ o, (Measure.pi (fun i => tvFrontierKernel n d eps i (o i))) {z} ∂Measure.pi (fun _ : Fin n => mu)) = _
simp_rw [ Measure.pi_singleton,
Measure.bind_apply (measurableSet_singleton _) (Kernel.measurable _).aemeasurable]
simp_rw [lintegral_fintype, Measure.pi_singleton]
simp_rw [← Finset.prod_mul_distrib]
exact (Fintype.prod_sum (fun i o => tvFrontierKernel n d eps i o {z i} * mu {o})).symm
theorem tvFrontier_sampling_transcript_product Lemma tvFrontier_sampling_transcript_product in the paper ↗
The actual sampling decision law has the independent averaged message-row marginal.
Formal statement
hypotheses
conclusion
= Measure.pi (fun i => p.bind (tvFrontierKernel n d eps i))
Proof (Lean source)
-- @node: tvFrontier_sampling_transcript_product
lemma tvFrontier_sampling_transcript_product (n d : ℕ) (eps : ℝ)
(p : Measure (PairedSymbol d)) [IsProbabilityMeasure p] :
(canonicalDecisionLaw (tvFrontierProtocol n d eps) p).map
(fun w => w.1) = Measure.pi (fun i => p.bind (tvFrontierKernel n d eps i)) := by
apply Measure.ext
intro E hE
erw [Measure.map_apply measurable_fst hE]
have hpre : (fun w : DecisionSpace (tvFrontierProtocol n d eps) => w.1) ⁻¹' E =
E ×ˢ univ ×ˢ univ := by ext w; simp
rw [hpre]
unfold canonicalDecisionLaw
rw [product_decisionRows_rectangle _ _ E univ univ hE
MeasurableSet.univ MeasurableSet.univ]
simp only [Set.indicator_univ, tvFrontier_fixedTranscriptLaw_product]
simp only [lintegral_const, measure_univ, mul_one, uniform01,
Measure.restrict_apply MeasurableSet.univ, Set.univ_inter, Real.volume_Icc]
have hmix := congrArg (fun L => L E)
(tvFrontier_iidTranscriptLaw_product n d eps p (0 : Fin 1))
erw [Measure.bind_apply hE
((measurable_fixedTranscriptLaw (tvFrontierProtocol n d eps)).comp
(show Measurable (fun o : Fin n → PairedSymbol d => (o,(0 : Fin 1))) by fun_prop)).aemeasurable]
at hmix
simp only [tvFrontier_fixedTranscriptLaw_product] at hmix
norm_num only [sub_zero, ENNReal.ofReal_one, mul_one]
exact hmix
theorem tvFrontierEstimator_risk_product
The risk of the actual transcript-only frontier estimate is a finite product-law integral.
Formal statement
hypotheses
conclusion
squaredRisk (canonicalDecisionLaw (tvFrontierProtocol n d eps) p) (tvFrontierEstimator n d eps) (tvFromUniform p)
= ∫⁻ z : Fin n → (Fin d → Bool), ofReal ((tvFrontierEstimate n d eps (z,(0 : Fin 1),0) - tvFromUniform p)^2) ∂Measure.pi (fun i => p.bind (tvFrontierKernel n d eps i))
Proof (Lean source)
-- @node: tvFrontierEstimator_risk_product
lemma tvFrontierEstimator_risk_product (n d : ℕ) (eps : ℝ)
(p : Measure (PairedSymbol d)) [IsProbabilityMeasure p] :
squaredRisk (canonicalDecisionLaw (tvFrontierProtocol n d eps) p)
(tvFrontierEstimator n d eps) (tvFromUniform p) =
∫⁻ z : Fin n → (Fin d → Bool),
ofReal ((tvFrontierEstimate n d eps (z,(0 : Fin 1),0) - tvFromUniform p)^2)
∂Measure.pi (fun i => p.bind (tvFrontierKernel n d eps i)) := by
let f : ProtocolTranscript (tvFrontierProtocol n d eps) → ℝ≥0∞ := fun z =>
ofReal ((tvFrontierEstimate n d eps (z,(0 : Fin 1),0) - tvFromUniform p)^2)
have hf : Measurable f := by
letI : Countable (ProtocolTranscript (tvFrontierProtocol n d eps)) := by
change Countable (Fin n → (Fin d → Bool))
infer_instance
letI : MeasurableSingletonClass (ProtocolTranscript (tvFrontierProtocol n d eps)) := by
change MeasurableSingletonClass (Fin n → (Fin d → Bool))
infer_instance
exact measurable_of_countable f
have htrans := tvFrontier_sampling_transcript_product n d eps p
change _ = ∫⁻ z, f z ∂Measure.pi (fun i => p.bind (tvFrontierKernel n d eps i))
rw [← htrans]
erw [lintegral_map hf measurable_fst]
unfold squaredRisk
apply lintegral_congr
intro w
rfl
theorem tvFrontier_active_row_law
Assume the stated hi condition, the causal-model conditions for the data law, and positive dimension. An active paired row, averaged over the causal signed marginal, is exactly the vector-message law used by the moment calibration.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: tvFrontier_active_row_law
lemma tvFrontier_active_row_law (n d : ℕ) (eps : ℝ) (i : Fin n)
(hi : i.val < 2*(frontierDesign n d eps).resources.m)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(hP : CausalModel P) (hd : 0 < d) :
(pairedLaw (contrast P)).bind (tvFrontierKernel n d eps i) =
vectorMessageLaw P eps := by
classical
rw [← causal_signed_law P hP hd]
apply Measure.ext
intro E hE
rw [Measure.bind_apply hE (Kernel.measurable _).aemeasurable]
unfold vectorMessageLaw
rw [Measure.bind_apply hE (Kernel.measurable _).aemeasurable]
rw [lintegral_map (by fun_prop) (by fun_prop)]
apply lintegral_congr
intro o
change atomLaw (fun z => if i.val < 2*(frontierDesign n d eps).resources.m then
_ else _) E = atomLaw (vectorMass eps o) E
simp only [hi, ↓reduceIte]
congr 1
apply congrArg atomLaw
funext z
rcases o with ⟨j, a, y⟩
cases a <;> cases y <;> simp [vectorMass, signedObserve, obsSign, signVal]
theorem tvFrontier_vector_selection_law
Assume the causal-model conditions for the data law, positive dimension, the stated hg condition, and the stated hactive condition. Distinct active participants in the paired protocol provide exactly the iid vector block experiment, so all finite moment calibrations apply to their messages.
Formal statement
hypotheses
n d k :
ℕ
eps :
ℝ
P :
hP :
hd :
0 < d
hg :
hactive :
∀ i, (g i).val < 2*(frontierDesign n d eps).resources.m
conclusion
(canonicalDecisionLaw (tvFrontierProtocol n d eps) (pairedLaw (contrast P))).map (fun w i => w.1 (g i))
= vectorBlockLaw P eps k
Proof (Lean source)
-- @node: tvFrontier_vector_selection_law
lemma tvFrontier_vector_selection_law {n d k : ℕ} (eps : ℝ)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(hP : CausalModel P) (hd : 0 < d)
(g : Fin k → Fin n) (hg : Injective g)
(hactive : ∀ i, (g i).val < 2*(frontierDesign n d eps).resources.m) :
(canonicalDecisionLaw (tvFrontierProtocol n d eps) (pairedLaw (contrast P))).map
(fun w i => w.1 (g i)) = vectorBlockLaw P eps k := by
haveI : IsProbabilityMeasure (pairedLaw (contrast P)) :=
pairedFamily_subset_simplex hd
(Set.mem_image_of_mem pairedLaw (contrast_mem_parameterCube P hP))
haveI : ∀ i, IsMarkovKernel (tvFrontierKernel n d eps i) := by
intro i
exact ⟨fun v => (tvFrontierStage_markov n d eps i).isProbabilityMeasure
((v,(0 : Fin 1)), fun _ => fun _ => false)⟩
haveI : ∀ i, IsProbabilityMeasure
((pairedLaw (contrast P)).bind (tvFrontierKernel n d eps i)) :=
fun i => isProbabilityMeasure_bind (Kernel.measurable _).aemeasurable
(Filter.Eventually.of_forall (fun _ => inferInstance))
have hmap : (fun w : DecisionSpace (tvFrontierProtocol n d eps) =>
fun i => w.1 (g i)) = (fun z : Fin n → Fin d → Bool => fun i => z (g i)) ∘
(fun w => w.1) := rfl
rw [hmap]
erw [← Measure.map_map (by fun_prop) measurable_fst]
erw [tvFrontier_sampling_transcript_product n d eps (pairedLaw (contrast P))]
have hind := (iIndepFun_pi
(μ := fun i => (pairedLaw (contrast P)).bind (tvFrontierKernel n d eps i))
(X := fun (_ : Fin n) (z : Fin d → Bool) => z)
(fun _ => measurable_id.aemeasurable)).precomp hg
have hlaw := hind.map_fun_eq_pi_map
(fun i => (measurable_pi_apply (g i)).aemeasurable)
refine hlaw.trans ?_
unfold vectorBlockLaw
congr 1
funext i
rw [(measurePreserving_eval
(fun i => (pairedLaw (contrast P)).bind (tvFrontierKernel n d eps i)) (g i)).map_eq]
exact tvFrontier_active_row_law n d eps (g i) (hactive i) P hP hd
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.TVUpper 7 declarations Projection closes the bounded-loss branches; the calibrated iid norm blocks close the remaining branches of the explicit paired polynomial procedure.
Uniform risk of the paired attaining estimator
Projection closes the bounded-loss branches; the calibrated iid norm blocks close the remaining branches of the explicit paired polynomial procedure.
theorem canonicalDecisionLaw_probability
Every input probability law induces a probability decision law.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: canonicalDecisionLaw_probability
lemma canonicalDecisionLaw_probability {n : ℕ} {α : Type} [MeasurableSpace α]
(Q : LocalProtocol n α) (p : Measure α) [IsProbabilityMeasure p] :
IsProbabilityMeasure (canonicalDecisionLaw Q p) := by
haveI : IsProbabilityMeasure uniform01 := ⟨by
simp [uniform01, Measure.restrict_apply, Real.volume_Icc]⟩
unfold canonicalDecisionLaw
apply isProbabilityMeasure_bind (measurable_protocol_decisionRows Q).aemeasurable
exact Filter.Eventually.of_forall (fun w => by
haveI : IsProbabilityMeasure (fixedTranscriptLaw Q w.1 w.2.1) :=
isProbabilityMeasure_transcriptLaw
Q.kernels Q.markov (fun i => (w.1 i,w.2.1))
exact Measure.isProbabilityMeasure_map (by fun_prop))
The paired projection keeps all estimates in the sharper target interval.
Formal statement
hypotheses
conclusion
tvFrontierEstimate n d eps w ∈ Icc (0 : ℝ) (1/4)
Proof (Lean source)
-- @node: tvFrontierEstimate_range
lemma tvFrontierEstimate_range (n d : ℕ) (eps : ℝ)
(w : DecisionSpace (tvFrontierProtocol n d eps)) :
tvFrontierEstimate n d eps w ∈ Icc (0 : ℝ) (1/4) := by
unfold tvFrontierEstimate
split_ifs
· norm_num
· exact ⟨le_max_left _ _, max_le (by norm_num) (min_le_left _ _)⟩
theorem tvFrontierEstimator_risk_le_sixteenth Lemma tvFrontierEstimator_risk_le_sixteenth in the paper ↗
Assume the stated hv condition. The paired projection gives a uniform one-sixteenth squared-risk bound.
Formal statement
hypotheses
conclusion
squaredRisk L (tvFrontierEstimator n d eps) v ≤ ofReal (1/16 : ℝ)
Proof (Lean source)
-- @node: tvFrontierEstimator_risk_le_sixteenth
lemma tvFrontierEstimator_risk_le_sixteenth (n d : ℕ) (eps : ℝ)
(L : Measure (DecisionSpace (tvFrontierProtocol n d eps))) [IsProbabilityMeasure L]
(v : ℝ) (hv : v ∈ Icc (0 : ℝ) (1/4)) :
squaredRisk L (tvFrontierEstimator n d eps) v ≤ ofReal (1/16 : ℝ) := by
unfold squaredRisk
calc
_ ≤ ∫⁻ _w, ofReal (1/16 : ℝ) ∂L := by
apply lintegral_mono
intro w
apply ENNReal.ofReal_le_ofReal
have hw := tvFrontierEstimate_range n d eps w
have hdist := abs_sub_le_of_le_of_le hw.1 hw.2 hv.1 hv.2
change (tvFrontierEstimate n d eps w - v)^2 ≤ (1/16 : ℝ)
nlinarith [sq_abs (tvFrontierEstimate n d eps w - v),
abs_nonneg (tvFrontierEstimate n d eps w - v)]
_ = _ := by simp
theorem tvFromUniform_paired_range
Assume dimension at least two and the stated hp condition. The paired target ranges over zero to one quarter on the parameter cube.
Formal statement
hypotheses
conclusion
tvFromUniform p ∈ Icc (0 : ℝ) (1/4)
Proof (Lean source)
-- @node: tvFromUniform_paired_range
lemma tvFromUniform_paired_range (d : ℕ) (hd : 2 ≤ d)
(p : Measure (PairedSymbol d)) (hp : p ∈ pairedFamily d) :
tvFromUniform p ∈ Icc (0 : ℝ) (1/4) := by
obtain ⟨theta, htheta, rfl⟩ := hp
rw [tvFromUniform_pairedLaw theta htheta (by omega)]
have hdR : (0 : ℝ) < d := by exact_mod_cast (by omega : 0 < d)
have hsum : ∑ j : Fin d, |theta j| ≤ (d : ℝ)*(1/2) := by
calc
_ ≤ ∑ _j : Fin d, (1/2 : ℝ) :=
Finset.sum_le_sum (fun j _ => abs_le.mpr (htheta j))
_ = _ := by simp
have hlo : 0 ≤ signedNorm theta := by unfold signedNorm; positivity
have hhi : signedNorm theta ≤ 1/2 := by
unfold signedNorm
calc
_ ≤ (d : ℝ)⁻¹ * ((d : ℝ)*(1/2)) :=
mul_le_mul_of_nonneg_left hsum (by positivity)
_ = _ := by field_simp
constructor <;> linarith
theorem tvFrontierEstimator_uniform_rate
Assume the bounded-mean concentration inequality, the Cai–Low Chebyshev approximation theorem, an admissible sample size, dimension, and privacy budget, and the stated hp condition. All finite-resource branches of the explicit paired estimator attain the common upper-risk constant, using the calibrated polynomial blocks.
Formal statement
hypotheses
hMean :
hCheb :
n d :
ℕ
eps :
ℝ
hAllowed :
Allowed n d eps
p :
Measure (PairedSymbol d)
hp :
p ∈ pairedFamily d
conclusion
squaredRisk (canonicalDecisionLaw (tvFrontierProtocol n d eps) p) (tvFrontierEstimator n d eps) (tvFromUniform p)
Proof (Lean source)
-- @node: tvFrontierEstimator_uniform_rate
lemma tvFrontierEstimator_uniform_rate
(hMean : BoundedMeanConcentration) (hCheb : CaiLowChebyshevApproximation)
(n d : ℕ) (eps : ℝ) (hAllowed : Allowed n d eps)
(p : Measure (PairedSymbol d)) (hp : p ∈ pairedFamily d) :
squaredRisk (canonicalDecisionLaw (tvFrontierProtocol n d eps) p)
(tvFrontierEstimator n d eps) (tvFromUniform p) ≤
ofReal ((10 : ℝ)^16 * rateR .NI n d eps) := by
haveI : IsProbabilityMeasure p := pairedFamily_subset_simplex
(by have := hAllowed.2.1; omega) hp
haveI := canonicalDecisionLaw_probability (tvFrontierProtocol n d eps) p
have hv := tvFromUniform_paired_range d hAllowed.2.1 p hp
have hbounded := tvFrontierEstimator_risk_le_sixteenth n d eps
(canonicalDecisionLaw (tvFrontierProtocol n d eps) p) _ hv
by_cases hn : n = 2
· subst n
apply (tvFrontierEstimator_two_risk d eps _ _ hv).trans
apply ENNReal.ofReal_le_ofReal
have hr := rateR_twoParticipants_lower d eps hAllowed
nlinarith
· by_cases hsaturated : rateR .NI n d eps = 1
· apply hbounded.trans
apply ENNReal.ofReal_le_ofReal
rw [hsaturated]
norm_num
· by_cases hf : (frontierResources n d eps).branch = .fallbackQuarter
· obtain ⟨hn', hdense, hfb⟩ := frontier_fallback_resources n d eps hf
have hr := frontier_fallback_rate_lower n d eps hAllowed hn' hdense hfb
apply hbounded.trans
apply ENNReal.ofReal_le_ofReal
nlinarith
· by_cases hL : logDim d < 4096
· by_cases hdense : (d : ℝ)^2 * logDim d ≤ (n : ℝ)*eps^2
· exact tvFrontierEstimator_absMean_dense_rate n d eps hAllowed hn hL hdense p hp
· have hr := frontier_smallDim_intermediate_rate_lower n d eps hAllowed hL
(lt_of_not_ge hdense)
apply hbounded.trans
apply ENNReal.ofReal_le_ofReal
nlinarith
· obtain ⟨theta, htheta, rfl⟩ := hp
have hd : 0 < d := by have := hAllowed.2.1; omega
haveI := symmetricLaw_probability theta htheta hd
have hmodel := symmetricLaw_causalModel theta htheta hd
have hcontrast : contrast (symmetricLaw theta) = theta := by
funext j
simp only [contrast, symmetricLaw_armMean theta htheta hd, signVal,
Bool.false_eq_true, ↓reduceIte]
ring
by_cases hdense : (d : ℝ)^2 * logDim d ≤ (n : ℝ)*eps^2
· have hr := tvFrontierEstimator_hybrid_dense_rate hMean hCheb n d eps hAllowed
hn (le_of_not_gt hL) hdense (canonicalScheme n d) canonicalScheme_iidPeople
(symmetricLaw theta) hmodel
simpa only [hcontrast] using hr
· have hr := tvFrontierEstimator_globalPoly_rate hMean hCheb n d eps hAllowed
hn (le_of_not_gt hL) hdense hsaturated hf
(canonicalScheme n d) canonicalScheme_iidPeople (symmetricLaw theta) hmodel
simpa only [hcontrast] using hr
theorem tvFrontier_concrete_attainment
Assume the bounded-mean concentration inequality, the Cai–Low Chebyshev approximation theorem, and an admissible sample size, dimension, and privacy budget. The explicit sign-vector procedure has finite global coverage and the square-root expected-length rate on the full paired family.
Formal statement
hypotheses
conclusion
ConcreteTvAttainment n d eps ((10 : ℝ)^16)
Proof (Lean source)
-- @node: tvFrontier_concrete_attainment
lemma tvFrontier_concrete_attainment
(hMean : BoundedMeanConcentration) (hCheb : CaiLowChebyshevApproximation)
(n d : ℕ) (eps : ℝ) (hAllowed : Allowed n d eps) :
ConcreteTvAttainment n d eps ((10 : ℝ)^16) := by
refine ⟨tvFrontierProtocol_noninteractive n d eps hAllowed.2.2.1.le, ?_⟩
intro p hp
haveI : IsProbabilityMeasure p := pairedFamily_subset_simplex
(by have := hAllowed.2.1; omega) hp
haveI := canonicalDecisionLaw_probability (tvFrontierProtocol n d eps) p
have hv := tvFromUniform_paired_range d hAllowed.2.1 p hp
have hr := tvFrontierEstimator_uniform_rate hMean hCheb n d eps hAllowed p hp
refine ⟨hr, tvFrontierInterval_coverage_of_risk n d eps hAllowed _
(by positivity) _ _ hv hr, ?_⟩
apply (tvFrontierInterval_expectedLength_le n d eps ((10 : ℝ)^16)
(by positivity) _).trans
apply ENNReal.ofReal_le_ofReal
apply mul_le_mul_of_nonneg_right _ (Real.sqrt_nonneg _)
apply (Real.sqrt_le_iff).mpr
norm_num
theorem tvFrontier_attainment
Assume the bounded-mean concentration inequality, the Cai–Low Chebyshev approximation theorem, and an admissible sample size, dimension, and privacy budget. The concrete paired procedure supplies the existential finite sign-vector attainment witness with the same universal constant.
Formal statement
Proof (Lean source)
-- @node: tvFrontier_attainment
lemma tvFrontier_attainment
(hMean : BoundedMeanConcentration) (hCheb : CaiLowChebyshevApproximation)
(n d : ℕ) (eps : ℝ) (hAllowed : Allowed n d eps) :
TvAttainment n d eps (rateR .NI n d eps) (rateH .NI n d eps) ((10 : ℝ)^16) := by
have hc := tvFrontier_concrete_attainment hMean hCheb n d eps hAllowed
refine ⟨tvFrontierProtocol n d eps, hc.1, ?_, tvFrontierEstimator n d eps,
tvFrontierInterval n d eps ((10 : ℝ)^16), ?_, hc.2⟩
· intro i
exact ⟨Equiv.refl _⟩
· refine ⟨fun z => tvFrontierEstimate n d eps (z, (0 : Fin 1), 0), ?_, ?_⟩
· exact (tvFrontierEstimate_measurable n d eps).comp (by fun_prop)
· intro w
rfl
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.TranscriptPreprocessing 3 declarations Joint measurability of finite sequential transcript laws and their decision observations.
Measurable transcript laws
Joint measurability of finite sequential transcript laws and their decision observations.
theorem measurable_protocol_prefixLaw
When the prefix length does not exceed the sample size, prefix laws are measurable in the fixed participant inputs and public seed.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: measurable_protocol_prefixLaw
@[fun_prop] lemma measurable_protocol_prefixLaw (Q : LocalProtocol n α) (k : ℕ) (hk : k ≤ n) :
Measurable (fun x : Fin n → α × Q.Seed => prefixLaw Q.kernels x k hk) := by
induction k with
| zero => exact measurable_const
| succ k ih =>
let κ : Kernel (Fin n → α × Q.Seed) (ProtocolHistory Q ⟨k, by omega⟩) :=
⟨fun x => prefixLaw Q.kernels x k (le_of_succ_le hk), ih _⟩
haveI : IsMarkovKernel κ := ⟨fun x => isProbabilityMeasure_prefixLaw Q.kernels Q.markov x k _⟩
let η := (Q.kernels (nextIndex hk)).comap
(fun w : (Fin n → α × Q.Seed) × History Q.Message k (le_of_succ_le hk) =>
(w.1 (nextIndex hk), w.2)) (by fun_prop)
have heq : (fun x : Fin n → α × Q.Seed => prefixLaw Q.kernels x (k+1) hk) =
((κ ⊗ₖ η).map (fun p => snoc hk p.1 p.2)) := by
funext x
haveI := isProbabilityMeasure_prefixLaw Q.kernels Q.markov x k (le_of_succ_le hk)
rw [prefixLaw_succ, Kernel.map_apply _ (measurable_snoc hk)]
congr 1
ext E hE
rw [Measure.compProd_apply hE, Kernel.compProd_apply hE]
rfl
rw [heq]
exact Kernel.measurable _
theorem measurable_fixedTranscriptLaw
For every protocol, fixed transcript laws are jointly measurable in the records and public seed.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: measurable_fixedTranscriptLaw
@[fun_prop] lemma measurable_fixedTranscriptLaw (Q : LocalProtocol n α) :
Measurable (fun w : (Fin n → α) × Q.Seed => fixedTranscriptLaw Q w.1 w.2) := by
exact (measurable_protocol_prefixLaw Q n le_rfl).comp (by fun_prop)
theorem measurable_protocol_decisionRows
For every protocol, appending the seed and analyst randomizer gives jointly measurable decision rows.
Formal statement
hypotheses
conclusion
Measurable (fun w : (Fin n → α) × Q.Seed × ℝ => (fixedTranscriptLaw Q w.1 w.2.1).map (fun z => (z,w.2.1,w.2.2)))
Proof (Lean source)
-- @node: measurable_protocol_decisionRows
@[fun_prop] lemma measurable_protocol_decisionRows (Q : LocalProtocol n α) :
Measurable (fun w : (Fin n → α) × Q.Seed × ℝ =>
(fixedTranscriptLaw Q w.1 w.2.1).map (fun z => (z,w.2.1,w.2.2))) := by
let κ : Kernel ((Fin n → α) × Q.Seed × ℝ) (ProtocolTranscript Q) :=
⟨fun w => fixedTranscriptLaw Q w.1 w.2.1,
(measurable_fixedTranscriptLaw Q).comp
(show Measurable (fun w : (Fin n → α) × Q.Seed × ℝ => (w.1,w.2.1))
by fun_prop)⟩
haveI : IsMarkovKernel κ := ⟨fun w => by
exact isProbabilityMeasure_transcriptLaw Q.kernels Q.markov (fun i => (w.1 i,w.2.1))⟩
let η : Kernel (((Fin n → α) × Q.Seed × ℝ) × ProtocolTranscript Q) (DecisionSpace Q) :=
Kernel.deterministic (fun p => (p.2,p.1.2.1,p.1.2.2)) (by fun_prop)
have heq : (fun w : (Fin n → α) × Q.Seed × ℝ =>
(fixedTranscriptLaw Q w.1 w.2.1).map (fun z => (z,w.2.1,w.2.2))) =
((κ ⊗ₖ η).map snd) := by
funext w
rw [Kernel.map_apply _ measurable_snd]
ext E hE
rw [Measure.map_apply (by fun_prop) hE,
Measure.map_apply measurable_snd hE, Kernel.compProd_apply (measurable_snd hE)]
simp only [η, Kernel.deterministic_apply]
change _ = ∫⁻ z, (Measure.dirac (z,w.2.1,w.2.2)) E ∂κ w
simp only [Measure.dirac_apply' _ hE]
change _ = ∫⁻ z, indicator ((fun z => (z,w.2.1,w.2.2)) ⁻¹' E) 1 z ∂κ w
rw [lintegral_indicator
((show Measurable (fun z : ProtocolTranscript Q => (z,w.2.1,w.2.2))
by fun_prop) hE)]
simp [κ]
rw [heq]
exact Kernel.measurable _
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.TwoCell 8 declarations Admissible attaining decisions bound both minimax values.
Two-cell calibration assembly
Admissible attaining decisions bound both minimax values. The saturated experiment uses a fixed message, the midpoint estimate, and the whole causal target interval.
theorem causalAttainment_minimax_upper
Assume the stated attain condition. One noninteractive attaining procedure gives upper bounds in either protocol class.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
S :
SamplingScheme n d
eps r h C0 :
ℝ
hAttain :
CausalAttainment S eps r h C0
conclusion
conclusion 1
minimaxRisk S C eps ≤ ofReal (C0*r)
conclusion 2
honestLength S C eps ≤ ofReal (C0*h)
Proof (Lean source)
-- @node: causalAttainment_minimax_upper
lemma causalAttainment_minimax_upper (S : SamplingScheme n d) (eps r h C0 : ℝ)
(hAttain : CausalAttainment S eps r h C0) (C : ProtocolClassLabel) :
minimaxRisk S C eps ≤ ofReal (C0*r) ∧
honestLength S C eps ≤ ofReal (C0*h) := by
obtain ⟨Q, hNI, T, I, _hTranscript, hBounds⟩ := hAttain
have hQ : protocolClass C Q eps := by
cases C with
| NI => exact hNI
| SI => exact NoninteractiveClass.toSequentialClass Q eps hNI
let q : {Q : LocalProtocol n (ObsRecord d) // protocolClass C Q eps} := ⟨Q, hQ⟩
constructor
· unfold minimaxRisk riskValue
apply (minimaxValueENNReal_le_worstCaseRisk ⟨q, T⟩).trans
apply iSup_le
intro P
exact (hBounds P.1 P.2).1
· unfold honestLength lengthValue
let J : {I : IntervalDecision Q (1/4) (3/4) //
∀ P ∈ causalClass d, (0.90 : ℝ) ≤ coverage (decisionLaw S Q P) I (value P)} :=
⟨I, fun P hP => (hBounds P hP).2.1⟩
apply (minimaxValueENNReal_le_worstCaseRisk ⟨q, J⟩).trans
apply iSup_le
intro P
exact (hBounds P.1 P.2).2.2
theorem causalAttainment_mono_constant
Assume the stated hr condition, the stated hh condition, the stated c condition, and the stated attain condition. Increasing a nonnegative comparison constant preserves attained upper bounds.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
S :
SamplingScheme n d
eps r h C0 C1 :
ℝ
hr :
0 ≤ r
hh :
0 ≤ h
hC :
C0 ≤ C1
hAttain :
CausalAttainment S eps r h C0
conclusion
CausalAttainment S eps r h C1
Proof (Lean source)
-- @node: causalAttainment_mono_constant
lemma causalAttainment_mono_constant (S : SamplingScheme n d) (eps r h C0 C1 : ℝ)
(hr : 0 ≤ r) (hh : 0 ≤ h) (hC : C0 ≤ C1)
(hAttain : CausalAttainment S eps r h C0) : CausalAttainment S eps r h C1 := by
obtain ⟨Q, hNI, T, I, hTranscript, hBounds⟩ := hAttain
refine ⟨Q, hNI, T, I, hTranscript, ?_⟩
intro P hP
obtain ⟨hRisk, hCov, hLength⟩ := hBounds P hP
exact ⟨hRisk.trans (ENNReal.ofReal_le_ofReal (mul_le_mul_of_nonneg_right hC hr)),
hCov, hLength.trans (ENNReal.ofReal_le_ofReal (mul_le_mul_of_nonneg_right hC hh))⟩
def midpointProtocol
Fix the sample size and the dimension. Fixed-message original-record protocol for the saturated branch.
Definition (Lean source)
parameters
n d :
ℕ
def
given by
clause 1
Seed := Fin 1
clause 2
seedMeasurable := inferInstance
clause 3
seedStandard := inferInstance
clause 4
seedLaw := Measure.dirac 0
clause 5
seedProbability := inferInstance
clause 6
Message := fun _ => Bool
clause 7
messageMeasurable := fun _ => inferInstance
clause 8
messageStandard := fun _ => inferInstance
clause 9
kernels := fun _ => Kernel.deterministic (fun _ => false) measurable_const
clause 10
markov := fun _ => inferInstance
theorem midpointProtocol_noninteractive
Assume a nonnegative privacy budget. A fixed message satisfies privacy at every history and seed.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
eps :
ℝ
heps :
0 ≤ eps
conclusion
NoninteractiveClass (midpointProtocol n d) eps
Proof (Lean source)
-- @node: midpointProtocol_noninteractive
lemma midpointProtocol_noninteractive (eps : ℝ) (heps : 0 ≤ eps) :
NoninteractiveClass (midpointProtocol n d) eps := by
constructor
· intro i o o' eta r E hE
change (Measure.dirac false) E ≤ ofReal (exp eps) * (Measure.dirac false) E
exact le_mul_of_one_le_left (bot_le)
(by simpa using ENNReal.ofReal_le_ofReal (Real.one_le_exp_iff.mpr heps))
· intro i o eta eta' r
rfl
def midpointEstimator
Fix the sample size and the dimension. Midpoint estimate, independent of all coins.
Definition (Lean source)
parameters
n d :
ℕ
def
given by
⟨fun _ => 1/2, measurable_const⟩
def fullCausalInterval
Fix the sample size and the dimension. Full causal target interval, independent of all coins.
Definition (Lean source)
parameters
n d :
ℕ
def
given by
clause 1
lo := fun _ => 1/4
clause 2
hi := fun _ => 3/4
clause 3
measurable_lo := measurable_const
clause 4
measurable_hi := measurable_const
clause 5
ordered := fun _ => by norm_num
clause 6
range_lo := fun _ => by norm_num [Set.mem_Icc]
clause 7
range_hi := fun _ => by norm_num [Set.mem_Icc]
theorem midpoint_decision_bounds
Assume the stated hv condition. The saturated procedure has risk at most one sixteenth and perfect coverage.
Formal statement
hypotheses
conclusion
conclusion 1
squaredRisk L (midpointEstimator n d) v ≤ ofReal (1/16 : ℝ)
conclusion 2
coverage L (fullCausalInterval n d) v = 1
conclusion 3
Proof (Lean source)
-- @node: midpoint_decision_bounds
lemma midpoint_decision_bounds (L : Measure (DecisionSpace (midpointProtocol n d)))
[IsProbabilityMeasure L] (v : ℝ) (hv : v ∈ Icc (1/4 : ℝ) (3/4)) :
squaredRisk L (midpointEstimator n d) v ≤ ofReal (1/16 : ℝ) ∧
coverage L (fullCausalInterval n d) v = 1 ∧
expectedLength L (fullCausalInterval n d) = ofReal (1/2 : ℝ) := by
have hsq : (1/2 - v)^2 ≤ (1/16 : ℝ) := by
nlinarith [hv.1, hv.2, mul_nonneg (sub_nonneg.mpr hv.1) (sub_nonneg.mpr hv.2)]
refine ⟨?_, ?_, ?_⟩
· simp only [squaredRisk, midpointEstimator, lintegral_const, measure_univ, mul_one]
exact ENNReal.ofReal_le_ofReal hsq
· have hEvent : coverageEvent (fullCausalInterval n d).lo
(fullCausalInterval n d).hi v = univ := by
ext w
simp only [coverageEvent, fullCausalInterval, Set.mem_setOf_eq,
Set.mem_univ, iff_true]
exact hv
rw [coverage, hEvent, probReal_univ]
· norm_num [expectedLength, fullCausalInterval, intervalLength]
theorem two_cell_saturated_attainment
Assume the stated allowed condition, independent and identically distributed participant records, independent protocol randomness, and the stated ht condition. Saturation of both two-cell rates is attained by fixed messages and the full interval.
Formal statement
hypotheses
n :
ℕ
eps :
ℝ
hAllowed :
Allowed n 2 eps
S :
SamplingScheme n 2
hIID :
hRandom :
ht :
(n : ℝ)*eps^2 ≤ 1
conclusion
Proof (Lean source)
-- @node: two_cell_saturated_attainment
lemma two_cell_saturated_attainment (n : ℕ) (eps : ℝ) (hAllowed : Allowed n 2 eps)
(S : SamplingScheme n 2) (hIID : IidPeople S) (hRandom : IndependentRandomness S)
(ht : (n : ℝ)*eps^2 ≤ 1) :
CausalAttainment S eps (min 1 (1/(n*eps^2)))
(min 1 (1/(sqrt n*eps))) 1 := by
have hn : (0 : ℝ) < n := by exact_mod_cast (by have := hAllowed.1; omega : 0 < n)
have heps := hAllowed.2.2.1
have htpos : (0 : ℝ) < n*eps^2 := mul_pos hn (sq_pos_of_pos heps)
have hspos : 0 < sqrt n*eps := mul_pos (Real.sqrt_pos.2 hn) heps
have hssq : (sqrt n*eps)^2 = n*eps^2 := by
rw [mul_pow, Real.sq_sqrt hn.le]
have hs : sqrt n*eps ≤ 1 := by nlinarith
have hr : min 1 (1/(n*eps^2)) = (1 : ℝ) :=
min_eq_left ((le_div_iff₀ htpos).2 (by simpa using ht))
have hh : min 1 (1/(sqrt n*eps)) = (1 : ℝ) :=
min_eq_left ((le_div_iff₀ hspos).2 (by simpa using hs))
rw [hr, hh]
refine ⟨midpointProtocol n 2, midpointProtocol_noninteractive eps heps.le,
midpointEstimator n 2, fullCausalInterval n 2, ?_, ?_⟩
· exact ⟨fun _ => 1/2, measurable_const, fun _ => rfl⟩
· intro P hP
letI := hP.1
haveI := sampling_decisionLaw_probability S hIID hRandom (midpointProtocol n 2) P hP.2
obtain ⟨hRisk, hCov, hLength⟩ := midpoint_decision_bounds
(decisionLaw S (midpointProtocol n 2) P) (value P)
(causal_value_range P hP.2 (by norm_num))
refine ⟨hRisk.trans (ENNReal.ofReal_le_ofReal (by norm_num)), ?_, ?_⟩
· rw [hCov]; norm_num
· rw [hLength]; norm_num
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.TwoCellAttainment 3 declarations This assembly separates the binary/vector sampling calculation from the already proved projection, Markov coverage, and interval length arguments.
Two-cell attainment from component estimates
This assembly separates the binary/vector sampling calculation from the already proved projection, Markov coverage, and interval length arguments. Component bounds are proof inputs here, not extra assumptions on the paper theorem.
def TwoCellComponents
Fix the sampling scheme S and the privacy budget. The binary baseline and two vector-coordinate estimates required by the roadmap. Existence of this certificate remains a proof obligation in the calibration theorem.
Definition (Lean source)
parameters
def
TwoCellComponents S eps :
Prop
given by
∃ (Q : LocalProtocol n (ObsRecord 2)),
clause 1
∃ (B x0 x1 : Estimator Q),
TranscriptOnly Q B
TranscriptOnly Q x0
TranscriptOnly Q x1
P ∈ causalClass 2 :
squaredRisk (decisionLaw S Q P) B (baseline P)
≤ ofReal (1 / (4 * (n / 2 : ℕ) * (privacyDelta eps) ^ 2))
squaredRisk (decisionLaw S Q P) x0 (contrast P 0)
≤ ofReal (4 / ((n - n / 2 : ℕ) * (privacyDelta eps) ^ 2))
squaredRisk (decisionLaw S Q P) x1 (contrast P 1)
≤ ofReal (4 / ((n - n / 2 : ℕ) * (privacyDelta eps) ^ 2))
theorem twoCellEstimator_transcriptOnly
Assume the stated b condition, the stated hx0 condition, and the stated hx1 condition. Combining transcript-only components preserves the transcript-only property.
Formal statement
hypotheses
n :
ℕ
Q :
LocalProtocol n (ObsRecord 2)
B x0 x1 :
hB :
TranscriptOnly Q B
hx0 :
TranscriptOnly Q x0
hx1 :
TranscriptOnly Q x1
conclusion
TranscriptOnly Q (twoCellEstimator Q B x0 x1)
Proof (Lean source)
-- @node: twoCellEstimator_transcriptOnly
lemma twoCellEstimator_transcriptOnly {n : ℕ} (Q : LocalProtocol n (ObsRecord 2))
(B x0 x1 : Estimator Q) (hB : TranscriptOnly Q B)
(hx0 : TranscriptOnly Q x0) (hx1 : TranscriptOnly Q x1) :
TranscriptOnly Q (twoCellEstimator Q B x0 x1) := by
obtain ⟨b, hb, hbeq⟩ := hB
obtain ⟨t0, ht0, ht0eq⟩ := hx0
obtain ⟨t1, ht1, ht1eq⟩ := hx1
refine ⟨fun z => twoCellValueEstimate (b z) (t0 z) (t1 z),
measurable_twoCellValueEstimate b t0 t1 hb ht0 ht1, ?_⟩
intro w
change twoCellValueEstimate (B.1 w) (x0.1 w) (x1.1 w) = _
rw [hbeq, ht0eq, ht1eq]
theorem two_cell_unsaturated_attainment_of_components
Assume the stated allowed condition, independent and identically distributed participant records, independent protocol randomness, the stated ht condition, and the stated components condition. Component MSEs give both unsaturated upper orders with the roadmap's constant 1000.
Formal statement
hypotheses
n :
ℕ
eps :
ℝ
hAllowed :
Allowed n 2 eps
S :
SamplingScheme n 2
hIID :
hRandom :
ht :
1 < (n : ℝ) * eps ^ 2
hComponents :
TwoCellComponents S eps
conclusion
Proof (Lean source)
-- @node: two_cell_unsaturated_attainment_of_components
lemma two_cell_unsaturated_attainment_of_components {n : ℕ} (eps : ℝ)
(hAllowed : Allowed n 2 eps) (S : SamplingScheme n 2)
(hIID : IidPeople S) (hRandom : IndependentRandomness S)
(ht : 1 < (n : ℝ) * eps ^ 2) (hComponents : TwoCellComponents S eps) :
CausalAttainment S eps (min 1 (1 / (n * eps ^ 2)))
(min 1 (1 / (sqrt n * eps))) 1000 := by
obtain ⟨Q, hNI, hFinite, B, x0, x1, hTB, hT0, hT1, hMSE⟩ := hComponents
have hn : (0 : ℝ) < n := by exact_mod_cast (by have := hAllowed.1; omega : 0 < n)
have htpos : 0 < (n : ℝ) * eps ^ 2 := mul_pos hn (sq_pos_of_pos hAllowed.2.2.1)
have hspos : 0 < sqrt n * eps :=
mul_pos (Real.sqrt_pos.mpr hn) hAllowed.2.2.1
have hssq : (sqrt n * eps)^2 = (n : ℝ) * eps ^ 2 := by
rw [mul_pow, Real.sq_sqrt hn.le]
have hs : 1 < sqrt n * eps := by nlinarith
have hr : min 1 (1 / ((n : ℝ) * eps ^ 2)) = 1 / ((n : ℝ) * eps ^ 2) :=
min_eq_right ((div_le_one htpos).mpr ht.le)
have hh : min 1 (1 / (sqrt n * eps)) = 1 / (sqrt n * eps) :=
min_eq_right ((div_le_one hspos).mpr hs.le)
rw [hr, hh]
refine ⟨Q, hNI, twoCellEstimator Q B x0 x1, twoCellInterval eps Q B x0 x1,
twoCellEstimator_transcriptOnly Q B x0 x1 hTB hT0 hT1, ?_⟩
intro P hP
letI := hP.1
haveI := sampling_decisionLaw_probability S hIID hRandom Q P hP.2
obtain ⟨hB, hx0, hx1⟩ := hMSE P hP
have hRisk := two_cell_risk_of_component_mse eps hAllowed Q (decisionLaw S Q P)
B x0 x1 P hP.2 hB hx0 hx1
refine ⟨hRisk.trans (ENNReal.ofReal_le_ofReal ?_),
twoCellInterval_coverage_of_risk eps hAllowed Q B x0 x1 _ (value P)
(causal_value_range P hP.2 (by norm_num)) hRisk,
(twoCellInterval_expectedLength_le eps hAllowed Q B x0 x1 _).trans
(ENNReal.ofReal_le_ofReal ?_)⟩
· calc
88 / ((n : ℝ) * eps ^ 2) ≤ 1000 / ((n : ℝ) * eps ^ 2) :=
(div_le_div_iff_of_pos_right htpos).mpr (by norm_num)
_ = _ := by ring
· calc
200 / (sqrt n * eps) ≤ 1000 / (sqrt n * eps) :=
(div_le_div_iff_of_pos_right hspos).mpr (by norm_num)
_ = _ := by ring
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.TwoCellComponents 18 declarations Independent participant rows yield the binary baseline MSE, and extraction of the remaining vector rows transfers the existing coordinate mean and variance calculation.
MSEs for the half-block protocol
Independent participant rows yield the binary baseline MSE, and extraction of the remaining vector rows transfers the existing coordinate mean and variance calculation. These estimates provide the two-cell attainment certificate.
theorem twoCellKernel_markov
Every attaining row is a probability kernel, in the binary or vector branch.
Formal statement
Proof (Lean source)
-- @node: twoCellKernel_markov
lemma twoCellKernel_markov (n d : ℕ) (eps : ℝ) (i : Fin n) :
IsMarkovKernel (twoCellKernel n d eps i) := by
exact ⟨fun o => (twoCellStage_markov n d eps i).isProbabilityMeasure
((o, (0 : Fin 1)), fun _ => (false, fun _ => false))⟩
theorem twoCellKernel_baseline_sign_mean
Assume the stated hi condition. A baseline row releases a sign with the randomized-response conditional mean.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: twoCellKernel_baseline_sign_mean
lemma twoCellKernel_baseline_sign_mean (n d : ℕ) (eps : ℝ)
(i : Fin n) (hi : i.val < (n / 2)) (o : ObsRecord d) :
(∫ z, signVal z.1 ∂twoCellKernel n d eps i o) =
privacyDelta eps * signVal o.2.2 := by
classical
letI := twoCellKernel_markov n d eps i
rw [integral_fintype Integrable.of_finite]
change (∑ z, (atomLaw (twoCellMass n d eps i o)).real {z} * signVal z.1) = _
have hm : ∀ z, 0 ≤ twoCellMass n d eps i o z := by
intro z
simp only [twoCellMass, hi, ↓reduceIte]
exact mul_nonneg (binaryOutcomeMass_nonneg eps o.2.2 z.1) (by split <;> positivity)
simp only [measureReal_def, atomLaw_singleton, ENNReal.toReal_ofReal (hm _)]
simp only [twoCellMass, hi, ↓reduceIte]
rw [Fintype.sum_prod_type]
simp only [Fintype.sum_bool]
simp [signVal]
ring
theorem twoCell_baseline_row_mean
Assume the stated hi condition. Averaging original records gives the baseline row's unconditional mean.
Formal statement
hypotheses
conclusion
= privacyDelta eps * (2 * baseline P - 1)
Proof (Lean source)
-- @node: twoCell_baseline_row_mean
lemma twoCell_baseline_row_mean (n d : ℕ) (eps : ℝ)
(i : Fin n) (hi : i.val < (n / 2))
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] :
(∫ z, signVal z.1 ∂(observedLaw P).bind (twoCellKernel n d eps i)) =
privacyDelta eps * (2 * baseline P - 1) := by
letI := twoCellKernel_markov n d eps i
letI : IsProbabilityMeasure (observedLaw P) :=
Measure.isProbabilityMeasure_map (by fun_prop)
change (∫ z, signVal z.1
∂((twoCellKernel n d eps i) ∘ₖ Kernel.const Unit (observedLaw P)) ()) = _
rw [Kernel.integral_comp Integrable.of_finite]
simp_rw [twoCellKernel_baseline_sign_mean n d eps i hi]
rw [integral_const_mul]
change privacyDelta eps * (∫ o, signVal o.2.2 ∂observedLaw P) = _
rw [observed_outcome_sign_mean]
theorem twoCell_averaged_row_probability
Averaging any attaining row over a probability input law preserves mass one.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: twoCell_averaged_row_probability
lemma twoCell_averaged_row_probability (n d : ℕ) (eps : ℝ)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (i : Fin n) :
IsProbabilityMeasure ((observedLaw P).bind (twoCellKernel n d eps i)) := by
letI := twoCellKernel_markov n d eps i
letI : IsProbabilityMeasure (observedLaw P) :=
Measure.isProbabilityMeasure_map (by fun_prop)
exact isProbabilityMeasure_bind (Kernel.measurable _).aemeasurable
(Filter.Eventually.of_forall (fun _ => inferInstance))
theorem twoCell_baseline_sum_moments
Assume the stated hg condition and the stated hbase condition. Distinct baseline rows have additive variances and the prescribed total mean.
Formal statement
hypotheses
n d k :
ℕ
eps :
ℝ
P :
hg :
hbase :
∀ i, (g i).val < (n / 2)
Proof (Lean source)
-- @node: twoCell_baseline_sum_moments
lemma twoCell_baseline_sum_moments {n d k : ℕ} (eps : ℝ)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(g : Fin k → Fin n) (hg : Injective g)
(hbase : ∀ i, (g i).val < (n / 2)) :
let L := Measure.pi (fun i => (observedLaw P).bind (twoCellKernel n d eps i))
(∫ z, ∑ i, signVal (z (g i)).1 ∂L) =
(k : ℝ) * (privacyDelta eps * (2 * baseline P - 1)) ∧
variance (fun z => ∑ i, signVal (z (g i)).1) L ≤ k := by
classical
let μ := fun i => (observedLaw P).bind (twoCellKernel n d eps i)
letI : ∀ i, IsProbabilityMeasure (μ i) :=
fun i => twoCell_averaged_row_probability n d eps P i
change (∫ z, ∑ i, signVal (z (g i)).1 ∂Measure.pi μ) = _ ∧ _
have hmean : ∀ i, (∫ z, signVal (z (g i)).1 ∂Measure.pi μ) =
privacyDelta eps * (2 * baseline P - 1) := by
intro i
rw [integral_comp_eval (μ := μ) (i := g i)
(f := fun z : FrontierMessage d => signVal z.1) (by fun_prop)]
exact twoCell_baseline_row_mean n d eps (g i) (hbase i) P
have hind := (iIndepFun_pi (μ := μ)
(X := fun (_ : Fin n) (z : FrontierMessage d) => signVal z.1)
(fun _ => (by fun_prop))).precomp hg
have hvar : ∀ i, variance (fun z => signVal (z (g i)).1) (Measure.pi μ) ≤ 1 := by
intro i
have h := variance_le_expectation_sq
(μ := Measure.pi μ) (X := fun z => signVal (z (g i)).1)
((show MemLp (fun z => signVal (z (g i)).1) 2 (Measure.pi μ)
from MemLp.of_discrete).aestronglyMeasurable)
have hs : ∀ z : Fin n → FrontierMessage d, (signVal (z (g i)).1)^2 = 1 := by
intro z
cases h : (z (g i)).1 <;> norm_num [signVal, h]
simpa [Pi.pow_apply, hs] using h
constructor
· rw [integral_finset_sum _ (fun _ _ => Integrable.of_finite)]
simp only [hmean, Finset.sum_const, Finset.card_univ, Fintype.card_fin, nsmul_eq_mul]
· have hv := IndepFun.variance_sum (s := univ)
(X := fun i z => signVal (z (g i)).1) (μ := Measure.pi μ)
(fun _ _ => MemLp.of_discrete) (fun i _ j _ hij => hind.indepFun hij)
change variance (fun z => ∑ i, signVal (z (g i)).1) (Measure.pi μ) ≤ _
have hv' : variance (fun z => ∑ i, signVal (z (g i)).1) (Measure.pi μ) =
∑ i, variance (fun z => signVal (z (g i)).1) (Measure.pi μ) := by
convert hv using 1
congr 1
funext z
simp
rw [hv']
calc
_ ≤ ∑ _i : Fin k, (1 : ℝ) := Finset.sum_le_sum (fun i _ => hvar i)
_ = _ := by simp
def twoCellBaselineEstimate
Fix the sample size and the dimension, the privacy budget, and the protocol transcript. First-half binary randomized-response estimate of the baseline.
Definition (Lean source)
parameters
def
twoCellBaselineEstimate n d eps z :
ℝ
given by
1/2
+ ((n / 2 : ℕ) : ℝ)⁻¹ * (∑ i : Fin (n / 2), signVal (z (castLE (Nat.div_le_self n 2) i)).1) / (2 * privacyDelta eps)
theorem twoCellBaselineEstimate_mse
Assume sample size at least two and a privacy budget in the interval from zero to one. The actual binary baseline estimate has the roadmap's finite-block MSE.
Formal statement
hypotheses
conclusion
(∫ z, (twoCellBaselineEstimate n d eps z - baseline P)^2 ∂Measure.pi (fun i => (observedLaw P).bind (twoCellKernel n d eps i)))
≤ 1 / (4 * (n / 2 : ℕ) * (privacyDelta eps)^2)
Proof (Lean source)
-- @node: twoCellBaselineEstimate_mse
lemma twoCellBaselineEstimate_mse (n d : ℕ) (eps : ℝ)
(hn2 : 2 ≤ n) (heps : eps ∈ Ioc 0 1)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] :
(∫ z, (twoCellBaselineEstimate n d eps z - baseline P)^2
∂Measure.pi (fun i => (observedLaw P).bind (twoCellKernel n d eps i))) ≤
1 / (4 * (n / 2 : ℕ) * (privacyDelta eps)^2) := by
classical
let m0 := (n / 2)
have hm0 : 0 < m0 := by dsimp [m0]; omega
have hm0r : (0 : ℝ) < m0 := by exact_mod_cast hm0
have hdelta : 0 < privacyDelta eps := by
have h := privacyDelta_lower_quarter eps heps
linarith [heps.1]
let g : Fin m0 → Fin n := castLE (Nat.div_le_self n 2)
let f : (Fin n → FrontierMessage d) → ℝ := fun z => ∑ i, signVal (z (g i)).1
let L := Measure.pi (fun i => (observedLaw P).bind (twoCellKernel n d eps i))
let c : ℝ := (m0 : ℝ)⁻¹ / (2 * privacyDelta eps)
letI : ∀ i, IsProbabilityMeasure ((observedLaw P).bind (twoCellKernel n d eps i)) :=
fun i => twoCell_averaged_row_probability n d eps P i
obtain ⟨hmean, hvar⟩ := twoCell_baseline_sum_moments eps P g
(by intro i j h; apply Fin.ext; exact congrArg (fun x : Fin n => x.val) h)
(fun i => i.isLt)
change (∫ z, f z ∂L) = (m0 : ℝ) * (privacyDelta eps * (2 * baseline P - 1)) at hmean
change variance f L ≤ (m0 : ℝ) at hvar
have hrepr : ∀ z : Fin n → FrontierMessage d,
twoCellBaselineEstimate n d eps z - baseline P = c * (f z - ∫ w, f w ∂L) := by
intro z
dsimp only [twoCellBaselineEstimate]
rw [hmean]
dsimp [c, f, g]
change 1/2 + (m0 : ℝ)⁻¹ * (∑ i : Fin m0, signVal (z (castLE _ i)).1) /
(2 * privacyDelta eps) - baseline P = _
field_simp
<;> ring
have hv : (∫ z, (twoCellBaselineEstimate n d eps z - baseline P)^2 ∂L) =
c^2 * variance f L := by
simp_rw [hrepr, mul_pow]
rw [integral_const_mul, variance_eq_integral (by fun_prop)]
change (∫ z, (twoCellBaselineEstimate n d eps z - baseline P)^2 ∂L) ≤ _
rw [hv]
calc
_ ≤ c^2 * m0 := mul_le_mul_of_nonneg_left hvar (sq_nonneg c)
_ = _ := by
dsimp [c]
change ((m0 : ℝ)⁻¹ / (2 * privacyDelta eps))^2 * m0 =
1 / (4 * m0 * (privacyDelta eps)^2)
field_simp
<;> ring
theorem twoCellKernel_vector_marginal
Assume the stated hi condition. A vector-release row has exactly the signed-vector marginal.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: twoCellKernel_vector_marginal
lemma twoCellKernel_vector_marginal (n d : ℕ) (eps : ℝ)
(i : Fin n) (hi : (n / 2) ≤ i.val) (o : ObsRecord d) :
(twoCellKernel n d eps i o).map snd = vectorKernel d eps o := by
classical
apply Measure.ext
intro E hE
rw [Measure.map_apply measurable_snd hE]
change atomLaw (twoCellMass n d eps i o) (snd ⁻¹' E) =
atomLaw (vectorMass eps o) E
simp only [twoCellMass, not_lt.mpr hi, ↓reduceIte, atomLaw,
Measure.finsetSum_apply, Measure.smul_apply, smul_eq_mul,
Measure.dirac_apply' _ (measurable_snd hE),
Measure.dirac_apply' _ hE]
rw [Fintype.sum_prod_type]
simp [indicator, Set.mem_preimage]
theorem twoCell_averaged_vector_marginal
Assume the stated hi condition. Averaging inputs preserves the vector marginal of every vector-release row.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: twoCell_averaged_vector_marginal
lemma twoCell_averaged_vector_marginal (n d : ℕ) (eps : ℝ)
(i : Fin n) (hi : (n / 2) ≤ i.val)
(P : Measure (FullRecord d)) :
((observedLaw P).bind (twoCellKernel n d eps i)).map snd =
vectorMessageLaw P eps := by
apply Measure.ext
intro E hE
rw [Measure.map_apply measurable_snd hE]
unfold vectorMessageLaw
rw [Measure.bind_apply (measurable_snd hE) (Kernel.measurable _).aemeasurable,
Measure.bind_apply hE (Kernel.measurable _).aemeasurable]
apply lintegral_congr
intro o
have h := congrArg (fun L => L E) (twoCellKernel_vector_marginal n d eps i hi o)
rw [Measure.map_apply measurable_snd hE] at h
exact h
theorem twoCell_vector_selection_law
Assume the stated hg condition and the stated hvec condition. Selecting distinct vector-release rows yields independent vector messages.
Formal statement
hypotheses
n d k :
ℕ
eps :
ℝ
P :
hg :
hvec :
∀ i, (n / 2) ≤ (g i).val
conclusion
= vectorBlockLaw P eps k
Proof (Lean source)
-- @node: twoCell_vector_selection_law
lemma twoCell_vector_selection_law {n d k : ℕ} (eps : ℝ)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(g : Fin k → Fin n) (hg : Injective g)
(hvec : ∀ i, (n / 2) ≤ (g i).val) :
(Measure.pi (fun i => (observedLaw P).bind (twoCellKernel n d eps i))).map
(fun z i => (z (g i)).2) = vectorBlockLaw P eps k := by
have : IsProbabilityMeasure (observedLaw P) :=
Measure.isProbabilityMeasure_map (show Measurable observe by fun_prop).aemeasurable
have : ∀ i, IsMarkovKernel (twoCellKernel n d eps i) := by
intro i
exact ⟨fun o => (twoCellStage_markov n d eps i).isProbabilityMeasure
((o,(0 : Fin 1)), fun _ => (false,fun _ => false))⟩
have : ∀ i, IsProbabilityMeasure ((observedLaw P).bind (twoCellKernel n d eps i)) :=
fun i => isProbabilityMeasure_bind (Kernel.measurable _).aemeasurable
(Filter.Eventually.of_forall (fun _ => inferInstance))
have hind := (iIndepFun_pi
(μ := fun i => (observedLaw P).bind (twoCellKernel n d eps i))
(X := fun (_ : Fin n) (z : FrontierMessage d) => z.2)
(fun _ => measurable_snd.aemeasurable)).precomp hg
have hlaw := hind.map_fun_eq_pi_map
(fun i => (measurable_snd.comp (measurable_pi_apply (g i))).aemeasurable)
refine hlaw.trans ?_
unfold vectorBlockLaw
congr 1
funext i
have hmap := (measurePreserving_eval
(fun i => (observedLaw P).bind (twoCellKernel n d eps i)) (g i)).map_eq
rw [← Measure.map_map measurable_snd (measurable_pi_apply (g i)), hmap]
exact twoCell_averaged_vector_marginal n d eps (g i) (hvec i) P
def twoCellVectorBlock
Fix the sample size and the dimension, the privacy budget, and the protocol transcript. The remaining vector rows, indexed without unused messages.
Definition (Lean source)
parameters
given by
fun i => (z ⟨n / 2 + i.val, by have := Nat.div_le_self n 2; omega⟩).2
theorem twoCellVectorBlock_law
The remaining people have the calibrated iid vector-block law.
Formal statement
hypotheses
conclusion
(Measure.pi (fun i => (observedLaw P).bind (twoCellKernel n d eps i))).map (twoCellVectorBlock n d eps)
= vectorBlockLaw P eps (n - n / 2)
Proof (Lean source)
-- @node: twoCellVectorBlock_law
lemma twoCellVectorBlock_law (n d : ℕ) (eps : ℝ)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] :
(Measure.pi (fun i => (observedLaw P).bind (twoCellKernel n d eps i))).map
(twoCellVectorBlock n d eps) = vectorBlockLaw P eps (n - n / 2) := by
let g : Fin (n - n / 2) → Fin n := fun i =>
⟨n / 2 + i.val, by have := Nat.div_le_self n 2; omega⟩
exact twoCell_vector_selection_law eps P g
(by intro i j h; apply Fin.ext; have := congrArg val h; dsimp [g] at this; omega)
(fun i => by dsimp [g]; omega)
def twoCellContrastEstimate
Fix the sample size and the dimension, the privacy budget, the coordinate index, and the protocol transcript. Each estimated contrast uses the mean of the last block's scaled coordinate.
Definition (Lean source)
parameters
def
twoCellContrastEstimate n d eps j z :
ℝ
given by
scaledColumnMean eps j (twoCellVectorBlock n d eps z)
theorem twoCellContrastEstimate_mse
Assume the stated allowed condition and the causal-model conditions for the data law. The two vector coordinates have the exact finite-block MSE order in the roadmap.
Formal statement
hypotheses
conclusion
(∫ z, (twoCellContrastEstimate n 2 eps j z - contrast P j)^2 ∂Measure.pi (fun i => (observedLaw P).bind (twoCellKernel n 2 eps i)))
≤ 4 / ((n - n / 2 : ℕ) * (privacyDelta eps)^2)
Proof (Lean source)
-- @node: twoCellContrastEstimate_mse
lemma twoCellContrastEstimate_mse (n : ℕ) (eps : ℝ) (hAllowed : Allowed n 2 eps)
(P : Measure (FullRecord 2)) [IsProbabilityMeasure P] (hP : CausalModel P)
(j : Fin 2) :
(∫ z, (twoCellContrastEstimate n 2 eps j z - contrast P j)^2
∂Measure.pi (fun i => (observedLaw P).bind (twoCellKernel n 2 eps i))) ≤
4 / ((n - n / 2 : ℕ) * (privacyDelta eps)^2) := by
have hm : 0 < n - n / 2 := by have := hAllowed.1; omega
have hcol : blockMean (m := n - n / 2) P eps
(fun z => (scaledColumnMean eps j z - contrast P j)^2) ≤
sigmaSquared 2 (n - n / 2) eps := by
rw [blockMean_sq_error_eq_variance_add_bias,
blockMean_scaledColumnMean P hP eps hAllowed.2.2.1 (by norm_num) hm]
simpa using blockVar_scaledColumnMean_le P hP eps hAllowed.2.2.1 (by norm_num) hm j
have heq := integral_map (μ := Measure.pi
(fun i => (observedLaw P).bind (twoCellKernel n 2 eps i)))
(φ := twoCellVectorBlock n 2 eps)
(f := fun z => (scaledColumnMean eps j z - contrast P j)^2)
(by fun_prop) (by fun_prop)
erw [twoCellVectorBlock_law n 2 eps P] at heq
change (∫ z, (twoCellContrastEstimate n 2 eps j z - contrast P j)^2 ∂_) ≤ _
erw [← heq]
exact hcol.trans (by dsimp [sigmaSquared, noiseScale]; field_simp; norm_num)
def twoCellTranscriptEstimator
Fix the sample size and the dimension, the privacy budget, and the function f. Lift any finite transcript statistic to a Borel transcript-only decision.
Definition (Lean source)
parameters
def
given by
⟨fun w
=> f w.1, by letI : Countable (ProtocolTranscript (twoCellProtocol n d eps)) := by change Countable (Fin n → FrontierMessage d) infer_instance letI : MeasurableSingletonClass (ProtocolTranscript (twoCellProtocol n d eps)) := by change MeasurableSingletonClass (Fin n → FrontierMessage d) infer_instance have hf : Measurable f := measurable_of_countable f exact hf.comp measurable_fst⟩
theorem twoCellTranscriptEstimator_transcriptOnly
The lifted decision uses only the finite transcript.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: twoCellTranscriptEstimator_transcriptOnly
lemma twoCellTranscriptEstimator_transcriptOnly (n d : ℕ) (eps : ℝ)
(f : ProtocolTranscript (twoCellProtocol n d eps) → ℝ) :
TranscriptOnly (twoCellProtocol n d eps) (twoCellTranscriptEstimator n d eps f) := by
letI : Countable (ProtocolTranscript (twoCellProtocol n d eps)) := by
change Countable (Fin n → FrontierMessage d)
infer_instance
letI : MeasurableSingletonClass (ProtocolTranscript (twoCellProtocol n d eps)) := by
change MeasurableSingletonClass (Fin n → FrontierMessage d)
infer_instance
exact ⟨f, measurable_of_countable f, fun _ => rfl⟩
theorem twoCellTranscriptEstimator_risk_product
Assume independent and identically distributed participant records, independent protocol randomness, and the causal-model conditions for the data law. Sampling MSEs of finite transcript statistics equal their product-law MSEs.
Formal statement
hypotheses
n d :
ℕ
eps :
ℝ
S :
SamplingScheme n d
hIID :
hRandom :
P :
hP :
f :
ProtocolTranscript (twoCellProtocol n d eps) → ℝ
v :
ℝ
conclusion
Proof (Lean source)
-- @node: twoCellTranscriptEstimator_risk_product
lemma twoCellTranscriptEstimator_risk_product (n d : ℕ) (eps : ℝ)
(S : SamplingScheme n d) (hIID : IidPeople S) (hRandom : IndependentRandomness S)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P)
(f : ProtocolTranscript (twoCellProtocol n d eps) → ℝ) (v : ℝ) :
squaredRisk (decisionLaw S (twoCellProtocol n d eps) P)
(twoCellTranscriptEstimator n d eps f) v =
ofReal (∫ z, (f z - v)^2
∂Measure.pi (fun i => (observedLaw P).bind (twoCellKernel n d eps i))) := by
let L := Measure.pi (fun i => (observedLaw P).bind (twoCellKernel n d eps i))
letI : ∀ i, IsProbabilityMeasure ((observedLaw P).bind (twoCellKernel n d eps i)) :=
fun i => twoCell_averaged_row_probability n d eps P i
letI : Countable (ProtocolTranscript (twoCellProtocol n d eps)) := by
change Countable (Fin n → FrontierMessage d)
infer_instance
letI : MeasurableSingletonClass (ProtocolTranscript (twoCellProtocol n d eps)) := by
change MeasurableSingletonClass (Fin n → FrontierMessage d)
infer_instance
have hf : Measurable (fun z => ofReal ((f z - v)^2)) :=
measurable_of_countable _
have htrans := twoCell_sampling_transcript_product n d eps S hIID hRandom P hP
rw [ofReal_integral_eq_lintegral_ofReal (Integrable.of_finite)
(Filter.Eventually.of_forall (fun _ => sq_nonneg _))]
rw [← htrans]
erw [lintegral_map hf measurable_fst]
rfl
theorem twoCellComponents_of_sampling
Assume the stated allowed condition, independent and identically distributed participant records, and independent protocol randomness. The explicit binary/vector half-block construction supplies all three MSEs.
Formal statement
hypotheses
conclusion
TwoCellComponents S eps
Proof (Lean source)
-- @node: twoCellComponents_of_sampling
lemma twoCellComponents_of_sampling (n : ℕ) (eps : ℝ) (hAllowed : Allowed n 2 eps)
(S : SamplingScheme n 2) (hIID : IidPeople S) (hRandom : IndependentRandomness S) :
TwoCellComponents S eps := by
refine ⟨twoCellProtocol n 2 eps,
twoCellProtocol_noninteractive n 2 eps hAllowed.2.2.1.le,
?_, twoCellTranscriptEstimator n 2 eps (twoCellBaselineEstimate n 2 eps),
twoCellTranscriptEstimator n 2 eps (twoCellContrastEstimate n 2 eps 0),
twoCellTranscriptEstimator n 2 eps (twoCellContrastEstimate n 2 eps 1),
twoCellTranscriptEstimator_transcriptOnly n 2 eps _,
twoCellTranscriptEstimator_transcriptOnly n 2 eps _,
twoCellTranscriptEstimator_transcriptOnly n 2 eps _, ?_⟩
· intro i
change Finite (FrontierMessage 2)
infer_instance
· intro P hP
letI := hP.1
simp only [twoCellTranscriptEstimator_risk_product n 2 eps S hIID hRandom P hP.2]
exact ⟨ENNReal.ofReal_le_ofReal
(twoCellBaselineEstimate_mse n 2 eps hAllowed.1 hAllowed.2.2 P),
ENNReal.ofReal_le_ofReal (twoCellContrastEstimate_mse n eps hAllowed P hP.2 0),
ENNReal.ofReal_le_ofReal (twoCellContrastEstimate_mse n eps hAllowed P hP.2 1)⟩
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.TwoCellError 11 declarations Projection and the absolute-value inequality turn the baseline and two coordinate mean-square errors into the two-cell value error.
Two-cell error assembly
Projection and the absolute-value inequality turn the baseline and two coordinate mean-square errors into the two-cell value error. This argument does not require independence between the coordinate estimates.
Fix the constant B and the real parameter x0 and the real parameter x1. The projected two-cell transcript estimate specified in the calibration proof.
Assume the stated hv condition. Projection onto the causal target interval cannot increase squared error.
Formal statement
Proof (Lean source)
-- @node: twoCell_projection_sq_le
lemma twoCell_projection_sq_le (x v : ℝ) (hv : v ∈ Icc (1/4 : ℝ) (3/4)) :
(max (1/4 : ℝ) (min (3/4) x) - v)^2 ≤ (x - v)^2 := by
by_cases hxlo : x ≤ 1/4
· rw [min_eq_right (by linarith), max_eq_left hxlo]
nlinarith [hv.1]
· by_cases hxhi : 3/4 ≤ x
· rw [min_eq_left hxhi, max_eq_right (by norm_num)]
nlinarith [hv.2]
· rw [min_eq_right (le_of_not_ge hxhi), max_eq_right (le_of_not_ge hxlo)]
theorem twoCellValueEstimate_sq_error
Assume the stated hv condition. The two absolute contrast errors cost at most one quarter of their squared errors in the value MSE, after combining with the baseline error.
Formal statement
hypotheses
B x0 x1 b t0 t1 :
ℝ
hv :
b + (|t0| + |t1|)/4 ∈ Icc (1/4 : ℝ) (3/4)
conclusion
(twoCellValueEstimate B x0 x1 - (b + (|t0| + |t1|)/4))^2
≤ 2*(B-b)^2 + ((x0-t0)^2 + (x1-t1)^2)/4
Proof (Lean source)
-- @node: twoCellValueEstimate_sq_error
lemma twoCellValueEstimate_sq_error (B x0 x1 b t0 t1 : ℝ)
(hv : b + (|t0| + |t1|)/4 ∈ Icc (1/4 : ℝ) (3/4)) :
(twoCellValueEstimate B x0 x1 - (b + (|t0| + |t1|)/4))^2 ≤
2*(B-b)^2 + ((x0-t0)^2 + (x1-t1)^2)/4 := by
have h0 := abs_abs_sub_abs_le_abs_sub x0 t0
have h1 := abs_abs_sub_abs_le_abs_sub x1 t1
have hs0 : (|x0|-|t0|)^2 ≤ (x0-t0)^2 := by
nlinarith [sq_abs (|x0|-|t0|), sq_abs (x0-t0),
abs_nonneg (|x0|-|t0|), abs_nonneg (x0-t0)]
have hs1 : (|x1|-|t1|)^2 ≤ (x1-t1)^2 := by
nlinarith [sq_abs (|x1|-|t1|), sq_abs (x1-t1),
abs_nonneg (|x1|-|t1|), abs_nonneg (x1-t1)]
apply (twoCell_projection_sq_le _ _ hv).trans
nlinarith [sq_nonneg ((|x0|-|t0|)-(|x1|-|t1|)),
sq_nonneg ((B-b)-((|x0|-|t0|)+(|x1|-|t1|))/4)]
theorem twoCellValueEstimate_mse_le
Assume measurability of b, measurability of x0, measurability of x1, and the stated hv condition. Integrating the pointwise assembly gives a bound from the three component MSEs.
Formal statement
hypotheses
Ω :
Type*
L :
Measure Ω
B x0 x1 :
Ω → ℝ
hB :
hx0 :
Measurable x0
hx1 :
Measurable x1
b t0 t1 :
ℝ
hv :
b + (|t0| + |t1|)/4 ∈ Icc (1/4 : ℝ) (3/4)
Proof (Lean source)
-- @node: twoCellValueEstimate_mse_le
lemma twoCellValueEstimate_mse_le {Ω : Type*} [MeasurableSpace Ω]
(L : Measure Ω) (B x0 x1 : Ω → ℝ)
(hB : Measurable B) (hx0 : Measurable x0) (hx1 : Measurable x1)
(b t0 t1 : ℝ) (hv : b + (|t0| + |t1|)/4 ∈ Icc (1/4 : ℝ) (3/4)) :
(∫⁻ w, ofReal
((twoCellValueEstimate (B w) (x0 w) (x1 w) - (b + (|t0| + |t1|)/4))^2) ∂L) ≤
2 * (∫⁻ w, ofReal ((B w-b)^2) ∂L) +
ofReal (1/4 : ℝ) *
((∫⁻ w, ofReal ((x0 w-t0)^2) ∂L) +
(∫⁻ w, ofReal ((x1 w-t1)^2) ∂L)) := by
have hsplit (w : Ω) :
ofReal (2*(B w-b)^2 + ((x0 w-t0)^2 + (x1 w-t1)^2)/4) =
2 * ofReal ((B w-b)^2) + ofReal (1/4 : ℝ) *
(ofReal ((x0 w-t0)^2) + ofReal ((x1 w-t1)^2)) := by
rw [ENNReal.ofReal_add (by positivity) (by positivity),
ENNReal.ofReal_mul (by norm_num : (0 : ℝ) ≤ 2)]
rw [div_eq_mul_inv, mul_comm _ (4 : ℝ)⁻¹,
ENNReal.ofReal_mul (by norm_num : (0 : ℝ) ≤ (4 : ℝ)⁻¹),
ENNReal.ofReal_add (sq_nonneg _) (sq_nonneg _)]
norm_num
calc
_ ≤ ∫⁻ w, ofReal (2*(B w-b)^2 + ((x0 w-t0)^2 + (x1 w-t1)^2)/4) ∂L :=
lintegral_mono (fun w => ENNReal.ofReal_le_ofReal
(twoCellValueEstimate_sq_error (B w) (x0 w) (x1 w) b t0 t1 hv))
_ = _ := by
simp_rw [hsplit]
rw [lintegral_add_left (by fun_prop), lintegral_const_mul _ (by fun_prop),
lintegral_const_mul _ (by fun_prop), lintegral_add_left (by fun_prop)]
theorem causal_value_two_cells
Assume the causal-model conditions for the data law. The bridge identifies the two-cell target used in the error calculation.
Formal statement
Proof (Lean source)
-- @node: causal_value_two_cells
lemma causal_value_two_cells (P : Measure (FullRecord 2)) [IsProbabilityMeasure P]
(hP : CausalModel P) :
value P = baseline P + (|contrast P 0| + |contrast P 1|)/4 := by
rw [causal_value_decomposition P hP (by norm_num)]
simp only [signedNorm, Fin.sum_univ_two]
norm_num
ring
Assume a privacy budget in the interval from zero to one. On the allowed privacy domain the randomized-response signal is at least ε/4.
Formal statement
Proof (Lean source)
-- @node: privacyDelta_lower_quarter
lemma privacyDelta_lower_quarter (eps : ℝ) (heps : eps ∈ Ioc 0 1) :
eps/4 ≤ privacyDelta eps := by
rw [privacyDelta_exp_formula]
apply (le_div_iff₀ (by positivity : 0 < exp eps + 1)).mpr
have hlo := Real.add_one_le_exp eps
have hhi : exp eps < 3 := (Real.exp_le_exp.mpr heps.2).trans_lt Real.exp_one_lt_three
nlinarith [heps.1]
Assume sample size at least two. The deterministic half split supplies the two lower block-size bounds.
Formal statement
hypotheses
n :
ℕ
hn :
2 ≤ n
conclusion
conclusion 1
0 < n/2
conclusion 2
(n : ℝ)/3 ≤ (n/2 : ℕ)
conclusion 3
(n : ℝ)/2 ≤ (n-n/2 : ℕ)
Proof (Lean source)
-- @node: two_cell_half_block_sizes
lemma two_cell_half_block_sizes (n : ℕ) (hn : 2 ≤ n) :
0 < n/2 ∧ (n : ℝ)/3 ≤ (n/2 : ℕ) ∧ (n : ℝ)/2 ≤ (n-n/2 : ℕ) := by
have h0 : 0 < n/2 := by omega
have h1 : n ≤ 3*(n/2) := by omega
have h2 : n ≤ 2*(n-n/2) := by omega
refine ⟨h0, ?_, ?_⟩
· have hr : (n : ℝ) ≤ 3*(n/2 : ℕ) := by exact_mod_cast h1
linarith
· have hr : (n : ℝ) ≤ 2*(n-n/2 : ℕ) := by exact_mod_cast h2
linarith
theorem two_cell_variance_calibration
Assume the stated allowed condition. The block MSE bounds yield the roadmap's finite numerical constant 88.
Formal statement
hypotheses
conclusion
1/(2*(n/2 : ℕ)*(privacyDelta eps)^2) + 2/((n-n/2 : ℕ)*(privacyDelta eps)^2)
≤ 88/((n : ℝ)*eps^2)
Proof (Lean source)
-- @node: two_cell_variance_calibration
lemma two_cell_variance_calibration (n : ℕ) (eps : ℝ) (hAllowed : Allowed n 2 eps) :
1/(2*(n/2 : ℕ)*(privacyDelta eps)^2) +
2/((n-n/2 : ℕ)*(privacyDelta eps)^2) ≤ 88/((n : ℝ)*eps^2) := by
have hn : (0 : ℝ) < n := by exact_mod_cast (by have := hAllowed.1; omega : 0 < n)
have heps := hAllowed.2.2.1
have hdelta := privacyDelta_lower_quarter eps hAllowed.2.2
have hd : 0 < privacyDelta eps := by linarith
obtain ⟨hm0, hm0bound, hm1bound⟩ := two_cell_half_block_sizes n hAllowed.1
have hm0pos : (0 : ℝ) < (n/2 : ℕ) := by exact_mod_cast hm0
have hm1pos : (0 : ℝ) < (n-n/2 : ℕ) := (by positivity : (0 : ℝ) < n/2).trans_le hm1bound
calc
_ ≤ 1/(2*((n : ℝ)/3)*(privacyDelta eps)^2) +
2/(((n : ℝ)/2)*(privacyDelta eps)^2) := by
apply add_le_add
· apply one_div_le_one_div_of_le (by positivity)
exact mul_le_mul_of_nonneg_right (by linarith) (sq_nonneg _)
· apply div_le_div_of_nonneg_left (by norm_num) (by positivity)
exact mul_le_mul_of_nonneg_right hm1bound (sq_nonneg _)
_ = 88/((n : ℝ)*(4*privacyDelta eps)^2) := by
field_simp
<;> ring
_ ≤ _ := by
apply div_le_div_of_nonneg_left (by norm_num) (by positivity)
apply mul_le_mul_of_nonneg_left _ hn.le
nlinarith
theorem measurable_twoCellValueEstimate
If the baseline and two contrast statistics are measurable, their two-cell projection is measurable.
Formal statement
hypotheses
conclusion
Measurable (fun w => twoCellValueEstimate (B w) (x0 w) (x1 w))
Proof (Lean source)
-- @node: measurable_twoCellValueEstimate
@[fun_prop] lemma measurable_twoCellValueEstimate {Ω : Type*} [MeasurableSpace Ω]
(B x0 x1 : Ω → ℝ) (hB : Measurable B) (hx0 : Measurable x0) (hx1 : Measurable x1) :
Measurable (fun w => twoCellValueEstimate (B w) (x0 w) (x1 w)) := by
unfold twoCellValueEstimate
fun_prop
def twoCellEstimator
Fix the local protocol Q and the estimator B and the estimator x0 and the estimator x1. Combine three transcript-only statistics into the projected two-cell estimate.
Definition (Lean source)
parameters
def
given by
⟨fun w
=> twoCellValueEstimate (B.1 w) (x0.1 w) (x1.1 w), measurable_twoCellValueEstimate B.1 x0.1 x1.1 B.2 x0.2 x1.2⟩
theorem two_cell_risk_of_component_mse
Assume the stated allowed condition, the causal-model conditions for the data law, the stated b condition, the stated hx0 condition, and the stated hx1 condition. Component binary/vector MSE bounds assemble into the uniform two-cell risk bound. The component estimates can be dependent: only their marginal MSEs enter.
Formal statement
hypotheses
n :
ℕ
eps :
ℝ
hAllowed :
Allowed n 2 eps
Q :
LocalProtocol n (ObsRecord 2)
L :
Measure (DecisionSpace Q)
B x0 x1 :
P :
hP :
hB :
hx0 :
squaredRisk L x0 (contrast P 0) ≤ ofReal (4/((n-n/2 : ℕ)*(privacyDelta eps)^2))
hx1 :
squaredRisk L x1 (contrast P 1) ≤ ofReal (4/((n-n/2 : ℕ)*(privacyDelta eps)^2))
conclusion
squaredRisk L (twoCellEstimator Q B x0 x1) (value P) ≤ ofReal (88/((n : ℝ)*eps^2))
Proof (Lean source)
-- @node: two_cell_risk_of_component_mse
lemma two_cell_risk_of_component_mse {n : ℕ} (eps : ℝ) (hAllowed : Allowed n 2 eps)
(Q : LocalProtocol n (ObsRecord 2)) (L : Measure (DecisionSpace Q))
(B x0 x1 : Estimator Q) (P : Measure (FullRecord 2)) [IsProbabilityMeasure P]
(hP : CausalModel P)
(hB : squaredRisk L B (baseline P) ≤
ofReal (1/(4*(n/2 : ℕ)*(privacyDelta eps)^2)))
(hx0 : squaredRisk L x0 (contrast P 0) ≤
ofReal (4/((n-n/2 : ℕ)*(privacyDelta eps)^2)))
(hx1 : squaredRisk L x1 (contrast P 1) ≤
ofReal (4/((n-n/2 : ℕ)*(privacyDelta eps)^2))) :
squaredRisk L (twoCellEstimator Q B x0 x1) (value P) ≤
ofReal (88/((n : ℝ)*eps^2)) := by
have hv := causal_value_range P hP (by norm_num)
rw [causal_value_two_cells P hP] at hv
have hsum := twoCellValueEstimate_mse_le L B.1 x0.1 x1.1 B.2 x0.2 x1.2
(baseline P) (contrast P 0) (contrast P 1) hv
have herror : squaredRisk L (twoCellEstimator Q B x0 x1) (value P) ≤
2*squaredRisk L B (baseline P) + ofReal (1/4 : ℝ)*
(squaredRisk L x0 (contrast P 0) + squaredRisk L x1 (contrast P 1)) := by
simpa only [squaredRisk, twoCellEstimator, causal_value_two_cells P hP] using hsum
apply herror.trans
calc
_ ≤ 2*ofReal (1/(4*(n/2 : ℕ)*(privacyDelta eps)^2)) +
ofReal (1/4 : ℝ)*
(ofReal (4/((n-n/2 : ℕ)*(privacyDelta eps)^2)) +
ofReal (4/((n-n/2 : ℕ)*(privacyDelta eps)^2))) :=
add_le_add (mul_le_mul' le_rfl hB) (mul_le_mul' le_rfl (add_le_add hx0 hx1))
_ = ofReal (1/(2*(n/2 : ℕ)*(privacyDelta eps)^2) +
2/((n-n/2 : ℕ)*(privacyDelta eps)^2)) := by
rw [show (2 : ℝ≥0∞) = ofReal (2 : ℝ) by norm_num]
rw [← ENNReal.ofReal_mul (by norm_num : (0 : ℝ) ≤ 2),
← ENNReal.ofReal_add (by positivity) (by positivity),
← ENNReal.ofReal_mul (by norm_num : (0 : ℝ) ≤ 1/4),
← ENNReal.ofReal_add (by positivity) (by positivity)]
congr 1
ring
_ ≤ _ := ENNReal.ofReal_le_ofReal (two_cell_variance_calibration n eps hAllowed)
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.TwoCellInterval 7 declarations The calibration roadmap uses radius √(10000/t) around the projected value estimate.
Two-cell finite honest intervals
The calibration roadmap uses radius √(10000/t) around the projected value estimate. Markov's inequality applied to the assembled 88/t MSE gives global ninety-percent coverage, and clipping gives length at most 200/√t.
Fix the sample size and the privacy budget. The deterministic radius in the two-cell calibration roadmap.
Definition (Lean source)
theorem twoCellEstimator_range
Projection keeps the two-cell estimate inside the causal target domain.
Formal statement
hypotheses
conclusion
(twoCellEstimator Q B x0 x1).1 w ∈ Icc (1 / 4 : ℝ) (3 / 4)
Proof (Lean source)
-- @node: twoCellEstimator_range
lemma twoCellEstimator_range {n : ℕ} (Q : LocalProtocol n (ObsRecord 2))
(B x0 x1 : Estimator Q) (w : DecisionSpace Q) :
(twoCellEstimator Q B x0 x1).1 w ∈ Icc (1 / 4 : ℝ) (3 / 4) := by
exact ⟨le_max_left _ _, max_le (by norm_num) (min_le_left _ _)⟩
def twoCellInterval
Fix the privacy budget, the local protocol Q, and the estimator B and the estimator x0 and the estimator x1. The clipped interval around the projected two-cell value estimate.
Definition (Lean source)
parameters
def
given by
clause 1
clause 2
clause 3
measurable_lo := by have hm := (twoCellEstimator Q B x0 x1).2; fun_prop
clause 4
measurable_hi := by have hm := (twoCellEstimator Q B x0 x1).2; fun_prop
clause 5
ordered := by intro w have hv := twoCellEstimator_range Q B x0 x1 w have hq : 0
≤ twoCellRadius n eps := Real.sqrt_nonneg _ apply le_trans (max_le hv.1 (by linarith)) (le_min hv.2 (by linarith))
clause 6
range_lo := by intro w have hv := twoCellEstimator_range Q B x0 x1 w have hq : 0
≤ twoCellRadius n eps := Real.sqrt_nonneg _ exact ⟨le_max_left _ _, max_le (by norm_num) (by linarith [hv.2])⟩
clause 7
range_hi := by intro w have hv := twoCellEstimator_range Q B x0 x1 w have hq : 0
≤ twoCellRadius n eps := Real.sqrt_nonneg _ exact ⟨le_min (by norm_num) (by linarith [hv.1]), min_le_left _ _⟩
theorem twoCellRadius_eq
Assume the stated allowed condition. The roadmap's radius is exactly 100 divided by the private square-root sample size.
Formal statement
hypotheses
conclusion
twoCellRadius n eps = 100 / (sqrt n * eps)
Proof (Lean source)
-- @node: twoCellRadius_eq
lemma twoCellRadius_eq (n : ℕ) (eps : ℝ) (hAllowed : Allowed n 2 eps) :
twoCellRadius n eps = 100 / (sqrt n * eps) := by
rw [twoCellRadius, Real.sqrt_div (by norm_num), Real.sqrt_mul (by positivity),
Real.sqrt_sq hAllowed.2.2.1.le,
show (10000 : ℝ) = 100^2 by norm_num, Real.sqrt_sq (by norm_num : (0 : ℝ) ≤ 100)]
theorem twoCellInterval_length_le
Clipping bounds the interval length pointwise by twice the radius.
Formal statement
hypotheses
conclusion
≤ 2 * twoCellRadius n eps
Proof (Lean source)
-- @node: twoCellInterval_length_le
lemma twoCellInterval_length_le {n : ℕ} (eps : ℝ) (Q : LocalProtocol n (ObsRecord 2))
(B x0 x1 : Estimator Q) (w : DecisionSpace Q) :
intervalLength ((twoCellInterval eps Q B x0 x1).lo w)
((twoCellInterval eps Q B x0 x1).hi w) ≤ 2 * twoCellRadius n eps := by
change max 0 (min (3 / 4) (_ + twoCellRadius n eps) -
max (1 / 4) (_ - twoCellRadius n eps)) ≤ _
apply max_le
· exact mul_nonneg (by norm_num) (Real.sqrt_nonneg _)
· have hu := min_le_right (3 / 4 : ℝ)
((twoCellEstimator Q B x0 x1).1 w + twoCellRadius n eps)
have hl := le_max_right (1 / 4 : ℝ)
((twoCellEstimator Q B x0 x1).1 w - twoCellRadius n eps)
linarith
theorem twoCellInterval_expectedLength_le
Assume the stated allowed condition. The finite expected length has the asserted 200/√t bound.
Formal statement
hypotheses
conclusion
expectedLength L (twoCellInterval eps Q B x0 x1)
Proof (Lean source)
-- @node: twoCellInterval_expectedLength_le
lemma twoCellInterval_expectedLength_le {n : ℕ} (eps : ℝ) (hAllowed : Allowed n 2 eps)
(Q : LocalProtocol n (ObsRecord 2)) (B x0 x1 : Estimator Q)
(L : Measure (DecisionSpace Q)) [IsProbabilityMeasure L] :
expectedLength L (twoCellInterval eps Q B x0 x1) ≤
ofReal (200 / (sqrt n * eps)) := by
have heq : 2 * twoCellRadius n eps = 200 / (sqrt n * eps) := by
rw [twoCellRadius_eq n eps hAllowed]
ring
rw [← heq]
unfold expectedLength
calc
_ ≤ ∫⁻ _w, ofReal (2 * twoCellRadius n eps) ∂L :=
lintegral_mono (fun w => ENNReal.ofReal_le_ofReal
(twoCellInterval_length_le eps Q B x0 x1 w))
_ = _ := by simp
theorem twoCellInterval_coverage_of_risk
Assume the stated allowed condition, the stated hv condition, and the estimator hRisk. The assembled MSE implies finite global ninety-percent coverage by Markov's inequality.
Formal statement
hypotheses
n :
ℕ
eps :
ℝ
hAllowed :
Allowed n 2 eps
Q :
LocalProtocol n (ObsRecord 2)
B x0 x1 :
L :
v :
ℝ
hv :
v ∈ Icc (1 / 4 : ℝ) (3 / 4)
hRisk :
squaredRisk L (twoCellEstimator Q B x0 x1) v ≤ ofReal (88 / ((n : ℝ) * eps ^ 2))
conclusion
(0.90 : ℝ) ≤ coverage L (twoCellInterval eps Q B x0 x1) v
Proof (Lean source)
-- @node: twoCellInterval_coverage_of_risk
lemma twoCellInterval_coverage_of_risk {n : ℕ} (eps : ℝ) (hAllowed : Allowed n 2 eps)
(Q : LocalProtocol n (ObsRecord 2)) (B x0 x1 : Estimator Q)
(L : Measure (DecisionSpace Q)) [IsProbabilityMeasure L]
(v : ℝ) (hv : v ∈ Icc (1 / 4 : ℝ) (3 / 4))
(hRisk : squaredRisk L (twoCellEstimator Q B x0 x1) v ≤
ofReal (88 / ((n : ℝ) * eps ^ 2))) :
(0.90 : ℝ) ≤ coverage L (twoCellInterval eps Q B x0 x1) v := by
let q := twoCellRadius n eps
have hn : (0 : ℝ) < n := by exact_mod_cast (by have := hAllowed.1; omega : 0 < n)
have ht : 0 < (n : ℝ) * eps ^ 2 := mul_pos hn (sq_pos_of_pos hAllowed.2.2.1)
have hq : 0 < q := Real.sqrt_pos.mpr (div_pos (by norm_num) ht)
have hq2 : q ^ 2 = 10000 / ((n : ℝ) * eps ^ 2) := Real.sq_sqrt (by positivity)
let f := fun w : DecisionSpace Q =>
ofReal (((twoCellEstimator Q B x0 x1).1 w - v)^2)
have hf : Measurable f := by
have hm := (twoCellEstimator Q B x0 x1).2
dsimp [f]
fun_prop
have hm := mul_meas_ge_le_lintegral (μ := L) hf (ofReal (q ^ 2))
have hm' : ofReal (q ^ 2) * L {w | ofReal (q ^ 2) ≤ f w} ≤
ofReal (88 / ((n : ℝ) * eps ^ 2)) := hm.trans hRisk
have hmR := ENNReal.toReal_mono ENNReal.ofReal_ne_top hm'
rw [ENNReal.toReal_mul, ENNReal.toReal_ofReal (sq_nonneg q),
ENNReal.toReal_ofReal (by positivity)] at hmR
let E := coverageEvent (twoCellInterval eps Q B x0 x1).lo
(twoCellInterval eps Q B x0 x1).hi v
have hE : MeasurableSet E := measurableSet_coverageEvent
(twoCellInterval eps Q B x0 x1).measurable_lo
(twoCellInterval eps Q B x0 x1).measurable_hi
have hsub : Eᶜ ⊆ {w | ofReal (q ^ 2) ≤ f w} := by
intro w hw
have herr : q < |(twoCellEstimator Q B x0 x1).1 w - v| := by
by_contra hh
have ha := abs_le.mp (le_of_not_gt hh)
apply hw
change max (1 / 4) ((twoCellEstimator Q B x0 x1).1 w - q) ≤ v ∧
v ≤ min (3 / 4) ((twoCellEstimator Q B x0 x1).1 w + q)
exact ⟨max_le hv.1 (by linarith [ha.2]), le_min hv.2 (by linarith [ha.1])⟩
apply ENNReal.ofReal_le_ofReal
nlinarith [sq_abs ((twoCellEstimator Q B x0 x1).1 w - v)]
have hmono := measureReal_mono (μ := L) hsub
have hbad : L.real Eᶜ ≤ (1 / 10 : ℝ) := by
have hmR' : q ^ 2 * L.real {w | ofReal (q ^ 2) ≤ f w} ≤ q ^ 2 / 10 := by
calc
_ ≤ 88 / ((n : ℝ) * eps ^ 2) := hmR
_ ≤ q ^ 2 / 10 := by
rw [hq2]
have heq : 10000 / ((n : ℝ) * eps ^ 2) / 10 = 1000 / ((n : ℝ) * eps ^ 2) := by ring
rw [heq]
exact (div_le_div_iff_of_pos_right ht).mpr (by norm_num)
have hpos : 0 < q ^ 2 := sq_pos_of_pos hq
nlinarith
rw [measureReal_compl hE, probReal_univ] at hbad
change (0.90 : ℝ) ≤ L.real E
linarith
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.TwoCellProtocol 11 declarations The two-cell construction assigns the first half of people to binary outcome releases and the remaining people to signed-vector releases.
Half-block binary/vector protocol
The two-cell construction assigns the first half of people to binary outcome releases and the remaining people to signed-vector releases. All rows are total, private, and independent of histories; their sampling transcript has product law.
Fix the sample size and the dimension, the privacy budget, the participant index, the observed participant record, and the parameter z. Original-input participant-specific finite atom channel.
Definition (Lean source)
parameters
def
twoCellMass n d eps i o z :
ℝ
given by
if i.val < (n / 2) then (1+privacyDelta eps*signVal o.2.2*signVal z.1)/2 * (if z.2 = (fun _ => false) then 1 else 0) else vectorMass eps o z.2 * (if z.1 = false then 1 else 0)
Fix the sample size and the dimension, the privacy budget, and the participant index. Finite participant channel ignoring histories.
Definition (Lean source)
Fix the sample size and the dimension, the privacy budget, and the participant index. Participant stage with ignored histories.
Definition (Lean source)
parameters
def
twoCellStageKernel n d eps i :
Kernel ((ObsRecord d × Fin 1) × History (fun _ : Fin n => FrontierMessage d) i.val (le_of_lt i.isLt)) (FrontierMessage d)
given by
(twoCellKernel n d eps i).comap (fun w => w.1.1) (measurable_fst.comp measurable_fst)
theorem twoCellStage_markov
Stage Markov certificate.
Formal statement
Proof (Lean source)
-- @node: twoCellStage_markov
lemma twoCellStage_markov (n d : ℕ) (eps : ℝ) (i : Fin n) :
IsMarkovKernel (twoCellStageKernel n d eps i) := by
classical
have hm : ∀ o z, 0 ≤ twoCellMass n d eps i o z := by
intro o z
unfold twoCellMass
split
· exact mul_nonneg (binaryOutcomeMass_nonneg eps o.2.2 z.1) (by split <;> positivity)
· exact mul_nonneg (vectorMass_nonneg eps o z.2) (by split <;> positivity)
have hs : ∀ o, ∑ z, twoCellMass n d eps i o z = 1 := by
intro o
unfold twoCellMass
by_cases hi : i.val < n / 2
· simp only [hi, ↓reduceIte]
rw [Fintype.sum_prod_type]
simp only [← Finset.mul_sum]
simpa [Fintype.sum_bool] using binaryOutcomeMass_sum eps o.2.2
· simp only [hi, ↓reduceIte]
rw [Fintype.sum_prod_type]
simp [vectorMass_sum]
have hk : IsMarkovKernel (twoCellKernel n d eps i) := by
constructor
intro o
constructor
change atomLaw _ univ = 1
simp only [atomLaw, Measure.finsetSum_apply, MeasurableSet.univ,
Measure.smul_apply, Measure.dirac_apply_of_mem, Set.mem_univ, smul_eq_mul, mul_one]
rw [← ENNReal.ofReal_sum_of_nonneg (fun z _ => hm o z), hs]
simp
letI := hk
unfold twoCellStageKernel
infer_instance
def twoCellProtocol
Fix the sample size and the dimension and the privacy budget. Explicit noninteractive original-record attaining protocol.
Definition (Lean source)
parameters
n d :
ℕ
eps :
ℝ
def
given by
clause 1
Seed := Fin 1
clause 2
seedMeasurable := inferInstance
clause 3
seedStandard := inferInstance
clause 4
seedLaw := Measure.dirac 0
clause 5
seedProbability := inferInstance
clause 6
Message := fun _ => FrontierMessage d
clause 7
messageMeasurable := fun _ => inferInstance
clause 8
messageStandard := fun _ => inferInstance
clause 9
kernels := twoCellStageKernel n d eps
clause 10
markov := twoCellStage_markov n d eps
theorem twoCellMass_privacy
Assume a nonnegative privacy budget. Each branch of the combined finite message channel satisfies the atomwise privacy bound.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: twoCellMass_privacy
lemma twoCellMass_privacy (n d : ℕ) (eps : ℝ) (heps : 0 ≤ eps)
(i : Fin n) (o o' : ObsRecord d) (z : FrontierMessage d) :
twoCellMass n d eps i o z ≤ exp eps * twoCellMass n d eps i o' z := by
unfold twoCellMass
by_cases hi : i.val < n / 2
· simp only [hi, ↓reduceIte]
split_ifs
· simpa using binaryOutcomeMass_privacy eps heps o.2.2 o'.2.2 z.1
· simp
· simp only [hi, ↓reduceIte]
split_ifs
· simpa using vectorMass_privacy eps heps o o' z.2
· simp
theorem twoCellKernel_privacy
Assume a nonnegative privacy budget. Summing the finite atom inequalities proves privacy for every message event.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: twoCellKernel_privacy
lemma twoCellKernel_privacy (n d : ℕ) (eps : ℝ) (heps : 0 ≤ eps)
(i : Fin n) (o o' : ObsRecord d) (E : Set (FrontierMessage d)) :
twoCellKernel n d eps i o E ≤
ofReal (exp eps) * twoCellKernel n d eps i o' E := by
classical
change (atomLaw (twoCellMass n d eps i o)) E ≤
ofReal (exp eps) * (atomLaw (twoCellMass n d eps i o')) E
simp only [atomLaw, Measure.finsetSum_apply, Measure.smul_apply, smul_eq_mul,
Finset.mul_sum]
apply Finset.sum_le_sum
intro z _
rw [← mul_assoc, ← ENNReal.ofReal_mul (Real.exp_pos eps).le]
simpa only [mul_comm] using
mul_le_mul_right (ENNReal.ofReal_le_ofReal (twoCellMass_privacy n d eps heps i o o' z))
((Measure.dirac z) E)
theorem twoCellProtocol_noninteractive
Assume a nonnegative privacy budget. The entire resource-selected original-input procedure is noninteractive and pure private.
Formal statement
hypotheses
n d :
ℕ
eps :
ℝ
heps :
0 ≤ eps
conclusion
NoninteractiveClass (twoCellProtocol n d eps) eps
Proof (Lean source)
-- @node: twoCellProtocol_noninteractive
lemma twoCellProtocol_noninteractive (n d : ℕ) (eps : ℝ) (heps : 0 ≤ eps) :
NoninteractiveClass (twoCellProtocol n d eps) eps := by
constructor
· intro i o o' eta r E _
exact twoCellKernel_privacy n d eps heps i o o' E
· intro i o eta eta' r
rfl
theorem twoCell_fixedTranscriptLaw_product
For fixed records the concrete transcript consists of independent message rows.
Formal statement
hypotheses
conclusion
fixedTranscriptLaw (twoCellProtocol n d eps) o r
= Measure.pi (fun i => twoCellKernel n d eps i (o i))
Proof (Lean source)
-- @node: twoCell_fixedTranscriptLaw_product
lemma twoCell_fixedTranscriptLaw_product (n d : ℕ) (eps : ℝ)
(o : Fin n → ObsRecord d) (r : (twoCellProtocol n d eps).Seed) :
fixedTranscriptLaw (twoCellProtocol n d eps) o r =
Measure.pi (fun i => twoCellKernel n d eps i (o i)) := by
letI : Countable (ProtocolTranscript (twoCellProtocol n d eps)) := by
change Countable (Fin n → FrontierMessage d)
infer_instance
haveI : ∀ i, IsProbabilityMeasure (twoCellKernel n d eps i (o i)) :=
fun i => (twoCellStage_markov n d eps i).isProbabilityMeasure
((o i,r), fun _ => (false,fun _ => false))
change (fixedTranscriptLaw (twoCellProtocol n d eps) o r :
Measure (Fin n → FrontierMessage d)) = _
apply Measure.ext_of_singleton
intro z
change Fin n → FrontierMessage d at z
erw [Measure.pi_singleton]
exact transcriptLaw_singleton
(twoCellProtocol n d eps).kernels (twoCellProtocol n d eps).markov
(fun i => (o i,r)) z
theorem twoCell_iidTranscriptLaw_product
Averaging independent input records preserves the product of private row laws.
Formal statement
hypotheses
conclusion
= Measure.pi (fun i => mu.bind (twoCellKernel n d eps i))
Proof (Lean source)
-- @node: twoCell_iidTranscriptLaw_product
lemma twoCell_iidTranscriptLaw_product (n d : ℕ) (eps : ℝ)
(mu : Measure (ObsRecord d)) [IsProbabilityMeasure mu]
(r : (twoCellProtocol n d eps).Seed) :
(Measure.pi (fun _ : Fin n => mu)).bind
(fun o => fixedTranscriptLaw (twoCellProtocol n d eps) o r) =
Measure.pi (fun i => mu.bind (twoCellKernel n d eps i)) := by
classical
letI : Countable (ProtocolTranscript (twoCellProtocol n d eps)) := by
change Countable (Fin n → FrontierMessage d)
infer_instance
letI : MeasurableSingletonClass (ProtocolTranscript (twoCellProtocol n d eps)) := by
change MeasurableSingletonClass (Fin n → FrontierMessage d)
infer_instance
haveI : ∀ i, IsMarkovKernel (twoCellKernel n d eps i) := by
intro i
exact ⟨fun o => (twoCellStage_markov n d eps i).isProbabilityMeasure
((o,r), fun _ => (false,fun _ => false))⟩
haveI : ∀ i, IsProbabilityMeasure (mu.bind (twoCellKernel n d eps i)) :=
fun i => isProbabilityMeasure_bind (twoCellKernel n d eps i).measurable.aemeasurable
(Filter.Eventually.of_forall (fun _ => inferInstance))
apply Measure.ext_of_singleton
intro z
change Fin n → FrontierMessage d at z
erw [Measure.bind_apply (measurableSet_singleton z)
((measurable_fixedTranscriptLaw (twoCellProtocol n d eps)).comp
(show Measurable (fun o : Fin n → ObsRecord d => (o,r)) by fun_prop)).aemeasurable,
Measure.pi_singleton]
simp only [twoCell_fixedTranscriptLaw_product]
change (∫⁻ o, (Measure.pi (fun i => twoCellKernel n d eps i (o i))) {z} ∂Measure.pi (fun _ : Fin n => mu)) = _
simp_rw [ Measure.pi_singleton,
Measure.bind_apply (measurableSet_singleton _) (Kernel.measurable _).aemeasurable]
simp_rw [lintegral_fintype, Measure.pi_singleton]
simp_rw [← Finset.prod_mul_distrib]
exact (Fintype.prod_sum (fun i o => twoCellKernel n d eps i o {z i} * mu {o})).symm
theorem twoCell_sampling_transcript_product
Assume independent and identically distributed participant records, independent protocol randomness, and the causal-model conditions for the data law. The actual sampling decision law has the independent averaged message-row marginal.
Formal statement
hypotheses
conclusion
= Measure.pi (fun i => (observedLaw P).bind (twoCellKernel n d eps i))
Proof (Lean source)
-- @node: twoCell_sampling_transcript_product
lemma twoCell_sampling_transcript_product (n d : ℕ) (eps : ℝ)
(S : SamplingScheme n d) (hIID : IidPeople S) (hRandom : IndependentRandomness S)
(P : Measure (FullRecord d)) [IsProbabilityMeasure P] (hP : CausalModel P) :
(decisionLaw S (twoCellProtocol n d eps) P).map
(fun w => w.1) =
Measure.pi (fun i => (observedLaw P).bind (twoCellKernel n d eps i)) := by
haveI : IsProbabilityMeasure (observedLaw P) :=
Measure.isProbabilityMeasure_map (show Measurable observe by fun_prop).aemeasurable
apply Measure.ext
intro E hE
erw [Measure.map_apply measurable_fst hE]
have hpre : (fun w : DecisionSpace (twoCellProtocol n d eps) => w.1) ⁻¹' E =
E ×ˢ univ ×ˢ univ := by ext w; simp
rw [hpre]
unfold decisionLaw
rw [iid_sampling_inputLaw S hIID hRandom (twoCellProtocol n d eps) P hP,
product_decisionRows_rectangle _ _ E univ univ hE
MeasurableSet.univ MeasurableSet.univ]
simp only [Set.indicator_univ, twoCell_fixedTranscriptLaw_product]
simp only [lintegral_const, measure_univ, mul_one, uniform01,
Measure.restrict_apply MeasurableSet.univ, Set.univ_inter, Real.volume_Icc]
have hmix := congrArg (fun L => L E)
(twoCell_iidTranscriptLaw_product n d eps (observedLaw P) (0 : Fin 1))
erw [Measure.bind_apply hE
((measurable_fixedTranscriptLaw (twoCellProtocol n d eps)).comp
(show Measurable (fun o : Fin n → ObsRecord d => (o,(0 : Fin 1))) by fun_prop)).aemeasurable]
at hmix
simp only [twoCell_fixedTranscriptLaw_product] at hmix
norm_num only [sub_zero, ENNReal.ofReal_one, mul_one]
exact hmix
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.TwoPoint 11 declarations Finite original-record private value frontiers: Helpers/TwoPoint.
Helpers/TwoPoint
Finite original-record private value frontiers: Helpers/TwoPoint.
A degenerate coordinate prior fixes the entire parameter vector.
Formal statement
Proof (Lean source)
-- @node: productPrior_dirac_ae
lemma productPrior_dirac_ae (u : ℝ) :
∀ᵐ theta ∂productPrior d (Measure.dirac u), theta = fun _ => u := by
have hall : ∀ᵐ theta ∂productPrior d (Measure.dirac u), ∀ j, theta j = u :=
Filter.eventually_all.mpr (fun j =>
(Measure.tendsto_eval_ae_ae (μ := fun _ : Fin d => Measure.dirac u) (i := j)).eventually
(show ∀ᵐ x ∂Measure.dirac u, x = u by simp))
filter_upwards [hall] with theta htheta
exact funext htheta
theorem mixtureLaw_dirac
A point coordinate prior gives the corresponding unmixed experiment.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: mixtureLaw_dirac
lemma mixtureLaw_dirac (S : SamplingScheme n d) (Q : LocalProtocol n (ObsRecord d))
(u : ℝ) : mixtureLaw S Q (Measure.dirac u) =
seedTranscriptLaw S Q (symmetricLaw (fun _ => u)) := by
unfold mixtureLaw
have h := productPrior_dirac_ae (d := d) u
have heq : (fun theta => seedTranscriptLaw S Q (symmetricLaw theta)) =ᵐ[
productPrior d (Measure.dirac u)]
(fun _ => seedTranscriptLaw S Q (symmetricLaw (fun _ => u))) :=
h.mono (fun theta htheta => by rw [htheta])
rw [Measure.bind_congr_right heq]
haveI : IsProbabilityMeasure (productPrior d (Measure.dirac u)) := by
unfold productPrior; infer_instance
simp
instance measurableSingleton_fullRecordMeasure Definition measurableSingleton_fullRecordMeasure in the paper ↗
Finite population measures are separated by their measurable atom masses.
Definition (Lean source)
-- @node: measurableSingleton_fullRecordMeasure
instance measurableSingleton_fullRecordMeasure :
MeasurableSingletonClass (Measure (FullRecord d)) where
measurableSet_singleton P := by
have heq : ({P} : Set (Measure (FullRecord d))) =
⋂ x : FullRecord d, {μ | μ {x} = P {x}} := by
ext μ
simp only [Set.mem_singleton_iff, Set.mem_iInter, Set.mem_ofPred_eq]
exact ⟨fun h x => by rw [h], fun h => Measure.ext_of_singleton h⟩
rw [heq]
exact MeasurableSet.iInter (fun x => measurableSet_eq_fun
(Measure.measurable_coe (measurableSet_singleton x)) measurable_const)
theorem causal_dirac_bind
A law prior at a single population has no mixing effect.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
S :
SamplingScheme n d
Q :
LocalProtocol n (ObsRecord d)
P :
Measure (FullRecord d)
conclusion
Proof (Lean source)
-- @node: causal_dirac_bind
lemma causal_dirac_bind (S : SamplingScheme n d) (Q : LocalProtocol n (ObsRecord d))
(P : Measure (FullRecord d)) :
(Measure.dirac P).bind (decisionLaw S Q) = decisionLaw S Q P := by
rw [Measure.bind_congr_right (ae_eq_dirac (decisionLaw S Q))]
change (Measure.dirac P).bind (fun _ => decisionLaw S Q P) = _
simp
theorem signedNorm_constant
Assume positive dimension. The constant contrast has its absolute value as its averaged signed norm.
Formal statement
Proof (Lean source)
-- @node: signedNorm_constant
lemma signedNorm_constant (u : ℝ) (hd : 0 < d) :
signedNorm (fun _ : Fin d => u) = |u| := by
have hdR : (d : ℝ) ≠ 0 := by exact_mod_cast (Nat.ne_of_gt hd)
simp [signedNorm, hdR]
theorem constant_contrast_tv_bound
Assume measurable Radon–Nikodym densities for dominated kernels, independent and identically distributed participant records, independent protocol randomness, sequential local privacy of the protocol, an admissible sample size, dimension, and privacy budget, and amplitude between zero and one half. The first moment-matching contraction controls the two constant-contrast experiments.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
S :
SamplingScheme n d
hIID :
hRandom :
Q :
LocalProtocol n (ObsRecord d)
eps a :
ℝ
hQ :
SequentialClass Q eps
hAllowed :
Allowed n d eps
ha :
a ∈ Ioc 0 (1/2 : ℝ)
conclusion
tvDist (seedTranscriptLaw S Q (symmetricLaw (fun _ => 0))) (seedTranscriptLaw S Q (symmetricLaw (fun _ => a)))
≤ a * sqrt n * eps
Proof (Lean source)
-- @node: constant_contrast_tv_bound
lemma constant_contrast_tv_bound (hRN : MeasurableKernelRadonNikodym)
(S : SamplingScheme n d) (hIID : IidPeople S) (hRandom : IndependentRandomness S)
(Q : LocalProtocol n (ObsRecord d)) (eps a : ℝ) (hQ : SequentialClass Q eps)
(hAllowed : Allowed n d eps) (ha : a ∈ Ioc 0 (1/2 : ℝ)) :
tvDist (seedTranscriptLaw S Q (symmetricLaw (fun _ => 0)))
(seedTranscriptLaw S Q (symmetricLaw (fun _ => a))) ≤
a * sqrt n * eps := by
have hprior (u : ℝ) (hu : u ∈ Icc (-a) a) :
AmplitudePrior a (Measure.dirac u) := by
refine ⟨inferInstance, ?_⟩
simp [Measure.dirac_apply', hu]
have hmatch : MatchingMoments 1 (Measure.dirac (0 : ℝ)) (Measure.dirac a) := by
intro q hq
have hq0 : q = 0 := by omega
subst q
simp
have htv := ((adaptive_moment_contraction hRN S hIID hRandom Q eps hQ hAllowed).2
a ha (Measure.dirac 0) (Measure.dirac a)
(hprior 0 ⟨by linarith [ha.1], ha.1.le⟩)
(hprior a ⟨by linarith [ha.1], le_rfl⟩) 1 le_rfl hmatch).1 (by
have := hAllowed.1; omega)
rw [mixtureLaw_dirac, mixtureLaw_dirac] at htv
have hexp : exp eps - 1 ≤ 2*eps := by
have h := Real.abs_exp_sub_one_le (show |eps| ≤ 1 by
rw [abs_of_pos hAllowed.2.2.1]; exact hAllowed.2.2.2)
rw [abs_of_pos hAllowed.2.2.1] at h
exact (le_abs_self _).trans h
have hdR : (0 : ℝ) < d := by exact_mod_cast (show 0 < d by
have := hAllowed.2.1; omega)
have heq : (d : ℝ) * a^1 * sqrt (choose n 1) *
(derivativeScale d eps)^1 = a * sqrt n * (exp eps - 1)/2 := by
simp only [pow_one, Nat.choose_one_right, derivativeScale]
field_simp
refine (htv.trans (min_le_right _ _)).trans ?_
rw [heq]
have hmul := mul_le_mul_of_nonneg_left hexp
(mul_nonneg ha.1.le (Real.sqrt_nonneg (n : ℝ)))
nlinarith
theorem constant_contrast_decision_lower
Assume independent and identically distributed participant records, independent protocol randomness, amplitude between zero and one half, positive dimension, and the stated total-variation bound. Point priors turn transcript closeness into both per-decision lower bounds.
Formal statement
hypotheses
n :
ℕ
d :
ℕ
S :
SamplingScheme n d
hIID :
hRandom :
Q :
LocalProtocol n (ObsRecord d)
a :
ℝ
ha :
a ∈ Ioc 0 (1/2 : ℝ)
hd :
0 < d
hTV :
tvDist (seedTranscriptLaw S Q (symmetricLaw (fun _ => 0))) (seedTranscriptLaw S Q (symmetricLaw (fun _ => a)))
≤ 1/8
conclusion
conclusion 1
T :
ofReal (63*a^2/4096)
≤ ⨆ P : {P : Measure (FullRecord d) // P ∈ causalClass d}, squaredRisk (decisionLaw S Q P.1) T (value P.1)
Proof (Lean source)
-- @node: constant_contrast_decision_lower
lemma constant_contrast_decision_lower
(S : SamplingScheme n d) (hIID : IidPeople S) (hRandom : IndependentRandomness S)
(Q : LocalProtocol n (ObsRecord d)) (a : ℝ) (ha : a ∈ Ioc 0 (1/2 : ℝ))
(hd : 0 < d)
(hTV : tvDist
(seedTranscriptLaw S Q (symmetricLaw (fun _ => 0)))
(seedTranscriptLaw S Q (symmetricLaw (fun _ => a))) ≤ 1/8) :
(∀ T : Estimator Q, ofReal (63*a^2/4096) ≤
⨆ P : {P : Measure (FullRecord d) // P ∈ causalClass d},
squaredRisk (decisionLaw S Q P.1) T (value P.1)) ∧
(∀ I : IntervalDecision Q (1/4) (3/4),
(∀ P ∈ causalClass d, (0.90 : ℝ) ≤ coverage (decisionLaw S Q P) I (value P)) →
ofReal (81*a/320) ≤
⨆ P : {P : Measure (FullRecord d) // P ∈ causalClass d},
expectedLength (decisionLaw S Q P.1) I) := by
have hcube0 : (fun _ : Fin d => (0 : ℝ)) ∈ parameterCube d := by
intro j; constructor <;> norm_num
have hcubea : (fun _ : Fin d => a) ∈ parameterCube d := by
intro j; exact ⟨by linarith [ha.1], ha.2⟩
haveI := symmetricLaw_probability _ hcube0 hd
haveI := symmetricLaw_probability _ hcubea hd
have hmodel0 := symmetricLaw_causalModel _ hcube0 hd
have hmodela := symmetricLaw_causalModel _ hcubea hd
have hmem0 : symmetricLaw (fun _ : Fin d => (0 : ℝ)) ∈ causalClass d :=
⟨inferInstance, hmodel0⟩
have hmema : symmetricLaw (fun _ : Fin d => a) ∈ causalClass d :=
⟨inferInstance, hmodela⟩
have hv0 : value (symmetricLaw (fun _ : Fin d => (0 : ℝ))) = 1/2 := by
rw [symmetricLaw_value _ hcube0 hd, signedNorm_constant _ hd]
norm_num
have hva : value (symmetricLaw (fun _ : Fin d => a)) = 1/2+a/2 := by
rw [symmetricLaw_value _ hcubea hd, signedNorm_constant _ hd, abs_of_pos ha.1]
have hsupport0 : (Measure.dirac (symmetricLaw (fun _ : Fin d => (0 : ℝ))))
(causalClass d)ᶜ = 0 := by simp [hmem0]
have hsupporta : (Measure.dirac (symmetricLaw (fun _ : Fin d => a)))
(causalClass d)ᶜ = 0 := by simp [hmema]
have hprob0 : IsProbabilityMeasure
((Measure.dirac (symmetricLaw (fun _ : Fin d => (0 : ℝ)))).bind (decisionLaw S Q)) := by
rw [causal_dirac_bind]
exact sampling_decisionLaw_probability S hIID hRandom Q _ hmodel0
have hproba : IsProbabilityMeasure
((Measure.dirac (symmetricLaw (fun _ : Fin d => a))).bind (decisionLaw S Q)) := by
rw [causal_dirac_bind]
exact sampling_decisionLaw_probability S hIID hRandom Q _ hmodela
have hescape0 : (Measure.dirac (symmetricLaw (fun _ : Fin d => (0 : ℝ)))).real
{P | ((1/2+a/2)-1/2)/8 < |value P - 1/2|} ≤ 0 := by
have hnot : symmetricLaw (fun _ : Fin d => (0 : ℝ)) ∉
{P | ((1/2+a/2)-1/2)/8 < |value P - 1/2|} := by
simp only [Set.mem_ofPred_eq, hv0, sub_self, abs_zero]
linarith [ha.1]
simp only [Measure.real, Measure.dirac_apply, Set.indicator_of_notMem hnot,
ENNReal.toReal_zero, le_refl]
have hescapea : (Measure.dirac (symmetricLaw (fun _ : Fin d => a))).real
{P | ((1/2+a/2)-1/2)/8 < |value P - (1/2+a/2)|} ≤ 0 := by
have hnot : symmetricLaw (fun _ : Fin d => a) ∉
{P | ((1/2+a/2)-1/2)/8 < |value P - (1/2+a/2)|} := by
simp only [Set.mem_ofPred_eq, hva, sub_self, abs_zero]
linarith [ha.1]
simp only [Measure.real, Measure.dirac_apply, Set.indicator_of_notMem hnot,
ENNReal.toReal_zero, le_refl]
have htv : tvDist
(((Measure.dirac (symmetricLaw (fun _ : Fin d => (0 : ℝ)))).bind
(decisionLaw S Q)).map (fun w => (w.2.1,w.1)))
(((Measure.dirac (symmetricLaw (fun _ : Fin d => a))).bind
(decisionLaw S Q)).map (fun w => (w.2.1,w.1))) ≤ 1/8 := by
simpa only [causal_dirac_bind, seedTranscriptLaw] using hTV
have hsep := separated_value_mixtures S hIID hRandom Q
(Measure.dirac (symmetricLaw (fun _ : Fin d => (0 : ℝ))))
(Measure.dirac (symmetricLaw (fun _ : Fin d => a)))
hsupport0 hsupporta hprob0 hproba (1/2) (1/2+a/2) 0 (1/8)
(by linarith [ha.1]) hescape0 hescapea htv
have hr : 9*((1/2+a/2)-1/2)^2/128 * max 0 (1-(1/8 : ℝ)-2*0) =
63*a^2/4096 := by norm_num; ring
have hl : 3*((1/2+a/2)-1/2)/4 * max 0 ((0.80 : ℝ)-2*0-1/8) =
81*a/320 := by norm_num; ring
simpa only [hr, hl] using hsep
Assume the stated hs condition. Squaring the truncated reciprocal gives the truncated inverse information.
Proof (Lean source)
-- @node: min_one_reciprocal_sq
lemma min_one_reciprocal_sq (s : ℝ) (hs : 0 < s) :
(min 1 (1/s))^2 = min 1 (1/s^2) := by
by_cases h : s ≤ 1
· have hi : 1 ≤ 1/s := (le_div_iff₀ hs).mpr (by linarith)
have hi2 : 1 ≤ 1/s^2 := (le_div_iff₀ (sq_pos_of_pos hs)).mpr (by nlinarith)
rw [min_eq_left hi, min_eq_left hi2]
norm_num
· have hi : 1/s ≤ 1 := (div_le_iff₀ hs).mpr (by linarith)
have hi2 : 1/s^2 ≤ 1 := (div_le_iff₀ (sq_pos_of_pos hs)).mpr (by nlinarith)
rw [min_eq_right hi, min_eq_right hi2, div_pow, one_pow]
Assume the stated hn condition and a positive privacy budget. The roadmap's amplitude obeys its support, privacy, and rate calibration requirements.
Formal statement
Proof (Lean source)
-- @node: two_point_amplitude_calibration
lemma two_point_amplitude_calibration (n : ℕ) (eps : ℝ) (hn : 0 < n) (heps : 0 < eps) :
let a := min 1 (1/(sqrt n*eps))/8
a ∈ Ioc 0 (1/2 : ℝ) ∧ a*sqrt n*eps ≤ 1/8 ∧
(1/8192 : ℝ)*min 1 (1/(n*eps^2)) ≤ 63*a^2/4096 ∧
(1/8192 : ℝ)*min 1 (1/(sqrt n*eps)) ≤ 81*a/320 := by
have hnR : (0 : ℝ) < n := by exact_mod_cast hn
have hs : 0 < sqrt n*eps := mul_pos (Real.sqrt_pos.mpr hnR) heps
have hmin : 0 < min 1 (1/(sqrt n*eps)) := lt_min (by norm_num) (by positivity)
have hinfo : (sqrt n*eps)^2 = n*eps^2 := by
rw [mul_pow, Real.sq_sqrt hnR.le]
have hsq := min_one_reciprocal_sq (sqrt n*eps) hs
rw [hinfo] at hsq
dsimp only
refine ⟨⟨by positivity, by linarith [min_le_left 1 (1/(sqrt n*eps))]⟩, ?_, ?_, ?_⟩
· have hprod := mul_le_mul_of_nonneg_right
(min_le_right 1 (1/(sqrt n*eps))) hs.le
rw [one_div_mul_cancel hs.ne'] at hprod
nlinarith
· have hnonneg : 0 ≤ min 1 (1/(n*eps^2)) := by positivity
nlinarith [hsq]
· nlinarith
theorem dimension_free_private_two_point_decisions
Assume measurable Radon–Nikodym densities for dominated kernels, an admissible sample size, dimension, and privacy budget, independent and identically distributed participant records, independent protocol randomness, and sequential local privacy of the protocol. The two-point converse holds before taking either minimax infimum.
Formal statement
hypotheses
n d :
ℕ
eps :
ℝ
hAllowed :
Allowed n d eps
S :
SamplingScheme n d
hIID :
hRandom :
Q :
LocalProtocol n (ObsRecord d)
hQ :
SequentialClass Q eps
conclusion
conclusion 1
T :
≤ ⨆ P : {P : Measure (FullRecord d) // P ∈ causalClass d}, squaredRisk (decisionLaw S Q P.1) T (value P.1)
Proof (Lean source)
-- @node: dimension_free_private_two_point_decisions
lemma dimension_free_private_two_point_decisions (hRN : MeasurableKernelRadonNikodym)
(n d : ℕ) (eps : ℝ) (hAllowed : Allowed n d eps)
(S : SamplingScheme n d) (hIID : IidPeople S) (hRandom : IndependentRandomness S)
(Q : LocalProtocol n (ObsRecord d)) (hQ : SequentialClass Q eps) :
(∀ T : Estimator Q, ofReal ((1/8192 : ℝ)*min 1 (1/(n*eps^2))) ≤
⨆ P : {P : Measure (FullRecord d) // P ∈ causalClass d},
squaredRisk (decisionLaw S Q P.1) T (value P.1)) ∧
(∀ I : IntervalDecision Q (1/4) (3/4),
(∀ P ∈ causalClass d, (0.90 : ℝ) ≤ coverage (decisionLaw S Q P) I (value P)) →
ofReal ((1/8192 : ℝ)*min 1 (1/(sqrt n*eps))) ≤
⨆ P : {P : Measure (FullRecord d) // P ∈ causalClass d},
expectedLength (decisionLaw S Q P.1) I) := by
let a := min 1 (1/(sqrt n*eps))/8
obtain ⟨ha, hsmall, hr, hl⟩ := two_point_amplitude_calibration n eps
(by have := hAllowed.1; omega) hAllowed.2.2.1
have hd : 0 < d := by have := hAllowed.2.1; omega
have hTV := (constant_contrast_tv_bound hRN S hIID hRandom Q eps a
hQ hAllowed ha).trans hsmall
have hsep := constant_contrast_decision_lower S hIID hRandom Q a ha hd hTV
exact ⟨fun T => (ENNReal.ofReal_le_ofReal hr).trans (hsep.1 T),
fun I hCov => (ENNReal.ofReal_le_ofReal hl).trans (hsep.2 I hCov)⟩
theorem dimension_free_private_two_point
Assuming measurable kernel Radon--Nikodym derivatives, universal private two-point alternatives give lower bounds for both minimax decision values.
Formal statement
hypotheses
hRN_of_gate :
Proof (Lean source)
lemma dimension_free_private_two_point (hRN_of_gate : MeasurableKernelRadonNikodym) :
∃ c1 : ℝ, 0 < c1 ∧ ∀ (n d : ℕ) (eps : ℝ), Allowed n d eps →
∀ (S : SamplingScheme n d), IidPeople S → IndependentRandomness S →
∀ C : ProtocolClassLabel,
ofReal (c1 * min 1 (1/(n*eps^2))) ≤ minimaxRisk S C eps ∧
ofReal (c1 * min 1 (1/(sqrt n*eps))) ≤ honestLength S C eps := by
refine ⟨1/8192, by norm_num, ?_⟩
intro n d eps hAllowed S hIID hRandom C
have hdec (Q : LocalProtocol n (ObsRecord d)) (hQ : protocolClass C Q eps) :=
dimension_free_private_two_point_decisions hRN_of_gate n d eps hAllowed S hIID hRandom Q
(by cases C with
| NI => exact NoninteractiveClass.toSequentialClass Q eps hQ
| SI => exact hQ)
constructor
· unfold minimaxRisk riskValue minimaxValueENNReal
apply le_iInf
intro e
exact (hdec e.1.1 e.1.2).1 e.2
· unfold honestLength lengthValue minimaxValueENNReal
apply le_iInf
intro e
exact (hdec e.1.1 e.1.2).2 e.2.1 e.2.2
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.ValueSequences 5 declarations Positive uniform rate comparisons transfer consistency, parametric comparability, and the growing-dimension elbow to risk and honest length.
Transfer of numerical rates to value sequences
Positive uniform rate comparisons transfer consistency, parametric comparability, and the growing-dimension elbow to risk and honest length.
theorem comparable_symm
Eventual comparison by positive constants is symmetric.
Formal statement
Proof (Lean source)
-- @node: comparable_symm
lemma comparable_symm {f g : ℕ → ℝ} (h : Comparable f g) : Comparable g f := by
obtain ⟨c, C, hc, hcC, he⟩ := h
have hC : 0 < C := hc.trans_le hcC
refine ⟨C⁻¹, c⁻¹, inv_pos.mpr hC, inv_le_inv₀ hC hc |>.mpr hcC, ?_⟩
filter_upwards [he] with k hk
constructor
· exact (inv_mul_le_iff₀ hC).mpr (by simpa [mul_comm] using hk.2)
· exact (le_inv_mul_iff₀ hc).mpr (by simpa [mul_comm] using hk.1)
theorem comparable_trans
Assume the stated hfg condition and the stated hgh condition. Eventual comparison by positive constants is transitive.
Formal statement
Proof (Lean source)
-- @node: comparable_trans
lemma comparable_trans {f g h : ℕ → ℝ} (hfg : Comparable f g)
(hgh : Comparable g h) : Comparable f h := by
obtain ⟨c, C, hc, hcC, he⟩ := hfg
obtain ⟨a, A, ha, haA, he'⟩ := hgh
have hC := hc.trans_le hcC
refine ⟨c*a, C*A, mul_pos hc ha,
mul_le_mul hcC haA ha.le hC.le, ?_⟩
filter_upwards [he, he'] with k hk hk'
constructor
· calc
(c*a)*h k ≤ c*g k := by simpa [mul_assoc] using
mul_le_mul_of_nonneg_left hk'.1 hc.le
_ ≤ f k := hk.1
· exact hk.2.trans (by simpa [mul_assoc] using
mul_le_mul_of_nonneg_left hk'.2 hC.le)
theorem comparable_tendsto_zero_iff
Assume the stated hf condition and the stated hg condition. Nonnegative comparable sequences vanish together.
Formal statement
Proof (Lean source)
-- @node: comparable_tendsto_zero_iff
lemma comparable_tendsto_zero_iff {f g : ℕ → ℝ}
(hf : ∀ k, 0 ≤ f k) (hg : ∀ k, 0 ≤ g k) (h : Comparable f g) :
Tendsto f atTop (nhds 0) ↔
Tendsto g atTop (nhds 0) := by
have transfer : ∀ (u v : ℕ → ℝ), (∀ k, 0 ≤ u k) → Comparable u v →
Tendsto v atTop (nhds 0) →
Tendsto u atTop (nhds 0) := by
intro u v hu huv hv
obtain ⟨c, C, hc, hcC, he⟩ := huv
apply squeeze_zero' (Filter.Eventually.of_forall hu) (he.mono fun k hk => hk.2)
simpa using hv.const_mul C
exact ⟨transfer g f hg (comparable_symm h), transfer f g hf h⟩
Assume the stated hf condition. A nonnegative sequence and its square root vanish together.
Formal statement
Proof (Lean source)
-- @node: tendsto_sqrt_zero_iff
lemma tendsto_sqrt_zero_iff (f : ℕ → ℝ) (hf : ∀ k, 0 ≤ f k) :
Tendsto (fun k => sqrt (f k)) atTop (nhds 0) ↔
Tendsto f atTop (nhds 0) := by
constructor
· intro h
have hh := h.pow 2
simpa only [Real.sq_sqrt (hf _), zero_pow (by omega : 2 ≠ 0)] using hh
· intro h
simpa only [Function.comp_def, Real.sqrt_zero] using
Real.continuous_sqrt.continuousAt.tendsto.comp h
theorem value_sequence_conclusions_of_bounds
Assume the stated hc condition, the stated hc c condition, and the function hBounds. Risk and honest length inherit every numerical resource conclusion from uniform positive comparisons with the rate and its square root.
Formal statement
hypotheses
risk length :
(n d : ℕ) → ℝ → ℝ
c C :
ℝ
hc :
0 < c
hcC :
c ≤ C
conclusion
ValueSequenceConclusions risk length
Proof (Lean source)
-- @node: value_sequence_conclusions_of_bounds
lemma value_sequence_conclusions_of_bounds
(risk length : (n d : ℕ) → ℝ → ℝ) (c C : ℝ) (hc : 0 < c) (hcC : c ≤ C)
(hBounds : ∀ n d eps, Allowed n d eps →
c * rho (n*eps^2) d ≤ risk n d eps ∧
risk n d eps ≤ C * rho (n*eps^2) d ∧
c * sqrt (rho (n*eps^2) d) ≤ length n d eps ∧
length n d eps ≤ C * sqrt (rho (n*eps^2) d)) :
ValueSequenceConclusions risk length := by
have hC : 0 < C := hc.trans_le hcC
have hrho : ∀ n d eps, Allowed n d eps → 0 ≤ rho (n*eps^2) d := by
intro n d eps h
exact (by positivity : (0 : ℝ) ≤ min 1 (1 / (n*eps^2))).trans
(rho_elementary_comparisons n d eps h).1
constructor
· intro ns ds es h
have hR : Comparable (fun k => risk (ns k) (ds k) (es k))
(fun k => rho (ns k*(es k)^2) (ds k)) :=
⟨c, C, hc, hcC, Filter.Eventually.of_forall fun k =>
⟨(hBounds _ _ _ (h k)).1, (hBounds _ _ _ (h k)).2.1⟩⟩
have hH : Comparable (fun k => length (ns k) (ds k) (es k))
(fun k => sqrt (rho (ns k*(es k)^2) (ds k))) :=
⟨c, C, hc, hcC, Filter.Eventually.of_forall fun k =>
(hBounds _ _ _ (h k)).2.2⟩
have hR0 : ∀ k, 0 ≤ risk (ns k) (ds k) (es k) := fun k =>
(mul_nonneg hc.le (hrho _ _ _ (h k))).trans (hBounds _ _ _ (h k)).1
have hH0 : ∀ k, 0 ≤ length (ns k) (ds k) (es k) := fun k =>
(mul_nonneg hc.le (Real.sqrt_nonneg _)).trans (hBounds _ _ _ (h k)).2.2.1
have hparam : Comparable (fun k => risk (ns k) (ds k) (es k))
(fun k => 1/(ns k*(es k)^2)) ↔
Comparable (fun k => rho (ns k*(es k)^2) (ds k))
(fun k => 1/(ns k*(es k)^2)) :=
⟨fun hh => comparable_trans (comparable_symm hR) hh,
fun hh => comparable_trans hR hh⟩
refine ⟨?_, ?_, hparam.trans (rho_parametric_comparable_iff ns ds es h), ?_⟩
· exact (comparable_tendsto_zero_iff hR0 (fun k => hrho _ _ _ (h k)) hR).trans
(rho_consistency_iff ns ds es h)
· exact ((comparable_tendsto_zero_iff hH0 (fun k => Real.sqrt_nonneg _) hH).trans
(tendsto_sqrt_zero_iff _ (fun k => hrho _ _ _ (h k)))).trans
(rho_consistency_iff ns ds es h)
· intro ht
exact hparam.trans (rho_parametric_iff_bounded_dimension ns ds es h ht)
· intro a b ha hab
obtain ⟨u, U, hu, huU, D0, hD⟩ := rho_elbow_comparison a b ha hab
refine ⟨min (c*u) (c^2*u), max (C*U) (C^2*U),
lt_min (mul_pos hc hu) (mul_pos (sq_pos_of_pos hc) hu),
(min_le_left _ _).trans ((mul_le_mul hcC huU hu.le hC.le).trans
(le_max_left _ _)), D0, ?_⟩
intro n d eps h hd ht
obtain ⟨hlo, hhi⟩ := hD d hd h.2.1 (n*eps^2) ht
obtain ⟨hRlo, hRhi, hHlo, hHhi⟩ := hBounds n d eps h
have hU : 0 < U := hu.trans_le huU
have hslo := Real.sqrt_le_sqrt hlo
have hshi := Real.sqrt_le_sqrt hhi
rw [Real.sqrt_mul hu.le, Real.sqrt_sq_eq_abs] at hslo
rw [Real.sqrt_mul hU.le, Real.sqrt_sq_eq_abs] at hshi
refine ⟨?_, ?_, ?_, ?_⟩
· calc
min (c*u) (c^2*u) * (log (logDim d)/logDim d)^2 ≤
(c*u) * (log (logDim d)/logDim d)^2 :=
mul_le_mul_of_nonneg_right (min_le_left _ _) (sq_nonneg _)
_ ≤ c * rho (n*eps^2) d := by
simpa [mul_assoc] using mul_le_mul_of_nonneg_left hlo hc.le
_ ≤ risk n d eps := hRlo
· calc
risk n d eps ≤ C * rho (n*eps^2) d := hRhi
_ ≤ (C*U) * (log (logDim d)/logDim d)^2 := by
simpa [mul_assoc] using mul_le_mul_of_nonneg_left hhi hC.le
_ ≤ max (C*U) (C^2*U) * (log (logDim d)/logDim d)^2 :=
mul_le_mul_of_nonneg_right (le_max_left _ _) (sq_nonneg _)
· have hsqrt : sqrt (min (c*u) (c^2*u)) ≤ c * sqrt u := by
calc
_ ≤ sqrt (c^2*u) := Real.sqrt_le_sqrt (min_le_right _ _)
_ = c * sqrt u := by rw [Real.sqrt_mul (sq_nonneg c), Real.sqrt_sq hc.le]
calc
_ ≤ (c * sqrt u) * |log (logDim d)/logDim d| :=
mul_le_mul_of_nonneg_right hsqrt (abs_nonneg _)
_ ≤ c * sqrt (rho (n*eps^2) d) := by
simpa [mul_assoc] using mul_le_mul_of_nonneg_left hslo hc.le
_ ≤ length n d eps := hHlo
· have hsqrt : C * sqrt U ≤ sqrt (max (C*U) (C^2*U)) := by
calc
_ = sqrt (C^2*U) := by rw [Real.sqrt_mul (sq_nonneg C), Real.sqrt_sq hC.le]
_ ≤ _ := Real.sqrt_le_sqrt (le_max_right _ _)
calc
length n d eps ≤ C * sqrt (rho (n*eps^2) d) := hHhi
_ ≤ (C * sqrt U) * |log (logDim d)/logDim d| := by
simpa [mul_assoc] using mul_le_mul_of_nonneg_left hshi hC.le
_ ≤ _ := mul_le_mul_of_nonneg_right hsqrt (abs_nonneg _)
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.Helpers.VectorChannel 29 declarations Finite original-record private value frontiers: Helpers/VectorChannel.
Helpers/VectorChannel
Finite original-record private value frontiers: Helpers/VectorChannel.
def BlockAdmissible
Fix the sample size and the block size. Standing admissibility of a signed-message block in the n-person experiment.
Definition (Lean source)
parameters
n m :
ℕ
def
BlockAdmissible n m :
Prop
given by
clause 1
1 ≤ m
clause 2
m ≤ n
def SignedBlockSize
Fix the sample size. Block sizes in the standing paper domain, with both bounds carried by the type.
Definition (Lean source)
def privacyDelta
Fix the privacy budget. Local noise parameter.
Definition (Lean source)
parameters
eps :
ℝ
def
privacyDelta eps :
ℝ
given by
Real.tanh (eps/2)
def noiseScale
Fix the dimension and the privacy budget. Scaled sign noise.
Definition (Lean source)
def vectorMass
Fix the privacy budget, the observed participant record, and the function z. Signed-vector atom weight.
def vectorKernel
Fix the dimension and the privacy budget. Explicit finite signed-vector channel.
Flipping one coordinate pairs the positive and negative signs.
Proof (Lean source)
-- @node: sum_vector_coordinate_sign
lemma sum_vector_coordinate_sign (j : Fin d) :
∑ z : Fin d → Bool, signVal (z j) = 0 := by
classical
apply Finset.sum_ninvolution (fun z => update z j (!(z j)))
· intro z
cases h : z j <;> simp [signVal, h]
· intro z _ heq
have h := congrFun heq j
cases hz : z j <;> simp [hz] at h
· intro z
exact Finset.mem_univ _
· intro z
ext l
by_cases h : l = j
· subst l
simp
· simp [Function.update_of_ne h]
Signed-vector masses are nonnegative for every real privacy parameter.
Formal statement
Proof (Lean source)
-- @node: vectorMass_nonneg
lemma vectorMass_nonneg (eps : ℝ) (o : ObsRecord d) (z : Fin d → Bool) :
0 ≤ vectorMass eps o z := by
have hlo := (abs_lt.mp (Real.abs_tanh_lt_one (eps/2))).1
have hhi := (abs_lt.mp (Real.abs_tanh_lt_one (eps/2))).2
unfold vectorMass privacyDelta obsSign signVal
apply mul_nonneg (by positivity)
cases o.2.1 <;> cases o.2.2 <;> cases z o.1 <;> norm_num <;> linarith
Uniform signs cancel the perturbation in the mass sum.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: vectorMass_sum
lemma vectorMass_sum (eps : ℝ) (o : ObsRecord d) :
∑ z : Fin d → Bool, vectorMass eps o z = 1 := by
simp only [vectorMass, Finset.mul_sum, ← Finset.mul_sum,
Finset.sum_add_distrib, Finset.sum_const, Finset.card_univ,
Fintype.card_fun, Fintype.card_bool, Fintype.card_fin,
sum_vector_coordinate_sign, mul_zero, add_zero, nsmul_eq_mul, mul_one]
simp [zpow_neg, zpow_natCast]
theorem vectorKernel_markov
Markov certificate for the finite vector channel.
Formal statement
Proof (Lean source)
-- @node: vectorKernel_markov
lemma vectorKernel_markov (d : ℕ) (eps : ℝ) : IsMarkovKernel (vectorKernel d eps) := by
constructor
intro o
constructor
change atomLaw (vectorMass eps o) univ = 1
simp only [atomLaw, Measure.finsetSum_apply, MeasurableSet.univ,
Measure.smul_apply, Measure.dirac_apply_of_mem, Set.mem_univ, smul_eq_mul, mul_one]
rw [← ENNReal.ofReal_sum_of_nonneg (fun z _ => vectorMass_nonneg eps o z),
vectorMass_sum]
simp
def vectorStageKernel
Fix the sample size and the dimension, the privacy budget, and the participant index. Constant-history vector stage.
Stagewise Markov certificate after ignoring seed and history.
Formal statement
Proof (Lean source)
-- @node: vectorStage_markov
lemma vectorStage_markov (n d : ℕ) (eps : ℝ) (i : Fin n) :
IsMarkovKernel (vectorStageKernel n d eps i) := by
letI := vectorKernel_markov d eps
unfold vectorStageKernel
infer_instance
def vectorProtocol
Fix the sample size and the dimension and the privacy budget. Original-input vector protocol with a singleton public seed.
Definition (Lean source)
parameters
n d :
ℕ
eps :
ℝ
def
given by
clause 1
Seed := Fin 1
clause 2
seedMeasurable := inferInstance
clause 3
seedStandard := inferInstance
clause 4
seedLaw := Measure.dirac (0 : Fin 1)
clause 5
seedProbability := inferInstance
clause 7
messageMeasurable := fun _ => inferInstance
clause 8
messageStandard := fun _ => inferInstance
clause 9
kernels := vectorStageKernel n d eps
clause 10
markov := vectorStage_markov n d eps
def vectorMessageLaw
Fix the probability law P and the privacy budget. One signed-vector message law.
Definition (Lean source)
parameters
given by
(observedLaw P).bind (vectorKernel d eps)
def vectorBlockLaw
Fix the probability law P, the privacy budget, and the block size. Independent m-row vector-message law.
Definition (Lean source)
parameters
given by
Measure.pi (fun _ => vectorMessageLaw P eps)
def scaledMessages
Fix the privacy budget, the function z, the participant index, and the coordinate index. Scaled message matrix.
def vectorSamplerLaw
Fix the privacy budget and the observed participant record. Direct product sampler: distinguished coordinate has mean δS; others are fair.
A finite atomic law assigns the declared nonnegative mass to each singleton.
Formal statement
hypotheses
Proof (Lean source)
-- @node: atomLaw_singleton
lemma atomLaw_singleton {α : Type} [Fintype α] [MeasurableSpace α]
[MeasurableSingletonClass α] (w : α → ℝ) (a : α) :
atomLaw w {a} = ofReal (w a) := by
classical
simp [atomLaw, Measure.finsetSum_apply, Measure.smul_apply,
Measure.dirac_apply', Pi.single_apply]
The sampler's coordinate weights multiply to the vector-channel mass.
Formal statement
hypotheses
conclusion
= vectorMass eps o z
Proof (Lean source)
-- @node: vectorSamplerMass_product
lemma vectorSamplerMass_product (eps : ℝ) (o : ObsRecord d) (z : Fin d → Bool) :
(∏ j : Fin d, (if j = o.1 then
(1 + privacyDelta eps * obsSign o * signVal (z j))/2 else 1/2)) =
vectorMass eps o z := by
classical
have hfactor : ∀ j : Fin d, (if j = o.1 then
(1 + privacyDelta eps * obsSign o * signVal (z j))/2 else 1/2) =
(if j = o.1 then 1 + privacyDelta eps * obsSign o * signVal (z j) else 1) * (1/2) := by
intro j
split_ifs <;> ring
simp_rw [hfactor]
rw [Finset.prod_mul_distrib, Finset.prod_eq_single o.1]
· simp [vectorMass, zpow_neg, zpow_natCast, inv_pow, mul_comm, one_div]
· intro j hj hne
simp [hne]
· simp
theorem vectorKernel_eq_sampler
The finite channel is the stated total product sampler.
Formal statement
hypotheses
conclusion
vectorKernel d eps o = vectorSamplerLaw eps o
Proof (Lean source)
-- @node: vectorKernel_eq_sampler
lemma vectorKernel_eq_sampler (eps : ℝ) (o : ObsRecord d) :
vectorKernel d eps o = vectorSamplerLaw eps o := by
classical
let w : Fin d → Bool → ℝ := fun j s =>
if j = o.1 then (1 + privacyDelta eps * obsSign o * signVal s)/2 else 1/2
have hw : ∀ j s, 0 ≤ w j s := by
intro j s
have hlo := (abs_lt.mp (Real.abs_tanh_lt_one (eps/2))).1
have hhi := (abs_lt.mp (Real.abs_tanh_lt_one (eps/2))).2
dsimp [w, privacyDelta, obsSign, signVal]
split_ifs <;> cases o.2.1 <;> cases o.2.2 <;> cases s <;> norm_num <;> linarith
letI : ∀ j : Fin d, IsFiniteMeasure (atomLaw (w j)) := fun j => by
constructor
simp only [atomLaw, Measure.finsetSum_apply, MeasurableSet.univ,
Measure.smul_apply, Measure.dirac_apply_of_mem, Set.mem_univ, smul_eq_mul, mul_one]
exact ENNReal.sum_lt_top.mpr (fun _ _ => ENNReal.ofReal_lt_top)
apply Measure.ext_of_singleton
intro z
change atomLaw (vectorMass eps o) {z} = (Measure.pi (fun j => atomLaw (w j))) {z}
rw [atomLaw_singleton, Measure.pi_singleton]
simp_rw [atomLaw_singleton]
rw [← ENNReal.ofReal_prod_of_nonneg (fun j _ => hw j (z j))]
congr 1
exact (vectorSamplerMass_product eps o z).symm
The tanh parametrization gives the exact randomized-response odds.
Formal statement
Proof (Lean source)
-- @node: privacyDelta_exp_formula
lemma privacyDelta_exp_formula (eps : ℝ) :
privacyDelta eps = (exp eps - 1) / (exp eps + 1) := by
have he : exp (eps/2) ≠ 0 := ne_of_gt (Real.exp_pos _)
have he2 : exp eps = exp (eps/2) * exp (eps/2) := by
rw [← Real.exp_add]
congr 1
ring
rw [privacyDelta, Real.tanh_eq, Real.exp_neg, he2]
field_simp
<;> ring
Assume a nonnegative privacy budget. The local sign bias is nonnegative and strictly below one.
Formal statement
hypotheses
eps :
ℝ
heps :
0 ≤ eps
Proof (Lean source)
-- @node: privacyDelta_bounds
lemma privacyDelta_bounds (eps : ℝ) (heps : 0 ≤ eps) :
0 ≤ privacyDelta eps ∧ privacyDelta eps < 1 := by
rw [privacyDelta_exp_formula]
have he := Real.one_le_exp_iff.mpr heps
constructor
· exact div_nonneg (by linarith) (by positivity)
· apply (div_lt_one (by positivity : 0 < exp eps + 1)).mpr
linarith
The two extreme sign weights have exactly the pure-privacy ratio.
Formal statement
Proof (Lean source)
-- @node: privacyDelta_odds_identity
lemma privacyDelta_odds_identity (eps : ℝ) :
1 + privacyDelta eps = exp eps * (1 - privacyDelta eps) := by
rw [privacyDelta_exp_formula]
have he : exp eps + 1 ≠ 0 := ne_of_gt (by positivity)
field_simp
<;> ring
Assume a nonnegative privacy budget. Every vector atom satisfies the full original-input privacy bound.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: vectorMass_privacy
lemma vectorMass_privacy (eps : ℝ) (heps : 0 ≤ eps)
(o o' : ObsRecord d) (z : Fin d → Bool) :
vectorMass eps o z ≤ exp eps * vectorMass eps o' z := by
have hdelta := (privacyDelta_bounds eps heps).1
have hsign : ∀ v : ObsRecord d,
-privacyDelta eps ≤ privacyDelta eps * obsSign v * signVal (z v.1) ∧
privacyDelta eps * obsSign v * signVal (z v.1) ≤ privacyDelta eps := by
intro v
unfold obsSign signVal
cases v.2.1 <;> cases v.2.2 <;> cases z v.1 <;> norm_num <;> linarith
have hupper := (hsign o).2
have hlower := (hsign o').1
have hodds := privacyDelta_odds_identity eps
have hinner : 1 + privacyDelta eps * obsSign o * signVal (z o.1) ≤
exp eps * (1 + privacyDelta eps * obsSign o' * signVal (z o'.1)) := by
calc
_ ≤ 1 + privacyDelta eps := by linarith
_ = exp eps * (1 - privacyDelta eps) := hodds
_ ≤ _ := mul_le_mul_of_nonneg_left (by linarith) (Real.exp_pos eps).le
unfold vectorMass
calc
_ ≤ (2 : ℝ)^(-(d : ℤ)) *
(exp eps * (1 + privacyDelta eps * obsSign o' * signVal (z o'.1))) :=
mul_le_mul_of_nonneg_left hinner (by positivity)
_ = _ := by ring
theorem vectorKernel_privacy
Assume a nonnegative privacy budget and the set hE. Summing the atom bounds proves privacy for every measurable message event.
Formal statement
hypotheses
conclusion
Proof (Lean source)
-- @node: vectorKernel_privacy
lemma vectorKernel_privacy (eps : ℝ) (heps : 0 ≤ eps)
(o o' : ObsRecord d) (E : Set (Fin d → Bool)) (hE : MeasurableSet E) :
vectorKernel d eps o E ≤ ofReal (exp eps) * vectorKernel d eps o' E := by
classical
change (atomLaw (vectorMass eps o)) E ≤
ofReal (exp eps) * (atomLaw (vectorMass eps o')) E
simp only [atomLaw, Measure.finsetSum_apply, Measure.smul_apply, smul_eq_mul,
Finset.mul_sum]
apply Finset.sum_le_sum
intro z hz
rw [← mul_assoc, ← ENNReal.ofReal_mul (Real.exp_pos eps).le]
simpa only [mul_comm] using
mul_le_mul_right (ENNReal.ofReal_le_ofReal (vectorMass_privacy eps heps o o' z))
((Measure.dirac z) E)
theorem vectorProtocol_noninteractive
Assume a nonnegative privacy budget. The fixed signed-vector mechanism is noninteractive and pure private.
Formal statement
hypotheses
n d :
ℕ
eps :
ℝ
heps :
0 ≤ eps
conclusion
NoninteractiveClass (vectorProtocol n d eps) eps
Proof (Lean source)
-- @node: vectorProtocol_noninteractive
lemma vectorProtocol_noninteractive (n d : ℕ) (eps : ℝ) (heps : 0 ≤ eps) :
NoninteractiveClass (vectorProtocol n d eps) eps := by
constructor
· intro i o o' eta r E hE
exact vectorKernel_privacy eps heps o o' E hE
· intro i o eta eta' r
rfl
One release is a probability law whenever the original record law is.
Formal statement
hypotheses
conclusion
IsProbabilityMeasure (vectorMessageLaw P eps)
Proof (Lean source)
-- @node: vectorMessageLaw_probability
lemma vectorMessageLaw_probability (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(eps : ℝ) : IsProbabilityMeasure (vectorMessageLaw P eps) := by
letI := vectorKernel_markov d eps
letI : IsProbabilityMeasure (observedLaw P) := by
unfold observedLaw
exact Measure.isProbabilityMeasure_map (by fun_prop)
unfold vectorMessageLaw
exact isProbabilityMeasure_bind (vectorKernel d eps).measurable.aemeasurable
(Filter.Eventually.of_forall (fun _ => inferInstance))
Independent rows of the signed-vector mechanism form a probability law.
Formal statement
hypotheses
conclusion
IsProbabilityMeasure (vectorBlockLaw P eps m)
Proof (Lean source)
-- @node: vectorBlockLaw_probability
lemma vectorBlockLaw_probability (P : Measure (FullRecord d)) [IsProbabilityMeasure P]
(eps : ℝ) (m : ℕ) : IsProbabilityMeasure (vectorBlockLaw P eps m) := by
letI := vectorMessageLaw_probability P eps
unfold vectorBlockLaw
infer_instance
def binaryOutcomeKernel
Fix the dimension and the privacy budget. Binary outcome randomized response.
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.TFullSimplexTvConverse 1 declarations Finite original-record private value frontiers: TFullSimplexTvConverse.
TFullSimplexTvConverse
Finite original-record private value frontiers: TFullSimplexTvConverse.
theorem full_simplex_tv_converse
Under the Bernstein absolute-approximation limit, the full simplex obeys the private minimax-risk and globally honest connected-length lower bounds.
Formal statement
hypotheses
hBernstein_of_gate :
conclusion
∃ c : ℝ,
0 < c
conclusion 1
Proof (Lean source)
theorem full_simplex_tv_converse (hBernstein_of_gate : BernsteinAbsoluteApproximationLimit) :
∃ c : ℝ, 0 < c ∧ -- @realizes c(universal positive lower constant)
∀ (n d : ℕ) (eps : ℝ), Allowed n d eps →
∀ C : ProtocolClassLabel,
ofReal (c*rateR C n d eps) ≤ tvMinimaxRisk C (simplexModel d) n eps ∧
ofReal (c*rateH C n d eps) ≤ tvHonestLength C (simplexModel d) n eps := by
obtain ⟨c, hc, hconverse⟩ := paired_converse_of_gate
measurableKernelRadonNikodym_proved caiLowMomentDuality_proved hBernstein_of_gate
refine ⟨c, hc, ?_⟩
intro n d eps hAllowed C
have hsub := pairedFamily_subset_simplex (d := d) (by have := hAllowed.2.1; omega)
have hsequential : ∀ K : LocalProtocol n (PairedSymbol d),
protocolClass C K eps → SequentialClass K eps := by
intro K hK
cases C with
| NI => exact ⟨hK.privacy⟩
| SI => exact hK
constructor
· change _ ≤ minimaxValueENNReal _
apply le_minimaxValueENNReal
rintro ⟨⟨K, hK⟩, T⟩
apply le_trans ((hconverse n d eps hAllowed K (hsequential K hK)).1 T)
apply iSup_le
intro p
exact le_iSup_of_le ⟨p.1, hsub p.2⟩ le_rfl
· change _ ≤ minimaxValueENNReal _
apply le_minimaxValueENNReal
rintro ⟨⟨K, hK⟩, J, hJ⟩
have hpaired : ∀ p ∈ pairedFamily d,
(0.90 : ℝ) ≤ coverage (canonicalDecisionLaw K p) J (tvFromUniform p) :=
fun p hp => hJ p (hsub hp)
apply le_trans ((hconverse n d eps hAllowed K (hsequential K hK)).2 J hpaired)
apply iSup_le
intro p
exact le_iSup_of_le ⟨p.1, hsub p.2⟩ le_rfl
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.TPairedUniformTvFrontier 5 declarations Finite original-record private value frontiers: TPairedUniformTvFrontier.
TPairedUniformTvFrontier
Finite original-record private value frontiers: TPairedUniformTvFrontier.
theorem paired_converse_of_gate
Assume measurable Radon–Nikodym densities for dominated kernels, the Cai–Low moment-duality theorem, and the Bernstein absolute-approximation limit. Per-decision paired converse for reuse under model inclusion.
Formal statement
hypotheses
hRN_of_gate :
hDual_of_gate :
hBernstein_of_gate :
conclusion
∃ c : ℝ,
0 < c
conclusion 1
T :
≤ ⨆ p : {p : Measure (PairedSymbol d) // p ∈ pairedFamily d}, squaredRisk (canonicalDecisionLaw K p.1) T (tvFromUniform p.1)
J :
IntervalDecision K 0 1
≤ ⨆ p : {p : Measure (PairedSymbol d) // p ∈ pairedFamily d}, expectedLength (canonicalDecisionLaw K p.1) J
Proof (Lean source)
-- @node: paired_converse_of_gate
lemma paired_converse_of_gate (hRN_of_gate : MeasurableKernelRadonNikodym)
(hDual_of_gate : CaiLowMomentDuality) (hBernstein_of_gate :
BernsteinAbsoluteApproximationLimit) :
∃ c : ℝ, 0 < c ∧ -- @realizes c(universal positive lower constant)
∀ (n d : ℕ) (eps : ℝ), Allowed n d eps →
∀ K : LocalProtocol n (PairedSymbol d), SequentialClass K eps →
(∀ T : Estimator K, ofReal (c*rateR .SI n d eps) ≤
⨆ p : {p : Measure (PairedSymbol d) // p ∈ pairedFamily d},
squaredRisk (canonicalDecisionLaw K p.1) T (tvFromUniform p.1)) ∧
(∀ J : IntervalDecision K 0 1,
(∀ p ∈ pairedFamily d, (0.90 : ℝ) ≤ coverage (canonicalDecisionLaw K p) J
(tvFromUniform p)) →
ofReal (c*rateH .SI n d eps) ≤
⨆ p : {p : Measure (PairedSymbol d) // p ∈ pairedFamily d},
expectedLength (canonicalDecisionLaw K p.1) J) := by
-- Concentrated product priors give the converse above a universal dimension cutoff.
have hLarge :
∃ D : ℕ, 2 ≤ D ∧ ∃ c : ℝ, 0 < c ∧ -- @realizes c(universal positive lower constant)
∀ (n d : ℕ) (eps : ℝ), Allowed n d eps → D < d →
∀ K : LocalProtocol n (PairedSymbol d), SequentialClass K eps →
(∀ T : Estimator K, ofReal (c*rateR .SI n d eps) ≤
⨆ p : {p : Measure (PairedSymbol d) // p ∈ pairedFamily d},
squaredRisk (canonicalDecisionLaw K p.1) T (tvFromUniform p.1)) ∧
(∀ J : IntervalDecision K 0 1,
(∀ p ∈ pairedFamily d, (0.90 : ℝ) ≤ coverage (canonicalDecisionLaw K p) J
(tvFromUniform p)) →
ofReal (c*rateH .SI n d eps) ≤
⨆ p : {p : Measure (PairedSymbol d) // p ∈ pairedFamily d},
expectedLength (canonicalDecisionLaw K p.1) J) := by
obtain ⟨b, hb, D, hD, hpriors⟩ :=
paired_lawspace_resource_priors_of_gate hRN_of_gate hDual_of_gate hBernstein_of_gate
let scale : ℝ := b/3400
have hs : 0 < scale := by dsimp [scale]; positivity
refine ⟨D, hD, min (scale^2/100) (scale/100),
lt_min (by positivity) (by positivity), ?_⟩
intro n d eps hAllowed hdim K hK
obtain ⟨nu0, nu1, hnu0, hnu1, hmatch, hp0, hp1, gap, hgap,
hlower, hmean, hescape, _hcontract, _hcancel⟩ :=
hpriors n d eps hAllowed hdim K hK
letI := hp0
letI := hp1
have hd : 0 < d := by have := hAllowed.2.1; omega
have ha := (frontier_converse_amplitude_domain n d eps hAllowed).2
have hdegree : (frontierResources n d eps).converseDegree - 1 + 1 =
(frontierResources n d eps).converseDegree := by
have := frontier_converse_degree_domain n d eps hAllowed
omega
rw [hdegree] at hmatch
let v0 : ℝ := (∫ u, |u| ∂nu0)/2
let v1 : ℝ := (∫ u, |u| ∂nu1)/2
have hcenters : v1-v0 = gap := by
rw [pairedLaw_prior_target_mean hd _ ha nu1 hnu1,
pairedLaw_prior_target_mean hd _ ha nu0 hnu0] at hmean
exact hmean
have hTV := paired_lawspace_resource_contraction hRN_of_gate K eps hK hAllowed
nu0 nu1 hnu0 hnu1 hmatch
have hdec := paired_separated_lawspace_decisions K hAllowed.2.1
((productPrior d nu0).map pairedLaw) ((productPrior d nu1).map pairedLaw)
(pairedLaw_productPrior_support hd _ ha nu0 hnu0)
(pairedLaw_productPrior_support hd _ ha nu1 hnu1)
v0 v1 (1/100) (1/100) (by linarith)
(by simpa only [hcenters] using hescape nu0 (by simp))
(by simpa only [hcenters] using hescape nu1 (by simp)) hTV
rw [hcenters] at hdec
have htest : max (0 : ℝ) (1-1/100-2*(1/100)) = 97/100 := by norm_num
have hlength : max (0 : ℝ) ((0.80 : ℝ)-2*(1/100)-1/100) = 77/100 := by norm_num
rw [htest, hlength] at hdec
have hr0 : 0 ≤ rateR .SI n d eps :=
(by positivity : (0 : ℝ) ≤ min 1 (1/(n*eps^2))).trans
(rho_elementary_comparisons n d eps hAllowed).1
have hh0 : 0 ≤ rateH .SI n d eps := Real.sqrt_nonneg _
have hsq : (rateH .SI n d eps)^2 = rateR .SI n d eps :=
Real.sq_sqrt hr0
have hlower' : scale * rateH .SI n d eps ≤ gap := hlower
have hgapSq : scale^2 * rateR .SI n d eps ≤ gap^2 := by
have h := mul_self_le_mul_self (mul_nonneg hs.le hh0) hlower'
simpa only [← pow_two, mul_pow, hsq] using h
have hr : min (scale^2/100) (scale/100) * rateR .SI n d eps ≤
9*gap^2/128 * (97/100) := by
have h := mul_le_mul_of_nonneg_right
(min_le_left (scale^2/100) (scale/100)) hr0
nlinarith [sq_nonneg gap]
have hh : min (scale^2/100) (scale/100) * rateH .SI n d eps ≤
3*gap/4 * (77/100) := by
have h := mul_le_mul_of_nonneg_right
(min_le_right (scale^2/100) (scale/100)) hh0
nlinarith
exact ⟨fun T => (ENNReal.ofReal_le_ofReal hr).trans (hdec.1 T),
fun J hCov => (ENNReal.ofReal_le_ofReal hh).trans (hdec.2 J hCov)⟩
obtain ⟨D, hD, cLarge, hcLarge, hLarge⟩ := hLarge
let cSmall : ℝ := 1/(32768*(D : ℝ)^2)
have hDpos : (0 : ℝ) < D := by exact_mod_cast (show 0 < D by omega)
have hcSmall : 0 < cSmall := by dsimp [cSmall]; positivity
refine ⟨min cLarge cSmall, lt_min hcLarge hcSmall, ?_⟩
intro n d eps hAllowed K hK
have hr0 : 0 ≤ rateR .SI n d eps :=
(by positivity : (0 : ℝ) ≤ min 1 (1/(n*eps^2))).trans
(rho_elementary_comparisons n d eps hAllowed).1
have hh0 : 0 ≤ rateH .SI n d eps := Real.sqrt_nonneg _
by_cases hdD : d ≤ D
· have hSmall := paired_bounded_dimension_frontier_lower hRN_of_gate D n d eps hD hdD
hAllowed K hK
constructor
· intro T
exact (ENNReal.ofReal_le_ofReal (mul_le_mul_of_nonneg_right
(min_le_right cLarge cSmall) hr0)).trans (hSmall.1 T)
· intro J hCov
exact (ENNReal.ofReal_le_ofReal (mul_le_mul_of_nonneg_right
(min_le_right cLarge cSmall) hh0)).trans (hSmall.2 J hCov)
· have hBig := hLarge n d eps hAllowed (by omega) K hK
constructor
· intro T
exact (ENNReal.ofReal_le_ofReal (mul_le_mul_of_nonneg_right
(min_le_left cLarge cSmall) hr0)).trans (hBig.1 T)
· intro J hCov
exact (ENNReal.ofReal_le_ofReal (mul_le_mul_of_nonneg_right
(min_le_left cLarge cSmall) hh0)).trans (hBig.2 J hCov)
theorem paired_minimax_lower_of_gate
Assume measurable Radon–Nikodym densities for dominated kernels, the Cai–Low moment-duality theorem, and the Bernstein absolute-approximation limit. The paired per-decision converse survives both minimax infima.
Formal statement
hypotheses
hDual :
hBernstein :
conclusion
∃ c : ℝ,
0 < c
conclusion 1
Proof (Lean source)
-- @node: paired_minimax_lower_of_gate
lemma paired_minimax_lower_of_gate (hRN : MeasurableKernelRadonNikodym)
(hDual : CaiLowMomentDuality) (hBernstein : BernsteinAbsoluteApproximationLimit) :
∃ c : ℝ, 0 < c ∧ ∀ n d eps, Allowed n d eps → ∀ C : ProtocolClassLabel,
ofReal (c*rateR C n d eps) ≤ tvMinimaxRisk C (pairedFamily d) n eps ∧
ofReal (c*rateH C n d eps) ≤ tvHonestLength C (pairedFamily d) n eps := by
obtain ⟨c, hc, hLower⟩ := paired_converse_of_gate hRN hDual hBernstein
refine ⟨c, hc, ?_⟩
intro n d eps hAllowed C
have hSeq : ∀ K : LocalProtocol n (PairedSymbol d), protocolClass C K eps →
SequentialClass K eps := by
intro K hK
cases C with
| NI => exact NoninteractiveClass.toSequentialClass K eps hK
| SI => exact hK
constructor
· unfold tvMinimaxRisk riskValue minimaxValueENNReal
apply le_iInf
intro e
exact (hLower n d eps hAllowed e.1.1 (hSeq _ e.1.2)).1 e.2
· unfold tvHonestLength lengthValue minimaxValueENNReal
apply le_iInf
intro e
exact (hLower n d eps hAllowed e.1.1 (hSeq _ e.1.2)).2 e.2.1 e.2.2
theorem tvAttainment_minimax_upper
Assume the stated attain condition. Finite paired attainment bounds both private decision values; the same interval endpoints also define a legal interval in the larger range [0,1].
Formal statement
hypotheses
conclusion
conclusion 1
conclusion 2
Proof (Lean source)
-- @node: tvAttainment_minimax_upper
lemma tvAttainment_minimax_upper (n d : ℕ) (eps r h C0 : ℝ)
(hAttain : TvAttainment n d eps r h C0) (C : ProtocolClassLabel) :
tvMinimaxRisk C (pairedFamily d) n eps ≤ ofReal (C0*r) ∧
tvHonestLength C (pairedFamily d) n eps ≤ ofReal (C0*h) := by
obtain ⟨K, hNI, _hFinite, T, J, _hTranscript, hBounds⟩ := hAttain
have hK : protocolClass C K eps := by
cases C with
| NI => exact hNI
| SI => exact NoninteractiveClass.toSequentialClass K eps hNI
let J' : IntervalDecision K 0 1 :=
{ lo := J.lo, hi := J.hi, measurable_lo := J.measurable_lo,
measurable_hi := J.measurable_hi, ordered := J.ordered,
range_lo := fun w => ⟨(J.range_lo w).1, (J.range_lo w).2.trans (by norm_num)⟩,
range_hi := fun w => ⟨(J.range_hi w).1, (J.range_hi w).2.trans (by norm_num)⟩ }
constructor
· unfold tvMinimaxRisk riskValue minimaxValueENNReal
apply iInf_le_of_le ⟨⟨K, hK⟩, T⟩
apply iSup_le
intro p
exact (hBounds p.1 p.2).1
· unfold tvHonestLength lengthValue minimaxValueENNReal
apply iInf_le_of_le ⟨⟨K, hK⟩, ⟨J', fun p hp => (hBounds p hp).2.1⟩⟩
apply iSup_le
intro p
exact (hBounds p.1 p.2).2.2
theorem tv_ni_si_values
Paired NI optimization is over a smaller protocol class than SI optimization.
Formal statement
hypotheses
n d :
ℕ
eps :
ℝ
conclusion
conclusion 1
conclusion 2
Proof (Lean source)
-- @node: tv_ni_si_values
lemma tv_ni_si_values (n d : ℕ) (eps : ℝ) :
tvMinimaxRisk .SI (pairedFamily d) n eps ≤ tvMinimaxRisk .NI (pairedFamily d) n eps ∧
tvHonestLength .SI (pairedFamily d) n eps ≤ tvHonestLength .NI (pairedFamily d) n eps := by
constructor
· unfold tvMinimaxRisk riskValue Causalean.Stat.minimaxValueENNReal
apply le_iInf
intro e
let q : {K : LocalProtocol n (PairedSymbol d) // protocolClass .SI K eps} :=
⟨e.1.1, NoninteractiveClass.toSequentialClass e.1.1 eps e.1.2⟩
exact iInf_le_of_le ⟨q, e.2⟩ le_rfl
· unfold tvHonestLength lengthValue Causalean.Stat.minimaxValueENNReal
apply le_iInf
intro e
let q : {K : LocalProtocol n (PairedSymbol d) // protocolClass .SI K eps} :=
⟨e.1.1, NoninteractiveClass.toSequentialClass e.1.1 eps e.1.2⟩
exact iInf_le_of_le ⟨q, e.2⟩ le_rfl
theorem paired_uniform_tv_frontier
Given the Bernstein absolute-approximation limit, the paired experiment satisfies the complete TV frontier, finite sign-vector attainment, and resource conclusions.
Formal statement
hypotheses
hBernstein_of_gate :
conclusion
conclusion 2
∃ c C0 : ℝ,
conclusion 3
conclusion 4
ValueSequenceConclusions (fun n d eps => (tvMinimaxRisk C (pairedFamily d) n eps).toReal) (fun n d eps => (tvHonestLength C (pairedFamily d) n eps).toReal)
Proof (Lean source)
theorem paired_uniform_tv_frontier
(hBernstein_of_gate : BernsteinAbsoluteApproximationLimit) :
(∀ d : ℕ, 2 ≤ d → ∀ theta ∈ parameterCube d,
tvFromUniform (pairedLaw theta) = tvDist (pairedLaw theta) (pairedUniform d) ∧
tvFromUniform (pairedLaw theta) = signedNorm theta/2) ∧
(∃ c C0 : ℝ, 0 < c ∧ c ≤ C0 ∧
-- @realizes c(universal positive lower constant); @realizes C_0(universal finite upper constant)
∀ (n d : ℕ) (eps : ℝ), Allowed n d eps → ∀ C : ProtocolClassLabel,
ofReal (c*rateR C n d eps) ≤ tvMinimaxRisk C (pairedFamily d) n eps ∧
tvMinimaxRisk C (pairedFamily d) n eps ≤ ofReal (C0*rateR C n d eps) ∧
ofReal (c*rateH C n d eps) ≤ tvHonestLength C (pairedFamily d) n eps ∧
tvHonestLength C (pairedFamily d) n eps ≤ ofReal (C0*rateH C n d eps) ∧
TvAttainment n d eps (rateR C n d eps) (rateH C n d eps) C0 ∧
ConcreteTvAttainment n d eps C0 ∧
(1 : ℝ≥0∞) ≤ tvMinimaxRisk .NI (pairedFamily d) n eps / tvMinimaxRisk .SI (pairedFamily
d) n eps ∧
tvMinimaxRisk .NI (pairedFamily d) n eps / tvMinimaxRisk .SI (pairedFamily d) n eps ≤
ofReal (C0/c) ∧
(1 : ℝ≥0∞) ≤ tvHonestLength .NI (pairedFamily d) n eps / tvHonestLength .SI
(pairedFamily d) n eps ∧
tvHonestLength .NI (pairedFamily d) n eps / tvHonestLength .SI (pairedFamily d) n eps ≤
ofReal (C0/c)) ∧
RateResourceConclusions ∧
(∀ C : ProtocolClassLabel, ValueSequenceConclusions
(fun n d eps => (tvMinimaxRisk C (pairedFamily d) n eps).toReal)
(fun n d eps => (tvHonestLength C (pairedFamily d) n eps).toReal)) := by
obtain ⟨cLower, hcLower, hLower⟩ :=
paired_minimax_lower_of_gate measurableKernelRadonNikodym_proved
caiLowMomentDuality_proved hBernstein_of_gate
let c := min cLower 1
let C0 : ℝ := (10 : ℝ)^16
have hc : 0 < c := lt_min hcLower (by norm_num)
have hC0 : 0 < C0 := by norm_num [C0]
have hcC : c ≤ C0 := (min_le_right cLower 1).trans (by norm_num [C0])
have hBase : ∀ n d eps, Allowed n d eps → ∀ C : ProtocolClassLabel,
ofReal (c*rateR C n d eps) ≤ tvMinimaxRisk C (pairedFamily d) n eps ∧
tvMinimaxRisk C (pairedFamily d) n eps ≤ ofReal (C0*rateR C n d eps) ∧
ofReal (c*rateH C n d eps) ≤ tvHonestLength C (pairedFamily d) n eps ∧
tvHonestLength C (pairedFamily d) n eps ≤ ofReal (C0*rateH C n d eps) := by
intro n d eps hAllowed C
have hr : 0 ≤ rateR C n d eps :=
(by positivity : (0 : ℝ) ≤ min 1 (1/(n*eps^2))).trans
(rho_elementary_comparisons n d eps hAllowed).1
have hh : 0 ≤ rateH C n d eps := Real.sqrt_nonneg _
obtain ⟨hRl, hHl⟩ := hLower n d eps hAllowed C
obtain ⟨hRu, hHu⟩ := tvAttainment_minimax_upper n d eps _ _ C0
(tvFrontier_attainment boundedMeanConcentration_proved
caiLowChebyshevApproximation_proved n d eps hAllowed) C
exact ⟨(ENNReal.ofReal_le_ofReal (mul_le_mul_of_nonneg_right
(min_le_left cLower 1) hr)).trans hRl, hRu,
(ENNReal.ofReal_le_ofReal (mul_le_mul_of_nonneg_right
(min_le_left cLower 1) hh)).trans hHl, hHu⟩
refine ⟨?_, ⟨c, C0, hc, hcC, ?_⟩, rate_resource_conclusions, ?_⟩
· intro d hd theta htheta
have hp : IsProbabilityMeasure (pairedLaw theta) := pairedFamily_subset_simplex
(by omega) (Set.mem_image_of_mem pairedLaw htheta)
letI := hp
exact ⟨tvFromUniform_eq_tvDist _ (by omega), tvFromUniform_pairedLaw theta htheta (by omega)⟩
· intro n d eps hAllowed C
obtain ⟨hRl, hRu, hHl, hHu⟩ := hBase n d eps hAllowed C
have hn : (0 : ℝ) < n := by
exact_mod_cast (show 0 < n by have := hAllowed.1; omega)
have ht : 0 < (n : ℝ)*eps^2 := mul_pos hn (sq_pos_of_pos hAllowed.2.2.1)
have hr : 0 < rateR .NI n d eps :=
(by positivity : (0 : ℝ) < min 1 (1/(n*eps^2))).trans_le
(rho_elementary_comparisons n d eps hAllowed).1
have hh : 0 < rateH .NI n d eps := Real.sqrt_pos.mpr hr
have hInclusion := tv_ni_si_values n d eps
have hRiskRatio := frontier_ratio_comparison c C0 (rateR .NI n d eps) hc hC0 hr
(tvMinimaxRisk .NI (pairedFamily d) n eps) (tvMinimaxRisk .SI (pairedFamily d) n eps)
hInclusion.1 (hBase n d eps hAllowed .SI).1 (hBase n d eps hAllowed .NI).2.1
have hLengthRatio := frontier_ratio_comparison c C0 (rateH .NI n d eps) hc hC0 hh
(tvHonestLength .NI (pairedFamily d) n eps) (tvHonestLength .SI (pairedFamily d) n eps)
hInclusion.2 (hBase n d eps hAllowed .SI).2.2.1 (hBase n d eps hAllowed .NI).2.2.2
exact ⟨hRl, hRu, hHl, hHu,
tvFrontier_attainment boundedMeanConcentration_proved
caiLowChebyshevApproximation_proved n d eps hAllowed,
tvFrontier_concrete_attainment boundedMeanConcentration_proved
caiLowChebyshevApproximation_proved n d eps hAllowed,
hRiskRatio.1, hRiskRatio.2, hLengthRatio.1, hLengthRatio.2⟩
· intro C
apply value_sequence_conclusions_of_bounds _ _ c C0 hc hcC
intro n d eps hAllowed
obtain ⟨hRlo, hRhi, hHlo, hHhi⟩ := hBase n d eps hAllowed C
have hRfin : tvMinimaxRisk C (pairedFamily d) n eps ≠ ∞ :=
ne_top_of_le_ne_top ENNReal.ofReal_ne_top hRhi
have hHfin : tvHonestLength C (pairedFamily d) n eps ≠ ∞ :=
ne_top_of_le_ne_top ENNReal.ofReal_ne_top hHhi
have hrho : 0 ≤ rho (n*eps^2) d :=
(by positivity : (0 : ℝ) ≤ min 1 (1/(n*eps^2))).trans
(rho_elementary_comparisons n d eps hAllowed).1
refine ⟨?_, ?_, ?_, ?_⟩
· simpa only [rateR, ENNReal.toReal_ofReal (mul_nonneg hc.le hrho)] using
ENNReal.toReal_mono hRfin hRlo
· simpa only [rateR, ENNReal.toReal_ofReal (mul_nonneg hC0.le hrho)] using
ENNReal.toReal_mono ENNReal.ofReal_ne_top hRhi
· simpa only [rateH, rateR,
ENNReal.toReal_ofReal (mul_nonneg hc.le (Real.sqrt_nonneg _))] using
ENNReal.toReal_mono hHfin hHlo
· simpa only [rateH, rateR,
ENNReal.toReal_ofReal (mul_nonneg hC0.le (Real.sqrt_nonneg _))] using
ENNReal.toReal_mono ENNReal.ofReal_ne_top hHhi
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.TSignedCausalBridge 1 declarations Causal identification, symmetric realization, and two-way private experiment equivalence.
Signed causal experiment bridge
Causal identification, symmetric realization, and two-way private experiment equivalence.
theorem signed_causal_bridge
For a scheme with iid participants and independent randomization and at least two cells, the signed construction proves causal identification, symmetric-law realization, and two-way private experiment equivalence.
Formal statement
hypotheses
conclusion
conclusion 1
conclusion 2
theta ∈ parameterCube d :
IsProbabilityMeasure (symmetricLaw theta)
CausalModel (symmetricLaw theta)
value (symmetricLaw theta) = 1/2 + signedNorm theta/2
conclusion 3
eps :
ℝ
Q :
LocalProtocol n (ObsRecord d)
SequentialClass Q eps
SequentialClass (averagedProtocol Q) eps
NoninteractiveClass Q eps
NoninteractiveClass (averagedProtocol Q) eps
theta ∈ parameterCube d :
seedTranscriptLaw S Q (symmetricLaw theta)
K :
LocalProtocol n (PairedSymbol d)
SequentialClass K eps
SequentialClass (pulledProtocol K) eps
NoninteractiveClass K eps
NoninteractiveClass (pulledProtocol K) eps
theta ∈ parameterCube d :
= canonicalSeedTranscriptLaw K (pairedLaw theta)
Proof (Lean source)
theorem signed_causal_bridge (S : SamplingScheme n d) (hIID : IidPeople S)
(hRandom : IndependentRandomness S) (hd : 2 ≤ d) :
(∀ P : Measure (FullRecord d), IsProbabilityMeasure P → CausalModel P →
(∀ j, signedCellMean P j = contrast P j) ∧
(observedLaw P).map signedObserve = pairedLaw (contrast P) ∧
value P = baseline P + signedNorm (contrast P)/2 ∧
value P = baseline P + tvDist (pairedLaw (contrast P)) (pairedUniform d)) ∧
(∀ theta ∈ parameterCube d,
IsProbabilityMeasure (symmetricLaw theta) ∧ CausalModel (symmetricLaw theta) ∧
value (symmetricLaw theta) = 1/2 + signedNorm theta/2 ∧
(∀ (j : Fin d) (s a : Bool),
(symmetricLaw theta).real {w | cell w = j ∧ signedObserve (observe w) = (j,s) ∧ arm w = a} =
(pairedLaw theta).real {(j,s)}/2) ∧
(∀ᵐ w ∂symmetricLaw theta, signVal (outcome w) = obsSign (observe w) * signVal (arm w))) ∧
(∀ eps : ℝ,
(∀ Q : LocalProtocol n (ObsRecord d),
(SequentialClass Q eps → SequentialClass (averagedProtocol Q) eps) ∧
(NoninteractiveClass Q eps → NoninteractiveClass (averagedProtocol Q) eps) ∧
∀ theta ∈ parameterCube d,
seedTranscriptLaw S Q (symmetricLaw theta) =
canonicalSeedTranscriptLaw (averagedProtocol Q) (pairedLaw theta)) ∧
(∀ K : LocalProtocol n (PairedSymbol d),
(SequentialClass K eps → SequentialClass (pulledProtocol K) eps) ∧
(NoninteractiveClass K eps → NoninteractiveClass (pulledProtocol K) eps) ∧
∀ theta ∈ parameterCube d,
seedTranscriptLaw S (pulledProtocol K) (symmetricLaw theta) =
canonicalSeedTranscriptLaw K (pairedLaw theta))) := by
constructor
· intro P hprob hP
letI := hprob
refine ⟨signedCellMean_eq_contrast P hP, ?_, causal_value_decomposition P hP hd, ?_⟩
· exact causal_signed_law P hP (by omega)
· haveI : IsProbabilityMeasure (pairedLaw (contrast P)) :=
pairedFamily_subset_simplex (by omega)
(Set.mem_image_of_mem pairedLaw (contrast_mem_parameterCube P hP))
rw [← tvFromUniform_eq_tvDist _ (by omega)]
rw [tvFromUniform_pairedLaw _ (contrast_mem_parameterCube P hP) (by omega)]
exact causal_value_decomposition P hP hd
constructor
· intro theta htheta
refine ⟨?_, ?_, ?_, ?_, Filter.Eventually.of_forall outcome_sign_reconstruction⟩
· exact symmetricLaw_probability theta htheta (by omega)
· exact symmetricLaw_causalModel theta htheta (by omega)
· exact symmetricLaw_value theta htheta (by omega)
· exact symmetricLaw_ancillary theta htheta
· intro eps
constructor
· intro Q
obtain ⟨hSI, hNI⟩ := (signed_protocol_classes (n := n) (d := d) eps).1 Q
refine ⟨hSI, hNI, ?_⟩
intro theta htheta
rw [seedTranscriptLaw, symmetricLaw_reconstructed_decisionLaw
S hIID hRandom (by omega) Q theta htheta]
haveI : IsProbabilityMeasure (pairedLaw theta) :=
pairedFamily_subset_simplex (by omega) (Set.mem_image_of_mem pairedLaw htheta)
rw [averagedProtocol_reconstructed_decisionLaw]
rfl
· intro K
obtain ⟨hSI, hNI⟩ := (signed_protocol_classes (n := n) (d := d) eps).2 K
refine ⟨hSI, hNI, ?_⟩
intro theta htheta
exact congrArg (fun μ => μ.map (fun w => (w.2.1,w.1)))
(pulledProtocol_decisionLaw S hIID hRandom hd K theta htheta)
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.TTwoCellCalibration 1 declarations Finite original-record private value frontiers: TTwoCellCalibration.
TTwoCellCalibration
Finite original-record private value frontiers: TTwoCellCalibration.
theorem two_cell_calibration
The two-cell model has universal finite private risk bounds, globally honest length bounds, and explicit attainment.
Formal statement
Proof (Lean source)
theorem two_cell_calibration :
∃ c C0 : ℝ, 0 < c ∧ c ≤ C0 ∧
-- @realizes c(universal positive lower constant); @realizes C_0(universal finite upper constant)
∀ (n : ℕ) (eps : ℝ), Allowed n 2 eps →
∀ (S : SamplingScheme n 2), IidPeople S → IndependentRandomness S →
∀ C : ProtocolClassLabel,
ofReal (c * min 1 (1/(n*eps^2))) ≤ minimaxRisk S C eps ∧
minimaxRisk S C eps ≤ ofReal (C0 * min 1 (1/(n*eps^2))) ∧
ofReal (c * min 1 (1/(sqrt n*eps))) ≤ honestLength S C eps ∧
honestLength S C eps ≤ ofReal (C0 * min 1 (1/(sqrt n*eps))) ∧
CausalAttainment S eps (min 1 (1/(n*eps^2))) (min 1 (1/(sqrt n*eps))) C0 := by
obtain ⟨c1, hc1, hLower⟩ :=
dimension_free_private_two_point measurableKernelRadonNikodym_proved
refine ⟨min c1 1, 1000, lt_min hc1 (by norm_num),
(min_le_right c1 1).trans (by norm_num), ?_⟩
intro n eps hAllowed S hIID hRandom C
have heps : 0 < eps := hAllowed.2.2.1
have hAttain : CausalAttainment S eps (min 1 (1/(n*eps^2)))
(min 1 (1/(sqrt n*eps))) 1000 := by
by_cases ht : (n : ℝ)*eps^2 ≤ 1
· exact causalAttainment_mono_constant S eps _ _ 1 1000
(by positivity) (by positivity) (by norm_num)
(two_cell_saturated_attainment n eps hAllowed S hIID hRandom ht)
· apply two_cell_unsaturated_attainment_of_components eps hAllowed S hIID hRandom
(lt_of_not_ge ht)
exact twoCellComponents_of_sampling n eps hAllowed S hIID hRandom
obtain ⟨hRiskUpper, hLengthUpper⟩ :=
causalAttainment_minimax_upper S eps _ _ 1000 hAttain C
obtain ⟨hRiskLower, hLengthLower⟩ := hLower n 2 eps hAllowed S hIID hRandom C
refine ⟨?_, hRiskUpper, ?_, hLengthUpper, hAttain⟩
· exact (ENNReal.ofReal_le_ofReal (mul_le_mul_of_nonneg_right
(min_le_left c1 1) (by positivity))).trans hRiskLower
· exact (ENNReal.ofReal_le_ofReal (mul_le_mul_of_nonneg_right
(min_le_left c1 1) (by positivity))).trans hLengthLower
CausalSmith.Stat.STAT_LdpOptvalueUniformFrontier_Research.TUniformPrivateValueFrontiers 5 declarations Finite original-record private value frontiers: TUniformPrivateValueFrontiers.
TUniformPrivateValueFrontiers
Finite original-record private value frontiers: TUniformPrivateValueFrontiers.
theorem frontier_minimax_lower_of_gate
Assume measurable Radon–Nikodym densities for dominated kernels, the Cai–Low moment-duality theorem, and the Bernstein absolute-approximation limit. Per-decision sequential lower bounds survive both minimax infima.
Formal statement
hypotheses
hDual :
hBernstein :
Proof (Lean source)
-- @node: frontier_minimax_lower_of_gate
lemma frontier_minimax_lower_of_gate (hRN : MeasurableKernelRadonNikodym)
(hDual : CaiLowMomentDuality) (hBernstein : BernsteinAbsoluteApproximationLimit) :
∃ c : ℝ, 0 < c ∧ ∀ n d eps, Allowed n d eps →
∀ S : SamplingScheme n d, IidPeople S → IndependentRandomness S →
∀ C : ProtocolClassLabel,
ofReal (c*rateR C n d eps) ≤ minimaxRisk S C eps ∧
ofReal (c*rateH C n d eps) ≤ honestLength S C eps := by
obtain ⟨c, hc, hLower⟩ := frontier_lower_of_gate hRN hDual hBernstein
refine ⟨c, hc, ?_⟩
intro n d eps hAllowed S hIID hRandom C
have hSeq : ∀ Q : LocalProtocol n (ObsRecord d), protocolClass C Q eps →
SequentialClass Q eps := by
intro Q hQ
cases C with
| NI => exact NoninteractiveClass.toSequentialClass Q eps hQ
| SI => exact hQ
constructor
· unfold minimaxRisk riskValue minimaxValueENNReal
apply le_iInf
intro e
exact (hLower n d eps hAllowed S hIID hRandom e.1.1 (hSeq _ e.1.2)).1 e.2
· unfold honestLength lengthValue minimaxValueENNReal
apply le_iInf
intro e
exact (hLower n d eps hAllowed S hIID hRandom e.1.1 (hSeq _ e.1.2)).2 e.2.1 e.2.2
Assume the stated hc condition, the stated c condition, the stated hr condition, the stated r assumption and the function H, the stated rlo condition, the stated rhi condition, the stated hlo condition, and the stated hhi condition. Separate risk and honest-length bounds imply their square-root comparison.
Formal statement
Proof (Lean source)
-- @node: frontier_square_comparison
lemma frontier_square_comparison (c C r : ℝ) (hc : 0 < c) (hC : 0 < C)
(hr : 0 ≤ r) (R H : ℝ≥0∞)
(hRlo : ofReal (c*r) ≤ R) (hRhi : R ≤ ofReal (C*r))
(hHlo : ofReal (c*sqrt r) ≤ H)
(hHhi : H ≤ ofReal (C*sqrt r)) :
ofReal (c^2/C)*R ≤ H^2 ∧ H^2 ≤ ofReal (C^2/c)*R := by
have hRf : R ≠ ∞ := ne_top_of_le_ne_top ENNReal.ofReal_ne_top hRhi
have hHf : H ≠ ∞ := ne_top_of_le_ne_top ENNReal.ofReal_ne_top hHhi
have hRl : c*r ≤ R.toReal := by
simpa only [ENNReal.toReal_ofReal (mul_nonneg hc.le hr)] using
ENNReal.toReal_mono hRf hRlo
have hRu : R.toReal ≤ C*r := by
simpa only [ENNReal.toReal_ofReal (mul_nonneg hC.le hr)] using
ENNReal.toReal_mono ENNReal.ofReal_ne_top hRhi
have hHl : c*sqrt r ≤ H.toReal := by
simpa only [ENNReal.toReal_ofReal (mul_nonneg hc.le (Real.sqrt_nonneg r))] using
ENNReal.toReal_mono hHf hHlo
have hHu : H.toReal ≤ C*sqrt r := by
simpa only [ENNReal.toReal_ofReal (mul_nonneg hC.le (Real.sqrt_nonneg r))] using
ENNReal.toReal_mono ENNReal.ofReal_ne_top hHhi
have hsqlo : c^2*r ≤ H.toReal^2 := by
have h := mul_le_mul hHl hHl
(mul_nonneg hc.le (Real.sqrt_nonneg r)) ENNReal.toReal_nonneg
simpa only [← sq, mul_pow, Real.sq_sqrt hr] using h
have hsqup : H.toReal^2 ≤ C^2*r := by
have h := mul_le_mul hHu hHu ENNReal.toReal_nonneg
(mul_nonneg hC.le (Real.sqrt_nonneg r))
simpa only [← sq, mul_pow, Real.sq_sqrt hr] using h
constructor
· apply (ENNReal.toReal_le_toReal (ENNReal.mul_ne_top ENNReal.ofReal_ne_top hRf)
(ENNReal.pow_ne_top hHf)).mp
rw [ENNReal.toReal_mul, ENNReal.toReal_pow,
ENNReal.toReal_ofReal (by positivity : 0 ≤ c^2/C)]
calc
(c^2/C)*R.toReal ≤ (c^2/C)*(C*r) :=
mul_le_mul_of_nonneg_left hRu (by positivity)
_ = c^2*r := by field_simp <;> ring
_ ≤ H.toReal^2 := hsqlo
· apply (ENNReal.toReal_le_toReal (ENNReal.pow_ne_top hHf)
(ENNReal.mul_ne_top ENNReal.ofReal_ne_top hRf)).mp
rw [ENNReal.toReal_mul, ENNReal.toReal_pow,
ENNReal.toReal_ofReal (by positivity : 0 ≤ C^2/c)]
calc
H.toReal^2 ≤ C^2*r := hsqup
_ = (C^2/c)*(c*r) := by field_simp <;> ring
_ ≤ (C^2/c)*R.toReal := mul_le_mul_of_nonneg_left hRl (by positivity)
Assume the stated hc condition, the stated c condition, the stated hr condition, the stated a assumption and the constant B, the stated ba condition, the stated blo condition, and the stated ahi condition. Nested finite positive values with common rate bounds have bounded ratios.
Formal statement
Proof (Lean source)
-- @node: frontier_ratio_comparison
lemma frontier_ratio_comparison (c C r : ℝ) (hc : 0 < c) (hC : 0 < C)
(hr : 0 < r) (A B : ℝ≥0∞) (hBA : B ≤ A)
(hBlo : ofReal (c*r) ≤ B) (hAhi : A ≤ ofReal (C*r)) :
1 ≤ A/B ∧ A/B ≤ ofReal (C/c) := by
have hAf : A ≠ ∞ := ne_top_of_le_ne_top ENNReal.ofReal_ne_top hAhi
have hBf : B ≠ ∞ := ne_top_of_le_ne_top hAf hBA
have hBp : 0 < B := (ENNReal.ofReal_pos.mpr (mul_pos hc hr)).trans_le hBlo
have hB0 : B ≠ 0 := ne_of_gt hBp
have hBt : 0 < B.toReal := ENNReal.toReal_pos hB0 hBf
have hBl : c*r ≤ B.toReal := by
simpa only [ENNReal.toReal_ofReal (mul_pos hc hr).le] using
ENNReal.toReal_mono hBf hBlo
have hAu : A.toReal ≤ C*r := by
simpa only [ENNReal.toReal_ofReal (mul_pos hC hr).le] using
ENNReal.toReal_mono ENNReal.ofReal_ne_top hAhi
have hAB : B.toReal ≤ A.toReal := ENNReal.toReal_mono hAf hBA
have hdivf : A/B ≠ ∞ := ENNReal.div_ne_top hAf hB0
constructor
· apply (ENNReal.toReal_le_toReal (by simp) hdivf).mp
simp only [ENNReal.toReal_one, ENNReal.toReal_div]
exact (le_div_iff₀ hBt).mpr (by simpa using hAB)
· apply (ENNReal.toReal_le_toReal hdivf ENNReal.ofReal_ne_top).mp
rw [ENNReal.toReal_div, ENNReal.toReal_ofReal (by positivity : 0 ≤ C/c)]
apply (div_le_iff₀ hBt).mpr
calc
A.toReal ≤ C*r := hAu
_ = (C/c)*(c*r) := by field_simp <;> ring
_ ≤ (C/c)*B.toReal := mul_le_mul_of_nonneg_left hBl (by positivity)
Fix the sampling scheme S and the privacy budget and the constant C0. Every finite causal upper bound is attained by the resource-selected explicit protocol.
Definition (Lean source)
parameters
def
ConcreteCausalAttainment S eps C0 :
Prop
given by
design :
frontierDesign n d eps
NoninteractiveClass design.protocol eps
P ∈ causalClass d :
squaredRisk (decisionLaw S design.protocol P) design.estimator (value P)
(0.90 : ℝ) ≤ coverage (decisionLaw S design.protocol P) design.interval (value P)
expectedLength (decisionLaw S design.protocol P) design.interval
theorem uniform_private_value_frontiers
Given the Bernstein absolute-approximation limit, the causal experiment satisfies the complete finite-resource frontier, explicit attainment, NI/SI and risk/length comparisons, saturation, consistency, private-parametric boundary, and growing-dimension elbow.
Formal statement
hypotheses
hBernstein_of_gate :
conclusion
∃ c C0 : ℝ,
0 < c
c ≤ C0
conclusion 1
ConcreteCausalAttainment S eps C0
(1 : ℝ≥0∞) ≤ minimaxRisk S .NI eps / minimaxRisk S .SI eps
(1 : ℝ≥0∞) ≤ honestLength S .NI eps / honestLength S .SI eps
conclusion 2
conclusion 3
schemes :
(n d : ℕ) → SamplingScheme n d
(∀ n d, IidPeople (schemes n d))
(∀ n d, IndependentRandomness (schemes n d))
ValueSequenceConclusions (fun n d eps => (minimaxRisk (schemes n d) C eps).toReal) (fun n d eps => (honestLength (schemes n d) C eps).toReal)
Proof (Lean source)
theorem uniform_private_value_frontiers
(hBernstein_of_gate : BernsteinAbsoluteApproximationLimit) :
∃ c C0 : ℝ, 0 < c ∧ c ≤ C0 ∧
-- @realizes c(universal positive lower constant); @realizes C_0(universal finite upper constant)
(∀ (n d : ℕ) (eps : ℝ), Allowed n d eps →
∀ (S : SamplingScheme n d), IidPeople S → IndependentRandomness S →
(∀ C : ProtocolClassLabel,
ofReal (c*rateR C n d eps) ≤ minimaxRisk S C eps ∧
minimaxRisk S C eps ≤ ofReal (C0*rateR C n d eps) ∧
ofReal (c*rateH C n d eps) ≤ honestLength S C eps ∧
honestLength S C eps ≤ ofReal (C0*rateH C n d eps) ∧
CausalAttainment S eps (rateR C n d eps) (rateH C n d eps) C0 ∧
ofReal (c^2/C0) * minimaxRisk S C eps ≤ (honestLength S C eps)^2 ∧
(honestLength S C eps)^2 ≤ ofReal (C0^2/c) * minimaxRisk S C eps) ∧
ConcreteCausalAttainment S eps C0 ∧
(1 : ℝ≥0∞) ≤ minimaxRisk S .NI eps / minimaxRisk S .SI eps ∧
minimaxRisk S .NI eps / minimaxRisk S .SI eps ≤ ofReal (C0/c) ∧
(1 : ℝ≥0∞) ≤ honestLength S .NI eps / honestLength S .SI eps ∧
honestLength S .NI eps / honestLength S .SI eps ≤ ofReal (C0/c)) ∧
RateResourceConclusions ∧
(∀ (schemes : (n d : ℕ) → SamplingScheme n d),
(∀ n d, IidPeople (schemes n d)) → (∀ n d, IndependentRandomness (schemes n d)) →
∀ C : ProtocolClassLabel,
ValueSequenceConclusions
(fun n d eps => (minimaxRisk (schemes n d) C eps).toReal)
(fun n d eps => (honestLength (schemes n d) C eps).toReal)) := by
-- Assemble the explicit NI upper bound with the per-decision SI converse.
have hFinite :
∃ c C0 : ℝ, 0 < c ∧ c ≤ C0 ∧
-- @realizes c(universal positive lower constant); @realizes C_0(universal finite upper constant)
(∀ (n d : ℕ) (eps : ℝ), Allowed n d eps →
∀ (S : SamplingScheme n d), IidPeople S → IndependentRandomness S →
(∀ C : ProtocolClassLabel,
ofReal (c*rateR C n d eps) ≤ minimaxRisk S C eps ∧
minimaxRisk S C eps ≤ ofReal (C0*rateR C n d eps) ∧
ofReal (c*rateH C n d eps) ≤ honestLength S C eps ∧
honestLength S C eps ≤ ofReal (C0*rateH C n d eps) ∧
CausalAttainment S eps (rateR C n d eps) (rateH C n d eps) C0 ∧
ofReal (c^2/C0) * minimaxRisk S C eps ≤ (honestLength S C eps)^2 ∧
(honestLength S C eps)^2 ≤ ofReal (C0^2/c) * minimaxRisk S C eps) ∧
ConcreteCausalAttainment S eps C0 ∧
(1 : ℝ≥0∞) ≤ minimaxRisk S .NI eps / minimaxRisk S .SI eps ∧
minimaxRisk S .NI eps / minimaxRisk S .SI eps ≤ ofReal (C0/c) ∧
(1 : ℝ≥0∞) ≤ honestLength S .NI eps / honestLength S .SI eps ∧
honestLength S .NI eps / honestLength S .SI eps ≤ ofReal (C0/c)) := by
obtain ⟨cLower, hcLower, hLower⟩ :=
frontier_minimax_lower_of_gate measurableKernelRadonNikodym_proved
caiLowMomentDuality_proved hBernstein_of_gate
obtain ⟨cUpper, hcUpper, hUpper⟩ :=
frontier_upper_of_gate caiLowChebyshevApproximation_proved boundedMeanConcentration_proved
let c := min cLower 1
let C0 := max 1 (max cUpper (sqrt (40*cUpper)))
have hc : 0 < c := lt_min hcLower (by norm_num)
have hC0 : 0 < C0 := lt_of_lt_of_le (by norm_num) (le_max_left _ _)
have hcC : c ≤ C0 := (min_le_right _ _).trans (le_max_left _ _)
have hUpperC : cUpper ≤ C0 := (le_max_left _ _).trans (le_max_right _ _)
have hLengthC : sqrt (40*cUpper) ≤ C0 :=
(le_max_right _ _).trans (le_max_right _ _)
refine ⟨c, C0, hc, hcC, ?_⟩
intro n d eps hAllowed S hIID hRandom
have hn : (0 : ℝ) < n := by
exact_mod_cast (show 0 < n by have := hAllowed.1; omega)
have ht : 0 < (n : ℝ)*eps^2 := mul_pos hn (sq_pos_of_pos hAllowed.2.2.1)
have hr : 0 < rateR .NI n d eps :=
(by positivity : (0 : ℝ) < min 1 (1/(n*eps^2))).trans_le
(rho_elementary_comparisons n d eps hAllowed).1
have hh : 0 < rateH .NI n d eps := Real.sqrt_pos.mpr hr
obtain ⟨hNI, hDesign⟩ := hUpper n d eps hAllowed S hIID hRandom
have hBounds : ∀ P ∈ causalClass d,
squaredRisk (decisionLaw S (frontierProtocol n d eps) P)
(frontierEstimator n d eps) (value P) ≤ ofReal (C0*rateR .NI n d eps) ∧
(0.90 : ℝ) ≤ coverage (decisionLaw S (frontierProtocol n d eps) P)
(frontierInterval n d eps) (value P) ∧
expectedLength (decisionLaw S (frontierProtocol n d eps) P)
(frontierInterval n d eps) ≤ ofReal (C0*rateH .NI n d eps) := by
intro P hP
obtain ⟨hR, hCov, hH⟩ := hDesign P hP
exact ⟨hR.trans (ENNReal.ofReal_le_ofReal
(mul_le_mul_of_nonneg_right hUpperC hr.le)), hCov,
hH.trans (ENNReal.ofReal_le_ofReal
(mul_le_mul_of_nonneg_right hLengthC hh.le))⟩
have hAttain : CausalAttainment S eps (rateR .NI n d eps) (rateH .NI n d eps) C0 := by
refine ⟨frontierProtocol n d eps, hNI, frontierEstimator n d eps,
frontierInterval n d eps, ?_, hBounds⟩
refine ⟨fun z => frontierEstimate n d eps (z, (0 : Fin 1), 0), ?_, ?_⟩
· exact (frontierEstimate_measurable n d eps).comp
(by fun_prop : Measurable (fun z : ProtocolTranscript (frontierProtocol n d eps) =>
(z, (0 : Fin 1), (0 : ℝ))))
· intro w
rfl
have hBase : ∀ C : ProtocolClassLabel,
ofReal (c*rateR C n d eps) ≤ minimaxRisk S C eps ∧
minimaxRisk S C eps ≤ ofReal (C0*rateR C n d eps) ∧
ofReal (c*rateH C n d eps) ≤ honestLength S C eps ∧
honestLength S C eps ≤ ofReal (C0*rateH C n d eps) := by
intro C
obtain ⟨hRl, hHl⟩ := hLower n d eps hAllowed S hIID hRandom C
obtain ⟨hRu, hHu⟩ := causalAttainment_minimax_upper S eps _ _ C0 hAttain C
exact ⟨(ENNReal.ofReal_le_ofReal
(mul_le_mul_of_nonneg_right (min_le_left cLower 1) hr.le)).trans hRl,
hRu, (ENNReal.ofReal_le_ofReal
(mul_le_mul_of_nonneg_right (min_le_left cLower 1) hh.le)).trans hHl, hHu⟩
have hInclusion := ni_si_values S eps
have hRiskRatio := frontier_ratio_comparison c C0 (rateR .NI n d eps) hc hC0 hr
(minimaxRisk S .NI eps) (minimaxRisk S .SI eps) hInclusion.1
(hBase .SI).1 (hBase .NI).2.1
have hLengthRatio := frontier_ratio_comparison c C0 (rateH .NI n d eps) hc hC0 hh
(honestLength S .NI eps) (honestLength S .SI eps) hInclusion.2
(hBase .SI).2.2.1 (hBase .NI).2.2.2
refine ⟨?_, ⟨hNI, hBounds⟩, hRiskRatio.1, hRiskRatio.2,
hLengthRatio.1, hLengthRatio.2⟩
intro C
obtain ⟨hRl, hRu, hHl, hHu⟩ := hBase C
have hSquare := frontier_square_comparison c C0 (rateR C n d eps) hc hC0 hr.le
(minimaxRisk S C eps) (honestLength S C eps) hRl hRu hHl hHu
exact ⟨hRl, hRu, hHl, hHu, hAttain, hSquare⟩
obtain ⟨c, C0, hc, hcC, hFinite⟩ := hFinite
refine ⟨c, C0, hc, hcC, hFinite, rate_resource_conclusions, ?_⟩
intro schemes hIID hRandom C
apply value_sequence_conclusions_of_bounds _ _ c C0 hc hcC
intro n d eps hAllowed
obtain ⟨hRlo, hRhi, hHlo, hHhi, _⟩ :=
(hFinite n d eps hAllowed (schemes n d) (hIID n d) (hRandom n d)).1 C
have hRfin : minimaxRisk (schemes n d) C eps ≠ ∞ :=
ne_top_of_le_ne_top ENNReal.ofReal_ne_top hRhi
have hHfin : honestLength (schemes n d) C eps ≠ ∞ :=
ne_top_of_le_ne_top ENNReal.ofReal_ne_top hHhi
have hrho : 0 ≤ rho (n*eps^2) d :=
(by positivity : (0 : ℝ) ≤ min 1 (1/(n*eps^2))).trans
(rho_elementary_comparisons n d eps hAllowed).1
have hC0 : 0 < C0 := hc.trans_le hcC
refine ⟨?_, ?_, ?_, ?_⟩
· simpa only [rateR, ENNReal.toReal_ofReal (mul_nonneg hc.le hrho)] using
ENNReal.toReal_mono hRfin hRlo
· simpa only [rateR, ENNReal.toReal_ofReal (mul_nonneg hC0.le hrho)] using
ENNReal.toReal_mono ENNReal.ofReal_ne_top hRhi
· simpa only [rateH, rateR,
ENNReal.toReal_ofReal (mul_nonneg hc.le (Real.sqrt_nonneg _))] using
ENNReal.toReal_mono hHfin hHlo
· simpa only [rateH, rateR,
ENNReal.toReal_ofReal (mul_nonneg hC0.le (Real.sqrt_nonneg _))] using
ENNReal.toReal_mono ENNReal.ofReal_ne_top hHhi