| Title: | R Bindings for the OpenDP Library |
|---|---|
| Description: | The OpenDP Library is a modular collection of statistical algorithms that adhere to the definition of differential privacy. It can be used to build applications of privacy-preserving computations, using a number of different models of privacy. |
| Authors: | Stefano Iacus [cre], The OpenDP Project [aut] (https://github.com/opendp/opendp/graphs/contributors), The authors of the dependency Rust crates [ctb] (see inst/AUTHORS file for details) |
| Maintainer: | Stefano Iacus <[email protected]> |
| License: | MIT + file LICENSE |
| Version: | 0.15.1 |
| Built: | 2026-05-29 05:24:31 UTC |
| Source: | https://github.com/opendp/opendp |
AbsoluteDistance metric.absolute_distance in Rust documentation.
absolute_distance(.T)absolute_distance(.T)
.T |
undocumented |
Metric
accuracy (tolerance) into a discrete gaussian noise scale at a statistical significance level alpha.accuracy_to_discrete_gaussian_scale in Rust documentation.
accuracy_to_discrete_gaussian_scale(accuracy, alpha, .T = NULL)accuracy_to_discrete_gaussian_scale(accuracy, alpha, .T = NULL)
accuracy |
Desired accuracy. A tolerance for how far values may diverge from the input to the mechanism. |
alpha |
Statistical significance, level- |
.T |
Data type of |
Proof Definition:
accuracy (tolerance) into a discrete Laplacian noise scale at a statistical significance level alpha.accuracy_to_discrete_laplacian_scale in Rust documentation.
accuracy_to_discrete_laplacian_scale(accuracy, alpha, .T = NULL)accuracy_to_discrete_laplacian_scale(accuracy, alpha, .T = NULL)
accuracy |
Desired accuracy. A tolerance for how far values may diverge from the input to the mechanism. |
alpha |
Statistical significance, level- |
.T |
Data type of |
Proof Definition:
Discrete laplacian noise scale that meets the accuracy requirement at a given level-alpha.
accuracy (tolerance) into a gaussian noise scale at a statistical significance level alpha.accuracy_to_gaussian_scale in Rust documentation.
accuracy_to_gaussian_scale(accuracy, alpha, .T = NULL)accuracy_to_gaussian_scale(accuracy, alpha, .T = NULL)
accuracy |
Desired accuracy. A tolerance for how far values may diverge from the input to the mechanism. |
alpha |
Statistical significance, level- |
.T |
Data type of |
accuracy (tolerance) into a Laplacian noise scale at a statistical significance level alpha.accuracy_to_laplacian_scale in Rust documentation.
accuracy_to_laplacian_scale(accuracy, alpha, .T = NULL)accuracy_to_laplacian_scale(accuracy, alpha, .T = NULL)
accuracy |
Desired accuracy. A tolerance for how far values may diverge from the input to the mechanism. |
alpha |
Statistical significance, level- |
.T |
Data type of |
Laplacian noise scale that meets the accuracy requirement at a given level-alpha.
In the following definition, corresponds to privacy parameters
when also quantified over all adjacent datasets
( is the privacy parameter corresponding to privacy measure PM).
That is, is no smaller than (by product ordering),
over all pairs of adjacent datasets where , .
is a measurement (commonly known as a mechanism).
The measurement's input metric defines the notion of adjacency,
and the measurement's input domain defines the set of possible datasets.
approximate(measure)approximate(measure)
measure |
inner privacy measure |
approximate in Rust documentation.
Proof Definition:
For any two distributions and 2-tuple ,
where is the distance with respect to privacy measure PM,
are -close under the approximate PM measure whenever,
for any choice of ,
there exist events (depending on ) and (depending on )
such that , , and
where denotes the distribution of conditioned on the event .
Note that this is not privacy parameter until quantified over all adjacent datasets,
as is done in the definition of a measurement.
ApproximateDivergence
AtomDomain.The domain defaults to unbounded if bounds is None,
If T is float, nan defaults to true.
atom_domain(bounds = NULL, nan = NULL, .T = NULL)atom_domain(bounds = NULL, nan = NULL, .T = NULL)
bounds |
Optional bounds of elements in the domain, if the data type is numeric. |
nan |
Whether the domain may contain NaN, if the data type is float. |
.T |
The type of the atom. |
atom_domain in Rust documentation.
AtomDomain
atom_domain(.T = "i32")atom_domain(.T = "i32")
predicate
If bounds are not passed, conducts an exponential search.
binary_search(predicate, bounds = NULL, .T = NULL, return_sign = FALSE)binary_search(predicate, bounds = NULL, .T = NULL, return_sign = FALSE)
predicate |
a monotonic unary function from a number to a boolean |
bounds |
a 2-tuple of the lower and upper bounds on the input of |
.T |
type of argument to |
return_sign |
if True, also return the direction away from the decision boundary |
the discovered parameter within the bounds
d_in, d_out)-close Transformation or Measurement.Searches for the numeric parameter to make_chain that results in a computation
that most tightly satisfies d_out when datasets differ by at most d_in,
then returns the Transformation or Measurement corresponding to said parameter.
binary_search_chain(make_chain, d_in, d_out, bounds = NULL, .T = NULL)binary_search_chain(make_chain, d_in, d_out, bounds = NULL, .T = NULL)
make_chain |
a function that takes a number and returns a Transformation or Measurement |
d_in |
how far apart input datasets can be |
d_out |
how far apart output datasets or distributions can be |
bounds |
a 2-tuple of the lower and upper bounds on the input of |
.T |
type of argument to |
See binary_search_param to retrieve the discovered parameter instead of the complete computation chain.
a Transformation or Measurement (chain) that is (d_in, d_out)-close.
enable_features("contrib") # create a sum transformation over the space of float vectors s_vec <- c(vector_domain(atom_domain(.T = "float", nan = FALSE)), symmetric_distance()) t_sum <- s_vec |> then_clamp(c(0., 1.)) |> then_sum() # find a measurement that satisfies epsilon = 1 when datasets differ by at most one record m_sum <- binary_search_chain(\(s) t_sum |> then_laplace(s), d_in = 1L, d_out = 1.)enable_features("contrib") # create a sum transformation over the space of float vectors s_vec <- c(vector_domain(atom_domain(.T = "float", nan = FALSE)), symmetric_distance()) t_sum <- s_vec |> then_clamp(c(0., 1.)) |> then_sum() # find a measurement that satisfies epsilon = 1 when datasets differ by at most one record m_sum <- binary_search_chain(\(s) t_sum |> then_laplace(s), d_in = 1L, d_out = 1.)
make_chain
Searches for the numeric parameter to make_chain that results in a computation
that most tightly satisfies d_out when datasets differ by at most d_in.
binary_search_param(make_chain, d_in, d_out, bounds = NULL, .T = NULL)binary_search_param(make_chain, d_in, d_out, bounds = NULL, .T = NULL)
make_chain |
a function that takes a number and returns a Transformation or Measurement |
d_in |
how far apart input datasets can be |
d_out |
how far apart output datasets or distributions can be |
bounds |
a 2-tuple of the lower and upper bounds on the input of |
.T |
type of argument to |
the parameter to make_chain that results in a (d_in, d_out)-close Transformation or Measurement
BitVectorDomain.Construct an instance of BitVectorDomain.
bitvector_domain(max_weight = NULL)bitvector_domain(max_weight = NULL)
max_weight |
The maximum number of positive bits. |
Domain
ChangeOneDistance metric.Construct an instance of the ChangeOneDistance metric.
change_one_distance()change_one_distance()
Metric
branching_factor for a dataset of a given size,
that minimizes error in cdf and quantile estimates based on b-ary trees.Required features: contrib
choose_branching_factor(size_guess)choose_branching_factor(size_guess)
size_guess |
A guess at the size of your dataset. |
choose_branching_factor in Rust documentation.
Citations:
int
Disable features in the opendp package.
disable_features(...)disable_features(...)
... |
features to disable |
DiscreteDistance metric.Construct an instance of the DiscreteDistance metric.
discrete_distance()discrete_distance()
Metric
alpha.discrete_gaussian_scale_to_accuracy in Rust documentation.
discrete_gaussian_scale_to_accuracy(scale, alpha, .T = NULL)discrete_gaussian_scale_to_accuracy(scale, alpha, .T = NULL)
scale |
Gaussian noise scale. |
alpha |
Statistical significance, level- |
.T |
Data type of |
Proof Definition:
alpha., where , and .
That is, is a discrete Laplace random variable and is the distribution of the errors.
discrete_laplacian_scale_to_accuracy(scale, alpha, .T = NULL)discrete_laplacian_scale_to_accuracy(scale, alpha, .T = NULL)
scale |
Discrete Laplacian noise scale. |
alpha |
Statistical significance, level- |
.T |
Data type of |
This function returns a float accuracy. You can take the floor without affecting the coverage probability.
discrete_laplacian_scale_to_accuracy in Rust documentation.
Proof Definition:
domain.Get the carrier type of a domain.
domain_carrier_type(this)domain_carrier_type(this)
this |
The domain to retrieve the carrier type from. |
str
domain.Debug a domain.
domain_debug(this)domain_debug(this)
this |
The domain to debug (stringify). |
str
domain.Get the type of a domain.
domain_type(this)domain_type(this)
this |
The domain to retrieve the type from. |
str
See https://github.com/opendp/opendp/discussions/304 for available features.
enable_features(...)enable_features(...)
... |
features to enable |
type signature for an arbitrary R object preserved across FFI
ExtrinsicObjectExtrinsicObject
type signature for a 32-bit floating point number
f32f32
type signature for a 64-bit floating point number
f64f64
In the following definition, corresponds to when also quantified over all adjacent datasets.
That is, is no smaller than (by product ordering),
over all pairs of adjacent datasets where , .
is a measurement (commonly known as a mechanism).
The measurement's input metric defines the notion of adjacency,
and the measurement's input domain defines the set of possible datasets.
fixed_smoothed_max_divergence()fixed_smoothed_max_divergence()
Proof Definition:
For any two distributions and any 2-tuple of non-negative numbers and ,
are -close under the fixed smoothed max divergence measure whenever
.
Note that this and are not privacy parameters and until quantified over all adjacent datasets,
as is done in the definition of a measurement.
Measure
function with arg.Eval the function with arg.
function_eval(this, arg, TI = NULL)function_eval(this, arg, TI = NULL)
this |
Function to invoke. |
arg |
Input data to supply to the measurement. A member of the measurement's input domain. |
TI |
Input Type. |
alpha.gaussian_scale_to_accuracy in Rust documentation.
gaussian_scale_to_accuracy(scale, alpha, .T = NULL)gaussian_scale_to_accuracy(scale, alpha, .T = NULL)
scale |
Gaussian noise scale. |
alpha |
Statistical significance, level- |
.T |
Data type of |
HammingDistance metric.Construct an instance of the HammingDistance metric.
hamming_distance()hamming_distance()
Metric
extract heterogeneously typed keys and values from a hashtab
hashitems(data, type_name)hashitems(data, type_name)
data |
a hashtab |
type_name |
the expected runtime_type of the hashtab |
type signature for a 128-bit signed integer
i128i128
type signature for a 16-bit signed integer
i16i16
type signature for a 32-bit signed integer
i32i32
type signature for a 64-bit signed integer
i64i64
type signature for an 8-bit signed integer
i8i8
InsertDeleteDistance metric.Construct an instance of the InsertDeleteDistance metric.
insert_delete_distance()insert_delete_distance()
Metric
L01InfDistance metric.l01inf_distance in Rust documentation.
l01inf_distance(metric)l01inf_distance(metric)
metric |
The metric used to compute distance between partitions. |
Metric
L02InfDistance metric.l02inf_distance in Rust documentation.
l02inf_distance(metric)l02inf_distance(metric)
metric |
The metric used to compute distance between partitions. |
Metric
L1Distance metric.l1_distance in Rust documentation.
l1_distance(.T)l1_distance(.T)
.T |
undocumented |
Metric
L2Distance metric.l2_distance in Rust documentation.
l2_distance(.T)l2_distance(.T)
.T |
undocumented |
Metric
alpha.laplacian_scale_to_accuracy in Rust documentation.
laplacian_scale_to_accuracy(scale, alpha, .T = NULL)laplacian_scale_to_accuracy(scale, alpha, .T = NULL)
scale |
Laplacian noise scale. |
alpha |
Statistical significance, level- |
.T |
Data type of |
LInfDistance metric.linf_distance in Rust documentation.
linf_distance(.T, monotonic = FALSE)linf_distance(.T, monotonic = FALSE)
.T |
The type of the distance. |
monotonic |
set to true if non-monotonicity implies infinite distance |
Metric
Construct a Measurement that when invoked, returns a queryable that interactively composes measurements.
make_adaptive_composition( input_domain, input_metric, output_measure, d_in, d_mids )make_adaptive_composition( input_domain, input_metric, output_measure, d_in, d_mids )
input_domain |
indicates the space of valid input datasets |
input_metric |
how distances are measured between members of the input domain |
output_measure |
how privacy is measured |
d_in |
maximum distance between adjacent input datasets |
d_mids |
maximum privacy expenditure of each query |
Required features: contrib
make_adaptive_composition in Rust documentation.
Citations:
Composition Properties
sequential: all measurements are applied to the same dataset
basic: the composition is the linear sum of the privacy usage of each query
interactive: mechanisms can be specified based on answers to previous queries
compositor: all privacy parameters specified up-front
If the privacy measure supports concurrency, this compositor allows you to spawn multiple interactive mechanisms and interleave your queries amongst them.
Supporting Elements:
Input Domain: DI
Output Type: MI
Input Metric: MO
Output Measure: Queryable<Measurement<DI, MI, MO, TO>, TO>
Measurement
Measurement to release a queryable containing a DP projection of bounded sparse data.
make_alp_queryable( input_domain, input_metric, scale, total_limit, value_limit = NULL, size_factor = 50L, alpha = 4L )make_alp_queryable( input_domain, input_metric, scale, total_limit, value_limit = NULL, size_factor = 50L, alpha = 4L )
input_domain |
Domain of input data |
input_metric |
Metric on input domain |
scale |
Privacy loss parameter. This is equal to epsilon/sensitivity. |
total_limit |
Either the true value or an upper bound estimate of the sum of all values in the input. |
value_limit |
Upper bound on individual values (referred to as β). Entries above β are clamped. |
size_factor |
Optional multiplier (default of 50) for setting the size of the projection. |
alpha |
Optional parameter (default of 4) for scaling and determining p in randomized response step. |
The size of the projection is O(total * size_factor * scale / alpha). The evaluation time of post-processing is O(beta * scale / alpha).
size_factor is an optional multiplier (defaults to 50) for setting the size of the projection.
There is a memory/utility trade-off.
The value should be sufficiently large to limit hash collisions.
Required features: contrib
make_alp_queryable in Rust documentation.
Citations:
ALP21 Differentially Private Sparse Vectors with Low Error, Optimal Space, and Fast Access Algorithm 4
Supporting Elements:
Input Domain: MapDomain<AtomDomain<K>, AtomDomain<CI>>
Output Type: L01InfDistance<AbsoluteDistance<CI>>
Input Metric: MaxDivergence
Output Measure: Queryable<K, f64>
Measurement
Constructs a new output measurement where the output measure is δ-approximate, where δ=0.
make_approximate(measurement)make_approximate(measurement)
measurement |
a measurement with a privacy measure to be casted |
Required features: contrib
make_approximate in Rust documentation.
Measurement
Expand a vector of counts into a b-ary tree of counts,
where each branch is the sum of its b immediate children.
make_b_ary_tree(input_domain, input_metric, leaf_count, branching_factor)make_b_ary_tree(input_domain, input_metric, leaf_count, branching_factor)
input_domain |
Domain of input data |
input_metric |
Metric on input domain |
leaf_count |
The number of leaf nodes in the b-ary tree. |
branching_factor |
The number of children on each branch of the resulting tree. Larger branching factors result in shallower trees. |
Required features: contrib
make_b_ary_tree in Rust documentation.
Supporting Elements:
Input Domain: VectorDomain<AtomDomain<TA>>
Output Domain: M
Input Metric: VectorDomain<AtomDomain<TA>>
Output Metric: M
Transformation
Construct the DP composition [measurement0, measurement1, ...].
Returns a Measurement that when invoked, computes [measurement0(x), measurement1(x), ...]
make_basic_composition(measurements)make_basic_composition(measurements)
measurements |
A vector of Measurements to compose. |
All metrics and domains must be equivalent.
Composition Properties
sequential: all measurements are applied to the same dataset
basic: the composition is the linear sum of the privacy usage of each query
noninteractive: all mechanisms specified up-front (but each can be interactive)
compositor: all privacy parameters specified up-front (via the map)
Required features: contrib
Measurement
Make a Transformation that computes the sum of bounded data with known dataset size.
make_bounded_float_checked_sum(size_limit, bounds, .S = "Pairwise<.T>")make_bounded_float_checked_sum(size_limit, bounds, .S = "Pairwise<.T>")
size_limit |
Upper bound on number of records to keep in the input data. |
bounds |
Tuple of lower and upper bounds for data in the input domain. |
.S |
Summation algorithm to use over some data type |
This uses a restricted-sensitivity proof that takes advantage of known dataset size for better utility.
Use make_clamp to bound data and make_resize to establish dataset size.
| S (summation algorithm) | input type |
Sequential<S::Item> |
Vec<S::Item> |
Pairwise<S::Item> |
Vec<S::Item>
|
S::Item is the type of all of the following:
each bound, each element in the input data, the output data, and the output sensitivity.
For example, to construct a transformation that pairwise-sums f32 half-precision floats,
set S to Pairwise<f32>.
Required features: contrib
make_bounded_float_checked_sum in Rust documentation.
Citations:
Supporting Elements:
Input Domain: VectorDomain<AtomDomain<S::Item>>
Output Domain: SymmetricDistance
Input Metric: AtomDomain<S::Item>
Output Metric: AbsoluteDistance<S::Item>
Transformation
Make a Transformation that computes the sum of bounded floats with known ordering.
make_bounded_float_ordered_sum(size_limit, bounds, .S = "Pairwise<.T>")make_bounded_float_ordered_sum(size_limit, bounds, .S = "Pairwise<.T>")
size_limit |
Upper bound on the number of records in input data. Used to bound sensitivity. |
bounds |
Tuple of lower and upper bounds for data in the input domain. |
.S |
Summation algorithm to use over some data type |
Only useful when make_bounded_float_checked_sum returns an error due to potential for overflow.
You may need to use make_ordered_random to impose an ordering on the data.
The utility loss from overestimating the size_limit is small.
| S (summation algorithm) | input type |
Sequential<S::Item> |
Vec<S::Item> |
Pairwise<S::Item> |
Vec<S::Item>
|
S::Item is the type of all of the following:
each bound, each element in the input data, the output data, and the output sensitivity.
For example, to construct a transformation that pairwise-sums f32 half-precision floats,
set S to Pairwise<f32>.
Required features: contrib
make_bounded_float_ordered_sum in Rust documentation.
Citations:
Supporting Elements:
Input Domain: VectorDomain<AtomDomain<S::Item>>
Output Domain: InsertDeleteDistance
Input Metric: AtomDomain<S::Item>
Output Metric: AbsoluteDistance<S::Item>
Transformation
Make a Transformation that computes the sum of bounded ints, where all values share the same sign.
make_bounded_int_monotonic_sum(bounds, .T = NULL)make_bounded_int_monotonic_sum(bounds, .T = NULL)
bounds |
Tuple of lower and upper bounds for data in the input domain. |
.T |
Atomic Input Type and Output Type |
Required features: contrib
make_bounded_int_monotonic_sum in Rust documentation.
Citations:
Supporting Elements:
Input Domain: VectorDomain<AtomDomain<T>>
Output Domain: SymmetricDistance
Input Metric: AtomDomain<T>
Output Metric: AbsoluteDistance<T>
Transformation
Make a Transformation that computes the sum of bounded ints.
You may need to use make_ordered_random to impose an ordering on the data.
make_bounded_int_ordered_sum(bounds, .T = NULL)make_bounded_int_ordered_sum(bounds, .T = NULL)
bounds |
Tuple of lower and upper bounds for data in the input domain. |
.T |
Atomic Input Type and Output Type |
Required features: contrib
make_bounded_int_ordered_sum in Rust documentation.
Citations:
Supporting Elements:
Input Domain: VectorDomain<AtomDomain<T>>
Output Domain: InsertDeleteDistance
Input Metric: AtomDomain<T>
Output Metric: AbsoluteDistance<T>
Transformation
Make a Transformation that computes the sum of bounded ints. Adds the saturating sum of the positives to the saturating sum of the negatives.
make_bounded_int_split_sum(bounds, .T = NULL)make_bounded_int_split_sum(bounds, .T = NULL)
bounds |
Tuple of lower and upper bounds for data in the input domain. |
.T |
Atomic Input Type and Output Type |
Required features: contrib
make_bounded_int_split_sum in Rust documentation.
Citations:
Supporting Elements:
Input Domain: VectorDomain<AtomDomain<T>>
Output Domain: SymmetricDistance
Input Metric: AtomDomain<T>
Output Metric: AbsoluteDistance<T>
Transformation
Make a Measurement that adds noise from a canonical noise distribution. The implementation is tailored towards approximate-DP, resulting in noise sampled from the Tulap distribution.
make_canonical_noise(input_domain, input_metric, d_in, d_out)make_canonical_noise(input_domain, input_metric, d_in, d_out)
input_domain |
Domain of the input. |
input_metric |
Metric of the input. |
d_in |
Sensitivity |
d_out |
Privacy parameters (ε, δ) |
Required features: contrib
make_canonical_noise in Rust documentation.
Citations:
Supporting Elements:
Input Domain: AtomDomain<f64>
Output Type: AbsoluteDistance<f64>
Input Metric: Approximate<MaxDivergence>
Output Measure: f64
Proof Definition:
Measurement
Make a Transformation that casts a vector of data from type TIA to type TOA.
For each element, failure to parse results in None, else Some(out).
make_cast(input_domain, input_metric, .TOA)make_cast(input_domain, input_metric, .TOA)
input_domain |
Domain of input data |
input_metric |
Metric on input domain |
.TOA |
Atomic Output Type to cast into |
Can be chained with make_impute_constant or make_drop_null to handle nullity.
Required features: contrib
make_cast in Rust documentation.
Supporting Elements:
Input Domain: VectorDomain<AtomDomain<TIA>>
Output Domain: M
Input Metric: VectorDomain<OptionDomain<AtomDomain<TOA>>>
Output Metric: M
Transformation
Make a Transformation that casts a vector of data from type TIA to type TOA.
Any element that fails to cast is filled with default.
make_cast_default(input_domain, input_metric, .TOA)make_cast_default(input_domain, input_metric, .TOA)
input_domain |
Domain of input data |
input_metric |
Metric on input domain |
.TOA |
Atomic Output Type to cast into |
TIA |
TIA::default() |
| float | 0. |
| int | 0 |
| string | "" |
| bool | false
|
Required features: contrib
make_cast_default in Rust documentation.
Supporting Elements:
Input Domain: VectorDomain<AtomDomain<TIA>>
Output Domain: M
Input Metric: VectorDomain<AtomDomain<TOA>>
Output Metric: M
Transformation
Make a Transformation that casts a vector of data from type TIA to a type that can represent nullity TOA.
If cast fails, fill with TOA's null value.
make_cast_inherent(input_domain, input_metric, .TOA)make_cast_inherent(input_domain, input_metric, .TOA)
input_domain |
Domain of input data |
input_metric |
Metric on input domain |
.TOA |
Atomic Output Type to cast into |
TIA |
TIA::default() |
| float | NaN |
Required features: contrib
make_cast_inherent in Rust documentation.
Supporting Elements:
Input Domain: VectorDomain<AtomDomain<TIA>>
Output Domain: M
Input Metric: VectorDomain<AtomDomain<TOA>>
Output Metric: M
Transformation
Postprocess a noisy array of float summary counts into a cumulative distribution.
make_cdf(.TA = "float")make_cdf(.TA = "float")
.TA |
Atomic Type. One of |
Required features: contrib
make_cdf in Rust documentation.
Supporting Elements:
Input Type: Vec<TA>
Output Type: Vec<TA>
Function
Construct the functional composition (measurement1 ○ transformation0).
Returns a Measurement that when invoked, computes measurement1(transformation0(x)).
make_chain_mt(measurement1, transformation0)make_chain_mt(measurement1, transformation0)
measurement1 |
outer mechanism |
transformation0 |
inner transformation |
Required features: contrib
make_chain_mt in Rust documentation.
Measurement
Construct the functional composition (postprocess1 ○ measurement0).
Returns a Measurement that when invoked, computes postprocess1(measurement0(x)).
Used to represent non-interactive postprocessing.
make_chain_pm(postprocess1, measurement0)make_chain_pm(postprocess1, measurement0)
postprocess1 |
outer postprocessor |
measurement0 |
inner measurement/mechanism |
Required features: contrib
make_chain_pm in Rust documentation.
Measurement
Construct the functional composition (transformation1 ○ transformation0).
Returns a Transformation that when invoked, computes transformation1(transformation0(x)).
make_chain_tt(transformation1, transformation0)make_chain_tt(transformation1, transformation0)
transformation1 |
outer transformation |
transformation0 |
inner transformation |
Required features: contrib
make_chain_tt in Rust documentation.
Transformation
Make a Transformation that clamps numeric data in Vec<TA> to bounds.
make_clamp(input_domain, input_metric, bounds)make_clamp(input_domain, input_metric, bounds)
input_domain |
Domain of input data. |
input_metric |
Metric on input domain. |
bounds |
Tuple of inclusive lower and upper bounds. |
If datum is less than lower, let datum be lower. If datum is greater than upper, let datum be upper.
Required features: contrib
make_clamp in Rust documentation.
Supporting Elements:
Input Domain: VectorDomain<AtomDomain<TA>>
Output Domain: M
Input Metric: VectorDomain<AtomDomain<TA>>
Output Metric: M
Proof Definition:
Transformation
Construct the DP composition [measurement0, measurement1, ...].
Returns a Measurement that when invoked, computes [measurement0(x), measurement1(x), ...]
make_composition(measurements)make_composition(measurements)
measurements |
A vector of Measurements to compose. |
All metrics and domains must be equivalent.
Composition Properties
sequential: all measurements are applied to the same dataset
basic: the composition is the linear sum of the privacy usage of each query
noninteractive: all mechanisms specified up-front (but each can be interactive)
compositor: all privacy parameters specified up-front (via the map)
Required features: contrib
Measurement
Postprocessor that makes a noisy b-ary tree internally consistent, and returns the leaf layer.
make_consistent_b_ary_tree(branching_factor, .TIA = "int", .TOA = "float")make_consistent_b_ary_tree(branching_factor, .TIA = "int", .TOA = "float")
branching_factor |
the maximum number of children |
.TIA |
Atomic type of the input data. Should be an integer type. |
.TOA |
Atomic type of the output data. Should be a float type. |
The input argument of the function is a balanced b-ary tree implicitly stored in breadth-first order
Tree is assumed to be complete, as in, all leaves on the last layer are on the left.
Non-existent leaves are assumed to be zero.
The output remains consistent even when leaf nodes are missing. This is due to an adjustment to the original algorithm to apportion corrections to children relative to their variance.
Required features: contrib
make_consistent_b_ary_tree in Rust documentation.
Citations:
Supporting Elements:
Input Type: Vec<TIA>
Output Type: Vec<TOA>
Function
Make a Transformation that computes a count of the number of records in data.
make_count(input_domain, input_metric, .TO = "int")make_count(input_domain, input_metric, .TO = "int")
input_domain |
Domain of the data type to be released. |
input_metric |
Metric of the data type to be released. |
.TO |
Output Type. Must be numeric. |
Required features: contrib
make_count in Rust documentation.
Citations:
Supporting Elements:
Input Domain: VectorDomain<AtomDomain<TIA>>
Output Domain: SymmetricDistance
Input Metric: AtomDomain<TO>
Output Metric: AbsoluteDistance<TO>
Proof Definition:
Transformation
Make a Transformation that computes the count of each unique value in data. This assumes that the category set is unknown.
make_count_by(input_domain, input_metric, .TV = "int")make_count_by(input_domain, input_metric, .TV = "int")
input_domain |
Domain of input data |
input_metric |
Metric on input domain |
.TV |
Type of Value. Express counts in terms of this integral type. |
Required features: contrib
make_count_by in Rust documentation.
Citations:
Supporting Elements:
Input Domain: VectorDomain<AtomDomain<TK>>
Output Domain: SymmetricDistance
Input Metric: MapDomain<AtomDomain<TK>, AtomDomain<TV>>
Output Metric: L01InfDistance<AbsoluteDistance<TV>>
The carrier type is HashMap<TK, TV>, a hashmap of the count (TV) for each unique data input (TK).
Make a Transformation that computes the number of times each category appears in the data. This assumes that the category set is known.
make_count_by_categories( input_domain, input_metric, categories, null_category = TRUE, .MO = "L1Distance<int>", .TOA = "int" )make_count_by_categories( input_domain, input_metric, categories, null_category = TRUE, .MO = "L1Distance<int>", .TOA = "int" )
input_domain |
Domain of input data |
input_metric |
Metric on input domain |
categories |
The set of categories to compute counts for. |
null_category |
Include a count of the number of elements that were not in the category set at the end of the vector. |
.MO |
Output Metric. |
.TOA |
Atomic Output Type that is numeric. |
Required features: contrib
make_count_by_categories in Rust documentation.
Citations:
Supporting Elements:
Input Domain: VectorDomain<AtomDomain<TIA>>
Output Domain: SymmetricDistance
Input Metric: VectorDomain<AtomDomain<TOA>>
Output Metric: MO
The carrier type is Vec<TOA>, a vector of the counts (TOA).
Make a Transformation that computes a count of the number of unique, distinct records in data.
make_count_distinct(input_domain, input_metric, .TO = "int")make_count_distinct(input_domain, input_metric, .TO = "int")
input_domain |
Domain of input data |
input_metric |
Metric on input domain |
.TO |
Output Type. Must be numeric. |
Required features: contrib
make_count_distinct in Rust documentation.
Citations:
Supporting Elements:
Input Domain: VectorDomain<AtomDomain<TIA>>
Output Domain: SymmetricDistance
Input Metric: AtomDomain<TO>
Output Metric: AbsoluteDistance<TO>
Transformation
Make a Transformation that constructs a dataframe from a Vec<Vec<String>> (a vector of records).
make_create_dataframe(col_names, .K = NULL)make_create_dataframe(col_names, .K = NULL)
col_names |
Column names for each record entry. |
.K |
categorical/hashable data type of column names |
Required features: contrib
make_create_dataframe in Rust documentation.
Supporting Elements:
Input Domain: VectorDomain<VectorDomain<AtomDomain<String>>>
Output Domain: SymmetricDistance
Input Metric: DataFrameDomain<K>
Output Metric: SymmetricDistance
Transformation
Make a Transformation that casts the elements in a column in a dataframe from type TIA to type TOA.
If cast fails, fill with default.
make_df_cast_default(input_domain, input_metric, column_name, .TIA, .TOA)make_df_cast_default(input_domain, input_metric, column_name, .TIA, .TOA)
input_domain |
Domain of input data |
input_metric |
Metric on input domain |
column_name |
column name to be transformed |
.TIA |
Atomic Input Type to cast from |
.TOA |
Atomic Output Type to cast into |
TIA |
TIA::default() |
| float | 0. |
| int | 0 |
| string | "" |
| bool | false
|
Required features: contrib
make_df_cast_default in Rust documentation.
Supporting Elements:
Input Domain: DataFrameDomain<TK>
Output Domain: M
Input Metric: DataFrameDomain<TK>
Output Metric: M
Transformation
Make a Transformation that checks if each element in a column in a dataframe is equivalent to value.
make_df_is_equal(input_domain, input_metric, column_name, value, .TIA = NULL)make_df_is_equal(input_domain, input_metric, column_name, value, .TIA = NULL)
input_domain |
Domain of input data |
input_metric |
Metric on input domain |
column_name |
Column name to be transformed |
value |
Value to check for equality |
.TIA |
Atomic Input Type to cast from |
Required features: contrib
make_df_is_equal in Rust documentation.
Supporting Elements:
Input Domain: DataFrameDomain<TK>
Output Domain: M
Input Metric: DataFrameDomain<TK>
Output Metric: M
Transformation
Make a Transformation that drops null values.
make_drop_null(input_domain, input_metric)make_drop_null(input_domain, input_metric)
input_domain |
Domain of input data |
input_metric |
Metric on input domain |
| input_domain |
vector_domain(option_domain(atom_domain(TA))) |
vector_domain(atom_domain(TA))
|
Required features: contrib
make_drop_null in Rust documentation.
Supporting Elements:
Input Domain: VectorDomain<DIA>
Output Domain: M
Input Metric: VectorDomain<AtomDomain<DIA::Imputed>>
Output Metric: M
Transformation
Find the index of a data value in a set of categories.
make_find(input_domain, input_metric, categories)make_find(input_domain, input_metric, categories)
input_domain |
The domain of the input vector. |
input_metric |
The metric of the input vector. |
categories |
The set of categories to find indexes from. |
For each value in the input vector, finds the index of the value in categories.
If an index is found, returns Some(index), else None.
Chain with make_impute_constant or make_drop_null to handle nullity.
Required features: contrib
make_find in Rust documentation.
Supporting Elements:
Input Domain: VectorDomain<AtomDomain<TIA>>
Output Domain: M
Input Metric: VectorDomain<OptionDomain<AtomDomain<usize>>>
Output Metric: M
Transformation
Make a transformation that finds the bin index in a monotonically increasing vector of edges.
make_find_bin(input_domain, input_metric, edges)make_find_bin(input_domain, input_metric, edges)
input_domain |
The domain of the input vector. |
input_metric |
The metric of the input vector. |
edges |
The set of edges to split bins by. |
For each value in the input vector, finds the index of the bin the value falls into.
edges splits the entire range of TIA into bins.
The first bin at index zero ranges from negative infinity to the first edge, non-inclusive.
The last bin at index edges.len() ranges from the last bin, inclusive, to positive infinity.
To be valid, edges must be unique and ordered.
edges are left inclusive, right exclusive.
Required features: contrib
make_find_bin in Rust documentation.
Supporting Elements:
Input Domain: VectorDomain<AtomDomain<TIA>>
Output Domain: M
Input Metric: VectorDomain<AtomDomain<usize>>
Output Metric: M
Transformation
Fix the delta parameter in the privacy map of a measurement with a SmoothedMaxDivergence output measure.
make_fix_delta(measurement, delta)make_fix_delta(measurement, delta)
measurement |
a measurement with a privacy curve to be fixed |
delta |
parameter to fix the privacy curve with |
Required features: contrib
make_fix_delta in Rust documentation.
Measurement
Constructs a new output measurement where the output measure
is casted from Approximate<MaxDivergence> to SmoothedMaxDivergence.
make_fixed_approxDP_to_approxDP(measurement)make_fixed_approxDP_to_approxDP(measurement)
measurement |
a measurement with a privacy measure to be casted |
Required features: contrib
make_fixed_approxDP_to_approxDP in Rust documentation.
Measurement
Construct an odometer that can spawn a compositor queryable.
make_fully_adaptive_composition(input_domain, input_metric, output_measure)make_fully_adaptive_composition(input_domain, input_metric, output_measure)
input_domain |
indicates the space of valid input datasets |
input_metric |
how distances are measured between members of the input domain |
output_measure |
how privacy is measured |
Required features: contrib
make_fully_adaptive_composition in Rust documentation.
Citations:
Supporting Elements:
Input Domain DI
Input Metric MI
Output Measure MO
Query Measurement<DI, MI, MO, TO>
Answer TO
Proof Definition:
Odometer
Make a Measurement that adds noise from the Gaussian(scale) distribution to the input.
make_gaussian( input_domain, input_metric, scale, k = NULL, .MO = "ZeroConcentratedDivergence" )make_gaussian( input_domain, input_metric, scale, k = NULL, .MO = "ZeroConcentratedDivergence" )
input_domain |
Domain of the data type to be released. |
input_metric |
Metric of the data type to be released. |
scale |
Noise scale parameter for the gaussian distribution. |
k |
The noise granularity in terms of 2^k. |
.MO |
Output Measure. The only valid measure is |
Valid inputs for input_domain and input_metric are:
input_domain |
input type | input_metric |
atom_domain(T) |
T |
absolute_distance(QI) |
vector_domain(atom_domain(T)) |
Vec<T> |
l2_distance(QI)
|
Required features: contrib
make_gaussian in Rust documentation.
Supporting Elements:
Input Domain: DI
Output Type: MI
Input Metric: MO
Output Measure: DI::Carrier
Proof Definition:
Measurement
library(opendp) enable_features("contrib") gaussian <- make_gaussian( atom_domain(.T = f64, nan = FALSE), absolute_distance(.T = f64), scale = 1.0) gaussian(arg = 100.0) # Or, more readably, define the space and then chain: space <- c(atom_domain(.T = f64, nan = FALSE), absolute_distance(.T = f64)) gaussian <- space |> then_gaussian(scale = 1.0) gaussian(arg = 100.0) # Sensitivity of this measurement: gaussian(d_in = 1) gaussian(d_in = 2) gaussian(d_in = 4) # Typically will be used with vectors rather than individual numbers: space <- c(vector_domain(atom_domain(.T = i32)), l2_distance(.T = i32)) gaussian <- space |> then_gaussian(scale = 1.0) gaussian(arg = c(10L, 20L, 30L))library(opendp) enable_features("contrib") gaussian <- make_gaussian( atom_domain(.T = f64, nan = FALSE), absolute_distance(.T = f64), scale = 1.0) gaussian(arg = 100.0) # Or, more readably, define the space and then chain: space <- c(atom_domain(.T = f64, nan = FALSE), absolute_distance(.T = f64)) gaussian <- space |> then_gaussian(scale = 1.0) gaussian(arg = 100.0) # Sensitivity of this measurement: gaussian(d_in = 1) gaussian(d_in = 2) gaussian(d_in = 4) # Typically will be used with vectors rather than individual numbers: space <- c(vector_domain(atom_domain(.T = i32)), l2_distance(.T = i32)) gaussian <- space |> then_gaussian(scale = 1.0) gaussian(arg = c(10L, 20L, 30L))
Make a Measurement that uses propose-test-release to release a hashmap of counts.
make_gaussian_threshold( input_domain, input_metric, scale, threshold, k = NULL, .MO = "Approximate<ZeroConcentratedDivergence>" )make_gaussian_threshold( input_domain, input_metric, scale, threshold, k = NULL, .MO = "Approximate<ZeroConcentratedDivergence>" )
input_domain |
Domain of the input. |
input_metric |
Metric for the input domain. |
scale |
Noise scale parameter for the laplace distribution. |
threshold |
Exclude pairs with values whose distance from zero exceeds this value. |
k |
The noise granularity in terms of 2^k. |
.MO |
Output Measure. |
This function takes a noise granularity in terms of 2^k. Larger granularities are more computationally efficient, but have a looser privacy map. If k is not set, k defaults to the smallest granularity.
Required features: contrib
make_gaussian_threshold in Rust documentation.
Citations:
Rogers23 A Unifying Privacy Analysis Framework for Unknown Domain Algorithms in Differential Privacy
Supporting Elements:
Input Domain: DI
Output Type: MI
Input Metric: MO
Output Measure: DI::Carrier
Proof Definition:
Measurement
Equivalent to make_laplace but restricted to an integer support.
Can specify bounds to run the algorithm in near constant-time.
make_geometric( input_domain, input_metric, scale, bounds = NULL, .MO = "MaxDivergence" )make_geometric( input_domain, input_metric, scale, bounds = NULL, .MO = "MaxDivergence" )
input_domain |
Domain of the data type to be released. |
input_metric |
Metric of the data type to be released. |
scale |
Noise scale parameter for the distribution. |
bounds |
Set bounds on the count to make the algorithm run in constant-time. |
.MO |
Measure used to quantify privacy loss. Valid values are just |
Required features: contrib
make_geometric in Rust documentation.
Citations:
Supporting Elements:
Input Domain: DI
Output Type: MI
Input Metric: MO
Output Measure: DI::Carrier
Proof Definition:
Measurement
Make a Transformation representing the identity function.
make_identity(domain, metric)make_identity(domain, metric)
domain |
Domain of input data |
metric |
Metric on input domain |
WARNING: In Python, this function does not ensure that the domain and metric form a valid metric space. However, if the domain and metric do not form a valid metric space, then the resulting Transformation won't be chainable with any valid Transformation, so it cannot be used to introduce an invalid metric space into a chain of valid Transformations.
Required features: contrib, honest-but-curious
make_identity in Rust documentation.
Why honest-but-curious?:
For the result to be a valid transformation, the input_domain and input_metric pairing must form a valid metric space.
For instance, the symmetric distance metric and atom domain do not form a valid metric space,
because the metric cannot be used to measure distances between any two elements of an atom domain.
Whereas, the symmetric distance metric and vector domain,
or absolute distance metric and atom domain on a scalar type, both form valid metric spaces.
Supporting Elements:
Input Domain: D
Output Domain: M
Input Metric: D
Output Metric: M
Transformation
Make a Transformation that replaces null/None data with constant.
make_impute_constant(input_domain, input_metric, constant)make_impute_constant(input_domain, input_metric, constant)
input_domain |
Domain of the input data. See table above. |
input_metric |
Metric of the input data. A dataset metric. |
constant |
Value to replace nulls with. |
If chaining after a make_cast, the input type is Option<Vec<TA>>.
If chaining after a make_cast_inherent, the input type is Vec<TA>, where TA may take on float NaNs.
| input_domain | Input Data Type |
vector_domain(option_domain(atom_domain(TA))) |
Vec<Option<TA>> |
vector_domain(atom_domain(TA)) |
Vec<TA>
|
Required features: contrib
make_impute_constant in Rust documentation.
Supporting Elements:
Input Domain: VectorDomain<DIA>
Output Domain: M
Input Metric: VectorDomain<AtomDomain<DIA::Imputed>>
Output Metric: M
Transformation
Make a Transformation that replaces NaN values in Vec<TA> with uniformly distributed floats within bounds.
make_impute_uniform_float(input_domain, input_metric, bounds)make_impute_uniform_float(input_domain, input_metric, bounds)
input_domain |
Domain of the input. |
input_metric |
Metric of the input. |
bounds |
Tuple of inclusive lower and upper bounds. |
Required features: contrib
make_impute_uniform_float in Rust documentation.
Supporting Elements:
Input Domain: VectorDomain<AtomDomain<TA>>
Output Domain: M
Input Metric: VectorDomain<AtomDomain<TA>>
Output Metric: M
Transformation
Make a transformation that treats each element as an index into a vector of categories.
make_index(input_domain, input_metric, categories, null, .TOA = NULL)make_index(input_domain, input_metric, categories, null, .TOA = NULL)
input_domain |
The domain of the input vector. |
input_metric |
The metric of the input vector. |
categories |
The set of categories to index into. |
null |
Category to return if the index is out-of-range of the category set. |
.TOA |
Atomic Output Type. Output data will be |
Required features: contrib
make_index in Rust documentation.
Supporting Elements:
Input Domain: VectorDomain<AtomDomain<usize>>
Output Domain: M
Input Metric: VectorDomain<AtomDomain<TOA>>
Output Metric: M
Transformation
Make a Transformation that checks if each element is equal to value.
make_is_equal(input_domain, input_metric, value)make_is_equal(input_domain, input_metric, value)
input_domain |
Domain of input data |
input_metric |
Metric on input domain |
value |
value to check against |
Required features: contrib
make_is_equal in Rust documentation.
Supporting Elements:
Input Domain: VectorDomain<AtomDomain<TIA>>
Output Domain: M
Input Metric: VectorDomain<AtomDomain<bool>>
Output Metric: M
Proof Definition:
Transformation
Make a Transformation that checks if each element in a vector is null or nan.
make_is_null(input_domain, input_metric)make_is_null(input_domain, input_metric)
input_domain |
Domain of input data |
input_metric |
Metric on input domain |
Required features: contrib
make_is_null in Rust documentation.
Supporting Elements:
Input Domain: VectorDomain<DIA>
Output Domain: M
Input Metric: VectorDomain<AtomDomain<bool>>
Output Metric: M
Transformation
Make a Measurement that adds noise from the Laplace(scale) distribution to the input.
make_laplace( input_domain, input_metric, scale, k = NULL, .MO = "MaxDivergence" )make_laplace( input_domain, input_metric, scale, k = NULL, .MO = "MaxDivergence" )
input_domain |
Domain of the data type to be released. |
input_metric |
Metric of the data type to be released. |
scale |
Noise scale parameter for the Laplace distribution. |
k |
The noise granularity in terms of 2^k, only valid for domains over floats. |
.MO |
Measure used to quantify privacy loss. Valid values are just |
Valid inputs for input_domain and input_metric are:
input_domain |
input type | input_metric |
atom_domain(T) (default) |
T |
absolute_distance(T) |
vector_domain(atom_domain(T)) |
Vec<T> |
l1_distance(T)
|
Internally, all sampling is done using the discrete Laplace distribution.
Required features: contrib
make_laplace in Rust documentation.
Citations:
Supporting Elements:
Input Domain: DI
Output Type: MI
Input Metric: MO
Output Measure: DI::Carrier
Proof Definition:
Measurement
Make a Measurement that uses propose-test-release to release a hashmap of counts.
make_laplace_threshold( input_domain, input_metric, scale, threshold, k = NULL, .MO = "Approximate<MaxDivergence>" )make_laplace_threshold( input_domain, input_metric, scale, threshold, k = NULL, .MO = "Approximate<MaxDivergence>" )
input_domain |
Domain of the input. |
input_metric |
Metric for the input domain. |
scale |
Noise scale parameter for the laplace distribution. |
threshold |
Exclude counts that are less than this minimum value. |
k |
The noise granularity in terms of 2^k. |
.MO |
Output Measure. |
This function takes a noise granularity in terms of 2^k. Larger granularities are more computationally efficient, but have a looser privacy map. If k is not set, k defaults to the smallest granularity.
Required features: contrib
make_laplace_threshold in Rust documentation.
Citations:
Rogers23 A Unifying Privacy Analysis Framework for Unknown Domain Algorithms in Differential Privacy
Supporting Elements:
Input Domain: DI
Output Type: MI
Input Metric: MO
Output Measure: DI::Carrier
Proof Definition:
Measurement
Make a transformation that multiplies an aggregate by a constant.
make_lipschitz_float_mul(input_domain, input_metric, constant, bounds)make_lipschitz_float_mul(input_domain, input_metric, constant, bounds)
input_domain |
The domain of the input. |
input_metric |
The metric of the input. |
constant |
The constant to multiply aggregates by. |
bounds |
Tuple of inclusive lower and upper bounds. |
The bounds clamp the input, in order to bound the increase in sensitivity from float rounding.
Required features: contrib
make_lipschitz_float_mul in Rust documentation.
Supporting Elements:
Input Domain: AtomDomain<TA>
Output Domain: AbsoluteDistance<TA>
Input Metric: AtomDomain<TA>
Output Metric: AbsoluteDistance<TA>
Transformation
Make a Transformation that computes the mean of bounded data.
make_mean(input_domain, input_metric)make_mean(input_domain, input_metric)
input_domain |
Domain of input data |
input_metric |
Metric on input domain |
This uses a restricted-sensitivity proof that takes advantage of known dataset size.
Use make_clamp to bound data and make_resize to establish dataset size.
Required features: contrib
make_mean in Rust documentation.
Supporting Elements:
Input Domain: VectorDomain<AtomDomain<T>>
Output Domain: MI
Input Metric: AtomDomain<T>
Output Metric: AbsoluteDistance<T>
Transformation
Make a Transformation that converts the unbounded dataset metric MI
to the respective bounded dataset metric with a no-op.
make_metric_bounded(input_domain, input_metric)make_metric_bounded(input_domain, input_metric)
input_domain |
Domain of input data |
input_metric |
Metric on input domain |
The constructor enforces that the input domain has known size, because it must have known size to be valid under a bounded dataset metric.
MI |
MI::BoundedMetric |
| SymmetricDistance | ChangeOneDistance |
| InsertDeleteDistance | HammingDistance |
Required features: contrib
make_metric_bounded in Rust documentation.
Supporting Elements:
Input Domain: D
Output Domain: MI
Input Metric: D
Output Metric: MI::BoundedMetric
Transformation
Make a Transformation that converts the bounded dataset metric MI
to the respective unbounded dataset metric with a no-op.
make_metric_unbounded(input_domain, input_metric)make_metric_unbounded(input_domain, input_metric)
input_domain |
Domain of input data |
input_metric |
Metric on input domain |
MI |
MI::UnboundedMetric |
| ChangeOneDistance | SymmetricDistance |
| HammingDistance | InsertDeleteDistance |
Required features: contrib
make_metric_unbounded in Rust documentation.
Supporting Elements:
Input Domain: D
Output Domain: MI
Input Metric: D
Output Metric: MI::UnboundedMetric
Transformation
Make a Measurement that adds noise from the appropriate distribution to the input.
make_noise(input_domain, input_metric, output_measure, scale, k = NULL)make_noise(input_domain, input_metric, output_measure, scale, k = NULL)
input_domain |
Domain of the data type to be released. |
input_metric |
Metric of the data type to be released. |
output_measure |
Privacy measure. Either |
scale |
Noise scale parameter. |
k |
The noise granularity in terms of 2^k. |
Valid inputs for input_domain and input_metric are:
input_domain |
input type | input_metric |
atom_domain(T) |
T |
absolute_distance(QI) |
vector_domain(atom_domain(T)) |
Vec<T> |
l2_distance(QI)
|
Required features: contrib
make_noise in Rust documentation.
Supporting Elements:
Input Domain: DI
Output Type: MI
Input Metric: MO
Output Measure: DI::Carrier
Measurement
Make a Measurement that uses propose-test-release to release a hashmap of counts.
make_noise_threshold( input_domain, input_metric, output_measure, scale, threshold, k = NULL )make_noise_threshold( input_domain, input_metric, output_measure, scale, threshold, k = NULL )
input_domain |
Domain of the input. |
input_metric |
Metric for the input domain. |
output_measure |
Privacy measure. Either |
scale |
Noise scale parameter for the laplace distribution. |
threshold |
Exclude counts that are less than this minimum value. |
k |
The noise granularity in terms of 2^k. |
This function takes a noise granularity in terms of 2^k. Larger granularities are more computationally efficient, but have a looser privacy map. If k is not set, k defaults to the smallest granularity.
Required features: contrib
make_noise_threshold in Rust documentation.
Citations:
Rogers23 A Unifying Privacy Analysis Framework for Unknown Domain Algorithms in Differential Privacy
Supporting Elements:
Input Domain: DI
Output Type: MI
Input Metric: Approximate<MO>
Output Measure: DI::Carrier
Measurement
Make a Measurement that takes a vector of scores and privately selects the index of the highest score.
make_noisy_max( input_domain, input_metric, output_measure, scale, negate = FALSE )make_noisy_max( input_domain, input_metric, output_measure, scale, negate = FALSE )
input_domain |
Domain of the input vector. Must be a non-nullable |
input_metric |
Metric on the input domain. Must be |
output_measure |
One of |
scale |
Scale for the noise distribution |
negate |
Set to true to return min |
Required features: contrib
make_noisy_max in Rust documentation.
Citations:
Supporting Elements:
Input Domain: VectorDomain<AtomDomain<TIA>>
Output Type: LInfDistance<TIA>
Input Metric: MO
Output Measure: usize
Measurement
Make a Measurement that takes a vector of scores and privately selects the index of the highest score.
make_noisy_top_k( input_domain, input_metric, output_measure, k, scale, negate = FALSE )make_noisy_top_k( input_domain, input_metric, output_measure, k, scale, negate = FALSE )
input_domain |
Domain of the input vector. Must be a non-nullable VectorDomain. |
input_metric |
Metric on the input domain. Must be LInfDistance |
output_measure |
One of |
k |
Number of indices to select. |
scale |
Scale for the noise distribution. |
negate |
Set to true to return bottom k |
Required features: contrib
make_noisy_top_k in Rust documentation.
Citations:
Supporting Elements:
Input Domain: VectorDomain<AtomDomain<TIA>>
Output Type: LInfDistance<TIA>
Input Metric: MO
Output Measure: Vec<usize>
Proof Definition:
Measurement
Make a Transformation that converts the unordered dataset metric SymmetricDistance
to the respective ordered dataset metric InsertDeleteDistance by assigning a random permutation.
make_ordered_random(input_domain, input_metric)make_ordered_random(input_domain, input_metric)
input_domain |
Domain of input data |
input_metric |
Metric on input domain |
MI |
MI::OrderedMetric |
| SymmetricDistance | InsertDeleteDistance |
| ChangeOneDistance | HammingDistance |
Required features: contrib
make_ordered_random in Rust documentation.
Supporting Elements:
Input Domain: D
Output Domain: MI
Input Metric: D
Output Metric: MI::OrderedMetric
Transformation
Construct an amplified measurement from a measurement with privacy amplification by subsampling.
This measurement does not perform any sampling.
It is useful when you have a dataset on-hand that is a simple random sample from a larger population.
make_population_amplification(measurement, population_size)make_population_amplification(measurement, population_size)
measurement |
the computation to amplify |
population_size |
the size of the population from which the input dataset is a simple sample |
The DIA, DO, MI and MO between the input measurement and amplified output measurement all match.
Required features: contrib, honest-but-curious
make_population_amplification in Rust documentation.
Why honest-but-curious?:
The privacy guarantees are only valid if the input dataset is a simple sample from a population with population_size records.
Measurement
Combinator that limits the privacy loss of an odometer.
make_privacy_filter(odometer, d_in, d_out)make_privacy_filter(odometer, d_in, d_out)
odometer |
A privacy odometer |
d_in |
Upper bound on the distance between adjacent datasets |
d_out |
Upper bound on the privacy loss |
Adjusts the queryable returned by the odometer to reject any query that would increase the total privacy loss above the privacy guarantee of the mechanism.
Required features: contrib
make_privacy_filter in Rust documentation.
Citations:
Supporting Elements:
Input Domain: DI
Output Type: MI
Input Metric: MO
Output Measure: OdometerQueryable<Q, A, MI::Distance, MO::Distance>
Proof Definition:
Measurement
Make a Measurement that computes the quantile of a dataset.
make_private_quantile( input_domain, input_metric, output_measure, candidates, alpha, scale )make_private_quantile( input_domain, input_metric, output_measure, candidates, alpha, scale )
input_domain |
Uses a tighter sensitivity when the size of vectors in the input domain is known. |
input_metric |
Either SymmetricDistance or InsertDeleteDistance. |
output_measure |
Either MaxDivergence or ZeroConcentratedDivergence. |
candidates |
Potential quantiles to score |
alpha |
a value in |
scale |
the scale of the noise added |
Required features: contrib
make_private_quantile in Rust documentation.
Citations:
Smith11 Privacy-Preserving Statistical Estimation with Optimal Convergence Rates
MS20 Permute-and-Flip: A New Mechanism for Differentially Private Selection
Supporting Elements:
Input Domain: VectorDomain<AtomDomain<T>>
Output Type: MI
Input Metric: MO
Output Measure: T
Measurement
Constructs a new output measurement where the output measure
is casted from MaxDivergence to ZeroConcentratedDivergence.
make_pureDP_to_zCDP(measurement)make_pureDP_to_zCDP(measurement)
measurement |
a measurement with a privacy measure to be casted |
Required features: contrib
make_pureDP_to_zCDP in Rust documentation.
Citations:
Measurement
Makes a Transformation that scores how similar each candidate is to the given alpha-quantile on the input dataset.
make_quantile_score_candidates(input_domain, input_metric, candidates, alpha)make_quantile_score_candidates(input_domain, input_metric, candidates, alpha)
input_domain |
Uses a smaller sensitivity when the size of vectors in the input domain is known. |
input_metric |
Either SymmetricDistance or InsertDeleteDistance. |
candidates |
Potential quantiles to score |
alpha |
a value in |
Required features: contrib
make_quantile_score_candidates in Rust documentation.
Citations:
Supporting Elements:
Input Domain: VectorDomain<AtomDomain<TIA>>
Output Domain: MI
Input Metric: VectorDomain<AtomDomain<u64>>
Output Metric: LInfDistance<u64>
Proof Definition:
Transformation
Postprocess a noisy array of summary counts into quantiles.
make_quantiles_from_counts( bin_edges, alphas, interpolation = "linear", .TA = NULL, .F = "float" )make_quantiles_from_counts( bin_edges, alphas, interpolation = "linear", .TA = NULL, .F = "float" )
bin_edges |
The edges that the input data was binned into before counting. |
alphas |
Return all specified |
interpolation |
Must be one of |
.TA |
Atomic Type of the bin edges and data. |
.F |
Float type of the alpha argument. One of |
Required features: contrib
make_quantiles_from_counts in Rust documentation.
Supporting Elements:
Input Type: Vec<TA>
Output Type: Vec<TA>
Function
Make a Measurement that implements randomized response on a categorical value.
make_randomized_response(categories, prob, .T = NULL)make_randomized_response(categories, prob, .T = NULL)
categories |
Set of valid outcomes |
prob |
Probability of returning the correct answer. Must be in |
.T |
Data type of a category. |
Required features: contrib
make_randomized_response in Rust documentation.
Citations:
Supporting Elements:
Input Domain: AtomDomain<T>
Output Type: DiscreteDistance
Input Metric: MaxDivergence
Output Measure: T
Proof Definition:
Measurement
Make a Measurement that implements randomized response on a bit vector.
make_randomized_response_bitvec( input_domain, input_metric, f, constant_time = FALSE )make_randomized_response_bitvec( input_domain, input_metric, f, constant_time = FALSE )
input_domain |
BitVectorDomain with max_weight |
input_metric |
DiscreteDistance |
f |
Per-bit flipping probability. Must be in |
constant_time |
Whether to run the Bernoulli samplers in constant time, this is likely to be extremely slow. |
This primitive can be useful for implementing RAPPOR.
Required features: contrib
make_randomized_response_bitvec in Rust documentation.
Citations:
Supporting Elements:
Input Domain: BitVectorDomain
Output Type: DiscreteDistance
Input Metric: MaxDivergence
Output Measure: BitVector
Proof Definition:
Measurement
Make a Measurement that implements randomized response on a boolean value.
make_randomized_response_bool(prob, constant_time = FALSE)make_randomized_response_bool(prob, constant_time = FALSE)
prob |
Probability of returning the correct answer. Must be in |
constant_time |
Set to true to enable constant time. Slower. |
Required features: contrib
make_randomized_response_bool in Rust documentation.
Citations:
Supporting Elements:
Input Domain: AtomDomain<bool>
Output Type: DiscreteDistance
Input Metric: MaxDivergence
Output Measure: bool
Proof Definition:
Measurement
Make a Measurement that takes a vector of scores and privately selects the index of the highest score.
make_report_noisy_max_gumbel( input_domain, input_metric, scale, optimize = "max" )make_report_noisy_max_gumbel( input_domain, input_metric, scale, optimize = "max" )
input_domain |
Domain of the input vector. Must be a non-nullable |
input_metric |
Metric on the input domain. Must be |
scale |
Scale for the noise distribution |
optimize |
Set to "min" to report noisy min |
Required features: contrib
make_report_noisy_max_gumbel in Rust documentation.
Citations:
Supporting Elements:
Input Domain: VectorDomain<AtomDomain<TIA>>
Output Type: LInfDistance<TIA>
Input Metric: MaxDivergence
Output Measure: usize
Measurement
Make a Transformation that either truncates or imputes records
with constant to match a provided size.
make_resize( input_domain, input_metric, size, constant, .MO = "SymmetricDistance" )make_resize( input_domain, input_metric, size, constant, .MO = "SymmetricDistance" )
input_domain |
Domain of input data. |
input_metric |
Metric of input data. |
size |
Number of records in output data. |
constant |
Value to impute with. |
.MO |
Output Metric. One of |
Required features: contrib
make_resize in Rust documentation.
Supporting Elements:
Input Domain: VectorDomain<AtomDomain<TA>>
Output Domain: MI
Input Metric: VectorDomain<AtomDomain<TA>>
Output Metric: MO
A vector of the same type TA, but with the provided size.
Make a Transformation that retrieves the column key from a dataframe as Vec<TOA>.
make_select_column(key, .TOA, .K = NULL)make_select_column(key, .TOA, .K = NULL)
key |
categorical/hashable data type of the key/column name |
.TOA |
Atomic Output Type to downcast vector to |
.K |
data type of key |
Required features: contrib
make_select_column in Rust documentation.
Supporting Elements:
Input Domain: DataFrameDomain<K>
Output Domain: SymmetricDistance
Input Metric: VectorDomain<AtomDomain<TOA>>
Output Metric: SymmetricDistance
Transformation
Select a private candidate whose score is above a threshold.
make_select_private_candidate(measurement, stop_probability, threshold)make_select_private_candidate(measurement, stop_probability, threshold)
measurement |
A measurement that releases a 2-tuple of (score, candidate) |
stop_probability |
The probability of stopping early at any iteration. |
threshold |
The threshold score. Return immediately if the score is above this threshold. |
Given measurement that satisfies ε-DP, returns new measurement M' that satisfies 2ε-DP.
M' releases the first invocation of measurement whose score is above threshold.
Each time a score is below threshold
the algorithm may terminate with probability stop_probability and return nothing.
measurement should make releases in the form of (score, candidate).
If you are writing a custom scorer measurement in Python,
specify the output type as TO=(float, "ExtrinsicObject").
This ensures that the float value is accessible to the algorithm.
The candidate, left as arbitrary Python data, is held behind the ExtrinsicObject.
Algorithm 1 in Private selection from private candidates (Liu and Talwar, STOC 2019).
Required features: contrib
make_select_private_candidate in Rust documentation.
Supporting Elements:
Input Domain: DI
Output Type: MI
Input Metric: MaxDivergence
Output Measure: Option<(f64, TO)>
Proof Definition:
A measurement that returns a release from measurement whose score is greater than threshold, or none.
Construct a Measurement that when invoked, returns a queryable that interactively composes measurements.
make_sequential_composition( input_domain, input_metric, output_measure, d_in, d_mids )make_sequential_composition( input_domain, input_metric, output_measure, d_in, d_mids )
input_domain |
indicates the space of valid input datasets |
input_metric |
how distances are measured between members of the input domain |
output_measure |
how privacy is measured |
d_in |
maximum distance between adjacent input datasets |
d_mids |
maximum privacy expenditure of each query |
Required features: contrib
make_sequential_composition in Rust documentation.
Citations:
Composition Properties
sequential: all measurements are applied to the same dataset
basic: the composition is the linear sum of the privacy usage of each query
interactive: mechanisms can be specified based on answers to previous queries
compositor: all privacy parameters specified up-front
If the privacy measure supports concurrency, this compositor allows you to spawn multiple interactive mechanisms and interleave your queries amongst them.
Supporting Elements:
Input Domain: DI
Output Type: MI
Input Metric: MO
Output Measure: Queryable<Measurement<DI, MI, MO, TO>, TO>
Measurement
Make a Transformation that computes the sum of bounded floats with known dataset size.
make_sized_bounded_float_checked_sum(size, bounds, .S = "Pairwise<.T>")make_sized_bounded_float_checked_sum(size, bounds, .S = "Pairwise<.T>")
size |
Number of records in input data. |
bounds |
Tuple of lower and upper bounds for data in the input domain. |
.S |
Summation algorithm to use over some data type |
This uses a restricted-sensitivity proof that takes advantage of known dataset size for better utility.
| S (summation algorithm) | input type |
Sequential<S::Item> |
Vec<S::Item> |
Pairwise<S::Item> |
Vec<S::Item>
|
S::Item is the type of all of the following:
each bound, each element in the input data, the output data, and the output sensitivity.
For example, to construct a transformation that pairwise-sums f32 half-precision floats,
set S to Pairwise<f32>.
Required features: contrib
make_sized_bounded_float_checked_sum in Rust documentation.
Citations:
Supporting Elements:
Input Domain: VectorDomain<AtomDomain<S::Item>>
Output Domain: SymmetricDistance
Input Metric: AtomDomain<S::Item>
Output Metric: AbsoluteDistance<S::Item>
Transformation
Make a Transformation that computes the sum of bounded floats with known ordering and dataset size.
make_sized_bounded_float_ordered_sum(size, bounds, .S = "Pairwise<.T>")make_sized_bounded_float_ordered_sum(size, bounds, .S = "Pairwise<.T>")
size |
Number of records in input data. |
bounds |
Tuple of lower and upper bounds for data in the input domain. |
.S |
Summation algorithm to use over some data type |
Only useful when make_bounded_float_checked_sum returns an error due to potential for overflow.
This uses a restricted-sensitivity proof that takes advantage of known dataset size for better utility.
You may need to use make_ordered_random to impose an ordering on the data.
| S (summation algorithm) | input type |
Sequential<S::Item> |
Vec<S::Item> |
Pairwise<S::Item> |
Vec<S::Item>
|
S::Item is the type of all of the following:
each bound, each element in the input data, the output data, and the output sensitivity.
For example, to construct a transformation that pairwise-sums f32 half-precision floats,
set S to Pairwise<f32>.
Required features: contrib
make_sized_bounded_float_ordered_sum in Rust documentation.
Citations:
Supporting Elements:
Input Domain: VectorDomain<AtomDomain<S::Item>>
Output Domain: InsertDeleteDistance
Input Metric: AtomDomain<S::Item>
Output Metric: AbsoluteDistance<S::Item>
Transformation
Make a Transformation that computes the sum of bounded ints. The effective range is reduced, as (bounds * size) must not overflow.
make_sized_bounded_int_checked_sum(size, bounds, .T = NULL)make_sized_bounded_int_checked_sum(size, bounds, .T = NULL)
size |
Number of records in input data. |
bounds |
Tuple of lower and upper bounds for data in the input domain. |
.T |
Atomic Input Type and Output Type |
Required features: contrib
make_sized_bounded_int_checked_sum in Rust documentation.
Citations:
Supporting Elements:
Input Domain: VectorDomain<AtomDomain<T>>
Output Domain: SymmetricDistance
Input Metric: AtomDomain<T>
Output Metric: AbsoluteDistance<T>
Transformation
Make a Transformation that computes the sum of bounded ints, where all values share the same sign.
make_sized_bounded_int_monotonic_sum(size, bounds, .T = NULL)make_sized_bounded_int_monotonic_sum(size, bounds, .T = NULL)
size |
Number of records in input data. |
bounds |
Tuple of lower and upper bounds for data in the input domain. |
.T |
Atomic Input Type and Output Type |
Required features: contrib
make_sized_bounded_int_monotonic_sum in Rust documentation.
Citations:
Supporting Elements:
Input Domain: VectorDomain<AtomDomain<T>>
Output Domain: SymmetricDistance
Input Metric: AtomDomain<T>
Output Metric: AbsoluteDistance<T>
Transformation
Make a Transformation that computes the sum of bounded ints with known dataset size.
make_sized_bounded_int_ordered_sum(size, bounds, .T = NULL)make_sized_bounded_int_ordered_sum(size, bounds, .T = NULL)
size |
Number of records in input data. |
bounds |
Tuple of lower and upper bounds for data in the input domain. |
.T |
Atomic Input Type and Output Type |
This uses a restricted-sensitivity proof that takes advantage of known dataset size for better utility.
You may need to use make_ordered_random to impose an ordering on the data.
Required features: contrib
make_sized_bounded_int_ordered_sum in Rust documentation.
Citations:
Supporting Elements:
Input Domain: VectorDomain<AtomDomain<T>>
Output Domain: InsertDeleteDistance
Input Metric: AtomDomain<T>
Output Metric: AbsoluteDistance<T>
Transformation
Make a Transformation that computes the sum of bounded ints with known dataset size.
make_sized_bounded_int_split_sum(size, bounds, .T = NULL)make_sized_bounded_int_split_sum(size, bounds, .T = NULL)
size |
Number of records in input data. |
bounds |
Tuple of lower and upper bounds for data in the input domain. |
.T |
Atomic Input Type and Output Type |
This uses a restricted-sensitivity proof that takes advantage of known dataset size for better utility. Adds the saturating sum of the positives to the saturating sum of the negatives.
Required features: contrib
make_sized_bounded_int_split_sum in Rust documentation.
Citations:
Supporting Elements:
Input Domain: VectorDomain<AtomDomain<T>>
Output Domain: SymmetricDistance
Input Metric: AtomDomain<T>
Output Metric: AbsoluteDistance<T>
Transformation
Make a Transformation that splits each record in a String into a Vec<Vec<String>>,
and loads the resulting table into a dataframe keyed by col_names.
make_split_dataframe(separator, col_names, .K = NULL)make_split_dataframe(separator, col_names, .K = NULL)
separator |
The token(s) that separate entries in each record. |
col_names |
Column names for each record entry. |
.K |
categorical/hashable data type of column names |
Required features: contrib
make_split_dataframe in Rust documentation.
Supporting Elements:
Input Domain: AtomDomain<String>
Output Domain: SymmetricDistance
Input Metric: DataFrameDomain<K>
Output Metric: SymmetricDistance
Transformation
Make a Transformation that takes a string and splits it into a Vec<String> of its lines.
make_split_lines()make_split_lines()
Required features: contrib
make_split_lines in Rust documentation.
Supporting Elements:
Input Domain: AtomDomain<String>
Output Domain: SymmetricDistance
Input Metric: VectorDomain<AtomDomain<String>>
Output Metric: SymmetricDistance
Transformation
Make a Transformation that splits each record in a Vec<String> into a Vec<Vec<String>>.
make_split_records(separator)make_split_records(separator)
separator |
The token(s) that separate entries in each record. |
Required features: contrib
make_split_records in Rust documentation.
Supporting Elements:
Input Domain: VectorDomain<AtomDomain<String>>
Output Domain: SymmetricDistance
Input Metric: VectorDomain<VectorDomain<AtomDomain<String>>>
Output Metric: SymmetricDistance
Transformation
Make a Transformation that subsets a dataframe by a boolean column.
make_subset_by(indicator_column, keep_columns, .TK = NULL)make_subset_by(indicator_column, keep_columns, .TK = NULL)
indicator_column |
name of the boolean column that indicates inclusion in the subset |
keep_columns |
list of column names to apply subset to |
.TK |
Type of the column name |
Required features: contrib
make_subset_by in Rust documentation.
Supporting Elements:
Input Domain: DataFrameDomain<TK>
Output Domain: SymmetricDistance
Input Metric: DataFrameDomain<TK>
Output Metric: SymmetricDistance
Transformation
Make a Transformation that computes the sum of bounded data.
Use make_clamp to bound data.
make_sum(input_domain, input_metric)make_sum(input_domain, input_metric)
input_domain |
Domain of the input data. |
input_metric |
One of |
If dataset size is known, uses a restricted-sensitivity proof that takes advantage of known dataset size for better utility.
Required features: contrib
make_sum in Rust documentation.
Citations:
Supporting Elements:
Input Domain: VectorDomain<AtomDomain<T>>
Output Domain: MI
Input Metric: AtomDomain<T>
Output Metric: AbsoluteDistance<T>
Transformation
Make a Transformation that computes the sum of squared deviations of bounded data.
make_sum_of_squared_deviations(input_domain, input_metric, .S = "Pairwise<.T>")make_sum_of_squared_deviations(input_domain, input_metric, .S = "Pairwise<.T>")
input_domain |
Domain of input data |
input_metric |
Metric on input domain |
.S |
Summation algorithm to use on data type |
This uses a restricted-sensitivity proof that takes advantage of known dataset size.
Use make_clamp to bound data and make_resize to establish dataset size.
| S (summation algorithm) | input type |
Sequential<S::Item> |
Vec<S::Item> |
Pairwise<S::Item> |
Vec<S::Item>
|
S::Item is the type of all of the following:
each bound, each element in the input data, the output data, and the output sensitivity.
For example, to construct a transformation that computes the SSD of f32 half-precision floats,
set S to Pairwise<f32>.
Required features: contrib
make_sum_of_squared_deviations in Rust documentation.
Citations:
Supporting Elements:
Input Domain: VectorDomain<AtomDomain<S::Item>>
Output Domain: SymmetricDistance
Input Metric: AtomDomain<S::Item>
Output Metric: AbsoluteDistance<S::Item>
Transformation
Make a Transformation that converts the ordered dataset metric MI
to the respective ordered dataset metric with a no-op.
make_unordered(input_domain, input_metric)make_unordered(input_domain, input_metric)
input_domain |
Domain of input data |
input_metric |
Metric on input domain |
MI |
MI::UnorderedMetric |
| InsertDeleteDistance | SymmetricDistance |
| HammingDistance | ChangeOneDistance |
Required features: contrib
make_unordered in Rust documentation.
Supporting Elements:
Input Domain: D
Output Domain: MI
Input Metric: D
Output Metric: MI::UnorderedMetric
Transformation
Construct a Measurement from user-defined callbacks.
make_user_measurement( input_domain, input_metric, output_measure, function_, privacy_map, .TO = "ExtrinsicObject" )make_user_measurement( input_domain, input_metric, output_measure, function_, privacy_map, .TO = "ExtrinsicObject" )
input_domain |
A domain describing the set of valid inputs for the function. |
input_metric |
The metric from which distances between adjacent inputs are measured. |
output_measure |
The measure from which distances between adjacent output distributions are measured. |
function_ |
A function mapping data from |
privacy_map |
A function mapping distances from |
.TO |
The data type of outputs from the function. |
Required features: contrib, honest-but-curious
Why honest-but-curious?:
This constructor only returns a valid measurement if for every pair of elements in input_domain,
and for every pair (d_in, d_out),
where d_in has the associated type for input_metric and d_out has the associated type for output_measure,
if are d_in-close under input_metric, privacy_map(d_in) does not raise an exception,
and privacy_map(d_in) <= d_out,
then function(x), function(x') are d_out-close under output_measure.
In addition, function must not have side-effects, and privacy_map must be a pure function.
Supporting Elements:
Input Domain: AnyDomain
Output Type: AnyMetric
Input Metric: AnyMeasure
Output Measure: AnyObject
Measurement
Construct a Transformation from user-defined callbacks.
make_user_transformation( input_domain, input_metric, output_domain, output_metric, function_, stability_map )make_user_transformation( input_domain, input_metric, output_domain, output_metric, function_, stability_map )
input_domain |
A domain describing the set of valid inputs for the function. |
input_metric |
The metric from which distances between adjacent inputs are measured. |
output_domain |
A domain describing the set of valid outputs of the function. |
output_metric |
The metric from which distances between outputs of adjacent inputs are measured. |
function_ |
A function mapping data from |
stability_map |
A function mapping distances from |
Required features: contrib, honest-but-curious
Why honest-but-curious?:
This constructor only returns a valid transformation if for every pair of elements in input_domain,
and for every pair (d_in, d_out),
where d_in has the associated type for input_metric and d_out has the associated type for output_metric,
if are d_in-close under input_metric, stability_map(d_in) does not raise an exception,
and stability_map(d_in) <= d_out,
then function(x), function(x') are d_out-close under output_metric.
In addition, for every element in input_domain, function(x) is a member of output_domain or raises a data-independent runtime exception.
In addition, function must not have side-effects, and stability_map must be a pure function.
Transformation
Make a Transformation that computes the variance of bounded data.
make_variance(input_domain, input_metric, ddof = 1L, .S = "Pairwise<.T>")make_variance(input_domain, input_metric, ddof = 1L, .S = "Pairwise<.T>")
input_domain |
Domain of input data |
input_metric |
Metric on input domain |
ddof |
Delta degrees of freedom. Set to 0 if not a sample, 1 for sample estimate. |
.S |
Summation algorithm to use on data type |
This uses a restricted-sensitivity proof that takes advantage of known dataset size.
Use make_clamp to bound data and make_resize to establish dataset size.
Required features: contrib
make_variance in Rust documentation.
Citations:
Supporting Elements:
Input Domain: VectorDomain<AtomDomain<S::Item>>
Output Domain: SymmetricDistance
Input Metric: AtomDomain<S::Item>
Output Metric: AbsoluteDistance<S::Item>
Transformation
Constructs a new output measurement where the output measure
is casted from ZeroConcentratedDivergence to SmoothedMaxDivergence.
make_zCDP_to_approxDP(measurement)make_zCDP_to_approxDP(measurement)
measurement |
a measurement with a privacy measure to be casted |
Required features: contrib
make_zCDP_to_approxDP in Rust documentation.
Measurement
MapDomain.Construct an instance of MapDomain.
map_domain(key_domain, value_domain)map_domain(key_domain, value_domain)
key_domain |
domain of keys in the hashmap |
value_domain |
domain of values in the hashmap |
Domain
In the following proof definition, corresponds to when also quantified over all adjacent datasets.
That is, is the greatest possible
over all pairs of adjacent datasets where , .
is a measurement (commonly known as a mechanism).
The measurement's input metric defines the notion of adjacency,
and the measurement's input domain defines the set of possible datasets.
max_divergence()max_divergence()
Proof Definition:
For any two distributions and any non-negative ,
are -close under the max divergence measure whenever
.
Measure
measure.Debug a measure.
measure_debug(this)measure_debug(this)
this |
The measure to debug (stringify). |
str
measure.Get the distance type of a measure.
measure_distance_type(this)measure_distance_type(this)
this |
The measure to retrieve the distance type from. |
str
measure.Get the type of a measure.
measure_type(this)measure_type(this)
this |
The measure to retrieve the type from. |
str
measurement at the given d_in, d_out
Check the privacy relation of the measurement at the given d_in, d_out
measurement_check(measurement, distance_in, distance_out)measurement_check(measurement, distance_in, distance_out)
measurement |
Measurement to check the privacy relation of. |
distance_in |
undocumented |
distance_out |
undocumented |
True indicates that the relation passed at the given distance.
Get the function from a measurement.
measurement_function(this)measurement_function(this)
this |
The measurement to retrieve the value from. |
Function
this.Get the input (carrier) data type of this.
measurement_input_carrier_type(this)measurement_input_carrier_type(this)
this |
The measurement to retrieve the type from. |
str
measurement.Get the input distance type of measurement.
measurement_input_distance_type(this)measurement_input_distance_type(this)
this |
The measurement to retrieve the type from. |
str
measurement.Get the input domain from a measurement.
measurement_input_domain(this)measurement_input_domain(this)
this |
The measurement to retrieve the value from. |
Domain
measurement.Get the input domain from a measurement.
measurement_input_metric(this)measurement_input_metric(this)
this |
The measurement to retrieve the value from. |
Metric
measurement with arg. Returns a differentially private release.Invoke the measurement with arg. Returns a differentially private release.
measurement_invoke(this, arg)measurement_invoke(this, arg)
this |
Measurement to invoke. |
arg |
Input data to supply to the measurement. A member of the measurement's input domain. |
measurement to map a given d_in to d_out.Use the measurement to map a given d_in to d_out.
measurement_map(measurement, distance_in)measurement_map(measurement, distance_in)
measurement |
Measurement to check the map distances with. |
distance_in |
Distance in terms of the input metric. |
measurement.Get the output distance type of measurement.
measurement_output_distance_type(this)measurement_output_distance_type(this)
this |
The measurement to retrieve the type from. |
str
measurement.Get the output domain from a measurement.
measurement_output_measure(this)measurement_output_measure(this)
this |
The measurement to retrieve the value from. |
Measure
metric.Debug a metric.
metric_debug(this)metric_debug(this)
this |
The metric to debug (stringify). |
str
metric.Get the distance type of a metric.
metric_distance_type(this)metric_distance_type(this)
this |
The metric to retrieve the distance type from. |
str
metric.Get the type of a metric.
metric_type(this)metric_type(this)
this |
The metric to retrieve the type from. |
str
new domain
new_domain(ptr, log)new_domain(ptr, log)
ptr |
a pointer to a domain |
log |
call history |
Required features: contrib, honest-but-curious
new_function(function_, .TO)new_function(function_, .TO)
function_ |
A function mapping data to a value of type |
.TO |
Output Type |
new_function in Rust documentation.
Why honest-but-curious?:
An OpenDP function must satisfy two criteria.
These invariants about functions are necessary to show correctness of other algorithms.
First, function must not use global state.
For instance, a postprocessor that accesses the system clock time
can be used to build a measurement that reveals elapsed execution time,
which escalates a side-channel vulnerability into a direct vulnerability.
Secondly, function must only raise data-independent exceptions.
For instance, raising an exception with the value of a DP release will both
reveal the DP output and cancel the computation, potentially avoiding privacy accounting.
Function
new function
new_function_internal(ptr, log)new_function_internal(ptr, log)
ptr |
a pointer to a function |
log |
call history |
create an instance of a hashtab from keys and values
new_hashtab(keys, vals)new_hashtab(keys, vals)
keys |
a vector of keys |
vals |
a vector of values |
new measure
new_measure(ptr, log)new_measure(ptr, log)
ptr |
a pointer to a measure |
log |
call history |
new measurement
new_measurement(ptr, log)new_measurement(ptr, log)
ptr |
pointer to the measurement struct |
log |
call history |
new metric
new_metric(ptr, log)new_metric(ptr, log)
ptr |
a pointer to a metric |
log |
call history |
new odometer
new_odometer(ptr, log)new_odometer(ptr, log)
ptr |
pointer to the odometer struct |
log |
call history |
new odometer queryable
new_odometer_queryable_internal(ptr)new_odometer_queryable_internal(ptr)
ptr |
a pointer to an odometer queryable |
Required features: contrib, honest-but-curious
new_privacy_profile(curve)new_privacy_profile(curve)
curve |
A privacy curve mapping epsilon to delta |
Why honest-but-curious?:
The privacy profile should implement a well-defined curve:
monotonically decreasing
rejects epsilon values that are less than zero or nan
returns delta values only within
new privacy profile
new_privacy_profile_internal(ptr)new_privacy_profile_internal(ptr)
ptr |
a pointer to a privacy profile |
Required features: contrib
new_queryable(transition, .Q = "ExtrinsicObject", .A = "ExtrinsicObject")new_queryable(transition, .Q = "ExtrinsicObject", .A = "ExtrinsicObject")
transition |
A transition function taking a reference to self, a query, and an internal/external indicator |
.Q |
Query Type |
.A |
Output Type |
new queryable
new_queryable_internal(ptr)new_queryable_internal(ptr)
ptr |
a pointer to a queryable |
new transformation
new_transformation(ptr, log)new_transformation(ptr, log)
ptr |
pointer to the transformation struct |
log |
call history |
Internal function. Retrieve the type descriptor string of an AnyObject.
object_type(this)object_type(this)
this |
A pointer to the AnyObject. |
str
this.Get the input (carrier) data type of this.
odometer_input_carrier_type(this)odometer_input_carrier_type(this)
this |
The odometer to retrieve the type from. |
str
odometer.Get the input domain from a odometer.
odometer_input_domain(this)odometer_input_domain(this)
this |
The odometer to retrieve the value from. |
Domain
odometer.Get the input domain from a odometer.
odometer_input_metric(this)odometer_input_metric(this)
this |
The odometer to retrieve the value from. |
Metric
odometer with arg. Returns a differentially private release.Invoke the odometer with arg. Returns a differentially private release.
odometer_invoke(this, arg)odometer_invoke(this, arg)
this |
Odometer to invoke. |
arg |
Input data to supply to the odometer. A member of the odometer's input domain. |
odometer.Get the output domain from a odometer.
odometer_output_measure(this)odometer_output_measure(this)
this |
The odometer to retrieve the value from. |
Measure
queryable with an invoke query.Eval the odometer queryable with an invoke query.
odometer_queryable_invoke(queryable, query)odometer_queryable_invoke(queryable, query)
queryable |
Queryable to eval. |
query |
Invoke query to supply to the queryable. |
queryable.Get the invoke query type of an odometer queryable.
odometer_queryable_invoke_type(this)odometer_queryable_invoke_type(this)
this |
The queryable to retrieve the query type from. |
str
queryable.Retrieve the privacy loss of an odometer queryable.
odometer_queryable_privacy_loss(queryable, d_in)odometer_queryable_privacy_loss(queryable, d_in)
queryable |
Queryable to eval. |
d_in |
Maximum distance between adjacent inputs in the input domain. |
queryable.Get the map query type of an odometer queryable.
odometer_queryable_privacy_loss_type(this)odometer_queryable_privacy_loss_type(this)
this |
The queryable to retrieve the query type from. |
str
The OpenDP Library is a modular collection of statistical algorithms that adhere to the definition of differential privacy.
More information can be found at the following locations:
Maintainer: Stefano Iacus [email protected]
Authors:
The OpenDP Project [email protected] (https://github.com/opendp/opendp/graphs/contributors)
Other contributors:
The authors of the dependency Rust crates (see inst/AUTHORS file for details) [contributor]
Useful links:
Report bugs at https://github.com/opendp/opendp/issues
OptionDomain.option_domain in Rust documentation.
option_domain(element_domain, .D = NULL)option_domain(element_domain, .D = NULL)
element_domain |
undocumented |
.D |
The type of the inner domain. |
OptionDomain
Mirrors Python's public RuntimeType.parse_or_infer(...) entrypoint.
parse_or_infer( type_name, public_example, generics = list(), allow_extrinsic = FALSE )parse_or_infer( type_name, public_example, generics = list(), allow_extrinsic = FALSE )
type_name |
A type descriptor to normalize, or |
public_example |
A value to infer from when |
generics |
Generic type names to preserve during parsing. |
allow_extrinsic |
Return |
A normalized runtime_type.
epsilon.Internal function. Use a PrivacyProfile to find epsilon at a given epsilon.
privacy_profile_delta(curve, epsilon)privacy_profile_delta(curve, epsilon)
curve |
The PrivacyProfile. |
epsilon |
What to fix epsilon to compute delta. |
Delta at a given epsilon.
delta.Internal function. Use an PrivacyProfile to find epsilon at a given delta.
privacy_profile_epsilon(profile, delta)privacy_profile_epsilon(profile, delta)
profile |
The PrivacyProfile. |
delta |
What to fix delta to compute epsilon. |
Epsilon at a given delta.
queryable with query. Returns a differentially private release.Eval the queryable with query. Returns a differentially private release.
queryable_eval(queryable, query)queryable_eval(queryable, query)
queryable |
Queryable to eval. |
query |
The input to the queryable. |
queryable.Get the query type of queryable.
queryable_query_type(this)queryable_query_type(this)
this |
The queryable to retrieve the query type from. |
str
In the following proof definition, corresponds to an RDP curve when also quantified over all adjacent datasets.
That is, an RDP curve is no smaller than for any possible choices of ,
and over all pairs of adjacent datasets where , .
is a measurement (commonly known as a mechanism).
The measurement's input metric defines the notion of adjacency,
and the measurement's input domain defines the set of possible datasets.
renyi_divergence()renyi_divergence()
Proof Definition:
For any two distributions and any curve ,
are -close under the Rényi divergence measure if,
for any given ,
Note that this and are not privacy parameters and until quantified over all adjacent datasets,
as is done in the definition of a measurement.
Measure
Mirrors Python's public RuntimeType.infer(...) entrypoint.
rt_infer(public_example, allow_extrinsic = FALSE)rt_infer(public_example, allow_extrinsic = FALSE)
public_example |
A value whose runtime type should be inferred. |
allow_extrinsic |
Return |
A normalized runtime_type.
Mirrors Python's public RuntimeType.parse(...) entrypoint.
rt_parse(type_name, generics = list())rt_parse(type_name, generics = list())
type_name |
A type descriptor to normalize. |
generics |
Generic type names to preserve during parsing. |
A normalized runtime_type.
In the following proof definition, corresponds to a privacy profile when also quantified over all adjacent datasets.
That is, a privacy profile is no smaller than for all possible choices of ,
and over all pairs of adjacent datasets where , .
is a measurement (commonly known as a mechanism).
The measurement's input metric defines the notion of adjacency,
and the measurement's input domain defines the set of possible datasets.
smoothed_max_divergence()smoothed_max_divergence()
The distance is of type PrivacyProfile, so it can be invoked with an
to retrieve the corresponding .
Proof Definition:
For any two distributions and any curve ,
are -close under the smoothed max divergence measure whenever,
for any choice of non-negative , and ,
.
Note that and are not privacy parameters and until quantified over all adjacent datasets,
as is done in the definition of a measurement.
Measure
SymmetricDistance metric.Construct an instance of the SymmetricDistance metric.
symmetric_distance()symmetric_distance()
Metric
See documentation for make_adaptive_composition() for details.
then_adaptive_composition(lhs, output_measure, d_in, d_mids)then_adaptive_composition(lhs, output_measure, d_in, d_mids)
lhs |
The prior transformation or metric space. |
output_measure |
how privacy is measured |
d_in |
maximum distance between adjacent input datasets |
d_mids |
maximum privacy expenditure of each query |
Measurement
See documentation for make_alp_queryable() for details.
then_alp_queryable( lhs, scale, total_limit, value_limit = NULL, size_factor = 50L, alpha = 4L )then_alp_queryable( lhs, scale, total_limit, value_limit = NULL, size_factor = 50L, alpha = 4L )
lhs |
The prior transformation or metric space. |
scale |
Privacy loss parameter. This is equal to epsilon/sensitivity. |
total_limit |
Either the true value or an upper bound estimate of the sum of all values in the input. |
value_limit |
Upper bound on individual values (referred to as β). Entries above β are clamped. |
size_factor |
Optional multiplier (default of 50) for setting the size of the projection. |
alpha |
Optional parameter (default of 4) for scaling and determining p in randomized response step. |
Measurement
See documentation for make_approximate() for details.
then_approximate(lhs, measurement)then_approximate(lhs, measurement)
lhs |
The prior transformation or metric space. |
measurement |
a measurement with a privacy measure to be casted |
Measurement
See documentation for make_b_ary_tree() for details.
then_b_ary_tree(lhs, leaf_count, branching_factor)then_b_ary_tree(lhs, leaf_count, branching_factor)
lhs |
The prior transformation or metric space. |
leaf_count |
The number of leaf nodes in the b-ary tree. |
branching_factor |
The number of children on each branch of the resulting tree. Larger branching factors result in shallower trees. |
Transformation
See documentation for make_basic_composition() for details.
then_basic_composition(lhs, measurements)then_basic_composition(lhs, measurements)
lhs |
The prior transformation or metric space. |
measurements |
A vector of Measurements to compose. |
Measurement
See documentation for make_bounded_float_checked_sum() for details.
then_bounded_float_checked_sum(lhs, size_limit, bounds, .S = "Pairwise<.T>")then_bounded_float_checked_sum(lhs, size_limit, bounds, .S = "Pairwise<.T>")
lhs |
The prior transformation or metric space. |
size_limit |
Upper bound on number of records to keep in the input data. |
bounds |
Tuple of lower and upper bounds for data in the input domain. |
.S |
Summation algorithm to use over some data type |
Transformation
See documentation for make_bounded_float_ordered_sum() for details.
then_bounded_float_ordered_sum(lhs, size_limit, bounds, .S = "Pairwise<.T>")then_bounded_float_ordered_sum(lhs, size_limit, bounds, .S = "Pairwise<.T>")
lhs |
The prior transformation or metric space. |
size_limit |
Upper bound on the number of records in input data. Used to bound sensitivity. |
bounds |
Tuple of lower and upper bounds for data in the input domain. |
.S |
Summation algorithm to use over some data type |
Transformation
See documentation for make_bounded_int_monotonic_sum() for details.
then_bounded_int_monotonic_sum(lhs, bounds, .T = NULL)then_bounded_int_monotonic_sum(lhs, bounds, .T = NULL)
lhs |
The prior transformation or metric space. |
bounds |
Tuple of lower and upper bounds for data in the input domain. |
.T |
Atomic Input Type and Output Type |
Transformation
See documentation for make_bounded_int_ordered_sum() for details.
then_bounded_int_ordered_sum(lhs, bounds, .T = NULL)then_bounded_int_ordered_sum(lhs, bounds, .T = NULL)
lhs |
The prior transformation or metric space. |
bounds |
Tuple of lower and upper bounds for data in the input domain. |
.T |
Atomic Input Type and Output Type |
Transformation
See documentation for make_bounded_int_split_sum() for details.
then_bounded_int_split_sum(lhs, bounds, .T = NULL)then_bounded_int_split_sum(lhs, bounds, .T = NULL)
lhs |
The prior transformation or metric space. |
bounds |
Tuple of lower and upper bounds for data in the input domain. |
.T |
Atomic Input Type and Output Type |
Transformation
See documentation for make_canonical_noise() for details.
then_canonical_noise(lhs, d_in, d_out)then_canonical_noise(lhs, d_in, d_out)
lhs |
The prior transformation or metric space. |
d_in |
Sensitivity |
d_out |
Privacy parameters (ε, δ) |
Measurement
See documentation for make_cast() for details.
then_cast(lhs, .TOA)then_cast(lhs, .TOA)
lhs |
The prior transformation or metric space. |
.TOA |
Atomic Output Type to cast into |
Transformation
See documentation for make_cast_default() for details.
then_cast_default(lhs, .TOA)then_cast_default(lhs, .TOA)
lhs |
The prior transformation or metric space. |
.TOA |
Atomic Output Type to cast into |
Transformation
See documentation for make_cast_inherent() for details.
then_cast_inherent(lhs, .TOA)then_cast_inherent(lhs, .TOA)
lhs |
The prior transformation or metric space. |
.TOA |
Atomic Output Type to cast into |
Transformation
See documentation for make_cdf() for details.
then_cdf(lhs, .TA = "float")then_cdf(lhs, .TA = "float")
lhs |
The prior transformation or metric space. |
.TA |
Atomic Type. One of |
Function
See documentation for make_chain_mt() for details.
then_chain_mt(lhs, measurement1, transformation0)then_chain_mt(lhs, measurement1, transformation0)
lhs |
The prior transformation or metric space. |
measurement1 |
outer mechanism |
transformation0 |
inner transformation |
Measurement
See documentation for make_chain_pm() for details.
then_chain_pm(lhs, postprocess1, measurement0)then_chain_pm(lhs, postprocess1, measurement0)
lhs |
The prior transformation or metric space. |
postprocess1 |
outer postprocessor |
measurement0 |
inner measurement/mechanism |
Measurement
See documentation for make_chain_tt() for details.
then_chain_tt(lhs, transformation1, transformation0)then_chain_tt(lhs, transformation1, transformation0)
lhs |
The prior transformation or metric space. |
transformation1 |
outer transformation |
transformation0 |
inner transformation |
Transformation
See documentation for make_clamp() for details.
then_clamp(lhs, bounds)then_clamp(lhs, bounds)
lhs |
The prior transformation or metric space. |
bounds |
Tuple of inclusive lower and upper bounds. |
Transformation
See documentation for make_composition() for details.
then_composition(lhs, measurements)then_composition(lhs, measurements)
lhs |
The prior transformation or metric space. |
measurements |
A vector of Measurements to compose. |
Measurement
See documentation for make_consistent_b_ary_tree() for details.
then_consistent_b_ary_tree(lhs, branching_factor, .TIA = "int", .TOA = "float")then_consistent_b_ary_tree(lhs, branching_factor, .TIA = "int", .TOA = "float")
lhs |
The prior transformation or metric space. |
branching_factor |
the maximum number of children |
.TIA |
Atomic type of the input data. Should be an integer type. |
.TOA |
Atomic type of the output data. Should be a float type. |
Function
See documentation for make_count() for details.
then_count(lhs, .TO = "int")then_count(lhs, .TO = "int")
lhs |
The prior transformation or metric space. |
.TO |
Output Type. Must be numeric. |
Transformation
See documentation for make_count_by() for details.
then_count_by(lhs, .TV = "int")then_count_by(lhs, .TV = "int")
lhs |
The prior transformation or metric space. |
.TV |
Type of Value. Express counts in terms of this integral type. |
The carrier type is HashMap<TK, TV>, a hashmap of the count (TV) for each unique data input (TK).
See documentation for make_count_by_categories() for details.
then_count_by_categories( lhs, categories, null_category = TRUE, .MO = "L1Distance<int>", .TOA = "int" )then_count_by_categories( lhs, categories, null_category = TRUE, .MO = "L1Distance<int>", .TOA = "int" )
lhs |
The prior transformation or metric space. |
categories |
The set of categories to compute counts for. |
null_category |
Include a count of the number of elements that were not in the category set at the end of the vector. |
.MO |
Output Metric. |
.TOA |
Atomic Output Type that is numeric. |
The carrier type is Vec<TOA>, a vector of the counts (TOA).
See documentation for make_count_distinct() for details.
then_count_distinct(lhs, .TO = "int")then_count_distinct(lhs, .TO = "int")
lhs |
The prior transformation or metric space. |
.TO |
Output Type. Must be numeric. |
Transformation
See documentation for make_create_dataframe() for details.
then_create_dataframe(lhs, col_names, .K = NULL)then_create_dataframe(lhs, col_names, .K = NULL)
lhs |
The prior transformation or metric space. |
col_names |
Column names for each record entry. |
.K |
categorical/hashable data type of column names |
Transformation
See documentation for make_df_cast_default() for details.
then_df_cast_default(lhs, column_name, .TIA, .TOA)then_df_cast_default(lhs, column_name, .TIA, .TOA)
lhs |
The prior transformation or metric space. |
column_name |
column name to be transformed |
.TIA |
Atomic Input Type to cast from |
.TOA |
Atomic Output Type to cast into |
Transformation
See documentation for make_df_is_equal() for details.
then_df_is_equal(lhs, column_name, value, .TIA = NULL)then_df_is_equal(lhs, column_name, value, .TIA = NULL)
lhs |
The prior transformation or metric space. |
column_name |
Column name to be transformed |
value |
Value to check for equality |
.TIA |
Atomic Input Type to cast from |
Transformation
See documentation for make_drop_null() for details.
then_drop_null(lhs)then_drop_null(lhs)
lhs |
The prior transformation or metric space. |
Transformation
See documentation for make_find() for details.
then_find(lhs, categories)then_find(lhs, categories)
lhs |
The prior transformation or metric space. |
categories |
The set of categories to find indexes from. |
Transformation
See documentation for make_find_bin() for details.
then_find_bin(lhs, edges)then_find_bin(lhs, edges)
lhs |
The prior transformation or metric space. |
edges |
The set of edges to split bins by. |
Transformation
See documentation for make_fix_delta() for details.
then_fix_delta(lhs, measurement, delta)then_fix_delta(lhs, measurement, delta)
lhs |
The prior transformation or metric space. |
measurement |
a measurement with a privacy curve to be fixed |
delta |
parameter to fix the privacy curve with |
Measurement
See documentation for make_fixed_approxDP_to_approxDP() for details.
then_fixed_approxDP_to_approxDP(lhs, measurement)then_fixed_approxDP_to_approxDP(lhs, measurement)
lhs |
The prior transformation or metric space. |
measurement |
a measurement with a privacy measure to be casted |
Measurement
See documentation for make_fully_adaptive_composition() for details.
then_fully_adaptive_composition(lhs, output_measure)then_fully_adaptive_composition(lhs, output_measure)
lhs |
The prior transformation or metric space. |
output_measure |
how privacy is measured |
Odometer
See documentation for make_gaussian() for details.
then_gaussian(lhs, scale, k = NULL, .MO = "ZeroConcentratedDivergence")then_gaussian(lhs, scale, k = NULL, .MO = "ZeroConcentratedDivergence")
lhs |
The prior transformation or metric space. |
scale |
Noise scale parameter for the gaussian distribution. |
k |
The noise granularity in terms of 2^k. |
.MO |
Output Measure. The only valid measure is |
Measurement
library(opendp) enable_features("contrib") gaussian <- make_gaussian( atom_domain(.T = f64, nan = FALSE), absolute_distance(.T = f64), scale = 1.0) gaussian(arg = 100.0) # Or, more readably, define the space and then chain: space <- c(atom_domain(.T = f64, nan = FALSE), absolute_distance(.T = f64)) gaussian <- space |> then_gaussian(scale = 1.0) gaussian(arg = 100.0) # Sensitivity of this measurement: gaussian(d_in = 1) gaussian(d_in = 2) gaussian(d_in = 4) # Typically will be used with vectors rather than individual numbers: space <- c(vector_domain(atom_domain(.T = i32)), l2_distance(.T = i32)) gaussian <- space |> then_gaussian(scale = 1.0) gaussian(arg = c(10L, 20L, 30L))library(opendp) enable_features("contrib") gaussian <- make_gaussian( atom_domain(.T = f64, nan = FALSE), absolute_distance(.T = f64), scale = 1.0) gaussian(arg = 100.0) # Or, more readably, define the space and then chain: space <- c(atom_domain(.T = f64, nan = FALSE), absolute_distance(.T = f64)) gaussian <- space |> then_gaussian(scale = 1.0) gaussian(arg = 100.0) # Sensitivity of this measurement: gaussian(d_in = 1) gaussian(d_in = 2) gaussian(d_in = 4) # Typically will be used with vectors rather than individual numbers: space <- c(vector_domain(atom_domain(.T = i32)), l2_distance(.T = i32)) gaussian <- space |> then_gaussian(scale = 1.0) gaussian(arg = c(10L, 20L, 30L))
See documentation for make_gaussian_threshold() for details.
then_gaussian_threshold( lhs, scale, threshold, k = NULL, .MO = "Approximate<ZeroConcentratedDivergence>" )then_gaussian_threshold( lhs, scale, threshold, k = NULL, .MO = "Approximate<ZeroConcentratedDivergence>" )
lhs |
The prior transformation or metric space. |
scale |
Noise scale parameter for the laplace distribution. |
threshold |
Exclude pairs with values whose distance from zero exceeds this value. |
k |
The noise granularity in terms of 2^k. |
.MO |
Output Measure. |
Measurement
See documentation for make_geometric() for details.
then_geometric(lhs, scale, bounds = NULL, .MO = "MaxDivergence")then_geometric(lhs, scale, bounds = NULL, .MO = "MaxDivergence")
lhs |
The prior transformation or metric space. |
scale |
Noise scale parameter for the distribution. |
bounds |
Set bounds on the count to make the algorithm run in constant-time. |
.MO |
Measure used to quantify privacy loss. Valid values are just |
Measurement
See documentation for make_identity() for details.
then_identity(lhs)then_identity(lhs)
lhs |
The prior transformation or metric space. |
Transformation
See documentation for make_impute_constant() for details.
then_impute_constant(lhs, constant)then_impute_constant(lhs, constant)
lhs |
The prior transformation or metric space. |
constant |
Value to replace nulls with. |
Transformation
See documentation for make_impute_uniform_float() for details.
then_impute_uniform_float(lhs, bounds)then_impute_uniform_float(lhs, bounds)
lhs |
The prior transformation or metric space. |
bounds |
Tuple of inclusive lower and upper bounds. |
Transformation
See documentation for make_index() for details.
then_index(lhs, categories, null, .TOA = NULL)then_index(lhs, categories, null, .TOA = NULL)
lhs |
The prior transformation or metric space. |
categories |
The set of categories to index into. |
null |
Category to return if the index is out-of-range of the category set. |
.TOA |
Atomic Output Type. Output data will be |
Transformation
See documentation for make_is_equal() for details.
then_is_equal(lhs, value)then_is_equal(lhs, value)
lhs |
The prior transformation or metric space. |
value |
value to check against |
Transformation
See documentation for make_is_null() for details.
then_is_null(lhs)then_is_null(lhs)
lhs |
The prior transformation or metric space. |
Transformation
See documentation for make_laplace() for details.
then_laplace(lhs, scale, k = NULL, .MO = "MaxDivergence")then_laplace(lhs, scale, k = NULL, .MO = "MaxDivergence")
lhs |
The prior transformation or metric space. |
scale |
Noise scale parameter for the Laplace distribution. |
k |
The noise granularity in terms of 2^k, only valid for domains over floats. |
.MO |
Measure used to quantify privacy loss. Valid values are just |
Measurement
See documentation for make_laplace_threshold() for details.
then_laplace_threshold( lhs, scale, threshold, k = NULL, .MO = "Approximate<MaxDivergence>" )then_laplace_threshold( lhs, scale, threshold, k = NULL, .MO = "Approximate<MaxDivergence>" )
lhs |
The prior transformation or metric space. |
scale |
Noise scale parameter for the laplace distribution. |
threshold |
Exclude counts that are less than this minimum value. |
k |
The noise granularity in terms of 2^k. |
.MO |
Output Measure. |
Measurement
See documentation for make_lipschitz_float_mul() for details.
then_lipschitz_float_mul(lhs, constant, bounds)then_lipschitz_float_mul(lhs, constant, bounds)
lhs |
The prior transformation or metric space. |
constant |
The constant to multiply aggregates by. |
bounds |
Tuple of inclusive lower and upper bounds. |
Transformation
See documentation for make_mean() for details.
then_mean(lhs)then_mean(lhs)
lhs |
The prior transformation or metric space. |
Transformation
See documentation for make_metric_bounded() for details.
then_metric_bounded(lhs)then_metric_bounded(lhs)
lhs |
The prior transformation or metric space. |
Transformation
See documentation for make_metric_unbounded() for details.
then_metric_unbounded(lhs)then_metric_unbounded(lhs)
lhs |
The prior transformation or metric space. |
Transformation
See documentation for make_noise() for details.
then_noise(lhs, output_measure, scale, k = NULL)then_noise(lhs, output_measure, scale, k = NULL)
lhs |
The prior transformation or metric space. |
output_measure |
Privacy measure. Either |
scale |
Noise scale parameter. |
k |
The noise granularity in terms of 2^k. |
Measurement
See documentation for make_noise_threshold() for details.
then_noise_threshold(lhs, output_measure, scale, threshold, k = NULL)then_noise_threshold(lhs, output_measure, scale, threshold, k = NULL)
lhs |
The prior transformation or metric space. |
output_measure |
Privacy measure. Either |
scale |
Noise scale parameter for the laplace distribution. |
threshold |
Exclude counts that are less than this minimum value. |
k |
The noise granularity in terms of 2^k. |
Measurement
See documentation for make_noisy_max() for details.
then_noisy_max(lhs, output_measure, scale, negate = FALSE)then_noisy_max(lhs, output_measure, scale, negate = FALSE)
lhs |
The prior transformation or metric space. |
output_measure |
One of |
scale |
Scale for the noise distribution |
negate |
Set to true to return min |
Measurement
See documentation for make_noisy_top_k() for details.
then_noisy_top_k(lhs, output_measure, k, scale, negate = FALSE)then_noisy_top_k(lhs, output_measure, k, scale, negate = FALSE)
lhs |
The prior transformation or metric space. |
output_measure |
One of |
k |
Number of indices to select. |
scale |
Scale for the noise distribution. |
negate |
Set to true to return bottom k |
Measurement
See documentation for make_ordered_random() for details.
then_ordered_random(lhs)then_ordered_random(lhs)
lhs |
The prior transformation or metric space. |
Transformation
See documentation for make_population_amplification() for details.
then_population_amplification(lhs, measurement, population_size)then_population_amplification(lhs, measurement, population_size)
lhs |
The prior transformation or metric space. |
measurement |
the computation to amplify |
population_size |
the size of the population from which the input dataset is a simple sample |
Measurement
This provides Python-like ergonomics for chaining a pure function after a measurement release.
then_postprocess(lhs, f, .TO = "ExtrinsicObject")then_postprocess(lhs, f, .TO = "ExtrinsicObject")
lhs |
A measurement to postprocess. |
f |
A pure postprocessing function applied to the release. |
.TO |
The runtime type of the postprocessed output. |
A composed measurement.
See documentation for make_privacy_filter() for details.
then_privacy_filter(lhs, odometer, d_in, d_out)then_privacy_filter(lhs, odometer, d_in, d_out)
lhs |
The prior transformation or metric space. |
odometer |
A privacy odometer |
d_in |
Upper bound on the distance between adjacent datasets |
d_out |
Upper bound on the privacy loss |
Measurement
See documentation for make_private_quantile() for details.
then_private_quantile(lhs, output_measure, candidates, alpha, scale)then_private_quantile(lhs, output_measure, candidates, alpha, scale)
lhs |
The prior transformation or metric space. |
output_measure |
Either MaxDivergence or ZeroConcentratedDivergence. |
candidates |
Potential quantiles to score |
alpha |
a value in |
scale |
the scale of the noise added |
Measurement
See documentation for make_pureDP_to_zCDP() for details.
then_pureDP_to_zCDP(lhs, measurement)then_pureDP_to_zCDP(lhs, measurement)
lhs |
The prior transformation or metric space. |
measurement |
a measurement with a privacy measure to be casted |
Measurement
See documentation for make_quantile_score_candidates() for details.
then_quantile_score_candidates(lhs, candidates, alpha)then_quantile_score_candidates(lhs, candidates, alpha)
lhs |
The prior transformation or metric space. |
candidates |
Potential quantiles to score |
alpha |
a value in |
Transformation
See documentation for make_quantiles_from_counts() for details.
then_quantiles_from_counts( lhs, bin_edges, alphas, interpolation = "linear", .TA = NULL, .F = "float" )then_quantiles_from_counts( lhs, bin_edges, alphas, interpolation = "linear", .TA = NULL, .F = "float" )
lhs |
The prior transformation or metric space. |
bin_edges |
The edges that the input data was binned into before counting. |
alphas |
Return all specified |
interpolation |
Must be one of |
.TA |
Atomic Type of the bin edges and data. |
.F |
Float type of the alpha argument. One of |
Function
See documentation for make_randomized_response() for details.
then_randomized_response(lhs, categories, prob, .T = NULL)then_randomized_response(lhs, categories, prob, .T = NULL)
lhs |
The prior transformation or metric space. |
categories |
Set of valid outcomes |
prob |
Probability of returning the correct answer. Must be in |
.T |
Data type of a category. |
Measurement
See documentation for make_randomized_response_bitvec() for details.
then_randomized_response_bitvec(lhs, f, constant_time = FALSE)then_randomized_response_bitvec(lhs, f, constant_time = FALSE)
lhs |
The prior transformation or metric space. |
f |
Per-bit flipping probability. Must be in |
constant_time |
Whether to run the Bernoulli samplers in constant time, this is likely to be extremely slow. |
Measurement
See documentation for make_randomized_response_bool() for details.
then_randomized_response_bool(lhs, prob, constant_time = FALSE)then_randomized_response_bool(lhs, prob, constant_time = FALSE)
lhs |
The prior transformation or metric space. |
prob |
Probability of returning the correct answer. Must be in |
constant_time |
Set to true to enable constant time. Slower. |
Measurement
See documentation for make_report_noisy_max_gumbel() for details.
then_report_noisy_max_gumbel(lhs, scale, optimize = "max")then_report_noisy_max_gumbel(lhs, scale, optimize = "max")
lhs |
The prior transformation or metric space. |
scale |
Scale for the noise distribution |
optimize |
Set to "min" to report noisy min |
Measurement
See documentation for make_resize() for details.
then_resize(lhs, size, constant, .MO = "SymmetricDistance")then_resize(lhs, size, constant, .MO = "SymmetricDistance")
lhs |
The prior transformation or metric space. |
size |
Number of records in output data. |
constant |
Value to impute with. |
.MO |
Output Metric. One of |
A vector of the same type TA, but with the provided size.
See documentation for make_select_column() for details.
then_select_column(lhs, key, .TOA, .K = NULL)then_select_column(lhs, key, .TOA, .K = NULL)
lhs |
The prior transformation or metric space. |
key |
categorical/hashable data type of the key/column name |
.TOA |
Atomic Output Type to downcast vector to |
.K |
data type of key |
Transformation
See documentation for make_select_private_candidate() for details.
then_select_private_candidate(lhs, measurement, stop_probability, threshold)then_select_private_candidate(lhs, measurement, stop_probability, threshold)
lhs |
The prior transformation or metric space. |
measurement |
A measurement that releases a 2-tuple of (score, candidate) |
stop_probability |
The probability of stopping early at any iteration. |
threshold |
The threshold score. Return immediately if the score is above this threshold. |
A measurement that returns a release from measurement whose score is greater than threshold, or none.
See documentation for make_sequential_composition() for details.
then_sequential_composition(lhs, output_measure, d_in, d_mids)then_sequential_composition(lhs, output_measure, d_in, d_mids)
lhs |
The prior transformation or metric space. |
output_measure |
how privacy is measured |
d_in |
maximum distance between adjacent input datasets |
d_mids |
maximum privacy expenditure of each query |
Measurement
See documentation for make_sized_bounded_float_checked_sum() for details.
then_sized_bounded_float_checked_sum(lhs, size, bounds, .S = "Pairwise<.T>")then_sized_bounded_float_checked_sum(lhs, size, bounds, .S = "Pairwise<.T>")
lhs |
The prior transformation or metric space. |
size |
Number of records in input data. |
bounds |
Tuple of lower and upper bounds for data in the input domain. |
.S |
Summation algorithm to use over some data type |
Transformation
See documentation for make_sized_bounded_float_ordered_sum() for details.
then_sized_bounded_float_ordered_sum(lhs, size, bounds, .S = "Pairwise<.T>")then_sized_bounded_float_ordered_sum(lhs, size, bounds, .S = "Pairwise<.T>")
lhs |
The prior transformation or metric space. |
size |
Number of records in input data. |
bounds |
Tuple of lower and upper bounds for data in the input domain. |
.S |
Summation algorithm to use over some data type |
Transformation
See documentation for make_sized_bounded_int_checked_sum() for details.
then_sized_bounded_int_checked_sum(lhs, size, bounds, .T = NULL)then_sized_bounded_int_checked_sum(lhs, size, bounds, .T = NULL)
lhs |
The prior transformation or metric space. |
size |
Number of records in input data. |
bounds |
Tuple of lower and upper bounds for data in the input domain. |
.T |
Atomic Input Type and Output Type |
Transformation
See documentation for make_sized_bounded_int_monotonic_sum() for details.
then_sized_bounded_int_monotonic_sum(lhs, size, bounds, .T = NULL)then_sized_bounded_int_monotonic_sum(lhs, size, bounds, .T = NULL)
lhs |
The prior transformation or metric space. |
size |
Number of records in input data. |
bounds |
Tuple of lower and upper bounds for data in the input domain. |
.T |
Atomic Input Type and Output Type |
Transformation
See documentation for make_sized_bounded_int_ordered_sum() for details.
then_sized_bounded_int_ordered_sum(lhs, size, bounds, .T = NULL)then_sized_bounded_int_ordered_sum(lhs, size, bounds, .T = NULL)
lhs |
The prior transformation or metric space. |
size |
Number of records in input data. |
bounds |
Tuple of lower and upper bounds for data in the input domain. |
.T |
Atomic Input Type and Output Type |
Transformation
See documentation for make_sized_bounded_int_split_sum() for details.
then_sized_bounded_int_split_sum(lhs, size, bounds, .T = NULL)then_sized_bounded_int_split_sum(lhs, size, bounds, .T = NULL)
lhs |
The prior transformation or metric space. |
size |
Number of records in input data. |
bounds |
Tuple of lower and upper bounds for data in the input domain. |
.T |
Atomic Input Type and Output Type |
Transformation
See documentation for make_split_dataframe() for details.
then_split_dataframe(lhs, separator, col_names, .K = NULL)then_split_dataframe(lhs, separator, col_names, .K = NULL)
lhs |
The prior transformation or metric space. |
separator |
The token(s) that separate entries in each record. |
col_names |
Column names for each record entry. |
.K |
categorical/hashable data type of column names |
Transformation
See documentation for make_split_lines() for details.
then_split_lines(lhs)then_split_lines(lhs)
lhs |
The prior transformation or metric space. |
Transformation
See documentation for make_split_records() for details.
then_split_records(lhs, separator)then_split_records(lhs, separator)
lhs |
The prior transformation or metric space. |
separator |
The token(s) that separate entries in each record. |
Transformation
See documentation for make_subset_by() for details.
then_subset_by(lhs, indicator_column, keep_columns, .TK = NULL)then_subset_by(lhs, indicator_column, keep_columns, .TK = NULL)
lhs |
The prior transformation or metric space. |
indicator_column |
name of the boolean column that indicates inclusion in the subset |
keep_columns |
list of column names to apply subset to |
.TK |
Type of the column name |
Transformation
See documentation for make_sum() for details.
then_sum(lhs)then_sum(lhs)
lhs |
The prior transformation or metric space. |
Transformation
See documentation for make_sum_of_squared_deviations() for details.
then_sum_of_squared_deviations(lhs, .S = "Pairwise<.T>")then_sum_of_squared_deviations(lhs, .S = "Pairwise<.T>")
lhs |
The prior transformation or metric space. |
.S |
Summation algorithm to use on data type |
Transformation
See documentation for make_unordered() for details.
then_unordered(lhs)then_unordered(lhs)
lhs |
The prior transformation or metric space. |
Transformation
See documentation for make_user_measurement() for details.
then_user_measurement( lhs, output_measure, function_, privacy_map, .TO = "ExtrinsicObject" )then_user_measurement( lhs, output_measure, function_, privacy_map, .TO = "ExtrinsicObject" )
lhs |
The prior transformation or metric space. |
output_measure |
The measure from which distances between adjacent output distributions are measured. |
function_ |
A function mapping data from |
privacy_map |
A function mapping distances from |
.TO |
The data type of outputs from the function. |
Measurement
See documentation for make_user_transformation() for details.
then_user_transformation( lhs, input_domain, input_metric, output_domain, output_metric, function_, stability_map )then_user_transformation( lhs, input_domain, input_metric, output_domain, output_metric, function_, stability_map )
lhs |
The prior transformation or metric space. |
input_domain |
A domain describing the set of valid inputs for the function. |
input_metric |
The metric from which distances between adjacent inputs are measured. |
output_domain |
A domain describing the set of valid outputs of the function. |
output_metric |
The metric from which distances between outputs of adjacent inputs are measured. |
function_ |
A function mapping data from |
stability_map |
A function mapping distances from |
Transformation
See documentation for make_variance() for details.
then_variance(lhs, ddof = 1L, .S = "Pairwise<.T>")then_variance(lhs, ddof = 1L, .S = "Pairwise<.T>")
lhs |
The prior transformation or metric space. |
ddof |
Delta degrees of freedom. Set to 0 if not a sample, 1 for sample estimate. |
.S |
Summation algorithm to use on data type |
Transformation
See documentation for make_zCDP_to_approxDP() for details.
then_zCDP_to_approxDP(lhs, measurement)then_zCDP_to_approxDP(lhs, measurement)
lhs |
The prior transformation or metric space. |
measurement |
a measurement with a privacy measure to be casted |
Measurement
Convert a format-able value to a string representation
## Default S3 method: to_str(x, depth)## Default S3 method: to_str(x, depth)
x |
value to convert to string |
depth |
offset from start of string |
Convert hashtab to a string representation
## S3 method for class 'hashtab' to_str(x, depth = 0L)## S3 method for class 'hashtab' to_str(x, depth = 0L)
x |
value to convert to string |
depth |
offset from start of string |
make_ constructor into a then_ constructor.This mirrors the Python extras utility for constructors whose first two
arguments are input_domain and input_metric.
to_then(constructor)to_then(constructor)
constructor |
A constructor whose first two arguments are |
A partial constructor suitable for |> chaining.
measurement at the given d_in, d_out
Check the privacy relation of the measurement at the given d_in, d_out
transformation_check(transformation, distance_in, distance_out)transformation_check(transformation, distance_in, distance_out)
transformation |
undocumented |
distance_in |
undocumented |
distance_out |
undocumented |
True indicates that the relation passed at the given distance.
Get the function from a transformation.
transformation_function(this)transformation_function(this)
this |
The transformation to retrieve the value from. |
Function
this.Get the input (carrier) data type of this.
transformation_input_carrier_type(this)transformation_input_carrier_type(this)
this |
The transformation to retrieve the type from. |
str
transformation.Get the input distance type of transformation.
transformation_input_distance_type(this)transformation_input_distance_type(this)
this |
The transformation to retrieve the type from. |
str
transformation.Get the input domain from a transformation.
transformation_input_domain(this)transformation_input_domain(this)
this |
The transformation to retrieve the value from. |
Domain
transformation.Get the input domain from a transformation.
transformation_input_metric(this)transformation_input_metric(this)
this |
The transformation to retrieve the value from. |
Metric
transformation with arg. Returns a differentially private release.Invoke the transformation with arg. Returns a differentially private release.
transformation_invoke(this, arg)transformation_invoke(this, arg)
this |
Transformation to invoke. |
arg |
Input data to supply to the transformation. A member of the transformation's input domain. |
transformation to map a given d_in to d_out.Use the transformation to map a given d_in to d_out.
transformation_map(transformation, distance_in)transformation_map(transformation, distance_in)
transformation |
Transformation to check the map distances with. |
distance_in |
Distance in terms of the input metric. |
transformation.Get the output distance type of transformation.
transformation_output_distance_type(this)transformation_output_distance_type(this)
this |
The transformation to retrieve the type from. |
str
transformation.Get the output domain from a transformation.
transformation_output_domain(this)transformation_output_domain(this)
this |
The transformation to retrieve the value from. |
Domain
transformation.Get the output domain from a transformation.
transformation_output_metric(this)transformation_output_metric(this)
this |
The transformation to retrieve the value from. |
Metric
type signature for a 128-bit unsigned integer
u128u128
type signature for a 16-bit unsigned integer
u16u16
type signature for a 32-bit unsigned integer
u32u32
type signature for a 64-bit unsigned integer
u64u64
type signature for an 8-bit unsigned integer
u8u8
Required features: honest-but-curious
user_distance(identifier, descriptor = NULL)user_distance(identifier, descriptor = NULL)
identifier |
A string description of the metric. |
descriptor |
Additional constraints on the domain. |
Why honest-but-curious?:
Your definition of d must satisfy the requirements of a pseudo-metric:
for any ,
for any , (non-negativity)
for any , (symmetry)
for any , (triangle inequality)
Metric
Any two instances of UserDivergence are equal if their descriptors compare equal.
user_divergence(identifier, descriptor = NULL)user_divergence(identifier, descriptor = NULL)
identifier |
A string description of the privacy measure. |
descriptor |
Additional constraints on the privacy measure. |
Required features: honest-but-curious
Why honest-but-curious?:
The essential requirement of a privacy measure is that it is closed under postprocessing.
Your privacy measure D must satisfy that, for any pure function f and any two distributions Y, Y', then .
Beyond this, you should also consider whether your privacy measure can be used to provide meaningful privacy guarantees to your privacy units.
Measure
Required features: honest-but-curious
user_domain(identifier, member, descriptor = NULL)user_domain(identifier, member, descriptor = NULL)
identifier |
A string description of the data domain. |
member |
A function used to test if a value is a member of the data domain. |
descriptor |
Additional constraints on the domain. |
Why honest-but-curious?:
The identifier must uniquely identify this domain. If the identifier is not uniquely identifying, then two different domains with the same identifier will chain, which can violate transformation stability.
In addition, the member function must:
be a pure function
be sound (only return true if its input is a member of the domain).
Domain
type signature for a pointer-sized unsigned integer
usizeusize
VectorDomain.Construct an instance of VectorDomain.
vector_domain(atom_domain, size = NULL)vector_domain(atom_domain, size = NULL)
atom_domain |
The inner domain. |
size |
undocumented |
VectorDomain
In the following proof definition, corresponds to when also quantified over all adjacent datasets.
That is, is the greatest possible
over all pairs of adjacent datasets where , .
is a measurement (commonly known as a mechanism).
The measurement's input metric defines the notion of adjacency,
and the measurement's input domain defines the set of possible datasets.
zero_concentrated_divergence()zero_concentrated_divergence()
Proof Definition:
For any two distributions and any non-negative ,
are -close under the zero-concentrated divergence measure if,
for every possible choice of ,
.
Measure