\documentclass{article}
\input{../../lib.sty}
\allowdisplaybreaks

\title{\texttt{impl TopKMeasure for ZeroConcentratedDivergence}}
\author{Michael Shoemate}
\begin{document}
\maketitle

\section{Hoare Triple}
\subsection*{Precondition}
\subsubsection*{Compiler-verified}
\begin{itemize}
    \item Method \texttt{noisy\_top\_k}
        \textit{Types consistent with pseudocode.}
    \item Method \texttt{privacy\_map}
        \textit{Types consistent with pseudocode.}
\end{itemize}

\subsubsection*{Caller-verified}
\begin{itemize}
    \item Method \texttt{noisy\_top\_k}
        \begin{itemize}
            \item \texttt{x} elements are non-null.
            \item \texttt{scale} is finite and non-negative.
        \end{itemize}
    \item Method \texttt{privacy\_map}
        \begin{itemize}
            \item \texttt{d\_in} is non-null and positive.
            \item \texttt{scale} is non-null and positive.
        \end{itemize}
\end{itemize}

\subsection*{Pseudocode}
\label{sec:python-pseudocode}
\lstinputlisting[language=Python,firstline=2,escapechar=|]{./pseudocode/TopKMeasure_ZeroConcentratedDivergence.py}

\subsection*{Postcondition}
\begin{theorem}
    The implementation is consistent with all associated items in the \rustdoc{measurements/noisy\_top\_k/trait}{TopKMeasure} trait.
    \begin{enumerate}
        \item Method \texttt{noisy\_top\_k}:
        \begin{itemize}
            \item Returns the index of the top element $z_i$,
            where each $z_i \sim \mathrm{DISTRIBUTION}(\mathrm{shift}=y_i, \mathrm{scale}=\texttt{scale})$,
            and each $y_i = -x_i$ if \texttt{negate}, else $y_i = x_i$,
            $k$ times with removal.
            \item Errors are data-independent, except for exhaustion of entropy.
        \end{itemize}

        \item Method \texttt{privacy\_map}:
        For any $x, x'$ where $d_\mathrm{in} \ge d_\mathrm{Range}(x, x')$,
        return $d_\mathrm{out} \ge D_\mathrm{self}(f(x), f(x'))$,
        where $f(x) = \mathrm{noisy\_top\_k}(x=x, k=1, \mathrm{scale}=\mathrm{scale})$.
    \end{enumerate}
\end{theorem}

\begin{definition}
    \label{def:Gumbel}
    A random variable follows the Gumbel distribution if it has density
    \begin{equation}
        f(x) = \frac{1}{\beta} e^{-e^{-z} - z}
    \end{equation}
    where $z = \frac{x - \mu}{\beta}$,
    $\mu$ is the shift (location) parameter and $\beta$ is the scale parameter.
\end{definition}

\begin{proof}[Proof of postcondition: \texttt{noisy\_top\_k}]
    The preconditions of \rustdoc{measurements/noisy_top_k/gumbel/fn}{gumbel\_noisy\_max} are met,
    therefore by the postcondition of \texttt{gumbel\_top\_k},
    the postcondition of \texttt{noisy\_top\_k} is satisfied.
\end{proof}

\begin{proof}[Proof of postcondition: \texttt{privacy\_map}]
    By Lemma 4.2 of \cite{Durfee2019PracticalDP}, $\mathcal{M}_{\mathrm{Gumbel}}^k(x)$ is equal in distribution to the peeling exponential mechanism,
    which is the k-fold composition of the exponential mechanism.
    Proposition 2 of \cite{Dong2019OptimalDP} shows that the exponential mechanism satisfies the zCDP privacy guarantee.
\end{proof}

\bibliographystyle{plain}
\bibliography{references.bib}

\end{document}