\documentclass{article}
\input{../../lib.sty}

\title{\texttt{fn make\_select\_private\_candidate}}
\author{Michael Shoemate}
\date{}

\begin{document}

\maketitle

\contrib
Proves soundness of \rustdoc{combinators/fn}{make\_select\_private\_candidate} in \asOfCommit{mod.rs}{f5bb719}.

\texttt{make\_select\_private\_candidate} returns a Measurement that returns a release from \texttt{measurement} whose score is above \texttt{threshold},
or may fail and return nothing.

\section{Hoare Triple}
\subsection*{Precondition}
\subsubsection*{Compiler-verified}
\begin{itemize}
    \item Generic \texttt{DI} (input domain) is a type with trait \rustdoc{core/trait}{Domain}. 
    \item Generic \texttt{MI} (input metric) is a type with trait \rustdoc{core/trait}{Metric}. 
    \item \rustdoc{core/trait}{MetricSpace} is implemented for \texttt{(DI, MI)}. Therefore \texttt{MI} is a valid metric on \texttt{DI}.
    \item Argument \texttt{measurement} is a measurement whose output metric is \rustdoc{measures/struct}{MaxDivergence}, and releases a tuple \texttt{(f64, TO)}, where \texttt{TO} is some arbitrary type.
    \item Argument \texttt{stop\_probability} is of type \texttt{f64}.
    \item Argument \texttt{threshold} is of type \texttt{f64}.
\end{itemize}

\subsubsection*{User-verified}
None

\subsection*{Pseudocode}
\lstinputlisting[language=Python,firstline=2,escapechar=|]{./pseudocode/make_select_private_candidate.py}

\subsection*{Postcondition}
\validMeasurement{\texttt{(measurement, stop\_probability, threshold, DI, MI, TO)}}{\texttt{make\_select\_private\_candidate}}

\section{Proofs}
This section shows that the pseudocode implements Theorem 3.1 in \cite{liu2018privateselectionprivatecandidates}, where 
\texttt{stop\_probability} is $\gamma$ and
\texttt{threshold} is $\tau$.

\begin{theorem}
    \label{algorithm-equivalence}
    The function pseudocode is equivalent to Algorithm 1 in \cite{liu2018privateselectionprivatecandidates}.
\end{theorem}

\begin{proof}
    \texttt{scale} is $-1 / \ln(1 - \gamma)$, with arithmetic conservatively rounded down.
    The rounding down corresponds to higher effective stop probability.
    A higher effective stop probability results in a lower effective privacy usage $\epsilon_0$.
    This means the advertised privacy loss is a conservative overestimate.

    Since $\gamma$ is restricted to $[0, 1)$ by \ref{stop-prob}, scale is non-negative.
    Therefore in \ref{sample-geometric}, 
    the precondition of \rustdoc{traits/samplers/cks20/fn}{sample\_geometric\_exp\_fast} is satisfied.
    In Algorithm 1, the mechanism is invoked once before potentially terminating, so one is added to the sample.
    \texttt{remaining\_iterations}, a sample from the shifted geometric distribution, 
    is then equivalent to a count of the number of coin flips made until sampling one heads,
    as is used in Algorithm 1.

    We then only run as many iterations as has been sampled, as in Algorithm 1.
    In the case where $T$ is infinity and $\gamma$ is zero, then the algorithm only terminates when score exceeds threshold.

    If the measurement releases a score of NaN, then this is effectively treated as a score below negative infinity, 
    as NaN will never compare greater than the threshold.

    Otherwise, the rest of the algorithm is evidently equivalent.
\end{proof}

\begin{theorem}
    \label{theorem-equivalence}
    \texttt{make\_select\_private\_candidate} is consistent with Theorem 3.1 of \cite{liu2018privateselectionprivatecandidates}.
\end{theorem}

\begin{proof}
    Since there is no limit on iterations, $\epsilon_0$ is zero.
    By \ref{algorithm-equivalence}, the function is equivalent to Algorithm 1, so we can claim parts a-e of Theorem 3.1.
    Since \texttt{measurement} is a valid measurement, then we know that it satisfies $\epsilon_1$-DP.
    The privacy map returns $2\epsilon_1 + \epsilon_0$ with arithmetic rounded conservatively up,
    which is consistent with part b in Theorem 3.1.
\end{proof}

\textbf{(Privacy guarantee.)} 
By \ref{theorem-equivalence}, assuming correctness of Theorem 3.1 part b in \cite{liu2018privateselectionprivatecandidates},
then for every pair of elements $x, x' \in \texttt{input\_domain}$ and every $d_{MI}(x, x') \le \din$ with $\din \ge 0$, 
if $x, x'$ are $\din$-close then $\function(x), \function(x')$ are $\texttt{privacy\_map}(\din)$-close under $\texttt{output\_measure}$ (the Max-Divergence).

\bibliographystyle{plain}
\bibliography{references.bib}

\end{document}
