Opendp

Latest version: v0.11.1

Safety actively analyzes 688917 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 1 of 3

0.7.0

Added
- FFI and Python interfaces for creating and accessing Domains, Metrics, and Measures ([637](https://github.com/opendp/opendp/pull/637))
- Queryables and supporting infrastructure for interactive Measurements ([618](https://github.com/opendp/opendp/pull/618)), ([#675](https://github.com/opendp/opendp/pull/675))
- Constructor for sequential composition of Measurements ([674](https://github.com/opendp/opendp/pull/674))
- Checks for compatibility between pairings of Domains and Metrics/Measures ([604](https://github.com/opendp/opendp/pull/604))
- Python `opendp.extrinsics` module for code contributions and proofs outside of Rust ([693](https://github.com/opendp/opendp/pull/693))
- Docs: [First Look at DP](https://docs.opendp.org/en/v0.7.0/user/first-look-at-DP.html) notebook ([#666](https://github.com/opendp/opendp/pull/666))
- Docs: [Compositors](https://docs.opendp.org/en/v0.7.0/user/combinators/compositors.html) notebook, with usage of interactive Measurements ([#735](https://github.com/opendp/opendp/pull/735))

Changed
- Incorporated Domain instances into some constructor signatures ([650](https://github.com/opendp/opendp/pull/650))
- Simplified postprocessors to Function (from previous full Transformation) ([648](https://github.com/opendp/opendp/pull/648))
- Moved some Domain logic from type-inherent constraints to runtime checks of more general types ([645](https://github.com/opendp/opendp/pull/645)), ([#696](https://github.com/opendp/opendp/pull/696))
- Remove SizedDomain in favor of a runtime size descriptor on VectorDomain
- Remove BoundedDomain in favor of a runtime bounds descriptor on AtomDomain
- Remove InherentNullDomain in favor of a runtime nullity descriptor on AtomDomain
- Removed the default Domain limitation on [user-defined callbacks](https://docs.opendp.org/en/v0.7.0/user/combinators.html#user-defined-callbacks),
and renamed constructors from `make_default_user_XXX()` to `make_user_XXX` ([650](https://github.com/opendp/opendp/pull/650))
- Docs: Improved the clarity of the [User Guide](https://docs.opendp.org/en/v0.7.0/user/index.html) based on feedback ([#639](https://github.com/opendp/opendp/pull/639))
- Docs: Renamed the Developer Guide to [Contributor Guide](https://docs.opendp.org/en/v0.7.0/contributor/index.html) ([#639](https://github.com/opendp/opendp/pull/639))

Deprecated
- AllDomain in the Python bindings, with a warning to switch to AtomDomain ([645](https://github.com/opendp/opendp/pull/645))

Removed
- The `output_domain` field of Measurement struct ([647](https://github.com/opendp/opendp/pull/647))

Fixed
- Switched to from `backtrace` crate to `std::backtrace`, and fixed some corner cases, for much faster backtrace resolution ([691](https://github.com/opendp/opendp/pull/691))
- Whole-codebase reformat using `rustfmt` to minimize spurious churn in the future ([669](https://github.com/opendp/opendp/pull/669))

0.6.2

Added
- [support for user-defined callbacks under explicit opt-in](https://docs.opendp.org/en/v0.6.2/user/combinators.html#user-defined-callbacks)
- researchers may construct their own transformations, measurements and postprocessors in Python
- these "custom" components may be interleaved with other components in the library
- expanded docs.opendp.org User Guide with more explanatory notebooks
- "contrib" proofs for CKS20 sampler algorithms
- "contrib" proof for ρ-zCDP to ε(δ)-DP conversion
- CITATION.cff [552](https://github.com/opendp/opendp/pull/552)

Fixed
- cleanup of accuracy utilities [626](https://github.com/opendp/opendp/issues/626)
* `discrete_gaussian_scale_to_accuracy` returns an accuracy one too large when the scale is on the lower edge
* improve float precision of `laplacian_scale_to_accuracy` and `accuracy_to_laplacian_scale`
* Reported by Alex Whitworth (alexWhitworth). Thank you!
- clamp negative epsilon in `make_zCDP_to_approxDP` when delta is large [621](https://github.com/opendp/opendp/issues/621)
* Reported by Marika Swanberg and Shlomi Hod. Thank you!
- resolve build warnings from metadata in version tags

0.6.1

Fixed
- docs.rs failed to render due to Katex dependency

0.6.0

Added
- Restructured and expanded documentation on docs.opendp.org
- Moved notebooks into the documentation site
- Updated developer documentation and added introductions to Rust and proof-writing
- Much more thorough API documentation and links to corresponding Rust documentation
- Documentation throughout the Rust library, as well as proof definition stubs
- Additional combinators for converting the privacy measure
- `make_pureDP_to_fixed_approxDP` to convert ε to (ε, 0)-approx DP
- `make_pureDP_to_zCDP` to convert ε to ρ
- Additional accuracy functions for discrete noise mechanisms
- `discrete_laplacian_scale_to_accuracy`
- `discrete_gaussian_scale_to_accuracy`
- `accuracy_to_discrete_laplacian_scale`
- `accuracy_to_discrete_gaussian_scale`
- `make_b_ary_tree` Lipschitz transformation. Use in conjunction with:
- `make_consistent_b_ary_tree` to retrieve consistent leaf node counts
- `make_quantiles_from_counts` to retrieve quantile estimates
- `make_cdf` to estimate a discretized cumulative distribution function
- `make_subset_by`, `make_df_is_equal` and `make_df_cast_default` transformations
- used for simple dataframe subsetting
- `make_chain_tm` combinator for postprocessing
- Updates for proof-writing:
- `rust/src/lib.sty` contains a collection of latex macros to aid in cross-linking and maintenance
- See the proof-writing section of the developer documentation
- PRs with .tex proof documents are rendered by a bot
- Documentation will now embed links to proof documents that are adjacent to source files
- Proof documents are automatically hosted and versioned on docs.opendp.org
- An initial proof for `make_count` (by silviacasac, cwagaman gracetian6).

Changed
- Renamed `meas` to `measurements`, `trans` to `transformations` and `comb` to `combinators`
- Added an `honest-but-curious` feature flag to `make_population_amplification`

Fixed
- Python bindings check that C integers do not overflow
- Fixed clamping behaviour on `make_lipschitz_float_mul`
- Let the type of the sensitivity supplied to `make_base_discrete_gaussian` vary according to type `QI`
- Fix FFI dispatch in fixed approximate DP composition

0.5.0

Added
- Account for finite data types in aggregators based on our paper [CSVW22](https://arxiv.org/abs/2207.10635)
- For the [sum 467](https://github.com/opendp/opendp/pull/467), [variance #475](https://github.com/opendp/opendp/pull/475) and [mean #476](https://github.com/opendp/opendp/pull/476)
- Formalize privacy analysis of data ordering [465](https://github.com/opendp/opendp/pull/465) [#466](https://github.com/opendp/opendp/pull/466)
- Stability/privacy relations replaced with maps [463](https://github.com/opendp/opendp/pull/463)
- You can now call `.map` on transformations and measurements to directly get the tightest `d_out`
- Composition of measurements [482](https://github.com/opendp/opendp/pull/482)
- Permits arbitrary nestings of compositions of an arbitrary number of measurements
- Discrete noise mechanisms from [CKS20](https://arxiv.org/pdf/2004.00010.pdf)
- `make_base_discrete_laplace` is equivalent to `make_base_geometric`, but executes in a constant-time number of operations
- `make_base_discrete_gaussian` for the discrete gaussian mechanism
- Add zero-concentrated differential privacy to the gaussian and discrete gaussian mechanisms
- Output measure is now always `ZeroConcentratedDivergence<Q>`, and output distance is in terms of rho
- Add combinator to cast a measurement's output measure from `ZeroConcentratedDivergence<Q>` to `SmoothedMaxDivergence<Q>`
- `meas_smd = opendp.comb.make_zCDP_to_approxDP(meas_zcd)`
- The `SmoothedMaxDivergence<Q>` measure represents distances as an `ε(δ)` privacy curve:
- Can construct a curve by invoking the map: `curve = meas_smd.map(d_in)`
- Can evaluate a curve at a given delta `epsilon = curve.epsilon(delta)`
- Add `make_fix_delta` combinator to fix the delta parameter in a `SmoothedMaxDivergence<Q>` measure
- The resulting measure is `FixedSmoothedMaxDivergence<Q>`, where the output distance is an `(ε, δ)` pair
- `eps, delta = make_fix_delta(meas_smd, delta=1e-8).map(d_in)`
- The fixed measure supports composition (unlike the curve measure)
- Utility functions `set_default_float_type` and `set_default_int_type` to set the default bit depth of ints and floats
- Exponential search when bounds are not specified in binary search utilities [453](https://github.com/opendp/opendp/pull/453)
- Support for Apple silicon (`aarch64-apple-darwin` target)

Changed
- Switched to a single Rust crate (merged `opendp-ffi` into `opendp`)
- Updated documentation to reflect feedback from users and added more example notebooks
- Packaging for Contributor License Agreements
- Improved formatting of rust stack traces in Python
- Expanded error-indexes

Deprecated
- `make_base_geometric` in favor of the more efficient `make_base_discrete_laplace`
- Constant-time execution can still be accessed via `make_base_discrete_laplace_linear`

Removed
- `make_base_analytic_gaussian` in favor of the (now generally tighter) `make_base_gaussian`
- This would have been a deprecation, but updating to be consistent with forward maps is nontrivial

Fixed
- Rust documentation on docs.rs is built with "untrusted" flag enabled
- Python documentation for historical versions is rebuilt on correct tag
- Avoid potential infinite loop in binary search utility

Security
- Replace the underlying implementation of `make_base_laplace` and `make_base_gaussian` to [address precision-based attacks](https://tpdp.journalprivacyconfidentiality.org/2022/papers/HaneyDHSH22.pdf)
- Both measurements map input floats exactly to an integer discretization, apply discrete laplace or discrete gaussian noise, and then postprocess back to floats
- The discretization is on ℤ*2^k, where k can be configured, similar to the Google Differential Privacy Library
- In contrast to the Google library, the approximation to real sampling continues to improve as k is chosen to be smaller than -45. We choose a k of -1074, which matches the subnormal ULP, giving a tight privacy map
- Fixed function in `make_randomized_response_bool`
- from proofwriting by Vicki Xu and Hanwen Zhang [481](https://github.com/opendp/opendp/pull/481)
- Multiplicative difference in probabilities in linear-time discrete laplace sampler are now exact around zero
- eliminates an un-accounted δ < ulp(e^-(1/scale)) from differing conservative roundings
- Biased bernoulli sampler on float probabilities is now exact
- eliminates an un-accounted δ < 2^-500 in RR and linear-time discrete laplace sampler
- from proofwriting by Vicki Xu and Hanwen Zhang [496](https://github.com/opendp/opendp/pull/496)
- Added conservative rounding when converting between MFPR floats and native floats
- MFPR has a different exponent range, which could lead to unintended rounding of floats that are out of exponent range

Migration
- `make_base_gaussian`'s output measure is now ZeroConcentratedDivergence.
- This means the output distance is now a single scalar, rho (it used to be an (ε, δ) tuple)
- Use `adp_meas = opendp.comb.make_zCDP_to_approxDP(zcdp_meas)` to convert to an ε(δ) curve.
- Use `fadp_meas = opendp.comb.make_fix_delta(adp_meas)` to change output distance from an ε(δ) curve to an (ε, δ) tuple
- `fadp_meas.check(d_in, (ε, δ))` is equivalent to the check on `make_base_gaussian` in 0.4
- replace `make_base_analytic_gaussian` with `make_base_gaussian`
- replace `make_base_geometric` with `make_base_discrete_laplace`
- `make_basic_composition` accepts a list of measurements as its first argument (it used to have two arguments)
- slight increase in sensitivities/privacy utilization across the library as a byproduct of floating-point attack mitigations

0.4.0

Not secure
Added
- `make_randomized_response_bool` and `make_randomized_response` for local differential privacy.
- `make_base_analytic_gaussian` for a tighter, analytic calibration of the gaussian mechanism.
- `make_population_amplification` combinator for privacy amplification by subsampling.
- `make_drop_null` transformation for dropping null values in nullish data.
- `make_find`, `make_find_bin` and `make_index` transformations for categorical relabeling and binning.
- `make_base_alp` for histograms via approximate laplace projections from Christian Lebeda (https://github.com/ChristianLebeda)
- `make_base_ptr` for stability histograms via propose-test-release.
- Added floating-point numbers to the admissible output types on integer queries like `make_count`, `make_count_by`, `make_count_by_categories` and `make_count_distinct`.
- Simple attack notebook from Oren Renard (https://github.com/orespo)
- Support for Numpy data types.
- Release helper script

Fixed
- Resolved memory leaks in FFI

Changed
- moved windows patch directory into `/rust`
- added minimum rust version of 1.56 and updated to the 2021 edition.
- dropped sized-ness domain requirements from `make_count_by`

Security
- `make_base_stability` underestimated the sensitivity of queries. Removed in favor of `make_base_ptr`.
- Floating-point arithmetic throughout the library now has explicit rounding modes such that the budget is always slightly overestimated. There is still some potential for small floating-point leaks via rounding in floating-point aggregations.
- Fixed integer truncation issue in the sized bounded sum privacy relation.
- The resize relation is now looser to account for a worst-case situation where d_in records removed, and d_in new records are imputed.

Page 1 of 3

© 2024 Safety CLI Cybersecurity Inc. All Rights Reserved.