opendp 0.14.2-dev.20260401.2

A library of differential privacy algorithms for the statistical analysis of sensitive private data.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64

use std::os::raw::c_uint;

use opendp_derive::bootstrap;

use crate::combinators::AmplifiableMeasure;
use crate::core::FfiResult;
use crate::error::Fallible;
use crate::ffi::any::{AnyMeasure, AnyMeasurement, AnyObject, Downcast};
use crate::measures::{Approximate, MaxDivergence};

impl AmplifiableMeasure for AnyMeasure {
    fn amplify(
        &self,
        budget: &AnyObject,
        population_size: usize,
        sample_size: usize,
    ) -> Fallible<AnyObject> {
        fn monomorphize<M: 'static + AmplifiableMeasure>(
            measure: &AnyMeasure,
            budget: &AnyObject,
            population_size: usize,
            sample_size: usize,
        ) -> Fallible<AnyObject> {
            let measure = measure.downcast_ref::<M>()?;
            let budget = budget.downcast_ref::<M::Distance>()?;
            measure
                .amplify(budget, population_size, sample_size)
                .map(AnyObject::new)
        }
        dispatch!(
            monomorphize,
            [(self.type_, [MaxDivergence, Approximate<MaxDivergence>])],
            (self, budget, population_size, sample_size)
        )
    }
}

#[bootstrap(features("contrib", "honest-but-curious"))]
/// Construct an amplified measurement from a `measurement` with privacy amplification by subsampling.
/// This measurement does not perform any sampling.
/// It is useful when you have a dataset on-hand that is a simple random sample from a larger population.
///
/// The DIA, DO, MI and MO between the input measurement and amplified output measurement all match.
///
/// # Arguments
/// * `measurement` - the computation to amplify
/// * `population_size` - the size of the population from which the input dataset is a simple sample
///
/// # Why honest-but-curious?
/// The privacy guarantees are only valid if the input dataset is a simple sample from a population with `population_size` records.
fn make_population_amplification(
    measurement: &AnyMeasurement,
    population_size: usize,
) -> Fallible<AnyMeasurement> {
    super::make_population_amplification(measurement, population_size)
}

#[unsafe(no_mangle)]
pub extern "C" fn opendp_combinators__make_population_amplification(
    measurement: *const AnyMeasurement,
    population_size: c_uint,
) -> FfiResult<*mut AnyMeasurement> {
    make_population_amplification(try_as_ref!(measurement), population_size as usize).into()
}