analysis/accuracy_pitfalls.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Accuracy: Pitfalls and Edge Cases\n",
    "\n",
    "This notebook describes SmartNoise's accuracy calculations, and ways in which an analyst might be tripped up by them.\n",
    "\n",
    "### Overview \n",
    "\n",
    "#### Accuracy vs. Confidence Intervals\n",
    "\n",
    "Each privatizing mechanism (e.g. Laplace, Gaussian) in SmartNoise has an associated accuracy that is a function of the requested privacy usage, sensitivity of the function whose values is being privatized, etc. Imagine you have data $D$ and you want, for some function $\\phi$ to return $\\phi(D)$ in a differentially private way -- we will call this value $\\phi_{dp}(D)$. An $\\alpha$-level accuracy guarantee $a$ promises that, over infinite runs of the privatizing mechanism on the data in question, \n",
    "$$ \\phi(D) \\in [\\phi_{dp}(D) - a, \\phi_{dp}(D) + a] $$\n",
    "with probability $1 - \\alpha$.\n",
    "\n",
    "This looks very much like the traditional confidence interval, but it is important to note a major difference. In a canonical confidence interval, the uncertainty being represented is due to sampling error -- that is, how often will it be the case that $\\phi(P)$ (the value of $\\phi$ on the underlying population) is within some range of the realized $\\phi(D)$. \n",
    "\n",
    "In SmartNoise (and differentially private data analysis generally), there is an extra layer of uncertainty due to the noise added to $\\phi(D)$ to produce $\\phi_{dp}(D)$. SmartNoise's accuracy metrics deal only with the uncertainty of $\\phi_{dp}(D)$ relative to $\\phi(D)$ and not the uncertainty of $\\phi(D)$ relative to $\\phi(P)$.\n",
    "\n",
    "#### What is $D$?\n",
    "\n",
    "SmartNoise allows for analysis of data with an unknown number of rows by resizing the data to ensure consistency with an estimated size (see the [unknown dataset size notebook](https://github.com/opendifferentialprivacy/smartnoise-samples/blob/master/analysis/unknown_dataset_size.ipynb) for more details). Accuracy guarantees are always relative to the resized data $\\tilde{D}$, not the data of unknown size.\n",
    "\n",
    "#### Synopsis\n",
    "\n",
    "Let's say an analyst releases $\\phi_{dp}(D)$ and gets an accuracy guarantee of $a$ at accuracy-level $\\alpha$. $D$ as a dataset of unknown size drawn from population $P$ and will be resized to $\\tilde{D}$. This suggests that over infinite runs of this procedure,\n",
    "\n",
    "- $\\phi_{dp}(D) \\in [\\phi(\\tilde{D}) - a, \\phi(\\tilde{D}) + a]$ with probability $1 - \\alpha$\n",
    "- It is likely that $\\phi_{dp}(D) \\in [\\phi(D) - a, \\phi(D) + a]$ with probability $\\approx 1 - \\alpha$, though we cannot make any guarantee. For many cases (e.g. resizing the data based on $n$ obtained from a differentially private count and reasonable bounds on the data elements), this is likely to be approximately true. In the next section, we will explore some examples of cases where this statement holds to varying extents.\n",
    "\n",
    "- We cannot directly make statements about the relationship uncertainty of $\\phi_{dp}(D)$ relative to $\\phi(P)$.\n",
    "\n",
    "### Accuracy Guarantees In Practice\n",
    "\n",
    "We now move to some empirical evaluations of how well our accuracy guarantees translate from $\\phi(\\tilde{D})$ to $\\phi(D)$. We first consider the case where we actually know the size of the underlying data and are able to set plausible lower/upper bounds on `age`.\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "metadata": {
    "pycharm": {
     "is_executing": true
    },
    "scrolled": false
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Accuracy interval (with accuracy value 0.2996) contains the true mean on D_tilde with probability 0.936\n",
      "Accuracy interval (with accuracy value 0.2996) contains the true mean on D with probability 0.936\n"
     ]
    }
   ],
   "source": [
    "# load libraries\n",
    "import os\n",
    "import sys\n",
    "import numpy as np\n",
    "import pandas as pd\n",
    "import opendp.smartnoise.core as sn\n",
    "\n",
    "# establish data information\n",
    "data_path = os.path.join('.', 'data', 'PUMS_california_demographics_1000', 'data.csv')\n",
    "var_names = [\"age\", \"sex\", \"educ\", \"race\", \"income\", \"married\", \"pid\"]\n",
    "D = pd.read_csv(data_path)['age']\n",
    "D_mean_age = np.mean(D)\n",
    "\n",
    "# establish extra information for this simulation\n",
    "age_lower_bound = 0.\n",
    "age_upper_bound = 100.\n",
    "D_tilde = np.clip(D, age_lower_bound, age_upper_bound)\n",
    "D_tilde_mean_age = np.mean(D_tilde)\n",
    "data_size = 1000\n",
    "\n",
    "n_sims = 1_000\n",
    "releases = []\n",
    "with sn.Analysis(dynamic = True) as analysis:\n",
    "    data = sn.Dataset(path = data_path, column_names = var_names)\n",
    "    D = sn.to_float(data['age'])\n",
    "    # preprocess data (resize is a no-op because we have the correct data size)\n",
    "    D_tilde = sn.resize(sn.clamp(data = D, lower=0., upper=100.), number_rows = data_size)\n",
    "    \n",
    "    for index in range(n_sims):\n",
    "       # get DP mean of age\n",
    "        releases.append(sn.dp_mean(\n",
    "            data = sn.impute(D_tilde),\n",
    "            privacy_usage = {'epsilon': 1}))\n",
    "\n",
    "accuracy = releases[0].get_accuracy(0.05)\n",
    "\n",
    "analysis.release()\n",
    "dp_values = [release.value for release in releases]\n",
    "print('Accuracy interval (with accuracy value {0}) contains the true mean on D_tilde with probability {1}'.format(\n",
    "    round(accuracy, 4), \n",
    "    np.mean([(D_tilde_mean_age >= val - accuracy) & (D_tilde_mean_age <= val + accuracy) for val in dp_values])))\n",
    "\n",
    "print('Accuracy interval (with accuracy value {0}) contains the true mean on D with probability {1}'.format(\n",
    "    round(accuracy, 4), \n",
    "    np.mean([(D_mean_age >= val - accuracy) & (D_mean_age <= val + accuracy) for val in dp_values])))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "This performance is as expected. $D$ and $\\tilde{D}$ are actually the exact same data (the maximum age in the raw data is 93, so our clamp to $[0, 100]$ does not change any values, and we know the correct $n$), so our theoretical guarantees on $\\tilde{D}$ map exactly to gaurantees on $D$.\n",
    "\n",
    "We now move to a scenario that is still realistic, but where the performance does not translate quite as well. In this case, we imagine that the analyst believes the data to be of size 1050 and uses the default imputation within resize so that the extra 50 elements are drawn uniformly from $\\{ 0, 1, ..., 100 \\}$.\n",
    "\n",
    "Note that our diagnostic testing of $\\tilde{D}$ in the code above is not trivial in this case. In the first example, we knew that clamp/resize did not change the underlying data, so we could predict exactly the data on which the DP mean would actually be calculated. This will not be true for the following examples, so we will simulate finding the true underlying mean by releasing an extra DP mean with very high epsilon.  "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {
    "pycharm": {
     "is_executing": true
    },
    "scrolled": true
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Accuracy interval (with accuracy value 0.2853) contains the true mean on D_tilde with probability 0.955\n",
      "Accuracy interval (with accuracy value 0.2853) contains the true mean on D with probability 0.564\n"
     ]
    }
   ],
   "source": [
    "# establish extra information for this simulation\n",
    "age_lower_bound = 0.\n",
    "age_upper_bound = 100.\n",
    "data_size = 1050\n",
    "\n",
    "n_sims = 1_000\n",
    "true_D_tilde_mean_ages = []\n",
    "dp_D_tilde_mean_ages = []\n",
    "\n",
    "# all nodes are retained in the final analysis\n",
    "with sn.Analysis(filter_level='all') as analysis:\n",
    "    \n",
    "    data = sn.Dataset(path = data_path, column_names = var_names)\n",
    "    \n",
    "    # this is a no-op, but provides static guarantees\n",
    "    D = sn.clamp(sn.to_float(data['age']), age_lower_bound, age_upper_bound)\n",
    "    \n",
    "    for index in range(n_sims):\n",
    "        D_tilde = sn.impute(sn.resize(D, number_rows=data_size))\n",
    "        \n",
    "        # get true mean of age on D_tilde\n",
    "        true_D_tilde_mean_ages.append(sn.mean(data = D_tilde))\n",
    "\n",
    "        # get DP mean of age\n",
    "        dp_D_tilde_mean_ages.append(sn.dp_mean(\n",
    "            data = D_tilde,\n",
    "            privacy_usage = {'epsilon': 1}))\n",
    "\n",
    "accuracy = dp_D_tilde_mean_ages[0].get_accuracy(0.05)\n",
    "\n",
    "analysis.release()\n",
    "\n",
    "true_values = [true.value for true in true_D_tilde_mean_ages]\n",
    "dp_values = [dp.value for dp in dp_D_tilde_mean_ages]\n",
    "\n",
    "print('Accuracy interval (with accuracy value {0}) contains the true mean on D_tilde with probability {1}'.format(\n",
    "    round(accuracy, 4), \n",
    "    np.mean([(true_val >= dp_val - accuracy) & (true_val <= dp_val + accuracy) for true_val,dp_val in zip(true_values, dp_values)])))\n",
    "\n",
    "print('Accuracy interval (with accuracy value {0}) contains the true mean on D with probability {1}'.format(\n",
    "    round(accuracy, 4), \n",
    "    np.mean([(D_mean_age >= dp_val - accuracy) & (D_mean_age <= dp_val + accuracy) for dp_val in dp_values])))"
   ]
  },
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "The accuracy guarantee still holds on $\\tilde{D}$ (as it should), but we now see much worse performance relative to the true underlying data $D$."
   ]
  }
 ],
 "metadata": {
  "file_extension": ".py",
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.6.11"
  },
  "mimetype": "text/x-python",
  "name": "python",
  "npconvert_exporter": "python",
  "pygments_lexer": "ipython3",
  "version": 3
 },
 "nbformat": 4,
 "nbformat_minor": 2
}