Smokescreen blinding: per-catalogue custody, blind drawn once, parts sealed at birth

[cailmdaley]

This PR blinds the data vector with the UNIONS Smokescreen fork. For a blinded catalogue, ξ± and pseudo-Cℓ_EE are shifted in memory by t(hidden) − t(fiducial), a secret cosmology's theory minus the fiducial's, before they are first written, so true values never reach disk. It guards against accidents, not adversaries.

Goals: blinding declared once per catalogue and enforced everywhere; signal born shifted, and everything derived from it blinded; the inference's theory route; any new statistic blindable without a PR; a reveal that is a reviewed change. Non-goals: adversarial security, seed encryption, maps and peak counts.

Design

• Custody: a catalogue's blinding status: none, mock, or a blind's name.
• Blind: a named secret seed, from which the fork draws the hidden cosmology uniformly within S8 ±0.075, Ωm ±0.1 of the fiducial.
• Commitment: a public hash of the blind's record, naming it without revealing it.
• Stamp: the custody token (none, mock or <name>:<commitment>) in a SACC's metadata. A part is one measurement's SACC file.

cat_config: blind: y3 ─ launch ─► rule params carry "y3:<commitment>"
measure ─► sacc_io.save(custody=): shift, stamp ─► part
COSEBIs, pure-E/B, {version}.sacc ◄─ save(derived_from=parts): inherit the one stamp
sacc_io.load refuses unstamped files

Key decisions

• Custody is one field per catalogue. Every cosmo_val/cat_config.yaml entry must declare blind: (_leak_corr/_seed<N> inherit it), so a new catalogue can't run until someone decides. At launch and in CosmologyValidation, entries reading one shear file must declare one blind (the repo config wins over a personal copy), and a blinded catalogue is shown only beside mocks or its own blind, since any other overlay displays the shift.
• A blind is one file outside git, <paths.blinds>/<name>.blind.json: seed, envelope, fiducial, draw scheme. The seed is unencrypted; registry access is blind access. A registry inside a git worktree is refused unless it is a private repo's root.
• Calculate, then save. A measurement function computes its signal, saves (or seals) it under the catalogue's custody in the same function, and returns the sealed part, so raw signal never leaves it; calculate_2pcf is the pattern. sacc_io.save is the only SACC writer: a birth is shifted if blinded, then stamped; a derivation inherits its inputs' one stamp and cannot add shiftable rows. Rule params carry the token, so a flip reruns exactly what it touches.
• One table of standard estimators. blinding.STANDARD declares each estimator cosmo_val computes, once, with its rule: ξ± and Cℓ_EE shifted by the default theory; Cℓ_BB/EB unshifted; COSEBIs and pure-E/B derived from ξ±, so they inherit its shift; ρ/τ signal-free. The default theory is pyccl on cs_util.cosmo.get_cosmo's CAMB HMCode2020-feedback route, as in inference; remaining differences (Planck18 centre, N_eff, kmax, IA off) are second order in a shift.
• Anything else is shifted by a theory you pass: sacc_io.save(s, path, custody=c, theory={data_type: f}), with f(params, s, rows) -> values and params a plain mapping, so an emulator works (it may also replace a standard type's default). Under a blind, a type neither standard nor given a function is refused: a new statistic fails closed and needs no registry edit.

Rejected: custody in two places, e.g. a list of what each blind covers (copies drift); an encrypted seed (unattended jobs need the key beside it); a bespoke blinding cosmology (a third fiducial).

Using it

spv-container exec python -m sp_validation.blinding init y3   # prints name and commitment only

Set blind: y3 on the entry (and every entry reading its file) in a reviewed PR, then launch. A new statistic, ΔΣ say, is a function that calculates, then saves:

def delta_sigma_theory(params, s, rows):              # CCL, an emulator, ...
    return my_delta_sigma(theory.cosmology(params), theory.tag(s, rows, "rp"))

def measure_delta_sigma(cv, ver, out):
    rp, ds = my_estimator(cv, ver)                    # raw signal, local to this function
    s = sacc_io.new_sacc(cv.sacc_nz(ver), cv.sacc_metadata(ver))
    for r, v in zip(rp, ds):
        s.add_data_point(DELTA_SIGMA, ("source_0", "source_0"), v, rp=r)
    return sacc_io.save(s, out, custody=cv.custody(ver),
                        theory={DELTA_SIGMA: delta_sigma_theory})   # shifted here

Reveal = flip + rerun: copy the blinded outputs aside, set blind: none in a reviewed PR, and rerun; nothing to decrypt or subtract.

What else changes for users

• sacc_io.save takes custody= or derived_from=, not type=. load(allow_unblinded=) and the workflow's cosmo_val.type are gone.
• calculate_2pcf returns the sealed ξ± part, which sacc_io.xi_correlation reads like a GGCorrelation; the ξ± .txt dumps are gone.
• ⟨M_ap²⟩ is computed from the part (TreeCorr's calculateMapSq to 1e-12) and kept in cv.map2, not written.
• Interactive jackknife pure-E/B propagates the part's covariance through the kernel rather than jackknifing the modes (variance ratio to TreeCorr's on SP_v1.4.6.3: median 0.97–1.14 for E/B, 1.48 ambiguous).
• scripts/xip_xim.py refuses a blinded shear file.

Open questions for the collaboration

1. Where does the blind live? A candide path (default /n17data/UNIONS/WL/blinds, not yet created) or a private repo such as UNIONS-WL/blinds.
2. Who may draw and hold a blind?
3. v1.6.x: every entry is none for now. Has v1.6.x already been seen unblinded? If so, blinding it protects little.
4. Reveal criteria (PRD: SACC data format + Smokescreen blinding #241 §7).
5. Envelope and fiducial: keep S8 ±0.075, Ωm ±0.1? Planck18 or the inference centre as fiducial?
6. Maps and peak counts: can't be shifted. Do they wait for the reveal?
7. Nuisance parameters: Smokescreen shifts S8 and Ωm but not nuisance parameters (e.g. galaxy bias once γt returns). We believe this is second order; worth checking.

Testing

• Container suite (with slow): 341 passed, 2 xfailed (GLASS maps, unrelated; noisy pure-E/B, below).
• Host workflow tests: 14 passed, 1 skipped (SLURM smoke): paper DAG dry runs, launches that must fail closed, a flip rerunning exactly its ξ parts, an apptainer toy run under a fresh blind.
• Custom types: with a theory function, shifted and assemblable; without, refused.
• B-modes under a blind (synthetic ξ± with SP_v1.4.6.3 shape noise, each envelope corner): COSEBIs B_n move by the transform's response to the shift, ≤ 0.034σ; pure-E/B ξ_B ≤ 0.005σ noise-free. On noisy input ξ_B moves 0.1–1.2σ in isolated bins (strict xfail): pure-E/B is not additive on noisy ξ±, blinded or not; root cause open.

Follow-ups

• Smokescreen: move SACC row planning into the fork, so conceal becomes a thin call.
• cs_util#80: get_cosmo drops falsy values (mnu=0 becomes 0.06).
• Inference outputs carry the custody token once it moves to SACC.

Issues

Closes #252.

Part of #280: the default theory's settings were matched by reading cosmosis_pipeline_A_*.ini; the numerical CosmoSIS comparison is not done.

Issue texts to update: #252 (no encryption, escrow or unblind; one theory per data type); #241 §4 (draw in S8/Ωm; mock custody replaces type/concealed); #241 §5 (the commitment hashes the whole record; reveal is a rerun); #241 §6 (cross-check in #280).

— Claude (Opus) on behalf of Cail.

🤖 Generated with Claude Code