A library for working with differential privacy.
This library implements the framework described in the paper, A Programming Framework for OpenDP. OpenDP (the library) is part of the larger OpenDP Project.
Overview
OpenDP provides three main concepts:
- A flexible architecture for modeling privacy-preserving computations.
- Implementations of several common algorithms for statistical analysis and data manipulation, which can be used out-of-the-box to assemble DP applications.
- Facilities for extending OpenDP with new algorithms, privacy models, etc.
In addition, there's a companion crate, opendp-ffi, which provides FFI wrappers for opendp functionality. This can be used to implement bindings in languages other than Rust.
User Guide
A more thorough User Guide can be found on the docs website.
OpenDP applications are created by using constructors and combinators to create private computation pipelines. These can be written directly in Rust, or by using a language binding that uses OpenDP through an FFI interface. Python is the first language binding available, but we plan to add others in the future.
Rust Application Example
Here's a simple example of using OpenDP from Rust to create a private sum:
use Fallible;
use ;
use ;
use make_base_laplace;
example.unwrap;
Contributor Guide
Contributions to OpenDP typically take the form of what we call "constructors."
A constructor is a function that returns a Measurement
or Transformation
.
Before you submit your PR, please review the Contribution Process.
Adding Constructors
Measurement constructors go in the module [meas
], and Transformation constructors
in the module [trans
].
There are two code steps to adding a constructor function: Writing the function itself, and adding the FFI wrapper.
Writing Constructors
Constructors are functions that take configuration parameters and return an appropriately configured Measurement
or Transformation
.
They typically follow a common pattern:
- Choose the appropriate input and output
Domain
. - Write a closure that implements the
Function
. - Choose the appropriate input and output
Metric
/Measure
. - Write a closure that implements the
PrivacyRelation
/StabilityRelation
.
Example Transformation Constructor
# use ;
# use AbsoluteDistance;
# use AllDomain;
make_i32_identity;
Input and Output Types
The Function
created in a constructor is allowed to have any type for its input and output Domain::Carrier
.
There's no need for special data carrying wrappers. The glue code in the FFI layer handles this transparently.
However, the most common are the Rust primitives (e.g., i32
, f64
, etc.), and collections of the primitives
(Vec<i32>
, HashMap<String, f64>
).
Handling Generics
Measurement
/Transformation
constructors are allowed to be generic! Typically, this means that the type parameter on the
constructor will determine type of the input or output Domain::Carrier
(or the generic type within, for instance the i32
of Vec<i32>
).