Smokescreen: A Python package for data vector blinding and encryption in cosmological analyses

1. Problem Statement

Modern cosmological analyses face a critical challenge: experimenter bias. Because there is only one observable Universe, cosmological signals are statistical patterns (e.g., correlation functions, power spectra) rather than localized events, making traditional "double-blind" or "single-blind" techniques difficult to implement. Without principled concealment strategies, analysts risk unconsciously tuning their pipelines to match expected results or results from other experiments, compromising scientific integrity.

Existing blinding strategies in the field suffer from specific limitations:

• Catalogue-level methods: Robust but difficult to implement for multi-probe experiments.
• Posterior-level methods: Simple but leave the raw data vectors unblinded during analysis.
• Covariance-level methods: Mathematically elegant but hard to apply due to the varied construction of covariance matrices.
• Ad-hoc implementations: Previous experiments (DES, KiDS, HSC) used custom, non-reusable solutions that lacked standardization.

There was a specific gap in the LSST Dark Energy Science Collaboration (DESC) ecosystem: no standardized tool existed to blind data vectors while ensuring the theoretical model used for blinding was identical to the one used for inference.

2. Methodology

Smokescreen addresses this by implementing data-vector blinding based on the framework defined by Muir et al. (2020). The core philosophy is to apply cosmology-dependent shifts to the observed data vector, moving it away from the true signal without altering its statistical properties (covariance).

Core Algorithm

The process involves five steps:

1. Shift Definition: The user defines a shift distribution (deterministic, uniform, or Gaussian) for specific cosmological parameters ($\theta_i$).
2. Blind Cosmology Construction: A concealed cosmology is generated: $\theta_{blind} = \theta_{ref} + \Delta\theta$.
3. Theory Vector Evaluation: Using the Firecrown likelihood framework, the theory vector $T(\theta, s)$ is computed for both the reference cosmology ($\theta_{ref}$) and the blind cosmology ($\theta_{blind}$), keeping nuisance parameters ($s_{ref}$) fixed.
   • $d_{ref} = T(\theta_{ref}, s_{ref})$
   • $d_{blind} = T(\theta_{blind}, s_{ref})$
4. Blinding Factor Calculation: A factor is computed in either additive or multiplicative form:
   • Additive: $f_{add} = d_{blind} - d_{ref}$
   • Multiplicative: $f_{mult} = d_{blind} / d_{ref}$
5. Application: The factor is applied to the observed data vector ($d_{obs}$) to produce the blinded vector ($\hat{d}$):
   • $\hat{d} = d_{obs} + f_{add}$ or $\hat{d} = d_{obs} \cdot f_{mult}$

Key Design Features

• Model Consistency: By using Firecrown (the same library used for inference) to compute the shifts, Smokescreen guarantees that the theoretical model used for blinding is identical to the inference model.
• Covariance Preservation: Since nuisance parameters are fixed during the shift calculation, the covariance matrix remains unchanged, allowing standard inference pipelines to run on blinded data without modification.
• Security: The original SACC file (containing true cosmology) is encrypted using Fernet (AES-128-CBC + HMAC-SHA256) immediately after the blinded file is generated. The encryption key is stored separately.
• Format Agnostic: It operates on the SACC (Standard Analysis Cosmology Container) format, making it applicable to any experiment using Firecrown and SACC, not just LSST.

3. Key Contributions

• Standardized Open-Source Library: Smokescreen is the first dedicated, open-source Python library for data vector blinding designed to integrate with collaboration-wide pipelines.
• Modular Architecture: The code is structured around a ConcealDataVector class with separated concerns for parameter perturbation, theory vector computation, encryption, and orchestration.
• Validation & Testing: The package includes a rigorous test suite (94% code coverage) that verifies physical correctness (e.g., exact adherence to blinding equations) rather than just array shapes.
• Encryption Integration: It provides built-in, secure encryption of the original data, preventing accidental unblinding.
• Flexibility: Supports deterministic, uniform, and Gaussian shift distributions, and allows for complex configurations via YAML or CLI.

4. Results

The authors demonstrated Smokescreen using a simulated LSST Year 1 (Y1) 3×2pt data vector (combining cosmic shear, galaxy-galaxy lensing, and galaxy clustering).

• Blinding Effectiveness: Two blinded realizations ("Blind A" and "Blind B") were created with deterministic shifts to the amplitude parameter ($A_s$) and dark energy equation of state ($w$).
• Cosmological Validation:
  • Posterior Shift: Inference on the blinded data vectors showed posterior distributions shifting towards the blinded cosmologies, successfully hiding the true values.
  • Goodness-of-Fit: The reduced chi-squared ($\chi^2_{red}$) remained effectively unchanged (0.0039 for true vs. ~0.007–0.008 for blinded), satisfying the requirement that blinding does not degrade the fit quality.
  • Bayesian Evidence: The log-evidence ($\log Z$) was statistically indistinguishable between the true and blinded cases ($|\Delta \log Z| \le 1$), confirming that the blinded analyses are statistically valid.
  • Degeneracy Handling: Parameters not explicitly shifted (e.g., $\Omega_{cdm}$) shifted slightly due to known parameter degeneracies ($A_s$–$\Omega_{cdm}$–$w$), demonstrating that the method preserves physical correlations (Criterion I).

5. Significance

• LSST DESC Readiness: Smokescreen provides the necessary infrastructure for the Vera C. Rubin Observatory's Legacy Survey of Space and Time (LSST), ensuring a collaboration-wide, consistent blinding strategy before the survey begins.
• Community Adoption: It is already being adopted by other collaborations, such as KiDS, for their 6×2pt legacy analysis, proving its utility beyond LSST.
• Scientific Integrity: By eliminating inconsistencies between blinding and inference models, Smokescreen reduces the risk of "tuning" biases, thereby enhancing the credibility and reproducibility of Stage-IV cosmological measurements.
• Transparency: The open-source nature allows the wider community to inspect and verify how blinding shifts are computed, fostering trust in cosmological results.

Availability:

• Source: github.com/LSSTDESC/Smokescreen
• License: BSD 3-Clause
• Installation: Available via conda (lsstdesc-smokescreen) and pip (smokescreen).