Janady13/missionmatch / internal/modules/ai/suppression_test.go

1package ai 2 3import ( 4 "testing" 5 6 "github.com/shopspring/decimal" 7) 8 9func TestSuppressBelowThresholdHidesSmallCells(t *testing.T) { 10 // Total is 40, above k, so the answer is allowed. The cell under 10 is hidden by primary 11 // suppression, and because it is the only naturally sub k cell, complementary suppression also hides 12 // the smallest published cell so the residual cannot be back solved. The largest cell stays published. 13 cells := []Cell{ 14 {Key: []string{"secret"}, Count: 22}, 15 {Key: []string{"top_secret"}, Count: 12}, 16 {Key: []string{"ts_sci"}, Count: 6}, 17 } 18 out := Suppress(cells, 10) 19 if out[0].Suppressed { 20 t.Fatal("the largest published cell must not be suppressed") 21 } 22 if !out[2].Suppressed { 23 t.Fatal("a cell of 6 (below k=10) must be suppressed") 24 } 25 if !out[1].Suppressed { 26 t.Fatal("the smallest published cell must be hidden by complementary suppression") 27 } 28} 29 30func TestSuppressComplementaryHidesASecondCell(t *testing.T) { 31 // Exactly one cell is naturally below k. If only it were hidden, it could be recovered as 32 // total minus the published cells. So a second (the smallest published) cell must also hide. 33 cells := []Cell{ 34 {Key: []string{"secret"}, Count: 30}, 35 {Key: []string{"top_secret"}, Count: 14}, 36 {Key: []string{"ts_sci"}, Count: 6}, 37 } 38 out := Suppress(cells, 10) 39 suppressed := 0 40 for _, c := range out { 41 if c.Suppressed { 42 suppressed++ 43 } 44 } 45 if suppressed < 2 { 46 t.Fatalf("complementary suppression must hide at least 2 cells, got %d", suppressed) 47 } 48 // The smallest published cell (top_secret, 14) is the one chosen to also hide, not the larger. 49 if out[1].Key[0] != "top_secret" || !out[1].Suppressed { 50 t.Fatal("the smallest published cell must be the complementary suppression") 51 } 52} 53 54func TestSuppressRefusesWhenTotalBelowThreshold(t *testing.T) { 55 // If the whole matched set is below k, even its existence is sub threshold: hide everything. 56 cells := []Cell{ 57 {Key: []string{"secret"}, Count: 4}, 58 {Key: []string{"ts_sci"}, Count: 3}, 59 } 60 out := Suppress(cells, 10) 61 for _, c := range out { 62 if !c.Suppressed { 63 t.Fatal("when the total is below k every cell must be suppressed") 64 } 65 } 66} 67 68func TestSuppressNoSmallCellsLeavesAllPublished(t *testing.T) { 69 cells := []Cell{ 70 {Key: []string{"secret"}, Count: 22}, 71 {Key: []string{"top_secret"}, Count: 18}, 72 } 73 out := Suppress(cells, 10) 74 for _, c := range out { 75 if c.Suppressed { 76 t.Fatal("no cell below k means nothing is suppressed") 77 } 78 } 79} 80 81func TestSuppressIsDeterministic(t *testing.T) { 82 cells := []Cell{ 83 {Key: []string{"a"}, Count: 6}, 84 {Key: []string{"b"}, Count: 6}, 85 {Key: []string{"c"}, Count: 28}, 86 } 87 a := Suppress(append([]Cell(nil), cells...), 10) 88 b := Suppress(append([]Cell(nil), cells...), 10) 89 for i := range a { 90 if a[i].Suppressed != b[i].Suppressed { 91 t.Fatal("suppression must be deterministic across runs") 92 } 93 } 94} 95 96func TestSuppressDifferencingTwoQueriesCannotIsolateOne(t *testing.T) { 97 // The classic differencing attack: a broad query and a narrow query that differ by one person. With 98 // suppression, the narrow query's small residual cell is hidden, so subtraction cannot isolate the 99 // individual. This proves the per answer floor blocks the naive single subtraction (the cross query 100 // budget that blocks the iterated attack is the deferred cross tenant control, documented). 101 broad := []Cell{{Key: []string{"secret"}, Count: 11}} 102 narrow := []Cell{{Key: []string{"secret"}, Count: 1}} // the broad set minus ten others, one person 103 bo := Suppress(broad, 10) 104 no := Suppress(narrow, 10) 105 if bo[0].Suppressed { 106 t.Fatal("a published cell of 11 should remain") 107 } 108 if !no[0].Suppressed { 109 t.Fatal("a residual cell of 1 must be suppressed so subtraction cannot isolate the person") 110 } 111} 112 113func TestSuppressNeverPublishesBelowK(t *testing.T) { 114 // Property: after Suppress, no published cell has a count below k. Exhaustive over small grids. 115 k := 10 116 for total := 0; total <= 60; total++ { 117 for a := 0; a <= total; a++ { 118 cells := []Cell{{Key: []string{"a"}, Count: a}, {Key: []string{"b"}, Count: total - a}} 119 out := Suppress(cells, k) 120 for _, c := range out { 121 if !c.Suppressed && c.Count < k { 122 t.Fatalf("published a cell of %d below k=%d (total=%d)", c.Count, k, total) 123 } 124 } 125 } 126 } 127} 128 129func TestSuppressAtLeastTwoOrZeroHidden(t *testing.T) { 130 // Property: among MULTIPLE buckets the hidden count is never exactly one (complementary suppression 131 // invariant). The single bucket refuse case is covered separately in TestSuppressWidthOneAndZero. 132 k := 10 133 for total := 0; total <= 60; total++ { 134 for a := 0; a <= total; a++ { 135 cells := []Cell{{Key: []string{"a"}, Count: a}, {Key: []string{"b"}, Count: total - a}} 136 out := Suppress(cells, k) 137 hidden := 0 138 for _, c := range out { 139 if c.Suppressed { 140 hidden++ 141 } 142 } 143 if hidden == 1 { 144 t.Fatalf("exactly one cell hidden (recoverable) at total=%d a=%d", total, a) 145 } 146 } 147 } 148} 149 150func TestSuppressWidthOneAndZero(t *testing.T) { 151 // Width 0: an empty partition is a no op and never panics. 152 if out := Suppress([]Cell{}, 10); len(out) != 0 { 153 t.Fatal("empty input must return empty") 154 } 155 // Width 1, below k: the single bucket is refused. One hidden cell is acceptable here because there is 156 // no sibling and no grand total to subtract against. 157 one := Suppress([]Cell{{Key: []string{"only"}, Count: 7}}, 10) 158 if !one[0].Suppressed { 159 t.Fatal("a lone sub k bucket must be suppressed") 160 } 161 // Width 1, at or above k: published. 162 ok := Suppress([]Cell{{Key: []string{"only"}, Count: 10}}, 10) 163 if ok[0].Suppressed { 164 t.Fatal("a lone bucket at k must be published") 165 } 166} 167 168func TestSuppressZeroesValueOnSuppressedCell(t *testing.T) { 169 // A suppressed cell must not retain its decimal aggregate, and RenderValue must return the sentinel, 170 // so a small cell median or average can never leak through the Value dimension. 171 cells := []Cell{ 172 {Key: []string{"secret"}, Count: 30, Value: decimal.RequireFromString("88.5"), HasValue: true}, 173 {Key: []string{"ts_sci"}, Count: 6, Value: decimal.RequireFromString("91.4"), HasValue: true}, 174 } 175 out := Suppress(cells, 10) 176 // ts_sci is suppressed (count 6), and complementary suppression also hides secret. Both must have 177 // their Value cleared and RenderValue must show the sentinel. 178 for _, c := range out { 179 if !c.Suppressed { 180 t.Fatalf("expected both cells suppressed, %v was published", c.Key) 181 } 182 if !c.Value.IsZero() || c.HasValue { 183 t.Fatalf("suppressed cell %v still carries a value", c.Key) 184 } 185 if RenderValue(c) != SuppressionSentinel { 186 t.Fatalf("RenderValue leaked a suppressed aggregate for %v", c.Key) 187 } 188 } 189} 190 191func TestSuppressClearsStaleFlagsOnReuse(t *testing.T) { 192 // Reusing a slice must not keep an old suppression decision. First call suppresses, then the same 193 // backing slice is refilled with all published counts and must come back fully published. 194 cells := []Cell{{Key: []string{"a"}, Count: 3}, {Key: []string{"b"}, Count: 4}} 195 Suppress(cells, 10) // total 7 < k, both suppressed 196 cells[0].Count = 25 197 cells[1].Count = 25 198 out := Suppress(cells, 10) 199 for _, c := range out { 200 if c.Suppressed { 201 t.Fatalf("stale suppression flag survived reuse for %v", c.Key) 202 } 203 } 204} 205