Smokescreen: Blinding in Cosmology

• Smokescreen is an open-source Python library for cosmological data-vector blinding that leverages Firecrown likelihoods to apply controlled shifts while preserving covariance.
• The package encrypts original SACC files using a robust Fernet scheme to prevent accidental unblinding, ensuring secure handling of sensitive cosmological data.
• Its design integrates transparently into existing inference workflows by reusing the final likelihood model to generate consistent, cosmology-dependent shifts without altering error propagation.

Searching arXiv for the Smokescreen package and related cosmological blinding work. Search query: title/abstract contains "Smokescreen" cosmology blinding Firecrown SACC. Search query: Muir et al. cosmological blinding robust blinding strategy. Smokescreen is an open-source Python library for data-vector concealment, or blinding, in cosmological analyses. It implements a data-vector blinding strategy in which cosmology-dependent shifts are applied to the observed data vector so that analysts cannot infer the true cosmological result until the analysis is frozen and the blinding is lifted, while the statistical properties of the analysis are preserved (Loureiro et al., 20 Apr 2026). The package computes these shifts using Firecrown likelihoods applied to data vectors stored in the SACC format, and it encrypts the original SACC file to prevent accidental unblinding. Although developed for the Vera C. Rubin Observatory Legacy Survey of Space and Time (LSST), it is applicable to any experiment using Firecrown likelihoods and the SACC data format (Loureiro et al., 20 Apr 2026).

1. Scientific motivation and design criteria

Cosmological analyses confront a structural limitation absent from true double-blind experiments: cosmologists observe exactly one Universe. In consequence, analysts can unconsciously tune pipelines to match external expectations, producing confirmation bias. Smokescreen addresses this problem by operationalizing data-vector blinding in a form intended to preserve routine inference and validation workflows (Loureiro et al., 20 Apr 2026).

The package is organized around three criteria for a robust blinding strategy. First, the true cosmology must be hidden while preserving physically reasonable posteriors and degeneracies. Second, standard validation tests, including goodness-of-fit and null tests, must remain available. Third, the procedure must be simple to apply and unblind, yet prevent accidental unblinding. Smokescreen adopts data-vector blinding because it satisfies these criteria by shifting the mean of the data vector without altering the covariance (Loureiro et al., 20 Apr 2026).

Its design goals are correspondingly specific. It computes shifts using exactly the same theoretical model as the final inference via Firecrown; it remains agnostic to the observable, including power spectra, correlation functions, and multi-probe analyses; and it encrypts the original SACC file to avoid accidental leaks. Within a standard cosmological inference workflow, it inserts itself between “measure data→run likelihood” and “unblind→publish final results” (Loureiro et al., 20 Apr 2026).

2. Mathematical formulation of data-vector blinding

Smokescreen follows a five-step algorithm. The procedure begins by drawing parameter shifts

$$\delta\theta_i \sim p_i(\delta\theta)\qquad (i=1,\dots,N_{\rm cosmo}),$$

where each $p_i$ is uniform, Gaussian, or deterministic. A blinded cosmology is then defined as

$\theta_{\rm blind}=\theta_{\rm ref}+\delta\theta,$

with $\theta_{\rm ref}$ a user-supplied reference (Loureiro et al., 20 Apr 2026).

The package next computes theory data vectors with Firecrown,

$$\mathbf d_{\rm ref}=T(\theta_{\rm ref},\phi_{\rm ref}),\qquad \mathbf d_{\rm blind}=T(\theta_{\rm blind},\phi_{\rm ref}),$$

where $T$ is exactly the same Firecrown likelihood evaluation used in the final inference, and $\phi_{\rm ref}$ are fixed nuisance parameters. This identity between the blinding model and the inference model is a central property of the package (Loureiro et al., 20 Apr 2026).

From these theory vectors, Smokescreen constructs either an additive or a multiplicative blinding factor: $$\mathbf f_{\rm add}=\mathbf d_{\rm blind}-\mathbf d_{\rm ref}, \qquad \mathbf f_{\rm mult}=\frac{\mathbf d_{\rm blind}}{\mathbf d_{\rm ref}}.$$ The blinded data vector is then obtained as

$\mathbf d_{\rm blinded}= \begin{cases} \mathbf d_{\rm obs}+\mathbf f_{\rm add},\[4pt] \mathbf d_{\rm obs}\odot \mathbf f_{\rm mult}, \end{cases}$

where $\odot$ denotes elementwise multiplication (Loureiro et al., 20 Apr 2026).

Because the covariance $p_i$0 is unchanged, a Gaussian likelihood,

$p_i$1

satisfies

$p_i$2

This implies that all errors and goodness-of-fit tests carry over verbatim. A common misconception is that blinding necessarily compromises validation; in Smokescreen’s formulation, the covariance is unchanged, so standard validation machinery remains usable (Loureiro et al., 20 Apr 2026).

3. Software architecture and workflow integration

Smokescreen is implemented as four thin layers, reflecting an explicit separation of concerns.

Layer	Role	Representative interface
param_shifts.py	Draw $p_i$3	shift sampling
datavector.py	Load SACC, call Firecrown, build $p_i$4, apply it	ConcealDataVector
encryption.py	Encrypt/decrypt SACC via Fernet	encrypt_file, decrypt_file
__main__.py	CLI and YAML orchestration	command-line entry point

The principal high-level class is ConcealDataVector in datavector.py. At low level, the package loads an existing SACC file, samples shifts through param_shifts.sample_shifts, constructs a Firecrown likelihood via a build_likelihood factory, computes $p_i$5 and $p_i$6, forms the blinding factor, applies it to the observed vector, and writes a blinded SACC file (Loureiro et al., 20 Apr 2026).

This organization makes the package observable-agnostic in a precise sense: the only substantive requirements are SACC-formatted data vectors and a Firecrown-compatible likelihood factory build_likelihood. The same architecture therefore supports single-probe or multi-probe workflows without changing the blinding formalism (Loureiro et al., 20 Apr 2026).

A single CLI, smokescreen datavector, a YAML configuration, or a Python API call integrates blinding and encryption into a standard Rubin/LSST or Cobaya/CosmoSIS pipeline. This suggests that Smokescreen is intended less as a stand-alone statistical method than as a workflow component inserted into existing inference stacks.

4. Encryption and controlled unblinding

To prevent accidental unblinding, Smokescreen encrypts the original SACC file. It uses the Python cryptography library’s Fernet scheme, specified in the paper as AES-128-CBC plus HMAC-SHA256 (Loureiro et al., 20 Apr 2026).

On every blinding run, the package generates a fresh symmetric key, encrypts the original SACC file to produce data.sacc.encrpt, deletes the plaintext SACC by default, and writes the key to data.sacc.key. The corresponding algorithmic primitives are

$p_i$7

$p_i$8

and

$p_i$9

The unblinding workflow is similarly explicit: the analysis is frozen with only the blinded SACC in the repository, the blinding committee holds the .key, and the true SACC is recovered by running smokescreen decrypt --encrypted data.sacc.encrpt --key data.sacc.key after sign-off (Loureiro et al., 20 Apr 2026).

This protocol addresses another recurrent concern in cosmological blinding practice: accidental leakage through file persistence or inconsistent repository state. Smokescreen’s response is not only statistical concealment but also operational control over the true data product.

5. Applications, portability, and demonstrated use

The package was developed for LSST, but its stated scope is broader. Any experiment using Firecrown likelihoods and the SACC data format can use Smokescreen. The paper identifies multi-probe SACC data, including KIDS 6×2 pt and HSC, as immediately portable use cases, as well as arbitrary cosmological observables so long as Firecrown can model them (Loureiro et al., 20 Apr 2026).

A concrete example is the LSST/DESC Y1 3×2 pt demonstration. In that setting, Smokescreen produced two deterministic “Blind A/B” data vectors by shifting $\theta_{\rm blind}=\theta_{\rm ref}+\delta\theta,$0 by $\theta_{\rm blind}=\theta_{\rm ref}+\delta\theta,$1 and $\theta_{\rm blind}=\theta_{\rm ref}+\delta\theta,$2. Posterior runs with the same Firecrown likelihood recovered unbiased goodness-of-fit and shifted best-fit points. The example is significant because it illustrates the package’s central design principle: the blinding transform is generated by the same likelihood machinery later used for inference, rather than by an external surrogate model (Loureiro et al., 20 Apr 2026).

The package is therefore model-consistent in a narrowly defined but practically important sense. It does not introduce a separate forward model for blinding; instead, it reuses the inference model itself. A plausible implication is that this reduces the risk that blinding artifacts arise from theory-code mismatch rather than from the intended concealment of cosmological parameters.

6. Methodological significance and limitations of scope

Smokescreen occupies a specific position within cosmological analysis methodology. It is a library for concealing the data vector, not a general-purpose framework for modifying likelihoods, covariances, or posterior summaries. Its preservation of covariance is deliberate: the blinded analysis is intended to retain standard error propagation, goodness-of-fit tests, and null tests unchanged (Loureiro et al., 20 Apr 2026).

Its abstraction boundary is likewise clear. The package assumes a SACC-encoded data vector and a Firecrown-compatible likelihood factory. Consequently, its portability is substantial within that software ecosystem and correspondingly limited outside it. This is not a weakness relative to its stated goals; rather, it is the mechanism by which the package guarantees that the theory model used for blinding is identical to that used for inference (Loureiro et al., 20 Apr 2026).

In practice, Smokescreen formalizes a reproducible blinding protocol in which blinding, encryption, and unblinding are all explicit computational steps. For collaborations concerned with confirmation bias but unwilling to sacrifice routine validation, this combination of cosmology-dependent data-vector shifts, invariant covariance, and encrypted source data defines its distinctive contribution to contemporary cosmological analysis pipelines.