---
title: 'Smokescreen: Blinding in Cosmology'
url: https://www.emergentmind.com/topics/smokescreen
type: topic
---

# Smokescreen: Blinding in Cosmology

Searching arXiv for the Smokescreen package and related cosmological blinding work.
Search query: title/abstract contains "Smokescreen" cosmology blinding Firecrown SACC.
Search query: Muir et al. cosmological blinding robust blinding strategy.
Smokescreen is an open-source Python library for data-vector concealment, or blinding, in cosmological analyses. It implements a data-vector blinding strategy in which cosmology-dependent shifts are applied to the observed data vector so that analysts cannot infer the true cosmological result until the analysis is frozen and the blinding is lifted, while the statistical properties of the analysis are preserved [2604.18111]. The package computes these shifts using Firecrown likelihoods applied to data vectors stored in the SACC format, and it encrypts the original SACC file to prevent accidental unblinding. Although developed for the Vera C. Rubin Observatory Legacy Survey of Space and Time (LSST), it is applicable to any experiment using Firecrown likelihoods and the SACC data format [2604.18111].

## 1. Scientific motivation and design criteria

Cosmological analyses confront a structural limitation absent from true double-blind experiments: cosmologists observe exactly one Universe. In consequence, analysts can unconsciously tune pipelines to match external expectations, producing confirmation bias. Smokescreen addresses this problem by operationalizing data-vector blinding in a form intended to preserve routine inference and validation workflows [2604.18111].

The package is organized around three criteria for a robust blinding strategy. First, the true cosmology must be hidden while preserving physically reasonable posteriors and degeneracies. Second, standard validation tests, including goodness-of-fit and null tests, must remain available. Third, the procedure must be simple to apply and unblind, yet prevent accidental unblinding. Smokescreen adopts data-vector blinding because it satisfies these criteria by shifting the mean of the data vector without altering the covariance [2604.18111].

Its design goals are correspondingly specific. It computes shifts using exactly the same theoretical model as the final inference via Firecrown; it remains agnostic to the observable, including power spectra, correlation functions, and multi-probe analyses; and it encrypts the original SACC file to avoid accidental leaks. Within a standard cosmological inference workflow, it inserts itself between “measure data→run likelihood” and “unblind→publish final results” [2604.18111].

## 2. Mathematical formulation of data-vector blinding

Smokescreen follows a five-step algorithm. The procedure begins by drawing parameter shifts
\[
\delta\theta_i \sim p_i(\delta\theta)\qquad (i=1,\dots,N_{\rm cosmo}),
\]
where each \(p_i\) is uniform, Gaussian, or deterministic. A blinded cosmology is then defined as
\[
\theta_{\rm blind}=\theta_{\rm ref}+\delta\theta,
\]
with \(\theta_{\rm ref}\) a user-supplied reference [2604.18111].

The package next computes theory data vectors with Firecrown,
\[
\mathbf d_{\rm ref}=T(\theta_{\rm ref},\phi_{\rm ref}),\qquad
\mathbf d_{\rm blind}=T(\theta_{\rm blind},\phi_{\rm ref}),
\]
where \(T\) is exactly the same Firecrown likelihood evaluation used in the final inference, and \(\phi_{\rm ref}\) are fixed nuisance parameters. This identity between the blinding model and the inference model is a central property of the package [2604.18111].

From these theory vectors, Smokescreen constructs either an additive or a multiplicative blinding factor:
\[
\mathbf f_{\rm add}=\mathbf d_{\rm blind}-\mathbf d_{\rm ref},
\qquad
\mathbf f_{\rm mult}=\frac{\mathbf d_{\rm blind}}{\mathbf d_{\rm ref}}.
\]
The blinded data vector is then obtained as
\[
\mathbf d_{\rm blinded}=
\begin{cases}
\mathbf d_{\rm obs}+\mathbf f_{\rm add},\\[4pt]
\mathbf d_{\rm obs}\odot \mathbf f_{\rm mult},
\end{cases}
\]
where \(\odot\) denotes elementwise multiplication [2604.18111].

Because the covariance \(C\) is unchanged, a Gaussian likelihood,
\[
\mathcal L(\mathbf d|\theta)\propto
\exp\Big[-\tfrac12(\mathbf d-T(\theta))^T C^{-1}(\mathbf d-T(\theta))\Big],
\]
satisfies
\[
\mathcal L(\mathbf d_{\rm blinded}\mid\theta)
=
\mathcal L(\mathbf d_{\rm obs}\mid\theta-\delta\theta).
\]
This implies that all errors and goodness-of-fit tests carry over verbatim. A common misconception is that blinding necessarily compromises validation; in Smokescreen’s formulation, the covariance is unchanged, so standard validation machinery remains usable [2604.18111].

## 3. Software architecture and workflow integration

Smokescreen is implemented as four thin layers, reflecting an explicit separation of concerns.

| Layer | Role | Representative interface |
|---|---|---|
| `param_shifts.py` | Draw \(\delta\theta_i\) | shift sampling |
| `datavector.py` | Load SACC, call Firecrown, build \(\mathbf f\), apply it | `ConcealDataVector` |
| `encryption.py` | Encrypt/decrypt SACC via Fernet | `encrypt_file`, `decrypt_file` |
| `__main__.py` | CLI and YAML orchestration | command-line entry point |

The principal high-level class is `ConcealDataVector` in `datavector.py`. At low level, the package loads an existing SACC file, samples shifts through `param_shifts.sample_shifts`, constructs a Firecrown likelihood via a `build_likelihood` factory, computes \(\mathbf d_{\rm ref}\) and \(\mathbf d_{\rm blind}\), forms the blinding factor, applies it to the observed vector, and writes a blinded SACC file [2604.18111].

This organization makes the package observable-agnostic in a precise sense: the only substantive requirements are SACC-formatted data vectors and a Firecrown-compatible likelihood factory `build_likelihood`. The same architecture therefore supports single-probe or multi-probe workflows without changing the blinding formalism [2604.18111].

A single CLI, `smokescreen datavector`, a YAML configuration, or a Python API call integrates blinding and encryption into a standard Rubin/LSST or Cobaya/CosmoSIS pipeline. This suggests that Smokescreen is intended less as a stand-alone statistical method than as a workflow component inserted into existing inference stacks.

## 4. Encryption and controlled unblinding

To prevent accidental unblinding, Smokescreen encrypts the original SACC file. It uses the Python `cryptography` library’s Fernet scheme, specified in the paper as AES-128-CBC plus HMAC-SHA256 [2604.18111].

On every blinding run, the package generates a fresh symmetric key, encrypts the original SACC file to produce `data.sacc.encrpt`, deletes the plaintext SACC by default, and writes the key to `data.sacc.key`. The corresponding algorithmic primitives are
\[
\texttt{key}=\mathrm{Fernet.generate\_key()},
\]
\[
\texttt{token}=\mathrm{Fernet(key).encrypt}(\mathrm{plaintext\_bytes}),
\]
and
\[
\mathrm{plaintext\_bytes}=\mathrm{Fernet(key).decrypt}(\texttt{token}).
\]
The unblinding workflow is similarly explicit: the analysis is frozen with only the blinded SACC in the repository, the blinding committee holds the `.key`, and the true SACC is recovered by running `smokescreen decrypt --encrypted data.sacc.encrpt --key data.sacc.key` after sign-off [2604.18111].

This protocol addresses another recurrent concern in cosmological blinding practice: accidental leakage through file persistence or inconsistent repository state. Smokescreen’s response is not only statistical concealment but also operational control over the true data product.

## 5. Applications, portability, and demonstrated use

The package was developed for LSST, but its stated scope is broader. Any experiment using Firecrown likelihoods and the SACC data format can use Smokescreen. The paper identifies multi-probe SACC data, including KIDS 6×2 pt and HSC, as immediately portable use cases, as well as arbitrary cosmological observables so long as Firecrown can model them [2604.18111].

A concrete example is the LSST/DESC Y1 3×2 pt demonstration. In that setting, Smokescreen produced two deterministic “Blind A/B” data vectors by shifting \((A_s,w)\) by \(\pm 5.2\%\) and \(\pm 10\%\). Posterior runs with the same Firecrown likelihood recovered unbiased goodness-of-fit and shifted best-fit points. The example is significant because it illustrates the package’s central design principle: the blinding transform is generated by the same likelihood machinery later used for inference, rather than by an external surrogate model [2604.18111].

The package is therefore model-consistent in a narrowly defined but practically important sense. It does not introduce a separate forward model for blinding; instead, it reuses the inference model itself. A plausible implication is that this reduces the risk that blinding artifacts arise from theory-code mismatch rather than from the intended concealment of cosmological parameters.

## 6. Methodological significance and limitations of scope

Smokescreen occupies a specific position within cosmological analysis methodology. It is a library for concealing the data vector, not a general-purpose framework for modifying likelihoods, covariances, or posterior summaries. Its preservation of covariance is deliberate: the blinded analysis is intended to retain standard error propagation, goodness-of-fit tests, and null tests unchanged [2604.18111].

Its abstraction boundary is likewise clear. The package assumes a SACC-encoded data vector and a Firecrown-compatible likelihood factory. Consequently, its portability is substantial within that software ecosystem and correspondingly limited outside it. This is not a weakness relative to its stated goals; rather, it is the mechanism by which the package guarantees that the theory model used for blinding is identical to that used for inference [2604.18111].

In practice, Smokescreen formalizes a reproducible blinding protocol in which blinding, encryption, and unblinding are all explicit computational steps. For collaborations concerned with confirmation bias but unwilling to sacrifice routine validation, this combination of cosmology-dependent data-vector shifts, invariant covariance, and encrypted source data defines its distinctive contribution to contemporary cosmological analysis pipelines.

Source: https://www.emergentmind.com/topics/smokescreen