A Framework for Adversarially Robust Streaming Algorithms

Abstract

We investigate the adversarial robustness of streaming algorithms. In this context, an algorithm is considered robust if its performance guarantees hold even if the stream is chosen adaptively by an adversary that observes the outputs of the algorithm along the stream and can react in an online manner. While deterministic streaming algorithms are inherently robust, many central problems in the streaming literature do not admit sublinear-space deterministic algorithms; on the other hand, classical space-efficient randomized algorithms for these problems are generally not adversarially robust. This raises the natural question of whether there exist efficient adversarially robust (randomized) streaming algorithms for these problems. In this work, we show that the answer is positive for various important streaming problems in the insertion-only model, including distinct elements and more generally F p -estimation, F p -heavy hitters, entropy estimation, and others. For all of these problems, we develop adversarially robust (1+ε)-approximation algorithms whose required space matches that of the best known non-robust algorithms up to a poly(log n , 1/ε) multiplicative factor (and in some cases even up to a constant factor). Towards this end, we develop several generic tools allowing one to efficiently transform a non-robust streaming algorithm into a robust one in various scenarios.

Compact Frequency Estimators in Adversarial Environments

“…In [16], the authors consider adding robustness to streaming algorithms using differential privacy. Meanwhile, Hardt and Woodruff [15], Cohen et al [9] and Ben-Eliezer et al [4] have shown that linear sketches (including CMS but not HK) are not "robust" to well-resourced adaptive attacks, when it comes to various 𝐿 𝑝 -norm estimation tasks, e.g., solving the 𝑘-heavy-hitters problem relative to the 𝐿 2 -norm. These works are mostly of theoretical importance, whereas we aim to give concrete attacks and results that are (more) approachable for practitioners.…”

“…𝑥 can be potentially inserted 𝑞 𝑈 − 𝑞 ′ 𝑈 times, accumulating some additional error4 . Say C is the attack's maximal round candidate cover.…”

“…We could have 𝑧 𝑖 simultaneously covering more not yet covered counters. Then, adding 𝑧 𝑖 𝑡 times fixes one counter to 𝑡 , and the others to 𝑡 with at probability at least 0.9 -the other counters might have been owned by some others elements but are definitely of value one, so each of them gets "taken" by 𝑧 𝑖 in the first insertion with probability 0.9 4. We say potentially as the Qry-query budget might be a limiting factor.…”