Bloom Filters in Adversarial Environments

Abstract

Many efficient data structures use randomness, allowing them to improve upon deterministic ones. Usually, their efficiency and correctness are analyzed using probabilistic tools under the assumption that the inputs and queries are independent of the internal randomness of the data structure. In this work, we consider data structures in a more robust model, which we call the adversarial model. Roughly speaking, this model allows an adversary to choose inputs and queries adaptively according to previous responses. Specifically, we consider a data structure known as "Bloom filter" and prove a tight connection between Bloom filters in this model and cryptography.A Bloom filter represents a set S of elements approximately, by using fewer bits than a precise representation. The price for succinctness is allowing some errors: for any x ∈ S it should always answer 'Yes', and for any x / ∈ S it should answer 'Yes' only with small probability. In the adversarial model, we consider both efficient adversaries (that run in polynomial time) and computationally unbounded adversaries that are only bounded in the number of queries they can make. For computationally bounded adversaries, we show that non-trivial (memory-wise) Bloom filters exist if and only if one-way functions exist. For unbounded adversaries we show that there exists a Bloom filter for sets of size n and error ε, that is secure against t queries and uses only O(n log 1 ε + t) bits of memory. In comparison, n log 1 ε is the best possible under a non-adaptive adversary.Theorem 4.8. Let B be an (n, ε)-Bloom filter using m bits of memory. If pseudorandom permutations exist, then there exists a negligible function neg(·) such that for security parameter λ there exists an (n, ε + neg(λ))-strongly resilient Bloom filter that uses m = m + λ bits of memory.Proof. The main idea is to randomize the adversary's queries by applying a pseudorandom permutation (see Definition A.6) on them; then we may consider the queries as random and not as chosen adaptively by the adversary.Let B be an (n, ε)-Bloom filter using m bits of memory. We will construct a (n, ε + neg(λ))strongly resilient Bloom filter B as follows: To initialize B on a set S we first choose a key K ∈ {0, 1} λ for a pseudo-random permutation, PRP, over {0, 1} log u . LetThen we initialize B with S . For the query algorithm, on input x we output B(PRP K (x)). Notice that the only additional memory we need is storing the key K of the PRP which takes λ bits. Moreover, the running time of the query algorithm of B is one pseudo-random permutation more than the query time of B.

Bloom Filters, Adaptivity, and the Dictionary Problem

“…While for some special sets S given in advance, an AMQ may be able to store S very accurately (with very few false positives), this is not true for most random sets S chosen from the universe by the adversary. We note the following claim from Naor and Yogev [27]. For the remainder of this section, we fix a set S * ⊆ U of size n such that |OFP(S * , ρ)| > uε 0 .…”

“…Ideal hash functions have this property for arbitrary adversaries. If the adversary is polynomially bounded, one-way functions are sufficient to prevent them from generating new false positives [27].…”

“…Adversarial-resilient Bloom filters. Naor and Yogev [27] study Bloom filters in the context of a repeatfree adaptive adversary, which queries elements until it can find a never-before-queried element that has a false-positive probability greater than ε. (They do not consider the false-positive probability of repeated queries.)…”

“…(They do not consider the false-positive probability of repeated queries.) They show how to protect an AMQ from a repeat-free adaptive adversaries using cryptographically secure hash functions so that new queries are indistinguishable from uniformly selected queries [27]. Hiding data-structure hash functions has been studied beyond AMQs (e.g., see [5,19,20,24,26]).…”

“…[27, Claim 5.3]). Given any randomness ρ of AMQ using space m ≤ n log 1/ε 0 + 4n bits, for any set S of size n chosen uniformly at random from U , we have: Pr S [|OFP(S, ρ)| ≤ uε 0 ] ≤ 2 −n .…”