Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

One Attack to Rule Them All: Tight Quadratic Bounds for Adaptive Queries on Cardinality Sketches

Edith Cohen, Jelani Nelson, Tamás Sarlós, Mihir Singhal, Uri Stemmer

TL;DR

Cardinality sketches enable compact, composable representations of sets, but adaptive queries undermine standard non-adaptive guarantees, prompting a need for robust understanding of adaptivity. The authors present a universal attack framework that identifies a small determining pool and uses a core peeling strategy to drive errors under adaptive interactions, yielding near-tight bounds. They prove that any composable sketch of rank $k$ can be compromised with $\tilde{O}(k^4)$ adaptive queries, while monotone maps enjoy a tighter $\tilde{O}(k^2)$ bound; they extend the same framework to linear sketches over $\mathbb{R}$ and $\mathbb{F}_p$, achieving $\tilde{O}(k^2)$ queries. The framework also recovers and strengthens prior results for statistical queries and MinHash/HyperLogLog sketches, and highlights fundamental vulnerabilities of sketch-based systems under adaptivity with implications for differential privacy and robustness in distributed/quasi-streaming settings.

Abstract

Cardinality sketches are compact data structures for representing sets or vectors. These sketches are space-efficient, typically requiring only logarithmic storage in the input size, and enable approximation of cardinality (or the number of nonzero entries). A crucial property in applications is \emph{composability}, meaning that the sketch of a union of sets can be computed from individual sketches. Existing designs provide strong statistical guarantees, ensuring that a randomly sampled sketching map remains robust for an exponential number of queries in terms of the sketch size $k$. However, these guarantees degrade to quadratic in $k$ when queries are \emph{adaptive}, meaning they depend on previous responses. Prior works on statistical queries (Steinke and Ullman, 2015) and specific MinHash cardinality sketches (Ahmadian and Cohen, 2024) established that this is tight in that they can be compromised using a quadratic number of adaptive queries. In this work, we develop a universal attack framework that applies to broad classes of cardinality sketches. We show that any union-composable sketching map can be compromised with $\tilde{O}(k^4)$ adaptive queries and this improves to a tight bound of $\tilde{O}(k^2)$ for monotone maps (including MinHash, statistical queries, and Boolean linear maps). Similarly, any linear sketching map over the reals $\mathbb{R}$ and finite fields $\mathbb{F}_p$ can be compromised using $\tilde{O}(k^2)$ adaptive queries, which is optimal and strengthens some of the recent results by~\citet{GribelyukLWYZ:FOCS2024}, who established a weaker polynomial bound.

One Attack to Rule Them All: Tight Quadratic Bounds for Adaptive Queries on Cardinality Sketches

TL;DR

Cardinality sketches enable compact, composable representations of sets, but adaptive queries undermine standard non-adaptive guarantees, prompting a need for robust understanding of adaptivity. The authors present a universal attack framework that identifies a small determining pool and uses a core peeling strategy to drive errors under adaptive interactions, yielding near-tight bounds. They prove that any composable sketch of rank can be compromised with adaptive queries, while monotone maps enjoy a tighter bound; they extend the same framework to linear sketches over and , achieving queries. The framework also recovers and strengthens prior results for statistical queries and MinHash/HyperLogLog sketches, and highlights fundamental vulnerabilities of sketch-based systems under adaptivity with implications for differential privacy and robustness in distributed/quasi-streaming settings.

Abstract

Cardinality sketches are compact data structures for representing sets or vectors. These sketches are space-efficient, typically requiring only logarithmic storage in the input size, and enable approximation of cardinality (or the number of nonzero entries). A crucial property in applications is \emph{composability}, meaning that the sketch of a union of sets can be computed from individual sketches. Existing designs provide strong statistical guarantees, ensuring that a randomly sampled sketching map remains robust for an exponential number of queries in terms of the sketch size . However, these guarantees degrade to quadratic in when queries are \emph{adaptive}, meaning they depend on previous responses. Prior works on statistical queries (Steinke and Ullman, 2015) and specific MinHash cardinality sketches (Ahmadian and Cohen, 2024) established that this is tight in that they can be compromised using a quadratic number of adaptive queries. In this work, we develop a universal attack framework that applies to broad classes of cardinality sketches. We show that any union-composable sketching map can be compromised with adaptive queries and this improves to a tight bound of for monotone maps (including MinHash, statistical queries, and Boolean linear maps). Similarly, any linear sketching map over the reals and finite fields can be compromised using adaptive queries, which is optimal and strengthens some of the recent results by~\citet{GribelyukLWYZ:FOCS2024}, who established a weaker polynomial bound.

Paper Structure

This paper contains 45 sections, 27 theorems, 106 equations, 1 figure.

Table of Contents

  1. Introduction
  2. Adaptive vs non-adaptive settings
  3. Positive results via wrapper methods
  4. Negative results by attack constructions
  5. Overview of contributions
  6. Attack Framework
  7. Application to Composable Sketches
  8. Application to Linear Sketches
  9. Ideas in our Attacks on Linear Sketches
  10. Statistical queries and MinHash Sketches
  11. Statistical Queries
  12. HyperLogLog (k-partition) sketch
  13. Bottom-k sketch
  14. Preliminaries
  15. Notation
  16. ...and 30 more sections

Key Result

Theorem 1.3

For any fixed $\eta<1/4$, if the sketching map $(S,\mathcal{U})$ has a determining pool $L\in 2^\mathcal{U}$ so that $|L| \ll n$,$|L|<c n$ for some universal constant $c<1$, then with probability $1-\delta$, our unified attack after $r=O(\log(1/\delta)|L|^2 \log n)$ queries forces at least $\eta r$

Figures (1)

  • Figure 1: Example plot of the density function $\nu(q)$

Theorems & Definitions (122)

  • Definition 1.2: Determining pool; simplified
  • Theorem 1.3: Informal; See Theorem \ref{['metacorrectness:thm']} and Lemma \ref{['limitedpoolnaturalQR:lemma']}
  • Remark 1.4: Implication for Differentially Private Data Analysis
  • Theorem 1.5: Informal, see Theorem \ref{['composablepool:theorem']}
  • Theorem 1.6: Informal, see Theorem \ref{['linearsketches:thm']}
  • Remark 1.7: Magnitude of values
  • Definition 3.1: Rate distribution
  • Definition 3.2: Query distribution
  • Remark 3.3: Choice of $q_\textnormal{min}, q_1, q_2, q_\textnormal{max}$ when $\varepsilon$ is small
  • Definition 3.4: Determining pool
  • ...and 112 more