Adversarial Robustness on Insertion-Deletion Streams

Abstract: We study adversarially robust algorithms for insertion-deletion (turnstile) streams, where future updates may depend on past algorithm outputs. While robust algorithms exist for insertion-only streams with only a polylogarithmic overhead in memory over non-robust algorithms, it was widely conjectured that turnstile streams of length polynomial in the universe size $n$ require space linear in $n$. We refute this conjecture, showing that robustness can be achieved using space which is significantly sublinear in $n$. Our framework combines multiple linear sketches in a novel estimator-corrector-learner framework, yielding the first insertion-deletion algorithms that approximate: (1) the second moment $F_2$ up to a $(1+\varepsilon)$-factor in polylogarithmic space, (2) any symmetric function $\cal{F}$ with an $\mathcal{O}(1)$-approximate triangle inequality up to a $2<sup>{\mathcal{O}(C)}$ factor in $\tilde{\mathcal{O}}(n^{1/C}) \cdot S(n)$ bits of space, where $S$ is the space required to approximate $\cal{F}$ non-robustly; this includes a broad class of functions such as the $L_1$-norm, the support size $F_0$, and non-normed losses such as the $M$-estimators, and (3) $L_2$ heavy hitters. For the $F_2$ moment, our algorithm is optimal up to $\textrm{poly}((\log n)/\varepsilon)$ factors. Given the recent results of Gribelyuk et al. (STOC, 2025), this shows an exponential separation between linear sketches and non-linear sketches for achieving adversarial robustness in turnstile streams.

• The paper disproves the conjectured Ω(n)-space barrier by achieving adversarially robust (1+ε)-approximation of F2 with poly(1/ε, log n) space for polynomial-length insertion-deletion streams.
• The estimator-corrector-learner framework combines recursively organized sketches with fresh randomness, limiting adaptive interactions and achieving approximately Õ(ε⁻⁴ log⁸ n) space for robust F2 estimation.
• The framework also supports robust L2 heavy hitters and broad approximate-triangle-inequality functions, while leaving open tighter logarithmic bounds, p>2 moments, and implementation efficiency.

This paper refutes a long-standing conjecture that adversarially robust constant-factor approximation of frequency moments on insertion-deletion (turnstile) streams requires $\Omega(n)$ space. The authors construct the first adversarially robust turnstile algorithms that achieve sublinear-in-$n$ space for $F_2$ moment estimation, $L_2$ heavy hitters, and a broad class of symmetric functions satisfying an approximate triangle inequality. The key conceptual contribution is a non-linear algorithmic framework—termed the estimator-corrector-learner framework—that composes many linear sketches, each of which is only required to withstand a small number of adaptive queries, thereby circumventing known lower bounds against linear sketches.

Background and motivation

In the adversarially robust streaming model of Ben-Eliezer, Jayaram, Woodruff, and Yogev, updates to an implicit frequency vector $\bx \in \mathbb{R}^n$ may be chosen adaptively based on the full transcript of prior updates and algorithm outputs; the algorithm must produce accurate estimates at every one of $m = \poly(n)$ time steps. For insertion-only streams, robustness is now achievable for many problems with only polylogarithmic overhead over non-robust algorithms. For turnstile streams, however, the situation was far less understood: differential-privacy-based approaches yield space sublinear in the stream length $m$, but become linear in $n$ when $m = \poly(n)$.

The negative results are sharp for linear sketches: Hardt and Woodruff, followed by Gribelyuk et al. (FOCS 2024, STOC 2025), showed adaptive attacks demonstrating that any linear sketch achieving constant-factor approximation to $F_p$ moments on adversarial insertion-deletion streams requires sketching dimension $n$0. Since all previously known large-length turnstile algorithms are linear sketches, and since optimal non-adaptive turnstile algorithms were characterized by linear sketching, it was conjectured that any robust constant-factor $n$1 algorithm needs $n$2 space. This paper shows the conjecture is false.

The main result for F2 estimation

Theorem 1.1: For any $n$3, there exists an adversarially robust insertion-deletion streaming algorithm that outputs $n$4-approximations to the $n$5 moment at all times using $n$6 bits of space for $n$7.

Because Braverman and Zamir's lower bound implies even non-adaptive $n$8 estimation requires $n$9 space, this bound is optimal up to $F_2$0 factors. Combined with the linear-sketch lower bounds of Gribelyuk et al., the result establishes an exponential separation between linear and non-linear sketches for adversarial robustness on turnstile streams—a strong claim that directly contradicts the intuition that optimal turnstile algorithms "might as well be linear sketches," which holds in the oblivious setting but breaks under adaptivity.

The estimator-corrector-learner framework

The core difficulty is that linear sketches draw their randomness once at initialization and behave deterministically thereafter; an adaptive adversary can extract the random bits over $F_2$1 queries and then construct a breaking input. The paper's remedy is to inject fresh randomness during execution by initializing new independent sketches mid-stream.

The simplified setting assumes a prefix vector $F_2$2 is already sketched by a matrix $F_2$3, while a suffix $F_2$4 arrives online and can additionally be sketched by a fresh matrix $F_2$5. Three components operate jointly:

• Estimator: outputs $F_2$6 as an estimate of $F_2$7, where $F_2$8 is the learner's current approximation of $F_2$9. When $L_2$0 is uncorrelated with $L_2$1 relative to $L_2$2, near-orthogonality makes this accurate.
• Corrector: uses the sketch $L_2$3 to detect incorrect estimates, returning its own estimate whenever the estimator fails.
• Learner: maintains $L_2$4 as a linear combination of queries on which the estimate was incorrect, updating via $L_2$5.

The analysis hinges on a progress argument: an incorrect estimate forces $L_2$6, so choosing the step size $L_2$7 yields $L_2$8. Since $L_2$9, the iterate converges within $\bx \in \mathbb{R}^n$0 updates—hence the corrector interacts with the adversary only $\bx \in \mathbb{R}^n$1 times per block.

Robustness then follows from the bounded computation paths technique: a deterministic adversary can generate at most $\bx \in \mathbb{R}^n$2 distinct output patterns, so setting the failure probability to roughly $\bx \in \mathbb{R}^n$3 and applying a union bound protects every sketch. Space scales linearly in $\bx \in \mathbb{R}^n$4 (where $\bx \in \mathbb{R}^n$5 is the block count), giving a direct quantitative trade-off between how often the estimator errs and total memory.

Recursion via a tree structure

To handle the fact that lower-level sketches themselves face many adaptive queries, the algorithm recurses: estimating $\bx \in \mathbb{R}^n$6 given a rounded sketch of $\bx \in \mathbb{R}^n$7 is structurally identical to the original problem but on a shorter stream. Concretely, the stream is partitioned into a $\bx \in \mathbb{R}^n$8-ary tree of height $\bx \in \mathbb{R}^n$9 with $m = \poly(n)$0. Setting $m = \poly(n)$1 and $m = \poly(n)$2 ensures each sketch handles at most $m = \poly(n)$3 adaptive interactions, and only one active sketch per level is maintained at any time. The total space works out to $m = \poly(n)$4 bits, dominated by $m = \poly(n)$5 levels each holding $m = \poly(n)$6 sketches of dimension $m = \poly(n)$7. Correctness is established through a level-wise invariant showing each output lies within a $m = \poly(n)$8-factor band around $m = \poly(n)$9, with errors telescoping across at most $m$0 levels.

L2 heavy hitters

Building on the robust $m$1 estimator, the paper gives the first adversarially robust turnstile algorithm for $m$2 heavy hitters in $m$3 space. Given an approximate norm bound $m$4, the algorithm deterministically probes each coordinate by injecting mass $m$5 and recomputing the norm in both directions. A clean analytic separation shows that heavy coordinates ($m$6) increase the squared norm by at least $m$7-scale amounts, whereas non-heavy coordinates increase it by at most $m$8-scale amounts—a constant gap distinguishable by a $m$9-approximation. Since $n$0 heavy hitters for $n$1 are contained in the $n$2 set, this yields robust $n$3 heavy hitters for all $n$4, essentially matching the best classical (non-adaptive) bounds up to polynomial factors in $n$5.

Generalization to approximate triangle inequality functions

The framework extends to symmetric functions $n$6 satisfying a $n$7-approximate triangle inequality, provided a non-adaptive turnstile sketch using $n$8 bits achieving $n$9-approximation exists for some constant $m = \poly(n)$0. The resulting robust algorithm uses $m = \poly(n)$1 bits and outputs a $m = \poly(n)$2-approximation for any constant $m = \poly(n)$3.

The progress mechanism changes: the estimator $m = \poly(n)$4 is always an overestimate by triangle inequality, and if it exceeds $m = \poly(n)$5, then $m = \poly(n)$6, so resetting the iterate to $m = \poly(n)$7 reduces $m = \poly(n)$8 by a constant factor. Combined with the assumption that $m = \poly(n)$9 takes values in $F_p$0, this bounds the number of updates per level to $F_p$1.

A notable application class arises from Bernstein functions $F_p$2: for $F_p$3 with $F_p$4, concavity and subadditivity give $F_p$5, i.e., $F_p$6. The paper further verifies that such $F_p$7 satisfies the slow-jumping, slow-dropping, and predictable conditions of the Braverman–Chestnut–Woodruff–Yang zero-one law, guaranteeing non-robust sketches exist. This covers the $F_p$8 norm, support size $F_p$9, $n$00 norms for $n$01, and robust-statistical losses including pseudo-Huber, Cauchy/Lorentzian, generalized Charbonnier, Welsch/Leclerc, and Geman–McClure losses. Notably, these include non-normed objectives outside the reach of standard moment machinery.

Limitations and open questions

Several caveats qualify the results. First, the general triangle-inequality theorem degrades the approximation ratio from the non-robust $n$02 to $n$03, and requires $n$04 values to lie in a polynomial range—an assumption that excludes functions with extreme dynamic ranges. Second, the $n$05 result achieves optimality only up to $n$06 factors; tightening these exponents (e.g., removing the $n$07 overhead from the tree structure) remains open. Third, for $n$08 no sublinear-space robust algorithm is known, and whether the exponential separation between linear and non-linear sketches extends beyond constant-factor approximations or to other function classes is unresolved. Finally, the paper does not address update time or the practicality of maintaining the full tree structure, leaving implementation cost as an open consideration.

Conclusion

This paper disproves the conjectured $n$09 barrier for adversarially robust turnstile streaming by introducing a non-linear composition of linear sketches in which each component faces only a bounded number of adaptive interactions. The framework delivers near-optimal polylogarithmic-space robust $n$10 estimation, matching robust $n$11 heavy hitters, and a generic reduction for approximate-triangle-inequality functions down to $n$12 space. Its principal conceptual lesson is that the equivalence between turnstile streaming and linear sketching, valid in the oblivious setting, does not survive adaptivity: robustness demands fresh randomness injected throughout execution rather than fixed upfront.