Adaptively Robust Sketches

• Adaptively robust sketches are streaming algorithms designed for resettable models that use polylog-space and differential privacy to resist adaptive adversaries.
• They replace traditional linear sketches with dedicated Bernoulli sampling and the Binary Tree Mechanism to ensure strong prefix-max accuracy under dynamic updates and resets.
• They enable robust and efficient approximation of various statistics such as cardinality, sum, and Bernstein statistics, supporting advanced data monitoring and unlearning applications.

Adaptively robust sketches are streaming algorithms designed for the resettable streaming model, providing polylogarithmic-space, adversary-resilient data summaries for dynamic systems with both increment and reset capabilities. These sketches address fundamental vulnerabilities of standard linear and composable sketching techniques under adaptive adversaries and enable robust approximation of a wide class of statistical queries, including (sub)linear moments and Bernstein statistics, while offering strong prefix-max accuracy guarantees and efficient memory usage (Cohen et al., 29 Jan 2026).

1. Resettable Streaming Model: Formalism and Scope

The resettable streaming model is characterized by a universe of keys $x \in \mathcal U$, each associated with a nonnegative value $v_x \ge 0$, and an update stream with two operations: $\mathrm{Inc}(x, \Delta)$, incrementing $v_x$ by $\Delta \ge 0$, and $\mathrm{Reset}(x)$, setting $v_x$ to zero. While the reset operation can be generalized to predicates over the key set, single-key resets are sufficient to establish information-theoretic lower and upper bounds.

At time $t$, the vector $(v_x^{(t)})_{x}$ naturally defines a broad family of streaming statistics:

$F_t = \sum_x f(v_x^{(t)})$

where $v_x \ge 0$0 can represent the indicator for nonzero entries (cardinality, $v_x \ge 0$1), the identity (sum, $v_x \ge 0$2), or any sublinear, soft-concave “Bernstein” function.

This model is especially relevant for applications requiring fine-grained reset or deletion support, such as resource monitoring with deletions and machine unlearning.

2. Vulnerabilities of Classical Sketches under Adaptive Attacks

Classical streaming sketches, including sampling-based and linear sketches, provide low-variance, unbiased estimates for $v_x \ge 0$3 in the non-adaptive (oblivious) setting but are vulnerable to adaptive adversaries. In the adaptive scenario, the adversary can issue updates based on intermediate estimates, exploiting the deterministic or information-leaking properties of the sketch’s internal randomness.

Key attacks include:

• Re-insertion Attack (for Insertion-Only and Bernoulli Sampling): The adversary inserts a key and, if the sample size increases, immediately re-inserts it, reducing the effective probability of being retained—yielding a $v_x \ge 0$4-fold underestimation of cardinality.
• Sample-and-Delete Attack (with Resets): For each new key, the adversary inserts it, checks the sample, and resets if it is present. The adversary empties the sample even as the underlying set $v_x \ge 0$5 grows, leading to unbounded relative error.
• Lower Bounds for Linear and Composable Sketches: All known union-composable or linear sketches for these statistics are subject to $v_x \ge 0$6-query universal attacks for sketches of size $v_x \ge 0$7, and thus require $v_x \ge 0$8-size to resist adaptive streams of length $v_x \ge 0$9.

These vulnerabilities render oblivious or linear sketches fundamentally unsuitable for robust streaming in the resettable model.

3. Adaptively Robust Sketching Framework: Differential Privacy and Binary Tree Mechanism

The adaptation to adversarial streaming hinges on two core design choices: abandoning composability and linearity in favor of dedicated sampling sketches, and shielding their internal randomness with differential privacy (DP). The key privacy tool is the Binary Tree Mechanism (BTM) for continual observation.

Fixed-Rate Robust Cardinality Sketch

• Sampling paradigm: Maintain a Bernoulli sample $\mathrm{Inc}(x, \Delta)$0 where each active key in $\mathrm{Inc}(x, \Delta)$1 enters $\mathrm{Inc}(x, \Delta)$2 with independent probability $\mathrm{Inc}(x, \Delta)$3.
• Increment Logging: Instead of directly releasing $\mathrm{Inc}(x, \Delta)$4, release the increments $\mathrm{Inc}(x, \Delta)$5.
• Noisy Aggregation: Feed the increments into the BTM, releasing

$\mathrm{Inc}(x, \Delta)$6

with sensitivity $\mathrm{Inc}(x, \Delta)$7 and DP parameter $\mathrm{Inc}(x, \Delta)$8.

• Estimate:

$\mathrm{Inc}(x, \Delta)$9

Intuitive protection arises from the Laplace noise, ensuring that even with adaptive access to $v_x$0, an adversary cannot infer more than a small multiplicative factor regarding any key’s sampled status.

Error Analysis and Robustness via DP-Generalization

Standard BTM analyses yield, uniformly for all $v_x$1, with probability $v_x$2:

$v_x$3

DP-generalization theorems ensure, even under adaptive querying, the difference between $v_x$4 and $v_x$5 remains tightly bounded (up to additive $v_x$6 for all $v_x$7).

By judicious parameter selection:

• $v_x$8
• $v_x$9

yields for all $\Delta \ge 0$0:

$\Delta \ge 0$1

where $\Delta \ge 0$2.

Adjustable-Rate Prefix-Max Accuracy

A fixed-$\Delta \ge 0$3 scheme requires foreknowledge of $\Delta \ge 0$4. To circumvent this and guarantee

$\Delta \ge 0$5

at each $\Delta \ge 0$6, the sketch adaptively halves $\Delta \ge 0$7 so sample size never exceeds a fixed budget $\Delta \ge 0$8. Subsampling and corresponding BTM updates ensure continued DP guarantees and error bounds, while maintaining $\Delta \ge 0$9 total space.

4. Robustness for Sum and Bernstein Statistics

The framework generalizes to both sum ($\mathrm{Reset}(x)$0) and Bernstein statistics.

• Resettable Sum ($\mathrm{Reset}(x)$1) Sketch: Uses a related sampler with clipping, deterministically includes large-value keys, and applies BTM to normalized updates. The resulting sketch achieves

$\mathrm{Reset}(x)$2

space for prefix-max error

$\mathrm{Reset}(x)$3

with probability $\mathrm{Reset}(x)$4.

• Bernstein Statistics: For any function $\mathrm{Reset}(x)$5 admitting a Lévy–Khintchine representation,

$\mathrm{Reset}(x)$6

e.g., $\mathrm{Reset}(x)$7 for $\mathrm{Reset}(x)$8, soft-capping, etc., a known reduction expresses $\mathrm{Reset}(x)$9 as a sum plus Max-Distinct over randomized mappings. Parallel application of $v_x$0 cardinality samplers and robust sum sketches yields overall prefix-max accuracy and $v_x$1 space.

5. Error Guarantees and Lower Bounds

An information-theoretic lower bound via set-disjointness precludes pure relative error $v_x$2 with sublinear space, even in the resettable model. However, the “prefix-max” error

$v_x$3

is simultaneously achievable in polylogarithmic space and often operationally sufficient, provided the target statistic seldom shrinks by more than a constant factor from prior maxima.

6. Technical Lemmas and Concentration under Adaptivity

Three essential technical tools underpin adaptively robust sketches:

• Binary Tree Mechanism Accuracy ([Chan–Shi–Song’11]): For all $v_x$4, with $v_x$5 counters and Laplace noise per node, prefix-noisy sums satisfy

$v_x$6

• DP-Generalization for Bernoulli Sampling: For any DP mechanism applied to Bernoulli samples, the posterior probability that a specific key is in the sample remains within $v_x$7 of the base rate $v_x$8. The absolute bias in mean sample size remains $v_x$9.
• Concentration under Adaptivity: By expressing the sample size as $t$0 ($t$1 i.i.d. Bernoulli), Freedman-style martingale analysis augmented with DP-posterior stability establishes that for all $t$2

$t$3

with probability $t$4.

7. Summary of Contributions and Impact

Adaptively robust sketches provide the first polylog-space, provably adversary-resistant streaming algorithms for the resettable model, with strong prefix-max error guarantees for a large class of statistics. The blend of non-composable sampling frameworks and the binary tree mechanism for continual, differentially private release enables these robust properties, sidestepping the impossibility results for conventional sketching. These advances contribute foundational tools for adversarially robust, memory-efficient data processing in streaming applications with support for deletions and unlearning, with immediate implications for areas such as active monitoring and privacy-preserving analytics (Cohen et al., 29 Jan 2026).