Sample-and-Query Model

• The Sample-and-Query Model is an access abstraction where algorithms process data through summarized samples and limited queries instead of full-data traversal.
• It facilitates approximate analytics in databases, quantum computing, and security by using tailored sampling strategies and statistical estimators.
• Key developments include finite-population PAC bounds, adaptive sample size optimization, and hybrid query mechanisms that balance storage, cost, and precision.

Searching arXiv for papers on “sample-and-query model” and closely related formulations. In the cited literature, the “Sample-and-Query Model” denotes a family of access abstractions in which an algorithm does not traverse or materialize its full underlying object, but instead works through sampled information together with restricted query access. The underlying object may be a static dataset summarized by a fixed-size uniform sample, a query-conditioned synthetic sample generator for approximate analytics, a designed measurement system over hidden variables, a black-box model queried on selected inputs, a vector exposed through sample-and-query primitives, or a quantum-encoded state exposed through approximate sample-and-query access (Bax et al., 2022, Zhang et al., 2021, Chung et al., 2017, Oksuz et al., 21 Feb 2026, Murça et al., 2024). Across these settings, the common structural idea is that computation is driven by a controlled interface—sampling, querying, or both—rather than unrestricted full-data access.

1. Access pattern and formal variants

In the cited work, the model is not a single universal formalism. Instead, it appears as a recurrent pattern: preprocessing, partial acquisition, or oracle interaction produces a restricted interface; later algorithms answer queries, infer global properties, or recover hidden structure using only that interface. In database-oriented settings, the sample is often a retained subset of tuples. In algorithmic and quantum settings, the “sample” may instead be an $\ell_2$-distributed index draw, copies of a state, or local partial instantiations of a random object. In security settings, the sample is often a selected set of candidate inputs or real seed examples chosen before spending black-box queries.

Setting	Sample primitive	Query primitive
Finite-population sketching	Uniform sample without replacement	Predicate frequency query on retained sample
AQP and learned AQP	Stratified or generated tuples	Aggregate / group-by evaluation
Designed acquisition	Random parity measurements	Recovery from queried measurements
Vector / quantum access	$\ell_2$-distributed sampling or approximate sample access	Entry query or amplitude query
Local random objects	Partial on-the-fly instantiation	Local structural queries

One influential exact classical formulation is sample-and-query access to a vector $v \in \mathbb{C}^d$: query any entry $v(i)$, sample $i$ from $\Distribution(i)=|v(i)|^2/\|v\|^2$, and read $\|v\|$. The quantum-compatible relaxation replaces exact access by approximate query, approximate sample, and approximate norm estimation, yielding ASQ and $\ASQ[\phi]$ interfaces (Murça et al., 2024). At the opposite end of the design space, some database papers treat a fixed retained sample itself as the synopsis, while others augment it with auxiliary statistics, generative models, or partition aggregates (Bax et al., 2022, Liang et al., 2021).

2. Finite-population inference from retained samples

A particularly clean sample-and-query formulation arises when preprocessing scans a dataset of size $n$, stores a uniform sample $S$ of exactly $\ell_2$0 items without replacement, and later answers arbitrary predicate-frequency queries from that sample alone. If a query predicate matches $\ell_2$1 records in the full dataset and $\ell_2$2 records in the sample, then the correct sampling law is hypergeometric, with

$\ell_2$3

The left and right tails are

$\ell_2$4

and exact finite-population PAC bounds are obtained by inversion: $\ell_2$5

$\ell_2$6

This gives high-confidence bounds on the unknown count $\ell_2$7, or equivalently on the true frequency $\ell_2$8, for any post hoc predicate that can be evaluated on sampled items (Bax et al., 2022).

The statistical claim is unusually sharp. The bounds are “sharp” when exact tail inversion is performed exactly, and “off by only one” when approximate tail computation preserves the threshold ordering near the optimum. The local numerical difficulty is governed by

$\ell_2$9

which quantifies how much precision is needed to distinguish adjacent feasible counts. The lower bound reduces by symmetry to the upper-bound computation via

$v \in \mathbb{C}^d$0

The computational backbone is binary search over $v \in \mathbb{C}^d$1, using monotonicity of $v \in \mathbb{C}^d$2 in $v \in \mathbb{C}^d$3, together with high-accuracy hypergeometric tail evaluation. The paper gives two implementations: direct combinatorial term computation with Loader-style interleaved multiply/divide, and a Stirling-log method based on

$v \in \mathbb{C}^d$4

For a stored explicit sample, counting $v \in \mathbb{C}^d$5 is $v \in \mathbb{C}^d$6; then inversion is $v \in \mathbb{C}^d$7 with direct term evaluation or $v \in \mathbb{C}^d$8 with the Stirling-based method. The same framework also handles simultaneous guarantees across multiple queried predicates by replacing $v \in \mathbb{C}^d$9 with $v(i)$0 per side for $v(i)$1 queries (Bax et al., 2022).

3. Approximate query processing and database realizations

In approximate query processing, the sample-and-query model usually appears as a reusable synopsis or as a query-specific sampling controller. A canonical reusable-sample formulation is CVOPT, which builds a single stratified sample under memory budget $v(i)$2 to support many future GROUP BY aggregates. Its objective is not variance of one scalar answer, but a norm of per-group coefficients of variation. For single aggregate, single group-by, with group $v(i)$3 of size $v(i)$4, mean $v(i)$5, standard deviation $v(i)$6, weight $v(i)$7, and stratum sample size $v(i)$8, the paper derives

$v(i)$9

and the optimal allocation for the weighted $i$0 objective is

$i$1

The framework extends to multiple aggregates and multiple group-bys by stratifying at the finest joint granularity and optimizing the resulting coefficients $i$2 per finest stratum (Nguyen et al., 2019).

A different AQP line treats sample size itself as the optimization variable. MISS formulates Sample Size Optimization as

$i$3

with $i$4, and models query error by a power law such as $i$5. In the multi-group case it fits

$i$6

from bootstrap-estimated error profiles, then predicts sample sizes by solving the induced constrained optimization. This is not a fixed-sample reuse model; it is query-specific adaptive sample refinement during query answering (Su et al., 2018).

PASS makes the hybrid form explicit. It stores a tree of exact partial aggregates over data partitions, and leaf-level stratified samples. A query is decomposed into fully covered partitions, answered exactly from precomputed summaries, and partially overlapping leaves, answered from samples. The query-time uncertainty is therefore confined to

$i$7

rather than to the whole predicate region. The physical design objective is a minimax partition optimization over query error, and the paper gives 1D dynamic programs and multidimensional k-d-tree approximations (Liang et al., 2021).

Learned AQP introduces a further variant: query-conditioned sample generation rather than direct answer prediction. A conditional Wasserstein GAN is trained on tuples with group labels, or with bucket-plus-group labels for predicate-aware group-by queries, so that the generator can synthesize tuples from $i$8 or $i$9. The generated tuples are then fed into standard aggregate estimators, and the method can be combined with CVOPT-style allocation and online aggregation (Zhang et al., 2021).

Open-world query processing pushes the model beyond unbiased sampling. Mosaic distinguishes populations, samples, and metadata, and lets users ask CLOSED, SEMI-OPEN, or OPEN queries over a population relation represented only by samples plus marginals. If inclusion probabilities are known, weights are $\Distribution(i)=|v(i)|^2/\|v\|^2$0; if unknown, the system proposes IPF-style reweighting against metadata for SEMI-OPEN, and a marginal-constrained sliced-Wasserstein generator for OPEN (Orr et al., 2019). Closely related in spirit, PAO interleaves predicate sampling and query optimization: it repeatedly samples unknown predicate selectivities, computes a candidate plan, finds a selectivity cube in which that plan is $\Distribution(i)=|v(i)|^2/\|v\|^2$1-optimal, and stops once Hoeffding-based confidence in that cube exceeds $\Distribution(i)=|v(i)|^2/\|v\|^2$2 (Trummer et al., 2015).

4. Designed queries, query difficulty, and query-to-sampling conversion

Not all sample-and-query models begin from a passive retained sample. In query-based data acquisition, the “sample” may itself be a response to a designed query. A clean example is reconstruction of a hidden binary vector

$\Distribution(i)=|v(i)|^2/\|v\|^2$3

from parity queries

$\Distribution(i)=|v(i)|^2/\|v\|^2$4

Here each query is specified by a binary design vector $\Distribution(i)=|v(i)|^2/\|v\|^2$5, and the average query degree

$\Distribution(i)=|v(i)|^2/\|v\|^2$6

measures query difficulty. With a Soliton degree law, the fundamental trade-off is

$\Distribution(i)=|v(i)|^2/\|v\|^2$7

so harder parity queries reduce the required number of samples until the irreducible $\Distribution(i)=|v(i)|^2/\|v\|^2$8-equation barrier dominates (Chung et al., 2017).

Another strand runs in the opposite direction: replacing active query patterns by oblivious sampling. For property testing over a fixed alphabet, every non-adaptive constant-query tester can be converted into a sample-based tester in which each coordinate is sampled independently with probability $\Distribution(i)=|v(i)|^2/\|v\|^2$9. In the one-sided case, the conversion yields

$\|v\|$0

so the expected number of inspected coordinates is

$\|v\|$1

a sublinear power of $\|v\|$2. The combinatorial mechanism is the extraction of generalized sunflowers, called pompoms, from the support hypergraph of the original tester (Fischer et al., 2015). This result is noteworthy because it shows that, at least for non-adaptive constant-query testers, sophisticated property-specific query distributions can sometimes be replaced by a universal sample-only access pattern.

5. Learning and security: query allocation around informative samples

In adversarial learning and privacy attacks, the sample-and-query model becomes a resource-allocation problem: which candidate inputs should be queried, and how much information should be extracted from each? LoMime addresses label-only membership inference by moving almost all online query cost into a one-time extraction phase. Starting from a small auxiliary set $\|v\|$3, it constructs a candidate pool $\|v\|$4 by perturbation and replication, then filters it by entropy sampling,

$\|v\|$5

entropy-gradient clustering, and loss-based sampling before querying the target model $\|v\|$6. The queried labels train a surrogate $\|v\|$7, and membership inference is then performed offline on $\|v\|$8 using the decision-boundary distance

$\|v\|$9

The central access shift is from repeated target queries per attacked record to amortized extraction followed by offline querying of the surrogate (Oksuz et al., 21 Feb 2026).

QEDG studies hard-label, data-free model stealing under a similar query-economics lens. Synthetic inputs are generated by optimizing

$\ASQ[\phi]$0

where $\ASQ[\phi]$1 pushes samples toward low-variance, decision-boundary-adjacent regions of the substitute, and $\ASQ[\phi]$2 spreads them along the boundary. Since each target query returns only a hard label, the method adds “query-free sample augmentation” for non-disputed samples and upweights disputed samples during substitute training (Pei et al., 2024).

SPSG is a particularly literal sample-and-query stealing model. With only a limited number of real images, it queries a victim classifier on the original sample $\ASQ[\phi]$3 and on structured superpixel perturbations

$\ASQ[\phi]$4

thereby estimating superpixel sample gradients rather than merely obtaining one label per image. The substitute is then trained with output matching and gradient matching. The practical advantage is that superpixel querying reduces per-sample query counts from pixel-level finite differences such as $\ASQ[\phi]$5 to values like $\ASQ[\phi]$6, $\ASQ[\phi]$7, or $\ASQ[\phi]$8, depending on segmentation (Zhao et al., 2024).

PSS-MIA turns black-box membership inference into an explicit pre-query selection problem. For each candidate sample $\ASQ[\phi]$9, it computes the Loss-Gap Ranking score

$n$0

where $n$1 and $n$2 are true-label losses under reference models trained with and without $n$3. Only the top-ranked subset is then queried and passed to a downstream MIA. Under a $n$4 FPR constraint, this pre-query ranking saves at least $n$5, $n$6, and $n$7 of the query budget on CIFAR-10, CIFAR-100, and CINIC-10, respectively (Zhao et al., 29 Jun 2026).

6. Quantum and local-access generalizations

Quantum work makes the access abstraction explicit. For a vector $n$8, approximate query access returns $n$9 with additive error $S$0 and two-sided error probability at most $S$1 in time $S$2. Approximate sample access returns an index from

$S$3

with one-sided failure probability at most $S$4, and approximate norm access estimates $S$5. Together these yield ASQ; the oversampling relaxation $S$6 allows sampling from a dominating vector $S$7 satisfying

$S$8

The model is realizable from state preparation and block encodings: if an $S$9-qubit state $\ell_2$00 can be prepared in time $\ell_2$01, then

$\ell_2$02

This interface is then used to build compositional algorithms such as approximate linear combinations and inner-product estimators (Murça et al., 2024).

A complementary result studies lower bounds by relating quantum sample access to quantum query access. For a quantum state-testing problem $\ell_2$03, let $\ell_2$04 be the number of copies of the state needed in the sample model and $\ell_2$05 the block-encoding query complexity. The paper proves the lifting theorem

$\ell_2$06

showing an essentially quadratic relation between sample and query complexity. Applications include lower bounds $\ell_2$07 for Gibbs sampling and $\ell_2$08 for the entanglement entropy problem (Wang et al., 2023).

A non-quantum but closely related local-access perspective appears in work on huge random objects. There the goal is not to retain a sample of a fixed object, but to answer local queries while incrementally constructing only the necessary parts of a random object sampled from the target distribution. A local-access implementation must satisfy two conditions: there exists a single consistent object $\ell_2$09 such that all answers equal $\ell_2$10, and the induced distribution $\ell_2$11 must satisfy

$\ell_2$12

The paper gives such implementations for random graphs, Dyck paths, rooted and binary trees, well-bracketed expressions, and uniform graph colorings, supporting queries such as Vertex-Pair, Next-Neighbor, Random-Neighbor, Height, and First-Return (Biswas et al., 2017).

7. Limits, trade-offs, and conceptual significance

The literature repeatedly emphasizes that sample-and-query access trades completeness of access for sharper control of storage, query cost, or exposure. The trade-offs differ by domain. In retained-sample frequency inference, only predicates reducible to success/failure labeling on sampled records are supported, simultaneous validity across many queried conditions requires union-bound correction, and high numerical precision may be necessary because neighboring hypergeometric tails can differ on the order of $\ell_2$13 (Bax et al., 2022). In reusable AQP synopses, guarantees are strongest for the optimized query family; no significantly sublinear sample can support all arbitrary future groupings and predicates accurately, and many methods remain centered on AVG-like estimators rather than a fully general SQL semantics (Nguyen et al., 2019).

Other systems expose different limitations. MISS is explicitly query-specific rather than a one-sample-for-all-queries synopsis (Su et al., 2018). Mosaic’s OPEN semantics are approximate and assumption-dependent, and the paper does not provide formal confidence intervals or universal identifiability guarantees when sampling probabilities are unknown (Orr et al., 2019). Query-to-sampling conversion in property testing is presently limited to non-adaptive constant-query testers over a fixed alphabet, with exponent $\ell_2$14 rather than the conjectured $\ell_2$15 (Fischer et al., 2015). In ASQ, randomized access and finite precision complicate the closure arguments that were straightforward in exact classical SQ models (Murça et al., 2024).

In learning and security, the central constraints are different: black-box queries may be expensive, rate-limited, or logged, so the problem becomes one of concentrating queries on high-value samples or boundary regions. This is why extraction-based MIAs, pre-query ranking, and superpixel probing all separate sample selection from query expenditure (Oksuz et al., 21 Feb 2026, Zhao et al., 29 Jun 2026, Zhao et al., 2024). A plausible implication is that “sample-and-query” is best treated not as a single theorem or interface, but as an access-design principle: specify what can be sampled, what can be queried, what consistency guarantee links those operations to the hidden full object, and what trade-off is accepted in exchange for avoiding unrestricted access.