Title: LEARNING-BASED FREQUENCY ESTIMATION ALGORITHMS

Abstract: Estimating the frequencies of elements in a data stream is a fundamental task in data analysis and machine learning. The problem is typically addressed using streaming algorithms which can process very large data using limited storage. Today's streaming algorithms, however, cannot exploit patterns in their input to improve performance. We propose a new class of algorithms that automatically learn relevant patterns in the input data and use them to improve its frequency estimates. The proposed algorithms combine the benefits of machine learning with the formal guarantees available through algorithm theory. We prove that our learning-based algorithms have lower estimation errors than their non-learning counterparts. We also evaluate our algorithms on two real-world datasets and demonstrate empirically their performance gains.
We will use e i := | fi -f i | to denote the estimation error for f i . To measure the overall estimation error between the frequencies
where D models the distribution over the queries to the data structure. Similar to past work (Roy et al., 2016) , we assume the query distribution D is the same as the distribution of the input stream, i.e.,

1.. INTRODUCTION:

Classical algorithms provide formal guarantees over their performance, but often fail to leverage useful patterns in their input data to improve their output. On the other hand, deep learning models are highly successful at capturing and utilizing complex data patterns, but often lack formal error bounds. The last few years have witnessed a growing effort to bridge this gap and introduce algorithms that can adapt to data properties while delivering worst case guarantees. Deep learning modules have been integrated into the design of Bloom filters (Kraska et al., 2018; Mitzenmacher, 2018) , caching algorithms (Lykouris & Vassilvitskii, 2018) , graph optimization (Dai et al., 2017) , similarity search (Salakhutdinov & Hinton, 2009; Weiss et al., 2009) and compressive sensing (Bora et al., 2017) . This paper makes a significant step toward this vision by introducing frequency estimation streaming algorithms that automatically learn to leverage the properties of the input data.

Estimating the frequencies of elements in a data stream is one of the most fundamental subroutines in data analysis. It has applications in many areas of machine learning, including feature selection (Aghazadeh et al., 2018) , ranking (Dzogang et al., 2015) , semi-supervised learning (Talukdar & Cohen, 2014) and natural language processing (Goyal et al., 2012) . It has been also used for network measurements (Estan & Varghese, 2003; Yu et al., 2013; Liu et al., 2016) and security (Schechter et al., 2010) . Frequency estimation algorithms have been implemented in popular data processing libraries, such as Algebird at Twitter (Boykin et al., 2016) . They can answer practical questions like: what are the most searched words on the Internet? or how much traffic is sent between any two machines in a network?

The frequency estimation problem is formalized as follows: given a sequence S of elements from some universe U , for any element i ∈ U , estimate f i , the number of times i occurs in S. If one could store all arrivals from the stream S, one could sort the elements and compute their frequencies. However, in big data applications, the stream is too large (and may be infinite) and cannot be stored. This challenge has motivated the development of streaming algorithms, which read the elements of S in a single pass and compute a good estimate of the frequencies using a limited amount of space. 1 Over the last two decades, many such streaming algorithms have been developed, including Count-Sketch (Charikar et al., 2002) , Count-Min (Cormode & Muthukrishnan, 2005b ) and multistage filters (Estan & Varghese, 2003) . The performance guarantees of these algorithms are wellunderstood, with upper and lower bounds matching up to O(•) factors (Jowhari et al., 2011) .

However, such streaming algorithms typically assume generic data and do not leverage useful patterns or properties of their input. For example, in text data, the word frequency is known to be inversely correlated with the length of the word. Analogously, in network data, certain applications tend to generate more traffic than others. If such properties can be harnessed, one could design frequency estimation algorithms that are much more efficient than the existing ones. Yet, it is important to do so in a general framework that can harness various useful properties, instead of using handcrafted methods specific to a particular pattern or structure (e.g., word length, application type).

In this paper, we introduce learning-based frequency estimation streaming algorithms. Our algorithms are equipped with a learning model that enables them to exploit data properties without being specific to a particular pattern or knowing the useful property a priori. We further provide theoretical analysis of the guarantees associated with such learning-based algorithms.

We focus on the important class of "hashing-based" algorithms, which includes some of the most used algorithms such as Count-Min, Count-Median and Count-Sketch. Informally, these algorithms hash data items into B buckets, count the number of items hashed into each bucket, and use the bucket value as an estimate of item frequency. The process can be repeated using multiple hash functions to improve accuracy. Hashing-based algorithms have several useful properties. In particular, they can handle item deletions, which are implemented by decrementing the respective counters. Furthermore, some of them (notably Count-Min) never underestimate the true frequencies, i.e., fi ≥ f i holds always. However, hashing algorithms lead to estimation errors due to collisions: when two elements are mapped to the same bucket, they affect each others' estimates. Although collisions are unavoidable given the space constraints, the overall error significantly depends on the pattern of collisions. For example, collisions between high-frequency elements ("heavy hitters") result in a large estimation error, and ideally should be minimized. The existing algorithms, however, use random hash functions, which means that collisions are controlled only probabilistically.

Our idea is to use a small subset of S, call it S , to learn the heavy hitters. We can then assign heavy hitters their own buckets to avoid the more costly collisions. It is important to emphasize that we are learning the properties that identify heavy hitters as opposed to the identities of the heavy hitters themselves. For example, in the word frequency case, shorter words tend to be more popular. The subset S itself may miss many of the popular words, but whichever words popular in S are likely to be short. Our objective is not to learn the identity of high frequency words using S . Rather, we hope that a learning model trained on S learns that short words are more frequent, so that it can identify popular words even if they did not appear in S .

Our main contributions are as follows:

• We introduce learning-based frequency estimation streaming algorithms, which learn the properties of heavy hitters in their input and exploit this information to reduce errors

• We provide performance guarantees showing that our algorithms can deliver a logarithmic factor improvement in the error bound over their non-learning counterparts. Furthermore, we show that our learning-based instantiation of Count-Min, a widely used algorithm, is asymptotically optimal among all instantiations of that algorithm. See Table 4 .1 in section 4.1 for the details.

• We evaluate our learning-based algorithms using two real-world datasets: traffic load on an Internet backbone link and search query popularity. In comparison to their non-learning counterparts, our algorithms yield performance gains that range from 18% to 71%.

2.. RELATED WORK:

Frequency estimation in data streams. Frequency estimation, and the closely related problem of finding frequent elements in a data stream, are some of the most fundamental and well-studied problems in streaming algorithms, see Cormode & Hadjieleftheriou (2008) for an overview. Hashingbased algorithms such as Count-Sketch (Charikar et al., 2002) , Count-Min (Cormode & Muthukrishnan, 2005b ) and multi-stage filters (Estan & Varghese, 2003) are widely used solutions for these problems. These algorithms also have close connections to sparse recovery and compressed sens-ing (Candès et al., 2006; Donoho, 2006) , where the hashing output can be considered as a compressed representation of the input data (Gilbert & Indyk, 2010) .

Several "non-hashing" algorithms for frequency estimation have been also proposed (Misra & Gries, 1982; Demaine et al., 2002; Karp et al., 2003; Metwally et al., 2005) . These algorithms do not possess many of the properties of hashing-based methods listed in the introduction (such as the ability to handle deletions), but they often have better accuracy/space tradeoffs. For a fair comparison, our evaluation focuses only on hashing algorithms. However, our approach for learning heavy hitters should be useful for non-hashing algorithms as well.

Some papers have proposed or analyzed frequency estimation algorithms customized to data that follows Zipf Law (Charikar et al., 2002; Cormode & Muthukrishnan, 2005a; Metwally et al., 2005; Minton & Price, 2014; Roy et al., 2016) ; the last algorithm is somewhat similar to the "lookup table" implementation of the heavy hitter oracle that we use as a baseline in our experiments. Those algorithms need to know the data distribution a priori, and apply only to one distribution. In contrast, our learning-based approach applies to any data property or distribution, and does not need to know that property or distribution a priori.

Learning-based algorithms. Recently, researchers have begun exploring the idea of integrating machine learning models into algorithm design. In particular, researchers have proposed improving compressed sensing algorithms, either by using neural networks to improve sparse recovery algorithms (Mousavi et al., 2017; Bora et al., 2017) , or by designing linear measurements that are optimized for a particular class of vectors (Baldassarre et al., 2016; Mousavi et al., 2015) , or both. The latter methods can be viewed as solving a problem similar to ours, as our goal is to design "measurements" of the frequency vector (f 1 , f 2 . . . , f |U | ) tailored to a particular class of vectors. However, the aforementioned methods need to explicitly represent a matrix of size B × |U |, where B is the number of buckets. Hence, they are unsuitable for streaming algorithms which, by definition, have space limitations much smaller than the input size.

Another class of problems that benefited from machine learning is distance estimation, i.e., compression of high-dimensional vectors into compact representations from which one can estimate distances between the original vectors. Early solutions to this problem, such as Locality-Sensitive Hashing, have been designed for worst case vectors. Over the last decade, numerous methods for learning such representations have been developed (Salakhutdinov & Hinton, 2009; Weiss et al., 2009; Jegou et al., 2011; Wang et al., 2016) . Although the objective of those papers is similar to ours, their techniques are not usable in our applications, as they involve a different set of tools and solve different problems.

More broadly, there have been several recent papers that leverage machine learning to design more efficient algorithms. The authors of (Dai et al., 2017) show how to use reinforcement learning and graph embedding to design algorithms for graph optimization (e.g., TSP). Other learning-augmented combinatorial optimization problems are studied in (He et al., 2014; Balcan et al., 2018; Lykouris & Vassilvitskii, 2018) . More recently, (Kraska et al., 2018; Mitzenmacher, 2018) have used machine learning to improve indexing data structures, including Bloom filters that (probabilistically) answer queries of the form "is a given element in the data set?" As in those papers, our algorithms use neural networks to learn certain properties of the input. However, we differ from those papers both in our design and theoretical analysis. Our algorithms are designed to reduce collisions between heavy items, as such collisions greatly increase errors. In contrast, in existence indices, all collisions count equally. This also leads to our theoretical analysis being very different from that in (Mitzenmacher, 2018) .

3.. PRELIMINARIES:

is the sum of all frequencies. This leads to the estimation error of F with respect to F:

Err(F, F) := 1/N i∈U | fi -f i | • f i (3.1)

We note that the theoretical guarantees of frequency estimation algorithms are typically phrased in the "( , δ)-form", e.g., Pr[| fi -f i | > N ] < δ for every i (see e.g., Cormode & Muthukrishnan (2005b) ). However, this formulation involves two objectives ( and δ). We believe that the (single objective) expected error in Equation 3.1 is more natural from the machine learning perspective.

3.2.. ALGORITHMS FOR FREQUENCY ESTIMATION:

In this section, we recap three variants of hashing-based algorithms for frequency estimation.

Single Hash Function. The basic hashing algorithm uses a single uniformly random hash function

h : U → [B]

, where we use [B] to denote the set {1 . . . B}. The algorithm maintains a onedimensional array C[1 . . . B], in which all entries are initialized to 0. Given an element i, the algorithm increments C[h(i)]. It can be seen that at the end of the stream, we have 

C[b] = j:h(j)=b f j . The estimate fi of f i is defined as fi = C[h(i)] = j:h(i)=h(j) f j . Note that it is always the case that fi ≥ f i . Count-Min. We have k distinct hash functions h i : U → [B]

C such that C[ , b] = j:h (j)=b f j • g (j). For each i ∈ U , the frequency estimate fi is equal to the median of {g (i)•C[ , h (i)]} ≤k .

Note that unlike the previous two methods, here we may have fi < f i .

3.3.. ZIPFIAN DISTRIBUTION:

In our theoretical analysis we assume that the item frequencies follow the Zipf Law. That is, if we re-order the items so that their frequencies appear in a sorted order f i1 ≥ f i2 ≥ . . . ≥ f in , then f ij ∝ 1/j. To simplify the notation we assume that f i = 1/i.

4.. LEARNING-BASED FREQUENCY ESTIMATION ALGORITHMS:

We aim to develop frequency estimation algorithms that exploit data properties for better performance. To do so, we learn an oracle that identifies heavy hitters, and use the oracle to assign each heavy hitter its unique bucket to avoid collisions. Other items are simply hashed using any classic frequency estimation algorithm (e.g., Count-Min, or Count-Sketch), as shown in the block-diagram in Figure 4 .1. This design has two useful properties: First, it allows us to augment a classic frequency estimation algorithm with learning capabilities, producing a learning-based counterpart that inherits the original guarantees of the classic algorithm. For example, if the classic algorithm is Count-Min, the resulting learning-based algorithm never underestimates the frequencies. Second, it provably reduces the estimation errors, and for the case of Count-Min it is (asymptotically) optimal.

Algorithm 1 provides pseudo code for our design. The design assumes an oracle HH(i) that attempts to determine whether an item i is a "heavy hitter" or not. All items classified as heavy hitters are assigned to one of the B r unique buckets reserved for heavy items. All other items are fed to the remaining B -B r buckets using a conventional frequency estimation algorithm SketchAlg (e.g., Count-Min or Count-Sketch).

The estimation procedure is analogous. To compute fi , the algorithm first checks whether i is stored in a unique bucket, and if so, reports its count. Otherwise, it queries the SketchAlg procedure. Note that if the element is stored in a unique bucket, its reported count is exact, i.e., fi = f i .

The oracle is constructed using machine learning and trained with a small subset of S, call it S . Note that the oracle learns the properties that identify heavy hitters as opposed to the identities of the heavy hitters themselves. For example, in the case of word frequency, the oracle would learn that shorter words are more frequent, so that it can identify popular words even if they did not appear in the training set S .

4.1.. ANALYSIS:

Our algorithms combine simplicity with strong error bounds. Below, we summarize our theoretical results, and leave all theorems, lemmas, and proofs to the appendix. In particular, Table 4 .1 lists the results proven in this paper, where each row refers to a specific streaming algorithm, its corresponding error bound, and the theorem/lemma that proves the bound.

First, we show (Theorem 9.11 and Theorem 9.14) that if the heavy hitter oracle is accurate, then the error of the learned variant of Count-Min is up to a logarithmic factor smaller than that of its nonlearning counterpart. The improvement is maximized when B is of the same order as n (a common scenario 2 ). Furthermore, we prove that this result continues to hold even if the learned oracle makes prediction errors with probability δ, as long as δ = O(1/ ln n) (Lemma 9.15).

Second, we show that, asymptotically, our learned Count-Min algorithm cannot be improved any further by designing a better hashing scheme. Specifically, for the case of Learned Count-Min with a perfect oracle, our design achieves the same asymptotic error as the "Ideal Count-Min", which optimizes its hash function for the given input (Theorem 10.4).

Finally, we note that the learning-augmented algorithm inherits any ( , δ)-guarantees of the original version. Specifically, its error is not larger than that of SketchAlg with space B -B r , for any input.

Algorithms:

Expected Error Analysis Single Hash Function (B) Θ(ln

2 n/B) Lemma 9.2 Count-Min Sketch (k, B) Ω( k ln n B ln k ) and O( k ln n ln k+2 k-1 ( kn B ) B ) Theorem 9.11 Learned Count-Min(B) Θ(ln 2 (n/B)/B) Theorem 9.14 Ideal Count-Min(B)

Θ(ln 2 (n/B)/B) Theorem 10.4 Table 4 .1: Our performance bounds for different algorithms on streams with frequencies obeying Zipf Law. k is a constant (≥ 2) that refers to the number of hash functions, B is the number of buckets, and n is the number of distinct elements. The space complexity of all algorithms is the same, Θ(B). See section 9.4 for non-asymptotic versions of the some of the above bounds

5.. EXPERIMENTS:

Baselines. We compare our learning-based algorithms with their non-learning counterparts. Specifically, we augment Count-Min with a learned oracle using Algorithm 1, and call the learningaugmented algorithm "Learned Count-Min". We then compare Learned Count-Min with traditional Count-Min. We also compare it with "Learned Count-Min with Ideal Oracle" where the neuralnetwork oracle is replaced with an ideal oracle that knows the identities of the heavy hitters in the test data, and "Table Lookup with Count-Min" where the heavy hitter oracle is replaced with a lookup table that memorizes heavy hitters in the training set. The comparison with the latter baseline allows for each stream element i do 3:

if Training a Heavy Hitter Oracle. We construct the heavy hitter oracle by training a neural network to predict the heaviness of an item. Note that the prediction of the network is not the final estimation.

HH(i) = 1 then 4: if i is

It is used in Algorithm 1 to decide whether to assign an item to a unique bucket. We train the network to predict the item counts (or the log of the counts) and minimize the squared loss of the prediction. Empirically, we found that when the counts of heavy items are few orders of magnitude larger than the average counts (as is the case for the Internet traffic data set), predicting the log of the counts leads to more stable training and better results. Once the model is trained, we select the optimal cutoff threshold using validation data, and use the model as the oracle described in Algorithm 1.

5.1.. INTERNET TRAFFIC ESTIMATION:

For our first experiment, the goal is to estimate the number of packets for each network flow. A flow is a sequence of packets between two machines on the Internet. It is identified by the IP addresses of its source and destination and the application ports. Estimating the size of each flow i -i.e., the number of its packets f i -is a basic task in network management (Sivaraman et al., 2017) . Frequency (log scale) 

Model::

The patterns of the Internet traffic are very dynamic, i.e., the flows with heavy traffic change frequently from one minute to the next. However, we hypothesize that the space of IP addresses should be smooth in terms of traffic load. For example, data centers at large companies and university campuses with many students tend to generate heavy traffic. Thus, though the individual flows from these sites change frequently, we could still discover regions of IP addresses with heavy traffic through a learning approach.

We trained a neural network to predict the log of the packet counts for each flow. The model takes as input the IP addresses and ports in each packet. We use two RNNs to encode the source and destination IP addresses separately. The RNN takes one bit of the IP address at each step, starting from the most significant bit. We use the final states of the RNN as the feature vector for an IP address. The reason to use RNN is that the patterns in the bits are hierarchical, i.e., the more significant bits govern larger regions in the IP space. Additionally, we use two-layer fully-connected networks to encode the source and destination ports. We then concatenate the encoded IP vectors, encoded port vectors, and the protocol type as the final features to predict the packet counts3 . The inference time takes 2.8 microseconds per item on a single GPU without any optimizations4 .

Results::

We plot the results of two representative test minutes (the 20th and 50th) in Figure 5 .2. All plots in the figure refer to the estimation error (Equation 3.1) as a function of the used space. The space includes space for storing the buckets and the model. Since we use the same model for all test minutes, the model space is amortized over the 50-minute testing period. For the learned versions, we account for the extra space needed for the unique buckets to store the item IDs and the counts. One unique bucket takes 8 bytes, twice the space of a normal bucket. 5Second, the figure also shows that our neural-network oracle performs better than memorizing the heavy hitters in a lookup table. This is likely due to the dynamic nature of Internet traffic -i.e., the heavy flows in the training set are significantly different from those in the test data. Hence, memorization does not work well. On the other hand, our model is able to extract structures in the input that generalize to unseen test data.

Third, the figure shows that our model's performance stays roughly the same from the 20th to the 50th minute (Figure 5 .2b and Figure 5 .2d), showing that it learns properties of the heavy items that generalize over time.

Lastly, although we achieve significant improvement over Count-Min and Count-Sketch, our scheme can potentially achieve even better results with an ideal oracle, as shown by the dashed green line in Figure 5 .2. This indicates potential gains from further optimizing the neural network model. Frequency (log scale) Model: Unlike traffic data, popular search queries tend to appear more consistently across multiple days. For example, "google" is the most popular search phrase in most of the days in the dataset.

5.2.. SEARCH QUERY ESTIMATION:

Simply storing the most popular words can easily construct a reasonable heavy hitter predictor. However, beyond remembering the popular words, other factors also contribute to the popularity of a search phrase that we can learn. For example, popular search phrases appearing in slightly different forms may be related to similar topics. Though not included in the AOL dataset, in general, metadata of a search query (e.g., the location of the search) can provide useful context of its popularity.

To construct the heavy hitter oracle, we trained a neural network to predict the number of times a search phrase appears. To process the search phrase, we train an RNN with LSTM cells that takes characters of a search phrase as input. The final states encoded by the RNN are fed to a fully-connected layer to predict the query frequency. Our character vocabulary includes lower-case English alphabets, numbers, punctuation marks, and a token for unknown characters. We map the character IDs to embedding vectors before feeding them to the RNN6 . We choose RNN due to its effectiveness in processing sequence data (Sutskever et al., 2014; Graves, 2013; Kraska et al., 2018) .

Results: We plot the estimation error vs. space for two representative test days (the 50th and 80th day) in Figure 5 .4. As before, the space includes both the bucket space and the space used by the model. The model space is amortized over the test days since the same model is used for all days.

Similarly, our learned sketches outperforms their conventional counterparts. For Learned Count-Min, compared to Count-Min, it reduces the loss by 18% at 0.5 MB and 52% at 1.0 MB (Figure 5 .4a).

For Learned Count-Sketch, compared to Count-Sketch, it reduces the loss by 24% at 0.5 MB and 71% at 1.0 MB (Figure 5 .4c). Further, our algorithm performs similarly for the 50th and the 80th day (Figure 5.4b and Figure 5.4d) , showing that the properties it learns generalize over a long period.

The figures also show an interesting difference from the Internet traffic data: memorizing the heavy hitters in a lookup table is quite effective in the low space region. This is likely because the search queries are less dynamic compared to Internet traffic (i.e., top queries in the training set are also popular on later days). However, as the algorithm is allowed more space, memorization becomes ineffective. We analyze the accuracy of the neural network heavy hitter models to better understand the results on the two datasets. Specifically, we use the models to predict whether an item is a heavy hitter (top 1% in counts) or not, and plot the ROC curves in Figure 5 .5. The figures show that the model for the Internet traffic data has learned to predict heavy items more effectively, with an AUC score of 0.9. As for the model for search query data, the AUC score is 0.8. This also explains why we see larger improvements over non-learning algorithms in Figure 5 .2.

5.3.. ANALYZING HEAVY HITTER MODELS:



6.. EMBEDDING SPACE VISUALIZATION:

In this section, we visualize the embedding spaces learned by our heavy hitter models to shed light on the properties or structures the models learned. Specifically, we take the neural network activations before the final fully-connected layer, and visualize them in a 2-dimensional space using t-SNE (Maaten & Hinton, 2008) . To illustrate the differences between heavy hitters (top 1% in counts) and the rest ("light" items), we randomly sample an equal amount of examples from both classes. We visualize the embedding space for both the Internet traffic and search query datasets.

We show the embedding space learned by the model on the Internet traffic data in Figure 6 . 

7.. CONCLUSION:

We have presented a new approach for designing frequency estimation streaming algorithms by augmenting them with a learning model that exploits data properties. We have demonstrated the benefits of our design both analytically and empirically. We envision that our work will motivate a deeper integration of learning in algorithm design, leading to more efficient algorithms.

9.. ANALYSIS -FULL PROOFS:

In this section, we analyze the performance of three different approaches, single (uniformly random) hash function, Count-Min sketch, and Learned Count-Min sketch when the frequency of items is from Zipfian distribution. For simplicity, we assume that the number of distinct elements n is equal to the size of the universe |U |, and f i = 1/i. We use [n] to denote the set {1 . . . n}. We also drop the normalization factor 1/N in the definition of estimation error.

The following observation is useful throughout this section (in particular, in the section on nonasymptotic analysis). 

( ln 2 n B ). Proof: E[Err(F, Fh )] = E[ j∈[n] ( fj -f j ) • f j ] = j∈[n] E[ {q =j | h[q]=h[j]} f q ] • f j = j∈[n] (Θ( ln n B ) - f j B ) • f j = Θ( ln 2 n B ).

Moreover, since each bucket maintains the frequency of items that are mapped to it under h, the space complexity of this approach is proportional to the number of buckets which is Θ(B).

9.2.. COUNT-MIN SKETCH:

Here, we provide an upper bound and lower bound for the expected estimation error of Count-Min sketch with k hash functions and B buckets per row. In the rest of this section, for each j ∈ [n], ≤ k, we use e j, and e j respectively to denote the estimation error of f j by h and Count-Min sketch. Recall that the expected error of Count-Min sketch is defined as follows:

EQUATION

Our high-level approach is to partition the interval [0, B ln n] into m + 1 smaller intervals by a sequence of thresholds Θ(ln

1+γ ( n B )) = r 0 ≤ • • • ≤ r m = B ln n

where γ is a parameter to be determined later. Formally, we define the sequence of r i s to satisfy the following property:

∀ > 0, r := (ln( n B ) + ln r +1 ) ln γ r +1 . (9.3) Claim 9.3. For each i ≥ 0, ln r i+1 ≥ 2 ln r i .

Proof: By (9.3) and assuming ln r i+1 ≥ ln( n B ), r i < 2 ln 1+γ r i+1 . Hence, ln r i+1 > ( ri 2 ) 1 1+γ > 2 ln r i for sufficiently large values of r i7 assuming γ ≤ 3.

Note that as long as ln r i+1 ≥ ln( n B ), r i ≤ r i+1 . Otherwise, r i = o(ln 1+γ ( n B )) < r 0 . Corollary 9.4. For each i ≥ 1 and c ≥ 1, j≥i ln -c r j = O(ln -c r i ).

Hence, with probability at least 1 -1 k , the estimation fj includes the frequency of one of the top 2( B k ) ln k + 1 frequent items. Lemma 9.10. The expected error of Count-Min sketch of size k × ( B k ) for estimating items whose frequency distribution is Zipfian is at least (k-1) ln n 2B ln k+k . Proof: Observation 9.9 implies that E[e j ] ≥ (1 ).

-1 k ) 1 2( B k ) ln k+1 = k-1 2B ln k+k . Hence, E[Err(F, FCM )] = j∈[n] E[e j ] • f j ≥ ( k -1 2B ln k + k ) ln

In particular, for the case B = Θ(n) and k = O(1), the expected error of Count-Min sketch is Θ( ln n B ). Proof: The proof follows from Lemma 9.8 and 9.10. We remark that the bound in Lemma 9.8 is for the expected estimation error of Count-Min sketch of size k × B. Hence, to get the bound on the expected error of Count-Min of size k × ( B k ), we must replace B with B/k.

9.3.. LEARNED COUNT-MIN SKETCH:

Definition 9.12 (φ-HeavyHitter). Given a set of items

I = {i 1 , • • • , i n } with frequencies f = f 1 , • • • , f n , an item j is a φ-HeavyHitter of I if f j ≥ φ|| f || 1 .

Remark 9.13. If the frequency distribution of items I is Zipfian, then the number of φ-HeavyHitters is at most 1/(φ ln n). In other words, B r ≤ (φ ln n) -1 .

To recall, in our Learned Count-Min sketch with parameters (B r , B), B r buckets are reserved for the frequent items returned by HH and the rest of items are fed to a Count-Min sketch of size k × ( B-Br k

)

where k is a parameter to be determined. We emphasize that the space complexity of Learned Count-Min sketch with parameter (B r , B) is B r + B = O(B). Theorem 9.14. The optimal expected error of Learned Count-Min sketches with parameters (B r , B) is at most (ln(n/Br)+0.58) 2

B-Br:

. In particular, for B r = Θ(B) = Θ(n), E[Err(F, FL-CM )] = O( 1 n ). Proof: Since, the count of top B r frequent items are stored in their own buckets, for each j ≤ B r , e j = 0. Hence,

E[Err(F, FL-CM )] = j∈[n] E[e j ] • f j = j>Br E[e j ] • f j ∀j ≤ B r , e j = 0 < (ln(n/B r ) + 0.58) 2 B -B r By Observation 9.1

Note that the last inequality follows from the guarantee of single hash functions; in other words, setting k = 1 in the Count-Min sketch.

9.3.1.. LEARNED COUNT-MIN SKETCH USING NOISY HEAVYHITTERS ORACLE:

Unlike the previous part, here we assume that we are given a noisy HeavyHitters oracle HH δ such that for each item j, Pr HH δ (j, 1 Br ln n ) = HH 0 (j, 1 Br ln n ) ≤ δ where HH 0 is an ideal HeavyHitter oracle that detects heavy items with no error. Lemma 9.15. In an optimal Learned Count-Min sketch with parameters (B r , B) and a noisy HeavyHitters oracle HH δ , E[Err(F, F(L-CM,δ) )] = O( δ 2 ln 2 Br+ln 2 (n/Br)

).

Proof::

The key observation is that each heavy item, any of B r most frequent items, may only misclassify with probability δ. Hence, for each item j classified as "not heavy", (9.12) where the first term denotes the expected contribution of the misclassified heavy items and the second term denotes the expected contribution of non-heavy items.

E[e j ] ≤ δ • ( ln B r + 1 B -B r ) + ( ln(n/B r ) + 1 B -B r ) = O( δ ln B r + ln(n/B r ) B -B r ),

The rest of analysis is similar to the proof of Theorem 9.14.

E[Err(F, F(L-CM,δ) )] = j∈[n] E[e j ] • f j < δ j≤Br E[e j ] • f j + j>Br E[e j ] • f j ≤ O(δ • ln B r + ln(n/B r )) • O( δ ln B r + ln(n/B r ) B -B r ) By (9.12) ≤ O( δ 2 ln 2 B r + ln 2 (n/B r ) B -B r ).

Corollary 9.16.

Assuming B r = Θ(B) = Θ(n) and δ = O(1/ ln n), E[Err(F, F(L-CM,δ) )] = O(1/n).

Space analysis. Here, we compute the amount of space that is required by this approach.

Lemma 9.17 ) with cutoff (B r reserved buckets) for estimating the frequency of items whose distribution is Zipfian is O(B).

Proof: The amount of space required to store the counters corresponding to functions h

1 , • • • , h k is O(k • ( B-Br k )).

Here, we also need to keep a mapping from the heavy items (top B r frequent items according to HH δ ) to the reserved buckets B r which requires extra O(B r ) space; each reserved buckets stores both the hashmap of its corresponding item and its count.

9.4.. NON-ASYMPTOTIC ANALYSIS OF COUNT-MIN AND LEARNED COUNT-MIN:

In this section, we compare the non-asymptotic expected error of Count-Min sketch and out Learned Count-Min sketch with ideal HeavyHitters oracle. Throughout this section, we assume that the amount of available space to the frequency estimation algorithms is (1+α)B words. More precisely, we compare the expected error of Count-Min sketch with k hash functions and our Learned Count-Min sketch with B r = αB reserved buckets. Recall that we computed the following bounds on the expected error of these approaches (Lemma 9.10 and Theorem 9.14):

E[Err CM ] ≥ (k -1) ln n 2(1 + α)B ln(k) + k , E[Err L-CM ] ≤ (ln( n αB ) + 0.58) 2 (1 -α)B .

In the rest of this section, we assume that B ≥ γn and then compute the minimum value of γ that guarantees

E[Err L-CM ] ≤ 1 1+ε • E[Err CM ].

In other words, we compute the minimum amount of space that is required so that our Learned Count-Min sketch performs better than Count-Min sketch by a factor of at least (1 + ε).

E[Err:

L-CM ] ≤ (ln( 1 αγ ) + 0.58) 2 (1 -α)B ≤ 1 1 + ε • (k -1) ln n 2(1 + α)B ln k + k ≤ 1 1 + ε • E[Err CM ],

Hence, we must have (0.58

-ln α -ln γ) 2 ≤ (k-1)(1-α) (1+ε)(2(1+α) ln k+( k B ))

• ln n. By solving the corresponding quadratic equation,

ln 2 γ + 2(ln α -0.58) ln γ + ((ln α -0.58) 2 - (k -1)(1 -α) (1 + ε)(2(1 + α) ln k + ( k B )) • ln n) ≤ 0.

This implies that ln γ = -ln α + 0.58 -

(k-1)(1-α) (1+ε)(2(1+α) ln k+( k B )) • ln n. By setting α = 1 2 , γ ≤ 3.58 e (k-1) ln n 2(1+ε)(3 ln k+(k/B))

.

Next, we consider different values of k and show that in each case what is the minimum amount of space in which Learned CM outperforms CM by a factor of 1.06 (setting ε = 0.06).

• k = 1. In this case, we are basically comparing the expected error of a single hash function and Learned Count-Min. In particular, in order to get a gap of at least (1 + ε), by a more careful analysis of Lemma 9.2, γ must satisfy the following condition:

E[Err L-CM ] ≤ (ln( 1 αγ ) + 0.58) 2 (1 -α)B ≤ 1 1 + ε • ln 2 n -1.65 (1 + α)B ≤ 1 1 + ε • E[Err h ],

To simplify it further, we require that (ln( 2 γ )+0.58) 2 ≤ 3.18•(ln 2 n-1.65) which implies that γ = Θ(1/ ln n).

• k = 2. In this case, γ ≤ 3.58 e √ (ln n)/4.5 for sufficiently large values of B. Hence, we require that the total amount of available space is at least 5.37n e √ (ln n)/4.5 .

• k ∈ {3, 4}: In this case, γ ≤ 2 e √ (ln n)/3.5 for sufficiently large values of B. Hence, we require that the total amount of available space is at least 5.37n e √ (ln n)/3.5 .

• k ≥ 5. In this case, γ ≤ 2 e √ (ln n)/2.6 for sufficiently large values of B. Hence, we require that the total amount of available space is at least 5.37n e √ (ln n)/2.6 .

We also note that settings where the number of buckets is close to n are quite common in practice. For example, Goyal et al. (2012) uses ((1 + α)B = 20M, n = 33.5M ) and ((1 + α)B = 50M, n = 94M ) with k = 3, while Kumar et al. (2004) uses different pairs of ((1 + α)B, n) including (B = 288K, n = 563K). Plugging these values into the exact formulas computed above shows that Learned CM has a significantly lower loss than CM.

10.. OPTIMAL HASH FUNCTION:

In this section we compute an asymptotic bound error bound of optimal hash functions that map items 

f i • (f (h(i)) -f i ) = i∈I f i • f (h(i)) - i∈I f 2 i = b∈[B I ] f (b) 2 - i∈I f 2 i . (10.1)

Note that in (10.1) the second term is independent of h and is a constant. Hence, an optimal hash function minimizes the first term, b∈B I f (b) 2 .

Suppose that an item i * with frequency at least f (I) B I collides with a (non-empty) set of items I * ⊆ I \ {i * } under an optimal hash function h * . Since the total frequency of the items mapped to the bucket b * containing i * is greater than f (I) B I (i.e., f (h(i * )) > f (I) B I ), there exists a bucket b such that f (b) < f (I) B I . Next, we define a new hash function h with smaller estimation error compared to h * which contradicts the optimality of h * :

h(i) = h * (i) if i ∈ I \ I * b otherwise.

Formally, Err(F(I), Fh * (I)) -Err(F(I), Fh (I)

) = f h * (b * ) 2 + f h * (b) 2 -f h (b * ) 2 -f h (b) 2 = (f i * + f (I * )) 2 + f h * (b) 2 -f 2 i * -(f h * (b) + f (I * )) 2 = 2f i * • f (I * ) -2f h * (b) • f (I * ) = 2f (I * ) • (f i * -f h * (b)) > 0 Since f i * > f (I) B > f h * (b).

Next, we show that in any optimal hash function h Proof: Let i j * be the most frequent item that is not mapped to a singleton bucket under h * . If j * > B 2 ln γ then the statement holds. Suppose it is not the case and j * ≤ B 2 ln γ . Let I denote the set of items with frequency at most f j * = 1/j * (i.e., I = {i j | j ≥ j * }) and let B I denote the number of buckets that the items with index at least j * mapped to; B I = B -j * + 1. Also note that by Observation 9.1, f (I) < ln( n j * ) + 1. Next, by Claim 10.1, we show that h * does not hash the items {j * , • • • , n} to B I optimally. In particular, we show that the frequency of item j * is more than f (I) B I . To prove this, first we observe that the function g(j) := j • (ln(n/j) + 1) is strictly increasing in ).

Proof: By Lemma 10.2, in any hash function with minimum estimation error, the ( B 2 ln γ ) most frequent items do not collide with any other items (i.e., they are mapped into a singleton bucket) where γ = n/B > e 4.2 .

Hence, the goal is to minimize (10.1) for the set of items I which consist of all items other than the ( B 2 ln γ ) most frequent items. Since the sum of squares of m items that summed to S is at least S 2 /m, the multi-set loss of any optimal hash function is at least: = Ω( ln 2 (n/B) B ).

Err(F(I), Fh * (I)) = b∈[B] f (b) 2 - i∈[n]

:

Specifically, the goal of the problem is as follows. Given a sequence S of elements from U , the desired algorithm reads S in a single pass while writing into memory C (whose size can be much smaller than the length of S). Then, given any element i ∈ U , the algorithm reports an estimation of fi based only on the content of C.

We use RNNs with 64 hidden units. The two-layer fully-connected networks for the ports have 16 and 8 hidden units. The final layer before the prediction has 32 hidden units.

Note that new specialized hardware such as Google TPU, hardware accelerators and network compression(Han et al., 2017;Sze et al., 2017;Chen et al., 2017;Han et al., 2016; 2015) can drastically improve the inference time. Further, Nvidia has predicted that GPU will get 1000x faster by 2025. Because of these trends, the overhead of neural network inference is expected to be less significant in the future(Kraska et al., 2018).

By using hashing with open addressing, it suffices to store IDs hashed into log Br +t bits (instead of whole IDs) to ensure there is no collision with probability 1 -2 -t . log Br + t is comparable to the number of bits per counter, so the space for a unique bucket is twice the space of a normal bucket.

We use an embedding size of 64 dimensions, an RNN with 256 hidden units, and a fully-connected layer with 32 hidden units.

More precisely, ri ≥ 1.3 × 10 6 .

Figures and Tables:

and an array C of size k × B. The algorithm maintains C, such that at the end of the stream we have C[ , b] = j:h (j)=b f j . For each i ∈ U , the frequency estimate fi is equal to min ≤k C[ , h (i)], and always satisfies fi ≥ f i . Count-Sketch. Similarly to Count-Min, we have k distinct hash functions h i : U → [B] and an array C of size k × B. Additionally, in Count-Sketch, we have k sign functions g i : U → {-1, 1}, and the algorithm maintains

For example, Goyal et al. (2012) uses B = 20M, n = 33.5M and B = 50M, n = 94M . Algorithm 1 Learning-Based Frequency Estimation 1: procedure LEARNEDSKETCH(B, Br, HH, SketchAlg) 2:

Figure 4.1: Pseudo-code and block-diagram representation of our algorithms

Figure 5.1: Frequency of Internet Flows

Figure5.2 reveals multiple findings. First, the figure shows that our learning-based algorithms exhibit a better performance than their non-learning counterparts. Specifically, Learned Count-Min, compared to Count-Min, reduces the the error by 32% with space of 0.5 MB and 42% with space of 1.0 MB(Figure 5.2a). Learned Count-Sketch, compared to Count-Sketch, reduces the error by 52%

Figure 5.4: Comparison of our algorithms with Count-Min and Count-Sketch on search query data.

Figure 5.5: ROC curves of the learned models.

1. Each point in the scatter plot represents one Internet traffic flow. By coloring each flow with its number of packets in Figure6.1a, we see that the model separate flows with more packets (green and yellow clusters) from flows with fewer packets (blue clusters). To understand what structure the model learns to separate these flows, we color each flow with its destination IP address in Figure6.1b. We found that clusters with more packets are often formed by flows sharing similar destination address prefixes. Interestingly, the model learns to group flows with similar IP prefixes closer in the embedding space. For example, the dark blue cluster at the upper left of Figure6.1b shares a destination IP address prefix "1.96.*.*". Learning this "structure" from the Internet traffic data allows the model to generalize to packets unseen in the training set.

Figure 6.1: Visualization of the embedding space learned by our model on the Internet traffic data. Each point in the scatter plot represents one network flow.We show the embedding space learned by the model on the search query data in Figure6.2. Each point in the scatter plot represents one search query. Similarly, the model learns to separate frequent search queries from the rest in Figure6.2a. By coloring the queries with the number of characters in Figure6.2b, we have multiple interesting findings. First, queries with similar length are closer in the embedding space, and the y-axis forms the dimension representing query length. Second, if we simply use the query length to predict heavy hitters, many light queries will be misclassified. The model must have learned other structures to separate heavy hitters in Figure6.2a.

Figure 6.2: Visualization of the embedding space learned by our model on the search query data. Each point in the scatter plot represents one search query.

The expected error of Count-Min sketch of size k × ( B k ) on estimating the frequency of n items from Zipfian distribution is at least Ω( k ln n B ln k ) and at most O(

The amount of space used by Learned Count-Min sketch of size k•( B-Br k

[n] to a set of buckets C[1 • • • B]. Claim 10.1. For a set of items I, let f (I) denote the total frequency of all items in I; f (I) := i∈I f i . In any optimal hash function of form {h : I → [B I ]} with minimum estimation error, any item with frequency at least f (I) B I does not collide with any other items in I. Proof: For each bucket b ∈ [B I ], lets f h (b) denotes the frequency of items mapped to b under h; f (b) := i∈I:h(i)=b f i . Recall that the estimation error of a hash function h is defined as Err(F(I), Fh (I)) := i∈I f i • (f (h(i)) -i). Note that we can rewrite Err(F(I), Fh (I)) as Err(F(I), Fh (I)) = i∈I

[1, n]. Hence, for any j * ≤ B 2 ln γ , j * • (ln( γ) + 2 < ln γ for ln γ ≥ 4.2< B I Thus, f j * = 1 j * > ln(n/j * )+1 B I > f (I)B I which implies that an optimal hash function must map j * to a singleton bucket. Theorem 10.3. If n/B ≥ e 4.2 , then the estimation error of any hash function that maps a set of n items following Zipfian distribution to B buckets is Ω(ln 2 ( n B ) B

The expected error of a single uniformly random hash function h : [n] → [B] (with B buckets) for estimating the frequency of items whose distribution is Zipfian is Θ

Table content: <table><tr><td colspan="4">Observation 9.1. For sufficiently large values of n (i.e., n &gt; 250),</td><td/></tr><tr><td>ln(n + 1) &lt;</td><td>n i=1</td><td>1 i</td><td>&lt; ln n + 0.58</td><td>(9.1)</td></tr><tr><td>9.1. SINGLE HASH FUNCTION</td><td/><td/><td/><td/></tr><tr><td>Lemma 9.2.</td><td/><td/><td/><td/></tr></table>

: [n] → [B] and assuming Zipfian input distribution, Θ(B) most frequent items do not collide with any other items under h * . Lemma 10.2. Suppose that B = n/γ where γ ≥ e 4.2 is a constant and lets assume that items follow Zipfian distribution. In any hash function h * : [n] → [B] with minimum estimation error, none of the B 2 ln γ most frequent items collide with any other items (i.e., they are mapped to a singleton bucket).

Table content: <table/>

Peer review (iclr2019):
 Quality/clarity: - The problem setting description is neither formal nor intuitive which made it very hard for me to understand exactly the problem you are trying to solve. Starting with S and i: I guess S and i are both simply varying-length sequences in U. - In general the intro should focus more on an intuitive (and/or formal) explanation of the problem setting, with some equations that explain the problem you want to work on. Right now it is too heavy on *related work* (this is just my opinion). Originality/Significance: I have certainly never seen a ML-based paper on this topic. The idea of *learning* prior information about the heavy hitters seems original. Pros: It seems like a creative and interesting place to use machine learning. the plots in Figure 5.2 seem promising. Cons: - The formalization in Paragraph 3 of the Intro is not very formal. I guess S and i are both simply varying-length sequences in U. - In general the intro should focus more on an intuitive (and/or formal) explanation of the problem setting, with some equations that explain the problem you want to work on. Right now it is too heavy on *related work* (this is just my opinion). -In describing Eqn 3 there are some weird remarks, e.g. "N is the sum of all frequencies". Do you mean that N is the total number of available frequencies? i.e. should it be |D|? It*s not clear to me that the sum of frequencies would be bounded if D is not discrete. - Your F and .tilde{f} are introduced as infinite series. Maybe they should be {f1, f2,..., fN}, i.e. N queries, each of which you are trying to be estimate. - In general, you have to introduce the notation much more carefully. Your audience should not be expected to be experts in hashing for this venue!! *C[1,...,B]* is informal abusive notation. You should clearly state using both mathematical notation AND using sentences what each symbol means. My understanding is that that h:U->b, is a function from universe U to natural number b, where b is an element from the discrete set {1,...,B}, to be used as an index for vector C. The algorithm maintains this vector C.in N^B (ie C is a B-length vector of natural numbers). In other words, h is mapping a varying-length sequence from U to an *index* of the vector C (a.k.a: a bin). Thus C[b] denotes the b-th element/bin of C, and C[h(i)] denotes the h(i)-th element. - Still it is unclear where *fj* comes from. You need to state in words eg "C[b] contains the accumulation of all fj*s such that h(j)=b; i.e. for each sequence j .in U, if the hash function h maps the sequence to bin b (ie ), then we include the *corresponding frequency* in the sum." - What I don*t understand is how fj is dependent on h. When you say "at the end of the stream", you mean that given S, we are analyzing the frequency of a series of sequences {i_1,...,i_N}? - Sorry, it*s just confusing and I didn*t really understand "Single Hash Function" from Sec 3.2 until I started typing this out. - The term "sketch" is used in Algorithm1, like 10, before *sketch* is defined!! -I*m not going to trudge through the proofs, because I don*t think this is self-contained (and I*m clearly not an expert in the area). Conclusion: Honestly, this paper is very difficult to follow. However to sum up the idea: you want to use deep learning techniques to learn some prior on the hash-estimation problem, in the form of a heavy-hitter oracle. It seems interesting and shows promising results, but the presentation has to be cleaned up for publication in a top ML venue. ****** Update after response: The authors have provided improvements to the introduction of the problem setting, satisfying most of my complaints from before. I am raising my score accordingly, since the paper does present some novel results.