Adversarial Robustness of Streaming Algorithms through Importance Sampling

1 Introduction . Robustness against adversarial attacks have recently been at the forefront of algorithmic design for machine learning tasks [ GSS15 , CW17 , AEIK18 , MMS+18 , TSE+19 ] . We extend this line of work by studying adversarially robust streaming algorithms . In the streaming model , data points are generated one at a time in a stream and the goal is to compute some meaningful function of the input points while using a limited amount of memory , typically 35th Conference on Neural Information Processing Systems ( NeurIPS 2021 ) . sublinear in the total size of the input . The streaming model is applicable in many algorithmic and ML related tasks where the size of the data far exceeds the available storage . Applications of the streaming model include monitoring IP traffic flow , analyzing web search queries [ LMV+16 ] , processing large scientific data , feature selection in machine learning [ HZZ21 , GRB+19 , WYWD10 ] , and estimating word statistics in natural language processing [ GDC12 ] to name a few . Streaming algorithms have also been implemented in popular data processing libraries such as Apache Spark which have implementations for streaming tasks such as clustering and linear regression [ ZXW+16a ] . In the adversarial streaming model [ MBN+17 , BMSC17 , AMYZ19 , BY20 , BJWY20 , HKM+20 , WZ20 , ABD+21 , KMNS21 ] , an adversary gives an algorithm a sequence of adaptively chosen updates u1 , . . . , un as a data stream . The goal of the algorithm is to compute or approximate some predetermined function for every prefix of the adversarial stream , but the adversary may generate future updates based on previous outputs of the algorithm . In particular , the adversary may gradually learn the random bits internally used by an algorithm to manipulate dependencies in the input . This is especially problematic as many important problems in the streaming model require randomized algorithms , as they are known to not admit any deterministic algorithms that use sublinear space . Studying when adversarially robust streaming algorithms are possible is an important problem in lieu of recent interest in adversarial attacks in ML with applications to adaptive data analysis . Formally , we define the model as a two-player game between a streaming algorithm StreamAlg and a source Adversary of adaptive and adversarial input to StreamAlg . At the beginning of the game , a fixed queryQ is determined and asks for a fixed function for the underlying dataset implicitly defined by the stream . The game then proceeds in rounds , and in the t-th round , ( 1 ) Adversary computes an update ut ∈ [ n ] for the stream , which depends on all previous stream updates and all previous outputs from StreamAlg . ( 2 ) StreamAlg uses ut to update its data structures Dt , acquires a fresh batch Rt of random bits , and outputs a response At to the query Q . ( 3 ) Adversary observes and records the response At . The goal of Adversary is to induce StreamAlg to make an incorrect response At to the query Q at some time t ∈ [ m ] throughout the stream . Related Works . Adversarial robustness of streaming algorithms has been an important topic of recent research . On the positive note , [ BJWY20 ] gave a robust framework for estimating the Lp norm of points in a stream in the insertion-only model , where previous stream updates can not later be deleted . Their work thus shows that deletions are integral to the attack of [ HW13 ] . Subsequently , [ HKM+20 ] introduced a new algorithmic design for robust Lp norm estimation algorithms , by using differential privacy to protect the internal randomness of algorithms against the adversary . Although [ WZ20 ] tightened these bounds , showing that essentially no losses related to the size of the input n or the accuracy parameter ε were needed , [ KMNS21 ] showed that this may not be true in general . Specifically , they showed a separation between oblivious and adversarial streaming in the adaptive data analysis problem . [ BY20 ] showed that sampling is not necessarily adversarially robust ; they introduce an exponentially sized set system where a constant number of samples , corresponding to the VC-dimension of the set system , may result in a very unrepresentative set of samples . However , they show that with an additional logarithmic overhead in the number of samples , then Bernoulli and or reservoir sampling are adversarially robust . This notion is further formalized by [ ABD+21 ] , who showed that the classes that are online learnable requires essentially sample-complexity proportional to the Littlestone ’ s dimension of the underlying set system , rather than VC dimension . However , these sampling procedures are uniform in the sense that each item in the stream is sampled with the same probability . Thus the sampling probability of each item is oblivious to the identity of the item . By contrast , we show the robustness for a variety of algorithms based on non-oblivious sampling , where each stream item is sampled with probability roughly proportional to the “ importance ” of the item . 1.1 Our Contributions . Our main contribution is a powerful yet simple statement that algorithms based on non-oblivious sampling are adversarially robust if informally speaking , the process of sampling each item in the stream can be viewed as using fresh randomness independent of previous steps , even if the sampling probabilities depend on previous steps . Let us describe , very informally , our meta-approach . Suppose we have an adversarial stream of elements given by u1 , . . . , un . Our algorithm A will maintain a data structure At at time t which updates as the stream progresses . A will use a function g ( At , ut ) to determine the probability of sampling item ut to update At to At+1 . The function g measures the ‘ importance ’ of the element ut to the overall problem that we wish to solve . For example , if our application is k-means clustering and ut is a point far away from all previously seen points so far , we want to sample it with a higher probability . We highlight that even though the sampling probability for ut given by g ( At , ut ) is adversarial , since the adversary designs ut and previous streaming elements , the coin toss performed by our algorithm A to keep item ut is independent of any events that have occurred so far , including the adversary ’ s actions . This new randomness introduced by the independent coin toss is a key conceptual step in the analysis for all of the applications listed in Figure 1 . Contrast this to the situation where a “ fixed ” data structure or sketch is specified upfront . In this case , we would not be adaptive to which inputs ut the adversary designs to be “ important ” for our problem which would lead us to potentially disregard such important items rendering the algorithm ineffective . As applications of our meta-approach , we introduce adversarially robust streaming algorithms for two central machine learning tasks , regression and clustering , as well as their more general counterparts , subspace embedding , low-rank approximation , and coreset construction . We show that several methods from the streaming algorithms “ toolbox ” , namely merge and reduce , online leverage score sampling , and edge sampling are adversarially robust “ for free. ” As a result , existing ( and future ) streaming algorithms that use these tools are robust as well . We discuss our results in more detail below and provide a summary of our results and applications in Figure 1 . We first show that the well-known merge and reduce paradigm is adversarially robust . Since the merge and reduce paradigm defines coreset constructions , we thus obtain robust algorithms for k-means , k-median , Bregman clustering , projective clustering , principal component analysis ( PCA ) , non-negative matrix factorization ( NNMF ) [ LK17 ] . Theorem 1.1 ( Merge and reduce is adversarially robust ) Given an offline ε-coreset construction , the merge and reduce framework gives an adversarially robust streaming construction for an ε-coreset with high probability . For regression and other numerical linear algebra related tasks , we consider the row arrival streaming model , in which the adversary generates a sequence of row vectors a1 , . . . , an in d-dimensional vector space . For t ∈ [ n ] , the t-th prefix of the stream induces a matrix At ∈ Rt×d with rows a1 , . . . , at . We denote this matrix as At = a1 ◦ . . . ◦ at and define κ to be an upper bound on the largest condition number1 of the matrices A1 , . . . , An . Theorem 1.2 ( Row sampling is adversarially robust ) There exists a row sampling based framework for adversarially robust streaming algorithms that at each time t ∈ [ n ] : 1the ratio of the largest and smallest nonzero singular values ( 1 ) Outputs a matrix Mt such that ( 1 − ε ) A > t At M > t Mt ( 1 + ε ) A > t At , while sampling O ( d2κ ε2 log n log κ ) rows ( spectral approximation/subspace embedding/linear regres- sion/generalized regression ) . ( 2 ) Outputs a matrix Mt such that for all rank k orthogonal projection matrices P ∈ Rd×d , ( 1− ε ) ‖At −AtP‖2F ≤ ‖Mt −MtP‖ 2 F ≤ ( 1 + ε ) ‖At −AtP‖ 2 F , while sampling O ( dkκ ε2 log n log 2 κ ) rows ( projection-cost preservation/low-rank approximation ) . ( 3 ) Outputs a matrix Mt such that ( 1 − ε ) ‖Atx‖1 ≤ ‖Mtx‖1 ≤ ( 1 + ε ) ‖Atx‖1 , while sampling O ( d2κ ε2 log 2 n log κ ) rows ( L1 subspace embedding ) . Finally , we show that our analysis also applies to algorithms for graph sparsification for in which edges are sampled according to their “ importance ” . Define κ as the ratio of the largest and the smallest cut sizes in G ( see Section 4 and Supplementary Section C for exact details ) . Theorem 1.3 Given a weighted graph G = ( V , E ) with |V | = n whose edges e1 , . . . , em arrive sequentially in a stream , there exists an adversarially robust streaming algorithm that outputs a 1± ε cut sparsifier with O ( κ2n logn ε2 ) edges with probability 1− 1/ poly ( n ) . Sketching vs Sampling Algorithms . A central tool for randomized streaming algorithms is the use of linear sketches . These methods maintain a data structure f such that after the ( i+ 1 ) -th input xi , we can update f by computing a linear function of xi . Typically , these methods employ a random matrix . For example , if the input consists of vectors , sketching methods will use a random matrix to project the vector into a much smaller dimension space . In [ HW13 ] , it was proved no linear sketch can approximate the L2-norm within a polynomial multiplicative factor against such an adaptive adversary . In general , streaming algorithms that use sketching are highly susceptible to the type of attack described in [ HW13 ] where the adversary can effectively ‘ learn ’ the kernel of the linear function used and send inputs along the kernel . For example , if an adversary knows the kernel of the random matrix used to project the input points , then by sending points that lie on the kernel of the matrix as inputs , the adversary can render the whole streaming algorithm useless . One the other hand , we employ a different family of streaming algorithms that are based on sampling the input rather than sketching it . Surprisingly , this simple change allows one to automatically get many adversarially robust algorithms either “ for free ” or without new algorithmic overheads . For more information , see Section 1.1 . We emphasize that while our techniques are not theoretically sophisticated , we believe its power lies in its simple message that sampling is often superior to sketching for adversarial robustness . In addition to downstream algorithmic and ML applications , this provides an interesting separation and trade-offs between the two paradigms ; for non adversarial inputs sketching often gives similar or better performance guarantees for many tasks [ BYKS01 ] .

Summary: Many streaming algorithms developed during the last decades are randomized and have an expected solution guarantee (approximation guarantee).  However, the promised guarantee is not with respect to an adaptive adversary that can choose the remaining part of the instance as a function of the decisions taken so far of the algorithm (and thus as a function of the random bits). This has prompted recent work on "adversarial robustness of streaming" to obtain guarantees regarding these stronger adaptive adversaries. First it has been shown that sketching based algorithms (i.e., sample a dimension-reduction matrix before the stream) is not robust against adaptive adversaries. This is because, the adversary can figure out the used matrix and then feed a worst-case instance.  The present paper has a more positive message. They show that a large family of streaming algorithms are in fact also robust against adaptive adversaries. On a high level they show that sampling based algorithms that roughly work as follows: before the arrival of an element e, we calculate a threshold for taking that element e based on the current state of the algorithm (and thus already used randomness). However, we use *new* randomness for deciding wether to take the element or not.  Such sampling based algorithms have been heavily used for e.g. clustering, graph sparsification and regression.   The main result of the paper is this observation together with tons of applications of prior algorithms that the authors list.