Title: The Cost of Compression: Tight Quadratic Black-Box Attacks on Sketches for $\ell_2$ Norm Estimation
Venue: NeurIPS 2025
Accepted: yes
Keywords: $\ell_2$ sketches

dimensionality reduction

robustness
Abstract: Dimensionality reduction via linear sketching is a powerful and widely used technique, but it is known to be vulnerable to adversarial inputs. We study the \emph{black-box adversarial setting}, where a fixed, hidden sketching matrix $A \in \mathbb{R}^{k \times n}$ maps high-dimensional vectors $\boldsymbol{v} \in \mathbb{R}^n$ to lower-dimensional sketches $A\boldsymbol{v} \in \mathbb{R}^k$, and an adversary can query the system to obtain approximate $\ell_2$-norm estimates that are computed from the sketch.

We present a \emph{universal, nonadaptive attack} that, using $\tilde{O}(k^2)$ queries, either causes a failure in norm estimation or constructs an adversarial input on which the optimal estimator for the query distribution (used by the attack) fails. The attack is completely agnostic to the sketching matrix and to the estimator—it applies to \emph{any} linear sketch and \emph{any} query responder, including those that are randomized, adaptive, or tailored to the query distribution.

Our lower bound construction tightly matches the known upper bounds of $\tilde{\Omega}(k^2)$, achieved by specialized estimators for Johnson–Lindenstrauss transforms and AMS sketches. Beyond sketching, our results uncover structural parallels to adversarial attacks in image classification, highlighting fundamental vulnerabilities of compressed representations.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper designs a **non-adaptive**  attack against linear sketches for the $\\ell_2$ Norm Estimation problem. It starts with a batch of $\\tilde{O}(k^2)$ non-adaptive queries. Upon receiving all query responses, an attack query is generated based on those responses, which is guaranteed to compromise the $\\textit{optimal estimator}$. The $\\tilde{O}(k^2)$ batch size nearly matches the $\\Omega(k^2)$ upper bound achieved by JL transforms and AMS sketches, thus is nearly optimal. \n\nConcretely, each query vector is sampled as $v_i = w_i e + u_i$, where $e_h$ is a random, fixed basis vector, $w_i$ is an independent weight drawn from a carefully designed distribution, and $u_i$ is an independent Gaussian noise supported on a random subset of $[n]$ of size $\\tilde{O}(k^2)$. then the attack vector is a weighted sum of the noise vectors, where the weights are the query responses. The authors  prove the effectiveness of such an attack by showing that (1) the optimal estimator for the signal weight is a complete, sufficient statistic whose deviation is Gaussian, and (2) as long as the estimator does not err by too much, each query contributes an expected ''gain'' in aligning the weighted sum with an adversarial direction. This leads to the eventual failure of the estimator.\n\nSTRENGTHS AND WEAKNESSES:\n**Strength**:\n1. The non-adaptive ''batch'' attack model considered in this paper feels both intuitive and neat. And this paper studies the lower bound for the L2 norm estimation problem in this setting, which is arguably one of the most important problem. Although the bound holds only against ''optimal estimators'', one can imagine many use cases when the query responder is indeed an optimal estimator, thus I find the contribution of this paper clear.\n\n2. While the construction of the attack queries is easy to understand, the analysis feels non-trivial and novel. I think the high-level idea of the ''gaining lemma''  may potentially apply to other problems under similar attack models. \n\n\n**Weakness**:\n\nI think the presentation of the paper can be improved.\n\n1. Some terms are used before explaining. For example,\n- ''Optimal estimator'' is only explained as ''tailored to A and D'' until page 6. It would be clearer to either move the explanation on Line 215, 216 to a much earlier place, or add a few more words on what specific ''optimal estimator'' is being considered, since this is central to understanding the contribution and applicability of the result. \n- ''Signal gap'' appears in Lemma 4.1 without definition. Because ''signal'' already refers to $e_h$ earlier (and ''signal weight'' to $w$), the phrase “signal gap” is not self-explanatory and should be defined at first use.\n\n2. The purpose of each lemma in Section 4 is not very intuitive. i.e., It's a bit hard to understand what's the role of them in the entire proof. I think it would be helpful to add a short overview of the proof strategy and how the lemmas interlock.\n\n3. For the appendix, I only browsed through Appendix C and find\n- multiple typos, e.g. \"is order\" on Line 544, \"$2^{t-2}$\" on Line 527, and unclosed brackets on Line 564, 572. \n- Claim C.3. needs $\\langle v^{(i)}, v^{(j)} \\rangle = 1$ in the condition. Tracing down the proof of Lemma 4.5, Claim C.3 is applied on rows of a submatrix $B$ of $A$ containing orthogonal rows. I'm not sure how these rows satisfy the condition. \n\n\n  While I believe the proofs in the appendix are correct (at least on the high level), I suggest the authors to carefully proofread.\n\nQUESTIONS:\n1. There are many recent works on attacks against sketching / streaming. Has a non-adaptive “batch” attack model similar to the one in this paper been considered previously?\n\n2. The paper suggests, as a future direction, reducing the Gaussian noise support from $O(k^2)$ to $O(k)$. Beyond satisfying aesthetic bounds, does a smaller support lead to any concrete efficiency or robustness benefits for the attack?\n\n3. In adversarial streaming, Gribelyuk et al. (2025) extends L2 norm estimation lower bound to taks such as Lp norm, operator norm, and eigenvalues estimations. While this paper investigates a different attack model, does the result similarly generalizes to tasks beyond L2 norm estimation?\n\nLIMITATIONS:\nYes, the limitations are clearly discussed. The authors also point two potential future directions, which are\n- designing attacks that compromise $\\textit{every}$ query responder (beyond the optimal estimator considered in this paper), and\n- reducing the support size of the Gaussian additive noise from $O(k^2)$ to $O(k)$.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 2, "IMPACT": 3, "ORIGINALITY": 4, "DATE": "2025-06-23"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper investigates the robustness of linear sketching methods for ℓ₂ norm estimation under black-box adversarial settings. The authors propose a universal, nonadaptive attack that applies to any sketching matrix and query responder, including randomized and adaptive ones. The attack constructs a carefully designed distribution over sparse signals with additive Gaussian noise, and—using only $O(k^2  log^2⁡k )$ queries—either induces a nontrivial error rate in the responses or constructs a vector that misleads the optimal estimator tailored to the attacker's query distribution. Theoretical analysis demonstrates that this query complexity is tight, and preliminary experiments confirm the trade-off between robustness and estimation accuracy.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n\n1. Clear problem formulation: Definitions such as the (1, α)-gap problem (Definition 3.1) and adversarial noise vector (Definition 4.3) provide clean abstraction layers for analysis.\n\n2. The paper offers a clean theoretical framework, with precise definitions and proofs.\n\n3. The proposed attack is compatible with any sketching matrix and query responder, including randomized and adaptive estimators (Lines 125–126), demonstrating strong generality under minimal assumptions.\n\nWeaknesses:\n\n1. Some parts of the paper contain unnecessary redundancy; for example, Line 273 in Section 4.4 restates Theorem 3.2 in a way that duplicates prior content without adding new insight.\n\n2. Proof presentation could be improved: Key results like Theorem 3.2 are explained informally with phrases like “the idea is to show...” (Line 279), lacking formal structure and transitions.\n\n3. The attack's failure guarantee applies only to the optimal estimator aligned with the attack distribution and sketch matrix, and does not extend to arbitrary estimators, limiting its generality in practice.\n\nQUESTIONS:\n1. Is the $Ω(k^2)$ noise support size a theoretical necessity, or could it be reduced empirically without compromising effectiveness?\n\n2. Consider removing the redundant restatement of Theorem 3.2 on Line 273 in Section 4.4, as it adds little new content.\n\n3. While the authors claim that their result is “practically relevant,” the paper does not elaborate on the specific real-world scenarios or applications where such an attack might be impactful. A more concrete discussion of the practical implications of adversarial norm estimation in sketch-based systems would help contextualize the contribution.\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-28"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper presents an attack against linear sketches that aim to preserve the $\\ell_2$ norm, showing that after a quadratic number of queries, norm estimation can be compromised.\n\nFormally, the paper considers an attacker, a responder, and a fixed but unknown matrix $A \\in \\mathbb{R}^{k \\times n}$, which is hidden from both parties. In each round, the attacker generates a query vector $v \\in \\mathbb{R}^n$ and submits it to a black-box system. The responder receives the sketch $A v$ and must decide whether $\\|v\\|_2 \\le 1$ or $\\|v\\|_2 \\ge 1 + \\alpha$, for some fixed $\\alpha > 0$.\n\nThe main result shows that there exists a family of distributions over $\\mathbb{R}^n$ such that, if:\n1. The attacker randomly selects a distribution from this family and samples vectors $v$ accordingly, and\n2. The responder is aware of the distribution being used,\n\nthen after $\\tilde{O}(\\gamma^2 \\alpha^{-2} k^2)$ rounds, with constant probability, one of the following occurs:\n- The responder makes a constant fraction of errors in their binary decisions, or\n- The attacker can construct a vector $u$ such that the optimal estimator (with respect to $A$ and the chosen distribution) returns a value outside the interval $(1 \\pm \\gamma)\\|u\\|_2$.\n\nSTRENGTHS AND WEAKNESSES:\n1. Dimensionality reduction is widely used in data analysis and machine learning. Understanding when and how it fails contributes to our broader understanding of the stability and limitations of existing models.\n\n2. The proposed attack is agnostic to the underlying matrix $A$, and the number of queries required matches existing bounds for answering adaptively chosen queries accurately.\n\n3. The writing of the paper could be significantly improved. \n    * Several notations are introduced before being properly defined, which hinders readability. \n        For example:\n        - Line 41: the symbol $\\psi$ is used without a prior definition.\n        - Line 100: the meaning of $\\delta(\\alpha)$ is unclear.\n        - Line 120: the $W$ appears without explanation.\n\n   * Additionally, the technical overview in lines 119–123 of the introduction refers to the algorithm's pseudocode, which is not presented until two sections later. \n   This makes it difficult for the reader to follow the intuition behind the approach at an early stage.\n\n   * The figures in the experimental section are difficult to read due to the text being too small. \n   Axis labels, legends, and annotations should be enlarged to ensure readability.\n\nQUESTIONS:\n1. The setting introduced on Page 2 involves only two parties: the adversary and the responder. However, the attack–defense framework appears to implicitly involve a third party—namely, a “system” that computes $A v$ for each query vector. This system acts as a black box accessible to both the adversary and the responder.\n\n    This third entity is not formally introduced in the initial setup but becomes explicit on Page 5, where the paper describes each step of the attack (e.g., Line 166). Clarifying the role of the system earlier in the paper would help readers better understand the interaction model and the assumptions about information flow.\n\n\n2. The experimental section includes standard estimators for the Johnson–Lindenstrauss (JL) transform. \nHow does the proposed attack compares to prior methods designed to target these estimators, as discussed in the introduction.\n\nLIMITATIONS:\nSee weakness and questions.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 2, "CLARITY": 1, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-03"}

comments: SUMMARY:
- This paper studies the problem of constructing adversarial inputs to linear sketches for the task of L2 norm estimation
- The presented attack is a universal, non-adaptive attack using $\tilde{O}(k^2)$ queries, where $k$ is the dimension of lower-dimensional projection
- Compared to prior work, this paper works for any sketching matrix (whereas prior work focused on JL/AMS constructions), and also is universal (whereas previous work may only work for some estimators)

STRENGTHS AND WEAKNESSES:
Strengths
- Good presentation
- Clear contribution over prior work, reducing the number of queries for general sketching matrices to quadratic (whereas prior work work used more specific information about the sketching matrix)


Weaknesses
- Empirical verification only done for JL sketching matrices with Standard/Robust Estimator, should at least include some other sketch constructions
- Attack requires that the estimator is optimal with respect to $\mathcal{D}$ and $A$. How this can be generalized to non-optimal responders is not clear

QUESTIONS:
See weaknesses

LIMITATIONS:
See weaknesses
TITLE: Official Review
CLARITY: 3
IMPACT: 3
ORIGINALITY: 2
DATE: 2025-07-08