Original: List-Decodable Sparse Mean Estimation
Revised: List-Decodable Sparse Mean Estimation

Original: Abstract
Revised: Abstract

Original: Robust mean estimation is one of the most important problems in statistics: given a set of samples in R d where an ↵ fraction are drawn from some distribution D and the rest are adversarially corrupted, we aim to estimate the mean of D .
Revised: Robust mean estimation is one of the most important problems in statistics: given a set of samples in R d where an ↵ fraction are drawn from some distribution D and the rest are adversarially corrupted, we aim to estimate the mean of D .

Original: A surge of recent research interest has been focusing on the list-decodable setting where ↵(0 , 12 ] , and the goal is to output a ﬁnite number of estimates among which at least one approximates the target mean.
Revised: A surge of recent research interest has been focusing on the list-decodable setting where ↵(0 , 12 ] , and the goal is to output a ﬁnite number of estimates among which at least one approximates the target mean.

Original: In this paper, we consider that the underlying distribution D is Gaussian with k -sparse mean.
Revised: In this paper, we consider that the underlying distribution D is Gaussian with k -sparse mean.

Original: Our main contribution is the ﬁrst polynomial-time algorithm that enjoys sample complexity O
Revised: Our main contribution is the ﬁrst polynomial-time algorithm that enjoys sample complexity O

Original:  poly( k, log d )  , i.e. poly-logarithmic in the dimension.
Revised:  poly( k, log d )  , i.e. poly-logarithmic in the dimension.

Original: One of our core algorithmic ingredients is using low-degree sparse polynomials to ﬁlter outliers, which may ﬁnd more applications.
Revised: One of our core algorithmic ingredients is using low-degree sparse polynomials to ﬁlter outliers, which may ﬁnd more applications.

Original:  Introduction
Revised:  Introduction

Original: Mean estimation is arguably a fundamental inference task in statistics and machine learning.
Revised: Mean estimation is arguably a fundamental inference task in statistics and machine learning.

Original: Given a set of samples { x 1 , . . .
Revised: Given a set of samples { x 1 , . . .

Original: , x n } ⇢ R d where an ↵ fraction are drawn from some well-behaved (e g.
Revised: , x n } ⇢ R d where an ↵ fraction are drawn from some well-behaved (e g.

Original: Gaussian) distribution D and the rest are adversarially corrupted, the goal is to estimate the mean of
Revised: Gaussian) distribution D and the rest are adversarially corrupted, the goal is to estimate the mean of

Original: D .
Revised: D .

Original: In the noiseless case where ↵ = 1 , the problem can be easily solved in view of the concentration of measure phenomenon [LT91].
Revised: In the noiseless case where ↵ = 1 , the problem can be easily solved in view of the concentration of measure phenomenon [LT91].

Original: However, this is rarely the case as modern data sets are often contaminated by random noise or even by adversarial corruptions.
Revised: However, this is rarely the case as modern data sets are often contaminated by random noise or even by adversarial corruptions.

Original: Thus, a great deal of recent efforts are focused on efﬁciently and robustly estimating the target mean in the presence of outliers.
Revised: Thus, a great deal of recent efforts are focused on efﬁciently and robustly estimating the target mean in the presence of outliers.

Original: Generally speaking, there is a phase transition between ↵ > 1 / 2 and 0 < ↵  1 / 2 , and solving either problem in a computationally efﬁcient manner is highly nontrivial.
Revised: Generally speaking, there is a phase transition between ↵ > 1 / 2 and 0 < ↵  1 / 2 , and solving either problem in a computationally efﬁcient manner is highly nontrivial.

Original: The problem that most of the samples are uncorrupted, i.e. ↵ > 1 / 2 , has a very long history dating back to the 1960s [Tuk60,
Revised: The problem that most of the samples are uncorrupted, i.e. ↵ > 1 / 2 , has a very long history dating back to the 1960s [Tuk60,

Original: Hub64], yet only until recently have computationally efﬁcient algorithms been established [DKK + 16,
Revised: Hub64], yet only until recently have computationally efﬁcient algorithms been established [DKK + 16,

Original: LRV16].
Revised: LRV16].

Original: The other yet more challenging regime concerns that an overwhelming fraction of the samples are corrupted, i.e. ↵  1 / 2 , which even renders estimation impossible.
Revised: The other yet more challenging regime concerns that an overwhelming fraction of the samples are corrupted, i.e. ↵  1 / 2 , which even renders estimation impossible.

Original: This motivates a line of research on list-decodable mean estimation [CSV17], where in place of outputting one single estimate, the algorithm is allowed to generate a ﬁnite list of candidates and is considered to be successful if there exists at least one candidate in the list that is sufﬁciently close to the target mean.
Revised: This motivates a line of research on list-decodable mean estimation [CSV17], where in place of outputting one single estimate, the algorithm is allowed to generate a ﬁnite list of candidates and is considered to be successful if there exists at least one candidate in the list that is sufﬁciently close to the target mean.

Original: In this work, we investigate the problem of list-decodable mean estimation, for which there have been a plethora of elegant results established in recent years.
Revised: In this work, we investigate the problem of list-decodable mean estimation, for which there have been a plethora of elegant results established in recent years.

Original: From a high level, most of them concern error guarantees and running time.
Revised: From a high level, most of them concern error guarantees and running time.

Original: For example, [CSV17] proposed the ﬁrst tractable algorithm based on semideﬁnite programming, which runs in polynomial time and achieves optimal error rate for variance-bounded distributions.
Revised: For example, [CSV17] proposed the ﬁrst tractable algorithm based on semideﬁnite programming, which runs in polynomial time and achieves optimal error rate for variance-bounded distributions.

Original: [DKS18b] developed a multi-ﬁltering scheme and showed that the error rate can be improved by using high degree polynomials if the underlying distribution is Gaussian.
Revised: [DKS18b] developed a multi-ﬁltering scheme and showed that the error rate can be improved by using high degree polynomials if the underlying distribution is Gaussian.

Original: The more recent works [CMY20, DKK + 21a] further addressed the computational efﬁciency of this task and achieved almost linear running time in certain regimes.
Revised: The more recent works [CMY20, DKK + 21a] further addressed the computational efﬁciency of this task and achieved almost linear running time in certain regimes.

Original: Although all of these algorithms exhibit near-optimal guarantees on either error rate or computational complexity, it turns out that less is explored to improve another yet important metric: the sample 36th Conference on Neural Information Processing Systems (NeurIPS 2022).
Revised: Although all of these algorithms exhibit near-optimal guarantees on either error rate or computational complexity, it turns out that less is explored to improve another yet important metric: the sample 36th Conference on Neural Information Processing Systems (NeurIPS 2022).

Original: complexity.
Revised: complexity.

Original: In particular, the sample complexity of all these algorithms is O (poly( d )) , hence they quickly break down for data-demanding applications such as healthcare where the number of available samples is typically orders of magnitude less than the dimension d
Revised: In particular, the sample complexity of all these algorithms is O (poly( d )) , hence they quickly break down for data-demanding applications such as healthcare where the number of available samples is typically orders of magnitude less than the dimension d

Original: [Wai19].
Revised: [Wai19].

Original: Therefore, a pressing question that needs to be addressed in such a high-dimensional regime is the following:
Revised: Therefore, a pressing question that needs to be addressed in such a high-dimensional regime is the following:

Original: Does there exist a provably robust algorithm for list-decodable mean estimation that runs in polynomial time and enjoys a sample complexity bound of O (polylog( d )) ?
Revised: Does there exist a provably robust algorithm for list-decodable mean estimation that runs in polynomial time and enjoys a sample complexity bound of O (polylog( d )) ?

Original: In this paper, we answer the question in the afﬁrmative by showing that when the target mean is k -sparse, i.e. it has at most k non-zero elements, it is attribute-efﬁciently list-decodable.
Revised: In this paper, we answer the question in the afﬁrmative by showing that when the target mean is k -sparse, i.e. it has at most k non-zero elements, it is attribute-efﬁciently list-decodable.

Original: Theorem 1 (Main result) .
Revised: Theorem 1 (Main result) .

Original: Given parameter ↵ 2 (0 , 12 ] , failure probability ⌧ 2 (0 , 1) , a natural number `  1 , and a set T of ⌦
Revised: Given parameter ↵ 2 (0 , 12 ] , failure probability ⌧ 2 (0 , 1) , a natural number `  1 , and a set T of ⌦

Original: [Equation]
Revised: [Equation]

Original:  samples in R d , of which at least a (2 ↵ ) -fraction are independent draws from the Gaussian distribution N ( µ, I d ) where k µ k 0  k , there exists an algorithm that runs in time poly
Revised:  samples in R d , of which at least a (2 ↵ ) -fraction are independent draws from the Gaussian distribution N ( µ, I d ) where k µ k 0  k , there exists an algorithm that runs in time poly

Original: [Equation]
Revised: [Equation]

Original:  , uses polynomials of degree at most 2 ` , and returns a list of O (1 / ↵ ) number of k -sparse vectors such that with probability 1  ⌧ , the list contains at least one ˆ µ 2 R d with 
Revised:  , uses polynomials of degree at most 2 ` , and returns a list of O (1 / ↵ ) number of k -sparse vectors such that with probability 1  ⌧ , the list contains at least one ˆ µ 2 R d with k

Original: [Equation]
Revised: [Equation]

Original:  , where ˜ O ( · ) hides poly-logarithmic factors.
Revised:  , where ˜ O ( · ) hides poly-logarithmic factors.

Original: Remark 2.
Revised: Remark 2.

Original: The key message of the theorem is that when the true mean is k -sparse, it is possible to efﬁciently approximate it with O (polylog( d )) samples.
Revised: The key message of the theorem is that when the true mean is k -sparse, it is possible to efﬁciently approximate it with O (polylog( d )) samples.

Original: This is in stark contrast to existing listdecodable results [CSV17, DKS18b, CMY20, DKK20a, DKK + 21a] where the sample complexity is
Revised: This is in stark contrast to existing listdecodable results [CSV17, DKS18b, CMY20, DKK20a, DKK + 21a] where the sample complexity is

Original: O (poly( d )) .
Revised: O (poly( d )) .

Original: The only attribute-efﬁcient robust mean estimators are [BDLS17, DKK + 19, CDK + 21], but their results hold only for the mild corruption regime where ↵ > 1 / 2 .
Revised: The only attribute-efﬁcient robust mean estimators are [BDLS17, DKK + 19, CDK + 21], but their results hold only for the mild corruption regime where ↵ > 1 / 2 .

Original: Remark 3.
Revised: Remark 3.

Original: Our algorithm and analysis hold for any degree `  1 .
Revised: Our algorithm and analysis hold for any degree `  1 .

Original: When ` = 1 , the sample complexity reads as ˜ O
Revised: When ` = 1 , the sample complexity reads as ˜ O

Original: ( ↵  7 k14 log 8  d ) and the algorithm achieves error ˜ O
Revised: ( ↵  7 k 8 log 6 d ) and the algorithm achieves error ˜ O

Original: ( ↵  12 ) .
Revised: ( ↵  12 ) .

Original: As opposed to an
Revised: As opposed to an

Original: O (1  ↵ ) error rate obtained for ↵ > 1 / 2 , the (non-vanishing) error rate ˜ O
Revised: O (1  ↵ ) error rate obtained for ↵ > 1 / 2 , the (non-vanishing) error rate ˜ O

Original: ( ↵  12 ) is typically what one can expect for list-decodable mean estimation under bounded second order moment condition, in light of the lower bounds in [DKS18b].
Revised: ( ↵  12 ) is typically what one can expect for list-decodable mean estimation under bounded second order moment condition, in light of the lower bounds in [DKS18b].

Original: When leveraging degree- 2 ` polynomials into algorithmic design, we obtain the improved ˜
Revised: When leveraging degree- 2 ` polynomials into algorithmic design, we obtain the improved ˜

Original: O
Revised: O

Original: [Equation]
Revised: [Equation]

Original:   error guarantee.
Revised: )  error guarantee.

Original: Specially, when taking ` = ⇥  log 1 ↵  , our algorithm achieves error rate of ˜ O
Revised: Specially, when taking ` = ⇥  log 1 ↵  , our algorithm achieves error rate of ˜ O

Original:  log 32 ( 1 ↵ )  in quasi-polynomial time.
Revised:  log 32 ( 1 ↵ )  in quasi-polynomial time.

Original: This is very close to the minimax error rate of ⇥ (log 12 ( 1 ↵ )) established in [DKS18b].
Revised: This is very close to the minimax error rate of ⇥ (log 12 ( 1 ↵ )) established in [DKS18b].

Original: Remark 4.
Revised: Remark 4.

Original: If we further increase the sample size with an ` ` multiplicative factor with ` = ⇥ (log 1 ↵ ) , our algorithm will achieve an ˜ O  log 12 ( 1 ↵ )  error guarantee, which matches the minimax lower bound.
Revised: If we further increase the sample size with an ` ` multiplicative factor with ` = ⇥ (log 1 ↵ ) , our algorithm will achieve an ˜ O  log 12 ( 1 ↵ )  error guarantee, which matches the minimax lower bound.

Original: The proof follows the same pipeline and we leave it to interested readers.
Revised: The proof follows the same pipeline and we leave it to interested readers.

Original: 1.1 Overview of Our Techniques
Revised: 1.1 Overview of Our Techniques

Original: Our main algorithm is inspired by the multiﬁltering framework of [DKS18b], where the primary idea is to construct a sequence of polynomials to test the concentration of the samples to Gaussian so that the algorithm either certiﬁes that the sample set behaves like Gaussian, or sanitizes it by removing a sufﬁcient amount of outliers.
Revised: Our main algorithm is inspired by the multiﬁltering framework of [DKS18b], where the primary idea is to construct a sequence of polynomials to test the concentration of the samples to Gaussian so that the algorithm either certiﬁes that the sample set behaves like Gaussian, or sanitizes it by removing a sufﬁcient amount of outliers.

Original: Our key technical contribution lies into a new design of sparse polynomials , and new ﬁltering rules tailored to the sparse polynomials.
Revised: Our key technical contribution lies into a new design of sparse polynomials , and new ﬁltering rules tailored to the sparse polynomials.

Original: Sparse polynomials and sparsity-induced ﬁlters.
Revised: Sparse polynomials and sparsity-induced ﬁlters.

Original: To ensure that our algorithm is attribute-efﬁcient, we will only control the maximum eigenvalue of the sample covariance matrix on sparse directions.
Revised: To ensure that our algorithm is attribute-efﬁcient, we will only control the maximum eigenvalue of the sample covariance matrix on sparse directions.

Original: Since such computation is NP-hard in general, we ﬁrst consider a sufﬁcient condition which tests the maximum Frobenuis norm under a cardinality constraint, similar to the idea of [DKK + 19].
Revised: Since such computation is NP-hard in general, we ﬁrst consider a sufﬁcient condition which tests the maximum Frobenuis norm under a cardinality constraint, similar to the idea of [DKK + 19].

Original: If such Frobenuis norm is small, it implies a small restricted eigenvalue and hence the sample mean is returned.
Revised: If such Frobenuis norm is small, it implies a small restricted eigenvalue and hence the sample mean is returned.

Original: Otherwise, we construct sparse polynomials in the sense that they can be represented by a set of O ( ` 2 k 4 ` ) basis polynomials and O ( ` k 2 ` ) coordinates of the samples (see Deﬁnition 7), and measure the concentration of these sparse polynomials to the Gaussian.
Revised: Otherwise, we construct sparse polynomials in the sense that they can be represented by a set of O ( ` 2 k 4 ` ) basis polynomials and O ( ` k 2 ` ) coordinates of the samples (see Deﬁnition 7), and measure the concentration of these sparse polynomials to the Gaussian.

Original: Now as the underlying polynomials are sparse, we also design new sparsity-induced ﬁlters to certify the sample set, as otherwise a large amount of clean samples will be removed.
Revised: Now as the underlying polynomials are sparse, we also design new sparsity-induced ﬁlters to certify the sample set, as otherwise a large amount of clean samples will be removed.

Original: See Algorithm 3 and Algorithm 4.
Revised: See Algorithm 3 and Algorithm 4.

Original: Clustering by L 1 -norm.
Revised: Clustering by L 1 -norm.

Original: Technically, the success of our attribute-efﬁcient multiﬁltering approach hinges on a condition that all the samples lie within a small L 1 -norm ball.
Revised: Technically, the success of our attribute-efﬁcient multiﬁltering approach hinges on a condition that all the samples lie within a small L 1 -norm ball.

Original: It is not hard to see that all the Gaussian samples satisfy such condition, and we show that there is a simple scheme which can simultaneously prune and cluster the given samples into O (1 / ↵ ) groups, such that the retained samples are close under the L 1 -norm and at least one group contains most of the Gaussian samples.
Revised: It is not hard to see that all the Gaussian samples satisfy such condition, and we show that there is a simple scheme which can simultaneously prune and cluster the given samples into O (1 / ↵ ) groups, such that the retained samples are close under the L 1 -norm and at least one group contains most of the Gaussian samples.

Original: We note that the use of the L 1 -norm as our metric ensures attribute efﬁciency of this step.
Revised: We note that the use of the L 1 -norm as our metric ensures attribute efﬁciency of this step.

Original: An immediate implication of this clustering step is that the polynomials of Gaussian samples will be close enough, which facilitates the analysis of the performance of our ﬁlters.
Revised: An immediate implication of this clustering step is that the polynomials of Gaussian samples will be close enough, which facilitates the analysis of the performance of our ﬁlters.

Original: See Section 2.3.
Revised: See Section 2.3.

Original: 1.2 Related Works
Revised: 1.2 Related Works

Original: Breaking the barrier of the typical O (poly( d )) sample complexity bound is one of the central problems across many ﬁelds of science and engineering.
Revised: Breaking the barrier of the typical O (poly( d )) sample complexity bound is one of the central problems across many ﬁelds of science and engineering.

Original: Motivated by real-world applications, a property termed sparsity is often assumed for this end, meaning that only k out of the d number of attributes contribute to the underlying inference problem.
Revised: Motivated by real-world applications, a property termed sparsity is often assumed for this end, meaning that only k out of the d number of attributes contribute to the underlying inference problem.

Original: In this way, an improved bound of
Revised: In this way, an improved bound of

Original: O (poly( k, log d )) can be obtained in many inference paradigms such as linear regression [CDS98,
Revised: O (poly( k, log d )) can be obtained in many inference paradigms such as linear regression [CDS98,

Original: Tib96, CT05, Don06, SL17a, SL17b, SL18, WSL18], learning of threshold functions [Lit87, BHL95,
Revised: Tib96, CT05, Don06, SL17a, SL17b, SL18, WSL18], learning of threshold functions [Lit87, BHL95,

Original: STT12, PV13, ABHZ16, ZSA20, She20, SZ21], principal component analysis [Ma13, DKK + 19], and mean estimation [BDLS17, DKK + 19, CDK + 21].
Revised: STT12, PV13, ABHZ16, ZSA20, She20, SZ21], principal component analysis [Ma13, DKK + 19], and mean estimation [BDLS17, DKK + 19, CDK + 21].

Original: Unfortunately, the success of all these attributeefﬁcient algorithms hinges on the presumption that the majority of the data are uncorrupted.
Revised: Unfortunately, the success of all these attributeefﬁcient algorithms hinges on the presumption that the majority of the data are uncorrupted.

Original: Learning with mild corruption ( ↵ > 1 / 2 ).
Revised: Learning with mild corruption ( ↵ > 1 / 2 ).

Original: Learning in the presence of noise has been extensively studied in a broad context.
Revised: Learning in the presence of noise has been extensively studied in a broad context.

Original: In supervised learning where a sample consists of an instance (i.e. feature vector) and a label, lots of research efforts were dedicated to robust algorithms under label noise [AL87, Slo88, MN06].
Revised: In supervised learning where a sample consists of an instance (i.e. feature vector) and a label, lots of research efforts were dedicated to robust algorithms under label noise [AL87, Slo88, MN06].

Original: Recent years have witnessed signiﬁcant progress towards optimal algorithms in the presence of label noise, see for example, [KKMS05, ABL17, DKTZ20, ZSA20,
Revised: Recent years have witnessed signiﬁcant progress towards optimal algorithms in the presence of label noise, see for example, [KKMS05, ABL17, DKTZ20, ZSA20,

Original: DKK + 20b, ZS22] and the references therein.
Revised: DKK + 20b, ZS22] and the references therein.

Original: The regime that both instances and labels are corrupted turns out to be signiﬁcantly more challenging.
Revised: The regime that both instances and labels are corrupted turns out to be signiﬁcantly more challenging.

Original: The problem of learning halfspaces under such setting was put forward in the 1980s [Val85, KL88], yet only until recently have efﬁcient algorithms been established with near-optimal noise tolerance [ABL17, DKS18a, She21, SZ21].
Revised: The problem of learning halfspaces under such setting was put forward in the 1980s [Val85, KL88], yet only until recently have efﬁcient algorithms been established with near-optimal noise tolerance [ABL17, DKS18a, She21, SZ21].

Original: In addition, [BJK15,
Revised: In addition, [BJK15,

Original: KKM18, LSLC20] studied robust linear regression and [BDLS17] presented a set of interesting results under various statistical models.
Revised: KKM18, LSLC20] studied robust linear regression and [BDLS17] presented a set of interesting results under various statistical models.

Original: More in line with this work is the problem of robust mean estimation, see the breakthrough works of [DKK + 16, LRV16] and many follow-up works [DKK + 17,
Revised: More in line with this work is the problem of robust mean estimation, see the breakthrough works of [DKK + 16, LRV16] and many follow-up works [DKK + 17,

Original: BDLS17, DKS17, SCV18, KSS18, DKK + 19, HLZ20, CDK + 21].
Revised: BDLS17, DKS17, SCV18, KSS18, DKK + 19, HLZ20, CDK + 21].

Original: Learning with overwhelming corruption ( ↵  1 / 2 ).
Revised: Learning with overwhelming corruption ( ↵  1 / 2 ).

Original: The agnostic label noise of [Hau92, KSS92] seems the earliest model that allows the adversary to arbitrarily corrupt any fraction of the data (say 70% ), though it can only corrupt labels.
Revised: The agnostic label noise of [Hau92, KSS92] seems the earliest model that allows the adversary to arbitrarily corrupt any fraction of the data (say 70% ), though it can only corrupt labels.

Original: Following [CSV17], a considerate number of of recent works have studied the scenario that both instances and labels are grossly corrupted, and the goal is to output a ﬁnite list of candidate parameters among which at least one is a good approximation to the target.
Revised: Following [CSV17], a considerate number of of recent works have studied the scenario that both instances and labels are grossly corrupted, and the goal is to output a ﬁnite list of candidate parameters among which at least one is a good approximation to the target.

Original: This includes list-decodable learning of mixture models [DKS18b, DKK + 21b], regression [KKK19,
Revised: This includes list-decodable learning of mixture models [DKS18b, DKK + 21b], regression [KKK19,

Original: RY20a], and subspace recovery [RY20b, BK21].
Revised: RY20a], and subspace recovery [RY20b, BK21].

Original: Interestingly, there are some works studying the problem under crowdsourcing models, where the samples are collected from crowd workers and most of them behave adversarially [SVC16, ABHM17, MV18, ZS21].
Revised: Interestingly, there are some works studying the problem under crowdsourcing models, where the samples are collected from crowd workers and most of them behave adversarially [SVC16, ABHM17, MV18, ZS21].

Original: It is worth noting that [DKK + 22] concurrently and independently developed a polynomial-time algorithm to solve the same problem, with an interesting difference-of-pairs metric to ﬁlter outliers.
Revised: It is worth noting that [DKK + 22] concurrently and independently developed a polynomial-time algorithm to solve the same problem, with an interesting difference-of-pairs metric to ﬁlter outliers.

Original: 1.3 Roadmap
Revised: 1.3 Roadmap

Original: We collect useful notations, deﬁnitions, and some preliminary results in Section 2.
Revised: We collect useful notations, deﬁnitions, and some preliminary results in Section 2.

Original: Our main algorithms are described in Section 3 along with performance guarantees.
Revised: Our main algorithms are described in Section 3 along with performance guarantees.

Original: We conclude the work in
Revised: We conclude the work in

Original: Section 4, and defer all proof details to the appendix.
Revised: Section 4, and defer all proof details to the appendix.

Original:  Preliminaries
Revised:  Preliminaries

Original: Vector, matrix, and tensor.
Revised: Vector, matrix, and tensor.

Original: For a d -dimensional vector v = ( v 1 , . . .
Revised: For a d -dimensional vector v = ( v 1 , . . .

Original: , v d ) , denote by k v k 2 its L 2 -norm, k v k 1 its L 1 -norm, k v k 0 its L 0 -“norm” that counts the number of non-zeros, and k v kits inﬁnity norm.
Revised: , v d ) , denote by k v k 2 its L 2 -norm, k v k 1 its L 1 -norm, k v k 0 its L 0 -“norm” that counts the number of non-zeros, and k v kits inﬁnity norm.

Original: The hard thresholding operator trim k : R d !
Revised: The hard thresholding operator trim k : R d !

Original: R d keeps the k largest elements (in magnitude) of a vector and sets the remaining to zero.
Revised: R d keeps the k largest elements (in magnitude) of a vector and sets the remaining to zero.

Original: Let [ d ] := { 1 , 2 , . . .
Revised: Let [ d ] := { 1 , 2 , . . .

Original: , d } for some natural number d > 0 .
Revised: , d } for some natural number d > 0 .

Original: For an index set ⌦ ✓ [ d ] , v ⌦ is the vector of v restricted on ⌦ .
Revised: For an index set ⌦ ✓ [ d ] , v ⌦ is the vector of v restricted on ⌦ .

Original: We say a vector is k -sparse if it has at most k non-zero elements, and likewise for matrices and tensors.
Revised: We say a vector is k -sparse if it has at most k non-zero elements, and likewise for matrices and tensors.

Original: For a matrix M of size d 1 ⇥ d 2 , denote by k M k F its Frobenius norm and by k M k ⇤ its nuclear norm.
Revised: For a matrix M of size d 1 ⇥ d 2 , denote by k M k F its Frobenius norm and by k M k ⇤ its nuclear norm.

Original: For U ✓ [ d 1 ] ⇥ [ d 2 ] , denote by M U the submatrix of M with entries restricted to U .
Revised: For U ✓ [ d 1 ] ⇥ [ d 2 ] , denote by M U the submatrix of M with entries restricted to U .

Original: We also use tensors in our algorithms to ease expressions.
Revised: We also use tensors in our algorithms to ease expressions.

Original: Note that vectors and matrices can be seen as order- 1 and order- 2 tensors respectively.
Revised: Note that vectors and matrices can be seen as order- 1 and order- 2 tensors respectively.

Original: We say that an order- l tensor A is symmetric if
Revised: We say that an order- l tensor A is symmetric if

Original: A i 1 ,...,i l = A ⇡
Revised: A i 1 ,...,i l = A ⇡

Original: ( i 1 ,...,i l ) for all permutations ⇡ .
Revised: ( i 1 ,...,i l ) for all permutations ⇡ .

Original: Given two tensors A and B , denote by A ⌦ B the outer product (or tensor product) of A and B .
Revised: Given two tensors A and B , denote by A ⌦ B the outer product (or tensor product) of A and B .

Original: We will slightly abuse k
Revised: We will slightly abuse k

Original: A k 2 to denote the L 2 -norm of a tensor A by seeing it as a long vector.
Revised: A k 2 to denote the L 2 -norm of a tensor A by seeing it as a long vector.

Original: Probability.
Revised: Probability.

Original: We reserve the capital letter G for a random draw from N ( µ, I d ) , i.e. G ⇠ N ( µ, I d ) , where µ 2 R d is the target mean that we aim to estimate which is assumed to be k -sparse.
Revised: We reserve the capital letter G for a random draw from N ( µ, I d ) , i.e. G ⇠ N ( µ, I d ) , where µ 2 R d is the target mean that we aim to estimate which is assumed to be k -sparse.

Original: Suppose that T is a ﬁnite sample set.
Revised: Suppose that T is a ﬁnite sample set.

Original: We use µ T to denote the sample mean of T , i.e. µ T = 1 | T |
Revised: We use µ T to denote the sample mean of T , i.e. µ T = 1 | T |

Original: P x 2 T x , and use p ( T ) to denote the random variable p ( x ) where x is drawn uniformly from T .
Revised: P x 2 T x , and use p ( T ) to denote the random variable p ( x ) where x is drawn uniformly from T .

Original: Constants.
Revised: Constants.

Original: The capital letter C and its subscript variants such as C 1 , C 2 are used to denote positive absolute constants.
Revised: The capital letter C and its subscript variants such as C 1 , C 2 are used to denote positive absolute constants.

Original: However, their values may change from appearance to appearance.
Revised: However, their values may change from appearance to appearance.

Original: 2.1 Polynomials
Revised: 2.1 Polynomials

Original: Let x = ( x 1 , . . .
Revised: Let x = ( x 1 , . . .

Original: , x d ) be a d -dimensional vector in R d , and let a = ( a 1 , . .
Revised: , x d ) be a d -dimensional vector in R d , and let a = ( a 1 , . .

Original: . , a d ) 2 N d be a ddimensional multi-index.
Revised: . , a d ) 2 N d be a ddimensional multi-index.

Original: A monomial of x is a product of powers of the coordinates of x with natural exponents, written as x a :=
Revised: A monomial of x is a product of powers of the coordinates of x with natural exponents, written as x a :=

Original: Q d j =1 x a j j .
Revised: Q d j =1 x a j j .

Original: A polynomial of x , p ( x ) , is a ﬁnite sum of its monomials multiplied by real coefﬁcients; that is, p ( x ) =
Revised: A polynomial of x , p ( x ) , is a ﬁnite sum of its monomials multiplied by real coefﬁcients; that is, p ( x ) =

Original: P a 2 A c a x a where A ⇢ N d is a ﬁnite set of multiindices and the c a ’s are real coefﬁcients.
Revised: P a 2 A c a x a where A ⇢ N d is a ﬁnite set of multiindices and the c a ’s are real coefﬁcients.

Original: Note that the degree of p ( x ) is given by max a 2 A k a k 1 .
Revised: Note that the degree of p ( x ) is given by max a 2 A k a k 1 .

Original: We denote by P ( R d , l ) the class of polynomials on R d with degree at most l .
Revised: We denote by P ( R d , l ) the class of polynomials on R d with degree at most l .

Original: We will often use the probabilist’s Hermite polynomials that form a complete orthogonal basis with respect to N (0 , I d ) .
Revised: We will often use the probabilist’s Hermite polynomials that form a complete orthogonal basis with respect to N (0 , I d ) .

Original: Deﬁnition 5 (Hermite polynomials) .
Revised: Deﬁnition 5 (Hermite polynomials) .

Original: Let x 2 R be a variate.
Revised: Let x 2 R be a variate.

Original: For any natural number l 2 N , the degree- l Hermite polynomial is deﬁned as He l ( x ) =
Revised: For any natural number l 2 N , the degree- l Hermite polynomial is deﬁned as He l ( x ) =

Original: (  1) l e x 2 2 d l dx l e
Revised: (  1) l e x 2 2 d l dx l e

Original:  x 2 2 .
Revised:  x 2 2 .

Original: For a 2 N d and x 2 R d , the d -variate Hermite polynomial is given by He a ( x ) :=
Revised: For a 2 N d and x 2 R d , the d -variate Hermite polynomial is given by He a ( x ) :=

Original: Q di =

Revised: Q di =

Original: He a i ( x i ) , which is of degree k a k 1 .
Revised: He a i ( x i ) , which is of degree k a k 1 .

Original: Harmonic and homogeneous polynomials.
Revised: Harmonic and homogeneous polynomials.

Original: A polynomial h ( x ) 2 P ( R d , l ) is called harmonic if it can be written as a linear combination of degree- l Hermite polynomials.
Revised: A polynomial h ( x ) 2 P ( R d , l ) is called harmonic if it can be written as a linear combination of degree- l Hermite polynomials.

Original: A polynomial Hom( x )
Revised: A polynomial Hom( x )

Original: P ( R d , l ) is called homogeneous if all of its monomials have degree exactly l .
Revised: P ( R d , l ) is called homogeneous if all of its monomials have degree exactly l .

Original: Fact 6.
Revised: Fact 6.

Original: If a polynomial is degree- l harmonic or homogeneous, then there is a one-to-one mapping between it and an order- l symmetric tensor.
Revised: If a polynomial is degree- l harmonic or homogeneous, then there is a one-to-one mapping between it and an order- l symmetric tensor.

Original: To see this, we may deﬁne an operation “  ” such that He l ( x i )  He l ( x j )
Revised: To see this, we may deﬁne an operation “  ” such that He l ( x i )  He l ( x j )

Original: =
Revised: =

Original: He l ( x i ) ·
Revised: He l ( x i ) ·

Original: He l ( x j ) if i 6 = j and equals He 2 l ( x i ) otherwise.
Revised: He l ( x j ) if i 6 = j and equals He 2 l ( x i ) otherwise.

Original: Then any degree- l Hermite polynomial can be written as
Revised: Then any degree- l Hermite polynomial can be written as

Original: He 1 ( x i 1 ) 
Revised: He 1 ( x i 1 )

Original: He 1 ( x i 2 ) · · ·  He 1 ( x i l ) where all the indices i t 2 [ d ] .
Revised: He 1 ( x i 2 ) · · ·  He 1 ( x i l ) where all the indices i t 2 [ d ] .

Original: We will consider that one such sequence ( i 1 , . . .
Revised: We will consider that one such sequence ( i 1 , . . .

Original: , i l ) exactly corresponds to one degree- l Hermite polynomial on R d , and there are d l number of such sequences that form all degree- l Hermite polynomials.
Revised: , i l ) exactly corresponds to one degree- l Hermite polynomial on R d , and there are d l number of such sequences that form all degree- l Hermite polynomials.

Original: In this sense, any harmonic polynomial h ( x ) can be written as h ( x ) =
Revised: In this sense, any harmonic polynomial h ( x ) can be written as h ( x ) =

Original: P
Revised: P

Original: [Equation]
Revised: [Equation]

Original: i
Revised: i

Original: [Equation]
Revised: [Equation]

Original: 
Revised:

Original: [Equation]
Revised: [Equation]

Original: ( x
Revised: ( x

Original: [Equation]
Revised: [Equation]

Original: 2 ) · · ·  He 1 ( x i l ) , where A i 1 ,...,i l ’s are the coefﬁcients which form an order- l tensor.
Revised: 2 ) · · ·  He 1 ( x i l ) , where A i 1 ,...,i l ’s are the coefﬁcients which form an order- l tensor.

Original: If we choose A as symmetric, it is easy to see that A fully represents h ( x ) .
Revised: If we choose A as symmetric, it is easy to see that A fully represents h ( x ) .

Original: Then, we can convert “  ” back to the regular product by counting the number of times a particular index j appearing in ( i 1 , . . .
Revised: Then, we can convert “  ” back to the regular product by counting the number of times a particular index j appearing in ( i 1 , . . .

Original: , i l ) .
Revised: , i l ) .

Original: If we denote this number as c j ( i 1 , . .
Revised: If we denote this number as c j ( i 1 , . .

Original: , i l ) , we have
Revised: , i l ) , we have

Original: [Equation]
Revised: [Equation]

Original: where the factor 1 / p l ! is only used to normalize the magnitude of A to ease our analysis.
Revised: where the factor 1 / p l ! is only used to normalize the magnitude of A to ease our analysis.

Original: Likewise, any homogeneous polynomial takes the form
Revised: Likewise, any homogeneous polynomial takes the form

Original: [Equation]
Revised: [Equation]

Original: Sparse polynomials.
Revised: Sparse polynomials.

Original: In order to deﬁne sparse polynomials, we will ﬁrst specify a set of basis polynomials { b 1 , . . .
Revised: In order to deﬁne sparse polynomials, we will ﬁrst specify a set of basis polynomials { b 1 , . . .

Original: , b d l } ⇢ P ( R d , l ) .
Revised: , b d l } ⇢ P ( R d , l ) .

Original: In this paper, we will either choose such set as all degree- l monomials or all degree- l Hermite polynomials.
Revised: In this paper, we will either choose such set as all degree- l monomials or all degree- l Hermite polynomials.

Original: Deﬁnition 7 ( (  , ) -sparse polynomials) .
Revised: Deﬁnition 7 ( (  , ) -sparse polynomials) .

Original: We say that a polynomial p 2 P ( R d , l ) is (  , ) -sparse if it can be represented by at most  number of basis polynomials and coordinates of the input vector.
Revised: We say that a polynomial p 2 P ( R d , l ) is (  , ) -sparse if it can be represented by at most  number of basis polynomials and coordinates of the input vector.

Original: We denote by P ( R d , l,  , ) the class of (  , ) -sparse polynomials.
Revised: We denote by P ( R d , l,  , ) the class of (  , ) -sparse polynomials.

Original: Note that when  and l are ﬁxed, p ( x ) will depend on at most  · l coordinates.
Revised: Note that when  and l are ﬁxed, p ( x ) will depend on at most  · l coordinates.

Original: Thus, the introduction of the parameter makes sense only when   · l .
Revised: Thus, the introduction of the parameter makes sense only when   · l .

Original: In our algorithm, we will always have l  2 ` ,  = 4 ` 2 k 4 ` , and = 2 ` k 2 ` for some natural number `  1 .
Revised: In our algorithm, we will always have l  2 ` ,  = 4 ` 2 k 4 ` , and = 2 ` k 2 ` for some natural number `  1 .

Original: 2.2 Representative Set and Good Set
Revised: 2.2 Representative Set and Good Set

Original: To ease our analysis, we will need a deterministic condition on the set of uncorrupted samples.
Revised: To ease our analysis, we will need a deterministic condition on the set of uncorrupted samples.

Original: Deﬁnition 8 (Representative set) .
Revised: Deﬁnition 8 (Representative set) .

Original: Given ↵ 2 (0 , 12 ] and ⌧ 2 (0 , 1) , we say that a sample set S G ⇢ R d is representative with respect to P :=
Revised: Given ↵ 2 (0 , 12 ] and ⌧ 2 (0 , 1) , we say that a sample set S G ⇢ R d is representative with respect to P :=

Original: P ( R d , 2 ` , 4 ` 2 k 4 ` , 2 ` k 2 ` ) if the following holds:
Revised: P ( R d , 2 ` , 4 ` 2 k 4 ` , 2 ` k 2 ` ) if the following holds:

Original: [Equation]
Revised: [Equation]

Original: We show that a sufﬁciently large set drawn independently from N ( µ, I d ) is representative.
Revised: We show that a sufﬁciently large set drawn independently from N ( µ, I d ) is representative.

Original: The proof follows from the classic VC theory, and is deferred to Appendix A.1.
Revised: The proof follows from the classic VC theory, and is deferred to Appendix A.1.

Original: Proposition 9 (Sample complexity) .
Revised: Proposition 9 (Sample complexity) .

Original: Given ↵ 2 (0 , 12 ] and ⌧ 2 (0 , 1) , let S G be a set consisting of | S G | = 
Revised: Given ↵ 2 (0 , 12 ] and ⌧ 2 (0 , 1) , let S G be a set consisting of | S G | = C · ( l ·  + )log d ✏log

Original: [Equation]
Revised: [Equation]

Original: log l ·  ✏⌧ independent samples from N ( µ, I d ) where C > 0 is a sufﬁciently large absolute constant.
Revised: l · [Equation] ✏⌧ independent samples from N ( µ, I d ) where C > 0 is a sufﬁciently large absolute constant.

Original: Then, with probability 1  ⌧ ,
Revised: Then, with probability 1  ⌧ ,

Original: [Equation]
Revised: [Equation]

Original: In particular, when l = 2 ` ,  = 4 ` 2 k 4 ` , = 2 ` k 2 ` , and ✏ = ↵ 3 100 k 2 ` · log 2 ` ( ` d ↵⌧ ) for some natural number `  1 , it sufﬁces to pick | S G | = C 0 · ` 7 · k 14 ` ↵· log 8 ` ( ` d ↵⌧ ) for
Revised: In particular, when l = 2 ` ,  = 4 ` 2 k 4 ` , = 2 ` k 2 ` , and ✏ = ↵ 3 100 k 2 ` · log 2 ` ( ` d ↵⌧ ) for some natural number `  1 , it sufﬁces to pick | S G | = C 0 · ` 4 · k 8 ` ↵ 6 · log 6 ` ( ` d ↵⌧ ) for

Original: some sufﬁciently large constant
Revised: some sufﬁciently large constant

Original: C 0 so that S G is a representative set.
Revised: C 0 so that S G is a representative set.

Original: Our algorithm will progressively remove samples from T , and a key property that ensures the success of the algorithm is that most corrupted samples are eliminated while almost all uncorrupted samples are retained.
Revised: Our algorithm will progressively remove samples from T , and a key property that ensures the success of the algorithm is that most corrupted samples are eliminated while almost all uncorrupted samples are retained.

Original: Alternatively, we hope that T contains a representative set that contributes to a nontrivial fraction.
Revised: Alternatively, we hope that T contains a representative set that contributes to a nontrivial fraction.

Original: For technical reasons, we also require that all samples in T lie in a small L 1 -ball.
Revised: For technical reasons, we also require that all samples in T lie in a small L 1 -ball.

Original: Deﬁnition 10 ( ↵ -good set) .
Revised: Deﬁnition 10 ( ↵ -good set) .

Original: A multiset T ⇢ R d is ↵ -good if the following holds:
Revised: A multiset T ⇢ R d is ↵ -good if the following holds:

Original: There exists a set S G which is representative and satisﬁes | S G \ T |  max { (1  ↵ / 6) | S G | , ↵ | T |} .
Revised: There exists a set S G which is representative and satisﬁes | S G \ T |  max { (1  ↵ / 6) | S G | , ↵ | T |} .

Original: max x,y 2 T k x  y k 1  C · p log( d | S G | / ⌧ ) for some constant C > 0 .
Revised: max x,y 2 T k x  y k 1  C · p log( d | S G | / ⌧ ) for some constant C > 0 .

Original: It is not hard to verify that the initial sample set T satisﬁes the ﬁrst condition, and will also fulﬁll the second one with a simple data pre-processing, as stated in the next section.
Revised: It is not hard to verify that the initial sample set T satisﬁes the ﬁrst condition, and will also fulﬁll the second one with a simple data pre-processing, as stated in the next section.

Original: 2.3 Clustering for the Initial List
Revised: 2.3 Clustering for the Initial List

Original: Since the corrupted samples may behave adversarially, we will perform a preliminary step of clustering which splits T into an initial list of subsets, among which at least one is ↵ -good in the sense of
Revised: Since the corrupted samples may behave adversarially, we will perform a preliminary step of clustering which splits T into an initial list of subsets, among which at least one is ↵ -good in the sense of

Original: Deﬁnition 10.
Revised: Deﬁnition 10.

Original: We ﬁrst show that all Gaussian samples have bounded L 1 -norm with high probability, which simply follows from the Gaussian tail bound.
Revised: We ﬁrst show that all Gaussian samples have bounded L 1 -norm with high probability, which simply follows from the Gaussian tail bound.

Original: Lemma 11.
Revised: Lemma 11.

Original: Given ⌧ 2 (0 , 1) , with probability 1  ⌧ , we have max x 2 S G k x µ k 1 
Revised: Given ⌧ 2 (0 , 1) , with probability 1  ⌧ , we have max x 2 S G k x

Original: [Equation]
Revised: [Equation]

Original: where S G is a set of samples drawn independently from N ( µ, I d ) .
Revised: where S G is a set of samples drawn independently from N ( µ, I d ) .

Original: The above observation implies that for any x, y 2 S G , their distance under the L 1 -norm metric is at most
Revised: The above observation implies that for any x, y 2 S G , their distance under the L 1 -norm metric is at most

Original: [Equation]
Revised: [Equation]

Original:  as far as the size of S G has the same order with the one in Proposition 9.
Revised:  as far as the size of S G has the same order with the one in Proposition 9.

Original: To guarantee the existence of such S G , it sufﬁces to draw a corrupted sample set T that is 1 / ↵ times larger than | S G | .
Revised: To guarantee the existence of such S G , it sufﬁces to draw a corrupted sample set T that is 1 / ↵ times larger than | S G | .

Original: The lemma below further shows that this is sufﬁcient to guarantee the existence of an ↵ -good subset of T .
Revised: The lemma below further shows that this is sufﬁcient to guarantee the existence of an ↵ -good subset of T .

Original: Require: A multiset of samples T ⇢ R d , parameter ↵ 2 (0 , 1 / 2] , failure probability ⌧ 2 (0 , 1) , degree of polynomials `  1 .
Revised: Require: A multiset of samples T ⇢ R d , parameter ↵ 2 (0 , 1 / 2] , failure probability ⌧ 2 (0 , 1) , degree of polynomials `  1 .

Original: { T 1 , . . .
Revised: { T 1 , . . .

Original: , T |C| } .
Revised: , T |C| } .

Original: Lemma 12 (C LUSTER ) .
Revised: Lemma 12 (C LUSTER ) .

Original: Given ↵ 2 (0 , 12 ] and ⌧ 2 (0 , 1) , let T be the sample set given to the learner.
Revised: Given ↵ 2 (0 , 12 ] and ⌧ 2 (0 , 1) , let T be the sample set given to the learner.

Original: If | T | =
Revised: If | T | =

Original: C · ` 7 · k 14 ` ↵· log 8 ` ( ` d ↵⌧ ) and a (2 ↵ ) -fraction are independent samples from N ( µ, I d ) ,
Revised: C · ` 7 · k 14 ` ↵· log 8 ` ( ` d ↵⌧ ) and a (2 ↵ ) -fraction are independent samples from N ( µ, I d ) ,

Original: Algorithm 1 returns a list of at most 1 / ↵ many subsets of T , such that with probability at least 1  ⌧ , at least one of them is an ↵ -good set.
Revised: Algorithm 1 returns a list of at most 1 / ↵ many subsets of T , such that with probability at least 1  ⌧ , at least one of them is an ↵ -good set.

Original: As will be clear in our analysis, the motivation of bounding the L 1 -distance is to make sure that the function value of any p ( x ) =
Revised: As will be clear in our analysis, the motivation of bounding the L 1 -distance is to make sure that the function value of any p ( x ) =

Original: h A ( x  µ T ) 2 P
Revised: h A ( x  µ T ) 2 P

Original: ( R d , l,  , ) is bounded for samples in the ↵ -good subset T i .
Revised: ( R d , l,  , ) is bounded for samples in the ↵ -good subset T i .

Original: This is because when there exist a signiﬁcant fraction of good samples in T i , we want to efﬁciently distinguish the corrupted and uncorrupted ones.
Revised: This is because when there exist a signiﬁcant fraction of good samples in T i , we want to efﬁciently distinguish the corrupted and uncorrupted ones.

Original: A value-bounded polynomial function will facilitate our analysis on the function variance.
Revised: A value-bounded polynomial function will facilitate our analysis on the function variance.

Original: Lemma 13.
Revised: Lemma 13.

Original: Suppose that T is ↵ -good and a polynomial p 2 P ( R d , l, 4 ` 2 k 4 ` , 2 ` k 2 ` ) satisﬁes the following: there exists a symmetric order- l tensor A such that k A k 2  1 and p ( x ) =
Revised: Suppose that T is ↵ -good and a polynomial p 2 P ( R d , l, 4 ` 2 k 4 ` , 2 ` k 2 ` ) satisﬁes the following: there exists a symmetric order- l tensor A such that k A k 2  1 and p ( x ) =

Original: h A ( x  µ T ) .
Revised: h A ( x  µ T ) .

Original: Then, it holds that max x,y 2 T | p ( x )  p ( y ) |  2 k ` ·  l , where  = C 0 · q ` · log( ` d ↵⌧ ) .
Revised: Then, it holds that max x,y 2 T | p ( x )  p ( y ) |  2 k ` ·  l , where  = C 0 · q ` · log( ` d ↵⌧ ) .

Original:  Main Algorithms and Performance Guarantees
Revised:  Main Algorithms and Performance Guarantees

Original: We start with a review of the multiﬁltering framework that has been broadly used in prior works [DKS18b, DKK20a, DKK + 21b], followed by a highlight of our new techniques.
Revised: We start with a review of the multiﬁltering framework that has been broadly used in prior works [DKS18b, DKK20a, DKK + 21b], followed by a highlight of our new techniques.

Original: The multiﬁltering framework, i.e. Algorithm 2, includes three major steps.
Revised: The multiﬁltering framework, i.e. Algorithm 2, includes three major steps.

Original: The ﬁrst step is to invoke
Revised: The ﬁrst step is to invoke

Original: C LUSTER (Algorithm 1) to generate an initial list L which guarantees the existence of an ↵ -good subset of T (see Lemma 12).
Revised: C LUSTER (Algorithm 1) to generate an initial list L which guarantees the existence of an ↵ -good subset of T (see Lemma 12).

Original: We then imagine that there is a tree with root being the original contaminated sample set T and each child node of the root represents a member in L .
Revised: We then imagine that there is a tree with root being the original contaminated sample set T and each child node of the root represents a member in L .

Original: The algorithm iterates through these child nodes and performs one of the following: (1) creating a leaf node which is an estimate of the target mean; (2) creating one or two child nodes where are subsets of the parent node; (3) certifying that the set cannot be ↵ -good and delete branch.
Revised: The algorithm iterates through these child nodes and performs one of the following: (1) creating a leaf node which is an estimate of the target mean; (2) creating one or two child nodes where are subsets of the parent node; (3) certifying that the set cannot be ↵ -good and delete branch.

Original: In the end, if all leaves of the tree cannot be further split or deleted, the mean of the subsets on leaf nodes will be collected as a list M .
Revised: In the end, if all leaves of the tree cannot be further split or deleted, the mean of the subsets on leaf nodes will be collected as a list M .

Original: It is worth noting that the goal of algorithmic design is to guarantee that there always exists a branch that includes only ↵ -good subsets.
Revised: It is worth noting that the goal of algorithmic design is to guarantee that there always exists a branch that includes only ↵ -good subsets.

Original: In other words, at any level of the algorithm, at least one of the subsets of T is ↵ -good, which ensures the existence of a good estimation in the returned list M .
Revised: In other words, at any level of the algorithm, at least one of the subsets of T is ↵ -good, which ensures the existence of a good estimation in the returned list M .

Original: The ﬁnal step is a black-box algorithm that reduces the size of M from O (poly(1 / ↵ )) to O (1 / ↵ ) , which is due to [DKS18b].
Revised: The ﬁnal step is a black-box algorithm that reduces the size of M from O (poly(1 / ↵ )) to O (1 / ↵ ) , which is due to [DKS18b].

Original: Our technical contributions lie into an attribute-efﬁcient implementation of the ﬁrst and second steps.
Revised: Our technical contributions lie into an attribute-efﬁcient implementation of the ﬁrst and second steps.

Original: In this section, we elaborate on the second step, i.e. the
Revised: In this section, we elaborate on the second step, i.e. the

Original: A TTRIBUTE - EFFICIENT -M ULTIFILTER algorithm.
Revised: A TTRIBUTE - EFFICIENT -M ULTIFILTER algorithm.

Original: 3.1 Overview of Attribute-Efﬁcient Multiﬁltering
Revised: 3.1 Overview of Attribute-Efﬁcient Multiﬁltering

Original: The A TTRIBUTE - EFFICIENT -M ULTIFILTER algorithm is presented in Algorithm 3.
Revised: The A TTRIBUTE - EFFICIENT -M ULTIFILTER algorithm is presented in Algorithm 3.

Original: The starting point of the algorithm is a well-known fact that if the adversary were to signiﬁcantly deteriorate our estimate on µ , the spectral norm of a certain sample covariance matrix ˜ ⌃ would become large [DKK + 16, LRV16].
Revised: The starting point of the algorithm is a well-known fact that if the adversary were to signiﬁcantly deteriorate our estimate on µ , the spectral norm of a certain sample covariance matrix ˜ ⌃ would become large [DKK + 16, LRV16].

Original: In order to achieve attribute-efﬁcient sample complexity O (poly( k, log d )) , it is however vital to control the spectral norm only on k ` -sparse directions for some pre-speciﬁed polynomial degree `  1 , which can further be certiﬁed by a small Frobenius norm restricted on the largest k 2 ` entries.
Revised: In order to achieve attribute-efﬁcient sample complexity O (poly( k, log d )) , it is however vital to control the spectral norm only on k ` -sparse directions for some pre-speciﬁed polynomial degree `  1 , which can further be certiﬁed by a small Frobenius norm restricted on the largest k 2 ` entries.

Original: If the restricted Frobenius norm is sufﬁciently small, it implies that the sample covariance matrix behaves as a Gaussian one, and the algorithm returns the empirical mean truncated to be k -sparse
Revised: If the restricted Frobenius norm is sufﬁciently small, it implies that the sample covariance matrix behaves as a Gaussian one, and the algorithm returns the empirical mean truncated to be k -sparse

Original: (see Step 4).
Revised: (see Step 4).

Original: Otherwise, the algorithm will invoke either B ASIC MF (i.e. Algorithm 4)
Revised: Otherwise, the algorithm will invoke either B ASIC MF (i.e. Algorithm 4)

Original: Algorithm
Revised: Algorithm

Original: Require: A multiset of samples T ⇢ R d , parameter ↵ 2 (0 , 1 / 2] , failure probability ⌧ 2 (0 , 1) , degree of polynomials `  1 .
Revised: Require: A multiset of samples T ⇢ R d , parameter ↵ 2 (0 , 1 / 2] , failure probability ⌧ 2 (0 , 1) , degree of polynomials `  1 .

Original: 1: { T 1 , . . .
Revised: 1: { T 1 , . . .

Original: , T m }
Revised: , T m }

Original: C LUSTER ( T, ↵ , ⌧ , ` ) , L { ( T 1 , ↵ / 2) , . .
Revised: C LUSTER ( T, ↵ , ⌧ , ` ) , L { ( T 1 , ↵ / 2) , . .

Original: , ( T m , ↵ / 2) } , M ; .
Revised: , ( T m , ↵ / 2) } , M ; .

Original: 2: while L 6 = ; do 3: ( T 0 , ↵ 0 ) an element in L , L
Revised: 2: while L 6 = ; do 3: ( T 0 , ↵ 0 ) an element in L , L

Original: L\{ ( T 0 , ↵ 0 ) } . 4:
Revised: L\{ ( T 0 , ↵ 0 ) } . 4:

Original: ANS
Revised: ANS

Original: A TTRIBUTE - EFFICIENT -M ULTIFILTER ( T 0 , ↵ 0 , ⌧ / | T | , ` ) .
Revised: A TTRIBUTE - EFFICIENT -M ULTIFILTER ( T 0 , ↵ 0 , ⌧ / | T | , ` ) .

Original: i)
Revised: i)

Original: M .
Revised: M .

Original: ) if
Revised: ) if

Original: 5: end while 6: return L IST R EDUCTION ( T, ↵ , ` , M ) .
Revised: 5: end while 6: return L IST R EDUCTION ( T, ↵ , ` , M ) .

Original: Require: A multiset of samples T ⇢ R d , parameter ↵ 2 (0 , 1 / 2] , failure probability ⌧ 2 (0 , 1) , degree of polynomials `  1 .
Revised: Require: A multiset of samples T ⇢ R d , parameter ↵ 2 (0 , 1 / 2] , failure probability ⌧ 2 (0 , 1) , degree of polynomials `  1 .

Original: 1: ˜ ⌃
Revised: 1: ˜ ⌃

Original: E [ P d, ` ( T  µ T ) · P d, ` ( T  µ T ) > ] , and P d, ` ( x ) is the column vector of all degree- ` Hermite polynomials of x .
Revised: E [ P d, ` ( T  µ T ) · P d, ` ( T  µ T ) > ] , and P d, ` ( x ) is the column vector of all degree- ` Hermite polynomials of x .

Original: 2: { ( i t , j t ) } 12 ( k 2 ` + k ` ) t index set of the k ` diagonal entries and 12 ( k 2 `  k ` ) entries above the main diagonal of ˜ ⌃ with largest magnitude.
Revised: 2: { ( i t , j t ) } 12 ( k 2 ` + k ` ) t index set of the k ` diagonal entries and 12 ( k 2 `  k ` ) entries above the main diagonal of ˜ ⌃ with largest magnitude.

Original: U { ( i t , j t ) } t  1 [ { ( j t , i t ) } t  1 , U
Revised: U { ( i t , j t ) } t  1 [ { ( j t , i t ) } t  1 , U

Original: I ⇥ I , with I
Revised: I ⇥ I , with I

Original: = { i t } t  1 [ { j t or H ARMONIC MF (i.e. Algortihm 5) to examine the concentration of a polynomial of the empirical data to that of Gaussian.
Revised: = { i t } t  1 [ { j t or H ARMONIC MF (i.e. Algortihm 5) to examine the concentration of a polynomial of the empirical data to that of Gaussian.

Original: Both algorithms will either assert that the current sample set does not contain a sufﬁciently large amount of Gaussian samples, or will prune many corrupted samples to increase the fraction of Gaussian ones.
Revised: Both algorithms will either assert that the current sample set does not contain a sufﬁciently large amount of Gaussian samples, or will prune many corrupted samples to increase the fraction of Gaussian ones.

Original: A more detailed description of the two algorithms can be found in
Revised: A more detailed description of the two algorithms can be found in

Original: Section 3.2.1 and Section 3.2.2 respectively.
Revised: Section 3.2.1 and Section 3.2.2 respectively.

Original: What is subtle in Algorithm 3 is that we will check the maximum eigenvalue  ⇤ of the empirical covariance matrix ˜ ⌃ restricted on a carefully chosen subset U 0 , which corresponds to the maximum eigenvalue on a certain (2 k 2 ` ) -sparse direction.
Revised: What is subtle in Algorithm 3 is that we will check the maximum eigenvalue  ⇤ of the empirical covariance matrix ˜ ⌃ restricted on a carefully chosen subset U 0 , which corresponds to the maximum eigenvalue on a certain (2 k 2 ` ) -sparse direction.

Original: If  ⇤ is too large, this indicates an easy problem since it must be the case that the adversary corrupted the samples in an aggressively way.
Revised: If  ⇤ is too large, this indicates an easy problem since it must be the case that the adversary corrupted the samples in an aggressively way.

Original: Therefore, it sufﬁces to prune outliers using a degree- ` polynomial p 1 which is simply the projection of P d, ` ( x  µ T ) onto the span of the maximum eigenvector; see
Revised: Therefore, it sufﬁces to prune outliers using a degree- ` polynomial p 1 which is simply the projection of P d, ` ( x  µ T ) onto the span of the maximum eigenvector; see

Original: Step 7 in Algorithm 3.
Revised: Step 7 in Algorithm 3.

Original: On the other hand, if  ⇤ is on a moderate scale, it indicates that the adversary corrupted the samples in a very delicate way so that it passes the tests of both Frobenius norm and spectral norm.
Revised: On the other hand, if  ⇤ is on a moderate scale, it indicates that the adversary corrupted the samples in a very delicate way so that it passes the tests of both Frobenius norm and spectral norm.

Original: Now the main idea is to check the concentration of higher degree polynomials induced by the sample set; we show that it sufﬁces to construct a degree- 2 ` harmonic polynomial; see Step 10.
Revised: Now the main idea is to check the concentration of higher degree polynomials induced by the sample set; we show that it sufﬁces to construct a degree- 2 ` harmonic polynomial; see Step 10.

Original: While sparse mean estimation has been studied in [DKK + 19] and the idea of using restricted
Revised: While sparse mean estimation has been studied in [DKK + 19] and the idea of using restricted

Original: Frobenius norm and ﬁltering was also developed, we note that their analysis only holds in the mild corruption regime where ↵ > 1 / 2 .
Revised: Frobenius norm and ﬁltering was also developed, we note that their analysis only holds in the mild corruption regime where ↵ > 1 / 2 .

Original: To establish the main results, we will leverage the tools from [DKS18b], with a speciﬁc treatment on the fact that µ is k -sparse, to ensure an attribute-efﬁcient sample complexity bound.
Revised: To establish the main results, we will leverage the tools from [DKS18b], with a speciﬁc treatment on the fact that µ is k -sparse, to ensure an attribute-efﬁcient sample complexity bound.

Original: As we will show later, a key idea to this end is to utilize a sequence of carefully chosen sparse polynomials in the sense of Deﬁnition 7 along with sparsity-induced ﬁlters.
Revised: As we will show later, a key idea to this end is to utilize a sequence of carefully chosen sparse polynomials in the sense of Deﬁnition 7 along with sparsity-induced ﬁlters.

Original: The performance guarantee of A TTRIBUTE - EFFICIENT -M ULTIFILTER is as follows.
Revised: The performance guarantee of A TTRIBUTE - EFFICIENT -M ULTIFILTER is as follows.

Original: Theorem 14 (Algorithm 3) .
Revised: Theorem 14 (Algorithm 3) .

Original: Consider Algorithm 3 and denote by ANS its output.
Revised: Consider Algorithm 3 and denote by ANS its output.

Original: With probability 1  ⌧ , the following holds.
Revised: With probability 1  ⌧ , the following holds.

Original: ANS cannot be TBD .
Revised: ANS cannot be TBD .

Original: If ANS is a k -sparse vector and if T is ↵ -good, then k µ  ˆ µ k
Revised: If ANS is a k -sparse vector and if T is ↵ -good, then k µ  ˆ µ k

Original: [Equation]
Revised: [Equation]

Original: 
Revised: 

Original: [Equation]
Revised: [Equation]

Original: O
Revised: O

Original: [Equation]
Revised: [Equation]

Original:  .
Revised:  .

Original: If ANS =
Revised: If ANS =

Original: NO , then T is not ↵ -good.
Revised: NO , then T is not ↵ -good.

Original: If ANS =
Revised: If ANS =

Original: ( T i , ↵ i ) } mi =1 for some m  2 , then T i ⇢ T for all
Revised: ( T i , ↵ i ) } mi =1 for some m  2 , then T i ⇢ T for all

Original: i 2 [ m ] and
Revised: i 2 [ m ] and

Original: P mi =1 1 ↵ 2 i  1 ↵ 2 ; if additionally T is ↵ -good, then at least one T i is ↵ i -good.
Revised: P mi =1 1 ↵ 2 i  1 ↵ 2 ; if additionally T is ↵ -good, then at least one T i is ↵ i -good.

Original: Finally, the algorithm runs in time O  poly( | T | , d ` )  .
Revised: Finally, the algorithm runs in time O  poly( | T | , d ` )  .

Original: 3.2 Analysis of A TTRIBUTE - EFFICIENT -M ULTIFILTER
Revised: 3.2 Analysis of A TTRIBUTE - EFFICIENT -M ULTIFILTER

Original: We ﬁrst show that if the restricted Frobenius norm of the sample covariance matrix is small, then the sample mean is a good estimate of the target mean.
Revised: We ﬁrst show that if the restricted Frobenius norm of the sample covariance matrix is small, then the sample mean is a good estimate of the target mean.

Original: Lemma 15.
Revised: Lemma 15.

Original: Consider Algorithm 3.
Revised: Consider Algorithm 3.

Original: If the algorithm returns a vector ˆ µ at Step 4 and if T is ↵ -good, we have that k ˆ µ  µ k 2 
Revised: If the algorithm returns a vector ˆ µ at Step 4 and if T is ↵ -good, we have that k ˆ µ  µ k 2 

Original: O
Revised: O

Original: [Equation]
Revised: [Equation]

Original: 
Revised:

Original: [Equation]
Revised: [Equation]

Original: Next, we give performance guarantees on the remaining steps of Algorithm 3, where we consider the case that the algorithm does not return at Step 4.
Revised: Next, we give performance guarantees on the remaining steps of Algorithm 3, where we consider the case that the algorithm does not return at Step 4.

Original: Namely, the algorithm will either reach at Stepor Step 10, and will return the ANS obtained thereof.
Revised: Namely, the algorithm will either reach at Stepor Step 10, and will return the ANS obtained thereof.

Original: These two steps will invoke B ASIC MF or
Revised: These two steps will invoke B ASIC MF or

Original: H ARMONIC MF on different sparse polynomials.
Revised: H ARMONIC MF on different sparse polynomials.

Original: Observe that both algorithms may return 1) “ NO ”, which certiﬁes that the current input set T is not ↵ -good; 2) a list of subsets { ( T i , ↵ i ) } mi =1 for some m  2 , on which Algorithm 3 will be called in a recursive manner; or 3) TBD , which indicates that the algorithm is uncertain on T being ↵ -good.
Revised: Observe that both algorithms may return 1) “ NO ”, which certiﬁes that the current input set T is not ↵ -good; 2) a list of subsets { ( T i , ↵ i ) } mi =1 for some m  2 , on which Algorithm 3 will be called in a recursive manner; or 3) TBD , which indicates that the algorithm is uncertain on T being ↵ -good.

Original: In the following, we prove that the way that we invoke
Revised: In the following, we prove that the way that we invoke

Original: B ASIC MF and H ARMONIC MF ensures that they will never return TBD when being called within
Revised: B ASIC MF and H ARMONIC MF ensures that they will never return TBD when being called within

Original: Algorithm 3.
Revised: Algorithm 3.

Original: We then give performance guarantees on these two ﬁltering algorithms when they return “ NO ” or { ( T i , ↵ i ) } mi =1 , thus establishing Theorem 14.
Revised: We then give performance guarantees on these two ﬁltering algorithms when they return “ NO ” or { ( T i , ↵ i ) } mi =1 , thus establishing Theorem 14.

Original: Let us consider that the algorithm reaches Step 7, i.e. the largest eigenvalue on one sparse direction is larger than the threshold  ⇤ sparse .
Revised: Let us consider that the algorithm reaches Step 7, i.e. the largest eigenvalue on one sparse direction is larger than the threshold  ⇤ sparse .

Original: It is easy to see that when ` = 1 , ANS cannot be TBD since the only way that B ASIC MF returns TBD is when Var[ p ( T )] is not too large, but this would violate the condition that  ⇤ >
Revised: It is easy to see that when ` = 1 , ANS cannot be TBD since the only way that B ASIC MF returns TBD is when Var[ p ( T )] is not too large, but this would violate the condition that  ⇤ >

Original:  ⇤ sparse in view of our setting on  ⇤ sparse .
Revised:  ⇤ sparse in view of our setting on  ⇤ sparse .

Original: Similarly, we show that under the large  ⇤ regime, H ARMONIC MF will not return TBD either.
Revised: Similarly, we show that under the large  ⇤ regime, H ARMONIC MF will not return TBD either.

Original: Thus, we have the following lemma.
Revised: Thus, we have the following lemma.

Original: Lemma 16.
Revised: Lemma 16.

Original: Consider Algorithm 3.
Revised: Consider Algorithm 3.

Original: If it reaches Step 7, then ANS 6 = TBD .
Revised: If it reaches Step 7, then ANS 6 = TBD .

Original: Now it remains to consider the case that the algorithm reaches Step 10, which is more subtle since the evidence from the magnitude of the largest restricted eigenvalue is not so strong to prune outliers.
Revised: Now it remains to consider the case that the algorithm reaches Step 10, which is more subtle since the evidence from the magnitude of the largest restricted eigenvalue is not so strong to prune outliers.

Original: Note that this could happen even when T contains many outliers, since  ⇤ is not the maximum eigenvalue on all sparse directions but on a submatrix indexed by U 0 .
Revised: Note that this could happen even when T contains many outliers, since  ⇤ is not the maximum eigenvalue on all sparse directions but on a submatrix indexed by U 0 .

Original: Fortunately, if  ⇤ is not large, we show that the algorithm can still make progress by calling H ARMONIC MF on degree- 2 ` sparse polynomials.
Revised: Fortunately, if  ⇤ is not large, we show that the algorithm can still make progress by calling H ARMONIC MF on degree- 2 ` sparse polynomials.

Original: This is because higher-degree polynomials are more sensitive to outliers than low-degree polynomials, as far as we can certify the concentration of high-degree polynomials on clean samples.
Revised: This is because higher-degree polynomials are more sensitive to outliers than low-degree polynomials, as far as we can certify the concentration of high-degree polynomials on clean samples.

Original: As a result, we will have the following guarantee.
Revised: As a result, we will have the following guarantee.

Original: Lemma 17.
Revised: Lemma 17.

Original: Consider Algorithm 3.
Revised: Consider Algorithm 3.

Original: If it reaches Step 10, then ANS 6 = TBD .
Revised: If it reaches Step 10, then ANS 6 = TBD .

Original: 3.2.1 Basic Multiﬁlter for Sparse Polynomials
Revised: 3.2.1 Basic Multiﬁlter for Sparse Polynomials

Original: The B ASIC MF algorithm (Algorithm 4) is a key ingredient in the multiﬁltering framework.
Revised: The B ASIC MF algorithm (Algorithm 4) is a key ingredient in the multiﬁltering framework.

Original: It takes as input a sparse polynomial p and uses it to certify whether T is ↵ -good and sufﬁciently concentrated.
Revised: It takes as input a sparse polynomial p and uses it to certify whether T is ↵ -good and sufﬁciently concentrated.

Original: The central idea is to measure how p ( T ) distributed and compare it to that of the distribution of p ( G ) .
Revised: The central idea is to measure how p ( T ) distributed and compare it to that of the distribution of p ( G ) .

Original: We require the input p has certiﬁable variance on G , i.e. Var[ p ( G )]  1 , as otherwise, it could ﬁlter away a large number of the good samples.
Revised: We require the input p has certiﬁable variance on G , i.e. Var[ p ( G )]  1 , as otherwise, it could ﬁlter away a large number of the good samples.

Original: We note that the bounded variance condition is always satisﬁed for degree- 1 Hermite polynomials under proper normalization, while for high-degree polynomials, one cannot invoke B ASIC MF directly (see Section 3.2.2 for a remedy).
Revised: We note that the bounded variance condition is always satisﬁed for degree- 1 Hermite polynomials under proper normalization, while for high-degree polynomials, one cannot invoke B ASIC MF directly (see Section 3.2.2 for a remedy).

Original: The way that B ASIC MF certiﬁes the input sample set T not being ↵ -good is quite simple: if not all samples lie in a small L 1 -ball, it returns “ NO ” at Step 2, in that this contradicts Lemma 13.
Revised: The way that B ASIC MF certiﬁes the input sample set T not being ↵ -good is quite simple: if not all samples lie in a small L 1 -ball, it returns “ NO ” at Step 2, in that this contradicts Lemma 13.

Original: Otherwise, the algorithm will attempt to search for a ﬁner interval [ a, b ] such that it includes most of the samples.
Revised: Otherwise, the algorithm will attempt to search for a ﬁner interval [ a, b ] such that it includes most of the samples.

Original: If such interval exists, then either the adversary corrupted the samples such that the sample variance is as small as that of Gaussian while the sample mean may deviate far from the target, in which case B ASIC MF returns TBD at Step 5; or the sample variance is large, in which case
Revised: If such interval exists, then either the adversary corrupted the samples such that the sample variance is as small as that of Gaussian while the sample mean may deviate far from the target, in which case B ASIC MF returns TBD at Step 5; or the sample variance is large, in which case

Original: Algorithm
Revised: Algorithm

Original: Require: A multiset of samples T ⇢ R d , parameter ↵ 2 (0 , 1 / 2] , failure probability ⌧ 2 (0 , 1) , a polynomial p 2 P ( R d , l, 4 ` 2 k 4 ` , 2 ` k 2 ` ) such that l  2 ` , Var[ p ( G )]  1 , and p ( x ) =
Revised: Require: A multiset of samples T ⇢ R d , parameter ↵ 2 (0 , 1 / 2] , failure probability ⌧ 2 (0 , 1) , a polynomial p 2 P ( R d , l, 4 ` 2 k 4 ` , 2 ` k 2 ` ) such that l  2 ` , Var[ p ( G )]  1 , and p ( x ) =

Original: h A ( x  µ T ) .
Revised: h A ( x  µ T ) .

Original: 1: R ( C 1 · log 1 ↵ ) l/ 2 , 
Revised: 1: R ( C 1 · log 1 ↵ ) l/ 2 ,

Original: C 0 · q ` · log ` d ↵⌧ .
Revised: C 0 · q ` · log ` d ↵⌧ .

Original: 2: if max x,y 2 T | p ( x )  p ( y ) | > 2 k ` ·  l then return “ NO ”.
Revised: 2: if max x,y 2 T | p ( x )  p ( y ) | > 2 k ` ·  l then return “ NO ”.

Original: 3: if there is an interval [ a, b ] of length C 1 · R · log(2 + log 1 ↵ ) that contains at least (1  ↵ 2 ) -fraction of samples in { p ( x ) : x 2 T } then 4:
Revised: 3: if there is an interval [ a, b ] of length C 1 · R · log(2 + log 1 ↵ ) that contains at least (1  ↵ 2 ) -fraction of samples in { p ( x ) : x 2 T } then 4:

Original: if Var[ p ( T )]  C 1 ·  ` + C 1 log 1 ↵  l · log 2 (2 + log 1 ↵ ) then 5: return “ TBD ”.
Revised: if Var[ p ( T )]  C 1 ·  ` + C 1 log 1 ↵  l · log 2 (2 + log 1 ↵ ) then 5: return “ TBD ”.

Original: 6: else 7:
Revised: 6: else 7:

Original: Find a threshold t > 2 R such that
Revised: Find a threshold t > 2 R such that

Original: [Equation]
Revised: [Equation]

Original: R ) 2 /
Revised: R ) 2 /

Original: [Equation]
Revised: [Equation]

Original: ) + 2 ↵k
Revised: ) + 2 ↵k

Original: [Equation]
Revised: [Equation]

Original: log l (
Revised: log l (

Original: [Equation]
Revised: [Equation]

Original: d
Revised: d

Original: [Equation]
Revised: [Equation]

Original: T{ x 2 T : min {| p ( x )  a | , | p ( x )  b
Revised: T{ x 2 T : min {| p ( x )  a | , | p ( x )  b

Original: [Equation]
Revised: [Equation]

Original:  t
Revised:  t

Original: [Equation]
Revised: [Equation]

Original: , ↵↵
Revised: , ↵↵

Original: [Equation]
Revised: [Equation]

Original: ⇣ (1  ↵ /
Revised: ⇣ (1  ↵ /

Original: [Equation]
Revised: [Equation]

Original: | T | | T 0 | + ↵⌘ .
Revised: | T | | T 0 | + ↵⌘ .

Original: 9: return { ( T 0 , ↵ 0 ) } .
Revised: 9: return { ( T 0 , ↵ 0 ) } .

Original: 10: end if 11: else 12:
Revised: 10: end if 11: else 12:

Original: Find t 2 R , R 0 > 0 such that the sets T 1 :=
Revised: Find t 2 R , R 0 > 0 such that the sets T 1 :=

Original: { x 2 T : p ( x ) >
Revised: { x 2 T : p ( x ) >

Original: t  R 0 } and T 2 := { x 2 T : p ( x ) <
Revised: t  R 0 } and T 2 := { x 2 T : p ( x ) <

Original: t + R} satisfy | T 

Revised: t + R} satisfy | T

Original: | 2 + | T 2 | 2  | T | 2 (1  ↵ / 100) 2 and | T |  max( | T 1 | , | T 2 | )  ↵ | T | / 4 .
Revised: | 2 + | T 2 | 2  | T | 2 (1  ↵ / 100) 2 and | T |  max( | T 1 | , | T 2 | )  ↵ | T | / 4 .

Original: 13: ↵ i ↵ · (1  ↵ 2 / 100) · | T | / | T i | , for i = 1 , 2 .
Revised: 13: ↵ i ↵ · (1  ↵ 2 / 100) · | T | / | T i | , for i = 1 , 2 .

Original: 14: return { ( T 1 , ↵ 1 ) , ( T 2 , ↵ 2 ) } .
Revised: 14: return { ( T 1 , ↵ 1 ) , ( T 2 , ↵ 2 ) } .

Original: 15: end if it is possible to construct a sparsity-induced ﬁlter to prune outliers (see Steps 7 and 8).
Revised: 15: end if it is possible to construct a sparsity-induced ﬁlter to prune outliers (see Steps 7 and 8).

Original: We note that in Step 7, the ﬁrst term on the right-hand side is derived from Chernoff bound for degree- l Gaussian polynomials and the second term is due to concentration of empirical samples to Gaussian (see
Revised: We note that in Step 7, the ﬁrst term on the right-hand side is derived from Chernoff bound for degree- l Gaussian polynomials and the second term is due to concentration of empirical samples to Gaussian (see

Original: Deﬁnition 8), both of which are scaled by a factor 8 / ↵ so that the number of the samples removed from T is 8 / ↵ times more than that of the good samples in the representative set S G ⇢ T , which means most of the removed samples are outliers.
Revised: Deﬁnition 8), both of which are scaled by a factor 8 / ↵ so that the number of the samples removed from T is 8 / ↵ times more than that of the good samples in the representative set S G ⇢ T , which means most of the removed samples are outliers.

Original: We show by contradiction the existence of the threshold t (see Lemma 26).
Revised: We show by contradiction the existence of the threshold t (see Lemma 26).

Original: In fact, had such threshold t not existed, the set T must be sufﬁciently concentrated such that the algorithm would have returned at Step 5.
Revised: In fact, had such threshold t not existed, the set T must be sufﬁciently concentrated such that the algorithm would have returned at Step 5.

Original: This essentially relies on our result of the initial clustering of Algorithm 1, which guarantees that each subset T is bounded in a small L 1 -ball and the function value of p on the ↵ -good T does not change drastically (Lemma 13).
Revised: This essentially relies on our result of the initial clustering of Algorithm 1, which guarantees that each subset T is bounded in a small L 1 -ball and the function value of p on the ↵ -good T does not change drastically (Lemma 13).

Original: We then show that equipped with such threshold t , T 0 is a subset of T and it is ↵ 

Revised: We then show that equipped with such threshold t , T 0 is a subset of T and it is ↵

Original: -good
Revised: -good

Original: if T is ↵ -good (Lemma 28).
Revised: if T is ↵ -good (Lemma 28).

Original: When there is no such short interval [ a, b ] , the algorithm splits T into two overlapping subsets { T 1 , T 2 } such that T 1 \ T 2 is large enough to contain most of the samples in S G .
Revised: When there is no such short interval [ a, b ] , the algorithm splits T into two overlapping subsets { T 1 , T 2 } such that T 1 \ T 2 is large enough to contain most of the samples in S G .

Original: This guarantees that most of the samples in S G (if T is ↵ -good) are always contained in one subset and thus there always exists an ↵ -good subset of T .
Revised: This guarantees that most of the samples in S G (if T is ↵ -good) are always contained in one subset and thus there always exists an ↵ -good subset of T .

Original: We show that an appropriate threshold t can also be found at
Revised: We show that an appropriate threshold t can also be found at

Original: Step 12 (Lemma 30), and at least one T i is ↵ i -good
Revised: Step 12 (Lemma 30), and at least one T i is ↵ i -good

Original: if T is ↵ -good.
Revised: if T is ↵ -good.

Original: As a result, we have the following guarantees for Algorithm 4; see Appendix B for the full proof.
Revised: As a result, we have the following guarantees for Algorithm 4; see Appendix B for the full proof.

Original: Theorem 18 (B ASIC MF) .
Revised: Theorem 18 (B ASIC MF) .

Original: Consider Algorithm 4.
Revised: Consider Algorithm 4.

Original: Denote by ANS its return.
Revised: Denote by ANS its return.

Original: Suppose that T being ↵ -good implies Var[ p ( G )]  1 .
Revised: Suppose that T being ↵ -good implies Var[ p ( G )]  1 .

Original: Then with probability 1  ⌧ , the following holds.
Revised: Then with probability 1  ⌧ , the following holds.

Original: ANS is either “ NO ”, “ TBD ”, or a list of { ( T i , ↵ i ) } mi =1 with m  2 . 1)
Revised: ANS is either “ NO ”, “ TBD ”, or a list of { ( T i , ↵ i ) } mi =1 with m  2 . 1)

Original: If ANS =
Revised: If ANS =

Original: NO , then T is not ↵ -good.
Revised: NO , then T is not ↵ -good.

Original: If
Revised: If

Original: ANS =
Revised: ANS =

Original: TBD , then Var[ p ( T )]  O
Revised: TBD , then Var[ p ( T )]  O

Original: [Equation]
Revised: [Equation]

Original:  ; and if additionally T is ↵ -good, then | E [ p ( G )]  E [ p ( T )] |  O 
Revised:  ; and if additionally T is ↵ -good, then | E [ p ( G )]  E [ p ( T )] |  O

Original: [Equation]
Revised: [Equation]

Original: ) l
Revised: ) l

Original: [Equation]
Revised: [Equation]

Original: · log
Revised: · log

Original: [Equation]
Revised: [Equation]

Original: 2 +
Revised: 2 +

Original: [Equation]
Revised: [Equation]

Original: )  . 3)
Revised: )  . 3)

Original: If ANS =
Revised: If ANS =

Original: ( T i , ↵ i ) } mi =1 , then
Revised: ( T i , ↵ i ) } mi =1 , then

Original: T i ⇢ T and
Revised: T i ⇢ T and

Original: P i 1 ↵ 2 i  1 ↵ 2 for all
Revised: P i 1 ↵ 2 i  1 ↵ 2 for all

Original: i 2 [ m ] ; if additionally T is ↵ -good, then at least one T i is ↵ i -good.
Revised: i 2 [ m ] ; if additionally T is ↵ -good, then at least one T i is ↵ i -good.

Original: Algorithm
Revised: Algorithm

Original: Require: A multiset of samples T ⇢ R d , parameter ↵ 2 (0 , 1 / 2] , failure probability ⌧ 2 (0 , 1) , a polynomial p 2 P ( R d , l, 2 ` k 2 ` , 2 ` k 2 ` ) such that p ( x ) =
Revised: Require: A multiset of samples T ⇢ R d , parameter ↵ 2 (0 , 1 / 2] , failure probability ⌧ 2 (0 , 1) , a polynomial p 2 P ( R d , l, 2 ` k 2 ` , 2 ` k 2 ` ) such that p ( x ) =

Original: h A ( x  µ T ) and k A k 2 = 1 .
Revised: h A ( x  µ T ) and k A k 2 = 1 .

Original: 1: for l 0 = 0 , 1 , . .
Revised: 1: for l 0 = 0 , 1 , . .

Original: , l do 2:
Revised: , l do 2:

Original: Let B ( l 0 ) be
Revised: Let B ( l 0 ) be

Original: an order- 2 l 0 tensor with
Revised: an order- 2 l 0 tensor with

Original: B ( l 0 ) i 1 ,...,i l 0 ,j 1 ,...,j l 0 =
Revised: B ( l 0 ) i 1 ,...,i l 0 ,j 1 ,...,j l 0 =

Original: X k l
Revised: X k l

Original: [Equation]
Revised: [Equation]

Original: ,...,k l
Revised: ,...,k l

Original: A i 1 ...,i l 0 ,k l
Revised: A i 1 ...,i l 0 ,k l

Original: [Equation]
Revised: [Equation]

Original: ,...,k l A j
Revised: ,...,k l A j

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: ,k
Revised: ,k

Original: [Equation] [Equation]
Revised: [Equation] [Equation]

Original: [Equation]
Revised: [Equation]

Original: .,k l .
Revised: .,k l .

Original: Consider B ( l 0 ) as a d l 0 ⌦ d l 0 symmetric matrix by grouping each of the i 1 , . .
Revised: Consider B ( l 0 ) as a d l 0 ⌦ d l 0 symmetric matrix by grouping each of the i 1 , . .

Original: , i l 0 and j 1 , . .
Revised: , i l 0 and j 1 , . .

Original: , j lcoordinates together.
Revised: , j lcoordinates together.

Original: Apply eigenvalue decomposition on B ( l 0 ) to obtain B ( l 0 ) =
Revised: Apply eigenvalue decomposition on B ( l 0 ) to obtain B ( l 0 ) =

Original: P i  i V
Revised: P i  i V

Original: i ⌦ V i .
Revised: i ⌦ V i .

Original: ANS
Revised: ANS

Original: i
Revised: i

Original: M ULTILINEAR MF ( T, V i , l 0 , ↵ , ⌧ / ( ld l )) for every V i .
Revised: M ULTILINEAR MF ( T, V i , l 0 , ↵ , ⌧ / ( ld l )) for every V i .

Original: If ANS i
Revised: If ANS i

Original: =
Revised: =

Original: NO or a list of { ( T j , ↵ j ) } for some i , then return ANS i .
Revised: NO or a list of { ( T j , ↵ j ) } for some i , then return ANS i .

Original: If ANS i =
Revised: If ANS i =

Original: TBD , continue .
Revised: TBD , continue .

Original: 5: end for 6: ANS
Revised: 5: end for 6: ANS

Original: B ASIC MF ( T, ↵ , ⌧ , 1  h A ( x  µ T )) with  := 
Revised: B ASIC MF ( T, ↵ , ⌧ , 1  h A ( x  µ T )) with  :=

Original: C 1 · (1 + log 1 ↵ ) · log 2 (2 + log 1 ↵ )  l 2 .
Revised: C 1 · (1 + log 1 ↵ ) · log 2 (2 + log 1 ↵ )  l 2 .

Original: If ANS =
Revised: If ANS =

Original: NO or a list of ( T j , ↵ j ) , return ANS .
Revised: NO or a list of ( T j , ↵ j ) , return ANS .

Original: If ANS =
Revised: If ANS =

Original: TBD , still return “ NO ”.
Revised: TBD , still return “ NO ”.

Original: 3.2.2 Harmonic Multiﬁlter with Hermite Polynomials
Revised: 3.2.2 Harmonic Multiﬁlter with Hermite Polynomials

Original: Recall that applying B ASIC MF (Algorithm 4) on a polynomial p requires Var[ p ( G )]  1 .
Revised: Recall that applying B ASIC MF (Algorithm 4) on a polynomial p requires Var[ p ( G )]  1 .

Original: It is nontrivial to verify this condition for a high-degree polynomial p , as the variance of high-degree
Revised: It is nontrivial to verify this condition for a high-degree polynomial p , as the variance of high-degree

Original: Gaussian polynomials depends on the distribution mean, i.e. µ  µ T in this case, which is unfortunately unknown.
Revised: Gaussian polynomials depends on the distribution mean, i.e. µ  µ T in this case, which is unfortunately unknown.

Original: As a remedy, notice that for any harmonic polynomial h A ( x ) , E x ⇠ N ( µ 0 , I ) [ h A ( x ) 2 ] equals the summation of homogeneous polynomials of µ 0 , which can also be seen as the expectation of multilinear polynomials over independent variables
Revised: As a remedy, notice that for any harmonic polynomial h A ( x ) , E x ⇠ N ( µ 0 , I ) [ h A ( x ) 2 ] equals the summation of homogeneous polynomials of µ 0 , which can also be seen as the expectation of multilinear polynomials over independent variables

Original: X ( i ) ⇠ N ( µ 0 , I d ) .
Revised: X ( i ) ⇠ N ( µ 0 , I d ) .

Original: Thus, we only need to verify the expectation of these corresponding multilinear polynomials, whose variance on G does not hinge on µ 0 .
Revised: Thus, we only need to verify the expectation of these corresponding multilinear polynomials, whose variance on G does not hinge on µ 0 .

Original: The harmonic multiﬁlter is presented in Algorithm 5, where the subroutine M ULTILINEAR MF can be found in Appendix D.
Revised: The harmonic multiﬁlter is presented in Algorithm 5, where the subroutine M ULTILINEAR MF can be found in Appendix D.

Original: We ﬁrst present the guarantee when Algorithm 5 returns all TBD at
Revised: We ﬁrst present the guarantee when Algorithm 5 returns all TBD at

Original: Step 4 and reaches Step 6, where we can certify a bounded variance for h A ( x  µ T ) on G .
Revised: Step 4 and reaches Step 6, where we can certify a bounded variance for h A ( x  µ T ) on G .

Original: Lemma 19 (Variance of p ) .
Revised: Lemma 19 (Variance of p ) .

Original: Consider Algorithm 5.
Revised: Consider Algorithm 5.

Original: If it reaches Step 6 and T is ↵ -good, then we have E [ h A ( G  µ T ) 2 ]   2 .
Revised: If it reaches Step 6 and T is ↵ -good, then we have E [ h A ( G  µ T ) 2 ]   2 .

Original: Based on Lemma 19, we have that Var[ h A ( G  µ T ) /  ]  1 , for which we can invoke B ASIC MF on h A ( x  µ T ) /  and Theorem 18 can be applied immediately.
Revised: Based on Lemma 19, we have that Var[ h A ( G  µ T ) /  ]  1 , for which we can invoke B ASIC MF on h A ( x  µ T ) /  and Theorem 18 can be applied immediately.

Original: We are ready to elaborate the proof ideas for Lemma 16 and 17.
Revised: We are ready to elaborate the proof ideas for Lemma 16 and 17.

Original: First, observe that B ASIC MF returns “ TBD ” at Step 6 if and only if
Revised: First, observe that B ASIC MF returns “ TBD ” at Step 6 if and only if

Original: Var[ h A ( T  µ T ) /  ]  C 1 ·  ` + C 1 log 1 ↵  l · log 2 (2 + log 1 ↵ ) .
Revised: Var[ h A ( T  µ T ) /  ]  C 1 ·  ` + C 1 log 1 ↵  l · log 2 (2 + log 1 ↵ ) .

Original: Now return to Algorithm 3.
Revised: Now return to Algorithm 3.

Original: When h A ( x  µ T ) = p 1 ( x ) , this could not happen because Var[ p 1 ( T )] =
Revised: When h A ( x  µ T ) = p 1 ( x ) , this could not happen because Var[ p 1 ( T )] =

Original: Var[ v ⇤ · P d, ` ( T  µ T )]   ⇤  
Revised: Var[ v ⇤ · P d, ` ( T  µ T )]   ⇤

Original: ⇤ sparse = ⇥
Revised: ⇤ sparse = ⇥

Original: C 1 · ( ` +
Revised: C 1 · ( ` +

Original: [Equation]
Revised: [Equation]

Original: A contradiction that implies Lemma 16.
Revised: A contradiction that implies Lemma 16.

Original: When h A ( x  µ T ) = p 2 ( x ) , the case is more delicate.
Revised: When h A ( x  µ T ) = p 2 ( x ) , the case is more delicate.

Original: Here, we instead show that T must not be ↵ -good and H ARMONIC MF will return “ NO ” correctly.
Revised: Here, we instead show that T must not be ↵ -good and H ARMONIC MF will return “ NO ” correctly.

Original: This is because if T is ↵ -good, Proposition 18 implies that E [ p 2 ( G )] is close to E [ p 2 ( T )] , and together with
Revised: This is because if T is ↵ -good, Proposition 18 implies that E [ p 2 ( G )] is close to E [ p 2 ( T )] , and together with

Original: Lemma 19 we can show that E [ p 2 ( T )] is small.
Revised: Lemma 19 we can show that E [ p 2 ( T )] is small.

Original: However, by construction
Revised: However, by construction

Original: [Equation]
Revised: [Equation]

Original: [ p
Revised: [ p

Original: [Equation]
Revised: [Equation]

Original: T )]
Revised: T )]

Original:   ⇤ sparse , a contradiction that gives Lemma 17.
Revised:   ⇤ sparse , a contradiction that gives Lemma 17.

Original: The detailed proof can be found in Appendix B.3.
Revised: The detailed proof can be found in Appendix B.3.

Original:  Conclusion and Future Work
Revised:  Conclusion and Future Work

Original: In this paper, we developed an attribute-efﬁcient mean estimation algorithm which achieves sample complexity poly-logarithmic in the dimension with low-degree sparse polynomials under the listdecodable setting.
Revised: In this paper, we developed an attribute-efﬁcient mean estimation algorithm which achieves sample complexity poly-logarithmic in the dimension with low-degree sparse polynomials under the listdecodable setting.

Original: A natural question is whether the current techniques could be utilized to attributeefﬁciently solve the other list-decodable problems, such as learning of halfspaces and linear regression.
Revised: A natural question is whether the current techniques could be utilized to attributeefﬁciently solve the other list-decodable problems, such as learning of halfspaces and linear regression.

Original: Acknowledgments and Disclosure of Funding
Revised: Acknowledgments and Disclosure of Funding

Original: We thank the anonymous reviewers and meta-reviewer for valuable discussions.
Revised: We thank the anonymous reviewers and meta-reviewer for valuable discussions.

Original: This work is supported by NSF-IIS-1948133 and the startup funding from Stevens Institute of Technology.
Revised: This work is supported by NSF-IIS-1948133 and the startup funding from Stevens Institute of Technology.