One Attack to Rule Them All: Tight Quadratic Bounds for Adaptive Queries on Cardinality Sketches

TL;DR

This paper establishes tight bounds on the number of adaptive queries needed to compromise the security of various cardinality sketching algorithms, revealing fundamental limitations in their robustness against adaptive attacks.

Contribution

It introduces a universal attack framework that applies to broad classes of cardinality sketches, providing tight bounds on the number of adaptive queries required for compromise.

Findings

Any union-composable sketch can be compromised with O(k^4) queries.

Tight bound of O(k^2) queries for monotone maps, including MinHash.

Linear sketches over R and Fp can be compromised with O(k^2) queries, matching optimal bounds.

Abstract

Cardinality sketches are compact data structures for representing sets or vectors. These sketches are space-efficient, typically requiring only logarithmic storage in the input size, and enable approximation of cardinality (or the number of nonzero entries). A crucial property in applications is \emph{composability}, meaning that the sketch of a union of sets can be computed from individual sketches. Existing designs provide strong statistical guarantees, ensuring that a randomly sampled sketching map remains robust for an exponential number of queries in terms of the sketch size $k$. However, these guarantees degrade to quadratic in $k$ when queries are \emph{adaptive}, meaning they depend on previous responses. Prior works on statistical queries (Steinke and Ullman, 2015) and specific MinHash cardinality sketches (Ahmadian and Cohen, 2024) established that this is tight in that they can be compromised using a quadratic number of adaptive queries. In this work, we develop a universal attack framework that applies to broad classes of cardinality sketches. We show that any union-composable sketching map can be compromised with $\tilde{O}(k^4)$ adaptive queries and this improves to a tight bound of $\tilde{O}(k^2)$ for monotone maps (including MinHash, statistical queries, and Boolean linear maps). Similarly, any linear sketching map over the reals $\mathbb{R}$ and finite fields $\mathbb{F}_p$ can be compromised using $\tilde{O}(k^2)$ adaptive queries, which is optimal and strengthens some of the recent results by~\citet{GribelyukLWYZ:FOCS2024}, who established a weaker polynomial bound.