Adversarially Robust Bloom Filters: Privacy, Reductions, and Open Problems

TL;DR

This paper explores the adversarial robustness and privacy of Bloom filters, establishing formal connections between models, resolving open questions, and introducing differentially private Bloom filter constructions.

Contribution

It provides the first formal link between Filic and NOY models, proves limitations of PRF-backed Bloom filters, and introduces private Bloom filters with differential privacy guarantees.

Findings

Filic correctness implies AB-test resilience.

PRF-backed Bloom filters fail the NOY BP-test.

First private Bloom filters with differential privacy guarantees.

Abstract

A Bloom filter is a space-efficient probabilistic data structure that represents a set $S$ of elements from a larger universe $U$. This efficiency comes with a trade-off, namely, it allows for a small chance of false positives. When you query the Bloom filter about an element x, the filter will respond 'Yes' if $x \in S$. If $x \notin S$, it may still respond 'Yes' with probability at most $\varepsilon$. We investigate the adversarial robustness and privacy of Bloom filters, addressing open problems across three prominent frameworks: the game-based model of Naor-Oved-Yogev (NOY), the simulator-based model of Filic et. al., and learning-augmented variants. We prove the first formal connection between the Filic and NOY models, showing that Filic correctness implies AB-test resilience. We resolve a longstanding open question by proving that PRF-backed Bloom filters fail the NOY model's stronger BP-test. Finally, we introduce the first private Bloom filters with differential privacy guarantees, including constructions applicable to learned Bloom filters. Our taxonomy organizes the space of robustness and privacy guarantees, clarifying relationships between models and constructions.