A Bloom filter is a space-efficient probabilistic data structure that represents a set $S$ of elements from a larger universe $U$. This efficiency comes with a trade-off, namely, it allows for a small chance of false positives. When you query the Bloom filter about an element x, the filter will respond 'Yes' if $x \in S$. If $x \notin S$, it may still respond 'Yes' with probability at most $\varepsilon$. We investigate the adversarial robustness and privacy of Bloom filters, addressing open problems across three prominent frameworks: the game-based model of Naor-Oved-Yogev (NOY), the simulator-based model of Filic et. al., and learning-augmented variants. We prove the first formal connection between the Filic and NOY models, showing that Filic correctness implies AB-test resilience. We resolve a longstanding open question by proving that PRF-backed Bloom filters fail the NOY model's stronger BP-test. Finally, we introduce the first private Bloom filters with differential privacy guarantees, including constructions applicable to learned Bloom filters. Our taxonomy organizes the space of robustness and privacy guarantees, clarifying relationships between models and constructions.
DPBloomfilter: Securing Bloom Filters with Differential Privacy
Independent Researcher（独立研究者）；The University of Hong Kong（香港大学）；University of Texas at Austin（德克萨斯大学奥斯汀分校）；University of Wisconsin-Madison（威斯康星大学麦迪逊分校）
Leveraging Soft Prompts for Privacy Attacks in Federated Prompt Tuning
CISE, University of Florida, FL, USA（佛罗里达大学计算机与信息科学系）；North Carolina State University, NC, USA（北卡罗来纳州立大学）；Washington State University, WA, USA（华盛顿州立大学）；Seoul National University of Science and Technology, South Korea（韩国科学技术大学）
Make Up Your Mind: The Price of Online Queries in Differential Privacy
Harvard University John A. Paulson School of Engineering and Applied Sciences（哈佛大学约翰·A·保尔森工程与应用科学学院）；Yale University（耶鲁大学）；Northeastern University College of Computer and Information Science（东北大学计算机与信息科学学院）
Trade-offs between membership privacy & adversarially robust learning
University College London（伦敦大学学院）
从历史上看，机器学习方法在设计时并没有考虑到安全性。反过来，这又产生了对抗性的例子，仔细扰动输入样本，旨在误导检测在测试时，已被应用于攻击垃圾邮件和恶意软件分类，最近攻击图像分类。因此，大量的研究致力于设计对对抗性示例鲁棒的机器学习方法。不幸的是，除了鲁棒性之外，安全和安全的机器学习模型还必须满足其他要求，例如公平性和隐私性。Song et al.（2019）最近的研究表明，经验表明，健壮和私有机器学习模型之间存在权衡。设计为对对抗性示例具有鲁棒性的模型通常比标准（非鲁棒）模型在训练数据上更大程度地过拟合。如果数据集包含隐私信息，那么通过观察模型的输出来分离训练和测试数据的任何统计测试都可能代表隐私泄露，如果模型在训练数据上过拟合，这些统计测试就会变得更容易。在这项工作中，我们确定设置标准模型将过拟合到更大程度上相比，强大的模型，并在以前的作品中，根据经验观察，设置相反的行为发生。因此，不一定必须牺牲隐私来实现鲁棒性。过度拟合的程度自然取决于可用于训练的数据量。我们继续描述训练集大小如何影响通过在简单的高斯数据任务上训练鲁棒模型所暴露的隐私风险，并根据经验表明我们的研究结果适用于图像分类基准数据集，如CIFAR-10和CIFAR-100。
Combating Exacerbated Heterogeneity for Robust Models in Federated Learning
Hong Kong Baptist University（香港浸会大学）；Shanghai Jiao Tong University（上海交通大学）；Shanghai AI Laboratory（上海人工智能实验室）；The University of Sydney（悉尼大学）；Tsinghua University（清华大学）
FedGreed: A Byzantine-Robust Loss-Based Aggregation Method for Federated Learning
School of Electrical and Computer Engineering（电气与计算机工程学院）；National Technical University of Athens（雅典技术大学）；Department of Mathematics and Informatics（数学与信息学系）；Faculty of Sciences, University of Novi Sad（自然科学学院，诺维萨德大学）
