[Paper Review] Robust Testing and Estimation under Manipulation Attacks

Jayadev Acharya, Ziteng Sun+1 more|arXiv (Cornell University)|Apr 21, 2021

Privacy-Preserving Technologies in Data31 references4 citations

TL;DR

This paper presents a unified framework for robust distribution estimation and testing under manipulation attacks in both centralized and distributed settings with communication and local privacy (LDP) constraints. By relating manipulation strength to earth-mover distance (EMD) via Hamming distance between messages, it establishes tight minimax error bounds using novel techniques like random hashing and ℓ₁/ℓ₁ isometry, achieving optimal rates under strong contamination models with adversarial control over a γ-fraction of users.

ABSTRACT

We study robust testing and estimation of discrete distributions in the strong contamination model. We consider both the "centralized setting" and the "distributed setting with information constraints" including communication and local privacy (LDP) constraints. Our technique relates the strength of manipulation attacks to the earth-mover distance using Hamming distance as the metric between messages(samples) from the users. In the centralized setting, we provide optimal error bounds for both learning and testing. Our lower bounds under local information constraints build on the recent lower bound methods in distributed inference. In the communication constrained setting, we develop novel algorithms based on random hashing and an $\ell_1/\ell_1$ isometry.

Motivation & Objective

• To address robust inference in discrete distribution learning and identity testing when up to a γ-fraction of users are adversarially manipulated.
• To analyze the impact of information constraints—specifically communication limits and local differential privacy (LDP)—on robust inference under manipulation attacks.
• To develop optimal algorithms and derive tight minimax error bounds in both centralized and distributed settings with adversarial message manipulation.
• To unify the analysis of manipulation attacks by relating their strength to earth-mover distance (EMD) using Hamming distance as a metric on user messages.
• To establish lower bounds via χ²-contraction and channel information matrices, enabling tight characterization of fundamental limits under LDP and communication constraints.

Proposed method

• Models manipulation attacks as strong contamination where an adversary controls γn users and can arbitrarily alter their messages, with no access to original inputs but full knowledge of the protocol and public randomness.
• Uses earth-mover distance (EMD) between message distributions as a proxy for statistical error, with Hamming distance as the metric between messages to quantify manipulation impact.
• Applies random hashing and ℓ₁/ℓ₁ isometry to design communication-efficient and robust algorithms in the distributed setting with limited message length ℓ.
• Derives upper bounds on EMD under information constraints by relating them to the trace norm of the channel information matrix H(W), which captures how channels exploit distributional structure.
• Establishes lower bounds via χ²-contraction and a uniform mixture construction over distributions with alternating ±1 biases, linking EMD to the trace norm of H(W).
• Reduces the constrained inference problem to the unconstrained one via a reduction lemma, showing that the robust testing risk under ℓ-bit messages is within a constant factor of the risk under 2^ℓ-level messages.

Experimental results

Research questions

• RQ1 What is the fundamental limit of robust distribution estimation and identity testing when a γ-fraction of users are adversarially manipulated under communication and LDP constraints?
• RQ2 How does the strength of manipulation attacks relate to statistical error, and can this be formalized using earth-mover distance (EMD) and Hamming distance between messages?
• RQ3 Can optimal algorithms be designed for robust inference in distributed settings with limited communication and local privacy, and what are their error bounds?
• RQ4 How do information constraints—such as LDP and message length limits—affect the minimax error rates in robust inference tasks?
• RQ5 What is the role of the channel information matrix H(W) in characterizing the fundamental limits of robust inference under manipulation attacks?

Key findings

• The paper establishes a minimax lower bound of Ω(γ√(k / max_W ||H(W)||_*) ) for robust distribution learning under information constraints, where ||H(W)||_* is the trace norm of the channel information matrix.
• For local differential privacy (LDP), the lower bound becomes Ω(γ√(k / ε²)), showing that privacy parameter ε degrades robustness in proportion to ε⁻¹.
• Under communication constraints with ℓ-bit messages, the lower bound is Ω(γ√(k / 2^ℓ)), indicating that message length ℓ must scale logarithmically with k to maintain robustness.
• The upper bound for robust testing under ℓ-bit communication is O(√(k / 2^ℓ) × R_IT(2^ℓ, n, γ)), showing a reduction to the unconstrained case with effective alphabet size 2^ℓ.
• The paper proves that the minimax risk for robust testing under LDP is Ω(√(kγ/n)) when no information constraints are present, matching known lower bounds from prior work.
• The proposed algorithms achieve optimal rates in both centralized and distributed settings, with error bounds matching the derived lower bounds up to constant factors, establishing tightness of the results.