The big ideas of computer science, with the fine print
Twelve results that a working computer scientist should be able to derive, apply and distrust. Each comes with a lab that reproduces the result numerically and then pushes on the assumption that makes it true: fresh information, worst-case inputs, finite size, independence, a privacy budget that someone forgot to count.
How to read this
Each idea has five parts. The statement gives the theorem or model in standard form. Why it's true sketches the proof. Where it breaks covers the assumptions that fail in real systems and the well-known incidents and counterexamples. Key references points to the primary literature. The lab simulates the setting so you can find the edge yourself.
The labs are small simulations run in your browser. Constants are illustrative; the shapes are the point.
The power of two choices
One extra random probe cuts the maximum load exponentially.
Competitive paging
LRU is $k$-competitive, and the scan that proves it is common.
Random 3-SAT
A satisfiability threshold near $4.27$, and the hardness peak at it.
HyperLogLog
Counting $10^9$ distinct items in kilobytes, if the hash is good.
Channel capacity
Shannon's limit, and why repetition codes never reach it.
Zero-knowledge proofs
Convince a verifier you know a 3-colouring without revealing it.
FLP & randomized elections
Deterministic consensus is impossible. Raft breaks symmetry with randomized timeouts.
Quorums & staleness
$R+W>N$ gives intersection. Below it, staleness is a probability.
The tail at scale
Fan-out turns a 1% hiccup into the common case.
Algorithms under uncertainty
Randomness, unknown futures and random inputs. Each of these results gives a sharp guarantee, and each guarantee depends on a modelling assumption that real workloads routinely violate.
Balls into bins & the power of two choices
Throw $n$ balls into $n$ bins at random and the fullest bin holds about $\ln n/\ln\ln n$. Let each ball pick the less loaded of two random bins and it drops to about $\log_2\ln n$, an exponential improvement from one extra probe.
Statement
With one uniformly random choice per ball, the maximum load $L_1$ satisfies, with high probability,
while letting each ball join the least loaded of $d\ge2$ independent random bins (Greedy[$d$]) gives
With $m\gg n$ balls the one-choice gap above the mean grows like $\sqrt{(m/n)\ln n}$, while the $d$-choice gap stays $\ln\ln n/\ln d+O(1)$, independent of $m$.
Why it's true
One choice: $\Pr[\text{a given bin gets}\ge k]\le\binom nk n^{-k}\le 1/k!$, and a union bound over $n$ bins is below 1 once $k!>n$, i.e. $k\approx\ln n/\ln\ln n$. A matching second-moment argument gives the lower bound. Two choices, by layered induction: let $\beta_i$ bound the number of bins with load $\ge i$. A ball lands at height $i+1$ only if both its choices already have load $\ge i$, which happens with probability $(\beta_i/n)^2$. So $\beta_{i+1}\lesssim n(\beta_i/n)^2$, and the fraction squares at every level. Doubly exponential decay reaches $1/n$ after $\log_2\ln n$ levels.
Where it breaks
(i) Stale information: the analysis assumes each ball sees current loads. Load balancers that act on load reports refreshed only periodically send every request to the same apparently idle servers. Mitzenmacher (2000) analyses this herd behaviour, and with old enough information, more choices do worse than one. The lab's staleness slider shows it. (ii) The choices must be independent, or at least not adversarially correlated with load. (iii) The win is asymptotic: at $n=10^4$ it is the difference between a maximum load of about 7 and about 4, which matters for hash tables and less for some schedulers.
Key references
Gonnet, JACM (1981); Azar, Broder, Karlin & Upfal, "Balanced allocations," STOC (1994), SIAM J. Comput. (1999); Raab & Steger (1998); Mitzenmacher, "The power of two choices in randomized load balancing," IEEE TPDS (2001) and "How useful is old information?" IEEE TPDS (2000); Berenbrink, Czumaj, Steger & Vöcking, SIAM J. Comput. (2006), on the heavily loaded case.
Competitive paging
Bélády's offline rule is optimal. No deterministic online rule can be guaranteed within less than a factor $k$ of it, and LRU and FIFO achieve exactly $k$. The adversarial input is a cyclic scan, which real programs produce all the time.
Statement
A cache holds $k$ pages. Offline, MIN (evict the page whose next request is furthest in the future) minimizes faults (Bélády, 1966). An online algorithm $A$ is $c$-competitive if $\mathrm{cost}_A(\sigma)\le c\cdot\mathrm{OPT}(\sigma)+b$ for every request sequence $\sigma$. Sleator and Tarjan proved:
so with equal caches LRU and FIFO are $k$-competitive, and no deterministic algorithm does better. Randomized marking is $2H_k$-competitive against an oblivious adversary, and $H_k\approx\ln k$ is a lower bound (Fiat et al., 1991).
Why it's true
Lower bound: use $k+1$ distinct pages and always request the one the online algorithm doesn't hold. It faults on every request. MIN, on a fault, evicts the page needed furthest ahead, so it faults at most once per $k$ requests. Upper bound for LRU: split $\sigma$ into phases of $k$ distinct pages. LRU faults at most $k$ times per phase, and OPT must fault at least once per phase boundary.
Where it breaks
(i) The bound is pessimistic for typical traces, where LRU comes close to OPT. But the adversarial case, a loop slightly larger than the cache, is exactly a sequential scan or a nested-loop join, which is why databases use scan-resistant policies such as LRU-K (O'Neil et al., 1993), 2Q and ARC (Megiddo & Modha, 2003). (ii) Bélády's anomaly: FIFO can fault more with a larger cache. LRU and MIN are stack algorithms (the contents with $k$ pages are a subset of those with $k+1$), so they can't (Mattson et al., 1970). (iii) Competitive analysis ignores the distribution of inputs. Models with locality (Albers, Favrholdt & Giel, 2005) separate LRU from FIFO, which plain competitive analysis cannot.
Key references
Bélády, IBM Systems J. (1966); Bélády, Nelson & Shedler, CACM (1969); Mattson, Gecsei, Slutz & Traiger, IBM Systems J. (1970); Sleator & Tarjan, CACM (1985); Fiat, Karp, Luby, McGeoch, Sleator & Young, J. Algorithms (1991); Borodin & El-Yaniv, Online Computation and Competitive Analysis (1998).
Random 3-SAT & the hardness peak
Random 3-CNF formulas switch abruptly from almost surely satisfiable to almost surely unsatisfiable near $4.27$ clauses per variable, and backtracking search is slowest right at the switch.
Statement
Let $F$ have $n$ variables and $m=\alpha n$ clauses, each with 3 distinct variables chosen uniformly and negated independently with probability $\tfrac12$. Friedgut (1999) proved the transition is sharp: there is $\alpha_c(n)$ such that for any $\epsilon>0$, $\Pr[F\text{ sat}]\to1$ for $\alpha<(1-\epsilon)\alpha_c(n)$ and $\to0$ above $(1+\epsilon)\alpha_c(n)$. Statistical physics predicts $\alpha_c\approx4.267$ (Mézard, Parisi & Zecchina, 2002). For $k=3$ the proven bounds are about $3.52\le\alpha_c\le4.49$, and the exact value is established only for large $k$ (Ding, Sly & Sun, 2015).
Why it's true
First moment: a fixed assignment satisfies a random clause with probability $7/8$, so
and Markov's inequality gives unsatisfiability. The true threshold is lower because solutions are highly correlated, so the expectation is dominated by rare formulas with many solutions. For the hardness peak, below $\alpha_c$ there are many solutions and backtracking stumbles on one. Above it, contradictions appear after a few decisions, so refutation trees shrink as $\alpha$ grows. At the threshold the search must explore deep and wide (Cheeseman, Kanefsky & Taylor, 1991; Mitchell, Selman & Levesque, 1992).
Where it breaks
(i) Finite size: at $n=20$ to $40$ the transition is smeared over a window of width $\sim n^{-1/\nu}$ and shifted, so lab estimates of $\alpha_c$ drift with $n$ (Kirkpatrick & Selman, 1994). (ii) Random isn't industrial: CDCL solvers routinely decide industrial instances with millions of variables because those have structure that random formulas lack. Hardness at the threshold says little about those. (iii) "Hard" refers to this family of algorithms. Survey propagation solves large random instances quite close to the threshold, although resolution refutations of random unsatisfiable formulas are provably exponential (Chvátal & Szemerédi, 1988).
Key references
Chvátal & Szemerédi, JACM (1988); Cheeseman, Kanefsky & Taylor, IJCAI (1991); Mitchell, Selman & Levesque, AAAI (1992); Kirkpatrick & Selman, Science (1994); Friedgut, JAMS (1999); Mézard, Parisi & Zecchina, Science (2002); Ding, Sly & Sun, STOC (2015), Annals of Math. (2022).
Information & proof
How few bits a summary can use, how many bits a noisy channel can carry, and how little a proof needs to reveal. Each limit is sharp, and each depends on randomness the implementation must actually supply.
HyperLogLog
The longest run of leading zeros among hashed items reveals roughly how many distinct items there were. Averaging that over $m$ buckets gives a cardinality estimate with relative error $1.04/\sqrt m$ in about $6m$ bits.
Statement
Hash each item to a uniform bit string. The first $b$ bits pick one of $m=2^b$ registers, and register $j$ keeps $M_j=\max\rho$, where $\rho$ is the position of the first 1 in the remaining bits. The estimate is
with relative standard error
For small $n$, if $E\le\tfrac52m$ and $V>0$ registers are still zero, use linear counting, $m\ln(m/V)$, instead.
Why it's true
$\Pr[\rho\ge r]=2^{-(r-1)}$, so among $n/m$ items in a register the maximum $\rho$ sits near $\log_2(n/m)$, and $2^{M_j}$ estimates $n/m$ up to a constant. One register has huge variance. Stochastic averaging over $m$ registers, using the harmonic mean to blunt the occasional very large $M_j$, gives the $1/\sqrt m$ rate, and $\alpha_m$ removes the multiplicative bias. Registers hold values up to about $\log_2\log_2 n$ bits wide, hence "LogLog."
Where it breaks
(i) Small cardinalities: the raw estimator is badly biased when many registers are empty, which is why the linear-counting switch exists. HyperLogLog++ adds empirical bias correction and a sparse representation (Heule, Nunkesser & Hall, 2013). (ii) Hash quality is the whole guarantee. With a hash whose high bits don't mix, sequential IDs all land in one register, as the lab's "no mixing" option shows. (iii) A 32-bit hash saturates near $2^{32}$ distinct items and needs a large-range correction. 64-bit hashes avoid this. (iv) An adversary who knows the hash can craft items that inflate or deflate the count.
Key references
Flajolet & Martin, JCSS (1985); Whang, Vander-Zanden & Taylor, ACM TODS (1990), on linear counting; Durand & Flajolet, ESA (2003), on LogLog; Flajolet, Fusy, Gandouet & Meunier, AofA (2007); Heule, Nunkesser & Hall, EDBT (2013).
Channel capacity
A binary symmetric channel that flips bits with probability $p$ can carry $1-H_2(p)$ bits per use with error probability as small as you like. Below that rate, reliable communication is possible without driving the rate to zero.
Statement
For the $\mathrm{BSC}(p)$, with $H_2(p)=-p\log_2p-(1-p)\log_2(1-p)$,
For every rate $R<C$ there are codes of length $n$ and rate $R$ with block error probability $\to0$ as $n\to\infty$. For $R>C$ the error probability is bounded away from zero (strong converse: it tends to 1).
Why it's true
Achievability by random coding: draw $2^{nR}$ codewords uniformly. The channel flips about $np$ bits, so the received word lies in a Hamming ball of about $2^{nH_2(p)}$ points around the sent codeword. The whole space has $2^n$ points, so you can pack about $2^{n(1-H_2(p))}$ nearly disjoint balls, and a random codebook does so with high probability. Averaging over codebooks shows that some fixed codebook works. The converse follows from Fano's inequality: $nR\le I(X^n;Y^n)+1+P_e nR\le nC+1+P_e nR$.
Where it breaks
(i) The proof is non-constructive and random codes need exponential-time decoding. Practical capacity-approaching codes took decades: LDPC codes (Gallager, 1962, rediscovered by MacKay & Neal in 1996), turbo codes (Berrou et al., 1993) and polar codes, which provably achieve capacity with $O(n\log n)$ encoding and decoding (Arıkan, 2009). (ii) Finite blocklength: at length $n$ the best rate is about $C-\sqrt{V/n}\,Q^{-1}(\varepsilon)$ (Polyanskiy, Poor & Verdú, 2010), which matters for short, low-latency packets. (iii) Real channels are bursty, not memoryless. Interleaving spreads bursts so that a code designed for independent errors can handle them.
Key references
Shannon, Bell Sys. Tech. J. (1948); Hamming, BSTJ (1950); Gallager, IRE Trans. IT (1962); Berrou, Glavieux & Thitimajshima, ICC (1993); MacKay & Neal, Electronics Letters (1996); Arıkan, IEEE Trans. IT (2009); Polyanskiy, Poor & Verdú, IEEE Trans. IT (2010); Cover & Thomas, Elements of Information Theory (2nd ed., 2006).
Zero-knowledge proofs
A prover can convince a verifier that a graph is 3-colourable, and that the prover knows a colouring, while revealing nothing the verifier couldn't have produced alone. Each round catches a cheater with probability at least $1/|E|$.
Statement
An interactive proof $(P,V)$ for a language $L$ is complete (honest $P$ convinces $V$ on $x\in L$), sound (on $x\notin L$ any prover succeeds with probability $\le s$) and zero-knowledge (there is a simulator $S$ that, for any efficient verifier $V^*$, outputs transcripts indistinguishable from real interactions). Goldreich, Micali and Wigderson showed that every language in NP has a computational zero-knowledge proof if one-way functions exist, via graph 3-colouring. In each round:
A prover without a valid colouring is caught with probability $\ge1/|E|$ per round, so after $t$ independent rounds it survives with probability at most $(1-1/|E|)^t\le e^{-t/|E|}$.
Why it's true
Soundness: binding commitments fix a colouring before the challenge, and an invalid colouring has at least one bad edge. Zero knowledge: for a valid colouring, the two opened colours are a uniformly random ordered pair of distinct colours, whatever the edge. The simulator guesses the challenge edge in advance, commits to two random distinct colours on it (and anything on other vertices), and rewinds $V^*$ when its guess is wrong. Hiding commitments make the unopened vertices indistinguishable.
Where it breaks
(i) Soundness needs about $|E|\ln(1/\delta)$ rounds, so practical systems use succinct arguments and make them non-interactive with the Fiat–Shamir transform, replacing the verifier's challenges with a hash of the transcript. If the hash omits part of the public statement, provers can forge proofs. Bernhard, Pereira and Warinschi (2012) found this in Helios voting, and Trail of Bits' 2022 "Frozen Heart" disclosures found it in several production proof libraries. (ii) Sequential repetition preserves zero knowledge, but parallel repetition need not (Goldreich & Krawczyk, 1996). (iii) Zero knowledge is computational here: it rests on the commitment scheme, so a broken commitment leaks the witness.
Key references
Goldwasser, Micali & Rackoff, STOC (1985), SIAM J. Comput. (1989); Goldreich, Micali & Wigderson, FOCS (1986), JACM (1991); Fiat & Shamir, CRYPTO (1986); Goldreich & Krawczyk, SIAM J. Comput. (1996); Bernhard, Pereira & Warinschi, ASIACRYPT (2012); Goldreich, Foundations of Cryptography, vol. 1 (2001).
Distributed systems
Machines crash, messages are delayed, and the slowest of a thousand servers decides your latency. These results set what is impossible, what can be bought with probability, and what the tail costs.
FLP & randomized leader election
No deterministic protocol can guarantee consensus in an asynchronous system if even one process may crash. Practical protocols keep safety unconditionally and get liveness from timing assumptions and randomness. Raft's randomized election timeout is the simplest example.
Statement
Fischer, Lynch and Paterson (1985): in the asynchronous message-passing model with reliable links, no deterministic protocol for binary consensus satisfies agreement, validity and termination if one process may fail by crashing. Under partial synchrony, where message delays are eventually bounded, consensus is solvable with $f<n/2$ crash failures (Dwork, Lynch & Stockmeyer, 1988). With randomization it terminates with probability 1 (Ben-Or, 1983).
Why it's true
A configuration is bivalent if both decisions are still reachable. Validity and the possibility of one crash give a bivalent initial configuration. Then, for any pending message $e$, the set of configurations reachable by delivering $e$ last contains a bivalent one. Otherwise two neighbouring configurations would decide differently, depending only on one process's step, and crashing that process makes them indistinguishable. The adversarial scheduler can therefore keep the system bivalent forever. Raft escapes by electing a leader. Each follower times out after $T+U$, with $U\sim\mathrm{Unif}[0,W]$, and the first to time out usually collects a majority before anyone else starts. For $n$ followers, the gap between the two earliest timeouts exceeds $\delta$ with probability $(1-\delta/W)^n$.
Where it breaks
(i) With $W=0$ (no randomness) and symmetric nodes, every node times out together, votes for itself, and the election repeats forever. The lab reproduces this, a concrete instance of the FLP adversary. (ii) Timing assumptions: Raft needs broadcast time $\ll$ election timeout $\ll$ mean time between failures. GC pauses and overloaded disks violate the first. (iii) Liveness is not guaranteed under partial network partitions: a node that can reach some peers but not the leader keeps starting elections and deposing healthy leaders, which is why production Raft adds PreVote and CheckQuorum (Ongaro, 2014). Cloudflare's November 2020 control-plane outage involved etcd leader churn after a partial switch failure. (iv) FLP is about guaranteed termination. Randomized protocols terminate with probability 1, but with no bound on the worst case.
Key references
Ben-Or, PODC (1983); Fischer, Lynch & Paterson, JACM (1985); Dwork, Lynch & Stockmeyer, JACM (1988); Lamport, "The part-time parliament," ACM TOCS (1998); Ongaro & Ousterhout, "In search of an understandable consensus algorithm," USENIX ATC (2014), whose Figure 16 measures election time against timeout randomization; Ongaro, PhD thesis, Stanford (2014).
Quorums & probabilistic staleness
With $N$ replicas, writing to $W$ and reading from $R$ with $R+W>N$ guarantees that every read quorum overlaps every write quorum. Below that line, a read is stale with a probability you can compute, and it shrinks quickly as the write propagates.
Statement
Gifford's weighted voting (1979): if $R+W>N$, any $R$-set and any $W$-set intersect, so a read sees the latest acknowledged write (for a single register, no concurrent writes). For partial quorums ($R+W\le N$), if the read contacts a uniformly random $R$-set immediately after the write is acknowledged by exactly $W$ replicas,
and the probability falls with time $t$ after commit as the remaining replicas receive the write (probabilistically bounded staleness, Bailis et al., 2012).
Why it's true
Pigeonhole: $|R\cap W|\ge R+W-N\ge1$. For partial quorums, the read misses the write only if all $R$ replicas it contacts come from the $N-W$ that haven't yet applied it, which is a hypergeometric count. For $t>0$ each straggler has independently applied the write with probability $F(t)$, its delay distribution, so the bound improves at the rate of that distribution's tail.
Where it breaks
(i) Overlap isn't linearizability. A read concurrent with a write can return the new value and a later read the old one unless reads write back what they return (Attiya, Bar-Noy & Dolev, 1995). (ii) Sloppy quorums with hinted handoff (Dynamo) accept writes on substitute nodes during failures, so $R+W>N$ no longer implies intersection. (iii) Last-writer-wins conflict resolution with skewed clocks silently drops acknowledged writes. (iv) Latency: $W$ and $R$ are order statistics of replica response times, so raising either to buy consistency buys tail latency too. The lab shows both sides.
Key references
Gifford, SOSP (1979); Attiya, Bar-Noy & Dolev, JACM (1995); DeCandia et al., "Dynamo," SOSP (2007); Bailis, Venkataraman, Franklin, Hellerstein & Stoica, "Probabilistically bounded staleness," VLDB (2012); Kleppmann, Designing Data-Intensive Applications (2017), ch. 5 and 9.
The tail at scale
If one server is slow 1% of the time, a request that waits for 100 servers is slow 63% of the time. Latency at scale is set by the tail of the component distribution, and hedged requests can cut it at small cost, provided slowness is independent.
Statement
If leaf latencies $X_1,\dots,X_k$ are i.i.d. with CDF $F$ and the request waits for all of them, its latency $\max_iX_i$ has CDF $F^k$, so
so the $q$-quantile of the request latency is $F^{-1}\!\left(q^{1/k}\right)$.
With a hedge sent after delay $h$ to an independent replica, each leaf's latency becomes $\min(X,\,h+X')$.
Why it's true
Independence makes the max's CDF a product. With $1-F(x)=0.01$ and $k=100$, $1-0.99^{100}\approx0.63$. The $p99$ of the request is the $0.99^{1/100}\approx p99.99$ of a leaf, so fan-out moves the quantile you care about deep into the leaf's tail. Hedging after $h$ at the leaf's $p95$ adds about 5% load. A leaf is still slow only if both copies are slow, which under independence squares the tail probability.
Where it breaks
(i) Correlated slowness: if the backup shares the cause (garbage collection across a fleet, a hot shard, an overloaded rack), hedging adds load and saves little. The lab's correlation option shows this. (ii) Under overload, hedges and retries amplify the load that caused the slowness, so production systems cap hedge rates and cancel the losing copy ("tied requests"). (iii) Coordinated omission: load generators that wait for each response before sending the next under-sample exactly the slow periods and can understate tail latency by orders of magnitude (Tene).
Key references
Dean & Barroso, "The tail at scale," CACM (2013). In their BigTable benchmark, hedging after 10 ms cut the 99.9th-percentile latency for reading 1,000 keys from 1,800 ms to 74 ms, with 2% more requests. Vulimiri et al., "Low latency via redundancy," CoNEXT (2013); Tene, "How NOT to measure latency" (conference talk, 2013 onward).
Learning & security
A model that generalizes, a statistic that hides individuals, and a comparison that hides a secret all depend on what an observer can infer from outputs. All three fail when the observer gets more queries or more parameters than the analysis assumed.
Double descent
As a least-squares model gains parameters, test error follows the classical U-curve, spikes when the parameter count reaches the number of samples, and then falls again. The spike is noise amplified by a nearly singular design. Past it, the minimum-norm solution acts as an implicit regularizer.
Statement
Take $n$ samples, $p$ features and the minimum-norm least-squares fit $\hat\beta=X^{+}y$. For isotropic Gaussian features in the proportional limit $p/n\to\gamma$, with signal strength $r^2=\|\beta\|^2$ and noise variance $\sigma^2$, the excess test risk is (Hastie, Montanari, Rosset & Tibshirani, 2022)
which diverges at $\gamma=1$. Similar curves appear for random-feature models, kernels and deep networks as width, training time or data size varies (Belkin et al., 2019; Nakkiran et al., 2020).
Why it's true
The variance term is $\sigma^2\operatorname{tr}\big((X^\top X)^{+}\big)$ up to scaling. By Marchenko–Pastur, the smallest nonzero singular value of $X/\sqrt n$ is about $|1-\sqrt\gamma|$, which vanishes at $\gamma=1$, so a square design inverts tiny singular values and amplifies the noise. For $\gamma>1$, many interpolating solutions exist. The minimum-norm one spreads the fit over many directions, the smallest singular value grows again, and variance falls like $1/(\gamma-1)$. Bias rises because the fit lives in an $n$-dimensional subspace of a $p$-dimensional space.
Where it breaks
(i) The peak is an artefact of fitting without regularization. Optimally tuned ridge removes it, and test error then decreases monotonically in this setting (Nakkiran, Venkat, Kakade & Ma, 2021). Try the ridge option in the lab. (ii) "More parameters is better" is not the lesson. Whether the second descent beats the first minimum depends on the signal-to-noise ratio and on how well the features align with the target. (iii) Parameter count is a poor complexity measure. The relevant quantity is an effective dimension or norm, which is why the curve shifts with the feature distribution. The phenomenon was observed decades earlier (see Loog et al., 2020).
Key references
Belkin, Hsu, Ma & Mandal, PNAS (2019); Advani, Saxe & Sompolinsky, Neural Networks (2020); Nakkiran et al., "Deep double descent," ICLR (2020); Nakkiran, Venkat, Kakade & Ma, ICLR (2021); Loog, Viering, Mey, Krijthe & Tax, "A brief prehistory of double descent," PNAS (2020); Hastie, Montanari, Rosset & Tibshirani, Annals of Statistics (2022).
Differential privacy
Add noise scaled to how much one person can change an answer, and the output barely depends on any individual. The guarantee composes, and the budget is spent with every query, so a system that forgets to count is open to simple averaging attacks.
Statement
A randomized mechanism $M$ is $\varepsilon$-differentially private if, for all datasets $D,D'$ differing in one record and all output sets $S$,
The Laplace mechanism releases $f(D)+\mathrm{Lap}(\Delta f/\varepsilon)$, where $\Delta f=\max|f(D)-f(D')|$. Running mechanisms with budgets $\varepsilon_1,\dots,\varepsilon_k$ is $(\sum\varepsilon_i)$-DP (basic composition), and $k$ runs at $\varepsilon$ each are $(\varepsilon\sqrt{2k\ln(1/\delta)}+k\varepsilon(e^\varepsilon-1),\,\delta)$-DP (advanced composition).
Why it's true
The Laplace density is proportional to $e^{-|z-\mu|\varepsilon/\Delta f}$. Moving the centre by at most $\Delta f$ changes the density at every point by a factor of at most $e^{\varepsilon}$, and integrating gives the bound for any $S$. For composition, the likelihood ratios multiply, so the log-ratios add. Consequence: with equal priors, no test can distinguish $D$ from $D'$ with accuracy above $e^{\varepsilon}/(1+e^{\varepsilon})$.
Where it breaks
(i) Unaccounted composition: an interface that adds fresh $\varepsilon$-noise to every query but never tracks the total lets an attacker ask "how many people have the condition?" and "how many, excluding Alice?" repeatedly and average. Dinur and Nissim (2003) showed that answering $O(n)$ subset-sum queries with error $o(\sqrt n)$ allows reconstructing almost the entire database. (ii) Floating point: naive Laplace samplers leak through the low-order bits of the output (Mironov, 2012). (iii) What $\varepsilon$ means: $\varepsilon=10$ allows likelihood ratios of $e^{10}\approx22{,}000$. Deployed budgets vary widely, and the guarantee covers participation of one record, not inferences drawn from population-level statistics.
Key references
Dinur & Nissim, PODS (2003); Dwork, McSherry, Nissim & Smith, TCC (2006); Dwork, Rothblum & Vadhan, FOCS (2010); Mironov, CCS (2012); Dwork & Roth, The Algorithmic Foundations of Differential Privacy (2014; free online); Abowd, KDD (2018), on the 2020 US Census.
Timing side channels
If running time depends on a secret, the secret leaks. An early-exit string comparison reveals how many leading characters of a guess are right, which turns an exponential search into a linear one. Averaging defeats noise, so only constant-time code fixes it.
Statement
Let a comparison of guess $g$ against secret $s\in\Sigma^L$ take time $T(g)=c_0+\Delta\cdot\mathrm{lcp}(g,s)+\eta$, with $\eta$ noise of standard deviation $\sigma$. Recovering $s$ character by character needs
queries, with $N$ samples per candidate, instead of $|\Sigma|^L$ for brute force.
Why it's true
At each position the right candidate takes $\Delta$ longer than the $|\Sigma|-1$ wrong ones. Averaging $N$ samples shrinks the noise to $\sigma/\sqrt N$, so picking the largest mean is a multiple-comparison test whose error falls exponentially in $N\Delta^2/\sigma^2$. Random delays only increase $\sigma$, which the attacker offsets with more samples. Constant-time comparison (accumulate $\bigvee_i(g_i\oplus s_i)$ over all positions with no data-dependent branch) makes $\Delta=0$ and the signal disappears.
Where it breaks (for defenders)
(i) Network jitter doesn't save you. Remote timing differences of tens of microseconds over the internet and around 100 ns on a LAN have been measured with enough samples (Crosby, Wallach & Riedi, 2009), and Brumley and Boneh (2003) extracted RSA keys from OpenSSL across a network. (ii) Compilers can turn constant-time source into branching machine code, so production libraries check the generated assembly or use verified primitives. (iii) Time isn't the only channel: caches, branch predictors and speculative execution (Spectre, Meltdown) leak secrets through microarchitectural state even when the code's own timing is constant.
Key references
Kocher, "Timing attacks on implementations of Diffie-Hellman, RSA, DSS and other systems," CRYPTO (1996); Brumley & Boneh, USENIX Security (2003); Crosby, Wallach & Riedi, ACM TISSEC (2009); Lipp et al., "Meltdown," USENIX Security (2018); Kocher et al., "Spectre attacks," IEEE S&P (2019).
Four threads through the twelve
Randomness is an engineering tool
Two random choices, random registers, random challenges and random timeouts (ideas 1, 4, 6, 7) buy guarantees that no deterministic method can. The guarantee is only as good as the randomness and its independence.
Worst case and typical case disagree
Competitive ratios, NP-hardness and FLP (ideas 2, 3, 7) are statements about adversaries. Real systems are judged on workloads, so the useful question is how close the workload gets to the adversary, as with scans in caches.
Asymptotics hide constants and windows
Thresholds, $1/\sqrt m$ errors, capacity and double descent (ideas 3, 4, 5, 10) are limits. At the sizes engineers use, finite-size windows, small-range bias and blocklength penalties decide the outcome.
Every output is a channel
Noisy answers, response times, proof transcripts and stale reads (ideas 6, 8, 11, 12) all leak information about the state behind them. Privacy and security come down to bounding what repeated observations reveal.
A reading list
- M. Mitzenmacher & E. Upfal, Probability and Computing (2nd ed., 2017). Balls into bins, the probabilistic method, and much of Part I.
- S. Arora & B. Barak, Computational Complexity: A Modern Approach (2009). Including interactive proofs and zero knowledge.
- T. M. Cover & J. A. Thomas, Elements of Information Theory (2nd ed., 2006).
- N. Lynch, Distributed Algorithms (1996), and M. Kleppmann, Designing Data-Intensive Applications (2017).
- C. Dwork & A. Roth, The Algorithmic Foundations of Differential Privacy (2014; free online).
- A. Borodin & R. El-Yaniv, Online Computation and Competitive Analysis (1998), and M. Mézard & A. Montanari, Information, Physics, and Computation (2009).