On the Average-case Complexity of MCSP and Its Variants. Shuichi Hirahara (The University of Tokyo) Rahul Santhanam (University of Oxford)

Transcription

1 On the Average-case Complexity of MCSP and Its Variants Shuichi Hirahara (The University of Tokyo) Rahul Santhanam (University of Oxford) CCC Riga July 6, 2017

2 Minimum Circuit Size Problem (MCSP) Input Truth table T 0,1 2n of a function f: 0,1 n 0,1 Output Is there a circuit of size s that computes f? Size parameter s N Example: s = 5 Output: YES x 1 x 2 x 1 x f =

3 Brief History of MCSP Dates back to 1950s. [Trakhtenbrot s survey] Kabanets & Cai (2000) revived interest, based on natural proofs [Razborov & Rudich (1997)]. [ABKvMR06, AHMPS08, AD14, AHK15, HP15, MW15, HW16, CIKK16, IS17, AH17, IKV17] MCSP P under cryptographic assumptions. MCSP is not NP-hard under restricted reductions. Open Problem: Is MCSP NP-complete?

4 Average-case Complexity Parameterized MCSP[s] for s: N N Input Truth table T 0,1 2n of a function f: 0,1 n 0,1 Size parameter s N Output Is there a circuit of size s(n) that computes f? Consider the uniform distribution on 0,1 2n. Consider zero-error average-case complexity. (i.e. Algorithms output 0, 1, or? ) #YES instances = s O(s) 2 2n

5 Natural Proofs Useful Against SIZE s and Average-case Algorithms for MCSP[s] Natural proof: MCSP s An algorithm that 1. accepts most truth tables, and 2. rejects every truth table of an easy function. YES NO instances

6 Natural Proofs Useful Against SIZE s and Average-case Algorithms for MCSP[s] Natural proof: Claim: MCSP s An algorithm that 1. accepts most truth tables, and 2. rejects every truth table of an easy function. YES Rejects Accepts Natural Proof NO instances

7 Natural Proofs Useful Against SIZE s and Average-case Algorithms for MCSP[s] Natural proof: Claim: MCSP s An algorithm that 1. accepts most truth tables, and 2. rejects every truth table of an easy function. YES? 0 Zero-error Algorithm for MCSP s NO instances

8 Natural Proofs Useful Against SIZE s and Average-case Algorithms for MCSP[s] Natural proof: Claim: MCSP s An algorithm that 1. accepts most truth tables, and 2. rejects every truth table of an easy function. YES 1? 0 Zero-error Algorithm for MCSP s NO instances

9 Natural Proofs Useful Against SIZE s and Average-case Algorithms for MCSP[s] Natural proof: Claim: MCSP s An algorithm that 1. accepts most truth tables, and 2. rejects every truth table of an easy function. YES Natural Proof NO instances

10 Average-case Complexity of MCSP is More Intuitive In the setting of worst-case complexity, MCSP s 1 m p MCSP[s 2 ]? Not known In the setting of average-case complexity, MCSP s 1 MCSP[s 2 ] for s 1 s 2 This reduction is given by the identity map.

11 Outline 1. Pseudorandom self-reducibility of MCSP 2. Hardness of MKTP under Popular Average-Case Conjectures 3. Unconditional Lower Bounds for MCSP

12 Outline 1. Pseudorandom self-reducibility of MCSP 2. Hardness of MKTP under Popular Average-Case Conjectures 3. Unconditional Lower Bounds for MCSP

13 Random Self-reducibility L is (1-query) randomly self-reducible def Randomized poly-time machine Input: x 0,1 N Query q Oracle L Answer L(q) Output L x w.h.p. q is uniformly distributed on 0,1 N

14 Worst-case to Average-case Reduction L is randomly self-reducible, and algorithm solves L on average. algorithm solves L on every inputs. Input: x 0,1 N Query q U N The average-case algorithm Oracle L Answer L(q) Output L x w.h.p.

15 Worst-case Average-case for NP Theorem ([Feigenbaum & Fortnow 1993], [Bogdanov & Trevisan 2006]) NP-complete sets are not randomly self-reducible (unless PH collapses). If MCSP is randomly self-reducible, it provides strong evidence of non-np-hardness of MCSP.

16 Pseudorandom self-reducibility L is (1-query) pseudorandomly self-reducible def Randomized poly-time machine Input: x 0,1 N Query q Answer L(q) Oracle L Output L x w.h.p. q and U N are indistinguishable by SIZE(poly).

17 Worst-case to Average-case Reduction for Feasibly-on-Average Algorithms L is pseudorandomly self-reducible, and algorithm solves L on average and its error set can be decided in P. algorithm solves L on every inputs. Input: x 0,1 N Query q c U N E.g. A poly-time algorithm Oracle L Answer L(q) Output L x w.h.p.

18 MCSP is Pseudorandomly self-reducible Theorem Assume exponentially hard one-way functions exist. Then, for any s: N N, MCSP s n c, s + n c is pseudorandomly reducible to MCSP s.

19 MCSP is Pseudorandomly self-reducible Theorem Assume exponentially hard one-way functions exist. Then, for any s: N N, MCSP s n c, s + n c is pseudorandomly reducible to MCSP s. MCSP s n c, s + n c is the promise problem such that YES instances are truth tables of circuits of size s n n c, NO instances are truth tables of circuits of size > s n + n c.

20 MCSP is Pseudorandomly self-reducible Theorem Assume exponentially hard one-way functions exist. Then, for any s: N N, MCSP s n c, s + n c is pseudorandomly reducible to MCSP s. def f is exponentially hard one-way function. ε > 0 such that Pr x 0,1 n C f x f 1 f x < 2 nε for any circuit C of size < 2 nε.

21 MCSP is Pseudorandomly self-reducible Theorem Assume exponentially hard one-way functions exist. Then, for any s: N N, MCSP s n c, s + n c is pseudorandomly reducible to MCSP s. Main Ingredient: PseudoRandom Function Generator F (PRFG) F: 0,1 no(1) 0,1 2n is a PRFG def 1. F U n O 1 c U 2 n. (computationally indistinguishable) 2. The circuit complexity of F(r) is n c. A PRFG can be constructed from an exponentially hard OWF. [Razborov & Rudich 97], [Goldreich, Goldwasser & Micali 86]

22 Pseudorandom Self-reduction for MCSP Take a pseudorandom function generator F: 0,1 no 1 0,1 2n. Input: T 0,1 2n Pick r randomly. Query q T F(r) MCSP s oracle Output a Answer a 0,1 F r c U 2 n q = T F r c T U 2 n U 2 n. circuit complexity of T (circuit complexity of q) n c.

23 Pseudorandom self-reduction Summary of the 1 st part: 1. Introduced the notion of pseudorandom self-reduction. 2. MCSP is pseudorandomly self-reducible under a standard cryptographic assumption. Open Problem Are NP-complete sets pseudorandomly self-reducible under standard cryptographic assumptions?

24 Outline 1. Pseudorandom self-reducibility of MCSP 2. Hardness of MKTP under Popular Average-Case Conjectures 3. Unconditional Lower Bounds for MCSP

25 MKTP (Minimum Kolmogorov Time-bounded Complexity Problem) Input Output x 0,1 KT x s? Size parameter s N (Intuitively: Can each bit of x be described efficiently by a random access machine?) Definition of KT complexity [Allender, Buhrman, Koucký, van Melkebeek & Ronneburger 06] KT x min d + t U d i = x i in time t for all i. Fact [ABKvMR06]: KT x (circuit complexity of x)

26 Hardness Under Popular Conjectures Theorem 1. MKTP is Random 3SAT-hard (in the sense of Feige). 2. MKTP is Planted Clique-hard. 3. MKTP and MCSP are hard under Alekhnovich s hypothesis about linear equations with noise. Previously, SZK T BPP MCSP was known. [Allender & Das 2014] Our results give the first hardness results based on problems not known to be in SZK.

27 Random 3SAT [Feige 2002] Average-case version of 3SAT Distribution on inputs: A 3CNF formula with n variables and m = Δn clauses (Δ: a large constant) Each clause is chosen uniformly at random. Feige s Hypothesis (Random 3SAT is hard for P) There is no polynomial-time algorithm that 1. accepts every satisfiable formula, and 2. rejects most 3CNF formulae.

28 Random 3SAT hardness Theorem There is a poly-time algorithm with oracle access to MKTP that refutes Feige s hypothesis. Recently, Ryan O Donnell conjectured that Random 3SAT cannot be solved by even conp algorithms. In particular, his conjecture implies that MKTP is not in conp.

29 Proof of Random 3SAT Hardness Construct a many-one reduction: Random 3SAT φ MKTP (φ, θ) for some size parameter θ We need to claim: 1. KT φ > θ with high probability. (Most formulae are incompressible.) 2. KT φ θ for any satisfiable 3CNF formula φ. (Satisfiable formulae are quite rare instances.)

30 = Most Formulae are Incompressible Claim 1 KT φ > θ with high probability (over the choice of random 3CNF formula φ). log 8 n 3 random bits for each clause. (8 ways to negate variables.) φ = x 1 x 3 x 4 x 2 x 3 x 4 x 1 x 2 x 4 m log 8 n 3 random bits in total KT φ K φ > m log 8 n 3 O n w.h.p. θ

31 Satisfiable Formulae are Compressible Claim 2 KT φ m log 8 n 3 for any satisfiable 3CNF formula φ. Assume that some assignment a satisfies φ. Example: a = x 1 0, x 2 0, x 3 0, x 4 1. φ = x 1 x 3 x 4 x 2 x 3 x 4 x 1 x 2 x 4 This clause cannot appear in φ. Given a, each clause can be described by log 7 n bits of information. 3 (There are 7 ways to negate variables so that a clause is satisfied by a.) KT φ a + m log 7 n 3 m log 8 n 3 for large m.

32 Hardness Under Popular Conjectures Summary of the 2 nd part: 1. MKTP is Random 3SAT-hard, Planted Clique-hard, and hard under Alekhnovich s conjecture. 2. MCSP is hard under Alekhnovich s conjecture. Open Problem Is MCSP Random 3SAT-hard or Planted Clique-hard?

33 Outline 1. Pseudorandom self-reducibility of MCSP 2. Hardness of MKTP under Popular Average-Case Conjectures 3. Unconditional Lower Bounds for MCSP

34 Unconditional Lower Bounds Theorem For some size parameters s and s, 1. MKTP s cannot be decided with Ω 1 success on average by AC 0 p for any prime p. 2. MCSP s requires De Morgan formulae of size N 2 o 1 for input length N = 2 n. Proof idea Use ideas of pseudorandom generators for 1. AC 0 p [Fefferman, Shaltiel, Umans and Viola 13] 2. De Morgan formulae [Impagliazzo, Meka and Zuckerman 12]

35 MKTP AC 0 p on average Pseudorandom Generator for AC 0 [p] (p: odd prime) [FSUV 13] G: 0,1 n k 0,1 nk+k x 1,, x k x 1,, x k, PARITY x 1,, PARITY x k Fact. 1. KT G U nk nk + O n. 2. KT U nk+k nk + k n with high probability. MKTP oracle can be used to break G for k = n 2.

36 De Morgan Formula Lower Bounds Idea: Pseudorandom restriction A pseudorandom restriction shrinks a formula. Lemma. [Impagliazzo, Meka & Zuckerman 2012] There is a pseudorandom restriction ρ: N 0, 1, such that 1. ρ i = with probability p = N (1 o 1 ). 2. E ρ L f ρ p 2 L(f) for any function f. 3. Each bit of ρ can be computed in time N o 1. L MCSP s ρ pn for pseudorandom restriction ρ. (because MCSP s ρ depends on most unrestricted variables) pn L MCSP s ρ < p 2 L MCSP s.

37 Unconditional Lower Bounds Summary of the 3 rd part: 1. MKTP is not solvable by AC 0 [p] on average. 2. MCSP requires De Morgan Formulae of size N 2 o 1. Open Problems 1. MCSP AC 0 [p]? 2. MCSP requires De Morgan Formulae of size N 3 o 1?

38 Summary 1. MCSP is pseudorandomly self-reducible under a standard cryptographic assumption. 2. MKTP and MCSP are hard under popular averagecase complexity conjectures. 3. MKTP is not in AC 0 [p] on average. 4. MCSP requires De Morgan formulae of size N 2 o 1.