Bounded Independence versus Symmetric Tests

Transcription

1 Bounded Independence versus Symmetric Tests Ravi Boppana Johan Håstad Chin Ho Lee Emanuele Viola June 1, 018 Abstract For a test T {0, 1} n define k to be the maimum k such that there eists a k-wise uniform distribution over {0, 1} n whose support is a subset of T. For T = { {0, 1} n : i i n/ t} we prove k = Θ(t /n + 1). For T = { {0, 1} n : i i c (mod m)} we prove that k = Θ(n/m + 1). For some k = O(n/m) we also show that any k-wise uniform distribution puts probability mass at most 1/m + 1/100 over T. Finally, for any fied odd m we show that there is an integer k = (1 Ω(1))n such that any k-wise uniform distribution lands in T with probability eponentially close to T / n ; and this result is false for any even m. A preliminary version of this paper appeared in RANDOM 016 [BHLV16] Research Affiliate, Department of Mathematics, Massachusetts Institute of Technology. KTH-Royal Institute of Technology, work done in part while visiting the Simons Institute. Supported by the Swedish Research Council. College of Computer and Information Science, Northeastern University. Supported by NSF grant CCF Work done in part while visiting Harvard University, with support from Salil Vadhan s Simons Investigator grant, and in part while at the Simons Institute for the Theory of Computing.

2 1 Introduction and our results A distribution on {0, 1} n is k-wise uniform, aka k-wise independent, if any k bits are uniform in {0, 1} k. The study of k-wise uniformity has been central to theoretical computer science since at least the seminal work [CW79] by Carter and Wegman. A specific direction has been to show that k-wise uniformity looks random to several classes of tests. These classes include combinatorial rectangles [EGL + 9, CRS00] (for an eposition see e.g. Lecture 1 in [Vio17]), bounded-depth circuits, aka AC 0, [Baz09, Raz09, Bra10, Tal17, HS16] (see e.g. Lectures -3 in [Vio17]), and halfspaces [RS10, DGJ + 10, GOWZ10, DKN10]. More recently a series of works considers smoothed versions of the first two classes, where the input is perturbed with noise, and gives improved bounds [AW89, GMR + 1, HLV, LV17a]. These results have in turn found many applications. For eample, the recent eciting constructions of -source etractors for polylogarithmic min-entropy rely on [Bra10, DGJ + 10]. In this work we etend this direction by giving new bounds for two classes of tests, both symmetric. First we consider the class of mod m tests. Definition 1. For an input length n, and integers m and c, we define the set S m,c := { {0, 1} n : i i c (mod m)}. These tests have been intensely studied at least since circuit compleity theory hit the wall of circuits with mod m gates for composite m in the 80 s. However, the effect of k-wise uniformity on mod m tests does not seem to have been known before this paper. We study for what values of k does there eist a k-wise uniform distribution over {0, 1} n supported on S m,c. Our first main result gives tight bounds on the maimum value of such a k, establishing k = Θ(n/m + 1). The constants hidden in the O, Ω, and Θ notation are absolute. The +1 is there in case n/m is smaller than any constant. Theorem. For all integers m and c, there eists an integer k n/3m and a k-wise uniform distribution on {0, 1} n that is supported on S m,c. Theorem 3. For all integers m, c, and k 140n/m +4, no k-wise uniform distribution on {0, 1} n can be supported on S m,c. Theorem is trivial for m =, as the uniform distribution over S,0 is (n 1)-wise uniform. But already for m = 3 the result is not trivial. Theorem 3 is equivalent to saying that when k 100n/m + 4 then every k-wise uniform distribution must land in S m,c with non-zero probability. For motivation, recall from above the line of works [Baz09, Raz09, Bra10, Tal17, HS16] showing that k-wise uniform distributions fool AC 0 circuits. Specifically, these works show k = poly log n suffices to fool AC 0 circuits on n bits of size poly(n) and depth O(1). It is natural to ask whether the same distribution also fools AC 0 circuits with mod m gates, a frontier class for which we have eponential lower bounds [Raz87, Smo87] (when m is prime) but not good pseudorandom generators. A positive answer might have looked plausible, given that for eample the parity function is hard even with mod 3 gates [Smo87]. But in fact Theorem gives a strong negative answer, showing that k = Ω(n) is necessary even for a single mod 3 gate. 1

3 Theorem proves a conjecture in [LV17b] where this question is also raised. Their motivation was a study of the mod 3 rank of k-wise uniform distributions, started in [MZ09], which is the dimension of the space spanned by the support of the distribution over F 3. [LV17b] shows that achieving 100 log n-wise uniformity with dimension n 0.49 would have applications to pseudorandomness. It also ehibits a distribution with dimension n 0.7 and uniformity k =. Theorem yields a distribution with dimension n 1 and Ω(n)-wise uniformity. We then prove another theorem which is in the same spirit of Theorem 3 but gives different information. First Theorem 4 (a) shows that the largest possible value of k in Theorem is k (n + 1)/m +. Compared to Theorem 3, this result is asymptotically inferior, but gives better constants and has a simpler proof. Theorem 4 (b) shows that when m is odd, if k is larger than (1 γ)n for a positive constant γ depending only on m then k-wise uniformity fools S m,c with eponentially small error. The proof of Theorem 4 (b) however does not carry to the setting of k < n/, for any m. So we establish Theorem 4 (c), which gives a worse error bound but allows for k to become smaller for larger m, specifically, k = O(n/m) for constant error. The error bound in Theorem 4 (c) and the density of S m,c are such that it only provides a meaningful upper bound on the probability that the k-wise uniform distribution lands in S m,c, but not a lower bound. In fact, we conjecture that no lower bound is possible in the sense that there is a constant C > 0 such that for every m there is a Cn-wise uniform distribution supported on the complement of S m,c. Theorem 4. Let m and c be two integers. (a) For k n/m +, a k-wise uniform distribution over {0, 1} n cannot be supported on S m,c. (b) If m is odd, then there is a γ > 0 depending only on m such that for any (1 γ)n-wise uniform distribution D over {0, 1} n, we have Pr[D S m,c ] S m,c / n γn. (c) There eists a universal constant C such that for every ε > 0, n Cm log(m/ε), and any C(n/m)(1/ε) -wise uniform distribution D over {0, 1} n, Pr[D S m,c ] S m,c / n + ε. We note that Theorem 4 (b) is false when m is even because the uniform distribution on S,0 has uniformity k = n 1 but puts about /m mass on S m,0, a set which as we shall see later (cf. Remark 1) has density about 1/m. The latter density bound, in combination with Theorem 4 (b) and Theorem 4 (c) implies that for some k = min{o(n/m), (1 Ω(1))n}, every k-wise uniform distribution puts probability mass at most 1/m + 1/100 over S m,c for odd m and any integer c. We then consider another class of tests which can be written as the intersection of two halfspaces. Definition 5. For an input length n, and an integer t, we define the set H t := { {0, 1} n : i i n/ t}. Again, we ask for what values of k does there eist a k-wise uniform distribution over {0, 1} n supported on H t. We obtain tight bounds for k up to a constant factor, showing that the maimum value of such a k is Θ(t /n + 1).

4 Theorem 6. For every integer t, there eists an integer k t /50n and a k-wise uniform distribution over {0, 1} n that is supported on H t, Theorem 7. For all integers t and k 36t /n + 3, no k-wise uniform distribution over {0, 1} n can be supported on H t. One motivation for these results is to understand for which tests the smoothed version of the test obtained by perturbing coordinates with random noise is fooled by k-wise uniformity. As mentioned earlier, this understanding underlies recent, state-of-the-art pseudorandom generators [AW89, GMR + 1, HLV, LV17a]. See also [LV17b]. Using Theorem 6 we prove that independence Ω(log n) is necessary to fool read-once DNF on n bits, even with constant noise. Note that independence O(log n) is sufficient, even without noise [EGL + 9]. Theorem 8. There eists a read-once DNF d : {0, 1} n {0, 1}, a constant α, and an α log n-uniform distribution D such that Pr[d(U) = 1] Pr[d(D + N α ) = 1] Ω(1), where U is uniform over {0, 1} n, N α is the distribution over {0, 1} n whose bits are independent and are set to uniform with probability α and 0 otherwise, and + is bit-wise XOR. Proof. Let d be the Tribes DNF with width w = log n log ln n + o n (1), see e.g. [O D14]. We have Pr[d(U) = 1] 1/ = o(1). Partition the n bits into n/w blocks of size w. The distribution D has i.i.d. blocks. The projection of each block is an αw-wise uniform distribution with Hamming weight w/3. The probability that d(d + N α ) = 1 is at most the probability that there eists a block where the noise vector N α has Hamming weight w/3. This probability is at most for a sufficiently small α. 1.1 Techniques (n/w) w (α/) w/3 1/3, We give two related approaches to proving Theorem. At a high level, both approaches are similar to the work of Alon, Goldreich, and Mansour [AGM03], which shows that one can apply a small perturbation to the probability masses of every almost k-wise uniform distribution on {0, 1} n to make it k-wise uniform, showing that every ε-almost k-wise uniform distribution on {0, 1} n is n O(k) ε-close to a k-wise uniform distribution, in statistical distance. However, in their setting there is no constraint on the support. This makes our proof significantly more technical. Our first approach uses the following equivalent definition for a distribution on {0, 1} n to be k-wise uniform: the distribution is unbiased under any parity test on at most k bits. To construct our distribution, we first start with the uniform distribution over the set S m,c, and show that the bias under each of these parity tests is small enough, so that they can be made zero by a small perturbation of the probability masses of the distribution. Our goal is then to show that the change in the probability on each weight is no more than the probability we start with, so that it remains non-negative after the perturbation. In the conference version of this paper [BHLV16], we use this approach to prove a slightly weaker version of Theorem. We refer the interested readers to [BHLV16] for details. 3

5 We now give an overview of the second approach, which is developed in this paper. Instead of looking at the biases of parity tests, we consider another equivalent characterization of k-wise uniform distributions that are symmetric. To simplify the calculations, we will switch to { 1, 1} and consider distributions supported on S m,c := {y { 1, 1} n : i y i c (mod m)}. One can then translate results for { 1, 1} n back to {0, 1} n (See Fact 1). A symmetric distribution is k-wise uniform on { 1, 1} n if and only if the first k moments of the sum of its n bits match the ones of the uniform bits. Similar to the first approach, we start with the uniform distribution on S m,c, and show that the first k moments of the sum of the bits are close to the ones of the uniform bits. Then, we perturb the probabilities on k +1 of the sums i y i of the distribution to match these moments eactly. Once again, our goal is to show that the amount of correction is small enough so that the adjusted probabilities remain non-negative. Note that in this approach we work with distributions over the integers instead of {0, 1} n. While the two approaches seem similar to each other, the latter allows us to perform a more refined analysis on the tests we consider in this paper, and obtain the tight lower bounds for both modular and threshold tests. Organization. We begin with Theorem 4 in Section because it is simpler. We use the second approach to prove the tight lower bounds for S m,c and H t in Sections 3 and 4, respectively. The proof of Theorem involves a somewhat technical lemma which we defer to Section 5. Finally, we prove our tight upper bounds for S m,c and H t in Sections 6 and 7, respectively. Proof of Theorem 4 In this section we prove Theorem 4. We start with the following theorem which will give Theorem 4 (a) as a corollary. Theorem 9. Let I {0, 1,..., n} be a subset of size I n/. There does not eist a I wise uniform distribution on {0, 1} n that is supported on S := { {0, 1} n : i i I}. Proof. Suppose there eists such a distribution D. Define the n-variate nonzero real polynomial p by p() := ( n i + j ). i I Note that p() = 0 when S. And so E[p (D)] = 0 in particular. However, since p has degree at most I, we have E[p (D)] = E[p (U)] > 0, where U is the uniform distribution over {0, 1} n, a contradiction. Proof of Theorem 4 (a). When I corresponds to the mod m test S m,c, I n/m + 1. We now move to Theorem 4 (b). First we prove a lemma giving a useful estimate of k ( 1) i=1 i. S m,c 4

6 Similar bounds have been established elsewhere, cf. e.g. Theorem.9 in [VW08], but we do not know of a reference with an eplicit dependence on m, which will be used in the net section. Theorem 4 (b) follows from bounding above the tail of the Fourier coefficients of the indicator function of S m,c. Lemma 10. For any 1 k n 1 and any 0 c m 1, we have k ( ( 1) i=1 i n cos π ) n, m S m,c while for k = 0, we have k ( ( 1) i=1 i n /m n cos π ) n. m S m,c For odd m the first bound also holds for k = n. Proof. Consider an epansion of p(y) = (1 y) k (1 + y) n k into n terms indeed by {0, 1} n where i = 0 indicates that we take the term 1 from the ith factor. It is easy to see that the coefficient of y d is =d ( 1) k i=1 i, where denotes the number of occurrences of 1 in. Denote ζ := e πi/m as the mth root of unity. Recall the identity m 1 1 m j=0 ζ j(d c) = Thus the sum we want to bound is equal to { 1 if d c (mod m) 0 otherwise. m 1 1 ζ jc p(ζ j ). m j=0 Note that p(ζ 0 ) = p(1) = 0 for k 0 while for k = 0, p(ζ 0 ) = n. For the other terms we have the following bound. Claim 11. For 1 j m 1, p(ζ j ) ( ) n cos π k ( m cos π n k. m) Proof. As 1 + e iθ = cos(θ/) and 1 e iθ = sin(θ/) we have p(ζ j ) = 1 ζ j k 1 + ζ j n k ( = n sin jπ ) k ( cos jπ ) n k m m ( n cos π ) k ( cos π n k, m m) where the last inequality holds for odd m because (1) sin jπ m 1 is largest when j = or m j = m+1, () sin( π ) = cos, and (3) cos jπ is largest when j = 1 or j = m 1. For even m m the term with j = m/ is 0, as in this case we are assuming that k < n, and the bounds for odd m are valid for the other terms. 5

7 Therefore, for k 0 we have k ( 1) i=1 i S m,c = m 1 ( m n cos π ) k ( cos π ) n k ( n cos π ) k ( cos π n k, m m m m) and we complete the proof using the fact that cos(π/m) cos(π/m). For k = 0 we also need to include the term p(1) = n which divided by m gives the term n /m. Remark 1. Clearly the lemma for k = 0 simply is the well-known fact that the cardinality of S m,c is very close to n /m. Equivalently, if is uniform in {0, 1} n then the probability that i i c (mod m) is very close to 1/m. Proof of Theorem 4 (b). Let f : {0, 1} n {0, 1} be the characteristic function of S m,c. We first bound above the nonzero Fourier coefficients of f. By Lemma 10, we have for any β with β = k > 0, ˆf β = n k ( 1) i=1 i (cos π ) n αn, m S m,c where α = ln cos(π/m) depends only on m. Thus, if D is k-wise uniform, E[f(D)] E[f(U)] ˆf [ β E D ( 1) ] i β i ˆf n β αn β >k β >k t=k+1 ( n t ) n k 1 = αn t=0 ( ) n. t For k (1 δ)n, we have an upper bound of n(h(δ) α). H(δ) α/. The result follows by setting γ := min{α/, δ}. Pick δ small enough so that Note that the above proof fails when m is even as we cannot handle the term with β = n. Finally, we prove Theorem 4 (c). We use approimation theory. Proof of Theorem 4 (c). Let f : {0, 1} n {0, 1} be the characteristic function of S m,c. The proof amounts to ehibiting a real polynomial p in n variables of degree d = C(n/m)(1/ε) such that f() p() for every {0, 1} n, and E[p(U)] ε for U uniform over {0, 1} n. To see that this suffices, note that E[p(U)] = E[p(D)] for any distribution D that is d-wise uniform. Using this and the fact that f is non-negative, we can write 0 E[f(U)] E[p(U)] ε and 0 E[f(D)] E[p(D)] ε Hence, E[f(U)] E[f(D)] ε. This is the method of sandwiching polynomials from [Baz09]. Let us write f = g( i i/n), for g : {0, 1/n,..., 1} {0, 1}. We ehibit a univariate polynomial q of degree d such that g() q() for every, and the epectation of q under the binomial distribution is at most ε. The polynomial p is then q( i i/n). Consider the continuous, piecewise linear function s : [ 1, 1] [0, 1] defined as follows. The function is always 0, ecept at intervals of radius a/n around the inputs where g equals 1, i.e., inputs such that n is congruent to c modulo m. In those intervals it goes up and down like a Λ, reaching the value of 1 at. We set a = εm/10. 6

8 By Jackson s theorem (see e.g., [Car, Theorem 7.4] or [Che66]), for d = O(nε 1 a 1 ) = O(nε m 1 ), there eists a univariate polynomial q of degree d that approimates s with pointwise error ε/10. Our polynomial q is defined as q := q + ε/10. It is clear that g() q() for every {0, 1/n,..., 1}. It remains to estimate E[q(U)]. As q is a good approimation of s we have E[q(U)] ε/10 + E[s(U)]. We noted in Remark 1 that the remainder modulo m of i is δ-close to uniform for δ = cos(π/m) n = e Ω(n/m). Now the function s, as a function of i, is a periodic function with period m and if we feed the uniform distribution over {0, 1/n,..., m/n} into s we have E[s] ε/10. It follows that if n is at least a large constant times m (log(m/ε)), we have E[s(U)] ε/10 and we conclude that E[q(U)] 4ε/10. 3 Tight lower bound on k-wise uniformity vs. mod m In this section we prove Theorem. For convenience, from now on we will consider the space { 1, 1} n instead of {0, 1} n. In particular, we will consider strings { 1, 1} n that satisfy i i c (mod m). One can translate results stated for {0, 1} n to results for { 1, 1} n and vice versa using the following fact. Fact 1. Let {0, 1} n and y { 1, 1} n be the string obtained by replacing each i by y i = 1 i. Then y i = n i (mod m), i i and conversely, i i { 1 (n i y i) (mod m) if m odd, (n i y i)/ (mod m ) if m and n are even. Let n be a positive integer. Let X 1, X,..., X n be independent random variables chosen uniformly from { 1, 1}. Let B be the sum of all the X j. The distribution of B is a shifted binomial distribution. Note that B has the same parity as n. Theorem 13. Let m and n be positive integers and c be an integer. Suppose that m is odd or n and c have the same parity. Let k be a positive integer such that k n. Then there 8m is a probability distribution on the c mod m integers that matches the first k moments of B. Furthermore, the support of the probability distribution is a subset of the support of B. Theorem follows from applying Fact 1 to Theorem 13. Our goal is to come up with a distribution supported on c mod m so that its first k moments match the moments of B. We first start with a measure q on the c mod m integers. Here q may not be a probability measure its values may not sum to 1. However, we will show that we can turn q into a probability measure p by a small adjustment on k + 1 appropriately chosen positive values of q(). 7

9 3.1 Defining C m,c () Let m be a positive integer (the modulus). Let c be an integer (the residue). We will assume that either m is odd or n and c have the same parity. We will use Iverson bracket notation: true = 1 and false = 0. Define the comb function C m,c on the integers by C m,c () = m c (mod m) if m is odd and C m,c () = m c (mod m) if m is even. 3. Defining q() Define the function q on the integers by q() = C m,c () Pr[B = ]. Note that q is nonnegative. Also if q() 0, then is c (mod m) and in the support of B. Lemma 14. If f is a function on the integers, then q()f() = E[C m,c (B)f(B)]. Proof. By the definition of epected value, we have q()f() = Pr[B = ]C m,c ()f() = E[C m,c (B)f(B)]. 3.3 Defining Lagrange polynomials Let k be a positive integer. Let a 0, a 1,..., a k be k + 1 distinct integers that are c mod m, n mod, and as close to 0 as possible. Because they are as close to 0 as possible, we have a j (k + 1)m km. In our application, km will be at most n. So each a j will be in the support of B. Given an integer v such that 0 v k, define the Lagrange polynomial L v as follows: L v () = ( a j ). 0 j k j v Note that L v (a w ) = 0 if and only if v w. It s well known that L 0, L 1,..., L k form a basis (the Lagrange basis) of the vector space of polynomials of degree at most k. 3.4 Defining () Define the function on the integers as follows. If equals a v (for some v), then For a w for any w, then () = 0. (a v ) = E[C m,c(b)l v (B)] E[L v (B)]. L v (a v ) Lemma 15. If f is a polynomial of degree at most k, then ()f() = E[C m,c (B)f(B)] E[f(B)]. 8

10 Proof. We will first prove the claim when f is a Lagrange polynomial L v. If () 0, then is of the form a w for some w. But if L v (a w ) 0, then v = w. So the sum has at most one nonzero term, corresponding to = a v. And the equation is true in this case by the definition of. We have proved the claim for Lagrange polynomials. But every polynomial of degree at most k is a linear combination of the Lagrange polynomials. This completes the proof. 3.5 Defining p() Define the function p on the integers by p() = q() (). Note that if p() 0, then is c mod m and (assuming km n) in the support of B. Lemma 16. If f is a polynomial of degree at most k, then p()f() = E[f(B)]. Proof. By Lemmas 14 and 15, we have p()f() = q()f() = E[C m,c (B)f(B)] = E[f(B)]. ()f() ( ) E[C m,c (B)f(B)] E[f(B)] To show that p is nonnegative, we will show that () 1 q(). First we bound above (). Then we bound below q(). Recall that () = E[Cm,c(B)Lv(B)] E[Lv(B)] L v(a v) if equals a v for some v (and 0 otherwise). Lemmas 0 and below give upper and lower bounds on the numerator and denominator, respectively. 3.6 Bounding above E[L v (B)C m,c (B)] E[L v (B)] We start this section by proving a few lemmas that will be useful to obtaining the upper bound. Lemma 17. If θ is a real number such that θ < π, then tan θ θ. Proof. By symmetry, we may assume that θ 0. Recall that sec is 1/ cos. The derivative of tan is sec. Because cos 1, it follows that sec 1. Integrating both sides (from 0 to θ) gives tan θ θ. Lemma 18. If θ is a real number such that θ π, then cos θ e θ /. Proof. By symmetry, we may assume that θ 0. The case θ = π/ is trivial, so we will assume that θ < π/. The derivative of ln cos is tan. By Lemma 17, we have tan for 0 < π. Integrating both sides (from 0 to θ) gives ln cos θ θ /. Eponentiating gives the desired inequality. 9

11 Lemma 19. Let r be an integer such that 0 r n. Let m be an integer such that 8 1 m n. Suppose that m is odd or n and c have the same parity. Then E[B r C m,c (B)] E[B r ] 8(3rm) r e n/m. Proof. Let m be m if m is odd and m/ if m is even. Let α be π/m. For now, we will assume that n and c have the same parity. At the end, we will show how to adjust the proof when n and c have the opposite parity. Because B and n have the same parity, B c is even. So we have the identity m 1 e ijα(b c) = C m,c (B) 1. Hence, by the triangle inequality and then Lemma 38, whose proof we defer to Section 5, we have (Lemma 38 is the second inequality) E[B r C m,c (B)] E[B r ] [ E = ] e ijα(b c) B r m 1 m 1 = e ijαc E[B r e ijαb ] m 1 E[B r e ijαb ] m 1 (8r cot jα ) r cos jα n/ m 1 = (8r) r cot jα r cos jα n/. The sum is symmetric: the terms corresponding to j = l and j = m l are equal. So we can double its first half: E[B r C m,c (B)] E[B r ] m / 4(8r) r cot jα r cos jα n/. 10

12 Therefore, by Lemmas 17 and 18, we have E[B r C m,c (B)] E[B r ] m / ( 1 ) re 4(8r) r j α n/4 jα ( 8r ) m / r 4 α ( 8rm ) m / r 4 π m / 4(3rm) r m / 4(3rm) r e j α n/4 e j π n/(4m ) e j n/m e jn/m. The sum is a geometric series whose common ratio is less than 1, so we can bound it by twice its first term: E[B r C m,c(b)] E[B r ] 8(3rm) r e n/m. The proof above assumed that n and c have the same parity. When n and c have the opposite parity, we can adjust the proof as follows. From the parity hypothesis in the theorem, we know that m is odd. In particular, m = m. Because B and n have the same parity, B c is odd. So we have the identity m 1 ( 1) j e ijα(b c) = C m,c (B) 1. It s the same identity as before ecept for the factor of ( 1) j. We can now continue with the remainder of the proof. The factor of ( 1) j goes away as soon as we apply the triangle inequality. Hence we obtain the same bound. Lemma 0. Let m be an integer such that 1 m n. Suppose that m is odd or n and c have the same parity. Suppose that k n. If v is an integer such that 0 v k, then 8 E[Lv (B)C m,c (B)] E[L v (B)] 8(5km) k e n/m. Proof. Given a subset A of {1,,..., n}, define X A to be the product of the X j for which j is in A. By epanding the product, we have L v (B) = j v (B a j ) = A ( 1) A a A B k A, 11

13 where A ranges over every subset of {0, 1,..., k} {v}. Therefore, by the triangle inequality, Lemma 19, and the binomial theorem, we have [ E[L v (B)C m,c (B)] E[L v (B)] = E [C m,c (B) 1]L v (B)] [ = E [C m,c (B) 1] ] ( 1) A a A B k A A = [ ] ( 1) A a A E [C m,c (B) 1]B k A A [ ] a A E [C m,c (B) 1]B k A A A A (km) A E [[C m,c (B) 1]B k A ] (km) A 8(3(k A )m) k A e n/m = 8e n/m A 8e n/m A (km) A (3(k A )m) k A (km) A (3km) k A 3.7 Bounding below L v (a v ) = 8e n/m (5km) k. Our lower bound on L v (a v ) follows from the following claim. Claim 1. Let a 0 < < a k be k + 1 points such that for every j {1,..., k} we have a j a j 1 d. Then for any integer t such that 0 t k, ( kd ) k. a t a j e Proof. First observe that we have a t a j d t j. So we have t a j j t a d t j = d k t!(k t)!. j t j t We will use Stirling s formula in the form! e f(), where f() = ln for > 0 and e f(0) = 0. Note that f is conve on the interval [0, ). Hence we have ( kd ) k. a t a j d k t!(k t)! d k e f(t)+f(k t) d k e f(k/) = e j t Lemma. If v is an integer such that 0 v k, then ( km ) k. L v (a v ) 6 Proof. Without loss of generality, assume that the a j are in sorted order. Then this lemma follows from Claim 1 with d replaced by m. 1

14 3.8 Conclude upper bound on () Lemma 3. Let m be an integer such that 1 m n. Suppose that m is odd or n and c have the same parity. Suppose that k n. If is an integer, then 8 () 8(30) k e n/m. Proof. If is different from a v for every v, then () = 0. So we may assume that = a v for some v. By Lemmas 0 and, we have 3.9 Bounding below q() () = E[C m,c(b)l v (B)] E[L v (B)] L v (a v ) 8(5km)k e n/m (km/6) k = 8(30) k e n/m. Lemma 4. If a is an integer such that a n and a n (mod ), then Pr[B = a] a /n 1 n. Proof. The event B = a is equivalent to n+a of the X j being 1 and the other n a being 1. Hence Pr[B = a] = 1 ( ) n. n (n + a)/ If a = n or a = n, then the desired inequality is easy to check. So we will assume that a < n. We will use Stirling s formula in the form where is a positive integer. We have ( ) n n! = n+a (n + a)/! n a! e π! e e, n n πn ( n+a )(n+a)/ ( n a )(n a)/ e (n + a)/ (n a)/ = H( 1 + a n )n πn e n a, where H is the binary entropy function H() = log (1 ) log (1 ). It s known 13

15 that H() 4(1 ). That means H( 1 + a ) 1 a. So we have n n ( ) n n a /n πn (n + a)/ e n a Dividing by n gives the desired inequality Conclude () q() n a /n π e n n a /n 1 n. Lemma 5. Let m and n be positive integers and c be an integer. Suppose that m is odd or n and c have the same parity. Let k be a positive integer such that k n. If is an 8m integer, then () 1q(). Proof. If is different from a v for every v, then () = 0. So we may assume that = a v for some v. By Lemma 3, we have () 8(30) k e n/m 1 4 e8k e n/m 1 4 en/m e n/m = 1 4 e n/m. By the definition of q and Lemma 4, we have We know that So q() = C m,0 () Pr[B = ] m Pr[B = ] /n m 4 n. = a v km n 4m. q() n/(16m ) m 4 n ) m e n/(16m 4 n. Applying the inequality e /e (to = 4n/m ), we have Thus Hence 4n m e4n/(em) e 3n/(m). m 4 n = 1 ( 4n ) 1/ 1 m e 3n/(4m). q() 1 e 3n/(4m) e n/(16m) 1 e n/m. Comparing our bounds for and q, we see that () 1 q(). 14

16 3.11 Conclude lower bound Proof of Theorem 13. Recall the function p from Lemma 16. We will show that p is the desired probability distribution. From the definition of p and Lemma 5, we get p() 1 q(); in particular, p is nonnegative. Applying Lemma 16 to the constant function 1 (the zeroth moment), we see that the sum of the p() is 1. In other words, p is indeed a probability distribution. Applying Lemma 16 to the other monomials (namely,,..., k ), we see that p matches the first k moments of B. This completes the proof. 4 Tight lower bound on k-wise uniformity vs. threshold In this section we prove Theorem 6. Like the last section, we will work with { 1, 1} n and translate the results back to {0, 1} n using the following fact. Fact 6. Let {0, 1} n and y { 1, 1} n be the string obtained by replacing each i by y i = 1 i. Then i i n/ t if and only if i y i t. Let n be a positive integer. Let X 1, X,..., X n be independent random variables chosen uniformly from { 1, 1}. Let B be the sum of all the X j. The distribution of B is a shifted binomial distribution. Note that B has the same parity as n. Theorem 7. Let n and t be positive integers such that t n. Let k be a positive integer such that k t. Then there is a probability distribution on the integers with absolute 00n value at most t that matches the first k moments of B. Furthermore, the support of the probability distribution is a subset of the support of B. Theorem 6 follows from applying Fact 6 to Theorem 7. Let m be an odd integer between n and n. In Theorem 13, we constructed a probability 3t t distribution (call it p ) on the 0 mod m integers that matches the first t moments of B. 8n Furthermore, the support of p is a subset of the support of B. Looking at the proof, we see that p () 1C m,0() Pr[B = ] for all. Let C () be p ()/ Pr[B = ] if Pr[B = ] > 0 and C m,0 () otherwise. We have p () = C () Pr[B = ] for all. Because p matches the first few moments of B, we have E[C (B)f(B)] = E[f(B)] for every polynomial f of degree at most t. Also, 8n C () 1C m,0() for all. Given an integer, let T () be t C (). 4.1 Defining q() Given an integer, define q() to be T () Pr[B = ]. Note that q is nonnegative. Also if q() 0, then t and is in the support of B. Lemma 8. If f is a function on the integers, then q()f() = E[T (B)f(B)]. Proof. By the definition of epected value, we have q()f() = Pr[B = ]T ()f() = E[T (B)f(B)]. 15

17 4. Defining Lagrange polynomials Let a 0, a 1,..., a k be k + 1 distinct integers that are 0 mod m, n mod, and as close to 0 as possible. Because they are as close to 0 as possible, we have a j (k + 1)m km. Because k t and m n, we have km t n. So a 00n t j t and a j is in the support of B. Given an integer v such that 0 v k, define the Lagrange polynomial L v as follows: L v () = ( a j ). 0 j k j v Note that L v (a w ) = 0 if and only if v w. It s well known that L 0, L 1,..., L k form a basis (the Lagrange basis) of the vector space of polynomials of degree at most k. 4.3 Defining () Define the function on the integers as follows. If equals a v (for some v), then For a w for any w, then () = 0. (a v ) = E[T (B)L v(b)] E[L v (B)]. L v (a v ) Lemma 9. If f is a polynomial of degree at most k, then ()f() = E[T (B)f(B)] E[f(B)]. Proof. We will first prove the claim when f is a Lagrange polynomial L v. If () 0, then is of the form a w for some w. But if L v (a w ) 0, then v = w. So the sum has at most one nonzero term, corresponding to = a v. And the equation is true in this case by the definition of. We have proved the claim for Lagrange polynomials. But every polynomial of degree at most k is a linear combination of the Lagrange polynomials. This completes the proof. 4.4 Defining p() Define the function p on the integers by p() = q() (). Note that if p() 0, then t and is in the support of B. Lemma 30. If f is a polynomial of degree at most k, then p()f() = E[f(B)]. Proof. By Lemmas 8 and 9, we have p()f() = q()f() ()f() ( ) = E[T (B)f(B)] E[T (B)f(B)] E[f(B)] = E[f(B)]. 16

18 We will show that () 1 q(). First we bound above (). Then we bound below E[Lv(B)T (B)] E[Lv(B)] q(). Recall that () = L v(a v) if equals a v for some v and 0 otherwise. Lemmas 34 and 35 below give upper and lower bounds on the numerator and denominator, respectively. 4.5 Bounding above E[L v (B)T (B)] E[L v (B)] We start this section by proving the following lemma. Lemma 31. Let d be a nonnegative integer. Then the (d)th moment E[B d ] is at most (d)! d d! nd. Proof. The odd moments of each X j are all 0. The even moments of X j are all 1. Let g 1, g,..., g n be independent standard Gaussians (with mean zero and unit variance). The odd moments of g j are all 0. If c is a nonnegative integer, then the (c)th moment of g j is known to be (c)!, the product of the positive odd integers less than c. In particular, the c c! even moments of g j are all at least 1. So the moments of X j are at most the corresponding moments of g j. Let G be the sum of the g j. When we epand B d and G d, each gives a sum of n d terms. By the previous paragraph, the epectation of each term of B d is at most the epectation of the corresponding term of G d. Hence the (d)th moment of B is at most the (d)th moment of G. But G is a Gaussian with mean zero and variance n. In particular, G/ n is a standard Gaussian. So we have E[B d ] E[G d ] = n d E[(G/ n ) d ] = (d)! d d! nd. Lemma 3. If d is a nonnegative integer, then E[B d ] is at most (dn/e) d. Proof. The case d = 0 is trivial (interpreting 0 0 as 1), so we will assume that d is positive. Lemma 31 says that E[B d ] (d)! d d! nd. To bound the factorials, we will use the following precise form of Stirling s formula due to Robbins [Rob55]: if is a positive integer, then Hence we have (d)! d d! e π e 1/(1+1) <! < e π e 1/(1). < (d)d e d 4πd e 1/(4d) d d d e d πd e = ( d ) de 1/(4d) 1/(1d+1) < ( d ) d. 1/(1d+1) e e Lemma 33. Let n and t be positive integers such that t n and t 00n. Let r be an integer such that 0 r t 9n. Then E[B r T (B)] E[B r ] t r e t /(6n). 17

19 Proof. Let s be a nonnegative integer such that r + s is an even number between t 9n (Because t 00n, there is such an s.) We have and t 8n. B > t t s B s. Hence, by the moment-matching property of C, the definition of T, the triangle inequality, and Lemma 3, we have E[B r ] E[B r T (B)] = E[B r C (B)] E[B r T (B)] = E [ B r C (B) B > t ] E [ B r C (B) B > t ] t s E [ B r+s C (B) ] = t s E [ B r+s C (B) ] = t s E [ B r+s] ( (r + s)n t s e ( (r + s)n = t r et ) t /(18n) ( 1 t r 8e t r e t /(6n). ) (r+s)/ ) (r+s)/ Lemma 34. Let n and t be positive integers such that t n. Let k be a positive integer such that k. If v is an integer such that 0 v k, then t 00n E[Lv (B)T (B)] E[L v (B)] (t) k e t /(6n). Proof. Recall that for a subset A of {1,,..., n}, we define X A to be the product of the X j for which j is in A. By epanding the product, we have L v (B) = j v (B a j ) = A ( 1) A a A B k A, where A ranges over every subset of {0, 1,..., k} {v}. Therefore, by the triangle inequality, 18

20 Lemma 33, and the binomial theorem, we have [ E[L v (B)T (B)] E[L v (B)] = E [T (B) 1]L v (B)] [ = E [T (B) 1] ] ( 1) A a A B k A A = [ ] ( 1) A a A E [T (B) 1]B k A A [ ] a A E [T (B) 1]B k A A A A t A E [[T (B) 1]B k A ] t A t k A e t /(6n) = e t /(6n) A t k 4.6 Bounding below L v (a v ) = e t /(6n) (t) k. Lemma 35. If v is an integer such that 0 v k, then ( kn ) k. L v (a v ) 9t Proof. Without loss of generality, assume that the a j are in sorted order. Then this lemma follows from Claim 1 (with d replaced by m) and the bound m n. 3t 4.7 Conclude upper bound on () Lemma 36. Let n and t be positive integers such that t n. Let k be a positive integer such that k. If is an integer, then t 00n () 1 50 e t /(1n). Proof. If is different from a v for every v, then () = 0. So we may assume that = a v for some v. By Lemmas 34 and 35, we have () = E[T (B)L v(b)] E[L v (B)] L v (a v ) (t)k e t /(6n) (kn/(9t)) k ( 18t ) ke t = /(6n) kn 1 ( 1800t ) ke t /(6n). 50 kn 19

21 The epression ( 1800t kn )k is an increasing function of k on the interval (0, 1800t ]. Because en k t, we have 00n ( 1800t ) k ( ) t /(00n) e t /(1n). kn Plugging this bound into our previous inequality for () completes the proof. 4.8 Conclude () q() Lemma 37. Let n and t be positive integers such that t n. Let k be a positive integer such that k t. If is an integer, then () 1q(). 00n Proof. If is different from a v for every v, then () = 0. So we may assume that = a v for some v. By Lemma 36, we have () 1 /(1n) 50 e t. By the definition of q and Lemma 4, we have q() = C () Pr[B = ] 1 C m,0() Pr[B = ] n 6t Pr[B = ] /n n 1t. We know that So = a v km t 00n n t = t 100. q() t /(10000n) n 1t /(10000n) n e t 1t. Applying the inequality e /e (to = t ), we have 4n Thus Hence t 4n et /(4en) e t /(10n). n 1t = 1 ( t ) 1/ 1 /(0n) 4 4n 4 e t. q() 1 4 e t /(0n) e t /(10000n) 1 4 e t /(1n). Comparing our bounds for and q, we see that () 1 q(). 4.9 Conclude lower bound Proof of Theorem 7. Recall the function p from Lemma 30. We will show that p is the desired probability distribution. From the definition of p and Lemma 37, we get p() 1 q(); in particular, p is nonnegative. Applying Lemma 30 to the constant function 1 (the zeroth moment), we see that the sum of the p() is 1. In other words, p is indeed a probability distribution. Applying Lemma 30 to the other monomials (namely,,..., k ), we see that p matches the first k moments of B. This completes the proof. 0

22 5 Proof of Lemma 38 In this section, we will prove the following lemma that was used in the proof of Lemma 19. Recall that X 1, X,..., X n are independent random variables chosen uniformly from { 1, 1}, and B is the sum of all the X j. Lemma 38. Let r be an integer such that 0 r n. Let θ be a real number such that 8 sin θ 0. Then E[B r e iθb ] (8r cot θ ) r cos θ n/. Remark. By the triangle inequality and Lemma 31, we have E[B r e iθb ] (r)! r r! nr, whether sin θ is zero or not. Recall that for a subset A of {1,,..., n}, we define X A to be the product of the X j for which j is in A. We will need the hyperbolic functions. Recall that cosh z is (e z + e z )/, sinh z is (e z e z )/, tanh z is sinh z/ cosh z, coth z is cosh z/ sinh z, and sech z is 1/ cosh z. Lemma 39. If A is a subset of {1,,..., n} and z is a comple number, then E[X A e zb ] = (sinh z) A (cosh z) n A. Proof. Because B is the sum of the X j, we have [ E[X A e zb ] = E j A X j n ] e zx j [ = E X j e zx j = j A = j A j A j / A ] e zx j E[X j e zx j ] j / A E[e zx j ] sinh z j / A cosh z = (sinh z) A (cosh z) n A. Lemma 40. Let A be a subset of {1,,..., n}. Let θ be a real number. If sin θ < cos θ, then E[X A e iθb ] = (cos θ) n/ E[X A e λb ], where λ is 1 1+ tan θ ln. 1 tan θ Proof. Because sin θ < cos θ, we have tan θ < 1, so λ is well defined. From our choice of λ, we have It follows that cosh λ = tanh λ = eλ 1 e λ + 1 = (1 + tan θ ) (1 tan θ ) (1 + tan θ ) + (1 tan θ ) 1 1 tanh λ = 1 1 tan θ = cos θ cos θ sin θ = tan θ. = cos θ cos θ. 1

23 Hence cos θ sinh λ = tanh λ cosh λ = tan θ = cos θ sin θ cos θ. Therefore, applying Lemma 39 twice, we have E[X A e iθb ] = sinh iθ A cosh iθ n A = sin θ A cos θ n A = (cos θ) n/ (sinh λ) A (cosh λ) n A = (cos θ) n/ E[X A e λb ]. Let r be a nonnegative integer. Let f be a function from {1,,..., r} to {1,,..., n}. Define odd(f), the odd image of f, to be the set of j in {1,,..., n} such that f 1 (j) is odd. Note that odd(f) r and odd(f) n. Lemma 41. If r is a nonnegative integer, then B r = f Xodd(f), where the sum is over every function f from {1,..., r} to {1,..., n}. Proof. By epanding B r and eploiting the constraint that each X j is ±1, we have B r = f = f = f = f = f X f(1) X f(r) n n X f 1 (j) j X f 1 (j) mod j j odd(f) X odd(f). X j Lemma 4. Let r be a nonnegative integer. Let θ be a real number. (a) If r n, then E[B r e iθb ] n r cos θ n r. (b) If sin θ < cos θ, then E[B r e iθb ] (cos θ) n/ E[B r e λb ], where λ is 1 Proof. By Lemma 41 and the triangle inequality, we have E[B r e iθb [ ] ] = E X odd(f) e iθb = E[X odd(f) e iθb ] f f We will use this inequality in both parts. f ln 1+ tan θ 1 tan θ. E[X odd(f) e iθb ].

24 (a) By Lemma 39, we have E[B r e iθb ] f = f E[X odd(f) e iθb ] sin θ odd(f) cos θ n odd(f) = cos θ n r f cos θ n r f sin θ odd(f) cos θ r odd(f) 1 = n r cos θ n r. (b) By Lemmas 40 and 41, we have E[B r e iθb ] f = f E[X odd(f) e iθb ] (cos θ) n/ E[X odd(f) e λb ] = (cos θ) n/ f E[X odd(f) e λb ] = (cos θ) n/ E[B r e λb ]. Lemma 43. If r 0 and λ is a nonzero real number, then ( 4r ) r ( E[ B r e λb ] cosh 11 ) n. λ 10 λ Proof. First we will bound B r by an eponential. Let a be 10r. Let s temporarily assume e λ that r 0. Applying the inequality e /e (to = B /a), we have B ae B /(ea). Raising both sides to the rth power gives B r a r e r B /(ea). Plugging in the definition of a, we have B r a r e λb /10. This inequality is true for r = 0 too. Now we are ready to prove the desired inequality. By Lemma 39 (with A = ), we have E[ B r e λb ] E[ B r e λb ] a r E[e λb /10 e λb ] = a r E[e 11 λb /10 ] a r E[e 11λB/10 + e 11λB/10 ] ( = a r cosh 11 ) n 10 λ ( 10r ) r ( = cosh 11 ) n e λ 10 λ ( 4r ) r ( cosh 11 ) n. λ 10 λ 3

25 Lemma 44. If λ is a real number, then tanh λ λ. Proof. By symmetry, we may assume that λ 0. The derivative of tanh is sech. Because cosh 1, it follows that sech 1. Integrating both sides (from 0 to λ) gives tanh λ λ. Lemma 45. If λ is a real number and c 1, then cosh cλ (cosh λ) c. Proof. We will first prove that tanh c c tanh for every 0. The derivative of tanh is sech. Because cosh is increasing on [0, ), it follows that sech ct sech t for every t 0. Integrating both sides (from 0 to ) gives 1 tanh c tanh. Multiplying by c gives c tanh c c tanh. Net we will prove the cosh inequality. By symmetry, we may assume that λ 0. The derivative of ln cosh is tanh. By the previous paragraph, we have tanh c c tanh for every 0. Integrating both sides (from 0 to λ) gives 1 ln cosh cλ c ln cosh λ. Multiplying by c c and eponentiating gives the desired inequality. Lemma 46. If θ is a real number such that cos θ 5 1, then cos θ cos 6 θ. Proof. From the hypothesis, we have Therefore, we have cos θ + cos 4 θ = cos θ(1 + cos θ) = 1. cos 6 θ = 1 (1 cos θ)(1 + cos θ + cos 4 θ) = 1 sin θ(1 + cos θ + cos 4 θ) 1 sin θ = cos θ. 5.1 Main lemma, bounding E[B r e iθb ] Lemma 47 (Lemma 38 restated). Let r be an integer such that 0 r n. Let θ be a real 8 number such that sin θ 0. Then E[B r e iθb ] (8r cot θ ) r cos θ n/. Proof. We will consider two cases: cos θ e 1/e and cos θ 5 1. Because 5 1 < e 1/e, these two cases cover all possible θ. Case 1: cos θ e 1/e. Applying the inequality e 1/e for 0 (to = 8r/n), we have ( 8r ) 8r/n. cos θ e 1/e n 4

26 Hence, by Lemma 4(a), we have E[B r e iθb ] n r cos θ n r n r cos θ 3n/4+r = n r (cos θ) n/8 cos θ n/+r ( 8r ) r cos n r θ n/+r n = (8r cos θ ) r cos θ n/ (8r cot θ ) r cos θ n/ (8r cot θ ) r cos θ n/. Case : cos θ 5 1. In particular, sin θ < cos θ. Let λ be 1 1+ tan θ ln. In the proof 1 tan θ of Lemma 40, we showed that tanh λ is tan θ and cosh λ is cos θ / cos θ. By Lemma 44, we have λ tanh λ = tan θ. Hence, by Lemmas 4(b), 43, 45, and 46, we have E[B r e iθb ] (cos θ) n/ E[B r e λb ] (cos θ) n/ E[ B r e λb ] ( 4r ) r ( (cos θ) n/ cosh 11 ) n λ 10 λ ( (cos θ) n/ (4r cot θ ) r cosh 11 ) n 10 λ (cos θ) n/ (4r cot θ ) r (cosh λ) 11n/100 (cos θ) n/ (4r cot θ ) r (cosh λ) 5n/4 = (4r cot θ ) r (cos θ) n/ ( cos θ cos θ ) 5n/4 r cos θ 5n/4 = (4r cot θ ) (cos θ) n/8 r cos θ 5n/4 (4r cot θ ) cos θ 3n/4 = (4r cot θ ) r cos θ n/ (8r cot θ ) r cos θ n/. 6 Tight upper bound on k-wise uniformity vs. mod m In this section we prove Theorem 3. It follows from Theorem 48 below by translating the statement for { 1, 1} n back to {0, 1} n using Fact 1. Recall that S m,c = {y { 1, 1} n : i y i c (mod m)}. Theorem 48. Let m be a positive integer and let c be an integer. Let k be an integer greater than or equal to 4. Suppose there is a k-wise uniform distribution on { 1, 1} n that is supported on S m,c. Then k 140n. m 5

27 We can restate the theorem using moments as follows. Let B be the sum of n independent random bits chosen uniformly from { 1, 1}. Let Y be a random variable that is always c mod m. Suppose the first k moments of Y match those of B. Then k 140n. m The high-level idea of the proof is as follows. We compare E[e πiy/m ] and E[e πib/m ]. The first is 1 because Y is always c mod m. The second we show is less than 1. We then take the Taylor approimations of the eponentials. The first k 1 terms are equal by the moment-matching property of Y. The error is given by the kth term, which gives us an upper bound on k. Proof of Theorem 48. If m < 4, then k n 16n m. So we may assume that m 4. Let α = π/m. Because m 4, we have 0 < α π/. For now, we will assume that k is even. At the end, we will handle the odd case. Because Y is always c mod m, we have E[e iαy ] = e iαc = 1. By Lemma 39 (with A = ) and Lemma 18, we have E[e iαb ] = cos α n e α n/. By Taylor s theorem, for every real θ we have k 1 e iθ Hence by the triangle inequality we have j=0 (iθ) j θk j! k!. k 1 E[e iαy ] j=0 (iα) j j! E[Y j e ] E[ iαy k 1 j=0 (iαy ) j j! ] αk k! E[Y k ]. Similarly we have k 1 E[e iαb ] j=0 (iα) j E[B j ] αk j! k! E[Bk ]. Because the first k moments of Y match those of B, we get a ton of cancellation: In particular, we have E[e iαy ] E[e iαb ] α k k! E[Y k ] + αk k! E[Bk ] = αk k! E[Bk ]. 1 = E[e iαy ] E[e iαb ] + α k Hence, using the moment bound of Lemma 31, we have k! E[Bk ] e α n/ + αk k! E[Bk ]. 1 e αn/ α k + k/ (k/)! nk/ e αn/ + ( α n ) k/. (k/)! 6

28 Let f be the function defined by f() = e + (k/)! k/. Then the inequality above simplifies to f(α n/) 1. Note that f(0) = 1. Also f is conve on the interval [0, ). We claim that f(k /8) < 1. To prove it, we will show that the first term of f is less than 1 and the second term is at most 1. Because k 4, the first term indeed satisfies e k /8 e / < 1. The second term is (k /8) k/. If k = 4, then this term is eactly 1. Otherwise k 6, (k/)! and so by Stirling s formula we have ( k ) k/ ( k ) k/ = (k/)! 8 (k/) k/ e k/ πk 8 πk ( e 4 ) k/ < πk < 1. In either case, the second term is at most 1. Hence f(k /8) < 1. To summarize, f is conve on [0, ), f(0) = 1, and f(k /8) < 1. It follows that f is less than 1 on the interval (0, k /8]. Because f(α n/) 1, we have α n/ > k /8. Solving for k gives k < α n = ( π ) n 11n <. m m So far, we assumed that k is even. Now suppose that k is odd. We can apply the proof above to k 1, which gives the bound k 1 < 11n. Because k 5, we have m k 5 4 (k 1) < n m = 140n m. 7 Tight upper bound on k-wise uniformity vs. threshold In this section we prove Theorem 6, which follows from Theorem 50 below by translating the statement for { 1, 1} n to {0, 1} n using Fact 6. We will show that for any k 3, any k-wise uniform distribution over { 1, 1} n must put nonzero probability masses on strings whose sums n i=1 i are Ω( nk) and Ω( nk) away from 0. This result shows that the lower bound we obtain in Theorem 6 is tight. We note that this is not true for k =, as when n is odd, there eists a pairwise uniform distribution supported on the all 1 vector and vectors with (n + 1)/ ones. Let X 1, X,..., X n be independent random variables chosen uniformly from { 1, 1}. Let B be the sum of all the X j. The distribution of B is a shifted binomial distribution. First we give a lower bound on the dth moment of B. Claim 49. Let d be a nonnegative integer. Then E[ B d ] ( n(d 1) e ) d/. Proof. We first prove the claim assuming d is even. Let d = r. Consider epanding B r, which gives us a sum of n r terms. If for some inde i, the variable X i appears an odd number of times in a term, then this term has epectation zero. So the terms with nonzero epectation are the ones in which each X i appears an even number of times. In particular, 7

29 each such term has epectation 1. It suffices to consider the terms in which either each X i appears eactly twice or does not appear at all. There are ( n r) ways of choosing the indices that appear twice in a term, and each term appears (r)!/ r number of times in the n r terms. Hence we have ( ) n (r)! E[B r ]. r r Using the inequality ( n r) (n/r) r and a crude form of Stirling s formula, n! (n/e) n, we have ( ) n (r)! ( n ) r ( r ) r 1 ( nr ) r, r r r e = r e proving the claim for even d. For odd d, let d = r +1. Then by Jensen s inequality, we have E[ B r+1 ] E[B r ] r+1 r ( nr ) r+1 e. Theorem 50. Let t + and t be two positive integers. Let Y be a random variable that is supported on { 1, 1} n so that i Y i t and i Y i t +. Let k be a positive integer. Suppose that the (k + 1)th moment of Y is equal to the (k + 1)th moment of B. Then min{t, t + } nk/3. Remark 3. The conclusion is false when Y only matches the first two moments of B. When n is odd, there eists a pairwise uniform distribution supported on the all 1 vector and vectors with (n + 1)/ ones. Proof. Let p + and p denote Pr[Y 0] and Pr[Y < 0] respectively. Note that E[Y k+1 ] = E[B k+1 ] = 0. Together with Claim 49, we have p + E[ Y k+1 Y 0] p E[ Y k+1 Y < 0] = E[Y k+1 ] = 0 p + E[ Y k+1 Y 0] + p E[ Y k+1 Y < 0] = E[ Y k+1 ] ( nk e ) k. Summing the two relations, we have p + E[ Y k+1 Y 0] ( nk ) k+1 e. Hence, there must be a point y in Y such that y k+1 (nk/9) k+1 k, and so y nk/3. By symmetry, there is another point y in Y such that y nk/3. References [AGM03] [AW89] Noga Alon, Oded Goldreich, and Yishay Mansour. Almost k-wise independence versus k-wise independence. Inf. Process. Lett., 88(3): , 003. Miklos Ajtai and Avi Wigderson. Deterministic simulation of probabilistic constantdepth circuits. Advances in Computing Research - Randomness and Computation, 5:199 3, [Baz09] Louay M. J. Bazzi. Polylogarithmic independence can fool DNF formulas. SIAM J. Comput., 38(6):0 7,