Limits of Minimum Circuit Size Problem as Oracle

Transcription

1 Limits of Minimum Circuit Size Problem as Oracle Shuichi Hirahara(The University of Tokyo) Osamu Watanabe(Tokyo Institute of Technology) CCC 2016/05/30

2 Minimum Circuit Size Problem (MCSP) Input Truth table T 0,1 2n Size parameter s N x 1 x 2 x 1 xor x Output Decide if circuit of size s whose truth table is T. Easy to see that MCSP NP. x 1 x 2 Question: Is MCSP NP-complete?

3 Importance of MCSP MCSP P [Kabanets & Cai (2000)] EXP NP P/poly conp P NP

4 Importance of MCSP MCSP P [Kabanets & Cai (2000)] EXP NP P/poly MCSP conp [ABKvMR06] MA = NP Few evidences Q. NP MCSP? conp P NP T P or T BPP

5 Importance of MCSP MCSP P MCSP conp Our Main Contributions [Kabanets & Cai (2000)] [ABKvMR06] EXP NP P/poly Oracle-independent reductions MA = NP Provide Few evidences strong evidences that current reduction techniques cannot establish NP-hardness of MCSP (under p T nor BPP m ). Q. NP MCSP? conp P NP T P or T BPP

6 Today s Agenda 1. Background 2. Oracle-independent Reductions Why are current reductions oracle-independent? 3. Our Results Limits of oracle-independent reductions Hardness of MCSP implies separations 4. Conclusions

7 Today s Agenda 1. Background 2. Oracle-independent Reductions Why are current reductions oracle-independent? 3. Our Results Limits of oracle-independent reductions Hardness of MCSP implies separations 4. Conclusions

8 Two Sides on Hardness of MCSP General reductions [Allender & Das (2014)] MCSP is SZK-hard under BPP-Turing reductions T BPP Difficulty of proving hardness under restricted reductions Hardness under general reductions [Murry & Williams (2015)] Difficult to prove its NP-hardness under m p. m p Restricted reductions

9 Background: Hardness of MCSP [Allender, Buhrman, Koucký, van Melkebeek and Ronneburger (2006)] Integer factorization is in ZPP MCSP. Discrete logarithm is in BPP MCSP. conp Discrete log Integer Factorization P NP Harder than NP-intermediate problems

10 Background: Hardness of MCSP [Allender & Das (2014)] Statistical Zero Knowledge (SZK) is included in BPP MCSP. conp Discrete log Integer Factorization NP SZK P MCSP is SZK-hard

11 Difficulty of Proving Hardness of MCSP [Murray & Williams (CCC 2015)] An extension of [Kabanets & Cai (2000)] NP m p MCSP ZPP EXP. Proving NP-hardness is at least as difficult as proving ZPP EXP.

12 Two Sides on Hardness of MCSP General reductions [Allender & Das (2014)] MCSP is SZK-hard under BPP-Turing reductions T BPP Our Results Hardness under 1. Showing inherent limits of current reduction Difficulty of proving general reductions techniques (for p hardness under T and BPP m ) 2. restricted Extending reductions Murray & Williams results to p p tt and T [Murry & Williams (2015)] Difficult to prove its NP-hardness under m p. m BPP T p p tt m p Restricted reductions

13 Today s Agenda 1. Background 2. Oracle-independent Reductions Why are current reductions oracle-independent? 3. Our Results Limits of oracle-independent reductions Hardness of MCSP implies separations 4. Conclusions

14 Strategy: Relativize [Allender & Das (2014)] SZK BPP MCSP The reduction can be generalized to a reduction to MCSP A for all oracle A. SZK BPP MCSPA A oracleindependent

15 Minimum Oracle Circuit Size Problem Let A 0, 1 0,1 be an arbitrary oracle. Def (Minimum A-Oracle Circuit Size Problem; MCSP A ) Input: Truth table T 0, 1 2n and size parameter s N Output: Does there exists an A-oracle circuit of size s whose truth table is T? In addition to A-oracle gates A gates, can be used. A x 1,, x 4 A x 1 x 2 x 3 x 4 Remark: MCSP is not necessarily reducible to MCSP A

16 Oracle-independent Reductions Def (Oracle-independent Reductions) A reduction to MCSP is oracle-independent if the reduction can be generalized to a reduction to MCSP A for any oracle A. Idea: The reduction relies on common properties of MCSP A for all A (instead of a non-relativizing property of MCSP) For example: L reduces to MCSP via an oracle-independent P-Turing reduction def L P MCSPA L A P MCSPA. for any oracle A.

17 Relativization vs. Oracle-independent [Ko (1991)] There exists an oracle A such that NP A P MCSPA, A. A specific oracle A All oracles A (MCSP is not NP-hard relative to A) Instead, we will show Do not allow direct access to A NP A P MCSPA, A unless P = NP.

18 A Known Reductions Are Oracle-independent The reduction of [Allender & Das (2014)] is oracle-independent: SZK BPP MCSPA A Other reductions are also oracle-independent: Let s look at it. [Kabanets & Cai (2000)] BPP ZPP MCSPA [Allender, Grochow & Moore (2015)] A Rigid GI ZPP MCSPA

19 Review of SZK-hardness Claim: SZK BPP MCSP [Allender & Das (2014)] Important Observation PRGs can be broken with oracle access to MCSP. [Hastad, Impagliazzo, Levin & Luby (1999)] Any one-way function can be inverted. [Allender & Das (2014)] SZK can be solved in polynomial time.

20 Breaking PRGs Using MCSP Important Observation PRGs can be broken with oracle access to MCSP. Pseudorandom distribution G U m small circuit complexity G U m can be efficiently computed (by the definition of PRGs). Uniform distribution U 2 n high circuit complexity Uniformly chosen strings require high circuit complexity (by a counting argument).

21 Breaking PRGs Using MCSP A Important Observation PRGs can be broken with oracle access to MCSP A. Pseudorandom distribution G U m small circuit complexity G U m Remains true even if A-oracle gates can be used. can be efficiently computed (by the definition of PRGs). Uniform distribution U 2 n high circuit complexity Uniformly chosen strings require high circuit complexity (by a counting argument). A similar counting arguments can be applied.

22 Breaking PRGs Using MCSP A Important Observation PRGs can be broken with oracle access to MCSP A. Pseudorandom distribution G U m small circuit complexity Corollary G U m [Allender can be efficiently & Das (2014)] computed (by the Remains definition true even of PRGs). SZK Uniform distribution U 2 na BPP MCSPA. if A-oracle gates can be used. high circuit complexity Uniformly chosen strings require high circuit complexity (by a counting argument). A similar counting arguments can be applied.

23 Why Are Current Techniques Oracle-independent? For upper bounds: Pseudorandom distribution G U m Adding A-oracle gates does not increase the circuit complexity. For lower bounds: Uniform distribution U 2 n We know very few lower bounds for general circuits. We are prone to rely on counting arguments. Counting arguments can be generalized to A-oracle circuits. This is weakness of current reduction techniques.

24 Today s Agenda 1. Background 2. Oracle-independent Reductions Why are current reductions oracle-independent? 3. Our Results Limits of oracle-independent reductions Hardness of MCSP implies separations 4. Conclusions

25 Our Results (1/2) Theorem 1. (Limit of Oracle-independent P-Reductions) If L reduces to MCSP via an oracle-independent polynomialtime Turing reduction, then L P. (In other words) If L P MCSPA for any oracle A, then L P. A P MCSPA = P. In particular, MCSP is not NP-hard under such reductions (unless P = NP). This captures the limits of current reduction techniques. No (nontrivial) deterministic reduction to MCSP is known.

26 Our Results (2/2) Theorem 2. (Limit of Oracle-independent BPP-Reductions) If L reduces to MCSP via an oracle-independent one-query BPP-Turing reduction (with negligible error probability), then L AM coam. In short, A BPP MCSPA [1] AM coam. MCSP is not NP-hard under such randomized reductions (unless polynomial hierarchy collapses).

27 Theorem 1. (Limit of P-Reductions) Proof Sketch of A P MCSPA = P. Step 1. Swap the order of quantifiers. The theorem says: A, M, M MCSPA x = L x L P. However, it is sufficient to prove: Lemma. M, A, M MCSPA x = L x L P (Proof of Lemma Theorem) A simple diagonalization argument. (omitted)

28 Theorem 1. (Limit of P-Reductions) Proof Sketch of A P MCSPA = P. Step 1. Swap the order of quantifiers. The theorem says: A, M, M MCSPA x = L x L P. However, it is sufficient to prove: Lemma. M, A, M MCSPA x = L x L P (Proof of Lemma Theorem) A simple diagonalization argument. (omitted)

29 Lemma. M, A, x, M MCSPA x = L x L P Step 2. We can choose A arbitrarily. Choose an oracle A so that M MCSPA x can be easily simulated Let T 1,, T m be truth tables queried by M. If CC A T i O log n, we can compute CC A T i by an exhaustive search. It takes 2 O log n = n O 1 time if we regard circuit size as description length. Circuit complexity relative to A

30 Lemma. Step 2. M, A, x, M MCSPA x = L x L P Choose an oracle A so that M MCSPA x can be easily simulated Claim: A such that CC A T i O log n Define A i, j T ij. The truth table of the A-oracle circuit is equal to T i (for each i). CC A T i O log n T ij A (i, j)

31 Theorem 1. Summary: Main Ideas for A P MCSPA = P. Step 1. Swap the order of quantifiers. Step 2. Choose an oracle A so that M can be easily simulated Encode every query into A so that circuit complexity becomes small.

32 Theorem 2. (Limit of BPP-Reductions) Proof Sketch of A BPP MCSPA [1] AM coam. Consider the case when L m BPP MCSP A. Let Q(x, r) be the query on input x and coin flips r x L Pr Q x, r MCSP A 1. x L Pr Q x, r MCSP A 0. For simplicity, assume that size parameter s is fixed.

33 < 2 s+1 instances YES r Q(x, ) Q x, r NO instances Coin flips r Instances of MCSP A

34 Suppose Pr Q x, r MCSP A 1. < 2 s+1 instances YES YES Q(x, ) concentrates YES Coin flips r NO instances Instances of MCSP A

35 Conversely, suppose that Q(x, ) concentrates on. (Claim: Pr Q x, r MCSP A 1.) For some k s O log n, T 1, T 2, T 2 k large Coin flips r Instances of MCSP A

36 Conversely, suppose that Q(x, ) concentrates on. Define A so that CC A T i s for all i 1,, 2 k. (Claim: Pr Q x, r MCSP A 1.) For some k s O log n, T 1, T 2, T 2 k YES YES large Coin flips r Instances of MCSP A

37 Conversely, suppose that Q(x, ) concentrates on. Define A so that CC A T i s for all i 1,, 2 k. (Claim: Pr Q x, r MCSP A 1.) For some k s O log n, T 1, T 2, T 2 k YES YES Pr Q x, r MCSP A Coin flips r is large Instances of MCSP A

38 When Pr Q x, r MCSP A is large: It suffices to check if such a concentration occurs in AM coam.

39 When Pr Q x, r MCSP A is small: It suffices to check if such a concentration occurs in AM coam.

40 When Pr Q x, r MCSP A is small: Use heavy samples protocol [Bogdanov & Trevisan 06] (or lower and upper bound protocols [Goldwasser & Sipser 86] [Fortnow 87]) It suffices to check if such a concentration occurs in AM coam.

41 Using heavy samples protocol... Pr Q x, r isheavy is large. When the query distribution is concentrated (Here, y is heavy the inverse of y is large) When the query distribution is not concentrated Pr Q x, r isheavy is small.

42 Today s Agenda 1. Background 2. Oracle-independent Reductions Why are current reductions oracle-independent? 3. Our Results Limits of oracle-independent reductions Hardness of MCSP implies separations 4. Conclusions

43 Extending Murray & Williams results [Murray & Williams (2015)] NP m p MCSP ZPP EXP. Exntension to the case of nonadaptive reductions Theorem. (Limits of polynomial-time nonadaptive reductions) p NP tt MCSP ZPP EXP. Proof: Based on firm links between circuit complexity and Levin s Kolmogorov complexity. [Allender, Buhrman, Koucký, van Melkebeek and Ronneburger (2006)] [Allender, Koucky, Ronneburger & Roy (2011)]

44 Extending Murray & Williams results [Murray & Williams (2015)] NP m p MCSP ZPP EXP. Exntension to the case of Turing reductions Theorem. (Limits of polynomial-time Turing reductions) NP T p GapMCSP ZPP EXP. A promise problem of approximating log of circuit complexity within constant factor

45 Today s Agenda 1. Background 2. Oracle-independent Reductions Why are current reductions oracle-independent? 3. Our Results Limits of oracle-independent reductions Hardness of MCSP implies separations 4. Conclusions

46 Summary: Our Contributions 1. We introduced oracle-independent reductions that capture the current reduction techniques. 2. We showed that NP-hardness cannot be proved by such techniques under polynomial-time Turing reductions nor one-query randomized reductions. Main Message Relativizable circuit lower bound is not sufficient for proving NP-hardness of MCSP.

47 Open Problems How about two-query BPP-Turing Reductions? How about more general types of reductions? Is NP conp MCSP?