CS151 Complexity Theory. Lecture 9 May 1, 2017

Transcription

1 CS151 Complexity Theory Lecture 9

2 Hardness vs. randomness We have shown: If one-way permutations exist then BPP δ>0 TIME(2 nδ ) ( EXP simulation is better than brute force, but just barely stronger assumptions on difficulty of inverting OWF lead to better simulations

3 Hardness vs. randomness We will show: If E requires exponential size circuits then BPP = P by building a different generator from different assumptions. E = k DTIME(2 kn )

4 Hardness vs. randomness BMY: for every δ > 0, G δ is a PRG with seed length t = m δ output length m error ε < 1/m d (all d) fooling size s = m e (all e) running time m c running time of simulation dominated by 2 t

5 Hardness vs. randomness To get BPP = P, would need t = O(log m) BMY building block is one-waypermutation: f:{0,1} t {0,1} t required to fool circuits of size m e (all e) with these settings a circuit has time to invert f by brute force! can t get BPP = P with this type of PRG

6 Hardness vs. randomness BMY pseudo-random generator: one generator fooling all poly-size bounds one-way-permutation is hard function implies hard function in NP conp New idea (Nisan-Wigderson): for each poly-size bound, one generator hard function allowed to be in E = k DTIME(2 kn )

7 Comparison BMY: 8 δ > 0 PRG G δ NW: PRG G seed length t = m δ t = O(log m) running time t c m m c output length m << m > error ε < 1/m d (all d) ε < 1/m fooling size s = m e (all e) s = m

8 NW PRG NW: for fixed constant δ, G = {G n } with seed length t = O(log n) t = O(log m) running time n c output length m = n δ error ε < 1/m fooling size s = m m c m Using this PRG we obtain BPP = P to fool size n k use G n k/δ running time O(n k + n ck/δ )2 t = poly(n)

9 NW PRG First attempt: build PRG assuming E contains unapproximable functions Definition: The function family f = {f n }, f n :{0,1} n {0,1} is s(n)-unapproximable if for every family of size s(n) circuits {C n }: Pr x [C n (x) = f n (x)] ½ + 1/s(n).

10 One bit Suppose f = {f n } is s(n)-unapproximable, for s(n) = 2 Ω(n), and in E a 1-bit generator family G = {G n }: G n (y) = y f log n (y) Idea: if not a PRG then exists a predictor that computes f log n with better than ½ + 1/ s(log n) agreement; contradiction.

11 One bit Suppose f = {f n } is s(n)-unapproximable, for s(n) = 2 δn, and in E a 1-bit generator family G = {G n }: G n (y) = y f log n (y) seed length t = log n output length m = log n + 1 (want n δ ) fooling size s s(log n) = n δ running time n c error ε 1/s(log n) = 1/n δ

12 Many bits Try outputting many evaluations of f: G(y) = f(b 1 (y)) f(b 2 (y)) f(b m (y)) Seems that a predictor must evaluate f(b i (y)) to predict i-th bit Does this work?

13 Many bits Try outputting many evaluations of f: G(y) = f(b 1 (y)) f(b 2 (y)) f(b m (y)) predictor might notice correlations without having to compute f but, more subtle argument works for a specific choice of b 1 b m

14 Nearly-Disjoint Subsets Definition: S 1,S 2,,S m {1 t} is an (h, a) design if for all i, S i = h for all i j, S i S j a S 2 {1..t} S 1 S 3

15 Nearly-Disjoint Subsets Lemma: for every ε > 0 and m < n can in poly(n) time construct an (h = log n, a = εlog n) design S 1,S 2,,S m {1 t} with t = O(log n).

16 Nearly-Disjoint Subsets Proof sketch: pick random (log n)-subset of {1 t} set t = O(log n) so that expected overlap with a fixed S i is εlog n/2 probability overlap with S i is > εlog n is at most 1/n union bound: some subset has required small overlap with all S i picked so far find it by exhaustive search; repeat n times.

17 The NW generator f E s(n)-unapproximable, for s(n) = 2 δn S 1,,S m {1 t} (log n, a = δlog n/3) design with t = O(log n) G n (y)=f log n (y S 1 ) f log n (y S2 ) f log n (y Sm ) f log n : seed y

18 The NW generator Theorem (Nisan-Wigderson): G={G n } is a pseudo-random generator with: seed length t = O(log n) output length m = n δ/3 running time n c fooling size s = m error ε = 1/m

19 The NW generator Proof: assume does not ε-pass statistical test C = {C m } of size s: Pr x [C(x) = 1] Pr y [C( G n (y) ) = 1] > ε can transform this distinguisher into a predictor P of size s = s + O(m): Pr y [P(G n (y) 1 i-1 ) = G n (y) i ] > ½ + ε/m

20 The NW generator G n (y)=f log n (y S 1 ) f log n (y S2 ) f log n (y Sm ) f log n : α y β S i Proof (continued): Pr y [P(G n (y) 1 i-1 ) = G n (y) i ] > ½ + ε/m fix bits outside of S i to preserve advantage: Pr y [P(G n (αy β) 1 i-1 ) = G n (αy β) i ] > ½ + ε/m

21 The NW generator G n (y)=f log n (y S 1 ) f log n (y S2 ) f log n (y Sm ) f log n : Proof (continued): G n (αy β) i is exactly f log n (y ) α y β S i for j i, as vary y, G n (αy β) j varies over 2 a values! hard-wire up to (m-1) tables of 2 a values to provide G n (αy β) 1 i-1

22 The NW generator G n (y)=f log n (y S 1 ) f log n (y S2 ) f log n (y Sm ) f log n : output f log n (y ) size m + O(m) + (m-1)2 a < s(log n) = n δ advantage ε/m=1/m 2 > 1/ y s(log n) = n -δ contradiction P hardwired tables

23 Worst-case vs. Average-case Theorem (NW): if E contains 2 Ω(n) -unapproximable functions then BPP = P. How reasonable is unapproximability assumption? Hope: obtain BPP = P from worst-case complexity assumption try to fit into existing framework without new notion of unapproximability

24 Worst-case vs. Average-case Theorem (Impagliazzo-Wigderson, Sudan-Trevisan-Vadhan) If E contains functions that require size 2 Ω(n) circuits, then E contains 2 Ω(n) unapproximable functions. Proof: main tool: error correcting code

25 Error-correcting codes Error Correcting Code (ECC): C:Σ k Σ n message m Σ k C(m) received word R C(m) with some positions corrupted if not too many errors, can decode: D(R) = m parameters of interest: rate: k/n distance: d = min m m Δ(C(m), C(m )) R

26 Distance and error correction C is an ECC with distance d can uniquely decode from up to d/2 errors d Σ n

27 Distance and error correction can find short list of messages (one correct) after closer to d errors! Theorem (Johnson): a binary code with distance (½ - δ 2 )n has at most O(1/δ 2 ) codewords in any ball of radius (½ - δ)n.

28 Example: Reed-Solomon alphabet Σ = F q : field with q elements message m Σ k polynomial of degree at most k-1 p m (x) = Σ i=0 k-1 m i x i codeword C(m) = (p m (x)) x F q rate = k/q

29 Example: Reed-Solomon Claim: distance d = q k + 1 suppose Δ(C(m), C(m )) < q k + 1 then there exist polynomials p m (x) and p m (x) that agree on more than k-1 points in F q polnomial p(x) = p m (x) - p m (x) has more than k-1 zeros but degree at most k-1 contradiction.

30 Example: Reed-Muller Parameters: t (dimension), h (degree) alphabet Σ = F q : field with q elements message m Σ k multivariate polynomial of total degree at most h: p m (x) = Σ i=0 k-1 m i M i {M i } are all monomials of degree h

31 Example: Reed-Muller M i is monomial of total degree h e.g. x 12 x 2 x 4 3 need # monomials (h+t choose t) > k codeword C(m) = (p m (x)) x (F q)t rate = k/q t Claim: distance d = (1 - h/q)q t proof: Schwartz-Zippel: polynomial of degree h can have at most h/q fraction of zeros

32 Codes and hardness Reed-Solomon (RS) and Reed-Muller (RM) codes are efficiently encodable efficient unique decoding? yes (classic result) efficient list-decoding? yes (RS on problem set)

33 Codes and Hardness Use for worst-case to average case: truth table of f:{0,1} log k {0,1} (worst-case hard) m: truth table of f :{0,1} log n {0,1} (average-case hard) Enc(m):

34 Codes and Hardness if n = poly(k) then f E implies f E Want to be able to prove: if f is s -approximable, then f is computable by a size s = poly(s ) circuit

35 Codes and Hardness Key: circuit C that approximates f implicitly gives received word R R: Enc(m): Decoding procedure D computes f exactly D C Requires special notion of efficient decoding

36 Codes and Hardness f:{0,1} log k {0,1} m: f :{0,1} log n {0,1} Enc(m): R: decoding procedure i 2 {0,1} log k D C small circuit C approximating f small circuit that computes f exactly f(i)