1. Extractors: applications and constructions Avi Wigderson IAS, Princeton Randomness

2. Extractors: original motivation Unbiased, independent Probabilistic algorithms Cryptography Game Theory Applications: Analyzed on perfect randomness biased, dependent Reality: Sources of imperfect randomness Stock market fluctuations Sun spots Radioactive decay Extractor Theory

3. Applications of Extractors Using weak random sources in prob algorithms [B84,SV84,V85,VV85,CG85,V87,CW89,Z90-91] Randomness-efficient error reduction of prob algorithms [ Sip88, GZ97, MV99,STV99 ] Derandomization of space-bounded algorithms [ NZ93, INW94, RR99, GW02 ] Distributed Algorithms [ WZ95, Zuc97, RZ98, Ind02 ]. Hardness of Approximation [ Zuc93, Uma99, MU01 ] Cryptography [ CDHKS00, MW00, Lu02 Vad03 ] Data Structures [Ta02]

4. Unifying Role of Extractors Extractors are intimately related to: Hash Functions [ILL89,SZ94,GW94] Expander Graphs [NZ93, WZ93, GW94, RVW00, TUZ01, CRVW02] Samplers [G97, Z97] Pseudorandom Generators [Trevisan 99, …] Error-Correcting Codes [T99, TZ01, TZS01, SU01, U02]  Unify the theory of pseudorandomness.

5. Definitions

6. Weak random sources Distributions X on {0,1} n with some entropy: [vN] sources: n coins of unknown fixed bias [SV] sources : Pr[X i+1 =1|X 1 =b 1,…,X i =b i ]  ( δ, 1-δ) Bit fixing: n coins, some good, some “sticky” ….. [Z] k-sources: H ∞ (X) ≥ k  x Pr[X = x]  2 -k e.g X uniform with support  2 k {0,1} n X

7. Randomness Extractors (1 st attempt) E XT X k -source of length n m almost-uniform bits Impossible even if k=n-1 and m=1 “weak” random source X k can be e.g n/2, √n, log n,… Ext=0 Ext=1 {0,1} n X

8. Extractors [Nisan & Zuckerman `93] d random bits (short) “seed” E XT X k -source of length n m almost-uniform bits Ext : {0,1} n x {0,1} d  {0,1} m X has min-entropy k (  X is a k-source) m ≤ k+d

9. Extractors [Nisan & Zuckerman `93] E XT k -source of length n m bits  -close to uniform  k-source X, | Ext(X,U d ) – U m | 1 <   but  -fraction of y’s, | Ext(X, y) – U m | 1 <  d random bits (short) “seed” {0,1} n X {0,1} m Ext(X,y) y  {0,1} d

10. Extractors as graphs k-source X |X|=2 k (k,  )-extractor Ext: {0,1} n  {0,1} d  {0,1} m {0,1} n {0,1} m x Ext(x,y) y B (X)(X) Discrepancy: For all but 2 k of the x  {0,1} n, | |  ( X )  B |/2 d - |B|/2 m |<  Sampling Hashing Amplification Coding Expanders … 

11. Probabilistic algorithms with weak random bits k-source of length n m random bits E XT d random bits Probabilistic algorithm Input (upto  ) Output Error prob < δ ++ Where from? Try all possible 2 d strings. Take Majority vote Efficient? Want: efficient Ext, small d, , large m

12. Extractors - Parameters E XT k -source of length n m bits  -close to uniform Goals: minimize d, , maximize m. Non-constructive & optimal [Sip88,NZ93,RT97]: –Seed length d = log(n-k) + 2 log 1/  + O(1). –Output length m = k + d - 2 log 1/  - O(1). d random bits (short) “seed”

13. Extractors - Parameters E XT k -source of length n m bits  -close to uniform Goals: minimize d, maximize m. Non-constructive & optimal [Sip88,NZ93,RT97]: –Seed length d = log n + O(1). –Output length m = k + d - O(1). d random bits (short) “seed”  = 0.01 k  n/2

14. Explicit Constructions Non-constructive & optimal [Sip88,NZ93,RT97]: –Seed length d = log n + O(1). –Output length m = k + d - O(1). [...B86,SV86,CG87, NZ93, WZ93, GW94, SZ94, SSZ95, Zuc96, Ta96, Ta98, Tre99, RRV99a, RRV99b, ISW00, RSW00, RVW00, TUZ01, TZS01, SU01, LRVW03,…] New explicit constructions [GUV07, DW08] - Seed length d = O(log n) [even for  =1/n] –Output length m =.99k + d

15. Applications

16. Probabilistic algorithms with weak random bits k-source of length n X m random bits E XT d random bits Probabilistic algorithm Input (upto  ) Output Error prob < δ ++ Try all 2 d = poly(n) strings. Take Majority vote Efficient! The error set B  {0,1} m of alg is sampled accurately whp

17. Extractors as samplers n-bit string x Ext(X,1) E XT Efficient! k=2m Ext(X,2)Ext(X,n c ) m m m S(x)={ } For every B  {0,1} m, all but 2 k of x  {0,1} n : | |S(x)  B|/n c - |B|/2 m |<  Note: x bad with prob < 2 k /2 n, n arbitrary

18. Extractors as list-decodable error-correcting codes [TZ] Polynomial rate! Efficient encoding!! Efficient decoding? n-bit string x Ext(X,1) E XT Ext(X,2) Ext(X,D) 1 bit 1 bit 1 bit C(x)= ……… For z  {0,1} D let B z  {0,1} d+1 be the set {(i,z i ) : i  [D] } List decoding: For every z, at most D 2 of x have C(x) fall in (1/2 -  )D hamming ball around z c2c2 c1c1 c3c3 {0,1} D c8c8 c7c7 c6c6 c5c5 c4c4 c9c9 z d = c log n D =2 d = n c C: {0,1} n  {0,1} D

19. Beating e-value expansion Task: Construct an graph on [N] of minimal degree DEG s.t. every two sets of size K are connected by an edge. Any such graph: DEG > N/K Ramanujan graphs: DEG < (N/K) 2 Random graphs: DEG < (N/K) 1+o(1) Extractors: DEG < (N/K) 1+o(1) K linear in N and constant DEG [RVW] We’ll see it for “moderate” K [WZ] N K K

20. Extractors as graphs (again) (k,. 01 )-extractor Ext: {0,1} n  {0,1} d  {0,1} m 2 k = K = M 1+o(1) Ext: [N] x [D]  [M] 2 d = D < M o(1) [N] [M] |  (X) | >. 99 M |X|=K |X’|=K Take G = Ext 2 on [N] DEG < (N/K) 1+o(1) Many edges between any two K-sets X,X’

21. Constructions

22. Expanders as extractors Algxx rr {0,1} m random strings Thm [Chernoff] r 1 r 2 …. r t independent (tm random bits) Thm [AKS] r 1 r 2 …. r t random G-path (m+ O(t) random bits) Algxx rtrt xx r1r1 Majority G explicit expander of const degree BxBx Pr[error] < 1/3 then Pr[error] = Pr[|{r 1 r 2 …. r t }  B x }| > t/2] < exp(-t)

23. Expanders as extractors (k large) G expander graph of const degree on {0,1} m B any subset, δ= |B|/2 m S = { r 1 r 2 …. r t } a random G-path (n = m+ O(t) bits) Thm [G] Pr[| δ - |S  B|/t | >  ] < exp(-  2 t) Thm [Z] t=cm=2 d, Ext : {0,1} n x {0,1} d  {0,1} m Ext(r 1 r 2 …. r t ; i) = r i is an (k=.99n,  )–extractor of d=O(log n) seed

24. Condensers [RR99,RSW00,TUZ01] d random bits seed Con X k -source of length n.99k -source of length k Sufficient to construct such condensers: from here we can use [Z] extractor

25. Mergers [T96] d random bits seed Mer X 1 X 2 … X S.9k -source Some block X i is random. The other X j are correlated arbitrarily with it. Mer outputs a high entropy distribution. X= n=ks k k … k k

26. Mergers [T96] d random bits seed Mer X 1 X 2 … X S. 9k-source X= n=ks k k … k k X i  F q k q ~ n 100 Some X i is random [LRVW] Mer = a 1 X 1 +a 2 X 2 +…+a s X s a i  F q ( d=slog q ) Mer is a random element in the subspace spanned by X i ’s [D] It works! (proof of the Wolf conjecture). [DW] Mer = a 1 (y)X 1 +a 2 (y)X 2 +…+a s (y)X s y  F q ( d=log q ) Mer is a random element in the curve through the X i ’s

27. The proof Assume: E [|C(X)  B|] > 2 ε & B small x1x1 x2x2 xixi xsxs x1x1 x2x2 xixi xsxs C(x) (F q ) k B Mer(x) B Pr x [ |C(x)  B|> ε ] >ε  Pr x [ Q(C(x))  0 ] >ε Deg(C) = s-1  Pr [ Q(x i )  0 ] >ε  Q  0 # low deg Q:(F q ) k  F q Q(B)  0

28. Open Problems Find explicit extractors with –Seed length d = log n + O(1). –Output length m = k + d - O(1). Find explicit bipartite graph, of constant deg [N 3 ] [N 2 ] |X|=N |Γ(X)|≥ N

29. Extractors as samplers X k-source of length n m random bits E XT d random bits Any set B  {0,1} m (upto  ) WHP estimation error <  Try all 2 d = poly(n) strings. Count the fraction falls in B Efficient! Given B  {0,1} m Estimate |B|/2 m