1. Using Nondeterminism to Amplify Hardness Emanuele Viola Joint work with: Alex Healy and Salil Vadhan Harvard University

2. Average-Case Hardness of NP Study hardness of NP on random instances –Natural question, essential for cryptography One Goal: relate worst-case & avg-case hardness –Done for #P, PSPACE, EXP... [L89, BF90, BFL91,...] –New techniques needed for NP [FF91, BT03, V03, V04] This Talk: hardness amplification –Relate mild avg-case & strong avg-case hardness

3. Hardness Amplification Def: f : {0,1} n ! {0,1} is  -hard for size s if 8 circuit C of size s Pr x [C(x)  f(x)] ¸  Hardness Amplification e.g., -hard for size s e.g., -hard for size ¼ s where  =  (n´) ff 0f 0

4. Standard Hardness Amplification Yao’s XOR Lemma: f : {0,1} n ! {0,1}  -hard for size s = s(n) ) f 0 (x 1,..., x k ) = f(x 1 ) ©... © f(x k ) k = n ) n´ = n 2 and f 0 : {0,1} n' ! {0,1} ¼ Optimal, but cannot use in NP: f 2 NP ; f 0 2 NP

5. O’Donnell’s Amplification in NP Idea: f´(x 1,..., x k ) = C(f(x 1 ),..., f(x k )), C monotone e.g. f(x 1 ) Æ ( f(x 2 ) Ç f(x 3 ) ). Then f´ 2 NP if f 2 NP Theorem [O’Donnell `02]: 9 balanced f 2 NP (1/poly(n))-hard for size n  (1) ) 9 f´ 2 NP -hard for size (n´)  (1) Barrier: No such construction can amplify above

6. Thm: 9 balanced f 2 NP (1/poly(n))-hard for size s(n) ) 9 f´ 2 NP ¼ -hard for size ¼ Examples: –s(n) = n  (1) ) hardness –s(n) = 2 n  (1) ) hardness –s(n) = 2  (n) ) hardness Our Main Result

7. Approach Obs: Hardness of f´(x 1,..., x k ) = C(f(x 1 ),..., f(x k )) limited by Idea 1: Derandomization [I95, IW97] for “pseudorandom” generator G, so E.g. if then hope f´ -hard Q: Why does this still amplify hardness? –We exhibit unconditional G s.t. this works f´(  ) = C(f(x 1 ),..., f(x k )), where (x 1,...,x k ) = G(  )

8. Approach (cont.) Q: How to compute f´2 NP when k = (n´)  (1) ? Idea 2: Nondeterminism –Use C s.t. C(f(x 1 ),..., f(x k )) can be computed nondeterministically looking at only log(k) f(x i )’s. –So f´2 NP even when k = 2 n’ f´(  ) = C(f(x 1 ),..., f(x k )), where (x 1,...,x k ) = G(  )

9. Outline Trevisan’s (2003) proof of O’Donnell’s theorem Identify properties of G that suffice & find such G Describe C ensuring f´ 2 NP Negative results: balanced f and nondeterminism necessary f´(  )=C(f(x 1 ),..., f(x k )), where (x 1,...,x k )=G(  )

10. Notation f : {0,1} n ! {0,1}  -hard for size s (e.g.  =.01, s = 2  (n) ) f´(x 1,..., x k ) := C(f(x 1 ),..., f(x k )) for appropriate monotone C Aim: Show f´ has hardness ¼ 1/2 - 1/k for size s´ = k = s  (1)

11. Step 1: Hardcore Lemma [Imp95] f  -hard ) indistinguishable from F w/ coin-flip on 2  frac. of inputs 0 1 coin-flip 2  frac. 01 ¼ f F Formally: no circuit of size s ´ can distinguish (x,f(x)) from (x,F(x)) for random x w/ advantage > 1/s ´

12. Step 2: Info-theoretic hardness 0 1 coin-flip 2  frac. 01 ¼ f F (x,f(x)) ´ (x,F(x)) ) (x 1,....,x k,f(x 1 ),...,f(x k )) ´ (x 1,...,x k,F(x 1 ),...,F(x k )) ) Hardness of C(f(x 1 ),...,f(x k )) for size s´ ¼ hardness of C(F(x 1 ),...,F(x k )) for size s´ ¸ hardness of C(F(x 1 ),...,F(x k )) for size 1 uses independence

13. Step 3: Noise Sensitivity 0 1 coin-flip 2  frac. 01 ¼ f F Info-theoretic hardness of C(F(x 1 ),...,F(x k )) depends only on C and  ! Hardness ¼ NoiseSens  [C] where  i = 1 independently with probability  uses independence

14. Step 4: Choosing C There is monotone C : {0,1} k ! {0,1} ) C(f(x 1 ),..., f(x k )) has hardness ¼ 1/2 - 1/k The barrier [KKL88]: 8 monotone C : {0, 1} k ! {0, 1},

15. Outline Trevisan’s (2003) proof of O’Donnell’s theorem Identify properties of G that suffice & find such G Describe C ensuring f´ 2 NP Negative results: balanced f and nondeterminism necessary f´(  )=C(f(x 1 ),..., f(x k )), where (x 1,...,x k )=G(  )

16. Step 2: Info-theoretic hardness 0 1 coin-flip 2  frac. 01 ¼ f F (x,f(x)) ´ (x,F(x)) ) (x 1,....,x k,f(x 1 ),...,f(x k )) ´ (x 1,...,x k,F(x 1 ),...,F(x k )) ) Hardness of C(f(x 1 ),...,f(x k )) for size s´ ¼ hardness of C(F(x 1 ),...,F(x k )) for size s´ ¸ hardness of C(F(x 1 ),...,F(x k )) for size 1 uses independence

17. Preserving Indistinguishability (x,f(x)) ´ (x,F(x)) ) (x 1,....,x k,f(x 1 ),...,f(x k )) ´ (x 1,...,x k,F(x 1 ),...,F(x k )) Want: G to be indistinguishability-preserving: (x,f(x)) ´ (x,F(x)) ) ( ,f(x 1 ),...,f(x k )) ´ ( ,F(x 1 ),...,F(x k )) where (x 1,...,x k )=G(  ) Achieved via combinatorial designs [Nis91,NW94].

18. Step 3: Noise Sensitivity 0 1 coin-flip 2  frac. 01 ¼ f F Info-theoretic hardness of C(F(x 1 ),...,F(x k )) depends only on C and  ! Hardness ¼ NoiseSens  [C] where  i = 1 independently with probability  uses independence

19. 0 1 coin-flip r 2  frac. 01 ¼ f F Fooling Noise Sensitivity

20. Want: Show 9 randomized constant-depth circuit s.t. 8 x 1,...,x k Use existence of unconditional G against constant- depth circuits [Nis90] Fooling Noise Sensitivity ¼

21. C  x 1 x 2.... x k F... C FFF FF A has constant depth and size(A) = poly(2 n,k) (using C constant depth and size(C) = poly(k)) A Want:

22. Nisan’s Pseudorandom Generator Want Pr[A(x 1,..., x k ) = 1] ¼ Pr[A(G(  )) = 1] Theorem [Nis91]: There is G : {0,1} log O(1) N ! {0,1} N such that above holds for every A of size N and constant depth Recall size(A) = poly(2 n,k) ) Input length of Nisan’s generator is poly(n), even for k = 2 n

23. Completing Derandomization Let G(  1,  2 ) = G ind-pres (  1 ) © G const-depth (  2 ) f´(  )=C(f(x 1 ),..., f(x k )), where (x 1,...,x k )=G(  ) Thm: f´ has hardness ¼ 1/2 - 1/k for size s´ = k = s  (1) n´ = O(n 2 ) (w/PRG vs space [Nis91]) ) hardness

24. Outline Trevisan’s (2003) proof of O’Donnell’s theorem Identify properties of G that suffice & find such G Describe C ensuring f´ 2 NP Negative results: balanced f and nondeterminism necessary f´(  )=C(f(x 1 ),..., f(x k )), where (x 1,...,x k )=G(  )

25. The Structure of C C = TRIBES MONOTONE DNF [BL90] Claim: If f 2 NP then f´ 2 NP even for k = 2 n´ Proof: To compute f´(  ): –Guess a clause, say (f(x i+1 ) Æ... Æ f(x i+b )) –Check if clause is true

26. Thm: 9 balanced f 2 NP (1/poly(n))-hard for size s(n) ) 9 f´ 2 NP ¼ -hard for size ¼ Examples: –s(n) = n  (1) ) hardness –s(n) = 2 n  (1) ) hardness –s(n) = 2  (n) ) hardness Our Main Result

27. Balanced Functions Both our results and O’Donnell’s need balanced f 2 NP. That is: Theorem: Any monotone “black-box” hardness amplification cannot amplify beyond Proof Idea: –“Black-box” hardness amplification ) error correcting code [I02,TV02,V03,T03] –Good monotone codes only exist for balanced messages [Kruskal-Katona]

28. Nondeterminism is Necessary Use of nondeterminism is likely to be necessary Theorem: There is no deterministic, monotone “black-box” hardness amplification that amplifies beyond Our amplification is nondeterministic, monotone, black-box, and amplifies up to

29. Conclusion O’Donnell’s hardness amplification in NP: –Amplifies up to –No construction of same form does better Our result: amplify up to Two new techniques: 1.Derandomization G fools noise sensitivity 2.Nondeterminism k = n  (1) Only obstacle to hardness is PRG with logarithmic seed length for space or const-depth