Using Nondeterminism to Amplify Hardness Emanuele Viola Joint

Using Nondeterminism to Amplify Hardness Emanuele Viola Joint work with: Alex Healy and Harvard University Salil Vadhan

Average-Case Hardness of NP • Study hardness of NP on random instances – Natural question, essential for cryptography • One Goal: relate worst-case & avg-case hardness – Done for #P, PSPACE, EXP. . . [L 89, BF 90, BFL 91, . . . ] – New techniques needed for NP [FF 91, BT 03, V 04] • This Talk: hardness amplification – Relate mild avg-case & strong avg-case hardness

Hardness Amplification • Def: f : {0, 1}n ! {0, 1} is -hard for size s if 8 circuit C of size s Prx[C(x) f(x)] ¸ f e. g. , -hard for size s Hardness Amplification f 0 e. g. , -hard for size ¼ s where = (n´)

Standard Hardness Amplification • Yao’s XOR Lemma: f : {0, 1}n ! {0, 1} -hard for size s = s(n) ) f 0(x 1, . . . , xk) = f(x 1) ©. . . © f(xk) • k = n ) n´ = n 2 and f 0 : {0, 1}n' ! {0, 1} • ¼ Optimal, but cannot use in NP: f 2 NP ; f 0 2 NP

O’Donnell’s Amplification in NP • Idea: f´(x 1, . . . , xk) = C(f(x 1), . . . , f(xk)), C monotone • e. g. f(x 1) Æ ( f(x 2) Ç f(x 3) ). Then f´ 2 NP if f 2 NP • Theorem [O’Donnell `02]: 9 balanced f 2 NP (1/poly(n))-hard for size n (1) ) 9 f´ 2 NP -hard for size (n´) (1) • Barrier: No such construction can amplify above

Our Main Result Thm: 9 balanced f 2 NP (1/poly(n))-hard for size s(n) ) 9 f´ 2 NP ¼ -hard for size ¼ Examples: – s(n) = n (1) ) hardness – s(n) = W(1) n 2 ) hardness – s(n) = 2 W(n) ) hardness

Approach • Obs: Hardness of f´(x 1, . . . , xk) = C(f(x 1), . . . , f(xk)) limited by • Idea 1: Derandomization [I 95, IW 97] f´(s) = C(f(x 1), . . . , f(xk)) , where (x 1, . . . , xk) = G(s) for “pseudorandom” generator G, so • E. g. if then hope f´ • Q: Why does this still amplify hardness? – We exhibit unconditional G s. t. this works -hard

Approach (cont. ) f´(s) = C(f(x 1), . . . , f(xk)) , where (x 1, . . . , xk) = G(s) • Q: How to compute f´ 2 NP when k = (n´) (1)? • Idea 2: Nondeterminism – Use C s. t. C(f(x 1), . . . , f(xk)) can be computed nondeterministically looking at only log(k) f(xi )’s. – So f´ 2 NP even when k = 2 n’

f´(s)=C(f(x 1), . . . , f(xk)) , where (x 1, . . . , xk)=G(s) Outline • Trevisan’s (2003) proof of O’Donnell’s theorem • Identify properties of G that suffice & find such G • Describe C ensuring f´ 2 NP • Negative results: balanced f and nondeterminism necessary

Notation • f : {0, 1}n ! {0, 1} -hard for size s (e. g. =. 01, s = 2 W(n)) • f´(x 1, . . . , xk) : = C(f(x 1), . . . , f(xk)) for appropriate monotone C • Aim: Show f´ has hardness ¼ 1/2 - 1/k for size s´ = k = s. W(1)

Step 1: Hardcore Lemma [Imp 95] • f -hard ) indistinguishable from F w/ coin-flip on 2 frac. of inputs f 0 1 ¼ F 0 coin-flip 1 2 frac. • Formally: no circuit of size s´ can distinguish (x, f(x)) from (x, F(x)) for random x w/ advantage > 1/s´

Step 2: Info-theoretic hardness f 0 1 ¼ F 0 1 coin-flip 2 frac. (x, f(x)) ´ (x, F(x)) uses independence ) (x 1, . . , xk, f(x 1), . . . , f(xk)) ´ (x 1, . . . , xk, F(x 1), . . . , F(xk)) ) Hardness of C(f(x 1), . . . , f(xk)) for size s´ ¼ hardness of C(F(x 1), . . . , F(xk)) for size s´ ¸ hardness of C(F(x 1), . . . , F(xk)) for size 1

Step 3: Noise Sensitivity f 0 1 ¼ F 0 coin-flip 1 2 frac. • Info-theoretic hardness of C(F(x 1), . . . , F(xk)) depends only on C and ! • Hardness ¼ Noise. Sens [C] uses independence where i = 1 independently with probability

Step 4: Choosing C • There is monotone C : {0, 1}k ! {0, 1} ) C(f(x 1), . . . , f(xk)) has hardness ¼ 1/2 - 1/k • The barrier [KKL 88]: 8 monotone C : {0, 1}k ! {0, 1},

f´(s)=C(f(x 1), . . . , f(xk)) , where (x 1, . . . , xk)=G(s) Outline • Trevisan’s (2003) proof of O’Donnell’s theorem • Identify properties of G that suffice & find such G • Describe C ensuring f´ 2 NP • Negative results: balanced f and nondeterminism necessary

Step 2: Info-theoretic hardness f 0 1 ¼ F 0 1 coin-flip 2 frac. (x, f(x)) ´ (x, F(x)) uses independence ) (x 1, . . , xk, f(x 1), . . . , f(xk)) ´ (x 1, . . . , xk, F(x 1), . . . , F(xk)) ) Hardness of C(f(x 1), . . . , f(xk)) for size s´ ¼ hardness of C(F(x 1), . . . , F(xk)) for size s´ ¸ hardness of C(F(x 1), . . . , F(xk)) for size 1

Preserving Indistinguishability (x, f(x)) ´ (x, F(x)) ) (x 1, . . , xk, f(x 1), . . . , f(xk)) ´ (x 1, . . . , xk, F(x 1), . . . , F(xk)) • Want: G to be indistinguishability-preserving: (x, f(x)) ´ (x, F(x)) ) (s, f(x 1), . . . , f(xk)) ´ (s, F(x 1), . . . , F(xk)) where (x 1, . . . , xk)=G(s) • Achieved via combinatorial designs [Nis 91, NW 94].

Step 3: Noise Sensitivity f 0 1 ¼ F 0 coin-flip 1 2 frac. • Info-theoretic hardness of C(F(x 1), . . . , F(xk)) depends only on C and ! • Hardness ¼ Noise. Sens [C] uses independence where i = 1 independently with probability

Fooling Noise Sensitivity f 0 1 ¼ F 0 coin-flip r 1 2 frac.

Fooling Noise Sensitivity • Want: ¼ • Show 9 randomized constant-depth circuit s. t. 8 x 1, . . . , xk • Use existence of unconditional G against constantdepth circuits [Nis 90]

Want: A C C F F. . . F x 1 x 2. . xk A has constant depth and size(A) = poly(2 n, k) (using C constant depth and size(C) = poly(k))

Nisan’s Pseudorandom Generator • Want Pr[A(x 1, . . . , xk) = 1] ¼ Pr[A(G(s)) = 1] O(1) N log {0, 1} • Theorem [Nis 91]: There is G : ! {0, 1}N such that above holds for every A of size N and constant depth • Recall size(A) = poly(2 n, k) ) Input length of Nisan’s generator is poly(n), even for k = 2 n

Completing Derandomization • Let G(s 1, s 2) = Gind-pres(s 1) © Gconst-depth(s 2) • f´(s)=C(f(x 1), . . . , f(xk)) , where (x 1, . . . , xk)=G(s) • Thm: f´ has hardness ¼ 1/2 - 1/k for size s´ = k = s. W(1) • n´ = O(n 2) (w/PRG vs space [Nis 91]) ) hardness

f´(s)=C(f(x 1), . . . , f(xk)) , where (x 1, . . . , xk)=G(s) Outline • Trevisan’s (2003) proof of O’Donnell’s theorem • Identify properties of G that suffice & find such G • Describe C ensuring f´ 2 NP • Negative results: balanced f and nondeterminism necessary

The Structure of C C = TRIBES MONOTONE DNF [BL 90] Claim: If f 2 NP then f´ 2 NP even for k = 2 Proof: To compute f´(s): – Guess a clause, say (f(xi+1) Æ. . . Æ f(xi+b)) – Check if clause is true n´

Our Main Result Thm: 9 balanced f 2 NP (1/poly(n))-hard for size s(n) ) 9 f´ 2 NP ¼ -hard for size ¼ Examples: – s(n) = n (1) ) hardness – s(n) = W(1) n 2 ) hardness – s(n) = 2 W(n) ) hardness

Balanced Functions • Both our results and O’Donnell’s need balanced f 2 NP. That is: • Theorem: Any monotone “black-box” hardness amplification cannot amplify beyond • Proof Idea: – “Black-box” hardness amplification ) error correcting code [I 02, TV 02, V 03, T 03] – Good monotone codes only exist for balanced messages [Kruskal-Katona]

Nondeterminism is Necessary • Use of nondeterminism is likely to be necessary • Theorem: There is no deterministic, monotone “black-box” hardness amplification that amplifies beyond • Our amplification is nondeterministic, monotone, black-box, and amplifies up to

Conclusion • O’Donnell’s hardness amplification in NP: – – Amplifies up to No construction of same form does better • Our result: amplify up to • Two new techniques: 1. Derandomization 2. Nondeterminism • G fools noise sensitivity k = n (1) Only obstacle to hardness is PRG with logarithmic seed length for space or const-depth