[PPT] - Complexity of MCSP and Its Variants Shuichi Hirahara (The PowerPoint Presentation

SLIDE 1

On the Average-case Complexity of MCSP and Its Variants

Shuichi Hirahara (The University of Tokyo) Rahul Santhanam (University of Oxford)

CCC 2017 @Latvia, Riga July 6, 2017

SLIDE 2

Minimum Circuit Size Problem (MCSP)

Input

𝒚𝟐 𝒚𝟑 𝒚𝟐 ⊕ 𝒚𝟑 1 1 1 1 1 1

Truth table 𝑈 ∈ 0,1 2𝑜 of a

function 𝑔: 0,1 𝑜 → 0,1

Output

Is there a circuit of size ≤ 𝑡 that computes 𝑔?

Example: 𝑡 = 5 𝑔 = Output: “YES”

Size parameter 𝑡 ∈ ℕ

SLIDE 3

Brief History of MCSP

Dates back to 1950s. [Trakhtenbrot’s survey]
Kabanets & Cai (2000) revived interest,

based on natural proofs [Razborov & Rudich (1997)].

[ABKvMR06, AHMPS08, AD14, AHK15, HP15, MW15,

HW16, CIKK16, IS17, AH17, IKV17]…

MCSP ∉ 𝐐 under cryptographic assumptions.
MCSP is not NP-hard under restricted reductions.
Open Problem: Is MCSP NP-complete?

SLIDE 4

Average-case Complexity

Input

Truth table 𝑈 ∈ 0,1 2𝑜 of a

function 𝑔: 0,1 𝑜 → 0,1

Output

Is there a circuit of size ≤ 𝑡(𝑜) that computes 𝑔?

Size parameter 𝑡 ∈ ℕ

➢ Parameterized MCSP[s] for 𝑡: ℕ → ℕ ➢ Consider the uniform distribution on 0,1 2𝑜.

#YES instances = 𝑡𝑃(𝑡) ≪ 22𝑜

➢ Consider zero-error average-case complexity.

(i.e. Algorithms output 0, 1, or ‘?’)

SLIDE 5

“Natural Proofs Useful Against SIZE 𝑡 ” and “Average-case Algorithms for MCSP[𝑡]”

YES NO instances

MCSP 𝑡 Natural proof:

An algorithm that

1. accepts most truth tables, and
2. rejects every truth table of an

easy function.

⟺

SLIDE 6

“Natural Proofs Useful Against SIZE 𝑡 ” and “Average-case Algorithms for MCSP[𝑡]”

YES NO instances

MCSP 𝑡 Natural proof:

An algorithm that

1. accepts most truth tables, and
2. rejects every truth table of an

easy function. Rejects Accepts Natural Proof

⟹

Claim:

SLIDE 7

“Natural Proofs Useful Against SIZE 𝑡 ” and “Average-case Algorithms for MCSP[𝑡]”

YES NO instances

MCSP 𝑡 Natural proof:

An algorithm that

1. accepts most truth tables, and
2. rejects every truth table of an

easy function. ‘?’

‘0’

Zero-error Algorithm for MCSP 𝑡

⟹

Claim:

SLIDE 8

“Natural Proofs Useful Against SIZE 𝑡 ” and “Average-case Algorithms for MCSP[𝑡]”

YES NO instances

MCSP 𝑡 Natural proof:

An algorithm that

1. accepts most truth tables, and
2. rejects every truth table of an

easy function. ‘?’

‘0’

Zero-error Algorithm for MCSP 𝑡

⟸

Claim:

‘1’

SLIDE 9

“Natural Proofs Useful Against SIZE 𝑡 ” and “Average-case Algorithms for MCSP[𝑡]”

YES NO instances

MCSP 𝑡 Natural proof:

An algorithm that

1. accepts most truth tables, and
2. rejects every truth table of an

easy function. ‘0’

‘1’

⟸

Claim:

‘0’ Natural Proof

SLIDE 10

Average-case Complexity of MCSP is More Intuitive ➢ MCSP 𝑡1 ≤𝑛

𝑞 MCSP[s2]

In the setting of worst-case complexity,

?

Not known

➢ MCSP 𝑡1 ≤ MCSP[s2] for 𝑡1 ≤ 𝑡2

This reduction is given by the identity map.

In the setting of average-case complexity,

SLIDE 11

Outline

1. Pseudorandom self-reducibility of MCSP
2. Hardness of MKTP under Popular Average-Case

Conjectures

3. Unconditional Lower Bounds for MCSP

SLIDE 12

Outline

1. Pseudorandom self-reducibility of MCSP
2. Hardness of MKTP under Popular Average-Case

Conjectures

3. Unconditional Lower Bounds for MCSP

SLIDE 13

Random Self-reducibility

𝑀 is (1-query) randomly self-reducible Oracle 𝑀

∃ Randomized poly-time machine Query 𝑟 Answer 𝑀(𝑟) Input: 𝑦 ∈ 0,1 𝑂 Output 𝑀 𝑦 w.h.p.

𝑟 is uniformly distributed on 0,1 𝑂

⟺

def

SLIDE 14

Worst-case to Average-case Reduction

𝑀 is randomly self-reducible, and

Oracle 𝑀

Query 𝑟 ≡ 𝑉𝑂 Answer 𝑀(𝑟) Input: 𝑦 ∈ 0,1 𝑂 Output 𝑀 𝑦 w.h.p.

∃ algorithm solves 𝑀 on average.

⟹ ∃ algorithm solves 𝑀 on every inputs.

The average-case algorithm

SLIDE 15

Worst-case ≰ Average-case for NP

➢ If MCSP is randomly self-reducible, it provides strong evidence of non-NP-hardness of MCSP.

Theorem ([Feigenbaum & Fortnow 1993], [Bogdanov & Trevisan 2006])

NP-complete sets are not randomly self-reducible (unless PH collapses).

SLIDE 16

Pseudorandom self-reducibility

𝑀 is (1-query) pseudorandomly self-reducible Oracle 𝑀

Query 𝑟 Answer 𝑀(𝑟) Input: 𝑦 ∈ 0,1 𝑂 Output 𝑀 𝑦 w.h.p.

𝑟 and 𝑉𝑂 are indistinguishable by SIZE(poly).

⟺

def

∃ Randomized poly-time machine

SLIDE 17

Worst-case to Average-case Reduction for “Feasibly-on-Average” Algorithms

𝑀 is pseudorandomly self-reducible, and

Oracle 𝑀

Query 𝑟 ≈𝑑 𝑉𝑂 Answer 𝑀(𝑟) Input: 𝑦 ∈ 0,1 𝑂 Output 𝑀 𝑦 w.h.p.

∃ algorithm solves 𝑀 on average

and its error set can be decided in P.

⟹ ∃ algorithm solves 𝑀 on every inputs.

E.g. A poly-time algorithm

SLIDE 18

Theorem

Assume exponentially hard one-way functions exist. Then, for any 𝑡: ℕ → ℕ, MCSP 𝑡 − 𝑜𝑑, 𝑡 + 𝑜𝑑 is pseudorandomly reducible to MCSP 𝑡 .

MCSP is Pseudorandomly self-reducible

SLIDE 19

MCSP is Pseudorandomly self-reducible

Theorem

Assume exponentially hard one-way functions exist. Then, for any 𝑡: ℕ → ℕ, MCSP 𝑡 − 𝑜𝑑, 𝑡 + 𝑜𝑑 is pseudorandomly reducible to MCSP 𝑡 .

MCSP 𝑡 − 𝑜c, 𝑡 + 𝑜c is the promise problem such that

YES instances are truth tables of circuits of size ≤ 𝑡 𝑜 − 𝑜𝑑,
NO instances are truth tables of circuits of size > 𝑡 𝑜 + 𝑜𝑑.

SLIDE 20

Theorem

Assume exponentially hard one-way functions exist. Then, for any 𝑡: ℕ → ℕ, MCSP 𝑡 − 𝑜𝑑, 𝑡 + 𝑜𝑑 is pseudorandomly reducible to MCSP 𝑡 .

𝑔 is exponentially hard one-way function.

⟺

def Pr

𝑦∼ 0,1 𝑜 𝐷 𝑔 𝑦

∈ 𝑔−1 𝑔 𝑦 < 2−𝑜𝜗 for any circuit 𝐷 of size < 2𝑜𝜗. ∃ 𝜗 > 0 such that

MCSP is Pseudorandomly self-reducible

SLIDE 21

Theorem

Assume exponentially hard one-way functions exist. Then, for any 𝑡: ℕ → ℕ, MCSP 𝑡 − 𝑜𝑑, 𝑡 + 𝑜𝑑 is pseudorandomly reducible to MCSP 𝑡 .

Main Ingredient: PseudoRandom Function Generator 𝐺 (PRFG)

𝐺: 0,1 𝑜𝑃(1) → 0,1 2𝑜 is a PRFG

⟺

def

2. The circuit complexity of 𝐺(𝑠) is ≤ 𝑜𝑑.
1. 𝐺 𝑉𝑜𝑃 1

≈𝑑 𝑉2𝑜. (computationally indistinguishable)

A PRFG can be constructed from an exponentially hard OWF.

[Razborov & Rudich ‘97], [Goldreich, Goldwasser & Micali ’86]

MCSP is Pseudorandomly self-reducible

SLIDE 22

Pseudorandom Self-reduction for MCSP

MCSP 𝑡 oracle

Query 𝑟 ≔ 𝑈 ⊕ 𝐺(𝑠) Answer 𝑏 ∈ 0,1 Input: 𝑈 ∈ 0,1 2𝑜

Output 𝑏

𝑟 = 𝑈 ⊕ 𝐺 𝑠 ≈𝑑 𝑈 ⊕ 𝑉2𝑜 ≡ 𝑉2𝑜.

Take a pseudorandom function generator 𝐺: 0,1 𝑜𝑃 1 → 0,1 2𝑜.

Pick 𝑠 randomly.

𝐺 𝑠 ≈𝑑 𝑉2𝑜 ⟹
circuit complexity of 𝑈 − (circuit complexity of 𝑟) ≤ 𝑜𝑑.

SLIDE 23

Pseudorandom self-reduction

Summary of the 1st part:
1. Introduced the notion of pseudorandom self-reduction.
2. MCSP is pseudorandomly self-reducible under a

standard cryptographic assumption.

Open Problem

Are NP-complete sets pseudorandomly self-reducible under standard cryptographic assumptions?

SLIDE 24

Outline

1. Pseudorandom self-reducibility of MCSP
2. Hardness of MKTP under Popular Average-Case

Conjectures

3. Unconditional Lower Bounds for MCSP

SLIDE 25

Input

𝑦 ∈ 0,1 ∗

Output

KT 𝑦 ≤ 𝑡 ?

Size parameter 𝑡 ∈ ℕ

MKTP

(Minimum Kolmogorov Time-bounded Complexity Problem) Fact [ABKvMR06]: KT 𝑦 ≈ (circuit complexity of 𝑦) (Intuitively: Can each bit of 𝑦 be described efficiently by a random access machine?) KT 𝑦 ≔ min 𝑒 + 𝑢 | 𝑉𝑒 𝑗 = 𝑦𝑗 in time 𝑢 for all 𝑗 .

Definition of KT complexity [Allender, Buhrman, Koucký, van Melkebeek & Ronneburger ‘06]

SLIDE 26

Hardness Under Popular Conjectures

Theorem

1. MKTP is Random 3SAT-hard (in the sense of Feige).
2. MKTP is Planted Clique-hard.
3. MKTP and MCSP are hard under Alekhnovich’s

hypothesis about linear equations with noise.

Previously, SZK ≤𝑈

BPP MCSP was known.

Our results give the first hardness results based on

problems not known to be in SZK.

[Allender & Das 2014]

SLIDE 27

Random 3SAT [Feige 2002]

➢Average-case version of 3SAT ➢Distribution on inputs:

A 3CNF formula with 𝑜 variables and 𝑛 = Δ𝑜 clauses

(Δ: a large constant)

Each clause is chosen uniformly at random.

Feige’s Hypothesis (Random 3SAT is hard for P)

There is no polynomial-time algorithm that

1. accepts every satisfiable formula, and
2. rejects most 3CNF formulae.

SLIDE 28

Random 3SAT hardness

Recently, Ryan O’Donnell conjectured that Random

3SAT cannot be solved by even coNP algorithms.

In particular, his conjecture implies that MKTP is

not in coNP.

Theorem

There is a poly-time algorithm with oracle access to MKTP that refutes Feige’s hypothesis.

SLIDE 29

Proof of Random 3SAT Hardness

Construct a many-one reduction:
We need to claim:
1. KT 𝜒 > 𝜄 with high probability.

(Most formulae are incompressible.)

2. KT 𝜒 ≤ 𝜄 for any satisfiable 3CNF formula 𝜒.

(Satisfiable formulae are quite “rare” instances.)

Random 3SAT 𝜒 MKTP

↦

(𝜒, 𝜄)

for some size parameter 𝜄

SLIDE 30

Most Formulae are Incompressible

Claim 1

KT 𝜒 > 𝜄 with high probability (over the choice of random 3CNF formula 𝜒). 𝜒 = 𝑦1 ∨ 𝑦3 ∨ 𝑦4 ∧ 𝑦2 ∨ 𝑦3 ∨ 𝑦4 ∧ 𝑦1 ∨ 𝑦2 ∨ 𝑦4 ∧ ⋯

log 8 𝑜

3 random bits for each clause. (8 ways to negate variables.)

𝑛 ⋅ log 8 𝑜

3 random bits in total

⟹ ⟹

KT 𝜒 ≥ K 𝜒 > 𝑛 ⋅ log 8 𝑜

3 − 𝑃 𝑜 w.h.p.

= 𝜄

SLIDE 31

Satisfiable Formulae are Compressible

Claim 2

KT 𝜒 ≪ 𝑛 ⋅ log 8 𝑜

3 for any satisfiable 3CNF formula 𝜒.

Example: 𝑏 = 𝑦1 ↦ 0, 𝑦2 ↦ 0, 𝑦3 ↦ 0, 𝑦4 ↦ 1 . 𝜒 = 𝑦1 ∨ 𝑦3 ∨ 𝑦4 ∧ 𝑦2 ∨ 𝑦3 ∨ 𝑦4 ∧ 𝑦1 ∨ 𝑦2 ∨ 𝑦4 ∧ ⋯ Assume that some assignment 𝑏 satisfies 𝜒.

Given 𝑏, each clause can be described by log 7 𝑜

3 bits of information.

(There are 7 ways to negate variables so that a clause is satisfied by 𝑏.)

⟹

KT 𝜒 ≾ 𝑏 + 𝑛 log 7 𝑜

3 ≪ 𝑛 log 8 𝑜 3 for large 𝑛. This clause cannot appear in 𝜒.

SLIDE 32

Hardness Under Popular Conjectures

Summary of the 2nd part:
1. MKTP is Random 3SAT-hard, Planted Clique-hard, and

hard under Alekhnovich’s conjecture.

2. MCSP is hard under Alekhnovich’s conjecture.

Open Problem

Is MCSP Random 3SAT-hard or Planted Clique-hard?

SLIDE 33

Outline

1. Pseudorandom self-reducibility of MCSP
2. Hardness of MKTP under Popular Average-Case

Conjectures

3. Unconditional Lower Bounds for MCSP

SLIDE 34

Unconditional Lower Bounds

Theorem

For some size parameters 𝑡 and 𝑡′,

1. MKTP 𝑡′ cannot be decided with Ω 1 success on

average by AC0 𝑞 for any prime 𝑞.

2. MCSP 𝑡 requires De Morgan formulae of size 𝑂2−𝑝 1 for

input length 𝑂 = 2𝑜. Proof idea Use ideas of pseudorandom generators for

1. AC0 𝑞

[Fefferman, Shaltiel, Umans and Viola ’13]

2. De Morgan formulae [Impagliazzo, Meka and Zuckerman ’12]

SLIDE 35

MKTP ∉ AC0 𝑞 on average

Pseudorandom Generator for 𝐁𝐃𝟏[𝒒] (𝑞: odd prime) [FSUV’13]

𝐻: 0,1 𝑜 𝑙 → 0,1 𝑜𝑙+𝑙 𝑦1, … , 𝑦𝑙 ↦ 𝑦1, … , 𝑦𝑙, PARITY 𝑦1 , … , PARITY 𝑦𝑙 ∈

Fact.

1. KT 𝐻 𝑉𝑜𝑙

≤ 𝑜𝑙 + ෨ 𝑃 𝑜 .

2. KT 𝑉𝑜𝑙+𝑙 ≥ 𝑜𝑙 + 𝑙 − 𝑜 with high probability.

⟹ MKTP oracle can be used to break 𝐻 for 𝑙 = 𝑜2.

SLIDE 36

De Morgan Formula Lower Bounds

Lemma. [Impagliazzo, Meka & Zuckerman 2012]

There is a pseudorandom restriction 𝜍: 𝑂 → 0, 1,∗ such that

1. 𝜍 𝑗 = ∗ with probability 𝑞 = 𝑂−(1−𝑝 1 ).
2. 𝔽𝜍 L 𝑔|𝜍

≤ 𝑞2 ⋅ L(𝑔) for any function 𝑔.

3. Each bit of 𝜍 can be computed in time 𝑂𝑝 1 .

Idea: “Pseudorandom restriction”

A pseudorandom restriction shrinks a formula.
L MCSP 𝑡 |𝜍 ≿ 𝑞𝑂 for pseudorandom restriction 𝜍.

𝑞𝑂 ≾ L MCSP 𝑡 |𝜍 < 𝑞2L MCSP 𝑡 .

⟹

(because MCSP 𝑡 |𝜍 depends on most unrestricted variables)

SLIDE 37

Unconditional Lower Bounds

Summary of the 3rd part:
1. MKTP is not solvable by AC0[𝑞] on average.
2. MCSP requires De Morgan Formulae of size 𝑂2−𝑝 1 .

Open Problems

1. MCSP ∉ AC0[𝑞]?
2. MCSP requires De Morgan Formulae of size 𝑂3−𝑝 1 ?

SLIDE 38

Summary

1. MCSP is pseudorandomly self-reducible under a

standard cryptographic assumption.

2. MKTP and MCSP are hard under popular average-

case complexity conjectures.

3. MKTP is not in AC0[𝑞] on average.
4. MCSP requires De Morgan formulae of size 𝑂2−𝑝 1 .