Complexity of MCSP and Its Variants Shuichi Hirahara (The - PowerPoint PPT Presentation

On the Average-case Complexity of MCSP and Its Variants Shuichi Hirahara (The University of Tokyo) Rahul Santhanam (University of Oxford) CCC 2017 @Latvia, Riga July 6, 2017

Minimum Circuit Size Problem (MCSP) Output Input • Truth table 𝑈 ∈ 0,1 2 𝑜 of a Is there a circuit of size ≤ 𝑡 function 𝑔: 0,1 𝑜 → 0,1 that computes 𝑔 ? • Size parameter 𝑡 ∈ ℕ Example: Output: “YES” 𝑡 = 5 𝒚 𝟐 𝒚 𝟑 𝒚 𝟐 ⊕ 𝒚 𝟑 0 0 0 0 1 1 𝑔 = 1 0 1 1 1 0

Brief History of MCSP • Dates back to 1950s. [ Trakhtenbrot’s survey] • Kabanets & Cai (2000) revived interest, based on natural proofs [Razborov & Rudich (1997)]. • [ABKvMR06, AHMPS08, AD14, AHK15, HP15, MW15, HW16, CIKK16, IS17, AH17, IKV17]… • MCSP ∉ 𝐐 under cryptographic assumptions. • MCSP is not NP-hard under restricted reductions. • Open Problem: Is MCSP NP-complete?

Average-case Complexity ➢ Parameterized MCSP[s] for 𝑡: ℕ → ℕ Output Input • Truth table 𝑈 ∈ 0,1 2 𝑜 of a Is there a circuit of size ≤ 𝑡(𝑜) function 𝑔: 0,1 𝑜 → 0,1 that computes 𝑔 ? • Size parameter 𝑡 ∈ ℕ ➢ Consider the uniform distribution on 0,1 2 𝑜 . ➢ Consider zero-error average-case complexity. (i.e. Algorithms output 0, 1, or ‘?’) • #YES instances = 𝑡 𝑃(𝑡) ≪ 2 2 𝑜

“Natural Proofs Useful Against SIZE 𝑡 ” and “Average -case Algorithms for MCSP[𝑡] ” ⟺ MCSP 𝑡 Natural proof: An algorithm that 1. accepts most truth tables, and YES 2. rejects every truth table of an easy function. NO instances

“Natural Proofs Useful Against SIZE 𝑡 ” and “Average -case Algorithms for MCSP[𝑡] ” Claim: ⟹ MCSP 𝑡 Natural proof: An algorithm that 1. accepts most truth tables, and YES 2. rejects every truth table of an Rejects easy function. Accepts Natural Proof NO instances

“Natural Proofs Useful Against SIZE 𝑡 ” and “Average -case Algorithms for MCSP[𝑡] ” Claim: ⟹ MCSP 𝑡 Natural proof: An algorithm that 1. accepts most truth tables, and YES 2. rejects every truth table of an ‘?’ easy function. ‘0’ Zero-error Algorithm for MCSP 𝑡 NO instances

“Natural Proofs Useful Against SIZE 𝑡 ” and “Average -case Algorithms for MCSP[𝑡] ” Claim: ⟸ MCSP 𝑡 Natural proof: An algorithm that 1. accepts most truth tables, and YES ‘1’ 2. rejects every truth table of an ‘?’ easy function. ‘0’ Zero-error Algorithm for MCSP 𝑡 NO instances

“Natural Proofs Useful Against SIZE 𝑡 ” and “Average -case Algorithms for MCSP[𝑡] ” Claim: ⟸ MCSP 𝑡 Natural proof: An algorithm that 1. accepts most truth tables, and YES ‘0’ 2. rejects every truth table of an ‘0’ easy function. ‘1’ Natural Proof NO instances

Average-case Complexity of MCSP is More Intuitive • In the setting of worst-case complexity, ? 𝑞 MCSP[s 2 ] ➢ MCSP 𝑡 1 ≤ 𝑛 Not known • In the setting of average-case complexity, ➢ MCSP 𝑡 1 ≤ MCSP[s 2 ] for 𝑡 1 ≤ 𝑡 2 This reduction is given by the identity map.

Outline 1. Pseudorandom self-reducibility of MCSP 2. Hardness of MKTP under Popular Average-Case Conjectures 3. Unconditional Lower Bounds for MCSP

Outline 1. Pseudorandom self-reducibility of MCSP 2. Hardness of MKTP under Popular Average-Case Conjectures 3. Unconditional Lower Bounds for MCSP

Random Self-reducibility 𝑀 is (1-query) randomly self-reducible def ⟺ ∃ Randomized poly-time machine Input: 𝑦 ∈ 0,1 𝑂 Oracle 𝑀 Query 𝑟 Answer 𝑀(𝑟) Output 𝑀 𝑦 w.h.p. 𝑟 is uniformly distributed on 0,1 𝑂 •

Worst-case to Average-case Reduction • 𝑀 is randomly self-reducible, and • ∃ algorithm solves 𝑀 on average. ⟹ ∃ algorithm solves 𝑀 on every inputs. The average-case algorithm Input: 𝑦 ∈ 0,1 𝑂 Oracle 𝑀 Query 𝑟 ≡ 𝑉 𝑂 Answer 𝑀(𝑟) Output 𝑀 𝑦 w.h.p.

Worst-case ≰ Average-case for NP Theorem ( [Feigenbaum & Fortnow 1993], [Bogdanov & Trevisan 2006]) NP-complete sets are not randomly self-reducible (unless PH collapses). ➢ If MCSP is randomly self-reducible, it provides strong evidence of non-NP-hardness of MCSP.

Pseudorandom self-reducibility 𝑀 is (1-query) pseudorandomly self-reducible def ⟺ ∃ Randomized poly-time machine Input: 𝑦 ∈ 0,1 𝑂 Oracle 𝑀 Query 𝑟 Answer 𝑀(𝑟) Output 𝑀 𝑦 w.h.p. • 𝑟 and 𝑉 𝑂 are indistinguishable by SIZE(poly).

Worst-case to Average-case Reduction for “Feasibly -on- Average” Algorithms • 𝑀 is pseudorandomly self-reducible, and • ∃ algorithm solves 𝑀 on average and its error set can be decided in P . ⟹ ∃ algorithm solves 𝑀 on every inputs. E.g. A poly-time algorithm Input: 𝑦 ∈ 0,1 𝑂 Oracle 𝑀 Query 𝑟 ≈ 𝑑 𝑉 𝑂 Answer 𝑀(𝑟) Output 𝑀 𝑦 w.h.p.

MCSP is Pseudorandomly self-reducible Theorem Assume exponentially hard one-way functions exist. Then, for any 𝑡: ℕ → ℕ, MCSP 𝑡 − 𝑜 𝑑 , 𝑡 + 𝑜 𝑑 is pseudorandomly reducible to MCSP 𝑡 .

MCSP is Pseudorandomly self-reducible Theorem Assume exponentially hard one-way functions exist. Then, for any 𝑡: ℕ → ℕ, MCSP 𝑡 − 𝑜 𝑑 , 𝑡 + 𝑜 𝑑 is pseudorandomly reducible to MCSP 𝑡 . MCSP 𝑡 − 𝑜 c , 𝑡 + 𝑜 c is the promise problem such that YES instances are truth tables of circuits of size ≤ 𝑡 𝑜 − 𝑜 𝑑 , • • NO instances are truth tables of circuits of size > 𝑡 𝑜 + 𝑜 𝑑 .

MCSP is Pseudorandomly self-reducible Theorem Assume exponentially hard one-way functions exist. Then, for any 𝑡: ℕ → ℕ, MCSP 𝑡 − 𝑜 𝑑 , 𝑡 + 𝑜 𝑑 is pseudorandomly reducible to MCSP 𝑡 . 𝑔 is exponentially hard one-way function. def ⟺ ∃ 𝜗 > 0 such that ∈ 𝑔 −1 𝑔 𝑦 < 2 −𝑜 𝜗 𝑦∼ 0,1 𝑜 𝐷 𝑔 𝑦 Pr for any circuit 𝐷 of size < 2 𝑜 𝜗 .

MCSP is Pseudorandomly self-reducible Theorem Assume exponentially hard one-way functions exist. Then, for any 𝑡: ℕ → ℕ, MCSP 𝑡 − 𝑜 𝑑 , 𝑡 + 𝑜 𝑑 is pseudorandomly reducible to MCSP 𝑡 . • Main Ingredient: PseudoRandom Function Generator 𝐺 (PRFG) 𝐺: 0,1 𝑜 𝑃(1) → 0,1 2 𝑜 is a PRFG def 1. 𝐺 𝑉 𝑜 𝑃 1 ≈ 𝑑 𝑉 2 𝑜 . (computationally indistinguishable) ⟺ 2. The circuit complexity of 𝐺(𝑠) is ≤ 𝑜 𝑑 . • A PRFG can be constructed from an exponentially hard OWF. [Razborov & Rudich ‘97], [ Goldreich, Goldwasser & Micali ’86]

Pseudorandom Self-reduction for MCSP Take a pseudorandom function generator 𝐺: 0,1 𝑜 𝑃 1 → 0,1 2 𝑜 . • Input: 𝑈 ∈ 0,1 2 𝑜 Query Pick 𝑠 randomly. MCSP 𝑡 oracle 𝑟 ≔ 𝑈 ⊕ 𝐺(𝑠) Answer 𝑏 ∈ 0,1 Output 𝑏 𝐺 𝑠 ≈ 𝑑 𝑉 2 𝑜 ⟹ 𝑟 = 𝑈 ⊕ 𝐺 𝑠 ≈ 𝑑 𝑈 ⊕ 𝑉 2 𝑜 ≡ 𝑉 2 𝑜 . • circuit complexity of 𝑈 − (circuit complexity of 𝑟) ≤ 𝑜 𝑑 . •

Pseudorandom self-reduction • Summary of the 1 st part: 1. Introduced the notion of pseudorandom self-reduction. 2. MCSP is pseudorandomly self-reducible under a standard cryptographic assumption. Open Problem Are NP-complete sets pseudorandomly self-reducible under standard cryptographic assumptions?

Outline 1. Pseudorandom self-reducibility of MCSP 2. Hardness of MKTP under Popular Average-Case Conjectures 3. Unconditional Lower Bounds for MCSP

MKTP (Minimum Kolmogorov Time-bounded Complexity Problem) Input Output • 𝑦 ∈ 0,1 ∗ KT 𝑦 ≤ 𝑡 ? • Size parameter 𝑡 ∈ ℕ (Intuitively: Can each bit of 𝑦 be described efficiently by a random access machine?) Definition of KT complexity [Allender, Buhrman, Koucký, van Melkebeek & Ronneburger ‘06] KT 𝑦 ≔ min 𝑒 + 𝑢 | 𝑉 𝑒 𝑗 = 𝑦 𝑗 in time 𝑢 for all 𝑗 . Fact [ABKvMR06]: KT 𝑦 ≈ (circuit complexity of 𝑦)

Hardness Under Popular Conjectures Theorem 1. MKTP is Random 3SAT-hard (in the sense of Feige). 2. MKTP is Planted Clique-hard. 3. MKTP and MCSP are hard under Alekhnovich’s hypothesis about linear equations with noise. BPP MCSP was known. • Previously, SZK ≤ 𝑈 [Allender & Das 2014] • Our results give the first hardness results based on problems not known to be in SZK .

Random 3SAT [Feige 2002] ➢ Average-case version of 3SAT ➢ Distribution on inputs: • A 3CNF formula with 𝑜 variables and 𝑛 = Δ𝑜 clauses ( Δ : a large constant) • Each clause is chosen uniformly at random. Feige’s Hypothesis (Random 3SAT is hard for P) There is no polynomial-time algorithm that 1. accepts every satisfiable formula, and 2. rejects most 3CNF formulae.

Random 3SAT hardness Theorem There is a poly-time algorithm with oracle access to MKTP that refutes Feige’s hypothesis. • Recently, Ryan O’Donnell conjectured that Random 3SAT cannot be solved by even coNP algorithms. • In particular, his conjecture implies that MKTP is not in coNP .

Proof of Random 3SAT Hardness • Construct a many-one reduction: MKTP Random 3SAT ↦ 𝜒 (𝜒, 𝜄) for some size parameter 𝜄 • We need to claim: 1. KT 𝜒 > 𝜄 with high probability. (Most formulae are incompressible.) 2. KT 𝜒 ≤ 𝜄 for any satisfiable 3CNF formula 𝜒 . (Satisfiable formulae are quite “rare” instances.)