improving the exact security of digital signature schemes
TRANSCRIPT
10/5/2020
Sublinear Algorithms
LECTURE 5Last timeβ’ Limitations of sublinear-time algorithms
β’ Yaoβs Minimax Principle
β’ Examples: testing 0β and sortedness
Todayβ’ Limitations of sublinear-time algorithms
β’ Yaoβs Minimax Principle
β’ Communication complexity
Sofya Raskhodnikova;Boston University
Recall: Yaoβs Minimax Principle
2
β’ Need for lower bounds
Yaoβs Minimax Principle (easy direction): Statement 2 β Statement 1.
NOTE: Also applies to restricted algorithms
β’ 1-sided error tests
β’ nonadaptive tests
Statement 1
For any probabilistic algorithm A of complexity q there exists an input x s.t.
Prππππ π‘ππ π ππ ππ π΄
[A(x) is wrong] > 1/3.
Statement 2
There is a distribution D on the inputs, s.t. for every deterministic algorithm of complexity q,
Prπ₯βπ·
[A(x) is wrong] > 1/3.
Yaoβs Minimax Principle as a game
3
Players: Evil algorithms designer Al and poor lower bound prover Lola.
Game1
Move 1. Al selects a q-query randomized algorithm A for the problem.
Move 2. Lola selects an input on which A errs with largest probability.
Game2
Move 1. Lola selects a distribution on inputs.
Move 2. Al selects a q-query deterministic algorithm with as large probability of success on Lolaβs distribution as possible.
Testing Monotonicity of functions on HypercubeNon-adaptive 1-sided error
Lower Bound
5
f(000)
f(111) f(011)
f(100)
f(101)
f(110)f(010)
f(001)
Boolean Functions π βΆ π, π π β {π, π}
Graph representation:
π-dimensional hypercube
β’ 2π vertices: bit strings of length π
β’ 2πβ1π edges: (π₯, π¦) is an edge if π¦ can be obtained from π₯ by increasing one bit from 0 to 1
β’ each vertex π₯ is labeled with π(π₯)
001001
011001
π₯π¦
6
Boolean Functions π βΆ π, π π β {π, π}
Graph representation:
π-dimensional hypercube
β’ 2π vertices: bit strings of length π
β’ 2πβ1π edges: (π₯, π¦) is an edge if π¦ can be obtained from π₯ by increasing one bit from 0 to 1
β’ each vertex π₯ is labeled with π(π₯)
001001
011001
π₯π¦
π(00β―00)
π(11β―11)
Vertices: increasing weight
Monotonicity of Functions
7
[Goldreich Goldwasser Lehman Ron Samorodnitsky,
Dodis Goldreich Lehman Raskhodnikova Ron Samorodnitsky
Fischer Lehman Newman Raskhodnikova Rubinfeld Samorodnitsky]
β’ A function π βΆ 0,1 π β {0,1} is monotone
if increasing a bit of π₯ does not decrease π(π₯).
β’ Is π monotone or π-far from monotone(π has to change on many points to become monontone)?
β Edge π₯π¦ is violated by π if π (π₯) > π (π¦).
Time:
β π(π/π), logarithmic in the size of the input, 2π
β Ξ©( π/π) for 1-sided error, nonadaptive tests
β Advanced techniques: Ξ( π/π2) for nonadaptive tests, Ξ© 3 π
[Khot Minzer Safra 15, Chen De Servidio Tang 15, Chen Waingarten Xie 17]
0
0 0
01
1
1
1
1
1 0
00
0
1
1
monotone
1
2-far from monotone
Hypercube 1-sided Error Lower Bound
8
β’ 1-sided error test must accept if no violated pair is uncovered.
Violated pair:
β A distribution on far from monotone functions suffices.
LemmaEvery 1-sided error nonadaptive test for monotonicity of functions π βΆ
0,1 π β {0,1} requires Ξ© π queries.
01
[Fischer Lehman Newman Raskhodnikova Rubinfeld Samorodnitsky]
Hypercube 1-sided Error Lower Bound
9
β’ Hard distribution: pick coordinate π at random and output ππ.
π
2Β± π 1 β coordinate π
1
0
ππ βΆ
ππ(π₯) =
1 if π₯ >π
2+ π
1 β π₯π if π₯ =π
2Β± π
0 if π₯ <π
2β π
Hypercube 1-sided Error Lower Bound
10
β’ Hard distribution: pick coordinate π at random and output ππ.
β’ A ``truncationββ of an antidicator
π
2Β± π 1 β coordinate π
1
0
ππ βΆ
ππ(π₯) =
1 if π₯ >π
2+ π
1 β π₯π if π₯ =π
2Β± π
0 if π₯ <π
2β π
1
10
00
0
1
1
antidictator
The Fraction of Nodes in Middle Layers
E[Y]=
π =
11
Let Y1, β¦ , Ys be independently distributed random variables in [0,1].
Let Y =1
π β β
π
π=1Yi (called sample mean). Then Pr Y β E Y β₯ π β€ 2eβ2π π
2.
Hoeffding Bound
π
2Β± π 1 β coordinate π
1
0
ππ βΆ
Hard Functions are Far
12
β’ Hard distribution: pick coordinate π at random and output ππ.
Analysis
2 π 1 β coordinate π
1
0
ππ βΆ
β’ The middle contains a constant fraction of vertices.β’ Edges from (π₯1, β¦ , π₯πβ1, 0, π₯π+1, β¦ , π₯π) to (π₯1, β¦ , π₯πβ1, 1, π₯π+1, β¦ , π₯π) are
violated if both endpoints are in the middle.β’ All π functions are π-far from monotone for some constant π.
ππ(π₯) =
1 if π₯ >π
2+ π
1 β π₯π if π₯ =π
2Β± π
0 if π₯ <π
2β π
Hypercube 1-sided Error Lower Bound
13
β’ How many functions does a set of π queries expose?
# functions that a query pair (π₯, π¦) exposesβ€ # coordinates on which π₯ and π¦ differ
β€ 2 π
111011
001001
π₯π¦
π π π
Pair (π₯, π¦)can expose only
functions ππ , ππ and ππ
queries
2 π
1
0
π
π₯
π¦
Only pairs of queries in the Green Band can be violated β disagreements β€ 2 π
Naive Analysis
# functions exposed by π queriesβ€ π2 β 2 π
Hypercube 1-sided Error Lower Bound
14
β’ How many functions does a set of π queries expose?
# functions that a query pair (π₯, π¦) exposesβ€ # coordinates on which π₯ and π¦ differ
β€ 2 π
111011
001001
π₯π¦
π π π
Pair (π₯, π¦)can expose only
functions ππ , ππ and ππ
queries
2 π
1
0
π
π₯
π¦
Only pairs of queries in the Green Band can be violated β disagreements β€ 2 π
Claim# functions exposed by π queries
β€ (π β 1) β 2 π
Hypercube 1-sided Error Lower Bound
15
β’ How many functions does a set of π queries expose?
Let π be the set of queries made.The tester catches a violation
βQ contains comparable π₯, π¦that differ in coordinate π
2 π
1
0
π
π₯
π¦
Claim# functions exposed by π queries
β€ (π β 1) β 2 π
Consider its spanning forest.
sufficient to consider adjacent vertices in a minimum spanning forest
on the query set
Draw an undirected graph π, πΈby connected comparable queries
π₯, π¦ existβ
there are adjacent vertices on the pathfrom π₯ to π¦ that differ in coordinate π
Hypercube 1-sided Error Lower Bound
16
β’ How many functions does a set of π queries expose?
queries
2 π
1
0
π
π₯
π¦
Claim# functions exposed by π queries
β€ (π β 1) β 2 π
β
ClaimEvery deterministic test that makes a set π of π queries (in the middle)
succeeds with probability ππ
πon our distribution. ⨳
Communication Complexity
A Method for Proving Lower Bounds [Blais Brody Matulef 11]
Use known lower bounds
for other models of computation
Partially based on slides by Eric Blais
(Randomized) Communication Complexity
20
Compute πΆ π₯, π¦
0100
11
001
β―
0011
BobAlice
πΌπππ’π‘: π₯ Input: π¦
1101000101110101110101010110β¦
πβππππ ππππππ π π‘ππππ
Goal: minimize the number of bits exchanged.
β’ Communication complexity of a protocol is the maximum number of bits exchanged by the protocol.
β’ Communication complexity of a function πΆ, denoted π (πΆ), is the communication complexity of the best protocol for computing C.
Example: Set Disjointness π·πΌππ½π
21
Theorem [Kalyanasundaram Schmitger 92, Razborov 92]
π DISJπ β₯ Ξ© π for all π β€π
2.
Compute π·πΌππ½π π, π
= αππππππ if π β© π = β ππππππ otherwise
BobAlice
πΌπππ’π‘: π β [π], π = π. Input: π β [π], π = π
1101000101110101110101010110β¦
A lower bound using CC method
Testing if a Boolean function is a k-parity
Linear Functions Over Finite Field π½2
23
A Boolean function π: 0,1 π β {0,1} is linear (also called parity) if
π π₯1, β¦ , π₯π = π1π₯1 +β―+ πππ₯π for some π1, β¦ , ππ β {0,1}
β’ Work in finite field π½2β Other accepted notation for π½2: πΊπΉ2 and β€2β Addition and multiplication is mod 2
β π= π₯1, β¦ , π₯π , π= π¦1, β¦ , π¦π , that is, π, π β 0,1 π
π + π= π₯1 + π¦1, β¦ , π₯π + π¦π
no free term
001001
011001
010000
+
example
Linear Functions Over Finite Field π½2
24
A Boolean function π: 0,1 π β {0,1} is linear (also called parity) if
π π₯1, β¦ , π₯π = π1π₯1 +β―+ πππ₯π for some π1, β¦ , ππ β {0,1}
β
π π₯1, β¦ , π₯π = βπβS π₯π for some π β π .
Notation: ππ π₯ = βπβπ π₯π.
[π] is a shorthand for {1, β¦π}
Testing if a Boolean function is Linear
25
Input: Boolean function π: 0,1 π β {0,1}
Question:
Is the function linear or π-far from linear
(β₯ π2π values need to be changed to make it linear)?
Later in the course:
Famous BLR (Blum Lubi Rubinfeld 90) test runs in π1
πtime
k-Parity Functions
26
π-Parity Functions
A function π βΆ 0,1 π β {0,1} is a π-parity if
π π₯ = ππ π₯ = βπβπ π₯πfor some set π β π of size π = π.
Testing if a Boolean Function is a k-Parity
27
Input: Boolean function π: 0,1 π β {0,1} and an integer π
Question: Is the function a π-parity or π-far from a π-parity
(β₯ π2π values need to be changed to make it a π-parity)?
Time:
O π log π [Chakraborty GarciaβSoriano Matsliah]
W min(π, π β π ) [Blais Brody Matulef 11]
β’ Today: Ξ©(π) for π β€ π/2
β’ Todayβs bound implies W min(π, π β π )
Important Fact About Linear Functions
β’ Consider functions ππ and ππ where π β π.
β Let π be an element on which π and π differ
(w.l.o.g. π β π β π)
β Pair up all π-bit strings: (π, π π )
where π π is π with the πth bit flipped.
β For each such pair, ππ(π) β ππ(ππ )
but ππ(π) = ππ(ππ )
So, ππ and ππ differ on exactly one of π, π π .
β Since all πβs are paired up,
ππ and ππ differ on half of the values.
28
π
π π
ππ(x) ππ(x)
011π0β β β
1 β π010
010π1β β β π001
Two different linear functions disagree on half of the values.Fact.
A πβ²βparity function, where πβ² β π, is Β½-far from any k-parity.Corollary.
Reduction from π·πΌππ½π/π to Testing k-Parity
β’ Let π be the best tester for the π-parity property for π = 1/2β query complexity of T is π testing πβparity .
β’ We will construct a communication protocol for π·πΌππ½π/π that runs
π and has communication complexity 2 β π(testing πβparity).
β’ Then 2 β π(testing πβparity) β₯ π DISJπ/2 β₯ Ξ© π/2 for π β€ π/2
β
π(testing π-parity) β₯ Ξ© π for π β€ π/2
29
holds for CC of every
protocol for π·πΌππ½π [Kalyanasundaram Schnitger 92]
Reduction from π·πΌππ½π/π to Testing k-Parity
30
BobAlice
πΌπππ’π‘: π β [π], π = π/2.
Compute: π = ππ
Input: π β [π], π = π/2Compute: π = ππ
1101000101110101110101010110β¦
Output Tβs answer
T
β = π + π (πππ 2)
ππππππ/ππππππ
β π₯ ? π π₯ + π π₯ πππ 2
π(π₯)π(π₯)
β’ π receives its random bits from the shared random string.
Analysis of the Reduction
Queries: Alice and Bob exchange 2 bits for every bit queried by π
Correctness:
β’ β = π + π πππ 2 = ππ + ππ πππ 2 = ππΞπ
β’ πΞπ = π + π β 2 π β© π
β’ SΞπ = απ if Sβ©T = β
β€ π β 2 if Sβ©T β β
β is απβparity if Sβ©T = β
πβ²βparity where πβ² β π if Sβ©T β β
Summary: π(testing π-parity) β₯ Ξ© π for π β€ π/2
31
1/2-far from every π-parity
Testing Lipschitz Property on Hypercube
Lower Bound
Lipschitz Property of Functions f: 0,1 πβR
33
β’ A function π βΆ 0,1 π β R is Lipschitz
if changing a bit of π₯ changes π(π₯) by at most 1.
β’ Is π Lipschitz or π-far from Lipschitz(π has to change on many points to become Lipschitz)?
β Edge π₯ β π¦ is violated by π if π π₯ β π(π¦) > 1.
Time:
β π(π/π), logarithmic in the size of the input, 2π
[Chakrabarty Seshadhri]
β Ξ©(π) [Jha Raskhodnikova]
0
0 1
12
1
2
1
2
2 0
00
0
2
2
Lipschitz
1
2-far from Lipschitz
Testing Lipschitz Property
34
Prove it.
Theorem
Testing Lipschitz property of functions f: 0,1 π β {0,1,2}requires Ξ©(π) queries.
Summary of Lower Bound Methods
β’ Yaoβs Principle
β testing membership in 1*, sortedness of a list and monotonicity of Boolean functions
β’ Reductions from communication complexity problems
β testing if a Boolean function is a π-parity
35
Other Models of SublinearComputation
37
Tolerant Property Tester
πΊπ-close to YES
πΊπ-far from
YES
YES
Reject with probability 2/3
Donβt care
Accept with probability β₯ π/π
Tolerant Property Tester [Rubinfeld Parnas Ron]
Randomized Algorithm
YES Accept with probability β₯ π/π
Reject with probability 2/3
NO
Sublinear-Time βRestorationβ Models
Local Decoding
Program Checking
Local Reconstruction
38
Input: Function π nearly satisfying some property πRequirement: Reconstruct function π to ensure that the reconstructed function π satisfies π, changing π only when necessary. For each input π₯, compute π(π₯) with a few queries to π.
π
πInput: A program π computing π correctly on most inputs.Requirement: Self-correct program π: for a given input π₯, compute π(π₯) by making a few calls to P.
Input: A slightly corrupted codewordRequirement: Recover individual bits of the closest codeword with a constant number of queries per recovered bit.
π