On worst-case to average-case reductions for NP

Danny Gutfreund (Harvard) Ronen Shaltiel (Haifa U.) and

Amnon Ta-Shma (Tel-Aviv U.)

Negative results

Thm: [BT,FF]

If PH does not collapse, then there is no non-adaptive

reduction

from solving SAT to solving (L,U) for some L in NP.

Reduction = Turing reduction

A computational task A reduces to computational task B, if

There exists an efficient oracle machine R,

such that for any O, if O solves B then RO solves A.

The [BT] results generalizes

Thm: If PH does not collapse* then there is no non-adaptive reduction

from solving SAT to solving (SAT,D).

Where D is any distribution samplable in quasi-polynomial time.

Search to decision reduction

RB is the search-algorithm for SAT, using B as a decision algorithm for

SAT.

Note: Can be a non-adaptive reduction.

GST

Thm: [GST] There exists some distribution D

samplable in quasi-polynomial time, such that

If BSAT is a probabilistic, polynomial time algorithm solving (SAT,D) well on the average,

Then, RBSAT solves SAT.

In other words

There is a reduction from solving SAT to solving

(SAT,D), where D is some distribution

samplable in quasi-polynomial time.

Reductions again

When we say “reduction” we mean several things:

We mean that R has black-box access to O (that solves B).

We mean that RO is correct whenever O is.

More on reductions The first condition tells us that the

reduction does not need to know about the actual way B operates.

The second condition tells us that the correctness proof does not need to know about the way B operates.

These are two separate issues!!!

Class Reduction

A computational task A C-reduces to computational task B, if

there exists an efficient oracle machine R,

such that for any O in C, if O solves B then RO solves A.

We saw

If PH does not collapse*

- One can not achieve the GST reduction with a non-adaptive reduction, but

- One can achieve the GST reduction with a non-adaptive, BPP-class reduction.

So

Now, that we have no negative results to stop us,

Can we make progress on the worst-case to avg-case problem for NP?

The cryptographic goal

Prove a polynomial-time reduction from SAT to (L,D), for some

L in NP, and polynomially samplable D.

IL If (L,D) is average-case hard for

some L in NP and samplable D, then

(L,U) is average-case hard for some L in NP.

A more modest goal

Prove a polynomial-time class reduction from SAT to (L,U), for L in NTime(t(n)).

t(n) =nc – cryptographic setting t(n) =super-poly(n) – complexity

setting

NOT KNOWN for any sub-exponential t(n)

Have vs. Want: Have: A polynomial-time class

reduction from SAT to (SAT,D), for D samplable in super-polynomial time.

Want: A polynomial-time class reduction from SAT to (L,U), for L in .

PN~

Idea: use [IL]

(SAT,D )not in AvgBPP, D is super-poly

(L,U )not in AvgBPP, L is super-poly

SAT not in BPP

ProblemThe reduction time depends on the

complexity of D.

Not useful.

We get an algorithm for (L,D) taking more resources than D, which [GST] does not contradict.

The main theorem Under a weak derandomizaion

assumption:

Thm: There exists L in s.t.,

BPPAvgULBPPNP o )1(2/1),(

PN~

The Assumption in detail

For every c, for every probabilistic polynomial-time

A using nc coins, There exists a probabilistic polynomial

time algorithm A’, using only n coins, s.t.

For any samplable distribution DPr {x in D} [ |A(x) – A’(x)| ≥ 1/10 ] ≤ 1/10

L

The proof In spite of all, let use IL.

Observation: the complexity of the reduction can be made to depend on the number of coins of D, and not on the running time of D.

The new language depends on the running time of D.

The main idea While we do not know how to save

on time, we believe we can save on random coins.

Use the derandomization assumption to reduce the number of coins of D.

The reality It works but takes effort. We need to derandomize

procedures that output non-boolean values, which we usually can not derandomize.

This forces us to go back to [GST] and modify the proof to get the derandomized version.

Summary Negative results showed there are no

non-adaptive worst-case to average-case reduction.

We show class reductions exist, where regular reductions are ruled out.

Can we now solve the complexity version of the worst-case to average-case reduction for NP?