On worst-case to average-case reductions for NP

1. On worst-case to average-case reductions for NP Danny Gutfreund (Harvard) Ronen Shaltiel (Haifa U.) and Amnon Ta-Shma (Tel-Aviv U.)

2. Negative results Thm: [BT,FF] If PH does not collapse, then there is no non-adaptive reduction from solving SAT to solving (L,U) for some L in NP.

3. Reduction = Turing reduction A computational task A reduces to computational task B, if There exists an efficient oracle machine R, such that for anyO, if O solves B then RO solves A.

4. The [BT] results generalizes Thm: If PH does not collapse* then there is no non-adaptive reduction from solving SAT to solving (SAT,D). Where D is any distribution samplable in quasi-polynomial time.

5. Search to decision reduction RB is the search-algorithm for SAT, using B as a decision algorithm for SAT. Note: Can be a non-adaptive reduction.

6. GST Thm: [GST] There exists some distribution D samplable in quasi-polynomial time, such that If BSAT is a probabilistic, polynomial time algorithm solving (SAT,D) well on the average, Then, RBSAT solves SAT.

7. In other words There is a reduction from solving SAT to solving (SAT,D), where D is some distribution samplable in quasi-polynomial time.

8. Reductions again When we say “reduction” we mean several things: • We mean that R has black-box access to O (that solves B). • We mean that RO is correct whenever O is.

9. More on reductions • The first condition tells us that the reduction does not need to know about the actual way B operates. • The second condition tells us that the correctness proof does not need to know about the way B operates. These are two separate issues!!!

10. Class Reduction A computational task AC-reduces to computational task B, if • there exists an efficient oracle machine R, • such that for anyO in C, if O solves B then RO solves A.

11. We saw If PH does not collapse* • One can not achieve the GST reduction with a non-adaptive reduction, but • One can achieve the GST reduction with a non-adaptive, BPP-class reduction.

12. So Now, that we have no negative results to stop us, Can we make progress on the worst-case to avg-case problem for NP?

13. The cryptographic goal Prove a polynomial-time reduction from SAT to (L,D), for some • L in NP, and • polynomially samplable D.

14. IL • If (L,D) is average-case hard for some L in NP and samplable D, then • (L,U) is average-case hard for some L in NP.

15. A more modest goal Prove a polynomial-time class reduction from SAT to (L,U), for L in NTime(t(n)). • t(n) =nc– cryptographic setting • t(n) =super-poly(n) – complexity setting NOT KNOWN for any sub-exponential t(n)

16. Have vs. Want: • Have: A polynomial-time class reduction from SAT to (SAT,D), for D samplable in super-polynomial time. • Want: A polynomial-time class reduction from SAT to (L,U), for L in .

17. Idea: use [IL] SAT not in BPP (SAT,D) not in AvgBPP, D is super-poly (L,U) not in AvgBPP, L is super-poly

18. Problem The reduction time depends on the complexity of D. Not useful. We get an algorithm for (L,D) taking more resources than D, which [GST] does not contradict.

19. The main theorem • Under a weak derandomizaion assumption: • Thm: There exists L in s.t.,

20. The Assumption in detail For every c, for every probabilistic polynomial-time A using nc coins, There exists a probabilistic polynomial time algorithm A’, using only n coins, s.t. For any samplable distribution D Pr {x in D} [ |A(x) – A’(x)| ≥ 1/10 ] ≤ 1/10

21. The proof • In spite of all, let use IL. • Observation: the complexity of the reduction can be made to depend on the number of coins of D, and not on the running time of D. • The new language depends on the running time of D.

22. The main idea • While we do not know how to save on time, we believe we can save on random coins. • Use the derandomization assumption to reduce the number of coins of D.

23. The reality • It works but takes effort. • We need to derandomize procedures that output non-boolean values, which we usually can not derandomize. • This forces us to go back to [GST] and modify the proof to get the derandomized version.

24. Summary • Negative results showed there are no non-adaptive worst-case to average-case reduction. • We show class reductions exist, where regular reductions are ruled out. • Can we now solve the complexity version of the worst-case to average-case reduction for NP?