Direct Product :

Decoding & Testing, with Applications

Russell Impagliazzo (IAS & UCSD)Ragesh Jaiswal (Columbia)Valentine Kabanets (SFU)

Avi Wigderson (IAS)

Direct-Product (DP) Function

For f: U R, its k-wise DP function is fk : Uk Rk where:

fk ( x1, …, xk ) = ( f(x1), …, f(xk) )

Applications of Direct Product

Cryptography

Derandomization

Error-Correcting Codes

Hardness Amplification

f gHard function Harder function

Hardness on average

(Nonuniform) Hardness on Average

f s

A function f is called δ-hard for size s, if any circuit of size s fails to compute f on at least δ fraction of the inputs.

2n

{0,1}n

{0,1}n {0,1}n

Amplification using Repetition

Intuition: If, given a random x, it is hard to compute f(x),then given k independent random x1,…, xk, it is MUCH HARDER to compute f(x1),…, f(xk).

1. Sequential repetition: Given an algorithm A, ask for ( A(x1), …, A(xk) ) = ( f(x1),…, f(xk) )

2. Parallel repetition: Given an algorithm A, ask for A(x1,…, xk) = ( f(x1),…, f(xk) )Is problem easier if given all k instances at once ???

Direct Product Theorem [Yao’82, Levin’87, GNW’95, Imp’95, IW’97,…]

Suppose: f is at least -hard

for size s.

Then: fk is at least (1 - )-hard for size s’ = s*poly(,),

where ≈ (1-)k ≈ e- k

2n

{0,1}n

2n

{0,1}nk

DP Theorem: Constructive Proof

[Yao’82, Levin’87, GNW’95, Imp’95, IW’97,…]

Given: a circuit C (of size s’ =

s*poly(,)) that -computes fk for > (1-)k ≈ e- k

Construct: a circuit C’ (of size s)

that (1-)-computes f.

2n

{0,1}nk

2n

{0,1}n

Need for “List Decoding”

Given: a circuit C, there may be at least L = 1/ different functions f1, …, fL such that C -computes fi

k for each i = 1, …, L.

(Partition the inputs into 1/ blocks of size , and define C’ to agree with fi

k on block i. )

Need to allow constructing a list of circuits !

(Generic) DP Decoding

r1 X rk

C’

X

b1 b bk

if “enough” bi = f(ri),

then output b

b

Repeat O(1/2) times, and take Majority

Need (1/2) correct values f(ri).[IW97,…]: Use non-uniform advice !

[IJK06]: Use C’ to generate “advice” !

[IJKW08]: Check C’ for consistency(on intersecting k-sets).Trust consistent answers !

Our Algorithm [IJKW08]

Preprocessing: Randomly pick a k-set S1 =(B1,A)

(with |A| = k/2 ).

B1 B2

AS1 S2

Algo: On input x, pick a random S2 = (B2, A), with x2 B2. If C( S1 )A = C( S2 )A , then output C( S2 )x, else re-sample S2 (repeat for < poly (1/²) iterations ).

x

Thm: With prob (²) over (B1, A), Algo (1-) computes f.

Proof Ideas

Flowers, cores, petalsFlower: determined by S=(A,B)

Core: A

Core values: α=C(A,B)A

Consistent petals: { (A,B’) | C(A,B’)A = α }

[IJKW08]: Flower analysis

B

B4

AA B2

B3

B1

B5

Structure (Decoding)

There are many(²/2) large (²/2) flowers such that:

For almost all consistent petals of the flower, C ¼ fk

B

B4

AA B2

B3

B1

B5

Assume: C ²-agrees with fk

Decode: g(x) = PLURALITY { C( S )x }

petals S : x2 S

Soundness Amplification

f gMildly soundproof

More sound proof

Proof = Oracle (think PCP)

Graph CSPGraph: G = (V, E)Alphabet: Σ (constant size)

Edge constraints: Áe : Σ2 {0, 1} (for all e2 E )Question: f: V Σ satisfying all Áe ?PCP Theorem [AS, ALMSS] For a constant 0< δ <1, it is

NP-hard to distinguish between satisfiable graph CSPs and δ-unsatisfiable ones (where every f: V Σ violates > δ fraction of edge constraints).

Graph CSPGraph: G = (V, E)Alphabet: Σ (constant size)

Edge constraints: Áe : Σ2 {0, 1} (for all e2 E )Question: f: V Σ satisfying all Áe ?PCP Theorem [AS, ALMSS] For a constant 0< δ <1, it is

NP-hard to distinguish between satisfiable graph CSPs and δ-unsatisfiable ones.

PCP Proof: f: V Σ Verifier: Accept if f satisfies a random edge

Q1Q2

# queries: 2soundness: 1 - δ(perfect completeness)

Decreasing soundness by repetition

sequential repetition : proof f: V Σ soundness : 1- δ (1- δ)k X # queries: 2k

parallel repetition : proof F: Vk Σk

# queries : 2X soundness: ?

Q1

Q2

Q3

Q4

Qk-1

Qk

Q1

Q2

Decreasing soundness by repetition

sequential repetition : proof f: V Σ soundness : 1- δ (1- δ)k X # queries: 2k

parallel repetition : proof F: Vk Σk

# queries : 2X soundness: ?

Q1

Q2

Q3

Q4

Qk-1

Qk

Q1

Q2

Wish: F = fk for some f: V Σ. Then soundness is (1-δ)k !!!

How ?

1. DP-test: Make ( 2 ? ) queries to F, to verify that F = fk, for some f : V Σ.

2. Make 2 “parallel-repetition” queries to F & verify that all k constraints are satisfied

proof F: Vk Σk

How ?

1. DP-test: Make ( 2 ? ) queries to F, to verify that F = fk, for some f : V Σ.

Wish: If DP-Test accepts F with prob ²,then F = fk .

False! The best can hope: F = fk on ¼² of inputs.

Is it enough ??? Not clear !

Also: want to have only 2 queries TOTAL (including “parallel repetition” queries) !

proof F: Vk Σk

Direct-Product Testing Given an oracle C : Uk Rk

Test makes some queries to C, and(1) Accepts if C = fk.(2) Rejects if C is “far away” from any fk

(2’) If Test accepts C with “high” probability, then C must be “close” to some fk.

- Want to minimize number of queries to C.- Want to handle small acceptance probability- Hope the DP Test will be useful for PCPs …

DP Testing History

Given an oracle C : Uk Rk, is C ¼ gk ? #queries acc.

prob.Goldreich-Safra 00 20 .99Dinur-Reingold 06 2 .99Dinur-Goldenberg 08 2 1/kα

Dinur-Goldenberg 08 2 1/kNew 3 exp(-kα)New* 2 1/kα

* Derandomization

/

*

Consistency tests

V-Test [GS00,FK00,DR06,DG08]

Randomly pick two k-sets S1 =(B1,A) and S2

=(A,B2)

(with |A| = k1/2 ).

B1 B2

AS1 S2

Accept if C( S1 )A = C( S2 )A

V-Test Analysis

Theorem [DG08]:If V-Test accepts with probability ² > 1/k, then there is g : U R s.t. C ¼ gk on at least ² fraction of k-sets.

When ² < 1/k, the V-Test does not work.

Z-TestRandomly pick k-sets S1 =(B1,A1), S2=(A1,B2),

S3=(B2,A2)

( |A1| = |A2| = m = k1/2). B1

B2

A1

A2

S1

S2

S3

Accept if C( S1 )A1= C( S2 )A1

and C( S2 )B2 =

C( S3 )B2

Z-Test Analysis

Theorem (main result):If Z-Test accepts with prob ² > exp(-k),then there is g : U R s.t. C ¼ gk on at least ² fraction of k-sets.

Also: - analyze the V-Test, re-proving [DG08] (simpler proof); - analyze “derandomized” V-Test and Z-Test

Proof Ideas

Flowers, cores, petalsFlower: determined by S=(A,B)

Core: A

Core values: α=C(A,B)A

Consistent petals: Cons = { (A,B’) | C(A,B’)A = α }

[IJKW08]: Flower analysis

B

B4

AA B2

B3

B1

B5

V-Test ) Structure (Testing)

There are many(²/2) large (²/2) flowers such that:

On the petals of the flower, V-test accepts almost certainly ( 1-poly(²) ).

[ harmony ]

B

B4

AA B2

B3

B1

B5

E

C(A, B1 )E ¼ C(A, B2 )E, with |E| = |

A| Assume: V-Test accepts with prob ²

V-Test: HarmonyFor random B1 = (E,D1) and B2 = (E,D2) (|E|=|

A|)Pr [B1 2 Cons & B2 2 Cons & C(A, B1)E C(A, B2)E ] < ²4

<< ²

B

D2

D1

AE

Proof: Symmetry between A and E (few errors in AuE )Chernoff: ² ¼ exp(-kα) E

A

Intuition: Restricted to Cons, an approxV-Test on E accepts almost surely: Unique Decode!

V-Test ) Structure (Testing)

There are many (²/2) large (²/2) flowers such that:

On the petals of the flower, V-test accepts almost certainly ( 1-poly(²) ).

B

B4

AA B2

B3

B1

B5

Assume: V-Test accepts with prob ²

Main Lemma: For g(x) = PLURALITY { C( S )x }

C(S) ¼ gk (S) for almost all (1-²) petals S.

petals S : x2 S

Decoding vs. Testing

Decoding Testing

There are many large flowers such that:

Almost all pairs of intersecting petals are consistent

Assume: V-Test accepts with prob ²

Conclude: C(S) ¼ gk (S) for almost all petals S of the flower.

There are many large flowers such that:

For almost all petals S of the flower, C ¼ fk

Assume: C ²-agrees with fk

Define: g(x) = PLURALITY { C( S )x }petals S : x2 S

Conclude: g(x) = f(x) for almost inputs x.

Back to DP Testing

Local DP structureField of flowers (Ai,Bi)

Each with its ownLocal DP function gi

Global g?

B2

AA Bi

AA

B

AA

B3

AAB1

AA

Is there global DP function g ?

Yes, if ² > 1/ka [DG08] [we re-prove it] ( can “glue together” many flowers )

No, if ² < 1/k [DG08] But, using Z-Test, we get ² = exp( - ka) !

Counterexample [DG]

For every x 2 U pick a random gx: U R

For every k-subset S pick a random x(S) 2 S

Define C(S) = gx(S)(S)

C(S1)A=C(S2)A “iff” x(S1)=x(S2)

V-test passes with high prob:

² = Pr[C(S1)A=C(S2)A] ~ m/k2

No global g if ² < 1/k2

B1 B2

AS1 S2

Back to PCPs

2-PCP Amplification History

f: V Σ, F : Vk Σk |V|=N, t = log |Σ|

soundness

Raz 98 exp( - δ3 k/t) Holenstein 07 ( t essential

[FV])

Rao 08 exp( - δ2 k ) ( δ2 essential

[Raz])

Feige-Kilian 00 1/kα

NEW exp ( - δ k1/2)

Parallelrepetition

Projection games

Mix N’Match

Our PCP Construction

A New 2-Query PCP (similar to [FK])

For a regular CSP graph G = (V, E), the PCP proof: CE : Ek (Σ2)k

Accept if (1) CE (Q1) and CE (Q2) agree on common vertices, and (2) all edge constraints are satisfied

Q1

Q2

The 2-query PCP Theorem

Theorem:If CSP is δ – unsatisfiable, then no CE is accepted

with probability > exp ( - δ k1/2). ( perfect completeness preserved )

Corollary: A 2-query PCP over Σk, of size nk, perfect completeness, and soundness exp(- k1/2).

Q1

Q2

PCP Analysis

Edge proof CE <-> Vertex proof C

1. V-test analysis: - get Local DP g for the flower Q1

- Q2 is in the same flower

- CE (Q2) = gk (Q2)

2. g violates > δ edges (original soundness) .3. Q2 has δ violated edges (Chernoff) w.r.t. gk

4. CE violates some edges of Q2, so Test rejects.

Q1

Q2

Derandomization

Derandomized DP Test

Derandomized DP: fk (S), for linear subspaces S (as in [IJKW08] ) .

Theorem (Derandomized V-Test): If derandomized V-Test accepts C with probability ² > poly(1/k), then there is a function g : U R such that C (S) ¼ gk (S) on poly(²) of subspaces S.

Corollary: Polynomial rate testable code.

Summary Direct Product Testing: 3 queries &

exponentially small acceptance probability

Derandomized DP Testing: 2 queries & polynomially small acceptance probability

( derandomized V-Test of [DG08] )

PCP: 2-Prover parallel k-repetition for restricted games, with exponential in k1/2 decrease in soundness

Open Questions

Better dependence on k in our Parallel Repetition Theorem : exp ( -δk ) ?

Derandomized 2-Query PCP : Obtaining / improving

[Moshkovitz-Raz’08, Dinur-Harsha’09] using similar techniques.