Randomness and Non-determinism

Exponentiation makes the difference between the bit-size of this line and the number (≪ 2) of particles in the known Universe. The expulsion of exponential time algorithms from Computer Theory in the 60’s broke its umbilical cord from Mathematical Logic. It created a deep gap between deterministic computation and – formerly its unremarkable tools – randomness and non-determinism. Little did we learn in the past decades about the power of either of these two basic “freedoms” of computation, but some vague pattern is emerging in relationships between them. The pattern of similar techniques instrumental for quite different results in this area seems even more interesting. Ideas like multilinear and low-degree multivariate polynomials, Fourier transformation over low-periodic groups seem very illuminating. The talk surveyed some recent results. One of them, given in a stronger form than previously published, is described below. |x| will denote the length of string x. Let P be the set of fast, i.e. computable in time Tf(x) = |x| , algorithms f(x) on binary strings. [Blum Micali 82, Yao 82] proposed a fast deterministic way to generate “nearly perfect” randomness, using the idea of a hard core or hidden bit. They assume certain length preserving functions f ∈P to be one-way (OWF), i.e. infeasible to invert (a non-deterministically easy task). Suppose it is hard to compute from f(x) not only x but even its one bit b(x) ∈ {±1}, b ∈P. Moreover, assume that even guessing b(x) with any noticeable correlation is infeasible. If f is bijective, f(x) and b(x) are both random and appear to be independent to any feasible test, thus increasing the initial amount |x| of randomness by one bit. Then, a short random seed x can be transformed into an arbitrary long string α(1), α(2), . . .: α(i) = b(f (x)). Such α passes any feasible randomness test. [Goldreich Levin 89] showed that every OWF f has such a hidden bit with security of f and b polynomially related. It also gives more details on the definitions below. Here this result is strengthened to yield the same security for f and b. Let P be the set of probabilistic algorithms A(x, ω) using coin-flips ω ∈ {0, 1} N and running in average over ω time EωTA(x,ω) = |x| . An inverter I ∈ P for f attempts to compute from f(x) a list of strings containing x. Its success rate sI,f (n) is the probability of {x ∈ {0, 1} , ω : x ∈ I(f(x), ω)}. A guesser for b : S → {±1} on f ∈P is a P -algorithm G(y, ω) ∈ {0,±1}. Its success rate is sG,b,f(n) = (Ex,ωG(f(x), ω)b(x)) /Ex,ωG(x, ω) , i.e. the inverse sample size needed to notice the correlation with b. The security of OWF f or of its hidden bit b is a lower bound of 1/s(n) for all I (or G) and big enough n. Let us pad a OWF f to f (x, r) = (y, r), y = f(x); x, y, r ∈ Z 2 . Let b(x, r) = (−1) ; vi = 0 10. We fix y, ω, denote Gr = G(y, r, ω) and c(x) = Erb(x, r)Gr/ √