\documentclass[11pt]{article}

\usepackage{latexsym}
\usepackage{amsmath}
\usepackage{amssymb}
\usepackage{amsthm}

\newcommand{\handout}[5]{
   \noindent
   \begin{center}
   \framebox{
      \vbox{
    \hbox to 5.78in { {\bf Complexity Theory II } \hfill Course Instructor: #2 }
       \vspace{4mm}
       \hbox to 5.78in { {\Large \hfill #5  \hfill} }
       \vspace{2mm}
       \hbox to 5.78in { {\em #3 \hfill #4} }
      }
   }
   \end{center}
   \vspace*{4mm}
}

\newcommand{\lecture}[4]{\handout{#1}{#2}{Lecturer: #3}{Scribe:
    #4}{Lecture #1}}

\newtheorem{theorem}{Theorem}
\newtheorem{corollary}[theorem]{Corollary}
\newtheorem{lemma}[theorem]{Lemma}
\newtheorem{observation}[theorem]{Observation}
\newtheorem{proposition}[theorem]{Proposition}
\newtheorem{definition}[theorem]{Definition}
\newtheorem{claim}[theorem]{Claim}
\newtheorem{fact}[theorem]{Fact}

\begin{document}

\lecture{1 :  Aug 2, 2006 }{V. Arvind}{V. Arvind}{Kazim Bhojani}

\section{Outline of the course}

In this course we will discuss following topics 

\begin{itemize}
\item Hardness vs. Randomness
\begin{itemize}
\item Pseudorandom generators
\item Error correcting codes
\end{itemize}
\item Extractors 
\item Expander graphs
\begin{itemize}
\item Reingold's Logspace algorithm for undirected connectivity
\item New proof of PCP theorem
\end{itemize}
\end{itemize}

Topics  discussed in the first part are taken  from a survey by Nisan and Wigderson, {\em Hardness vs. Randomness.}


\section{Notion of Pseudorandomness and constructing PRG's}

In this lecture we shall discuss two notions of randomness as formulated by Blum-Micali and Yao during 80's ,show that the two definitions are equivalent and then go on to construct a PRG using one way functions.

\subsection{Two notions of Pseudorandomness}

If a {\em resource bounded } observer cannot distinguish between Ideal random source and another deterministic source A , then A can be used in place of ideal source and it is as good as an ideal source from the observer's point of view.

Such an A will be called a {\em Pseudorandom Generator}.

Blum and Micali for the first time in 1980 formalized the notion of randomness and gave the following definition of Pseudorandomness.

\begin{definition}Blum-Micali definition(Next bit prediction test)

Let $G = \{ G_n : \{0,1\}^{l(n)} \rightarrow \{0,1\}^n\}$ be such  that $l(n) < < n$  , that is , G takes a seed of length $l(n)$ and generates a string of length $n$ .

$G$ is called a {\em Pseudorandom Generator} for a class $C$(of algorithms) , if for every polynomial $p(n)$ and each $i$ and for all the algorithms $ A \in C$ the following holds

$$\left|Prob_{x \in \{0,1,\}^{l(n)}} [A(y_1y_2\ldots y_{i-1}) = y_i] - \frac{1}{2}\right| < \frac{1}{p(n)}$$

where $x \in \{0,1\}^{l(n)}$ and $G_n(x) = y_1y_2\ldots y_n$. 

\end{definition}

Yao in 1982 formulated a different definition of Pseudorandomness and showed that the two definitions are equivalent

\begin{definition}Yao's Definition(Distinguisher test)

A function $G : l(n) \rightarrow n $ is a PRG \footnote{Henceforth we will use the abbreviation PRG for Pseudorandom generator(s)} for a class $C$ of algorithms if for every polynomial $p(n)$ and each $i$ and for all the algorithms $ A \in C$ the following holds 

$$\left|Prob_{y \in \{0,1,\}^n} [A(y) = 1] - Prob_{x \in \{0,1,\}^{l(n)}}[A(G(x)) = 1] \right| < \frac{1}{p(n)}$$

\end{definition}

\begin{theorem}[Yao]

The two definitions of Pseudorandomness given above are equivalent

\end{theorem}

\subsection{Constructing PRG's}

First we begin with the definition of {\em One way functions.}

\begin{definition}One way functions

A function $ f = \{ f_n : \{0,1\}^n \rightarrow \{0,1\}^m \} $ is a {\em 1-way function} if for every polynomial $p(n)$ and every circuit $C$ of size $p(n)$ the following holds

$$Prob_{x \in \{0,1\}^n} [ C(f(x)) \notin f^{-1}(x) ] \geq \frac{1}{p(n)}$$

and $f$ should be computable in polynomial time.

\end{definition}

The following are two examples of functions are that are believed to be 1-way and no {\em fast} algorithms are known for inverting these functions

\begin{itemize}

\item Function $f$ that computes product of two $n$ bit primes

\item $$ f : (\mathbb{Z}_{p-1} , + ) \rightarrow (\mathbb{Z}_p^* , * )$$
      $$ x \mapsto a^x$$

\end{itemize}

Now we state a theorem due to Yao which relate 1-way functions with PRGs.

\begin{theorem}(Yao's theorem).

If there is a 1-way function $f$ then for every $\epsilon > 0$ there is a PRG $$ G : n^{\epsilon} \rightarrow n$$ such that $G$ runs in polynomial time and is secure against all polynomial size circuits.

\end{theorem}

But how do we get hold of $G$ , given a 1-way function ? 

Here is a rough procedure how we can use 1-way function to get hold of a PRG

\begin{itemize}

\item $f$ is a 1-way function.

\item Get hold of $g$ which is 1-way with amplified hardness

\item Then compute $ x , g(x) , g(g(x)) , \ldots , g^{(n)}(x)$.

\item Extract one bit from each of the above strings and\ this $x_0x_1\ldots x_n$ is the output of the PRG

\end{itemize}

One immediate corollary of the Yao's theorem is the following result

\begin{corollary}

If 1-way functions exist then $BPP \subseteq DTIME(2^{n^{\epsilon}})$ for some $\epsilon > 0 $.

\end{corollary}

Also the converse of Yao's of theorem is also true.

\begin{theorem}(Converse of Yao's Theorem).

If there is a PRG $$ G : n^{\epsilon} \rightarrow n$$ then 1-way functions exist.

\end{theorem}

\subsection{Nisan-Wigderson design}

First we begin with definition of quick PRG.

\begin{definition}(quick PRG).

$ G : l(n) \rightarrow n $ is called a quick PRG if it is computable in time $2^{O(l(n))}$(deterministic) and for every circuit $C$ of size $n^2$ the following holds

$$\left|Prob_{y \in \{0,1,\}^n} [C(y) = 1] - Prob_{x \in \{0,1,\}^{l(n)}}[C(G(x)) = 1] \right| < \frac{1}{n}$$

\end{definition}

\begin{lemma}

If a quick PRG $ G : l(n) \rightarrow n $ exists then for every time constructible function $t(n)$ 
$$ BPTIME(t(n)) \subseteq DTIME(2^{O(l(t(n)))} $$

\begin{proof}

Let $ L \in BPTIME(t(n)) $ and M be a machine which accepts language $L$ and $x$ be an input instance.

Let $ |x| = t(n) $ , we can assume that the $r$ random bits used in the computation are given with input.

Look at the tableau of computation it has $t(n)$ configurations.

Now  $ G_{t(n)} : O(l(t(n))) \rightarrow O(t(n)) $ , so we can cycle over all string $s$ of length $l(t(n))$ and use $G(s)$ as a random string in computation so the whole simulation can be done in $DTIME(2^{O(l(t(n)))}$

Hence proved.

\end{proof}

\end{lemma}

Now we define the notion of hardness of a boolean function.

\begin{definition}
A boolean function $ f: \{0,1\}^n \rightarrow \{0,1\} $ is called $(\epsilon , S )$-hard , if for all circuits of size S the following holds,

$$\left| Prob_{x \in \{0,1,\}^{l(n)}} [C(x) = f(x) ] - \frac{1}{2} \right|  < \epsilon$$

\end{definition}

Also a function $f$ is said to have hardness $H(f)=m$ , where is $m$ is the largest number such that $f$ is $(m,\frac{1}{m})$-hard.

We can now use hard functions to build PRGs using the Nisan-Wigderson design

\subsubsection{The (n,l,m,k) design}

\begin{itemize}
\item Let $S_1,S_2,\ldots,S_n \subseteq \{1,2,\ldots,l\} $ such that $|S_i| = m $ 

\item $ i \neq j \implies |S_i \cup S_j| \leq k$.

\item Let $ f: \{0,1\}^m \rightarrow \{0,1\}$ be the given hard function.

\item Let $x = x_1x_2\ldots x_l$ be the seed where $l$ is the seed length.

\item Now project $x$ onto each coordinate of $S_i$ to get a string of length $m$ and apply $f$ to that string to obtain bit $y_i$ , that is $y_i = f(x|S_i)$ for $ i = 1,2,\ldots,n$.

\item $y=y_1y_2\ldots y_n$ is the output of the  Pseudorandom generator.

\end{itemize}

So we have a function $ G_f: l \rightarrow n $.

\begin{theorem}

If $ f: \{0,1\}^m \rightarrow \{0,1\}$ is a boolean function with hardness $n^2$ and $G_f$ is built from a $(n,l,m,\log n)$ design , then $G_f$ is a quick PRG.


\begin{proof}

Suppose $C$ is a circuit of size $n^2$ that distinguishes $G_f$'s output from random source , that is ,

$$ Prob_{y \in \{0,1,\}^n} [C(y) = 1] - Prob_{x \in \{0,1,\}^{l(n)}}[C(G_f(x)) = 1]  > \frac{1}{n}$$

Let $E_1$ be the uniform distribution and $E_n$ be the distribution of $G(x)$ , now we advance a hybrid argument to obtain a contradiction.

Define the intermediate distributions $E_2,\ldots,E_{(n-1)}$ as follows , 

\begin{itemize}
\item
$E_0$ has distribution $r_1,r_2,\ldots,r_n$ where $r_i$'s are true random bits.

$\vdots$

\item $E_i$ has distribution $u_1,\ldots,u_i,r_{i+1},\ldots,r_n$ , where $u_1,\ldots,u_i$ are first $i$ bits of output of pseudorandom generator $G$.

$\vdots$

\item 
$E_n$ has distribution $u_1,u_2,\ldots,u_n$ where $u_i$'s are output of $G$.

\end{itemize}

So we have , 

$$ Prob_{y \in E_0} [C(y) = 1] - Prob_{y \in E_n}[C(y) = 1]  > \frac{1}{n}$$

$$\implies \sum_{i=0}^{n-1}\left[ Prob_{y \in E_i} [C(y) = 1] - Prob_{y \in E_{i+1}}[C(y) = 1]\right]  > \frac{1}{n}$$

$$\implies \exists\ i : Prob_{y \in E_i} [C(y) = 1] - Prob_{y \in E_{i+1}}[C(y) = 1]  > \frac{1}{n^2} $$


So now we have a randomized algorithm $D(y_1,y_2,\ldots,y_n)$ where input is first $i$ bits of $G$'s output and outputs $y_{i+1}$ with probability $\geq \frac{1}{2} + \frac{1}{n^2}$.

\begin{itemize}
\item Pick $r_{i+1},\ldots,r_n$ ideal random bits.
\item Let $C(y_1,\ldots,y_i,r_{i+1},\ldots,r_n) = b$
\item if $b = 1$ then predict $y_{i+1}=r_{i+1}$ else $y_{i+1}=\overline{r_{i+1}}$
\end{itemize}


{\bf Claim}

$$Prob_{x,r_{i+1},\ldots,r_n}[D(y_1,\ldots,y_i)=y_{i+1}] \geq \frac{1}{2} + \frac{1}{n^2}$$

This shows that functions obtained using Nisan-Wigderson design are Pseudorandom generators if the function used is a hard function , assuming the claim.

\end{proof}

Now we prove the claim stated above.

\begin{proof}[Proof of Claim]

\begin{eqnarray*}
\text{Required probability}&=&Prob[D(y_1,\ldots,y_i)=y_{i+1}|r_{i+1}=y_{i+1}].\frac{1}{2}\\
&+&Prob[D(y_1,\ldots,y_i)=y_{i+1}|r_{i+1}=\overline{y_{i+1}}].\frac{1}{2}\\
&=&Prob[D(y_1,\ldots,y_i)=y_{i+1}|r_{i+1}=y_{i+1}].\frac{1}{2}+\frac{1}{2}\alpha\\
&&\\
Prob[D(y_1,\ldots,y_i)=0]&=&1-p_i\\
&=&Prob[D(y_1,\ldots,y_i,y_{i+1},\ldots,r_n)=y_{i+1}|r_{i+1}=y_{i+1}].\frac{1}{2}\\
&+&Prob[D(y_1,\ldots,y_i,\overline{y_{i+1}},\ldots,r_n)=y_{i+1}|r_{i+1}=\overline{y_{i+1}}].\frac{1}{2}\\
&&\\
1-p_i & = & \frac{1}{2}p_{i+1}+\frac{\alpha}{2}\\
\frac{\alpha}{2}& = & 1-p_i-\frac{1}{2}(1-p_{i+1})\\
\text{Required probability}&=&1-p_i+\frac{1}{2}p_{i+1}-\frac{1}{2}(1-p_{i+1})\\
&=&\frac{1}{2}+(p_{i+1}-p_i)\\
&\geq&\frac{1}{2} + \frac{1}{n^2}
\end{eqnarray*}

This also proves that a distinguisher circuit can also be used to construct a next bit predictor which proves one direction of theorem $1$  due to Yao stated in the beginning.

\end{proof}

\end{theorem}
 
\end{document}


