cs151 complexity theory lecture 7 april 20, 2015
Post on 20-Dec-2015
220 views
TRANSCRIPT
![Page 1: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/1.jpg)
CS151Complexity Theory
Lecture 7
April 20, 2015
![Page 2: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/2.jpg)
April 20, 2015 2
Randomness
• 3 examples of the power of randomness – communication complexity– polynomial identity testing– complexity of finding unique solutions
• randomized complexity classes
![Page 3: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/3.jpg)
April 20, 2015 3
2. Polynomial identity testing
• Given: polynomial p(x1, x2, …, xn) as arithmetic formula (fan-out 1):
-
*
x1 x2
*
+ -
x3 … xn
*• multiplication (fan-in 2)
• addition (fan-in 2)
• negation (fan-in 1)
![Page 4: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/4.jpg)
April 20, 2015 4
Polynomial identity testing
• Question: Is p identically zero?– i.e., is p(x) = 0 for all x Fn – (assume |F| larger than degree…)
• “polynomial identity testing” because given two polynomials p, q, we can check the identity p q by checking if (p – q) 0
![Page 5: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/5.jpg)
April 20, 2015 5
Polynomial identity testing
• try all |F|n inputs? – may be exponentially many
• multiply out symbolically, check that all coefficients are zero?– may be exponentially many coefficients
• can randomness help?– i.e., flip coins, allow small probability of wrong
answer
![Page 6: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/6.jpg)
April 20, 2015 6
Polynomial identity testing
Lemma (Schwartz-Zippel): Let
p(x1, x2, …, xn)
be a total degree d polynomial over a field F and let S be any subset of F. Then if p is not identically 0,
Prr1,r2,…,rnS[ p(r1, r2, …, rn) = 0] ≤ d/|S|.
![Page 7: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/7.jpg)
April 20, 2015 7
Polynomial identity testing
• Proof:– induction on number of variables n– base case: n = 1, p is univariate polynomial of
degree at most d– at most d roots, so
Pr[ p(r1) = 0] ≤ d/|S|
![Page 8: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/8.jpg)
April 20, 2015 8
Polynomial identity testing
– write p(x1, x2, …, xn) as
p(x1, x2, …, xn) = Σi (x1)i pi(x2, …, xn)
– k = max. i for which pi(x2, …, xn) not id. zero
– by induction hypothesis:
Pr[ pk(r2, …, rn) = 0] ≤ (d-k)/|S|
– whenever pk(r2, …, rn) ≠ 0, p(x1, r2, …, rn) is a univariate polynomial of degree k
Pr[p(r1,r2,…,rn)=0 | pk(r2,…,rn) ≠ 0] ≤ k/|S|
![Page 9: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/9.jpg)
April 20, 2015 9
Polynomial identity testing
Pr[ pk(r2, …, rn) = 0] ≤ (d-k)/|S|
Pr[p(r1,r2,…,rn)=0 | pk(r2,…,rn) ≠ 0] ≤ k/|S|
– conclude:
Pr[ p(r1, …, rn) = 0] ≤ (d-k)/|S| + k/|S| = d/|S|
– Note: can add these probabilities because
Pr[E1] = Pr[E1|E2]Pr[E2] + Pr[E1|E2]Pr[ E2]
≤ Pr[E2] + Pr[E1|E2]
![Page 10: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/10.jpg)
April 20, 2015 10
Polynomial identity testing
• Given: polynomial p(x1, x2, …, xn)
• Is p identically zero?
• Note: degree d is at most the size of input
-
*
x1 x2
*
+ -
x3 … xn
*
![Page 11: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/11.jpg)
April 20, 2015 11
Polynomial identity testing
• randomized algorithm: field F, pick a subset S F of size 2d– pick r1, r2, …, rn from S uniformly at random– if p(r1, r2, …, rn) = 0, answer “yes”– if p(r1, r2, …, rn) ≠ 0, answer “no”
• if p identically zero, never wrong• if not, Schwartz-Zippel ensures probability
of error at most ½
![Page 12: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/12.jpg)
April 20, 2015 12
Polynomial identity testing
• Given: polynomial p(x1, x2, …, xn)
• Is p identically zero?
-
*
x1 x2
*
+ -
x3 … xn
*
What if polynomial is given as arithmetic circuit?
• max degree?
• does the same strategy work?
![Page 13: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/13.jpg)
April 20, 2015 13
3. Unique solutions
• a positive instance of SAT may have many satisfying assignments
• maybe the difficulty comes from not knowing which to “work on”
• if we knew # satisfying assignments was 1 or 0, could we zoom in on the 1 efficiently?
![Page 14: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/14.jpg)
April 20, 2015 14
Unique solutions
Question: given polynomial-time algorithm that works on SAT instances with at most 1 satisfying assignment, can we solve general SAT instances efficiently?
• Answer: yes– but (currently) only if “efficiently” allows
randomness
![Page 15: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/15.jpg)
April 20, 2015 15
Unique solutions
Theorem (Valiant-Vazirani): there is a randomized poly-time procedure that given a 3-CNF formula
φ(x1, x2, …, xn)
outputs a 3-CNF formula φ’ such that – if φ is not satisfiable then φ’ is not satisfiable– if φ is satisfiable then with probability at least
1/(8n) φ’ has exactly one satisfying assignment
![Page 16: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/16.jpg)
April 20, 2015 16
Unique solutions
• Proof:– given subset S {1, 2, …, n}, there exists a
3-CNF formula θS on x1, x2, …, xn and additional variables such that:• θS is satisfiable iff an even number of
variables in {xi}iS are true• for each such setting of the xi variables, this
satisfying assignment is unique• |θS| = O(n)• not difficult; details omitted
![Page 17: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/17.jpg)
April 20, 2015 17
Unique solutions
– set φ0 = φ– for i = 1, 2, …, n
• pick random subset Si
• set φi = φi-1 θSi
– output random one of the φi
– T = set of satisfying assignments for φ– Claim: if |T| > 0, then
Prk{0,1,2,…,n-1}[2k ≤ |T| ≤ 2k+1] ≥ 1/n
![Page 18: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/18.jpg)
April 20, 2015 18
Unique solutions
Claim: if 2k ≤ |T| ≤ 2k+1, then the probability φk+2 has exactly one satisfying assignment is ≥ 1/8
– fix t, t’ T
– Pr[t “agrees with” t’ on Si] = ½
– Pr[t agrees with t’ on S1, S2, …, Sk+2] = (½)k+2
t = 0101 00101 0111
t’ = 1010 11100 0101
Si
Si contains even # of positions i where ti ≠ ti’
![Page 19: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/19.jpg)
April 20, 2015 19
Unique solutions
– Pr[t agrees with some t’ on S1,…, Sk+2]
≤ (|T|-1)(½)k+2 < ½
– Pr[t satisfies S1, S2, …, Sk+2] = (½)k+2
– Pr[t unique satisfying assignment of φk+2]
> (½)k+3
– sum over at least 2k different t T (disjoint events); claim follows.
![Page 20: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/20.jpg)
April 20, 2015 20
Randomized complexity classes
• model: probabilistic Turing Machine– deterministic TM with additional read-only
tape containing “coin flips”
• BPP (Bounded-error Probabilistic Poly-time)
– L BPP if there is a p.p.t. TM M:
x L Pry[M(x,y) accepts] ≥ 2/3
x L Pry[M(x,y) rejects] ≥ 2/3
– “p.p.t” = probabilistic polynomial time
![Page 21: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/21.jpg)
April 20, 2015 21
Randomized complexity classes
• RP (Random Polynomial-time)
– L RP if there is a p.p.t. TM M:
x L Pry[M(x,y) accepts] ≥ ½
x L Pry[M(x,y) rejects] = 1
• coRP (complement of Random Polynomial-time)
– L coRP if there is a p.p.t. TM M:
x L Pry[M(x,y) accepts] = 1
x L Pry[M(x,y) rejects] ≥ ½
![Page 22: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/22.jpg)
April 20, 2015 22
Randomized complexity classes
One more important class:
• ZPP (Zero-error Probabilistic Poly-time)
– ZPP = RP coRP
– Pry[M(x,y) outputs “fail”] ≤ ½
– otherwise outputs correct answer
![Page 23: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/23.jpg)
April 20, 2015 23
Randomized complexity classes
• “1/2” in ZPP, RP, coRP definition unimportant– can replace by 1/poly(n)
• “2/3” in BPP definition unimportant– can replace by ½ + 1/poly(n)
• Why? error reduction– we will see simple error reduction by repetition– more sophisticated error reduction later
These classes may capture “efficiently computable” better than P.
![Page 24: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/24.jpg)
April 20, 2015 24
Error reduction for RP
• given L and p.p.t TM M:x L Pry[M(x,y) accepts] ≥ ε
x L Pry[M(x,y) rejects] = 1
• new p.p.t TM M’:– simulate M k/ε times, each time with
independent coin flips– accept if any simulation accepts– otherwise reject
![Page 25: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/25.jpg)
April 20, 2015 25
Error reduction
x L Pry[M(x,y) accepts] ≥ ε
x L Pry[M(x,y) rejects] = 1
• if x L:– probability a given simulation “bad” ≤ (1 – ε) – probability all simulations “bad” ≤ (1–ε)(k/ε) ≤ e-k
Pry’[M’(x, y’) accepts] ≥ 1 – e-k
• if x L:Pry’[M’(x,y’) rejects] = 1
![Page 26: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/26.jpg)
April 20, 2015 26
Error reduction for BPP
• given L, and p.p.t. TM M:x L Pry[M(x,y) accepts] ≥ ½ + ε
x L Pry[M(x,y) rejects] ≥ ½ + ε
• new p.p.t. TM M’:– simulate M k/ε2 times, each time with
independent coin flips– accept if majority of simulations accept– otherwise reject
![Page 27: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/27.jpg)
April 20, 2015 27
Error reduction for BPP
– Xi random variable indicating “correct” outcome in i-th simulation (out of m = k/ε2 )
• Pr[Xi = 1] ≥ ½ + ε
• Pr[Xi = 0] ≤ ½ - ε
– E[Xi] ≥ ½+ε
– X = ΣiXi
– μ = E[X] ≥ (½ + ε)m
– Chernoff: Pr[X ≤ m/2] ≤ 2-(ε2 μ)
![Page 28: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/28.jpg)
April 20, 2015 28
Error reduction for BPP
x L Pry[M(x,y) accepts] ≥ ½ + ε
x L Pry[M(x,y) rejects] ≥ ½ + ε
– if x L
Pry’[M’(x, y’) accepts] ≥ 1 – (½)(k)
– if x L
Pry’[M’(x,y’) rejects] ≥ 1 – (½)(k)
![Page 29: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/29.jpg)
April 20, 2015 29
Randomized complexity classes
• We have shown:– polynomial identity testing is in coRP
– a poly-time algorithm for detecting unique solutions to SAT implies
NP = RP
![Page 30: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/30.jpg)
April 20, 2015 30
Relationship to other classes
• ZPP, RP, coRP, BPP, contain P– they can simply ignore the tape with coin flips
• all are in PSPACE – can exhaustively try all strings y– count accepts/rejects; compute probability
• RP NP (and coRP coNP)– multitude of accepting computations– NP requires only one
![Page 31: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/31.jpg)
April 20, 2015 31
Relationship to other classes
P
RP coRP
NP coNP
PSPACE
BPP
![Page 32: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/32.jpg)
April 20, 2015 32
BPP
• How powerful is BPP?
• We have seen an example of a problem in
BPP
that we only know how to solve in EXP.
Is randomness a panacea for intractability?
![Page 33: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/33.jpg)
April 20, 2015 33
BPP
• It is not known if BPP = EXP (or even NEXP!) – but there are strong hints that it does not
• Is there a deterministic simulation of BPP that does better than brute-force search?– yes, if allow non-uniformity
Theorem (Adleman): BPP P/poly
![Page 34: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/34.jpg)
April 20, 2015 34
BPP and Boolean circuits
• Proof: – language L BPP – error reduction gives TM M such that
• if x L of length n
Pry[M(x, y) accepts] ≥ 1 – (½)n2
• if x L of length n
Pry[M(x, y) rejects] ≥ 1 – (½)n2
![Page 35: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/35.jpg)
April 20, 2015 35
BPP and Boolean circuits
– say “y is bad for x” if M(x,y) gives incorrect answer
– for fixed x: Pry[y is bad for x] ≤ (½)n2
– Pry[y is bad for some x] ≤ 2n(½)n2< 1
– Conclude: there exists some y on which M(x, y) is always correct
– build circuit for M, hardwire this y
![Page 36: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/36.jpg)
April 20, 2015 36
BPP and Boolean circuits
• Does BPP = EXP ?
• Adleman’s Theorem shows:
BPP = EXP implies EXP P/poly
If you believe that randomness is all-powerful, you must also believe
that non-uniformity gives an exponential advantage.
![Page 37: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/37.jpg)
April 20, 2015 37
BPP
• Next:
further explore the relationship between
randomness
and
nonuniformity
• Main tool: pseudo-random generators
![Page 38: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/38.jpg)
April 20, 2015 38
Derandomization
• Goal: try to simulate BPP in subexponential time (or better)
• use Pseudo-Random Generator (PRG):
• often: PRG “good” if it passes (ad-hoc) statistical tests
seed output stringGt bits m
bits
![Page 39: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/39.jpg)
April 20, 2015 39
Derandomization
• ad-hoc tests not good enough to prove BPP has non-trivial simulations
• Our requirements:– G is efficiently computable
– “stretches” t bits into m bits
– “fools” small circuits: for all circuits C of size at most s:
|Pry[C(y) = 1] – Prz[C(G(z)) = 1]| ≤ ε
![Page 40: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/40.jpg)
April 20, 2015 40
Simulating BPP using PRGs
• Recall: L BPP implies exists p.p.t.TM Mx L Pry[M(x,y) accepts] ≥ 2/3
x L Pry[M(x,y) rejects] ≥ 2/3
• given an input x:– convert M into circuit C(x, y)– simplification: pad y so that |C| = |y| = m
• hardwire input x to get circuit Cx
Pry[Cx(y) = 1] ≥ 2/3 (“yes”)
Pry[Cx(y) = 1] ≤ 1/3 (“no”)
![Page 41: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/41.jpg)
April 20, 2015 41
Simulating BPP using PRGs
• Use a PRG G with– output length m– seed length t « m– error ε < 1/6– fooling size s = m
• Compute Prz[Cx(G(z)) = 1] exactly
– evaluate Cx(G(z)) on every seed z {0,1}t
• running time (O(m)+(time for G))2t
![Page 42: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/42.jpg)
April 20, 2015 42
Simulating BPP using PRGs
• knowing Prz[Cx(G(z)) = 1], can distinguish between two cases:
0 1/3 1/2 2/3 1“yes”:
ε
0 1/3 1/2 2/3 1“no”:
ε
![Page 43: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/43.jpg)
April 20, 2015 43
Blum-Micali-Yao PRG
• Initial goal: for all 1 > δ > 0, we will build a family of PRGs {Gm} with:output length m fooling size s = mseed length t = mδ running time mc
error ε < 1/6
• implies: BPP δ>0 TIME(2nδ ) ( EXP
• Why? simulation runs in time
O(m+mc)(2mδ)
= O(2m2δ
) = O(2n2kδ)
![Page 44: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/44.jpg)
April 20, 2015 44
Blum-Micali-Yao PRG
• PRGs of this type imply existence of one-way-functions– we’ll use widely believed cryptographic assumptions
Definition: One Way Function (OWF): function family f = {fn}, fn:{0,1}n
{0,1}n
– fn computable in poly(n) time
– for every family of poly-size circuits {Cn}
Prx[Cn(fn(x)) fn-1(fn(x))] ≤ ε(n)
– ε(n) = o(n-c) for all c
![Page 45: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/45.jpg)
April 20, 2015 45
Blum-Micali-Yao PRG
• believe one-way functions exist– e.g. integer multiplication, discrete log, RSA
(w/ minor modifications)
Definition: One Way Permutation: OWF in which fn is 1-1
– can simplify “Prx[Cn(fn(x)) fn-1(fn(x))] ≤ ε(n)” to
Pry[Cn(y) = fn-1(y)] ≤ ε(n)
![Page 46: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/46.jpg)
April 20, 2015 46
First attempt
• attempt at PRG from OWF f:– t = mδ
– y0 {0,1}t
– yi = ft(yi-1)
– G(y0) = yk-1yk-2yk-3…y0
– k = m/t
• computable in time at most ktc < mtc-1 = mc
![Page 47: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/47.jpg)
April 20, 2015 47
First attempt
• output is “unpredictable”:– no poly-size circuit C can output yi-1 given
yk-1yk-2yk-3…yi with non-negl. success prob.
– if C could, then given yi can compute yk-1, yk-2, …, yi+2, yi+1 and feed to C
– result is poly-size circuit to compute
yi-1 = ft-1(yi) from yi
– note: we’re using that ft is 1-1
![Page 48: CS151 Complexity Theory Lecture 7 April 20, 2015](https://reader030.vdocuments.mx/reader030/viewer/2022032704/56649d4a5503460f94a26d59/html5/thumbnails/48.jpg)
April 20, 2015 48
First attempt
attempt:• y0 {0,1}t
• yi = ft(yi-1)
• G(y0) =
yk-1yk-2yk-3…y0
y0y1y2y3y4y5
ftftftftft
G(y0):
y0y1y2y3y4y5
ft-1ftft
G’(y3):
ft-1ft
-1
same distribution!