\documentclass[10pt]{article}
\newtheorem{define}{Definition}
%\newcommand{\Z}{{\mathbb{Z}}}
%\usepackage{psfig}
\usepackage{amsmath}

\oddsidemargin=0.15in
\evensidemargin=0.15in
\topmargin=-.5in
\textheight=9in
\textwidth=6.25in

\begin{document}
\input{preamble.tex}

%{lecture number}{lecture date}{Ronitt Rubinfeld}{Your name}
\lecture{25}{December 6, 2017}{Ronitt Rubinfeld}{Jennifer Tang}

\section{Amplifying Hardness: Yao's XOR Lemma}

Goal: To ``amplify hardness'' by taking any slightly hard function (worst case hard function) $f$ and turn it into a new actually hard function (average case hard function) $f^*$.

How will we do this? By showing that if a function is not hard in the average case, we can solve it in the worst case.

\subsection{Yao's XOR lemma}

Here's an example to understand the intuition behind Yao's XOR lemma:
Suppose you have a $\delta$-biased coin where the probability of heads is $1 - \delta$ (suppose $\delta \leq\frac{1}{2}$). 
\begin{itemize}
\item We can correctly predict the result of one coin flip with probability $1- \delta$ (by guessing heads)
\item We can correctly predict the result of $k$ coin flips with probability $(1-\delta)^k$ (by guessing all heads)
\item If we were asked to guess the parity of $k$ coin flips (odd parity if there is an odd number of heads), we can correctly predict the parity with probability $\approx \frac{1}{2} + (1-2\delta)^k$. This approaches $\frac{1}{2}$ as $k$ goes to infinity.
\end{itemize}
What we want to do is apply this not to coin flips, but to the function $f$. This is not so straightforward. 

\subsection{Plan}
Note that this topic deals with functions on circuits as opposed to functions on Turing machines. Fix a class of circuits. The overall plan is to show:

\begin{centering}
Function $f$ is wrong on some fraction $\delta$ of inputs for any circuit

$\Downarrow$ (using boosting)

There exists a measure where $f$ is wrong on almost $\frac{1}{2}$ fraction of inputs with any circuit

$\Downarrow$ (using probabilistic argument)

There exists a subset of inputs such that $f$ is wrong on $\frac{1}{2}$ the inputs with any circuit

$\Downarrow$ (using Yao's XOR lemma)

There exists a function $f^*$ which is wrong on almost $\frac{1}{2}$ of all inputs with any circuit

\end{centering}
We have amplified hardness by significantly increasing the proportion of inputs any circuit is wrong on. 

%We will introduce some definitions to clear up what we intend to show. Using the definitions, the above plan is to same as showing there is a function $f$ which achieve the following:
%
%\begin{centering}
%$\delta$-hard
%
%$\Downarrow$
%
%$\delta'(\varepsilon,\delta)$ - hardcore measure
%
%$\Downarrow$
%
%$2\delta '$ hardcore set
%
%$\Downarrow$
%
%$2\delta' + (1-\delta)^k$ hardcore on all domains
%
%\end{centering}

\subsection{Several Definitions}

\begin{definition}
Function $f: \{ \pm 1\}^n \rightarrow \{ \pm1\}$ is \textbf{\emph{$\delta$-hard}} on distribution $\mathcal{D}$ for size $g$ if for any Boolean circuit $C$ with less than $g$ gates $$ Pr_{\mathcal{D}}[C(x) = f(x)] \leq 1-\delta\,.$$
\end{definition}
In other words, $f$ is $\delta$-hard if there is always an error on at least $\delta$ fraction of inputs given by distribution $\mathcal{D}$. For example, if $\mathcal{D}$ is uniform on binary $n$ bit inputs, a function $f$ is $\delta$-hard for $\delta = 2^{-n}$ if more than one input always gives the wrong answer for any circuit. If $f$ is $\delta$-hard for $\delta = \frac{1}{2}$, then no circuit does better than randomly guessing the function. In such a case, we can always set $C(\cdot) = 1$ or $C(\cdot) = -1$.

Our goal is to find a function and distribution pair, $(f, \mathcal{D}),$ which is $\delta$-hard on approximately $\frac{1}{2}$ of the inputs under distribution $\mathcal{D}$.

For the next definition, recall

$$Adv_x(M) = \sum_x R_c(x) M(x)$$ where 
$$
R_c(x) = \begin{cases} +1 \text{ if } C(x) = f(x)\\
-1 \text{ if } C(x) \neq f(x)\\
\end{cases}
$$

\begin{definition}
If $\frac{Adv_c(M)}{\sum_x M(x)} \leq \varepsilon$ for every circuit $C$ with less than $g$ gates, then $f$ is \textbf{\emph{$\varepsilon$-hardcore}} on $M$ for size $g$.
\end{definition}
Note that the condition $\frac{Adv_c(M)}{\sum_x M(x)} \leq \varepsilon$ is equivalent to $Pr_M[C(x) = f(x)] \leq \frac{1}{2} + \frac{\varepsilon}{2}$ (where the probability is taken over the measure given by $M$). 

\begin{definition}
Let $S \subseteq  \{ \pm 1\}^n$, then $f$ is \textbf{\emph{$\varepsilon$-hardcore}} on $S$ for size $g$ if for every circuit $C$ of size at most $g$ is such that $Pr[C(x) = f(x)] \leq \frac{1}{2} + \frac{\varepsilon}{2}$ where the probability measure is uniform on the elements in set $S$. 
\end{definition}

We have defined these terms so that we can show for every hard function $f$, there is a hardcore function on the set $S \subseteq  \{ \pm 1\}^n$.

\subsection{Several Theorems: Hard functions have hardcore measure}

\begin{theorem} Suppose $f$ is a $\delta$-hard function for the uniform distribution for size $g$. Let $0 < \varepsilon < 1$. Then there exists a measure ${M}$ such that $\mu(M) = \frac{\sum_x M(x)}{\#x} \geq \delta$ such that $f$ is $\varepsilon$-hardcore on $M$ for size $g' = \frac{1}{4}\varepsilon^2 \delta^2 g$.
\end{theorem}
The proof of this theorem is given by boosting. Notice how the size of the circuit grows by a similar constant used in boosting.
\newline
\newline
\begin{proof}
Given $f$, suppose there is no measure $M$ that meets the condition of the theorem. Then, for every $M$ such that $\mu(M) \geq \delta$, there is a circuit of size $g'$ with $Adv_c(M) \geq \varepsilon$. Let this circuit be the ``weak learner'' in the boosting argument. 

We can take the majority of the $\frac{1}{\varepsilon^2 \delta^2}$ circuits of size $g'$. The output of each of the circuits of size $g'$ is feed into one large majority gate which produces the final answer. By boosting, this predicts $f$ with error less than $\delta$. The total size of the circuit is $\frac{1}{\varepsilon^2 \delta^2} g' + o(\frac{1}{\varepsilon^2 \delta^2}) = \frac{1}{\varepsilon^2 \delta^2} \frac{1}{4}\varepsilon^2 \delta^2 g + o(\frac{1}{\varepsilon^2 \delta^2})< g$. This implies that $f$ cannot be $\delta$-hard for circuits of size $g$.
\end{proof}

Using a probabilistic argument, we can get that if there is an $\varepsilon$-hardcore measure $M$ for size $g'$ where $2n < g < \frac{\varepsilon^2 \delta^2}{8}\frac{2^n}{n}$ then there exists a $2\varepsilon$-hardcore set $S$ for $f$ of size $g$ where $|S| \leq \delta 2^n$. 

The following theorem (or lemma rather) shows that if there is hardcore set then there is a function (a different one) which is hard to predict on all of the domain. The new function is created by taking a combination of XOR's of the original function. 

\begin{lemma}[Yao's XOR lemma]
Given $f$ which is $\varepsilon$-hardcore for set $H$ of size greater than $\delta 2^n$ for size $g+1$, the function 
$$ f^{\oplus k}(x_1,...,x_k) = f(x_1) \oplus f(x_2) \oplus ... \oplus f(x_k)$$ is $\varepsilon + 2(1-\delta)^k$-hardcore for size $g$ on the whole domain. 
\end{lemma}
Before we present the actual proof, we will provide an idea which is key to the proof. This idea does \emph{not} work on its own, but it helpful for understanding the proof. 

Assume the theorem is not true. Then there exists a circuit $C$ with less than $g$ gates, which that 
$$Pr_{x_1, ...,x_k} [C(x_1, ...,x_k) = f^{\oplus k}(x_1,...,x_k)] \geq \frac{1}{2} + \frac{\varepsilon}{2} + (1-\delta)^k\,.$$

Here is a way to use $f^{\oplus k}$ to determine $f$: Given an input $x$, let $x_1 = x$. Let the rest of the inputs into $f^{\oplus k}$ each equal the zero vector, that is $x_2 = \underline 0,...,x_k = \underline 0$. Let $ b = \oplus_{i = 2}^k f(\underline 0)$, then $$f(x) = f^{\oplus k}(x, \underline 0,...,\underline 0) \oplus b\,.$$

We can create a circuit for $f(x)$ by using $C(x, \underline 0,...,\underline 0) \oplus b$. If 

$$ Pr [f(x) = C(x, \underline 0,...,\underline 0) \oplus b] > \frac{1}{2} + \frac{\varepsilon}{2}$$ then we have a contradiction. The only problem here is that while $C(x_1,...,x_k)$ approximates $f(x_1, ...,x_k)$ well on $\frac{1}{2} + \frac{\varepsilon}{2} + (1-\delta)^k$ of the inputs, setting the inputs $x_2,...,x_k$ to zero vectors might not be one of the instances which $C(x_1,...,x_k)$ is correct for. The proof below uses this idea but fixes this issue by evaluating on a better choice of $x_2,...,x_k$.
\newline
\newline
\begin{proof}
Let $A_m$ be the event that exactly $m$ of $x_1,...,x_k$ are in $H$. Note that $$Pr_{x_1,...,x_k}[A_0] \leq (1-\delta)^k\,.$$ The event $A_0$ are instances which have no $x_i$ in $H$, so these are not ``hard'' to evaluate on. If we condition on not getting $A_0$, we must have

$$ Pr_{x_1,...,x_k}[C(x_1,...,x_k)  = f^{\oplus k}(x_1,...,x_k) | \cup_{m > 0} A_m] > \frac{1}{2} + \frac{\varepsilon}{2}\,.$$

By averaging, we know that there is one $i >0$ where $$ Pr_{x_1,...,x_k}[C(x_1,...,x_k)  = f^{\oplus k}(x_1,...,x_k) | A_i] > \frac{1}{2} + \frac{\varepsilon}{2}\,.$$

With this value of $i$, the procedure is that given any $x \in H$, compute $f(x)$ by 
\begin{enumerate}
\item Picking $x_1,...,x_{i-1} \in H$ randomly
\item Picking $y_{i+1},...,y_k \in \bar H$ randomly
\item Picking a random permutation $\pi$ of $(x_1,...,x_{i-1},x, y_{i+1},...,y_k)$
\end{enumerate}

$$ Pr_{x_1,...,x_k}[C(\pi(x_1,...,x_{i-1},x,y_{i+1},...,y_k))  = f^{\oplus k}(\pi(x_1,...,x_{i-1},x,y_{i+1},...,y_k))] > \frac{1}{2} + \frac{\varepsilon}{2}\,.$$

By averaging, there exists a specific choice of $\pi, x_1,...,x_{i-1},y_{i+1},...y_{k}$ and a bit $b = \oplus_{j = 1}^{i-1} f(x_j) \oplus_{j = i+1}^{k} f(y_j)$ so that 
$$ Pr_{x \in H}[f(x) = C(\pi(x_1,...,x_{i-1},x,y_{i+1},...,y_k)) \oplus b] \geq \frac{1}{2}+\frac{\varepsilon}{2}$$.

We will create the circuit for predicting $f$ by hardcoding $C$ with the choices of variables $x_1,...,x_{i-1},y_{i+1},...y_{k}$, the permutation $\pi$, and the bit $b$. The size of this circuit is less than $g+1$, so $f$ is not $\varepsilon$-hardcore for size $g+1$ for on the set $H$.

\end{proof}
\end{document}
