\documentclass[10pt]{article}
\newtheorem{define}{Definition}
%\newcommand{\Z}{{\mathbb{Z}}}
%\usepackage{psfig}

\oddsidemargin=0.15in
\evensidemargin=0.15in
\topmargin=-.5in
\textheight=9in
\textwidth=6.25in

\begin{document}
\input{preamble.tex}

%{lecture number}{lecture date}{Ronitt Rubinfeld}{Your name}
\lecture{26}{May 16, 2012}{Ronitt Rubinfeld}{Andrei Frimu}

%%%% body goes in here %%%%

This lecture discusses the relationship between pseudorandomness and hard functions. The main result, accompanied by proof, is Theorem \ref{nw}.

First, let's review the definition of a useful construction from the previous lecture:
\begin{define}
A collection of sets $S_1,\ldots,S_m\subseteq[d]=\{1,\ldots,d\}$ is an \textbf{$(l,a)$-design} if
\begin{itemize}
\item $\forall i$, $|S_i|=l$
\item $\forall i\neq j$, $|S_i\cap S_j|\le a$.
\end{itemize}
\end{define}

Note that if $a=0$, then the sets $S_1,\ldots,S_l$ are all disjoint as they each have $l$ elements, $d$ is forced to be at least $m\cdot l$. For the purposes of this lecture, it is useful to think of $m$ as being big and $a$ relatively small.

We will use the following theorem, which we don't prove here:
\begin{theorem}
For any constant $\gamma$, there exists an $(l,a)$-design with $a=\gamma\log m$, constructible in time $2^{O(d)}$ and such that $d=O(l^2/a)$.
\end{theorem}

We now introduce another definition
\begin{define}
$f:\{0,1\}^l\to\{0,1\}$ is \textbf{$(t,\alpha)$-average case hard} if for any nonuniform (circuit with advice) algorithm $A$ running in time $t(l)$ the following inequality holds for large $l$:
\[
\Pr_{x,A}\left[A(x)=f(x)\right]<1-\alpha(l)
\]
\end{define}
Note that $x$ is of size $l$. We will use $\alpha(l)=1-\epsilon(l)$ for $\epsilon(l)\le\frac1{t(l)}$, hence $1-\alpha(l)\le\frac12+\epsilon(l)\le\frac12+\frac1{t(l)}$.

The following theorem allows us to extend by 1-bit:
\begin{theorem}
If $f$ is $(t,1-\epsilon)$-average case hard, then $G(y):=y\circ f(y)$ is a $(t,\epsilon)$-PRG. 
\end{theorem}

We want to stretch this. Our approach is to use the \textit{Nisan-Wigderson generator}, which we present here.

\begin{define}[Nisan-Wigderson generator]
Given $(l,a)$-design $S_1,\ldots,S_m\subseteq[d]$, define $G:\{0,1\}^d\to\{0,1\}^m$ to be
\[
G(x):=f(x|_{S_1})\circ f(x|_{S_2})\circ\cdots\circ f(x|_{S_m}),
\]
where $x|_{S_i}$ is the string of length $l=|S_i|$ obtained by selecting the bits of $x$ indexed by $S_i$. For convenience, use the notation $f_i(x):=f(x|_{S_i})$. Note that the domain of each $f_i$ is $\{0,1\}^l$.
\end{define}

The intuition behind this construction is that if the sets $S_i$ were completely disjoint, then the strings $x|_{S_i}$ would be completely independent, since they would have no common bits, making $G$ hard to predict. However, in this case, as we saw, $d\ge ml$.

What we hope is that by trading independence of the strings $x|_{S_i}$, by allowing a bit of overlap (bounded above by $|S_i\cap S_j|\le a$), we can still achieve satisfactory unpredictability. The following theorem quantifies these ideas:

\begin{theorem}[NW]\label{nw}
Assume that the following two conditions hold (to be used in the Nisan-Wigderson generator):
\begin{itemize}
\item there exists $f:\{0,1\}^l\to\{0,1\}$ such that $f\in E:=DTIME(2^{O(l)})$ and
\[
f\textrm{ is }\left(t,\frac12-\frac1{\epsilon(l)}\right)-average case hard
\]
\item there exists an $(l,a)$-design $S_1,\ldots,S_m\subseteq[d]$ such that
\[
m=t(l)^{1/3}\qquad\textrm{ and }\qquad a = \frac13\log t(l)
\]
\end{itemize}
Then the Nisan-Wigderson generator $G$ is a $\frac1m$-PRG against non-uniform time $m$.
\end{theorem}

Before we move on to the proof of theorem \ref{nw}, we mention two interesting corollaries.
\begin{corollary} If $f\in E=DTIME(2^{O(l)})$ such that $f$ is $\left(t,\frac12-t\right)$-average case hard for
\[ t = 2^{\Omega(l)}\ \Longrightarrow\ P=BPP \]
\[ t = 2^{l^{\Omega(1)}}\ \Longrightarrow\ \tilde{P}=BPP\]
\[ t = l^{\omega(1)}\ \Longrightarrow\ BPP\subseteq SUBEXP\]
\end{corollary}

\begin{corollary}
There exists $(m,1/m)$ PRG for depth $d$ circuits of size $m$ such that the PRG is computable in polynomial time.
\end{corollary}

Now we present the proof of theorem \ref{nw}:

\begin{proof}

Suppose the result is not true. Then there exists a next-bit predictor $P$ such that
\begin{equation}\label{ineq1}
\Pr_{i,x}\left[P\Big(f_1(x)\circ f_2(x)\circ\cdots\circ f_{i-1}(x)\Big)=f_i(x)\right]\ge\frac12+\frac{\epsilon}m.
\end{equation}
Note that the circuit size of $P$ is the sum of the runtime of the PRG, which is $m$ and the size of the advice we gave $P$ in the proof, which is $O(m)$, hence $\textrm{size}(P)=O(m)$.

Using a standard argument (seen before in other lectures), there exists $i^*$ that achieves the expectation, in other words
\begin{equation}\label{ineq2}
\Pr_{\textrm{bits of }x\textrm{ in }S_{i^*},\ \textrm{bits of }x\textrm{ not in }S_{i^*}}\left[P\Big(f_1(x)\circ f_2(x)\circ\cdots\circ f_{i^*-1}(x)\Big)=f_{i^*}(x)\right]\ge\frac12+\frac{\epsilon}m.
\end{equation}
Note that this is just inequality (\ref{ineq1}) as before, rewritten for $i^*$ and with the probability split over two sets.

Now using an averaging process, we see that there must exist a setting $Z$ of the bits of $x$ \textit{not in} $S_i$ which achieves (\ref{ineq2}). We change notation and use the variable $y$ to denote the $x$'s that has its bits \textit{not in} $S_i$ set according to the setting $Z$. Then (\ref{ineq2}) becomes
\begin{equation}\label{ineq3}
\Pr_y\left[P\Big(f_1(y)\circ f_2(y)\circ\cdots\circ f_{i^*-1}(y)\Big)=f_{i^*}(y)\right]\ge\frac12+\frac{\epsilon}m
\end{equation}

Note that in (\ref{ineq3}), in $f_{i^*}(y)$, the unset variables are those indexed by $S_{i^*}$ and $f_{i^*}$ depends on all these. However, on the left hand side of the equality inside the probability in (\ref{ineq3}), each $f_j$, $1\le j\le i^*-1$ depends only on the unset variables index by $S_j\cap S_i$, for the other variable of $y$ have been fixed according to the setting $Z$ chose above.

Hence, each $f_j$ depends on $|S_i\cap S_j|\le a$ variables. The $2^a$ values can be encoded as advice, giving a total advice size of $m\cdot 2^a$. This relatively small size of the advice (for special $m$ and $a$) is crucial in what follows.

Define $A(y)=P(f_1(y)\circ\cdots\circ f_{i^*-1}(y))$.

\begin{itemize}
\item predicts $f(y)$ with advantage at least $\frac{\epsilon}m\approx\frac1{m^2}$
\item has circuit size $m\cdot 2^a + \textrm{size of}(P)$. The latter we saw to be $O(m)$. Since we picked $a,m$ to satisfy $a=\frac13\log t(l)$ and $m=t(l)^{\frac 13}$, we have that
\[
\textrm{size}(A(y))=m\cdot 2^a + O(m)=t(l)^{\frac13}\cdot t(l)^{\frac 13}+O(t(l)^{\frac13})\ll t(l),
\]
contradicting the first assumption of theorem \ref{nw}. (the average case hardness assumption)
\end{itemize}

\end{proof}

\end{document}