The hardness vs. randomness paradigm aims to construct pseudorandom generators (PRGs) based on complexity theoretic hardness assumptions. A seminal result in this area is a PRG construction by [N. Nisan and A. Wigderson, 1994; R. Impagliazzo and A. Wigderson, 1997]. A sequence of works [A. Klivans and D. van Melkebeek, 2002; R. Shaltiel and C. Umans, 2005; C. Umans, 2003; R. Shaltiel and C. Umans, 2006] generalized the result of [N. Nisan and A. Wigderson, 1994; R. Impagliazzo and A. Wigderson, 1997] to nondeterministic circuits, and showed that if E = DTIME(2^{O(n)}) requires nondeterministic circuits of size 2^{Ω(n)}, then for every sufficiently large s, and every ε ≥ 1/s, there is an ε-PRG G:{0,1}^{r = O(log s + log 1/(ε))} → {0,1}^s that runs in time poly(s), and fools size s nondeterministic circuits. In particular, for every size s nondeterministic circuit C, Pr[C(G(U_r)) = 1] ≤ Pr[C(U_s) = 1] + ε. Applebaum et al. [B. Applebaum et al., 2015] showed that "black-box techniques" cannot achieve such results for ε = s^{-ω(1)}. In order to circumvent this problem, Artemenko et al. [S. Artemenko et al., 2016] suggested a "multiplicative" version of PRGs, which requires that: Pr[C(G(U_r)) = 1] ≤ 2 ⋅ Pr[C(U_s) = 1] + ε. This still gives that Pr[C(G(U_r)) = 1] is very small, if Pr[C(U_s) = 1] is very small, and is therefore suitable for applications that only require this consequence. [S. Artemenko et al., 2016] constructed such multiplicative PRGs for ε = s^{-ω(1)} (based on very strong hardness assumptions). In this paper, we give an optimal construction of multiplicative PRGs for nondeterministic circuits. More specifically, under the same hardness assumption used for (standard) PRGs for nondeterministic circuits, we show that for every ε ≥ 1/(2^{s)}, there is a multiplicative PRG G:{0,1}^{r = O(log s + log 1/(ε))} → {0,1}^s that runs in time poly(s) and fools size s nondeterministic circuits. This gives the optimal seed length under a hardness assumption that is necessary, and provides improvements in several applications of multiplicative PRGs. Our result improves upon the previous multiplicative PRG construction of [S. Artemenko et al., 2016], which uses a stronger hardness assumption against Σ₃-circuits, and where the seed length is the suboptimal r = O(log s) + O(log 1/(ε))². Our result also improves upon the recent multiplicative PRG of Shaltiel [R. Shaltiel, 2025] that only achieves very small stretch (the output length in [R. Shaltiel, 2025] is less than twice the seed length). Our PRG construction borrows ideas from the recent "low stretch" PRG of Shaltiel [R. Shaltiel, 2025], and the (standard) PRG construction of Shaltiel and Umans [R. Shaltiel and C. Umans, 2005]. Loosely speaking, we aim to get the "multiplicativity" of the former, and the "large stretch" of the latter. While both approaches generalize the list-decoding results of Sudan, Trevisan and Vadhan [M. Sudan et al., 2001], the two results are tailored to two very different parameter regimes, and we introduce several new ideas to make the two approaches co-exist.

Trevisan and Vadhan (FOCS 2000) introduced the notion of (seedless) extractors for samplable distributions. They showed that under a very strong complexity theoretic hardness assumption (specifically, that there exists a problem in $\mathrm{E}=$ DTIME $\left(2^{O(n)}\right)$ that cannot be computed by size $2^{\Omega(n)}$ circuits that have an oracle to $\Sigma_{6}^{\mathrm{P}}$) there are extractors for samplable distributions with large min-entropy of $k=(1-\gamma) \cdot n$, for some small constant $\gamma{\gt}0$. Recently, Ball, Shaltiel and Silbak (STOC 2025) were able to reduce the min-entropy threshold to $k=n^{1-\gamma}$. Ball et al., point out that their approach does not work for $k{\lt}\sqrt{n}$ (and this holds even for stronger hardness assumptions, in which 6 is replaced with any other constant). In this paper, we show how to further reduce the minentropy threshold to $k=n^{0.34}\lt \sqrt{n}$ under the same hardness assumption used by Trevisan and Vadhan. More generally, for every positive integer $i \geq 2$, and every $\alpha{\gt}\frac{1}{i}$, we construct an extractor for samplable distributions with min-entropy $k=n^{\alpha}$, under a hardness assumption in which 6 is replaced with $i+3$ (the aforementioned result is a obtained for i = 3). We also provide a multiplicative version of our extractors (under a stronger hardness assumption) addressing an open problem of Ball et al. Our work builds on the approach of Ball et al., who reduced the task of constructing extractors for samplable distributions with min-entropy k, to the task of constructing errorless condensers for samplable distributions with min-entropy k. Our main technical contribution is a new construction of errorless condensers for samplable distributions with $k=n^{\alpha}$ under the hardness assumption stated above, improving upon the minentropy threshold achieved in Ball et al. (which cannot achieve $k\lt \sqrt{n}$). Our insight is that the technique used by Ball et al. to reduce the task of constructing extractors to that of constructing errorless condensers, can itself be used to construct errorless condensers for polynomially small min-entropy when combined with “win-win analysis” approaches that are inspired by some early work on seeded extractors and dispersers. In order to do this, we adapt these approaches from the information theoretic scenario of seeded extractors and dispersers to the computational scenario of errorless condensers for samplable distributions. Index Terms-Randomness extractors, Samplable distributions. In memory of Luca Trevisan. Research supported by ISF grant 1006/23. This research is also co-funded by the European Union (ERC, NFITSC, 101097959). Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union or the European Research Council. Neither the European Union nor the granting authority can be held responsible for them.

Codes for poly-size circuits: Guruswami and Smith (J. ACM 2016) considered codes for channels that are poly-size circuits which modify at most a p-fraction of the bits of the codeword. This class of channels is significantly stronger than Shannon’s binary symmetric channel (BSC), but weaker than Hamming’s channels which are computationally unbounded. The goal of this direction is to construct explicit codes (namely, codes with poly-time encoding and decoding algorithms) with rate R(p)=1−H(p) (matching the capacity of the BSC, and beating the capacity of codes for Hamming’s channels). This goal implies circuit lower bounds, and specifically that E=DTIME(2O(n)) does not have poly-size circuits (and therefore explicit constructions need to be based on hardness assumptions). We give the first explicit construction of such codes for poly-size channels. Specifically, for every 0 ≤ p < 1/4, there are explicit codes with rate R(p)=1−H(p), assuming E does not have size 2Ω(n) nondeterministic circuits. This hardness assumption was introduced in the context of hardness vs. randomness tradeoffs, and is by now standard in complexity theory. Our result builds on, and improves the previous work of Guruswami and Smith, and Shaltiel and Silbak (FOCS 2022). (These works gave a randomized Monte-Carlo construction, rather than explicit codes). Functions that are hard to sample on low entropy distributions: A key component in our codes (that may be of independent interest) is a new complexity theoretic notion of hard to sample functions (HTS): We say that a function f on n bits is an HTS for circuits of size nc, if there exists a constant c′>c, such that for every randomized circuit A of size nc that samples a distribution (X,Y) with (X) ≥ c′ · logn, it holds that Pr[Y=f(X)] ≤ 1/nc. This is inspired by works by Viola on the complexity of distributions (SICOMP 2012, 2020), in which X is the uniform distribution. Here, we allow A to choose any distribution X (except for distributions X with very low min-entropy) and note that a circuit A of size nc, may be hardwired with ≈ nc outputs of f, and therefore, can easily produce pairs (X,f(X)) for a distribution X, with (X) ≈ c logn. Building on classical works on “hardness amplification” (and using many additional tools and ideas from pseudorandomness) we show that if E does not have size 2Ω(n) nondeterministic circuits, then for every constant c, there is an HTS that is computable in time (nc). Our codes are obtained by using our HTS (as well as additional tools and ideas) to achieve explicit constructions (under the hardness assumption) of several components in the code of Shaltiel and Silbak, replacing previously obtained randomized Monte-Carlo constructions of these components. We then need to revisit the codes of Shaltiel and Silbak, and significantly modify the construction and analysis, so that they work with the weaker components that we are able to explicitly construct.

Yao’s XOR lemma states that for every function $$f:\{0,1\}^k \rightarrow \{0,1\}$$ , if f has hardness 2/3 for P/poly (meaning that for every circuit C in P/poly, $$\Pr[C(X)=f(X)] \le 2/3$$ on a uniform input X), then the task of computing $$f(X_1) \oplus \ldots \oplus f(X_t)$$ for sufficiently large t has hardness $$\frac{1}{2} + \epsilon$$ for P/poly. Known proofs of this lemma cannot achieve $$\epsilon=\frac{1}{k^{\omega(1)}}$$ , and even for $$\epsilon=\frac{1}{k}$$ , we do not know how to replace P/poly by AC0[parity] (the class of constant depth circuits with the gates {and, or, not, parity} of unbounded fan-in). Grinberg, Shaltiel and Viola (FOCS 2018) (building on a sequence of earlier works) showed that these limitations cannot be circumvented by black-box reductions. Namely, by reductions $${\rm Red}^{(\cdot)}$$ that given oracle access to a function D that violates the conclusion of Yao’s XOR lemma, implement a circuit that violates the assumption of Yao’s XOR lemma. There are a few known reductions in the related literature on worst-case to average-case reductions that are non-black-box. Specifically, the reductions of Gutfreund, Shaltiel and Ta-Shma (Computational Complexity 2007) and Hirahara (FOCS 2018)) are “class reductions” that are only guaranteed to succeed when given oracle access to an oracle D from some efficient class of algorithms. These works seem to circumvent some black-box impossibility results. In this paper, we extend the previous limitations of Grinberg, Shaltiel and Viola to several types of class reductions, giving evidence that class reductions cannot yield the desired improvements in Yao’s XOR lemma. To the best of our knowledge, this is the first limitation on reductions for hardness amplification that applies to class reductions. Our technique imitates the previous lower bounds for black-box reductions, replacing the inefficient oracle used in that proof, with an efficient one that is based on limited independence, and developing tools to deal with the technical difficulties that arise following this replacement.

Guruswami and Smith (J. ACM 2016) considered codes for channels that are poly-size circuits which modify at most a p-fraction of the bits of the codeword. This class of channels is significantly stronger than Shannon’s binary symmetric channel (BSC), but weaker than Hamming’s channels which are computationally unbounded. Guruswami and Smith gave an explicit Monte-Carlo construction of codes with optimal rate of R(p) = 1 − H(p) that achieve list-decoding in this scenario. Here, “explicit Monte-Carlo” means that both encoding and decoding algorithms run in polynomial time. However, the encoding and decoding algorithms also receive a uniformly chosen string of polynomial length (which is chosen and published, once and for all, in a pre-processing stage) and their correctness is guaranteed w.h.p. over this random choice. Guruswami and Smith asked whether it is possible to obtain uniquely decodable codes for poly-size channels with rate that beats the Gilbert-Varshamov bound $R^{GV}(p)=1-H(2p)$. We give an affirmative answer, Specifically:•For every $0\leq p\lt\frac{1}{4}$, we give an explicit Monte-Carlo construction of uniquely-decodable codes with optimal rate R(p) = 1 − H(p). This matches the rate achieved by Guruswami and Smith for the easier task of list-decoding, and also matches the capacity of binary symmetric channels. Moreover, this rate is strictly larger than that of codes for the standard coding scenario (namely, uniquely-decodable codes for Hamming channels).•Even ignoring explicitness, our result implies a characterization of the capacity of poly-size channels, which was not previously understood.Our technique builds on the earlier list-decodable codes of Guruswami and Smith, achieving unique-decoding by extending and modifying the construction so that we can identify the correct message in the list. For this purpose we use ideas from coding theory and pseudorandomness, specifically:•We construct codes for binary symmetric channels that beat the Gilbert-Varshamov bound, and are “evasive” in the sense that a poly-size circuit that receives a random (or actually pseudorandom) string, cannot find a codeword within relative distance 2p. This notion of evasiveness is inspired by the recent work of Shaltiel and Silbak (STOC 2021) on codes for space bounded channels.•We develop a methodology (that is inspired by proofs of t-wise independent tail inequalities, and may be of independent interest) to analyze random codes, in scenarios where the success of the channel is measured in an additional random experiment (as in the evasiveness experiment above).•We introduce a new notion of “small-set non-malleable codes” that is tailored for our application, and may be of independent interest.

The hardness vs. randomness paradigm aims to explicitly construct pseudorandom generators G:{0,1}^r → {0,1}^m that fool circuits of size m, assuming the existence of explicit hard functions. A "high-end PRG" with seed length r = O(log m) (implying BPP=P) was achieved in a seminal work of Impagliazzo and Wigderson (STOC 1997), assuming the high-end hardness assumption: there exist constants 0 < β < 1 < B, and functions computable in time 2^{B ⋅ n} that cannot be computed by circuits of size 2^{β ⋅ n}. Recently, motivated by fast derandomization of randomized algorithms, Doron et al. (FOCS 2020) and Chen and Tell (STOC 2021), construct "extreme high-end PRGs" with seed length r = (1+o(1))⋅ log m, under qualitatively stronger assumptions. We study whether extreme high-end PRGs can be constructed from the corresponding hardness assumption in which β = 1-o(1) and B = 1+o(1), which we call the extreme high-end hardness assumption. We give a partial negative answer: - The construction of Doron et al. composes a PEG (pseudo-entropy generator) with an extractor. The PEG is constructed starting from a function that is hard for MA-type circuits. We show that black-box PEG constructions from the extreme high-end hardness assumption must have large seed length (and so cannot be used to obtain extreme high-end PRGs by applying an extractor). To prove this, we establish a new property of (general) black-box PRG constructions from hard functions: it is possible to fix many output bits of the construction while fixing few bits of the hard function. This property distinguishes PRG constructions from typical extractor constructions, and this may explain why it is difficult to design PRG constructions. - The construction of Chen and Tell composes two PRGs: G₁:{0,1}^{(1+o(1)) ⋅ log m} → {0,1}^{r₂ = m^{Ω(1)}} and G₂:{0,1}^{r₂} → {0,1}^m. The first PRG is constructed from the extreme high-end hardness assumption, and the second PRG needs to run in time m^{1+o(1)}, and is constructed assuming one way functions. We show that in black-box proofs of hardness amplification to 1/2+1/m, reductions must make Ω(m) queries, even in the extreme high-end. Known PRG constructions from hard functions are black-box and use (or imply) hardness amplification, and so cannot be used to construct a PRG G₂ from the extreme high-end hardness assumption. The new feature of our hardness amplification result is that it applies even to the extreme high-end setting of parameters, whereas past work does not. Our techniques also improve recent lower bounds of Ron-Zewi, Shaltiel and Varma (ITCS 2021) on the number of queries of local list-decoding algorithms.

A binary code Enc:{0,1}^k → {0,1}ⁿ is (1/2-ε,L)-list decodable if for every w ∈ {0,1}ⁿ, there exists a set List(w) of size at most L, containing all messages m ∈ {0,1}^k such that the relative Hamming distance between Enc(m) and w is at most 1/2-ε. A q-query local list-decoder for Enc is a randomized procedure Dec that when given oracle access to a string w, makes at most q oracle calls, and for every message m ∈ List(w), with high probability, there exists j ∈ [L] such that for every i ∈ [k], with high probability, Dec^w(i,j) = m_i. We prove lower bounds on q, that apply even if L is huge (say L = 2^{k^{0.9}}) and the rate of Enc is small (meaning that n ≥ 2^{k}): - For ε = 1/k^{ν} for some constant 0 < ν < 1, we prove a lower bound of q = Ω(log(1/δ)/ε²), where δ is the error probability of the local list-decoder. This bound is tight as there is a matching upper bound by Goldreich and Levin (STOC 1989) of q = O(log(1/δ)/ε²) for the Hadamard code (which has n = 2^k). This bound extends an earlier work of Grinberg, Shaltiel and Viola (FOCS 2018) which only works if n ≤ 2^{k^ν} and the number of coins tossed by Dec is small (and therefore does not apply to the Hadamard code, or other codes with low rate). - For smaller ε, we prove a lower bound of roughly q = Ω(1/(√ε)). To the best of our knowledge, this is the first lower bound on the number of queries of local list-decoders that gives q ≥ k for small ε. Local list-decoders with small ε form the key component in the celebrated theorem of Goldreich and Levin that extracts a hard-core predicate from a one-way function. We show that black-box proofs cannot improve the Goldreich-Levin theorem and produce a hard-core predicate that is hard to predict with probability 1/2 + 1/𝓁^ω(1) when provided with a one-way function f:{0,1}^𝓁 → {0,1}^𝓁, where f is such that circuits of size poly(𝓁) cannot invert f with probability ρ = 1/2^√𝓁 (or even ρ = 1/2^Ω(𝓁)). This limitation applies to any proof by black-box reduction (even if the reduction is allowed to use nonuniformity and has oracle access to f).

We consider codes for space bounded channels. This is a model for communication under noise that was introduced by Guruswami and Smith (J. ACM 2016) and lies between the Shannon (random) and Hamming (adversarial) models. In this model, a channel is a space bounded procedure that reads the codeword in one pass, and modifies at most a p fraction of the bits of the codeword.

Let $\pi$ be an efficient two-party protocol that, given security parameter $\kappa$, both parties output single bits $X_\kappa$ and $Y_\kappa$, respectively. We are interested in how $(X_\kappa,Y_\kappa)$ “appears” to an efficient adversary that only views the transcript $T_\kappa$. We make the following contributions: (a) We develop new tools to argue about this loose notion and show (modulo some caveats) that for every such protocol $\pi$, there exists an efficient simulator such that the following holds: on input $T_\kappa$, the simulator outputs a pair $(X'_\kappa,Y'_\kappa)$ such that $(X'_\kappa,Y'_\kappa,T_\kappa)$ is (somewhat) computationally indistinguishable from $(X_\kappa,Y_\kappa,T_\kappa)$. (b) We use these tools to prove the following dichotomy theorem: every such protocol $\pi$ is either uncorrelated---it is (somewhat) indistinguishable from an efficient protocol whose parties interact to produce $T_\kappa$, but then choose their outputs independently from some product distribution (that is determined in poly-time from $T_\kappa$), or the protocol implies a key-agreement protocol (for infinitely many $\kappa$'s). Uncorrelated protocols are uninteresting from a cryptographic viewpoint, as the correlation between outputs is (computationally) trivial. Our dichotomy shows that every protocol is either completely uninteresting or implies key-agreement. (c) We use the above dichotomy to make progress on open problems on minimal cryptographic assumptions required for differentially private mechanisms for the XOR function. (d) A subsequent work [I. Haitner, N. Makriyannis, and E. Omri, in Theory of Cryptography Conference, Springer, Cham, Switzerland, 2018, pp. 539--562] uses the above dichotomy to makes progress on a long-standing open question regarding the complexity of fair two-party coin-flipping protocols. We also highlight the following two ideas regarding our technique: (a) The simulator algorithm is obtained by a carefully designed “competition” between efficient algorithms attempting to forecast $(X_\kappa,Y_\kappa)|_{T_\kappa=t}$. The winner is used to simulate the outputs of the protocol. (b) Our key-agreement protocol uses the simulation to reduce to an information theoretic setup and is, in some sense, a non-black-box.

We consider codes for space bounded channels. This is a model for communication under noise that was studied by Guruswami and Smith (J. ACM 2016) and lies between the Shannon (random) and Hamming (adversarial) models. In this model, a channel is a space bounded procedure that reads the codeword in one pass, and modifies at most a p fraction of the bits of the codeword. Guruswami and Smith, and later work by Shaltiel and Silbak (RANDOM 2016), gave constructions of listdecodable codes with rate approaching 1 - H(p) against channels with space s = clog n, with encoding/decoding time poly(2s) = poly(nc). In this paper we show that for every constant 00, there are codes with rate R ≥ 1 - H(p) - ε, list size poly(1/ε), and furthermore: . Our codes can handle channels with space s = nΩ(1), which is much larger than O(log n) achieved by previous work. . We give encoding and decoding algorithms that run in time n · polylog(n). Previous work achieved large and unspecified poly(n) time (even for space s = 1 · log n channels). . We can handle space bounded channels that read the codeword in any order, whereas previous work considered channels that read the codeword in the standard order. Our construction builds on the machinery of Guruswami and Smith (with some key modifications) replacing some nonconstructive codes and pseudorandom objects (that are found in exponential time by brute force) with efficient explicit constructions. For this purpose we exploit recent results of Haramaty, Lee and Viola (SICOMP 2018) on pseudorandom properties of “t-wise independence + low weight noise” which we quantitatively improve using techniques by Forbes and Kelly (FOCS 2018). To make use of such distributions, we give new explicit constructions of binary linear codes that have dual distance of nΩ(1), and are also polynomial time list-decodable from relative distance á1/2-ε, with list size poly(1/ε). To the best of our knowledge, no such construction was previously known. Somewhat surprisingly, we show that Reed-Solomon codes with dimension k <; √n, have this property if interpreted as binary codes (in some specific interpretation)which we term: “Raw Reed-Solomon Codes”. A key idea is viewing Reed-Solomon codes as “bundles” of certain dualBCH codewords.

We study how well can q-query decision trees distinguish between the following two distributions: (i) R = (R1,...,RN) that are i.i.d. indicator random variables, (ii) X=(R|R ϵ A) where A is an event s.t. Pr[R ϵ A] ≥ 2-a. We prove two lemmas: · Forbidden-set lemma: There exists B ⊆ [N] of size poly(a, q, 1/η) such that q-query trees that do not query variables in B cannot distinguish X from R with advantage η. · Fixed-set lemma: There exists B ⊆ [N] of size poly(a, q,1/η) and v ϵ0,1Bsuch that q-query trees do not distinguish (X|XB=v) from (R|RB=v) with advantage η. The first can be seen as an extension of past work by Edmonds, Impagliazzo, Rudich and Sgall (Computational Complexity 2001), Raz (SICOMP 1998), and Shaltiel and Viola (SICOMP 2010) to adaptive decision trees. It is independent of recent work by Meir and Wigderson (ECCC 2017) bounding the number of i ϵ [N] for which there exists a q-query tree that predicts Xifrom the other bits. We use the second, fixed-set lemma to prove lower bounds on black-box proofs for hardness amplification that amplify hardness from δ to 1/2-ϵ. Specifically: · Reductions must make q=Ω(log(1/δ)/ϵ2) queries, implying a "size loss factor" of q. We also prove the lower bound q=Ω(log(1/δ)/ϵ) for "error-less" hardness amplification proofs, and for direct-product lemmas. These bounds are tight. · Reductions can be used to compute Majority on Ω(1/ϵ) bits, implying that black box proofs cannot amplify hardness of functions that are hard against constant depth circuits (unless they are allowed to use Majority gates). Both items extend to pseudorandom-generator constructions. These results prove 15-year-old conjectures by Viola, and improve on three incomparable previous works (Shaltiel and Viola, SICOMP 2010; Gutfreund and Rothblum, RANDOM 2008; Artemenko and Shaltiel, Computational Complexity 2014).

Let π be an efficient two-party protocol that given security parameter k, both parties output single bits Xkand Yk, respectively. We are interested in how (Xk, Yk) "appears" to an efficient adversary that only views the transcript Tk. We make the following contributions: · We develop new tools to argue about this loose notion, and show (modulo some caveats) that for every such protocol π, there exists an efficient simulator such that the following holds: on input Tk, the simulator outputs a pair (X'k, Y'k) such that (X'k, Y'k, Tk) is (somewhat) computationally indistinguishable from (Xk, Yk, Tk). · We use these tools to prove the following dichotomy theorem: every such protocol π is: - either uncorrelated - it is (somewhat) indistinguishable from an efficient protocol whose parties interact to produce Tk, but then choose their outputs independently from some product distribution (that is determined in poly-time from Tk), - or, the protocol implies a key-agreement protocol (for infinitely many k's). Uncorrelated protocols are uninteresting from a cryptographic viewpoint, as the correlation between outputs is (computationally) trivial. Our dichotomy shows that every protocol is either completely uninteresting or implies key-agreement. ·We use the above dichotomy to make progress on open problems on minimal cryptographic assumptions required for differentially private mechanisms for the XOR function. · A subsequent work of Haitner et al. uses the above dichotomy to makes progress on a long-standing open question regarding the complexity of fair two-party coin-flipping protocols. We highlight the following ideas regarding our technique: · The simulator algorithm is obtained by a carefully designed "competition" between efficient algorithms attempting to forecast ((Xk, Yk)|Tk= t). The winner is used to simulate the outputs of the protocol. · Our key-agreement protocol uses the simulation to reduce to an information theoretic setup, and is in some sense non-black box.

A stochastic code is a pair of encoding and decoding procedures where Encoding procedure receives a k bit message m, and a d bit uniform string S. The code is (p,L)-list-decodable against a class C of "channel functions" from n bits to n bits, if for every message m and every channel C in C that induces at most $pn$ errors, applying decoding on the "received word" C(Enc(m,S)) produces a list of at most L messages that contain m with high probability (over the choice of uniform S). Note that both the channel C and the decoding algorithm Dec do not receive the random variable S. The rate of a code is the ratio between the message length and the encoding length, and a code is explicit if Enc, Dec run in time poly(n). Guruswami and Smith (J. ACM, to appear), showed that for every constants 0 < p < 1/2 and c>1 there are Monte-Carlo explicit constructions of stochastic codes with rate R >= 1-H(p)-epsilon that are (p,L=poly(1/epsilon))-list decodable for size n^c channels. Monte-Carlo, means that the encoding and decoding need to share a public uniformly chosen poly(n^c) bit string Y, and the constructed stochastic code is (p,L)-list decodable with high probability over the choice of Y. Guruswami and Smith pose an open problem to give fully explicit (that is not Monte-Carlo) explicit codes with the same parameters, under hardness assumptions. In this paper we resolve this open problem, using a minimal assumption: the existence of poly-time computable pseudorandom generators for small circuits, which follows from standard complexity assumptions by Impagliazzo and Wigderson (STOC 97). Guruswami and Smith also asked to give a fully explicit unconditional constructions with the same parameters against O(log n)-space online channels. (These are channels that have space O(log n) and are allowed to read the input codeword in one pass). We resolve this open problem. Finally, we consider a tighter notion of explicitness, in which the running time of encoding and list-decoding algorithms does not increase, when increasing the complexity of the channel. We give explicit constructions (with rate approaching 1-H(p) for every p <= p_0 for some p_0>0) for channels that are circuits of size 2^{n^{Omega(1/d)}} and depth d. Here, the running time of encoding and decoding is a fixed polynomial (that does not depend on d). Our approach builds on the machinery developed by Guruswami and Smith, replacing some probabilistic arguments with explicit constructions. We also present a simplified and general approach that makes the reductions in the proof more efficient, so that we can handle weak classes of channels.

Impagliazzo and Wigderson (STOC 1997) showed that if E=DTIME(2^O(n)) requires size 2^Omega(n) circuits, then every time T constant-error randomized algorithm can be simulated deterministically in time poly(T). However, such polynomial slowdown is a deal breaker when T=2^(alpha*n), for a constant alpha>0, as is the case for some randomized algorithms for NP-complete problems. Paturi and Pudlak (STOC 2010) observed that many such algorithms are obtained from randomized time T algorithms, for T < 2^o(n), with large one-sided error 1-epsilon, for epsilon=2^(-alpha*n), that are repeated 1/epsilon times to yield a constant-error randomized algorithm running in time T/epsilon=2^((alpha+o(1))*n). We show that if E requires size 2^Omega(n) nondeterministic circuits, then there is a poly(n)-time epsilon-HSG (Hitting-Set Generator) H:{0,1}^(O(log(n)) + log(1/epsilon) -> {0,1}^n, implying that time T randomized algorithms with one-sided error 1-epsilon can be simulated in deterministic time poly(T)/epsilon. In particular, under this hardness assumption, the fastest known constant-error randomized algorithm for k-SAT (for k > 3) by Paturi et al. (J. ACM 2005) can be made deterministic with essentially the same time bound. This is the first hardness versus randomness tradeoff for algorithms for NP-complete problems. We address the necessity of our assumption by showing that HSGs with very low error imply hardness for nondeterministic circuits with "few" nondeterministic bits. Applebaum et al. (CCC 2015) showed that "black-box techniques" cannot achieve poly(n)-time computable epsilon-PRGs (Pseudo-Random Generators) for epsilon=n^-omega(1), even if we assume hardness against circuits with oracle access to an arbitrary language in the polynomial time hierarchy. We introduce weaker variants of PRGs with relative error, that do follow under the latter hardness assumption. Specifically, we say that a function G:{0,1}^r -> {0,1}^n is an (epsilon,delta)-re-PRG for a circuit C if (1-epsilon)*Pr[C(U_n)=1] - delta < Pr[C(G(U_r)=1] < (1+epsilon)*Pr[C(U_n)=1] + delta. We construct poly(n)-time computable (epsilon,delta)-re-PRGs with arbitrary polynomial stretch, epsilon=n^-O(1) and delta=2^(-n^Omega(1)). We also construct PRGs with relative error that fool non-boolean distinguishers (in the sense introduced by Dubrov and Ishai (STOC 2006)). Our techniques use ideas from Paturi and Pudlak (STOC 2010), Trevisan and Vadhan (FOCS 2000), Applebaum et al. (CCC 2015). Common themes in our proofs are "composing" a PRG/HSG with a combinatorial object such as dispersers and extractors, and the use of nondeterministic reductions in the spirit of Feige and Lund (Comp. Complexity 1997).

We show that circuit lower bound proofs based on the method of random restrictions yield non-trivial compression algorithms for “easy” Boolean functions from the corresponding circuit classes. The compression problem is defined as follows: given the truth table of an n-variate Boolean function f computable by some unknown small circuit from a known class of circuits, find in deterministic time poly(2n) a circuit C (no restriction on the type of C) computing f so that the size of C is less than the trivial circuit size 2n/n. We get nontrivial compression for functions computable by AC0circuits, (de Morgan) formulas, and (read-once) branching programs of the size for which the lower bounds for the corresponding circuit class are known. These compression algorithms rely on the structural characterizations of “easy” functions, which are useful both for proving circuit lower bounds and for designing “meta-algorithms” (such as Circuit-SAT). For (de Morgan) formulas, such structural characterization is provided by the “shrinkage under random restrictions” results [52], [21], strengthened to the “high-probability” version by [48], [26], [33]. We give a new, simple proof of the “high-probability” version of the shrinkage result for (de Morgan) formulas, with improved parameters. We use this shrinkage result to get both compression and #SAT algorithms for (de Morgan) formulas of size about n2. We also use this shrinkage result to get an alternative proof of the recent result by Komargodski and Raz [33] of the average-case lower bound against small (de Morgan) formulas. Finally, we show that the existence of any non-trivial compression algorithm for a circuit class C ⊆ P/poly would imply the circuit lower bound NEXP ⊈ C. This complements Williams's result [55] that any non-trivial Circuit-SAT algorithm for a circuit class C would imply a superpolynomial lower bound against C for a language in NEXP1.

A sampling procedure for a distribution P over {0, 1}ℓ, is a function C: {0, 1}n → {0, 1}ℓ such that the distribution C(Un) (obtained by applying C on the uniform distribution Un) is the "desired distribution" P. Let n > r ≥ ℓ = nΩ(1). An nb-PRG (defined by Dubrov and Ishai (STOC 2006)) is a function G: {0, 1}r → {0, 1}n such that for every C: {0, 1}n → {0, 1}ℓ in some class of "interesting sampling procedures", C' (Ur) = C(G(Ur)) is close to C(Un) in statistical distance.

The hybrid argument allows one to relate the distinguishability of a distribution (from uniform) to the predictability of individual bits given a prefix. The argument incurs a loss of a factor k equal to the bit-length of the distributions: ε-distinguishability implies ε/k-predictability. This paper studies the consequences of avoiding this loss - what we call "beating the hybrid argument" -- and develops new proof techniques that circumvent the loss in certain natural settings. Specifically, we obtain the following results:

We construct an explicit disperser for affine sources over F2nwith entropy k = 2log0.9n= no(1). This is a polynomial time computable function D : F2n→ {0,1} such that for every affine space V of F2nthat has dimension at least k, D(V) = {0,1}. This improves the best previous construction of Ben-Sasson and Kopparty (STOC 2009) that achieved k = Ω(n4/5). Our technique follows a high level approach that was developed in Barak, Kindler, Shaltiel, Sudakov and Wigderson (J. ACM 2010) and Barak, Rao, Shaltiel and Wigderson (STOC 2006) in the context of dispersers for two independent general sources. The main steps are: · Adjust the high level approach to make it suitable for affine sources. · Implement a "challenge-response game" for affine sources (in the spirit of the two aforementioned papers that introduced such games for two independent general sources). · In order to implement the game, we construct extractors for affine block-wise sources. For this we use ideas and components by Rao (CCC 2009). · Combining the three items above, we obtain dispersers for affine sources with entropy larger than √n. We use a recursive win-win analysis in the spirit of Reingold, Shaltiel and Wigderson (SICOMP 2006) and Barak, Rao, Shaltiel and Wigderson (STOC 2006) to get affine dispersers with entropy less than √n.

Raz's parallel repetition theorem together with improvements of Holenstein shows that for any two-prover one-round game with value at most 1 - ∈ (for ∈ ≤ 1/2), the value of the game repeated n times in parallel on independent inputs is at most (1-∈)Ω(∈2n/ℓ)where ℓ is the answer length of the game. For free games (which are games in which the inputs to the two players are uniform and independent) the constant 2 can be replaced with 1 by a result of Barak, Rao, Raz, Rosen and Shaltiel. Consequently, n = O(tℓ/∈) repetitions suffice to reduce the value of a free game from 1 - ∈ to (1 - ∈)t, and denoting the input length of the game by m, if follows that nm = O(tℓm/∈) random bits can be used to prepare n independent inputs for the parallel repetition game. In this paper we prove a derandomized version of the parallel repetition theorem for free games and show that O(t(m+ℓ)) random bits can be used to generate correlated inputs such that the value of the parallel repetition game on these inputs has the same behavior. Thus, in terms of randomness complexity, correlated parallel repetition can reduce the value of free games at the "correct rate" when ℓ = O(m). Our technique uses strong extractors to "derandomize" a lemma of, and can be also used to derandomize a parallel repetition theorem of Parnafes, Raz and Wigderson for communication games in the special case that the game is free.

We present new explicit constructions of deterministic randomness extractors, dispersers and related objects. We say that a distribution X on binary strings of length n is a δ-source if X assigns probability at most 2 −δ n to any string of length n . For every δ>0, we construct the following poly( n )-time computable functions: 2-source disperser: D:({0, 1} n ) 2 → {0, 1} such that for any two independent δ-sources X 1 , X 2 we have that the support of D ( X 1 , X 2 ) is {0, 1}. Bipartite Ramsey graph: Let N =2 n . A corollary is that the function D is a 2-coloring of the edges of K N,N (the complete bipartite graph over two sets of N vertices) such that any induced subgraph of size N δ by N δ is not monochromatic. 3-source extractor: E :({0, 1} n ) 3 → {0, 1} such that for any three independent δ-sources X 1 , X 2 , X 3 we have that E ( X 1 , X 2 , X 3 ) is o (1)-close to being an unbiased random bit. No previous explicit construction was known for either of these for any δ<1/2, and these results constitute significant progress to long-standing open problems. A component in these results is a new construction of condensers that may be of independent interest: This is a function C :{0, 1} n → ({0, 1} n/c ) d (where c and d are constants that depend only on δ) such that for every δ-source X one of the output blocks of C(X) is (exponentially close to) a 0.9-source. (This result was obtained independently by Ran Raz.) The constructions are quite involved and use as building blocks other new and known objects. A recurring theme in these constructions is that objects that were designed to work with independent inputs, sometimes perform well enough with correlated, high entropy inputs. The construction of the disperser is based on a new technique which we call “the challenge-response mechanism” that (in some sense) allows “identifying high entropy regions” in a given pair of sources using only one sample from the two sources.

Hardness amplification is the fundamental task of converting a $\delta$-hard function $f:\{0,1\}^n\to\{0,1\}$ into a $(1/2-\epsilon)$-hard function $\mathit{Amp}(f)$, where f is $\gamma$-hard if small circuits fail to compute f on at least a $\gamma$ fraction of the inputs. In this paper we study the complexity of black-box proofs of hardness amplification. A class of circuits $\mathcal{D}$ proves a hardness amplification result if for any function h that agrees with $\mathit{Amp}(f)$ on a $1/2+\epsilon$ fraction of the inputs there exists an oracle circuit $D\in\mathcal{D}$ such that $D^h$ agrees with f on a $1-\delta$ fraction of the inputs. We focus on the case where every $D\in\mathcal{D}$ makes nonadaptive queries to h. This setting captures most hardness amplification techniques. We prove two main results: (1) The circuits in $\mathcal{D}$ “can be used” to compute the majority function on $1/\epsilon$ bits. In particular, when $\epsilon\leq1/\log^{\omega(1)}n$, $\mathcal{D}$ cannot consist of oracle circuits that have unbounded fan-in, size $\mathrm{poly}(n)$, and depth $O(1)$. (2) The circuits in $\mathcal{D}$ must make $\Omega\left(\log(1/\delta)/\epsilon^2\right)$ oracle queries. Both our bounds on the depth and on the number of queries are tight up to constant factors. Our results explain why hardness amplification techniques have failed to transform known lower bounds against constant-depth circuit classes into strong average-case lower bounds. Our results reveal a contrast between Yao's XOR lemma ($\mathit{Amp}(f):=f(x_1)\oplus\cdots\oplus f(x_t)\in\{0,1\}$) and the direct-product lemma ($\mathit{Amp}(f):=f(x_1)\circ\cdots\circ f(x_t)\in\{0,1\}^t$; here $\mathit{Amp}(f)$ is non-Boolean). Our results (1) and (2) apply to Yao's XOR lemma, whereas known proofs of the direct-product lemma violate both (1) and (2). One of our contributions is a new technique for handling “nonuniform” reductions, i.e., the case when $\mathcal{D}$ contains many circuits.

A simple averaging argument shows that given a randomized algorithm A and a function f such that for every input x, Pr[A(x) = f(x)] ges 1-p (where the probability is over the coin tosses of A), there exists a nonuniform deterministic algorithm B "of roughly the same complexity'' such that Pr[B(x) = f(x)] ges 1-p (where the probability is over a uniformly chosen input x). This implication is often referred to as "the easy direction of Yao's lemma'' and can be thought of as "weak derandomization'' in the sense that B is deterministic but only succeeds on most inputs. The implication follows as there exists a fixed value r' for the random coins of A such that "hardwiring r' into A'' produces a deterministic algorithm B. However, this argument does not give a way to explicitly construct B. In this paper we consider the task of proving uniform versions of the implication above. That is, how to explicitly construct a deterministic algorithm B when given a randomized algorithm A. We prove such derandomization results for several classes of randomized algorithms. These include: randomized communication protocols, randomized decision trees (here we improve a previous result by Zimand), randomized streaming algorithms and randomized algorithms computed by polynomial size constant depth circuits. Our proof uses an approach suggested by Goldreich and Wigderson and "extracts randomness from the input''. We show that specialized (seedless) extractors can produce randomness that is in some sense not correlated with the input. Our analysis can be applied to any class of randomized algorithms as long as one can explicitly construct the appropriate extractor. Some of our derandomization results follow by constructing a new notion of seedless extractors that we call "extractors for recognizable distributions'' which may be of independent interest.

Impagliazzo and Wigderson [Proceedings of the 39th Annual IEEE Symposium on Foundations of Computer Science, IEEE Computer Society, Washington, DC, 1998, pp. 734–743] proved a hardness versus randomness tradeoff for BPP in the uniform setting, which was subsequently extended to give optimal tradeoffs for the full range of possible hardness assumptions (in slightly weaker settings). Gutfreund, Shaltiel, and Ta-Shma [Comput. Complexity, 12 (2003), pp. 85–130] proved a uniform hardness versus randomness tradeoff for AM, but that result worked only on the “high end” of possible hardness assumptions. In this work, we give uniform hardness versus randomness tradeoffs for AM that are near-optimal for the full range of possible hardness assumptions. Following Gutfreund, Shaltiel, and Ta-Shma, we do this by constructing a hitting-set-generator (HSG) for AM with “resilient reconstruction.” Our construction is a recursive variant of the Miltersen–Vinodchandran HSG [Comput. Complexity, 14 (2005), pp. 256–279], the only known HSG construction with this required property. The main new idea is to have the reconstruction procedure operate implicitly and locally on superpolynomially large objects, using tools from PCPs (low-degree testing, self-correction) together with a novel use of extractors that are built from Reed–Muller codes for a sort of locally computable error-reduction. As a consequence we obtain gap theorems for AM (and AM $\cap$ coAM) that state, roughly, that either AM (or AM $\cap$ coAM) protocols running in time $t(n)$ can simulate all of EXP (“Arthur–Merlin games are powerful”) or else all of AM (or AM $\cap$ coAM) can be simulated in nondeterministic time $s(n)$ (“Arthur–Merlin games can be derandomized”) for a near-optimal relationship between $t(n)$ and $s(n)$. As in Gutfreund, Shatiel, and Ta-Shma, the case of AM $\cap$ coAM yields a particularly clean theorem that is of special interest due to the wide array of cryptographic and other problems that lie in this class.

In 1998, Impagliazzo and Wigderson [18] proved a hardnessvs. randomness tradeoff for BPP in the uniform setting,which was subsequently extended to give optimal tradeoffs for thefull range of possible hardness assumptions by Trevisan and Vadhan [29] (in a slightly weaker setting). In 2003, Gutfreund,Shaltiel and Ta-Shma [11] proved a uniform hardness vs. randomness tradeoff for AM, but that result only worked on the "high-end" of possible hardness assumptions.

We prove that if NP $${\nsubseteq}$$ BPP, i.e., if SAT is worst-case hard, then for every probabilistic polynomial-time algorithm trying to decide SAT, there exists some polynomially samplable distribution that is hard for it. That is, the algorithm often errs on inputs from this distribution. This is the first worst-case to average-case reduction for NP of any kind. We stress however, that this does not mean that there exists one fixed samplable distribution that is hard for all probabilistic polynomial-time algorithms, which is a pre-requisite assumption needed for one-way functions and cryptography (even if not a sufficient assumption). Nevertheless, we do show that there is a fixed distribution on instances of NP-complete languages, that is samplable in quasi-polynomial time and is hard for all probabilistic polynomial-time algorithms (unless NP is easy in the worst case). Our results are based on the following lemma that may be of independent interest: Given the description of an efficient (probabilistic) algorithm that fails to solve SAT in the worst case, we can efficiently generate at most three Boolean formulae (of increasing lengths) such that the algorithm errs on at least one of them.

Let C be a class of distributions over {0, 1}n. A deterministic randomness extractor for C is a function E : {0, 1}nrarr {0, 1}msuch that for any X in C the distribution E(X) is statistically close to the uniform distribution. A long line of research deals with explicit constructions of such extractors for various classes C while trying to maximize m. In this paper we give a general transformation that transforms a deterministic extractor E that extracts "few" bits into an extractor E' that extracts "almost all the bits present in the source distribution". More precisely, we prove a general theorem saying that if E and C satisfy certain properties, then we can transform E into an extractor E'. Our methods build on (and generalize) a technique of Gabizon, Raz and Shaltiel (FOCS 2004) that present such a transformation for the very restricted class C of "oblivious bit-fixing sources". Loosely speaking the high level idea is to find properties of E and C which allow "recycling" the output of E so that it can be "reused" to operate on the source distribution. An obvious obstacle is that the output of E is correlated with the source distribution. Using our transformation we give an explicit construction of a two-source extractor E : {0, 1}ntimes {0, 1}nrarr {0, 1}msuch that for every two independent distributions X1and X2over {0, 1}nwith min-entropy at least k = (1/2 + delta)n, E(X1, X2) is epsi-close to the uniform distribution on m = 2k - Cdeltalog(1/epsi) bits. This result is optimal except for the precise constant Cdeltaand improves previous results by Chor and Goldreich (SICOMP 1988), Vazirani (Combinatorica 1987) and Dodis et al. (RANDOM 2004). We also give explicit constructions of extractors for samplable distributions that extract many bits even out of "low-entropy" samplable distributions. This improves some previous results by Trevisan and Vadhan (FOCS 2000)

The main result of this paper is an explicit disperser for two independent sources on n bits, each of entropy k=no(1). Put differently, setting N=2n and K=2k, we construct explicit N x N Boolean matrices for which no K x K submatrix is monochromatic. Viewed as adjacency matrices of bipartite graphs, this gives an explicit construction of K-Ramsey bipartite graphs of size N.This greatly improves the previous bound of k=o(n) of Barak, Kindler, Shaltiel, Sudakov and Wigderson [4]. It also significantly improves the 25-year record of k = Õ (√n) on the special case of Ramsey graphs, due to Frankl and Wilson [9].The construction uses (besides "classical" extractor ideas) almost all of the machinery developed in the last couple of years for extraction from independent sources, including:

We study computational procedures that use both randomness and nondeterminism. Examples are Arthur-Merlin games and approximate counting and sampling of NP-witnesses. The goal of this paper is to derandomize such procedures under the weakest possible assumptions. Our main technical contribution allows one to "boost" a given hardness assumption. One special case is a proof that EXP /spl nsube/ NP/poly /spl rArr/ EXP /spl nsube/ P/sub /spl par///sup NP//poly. In words, if there is a problem in EXP that cannot be computed by poly-size nondeterministic circuits then there is one which cannot be computed by poly-size circuits that make non-adaptive NP oracle queries. This in particular shows that the various assumptions used over the last few years by several authors to derandomize Arthur-Merlin games (i.e., show AM = NP) are in fact all equivalent. In addition to simplifying the framework of AM derandomization, we show that this "unified assumption" suffices to de-randomize several other probabilistic procedures. For these results we define two new primitives that we regard as the natural pseudorandom objects associated with approximate counting and sampling of NP-witnesses. We use the "boosting" theorem and hashing techniques to construct these primitives using an assumption that is no stronger than that used to derandomize AM. As a consequence, under this assumption, there are deterministic polynomial time algorithms that use non-adaptive NP-queries and perform the following tasks: 1) approximate counting of NP-witnesses: given a Boolean circuit A, output r such that (1 - /spl epsi/)|A/sup -1/(1)| /spl les/ r les; |A/sup -1/(1)|. 2) pseudorandom sampling of NP-witnesses: given a Boolean circuit A, produce a polynomial-size sample space that is computationally indistinguishable from the uniform distribution over A/sup -1/(1). We also present applications. For example, we observe that Cai's proof that S/sub 2//sup p/ /spl sube/ ZPP/sup NP/ and the learning algorithm of Bshouty et al. can be seen as reductions to sampling that are not probabilistic. As a consequence they can be derandomized under the assumption stated above, which is weaker than the assumption that was previously known to suffice.

An $(n,k)$‐bit‐fixing source is a distribution X over $\{0,1\}^n$ such that there is a subset of k variables in $X_1,\ldots,X_n$ which are uniformly distributed and independent of each other, and the remaining $n-k$ variables are fixed. A deterministic bit‐fixing source extractor is a function $E:\{0,1\}^n \rightarrow \{0,1\}^m$ which on an arbitrary $(n,k)$‐bit‐fixing source outputs m bits that are statistically close to uniform. Recently, Kamp and Zuckerman [Proceedings of the 44th Annual IEEE Symposium on Foundations of Computer Science, 2003, pp. 92–101] gave a construction of a deterministic bit‐fixing source extractor that extracts $\Omega(k^2/n)$ bits and requires $k>\sqrt{n}$. In this paper we give constructions of deterministic bit‐fixing source extractors that extract $(1-o(1))k$ bits whenever $k>(\log n)^c$ for some universal constant $c>0$. Thus, our constructions extract almost all the randomness from bit‐fixing sources and work even when k is small. For $k \gg \sqrt{n}$ the extracted bits have statistical distance $2^{-n^{\Omega(1)}}$ from uniform, and for $k \le \sqrt{n}$ the extracted bits have statistical distance $k^{-\Omega(1)}$ from uniform. Our technique gives a general method to transform deterministic bit‐fixing source extractors that extract few bits into extractors which extract almost all the bits.

Extractors (as defined by Nisan and Zuckerman) are procedures that use a small number of truly random bits (called the seed) to extract many (almost) truly random bits from arbitrary distributions as long as distributions have sufficient (min)-entropy. A natural weakening of an extractor is a condenser, whose output distribution has a higher entropy rate than the input distribution (without losing much of the initial entropy). An extractor can be viewed as an ultimate condenser because it outputs a distribution with the maximal entropy rate. In this paper we construct explicit condensers with short seed length. The condenser constructions combine (variants of or more efficient versions of) ideas from several works, including the block extraction scheme of [N. Nisan and D. Zuckerman, J. Comput. System Sci., 52 (1996), pp. 43-52], the observation made in [A. Srinivasanand D. Zuckerman, SIAM J. Comput., 28 (1999), pp. 1433-1459; N. Nisan and A. Ta-Shma, J. Comput. System Sci., 58 (1999), pp. 148-173] that a failure of the block extraction scheme is also useful, the recursive "win-win" case analysis of [R. Impagliazzo, R. Shaltiel, and A. Wigderson, Near-optimal conversion of hardness into pseudo-randomness, in Proceedings of the 40th Annual IEEE Symposium on Foundations of Computer Science, IEEE, Los Alamitos, CA, 1999, pp. 181-190; R. Impagliazzo, R. Shaltiel, and A. Wigderson, Extractors and pseudo-random generators with optimal seed length, in Proceedings of the 32nd Annual ACM Symposium on Theory of Computing, ACM, New York, 2000, pp. 1-10], and the error correction of random sources used in [L. Trevisan, J. ACM, 48 (2001), pp. 860-879]. As a by-product (via repeated iterating of condensers), we obtain new extractor constructions. The new extractors give significant qualitative improvements over previous ones for sources of arbitrary min-entropy; they are nearly optimal simultaneously in the two main parameters of seed length and output length. Specifically, our extractors can make any one of these two parameters optimal (up to a constant factor) only at a polylogarithmic loss in the other. Previous constructions require polynomial loss in both cases for general sources. We also give a simple reduction converting "standard" extractors (which are good for an average seed) into "strong" ones (which are good for most seeds), with essentially the same parameters. With this reduction, all the above improvements apply to strong extractors as well.

We prove that if NP /spl nsube/ BPP, i.e., if some NP-complete language is worst-case hard, then for every probabilistic algorithm trying to decide the language, there exists some polynomially samplable distribution that is hard for it. That is, the algorithm often errs on inputs from this distribution. This is the first worst-case to average-case reduction for NP of any kind. We stress however, that this does not mean that there exists one fixed samplable distribution that is hard for all probabilistic polynomial time algorithms, which is a pre-requisite assumption needed for OWF and cryptography (even if not a sufficient assumption). Nevertheless, we do show that there is a fixed distribution on instances of NP-complete languages, that is samplable in quasi-polynomial time and is hard for all probabilistic polynomial time algorithms (unless NP is easy in the worst-case). Our results are based on the following lemma that may be of independent interest: Given the description of an efficient (probabilistic) algorithm that fails to solve SAT in the worst-case, we can efficiently generate at most three Boolean formulas (of increasing lengths) such that the algorithm errs on at least one of them.

A distribution X over binary strings of length n has min-entropy k if every string has probability at most 2-k in X. We say that X is a δ-source if its rate k⁄n is at least δ.We give the following new explicit instructions (namely, poly(n)- time computable functions) of deterministicextractors, dispersers and related objects. All work for any fixed rate δ>0. No previous explicit construction was known for either of these, for any δ‹1⁄2. The first two constitute major progress to very long-standing open problems.

A “randomness extractor” is an algorithm that given a sample from a distribution with sufficiently high min-entropy and a short random seed produces an output that is statistically indistinguishable from uniform. (Min-entropy is a measure of the amount of randomness in a distribution.) We present a simple, self-contained extractor construction that produces good extractors for all min-entropies. Our construction is algebraic and builds on a new polynomial-based approach introduced by Ta-Shma et al. [2001b]. Using our improvements, we obtain, for example, an extractor with output length m = k /(log n ) O (1/α) and seed length (1 + α)log n for an arbitrary 0 < α ≤ 1, where n is the input length, and k is the min-entropy of the input distribution.A “pseudorandom generator” is an algorithm that given a short random seed produces a long output that is computationally indistinguishable from uniform. Our technique also gives a new way to construct pseudorandom generators from functions that require large circuits. Our pseudorandom generator construction is not based on the Nisan-Wigderson generator [Nisan and Wigderson 1994], and turns worst-case hardness directly into pseudorandomness. The parameters of our generator match those in Impagliazzo and Wigderson [1997] and Sudan et al. [2001] and in particular are strong enough to obtain a new proof that P = BPP if E requires exponential size circuits.Our construction also gives the following improvements over previous work:---We construct an optimal “hitting set generator” that stretches O (log n ) random bits into s Ω(1) pseudorandom bits when given a function on log n bits that requires circuits of size s . This yields a quantitatively optimal hardness versus randomness tradeoff for both RP and BPP and solves an open problem raised in Impagliazzo et al. [1999].---We give the first construction of pseudorandom generators that fool nondeterministic circuits when given a function that requires large nondeterministic circuits. This technique also give a quantitatively optimal hardness versus randomness tradeoff for AM and the first hardness amplification result for nondeterministic circuits.

An {n, k)-bit-fixing source is a distribution X over {0, 1}/sup n/ such that there is a subset of k variables in X/sub 1/, ..., X/sub n/ which are uniformly distributed and independent of each other, and the remaining n - k variables are fixed. A deterministic bit-fixing source extractor is a function E : {0, l}/sup n/ /spl rarr/ {0, l}/sup m/ which on an arbitrary (n, k)-bit-fixing source outputs m bits that are statistically-close to uniform. Recently, Kamp and Zuckerman (2003) gave a construction of deterministic bit-fixing source extractor that extracts /spl Omega/(k/sup 2//n) bits, and requires k > /spl radic/n. In this paper we give constructions of deterministic bit-fixing source extractors that extract (1 -o(1))k bits whenever k > (log n)/sup c/ for some universal constant c > 0. Thus, our constructions extract almost all the randomness from bit-fixing sources and work even when k is small. For k /spl Gt/ /spl radic/n the extracted bits have statistical distance 2/sup -n/spl Omega/(1)/ from uniform, and for k /spl les/ /spl radic/n the extracted bits have statistical distance k/sup -/spl Omega/(1)/ from uniform. Our technique gives a general method to transform deterministic bit-fixing source extractors that extract few bits into extractors which extract almost all the bits.

Impagliazzo and Wigderson proved a uniform hardness vs. randomness "gap result" for BPP. We show an analogous result for AM: Either Arthur-Merlin protocols are very strong and everything in E=DTIME(2/sup O(n)/) can be proved to a subexponential time verifier, or else Arthur-Merlin protocols are weak and every language in AM has a polynomial time nondeterministic algorithm in the uniform average-case setting (i.e., it is infeasible to come up with inputs on which the algorithm fails). For the class AM/spl cap/coAM, we can remove the average-case clause and show under the same assumption that AM/spl cap/coAM=NP/spl cap/coNP. A new ingredient in our proof is identifying a novel resiliency property of hardness vs. randomness trade-offs. We observe that the Miltersen-Vinodchandran generator has this property.

A fundamental question of complexity theory is the direct product question. A famous example is Yao’s XOR-lemma, in which one assumes that some function f is hard on average for small circuits (meaning that every circuit of some fixed size s which attempts to compute f is wrong on a non-negligible fraction of the inputs) and concludes that every circuit of size s’ only has a small advantage over guessing randomly when computing $$ f^{\bigoplus k}(x_{1},...,x_{k}) = f(x_{1})\bigoplus...\bigoplus f(x_{k}) $$ on independently chosen $$ x_{1},...,x_{k} $$ . All known proofs of this lemma have the property that s’ < s . In words, the circuit which attempts to compute $$ f^{\bigoplus k} $$ is smaller than the circuit which attempts to compute f on a single input! This paper addresses the issue of proving strong direct product assertions, that is, ones in which $$ s' \approx ks $$ and is in particular larger than s. We study the question of proving strong direct product question for decision trees and communication protocols.

We prove (mostly tight) space lower bounds for "streaming" (or "on-line") computations of four fundamental combinatorial objects: error-correcting codes, universal hash functions, extractors, and dispersers. Streaming computations for these objects are motivated algorithmically by massive data set applications and complexity-theoretically by pseudorandomness and derandomization for space-bounded probabilistic algorithms. Our results reveal a surprising separation of extractors and dispersers in terms of the space required to compute them in the streaming model. While online extractors require space linear in their output length, we construct dispersers that are computable online with exponentially less space. We also present several explicit constructions of online extractors that match the lower bound. We show that online universal and almost-universal hash functions require space linear in their output length (this bound was known previously only for "pure" universal hash functions). Finally, we show that both online encoding and online decoding of error-correcting codes require space proportional to the product of the length of the encoded message and the code's relative minimum distance. Block encoding trivially matches the lower bounds for constant rate codes.

We present a simple, self-contained extractor construction that produces good extractors for all min-entropies (min-entropy measures the amount of randomness contained in a weak random source). Our construction is algebraic and builds on a new polynomial-based approach introduced by A. Ta-Shma et al. (2001). Using our improvements, we obtain, for example, an extractor with output length m=k/sup 1-/spl delta// and seed length O(log n). This matches the parameters of L. Trevisan's (1999) breakthrough result and additionally achieves those parameters for small min-entropies k. Our construction gives a much simpler and more direct solution to this problem. Applying similar ideas to the problem of building pseudo-random generators, we obtain a new pseudo-random generator construction that is not based on the NW generator (N. Nisan and A. Widgerson, 1994), and turns worst-case hardness directly into pseudo-randomness. The parameters of this generator are strong enough to obtain a new proof that P=BPP if E requires exponential size circuits. Essentially, the same construction yields a hitting set generator with optimal seed length that outputs s/sup /spl Omega/(1)/ bits when given a function that requires circuits of size s (for any s). This implies a hardness versus randomness trade off for RP and BPP that is optimal (up to polynomial factors), solving an open problem raised by R. Impagliazzo et al. (1999). Our generators can also be used to derandomize AM.

On an input probability distribution with some (min-)entropy an extractor outputs a distribution with a (near) maximum entropy rate (namely the uniform distribution). A natural weakening of this concept is a condenser, whose output distribution has a higher entropy rate than the input distribution (without losing much of the initial entropy). We construct efficient explicit condensers. The condenser constructions combine (variants or more efficient versions of) ideas from several works, including the block extraction scheme of Nisan and Zuckerman (1996), the observation made by Srinivasan and Zuckerman (1994) and Nisan and Ta-Schma (1999) that a failure of the block extraction scheme is also useful, the recursive "win-win" case analysis of Impagliazzo et al. (1999, 2000), and the error correction of random sources used by Trevisan (1999). As a natural byproduct, (via repeated iterating of condensers), we obtain new extractor constructions. The new extractors give significant qualitative improvements over previous ones for sources of arbitrary min-entropy; they are nearly optimal simultaneously in the main two parameters-seed length and output length. Specifically, our extractors can make any of these two parameters optimal (up to a constant factor), only at a poly-logarithmic loss in the other. Previous constructions require polynomial loss in both cases for general sources. We also give a simple reduction converting "standard" extractors (which are good for an average seed) to "strong " ones (which are good for mast seeds), with essentially the same parameters.

We give the first construction of a pseudo-random generator with optimal seed length that uses (essentially) arbitrary hardness.It builds on the novel recursive use of the NWgenerator in [8], which produced many optimal generators one of which was pseudo-random.This is achieved in two stages -first significantly reducing the number of candidate generators, and then efficiently combining them into one.We also give the first construction of an extractor with optimal seed length, that can handle sub-polynomial entropy levels.It builds on the fundamental connection between extractors and pseudo-random generators discovered by Trevisan [21], combined with construction above.Moreover, using Kolmogorov Complexity rather than circuit size in the analysis gives super-polynomial savings for our construction, and renders our extractors better than known for all entropy levels.

Various efforts have been made to derandomize probabilistic algorithms using the assumption that there exists a problem in E=dtime(2/sup O(n)/) that requires circuits of size s(n) (for some function s). These results are based on the NW (Nisan & Wigderson, 1997) generator. For the strong lower bound s(n)=2/sup ϵn/, the optimal derandomization is P=BPP. However, for weaker lower bound functions s(n), these constructions fall short of the natural conjecture for optimal derandomization that bptime(t)⊆ dtime(2O[s/sup -1/(t)]). The gap is due to an inherent efficiency limitation in NW-style pseudorandom generators. We are able to obtain derandomization in almost optimal time using any lower bound s(n). We do this by using the NW-generator in a more sophisticated way. We view any failure of the generator as a reduction from the given hard function to its restrictions on smaller input sizes. Thus, either the original construction works optimally or one of the restricted functions is as hard as the original. Any such restriction can then be plugged into the NW-generator recursively. This process generates many candidate generators, and at least one is guaranteed to be good. To perform the approximation of the acceptance probability of the given circuit, we run a tournament between the candidate generators which yields an accurate estimate. We explore information theoretic analogs of our new construction. The inherent limitation of the NW-generator makes the extra randomness required by that extractor suboptimal. However, applying our construction, we get an almost optimal disperser.