1. If NP languages are hard on the worst-case then it is easy to find their hard instances Danny Gutfreund, Hebrew U. Ronen Shaltiel, Haifa U. Amnon Ta-Shma, Tel-Aviv U.

2. What is this talk about? Let s assume PNP. Problem: Finding hard instances Input: poly-time algorithm DSAT (that is attempting to Decide SAT). Output: hard instance for DSAT A formula x on which DSAT(x)SAT(x). Formulaes x 1,..,x 6 s.t. x i with DSAT(x i )SAT(x i ). A samplable distribution D s.t. Pr x D [DSAT(x)=SAT(x)]<<1 How difficult is this problem?

3. Outline of talk Main result: Finding hard instances in poly-time assuming only worst case hardeness. Version for deterministic algorithms assuming PNP. Version for randomized algorithms assuming RPNP. Two interpretations: A weak form of worst case to average case reduction. Limitation on SAT solving heuristics. Proof of version for deterministic algorithms.

4. Part 1: Statement of result

5. We design an algorithm FIND which on input: DSAT - code of a poly-time (detereministic) alg. n - an input length. Runs in time poly(n). If PNP then for infinitely many n s FIND(DSAT,n) produces formulae x 1,..,x 6 s.t. x i with DSAT(x i )SAT(x i ). In particular, sampling one formula gives a samplable distribution on instances of length n on which DSAT succeeds with prob < 5/6. Finding hard instances for deterministic poly-time algorithms

6. We design a randomized algorithm FIND which on: DSAT - code of a poly-time (randomized) alg. n - an input length. Runs in time poly(n). If RPNP then for infinitely many n s FIND(DSAT,n) We produce a samplable distribution on instances of length n on which DSAT succeeds with prob < 97/100. Finding hard instances for randomized poly-time algorithms

7. Part 2: Interpretation

8. NP is hard on average Generating hard instances Generate distribution D on formulae of length n: For every poly-time algorithm DSAT: Pr x D [DSAT(x)=SAT(x)]<<1 Necessary for Cryptography! Finding hard instances and generating hard instances. RPNP Finding hard instances Given poly-time algorithm DSAT Generate distribution D on formulae of length n: Pr x D [DSAT(x)=SAT(x)]<<1 Our result Levin s definition Open problem: worst case to average case reduction. Interpretation: Weak form of worst case to average case reduction. Negative results: [FF91,BT03,Vio03]

9. Worst case to average case reductions Our result: Goal: 2 nd result: in super-polynomial time Weak form of Generating hard instances.

10. Perspective: Impagliazzo s worlds Algorithmica: NP is easy on the worst-case Heuristica: NP hard on the worst-case but easy on the avg. Pessiland: NP hard on the avg, but no OWF. Minicrypt: OWF, but no public-key crypto. Cryptomania: Public-key cryptography. Generate hard instances Find hard instances our result:

11. Interpretation: limitation on SAT solving heuristics Algorithmica: NP is easy on the worst-case Heuristica: NP hard on the worst-case but easy on the avg. Pessiland: NP hard on the avg, but no OWF. Minicrypt: OWF, but no public-key crypto. Cryptomania: Public-key cryptography. Find hard instances Our result: Suppose we live in Heuristica. NP is easy on average. SAT solving heuristics on real-life inputs. The best we can hope for is that in Heuristica: There exists a SAT solver DSAT that is does well on all samplable distributons. Even in Heuristica, SAT solving heuristics have to be bound to specific samplable distributions.

12. Part 3: Proof

13. Proof of main result: (deterministic case) Assume PNP. Find hard instances Input: poly-time algorithm DSAT and input length n on which DSAT fails to decide SAT. Output: 3 formulae x 1,x 2,x 3 s.t. x i on which DSAT(x i )SAT(x i ). Main idea: Use the code of DSAT to find hard instances. Apply DSAT on a formula encoding the statement:DSAT fails to solve SAT.

14. Special case: Search algorithms A search algorithm for SAT is an algorithm SSAT which given a formula x: Either answers no (that x isn t satisfiable). Or answers yes (that x is satisfiable) and in that case it needs to provide a satisfying assignment. SSAT never errs when it answers yes. SSAT errs only on x s s.t.: SAT(x)= yes and SSAT(x) yes.

15. Proof for search algorithms Given search algorithm SSAT and input length n: Consider the following statement: y n = x {0,1} n : SAT(x)= yes and SSAT(x) yes. SSAT fails to decide SAT on length n => y n is true. Deciding y n is in NP (and thus can be reduced to SAT). Run SSAT(y n ): If SSAT answers no then y n is a hard instance. If SSAT answers yes then it outputs a witness x for y n and x is a hard instance. We find a hard instance in both cases!

16. Search to decision reduction (self reducibility of SAT) Algorithm SSAT: Given formula x. If DSAT(x)= no answer no. Otherwise consider formulae x 0,x 1 (constructed by setting first variable to 0/1). Run DSAT(x 0 ) and DSAT(x 1 ). Repeat on one that is answered yes. If both x 0,x 1 are answered by no then (x,x 0,x 1 ) contain a hard instance. If all variables are set: obtain a satisfying assignment for original input and answer yes.

17. Proof for decision algorithms Given decision algorithm DSAT and input length n: Consider the following statement: y n = x {0,1} n : SAT(x)= yes and SSAT(x) yes. SSAT fails to decide SAT on length n => y n is true. Deciding y n is in NP (and thus can be reduced to SAT). Run SSAT(y n ): If SSAT catches DSAT then we find hard instances. If SSAT answers no then y n is a hard instance. If SSAT answers yes then it outputs a witness x for y n and x is a hard instance. x is a hard instance for SSAT not necessarily hard for DSAT

18. Proof for decision algorithms Given decision algorithm DSAT and input length n: Consider the following statement: y n = x {0,1} n : SAT(x)= yes and SSAT(x) yes. If SSAT(y n )= yes then SSAT outputs a witness x for y n and x is a hard instance for SSAT. Run SSAT(x) We know that SSAT(x) does not answer yes ! If SSAT catches DSAT then we find hard instances. If SSAT answers no then DSAT answers no and thus x is a hard instance. The proof of the randomized case goes along same lines using more complex case analysis

19. Conclusions and open problems When given randomized DSAT we obtain a samplable distribution on which DSAT succeeds with probability < 97/100. Open problem: Hardness amplification to ½ +ε. The situation is even worse when we switch quantifiers. Our FIND algorithm is non-black box in DSAT: It relies on the code of DSAT. Can such ideas be used to bypass the limitations on worst case to average case reductions pointed out by [FF91,BT03,Vio03]? Our FIND algorithm does not prove that DSAT is incorrect. (What if NP=P).

20. That s it … Thank You!