Pseudorandomness
when the odds are against you
Sergei Artemenko, U. Haifa
Russell Impagliazzo, UCSD
Valentine Kabanets, SFU
Ronen Shaltiel, U. Haifa
Hardness versus randomness
[BM,Yao,NW,BFNW,IW,KvM,MV,SU]
Under Plausible hardness assumptions
Hardness Assumption: b>0 and L∈E=DTIME(2O(n)) s.t.
for every large enough n, size 2bn circuits
fail to solve L on inputs of length n.
[IW]
Randomized algorithms can be efficiently derandomized.
Conclusion: BPP=P, every randomized algorithm that:


Runs in time T(n)
Has constant success probability (can be two sided)
Can be simulated in time poly(T(n)).
Polynomial slowdown is sometimes a deal breaker!
Randomized exponential time
algorithms for k-SAT
k-SAT solvers in literature run in time 𝑇𝑘 𝑛 = 2𝛼𝑘 ⋅𝑛
for constant (0 < 𝛼𝑘 < 1) s.t. lim 𝛼𝑘 = 1
𝑘→∞
For k>3, best known algorithms are randomized [PPSZ].
Can we derandomize by hardness vs. randomness?
Naïve approach ⇒ trivial time: poly 𝑇𝑘 𝑛
Goal: negligible slowdown: 𝑇𝑘 𝑛 ⋅ 2𝑜
𝑛
= 2𝑂
𝛼𝑘 ⋅𝑛
> 2𝑛
= 2(𝛼𝑘 +𝑜(1))⋅𝑛
We show: PPSZ can be efficiently derandomized with
negligible slowdown under plausible assumptions.
First use of hardness vs. randomness for NP-problems.
OPaP-algorithms: Paturi-Pudlak
Dfn: A randomized algorithm A(x,y) is 𝜖-OPaP for L if
it runs in time 𝑡 𝑛 = 2𝑜 𝑛 , and for every x:

𝑥 ∈ 𝐿 ⇒ Pr 𝐴 𝑥, 𝑦 = 1 ≥ ϵ

𝑥 ∉ 𝐿 ⇒ Pr 𝐴 𝑥, 𝑦 = 1 = 0
𝑦
𝑦
Paturi-Pudlak: Many k-SAT solvers (e.g. PPSZ) are
based on OPaP algorithms with 𝜖𝑘 𝑛 = 2−𝛼𝑘 ⋅𝑛 .
Constant error randomized algorithms obtained by
1
running A,
= 2𝛼𝑘 ⋅𝑛 times, yielding final running
𝜖𝑘 𝑛
time: 𝑇𝑘 𝑛 = 𝑡𝑘 𝑛 ⋅ 2𝛼𝑘 ⋅𝑛 = 2(𝛼𝑘 +𝑜(1))⋅𝑛 .
This work: Derandomize OPaP algorithms.
Standard
assumption:
Result: Hardness
versus
randomness
Scaled, nonuniform EXP ≠ NP
for OPaP algorithms
Implies AM=NP [MV,SU]
Under Plausible hardness assumptions
Hardness Assumption: b>0 and L∈E=DTIME(2O(n)) s.t.
for every large enough
n, size 2inbnthe
circuits
Best possible,
sense that
nondeterministic
circuits
even
the
weaker
goal
of
fail to solve L on inputs of length n.
obtaining
a randomized constant
[IW] Our results
error alg takes the same time.
Randomized algorithms can be efficiently derandomized.
Conclusion: every randomized algorithm that:


Runs in time T(n)
one-sided error, success prob ≥ 𝜖(𝑛)
Has constant success probability (can be two sided)
Can be simulated in time
𝑝𝑜𝑙𝑦 𝑇 𝑛
𝑇 𝑛
poly(T(n)).
𝑝𝑜𝑙𝑦(
)
𝜖 𝑛
𝜖 𝑛
For OPAP (e.g. PPSZ): time 2𝑜
𝑛
/𝜖 𝑛 = 2(𝛼𝑘 +𝑜(1))⋅𝑛
Derandomization 101
Let 𝐶: 0,1


𝑛
→ 0,1 be a circuit. 𝐺: 0,1
𝑟
→ 0,1
n
is
𝜖-PRG for C if | Pr 𝐶 𝐺 𝑈𝑟 = 1 − Pr 𝐶 𝑈𝑛 = 1 | ≤ 𝜖
𝜖-HSG for C if Pr 𝐶 𝑈𝑛 = 1 > 𝜖 ⇒ ∃𝑠: 𝐶 𝐺 𝑠 = 1.
PRGs/HSGs for linear circuits ⇒ deterministic simulation
of rand algs.
Deterministic time = 2𝑟 ⋅ 𝑇𝑖𝑚𝑒 𝐺 ⋅ 𝑇𝑖𝑚𝑒(𝐴𝑙𝑔).
To handle algs with small success prob/large error:

Short seed, preferably 𝑟 ≈ log 1 /𝜖 so that 2𝑟 = 1/𝜖.

Efficient generators, 𝑇𝑖𝑚𝑒 𝐺 = poly(n) = 𝑜
Can we construct such PRGs/HSGs?
Under what assumptions?
1
𝜖
.
Hardness
for
Deterministic
circuits
¼-PRG
time poly(n)
seed: O(log n) [IW97]
𝐵𝑃𝑇𝐼𝑀𝐸1/4 𝑇
⊆ 𝐷𝑇𝐼𝑀𝐸(𝑝𝑜𝑙𝑦(𝑇))
𝜖-HSG
Impossible*
[SV08,AS11]
Nondeterministic circuits
PH-circuits
This work.
1
seed: 𝑂(log 𝑛) + 1 ⋅ log
𝜖
𝑝𝑜𝑙𝑦 𝑇
𝑅𝑇𝐼𝑀𝐸𝜖 𝑇 ⊆ 𝐷𝑇𝐼𝑀𝐸(
)
𝜖
𝜖-PRG
Impossible*
Impossible*
*Impossible for[SV08,AS11]
black box reductions.
Impossible*
[AASY15]
½ vs ½+𝜖
Impossible*
Impossible* [AASY15]
Thm: 𝜖-HSG ⇔[SV08,AS11]
¼-HSG for nondeterministic circuits that use log
PRG
1
𝜖
[AASY15]
Impossible* [AASY15]
nondeterministic bits.
𝜖 vs 2𝜖
This work.
Corrolary:
𝜖-HSG
⇒
hardness
for
nondeterministic
circuits that𝑝𝑜𝑙𝑦
use 𝑇few nondeterministic bits.
derandomization
𝐵𝑃𝑇𝐼𝑀𝐸𝜖,2𝜖 𝑇 ⊆ 𝐷𝑇𝐼𝑀𝐸(
𝜖 vs 2𝜖
PRG
Impossible*
[SV08,AS11]
𝜖2
)
This work.
Hardness vs. Σ3 -circuits.
seed: 𝑂 log 𝑛 +
𝜖 vs 2𝜖
Impossible*
[SV08,AS11]
PRG for
circuits that
output ℓ bits
1 2
log
𝜖
This work.
Hardness vs. Σ6 -circuits.
seed: ℓ + 𝑂 log 𝑛 + log
1 2
𝜖
Hardness
for
Deterministic
circuits
¼-PRG
time poly(n)
seed: O(log n) [IW97]
𝐵𝑃𝑇𝐼𝑀𝐸1/4 𝑇
⊆ 𝐷𝑇𝐼𝑀𝐸(𝑝𝑜𝑙𝑦(𝑇))
𝜖-HSG
Impossible*
[SV08,AS11]
Nondeterministic circuits
PH-circuits
This work.
1
seed: 𝑂(log 𝑛) + 1 ⋅ log
𝜖
𝑝𝑜𝑙𝑦 𝑇
𝑅𝑇𝐼𝑀𝐸𝜖 𝑇 ⊆ 𝐷𝑇𝐼𝑀𝐸(
)
𝜖
𝜖-PRG
Impossible*
Impossible*
*Impossible for[SV08,AS11]
black box reductions.
½ vs ½+𝜖
Impossible*
Impossible*
[SV08,AS11]
PRG
𝜖 vs 2𝜖
Impossible*
[AASY15]
[AASY15]
Impossible*
[AASY15]
This work.
derandomization
𝜖 vs 2𝜖
PRG
[AASY15]
𝐵𝑃𝑇𝐼𝑀𝐸𝜖,2𝜖 𝑇 ⊆ 𝐷𝑇𝐼𝑀𝐸(
Impossible*
[SV08,AS11]
𝑝𝑜𝑙𝑦 𝑇
)
𝜖2
This work.
Hardness vs. Σ3 -circuits.
seed: 𝑂 log 𝑛 +
𝜖 vs 2𝜖
Impossible*
[SV08,AS11]
PRG for
circuits that
output ℓ bits
1 2
log
𝜖
This work.
Hardness vs. Σ6 -circuits.
seed: ℓ + 𝑂 log 𝑛 + log
1 2
𝜖
Nondeterministic circuits
Hardness
for
Deterministic
circuits
¼-PRG
time poly(n)
seed: O(log n) [IW97]
𝐵𝑃𝑇𝐼𝑀𝐸1/4 𝑇
⊆ 𝐷𝑇𝐼𝑀𝐸(𝑝𝑜𝑙𝑦(𝑇))
𝜖-HSG
Impossible*
PH-circuits
This work.
1
seed: 𝑂(log 𝑛) + 1 ⋅ log
[SV08,AS11]
𝜖
𝑝𝑜𝑙𝑦 𝑇
𝑅𝑇𝐼𝑀𝐸𝜖 𝑇 ⊆ 𝐷𝑇𝐼𝑀𝐸(
)
𝜖
𝜖-PRG
Impossible*
Impossible*
[AASY15]
Impossible*
[AASY15]
½ vs ½+𝜖
PRG
Impossible*
Impossible*
[AASY15]
Impossible*
[AASY15]
[SV08,AS11]
[SV08,AS11]
𝜖 vs 2𝜖
This work.
*Impossible
for
black
box
reductions.
derandomization
𝐵𝑃𝑇𝐼𝑀𝐸𝜖,2𝜖 𝑇 ⊆ 𝐷𝑇𝐼𝑀𝐸(
A 𝛼1 vs 𝛼2 PRG is a 𝐺: 0,1
𝜖 vs 2𝜖
PRG
Impossible*
𝑟
→ 0,1
n s.t.
𝑝𝑜𝑙𝑦 𝑇
)
𝜖2
for every small circuit C:
[SV08,AS11]
Pr 𝐶 𝑈𝑛 = 1 ≤ 𝛼1 ⇒ Pr 𝐶 𝐺 𝑈𝑟
𝜖-PRG is 𝛼 vs 𝛼 + 𝜖 PRG for every 𝛼.
𝜖 vs 2𝜖
Impossible*
[SV08,AS11]
PRG for
Can we get PRGs/Derandomization
circuits that
output ℓ bits
for small 𝛼, 𝜖?
This work.
= 1 Hardness
≤ 𝛼2 . vs. Σ3-circuits. 2
seed: 𝑂 log 𝑛 + log
1
𝜖
This work.
Hardness vs. Σ6 -circuits.
seed: ℓ + 𝑂 log 𝑛 + log
1 2
𝜖
Nondeterministic circuits
Hardness
for
Deterministic
circuits
¼-PRG
time poly(n)
seed: O(log n) [IW97]
𝐵𝑃𝑇𝐼𝑀𝐸1/4 𝑇
⊆ 𝐷𝑇𝐼𝑀𝐸(𝑝𝑜𝑙𝑦(𝑇))
𝜖-HSG
Impossible*
PH-circuits
This work.
1
seed: 𝑂(log 𝑛) + 1 ⋅ log
[SV08,AS11]
𝜖
𝑝𝑜𝑙𝑦 𝑇
𝑅𝑇𝐼𝑀𝐸𝜖 𝑇 ⊆ 𝐷𝑇𝐼𝑀𝐸(
)
𝜖
𝜖-PRG
Impossible*
Impossible*
[AASY15]
Impossible*
[AASY15]
½ vs ½+𝜖
PRG
Impossible*
Impossible*
[AASY15]
Impossible*
[AASY15]
[SV08,AS11]
[SV08,AS11]
𝜖 vs 2𝜖
This work.
derandomization
A 𝛼1 vs 𝛼2 PRG is a 𝐺: 0,1
𝜖 vs 2𝜖
PRG
Pr 𝐶 𝑈𝑛
Impossible*
𝑟
𝑇
→ 𝐵𝑃𝑇𝐼𝑀𝐸
0,1 n𝜖,2𝜖
s.t.𝑇 for
every𝑝𝑜𝑙𝑦
small
⊆ 𝐷𝑇𝐼𝑀𝐸(
) circuit C:
2
𝜖
= 1 ≤ 𝛼1 ⇒ Pr 𝐶 𝐺 𝑈𝑟
[SV08,AS11]
𝜖-PRG is 𝛼 vs 𝛼 + 𝜖 PRG for every 𝛼.
we get Impossible*
PRGs/Derandomization
𝜖Can
vs 2𝜖
[SV08,AS11]
PRG for
circuits that
output ℓ bits
for small 𝛼, 𝜖?
= 1 This
≤ 𝛼work.
2.
Hardness vs. Σ3 -circuits.
seed: 𝑂 log 𝑛 +
1 2
log
𝜖
This work.
Hardness vs. Σ6 -circuits.
seed: ℓ + 𝑂 log 𝑛 + log
1 2
𝜖
Nondeterministic circuits
Hardness
for
Deterministic
circuits
¼-PRG
time poly(n)
seed: O(log n) [IW97]
𝐵𝑃𝑇𝐼𝑀𝐸1/4 𝑇
⊆ 𝐷𝑇𝐼𝑀𝐸(𝑝𝑜𝑙𝑦(𝑇))
𝜖-HSG
Impossible*
PH-circuits
This work.
1
seed: 𝑂(log 𝑛) + 1 ⋅ log
[SV08,AS11]
𝜖
𝑝𝑜𝑙𝑦 𝑇
𝑅𝑇𝐼𝑀𝐸𝜖 𝑇 ⊆ 𝐷𝑇𝐼𝑀𝐸(
)
𝜖
𝜖-PRG
Impossible*
Impossible*
[AASY15]
Impossible*
[AASY15]
½ vs ½+𝜖
PRG
Impossible*
Impossible*
[AASY15]
Impossible*
[AASY15]
[SV08,AS11]
[SV08,AS11]
𝜖 vs 2𝜖
This work.
derandomization
𝜖A vs
𝛼12𝜖vs
PRG
𝐵𝑃𝑇𝐼𝑀𝐸𝜖,2𝜖 𝑇 ⊆ 𝐷𝑇𝐼𝑀𝐸(
Impossible*
𝛼2 PRG
is a 𝐺: 0,1
[SV08,AS11]
𝑟
→ 0,1
n s.t.
𝑝𝑜𝑙𝑦 𝑇
)
𝜖2
This work.
for every small circuit
C:
Pr 𝐶 𝑈𝑛 = 1 ≤ 𝛼1 ⇒ Pr 𝐶 𝐺 𝑈𝑟
𝜖𝜖-PRG
vs 2𝜖 is 𝛼 vs
Impossible*
𝛼 + 𝜖 PRG
[SV08,AS11]
PRG for
circuits that
output ℓ bits
for every 𝛼.
Hardness vs. Σ3 -circuits.
= 1 seed:
≤ 𝛼2𝑂.
log 𝑛 +
1 2
log
𝜖
This work.
Hardness vs. Σ6 -circuits.
seed: ℓ + 𝑂 log 𝑛 + log
1 2
𝜖
Hardness
for
Deterministic
circuits
¼-PRG
time poly(n)
seed: O(log n) [IW97]
𝐵𝑃𝑇𝐼𝑀𝐸1/4 𝑇
⊆ 𝐷𝑇𝐼𝑀𝐸(𝑝𝑜𝑙𝑦(𝑇))
𝜖-HSG
Impossible*
[SV08,AS11]
Nondeterministic circuits
PH-circuits
This work.
1
seed: 𝑂(log 𝑛) + 1 ⋅ log
𝜖
𝑝𝑜𝑙𝑦 𝑇
𝑅𝑇𝐼𝑀𝐸𝜖 𝑇 ⊆ 𝐷𝑇𝐼𝑀𝐸(
)
𝜖
𝜖-PRG
Impossible*
Impossible*
[AASY15]
Impossible*
[AASY15]
½ vs ½+𝜖
PRG
Impossible*
Impossible*
[AASY15]
Impossible*
[AASY15]
[SV08,AS11]
[SV08,AS11]
𝜖 vs 2𝜖
This work.
derandomization
𝜖 vs 2𝜖
PRG
𝐵𝑃𝑇𝐼𝑀𝐸𝜖,2𝜖 𝑇 ⊆ 𝐷𝑇𝐼𝑀𝐸(
Impossible*
[SV08,AS11]
𝑝𝑜𝑙𝑦 𝑇
)
𝜖2
This work.
Hardness vs. Σ3 -circuits.
seed: 𝑂 log 𝑛 +
𝜖 vs 2𝜖
Impossible*
[SV08,AS11]
nb-PRG for
circuits that
output ℓ bits
1 2
log
𝜖
This work.
Hardness vs. Σ6 -circuits.
seed: ℓ + 𝑂 log 𝑛 + log
1 2
𝜖
Deterministic
Nondeterministic
Hardness
A 𝛼1 vs 𝛼2 nb-PRG
[DI06,AS14,AASY15]
is a 𝐺: 0,1 𝑟circuits
→ 0,1 n s.t.PH-circuits
circuits
for
𝑛
ℓ
ℓ
for every small circuit 𝐶: 0,1
¼-PRG
time poly(n)
seed: O(log n) [IW97]
Pr
𝐷(𝐶 1/4
𝑈𝑛𝑇) = 1
𝐵𝑃𝑇𝐼𝑀𝐸
⊆ 𝐷𝑇𝐼𝑀𝐸(𝑝𝑜𝑙𝑦(𝑇))
𝜖-HSG
Impossible*
[SV08,AS11]
→ 0,1 , and any function 𝐷: 0,1
→ {0,1}
≤ 𝛼1 ⇒ Pr 𝐷(𝐶 𝐺 𝑈𝑟 ) = 1 ≤ 𝛼2 .
This work.
1
seed: 𝑂(log 𝑛) + 1 ⋅ log
𝜖
𝑝𝑜𝑙𝑦 𝑇
𝑅𝑇𝐼𝑀𝐸𝜖 𝑇 ⊆ 𝐷𝑇𝐼𝑀𝐸(
)
𝜖
𝜖-PRG
Impossible*
Impossible*
[AASY15]
Impossible*
[AASY15]
½ vs ½+𝜖
PRG
Impossible*
Impossible*
[AASY15]
Impossible*
[AASY15]
[SV08,AS11]
[SV08,AS11]
𝜖 vs 2𝜖
This work.
derandomization
𝜖 vs 2𝜖
PRG
𝐵𝑃𝑇𝐼𝑀𝐸𝜖,2𝜖 𝑇 ⊆ 𝐷𝑇𝐼𝑀𝐸(
Impossible*
[SV08,AS11]
𝑝𝑜𝑙𝑦 𝑇
)
𝜖2
This work.
Hardness vs. Σ3 -circuits.
seed: 𝑂 log 𝑛 +
𝜖 vs 2𝜖
Impossible*
[SV08,AS11]
PRG
for for
nb-PRG
circuits that
output ℓ bits
1 2
log
𝜖
This work.
Hardness vs. Σ6 -circuits.
1 2
seed: ℓ + 𝑂 log 𝑛 + log 1
𝜖
𝜖
A construction of 𝜖-HSGs with
seed r=𝑂(log 𝑛) + log(1 /𝜖)
Construction:
Hardness Assumption
for nondeterministic circuits
[IW97,KvM99,MV99,SU01]
Proof: Nondet. Reduction:
G’ is not an 𝜖-HSG
∃small circuit 𝐶: 0,1 𝑛 → {0,1}
Pr 𝐶 𝑈𝑛 = 1 ≥ 𝜖, yet:
∀𝑠1 , 𝑠2 : C G′ s1 , s2 = 0.
¼-HSG 𝐺: 0,1 𝑂(log 𝑛) → 0,1 2𝑛
for nondeterministic circuits
Let 𝐷 𝑧 ≔ ∃𝑠2 : 𝐶(ℎ𝑧 (𝑠2 )) = 1.
computable in time poly(n)
Small nondeterministic circuit.
𝐺 ′ (𝑠1 , 𝑠2 ) = ℎ𝐺 𝑠1 𝑠2 where: ∀𝑠1 : 𝐷 𝐺 𝑠1 = 0.
1
log(1/𝜖)
𝑛
ℎ: 0,1
→ 0,1 is from 2-wise ⇒ Pr 𝐷 𝑈2𝑛 = 1 ≥ 2
2-wise independent family
⇒ D ¼-distinguishes G. ∎
A construction of 𝜖 vs 2𝜖 PRG
Construction:
truth
table of fFollow
to get truth NW
table of g.
HighEncode
level
idea:
Reduction: sublinear time local list decoding algorithm
Hardness assumption
Hardness Amplification 𝑓 → 𝑔
𝑓 worst case hard ⇒ 𝑔 average-case hard
G(x)=(x,g(x))
PRG with one bit stretch
Nisan-Wigderson
Generator
Need to tailor details
To our setup
PRG with large stretch
Impossible for black box PH reductions [AASY15].
Following [FL96,TV00,AASY15] we use: approximate counting and
uniform sampling of NP witnesses [St83,JVV86,BGP00] to give a
1
PH reduction with time 𝑝𝑜𝑙𝑦 𝑛 = 𝑜( ) ⇒ 𝜖 vs 2𝜖 PRG.
𝜖
A construction of 𝜖 vs 2𝜖 PRG with one
bit stretch (inspired by [TV00,AASY15])
Construction:
Given
samplingby [S,JVV]:
𝑇𝑥 is ax:
PH-circuit
w
∈𝑅Hardness
𝑧: 𝑇𝑥 𝑧 counting
=
1 caninbe
approximate
PH.
Assumption
done by for
PH-circuits
[JVV,BGP].
PH-circuits
This
is
where
we
use
𝜖 vs 2𝜖
Uniform sampling of NP witnesses.
rather than[TV00]
½ vs ½+𝜖.
𝑛′ :=Ω(𝑛)
𝑓: 0,1 → 0,1
that is
extremely hard on average
′ /3
−𝑛
circuits succeed w.p ≤ 2
𝑛
“Goldereich-Levin”
“Code concatenation”
𝑔 𝑥, 𝑦 = 𝐸 𝑓 𝑥 , 𝑦 , where:
E is a strong seeded extractor
that outputs one bit.
𝐺 𝑥, 𝑦 = 𝑥, 𝑦, 𝑔 𝑥, 𝑦
Proof by PH-Reduction:
G is not an 𝜖 vs 2𝜖 PRG
s.t. for noticable
∃small circuit 𝐶 fraction of x’s
Pr 𝐶 𝑋,
= 1 ≤ 𝜖, yet
x 𝑌, 𝑈
x 𝑌 = 1 ≥ 2𝜖
x 𝑌, 𝐸 𝑓(𝑋),
Pr[𝐶 𝑋,
Let 𝑇𝑥 𝑧 ≔ 1 iff Pr[𝐶 (𝑥, 𝑌
Conclusion and Open problems


Conditional Derandomization/HSGs/PRGs for
low-error regime.
Power and limitations of PH-reductions.
Open problems:
 Derandomization of general SAT-solvers.
 More applications of 𝜖 vs 2𝜖 PRGs/nb-PRGs.
 Minimal assumptions for 𝜖 vs 2𝜖 PRGs/nb-PRGs.
That’s it…
That’s it…
Goal: Reduce randomness complexity
of sampling procedures [DI06].
Given: poly-size circuit C:{0,1}n ! {0,1}𝑙
s.t. C(Un) is “desired dist.” P on {0,1}𝑙 .
(think: n=𝑙 e for some e>1).
Design C’:{0,1}r ! {0,1}𝑙
 r << n.
 C’(Ur) statistically-close to P=C(Un).
 Goal r ≈ 𝑙, (best possible).
 Small statistical error 𝜖.
 C’ is of poly-size.
𝑙
P
C
Un
n
𝑙
≈P
C’
Ur
r
non-boolean PRGs
nb-PRGs [DI06]
nb-PRG: G:{0,1}r ! {0,1}n, ²–fools C:{0,1}n ! {0,1}𝑙 if
C(G(Ur)) ²–close to C(Un) in stat. dist.
≈P
In boolean case (𝑙=1):
 |Pr[C(G(Ur))=1) – Pr[C(Un)=1]| ≤ ²
C
pseudorandom
nb-PRGs generalize (standard) PRGs.
G
C’(Ur)=C(G(Ur)) is ²–close to P=C(Un).
Indeed r<<n.
Ur
Application dictates: for C of size nc, to get efficient C’:
⇒ Can allow G time nb for b>c. (NW-setting).
C’
Previous work and our results on
nb-PRGs
A 𝛼1 vs 𝛼2 nb-PRG is a 𝐺: 0,1 𝑟 → 0,1 n s.t.
for every small circuit 𝐶: 0,1 𝑛 → 0,1 ℓ , and any function 𝐷: 0,1
ℓ
→ {0,1}
Pr 𝐷(𝐶 𝑈𝑛 ) = 1 ≤ 𝛼1 ⇒ Pr 𝐷(𝐶 𝐺 𝑈𝑟 ) = 1 ≤ 𝛼2 .
Hardness
for
1
𝑛𝑐
Deterministic
circuits
− nb-PRG
𝜖-nb-PRG
Impossible*
𝜖 vs 2𝜖
Impossible*
[SV08,AS11]
nb-PRG for
circuits that
output ℓ bits
[AASY15]
Nondeterministic circuits
PH-circuits
[AASY15]
[AS14]
seed: 𝑂 ℓ + log 𝑛
seed: 𝑂 ℓ + log 𝑛
Impossible*
[AASY15]
Hardness vs. Σ2 -circuits.
Impossible*
[AASY15]
This work.
Hardness vs. Σ6 -circuits.
seed: ℓ + 𝑂 log 𝑛 + log
1 2
𝜖
There are also constructions based on incompressibility assumptions [DI06].
𝜖 vs 2𝜖 nb-PRGs (following

[AASY15])
A random 𝑡 = 𝑛𝑂(𝑐) −wise independent function
𝑂 𝑐
𝑟
𝑛
𝑛
ℎ𝑠 : 0,1 → 0,1 ∶ s ← 0,1
is w.h.p. an 𝜖 vs 2𝜖
𝑛
nb-PRG, for 𝑟 = ℓ + 𝑂(log
).
𝜖



Checking whether a given function ℎ𝑠 is such a PRG
is in Σ3𝑃 . (This is where 𝜖 vs 2𝜖 comes up).
𝑡=𝑛𝑂(𝑐)
Let 𝐺: 0,1 → 0,1
be an 𝜖 vs 2𝜖 PRG for
Σ3 -circuits. For a random seed 𝑠 ∈ 0,1 𝑟′ ,
𝐺′ ⋅ = ℎ𝐺(𝑠) (⋅) is with prob 1 − 𝜖, a 𝜖 vs 2𝜖 PRG.
𝑟′
Let 𝐺′: 0,1 𝑟+𝑟′ → 0,1
is a 𝜖 vs 3𝜖 PRG.
𝑚
be 𝐺′ 𝑥, 𝑠 = ℎ𝐺(𝑠) (𝑥) then f