New Techniques for Proving Fine-Grained Average-Case Hardness
Mina Dalirrooyfard, Andrea Lincoln, Virginia Vassilevska Williams
NNew Techniques for Proving Fine-Grained Average-Case Hardness
Mina DalirrooyfardMIT, [email protected] Andrea LincolnMIT, [email protected] Virginia Vassilevska WilliamsMIT, [email protected]
Abstract
The recent emergence of fine-grained cryptography strongly motivates developing an average-caseanalogue of Fine-Grained Complexity (FGC).Prior work [Goldreich-Rothblum 2018, Boix-Adser`a et al. 2019, Ball et al. 2017] developed worst-case to average-case fine-grained reductions (WCtoACFG) for certain algebraic and counting problemsover natural distributions and used them to obtain a limited set of cryptographic primitives. To ob-tain stronger cryptographic primitives based on standard FGC assumptions, ideally, one would like todevelop WCtoACFG reductions from the core hard problems of FGC, Orthogonal Vectors (OV), CNF-SAT, 3SUM, All-Pairs Shortest Paths (APSP) and zero- k -clique. Unfortunately, it is unclear whetherthese problems actually are hard for any natural distribution. It is known, that e.g. OV can be solvedquickly for very natural distributions [Kane-Williams 2019], and in this paper we show that even count-ing the number of OV pairs on average has a fast algorithm.This paper defines new versions of OV, k SUM and zero- k -clique that are both worst-case and average-case fine-grained hard assuming the core hypotheses of FGC. We then use these as a basis for fine-grained hardness and average-case hardness of other problems. The new problems represent their inputsin a certain “factored” form. We call them “factored”-OV, “factored”-zero- k -clique and “factored”-3SUM. We show that factored- k -OV and factored k SUM are equivalent and are complete for a class ofproblems defined over Boolean functions. Factored zero- k -clique is also complete, for a different classof problems.Our hard factored problems are also simple enough that we can reduce them to many other problems,e.g. to edit distance, k -LCS and versions of Max-Flow. We further consider counting variants of thefactored problems and give WCtoACFG reductions for them for a natural distribution. Through FGCreductions we then get average-case hardness for well-studied problems like regular expression matchingfrom standard worst-case FGC assumptions.To obtain our WCtoACFG reductions, we formalize the framework of [Boix-Adser`a et al. 2019]that was used to give a WCtoACFG reduction for counting k -cliques. We define an explicit propertyof problems such that if a problem has that property one can use the framework on the problem toget a WCtoACFG self reduction. We then use the framework to slightly extend Boix-Adser`a et al.’saverage-case counting k -cliques result to average-case hardness for counting arbitrary subgraph patternsof constant size in k -partite graphs.The fine-grained public-key encryption scheme of [LaVigne et al.’20] is based on an average-casehardness hypothesis for the decision problem, zero- k -clique, and the known techniques for building suchschemes break down for algebraic/counting problems. Meanwhile, the WCtoACFG reductions so farhave only been for counting problems. To bridge this gap, we show that for a natural distribution, analgorithm that detects a zero- k -clique with high enough probability also implies an algorithm that cancount zero- k -cliques with high probability. This gives hope that the FGC cryptoscheme of [LaVigne etal.’20] can be based on standard FGC assumptions. a r X i v : . [ c s . CC ] A ug Introduction
Fine-grained complexity (FGC) is an active research area that seeks to understand why many problems ofinterest have particular running time bounds t ( n ) that are easy to achieve with known techniques, but havenot been improved upon significantly in decades, except by t ( n ) o ( ) factors. FGC has produced a versatileset of tools that have resulted in surprising fine-grained reductions that together with popular hardnesshypotheses explain the running time bottlenecks for a large variety of problems [Vas18]. The reductions ofFGC have, for example, explained the difficulty of improving over the n − o ( ) time algorithms for LongestCommon Subsequence (LCS) by giving a tight reduction from k -SAT, and thus showing that an improvedLCS algorithm would violate the Strong Exponential Time Hypothesis (SETH) [ABV15].There are three main problems, with associated hardness hypotheses about their running times, that FGCprimarily uses as sources of hardness reductions (see [Vas18]). The three core hard problems are All PairsShortest Paths (APSP), hypothesized to require n − o ( ) time in n -node graphs , the 3SUM problem, hypoth-esized to require n − o ( ) time on n integer inputs, and the Orthogonal Vectors (OV) problem, hypothesizedto require n − o ( ) time for n vector inputs of dimension ω ( log n ) (the OV hypothesis is implied by SETH[Wil07]).While it is unknown whether these three hypotheses are equivalent, some work suggests they might notbe [CGI + n node graphs that requires n − o ( ) time under both the3SUM and the APSP hypothesis [VW18, VW13]. Zero Triangle asks if an n node graph with integer edgeweights contains a triangle whose three edge weights sum to 0. A natural extension of Zero Triangle, zero- k -clique (where one wants to detect a k -clique with edge weight sum 0), is conjectured to require n k − o ( ) time.There are also some simple to define problems on n node graphs that require n − o ( ) time under three corehardness hypotheses (SETH, APSP and 3SUM): Matching Triangles and Triangle Collection [AVY18].Recently there has been increased interest in developing average-case fine-grained complexity (ACFGC),with a new type of fine-grained cryptography as a main motivation [BRSV17, BRSV18, GR18, LLV19,BBB19]. The main goal is to identify a problem P that requires some t ( n ) − o ( ) time on average for aneasily sampled distribution, and then to build interesting cryptographic primitives from this problem, whereany honest party only needs to run a very fast algorithm, in some t (cid:48) ( n ) ≤ O ( t ( n ) c ) time for c much smallerthan 1, while an adversary would need to run at least in t ( n ) − o ( ) time, unless problem P can be solved faston average.To obtain average-case fine-grained hard problems, one would like to be able to obtain worst-case toaverage-case fine-grained reductions for natural problems that are hypothesized to be fine-grained hard inthe worst-case . This is what prior work does.The problems for which fine-grained worst-case to average-case hardness reductions are known aremostly algebraic or counting problems, such as counting k -cliques [GR20, GR18, BRSV18, BBB19], orsome problems involving polynomials. Some limited cryptographic primitives have been obtained from suchproblems, e.g. fine-grained proofs-of-work [BRSV18, BRSV17]. Building fine-grained one-way functionsor fine-grained public key cryptography based on any worst-case FGC hardness assumption is still an openproblem. Such primitives have been developed, based on plausible assumptions about the average-casecomplexity of zero- k -clique [LLV19]. This motivates the following question: Is there a fine-grained worst-case to average-case reduction for zero-k-clique? All hypotheses are for the word-RAM model of computation with O ( log n ) bit words. Well, even more ideally, one would like to use problems that are provably unconditionally average-case hard, such as theproblems from the known time-hierarchy theorems, but these problems are difficult to work with and there are no known techniquesto build cryptography from them.
1s prior work showed worst-case to average-case case reductions for counting cliques, a natural ap-proach to obtaining worst-case to average-case reductions for the detection variant of zero- k -clique is togive a fine-grained reduction from counting to decision. A tight reduction is not known for the worst-caseversion of the problem. It turns out that a fine-grained reduction from counting to decision for zero- k -cliqueis possible in the average-case for a natural distribution with certain parameters, if the detection probabilityis high enough. We prove this in Section 7. While the parameters are currently not good enough to implya worst-case to average-case reduction for (the decision version of) zero- k -clique, the reduction gives hopethat the fine-grained public-key scheme of [LLV19] can eventually be based on a standard FGC (worst-case)hardness assumption.The next natural question is whether worst-case to average-case reductions are possible for the othercore problems of FGC, and in particular for OV (as it is as far as we know unrelated to zero- k -clique).Consider the most natural distribution for OV: given a fixed probability p ∈ ( , ) , one generates n vectorsof dimension d = ω ( log n ) by selecting for each vector v and i ∈ [ d ] independently, v i to be 1 with probability p and 0 otherwise. Kane and Williams [KW19] showed that for every p , there is an ε p > O ( n − ε p ) time algorithm that solves OV on instances generated from the above distribution with high probability.Thus, for this distribution (if the OV conjecture is true), there can’t be a fine-grained ( n , n ) -worst-case toaverage-case reduction for OV. In Section 6 we also show that even the counting version of OV, in whichone wants to determine the number of pairs of orthogonal vectors, has a truly-subquadratic time algorithmthat works with high probability over the same distribution. Thus, even counting OV cannot be average-case n − o ( ) -hard. (Though, it could be fine-grained average-case hard for a different time function. We leavethis to future work.)The first key contribution of this paper is in defining a new type of problem, a “factored problem” thatis fine-grained hard from a core FGC assumption, whose counting version is average-case hard for a naturaldistribution again under a core FGC assumption, and that is also simple enough so that one can reduce it towell-studied problems and develop average-case hardness for them.While developing worst-case to average-case reductions for our factored problems, we formalize theworst-case to average-case fine-grained reductions framework of Boix et al. [BBB19]. We identify a prop-erty of problems (the existence of a “good polynomial”) that makes it possible for these problems to havesuch a worst-case to average-case reduction. Originally, [BBB19] gave average-case hardness for counting k -Cliques in Erd¨os-Renyi graphs using their framework. Along the way of generalizing their framework,we also obtain a worst-case to average-case reduction for counting copies of H for any k -node H , wherethe distribution for the average-case instance is again for Erd¨o-Renyi graphs. We achieve this using a newtechnique we call Inclusion-Edgesclusion.In the rest of the introduction we will present our results mentioned in the above two paragraphs. We call the problems we introduce “factored problems” (a full formal definition is in Section 2). To definethem, let us first define a factored vector . Let b and g be positive integers. A ( g , b ) -factored vector, v , ismade up of g sets v [ ] , . . . , v [ g ] . Each set is a subset v [ i ] ⊆ { , } b . Roughly speaking, a factored vector v represents many b · g binary vectors, namely a concatenation x , x , . . . , x g for each choice of a g -tuple ofvectors x i ∈ v [ i ] for all i . For example, for g = b =
3, let v be a factored vector where v [ ] = { , } and v [ ] = { , } . A natural interpretation of v is that it is a set of the following 4 binary vectors, byconcatenating each member of v [ ] with each member of v [ ] , that is { , , , } .Now, consider a function f that takes a 2 b -bit input x , . . . , x b , y , . . . , y b and returns a value in { , } ;we can consider f as a Boolean function. Then, for two factored vectors v and v (cid:48) and a coordinate i ∈ [ g ] ,2e can consider the number of pairs of b -bit vectors x ∈ v [ i ] , y ∈ v (cid:48) [ i ] that f accepts. This is accept f ( v , v (cid:48) , i ) : = ∑ x ∈ v [ i ] , y ∈ v (cid:48) [ i ] f ( x , . . . , x b , y , . . . , y b ) , where x = x . . . x b and y = y . . . y b . If we take the product ∏ gi = accept f ( v , v (cid:48) , i ) ,we would obtain the number of pairs of b · g -length vectors represented by v and v (cid:48) that are accepted by f ,where f is said to accept a pair of b · g -length vectors if it accepts each of the g pairs of chunks of b -lengthsubvectors between positions ( i − ) b + ib for i ∈ [ g ] .Then we can define the factored problem for f , F2- f that given two sets S and T of n ( g , b ) -factored vec-tors, computes the sum ∑ v ∈ S , v (cid:48) ∈ T ∏ gi = accept f ( v , v (cid:48) , i ) , i.e. the total number of pairs of vectors represented byvectors in S and T that are accepted by f . For technical reasons, we restrict the values g = o ( lg ( n ) / lg lg ( n )) and b = o ( lg ( n )) , so that each factored vector can be represented with at most gb b bits ( g sets of at most 2 b vectors of length b ).Depending on the function f , we get different versions of a factored problem. If f on b -length vectors x and y , returns 1 iff x · y =
0, then we get the factored OV problem F2-OV. If f returns 1 if the XOR of x and y is 0, we get the F2-XOR problem, and if f returns 1 iff x + y = f can be defined over k · b -length vectors, for integer k ≥
2, taking k -tuples of b -lengthbinary vectors to { , } . Then analogously we can define F k - f to compute the number of k -tuples of vectorsrepresented by some k -tuple of factored vectors, one from each n -sized input set S i , i ∈ [ k ] , so that f acceptsthe k -tuple. This way we can define F k -OV, F k -XOR, F k -SUM etc, the factored versions of k -OV, k -XOR and k -SUM.Similarly to these problems defined on k -tuples of sets of factored vectors, we define problems reminis-cent to k -clique. Here f is a function that takes (cid:0) k (cid:1) -tuples of b -length vectors to { , } , one is given a graphwhose edges are labeled by factored vectors and the factored f k -clique problem, F f k C, asks to compute thenumber of (cid:0) k (cid:1) -tuples of vectors that are accepted by f and are represented by the factored vectors labelingthe edges of a k -clique in the graph. We focus in particular on the factored zero- k -clique problem, FZ k C, inwhich f corresponds to returning whether the sum of (cid:0) k (cid:1) b -bit numbers is 0. We will summarize the results around our factored problems below. They appear in sections 3 and 4. Wegive a visual summary of our results in Figure 1. We use the shortened names for many of the problems in thefigure. The results will concern both counting and decision versions of our factored problems. The decisionversions ask whether the count is nonzero, whereas the counting versions ask for the exact count. Whenwe want the counting version, we will place
Summary.
We first provide an overview summary of our results.First we show that the factored versions of k -OV, k -SUM and k -XOR are all n k − o ( ) -fine-grained hardunder SETH. We also show that the factored version of zero-3-clique (FZ3C) is n − o ( ) -fine-grained hardbased on any of the three core hypotheses of FGC (SETH, or the APSP or 3-SUM hypothesis). Additionally,we show that the counting versions of these factored problems are as hard in their natural uniform average-case as they are in the worst case. Moreover, we show that many natural problems, like counting regularexpression matchings, reduce from our factored problems. This even implies fine-grained average-casehardness for these problems over some explicit distributions.Thus our factored problems do three things simultaneously: • Instead of trying to use the uniform average-case of the core problems of FGC as central problems3 k -OVF k -SUM k -OV SETHFZ k C Z k C 3-SUMAPSPZ3CAC k CAC k -SUMAC k -OV k C k -SUM k -OV k -LCS( k + 1)L-MF k -NLstC k -ELstC F2-OVEdit Distance k - f F f k CF k -XORAC k -XOR k -XOR Figure 1: A summary of the reductions to and from factored problems in the paper. The problems indiamonds are the core problems of FGC. The full lines are reductions from this paper, while doted lines arepre-existing reductions. The problems in gray boxes are our factored problems. The problems in thick linedboxes are the problems we reduce from factored problems. For the problems surrounded by a thick-lineddouble box we have generated an explicit average case distributions on which they are hard (but it is not theuniform distribution). These results appear in Sections 3 and 4.in a network of average-case reductions, we can use the factored versions of the core problems inFGC. For example, the counting variant of factored OV ( • The factored versions of the core problems are sufficiently expressive that they are complete for thelarge class of factored problems. In particular, F k -OV, F k -XOR, and F k -SUM are complete forthe class of problems of the form F k - f over all f , while FZ k C is complete for the class of problemsF f k C over all f . Despite this expressiveness we are still able to reduce our factored problems to manynatural problems. In section 4 we give fine-grained reductions from our factored problems to k -LCS,Edit Distance and a labeled version of Max Flow. • Abboud et al. [AVY18] gave two problems, Triangle Collection and Matching Triangles that are hardfrom all three core assumptions in FGC. They also showed that one can reduce Triangle Collection to several natural problems in graph algorithms. Unfortunately, however, neither Triangle Collection,nor Matching Triangles are known to be hard on average. One of our factored problems, FZ3C is alsohard from all three core assumptions. Moreover, the counting version of FZ3C is additionally n − o ( ) hard in the average-case from all three core assumptions of FGC. Thus, problems that reduce fromcounting FZ3C get average-case hardness for some explicit average-case distribution. We give twoexamples of problems that reduce from counting FZ3C in Section 4. Hence if you are interested in Actually a version of the problem that is still hard under all three assumptions.
Fine-grained hardness for factored problems.
Here we show that our factored problems are fine-grainedhard under standard FGC hypotheses.We first show that a single call to a factored problem solves its non-factored counterpoint.
Theorem 1.1.
In O ( n ) time, one can reduce an instance of size n of k-OV, k-XOR, k-SUM and ZkC to asingle call to an instance of size ˜ O ( n ) of Fk-OV, Fk-XOR, Fk-SUM and FZkC, respectively. The above theorem holds both in the decision and counting context. It gives fine-grained hardness forthe factored variants of all our problems, under the hypothesis that the original variants are hard. Note that k -XOR, k -SUM have ˜ O ( n (cid:100) k / (cid:101) ) time algorithms. However, we have n k − o ( ) conditional lower bounds forall of F k -OV, F k -XOR, F k -SUM and FZ k C. So, while we do get fine-grained hardness from the k -XORand k -SUM hypotheses, this hardness is not tight. The hardness is tight from the k -OV and Z k C hypotheseshowever.Now we give fine-grained hardness for FZ3C under all three core hypotheses from FGC.
Theorem 1.2.
If FZ C (even for b = o ( log n ) and g = o ( log ( n ) / log log ( n )) ) can be solved in O ( n − ε ) timefor some constant ε > , then SETH is false, and there exists a constant ε (cid:48) > such that -SUM can besolved in O ( n − ε (cid:48) ) time and APSP can be solved in O ( n − ε (cid:48) ) time. Worst-case to average-case reductions for factored problems.
We show that our factored problemsadmit fine-grained worst-case to average-case reductions. Our first theorem about this is a worst-case toaverage-case fine-grained reduction for the counting version of F k - f for a natural distribution (defined inDefinition 18). The proof appears in Section 3. Theorem 1.3.
Let µ be a constant such that < µ < . Suppose that average-case f µ (see definition18, this is an iid distribution which has ones with probability µ ) can be solved in time T ( n ) with probabilityat least − / ( lg ( n ) kg lg lg ( n ) kg ) . Then worst-case f can be solved in time ˜ O ( T ( n )) .When µ = / average-case f µ is average-case f . Thus, if we have worst-case fine-grained hardness for k - f for some f , then we get average-case hard-ness for the same problem over a natural distribution. In particular, in the corollary below we obtain average-case hardness for k -OV, k -SUM , k -XOR, based on the standard FGC hardness of k -OV, k -SUM, k -XOR (as implied by Theorem 1.1). Corollary 1.4.
If average-case ( n ) with probability − / ( lg ( n ) gk lg lg ( n ) gk ) then worst-case ˜ O ( T ( n )) .If average-case ( n ) with probability − / ( lg ( n ) gk lg lg ( n ) gk ) thenworst-case ˜ O ( T ( n )) .If average-case ( n ) with probability − / ( lg ( n ) gk lg lg ( n ) gk ) thenworst-case ˜ O ( T ( n )) . Similarly, we obtain fine-grained average-case hardness for f k C, based on the fine-grained worst-casehardness of f k C. Note that given that g = o ( lg ( n ) / lglg ( n )) then a probability of 1 − / n ε will be high enough for any ε > heorem 1.5. Let µ be a constant and < µ < . If average-case f kC µ (see Definition 18, this isan iid distribution which has ones with probability µ ) can be solved in time T ( n ) with probability − / ( lg ( n ) k g lg lg ( n ) k g ) then worst-case f kC can be solved in time ˜ O ( T ( n )) .When µ = / average-case f kC µ is average-case f kC. By Theorem 1.5, we have the following result for k C in particular.
Corollary 1.6.
If average-case ( n ) with probability − / ( lg ( n ) k g lg lg ( n ) k g ) then worst-case ˜ O ( T ( n )) . Thus in particular we obtain fine-grained average-case hardness for counting factored zero-3-cliques,based on the hardness of zero-3-clique, and thus based on the APSP and 3-SUM hypotheses.
Completeness for F k -OV, F k -SUM , F k -XOR and FZ k C. Let k ≥ k - f defined over all boolean functions f on kb -length inputs. Our first sequence of results showthat F k -OV, F k -SUM and F k -XOR are complete for the class, so that a T ( n ) time algorithm for any of theseproblems would imply an ˜ O ( T ( n )) time algorithm for F k - f for any f .To prove this, we first show that F k -XOR is complete for the class: Theorem 1.7.
If we can solve b length vectors in time T ( n ) then, for any f , wecan solve a f instance with g sets of b length vectors in time T ( n ) + ˜ O ( n ) time. We then show that F k -OV, F k -SUM and F k -XOR are equivalent. Theorem 1.8.
If any of ( n ) time then all of ˜ O ( T ( n )) time. The above two theorems imply the final completeness theorem:
Theorem 1.9.
If any of ( n ) time then f can besolved in ˜ O ( T ( n )) time. We also consider the class of problems ( f k C defined by Boolean functions f on (cid:0) k (cid:1) b -length inputs.We show that ( k C is complete for this class.
Theorem 1.10.
If ( ( n ) time then ( f kC for any f , can be solved in ˜ O ( T ( n ) + n ) time. Thus our factored problems corresponding to core problems in FGC, are the hard problems for naturalclasses of factored problems.
Fine-grained hardness for well-studied problems, based on the hardness of factored problems.
Theresults we mention here appear in Section 4. The main upshot is that the factored problems are both hardand also simple enough to imply hardness for basic problems in graph and string algorithms. Some of theresults are based on the hardness of FZ3C which implies hardness from all of SETH, 3-SUM and APSP.Some come from F k - f which implies hardness from SETH. Partitioned Matching Triangles.
First we define the
Partitioned Matching Triangles problem (PMT) asfollows: Given g disjoint n -node graphs with node colors, is there a triple of colors a , b , c so that every oneof the g graphs contains a triangle whose nodes are colored by a , b , c ? The counting variant of PMT is tocount the total number of such g -tuples of colored triangles.6bboud et al. [AVY18] consider the related Matching Triangles problem mentioned earlier in the intro-duction, and show that it is hard from all three core FGC hypotheses. In the Matching Triangles problemone is given an integer T and a node-colored graph G and one wants to know if there is a triple of colors a , b , c so that there are at least T triangles in G colored by a , b , c .We observe first that for the particular parameters for which Matching Triangles is shown to be hardin [AVY18], one can actually reduce Matching Triangles in a fine-grained way to Partitioned MatchingTriangles (PMT), so that the latter problem is also hard from all three hypothesis. Furthermore, we give apowerful reduction to PMT from FZ3C. Moreover, our reduction also holds between the counting versions ofthe problems, so that we get fine-grained average-case hardness for counting PMT under all three hypothesesas well. Theorem 1.11.
If ( ( n ) time, then we can solve ( C intime ˜ O ( T ( n ) + n ) .kkk -color Node Labeled st Connectivity.
In the k -color Node Labeled st Connectivity Problem ( k -NLstC) oneis given an acyclic graph G = ( V , E ) with two designated nodes s , t ∈ V , and colors on all nodes in V \ { s , t } from a set of colors C . One is then asked whether there is a path from s to t in G using at most k node colors.We give a fine-grained reduction from FZ k C to k -NLstC that also holds between the counting versions.Here in the counting version of k -NLstC we want to output the number of s - t paths through at most k colors,mod (cid:100) k lg ( n ) (cid:101) . Theorem 1.12.
If a O ( | C | k − | E | − ε / ) or O ( | C | k − − ε | E | ) time algorithm exists for (counting mod k lg ( n ) )k-NLstC then a O ( n k − ε ) algorithm exists for ( The conditional lower bound of ( | C | k − | E | ) − o ( ) resulting from the above theorem is tight. In AppendixA we give the corresponding algorithm. kkk -color Edge Labeled st Connectivity.
The k -color Edge Labeled st Connectivity problem ( k -ELstC) asksfor a given acyclic graph with colored edges and given source s and target t , if there is a path from s to t thatuses only k colors of edges.We give conditional hardness for both the decision and counting version of the problem (where thecounts are mod a small R ). This also implies average-case hardness for the counting mod R problem underall three hardness hypotheses of FGC. Theorem 1.13.
If a ˜ O ( | E || C | k − − ε ) or ˜ O ( | E | − ε | C | k − ) time algorithm exists for (counting mod k lg ( n ) )k-ELstC, then a ˜ O ( n k − ε ) algorithm exists for ( f . This is tight. Note this algorithm is slower (by a factor of | C | ) than the node-labeled version, however itis optimal. The corresponding algorithm is in a theorem from Appendix A. ((( kkk +++ ))) Labeled Max Flow.
The ( k + ) Labeled Max Flow problem studied in [GCSR13] asks, given acapacitated graph G = ( V , E ) where the edges have colors, and s , t ∈ V , if there is a maximum flow from thesource s to the sink t where number of distinct colors of the edges with non-zero flow is at most k + Theorem 1.14. If ( k + ) L-MF can be solved in T ( n ) time, then we can solve FZkC in time ˜ O ( T ( n ) + n ) . This implies an n k − − o ( ) lower bound for k L-MF under all three FGC hypotheses. We also show thatfor the particular structured version of the problem given in our reduction, this lower bound is tight.
Regular Expression Matching.
The Regular Expression Matching problem (studied e.g. in [BI16]) takesas input a regular expression (pattern) p of size m and a sequence of symbols (text) t of length n , and asks7f there is a substring of t that can be derived from p . The counting version of the problem, R , where R = n o ( ) . A classic algorithm constructs and simulates a non-deterministic finite automatoncorresponding to the expression, resulting in the rectangular O ( mn ) running time for the detection versionof the problem.We give hardness from R ) which in turn implies average-case fine-grained hardness forcounting regular expression matchings mod R , from SETH. Theorem 1.15.
Let R be an integer where lg ( R ) is subpolynomial. If you can solve ( ( n ) time, then you can solve ( -OV in ˜ O ( T ( n ) + n ) time Again, we show in Appendix A that for the particular “type” of pattern used in our reduction, this lowerbound is tight.
LCS and Edit Distance.
The k -LCS problem is a basic problem in sequence alignment. Given k sequences s , . . . , s k of length n , one is asked to find the longest sequence that appears in every s i as a subsequence. k -LCS can be solved in O ( n k ) time with dynamic programming and requires n k − o ( ) time under SETH, viaa reduction from k -OV [ABV15]. Here we show that k -LCS is also fine-grained hard via a reduction fromF k -OV. Theorem 1.16.
A T ( n ) time algorithm for k-LCS with alphabet size O ( k ) implies a ˜ O ( T ( n )) algorithm forFk-OV. The Edit Distance problem is another famous sequence alignment problem. Here one is given two n length sequences a and b and one needs to compute the minimum number of symbol insertions, deletionsand substitutions needed to transform a into b . Edit Distance can be solved in O ( n ) time via dynamicprogramming, and requires n − o ( ) time under SETH, via a reduction from OV [BI15, BI18].In section 4 we show that edit distance is also fine-grained hard from F2-OV. Theorem 1.17.
A T ( n ) time algorithm for Edit Distance implies a ˜ O ( T ( n )) algorithm for F -OV. As mentioned earlier in the introduction we show that counting orthogonal vectors over the uniform distri-bution is easy in the average-case. Let µ , d be the problem of solving orthogonal vectors on instancesgenerated by sampling n vectors iid from the distribution over d bit vectors where every bit in the vector issampled iid from the distribution that returns 1 with probability µ and returns 0 with probability 1 − µ . Theorem 1.18.
For all constant values of µ and all values of d there exists constants ε > and δ > suchthat there is an algorithm for OV µ , d that runs in time ˜ O ( n − δ ) with probability at least − n − ε . k C Our worst-case to average-case reductions show hardness for counting problems. We mentioned earlier inthe introduction that stronger cryptographic primitives have been built from detection problems than fromcounting problems. In this paper we show that in the sufficiently low error regime there is a counting todetection reduction for the zero- k -clique problem. Unfortunately, this does not give a fine-grained one-wayfunction from worst-case assumptions. However, it makes progress towards bridging the gap between the8roblems we can show hard from the worst-case and those we can build powerful cryptographic primitivesfrom. Definition 1.
An average case instance of Z k C (ACZ k C) with range R takes as input a complete k -partitegraph with n nodes in each partition. Every edge has a weight chosen iid from [ , R − ] . A clique isconsidered a zero k clique if the sum of the edges is zero mod R . Theorem 1.19.
Given a decision algorithm for ACZkC that runs in time O ( n k − ε ) for some ε > andsucceeds with probability at least − n − ω ( ) , there is a counting algorithm that runs in O ( n k − ε (cid:48) ) time forsome ε (cid:48) > and succeeds with probability at least − n − ω ( ) , where ω ( ) here means any function that isasymptotically larger than constant. We define the notion of a good low-degree polynomial for the problem P (a GLDP( P )). We define theproperties of a good low-degree polynomial in Definition 8. Intuitively these properties are that the functionmust be low degree, count the output of the problem, and have well structured monomials. We show that anyproblem P that has a GLDP( P ) is hard in its uniform average case in appendix B. We do this using techniquesfrom Boix-Adser`a et al [BBB19]. We use the GLDP( · ) framework to show uniform average-case hardnessfor our counting factored problems (in section 3). We give the framework theorem statement below. Theorem 1.20.
Let µ be a constant such that < µ < . Let P be a problem such that a function f existsthat is a GLDP(P), and let d be the degree of f . Let A be an algorithm that runs in time T ( n ) such that when (cid:126) I is formed by n bits each chosen iid from Ber [ µ ] :Pr [ A ( (cid:126) I ) = P ( (cid:126) I )] ≥ − / ω (cid:16) lg d ( n ) lg lg d ( n ) (cid:17) . Then there is a randomized algorithm B that runs in time ˜ O ( n + T ( n )) such that for any for (cid:126) I ∈ { , } n :Pr [ B ( (cid:126) I ) = P ( (cid:126) I )] ≥ − O (cid:16) − lg ( n ) (cid:17) . Boix-Adser`a et al show that counting k cliques is as hard in Erd˝os-R´enyi graphs as it is in the worstcase. We use the GLDP( · ) framework a second time to slightly generalize their result to show that countingany subgraph H in an Erd˝os-R´enyi graph is at least as hard as counting subgraphs H in worst case k -partitegraphs (in section 5). Theorem 1.21.
Let H have e edges and k vertices where k = o ( (cid:112) lg ( n )) . Let A be an average-case algorithmfor counting subgraphs H in Erd˝os-R´enyi graphs with edge probability / b which takes T ( n ) time withprobability − − k · b − k · ( lg ( e ) lg lg ( e )) − ω ( ) .Then an algorithm exists to count subgraphs H in k-partite graphs in time ˜ O ( T ( n )) with probability atleast − ˜ O ( − lg ( n ) ) . In the preliminaries section 2 we give a formal definition of our factored problems. We also define theproblems that we use throughout the paper, and we give an introduction of the average-case frameworkwhich is defined formally in Appendix B. We show that the factored problems are hard, and give the worst-case to average-case reductions for the factored problems in section 3. In section 4, we show that our9actored problems can show hardness for many natural non-factored problems. We use the same frameworkthat gives average-case hardness for the factored problems to show that counting arbitrary subgraphs inrandom graphs is hard in section 5. We give a fast algorithm for counting OV over the uniform average-casein section 6. We give counting to detection reduction for average-case zero- k -clique with high probabilityin section 7. Finally, we list problems that seem like promising future work in section 8.We give the efficient algorithms for our factored problems and the problems that reduce from our fac-tored problems in appendix A. We give the framework that generalizes the techniques of Boix-Adser`a et al.in appendix B. We cover useful preliminaries for sections 3 and 4 in this section. We include preliminaries for Section 5,Appendix B, and proofs of algorithm running times in Appendix A.
Definition 1. The -SUM Hypothesis [GO95] In the k-SUM problem , we are given an unsorted list L of n values (over Z or R ) and want to determine if there are a , . . . , a k ∈ L such that ∑ ki = a i =
0. The countingversion of k -SUM asks how many sets of k numbers a , . . . , a k ∈ L sum to zero.The k -SUM hypothesis states that that the k -SUM problem requires n (cid:100) k / (cid:101)− o ( ) time [GO95].This is equivalent to saying no n (cid:100) k / (cid:101)− ε time algorithm exists for k -SUM for constant ε > Definition 2. APSP Hypothesis [VW10a]
APSP takes as input a graph G with n nodes (vertices), V and m edges, E . These edges are given weights in [ − R , R ] where R = O ( n c ) for some constant c . We must returnthe shortest path length for every pair of vertices u , v ∈ V . The length of a path is the sum of the edge weightsfor all edges on that path.The APSP Hypothesis states that the APSP problem requires n − o ( ) time when m = Ω ( n ) . Definition 3. Strong Exponential Time Hypothesis (SETH) [IP01]
Let c k be the smallest constant suchthat there is an algorithm for k -CNF SAT that runs in O ( c k n + o ( n ) ) time.SETH states that there is no constant ε > c k ≤ − ε for all constant k .Intuitively SETH states that there is no constant ε > O ( n ( − ε ) ) time algorithm for k -CNF SAT for all constant values of k . Definition 4. The k -OV Hypothesis [Wil07] In the k-OV problem , we are given k unsorted lists L , . . . , L k of n zero-one vectors of length d as input. If there are k vectors v ∈ L , . . . , v k ∈ L k such that for ∀ i ∈ [ , d ] ∃ j ∈ [ , k ] such that v i [ j ] = k vectors an orthogonal k -tuple. One should return true ifthere is an orthogonal k -tuple in the input. The counting version of k -OV ( k -OV) asks for the number oforthogonal k -tuples.The k -OV hypothesis states that that the k -OV problem requires n k − o ( ) time [Wil07].This is equivalent to saying no O ( n k − ε ) time algorithm exists for k -OVfor constant ε > .2 Graphs Definition 5.
Let H = ( V H , E H ) be a k -node graph with V H = { x , . . . , x k } .An H -partite graph is a graph with k partitions V , . . . , V k . This graph must only have edges betweennodes v i ∈ V i and v j ∈ V j if e ( x i , x j ) ∈ E H . (See Figure 2) H H -partite H (cid:48) H (cid:48) -partite Figure 2: An example of the corresponding H -partite graphs. We define the good low-degree polynomial for a problem P ( GLDP ( P ) ). In Appendix B we provide aframework which shows that if a problem P has a GLDP ( P ) then P is hard over the uniform average case.The proof of this framework is a generalization of the proof in Boix et al. [BBB19]. We use this to showaverage-case hardness for counting versions of factored problems and counting subgraphs in sections 3 and5 respectively. Definition 6.
Let the polynomial f have n inputs x , . . . , x n . We say f is strongly d-partite if one canpartition the inputs into d sets S , . . . , S d such that f can be written as a sum of monomials ∑ i x , i · · · x d , i ,where every variable x j , i is from the partition S j . That is, if there is a monomial x c i · · · x c k i k in f then it mustbe that c j = j (cid:54) = (cid:96) if x i j ∈ S m then x i (cid:96) / ∈ S m . Definition 7.
Let P ( (cid:126) I ) be the correct output for problem P given input (cid:126) I . Definition 8.
Let n be the input size of the problem P , let P return an integer in the range [ , p − ] where p is a prime and p < n c for some constant c . A good low-degree polynomial for problem P (GLDP(P)) is apolynomial f over a prime finite field F p where: • If (cid:126) I = b , . . . , b n , then f ( b , . . . , b n ) = f ( (cid:126) I ) = P ( (cid:126) I ) where b i maps to either a zero or a one in the primefinite field. • The function f has degree d = o ( lg ( n ) / lg lg ( n )) . • The function f is strongly d -partite. We introduce a more expressive extension of k -SUM, k -OV, k -XOR, and Z k C. At a high level this extensiontakes every number or vector from the original problems and splits them up into g = o ( lg ( n ) / lg lg ( n )) groups11f numbers or vectors with bit representations of size b = o ( lg ( n )) . If the original numbers had length (cid:96) ,then (cid:96) ≈ b · g . Then, we allow each group to contain multiple numbers or vectors.We start by giving a definition of F k -OV, then we give a small example of F2-OV. Next, we follow upwith the analogously defined F k -SUM ,F k -XOR, and FZT. Finally, we give algorithms for these problemsin the Appendix A. k -OV, Intuition and ExamplesDefinition 9. A ( g , b ) - factored vector v is defined by g sets ( v [ ] , . . . , v [ g ]) where each v [ i ] ⊆ { , } b is a setof b -dimensional binary vectors.For a set of vectors (cid:126) w , . . . , (cid:126) w k of the same dimension d , let isOrthogonalTuple ( (cid:126) w , . . . , (cid:126) w k ) return 1 iff (cid:126) w , . . . , (cid:126) w k are orthogonal, i.e. iff ∑ da = ∏ kj = w j [ a ] =
0, where w j [ a ] is the a th bit of the vector w j .Now we define a useful operator, ◦ for a set { Z , . . . , Z k } where each Z i is a set of d -dimensional binaryvectors as follows. ◦ ( Z , . . . , Z k ) : = ∑ (cid:126) w ∈ Z ,...,(cid:126) w k ∈ Z k isOrthogonalTuple ( (cid:126) w , . . . , (cid:126) w k ) . Now, given k ( g , b ) -factored vectors v , . . . , v k the number of orthogonal vectors within those factoredvectors is (cid:125) ( v , . . . , v k ) : = Π g − i = ◦ ( v [ i ] , . . . , v k [ i ]) . The input to F k -OV is V , . . . , V k , where each V j is a set of n ( g , b ) -factored vectors, where g = o ( lg ( n ) / lg lg ( n )) and b = o ( lg ( n )) . The total number of orthogonal vectors in a given F k -OV instance is ∑ v ,..., v k ∈ V ,..., V k (cid:125) ( v , . . . , v k ) . The F k -OV problem asks to determine whether ∑ v ,..., v k ∈ V ,..., V k (cid:125) ( v , . . . , v k ) > An Example:
We give a small example bellow. Consider F2-OV where g = b =
3. We give anexample of factored vectors u , v and w : u [ ] = { , } u [ ] = { , } v [ ] = { , , } v [ ] = { , } w [ ] = {} w [ ] = { , , , } First, note that (cid:125) ( w , u ) = (cid:125) ( w , v ) = w [ ] is the empty set. Empty sets are valid inthis factored representation, but, rather degenerate. Next, note that (cid:125) ( v , u ) is 4 · =
8. For ◦ ( u [ ] , v [ ]) allof ( , ) , ( , ) , ( , ) , and ( , ) are orthogonal. For ◦ ( u [ ] , v [ ]) both ( , ) , and ( , ) are orthogonal. A Natural Interpretation:
We can generate a k − OV instance by interpreting a factored vector as rep-resenting | v | · . . . · | v k | vectors. For example u in the above example would represent the following list ofvectors: 001001 , , , . As another example v would represent the following list of vectors:000110 , , , , , . W represents no vectors, because w [ ] is the empty set.However, the number of vectors that can be represented by a single factored vector that has a g b sizedrepresentation is 2 bg . While g b is sub-polynomial, 2 bg can be super polynomial (e.g. if b = g = lg ( n ) / )! k - f , F k -SUM, F k -XOR, and FZTDefinition 10. Let f : ( { , } b ) × k → { , } be a function taking k b -dimensional binary vectors to { , } .We can view f as a Boolean function.Let us define an operator for f , ◦ f , that takes k factored vectors a , . . . , a k and computes the number of k -tuples of vectors, one in each a i , that f accepts: ◦ f ( a , . . . , a k ) = ∑ (cid:126) w ∈ a ...(cid:126) w k ∈ a k f ( (cid:126) w , . . . , (cid:126) w k ) . If v is a ( g , b ) -factored vector let, for i ∈ [ g ] , v [ i ] be the i th set of vectors in v .Given ( g , b ) -factored vectors v , . . . , v k the number of k -tuples of vectors accepted by f within thosefactored vectors is (cid:125) f ( v , . . . , v k ) = Π g − i = ◦ f ( v [ i ] , . . . , v k [ i ]) . For each f , we define a problem F k - f . The input to F k - f is k sets, V , . . . , V k , of n ( g , b ) -factored vectorseach, where g = o ( lg ( n ) / lg lg ( n )) and b = o ( lg ( n )) .The total number k -tuples of vectors accepted by f in a given F k - f instance isF k - f ( V , . . . , V k ) : = ∑ v ,..., v k ∈ V ,..., V k (cid:125) f ( v , . . . , v k ) . The F k - f problem returns true iff F k - f ( V , . . . , V k ) >
0. More generally, the counting version k - f ofF k - f asks to compute the quantity F k - f ( V , . . . , V k ) . Definition 11. F k -XOR is the problem F k - f where f is 1 if the componentwise XOR of the k given vectorsis the 0 vector: f ( v , . . . , v k ) = (cid:40) , if v ⊕ . . . ⊕ v k = (cid:126) , else . Definition 12. F k -SUM is the problem F k - f where f that checks if the sum of the k vectors is the 0 vector: f ( v , . . . , v k ) = (cid:40) , if v + . . . + v k = , else . Definition 13.
For an integer k , (cid:96) = (cid:0) k (cid:1) and a given function f : { , } b (cid:96) → { , } , construed as taking (cid:96) -tuples of b -length binary vectors to { , } , let f k C be the problem of counting cliques in a graph whoseedges are labeled with factored vectors, where a clique is counted with multiplicity the number of (cid:96) -tuplesof vectors that f accepts and that appear in the (cid:96) factored vectors labeling the edges.More formally, we change the definition of the operation (cid:125) f ( · ) to take as input k vertices v , . . . , v k of agiven graph G = ( V , E ) whose edges ( x , y ) ∈ E are labeled by ( g , b ) -factored vectors e x , y : (cid:125) (cid:48) f ( v , . . . , v k ) = isClique ( v , . . . , v k ) · Π g − i = ◦ f ( e v , v [ i ] , e v , v [ i ] , . . . , e v k − , v k [ i ]) . isClique ( v , . . . , v k ) outputs 1 if v , . . . , v k form a k -clique in G , and otherwise outputs 0.We keep the definition of ◦ f ( · ) the same as before, but now its input is a list of (cid:96) sets of vectors that arethe i th group of vectors of the factored vectors labeling the clique edges: ◦ f ( e [ i ] , . . . , e (cid:96) [ i ]) = ∑ (cid:126) w ∈ e [ i ] ...(cid:126) w (cid:96) ∈ e (cid:96) [ i ] f ( (cid:126) w , . . . , (cid:126) w (cid:96) ) . Finally, we let f k Cbe the problem of computingF f k C ( G ) : = ∑ v ,..., v k ∈ V (cid:125) (cid:48) f ( v , . . . , v k ) . Here, unlike for (cid:96) -f, we are only counting the sums of factored vectors when those factored vectorsare on a set of (cid:96) = (cid:0) k (cid:1) edges that form a k clique. Let F f k Cbe the detection version of the problem thatreturns 1 if F f k C ( G ) > Definition 14.
Factored Zero k -Clique, FZ k C is the F f k C problem where f is the sum function for (cid:0) k (cid:1) variables defined in the definition of F k -SUM . Definition 15.
Factored Zero Triangle, FZT is FZ3C.
First we will define the hypotheses for our factored list problems.In many lemma, theorem and definition statements we will use a structure where we put ( ) beforeseveral problem or hypothesis names. This structure means that the statement is true for all non countingversions, or for all counting versions. For example, in the first line below the two implies statements are:“The F k -OV hypothesis (i.e.F k -OVH) states that F k -OV requires n k − o ( ) time.”and “The k -OV hypothesis (i.e. k -OVH) states that k -OV requires n k − o ( ) time.”. Definition 16.
The ( k -OV hypothesis (i.e.( k -OVH) states that ( k -OV requires n k − o ( ) time.The ( k -SUM hypothesis (i.e.( k -SUMH) states that ( k -SUM requires n k − o ( ) time.The ( k -XOR hypothesis (i.e.( k -XORH) states that ( k -XOR requires n k − o ( ) time.The ( k - f hypothesis (i.e.( k - f H) states that ( k - f requires n k − o ( ) time.Now we will define the hypotheses for our factored clique problems. Definition 17.
The ( k C hypothesis (i.e.( k CH) states that ( k C requires n k − o ( ) time.The ( f k C hypothesis (i.e.( f k CH) states that ( f k C requires n k − o ( ) time. We will separate the average-case distribution of factored problems into the normal case and a more-generalparameterized case.
Definition 18. More General Average-Case
Let S b , µ be a distribution over sets of vectors from { , } b . Aset drawn from S b , µ includes every vector w ∈ { , } b with probability µ .Let D g , b , µ be a distribution over factored vectors v where all g sets of v [ i ] are sampled iid from S b , µ .The average-case distribution for k - f µ samples every factored vector in its input iid from D g , b , µ .14he average-case distribution for f k C µ samples every factored vector in its input iid from D g , b , µ .For the average-case we use in this paper we use µ = /
2. We feel this is the most natural distributionfor our problem. We will occasionally call this the “uniform average-case” to emphasize that every set v [ i ] in every factored vector is chosen uniformly at random from all possible subsets of { , } b . Definition 19.
The average-case distribution for k - f samples every factored vector in its input iid from D g , b , / .The average-case distribution for f k C samples every factored vector in its input iid from D g , b , / . Here we define problems that later are shown to be hard via reductions from the factored problems. We statethe known results for each, and a simple algorithm for each is given in Appendix A that matches the lowerbound we prove later.
Definition 20.
The
Partitioned Matching Triangles (PMT) problem takes as input g = O ( log n / log log n ) disjoint n -node graphs with node colors, and asks if there is a triple of colors with a triangle of that colortriple in each of the g graphs. The counting version of the problem, PMT , asks for the number of such g -tuples of colored triangle.This problem is very similar to the ∆ Matching Triangles problem defined in [AVY18], where given an n -node graph G with node colors, the problems asks if there is a triple color with ∆ triangles of that colortriple in G .In [AVY18], 3SUM, APSP and SETH are reduced to ∆ Matching Triangles where the instances pro-duced can be represented as instances of Partitioned Matching Triangles instance for g = ∆ . So PartitionedMatching Triangles is hard from 3SUM, APSP and SETH. A related problem to PMT is the node disjointtriangle packing problem which asks to find a maximum size node-disjoint triangle packing in a given graph(see for example [CR02]). PMT is a natural mix of the ∆ -matching-triangle and the node disjoint trianglepacking problems. Definition 21. Node Labeled k -Color st Connectivity ( k -NLstC) takes as input a directed graph G withedge set E and vertex set V , two special nodes s and t , and a proper coloring of the vertices c : V \ { s , t } → C ,where C is a set of colors, so that the endpoints of every edge have different colors and s and t have alltheir neighbors colored distinctly. The input graph G is a layered graph, the vertex set V is partitionedinto V , V , . . . , V (cid:96) , such that every directed edge goes from a node in set V i to a node in set V i + for some i ∈ { , . . . , (cid:96) − } . The k -NLstC problem asks if there is a path from s to t that uses only k colors of nodes(where s and t are not counted for colors).We also consider the problem of Counting k -NLstC mod R , in which we ask for the total number ofpaths from s to t that use at most k colors of nodes. We will generally use values of R such that lg ( R ) issubpolynomial, as this allows us to represent the count with a subpolynomial number of bits. Definition 22.
The k Edge Labeled (directed/undirected) st Connectivity ( k -ELstC) problem takes asinput a directed acyclic graph G = ( V , E ) , two special vertices s and t and a coloring of the edges c : E → C ,where C is a set of colors. k -ELstC asks, given this input can you pick k colors such that there is a path from s to t using only edgesthat are colored by one of those k colors? The counting version of k -ELstC, k -ELstC asks for the numberof paths from s to t mod R that use only k colors, where lg ( R ) = n o ( ) .15 efinition 23. The
Bounded Labeled Maximum Flow (BL-MF) problem [GCSR13] takes as input adirected, capacitated, and edge-labeled graph G = ( V , E ) with a source node s ∈ V , a sink node t ∈ V , anda positive integer k , and asks if there is a maximum flow x from s to t in G such that the total number ofdifferent labels corresponding to arcs ( i , j ) ∈ E with non-zero flow is less than or equal to k . For fixedconstant k , we refer to the problem as k L-MF.BL-MF is the decision version of the maximum flow with the minimum number of labels (MF-ML) problem where we seek a maximum flow from s to t that uses the minimum number of labels. [GCSR13]uses this problem to model the purification of water during the distribution process. They show that BL-MFis NP-complete. Let BL-MF* be a slightly more restricted version of BL-MF where the number of edges ofeach label is o ( n ) and the edges attached to the sink and source have a special label l ∗ . We show a lowerbound of O ( n k − ) for k L-MF* (and thus k L-MF) for fixed k , and show that it has a matching algorithm aswell. Definition 24.
The
Regular Expression Matching problem [BI16] takes as input a regular expression(pattern) p of size m and a sequence of symbols (text) t of length n , and asks if there is a substring of t thatcan be derived from p . The counting version of the problem, R , where R = n o ( ) .A classic algorithm constructs and simulates a non-deterministic finite automaton corresponding to theexpression, resulting in the rectangular O ( mn ) running time. Definition 25.
The (counting) k -Longest Common Subsequence (( k -LCS) problem (see for example[IF92]) takes as input k sequences P , . . . , P k of length n over an alphabet Σ . Let (cid:96) be the length of the longestsequence X such that X appears in all of P , . . . , P k (in the same order). k -LCS asks for the value of (cid:96) , while k -LCS asks to compute (cid:96) and also the total number of commonsubsequences of length (cid:96) .More formally, define C ( X i ) to be the total number k -tuples of (cid:96) sequence locations in each of our k strings such that those locations map onto the sequence X i for all k strings when X i is of length (cid:96) . Let X , X , . . . X j be all possible sequences of length (cid:96) that appear in all of P , . . . , P k . For the k -LCS problemwe ask for the value of (cid:96) and the value of Π ji = C ( X i ) . Definition 26.
The
Edit Distance problem (see for example [BI15]) takes as input two sequences x and y over an alphabet Σ , and asks to output the edit distance EDIT ( x , y ) which is equal to the minimum numberof symbol insertions, symbol deletions or symbol substitutions needed to transform x into y . In this section we will first show the simple result that F k -OV, F k -SUM , F k -XOR, and FZT are all at leastas hard as their non-factored variants. Second, we will show a worst-case to average-case reduction fromF k -OV to itself. We will also show the corresponding worst-case to average-case reductions for F k -SUM, F k -XOR, and FZT. Third, we will show many worst-case reductions between these factored problems.Notably, F k -OV, F k -SUM , and F k -XOR are all equivalent up to sub-polynomial factors. Additionally,FZT is n − o ( ) hard from F3-OV (and thus equivalently hard from F3-SUM , and F3-XOR). Notably thismeans that the F f O ( n k + o ( ) ) algorithmsfor F k -OV, F k -SUM , FZ k C and F k -XOR. 16 k -OV F k -XORF k -SUMFZ k C F k -fFf k C Figure 3: Map of the reductions
Consider any problem where we have k sets of vectors V , . . . , V k and we want to compute the number of k -tuples of vectors v ∈ V , . . . , v k ∈ V k of length l = bg , such that ˆ f ( v , . . . , v k ) =
1, for some functionˆ f : { , } l × k → { , } . Call this problem k - ˆ f . Note that k -SUM, k XOR, and k OV are examples of suchproblems. We show that these problems can be solved using their factored version.For any vector v of length bg and for any j = , . . . , g , let v j be the subvector of v that starts at the ( j − ) b + jb th bit. Suppose that there is a function f : { , } b × k → { , } such thatˆ f ( v , . . . , v k ) = Π gj = f ( v j , . . . , v jk ) =
1. We call f the factored version of ˆ f . In other words,the function ˆ f can be applied more locally, on subvectors of length g . Note that for most problems includingthe problems we work with, this property holds.Now we can easily reduce k - ˆ f to F k - f . Let the resulting F k - f instance be the following: For any bg lengthvector v in the k - ˆ f instance, let the factored version of v have sets v [ j ] = { v j } . By the property mentioned,it is straightforward to see that this instance of F k - f is equivalent to k - ˆ f .For the k -SUM problem it is less obvious how to solve it with F k -SUM . For the k -SUM problem wecan use the nearly linear hash functions to reduce all numbers to the range [ − n k , n k ] [Pat10]. Additionally,we can reduce k -SUM in the range [ − n k , n k ] to a version where every number is instead a vector with g numbers with b bits each [ALW14], where g · b = k lg ( n ) . We consider a sum of k vectors to be a zero sumif the vectors sum to the zero vector. To ask if k numbers of length k lg ( n ) sum to zero, we can instead askif k vectors sum to the zero vector where the vectors have length g and the numbers are each b bits. But, weneed to guess the g − O ( k g ) guesses. If g = o ( lg ( n )) this is sub-polynomial, and sowe can go through all these guesses. This vectorized version of the k -SUM problem can be directly solvedby F k -SUM as mentioned above.Similar to the approach for solving k - ˆ f problems using F k - f , we can reduce Z k C to FZ k C. Here thefunction ˆ f (which is the sum function) gets (cid:0) k (cid:1) vectors as input instead of k vectors, and these vectors shouldhave the property that they form the edges of a k -clique in the graph. If f is the factored version of ˆ f , then wehave that ˆ f ( e , . . . , e ( k )) = e , . . . , e ( k ) are the edges of a k -clique if and only if Π gj = f ( e j , . . . , e j ( k )) = e , . . . e ( k ) are edges of a k -clique. So again, the FZ k C instance that is equivalent to the Z k C instanceis that for each vector e of an edge, we let e [ j ] = { e j } . So we have the following theorem. Note that ourreductions form a one-to-one correspondence between each solution in a k - ˆ f instance and the correspondingF k - f instance, and hence they work for the counging version of our problems as well. R EMINDER OF T HEOREM
In O ( n ) time, one can reduce an instance of size n of k-OV, k-XOR, k-SUMand ZkC to a single call to an instance of size ˜ O ( n ) of Fk-OV, Fk-XOR, Fk-SUM and FZkC respectively.Proof. We can split a number or vector in the original problem into a vector with g numbers of length b .This reduction step is trivial for k -OV, Z k C, and k -XOR. To be explicit: • k -OV: Let d = o ( lg ( n )) be the dimension. Given k lists of n vectors L , . . . , L k we will produce k listsof factored vectors L (cid:48) , . . . , L (cid:48) k . Let v [ x : y ] be a vector formed by taking all the bits from x th bit to the17 th bit. For every vector v i ∈ L i take the vector v i [ b j + , b ( j + )] = v ji where b = √ d and j ∈ [ , g ] where g = √ d . We create a factored vector v (cid:48) i from v i by creating a vector where the j th subset of { , } b is just a set with the single vector v ji . • k -XOR: There is a random reduction for k -XOR which shrinks the vectors to length d = k lg ( n ) bits.Given two lists of n vectors L and L we will produce two lists of factored vectors L (cid:48) and L (cid:48) . Let v [ x : y ] be a vector formed by taking all the bits from x th bit to the y th bit. For every vector v i ∈ L i takethe vector v i [ b j + , b ( j + )] = v ji where b = √ d and j ∈ [ , g ] where g = √ d . We create a factoredvector v (cid:48) i from v i by creating a vector where the j th subset of { , } b is just a set with the single vector v ji . • Z k C and k -SUM: We reduce the range of numbers with linear hash functions to the range [ − n k , n k ] .We want to split each k lg ( n ) bit number into g = (cid:112) k lg ( n ) numbers length b = (cid:112) k lg ( n ) bits. If weguess all g caries then we can replace the question of if k ( (cid:0) k (cid:1) ) numbers sum to zero to if g sets of k ( (cid:0) k (cid:1) ) numbers each sum to zero (see [ALW14]). So, for all O ( k g ) possible guesses of carries we forma factored vector for an edge by having g subsets of { , } b that each have one number. The j th set hasthe j th number created by splitting the original number (possibly updated by our guess of the carry). We will use our framework from Section B to show that these factored versions are as hard on average asthey are in the worst case. k - f We give a polynomial for k - f . We represent every factored vector v with g b variables. Thevariable x v [ i ] ( (cid:126) s ) is a 1 if s ∈ v [ i ] and 0 otherwise. We create such a variable for all i ∈ [ , g − ] and all s ∈ { , } b . Let S f be the subset of k tuples of vectors in { , } b such that f ( s , . . . , s k ) = f ck f unc ( (cid:126) X ) = ∑ v ∈ V ,..., v k ∈ V k ∏ i ∈ [ , g − ] ∑ ( s ,..., s k ) ∈ S f x v [ i ] ( (cid:126) s ) · · · x v k [ i ] ( (cid:126) s k ) . Lemma 3.1. f ck f unc ( (cid:126) X ) is a GLDP( f ) (see Definition 8)Proof. We will show that each property of a good polynomial is met by f ck f unc . • If (cid:126) I = b , . . . , b n , then f ck f unc ( b , . . . , b n ) = f ck f unc ( (cid:126) I ) = P ( (cid:126) I ) where b i maps to either a zero or a onein the prime finite field : f ck f unc and k - f count the same thing. Note that the inner summation iscomputing ◦ f , the product is computing (cid:125) f . Thus the overall sum is computing k - f . • The function f ck f unc has degree d = o ( lg ( n ) / lg lg ( n )) : f ck f unc has degree kg which, when k is constantis o ( lg ( n ) / lg lg ( n )) by the definition of g . • The function f ck f unc is strongly d-partite:
Every monomial is formed by exactly one copy of a x v j [ i ] ( (cid:126) s ) variable for every j ∈ [ , g − ] and i ∈ [ , k ] . These form our partitions and make the function strongly kg partite. 18ow we can say that the average case version of k - f is as hard as the worst case version. R EMINDER OF T HEOREM
Let µ be a constant such that < µ < . If average-case f µ (seeDefinition 18) can be solved in time T ( n ) with probability − / ( lg ( n ) kg lg lg ( n ) kg ) then worst-case f can be solved in time ˜ O ( T ( n )) .When µ = / average-case f µ is average-case f .Proof. This follows from Theorem 1.20 and Lemma 3.1. The dimension of the GLDP( k - f ) is kg . Byour construction of f ck f unc every set has every possible string as a variable. By the construction of theframework from theorem 1.20, every bit will be selected as a 1 uniformly at random with probability µ . So,given the construction of f ck f unc every set will have every possible string included with probability µ . Sothe distribution induced by our framework matches our defined average-case distribution.Finally by definition 19 when µ = / k - f µ is average-case k - f . R EMINDER OF C OROLLARY
By Theorem 1.3, we have the following result:If average-case ( n ) with probability − / ( lg ( n ) gk lg lg ( n ) gk ) then worst-case ˜ O ( T ( n )) .If average-case ( n ) with probability − / ( lg ( n ) gk lg lg ( n ) gk ) thenworst-case ˜ O ( T ( n )) .If average-case ( n ) with probability − / ( lg ( n ) gk lg lg ( n ) gk ) thenworst-case ˜ O ( T ( n )) . f k C Now we will give the f k C polynomial. Once again we will represent every factored vector v with g b variables. The variable x v [ i ] ( (cid:126) s ) is a 1 if s ∈ v [ i ] and 0 otherwise. We create such a variable for all i ∈ [ , g − ] and all s ∈ { , } b . Once again, let S f be the subset of (cid:0) k (cid:1) tuples of vectors in { , } b suchthat f ( s , . . . , s ( k )) =
1. Finally for convenience let E , . . . , E ( k ) be the (cid:0) k (cid:1) partitions of edges in the input ofF f k C and let (cid:96) = (cid:0) k (cid:1) to make notation easier to read. Let S E be the set of all (cid:96) tuples of edges e , . . . , e (cid:96) thatform a clique. In an abuse of notation we will also use e i to represent the factored vector associated with theedge e i . f f f kc ( (cid:126) X ) = ∑ e ,..., e (cid:96) ∈ S E ∏ i ∈ [ , g − ] ∑ ( s ,..., s (cid:96) ) ∈ S f x e [ i ] ( (cid:126) s ) · · · x e (cid:96) [ i ] ( (cid:126) s (cid:96) ) . Lemma 3.2. f f f kc ( (cid:126) X ) is a GLDP( f kC) (see Definition 8).Proof. We will show that each property of a good polynomial is met by f f f kc . • If (cid:126) I = b , . . . , b n , then f f f k ( b , . . . , b n ) = f f f kc ( (cid:126) I ) = P ( (cid:126) I ) where b i maps to either a zero or a one in theprime finite field : f f f kc and k - f count the same thing. Note that the inner summation is computing ◦ f , the product is computing (cid:125) (cid:48) f . Thus the overall sum is computing k - f . • The function f f f kc has degree d = o ( lg ( n ) / lg lg ( n )) : f f f kc has degree (cid:96) g < k g which, when k isconstant is o ( lg ( n ) / lg lg ( n )) by the definition of g . Note that given that g = o ( lg ( n ) / lglg ( n )) then a probability of 1 − / n ε will be high enough for any ε > The function f f f kc is strongly d-partite:
Every monomial is formed by exactly one copy of a x e j [ i ] ( (cid:126) s ) variable for every j ∈ [ , g − ] and i ∈ [ , (cid:96) ] . These form our partitions and make the function strongly (cid:96) g partite. R EMINDER OF T HEOREM
Let µ be a constant and < µ < . If average-case f kC µ (see Definition18) can be solved in time T ( n ) with probability − / ( lg ( n ) k g lg lg ( n ) k g ) then worst-case f kC can besolved in time ˜ O ( T ( n )) .When µ = / average-case f kC µ is average-case f kC.Proof. This follows from Theorem 1.20 and Lemma 3.2. The dimension of the GLDP( f k C) is (cid:0) k (cid:1) g < k g .By our construction of f f f kc every set has every possible string as a variable. By the construction of theframework from theorem 1.20, every bit will be selected as a 1 uniformly at random with probability µ . So,given the construction of f f f kc every set will have every possible string included with probability µ . So thedistribution induced by our framework matches our defined average-case distribution.Finally by definition 19 when µ = / f k C mu is average-case f k C. R EMINDER OF C OROLLARY
By Theorem 1.5, we have the following result:If average-case ( n ) with probability − / ( lg ( n ) k g lg lg ( n ) k g ) thenworst-case ˜ O ( T ( n )) . Reductions to Counting Factored Problems Imply Average Case Hardness Over Some Distribution
Assume a problem P exists such that an algorithm for it running in T ( n ) − ε implies a violation of k - f H or f k CH. We will evince examples of such problems in Section 4. Further imagine that there is anexplicit reduction that turns instances of k - f or f k C into instances of P . In that case we can describea distribution D over which problem P is T ( n ) − o ( ) hard on average from k - f H or f k CH. We cangenerate this distribution D by taking the uniform distribution (the average-case distribution) over k - f or f k C and running this distribution through our reduction.Thus, reductions from problems P to k - f or f k C give explicit hard average-case distributions forproblems P . Our factored versions of these problems are very expressive. This allows us to show hardness from thesefactored problems.
We will now show that F k -OV, F k -XOR, and F k -SUM are all complete for F k - f for all functions f . Wedo this by showing F k -XOR solves F k - f . Then, the equivalence between F k -OV, F k -XOR, and F k -SUMimplies they are all complete for F k - f . We will also show, using similar techniques, that FZ k C is completefor F f k C for all functions f .This is a reminder of Theorem 1.7, however, we add an additional statement to the theorem. We give anexplicit function that we use to build this reduction. R EMINDER OF T HEOREM
If we can solve b length vectors in time T ( n ) then we can solve f instance with g sets of b length vectors in time T ( n ) + ˜ O ( n ) . dditionally, Let v , . . . , v k be k factored vectors each with g subsets of { , } b . Let f XOR be the functionthat returns if the k input vectors xor to zero and otherwise returns . There is a function γ f → XOR , k ( · , · ) that takes as input a factored vector with g subsets of { , } b and an index and returns a new factored vectorwith g subsets of { , } O ( b ) . This function γ f → XOR , k runs in ˜ O ( b · g ) time for each vector and: (cid:125) f XOR ( γ f → XOR , k ( v , ) , . . . , γ f → XOR , k ( v k , k )) = (cid:125) f ( v , . . . , v k ) . Proof.
Consider a F k - f instance and let v i be a factored vector from the i th list of it. Given the factoredvector v i from F k - f we will describe how to make the factored vector v (cid:48) i for our F k -XOR instance. Thistransformation will be γ f → XOR , k ( · , · ) . We will describe the transformation for γ f → XOR , k ( v i , i ) . We do this bydoing the same transformation on each set v i [ j ] where j ∈ [ , g ] . We transform each set by performing thesame transformation on every vector u i ∈ v i [ j ] . We describe this transformation in the next paragraph.Given a vector u i of length b we produce at most 2 b ( k − ) new vectors of length k b . These vectorsrepresent all possible k tuples which include u i as as the i th vector. We want to include a k tuple vector onlyif f of that k tuple evaluates to 1. And we want our new long vectors to to return true if we are comparingvectors in F k - f instance that do indeed have exactly that k tuple of vectors.More formally, let one possible k tuple that includes u i as the i th vector be ( w , . . . , w i − , u i , w i + . . . , w k ) .If f ( w , . . . , w i − , u i , w i + . . . , w k ) = , then we create a k b -length vector for u i with this kb length vector byconsidering every possible tuple ( x , y , z ) where x , y , z ∈ [ , k ] : We set aside b bits for every possible tuple (insorted order by the tuple). We want to use these to check if the x th vector and y th vector agree about whattuple they are considering as follows: • If the tuple is ( x , x , z ) we write the all zeros string, for the rest of the cases assume the first two indicesare non-equal. • If the tuple is ( x , i , z ) we write w z (or u i if z = i ) in the b bits. • If the tuple is ( i , y , z ) we write w z (or u i if z = i ) in the b bits. • If the tuple is ( x , y , z ) and x , y (cid:54) = i then we write the all zeros vector of length b .If we are comparing k of these new vectors each of which representing the same tuple ( w , . . . , w k ) thenthe new vector xors to zero. Consider a given group of b bits that corresponds to ( x , y , z ) . Only two of ourvectors have non-zero entries here, the x th and y th vectors. Both wrote down w z if they were representing thesame k -tuple. A vector xored to itself produces the zero vector, so we get the zero vector.If we are comparing k of these new vectors and not all of the vectors agree about what tuples they arecomparing then we will not xor to the zero vector. Say the x th and y th vectors disagree about what the z th element of the tuple is. Then the b bits corresponding to ( x , y , z ) will still have only two vectors withnon-zero contributions. We will be xoring two vectors which are not equal, this will xor to some non-zerostring.Thus there is a one-to-one correspondence between k -tuples of vectors that evaluate to one in the F k - f version and k -tuples of vectors that xor to the zero vector in the new F k -XOR version. Thus, the countsboth give as output are equal.As a result, we can transform an instance of F k - f with g groups of b length vectors into an instance ofF k -XOR with g groups of k b length vectors in time O ( n · g · b · ( k − ) b · k b ) . We restrict k to be constantand b = o ( lg ( n )) , thus the time for the conversion is ˜ O ( n ) . In the new version the count of the number of21 k -XOR vectors that xor to zero is the same as the count of the number of F k - f vectors that evaluate to 1 onthe function. So, a T ( n ) algorithm for F k -XOR with g groups and k b bits implies a T ( n ) + ˜ O ( n ) algorithmfor F k - f . k -OV, f k -SUM, and F k -XOR are Equivalent and Complete Intuitively, we can use our subsets of { , } b to do guesses that reduce from one problem to another. Lemma 3.3.
If ( ( n ) then ( ˜ O ( T ( n )) time.Proof. Say we are given an F k -XOR instance, with k lists of factored vectors, each with g subsets of b -bitvectors. We will follow the structure of Theorem 1.7. Say we are given a factored vector from list i , v i .Consider the j th subset v i [ j ] of it. Consider a particular vector u i ∈ v i [ j ] . We will produce a new vector forevery possible k tuple of vectors ( w , . . . , u i , . . . , w k ) such that w ⊕ . . . ⊕ u i ⊕ . . . ⊕ w k = (cid:126)
0. This vector willhave k sections each of length 2 b , for a total length of vector 2 k b . These k sections will correspond toevery possible tuple ( x , y , z ) where x , y , z ∈ [ , k ] . The 2 b bits will be used to check if the vector from list x and the vector from list y agree about the vector w z . We want to only accept if there are k vectors, one fromeach list that xor to the zero vector. Let ¯ s be the bitwise bit flip of every bit in s . We will use the fact that ifboth s and ¯ s are orthogonal and ¯ s and s are orthogonal then s = s . This allows us to check equality. Let (cid:107) be the concatenation operator (e.g 00 (cid:107) = b bits that correspond to ( x , y , z ) are determinedas follows: • If the tuple is ( x , x , z ) we write the 2 b bit all zeros string. For the rest of these assume the first twoindices are not equal. • If the tuple is ( i , x , z ) then write w z (cid:107) ¯ w z (for convenience let w i = u i ). • If the tuple is ( x , i , z ) then write ¯ w z (cid:107) w z (for convenience let w i = u i ). • If the tuple is ( x , y , z ) and x (cid:54) = i and y (cid:54) = i then we put the all ones string.Now k of these constructed vectors will be orthogonal only if w ⊕ . . . ⊕ w k = (cid:126)
0, all the vectors w i existedin the original lists, and the constructed vectors all agree on the tuple ( w , . . . , w k ) .So, with our constructed vectors the count of the number of vectors that are orthogonal will remainthe same. The new instance will have the same number of factored vectors, n , but the vectors will have g subsets of { , } k b . An algorithm which runs in T ( n ) on this F k -OV instance will run in T ( n ) on theF k -XOR instance.Next we reduce ( k -XOR to ( k -SUM . In F k -XOR we want to know if k vectors xor to zero, whichis very similar to asking if k numbers sum to zero. The difference is entirely carries. So, we can pad theinstance, and then guess carries.We will use the F k -SUM variant where we ask if k − Lemma 3.4.
If ( ( n ) then ( ˜ O ( T ( n )) time.Additionally, Let v , . . . , v k be k factored vectors each with g subsets of { , } b . Let f XOR be the functionthat returns if the k input vectors xor to zero and otherwise returns . Let f SUM be the function that returns if the k input vectors sum to zero and otherwise returns . There is a function γ XOR → SUM , k ( · , · ) that takes s input a factored vector with g subsets of { , } b and an index and returns a new factored vector with gsubsets of { , } O ( b ) . This function γ XOR → SUM , k runs in ˜ O ( b · g ) time for each vector and: (cid:125) f SUM ( γ XOR → SUM , k ( v , ) , . . . , γ XOR → SUM , k ( v k , k )) = (cid:125) f ( v , . . . , v k ) . Proof.
We will describe the transformation γ XOR → SUM , k below. Let v , . . . , v k be k factored vectors from aF k -XOR instance. Let v [ j ] , . . . , v k [ j ] be the j th subset of b -bit vectors from each of the factored vectors. Let v i [ j ][ h ][ (cid:96) ] be the (cid:96) th bit of the h th vector in the set v i [ j ] .We will turn every bit from v i [ j ][ h ][ (cid:96) ] into (cid:100) lg ( k ) (cid:101) + i < k then this new longerstring is (cid:100) lg ( k ) (cid:101) zeros followed by the bit v i [ j ][ h ][ (cid:96) ] . If i = k , then every vector v k [ j ][ h ] turns into manyvectors in the k th set of the F k -SUM instance: If v k [ j ][ h ][ (cid:96) ] = (cid:100) lg ( k ) (cid:101) + even numbers in [ , k − ] . If v k [ j ][ h ][ (cid:96) ] = (cid:100) lg ( k ) (cid:101) + odd numbers in [ , k − ] . So we produce O ( k b ) vectors for v k [ j ][ h ] .If a k-tuple of vectors forms a zero vector in k-xor then we get exactly one k-sum. The number of setsstays the same but the length of vectors in those sets grows from b to ( (cid:100) lg ( k ) (cid:101) + ) b length vectors. This isa constant and so if F k -SUM can be solved in time T ( n ) then F k -XOR can be solved in ˜ O ( T ( n )) time. R EMINDER OF T HEOREM
If any of ( n ) time thenall of ˜ O ( T ( n )) time.Proof. This follows from Lemmas 3.3, 3.4, and Theorem 1.7. R EMINDER OF T HEOREM
If any of ( n ) time then f can be solved in ˜ O ( T ( n )) time.Proof. Use Theorem 1.7 and Theorem 1.8.By Theorem 1.8 and Theorem 1.9 we get the following corollary.
Corollary 3.5. f for any function f . k -clique is hard from f k -OV, f k -SUM, f k -XOR, and F f k CLemma 3.6.
If ( ( n ) then ( ˜ O ( T ( n )) .Proof. Consider a F k -SUM instance with lists L , . . . , L k . We will build the k -partite graph of our FZ k C in-stance to have vertex sets V , . . . , V k . For every factored number x i ∈ L i from the F k -SUM instance we createa node v i ∈ V i where all edges going from v i to any vertex in V i + have the value x i on them. All edges goingfrom v i to nodes in V j where j (cid:54) = i − j (cid:54) = i + v , v , . . . , v k the corresponding edges have a zero sum iff the corre-sponding x , x , . . . , x k are a zero sum. Theorem 3.7.
If ( ( n ) time then all of ( ˜ O ( T ( n )) time. roof. This follows from Lemma 3.6 and Theorem 1.8.Now we will show that FZ k C is complete for the set of all problems F f k C for all functions f . R EMINDER OF T HEOREM
If ( ( n ) time then ( f kC for any f , can besolved in ˜ O ( T ( n ) + n ) time.Proof. We will use the transforms γ f → XOR , ( k )( · , · ) and γ XOR → SUM , ( k )( · , · ) from Theorem 1.7 and Lemma 3.4respectively.Let G be the k -partite graph we take as input from ( f k C, now label the (cid:96) = (cid:0) k (cid:1) edge sets as E , . . . , E (cid:96) .Now, for every factored vector e i ∈ E i run the following transform: ˆ γ (cid:96) ( e i , i ) = γ XOR → SUM , ( k )( γ f → XOR ,(cid:96) ( e i , i ) , i ) . This causes the output factored vector to have g subsets of { , } O ( b ) . The transformation takes ˜ O ( O ( b ) g ) time per vector, which is ˜ O ( ) time per vector. The output vectors have the property that (cid:125) f SUM ( ˆ γ (cid:96) ( e , ) , . . . , ˆ γ (cid:96) ( e (cid:96) , (cid:96) )) = (cid:125) f ( e , . . . , e (cid:96) ) . Because (cid:125) (cid:48) f (the function used in our factored clique problem definition) is equal to (cid:125) f · isClique ( e , . . . , e (cid:96) ) ,by running this transformation we will have that: (cid:125) (cid:48) f SUM ( ˆ γ (cid:96) ( e , ) , . . . , ˆ γ (cid:96) ( e (cid:96) , (cid:96) )) = (cid:125) (cid:48) f ( e , . . . , e (cid:96) ) . Thus, we can run the transformation ˆ γ (cid:96) in time ˜ O ( n ) (because n is the input size). Additionally, theoutput of the counting or detection variants of the FZ k C on the transformed input will be exactly equal to theoutput of F f k C on the original input. Thus, if we can solve ( k C in time T ( n ) we can solve ( f k C intime ˜ O ( T ( n ) + n ) . The FZ CH is implied by any one of SETH, the -SUM hypothesis, or the APSP hypothesis.Proof. A violation of FZ3CH implies a violation of F3-OVH by Lemma 3.7. A violation of F3-OVH impliesa violation of SETH [Wil07].A violation of FZ3CH implies that a O ( n − ε ) time algorithm exists for the zero triangle problem forsome ε >
0. A O ( n − ε ) time algorithm for zero triangle implies a violation of the 3-SUM hypothesis andthe APSP hypothesis [VW10b].So if any one of the three core hypotheses of fine-grained complexity (SETH, 3-SUM, and APSP) aretrue then FZ3CH is true. R EMINDER OF T HEOREM
If FZ C (even for b = o ( log n ) and g = o ( log ( n ) / log log ( n )) ) can be solvedin O ( n − ε ) time for some constant ε > , then SETH is false, and there exists a constant ε (cid:48) > such that -SUM can be solved in O ( n − ε (cid:48) ) time and APSP can be solved in O ( n − ε (cid:48) ) time.Proof. This follows from Lemma 3.8. A O ( n − ε ) time algorithm implies a violation of FZ3CH. If FZ3CH isfalse then all of SETH, the APSP hypothesis, the 3-SUM hypothesis are false.24 Implications from Factored Variants
In this section we will show that a series of problems reduce from both counting and decision versions ofFZ3C, FZ k C, and F k - f .The reductions from the counting variant of FZ3C generate counting problems that are hard in theaverage-case from SETH, 3-SUM, and APSP. The reductions from the counting variant of FZ k C or F k - f generate counting problems that are hard in the average-case from SETH. As a result, in this section weproduce a suite of problems that are fine-grained hard from the most popular hypotheses of fine-grainedcomplexity.In this section we give explicit tight fine-grained reductions from factored problems to many otherproblems. We will quickly summarize the results of this section.We give four tight fine-grained reductions from counting versions of our factored problems. We reduce k -NLstC from k C and k -ELstC from k - f . Finally, we reduce counting regularexpression matching to ( k + ) L-MF to FZ k C. We reduce Edit Distance to F2-OV and k -LCS fromF k -OV. R EMINDER OF T HEOREM
If ( ( n ) time,then we can solve ( C in time ˜ O ( T ( n ) + n ) .Proof. Let G = ( U , V , W ) be an instance of FZ3C, where each edge e is a factored vector. For notationconvenience let uv [ j ] refer to the j th set of the factored vector on the edge from u to v .We define an instance of PMT as a set of g graphs G j for j = , . . . , g . We define G j as follows. Forevery u ∈ U add a copy of u in G j with color u . For every v ∈ V and w ∈ W , add vertices v x and w x for all x = − b + , . . . , b + , with color v and w respectively. Note that since b = o ( log n ) , G j has ˜ O ( n ) nodes.Now we attach u ∈ G j to v x ∈ G j if x ∈ uv [ j ] . We connect v x to w y if y − x ∈ vw [ j ] and we connect w y to u if − y ∈ wu [ j ] .We prove that the FZ3C instance and the PMT instance are equivalent. For this, consider a zero triangle uvw , where the vectors x j ∈ uv [ j ] , y j ∈ vw [ j ] and z j ∈ wu [ j ] are picked to have sum zero for each j . Thiscorresponds to the triangles uv x j w y j + x j in G j for each j , where all these triangles are of color ( u , v , w ) .Conversely, any set of g triangles of color ( u , v , w ) in G j s should be of the form uv x j w y j , and hence from thedefinition of the PMT instance we have that for each j , x j ∈ uv [ j ] , y j − x j ∈ vw [ j ] and − y j ∈ wu [ j ] and sothey correspond to a zero uvw triangle. k -Node Labeled st Connectivity is hard from Factored Zero- k -Clique We will show that counting k -NLstC mod 2 k lg ( n ) is hard from k CH. The generated graph will be adense DAG. Recall that this implies an explicit average-case distribution over which counting k -NLstC mod2 k lg ( n ) is hard from worst case FZ k CH, SETH, the 3-SUM hypothesis, and the APSP hypothesis. R EMINDER OF T HEOREM
If a O ( | C | k − | E | − ε / ) or O ( | C | k − − ε | E | ) time algorithm exists for(counting mod k lg ( n ) ) k-NLstC then a O ( n k − ε ) algorithm exists for ( roof. Let G = ( V , . . . , V k ) be an instance of FZ k C. We reduce this instance to an instance of k -NLstC asfollows. We begin by adding the special node s and the special node t . We will build g gadgets and put themafter each other serially. The nodes in the gadgets will be assigned colors associated to the nodes of G . Eachgadget will be designed to check if given k colors (and thus k nodes in G ) whether the i th subset of the (cid:0) k (cid:1) factored vectors represented do have a zero sum. See Figure 4 for a representation of our construction. s t Set 1Set 2 . . .
Set g L L L ( k ) V V x V z V w V r u u x ( s ) u z ( s ) u w ( s , s ) u r Set i Figure 4: Left: The gadget structure for k -NLstC. Right: Inside of a set gadget.The gadget for set i consists of (cid:0) k (cid:1) layers L , . . . , L ( k ) . Each layer L j represents the edges from V x to V y for some x , y ∈ { , . . . , k } as follows: L j consists of two layers itself, one for V x and one for V y . Foreach vertex u x ∈ V x , we add 2 b ( j − ) nodes u x ( s , . . . , s j − ) where s , . . . , s j − ∈ { , } b , and we color thesenodes with the color u x . So we have a total of n b ( j − ) vertices. These vertices represent that we havechosen a particular node u x ∈ V x and that in the first j edges we have chosen the j − s , . . . , s j − from the sets of the previous j − L j , for each u y ∈ V y we add 2 b j nodes u y ( s , . . . , s j ) where s , . . . , s j ∈ { , } b , and we color these nodes with the color u y . We add edges betweennodes u x ( s , . . . , s j − ) and u y ( s , . . . , s j − , s j ) iff the i th set of the factored vector of edge ( u x , u y ) contains thestring s j , i.e. s j ∈ u x u y [ i ] .Now to specify the edges between layers, suppose that layer L j + deals with the edges between V z and V w . For every j -tuple ( s , . . . , s j ) , add an edge from u y ( s , . . . , s j ) in L j to u z ( s , . . . , s j ) in L j + for every u y ∈ V y and u z ∈ V z . If z = y we can skip this step and just use the same set nodes.Finally, we do something special for layer L ( k ) . Lets say that layer L ( k ) summarizes the edges between26 x and V y . For the nodes associated to V y , instead of having vertices u y ( s , . . . , s ( k )) , we put only one vertex u y . We connect u x ( s , . . . , s ( k ) − ) to u y if and only if the set i of the edge ( u x , u y ) has a vector s ( k ) such thatthe vectors s , . . . , s ( k ) − , s ( k ) sum to zero. Note that given a fixed choice of s , . . . , s ( k ) − there is a singlevector s ( k ) such that they all sum to zero together.This forms a layered directed graph, where edges go from layer L i to layer L i + . We also assume that L represents the edges from V to V x for some x . We add an edge from s to all vertices of the first layer of L and an edge from all vertices in the last layer of L ( k ) to t . A representation of the layers is represented inFigure 4.By this construction, a path with colors u , u , . . . , u k that goes through the j th gadget represents a zerosum within the j th sets on the (cid:0) k (cid:1) edges between u , . . . , u k .In our graph the number of colors | C | is O ( n ) and | E | = O ( n ) so a O ( | C | k − | E | − ε / ) algorithm and a O ( | C | k − − ε | E | ) algorithm both run in O ( n k − ε ) time. The number of solutions to both problems is the same,thus the counts are the same. The maximum count of FZ k C is 2 gb n k = O ( lg ( n )+ k lg ( n ) ) . Notably, this is lessthan 2 k lg ( n ) , so the count from the k -NLstC instance will be less than the count for the FZ k C instance.Note that we can count k -NLstC mod 2 k lg ( n ) with | C | = n and | E | = n in time ˜ O (cid:0) n k (cid:1) . Corollary 4.1.
If | C | k − ± o ( ) | E | ± o ( ) (where lg ( R ) = n o ( ) ).Proof. By Theorem 1.12 if k CH is true then k -NLstC (mod R ) takes at least | C | k − − o ( ) | E | − o ( ) time.By Theorem A.4 there is a | C | k − + o ( ) | E | + o ( ) time algorithm for counting k -NLstC mod R . k -Edge Labeled st Connectivity is hard from Factored k Function Problems (F k -f) In this subsection we will show hardness from The edge labeled version of st connectivity. This reductionwill get hardness from k - f . Note that while k -NLstC has a ˜ O ( C k − E ) algorithm, k -ELstC has a moreexpensive ˜ O ( C k − E ) algorithm. In this section we will show that the k -ELstC algorithm is optimal up tosublinear factors if F k - f H is true (note that this algorithm is thus also implied to be tight by SETH).While our reduction to k -NLstC generated a dense graph, our reduction to k -ELstC generates a sparse graph. The sparsity allows for a tight reduction to the F k - f H problem. However, because that our reductionrequires sparsity to be tight, we have not been able to reduce FZ k C to k -ELstC. R EMINDER OF T HEOREM
If a ˜ O ( | E || C | k − − ε ) or ˜ O ( | E | − ε | C | k − ) time algorithm exists for (count-ing mod k lg ( n ) ) k-ELstC, then a ˜ O ( n k − ε ) algorithm exists for ( f .Proof. Given an instance of F k - f which takes k lists V , . . . , V k of factored vectors, we produce an instanceof k -ELstC with ˜ O ( n ) colors and ˜ O ( n ) edges. In the F k - f instance, let u j [ i ] be the i th subset of the vector u j ∈ V j . We use the vectors in the F k - f instance as colors in the k -ELstC instance.We start by adding two nodes s and t . We will make g gadgets, G , . . . , G g , where G i handles the i th set of the factored vectors, i.e. u j [ i ] for all u j ∈ V j for all j . In each gadget G i we have k layers of vertices L i , . . . , L ik , where the vertex set L ij represents the factored vectors in V j . Finally we attach these gadgets oneafter the other serially.For j ≤ k the layer L ij has two layers itself, one with n b j nodes and one with 2 b j nodes. For each node u j ∈ V j , we add the nodes u j ( s , . . . , s j ) to the first layer of L ij for all s , . . . , s j ∈ { , } b , so adding n b j nodes in total. For the second layer of L ij , we add nodes l i ( s , . . . , s j ) for all s , . . . , s j ∈ { , } b . For eachvertex u j , we add a matching from the 2 b j nodes associated to vector u j to the nodes in the second layer,27onnecting u j ( s , . . . , s j ) to l i ( s , . . . , s j ) . We color these edges with u j . Note that this is how we achievesparsity. Every other layer has ˜ O ( ) nodes in it. So every node (other than s and t ) has an out-degree of˜ O ( ) .We add edges from the second layer of L ij to the first layer of L ij + . For u j + ∈ V j + , we connect l i ( s , . . . , s j ) ∈ L ij to u j + ( s , . . . , s j , s j + ) ∈ L ij + if, and only if, s j + ∈ u j + [ i ] . We color this edge with u j + .The full effect of this means that by layer L ik a path from the beginning to the end of the gadget with thecolors of a given set of k vectors implies those vectors have the corresponding set of vectors in their i th sets.We will only add outgoing edges from nodes in the second layer of L ik only if f ( s , . . . , s k ) = G i and G i + by adding edges between the second layer of L ik and the firstlayer of L i + as follows. We connect the node l i ( s , . . . , s k ) ∈ G i to u ( s (cid:48) ) ∈ G i + for some u ∈ V if andonly if f ( s , . . . , s k ) = s (cid:48) ∈ u [ i + ] . We color this edge with u .Now we deal with s and t . We add edges from s to all nodes u ∈ L if s ∈ u [ ] . These edges arecolored with u . Further, we add edges from the first layer of L gk to t directly, removing the second layer of L gk . We only add edges from u k ( s , . . . , s k ) for u k ∈ V k to t iff f ( s , . . . , s k ) =
1. We color this edge with u k .First, note that we always add edges between two layers of size o ( n ) and ˜ O ( n ) , so adding at most ˜ O ( n ) edges between them. Since we have O ( ) layers, our graph has ˜ O ( n ) edges in total.Given this graph setup, if we pick k colors for example associated with u ( ) , u ( ) , . . . , u k ( k ) then thenumber of paths from s to t using only those colors of edges will correspond to the outcome of (cid:125) ( u ( ) , u ( ) , . . . , u k ( k )) as defined in the preliminaries. As a result, the sum over all k tuples of colors will be the count of the outputof the F k - f instance. The count of a F k - f instance is at most n k bg = o ( k lg ( n ) ) . So if R = Ω ( k lg ( n ) ) thecount mod R and the count are the same. Corollary 4.2.
If Fk- f H ( f ) is true then k-ELstC( | C | k − ± o ( ) | E | ± o ( ) (when lg ( R ) = n o ( ) ).Proof. By Theorem 1.13 if F k - f H ( k - f H) is true then k -ELstC ( k -ELstC mod R ) takes at least | C | k − − o ( ) | E | − o ( ) time.By Theorem A.5 there is a | C | k − + o ( ) | E | + o ( ) time algorithm for counting mod R k -ELstC. ( k + ) Labeled Max Flow solves Factored Zero- k -Clique R EMINDER OF T HEOREM If ( k + ) L-MF can be solved in T ( n ) time, then we can solve FZkC intime ˜ O ( T ( n ) + n ) .Proof. We use the set gadgets from Theorem 1.12 and instead of placing them serially, we make a parallelnetwork G (cid:48) as shown in Figure 5. More particularly, let SG , . . . , SG g be the set gadgets from Theorem1.12. Add s , . . . , s g with a source node s to the graph. Add t , . . . , t g with a sink node t to the graph. Thiscompletes the definition of the vertices of G (cid:48) .We attach s to all s j and all t j to t with label l ∗ for j = , . . . , g . For each j , we attach s j to all the nodesin the first layer of SG j , which is a copy of V . Let the label of any s j u edge be u where u ∈ V . Connect allthe nodes in the last layer of SG j to t j for all j . Suppose that the last layer of SG j corresponds to V y . Let thelabel of any edge u y t j be u y . Let the label of any edge ( r , z ) in any set gadget SG j be the same as the color of r , since G (cid:48) is supposed to be an edge-labeled graph. All the edges are unit capacitated. This completes thedefinition of G (cid:48) . 28 s s g st t t g t Set 1 Set 2 Set g Figure 5: ( k + ) labeled max flow instance structure.First note that the maximum flow is at most g since the outdegree of s is g and the graph is unit-capacitated. So the flow going through each set gadget is at most 1, which means that there is at least onepath from s j to t j through SG j . From Theorem 1.12 any zero weight k -clique corresponds to g paths, onein each set gadget, using k labels corresponding to the k vertices of the clique. So any zero weight k -cliquecorresponds to a ( k + ) labeled flow of size g from s to t . Conversely, if there is a ( k + ) labeled flow ofsize g from s to t , it must correspond to (at least) one path from s j to t j in SG j for each j with all the g pathshaving the same k labels, which corresponds to a zero k -clique by Theorem 1.12. We are going to reduce F2-OV to regular expression matching. First, we define type and depth of a regularexpression. Intuitively, the structure of the operations in a regular expression is called its type , which isrepresented by a tree with nodes labeled with operations. Let • be an arbitrary operator. A tree T with rootnode • means that all the first level operations of a regular expression E of are • , i.e. E = A • A • . . . • A (cid:96) ,where A i s are regular expressions. The type of each A i can be the subtree with any of the children of the rootnode as its root. The depth of a regular expression is the longest root-leaf path in the type tree of the regularexpression.We reduce ( T shown in Figure 6, and we give an O ( mn ) algorithm for counting such patterns in O ( mn ) time (TheoremA.9 in the Appendix). R EMINDER OF T HEOREM
Let R be an integer where lg ( R ) is subpolynomial. If you can solve ( ( n ) time, then you can solve ( -OV in ˜ O ( T ( n ) + n ) time. |||∗ · · Figure 6: Type T of the regular expression of Theorem 1.15. Where “ | ” is the OR operator, “ · ” is theconcatenation operator, and ∗ is the Kleen star operator. Proof.
We use the proof of Theorem 1 in [BI16] that shows hardness for patterns of type “ | · | ”, where “ | ”is the OR operator, “ · ” is the concatenation operator and the type tree is a path of length two with node | , · and | respectively. In [BI16] authors start with any 2 OV instances ( A , C ) where A = { a , . . . , a n } and C = { c , . . . , c n } are sets of n vectors of dimension d and reduce it to an instance of regular expressionmatching with pattern p constructed from A (and independent from C ) and text t constructed from C (andindependent from A ) both of O ( dn ) size, where any orthogonal pair ( a , c ) with a ∈ A and c ∈ C correspondsto an alignment of p on a substring of t , and conversely any alignment of p on t corresponds to an orthogonalpair ( a , c ) . More particularly, pattern p = V G ( a ) | . . . | V G ( a n ) consists of the OR of vector gadgets V G ( a ) = CG ( a ) · . . . · CG ( a d ) where CG is a coordinate gadget and a i is the i th bit of vector a . Each coordinate gadgetis aligned on a single bit. The text t = V G (cid:48) ( c ) . . . V G (cid:48) ( c n ) consists of vector gadgets V G (cid:48) ( c ) = c c . . . c d which is the bit representation of the vector c . We have that a i · c j = V G ( a i ) on V G (cid:48) ( c j ) . As a result, the number of orthogonal pairs in ( A , C ) is the number of subset alignments of p on t .We use the above construction for our factored vectors. Note that if w is a factored vector, for any j ∈ { , . . . , g } we can construct a pattern (or a text) of length O ( | w [ j ] | b ) using the vectors in w [ j ] which havelength b .Consider an instance ( U , V ) of F2-OV where U = { u , . . . , u n } and V = { v , . . . , v n } are sets of n factoredvectors. We construct the pattern P using U and the text T using V . We first construct the pattern. Let p i [ j ] be the pattern corresponding to u i [ j ] using the construction of [BI16] for i = , . . . , n and j = , . . . , g . Notethat the symbols used in p i [ j ] are 0 ,
1. Let p (cid:48) i [ j ] = [ | | ] ∗ · p i [ j ] · [ | | ] ∗ , where “ ∗ ” is the Kleen staroperator. Define the “pattern factored vector gadget” PV G ( i ) for u i as follows: PV G ( i ) = p (cid:48) i [ ] · · p (cid:48) i [ ] · · . . . · · p (cid:48) i [ g ] Let the pattern P be the following: P = PV G ( ) | PV G ( ) | . . . | PV G ( n ) Note that the length of P is ˜ O ( n ) , since we have that | p i [ j ] | = O ( | u i [ j ] | ) = O ( b . b ) = o ( n ) , | p (cid:48) i [ j ] | = O ( p i [ j ]) and the number of occurrence of the symbol 3 is ( g − ) n . The number of symbols in a ∗ expression is also O ( gn ) since the number of ∗ expressions is 2 ng . So the total number of symbols in P is ˜ O ( n ) , and as a resultthe length of P is ˜ O ( n ) .Now we construct the text. Let t i [ j ] be the text corresponding to v i [ j ] using the construction in [BI16] for i = , . . . , n and j = , . . . , g . Note that the symbols used in t i [ j ] are 0 , ,
2. Define the “text factored vectorgadget”
TV G ( i ) for v i as follows: TV G ( i ) = t i [ ] t i [ ] . . . t i [ g ] Let the pattern T be the following: T = TV G ( ) TV G ( ) . . . TV G ( n ) P , the length of T is ˜ O ( n ) .Now we have to show that there is a one to one correspondence between orthogonal vectors in the F2-OV instance and the number of subset alignments of P on T . First consider an orthogonal pair ( u i , v j ) , wherefor each k = , . . . , g the vector chosen from u i [ k ] is the r k th vector u i [ k ][ r k ] , and the vector chosen from v j [ k ] is the s k th vector v j [ k ][ s k ] . So we have that for each k , u i [ k ][ r k ] . v j [ k ][ s k ] =
0. This means that there is a subsetalignment of p i [ k ] on t j [ k ] corresponding to u i [ k ][ r k ] and v j [ k ][ s k ] for all k . We use the [ | | ] ∗ parts of p (cid:48) i [ k ] to cover the rest of t j [ k ] and thus we get a full alignment of p (cid:48) i [ k ] on t j [ k ] . Having these alignments for each k , they extend uniquely to a full alignment of PV G ( i ) on TV G ( i ) .Conversely, suppose that there is a subset alignment of P on T . Note that the first level of the patternconsists of ORs, so any alignment should choose some i ∈ { , . . . , n } and align PSG ( i ) on T . On the otherhand, symbol 4 is not used in the pattern P . So P should be aligned on T SG ( j ) for some j . So assume thatin this subset alignment, PSG ( i ) is aligned on T SG ( j ) . Since there are exactly g − PSG ( i ) and there are exactly g − T SG ( j ) , the 3s should be aligned to eachother. So p (cid:48) i [ k ] is fully aligned to t j [ k ] . Recall that p (cid:48) i [ k ] = [ | | ] ∗ · p i [ k ] · [ | | ] ∗ . So p i [ k ] should be alignedto t j [ k ] . So by the construction of [BI16] there are unique r k and s k where the vector gadget for u i [ k ][ r k ] isfully aligned to the vector gadget for v j [ k ][ s k ] , which means that these two vectors are orthogonal. Sincethis is true for every k , u i and v j are orthogonal, and hence the number of factored orthogonal vectors in theF2-OV instance equals to the number of subset alignments of P on T . We are going to look at the k -LCS problem in this subsection. We show that k -LCS is hard from F k -OV. Wenote that this sort of proof should also work for other string similarity measures. In a work of Bringmannand K¨unnemann they show a general framework for proving hardness for string comparisons on two stringsfrom 2-OV [BK15]. Presumably this framework can be expanded to work for F k -OV, however, generatingthis framework is out of the scope of this paper. We will note however that the only additional gadget youseem to need to solve F k -OV is a selector gadget for at most ˜ O ( ) strings each of length ˜ O ( ) . This meanseven expensive gadgets are acceptable.We will first show that weighted k -LCS is hard from F k -OV. Definition 1. Weighted Longest Common Subsequence (WLCS) [ABV15]
For k sequences P , . . . , P k oflength n over an alphabet Σ and a weight function w : Σ → [ K ] , let X be the sequence that appears in all of P , . . . , P k as a subsequence and maximizes the expression W ( X ) = ∑ | X | i = w ( X [ i ]) . We say that X is the WLCSof P , . . . , P k and write WLCS ( P , . . . , P k ) = W ( X ) . The Weighted Longest Common Subsequence problemasks to output WLCS ( P , . . . , P k ) .We will then use this lemma from a previous work to show that k -LCS is hard from k -WLCS if theweights are small enough [ABV15]. Lemma 4.3.
If the k-LCS of k sequences of length O ( Kn ) over Σ can be computed in time T ( n ) then thek-WLCS of k sequences of length n over Σ with weights w : Σ → [ K ] can be computed in ˜ O ( T ( n ) K ) time[ABV15]. We want to use the ideas and gadgets of Abboud, Backurs and Vassilevska Williams [ABV15]. Webasically want to ask, given sets V , . . . , V k of factored vectors, are there k factored vectors v ∈ V , . . . , v k ∈ V k such that for all i there exist vectors u ∈ v [ i ] , . . . , u k ∈ v k [ i ] such that those vectors are orthogonal. Notably,once you have specified the factored vectors and the index i what remains is a (small) orthogonal vectorsinstance. The construction from [ABV15] produces a fixed longest common sub-sequence value if there31s an orthogonal k tuple. So, if we can construct a setup where the output of the WLCS is basically aconcatenation of gadgets for each index i then we will get the value we want for any given pair of vectors.We will need to add some gadgets to force the WLCS to “pick” a set of vectors.Notably, “selector gadgets” from [ABV15] serve the purpose of forcing the WLCS to choose which k factored vectors to compare. And, if we have a gadget for every subset (so every i ∈ [ , g ] ) and put a highvalue set of symbols between them it forces the gadgets to not interact or loose that value. For this we wanta “parallel gadget”. Thus, we get a WLCS that is roughly the concatenation of the WLCS of each of the g gadgets. This gives us the desired result. Gadgets of General Use
First we will describe the selector gadget . Lemma 4.4.
As input we are given k lists L , . . . , L k each of which contain n strings of length at most (cid:96) (e.g.s i , , . . . , s i , n ∈ L i and | s i , j | ≤ (cid:96) ) with an alphabet Σ and weights in the range [ K ] . Let M be the maximumvalue of WLCS ( s , j , . . . , s k , j k ) over all choices of j , . . . , j k ∈ [ , n ] .We can generate a k-WLCS instance P , . . . , P k with k symbols added to Σ , the new range of weightsbeing [ (cid:96) Kn ] and length | P i | = O ( n + n (cid:96) ) , such that WLCS ( P , . . . , P k ) = C sel + M for C sel = ( kn )( (cid:96) Kn ) .Proof. We introduce k symbols @ , @ , . . . , @ k for this selector gadget. We assign a weight of 2 (cid:96) Kn to allthe symbols @ j (note this is larger than the total weight of any given string s i , j ). For convenience by @ ( x ) j we mean x copies of the symbol @ .We first define a helper gadget for separating our strings ST G i ( s ) = @ i @ ( n ) i − . . . @ ( n ) s @ ( n ) . . . @ ( n ) i − @ i . We can now define our output strings: P i = @ ( n ) k . . . @ ( n ) i + ST G i ( s i , ) . . . ST G i ( s i , n ) @ ( n ) i + . . . @ ( n ) k . Note that every
ST G i () gadget is of length O ( n + (cid:96) ) and O ( n ) ST G i () gadgets are used. The additional@ symbols make up at most kn symbols on every string. So the total length of each string P i is at most O ( n + n (cid:96) ) . The largest weight we use is for the @ symbols, they have a weight of 2 (cid:96) Kn . There are k @symbols, so we increase the alphabet by k .Let ? be some string made of symbols from the original alphabet (so no @ symbols). We will use thisto make arguing easier. We claim that the weighted longest common subsequence will look like this:@ ( y k ) k . . . @ ( y ) @ ( y ) ?@ ( n − y ) @ ( n − y ) . . . @ ( n − y k ) k . Let us argue for this claim. First, every symbol @ i appears only 2 n times in string P i so it can not appearmore often. Second, in the string P the only place that symbols @ k , . . . , @ appear is at the start and end ofthe string in the order presented above. For @ k it appears only 2 n times in the string P k . In every other string@ k only appear at the start and end of strings. To match all 2 n copies of the @ k symbol we must align asingle ST G k ( s ) gadget with the other strings P i for i < k . Given that we are matching a single ST G k ( s ) stringnote that the only locations that @ k − , . . . , @ symbols appear are around the string s in decreasing and thenincreasing order. So, if we do try to match all 2 n copies of every symbol @ i we must get k -WLCS that lookslike the above. 32ow we will argue that you can match 2 n copies of every symbol @ i . Consider the string P i , if youpick any single ST G i ( s i , j ) , all the symbols @ i and the “intro” and “outro” strings of @ ( n ) k . . . @ ( n ) i + and@ ( n ) i + . . . @ ( n ) k together make a string of the form:@ ( n ) k . . . @ ( j − ) i . . . @ ( n ) ?@ ( n ) . . . @ ( n − j + ) i . . . @ ( n ) k . If we match k of these we get our claimed string where y i = j − i symbols possible. Note that every @ i symbol is worthmore than all non @ symbols in the entire string. Given this, we must prefer matching all @ symbols to anyother goal.So, given that the k -WLCS will have the described form we can now note the following. The ? thatappears must be the k -WLCS of k strings s i , j . In every P i in order to match all 2 n symbols @ i and onlyhave non-@ symbols in the middle of the string one must select a single ST G () gadget to be included in the k -WLCS.So the k -WLCS will include 2 n copies of @ i symbols and the k -WLCS of the k strings that have thelargest k -WLCS.Now we will describe the parallel gadget . Lemma 4.5.
As input we are given k lists L , . . . , L k each containing g strings of length at most (cid:96) (e.g.s i , , . . . , s i , g ∈ L i and | s i , j | ≤ (cid:96) ) with an alphabet Σ and weights in the range [ K ] . LetM = g ∑ j = W LCS ( s , j , . . . , s k , j ) . We can generate a k-WLCS instance P , . . . , P k with symbol added to the alphabet Σ , the new range ofweights being [ (cid:96) Kg ] and length | P i | = O ( n (cid:96) ) , such that WLCS ( P , . . . , P k ) = C par + M for C par = (cid:96) Kg ( g − ) . The count of ( P , . . . , P k ) will be Π gj = W LCS ( s , j , . . . , s k , j ) . So the multiplication of all the matched k tuple counts.Proof.
We create a new character $ with weight 2 (cid:96) kn which is larger than M . Create each string P i as follows P i = s i , $ s i , $ . . . $ s i , g . Now aligning the g − k tuple ( s , , . . . , s ( k , ) ), then the next k tuple and so on. Given this, the count ofthe number of longest weighted subsequences is simply the multiplication of how many ways to achieve thelongest subsequence for each of our g k -tuples. Building Factored Vector GadgetsLemma 4.6.
Let w , . . . , w k be vectors of length b = o ( lg ( n )) . There are k vector gadgets V G ( · ) , . . . , V G k ( · ) such that WLCS ( V G ( w ) , . . . , V G k ( w k )) is some constant C V G if the k vectors w , . . . , w k are orthogonal andis C V G − otherwise.This uses an alphabet of size k + , weights of size ˜ O ( ) and the length of each w i is ˜ O ( ) . roof. We introduce two symbols 0 and 1 where w ( ) = w ( ) =
1. For each vector w i we construct allpossible kb length zero-one strings of the following form: { , } ( i − ) b w i { , } ( k − i ) b . That is, we generate allpossible bk length zero-one strings where the bits from position b ( i − ) + bi form w i . Call thisset of strings S (cid:48) i ( w i ) . Now we generate the set S i ( w i ) ⊆ S (cid:48) i ( w i ) by including only strings where the vectorsformed by the first b bits, the second b bits, the third b bits, etc form a k tuple of vectors that are k -orthogonal.So S i ( w i ) is a representation of all tuples of k vectors of length b where w i is the i th vector and the k vectorsare k -orthogonal.Now note that the only way that there is one string from each set S ( w ) , . . . , S k ( w k ) such that theweighted longest common subsequence of those strings is kb is that if those strings match perfectly. Theonly way for there to be k perfectly matching strings is if vectors w , . . . , w k are orthogonal (the string wouldotherwise be excluded).So we have generated k lists of at most 2 b ( k − ) strings of length bk . To ensure all the lists are the samelength we will pad all the lists to length 2 b ( k − ) with empty strings. We can now use the selector gadget(Lemma 4.4) to wrap around these lists. This will add k new symbols and make the gadgets have length O ( b ( k − ) + b ( k − ) bk ) with weights in range [ bk b ( k − ) ] . We note that this length is ˜ O ( ) and this weightis also ˜ O ( ) because b is constrained to be b = o ( lg ( n )) . Call this construction V G (cid:48) i ( · ) for the i th vector.So right now if we have an orthogonal vector k tuple we get a weighted longest common subsequence ofweight y = k b ( k − ) ( bk b ( k − ) ) + bk . But, for some inputs the optimal weight could be much lower (like2 k b ( k − ) ( bk b ( k − ) ) ).So, we will add another layer of a selector (from Lemma 4.4) around V G (cid:48) i ( w i ) as follows: Our lists willbe of length two. The i th list will be V G (cid:48) i ( w i ) and 0 y − . So if the vectors aren’t orthogonal the second optionwill lower bound the weight of the longest subsequence. This layer of selector adds another k symbols toour alphabet. It multiplies our weight by ˜ O ( ) . Our weight remains ˜ O ( ) .Now if the vectors are orthogonal we get weight C sel + y and C sel + y − C sel is set byour selector gadget. Lemma 4.7.
Let Z , . . . , Z k each be a subset of { , } b . There are k set vector gadgets SV G ( · ) , . . . , SV G k ( · ) such that WLCS ( SvG ( Z ) , . . . , SV G k ( Z k )) is some constant C SV G if the k sets of vectors have ◦ ( Z , . . . , Z k ) > and is C SV G − otherwise.This uses an alphabet of size k + , weights of size ˜ O ( ) and has a length of ˜ O ( ) .Proof. We first construct vector gadgets
V G i ( w i ) of Lemma 4.6 for all w i ∈ Z i . Let the list L i consist of allthe vector gadgets V G i ( w i ) for all w i ∈ Z i . We use these lists to make the selector gadget of Lemma 4.4.Note that Z i is a set of at most 2 b zero-one vectors of length b . So the expense of the selector gadget ispolynomial in the length, weight, and number of input strings. All these numbers are ˜ O ( ) so the cost ofthis selector gadget is ˜ O ( ) . If there is an orthogonal k tuple within these sets then the optimal weight willbe C sel + C V G , if there are not then the optimal weight will be C sel + C V G − k symbols for a total of 3 k + Lemma 4.8.
Let v , . . . , v k each be a factored vector with g sets containing b-bit vectors. There are k setvector gadgets FV G ( · ) , . . . , FV G k ( · ) such that WLCS ( FV G ( v ) , . . . , FV G k ( v k )) is some constant C FV G ifthe k sets of vectors have (cid:125) ( v , . . . , v k ) > and is C FV G − otherwise.This gadget uses an alphabet of size k + has weights of ˜ O ( ) and has a length of ˜ O ( ) .Proof. Let v be a factored vector with g sets called v [ ] , . . . , v [ g ] .To build FV G i ( v ) we want to concatenate the gadgets SV G i ( v [ ]) , . . . , SV G i ( v [ g ]) . We will use theparallel gadget for this (Lemma 4.5). 34e have that (cid:125) ( v , . . . , v k ) > j ∈ [ , g ] we have ◦ ( v [ j ] , . . . , v k [ j ]) >
0. So, we want toknow if the sum of all the k -WLCS of all k tuples of string SV G ( v [ j ]) , . . . , SV G k ( v k [ j ]) are C SV G . If theyare all C SV G , then (cid:125) ( v , . . . , v k ) > g set vector gadgets each of length ˜ O ( ) and with symbols of weight ˜ O ( ) . The parallel gadgetsweights and length depend polynomialy on g and the weights and length of the input strings. Notably, allthese values are ˜ O ( ) so the length and weight of the FV G i ( · ) will both be ˜ O ( ) .The number of symbols increases by 1 over the symbols in SV G i . So we have 3 k + WLCS and LCS
We now give a reduction from F k -OV to k -WLCS in the worst case. Theorem 4.9.
A T ( n ) time algorithm for k-WLCS with alphabet size O ( k ) and weights in the range [ ˜ O ( )] implies a ˜ O ( T ( n )) algorithm for Fk-OV.Proof. Let the F k -OV instance be given as k lists V , . . . , V k each containing n factored vectors v ∈ V i . Everyfactored vector has g subsets of { , } b . Recall that g = o ( lg ( n ) / lg lg ( n )) and b = o ( lg ( n )) .We will be reducing this to an instance of k -WLCS where we have k strings P , . . . , P k . These stringswill have length ˜ O ( n ) and weights that range from 1 to a number that is ˜ O ( ) .We will produce our k -WLCS instance by wrapping an alignment gadget around our factored vectorgadgets from Lemma 4.8. We are going to use the alignment gadget from [ABV15] (see the proof ofLemma 14 in that paper) as follows.We introduce k + , , , , . . . , k . Let Q = | P k | . For the weights of these symbols, weset w ( i ) = B i and we set B = B k > D where D is the largest possible weight of a factored vector gadget FV G which we defined in Lemma 4.8. The length of a
FV G ( v ) is ˜ O ( ) and the weight of every symbol is˜ O ( ) so D is ˜ O ( ) . We set B = B k = ( kD ) . We set B i = ( k ) k − i B . We set w ( ) = w ( ) = k B . So w ( ) = w ( ) (cid:29) w ( ) (cid:29) w ( ) (cid:29) . . . (cid:29) w ( k ) (cid:29) D . We will use parentheses bellow. They do not represent symbols, they are there to assist in readabilityand to help convey repetitions for example ( $ ) means $ FV G (cid:48) ( s ) = FV G ( s ) FV G (cid:48) i ( s ) = FV G i ( s ) ( . . . i ) Q . Define the factored vector (cid:126) e to be the vector formed by g empty sets (so a vector that gets the worst matchpossible). We define the concatenation operator. Let | v ∈ V i FV G (cid:48) i ( v ) be the concatenation of the FV G (cid:48) ( · ) applied to every factored vector v in the input list V i .Now we will define the strings P i : P i = ( i + . . . k ) Q ( . . . i )( FV G (cid:48) i ( (cid:126) e )) ( i − ) n (cid:0) | v ∈ V i FV G (cid:48) i ( v ) (cid:1) ( FV G (cid:48) i ( (cid:126) e )) ( i − ) n ( i + . . . k ) Q Given the choices of weights for the symbols 8 , , , . . . , k , a weighted longest common subsequencemust contain the maximum possible number of each symbol. Given the construction of the alignmentgadgets, there are weighted longest common subsequences that contain the maximum possible number ofeach symbol individually, simultaneously. For a more formal treatment see Lemma 14 in [ABV15]. Thelength of these strings is ˜ O ( n ) and the weights are of size ˜ O ( ) . Recall the FV G ( · ) constructions have length˜ O ( ) each. 35ur alphabet use for FV G is O ( k ) symbols and we have added k + O ( k ) .Further note that the optimal k -WLCS will align exactly n k -tuples of FV G ( · ) s. This means the lengthof the optimal k -WLCS will be some constant C tot , plus n ( X − ) if there are no k -tuples ( v , . . . , v k ) suchthat (cid:125) ( v , . . . , v k ) >
0. Otherwise the optimal k -WLCS will be at least C tot + n ( X − ) +
1. This allows usto solve the detection problem for F k -OV with one call to k -WLCS on strings of length ˜ O ( n ) and weights inthe range ˜ O ( ) . R EMINDER OF T HEOREM
A T ( n ) time algorithm for k-LCS with alphabet size O ( k ) implies a ˜ O ( T ( n )) algorithm for Fk-OV.Proof. We use Theorem 4.9 and Lemma 4.3. The weights of the instance produced in Theorem 4.9 are ˜ O ( ) and the length of strings is ˜ O ( n ) . So we can reduce F k -OV to k -WLCS and then reduce that instance of k -WLCS to k -LCS. Edit Distance
We will use the following Lemma to obtain hardness for Edit Distance.
Lemma 4.10 (Restated from Theorem C.2 from [Kus19]) . An algorithm for WLCS (k-WLCS where k = )that runs in O ( n − ε ) time for some constant ε > implies a O ( n − δ ) time algorithm for Edit Distance forsome constant δ > . [Kus19] Thus Theorem 4.9 and Lemma 4.10 give us the following theorem. R EMINDER OF T HEOREM
A T ( n ) time algorithm for Edit Distance implies a ˜ O ( T ( n )) algorithmfor F -OV. F k -OVH and LCS and Edit Distance Theorem 1.16 and Theorem 1.17 give us the following corollary.
Corollary 4.11.
If Fk-OVH is true then k-LCS requires n k − o ( ) time. If F -OVH is true then Edit Distancerequires n − o ( ) time. Here we demonstrate the power of the framework in Section B to show average case hardness for count-ing subgraphs H with k vertices, where k = o ( (cid:112) lg ( n ) / lg lg ( n )) . If the sub-graph H is sufficiently sparsethen some larger k can be tolerated. Notably, for this section, as long as the number of edges is e = o ( lg ( n ) / lg lg ( n )) then our worst case to average case reduction has sub-polynomial overhead.Using the framework we can immediately show that counting subgraphs H in what are roughly H -partiteErd˝os-R´enyi graphs (see Definition 1) is hard. We use our Inclusion/Edgesculsion Lemma from Section 5.2to extend this result to counting subgraphs H in Erd˝os-R´enyi graphs, and show that this problem is averagecase hard as well. We start by a few definitions. Definition 1.
The counting H sub-graphs in a H -partite fashion (CHGHP) problem takes as input a k -node graph H and a H -partite n -node graph G with vertex set partition V , . . . , V k , and asks for the countof the number of sub-graphs of G that have exactly one node from each of the k partitions and contain thegraph H . 36 efinition 2. The uniform counting H sub-graphs in a H -partite fashion (UCHGHP) problem takesas input a k -node graph H and an H -partite n -node graph G with vertex set partition V , . . . , V k , where everyedge between partitions that have edges in H is chosen to exist iid with probability µ . The problem asksfor the count of the number of sub-graphs of G that have exactly one node from each of the k partitions andcontain the graph H .Note that CHGHP is a worst-case problem whereas UCHGHP is an average-case problem. Notably,UCHGHP is the uniform distribution over inputs to CHGHP. H subgraphs in H -partite fashion to uniform counting We start by reducing CHGHP to UCHGHP. Our ultimate goal is to reduce CHGHP to counting H subgraphsin an Erd˝os-R´enyi graph. Lemma 5.1.
Let H be a k-node graph with vertices V H = { x , . . . , x k } and G a H-partite n-node graphwith vertex set partition V , . . . , V k . Let (cid:126) E be the set of variables { e ( v i , v j ) | i (cid:54) = j , v i ∈ V i , v j ∈ V j } when anedge variable is a if that edge exists and if the edge is absent in G. Let h ( v , . . . , v k ) be a function thatmultiples e ( v i , v j ) if x i x j is an edge in H for all i , j ∈ [ , k ] where i (cid:54) = j. If p is a prime in [ n k , n k ] , thefollowing function returns the output of CHGHP on G:f ( (cid:126) E ) = ∑ v ∈ V ,..., v k ∈ V k h ( v , . . . , v k ) ( mod p ) . Proof.
Consider the function h : If v , . . . , v k in that particular order contain the graph H it returns 1, other-wise it returns 0. Specifically, we are checking if our particular permutation of these variables completelycovers the (arbitrary) permutation of variables associated with the input sub-graph H .Now f sums over all choices of k nodes from each partition and counts how many instances of the subgraph appear in each. There is no double counting because every set of k nodes differs by at least onenode. Lemma 5.2.
The function f defined in Lemma 5.1 is a good low-degree polynomial for CHGHP if thenumber of edges in H is o ( lg ( n ) / lg lg ( n )) .Proof. To prove the lemma, first note that f is a polynomial over a prime finite field F p for some prime p ∈ [ n k , n k ] , and the number of monomials in f is O ( n k · k ! ) , which is polynomial. By Lemma 5.1 thefunction f returns the same value as CHGHP when it is given zero-one inputs.Let | E H | be the number of edges in H . The function f has degree | E H | = o ( lg ( n ) / lg lg ( n )) . In fact givenconstant k , f has constant degree. This is because f is formed with a sum over monomials h ( v , . . . , v k ) ,which have degree | E H | ≤ (cid:0) k (cid:1) .Finally, the function f is strongly | E H | -partite. There are | E H | partitions of edges. The function f is asum over calls to h where h takes as input one variable from each of those edge partitions and multiplies allof them. Corollary 5.3.
Let d = (cid:0) k (cid:1) and k = o ( (cid:112) lg ( n ) / lg lg ( n )) . If an algorithm exists to solve UCHGHP in timeT ( n ) with probability − / ω (cid:0) lg d ( n ) lg lg d ( n ) (cid:1) , then an algorithm exists to solve CHGHP in time ˜ O ( T ( n ) + n ) with probability at least − O (cid:16) − lg ( n ) (cid:17) . roof. If k = o ( (cid:112) lg ( n ) / lg lg ( n )) then the size of the edge set in H , E H is at most (cid:0) k (cid:1) = d = o ( lg ( n ) / lg lg ( n )) .Using Theorem 1.20 we simply need that a good low-degree polynomial for CHGHP exists. By Lemma 5.2,the function f from Lemma 5.1 is a GLDP(CHGHP). Corollary 5.4.
Let H be a sub-graph with an edge set E H where | E H | = o ( lg ( n ) / lg lg ( n )) . Let d = | E H | .If an algorithm exists to solve UCHGHP in time T ( n ) with probability − / ω (cid:0) lg d ( n ) lg lg d ( n ) (cid:1) , then analgorithm exists to solve CHGHP in time ˜ O ( T ( n ) + n ) with probability at least − O (cid:16) − lg ( n ) (cid:17) .Proof. We have that E H is at most (cid:0) k (cid:1) = d = o ( lg ( n ) / lg lg ( n )) . Using Theorem 1.20 we simply need thata good low-degree polynomial for CHGHP exists. By Lemma 5.2, the function f from Lemma 5.1 is aGLDP(CHGHP). In Corollary 5.4 we show that counting subgraphs H in Erd˝os-R´enyi H -partite graphs quickly with a highenough probability implies fast algorithms for counting H -subgraphs in the worst case. We now want toextend this to fully Erd˝os-R´enyi graphs. Specifically, we want to show that counting H -subgraphs in Erd˝os-R´enyi quickly with a high enough probability implies a fast algorithm for counting H -subgraphs in theworst case. To acheive this goal we introduce our Inclusion-Edgesclusion technique. We begin with a fewdefinitions. Definition 3.
Let G be a k -partite Erd˝os-R´enyi graph with every edge included with probability 1 / b where b is a constant integer. Let the vertex partitions of G be V , . . . , V k and the edge partitions be E i , j ∀ i , j ∈ [ , k ] where i < j .Label all | V i | · | V j | edges with numbers in [ , b ] as follows. Edges that exist in G are labeled 1. The restof the edges are uniformly at random assigned labels from [ , b ] . For (cid:96) ∈ [ , b ] , let E (cid:96) i , j be the set of all edgesof label (cid:96) .Let G ( (cid:96) )( (cid:96) ) ... ( (cid:96) ( k )) be the graph formed by choosing edge sets E (cid:96) , , E (cid:96) , , . . . , E (cid:96) ( k ) k − , k . Let S G be the set ofall possible b ( k ) graphs G ( (cid:96) )( (cid:96) ) ... ( (cid:96) ( k )) . Note when b = E ( ) i , j = E i , j and E ( ) i , j = ¯ E i , j . Definition 4.
Let G be a k -partite Erd˝os-R´enyi graph with every edge included with probability 1 / b where b is a constant integer. Let the vertex partitions be V , . . . , V k . Let the edge partitions be E i , j ∀ i , j ∈ [ , k ] where i < j .Let a labeled subgraph L of H in G be a subgraph of H where every vertex is assigned a unique labelfrom [ , k ] .Define the count of the number of labeled subgraphs L in G to be the number of not-necessarily inducedsubgraphs L where every vertex in L with label (cid:96) comes from V (cid:96) in the original graph.We want to reduce UCHGHP to counting subgraphs H in Erd˝os-R´enyi graphs. A uniformly random H -partite graph only has edges between partitions corresponding to edges in H . However, an Erd˝os-R´enyigraph would have edges within partitions and between partitions that don’t correspond to edges in H . So, ifwe add these random edges we will over count subgraphs H , including subgraphs H that appear outside ofthe original H -partite graph.We solve this problem by creating multiple graphs. Each graph individually looks like it is sampledfrom the Erd˝os-R´enyi distribution. However, these graphs are correlated. We use a variant of an inclusion-exclusion argument (hence the name “inclusion-edgesclusion”) to count the subgraphs H that appear in theoriginal H -partite graph. 38e will start with a warm up lemma. Lemma 5.5 (Warm Up Lemma) . Let C G be the count of the number of k-node subgraphs H in a completek-partite graph with the same edge partitioning as G where exactly one node of the subgraph is in eachpartition in G.Let C S G be the sum of the subgraphs H in all graphs G ( (cid:96) )( (cid:96) ) ... ( (cid:96) ( k )) in S G where each of the partitions ofG ( (cid:96) )( (cid:96) ) ... ( (cid:96) ( k )) has exactly one vertex of the subgraph.Then, C G = C S G .Proof. If a subgraph H exists and has one vertex in each partition, then there is exactly one choice of G ( (cid:96) )( (cid:96) ) ... ( (cid:96) ( k )) ∈ S G that will contain it. The choice of G ( (cid:96) )( (cid:96) ) ... ( (cid:96) ( k )) that picks the edge sets that H ’s edgeslay in. Every H that exists in the complete graph will appear in exactly one of these G ( (cid:96) )( (cid:96) ) ... ( (cid:96) ( k )) , so thecounts of both are the same.What should you get out of this lemma intuitively? Consider what happens if we sum all H that involveexactly one edge from E i , j , E i , j , . . . or , E bi , j (as defined in Definition 3). Then, we are getting the sum of all H that would exist if E i , j were complete. We can use this idea to count the subgraphs that use particular edgepartitions, while every E ( (cid:96) ) i , j looks uniformly random. To do this count, we develop a few lemmas and thenwe proceed to our main counting result in Lemma 5.9. Counting Small Subgraphs
We will argue that we can count labeled subgraphs H recursively. We startby arguing the base cases. Below are give fast algorithms for counting small labled subgraphs. By countinglabeled subgraphs H in a graph G with partitions V , . . . , V k , we mean that the vertex set of H is labeled with1 , . . . , k , and we want every copy of H to have a copy of x i in V i where x i is the vertex with label i in H . Lemma 5.6.
Let G be a graph with n nodes, m edges and k labeled partitions of the vertices V , . . . , V k (Gis not necessarily k partite).Given a labeled k-node tree H with vertices, counting the number of such labeled trees in G takesO ( m + n ) time.Proof. Pick a root of the tree H . Let ( u , p ) be the root and its label p . Let U i be the set of all tuples ofvertices and their labels in the tree at level i . Let h be the height of the tree.Thus, the set U h only contains leaves, and every node in U h has one sub-tree that includes it and no nodesbelow it.For all ( u h − , p h − ) ∈ U h − , where p h − is the label of u h − , we look at the vertex set V p h − . For all nodesin V p h − we are going to count the number of labeled sub-trees that include it and the nodes below it. We cando this in linear time over the edges between the relevant partitions. Save all the computed values.Now, we can do this for level h −
2, using our pre-existing counts. We can propagate these up the treeuntil we reach our root and count the total number of labeled trees H in the graph. Lemma 5.7.
Let G be a graph with n nodes, m edges and k labeled partitions of the vertices V , . . . , V k (Gis not necessarily k partite).If we have the counts of all labeled subgraphs of H in G of size less than s vertices, we can compute thenumber of labeled subgraphs in G that are the union of two disconnected labeled subgraphs of H of size sor less. roof. Let one be labeled subgraph L and the other be labeled subgraph L (cid:48) . Given that they share no vertices,we can simply multiply the number of subgraphs L and L (cid:48) . Lemma 5.8.
Let G be a graph with n nodes, m edges and k labeled partitions of the vertices V , . . . , V k (Gis not necessarily k partite).We can compute all counts of subgraphs in G with vertices or fewer in ˜ O ( m + n ) time.Proof. All subgraphs with 1 edge are trees. So by Lemma 5.6 we can compute all subgraphs with 2 edgesor fewer in ˜ O ( m ) time. The Recursive Step of Inclusion-Edgesclusion
This next lemma is the core step. We will use all countsof subgraphs with a small number of edges to count those with more edges. At its core this relies on thefact that if we sum together the counts of the number of subgraphs H with all possible combinations ofcomplimentary edge sets this roughly gives us a count of the number of subgraphs when that edge partitionis a complete bipartite edge set. Lemma 5.9.
Let G be a labeled k-partite graph with n nodes per partition.Say we are given the counts of the number of subgraphs H in all graphs S G (see Definition 3).Additionally, say we are given the counts of all less than or equal to v vertex labeled subgraphs of Hwith [ , e ] edges.Let L be a labeled subgraph of H with v vertices and e + edges.Using both of these counts we can count the number of not-necessarily induced subgraphs L in G in timeO ( k ! · k + b k ) .Proof. Let H have v H = k vertices and e H edges. Let the subgraph L be given as a list of v vertices labeledas being in partitions i , . . . , i v and e + i x and i y where x , y ∈ [ , v ] . Let S E be theset of all such pairs ( x , y ) .Consider ¯ S E , the set of all pairs of partitions not in S E . Then consider the subset of instances in S G wherethe edges between partitions in S E (for example E i , i ) are all set to be the version labeled ( ) ( E ( ) i , i ). Callthis subset S G [ L ] .Take the counts of the number of subgraphs H that appear in all graphs in S G [ L ] and sum them together,call this count c S G [ L ] . What will this count contain? It will count the number of subgraphs H that appear ifthe graph G were to have complete bipartite graphs between all pairs of partitions in ¯ S E , weighted by howmany edges in S E that subgraph uses. If a specific subgraph H appears in the graph G where (cid:96) of its edgesare in the ¯ S E partitions then it is counted b ( k ) − e − − (cid:96) times. We include that many copies of graphs in S G [ L ] that include this particular H .Given that L is a labeled subgraph of H , at least one labeling of H will share all e + v verticesof L . There may be many valid labelings for the e H − e − k − v unaccountedfor vertices.We want to count all H that happen to have a labeling that matches the e + L , and not countthose that share only some of these edges. Luckily, given the counts of all small subgraphs we can counthow many subgraphs H exist that match up only partially with L and remove these from the count c S G [ L ] .For a subgraph to match up only partially with L , it must match up with some labeled subgraph of L , L (cid:48) . L (cid:48) must have v vertices and at most e edges. We have the counts of all labeled subgraphs with v vertices andat most e edges. We want to remove from c S G [ L ] the count of all subgraphs H that overlap with L (cid:48) and shareno edges with L − L (cid:48) . 40et G L , L (cid:48) be a graph on k vertices where all edges in L (cid:48) are included, all edges in L − L (cid:48) are excluded andall other edges are included. Let c G L , L (cid:48) be the count of the number of subgraphs H that exist in this graph.Note we can compute this in O ( k ! ) and we do this computation on at most O ( k ) graphs.Let L (cid:48) have e L (cid:48) edges and v L (cid:48) vertices. Let c L (cid:48) be the count of all labeled subgraphs L (cid:48) that exist in G .The count of all subgraphs H which overlap exactly with L (cid:48) (sharing no edges with L − L (cid:48) ) that are countedin c S G [ L ] is c L (cid:48) · c G L , L (cid:48) · n k − v L (cid:48) · b ( k ) − e − e H + e L (cid:48) . Lets break down this value. First, of course the number of labeled subgraphs L (cid:48) that appear in the originalgraph each contribute proportionally. A choice of a particular labeled subgraph L (cid:48) fixes v L (cid:48) of the k vertices,but the rest of the vertices could be any of the available n vertices per partition. Now, given a fixed choiceof k vertices and e H edges this subgraph may still appear in multiple graphs in S G [ L ] . Specifically, it willappear in all graphs where we haven’t “fixed” the edge set. This is a total of b ( k ) − e − e H + e L (cid:48) graphs.So, for all O ( k ) labeled subgraphs of L we can compute their contribution to c S G [ L ] and subtract out thiscontribution. This leaves only a count of subgraphs H that overlap with L exactly. To compute the numberof subgraphs L we simply divide this number by c G L , L · n k − v · b ( k ) − e H .The total time for this computation is, at most O ( k · k ! + b k ) . If k = o ( (cid:112) lg ( n )) and b is a constant,then this term is sub-polynomial. Lemma 5.10.
Let G be a graph with n nodes, m edges and k labeled partitions of vertices V , . . . , V k . Giventhe count of all labeled subgraphs of H in G with less than v vertices, we can count all labeled sub-graphswith v vertices and at most v − edges in ˜ O ( m ) time.Proof. There are two cases. The subgraph is connected (only possible when we have exactly v − O ( m ) time.If the subgraph is disconnected then it is made up of disconnected labeled subgraphs with less than v vertices. We have the count of each of these on their own, thus by repeated applications of Lemma 5.7 wecan count these with overhead the number of subgraphs which is at most v , and thus also ˜ O ( m ) . Reducing to UCHGHP
First we reduce counting labeled copies of H in a k -partite Erd˝os-R´enyi graph tocounting H in Erd˝os-R´enyi graphs. We then note that by picking a particular labeling this solves the problemof UCHGHP. Finally, we use our previous reduction from CHGHP to UCHGHP to get our desired result: areduction from CHGHP to counting H subgraphs in Erd˝os-R´enyi graphs. Lemma 5.11.
Let H have e edges and k vertices. Let A be an average-case algorithm for counting“ unlabeled ” subgraphs H in k-partite Erd˝os-R´enyi graphs with edge probability / b which takes T ( n ) time with probability − ε / (cid:16) k · b k (cid:17) .The number of “labeled” copies of subgraph H in k-partite Erd˝os-R´enyi graphs with edge probability / b can be computed in time ˜ O ( k · m + k · b k · T ( n )) with probability at least − ε .Proof. We want to count only subgraphs that use exactly one vertex from each partition. We can make 2 k calls to A using standard inclusion/exclusion to count only subgraphs with exactly one edge in each partition.Call this algorithm A (cid:48) . 41et C ( v , (cid:96) ) be a list of tuples of all labeled subgraphs J with v vertices and (cid:96) edges with the associatedcount of the number of labeled subgraphs J in G .By Lemma 5.10 we can compute C ( v , (cid:96) ) in time | C ( v , (cid:96) ) | · ˜ O ( m ) if (cid:96) ≤ v − C ( v , (cid:96) ) for all (cid:96) ≤ (cid:96) (cid:63) then we can compute C ( v , (cid:96) (cid:63) + ) given calls to A (cid:48) on all graphs in S G . Note each of these steps uses the same set of calls to A (cid:48) on all graphs in S G .We can bound | S G | ≤ b k . With this we can say that we make at most b k calls to A (cid:48) , meaning we makeat most 2 k · b k calls to A .We can bound the total sum of all | C ( v , (cid:96) ) | by 2 k (every possible choice of a subset of edges in the completegraph on k vertices). This gives a time bound of ˜ O ( k · m + k · b k · T ( n )) .We make 2 k · b k calls to A , if they are all correct then we give the correct answer to the labeled H question. If A succeeds with probability at least 1 − ε / (cid:16) k · b k (cid:17) , then, by the union bound 2 k · b k calls to A will all succeed with probability at least 1 − ε . Lemma 5.12.
Let H have e edges and k vertices where k = o ( lg ( n ) / lg lg ( n )) . Let A be an average-casealgorithm for counting subgraphs H in Erd˝os-R´enyi graphs with edge probability / b which takes T ( n ) timewith probability − − k · b − k · ( lg ( e ) lg lg ( e )) − ω ( ) Then an algorithm exists to count subgraphs H in H-partite graphs (CHGHP) in time ˜ O ( T ( n )) withprobability at least − O ( − lg ( n ) ) .Proof. By Lemma 5.11, A implies a ˜ O ( T ( n )) algorithm for counting the number of labeled copies of sub-graph H in k -partite Erd˝os-R´enyi graphs with edge probability 1 / b with probability 1 − − k ( lg ( e ) lg lg ( e )) − ω ( ) .We need to add random edges within each partition to get a truly Erd˝os-R´enyi graph. Luckily, we canuse traditional inclusion-exclusion to count how many subgraphs don’t include exactly one vertex in eachpartition. This introduces another 2 k calls. By the union bound this causes the probability of success to beat least 1 − ( lg ( e ) lg lg ( e )) − ω ( ) .Now note that counting labeled copies of subgraph H in k -partite Erd˝os-R´enyi graphs solves UCHGHP withedge probability 1 / b with a single call. Given an instance of UCHGHP label the vertices of the subgraph H in the input instance, between all other partitions add random edges with probability 1 / b .Now apply Lemma 5.4. An algorithm for UCHGHP that succeeds with probability 1 − ( lg ( e ) lg lg ( e )) − ω ( ) in time T ( n ) implies an algorithm for CHGHP that runs in time ˜ O ( T ( n ) + n ) and succeeds with probability1 − O ( − lg ( n ) ) . R EMINDER OF T HEOREM
Let H have e edges and k vertices where k = o ( (cid:112) lg ( n )) . Let A be anaverage-case algorithm for counting subgraphs H in Erd˝os-R´enyi graphs with edge probability / b whichtakes T ( n ) time with probability − − k · b − k · ( lg ( e ) lg lg ( e )) − ω ( ) .Then an algorithm exists to count subgraphs H in k-partite graphs in time ˜ O ( T ( n )) with probability atleast − ˜ O ( − lg ( n ) ) .Proof. From Lemma 5.12 we know that A implies a ˜ O ( T ( n )) time algorithm for counting H in H -partitegraphs.Now, given an input of a graph G that is k -partite graph we can produce all e choose (cid:0) k (cid:1) graphs thathave only e sets of edges between the partitions. From these we can select only those that are H partite (thenumber of these will vary based on H ’s shape). The number of these graphs is at most 2 k , which by ourrestriction on k is ˜ O ( ) . Call the set of these H partite graphs S H .42e use the result from Lemma 5.12 to count the results on each of these graphs. By the union bound wewill get the correct answer on every graph with probability at least 1 − ˜ O ( − lg ( n ) ) . The sum these countsover all G (cid:48) ∈ S H is equal to the number of H in the original graph. Previous work has shown that detecting if there is at least one orthogonal vector in a set of n vectors ispossible in sub-quadratic time [KW19]. So, the next natural candidate problem that we might hope to showhard with our framework would be the counting version of average-case Orthogonal Vectors problem (OV).However, even the counting version of orthogonal vectors has truly subquadratic algorithm, as we will provebelow. Definition 1.
The counting µ -uniform d-dimensional Orthogonal Vectors problem ( µ , d ) takes as inputtwo lists of n zero-one vectors, where each vector is d -dimensional. All 2 · n · d bits are chosen iid wherea one is selected with probability µ . The output is the count of the number of vectors that are orthogonal(whose dot product is zero).We will consider constant µ for this section. We built up a few lemmas to prove the following theorem. R EMINDER OF T HEOREM
For all constant values of µ and all values of d there exists constants ε > and δ > such that there is an algorithm for OV µ , d that runs in time ˜ O ( n − δ ) with probability atleast − n − ε . We start by showing that if vectors are very long we are unlikely to have an orthogonal vector pair.
Lemma 6.1. A OV µ , d instance has at most a n · e − µ · d probability of having at least one pair of orthogonalvectors.Proof. Any given pair of vectors has a probability of ( − µ ) d of being an orthogonal pair. The probabilitythat some vector is an orthogonal pair is at most n · ( − µ ) d which is at most n · e − µ · d . Lemma 6.2.
If d > ( + δ ) ( e ) lg ( n ) for some constant δ > then there is a constant µ = ( + δ ) − / such that OV µ , d instance has at least a − / n ε probability of having no orthogonal vectors for someconstant ε .Proof. Using Lemma 6.1 and plugging in our value of d we have that the probability of an µ , d instancehaving an orthogonal vector is at most n · ( n ) − ( + δ ) µ . If µ = ( + δ ) − / then we can bound the probabilityby n ( − ( + δ ) / ) . For δ > ( + δ ) / >
1, and so 1 − ( + δ ) / is a negative constant. Thusthere is some positive constant ε (for example ε = − ( − ( + δ ) / ) ) such that the probability there are noorthogonal vectors in a µ , d instance is at least 1 − / n ε .A straightforward Corollary of Lemma 6.2 is the following. Corollary 6.3.
For all constant µ there is a constant δ = / µ − such that for d > ( + δ ) ( e ) lg ( n ) a OV µ , d instance has at least a − / n ε probability of having no orthogonal vectors for some constant ε . We use the following theorem appearing in [CW16] in the proof of Theorem 1.18.
Theorem 6.4.
Given a vector of dimension d = c lg ( n ) there is a ˜ O ( n − / O ( lg ( c )) ) time algorithm that suc-ceeds with probability on instances of OV µ , d in returning the count of the number of orthogonal vectorpairs for every vector if one exists, regardless of µ . [CW16] Proof of Theorem 1.18.
Let the dimension be d = c lg ( n ) . By Corollary 6.3 if c > ( e ) / µ then thereis some ε > − n − ε . Notably, this givesus an ˜ O ( d ) time algorithm where we return a count of zero if the dimension is larger than 2 lg ( e ) lg ( n ) / µ that succeeds with probability at least 1 − n − ε .When c ≤ ( e ) / µ we will run the algorithm from Theorem 6.4. This runs in ˜ O ( n − / lg ( c ) ) time and iscorrect with probability 1. This is at its worst a run time of ˜ O ( n − / lg ( ( e ) µ − ) ) . So δ = µ / lg ( ( e ) µ − ) , µ is a constant so δ is also a constant. (cid:50) k C In fine-grained complexity the primary technique used for worst-case to average-case reductions has usedthe technique described by [BRSV17]. This technique produces average-case hardness for computing theoutput of functions over a finite field. These problems are fundamentally counting problems. The issue withcounting problems is that they are much harder to build cryptographic objects out of.Here we give a reduction from Counting to Detection for Z k C in the average case (ACZ k C). Notably,such a reduction does not exist in the worst case in fine-grained complexity. This makes the assumptionthat average case Z k C detection with high probability requires n k − o ( ) time more plausible. The assumptionthat Z k C detection is hard with probability 1 /
100 can be used to make fine-grained public-key cryptogra-phy [LLV19] (though the assumption that average-case Z k C is hard with probability 1 − n − o ( ) should besufficient). There is a gap here between the probabilities we are describing, 1 − / Ω ( n k ) , and the probabili-ties used for fine-grained cryptography, 1 − / n o ( ) . However, this makes a step forward in closing the gapbetween the problems we can show are average-hard from worst-case assumptions and those we can buildcryptography from.Let us define average-case Z k C. Definition 1.
An average case instance of Z k C (ACZ k C) with range R takes as input a complete k -partitegraph with n nodes in each partition. Every edge has a weight chosen iid from [ , R − ] . A clique isconsidered a zero k clique if the sum of the edges is zero mod R .The idea of our reduction from counting to detection uses the fact that average-case Z k C is easy when R is small and there are very few solutions when R is large. In the worst-case we can reduce detectingACZ k C to counting n k − ε ACZ k Cs when ε >
0. So, intuitively we are using the fact that when R is small wecan use a fast algorithm for counting. When R is larger there are n k − ε solutions, so we can use a reductionto show that faster detection solves counting those small number of solutions.First we will prove that when the range is small there is a fast algorithm. Then, we will show that asearch algorithm counts very well when the range is exactly R = n k . We will then show that this gives ageneric counting to search reduction. Next, we will provide a search to decision reduction. Finally, we willgive the counting to detection statement.Note that throughout this section we assume the function p ( n ) is a monotonically non-increasing func-tion . Additionally, when we say an algorithm succeeds in the average case with probability p , this is ran-domness over both the input and the random coins flipped in the algorithm. Small Range is EasyLemma 7.1.
There is a ˜ O ( R n ω (cid:100) k / (cid:101) ) time algorithm for ACZkC. roof. Take the graph as a k -partite graph. Group together k / k is not a multipleof 3 then make groups of (cid:100) k / (cid:101) partitions and (cid:98) k / (cid:99) partitions. Then, in each group of partitions create anode for every possible set of (cid:100) k / (cid:101) or (cid:98) k / (cid:99) nodes one from each partition. The total number of nodes is O ( n (cid:100) k / (cid:101) ) .Consider two nodes v and u where v represents x nodes and u represents y nodes. Add an edge between u and v only if all x + y represented nodes form a clique. The weight on the edge between u and v is the sumof half the weight of all edges within the clique of x nodes represented by v , half of the weight of all theedges within the clique of y nodes represented by u , and the weight of all edges going between the x nodesin v and the y nodes in u .Now, the weights of the edges are still in the range [ , R ] . We want to find a zero triangle in this newgraph. We can guess the edge weights of two of the edges in the triangle, which forces the third value. Then,we produce a graph with only the edges of the guessed weights, then use matrix multiplication. All told thistakes O ( R · ( n (cid:100) k / (cid:101) ) ω ) time. This can be simplified to ˜ O ( R n ω (cid:100) k / (cid:101) ) time.We can have a slight improvement in the running time of Lemma 7.2. Lemma 7.2.
There is a ˜ O ( R n ( ω ( k − ) / )+ ) time algorithm for ACZkC.Proof. Let g be the largest integer such that 3 g ≤ k . Note that 3 g ≥ k − g = k then by Lemma 7.1 an algorithm exists which runs in time ˜ O ( R n ω (cid:100) k / (cid:101) ) time, which is˜ O ( R n ( ω ( k − ) / )+ ) .If 3 g = k − k − O ( R n ω (cid:100) ( k − ) / + (cid:101) ) time algorithm, which is ˜ O ( R n ( ω ( k − ) / )+ ) .If 3 g = k − k − O ( R n ( ω ( k − ) / )+ ) time algorithm.Lemma 7.2 gives the following corollary. Corollary 7.3.
If R = O ( n ( k − − ω ( k − ) / − ε ) / ) then there is a ˜ O ( n k − ε ) time algorithm for ACZkC with rangeR. High Probability Counting for R = n k When the range is n k we want to count efficiently with very highprobability. We will do this by first proving two helper lemmas. Lemma 7.4.
The probability that an instance of ACZkC with range R = n k has at least k k lg k ( n ) solutionsis − Ω ( lg ( n )) .Proof. If there are at least (cid:0) k lg ( n ) (cid:1) k zero cliques then there is at least one set of lg ( n ) cliques such thateach zero clique has at least one node not shared by any other zero clique. After all at least k lg ( n ) distinctnodes must be involved in these (cid:0) k lg ( n ) (cid:1) k zero cliques.If a zero clique has a node not shared with the other cliques then whether or not it is a zero clique isuncorrelated with the other zero cliques. So, the probability that there are (cid:0) k lg ( n ) (cid:1) k zero cliques is at mostthe probability that out of n k independent trials lg ( n ) return true when the probability of a trial returningtrue is 1 / R = / n k . By the Chernoff bound we get the probability of this event is less than 2 − lg ( n ) / whichis 2 − Ω ( lg ( n )) . 45 emma 7.5. Using a search algorithm, A , that succeeds with probability − p on an instances of ACZkC withn / ( k lg ( n )) nodes per partition and edge weights in the range R = θ ( n k ) in time T ( n ) we can count thenumber of solutions (or list all those solutions) in a ACZkC instance in time ˜ O ( T ( n ) + n k − ) with probabilityat least − pk k lg k + ( n ) − − Ω ( lg ( n )) .Proof. Let the input ACZ k C instance be the graph G with edge set E and vertex set V . First, note that withprobability 1 − / Ω ( lg ( n )) there are at most s = k k lg k ( n ) zero k -cliques (ZKCs).Now consider a given ZKC c in G . Imagine creating a new instance G (cid:48) that is a subset of G by selectinga random subset of n / x nodes from each partition. The ZKC c is in G (cid:48) with probability x − k . Now considera clique c (cid:48) which is in G and shares no nodes with c . Given that c is in G (cid:48) the probability that c (cid:48) is also in G (cid:48) is at most x − k . If there are at most (cid:96) cliques in G then the probability that a given clique c is in G (cid:48) andno disjoint cliques (cliques that share no vertices with c ) are in G (cid:48) is at least: x − k ( − x − k ) (cid:96) . Further notethat the sub-graph G (cid:48) has total variation distance 0 from ACZ k C instances with n / x nodes per partition andrange n k .Consider the algorithm B x . It creates an empty set S B that it will fill with cliques it finds. It generates G (cid:48) at random by selecting a random set of n / x nodes from each partition. Then it runs A on G (cid:48) . If A returnsa clique c , check that it is a ZKC. If it is, further exhaustively check that there is no clique that shares anode with c this takes O ( k ( n / x ) k − ) time (you can simply check all sets of k nodes involving one node inthe clique). Any cliques it finds in this search are added to S B and S B is returned. B x takes O ( T ( n ) + n k − ) time. If:1. a ZKC c is in G (cid:48) ,2. A returns correctly, and3. there are no ZKCs in G (cid:48) which share no vertices with c then B x will include c in S B . Because A returned a ZKC and it was either c or a clique that shared a nodewith c . In the later case our exhaustive search would find it. Given a specific clique c and A returningcorrectly c ∈ S B with probability x − k ( − x − k ) (cid:96) .Consider the case where (cid:96) ≤ s and x = k lg ( n ) = s / k . Then B k lg ( n ) returns a given c with probabilityat least s − ( − s − ) s ≥ s . If A is returning correctly every trial is independent. Thus if we run B k lg ( n ) s lg ( n ) times we will find the clique c with probability at least 1 − ( − / ( s )) s lg ( n ) ≥ − − Ω ( lg ( n )) .The probability we find all the ZKCs (given that there are at most s ZKCs) is, by union bound at least1 − s − Ω ( lg ( n )) = − − Ω ( lg ( n )) .After making 4 s lg ( n ) calls to B k lg ( n ) we will have made 4 s lg ( n ) calls to A . Using union bound allof these will succeed with probability at least 1 − s lg ( n ) p .So the time we take is O ( s lg ( n ) T ( n ) + s lg ( n ) n k − ) which is ˜ O ( T ( n ) + n k − ) . Our success proba-bility requires the union of the number of cliques being less than s , A returning correctly on all calls, andthe randomness in B k lg ( n ) allowing us to return all cliques. Thus our probability of success is at least 1 − s lg ( n ) p − − Ω ( lg ( n )) − − Ω ( lg ( n )) . This can be simplified to a success probability of 1 − k k lg k + ( n ) p − − Ω ( lg ( n )) . Counting to Search
We will start by describing the self reduction for ACZ k C. This is a folklore self-reduction in the worst case and was analyzed in the average case in [LLV19].46 emma 7.6.
Given an instance, I, of average case ZkC with range R with kn nodes it can be split into ( n / x ) k instances I , . . . , I ( n / x ) k each with kx nodes such that:1. The distribution over each I i is the average case distribution with kx nodes and range R. (Though twoinstances I i and I i (cid:48) may be correlated.)2. The number of solutions in instance I ( Solutions ( I ) ) is equal to the sum of solutions in all the in-stances I , . . . , I ( n / x ) k ( ∑ ( n / x ) k i = Solutions ( I i ) ).Proof. Note the k -partite graph in the instance I and note each partition of vertices V , . . . , V k . We create arandom partition of each vertex set into n / x sets of x vertices. Name the subsets of V i , V i [ j ] where j ∈ [ , n / x ] .The ( n / x ) k subinstances are formed by taking the intersection of k subsets one from each of the k partitions: V [ j ] ∪ . . . ∪ V k [ j k ] for all possible k tuples ( j , . . . , j k ) ∈ [ n / x ] k .For the first claim, note that for any given instance I i we simply have a random selection of n / x nodesfrom an average case instance. So every edge is chosen iid from [ R ] . This is indeed the distribution of anaverage case Z k C instance. We will note that two separate instances may be correlated. For example theinstance formed by V [ j ] ∪ V [ j ] ∪ V [ j ] . . . ∪ V k [ j k ] and the instance formed by V [ j ] ∪ V [ j ] ∪ V [ j (cid:48) ] . . . ∪ V k [ j (cid:48) k ] will share all edges between sections V [ j ] and V [ j ] . Of course union bounds can still be used tobound error between these ( n / x ) k instances.For the second claim, any ACZ k C witness has k nodes one from each partition: v ∈ V , . . . , v k ∈ V k .Every witness appears in exactly one sub-instance. A given witness ( v , . . . , v k ) will appear only in theinstance formed by a union of the subsets V [ j ] ∪ . . . ∪ V k [ j k ] where v i ∈ V i [ j i ] in every subset. Lemma 7.7.
Let p ( n ) be a monotonically non-increasing function.Assume an algorithm exists for the search version of ACZkC with range R ∈ [ k k lg k ( n ) n k , k k lg k ( n ) n k ] that succeeds with probability at least − p ( n ) and runs in time O ( n k − ε ) where ε > . Let k (cid:48) = + ω ( k − ) / . Then there is an algorithm for counting the number of ZkC in an average case instance for anypositive integer R with probability at least − − Ω ( lg ( n )) − p (cid:16) n ( k − k (cid:48) − δ ) / ( k ) / ( k lg ( n )) (cid:17) · n ( k (cid:48) + δ ) / · k k lg k ( n ) that runs in time ˜ O ( n k − δ ) for some constant δ > .Proof. Let us call the search algorithm A . There are two cases to consider. R ≤ n k and R > n k .If R > n k then we can use nearly linear hashing (see [Pat10]) to reduce our range down to n k . There maybe false positives here, however, the instance will look uniformly random (we are hashing large uniformlyrandom numbers). So we can use Lemma 7.4 to say that there will be at most s = k k lg k ( n ) solutions (falsepositives or true positives) with probability at least 1 − − Ω ( lg ( n )) . Now, we can use the algorithm fromLemma 7.5 to list all solutions with probability at least 1 − p ( n / ( k lg ( n ))) s − / Ω ( lg ( n )) . For each listedsolution we can check if it is a false positive and only count the actual cliques. This will return the truenumber of cliques with probability at least 1 − p ( n / ( k lg ( n ))) s − − Ω ( lg ( n )) . This requires s calls to A soit takes time O ( n k − ε s ) . This constrains δ < ε .If R ≤ n ( k − k (cid:48) − ε (cid:48) ) / where k (cid:48) = + ω ( k − ) /
3, then by Corollary 7.3 there is a O ( n k − ε (cid:48) ) time algorithmthat succeeds with probability 1.If n ( k − k (cid:48) − ε (cid:48) ) / < R < n k then we will use the average case self reduction for ACZ k C (see Lemma 7.6 or[LLV19]) to reduce the problem to problems of size x = R / k , so now we have that R = x k where x is ournew smaller input size. We can now call A on all these instances. Note that s ≥ n ( k − k (cid:48) − ε (cid:48) ) / ( k ) . Further notethat the total number of instances is ( n / x ) k ≤ n ( k (cid:48) + ε (cid:48) ) / . So, if A succeeds with probability 1 − p ( n ) then byunion bound these independent instances will succeed with probability at least 1 − p ( x / ( k lg ( x ))) · ( n / x ) k .47ow note that this is at least 1 − p ( n ( k − k (cid:48) − ε (cid:48) ) / ( k ) ) · n ( k (cid:48) + ε (cid:48) / ( k lg ( n ))) / . If there is an algorithm running in time O ( x k − ε ) for all ( n / x ) k problems then the running time is ˜ O ( n k − ε ( k − k (cid:48) − ε (cid:48) ) / ( k ) ) . Notably ε ( k − k (cid:48) − ε (cid:48) ) / ( k ) >
0. We want δ < ε (cid:48) and δ < ε ( k − k (cid:48) − ε (cid:48) ) / ( k ) < ε /
2. If we choose δ < ε (cid:48) = ε / − − Ω ( lg ( n )) − p ( n ( k − k (cid:48) − δ ) / ( k ) ) · n ( k (cid:48) + δ ) / · s and runs in time ˜ O ( n k − δ ) when δ < ε (cid:48) = ε / Search to DecisionLemma 7.8.
Let p ( n ) be a monotonically non-increasing function.Given a detection algorithm that runs in O ( n k − δ ) time for some δ > and has success probability atleast − p ( n ) we can produce a search algorithm that runs in time ˜ O (cid:0) n k − ε k + n k − δ ( − ε ) (cid:1) for any constant / > ε > and has success probability at least − p ( n − ε ) n k ε .Specifically for ε = / this can be bounded as ˜ O (cid:0) n k − δ / (cid:1) time and probability at least − p ( n / ) n k / .Proof. We use the classic self reduction for ACZ k C producing instances of size n − ε . For this we randomlysplit each partition of vertices into n ε groups of n − ε nodes. We form all n k ε possible sub-problems and runthe detection algorithm on them. On any instance that returns true we brute force the problem in O ( n k − k ε ) time. We of course can stop as soon as we find a clique.The probability that none of our n k ε instances produces a false positive is at least 1 − p ( n − ε ) n k ε . Ifwe have no false positives then our running time is O ( n k − k ε + n k ε ( n − ε ) k − δ ) . This can be simplified to O ( n k − k ε + n k − δ ( − ε ) ) Counting to DecisionLemma 7.9.
Let p ( n ) be a monotonically non-increasing function.Given a decision algorithm for ACZkC that runs in time O ( n k − ε ) for some ε > and succeeds withprobability at least − p ( n ) there is a counting algorithm that runs in O ( n k − ε (cid:48) ) for some ε (cid:48) > and succeedswith probability at least − − lg ( n ) − p ( n / ) n k .Proof. Use Lemma 7.8 when ε = / − p ( n / ) n k .Note this is not tight, by tuning ε and plugging in an improved value for the matrix multiplicationconstant you will get a tighter result. This bound is sufficient for our purposes so we leave it as is. R EMINDER OF T HEOREM
Given a decision algorithm for ACZkC that runs in time O ( n k − ε ) forsome ε > and succeeds with probability at least − n − ω ( ) , there is a counting algorithm that runs inO ( n k − ε (cid:48) ) time for some ε (cid:48) > and succeeds with probability at least − n − ω ( ) , where ω ( ) here means anyfunction that is asymptotically larger than constant.Proof. We plug in n − ω ( ) for p ( n ) in Lemma 7.9. Note that the second error term, 2 − lg ( n ) is n − ω ( ) . Average-case fine-grained complexity still has a lot of unexplored areas. We suggest the following openproblems that directly relate to results of this work. 48 eneral Questions
What other natural non-factored problems are hard from factored problems (either F k - f and F f k C)? We give three problems in section 4 where we only show their detection version is hard. Canone show that a counting version of ( k + ) L-MF, k -LCS, or Edit Distance is hard from counting factoredproblems? Recall that such a reduction would imply average case hardness over some distribution for theproblem reduced to. We show hardness for the uniform average case for k - f and f k C, can one showhardness for other natural worst case distributions of these problems?
Cryptography and Counting vs Detection
In Section 7 we show that detecting Z k C with high probabilityin the average case implies fast algorithms for counting with high probability in the average case. • Counting to detection in the high error regime:
Can you show that a detection algorithm for average-case Z k C that succeeds with probability 1 − / ( polylog ( n )) implies an algorithm for counting Z k C withprobability 2 /
3? If such a reduction exists in the high error regime you can build cryptography proto-cols from an assumption about the difficulty of counting Z k C on average [LLV19]. • Worst case ZkC to counting ZkC on average:
Can we reduce the worst case hardness of Z k C toaverage case k C? What about k -SUM? If you can prove this for Z k C and prove the previous high-error regime reduction, then you can build fine-grained cryptography from a worst-case assumptionabout the complexity of Z k C. • Counting to detection for other problems:
A similar proof technique that we use for Z k C shouldwork for the 3-SUM problem. For this style of reduction we need: (1) an efficient average-case self-reduction for the problem, (2) the number of witnesses to be small on average when some parameter R is large, and (3) an efficient algorithm when R is small. All of these exist for 3-SUM, however, thereisn’t an efficient self reduction for k -SUM for k >
3. Can another approach work to show counting todetection results for problems like k -SUM, k -LCS, etc? Using/Extending the Good Low-Degree Polynomial Framework
A few directions that could be takenwith respect to our framework are the following: • Can the framework be extended to handle multiple outputs? For example, the problem of multiplyingtwo zero-one matrices? • Can we find new problems P that have GLDP ( P ) ? • Can the framework be improved? For example, could it be improved to handle polynomials of(slightly) greater degree? Can the strong k -partiteness condition be weakened? LCS and Edit Distance
In Section 4.6 we cover LCS and Edit Distance. We have two open problemsfrom this section we want to highlight. • Making a framework for string distance lower bounds from factored problems:
Bringmann andK¨unnemann [BK15] create a framework for proving n − o ( ) lower bounds from SETH. We believethis same framework can be extended to work for F2-OV by adding a requirement of a selection gad-get. It also seems that this framework could be extended to contain F k -OV. Relatedly, can k-mediandistance and k-center-edit-distance be reduced to F k -OV?49 Getting tight hardness for
We note that the counting versions of k -LCS and k -WLCS both have algorithms that run in time n k + o ( ) (see Appendix A). Given our construction, thecounting versions of k -LCS and k -WLCS count (cid:125) ( v , . . . , v k ) is given as input the k strings FV G ( v ) , . . . , FV G ( v k ) . However, unfortunately, the counting versions of k -LCS and k -WLCS do not return k -OV given our construction of P , . . . , P k . This is due to using an alignment gadget instead of aselector gadget. If we used the selector gadget, the count of longest common subsequences would bethe sum over the counts of all FV G ( v ) , . . . , FV G ( v k ) where (cid:125) ( v , . . . , v k ) >
0. This would result inthe count being exactly the output of k -OV. However, the strings produced by our reduction wouldhave length n and weights of size ˜ O ( n ) . So, we would get a lower bound of n k / − o ( ) for k -WLCS,and a lower bound of n k / − o ( ) for k -LCS. A more efficient selector gadget would yield tight lowerbounds for k -LCS and k -WLCS, including in the average-case. We suggest this as a potential topicfor future work. Acknowledgements
We would like to acknowledge Marshall Ball for interesting and helpful early discussions.We would like to acknowledge all our reviewers for helpful comments. We thank all the reviewers foradvice about improving the readability of the paper. We would like to extend special thanks to reviewer 1who noted that we could improve the definition of good low-degree polynomial by removing a restriction!
References [ABV15] Amir Abboud, Arturs Backurs, and Virginia Vassilevska Williams. Tight hardness results forLCS and other sequence similarity measures. In
IEEE 56th Annual Symposium on Foundationsof Computer Science, FOCS 2015, Berkeley, CA, USA, 17-20 October, 2015 , pages 59–78, 2015.[ALW14] Amir Abboud, Kevin Lewi, and Ryan Williams. Losing weight by gaining edges. In Andreas S.Schulz and Dorothea Wagner, editors,
Algorithms - ESA 2014 - 22th Annual European Sympo-sium, Wroclaw, Poland, September 8-10, 2014. Proceedings , volume 8737 of
Lecture Notes inComputer Science , pages 1–12. Springer, 2014.[AVY18] Amir Abboud, Virginia Vassilevska Williams, and Huacheng Yu. Matching triangles and basinghardness on an extremely popular conjecture.
SIAM Journal on Computing , 47(3):1098–1122,2018.[BBB19] Enric Boix-Adser`a, Matthew Brennan, and Guy Bresler. The average-case complexity of count-ing cliques in erd˝os-r´enyi hypergraphs. In David Zuckerman, editor, , pages 1256–1280. IEEE Computer Society, 2019.[BI15] Arturs Backurs and Piotr Indyk. Edit distance cannot be computed in strongly subquadratic time(unless SETH is false). In Rocco A. Servedio and Ronitt Rubinfeld, editors,
Proceedings of theForty-Seventh Annual ACM on Symposium on Theory of Computing, STOC 2015, Portland, OR,USA, June 14-17, 2015 , pages 51–58. ACM, 2015.[BI16] Arturs Backurs and Piotr Indyk. Which regular expression patterns are hard to match? In , pages 457–466.IEEE, 2016. 50BI18] Arturs Backurs and Piotr Indyk. Edit distance cannot be computed in strongly subquadratic time(unless SETH is false).
SIAM J. Comput. , 47(3):1087–1097, 2018.[BK15] Karl Bringmann and Marvin K¨unnemann. Quadratic conditional lower bounds for string prob-lems and dynamic time warping. In Venkatesan Guruswami, editor,
IEEE 56th Annual Sym-posium on Foundations of Computer Science, FOCS 2015, Berkeley, CA, USA, 17-20 October,2015 , pages 79–97. IEEE Computer Society, 2015.[BRSV17] Marshall Ball, Alon Rosen, Manuel Sabin, and Prashant Nalini Vasudevan. Average-case fine-grained hardness. In Hamed Hatami, Pierre McKenzie, and Valerie King, editors,
Proceedingsof the 49th Annual ACM SIGACT Symposium on Theory of Computing, STOC 2017, Montreal,QC, Canada, June 19-23, 2017 , pages 483–496. ACM, 2017.[BRSV18] Marshall Ball, Alon Rosen, Manuel Sabin, and Prashant Nalini Vasudevan. Proofs of work fromworst-case assumptions. In Hovav Shacham and Alexandra Boldyreva, editors,
Advances inCryptology - CRYPTO 2018 - 38th Annual International Cryptology Conference, Santa Barbara,CA, USA, August 19-23, 2018, Proceedings, Part I , volume 10991 of
Lecture Notes in ComputerScience , pages 789–819. Springer, 2018.[CGI +
16] Marco L. Carmosino, Jiawei Gao, Russell Impagliazzo, Ivan Mihajlin, Ramamohan Paturi, andStefan Schneider. Nondeterministic extensions of the strong exponential time hypothesis andconsequences for non-reducibility. In Madhu Sudan, editor,
Proceedings of the 2016 ACMConference on Innovations in Theoretical Computer Science, Cambridge, MA, USA, January14-16, 2016 , pages 261–270, 2016.[CR02] Alberto Caprara and Romeo Rizzi. Packing triangles in bounded degree graphs.
InformationProcessing Letters , 84(4):175–180, 2002.[CW16] Timothy M. Chan and Ryan Williams. Deterministic apsp, orthogonal vectors, and more:Quickly derandomizing razborov-smolensky. In Robert Krauthgamer, editor,
Proceedings ofthe Twenty-Seventh Annual ACM-SIAM Symposium on Discrete Algorithms, SODA 2016, Ar-lington, VA, USA, January 10-12, 2016 , pages 1246–1255. SIAM, 2016.[GCSR13] Donatella Granata, Raffaele Cerulli, Maria Grazia Scutell`a, and Andrea Raiconi. Maximumflow problems and an np-complete variant on edge-labeled graphs.
Handbook of CombinatorialOptimization , pages 1913–1948, 2013.[GO95] Anka Gajentaan and Mark H. Overmars. On a class of o(n2) problems in computational geom-etry.
Comput. Geom. , 5:165–185, 1995.[GR18] Oded Goldreich and Guy N. Rothblum. Counting t-cliques: Worst-case to average-case reduc-tions and direct interactive proof systems. In Mikkel Thorup, editor, ,pages 77–88. IEEE Computer Society, 2018.[GR20] Oded Goldreich and Guy N. Rothblum. Worst-case to average-case reductions for subclassesof P. In
Computational Complexity and Property Testing - On the Interplay Between Random-ness and Computation , volume 12050 of
Lecture Notes in Computer Science , pages 249–295.Springer, 2020. 51IF92] Robert W Irving and Campbell B Fraser. Two algorithms for the longest common subsequenceof three (or more) strings. In
Annual Symposium on Combinatorial Pattern Matching , pages214–229. Springer, 1992.[IP01] Russell Impagliazzo and Ramamohan Paturi. On the complexity of k -SAT. J. Comput. Syst.Sci. , 62(2):367–375, 2001.[Kus19] William Kuszmaul. Dynamic time warping in strongly subquadratic time: Algorithms for thelow-distance regime and approximate evaluation. In Christel Baier, Ioannis Chatzigiannakis,Paola Flocchini, and Stefano Leonardi, editors, , volume 132 of
LIPIcs , pages 80:1–80:15. Schloss Dagstuhl - Leibniz-Zentrum f¨ur Informatik, 2019.[KW19] Daniel M. Kane and R. Ryan Williams. The orthogonal vectors conjecture for branching pro-grams and formulas. In Avrim Blum, editor, , volume 124 of
LIPIcs , pages 48:1–48:15. Schloss Dagstuhl - Leibniz-Zentrum fuer Informatik, 2019.[LLV19] Rio LaVigne, Andrea Lincoln, and Virginia Vassilevska Williams. Public-key cryptography inthe fine-grained setting. In Alexandra Boldyreva and Daniele Micciancio, editors,
Advancesin Cryptology - CRYPTO 2019 - 39th Annual International Cryptology Conference, Santa Bar-bara, CA, USA, August 18-22, 2019, Proceedings, Part III , volume 11694 of
Lecture Notes inComputer Science , pages 605–635. Springer, 2019.[Pat10] Mihai Patrascu. Towards polynomial lower bounds for dynamic problems. In Leonard J. Schul-man, editor,
Proceedings of the 42nd ACM Symposium on Theory of Computing, STOC 2010,Cambridge, Massachusetts, USA, 5-8 June 2010 , pages 603–610. ACM, 2010.[Vas18] Virginia Vassilevska Williams. On some fine-grained questions in algorithms and complexity.In
Proceedings of the ICM , volume 3, pages 3431–3472. World Scientific, 2018.[VW10a] Virginia Vassilevska Williams and Ryan Williams. Subcubic equivalences between path, matrixand triangle problems. In , pages 645–654. IEEE ComputerSociety, 2010.[VW10b] Virginia Vassilevska Williams and Ryan Williams. Subcubic equivalences between path, matrixand triangle problems. In
Foundations of Computer Science (FOCS), 2010 51st Annual IEEESymposium on , pages 645–654. IEEE, 2010.[VW13] Virginia Vassilevska Williams and Ryan Williams. Finding, minimizing, and counting weightedsubgraphs.
SIAM J. Comput. , 42(3):831–854, 2013.[VW18] Virginia Vassilevska Williams and R. Ryan Williams. Subcubic equivalences between path,matrix, and triangle problems.
J. ACM , 65(5):27:1–27:38, 2018.[Wil07] Ryan Williams. Algorithms and resource requirements for fundamental problems.
Ph. D. dis-sertation, Ph. D. Thesis , 2007. 52
Removed Algorithms
A.1 Algorithms for Factored Problems
These algorithms are straightforward be case they are simply brute force.
Lemma A.1.
Fk- f can be solved in ˜ O ( n k ) time.Proof. For F k - f , we want to run (cid:125) ( v , . . . , v k ) on every set of k vectors. To do this we need to compute ◦ ( v [ i ] , . . . , v k [ i ]) for all i ∈ [ , g ] . Running ◦ ( · ) takes O ( Π j ∈ [ , k ] | v j [ i ] | ) time. We can use the upper bound | v j [ i ] | ≤ b . So computing ◦ ( · ) takes at most O ( bk ) time. Thus, computing (cid:125) ( · ) takes at most O ( g · bk ) .Thus, computing F k - f takes at most O ( n k · g · bk ) time. We bounded g and b to be o ( lg ( n )) so g · bk issubpolynomial. Thus, F k - f takes at most ˜ O ( n k ) time. Lemma A.2. F f kC ( f kC) can be solved in time ˜ O ( n k ) .Proof. For every k tuple of nodes in the graph we want to evaluate (cid:125) ( · ) . If we can evaluate (cid:125) ( · ) in ˜ O ( ) time then we can count or detect in ˜ O ( n k ) time.Evaluating isClique ( · ) can be done in ˜ O ( ) time. Evaluating the multiplication, given the results of thefunction ◦ ( · ) can be done in ˜ O ( g ) time. Evaluating ◦ ( · ) should require at most ˜ O ( ( k ) b ) time as the function f has a total truth table size of 2 ( k ) b and we simply need to evaluate how many entries of the truth table are1 while we simultaneously have that vector.Finally, we note that g = ˜ O ( ) and 2 ( k ) b = ˜ O ( ) . So evaluating (cid:125) ( · ) can be done in ˜ O ( ) time. A.2 Algorithms for Problems Harder than Factored Problems
Theorem A.3.
Counting partitioned matching triangles ( ˜ O ( n ) time.Proof. Let the g graphs be G , . . . , G g in our PMT instance, and let n jr be the number of nodes of color r in G j . For all triple of colors ( c , c , c ) and all j , we count the number of triangles of these colors in G j . Wecan do this by inspecting every triple of nodes of color ( c , c , c ) in time n jc n jc n jc . Since ∑ r n jr = n for all j , we have that ∑ gj = ∑ ( c , c , c ) n jc n jc n jc = O ( gn ) = ˜ O ( n ) . Theorem A.4. (Counting mod R) k-NLstC has a ˜ O ( | C | k + | C | k − | E | ) time algorithm for all k ≥ (when lg ( R ) is sub-polynomial).Proof. We can guess the k colors and use BFS to discover if s is connected to t. This takes O ( | E | ) time.If we are counting instead of detecting paths from s to t then we want to extend the BFS approach byassociating an additional number to each node. Every node will keep a value of the number of paths from s to that node mod R . These numbers will require a sub-polynomial number of bits to represent as lg ( R ) isbounded to be subpolynomial. In a layered graph we can compute the number of paths from s to a node v inlayer i by summing the number of paths from s to u for all u that are neighbors of v that are in layer i − L . This also takes O ( | E | ) time.Let E c i , c j be the set of all edges between nodes of colors c i and c j . Let E s , c i be the set of all edgesbetween s and nodes with color c i . Let E t , c i be the set of all edges between t and nodes with color c i .53ur running time is: ∑ c , c ,..., c k ∈ C (cid:32)(cid:32) ∑ i ∈ [ , k ] | E s , c i | + | E t , c i | (cid:33) + ∑ i , j ∈ [ , k ] | E c i , c j | (cid:33) . We know that | E s , c i | + | E t , c i | ≤ | E c i , c i | =
0. So we cansimplify to: ˜ O (cid:32) k | C | k + k ∑ c , c ,..., c k ∈ C | E c , c | (cid:33) . Then we can use the fact that ∑ c , c ∈ C | E c , c | = | E | and that k is a constant to get:˜ O (cid:16) | C | k + | C | k − | E | (cid:17) . Theorem A.5.
There is an algorithm for (counting mod R) k-ELstC that runs in time ˜ O ( | C | k − | E | ) (when lg ( R ) = n o ( ) ).Proof. We do an exhaustive search for all k colors. Once we guess k colors c , . . . , c k then we simply run a O ( | E | ) time algorithm for (directed/undirected) reachability on this input. If we are counting paths mod R then we use the fact that the graph is a directed acyclic graph to count the number of paths from s to everynode, so we can go through a normal breadth first search but keeping the count mod R . Because lg ( R ) = n o ( ) we can track these sums in sub-polynomial time.We start by sorting our edges by their color (so that given a guess of colors we can in k lg ( n ) time givepointers to the full set of all edges of that color). Let e ( c ) be the number of edges of color c . Then ourrunning time can be given as: ∑ c ,..., c k ∈ [ , | C | ] e ( c ) + . . . + e ( c k ) + k lg ( n ) . Consider a particular one of the additive parts of this sum: ∑ c ,..., c k ∈ [ , n ] e ( c i ) . This can be re-written as: ∑ c ,..., c i − , c i + ,..., c k ∈ [ , | C | ] (cid:32) ∑ c i ∈ [ , | C | ] e ( c i ) (cid:33) . Which is ∑ c ,..., c i − , c i + ,..., c k ∈ [ , | C | ] | E | = | C | k − | E | . So the total running time is k | C | k + k | C | k − | E | lg ( R ) lg ( n ) + | E | lg ( n ) . The k | C | k time comes from runningall of our small instances. The k lg ( n ) coming from the need to give pointers into where our k colors of edgesare stored. The factor of lg ( R ) comes from tracking the count mod R in the counting version. And finally,the | E | lg ( n ) comes from sorting our edges according to color. Theorem A.6.
There is an algorithm for detecting ( k + ) L-MF* on an n-node graph that runs in ˜ O ( n k ) time. roof. First we run a max flow algorithm on the graph to obtain the value | F | of the max flow. Since thegraph is unit-capacitated, this can be done in O ( n √ m ) = O ( n ) time.Recall that the edges connected to the source s and the sink t have a special label l ∗ . So this label mustbe among the k + k labels l , . . . , l k , we consider the subgraph induced onthe edges with labels in l , . . . , l k , l ∗ , and we run a max flow algorithm on this graph. If the max flow valueon this graph equals | F | , we are done. Otherwise if all these graphs have maximum flow less than | F | , thereis no max flow with k + o ( n ) time since for eachlabel the number of edges with that label is o ( n ) .Now we turn to regular expressions matching problem, and state an efficient algorithm for counting thenumber of alignments of the pattern on sub-strings of the text. First we state two lemmas. Lemma A.7.
Let M be an NFA with no cycles of length more than . Let a computation of a string t inM be a sequence of states from the start state to the accept state of M that produces t. Then given a textT and a fixed integer R where log R is sub-polynomial, there is an algorithm that computes the number ofcomputations of substrings of T in M mod R in O ( m | T | ) time, where m is the number of edges of M.Proof. All numbers are taken mod R . Let Q be the set of states of M , and let ∆ : Q × Σ → P ( Q ) be thetransition function of M , where Σ is the alphabet, and P ( Q ) is the power set of Q . Recall that we have anedge from state s to state s (cid:48) if s (cid:48) ∈ ∆ ( s , σ ) for σ ∈ Σ ∪ { ε } , where ε is the empty string. Note that for anystate s ∈ Q , s / ∈ ∆ ( s , ε ) . We can assume that there is only one accept state with no outgoing edge (and henceno self-loops).Since M has no cycles other than self-loops, it has a topological ordering s , s , . . . , s r where s is thestart state, s r is the accept state, r is the number of states of M and there is no edge from state s i to s j if i > j .We compute the number of computations of substrings of T in M by dynamic programming. Let | T | = n ,and let T i be the postfix of T starting at i for i = , . . . , n +
1, where T n + is the empty string. Let M i be theNFA obtained from M by having s i as the start state. For i = , . . . , r and j = , . . . , | T | , let f ( i , j ) be thenumber of computations of prefixes of T j by M i . So ∑ nj = f ( , j ) is what we have to compute.As the base case, we have that f ( r , n + ) =
1. Let N out ( s i ) be the set of outgoing neighbors of s i , i.e. wehave that s j ∈ N out ( s i ) if there is an edge from s i to s j . Similarly we define N in ( s i ) to be the set of incomingneighbors of s i .Fix i , j . Suppose that we have computed f ( i (cid:48) , j (cid:48) ) for all i (cid:48) ≥ i and j (cid:48) ≥ j where i (cid:48) + j (cid:48) > i + j . We compute f ( i , j ) as follows. f ( i , j ) = ∑ s (cid:96) ∈ ∆ ( s i , T [ j ]) f ( i + , (cid:96) ) + ∑ s (cid:96) ∈ ∆ ( s i , ε ) f ( i , (cid:96) ) Note that s i / ∈ ∆ ( s i , ε ) , so we can compute this sum, which takes O ( | N out ( s i ) | ) to compute. Hence thecomputation of all f ( i , j ) s takes O ( mn ) time. Lemma A.8.
If E is a regular expression of the type T (see Figure 6), there is an NFA equivalent to E thathas no cycle of length more than . This MFA has O ( | E | ) edges.Proof. Let a sub-type of a regular expression type T be a type shown by a sub-tree of the tree of T . Weshow that for any regular expression of type T or any sub-type of T , there is an NFA equivalent to E thathas no cycle length more than 1. Recall that ε is the empty string.So let E be a regular expression of any sub-type of T . We construct the NFA of E in a recursive manner.As the base case, suppose that E has length 1. So it consists of only one symbol a , for which a two state55FA suffices: Let s be the starting state and s be the accept state, and let e be an edge from s to s withvalue a (equivalently, the transition function ∆ is ∆ ( s , a ) = { s } ).If E has length more than 1, it is of the form A • B or A ∗ , where • is one of the operators concatenation(“ · ”) or OR (“ | ”), and A and B are two regular expressions of a sub-type of T . Let M A and M B be theNFAs corresponding to A and B respectively, with s A , s B as the corresponding start states and t A , t B as thecorresponding accept states.So we have three cases:1. Concatenation: suppose that • = · . Define M to be the MFA that consists of M A and M B , with an edgeadded from t A to s B with value ε . Let s A be the start state of M and t B be the accept state of M .2. Or: suppose that • = | . Let s be a new state, which has an edge of value ε to s A and s B . Mark s as thestart state of M . Let t be a new state, where there is an edge from t A and t B to t with value ε . Let t bethe accept state.3. Star: Suppose that E = A ∗ . Since E is of a subtype of T , A must be of type “ | ”. So it is the OR ofsome symbols. Let the set of these symbols be Q A . Then define M to have 3 states, s E as the startstate, t E as the accept state, and s as a middle state where there is a self-loop from s to itself with allsymbols in Q A as its values, an edge from s A to s and an edge form s to t A with empty string ε as theirvalue.It is straightforward to see that this NFA is equivalent to E , so that each alignment of E on a text is equivalentto a computation of the text by the NFA M . Note that in each case we add O ( ) edges. So the total numberof edges is O ( | E | ) .Combining Lemma A.7 and A.8 gives us the following Theorem. Theorem A.9.
Given a regular expression E, a text T and a fixed integer R where log
R is sub-polynomial,there is an algorithm that counts the number of alignments of E on substrings of T mod R in O ( | T || E | ) time. Theorem A.10.
There is an algorithm for ˜ O ( n k ) time when lg ( R ) = o ( lg ( n )) .Proof. Take P , . . . , P k to be the input sequences. Recall that w ( P (cid:96) [ i ]) is the weight of the symbol at position i in the (cid:96) th string.We will use dynamic programming. We will have a cell in our table for every k tuples of locations in thestrings i , . . . , i k . Every cell will contain two pieces of information: • (cid:96) ( i , . . . , i k ) the length of the longest common subsequence(s) of the substrings P [ : i ] , . . . , P k [ : i k ] . • C ( i , . . . , i k ) is the count of the number of longest common subsequences mod R . This will have a n o ( ) bit representation due to our restriction on R .We start by initializing all cells associated with locations i , . . . , i k where any i j =
0. These cells areinitialized to (cid:96) ( i , . . . , i k ) = C ( i , . . . , i k ) =
1, as there is only one way to have a zero length string.Let the total sum of a cell be ∑ kj = i j , we will fill cells out in order by there total sum, starting with zeroand moving to kn . Any cell that has a i j value equal to zero will be left with its initialization.When filling the cell there are two cases: when P [ i ] = P [ i ] = . . . = P k [ i k ] , and when that isn’t true. Wedefine some helpful notation. Let (cid:126) v = i , . . . , i k and let eq (cid:96) ( (cid:126) v ,(cid:126) u ) be a function that returns 1 if (cid:96) ( (cid:126) v ) = (cid:96) ( (cid:126) u ) .Let (cid:126) v ( − ) be the vector i − , . . . , i k −
1. Let S ( (cid:126) v ) be a set of all vectors (cid:126) u such that for all indices j we have56hat (cid:126) u [ j ] = (cid:126) v [ j ] + { , − } excluding (cid:126) v and (cid:126) v ( − ) . So all the smaller neighboring vectors of (cid:126) v , excluding thestrictly smaller vector (note these may differ from (cid:126) v in 1 , , . . . , k − S ( (cid:126) v ) and (cid:126) v ( − ) will have been computed by the time we are computing the cell (cid:126) v . We will start with the case where P [ i j ] (cid:54) = P [ i j (cid:48) ] . Our length is the maximal length seen so far. (cid:96) ( i , . . . , i k ) = max (cid:126) u ∈ S ( (cid:126) v ) ( (cid:96) ( (cid:126) u )) . This is maximizing over all possible previous choices of longest common subsequence. We know our currentlast symbols can’t all be included in the LCS.For setting C : We want to look only at entries that are longest common subsequences, so naively youmight think to just sum all the counts from the earlier cells that hit our max length of (cid:96) ( (cid:126) v ) . But, we will havean inclusion exclusion issue. Consider the case of k =
2, i.e. 2-LCS. If C ( i − , j ) = x , C ( i , j − ) = y , and C ( i − , j − ) = z then C ( i , j ) = x + y − z . This is because x captures both all the longest sequences between P [ : i − ] and P [ : j − ] as well as those that use the symbol in location P [ i ] . The parallel statementis true for y . So we are double counting those longest common subsequences that appear in both P [ : i − ] and P [ : j − ] , so we subtract out that double counting. In order to handle this smoothly we willdefine a more involved version of S ( (cid:126) v ) . Let S r ( (cid:126) v ) contain the subset of vectors (cid:126) u ∈ S ( (cid:126) v ) ∪ (cid:126) v ( − ) where (cid:0) ∑ kj = (cid:126) v [ j ] (cid:1) − (cid:0) ∑ kj = (cid:126) u [ j ] (cid:1) = r . So S r ( (cid:126) v ) is the set of vectors that have r indices that are smaller than (cid:126) v . Now,after all this lead up, our value for C is the following: C ( (cid:126) v ) = k ∑ r = ( − ) r ∑ (cid:126) u ∈ S r ( (cid:126) v ) eq (cid:96) ( (cid:126) v ,(cid:126) u ) C ( (cid:126) u ) . We need to mod this by R so that the total bits in the representation is not too large.So in ˜ O ( k R ) time per cell we can compute k -LCS. There are a total of n k cells so the total time for thisalgorithm is ˜ O ( n k ) . Now we will deal with the case of P [ i ] = P [ i ] = . . . = P k [ i k ] . First let us set (cid:96) ( · ) : (cid:96) ( i , . . . , i k ) = (cid:96) ( i − , i − , . . . , i k − ) + w ( P [ i ]) . This works because we have a matching symbol. Our new longest common subsequence at this locationwill have a length one longer than the longest sequence that existed using none of the current symbols.For setting C : We want to count two non-overlapping sets. One set is the weighted longest commonsubsequences at location (cid:126) v ( − ) . The other set is all the strings that use some but not all of the symbols fromour current location (cid:126) v . For counting this we need inclusion exclusion like before. C ( (cid:126) v ) = C ( (cid:126) v ( − ) ) + k ∑ r = ( − ) r ∑ (cid:126) u ∈ S r ( (cid:126) v ) eq (cid:96) ( (cid:126) v ,(cid:126) u ) C ( (cid:126) u ) . This counts all longest sequences that include the current symbols indicated by (cid:126) v by including the count of C ( (cid:126) v ( − ) ) , it also counts all alternate ways to achieve a longest common subsequence of this length usingat least one of these symbols by the summation. We need to mod this by R so that the total bits in therepresentation is not too large. Corollary A.11.
There is an algorithm for ˜ O ( n k ) time when lg ( R ) = o ( lg ( n )) .Proof. The k -LCS problem is a special case of k -WLCS problem where w ( · ) is the constant function thatreturns 1. 57 Framework for Generating Uniform Average Case Hardness
B.1 Preliminaries
B.1.1 NotationDefinition 1.
We use x ∼ F np to mean that x is drawn uniformly at random from all p n values in the supportof F np . B.1.2 Getting Nearly Uniform Bit Strings from Finite Field Elements
Adser`a et. al show that counting cliques is hard on average over the uniform distribution where every edgeexists iid [BBB19].
Theorem B.1.
Let Z i = Ber [ µ ] where µ ∈ ( , ) . Then let Y ≡ ∑ ti = Z i · i ( mod p ) . Let the total variationdistance between Y and U NIF [ , p − ] be ∆ . Then there exists a constant C such that if t ≥ C · µ − · ( − µ ) − · lg ( p / ε ) · lg ( p ) , then ∆ ≤ ε [BBB19]. Theorem B.2.
If you are given an input with n numbers x , . . . , x n each chosen from U NIF [ , p − ] thereexists a sampling procedure which runs in time O ( n lg ( n ) t ( / p − ε ) − ) that, with probability at least − − lg ( n ) , produces a new set of numbers I = x (cid:48) , . . . , x (cid:48) n such that:1. x (cid:48) i ≡ x i mod p for all i.2. Each x (cid:48) i is t bits long where t ≥ C · µ − · ( − µ ) − · lg ( p / ε ) · lg ( p ) .3. I is total variation distance n ε from the distribution where every bit of x (cid:48) i is iid sampled from Ber [ µ ] .(inspired by [BBB19])Proof. Let Z i = Ber [ µ ] where µ ∈ ( , ) . Then let Y be the distribution formed by ∑ ti = Z i · i ( mod p ) .Consider the procedure to generate x (cid:48) i where we sample a number y from Y , if y ≡ x i ( mod p ) then x (cid:48) i = y , else repeat. We take O ( t ) time to produce a sample. We succeed with the probability that y ≡ x i ( mod p ) . This probability is at least p − ε , because ε is the total variation distance of Y and U NIF [ , p − ] .Thus, the time to produce a single sample in expectation is O ( t ( / p − ε ) − ) . To fail Θ ( t ( / p − ε ) − lg ( n )) times in a row will happen with probability at most 1 − − ( n ) . If we fail Θ ( t ( / p − ε ) − lg ( n )) times ina row simply halt the program and throw an error.We run this procedure for all n numbers, thus taking at most O ( nt ( / p − ε ) − lg ( n )) time to succeedwith probability at least 1 − n − ( n ) ≥ − − lg ( n ) .The total variation distance from each individual x (cid:48) i to the uniform distribution is ε and there are n inputsin total. Thus, the total variation distance is at most n ε by the union bound. Corollary B.3.
If you are given an input with n numbers x , . . . , x n each chosen from U NIF [ , p − ] thereexists a sampling procedure which runs in time O ( n lg ( n ) t ( / p − / n ) − ) that, with probability at least − − lg ( n ) , produces a new set of numbers I = x (cid:48) , . . . , x (cid:48) n such that:1. x (cid:48) i ≡ x i ( mod p ) for all i.2. Each x (cid:48) i is t bits long where t ≥ C · µ − · ( − µ ) − · ( lg ( p ) + ( n )) · lg ( p ) .3. I is total variation distance / n from the distribution where every bit of x (cid:48) i is iid sampled from Ber [ µ ] .Proof. Simply plug in ε = / n to Theorem B.2. 58 .2 The framework In this section we are going to show that any problem P with a GLDP ( · ) is hard over the uniform averagecase. We define GLDP ( · ) in Definition 8.First, we want to convert our problem over a polynomial large finite field to a problem over many O ( lg ( n )) sized finite fields. We will use the Chinese Remainder Theorem (CRT) to do this. Lemma B.4.
Let P be some problem with output in range [ , n c ] . Let P p be the same problem as P, butwhere P p ( (cid:126) I ) ≡ P ( (cid:126) I ) ( mod p ) .Let f be a GLDP(P). Let f , . . . , f s be a set of s polynomials where s = O ( lg ( n ) / lg lg ( n )) . We define f i as the same polynomial as f , but over finite field F p i where p i = Θ ( lg ( n )) and all p i are distinct.Then, for all i, f i is a GLDP(P p i ).Finally, given f i ( (cid:126) I ) for all i ∈ [ , s ] we can return P ( (cid:126) I ) .Proof. If f ( (cid:126) I ) = P ( (cid:126) I ) then trivially f ( (cid:126) I ) ≡ P ( (cid:126) I ) ( mod p ) . As a result f i ( (cid:126) I ) ≡ P p i ( (cid:126) I ) ≡ P ( (cid:126) I ) ( mod p i ) .If f has degree d then f i also has degree d (it certainly has at most d , because f is strongly d -partite theywill in fact be equal).If f is d -partite then so is f i .Thus, f i is a GLDP( P p i ).Given f i ( (cid:126) I ) for all i ∈ [ , s ] we know P p i ( (cid:126) I ) for all i ∈ [ , s ] . We can use the Chinese Remainder Theoremto find the value of P as long as Π si = p i ≥ n c . By the prime number theorem there is a sufficiently largeconstant c (cid:48) such that there are more than 2 c lg ( n ) / lg lg ( n ) primes between lg ( n ) and c (cid:48) lg ( n ) . If we choosethese primes to be p , . . . , p s = c lg ( n ) / lglg ( n ) then Π si = p i ≥ n c ≥ n c .Now we want to apply a worst-case to average case reduction for each f i separately. We can use Lemma1 from [BRSV17] to achieve this. Lemma B.5.
Consider positive integers n, d, and p, and an ε ∈ ( , / ) such that d > , p is prime andp > d. Suppose that for some polynomial f : F np → F p of degree at most d, there is an algorithm Arunning in time T ( n ) such that when x is drawn uniformly at random from all inputs F np :Pr [ A ( x ) = f ( x )] ≥ − ε . Then there is a randomized algorithm B that runs in time O ( nd log ( p ) + d + T ( n ) d ) such that for any x ∈ F np : Pr [ B ( x ) = f ( x )] ≥ / . [BRSV17] Notably, we demand that d = o ( lg ( n ) / lg lg ( n )) and we use p = Θ ( lg ( n )) , so p > d . The running time,given these choices, is ˜ O ( n + T ( n )) time. Corollary B.6.
Assume an f exists that is GLDP(P). Then, let f , . . . , f s be the polynomials described inB.4. Let A be an algorithm that runs in time T ( n ) such that when x ∼ F np i :Pr [ A ( x ) = f i ( x )] ≥ / , Ball et al. simply say a polynomial of degree d , however, unsurprisingly, their proof does not require the polynomial be ofdegree at least 9 to work. or all i. Then there is a randomized algorithm B that runs in time ˜ O ( n + T ( n )) such that for any (cid:126) I ∈ { , } n :Pr [ B ( (cid:126) I ) = P ( (cid:126) I )] ≥ − O (cid:16) − lg ( n ) (cid:17) . Proof.
We use Lemma B.5 for each polynomial f i . It follows that having an algorithm A for computing f i over the uniform input F np i that succeeds with probability 3 / B (cid:48) i existsthat succeeds with probability 2 / B i by running B (cid:48) i for Θ ( lg ( n )) times and pick the most common output,this will return the correct answer with probability at least 1 − − lg . ( n ) .Now if all of B , . . . , B s return the correct answer then we can use the CRT trick of Lemma B.4 to com-pute the value of P ( (cid:126) I ) . All of B , . . . , B s return the correct answer with probability at least 1 − s − lg . ( n ) = − O ( lg ( n ) / lg lg ( n )) − lg . ( n ) < − O (cid:16) − lg ( n ) (cid:17) So, we now want to show that solving random instances of P can solve random instances f i ( x ) where x ∼ F np . To do this we will use the sampling procedure described in Corollary B.3. We will also use the factthat P p i ( x ) = f i ( x ) when x is a zero and one input. Lemma B.7.
Assume a d degree polynomial f exists that is GLDP(P). Then, let f , . . . , f s and p , . . . , p s bethe polynomials and primes described in Lemma B.4.Let A be an algorithm that runs in time T ( n ) such that when (cid:126) I is formed by n bits each chosen iid fromBer [ µ ] where µ ∈ ( , ) is a constant, then:Pr [ A ( (cid:126) I ) = P ( (cid:126) I )] ≥ − / ω (cid:16) lg d ( n ) lg lg d ( n ) (cid:17) . Then there is a B that runs in time ˜ O ( n + T ( n )) such that when x ∼ F np i :Pr [ B ( x ) = f i ( x )] > / , for all f i .Proof. Let D µ be the distribution over inputs where each of the n bits is chosen iid from Ber [ µ ] , that is oneis chosen with probability µ and zero is chosen with probability 1 − µ . Recall that when we say (cid:126) Z ∼ D µ wemean that (cid:126) Z is drawn from the distribution D µ . We will use an abuse of notation where we run f i ( (cid:126) Z ) , whenwe do this we mean that one should interpret the n length bit vector as n values from F p i where 0 maps to0 ∈ F p i and 1 maps to 1 ∈ F p i . Additionally when we have a vector v we will use v [ j ] to represent the j th number in v .In this proof we will show how to use P ( (cid:126) Z ) to solve instances of f i ( (cid:126) Z ) for all i . Note that we can simplytake the output of P ( (cid:126) Z ) modulo p i . So we want to use f i ( (cid:126) Z ) where (cid:126) Z ∼ D µ to solve f i ( z ) where z ∼ F np i .Let f (cid:48) be the function f i but taken over the integers instead of F p i . Note that this is the same f (cid:48) regardlessof f i . We have that if x ∈ F np i then f (cid:48) ( x ) ≡ f i ( x ) ( mod p i ) . Furthermore, if we make a new input x (cid:48) where x (cid:48) [ j ] ≡ x [ j ] ( mod p i ) for all j ∈ [ , n ] then f (cid:48) ( x ) ≡ f i ( x ) ( mod p i ) . So, given an input x ∼ F np i we willtake the sampling procedure of Corollary B.3 and make a new input x (cid:48) , where x (cid:48) [ j ] is a t = O ( µ − · ( − µ ) − · ( lg ( p i ) + ( n )) · lg ( p i )) bit number. Note that because µ is constant and neither zero nor one and p i = Θ ( lg ( n )) then t = O ( lg ( n ) lg lg ( n )) . Furthermore, any given number x (cid:48) [ j ] has the property that thedistribution over its binary representation has total variation distance ≤ / n from the distribution where all60 bits are chosen iid from Ber [ µ ] . Thus, all tn bits in our new input x (cid:48) have total variation distance at most1 / n from the distribution where all tn bits are chosen iid from Ber [ µ ] .Now, we can compute the value of f (cid:48) ( x (cid:48) ) with t d calls to f (cid:48) where every call has a zero one input. Everymonomial is formed by one variable from each of the d partitions. Let m be the number of monomials. Sowe can write our polynomial f (cid:48) as follows : f (cid:48) ( x (cid:48) ) = m ∑ j = y k j , · y k j , · · · y k j , d , where y k j ,(cid:96) is a variable from the (cid:96) th partition S (cid:96) . The input x (cid:48) is formed with n of these input variables y k j ,(cid:96) .We can break down this multiplication for every bit. Let y k j ,(cid:96) [ r ] be the r th bit of y k j ,(cid:96) . Now we can rewriteour sum. Recall that g f (cid:48) ( v , . . . , v d ) is the function such that f (cid:48) can be written as a sum of calls to g f (cid:48) , where v (cid:96) is a variable from partition S (cid:96) : f (cid:48) ( x (cid:48) ) = m ∑ j = (cid:32) ∑ r ,..., r d ∈ [ , t − ] r + ... + r d · y k j , [ r ] · y k j , [ r ] · · · y k j , d [ r d ] (cid:33) . Put in words, we can multiply d numbers each of t bits by making a weighted sum over the t d multiplicationsof the bits of the d numbers.Now, we want to create t d inputs ˆ x , . . . , ˆ x t d . They are formed by taking all possible choices of r , . . . , r d where each r (cid:96) is an integer in [ , t − ] . Given a choice of r , . . . , r d we create a new input ˆ x j by taking allvariables in S (cid:96) and making their value in ˆ x j be the r th (cid:96) bit of that variable in x (cid:48) .Now, call A ( ˆ x j ) for all j ∈ [ , t d ] . Note that P ( ˆ x j ) ≡ f (cid:48) i ( ˆ x j ) ≡ f i ( ˆ x j ) ( mod p i ) . So, if A ( ˆ x j ) = P ( ˆ x j ) forall j ∈ [ , t d ] then we can return the value of f (cid:48) ( x (cid:48) ) ≡ f i ( x ) ( mod p ) .By the definition of A in this Lemma, A must succeed on any individual random input x ∼ D µ withprobability 1 − / ω ( lg d ( n ) lg lg d ( n )) . The total variation distance of any ˆ x j from D µ is at most 1 / n . So A must succeed on any one given random input ˆ x j with probability 1 − / ω ( lg d ( n ) lg lg d ( n )) − / n which is1 − / ω ( lg d ( n ) lg lg d ( n )) .Our inputs ˆ x j are not iid from each other, however, if A is correct with probability 1 − q on a given inputfrom ˆ x j then A must be correct with probability at least 1 − qt d on t d inputs ˆ x j at once.So, A will return correct answers for all t d inputs ˆ x j at once with probability at least 1 − / ω ( ) . Giventhese correct answers we can compute f i ( x ) , for all f i . So, an algorithm B exists that makes t d calls to A andtakes n lg ( n ) t time to produce our new sampled input x (cid:48) from x . B returns f i correctly with probability at least 1 − / ω ( ) > / B takes a total time of O ( t d T ( n ) + n ) . We have that t = O ( lg ( n ) lg lg ( n )) and d = o ( lg ( n ) / lg lg ( n )) (by ourdefinition of GLDP(P)). Thus, t d = n o ( ) . So we have that B runs in time ˜ O ( T ( n ) + n ) .This next theorem gives a worst case to average case reduction for P . R EMINDER OF T HEOREM