Extractors: applications and constructions

1
Extractors applications and constructions
Randomness

• Avi Wigderson
• IAS, Princeton

2
Extractors original motivation
Extractor Theory
3
Applications of Extractors

• Using weak random sources in prob algorithms
• B84,SV84,V85,VV85,CG85,V87,CW89,Z90-91
• Randomness-efficient error reduction of prob
  algorithms Sip88, GZ97, MV99,STV99
• Derandomization of space-bounded algorithms
  NZ93, INW94, RR99, GW02
• Distributed Algorithms WZ95, Zuc97, RZ98,
  Ind02.
• Hardness of Approximation Zuc93, Uma99, MU01
• Cryptography CDHKS00, MW00, Lu02 Vad03
• Data Structures Ta02

4
Unifying Role of Extractors

• Extractors are intimately related to
• Hash Functions ILL89,SZ94,GW94
• Expander Graphs NZ93, WZ93, GW94, RVW00, TUZ01,
  CRVW02
• Samplers G97, Z97
• Pseudorandom Generators Trevisan 99,
• Error-Correcting Codes T99, TZ01, TZS01, SU01,
  U02
• ? Unify the theory of pseudorandomness.

5
Definitions
6
Weak random sources

• Distributions X on 0,1n with some entropy
• vN sources n coins of unknown fixed bias
• SV sources PrXi1 1X1b1,,Xibi ? (d,
  1-d)
• Bit fixing n coins, some good, some sticky
• ..
• Z k-sources H8(X) k
• ?x PrX x ? 2-k
• e.g X uniform with support? 2k

7
Randomness Extractors(1st attempt)
weak random source X k can be e.g n/2, vn, log
n,
X k-source of length n
EXT
m almost-uniform bits
X

• Impossible even if kn-1 and m1

8
Extractors Nisan Zuckerman 93
X k-source of length n
EXT
m almost-uniform bits

• Ext 0,1n x 0,1d ? 0,1m
• X has min-entropy k (? X is a k-source)
• m kd

9
Extractors Nisan Zuckerman 93
X
k-source of length n
EXT
y? 0,1d
m bits ?-close to uniform

• ? k-source X, Ext(X,Ud) Um1 lt
  ?
• ? but ?-fraction of ys, Ext(X, y) Um1 lt ?
  

10
Extractors as graphs
(k,?)-extractor Ext 0,1n ? 0,1d
?0,1m
Sampling Hashing Amplification Coding Expanders
?
Discrepancy For all but 2k of the x? 0,1n,
?(X) ? B/2d - B/2m lt ?
11
Probabilistic algorithms with weak random bits
k-source of length n
Where from?
Efficient?
Try all possible 2d strings. Take Majority vote
m random bits
(upto ?)
Probabilistic algorithm
Input
Output
?
Error prob ltd
Want efficient Ext, small d, ? , large m
12
Extractors - Parameters
k-source of length n
(short) seed
EXT
d random bits
m bits ?-close to uniform

• Goals minimize d, ?, maximize m.
• Non-constructive optimal Sip88,NZ93,RT97
• Seed length d log(n-k) 2 log 1/? O(1).
• Output length m k d - 2 log 1/? - O(1).

13
Extractors - Parameters
k-source of length n
(short) seed
EXT
d random bits
m bits ?-close to uniform

• Goals minimize d, maximize m.
• Non-constructive optimal Sip88,NZ93,RT97
• Seed length d log n O(1).
• Output length m k d - O(1).

• ? 0.01
• k ? n/2

14
Explicit Constructions

• Non-constructive optimal Sip88,NZ93,RT97
• Seed length d log n O(1).
• Output length m k d - O(1).
• ...B86,SV86,CG87, NZ93, WZ93, GW94, SZ94, SSZ95,
  Zuc96, Ta96, Ta98, Tre99, RRV99a, RRV99b, ISW00,
  RSW00, RVW00, TUZ01, TZS01, SU01, LRVW03,
• New explicit constructions GUV07, DW08 - Seed
  length d O(log n) even for ?1/n
• Output length m .99k d

15
Applications
16
Probabilistic algorithms with weak random bits
k-source of length n X
Efficient!
Try all 2d poly(n) strings. Take Majority vote
m random bits
(upto ?)
Probabilistic algorithm
Input
Output
?
Error prob ltd
The error set B? 0,1m of alg is sampled
accurately whp
17
Extractors as samplers
n-bit string x
Efficient! k2m
S(x)

Ext(X,1)
Ext(X,2)
Ext(X,nc)
m m
m
For every B ? 0,1m, all but 2k of x ? 0,1n
S(x) ? B/nc - B/2m lt ? Note
x bad with prob lt 2k/2n, n arbitrary
18
Extractors as list-decodable error-correcting
codes TZ
C 0,1n ? 0,1D
d c log n D 2d nc
z
Polynomial rate! Efficient encoding!! Efficient
decoding?
For z ? 0,1D let Bz ? 0,1d1 be the set
(i,zi) i ?D List decoding For every z,
at most D2 of x have C(x) fall in (1/2 -?)D
hamming ball around z
19
Beating e-value expansion
Task Construct an graph on N of minimal
degree DEG s.t. every two sets of size K are
connected by an edge.
N
Any such graph DEG gt N/K Ramanujan
graphs DEG lt (N/K)2 Random graphs DEG lt
(N/K)1o(1) Extractors DEG lt
(N/K)1o(1) K linear in N and constant DEG
RVW Well see it for moderate K WZ
K
K
20
Extractors as graphs (again)
(k,.01)-extractor Ext 0,1n ? 0,1d
?0,1m 2k K M1o(1) Ext N x
D ? M 2d D lt Mo(1)

N
M
Take G Ext2 on N DEG lt (N/K)1o(1) Many
edges between any two K-sets X,X
21
Constructions
22
Expanders as extractors
Prerror lt 1/3
Thm Chernoff r1 r2. rt independent (tm
random bits)
Thm AKS r1 r2. rt random G-path (m O(t)
random bits)
then Prerror Prr1 r2. rt ?Bx gt
t/2 lt exp(-t)
23
Expanders as extractors (k large)
G expander graph of const degree on 0,1m B any
subset, dB/2m S r1 r2. rt a random
G-path (n m O(t) bits) Thm G Pr d -
S?B/t gt ? lt exp(-?2t) Thm Z tcm2d,
Ext 0,1n x 0,1d ? 0,1m
Ext(r1 r2. rt i) ri is an (k.99n,
?)extractor of dO(log n) seed
24
Condensers RR99,RSW00,TUZ01
X k-source of length n
Con
.99k-source of length k

• Sufficient to construct such condensers
• from here we can use Z extractor

25
Mergers T96
k k k
nks
X1 X2 XS
X
Mer
.9k-source
k

• Some block Xi is random.
• The other Xj are correlated arbitrarily with it.
• Mer outputs a high entropy distribution.

26
Mergers T96
Xi?Fqk q n100 Some Xi is random
LRVW Mer a1X1a2X2asXs ai?Fq (
dslog q ) Mer is a random element in the
subspace spanned by Xis D It works! (proof of
the Wolf conjecture). DW Mer
a1(y)X1a2(y)X2as(y)Xs y?Fq ( dlog q )
Mer is a random element in the curve through
the Xis
27
The proof
Deg(C) s-1
(Fq)k
B
B
C(x)
Mer(x)
Assume E C(X) ? B gt 2e B small
Prx C(x) ? Bgte gte
low deg Q(Fq)k ? Fq Q(B)? 0
? Prx Q(C(x)) ? 0 gte
? Pr Q(xi) ? 0 gte
? Q ? 0
28
Open Problems

• Find explicit extractors with
• Seed length d log n O(1).
• Output length m k d - O(1).
• Find explicit bipartite
• graph, of constant deg

29
Extractors as samplers
Given B ? 0,1m Estimate B/2m
X k-source of length n
Efficient!
m random bits
(upto ?)
Try all 2d poly(n) strings. Count the fraction
falls in B
Any set B ? 0,1m
WHP estimation error lt?