A Nearly Optimal Lower Bound on the Approximate Degree of AC$^0$

TL;DR

This paper introduces a method to significantly increase the approximate degree of AC$^0$ functions, nearly matching the trivial upper bound, and explores various applications including quantum communication complexity and secret sharing schemes.

Contribution

The authors develop a generic transformation that boosts the approximate degree of constant-depth circuits while preserving their computational class, leading to nearly optimal lower bounds for AC$^0$ functions.

Findings

Established an $ ilde{ ext{Omega}}(n)$ lower bound on approximate degree of AC$^0$ functions.

Derived applications in quantum communication complexity and secret sharing.

Improved previous lower bounds from $ ext{Omega}(n^{2/3})$ to nearly $ ext{Omega}(n)$.

Abstract

The approximate degree of a Boolean function $f \colon \{-1, 1\}^n \rightarrow \{-1, 1\}$ is the least degree of a real polynomial that approximates $f$ pointwise to error at most $1/3$. We introduce a generic method for increasing the approximate degree of a given function, while preserving its computability by constant-depth circuits. Specifically, we show how to transform any Boolean function $f$ with approximate degree $d$ into a function $F$ on $O(n \cdot \operatorname{polylog}(n))$ variables with approximate degree at least $D = \Omega(n^{1/3} \cdot d^{2/3})$. In particular, if $d= n^{1-\Omega(1)}$, then $D$ is polynomially larger than $d$. Moreover, if $f$ is computed by a polynomial-size Boolean circuit of constant depth, then so is $F$. By recursively applying our transformation, for any constant $\delta > 0$ we exhibit an AC$^0$ function of approximate degree $\Omega(n^{1-\delta})$. This improves over the best previous lower bound of $\Omega(n^{2/3})$ due to Aaronson and Shi (J. ACM 2004), and nearly matches the trivial upper bound of $n$ that holds for any function. Our lower bounds also apply to (quasipolynomial-size) DNFs of polylogarithmic width. We describe several applications of these results. We give: * For any constant $\delta > 0$, an $\Omega(n^{1-\delta})$ lower bound on the quantum communication complexity of a function in AC$^0$. * A Boolean function $f$ with approximate degree at least $C(f)^{2-o(1)}$, where $C(f)$ is the certificate complexity of $f$. This separation is optimal up to the $o(1)$ term in the exponent. * Improved secret sharing schemes with reconstruction procedures in AC$^0$.

Equations

$$({\psi }_f\star {\psi }_g)(x):=2^M\cdot {\psi }_f(\dots ,\mathrm{sgn}({\psi }_g(x_i)),\dots )\cdot \prod _{i=1}^M|{\psi }_g(x_i)|.$$

$$\bullet$$

$$g$$

$$\bullet$$

$$O(w\cdot {\log }^{2}n)$$

$$\text{SURJECTIVITY}:\{-1,1{\}}^n\to \{-1,1\}$$

$$y_{ij}(s)=\{\begin{array}{l}-1\text{ if }{s}_j=i\\ 1\text{ otherwise.}\end{array}$$

$${\text{SURJ}}_{N,R}(s)={\mathsf{AND}}_R({\mathsf{OR}}_N(y_{1,1},\dots ,y_{1,N}),\dots ,{\mathsf{OR}}_N(y_{R,1},\dots ,y_{R,N})).$$

$$p^{\ast }(y_{1,1},\dots ,y_{1,N},\dots ,y_{R,1},\dots ,y_{R,N})$$

$$F(s):=f({\mathsf{OR}}_N(y_{1,1},\dots ,y_{1,N}),\dots ,{\mathsf{OR}}_N(y_{R,1},\dots ,y_{R,N})).$$

$${\mathsf{OR}}_R({\mathsf{OR}}_N(y_{1,1},\dots ,y_{1,N}),\dots ,{\mathsf{OR}}_N(y_{R,1},\dots ,y_{R,N}))$$

$$g(s)=(f\circ {\mathsf{AND}}_{\log R})({\mathsf{OR}}_N(y_{1,1},\dots ,y_{1,N}),\dots ,{\mathsf{OR}}_N(y_{R^{\prime },1},\dots ,y_{R^{\prime },N})).$$

$$\sum _{|y|>N}|({\psi }_{\text{AND}}\star {\psi }_{\text{OR}})(y)|\ll R^{-D}.$$

$${\psi }_{\text{OR}}\text{ is supported only on inputs of Hamming weight at most }{R}^{1/3}.$$

$$\text{ For all }t\ge 0\text{, }\sum _{|x|=t}|{\psi }_{\text{OR}}(x)|\lesssim 1/(t+1{)}^2.$$

$$({\psi }_{\text{AND}}\star {\psi }_{\text{OR}})(y_1,\dots ,y_R)=2^R\cdot {\psi }_{\text{AND}}(\dots ,\mathrm{sgn}\left({\psi }_{\text{OR}}(y_i)\right),\dots )\cdot \prod _{i=1}^R|{\psi }_{\text{OR}}(y_i)|.$$

$$\sum _{x\in \mathcal{X}}\psi (x)\cdot f(x)>\epsilon ,$$

$$\sum _{x\in \mathcal{X}}|\psi (x)|=1,and$$

$$\text{ For every polynomial }p:\mathcal{X}\to \mathbb{R}\text{ of degree less than }d,\sum _{x\in \mathcal{X}}p(x)\cdot \psi (x)=0.$$

$$⟨{\psi }_1,{\psi }_2⟩:=\sum _{x\in \mathcal{X}}{\psi }_1(x)\cdot {\psi }_2(x),$$

$$⟨{\psi }_1,{\psi }_2⟩:=\sum _{x\in {\mathcal{X}}^{\prime }}{\psi }_1(x)\cdot {\psi }_2(x).$$

$$q(t)=\frac{1}{\left(\genfrac{}{}{0ex}{}{n}{t}\right)}\sum _{x\in \{-1,1{\}}^n:|x|=t}p(x)$$

$$(\Psi \star \psi )(x_1,\dots ,x_M)=2^M\cdot \Psi (\dots ,\mathrm{sgn}\left(\psi (x_i)\right),\dots )\cdot \prod _{i=1}^M|\psi (x_i)|.$$

$$\Vert \Psi \star \psi {\Vert }_1=1.$$

$$\mathrm{deg}q<D\cdot d⟹⟨\Psi \star \psi ,q⟩=0.$$

$$(\zeta \star \phi )\star \psi =\zeta \star (\phi \star \psi ).$$

$$x=(x_1,\dots ,x_{m_{\zeta }})=((x_{1,1},\dots ,x_{1,m_{\phi }}),\dots ,(x_{m_{\zeta },1},\dots ,x_{m_{\zeta },m_{\phi }})),$$

$$((\zeta$$

$$=2^{m_{\zeta }\cdot m_{\phi }}\cdot \left(2^{m_{\zeta }}\cdot \zeta (\dots ,\mathrm{sgn}\left(\phi (\dots ,\mathrm{sgn}\left(\psi (x_{i,j})\right),\dots )\right),\dots )\cdot \prod _{i=1}^{m_{\zeta }}|\phi (\dots ,\mathrm{sgn}\left(\psi (x_{i,j})\right),\dots )|\right)\cdot \prod _{i=1}^{m_{\zeta }}\prod _{j=1}^{m_{\phi }}|\psi (x_{i,j})|$$

$$=2^{m_{\zeta }}\cdot \zeta (\dots ,\mathrm{sgn}\left(\phi (\dots ,\mathrm{sgn}\left(\psi (x_{i,j})\right),\dots ),\dots \right)\cdot \prod _{i=1}^{m_{\zeta }}\left(2^{m_{\phi }}\cdot |\phi (\dots ,\mathrm{sgn}\left(\psi (x_{i,j})\right),\dots )|\prod _{j=1}^{m_{\phi }}|\psi (x_{i,j})|\right)$$

$$=2^{m_{\zeta }}\cdot \zeta (\dots ,\mathrm{sgn}\left(\left(\phi \star \psi \right)(x_i)\right),\dots )\cdot \prod _{i=1}^{m_{\zeta }}|(\phi \star \psi )(x_i)|$$

$$=(\zeta \star (\phi \star \psi ))(x_1,\dots ,x_{m_{\zeta }}).$$

$$⟨\Psi \star \psi ,{\mathsf{AND}}_M\circ f⟩\ge 1-(2/3{)}^M,$$

Full text

Specifically, we show how to transform any Boolean function $f$ with approximate degree $d$ into a function $F$ on $O(n\cdot\mathrm{polylog}(n))$ variables with approximate degree at least $D=\Omega(n^{1/3}\cdot d^{2/3})$. In particular, if $d=n^{1-\Omega(1)}$, then $D$ is polynomially larger than $d$. Moreover, if $f$ is computed by a polynomial-size Boolean circuit of constant depth, then so is $F$.

By recursively applying our transformation, for any constant $\delta>0$ we exhibit an AC0 function of approximate degree $\Omega(n^{1-\delta})$. This improves over the best previous lower bound of $\Omega(n^{2/3})$ due to Aaronson and Shi (J. ACM 2004), and nearly matches the trivial upper bound of $n$ that holds for any function. Our lower bounds also apply to (quasipolynomial-size) DNFs of polylogarithmic width.

We describe several applications of these results. We give:

• •

For any constant $\delta>0$, an $\Omega(n^{1-\delta})$ lower bound on the quantum communication complexity of a function in AC0.

• •

A Boolean function $f$ with approximate degree at least $C(f)^{2-o(1)}$, where $C(f)$ is the certificate complexity of $f$. This separation is optimal up to the $o(1)$ term in the exponent.

• •

Improved secret sharing schemes with reconstruction procedures in AC0.

1 Introduction

The $\varepsilon$-approximate degree of a Boolean function $f\colon\{-1,1\}^{n}\rightarrow\{-1,1\}$, denoted $\widetilde{\operatorname{deg}}_{\varepsilon}(f)$, is the least degree of a real polynomial that approximates $f$ pointwise to error at most $\varepsilon$. By convention, $\widetilde{\operatorname{deg}}(f)$ is used to denote $\widetilde{\operatorname{deg}}_{1/3}(f)$, and this quantity is referred to without qualification as the approximate degree of $f$. The choice of the constant $1/3$ is arbitrary, as $\widetilde{\operatorname{deg}}(f)$ is related to $\widetilde{\operatorname{deg}}_{\varepsilon}(f)$ by a constant factor for any constant $\varepsilon\in(0,1)$. Any Boolean function $f$ has an exact representation as a multilinear polynomial of degree at most $n$, so the approximate degree of $f$ is always at most $n$.

Approximate degree is a natural measure of the complexity of a Boolean function, with a wide variety of applications throughout theoretical computer science. For example, upper bounds on approximate degree underly many state-of-the-art learning algorithms [34, 35, 32, 45, 8, 33, 40], algorithmic approximations for the inclusion-exclusion principle [31, 48], and algorithms for differentially private data release [65, 22]. Very recently, approximate degree upper bounds have also been used to show new complexity-theoretic lower bounds. In particular, upper bounds on the approximate degree of Boolean formulae underly the best known lower bounds on the formula complexity and graph complexity of explicit functions [63, 62, 61].

Meanwhile, lower bounds on approximate degree have enabled significant progress in quantum query complexity [9, 2, 4], communication complexity [50, 16, 51, 28, 53, 43, 27, 23, 26, 47], circuit complexity [38, 49], oracle separations [11, 15], and secret-sharing [14]. In particular, approximate degree has been established as one of the most promising tools available for understanding the complexity of constant-depth Boolean circuits111In this paper, all circuits are Boolean and of polynomial size unless otherwise specified. (captured by the complexity class AC0). Indeed, approximate degree lower bounds lie at the heart of the best known bounds on the complexity of AC0 under measures such as sign-rank, discrepancy and margin complexity, Majority-of-Threshold and Threshold-of-Majority circuit size, and more.

Despite all of these applications, progress in understanding approximate degree has been slow and difficult. As noted by many authors, the following basic problem remains unresolved [18, 19, 21, 20, 10, 46, 57, 14].

Problem 1**.**

Is there a constant-depth circuit in $n$ variables with approximate degree $\Omega(n)$?

Prior to this work, the best result in this direction was Aaronson and Shi’s well-known $\Omega(n^{2/3})$ lower bound on the approximate degree of the Element Distinctness function ($\mathsf{ED}$ for short). In this paper, we nearly resolve Open Problem 1. Specifically, for any constant $\delta>0$, we exhibit an explicit constant-depth circuit $\mathcal{C}$ with approximate degree $\Omega(n^{1-\delta})$. Moreover, the circuit $\mathcal{C}$ that we exhibit has depth $O(\log(1/\delta))$. Our lower bound also applies to DNF formulae of polylogarithmic width (and quasipolynomial size).

Applications. We describe several consequences of the above results in complexity theory and cryptography. (Nevertheless, the list of applications we state here is not exhaustive.) We state these results somewhat informally in this introduction, leaving details to Section 5. Specifically:

• •

For any constant $\delta>0$, we obtain an $\Omega(n^{1-\delta})$ lower bounds on the quantum communication complexity of AC0. This nearly matches the trivial $O(n)$ upper bound that holds for any function.

• •

We exhibit a function $f$ with approximate degree at least $C(f)^{2-o(1)}$, where $C(f)$ is the certificate complexity of $f$. This separation is optimal up to the $o(1)$ term in the exponent. The previous best result was a power-7/6 separation, reported by Aaronson et al. [3].

• •

We give improved secret sharing schemes with reconstruction procedures in AC0.

While the first and third applications follow by combining our approximate degree lower bounds with prior works in a black box manner [50, 14], the second application requires some additional effort.

1.1 Prior Work on Approximate Degree

1.1.1 Early Results via Symmetrization

The notion of approximate degree was introduced in seminal work of Nisan and Szegedy [39], who proved a tight $\Omega(n^{1/2})$ lower bound on the approximate degree of the functions $\mathsf{OR}_{n}$ and $\mathsf{AND}_{n}$.222Whenever it is not clear from context, we use subscripts to denote the number of variables on which a function is defined. Nisan and Szegedy’s proof exploited a powerful technique known as symmetrization, which was introduced in the late 1960’s by Minsky and Papert [38]. Until recently, symmetrization was the primary tool available for proving approximate degree lower bounds [5, 41, 4, 11, 45, 42].

Symmetrization arguments proceed in two steps. First, a polynomial $p$ on $n$ variables (which is assumed to approximate the target function $f$) is transformed into a univariate polynomial $q$ in such a way that $\deg(q)\leq\deg(p)$. Second, a lower bound on $\deg(q)$ is proved, using techniques tailored to the analysis of univariate polynomials.

Although powerful, symmetrization is inherently lossy: by turning a polynomial $p$ on $n$ variables into a univariate polynomial $q$, information about $p$ is necessarily thrown away. Hence, several works identified the development of non-symmetrization techniques for lower bounding the approximate degree of Boolean functions as an important research direction (e.g., [1, 54, 47]). A relatively new such lower-bound technique called the method of dual polynomials plays an essential role in our paper.

1.2 The Method of Dual Polynomials and the AND-OR Tree

A dual polynomial is a dual solution to a certain linear program capturing the approximate degree of any function. These polynomials act as certificates of the high approximate degree of a function. Strong LP duality implies that the technique is lossless, in contrast to symmetrization. That is, for any function $f$ and any $\varepsilon$, there is always some dual polynomial $\psi$ that witnesses a tight $\varepsilon$-approximate degree lower bound for $f$.

A dual polynomial that witnesses the fact that $\widetilde{\operatorname{deg}}_{\varepsilon}(f_{n})\geq d$ is a function $\psi\colon\{-1,1\}^{n}\to\{-1,1\}$ satisfying three properties:

• •

$\sum_{x\in\{-1,1\}^{n}}\psi(x)\cdot f(x)>\varepsilon$. If $\psi$ satisfies this condition, it is said to be well-correlated with $f$.

• •

$\sum_{x\in\{-1,1\}^{n}}|\psi(x)|=1$. If $\psi$ satisfies this condition, it is said to have $\ell_{1}$-norm equal to 1.

• •

For all polynomials $p\colon\{-1,1\}^{n}\to\mathbb{R}$ of degree less than $d$, we have $\sum_{x\in\{-1,1\}^{n}}p(x)\cdot\psi(x)=0$. If $\psi$ satisfies this condition, it is said to have pure high degree at least $d$.

One success story for the method of dual polynomials is the resolution of the approximate degree of the two-level AND-OR tree. For many years, this was the simplest function whose approximate degree resisted characterization by symmetrization methods  [39, 58, 5, 54]. Given two functions $f_{M},g_{N}$, let $f\circ g\colon\{-1,1\}^{M\cdot N}\to\{-1,1\}$ denote their block composition, i.e., $f\circ g=f(g,\dots,g)$.

Theorem 1**.**

The approximate degree of the function $\mathsf{AND}_{M}\circ\mathsf{OR}_{N}$ is $\Theta(\sqrt{M\cdot N})$.

Ideas pertaining to both the upper and lower bounds of Theorem 1 will be useful to understanding the results in this paper. The upper bound of Theorem 1 was established by Høyer, Mosca, and de Wolf [30], who designed a quantum query algorithm to prove that $\widetilde{\operatorname{deg}}(\mathsf{AND}_{M}\circ\mathsf{OR}_{N})=O(\sqrt{MN})$. Later, Sherstov [55] proved the following more general result.

Theorem 2** (Sherstov [55]).**

For any Boolean functions $f,g$, we have $\widetilde{\operatorname{deg}}(f\circ g)=O(\widetilde{\operatorname{deg}}(f)\cdot\widetilde{\operatorname{deg}}(g))$.

Sherstov’s remarkable proof of Theorem 2 is via a technique we call robustification. This approximation technique will be an important source of intuition for our new results.

Robustification.

Sherstov [55] showed that for any polynomial $p\colon\{-1,1\}^{M}\to\{-1,1\}$, and every $\delta>0$, there is a polynomial $p_{\text{robust}}$ of degree $O(\deg(p)+\log(1/\delta))$ that is robust to noise in the sense that $|p(y)-p_{\text{robust}}(y+\textbf{e})|<\delta$ for all $y\in\{-1,1\}^{M}$, and $\mathbf{e}\in[-1/3,1/3]^{M}$. Hence, given functions $f_{M},g_{N}$, one can obtain an $(\varepsilon+\delta)$-approximating polynomial for the block composition $f_{M}\circ g_{N}$ as follows. Let $p$ be an $\varepsilon$-approximating polynomial for $f_{M}$, and $q$ a $(1/3)$-approximating polynomial for $g_{N}$. Then the block composition $p^{*}:=p_{\text{robust}}(q,\dots,q)$ is an $(\varepsilon+\delta)$- approximating polynomial for $f_{M}\circ g_{N}$. Notice that the degree of $p^{*}$ is at most the product of the degrees of $p_{\text{robust}}$ and $q$.

Sherstov [52] and the authors [17] independently used the method of dual polynomials to obtain the matching $\Omega(\sqrt{M\cdot N})$ lower bound of Theorem 1. These lower bound proofs work by constructing (explicitly in [17] and implicitly in [52]) an optimal dual polynomial $\psi_{\text{AND-OR}}$ for the AND-OR tree. Specifically, $\psi_{\text{AND-OR}}$ is obtained by taking dual polynomials $\psi_{\text{AND}},\psi_{\text{OR}}$ respectively witnessing the fact that $\widetilde{\operatorname{deg}}(\mathsf{AND}_{M})=\Omega(\sqrt{M})$ and $\widetilde{\operatorname{deg}}(\mathsf{OR}_{N})=\Omega(\sqrt{N})$, and combining them in a precise manner.

For arbitrary Boolean functions $f$ and $g$, this method of combining dual polynomials $\psi_{f}$ and $\psi_{g}$ to obtain a dual polynomial $\psi_{f}\star\psi_{g}$ for $f\circ g$ was introduced in earlier line of work by Shi and Zhu [59], Lee [36] and Sherstov [54]. Specifically, writing $x=(x_{1},\dots,x_{M})\in\left(\{-1,1\}^{N}\right)^{M}$,

[TABLE]

This technique of combining dual witnesses, which we call the “dual block” method, will also be central to this paper. The lower bound of [52, 17] was obtained by refining the analysis of $\psi_{f}\star\psi_{g}$ from [54] in the case where $f=\mathsf{AND}_{M}$ and $g=\mathsf{OR}_{N}$.

As argued in subsequent work of Thaler [64, Section 1.2.4], the combining method $\psi_{f}\star\psi_{g}$ is specifically tailored to showing optimality of the polynomial approximation $p^{*}$ for $f\circ g$ obtained via robustification. This assertion can be made precise via complementary slackness: the dual solution $\psi_{f}\star\psi_{g}$ can be shown to obey complementary slackness in an approximate (yet precise) sense with respect to the solution to the primal linear program corresponding to $p^{*}$.

1.2.1 Additional Prior Work

The method of dual polynomials has recently been used to establish a number of new lower bounds for approximate degree [40, 64, 54, 56, 18, 24, 15]. All of these results focus on block composed functions, and can be viewed as hardness amplification results. Specifically, they show that the block composition $f\circ g$ is strictly harder to approximate by low-degree polynomials (requiring either higher degree or higher error) than either $f$ or $g$ individually. These results have enabled progress on a number of open questions regarding the complexity of AC0, as well as oracle separations involving the polynomial hierarchy and various notions of statistical zero-knowledge proofs.

Recently, a handful of works have proved stronger hardness amplification results for approximate degree by moving beyond block composed functions [19, 42]. These papers use very different techniques than the ones we introduce in this work, as they are focused on a different form of hardness amplification for polynomial approximation (specifically, they amplify approximation error instead of degree).

1.3 Our Results and Techniques

A major technical hurdle to progress on Problem 1 is the need to go beyond the block composed functions that were the focus of prior work. Specifically, Theorem 2 implies that the approximate degree of $f_{M}\circ g_{N}$ (viewed as a function of the number of inputs $M\cdot N$) is never higher than the approximate degree of $f_{M}$ or $g_{N}$ individually (viewed as a function of $M$ and $N$ respectively). For example, if $f_{M}$ and $g_{N}$ both have approximate degree equal to the square root of the number of inputs (i.e., $\widetilde{\operatorname{deg}}(f_{M})=O(\sqrt{M})$ and $\widetilde{\operatorname{deg}}(g_{N})=O(\sqrt{N})$), then the block composition $f_{M}\circ g_{N}$ has the same property (i.e., $\widetilde{\operatorname{deg}}(f_{M}\circ g_{N})=O(\sqrt{M\cdot N})$). Our results introduce an analysis of non-block-composed functions that overcomes this hurdle.

Quantitatively, our main lower bounds for constant-depth circuits and DNFs are as follows. To obtain the tightest possible results for a given circuit depth, our analysis pays close attention to whether a circuit $\mathcal{C}$ is monotone ($\mathcal{C}$ is said to be monotone if it contains no $\mathsf{NOT}$ gates).

Theorem 3**.**

Let $k\geq 1$ be any constant integer. Then there is an (explicitly given) monotone circuit on $n\cdot\log^{4k-4}(n)$ variables of depth $2k$, with $\mathsf{AND}$ gates at the bottom, which computes a function with approximate degree $\Omega(n^{1-2^{k-1}/3^{k}}\cdot\log^{3-2^{k+2}/3^{k}}(n))$.

For example, Theorem 3 implies a Boolean circuit of depth $6$ on $n$ variables with approximate degree $\tilde{\Omega}(n^{23/27})=\tilde{\Omega}(n^{0.851...})$.

Theorem 4**.**

Let $k\geq 1$ be any constant integer. Then there is an (explicitly given) monotone DNF on $n\cdot\log^{4k-4}(n)$ variables of width $O\left(\log^{2k-1}(n)\right)$ (and size $2^{O(\log^{2k}(n))}$) which computes a function with approximate degree $\Omega(n^{1-2^{k-1}/3^{k}}\cdot\log^{3-2^{k+2}/3^{k}}(n))$.

Theorems 3 and 4 are in fact corollaries of a more general hardness amplification theorem. This result shows how to take any Boolean function $f$ and transform it into a related function $g$ on roughly the same number of variables that has significantly higher approximate degree (unless the approximate degree of $f$ is already $\tilde{\Omega}(n)$). Moreover, if $f$ is computed by a low-depth circuit, then $g$ is as well.

Theorem 5**.**

Let $f\colon\{-1,1\}^{n}\to\{-1,1\}$ with $\widetilde{\operatorname{deg}}(f)=d$. Then $f$ can be transformed into a related function $g\colon\{-1,1\}^{m}\rightarrow\{-1,1\}$ with $m=O(n\log^{4}n)$ and $\widetilde{\operatorname{deg}}(g)=\Omega(n^{1/3}\cdot d^{2/3}\cdot\log n).$ Moreover, $g$ satisfies the following additional properties.

[TABLE]

1.3.1 Hardness Amplification Construction

The goal of this subsection is to convey the main ideas underlying the transformation of $f$ into the harder-to-approximate function $g$ in the statement of Theorem 5. We focus on illustrating these ideas when we start with the function $f=\mathsf{AND}_{R}$, where we assume for simplicity that $R$ is a power of $2$. Let $n=N\log R$ for a parameter $N$ to be determined later.333All logarithms in this paper are taken in base $2$. Consider the function

[TABLE]

(SURJN,R for short) defined as follows. SURJN,R interprets its input $s$ as a list of $N$ numbers $(s_{1},\dots,s_{N})$ from a range $[R]$. The function SURJ${}_{N,R}(s)=-1$ if and only if every element of the range $[R]$ appears at least once in the list.444As is standard, we associate $-1$ with logical TRUE and $+1$ with logical FALSE throughout.

When we apply Theorem 5 to $f=\mathsf{AND}_{R}$, the harder function $g$ we construct is precisely $\mathsf{SURJ}_{N,R}$ (for a suitable choice of $N\leq\tilde{O}(R)$). Before describing our transformation for general $f$, we provide some intuition for why $\mathsf{SURJ}_{N,R}$ is harder to approximate than $\mathsf{AND}_{R}$.

Getting to Know SURJECTIVITY.

It is known that $\widetilde{\operatorname{deg}}(\textsf{SURJ}_{N,R})=\tilde{\Omega}(n^{2/3})$ when $R=N/2$ [4]. We do not improve this lower bound for $\textsf{SURJ}_{N,R}$, but we give a much more general and intuitive proof for it. The best known upper bound on $\widetilde{\operatorname{deg}}(\textsf{SURJ}_{N,R})$ is the trivial $O(n)$ that holds for any function on $n$ variables.

Although this upper bound is trivial, the following is an instructive way to achieve it. For $(i,j)\in[R]\times[N]$, let555We clarify that earlier work [5] using similar notation reverses the roles of $i$ and $j$ in the definition of $y_{ij}(s)$. We depart from the convention of earlier work because it simplifies the expression of the harder function $g$ exhibited in Theorem 5.

[TABLE]

Observe that $y_{ij}(s)$ is exactly computed by a polynomial in $s$ of degree at most $\log R$, as $y_{ij}(s)$ depends on only $\log R$ bits of $s$. For brevity, we will typically denote $y_{ij}(s)$ by $y_{ij}$, but the reader should always bear in mind that $y_{ij}$ is a function of $s$.

Clearly, it holds that:

[TABLE]

Equality (4) is depicted in Figure 1 in the special case $N=6,R=3$. Let $p^{*}$ be the polynomial approximation of degree $O(\sqrt{R\cdot N})$ for the block composed function $\mathsf{AND}_{R}\circ\mathsf{OR}_{N}$ obtained via robustification (cf. Section 1.2). Then

[TABLE]

approximates $\textsf{SURJ}_{N,R}$, and has degree $O(\deg(p^{*})\cdot\log R)$. If $N=O(R)$, then this degree bound is $O(N\log R)=O(n)$.

Our analysis in the proof of Theorem 5 is tailored to showing a sense in which this robustification-based approximation method is nearly optimal. Unsurprisingly, our analysis makes heavy use of the dual block method of combining dual witnesses [59, 36, 54], as this method is tailored to showing optimality of robustification-based approximations (cf. Section 1.2). However, there are several technical challenges to overcome, owing to the fact that Equation (4) does not express $\mathsf{SURJ}$ as a genuine block composition (since a single bit of the input $s\in\{-1,1\}^{N\cdot\log R}$ affects $R$ of the variables $y_{ij}$).

The Transformation for General Functions. Recall from the preceding discussion that when applying our hardness-amplifying transformation to the function $f=\mathsf{AND}_{R}$, the harder function (on $n=N\cdot\log R$ bits, for some $N=\tilde{O}(R)$) takes the form $\mathsf{SURJ}_{N,R}=\mathsf{AND}_{R}(\mathsf{OR}_{N}(y_{1,1},\dots,y_{1,N}),\dots,\mathsf{OR}_{N}(y_{R,1}\dots,y_{R,N}))$. This suggests that for general functions $f\colon\{-1,1\}^{R}\to\{-1,1\}$, one should consider the transformed function

[TABLE]

Unfortunately, this simple candidate fails spectacularly. Consider the particular case where $f=\mathsf{OR}_{R}$. It is easy to see that

[TABLE]

evaluates to $-1$ on all inputs $s\in\{-1,1\}^{N\cdot\log R}$. Hence, it has (exact) degree equal to 0.

Fortunately, we are able to show that a modification of the above candidate does work for general functions $f_{R}$. Let $R^{\prime}=R\log R$. Still simplifying, but only slightly, the harder function that we exhibit is $g\colon\{-1,1\}^{N\cdot\log(R^{\prime})}\to\{-1,1\}$ defined via:

[TABLE]

1.3.2 Hardness Amplification Analysis

For expository purposes, we again describe the main ideas of our analysis in the case where $f=\mathsf{AND}_{R}$. Recall that in this case, the harder function $g$ exhibited in Theorem 5 is SURJN,R on $n=N\cdot\log R$ bits. Moreover, in order to approximate $\textsf{SURJ}_{N,R}$, it is sufficient to approximate the block composed function $\mathsf{AND}_{R}\circ\mathsf{OR}_{N}$. This can be done by a polynomial of degree $O(\sqrt{R\cdot N})$ using robustification.

The goal of our analysis is to show that there is a sense in which this approximation method for SURJN,R is essentially optimal. Quantitatively, our analysis yields an $\Omega(R^{2/3})$ lower bound on the approximate degree of SURJN,R.

At a high level, our analysis proceeds in two stages. In the first stage (Section 3), we give a reduction showing that to approximate $\textsf{SURJ}_{N,R}(x)$, it is necessary to approximate $\mathsf{AND}_{R}\circ\mathsf{OR}_{N}$, under the promise that the input has Hamming weight at most $N$. This reduction is somewhat subtle, but conceptually crucial to our results. Nevertheless, at the technical level, it is a straightforward application of a symmetrization argument due to Ambainis [5].

In the second stage (Section 4), we prove that approximating $\mathsf{AND}_{R}\circ\mathsf{OR}_{N}$ under the above promise requires degree $\Omega(R^{2/3})$. Executing this second stage is the more technically involved part of our proof, and we devote the remainder of this informal overview to it. Specifically, for some $N=\tilde{O}(R)$, we must construct a dual polynomial $\psi_{\text{AND-OR}}$ witnessing the fact that $\widetilde{\operatorname{deg}}(\mathsf{AND}_{R}\circ\mathsf{OR}_{N})=\Omega(R^{2/3})$, such that $\psi_{\text{AND-OR}}$ is supported exclusively on inputs of Hamming weight at most $N$.

As a first attempt, one could consider the dual polynomial $\psi_{\text{AND}}\star\psi_{\text{OR}}$ (cf. Section 1.2) used in our prior work [17] to lower bound the approximate degree of the AND-OR tree. Unfortunately, this dual polynomial has inputs of Hamming weight as large as $\Omega(R\cdot N)$ in its support.

Our strategy for handling this issue is to modify $\psi_{\text{AND}}\star\psi_{\text{OR}}$ by post-processing it to zero out all of the mass it places on inputs of Hamming weight more than $N$. This must be done without significantly affecting its pure high degree, its $\ell_{1}$-norm, or its correlation with $\mathsf{AND}_{R}\circ\mathsf{OR}_{N}$. In more detail, let $|y|$ denote the Hamming weight of an input $y\in\{-1,1\}^{R\cdot N}$, and suppose that we can show

[TABLE]

Intuitively, if Inequality (5) holds for a large value of $D$, then inputs of Hamming weight greater than $N$ are not very important to the dual witness $\psi_{\text{AND}}\star\psi_{\text{OR}}$, and hence it is plausible that the lower bound witnessed by $\psi_{\text{AND}}\star\psi_{\text{OR}}$ holds even if such inputs are ignored completely.

To make the above intuition precise, we use a result of Razborov and Sherstov [44] to establish that Inequality (5) implies the existence of a (explicitly given) function $\psi_{\text{corr}}\colon\{-1,1\}^{N\cdot R}\to\{-1,1\}$ such that:

• •

$\psi_{\text{corr}}(y)=\psi_{\text{AND}}\star\psi_{\text{OR}}(y)$ for all $|y|>N$,

• •

$\psi_{\text{corr}}$ has pure high degree $D$, and

• •

$\sum_{|y|>N}|\psi_{\text{corr}}(y)|\ll R^{-D}$.

Let $\psi_{\text{AND-OR}}=C\cdot\left(\psi_{\text{AND}}\star\psi_{\text{OR}}-\psi_{\text{corr}}\right)$, where $C\geq 1-o(1)$ is chosen so that the resulting function has $\ell_{1}$-norm equal to $1$. Then $\psi_{\text{AND-OR}}$ has:

Pure high degree $\min\{D,\sqrt{R\cdot N}\}$, 2. 2.

The same correlation, up to a factor of $1-o(1)$, as $\psi_{\text{AND}}\star\psi_{\text{OR}}$ has with $\mathsf{AND}_{R}\circ\mathsf{OR}_{N}$, and 3. 3.

Support restricted to inputs of Hamming weight at most $N$.

Hence, Step 2 of the proof is complete if we can show that Inequality (5) holds for $D=\Omega(R^{2/3})$. Unfortunately, Inequality (5) does not hold unless we modify the dual witness $\psi_{\text{OR}}$ to satisfy additional properties. First, we modify $\psi_{\text{OR}}$ so that

[TABLE]

Moreover, we further ensure that $\psi_{\text{OR}}$ is biased toward inputs of low Hamming weight in the sense that

[TABLE]

We can guarantee that both Conditions (6) and (7) hold while still ensuring that $\psi_{\text{OR}}$ has pure high degree $\Omega(R^{1/6})$, as well as the same $\ell_{1}$-norm and correlation with $\mathsf{OR}_{N}$. (The fact that this modified dual polynomial $\psi_{\text{OR}}$ has pure high degree $\Omega(R^{1/6})$ rather than $\Omega(R^{1/2})$ is the reason we are only able to establish an $\Omega(R^{2/3})$ lower bound on the approximate degree of $\mathsf{SURJ}_{N,R}$, rather than $\Omega(R)$.)

We now explain why these modifications imply that Inequality (5) holds for $D=\Omega(R^{2/3})$. Recall that

[TABLE]

For intuition, let us focus on the final factor in this expression, $\prod_{i=1}^{R}|\psi_{\text{OR}}(y_{i})|$. Since $\psi_{\text{OR}}$ has $\ell_{1}$-norm equal to 1, the function $|\psi_{\text{OR}}|$ is a probability distribution, and $\prod_{i=1}^{R}|\psi_{\text{OR}}(y_{i})|$ is a product distribution over $\left(\{-1,1\}^{N}\right)^{R}$. At a high level, our analysis shows that this product distribution is “exponentially more biased” toward inputs of low Hamming weight than is $\psi_{\text{OR}}$ itself.

More specifically, Conditions (6) and (7) together imply that, if $y=(y_{1},\dots,y_{R})\in\{-1,1\}^{N\cdot R}$ is drawn from the product distribution $\prod_{i=1}^{R}|\psi_{\text{OR}}(y_{i})|$, then the probability that $y$ has Hamming weight more than $N=\tilde{O}(R)$ is dominated by the probability that roughly $R^{2/3}$ of the $y_{i}$’s each have Hamming weight close to $R^{1/3}$ (and the remaining $y_{i}$’s have low Hamming weight). But then Condition (7) ensures that the probability that this occurs is at most $R^{-\Omega(R^{2/3})}$.

1.4 Paper Organization

Section 2 covers technical preliminaries. Stage 1 of the proof of our main hardness amplification theorem, Theorem 5, is completed in Section 3. In Section 4, we execute Stage 2 of the proof of Theorem 5, and use it to establish Theorems 3 and 4 from the introduction. Finally, Section 5 describes applications of our results to complexity theory and cryptography.

2 Preliminaries

We begin by formally defining the notion of approximate degree of any partial function defined on a subset of $\mathbb{R}^{n}$. Throughout, for any subset $\mathcal{X}\subseteq\mathbb{R}^{n}$ and polynomial $p\colon\mathcal{X}\to\mathbb{R}$, we use $\deg(p)$ to denote the total degree of $p$, and refer to this without qualification as the degree of $p$.

Definition 6**.**

Let $\mathcal{X}\subseteq\mathbb{R}^{n}$, and let $f:\mathcal{X}\to\{-1,1\}$. The $\varepsilon$-approximate degree of $f$, denoted $\widetilde{\operatorname{deg}}_{\epsilon}(f)$, is the least degree of a real polynomial $p\colon\mathbb{R}^{n}\to\mathbb{R}$ such that $|p(x)-f(x)|\leq\epsilon$ for all $x\in\mathcal{X}$. We refer to such a $p$ as an $\varepsilon$-approximating polynomial for $f$. We use $\widetilde{\operatorname{deg}}(f)$ to denote $\widetilde{\operatorname{deg}}_{1/3}(f)$.

We highlight two slightly non-standard aspects of Definition 6. The first is that it considers subsets of $\mathbb{R}^{n}$ rather than $\{-1,1\}^{n}$. This level of generality has been considered in some prior works [54, 21, 5], and we will require it in our proof of Theorem 5 (cf. Section 3). Second, our definition of an $\varepsilon$-approximating polynomial $p$ for $f$ above does not place any restriction on $p(x)$ for $x$ outside of the domain of $f$. This is in contrast to some other works (e.g. [15, 28, 20, 53]) that do require $p(x)$ to be bounded for some inputs $x$ outside of the domain of $f$. Our definition is the most natural and convenient for the purposes of our analyses.

Strong LP duality implies the following characterization of approximate degree (see, e.g., [50]).

Theorem 7**.**

Let $\mathcal{X}$ be a finite subset of $\mathbb{R}^{n}$, and let $f:\mathcal{X}\to\{-1,1\}$. Then $\widetilde{\operatorname{deg}}_{\varepsilon}(f)\geq d$ if and only if there exists a function $\psi\colon\mathcal{X}\to\mathbb{R}$ satisfying the following properties.

[TABLE]

[TABLE]

[TABLE]

For functions $\psi_{1}\colon\mathcal{X}\to\mathbb{R}$ and $\psi_{2}\colon\mathcal{X}^{\prime}\to\mathbb{R}$ defined on finite domains $\mathcal{X},\mathcal{X}^{\prime}$ with $\mathcal{X}\subseteq\mathcal{X}^{\prime}$, we define

[TABLE]

and we refer to this as the correlation of $\psi_{1}$ with $\psi_{2}$. (We define $\langle\psi_{1},\psi_{2}\rangle$ similarly if instead $\mathcal{X}^{\prime}\subseteq\mathcal{X}$.) An equivalent way to define $\langle\psi_{1},\psi_{2}\rangle$ is to first extend the domain of $\psi_{1}$ to $\mathcal{X}^{\prime}$ by setting $\psi_{1}(x)=0$ for all $x\in\mathcal{X}^{\prime}\setminus\mathcal{X}$, and then define

[TABLE]

We refer to the right hand side of Equation (9) as the $\ell_{1}$-norm of $\psi$, and denote this quantity by $\|\psi\|_{1}$. If $\psi$ satisfies Equation (10), it is said to have pure high degree at least $d$.

Additional Notation. For an input $x\in\{-1,1\}^{n}$, we use $|x|$ to denote the Hamming weight of $x$, i.e., $|x|:=\sum_{i=1}^{n}(1-x_{i})/2$. Let $\{-1,1\}^{N}_{\leq k}:=\{x\in\{-1,1\}^{N}:|x|\leq k\}$. We denote the set $\{1,\dots,N\}$ by $[N]$ and the set $\{0,\dots,N\}$ by $[N]_{0}$. Given $t\in\mathbb{R}$, we define $\operatorname{sgn}(t)$ to equal $1$ if $t>0$ and to equal $-1$ otherwise. The function $\mathbf{1}_{N}\colon\{-1,1\}^{N}\to\{-1,1\}$ denotes the constant function that always evaluates to 1. We denote by $1^{N}$ the $N$-dimensional vector with all entries equal to $1$.

Minsky-Papert Symmetrization. The following well-known lemma is due to Minsky and Papert [38].

Lemma 8**.**

Let $p\colon\{-1,1\}^{n}\to\{-1,1\}$ be an arbitrary polynomial. Then there is a univariate polynomial $q\colon\mathbb{R}\to\mathbb{R}$ of degree at most $\deg(p)$ such that

[TABLE]

for all $t\in[n]_{0}$.

2.1 The Dual Block Method

This section collects definitions and preliminary results on the dual block method [59, 36, 54] for constructing dual witnesses for a block composed function $F\circ f$ by combining dual witnesses for $F$ and $f$ respectively.

Definition 9**.**

Let $\Psi:\{-1,1\}^{M}\to\mathbb{R}$ and $\psi:\{-1,1\}^{m}\to\mathbb{R}$ be functions that are not identically zero. Let $x=(x_{1},\dots,x_{M})\in\left(\{-1,1\}^{m}\right)^{M}$. Define the dual block composition of $\Psi$ and $\psi$, denoted $\Psi\star\psi:(\{-1,1\}^{m})^{M}\to\mathbb{R}$, by

[TABLE]

Proposition 10**.**

The dual block composition satisfies the following properties:

Preservation of $\ell_{1}$-norm:

If $\|\Psi\|_{1}=1$ and $\|\psi\|_{1}=1$, then

[TABLE]

Multiplicativity of pure high degree:

If $\langle\Psi,P\rangle=0$ for every polynomial $P\colon\{-1,1\}^{M}\to\{-1,1\}$ of degree less than $D$, and $\langle\psi,p\rangle=0$ for every polynomial $p\colon\{-1,1\}^{m}\to\{-1,1\}$ of degree less than $d$, then for every polynomial $q\colon\{-1,1\}^{m\cdot M}\to\{-1,1\}$,

[TABLE]

Associativity:

For every $\zeta:\{-1,1\}^{m_{\zeta}}\to\mathbb{R}$, $\varphi:\{-1,1\}^{m_{\varphi}}\to\mathbb{R}$, and $\psi:\{-1,1\}^{m_{\psi}}\to\mathbb{R}$, we have

[TABLE]

Proof.

Properties (11) and (12) appear in [54, Proof of Theorem 3.3]. Proving that Property (13) holds is a straightforward if tedious calculation that we now perform. Below, we will write an input

[TABLE]

where each $x_{i,j}\in\{-1,1\}^{m_{\psi}}$. We expand

[TABLE]

∎

The following proposition identifies conditions under which a dual witness $\psi$ for the large $(1/3)$-approximate degree of a function $f$ can be transformed, via dual block composition with a certain function $\Psi\colon\{-1,1\}^{M}\to\{-1,1\}$, into a dual witness for the large $(1-2^{-\Omega(M)})$-approximate degree of the block composition $\mathsf{AND}_{M}\circ f$.

Proposition 11** (Bun and Thaler [18]).**

Let $m,M\in\mathbb{N}$. There exists a function $\Psi:\{-1,1\}^{M}\to\mathbb{R}$ with the following properties. Let $f:\{-1,1\}^{m}\to\{-1,1\}$ be any function. Let $\psi:\{-1,1\}^{m}\to\mathbb{R}$ be any function such that $\langle\psi,f\rangle\geq 1/3$, $\|\psi\|_{1}=1$, and $\psi(x)\geq 0$ whenever $f(x)=1$. Then

[TABLE]

[TABLE]

[TABLE]

The following proposition roughly states that if $\psi$ and $\Psi$ are dual polynomials that are well-correlated with $f$ and $F$ respectively, then the dual block composition $\Psi\star\psi$ is well-correlated with the block composed function $F\circ f$. There is, however, a potential loss in correlation that is proportional to the number of variables on which $F$ is defined.

Proposition 12** (Sherstov [54]).**

Let $f:\{-1,1\}^{m}\to\{-1,1\}$ and $F\colon\{-1,1\}^{M}\to\{-1,1\}$, and let $\varepsilon,\delta>0$. Let $\psi\colon\{-1,1\}^{m}\to\{-1,1\}$ be a function with $\|\psi\|_{1}=1$ and $\langle\psi,f\rangle\geq 1-\delta$. Let $\Psi\colon\{-1,1\}^{M}\to\{-1,1\}$ be a function with $\|\Psi\|_{1}=1$ and $\langle\Psi,F\rangle\geq\varepsilon$. Then

[TABLE]

3 Connecting Symmetric Properties and Block Composed Functions

In this section, we execute Stage 1 of our program for proving our main hardness amplification theorem, Theorem 5. Throughout this entire section, fix an arbitrary function $F_{R}:\{-1,1\}^{R}\to\{-1,1\}$. (In order to prove Theorem 5, we will ultimately set $R=10\cdot n\cdot\log n$, and take $F_{R}=f\circ\mathsf{AND}_{10\log n}$ for $f:\{-1,1\}^{n}\to\{-1,1\}$.)

Our analysis relies on several intermediate functions, which we now define and analyze. All of these functions are variants of the function $F_{R}\circ\mathsf{OR}_{N}$.

3.1 The First Function: Block Composition Under a Promise

We define a promise variant of the function $F_{R}\circ\mathsf{OR}_{N}$ as follows.

Definition 13**.**

Fix positive numbers $N$ and $R$. Recall that $\{-1,1\}^{N\cdot R}_{\leq N}$ denotes the subset of $\{-1,1\}^{N\cdot R}$ consisting of vectors of Hamming weight at most $N$. Define $G^{\leq N}$ to be the partial function obtained from $F_{R}\circ\mathsf{OR}_{N}$ by restricting its domain to $\{-1,1\}^{N\cdot R}_{\leq N}$.

Our goal is to reduce establishing Theorem 5 to establishing a lower bound on the approximate degree of $G^{\leq N}$. Specifically, we prove the following theorem relating the approximate degree of $G^{\leq N}$ to that of a function $g$ which is not much more complex than $F_{R}$:

Theorem 14**.**

*Let $G^{\leq N}\colon\{-1,1\}_{\leq N}^{N\cdot R}\to\{-1,1\}$ be as in Definition 13. There exists a function

$g\colon\{-1,1\}^{12\cdot N\cdot\lceil\log(R+1)\rceil}\to\{-1,1\}$ such that*

[TABLE]

Moreover:

[TABLE]

3.2 The Second Function: A Property of Evaluation Tables

Consider a vector $s=(s_{1},\dots,s_{N})\in[R]_{0}^{N}$. Observe that $s$ can be thought of as the evaluation table of a function $f_{s}\colon[N]\to[R]_{0}$ defined via $f_{s}(i)=s_{i}$. The second function $G^{\operatorname{prop}}$ that we define (cf. Definition 16 below) can be thought of as a property of such a function $f_{s}$.

In order to define $G^{\operatorname{prop}}$, it is useful to describe such a function $f_{s}$ as follows.

Definition 15**.**

Fix any $s\in[R]_{0}^{N}$. For $(i,j)\in[R]_{0}\times[N]$, define $Y(s)=(\dots,Y_{ij}(s),\dots)\in\left(\{-1,1\}^{N}\right)^{R+1}$ where

[TABLE]

Observe that any vector $y=(\dots,y_{ij},\dots)\in\left(\{-1,1\}^{N}\right)^{R+1}$ equals $Y(s)$ for some $s\in[N]^{R+1}$ if and only if $y$ satisfies the following condition:

[TABLE]

Accordingly, the domain of our second function $G^{\operatorname{prop}}$ is the subset of $\left(\{-1,1\}^{N}\right)^{R+1}$ satisfying Condition (21).

Definition 16**.**

Let $\mathcal{D}_{N,R}$ be the subset of $\left(\{-1,1\}^{N}\right)^{R+1}$ of vectors satisfying Condition (21). We refer to any function from $\mathcal{D}_{N,R}$ to $\{-1,1\}$ as a property of functions $[N]\to[R]_{0}$. Define the property $G^{\operatorname{prop}}\colon\mathcal{D}_{N,R}\to\{-1,1\}$ via: $G^{\operatorname{prop}}(y_{0},y_{1},\dots,y_{R}):=F_{R}(\mathsf{OR}_{N}(y_{1}),\dots,\mathsf{OR}_{N}(y_{R})).$

One may view $G^{\operatorname{prop}}$ as a property of functions $f_{s}\colon[N]\to[R]_{0}$ as follows. The property $G^{\operatorname{prop}}$ first obtains a vector of $R$ bits $(b_{1},\dots,b_{R})$, one for each of the $R$ non-zero range items $1,\dots,R$, and then feeds these bits into $F_{R}$. Here, the bit $b_{i}$ for range item $i$ is obtained by testing whether $i$ appears in the image of $f_{s}$ (any occurrences of range item [math] are effectively ignored by $G^{\operatorname{prop}}$).

The following lemma establishes that $G^{\operatorname{prop}}$ satisfies a basic symmetry condition. This holds regardless of the base function $F_{R}$ used to define $G^{\operatorname{prop}}$.

Lemma 17**.**

For a permutation $\sigma:[N]\to[N]$ and a vector $y_{i}\in\{-1,1\}^{N}$, let $\sigma(y_{i}):=(y_{i,\sigma(1)},\dots,y_{i,\sigma(N)})$. Then $G^{\operatorname{prop}}(y_{0},\dots,y_{R})=G^{\operatorname{prop}}(\sigma(y_{0}),\dots,\sigma(y_{R})).$

Proof.

Immediate from Definition 16 and the fact that $\mathsf{OR}_{N}$ depends only on the Hamming weight of its input. ∎

Viewing $G^{\operatorname{prop}}$ as a property of functions $f_{s}\colon[N]\to[R]_{0}$, Lemma 17 simply states that $G^{\operatorname{prop}}$ is invariant under permutations of the domain of $f_{s}$.

3.3 The Third Function: A Symmetrized Property

To define our third function $\tilde{G}^{\operatorname{prop}}$, it is useful to consider yet another representation of a function $f_{s}\colon[N]\to[R]_{0}$.

Definition 18**.**

Given $s\in[R]_{0}^{N}$, and its associated function $f_{s}$, let $Z_{i}(s)=|f_{s}^{-1}(i)|$, and define $Z(s)=(Z_{0}(s),\dots,Z_{R}(s))$.

That is, each function $Z_{i}(s)$ counts the number of of inputs $j\in[N]$ such that $f_{s}(j)=i$. Observe that a vector $z=(z_{0},\dots,z_{R})\in[N]_{0}^{R+1}$ equals $Z(s)$ for some $s\in[R]_{0}^{N}$ if and only if

[TABLE]

Accordingly, the domain upon which our third function $\tilde{G}^{\operatorname{prop}}$ is defined is the subset of $[N]_{0}^{R+1}$ satisfying Equation (22).

Definition 19**.**

Let $\tilde{\mathcal{D}}_{N,R}$ be the subset of $[N]_{0}^{R+1}\subset\mathbb{R}^{R+1}$ consisting of all vectors $z=(z_{0},\dots,z_{R})$ satisfying Equation (22). Define $\tilde{G}^{\operatorname{prop}}\colon\tilde{\mathcal{D}}_{N,R}\to\{-1,1\}$ as follows. For any $z\in\tilde{\mathcal{D}}_{N,R}$, let $s$ be an arbitrary vector such that $Z(s)=z$. Define $\tilde{G}^{\operatorname{prop}}(z)=G^{\operatorname{prop}}(Y(s))$, where $Y(s)$ is as in Definition 15.

The function $\tilde{G}^{\operatorname{prop}}$ is well-defined, as Lemma 17 implies that for any pair $s,s^{\prime}\in[R]_{0}^{N}$ such that $Z(s)=Z(s^{\prime})$, it holds that $G^{\operatorname{prop}}(Y(s))=G^{\operatorname{prop}}(Y(s^{\prime}))$. It is straightforward to see that the following is an alternative definition of $\tilde{G}^{\operatorname{prop}}$ on its domain $\tilde{\mathcal{D}}_{N,R}$:

[TABLE]

where $\mathbb{I}_{>0}(z_{i})=1$ if $z_{i}=0$ and is equal to $-1$ otherwise.

Relating the Approximate Degrees of $G^{\operatorname{prop}}$ and $G^{\leq N}$.

The following lemma is implicit in the proof of [5, Lemma 3.4]. It states that $\tilde{G}^{\operatorname{prop}}$ is no harder to approximate by low-degree polynomials than is $G^{\operatorname{prop}}$.

Lemma 20** (Ambainis [5]).**

Let $G^{\operatorname{prop}}\colon\mathcal{D}_{N,R}\to\{-1,1\}$ be any property of functions $f_{s}\colon[N]\to[R]_{0}$ that is symmetric with respect to permutations of the domain of $f_{s}$. Let $p$ be a polynomial of degree $d$ that $\varepsilon$-approximates $G^{\operatorname{prop}}$ on its domain $\mathcal{D}_{N,R}$. Then there exists a polynomial $\tilde{p}\colon\mathbb{R}^{R+1}\to\mathbb{R}$ of degree at most $d$ that $\varepsilon$-approximates $\tilde{G}^{\operatorname{prop}}$ on its domain $\tilde{\mathcal{D}}_{N,R}$.

The following theorem is the technical heart of this section.

Theorem 21**.**

Let $\varepsilon>0$. Then $\widetilde{\operatorname{deg}}_{\varepsilon}(G^{\operatorname{prop}})\geq\widetilde{\operatorname{deg}}_{\varepsilon}(G^{\leq N}).$

Proof.

Recall that the domain of $G^{\operatorname{prop}}$ is the subset $\mathcal{D}_{N,R}$ of $\left(\{-1,1\}^{N}\right)^{R+1}$ of vectors satisfying Condition (21), and the domain of $G^{\leq N}$ is $\{-1,1\}_{\leq N}^{N\cdot R}=\{x\in(\{-1,1\}^{N})^{R}:|x|\leq N\}$. Let $p\colon\mathcal{D}_{N,R}\to\mathbb{R}$ be a polynomial of degree $d$ that $\varepsilon$-approximates $G^{\operatorname{prop}}$. We will construct a polynomial $q\colon\{-1,1\}_{\leq N}^{N\cdot R}\to\mathbb{R}$ of degree at most $d$ that $\varepsilon$-approximates $G^{\leq N}$.

By Lemma 20, there exists a polynomial $\tilde{p}:\mathbb{R}^{R+1}\to\mathbb{R}$ of degree at most $d$ such that

[TABLE]

For each $i=0,\dots,R$, define a function $T_{i}:\{-1,1\}_{\leq N}^{N\cdot R}\to[N]_{0}$ by $T_{i}(x)=|\{j\colon x_{ij}=-1\}|=\frac{1}{2}(N-\sum_{j=1}^{N}x_{ij})$. Now define the polynomial $q\colon\{-1,1\}_{\leq N}^{N\cdot R}\to\mathbb{R}$ by

[TABLE]

Since each of the functions $T_{i}$ is linear, the polynomial $q$ has degree at most $d$.

We now verify that

[TABLE]

Fix some $x=(x_{1},\dots,x_{R})\in\{-1,1\}_{\leq N}^{N\cdot R}$. Then

[TABLE]

Here, the first equality holds by combining Equation (23) with the fact that $\left(N-\sum_{i=1}^{R}T_{i}(x),T_{1}(x),\dots,T_{R}(x)\right)$ is a sequence of non-negative numbers summing to $N$ and hence is in the domain $\tilde{\mathcal{D}}_{N,R}$ of $\tilde{G}^{\operatorname{prop}}$. The second equality holds by definition of $\mathbb{I}_{>0}$. The third equality holds by definition of $G^{\leq N}$ and $\{-1,1\}_{\leq N}^{N\cdot R}$.

Property (25) now follows by definition of $q$ and Property (24). ∎

3.4 The Final Function: From a Property to a Circuit

Recall that our goal in this section is to prove Theorem 14 reducing our main hardness amplification theorem (Theorem 5) to a lower bound on the approximate degree of $G^{\leq N}$. Theorem 14 refers to a total function $g$ on $m=O(n\log^{4}n)$ bits. But none of the first three functions defined in this section (i.e., $G^{\leq N}$, $G^{\operatorname{prop}}$, and $\tilde{G}^{\operatorname{prop}}$) are total functions on bits. Hence, we still need to construct a function $g$ with domain $\{-1,1\}^{m}$, with circuit depth or DNF width not much higher than that of $F_{R}$. (Recall that the function $g$ referred to in Theorem 5 will ultimately be obtained in Section 4 by applying the construction here with $R=10n\log n$, and $F_{R}=f\circ\mathsf{AND}_{10\log n}$).

Our function $g$ will interpret its input $u\in\{-1,1\}^{m}$ as specifying a list $s$ of $N$ numbers from the set $[R]_{0}$, and will output $G^{\operatorname{prop}}(Y(s))$. There are many ways to translate $u$ into the list $s$. It turns out that a relatively simple translation method suffices to ensure Property (18) of Theorem 14, i.e., that if $F_{R}$ is computed by a circuit of depth $k$, then $g$ is computed by a circuit of depth $k+2$. We will begin by showing how to construct an auxiliary function $g^{*}$ that is already enough to satisfy Property (18). Slightly more effort will then be required to modify $g^{*}$ to construct $g$ establishing Properties (19) and (20) of Theorem 14.

3.4.1 Definition of $g^{*}$

Definition 22**.**

Fix positive integers $N$, $R$, and $k$ with $k\geq\lceil R+1\rceil$. Let $m=N\cdot k$, and fix any function $\phi\colon\{-1,1\}^{k}\to[R]_{0}$. We associate an input $u=(u_{1},\dots,u_{N})\in\left(\{-1,1\}^{k}\right)^{N}$ with the vector $s_{u}\in[R]_{0}^{N}$ defined as $s_{u}=(\phi(u_{1}),\dots,\phi(u_{N})).$ Let $Y:[R]_{0}^{N}\to\mathcal{D}_{N,R}$ be as in Definition 15. Given any property $G\colon\mathcal{D}_{N,R}\to\{-1,1\}$, define $G_{\phi}\colon\{-1,1\}^{m}\to\{-1,1\}$ by $G_{\phi}(u)=G(Y(s_{u}))$.

The following lemma is a restatement of [46, Theorem 3.2].

Lemma 23** (Sherstov [46]).**

Let $k=6\lceil\log(R+1)\rceil$. There exists an (explicitly given) surjection

[TABLE]

such that the following holds. For every property $G\colon\mathcal{D}_{N,R}\to\{-1,1\}$ and $\varepsilon>0$,

[TABLE]

The following corollary defines the function $g^{*}$ and uses Lemma 23 to show that a lower bound on the approximate degree of $G^{\leq N}$ implies a lower bound on the approximate degree of $g^{*}$.

Corollary 24**.**

Fix an integer $N>0$. Let $G^{\leq N}\colon\{-1,1\}_{\leq N}^{N\cdot R}\to\{-1,1\}$ be as in Definition 13, $G^{\operatorname{prop}}\colon\mathcal{D}_{N,R}\to\{-1,1\}$ be as in Definition 16, and $\phi$ be as in Lemma 23. Let $m=6N\cdot\lceil\log(R+1)\rceil$, and define $g^{*}\colon\{-1,1\}^{m}\to\{-1,1\}$ to equal $G^{\operatorname{prop}}_{\phi}$ as per Definition 22. Then for every $\varepsilon>0$,

[TABLE]

*Moreover, if $F_{R}$ is computed by Boolean circuit of depth $k$ and size $\mathrm{poly}(R)$, then $g^{*}$ is computed by circuit of depth $k+2$ and size $\mathrm{poly}(R,N)$. *

Proof.

Inequality (26) follows by combining Lemma 23 and Theorem 21.

We now turn to showing that if $F_{R}$ is computed by a circuit of small depth then $g^{*}$ is as well. Consider an input $u=(u_{1},\dots,u_{N})\in\left(\{-1,1\}^{6\lceil\log(R+1)\rceil}\right)^{N}$, and recall that we associate $u$ with the vector $(\phi(u_{1}),\dots,\phi(u_{N}))\in[R]_{0}^{N}$. The output $g(u)$ is obtained by applying $F_{R}$ to a sequence of bits $(b_{1},\dots,b_{R})$, where $b_{i}=-1$ if and only if there exists a $j\in[N]$ such that $\phi(u_{j})=i$.

Since $\phi$ is a function on just $6\lceil\log(R+1)\rceil$ bits, each bit $b_{i}$ is computed by a DNF $\mathcal{C}_{i}$ of width $6\lceil\log(R+1)\rceil$, and hence size at most $O(N\cdot R^{12})$.

Hence, if $F_{R}$ is computed by a Boolean circuit $\mathcal{C}$ of size $S=\mathrm{poly}(R)$ and depth $k$, then by replacing each input $b_{i}$ to $\mathcal{C}$ with the DNF $\mathcal{C}_{i}$, one obtains a circuit $\mathcal{C}^{*}$ for $g^{*}$ of size at most $O(S\cdot N\cdot R^{12})=\mathrm{poly}(R,N)$ and depth $k+2$. ∎

3.4.2 Definition of $g$

Even if $F_{R}$ is a DNF of polylogarithmic width, the function $g^{*}$ defined in Corollary 24 may not be. However, it is not hard to see that if $F_{R}$ is a monotone DNF of polylogarithmic width $w$, then $g^{*}$ is a (non-monotone) DNF of width at most $O(w\cdot\log n)$. Indeed, in this case the circuit $\mathcal{C}^{*}$ for $g^{*}$ constructed in the proof of Corollary 24 is an $\mathsf{OR}-\mathsf{AND}-\mathsf{OR}-\mathsf{AND}$ circuit with all negations at the input level. Each $\mathsf{AND}$ gate in the second level from the top has fan-in at most $w$, and the bottom $\mathsf{AND}$ gates each have fan-in at most $w^{\prime}=6\lceil\log(R+1)\rceil$. Any such circuit can be transformed into a (non-monotone) DNF of width at most $w\cdot w^{\prime}=O(w\cdot\log R)$.

Unfortunately, this observation is still not enough for us to eventually obtain our desired $n^{1-\delta}$ lower bounds for polylogarithmic width DNFs (cf. Theorem 4). To obtain such lower bounds, we need to recursively apply our hardness amplification methods, and hence we need the harder function $g$ to itself be a monotone DNF. Our definition of $g$ achieves this by applying a simple transformation to $g^{*}$. This transformation has appeared in related contexts [25, Proof of Lemma 3].

Definition 25**.**

*Fix $F_{R}\colon\{-1,1\}^{R}\to\{-1,1\}$, and let $g^{*}\colon\{-1,1\}^{m}\to\{-1,1\}$ be as in Definition 22. Let $\mathcal{C}^{*}$ be any circuit computing $g^{*}$ such that all negations in $\mathcal{C}_{g}$ appear at the inputs. Let $g\colon\{-1,1\}^{2m}\to\{-1,1\}$ be the monotone function defined as follows. Associate each of the first $m$ inputs to $g$ with an input to $g^{*}$, and each of the last $m$ inputs to $g$ with the negation of an input to $g^{*}$. Then $g$ is obtained from $g^{*}$ by replacing each literal of $\mathcal{C}^{*}$ with the corresponding (unnegated) input to $g$. *

We now complete the proof of Theorem 14.

Proof of Theorem 14.

We begin by establishing Expression (17). Let $p\colon\{-1,1\}^{2m}\to\mathbb{R}$ be a degree $d$ polynomial approximating $g$ to error $\epsilon$. Then one can turn $p$ into a polynomial $q\colon\{-1,1\}^{m}\to\{-1,1\}$ of degree at most $d$ approximating $g^{*}$ to the same error by simply replacing each input to $p$ with the corresponding input (or its negation) to $g^{*}$. It follows that $\widetilde{\operatorname{deg}}_{\varepsilon}(g)\geq\widetilde{\operatorname{deg}}_{\varepsilon}(g^{*})$. The inequality in Expression (17) follows from Corollary 24.

Property (18) is immediate from Corollary 24, since the construction of Definition 25 does not change the circuit depth of $\mathcal{C}^{*}$.

The discussion preceding the statement of Definition 25 revealed that, if $F_{R}$ is a monotone DNF of polylogarithmic width $w$, then $g^{*}$ is a (non-monotone) DNF of width at most $O(w\cdot\log R)$. It is then immediate from the definition of $g$ that $g$ is a monotone DNF of width $O(w\cdot\log R)$. This yields Property (20).

By similar reasoning, if $F_{R}$ is computed by a monotone circuit of depth $k$, then $g^{*}$ is computed by a circuit of depth $k+2$ with $\mathsf{AND}$ gates at the bottom, and all negations at the inputs. It is then immediate from the definition of $g$ that $g$ is computed by a monotone circuit of depth $k+2$ with $\mathsf{AND}$ gates at the bottom. This establishes Property (19), completing the proof. ∎

4 Analyzing Block Composed Functions On Low Hamming Weight Inputs

To complete the proof of Theorem 5, we combine the following theorem with Theorem 14.

Theorem 26**.**

Let $f_{n}:\{-1,1\}^{n}\to\{-1,1\}$ be any function. Let $N=c\cdot n\log^{3}n$ for a sufficiently large constant $c>0$. Let $G^{\leq N}\colon\{-1,1\}^{10\cdot N\cdot n\cdot\log n}_{\leq N}\to\{-1,1\}$ equal $f_{n}\circ\mathsf{AND}_{10\log n}\circ\mathsf{OR}_{N}$ restricted to inputs in $\{-1,1\}^{10\cdot N\cdot n\cdot\log n}_{\leq N}=\{x\in\{-1,1\}^{10\cdot N\cdot n\cdot\log n}:|x|\leq N\}$ (cf. Definition 13). Then $\widetilde{\operatorname{deg}}(G^{\leq N})\geq n^{1/3}\cdot\widetilde{\operatorname{deg}}(f_{n})^{2/3}.$

The primary goal of this section is to prove Theorem 26. Before embarking on this proof, we use it to complete the proofs of Theorems 3-5 from Section 1.3.

Proof of Theorem 5

assuming Theorem 26..

We begin by establishing Property (1) in the conclusion of Theorem 5. Let $R=10\cdot n\cdot\log n$ and $F_{R}:=f_{n}\circ\mathsf{AND}_{10\cdot\log n}$. Applying Corollary 24 to $F_{R}$ yields a function $g$ on $O(N\log R)=O(n\log^{4}n)$ variables satisfying

[TABLE]

where the final inequality holds by Theorem 26. Suppose $f_{n}$ is computed by polynomial size Boolean circuit $\mathcal{C}$ of depth $k$. Then $F_{R}$ is computed by polynomial-size Boolean circuit of depth $k+1$, and Property (18) of Theorem 14 guarantees that $g$ is computed by polynomial size Boolean circuit of depth $k+3$. Hence, $g$ satisfies Property (1) as desired.

To establish Property (2), suppose that $f_{n}$ is computed by a monotone circuit of depth $k$ with $\mathsf{AND}$ gates at the bottom. Then $F_{R}$ is computed by such a circuit as well. Property (19) of Theorem 14 then implies that $g$ is computed by a circuit of depth $k+2$ with $\mathsf{AND}$ gates at the bottom.

To establish Property (3), observe that if $f_{n}$ is computed by a monotone DNF of width $w$, then $F_{R}$ is computed by a monotone DNF of width $O(w\cdot\log n)$, and Property (20) of Theorem 14 implies that $g$ is computed by a monotone DNF of width $O(w\cdot\log^{2}n)$.

∎

Proof of Theorems 3 and 4

assuming Theorem 5.

One can almost obtain Theorems 3 and 4 by recursively applying Theorem 5, starting in the base case with the function $\mathsf{OR}_{n}$. However, to obtain stronger degree lower bounds for a given circuit depth or DNF width, we instead use the following well-known result of Aaronson and Shi [4] regarding the approximate degree of (the negation of) the well-known Element Distinctness function.

Lemma 27** (Sherstov [46], refining Aaronson and Shi [4]).**

There is a function $\overline{\mathsf{ED}}\colon\{-1,1\}^{n}\to\{-1,1\}$ such that $\widetilde{\operatorname{deg}}(\overline{\mathsf{ED}})=\Omega(n^{2/3}\log^{1/3}n)$. Moreover, $\overline{\mathsf{ED}}$ is computed by a monotone DNF of polynomial size and width $O(\log n)$.

Proof.

If the word monotone were omitted from the conclusion, this would be a restatement of [46, Theorem 3.3]. Using the same technique as in Definition 25, the non-monotone DNF constructed in [46, Theorem 3.3] can be transformed into a monotone DNF satisfying the same properties. ∎

Lemma 27 immediately implies Theorems 3 and 4 in the case $k=1$. Assume by way of induction that Theorem 3 holds for an integer $k\geq 1$. That is, there exists a function $f^{(k)}$ on $n\cdot\log^{4k-4}(n)$ variables, computed by monotone circuit of depth $2k$ with $\mathsf{AND}$ gates at the bottom, with approximate degree $\Omega(n^{1-2^{k-1}/3^{k}}\cdot\log^{3-2^{k+2}/3^{k}}(n))$. By applying Theorem 5 to $f^{(k)}$, one obtains (by Property (2)) a function $f^{(k+1)}$ on $n\cdot\log^{4k}(n)$ variables, computed by a monotone circuit of depth $2k+2$ with $\mathsf{AND}$ gates at the bottom, with approximate degree $\Omega(n^{1-2^{k}/3^{k+1}}\cdot\log^{3-2^{k+3}/3^{k+1}}(n))$. The function $f^{(k+1)}$ satisfies the conclusion of Theorem 3, completing the inductive proof of Theorem 3.

Similarly, assume by way of induction that Theorem 4 holds for an integer $k\geq 1$, for a DNF $f^{(k)}$. By applying Theorem 5 to $f^{(k)}$, one obtains (by Property (3)) a function $f^{(k+1)}$ satisfying the conclusion of Theorem 4 for integer $k+1$. ∎

4.1 Organization of the Proof of Theorem 26

Our proof of Theorem 26 entails using a dual witness for the approximate degree of $f_{n}$ to construct a dual witness for the higher approximate degree of $G^{\leq N}$. For expository purposes, we think about the construction of a dual witness for $G^{\leq N}$ as consisting of four steps.

Step 1.

Let $d=\widetilde{\operatorname{deg}}(f_{n})$. We begin by constructing a dual witness $\varphi$ for the $\Omega\left(\sqrt{k}\right)$-approximate degree of the $\mathsf{OR}_{N}$ function when restricted to inputs of Hamming weight at most $k=(n/d)^{2/3}$. This construction closely mirrors previous constructions of Špalek [60] and Bun and Thaler [18]. However, we need $\varphi$ to satisfy an additional metric condition that is not guaranteed by these prior constructions. Specifically, we require that the total $\ell_{1}$ weight that $\varphi$ places on the $t$’th layer of the Hamming cube should be upper bounded by $O(1/(t+1)^{2})$.

Step 2.

We apply the error amplification construction of Proposition 11 to transform $\varphi$ into a new dual polynomial $\psi$ that witnesses the fact that the $(1-\delta)$-approximate degree of the function $\mathsf{AND}_{10\log n}\circ\mathsf{OR}_{N}$ remains $\Omega(\sqrt{k})$, even with error parameter $\delta\leq 1/N^{2}$.

Step 3.

We appeal to the degree amplification construction of Proposition 12 to combine $\psi$ from Step 2 with a dual witness $\Psi$ for the high approximate degree of $f_{n}$. This yields a dual witness $\zeta$ showing that the approximate degree of the composed function $f_{n}\circ\mathsf{AND}_{10\log n}\circ\mathsf{OR}_{N}$ is $\Omega(d\cdot\sqrt{k})=\Omega(n^{1/3}\cdot d^{2/3})$.

Step 4.

Using a construction of Razborov and Sherstov [44], we zero out the mass that $\zeta$ places on inputs of Hamming weight larger than $N$, while maintaining its pure high degree and correlation with $G^{\leq N}$. This yields the final desired dual witness $\hat{\zeta}$ for $G^{\leq N}$.

4.2 Step 1: A Dual Witness for $\mathsf{OR}_{N}$

Proposition 28**.**

Let $k,N\in\mathbb{N}$ with $k\leq N$. Then there exist a constant $c_{1}\in(0,1)$ and a function $\psi:\{-1,1\}^{N}_{\leq k}\to\{-1,1\}$ such that:

[TABLE]

[TABLE]

[TABLE]

[TABLE]

[TABLE]

For intuition, we mention that Properties (27)-(30) amount to a dual formulation of the fact that the “one-sided” approximate degree of $\mathsf{OR}_{N}$ is $\Omega(\sqrt{k})$, even under the promise that the input has Hamming weight at most $k$.666One-sided approximate degree is a variant of approximate degree defined in, e.g., [18]. We will not need the primal formulation of approximate degree in this work, and therefore omit a formal definition of this notion. Property (31) is an additional metric condition that we require later in the proof.

The key to proving Proposition 28 is the following explicit construction of a univariate function from first principles. The construction closely follows previous work of Špalek [60] and Bun and Thaler [18], and appears in Appendix A.

Lemma 29**.**

Let $k\in\mathbb{N}$. There exists a constant $c_{1}\in(0,1)$ and a function $\omega:\{0,1,\dots,k\}\to\mathbb{R}$ such that

[TABLE]

[TABLE]

[TABLE]

[TABLE]

[TABLE]

Proof of Proposition 28.

Let $\omega$ be the function guaranteed by Lemma 29. Consider the function $\psi:\{-1,1\}^{N}_{\leq k}\to\{-1,1\}$ defined by

[TABLE]

That $\psi$ satisfies Conditions (27), (28), (30), and (31) is immediate from the definition of $\psi$ and Properties (32), (33), (35), and (36) of $\omega$. Property (29) is a consequence of Minsky-Papert symmetrization. Specifically, for any polynomial $p\colon\{-1,1\}^{N}\to\mathbb{R}$, Lemma 8 implies that there is a univariate polynomial $q$ of degree at most $\deg(p)$ such that for all $t\in[N]_{0}$, we have $q(t)={N\choose t}^{-1}\sum_{x\in\{-1,1\}^{N}\colon|x|=t}p(x)$. Hence, $\sum_{x\in\{-1,1\}^{N}}\psi(x)\cdot p(x)=\sum_{t=0}^{N}\omega(t)\cdot q(t)=0$, where the final equality holds by Property (34). ∎

4.3 Steps 2 and 3: A Preliminary Dual Witness for $G=f_{n}\circ\mathsf{AND}_{10\log n}\circ\mathsf{OR}_{N}$

Recall that our ultimate goal in this section is to construct a dual witness for the veracity of Theorem 26. Here, we begin by defining a preliminary dual witness $\zeta$. While $\zeta$ itself is insufficient to witness the veracity of Theorem 26, we will ultimately “post-process” $\zeta$ into the desired dual witness $\hat{\zeta}$.

We start by fixing choices of several key parameters:

• •

$d=\widetilde{\operatorname{deg}}_{2/3}(f_{n})$.

• •

$k=\lfloor(n/d)^{1/3}\rfloor^{2}$

• •

$D=c_{1}\sqrt{k}\cdot d=O(n^{1/3}\cdot d^{2/3})$, where $c_{1}$ is the constant from Lemma 29

• •

$R=10n\log n$

• •

$N=\lceil c_{2}R\log^{2}R\rceil$, where $c_{2}$ is a universal constant to be determined later (cf. Proposition 31)

• •

$m=R\cdot N$

To state our construction of a preliminary dual witness $\zeta$, we begin with the following objects:

• •

A dual witness $\varphi:\{-1,1\}^{n}\to\mathbb{R}$ for the fact that $\widetilde{\operatorname{deg}}_{2/3}(f_{n})\geq d$. By Theorem 7, $\varphi$ satisfies the following conditions.

[TABLE]

[TABLE]

[TABLE]

• •

The function $\Psi:\{-1,1\}^{10\log n}\to\mathbb{R}$ whose existence is guaranteed by Proposition 11.

• •

The dual witness $\psi:\{-1,1\}^{N}\to\mathbb{R}$ for $\mathsf{OR}_{N}$ guaranteed by Proposition 28, using the choice of the parameter $k$ above.

We apply dual block composition sequentially to the three dual witnesses to obtain a function $\zeta=\varphi\star\Psi\star\psi$. This function is well-defined because dual block composition is associative (Proposition 10).

Proposition 30**.**

The dual witness $\zeta=\varphi\star\Psi\star\psi$ satisfies the following properties:

[TABLE]

[TABLE]

[TABLE]

Proof.

It is easiest to reason about these properties by regarding $\zeta$ as $\varphi\star(\Psi\star\psi)$. To this end, let $\xi:(\{-1,1\}^{N})^{10\log n}\to\mathbb{R}$ denote $\Psi\star\psi$. Then $\xi$ satisfies the following properties:

[TABLE]

[TABLE]

[TABLE]

Property (43) follows from Expression (14) of Proposition 11, together with Properties (27), (28), and (30) of the dual witness $\psi$ for $\mathsf{OR}_{N}$. Property (44) follows from Property (11) of dual block composition (cf. Proposition 10), and the fact that both $\Psi$ and $\psi$ have unit $\ell_{1}$-norm (Equations (15) and (28)). Finally, Property (45) is a consequence of Property (12) of dual block composition (cf. Proposition 10), together with Properties (16) and (29), which state that $\Psi$ and $\psi$ have pure high degree at least $1$ and $c_{1}\sqrt{k}$, respectively.

We now verify Properties (40)-(42) of $\zeta=\varphi\star\xi$. Property (40) follows from Proposition 12, together with Properties (37) and (38) of $\varphi$ and Properties (43) and (44) of $\xi$. Property (41) follows from Property (11) of dual block composition (cf. Proposition 10), and the fact that both $\varphi$ and $\xi$ have unit $\ell_{1}$-norm (Equations (38) and (44)). Finally, Property (42) follows from Property (12) (cf. Proposition 10) of dual block composition, together with Properties (39) and (45) of the pure high degrees of $\varphi$ and $\xi$, respectively. ∎

4.4 Step 4: Constructing the Final Dual Witness

For a fixed number $N\in\mathbb{N}$, let $X=\{-1,1\}^{N\cdot 10\log n\cdot n}_{\leq N}=\{x\in((\{-1,1\}^{N})^{10\log n})^{n}:|x|\leq N\}.$ Recall that this set $X$ is the same one that appears in Definition 13 when applied to the function $F_{R}:=f_{n}\circ\mathsf{AND}_{10\log n}$ on $R=10n\log n$ variables.

Proposition 31**.**

Let $\zeta:((\{-1,1\}^{N})^{10\log n})^{n}\to\mathbb{R}$ be as constructed in Proposition 30. Then there exists a constant $c_{2}>0$ such that, for $N=\lceil c_{2}R\log^{2}R\rceil$ and sufficiently large $n$,

[TABLE]

Proof.

For the proof of Proposition 31, it is now useful to regard the dual witness $\zeta$ as the iterated dual block composition $(\varphi\star\Psi)\star\psi$. In this proof, let us denote $\Phi:=\varphi\star\Psi$. Then $\Phi:\{-1,1\}^{R}\to\mathbb{R}$ where $R=10n\log n$.

Write $\psi$ as a difference of non-negative functions $\psi_{+1}-\psi_{-1}$. Since $\psi$ has strictly positive pure high degree, it is in particular orthogonal to the constant function $\mathbf{1}_{N}$, and hence $\|\psi_{+1}\|_{1}=\|\psi_{-1}\|_{1}=1/2$. Recalling that $\psi(x)=\omega(|x|)/\binom{N}{|x|}$ where $\omega\colon[k]_{0}\to\mathbb{R}$ is given in Lemma 29, we may analogously write $\omega=\omega_{+1}-\omega_{-1}$ where $\omega_{+1}$ and $\omega_{-1}$ are non-negative functions satisfying

[TABLE]

By the definition of dual block composition, we have

[TABLE]

Consequently,

[TABLE]

Observe that for any $(t_{1},\dots,t_{R})\in[k]_{0}^{R}$, the number of inputs $(x_{1},\dots,x_{R})\in\left(\{-1,1\}^{N}\right)^{R}$ such that $|x_{i}|=t_{i}$ for all $i\in[R]$ is exactly $\prod_{i=1}^{R}{N\choose t_{i}}$. Hence, defining

[TABLE]

we may rewrite Expression (48) as

[TABLE]

To control this quantity, we appeal to the following combinatorial lemma, whose proof we defer to Section 4.5.

Lemma 32**.**

Let $k,R\in\mathbb{N}$ with $k\leq N$. There is a constant $\alpha>0$ such that the following holds. Let $N=\lceil\alpha R\log^{2}R\rceil$. Let $\eta_{i}:[k]_{0}\to\mathbb{R}$, for $i=1,\dots R$, be a sequence of non-negative functions where for every $i$,

[TABLE]

[TABLE]

Let $P=\{\vec{t}=(t_{1},\dots,t_{R})\in[k]_{0}^{R}:t_{1}+\dots+t_{R}>N\}$. Then

[TABLE]

Observe that the functions $\omega_{z_{i}}$ satisfy Condition (49) (cf. Equation (47)) and Condition (50) (cf. Property (36)). We complete the proof of Proposition 31 by letting $c_{2}$ equal the constant $\alpha$ appearing in the statement of Lemma 32, and bounding

[TABLE]

Here, the equality appeals to the fact that $\|\Phi\|_{1}=1$ (by Property (11) of Proposition 10), and the last inequality holds for sufficiently large $n$ by virtue of the fact that $R/k=\Theta(n^{1/3}d^{2/3}\log n)$, while $D=O(n^{1/3}d^{2/3})$ for the values of $R$ and $D$ specified at the start of Section 4.3. ∎

We are now in a position to construct our final dual witness for the high approximate degree of $G^{\leq N}$. This dual witness $\hat{\zeta}$ is obtained by modifying $\zeta$ to zero out all of the mass it places on inputs of total Hamming weight larger than $N$. This zeroing process is done in a careful way so as not to decrease the pure high degree of $\zeta$, nor to significantly affect its correlation with $G^{\leq N}$. The technical tool that enables this process is a construction of Razborov and Sherstov [44].

Lemma 33** (cf. [44, Proof of Lemma 3.2]).**

Let $D,m\in\mathbb{N}$ with $0\leq D\leq m-1$. Then for every $y\in\{-1,1\}^{m}$ with $|y|>D$, there exists a function $\phi_{y}:\{-1,1\}^{m}\to\mathbb{R}$ such that

[TABLE]

[TABLE]

[TABLE]

[TABLE]

Proposition 34**.**

There exists a function $\nu:((\{-1,1\}^{N})^{10\log n})^{n}\to\mathbb{R}$ such that

[TABLE]

[TABLE]

[TABLE]

where $\zeta$ is as in Proposition 30.

Proof.

Define

[TABLE]

where $\phi_{y}$ is as in Lemma 33 with $m$ and $D$ set as at the beginning of Section 4.3. Property (55) follows immediately from Property (53) and linearity. By Proposition 31 and Property (54), we have

[TABLE]

establishing Property (56). Finally, Property (57) follows from (51) and (52), together with the fact that $D<N$. ∎

Combining Proposition 34 with Proposition 30 allows us to complete the proof of Theorem 26, which was the goal of this section.

Proof of Theorem 26.

Let $\zeta=\varphi\star\Psi\star\psi$ be as defined in Section 4.3, and let $\nu$ be the correction object constructed in Proposition 34. Observe that $\|\zeta-\nu\|_{1}>0$, as $\|\zeta\|_{1}=1$ (cf. Equality (41)) and $\|\nu\|_{1}\leq 1/10$ (cf. Inequality (56)). Define the function

[TABLE]

Since $\nu(x)=\zeta(x)$ whenever $|x|>N$ (cf. Equation (57)), the function $\hat{\zeta}$ is supported on the set $X$. By Theorem 7, to show that it is a dual witness for the high approximate degree of $G^{\leq N}$, it suffices to show that $\hat{\zeta}$ satisfies the following three properties:

[TABLE]

[TABLE]

[TABLE]

We establish (58) by computing

[TABLE]

Equation (59) is immediate from the definition of $\hat{\zeta}$. Finally, (60) follows from (42), (55), and linearity.

∎

4.5 Proof of Lemma 32

All that remains to complete the proof of Theorem 26 is to establish the deferred combinatorial lemma from Section 4.4. We begin by stating a two simple lemmas.

Lemma 35**.**

Let $k,n\in\mathbb{N}$ with $k\leq n$. Then $\binom{n}{k}\leq\left(\frac{en}{k}\right)^{k}$.

Lemma 36**.**

Let $m\in\mathbb{N}$. Then

[TABLE]

Proof.

We calculate

[TABLE]

∎

We are now ready to prove Lemma 32, which we restate below for the reader’s convenience.

See 32

Proof.

Define a universal constant

[TABLE]

Note that $C<\infty$ by, say, the Cauchy condensation test.

We begin with a simple, but important, structural observation about the set $P$. Let $t=(t_{1},\dots,t_{R})\in[k]_{0}^{R}$ be a sequence such that $t_{1}+\dots+t_{R}>N$. Let $M=\lfloor\frac{N}{2k}\rfloor$. Then we claim that there exists an $s\in\{M\dots,R\}$ such that $t_{i}\geq N/(2Cs\log^{2}(2s))$ for at least $s$ indices $i\in[R]$. To see this, assume without loss of generality that the entries of $\vec{t}$ are sorted so that $t_{1}\geq t_{2}\geq\dots\geq t_{R}$. Then there must exist an $s\geq M$ such that $t_{s}\geq N/(2Cs\log^{2}(2s))$. Otherwise, because no $t_{i}$ can exceed $k$, we would have:

[TABLE]

Since the entries of $\vec{t}$ are sorted, the preceding values $t_{1},\dots,t_{s-1}\geq N/(2Cs\log^{2}(2s))$ as well.

For each subset $S\subseteq[R]$, define

[TABLE]

The observations above guarantee that for every $\vec{t}=(t_{1},\dots,t_{R})\in P$, there exists some set $S$ of size at least $s\in\{M,\dots,R\}$ such that $t_{i}\geq N/(2Cs\log^{2}(2s))$ for all $i\in S$. Hence,

[TABLE]

The claim follows as long as $M=\lfloor\frac{N}{2k}\rfloor\geq 2\log(2NR)\cdot R/k$, which is true for the setting of $N$ chosen above. ∎

5 Applications

5.1 Approximate Rank and Quantum Communication Complexity of AC0

For a matrix $F\in\{-1,1\}^{N\times N}$, the $\varepsilon$-approximate rank of $F$, denoted $\text{rank}_{\varepsilon}(F)$, is the least rank of a matrix $A\in\mathbb{R}^{N\times N}$ such that $|A_{ij}-F_{ij}|\leq\varepsilon$ for all $(i,j)\in[N]\times[N]$. Sherstov’s pattern matrix method [50] allows one to translate approximate degree lower bounds into approximate rank lower bounds in a black-box manner. Moreover, the logarithm of the approximate rank of a communication matrix is known to lower bound its quantum communication complexity, even when prior entanglement is allowed [37]. By combining the pattern matrix method with Theorems 3 and 4, we obtain the following corollary.

Corollary 37**.**

For any constant $\delta>0$, there is an $\operatorname{AC}^{0}$ function $F\colon\{-1,1\}^{n}\times\{-1,1\}^{n}\to\{-1,1\}$ such that $[F(x,y)]_{x,y}$ has approximate rank $\text{rank}_{1/3}(F)\geq\exp(n^{1-\delta})$. Similarly, there is a DNF $F\colon\{-1,1\}^{n}\times\{-1,1\}^{n}\to\{-1,1\}$ of width $\mathrm{polylog}(n)$ (and quasipolynomial size) such that $[F(x,y)]_{x,y}$ has approximate rank at least $\exp(n^{1-\delta})$. Moreover, the quantum communication complexity of $F$ (with arbitrary prior entanglement), denoted $Q^{*}_{1/3}(F)$, is $\Omega(n^{1-\delta})$.

Proof.

Let $f$ be the AC0 function, or low-width DNF, with $(1/2)$-approximate degree at least $n^{1-\delta}$ whose existence is guaranteed by Theorem 3 or Theorem 4 respectively. The pattern matrix method [50, Theorem 8.1] implies that the function $F\colon\{-1,1\}^{4n}\times\{-1,1\}^{4n}\to\{-1,1\}$ given by

[TABLE]

satisfies $\text{rank}_{1/3}(F)\geq\exp(\Omega(n^{1-\delta}))$. Moreover, if $f$ is computed by a Boolean circuit of depth $k$ and polynomial size, then $F$ is computed by a Boolean circuit of polynomial size and depth $k+2$. Similarly, if $f$ is computed by a DNF formula of width $w$, then $F$ is computed by a DNF formula of width $O(w)$. The claimed lower bound on $Q^{*}_{1/3}(F)$ follows from the fact that for any $2^{n}\times 2^{n}$ matrix $F$, we have $Q^{*}_{1/3}(F)\geq\Omega(\log\text{rank}_{1/3}(F))-O(\log n)$ [37]. ∎

The best previous lower bound on the approximate rank and quantum communication complexity of an AC0 function was $\exp\left(\tilde{\Omega}(n^{2/3})\right)$ and $\tilde{\Omega}(n^{2/3})$ respectively. This follows from combining the Element Distinctness lower bound (Theorem 27), with the pattern matrix method [50].

5.2 Nearly Optimal Separation Between Certificate Complexity and Approximate Degree

Certificate complexity, approximate degree, Fourier degree, block sensitivity, and deterministic, randomized, and quantum query complexities are all natural measures of the complexity of Boolean functions, with many applications in theoretical computer science. While it is known that all of these measures are polynomially related, much effort has been devoted to understanding the maximal possible separations between these measures. Ambainis et al. [7], building on techniques of Göös, Pitassi, and Watson [29], recently made remarkable progress in this direction, establishing a number of surprising separations between several of these measures. Subsequent work by Aaronson, Ben-David, and Kothari [3] unified and strengthened a number of these separations.

Let $f\colon\{-1,1\}^{n}\to\{-1,1\}$ be a (total) Boolean function. In this section, we study the relationship between certificate complexity, denoted $C(f)$ and defined below, and approximate degree. We build on Theorem 4 to construct a function $F\colon\{-1,1\}^{n}\rightarrow\{-1,1\}$ with $\widetilde{\operatorname{deg}}(F)=n^{1-o(1)}$ and certificate complexity $n^{1/2+o(1)}$. The function $F$ exhibits what is essentially the maximal possible separation between these two measures, as it is known that $\widetilde{\operatorname{deg}}(f)=O(C(f)^{2})$ for all Boolean functions $f$.777This follows by combining the relationship $D(f)\leq C(f)\cdot\text{bs}(f)$ [9] with the relationships $\text{bs}(f)\leq C(f)$ and $\widetilde{\operatorname{deg}}(f)\leq D(f)$. The best previous separation was reported by Aaronson et al. [3], who gave a function $f$ with $\widetilde{\operatorname{deg}}(f)=\tilde{\Omega}(C(f)^{7/6})$.

Theorem 38**.**

There is a Boolean function $F:\{-1,1\}^{n}\to\{-1,1\}$ such that $\widetilde{\operatorname{deg}}(F)\geq C(F)^{2-o(1)}$.

Certificate complexity definitions.

Let $f\colon\{-1,1\}^{n}\rightarrow\{-1,1\}$, and let $x\in\{-1,1\}^{n}$. A subset $S\subseteq\{1,\dots,n\}$ is a $(-1)$-certificate (respectively, $(+1)$-certificate) for $f$ at $x$ if for all inputs $y\in\{-1,1\}^{n}$ such that $y_{i}=x_{i}$ for all $i\in S$, it holds that $f(y)=f(x)=-1$ (respectively, $f(y)=f(x)=1$). For any $x\in\{-1,1\}^{n}$, let $C(f,x)$ denote the minimum size of a certificate for $f$ at $x$. Define $C(f):=\max_{x\in\{-1,1\}^{n}}C(f,x)$. Define the $(-1)$-certificate complexity of $f$ to be $C_{-1}(f):=\max_{x\in f^{-1}(-1)}C(f,x)$, and the $(+1)$-certificate complexity of $f$ to be $C_{+1}(f):=\max_{x\in f^{-1}(+1)}C(f,x)$.

5.2.1 Warm-Up: A Power $3/2$ Separation

Before proving Theorem 38, we begin by proving a weaker separation that illustrates most of the ideas in our construction.

Proposition 39**.**

There is a Boolean function $F\colon\{-1,1\}^{n}\to\{-1,1\}$ such that $\widetilde{\operatorname{deg}}(F)\geq C(F)^{3/2-o(1)}$.

Proof.

While Theorem 4 is stated only for constant $k\geq 1$, the proof is easily seen to hold when $k$ is a function of $n$. In particular, explicitly accounting for the constant factor loss that occurs in each step of the inductive proof of Theorem 4, we obtain the following statement that holds even if $k$ grows with $n$.

Theorem 40** (Generalized Version of Theorem 4).**

For any integer $k\geq 1$, there is an (explicitly given) monotone DNF on $n\cdot\log^{4k-4}(n)$ variables of width $O(\log^{2k-1}(n))$ that computes a function with approximate degree $2^{-O(k)}\cdot n^{1-2^{k-1}/3^{k}}\cdot\log^{3-2^{k+2}/3^{k}}(n)$.

Applying Theorem 40 for an appropriately chosen $k=O(\log\log n)$ yields a function $f:\{-1,1\}^{M}\to\{-1,1\}$ that is computed by a DNF on $M\leq n\cdot\log^{O(k)}(n)\leq n^{1+o(1)}$ variables with width $O(\log^{O(k)}(n))\leq M^{o(1)}$. Equivalently, $C_{-1}(f)\leq M^{o(1)}$. Moreover, $\widetilde{\operatorname{deg}}(f)\geq n^{1-o(1)}\geq M^{1-o(1)}$.

Let $\mathsf{MAJ}_{10\log M}$ denote the Majority function on $10\log M$ bits. The following result is implicit in [15, Theorem 4.2].

Lemma 41** (Bouland et al. [15]).**

Let $f\colon\{-1,1\}^{M}\to\{-1,1\}$. Then

[TABLE]

for $\varepsilon=1-1/M^{2}$.

Now consider the block-composed function $F=\mathsf{AND}_{M}\circ\mathsf{MAJ}_{10\log M}\circ f$. This is a function on $10M^{2}\log M$ variables, and Lemma 41 together with Proposition 12 implies that

[TABLE]

We now show that the function $F$ has certificate complexity $C(F)\leq M^{1+o(1)}$. Let $\hat{F}=\mathsf{MAJ}_{10\log M}\circ f$. Then $C_{-1}(\hat{F})\leq 5\log M\cdot C_{-1}(f)=M^{o(1)}$; this uses the fact that in order to certify that $\mathsf{MAJ}_{10\log M}$ evaluates to $-1$, it is enough to certify that at least half of its inputs are equal to $-1$. And, trivially, $C_{+1}(\hat{F})\leq 10M\log M$.

Any input $z$ to $\mathsf{AND}_{M}$ has a certificate $S$ such that $z_{i}=+1$ for at most one index $i\in S$. By composing certificates, it follows that

[TABLE]

Combining (61) and (62) completes the proof of Proposition 39.

∎

5.2.2 A Nearly Quadratic Separation

To improve Proposition 39 to a nearly quadratic separation, we replace $\mathsf{AND}_{M}$ in the definition of $F$ with a function $f^{*}$ defined on roughly $M$ variables, such that $\widetilde{\operatorname{deg}}(f^{*})\geq M^{1-o(1)}$. This function $f^{*}$ must moreover possess certificates satisfying the same key property as the $\mathsf{AND}$ function. Namely, every input $z$ to $f^{*}$ must have a certificate $S$ such that $z_{i}=+1$ for only a small (as we will see, $M^{o(1)}$) number of indices $i\in S$.

Construction of $f^{*}$.

While the function $f\colon\{-1,1\}^{M}\to\{-1,1\}$ considered in the proof of Proposition 39 satisfies the requisite approximate degree bound, it lacks the key property regarding its certificates. Hence, we must modify the function $f$ to obtain a suitable function $f^{*}$. The modification we use generalizes a technique introduced by Aaronson et al. [3, Theorem 8] to give separations between quantum query complexity and certificate complexity, Fourier degree, and approximate degree.

Definition 42**.**

Let $f\colon\{-1,1\}^{n}\to\{-1,1\}$ be computed by a DNF formula $\mathcal{C}_{f}$ of width $w$. We define a function $f^{*}\colon\{-1,1\}^{2n}\to\{-1,1\}$ as follows. Let each of the first $n$ inputs to $f^{*}$ be associated with an input to $f$, and each of the last $n$ inputs of $f^{*}$ be associated with the negation of an input to $f$. For an $i\in[n]$, let $(x_{i},x_{n+i})$ be the pair of inputs to $f^{*}$ corresponding to the $i$th input to $f$, and say that the pair is balanced if exactly one of $x_{i},x_{n+i}$ is equal to $-1$ (and exactly one is equal to $+1$).

For an input $x\in\{-1,1\}^{2n}$, define $\gamma(x)\in\{-1,+1,\perp\}^{n}$ by

[TABLE]

We say a clause of the DNF formula $\mathcal{C}_{f}$ is satisfied by a vector $y\in\{-1,+1,\perp\}^{n}$ if every literal in that clause is satisfied by $y$ (if $y_{i}=\perp$, then any literal corresponding to an input $i$ or its negation is automatically unsatisfied). Define $f^{*}\colon\{-1,1\}^{2n}\to\{-1,1\}$ by:

[TABLE]

Let $\varepsilon>0$ and suppose $p:\{-1,1\}^{2n}\to\mathbb{R}$ is a polynomial with $|p(x)-f^{*}(x)|\leq\varepsilon$ for every $x\in\{-1,1\}^{2n}$. Then the polynomial $q:\{-1,1\}^{n}\to\mathbb{R}$ defined by $q(y)=p(y_{1},\dots,y_{n},-y_{1},\dots,-y_{n})$ satisfies $|q(y)-f(y)|\leq\varepsilon$ for all $y\in\{-1,1\}^{n}$, since the definition of $f^{*}$ guarantees that $f(y)=f^{*}(y_{1},\dots,y_{n},-y_{1},\dots,-y_{n})$. Hence, for every $\varepsilon>0$, we have

[TABLE]

Completing the Proof of Theorem 38.

Let $f^{*}$ denote the function obtained by applying Definition 42 to the function $f\colon\{-1,1\}^{M}\to\{-1,1\}$ described in the proof of Proposition 39. Recall that $f$ is computed by a DNF $\mathcal{C}_{f}$ of width $M^{o(1)}$. Hence $f^{*}$ is a function on $2M$ variables, and by Inequality (63),

[TABLE]

We now argue that every input $x$ to $f^{*}$ has a certificate $S$ in which at most $M^{o(1)}$ entries of $x|_{S}$ are equal to $+1$. To see this, first let $x$ be any input in $\left(f^{*}\right)^{-1}(-1)$. Then by definition of $f^{*}$, it suffices to certify that (a) there is a clause of $\mathcal{C}_{f}$ that is satisfied by $\gamma(x)$ and (b) there is no $i\in[M]$ such that $(x_{i},x_{M+i})=(+1,+1)$. Letting $w$ denote the width of $\mathcal{C}_{f}$, condition (a) can be certified by providing at most $2w=M^{o(1)}$ indices of $x$, and condition (b) can be certified by supplying all of the coordinates of $x$ that are equal to $-1$.

Now suppose that $x$ is an input in $(f^{*})^{-1}(+1)$. There are two kinds of such inputs to certify. The first kind is any input $x$ with $(x_{i},x_{M+i})=(+1,+1)$ for some $i\in[M]$. Such an input can be certified by providing $x_{i}$ and $x_{M+i}$. The second kind is an input such that for all $i\in[M]$, the pair $(x_{i},x_{M+i})$ has at least one coordinate equal to $-1$, yet no clause of $\mathcal{C}_{f}$ is satisfied by $\gamma(x)$. This kind of input can be certified by providing the indices of all $(-1)$’s in the input $x$. Such a certificate is enough to reveal $(\gamma(x))_{i}$ for all $i$ under the assumption that every pair $(x_{i},x_{M+i})$ with exactly one $(-1)$ provided is balanced. While this certificate does not prove that every pair $(x_{i},x_{M+i})$ is actually balanced, it is still enough to prove that there is no clause of $\mathcal{C}_{f}$ that is satisfied. This is because changing a pair $(x_{i},x_{M+i})$ from balanced to unbalanced cannot cause an unsatisfied clause of $\mathcal{C}_{f}$ to become satisfied.

To summarize, the value of $f^{*}(x)$ can always be certified by providing at most $M^{o(1)}$ indices of $x$ that are equal to $+1$. To complete our construction, let $F=f^{*}\circ\hat{F}$, where $\hat{F}=\mathsf{MAJ}_{10\log M}\circ f$. This is a function on $M^{2+o(1)}$ variables. With the aforementioned property of the certificates of $f^{*}$ in hand, the argument that $\widetilde{\operatorname{deg}}(F)\geq C(F)^{2-o(1)}$ is identical to that of the previous section. Indeed, by composing certificates for $f^{*}$ and $\hat{F}$, one obtains

[TABLE]

Since $\widetilde{\operatorname{deg}}(f^{*})\geq M^{1-o(1)}$, Lemma 41 and Proposition 12 imply that

[TABLE]

Combining Equations (64) and (65) completes the proof of Theorem 38.

5.3 Secret Sharing Schemes

Bogdanov et al. [14] observed that for any $f\colon\{-1,1\}^{n}\to\{-1,1\}$ and integer $d>0$, any dual polynomial $\mu$ for the fact that $\widetilde{\operatorname{deg}}_{\varepsilon}(f)\geq d$ leads to a scheme for sharing a single secret bit $b\in\{-1,1\}$ among $n$ parties as follows. Decompose $\mu$ as $\mu_{+}-\mu_{-}$, where $\mu_{+}$ and $\mu_{-}$ are non-negative functions with $\|\mu_{+}\|_{1}=\|\mu_{0}\|_{1}=1/2$. Then in order to split $b$ among $n$ parties, one draws an input $x=(x_{1},\dots,x_{n})\in\{-1,1\}^{n}$ from the distribution $2\cdot\mu_{b}$, and gives bit $x_{i}$ to the $i$th party. In order to reconstruct $b$, one simply applies $f$ to $(x_{1},\dots,x_{n})$.

Because $\mu$ is $\varepsilon$-correlated with $f$, the probability of correct reconstruction if the bit is chosen at random is at least $(1+\varepsilon)/2$ (and the the reconstruction advantage, defined to equal $\Pr_{x\sim\mu_{+}}[f(x)=1]-\Pr_{x\sim\mu_{-}}[f(x)=1]$, is at least $\varepsilon$). The fact that $\mu$ has pure high degree at least $d$ means that any subset of shares of size less than $d$ provides no information about the secret bit $b$. We direct the interested reader to [14] for further details.

Hence, an immediate corollary of our new approximate degree lower bounds for AC0 is the following.

Corollary 43**.**

For any arbitrarily small constant $\delta>0$, there is a secret sharing scheme that shares a single bit $b$ among $n$ parties by assigning a bit $x_{i}$ to each party $i$. The scheme satisfies the following properties.

1. (a)

The reconstruction procedure is computed by an $\operatorname{AC}^{0}$ circuit. 2. (b)

The reconstruction advantage is at least 0.49. 3. (c)

Any subset of shares of size less than $d=\Omega(n^{1-\delta})$ provides no information about the secret bit $b$.

The above corollary improves over an analogous result of Bogdanov et al. [14], who used the Element Distinctness lower bound (cf. Theorem 27) to give a scheme for which subsets of shares of size less than $d=\Omega(n^{2/3})$ provides no information about the secret bit $b$.

To make the secret sharing scheme of Corollary 43 explicit, one needs an explicit dual polynomial witnessing our new approximate degree lower bounds for AC0 (cf. Theorem 3). Strictly speaking, our proof of Theorem 3 does not achieve this, owing to the primal-based symmetrization step of Section 3. However, this issue is easily addressed.

In more detail, recall that Theorem 26 establishes that there is an AC0 function

[TABLE]

for some $N^{\prime}>N$, such that $G^{\leq N}$ has approximate degree at least $\Omega(N^{1-\delta})$. In fact, the proof of Theorem 26 constructs an explicit dual polynomial $\psi$ witnessing this approximate degree bound. Definition 22 and Corollary 24 define an associated function $g^{*}\colon\{-1,1\}^{m}\to\{-1,1\}$, for $m=\tilde{O}(N)$, such that $\widetilde{\operatorname{deg}}_{\varepsilon}(g^{*})\geq\widetilde{\operatorname{deg}}_{\varepsilon}(G^{\leq N})\cdot\lceil\log(R+1)\rceil.$ A natural averaging construction shows how to translate the dual polynomial $\psi\colon\{-1,1\}^{N^{\prime}}_{\leq N}\to\mathbb{R}$ for $G^{\leq N}$ into a dual polynomial $\phi\colon\{-1,1\}^{m}\to\mathbb{R}$ for $g^{*}$. The analysis in the proof of Theorem 21 can then be used to show that this transformation preserves pure high degree, and that the correlation of $\phi$ with $g^{*}$ is the same as the correlation of $\psi$ with $G^{\leq N}$. (These remarks also apply to the augmented construction of $g$ in Definition 25.)

We further believe that closer inspection of this dual witness should show that shares from the resulting scheme can be sampled by an AC0 circuit.

6 Future Directions

6.1 Stronger Results for Constant Error Approximation

Throughout this section, $\delta$ denotes an arbitrarily small positive constant. While our $\Omega(n^{1-\delta})$ lower bound on the approximate degree of AC0 comes close to resolving Problem 1 from the introduction, we fall short of a complete solution. Can our techniques be refined to give an $\Omega(n)$ lower bound on the approximate degree of a function in AC0? Even the approximate degree of the $\mathsf{SURJECTIVITY}$ function remains unresolved. It is reasonable to conjecture that this function has essentially maximal approximate degree, $\Omega(n)$, yet our methods do not improve on the known $\Omega(n^{2/3})$ lower bound for this function.

It would also be very interesting to extend our $\Omega(n^{1-\delta})$ lower bounds for DNFs of polylogarithmic width and quasipolynomial size to DNFs of polynomial size (and ideally of logarithmic width). Currently, the best known lower bound on the approximate degree of polynomial size DNFs remains $\tilde{\Omega}(n^{2/3})$ for Element Distinctness.

For any constant integer $k>0$, the $k$-sum function is a DNF of width $O(\log n)$ that might have approximate degree $\Omega(n^{k/(k+1)})$ [6, 13]. Another candidate DNF that might have approximate degree polynomially larger than $\Omega(n^{2/3})$ is the $k$-distinctness function for $k\geq 3$. (The best known upper bound on the approximate degree of the $k$-distinctness function is $O(n^{1-2^{k-2}/(2^{k}-1)})$; this bound approaches $n^{3/4}$ as $k\rightarrow\infty$ [12].) However, we believe that substantially new techniques will be required to resolve the approximate degree of these specific candidates. As explained in Section 1.3.1, our analysis is tailored to showing (near-)optimality of robustification-based approximating polynomials for the functions we consider, in a sense that can be made precise via complementary slackness. But the best known approximating polynomials for $k$-sum and $k$-distinctness are derived from sophisticated quantum algorithms [6, 12]. In particular, they are not constructed via robustification. Hence, we expect that any proof of a novel approximate degree lower bound for these functions will have to look very different than our own, as they will have to implicitly engage with non-robustification based approximating polynomials.

6.2 Stronger Results for Large Error Approximation

Another open direction is to strengthen our $\varepsilon$-approximate degree lower bounds on AC0 from $\varepsilon=1/3$ to $\varepsilon$ much closer to 1. For example, the following two variants of Problem 1 from the introduction are open.

Problem 2**.**

Is there a constant-depth circuit in $n$ variables with $\varepsilon$-approximate degree $\Omega(n)$, for (say) $\varepsilon=1-2^{-\Omega(n)}$?

Problem 3**.**

Is there a constant-depth circuit in $n$ variables with $\varepsilon$-approximate degree $\Omega(n)$, for any $\varepsilon<1$?

Problem 3 is equivalent to asking whether there is an AC0 function with linear threshold degree. Resolving Problems 2 and 3 would have a wide variety of consequences in computational learning theory, circuit complexity, and communication complexity (see, e.g., [15, 57, 19] and the references therein).

Despite attention by many researchers, the best known lower bounds in the directions of Problems 3 and 4 are:

1. (a)

For any constant $\Gamma>0$, a depth-3 circuit with $\varepsilon$-approximate degree $\Omega(n^{1/2-\delta})$ for $\varepsilon=1-2^{-n^{\Gamma}}$ [19], 2. (b)

A depth-3 circuit with threshold degree $\Omega(n^{3/7})$ [46], and 3. (c)

A depth-4 circuit with threshold degree $\Omega(n^{1/2})$ [46].

We believe that the following three results in the directions of Problems 2 and 3 should be achievable via relatively modest extensions of our techniques.

First, it should be possible to nearly resolve Problem 2 as follows. Recall from Section 1.2.1 that our recent work [19] also proved stronger hardness amplification results for approximate degree by moving beyond block composed functions. The methods of [19] amplify approximation error but not degree, while in this paper we amplify degree but not approximation error. We believe that it is possible to combine the two sets of techniques to exhibit a function in AC0 on $n$ variables with $\varepsilon$-approximate degree at least $n^{1-\delta}$, even for $\varepsilon=1-2^{-\Omega(n^{1-\delta})}$. Such a result would translate in a black-box manner into lower bounds of $2^{\Omega(n^{1-\delta})}$ on the margin complexity, (multiplicative inverse of) discrepancy, threshold weight, and Majority-of-Threshold circuit size of AC0, nearly matching trivial $2^{O(n)}$ upper bounds.

Second, we are confident that the polylogarithmic width DNF $f\colon\{-1,1\}^{n}\to\{-1,1\}$ of approximate degree $\Omega(n^{1-\delta})$ exhibited in Theorem 4 in fact has large one-sided approximate degree [18]. Moreover, this should be provable via a modest extension of our techniques. Combining such a lower bound with a result of Sherstov [57] would imply that $\mathsf{AND}_{n^{1-\delta}}\circ f$ has threshold degree $\Omega(n^{1-\delta})$, thereby yielding a depth three circuit (of quasipolynomial size) on $N=n^{2-2\delta}$ variables with threshold degree $\Omega(N^{1/2-\delta})$.

Third, we believe that the following function $g$ on $O(n\log^{4}n)$ variables has threshold degree $\Omega(n^{3/5})$. Let $f_{n}=\mathsf{AND}_{n^{1/5}}\circ\mathsf{OR}_{n^{2/5}}\circ\mathsf{AND}_{n^{2/5}}$, and let $g$ be the harder function obtained by applying the construction of Theorem 5 to $f_{n}$. Note that $g$ is computed by a circuit of depth 5.

Sherstov [57] constructed a dual polynomial $\psi$ witnessing the fact that

[TABLE]

(Note that this block composed function is defined over $n^{7/5}$ variables.) In order to show that $g$ likewise has threshold degree $\Omega(n^{3/5})$, our results from Section 3 imply that it is enough to “zero out” the mass that $\psi$ places on inputs of Hamming weight larger than a suitable threshold $N=\tilde{O}(n)$, without affecting the sign of $\psi$ on the remaining inputs. We believe that is possible to achieve this via a refinement of the zeroing technique used in this work.

A final ambitious direction.

A more ambitious direction toward resolving Problems 2 and 3 would be to obtain a version of our hardness amplification result (Theorem 5) that (a) applies to threshold degree rather than approximate degree and (b) can be applied recursively. This would allow one to obtain an $\Omega(n^{1-\delta})$ lower bound on the threshold degree of AC0, nearly resolving Problem 3 above.

One might hope to obtain such a result by extending the above envisioned analysis for obtaining an $\Omega(n^{3/5})$ threshold degree lower bound, so as to allow recursive application of the construction and analysis. However, we believe that achieving this goal will require substantial new ideas. The only available techniques for recursively amplifying threshold degree bounds are due to Sherstov [57, 46], who considers block composed functions of the form $\mathsf{OR}\circ f$. Specifically, he uses a dual witness for the outer function $\mathsf{OR}$ to “amplify the efficacy” of a dual witness for the inner function $f$.

In contrast, our recursive construction in this paper considers block compositions of the form $f\circ\mathsf{OR}$, and uses a dual witness for the inner function $\mathsf{OR}$ to “amplify the efficacy” of a dual witness for the outer function $f$. This difference appears to prevent us from combining the methods of [57] with our own in a manner that would enable recursive application. Finding a way to reconcile the two approaches may present a promising avenue for obtaining a (near-)resolution of Problem 3.

Acknowledgements. We are grateful to Shalev Ben-David for illuminating conversations regarding separations between approximate degree and certificate complexity, and to Robin Kothari and Sasha Sherstov for valuable comments on an earlier version of this manuscript.

Appendix A A Refined Dual Witness for $\mathsf{OR}$

Our goal is to prove the following equivalent formulation of Lemma 29.

Lemma 44**.**

Let $k\in\mathbb{N}$. There exists a constant $c_{1}\in(0,1)$ and a function $\omega:\{0,1,\dots,k\}\to\mathbb{R}$ such that

[TABLE]

[TABLE]

[TABLE]

[TABLE]

In the proof of Lemma 44, we make use of the following combinatorial identity.

Fact 45**.**

Let $k\in\mathbb{N}$, and let $p$ be a polynomial of degree less than $k$. Then

[TABLE]

Proof of Lemma 29.

Let $c=25$ below. Let $m=\lfloor\sqrt{k/c}\rfloor$ and define the set

[TABLE]

Note that $|T|=\Omega(\sqrt{k})$. Define the polynomial

[TABLE]

It is immediate from Fact 45 that $\omega$ satisfies (67) for $c_{1}=1/\sqrt{c}$. By inspection, we have $\omega(0)>0$ and $\omega(1)<0$.

Expanding out the binomial coefficient reveals that

[TABLE]

For $t=1$, we observe

[TABLE]

On the other hand, for $t=2$, we have

[TABLE]

where the first inequality follows from the fact that $\prod_{i=1}^{m}(1-a_{i})\geq 1-\sum_{i=1}^{m}a_{i}$ for $a_{i}\in(0,1)$.

For $t=cj^{2}$ with $j\geq 1$, we get

[TABLE]

where the last inequality follows because

[TABLE]

is a product of factors that are each smaller than 1. Since

[TABLE]

for $c\geq 8$, this establishes (69).

What remains is to perform the correlation calculation to establish (66). First, observe that the total contribution of $t>2$ to $\|\omega\|_{1}/\omega(0)$ is at most

[TABLE]

Next, we calculate

[TABLE]

On the other hand,

[TABLE]

Combining (72) and (73), and using the fact that $-\omega(1)\geq 2\omega(0)$ shows that

[TABLE]

This establishes (66), completing the proof.

∎