Non-Uniform Attacks Against Pseudoentropy

TL;DR

This paper extends known non-uniform distinguishability results from pseudorandom distributions to those with limited min-entropy, showing they are similarly vulnerable to efficient distinguishing circuits.

Contribution

It generalizes previous results to distributions with bounded min-entropy, demonstrating they can be distinguished from higher min-entropy distributions with comparable circuit complexity.

Findings

Distributions with less than k bits of min-entropy can be distinguished from those with δ-smooth min-entropy using circuits of size O(2^k ε^2/δ^2).

Distributions supported on at most 2^k elements can be distinguished from distributions with min-entropy k+1 with size O(2^k ε^2).

Pseudoentropy distributions are vulnerable to the same non-uniform attacks as pseudorandom distributions.

Abstract

De, Trevisan and Tulsiani [CRYPTO 2010] show that every distribution over $n$-bit strings which has constant statistical distance to uniform (e.g., the output of a pseudorandom generator mapping $n-1$ to $n$ bit strings), can be distinguished from the uniform distribution with advantage $\epsilon$ by a circuit of size $O( 2^n\epsilon^2)$. We generalize this result, showing that a distribution which has less than $k$ bits of min-entropy, can be distinguished from any distribution with $k$ bits of $\delta$-smooth min-entropy with advantage $\epsilon$ by a circuit of size $O(2^k\epsilon^2/\delta^2)$. As a special case, this implies that any distribution with support at most $2^k$ (e.g., the output of a pseudoentropy generator mapping $k$ to $n$ bit strings) can be distinguished from any given distribution with min-entropy $k+1$ with advantage $\epsilon$ by a circuit of size $O(2^k\epsilon^2)$. Our result thus shows that pseudoentropy distributions face basically the same non-uniform attacks as pseudorandom distributions.

Figures

Equations

$${\mathsf{H}}_{\tilde{O}(2^k{ϵ}^2{\delta }^{-2}),ϵ}^{\mathsf{HILL}}(X)<k$$

$${\mathsf{H}}_{\tilde{O}(2^k{ϵ}^2),ϵ}^{\mathsf{HILL}}(f(U_k))\le k+1.$$

$${\mathsf{H}}_{\tilde{O}(2^k{ϵ}^2),ϵ}^{\mathsf{HILL}}(X)\le k+1.$$

$$\mathsf{AverageMaxLoad}(X)\approx 0.5+\sqrt{2/\pi }\cdot 2^{-k/2}\text{ w.h.p. when drawing from }X$$

$$\mathsf{AverageMaxLoad}(Y)\approx 0.5+\sqrt{2/\pi }\cdot 2^{-k^{\prime }/2}\text{ w.h.p. when drawing from }Y$$

$$\mathsf{AverageMaxLoad}(X)-\mathsf{AverageMaxLoad}(Y)=\Omega (2^{-k/2}).$$

$$\sum _x\max (P_X(x)-2^{-k},0)⩾\delta .$$

$${\mathsf{Adv}}^{\mathsf{D}}(X;Y)=\left|\sum _x\mathsf{D}(x)(P_X(x)-P_Y(x))\right|$$

$$E\left[{\left({\mathsf{Adv}}^{\mathsf{D}}(X;Y)\right)}^2\right]=E{\left|\sum _x\mathsf{D}(x)(P_X(x)-P_Y(x))\right|}^2=\sum _x(P_X(x)-P_Y(x){)}^2$$

$$\sum _{x\in S}(P_X(x)-P_Y(x){)}^2⩾\sum _{x\in S}(P_X(x)-2^{-k}{)}^2⩾|S{|}^{-1}{\left(\sum _{x\in S}\left(P_X(x)-2^{-k}\right)\right)}^2⩾2^{-k}{\delta }^2$$

$$E\left[{\left({\mathsf{Adv}}^{\mathsf{D}}(X;Y)\right)}^2\right]⩾2^{-k}{\delta }^2$$

$${\mathsf{Adv}}^{\mathsf{D}}(X;Y)⩾2^{-\frac{k}{2}}\delta .$$

$${\left(d_2(P_X;P_Y)\right)}^2=\sum _{i=1}^T{\left(d_2(P_X;P_Y|S_i)\right)}^2$$

$$d_2(P_X;P_Y|S_i)$$

$$\hat{\mathsf{D}}(x)={\beta }_i\mathsf{D}(x),\text{ where i is such that }x\in S_i,$$

$${\mathsf{Adv}}^{\hat{\mathsf{D}}}(X;Y)=\sum _{i=1}^T{\mathsf{Adv}}_{S_i}^{\mathsf{D}}(X;Y)=\Omega \left(T^{\frac{1}{2}}{2}^{-\frac{k}{2}}\delta \right)$$

$$E{\mathsf{Adv}}_{S_i}^{\hat{\mathsf{D}}}(X;Y)=\Omega \left(T^{-\frac{1}{2}}{d}_2(P_X;P_Y)\right)=\Omega \left(T^{-\frac{1}{2}}{2}^{-\frac{k}{2}}\delta \right).$$

$$\mathrm{Pr}\left[\sum _{i=1}^T{\mathsf{Adv}}_{S_i}^{\hat{\mathsf{D}}}⩾\Omega (1)\cdot T^{\frac{1}{2}}{2}^{-\frac{k}{2}}\delta \right]>\Omega (1).$$

$${\mathsf{Adv}}_{S_i}^{\mathsf{D}}(X;Y)=\left|\sum _x(P_X(x)-P_Y(x))1_{S_i}(x)\mathsf{D}(x)\right|$$

$${\mathsf{Adv}}_{S_i}^{\mathsf{D}}(X;Y)=\left|\sum _x{\xi }_{i,x}\right|$$

$$\Vert Z{\Vert }_p⩽{\left(\Vert Z{\Vert }_{p_1}\right)}^{\theta }{\left(\Vert Z{\Vert }_{p_2}\right)}^{1-\theta }$$

$$\frac{1}{\sqrt{3}}{\left(\sum _{x\in \mathcal{X}}\mathrm{Var}(\xi (x))\right)}^{\frac{1}{2}}⩽$$

$$E{\left|\sum _{x\in \mathcal{X}}\xi (x)\right|}^2=\sum _{x\in \mathcal{X}}\mathrm{Var}(\xi (x))$$

$${\left(\sum _{x\in \mathcal{X}}\mathrm{Var}(\xi (x))\right)}^2⩽$$

$$\mathrm{Pr}\left[Z>\theta EZ\right]⩾(1-\theta {)}^2\frac{(EZ{)}^2}{E{Z}^2}.$$

$$\mathrm{Pr}\left[\left|\sum \xi (x)\right|>\frac{1}{3}{\left(\sum \mathrm{Var}(\xi (x))\right)}^{\frac{1}{2}}\right]>\frac{1}{17}.$$

$$H_{\infty }^{\delta }(X)⩾k⟺\sum _{x\in \mathcal{X}}\max \left(P_X(x)-2^{-k},0\right)⩽\delta .$$

$$\sum _{x\in S}\left|P_X(x)-P_Y(x)\right|>\delta$$

$$\sum _{x\in S}\left(P_X(x)-P_Y(x)\right)>\delta$$

$${\left(\sum _{x\in S}{\left(P_X(x)-P_Y(x)\right)}^2\right)}^{\frac{1}{2}}>|S{|}^{-1/2}\sum _{x\in S}\left|P_X(x)-P_Y(x)\right|.$$

$$|S{|}^{-1}\left(\sum _{x\in S}{\left(P_X(x)-P_Y(x)\right)}^2\right)>{\left(|S{|}^{-1}\sum _{x\in S}\left|P_X(x)-P_Y(x)\right|\right)}^2$$

$$\left|\sum _{x\in S}\mathsf{D}(x)(P_X(x)-P_Y(x))\right|>\frac{1}{3}\cdot d_2(P_X;P_Y)$$

Full text

We generalize this result, showing that a distribution which has less than $k$ bits of min-entropy, can be distinguished from any distribution with $k$ bits of $\delta$-smooth min-entropy with advantage $\epsilon$ by a circuit of size $O(2^{k}\epsilon^{2}/\delta^{2})$. As a special case, this implies that any distribution with support at most $2^{k}$ (e.g., the output of a pseudoentropy generator mapping $k$ to $n$ bit strings) can be distinguished from any given distribution with min-entropy $k+1$ with advantage $\epsilon$ by a circuit of size $O(2^{k}\epsilon^{2})$.

Our result thus shows that pseudoentropy distributions face basically the same non-uniform attacks as pseudorandom distributions.

1. Introduction

De, Trevisan and Tulsiani [2] show a non-uniform attack against any pseudorandom generator (PRG) which maps ${\{0,1\}}^{n-1}\rightarrow{\{0,1\}}^{n}$. For any $\epsilon\geq 2^{-n/2}$, their attack achieves distinguishing advantage $\epsilon$ and can be realized by a circuit of size $O\left(2^{n}\epsilon^{2}\right)$. Their attack doesn’t even need the PRG to be efficiently computable.

In this work we consider a more general question, where we ask for attacks distinguishing a distribution from any distribution with slightly higher min-entropy. We generalize [2], showing a non-uniform attack which, for any $\epsilon,\delta>0$, distinguishes any distribution with $<k$ bits of min-entropy from any distribution with $k$ bits of $\delta$-smooth min-entropy with advantage $\epsilon$, and where the distinguisher is of size $O(2^{k}\epsilon^{2}/\delta^{2})$. As a corollary we recover the [2] result, showing that the output of any pseudoentropy generator ${\{0,1\}}^{k}\rightarrow{\{0,1\}}^{n}$ can be distinguished from any variable with min-entropy $k+1$ with advantage $\epsilon$ by circuits of size $O(2^{k}\epsilon^{2})$.

• •

From a theoretical perspective, we prove where the separation between pseudoentropy and smooth min-entropy lies, by classifying how powerful computationally bounded adversaries can be so they can still be fooled to “see” more entropy than there really is.

• •

From a more practical perspective, our result shows that using pseudoentropy instead of pseudorandomness (which for many applications is sufficient and allows for saving in entropy quantity [3]), will not give improvements in terms of quality (i.e., the size and advantage of distinguishers considered), at least not against generic non-uniform attacks.

1.1. Notation and Basic Definitions

Two variables $X$ and $Y$ are $(s,\epsilon)$ indistinguishable, denoted $X\sim_{s,\epsilon}Y$, if for all boolean circuits $D$ of size $|D|\leq s$ we have $|\Pr[D(X)=1]-\Pr[D(Y)=1]|\leq\epsilon$. The statistical distance of $X$ and $Y$ is $d_{1}(X;Y)\stackrel{{\scriptstyle{\sf def}}}{{=}}\sum_{x}|P_{X}(x)-P_{Y}(x)|$ (where $P_{X}(x)\stackrel{{\scriptstyle{\sf def}}}{{=}}\Pr[X=x]$), the Euclidean distance of $X$ and $Y$ is $d_{2}(P_{X};P_{Y})\stackrel{{\scriptstyle{\sf def}}}{{=}}\sqrt{\sum_{x}(P_{X}(x)-P_{Y}(x))^{2}}$. A variable $X$ has min-entropy $k$ if it doesn’t take any particular outcome with probability greater $2^{-k}$, it has $\delta$-smooth min-entropy $k$ [6], if it’s $\delta$ close to some distribution with min-entropy $k$. $X$ has $k$ bits of HILL pseudoentoentry of quality $(s,\epsilon)$ if there exists a $Y$ with min-entropy $k$ that is $(s,\epsilon)$ indistinguishable from $X$, we use the following standard notation for these notions

**: **

min-entropy: ${\sf H}_{\infty}(X)\stackrel{{\scriptstyle{\sf def}}}{{=}}-\log\max_{x}\left(\Pr[X=x]\right)\ .$

**: **

smooth min-entropy: ${\sf H}_{\infty}^{\delta}(X)\stackrel{{\scriptstyle{\sf def}}}{{=}}\max_{Y,d_{1}(X;Y)\leq\delta}{\sf H}_{\infty}(Y)\ .$

**: **

HILL pseudoentropy: ${\sf H}^{\sf HILL}_{s,\epsilon}(X)\stackrel{{\scriptstyle{\sf def}}}{{=}}\max_{Y,Y\sim_{(s,\epsilon)}X}{\sf H}_{\infty}(Y)\ .$

1.2. Our Contribution

In this work give generic non-uniform attacks on pseudoentropy distributions. A seemingly natural goal is to consider a distribution $X$ with ${\sf H}_{\infty}(X)\leq k$ bits of min-entropy, strictly larger ${\sf H}^{\sf HILL}_{s,\epsilon}(X)\geq k+1$ bits of HILL entropy, and then give an upper bound on $s$ in terms of $\epsilon$. This does not work as there are $X$ where ${\sf H}_{\infty}(X)\ll{\sf H}_{\infty}^{\delta}(X)$,222Consider an $X$ which is basically uniform over ${\{0,1\}}^{n}$, but has mass $\delta$ on one particular point, then $\log\delta^{-1}={\sf H}_{\infty}(X)\ll{\sf H}_{\infty}^{\delta}(X)=n$. and as by definition ${\sf H}_{\infty}^{\delta}(X)={\sf H}^{\sf HILL}_{\infty,\delta}(X)$, we can have a large entropy gap ${\sf H}^{\sf HILL}_{\infty,\delta}(X)-{\sf H}_{\infty}(X)$ even when considering unbounded adversaries against HILL entropy. For this reason, in our main technical result Lemma 1 below, we must consider distributions with bounded smooth min-entropy. This makes the statement of the lemma somewhat technical. In practice, the distributions considered often have bounded support, for example because they were generated from a short seed by a deterministic process (like a pseudorandom generator). In this case we can drop the smoothness requirement as stated in Theorem 1.1 below.

Lemma 1** (Nonuniform attacks against pseudoentropy).**

Suppose that $X\in{\{0,1\}}^{n}$ does not have $k$ bits of $\delta$-smooth min-entropy, i.e., ${\sf H}_{\infty}^{\delta}(X)<k$, then for any $\epsilon$ we have

[TABLE]

where $\tilde{O}(\cdot)$ hides a factor linear in $n$.

Theorem 1.1**.**

Let $f:{\{0,1\}}^{k}\rightarrow{\{0,1\}}^{n}$ be a deterministic (not necessarily efficient) function. Then we have

[TABLE]

more generally, for any $X$ over ${\{0,1\}}^{n}$ with support of size $\leq 2^{k}$

[TABLE]

Remark 1.2** (Concluding best attacks against PRGs).**

For the special case $n=k+1$ we recover the bound for pseudorandom* generators from [2].*

Proof 1.3** (Proof of Theorem 1.1).**

The theorem follows from Lemma 1 when $\delta=1/2$; consider any $X$ with support of size $\leq 2^{k}$, then ${\sf H}_{\infty}^{\delta}(X)\leq k+1$, as no matter how we cut probability mass of $1-\delta=1/2$ over $2^{k}$ elements, one element will have the weight at least $2^{-k-1}$.

1.3. Proof Outline

1.3.1. A Weaker Result as a Ball-Bins Problem

We outline the proof of a somewhat weakened version of Theorem 1.1 in the language of balls and bins. For every $Y$ of min-entropy $k^{\prime}=k+\Omega(1)$ we want to distinguish $Y$ from $X=f(U_{k})$. Suppose for simplicity that $Y$ is flat and $f$ is injective, so that $X$ is also flat. Our strategy will be to hash the points randomly into two bins and take advantage of the fact that the average maximum load is closer to $\frac{1}{2}$ when we sample from $Y$ than when drawing from $X$. The reason is that $Y$ has more balls, so by the law of large numbers, we expect the load to be “more concentrated” around the mean.

Think of throwing balls (inputs $x$) into two bins (labeled by $-1$ and $1$). If the balls come from the support of $X$, the expected maximum load (over two bins) equals $\approx 2^{k-1}+\sqrt{2/\pi}\cdot 2^{k/2}$. Similarly, if the balls come from the support of $Y$, then maximum load is $2^{k^{\prime}-1}+\sqrt{2/\pi}\cdot 2^{k^{\prime}/2}$. In terms of the average load (the load normalized by the total number of balls)

[TABLE]

As $k^{\prime}=k+\Omega(1)$ we obtain (with good probability)

[TABLE]

Letting $\mathsf{D}$ be one of these bins assignments we obtain a distinguisher with advantage $\epsilon=\Omega(2^{-k/2})$. To generate the assignments efficiently we relax the assumption about choosing bins and assume only that the choices of bins are independent for any group of $\ell=4$ balls. The fourth moment method allows us to keep sufficiently good probabilistic guarantees on the maximum load.

1.3.2. The General Case by Random Walk Techniques

A high-level outline and comparison to [2]

Below in Figure 1 we sketch the flow of our argument.

Our starting point is the proof from [2]. They use the fact that a random mapping $\mathsf{D}:{\{0,1\}}^{n}\rightarrow\{-1,1\}$ likely distinguishes any two distributions $X$ and $Y$ over ${\{0,1\}}^{n}$ with advantage being the Euclidean distance $d_{2}(X;Y)\stackrel{{\scriptstyle{\sf def}}}{{=}}\sqrt{\sum_{x}(P_{X}(x)-P_{Y}(x))^{2}}$.

For any $X$ and $Y$ with constant statistical distance $\sum_{x}|P_{X}(x)-P_{Y}(x)|=\Theta(1)$ (which is the case for the PRG setting where $Y=U_{n}$ and $X=PRG(U_{n-1})$) this yields a bound $\Omega\left(2^{-\frac{n}{2}}\right)$. This bound can be then amplified, at the cost of extra advice, by partitioning the domain ${\{0,1\}}^{n}$ and combining corresponding advantages (advice basically encodes if there is a need for flipping the output). Finally one can show that $4$-wise independence provides enough randomness for this argument, which makes sampling $\mathsf{D}$ efficient. Our argument deviates from this approach in two important aspects.

The first difference is that in the pseudoentropy case we can improve the advantage from $\Omega\left(2^{-\frac{n}{2}}\right)$, where $n$ is the logarithm of the support of the variables considered, to $\Omega\left(2^{-\frac{k}{2}}\right)$, where $k$ is the min-entropy of the variable we want to distinguish from. The reason is that being statistically far from any $k$-bit min-entropy distributions implies a large bias on already $2^{k}$ elements. This fact (see Lemmas 3.1 and 3.2, and also Figure 3) is a new characterization of smooth min-entropy of independent interest.

The second subtlety arises when it comes to amplify the advantage over the partition slices. For the pseudorandomness case it is enough to split the domain in a deterministic way, for example by fixing prefixes of $n$-bit strings, in our case this is not sufficient. For us a “good” partition must shatter the $2^{k}$-element high-biased set, which can be arbitrary. Our solution is to use random partitions, in fact, we show that using $4$-universal hashing is sufficient. Generating base distinguishers and partitions at the same time makes probability calculations more involved.

Technical calculations are based on the fourth moment method, similarly as in [2]. The basic idea is that for settings where the second and fourth moment are easy to compute (e.g. sums of independent symmetric random variables) we can obtain good upper and lower bounds on the first moment. In the context of algorithmic applications these techniques are usually credited to [1]. Interestingly, exploiting natural relations to random walks, we show that calculations immediately follow by adopting classical (almost one century old) tools and results [5, 4]. Our technical novelty is an application of moment inequalities due to Marcinkiewicz-Zygmund and Paley-Zygmund, which allow us to prove slightly more than just the existence of an attack. Namely we generate it with constant success probability.

Advantage $\Omega(2^{-k/2})$

Consider any $X$ with $\delta$-smooth min-entropy smaller than $k$. This requirement can be seen as a statement about the “shape” of the distribution. Namely, the mass of $X$ that is above the threshold $2^{-k}$ equals at least $\delta$, that is

[TABLE]

For an illustration see Figure 2.

We construct our attack based on this observation. Define the advantage of a function $\mathsf{D}$ for distributions $X$ and $Y$ as

[TABLE]

(writing also $\mathsf{Adv}^{\mathsf{D}}_{S}$ when the summation is restricted to a subset $S$). Consider a random distinguisher $\mathsf{D}:{\{0,1\}}^{n}\rightarrow\{-1,1\}$. Random variables $\mathsf{D}(x)$ for different $x$ are independent, have zero-mean and second moment equal to 1. Therefore the expected square of of the advantage, over the choice of $\mathsf{D}$, equals

[TABLE]

Let $S$ be the set of $x$ such that $P_{X}(x)>2^{-k}$. For any $Y$ of min-entropy at least $k$ we obtain

[TABLE]

where the first inequality follows because $P_{Y}(x)\leqslant 2^{-k}<P_{X}(x)$ for $x\in S$, the second inequality is by the standard inequality between the first and second norm, and the third inequality follows because we showed that $\Pr[X\in S]\geqslant|S|\cdot 2^{-k}+\delta$ (illustrated in Figure 2) which also implies $|S|^{-1}\geqslant 2^{-k}$.

By the previous formula on the expected squared advantage this means that

[TABLE]

for at least one choice of $\mathsf{D}$. This implies

[TABLE]

A random $\mathsf{D}$ as defined would be of size exponential in $n$, but since we used only the second moment in calculations, it suffices to generate $\mathsf{D}(x)$ as pairwise independent random variables. By assuming $4$-wise independence – which can be computed by $O(n^{2})$ size circuits – we can prove slightly more, namely that a constant fraction of generated $\mathsf{D}$’s are good distinguishers. This property will be important for the next step, where we amplify the advantage assuming larger distinguishers.

Leveraging the advantage by slicing the domain

Consider a random and equitable partition $\{S_{i}\}_{i=1}^{T}$ of the set $\{0,1\}^{n}$. From the previous analysis we know that a random distinguisher achieves advantage $\epsilon=d_{2}(P_{X};P_{Y})$ over the whole domain. Note that (for any, not necessarily random partition $\{S_{i}\}_{i}$) we have

[TABLE]

where $d_{2}(P_{X};P_{Y}|S_{i})$ is the restriction of the distance to the set $S_{i}$ (by restricting the summation to $S_{i}$). From a random partition we expect the mass difference between $P_{X}$ and $P_{Y}$ to be distributed evenly among the partition slices (see Figure 3(b)). Based on the last equation, we expect

[TABLE]

to hold with high probability over $\{S_{i}\}_{i}$.

In fact, if the mass difference is not well balanced amongst the slices (in the extreme case, concentrated on one slice) our argument will not offer any gain over the previous construction (see Figure 3(a)).

By applying the previous argument to individual slices, for every $i$ we can obtain an advantage $\mathsf{Adv}^{\mathsf{D}}_{S_{i}}(X;Y)=\Omega\left((T^{-\frac{1}{2}}2^{-\frac{k}{2}})\delta\right)$ when restricted to the set $S_{i}$ (with high probability over the choice of $\mathsf{D}$ and $\{S_{i}\}_{i}$). Now if the sets $S_{i}$ are efficiently recognizable, we can combine them into a better distinguisher. Namely for every $i$ we chose a value $\beta_{i}\in\{-1,1\}$ such that $\mathsf{D}$’s advantage (before taking the absolute value) restricted to $S_{i}$ has sign $\beta_{i}$, and set

[TABLE]

then the advantage equals (with high probability over $\mathsf{D}$ and the $S_{i}$’s)

[TABLE]

We need to specify a $4$-wise independent hash for $\mathsf{D}$, another $4$-wise independent hash for deciding in which of the $T$ slices an element lies, and $T$ bits to encode the $\beta_{i}$’s. Thus for a given $T$ the size of $\hat{\mathsf{D}}$ will be $T+\tilde{O}(n)$. Using the above equation, we then get a smooth tradeoff $s=O(2^{k}\epsilon^{2}\delta^{-2})$ between the advantage $\epsilon$ and the circuit size $s$. This discussion shows that to complete the argument we need the following two properties of the partition (a) the mass difference between $P_{X}$ and $P_{Y}$ is (roughly) equidistributed among slices and (b) the membership in partition slices can be efficiently decided.

Slicing using $4$-wise independence

To complete the argument, we assume that $T$ is a power of $2$, and generate the slicing by using a $4$-universal hash function $h:{\{0,1\}}^{n}\rightarrow{\{0,1\}}^{\log{T}}$. The $i$-th slice $S_{i}$ is defined as $\{x\in{\{0,1\}}^{n}:h(x)=i\}$. These assumptions are enough to prove that

[TABLE]

Interestingly, the expected advantage (left-hand side) cannot be computed directly. The trick here is to bound it in terms of the second and fourth moment. The above inequality, coupled with bounds on second moments of the advantage $\mathsf{Adv}^{\hat{\mathsf{D}}}_{S_{i}}$ (obtained directly), allows us to prove that

[TABLE]

This shows that there exists the claimed distinguisher $\hat{\mathsf{D}}$. In fact, a constant fraction of generated (over the choice of $\mathsf{D}$ and $\{\S_{i}\}_{i}$) distinguishers $\hat{\mathsf{D}}$’s works.

Random walks

From a technical point of view, our method involves computing higher moments of the advantages to obtain concentration and anti-concentration results. The key observation is that the advantage written down as

[TABLE]

which can be then studied as a random walk

[TABLE]

with zero-mean increments $\xi_{i,x}=(P_{X}(x)-P_{Y}(x))\mathbf{1}_{S_{i}}(x)\mathsf{D}(x)$. The difference with respect to classical model is that the increments are only $\ell$-wise independent (for $\ell=4$). However, that classical moment bounds still apply (see Sections 2.2 and 2.3 for more details).

2. Preliminaries

2.1. Interpolation Inequalities

Interpolation inequalities show how to bound the $p$-th moment of a random variable if we know bounds on one smaller and one higher moment. The following result is known also as log-convexity of $L_{p}$ norms, and can be proved by the Hölder Inequality

Lemma 2.1** (Moments interpolation).**

For any $p_{1}<p<p_{2}$ and any bounded random variable $Z$ we have

[TABLE]

where $\theta$ is such that $\frac{\theta}{p_{1}}+\frac{1-\theta}{p_{2}}=\frac{1}{p}$, and for any $r$ we define $\|Z\|_{r}=\left(\operatorname{\mathbb{E}}|Z|^{r}\right)^{\frac{1}{r}}$.

Alternatively, we can lower bound a moment given two higher moments. This is very useful when higher moments are easier to compute. In this work will bound first moments from below when we know the second and the fourth moment (which are easier to compute as they are even-order moments)

Corollary 2.2**.**

For any bounded $Z$ we have $\operatorname{\mathbb{E}}|Z|\geqslant\frac{\left(\operatorname{\mathbb{E}}|Z|^{2}\right)^{\frac{3}{2}}}{\left(\operatorname{\mathbb{E}}|Z|^{4}\right)^{\frac{1}{2}}}$.

2.2. Moments of random walks

For a random walk $\sum_{x}\xi(x)$, where $\xi(x)$ are independent with zero-mean, we have good control over the moments, namely $\operatorname{\mathbb{E}}\left|\sum_{x}\xi(x)\right|^{p}=\Theta(1)\cdot\left(\sum_{x}\mathrm{Var}(\xi(x))\right)^{\frac{p}{2}}$ where constants depend on $p$. This result is due to Marcinkiewicz and Zygmund [5] who extended the former result of Khintchine [4]. Below we notice that for small moments $p$ it suffices to assume only $p$-wise independence (most often used versions assume fully independence)

Lemma 2.3** (Strengthening of Marcinkiewicz-Zygmund’s Inequality for $p=4$).**

Suppose that $\{\xi(x)\}_{x\in\mathcal{X}}$ are $4$-wise independent, with zero mean. Then we have

[TABLE]

The proof appears in Section 4.1.

2.3. Anticontentration bounds

Lemma 2.4** (Paley-Zygmund Inequality).**

For any positive random variable $Z$ and a parameter $\theta\in(0,1)$ we have

[TABLE]

By applying Lemma 2.4 to the setting of Lemma 2.3, and choosing $\theta=\frac{1}{\sqrt{3}}$ we obtain

Corollary 2.5** (Anticoncentration for walks with $4$-wise independent increments).**

Suppose that $\{\xi(x)\}_{x\in\mathcal{X}}$ are $4$-wise independent with zero-mean, then we have

[TABLE]

where the summation is over $x\in\mathcal{X}$.

3. Proof of Lemma 1

Lemma 3.1** (Characterizing smooth min-entropy).**

For any random variable $X$ with values in a finite set $\mathcal{X}$, any $\delta$ and $k$ we have the following equivalence

[TABLE]

The proof appears in Section 4.2. We will work with the following equivalent statement

Corollary 3.2** (No smooth min-entropy $k$ implies bias w.r.t. distributions of min-entropy $k$ over at most $2^{k}$ elements).**

We have ${\sf H}_{\infty}^{\delta}(X)<k$ if and only if there exists a set $S$ of at most $2^{k}$ elements such that

[TABLE]

for all $Y$ of min-entropy at least $k$.

Proof 3.3** (Proof of Corollary 3.2).**

The direction $\Longleftarrow$ trivially follows by the definition of smooth min-entropy. Now assume ${\sf H}_{\infty}^{\delta}(X)<k$. Let $S$ be the set of all $x$ such that $P_{X}(x)>2^{-k}$, then $|S|<2^{k}$, and moreover by Lemma 3.1 we have $\sum_{x\in S}\left(P_{X}(x)-2^{-k}\right)>\delta$. In particular for any $Y$ of min-entropy $k$ (i.e., $P_{Y}(x)\leqslant 2^{-k}$ for all $x$)

[TABLE]

Lemma 3.4** (Bias implies Euclidean distance).**

For any distributions $P_{X},P_{Y}$ on $\mathcal{X}$ and any subset $S$ of $\mathcal{X}$ we have

[TABLE]

Proof 3.5**.**

By the Jensen Inequality we have

[TABLE]

which is equivalent to the statement.

Corollary 3.6** (No smooth min-entropy implies Euclidean distance to min-entropy distributions).**

Suppose that ${\sf H}_{\infty}^{\delta}(X)<k$. Then for any $Y$ of min-entropy at least $k$ we have $\left(\sum_{x}|P_{X}(x)-P_{Y}(x)|^{2}\right)^{\frac{1}{2}}>2^{-\frac{k}{2}}\delta$.

Proof 3.7** (Proof of Corollary 3.6).**

It suffices to combine Lemma 3.4 and Corollary 3.2.

By Corollary 2.5 we conclude that the advantage of a random distinguisher for any two measures (in our case $P_{X}$ and $P_{Y}$) equals the Euclidean distance.

Lemma 3.8** (The advantage of a random distinguisher equals the Euclidean distance).**

Let $\{\mathsf{D}(x)\}_{x\in\{0,1\}^{n}}$ be $4$-wise independent as indexed by $x$ and such that $\mathsf{D}(x)$ outputs a random element from $\{-1,1\}$. Then for any set $S$ we have

[TABLE]

with probability $\frac{1}{17}$ over the choice of $\mathsf{D}$ (the result actually holds for any measures in place of $P_{X},P_{Y}$).

For our case, that is the setting in Lemma 3.4, we obtain

Corollary 3.9** (A random attack achieves $\Omega\left(2^{-k}\delta\right)$ with significant probability).**

For $X,Y$ as in Corollary 3.6, and $\mathsf{D}$ as in Lemma 3.8 we have $\mathsf{Adv}^{\mathsf{D}}(X;Y)\geq\frac{1}{3}\cdot 2^{-\frac{k}{2}}\delta$ w.p. $\frac{1}{17}$ over $\mathsf{D}$.

3.1. Partitioning the domain into $T$ slices

Let $h:\{0,1\}^{n}\rightarrow[1\ldots 2^{t}]$, where $t=\lceil\log T\rceil$, be a $4$-universal hash function. Define $S_{i}=\{x:h(x)=i\}$, $\Delta(x)=P_{X}(x)-P_{Y}(x)$ and consider advantages on slices $S_{i}$

[TABLE]

The following corollary shows that on each of our $T$ slices, we get the advantage $T^{-\frac{1}{2}}2^{-\frac{k}{2}}\delta$. The proof appears in Section 4.3.

Corollary 3.10** ((Mixed) moments of slice advantages).**

For $\mathsf{D}$, $\{S_{u}\}_{u}$ as above and every $i,j$

[TABLE]

(the statement is valid for arbitrary measures in place of $P_{X},P_{Y}$).

Denote $Z=\sum_{i}\mathsf{Adv}^{\mathsf{D}}_{S_{i}}\left(X;Y\right)$. Using Lemma 2.4 with $\theta=\frac{1}{\sqrt{3}}$ where we compute $\operatorname{\mathbb{E}}Z^{2}$ and $\operatorname{\mathbb{E}}Z$ according to Corollary 3.10 we obtain $\Pr\left[|Z|>\frac{1}{\sqrt{3}}\cdot\operatorname{\mathbb{E}}|Z|\right]\geqslant\frac{1}{17}$. Bounding once again $\operatorname{\mathbb{E}}|Z|$ as in Corollary 3.10 we get

Corollary 3.11** (Total advantage on all parition slices).**

For $X,Y$ as in Corollary 3.6, $\mathsf{D}$ and $S_{i}$ defined above we have

[TABLE]

(for general $X,Y$ the lower bound is $\Omega(1)\cdot T^{\frac{1}{2}}\cdot d_{2}(P_{X};P_{Y})$).

The corollary shows that the total absolute advantage over all partition slices, is as expected. Since $\{S_{i}\}_{i}$ is a partition we have

[TABLE]

where for $\beta_{i}\overset{def}{=}\mathrm{sgn}\left(\sum_{x\in S_{i}}\left(P_{X}(x^{\prime})-P_{Y}(x)\right)\mathsf{D}(x)\right)$ (the sign of the advantage on the $i$-th slice) we define $\beta(x)=\beta_{i}$ where $S_{i}$ contains $x$. This shows that by ”flipping“ the distinguisher output on the slices we achieve the sum of individual advantages. Since the bit $\beta(x)$ can be computed with $O(T)+\tilde{O}(n)$ advice (the complexity of the function $i\rightarrow\beta_{i}$ plus the complexity of finding $i$ for a given $x$) we obtain

Corollary 3.12** (Computing total advantage by one distinguisher).**

For $X,Y$ as in Corollary 3.6, $\mathsf{D}$ and $\{S_{i}\}_{i}$ defined above there exists a modification to $\mathsf{D}$ which in time $\tilde{O}(n)$ and advice $O(T)$ achieves advantage $\frac{1}{3}\cdot T^{\frac{1}{2}}2^{-\frac{k}{2}}\delta$ with probability $\frac{1}{17}$.

Finally by setting $\epsilon=T^{\frac{1}{2}}2^{-\frac{k}{2}}\delta$ and manipulating $T$ we arrive at

Corollary 3.13** (Continue tradeoff).**

For any $\epsilon$ there exists $T$ such that the distinguisher in Corollary 3.12 has advantage $\epsilon$ and circuit complexity $s=O\left(2^{k}\epsilon^{2}\delta^{-2}\right)$.

4. Omitted Proofs

4.1. Proof of Lemma 2.3 (Strengthening of Marcinkiewicz-Zygmund’s Inequality for $p=4$)

Let $Z=\sum_{x}\xi(x)$. Since $\xi(x)$ are (in particular) $2$-wise independent with zero mean, we get

[TABLE]

(the summation taken over $x,y\in\mathcal{X}$). The fourth moment is somewhat more complicated

[TABLE]

The second equality follows because whenever $\xi(x)$ occurs in an odd power, for example $x=x_{1}\not=x_{2}=x_{3}=x_{4}$, the expectation is zero (this way one can simplify and bound also higher moments, see [7]). It remains to estimate the first moment. By Corollary 2.2 and bounds on the second and fourth moment we have just computed we obtain

[TABLE]

and the upper bound follows by Jensen’s Inequality (with constant 1).

4.2. Proof of Lemma 3.1 (Characterizing smooth min-entropy)

Suppose that ${\sf H}_{\infty}^{\delta}(X)\geqslant k$. then, by definition, there is $Y$ such that ${\sf H}_{\infty}(Y)\geqslant k$ and $\sum_{x:P_{X}(x)>P_{Y}(x)}P_{X}(x)-P_{Y}(x)\leqslant\delta$. Since all the summands are positive and since $P_{Y}(x)\leqslant 2^{-k}$, ignoring those $x$ for which $P_{Y}(x)<2^{-k}$ yields

[TABLE]

Again, since $P_{Y}(x)\leqslant 2^{-k}$ we obtain

[TABLE]

which finishes the proof of the ”$\Longrightarrow$“ part.

Assume now that $\delta^{\prime}=\sum_{x\in\mathcal{X}}\max\left(P_{X}(x)-2^{-k},0\right)\leqslant\delta$. Note that

[TABLE]

and therefore we have $\sum_{x\in\mathcal{X}}\max\left(2^{-k}-P_{X}(x),0\right)\geqslant\delta^{\prime}$. By this observation we can construct a distribution $Y$ by shifting $\delta^{\prime}$ of the mass of $P_{X}$ from the set $S^{-}=\{x:P_{X}(x)>2^{-k}\}$ to the set $\{x:2^{-k}\geqslant P_{X}(x)\}$ in such a way that we have $P_{Y}(x)\leqslant 2^{-k}$ for all $x$. Thus ${\sf H}_{\infty}(Y)\geqslant k$ and since a $\delta^{\prime}$ fraction of the mass is shifted and redistributed we have $d_{1}(X;Y)\leqslant\delta^{\prime}$. This finishes the proof of the ”$\Longleftarrow$“ part.

4.3. Proof of Corollary 3.10 ((Mixed) moments of slice advantages)

For shortness denote $\Delta(x)=P_{X}(x)-P_{Y}(x)$ and $\mathsf{Adv}^{\mathsf{D}}_{S_{i}}=\mathsf{Adv}^{\mathsf{D}}_{S_{i}}\left(X;Y\right)$.

Note that by Lemma 2.3, applied to the family $f_{x}=\Delta(x)\mathsf{D}(x)\mathbf{1}_{S_{i}}(x)$ (which is $4$-wise independent) we have

[TABLE]

which is the first inequality claimed in the corollary.how does $T$ come in here? In turn, again by Lemma 2.3, we have

[TABLE]

Since this holds for any $i$, by Cauchy-Schwarz we get for any $i,j$

[TABLE]

which proves the second inequality in the corollary.