The Power of Shared Randomness in Uncertain Communication

TL;DR

This paper explores the impact of shared randomness in uncertain communication, demonstrating that public randomness can significantly reduce communication complexity compared to private randomness, and establishing new bounds and separations.

Contribution

It provides the first separation between private-coin and public-coin uncertain communication complexities and improves lower bounds for public-coin protocols under uncertainty.

Findings

Public randomness reduces communication complexity in uncertain settings.

Private-coin protocols can require significantly more communication than public-coin protocols.

New lower bounds demonstrate the power of public randomness in uncertain communication.

Abstract

In a recent work (Ghazi et al., SODA 2016), the authors with Komargodski and Kothari initiated the study of communication with contextual uncertainty, a setup aiming to understand how efficient communication is possible when the communicating parties imperfectly share a huge context. In this setting, Alice is given a function $f$ and an input string $x$, and Bob is given a function $g$ and an input string $y$. The pair $(x,y)$ comes from a known distribution $\mu$ and $f$ and $g$ are guaranteed to be close under this distribution. Alice and Bob wish to compute $g(x,y)$ with high probability. The previous work showed that any problem with one-way communication complexity $k$ in the standard model has public-coin communication $O(k(1+I))$ bits in the uncertain case, where $I$ is the mutual information between $x$ and $y$. A lower bound of $\Omega(\sqrt{I})$ bits on the public-coin uncertain communication was also shown. An important question that was left open is the power that public randomness brings to uncertain communication. Can Alice and Bob achieve efficient communication amid uncertainty without using public randomness? How powerful are public-coin protocols in overcoming uncertainty? Motivated by these two questions: - We prove the first separation between private-coin uncertain communication and public-coin uncertain communication. We exhibit a function class for which the communication in the standard model and the public-coin uncertain communication are $O(1)$ while the private-coin uncertain communication is a growing function of the length $n$ of the inputs. - We improve the lower-bound of the previous work on public-coin uncertain communication. We exhibit a function class and a distribution (with $I \approx n$) for which the one-way certain communication is $k$ bits but the one-way public-coin uncertain communication is at least $\Omega(\sqrt{k} \cdot \sqrt{I})$ bits.

Equations

$${\mathcal{F}}_{\delta }\triangleq \{(f_S,f_T):S\subseteq T,|T|=\ell \text{ and }|T\setminus S|\le {\delta }^{\prime }\cdot \ell \},$$

$$\mathrm{Pr}[\mathsf{Sign}(X)\ne \mathsf{Sign}(Y)]=\frac{\arccos (\rho )}{\pi }.$$

$$\lambda$$

$$\Lambda$$

$$\Delta (f_S,f_T)$$

$$=\mathrm{Pr}[\mathsf{Sign}(\sum _{i\in [\ell ]}{X}_i^{\prime })\ne \mathsf{Sign}(\sum _{i\in [\ell ]}{Y}_i^{\prime })]$$

$$\displaystyle=\Pr[\mathsf{Sign}(X^{\prime\prime})\neq\mathsf{Sign}(Y^{\prime\prime})]\pm O\bigg{(}\frac{1}{\lambda^{3/2}\cdot\sqrt{\ell}}\bigg{)},$$

$$\Delta (f_S,f_T)$$

$$=O(\sqrt{{\delta }^{\prime }})$$

$$\le \delta ,$$

$$g(X,Y)$$

$$h(X,Y)$$

$$\rho \triangleq k^{-1}\cdot \sum _{j\in [k]}{\rho }_j=\frac{a}{s}=\frac{\ell \cdot (1-t\cdot {\delta }^{\prime })}{\ell \cdot (1-{\delta }^{\prime })}=1-\frac{(t-1)\cdot {\delta }^{\prime }}{1-{\delta }^{\prime }}\le 1-({ϵ}^{\prime }-{\delta }^{\prime }),$$

$$\Delta (g,h)$$

$$=\mathrm{Pr}[g(X,Y)=0,h(X,Y)=1]+\mathrm{Pr}[g(X,Y)=1,h(X,Y)=0]$$

$$\displaystyle=\Pr[X^{\prime}<0,Y\geq 0]\pm O\bigg{(}\frac{1}{(1-|\rho|)^{3/2}\cdot\sqrt{s}}\bigg{)}+\Pr[X^{\prime}\geq 0,Y<0]\pm O\bigg{(}\frac{1}{(1-|\rho|)^{3/2}\cdot\sqrt{s}}\bigg{)}$$

$$\displaystyle=\Pr[\mathsf{Sign}(X^{\prime})\neq\mathsf{Sign}(Y^{\prime})]\pm O\bigg{(}\frac{1}{(1-|\rho|)^{3/2}\cdot\sqrt{\ell}}\bigg{)}$$

$$\displaystyle=\frac{\arccos(\rho)}{\pi}\pm O\bigg{(}\frac{1}{(1-|\rho|)^{3/2}\cdot\sqrt{\ell}}\bigg{)}$$

$$\displaystyle\geq\frac{\arccos(1-(\epsilon^{\prime}-\delta^{\prime}))}{\pi}-O\bigg{(}\frac{1}{(1-|\rho|)^{3/2}\cdot\sqrt{\ell}}\bigg{)}$$

$$\displaystyle\geq\frac{\arccos(1-\epsilon^{\prime})}{\pi}-O(\sqrt{\delta^{\prime}})-O\bigg{(}\frac{1}{(1-|\rho|)^{3/2}\cdot\sqrt{\ell}}\bigg{)}$$

$$\ge ϵ-\delta ,$$

$${\delta }^{\prime }\triangleq c\cdot {\delta }^2\text{ and }ϵ\triangleq \sqrt{{\delta }^{\prime }/n},$$

$$f_{S}(x,y)\triangleq\mathsf{Sign}\big{(}\displaystyle\sum\limits_{i\in[k]}(-1)^{\langle S^{(i)},x^{(i)}\oplus y^{(i)}\rangle}\big{)}$$

$${\mathsf{Stab}}_{\rho }({\widetilde{\mathsf{Maj}}}_k)\ge 1-\frac{2}{\pi }\arccos (\rho ).$$

$${\Delta }_{{\mu }_{2ϵ-2{ϵ}^2}}(f_S,f_T)$$

$$\le \frac{1-{\mathsf{Stab}}_{\rho }({\widetilde{\mathsf{Maj}}}_k)}{2}$$

$$\le \frac{\arccos (\rho )}{\pi }$$

$$=O(\sqrt{{\delta }^{\prime }})$$

$$\le \delta ,$$

$$\underset{\hat{B}\in \{0,1{\}}^k}{\mathrm{argmax}}\mathrm{Pr}[B=\hat{B}|Q=q,W=w].$$

$$H(B|Q,W)$$

$$\le H(B|Q)-\alpha \cdot k$$

$$\le H(B)-\alpha \cdot k$$

$$\le (1-\alpha )\cdot k,$$

$$H(B|Q=q,W=w)\le (1-\alpha /10)\cdot k.$$

$$H_{\min}(B|Q=q,W=w)\triangleq\min_{\hat{B}\in\{0,1\}^{k}}\log_{2}\big{(}\frac{1}{\Pr[B=\hat{B}|Q=q,W=w]}\big{)}.$$

$$(\alpha /10)\cdot 2^{-(1-\alpha /10)\cdot k}\ge (0.5+\beta {)}^k,$$

$$I_{((S,X),(T,Y))\sim\kappa_{\epsilon}}\bigg{(}(\langle T^{(i)},X^{(i)}\rangle)_{i\in[k]};M(X,S)~{}|~{}Y,T\bigg{)}\geq\beta\cdot k$$

$${\Delta }_{TV}({\mu }_{2ϵ-2{ϵ}^2},{\mu }_{\hat{T},ϵ})\le k\cdot \exp (-ϵ\cdot n).$$

$${\mu }_{2ϵ-2{ϵ}^2}(X=\hat{X},Y=\hat{Y})=\frac{1}{2^{k\cdot n}}\cdot (2ϵ-2{ϵ}^2{)}^{\Delta (\hat{X},\hat{Y})}\cdot (1-2ϵ+2{ϵ}^2{)}^{k\cdot n-\Delta (\hat{X},\hat{Y})}$$

Full text

However, an important question that was left open is related to the power that public randomness brings to uncertain communication. Can Alice and Bob achieve efficient communication amid uncertainty without using public randomness? And how powerful are public-coin protocols in overcoming uncertainty? Motivated by these two questions:

• •

We prove the first separation between private-coin uncertain communication and public-coin uncertain communication. Namely, we exhibit a function class for which the communication in the standard model and the public-coin uncertain communication are $O(1)$ while the private-coin uncertain communication is a growing function of $n$ (the length of the inputs). This lower bound (proved with respect to the uniform distribution) is in sharp contrast with the case of public-coin uncertain communication which was shown by the previous work to be within a constant factor from the certain communication. This lower bound also implies the first separation between public-coin uncertain communication and deterministic uncertain communication. Interestingly, we also show that if Alice and Bob imperfectly share a sequence of random bits (a setup weaker than public randomness), then achieving a constant blow-up in communication is still possible.

• •

We improve the lower-bound of the previous work on public-coin uncertain communication. Namely, we exhibit a function class and a distribution (with mutual information $I\approx n$) for which the one-way certain communication is $k$ bits but the one-way public-coin uncertain communication is at least $\Omega(\sqrt{k}\cdot\sqrt{I})$ bits.

Our proofs introduce new problems in the standard communication complexity model and prove lower bounds for these problems. Both the problems and the lower bound techniques may be of general interest.

1. 1 Introduction

2. 1.1 Our Contributions

3. 1.2 Implications

4. 2 Overview of Proofs

5. 2.1 Overview of Proof of Theorem 1.1

6. 2.2 Overview of Proof of Theorem 1.3

7. 3 Preliminaries

8. 4 Construction for Private-Coin Uncertain Protocols

9. 4.1 Proof of Lemma 4.3

10. 4.2 Proof of Part (iii) of Theorem 1.1

11. 4.2.1 Description of Protocol $\Pi^{\prime}$

12. 4.2.2 The $\mathsf{stretch}_{r,a}$ Procedure

13. 4.2.3 Analysis of Protocol $\Pi^{\prime}$

14. 5 Construction for Public-Coin Uncertain Protocols

15. 5.1 Proof Preliminaries for Subsections 5.2 and 5.3

16. 5.2 Simulation Protocol

17. 5.3 Proof of Lemma 5.2

18. 6 Proof of Theorem 1.2

19. 7 Open Questions

20. A Two-Dimensional Berry-Esseen Theorem for Independent Random Variables

1 Introduction

In many forms of communication (e.g., human, computer-to-computer), the communicating parties share some context (e.g, knowledge of a language, operating system, communication protocol, encoding/decoding mechanisms.). This context is usually a) huge and b) imperfectly shared among the parties. Nevertheless, in human communication, very efficient communication is usually possible. Can we come up with a mathematical analogue of this phenomenon of efficient communication based on a huge but imperfectly shared context? Motivated by this general question, the study of “communication amid uncertainty” has been the subject of a series of recent work starting with Goldreich, Juba and Sudan [JS08, GJS12] followed by [JKKS11, JS11, JW13, HS14, CGMS15]. While early works were very abstract and general, later works (starting with Juba, Kalai, Khanna and Sudan [JKKS11]) tried to explore the ramifications of uncertainty in Yao’s standard communication complexity model [Yao79]. In particular, the more recent works relax the different pieces of context that were assumed to be perfectly shared in Yao’s model, such as shared randomness [CGMS15], and in a recent work of the authors with Komargodski and Kothari the function being computed [GKKS16].

Specifically, [GKKS16] study the following functional notion of uncertainty in communication. Their setup builds on – and generalizes – Yao’s classical model of (distributional) communication complexity, where Alice has an input $x$ and Bob has an input $y$, with $(x,y)$ being sampled from a distribution $\mu$. Their goal is to communicate minimally so as to compute some function $g(x,y)$ (with high probability over the choice of $(x,y)$). The understated emphasis of the model is that for many functions $g$, the communication required is much less than the lengths of $x$ or $y$, the entropy of $x$ or $y$ or even the conditional entropy of $x$ given $y$.

The question studied by [GKKS16] is: How much of this gain in communication is preserved when the communicating parties do not exactly agree on the function being computed? (We further discuss the importance of this question in Section 1.2.) This variation of the problem is modelled as follows: Alice is given a Boolean function $f$ and an input string $x$, and Bob is given a Boolean function $g$ and an input string $y$ where $(x,y)$ is sampled from a known distribution $\mu$ as before, and $(f,g)$ is chosen (adversarially) from a known class $\mathcal{F}$ of pairs of functions that are close in terms of the Hamming distance $\Delta_{\mu}$ (weighted according to $\mu$). Alice and Bob wish to compute $g(x,y)$. Alice’s knowledge of the function $f$ (which is close but not necessarily equal to $g$) captures the uncertainty in the knowledge of the context.

We define the public-coin uncertain communication complexity $\mathsf{PubCCU}^{\mu}_{\epsilon}(\mathcal{F})$ as the minimum length of a two-way public-coin protocol whose output is correct with probability at least $1-\epsilon$ over its internal randomness and that of $(x,y)$. We similarly define the private-coin uncertain communication complexity $\mathsf{PrivCCU}^{\mu}_{\epsilon}(\mathcal{F})$ by restricting to private-coin protocols. Clearly, $\mathsf{PubCCU}^{\mu}_{\epsilon}(\mathcal{F})\leq\mathsf{PrivCCU}^{\mu}_{\epsilon}(\mathcal{F})$. The quantities $\mathsf{owPubCCU}^{\mu}_{\epsilon}(\mathcal{F})$ and $\mathsf{owPrivCCU}^{\mu}_{\epsilon}(\mathcal{F})$ are similarly defined by restricting to one-way protocols.222Note that the uncertain model is clearly a generalization of Yao’s model which corresponds to the particular case where $\mathcal{F}=\{(f,f)\}$ for some fixed function $f$. On the other hand, the uncertain model can also be viewed as a particular case of Yao’s model via an exponential blow-up in the input size. For more on this view (which turns out to be ineffective in our setup), we refer the reader to Note Note at the end of this section.

The previous work ([GKKS16]) gave an upper bound on $\mathsf{owPubCCU}^{\mu}_{\epsilon}(\mathcal{F})$ whenever $\mathcal{F}$ consists of functions $g$ whose one-way distributional complexity is small. More precisely, denote by $\mathsf{owCC}^{\mu}_{\epsilon}(g)$ the one-way communication complexity of $g$ in the standard distributional model.333By the “easy direction” of Yao’s min-max principle, we can without loss of generality consider deterministic (instead of public-coin) protocols when defining $\mathsf{owCC}^{\mu}_{\epsilon}(g)$. We point out that this is not true in the uncertain case. Namely, $\mathsf{owCC}^{\mu}_{\epsilon}(g)$ is the minimum length of a one-way deterministic protocol computing $g$ with probability at least $1-\epsilon$ over the randomness of $(x,y)$. Then, [GKKS16] showed that if $\mathcal{F}$ consists of pairs $(f,g)$ of functions that are at distance $\delta$, and if $\mathsf{owCC}^{\mu}_{\epsilon}(f),\mathsf{owCC}^{\mu}_{\epsilon}(g)\leq k$, then for every positive $\theta$, $\mathsf{owPubCCU}_{\epsilon+2\delta+\theta}^{\mu}(\mathcal{F})\leq O_{\theta}(k\cdot(1+I(x;y)))$, where $I(x;y)$ denotes the mutual information between $x$ and $y$.444One interpretation of the dependence of the communication in the uncertain setup on the mutual information $I(x;y)$ is that the players are better able to use the correlation of their inputs in the standard case than in the uncertain case. Note that if $\mu$ is a product distribution and if we let the parameter $\theta$ be a small constant, then the blow-up in communication is only a constant factor. However, the protocol of [GKKS16] crucially uses public randomness, and one of the main motivations behind this work is to understand how large the blow-up would be in the case where Alice and Bob have access to weaker types of randomness (or no randomness at all).

We point out that understanding the type of randomness that is needed in order to cope with uncertainty is a core question in the setup of communication with contextual uncertainty: If Alice and Bob do not (perfectly) agree on the function being computed, why can we assume that they (perfectly) agree on the shared randomness?

1.1 Our Contributions

We prove several results about the power of shared randomness in uncertain communication.

Private and Imperfectly Shared Randomness

Our first result (Theorem 1.1) shows that private-coin protocols are much weaker than public-coin protocols in the setup of communication with contextual uncertainty. Far from obtaining a constant factor blow-up in communication, private-coin protocols incur an increase that is a growing function of $n$ when dealing with uncertainty.

Let $\mathcal{U}\triangleq\mathcal{U}_{2n}$ be the uniform distribution on $\{0,1\}^{2\cdot n}$. For positive integers $t$ and $n$, we define $\log^{(t)}(n)$ by setting $\log^{(1)}(n)=\log{n}$, and $\log^{(i)}(n)=\max(\log{\log^{(i-1)}(n)},1)$ for all $i\in\{2,\dots,t\}$.

Theorem 1.1** (Lower-bound on private-coin uncertain protocols).**

For every sufficiently small $\delta>0$, there exist a positive integer $\ell\triangleq\ell(\delta)$ and a function class $\mathcal{F}\triangleq\mathcal{F}_{\delta}$ such that

1. (i)

For each $(f,g)\in\mathcal{F}$, we have that $\Delta_{\mathcal{U}}(f,g)\leq\delta$. 2. (ii)

*For each $(f,g)\in\mathcal{F}$, we have that $\mathsf{owCC}^{\mathcal{U}}_{0}(f),\mathsf{owCC}^{\mathcal{U}}_{0}(g)\leq\ell$ . * 3. (iii)

For every $\eta>0$ and $\epsilon\in(4\delta,0.5]$, we have that $\mathsf{PrivCCU}^{\mathcal{U}}_{\epsilon/2-2\delta-\eta}(\mathcal{F})=\Omega(\eta^{2}\cdot\log^{(t)}(n))$ for some positive integer $t=\Theta((\epsilon/\delta)^{2})$.

In Theorem 1.1, the inputs $x$ and $y$ are binary strings of length $n$ and $\mathcal{F}$ is a family of pairs of functions, which each function mapping $\{0,1\}^{n}\times\{0,1\}^{n}$ to $\{0,1\}$. Also, the parameter $\eta$ can possibly depend on $n$. We point out that Theorem 1.1 also implies the first separation between deterministic uncertain protocols and public-coin uncertain protocols555This uses the fact that private-coin communication complexity is no larger than deterministic communication complexity, both in the certain and uncertain setups..

Note**.**

We point out that the relative power of private-coin and public-coin protocols in the uncertain model is both conceptually and technically different from the standard model. Specifically, the randomness is potentially used in the standard model in order to fool an adversary selecting the input pair $(x,y)$, whereas in the uncertain model, it is used to fool an adversary selecting the pair $(f,g)$ of functions that are promised to be close. This promise makes the task of proving lower bounds against private-coin protocols in the uncertain model (e.g., Theorem 1.1) significantly more challenging than in the standard model.666In particular, the diagonilization-based arguments that imply a separation between the public-coin and the private-coin communication complexities of the Equality function in the standard model completely fail when we impose such a promise. Moreover, a well-known theorem due to Newman [New91] shows that in the standard model, any public-coin protocol can be simulated by a private-coin protocol while increasing the communication by an additive $O(\log{n})$ bits. By contrast, there is no known analogue of Newman’s theorem in the uncertain case!

Note**.**

The construction that we use to prove Theorem 1.1 cannot give a separation larger than $\Theta(\log{\log{n}})$. Thus, showing a separation of $\omega(\log{\log{n}})$ between private-coin and public-coin protocols in the uncertain case would require a new construction. For more details, see Note Note.

In light of Theorem 1.1, it is necessary for Alice and Bob to share some form of randomness in order to only incur a constant blow-up in communication for product distributions. Fortunately, it turns out that it is not necessary for Alice and Bob to perfectly share a sequence of random coins. If Alice is given a uniform-random string $r$ of bits and Bob is given a string $r^{\prime}$ obtained by independently flipping each coordinate of $r$ with probability $0.49$, then efficient communication is still possible!

More formally, for $\rho\in[0,1]$, define $\mathsf{owIsrCCU}^{\mu}_{\epsilon,\rho}(\mathcal{F})$ in the same way that we defined $\mathsf{owPubCCU}^{\mu}_{\epsilon}(\mathcal{F})$ except that instead of Alice and Bob having access to public randomness, Alice will have access to a sequence $r$ of independent uniformly-random bits, and Bob will have access to a sequence $r^{\prime}$ of bits obtained by independently flipping each coordinate of $r$ with probability $(1-\rho)/2$. Note that this setup of imperfectly shared randomness interpolates between the public randomness and private randomness setups, i.e., $\mathsf{owIsrCCU}^{\mu}_{\epsilon,1}(\mathcal{F})=\mathsf{owPubCCU}^{\mu}_{\epsilon}(\mathcal{F})$ and $\mathsf{owIsrCCU}^{\mu}_{\epsilon,0}(\mathcal{F})=\mathsf{owPrivCCU}^{\mu}_{\epsilon}(\mathcal{F})$.

Theorem 1.2** (Uncertain protocol using imperfectly shared randomness).**

Let $\rho\in(0,1]$ and $\mu$ be a product distribution. Let $\mathcal{F}$ consist of pairs $(f,g)$ of functions with $\Delta_{\mu}(f,g)\leq\delta$, and $\mathsf{owCC}^{\mu}_{\epsilon}(f),\mathsf{owCC}^{\mu}_{\epsilon}(g)\leq k$. Then, for every positive $\theta$, $\mathsf{owIsrCCU}_{\epsilon+2\delta+\theta,\rho}^{\mu}(\mathcal{F})\leq O_{\theta}(k/\rho^{2})$.

The imperfectly shared randomness model in Theorem 1.2 was recently independently introduced (in the setup of communication complexity) by Bavarian, Gavinsky and Ito [BGI14] and by Canonne, Guruswami, Meka and Sudan [CGMS15] (and it was further studied in [GKS16]). Moreover, our proof of Theorem 1.2 is based on combining the uncertain protocol of [GKKS16] and the locality-sensitive-hashing based protocol of [CGMS15].

We point out that Theorem 1.2 also holds for more general i.i.d. sources of correlated randomness than the one described above. More precisely, for i.i.d. (not necessarily binary) sources of (imperfectly) shared randomness with maximal correlation777The maximal correlation of a pair $(X,Y)$ of random variables (with support $\mathcal{X}\times\mathcal{Y}$) is defined as $\rho(X,Y)\triangleq\sup\mathbb{E}[F(X)G(Y)]$ where the supremum is over all functions $F:\mathcal{X}\to\mathbb{R}$ and $G:\mathcal{Y}\to\mathbb{R}$ with $\mathbb{E}[F(X)]=\mathbb{E}[G(Y)]=0$ and $\operatorname*{\mathsf{Var}}[F(X)]=\operatorname*{\mathsf{Var}}[G(Y)]=1$. It is not hard to show that the binary source of imperfectly shared randomness defined in the paragraph preceding Theorem 1.2 has maximal correlation $\rho$. $\rho$, the work of Witsenhausen [Wit75] along with the protocols of [CGMS15] and [GKKS16] imply an uncertain protocol with $O_{\theta}(k/\rho^{2})$ bits of communication.

Public Randomness

We now turn to our next result where we consider the dependence of the upper bound of [GKKS16] on the mutual information $I\triangleq I(X;Y)$ in the case of public-coin protocols. The previous work [GKKS16] proved a lower bound of $\Omega(\sqrt{I})$ on this dependence, but their lower-bound does not grow with $k$. We improve this lower bound to $\Omega(\sqrt{k}\cdot\sqrt{I})$.

Theorem 1.3** (Improved lower-bound on public-coin uncertain protocols).**

For every sufficiently small $\delta>0$ and every positive integers $k,n$ such that $k=o(\exp(\sqrt{n}))$, there exist an input distribution $\mu$ on input pairs $(X,Y)\in\{0,1\}^{k\cdot n}\times\{0,1\}^{k\cdot n}$ with mutual information $I\approx k\cdot n$ and a function class $\mathcal{F}\triangleq\mathcal{F}_{\delta,k,n}$ such that888We note that $I\approx k\cdot n$ means that $I/(k\cdot n)\to 0$ as $n\to\infty$.

1. (i)

For each $(f,g)\in\mathcal{F}$, we have that $\Delta_{\mu}(f,g)\leq\delta$. 2. (ii)

For each $(f,g)\in\mathcal{F}$, we have that $\mathsf{owCC}^{\mu}_{0}(f),\mathsf{owCC}^{\mu}_{0}(g)\leq k$. 3. (iii)

$\mathsf{owPubCCU}^{\mu}_{\epsilon}(\mathcal{F})=\Omega(\sqrt{k}\cdot\sqrt{I})$* for some absolute constant $\epsilon>0$ independent of $\delta$.*

As will be explained in detail in Section 2.2, the proof of Theorem 1.3 is based on an extension of the lower bound construction of [GKKS16], which is then analyzed using different techniques.

Note**.**

The construction that we use to prove Theorem 1.3 cannot give a lower bound larger than $\tilde{\Theta}(\sqrt{k}\cdot\sqrt{I})$. Thus, improving on the lower bound in Theorem 1.3 by more than logarithmic factors in $k$ and $I$ would require a new construction.

New Communication Problems

Our lower bounds in Theorems 1.1 and 1.3 are derived by defining new problems in standard communication complexity (i.e., without uncertainty) and proving lower bounds for these problems. We describe these problems and our results on these next.

The construction that we use to prove Theorem 1.1 requires us to understand the following “subset-majority with side information” setup. Alice is given a subset $S\subseteq[n]$ and a string $x\in\{\pm 1\}^{n}$, and Bob is given a subset $T\subseteq[n]$ and a string $y\in\{\pm 1\}^{n}$. The subsets $S$ and $T$ are adversarially chosen but are promised to satisfy $S\subseteq T$, $|T|=\ell$ and $|T\setminus S|\leq\delta\cdot\ell$ for some fixed parameters $\ell$ and $\delta$. The strings $x$ and $y$ are chosen independently and uniformly at random. Alice and Bob wish to compute the function $\mathsf{SubsetMaj}((S,x),(T,y))\triangleq\mathsf{Sign}(\sum_{i\in T}x_{i}y_{i})$. In words, $\mathsf{SubsetMaj}((S,x),(T,y))$ is equal to [math] if $x$ and $y$ differ on a majority of the coordinates in subset $T$, and $1$ otherwise. Note that $S$ does not directly appear in the definition of the function $\mathsf{SubsetMaj}$ but it can serve as useful side-information for Alice.999Note that we could have alternatively defined $\mathsf{SubsetMaj}$ in terms of $S$, and let $T$ serve as the potentially useful side-information. Our lower bound would also apply to this setup. What is the private-coin communication complexity of computing $\mathsf{SubsetMaj}$ on every $(S,T)$-pair satisfying the above promise and with high probability over the random choice of $(x,y)$ and over the private randomness? We prove the following (informally stated) lower bound.

Lemma 1.4**.**

Any private-coin protocol computing $\mathsf{SubsetMaj}$ on every $(S,T)$-pair satisfying the promise and with high probability over the random choice of $(x,y)$ and over the private randomness should communicate at least $\log^{(t)}(n)$ bits for some positive integer $t$ that depends on $\delta$ and the error probability.

The proof of Theorem 1.3 is based on a construction that leads to the question described next regarding the communication complexity of a particular block-composed function. Namely, consider the following “majority composed with subset-parity with side information” setup. Alice is given a sequence of subsets $S\triangleq(S^{(i)}\subseteq[n])_{i\in[k]}$ and a sequence of strings $x\triangleq(x^{(i)}\in\{0,1\}^{n})_{i\in[k]}$, and Bob is given a sequence of subsets $T\triangleq(T^{(i)}\subseteq[n])_{i\in[k]}$ and a sequence of strings $y\triangleq(y^{(i)}\in\{0,1\}^{n})_{i\in[k]}$. We consider the following distribution $\mu$ on $((S,x),(T,y))$. Independently for each $i\in[k]$, we sample $((S^{(i)},x^{(i)}),(T^{(i)},y^{(i)}))$ as follows: $S^{(i)}$ is a uniform-random subset and $T^{(i)}$ is an $\epsilon$-noisy101010This means that the indicator vector of $T^{(i)}$ is obtained by independently flipping each coordinate of the indicator vector of $S^{(i)}$ with probability $\epsilon$. copy of $S^{(i)}$, and independently $x^{(i)}$ is a uniform-random string and $y^{(i)}$ is an $\epsilon$-noisy copy of $x$. Here, $\epsilon$ is a positive parameter that can depend on $n$ and $k$. Alice and Bob wish to compute the function \mathsf{Maj}\circ\mathsf{SubsetParity}((S,x),(T,y))\triangleq\mathsf{Sign}\big{(}\sum_{i=1}^{k}(-1)^{\langle T^{(i)},x^{(i)}\oplus y^{(i)}\rangle}\big{)} where $T^{(i)}$ denotes both the subset and its $0/1$ indicator vector, the inner product is over $\mathbb{F}_{2}$, and $x^{(i)}\oplus y^{(i)}$ is the coordinate-wise XOR of $x^{(i)}$ and $y^{(i)}$. What is the communication complexity of computing $\mathsf{Maj}\circ\mathsf{SubsetParity}$ with high probability over the distribution $\mu$? We prove the following lower bound.

Lemma 1.5**.**

Any $1$-way protocol computing $\mathsf{Maj}\circ\mathsf{SubsetParity}$ with high probability over the distribution $\mu$ should communicate $\Omega(k\cdot\epsilon\cdot n)$ bits.

In Section 2.1, we outline the proof of Theorem 1.1 and explain how it leads to the setup of Lemma 1.4 and how we prove Lemma 1.4. In Section 2.2, we outline the proof of Theorem 1.3 and explain how it leads to the setup of Lemma 1.5 and how we prove Lemma 1.5.

Before doing so, we discuss some conceptual implications of our results.

1.2 Implications

Functional uncertainty models much of the day-to-day interactions among humans, where a person is somewhat aware of the objectives of the other person she is interacting with, but do not know them precisely. Neither person typically knows exactly what aspects of their own knowledge may be relevant to the interaction, yet they do manage to have a short conversation. This is certainly a striking phenomenon, mostly unexplained in mathematical terms. This line of works aims to explore such phenomena. It is important to understand what mechanisms may come into play here, and what features play a role. Is the ability to make random choices important? Is shared information crucial? Is there a particular measure of distance between functions that makes efficient communication feasible? In order to understand such questions, one first needs to have a ground-level understanding of communication with functional uncertainty. This work tackles several basic questions that remain unexplored.

An ideal model for communication would only assume a constant amount of perfectly shared context between the sender and receiver, such as the knowledge of an encoding/decoding algorithm, one universal Turing machine, etc. Solutions to most interesting communication problems seem to assume a shared information which grows with the length of the inputs. Recent work showed that in many of these scenarios some assumptions about the shared context can be relaxed to an imperfect sharing, but these results are often brittle and break when two or more contextual elements are simultaneously assumed to be imperfectly shared. Our work raises the question of whether imperfectly shared randomness would be sufficient to overcome functional uncertainty. We show that this is indeed the case for product distributions, but the loss for non-product distributions might be much larger (for this and other open questions, we refer the reader to our conclusion Section 7). Such results highlight the delicate nature of the role of shared context in communication. They beg for a more systematic study of communication which at the very least should be able to mimic the aims, objectives and phenomena encountered in human communication.

Note**.**

As mentioned in Footnote 2, the uncertain model is clearly a generalization of Yao’s model. Strictly speaking, the uncertain model can also be viewed as a particular case of Yao’s model by regarding the function(s) that is being computed as part of the inputs of Alice and Bob, which results in an exponential blow-up in the input-size. This latter view turns out to be fruitless for our purposes. Indeed, from this perspective, all the different well-studied communication functions (such as Equality, Set Disjointness, Pointer Jumping, etc.) are regarded as special cases of one “universal function”! More importantly, this view completely blurs the distinction between the goal of the communication (i.e., the function to compute) and the inputs of the parties. On a technical level, it does not simplify the task of proving the lower bounds in Theorems 1.1 and 1.3 in any way since it does not capture the promise that the two functions (given to Alice and Bob) are close in Hamming distance. Thus, in the rest of this paper, we stick to the former view and use the expressions “uncertain model” and “standard model” to refer to the setups with and without uncertainty, respectively.

2 Overview of Proofs

2.1 Overview of Proof of Theorem 1.1

Reduction to Lemma 1.4.

In order to prove Theorem 1.1, we need to devise a function class for which circumventing the uncertainty is much easier using public randomness than using private randomness. One general setup in which Bob can leverage public randomness to resolve some uncertainty regarding Alice’s knowledge is the following “small-set intersection” problem. Assume that Alice is given a subset $S\subseteq[n]$, and Bob is given a subset $T\subseteq[n]$ such that $T$ contains $S$ and $|T|=\ell$, where we think of $\ell$ as being a large constant. Here, Bob knows that Alice has a subset of his own $T$ but he is uncertain which subset Alice has. Using public randomness, a standard $1$-way hashing protocol communicating $\tilde{O}(\ell)$ bits allows Bob to determine $S$ with high probability. On the other hand, using only private randomness, the communication complexity of this task is $\Theta(\log\log{n})$ bits.

With the above general setup in mind, we consider functions $f_{S}$ indexed by small subsets $S$ of coordinates on which they depend. Since we want the functions $f_{S}$ and $f_{T}$ to be close in Hamming distance, we enforce $|T\setminus S|$ to be small for every pair $(f_{S},f_{T})$ of functions in our class, and we let each function $f_{S}$ be “noise-stable”. Since we want our function $f_{S}$ to genuinely depend on all coordinates in $S$, the majority function $f_{S}(x,y)=\mathsf{Sign}(\sum_{i\in S}x_{i}y_{i})$ for $x,y\in\{\pm 1\}^{n}$ arises as a natural choice. We also let $x$ and $y$ be independent uniform-random strings. In this case, it can be seen that if $|T\setminus S|$ is a small constant fraction of $|T|$, then the quadratic polynomials $\sum_{i\in S}x_{i}y_{i}$ and $\sum_{i\in T}x_{i}y_{i}$ behave like standard Gaussians with correlation close to $1$, and the quadratic threshold functions $f_{S}(x,y)$ and $f_{T}(x,y)$ are thus close in Hamming distance.

Note that in the certain case, i.e., when both Alice and Bob agree on $S$, they can easily compute $f_{S}(x,y)$ by having Alice send to Bob the $\ell$ bits $(x_{i})_{i\in S}$. Moreover, if Alice and Bob are given access to public randomness in the uncertain case, Bob can figure out $S$ via the hashing protocol mentioned above using $\tilde{O}(\ell)$ bits of communication, which would reduce the problem to the certain case111111Alternatively, Alice and Bob can run the protocol of [GKKS16] which would communicate $O(\ell)$ bits.. The bulk of the proof will be to lower-bound the private-coin uncertain communication. Note that by the choice of our function class and distribution, this is equivalent to proving Lemma 1.4.

Proof of Lemma 1.4.

To prove Lemma 1.4, the high-level intuition is that a protocol solving the uncertain problem should be essentially revealing to Bob the subset $S$ that Alice holds. Formalizing this intuition turns out to be challenging, especially that a private-coin protocol solving the uncertain problem is only required to output a single bit which is supposed to equal the Boolean function $f_{T}(x,y)$ with high probability over $(x,y)$ and over the private randomness. In fact, this high-level intuition can be shown not to hold in certain regimes121212For example, for constant error probabilities, the $1$-way randomized communication complexity of small-set intersection is known to be $\Theta(\ell\cdot\log(\ell))$ bits (see, e.g., [BCK*+*14]) whereas the public-coin protocol of [GKKS16] can compute $f_{T}$ with $O(\ell)$ bits of communication.. Moreover, the standard proofs that lower bound the communication of small-set intersection do not extend to lower-bound the communication complexity of $f_{T}$.

To lower-bound the private-coin communication of solving the uncertain task by a growing function of $n$, we consider the following shift communication game. Bob is given a sorted tuple $\sigma=(\sigma_{1},\dots,\sigma_{t})$ of integers with $1\leq\sigma_{1}<\dots<\sigma_{t}\leq n$, and Alice is either given the prefix $(\sigma_{1},\dots,\sigma_{t-1})$ of length $t-1$ of $\sigma$ or the suffix $(\sigma_{2},\dots,\sigma_{t})$ of length $t-1$ of $\sigma$. Bob needs to determine the input of Alice. We show that a celebrated lower bound of Linial [Lin92] on the chromatic number of certain related graphs implies a lower bound of $\log^{(t+1)}(n)$ on the private-coin communication of the shift communication game. We then show that any private-coin protocol solving the uncertain task can be turned into a private-coin protocol solving the shift-communication game with a constant (i.e., independent of $n$) blow-up in the communication (see Protocol 1).

2.2 Overview of Proof of Theorem 1.3

Reduction to Lemma 1.5.

The proof of Theorem 1.3 builds on the lower-bound construction of [GKKS16] which we recall next. Let $\mu$ be the distribution over pairs $(x,y)\in\{0,1\}^{2n}$ where $x$ is uniform-random and $y$ is an $\epsilon$-noisy copy of $x$ with $\epsilon=\sqrt{\delta/n}$. Then, the mutual information between $x$ and $y$ satisfies $I\approx n$. For each $S\subseteq[n]$, consider the function $f_{S}(x,y)\triangleq\langle S,x\oplus y\rangle$ where the inner product is over $\mathbb{F}_{2}$, $x\oplus y$ denotes the coordinate-wise XOR of $x$ and $y$, and $S$ is used to denote both the subset and its $0/1$ indicator vector. Moreover, consider the class $\mathcal{F}$ of all pairs of functions $(f_{S},f_{T})$ where $|S\triangle T|\leq\sqrt{\delta n}$. It can be seen that for such $S$ and $T$, the distance between $f_{S}$ and $f_{T}$ under $\mu$ is at most $\delta$. If Alice and Bob both know $S$, then Alice can send the single bit $\langle S,x\rangle$ to Bob who can then output the correct answer $\langle S,x\oplus y\rangle=\langle S,x\rangle\oplus\langle S,y\rangle$. This means that the certain communication is $1$ bit. Using the well-known discrepancy method, [GKKS16] showed a lower bound of $\Omega(\sqrt{n})$ bits on the communication of the associated uncertain problem. Since in this case $I\approx n$, this in fact lower-bounds the uncertain communication by $\Omega(\sqrt{I})$ bits. For this construction, this lower bound turns out to be tight up to a logarithmic factor.

To improve the lower-bound from $\sqrt{I}$ to $\sqrt{k}\cdot\sqrt{I}$, we consider the following “block-composed” framework. Let $\{f_{S^{(i)}}(x^{(i)},y^{(i)}):i\in[k]\}$ be $k$ independent copies of the above base problem of [GKKS16] and consider computing the composed function g\big{(}f_{S^{(1)}}(x^{(1)},y^{(1)}),\dots,f_{S^{(k)}}(x^{(k)},y^{(k)})\big{)} for some outer function $g:\{0,1\}^{k}\to\{0,1\}$. For any choice of $g$, the certain communication of the composed function would be at most $k$ bits. When choosing the outer function $g$ to use in our lower bound, we thus have two objectives to satisfy. First, $g$ has to be sufficiently hard in the sense that its average-case decision tree complexity with respect to the uniform distribution on $\{0,1\}^{k}$ should be $\Omega(k)$; otherwise, it will not be the case that the uncertain communication of computing $g$ on $k$ copies of the base problem is at least $k$ times the uncertain communication of the base problem. Second, $g$ has to be noise stable in order to be able to upper bound the distance between g\big{(}f_{S^{(1)}}(\cdot),\dots,f_{S^{(k)}}(\cdot)\big{)} and g\big{(}f_{T^{(1)}}(\cdot),\dots,f_{T^{(k)}}(\cdot)\big{)}.

Note that setting $g$ to be a dictator function would satisfy the noise-stability property, but it clearly would not satisfy the hardness property, as the composed function would be equal to the base function and would thus have uncertain communication $\tilde{O}(\sqrt{n})$ bits. Another potential choice of $g$ is to set it to the parity function on $k$ bits. This function would satisfy the hardness property, but it would strongly violate the noise stability property that is crucial to us. This leads us to setting $g$ to the majority function on $k$ bits, which is well-known to be noise stable, and has average-case decision-tree complexity $\Omega(k)$ with respect to the uniform distribution on $\{0,1\}^{k}$. In fact, the noise stability of the majority function readily implies an upper bound of $O(\sqrt{\delta})$ on the distance between any pair of composed functions that are specified by tuples of subsets $(S^{(1)},\dots,S^{(k)})$ and $(T^{(1)},\dots,T^{(k)})$ with $|S^{(i)}\triangle T^{(i)}|\leq\sqrt{\delta n}$ for each $i\in[k]$. The crux of the proof will be to lower-bound the uncertain communication of the majority-composed function by $\Omega(k\sqrt{n})$, which amounts to proving Lemma 1.5. Since in this block-composed framework the mutual information satisfies $I\approx kn$, this would imply the lower bound of $\Omega(\sqrt{k}\sqrt{I})$ on the uncertain communication in Part (iii) of Theorem 1.3.

Proof of Lemma 1.5.

We first point out that the average-case quantum decision tree complexity of $\mathsf{Maj}_{k}$ with respect to the uniform distribution is $\tilde{O}(\sqrt{k})$ [ADW01]. This implies that any communication complexity lower-bound method that extends to the quantum model cannot prove a lower bound larger than $\tilde{O}(\sqrt{k}\cdot\sqrt{n})$ on our uncertain communication131313Thus, since $I\approx k\cdot n$ in our block-composed framework, such methods cannot be used to improve the lower-bound of $\Omega(\sqrt{I})$ of [GKKS16] by more than logarithmic factors.. In particular, we cannot solely rely on the discrepancy bound (as done in [GKKS16]), since this bound is known to lower-bound quantum communication. Similarly, the techniques of [She08, SZ07, LZ10] rely on the generalized discrepancy bound (originally due to [Kla01]) which also lower-bounds quantum communication. Moreover, the recent results of [MWY15] only apply to product distributions (i.e., where Alice’s input is independent of Bob’s input) in contrast to our case where the inputs of Alice and Bob are very highly-correlated. Finally, the recent works of [GLM*+*15, GPW15] do not imply lower bounds on the average-case complexity with respect to the distribution that arises in our setup.

To circumvent the above obstacles, we use a new approach that is tailored to our setup and that is outlined next. Let $\Pi$ be a $1$-way protocol solving the uncertain task with high probability. We consider the information that $\Pi$ reveals about the inputs to the outer function, i.e., about the length-$k$ binary string \big{(}f_{S^{(1)}}(x^{(1)},y^{(1)}),\dots,f_{S^{(k)}}(x^{(k)},y^{(k)})\big{)}. We call this quantity the intermediate information cost of $\Pi$, and we argue that it is at least $\Omega(k)$ bits. To do so, we recall the Hamming distance function $\mathsf{HD}_{k}$ defined by $\mathsf{HD}_{k}(u,v)=1$ if the Hamming distance between $u$ and $v$ is at least $k/2$ and $\mathsf{HD}_{k}(u,v)=0$ otherwise. We upper bound the information complexity of computing $\mathsf{HD}_{k}$ over the uniform distribution on $\{0,1\}^{2k}$ by the intermediate information cost of $\Pi$. We do so by giving an information-cost preserving procedure (Protocol 2) where Alice and Bob are given independent uniformly distributed $u$ and $v$ (respectively) and use their private and public coins in order to simulate the input distribution $(X,Y)$ of our uncertain problem. The known $1$-way lower bound of [Woo07] on $\mathsf{HD}_{k}$ under the uniform distribution then implies that $\Pi$ reveals $\Omega(k)$ bits of information to Bob about the tuple \big{(}f_{S^{(1)}}(x^{(1)},y^{(1)}),\dots,f_{S^{(k)}}(x^{(k)},y^{(k)})\big{)}. This allows Bob to guess this tuple with probability $0.51^{k}$. We then apply the strong direct product theorem for discrepancy of [LSS08] which, along with the discrepancy-based lower bound on the communication of the base uncertain problem of [GKKS16], implies that $\Pi$ should be communicating at least $\Omega(k\sqrt{n})$ bits.

Organization of the rest of the paper

In Section 3, we give some preliminaries that will be useful to us. In Section 4, we prove Theorem 1.1. In Section 5, we prove Theorem 1.3. The proof of Theorem 1.2 is given in Section 6. In Section 7, we conclude with some interesting open questions. A useful lemma that is used in Section 4 appears in Appendix A.

3 Preliminaries

For a real number $x$, we define $\mathsf{Sign}(x)$ to be $1$ if $x\geq 0$ and [math] if $x<0$. For a set $S$, we write $X\in_{R}S$ to indicate that $X$ is a random variable that is uniformly distributed on $S$. For a positive integer $n$, we let $[n]\triangleq\{1,\dots,n\}$. For a real number $x$, we denote $\exp(x)$ a quantity of the form $2^{\Theta(x)}$. For any two subsets $S,T\subseteq[n]$, we let $S\setminus T$ be the set of all elements of $S$ that are not in $T$. We let $S\triangle T$ be the symmetric difference of $S$ and $T$, i.e., the union of $S\setminus T$ and $T\setminus S$. For functions $f,g:\mathcal{X}\times\mathcal{Y}\to\{0,1\}$ and any distribution $\mu$ on $\mathcal{X}\times\mathcal{Y}$, we define the distance $\Delta_{\mu}(f,g)\triangleq\Pr_{(x,y)\sim\mu}[f(x,y)\neq g(x,y)]$ as the Hamming distance between the values of $f$ and $g$, weighted with respect to $\mu$. If $\mu$ is the uniform distribution on $\mathcal{X}\times\mathcal{Y}$, we drop the subscript $\mu$ and denote $\Delta_{\mu}$ by $\Delta$. We next recall the standard communication complexity model of Yao [Yao79]. In Definitions 3.1, 3.2 and 3.3 below, we let $f\colon\mathcal{X}\times\mathcal{Y}\rightarrow\{0,1\}$ be a Boolean function.

Definition 3.1** (Deterministic Communication Complexity).**

The two-way (resp. one-way) deterministic communication complexity of $f$, denoted by $\mathsf{CC}(f)$ (resp. $\mathsf{owCC}(f)$), is defined as the minimum over all two-way (resp. one-way) deterministic protocols $\Pi$ that compute $f$ correctly on every input pair, of the communication cost of $\Pi$.

Definition 3.2** (Private-Coin Communication Complexity).**

The two-way (resp. one-way) private-coin communication complexity of $f$ with error $\epsilon$, denoted by $\mathsf{PrivCC}_{\epsilon}(f)$ (resp. $\mathsf{owPrivCC}_{\epsilon}(f)$), is defined as the minimum over all two-way (resp. one-way) private-coin protocols $\Pi$ that compute $f$ with probability at least $1-\epsilon$ on every input pair, of the communication cost of $\Pi$.

The quantities in Definitions 3.1 and 3.2 can be similarly defined for partial functions $f$.

Definition 3.3** (Distributional Communication Complexity).**

Let $\mu$ be a distribution over $\mathcal{X}\times\mathcal{Y}$. The two-way (resp. one-way) distributional communication complexity of $f$ over $\mu$ with error $\epsilon$, denoted by $\mathsf{CC}^{\mu}_{\epsilon}(f)$ (resp. $\mathsf{owCC}^{\mu}_{\epsilon}(f)$), is the minimum over all two-way (resp. one-way) protocols $\Pi$ that compute $f$ with probability $1-\epsilon$ over $\mu$, of the communication cost of $\Pi$.

We next recall the model of communication with contextual uncertainty. For more details on this model, we refer the reader to [GKKS16]. In this setup, Alice knows a function $f$ and is given an input $x$, and Bob knows a function $g$ and is given an input $y$. Let $\mathcal{F}\subseteq\{f\colon\mathcal{X}\times\mathcal{Y}\to\{0,1\}\}^{2}$ be a family of pairs of Boolean functions with domain $\mathcal{X}\times\mathcal{Y}$, and $\mu$ be a distribution on $\mathcal{X}\times\mathcal{Y}$. We say that a public-coin (resp. private-coin) protocol $\Pi$ $\epsilon$-computes $\mathcal{F}$ over $\mu$ if for every $(f,g)\in\mathcal{F}$, we have that $\Pi$ outputs the value $g(x,y)$ with probability at least $1-\epsilon$ over the randomness of $(x,y)\sim\mu$ and over the public (resp. private) randomness of $\Pi$.

Definition 3.4** (Contextually Uncertain Communication Complexity).**

Let $\mu$ be a distribution on $\mathcal{X}\times\mathcal{Y}$ and $\mathcal{F}\subseteq\{f\colon\mathcal{X}\times\mathcal{Y}\to\{0,1\}\}^{2}$. The two-way (resp. one-way) public-coin communication complexity of $\mathcal{F}$ under contextual uncertainty, denoted $\mathsf{PubCCU}^{\mu}_{\epsilon}(\mathcal{F})$ (resp. $\mathsf{owPubCCU}^{\mu}_{\epsilon}(\mathcal{F})$), is the minimum over all two-way (resp. one-way) public-coin protocols $\Pi$ that $\epsilon$-compute $\mathcal{F}$ over $\mu$, of the maximum communication complexity of $\Pi$ over $(f,g)\in\mathcal{F}$, $(x,y)$ from the support of $\mu$ and settings of the public coins.

Similarly, the two-way (resp. one-way) private-coin communication complexity of $\mathcal{F}$ under contextual uncertainty $\mathsf{PrivCCU}^{\mu}_{\epsilon}(\mathcal{F})$ (resp. $\mathsf{owPrivCCU}^{\mu}_{\epsilon}(\mathcal{F})$) is defined by restricting to two-way (resp. one-way) private-coin protocols.

4 Construction for Private-Coin Uncertain Protocols

We now describe the construction that is used to prove Theorem 1.1. Each function in our universe is specified by a subset $S\subseteq[n]$ and is of the form $f_{S}:\{\pm 1\}^{n}\times\{\pm 1\}^{n}\to\{0,1\}$ with $f_{S}(X,Y)\triangleq\mathsf{Sign}(\sum_{i\in S}X_{i}Y_{i})$ for all $X,Y\in\{\pm 1\}^{n}$. The function class is then defined by

[TABLE]

where $\delta^{\prime}=\alpha\cdot\delta^{2}$ for some sufficiently small positive absolute constant $\alpha$, and $\ell=\ell(\delta)$ is a sufficiently large function of $\delta$. The input pair $(X,Y)$ is drawn from the uniform distribution on $\{\pm 1\}^{2n}$. We start with the proof of Part (i) of Theorem 1.1. It essentially follows from the fact that the the polynomials $\sum_{i\in S}X_{i}Y_{i}$ and $\sum_{i\in T}X_{i}Y_{i}$ behave like zero-mean Gaussians with unit-variance and correlation $\sqrt{1-\delta^{\prime}}$.

We will need the following well-known fact which follows from Sheppard’s forumla [She99].

Fact 4.1**.**

If $(X,Y)$ is a pair of zero-mean Gaussians with correlation $\mathbb{E}[XY]=\rho$, then

[TABLE]

We now prove Part (i) of Theorem 1.1.

Proof of Part (i) of Theorem 1.1.

Let $S\subseteq T\subseteq[n]$ be such that $|T|=\ell$ and $|T\setminus S|\leq\delta^{\prime}\cdot\ell$. For fixed $\ell$, the distance $\Delta(f_{S},f_{T})$ decreases when $|T\setminus S|$ decreases. So it suffices to upper bound $\Delta(f_{S},f_{T})$ when $|T\setminus S|=\delta^{\prime}\cdot\ell$. Assume that the coordinates in $T$ are $1\leq t_{1}<t_{2}<\dots<t_{\ell}$. Then, we define the random vectors $X^{\prime},Y^{\prime}\in\{0,1\}^{\ell}$ as $X^{\prime}_{i}=X_{t_{i}}Y_{t_{i}}$ for all $i\in[\ell]$, and $Y^{\prime}_{i}=X_{t_{i}}Y_{t_{i}}$ if $t_{i}\in S$ and $Y^{\prime}_{i}=0$ if $t_{i}\notin S$. We will apply the two-dimensional Berry-Esseen Theorem A.1 to $(X^{\prime},Y^{\prime})$. To do so, first note that the random pairs $(X^{\prime}_{1},Y^{\prime}_{1}),(X^{\prime}_{2},Y^{\prime}_{2}),\dots,(X^{\prime}_{\ell},Y^{\prime}_{\ell})$ are independent. Moreover, for every $i\in[\ell]$ such that $t_{i}\in S$, the covariance matrix of $(X_{i},Y_{i})$ is given by $\Sigma_{i}=\begin{bmatrix}1&1\\ 1&1\end{bmatrix}$. On the other hand, for $i\in[\ell]$ such that $t_{i}\notin S$, the convariance matrix of $(X_{i},Y_{i})$ is given by $\Sigma_{i}=\begin{bmatrix}1&0\\ 0&0\end{bmatrix}$. Hence, the average (across the $\ell$ coordinates) covariance matrix is given by $\Sigma=\ell^{-1}\cdot\displaystyle\sum\limits_{i\in[\ell]}\Sigma_{i}=\begin{bmatrix}1&1-\delta^{\prime}\\ 1-\delta^{\prime}&1-\delta^{\prime}\end{bmatrix}$. The smallest and largest eigenvalues of $\Sigma$ are respectively given by

[TABLE]

In Equation (1a), it can be checked that for $\delta^{\prime}\in(0,1)$, $\lambda>0$. By the two-dimensional Berry-Esseen Theorem A.1, we get that

[TABLE]

where $(X^{\prime\prime},Y^{\prime\prime})$ is a pair of zero-mean Gaussians with covariance matrix $\Sigma$. We can scale $Y^{\prime\prime}$ to make it have unit-variance; this does not change its mean or the probability in Equation (2). The covariance matrix becomes: $\Sigma^{\prime}=\begin{bmatrix}1&\sqrt{1-\delta^{\prime}}\\ \sqrt{1-\delta^{\prime}}&1\end{bmatrix}$. By Sheppard’s formula (i.e., Fact 4.1), we deduce that

[TABLE]

where we have used the facts that $\arccos(1-x)=O(\sqrt{x})$ for small positive values of $x$, that $\delta^{\prime}=\alpha\cdot\delta^{2}$ for a sufficiently small positive absolute constant $\alpha$, and that $\ell$ is be a sufficiently large function of $\delta$. ∎

We now give the proof of Part (ii) of Theorem 1.1, which is quite immediate.

Proof of Part (ii) of Theorem 1.1.

When both Alice and Bob know the subset $T\subseteq[n]$ which satisfies $|T|\leq\ell$, Alice can send the sequence $(X_{j}:j\in T)$ of at most $\ell$ bits to Bob who can then output $f_{T}(X,Y)$. ∎

To prove Part (iii) of Theorem 1.1, the next definition – which is based on the graphs studied by Linial [Lin92]– will be crucial to us.

Definition 4.2** (Shift Communication Game $\mathcal{G}_{m,t}$).**

Let $m$ and $t$ be positive integers with $t\leq m$. In the communication problem $\mathcal{G}_{m,t}$, Bob is given a sorted tuple $\sigma=(\sigma_{1},\dots,\sigma_{t})$ of distinct integers with $1\leq\sigma_{1}<\dots<\sigma_{t}\leq m$. In the YES case, Alice is given the prefix $(\sigma_{1},\dots,\sigma_{t-1})$ of length $t-1$ of $\sigma$. In the NO case, Alice is given the suffix $(\sigma_{2},\dots,\sigma_{t})$ of length $t-1$ of $\sigma$. Alice and Bob need to determine which of the YES and NO cases occurs.

Lemma 4.3 lower-bounds the private-coin communication complexity of $\mathcal{G}_{m,t}$. Its proof uses Linial’s lower bound on the chromatic number of related graphs.

Lemma 4.3**.**

There is an absolute constant $c$ such that for every sufficiently small $\epsilon>0$, we have that $\mathsf{PrivCC}_{\epsilon}(\mathcal{G}_{m,t})\geq c\cdot\log^{(t+2)}(m)$.

We prove Lemma 4.3 in Section 4.1. The proof of Part (iii) of Theorem 1.1 – which is the main part in the proof of Theorem 1.1 – is given in Section 4.2.

4.1 Proof of Lemma 4.3

The following family of graphs was first studied by Linial (in the setup of distributed graph algorithms) [Lin92].

Definition 4.4** (Shift Graph $G_{m,t}$).**

Let $m$ and $t$ be positive integers with $t\leq m$. In the graph $G_{m,t}=(V_{m,t},E_{m,t})$, the vertices are all sorted tuples $\sigma=(\sigma_{1},\dots,\sigma_{t})$ of distinct integers with $1\leq\sigma_{1}<\dots<\sigma_{t}\leq m$. Two such tuples $\sigma$ and $\pi$ are connected by an edge in $E_{m,t}$ if and only if either $(\sigma_{1},\dots,\sigma_{t-1})=(\pi_{2},\dots,\pi_{t})$ or $(\sigma_{2},\dots,\sigma_{t})=(\pi_{1},\dots,\pi_{t-1})$.

Recall that the chromatic number $\chi(G)$ of an undirected graph $G$ is the minimum number of colors needed to color its vertices such that no two adjacent vertices share the same color. The following theorem is due to Linial.

Theorem 4.5** ([Lin92], Proof of Theorem $2.1$).**

Let $m$ and $t$ be positive integers such that $t\leq m$ and $t$ is odd. Then, $\chi(G_{m,t})\geq\log^{(t-1)}(m)$.

The next lemma uses Theorem 4.5 to lower-bound the deterministic two-way communication complexity of the shift communication game $\mathcal{G}_{m,t}$.

Lemma 4.6**.**

Let $m$ and $t$ be positive integers such that $t\leq m$ and $t$ is odd. Then, it is the case that $\mathsf{CC}(\mathcal{G}_{m,t})\geq\log^{(t+1)}(m)$.

Proof of Lemma 4.6.

Assume for the sake of contradiction that there exists a deterministic two-way protocol that computes $\mathcal{G}_{m,t}$ and that has communication cost smaller than $\log^{(t+1)}(m)$. Then, using the fact that the one-way communication complexity of any function is at most exponential in its two-way communication complexity, we get that there is a one-way protocol $\Pi$ that computes $\mathcal{G}_{m,t}$ and that has communication cost smaller than $\log^{(t)}(m)$. Let $M$ be the single message sent from Alice to Bob under $\Pi$. Then, the length of $M$ satisfies $|M|<\log^{(t)}(m)$. Note that Alice’s input is an element of the vertex-set $V_{m,t}$ of the shift graph $G_{m,t}$ (Definition 4.4). Since $M$ is a deterministic function of Alice’s input, it induces a coloring of $V_{m,t}$ into less than $2^{\log^{(t)}(m)}=\log^{(t-1)}(m)$ colors. The fact that no two adjacent vertices in $G_{m,t}$ share the same color follows from the correctness of $\Pi$ in computing $\mathcal{G}_{m,t}$. This contradicts Theorem 4.5. ∎

The following known fact gives a generic lower bound on the bounded-error private-coin communication complexity in terms of the deterministic communication complexity.

Fact 4.7** ([KN97], Theorem $3.14$).**

For every communication function $f$ and every non-negative $\epsilon$ that is bounded below $1/2$, we have that $\mathsf{PrivCC}_{\epsilon}(f)=\Omega(\log(\mathsf{CC}(f)))$.

Lemma 4.3 now follows by combining Lemma 4.6 and Fact 4.7.

4.2 Proof of Part (iii) of Theorem 1.1

In this section, we prove Part (iii) of Theorem 1.1. We assume for the sake of contradiction that there exists a $1$-way private-coin protocol $\Pi$ computing $\mathcal{F}_{\delta}$ w.r.t. the uniform distribution on $\{0,1\}^{2n}$ with error at most $\epsilon/2-2\delta-\eta$ and with communication cost $|\Pi|=o(\eta^{2}\cdot\log^{(t)}(n))$ for some positive integer $t=\Theta((\epsilon/\delta)^{2})$ that will be exactly specified later on. We will use $\Pi$ to give a $1$-way private-coin protocol $\Pi^{\prime}$ solving the shift communication game $\mathcal{G}_{m,t}$ with high constant probability and with communication cost $|\Pi^{\prime}|\leq O(\eta^{-2}\cdot|\Pi|)=o(\log^{(t)}(n))$, which would contradict Lemma 4.3.

4.2.1 Description of Protocol $\Pi^{\prime}$

The operation of protocol $\Pi^{\prime}$, which uses $\Pi$ as a black-box, is described in Protocol 1. Note that the parameters in Protocol 1 are defined in terms of $\epsilon$ (which is a number in $[\delta,0.5]$ that is given in the statement of Theorem 1.1) and $\delta^{\prime}$ (which, as mentioned above, is set to $\alpha\cdot\delta^{2}$ for a sufficiently small positive absolute constant $\alpha$). Also as above, $\ell$ is set to a sufficiently large function of $\delta$. Note that $\epsilon^{\prime}=O(\epsilon^{2})$, and hence $t=O((\epsilon/\delta)^{2})$. In Protocol 1, Bob is given as input a sorted tuple $\sigma$, and Alice is given as input either the prefix $\phi$ of $\sigma$ or its suffix $\psi$. In steps 1 and 2, Alice and Bob “stretch” their tuples, which amounts to each of them repeating each bit of the corresponding $0/1$ indicator vector a certain number of times and appending a certain number of zeros (see Definition 4.8 and Figure 1 in Section 4.2.2 below for a thorough definition of $\mathsf{stretch}_{r,a}$). The aim of steps 1 and 2 is for Alice and Bob to produce a pair of subsets $(S,T)$ of $[n]$ such that $(f_{S},f_{T})\in\mathcal{F}_{\delta}$. The goal of Protocol 1 is for Bob to determine if Alice was given the prefix or the suffix of his tuple $\sigma$. To do so, Alice and Bob sample (using their private coins) $k$ random inputs $(X^{(i)},Y^{(i)})_{i\in[k]}$ (steps 3 and 4) and then simulate the given private-coin protocol $\Pi$ to compute the function $f_{T}(X,Y)$ on the $k$ random input-pairs that were sampled (steps 6 and 7). Moreover, Alice sends to Bob the influential bits of $X^{(i)}$ for each $i\in[k]$ (step 8). The main idea will be to be for Bob to compute the empirical error corresponding to each of the prefix (step 11) and suffix (step 12), and then output the hypothesis with the smallest empirical error (step 13).

4.2.2 The $\mathsf{stretch}_{r,a}$ Procedure

In this section, we thoroughly define and illustrate the stretching procedure used in Protocol 1 and mentioned in Section 4.

Definition 4.8** (The $\mathsf{stretch}_{r,a}$ procedure).**

Let $d$, $t$, $r$ and $a$ be positive integers with $t\leq d$. For any sorted tuple $\sigma=(\sigma_{1},\dots,\sigma_{t})$ of distinct integers with $1\leq\sigma_{1}<\dots<\sigma_{t}\leq d$, we first let $z\in\{0,1\}^{d}$ be the $0/1$ indicator vector of the subset of $[d]$ corresponding to $\sigma$. Let $w\in\{0,1\}^{d\cdot r+a}$ be the string obtained from $z$ by repeating each of its coordinates $r$ times, and then appending $a$ ones. Namely, for each $i\in[d]$ and $j\in[r]$, we set $w_{(i-1)\cdot r+j}=z_{i}$ and for each $j\in[a]$, we set $w_{d\cdot r+j}=1$. Then, we let $1\leq\Sigma_{1}<\Sigma_{2}<\dots<\Sigma_{t\cdot r+a}\leq d\cdot r+a$ be the indices of the coordinates of $w$ that are equal to $1$. The output of $\mathsf{stretch}_{r,a}(\sigma)$ is then the pair $(\Sigma,W)$ where $\Sigma\triangleq(\Sigma_{1},\Sigma_{2},\dots,\Sigma_{t\cdot r+a})$ and $W\subseteq[d\cdot r+a]$ is the support of $w$.

The operation of $\mathsf{stretch}_{r,a}$ is illustrated in Figure 1 in the particular case where $r=2$, $a=3$ and $d=9$. The “appending parameter” $a$ allows us to control how small is the normalized Hamming distance between the binary strings corresponding to $\Sigma$ and $\Phi$ (respectively $\Psi$). The purpose of the “repetition parameter” $r$ is the following. Consider the tuples $\phi=(2,4,5,7)$ and $\psi=(4,5,7,9)$ in Figure 1. The number of differing coordinates between the tuples $\phi$ and $\psi$ is $4$. After stretching, the number of differing coordinates between the resulting tuples $\Phi$ and $\Psi$ is amplified to $4\cdot r=8$. These two notions of distance (the number of coordinates on which the tuples differ and the normalized Hamming distance between the corresponding binary strings) are important to us. The fact that these two distances are important to us is the reason why we let the $\mathsf{stretch}_{r,a}$ procedure have two equivalent outputs (a subset $W$ and a tuple $\Sigma$).

4.2.3 Analysis of Protocol $\Pi^{\prime}$

We now turn to the formal analysis of Protocol 1. First, note that the communication cost of protocol $\Pi^{\prime}$ satisfies $|\Pi^{\prime}|\leq O(\eta^{-2}\cdot|\Pi|)$. Let $\Lambda$, $\Sigma$, $\Phi$ and $\Psi$ be the ordered sequences defined in the operation of Protocol 1. Define the functions $g$ and $h$ as

[TABLE]

Note that steps 11 and 12 of the protocol compute the empirical errors of functions $g$ and $h$ respectively. Since $\Lambda\in\{\Phi,\Psi\}$, let’s assume WLOG that $\Lambda=\Phi$ and show that the protocol $\Pi^{\prime}$ returns YES with high probability. The case where $\Lambda=\Psi$ is symmetric. When $\Lambda=\Phi$, we have that $g=f_{S}$ where $S$ is the subset of $[n]$ that Alice gets in step 1. The operation of the $\mathsf{stretch}_{r,a}$ procedure (Definition 4.8) guarantees that $S\subseteq[n]$, $|T|=\ell$ and $|T\setminus S|=\delta^{\prime}\cdot\ell$. Part (i) of Theorem 1.1 then implies that $\Delta(g,f_{T})\leq\delta$. In order to show that in step 13 Bob returns YES with high probability, the main idea will be to lower bound the distance between the functions $g$ and $h$. This is done in the next lemma.

Lemma 4.9**.**

The functions $g$ and $h$ defined in Equations (3a) and (3b) satisfy $\Delta(g,h)\geq\epsilon-\delta$.

To prove Lemma 4.9, we use the next lemma which spells out the distribution of the sequence $(X_{\Lambda_{j}}Y_{\Phi_{j}},X_{\Lambda_{j}}Y_{\Psi_{j}})_{j\in[s]}$ of random variables.

Lemma 4.10**.**

The random variables $(X_{\Lambda_{1}}Y_{\Phi_{1}},X_{\Lambda_{1}}Y_{\Psi_{1}}),(X_{\Lambda_{2}}Y_{\Phi_{2}},X_{\Lambda_{2}}Y_{\Psi_{2}}),\dots,(X_{\Lambda_{s}}Y_{\Phi_{s}},X_{\Lambda_{s}}Y_{\Psi_{s}})$ are independent, and they are distributed as follows:

For $1\leq j\leq s-a$, $(X_{\Lambda_{j}}Y_{\Phi_{j}},X_{\Lambda_{j}}Y_{\Psi_{j}})$ is uniformly distributed on $\{\pm 1\}^{2}$. 2. 2.

For $s-a<j\leq s$, $(X_{\Lambda_{j}}Y_{\Phi_{j}},X_{\Lambda_{j}}Y_{\Psi_{j}})$ is uniformly distributed on $\{(-1,-1),(+1,+1)\}$.

Proof of Lemma 4.10.

By the operation of the $\mathsf{stretch}_{r,a}$ procedure (Definition 4.8) in steps 1 and 2 of Protocol 1, for every $s-a<j\leq s$, it holds that $(X_{\Lambda_{j}}Y_{\Phi_{j}},X_{\Lambda_{j}}Y_{\Psi_{j}})=(X_{j}Y_{j},X_{j}Y_{j})$ and that $X_{j}$ and $Y_{j}$ do not contribute to any other $(X_{\Lambda_{j^{\prime}}}Y_{\Phi_{j^{\prime}}},X_{\Lambda_{j^{\prime}}}Y_{\Psi_{j^{\prime}}})$ pair. This implies part 1 and that for each $s-a<j\leq s$, the pair $(X_{\Lambda_{j}}Y_{\Phi_{j}},X_{\Lambda_{j}}Y_{\Psi_{j}})$ is independent of all other pairs in the sequence.

We next prove by induction on $1\leq j\leq s-a$ that conditioned on $(X_{\Lambda_{<j}}Y_{\Phi_{<j}},X_{\Lambda_{<j}}Y_{\Psi_{<j}})$ taking any particular value, $(X_{\Lambda_{j}}Y_{\Phi_{j}},X_{\Lambda_{j}}Y_{\Psi_{j}})$ is uniformly distributed on $\{\pm 1\}^{2}$. To see this (assuming WLOG that $\Lambda=\Phi$), note that $(X_{\Lambda_{j}}Y_{\Phi_{j}},X_{\Lambda_{j}}Y_{\Psi_{j}})=(X_{\Lambda_{j}}Y_{\Lambda_{j}},X_{\Lambda_{j}}Y_{\Psi_{j}})$ where $X_{\Lambda_{j}}$ and $Y_{\Psi_{j}}$ do not appear in $(X_{\Lambda_{<j}}Y_{\Phi_{<j}},X_{\Lambda_{<j}}Y_{\Psi_{<j}})$. Hence, conditioned on $(X_{\Lambda_{<j}}Y_{\Phi_{<j}},X_{\Lambda_{<j}}Y_{\Psi_{<j}})$ taking any particular value, $X_{\Lambda_{j}}Y_{\Phi_{j}}$ is a uniformly random bit (because of $X_{\Lambda_{j}}$). Moreover, conditioned on $(X_{\Lambda_{<j}}Y_{\Phi_{<j}},X_{\Lambda_{<j}}Y_{\Psi_{<j}})$ and $X_{\Lambda_{j}}Y_{\Phi_{j}}$ taking any particular values, $X_{\Lambda_{j}}Y_{\Psi_{j}}$ is a uniformly random bit (because of $Y_{\Psi_{j}}$). This completes the proof of the lemma. ∎

We now use Lemma 4.10 along with a two-dimensional Central Limit Theorem in order to prove Lemma 4.9.

Proof of Lemma 4.9.

By Lemma 4.10, independently for each $1\leq j\leq s-a$, $(X_{\Lambda_{j}}Y_{\Phi_{j}},X_{\Lambda_{j}}Y_{\Psi_{j}})$ is a $\rho_{j}$-correlated random pair with $\rho_{j}=0$, and independently for each $s-a<j\leq s$, $(X_{\Lambda_{j}}Y_{\Phi_{j}},X_{\Lambda_{j}}Y_{\Psi_{j}})$ is a $\rho_{j}$-correlated random pair with $\rho_{j}=1$. Hence, the average correlation across coordinates is

[TABLE]

where the last inequality used the setting of $t=\lceil\epsilon^{\prime}/\delta^{\prime}\rceil$ in Protocol 1. Denoting by $\Sigma_{j}$ the covariance matrix of $(X_{\Lambda_{j}}Y_{\Phi_{j}},X_{\Lambda_{j}}Y_{\Psi_{j}})$ for every $j\in[s]$, the average (across coordinates) covariance matrix is then given by $\Sigma\triangleq k^{-1}\cdot\displaystyle\sum\limits_{j\in[k]}\Sigma_{j}=\begin{bmatrix}1&\rho\\ \rho&1\end{bmatrix}$. Note that the smallest eigenvalue of $\Sigma$ is $\lambda=1-|\rho|$. Let $(X^{\prime},Y^{\prime})$ be a pair of zero-mean $\rho$-correlated Gaussians. By the two-dimensional Berry-Esseen Theorem A.1 and Sheppard’s formula (i.e., Fact 4.1), we get that

[TABLE]

where the last inequality follows by setting $\epsilon^{\prime}=1-\cos(\epsilon\pi)$ for the given $\epsilon\in[\delta,0.5]$, setting $\ell$ to be a sufficiently large function of $\delta$, and setting $\delta^{\prime}=\alpha\cdot\delta^{2}$ for a sufficiently small positive absolute constant $\alpha$. ∎

We are now ready to complete the proof of Part (iii) of Theorem 1.1. In Protocol 1, the tuples $((X^{(i)},Y^{(i)}),B_{i})_{i\in[k]}$ are i.i.d. samples corresponding to a function $q$ which, by the error guarantee of protocol $\Pi$, is $(\epsilon/2-2\delta-\eta)$-close to $f_{T}$. Since $\Delta(g,f_{T})\leq\delta$, we get that $\Delta(g,q)\leq(\epsilon/2-\delta-\eta)$. By Lemma 4.9, we also get that $\Delta(h,q)\geq(\epsilon/2+\eta)$. By Hoeffding’s bound (i.e., Fact 4.11), for $k=\Theta(1/\eta^{2})$, the empirical error $\epsilon^{(p)}$ of $g$ on the samples $((X^{(i)},Y^{(i)}),B_{i})_{i\in[k]}$ is less than the empirical error $\epsilon^{(s)}$ of $h$ on these samples, with high constant probability. Hence, Bob returns YES with high constant probability. A symmetric argument shows that when $\Lambda=\Psi$, Bob returns NO with high constant probability, which completes the proof.

Fact 4.11** (Hoeffding’s bound).**

Consider a coin that shows up head with probability $p$. Let $H(k)$ be the number of heads obtained in $k$ independent tosses of this coin. Then, for every $\epsilon>0$, $\Pr[|H(k)-pk|>\epsilon k]\leq 2e^{-2\epsilon^{2}k}$.

Note**.**

As mentioned in Note Note, the above construction cannot give a separation larger than $\Theta(\log\log{n})$. This is because using private randomness, Bob can learn the set $S$ using $O(\log\log{n})$ bits of communication (see, e.g., [BCK*+*14]). Additionally, Alice can send the coordinates of $X$ indexed by the elements of $S$ to Bob who can then compute $f_{S}(X,Y)$.

5 Construction for Public-Coin Uncertain Protocols

In this section, we describe the construction that is used to prove Theorem 1.3. We set

[TABLE]

where $\delta$ is the parameter from the statement of Theorem 1.3, and $c>0$ is a small-enough absolute constant. To define our input distribution, we first define a slightly more general distribution $\mu_{\eta}$. The support of $\mu_{\eta}$ is $\{0,1\}^{kn}\times\{0,1\}^{kn}$ and we will view the coordinates of a sample $(x,y)\sim\mu_{\eta}$ as $x=(x^{(i)})_{i\in[k]}$ and $y=(y^{(i)})_{i\in[k]}$ with $x^{(i)},y^{(i)}\in\{0,1\}^{n}$ for all $i\in[k]$. A sample $(x,y)\sim\mu_{\eta}$ is generated by letting $x\in_{R}\{0,1\}^{kn}$ and for all $i\in[k]$ and $j\in[n]$, independently setting $y^{(i)}_{j}$ to be an $\eta$-noisy copy of $x^{(i)}_{j}$. In other words, we set $y^{(i)}_{j}=x^{(i)}_{j}$ w.p. $1-\eta$ and $y^{(i)}_{j}=1-x^{(i)}_{j}$ w.p. $\eta$. Our input distribution is then $\mu_{2\epsilon-2\epsilon^{2}}$.

We now define our function class $\mathcal{F}_{\epsilon}$. Each function in our universe is specified by a sequence of subsets $S\triangleq(S^{(i)}\subseteq[n])_{i\in[k]}$ and it is of the form $f_{S}:\{0,1\}^{2\cdot k\cdot n}\to\{0,1\}$ with141414We will use the symbol $S^{(i)}$ to denote both the subset of $[n]$ and its corresponding $0/1$ indicator vector.

[TABLE]

for all $x,y\in\{0,1\}^{k\cdot n}$, where in Eq. (4) the inner product is over $\mathbb{F}_{2}$, the sum is over $\mathbb{R}$ and $x^{(i)}\oplus y^{(i)}$ denotes the coordinate-wise XOR of the two length-$n$ binary strings $x^{(i)}$ and $y^{(i)}$. The function class is then defined by $\mathcal{F}_{\epsilon}\triangleq\{(f_{S},f_{T}):|S^{(i)}\triangle T^{(i)}|\leq\epsilon\cdot n\text{ for all }i\in[k]\}$.

We now give the proof of Part (i) of Theorem 1.3. It follows from known bounds on the noise stability of the majority function.

Proof of Part (i) of Theorem 1.3.

Let $(f_{S},f_{T})\in\mathcal{F}_{\epsilon}$, and denote $a_{i}\triangleq(-1)^{\langle S^{(i)},x^{(i)}\oplus y^{(i)}\rangle}$ and $b_{i}\triangleq(-1)^{\langle T^{(i)},x^{(i)}\oplus y^{(i)}\rangle}$ for every $i\in[k]$. Also, let $a\triangleq(a_{i})_{i\in[k]}$ and $b\triangleq(b_{i})_{i\in[k]}$. Note that $(a_{i},b_{i})$ is a pair of $\rho_{i}$-correlated random strings with $\rho_{i}\geq(1-2\delta^{\prime})$. Since $\Delta_{\mu_{2\epsilon-2\epsilon^{2}}}(f_{S},f_{T})$ increases when $\rho_{i}$ decreases, we assume WLOG that $\rho_{i}=1-2\delta^{\prime}\triangleq\rho$ for all $i\in[k]$.

Recall that the noise stability of a function $h:\{0,1\}^{k}\to\{\pm 1\}$ is defined as $\mathsf{Stab}_{\rho}(h)=\mathbb{E}[h(x)h(y)]$ where $(x,y)$ is a random pair of $\rho$-correlated strings. Let the function $\widetilde{\mathsf{Maj}}_{k}$ be defined by $\widetilde{\mathsf{Maj}}_{k}(x)=(-1)^{\mathsf{Maj}_{k}(x)}$ for all $x\in\{0,1\}^{k}$. Recall (see [O’D14]) that the noise stability of $\widetilde{\mathsf{Maj}}_{k}$ satisfies

[TABLE]

Hence, we get that

[TABLE]

where the last equality uses the facts that $\rho=1-2\delta^{\prime}$ and that $\arccos(1-x)=O(\sqrt{x})$ for small positive values of $x$, and the last inequality follows from the setting of $\delta^{\prime}$ in († ‣ 5). ∎

We now give the (straightforward) proof of Part (ii) of Theorem 1.3.

Proof of Part (ii) of Theorem 1.3.

Note that $\langle S^{(i)},x^{(i)}\oplus y^{(i)}\rangle=\langle S^{(i)},x^{(i)}\rangle\oplus\langle S^{(i)},y^{(i)}\rangle$. Thus, when both Alice and Bob know $S$, Alice can send the $k$ bits $(\langle S^{(i)},x^{(i)}\rangle)_{i\in[k]}$ to Bob who can then output the value $f_{S}(x,y)$. ∎

In order to prove Part (iii) of Theorem 1.3, we first define (as in [GKKS16]) a communication problem in the standard distributional model that reduces to solving the contextually-uncertain problem specified by the function class $\mathcal{F}_{\epsilon}$ and the distribution $\mu_{2\epsilon-2\epsilon^{2}}$. For distributions $\phi$ and $\psi$, we denote by $\phi\otimes\psi$ the joint distribution of a sample from $\phi$ and an independent sample from $\psi$. The new problem is defined as follows.

Inputs:

Alice’s input is a pair $(S,x)$ where $S\triangleq(S^{(i)}\subseteq[n])_{i\in[k]}$ and $x\in\{0,1\}^{k\cdot n}$. Bob’s input is a pair $(T,y)$ where $T\triangleq(T^{(i)}\subseteq[n])_{i\in[k]}$ and $y\in\{0,1\}^{k\cdot n}$.

Distribution:

Let $\mathcal{D}_{q}$ be the distribution on the pair $(S,T)$ of sequences of $k$ subsets of $[n]$, which is defined by independently setting, for each $i\in[k]$, $S^{(i)}$ to be a uniformly-random subset of $[n]$, and $T^{(i)}$ to be a $q$-noisy copy of $S^{(i)}$. The distribution on the inputs of Alice and Bob is then given by $\nu_{\epsilon}\triangleq\mathcal{D}_{\epsilon}\otimes\mu_{2\epsilon-2\epsilon^{2}}$ with $\epsilon=\sqrt{\delta^{\prime}/n}$.

Function:

The goal is to compute the function $F:\{0,1\}^{2kn}\times\{0,1\}^{2kn}\to\{0,1\}$ defined by F((S,x),(T,y))=f_{T}(x,y)=\mathsf{Sign}\big{(}\sum_{i\in[k]}(-1)^{\langle T^{(i)},x^{(i)}\oplus y^{(i)}\rangle}\big{)}.

The next proposition follows from a simple application of the Chernoff bound.

Proposition 5.1**.**

For any $\theta>0$, $\mathsf{owPubCCU}_{\theta}^{\mu_{2\epsilon-2-\epsilon^{2}}}(\mathcal{F}_{\epsilon})\geq\mathsf{owCC}^{\nu_{\epsilon}}_{\theta+\theta^{\prime}}(F)$ with $\theta^{\prime}=2^{-\Theta(\epsilon\cdot n)}$.

We will prove the following lower bound on $\mathsf{owCC}^{\nu_{\epsilon}}_{\theta}(F)$, which along with Proposition 5.1 and the settings of $\epsilon$ and $\delta^{\prime}$ in († ‣ 5), implies Part (iii) of Theorem 1.3:

Lemma 5.2**.**

For every sufficiently small positive constant $\theta$, $\mathsf{owCC}^{\nu_{\epsilon}}_{\theta}(F)=\Omega(k\cdot\epsilon\cdot n)$.

We now prove Lemma 5.2 (which is the bulk of the proof of Theorem 1.3). Subsection 5.1 summarizes some known results that we use in Subsections 5.2 and 5.3. In Subsection 5.2, we prove a “Simulation Lemma” that will be useful to us. In Subsection 5.3, we prove Lemma 5.2.

5.1 Proof Preliminaries for Subsections 5.2 and 5.3

In this subsection, we state some tools and known results that we use in the proofs in Subsections 5.2 and 5.3. We use the following strong direct product theorem for discrepancy of [LSS08]151515We point out that the statement of Corollary $23$ of [LSS08] has a small inaccuracy: the additive $2^{-k\cdot(1-H_{b}(\tau))}$ term in Lemma 5.3 is missing. This term is clearly needed as one can always guess $f^{(k)}$ with probability $2^{-k}$. The statement that we use (Lemma 5.3) can be obtained by combining Theorem $22$ of [LSS08] and the proof of Proposition $1.4$ of [VW08]..

Lemma 5.3** (Corollary $23$ of [LSS08]).**

Let $f:X\times Y\to\{0,1\}$ be a Boolean function and $P$ a probability distribution over $X\times Y$. If $\mathsf{CC}^{P}_{1/2-w/2}(f)\geq C$ is proved using the discrepancy method, then the success probability under distribution $P^{\otimes k}$ of any $kC/3$ bit protocol computing the vector of solutions $f^{(k)}$ is at most $(8w)^{\tau\cdot k}+2^{-k\cdot(1-H_{b}(\tau))}$ where $\tau$ is any positive constant less than $0.5$.

Let $\xi_{\epsilon}$ be the distribution that is obtained by projecting $\nu_{\epsilon}$ on one of the $k$ blocks and marginalizing over the remaining $k-1$ blocks. Namely, $\nu_{\epsilon}=\xi_{\epsilon}^{\otimes k}$. Define the “base function” $G((\tilde{S},\tilde{x}),(\tilde{T},\tilde{y}))$ by $G((\tilde{S},\tilde{x}),(\tilde{T},\tilde{y}))=\langle\tilde{T},\tilde{x}\oplus\tilde{y}\rangle$ for every $\tilde{S},\tilde{T}\subseteq[n]$ and $\tilde{x},\tilde{y}\in\{0,1\}^{n}$. We will use the following lower-bound on the distributional complexity of $G$ over $\xi_{\epsilon}$ that was proved in [GKKS16] using the discrepancy method.

Lemma 5.4** ([GKKS16]).**

For any $w=2^{-o(\sqrt{\delta^{\prime}n})}$, we have that $\mathsf{CC}^{\xi_{\epsilon}}_{1/2-w/2}(G)\geq\Omega(\epsilon\cdot n)$, and it is proved using the discrepancy method.

Combining Lemma 5.3 and Lemma 5.4 implies the next corollary.

Corollary 5.5**.**

For every positive constant $\gamma$, any deterministic protocol computing $G^{(k)}$ correctly with probability at least $(0.5+\gamma)^{k}$ with respect to the distribution $\xi_{\epsilon}^{\otimes k}=\nu_{\epsilon}$ should be communicating $\Omega(k\cdot\epsilon\cdot n)$ bits.

We define the Hamming distance function $\mathsf{HD}_{k}:\{0,1\}^{k}\times\{0,1\}^{k}\to\{0,1\}$ as follows. For all $x,y\in\{0,1\}^{k}$, $\mathsf{HD}_{k}(x,y)=1$ if the Hamming distance between $x$ and $y$ is at least $\left\lfloor k/2\right\rfloor$ and $\mathsf{HD}_{k}(x,y)=0$ otherwise. Let $\mathcal{U}_{2k}$ denote the uniform distribution on $\{0,1\}^{2k}$.

Lemma 5.6** ([Woo07]).**

For every sufficiently small $\epsilon>0$, it holds that $\mathsf{owCC}^{\mathcal{U}_{2k}}_{\epsilon}(\mathsf{HD}_{k})=\Omega(k)$.

The next lemma of [JRS03] compresses a $1$-way private-coin protocol with external information cost161616The external information cost of a protocol is the amount of information that it reveals about the inputs to an external observer. For a $1$-way private-coin protocol, it is given by $I(X,Y;M)$ where $M$ is the single message sent from Alice to Bob. $I$ into a $1$-way deterministic protocol with communication cost $O(I)$.

Lemma 5.7** (Result $1$ of [JRS03]).**

Suppose that $\Pi$ is a $1$-way private-coin randomized protocol for $f:\mathcal{X}\times\mathcal{Y}\to\mathcal{Z}$. Let the average error of $\Pi$ under a probability distribution $\mu$ on the inputs $\mathcal{X}\times\mathcal{Y}$ be $\theta$. Let $X,Y$ denote the random variables corresponding to Alice’s and Bob’s inputs respectively. Let $M$ denote the single message sent by Alice to Bob. Suppose $I(X,Y;M)\leq a$. Let $\zeta>0$. Then, there is another deterministic $1$-way protocol $\Pi^{\prime}$ with the following properties:

The communication cost of $\Pi^{\prime}$ is at most $\frac{2(a+1)}{\zeta^{2}}+\frac{2}{\zeta}$ bits. 2. 2.

The distributional error of $\Pi^{\prime}$ under $\mu$ is at most $\theta+2\zeta$.

We will also use the next lemma.

Lemma 5.8**.**

Let $(Q,W,B)$ be correlated random variables with $Q\in\mathcal{Q}$, $W\in\mathcal{W}$ and $B\in\{0,1\}^{k}$. Let $\alpha\in(0,1]$ be any constant. If $I(B;W|Q)\geq\alpha\cdot k$, then there exists a positive constant $\beta$ that only depends on $\alpha$, and a deterministic function $E:\mathcal{Q}\times\mathcal{W}\to\{0,1\}^{k}$ such that $E(Q,W)=B$ with probability at least $(0.5+\beta)^{k}$ over the random choice of $(Q,W,B)$.

Proof of Lemma 5.8.

Consider the deterministic function $E:\mathcal{Q}\times\mathcal{W}\to\{0,1\}^{k}$ defined as follows. For each $(q,w)\in\mathcal{Q}\times\mathcal{W}$, $E(q,w)$ is set to an arbitrary element of the set

[TABLE]

We now argue that $E(Q,W)=B$ with probability at least $(0.5+\beta)^{k}$ over the randomness of $(Q,W,B)$, where $\beta$ is a positive constant that only depends on $\alpha$. Since $I(B;W|Q)\geq\alpha\cdot k$, we have that

[TABLE]

where the third inequality above uses the fact that conditioning does not increase entropy, and the fourth inequality follows from the fact that $B\in\{0,1\}^{k}$. By an averaging argument, with probability at least $\alpha/10$ over $(q,w)\sim(Q,W)$, it should be the case that

[TABLE]

Let $\mathcal{G}\subseteq\mathcal{Q}\times\mathcal{W}$ denote the set of all pairs $(q,w)$ that satisfy Equation (5). We now fix $(q,w)\in\mathcal{G}$, and consider the min-entropy

[TABLE]

Using the fact that min-entropy lower-bounds Shannon entropy and Equation (5), we deduce that there exists $\hat{B}\triangleq\hat{B}(q,w)\in\{0,1\}^{k}$ such that $\Pr[B=\hat{B}|Q=q,W=w]\geq 2^{-(1-\alpha/10)\cdot k}$. Hence, for any fixed $(q,w)\in\mathcal{G}$, conditioned on $(Q=q,W=w)$, the value $E(q,w)$ is equal to $B$ with probability at least $2^{-(1-\alpha/10)\cdot k}$. Since the probability that $(Q,W)\in\mathcal{G}$ is at least $\alpha/10$, we conclude that $E(Q,W)$ is equal to $B$ with probability at least

[TABLE]

for some constant $\beta$ that only depends on $\alpha$. ∎

5.2 Simulation Protocol

Recall that the distribution $\nu_{\epsilon}$ over the inputs $((S,X),(T,Y))$ to $F$ was defined as $\nu_{\epsilon}\triangleq\mathcal{D}_{\epsilon}\otimes\mu_{2\epsilon-2\epsilon^{2}}$. In the following simulation lemma, the error probability will be measured w.r.t. distribution $\nu_{\epsilon}$ whereas the information cost will be measured w.r.t. another distribution $\kappa_{\epsilon}$ over $((S,X),(T,Y))$ inputs, which is defined as $\kappa_{\epsilon}\triangleq\mathcal{D}_{\epsilon}\otimes\mu_{\epsilon}$.

Lemma 5.9** (Simulation Lemma).**

Let $\Pi$ be any deterministic $1$-way protocol computing $F$ with error at most $\theta$ on the distribution $\nu_{\epsilon}$ over $((S,X),(T,Y))$ inputs, and let $M\triangleq M(X,S)$ be the corresponding single message that is sent from Alice to Bob under $\Pi$. Then, we have that

[TABLE]

for some constant $\beta>0$ that only depends on $\theta$.

We point out that in Lemma 5.9, the error probability is measured w.r.t. the distribution $\nu_{\epsilon}$ while the information cost is measured w.r.t. the distribution $\kappa_{\epsilon}$.

Definition 5.10**.**

A sequence $\hat{T}\triangleq(\hat{T}^{(i)}\subseteq[n])_{i\in[k]}$ of subsets is said to be typical if $|\hat{T}^{(i)}|\in[n/3,2n/3]$ for all $i\in[k]$.

Recall that the total variation distance between two distributions $\phi$ and $\psi$ defined on the same finite support $\Omega$ is given by $\Delta_{TV}(\phi,\psi)=\max_{A\subseteq\Omega}|\phi(A)-\psi(A)|=0.5\cdot\sum_{x\in\Omega}|\phi(x)-\psi(x)|$. We will use the next lemma.

Lemma 5.11** (Closeness Lemma).**

For a given sequence $\hat{T}\triangleq(\hat{T}^{(i)}\subseteq[n])_{i\in[k]}$ of subsets, we define the distribution $\mu_{\hat{T},\epsilon}$ as follows. To sample $(X,Y)\sim\mu_{\hat{T},\epsilon}$, we independently sample $U,V\in_{R}\{0,1\}^{k}$, $Z\in_{R}\{0,1\}^{k\cdot n}$, $X$ to be an $\epsilon$-noisy copy of $Z$ conditioned on $(\langle\hat{T}^{(i)},X^{(i)}\rangle)_{i\in[k]}=U$, and $Y$ to be an $\epsilon$-noisy copy of $Z$ conditioned on $(\langle\hat{T}^{(i)},Y^{(i)}\rangle)_{i\in[k]}=V$.

Then, for every fixed typical $\hat{T}$, we have that

[TABLE]

Proof of Lemma 5.11.

We denote $\langle\hat{T},X\rangle\triangleq(\langle\hat{T}^{(i)},X^{(i)}\rangle)_{i\in[k]}$ and similarly $\langle\hat{T},Y\rangle\triangleq(\langle\hat{T}^{(i)},Y^{(i)}\rangle)_{i\in[k]}$. Note that both $\langle\hat{T},X\rangle$ and $\langle\hat{T},Y\rangle$ are elements of $\{0,1\}^{k}$. For every fixed $\hat{X},\hat{Y}\in\{0,1\}^{k\cdot n}$, define $\hat{U}\triangleq\langle\hat{T},\hat{X}\rangle$ and $\hat{V}\triangleq\langle\hat{T},\hat{Y}\rangle$. We have that

[TABLE]

On the other hand, we have that

[TABLE]

Denote by $N_{\epsilon}(Z)$ the distribution of a random variable that is an $\epsilon$-noisy copy version of $Z$. Then,

[TABLE]

where

[TABLE]

where the third equality above follows from the fact that $\hat{T}$ is typical. Plugging back this last expression in Equation (8), we get

[TABLE]

Similarly, we have that

[TABLE]

Combining Equations (7), (9) and (10) yields

[TABLE]

where the last equality above follows from the fact that one way to sample a $(2\epsilon-2\epsilon^{2})$-noisy pair $(X,Y)$ is to first sample a uniform-random $Z$, and then independently sample each of $X$ and $Y$ to be an $\epsilon$-noisy copy of $Z$. Using Equation (11) and the definition of the total-variation distance, we conclude that

[TABLE]

We are now ready to prove Lemma 5.9.

Proof of Lemma 5.9.

Assume for the sake of contradiction that there exists a deterministic $1$-way protocol $\Pi$ that computes $F$ with error at most $\theta$ on $\nu_{\epsilon}$ and that violates Equation (6). Namely, if we define the intermediate information cost of $\Pi$ as

[TABLE]

then we assume that $\textsc{IIC}_{\kappa_{\epsilon}}(\Pi~{}|~{}T)=o(k)$. We say that a particular value $\hat{T}$ of $T$ is nice if it simultaneously satisfies the following three properties:

$\hat{T}$ is typical. 2. 2.

The conditional error of $\Pi$ w.r.t. to $\nu_{\epsilon}$ conditioned on $T=\hat{T}$ is at most $O(\theta)$. 3. 3.

The intermediate information cost condtioned on $T=\hat{T}$ satisfies

[TABLE]

We now argue that there exists a $\hat{T}$ that is nice. To do so, we show that a random $\hat{T}$ satisfies the above three properties with high probability. First, by Definition 5.10, a Chernoff bound and union bound, a random $\hat{T}$ satisfies property 1 with probability at least $1-o(1)$ as long as $k\cdot\exp(-n)=o(1)$. Moreover, by an averaging argument, a random $\hat{T}$ satisfies property 2 with probability $1-o(1)$. Finally, by an averaging argument and the definition of the conditional mutual information in Equation (12), we get that a random $\hat{T}$ satisfies property 3 with probability $1-o(1)$. By a union bound, we conclude that a random $\hat{T}$ satisfies all three properties with high probability. Henceforth, we fix such a nice $\hat{T}$ and use it to give a deterministic $1$-way protocol computing the function $\mathsf{HD}_{k}$ w.h.p. over the uniform distribution on $\{0,1\}^{2\cdot k}$ and with communication $o(k)$ bits. This would contradict the lower bound of [Woo07] (i.e., Lemma 5.6).

Consider the simulation protocol $\Pi^{\prime}$ described in Protocol 2. In this protocol, Alice is given as input a binary string $U$ of length $k$ and Bob is given as input a binary string $V$ of length $k$. We will argue that

1. (a)

The output of $\Pi^{\prime}$ is equal to $\mathsf{HD}_{k}(U,V)$ with probability $1-O(\theta)$ over the randomness of $(U,V)\sim U_{2k}$ and over the private and shared randomness of $\Pi^{\prime}$. 2. (b)

The information cost of $\Pi^{\prime}$ satisfies

[TABLE]

where $M^{\prime}$ is the single (randomized) message sent from Alice to Bob under $\Pi^{\prime}$, and $R$ is the public randomness of $\Pi^{\prime}$.

We start by proving property (a). Let $\lambda$ be the probability distribution of the sequence $S$ of subsets that is sampled in Protocol 2. In other words, $S\sim\lambda$ is an $\epsilon$-noisy copy of $\hat{T}$. Then, when $(U,V)$ is drawn uniformly at random, the induced distribution on $(S,X,Y)$ in Protocol 2 is $\lambda\otimes\mu_{\hat{T},\epsilon}$. Property 2 above guaranteed that the error probability of protocol $\Pi$ on pairs $((S,X),(\hat{T},Y))$ such that $(S,X,Y)\sim\lambda\otimes\mu_{\epsilon}$ is at most $O(\theta)$. Using Lemma 5.11, the fact that Protocol $\Pi^{\prime}$ simulates $\Pi$ and the fact that

[TABLE]

we get that the error probability of $\Pi^{\prime}$ (over the randomness of $(U,V)\sim\mathcal{U}_{2k}$ and over the private and shared randomness) is at most $O(\theta)+O(k\cdot\exp(-\epsilon n))$, which is $O(\theta)$.

We next prove property (b). The information cost of $\Pi^{\prime}$ is given by

[TABLE]

where the second equality above follows from the fact that $(S,X)$ and $V$ are conditionally independent given $Z$, and the last equality follows from the fact that $(X,Z)\sim\mu_{\epsilon}$ in Protocol 2.

To sum up, the $1$-way protocol $\Pi^{\prime}$ computes $\mathsf{HD}_{k}$ with error probability at most $O(\theta)$ and has information cost $o(k)$ bits (by Properties 3 and (b) above). By averaging over the shared randomness, we can convert $\Pi^{\prime}$ into a $1$-way private-coin protocol $\Pi^{\prime\prime}$ with the same error and information cost guarantees. Note that since $U$ and $V$ are independent, we have that $I(U,V;M^{\prime\prime}(U))=I(U;M^{\prime\prime}(U)~{}|~{}V)$ where $M^{\prime\prime}$ is the single message sent from Alice to Bob under $\Pi^{\prime\prime}$. Applying the generic compression result of [JRS03] (i.e., Lemma 5.7) with error parameter $\zeta=\theta$, we get that there exists a $1$-way deterministic protcol $\Pi^{\prime\prime\prime}$ that computes $\mathsf{HD}_{k}$ with error probability at most $O(\theta)$ over the uniform distribution and with communication cost $o(k)$ bits. This contradicts the lower bound of Woodruff [Woo07] (i.e., Lemma 5.6).

∎

5.3 Proof of Lemma 5.2

Assume for the sake of contradiction that there is a deterministic $1$-way protocol $\Pi$ computing $F$ with error at most $\theta$ over the distribution $\nu_{\epsilon}$, and that has communication cost $o(k\cdot\epsilon\cdot n)$ bits. Let $M\triangleq M(X,S)$ be the single message that is sent from Alice to Bob under $\Pi$. By the Simulation Lemma 5.9, we should have that

[TABLE]

for some constant $\beta$ that only depends on $\theta$.

By Lemma 5.8 and Equation (13), there exists a deterministic function $E(Y,T,M(X,S))\in\{0,1\}^{k}$ such that $E(Y,T,M(X,S))=(\langle T^{(i)},X^{(i)}\rangle)_{i\in[k]}$ with probability at least $(0.5+\gamma)^{k}$ for some positive constant $\gamma$ that only depends on $\theta$. Hence, by applying the function $E(Y,T,M(X,S))$ to his inputs $(Y,T)$ and to the message $M(X,S)$ that he receives from Alice, Bob can guess the sequence $(\langle T^{(i)},X^{(i)}\rangle)_{i\in[k]}$ with probability $(0.5+\gamma)^{k}$. By Corollary 5.5 – which combines the strong direct product theorem for discrepancy of [LSS08] (i.e., Lemma 5.3) and the base lower bound of [GKKS16] that was proved using the discrepancy method (i.e., Lemma 5.4) – we conclude that the protocol $\Pi$ should have communication cost $\Omega(k\cdot\epsilon\cdot n)$ bits.

6 Proof of Theorem 1.2

We start by recalling the statement of Theorem 1.2.

Theorem 1.2.

Let $\rho\in(0,1]$ and $\mu$ be a product distribution. Let $\mathcal{F}$ consist of pairs $(f,g)$ of functions with $\Delta_{\mu}(f,g)\leq\delta$, and $\mathsf{owCC}^{\mu}_{\epsilon}(f),\mathsf{owCC}^{\mu}_{\epsilon}(g)\leq k$. Then, for every positive $\theta$, $\mathsf{owIsrCCU}_{\epsilon+2\delta+\theta}^{\mu}(\mathcal{F})\leq O_{\theta}(k/\rho^{2})$.

In order to prove Theorem 1.2, we start by defining a communication problem that will be useful to us (a similar definition is used in [CGMS15]).

Definition 6.1** (Gap Inner Product; $\mathsf{GIP}_{c,s}^{d}$).**

Let $-1\leq s<c\leq 1$. Let Alice be given a vector $u\in\{\pm 1\}^{d}$ and Bob be given a vector $v\in\{\pm 1\}^{d}$. The goal is for Alice and Bob to distinguish the case where $\mathbb{E}_{i\in_{R}[d]}[u_{i}v_{i}]\geq c$ from the case where $\mathbb{E}_{i\in_{R}[d]}[u_{i}v_{i}]\leq s$.

We let $\mathsf{ISR}_{\rho}$ denote the source of imperfect shared randomness where Alice gets a string $r$ of independent uniform-random bits and Bob gets a string $r^{\prime}$ of bits obtained by independently flipping each coordinate of $r$ with probability $(1-\rho)/2$. For a function $f$, we denote by $\mathsf{owIsrCC}_{\epsilon,\rho}(f)$ the minimum cost of a protocol that has access to $\mathsf{ISR}_{\rho}$ and that on input $(x,y)$ in the domain of $f$, ouputs $f(x,y)$ with probability at least $1-\epsilon$, where the probability is over the randomness of $\mathsf{ISR}_{\rho}$.

The following theorem –which upper bounds the communication complexity with $\mathsf{ISR}_{\rho}$ of $\mathsf{GIP}_{c,s}^{d}$– was proved by [CGMS15] using a locality-sensitive-hashing based protocol.

Theorem 6.2** ([CGMS15]).**

Let $\rho\in(0,1]$. Then, $\mathsf{owIsrCC}_{\epsilon,\rho}(\mathsf{GIP}_{c,s}^{d})=O((c-s)^{-2}\rho^{-2}\log(1/\epsilon))$ via a protocol where Alice’s message depends only her input, her part of the randomness, the values of $\rho$ and $\epsilon$ and the difference $c-s$.

Theorem 6.2 can be used in order to estimate the weighted inner product of two vectors up to an arbitrary additive accuracy, and when the weighting is done according to an arbitrary distribution on coordinates that is known to both Alice and Bob.

Lemma 6.3**.**

Let $t,d\in\mathbb{N}$ and $P$ be a distribution over $[d]$ that is known to both Alice and Bob. Let Alice be given a vector $u\in\{\pm 1\}^{d}$ and Bob be given $t$ vectors $v^{(1)},v^{(2)},\dots,v^{(t)}\in\{\pm 1\}^{d}$. Let $\theta>0$ and $\rho\in(0,1]$ be given. Then, there exists a $1$-way protocol with communication cost $O(\theta^{-2}\rho^{-2}\log(t/\theta))$ bits such that, with probability $1-\theta$, for every $j\in[t]$, Bob computes $\mathbb{E}_{i\sim P}[u_{i}v^{(j)}_{i}]$ up to an additive accuracy of $\theta$.

Proof.

First, note that we can reduce the case of general distributions $P$ on $[d]$ to the case of the uniform distribution on $[d^{\prime}]$ for some integer $d^{\prime}\in\mathbb{N}$, by having Alice and Bob repeat coordinate $i\in[d]$ of their vectors a number of times proportional to $P(i)$. More precisely, we can assume WLOG that $P(i)$ is a rational number for each $i\in[d]$ (because of the density of the rationals in the reals), and then have Alice and Bob repeat coordinate $i$ a number of times equal to $\ell\cdot P(i)$ where $\ell$ is the least-common multiple of the denominators in $\{P(i):i\in[d]\}$.

Henceforth, we assume that $P$ is the uniform distribution on $[d^{\prime}]$. Alice sends a message of the protocol for $\mathsf{GIP}$ in Theorem 6.2 with parameters $c-s=\theta$ and $\epsilon=\theta^{2}/t$. Bob then divides the interval $[-1,+1]$ into $2/\theta$ sub-intervals, each of length $\theta$. Then, he completes the protocol for $\mathsf{GIP}$ in Theorem 6.2 on Alice’s message, for each subinterval and for each of his vectors $v^{(1)},v^{(2)},\dots,v^{(t)}$. For each fixed $j\in[t]$, by a union bound over the $2/\theta$ sub-intrevals, we get that with probability $1-\theta/t$, Bob can deduce the value of $\mathbb{E}_{i\sim P}[u_{i}v^{(j)}_{i}]$ up to additive accuracy $\theta$. Another union bound over all $t$ vectors of Bob implies that with probablility $1-\theta$, for each $j\in[t]$, he computes the value of $\mathbb{E}_{i\sim P}[u_{i}v^{(j)}_{i}]$ up to additive accuracy $\theta$.

Moreover, by our setting of $c-s=\theta$ and $\epsilon=\theta^{2}/t$, we get that the communication cost of the protocol is $O(\theta^{-2}\rho^{-2}\log(t/\theta))$ bits. ∎

We are now ready to prove Theorem 1.2.

Proof of Theorem 1.2.

Let $\rho\in[0,1]$ and $\mu$ be a product distribution. Consider a pair $(f,g)\in\mathcal{F}$. Since $\mathsf{owCC}^{\mu}_{\epsilon}(g)\leq k$, there exist an integer $L\leq 2^{k}$ and (deterministic) functions $\pi\colon X\to[L]$ and $\{B_{i}\colon Y\to\{0,1\}\}_{i\in[L]}$, such that Alice’s message on input $x$ is $\pi(x)$, and Bob’s output on message $i$ from Alice and on input $y$ is $B_{i}(y)$. For every $x\in X$, we define the function $f_{x}:Y\to\{0,1\}$ as $f_{x}(y)\triangleq f(x,y)$ for all $y\in Y$. We also denote $\tilde{f}_{x}(y)\triangleq(-1)^{f_{x}(y)}$, and similarly $\tilde{B}_{i}(y)\triangleq(-1)^{B_{i}(y)}$. The operation of the protocol is given in Protocol 3.

The same argument as in the analysis of the protocol of [GKKS16] (specialized for product distributions) then implies that the probability that $B_{j_{\max}}(y)$ is not equal to $g(x,y)$ is at most $\epsilon+2\delta+\theta$. By Lemma 6.3 and our setting of $t=L\leq 2^{k}$, we get that the communication cost of Protocol 3 is $O_{\theta}(k/\rho^{2})$ bits, as desired. ∎

7 Open Questions

As mentioned in Notes Note and Note in Section 1, significantly improving the bounds from Theorems 1.1 and 1.3 seems to require fundamentally new constructions, and is a very important question. Moreover, is there an analogue of the protocol in Theorem 1.2 for non-product distributions?

Another very important and intriguing open question is whether efficient communication under contextual uncertainty is possible in the multi-round setup. Namely, if $k$ is the $r$-round certain communication, can we upper bound the $r$-round uncertain communication by some function of $k$, $I$ and possibly $r$? Even for $r=2$ and when the uncertain protocol is allowed to use public randomness, no non-trivial protocols are known in this setting. On the other hand, no separations are known for this case (beyond those known for $r=1$) even if the protocols are restricted to be deterministic.

Acknowledgements.

The authors would like to thank Ilan Komargodski, Pravesh Kothari and Mohsen Ghaffari and the anonymous reviewers for very helfpul discussions and pointers.

Appendix A Two-Dimensional Berry-Esseen Theorem for Independent Random Variables

In this section, we state a two-dimensional Berry-Esseen theorem for independent (but not necessarily identically distributed) binary random variables that we used in the proofs in Section 4 (namely, in the proofs of Part (i) of Theorem 1.1 and of Lemma 4.9). It follows from a known multi-dimensional Berry-Esseen theorem and the argument is very similar to that of [MORS10], the only exceptions being that in our case the random variables are not necessarily identically distributed, and each of them takes values in $\{-1,0,+1\}$ instead of $\{\pm 1\}$.

Theorem A.1** (Two-dimensional Berry-Esseen).**

Consider the linear form $\ell(z)\triangleq k^{-1/2}\cdot\displaystyle\sum\limits_{i\in[k]}z_{i}$ where $z\in\{-1,0,+1\}^{k}$. Let $(x,y)\in\{-1,0,+1\}^{k}\times\{-1,0,+1\}^{k}$ such that independently for each $i\in[k]$, $(x_{i},y_{i})$ is a pair of zero-mean random variables with covariance matrix $\Sigma_{i}$. Let $\Sigma\triangleq k^{-1}\cdot\displaystyle\sum\limits_{i\in[k]}\Sigma_{i}$ and denote by $\lambda$ the smallest eigenvalue of $\Sigma$. Then, for any intervals $I_{1},I_{2}\subseteq\mathbb{R}$, it holds that

[TABLE]

where $(X,Y)$ is a pair of zero-mean Gaussians with covariance matrix $\Sigma$.

Proof.

The following statement appears as Theorem 16 in [KKMO07] and as Corollary 16.3 in [BR86].

Theorem A.2**.**

Let $X_{1},\dots,X_{k}$ be independent random variables taking values in $\mathbb{R}^{d}$ and satisfying:

• •

$\mathbb{E}[X_{j}]$* is the all-zero vector for every $j\in\{1,\dots,k\}$.*

• •

$w^{-1}\sum_{j=1}^{w}{\rm Cov}[X_{j}]=\Sigma$* where ${\rm Cov}$ denotes the covariance matrix.*

• •

$\lambda$* is the smallest eigenvalue of $\Sigma$ and $\Lambda$ is the largest eigenvalue of $\Sigma$.*

• •

$\rho_{3}=k^{-1}\sum_{j=1}^{k}\mathbb{E}[||X_{j}||^{3}]<\infty$.

Let $Q_{k}$ denote the distribution of $k^{-1/2}(X_{1}+\dots+X_{k})$, let $\Phi_{0,V}$ denote the distribution of the $d$-dimensional Gaussian with mean [math] and covariance matrix $\Sigma$, and let $\eta=C\lambda^{-3/2}\rho_{3}k^{-1/2}$, where $C$ is a certain universal constant. Then, for any Borel set $A$,

[TABLE]

where $B(A)$ is the following measure of the boundary of $A$: $B(A)=2\sup_{y\in\mathbb{R}^{d}}\Phi_{0,V}((\partial A)^{\eta^{\prime}}+y)$, $\eta^{\prime}=\Lambda^{1/2}\eta$ and $(\partial A)^{\eta^{\prime}}$ denotes the set of points within distance $\eta^{\prime}$ of the topological boundary of $A$.

We now apply Theorem A.2 with $d=2$ in order to complete the proof of Theorem A.1. We are given that for every $i\in\{1,\dots,k\}$, $\mathbb{E}[X_{i}]=\mathbb{E}[Y_{i}]=0$ and ${\rm Cov}[(X_{i},Y_{i})]=\Sigma_{i}$. Thus, $k^{-1}\cdot\sum_{j=1}^{k}{\rm Cov}[(X_{j},Y_{j})]=\sum_{j=1}^{k}\Sigma_{i}=\Sigma$. Note that the largest eigenvalue of $\Sigma$ is $\Lambda=O(1)$. Moreover, since each coordinate of our random variables is $\{-1,0,+1\}$-valued, for every $j\in\{1,\dots,k\}$, $\mathbb{E}[||X_{j}||^{3}]\leq 2^{3/2}$. Thus, $\rho_{3}\leq 2^{3/2}$. Hence, $\eta=O(\lambda^{-3/2}k^{-1/2})$. As in [KKMO07, MORS10], one can check that the topological boundary of any set of the form $I_{1}\times I_{2}$ (where $I_{1},I_{2}\subseteq\mathbb{R}$ are intervals) is $O(\eta^{\prime})$. Since $\eta^{\prime}=\Lambda^{1/2}\eta=O(\eta)$, Theorem A.1 follows. ∎