Broadcast Congested Clique: Planted Cliques and Pseudorandom Generators

TL;DR

This paper introduces new techniques for proving lower bounds in the Broadcast Congested Clique model, applies them to the planted clique problem, and constructs an efficient pseudo-random generator to reduce randomness in algorithms.

Contribution

It develops a novel method for lower bounds in natural input distributions and constructs an optimal seed pseudo-random generator for the model.

Findings

Lower bounds for directed planted clique when k = n^(1/4 - eps)

A simple, efficient pseudo-random generator that fools the model

First average-case lower bound and time hierarchy for the model

Abstract

We develop techniques to prove lower bounds for the BCAST(log n) Broadcast Congested Clique model (a distributed message passing model where in each round, each processor can broadcast an O(log n)-sized message to all other processors). Our techniques are built to prove bounds for natural input distributions. So far, all lower bounds for problems in the model relied on constructing specifically tailored graph families for the specific problem at hand, resulting in lower bounds for artificially constructed inputs, instead of natural input distributions. One of our results is a lower bound for the directed planted clique problem. In this problem, an input graph is either a random directed graph (each directed edge is included with probability 1/2), or a random graph with a planted clique of size k. That is, k randomly chosen vertices have all of the edges between them included, and all other edges in the graph appear with probability 1/2. The goal is to determine whether a clique exists. We show that when k = n^(1/4 - eps), this problem requires a number of rounds polynomial in n. Additionally, we construct a pseudo-random generator which fools the Broadcast Congested Clique. This allows us to show that every k round randomized algorithm in which each processor uses up to n random bits can be efficiently transformed into an O(k)-round randomized algorithm in which each processor uses only up to O(k log n) random bits, while maintaining a high success probability. The pseudo-random generator is simple to describe, computationally very cheap, and its seed size is optimal up to constant factors. However, the analysis is quite involved, and is based on the new technique for proving lower bounds in the model. The technique also allows us to prove the first average case lower bound for the Broadcast Congested Clique, as well as an average-case time hierarchy.

Equations

$$\Vert \mathcal{P}(\Pi ,{\mathcal{A}}_{\mathsf{rand}})-\mathcal{P}(\Pi ,{\mathcal{A}}_k)\Vert \le O\left(\frac{k^2}{\sqrt{n}}\right).$$

$$\underset{C\sim {\mathcal{S}}_k^{[n]}}{E}\left[\Vert f({\mathcal{U}}_n)-f({\mathcal{U}}_n^C)\Vert \right]\le O\left(\frac{k}{\sqrt{n}}\right).$$

$$\Vert \mathcal{D}-{\mathcal{D}}^{\prime }\Vert \le \Vert {\mathcal{D}}_{|X}-{\mathcal{D}}_{|X}^{\prime }\Vert +\underset{a\sim {\mathcal{D}}_{|X}}{E}\left[\Vert {\mathcal{D}}_{X=a}-{\mathcal{D}}_{X=a}^{\prime }\Vert \right].$$

$$\underset{C\sim {\mathcal{S}}_k^{[n]}}{E}\left[\Vert {\mathcal{P}}_{\text{rand}}^{(t)}-{\mathcal{P}}_C^{(t)}\Vert \right]\le t\cdot c_1\cdot \frac{k^2}{n}\cdot \frac{1}{\sqrt{n}},$$

$$\Vert {\mathcal{P}}_{\text{rand}}^{(t)}-{\mathcal{P}}_C^{(t)}\Vert \le \Vert {\mathcal{P}}_{\text{rand}}^{(t-1)}-{\mathcal{P}}_C^{(t-1)}\Vert +\underset{p\sim {\mathcal{P}}_{\text{rand}}^{(t-1)}}{E}\left[\Vert f_t^{|p}({\mathcal{D}}_t)-f_t^{|p}({\mathcal{D}}_t^C)\Vert \right].$$

$$\underset{C\sim {\mathcal{S}}_k^{[n]}}{E}\left[\Vert {\mathcal{P}}_{\text{rand}}^{(t)}-{\mathcal{P}}_C^{(t)}\Vert \right]\le \underset{C\sim {\mathcal{S}}_k^{[n]}}{E}\left[\Vert {\mathcal{P}}_{\text{rand}}^{(t-1)}-{\mathcal{P}}_C^{(t-1)}\Vert \right]+\underset{p\sim {\mathcal{P}}_{\text{rand}}^{(t-1)}}{E}\underset{C\sim {\mathcal{S}}_k^{[n]}}{E}\left[\Vert f_t^{|p}({\mathcal{D}}_t)-f_t^{|p}({\mathcal{D}}_t^C)\Vert \right].$$

$$\Vert f_t^{|p}({\mathcal{D}}_t)-f_t^{|p}({\mathcal{D}}_t^C)\Vert =0,$$

$$\underset{C^{\prime }\sim {\mathcal{S}}_{k-1}^{[n]\setminus \{t\}}}{E}\left[\Vert f_t^{|p}({\mathcal{D}}_t)-f_t^{|p}({\mathcal{D}}_t^{C^{\prime }\cup \{t\}})\Vert \right]\le O\left(\frac{k}{\sqrt{n}}\right).$$

$$\underset{p\sim {\mathcal{P}}_{\text{rand}}^{(t-1)}}{E}\underset{C\sim {\mathcal{S}}_k}{E}\left[\Vert f_t^{|p}({\mathcal{D}}_t)-f_t^{|p}({\mathcal{D}}_t^C)\Vert \right]\le \frac{k}{n}\cdot O\left(\frac{k}{\sqrt{n}}\right),$$

$$\underset{i\leftarrow [n]}{E}\left[\Vert f(\mathcal{U})-f({\mathcal{U}}^{[i]})\Vert \right]\le O\left(\frac{1}{\sqrt{n}}\right).$$

$$\underset{C\sim {\mathcal{S}}_k^{[n]}}{E}\left[\Vert f({\mathcal{U}}_n)-f({\mathcal{U}}_n^C)\Vert \right]\le O\left(\frac{k}{\sqrt{n}}\right).$$

$$\underset{C\sim {\mathcal{S}}_k^{[n]}}{E}\left[\Vert f({\mathcal{U}}_n)-f({\mathcal{U}}_n^C)\Vert \right]=$$

$$\le$$

$$\underset{j\leftarrow [n]\setminus \{a_i{\}}_{i=1}^{\ell }}{E}\left[\Vert f({\mathcal{U}}_n^{\{a_i{\}}_{i=1}^{\ell }})-f({\mathcal{U}}_n^{\{a_i{\}}_{i=1}^{\ell }\cup \{j\}})\Vert \right]\le O\left(\frac{1}{\sqrt{n-\ell }}\right).$$

$$I(X_i;f(X))=H(X_i)-H(X_i|f(X))=1-H(X_i|f(X)).$$

$$\sum _{i=1}^{n}H(X_i|f(X))\ge H(X|f(X))\ge n-1.$$

$$\sum _{i=1}^{n}I(X_i;f(X))\le n-(n-1)\le 1.$$

$$\underset{i\leftarrow [n]}{E}I(X_i;f(X))\le \frac{1}{n}.$$

$$I(X_i;f(X)):=\underset{x\sim X_i}{E}D(f(X{)}_{X_i=x}||f(X)).$$

$$\underset{i\leftarrow [n]}{E}I(X_i;f(X))=\underset{i\leftarrow [n]}{E}\underset{x\sim X_i}{E}D(f(X{)}_{X_i=x}||f(X))\le \frac{1}{n}.$$

$$\underset{i\leftarrow [n]}{E}\underset{x\sim X_i}{E}\Vert f(X{)}_{X_i=x}-f(X)\Vert \le \sqrt{\frac{1}{n}},$$

$$\underset{i\leftarrow [n]}{E}\frac{1}{2}\cdot \Vert f(X{)}_{X_i=1}-f(X)\Vert \le \sqrt{\frac{1}{n}}.$$

$$\hat{f}(S):=\underset{x\sim {\mathcal{U}}_n}{E}\left[f(x)\cdot (-1{)}^{{\sum }_{i\in S}{x}_i}\right].$$

$$\underset{x\sim {\mathcal{U}}_n}{E}\left[f(x{)}^2\right]=\sum _{S\subseteq [n]}\hat{f}(S{)}^2.$$

$$\Vert \mathcal{D}-{\mathcal{D}}^{\prime }\Vert \le \Vert {\mathcal{D}}_{|X}-{\mathcal{D}}_{|X}^{\prime }\Vert +\underset{a\sim {\mathcal{D}}_{|X}}{E}\left[\Vert {\mathcal{D}}_{X=a}-{\mathcal{D}}_{X=a}^{\prime }\Vert \right].$$

$${\mathcal{D}}^{\text{aux}}(a,b):={\mathcal{D}}^{\prime }(a,b)\cdot \frac{{\mathcal{D}}_{|X}(a)}{{\mathcal{D}}_{|X}^{\prime }(a)}.$$

$$\Vert {\mathcal{D}}^{\text{aux}}-{\mathcal{D}}^{\prime }\Vert =\Vert {\mathcal{D}}_{|X}-{\mathcal{D}}_{|X}^{\prime }\Vert .$$

$$\Vert {\mathcal{D}}^{\text{aux}}-\mathcal{D}\Vert =\underset{a\sim {\mathcal{D}}_{|X}}{E}\left[\Vert {\mathcal{D}}_{X=a}-{\mathcal{D}}_{X=a}^{\prime }\Vert \right].$$

$$\Vert \mathcal{D}-{\mathcal{D}}^{\prime }\Vert$$

$$\le \Vert {\mathcal{D}}_{|X}-{\mathcal{D}}_{|X}^{\prime }\Vert +\underset{a\sim {\mathcal{D}}_{|X}}{E}\left[\Vert {\mathcal{D}}_{X=a}-{\mathcal{D}}_{X=a}^{\prime }\Vert \right].$$

$$D(\mathcal{P}||\mathcal{Q}):=\sum _{s\in S}\mathcal{P}(s)\cdot \log \frac{\mathcal{P}(s)}{\mathcal{Q}(s)}.$$

Full text

One of our results is a lower bound for the directed planted clique problem. In this problem, an input graph is either a random directed graph (each directed edge is included with probability $1/2$), or a random graph with a planted clique of size $k$. That is, $k$ randomly chosen vertices have all of the edges between them included, and all other edges in the graph appear with probability $1/2$. The goal is to determine whether a clique exists. We show that when $k=O(n^{1/4-\varepsilon}),$ this problem requires a number of rounds polynomial in $n$.

Additionally, we construct a pseudo-random generator which fools the Broadcast Congested Clique. This allows us to show that every $k$ round randomized algorithm in which each processor uses up to $n$ random bits can be efficiently transformed into an $O(k)$-round randomized algorithm in which each processor uses only up to $O(k\log n)$ random bits, while maintaining a high success probability. The pseudo-random generator is simple to describe, computationally very cheap, and its seed size is optimal up to constant factors. However, the analysis is quite involved, and is based on the new technique for proving lower bounds in the model.

The technique also allows us to prove the first average case lower bound for the Broadcast Congested Clique, as well as an average-case time hierarchy. We hope our technique will lead to more lower bounds for problems such as triangle counting, APSP, MST, diameter, and more, for natural input distributions.

1 Introduction

Recently there has been a surge of lower bound results in the CONGEST, and Broadcast Congested Clique models ([HP15, DKO14, KR17, cliqueCONGEST] to list a few, though there are many more). In general, these results take the following approach: a specific carefully chosen family of graphs is constructed, and the vertices are partitioned into two parts (or, in some rare cases, three parts), and a reduction from classical two-party communication complexity is used.

A main downside of this approach is that it merely proves worst case lower bounds. For all we know, for more natural input distributions (instead of the artificially constructed graph families used for these communication complexity reductions), many problems which are worst-case hard may become easy. One of our main goals in this paper is to develop techniques that prove lower bounds for more natural input distributions.

The distributed model we consider is the Broadcast Congested Clique model (BCAST(1))111Note that every lower bound for BCAST(1) can be extended to a lower bound for BCAST($\log n$) with only a $\log n$ factor loss in the number of rounds. In this model, there are $n$ processors, each with unlimited local computational power. Computation proceeds in rounds, and in each round each processor broadcasts a single bit222It is standard to use messages of size $O(\log n)$, but for our purposes it is more natural to consider single-bit messages. All of our results generalize to the setting of logarithmic sized messages. to all other processors (within a single round, a processor must broadcast the same bit to all other processors).

Our results include a lower bound for the planted clique problem. Additionally, we show how to use our techniques to construct a pseudo-random generator that fools the Broadcast Congested Clique model. This is the first pseudo-random generator which fools a distributed message passing model. As simple corollaries, we obtain an average-case lower bound for the model, and an average-case time hierarchy for the model.

1.1 Our Approach

How to deal with distributions

Consider the (directed) planted clique problem333Note that in the broadcast congested clique model, as opposed to the CONGEST or unicast congested clique model, it is not possible to reduce from directed to undirected in one round.. In this problem, the input is a directed graph which is either a random graph (each directed edge is included with probability $1/2$), or a random graph where $k$ of the vertices are chosen at random and all edges within this set of $k$ vertices are included (these $k$ vertices are called the planted clique). The goal is to distinguish between these two distributions (or, one can consider the search version of the problem, in which a graph with a planted clique is given, and the goal is to find the clique). For now, one can think of $k$ as approximately $n^{1/4}$.

When trying to prove a lower bound for the problem, one’s first approach may be to try reducing to two-party communication complexity: split the vertices into two parts, and argue that a lot of information must pass between the parts. This approach will not work for the problem, since no matter how the graph is split up, at least one of the parts will be able to detect the presence of the clique, since at least one of the parts must have many of the clique’s vertices.

One’s next approach may be the following: show that for any Congested Clique algorithm, after $t$ rounds, the distribution of transcripts of the Congested Clique algorithm (the “transcript” is the history of the algorithm; that is, the “transcript” is a list of all messages sent so far as well as who sent which message and when the message was sent) if the input were uniform is close to the distribution of transcripts if the input had a planted clique. To prove this, one may take an inductive approach: show that if the transcripts were similar for $t-1$ rounds, the next round can distinguish between the distributions with only low probability. In this round, all vertices are broadcasting, so one may try to use another approach: show that each vertex reveals little information about whether the graph has a planted clique or not, and therefore, the whole round reveals little information about whether there is a clique. This way, we would only need to analyze a single broadcast at a time, a much simpler task than considering a whole round at once.

There is an issue, however. The problem is that the inputs of different nodes may not be independent. Therefore, it is possible that while each processor’s broadcast on its own will not reveal substantial information about whether the graph contains a clique, when we consider many processors’ broadcasted bits the information revealed may be more than the sum of the information of the individual broadcasts.

To get around this, we instead split the planted clique distributions into a sum of many distributions, such that for each of these distributions, all processors’ inputs are independent. Specifically, we can write the planted clique distribution as a sum over all possible cliques $C$ of a random graph with a clique planted at $C$. Notice that after fixing $C$, each vertex’s input is independent of all other vertices’ inputs. Now, when considering whether an algorithm distinguishes between a random graph with a clique at $C$ and a truly random graph, we can consider each node’s output on its own, instead of trying to deal with all nodes at the same time. This is one of our main high level ideas: splitting the distribution into many distributions where in each one, different vertices’ inputs are independent. This greatly simplifies the analysis by letting us avoid having to deal with many messages at once, and is what makes proving the lower bounds possible.

Statistical Inequalities

The idea of partitioning a distribution into distributions with independent vertex inputs makes proving the lower bounds possible, but there is still lots of technical work to do. Specifically, we now have a bunch of distributions, and we need to show that any algorithm can distinguish only few of those distributions from uniform. At the high level, the idea to do this is to show that for any algorithm, for almost all cliques, when a vertex broadcasts a bit, the probability of that bit being broadcast with the clique vs without the clique is similar. This is basically a problem about Boolean functions: if we let $f$ be the function which takes in the node’s input, and outputs what the node will broadcast, we wish to show that for almost all cliques $C$, when $f$’s input is uniform, the output distribution is similar to the distribution when $f$’s input is chosen with a planted clique at $C$. The inequalities we show are at the high level similar to this, but many more technical issues arise. For example, since we have to prove a multi-round lower bound, we have to condition on what a node broadcasted in previous rounds, so instead of proving the statistical inequalities for total functions, we instead have to prove the inequalities for functions defined on only part of $\{0,1\}^{n}$. These inequalities are not true for all partial functions, but we manage to prove that they are true for all functions which are defined on a large enough subset. So then, there is another challenge of proving that with high probability, after conditioning on a transcript, the set of possible inputs to a node is large.

1.2 Our Results

Lower bounds for the planted clique problem

One of the problems we consider is the (directed) planted clique problem. In this problem, the input is a directed graph which is either a random graph (each directed edge is included with probability $1/2$), or a random graph where $k$ of the vertices are chosen and all edges within this set of $k$ vertices are added. The goal is to distinguish between these two distributions (or, one can consider the search version of the problem, in which a graph with a planted clique is given, and the goal is to find the clique). Because a random graph contains cliques of size $\Theta(\log n)$, the problem makes sense for larger values of $k$. Once $k$ goes substantially above $\sqrt{n}$, it is possible to find the clique by considering the vertices with highest degree. Hence, the interesting values of $k$ are between approximately $\log n$ and $\sqrt{n}$.

In the classical (non-distributed) setting, the planted clique problem is very well studied. There exists a spectral algorithm solving the problem when $k=O(\sqrt{n})$, and it remains a major open problem in complexity theory to understand whether the problem is hard when $k$ is smaller.

It has been shown that proving lower bounds in the unicast CONGESTED-CLIQUE444In the unicast model, in each round each processor can send one bit to each other processor without the requirement that the same bit is broadcast to all other processors; that is, within a single round a processor may choose to send the message “1” to some processors, and “0” to others. would imply some strong circuit lower bounds [DKO14], so finding lower bounds for the problem in this setting is quite a challenge. Finding upper bounds for planted clique in the unicast CONGESTED-CLIQUE model is an interesting problem, but it seems difficult – maybe impossible – to improve upon simple sampling-based algorithms for the problem. The next model one can look at is the broadcast CONGESTED-CLIQUE model, which is the model we consider. Specifically, we prove that for cliques of size $O(n^{1/4-\varepsilon})$, the planted clique problem requires polynomially many rounds:

Theorem 1.1** (Planted Clique lower bound).**

When $k=n^{1/4-\varepsilon}$ for a constant $\varepsilon$, no $n^{o(1)}$ round $\textsf{BCAST}(1)$ protocol $\Pi$ can distinguish between $\mathcal{A}_{\sf rand}$ and $\mathcal{A}_{k}$ with advantage555An algorithm distinguishing between two distributions $D_{1}$ and $D_{2}$ with advantage $\varepsilon$ is an algorithm $A$ which, when given a random sample $s$ which with probability $1/2$ is drawn from $D_{1}$ and probability $1/2$ is drawn from $D_{2}$, then $A$ can successfully guess from which distribution $s$ was drawn with probability $1/2+\varepsilon$. $\Omega(1)$.

Pseudo-random generators for distributed computation:

Historically, pseudo-random generators were used to fool adversaries modeled as Turing Machines or Circuits. One of our main contributions is constructing the first pseudo-random generator which fools a distributed message passing setting. That is, we show how within the BCAST(1) Congested Clique model, the processors can each sample a small random seed, and end with each processor having a longer string than it started with, such that these longer strings look random to the system. That is, no low-round BCAST(1) protocol can distinguish between these pseudo-random strings and truly uniformly random strings within few rounds (except with some low probability). Thus, any algorithm can use a pseudo-random string instead of true randomness, thereby saving random bits.

Pseudo-random generators have been used to derandomize specific problems in message passing models, for example in [PY18]. Our construction is the first pseudo-random generator which fools all low-round algorithms in the BCASTmodel (as opposed to just fooling a specific algorithm).

Definition 1.2** (BCAST(1) pseudo-random generator).**

A $(k,m,n,\ell)$ BCAST(1) pseudo-random generator (PRG) is an $n$-processor BCAST(1) protocol $\Pi$ such that:

• •

At the beginning every processor independently gets $k$ private uniform and independent random bits as input.

• •

After participating in protocol $\Pi$, each processor outputs $m$ bits (these bits are not broadcasted: they are the node’s pseudo-random bits).

• •

The joint distribution of all processors’ output bits cannot be distinguished (with better than $\frac{1}{n}$ probability666All of our constructions in the paper can achieve arbitrarily low inverse polynomial probability.) from a truly uniform random distribution by any $\ell$ round BCAST(1) protocol. Specifically, the statistical distance between the distribution of the protocol’s transcript when using a pseudo-random generator and the distribution of the transcript when using true randomness is small.

Theorem 1.3**.**

For all $m=O(n)$ and $k=\Omega(\log n)$, there exists an $(O(k),m,n,\Theta(k))$ BCAST(1) PRG that can be constructed within $O(k)$ rounds. In particular, the PRG works as follows

• •

Each processor gets $k+k\cdot\frac{(m-k)}{n}=O(k)$ private random bits.

• •

Then in $O\left(\frac{m-k}{n}\cdot k\right)=O(k)$ rounds, all processors broadcast their last $k\cdot\frac{(m-k)}{n}$ random bits. And they use that to construct a random matrix $M\in\{0,1\}^{k\times(m-k)}$.

• •

Each processor’s output is simply the concatenation of its first $k$ random bits $x$ and $x^{T}M$.

That is, with $k$ random bits per processor as a seed, for every constant $c$, within $O(k)$ rounds we can turn them into $cn$ pseudo-random bits per processor which require $\Omega(k)$ rounds to be distinguished from random.

So, for example, within $O(\log^{2}(n))$ round (In the $\textsf{BCAST}(\log n)$ model, $O(\log n)$ rounds would suffice), one can construct a pseudo-random generator which is indistinguishable from random for any $\log^{2}n$-round algorithm, except with low probability (the seed size for each processor would be $O(\log^{2}n)$, while the size of the pseudo-random string is $\Theta(n)$).

The PRG is very simple to describe (we describe it here with seed size $2k$): first each processor shares $k$ random bits to create $k$ public random elements from $\mathbb{F}_{2}^{n}$ (i.e., $k$ random $n$-bit vectors). Then, each processor uses its remaining $k$ random bits to pick a random linear combination of those vectors (which requires $k$ bits to sample), and the result of this linear combination is the node’s pseudo-random bits. So, essentially the pseudo-random generator is a distribution of low-rank matrices (which is very close to the uniform distribution matrices of rank up to $k$). Although the description and construction of the PRG are simple, and the seed size is tight up to a constant factor, the analysis is quite technical and involves new techniques. We remark that the pseudo-random generator has the additional nice property that it is computationally cheap; the only operations done by the processors is computing dot products of vectors over $\mathbb{F}_{2}$.

Efficiently saving random bits

It is possible to show that in the broadcast congested clique there is a randomized-deterministic separation (by reductions from two-player communication complexity for equality). That is, there are certain problems with faster randomized algorithms than the best possible deterministic algorithms. So, there is no hope for a general derandomization theorem. However, one can ask: in general, what is the fewest number of random bits needed to efficiently solve problems in the Broadcast Congested Clique model? Using a technique of Newman [New91] from communication complexity, it is possible to show that for any protocol with output size $k$ per processor, $O(k)$ random bits per processor is enough (see Appendix A). The main downside of Newman’s technique is that it is computationally inefficient: it holds in the case where all the processors have unbounded computational power, and is not a practical tool for saving random bits.

In this work, we ask the following question: In the Broadcast Congested Clique with computationally bounded (polynomial time) processors, how many random bits are needed to perform general randomized computation? We can use our pseudo-random generator to show that every $k$-round algorithm where $k=\Omega(\log n)$ in which every processor uses up to $O(n)$ random bits can be transformed into an $O(k)$-round algorithm in which every processor uses up to $k$ random bits (that is, we can show that each processor needs to use at most $1$ random bit per round, while only increasing the run-time by a constant factor). Furthermore, this transformation is efficient. That is, if in the original algorithm all processors work in polynomial time, they also work in polynomial time in the new algorithm (in fact, there is only an additive overhead of $O(kn)$ computation time for each processor. This overhead is the time required to compute the pseudo-random bits from the seed).

Stated in the setting of BCAST($\log n$), where messages are of size $O(\log n)$ instead of $1$, we show that every $k$ round randomized algorithm using up to $n$ random bits per processor can be transformed into an $O(k)$ round algorithm using up to $O(k\log n)$ random bits per processor.

First BCAST(1) Average Case Lower Bound and Hierarchy:

As a simple corollary of our PRG construction, we prove a $\textsf{BCAST}(1)$ average case lower bound, which is the first average case lower bound proven in the model. Specifically, we show that when each processor receives a row of a sample from a certain close-to-uniform distribution of $n\times n$ matrices of rank $n-1$, this cannot be distinguished from each processor receiving $n$ uniformly random bits. We show that this implies that determining whether an input has rank $n$ or not is hard (it takes $\Omega(n)$ rounds), even when the input is chosen uniformly at random:

Theorem 1.4**.**

Let $n$ be a large enough integer and $F_{\textsf{full-rank}}:\{0,1\}^{n\times n}\to\{0,1\}$ be the indicator function which indicates whether the given matrix has full rank. Suppose there are $n$ processors, and the $i$-th processor is given the $i$-th row of the input matrix. For all $n/20$-round BCAST(1) protocols and all processors $i$ in it, $i$ cannot compute $F$ correctly with probability better than $0.99$ when the input is a uniformly chosen random matrix from $\{0,1\}^{n\times n}$.

We also obtain an average-case time hierarchy theorem for the model:

Theorem 1.5**.**

For any $\omega(\log n)\leq k\leq n$, there is a function $F$ such that a $k$-round $\textsf{BCAST}(1)$ protocol can compute exactly, while any $k/20$-round $\textsf{BCAST}(1)$ protocols cannot compute $F$ correctly with probability $0.99$ over the uniform distribution.

1.3 Toy Example: One Round Lower Bound for Planted Clique

As a toy example to illustrate our proof framework, in the following we prove that the planted clique problem is hard for one-round $\textsf{BCAST}(1)$ protocols when $k=o(n^{1/4})$. We begin with some notations.

Notations.

Let $\mathcal{U}_{m}$ denote the uniform distribution on $\{0,1\}^{m}$. For a function $f:\{0,1\}^{*}\to\{0,1\}^{*}$ and a distribution $\mathcal{D}$ on $\{0,1\}^{*}$, we use $f(\mathcal{D})$ to denote the distribution of the output of $f$ when the input is drawn from $\mathcal{D}$. For two distributions $\mathcal{D}_{1}$ and $\mathcal{D}_{2}$, we use $\|\mathcal{D}_{1}-\mathcal{D}_{2}\|=\frac{1}{2}\sum_{x\in\{0,1\}^{*}}|\mathcal{D}_{1}(x)-\mathcal{D}_{2}(x)|$ to denote their statistical distance (where $\mathcal{D}(x)$ is the probability that a sample from $\mathcal{D}$ equals $x$).

Let $\mathcal{A}^{n}_{\sf rand}$ be the distribution on $\{0,1\}^{n\times n}$ such that for a sample $A$ from $\mathcal{A}^{n}_{\sf rand}$, for all $i\neq j$, $A_{i,j}$ is an independent uniform random bit in $\{0,1\}$, and $A_{i,i}$ is always [math] for all $i$. Let $C$ be a subset of $[n]$. We use $\mathcal{A}^{n}_{C}$ to denote the conditional distribution of $\mathcal{A}^{n}_{\sf rand}$ on the event that for all $i,j\in C$ and $i\neq j$, $A_{i,j}=1$ (that is, $C$ is a clique). We also use $\mathcal{A}^{n}_{k}$ to be the mixed distribution of $\mathcal{A}^{n}_{C}$’s when $C$ is a uniform random subset of $[n]$ of size $k$. When the meaning is clear, we often drop the superscripts of the aforementioned distributions for simplicity.

So, to summarize, $\mathcal{A}^{n}_{\sf rand}$ is the uniform distribution over a random directed graph, $\mathcal{A}^{n}_{C}$ is the distribution where the vertices of $C$ are in a clique, and the rest of the edges are uniformly random, and $\mathcal{A}^{n}_{k}$ is the distribution where a random $k$ vertices are chosen to be a clique, and the rest of the edges are chosen uniformly at random.

By Yao’s principle [Yao77], we can assume all processors are deterministic as we are trying to prove a lower bound for distinguishing two input distributions. Processor $i$ can then be defined by a function $f_{i}:\{0,1\}^{n}\times\{0,1\}^{*}\to\{0,1\}$, such that $f_{i}(z,p)$ is the bit that processor $i$ outputs when it gets the input $z$ and transcript $p$.777In a zero-round protocol, the processor’s $f_{i}$ does not take in an input $p$, since there is no transcript yet, just an input. However, in our proof, we assume that the processors broadcast their messages sequentially (that is, first the first processor speaks, then the second, and so on). In this stronger model, all but one of the processors do see a transcript before they broadcast their first bit. We use $f_{i}^{|p}$ to denote the function $f_{i}(\cdot,p)$ for simplicity. If transcript $p$ is incompatible with processor $i$ having input $z$, then we set $f_{i}(z,p)$ arbitrarily.

Given a $\textsf{BCAST}(1)$ protocol $\Pi$ and an input distribution $\mathcal{D}$, we use $\mathcal{P}(\Pi,\mathcal{D})$ to denote the distribution of the transcripts of the protocol $\Pi$ running on a input drawn from $\mathcal{D}$ (that is, given a matrix $A$ which is drawn from the distribution $\mathcal{D}$, the processor $i$ gets the $i$-th row of $A$, and all processors act according to the protocol $\Pi$).

In this section we prove the following theorem.

Theorem 1.6**.**

Let $n$ be the number of processors and $k$ be an integer. For any one round BCAST(1) protocol $\Pi$, we have

[TABLE]

That is, for any one-round protocol, the distribution of transcripts when run on a uniformly random input is statistically close to the distribution on an input with a planted clique. As a simple corollary, we immediately have:

Corollary 1.7**.**

When $k=o(n^{1/4})$, no one-round $\textsf{BCAST}(1)$ protocol $\Pi$ can distinguish between $\mathcal{A}_{\sf rand}$ and $\mathcal{A}_{k}$ with advantage $\Omega(1)$ (that is, any protocol which accepts on $\mathcal{A}_{\sf rand}$ with probability $p$, must accept on $\mathcal{A}_{k}$ with probability $p\pm o(1)$).

That is, there is no way to solve the planted clique problem for cliques of size $o(n^{1/4})$ within one round of the Broadcast Congested Clique.

Let $\mathcal{S}_{k}^{T}$ be the uniform distribution on all size-$k$ subsets of $T$. To prove Theorem 1.6, we need the following technical lemma, whose proof is deferred to the end of this section. In this lemma $f(x)$ represents the bit broadcasted by a processor, and $x$ represents the input to the processor. The lemma states that when picking a random clique $C$ of size $k$, then any function $f$ behaves similarly when the input is sampled from the uniform distribution vs. when the input is sampled from the uniform distribution with a clique planted on $C$. Basically, this means that for almost all possible cliques, $f$ does not substantially help distinguish between the clique existing, or the input being uniform.

Lemma 1.8**.**

Let $n,k$ be integers such that $k\leq n^{1/4}$, and $\mathcal{U}_{n}^{C}$ be the uniform distribution on \{x:x\in\{0,1\}^{n},x_{i}=1\text{ for all i\in C}\}. For all function $f:\{0,1\}^{n}\to\{0,1\}$, we have

[TABLE]

We also need the following lemma to bound the increase of the statistical distance when a processor speaks, The proof can be found in the preliminaries (Section 2).

Lemma 1.9**.**

Let $X$ and $Y$ be two sets, $\mathcal{D}$ and $\mathcal{D}^{\prime}$ be two distributions on $X\times Y$. Let $\mathcal{D}_{|X}$ and $\mathcal{D}^{\prime}_{|X}$ be the respective marginal distribution of $\mathcal{D}$ and $\mathcal{D}^{\prime}$ on set $X$. For $a\in X$, we use $\mathcal{D}_{X=a}$ and $\mathcal{D}^{\prime}_{X=a}$ to denote the respective conditional distribution of $\mathcal{D}$ and $\mathcal{D}^{\prime}$ on $Y$ conditioning on $X=a$.888For simplicity, we let $\mathcal{D}_{X=a}$ be the uniform distribution on $Y$ if $\Pr_{(x,y)\sim\mathcal{D}}[x=a]=0$. We have

[TABLE]

Now we are ready to prove Theorem 1.6.

Proof of Theorem 1.6.

Instead of viewing the algorithm as a single round algorithm, we will prove a slightly stronger lower bound. Consider the model where we have $n$ turns. On the $t^{th}$ turn, processor $t$ gets to send a single bit. This model is stronger than one round of the BCAST(1) model, since it allows the later processors to condition their outputs on earlier the processors’ messages. Hence, our lower bound implies a lower bound for the BCAST(1) model as well.

Let $\mathcal{P}_{\textsf{rand}}^{(t)}$ and $\mathcal{P}_{C}^{(t)}$ be the distributions of the transcript of the first $t$ turns when the input is drawn from $\mathcal{A}_{\sf rand}$ or $\mathcal{A}_{C}$, respectively. Note that to prove the theorem, it suffices to show that $\mathcal{P}_{\textsf{rand}}^{(n)}$ is close to most $\mathcal{P}_{C}^{(n)}$. For this purpose, we are going to prove the following inequality holds for any $t\leq n$:

[TABLE]

where $c_{1}$ is a large enough universal constant. This inequality states that when picking a clique at random, the distribution of transcripts is similar to the distribution of transcripts when the input is chosen uniformly at random. It is easy to see that plugging in $t=n$, (1) implies the theorem.

We prove the inequality above inductively. Clearly, (1) holds when $t=0$. So it suffices to show that when it holds for $t-1$, it also holds for $t$.

Let $\mathcal{D}_{t}$ and $\mathcal{D}_{t}^{C}$ be the input distributions to processor $t$ in $\mathcal{A}_{\sf rand}$ and $\mathcal{A}_{C}$, respectively. For a fixed $C\subseteq[n]$, by Lemma 1.9, we have:

[TABLE]

We think of $\|\mathcal{P}_{\textsf{rand}}^{(t)}-\mathcal{P}_{C}^{(t)}\|$ as the amount of evidence the transcript is giving us about whether the distribution is uniform or if it has $C$ as a clique. (If this value were [math], that would mean the transcript gives us no evidence. If the value were $1$, that would mean we have “full” evidence and could distinguish between the two with no error given the transcript). So, with this interpretation, the inequality above is basically stating that the amount of evidence we have after round $t$ is the sum of the evidence from all rounds up to $t-1$, plus the extra evidence we get from the broadcast of the processor in round $t$.

By definition, $\mathcal{D}_{t}$ is the uniform distribution on the set $\{x:x\in\{0,1\}^{n},x_{t}=0\}$. And $\mathcal{D}_{t}^{C}=\mathcal{D}_{t}$ if $t\notin C$, and is the uniform distribution on the set \{x:x\in\{0,1\}^{n},x_{t}=0,x_{j}=1\text{ for all j\in C\setminus{t}}\} otherwise.

We care not about the probability of distinguishing a particular clique existing, but about whether any clique exists, so we take the expected value over all possible cliques of both sides of (2) gives:

[TABLE]

We can bound $\operatorname*{\mathbb{E}}_{C\sim\mathcal{S}_{k}^{[n]}}\left[\left\|\mathcal{P}_{\textsf{rand}}^{(t-1)}-\mathcal{P}_{C}^{(t-1)}\right\|\right]$ by the inductive hypothesis, so it suffices to bound

$\operatorname*{\mathbb{E}}_{p\sim\mathcal{P}_{\textsf{rand}}^{(t-1)}}\operatorname*{\mathbb{E}}_{C\sim\mathcal{S}_{k}^{[n]}}\left[\left\|f_{t}^{|p}(\mathcal{D}_{t})-f_{t}^{|p}(\mathcal{D}_{t}^{C})\right\|\right]$. For $p\sim\mathcal{P}_{\textsf{rand}}^{(t-1)}$, there are two cases:

• •

When $t\notin C$, which happens with probability $1-\frac{k}{n}$, we have

[TABLE]

as $\mathcal{D}_{t}^{C}=\mathcal{D}_{t}$. That is, since $t$ is not in $C$, what $t$ says gives us no information about whether $C$ is a clique (whether there is a clique or not does not affect the input of $t$, and therefore does not affect their message).

• •

When $t\in C$, which happens with probability $\frac{k}{n}$, by Lemma 1.8, we have

[TABLE]

That is, when $t$ is in $C$, while $t$ might give information about whether $C$ is a clique, there are many cliques that may include $t$, and the inequality states that $t$ cannot give too much information about many of cliques (the expected amount of information revealed about a randomly chosen clique of size $k$ containing $t$ is bounded by $O\left(\frac{k}{\sqrt{n}}\right)$).

So, now we have bounded how much evidence the $t$-th processor reveals when broadcasting. We know that when the clique is chosen randomly, with probability $1-k/n$ no information is revealed, and with probability $k/n$ at most $O(k/\sqrt{n})$ information is revealed in expectation. Combining these facts gives:

[TABLE]

which, plugging into (3) and using the inductive hypothesis proves inequality (1) for $t$. ∎

1.3.1 Proof for Lemma 1.8

We need the following lemma first, whose proof is based on tools from information theory, and is deferred to the end of this subsection.999This lemma is standard and can be proved in various ways. We present a proof based on information theory because it can be easily generalized to a proof for Lemma 4.4, which is used in Section 4.

Lemma 1.10**.**

Let $n$ be an integer, and $\mathcal{U}_{n}^{[i]}$ be the uniform distribution on $\{x:x\in\{0,1\}^{n},x_{i}=1\}$. For all function $f:\{0,1\}^{n}\to\{0,1\}$, we have

[TABLE]

That is, if we consider a function $f$, suppose that on a uniform distribution, the probability it outputs $1$ is $p$. Then, if we pick a random index and set it to $1$, we still expect that if we randomly pick the rest of the coordinates, the output will be $1$ with probability approximately $p$.

Now we are ready to prove Lemma 1.8 (restated below).

*Reminder of Lemma 1.8 *** Let $n,k$ be integers such that $k\leq n^{1/4}$, and $\mathcal{U}_{n}^{C}$ be the uniform distribution on \{x:x\in\{0,1\}^{n},x_{i}=1\text{ for all i\in C}\}. For all function $f:\{0,1\}^{n}\to\{0,1\}$, we have

[TABLE]

The idea of the proof is that each bit we set to $1$, by Lemma 1.10, will change the expected output of $f$ by $O\left(\frac{1}{\sqrt{n}}\right)$. Hence, if we set $k$ of those bits to $1$, that will change the expected outcome by $O\left(\frac{1}{\sqrt{n}}\right)$ at most $k$ times, for a total of $O\left(\frac{k}{\sqrt{n}}\right)$. A formal proof is included below:

Proof of Lemma 1.8.

Instead of choosing $C$ from $\mathcal{S}_{k}^{[n]}$, we choose an ordered $k$-tuple of $a=(a_{1},a_{2},\dotsc,a_{k})$ of $k$ distinct elements in $[n]$ uniformly at random. Let the distribution be $\mathcal{T}_{k}^{[n]}$.

We have

[TABLE]

Now we are to bound the right side of (4) for each $0\leq\ell\leq k-1$ separately. Applying Lemma 1.10 on the restriction of $f$ such that all bits in $\{a_{i}\}$ are set to $1$, we have

[TABLE]

Plugging the above in (4) and noting that $k\leq n^{1/4}$ completes the proof. ∎

Now we prove Lemma 1.10. The proof makes use several tools from information theory, see Section 2.4 for the details.

Proof of Lemma 1.10.

Throughout the proof we will assume $X$ is a random variable drawn uniformly from $\{0,1\}^{n}$. For $i\in[n]$, let $X_{i}$ be the random variable of the $i$-th bit of $X$.

We have

[TABLE]

And by the sub-additivity of conditional entropy, we have

[TABLE]

Therefore,

[TABLE]

or equivalently,

[TABLE]

Note that by Fact 2.1,

[TABLE]

Taking expected values over $i$ of both sides and using $\operatorname*{\mathbb{E}}_{i\leftarrow[n]}I(X_{i};f(X))\leq\frac{1}{n}$ gives

[TABLE]

By Pinsker’s inequality (Lemma 2.2) and the fact that $\sqrt{x}$ is a concave function, we have

[TABLE]

and

[TABLE]

Note that by definition, $f(X)_{X_{i}=1}$ is distributed identically to $f(\mathcal{U}^{[i]})$, which completes the proof. ∎

1.4 Related Work

BCAST(1) Congested Clique:

The specific distributed model we investigate is the Broadcast Congested Clique. In this model, there are $n$ processors, and computation proceeds in rounds. In each round, each processor broadcasts a short message to all other processors. It has recently been studied in [BARR15, dERRU16, CKK*+*15, GHM18, DKO14, Gal16, NY18, HP15, CHPS16, BMRT18, JN17b, MT16, JN17a], among others. It has been used to study other areas in computer science such as streaming algorithms [AMS99] and mechanism design [DNO14].

Complexity Theoretic approaches in Distributed Computing:

Recently, more complexity theoretic approaches and results have been made in the congested clique and distributed computation in general, for example in [KS17, FKP13, GKM17, CP17].

Pseudo-randomness and Distributed Computing:

In [BGR96], the authors construct a pseudo-random generator which creates additional shared random bits in a distributed system. Specifically, the authors work in a setting where every pair of processors can privately communicate with each other (whereas we work in the broadcast model), and some of the processors may be adversarially faulty. They show how to use few shared random bits, and unlimited private random bits to efficiently compute more shared random bits. In our setting, we are saving on private random bits flipped (when all processors are non-faulty, it is easy to turn a private random bit into a public random bit – simply broadcast it).

In [INW94], the authors construct pseudo-randomness for a different distributed system, in which the network has a topology. Their main application is constructing pseudo-randomness that fools all low-space computation.

In [NPR99], a different setting than ours is considered, in which the processors are computationally bounded, and a cryptographic pseudo-random function is being evaluated.

In [PY18], a pseudo-random generator that fools DNFs is used to deterministically construct spanners in the congested clique. In that work, the pseudo-random generator is used for the specific problem considered, as opposed to being a pseudo-random generator which fools all algorithms in the model.

Pseudo-randomness in the context of complexity theory has been very widely studied. See Vadhan’s survey [Vad12].

In [GHK18], the authors introduce general methods for derandomizing algorithms in the LOCAL model to obtain better deterministic algorithms.

Planted Clique:

The planted clique problem (or hidden clique problem) was introduced in [Jer92] and [Kuc95]. The best known classical algorithm [FK00, DGP14] can find the hidden clique when its size is $k=\Omega(\sqrt{n})$ in near linear-time. For $k\ll\sqrt{n}$, the naïve algorithm (looking for a clique of size $10\log n$ with brute force, and then extending that clique to the whole clique) can solve it in $n^{O(\log n)}$ time, and the problem is conjectured to be not solvable in polynomial time. However, since it is an average-case problem, it is unlikely that the hardness of this problem can be derived from standard complexity assumptions such as $\textsf{P}\neq\textsf{NP}$ [FF93, BT06]. Therefore, much work has been put into trying to show limitations for certain classes of algorithm on this problem [FK03, MPW15, DM15, HKP*+*18, BHK*+*16], or showing tight hardness for closely-related worst-case problems under standard assumptions [BKRW17].

Distributed Clique lower bounds

There is some literature on lower bounds for finding cliques in the congested clique model [DKO14], as well as the standard CONGEST model [cliqueCONGEST]. These lower bounds hold in the worst case, and have no direct implications about the hardness of the planted clique problem.

Organization of the Paper

In Section 2, we introduce the needed preliminaries for this paper. Section 3 we present an abstract framework for our approach. In Section 4 we prove the lower bound for planted clique in $\textsf{BCAST}(1)$. In Section 5 we give an overview of the proofs for the PRG construction for $\textsf{BCAST}(1)$, starting with a one-round toy example. Then in Section 6, we show how to create a single pseudo-random bit for each processor, which also implies our average case lower bound for $\textsf{BCAST}(1)$. Next, in Section 7 we show how to create many pseudo-random bits. Finally, in Section 8 we show our pseudo-random generator’s parameters are optimal.

2 Preliminaries

2.1 Notations

Here we summarize some standard notations which are used in this paper.

For integers $n$ and $m$, we use $\mathcal{U}_{m}$ to denote the uniform distribution on $\{0,1\}^{m}$, and $\mathcal{U}_{n\times m}$ to denote the uniform distribution on $\{0,1\}^{n\times m}$.

Let $X,Y$ be two sets. For a function $f:X\to Y$ and a distribution $\mathcal{D}$ on $X$, we use $f(\mathcal{D})$ to denote the distribution of the output of $f$ when the input is drawn from $\mathcal{D}$. For two distributions $\mathcal{D}_{1}$ and $\mathcal{D}_{2}$ on a set $X$, we use $\|\mathcal{D}_{1}-\mathcal{D}_{2}\|=\frac{1}{2}\sum_{x\in X}|\mathcal{D}_{1}(x)-\mathcal{D}_{2}(x)|$ to denote their statistical distance (where $\mathcal{D}(x)$ is the probability that a sample from $\mathcal{D}$ equals $x$).

2.2 Analysis of Boolean Functions

Our proofs make use of some well-known facts from analysis of Boolean functions101010Some nice references can be found in [DW08, O’D14].

For any function $f:\{0,1\}^{n}\to\mathbb{R}$, its Fourier coefficient at a set $S$ is defined as

[TABLE]

Parseval’s Identity states

[TABLE]

2.3 Probability Theory

The following lemma is standard. We provide a proof here for completeness.

*Reminder of Lemma 1.9 *** Let $X$ and $Y$ be two sets, and $\mathcal{D}$ and $\mathcal{D}^{\prime}$ be two distributions on $X\times Y$. Let $\mathcal{D}_{|X}$ and $\mathcal{D}^{\prime}_{|X}$ be the respective marginal distribution of $\mathcal{D}$ and $\mathcal{D}^{\prime}$ on set $X$. For $a\in X$, we use $\mathcal{D}_{X=a}$ and $\mathcal{D}^{\prime}_{X=a}$ to denote the respective conditional distribution of $\mathcal{D}$ and $\mathcal{D}^{\prime}$ on $Y$ conditioning on $X=a$.111111For simplicity, we let $\mathcal{D}_{X=a}$ be the uniform distribution on $Y$ if $\Pr_{(x,y)\sim\mathcal{D}}[x=a]=0$. We have

[TABLE]

Proof.

We first define an auxiliary distribution $\mathcal{D}_{\textsf{aux}}$ as follows: for $(a,b)\in X\times Y$, if $\mathcal{D}^{\prime}_{|X}(a)>0$, (we use $\mathcal{D}^{\prime}_{|X}(a)$ to denote the probability that a sample from $\mathcal{D}^{\prime}_{|X}$ equal $a$).

[TABLE]

Otherwise, we set $\mathcal{D}^{\textsf{aux}}(a,b):=\frac{1}{|Y|}\cdot\mathcal{D}_{|X}(a)$. It is easy to verify that $\mathcal{D}^{\textsf{aux}}_{|X}=\mathcal{D}_{|X}$ and for all $a$ $\mathcal{D}^{\textsf{aux}}_{X=a}=\mathcal{D}^{\prime}_{X=a}$, and therefore it is a distribution.

Now, it is easy to see that

[TABLE]

Moreover, we have

[TABLE]

Putting everything together, we have

[TABLE]

∎

2.4 Information Theory

In this paper we need some definitions and facts from information theory. For an excellent introduction to information theory, one is referred to the textbook by Cover and Thomas [CT06]. We consider discrete random variables in this paper.

Let $X,Y$ be random variables in the same probability space $\Omega$. The entropy of $X$, denoted by $H(X)$, is defined as $H(X):=\Pr_{a\sim X}\log\frac{1}{\Pr[X=a]}$. The conditional entropy of $X$ given $Y$, denoted as $H(X|Y)$, is defined as $H(X|Y):=\operatorname*{\mathbb{E}}_{y\sim Y}H(X|Y=y)$.

The mutual information between $X$ and $Y$, denoted by $I(X;Y)$, is defined as $I(X;Y):=H(X)-H(X|Y)=H(Y)-H(Y|X)=H(X)+H(Y)-H(X,Y)$.

For two distributions $\mathcal{P}$ and $\mathcal{Q}$ on the same set $S$, their Kullback-Leibler (KL) divergence is defined as

[TABLE]

KL divergence is related to mutual information in the following way.

Fact 2.1**.**

[TABLE]

Lemma 2.2** (Pinsker’s Inequality).**

For two distributions $\mathcal{D}_{1}$ and $\mathcal{D}_{2}$, we have

[TABLE]

For a real $p\in[0,1]$, we use $\textsf{Ber}(p)$ to denote the binary Bernoulli random variable with expectation $p$. We also use $H(p)$ to denote the $H(\textsf{Ber}(p))$. We have the following fact.

Fact 2.3**.**

If $H(p)\geq 0.9$, we have $p\in[0.3,0.7]$, and

[TABLE]

3 Abstract Framework

In this section, we present an abstraction of our framework. Understanding this section is not necessary to understand the rest of the sections of the paper. It is included to make it easier to understand the structure of the proof without having to dig through the problem-specific technical parts.

In the following we exhibit an abstract framework for showing a certain input distribution $\mathcal{A}_{\sf pseudo}$ is indistinguishable from the uniform random input distribution $\mathcal{A}_{\sf rand}$ by a low round $\textsf{BCAST}(1)$ protocol121212It is not imperative that one of the distributions is uniform. We decide to present the framework with one of the distributions as uniform for the sake of simplicity, and since our two main applications of the framework in this paper involve distinguishing distributions from uniform..

For the simplicity of discussion. We assume each of the $n$ processors gets $n$ bits as its input. We also use a matrix $A\in\{0,1\}^{n\times n}$ to denote their inputs collectively, where the $i$-th player gets the $i$-th row of $A$. Then $\mathcal{A}_{\sf rand}$ is simply the uniform distribution over $\{0,1\}^{n\times n}$.

Notations.

We first recall and introduce some notations. Let $\mathcal{U}_{m}$ denote the uniform distribution on $\{0,1\}^{m}$. For a function $f:\{0,1\}^{*}\to\{0,1\}^{*}$ and a distribution $\mathcal{D}$ on $\{0,1\}^{*}$, we use $f(\mathcal{D})$ to denote the distribution of the output of $f$ when the input is drawn from $\mathcal{D}$. For two distributions $\mathcal{D}_{1}$ and $\mathcal{D}_{2}$, we use $\|\mathcal{D}_{1}-\mathcal{D}_{2}\|=\frac{1}{2}\sum_{x\in\{0,1\}^{*}}|\mathcal{D}_{1}(x)-\mathcal{D}_{2}(x)|$ to denote their statistical distance (where $\mathcal{D}(x)$ is the probability that a sample from $\mathcal{D}$ equals $x$).

By Yao’s principle [Yao77], we can assume all processors are deterministic as we are trying to prove a lower bound for distinguishing two input distributions. Processor $i$ can then be defined by a function $f_{i}:\{0,1\}^{n}\times\{0,1\}^{*}\to\{0,1\}$, such that $f_{i}(z,p)$ is the bit that player $i$ outputs when it gets the input $z$ and transcript $p$. We use $f_{i}^{|p}$ to denote the function $f_{i}(\cdot,p)$ for simplicity. If transcript $p$ is incompatible with player $i$ having input $z$, then we set $f_{i}(z,p)$ arbitrarily.

Given a $\textsf{BCAST}(1)$ protocol $\Pi$ and an input distribution $\mathcal{D}$, we use $\mathcal{P}(\Pi,\mathcal{D})$ to denote the distribution of the transcripts of the protocol $\Pi$ running on a input drawn from $\mathcal{D}$. We also use $\mathcal{P}^{(t)}(\Pi,\mathcal{D})$ to denote the distribution of the same transcript in first $t$ turns.

A Relaxation

Instead of viewing the algorithm as a single round algorithm, we will prove a slightly stronger lower bound. Consider the model where we have $j\cdot n$ turns instead of $j$ rounds. On the $t^{th}$ turn, processor $(t-1)\bmod{n}+1$ gets to send a single bit. This model is stronger than $j$ rounds of the BCAST(1) model, since it allows the later processors to condition their outputs on earlier processors’ messages. Hence, lower bounds for this relaxed model imply lower bounds for the BCAST(1) model as well.

Decomposition into Row-Independent Distributions

We first write $\mathcal{A}_{\sf pseudo}$ as an average of many row-independent distributions. Let $\mathcal{I}$ be an index set, and $\{\mathcal{A}_{I}\}_{I\in\mathcal{I}}$ be a family of distributions, we need the following two properties:

• •

$\mathcal{A}_{\sf pseudo}=\frac{1}{|\mathcal{I}|}\sum_{I\in\mathcal{I}}\mathcal{A}_{I}$. That is, $\mathcal{A}_{\sf pseudo}$ can be written as an average of all distributions in $\{\mathcal{A}_{I}\}_{I\in\mathcal{I}}$.

• •

For each $I\in\mathcal{I}$, $\mathcal{A}_{I}=\bigoplus_{i=1}^{n}\mathcal{A}_{I}^{[i]}$, where $\oplus$ means concatenation and all $\mathcal{A}_{I}^{[i]}$’s are independent. Equivalently, rows in $\mathcal{A}_{I}$ are independent. (Each row is a single node’s input).

Progress Function

We first fix a $\textsf{BCAST}(1)$ protocol $\Pi$. For simplicity, we define $\mathcal{P}_{\textsf{rand}}^{(t)}=\mathcal{P}^{(t)}(\Pi,\mathcal{A}_{\sf rand})$, $\mathcal{P}_{\sf pseudo}^{(t)}=\mathcal{P}^{(t)}(\Pi,\mathcal{A}_{\sf pseudo})$ and $\mathcal{P}^{(t)}_{I}=\mathcal{P}^{(t)}(\Pi,\mathcal{A}_{I})$ for $I\in\mathcal{I}$.

Ideally, we would like to bound

[TABLE]

round by round. But as discussed in the introduction, the above is very hard to work with, so we try to bound the following progress function instead:

[TABLE]

It is not hard to see that $\mathcal{L}_{\sf real\text{-}dist}^{(t)}\leq\mathcal{L}_{\sf progress}^{(t)}$: we know that $\mathcal{L}_{\sf progress}^{(t)}=\frac{1}{|\mathcal{I}|}\sum_{I\in\mathcal{I}}\left\|\mathcal{P}^{(t)}_{I}-\mathcal{P}_{\textsf{rand}}^{(t)}\right\|$, which by a triangle inequality is greater than or equal to $\left\|\frac{1}{|\mathcal{I}|}\sum_{I\in\mathcal{I}}\left[\mathcal{P}^{(t)}_{I}-\mathcal{P}_{\textsf{rand}}^{(t)}\right]\right\|=\left\|\mathcal{P}_{\sf pseudo}^{(t)}-\mathcal{P}_{\textsf{rand}}^{(t)}\right\|$ so showing an upper bound on $\mathcal{L}_{\sf progress}^{(t)}$ is sufficient for upper bounding $\mathcal{L}_{\sf real\text{-}dist}^{(t)}$.

Upper Bounding the Progress Made in Turn $t$

Now suppose we are at the $t$-th turn. Let $j$ be the current round number, and $i$ be the broadcasting processor of this turn. By Lemma 1.9, for all $I\in\mathcal{I}$, we have

[TABLE]

In above, $\mathcal{D}_{i}|p$ and $\mathcal{D}_{i}^{I}|p$ are the input distributions to player $i$ conditioning on seeing the transcript $p$ of the previous $t-1$ rounds, in $\mathcal{A}_{\sf rand}$ and $\mathcal{A}_{I}$ respectively.

First, since $\mathcal{D}_{i}$ is just $\mathcal{U}_{n}$, we can see $\mathcal{D}_{i}|p$ is simply the uniform distribution on the set of inputs which is consistent with the transcript $p$. Formally, let $t_{1},t_{2},\dotsc,t_{j-1}$ be the indices of all previous $j-1$ turns with processor $i$ broadcasting, before the current $t$-th turn. For $x\in\{0,1\}^{n}$, we say that $x$ is consistent with transcript $p$, if for all $\ell\in[j-1]$, we have

[TABLE]

where $p^{(t_{\ell}-1)}$ denotes the first $t_{\ell}-1$ bits of $p$. That is, simulating $f_{i}$ with respect to $p$ on $x$ gives the same outputs in $p$.

Let $D^{(t-1)}_{p}$ denote the set of inputs to $f_{i}$ which are consistent with the transcript $p$. Then we can see $\mathcal{D}_{i}|p$ is the uniform distribution on $D^{(t-1)}_{p}$. Similarly, since $\mathcal{A}_{I}$ is row-independent, $\mathcal{D}_{i}^{I}|p$ is just $\mathcal{A}_{I}^{[i]}$ conditioning on $D^{(t-1)}_{p}$. We denote this as $\mathcal{A}_{I}^{[i]}|D^{(t-1)}_{p}$.

Plugging in (5), and taking an expectation for all $I\in\mathcal{I}$, we have

[TABLE]

A key observation here is that $\mathcal{D}^{(t-1)}_{p}$ is usually a large set over $p\sim\mathcal{P}_{\textsf{rand}}^{(t-1)}$. The proof of the following claim is essentially the same as the proof for Claim 2 in Section 4, so we omit it here.

Claim 1**.**

For all $\varepsilon>0$,

[TABLE]

Therefore, in order to bound the second term of the right hand side of (6), we can assume $|D^{(t-1)}_{p}|\geq 2^{n-\Theta(\beta)}$, where $\beta$ is roughly the round lower bound we wish to prove.

Statistical Inequality Task

Now we are finally able to specify the statistical inequality task we need to prove. We want to show that for almost all $p\sim\mathcal{P}_{\textsf{rand}}^{(t-1)}$, their contribution to the second term of the right side of (6),

[TABLE]

is small. We obviously have no control over the set $D^{(t-1)}_{p}$ except for that it is large, so we want the following type of statistically inequality.

**Required Lemma Format. **Let $D\subseteq\{0,1\}^{n}$ with $|D|\geq 2^{n-\beta}$, $\mathcal{U}_{D}$ be the uniform distribution on $D$. For all function $f:D\to\{0,1\}$ and $i\in[n]$, we have

[TABLE]

In above $\varepsilon(n,\beta)$ is some error function which is increasing in $\beta$.

It will be helpful to observe that Lemma 1.8, Lemma 4.3, Lemma 5.2, Lemma 6.1, and Lemma 7.2 are all instantiations of the above required lemma (for proving the one-round lower bound we can simply assume $D=\{0,1\}^{n}$).

Once we have the required lemma, then by a simple induction, we have

[TABLE]

From which we can deduce the needed lower bound, if $(j\cdot n)\cdot\varepsilon(n,\Theta(j))\ll 1$.

4 Lower Bound for Planted Clique

In this section we prove that the planted clique problem is hard for $\textsf{BCAST}(1)$ when $k=n^{1/4-\varepsilon}$. We encourage the reader to read Section 1.3 before this section. That subsection contains a one-round lower bound for the problem, which involves a similar yet much less technical proof.

Notations.

We first recall some notations. Let $\mathcal{A}^{n}_{\sf rand}$ be the distribution on $\{0,1\}^{n\times n}$ such that for a sample $A$ from $\mathcal{A}^{n}_{\sf rand}$, for all $i\neq j$, $A_{i,j}$ is an independent uniform random bit in $\{0,1\}$, and $A_{i,i}$ is always [math] for all $i$. Let $C$ be a subset of $[n]$. We use $\mathcal{A}^{n}_{C}$ to denote the conditional distribution of $\mathcal{A}^{n}_{\sf rand}$ on the event that for all $i,j\in C$ and $i\neq j$, $A_{i,j}=1$ (that is, $C$ is a clique). We also use $\mathcal{A}^{n}_{k}$ to denote the mixed distribution of $\mathcal{A}^{n}_{C}$’s when $C$ is a uniformly chosen random subset of $[n]$ of size $k$.

For a distribution $\mathcal{A}$, we use $\mathcal{A}^{[i]}$ to denote it’s marginal distribution on the $i$-th row. Note that $\mathcal{A}^{n}_{\sf rand}$ and $\mathcal{A}^{n}_{C}$ have independent rows131313Fixing a clique $C$, all entries of the distribution $\mathcal{A}^{n}_{C}$ are independent: each edge outsize of $C$ is an independent coin flip with probability 1/2, and each edge in $C$ is an independent coin flip with probability 1. In particular, note that every two edges in the clique are independent, since they are both 1 with probability 1, and therefore the mutual information between the two entries is 0..

When the meaning is clear, we often drop the superscripts of the above distributions for simplicity.

Given a $\textsf{BCAST}(1)$ protocol $\Pi$ and an input distribution $\mathcal{D}$, we use $\mathcal{P}(\Pi,\mathcal{D})$ to denote the distribution of the transcripts of the protocol $\Pi$ running on an input drawn from $\mathcal{D}$ (that is, given a matrix $A$ which is drawn from the distribution $\mathcal{D}$, the processor $i$ gets the $i$-th row of $A$, and all processors act according to the protocol $\Pi$).

In this section we prove the following theorem:

Theorem 4.1**.**

Let $n$ be the number of processors. For any $j$-round BCAST(1) protocol $\Pi$, we have

[TABLE]

As a simple corollary, we immediately have:

Corollary 4.2** ($\textsf{BCAST}(1)$ Lower Bound for Planted Clique).**

For any constant $\varepsilon>0$, if $k=n^{1/4-\varepsilon}$ then no $n^{o(1)}$ round $\textsf{BCAST}(1)$ protocol $\Pi$ can distinguish between $\mathcal{A}_{\sf rand}$ and $\mathcal{A}_{k}$ with advantage $\Omega(1)$.

Let $\mathcal{S}_{k}^{T}$ be the uniform distribution on all size-$k$ subsets of $T$. To prove Theorem 4.1, we need the following technical lemma, whose proof is deferred to the end of this section.

Lemma 4.3**.**

Let $n,t,k$ be integers such that $t,k\leq n^{1/4}$ and $t\geq 10\log n$, $D$ be a subset of $\{0,1\}^{n}$ with $|D|\geq 2^{n-t}$, $\mathcal{U}_{D}$ be the uniform distribution on $D$, and $\mathcal{U}_{D}^{C}$ be the uniform distribution on \{x:x\in D,x_{i}=1\text{ for all i\in C}\}. For all functions $f:D\to\{0,1\}$, we have

[TABLE]

(If $\mathcal{U}_{D}^{C}$ is empty, we define $\|f(\mathcal{U}_{D})-f(\mathcal{U}_{D}^{C})\|=1$).

Intuitively speaking, the $D$ in the lemma above corresponds to the set of inputs to a certain node which are consistent with the current transcript. Each time the node broadcasts a bit, the size of $D$ is expected to reduce by at most a constant factor, so after $r$ rounds one would expect $D$ to be larger than $2^{n-\Theta(r)}$.

Now we are ready to prove Theorem 4.1.

Proof of Theorem 4.1.

Instead of viewing the algorithm as a standard $j$ round algorithm, we will prove a slightly stronger lower bound. Consider the model where during each round we have $n$ turns. On the $t^{th}$ turn, processor $(t-1)\bmod{n}+1$ gets to send a single bit. So, essentially, instead of all processors broadcasting their bit at the same time, they take turns. This model is stronger than one round of the BCAST(1) model, since it allows the later processors to condition their outputs on earlier the processors’ messages. Hence, our lower bound implies a lower bound for the BCAST(1) model as well.

Let $\mathcal{P}_{\textsf{rand}}^{(t)}$ and $\mathcal{P}_{C}^{(t)}$ be the distributions of the transcript of the first $t$ turns when the input is drawn from $\mathcal{A}_{\sf rand}$ or $\mathcal{A}_{C}$, respectively. Note that to prove the theorem, it suffices to show that the distribution $\mathcal{P}_{\textsf{rand}}^{(j\cdot n)}$ is close to $\mathcal{P}_{C}^{(j\cdot n)}$ for most choices of $C$. For this purpose, we are going to prove the following inequality holds for any $t\leq j\cdot n$:

[TABLE]

where $c_{1}$ is a large enough universal constant. It is easy to see that plugging in $t=j\cdot n$, (7) implies the theorem.

To prove (7), we induct on $t$. Clearly, (7) holds when $t=0$. So it suffices to show that when it holds for $t-1$, it also holds for $t$. Let $i$ be the processor who is broadcasting at the $t$-th turn.

For a fixed $C\subseteq[n]$, by Lemma 1.9, we have:

[TABLE]

In above, $\mathcal{D}_{i}|p$ and $\mathcal{D}_{i}^{C}|p$ are the input distributions to player $i$ conditioning on seeing the transcript $p$ of the previous $t-1$ rounds. Let $D^{(t-1)}_{p}$ denote the set of inputs from $\{x:x\in\{0,1\}^{n},x_{i}=0\}$ to $f_{i}$ which are consistent with the transcript $p$. We can see $\mathcal{D}_{i}|p$ is the uniform distribution on $D^{(t-1)}_{p}$, while $\mathcal{D}_{i}^{C}|p$ is the same as $\mathcal{D}_{i}|p$ when $i\not\in C$, and is the uniform distribution on \{x:x\in D^{(t-1)}_{p},x_{j}=1\text{ for all j\in C\setminus{i}}\}.

Taking the expected value over all cliques of both sides of (8) gives

[TABLE]

So, to prove (7), since we can bound $\operatorname*{\mathbb{E}}_{C\sim\mathcal{S}_{k}^{[n]}}\left[\left\|\mathcal{P}_{\textsf{rand}}^{(t-1)}-\mathcal{P}_{C}^{(t-1)}\right\|\right]$ by the inductive hypothesis, it suffices to bound $\operatorname*{\mathbb{E}}_{p\sim\mathcal{P}_{\textsf{rand}}^{(t-1)}}\operatorname*{\mathbb{E}}_{C\sim\mathcal{S}_{k}^{[n]}}\left[\left\|f_{i}^{|p}(\mathcal{D}_{i}|p)-f_{i}^{|p}(\mathcal{D}_{i}^{C}|p)\right\|\right]$. We first show that for most $p\sim\mathcal{P}_{\textsf{rand}}^{(t-1)}$, $D^{(t-1)}_{p}$ is large (that is, after $t-1$ turns, we expect the set of inputs consistent with the transcript to be large). The proof for the following claim is deferred to the end of the whole proof.

Claim 2**.**

For $t\leq j\cdot n\leq\frac{k\cdot n}{10}$, with probability $1-1/n^{2}$ over $p\sim\mathcal{P}_{\textsf{rand}}^{(t-1)}$, we have $|D^{(t-1)}_{p}|\geq 2^{n-j}/n^{3}$.

Now, given a $p$ with $|D^{(t-1)}_{p}|\geq 2^{n-j}/n^{3}=2^{n-j-3\log n}$, we want to bound $\operatorname*{\mathbb{E}}_{C\sim\mathcal{S}_{k}^{[n]}}\left[\left\|f_{i}^{|p}(\mathcal{D}_{i}|p)-f_{i}^{|p}(\mathcal{D}_{i}^{C}|p)\right\|\right]$. There are two cases:

• •

When $i\notin C$, which happens with probability $1-\frac{k}{n}$, we have

[TABLE]

as $\mathcal{D}_{i}^{C}|p=\mathcal{D}_{i}|p$.

• •

When $i\in C$, which happens with probability $\frac{k}{n}$, by Lemma 4.3, we have

[TABLE]

Putting them together, we have

[TABLE]

which proves (7) for $t$. ∎

Finally, we prove Claim 2.

Proof of Claim 2.

Let $t_{1},t_{2},\dotsc,t_{\ell}$ be the indices of all previous $\ell$ turns with processor $i$ broadcasting, before the current $t$-th turn. We have $\ell\leq j$. Let $x\in\{z:z\in\{0,1\}^{n},z_{i}=0\}$, note that $x$ is consistent with transcript $p$, if for all $a\in[\ell]$, we have

[TABLE]

where $p^{(t_{a}-1)}$ denotes the first $t_{a}-1$ bits of $p$. We set $F_{i}(x,p)=1$ if $x$ and $p$ are consistent, and [math] otherwise.

Consider the random process of generating $p\sim\mathcal{P}_{\textsf{rand}}^{(t-1)}$, suppose inputs to all processors other than $i$ are fixed, let $x^{-i}=(x_{1},x_{2},\dotsc,x_{i-1},x_{i+1},\dotsc,x_{n})\in\{0,1\}^{(n-1)\times n}$ be those fixed input. Let $P_{x^{-i}}^{(t)}$ be the distribution of the transcript when $x_{i}\sim\mathcal{A}_{\sf rand}^{[i]}$, and all other processors get (fixed) input according to $x^{-i}$.

For a fixed $x^{-i}$, note that there are only $2^{\ell}$ possible transcripts $p$ from $P_{x^{-i}}^{(t-1)}$, as the transcript is determined after fixing the output of processor $i$ at all $\ell$ rounds. Therefore, let $T(x^{-i},x_{i})$ be the transcript when all processors get inputs according to $x^{-i}$ and $x_{i}$, we can see when $p\sim P_{x^{-i}}^{(t-1)}$, $F_{i}(x,p)=1$ if and only if $T(x^{-i},x)=p$. That is,

[TABLE]

In above $P_{x^{-i}}^{(t-1)}(p)$ is the probability that getting $p$ from distribution $P_{x^{-i}}^{(t-1)}$. Then we have

[TABLE]

The last inequality holds because the support size of $P_{x^{-i}}^{(t-1)}$ is at most $2^{\ell}$ and $\ell\leq j$.

Hence, we have

[TABLE]

In above $\mathcal{A}_{\sf rand}^{[-i]}$ denotes the marginal distribution of $\mathcal{A}_{\sf rand}$ on all rows except the $i$-th row. ∎

4.1 Proof for Lemma 4.3

We need the following lemma first, which is proved using tools from information theory.

Lemma 4.4**.**

Let $n,t,k$ be integers such that $t,k\leq n/10$, $D$ be a subset of $\{0,1\}^{n}$ with $|D|\geq 2^{n-t}$, $\mathcal{U}_{D}$ be the uniform distribution on $D$, and $\mathcal{U}_{D}^{[i]}$ be the uniform distribution on $\{x:x\in D\text{ and }x_{i}=1\}$, for all function $f:D\to\{0,1\}$, we have

[TABLE]

Proof.

Let $D^{[i]}:=\{x:x\in D\text{ and }x_{i}=1\}$. Throughout the proof we will assume $X$ is a random variable drawn uniformly from $D$. For $i\in[n]$, let $X_{i}$ be the random variable of the $i$-th bit of $X$.

We have $\frac{|D^{[i]}|}{|D|}=\Pr[X_{i}=1]$. By the sub-additivity of entropy, it follows that $\sum_{i=1}^{n}H(X_{i})\geq H(X)\geq n-t$.

That is, $\operatorname*{\mathbb{E}}_{i\leftarrow[n]}[1-H(X_{i})]=\frac{t}{n}$. By a simple Markov’s inequality, with probability at least $1-\frac{2t}{n}$ over $i\leftarrow[n]$, we have $H(X_{i})\geq 1/2$. Note that $H(X_{i})\geq 1/2$ implies $\Pr[X_{i}=1]\geq 0.1$.

Also,

[TABLE]

And by the sub-additivity of conditional entropy, we have

[TABLE]

Therefore,

[TABLE]

or equivalently,

[TABLE]

Note that by Fact 2.1,

[TABLE]

Taking expected values over $i$ of both sides and using $\operatorname*{\mathbb{E}}_{i\leftarrow[n]}I(X_{i};f(X))\leq\frac{t+1}{n}$ gives

[TABLE]

By Pinsker’s inequality (Lemma 2.2) and the fact that $\sqrt{x}$ is a concave function, we have

[TABLE]

and

[TABLE]

Finally, note that with probability at least $1-\frac{2t}{n}$ over $i\leftarrow[n]$, we have $\Pr[X_{i}=1]\geq 0.1$. Putting everything together, we have

[TABLE]

Now we are ready to prove Lemma 4.3 (restated below).

*Reminder of Lemma 4.3 *** Let $n,t,k$ be integers such that $t,k\leq n^{1/4}$ and $t\geq 10\log n$, $D$ be a subset of $\{0,1\}^{n}$ with $|D|\geq 2^{n-t}$, $\mathcal{U}_{D}$ be the uniform distribution on $D$, and $\mathcal{U}_{D}^{C}$ be the uniform distribution on \{x:x\in D,x_{i}=1\text{ for all i\in C}\}. For all function $f:D\to\{0,1\}$, we have

[TABLE]

Proof of Lemma 4.3.

Instead of choosing $C$ from $\mathcal{S}_{k}^{[n]}$, we choose an ordered $k$-tuple of $a=(a_{1},a_{2},\dotsc,a_{k})$ of $k$ distinct elements in $[n]$ uniformly at random. Let the distribution be $\mathcal{T}_{k}^{[n]}$.

We have

[TABLE]

Now we are to bound the right side of (10) for each $0\leq\ell\leq k-1$ separately. For a subset $S\subseteq[n]$, let D^{S}=\{x:x\in D\wedge x_{i}=1\text{ for all i\in S}\}.

We first show with high probability, for $a\sim\mathcal{T}_{\ell}^{[n]}$, we have $D^{\{a_{i}\}_{i=1}^{\ell}}$ is very large. The proof of the following claim is deferred to end of the whole proof.

Claim 3**.**

For an integer $\ell\leq n^{1/4}$,

[TABLE]

Now, by Claim 3 and Lemma 4.4, with probability at least $1-O\left(\frac{t\cdot\ell}{n}\right)$ over $a\sim\mathcal{T}_{\ell}^{[n]}$, we have

[TABLE]

Putting them together, we have

[TABLE]

Summing everything up for $0\leq\ell\leq k-1$, we have

[TABLE]

∎

Finally, we prove Claim 3, which is the most technical proof of this section.

Proof of Claim 3.

We begin with some notations.

Subset Tree.

We can view the process of choosing the $k$-tuples as growing a tree. For each $0\leq\ell\leq k$ and each sequence $\{a_{i}\}_{i=1}^{\ell}$ from $\mathcal{T}_{\ell}^{[n]}$, we build a tree node $T_{\{a_{i}\}_{i=1}^{\ell}}$. For each $j\in[n]\setminus\{a_{i}\}_{i=1}^{\ell}$, we say node $T_{\{a_{i}\}_{i=1}^{\ell}\cup\{j\}}$ is a child of the node $T_{\{a_{i}\}_{i=1}^{\ell}}$, and denote the edge between them as $E_{\{a_{i}\}_{i=1}^{\ell}\rightarrow j}$. With this interpretation, the process of choosing $a\sim\mathcal{T}_{k}^{[n]}$ can be seen as starting from the root $T_{\emptyset}$, and descending to a random child for $k$ times.

We also define

[TABLE]

and

[TABLE]

That is, $Z_{\{a_{i}\}_{i=1}^{\ell}}$ is the gap between the entropy of the set corresponding to the node and the “full entropy” $n-\ell$, while $Y_{\{a_{i}\}_{i=1}^{\ell}}$ is the increase of that entropy gap on its parent.

Note that the claim asks to upper bound

[TABLE]

and we have

[TABLE]

Good Nodes, Good Edges, Bad Nodes, Bad Edges, and Edge Labels.

We next define when a node (or an edge) is good or bad. The root $T_{\emptyset}$ is a good node. If the parent of the node is a bad node then it is also a bad node. If a node is a bad node, then all edges in its sub-tree are bad edges.

If $T_{\{a_{i}\}_{i=1}^{\ell}}$ is a good node, we look at all $j\in[n]\setminus\{a_{i}\}_{i=1}^{\ell}$. We say the edge from $T_{\{a_{i}\}_{i=1}^{\ell}}$ to $T_{\{a_{i}\}_{i=1}^{\ell}\cup\{j\}}$, denoted as $E_{\{a_{i}\}_{i=1}^{\ell}\rightarrow j}$ is a good edge, if

[TABLE]

otherwise it is a bad edge. The above basically guarantees to us that a large enough subset (at least a constant fraction) of $D^{\{a_{i}\}_{i=1}^{\ell}}$ contains a $1$ as its $j$th entry.

We mark $T_{\{a_{i}\}_{i=1}^{\ell}\cup\{j\}}$ as a bad node if $E_{\{a_{i}\}_{i=1}^{\ell}\rightarrow j}$ is a bad edge, or $Z_{\{a_{i}\}_{i=1}^{\ell}\cup\{j\}}>3t$, otherwise it is a good node.

For a good edge $E_{\{a_{i}\}_{i=1}^{\ell}\rightarrow j}$, we say it has label $k$ if $|Y_{\{a_{i}\}_{i=1}^{\ell}\cup\{j\}}|\in(2^{-k},2^{-k+1}]$.

Since it is an good edge, we have

[TABLE]

and by Fact 2.3, it follows

[TABLE]

Therefore,

[TABLE]

Therefore, $Z^{\{a_{i}\}_{i=1}^{\ell}\cup\{j\}}\leq Z^{\{a_{i}\}_{i=1}^{\ell}}+\log(1/0.3)-1\leq Z^{\{a_{i}\}_{i=1}^{\ell}}+1$, which means $Y_{\{a_{i}\}_{i=1}^{\ell}\cup\{j\}}\leq 1$. Hence, a good edge’s label is at least $1$.

Basic Facts.

We need the following two basic facts, whose proof can be found at the end of the proof.

Fact 4.5**.**

Let $T_{\{a_{i}\}_{i=1}^{\ell}}$ be a good node, we have

[TABLE]

Fact 4.6**.**

Let $T_{\{a_{i}\}_{i=1}^{\ell}}$ be a good node and $k$ be an integer, we have

[TABLE]

The Bound.

Now we are going to lower bound the probability of the event that all nodes $T_{\{a_{i}\}_{i=1}^{d}}$ for $0\leq d\leq\ell$ are good, denoted as event $\mathcal{E}_{\sf good}$. Clearly this provides a lower bound on $\Pr_{a\sim T_{\ell}^{[n]}}[Z_{\{a_{i}\}_{i=1}^{\ell}}>2t]$.

Suppose $\mathcal{E}_{\sf good}$ doesn’t happen, let $d$ be the first index such that $T_{\{a_{i}\}_{i=1}^{d}}$ is a bad node, let this event be $\mathcal{E}_{\sf bad}^{d}$. Clearly we have

[TABLE]

Therefore it suffices to provide an upper bound for each $\Pr[\mathcal{E}_{\sf bad}^{d}]$, note that $\mathcal{E}_{\sf bad}^{d}$ is defined as

[TABLE]

There are two possible cases, the first case is that the edge $E_{\{a_{i}\}_{i=1}^{d-1}\rightarrow a_{d}}$ is an bad edge, which happens with probability at most $O\left(\frac{t}{n}\right)$ by Fact 4.5.

The second case is that the edge $E_{\{a_{i}\}_{i=1}^{d-1}\rightarrow a_{d}}$ is an good edge. In that case, by definition, we have $Z_{\{a_{i}\}_{i=1}^{d}}>3t$, which also means

[TABLE]

Let $N_{k}$ be the number of edges in the path $\{E_{\{a_{i}\}_{i=1}^{j-1}\rightarrow a_{j}}:j\in[d]\}$ with label $k$.

[TABLE]

which simplifies to

[TABLE]

Note that since $N_{k}\leq d$, we have

[TABLE]

Which means

[TABLE]

In particular, this means there exists an $k\in[\log_{2}(2d/t)]$, such that

[TABLE]

Let the above be event $\mathcal{E}_{\sf bad}^{d,k}$, we have

[TABLE]

And by Fact 4.6, we have

[TABLE]

Note that $4^{k}\leq(2d/t)^{2}=O(d^{2}/t^{2})$, $d\leq\ell\leq n^{1/4}$ and $t\geq 10\log n$, the above simplifies to

[TABLE]

Putting everything together, we have

[TABLE]

and

[TABLE]

The above completes the proof. ∎

Now we finish the whole proof by proving Fact 4.5 and Fact 4.6.

*Reminder of Fact 4.5 *** Let $T_{\{a_{i}\}_{i=1}^{\ell}}$ be a good node. We have

[TABLE]

*Reminder of Fact 4.6 *** Let $T_{\{a_{i}\}_{i=1}^{\ell}}$ be a good node and $k$ be an integer. We have

[TABLE]

Proof of Fact 4.5 and Fact 4.6.

Let $X\sim D^{\{a_{i}\}_{i=1}^{\ell}}$, we have $H(X)\geq n-\ell-2t$. Also, since $X_{j}$ for $j\in\{a_{i}\}_{i=1}^{\ell}$ is always $1$, and therefore has entropy [math], by the sub-additive of entropy, we have

[TABLE]

Or equivalently, we have

[TABLE]

By a simple Markov’s inequality, we have

[TABLE]

which proves Fact 4.5.

Now, let $B_{j}$ be the set of $j$ satisfying $H(X_{j})<0.9$. We have

[TABLE]

Now, let $p_{j}=\Pr[X_{j}=1]$ and $z_{j}=(p_{j}-1/2)$. For $j\in[n]\setminus(\{a_{i}\}_{i=1}^{\ell}\cup B_{j})$, we have $H(p_{j})\geq 0.9$ and $|z_{j}|\leq 0.2$ from Fact 2.3, and also

[TABLE]

Also, by definition, we have

[TABLE]

Consider the function $g(z):=\log(1+z)/z$, we can see it is a decreasing function when $z\in[-0.4,0.4]$, and we have

[TABLE]

Therefore, if the edge $E_{\{a_{i}\}_{i=1}^{\ell}\rightarrow j}$ has label $k$, we know that

[TABLE]

Using (11), we see there are at most $O\left(4^{k}\cdot t\right)$ $j$’s such that $E_{\{a_{i}\}_{i=1}^{\ell}\rightarrow j}$ has label $k$. From which Fact 4.6 follows directly. ∎

5 Proof Overview For the PRG Construction

In this section we provide an overview of the proof for our PRG construction. We first consider a toy example: a very simple PRG which constructs one pseudo-random bit, and fools any one-round BCAST(1) protocol. Its proof already illustrates the key proof strategy which is used to prove our full PRG results. Then in Subsections 5.1 and 5.2 we sketch the key ideas to generalize the proof for the general PRG theorem.

The Toy PRG.

Here we describe the PRG, and below we will analyze it to show it is indeed pseudo-random. Suppose there are $n$ processors, and each processor receives $k$ truly random bits. Suppose there is also a shared random bit-vector $b$ of length $k$, which is also sampled uniformly at random. Then each processor’s extra pseudo-random bit is the inner product (modulo 2) of the vector formed by its random bits and $b$ (so the complete pseudo-random string is its initial $k$ random bits concatenated with these extra random bits obtained with the inner product). Note that in the typical case $n\gg k$, this PRG generates $n$ pseudo-random bits out of a shared random string $b$ of length $k$. When analyzing the PRG, we think of $b$ as a “secret” string, since distinguishing the PRG from true randomness corresponds to discovering whether such a $b$ exists.

The goal here is to show that the above PRG construction and the case that all processor get $k+1$ truly random bits are indistinguishable to a one-round BCAST(1) protocol (see Theorem 5.1 for a formal statement). We begin with some notations.

Notations.

Throughout the paper, except when explicitly stated, all matrices and vectors are over $\mathbb{F}_{2}$. We use $\{0,1\}^{n}$ ($\{0,1\}^{n\times m}$) and $\mathbb{F}_{2}^{n}$ ($\mathbb{F}_{2}^{n\times m}$) interchangeably. For two vectors $u$ and $v$, we use $(u,v)$ to denote their concatenation.

Recall that we can assume all processors are deterministic as we are trying to prove a lower bound for distinguishing two input distributions by Yao’s principle. Processor $i$ can then be defined by a function $f_{i}:\{0,1\}^{k+1}\times\{0,1\}^{*}\to\{0,1\}$, such that $f_{i}(z,p)$ is the bit that player $i$ outputs when it gets the input $z$ and transcript $p$. We use $f_{i}^{|p}$ to denote the function $f_{i}(\cdot,p)$ for simplicity. If transcript $p$ is incompatible with player $i$ having input $z$, then we set $f_{i}(z,p)$ arbitrarily.

We use $\mathcal{U}_{[b]}$ to denote the uniform distribution on the set $\{(x,x\cdot b):x\in\{0,1\}^{k}\}$, which is the distribution of inputs a processor receives when the shared random string during the construction of the pseudo-randomness is $b$. We can now formally state our theorem.

Theorem 5.1**.**

Let $k$ be an integer and $n$ be the number of processors. Consider the following two cases:

• •

(A) All processors receive random inputs from $\mathcal{U}_{k+1}$.

• •

(B) Let $b$ be a uniform sample from $\mathcal{U}_{k}$, then all processors receive inputs from $\mathcal{U}_{[b]}$.

For any one-round BCAST(1) protocol, the statistical distance between the distributions of its transcripts in case (A) and (B) is at most $O\left(\frac{n}{2^{k/2}}\right)$.

We need the following technical lemma, whose proof can be found at the end of this section.

Lemma 5.2**.**

Given a function $f:\{0,1\}^{k+1}\to\{0,1\}$, we have

[TABLE]

Note that $f(\mathcal{U}_{k+1})$ and $f(\mathcal{U}_{[b]})$ are two distributions on $\{0,1\}$.

Intuitively, the above lemma says that for any function $f$ (think of this as a function describing a processor), it cannot distinguish distributions $\mathcal{U}_{[b]}$ and $\mathcal{U}_{k+1}$ for most strings $b$. So, fixing a few random entries of $x$ to be $1$ doesn’t change the probability that $f(x)$ is $1$ by much.

Now we are ready to prove Theorem 5.1.

Proof.

Instead of viewing the algorithm as a single round algorithm, we will prove a slightly stronger lower bound. Consider the model where we have $n$ turns. On the $t^{th}$ turn, processor $t$ gets to send a single bit. This model is stronger than one round of the BCAST(1) model, since it allows the later processors to condition their outputs on earlier the processors’ messages. Hence, our lower bound implies a lower bound for the BCAST(1) model as well.

Notations.

Let $\mathcal{P}_{\textsf{rand}}^{(t)}$ and $\mathcal{P}_{[b]}^{(t)}$ be the distributions of the transcript of the first $t$ turns when all processors get a random input from $\mathcal{U}_{k+1}$ and $\mathcal{U}_{[b]}$ respectively.

Note that to prove the theorem, it suffices to show that the distribution $\mathcal{P}_{\textsf{rand}}^{(n)}$ is close to $\mathcal{P}_{[b]}^{(n)}$ for most choices of $b$. For this purpose, we are going to prove the following inequality holds for any $t\leq n$:

[TABLE]

It is easy to see that plugging in $t=n$, (12) implies the theorem. To prove (12) for all $t$, we induct on $t$. Clearly, (7) holds when $t=0$. So it suffices to show that when it holds for $t-1$, it also holds for $t$.

For $b\in\{0,1\}^{k}$, we wish to bound the distance $\|\mathcal{P}_{\textsf{rand}}^{(t)}-\mathcal{P}_{[b]}^{(t)}\|$. By Lemma 1.9, it follows that

[TABLE]

Recall that in above $f_{t}^{|p}$ is the output function of process $t$ when seeing the transcript $p$.

For each $b\in\{0,1\}^{k}$ and transcript $p\in\{0,1\}^{t-1}$, we define scores $s_{b,p}$ and $s_{b}$ as follows:

[TABLE]

It suffices to give an upper bound on $\operatorname*{\mathbb{E}}_{b\sim\mathcal{U}_{k}}[s_{b}]$. By Lemma 5.2, for all $p\in\{0,1\}^{t-1}$, we have

[TABLE]

and therefore

[TABLE]

By the definition of $s_{b}$, it follows that

[TABLE]

Therefore, we have

[TABLE]

The above proves (12) for $t$, which completes the whole proof.

∎

Finally, we prove Lemma 5.2.

Proof of Lemma 5.2.

Note that since $f$ is Boolean valued, we have

[TABLE]

The proof is an application of the analysis of Boolean functions (see Section 2.2). Let $b\in\{0,1\}^{k}$, and let $S_{b}$ be the corresponding subset of $[k]$ (if $b_{i}=1$ then $i\in S_{b}$). We use $\overline{\mathcal{U}}_{[b]}$ to denote the uniform distribution on the set $\{(x,1-x\cdot b):x\in\{0,1\}^{b}\}$, that is, the uniform distribution on the complement of the support of $\mathcal{U}_{[b]}$.

Note that for every $x$ from the support of $\mathcal{U}_{[b]}$, we have $x\cdot(b,1)=0$, and for every $x$ from the support of $\overline{\mathcal{U}}_{[b]}$, we have $x\cdot(b,1)=1$. Then we have

[TABLE]

By Parseval’s identity (see Section 2.2) and the fact that $f$ is Boolean valued, we have

[TABLE]

and it follows that

[TABLE]

5.1 Generalization to Multi-Round Case

Now we outline how to extend the proof to the multi-round case. The PRG is still the same as the toy PRG, we just need to prove it also fools multiple round BCAST(1) protocols (i.e. Theorem 5.3). In the following, we will explain the key difficulty for generalizing the previous proof to the multi-round case, and how we address them.

Theorem 5.3**.**

Consider the following two cases:

• •

(A) All processors receive random inputs from $\mathcal{U}_{k+1}$.

• •

(B) Let $b$ be a uniform sample from $\mathcal{U}_{k}$, then all processors receive inputs from $\mathcal{U}_{[b]}$.

For $j\leq k/10$, and any $j$-round BCAST(1) protocol, the statistical distance between the distributions of its transcripts in case (A) and (B) is at most $O\left(\frac{j\cdot n}{2^{k/9}}\right)$.

The key technical part of the proof of Theorem 5.1, is to bound $\|\mathcal{P}_{\textsf{rand}}^{(t)}-\mathcal{P}_{[b]}^{(t)}\|$, i.e., the Inequality (13):

[TABLE]

Let $X_{\textsf{rand}}$ ($X_{[b]}$) denote the random variable for the input to the processor $i$ broadcasting at the $t^{th}$ turn, in the case all processors receive inputs from $\mathcal{U}_{k+1}$ ($\mathcal{U}_{[b]}$). Inequality (13) holds crucially because $X_{\textsf{rand}}$ ($X_{[b]}$) is independent of the previous part of the transcript during the first $(t-1)$ turns ($b$ is fixed).

However, the independence condition no longer holds in the multi-round case, as the transcript contains previous broadcasts of the same processor $i$, which contain information about processor $i$’s input. To deal with that, we have to consider the conditional random variables $X_{\textsf{rand}}^{|p}$ and $X_{[b]}^{|p}$ which are $X_{\textsf{rand}}$ and $X_{[b]}$ conditioning on seeing the transcript $p$.

Let $D^{(t-1)}_{p}$ denote the set of inputs to $f_{i}$ which are consistent with the transcript $p\in\{0,1\}^{t-1}$,141414That is, simulating $f_{i}$ with transcript $p$ on that input results in transcript $p$ itself. then $X_{\textsf{rand}}^{|p}$ and $X_{[b]}^{|p}$ distribute uniformly on $\{0,1\}^{k+1}\cap D^{(t-1)}_{p}$ and $\{(x,x\cdot b):x\in\{0,1\}^{k}\}\cap D^{(t-1)}_{p}$. We use $\mathcal{U}_{k+1,p}$ and $\mathcal{U}_{[b],p}$ to denote their distributions. Then we can state a bound similar to (13) in the multi-round case:

[TABLE]

Our one-round proof depends on Lemma 5.2, which cannot be used directly to bound the right side of the above inequality. Luckily, we are able to generalize Lemma 5.2 such that it works as long as $D^{(t-1)}_{p}$ is sufficiently large (see Lemma 6.1), which happens to be the case with high probability (see Claim 4).

5.2 Generalization to the Complete PRG

Before discussing how to generalize the proof to get a complete PRG. We give a formal description of the PRG here.

The Full PRG.

Suppose there are $n$ processors and the PRG wants to create $m$ pseudo-random bits that fool an $\Omega(k)$-round $\textsf{BCAST}(1)$ protocol. Then the PRG is described as follows: each processor gets $k$ truly random bits. There is also a hidden “secret” matrix $M$ of size $k\times(m-k)$, which distributes uniformly random (when constructing the pseudo-randomness, this matrix is created by having each processor broadcast some additional uniformly random bits until there are enough to create the matrix). Then each processor’s extra $m-k$ pseudo-random bits are simply the vector matrix product of its random bits and $M$, i.e., $x^{T}M$ (see also Theorem 1.3).

The generalization to the complete PRG case (Theorem 5.4) is quite technical. To state the whole technical theorem, we need to introduce some definitions. Let $M\in\{0,1\}^{n\times m}$. We use $\mathcal{U}_{M}$ to denote the uniform distribution on the following set $\{(x,x^{T}M):x\in\{0,1\}^{n}\}$, which is a subset of $\{0,1\}^{n+m}$. For integers $n$ and $m$, we use $\mathcal{U}_{n\times m}$ to denote the uniform distribution on $\{0,1\}^{n\times m}$. Formally, we want to show:

Theorem 5.4**.**

Let $n,m,k$ be three integers. Consider the following two cases:

• •

(A) All processors receive random inputs from $\mathcal{U}_{m}$.

• •

(B) Let $M$ be a uniform sample from $\mathcal{U}_{k\times(m-k)}$, then all processors receive inputs from $\mathcal{U}_{M}$.

For $j\leq k/10$, $m\leq 2^{k/20}$ and any $j$-round BCAST(1) protocol, the statistical distance between the distributions of its transcripts in case (A) and (B) is at most $O\left(\frac{j\cdot n}{2^{k/9}}\right)$.

The proof strategy is still similar to that of Theorem 5.3. But now for each turn $t$, we need to maintain a set $S^{(t)}$ of secret matrices $M\in\{0,1\}^{k\times(m-k)}$ instead of a set of secret strings. Following the same reasoning as in the previous subsection, we can state a similar bound in this case:

[TABLE]

In which we use $P_{M}^{(t)}$ to denote the distribution of the transcript of the first $t$ rounds when all processors get random input from $\mathcal{U}_{M}$. And $\mathcal{U}_{m,p}$ and $\mathcal{U}_{M,p}$ are distributions to the current processor $i$ conditioning on seeing transcript $p$. Using a clever hybrid argument, we are able to prove the sufficient technical lemma (Lemma 7.2) to bound the right side of the above inequality.

6 Creating a Single Extra Pseudo-random Bit And an Average Case Lower Bound

In this section we show our toy PRG (see Section 5) also fools multiple rounds BCAST(1) protocols by proving Theorem 5.3 (restated below). We also show that our average case lower bound (Theorem 1.4) is a simple corollary of it.

*Reminder of Theorem 5.3. *** Consider the following two cases:

• •

(A) All processors receive random inputs from $\mathcal{U}_{k+1}$.

• •

(B) Let $b$ be a uniform sample from $\mathcal{U}_{k}$, then all processors receive inputs from $\mathcal{U}_{[b]}$.151515recall that $\mathcal{U}_{[b]}$denotes the uniform distribution on the set $\{(x,x\cdot b):x\in\{0,1\}^{k}\}$

*For $j\leq k/10$, and any $j$-round BCAST(1) protocol, the statistical distance between the distributions of its transcripts in case (A) and (B) is at most $O\left(\frac{j\cdot n}{2^{k/9}}\right)$. *

6.1 An Average Case Lower Bound for BCAST(1)

First, we show Theorem 5.3 implies the average case lower bound we want.

**Reminder of Theorem 1.4 *** Let $n$ be a large enough integer and $F_{\textsf{full-rank}}:\{0,1\}^{n\times n}\to\{0,1\}$ be the indicator function that whether the given matrix has full rank. Suppose there are $n$ processors, $i$-th processor is given with the $i$-th row of the input matrix. For all $n/20$-round BCAST(1) protocol and all processor $i$ in it, $i$ cannot compute $F$ correctly with probability better than $0.99$, over a uniform random matrix from $\{0,1\}^{n\times n}$. *

Proof.

Let $M$ be the input matrix from $\mathcal{U}_{n\times n}$, where processor $i$ gets its $i$-th row. Let $\mathcal{U}_{A}$ be the uniform distribution $\mathcal{U}_{n\times n}$, and $\mathcal{U}_{B}$ be the input distribution of case (B) in Theorem 5.3 when setting $k=n-1$.

We need some results about random $\mathbb{F}_{2}$ matrix from Section 3.2 of [Kol99]. In particular, let $P_{n,s}$ be the probability that a uniformly random $\mathbb{F}_{2}$ matrix from $\mathbb{F}_{2}^{n\times n}$ has rank $n-s$. For all $s$, we have

[TABLE]

Numerically, we have $Q_{0}\approx 0.2887880950866$. Let $i$ be a processor, and $\textsf{acc}(M)$ be $i$’s output on input matrix $M$, it suffices to show that $\textsf{acc}(M)$ can not be correct w.r.t. $F_{\textsf{full-rank}}$ with probability higher than $0.99$. Set $\varepsilon=1-0.99=0.01$ for convenience.

Suppose for the contradiction that $\textsf{acc}(M)$ is correct w.r.t. $F_{\textsf{full-rank}}(M)$ with probability at least $1-\varepsilon$ over $M\sim\mathcal{U}_{A}$, then we have

[TABLE]

which means

[TABLE]

Also, by Theorem 5.3, we have

[TABLE]

and therefore

[TABLE]

However, for all matrices in the support of $\mathcal{U}_{B}$, their rank is at most $n-1$, which means $\textsf{acc}(M)$ must be wrong on most of them. Note that

[TABLE]

where $\mathcal{U}_{A}(M)$ and $\mathcal{U}_{B}(M)$ denote the probability of getting $M$ for distributions $\mathcal{U}_{A}$ and $\mathcal{U}_{B}$.

For a matrix $M\sim\mathcal{U}_{B}$, suppose the rank of its first $n-1$ columns is $n-s$, $\mathcal{U}_{B}(M)$ can be computed as

[TABLE]

Furthermore, for $M\sim\mathcal{U}_{B}$, the probability that its first $n-1$ columns have rank at least $n-s$ is at least $\sum_{j=0}^{s-1}P_{n-1,j}$, as the rank of an $n\times(n-1)$ matrix is always no less than the rank of its left-top $(n-1)\times(n-1)$ matrix. Setting $s=3$, we can see that for large enough $n$, with probability at least $\sum_{j=0}^{2}Q_{j}\geq 1-0.006$, the first $n-1$ columns of $M$ have rank at least $n-3$. In that case, $\frac{\mathcal{U}_{A}(M)}{\mathcal{U}_{B}(M)}\geq 2^{-s}=1/8$.

Putting them together, we have

[TABLE]

contradiction, which completes the proof. ∎

Considering the problem that checking whether the top $k\times k$ sub-matrix has full-rank, one immediately get the following average case time-hierarchy theorem for $\textsf{BCAST}(1)$.

**Reminder of Theorem 1.5 *** For any $\omega(\log n)\leq k\leq n$, there is a function $F$ such that a $k$-round $\textsf{BCAST}(1)$ protocol can compute exactly, while any $k/20$-round $\textsf{BCAST}(1)$ protocols cannot compute $F$ correctly with probability $0.99$ over the uniform distribution. *

6.2 Proof of Theorem 5.3

We need the following technical lemma first, whose proof is deferred to the end of the section.

Lemma 6.1**.**

Given a function $f:\{0,1\}^{k+1}\to\{0,1\}$ and a set $D\subseteq\{0,1\}^{k+1}$ with $|D|\geq 2^{k/2}$, let $\mathcal{U}_{[b],D}$ and $\mathcal{U}_{k+1,D}$ be the conditional distributions of $\mathcal{U}_{[b]}$ and $\mathcal{U}_{k+1}$ on the set $D$.161616When $\mathcal{U}_{[b]}$ ($\mathcal{U}_{k+1}$) has no mass on $D$, we set $\mathcal{U}_{[b],D}$ ($\mathcal{U}_{k+1,D}$) to be the uniform distribution on $D$. We have

[TABLE]

Now we are ready to prove Theorem 5.3.

Proof of Theorem 5.3.

Similar to the proof of Theorem 5.1, we will consider a slightly stronger model where we have $j\cdot n$ turns, and on the $t^{th}$ turn, processor $(t-1)\bmod{n}+1$ gets to send a single bit. Recall that we use $\mathcal{P}_{\textsf{rand}}^{(t)}$ to denote the distribution of the transcript of the first $t$ rounds when all processors get random input from $\mathcal{U}_{k+1}$, and $\mathcal{P}_{[b]}^{(t)}$ to denote the distribution of the transcript of the first $t$ rounds when all processors get random input from $\mathcal{U}_{[b]}$.

Note that to prove the theorem, it suffices to show that the distribution $\mathcal{P}_{\textsf{rand}}^{(j\cdot n)}$ is close to $\mathcal{P}_{[b]}^{(j\cdot n)}$ for most choices of $b$. For this purpose, we are going to prove the following inequality holds for any $t\leq j\cdot n$:

[TABLE]

It is easy to see that plugging in $t=j\cdot n$, (14) implies the theorem. To prove (14) for all $t$, we induct on $t$. Clearly, (7) holds when $t=0$. So it suffices to show that when it holds for $t-1$, it also holds for $t$. Let $i=(t-1)\pmod{n}+1$ be the processor broadcasting at the $t$-th turn.

Again, for $b\in\{0,1\}^{k}$, we wish to bound $\|\mathcal{P}_{\textsf{rand}}^{(t)}-\mathcal{P}_{[b]}^{(t)}\|$. By Lemma 1.9, we have

[TABLE]

In the above, $\mathcal{U}_{k+1,p}$ and $\mathcal{U}_{[b],p}$ are the distributions $\mathcal{U}_{k+1}$ and $\mathcal{U}_{[b]}$ conditioned on the previous transcript $p$. Specifically, let $D^{(t-1)}_{p}$ denote the set of inputs to $f_{i}$ which are consistent with the transcript $p$171717That is, simulating $f_{i}$ with transcript $p$ on that input results in transcript $p$ itself., then $\mathcal{U}_{[b],p}$ and $\mathcal{U}_{k+1,p}$ are the conditional distributions of $\mathcal{U}_{[b]}$ and $\mathcal{U}_{k+1}$ on set $D^{(t-1)}_{p}$.

Here, we wish to use Lemma 6.1 to bound the second term on the right side of (15). To satisfy the requirement of Lemma 6.1, we have to show that $D^{(t-1)}_{p}$ is a large subset of $\{0,1\}^{k+1}$ with high probability. Hence, we need the following claim, whose proof is deferred until we prove the theorem first.

Claim 4**.**

For $t\leq j\cdot n\leq\frac{k\cdot n}{10}$, with probability $1-2^{-k/4}$ over $p\sim\mathcal{P}_{\textsf{rand}}^{(t-1)}$, we have $|D^{(t-1)}_{p}|\geq 2^{k/2}$.

Now, for each $b$, we define a score $s_{b}$ as follows:

[TABLE]

For $p\in\{0,1\}^{t-1}$, we set $s_{b,p}:=\left\|f_{i}^{|p}(\mathcal{U}_{k+1,p})-f_{i}^{|p}(\mathcal{U}_{[b],p})\right\|$. Then by Lemma 6.1 and Claim 4, when $p\sim\mathcal{P}_{\textsf{rand}}^{(t-1)}$, with probability at least $1-2^{-k/4}$, we have $|D^{(t-1)}_{p}|\geq 2^{k/2}$ and

[TABLE]

Therefore, it follows

[TABLE]

Now we have

[TABLE]

The above proves (14) for $t$, which completes the whole proof.

∎

Now we prove Claim 4.

Proof of Claim 4.

Let $t_{1},t_{2},\dotsc,t_{\ell}$ be the indices of all previous $\ell$ turns with processor $i$ broadcasting, before the current $t$-th turn. We have $\ell\leq j\leq k/10$. Let $x\in\{0,1\}^{k+1}$, note that $x$ is consistent with transcript $p$, if for all $a\in[\ell]$, we have

[TABLE]

where $p^{(t_{a}-1)}$ denotes the first $t_{a}-1$ bits of $p$. We set $F_{i}(x,p)=1$ if $x$ and $p$ are consistent, and [math] otherwise.

Consider the random process of generating $p\sim\mathcal{P}_{\textsf{rand}}^{(t-1)}$, suppose inputs to all processors other than $i$ are fixed, let $x^{-i}=(x_{1},x_{2},\dotsc,x_{i-1},x_{i+1},\dotsc,x_{n})\in\{0,1\}^{(n-1)\times(k+1)}$ be those fixed input. Let $P_{x^{-i}}^{(t)}$ be the distribution of the transcript when $x_{i}\sim\mathcal{U}_{k+1}$, and all other processors get (fixed) input according to $x^{-i}$.

For a fixed $x^{-i}$, note that there are only $2^{\ell}$ possible transcripts $p$ from $P_{x^{-i}}^{(t-1)}$, as the transcript is determined after fixing the output of processor $i$ at all $\ell$ rounds. Therefore, let $T(x^{-i},x_{i})$ be the transcript when all processors get inputs according to $x^{-i}$ and $x_{i}$, we can see when $p\sim P_{x^{-i}}^{(t-1)}$, $F_{i}(x,p)=1$ if and only if $T(x^{-i},x)=p$. That is,

[TABLE]

In above $P_{x^{-i}}^{(t-1)}(p)$ is the probability that getting $p$ from distribution $P_{x^{-i}}^{(t-1)}$. Then we have

[TABLE]

The last inequality holds because the support size of $P_{x^{-i}}^{(t-1)}$ is at most $2^{\ell}$.

Hence, we have

[TABLE]

The claim follows from that $\ell\leq k/10$. ∎

6.3 Proof of Lemma 6.1

Here we prove Lemma 6.1.

Proof of Lemma 6.1.

Let $g$ be the following function

[TABLE]

Let $N_{D}:=|D|$, and for $b\in\{0,1\}^{k}$, let $D_{[b]}$ be the support set of $\mathcal{U}_{[b]}$ and $N_{b}:=|D\cap D_{[b]}|$. That is, $N_{D}$ is the size of the support set of $\mathcal{U}_{k+1,D}$, while $N_{b}$ is the size of the support size of $\mathcal{U}_{b,D}$.

We need the following claim, which shows that for most $b$’s $N_{b}$ is close of a half of $N_{D}$. We defer its proof until we prove the lemma.

Claim 5**.**

Let $b\sim\mathcal{U}_{k}$, with probability $1-2^{-k/8}$, we have $|N_{b}/N_{D}-\frac{1}{2}|<2^{-k/8}$.

By Lemma 5.2, we have

[TABLE]

Equivalently,

[TABLE]

In order to make use of the above bound (16), we now relate $g(\mathcal{U}_{[b]})$ and $g(\mathcal{U}_{k+1})$ to $f(\mathcal{U}_{[b],D})$ and $f(\mathcal{U}_{k+1,D})$. From the definition of $g$, we have

[TABLE]

and

[TABLE]

That is, $\operatorname*{\mathbb{E}}_{x\sim\mathcal{U}_{[b],D}}[f(x)]$ and $\operatorname*{\mathbb{E}}_{x\sim\mathcal{U}_{k+1,D}}[f(x)]$ are $\operatorname*{\mathbb{E}}_{x\sim\mathcal{U}_{[b]}}[g(x)]$ and $\operatorname*{\mathbb{E}}_{x\sim\mathcal{U}_{k+1}}[g(x)]$ scaled by a factor of $\frac{2^{k}}{N_{D}/2}$, except for another $\frac{N_{D}}{2N_{b}}$ factor in (17), which is very close to $1$ for most $b$’s by Claim 5.

We first ignore the $\frac{N_{D}}{2N_{b}}$ factor in (17), and define

[TABLE]

and

[TABLE]

Scaling each side of (16) by $\left(\frac{2^{k}}{N_{D}/2}\right)^{2}$, we have

[TABLE]

the last inequality follows from the assumption that $N_{D}=|D|\geq 2^{-k/2}$.

That is, by Markov’s inequality, when $b\sim\mathcal{U}_{k}$, with probability $1-2^{-k/8}$, we have

[TABLE]

which means $|F_{[b]}-F_{k+1}|<2^{-k/8}$.

Now we take care of the additional $\frac{N_{D}}{2N_{b}}$ factor in (17). By Claim 5, when $b\sim\mathcal{U}_{k}$, with probability $1-2^{-k/8}$, we have $\left|N_{b}/N_{D}-\frac{1}{2}\right|<2^{-k/8}$, which means $\left|\frac{N_{D}}{2N_{b}}-1\right|<3\cdot 2^{-k/8}$.

Putting everything together, when $b\sim\mathcal{U}_{k}$, with probability $1-2\cdot 2^{-k/8}$, we have

[TABLE]

The last line follows from that $F_{[b]}=\operatorname*{\mathbb{E}}_{x\sim\mathcal{U}_{[b]}}[g(x)]\cdot\frac{2^{k+1}}{N_{D}}\leq\frac{N_{D}}{2^{k+1}}\cdot\frac{2^{k+1}}{N_{D}}=1$.

Therefore,

[TABLE]

∎

Finally, we prove Claim 5.

Proof of Claim 5.

Let $I$ be the indicator function for set $D$:

[TABLE]

By Lemma 5.2, we have

[TABLE]

Note that from the definitions, $\operatorname*{\mathbb{E}}_{x\sim\mathcal{U}_{[b]}}[I(x)]=N_{b}/2^{k}$ and $\operatorname*{\mathbb{E}}_{x\sim\mathcal{U}_{k+1}}[I(x)]=N_{D}/2^{k+1}$. Plugging these in (18), we have

[TABLE]

Scaling each side by $\left(2^{k}/N_{D}\right)^{2}$, we have

[TABLE]

Equivalently,

[TABLE]

where the last inequality follows from the assumption that $N_{D}=|D|\geq 2^{k/2}$. Finally, by Markov’s inequality, when $b\sim\mathcal{U}_{k}$, with probability $1-2^{-k/8}$, we have $\left|N_{b}/N_{D}-\frac{1}{2}\right|^{2}\leq 2^{-k/2}\cdot 2^{k/8}\leq 2^{-k/4}$, and it follows $\left|N_{b}/N_{D}-\frac{1}{2}\right|<2^{-k/8}$, which completes the proof. ∎

7 The Complete Pseudo-random Generator

In this section we construct the PRG.

*Reminder of Theorem 1.3 *** For all $m=O(n)$ and $k=\Omega(\log n)$, there exists an $(O(k),m,n,\Omega(k))$ BCAST(1) PRG that can be constructed within $O(k)$ rounds. In particular, the PRG works as follows

• •

Each processor gets $k+k\cdot\frac{(m-k)}{n}$ private random bits.

• •

Then in $O\left(\frac{m-k}{n}\cdot k\right)=O(k)$ rounds, all processors broadcast their last $k\cdot\frac{(m-k)}{n}$ random bits. And they use that to construct a random matrix $M\in\{0,1\}^{k\times(m-k)}$.

• •

Each processor’s output is simply the concatenation of its first $k$ random bits $x$ and $x^{T}M$.

The following corollary follows directly from the above theorem.

Corollary 7.1**.**

Let $A$ be a $k$-round randomized BCAST(1) algorithm with poly($n$) time processors, where each processor uses up to $n$ random bits and $k=\Omega(\log n)$. Then there exists an algorithm $A^{\prime}$ solving the same problem within $O(k)$-rounds, where each processor uses at most $k$ random bits.

Note that the correctness of Theorem 1.3 follows directly from Theorem 5.4 (restated below). We spend the remainder of this section proving Theorem 5.4.

Notations.

We first recall some notations. Let $M\in\{0,1\}^{n\times m}$. We use $\mathcal{U}_{M}$ to denote the uniform distribution on the following set $\{(x,x^{T}M):x\in\{0,1\}^{n}\}$, which is a subset of $\{0,1\}^{n+m}$. For integers $n$ and $m$, we use $\mathcal{U}_{n\times m}$ to denote the uniform distribution on $\{0,1\}^{n\times m}$.

Supposing there are $n$ processors in total, we are going to assume they are deterministic. Processor $i$ can be defined by a function $f_{i}:\{0,1\}^{m}\times\{0,1\}^{*}\to\{0,1\}$, such that $f_{i}(z,p)$ is the bit player $i$ outputs when it gets the input $z$ and previous history $p$. We are going to use $f_{i}^{|p}$ to denote the function $f_{i}(\cdot,p)$ for simplicity. If transcript $p$ is incompatible with player $i$ having input $z$, then we set $f_{i}(z,p)$ arbitrarily.

*Reminder of Theorem 5.4 *** Let $n,m,k$ be three integers. Consider the following two cases:

• •

(A) All processors receive random inputs from $\mathcal{U}_{m}$.

• •

(B) Let $M$ be a uniform sample from $\mathcal{U}_{k\times(m-k)}$, then all processors receive inputs from $\mathcal{U}_{M}$.

*For $j\leq k/10$, $m\leq 2^{k/20}$ and any $j$-round BCAST(1) protocol, the statistical distance between the distributions of its transcripts in case (A) and (B) is at most $O\left(\frac{j\cdot n}{2^{k/9}}\right)$. *

To prove Theorem 5.4, we need the following technical lemma, whose proof is deferred to the end of this section.

Lemma 7.2**.**

Assuming $m\leq 2^{k/20}$, given a function $f:\{0,1\}^{m}\to\{0,1\}$ and a set $D\subseteq\{0,1\}^{m}$ with $|D|\geq 2^{m-k/2}$, let $\mathcal{U}_{M,D}$ and $\mathcal{U}_{m,D}$ be the conditional distributions of $\mathcal{U}_{M}$ and $\mathcal{U}_{m}$ on the set $D$.181818When $\mathcal{U}_{M}$ ($\mathcal{U}_{m}$) has no mass on $D$, we set $\mathcal{U}_{M,D}$ ($\mathcal{U}_{m,D}$ to be the uniform distribution on $D$.) We have

[TABLE]

Proof of Theorem 5.4.

Similar to the proof of Theorem 5.1, we will consider a slightly stronger model where we have $j\cdot n$ turns, and on the $t^{th}$ turn, processor $(t-1)\bmod{n}+1$ gets to send a single bit. We use similar notations as in the proof of Theorem 5.1 and Theorem 5.3. Let $\mathcal{P}_{\textsf{rand}}^{(t)}$ be the distribution of the transcripts of the first $t$ rounds when all processors get random input from $\mathcal{U}_{m}$. For a matrix $M\in\{0,1\}^{k\times(m-k)}$, we use $P_{M}^{(t)}$ to denote the distribution of the transcript of the first $t$ rounds when all processors get random input from $\mathcal{U}_{M}$. Recall that $\mathcal{U}_{M}$ is the uniform distribution on the set $\{(x,x^{T}M):x\in\{0,1\}^{k}\}$.

Note that to prove the theorem, it suffices to show that the distribution $\mathcal{P}_{\textsf{rand}}^{(j\cdot n)}$ is close to $\mathcal{P}_{M}^{(j\cdot n)}$ for most choices of $M\sim\mathcal{U}_{k\times(m-k)}$. For this purpose, we are going to prove the following inequality holds for any $t\leq j\cdot n$:

[TABLE]

It is easy to see that plugging in $t=j\cdot n$, (19) implies the theorem. To prove (19) for all $t$, we induct on $t$. Clearly, (7) holds when $t=0$. So it suffices to show that when it holds for $t-1$, it also holds for $t$. Let $i=(t-1)\pmod{n}+1$ be the processor broadcasting at the $t$-th turn.

For an $M\in\{0,1\}^{k\times(m-k)}$, we wish to bound $\|\mathcal{P}_{\textsf{rand}}^{(t)}-\mathcal{P}_{M}^{(t)}\|$. By Lemma 1.9, we have

[TABLE]

In above, $\mathcal{U}_{m,p}$ and $\mathcal{U}_{M,p}$ are distributions $\mathcal{U}_{m}$ and $\mathcal{U}_{M}$ conditioned on the previous transcript $p$. Specifically, let $D^{(t-1)}_{p}$ denote the set of inputs to $f_{i}$ which are consistent with the transcript $p$, then $\mathcal{U}_{m,p}$ and $\mathcal{U}_{M,p}$ are the conditional distributions of $\mathcal{U}_{m}$ and $\mathcal{U}_{M}$ on set $D^{(t-1)}_{p}$.

We wish to use Lemma 7.2 to bound the second term on the right side of (20). To do so, we need to show $D^{(t-1)}_{p}$ is large with high probability for $p\sim\mathcal{P}_{\textsf{rand}}^{(t-1)}$. The following claim can be proved in exactly the same way as Claim 4 in the proof of Theorem 5.3.

Claim 6**.**

For $t\leq j\cdot n\leq\frac{k\cdot n}{10}$, with probability $1-2^{-k/4}$ over $p\sim\mathcal{P}_{\textsf{rand}}^{(t-1)}$, we have $|D^{(t-1)}_{p}|\geq 2^{m-k/4}$.

Now, for each $M\in\{0,1\}^{k\times(m-k)}$, we again define a score $s_{M}$ as follows:

[TABLE]

For $p\in\{0,1\}^{t-1}$, we set $s_{M,p}:=\left\|f_{i}^{|p}(\mathcal{U}_{m,p})-f_{i}^{|p}(\mathcal{U}_{M,p})\right\|$. Then by Lemma 7.2 and Claim 6, when $p\sim\mathcal{P}_{\textsf{rand}}^{(t-1)}$, with probability at least $1-2^{-k/4}$, we have $|D^{(t-1)}_{p}|\geq 2^{m-k/4}$, and therefore

[TABLE]

Therefore, it follows

[TABLE]

Now we have

[TABLE]

The above proves (19) for $t$, which completes the whole proof. ∎

7.1 Proof of Lemma 7.2

Before proving Lemma 7.2, we first prove the following technical lemma, which is a generalization of Lemma 5.2.

Lemma 7.3**.**

Given a function $f:\{0,1\}^{m}\to\{0,1\}$, we have

[TABLE]

Proof.

Let $M\sim\mathcal{U}_{k\times(m-k)}$. Let $v_{1},v_{2},\dotsc,v_{m-k}$ be all the $m-k$ columns of $M$, such that $v_{1}$ is the last column and $v_{m-k}$ is the first. Clearly, $u_{i}$’s are i.i.d. samples from $\mathcal{U}_{k}$.

We are going to prove this lemma via a hybrid argument, for a fixed $M$, let $\mathcal{U}_{M,j}$ be the uniform distribution on the following set

[TABLE]

where $x^{(k)}$ denotes the first $k$ bits of string $x$. That is, for $x\sim\mathcal{U}_{M,j}$, the first $m-j$ bits are completely random, while the last $j$ bits are generated according to $M$. By definition, it is easy to see that $\mathcal{U}_{M,0}=\mathcal{U}_{m}$, and $\mathcal{U}_{M,m-k}=\mathcal{U}_{M}$.

The following claim is the central ingredient of our hybrid argument.

Claim 7**.**

For $0\leq j<m-k$, we have

[TABLE]

Before proving Claim 7, we show it implies our lemma.

First, for $k$ reals $a_{1},a_{2},\dotsc,a_{k}$, we have $\|a\|_{1}\leq\sqrt{k}\cdot\|a\|_{2}$, and consequently

[TABLE]

So we have

[TABLE]

Finally, we prove Claim 7.

Proof of Claim 7.

First, note that $v_{j+2},\dotsc,v_{m-k}$ are not involved in the inequality in the claim. Suppose we fix $v_{1},v_{2},\dotsc,v_{j}$ first. We use ${v^{(j)}}$ to denote this vector sequence.

Now, we define the extension function $E_{{v^{(j)}}}:\{0,1\}^{m-j}\to\{0,1\}^{m}$ as follows

[TABLE]

That is, extending the vector $x$ as if ${v^{(j)}}$ is the last $j$ columns of the matrix $M$.

We also define $g_{v^{(j)}}:\{0,1\}^{m-j}\to\{0,1\}$ by composing $E_{{v^{(j)}}}$ and $f$:

[TABLE]

Let $k^{\prime}=m-j-1$, and $\mathcal{U}_{[v_{j+1}]}$ be the uniform distribution on the set $\{(x,x^{(k)}\cdot v_{j+1}):x\in\{0,1\}^{k^{\prime}}\}$. By a similar proof of Lemma 5.2, we have

[TABLE]

or equivalently,

[TABLE]

Averaging over all $v_{1},v_{2},\dotsc,v_{j}$ from $\mathcal{U}_{k}$, from the definition of $\mathcal{U}_{M,j}$ and $\mathcal{U}_{M,j+1}$, the left side of (22) becomes

[TABLE]

and the right side becomes

[TABLE]

which completes the proof. ∎

∎

Now we move to prove Lemma 7.2.

Proof of Lemma 7.2.

The following proof are quite similar to the proof of Lemma 6.1. Let $g$ be the following function

[TABLE]

Let $N_{D}:=|D|$, and for $M\in\{0,1\}^{k\times(m-k)}$, let $D_{M}$ be the support set of $\mathcal{U}_{[M]}$, and $N_{M}:=|D\cap D_{M}|$. That is, $N_{D}$ is the support size of distribution $\mathcal{U}_{m,D}$, while $N_{M}$ is the support size of $\mathcal{U}_{M,D}$.

We need the following claim, whose proof is deferred until we prove the lemma.

Claim 8**.**

Let $M\sim\mathcal{U}_{k\times(m-k)}$, with probability $1-2^{-k/8}$, we have

[TABLE]

By Lemma 5.2, we have

[TABLE]

Equivalently,

[TABLE]

To make use of the above bound (23), we now relate $g(\mathcal{U}_{M})$ and $g(\mathcal{U}_{m})$ to $f(\mathcal{U}_{M,D})$ and $f(\mathcal{U}_{m,D})$. From the definition of $g$, we have

[TABLE]

and

[TABLE]

That is, $\operatorname*{\mathbb{E}}_{x\sim\mathcal{U}_{M,D}}[f(x)]$ and $\operatorname*{\mathbb{E}}_{x\sim\mathcal{U}_{m,D}}[f(x)]$ are $\operatorname*{\mathbb{E}}_{x\sim\mathcal{U}_{M}}[g(x)]$ and $\operatorname*{\mathbb{E}}_{x\sim\mathcal{U}_{m}}[g(x)]$ scaled by a factor of $\frac{2^{k}}{N_{D}/2^{m-k}}$, except for another $\frac{N_{D}}{2^{m-k}N_{M}}$ factor in (24), which is very close to $1$ for most $M$’s by Claim 8.

We first ignore the $\frac{2^{k}}{N_{D}/2^{m-k}}$ factor in (24), and define

[TABLE]

and

[TABLE]

Scaling each side of (23) by $\left(\frac{2^{k}}{N_{D}/2^{m-k}}\right)^{2}$, we have

[TABLE]

That is, by Markov’s inequality, when $M\sim\mathcal{U}_{k\times(m-k)}$, with probability $1-2^{-k/8}$, we have

[TABLE]

which means $|F_{M}-F_{k+1}|<2^{-k/8}$.

Now, by Claim 8, when $M\sim\mathcal{U}_{k\times(m-k)}$, with probability $1-2^{-k/8}$, we have

[TABLE]

Putting everything together, with probability $1-2\cdot 2^{-k/8}$, we have

[TABLE]

That last line follows from that $F_{M}=\operatorname*{\mathbb{E}}_{x\sim\mathcal{U}_{M}}[g(x)]\cdot\frac{2^{k}}{N_{D}/2^{m-k}}\leq\frac{N_{D}}{2^{m}}\cdot\frac{2^{m}}{N_{D}}=1$.

Therefore, we have

[TABLE]

∎

Finally, we prove Claim 8.

Proof of Claim 8.

Let $I$ be the indicator function for set $D$:

[TABLE]

By Lemma 7.3, we have

[TABLE]

Note that $\operatorname*{\mathbb{E}}_{x\sim\mathcal{U}_{M}}[I(x)]=N_{M}/2^{k}$ and $\operatorname*{\mathbb{E}}_{x\sim\mathcal{U}_{m}}[I(x)]=N_{D}/2^{m}$. Plugging these in (25), we have

[TABLE]

Scaling both sides by $\left(\frac{2^{k}}{N_{D}}\right)^{2}$, we have

[TABLE]

By Markov’s inequality, when $M\sim\mathcal{U}_{k\times(m-k)}$, with probability $1-2^{-k/8}$, we have

[TABLE]

which is equivalent to

[TABLE]

∎

8 A Matching Lower bound

In this section, we prove that our pseudo-random generator is optimal up to constant factors. That is, we prove that the seed length is optimal. We show that any pseudo-random generator with a seed length of size $s$ can be broken within $O(s)$ rounds (note that our pseudo-random generator is secure up to $\Omega(s)$ rounds when the output of the PRG is of length $n$ for each processor).

Theorem 8.1** (Seed Length Lower Bound).**

Let $n,m$, and $k$ be three integers. Suppose that there are $n$ processors in the Broadcast Congested Clique model. Furthermore, suppose there is a pseudo-random generator which when each processor starts with a seed of size $k$, gives each node a pseudo-random string of size $m$. Then there is an $O(k)$ round Broadcast Congested Clique protocol that can break this PRG.

Proof.

Consider the following $k+1$-round protocol: each processor broadcasts its first $k+1$ pseudo-random bits. In the case that these bits are pseudo-random, we know that since $nk$ random bits were used as a seed to construct these strings, the transcript of the first round must be one of $2^{nk}$ options. However, in the truly random case, there are $2^{n(k+1)}$ options. So, consider the algorithm that outputs $1$ if the transcript is one of the $2^{nk}$ options consistent with the pseudo-random generator, and otherwise outputs a [math]. Then if the pseudo-random generator was used, then the probability of outputting a $1$ is $1$. In the truly random case, the probability of outputting a $1$ is $\frac{2^{nk}}{2^{n(k+1)}}=\frac{1}{2^{n}}$. Hence, this algorithm distinguished between the truly random and the pseudo-random case with all but an exponentially small probability. ∎

9 Discussion

Our paper leaves some problems open. A main open problem is whether it is possible to improve the planted clique lower bound to show that if the clique is of size $k=\Theta(n^{1/2-\varepsilon})$, the planted clique problem still requires a number of rounds polynomial in $n$.

It would be interesting to extend the framework to work for undirected graphs as well. This causes the rows of the input matrix not to be independent (instead, each pair of rows contain one shared bit). Our current proofs rely on the rows of the input being independent, but we believe it may be possible to extend the framework to also work when the rows exhibit a small amount of dependence.

There are many problems in the BCAST model that may be interesting to try to prove lower bounds for using the techniques in this paper. These include counting triangles (or $K_{4}$s) in random graphs, constructing an MST on a complete graph with random weights to the edges, finding communities in a graph sampled from the stochastic block model, the “planted Hamiltonian cycle” problem (or, determining whether there is a Hamiltonian cycle in a random graph where the probability of an edge being included is chosen properly so that the probability of such a cycle existing is some constant), graph connectivity, finding the diameter of a random graph (the average degree must be chosen to be low enough so that the diameter is not $2$ with high probability), and APSP on a complete graph with random weight assignments. There are many possibilities.

The uniform distribution is not necessarily the most natural distribution to consider in the broadcast congested clique model. Our techniques are more general and could hopefully be used to prove lower bounds for other distributions as well. It would be interesting to consider other input distributions which may be “natural” for the problem at hand.

Appendix A An Analogue of Newman’s Theorem in BCAST(1)

In this appendix we adapt Newman’s technique from [New91] to show that in the computationally unbounded setting, every randomized $k$ rounds $\textsf{BCAST}(1)$ protocols in which there are $n$ processors, each with $m$ input bits and outputs $k$ bits at the end, can be simulated with only $O(k\cdot n+\log m)$ public random bits (this has not been observed before this work in the context of the broadcast congested clique). We note that Newman’s approach can be adapted to the Unicast Congested Clique model (where each vertex may send different messages to different nodes, instead of broadcasting the same message to all other nodes).

Let $\vec{x}=(x_{1},x_{2},\dotsc,x_{n})\in\left(\{0,1\}^{m}\right)^{n}$ be an input, we use $\mathcal{P}(P,\vec{x})$ to denote the joint distribution of the transcript and the concatenation of all processors’ output bits of the $k$-round $\textsf{BCAST}(1)$ protocol $P$ running on input $\vec{x}$, that is, $\mathcal{P}(P,\vec{x})$ is a distribution on $\{0,1\}^{2kn}$.

We say a protocol $P_{\sf new}$ $\varepsilon$-simulates another protocol $P$, if for all possible input $\vec{x}$, we have $\|\mathcal{P}(P,\vec{x})-\mathcal{P}(P_{\sf new},\vec{x})\|<\varepsilon$.

Theorem A.1**.**

Let $P$ be a randomized $\textsf{BCAST}(1)$ protocol with $n$ processors, each with $m$ input bits and outputs $k$ bits at the end. For all $\varepsilon>0$, there is an equivalent randomized $\textsf{BCAST}(1)$ protocol $P_{\sf new}$ $\varepsilon$-simulating $P$ with only $O(k\cdot n+\log(m)+\log\varepsilon^{-1})$ public random bits.

Proof.

In the following we are just going to mimic the proof of Newman’s theorem.

Without loss of generality we can assume $P$ is a public coin protocol. Suppose it makes use of at most $N$ public coins, where $N$ can be arbitrary large.

Fix an input $x\in\left(\{0,1\}^{m}\right)^{n}$. Note that $\|\mathcal{P}(P,\vec{x})-\mathcal{P}(P_{\sf new},\vec{x})\|<\varepsilon$ is equivalent to that for all function $f:\{0,1\}^{2kn}\to\{0,1\}$,

[TABLE]

We then fix a function $f$. Suppose we draw a public random string $w\sim\mathcal{U}_{N}$, and we use $P_{w}$ to denote protocol $P$ with public random string setting to $w$ and $P_{w}(\vec{x})$ to denote the concatenation of its transcript and all processor’ output bits on input $\vec{x}$.

Now, suppose we pick $T$ $w_{1},w_{2},\dotsc,w_{T}$ uniform random samples from $\mathcal{U}_{N}$, by a simple Chernoff bound, we have

[TABLE]

Setting

[TABLE]

it follows

[TABLE]

Since there are at most $2^{2^{2kn}}$ functions and $2^{nm}$ input bits, by a simple union bound, we have with probability at least $0.9$ over our $T$ samples, $\left|\frac{1}{T}\cdot\sum_{i=1}^{T}f(P_{w_{i}}(\vec{x}))-\operatorname*{\mathbb{E}}_{p\sim\mathcal{P}(P_{\sf new},\vec{x})}[f(p)]\right|<\varepsilon$ for all input $\vec{x}$ and function $f:\{0,1\}^{2kn}\to\{0,1\}$.

So we can just pick $T$ samples $w_{1},w_{2},\dotsc,w_{T}$ satisfying the above condition, and define $P_{\sf new}$ as the protocol that makes use of $\log T=O(kn+\log m+\log\varepsilon^{-1})$ coins to select a random index $i\in[T]$, and act according to $P_{w_{i}}$. It $\varepsilon$-simulates $P$ by the above discussions. ∎

Remark A.2**.**

We remark that in the worst case, at least $\Omega(k\cdot n)$ bits are required to $\varepsilon$-simulate a $k$-round BCAST(1) protocol $P$ where each processor outputs $k$ bits. Since if all processors output $k$ uniform random bits, the total entropy of $\mathcal{P}(P,\vec{x})$ on any input $\vec{x}$ is at least $k\cdot n$.

Appendix B Algorithm for Planted Clique in $\textsf{BCAST}(1)$

In this section we give an algorithm for finding planted clique in $\textsf{BCAST}(1)$.

Theorem B.1**.**

Let $n$ be an integer and $\omega(\log^{2}n)\leq k\leq n$. Given an input from $\mathcal{A}_{k}$, there is an $O(n/k\cdot\operatorname{polylog}(n))$ round $\textsf{BCAST}(1)$ protocol such that at the end of the protocol, with probability at least $1-1/n^{2}$, all processors know the hidden clique $C$.

Proof.

Let $p=\frac{1}{k}\cdot\log^{2}n$.

Algorithm.

The algorithm is very simple.

• •

At the first round of the protocol, each processor decides to stay active with probability $p$, and broadcasts whether it is active to everyone else.

• •

Let $N_{\sf active}$ be the number of active processors, if $N_{\sf active}>2\cdot n\cdot p$, all processors just terminate.

• •

Each active processors broadcast whether it has an edge to each other active processor, which takes $O(n\cdot p)=O(n/k\cdot\operatorname{polylog}(n))$ rounds (i.e., all information about the subrgraph induced by the active processors is broadcasted).

• •

Now everyone knows the induced subgraph $G_{\sf active}$ consisting of all active processors. Let the largest clique in $G_{\sf active}$ be $C_{\sf active}$. If $|C_{\sf active}|<\frac{1}{2}\cdot\log^{2}n$, all processors terminate.

• •

Every processor (including the non-active ones) checks whether it is connected to at least a $9/10$ fractions of vertices in $C_{\sf active}$, and if it is, it broadcasts with a message saying it is in the clique $C$. (if it is already in $C_{\sf active}$, then it also says that.)

Analysis.

Intuitively, the algorithm works because a random graph doesn’t contain a clique of size $10\log n$ with high probability. And in the hidden clique case, if we pick each vertex with probability $p$, then in expectation we would pick $p\cdot k=\log^{2}n$ vertices in $C$, and therefore $|C_{\sf active}|\geq\frac{1}{2}\cdot\log^{2}n$ with high probability, while in a random graph the largest clique is of size $\Theta(\log n)$ with high probability.

Let $X_{i}$ be the random variable indicating whether processor $i$ is active. And let $Y_{i}$ be the random variable indicating whether processor $i$ is both in the clique and active.

Note that $X_{i}$’s are i.i.d., by the multiplicative Chernoff bound, we have

[TABLE]

Setting $\delta=1$, we have with high probability, $N_{\sf active}\leq 2\cdot p\cdot n$.

Note that although $Y_{i}$’s are not independent, they are negatively associated, and we have the following by another multiplicative Chernoff bound,

[TABLE]

Set $\delta=0.5$. With high probability, there are more than $\frac{1}{2}\cdot p\cdot k=\frac{1}{2}\cdot\log^{2}n$ active vertices in $C$.

Finally, since with high probability, a random graph doesn’t contain a clique of size larger than $10\log n$. We can conclude that with high probability, at least $\frac{1}{2}\log^{2}n-10\log n$ vertices in $C_{\sf active}$ are actually in $C$. And it is easy to see that the last step of the algorithm identifies the clique $C$ correctly with high probability. ∎