Generative Models of Huge Objects

TL;DR

This paper systematically studies explicit distributions that are indistinguishable from a single large combinatorial object, extending previous work on uniform indistinguishability and exploring applications in learning, graph theory, and fairness.

Contribution

It introduces a framework for generative models of huge objects indistinguishable from a single object, with algorithms for dense and sparse structures under global constraints.

Findings

Developed a learning algorithm for indistinguishable objects in various settings.

Extended the weak regularity lemma to sparse graphs with global properties.

Generalized pseudorandom objects and notions in algorithmic fairness.

Abstract

This work initiates the systematic study of explicit distributions that are indistinguishable from a single exponential-size combinatorial object. In this we extend the work of Goldreich, Goldwasser and Nussboim (SICOMP 2010) that focused on the implementation of huge objects that are indistinguishable from the uniform distribution, satisfying some global properties (which they coined truthfulness). Indistinguishability from a single object is motivated by the study of generative models in learning theory and regularity lemmas in graph theory. Problems that are well understood in the setting of pseudorandomness present significant challenges and at times are impossible when considering generative models of huge objects. We demonstrate the versatility of this study by providing a learning algorithm for huge indistinguishable objects in several natural settings including: dense functions and graphs with a truthfulness requirement on the number of ones in the function or edges in the graphs, and a version of the weak regularity lemma for sparse graphs that satisfy some global properties. These and other results generalize basic pseudorandom objects as well as notions introduced in algorithmic fairness. The results rely on notions and techniques from a variety of areas including learning theory, complexity theory, cryptography, and game theory.

Tables

Table 1. Table 1: Comparison between problem settings

	What do we imitate?	What do we construct?
Pseudorandomness	distribution of objects	distribution of objects
Explicit construction (e.g. expander graphs)	distribution of objects	single object
Our setup: generative models	single object	distribution of objects

Equations

$$|\mathrm{Pr}[D^{B^{\ast }}=\text{“accept”}]-E_{B\sim M}[\mathrm{Pr}[D^B=\text{“accept”}]]|\le \epsilon .$$

$${\mathrm{Pr}}_{B\sim M}[B\in \mathcal{B}]=1.$$

$$|E_{B^{\prime }\sim M^{\prime }}\mathrm{Pr}[D^{B^{\prime }}=\text{“accept”}]-E_{B\sim M}\mathrm{Pr}[D^B=\text{“accept”}]|\le \epsilon \text{for every }D\in \mathcal{D}.$$

$$\mathsf{cap}(v)=\{\begin{array}{ll}v,& \text{if }0\le v\le 1;\\ 1,& \text{if }v>1;\\ 0,& \text{if }v<0.\end{array}$$

$$\mathsf{Lcap}(v_1)$$

$$\mathsf{Lcap}(v_1,\dots ,v_t)$$

$$g_D(x)=\mathrm{Pr}[D(x,1)=\text{“accept”}]-\mathrm{Pr}[D(x,0)=\text{“accept”}]\text{for every }x\in X.$$

$$\mathrm{Pr}[D(x,y_1)=\text{“accept”}]-\mathrm{Pr}[D(x,y_2)=\text{“accept”}]=y_1{g}_D(x)-y_2{g}_D(x).$$

$$|E[f^{\ast }(x)g(x)]-E[p(x)g(x)]|\ge \epsilon ,$$

$$E[f^{\ast }(x)\hat{g}(x)]-E[p(x)\hat{g}(x)]\ge \gamma .$$

$$|E[f^{\ast }(x)g(x)]-E[p(x)g(x)]|\le \epsilon \text{for every }g\in \mathcal{G}.$$

$$|E_x[\mathrm{Pr}[D(x,f^{\ast }(x))=\text{“accept”}]]-E_{f,x}[\mathrm{Pr}[D(x,f(x))=\text{“accept”}]]|$$

$$=$$

$$|E_x[f^{\ast }(x)g(x)]-E_x[p(x)g(x)]|\le \epsilon /4\text{for every }g\in \mathcal{G}\cup \{g_1\}.$$

$$\left|k-\sum _{x\in X}p(x)\right|=|X|\cdot |E[f^{\ast }(x)g_1(x)]-E[p(x)g_1(x)]|\le \epsilon |X|/4.$$

$${\mathrm{Pr}}_{B\sim M}[|\mathsf{supp}(f_B)|=k]$$

$$\sum _{x\in X}|E_{B\sim M}{f}_B(x)-p(x)|$$

$$|E_x[p(x)g(x)]-E_{B\sim M}{E}_x[f_B(x)g(x)]|$$

$$\le E_x|E_{B\sim M}{f}_B(x)-p(x)|$$

$$\le \epsilon /2,$$

$$|E_x[f^{\ast }(x)g(x)]-E_{B\sim M}{E}_x[f_B(x)g(x)]|\le \epsilon .$$

$$⟨w,f⟩\ge ⟨w,p⟩.$$

$$⟨w,p⟩$$

$$=\sum _{i\in [N]}\sum _{j=i}^N(w(j)-w(j+1))p(i)$$

$$=\sum _{j\in [N]}\sum _{i\in [j]}(w(j)-w(j+1)p(i)$$

$$=\sum _{j\in [N]}(w(j)-w(j+1))\sum _{i\in [j]}p(i)$$

$$⟨w,f⟩=\sum _{j\in [N]}(w(j)-w(j+1))\sum _{i\in [j]}f(i).$$

$$⟨w,p⟩=\sum _{j\in [N]}(w(j)-w(j+1))\sum _{i\in [j]}p(i)\le \sum _{j\in [N]}(w(j)-w(j+1))\sum _{i\in [j]}f(i)=⟨w,f⟩.\text{qed}$$

$$(r\diamond r^{\prime })(x)=\{\begin{array}{ll}r(x),& \text{if }x\le N;\\ r^{\prime }(x-N),& \text{if }x>N.\end{array}$$

$$\hat{w}(x)$$

$$w^{(2)}(x)$$

$$⟨w^{(1)}-w,r⟩\le {\mathsf{D}}_{\mathsf{KL}}(w\Vert w^{(1)})-{\mathsf{D}}_{\mathsf{KL}}(w\Vert w^{(2)})+\frac{1}{2}\Vert r{\Vert }_{\infty }^2.$$

$$⟨w^{(i,+)}-w^{(i,-)},f^{(i)}⟩\ge ⟨w^{(i,+)}-w^{(i,-)},p⟩.$$

$${\hat{w}}^{(i+1)}(x)$$

Full text

We demonstrate the versatility of this study by providing a learning algorithm for huge indistinguishable objects in several natural settings including: dense functions and graphs with a truthfulness requirement on the number of ones in the function or edges in the graphs, and a version of the weak regularity lemma for sparse graphs that satisfy some global properties. These and other results generalize basic pseudorandom objects as well as notions introduced in algorithmic fairness. The results rely on notions and techniques from a variety of areas including learning theory, complexity theory, cryptography, and game theory.

1. 1 Introduction

2. 1.1 Overall Goal: Indistinguishable Generative Models of Huge Objects

3. 1.2 Our Results

4. 1.3 Related Work

5. 2 Preliminaries

6. 3 Learning Functions with Exponentially Large Domains

7. 3.1 Learning Sample-Access Binary Functions

8. 3.2 Truthful Learning That Preserves Support Size

9. 3.2.1 Step 1: Exact Model with $2^{O(N)}$ Time Implementation

10. 3.2.2 Step 2: Indistinguishable Model with $\mathrm{poly}(N)$ Time Implementation

11. 3.2.3 Step 3: Indistinguishable Model with $\mathrm{polylog}(N)$ Time Implementation

12. 3.3 Learning Support-Access Binary Functions

13. 3.3.1 Auditor for Support-Access Objects

14. 3.4 Learning Bit-String Functions

15. 4 Learning Exponential-Size Graphs

16. 4.1 Learning Dense Graphs

17. 4.2 Learning Sparse Graphs Without Dense Subgraphs

18. 4.3 Learning Sparse Uniform Out-degree Graphs

19. 4.4 Learning Uniform Degree Graphs

20. 5 Impossibilities

1 Introduction

A pseudorandom distribution is indistinguishable from the uniform distribution to a set of computationally bounded distinguishers. Pseudorandomness is a cornerstone of many areas of computer science and mathematics. The variability of pseudorandom distributions stems from the different objects they can generate (bit strings, functions, permutations and more) and the different computational bounds that can be imposed on the distinguishers. In the area of cryptography, it is typical to consider powerful distinguishers that are at least polynomial time, giving rise to central notions such as pseudorandom generators [BM84, Yao82], pseudorandom functions [GGM86] and pseudorandom permutations [LR88]. More limited distinguishers give rise to other fundamental notions such as $k$-wise independent hashing and $\varepsilon$-biased distributions (cf. [WC81, NN93]). In the area of explicit combinatorial constructions, we typically try to emulate the uniform distribution by a single object, rather than with a distribution. A primer example is the fundamental notion of expander graphs (see [HLW06, Vad12] for surveys), with its multiple variants (including various notions of randomness extractors). These are graphs that are indistinguishable from a uniformly selected graph to a limited set of distinguishers (such as distinguishers that check if a random edge crosses a given cut).

In these classic areas of pseudorandomness, a distribution, or even a single object, is constructed to emulate a distribution (typically, the uniform distribution). In this paper we ask for a distribution to emulate a single object (Table 1). This reversal may seem absurd from the perspective of pseudorandomness but makes perfect sense from the perspective of generative models. An early exposure of the TOC community to generative models was with respect to the World Wide Web. These were models that produce distributions of graphs that imitate some properties of the Web, such as power law on the degrees of nodes (see [Mit03] for a survey). At any given point, the web is a single graph, but it is also a very large graph that does not have a simple description. Generative models gave a useful way to analyze, or estimate through experimentation, the expected performance of protocols on the Web.

Other well studied generative models are the stochastic block model [HLL83] and the more elaborate mixed membership stochastic block model [ABFX08]. Consider a graph representing some connections between individuals, such as the connectivity of the social network. The stochastic block model partitions the vertices into disjoint communities and for every two communities assigns a probability of connection. This model represents a distribution over graphs where for each two vertices, an edge is placed independently with the probability assigned to the pair of communities of its end points. (In the mixed-membership model, each vertex is assigned a distribution over communities.) These models help identify useful substructures within a social structure such as sub-communities or different social roles. But given a single social network, $B^{*}$, what is an appropriate model to capture it? After all, a model describes a distribution over networks rather than the single network we are trying to explain. A prevalent approach is to aim at the maximum likelihood model. Out of all models, the probability of sampling $B^{*}$ is maximized under the maximum likelihood model. Heuristics for estimating the maximum likelihood model have been playing a major roles in the generative-model literature and in its application in practice. It should be noted that the probability that the model would produce $B^{*}$ is often very small. In this light, the meaningfulness of a maximum-likelihood models may be debated and may depend on a particular setting.

From the perspective of indistinguishability, it may be more natural to seek a model that produce a distribution that is indistinguishable from $B^{*}$ to a meaningful set of distinguishers. For example, in the case of the stochastic block model, natural distinguishers are defined by two sets of vertices $U$ and $V$ and ask what is the probability that a random edge in the graph crosses from $U$ to $V$. A stochastic block model that fool all such distinguishers is exactly what is given by the Frieze-Kannan regularity lemma (also known as the weak regularity lemma) [FK99]. The indistinguishability perspective on generative models and known connections between learning and pseudrandomness, which we will discuss shortly, are both a motivation as well as the starting point of this work.

1.1 Overall Goal: Indistinguishable Generative Models of Huge Objects

In many of the applications of generative models, such as modeling the Web or a social network, the objects being modeled are huge. In this paper, we aim at a systematic theory of efficiently learning and implementing huge generative models. Our models will generate a distribution of objects satisfying some global properties that are indistinguishable from a fixed combinatorial object. Such a theory presents non-trivial challenges that do not manifest themselves neither when generating huge pseudorandom objects, nor in generative models of polynomial-size objects.

Concretely, we assume that we have access to an object $B^{*}$ with exponential size. For example, $B^{*}$ could be a function with an exponentially large domain, or a graph with exponentially many vertices and edges. We are most interested in the case where the object $B^{*}$ is too large to read or process as a whole, and we have to access it by sampling: for example, when $B^{*}$ represents a function $f:X\to\{0,1\}$ with $|X|$ being exponentially large, we may access $B^{*}$ by asking for random pairs $(x,f(x))\in X\times\{0,1\}$ (sample access) or random inputs $x\in X$ conditioned on $f(x)=1$ (support access). Given access to the huge object $B^{*}$, our goal is to create a generative model $M$ for $B^{*}$. Here, our model $M$ represents a distribution over objects, and we want to ensure that this distribution is indistinguishable from $B^{*}$ to all distinguishers $D$ in a class $\mathcal{D}$. Specifically, if we use $D^{B}\in\{\textup{``accept''},\textup{``reject''}\}$ to denote the output of distinguisher $D$ given sample/support access to object $B$, our indistinguishability requirement is that for every $D\in\mathcal{D}$,

[TABLE]

We aim for building an efficient learner $L$ that can output a model $M$ satisfying the indistinguishability requirement above when given sample/support access to the true object $B^{*}$. When $B^{*}$ is exponentially large (which is the case we are interested in), the output model $M$ also needs to generate exponentially large objects, and thus we cannot expect an efficient learner to directly output $M$. Instead, we want our learner to output an efficient implementation of $M$, which, roughly speaking, is a randomized algorithm that can efficiently provide sample/support access to objects drawn from $M$ (Definitions 2.9 and 2.10).

Our goal of learning a generative model $M$ indistinguishable from the true object $B^{*}$ is analogous to the problem addressed by Goldreich, Goldwasser and Nussboim [GGN10] in the area of pseudorandomness. They study the problem of efficiently implementing a distribution of huge objects, satisfying some global properties, that are indistinguishable from the uniform distribution of such objects. Follow-up works of [GGN10] such as [NNT05, NN07] study efficient implementations that are indistinguishable from certain distributions of huge random graphs. All these works aim to achieve indistinguishability from a known distribution of objects, whereas in our problem of learning a generative model, we assume that the true object $B^{*}$ is initially unknown, and to collect information about $B^{*}$, we additionally need a learner $L$ that can use sample/support access to $B^{*}$ to efficiently construct an implementation of an indistinguishable model.

Beyond indistinguishability, we also aim to achieve the notion of truthfulness introduced in [GGN10]. To demonstrate this notion, consider pseudorandom permutations $f_{s}:\{0,1\}^{n}\mapsto\{0,1\}^{n}$ [LR88]. A distribution of permutations is pseudorandom if it is indistinguishable from the uniform distribution of permutations. It should be noted that a pseudorandom $\{0,1\}^{n}\mapsto\{0,1\}^{n}$ function [GGM86] is also indistinguishable from a random permutation over $\{0,1\}^{n}$ (as long as the number of queries are sufficiently smaller than $2^{n/2}$). Nevertheless, insisting that the pseudorandom objects satisfy the global condition of being a permutation is critical in the applications of pseudorandom permutations. This motivates the distinction of [GGN10] between indistinguishability (that the pseudorandom objects are indistinguishable from a uniform object to a class of distinguishers) and truthfulness which is a global property that needs to hold exactly or approximately in a statistical sense. In our setup, a generative model $M$ is truthful if every object $B$ drawn from the distribution represented by $M$ satisfies a certain global property. For example, when the true object $B^{*}$ is a function $f^{*}:X\to\{0,1\}$ with support size $|\{x\in X:f^{*}(x)=1\}|$ being $k$, a truthful requirement on a generative model $M$ for $B^{*}$ may restrict $M$ to always generate functions with support size $k$.

The study of implementing huge pseudorandom objects [NR02, GGN10, NNT05, NN07] has pseudorandom functions and permutations as vital building blocks. Besides these building blocks, our techniques for learning generative models of huge objects also come from connections to the regularity lemma and especially the work of Trevisan, Tulsiani and Vadhan [TTV09]. In [TTV09], they construct an efficiently-implementable function $f:X\mapsto[0,1]$ which is indistinguishable from some $f^{*}:X\mapsto[0,1]$ to a family of distinguishers represented by functions $g:X\mapsto[0,1]$. Indistinguishability here means that $|\operatorname{\mathbb{E}}[f(x)g(x)]-\operatorname{\mathbb{E}}[f^{*}(x)g(x)]|$ is smaller than some error parameter $\varepsilon$. After [TTV09], the problem of creating indistinguishable functions and its applications to cryptography are further studied in [VZ13, JP14, Skó16a, Skó16b, Skó17, CCL18]. These works assume that the true function $f^{*}$ is known and they do not explicitly deal with the problem of learning $f^{*}$, but the corresponding learning task has been studied in the algorithmic fairness literature through the notions of multi-accuracy, multi-calibration, and outcome indistinguishability [HJKRR18, KGZ19, DKR*+*21, GKSZ22, DLLT23]. When applying techniques from these works to solve some problems in our setting, we need to deal with additional challenges such as the truthfulness requirement that we want our generative model to satisfy.

1.2 Our Results

The main conceptual contribution of this paper is in suggesting a new frontier for the study of indistinguishability, which is highly motivated and technically challenging. As we introduce in Section 1.1, the notion of indistinguishability from a single huge object combines at its core the areas of learning theory and pseudorandomness which, as recent research uncovered, have deep connections, providing a way to describe and address a rich landscape of natural problems. Below we summarize the main problems we address in this new framework.

Truthful Learning That Preserves Support Size

Suppose we have sample access to a function $f^{*}:\{0,1\}^{n}\to\{0,1\}$ and we want to build an indistinguishable generative model for $f^{*}$. Here sample access allows us to observe pairs $(x,f^{*}(x))$ with $x$ drawn uniformly at random from $\{0,1\}^{n}$, and accordingly, we assume that every distinguisher also decides to accept or reject based on such a random pair $(x,f(x))$ from a function $f$ that may or may not be the true $f^{*}$. This task of learning a generative model for a binary function is closely related to the task of no-access outcome indistinguishability studied in [DKR*+*21], and it has been observed that the task can be reduced to multi-accuracy. Indeed, assuming that the distinguishers have bounded complexity and can be learned efficiently, using previous algorithms in [HJKRR18, KGZ19, DKR*+*21], we can design an efficient learner that constructs a generative model indistinguishable from $f^{*}$ (Theorem 3.2). The model constructed this way is specified using a predictor $p:\{0,1\}^{n}\to[0,1]$, and the model represents the distribution of functions $f:\{0,1\}^{n}\to\{0,1\}$ where the function value $f(x)$ is distributed independently for every $x\in\{0,1\}^{n}$ according to the Bernoulli distribution ${\mathsf{Ber}}(p(x))$ with mean $p(x)$.

Learning generative models for binary functions becomes a more challenging task when we additionally enforce truthfulness requirements. A natural choice of truthfulness requirement is to preserve the support size of the function. Assuming that we know the support size $|\{x\in\{0,1\}^{n}:f^{*}(x)=1\}|$ of $f^{*}$ is $k$, we would like our model to only generate functions that also have support size $k$. We show how to build an efficient learner that can output such a truthful model which is also indistinguishable from the true function $f^{*}$:

Theorem 1.1** (Informal statement of Theorem 3.4).**

Let $\mathcal{B}$ be the class of sample-access objects induced by binary functions $f:\{0,1\}^{n}\to\{0,1\}$ satisfying $|{\mathsf{supp}}(f)|=k$, where ${\mathsf{supp}}(f):=\{x\in\{0,1\}^{n}:f(x)=1\}$. Let $\mathcal{D}$ be a class of distinguishers that is efficiently learnable. There exists an efficient $(\varepsilon,\delta)$-learner $L$ for $\mathcal{B}$ w.r.t. $\mathcal{D}$ and the learner always outputs an efficient implementation of a model $M$ that is truthful w.r.t. $\mathcal{B}$.

Note that the truthfulness requirement on the support size cannot be enforced simply using computationally-bounded distinguishers, because computing the support size of a function $f$ exactly requires reading the values $f(x)$ for all the exponentially many inputs $x\in\{0,1\}^{n}$. Also, this truthfulness requirement cannot be satisfied directly by a generative model specified by a predictor $p$, where the function value $f(x)$ is distributed according to ${\mathsf{Ber}}(p(x))$ independently of the function values $f(x^{\prime})$ of other individuals $x^{\prime}\neq x$. To enforce a fixed support size, the function values of different individuals must coordinate in a global manner, requiring us to use new techniques. We create a binary tree with leaves corresponding to the function domain $\{0,1\}^{n}$, and following ideas in previous work such as [GGN10], we assign support size budgets from the root to the leaves. However, the true function $f^{*}$ is a single unknown object and is very different from the uniform distribution considered in [GGN10], so there are no closed-from distributions (such as the binomial distributions used in [GGN10]) that can guide us to distribute the support size budget from a node two its two children. Instead, we need to estimate how the budget should be divided, and this leads to accumulated error towards the leaves and forces us to stop before reaching the leaves. To efficiently propagate the budgets to the leaves, we solve a zero-sum game where player $C$ chooses the budgets for the leaves and player $D$ distinguishes them from the target. We show that if player $D$ uses the multiplicative weights algorithm to minimize regret, we can create an indistinguishable and truthful model from the empirical distribution over the optimal responses from player $C$.

Learning a Function with Support Access

In the classic setting when learning a function $f:\{0,1\}\rightarrow\{0,1\}$, the learner receives random samples of form $(x,f(x))$ for a uniform $x\in\{0,1\}$. In this work, we also consider a function object in which we receive a random positive entry. That is, the learner receives random $x$’s such that $f(x)=1$. This type of random access is natural is certain situations, for example when we have information on the individuals that graduated some program, but not on those that did not.

Theorem 1.2** (Informal statement of Theorem 3.15).**

Let $\alpha>0$, and let $f:\{0,1\}\rightarrow\left\{0,1\right\}$ be a function such that $\Pr[f(x)=1]=\alpha$. Let $\mathcal{D}$ be a collection of distinguishers, each $D\in\mathcal{D}$ associated with a set $S_{D}\subseteq[N]$ and accepts $x$ if $x\in S_{D}$. If there exists a weak agnostic learner for $\mathcal{D}$, then there exists a learning algorithm $L$ running in time $\mathrm{poly}(n)$, that receives random elements from the set $\left\{x|f(x)=1\right\}$ and outputs a model $M$ that is indistinguishable from $f$ to all $D\in\mathcal{D}$.

The theorem holds when there is a weak agnostic learner for the collection of distinguishers $\mathcal{D}$ under the distribution of a random support element (i.e. random $x$ s.t. $f(x)=1$). We show in Section 3.3.1 that if a collection of distinguishers $\mathcal{D}$ has a weak agnostic learner over the standard sample access distribution, and the learner is a statistical query algorithm, then there is a learner for $\mathcal{D}$ also under the distribution of random support element.

The proof of the theorem is similar to the classic boosting argument, with an additional step that the learner preforms of keeping the support size of the model approximately the same as support size of $f$. This step is necessary because under the distribution of a random support element, the boosting algorithm is only promised to work when the support sizes of $f$ and the model are approximately equal.

Learning an object under the distribution of random support element is potentially very useful in the case of sparse objects. For a sparse function $f$, if we choose a uniform $x\in\{0,1\}$, then $f(x)=0$ with high probability, and a learner cannot hope to learn anything non-trivial with random samples of form $(x,f(x))$. Unfortunately, the above theorem does not hold for sparse functions, but in the next part we show how this theorem can be used to learn different sparse objects - sparse graphs.

Learning Sparse Graphs Without Dense Subgraphs

Suppose $G=([N],E)$ is a graph represented by the $N^{2}$ length string of its adjacency matrix. In this representation, receiving a random edge from $G$ is equivalent to receiving a random support element from the function representing its adjacency matrix. Therefore, Theorem 1.2 implies that we can learn a model for $G$ that is indistinguishable for a set of distinguishers $\mathcal{D}$ that have a weak agnostic learner. The theorem only holds for functions $f$ with a constant fraction of $1$ entries, which corresponds to a dense graph. What about sparse graphs?

Learning a sparse graph, or a sparse object in general, is a very challenging task because of the huge domain. The weak regularity lemma [FK99] has error that is proportional to $N^{2}$, which is too much in the case of sparse graphs (an empty graph is indistinguishable from a sparse graph with this error). Therefore in the setting of a sparse graphs it is more natural to require an $\varepsilon$ error from the distinguisher under the distribution of receiving a random edge. Under this distribution, the error of the distinguishers scales with the number of edges. We show a learner for a specific class of sparse graphs, those that have no dense subgraphs. We note that a random sparse graph has no dense subgraphs, so many graphs have this property.

Theorem 1.3** (Informal statement of Theorem 4.3).**

Let $G=([N],E)$ be a sparse graph with no dense subgraphs. Let $\mathcal{D}$ be a collection of distinguishers, each $D\in\mathcal{D}$ associated with two sets $U_{D},V_{D}\subseteq[N]$ and accepts an edge $(u,v)$ if $u\in U_{D},v\in V_{D}$. If there exists a weak agnostic learner for $\mathcal{D}$, then there exists a learning algorithm $L$ running in time $\mathrm{polylog}(N)$, that receives random edges from $G$ and outputs a model $M$ that is indistinguishable from $f$ to all $D\in\mathcal{D}$.

The model that the learner outputs is dense, i.e. the model outputs graphs with $\Theta(N^{2})$ many edges. This is done because of technical reasons - to allow us to use rejection sampling when training the model. This brings us to the question, is there a dense graph that is indistinguishable from our sparse graph $G$? The answer to this question depends on $G$, and in 4.5 we show that if a sparse graph $G$ has a very dense subgraph, then there is no dense graph that is indistinguishable from $G$.

The proof of the theorem has two parts, in the first part we show that for every sparse graph $G$ with no dense subgraphs, there exists a dense graph $H$ that is indistinguishable from $G$. In this part of the proof we apply the strong regularity lemma for sparse graphs [KR03, Sco11] on $G$, and use the resulting partition to build the dense indistinguishable graph $H$. This part of the proof is existential, and we do know how to find $H$ efficiently, as the strong regularity lemma does not have an efficient algorithm for finding the partition. It is not possible to use the weak regularity lemma or its variants [FK99], because its error is too large. In the second part of the proof, we reduce the learning $G$ to learning $H$, and show that the resulted model $M$ is indistinguishable from $G$ to all distinguishers $D\in\mathcal{D}$.

Other Results on Learning Generative Models

In this work we also show indistinguishable models in several other settings

• •

Let $f:\left\{0,1\right\}^{n}\rightarrow\left\{0,1\right\}^{n}$ be a function. Learning such function is harder than learning a binary function because the large domain makes $f$ a sparse object (when viewed as a graph for example it is an out-degree one graph). For such functions, we show that there exists a learner that given samples from the distribution $(x,f(x))$, outputs a model that is indistinguishable against the following set of distinguishers $\mathcal{D}=\left\{(S_{D},j_{D})|S_{D}\subset\left\{0,1\right\}^{n},j_{D}\in[n]\right\}$ such that $D=1\iff x\in S_{D},f(x)_{j}=1$. This appears on Section 3.4.

• •

In Section 4.1 we apply the theorems for functions on the adjacency matrix of a dense graph $G=([N],E)$. For a set of distinguishers $\mathcal{D}$ that have a weak agnostic leaner, we have an efficient learner that outputs an indistinguishable model when $G$ is:

A dense graph when the learner receives random adjacency matrix entries. 2. 2.

A dense graph with a fixed total number of edges $m=\Theta(N^{2})$. 3. 3.

A directed graph with a fixed out-degree $m=\Theta(N)$. 4. 4.

A dense graph when the learner receives random edges.

• •

For a directed graph $G=(\{0,1\}^{n},E)$ with constant out-degree $d$, we can treat each of the $d$ outgoing degrees as a function $f_{i}:\left\{0,1\right\}^{n}\rightarrow\left\{0,1\right\}^{n}$. For the same set of distinguishers that we can handle in the case of a length-preserving functions (the first item in this list), we provide an efficient learner. See Section 4.3.

• •

In the case of a uniform degree undirected graph, we provide in Section 4.4 a learning algorithm for an indistinghuishable model, albeit for a somewhat limited set of distinguishers.

Impossibility Results

As we discussed earlier, our goal of learning a generative model is closely related to the goal in [GGN10] of implementing huge random objects, but a key difference is that we assume the groundtruth is a single unknown object $B^{*}$, whereas [GGN10] considers a known uniform distribution of objects. This means that we need an additional learning procedure to collect information about $B^{*}$, and we show in Section 5 that our task of efficiently learning a generative model is only possible when the distinguisher class is efficiently learnable.

Besides the requirement of learning, our setting is more challenging than the setting in [GGN10] in many other ways. We demonstrate this by another two impossibility results on fooling entry-access distinguishers and fooling stronger distinguishers than the model. When we consider a pseudorandom function, $f_{s}$, the function is indistinguishable from the uniform distribution to distinguishers that have entry access to the function (allowed to ask for an arbitrary string $x$ and get $f_{s}(x)$). Furthermore, while $f_{s}$ is computable in a fixed polynomial time, the distinguishers can run in any polynomial time (and under reasonable assumptions, even exponential time). [GGN10] and subsequent work inherit these two properties - indistinguishability to distinguishers that are computationally more complex than the models and have entry access to the model. In Section 5 we argue that neither of these properties is achievable in our setting.

For the impossibility of fooling distinguishers with entry access, in Theorem 5.1 we give the example of a class $\mathcal{D}$ that contains a distinguisher $D_{x}$ for every input $x\in\{0,1\}^{n}$ which queries the function value $f(x)$ for a function $f$ and outputs “accept” if and only if $f(x)=1$. We argue that every model $M$ that is indistinguishable from the true $f^{*}$ for the set of distinguishers $\mathcal{D}$ has to be very close to $f^{*}$. Since the size of $f^{*}$ is exponential and $f^{*}$ is unknown, no efficient learner can output a model that is close to $f^{*}$. We also show an example, using an idea from [TTV09], of a distinguisher and a true function $f^{*}$, such that the distinguisher can tell apart $f^{*}$ from any model $M$ with a low complexity compared to the distinguisher (Theorem 5.2). This highlights the fact that in our setting, the generative model and the learner constructing the model have to be computationally comparable or stronger than the distinguishers.

1.3 Related Work

As mentioned in Section 1.1, [GGN10] introduced the problem of creating an indistinguishable implementation of a random object. [GGN10] as well as follow-up works [NNT05, NN07] also present a collection of positive results for dense and sparse graphs or functions with a variety of truthfulness conditions and access models of the distinguishers.

The connection between generative models and indistinguishability has been manifested through the invention of generative adversarial networks (GANs) [GPAM*+*14, AGL*+*17]. Intuitively, a GAN is trained to imitate a distribution of objects (say images). The generator is trained in concert with a discriminator that could be interpreted as a distinguisher. Through a sequence of rounds, the generator is trained to fool the discriminator which is then trained to fail the generator. GANs highlight the connection between generative models and indistinguishability [Imp17], but they do not naturally fall into our framework as they are more directly described in terms of indistinguishability of two distributions.

The connection between indistinguishability and learning theory has been established in many previous works (e.g. [TTV09] applies the boosting technique from learning theory). More recently, in the context of algorithmic fairness, the relation between learning theory and indistinguishability has been dramatically expanded in the notions of multicalibration and outcome indistinguishability [HJKRR18, DKR*+*21], in applications to learning and statistical inference through the notions of omnipredictors and universal adapatability [GKR*+*22, KKG*+*22, HLNRY22, GHK*+*23, KP23] and in the emergence of research uncovering intricate and exciting connections while studying the sample complexity of indistinguishability from a learning-theoretic perspective [HPR22, HP23].

It is possible to view our learning setting as a $2$-players zero-sum game, between the learner and the distinguishers, in which the learner’s goal is to output a model for an indistinguishable object and the distinguishers try to tell apart the input and the model. In this setting, there is a relation between min-max theorems and regularity-lemma theorems. Such theorems prove that it is possible to express a complex object $f$ by a function of a few simpler objects $g_{1},\ldots g_{t}$ that, in our setting, represent the distinguishers [TTV09, VZ13]. There have been works improving the parameters and also using such theorems for applications in cryptography [VZ13, JP14, Skó16a, Skó16b, Skó17, CCL18]. In this work, our setting is slightly different, as we assume that the object $f$ is complex and unknown, and the learner has to learn it. The proof of Theorem 1.3 has an intermediate step that is existential and has a similar structure to a weak regularity lemma theorems, but since the required error there is too small, we derive it from the sparse strong regularity lemma.

2 Preliminaries

Throughout the paper, we are interested in learning objects such as functions and graphs, and we are particularly interested when these objects have exponential sizes (e.g. functions with exponentially large domains and graphs with exponentially many vertices and edges). We typically use $B$ to denote an object, and use $\mathcal{B}$ to denote a class of objects. We view an object $B$ as a function $B:Q\to\Delta_{A}$ that maps a query $q\in Q$ to a distribution $B(q)$ over answers in $A$.

Functions.

When the object is a function $f:X\rightarrow Y$, we consider three access types. For sample access, $B$ returns a random pair $(x,f(x))$. For support access, it returns a random $x$ such that $f(x)=1$. For entry access, upon querying $x$, $B$ returns $f(x)$.

Definition 2.1** (Function-induced sample-access object).**

Let $f:X\to Y$ be a function and let $B:Q\to\Delta_{A}$ be an object. We say $B$ is the sample-access object induced by $f$ if $Q=\{\bot\},A=X\times Y$, and $B(\bot)$ is the distribution of $(x,f(x))\in A$ where $x$ is drawn uniformly from $X$.

Definition 2.2** (Function-induced support-access object).**

Let $f:X\to\{0,1\}$ be a binary function. We define the support of $f$ to be ${\mathsf{supp}}(f):=\{x\in X:f(x)=1\}$. Let $B:Q\to\Delta_{A}$ be an object. Assuming ${\mathsf{supp}}(f)\neq\emptyset$, we say $B$ is the support-access object induced by $f$ if $Q=\{\bot\},A=X$, and $B(\bot)$ is the uniform distribution over ${\mathsf{supp}}(f)\subseteq X$.

Definition 2.3** (Function-induced entry-access object).**

Let $f:X\to Y$ be a function and let $B:Q\to\Delta_{A}$ be an object. We say $B$ is the entry-access object induced by $f$ if $Q=X,A=Y$, and for every $q\in Q$, $B(q)$ is the singleton distribution such that $a\sim B(q)$ equals to $f(q)$ deterministically.

In this paper, we show positive results for learning generative models of functions with sample access and support access (Section 3) whereas we show impossibility results for entry access (Section 5). This separation is mainly because entry access makes the distinguishers stronger and thus makes indistinguishability harder to achieve (see Definitions 2.6 and 2.7 below).

Graphs.

For a graph $G=(V,E)$ where we assume $V$ has exponential size, we define two access types, sample-access which corresponds to a random adjacency matrix entry, and support-access which corresponds to a random edge in the graph.

Definition 2.4** (Graph-induced sample-access object).**

Let $G=(V,E)$ be a directed or undirected graph and let $B:Q\to\Delta_{A}$ be an object. We say $B$ is the sample-access object induced by $G$ if $Q=\{\bot\},A=V\times V\times\{0,1\}$, and $B(\bot)$ is the distribution of $(u,v,y)\in A$ where $(u,v)$ is drawn uniformly from $V\times V$, $y=1$ if $(u,v)\in E$ and $y=0$ otherwise.

Definition 2.5** (Graph-induced support-access object).**

Let $G=(V,E)$ be a directed or undirected graph and let $B:Q\to\Delta_{A}$ be an object. Assuming $E\neq\emptyset$, we say $B$ is the support-access object induced by $G$ if $Q=\{\bot\},A=V\times V$, and $B(\bot)$ is the uniform distribution over $E\subseteq V\times V$.

Indistinguishability.

Each learner we design in this paper has access to a ground-truth object $B^{*}$, and it aims to output an object $B$ that is indistinguishable from $B^{*}$. In many cases, the learner does not just output a single object $B$, but a distribution over objects, and we refer to such distributions as models. Below we formally define the notion of indistinguishability.

Definition 2.6** (Distinguisher).**

A distinguisher $D$ is an algorithm that when given access to an object $B:Q\to\Delta_{A}$, outputs “accept” or “reject”. That is, the distinguisher is allowed to make queries $q\in Q$ to the model, and for each query $q$ the distinguisher receives an answer $a\in A$ drawn independently from $B(q)\in\Delta_{A}$. We allow the distinguisher $D$ itself to be randomized, and we use random variable $D^{B}$ to denote the output of the distinguisher $D$ in $\{\textup{``accept''},\textup{``reject''}\}$ when given access to $B$.

Definition 2.7** (Indistinguishability).**

Let $B^{*}:Q\to\Delta_{A}$ be an object, and let model $M$ be a distribution over objects $B:Q\to\Delta_{A}$. We say model $M$ is $\varepsilon$-indistinguishable from object $B^{*}$ w.r.t. a distinguisher $D$ if

[TABLE]

We say model $M$ is $\varepsilon$-indistinguishable from object $B^{*}$ w.r.t. a class $\mathcal{D}$ of distinguishers if (1) holds for every $D\in\mathcal{D}$.

Truthfulness.

In addition to indistinguishability, another desirable property of a model is truthfulness introduced in [GGN10]. Truthfulness requires every object generated from the model to satisfy a certain (usually global) property which we formalize using an object class $\mathcal{B}$:

Definition 2.8** (Truthfulness).**

We say a model $M$ is truthful w.r.t. an object class $\mathcal{B}$ if

[TABLE]

Implementations.

Our goal is to design efficient learners, and thus we cannot expect the learner to output a model $M$ explicitly, especially when the objects drawn from $M$ are huge. Instead, our learner outputs an efficient implementation of a model, defined as follows.

Definition 2.9** (Ordinary Implementation).**

For $\ell\in{\mathbb{Z}}_{\geq 0}$, let $T$ be a randomized algorithm that takes $(r,q)\in\{0,1\}^{\ell}\times Q$ as input, and outputs $T(r,q)\in A$. We say $T$ is an ordinary implementation of a model $M$ with seed length $\ell$ if for every seed $r\in\{0,1\}^{\ell}$ there exists an object $B_{r}:Q\to\Delta_{A}$ such that

for every $q\in Q$, $T(r,q)$ is distributed according to $B_{r}(q)$, where the randomness in $T(r,q)$ comes from the internal randomness in algorithm $T$; 2. 2.

$B_{r}$* is distributed according to $M$ when $r$ is drawn uniformly from $\{0,1\}^{\ell}$.*

While our goal is to output an ordinary implementation with a polynomial-length seed, following the approach in [GGN10], it is more convenient to first build implementations using a random oracle and then transform the implementation to an ordinary one using Lemma 2.1.

Definition 2.10** (Random-Oracle Implementation).**

Let $T$ be a randomized algorithm that takes a function $r:\{0,1\}^{*}\to\{0,1\}$ as an oracle. On an input $q\in Q$, the algorithm $T$ outputs $T^{r}(q)\in A$. We say $T$ is a random-oracle implementation of a model $M$ if for every $r:\{0,1\}^{*}\to\{0,1\}$ there exists an object $B_{r}:Q\to\Delta_{A}$ such that

for every $q\in Q$, $T^{r}(q)$ is distributed according to $B_{r}(q)$, where the randomness in $T^{r}(q)$ comes from the internal randomness in algorithm $T$; 2. 2.

$B_{r}$* is distributed according to $M$ when $r$ is a uniformly random function from $\{0,1\}^{*}$ to $\{0,1\}$.*

Lemma 2.1** (Theorem 2.9 in [GGN10]).**

Suppose that one-way functions exist. There exists an algorithm $H$ with the following properties. Let $\mathcal{D}$ be a class of distinguishers where each $D\in\mathcal{D}$ is a circuit of size at most $W$ for some $W\geq 1$. Let $T$ be a random-oracle implementation of a model $M$ with circuit complexity at most $W$. Given $W,T$ and an arbitrary $\varepsilon\in(0,1)$ as input, the algorithm $H$ runs in time $\mathrm{poly}(W,1/\varepsilon)$ and outputs an ordinary implementation $T^{\prime}$ of a model $M^{\prime}$ where $T^{\prime}$ has seed length and circuit complexity both being $\mathrm{poly}(W,1/\varepsilon)$, and

[TABLE]

Moreover, if $M$ is truthful w.r.t. an object class $\mathcal{B}$, then $M^{\prime}$ is also truthful w.r.t. $\mathcal{B}$.

Lemma 2.1 can be proved by using a pseudorandom function to emulate the random oracle.

Learning.

We describe the learners we aim to design in the definition below.

Definition 2.11** (Learner).**

Let $\mathcal{B}$ be a class of objects $B:Q\to\Delta_{A}$ and $\mathcal{D}$ be a class of distinguishers. An $(\varepsilon,\delta)$-learner L for the class $\mathcal{B}$ w.r.t. $\mathcal{D}$ is an algorithm with the following properties. For any $B^{*}\in\mathcal{B}$, given access to $B^{*}$, the learner outputs an implementation $T$ of a model $M$ such that with probability at least $1-\delta$, $M$ is $\varepsilon$-indistinguishable from $B^{*}$ w.r.t. $\mathcal{D}$.

Other Notations.

For $v\in{\mathbb{R}}$, we define ${\mathsf{cap}}(v)$ by capping its value into $[0,1]$, i.e.,

[TABLE]

Given a list of values $(v_{1},\ldots,v_{t})$ we define ${\mathsf{Lcap}}(v_{1},\ldots,v_{t})$ by summing over the list and capping the value to $[0,1]$ in every iteration. We formally define it recursively:

[TABLE]

3 Learning Functions with Exponentially Large Domains

The goal of this section is to efficiently learn a generative model that is indistinguishable from a target function $f^{*}:X\to Y$ to a class $\mathcal{D}$ of distinguishers. We allow the domain $X$ of the function to have exponential size $N:=|X|$, and require our learner to run in time $\mathrm{polylog}(N)$. This means that the learner cannot read the entire function $f^{*}$, and can only access it via random sample. Throughout the paper, our learners output an efficient random-oracle implementation $T$ of a model $M$, which can be turned in to an efficient ordinary implementation by Lemma 2.1.

3.1 Learning Sample-Access Binary Functions

We start by studying the case where the target object $B^{*}$ is the sample-access object induced by a binary function $f^{*}:X\to\{0,1\}$ (Definition 2.1). We assume that every distinguisher $D\in\mathcal{D}$ satisfies the following: when given access to a sample-access object $B$ induced by a function $f:X\to\{0,1\}$, the distinguisher asks a single query $\bot$, receives an answer $a=(x,y)\sim B(\bot)$, and outputs $D(x,y)\in\{\textup{``accept''},\textup{``reject''}\}$. We allow the distinguisher itself to be randomized, and each distinguisher $D$ defines a function $g_{D}:X\to[-1,1]$ such that

[TABLE]

We use the following claim to relate a distinguisher $D\in\mathcal{D}$ to the function $g_{D}:X\to[-1,1]$:

Claim 3.1**.**

For every distinguisher $D\in\mathcal{D}$, the following equation holds for every $x\in X$ and $y_{1},y_{2}\in\{0,1\}$:

[TABLE]

The claim can be easily proved by considering the four possible choices of $(y_{1},y_{2})\in\{0,1\}\times\{0,1\}$.

As we show later in Section 5, it is necessary to impose certain learnability assumptions on the distinguishers. To that end, we assume that there is an auditor for the function class $\mathcal{G}:=\{g_{D}:D\in\mathcal{D}\}$, defined as follows:

Definition 3.1** (Auditor).**

Let $\mathcal{D}$ and $\mathcal{G}$ be defined as above. We say an algorithm $\Lambda$ is an $(\varepsilon,\gamma,\delta)$-auditor for $\mathcal{G}$ if it satisfies the following property. Given access to a sample-access object $B^{*}$ induced by a function $f^{*}:X\to\{0,1\}$ and taking a predictor $p:X\to[0,1]$ as an oracle, if there exists $g\in\mathcal{G}$ such that

[TABLE]

then $\Lambda$ outputs $\hat{g}:X\to[-1,1]$ satisfying the following with probability at least $1-\delta$:

[TABLE]

The auditor defined above can be viewed as a weak agnostic learner for the class $\mathcal{G}$. When the domain $X$ is $\{0,1\}^{n}$ with size $N=2^{n}$, many classes allow efficient auditors that run in time $\mathrm{poly}(n)=\mathrm{polylog}(N)$. Using an auditor for $\mathcal{G}$, we prove the following theorem:

Theorem 3.2**.**

Let the distinguisher class $\mathcal{D}$ and the function class $\mathcal{G}$ be defined above. Let $\varepsilon,\gamma,\delta,\delta^{\prime}\in(0,1/2)$ be parameters satisfying $\gamma\leq\varepsilon$ and $\delta^{\prime}\leq c\delta\gamma^{2}$ for a sufficiently small absolute constant $c>0$. Let $\mathcal{B}$ be the class of sample-access objects induced by binary functions $f:X\to\{0,1\}$. Let $\Lambda$ be an $(\varepsilon,\gamma,\delta^{\prime})$-auditor for $\mathcal{G}$ (Definition 3.1). Then there exists an $(\varepsilon,\delta)$-learner $L$ for $\mathcal{B}$ w.r.t. $\mathcal{D}$. Moreover, if the auditor $\Lambda$ runs in time at most $W_{1}$ and always outputs a function with circuit size at most $W_{2}$, then the learner $L$ runs in time $\mathrm{poly}(\gamma^{-1},\log(\delta^{-1}),W_{1})$ and always outputs implementations with circuit complexity $\tilde{O}(\gamma^{-2}W_{2})$.

We apply the following result in the algorithmic fairness literature to prove Theorem 3.2:

Lemma 3.3** (Learning a multiaccurate predictor [TTV09, HJKRR18, KGZ19]).**

Let the distinguisher class $\mathcal{D}$ and the functions class $\mathcal{G}$ be defined as above. Let $\varepsilon,\gamma,\delta,\delta^{\prime}\in(0,1/2)$ be parameters satisfying $\gamma\leq\varepsilon$ and $\delta^{\prime}\leq c\delta\gamma^{2}$ for a sufficiently small absolute constant $c>0$. Let $\Lambda$ be an $(\varepsilon,\gamma,\delta^{\prime})$-auditor for $\mathcal{G}$. Given access to a sample-access object $B^{*}$ induced by a function $f^{*}:X\to\{0,1\}$, there is a learner $L$ that outputs a predictor $p:X\to[0,1]$ such that with probability at least $1-\delta$,

[TABLE]

Moreover, if the auditor $\Lambda$ runs in time at most $W_{1}$ and always outputs a function with circuit size at most $W_{2}$, then the learner $L$ runs in time $\mathrm{poly}(\gamma^{-1},\log(\delta^{-1}),W_{1})$ and always outputs implementations with circuit complexity $\tilde{O}(\gamma^{-2}W_{2})$.

Proof of Theorem 3.2.

Let $B^{*}$ be the sample-access object induced by a binary function $f^{*}:X\to\{0,1\}$. It suffices to turn the predictor $p$ from Lemma 3.3 into an efficient random-oracle implementation $T$ of a model $M$ that is $\varepsilon$-indistinguishable from $B^{*}$ w.r.t. $\mathcal{D}$. Let us consider a random function $f:X\to\{0,1\}$ such that for every $x\in X$, the function value $f(x)$ is drawn independently from ${\mathsf{Ber}}(p(x))$. By 3.1, for every distinguisher $D\in\mathcal{D}$, we have

[TABLE]

Therefore, if we choose the model $M$ to be the distribution over the sample-access object $B_{f}$ induced by the random function $f$, then (3) and (4) imply that $M$ is $\varepsilon$-indistinguishable from $B^{*}$ w.r.t. $\mathcal{D}$. To implement $M$ efficiently using a random oracle $r:\{0,1\}^{*}\to\{0,1\}$, for each $x\in X$, we designate a set $S_{x}\subseteq\{0,1\}^{*}$ so that $S_{x}\cap S_{x^{\prime}}=\emptyset$ for $x\neq x^{\prime}$. We first generate a random $x\in X$ uniformly from $X$, and then draw $y\sim{\mathsf{Ber}}(p(x))$ using the randomness from $S_{x}$. We return the answer $(x,y)$. This is an implementation for $M$ for the following reasons. For every fixed $r$, there exists a function $f:X\to\{0,1\}$ such that the answer $(x,y)$ always satisfies $y=f(x)$ and the distribution of $x$ is uniform in $X$. Moreover, when $r$ is random, the conditional distribution of $y$ given $x$ is ${\mathsf{Ber}}(p(x))$. ∎

3.2 Truthful Learning That Preserves Support Size

Some desirable properties of a generative model are global and cannot be enforced using computationally bounded distinguishers alone. This motivated [GGN10] to introduce the notion of truthfulness that ensures such global properties beyond indistinguishability. Here we focus on a natural global property of a binary function $f:X\to\{0,1\}$: the size of its support ${\mathsf{supp}}(f):=\{x\in X:f(x)=1\}$. The model $M$ we create in Section 3.1 using the multiaccurate predictor $p$ from Lemma 3.3 may generate functions $f$ with support size different from the target function $f^{*}$. Indeed, even if $\sum_{x\in X}p(x)=|{\mathsf{supp}}(f^{*})|$, a random function $f$ with each entry $f(x)$ independently drawn from ${\mathsf{Ber}}(p(x))$ is not guaranteed to satisfy $|{\mathsf{supp}}(f)|=|{\mathsf{supp}}(f^{*})|$. Now we show an efficient learner that outputs truthful models that preserve the support size of the generated functions.

Theorem 3.4**.**

Let the distinguisher class $\mathcal{D}$ and the function class $\mathcal{G}$ be defined as in Section 3.1. Let $\varepsilon,\gamma,\delta,\delta^{\prime}\in(0,1/2)$ be parameters satisfying $\gamma\leq\varepsilon$ and $\delta^{\prime}\leq c\delta\gamma^{2}$ for a sufficiently small absolute constant $c>0$. Let $\mathcal{B}$ be the class of sample-access objects induced by binary functions $f:X\to\{0,1\}$ satisfying $|{\mathsf{supp}}(f)|=k$, where $X=\{0,1\}^{n}$. Let $\Lambda$ be an $(\varepsilon,\gamma,\delta^{\prime})$-auditor for $\mathcal{G}$ (Definition 3.1). Then there exists an $(\varepsilon,\delta)$-learner $L$ for $\mathcal{B}$ w.r.t. $\mathcal{D}$ and the learner always outputs a random-oracle implementation of a model $M$ that is truthful w.r.t. $\mathcal{B}$. Moreover, if the auditor $\Lambda$ runs in time at most $W_{1}$ and always outputs a function with circuit size at most $W_{2}$, then the learner $L$ runs in time $\mathrm{poly}(n,\gamma^{-1},\log(\delta^{-1}),W_{1})$ and always outputs an implementation with circuit complexity $\mathrm{poly}(n,\gamma^{-1},W_{2})$.

We prove Theorem 3.4 using Lemma 3.3 and the following lemma:

Lemma 3.5** (Fixed-weight implementation from a predictor).**

Define $X=\{0,1\}^{n}$ for a positive integer $n$. Let $k$ be an integer satisfying $0\leq k\leq|X|$ and let $\varepsilon\in(0,1)$ be a parameter. There exists a $\mathrm{poly}(n,\varepsilon^{-1})$-time implementation $T$ such that $T$ takes an arbitrary predictor $p:X\to[0,1]$ as an oracle and $T$ implements a model $M$ such that each object $B\sim M$ is the sample-access object induced by a binary function $f_{B}:X\to\{0,1\}$. Moreover, for every predictor $p:X\to[0,1]$, the resulting model $M$ satisfies

$\Pr_{B\sim M}[\sum_{x\in X}f_{B}(x)=k]=1$; 2. 2.

$\sum_{x\in X}|\operatorname{\mathbb{E}}_{B\sim M}f_{B}(x)-p(x)|\leq|k-\sum_{x\in X}p(x)|+\varepsilon|X|$.

We first prove Theorem 3.4 using Lemma 3.5 and then prove Lemma 3.5.

Proof of Theorem 3.4.

We start with the observation that using $\Lambda$, we can build an auditor $\Lambda^{\prime}$ for $\mathcal{G}\cup\{g_{1}\}$, where $g_{1}$ is the constant $1$ function: $g_{1}(x)=1$ for every $x\in X$. This is because we can accurately estimate $\operatorname{\mathbb{E}}[f^{*}(x)g_{1}(x)]-\operatorname{\mathbb{E}}[p(x)g_{1}(x)]$ using random examples $(x,f^{*}(x),p(x))$ for $x$ drawn uniformly from $X$.

Let $B^{*}$ be the sample-access object induced by a function $f^{*}:X\to\{0,1\}$ satisfying ${\mathsf{supp}}(f^{*})=k$. By Lemma 3.3, we can learn a predictor $p:X\to\{0,1\}$ such that

[TABLE]

In particular, choosing $g=g_{1}$, we have

[TABLE]

We apply Lemma 3.5 on $p$ to obtain an implementation $T$ of a model $M$ such that each object $B\sim M$ is the sample-access object induced by a binary function $f_{B}:X\to\{0,1\}$. Lemma 3.5 allows us to ensure that

[TABLE]

It remains to prove that $M$ is $\varepsilon$-indistinguishable from $B^{*}$ w.r.t. $\mathcal{D}$ and that $M$ is truthful w.r.t. $\mathcal{B}$. The truthfulness follows immediately from (6). We prove indistinguishability below. For every $g\in\mathcal{G}$, we have

[TABLE]

where the last inequality follows from (7). Combining (5) and (8), for every $g\in\mathcal{G}$,

[TABLE]

By 3.1, this implies that $M$ is $\varepsilon$-indistinguishable from $B^{*}$ w.r.t. $\mathcal{D}$. ∎

In the following sub-sections, we prove Lemma 3.5 starting with an inefficient implementation and building to more and more efficient ones, where we use $N=2^{n}$ to denote the domain size $|X|$. For convenience, we sometimes take $[N]:=\{1,\ldots,N\}$ to be our domain in place of $X=\{0,1\}^{n}$, in which case we allow $N$ to be not necessarily a power of $2$.

3.2.1 Step 1: Exact Model with $2^{O(N)}$ Time Implementation

We prove the following lemma which can be viewed as a version of Lemma 3.5 with $\alpha=\varepsilon=0$ and without efficiency requirement for the model:

Lemma 3.6**.**

Let $p:[N]\to[0,1]$ be a predictor satisfying $\sum_{x\in[N]}p(x)=k$ for some integer $k$. There exists a distribution $\mu$ over binary functions $f:[N]\to\{0,1\}$ such that

$\Pr_{f\sim\mu}[\sum_{x\in[N]}f(x)=k]=1$, and 2. 2.

for every $x\in[N]$, $\operatorname{\mathbb{E}}_{f\sim\mu}[f(x)]=p(x)$.

For two functions $p,p^{\prime}:[N]\to{\mathbb{R}}$, we define their inner product to be $\langle p,p^{\prime}\rangle:=\sum_{x\in[N]}p(x)p^{\prime}(x)$. Our proof of Lemma 3.6 is based on the following claim:

Claim 3.7**.**

Let $N,k$ be integers satisfying $N>0$ and $0\leq k\leq N$. Let $p:[N]\to[0,1]$ be a function satisfying $\sum_{x\in[N]}p(x)=k$. For any function $w:[N]\to{\mathbb{R}}$ with function values sorted as $w(\sigma(1))\geq\cdots\geq w(\sigma(N))$ for a bijection $\sigma:[N]\to[N]$, let $f:[N]\to\{0,1\}$ be the function satisfying $f(\sigma(1))=\cdots=f(\sigma(k))=1$ and $f(\sigma(k+1))=\cdots=f(\sigma(N))=0$. Then

[TABLE]

Proof.

By rearranging the coordinates, it is w.l.o.g. to assume that $\sigma(i)=i$ for every $i\in[N]$. Defining $w(N+1)=0$, we have

[TABLE]

and similarly

[TABLE]

It is clear that $\sum_{i\in[j]}p(i)\leq\min\{j,k\}=\sum_{i\in[j]}f(i)$ for every $j=1,\ldots,N$, and additionally $\sum_{i\in[N]}p(i)=k=\sum_{i\in[N]}f(i)$. Therefore,

[TABLE]

Proof of Lemma 3.6.

Let $F$ denote the set of functions $f:[N]\to\{0,1\}$ satisfying $|{\mathsf{supp}}(f)|=k$. We first show that $p$ belongs to the convex hull of $F$. Assuming that this is not the case, by the hyperplane separation theorem, there exists $w:[N]\to{\mathbb{R}}$ and $b\in{\mathbb{R}}$ such that $\langle w,p\rangle-b>0$ and $\langle w,f\rangle-b<0$ for every $f\in F$. By 3.7, there exists $f\in F$ such that $\langle w,f\rangle\geq\langle w,p\rangle$, and thus $\langle w,f\rangle-b\geq\langle w,p\rangle-b>0$, a contradiction.

We have proved that $p$ is in the convex hull of $F$. This means that there exists a probability distribution $\mu$ over $F$ such that $\operatorname{\mathbb{E}}_{f\sim\mu}[f(x)]=p(x)$ for every $x\in[N]$, as desired. ∎

Clearly, the distribution $\mu$ can be explicitly computed using a linear program in time $2^{O(N)}$ where the variables are the probability mass on each $f:[N]\to\{0,1\}$.

3.2.2 Step 2: Indistinguishable Model with $\mathrm{poly}(N)$ Time Implementation

We prove the following variant of Lemma 3.6 where we allow a small $\varepsilon$ error but require a $\mathrm{poly}(N)$ time algorithm to sample from the distribution $\mu$.

Lemma 3.8**.**

Let $N>1$ be a positive integer, and let $p:[N]\to[0,1]$ be a predictor satisfying $\sum_{x\in[N]}p(x)=k$ for some integer $k$. For any $\varepsilon\in(0,1/2)$, there exists a distribution $\mu$ over binary functions $f:[N]\to\{0,1\}$ such that

$\Pr_{f\sim\mu}[\sum_{x\in[N]}f(x)=k]=1$, and 2. 2.

for every $x\in[N]$, $|\operatorname{\mathbb{E}}_{f\sim\mu}[f(x)]-p(x)|\leq\varepsilon$.

Moreover, $\mu$ can be taken as the uniform distribution over $f^{(1)},\ldots,f^{(T)}$ for $T=O(\varepsilon^{-2}\log N)$, and the list $f^{(1)},\ldots,f^{(T)}$ can be computed in time $\tilde{O}(\varepsilon^{-2}N)$ given $p$ as input.

We prove Lemma 3.8 using the multiplicative weights algorithm. We need the following notations. We define $\Delta_{N}$ to be the set of all functions $w:[N]\to{\mathbb{R}}_{\geq 0}$ satisfying $\sum_{x\in[N]}w(x)=1$. For two functions $w,w^{\prime}\in\Delta_{N}$, assuming $w^{\prime}(x)>0$ for every $x\in[N]$, we define ${\mathsf{D_{KL}}}(w\|w^{\prime})=\sum_{x\in[N]}w(x)\ln(w(x)/w^{\prime}(x))$ with the convention that $0\ln 0=0$. For a function $r:[N]\to{\mathbb{R}}$, we define $\|r\|_{\infty}:=\max_{x\in[N]}|r(x)|$. For functions $r,r^{\prime}:[N]\to{\mathbb{R}}$, we define $r\diamond r^{\prime}:[2N]\to{\mathbb{R}}$ to be the function such that

[TABLE]

The definition of $r\diamond r^{\prime}$ allows us to state the following basic fact that will be useful:

Claim 3.9**.**

For any function $r:[N]\to{\mathbb{R}}$, there exists $w\in\Delta_{2N}$ such that $\langle w,r\diamond(-r)\rangle=-\|r\|_{\infty}$.

The claim above allows us to express $-\|r\|_{\infty}$ as an inner product. Note that it is crucial to extend $r$ to $r\diamond(-r)$. The claim would not hold if we instead consider inner products of the form $\langle w,r\rangle$ for $w\in\Delta_{N}$ because of the restriction that $w(x)\geq 0$ for every $w\in\Delta_{N}$ and $x\in[N]$.

The following is a standard lemma for analyzing the multiplicative weights algorithm:

Lemma 3.10** (Multiplicative Weights).**

Let $w^{(1)}\in\Delta_{N}$ and $r:[N]\to{\mathbb{R}}$ be two functions. Assume $w^{(1)}(x)>0$ for every $x\in[N]$. Define $\hat{w}:[N]\to{\mathbb{R}}$ and $w^{(2)}\in\Delta_{N}$ such that for every $x\in[N]$,

[TABLE]

Then for every $w\in\Delta_{N}$

[TABLE]

Proof of Lemma 3.8.

We initialize $w^{(1)}\in\Delta_{2N}$ such that $w^{(1)}(x)=1/(2N)$ for every $x\in[2N]$. In the $i$-th iteration, we perform the following computation. We break $w^{(i)}$ into two functions $w^{(i,+)},w^{(i,-)}:[N]\to[0,1]$ such that $w^{(i)}=w^{(i,+)}\diamond w^{(i,-)}$. Using 3.7, we can efficiently compute $f^{(i)}\in\{0,1\}^{N}$ such that $|{\mathsf{supp}}(f^{(i)})|=k$ and

[TABLE]

Define $r^{(i)}:[2N]\to{\mathbb{R}}$ such that $r^{(i)}=(f^{(i)}-p)\diamond(p-f^{(i)})$. We compute $w^{(i+1)}$ using the multiplicative weights algorithm with step size $\alpha$:

[TABLE]

By Lemma 3.10, for every $w\in\Delta_{2N}$,

[TABLE]

Summing up over $i=1,\ldots,T$ and noting that ${\mathsf{D_{KL}}}(w\|w^{(1)})\leq\ln(2N)$, ${\mathsf{D_{KL}}}(w\|w^{(T+1)})\geq 0$ and $\|r^{(i)}\|_{\infty}\leq 1$, we have

[TABLE]

which implies

[TABLE]

By the definition of $w^{(i,+)},w^{(i,-)}$ and $r^{(i)}$,

[TABLE]

where the last inequality follows from (9). Plugging this into (10), for every $w\in\Delta_{2N}$,

[TABLE]

By our definition $r^{(i)}=(f^{(i)}-p)\diamond(p-f^{(i)})$ and 3.9, there exists $w\in\Delta_{2N}$ such that $\langle w,\sum_{i\in[T]}r^{(i)}\rangle=-\|\sum_{i\in[T]}(f^{(i)}-p)\|_{\infty}$, so (11) implies

[TABLE]

Setting $T=\lceil\frac{4\ln(2N)}{\varepsilon^{2}}\rceil$ and $\alpha=\sqrt{(\ln(2N))/T}$, we get $\|\frac{1}{T}\sum_{i=1}^{T}f^{(i)}-p\|_{\infty}\leq 2\sqrt{(\ln(2N))/T}\leq\varepsilon$. The proof is completed by noting that the multiplicative weights algorithm allows us to compute $f^{(1)},\ldots,f^{(T)}$ in time $\tilde{O}(NT)=\tilde{O}(\varepsilon^{-2}N)$. ∎

The running time in Lemma 3.8 can be further improved in the case where $N\gg 1/\varepsilon$:

Lemma 3.11**.**

Let $N>1$ be a positive integer, and let $p:[N]\to[0,1]$ be a predictor satisfying $\sum_{x\in[N]}p(x)=k$ for some integer $k$. For any $\varepsilon\in(0,1/2)$, there exists a distribution $\mu$ over binary functions $f:[N]\to\{0,1\}$ such that

$\Pr_{M\sim\mu}[\sum_{x\in[N]}f(x)=k]=1$, and 2. 2.

for every $x\in[N]$, $|\operatorname{\mathbb{E}}_{f\sim\mu}[f(x)]-p(x)|\leq\varepsilon$.

Moreover, given $p$ as input, we can sample from the distribution $\mu$ in time $\tilde{O}(\varepsilon^{-2}r+N)$ where $r=\min\{1/\varepsilon,N\}$.

Proof.

We can assume w.l.o.g. that $N\geq 1/\varepsilon$ because of Lemma 3.8. We partition $[0,1]$ into $u=\lceil 2/\varepsilon\rceil$ sub-intervals $\Gamma_{1},\ldots,\Gamma_{u}$ with the width of each interval being at most $\varepsilon/2$. These sub-intervals partition $X:=[N]$ into $X_{1},\ldots,X_{u}$ where $X_{i}:=\{x\in X:p(x)\in\Gamma_{i}\}$. Define $s(i):=\sum_{x\in X_{i}}p(x)$ and define $t(i):=s(i)-\lfloor s(i)\rfloor$ for every $i\in[u]$. We have $t(i)\in[0,1]$ and $\sum_{i}t(i)$ is an integer $k^{\prime}=k-\sum_{i}\lfloor s(i)\rfloor$. Define $I_{0}:=\{i\in[u]:t(i)=0\}$. By Lemma 3.8, we can find a distribution over $\hat{t}:[u]\setminus I_{0}\to\{0,1\}$ such that $|\operatorname{\mathbb{E}}[\hat{t}(i)]-t(i)|\leq\varepsilon/2$ for every $i\in[u]\setminus I_{0}$ and $\sum_{i\in[u]\setminus I_{0}}\hat{t}(i)=k^{\prime}$. Moreover, a random $\hat{t}$ can be sampled in time $\tilde{O}(\varepsilon^{-2}r)$ given $t$. We define $\hat{t}(i)=0$ for every $i\in I_{0}$. For every $i\in[u]$, we define $\hat{s}(i):=\lfloor s(i)\rfloor+\hat{t}(i)$. It is clear that $\hat{s}(i)\leq\lceil s(i)\rceil\leq|X_{i}|$ and

[TABLE]

Given $\hat{t}$, we compute $\hat{s}$ and for each $i\in[u]$, we randomly pick $\hat{s}(i)$ individuals $x$ in $X_{i}$ and assign $f(x)=1$, and we assign $f(x)=0$ otherwise. This allows us to sample $f$ in time $\tilde{O}(N)$ given $\hat{t}$. By (12) we have $\sum_{x}f(x)=k$. For each individual $x\in X_{i}$,

[TABLE]

By (13), we have

[TABLE]

Since the width of $\Gamma_{i}$ is at most $\varepsilon/2$, by the definition of $s(i)$ and $X_{i}$, we have $|s(i)/|X_{i}|-p(x)|\leq\varepsilon/2$. Combining this with the inequality above, we have $|\operatorname{\mathbb{E}}_{f}[f(x)]-p(x)|\leq\varepsilon$, as desired. ∎

3.2.3 Step 3: Indistinguishable Model with $\mathrm{polylog}(N)$ Time Implementation

Now we prove Lemma 3.5, where $N=2^{n}$ is exponentially large and we want our implementation to run in time $\mathrm{poly}(n,\varepsilon^{-1})$. Because of this efficiency requirement, we cannot directly apply Lemma 3.11 which would only give us a $\mathrm{poly}(N,\varepsilon^{-1})$ time implementation. Our idea is to divide the domain $X=\{0,1\}^{n}$ into small groups each with size roughly $\Theta(\varepsilon^{-1})$ and apply Lemma 3.11 separately on each group. This requires us to set a target support size for every group so that these sizes sum up to the total support size $k$ for the entire domain. We achieve this by creating a binary tree whose root corresponds to the entire domain and whose leaves correspond to the groups. We assign a target support size for every node of the tree from the root to the leaves. For every non-leaf node, we determine how to split its support size to its two children by estimating the sum of $p(x)$ in the sub-domains corresponding to the children. We make sure that the depth of the tree is at most $n$ so that we can efficiently reach any leaf from the root, which allows us to construct an efficient implementation.

Because of Lemma 3.11, it is w.l.o.g. to assume $2^{n}\geq 8/\varepsilon$ in Lemma 3.5. We start by describing an inefficient randomized algorithm that produces a function $f:X\to\{0,1\}$ given the predictor $p$. We will then choose the model $M$ as the distribution of the sample-access model $B$ induced by the random function $f$ and show that $M$ can be implemented efficiently.

The randomized algorithm producing the function $f$ operates as follows. For every bit string $z\in\bigcup_{j=0}^{n}\{0,1\}^{j}$, we can view $z$ as a node in a binary tree with root being the empty string. Starting from the root, we assign an integer $k_{z}$ to certain nodes $z$ in the tree as follows. For the root node $z$, we set $k_{z}:=k$. Suppose we have assigned an integer $k_{z}$ to a node $z$ of the tree, we assign integers $k_{z\|0}$ and $k_{z\|1}$ to the two children $z\|0$ and $z\|1$ of $z$ as follows. Define $z^{\prime}:=z\|0$ and let $X_{z^{\prime}}$ be the set consisting of $x\in X$ such that $z^{\prime}$ is a prefix of $x$. We draw $x_{1},\ldots,x_{m}$ independently and uniformly from $X_{z^{\prime}}$ for $m=\lceil 16n^{2}/\varepsilon^{2}\rceil$, and define $\ell_{z^{\prime}}:=\frac{|X_{z^{\prime}}|}{m}\sum_{i=1}^{m}p(x_{i})$. We set $\hat{k}_{z\|0}:=\lfloor\ell_{z^{\prime}}\rfloor\in[0,|X_{z^{\prime}}|]$ and $\hat{k}_{z\|1}:=k_{z}-\hat{k}_{z\|0}$. We then define

[TABLE]

The above procedure allows us to assign an integer $k_{z}$ to every node $z$, and we use these integers to construct a function $f:X\to\{0,1\}$. Specifically, choosing $n^{\prime}$ to be the largest integer satisfying $2^{n-n^{\prime}}\geq 8/\varepsilon$, for every $z\in\{0,1\}^{n^{\prime}}$, we construct a function $f_{z}:X_{z}\to\{0,1\}$, and the function $f$ is then constructed by combining $f_{z}$ for all $z\in\{0,1\}^{n^{\prime}}$.

To construct each $f_{z}$, we first construct a predictor $p^{\prime}:X_{z}\to[0,1]$ as follows. If $k_{z}\geq\sum_{x\in X_{z}}p(x)$, we increase each $p(x)$ for $x\in X_{z}$ to $p^{\prime}(x)$ so that $\sum_{x\in X_{z}}p^{\prime}(x)=k_{z}$. Similarly, we decrease $p(x)$ to $p^{\prime}(x)$ if $k_{z}<\sum_{x\in X_{z}}p(x)$. Using Lemma 3.11, in time $\mathrm{poly}(|X_{z}|,\varepsilon^{-1})=\mathrm{poly}(\varepsilon^{-1})$ we can randomly construct a function $f_{z}:X_{z}\to\{0,1\}$ such that for every $x\in X_{z}$,

[TABLE]

where the expectation is in the randomness of $f_{z}$.

We analyze the above procedure of generating the function $f$ in the following lemma:

Lemma 3.12**.**

In the procedure above, if we choose $m\geq Cn^{2}/\varepsilon^{2}$ for a sufficiently large absolute constant $C>0$, then

$\Pr[\sum_{x\in X}f(x)=k]=1$; 2. 2.

$\sum_{x\in X}|\operatorname{\mathbb{E}}[f(x)]-p(x)|\leq|k-\sum_{x\in X}p(x)|+\varepsilon|X|$.

Note that the probability and expectation are over the randomness in $f$.

We first prove two helper lemmas below before we prove Lemma 3.12.

Lemma 3.13**.**

Assume that $|k_{z}-\sum_{x\in X_{z}}p(x)|\leq\alpha$ and $|\ell_{z\|0}-\sum_{x\in X_{z\|0}}p(x)|\leq\beta$. Then

[TABLE]

Proof.

By our choice of $\hat{k}_{z\|0}=\lfloor\ell_{z\|0}\rfloor$ and $\hat{k}_{z\|1}=k_{z}-\hat{k}_{z\|0}$, we have

[TABLE]

and

[TABLE]

Summing up,

[TABLE]

The lemma is proved by the observation that replacing $(\hat{k}_{z\|0},\hat{k}_{z\|1})$ with $(k_{z\|0},k_{z\|1})$ does not increase the LHS of the inequality above. ∎

Lemma 3.14**.**

Let $n^{\prime}\in{\mathbb{Z}}_{\geq 0}$ satisfy $2^{n-n^{\prime}}\geq\frac{8}{\varepsilon}$. Then

[TABLE]

Proof.

Consider an arbitrary $z\in\bigcup_{j=0}^{n-1}\{0,1\}^{j}$ and define $z^{\prime}=z\|0$. By our definition of $\ell_{z^{\prime}}:=\frac{|X_{z^{\prime}}|}{m}\sum_{i=1}^{m}p(x_{i})$ for $x_{1},\ldots,x_{m}$ drawn i.i.d. from the uniform distribution over $X_{z^{\prime}}$, we have $\operatorname{\mathbb{E}}[\ell_{z^{\prime}}]=\sum_{x\in X_{z^{\prime}}}p(x)$ and ${\mathsf{Var}}(\ell_{z^{\prime}})\leq\frac{|X_{z^{\prime}}|^{2}}{m}$. Therefore,

[TABLE]

By our choice of $m\geq 16n^{2}/\varepsilon^{2}$, we have

[TABLE]

We prove the following inequality by induction on $j=0,\ldots,n$:

[TABLE]

The inequality holds trivially for $j=0$ because $k_{z}=k$ and $X_{z}=X$ when $z$ is the empty string. Now suppose the inequality holds for some $j=0,\ldots,n-1$, and we show that it also holds with $j$ replaced by $j+1$. For every $z\in\{0,1\}^{j}$, defining $z^{\prime}:=z\|0$, by Lemma 3.13 we have

[TABLE]

Summing up over $z\in\{0,1\}^{j}$ and taking expectation, we have

[TABLE]

The lemma is proved by setting $j=n^{\prime}$ in (16) and observing that $\frac{\varepsilon n^{\prime}}{4n}\leq\frac{\varepsilon}{4}$ and $2^{-(n-n^{\prime}-1)}\leq\frac{\varepsilon}{4}$. ∎

Proof of Lemma 3.12.

For every $z\in\{0,1\}^{n^{\prime}}$, by the definition of $p^{\prime}(x)$,

[TABLE]

Combining (17) and (14),

[TABLE]

Taking expectation over $k_{z}$,

[TABLE]

Summing up over $z\in\{0,1\}^{n^{\prime}}$ and applying Lemma 3.14,

[TABLE]

Proof of Lemma 3.5.

It suffices to prove that the model $M$ defined as the distribution of the sample-access object $B$ induced by the random function $f$ in Lemma 3.12 can be implemented efficiently, and the implementation itself can be computed efficiently from $p$.

To see that $M$ can be implemented efficiently, we first generate all the randomness needed in the procedure of creating $f$ by querying a random oracle. We then note that in order to compute $f(x)$, it suffices to compute $k_{z}$ for every prefix $z$ of $x$ and then compute $f_{z}$ for $z$ being the length-$n^{\prime}$ prefix of $x$. This can be done efficiently in time $\mathrm{poly}(n,\varepsilon^{-1})$. ∎

3.3 Learning Support-Access Binary Functions

In the previous sections we showed how to learn and construct an implementation of an indistinguishable model for a function induced sample-access object $B^{*}$, i.e. there exists a function $f^{*}:X\rightarrow\{0,1\}$, and the distinguishers and learner both receives random samples of form $(x,f^{*}(x))$. In this section, we learn a support-access object induced by a function see Definition 2.2. For a binary function $f^{*}:X\rightarrow\{0,1\}$, the support-access object $B^{*}$ induced by $f^{*}$ outputs random samples from the set $\left\{x|f^{*}(x)=1\right\}$. We show how to construct an efficient implementation of a model that is indistinguishable from $B^{*}$.

Distinguishers:

Let $\mathcal{D}$ be a set of distinguishers, such that each $D\in\mathcal{D}$ has an associated subset $S_{D}\subset X$. Given access to a sample $x$ from a object $B$,the distinguisher accepts if $x\in S_{D}$.

We assume that for every $D\in\mathcal{D}$, the set $S_{D}$ has known size and an efficient description, that on input $x$ answers if $x\in S_{D}$.

Auditor:

Let $\mathcal{D}$ be defined as above. We say that an algorithm $\Lambda^{B^{*},p}$ is an $(\varepsilon,\gamma,\delta)$ auditor for the collection of sets $\mathcal{S}=\left\{S_{D}|D\in\mathcal{D}\right\}$ if it has the following properties. Given access to a function-induced support access-object $B^{*}$ and query access to a predictor $p:X\rightarrow[0,1]$. If there exists $S\in\mathcal{S}$ and $b\in\{-1,1\}$ such that

[TABLE]

Then the auditor returns a set $S^{\prime}$ such that with probability $1-\delta$,

[TABLE]

Where $x\sim p$ is the distribution generated from the predictor $p$, i.e. $\Pr_{x\sim p}[x=x^{\prime}]=\frac{p(x^{\prime})}{\sum_{x^{\prime\prime}\in X}p(x^{\prime\prime})}$.

Assuming an auditor for the collection of sets $\mathcal{S}$, we show a learning algorithm for support-access function object $B^{*}$.

Theorem 3.15**.**

Let $\alpha\in[0,1]$ , and let $\mathcal{B}$ be a collection of support access object induced by binary functions, such that $\forall B\in\mathcal{B},\operatorname{\mathbb{E}}_{x\in X}[f_{B}(x)]=\alpha$. Let $\mathcal{D}$ be a collection of distinguishers as described above.

Let $\varepsilon,\gamma,\delta^{\prime},\delta^{\prime\prime}$ be parameters such that $\delta^{\prime}\leq c\delta\gamma^{2}\alpha^{-2}$ for a sufficiently small constant $c$. Let $\Lambda$ be an $(\varepsilon,\gamma,\delta^{\prime})$ auditor $\Lambda$ for $\mathcal{D}$. Then there exists a $(2\varepsilon,\delta)$-learner $L$ for $\mathcal{B}$ with respect to the distinguisher class $\mathcal{D}$. The learner $L$ runs in time $\mathrm{poly}(\gamma^{-1}\log(\delta^{-1})\alpha^{-1},W_{1},W_{2})$, where $W_{1}$ is the running time of the auditor $\Lambda$ and $W_{2}$ the circuit complexity of its output. The implementation $T$ that the learner outputs runs in time $\mathrm{poly}(\gamma^{-1}\log(\delta^{-1})\alpha^{-1},W_{2})$

The learner $L$ in the theorem above has access to an auditor $\Lambda$ that can audit support-access objects. In section Section 3.3.1 we show that such auditor exists under similar conditions to an auditor for sample-access objects.

The learning algorithm is similar to the classic algorithm in Lemma 3.3, with an additional step of keeping the expected value of the model to be approximately $\alpha$. This extra step is required to show convergence for support-access objects. We note that if the function is sparse, i.e. $\alpha$ is very small, then the algorithm is no longer efficient.

Learning algorithm:

We described the polynomial-time learner $L$. The learner maintains a list $F$ or tuples $(S,w)$, for $S\subseteq X$ and $w\in[0,1]$. Using the list, the learner calculates a predictor $p:X\rightarrow[0,1]$, by setting for each $x\in X$,

[TABLE]

where ${\mathsf{Lcap}}$ caps the value $p(x)$ to the range $[0,1]$ after adding every list element, as defined in eq. 2. For example, if the list is $(S_{1},w_{1}),(S_{2},w_{2})$ then we have $p(x)={\mathsf{cap}}({\mathsf{cap}}(w_{1}\cdot\mathbf{1}(x\in S_{1}))+w_{2}\cdot\mathbf{1}(x\in S_{2}))$.

For every $x\in X$, calculating $p(x)$ is done in $\left|F\right|$ calls for the functions $\mathbf{1}(x\in S)$, for sets $S$ that the auditor returns.

The learner creates the list $F$ using the following algorithm.

Initialization: set $F=(X,w_{0}=\alpha)$. 2. 2.

Query $\Lambda^{B^{*},p}$, where $p$ is the predictor generated from $F$.

1. (a)

If it does not return a set, output the current $F$. 2. (b)

If the auditor returns a set $S\subseteq X$ and a sign $b\in\left\{-1,1\right\}$, set $F\leftarrow F\cup(S,b\gamma\alpha\frac{\left|X\right|}{\left|S\right|})$. 3. 3.

Choose $t=\log\left|X\right|$ random elements from $X$, $I=\left\{x_{1},\ldots,x_{t}\right\}$.

If $\left|\operatorname{\mathbb{E}}_{x\in I}[p(x)]-\alpha\right|>\beta=\frac{1}{10}\gamma\alpha^{2}$, add $([N],\beta{\mathsf{sign}}\left(\alpha-\operatorname{\mathbb{E}}_{i\in I}[p_{i}]\right))$ to $F$. Repeat the current item until the condition is satisfied. Return to Item 2.

Implementation:

Given a list $F$, a random oracle implementation $T$ implements sampling $x\sim B(\bot)$ by rejection sampling. Denote by $R$ the random oracle, and assume that for every input the random oracle outputs a different random string.

Choose a random $x\in X$. 2. 2.

Use $R(x)$ to sample a bit $b$ such that $\Pr_{R(x)}[b=1]=p(x)$. 3. 3.

If $b=1$, return $x$. If $b=0$, go back to Item 1.

The expected number of loop iterations in the implementation is $\alpha$, since this is the expected value of $p$. The random oracle is used to create an implement a consistent function object $B$. That is, in every time the implementation samples $x\in X$, the random oracle returns the same random string $R(x)$. This means that for every randomness, the implementation implements a support-access object for a specific function $f:X\rightarrow\left\{0,1\right\}$, as required.

Proof of Theorem 3.15.

We start by assuming that the learning algorithm finished its running, and showing that in this case the output is indistinguishable from $B^{*}$ to all $D\in\mathcal{D}$.

The algorithm ends after Item 3, which means that with probability $(\beta\left|X\right|)^{-1}$, we have

[TABLE]

Assuming eq. 20 holds, the implementation $T$ of our model is efficient and runs approximately $1/\alpha$ steps before stopping. It sample a random entry $x\sim p$, from $p$ such that the auditor does not return any set $S$, which means that for all $D\in\mathcal{D}$,

[TABLE]

Together this implies that after the algorithm ends, the model $M$ is such that

[TABLE]

Therefore, if the learning algorithm ends it outputs an implementation for a model that is indistinguishable from $B^{*}$ for all $D\in\mathcal{D}$.

We are left with proving that the learning algorithm is efficient, which also bounds the complexity of the implementation $T$ (as it depends on the size of $F$). We prove this using a potential function:

[TABLE]

Since both $p$ and $f^{*}$ are in $[0,1]$, the value of $\varphi$ is bounded by $\left|X\right|$.

By definition, with probability $1-\delta^{\prime}$ the auditor returns a set $S$ that satisfies eq. 18. In this case, from 3.16, the value of $\varphi$ is reduced by $\Omega(\gamma^{2}\alpha^{2}\left|X\right|)$ on each iteration. In addition, from 3.17, the value of $\varphi$ is reduced by $\Omega(\gamma^{2}\alpha^{4}\left|X\right|)$ on each iteration of Item 3. Together, we get that the total number of weight updates (of both types) are at most $O(\gamma^{-2}\alpha^{-4})$. ∎

Claim 3.16**.**

Suppose that on Item 2b of the algorithm, the learning algorithm list is updated from $F$ to $F\cup(S,w)$, such that $(S,w)$ satisfies eq. 18. Let $p$ be the predictor described by $F$, and $p^{\prime}$ be the predictor described by $F\cup(S,w)$. Assume that $\left|\operatorname{\mathbb{E}}_{x\in X}[p(x)]-\alpha\right|\leq 2\delta$, then $\varphi(B^{*},p^{\prime})\leq\varphi(B^{*},p)-\frac{1}{2}\gamma^{2}\alpha^{2}\left|X\right|$.

Proof.

According to our assumption, we have

[TABLE]

The previous inequality can be written also as

[TABLE]

We divide into two cases, of $b=1$ and $b=-1$. The two cases are nearly identical and we write them both for completeness.

If $b=1$:

Then eq. 21 can be written as:

[TABLE]

Where we use the fact that $\operatorname{\mathbb{E}}_{x\in X}[p(x)]\leq\alpha+\beta$.

[TABLE]

Where we use the fact that $\beta=\frac{1}{8}\gamma\alpha^{2}$.

The capping of $p(x)$ to $[0,1]$ can only reduce the value of the potential function, because for every $x\in X$ we have $f^{*}(x)\in\left\{0,1\right\}$.

If $b=-1$:

This case is nearly identical to the $b=1$ case. In this case, eq. 21 can be written as

[TABLE]

If the algorithm did not perform any capping:

[TABLE]

As before, capping $p(x)$ to $[0,1]$ can only reduce the value of $\varphi$. ∎

Claim 3.17**.**

Suppose that in the step described by Item 3, the algorithm makes an update to the list $F$. Let $p$ be the predictor before the update (as defined in (19)), and $p^{\prime}$ be the predictor after the update. Then with probability $1-O(\left|X\right|^{-1})$, $\varphi(B^{*},p^{\prime})\leq\varphi(B^{*},p)-\frac{9}{10}\beta^{2}\left|X\right|$.

Proof.

This proof is the classic learning proof. Using the Chernoff bound, with probability $O(\left|X\right|^{-1})$ we have that

[TABLE]

Assuming the above holds, then

[TABLE]

Assume without loss of generality that $\sum_{x\in X}f^{*}(x)\geq\sum_{x\in X}p(x)$, then we add $([N],\beta)$ to the list. We have

[TABLE]

Assume for now that no capping is done for $p^{\prime}$. In this case, $p^{\prime}(x)=p(x)+\beta$ and thus

[TABLE]

Capping $p^{\prime}$ can only reduce the value of $\varphi(B^{*},p^{\prime})$, since $f^{*}(x)\in[0,1]$. ∎

3.3.1 Auditor for Support-Access Objects

The auditor for the sample-access objects can be seen as a weak agnostic learner of the concept class $\mathcal{G}$ representing the class of distinguishers $\mathcal{D}$ under the uniform distribution. In the case of support-access objects, the auditor does not get labeled samples $(x,f^{*}(x))$, but rather a random $x$ such that $f^{*}(x)=1$.

We show that for a large family of learning algorithms, statistical query algorithms, learning from support-access objects is not much more difficult than learning from sample-access objects.

Definition 3.2** (Statistical Query Oracle).**

A statistical query oracle over a distribution $P:X\times\{0,1\}\rightarrow[0,1]$ is a function receiving as an input a function $\phi:X\times\{0,1\}\rightarrow\{0,1\}$ and error parameter $\varepsilon$ and outputting a value $v\in[0,1]$ such that $\left|v-\operatorname{\mathbb{E}}_{(x,y)\sim P}[\phi(x,y)]\right|\leq\varepsilon$.

Definition 3.3** (Statistical Query Algorithm).**

An algorithm $\mathcal{A}$ is a statistical query algorithm over a distribution $P:X\times\{0,1\}\rightarrow[0,1]$ if it only access to the object is using a statistical query oracle over the distribution $P$.

Claim 3.18**.**

If there exists a statistical query algorithm $\mathcal{A}$ learning a hypothesis $h$ over the distribution $P$ created from sample-access object, i.e. that outputs $(x,f^{*}(x))$ for a uniform $x\in X$, then there exists an algorithm $\mathcal{A}^{\prime}$ learning $h$ from the distribution $P^{\prime}$ created from support-access object, i.e. that outputs a uniform $(x,1)$ for a random $x\in X$ such that $f^{*}(x)=1$. The algorithm $\mathcal{A}^{\prime}$ also requires $m=\left|{\mathsf{supp}}(f^{*})\right|=\sum_{x\in X}f^{*}(x)$ as an input.

Furthermore, $\mathcal{A}^{\prime}$ has the same number of queries to the statistical oracle, has running time similar to the running time of $\mathcal{A}$ up to $\mathrm{polylog}\left|X\right|$ factors, and has the same success probability up to an additive error of $1/\log\left|X\right|$.

Proof.

The algorithm $\mathcal{A}^{\prime}$ simulates the algorithm $\mathcal{A}$, and simulates the the statistical query oracle over the distribution $P$ using the oracle for $P^{\prime}$. Suppose the algorithm $\mathcal{A}$ queries the statistical query oracle the function $\phi:X\times\{0,1\}\rightarrow\{0,1\}$. Since the second variable is binary we can write,

[TABLE]

The value $\operatorname{\mathbb{E}}_{x\in X}[\varphi_{2}(x)]$ does not depend on the function $f^{*}$ and can be approximated without any queries to $f^{*}$ or to the oracle. Given that the function $\varphi_{2}(x)$ is bounded, $\mathcal{A}^{\prime}$ can approximate $E_{x\in X}[\varphi_{2}(x)]$ up to an additive error of $\varepsilon/2$ in $\mathrm{polylog}\left|X\right|$ runtime, with success probability $1-\left|X\right|^{-2}$. We denote this approximation by $v_{1}$.

For the second element, $\operatorname{\mathbb{E}}_{x\in X}[(\varphi_{1}(x)-\varphi_{2}(x))f^{*}(x)]$, we have

[TABLE]

Notice that the last term is the expected value of $\varphi_{1}(x)-\varphi_{2}(x)$ under the support-access object distribution, $P^{\prime}$. Therefore, the algorithm $\mathcal{A}^{\prime}$ then queries the statistical query oracle over distribution $P^{\prime}$ with function $\phi^{\prime}(x,y)=\varphi_{1}(x)-\varphi_{2}(x)$ and error parameter $\varepsilon/2$. Denote the return value to be $v_{2}$. Then, $\mathcal{A}^{\prime}$ to simulates $\mathcal{A}$ assuming the return value of the statistical query oracle to $\mathcal{A}$ is $v_{1}+\frac{m}{\left|X\right|}v_{2}$. Since the error in $v_{1},v_{2}$ is bounded by $\varepsilon/2$, the return value is a valid return value from the statistical oracle query with probability $1-\left|X\right|^{-2}$.

Summing over all of the queries of $\mathcal{A}$ to the statistical query oracle, the probability that $\mathcal{A}^{\prime}$ fails is the same as $\mathcal{A}$ with the additional factor smaller than $1/\log\left|X\right|$ (which is the error in the approximation of $\operatorname{\mathbb{E}}_{x\in X}[\varphi_{2}(x)]$). ∎

Therefore, if there exists an auditor in the standard sample-access object, that is a statistical query algorithm, then there is also an auditor for the support-access object.

We further prove the existence of an auditor for support-access objects for specific set of distinguishers.

Claim 3.19**.**

Let $\mathcal{D}$ be a set of $t$ distinguishers for the support-access object, as defined on Section 3.3. Then there exists an auditor $\Lambda$ as defined in Section 3.3 with running time $\Theta(t)$ and query complexity $O(\log(t)\mathrm{polylog}(\left|X\right|)1/(\delta(\varepsilon-\gamma)))$.

Proof.

The auditor samples $k=c\cdot\log(t)\mathrm{polylog}(\left|X\right|)$ uniform samples $x_{1},\ldots,x_{k}\sim B^{*}(\bot)$. For every distinguisher $D\in\mathcal{D}$ with an associated set $S_{D}$ the auditor calculates

[TABLE]

If there exists $D\in\mathcal{D}$ such that $\left|v_{D}-\Pr_{x\sim p}[x\in S_{D}]\right|>\frac{\varepsilon+\gamma}{2}$, the auditor returns $S_{D}$.

For every set $S_{D}\subseteq X$, by Chernoff bound the probability over $x_{1},\ldots,x_{k}$ that

[TABLE]

is at most $e^{-k(\varepsilon-\gamma)^{2}/10}$. Therefore, we choose the constant $c$ such that even when summing over the $t$ distinguishers, the error is smaller than $\delta$. ∎

We can look at the value $v_{D}$ calculated by the algorithm above as an estimator for $\Pr_{x\in B^{*}(\bot)}[x\in S_{D}]$. The argument above implies that $v_{D}$ uniformly converge to $\Pr_{x\in B^{*}(\bot)}[x\in S_{D}]$.

Definition 3.4** (Uniform Convergence).**

An estimator $v$ uniformly converges to $P$ under distribution $B$ over the hypothesis class $\mathcal{D}$ if there exists a function $k:(0,1)\times(0,1)\rightarrow\mathbb{N}$ such that for every $\varepsilon,\delta>0$, if $k>k(\varepsilon,\delta)$ then

[TABLE]

The uniform convergence implies that there exists an algorithm for weak agnostic learning of the class $\mathcal{D}$ with sample complexity $\mathrm{poly}(1/\varepsilon,\log(1/\delta),\mathsf{VCdim}(\mathcal{D}))$ [VC71, BEHW89, LMR91].

3.4 Learning Bit-String Functions

In this section we are interested in learning a function $f:\left\{0,1\right\}^{n}\rightarrow\left\{0,1\right\}^{n}$. This is a harder than learning a binary function, because the range of the function is very large. In this section, we only learn a indistinguishable model with respect to a very limited set of distinguishers, with a product structure. In this setting, the sampling distribution is a pair $(x,f(x))$ for a random input $x$.

Distinguishers:

Let $\mathcal{D}$, such that each distinguisher $D\in\mathcal{D}$ has an set $S_{D}\subset\left\{0,1\right\}^{n}$ and a coordinate $j\in[n]$. The distinguisher $D$ accept a sample $(x,f(x))$ if $x\in S$ and $f(x)_{j}=1$.

Auditor:

Let $\mathcal{D}$ be defined as above. We say that an algorithm $\Lambda^{B^{*},p}$ is an $(\varepsilon,\gamma,\delta)$ auditor for the collection of sets $\mathcal{S}$ if it has the following properties. Given access to a function-induced support access-object $B^{*}$ and query access to a set of $n$ predictors $p_{1},\ldots p_{n}$, such that $p_{j}:\left\{0,1\right\}^{n}\rightarrow[0,1]$. If there exists $S\in\mathcal{S}$ and $j\in[n]$ such that

[TABLE]

Then the auditor returns a set $S^{\prime}\subseteq\left\{0,1\right\}^{n}$ and $j\in[n]$ such that with probability $1-\delta$,

[TABLE]

.

Theorem 3.20**.**

Let $\mathcal{B}$ be a collection of support access object induced by functions $f:\left\{0,1\right\}^{n}\rightarrow\left\{0,1\right\}^{n}$. Let $\mathcal{D}$ be a collection of distinguishers as described above.

Let $\varepsilon,\gamma,\delta^{\prime},\delta^{\prime\prime}$ be parameters such that $\delta^{\prime}\leq c\delta\gamma^{2}n^{-1}$ for a sufficiently small constant $c$. Let $\Lambda$ be an $(\varepsilon,\gamma,\delta^{\prime})$ auditor for $\mathcal{D}$. Then there exists a $(2\varepsilon,\delta)$-learner $L$ to $\mathcal{B}$ with respect to the distinguisher class $\mathcal{D}$ and the learner $L$ runs in time $\mathrm{poly}(\gamma^{-1}\log(\delta^{-1})\alpha^{-1},W_{1},W_{2})$, where $W_{1}$ is the running time of the auditor $\Lambda$ and $W_{2}$ the circuit complexity of its output. The implementation $T$ that the learner outputs runs in time $\mathrm{poly}(\gamma^{-1}\log(\delta^{-1})\alpha^{-1},W_{2})$

We describe the learner $L$ and implementation $T$.

Implementation:

Given a list $F$ of tuples $(S,j,w)$, the implementation algorithm $T$ with oracle access to a random oracle $R$ generates a model $\hat{B}$. Given $x\in\left\{0,1\right\}^{n}$ the algorithm $T$ outputs $v$ by:

1. 1.

For every $j\in[n]$ calculate $p_{j}(x)\in[0,1]$ by:

[TABLE] 2. 2.

Choose $v\in\left\{0,1\right\}^{n}$ by setting for every $j\in[j]$, $v_{j}=1$ with probability $p_{j}(x)$ independently using the random oracle $R(x)$.

Learning Algorithm:

The learning algorithm $L$.

1. 1.

Initialization: set $F=\left\{(\left\{0,1\right\}^{n},j,1/2)|j\in[n]\right\}$. 2. 2.

Query the auditor with the current model and $B^{*}$. If the auditor returns $(S,j,b)$, add $(S,j,b\cdot\gamma)$ to $F$ and repeat.

Notice that the learner is identical to the classic boosting algorithm, where we apply it individually on each of the coordinated of $f(x)$. This is the reason that we can only be indistinguishable with respect to a set of distinguishers $D$ that only check if a single output coordinate in $f(x)$ equals $1$.

Proof of Theorem 3.20.

Similar to the previous proofs, if the auditor does not output any set then the model is $\varepsilon$-indistinguishable for all $D\in\mathcal{D}$.

We prove the correctness using a potential function, which sums over the error of each coordinate $j\in[n]$. Let

[TABLE]

Every $x$ appears in the sum $n$ times, therefor the initial value of $\varphi$ is bounded by $n\cdot 2^{n}$.

Let $p_{1},\ldots,p_{n}$ be the predictors before the execution of Item 2, and $p^{\prime}_{1},\ldots,p_{n}^{\prime}$ afterwards. We claim that with probability $1-\delta^{\prime}$ we have that $\varphi(B^{*},p_{1},\ldots,p_{n})-\varphi(B^{*},p_{1}^{\prime},\ldots,p_{n}^{\prime})\geq\gamma^{2}2^{n}$.

The auditor returned $(S,i,b)$, then

[TABLE]

Assume without loss of generality that $b=1$. We note that the difference between $p_{1},\ldots,p_{n}$ and $p_{1}^{\prime},\ldots,p_{n}^{\prime}$ is only between $p_{i},p_{i}^{\prime}$ and only for $x\in S$.

[TABLE]

Assuming that the algorithm does not do any capping,

[TABLE]

where we use eq. 25 in the last inequality.

The values of $\mathbf{1}(f(x)_{j}=1)$ are in $\left\{0,1\right\}$, therefore capping the value of $p_{i}$ to $[0,1]$ can only lower the value of the potential function. ∎

4 Learning Exponential-Size Graphs

4.1 Learning Dense Graphs

The most basic setting for graphs is the dense model, where the graph-induced sample-access object $B$ induced by a graph $G=([N],E)$ can be thought of as getting a random entry $((u,v),b)$ for $u,v\in[N],b\in\left\{0,1\right\}$ from the adjacency matrix of $G$ (see Definition 2.4). In this setting, we can think of the adjacency matrix of the graph as a function, where the graph imposes some extra structure on the distinguishers. Therefore, some of the results from Section 3 follow directly.

Distinguishers:

Let $\mathcal{D}$ be a collection of distinguishers. Each distinguisher has two sets of vertices $U_{D},V_{D}\subset[N]$. When getting a random entry $((u,v),b)$ from the graph-induced sample-access object $B^{*}$, it accepts if $u\in U_{D}$, $v\in V_{D}$ and $b=1$.

Auditors:

An algorithm $\Lambda$ is an $(\varepsilon,\gamma,\delta)$-auditor for a collection of tuples $\mathcal{S}$ containing pairs $(U,V)\subset[N]\times[N]$ if it satisfies the following. The auditor received query access to a predictor $p:[N]\times[N]\rightarrow[0,1]$ and to a graph-induced sample-access object $B^{*}$ induced by a graph $G^{*}=([N],E^{*})$. If there exists $(U,V)\in\mathcal{S}$ such that

[TABLE]

Then with probability $(1-\delta)$, it outputs $U^{\prime},V^{\prime}$ such that

[TABLE]

From Theorem 3.2, which uses a multicalibrated predictor from [TTV09, HJKRR18, KGZ19], we get that we can learn an exponential graph model assuming we have an auditor for the class of distinguishers. This is done by simply applying Theorem 3.2 on the sample-access object for a graph, when treating its adjacency matrix as a binary function, i.e. apply it on $f^{*}:[N]\times[N]\rightarrow\left\{0,1\right\}$ such that $f^{*}(u,v)=1\iff(u,v)\in E^{*}$.

Corollary 4.1** (Corollary of Theorem 3.2).**

Let the distinguisher class $\mathcal{D}$ be defined above. Let $\varepsilon,\gamma,\delta,\delta^{\prime}>0$ be parameters satisfying $\delta^{\prime}\leq c\delta\gamma^{2}$ for a sufficiently small absolute constant $c>0$. Let $\mathcal{B}$ be the class of sample-access objects induced by graphs over vertex set $[N]$. Let $\Lambda$ be an $(\varepsilon,\gamma,\delta^{\prime})$-auditor for $\mathcal{S}=\left\{(U_{D},V_{D})|D\in\mathcal{D}\right\}$. Then there exists an $(\varepsilon,\delta)$-learner $L$ for $\mathcal{B}$ w.r.t. $\mathcal{D}$. Moreover, if the auditor $\Lambda$ runs in time at most $W_{1}$ and always outputs a function with circuit size at most $W_{2}$, then the learner $L$ runs in time $\mathrm{poly}(\gamma^{-1},\log(\delta^{-1}),W_{1})$ and always outputs implementations with circuit complexity $O(\gamma^{-2}W_{2})$.

The same holds also for learning a graph with a fixed number of edges. We can apply Theorem 3.4 on the sample-access object representing the adjacency matrix of a graph with $m$ edges (when $m$ is known). Theorem 3.4 implies that we can learn an indistinguishable model in the setting of Corollary 4.1, while also requiring that the model only contains graphs with $m$ edges. Note though that this can be done when using the adjacency matrix of the graph as a function, so the result is meaningful only for dense graphs, i.e. when $m=\Theta(N^{2})$.

The two theorems also apply when learning a model of a directed graph, and all of the previous results still holds. This is done simply by having the adjacency matrix of a directed graph, i.e. when $f(u,v)$ might differ from $f(v,u)$. In addition, for a directed graph, it is possible to apply the construction used in Section 3.2 to have a truthfulness requirement of a fixed out degree $d$. That is, when given a sample-access object induced by a directed graph $G$ with uniform out-degree $d$, we output a model such that for all $B\sim M$, the graph $G_{B}$ has out degree $d$ for all vertices. This is done by learning a predictor as previously, and using the construction from Section 3.2 for the sampling algorithm. In the sampling algorithm, instead of having a directed edge $(u,v)$ with probability $p(u,v)$ independently, we apply the algorithm from Section 3.2 on the function representing the row of $u$ in the adjacency matrix, with the value of the function being $d$. We sample a directed edge by following the algorithm from Section 3.2.

4.2 Learning Sparse Graphs Without Dense Subgraphs

For a sparse graph, a sample-access graph object is not useful. This is because a random entry in the adjacency matrix of a sparse graph is nearly always [math], so any sparse graph is indistinguishable from the empty graph for sample-access objects. For sparse graphs, we study graph-induced support-access objects (Definition 2.5). A support-access object $B^{*}$ induced by a sparse graph $G=([N],E)$, $B(\bot)$ outputs a random edge in the graph $(u,v)\in E$.

In Section 3.3 we studied function-induced support access objects, i.e. an object of a function $f$ that returns a random input $x$ such that $f(x)=1$. For a graph $G=([N],E)$, if we view its adjacency matrix as a function $f:[N]\times[N]\rightarrow\left\{0,1\right\}$, then a support-access function object $B$ of $f$ returns a random positive entry of $f$, i.e. a random edge $(u,v)\in E$. Therefore, we can apply Theorem 3.15 for support-access graph objects. Unfortunately, Theorem 3.15 only applies for functions $f$ with a constant expected value, i.e. when $f$ represents the adjacency matrices of a dense graph (for $f$ representing a sparse graph, the learning and implementation are inefficient).

In this section we show how to create a dense model for a sparse graph, as long as the sparse graph does not have a subgraph which is too dense. We do so by using the strong regularity lemma for sparse graphs [KR03, Sco11], which implies that for a sparse graph $G$ with no dense subgraphs, there exists a dense graph that is indistinguishable from it. Then we reduce the problem to finding a dense model for a dense graph, and apply Theorem 3.15.

Distinguishers:

Let $\mathcal{D}$ be a collection of distinguishers. Each distinguisher has two sets of vertices $U_{D},V_{D}\subset[N]$. A distinguisher $D$ on input $(u,v)$ accepts if $u\in U_{D}$ and $v\in V_{D}$.

Auditors:

An algorithm $\Lambda$ is an $(\varepsilon,\varepsilon^{\prime},\delta)$-auditor for a collection pairs of sets $\mathcal{S}$, such that $(U,V)\in\mathcal{S}$, $U,V\subset[N]$ if it satisfies the following. The auditor received query access to a predictor $p:[N]\times[N]\rightarrow[0,1]$ and access to a graph-induced support-access object $B^{*}$ representing a graph $G^{*}=([N],E^{*})$. If there exists a pair of sets $(U,V)\subset\mathcal{S}$ and a bit $b$ such that

[TABLE]

Then $\Lambda$ outputs sets $U^{\prime},V^{\prime}\subset[N]$ such that

[TABLE]

The distribution $(u,v)\sim p$ is defined by the predictor $p$, i.e. for all $u,v\in[N]$ we have

[TABLE]

Graph Notations and Definitions

For a graph $G=([N],E)$ and $U,V\subset[N]$, we define $E_{G}(U,V)=\left\{(u,v)\in E|u\in U,v\in V\right\}$ to be the set of edges between $U,V$ in $G$. We denote by $\rho_{G}(U,V)$ the edge density between $U,V$ in $G$, $\rho_{G}(U,V)=\frac{\left|E_{G}(U,V)\right|}{\left|U\right|\left|V\right|}$. We denote by $\rho_{G}=\rho_{G}([N],[N])$ the edge density of the graph.

We use the definition of upper-uniform graphs from [KR03, Sco11] to define graphs without dense subgraph. We need a slightly stronger definition than what is used in [KR03, Sco11], with an additional requirement also for $U,V$ smaller than $\eta N$.

Definition 4.1** (Upper-uniform graphs).**

A graph $G=([N],E)$ is $(\eta,\gamma)$-upper uniform, if for every two disjoint sets $U,V\subset[N]$, with $\min\left\{\left|U\right|,\left|V\right|\right\}\geq\eta N$ we have that

[TABLE]

and for $U,V$ such that $\min\left\{\left|U\right|,\left|V\right|\right\}<\eta N$,

[TABLE]

We remark that with high probability, a random sparse graph is upper-uniform for constants $\eta,\gamma$.

In this section we use the regularity lemma for sparse graphs from [KR03, Sco11].

Definition 4.2** (Regular sets).**

For graph $G=([N],E)$, the vertex sets $V,U\subset[N]$ are $(\delta)$-regular if for all $U^{\prime}\subset U,V^{\prime}\subset V$ with $\left|U^{\prime}\right|\geq\delta\left|U\right|,\left|V^{\prime}\right|\geq\delta\left|V\right|$ we have

[TABLE]

Theorem 4.2** (Regularity lemma for sparse upper uniform graphs [KR03]).**

For every $\delta,\gamma>0$ there exists $(\eta,m)=\varphi(\delta,\gamma),\eta>0,m\in\mathbb{N}$ such that every $(\eta,\gamma)$-upper uniform graph $G$ has a partition $U_{0},U_{1},\ldots,U_{k}$ with $k\leq m$ such that $\left|V_{0}\right|\leq\delta N$, $\left|V_{i}\right|=\left|V_{j}\right|$ for all $i,j\geq 1$, and all except $\delta k^{2}$ of the pairs $V_{i},V_{j}$ in the partition are $(\delta)$-regular.

We now state and prove the theorem for constructing a dense model for a sparse graph.

Theorem 4.3**.**

For every parameter $\gamma,\varepsilon,\varepsilon^{\prime},\lambda^{\prime}\lambda^{\prime\prime}>0$, such that $\lambda^{\prime}\leq c\lambda\varepsilon^{\prime 2}$ for a sufficiently large constant $c$. Then there exists $\eta\in[0,1]$ such that the following holds. Let $\mathcal{B}$ be a collection of graph-induced support access objects, such that for each $B^{*}\in\mathcal{B}$, the graph it represents $G_{B^{*}}$ is $(\eta,\gamma)$-upper-uniform.

Let $\mathcal{D}$ be a collection of distinguishers. If there exists an $(\varepsilon,\varepsilon^{\prime},\delta^{\prime})$-auditor $\Lambda$ for the collection of sets ${\mathcal{C}}=\left\{(U_{D},V_{D})|D\in\mathcal{D}\right\}$, then there exists an $(\varepsilon,\delta^{\prime\prime})$-learning algorithm $L$ for all $B^{*}\in\mathcal{B}$ with respect to $\mathcal{D}$.

Proof.

At a high level, the proof of the theorem has two parts. In the first, 4.4, we use the regularity lemma for sparse graphs to show that for every upper-uniform graph $G$ there exists a dense graph $H$ that is indistinguishable from $G$. In the second part, we reduce finding a model to our graph $G^{*}$ to finding a model for a dense graph $H$ that is indistinguishable from it.

Let $\delta=\frac{\varepsilon^{\prime 2}}{100\gamma}$ . Let $(\eta^{\prime},m)=\varphi(\delta,\gamma)$, where $\varphi$ is the function from the regularity lemma, Theorem 4.3. Let $\eta=\min\left\{\eta^{\prime},1/(2m),\delta\right\}$.

Let $B^{*}\in\mathcal{B}$ be a graph-induced support-access object, representing a sparse graph $G^{*}$ that is $(\eta,\gamma)$-upper uniform. We remark that $G^{*}$ is also $(\eta^{\prime},\gamma)$-upper uniform, as the upper-regularity is monotone in the $\eta$ parameter.

From 4.4, there exists a graph $H$ with $\rho_{H}\approx 1/\gamma$ such that for all $U,V\subset[N]$,

[TABLE]

Suppose that instead of a graph-induced support-access object $B^{*}$ representing the sparse graph $G^{*}$, we had access to an object $B^{H}$ representing the dense graph $H$. Then, we could have run the learning algorithm from Section 3.3 on $B^{H}$ (treating $B^{H}$ as a function-induced support-access object), and get an implementation of a model $M$ that is $2\varepsilon$-indistinguishable from $B^{H}$. Since the indistinguishability error is additive, $M$ is also $(2\varepsilon+\delta)$-indistinguishable from ${B^{*}}$.

In our case, we do not have access to the object $B^{H}$, and cannot find $H$. Instead, we simulate an auditor with access to $B^{H}$ by our auditor with access to $B^{*}$. Every time that the algorithm queries the auditor $\Lambda^{B^{H},p}$, we instead invoke the auditor $\Lambda^{B^{*},p}$ and forward its answer to the algorithm.

We claim that our simulated auditor is an $(2\varepsilon,\frac{1}{2}\varepsilon^{\prime},\delta^{\prime})$-auditor for $B^{H}$. In fact, a slightly weaker claim suffice. We claim that if $\Lambda^{B^{*},p}$ returns a tuple $((U,V),b)$, then it is also a valid return value for $\Lambda^{B^{H},p}$.

Suppose the auditor $\Lambda^{B^{*},p}$ returned a tuple $((U,V),b)$. Then with probability $1-\delta^{\prime}$ we have

[TABLE]

This is the same as

[TABLE]

From 4.4, we have that

[TABLE]

Together with the fact that $\rho_{H}\in[1/\gamma-12\delta,1/\gamma+12\delta]$ we get that

[TABLE]

For our choice of $\delta$. That is, if the auditor $\Lambda^{B^{*},p}$ returned a tuple $((U,V),b)$, then with probability $1-\delta^{\prime}$, this answer is a valid return value also for $\Lambda^{B^{H},p}$.

If the auditor $\Lambda^{B^{*},p}$ does not return an answer, then $p$ is a $2\varepsilon$ indistinguishable model from $B^{*}$ (see the proof of Theorem 3.15 for more details), so we are done. ∎

Claim 4.4**.**

Let $\gamma,\delta,\eta>0$, be such that $\eta\leq\eta^{\prime},1/(2m),\delta$ for $(\eta^{\prime},m)=\varphi(\delta,\gamma)$. Then for every $(\eta,\gamma)$-upper uniform graph $G$ on vertex set $[N]$, there exists a graph $H$ on vertex set $[N]$ with $\rho_{H}\in[1/\gamma-12\delta,1/\gamma+12\delta]$, such that for every $U,V\subset[N]$, we have that

[TABLE]

Proof.

From the claim requirements, $\eta$ is a constant small enough that the regularity lemma for sparse graphs, Theorem 4.2, holds with $\gamma,\delta$. Therefore, any $(\eta,\gamma)$-upper uniform graph $G$ can be partitioned into $V_{0},V_{1}\ldots,V_{k}$ with $k\leq m$ such that $\left|V_{i}\right|=\left|V_{j}\right|$ for all $i,j\geq 1$, $\left|V_{0}\right|\leq\delta N$ and all except $\delta k^{2}$ of the pairs $V_{i},V_{j}$ are $(\delta)$-regular. Since $\eta\leq\frac{1}{2k}$ and $G$ is $(\eta,\gamma)$ regular, all sets $V_{i},V_{j}$ satisfy $\rho_{G}(V_{i},V_{j})\leq\gamma\rho_{G}$.

We use this partition to construct a dense graph $H$ as follows. For every pair $u,v\in[N]$, add the edge $(u,v)$ to $H$ with probability $p_{u,v}$ defined by:

[TABLE]

From the fact that $\rho_{G}(V_{i},V_{j})\leq\gamma\rho_{G}$, we get that for every $u,v$, $p_{u,v}\leq 1$.

We prove that $H$ satisfies the conditions of the claim. Fix any two sets $U,V\subset[N]$. We start by bounding $\left|E_{G}(U,V)\right|$,

[TABLE]

We bound this sum using the regularity lemma, and dividing into cases.

Exception set: From the regularity lemma, the size of the exception set if bounded by $\delta N$. Using the upper-uniformity condition, intersection with the exception set have:

[TABLE]

and the same holds for $E_{G}(V_{0}\cap U,V)$. 2. 2.

Non-regular sets: At most $\delta k^{2}$ of the sets $V_{i},V_{j}$ in the partition are not regular. We bound the maximal number of edges between these sets:

[TABLE] 3. 3.

Sets with small intersection: For the set $U$, we say that the intersection of $U$ with $V_{i}$ is small, if $\left|U\cap V_{i}\right|\leq\delta\left|V_{i}\right|$. Let $I_{U}\subset[k]$ be the parts that has small intersection with $U$, and $S_{U}=\cup_{i\in I_{U}}\left(U\cap V_{i}\right)$ be their union. Then $\left|S_{U}\right|\leq\delta N$. From the upper-uniformity condition, we have that

[TABLE]

and the same holds for $E_{G}(S_{V},U)$. 4. 4.

Regular sets with large intersection: Let $V_{i},V_{j}$ be a $(\delta)$-regular pair, such that $\left|V_{i}\cap U\right|\geq\delta\left|V_{i}\right|$ and $\left|V_{j}\cap V\right|\geq\delta\left|V_{j}\right|$. Then according to the regularity lemma,

[TABLE]

Combining all of the cases together, if we call $i,j\in[k]$ good if $V_{i},V_{j}$ is regular, and $U,V$ have large intersection with $V_{i},V_{j}$ we have that

[TABLE]

Similarly, we get a lower bound

[TABLE]

We now bound $\left|E_{H}(U,V)\right|$. The graph $H$ is generated such that each edge is sampled uniformly at random with probability $p_{u,v}$. For all good $i,j$, We have that if $u\in V_{i},v\in V_{j}$, then $p_{u,v}=p_{i,j}=\frac{\rho_{G}(V_{i},V_{j})}{\rho_{G}\gamma}$. Since $\left|V_{i}\right|,\left|V_{j}\right|=\Theta(N)$, we have from Chernoff bound that with high probability,

[TABLE]

There are at most $5\delta N^{2}$ pairs of vertices $(u,v)$ that do not belong into a good pair of parts $V_{i},V_{j}$.

Together we get that

[TABLE]

The above equation also implies that $\rho_{H}\in[1/\gamma-12\delta,1/\gamma+12\delta]$, by applying it with $U=V=[N]$. ∎

Next we show that a sparse graph with a dense subgraph does not have a dense indistinguishable model. This does not mean that it is not possible to learn a sparse graph with a dense subgraph, but it indicates that our approach have certain limits. This claim is not tight, in a sense that there are graphs do not satisfy the claims of Theorem 4.3, and we do not know if they have a dense model.

Claim 4.5**.**

Let $G$ be a graph, if there exists a distinguisher $D$ with vertex sets $U,V$ such that $\left|U\right|,\left|V\right|\geq\varepsilon N$ and

[TABLE]

then there is no graph $H$ with $\rho_{H}=1/\gamma$ that is $\delta$-indistinguishable from $G$ to $D$.

Proof.

If $H$ and $G$ are indistinguishable, it must be that

[TABLE]

This is the same as

[TABLE]

This means that

[TABLE]

which is a contradiction as $\rho_{H}(U,V)\leq 1$ and $\rho_{H}=1/\gamma$. ∎

4.3 Learning Sparse Uniform Out-degree Graphs

In this section we are interested in learning a sparse directed graph $G^{*}=(\{0,1\}^{n},E^{*})$, such that each $x\in G^{*}$ has a uniform constant out degree $d$. We assume $B^{*}$ is the object representing the graph $G^{*}$, and upon querying $B^{*}(\bot)$ outputs a random edge according to the following distribution: choose a random $x\in[N]$, then a random neighbor of $x$.

If we denote the $d$ outgoing edges from each $x$ as $d$ functions, $f_{1},\ldots,f_{d}:\{0,1\}^{n}\rightarrow\{0,1\}^{n}$, then learning $B^{*}$ is rather similar to learning these $d$ functions. Using this notations, a random edge from $B^{*}(\bot)$ corresponds to a pair $(x,f_{i}(x))$ for a random $x\in\{0,1\}^{n},i\in[d]$. If we would also assumes that the sample contains the index $i$, i.e. that $B^{*}(\bot)$ returns a random triplet $(x,i,f_{i}(x))$, then this would be exactly equivalent to learning the functions $f_{1},\ldots,f_{d}$, and the result of Section 3.4 would translate automatically. Without this additional assumption we need to do a bit more work in order to translate the result of Section 3.4 into the graph object.

We formally describe the object, the class of distinguishers that we can work against and the auditor.

The object $B^{*}$ is a graph-induced support access object to a directed graph $G=(\left\{0,1\right\}^{n},E)$ with out-degree $d$ for a constant $d$. The edge distribution is choosing a uniform $x\in\left\{0,1\right\}^{n}$ and then a random neighbor $y$ of $x$. We assume an order over the $d$ neighbors of each vertex, and denote by $f_{1},\ldots,f_{d}:\left\{0,1\right\}^{n}\rightarrow\left\{0,1\right\}^{n}$ to be $d$ functions representing the neighbors of the vertices in the graph.

Distinguishers:

Let $\mathcal{D}$, such that each distinguisher $D\in\mathcal{D}$ has an set $S_{D}\subset\left\{0,1\right\}^{n}$ and a coordinate $j\in[n]$. The distinguisher $D$ accept an edge $(u,v)$ if $u\in S_{D}$ and $v_{j}=1$.

Auditor:

Let $\mathcal{D}$ be defined as above. We say that an algorithm $\Lambda^{B^{*},p}$ is an $(\varepsilon,\gamma,\delta)$ auditor for the collection of sets $\mathcal{S}$ if it has the following properties. Given access to a graph-induced support access-object $B^{*}$ and query access to a predictor $p:\left\{0,1\right\}^{n}\rightarrow[0,1]$. If there exists $S\in\mathcal{S}$ and $j\in[j]$ such that

[TABLE]

Then the auditor returns a set $S^{\prime},j$ such that with probability $1-\delta$,

[TABLE]

The probability is uniform among all $x\in[N],i\in[d]$.

Theorem 4.6**.**

Let $\mathcal{B}$ be a collection of support access graph objects induced by $d$ functions $f_{1},\ldots,\allowbreak f_{d}:\left\{0,1\right\}^{n}\rightarrow\left\{0,1\right\}^{n}$. Let $\mathcal{D}$ be a collection of distinguishers as described above.

Let $\varepsilon,\gamma,\delta^{\prime},\delta^{\prime\prime}$ be parameters such that $\delta^{\prime}\leq c\delta\gamma^{2}n^{-1}$ for a sufficiently small constant $c$. Let $\Lambda$ be an $(\varepsilon,\gamma,\delta^{\prime})$ auditor $\Lambda$ for $\mathcal{D}$. Then there exists a $(2\varepsilon,\delta)$-learner $L$ to $\mathcal{B}$ with respect to the distinguisher class $\mathcal{D}$, and the learner $L$ runs in time $\mathrm{poly}(\gamma^{-1}\log(\delta^{-1})\alpha^{-1},W_{1},W_{2})$, where $W_{1}$ is the running time of the auditor $\Lambda$ and $W_{2}$ the circuit complexity of its output. The implementation $T$ that the learner outputs runs in time $\mathrm{poly}(\gamma^{-1}\log(\delta^{-1})\alpha^{-1},W_{2})$

We prove the theorem in a similar way to the proof of Theorem 3.20. The learner $L$ and the implementation $T$ are the same as in the function, only we apply the same predictor $d$ times to get $d$ outgoing edges out of every vertex in the graph, and verify that the endpoints are distinct.

Implementation:

Given a list $F$ of tuples $(S,j,w)$, the implementation algorithm $T$ with oracle access to a random oracle $R$ generates a model $\hat{B}$. Given $x\in\left\{0,1\right\}^{n}$ the algorithm $T$ outputs $v$ by:

1. 1.

For every $j\in[n]$ calculate $p_{j}\in[0,1]$ by:

[TABLE] 2. 2.

For $t=1$ to $d$, choose a vertex $v^{(t)}$ by setting $v^{(t)}_{j}=1$ with probability $p_{j}(x)$, using the random oracle $R(v,t)$. 3. 3.

If all of the vertices $v^{(t)}$ are distinct, choose a uniform $i\in[d]$ and return $v^{(i)}$. If there is a collision, go back to Item 2 and repeat with new randomness from the random oracle.

We remark that since $d$ is constant and the domain $\{0,1\}^{n}$ is exponentially large, collisions are very unlikely. When analyzing the distribution of the model over large sets of vertices we can ignore this event.

Learning Algorithm:

The learning algorithm $L$.

1. 1.

Initialization: set $F=\left\{(\left\{0,1\right\}^{n},j,1/2)|j\in[n]\right\}$. 2. 2.

Query the auditor with the current model and $B^{*}$. If the auditor returns $(S,j,b)$, add $(S,j,b\cdot\gamma)$ to $F$ and repeat .

Notice that the learner is identical to the classic boosting algorithm, where we apply it individually on each of the coordinated of $\sum_{i\in[d]}f_{i}(x)$. This is the reason that we can only be indistinguishable with respect to a set of distinguishers $D$ that only check if a single output coordinate in $f(x)$ equals $1$.

Proof of Theorem 4.6.

The proof is the same as the proof of Theorem 3.20, except the averaging over $i\in[d]$. The probability of collision on Item 2 is negligible, so we can safely assume independence between the $d$ outgoing edges.

If the auditor does not output any set then the model is $\varepsilon$-indistinguishable for all $D\in\mathcal{D}$.

We prove the correctness using a potential function, which sums over the error of each coordinate $j\in[n]$. Let

[TABLE]

Every $x$ appears in the sum $n\cdot d$ times, therefor the initial value of $\varphi$ is bounded by $n\cdot 2^{n}$.

Let $p_{1},\ldots,p_{n}$ be the predictors after before the execution of Item 2 and $p^{\prime}_{1},\ldots,p_{n}^{\prime}$ afterwards, then we claim that with probability $1-\delta^{\prime}$ we have that $\varphi(B^{*},p_{1},\ldots,p_{n})-\varphi(B^{*},p^{\prime}_{1},\ldots,p_{n}^{\prime})\geq\gamma^{2}2^{n}$.

The auditor returned $(S,i,b)$, then

[TABLE]

Assume without loss of generality that $b=1$, then with probability $1-\delta$,

[TABLE]

If there is not capping, we have

[TABLE]

where we use eq. 25 in the last inequality.

The values of $\operatorname{\mathbb{E}}_{i\in[d]}[\mathbf{1}(f(x)_{j}=1)]$ are in $[0,1]$, therefore capping the value of $p_{i}$ to $[0,1]$ can only lower the value of the potential function. ∎

4.4 Learning Uniform Degree Graphs

Suppose we are interested in generating a truthful model for a uniform degree $d$ graph. That is, we want that all graph in our model has a uniform degree $d$. In Section 4.1, we discussed applying the results from learning functions to learning graphs, and have a truthful model for a directed graph with a uniform out-degree, assuming the graph is dense. In the previous section, we also saw how to have a sparse directed graph with uniform out-degree.

For undirected graphs, in [GGN10] the authors showed an algorithm for generating a uniform degree graph that is indistinguishable from a random uniform degree graph. Their algorithm applies a random permutation on a large girth uniform degree expander graph.

We are interested in generating a model $M$ that is indistinguishable from a specific graph-induced object $B^{*}$. Therefore, it is not possible to use the same approach. Instead, we are restricting the set of distinguishers to those that can be described by a partition over the set of vertices, and show how to create a uniform degree graph in this case. Our construction is simple - we sample and approximate the edge density between every two parts in the partition induced by the distinguishers, and the model is a random permutation over a deterministic graph with the correct edge density.

Distinguishers:

Then the set of distinguishers $\mathcal{D}$ contains distinguishers $D$ with sets $(U_{D},V_{D})$ such that $U,V\in\mathcal{U}$. Every distinguisher $D$ accepts an edge $(u,v)$ if $u\in U,v\in V$. Let $\mathcal{U}=\left\{U\subset[N]|\exists D\textbf{ s.t. }U=U_{D}\text{ or }U=V_{D}\right\}$. We assume that $\mathcal{U}$ is a partition with $t$ parts, and that $\left|U_{J}\right|$ is linear in $N$.

Lemma 4.7**.**

Let $\mathcal{B}$ be a collection of graph-induced support-access objects, such that for all $B^{*}\in\mathcal{B}$, the graph $G_{B^{*}}$ has a uniform degree $d$. Let $\mathcal{D}$ be the distinguishers class defined above. Then for every constant $\varepsilon$ there exists an $(\varepsilon,\delta)-$ learning algorithm $L$ for the class $\mathcal{B}$ with respect to $\mathcal{D}$. The algorithm runs in time $\mathrm{poly}(1/\varepsilon,\log(1/\delta))$.

We describe an implementation and a learning algorithm:

Representation:

The model $M$ is represented by the partition $\mathcal{U}$, and by a function $k:\binom{t}{2}\rightarrow\mathbb{N}$. The function $k$ represents the number of edges between every two parts. We assume that it satisfies for all $j\in[t]$ we have $\sum_{i\in[t]}k(\left\{i,j\right\})=d\cdot\left|U_{j}\right|$.

Implementation:

The implementation $T$ with a random oracle $R$ on partition $\mathcal{U}$ and function $k$. It samples a random $u\in[N]$ it outputs an edge $(u,v)$ by:

1. 1.

Let $U_{j}\in\mathcal{U}$ be the part in the partition that $u$ belongs to. We assume there is a deterministic order on the vertices in $U_{j}$, $u_{1},\ldots,u_{\left|U_{J}\right|}$. 2. 2.

Choose a random $\ell\in[d]$. 3. 3.

Let $E_{U_{j}}$ be a list of all the outgoing edges from $U_{j}$, by following order:

[TABLE]

Let $F_{U_{j}}\in[t]^{\left|E_{U_{j}}\right|}$ be the vector: $F_{U_{j}}=(1^{k(\left\{j,1\right\})},2^{k(\left\{j,2\right\})},\ldots,t^{k(\left\{j,t\right\})})$. That is, $1$ appears exactly $k(j,1)$ times in $F_{U_{j}}$. 4. 4.

Calculate $i=F_{U_{j}}(u^{\ell})$. 5. 5.

Use $R$ to apply a random matching between $\left\{(u^{\prime},l^{\prime})\in U_{j}|F_{U_{j}}((u^{\prime})^{l^{\prime}})=i\right\}$ to the set $\left\{(u^{\prime},l^{\prime})\in U_{i}|F_{U_{i}}((u^{\prime})^{l^{\prime}})=j\right\}$. Note that both sets have size $k(\left\{i,j\right\})$. For $i=j$, pick an arbitrary matching that does not map any element to itself. If any vertex $u^{\prime}$ appears in the set more than once, pick a matching from $U_{j}$ to the matching set in $U_{i}$, then for the second edge of $u^{\prime}$ pick a shift of the matching (and vice verse). 6. 6.

Let $v\in U_{i}$ be the vertex matched to $(u,\ell)$ in the above random matching, output $v$.

We remark that the random permutation is picked to be inevitable, such that if $v$ is picked, then the corresponding neighbor would be $u$.

Learning algorithm:

We describe an algorithm for learning the function $k$.

1. 1.

Sample edges from $B^{*}$, let $S=(u_{1},v_{1}),\ldots,(u_{m},v_{m})$ be the sample. For every $i,j\in[t]$ set $k(\left\{i,j\right\})$ by for $i\neq j$

[TABLE]

and for $i=j$ twice this value. 2. 2.

For every $i\in[t]$, calculate $e_{i}=\sum_{j\in[t]}k(\left\{i,j\right\})-d\left|U_{i}\right|$. 3. 3.

If there exists $i\in[t]$ such that $\left|e_{i}\right|\geq d\varepsilon/2\left|U_{i}\right|$, quit the algorithm and output an arbitrary $k$ such that $e_{i}=0$ for all $i$. 4. 4.

While there exists $i$ with $e_{i}\neq 0$: Pick $i$ with $e_{i}>0$ and $i^{\prime}$ with $e_{i^{\prime}}<0$. Pick a random $j\in[t]$, such that it is possible to decrease $k(\left\{i,j\right\})$ by $1$ and increase $k(\left\{{i^{\prime}},j\right\})$ by $1$, and do so.

Remark 4.1**.**

The initial value $k(\left\{i,j\right\})$ on the first item are created such that $\sum_{i,j\in[t]}k(i,j)=2dN$, and therefore we have $\sum_{i\in[t]}e_{i}=0$. This means that in Item 4, if there is $i$ with $e_{i}>0$ then there must also be $i^{\prime}$ with $e_{i^{\prime}}<0$. Therefore, the correction algorithm always ends.

The implementation $T$ outputs exactly $d$ neighbors for each vertex $u\in U$. We prove that the resulting model is indistinguishabile for every $D\in\mathcal{D}$.

Proof of Lemma 4.7.

We start by proving that with high probability over the samples of the learning algorithm, we have $\left|e_{i}\right|<\frac{\varepsilon}{2}\left|U_{i}\right|$ for all $i\in[N]$.

Fix some $i\in[t]$. The specification graph $B^{*}$ has uniform degree $d$, which implies that

[TABLE]

For every edge $(u,v)$ sampled, let $I_{(u,v)}$ be the indicator random variable that this edge contributes to $k(\left\{i,j\right\})$ for some $j\in[t]$. Then we know that the expected value of $\sum_{(u,v)\in S}I_{(u,v)}=\frac{\left|U_{i}\right|}{N}\cdot\left|S\right|$. Therefore, by chernoff bound, with probability $\exp(\frac{\left|U_{i}\right|}{N}\cdot\left|S\right|\varepsilon^{2})$, all approximations are within $\varepsilon/2$ form the expected value.

The corrections on the value of $k$ on Item 4 are negligible, as they correct at most $t^{2}d$ edges per group $U_{j}$ of size linear in $N$.

Let $D$ be a distinguisher with sets $U_{i},U_{j}$ in the partition. Then by the model, the probability that an edge is sampled with $U_{i},U_{j}$ is $k(\left\{i,j\right\})/(dN)$. Therefore, if $k_{i,j}$ are correct up to an $\varepsilon/2Nd$ factor, the model is indistinguishable for $D$. ∎

5 Impossibilities

A main difference in our work from [GGN10] is in the target distribution/object we aim to be indistinguishable from. In [GGN10], the target distribution is fixed and uniform over many objects, whereas in our setup the target is a single object which is initially unknown, and a learner is needed to access the target object to make it possible to create an indistinguishable model. This difference makes our setup challenging, and below we show example tasks that are impossible to achieve in our setup because of this difference.

Fooling Distinguishers with Entry-Access is Hard.

In [GGN10], the distinguishers can query for specific entries of an object. Such distinguishers can be impossible to fool in our setup. For example, suppose the target object $B^{*}$ is the entry-access object induced by a function $f^{*}:X\to\{0,1\}$ (Definition 2.3), and suppose our learner aims to output a model $M$ of entry-access objects $B$ induced by functions $f:X\to\{0,1\}$. For every $x\in X$, suppose there is a distinguisher that queries for the value of $f(x)$ and outputs “accept” if and only if $f(x)=1$. To fool these distinguishers, we have to learn the target function $f^{*}$ exactly, which is clearly impossible if the domain $X$ has exponential size and the learner can only make polynomially many queries.

Theorem 5.1**.**

Let $X$ be a non-empty finite set. Let $\mathcal{B}$ be the class of entry-access objects induced by all functions $f:X\to\{0,1\}$. Let $\mathcal{D}$ be the class of distinguishers $D_{x}$ for every $x\in X$ where given an object $B$, the distinguisher $D_{x}$ outputs “accept” if and only if the answer $a\sim B(x)$ is equal to $1$. Let $L$ be an $(\varepsilon,\delta)$-learner for the class $\mathcal{B}$ w.r.t. $\mathcal{D}$ for $\varepsilon,\delta<1/2$. Then $L$ needs to query every input $x\in X$ in the worst case.

Proof.

For the sake of contradiction, let us assume that whenever $L$ outputs a model, there always exists $x\in X$ that is not queried by $L$. Consider the case where the target object $B^{*}\in\mathcal{B}$ is drawn uniformly at random. That is, $B^{*}$ is induced by $f^{*}:X\to\{0,1\}$ chosen randomly such that for every $x\in X$, $f^{*}(x)$ is distributed independently and uniformly from $\{0,1\}$. When $L$ outputs a model $M$ given entry access to the random target model $B^{*}$, the conditional distribution of $f^{*}(x)$ for the $x\in X$ not queried by $L$ is still the uniform distribution over $\{0,1\}$, and thus with conditional probability at least $1/2$ over the randomness in $f^{*}$, it holds that $\Pr_{B\sim M,a\sim B(x)}[a=f^{*}(x)]\leq 1/2$, and thus

[TABLE]

By the law of total probability, with (unconditional) probability at least $1/2$, there exists a distingsher $D\in\mathcal{D}$ such that

[TABLE]

This contradicts the fact that $L$ is an $(\varepsilon,\delta)$-learner with $\varepsilon,\delta<1/2$. ∎

Learned Model Needs to be Stronger than Distinguishers.

The model learned in [GGN10] can fool distinguishers with significantly larger circuit complexity than the model itself. Below we show that this can become impossible in our setup where the target is a single object.

Theorem 5.2** (Remark 1.6 in [TTV09]).**

Let $n,W>1$ be positive integers satisfying $W\log W\leq 2^{n}/C$ for a sufficiently large absolute constant $C>0$. There exists a sample-access object $B^{*}$ induced by a function $f^{*}:\{0,1\}^{n}\to\{0,1\}$ and a distinguisher $D$ with circuit complexity $\tilde{O}(nW)$ such that for any model $M$ with circuit complexity at most $W$, it holds that

[TABLE]

Proof.

Define $k:=CW\log W\leq 2^{n}$. By known constructions of $k$-wise independent hash functions [CW79, WC81], there exists a distribution over $f^{*}:\{0,1\}^{n}\to\{0,1\}$ with the following properties:

for any distinct $x_{1},\ldots,x_{k}\in\{0,1\}^{n}$, the $k$-tuple $(f^{*}(x_{1}),\ldots,f^{*}(x_{k}))$ is distributed uniformly from $\{0,1\}^{k}$; 2. 2.

every $f^{*}$ drawn from the distribution has circuit complexity $\tilde{O}(nk)=\tilde{O}(nW)$.

Consider any fixed model $M$. By concentration inequalities for $k$-wise independent random variables [BR94], it holds that

[TABLE]

Choosing $C$ to be sufficiently large and applying the union bound over all $2^{O(W\log W)}$ models of circuit size at most $S$, there exists $f^{*}$ with circuit complexity $\tilde{O}(nW)$ such that for every model $M$ with circuit size at most $W$,

[TABLE]

Now we choose $D$ to be the distinguisher that on a sample $(x,y)$ outputs “accept” if and only if $y=f^{*}(x)$. Inequality (28) implies

[TABLE]

Let $B^{*}$ be the object induced by $f^{*}$. By our definition of $D$ and $B^{*}$, we have $\Pr[D^{B^{*}}=\textup{``accept''}]=1$. Combining this with (29), we get (27) as desired. ∎

The Distinguisher Class Needs to be Learnable.

Since the target distribution in [GGN10] is fixed, no learning is needed in order to produce an indistinguishable model. In our setup, the learning task is usually performed using an auditor, which can be viewed as a weak agnostic learner for the class of distinguishers. A natural question is whether we can still achieve indistinguishability if such a weak agnostic learner does not exist. Previous works [HJKRR18, GHK*+*23] have shown negative answers to this question for certain notions of indistinguishability (such as calibrated multiaccuracy) by showing that these notions imply (strong) agnostic learning for the distinguisher class. The indistinguishability notion we use for generative models is closer to multiaccuracy, and below we show that efficiently achieving this notion requires the distinguisher class to be efficiently realizably learnable. For a true function $f^{*}:X\to\{0,1\}$, multiaccuracy requires a predictor $p:X\to[0,1]$ to satisfy

[TABLE]

for every function $g$ in a class $\mathcal{G}$. Now consider the case where $\mathcal{G}$ consists of functions $g:X\to\{-1,1\}$. For an arbitrary $g^{*}\in\mathcal{G}$, suppose the true function $f^{*}$ satisfies $f^{*}(x)=1$ if $g^{*}(x)=1$ and $f^{*}(x)=0$ if $g^{*}(x)=-1$. Then (30) implies

[TABLE]

Now we define $\hat{g}(x)=1$ if $p(x)\geq 1/2$, and define $\hat{g}(x)=-1$ if $p(x)<1/2$. It is easy to check that if $\hat{g}(x)\neq g^{*}(x)$ for some $x\in X$, then $|f^{*}(x)-p(x)|\geq 1/2$, and thus (31) implies the following realizable learning guarantee for the class $\mathcal{G}$:

[TABLE]