\documentclass[11pt]{article}

\usepackage{lecture}

\begin{document}

\lecture{16}{3/18/2013}{$\RL$ is in $\L^{1.5}$}{Lubos Krcal}

\draft

In Lecture~15, we have seen two pseudorandom generators that use a 
seed of length $\log^2 n$ and produce pseudorandomness for 
$\RL$-machines.
This time, we will see that every randomized logspace machine with 
bounded error can be simulated by a deterministic machine that 
uses~$\log^{1.5} n$.
All of these results can be easily transferred to \BPL-machines, where 
the error can be two-sided.

\section{The idea}

Recall that Nisan's generator consisted of two phases:
In the first phase, a logarithmic number~$k\sim\log n$ of hash 
functions is chosen; to sample a single hash function, a logarithmic 
number of random bits are required, and thus, the outer seed consists 
of $O(k\log n) = O(\log^2 n)$ random bits.
In the second phase, an inner seed of logarithmic length~$m\sim\log n$ 
chosen and the output is computed using at most a logarithmic amount 
of additional work space.
It is this discrepancy between the logarithmic space requirement of 
the second phase and the quadratically logarithmic length of the outer 
seed length that we will be able to trade off with each other to get 
an overall seed length of~$O(\log^{1.5} n)$.

A natural idea for decreasing the seed length of the outer seed is to 
simply choose fewer hash functions and reuse them a few times.
In particular, we want to choose $k << \log n$ so that $k\log n << 
\log^2 n$.
We will see below that we can in fact do so if we are willing to pay 
for it with an increased space requirement of the inner phase.
In the construction and analysis below, the space requirement for the 
inner phase will eventually go up to $\frac{\log n}{k}\cdot \log n$.
The two quantities $k\log n$ and $\log^2 n/k$ embody the trade off 
mentioned above, and they are simultaneously minimized if $k\sim 
\sqrt{\log n}$, which is how the bound of $\log^{1.5} n$ comes about.

We will first attempt to pick a single hash function, fail, and 
successively try to make this idea work.


%We have seen in Theorem~\ref{lect15:theorem: strong Nisan} of , we 
%know that Lecture~15 that, for any branching program of polynomial 
%width and length, the first phase produces, with very high 
%probability, a sequence of~$k$ hash function with respect to which 
%Nisan's generator is pseudorandom for the given branching program.

\section{Attempt 1: Pick only a single hash function}

Na{\"i}vely, we might pick a single hash function $h_1:\zo^m\to\zo^m$ 
from the distribution $\mathcal H$ and set $h_2=\dots=h_k=h_1$.
This is not so unreasonable since the concentration result for Nisan's 
generator, Theorem~\ref{lect15:theorem: strong Nisan} in Lecture~15, 
implies that $G_{h_1}:\zo^m\to\zo^{2m}$ is with high probability a 
pseudorandom walk generator for a given branching program~$B$: That 
is, it only requires $m$ bits of seed but produces randomness that $B$ 
cannot distinguish from $2m$ uniform bits.
At least on the surface, this is similar to the derandomized squaring 
based on expander graphs that we discussed in Lecture~14.
The idea to simply apply the same derandomized squaring~$k$ times to 
get $r\leq 2^km$ pseudorandom bits out then directly leads to our 
attempt to choose all hash functions to be equal.

More formally, we define the \emph{derandomized square} of a branching 
program~$B:[r-1]\times[w]\times\zo^m\to[r]\times[w]$ with respect to a 
function $h:\zo^m\to\zo^m$ to be the branching program
$B_{h} : [r-2]\times[w]\times\zo^m \to [r]\times[w]$ where $B_{h}  
(s;\sigma)\doteq B(s;G_{h}(\sigma))$ holds for all 
states~$s\in[r-2]\times[w]$.
Since $r=2^k$ and $G_{h}(\sigma)$ is $2m$ bits long, we can drop all 
states $s=(i,*)$ for odd numbers $i$; thus, the length of the 
derandomized square is $r/2$, half of the length of~$B$, and its width 
is again at most~$w$ since the computation of $G_h(\sigma)$ is hidden 
in the non-uniformity of the branching program model (this is why we 
make the branching program read a block of length~$m$ in each step, 
which we can do without loss of generality since any pseudorandom 
generator for this model will also be pseudorandom for the usual model 
with block length~$1$).

An immediate consequence of Nisan's pseudorandomness guarantee is that 
the derandomized square of a branching program has a similar behavior 
as the original, which we formalize below.
\begin{lemma}\label{lemma: dersquare}
  For all $k$, $w$, and $\epsilon>0$, there is an $m \sim \log r + 
  \log w + \log(1/\epsilon)$ such that, for every branching 
  program~$B:[r-1]\times[w]\times\zo^m\to[r]\times[w]$ of 
  length~$r=2^k$ and width~$w$ and for all states $s$ of $B$, we have
  \begin{align}\label{eq: Nisan concentration}
    \Pr_{h_1\sim\mathcal H}
    \Big[\;
    \sdist \Big( B_h(s;U_{m}) \;,\; B(s;U_{2m}) \Big) < \epsilon\;
    \Big] \geq 1-\frac{1}{\poly(r)}\,.
  \end{align}
\end{lemma}
Note that the distributions in \eqref{eq: Nisan concentration} are 
over states two layers after $s$.

If we iterate the derandomized square process with hash functions 
$h_1,\dots,h_k$ sampled from $\mathcal H$ independently, 
Lemma~\ref{lemma: dersquare} implies that $B_{h_1,h_2,\dots,h_k}$ is 
$k\epsilon$-close to the original branching program, except with 
probability at most $k/\poly(r) = 1/\poly(r)$.
Another reason why this is true is the fact that 
$B_{h_1,\dots,h_k}(s;\sigma)=B(s;G_{h_1,\dots,h_k}(\sigma))$
holds, and Nisan's generator has the stated property.

In light of Lemma~\ref{lemma: dersquare}, it is tempting to use the 
same hash function $h_1=\dots=h_k$.
However, it is not hard to see that Nisan's generator 
$G_{h_1,\dots,h_1}$ fails to be pseudorandom in this case since there 
exists a simple distinguisher~$D$ that can tell the generator's output 
apart from a uniform distribution:
For example, if $k=2$, we have $G_{h_1,h_1}(\sigma)=\sigma \circ 
h_1(\sigma) \circ h_1(\sigma) \circ h_1(h_1(\sigma))$.
A branching program~$D$ of width two can then store the $(m+1)$st bit 
and compare it to the $(2m+1)$st bit.
If they are equal, the branching program will guess that the 
distribution is not uniform.
Indeed, in the uniform case the bits are equal with 
probability~$\frac{1}{2}$ whereas they are always equal under the 
output distribution of $G_{h_1,h_1}$.
In other words, we have $\sdist(D_{h_1,h_1}(s;U) , D(s;U)) \geq 1/2$ 
for \emph{all} functions~$h_1$ when $s$ is the start state, and 
\eqref{eq: Nisan concentration} cannot hold.
Therefore, we have to do something slightly more clever if we are to 
reuse the same hash function.

%
%\begin{lemma}
%After one step, the statistical distance between the squared 
%automaton and the pseudorandomly squared automaton is still good over 
%$h_1$.
%
%\begin{equation}
%\label{eq1}
%\sdist(Q^2,Q_{h_1}) < \epsilon \ \text{with high probability}
%\end{equation}
%
%The same holds for $Q^2$. But the distance between $Q^4$ and 
%$(Q{h_1})_{h_1})$ is bigger than some constant, let's say $\frac12$.
%$$\sdist((Q^2)^2,(Q^2)_{h_1}) < \epsilon \ \text{with high 
%probability}$$
%$$\sdist((Q^2)^2,(Q_{h_1})_{h_1}) \ge \ \frac12$$
%\end{lemma}

\subsection{Attempt 2: Decoupling by Rounding}
We have seen in the last section that we cannot simply re-use the same 
hash function in Nisan's generator.
Formally, the reason that Lemma~\ref{lemma: dersquare} fails to give a 
guarantee for the branching program $B'=B_{h_1}$ after the first 
iteration is that the second hash function~$h_2$ is assumed to be 
independent if we were to reapply Lemma~\ref{lemma: dersquare}, but we 
don't do that since we chose it to be equal to $h_1$.
However, if we can start from $B_{h_1}$ and modify it a little bit to 
get to a related $B'$ that is \emph{independent} from~$h_1$, then we 
can pick $h_1$ such that $B_{h_1}$ is a good approximation for $B$ and 
\emph{simultaneously} $B'_{h_1}$ is a good approximation for $B'$, 
which would enable us to hold on to the idea of choosing the same hash 
function in each derandomized squaring step.
This ``modification'' of $B_{h_1}$ will no longer work in a black-box 
way, but recall that we have the relaxed goal to derandomize~$B$ in as 
little space as possible in a possibly non-black-box way.
This means that we are given $B$ as \emph{input} to a Turing machine 
and we are allowed to transform it arbitrarily; we first transform it 
into $B_{h_1}$ and then decouple it from $h_1$ to obtain $B'$.

To see what good candidates for this ``decoupled'' $B'$ could be, note 
that $B_{h_1}$ \emph{is} a good approximation for $B$, so $B'$ should 
also be something close to $B$ that is, however, independent 
from~$h_1$.
We cannot choose $B$ itself since it is not clear how to get from 
$B_{h_1}$ back to $B$, and in fact, some information about~$B$ may 
have gotten lost in $B_{h_1}$.
To get a clue, let us look back at \eqref{eq: Nisan concentration} and 
only consider the good case for $h_1$.
Then the $1$-norm interpretation of the statistical distance states 
that
$\sum_{t\in\text{next even layer}} |{\Pr(B_h(s;U)=t)} - 
{\Pr(B(s;U)=t)}| < 2\epsilon$ holds for all states~$s$ in an even 
layer.
This implies that $\Pr(B_h(s;U)=t)$ and $\Pr(B(s;U)=t)$ are equal up 
to an additive error of at most~$2\epsilon$.
In particular, it seems very likely that the binary expansions of
\newcommand{\accuracy}{{M}}
these two numbers coincide in their first $\accuracy=\log(1/\epsilon) 
/ 100$ most significant bits, and that the only part of the 
probabilities that depends on~$h$ is in the lower-order bits.
It is then natural to cut the lower-order bits off, which simply 
corresponds to rounding down to an integer multiple of $2^{-M}$.
Thus, we can define $B'\doteq\lfloor B_h\rfloor_\accuracy$ such that 
the probabilities are rounded down to the first $\accuracy$ positions.
The hope is that the probabilities and $B'$ itself will be independent 
from $h$.
Moreover, when $B_{h}$ is given, a description of $B'$ can be computed 
in space $O(m+\log w + \log r + \log(1/\epsilon))$.
We leave this fact as an exercise.
\begin{exercise}\label{rounding}
  There is a deterministic algorithm that, when given a branching 
  program $B$ of length~$r$, block length~$b$, and width~$w$, and 
  given a number~$\epsilon>0$ so that $\accuracy\doteq\log(1/\epsilon) 
  / 100 \leq m$, computes a branching program~$\lfloor B 
  \rfloor_\accuracy$ of length~$r$, block length~$m$, and width~$w$ 
  that satisfies
  \begin{align}\label{eq: rounded}
    \Pr(\lfloor B\rfloor_\epsilon(s;U_m)=t) = 
    \lfloor\Pr(B(s;U_b)=t)\rfloor_\accuracy\,,
  \end{align}
  for all states $s$ in the $i$-th layer and all states $t$ in the 
  $(i+1)$-st layer.
  Moreover, the algorithm uses space $O(m+b+\log(wr/\epsilon))$ and 
  the program $\lfloor B \rfloor_\accuracy$ depends only on the 
  right-hand side of \eqref{eq: rounded} (and not on the structure of 
  $B$).

  The rounded program approximates the original in the following 
  sense: For all states~$s$,
  \begin{align}
    \sdist\Big(\lfloor B\rfloor_\accuracy(s;U_m),B(s;U_b)\Big)
   & \leq w 2^{-M}=O(\epsilon w)\,.
  \end{align}
\end{exercise}

So our second attempt for obtaining a derandomization of $B$ proceeds 
as follows: We are given~$B$ of length~$r=2^k$ and with block 
length~$m$ as input, and we pick a single hash function $h\sim\mathcal 
H$.
Then we compute the branching program $P_k$ defined iteratively as 
follows:
\begin{align*}
  P_0 &\doteq B\\
  P_{i+1} &\doteq \lfloor B_h \rfloor_\accuracy\,.
\end{align*}
The block length of all these programs is~$m\sim\log r$, and the 
length of $P_i$ is $r/2^i$.
Therefore, $P_k$ has length one and can be fully derandomized by brute 
force.
By Lemma~\ref{lemma: dersquare}, we know that one step in~$B_h$ is 
$\epsilon$-close to two steps in~$B$.
So we can compare the above sequence to the ``truly random'' sequence:
\begin{align*}
  T_0 &\doteq B\\
  T_{i+1} &\doteq \lfloor B^2 \rfloor_\accuracy\,.
\end{align*}
In this sequence, the block length of $B^2$ is~$2m$, but the rounding 
cuts the block length back to~$m$ and we loose some precision in the 
lower-order bits.
In the truly random sequence, we iteratively apply 
Exercise~\ref{rounding} and get that $T_k$ and $B^{2^k}$ are 
$O(kw\epsilon)$-close in statistical distance.

Recall that our goal is to apply Lemma~\ref{lemma: dersquare} 
\emph{once} to find an $h$ that bounds the distance between $P_i$ 
and~$T_i$ for \emph{all} $i\in[k]$ simultaneously.
This would indeed be possible by a simple application of the union 
bound if the rounding made the $P_i$'s independent from $h$.
We have not quite achieved that goal yet:
Consider the case in which $B$ transitions from $s$ to a state $t$ two 
layers after~$s$ with probability exactly $p=7 \cdot 2^{-M}$.
Then Lemma~\ref{lemma: dersquare} guarantees that, for most choices 
of~$h$, the program $B_h$ transitions from $s$ to $t$ with probability 
$2\epsilon$-close to $p$; this probability could be $<p$ or $\geq p$.
In the former case, $P_1$ would round this probability down to $6\cdot 
2^{-M}$, and in the latter case it would get rounded down to $7\cdot 
2^{-M}$.
Note that $M$ was chosen so that $\epsilon = 2^{-100 M}$, so only 
these two cases can occur since the error is much smaller than the 
rounding intervals.
The problem is that the program $P_1$ still depends on~$h$ since we 
cannot rule out that some~$h$ with lead to the larger number and some 
will lead to the smaller one.

\subsection{Attempt 3: Decoupling by Rounding + Random Translation}
To circumvent the problem that the branching program may depend on~$h$ 
after the rounding step, note that there are only few problematic 
values for the probability~$p$ from above: The problematic cases 
of~$p$ occur in the $2\epsilon$-neighborhood around integer multiples 
of $2^{-M}$.
In each interval $[i 2^{-M}, (i+1) 2^{-M}]$, the total measure of 
these problematic boundary cases is $2\epsilon / 2^{-M} = 2^{-100 M + 
  1 + M} \leq 2^{-98 M}$ by our choice of $M=\log(1/\epsilon)/100$.
By choosing $\epsilon=1/\poly(r)$, we can make this measure 
polynomially small in~$r$.

In light of the small measure of problematic cases, we can just add 
some random noise to the transition probabilities.
The noise will be such that it is unlikely that we will be in the 
problematic region, and so that the error does not go up 
significantly.
The details can be worked out in the following exercise.
\begin{exercise}\label{noise}
  There is a deterministic algorithm that, when given a branching 
  program $B$ of length~$r$, block length~$m$, and width~$w$, and 
  given numbers~$\epsilon>0$ and $\delta\in[0,1]\cap 2^{-100 M} \cdot 
  \Nat$ so that $\accuracy\doteq\log(1/\epsilon) / 100 \leq m$, 
  computes a branching program~$\lfloor B \rfloor_\accuracy$ of 
  length~$r$, block length~$m$, and width~$w$ that satisfies
  \begin{align}\label{eq: noise}
    \Pr(\lfloor B-\delta\rfloor_\epsilon(s;U_m)=t) = 
    \lfloor\Pr(B(s;U_b)=t)-\delta\rfloor_\accuracy\,,
  \end{align}
  for all states $s$ in the $i$-th layer and all states $t$ in the 
  $(i+1)$-st layer.
  Moreover, the algorithm uses space $O(m+b+\log(wr/\epsilon))$ and 
  the program $\lfloor B-\delta \rfloor_\accuracy$ depends only on the 
  right-hand side of \eqref{eq: noise} (and not on the structure of 
  $B$).

  The rounded program approximates the original in the following 
  sense: For all states~$s$,
  \begin{align}
    \sdist\Big(\lfloor B-\delta\rfloor_\accuracy(s;U_m),B(s;U_b)\Big)
   & \leq w (2^{-M}+\delta)=O((\epsilon+\delta) w)\,.
  \end{align}
\end{exercise}
Finally, if $h$ is a good hash function for $B$ in the sense of 
\eqref{eq: Nisan concentration}, we want to have that $\lfloor 
B_h-\delta \rfloor$ is the same regardless of the choice of which good 
hash function we chose.
Note that there are at most $r\cdot w=\poly(r)$ transition 
probabilities between subsequent layers of $B_h$, and therefore, the 
probability that there exists a transition probability that gets 
shifted into a bad region by picking $\delta$ uniformly at random is 
at most $1/\poly(r)$, where the degree of the polynomial can be made 
as large as needed to apply the union bound over all transition 
probabilities.

We are done with our third attempt, and this algorithm actually works.
Let's analyze the space requirement:
The space for a single iteration is $\sim log r$ plus the space 
required to store the hash function $h$, which is $\log m \sim \log 
(1/\epsilon) \sim \log r$.
So over all~$k$ iterations, we require space $k \cdot \log r \sim 
\log^2 r$, which is no improvement over Nisan's generator.

\subsection{Final algorithm}

To reduce the space requirements further, we need to decrease the 
number of iterations and rounding steps required, and we will do so by 
increasing the number of hash functions used.
In particular, our final algorithm proceeds as follows:
\begin{enumerate}
  \item The input is a branching program~$B$ of length $r=2^k$ and 
    width $w$.
  \item We set $\epsilon=1/\poly(r)$, $m=O(\log(1/\epsilon))$, and 
    $M=\log(1/\epsilon)/100$.
  \item We sample $\sqrt k$ hash functions $h_1,\dots,h_{\sqrt k} \sim 
    \mathcal H$.
  \item We set $P_0=B$.
  \item For each $i$ from $0$ to $\sqrt k-1$, we sample $\delta_i$ 
    uniformly at random and compute
    \begin{align*}
      P_{i+1}\doteq \Big\lfloor
      (P_i)_{h_1,h_2,\dots,h_{\sqrt k}}-\delta_i
      \Big\rfloor_M\,,
    \end{align*}
    via Exercise~\ref{noise}.
  \item We cycle through all seeds of length $m$ to compute the 
    acceptance probability of $P_{\sqrt k}$.
\end{enumerate}
Note that $P_0$ has block length~$1$ initially, and we silently pad it 
to block length~$m$ without loss of generality.
The successive application of Lemma~\ref{lemma: dersquare} with $\sqrt 
k$ independent hash function decreases the length of the program by a 
factor of $2^{\sqrt k}$, so all programs $P_i$ have block length~$m$ 
and length~$r/2^{i\cdot \sqrt k}$.
Importantly, computing this composition and applying 
Exercise~\ref{noise} only requires space~$\sim\log r$ since the hash 
functions are fixed globally.
In the end, $P_{\sqrt k}$ has length one, and cycling through all 
seeds of length~$m$ can be done in space $O(\log r)$.
Thus, we need space $m\cdot\sqrt k$ to sample the hash functions once, 
and we need space $\log r \cdot \sqrt k$ to iteratively compute 
$P_{\sqrt k}$.
By the choice of parameters, this works out to be $\sim\log^{1.5} r$.

\begin{theorem}[\cite{SaksZhou}]
  $\RL \in \L^{1.5}$.
\end{theorem}

\bibliographystyle{alpha}
\bibliography{references}

\end{document}

