CNF Encodings of Parity

A popular approach for solving a difficult combinatorial problem in practice is to encode it in conjunctive normal form (CNF) and to invoke a SAT-solver. There are two main reasons why this approach works well for many hard problems: the state-of-the-art SAT-solvers are extremely efficient and many combinatorial problems are expressed naturally in CNF. At the same time, a CNF encoding is not unique and one usually determines a good encoding empirically. Moreover, there is no such thing as the best encoding of a given problem as it also depends on a SAT-solver at hand. Prestwich [10] gives an overview of various ways to translate problems into CNF and discusses their desirable properties, both from theoretical and practical points of view.

Already for such simple functions as the parity function $x_{1}\oplus x_{2}\oplus\dotsb\oplus x_{n}$, it is not immediate how to encode them in CNF (to make it efficiently handled by SAT-solvers). Parity function is used frequently in cryptography (hash functions, stream ciphers, etc.). It is known that the minimum number of clauses in a CNF computing parity is $2^{n-1}$. This becomes impractical quickly as $n$ grows. A standard way to reduce the size of an encoding is by using non-deterministic variables (also known as guess or auxiliary variables). Namely, one introduces $s$ non-deterministic variables $y_{1},\dotsc,y_{s}$ and partitions the set of input variables into $s+1$ blocks of size at most $\lceil n/(s+1)\rceil$: $\{x_{1},x_{2},\dotsc,x_{n}\}=X_{1}\sqcup X_{2}\sqcup\dotsb\sqcup X_{s+1}$. Then, one writes down the following $s+1$ parity functions in CNF:

The value for the parameter $s$ is usually determined experimentally. For example, Prestwich [9] reports that taking $s=10$ gives the best results when solving the minimal disagreement parity learning problem using local search based SAT-solvers.

The simple construction above implies several upper bounds on the number $m$ of clauses, the number $s$ of non-deterministic variables, and the width $k$ of clauses:

Limited non-determinism:

using $s$ non-deterministic variables, one can encode parity either as a CNF with at most

$$m\leq(s+1)2^{\lceil n/(s+1)\rceil+2-1}\leq 4(s+1)2^{n/(s+1)}$$

clauses or as a $k$-CNF, where

$$k=2+{\lceil n/(s+1)\rceil}\leq 3+n/(s+1)\,.$$

Unlimited non-determinism:

one can encode parity as a CNF with at most $4n$ clauses (to do this, use $s=n-1$ non-deterministic variables; then, each of $n$ functions in (1) can be written in CNF using at most four clauses).

In this paper, we show that the upper bounds mentioned above are essentially optimal.

We derive a lower bound $m\geq\Omega((s+1)2^{n/(s+1)}/n)$ from the Satisfiability Coding Lemma due to Paturi, Pudlák, and Zane [8]. This lemma allows to prove a $2^{\sqrt{n}}$ lower bound on the size of depth-$3$ circuits computing the parity function. Interestingly, the lower bound $m\geq\Omega((s+1)2^{n/(s+1)}/n)$ implies a lower bound $2^{\Omega(\sqrt{n})}$ almost immediately, though it is not clear whether a converse implication can be easily proved.

To prove a lower bound $m\geq 3n-9$, we analyze carefully the structure of a CNF encoding.

Many results for various computational models with limited non-determinism are surveyed by Goldsmith, Levy, and Mundhenk [2]. An overview of known approaches for CNF encodings is given by Prestwich [10]. Two recent results that are close to the results of this paper are the following. Morizumi [7] proved that non-deterministic inputs do not help in the model of Boolean circuits over the $U_{2}$ basis (the set of all binary functions except for the binary parity and its complement) for computing the parity function: with and without non-deterministic inputs, the minimum size of a circuit computing parity is $3(n-1)$. Kucera, Savický, Vorel [5] prove almost tight bounds on the size of CNF encodings of the at-most-one Boolean function ($[x_{1}+\dotsb+x_{n}\leq 1]$). Sinz [11] proves a linear lower bound on the size of CNF encodings of the at-most-$k$ Boolean function.

For a Boolean function $f(x_{1},\dotsc,x_{n})\colon\{0,1\}^{n}\to\{0,1\}$, we say that a CNF $F(x_{1},\dotsc,x_{n})$ computes $f$ if $f\equiv F$, that is, for all $x_{1},\dotsc,x_{n}\in\{0,1\}$, $f(x_{1},\dotsc,x_{n})=F(x_{1},\dotsc,x_{n})$. We treat a CNF as a set of clauses and by the size of a CNF we mean its number of clauses. It is well known that for every function $f$, there exists a CNF computing it. One way to construct such a CNF is the following: for every input $x\in\{0,1\}^{n}$ such that $f(x)=0$, populate a CNF with a clause of length $n$ that is falsified by $x$.

This method does not guarantee that the produced CNF has the minimal number of clauses: this would be too good to be true as the problem of finding a CNF of minimum size for a given Boolean function (specified by its truth table) is NP-complete as proved by Masek [6] (see also [1] and references herein). For example, for a function $f(x_{1},x_{2})=x_{1}$ the method produces a CNF $(\overline{x_{1}}\lor x_{2})\land(\overline{x_{1}}\lor\overline{x_{2}})$ whereas the function $x_{1}$ is already in CNF format.

It is well known that for many functions, the minimum size of a CNF is exponential. The canonical example is the parity function $\operatorname{PAR}_{n}(x_{1},\dotsc,x_{n})=x_{1}\oplus\dotsb\oplus x_{n}$. The property of $\operatorname{PAR}_{n}$ that prevents it from being computable by short CNF’s is its high sensitivity: by flipping any bit in any input $x\in\{0,1\}^{n}$, one flips the value of $\operatorname{PAR}_{n}(x)$.

We say that a CNF $F$ encodes a Boolean function $f(x_{1},\dotsc,x_{n})$ if the following two conditions hold.

1. 1.

   In addition to the input bits $x_{1},\dotsc,x_{n}$, $F$ also depends on $s$ bits $y_{1},\dotsc,y_{s}$ called guess inputs or non-deterministic inputs.

2. 2.

   For every $x\in\{0,1\}^{n}$, $f(x)=1$ iff there exists $y\in\{0,1\}^{s}$ such that $F(x,y)=1$. In other words, for every $x\in\{0,1\}^{n}$,

   $$f(x)=\bigvee_{y\in\{0,1\}^{s}}F(x,y)\,.$$

   (5)

Such representations of Boolean functions are widely used in practice when one translates a problem to SAT. For example, the following CNF encodes $\operatorname{PAR}_{4}$:

A natural way to get a CNF encoding of a Boolean function $f$ is to take a circuit computing $f$ and apply Tseitin transformation [12]. We describe this transformation using a toy example. The following circuit computes $\operatorname{PAR}_{12}$ with three gates. It has $12$ inputs, $3$ gates (one of which is an output gate), and has depth $3$.

To the right of the circuit, we show the functions computed by each gate. One can translate each line into CNF. Adding a clause $(y_{3})$ to the resulting CNF gives a CNF encoding of the function computed by the circuit. In fact, the CNF (1) can be obtained this way (after propagating the value of the output gate).

A CNF can be viewed as a depth-$2$ circuit where the output gate is an AND, all other gates are ORs, and the inputs are variables and their negations. For example, the following circuit corresponds to a CNF (6). Such depth-2 circuits are also denoted as $\operatorname{AND}\circ\operatorname{OR}$ circuits.

Depth-$3$ circuits is a natural generalization of CNFs: a $\Sigma_{3}$-circuit is simply an OR of CNFs. In a circuit, these CNFs are allowed to share clauses. A $\Sigma_{3}$-formula is a $\Sigma_{3}$-circuit whose CNFs do not share clauses (in other words, it is a circuit where the out-degree of every gate is equal to one).

On the one hand, this computation model is still simple enough. On the other hand, proving lower bounds against this model is much harder: getting a $2^{\omega(n)}$ lower bound for an explicit function (say, from $\NP$ or $\E^{\NP}$) is a major challenge. Proving a lower bound $2^{\omega(n/\log\log n)}$ would resolve another open question, through Valiant’s depth reduction [13]: proving a superlinear lower bound on the size of logarithmic depth circuits. We refer the reader to Jukna’s book [4, Chapter 11] for an exposition of known results for depth-$3$ circuits. For the parity function, the best known lower bound on depth-$3$ circuits is $\Omega(2^{\sqrt{n}})$ [8]. If one additionally requires that a circuit is a formula, i.e., that every gate has out-degree at most 1, then the best lower bound is $\Omega(2^{2\sqrt{n}})$ [3]. Both lower bounds are tight up to polynomial factors.

Equation (5) shows a tight connection between CNF encodings and depth-$3$ circuits of type $\operatorname{OR}\circ\operatorname{AND}\circ\operatorname{OR}$. Namely, let $F(x_{1},\dotsc,x_{n},y_{1},\dotsc,y_{s})=\{C_{1},\dotsc,C_{m}\}$ be a CNF encoding of a Boolean function $f\colon\{0,1\}^{n}\to\{0,1\}$. Then, $f(x)=\lor_{y\in\{0,1\}^{s}}F(x,y)$. By assigning $y$’s in all $2^{s}$ ways, one gets an $\Sigma_{3}$-formula that computes $f$:

where each $F_{j}$ is a CNF. We call this an expansion of $F$. For example, an expansion of a CNF (6) looks as follows. It is an OR of four CNFs.

An expansion is a formula: it is an OR of CNFs, every gate has out-degree one. One can also get a circuit-expansion: in this case, gates are allowed to have out-degree more than one; alternatively, CNFs are allowed to share clauses. For example, this is a circuit-expansion of (6).

Below, we show that CNF encodings and depth-3 circuits can be easily transformed one into the other. It will prove convenient to define the size of a circuit as its number of gates excluding the output gate. This way, the size of a CNF formula equals its number of clauses (a CNF is a depth-2 formula). By a $\Sigma_{3}(t,r)$-circuit we denote a $\Sigma_{3}$-circuit having at most $t$ ANDs on the second layer and at most $r$ ORs on the third layer (hence, its size is at most $t+r$).

Interestingly, the upper bounds on depth-3 circuits resulting from this simple transformation cannot be substantially improved. Indeed, by plugging in a CNF encoding of $\operatorname{PAR}_{n}$ with $s=\sqrt{n}$ and $m=O(\sqrt{n}2^{\sqrt{n}})$ (see (1)), one gets a $\Sigma_{3}$-formula and a $\Sigma_{3}$-circuit of size $2^{2\sqrt{n}}$ and $2^{\sqrt{n}}$, respectively, up to polynomial factors. As discussed above, these bounds are known to be optimal.

Below, we show a converse transformation.

Finally, we show that proving strong lower bounds on the size of CNF encodings is not easier than proving strong lower bounds on the size of depth-3 circuits. Let $C$ be a $\Sigma_{3}(t,r)$-formula computing $\operatorname{PAR}_{n}$. Lemma 2.5 guarantees that $\operatorname{PAR}_{n}$ can be encoded as a CNF of size $r$ with $\lceil\log t\rceil$ non-deterministic variables. Then, by the inequality (2),

Similarly, if $C$ is a $\Sigma_{3}(t,r)$-circuit, Lemma 2.5 guarantees that $\operatorname{PAR}_{n}$ can be encoded as a CNF of size $2rt$ with $\lceil\log t\rceil$ non-deterministic variables. Then,

To prove a lower bound $m\geq\Omega((s+1)2^{n/(s+1)}/n)$, we adapt a proof of the $\Omega(n^{1/4}2^{\sqrt{n}})$ lower bound for depth-3 circuits computing $\operatorname{PAR}_{n}$ by Paturi, Pudlák, and Zane [8]. Let $F(x_{1},\dotsc,x_{n})$ be a CNF. For every isolated satisfying assignment $x\in\{0,1\}^{n}$ of $F$ and every $i\in[n]$, fix a shortest critical clause w.r.t. $(x,i)$ and denote it by $C_{F,x,i}$. Then, for an isolated satisfying assignment $x$, define its weight w.r.t. $F$ as

To prove the lower bound $k\geq n/(s+1)$, we use the following corollary of the Satisfiability Coding Lemma.

In this section, we prove the lower bound $m\geq 3n-9$.