Pseudodeterministic Constructions in Subexponential Time

The main application of our techniques is that there is unconditionally a subexponential-time pseudodeterministic algorithm for generating infinitely many primes.

Note that the algorithm $A$ is zero-error: on input $1^{|p_{n}|}$, it outputs the same prime $p_{n}$ on all computation paths. In fact, on any input $1^{m}$, the algorithm either operates deterministically and halts without output, or else it outputs the same $m$-bit prime on all computation paths.

Using the proof idea of Theorem 1, we answer a variant of the question from Polymath 4: under the assumption that $\mathsf{ZPP}\subseteq\operatorname{i.o.}\mathsf{DTIME}(2^{n^{c}})$ for some fixed $c>0$ (which is much weaker than $\mathsf{BPP}=\mathsf{P}$), we show that there is a subexponential-time deterministic algorithm for generating infinitely many primes (see Theorem 9 in Section 3.2).

Theorem 1 has some unusual features: we show that an algorithm exists satisfying the described properties, but we are not able to explicitly give such an algorithm. Similarly, while we show the existence of an infinite sequence of primes $\{p_{n}\}$, we are unable to bound $|p_{n+1}|$ as a function of $|p_{n}|$. These non-constructive features, which are surprising in the context of an algorithmic solution to a natural problem, arise because Theorem 1 is proved as a corollary of the following generic result about explicit constructions.

We derive Theorem 1 by taking $Q$ to be the set of primes in Theorem 2, and observing that the statement of Theorem 1 follows both from the first and second item of Theorem 2. The non-constructivity comes from not knowing which of these two items holds, and we discuss this issue in more detail in Section 1.4.

Consider any property $Q$ as in the statement of Theorem 2, namely with polynomial density and decidable in deterministic polynomial time. For any such property, there is a randomized generation algorithm in polynomial time analogous to the one we described for Primes: generate strings of length $n$ at random and test for membership in $Q$, halting if a string in $Q$ is found. What Theorem 2 says is that this randomized generation algorithm can unconditionally be made pseudodeterministic in a generic fashion, albeit at the cost of increasing the running time to subexponential, and only succeeding for infinitely many input lengths $n$.

Theorem 2 is a very general result, and the generality of our techniques enables us to apply them to give unconditional pseudodeterministic algorithms in other contexts. Even if Theorem 1 does not give an explicit algorithm for generating primes of every input length, it does provide evidence that such algorithms might not be out of reach of current techniques. More explicit and more efficient algorithms could perhaps be designed by tailoring them more closely to the property at hand.

Nevertheless, we are interested in the question of whether there is a fundamental bottleneck to constructivity in our proof technique for Theorem 2. By refining some aspects of our approach, we are able to get somewhat explicit algorithms for generating primes as follows.

The algorithm in Theorem 3 is explicit, but we still cannot say for sure on which input lengths it will succeed. We do have the guarantee that the gaps between successive input lengths on which the algorithm succeeds are not superpolynomially large. Theorem 3 does not strictly improve on Theorem 1 – it is not necessarily true, for example, that the same prime is output on all computation paths. Namely, we get a bounded-error pseudodeterministic algorithm rather than a zero-error one. However, the issue of non-constructivity is somewhat mitigated in Theorem 3.

Theorem 2 yields subexponential-time pseudodeterministic generation algorithms for properties that are both easy and dense. A more general context is polynomial-time sampling. Here we are given a sampler that either outputs a string (with high probability) or aborts, and we wish to design a new sampler that outputs a fixed string with high probability, with the constraint that this fixed string should belong to the range of the original sampler. We show how to adapt our ideas to give an analogue of Theorem 2 for this problem. We refer to Section 3.3 for more details.

We also study the relationship between pseudodeterminism and derandomization. A natural problem associated with derandomization is the Circuit Acceptance Probability Problem ($\mathsf{CAPP}$): given a circuit $C$, output a small-error additive approximation to the acceptance probability of $C$. There is a simple randomized polynomial-time algorithm for this problem – sample polynomially many inputs of $C$ at random, and output the fraction of these inputs on which $C$ accepts. This algorithm outputs different estimations of the acceptance probability of $C$ on different computation paths. We show how to get a pseudodeterministic algorithm as in Theorem 2 for infinitely many input lengths, but our algorithm is only guaranteed to succeed distributionally rather than in the worst case. (We refer to Section 4 for a precise formulation of the result.)

One of the main questions in the theory of derandomization concerns the relationship between “white-box” and “black-box” derandomization. Black-box derandomization refers to derandomization using a fixed pseudorandom generator, while in white-box derandomization, we are given a circuit and asked to approximate its acceptance probability deterministically. Black-box derandomization implies white-box derandomization of randomized algorithms, and white-box derandomization implies deterministic simulations of languages in $\mathsf{BPP}$. However, it is unknown whether these implications can be reversed in general (cf. [9, 15]), and separations are known in relativized worlds [9].

We prove that these notions are all in fact equivalent in the setting of subexponential-time derandomization that works infinitely often on average over polynomial-time samplable distributions. (While Theorem 4 provides a randomized algorithm, we stress that the algorithms postulated in Theorem 5 below are all deterministic. We refer to Section 4 for definitions.)

Therefore, in order to establish all these items it is necessary and sufficient to turn the (unconditional) pseudodeterministic algorithm from Theorem 4 into a deterministic algorithm.

There has been a lot of work on explicitly constructing combinatorial objects that can be shown to exist by the probabilistic method. Vadhan [31] surveys known unconditional constructions of such objects, and connections to the theory of pseudorandomness. There are important properties, such as the Ramsey property, for which optimal explicit constructions are still not known, though there has been much recent progress (cf. [8, 7]). However, in many cases, such constructions do exist if the notion of explicitness is weakened or if a sufficiently strong derandomization hypothesis is made [29, 26].

The techniques used to show explicit constructions of combinatorial objects do not seem to be directly relevant to constructions of algebraic objects such as irreducible polynomials or number-theoretic objects such as primes. Shoup [27] shows how to deterministically construct an irreducible polynomial of degree $n$ over the field $\mathbb{F}_{p}$ in time polynomial in $n$ and $p$. This is useful for constructions of irreducible polynomials over fields of small characteristic, but the large-characteristic case is still open – ideally we would like the construction algorithm to operate in time $\operatorname{poly}(n,\log(p))$.

For primes, known results are even weaker. The fastest known algorithm generates $n$-bit primes in time $2^{(\gamma+o(1))n}$, for $\gamma=1/2$ [24]. There are algorithms that achieve an arbitrarily small constant $\gamma>0$, but assume certain number-theoretic conjectures. Faster running times can be obtained under stronger conjectures, and we refer to the introduction of [28] for more information.

Assuming standard (but hard to prove) derandomization hypotheses, stronger explicit constructions are known. It is folklore that the existence of hitting sets against a class $\mathfrak{C}$ of algorithms yields explicit deterministic constructions for every dense property computed by $\mathfrak{C}$-algorithms. References that discuss this include [29, 26, 15]). As an example, the assumption that $\mathsf{E}$ requires exponential-size Boolean circuits implies polynomial-time explicit constructions of irreducible polynomials and of primes. However, in this work, we are interested in unconditional, albeit pseudodeterministic, constructions for properties decidable in polynomial time. (While there are unconditional pseudorandom generators against restricted classes of algorithms such as small-depth polynomial size circuits, it is known that such circuits cannot decide several properties of interest, such as prime numbers [3].)

Perhaps the most closely related result is a certain unconditional derandomization of one-sided polynomial time randomized algorithms in subexponential time established in [22]. However, the focus there is on decision problems, and as remarked above, such results do not immediately imply pseudodeterministic constructions. The easy witness method from [22] is an important tool in some of our proofs.

The investigation of the power and limitations of pseudodeterministic algorithms is fairly recent. A sequence of works [11, 13, 12, 16] has started the development of a more general theory of pseudodeterministic computation. These papers give pseudodeterministic algorithms that are faster than their known deterministic counterparts for various concrete search problems of interest, and also give some structural results.

Connections between black-box derandomization, white-box derandomization and deterministic simulation of $\mathsf{BPP}$ are explored by Fortnow [9], who shows relativized separations between these notions. Goldreich [15] shows an equivalence between white-box derandomization and black-box derandomization in the average-case setting; however he consider pseudo-random generators that work against uniform algorithms, rather than against non-uniform circuits. Implagliazzo, Kabanets and Wigderson [17] give an equivalence between white-box and black-box derandomization in the setting where we allow the derandomization to be done non-deterministically with a small amount of advice, and the derandomization is only required to be correct for infinitely many input lengths.

Suppose we wish to pseudodeterministically generate strings satisfying some property $Q$ that is dense and is decidable in polynomial time, such as $\mathsf{Primes}$.³³3For concreteness, we let $\mathtt{Primes}\stackrel{{\scriptstyle\rm def}}{{=}}\{w\in\{0,1\}^{*}\mid w=w_{n-1}w_{n-2}\ldots w_{0},~w_{n-1}=1,~\text{and}~\sum_{i=0}^{n-1}2^{i}w_{i}~\text{is prime}\,\}$. It is well-known that using standard hardness-randomness tradeoffs, efficient deterministic generation can be done under a strong enough circuit lower bound assumption for $\mathsf{E}\stackrel{{\scriptstyle\rm def}}{{=}}\mathsf{DTIME}(2^{O(n)})$ (linear exponential time).

Our first observation is that efficient pseudodeterministic generation follows from weaker circuit lower bound assumptions, namely circuit lower bounds for the probabilistic classes $\mathsf{BPE}=\mathsf{BPTIME}(2^{O(n)})$ (bounded-error linear exponential time) and $\mathsf{ZPE}=\mathsf{ZPTIME}(2^{O(n)})$ (zero-error linear exponential time). Pseudodeterministic algorithms come in two flavours: zero-error, where the algorithm outputs a fixed string (with high probability) or else aborts, and bounded-error, where it outputs a fixed string on most computation paths but might output other strings on exceptional computation paths. It turns out that strong enough circuit lower bounds for $\mathsf{BPE}$ imply efficient bounded-error pseudodeterministic generation, and strong enough circuit lower bounds for $\mathsf{ZPE}$ imply efficient zero-error pseudodeterministic generation. This is because a hard function in $\mathsf{BPE}$ (resp. a hard function in $\mathsf{ZPE}$) yields a bounded-error (resp. zero-error) pseudodeterministic construction of a discrepancy set (see Section 2). In turn, once such a discrepancy set is obtained, its elements can be checked in some fixed order for membership in $Q$, and the first such element belonging to $Q$ can then be output pseudodeterministically.

Note that circuit lower bounds for $\mathsf{BPE}$ do not seem useful for decision problems: using a sufficiently hard function in $\mathsf{BPE}$ in a pseudorandom generator would merely yield the tautologous inclusion $\mathsf{BPP}\subseteq\mathsf{BPP}$. However, such circuit lower bounds are useful for pseudo-derandomization of search problems.⁴⁴4It is natural to wonder if there are techniques tailored to $\mathsf{BPE}$ and $\mathsf{ZPE}$ lower bounds. We refer the interested reader to the approaches outlined in [25].

To turn our conditional pseudodeterministic generation algorithms into unconditional ones, we use the uniform hardness-randomness tradeoffs of [20, 30] and win-win analysis, showing that both the success and the failure of certain pseudorandom generators can be exploited to give non-trivial pseudodeterministic constructions. The specific win-win analysis we use depends on the intended application. In order to make some constructions zero-error, we further combine the arguments with the easy witness method [22].

We describe next the main conceptual ideas behind the proof of each main result stated in Section 1.1.

Theorem 1 (Non-constructive zero-error pseudo-deterministic algorithm for $\mathtt{Primes}$). Recall that Theorem 1 is a straightforward consequence of Theorem 2. In each case, it follows that there is a pseudodeterministic subexponential time algorithm which simply outputs the lexicographic first $n$-bit prime in the hitting set. The non-constructive aspect of Theorem 1 arises because we do not know which of items (1) and (2) holds in Theorem 2.

Theorem 2 (Unconditional pseudo-deterministic hitting set generators). Here we use a win-win-win analysis. We try two different candidate hitting set generators $\mathcal{H}^{\mathsf{easy}}$ and $\mathcal{H}^{\mathsf{hard}}$, both computable in deterministic subexponential time. The first generator is based on the easy witness method of Kabanets [22], and the second is the generator of Trevisan-Vadhan [30]. If either of the corresponding hitting set families intersects $Q\cap\{0,1\}^{n}$ infinitely often, we have that the first item of Theorem 2 holds. If not, then we show that we have the complexity collapse $\mathsf{PSPACE}=\mathsf{ZPP}$. We exploit this collapse to derive strong circuit lower bounds in $\mathsf{ZPE}$, and are then able to use our conditional argument for efficient pseudodeterministic generation to conclude the second item.

Theorem 3 (Constructive bounded-error pseudo-deterministic algorithm for $\mathtt{Primes}$). The proof for Theorem 2 gives no information on the sparsity of input lengths for which the construction succeeds, nor does it give us an explicit algorithm. An important reason for this is that we prove item (2) to hold in Theorem 2 only if the candidate hitting set generators in item (1) fail almost everywhere. We first show a refinement of the main technical lemma which allows us to derive a consequence for item (2) from a failure of item (1) for all input lengths in a polynomially large range of input lengths. We then crucially use the fact that item (1) gives deterministically generatable hitting sets which can be checked for correctness somewhat efficiently to guarantee that either item (1) or item (2) must hold in every large enough polynomial range of input lengths.⁵⁵5The possible sparsity of the sequence of primes produced by our algorithm is an artifact of our complexity-theoretic techniques. In contrast, constructions using standard number-theoretic techniques typically use analytic methods and succeed for every large enough input length (James Maynard, personal communication). The details are somewhat technical, and we provide a more intuitive explanation in Section 3.4.

Theorem 4 (Pseudodeterministic algorithm for $\mathsf{CAPP}$). We use a win-win analysis once again, relying on the fact that pseudo-random generators can be employed to approximate the acceptance probability of circuits in a deterministic fashion. If the candidate pseudo-random generator we use succeeds infinitely often, we can solve $\mathsf{CAPP}$ deterministically infinitely often; if it fails in an average-case sense, we adapt the arguments used in the proof of Theorem 2 to show how to solve $\mathsf{CAPP}$ pseudodeterministically in polynomial time.

Theorem 5 (Equivalences for deterministic algorithms in the average-case ). The most interesting implications rely on results from previous works. The simulation in (3) assuming (2) introduces advice, and this advice is eliminated in item (4) as follows. Under assumption (3), it follows by diagonalization that $\mathsf{EXP}\neq\mathsf{BPP}$. In turn, [20] showed that this hypothesis provides sub-exponential time simulations of $\mathsf{BPP}$, as required in (4). Perhaps a more surprising connection is that (4) implies (1). Our argument is based on another win-win analysis, and relies on results from [5, 20, 30]. Under (4), it can be shown that $\mathsf{EXP}\neq\mathsf{BPP}$, and that this implies that either $\mathsf{EXP}\nsubseteq\mathsf{P}/\mathsf{poly}$, or $\mathsf{PSPACE}\neq\mathsf{BPP}$. In each case, we argue that any samplable distribution admits an average-case pseudo-random generator satisfying the conditions in (1).

Note the quantification in the statement of Theorem 2: there is a pseudodeterministic polynomial time algorithm producing a hitting set family which works for every sufficiently dense easy property, or there is a deterministic subexponential time algorithm producing hitting set families which work infinitely often for every sufficiently dense easy property. Thus we provably live in one of two worlds:⁶⁶6Inspired by the worlds of Impagliazzo [18]. a world PSEUDO where there is a generic hitting set family for sufficiently dense easy properties that is computable in zero-error pseudodeterministic polynomial time, or a world SPARSE where generic hitting set families are computable deterministically but only in subexponential time, and moreover the hitting sets only work infinitely often. These two worlds could co-exist. Indeed many complexity theorists believe that linear exponential time requires exponential size circuits on almost all input lengths, which would imply the co-existence of the two worlds. However, given the available techniques at this point in time, we are only able to establish that we live in one of the two worlds.

The fact that we can show that we live in one of these two worlds, but don’t know which one, leads to a certain non-constructivity in our results, which is ironic given that we are motivated by explicit constructions! We can show that we live in one of the worlds PSEUDO or SPARSE, and in the latter case, our proof provides an explicit algorithm witnessing that we live in that world, namely the algorithm producing the union of the hitting set families $\mathcal{H}^{\mathsf{easy}}$ and $\mathcal{H}^{\mathsf{hard}}$. However, in the former case, the proof does not provide an explicit algorithm witnessing that we live in that world. This is because the proof relies on the existence of an easy dense property which acts as distinguisher for the hitting set families, and we do not know a priori which property this is.

A further element of non-constructivity in Theorem 2 is that in case we live in the world SPARSE, we have no information on the set of input lengths for which the hitting set works, except that this set is infinite. This set could be arbitrarily sparse. The reason is that we can only show the second item based on the hitting set families $\mathcal{H}^{\mathsf{easy}}$ and $\mathcal{H}^{\mathsf{hard}}$ failing to work on all large enough input lengths.

We partially address both issues in Section 3.4, and we refer to that section for further discussions on PSEUDO and SPARSE.

We refer to algorithms in a sufficiently strong computational model, such as the 2-tape Turing Machine over the alphabet $\{0,1,\perp\}$. We use standard encodings of objects such as numbers and finite sets by strings. For convenience, we let $\mathbb{N}\stackrel{{\scriptstyle\rm def}}{{=}}\{1,2,\ldots\}$. Given a string $u\in\{0,1\}^{\geq n}$, we let $\mathsf{left}_{n}(u)$ denote its leftmost $n$ bits.

Let $\gamma\colon\mathbb{N}\to\mathbb{R}$ be an arbitrary function. We say that a sequence $\mathcal{H}$ of (multi-) sets $H_{n}$ is a $\gamma$-discrepancy set for $Q$ at length $n$ if $\left||Q_{n}|/2^{n}-|H_{n}\cap Q_{n}|/|H_{n}|\right|<\gamma(n)$. The notions of being a $\gamma$-discrepancy set family at a set $S\subseteq\mathbb{N}$ of input lengths, an i.o. $\gamma$-discrepancy set family and a $\gamma$-discrepancy set family are defined in analogy to the previous paragraph. Note that if $Q$ is $\gamma$-dense, then a $\gamma$-discrepancy set family $\mathcal{H}$ for $Q$ is also a hitting set family for $Q$.

Pseudodeterministic Algorithms. By default, we consider randomized algorithms whose input and output are both strings. Let $p$ be a real-valued parameter. A randomized algorithm $A(\cdot)$ is said to be a bounded-error pseudodeterministic algorithm with success probability $p$ if there is a function $f\colon\{0,1\}^{*}\to\{0,1\}^{*}$ such that $A(x)=f(x)$ with probability at least $p$ over the random choices of $A$. We call such a function $f$ a $p$-canonical function for $A$, and an output $f(x)$ of the function a $p$-canonical output of $A(x)$. A randomized algorithm $A(\cdot)$ is said to be a zero-error pseudodeterministic algorithm with success probability $p$ if there is a function $f\colon\{0,1\}^{*}\to\{0,1\}^{*}$ such that on each computation path, $A(x)$ outputs either $f(x)$ or $\perp$, and $A(x)=f(x)$ with probability at least $p$ over the random choices of $A$.

Given a set $S$ of inputs, we say that an algorithm is pseudodeterministic on $S$ if the pseudodeterministic promise is only required to hold for inputs in $S$. When the algorithm takes a unary input, we sometimes identify subsets of inputs with subsets of $\mathbb{N}$, in the natural way.

For any bounded-error pseudodeterministic algorithm with success probability $>1/2$ or any zero-error pseudodeterministic algorithm with success probability $>0$, there is a unique $p$-canonical function, defined in the former case by the unique output produced with probability $>1/2$, and in the latter case by the unique non-$\perp$ output. In both cases, we simply call the function and the corresponding output canonical.

Let $Q$ be a property, $p$ a real-valued parameter, and $T\colon\mathbb{N}\rightarrow\mathbb{N}$ be a time function. We say that there is a bounded-error pseudodeterministic construction with success probability $p$ for $Q$ in time $T$ if there is a bounded-error pseudodeterministic algorithm $A$ with success probability $p$ such that for all large enough $n$, $A(1^{n})$ halts in time $T(n)$ and has a $p$-canonical output in $Q_{n}$. Similarly, we say that there is a zero-error pseudodeterministic construction with success probability $p$ for $Q$ in time $T$ if there is a zero-error pseudodeterministic algorithm $A$ with success probability $p$, such that for all large enough $n$, $A(1^{n})$ halts in time $T(n)$ and has a $p$-canonical output in $Q_{n}$.

As with hitting sets and discrepancy sets, given a set $S\subseteq\mathbb{N}$, we can generalize the notion of a pseudodeterministic construction to the notion of a pseudodeterministic construction on $S$, which means that $A(1^{n})$ has a $p$-canonical output in $Q_{n}$ for each $n\in S$. An i.o. pseudodeterministic construction is a pseudodeterministic construction on some infinite set $S$.

When the parameter $p=p(n)$ for a pseudodeterministic algorithm is omitted, it is taken by default to be $1-o(1)$. For such a pseudodeterministic algorithm $A$ on input $x$ of length $n$, for a large enough $n$, we will sometimes abuse notation and use $A(x)$ to refer to the canonical output of $A$ on $x$. Indeed, as observed next, bounded-error pseudodeterministic constructions and zero-error pseudodeterministic constructions are largely robust to variations in the success probability.

As opposed to Theorem 1, the algorithm from Theorem 3 might generate different primes on inputs $1^{\ell}$ for which it is not the case that $\ell=|q_{n}|$ for some $n$. It is not excluded that on some inputs of this form each prime is generated with approximately equal and non-negligible probability. This can be partially addressed using the following simple proposition.

We say that a function $G\colon\{0,1\}^{\ell}\to\{0,1\}^{m}$ $\varepsilon$-fools algorithms (circuits) of running time (circuit size) $t$ if for every such algorithm (circuit) $D$,

Otherwise, we say that $D$ $\varepsilon$-distinguishes $G$ (on seed length $\ell$).

We will consider a sequence $\{G_{\ell}\}_{\ell\in\mathbb{N}}$ of generators $G_{\ell}\colon\{0,1\}^{\ell}\to\{0,1\}^{m(\ell)}$, which we also view as a single function $G\colon\{0,1\}^{*}\to\{0,1\}^{*}$. The function $m(\cdot)$ is the stretch of $G$. We say that a generator $G$ with stretch $m(\cdot)$ is quick if on every input $w\in\{0,1\}^{\ell}$, $G(w)$ can be computed in time $O(m(\ell)^{d})$, where $d$ is a fixed constant independent of the remaining parameters. Finally, we say that an algorithm $D$ is a $t(m)$-distinguisher for $G$ if $D$ runs in time at most $t(m)$, and on every sufficiently large $\ell$, $D$ $1/t(m)$-distinguishes $G_{\ell}$.

We make use of the following “hardness versus randomness” results.

The next generator is based on a downward-self-reducible and self-correctable $\mathsf{PSPACE}$-complete language $L^{\star}$ described in [30], and the corresponding result can be seem as a uniform “low-end” version of Theorem 6. The following formulation is sufficient for our purposes.

The proof of Corollary 1 can easily be adapted to give a bounded-error pseudodeterministic construction in polynomial time even when the condition on easiness of $Q$ is relaxed to $Q\in\mathsf{BPP}$, and a zero-error pseudodeterministic construction in polynomial time even when the condition on easiness of $Q$ is relaxed to $Q\in\mathsf{ZPP}$. There is also a natural tradeoff between the hardness assumption and the running time of the corresponding pseudodeterministic construction, which can be obtained by using a generalization of Theorem 6 giving a hardness-randomness tradeoff based on circuit lower bounds varying from superpolynomial to exponential.

Note that the easiness assumption on $Q$ is used twice to obtain Corollary 1, the first time in the proof of Lemma 1 to obtain pseudodeterministic algorithms outputting discrepancy sets based on the hardness assumption, and the second time in the proof of Corollary 1 to obtain a pseudodeterministic construction for $Q$ from the discrepancy set. The first use of the assumption can be eliminated by using a stronger hardness assumption with respects to circuits that have oracle access to $Q$, but the second use seems essential.

By using in addition uniform hardness-randomness tradeoffs, we obtain unconditionally that there are pseudodeterministic constructions for easy dense sets in polynomial time, or else there are deterministic constructions for easy dense sets in subexponential time which work infinitely often. In fact, we obtain the following stronger result stating that in either case, there is a generic hitting set family that works simultaneously for all easy dense sets where the easiness and density parameters are fixed in advance.

We now give the proof of Theorem 8. Informally, the proof is a “win-win-win” argument using uniform hardness-randomness tradeoffs. We will describe two candidate hitting set families $\mathcal{H}^{\mathsf{easy}}$ and $\mathcal{H}^{\mathsf{hard}}$ computable in sub-exponential time, the first based on the “easy witness” method of Kabanets [22], and the second based on the uniform hardness-randomness tradeoffs of Impagliazzo-Wigderson and Trevisan-Vadhan [20, 30]. We will show that if there is a sufficiently easy dense property $Q$ such that $\mathcal{H}^{\mathsf{easy}}$ is not an i.o. hitting set family for $Q$, then $\mathsf{BPP}=\mathsf{ZPP}$. We will also show that if there is a sufficiently easy dense property $Q$ such that $\mathcal{H}^{\mathsf{hard}}$ is not an i.o. hitting set family for $Q$, then $\mathsf{PSPACE}=\mathsf{BPP}$. Thus, in each of these cases, we either “win” for each sufficiently easy dense property $Q$ by computing an i.o. hitting set family in sub-exponential time, or we have a complexity collapse. Finally, we show how to “win” in the case that both complexity collapses occur, by using Lemma 1. The win in this case is in the form of a polynomial-time pseudodeterministic algorithm which outputs a hitting set family for each sufficiently easy dense property. When either of the first two wins occur, item 2 of Theorem 8 holds, and when the third win occurs, item 1 holds.

Fix a $c>0$ as in the statement of Theorem 8, and let $\varepsilon>0$ be any constant. The candidate hitting set families $\mathcal{H}^{\mathsf{easy}}$ and $\mathcal{H}^{\mathsf{hard}}$ depend on $\varepsilon$, but we work with a fixed arbitrarily small $\varepsilon>0$ through the proof, and therefore do not need to formalize this dependence.

We first define the candidate hitting set family $\mathcal{H}^{\mathsf{easy}}$. Consider the set $\mathcal{C}_{n}$ of all Boolean circuits $C$ on $\lceil\log n\rceil$ input variables and of size at most $n^{\delta}$, where $\delta\stackrel{{\scriptstyle\rm def}}{{=}}\varepsilon/10$. Each circuit $C\in\mathcal{C}_{n}$ computes a Boolean function $f_{C}\colon\{0,1\}^{\lceil\log(n)\rceil}\to\{0,1\}$, and its truth-table $\mathsf{tt}(f_{C})$ is a string of length $\geq n$. We consider the following family $\mathcal{H}^{\mathsf{easy}}=\{H_{n}^{\mathsf{easy}}\}$ obtained from $\mathcal{C}_{n}$:

By our choice of $\delta=\varepsilon/10$ and a standard upper bound on the number of small circuits (cf. [1]), there are at most $O(2^{n^{2\delta}})\leq O(2^{n^{\varepsilon/2}})$ strings in $\mathcal{H}_{n}^{\mathsf{easy}}$. Furthermore, an ordered list containing all such strings can be printed in time $O(2^{n^{\varepsilon}})$.

The following lemma is key to our analysis of $\mathcal{H}^{\mathsf{easy}}$.

Next we define the candidate hitting set family $\mathcal{H}^{\mathsf{hard}}$. Assume that the $\mathsf{PSPACE}$-complete language $L^{\star}$ from Theorem 7 can be decided in space $O(n^{a})$, where $a\in\mathbb{N}$. Let $\delta\stackrel{{\scriptstyle\rm def}}{{=}}\varepsilon/(10a)$. Consider the function $G^{\star}$ obtained from an application of Theorem 7 with stretch parameter $b=1/\delta$ and the parameter $c$ set as in the statement of Theorem 2. This gives a sequence $\{G^{\star}_{\ell}\}_{\ell\in\mathbb{N}}$ of functions computable with oracle access to $L^{\star}_{\leq\ell}$ in time $\mathsf{poly}(\ell)$, where each $G^{\star}_{\ell}\colon\{0,1\}^{\ell}\to\{0,1\}^{\ell^{b}}$. Consider a seed function $s(n)\stackrel{{\scriptstyle\rm def}}{{=}}\lceil n^{\delta}\rceil$, and let $G_{n}\stackrel{{\scriptstyle\rm def}}{{=}}G^{\star}_{s(n)}$. Since $b=1/\delta$, we have

In addition, $G_{n}$ can be computed in time $O(2^{n^{\varepsilon/5}})$ without access to an oracle. This is because the oracle answers to $L_{\leq n^{\delta}}$ can be computed within this running time due to our choice of parameters and the fact that bounded-space algorithms run in time at most exponential.