Separations in query complexity using cheat sheets

Let $f$ be function from a domain $D\subseteq\Sigma^{n}$ to $\{0,1\}$, where $\Sigma$ is some finite set.  Usually $\Sigma=\{0,1\}$, and we assume this for simplicity below, although most complexity measures are easily generalized to larger input alphabets.  A function $f$ is called a total function if $D=\Sigma^{n}$. Otherwise, we say $f$ is a partial function or a promise problem and refer to $D$ as the promised set or the promise.

For any two (possibly partial) Boolean functions $g:G\to\{0,1\}$, where $G\subseteq\{0,1\}^{n}$, and $h:H\to\{0,1\}$, where $H\subseteq\{0,1\}^{m}$, we can define the composed function $g\circ h:D\to\{0,1\}$, where $D\subseteq\{0,1\}^{nm}$, as follows.  For an input $(z_{1},z_{2},\ldots,z_{nm})\in\{0,1\}^{nm}$, we define $g\circ h$ as follows (as depicted in Figure 1):

where the function $g\circ h$ is only defined on $z$ where the inputs to the $h$ gates lie in the domain $H$ and the $n$-bit input to $g$, $(h(z_{1},\ldots,z_{m}),h(z_{m+1},\ldots,z_{2m}),\ldots,h(z_{(n-1)m+1},\ldots,z_{nm}))$, lies in $G$.

Some Boolean functions that we use in this paper are $\textsc{And}_{n}$ and $\textsc{Or}_{n}$, the And and Or functions respectively on $n$ bits, and $\textsc{And-Or}_{n^{2}}:\{0,1\}^{n^{2}}\to\{0,1\}$, defined as $\textsc{And}_{n}\circ\textsc{Or}_{n}$.

Formal definitions of most measures introduced here may be found in the survey on query complexity by Buhrman and de Wolf [BdW02] and in the recent paper of Ambainis et al. [ABB⁺15].

In the model of query complexity, algorithms may only access the input by asking queries to an oracle that knows the input $x\in D$.  The queries are of the form “what is $x_{i}$?” for some $i\in[n]$ and the oracle responds with the value of $x_{i}\in\Sigma$.  The goal is to minimize the number of queries made to compute $f$.

We use $D(f)$ to denote the deterministic query complexity of computing $f$, the minimum number of queries that have to be made by a deterministic algorithm that outputs $f(x)$ on every input $x$.  We use $R(f)$ to denote bounded-error randomized query complexity, the minimum number of queries made by a randomized algorithm that outputs $f(x)$ on input $x$ with probability at least $2/3$.  We use $R_{0}(f)$ to denote zero-error randomized query complexity, the minimum number of queries made by a randomized algorithm that must output either the correct answer, $f(x)$, on input $x$ or output $*$, indicating that it does not know the answer.  However, the probability (over the internal randomness of the algorithm) that it outputs $*$ should be at most $1/2$ on any $x\in D$.

Similarly, we study quantum analogues of these measures.  The quantum analogue of $D(f)$ is exact quantum query complexity, denoted $Q_{E}(f)$, the minimum number of queries made by a quantum algorithm that outputs $f(x)$ on every input $x\in D$ with probability 1.  The quantum analogue of $R(f)$ is bounded-error quantum query complexity, denoted $Q(f)$, where the algorithm is only required to be correct with probability at least $2/3$.

We also study some measures related to the complexity of certifying the output.  For a function $f$, let $C_{1}(f)$ denote the minimum number of bits of a $1$-input, i.e., an input with $f(x)=1$, that have to be revealed to convince a verifier that $f(x)=1$.  Alternately, imagine the verifier is allowed to interact with an untrustworthy prover who claims that $f(x)=1$, and is allowed to provide an arbitrarily long witness for this.  After receiving the witness, the verifier makes at most $C_{1}(f)$ queries to the input and decides whether to accept that $f(x)=1$ or not.  We require that if $f(x)=1$, then there is some witness that makes the verifier accept and if $f(x)=0$ then no witness makes the verifier accept.  Similarly we define $C_{0}(f)$ as the analogous notion for $0$-inputs.  Finally the certificate complexity of $f$, or $C(f)$, is defined as $\max\{C_{0}(f),C_{1}(f)\}$.  Similarly, if the verifier is randomized and only needs to accept valid proofs and reject invalid proofs with probability greater than $2/3$, we get the bounded-error randomized analogues $\operatorname{RC}_{0}(f)$, $\operatorname{RC}_{1}(f)$, and $\operatorname{RC}(f):=\max\{\operatorname{RC}_{0}(f),\operatorname{RC}_{1}(f)\}$ [Aar06].

We also study a combinatorial measure of a function called block sensitivity, denoted $\operatorname{bs}(f)$.  For a function $f$ and input $x$, a block of bits $B\subseteq[n]$ is said to be sensitive for $x$ if the input obtained by complementing all the bits $x_{i}$ for $i\in B$ yields an input $y\in D$ with $f(x)\neq f(y)$.  The block sensitivity of $f$ on input $x$ is the maximum number of disjoint blocks sensitive for $x$.  The block sensitivity of $f$ is the maximum block sensitivity over all inputs $x\in D$.

Lastly we study measures related to representing a function with a polynomial with real coefficients.  The (exact) degree of $f$, denoted $\deg(f)$, is the minimum degree of a real polynomial $p$ over the variables $x_{1},x_{2},\ldots,x_{n}$, such that $p(x_{1},x_{2},\ldots,x_{n})=f(x)$ for all $x\in D$.  Similarly, the approximate degree of $f$, denoted $\operatorname{\widetilde{\deg}}(f)$, is the minimum degree of a polynomial that approximates the value of $f(x)$ on every input $x\in D$, i.e., for all $x\in D$ the polynomial satisfies $|p(x)-f(x)|\leq 1/3$.

All the measures introduced in this section lie between $0$ and $n$.  For most measures this follows because the algorithm may simply query all $n$ input variables and compute $f(x)$.  Also, any Boolean function $f$ can be exactly represented by a real polynomial of degree at most $n$.

We now summarize the best known relations between the complexity measures studied in this paper.  Figure 2 depicts all known relations of the type $M_{1}(f)=O(M_{2}(f))$ for complexity measures $M_{1}(f)$ and $M_{2}(f)$.  An upward line from $M_{1}$ to $M_{2}$ in Figure 2 indicates $M_{1}(f)=O(M_{2}(f))$ for all (partial or total) Boolean functions $f$.  Most of these relations follow straightforwardly from definitions.  For example $R_{0}(f)\leq D(f)$ because any deterministic algorithm is also a zero-error randomized algorithm.  The relationships that do not follow from such observations are $\operatorname{bs}(f)=O(\operatorname{RC}(f))$ [Aar06], $\deg(f)=O(Q_{E}(f))$ [BBC⁺01], and $\operatorname{\widetilde{\deg}}(f)=O(Q(f))$ [BBC⁺01].

All other known relationships between these measures follow by combining the relationships in Figure 2 with the following relationships that hold for all total Boolean functions:

• •

  $C(f)\leq\operatorname{bs}(f)^{2}$ [Nis91]

• •

  $D(f)\leq C(f)\operatorname{bs}(f)$ [BBC⁺01]

• •

  $D(f)\leq\deg(f)^{3}$ [Mid04, Tal13]

• •

  $\operatorname{RC}(f)=O(\operatorname{\widetilde{\deg}}(f)^{2})$ [KT13]

• •

  $R_{0}(f)=O(R(f)^{2}\log R(f))$ [KT13]

We now turn to the best known separations between these measures.  To conveniently express these results, we use a notion called the critical exponent, as defined by [GSS13].  The the critical exponent for a measure $M_{1}$ relative to a measure $M_{2}$, denoted $\operatorname{crit}(M_{1},M_{2})$, is the infimum over all $r$ such that the relation $M_{1}(f)=O(M_{2}(f)^{r})$ holds for all total functions $f$. For example, because $D(f)\leq C(f)^{2}$ for all total $f$, we have $\operatorname{crit}(D,C)\leq 2$.  Furthermore, since we also know that the And-Or function on $k^{2}$ bits satisfies $D(f)=k^{2}$ and $C(f)=k$, we have $\operatorname{crit}(D,C)=2$.  Note that the critical exponent between $M_{1}$ and $M_{2}$ is $2$ even if we have $M_{1}(f)=O(M_{2}(f)^{2}\log M_{2}(f))$, or more generally if $M_{1}(f)\leq M_{2}(f)^{2+o(1)}$.

Table 2 lists the best known separations between these measures.  A cell in the table has the form $a,b$, where $a\leq b$ are the best known lower and upper bounds on the critical exponent for the row measure relative to the column measure.  The cell also contains a citation for the function that provides the lower bound.  For example, in the cell corresponding to row $D$ and column $\deg$, we have the entry $2,3$, which means $2\leq\operatorname{crit}(D,\deg)\leq 3$, and a function achieving the separation appears in [GPW15].

We begin with the best known separation between randomized and quantum query complexity for partial functions, which is currently $\widetilde{\Omega}(\sqrt{n})$ versus $1$ provided by the Forrelation problem [AA15].  (Note that Simon’s problem also provides a similar separation up to log factors [Sim97].)  Let $g$ be the Forrelation function on $D\subseteq\{0,1\}^{n}$ with $R(g)=\widetilde{\Omega}(\sqrt{n})$ and $Q(g)=1$, although any function with these query complexities (up to log factors) would do.

One way to make $g$ total would be to define it to be $0$ on the rest of the domain $\{0,1\}^{n}\setminus D$.  But then it is unclear if the new function $g$ has low quantum query complexity, since the quantum algorithm would have to test whether the input lies in the promised set $D$.  In general since partial function separations often require a stringent promise on the input, we may expect that it is necessary to examine most input bits to ascertain that $x\in D$.

Indeed, it is not even clear how to certify that $x\in D$ for our function $g$.  On the other hand, the domain certification problem is trivial for total functions.  So we can compose $g$ with a total function $h$ to obtain some of the desirable properties of both.  We can certify that an input to $g\circ h$ lies in its domain by certifying the outputs of all instances of $h$.  This means we want $h$ to have low certificate complexity, and since we will use $g\circ h$ to separate randomized and quantum query complexity, we would also like $h$ to have $Q(h)$ smaller than $R(h)$.  A function that fits the bill perfectly is the $\textsc{And-Or}_{m^{2}}$ function that satisfies $R(h)=\Omega(m^{2})$, $C(h)=m$, and $Q(h)=O(m)$.

We can now compute the various complexities of $f:=g\circ h$.  First we have $Q(f)=\widetilde{O}(m)$, by composing algorithms for $g$ and $h$.  There also exists a certificate of size $\widetilde{O}(nm)$ that proves that the input satisfies the promise, since we can certify the outputs of the $n$ different $h$ gates using certificates of size $C(h)=m$.  Also, given query access to this certificate of size $\widetilde{O}(nm)$, a quantum algorithm can check the certificate’s validity using Grover search in $\widetilde{O}(\sqrt{nm})$ queries.  Hence a quantum algorithm with access to a certificate can solve the problem with $\widetilde{O}(m+\sqrt{nm})$ queries.  On the other hand, it can be shown that $R(f)=R(g\circ h)=\Omega(R(g)R(h))=\widetilde{\Omega}(\sqrt{n}m^{2})$.

Now if we set $m=n$, then we see that $Q(f)=\widetilde{O}(n)$ and $R(f)=\widetilde{\Omega}(n^{2.5})$, but $f$ is still a partial function.  However, $f$ has the desirable property that a quantum algorithm given query access to a certificate can decide whether the input satisfies the promise using $\widetilde{O}(n)$ queries.  But we cannot simply append the certificate to the input as we do not want the randomized algorithm to be able to use it.  It is, however, acceptable if the randomized algorithm finds the certificate after it spends $R(f)$ queries, since that is the lower bound we want to prove.

What we would like is to hide the certificate somewhere in the input where only the quantum algorithm can find it.  What information do we have that is only known to the quantum algorithm and remains unknown to the randomized algorithm unless it spends $R(f)$ queries?  Clearly the value of $f$ on the input has this property.

While one bit does not help much, we can obtain additional bits of this kind by using (say) $10\log n$ copies of $f$.  Now the answer string to these problems can address an array of size $n^{10}$, much larger than can be brute-force searched by a randomized algorithm in a reasonable amount of time.  Furthermore, this address can be found by a quantum algorithm using only $\widetilde{O}(Q(f))$ queries.  At this location we will store a cheat sheet: a collection of certificates for all $10\log n$ instances of $f$.

Now the new function, which we call $f_{\mathrm{CS}}$ (shown in Figure 3), evaluates to $1$ if and only if the $10\log n$ inputs are in the domain of $f$, and the outputs of the $10\log n$ copies of $f$ point to a valid cheat sheet, i.e., a set of valid certificates for the $10\log n$ copies of $f$.  This construction ensures that the quantum algorithm can find the cheat sheet using $\widetilde{O}(Q(f))=\widetilde{O}(n)$ queries, and then verify it using $\widetilde{O}(n)$ queries, which gives $Q(f_{\mathrm{CS}})=\widetilde{O}(n)$. On the other hand, we intuitively expect that the randomized algorithm cannot even find the cheat sheet unless it computes $f$ by spending at least $R(f)=\widetilde{\Omega}(n^{2.5})$ queries, which gives us the desired separation.

In this section we prove Theorem 1, restated for convenience:

See 1

Let $g$ be the Forrelation function on $D\subseteq\{0,1\}^{n}$ with $R(g)=\widetilde{\Omega}(\sqrt{n})$ and $Q(g)=O(1)$.  Let $h:\{0,1\}^{m^{2}}\to\{0,1\}$ be the $\textsc{And-Or}_{m^{2}}$ function, defined as $\textsc{And}_{m}\circ\textsc{Or}_{m}$. This function satisfies $R(h)=\Omega(m^{2})$, which can be shown using a variety of methods: it follows from the partition bound [JK10, Theorem 4] and also from our more general Theorem 5.  We also have $C(h)=m$, since one $1$ from each Or gate is a valid $1$-certificate and an Or gate with all zero inputs is a valid $0$-certificate.  Lastly, $Q(h)=\widetilde{O}(m)$ follows from simply composing quantum algorithms for And and Or, and indeed $Q(h)=O(m)$ [HMdW03].

Let $f=g\circ h$ be a partial function on $nm^{2}$ bits.  We have $Q(f)=O(m)$ by composition, since quantum algorithms can be composed in general without losing a log factor due to error reduction [Rei11, LMR⁺11].  There also exists a certificate of size $\widetilde{O}(nm)$ that proves that the input satisfies the promise, since we can certify the outputs of the $n$ different $h$ gates using $C(h)=m$ pointers to the relevant input bits.  Since each pointer uses $O(\log n)$ bits, the certificate is of size $\widetilde{O}(nm)$.  Also note that a quantum algorithm with query access to this certificate can check its validity using Grover search in $\widetilde{O}(\sqrt{nm})$ queries.

Lastly, we claim that $R(f)=R(g\circ h)=\Omega(R(g)R(h))=\widetilde{\Omega}(\sqrt{n}m^{2})$.  While a general composition theorem for bounded-error or zero-error randomized query complexity is unknown, we can show such a result when the inner function is the Or function.