RELATIONSHIP BETWEEN BPP AND OTHER CLASSES

machine outputs “heads” and stops; ifb_i >p_i, the machine outputs “tails” andhalts;

otherwise, the machine goes to stepi+1. Clearly, the machine reaches stepi+1 iff b_j=p_jfor allj≤i, which happens with probability 1/2ⁱ. Thus the probability of “heads”

is

ip_i2¹_i, which is exactlyρ. Furthermore, the expectedrunning time is

ii^c· ₂¹i. For every constantc, this infinite sum is bounded by another constant (see Exercise7.2).

Conversely, probabilistic algorithms that only have access toρ-coins do not have less power than standard probabilistic algorithms:

Lemma 7.13von-Neumann[vN51] A coin withPr[Heads] =1/2can be simulated by a probabilistic TM with access to a stream ofρ-biased coins in expected time O(_ρ(1¹_−ρ)).# Proof: We construct a TMMthat given the ability to tossρ-coins, outputs a 1/2-coin.

The machineM tosses pairs of coins until the first time it gets a pair containing two different results (i.e., “Heads-Tails” or “Tails-Heads”). Then, if the first of these two results is “Heads” it outputs “Heads” and otherwise it outputs “Tails.”

The probability that a pair of coins comes up “Head-Tails” isρ(1−ρ), while the probability it comes up “Tails-Heads” is(1−ρ)ρ =ρ(1−ρ). Hence, in each stepM halts with probability 2ρ(1−ρ), andconditionedonMhalting in a particular step, the outputs “Heads” and “Tails” are equiprobable (i.e.,M’s output is a fair coin). Note that we didnot needto knowρto run this simulation.

Weak random sources. Physicists (andphilosophers) are still not completely certain that randomness exists in the world, and even if it does, it is not clear that our computers have access to an endless stream of independent coins. Conceivably, it may be the case that we only have access to a source ofimperfectrandomness that, although somewhat unpredictable, does not consist of independent coins. In Chapter 21, we show how to use such imperfect sources to run probabilistic algorithms that were designed assuming perfect randomness.

7.5 RELATIONSHIP BETWEEN BPP AND OTHER CLASSES

Below we will show thatBPP ⊆ P_/poly. Thus P ⊆ BPP ⊆ P_/poly. Furthermore, we show thatBPP⊆^p₂∩^p₂andso ifNP=P, thenBPP=P. Of course, since we do not believeP=NP, this still leaves open the possibility thatP =BPP. However, as mentionedabove (andwill be elaboratedin Chapters 19and20), we can show that if certain plausible complexity-theoretic conjectures are true, thenBPP=P. Thus we suspect thatBPPis the same asPandhence (by the Time Hierarchy Theorem)BPPis a proper subset of, say,DTIME(n^logn). Yet currently researchers are not even able to show thatBPPis a proper subset ofNEXP.

7.5.1 BPP⊆P_/poly

Now we show that allBPPlanguages have polynomial sizedcircuits. Together with Theorem6.19this shows that unless the polynomial-hierarchy collapses,3SATcannot be solvedin probabilistic polynomial time.

Theorem 7.14 [Adl78]

BPP⊆P_/poly.

Proof: SupposeL ∈ BPP, then by the alternative definition of BPPandthe error reduction procedure of Theorem7.10, there exists a TMMthat on inputs of sizenuses mrandom bits and such that for everyx ∈ {0, 1}ⁿ, Pr_r[M(x,r)= L(x)] ≤ 2⁻ⁿ⁻¹. Say that a stringr∈ {0, 1}^misbadfor an inputx∈ {0, 1}ⁿifM(x,r)=L(x)andotherwise callr good for x. For every x, at most ^2m

2ⁿ⁺¹ strings r are badforx. Adding over all x ∈ {0, 1}ⁿ, there are at most 2ⁿ· ₂²_n+1^m = 2^m/2 stringsr that are badforsome x. In particular, there exists a stringr₀∈ {0, 1}^m that is goodforevery x∈ {0, 1}ⁿ. We can hardwire such a stringr₀to obtain a circuitC(of size at most quadratic in the running time ofM) that on inputxoutputsM(x,r₀). The circuitCwill satisfyC(x)=L(x)for everyx∈ {0, 1}ⁿ.

7.5.2 BPPis inPH

At first glance,BPPseems to have nothing to do with the polynomial hierarchy, so the next theorem is somewhat surprising.

Theorem 7.15 (Sipser-Gács Theorem) BPP⊆^p₂∩^p₂.

Proof: It is enough to prove thatBPP⊆^p₂becauseBPPis closedunder complemen-tation (i.e.,BPP=coBPP).

SupposeL∈BPP. Then by the alternative definition ofBPPandthe error reduc-tion procedure of Theorem7.10there exists a polynomial-time deterministic TMMfor Lthat on inputs of lengthnusesm=poly(n)random bits and satisfies

x∈L⇒Pr

r [M(x,r)accepts ]≥1−2⁻ⁿ x∈L⇒Pr

r [M(x,r)accepts ]≤2⁻ⁿ

Forx∈ {0, 1}ⁿ, letS_xdenote the set ofr’s for whichMaccepts the input pairx,r. Then either|Sx| ≥ (1−2⁻ⁿ)2^m or|Sx| ≤2⁻ⁿ2^m, depending on whether or notx ∈L.

We will show how to check, using two quantifiers, which of the two cases is true.

Figure 7.1.There are only two possible sizes for the set ofr’s such thatM(x,r)=Accept: Either this set is almost all of{0, 1}^m, or it is a tiny fraction of{0, 1}^m. In the former case, a few random “shifts” of this set are quite likely to cover all of{0, 1}^m. In the latter case, the set’s size is so small that a few shifts cannot cover{0, 1}^m.

7.5. Relationship BetweenBPPand Other Classes 137 For a set S ⊆ {0, 1}^m andstringu ∈ {0, 1}^m, we denote byS+u the “shift” of the setSbyu:S+u= {x+u:x∈S}where+denotes vector addition modulo 2 (i.e., bitwise XOR). Letk=_m

n

+1. Theorem7.15is impliedby the following two claims (see Figure 7.1).

Claim 1: For every setS ⊆ {0, 1}^m with|S| ≤ 2^m−n andeveryk vectors u1,. . .,u_k,

∪^k_i=1(S+u_i)= {0, 1}^m.

Proof: Since|S+u_i| = |S|, by the union boundwe have| ∪^k_i=1(S+u_i)| ≤k|S|<2^m (for sufficiently largen).

Claim 2: For every setS ⊆ {0, 1}^mwith|S| ≥(1−2⁻ⁿ)2^m, there existu₁,. . .,u_ksuch that∪^k_i=1(S+ui)= {0, 1}^m.

Proof: This follows from the probabilistic method: We claim that if u₁,. . .,u_k are chosen independently at random, then Pr[∪^k_i=1(S+u_i) = {0, 1}^m] > 0. Indeed, for r ∈ {0, 1}^m, letB_r denote the “bad event” that ris not in∪^k_i=1(S+u_i). It suffices to prove that Pr[∃_{r∈{0, 1}}^mB_r]<1, which will follow by the union boundif we can show for everyrthat Pr[Br]<2^−m. ButBr = ∩_i∈[k]Bⁱ_r whereBⁱ_ris the event thatr∈S+ui, or, equivalently, thatr+u_i ∈S(using the fact that modulo 2, a+b= c⇔a =c+b).

Yet,r+u_i is a uniform element in{0, 1}^m, andso it will be in Swith probability at least 1−2⁻ⁿ. Furthermore, the eventsBⁱ_rare independent for differenti’s implying that Pr[B_r] =Pr[Bⁱ_r]^k ≤2^−nk<2^−m.

Together Claims1and2show thatx∈Lif andonly if the following statement is true:

∃u1,. . .,u_k∈ {0, 1}^m ∀r∈ {0, 1}^m r∈ ∪^k_i=1(Sx+ui) or, equivalently,

∃u1,. . .,u_k ∈ {0, 1}^m ∀r∈ {0, 1}^m k i=1

M(x,r⊕u_i)accepts

which represents a^p₂computation sincekis poly(n). Hence we have shownL∈2. 7.5.3 Hierarchy theorems and complete problems?

The reader may have wondered if BPP has complete problems, or if probabilistic computation has hierarchy theorems. Now we discuss this.

Complete problems for BPP?

Though a very natural class,BPPbehaves differently in some ways from other classes we have seen. For example, we know of no complete languages forBPP. One reason for this difficulty is that the defining property ofBPTIMEmachines issemantic, namely, that they accept every input string either with probability at least²/³or with probability at most¹/³. Testing whether a given TMMhas this property is undecidable. By contrast, the defining property of an NDTM issyntactic:Given a string, it is easy to determine if it is a validencoding of an NDTM. Complete problems seem easier to findfor syntactically

defined classes than for semantically defined ones. For example, consider the following natural attempt at aBPP-complete language: DefineLto contain all tuplesM,x, 1^t such that on inputx,Moutputs 1 withintsteps with probability at least²/³. The language Lis indeedBPP-hardbut is not known to be inBPPsince forM,x, 1^t ∈Lwe could have Pr[M(x)=1] =¹/²(say), which is greater than¹/³. In fact, we will see in Chapter17 that this language is#P-complete andhence unlikely to be in any level of the polynomial hierarchy unless the hierarchy collapses. However if, as believed,BPP=P, thenBPP does have a complete problem (sincePdoes).

Does BPTIME have a hierarchy theorem?

Is every problem inBPTIME(n²)also inBPTIME(n)? One wouldimagine not, and this seems like the kindof result we shouldbe able to prove using the diagonalization techniques of Chapter3. However currently we are even unable to show that, say, BPTIME(n)=BPTIME(n^(logn)10). The standard diagonalization techniques fail, again apparently because the defining property ofBPTIMEmachines is semantic. However, recently there has been some progress on obtaining hierarchy theorems for some closely relatedclasses (see the chapter notes).