On Generating Solved Instances of Computational Problems

We consider the e cient generation of solved instances of computational problems. In particular, we consider invulnerable generators. Let S be a subset of f0; 1g and M be a Turing Machine that accepts S; an accepting computation w of M on input x is called a \witness" that x 2 S. Informally, a program is an -invulnerable generator if, on input 1 n , it produces instancewitness pairs hx; wi, with jxj = n, according to a distribution under which any polynomial-time adversary who is given x fails to nd a witness that x 2 S, with probability at least , for in nitely many lengths n. The question of which sets have invulnerable generators is intrinsically appealing theoretically, and the results can be applied to the generation of test data for heuristic algorithms and to the theory of zero-knowledge proof systems. The existence of invulnerable generators is closely related to the existence of cryptographically secure one-way functions. We prove three theorems about invulnerability. The rst addresses the question of which sets in NP have invulnerable generators, if indeed any NP sets do. The second addresses the question of how invulnerable these generators are. Theorem (Completeness): If any set in NP has an -invulnerable generator, then SAT has one. Theorem (Ampli cation): If S 2 NP has a -invulnerable generator, for some constant 2 (0; 1), then S has an -invulnerable generator, for every constant 2 (0; 1). Our third theorem on invulnerability shows that one cannot, using techniques that relativize, resolve the question of whether the assumption that P 6= NP alone su ces to prove the existence of invulnerable generators. Clearly there are relativized worlds in which invulnerable generators exist; in all of these worlds, P 6= NP. The more subtle question, which we resolve in our third theorem, is whether there are also relativized worlds in which P 6= NP and invulnerable generators do not exist. Theorem (Relativization): There is an oracle relative to which P 6= NP but there are no invulnerable generators. More generally, we ask which sets can be generated according to which distributions. In particular, the simplest requirement that can be imposed on a generator is that it produce some x 2 S of length n, if at least one such x exists; we call such a generator an exempli er. It seems at rst that the sets in P or even NP that one encounters \naturally" are all exempli able. Nevertheless, we show: Theorem: There are sets in P that are not exempli able, unless E = NE. More generally, there are sets in P i that are not exempli able, unless E = E i+1 . DEC Systems Research Center, Palo Alto, CA 94301. y Rutgers University, New Brunswick, NJ 08903. z AT&T Bell Laboratories, Murray Hill, NJ 07974. x Columbia University, New York, NY 10027.