Invertible Zero-Error Dispersers and Defective Memory with Stuck-At Errors

1. Invertible Zero-Error Dispersers and Defective Memory with Stuck-At Errors Ariel Gabizon Ronen Shaltiel

2. Defective memory with stuck-at errors n-bit memory with ≤ p∙n “stuck bits” (can’t write) Goal: store msgz. msgz 0 0 0 1 1 1 Storage proc. Encknows which bits are stuck. In standard codes we expect* rate 1-h(2p)-o(1). Enc * 0 0 1 1 0 0 * 0 * 1 * Reading proc. Dec must retrieve z,doesn’t know which bits are stuck. Earlier work [KuzTsy] shows existence of non-explicit schemes. Error-correcting codes where encoder knows in advance which bits will be corrupted. Dec Give explicit schemes. p:storen-p∙n-logcnbits. Rate > 1-p-o(1).

3. We can also handle few additional errs n-bit memory with ≤ p∙n “stuck bits” (can’t write) Goal: store msgz. msgz 0 0 0 0 0 1 1 1 1 1 1 1 Storage proc. Encknows which bits are stuck. Enc 0 0 * 0 1 1 0 * 0 * 1 * Reading proc. Dec must retrieve z,doesn’t know which bits are stuck. Noise Give explicit schemes. Handle o(n½) unknown errs. Rate > 1-p-o(1). Dec

4. Dfn of memory scheme (for parameter 0<p<1): `Defect pattern’:SubsetSµ[n] of size ≤p∙n, String a2{0,1}p∙n. -Encoding proc. Enc, on messagez 2{0,1}m and pattern S,aproduces x2{0,1}nwithx|S=a. -Decoding proc. Dec such that Dec(x) = z Dec doesn’t depend on S,a m/n is the rateof the scheme. Explicit: Encexpected poly-time*, Decpoly-time. *Simply because that’s what we get.

5. Write Once Memory (k-WOM) 1 1 n-bit memory initialized to zeros. If we raise a bit, it is “stuck-at” 1. Goal: Reuse memory k times. (think k=2). • Stuck-at scheme => 2-WOM, gives opt. rate ≈ h(p) + (1-p). • Intuitively WOM is easier to achieve. • Defect pattern is not adversarial. • Can pass o(n) bits from enc to decby reserving first o(n) bits. (errorless channel from enc to dec). • Starting point for this work: • Shpilka: Linear seeded extractors => 2-WOM. • We generalize: seedless zero-error disp. for bit-fixing sources  schemes for stuck-at errors. 0 0 0 0 0 0

6. Bit-fixing sources and dispersers: Sµ[n] – subset of size p∙n. a – string in {0,1}p∙n XS,a, set of strings in {0,1}n, s.t.x|S=a. Call such a set a bit-fixing source. |XS,a|=2kfor k=n-p∙n (# unfixed bits). Dfn:D:{0,1}n{0,1}mis azero-error bit-fixing disperser for threshold k if S,a as above D(XS,a)={0,1}m. (Explicit:poly-time). Goal: achieve large m. Obviously m ≤ k = n-p∙n. Efficiently invertible:given S,a and outputz, can find x2XS,a with D(x) = zin expected* poly(n)-time. *Simply because that’s what we get. D * * 0 * * * * 1 *

7. Dispersers => memory schemes (and vice-versa) • Bit-fixing disperser D:{0,1}n{0,1}m. • Encoding: Given message z2{0,1}mand defect pattern S,a,Enc finds x2XS,a with D(x) = z. • Decoding: Given x, Dec computes D(x)=z. • Output len. m=(1-o(1))∙k => optimal rate. • Explicitness of scheme follows if D is explicit and efficiently invertibile. • This work: construct such dispersers (for k>logcn). Improve [GabSha08] where m=(k).

8. Construction of zero-error disperser

9. Seeded zero-error dispersers • Dfn: E(x,y) is a seeded bit-fixing disperserfor threshold k, if z, and bit-fixing source XS,awith k unfixed bits, there exist: • a seed y, and • x2XS,a • such that E(x,y) = z. • E is efficiently invertibleif x,y can be found in expected poly(n)-timegiven z,S,a. • Known [RazReiVad]: m=(1-o(1))∙k, |y|=log3n. • Shpilka: 2-WOM, Enc and Dec can share o(n)bits. Given z,S,a,Encfinds y and shares it.

10. Linear seeded extractors => seeded bit-fixing disperser • Known: Explicit constructions of E(x,y) s.t. • bit-fixing source*XS,awith k unfixed bits, for most y’s E(XS,a,y) is close to uniform. • y: T(x)=E(x,y) islinearover F2n. • * In fact, distribution with min-entropy ≥ k. • XS,a is an affine subspace of F2n. • E is a seeded bit-fixing source disperser that is efficiently invertible. • [Tre99,ShaUma01]: seedO(log n),output√k • [RazReiVad00]: seedO(log3n), output (1-o(1))k

11. (Seedless) disperser construction: Step 1: (seedless) disperser with short outputm=O(log n)that is efficiently invertible. Step 2:(Using approach of [GabSha08]) Combine with seeded disperser with large output length to get (seedless) and efficiently invertible disperserwith large output length.

12. Step 1: Disperser with m=O(log n) Thm: Any explicit bit-fixing extractor* D:{0,1}n{0,1}mwith m=O(log n) is efficiently invertible. *Say, PrXXS,a[D(X)=z] ¸ 2-2m = 1/poly(n) Known Explicit constructions: [KempZuck03,GabRazSha04,Rao09]. Proof: Sample random x2XS,aand check if D(x) =z.Will take expected poly(n)-time.

13. Step 2: Increasing output length with threshold k’rather than k • -D(x) is ab.f.d. with output length O(log n) • -E(x,y) is a seeded b.f.d. with seed O(log n) • F(x) , E(x,D(x)) has large m. Disperser? • [GabSha08]: Yes, if E is a `subsource hitter’: • S,a z ybit-fixing source XS’,a’s.t. • {xXS,a: E(x,y)=z} containsXS’,a’ • XS’,a’ has k’ unfixed bits (for k’<<k not tiny). • Proof: xs.t. D(x)=y and then, • F(x) = E(x,D(x)) = E(x,y) = z. • Efficiently invertible if y,S’,a’ can be found in expected poly(n) time given S,a,z. => F is efficiently invertible

14. Step 2: Increasing output length with threshold k’rather than k • -D(x) is ab.f.d. with output length O(log n) • -E(x,y) is a seeded b.f.d. with seed O(log n) • F(x) , E(x,D(x)) has large m. Disperser? • [GabSha08]: Yes,if E is a `subsource hitter’: • S,a z ybit-fixing source XS’,a’s.t. • {xXS,a: E(x,y)=z} containsXS’,a’ • XS’,a’ has k’ unfixed bits (for k’<<k not tiny). • E linear seeded => z y : {xXS,a: E(x,y)=z} is an affine subspace of dimk’ := k-m. • Works if D is an extractor for affine sources [Bou07,Yeh10,Li11]for k=n/(log log n)½. affine subspace

15. Dispersers for affine sources • Get: zero-error disperser for affine sources. • Used in memory scheme w/ additional errs. • Have explicit D only for k=n/(log log n)½. • Final disperser has k > n/(log log n)½. • Output length m = k - O(n/(log log n)½). • Suffices for achieving rate 1-p-o(1). • In paper:Subsource-hitter for bit-fixing. • => Final disperser for bit-fixing sources. • Works for any k > logcn. • Output length m = k - O(logcn). • Gives schemes with m = n-p∙n - O(logcn).

16. Subsource hitter (Inspired by[GabRazSha]) Linear seeded extractors Subsource hitter for bit-fixing sources. XS,a XS,a seed y * * * * 0 * 0 * * * * * * * 1 1 * * seed y seed y’ • y’ - seed for sampler, selects subset of [n]. • y’ that partitions unfixed bits: • Most unfixed bits are selected. • At least k’ bits are not selected. • Apply E(∙,y) only on selected portion of x.

17. Handling stuck-at memory with noise Given msgz and defect patternS,a: Findx Code ∩ XS,as.t. D(x)=z. Idea:Force Enc to output codeword in code for noise. Need code: defect patternmany consistent codewords. Linear code w/ dual distp∙n. Code ∩ XS,ais affine space. dimn-p∙n-o(n) (for n½ errs) Use affine source disp. k=n-p∙n-o(n) => m=n-p∙n-o(n). => rate 1-p-o(1). msgz 0 0 0 0 0 1 1 1 1 1 1 1 Given corruptedx’ that is close to x: Decodex’ to find x. Compute D(x) to get msgz. Enc 0 * 0 1 1 0 0 0 * * 1 * Noise Dec

18. Open questions • Construct invertible dispersers for `Hamming sources’: Hamming balls of radius p∙n around some point x{0,1}n. • Want: output lenm approaching h(p)∙n. • Motivated by k-WOMs. • Issues with definition of explicitness. • Our constructions should give 2-WOMs that are `more robust’ than known. • Don’t rely on channel from enc to dec. • Can handle additional errs. • Thanks

19. That’s it…

20. Standrad coding theory (unknown errors) msgz • If p∙n bits are corrupted, rate can be* ≈ 1-h(p) • Achieved by random codes. • Not known to be tight. • Explicit constructions achieve poorer rate. 0 0 1 0 0 0 1 1 1 0 1 1 Enc C(z) 0 0 1 1 0 0 Channel Dec

21. Suppose Enc\Dec know where errors are: msgz Channel replaces ≤p∙n bits by fixed bits. 0 0 1 0 1 Enc 0 0 * 0 1 1 0 * 0 * 1 Can trivially get get rate 1-p, by using `unstuck’ places Dec

22. What if only Enc knows errors? Channel replaces ≤p∙n bits by fixed bits. msgz Dec must retrieve zwithout knowing the error pattern 0 0 0 1 1 1 Enc 0 * 0 0 1 1 0 0 * * 1 * [Kuznetsov-Tsybakov:] possible to get any rate R < 1-p. We give first explicit schemes. rate R > 1-p-o(1). Dec

23. Dfn:A subsourceofXS,ais a set • XS’,a’ ½XS,a • for • S’¾S with |S’|·2p¢n. * 0 0 0 * * * * 1 1 * * XS,a: XS’,a’:

24. Dfn:E(x,y) is a subsource hitterif given z, there exists - a seedy - a subsourceXS’,a’ ofXS,a such that: E(XS’,a’,y) ´ z E is eff. invertible if y,XS’,a’ can be found in poly(n)-time.

25. Theorem of [GabSha08] -D is ab.f.d (for sets |S’|·2p¢n). -E is a subsource hitter. F(x) , E(x,D(x)) is a bit-fixing disperser. Proof: -Givenz,9XS’,a’ with E(XS’,a’,y)´z. -Also, 9x2XS’,a’ with D(x)=y. For this x: E(x,D(x))=E(x,y)=z.

26. Efficient Invertibilty of F Proof: -Givenz,9XS’,a’ with E(XS’,a’,y)´z. -Also, 9x2XS’,a’ with D(x)=y. For this x: E(x,D(x))=E(x,y)=z. E e.i.  can efficiently findXS’,a’,y. D e.i.  can eff. find x2XS’,a’ with D(x)=y.

27. Seeded dispersers subsource hitters: First, sample a random subset of the input bits. Apply seeded disperser only on this subset. * 0 * * 1 * apply E here Preimage set now includes all settings of non-fixed bits outside of the subset.

28. Similar results for `mixed’ scenario ‘stuck errors’ known to encoder+ noise added after encoding uses affine dispersers and error correcting codes rather than bit-fixing dispersers. We get similar improvements for output length of affine dispersers.

29. Open questions • -Invertible dispersers for `Hamming sources’: • Find mapping D:{0,1}n{0,1}m such that for all large enough hamming balls B • D(B) = {0,1}m , • and there is efficient way of finding preimage of z in B. • Thanks

30. Dispersers imply memory schemes Bit-fixing disperser D:{0,1}n{0,1}m. - Encoding: Given message z2{0,1}mand defect pattern S,a,Enc finds x2XS,a with D(x) = z. - Decoding: Given x, Dec computes D(x)=z. Output length m = (1-o(1))∙k => optimal rate. Explicitness of scheme follows if D is explicit and efficiently invertibile.

31. Coding Theory Fixed constant 0<p<1. Encoding function C:{0,1}m{0,1}n,n>m. -Messagez2 {0,1}m -CodewordC(z) 2 {0,1}n Decoder must retrieve z from C(z)after p∙n bits of C(z) have been corrupted. (will look at different dfns next) m/n ,the rate of C.

32. What if only Enc knows errors? msgz `defect pattern’- p∙n`stuck’ bits 0 0 0 1 1 1 Enc 0 0 * 0 1 1 0 * 0 * 1 * [Kuznetsov-Tsybakov:] possible to get any rate R < 1-p. We give first explicit schemes. Dec

33. Memory with stuck-at defects: Memory with n cells. 0<p<1, some constant. p∙n cells are `stuck’ either at 0 or 1. Person writing in memory knows which cells are stuck and to what values. Person reading memory does not.

34. Formal dfn of memory scheme: `Defect pattern’:SubsetSµ[n] of size p∙n, String a2{0,1}p∙n. Message z 2{0,1}m. -Encoding function E, givenS,a,z, produces x2{0,1}nwithx|S=a. -Decoding function D such that D(x) = z D doesn’t depend on S,a m/n is the rateof the scheme

35. Previous results and Ours [Kuznetsov-Tsybakov]: Introduced model. Non-explicit schemes with any rateR<1-p [Tsybakov]: Explicit schemesusing linear codes with rate<<1-p Our result: Explicit* schemeswith rate 1-p-o(1). *-Our encoding is runs in expected polynomial time.

36. Bit-fixing dispersers: D * * 0 * * * * 1 * Given all strings with a certain `defect pattern’ a bit-fixing disperser produces all possible outputs

37. Bit-fixing dispersers: Example: D(x1,…,xn) ,i xi (mod 2) D * * 0 * * * * 1 * Given all strings with a certain `defect pattern’ a bit-fixing disperser produces all possible outputs

38. Bit-fixing dispersers: Sµ[n] – subset of size p∙n. a – string in {0,1}p∙n XS,a, set of strings in {0,1}n, withx|S=a. Call such a set a bit-fixing source. Dfn:D:{0,1}n{0,1}mis abit-fixing disperser if for every S,a as above D(XS,a)={0,1}m (this is actually a zero-error disperser)

39. Bit-fixing dispersers: D * * 0 * * * * 1 * Another example: Suppose k=n-p∙n. Take the sum of input bits (mod k).. gives us logkoutput bits.

40. Dispersers to memory schemes: Bit-fixing disperser D(x). Message z -Given defect patternS,a,Enc finds x2XS,a with D(x) = z. -Dec simply computes D. Efficiency of scheme requires `efficient invertibility’ of D.

41. Dfn:We say D is efficiently invertible if given S,a and outputz, we can find in expected* poly(n)-time x2XS,a with D(x) = z. *Simply because that’s what we get

42. Our results: Bit-fixing dispersers with output lengthm=k-o(k) , where k = n-p¢n. Previous result m=(k).[GabSha08] Also, our dispersers are efficiently invertible – (previous constructions seem not to be)

43. Disperser Construction: Step 1:Disperser with short output. Step 2:Seeded disperser with large output length. Step 3:Combining the above to get (seedless) disperser with large output length. (Follows [GabSha08])

44. Step 1: Disperser with m=O(log n) Thm: Any explicit bit-fixing extractor* D:{0,1}n{0,1}mwith m=O(log n) is efficiently invertible. *Say, PrxXS,a[D(x)=z]¸2-2m=1/poly(n) Known Explicit constructions: [KempZuck03,GabRazSha04,Rao09]. Proof: Sample random x2XS,aand check if D(x) =z.Will take expected poly(n)-time.

45. 2nd step: we construct efficientlyinvertible seeded bit-fixing dispersers with large output length.

46. Seeded Bit-fixing dispersers: E * * * 0 * * * * 1 * auxiliary short random input a.k.a `seed’ We `invest’ a short seed to obtain a longer output.

47. Dfn:E(x,y) is a seeded bit-fixing disperserif given z, there exist: • a seed y, and • x2XS,a • such that: • E(x,y) = z. • E is efficiently invertibleif x,y can be found in poly(n)-time. • ..idea is that |y|<<|z|.

48. Observation: • If T(x)=E(x,y) is linear function for every fixed seed y, • then E is efficiently invertible: • For every y: (assume |y|=O(log n) ) • -Check if exists x with • x2XS,a • E(x,y) =z • (This is a set of affine equations and can be check efficiently)

49. `Linear seeded extractors’ exactly give us such an Ewithlarge output length Such constructions by [Trevisan\RazReingoldVadhan\ShaltielUmans,..]

50. Step 3:Get rid of seed: -D(x) is ab.f.d. with output length d -E(x,y) is a seeded b.f.d. with seed length d [GabSha08]: F(x) = E(x,D(x)) is a bit-fixing disperser assuming E is also a `subsource hitter’. Also: If D and E are efficiently invertible so is F.