Symmetric Exponential Time Requires Near-Maximum Circuit Size: Simplified, Truly Uniform

In a recent breakthrough, Chen, Hirahara and Ren prove that $\mathsf{S_2E}/_1 \not\subset \mathsf{SIZE}[2^n/n]$ by giving a single-valued $\mathsf{FS_2P}$ algorithm for the Range Avoidance Problem ($\mathsf{Avoid}$) that works for infinitely many input size $n$. Building on their work, we present a simple single-valued $\mathsf{FS_2P}$ algorithm for $\mathsf{Avoid}$ that works for all input size $n$. As a result, we obtain the circuit lower bound $\mathsf{S_2E} \not\subset {i.o.}$-$\mathsf{SIZE}[2^n/n]$ and many other corollaries: 1. Almost-everywhere near-maximum circuit lower bound for $\mathsf{\Sigma_2E} \cap \mathsf{\Pi_2E}$ and $\mathsf{ZPE}^{\mathsf{NP}}$. 2. Pseudodeterministic $\mathsf{FZPP}^{\mathsf{NP}}$ constructions for: Ramsey graphs, rigid matrices, pseudorandom generators, two-source extractors, linear codes, hard truth tables, and $K^{poly}$-random strings.


Introduction
Proving circuit lower bounds has been one of the most fundamental problems in complexity theory, and has close connections to many other fundamental questions such as P versus NP, derandomization and so on.For instance, if we could show E ⊂ SIZE [2 o(n) ], then we achieve unconditional derandomization, i.e. prBPP = prP [NW94,IW97].Morally speaking, it is a quest to distinguish the computational power between uniform and non-uniform computations.
In the search of exponential circuit lower bound, we know that almost all n-bit boolean functions requires near-maximum (2 n /n)-sized circuit via a simple counting argument [Sha49,FM05].While such argument is inherently non-constructive, it serves as some form of evidence that we should be optimistic about finding one such boolean function in some not-too-large complexity class.
However, limited progress has been made over the past few decades in the search of a small complexity class with exponential circuit lower bound.In 1982, Kannan [Kan82] showed that Σ 3 E ∩ Π 3 E contains a language with maximum circuit complexity.The frontier was later pushed to ∆ 3 E = E Σ2P by Miltersen, Vinodchandran and Watanabe [MVW99], which persisted to be the state of the art for more than twenty years.
Very recently in a breakthrough result, Chen, Hirahara and Ren [CHR24] prove that: The Range Avoidance Problem In the past few years, study on the range avoidance problem has been another exciting line of research [KKMP21, Kor21, GLW22, RSW22, CHLR23, GGNS23, ILW23].The problem itself is defined as follows: given an expanding circuit C : {0, 1} n → {0, 1} n+1 , find a string not in the image of C. That is, output y ∈ {0, 1} n+1 where ∀x ∈ {0, 1} n , C(x) = y.At a first glance, Avoid might seem to be a easy problem: a random string y would be a non-image of C with probability at least 1/2.However, it is unclear how to amplify the probability of success without an NP oracle.And given an NP oracle, Avoid can be trivially solved in FZPP NP .Somewhat surprisingly, Korten [Kor21] showed that Avoid is as hard as finding optimal explicit constructions of important combinatorial objects such as Ramsey graphs [Rad21], rigid matrices [GLW22, GGNS23], pseudorandom generators [CT22], two-source extractors [CZ19,Li23], linear codes [GLW22], hard truth tables [Kor21], and strings with maximum time-bounded Kolmogorov complexity (K poly -random strings) [RSW22].Therefore, finding any non-trivial algorithm for Avoid implies algorithms for constructing these important objects.
Single-Valued Algorithm Let Π be a search problem where Π x denotes the set of solutions for input x.Morally speaking, A single-valued algorithm A on input x succeeds only when it outputs some canonical solution y x ∈ Π x .Here are two examples: • A single-valued FNP algorithm should have at least one successful computational path and should output ⊥ in all other computational paths.(Studied as NPSV constructions in, e.g.[HNOS96]).
In particular, the trivial FZPP NP algorithm for Avoid (i.e.sample a string and check with the NP oracle) is inherently not single-valued: the outputs would be different in almost all executions!As pointed out in [CHR24] and many other previous works, circuit lower bounds can be viewed as single-valued construction of hard truth tables.In particular, if for all input size n, one could compute (consistently the same) truth table that is hard against all s(n)-size circuits, then the language whose characteristic function is set to the truth table, would be a hard language / ∈ SIZE[s(n)].Given that finding hard truth table reduces to Avoid, this connects the two tasks: proving circuit lower bound and finding single-valued algorithm for Avoid.

Algorithm for the Range Avoidance Problem
[CHR24] presented a single-valued FS 2 P algorithm for Avoid that works infinitely often.I.e., for infinitely many (but unknown) input size n, there is a S 2 P machine1 , on input a circuit C : {0, 1} n → {0, 1} n+1 , outputs a canonical non-image of C in the successful computational paths and ⊥ otherwise.
In this work, we extend their algorithm to a single-valued FS 2 P algorithm for Avoid that works for all input size n.
The remaining results are corollaries of our new single-valued FS 2 P algorithm for Avoid.

Almost-everywhere near-maximum circuit lower bounds
In [CHR24], their circuit lower bound requires one bit of advice.This is because their FS 2 P algorithm for Avoid only works for infinitely many input size n, and the one bit of advice is necessary for indicating which input size is 'good'.As our algorithm works for all input size n, the circuit lower bound that we obtain are almost-everywhere and completely removes any non-uniform advice: Theorem 1.5.There is a single-valued FZPP NP algorithm A: when given any circuit C : {0, 1} n → {0, 1} n+1 as input, A(C) outputs y C with probability at least 2/3 and y C / ∈ Im(C).

Corollary 1.6 (Informal).
There are zero-error pseudodeterministic constructions for the following objects with an NP oracle for every input size n: Ramsey graphs, rigid matrices, pseudorandom generators, twosource extractors, linear codes, hard truth tables, and K poly -random strings.

Missing-String problem
Lastly, we point out a connection to the MissingString problem.The MissingString problem is defined as follows: given a list of m strings x 1 , . . ., x m ∈ {0, 1} n where m < 2 n , the goal is to output any string y ∈ {0, 1} n not in the list.
In [VW23], Vyas and Williams connected the circuit complexity of the MissingString with the (relativized) circuit complexity of Σ 2 E.
As a corollary of our circuit lower bound which relativizes, we can conclusively claim that: Corollary 1.8.For m = 2 Ω(n) , the MissingString problem can be solved by a uniform family of size-2 poly(n) depth-3 AC 0 circuits.

Korten's Reduction
We start by reviewing Korten's reduction from [Kor21], which reduces Avoid on a circuit with n-bit stretch (i.e.maps n-bit input to 2n-bit output) to Avoid on some other circuit with much longer stretch.Given any circuit C : {0, 1} n → {0, 1} 2n and parameter T = n • 2 k , Korten builds another circuit GGM T [C] : {0, 1} n → {0, 1} T by applying the circuit C in a perfect binary tree: 1. Assign the root vertex (0, 0) with value v 0,0 = x.Build a perfect binary tree of height k where (i, j) denotes the jth vertex on the ith level for 0 ≤ i ≤ k and 0 ≤ j ≤ 2 i − 1.
2. For each vertex (i, j) on the tree, evaluate y = C(v i,j ) and assign its left child with the first n bits of y and its right child with the last n bits of y.Notice that on any fixed input x ∈ {0, 1} n , every vertex on the GGM tree has an n-bit value.Hence, we call it a fully-assigned GGM tree.It is not hard to see that one can efficiently (takes time linear in the height of the tree, k) evaluate the assigned value at any vertex by traversing the tree and apply the circuit C at most k times.In other words, a fully-assigned GGM tree has small circuit complexity.
Korten's reduction asserts that given an NP oracle and any f ∈ {0, 1} T \ Im(GGM T [C]), there is a deterministic algorithm that finds a non-image of C and runs in time poly(T, n).And the algorithm is simple: 1. Set the assigned values of the leaves to be f .2. Next, traverse the tree in a simple bottom up manner.I.e.traverse the 2 k−1 vertices on the (k − 1)th level one by one (say, from right to left), then proceed to the (k − 2)th level and so on, until reaching root.
3. For each interval vertex u traversed, assign v u with the lexicographically first2 n-bit string x such that C(x) correctly evaluates to the assigned values of u's children (Note that this step uses the NP oracle).
4. Whenever such string cannot be found, we successfully find a non-image of C (i.e. the assigned values of u's children).The algorithm now returns with the non-image of C found and assigns ⊥ to all remaining vertices.
Figure 2: An illustration of the partially-assigned GGM tree from running Korten's algorithm.

History of the Reduction
The computational history of Korten's reduction on fixed input (C, f ) is fully characterised by a partiallyassigned GGM tree i.e. some of the vertices are assigned ⊥.We are interested in the computaional history because it has a few nice properties: 1. Contains a Canonical Solution: Notice that the execution of Korten's algorithm is fully deterministic.Hence, it produces the same non-image of C given the same f .And the solution is clearly stored in the partially-assigned GGM tree.
2. Locally Verifiable: Every step of execution is very simple, making them locally verifiable.In other words, to verify any particular step of the execution, we only need to look at a constant number of assigned values on the partially-assigned GGM tree.
Moreover, by choosing T = 2n • 2 2n , we know an f that is trivially not in the image of GGM T [C]: the concatenation of all 2n-length strings.

Finding a Short Description of the History
The downside of choosing T = 2n • 2 2n is that the size of the computational history is now exponential in n.The locally verifiable property allows us to use a universal quantifier (∀) and a O(log T )-bit variable to verify all O(T ) steps of the algorithm, but ultimately we need a short (poly(n)) description of the computational history if we want to, for example build a FΣ 2 P algorithm.
The authors in [CHR24] appeal to the iterative win-win argument for such a short description: they manage to show that within a large interval of input size, there exists at least one input size n such that the corresponding computational history admits a short description.In fact, the computational history will be the output of a (different) fully-assigned GGM tree, leveraging the fact that fully-assigned GGM tree has small circuit complexity.
We take a slightly different approach: the key observation is that, by changing traversal order in Korten's algorithm, the resulting computational history (i.e. a partially-assigned GGM tree) also has small circuit complexity!More specifically, if we change the traversal order to a post-order traversal (i.e.traverse the left subtree, then the right subtree, and finally the root), the resulting partially-assigned GGM tree can be decomposed into O(n) smaller fully-assigned GGM trees.See Figure 3 for an illustration.The roots of the fully-assigned GGM trees are drawn in circles.
As such, we obtain a short description of the computational history: simply store the roots of all these O(n) fully-assigned GGM tree.

Generalizing to FS 2 P
All the ingredients above allow us to build a single-valued FΣ 2 P algorithm for Avoid.In order to generalise it to a FS 2 P algorithm, we need a selector algorithm that picks the better witness (in this case, the correct description of the computational history).Now that we have a small description, this turns out to be an easy task.It is now easy to identify a single vertex with different assigned values in the two histories, and traverse down the tree until we hit the leaves, where we know the correct assigned value (i.e. the concatenation of all 2n-length strings).

Preliminaries
Definition 2.1.Let s : N → N. We say that a language L ∈ SIZE[s(n)] if L can be computed by circuit families of size O(s(n)) for all sufficiently large input size n.We assume basic familiarity with computational complexity theory, such as complexity classes in the polynomial hierarchy (see e.g.[AB09,Gol08] for references).Definition 2.4.Let T : N → N. We say that a language L ∈ S 2 TIME[T (n)], if there exists an O(T (n))-time verifier V (x, π 1 , π 2 ) that takes x ∈ {0, 1} n and π 1 , π 2 ∈ {0, 1} T (n) as input, satisfying that: • if x ∈ L, then there exists π 1 such that for every π 2 , V (x, π 1 , π 2 ) = 1, and for some polynomial p.

For every
And we say that A solves a search problem Π if on any input x it outputs a string y x and y x ∈ Π x .Definition 2.6 (Single-valued FS 2 P algorithm).A single-valued FS 2 P algorithm A is specified by a polynomial ℓ(•) together with a polynomial-time algorithm V A (x, π 1 , π 2 ).On an input x ∈ {0, 1} * , we say that A outputs y x ∈ {0, 1} * , if the following hold: And we say that A solves a search problem Π if on any input x it outputs a string y x and y x ∈ Π x .

Modified Korten's reduction
Notation.We follow the notations from [CHR24] closely: Let s be a n-bit string.We use 0-index where s 0 denotes the first bit of s and s n−1 denotes the last bit of s.Let i < j, we use s [i,j) to denote the substring of s from the ith bit to the (j − 1)th bit.We use s 1 • s 2 to denote the concatenation of two strings s 1 and s 2 .
We identify any vertex in a perfect binary tree of height 2n + 1 with a tuple (i, j) where i ∈ [0, 2n + 1] and j ∈ [0, 2 i − 1], indicating that the vertex is the jth vertex on level i.Note that the two children of (i, j) are (i + 1, 2j) and (i + 1, 2j + 1).

The GGM Tree
Recall that the GGM tree construction from [GGM86] (vaguely speaking) increases the stretch of a circuit C : {0, 1} n → {0, 1} 2n to arbitrarily long by applying C in a perfect binary tree manner.
Definition 3.1 (The GGM tree construction [GGM86]).Let C : {0, 1} n → {0, 1} 2n be a circuit.Let n, T ∈ N be such that T ≥ 4n and let k be the smallest integer such that Consider a perfect binary tree with 2 k leaves, where the root is on level 0 and the leaves are on level k.Each node is assigned a binary string of length n, and for 0 ≤ j < 2 i , denote v i,j ∈ {0, 1} n the value assigned to the vertex (i, j) (i.e.j-th node on level i).Let x ∈ {0, 1} n .We perform the following computation to obtain GGM T [C](x): we set v 0,0 := x, and for each 0 Finally, we concatenate all values of the leaves and take the first T bits as the output: For what we need, T is always set to 2n • 2 2n = n • 2 2n+1 .In other words, the GGM tree will always have height 2n + 1.
It is known that the output of GGM tree has a small circuit [CHR24,Lemma 3.2].For what we need, we note that the assigned value of any vertex in a GGM tree on a given input has a small circuit.Lemma 3.2.Let GGMEval(C, T, x, (i, j)) denote the n-bit assigned value v i,j in the evaluation of the GGM tree GGM T [C](x).There is an algorithm running in O(|C| • log T ) time that, given C, T, x, (i, j), outputs GGMEval(C, T, x, (i, j)).
Proof sketch.To compute v i,j , it suffices to traverse the GGM tree from the root to the vertex (i, j), applying the circuit C in each step.The running time is clearly bounded by the O(|C| • log T ) since the GGM tree has height O(log T ).

Modifying Korten's Reduction
Korten's reduction [Kor21] asserts that given a hard truth table f / ∈ Im(GGM T [C]) and an NP oracle, one can find a non-image for C in poly(T, n) time.
Note that on a fixed f , Korten's reduction produces the same output.Hence, if we could efficiently simulate the reduction, we obtain an efficient single-valued algorithm.The remaining parts of this section aim to show that Korten's reduction (after our modification) indeed has a small description.
We modify Korten's reduction in the following manner: instead of traversing the perfect binary tree in a simple bottom-up manner, we perform a post-order traversal (i.e.traverse the left subtree, then the right subtree and finally the root).
For simplicity, we will fix T to be n • 2 2n+1 and the perfect binary tree has height 2n + 1.We note that this choice of T (i.e.exponential in n) is the "base case" or "worst case" in the iterative win-win argument in [CHR24].Since we can handle even the "worst case", we manage to completely bypass the iterative win-win argument.
Upon passing the first part of the verification, we know D h corresponds to some partially-assigned perfect binary tree h and it remains to check that h is the computational history Histree(C, f ).One should think of the verifier making at most 2 |w| checks and accepts only if all 2 |w| check passes.
The verifier V needs to make the following checks.Note that whenever we need some value v i,j , we will call Eval( D h , (i, j)) for the value.Recall that the total order < P is defined according to the post-order traversal sequence.
1.The values written on the leaves are indeed f .Hence, for every j ∈ [0, 2 2n+1 − 1], check that v 2n+1,j is consistent with the corresponding string in f .2. For every (i, j) . (the values are consistent with the children) 3.For every (i, j) < P u * , for every x ∈ {0, 1} n that is lexicographically smaller than (the two children of u * form a non-image of C) 5.For every (i, j) where u * ≤ P (i, j), v i,j = ⊥.
Each of the above checks is local (requires assigned values of at most 3 vertices) and efficient (runs in time poly(n, log T )).There are in total O(T ) vertices and therefore O(T ) tests, which can be implemented with a universal (∀) quantification over at most 2 log T + n bits.
Clearly the correct history h (and therefore its unique description D h ) passes all these checks.Also these checks uniquely determine h as they are essentially enforcing every step of execution of Korten ′ (C, f ).Proof.On input a circuit C : {0, 1} n → {0, 1} 2n , let T = 2n • 2 2n and f ∈ {0, 1} T be the concatenation of all 2n-length bit strings.Let h = Histree(C, f ).V A (C, π 1 , π 2 ) is defined as follows: it parses π 1 as D h and π 2 as w, simulates the verifier V f (C, D h , w) in Lemma 3.8.It outputs the non-image of C stored in D h iff V f (C, D h , w) = 1.Otherwise it outputs ⊥.Note that every position of f can be easily computed since it is just enumerating all 2n-length strings.Hence the simulation can be done in polynomial time.

Single-valued FS 2 P Algorithm
In order to generalise the FΣ 2 P algorithm above to a FS 2 P algorithm, we need a 'selector' that chooses the correct D h when two candidates are given.We formalise such selector in the following lemma.Lemma 4.2.Let n, T ∈ N be such that T = 2n•2 2n .Let C : {0, 1} n → {0, 1} 2n be a circuit, and f ∈ {0, 1} T .Let h := Histree(C, f ) and D h be the succinct description of h defined in Lemma 3.7.Given f as an oracle and two strings π 1 , π 2 as additional input, with the promise that π i = D h for at least one i ∈ {1, 2}, there is a deterministic algorithm S such that S f (C, π 1 , π 2 ) = π i and runs in time poly(n) • log T .Proof Sketch.Let A be the single-valued algorithm from Corollary 4.7 and set s := 2 n /n.Define the language L such that the truth table of the characteristic function of L ∩ {0, 1} n is A(TT n,s ).By our choice of s, L n,s = (s + 1)(7 + log(n + s)) < 2 n and hence TT n,s is a valid Avoid instance.
L / ∈ i.o.-SIZE[s(n)] since any s-size n-input circuit C can be encoded into a stack program of size L n,s bits [FM05].
L ∈ S 2 E since one can compute the truth table using algorithm A.
Remark 4.9.Similar to [CHR24], it is not hard to verify that all our results above relativise.

Figure 1 :
Figure 1: An illustration of a GGM tree of height 3.

Figure 3 :
Figure 3: An illustration of the partially-assigned GGM tree from running modified Korten's algorithm.

Definition 2 . 2 .
Let s : N → N. We say that a language L ∈ i.o.-SIZE[s(n)] if L can be computed by circuit families of size O(s(n)) for infinitely many input size n.By definition, we have SIZE[s(n)] ⊆ i.o.-SIZE[s(n)].Hence, circuit lower bounds against i.o.-SIZE[s(n)] are stronger and sometimes denoted as almost-everywhere circuit lower bound in the literature.Definition 2.3.The Range Avoidance (Avoid) problem is defined as follows: given as input the description of a Boolean circuit C : {0, 1} n → {0, 1} m , for m > n, find a y ∈ {0, 1} m such that ∀x ∈ {0, 1} n : C(x) = y.

4
Circuit Lower Bound for S 2 E 4.1 Single-valued FΣ 2 P Algorithm We start by showing a simple single-valued FΣ 2 P Algorithm for Avoid.Theorem 4.1.There is a single-valued FΣ 2 P algorithm A: when given any circuit C : {0, 1} n → {0, 1} 2n as input, A(C) outputs y C such that y C / ∈ Im(C) .
[Cai07] 1.2.S 2 E ⊂ i.o.-SIZE[2 n /n].Moreover, this holds in every relativized world.Similar to[CHR24], our results fully relativize.Via known results where S 2 E ⊆ ZPE NP[Cai07]and ZPE NP ⊆ Σ 2 E∩Π 2 E, we obtain the following corollaries:Corollary 1.3.ZPE NP ⊂ i.o.-SIZE[2 n /n].Moreover, this holds in every relativized world.ZPP NP .Hence, Avoid and all explicit construction problems admit a single-valued FZPP NP algorithm.Equivalently speaking, Avoid and all explicit construction problems admit a pseudodeterministic (with an NP oracle) algorithm, where a pseudodeterministic algorithm for a search problem is a probabilistic algorithm that with high probability outputs a fixed solution on any given input.