The unifying topic of this thesis is the relation of randomness to computation. We study two different facets of this: the hardness of sampling from probability distributions and the extent of usefulness of randomness in communication complexity. Hardness of Sampling. A circuit samples the distribution of its output on a uniformly random input. What distributions are samplable with small circuits? What about local circuits (NC0)? We make two contributions in this direction. The first is to show that sampling uniformly from the set of Hamming-weight-k n-bit string is hard for NC0-circuits (and even constant-width DNFs) as long as k=o(n). The second is to show that sampling a uniformly random permutation of [n] elements requires polylog(n) adaptive queries to a sequence of uniform input symbols from [n]---adaptive cell probes. These results refine our understanding of sampling by constant-depth de Morgan circuits (AC0). Randomness in Communication. The classical example separating deterministic and randomized communication is the Equality problem: Alice and Bob are to decide whether their n-bit inputs are equal. It requires transmitting n+1 in the deterministic model, but is solvable with a constant-cost protocol using public randomness. An active line of research found many non-trivial problems that are solvable with just constant-cost randomized communication [Harms-Wild-Zamaraev, STOC 2022; Hambardzumyan-Hatami-Hatami, Isr. J. Math.; Fang-Hambardzumyan-Harms-Hatami, STOC 2024; Fang-Göös-Harms-Hatami, STOC 2025]. All of those problems can be solved with polylog(n) queries to Equality oracle. Our first contribution is to exhibit a problem that is solvable with constant-cost randomized communication, but requires polynomially many calls to Equality oracle. This resolves an open problem in the survey [Hatami-Hatami, ACM SIGACT News]. Our second contribution is to investigate when the randomized communication complexity can be localized or condensed: for a matrix of randomized communication cost k, can we find its 2^k-by-2^k submatrix that retains communication cost at least linear in k$? In general this is impossible [Hambardzumyan-Hatami-Hatami, Discrete Appl. Math.]. We show, however, that in an important case it can be done: we condense randomized communication cost of sink-of-xor function---a recent counterexample to log-approximate-rank conjecture by [Chattopadhyay-Mande-Sherif, J. ACM], and thereby quantitatively improve the counterexample.
The unifying topic of this thesis is the relation of randomness to computation. We study two different facets of this: the hardness of sampling from probability distributions and the extent of usefulness of randomness in communication complexity. Hardness of Sampling. A circuit samples the distribution of its output on a uniformly random input. What distributions are samplable with small circuits? What about local circuits (NC0)? We make two contributions in this direction. The first is to show that sampling uniformly from the set of Hamming-weight-k n-bit string is hard for NC0-circuits (and even constant-width DNFs) as long as k=o(n). The second is to show that sampling a uniformly random permutation of [n] elements requires polylog(n) adaptive queries to a sequence of uniform input symbols from [n]---adaptive cell probes. These results refine our understanding of sampling by constant-depth de Morgan circuits (AC0). Randomness in Communication. The classical example separating deterministic and randomized communication is the Equality problem: Alice and Bob are to decide whether their n-bit inputs are equal. It requires transmitting n+1 in the deterministic model, but is solvable with a constant-cost protocol using public randomness. An active line of research found many non-trivial problems that are solvable with just constant-cost randomized communication [Harms-Wild-Zamaraev, STOC 2022; Hambardzumyan-Hatami-Hatami, Isr. J. Math.; Fang-Hambardzumyan-Harms-Hatami, STOC 2024; Fang-Göös-Harms-Hatami, STOC 2025]. All of those problems can be solved with polylog(n) queries to Equality oracle. Our first contribution is to exhibit a problem that is solvable with constant-cost randomized communication, but requires polynomially many calls to Equality oracle. This resolves an open problem in the survey [Hatami-Hatami, ACM SIGACT News]. Our second contribution is to investigate when the randomized communication complexity can be localized or condensed: for a matrix of randomized communication cost k, can we find its 2^k-by-2^k submatrix that retains communication cost at least linear in k$? In general this is impossible [Hambardzumyan-Hatami-Hatami, Discrete Appl. Math.]. We show, however, that in an important case it can be done: we condense randomized communication cost of sink-of-xor function---a recent counterexample to log-approximate-rank conjecture by [Chattopadhyay-Mande-Sherif, J. ACM], and thereby quantitatively improve the counterexample.
Suppose we have a two-party communication protocol for f which allows the parties to make queries to an oracle computing g; for example, they may query an Equality oracle. To translate this protocol into a randomized protocol, we must replace the oracle with a randomized subroutine for solving g. If q queries are made, the standard technique requires that we boost the error of each subroutine down to O(1/q), leading to communication complexity which grows as q log q. For which oracles g can this naïve boosting technique be improved? We focus on the oracles which can be computed by constant-cost randomized protocols, and show that the naïve boosting strategy can be improved for the Equality oracle but not the 1-Hamming Distance oracle. Two surprising consequences are (1) a new example of a problem where the cost of computing k independent copies grows superlinear in k, drastically simplifying the only previous example due to Blais & Brody (CCC 2019); and (2) a new proof that Equality is not complete for the class of constant-cost randomized communication (Harms, Wild, & Zamaraev, STOC 2022; Hambardzumyan, Hatami, & Hatami, Israel Journal of Mathematics 2022).
This thesis presents a theoretical analysis of round complexity in cryptographic sampling protocols. We study the following problem: how can n participants agree on a random sample from the distribution D without anybody knowing any secret information hidden in the chosen sample? How many rounds of interactions are needed in any such protocol? Which assumptions are required? These questions are particularly interesting in the context of multiparty computation (MPC) due to the extensive reliance (often unavoidable) on trusted setups such as common reference strings (CRSs). These are samples from known distributions made public before the beginning of the protocol. Security proofs often require CRSs to hide trapdoors. However, if these trapdoors get leaked, security is often fatally compromised. Since trusted setups are inherently single points of failure, it is desirable to generate CRSs in a distributed fashion using MPC protocols: as long as at least one of the participants remains honest, any trapdoor hidden in the CRS is guaranteed to remain secret. Previous research (Garg et al. TCC ’14) had shown that, in the setting of semi-honest security with dishonest majority, any functionality can be implemented in two rounds. In this thesis, we show that, using strong primitives such as indistinguishability obfuscation (iO), it is possible to build one-round sampling protocols. We call these constructions distributed samplers. We show that these protocols can be used to securely generate large amounts of correlated randomness with sublinear communication in a single round. We study different ways to upgrade our semi-honest construction to active security. First, we try to circumvent Cleve’s impossibility (STOC ’86) by allowing the adversary limited influence on the output of the protocol: we consider the functionality F_D^{Active} that proposes a polynomial number of different outputs to the adversary, letting it choose its favourite one (F_D^{Active} can still be used to generate CRSs). We show how to implement F_D^{Active} in one round by relying on a programmable random oracle. In subsequent work, we show that random oracles are necessary: any actively secure distributed samplers implementing F_D^{Active} needs to rely on a CRS that is non-reusable, as large as a sample from D and structured (unless D is an obliviously samplable distribution). This suggests that, without random oracles, simulation-based, actively secure distributed samplers provide no advantage over trusted dealers. We get around this impossibility by proposing new game-based definitions for actively secure distributed samplers. Hardness-preserving distributed samplers allow the removal of CRSs from MPC protocols preserving at the same time the hardness of search problems. Indistinguishability-preserving distributed samplers, on the other hand, substitute the trusted setup while preserving the functionality, however, the protocol needs to satisfy particular conditions. We show how to build distributed samplers with the defined properties by relying on extremely lossy functions, the subexponential security of iO and other primitives. Next, in the context of active security with dishonest majority, we study the feasibility of protocols producing unbiased samples with guaranteed output: to circumvent Cleve's impossibility, we assume the existence of an auxiliary functionality that, upon invocation, publishes a random , short k-bit string. We first study the question when D is the uniform distribution over {0, 1}^m where m>k. This problem is called coin tossing extension (CTE) (Bellare et al. PODC '96). We show the existence of O(1)-round CTE constructions producing an arbitrarily large quantity of unbiased randomness based on various assumptions (OWFs, DDH, QR and DCR, class groups). Our most important result is an LWE-based, one-round, UC-secure, n-party CTE protocol withstanding adaptive corruption. The protocol can be viewed as an explainable randomness extractor. By relying on distributed samplers and the auxiliary functionality, we build one-round unbiased sampling protocols for any distribution. Finally, we present a lower bound for statistically secure CTE with black-box simulation: an R-round protocol can generate at most k+R·O(log λ) bits of randomness.
Suppose we have a two-party communication protocol for f which allows the parties to make queries to an oracle computing g; for example, they may query an Equality oracle. To translate this protocol into a randomized protocol, we must replace the oracle with a randomized subroutine for solving g. If q queries are made, the standard technique requires that we boost the error of each subroutine down to O(1/q), leading to communication complexity which grows as qlogq. For which oracles g can this naive boosting technique be improved? We focus on the oracles which can be computed by constant-cost randomized protocols, and show that the naive boosting strategy can be improved for the Equality oracle but not the 1-Hamming Distance oracle. Two surprising consequences are (1) a new example of a problem where the cost of computing k independent copies grows superlinear in k, drastically simplifying the only previous example due to Blais & Brody (CCC 2019); and (2) a new proof that Equality is not complete for the class of constant-cost randomized communication (Harms, Wild, & Zamaraev, STOC 2022; Hambardzumyan, Hatami, & Hatami, Israel Journal of Mathematics 2022).
We give new evidence that quantum circuits are substantially more powerful than classical circuits. We show, relative to a random oracle, that polynomial-size quantum circuits can sample distributions that subexponential-size classical circuits cannot approximate even to TV distance 1−o(1). Prior work of Aaronson and Arkhipov (2011) showed such a separation for the case of exact sampling (i.e. TV distance 0), but separations for approximate sampling were only known for uniform algorithms. A key ingredient in our proof is a new hardness amplification lemma for the classical query complexity of the Yamakawa-Zhandry (2022) search problem. We show that the probability that any family of query algorithms collectively finds k distinct solutions decays exponentially in k.
Random circuit sampling (RCS) is a leading candidate for demonstrating quantum advantage, supported by strong complexity-theoretic evidence of hardness in the ideal setting and by rapid experimental progress to date. In practice, however, noise is unavoidable, and a central problem is to identify the noise-strength boundary between classically simulable and classically hard regimes. In this work, we establish an architecture-general hardness bound for this boundary for the standard local depolarizing noise of strength γ. Assuming the standard average-case #P-hardness conjecture for ideal RCS, we show that, for any circuit architecture satisfying this conjecture, noisy RCS on the same architecture remains hard to simulate classically within any inverse-polynomial total variation distance whenever γ=O(logn/(nd)) for n-qubit circuits of depth d, unless the polynomial hierarchy collapses. Crucially, noisy-RCS hardness follows without any additional conjectural or architecture-specific assumption beyond those already entering the ideal-RCS hardness framework. Our proof combines a low-degree polynomial extrapolation with a monotonicity reduction showing that efficient classical simulation at one depolarizing noise strength implies efficient simulation at every larger strength. Together, these ingredients transfer the standard ideal-RCS hardness conjecture to sampling hardness at a prespecified noise strength. Finally, combining the convergence-to-uniformity result of Dalzell et al. [Commun. Math. Phys. 405, 78 (2024)] with our monotonicity reduction yields efficient classical simulation for γ=ω(logn/(nd)) on layered, regularly connected architectures. Thus, wherever the two architectural settings overlap, this identifies γ=Θ(logn/(nd)) as the asymptotic complexity-transition scale.
In the field of information-theoretic cryptography, randomness complexity is a key metric for protocols for private computation, that is, the number of random bits needed to realize the protocol. Although some general bounds are known, even for the relatively simple example of 1-private computation of n-party AND, the exact complexity is unknown. We study two settings. First, we consider the model of Goyal, Ishai, and Song (Crypto '22) where helper parties without any inputs are allowed to assist in the computation. In this setting, we show that two random bits always suffice to compute an arbitrary Boolean circuit C 1-privately: a single designated inputless helper flips the two bits and privately distributes the derived one-time bits to the other helper parties and the input parties as they are needed. We give an explicit construction using seven helper parties per AND gate and three helper parties per XOR gate (plus the single global randomness dealer). Moreover, two random bits are necessary already for the AND functionality (by a reduction to the standard no-helper model together with the lower bound of Kushilevitz, Ostrovsky, Prouff, Rosén, Thillard and Vergnaud (TCC '19), and therefore the worst-case helper-party randomness complexity is exactly 2 bits. Second, in the setting without helper parties, we improve the upper bound from Couteau and Rosén (Asiacrypt '22) on the (asymptotic) randomness complexity of n-party AND from 6 to 5 bits. That is, we give a 1-private protocol for computing the AND of n parties' inputs requiring 5 bits of randomness, for all n ≥ 6. Our construction, like that of Couteau and Rosén, uses a single party to flip the 5 bits and distribute the required derived values during the execution. Our approach to both problems is built around a more systematic exploration of techniques for recycling randomness across sub-computations. As part of resolving the second problem, we isolate an exact local-independence combinatorial object called a Sliding-Window Independence Generator, or a SWIG. A (k,m)-SWIG is a linear generator from a k-bit seed to m ≥ k output bits, where every cyclic length-k sliding window chosen from m output bits is perfectly uniform. We give an explicit (k,m)-SWIG for every k ≥ 1 and every m ≥ k and use a (5,n-1)-SWIG in our no-helper AND protocol.