Threshold computation and cryptographic security

Abstract

Threshold machines [21] are Turing machines whose acceptance is determined by what portion of the machine’s computation paths are accepting paths. Probabilistic machines [11] are Turing machines whose acceptance is determined by the probability weight of the machine’s accepting computation paths. Simon [21] proved that for unbounded-error polynomial-time machines these two notions yield the same class, PP. Perhaps because Simon’s result seemed to collapse the threshold and probabilistic modes of computation, the relationship between threshold and probabilistic computing for the case of bounded error has remained unexplored. In this paper, we compare the bounded-error probabilistic class BPP with the analogous threshold class, BPPpath, and, more generally, we study the structural properties of BPPpath. We prove that BPPpath contains both NPBPP and PNP[log], and that BPPpath is contained in (formula presented), BPPNP, and PP. We conclude that, unless the polynomial hierarchy collapses, bounded-error threshold computation is strictly more powerful than bounded-error probabilistic computation. We also consider the natural notion of secure access to a database: an adversary who watches the queries should gain no information about the input other than perhaps its length [5]. We show, for both BPP and BPPpath, that if there is any database for which this formalization of security differs from the security given by oblivious [9] database access, then BPP≠PP. It follows that if any set lacking small circuits can be securely accepted, then BPP≠PP.