VAUGHAN JONES, KOLMOGOROV COMPLEXITY, AND THE NEW COMPLEXITY LANDSCAPE AROUND CIRCUIT MINIMIZATION

. We survey recent developments related to the Minimum Circuit Size Problem and time-bounded Kolmogorov Complexity.


Introduction
When listing the many accomplishments of Vaughan Jones, the obituaries did not mention the fact that he is indirectly responsible for much of the modern development of the study of Algorithmic Information Theory, also known as Kolmogorov Complexity.This is because much of this modern development was spurred on by Rod Downey and Denis Hirschfeldt, who wrote, in the preface and acknowledgments for their influential book [22]: At the time, neither of us knew much about Kolmogorov complexity, but we had a distinct interest in it after Lance Fortnow's illuminating lectures at Kaikoura in January 2000. . . .As mentioned in the preface, our early interest in Kolmogorov complexity was stimulated by a talk given by Lance Fortnow at a conference in Kaikoura . . .The conference in Kaikoura in January, 2000 was organized by the New Zealand Mathematical Research Institute (NZMRI), which owes its existence to the efforts of Vaughan Jones.I was also a participant in the 2000 Kaikoura conference, and that was the first time I met Vaughan.It was indeed a stimulating conference, and it led to other research-related visits to New Zealand.
One of those visits included participation in a meeting held to celebrate a significant birthday for Rod Downey, and I wrote a contribution to the Festschrift surveying the connections between Kolmogorov complexity and computational complexity theory [1].Three years later, that survey was already out of date, with several of the open questions that were mentioned in [1] newly resolved, and some of the conjectures mentioned in [1] consigned to the scrap heap.(In particular, recent work [29] shows that these conjectures are extremely unlikely to be true.)Thus, when I was invited to give a keynote address at a conference in Milan in 2020 (which was postponed to the fall of 2021 due to COVID) I wrote a survey article [2] entitled "The New Complexity Landscape around Circuit Minimization" (emphasis added), where by "New" I signaled my intent to avoid repeating too many of the observations that were made in [1].(It turns out that the studies of Circuit Minimization 586 ERIC ALLENDER and Kolmogorov Complexity are closely related.)That survey began with these paragraphs: Over the past few years, there has been an explosion of interest in the Minimum Circuit Size Problem (MCSP) and related problems.
Thus the time seemed right to provide a survey, describing the new landscape and offering a guidebook so that one can easily reach the new frontiers of research in this area.
It turns out that this landscape is extremely unstable, with new features arising at an alarming rate.Although this makes it a scientifically-exciting time, it also means that this survey is doomed to be obsolete before it appears.It also means that the survey is going to take the form of an "annotated bibliography" with the intent to provide many pointers to the relevant literature, along with a bit of context.As predicted, that survey, which was written for a conference that has not yet even taken place (due to the pandemic), is indeed already obsolete, with several important advances being announced in just the past year.Also, some unfortunate typographical errors and at least one misstatement wormed their way into [2].Thus I offer this updated survey.

Meta-complexity, MCSP and Kolmogorov Complexity
The focus of complexity theory is to determine how hard problems are.The focus of meta-complexity is to determine how hard it is to determine how hard problems are.Some of the most exciting recent developments in complexity theory have been the result of meta-complexity-theoretic investigations.
The Minimum Circuit Size Problem (MCSP) is, quite simply, the problem of determining the circuit complexity of functions.The input consists of a pair (f, i), where f is a bit string of length N = 2 n representing the truth-table of a Boolean function, and i ∈ N, and the problem is to determine if f has a circuit of size at most i. 1 The study of the complexity of MCSP is therefore the canonical metacomplexity-theoretic question.Complexity theoreticians are fond of complaining that the problems they confront (showing that computational problems are hard to compute) are notoriously difficult.But is this really true?Is it hard to show that a particular function is difficult to compute?This question can be made precise by asking about the computational complexity of MCSP.(See also [55] for a different approach.) A small circuit is a short description of a large truth-table f ; thus it is no surprise that investigations of MCSP have made use of the tools and terminology of Kolmogorov complexity.In order to discuss some of the recent developments, it will be necessary to review some of the different notions, and to establish the notation that will be used throughout the rest of the article.
Let U be a Turing machine.We define K U (x) to be min{|d| : U (d) = x}.Those readers who are familiar with Kolmogorov complexity2 will notice that the definition here is for what is sometimes called "plain" Kolmogorov complexity, although the notation K U (x) is more commonly used to denote what is called "prefix-free" Kolmogorov complexity.This is intentional.In this survey, the distinctions between these two notions will be blurred, in order to keep the discussion on a high level.Some of the theorems that will be mentioned below are only known to hold for the prefix-free variant, but the reader is encouraged to ignore these finer distinctions here, and seek the more detailed information in the cited references.For some Turing machines U , K U (x) will not be defined for some x, and the values of K U (x) and K U (x) can be very different, for different machines U and U .But the beauty of Kolmogorov complexity (and the applicability of the theory it gives rise to) derives from the fact that if U and U are universal Turing machines, then K U (x) and K U (x) differ by at most O (1).By convention, we select one particular universal machine U and define K(x) to be equal to K U (x).
The function K is not computable.The simplest way to obtain a computable function that shares many of the properties of K is to simply impose a time bound, leading to the definition K t (x) := min{|d| : U (d) = x in time t(|x|)} where t is a computable function.Although it is useful in many contexts, K t (x) does not appear to be closely connected to the circuit size of x (where x is viewed as the truth-table of a function).Thus we will frequently refer to two additional resource-bounded Kolmogorov complexity measures, Kt and KT.
Levin defined Kt(x) to be min{|d| + log t : U (d) = x in time t} [41]; it has the nice property that it can be used to define the optimal search strategy to use, in searching for accepting computations on a nondeterministic Turing machine.Kt(x) also corresponds to the circuit size of the function x, but not on "normal" circuits.As is shown in [4], Kt(x) is roughly the same as the size of the smallest oracle circuit that computes x, where the oracle is a complete set for EXP.(An oracle circuit has "oracle gates" in addition to the usual AND, OR, and NOT gates; an oracle gate for oracle A has k wires leading into it, and if those k wires encode a bitstring y of length k where y is in A, then the gate outputs 1, otherwise it outputs 0.) It is clearly desirable to have a version of Kolmogorov complexity that is more closely related to "ordinary" circuit size, instead of oracle circuit size.This is accomplished by defining KT(x) to be min{|d| + t : U (d, i) = x i in time t}.(More precise definitions can be found in [4,14].) We have now presented a number of different measures K µ ∈ {K, K t , Kt, KT}.In order to connect the problem of computing these measures to the framework of complexity classes, it is useful to define corresponding decision problems, as follows: By analogy with MCSP, we can study K µ in place of the "circuit size" measure, and thus obtain various problems of the form MK µ P = {(x, i) : K µ (x) ≤ i}, such as MKTP, MK t P and MKtP.If t(n) = n O (1) , then MK t P is in NP, and several theorems about MKTP yield corollaries about MK t P in this case.(See, e.g.[4]).Similarly, if t(n) = 2 n c for some c > 0, then MK t P is in EXP, and several theorems about MKtP yield corollaries about MK t P for t in this range [4].In order to highlight some of the recent developments, let us introduce some notation that is somewhat imprecise and which is not used anywhere else, but which will be convenient for our purposes.Let K poly serve as a shorthand for K t whenever t = n O (1) , and similarly let K exp serve as a shorthand for K t whenever t = 2 n c for some c > 0. We will thus be referring to MK poly P and MK exp P. Doing so will enable us to avoid some confusing notation surrounding the name MinKT, which was introduced by Ko [40] to denote the set That is, (x, i) ∈ MK poly P iff (x, 1 n c , i) ∈ MinKT (where the time bound t(n) = n c ). Hence these sets have comparable complexity and results about MinKT can be rephrased in terms of MK poly P with only a small loss of accuracy.In particular, some recent important results [27,28] are phrased in terms of MinKT, and as such they deal with K poly complexity, and they are not really very closely connected with the KT measure; the name MinKT was devised more than a decade before KT was formulated.The reader who is interested in the details should refer to the original papers for the precise formulation of the theorems.However, the view presented here is "probably approximately correct".
Frequently, theorems about MCSP and the various MK µ P problems are stated not in terms of exactly computing the circuit size or the complexity of a string, but in terms of approximating these values.This is usually presented in terms of two thresholds θ 1 < θ 2 , where the desired solution is to say yes if the complexity of x is less than θ 1 , and to say no if the complexity of x is greater than θ 2 , and any answer is allowed if the complexity of x lies in the "gap" between θ 1 and θ 2 .In the various theorems that have been proved in this setting, the choice of thresholds θ 1 and θ 2 is usually important, but in this article those details will be suppressed, and all of these approximation problems will be referred to as GapMCSP, GapMKtP, GapMKTP, etc.
At this point, the reader's eyes may be starting to glaze over.It is natural to wonder if we really need to have all of these different related notions.In particular, there does not seem to be much difference between MCSP and MKTP.Most hardness results for MCSP actually hold for GapMCSP, and if the "gap" is large enough, then MKTP is a solution to GapMCSP (and vice-versa).Furthermore it has frequently been the case that a theorem about MCSP was first proved for MKTP and then the result for MCSP was obtained as a corollary.However, there is no efficient reduction known (in either direction) between MCSP and MKTP, and there are some theorems that are currently known to hold only for MKTP, although they are suspected to hold also for MCSP (e.g., [8,10,31,20]). 3 Similarly, some of the more intriguing recent developments can only be understood by paying attention to the distinction between different notions of resource-bounded Kolmogorov complexity.Thus it is worth making this investment in defining the various distinct notions.

Connections to Learning Theory
Certain connections between computational learning theory and Kolmogorov complexity were identified soon after computational learning theory emerged as a field.After all, the goal of computational learning theory is to find a satisfactory (and hence succinct) explanation of a large body of observed data.For instance, in the 1980s and 1990s (and even earlier [25]) there was work [56,57] showing that it is NP-hard to find "succinct explanations" that have size somewhat close to the optimal size, if these "explanations" are required to be finite automata or various other restricted formalisms.Ko studied this in a more general setting, allowing "explanations" to be efficient programs (in the setting of time-bounded Kolmogorov complexity).
Thus Ko studied not only the problem of computing K poly (x) (where one can consider x to be a completely-specified Boolean function), but also the problem of finding the smallest description d such that U (d) agrees with a given list of "yes instances" Y and a list of "no instances" N (that is, x can be considered as a partial Boolean function, with many "don't care" instances).Thus, following [36], we can call this problem Partial-MK poly P. In the setting that is most relevant for computational learning theory, the partial function x is presented compactly as separate lists Y and N , rather than as a string of length 2 n over the alphabet {0, 1, * }.
Ko showed in [40] that relativizing techniques would not suffice, in order to settle the question of whether MK poly P and Partial-MK poly P are NP-complete.That is, by giving the universal Turing machine U that defines Kolmogorov complexity access to an oracle A, one obtains the problems MK poly P A and Partial-MK poly P A , and these sets can either be NP A -complete or not, depending on the choice of A.
Thus it is noteworthy that it has recently been shown that Partial-MCSP is NP-complete under ≤ P m reductions [36].(As is usually the case4 , the proof also establishes that Partial-MKTP is NP-complete under ≤ P m reductions.)One lesson to take from this is that KT and K poly complexity differ from each other in significant ways, since the result of Ko mentioned in the previous paragraph shows that Partial-MK poly P, cannot be shown to be NP-complete using relativizing techniques.There are other recent examples of related phenomena, which will be discussed below.
There are other strong connections between MCSP and learning theory that have come to light recently.Using MCSP as an oracle (or even using a set that shares certain characteristics with MCSP) one can efficiently learn small circuits that do a good job of explaining the data [15].For certain restricted classes of circuits, there are sets in P that one can use in place of MCSP to obtain learning algorithms that don't require an oracle [15].This connection has been explored further [51,16].

Completeness, Hardness, Reducibility
The preceding section mentioned a result about a problem being NP-complete under ≤ P m reductions.In order to discuss other results about the complexity of MCSP and related problems it is necessary to go into more detail about different notions of reducibility.
Let C be either a class of functions or a class of circuits.The classes that will concern us the most are the standard complexity classes L ⊆ P ⊆ NP as well as the circuit classes (both uniform and nonuniform): We refer the reader to the text by Vollmer [63] for background and more complete definitions of these standard circuit complexity complexity classes, as well as for a discussion of uniformity.
We say that m , and ≤ proj m reducibility.This last notion (≤ proj m ), refers to projections, which are functions computed by NC 0 circuits that have only NOT gates.That is, in a projection, each output bit is either a constant 0 or 1, or is connected by a wire to an input bit or its negation.
The more powerful notion of Turing reducibility also plays an important role in this work.Here, C is a complexity class that admits a characterization in terms of Turing machines or circuits, which can be augmented with an "oracle" mechanism, either by providing a "query tape" or "oracle gates".We say that A≤ C T B if there is a oracle machine in C (or a family of oracle circuits in C) accepting A, when given oracle B. We make use of ≤ and ≤ AC 0 T reducibility; instead of writing A≤ P/poly T B or A≤ ZPP T B, we will sometimes write A ∈ P B /poly or A ∈ ZPP B .Turing reductions that are "nonadaptive" -in the sense that the list of queries that are posed on input x does not depend on the answers provided by the oracle -are called truth table reductions.We make use of ≤ P tt and ≤ P/poly tt reducibility.Once again, the reader may protest that this profusion of different notions of reducibility is unjustified and unmotivated.We will return to discuss this objection, after we present some of the hardness and non-hardness results, so that the reader will be in a better position to understand the motivation.

Hardness of MCSP.
The strongest hardness results that are known for the MK µ P problems in NP remain the results of [6], where it was shown that MCSP, MKTP, and MK poly P are all hard for SZK under ≤ BPP T reductions.SZK is the class of problems that have statistical zero knowledge interactive proofs; SZK contains most of the problems that are assumed to be intractable, in order to build publickey cryptosystems.Thus it is widely assumed that MCSP and related problems lie outside of P/poly, and cryptographers hope that it requires nearly exponential-sized circuits.SZK also contains the Graph Isomorphism problem, which is ≤ RP T -reducible to MCSP and MKTP.In [8], Graph Isomorphism (and several other problems) were shown to be ≤ ZPP T reducible to MKTP; it remains unknown if this also holds for MCSP.In fact, there is no interesting example of a problem A that is not known to be in NP ∩ coNP that has been shown to be ≤ ZPP T reducible to MCSP.Although it is useful to know that every problem in SZK is "efficiently reducible" (via a BPP reduction) to MCSP, this does not yield any unconditional lower bounds on the complexity of MCSP, since it is still open whether BPP = EXP.Thus there is motivation to consider very restrictive reductions: m reductions.This also holds for MKtP and MKP.
Here, co-NISZK L is a subclass of SZK that -like SZK -contains several problems that are widely believed to be cryptographically hard.It includes the well-known complexity classes L and NL, as well as the class known as DET: the class of problems NC 1 -Turing-reducible to computing the determinant.
Because projections are so computationally weak, this immediately implies that MKTP is not in AC 0 [p] for any prime p. (This was mentioned as an open question in [1] (see footnote 2 of [1]).)It also implies that MKTP cannot be computed by THRESHOLD•MAJORITY circuits of size 2 n o (1) , by appealing to a lower bound proved in [23].It is currently still open whether this latter lower bound holds also for MCSP.
The AC 0 [p] lower bound for MKTP was first proved in [10].It remained open whether MCSP was in AC 0 [p] until this was established in [26], by showing that the problem of computing the determinant of integer matrices is reducible to MCSP via non-uniform ≤ AC 0 T reductions.Incidentally, it is no accident that the reductions presented in [7,10,26] are non-uniform.If one can show that MCSP or MKTP is hard for TC 0 under uniform ≤ AC 0 T reductions, then one will have shown that NP = TC 0 [11].Of course, most researchers would conjecture that NP = TC 0 , and thus this should not be taken as evidence that non-uniformity is essential -only that it is essential given our current inability to prove lower bounds.

Negative hardness results.
In the last section, we noted that proving hardness for MKTP under uniform ≤ AC 0 T reductions will be difficult with our current understanding.This is just one example of what is by now a large collection of results, showing either that MCSP is not hard under a class of reductions, or at least showing that it will be difficult to show that it is hard.Table 2 is an updated version of a similar table that appeared in my earlier survey [1].Table 2 presents information about the consequences that will follow if MCSP is NP-complete (or even if it is hard for certain subclasses of NP).There is some redundancy in the table, since some readers will primarily be interested in the consequences that follow if MCSP is NP-complete under ≤ P m reductions, even though that line in the table follows from the lines dealing with hardness for subclasses of NP under even more powerful reductions.The "???" entry indicates that no consequences are known, if MCSP is NP-complete under ≤ P T reductions.The table does not include results about some restricted versions of ≤ P m reductions, although the theorems of this type that were proved by Kabanets and Cai [39] were influential in starting off this line of research.One thing should jump out at the reader from Table 2: All of the conditions listed in Column 3 (with the exception of "FALSE") are widely believed to be true, although they all seem to be far beyond the reach of current proof techniques.
It is significant that neither MCSP nor MKTP is NP-complete under ≤ n 1/3 m reductions, since SAT and many other well-known problems are complete under this very restrictive notion of reducibility -but it would be more satisfying to know whether these problems can be complete under more widely-used reducibilities such as ≤ AC 0 m .These sublinear-time reductions are so restrictive, that even the PARITY problem is not ≤ n 1/3 m -reducible to MCSP or MKTP.I suspect that Theorem 1 holds also for MCSP.Let us pause, to consider one of the obstacles to proving this.The proof of Theorem 1 actually carries over to a version of GapMKTP where the "gap" is quite small.Thus one avenue for proving a hardness result for MCSP had seemed to be to improve the hardness result for MKTP, so that it worked for a much larger "gap".This avenue was subsequently blocked, when it was shown that PARITY is not AC 0 -reducible to GapMCSP (or to GapMKTP) for a moderate-sized "gap" [12].Thus, although it is still open whether MCSP is NP-complete under ≤ AC 0 m reductions, we now know that GapMCSP is not NP-complete under this notion of reducibility.
When a much larger "gap" is considered, it was shown in [10] that, if cryptographically-secure one-way functions exist, then GapMCSP and GapMKTP are NP-intermediate in the sense that neither problem is in P/poly, and neither problem is complete for NP under P/poly-Turing reductions.
We close this section with a discussion of a very powerful notion of reducibility: SNP reductions.(Informally A is SNP reducible to B means that A is (NP ∩ 5 The notation "≤ n 1/3 m " refers to "local reductions" computable in time bounded by the cube root of the input length.This is an important non-hardness result, because SAT and most familiar NP-complete problems are complete under local reductions computable even in logarithmic time. 6LTH is the linear-time analog of the polynomial hierarchy.Problems in LTH are accepted by alternating Turing machines that make only O(1) alternations and run for linear time.coNP)-reducible to B.) Hitchcock and Pavan have shown, under the very plausible assumption that NP ∩ coNP contains problems that require large circuits, that if MCSP is NP-complete (under the usual ≤ P m reductions), then it is also complete under SNP reductions whose queries avoid asking about very small circuit sizes; they are able to use this as a tool to derive additional interesting consequences from the assumption that MCSP is NP-complete [33].It is interesting to note that, back in the early 1990's, Ko explicitly considered the possibility that computing MK poly P might be NP-complete under SNP reductions [40].

Completeness in EXP and other classes.
There are problems "similar" to MCSP that reside in many complexity classes.We can define MCSP A to be MCSP for oracle circuits with A-oracle gates.That is, MCSP A = {(f, i) : f has an A-oracle circuit of size at most i}.When A is complete for EXP, then MCSP A is thought of as being quite similar to MKtP.Both of these problems, along with MK exp P, are complete for EXP under ≤ P/poly tt and ≤ NP T reductions, and neither is complete for EXP under ≤ P tt reductions [4].It is still open whether either of MKtP or MCSP A is in P, and it had been open if MK t P is in P for "small" exponential functions t such as t(n) = 2 n/2 .But there is recent progress: This seems to go a long way toward addressing Open Question 3.6 in [1].In contrast to MKtP, we know that MK exp P is not in P. In fact, a much stronger result holds.Let t be any superpolynomial function.Then the set of K t -random strings {x : K t (x) < |x|} is immune to P (meaning: it has no infinite subset in P) [28].The proof does not seem to carry over to Kt complexity, highlighting a significant difference between Kt and K exp .
Although it remains open whether MKtP ∈ P, Hirahara [29] does show that MKtP is not in P-uniform ACC 0 , and in fact the set of Kt-random strings is immune to P-uniform ACC 0 .Furthermore, improved immunity results for the Kt-random strings are in some sense possible if and only if better algorithms for CircuitSAT can be devised for larger classes of circuits [28].
Oliveira has defined a randomized version of Kt complexity, which is conjectured to be nearly the same as Kt, but for which he is able to prove unconditional intractability results [52].Lu and Oliveira also show that a version of the "coding theorem" for Kolmogorov complexity holds for this randomized version of Kt, which is a nice property not known to hold for other versions of resource-bounded Kolmogorov complexity [48].
MCSP QBF was known to be complete for PSPACE under ≤ ZPP T reductions [4].In more recent work, for various subclasses C of PSPACE, when A is a suitable complete problem for C, then MCSP A has been shown to be complete for C under ≤ BPP T reductions [38].Crucially, the techniques used by [38] (and, indeed, by any of the authors who had proved hardness results for MCSP A previously for various A) failed to work for any A in the polynomial hierarchy.We will return to this issue in the following section.
In related work, it was shown [10] that the question of whether MKTP A is hard for DET under a type of uniform AC 0 reductions is equivalent to the question of whether DSPACE(n) contains any sets that require exponential-size A-oracle circuits.Furthermore, this happens if and only if PARITY reduces to MKTP A .Note that this condition is more likely to be true if A is easy, than if A is complex; it is false if A is complete for PSPACE, and it is probably true if A = ∅.Thus, although MKTP QBF is almost certainly more complex than MKTP (the former is PSPACEcomplete, and the latter is in NP), a reasonably-large subclass of P probably reduces to MKTP via these uniform AC 0 reductions, whereas hardly anything AC 0 -reduces to MKTP QBF .The explanation for this is that a uniform AC 0 reduction cannot formulate any useful queries to a complex oracle, whereas it (probably) can do so for a simpler oracle.
4.4.NP-Hardness.Recall from the previous section that there were no NP-hardness results known for any problem of the form MCSP A where A is in the polynomial hierarchy.This is still true; however, there is some progress to report.Hirahara has shown that computing the "conditional" complexity K poly (x|y) relative to SAT (i.e., given (x, y), finding the length of the shortest description d such that U SAT (d, y) = x in time n c ) is NP-hard under ≤ P tt reductions [28].It might be more satisfying to remove the SAT oracle, and have a hardness result for computing K poly (x|y) -but Hirahara [29] shows that this can't be shown to be hard for NP (or even hard for ZPP) under ≤ P tt reductions without first separating EXP from ZPP.
In a similar vein, if one were to show that MCSP or MKTP (or MCSP A or MKTP A for any set A ∈ EXP) is hard for NP under ≤ P tt reductions, then one will have shown that ZPP = EXP [28].
One should be careful how to interpret these results.To illustrate this, let me restate the result above, and provide additional context, for the particular case where A is complete for EXP (in which case the proof carries over to MKtP: the problem of computing Levin's Kt complexity).
(1) If MKtP is hard for NP under ≤ P tt reductions, then ZPP = EXP [28].(2) If MKtP is hard for ZPP under ≤ P tt reductions, then ZPP = EXP (This follows from the proof given in [24], showing the analogous result where MKtP is replaced by MCSP.) (3) If MKtP is hard for NP under ≤ P m reductions, then EXP = NEXP [11].The second item is a strengthening of the first item; each of the first two items seem to be saying that we should not expect a proof in the near future, showing that MKtP is hard for NP (or even for ZPP) under ≤ P m reductions, since this would provide the long-awaited proof that EXP is not equal to ZPP.But the third item shows that the "expected" conclusion that ZPP = EXP follows because of the extremely unlikely condition EXP = NEXP.Thus we should certainly not expect that MKtP is NP-hard under ≤ P m reductions.These results give us no guidance, regarding whether we should expect that MKtP is hard for ZPP under ≤ P m reductions.7But let us return to the topic of NP-hardness for conditional versions of Kolmogorov complexity.
A different kind of NP-hardness result for conditional Kolmogorov complexity was proved recently by Ilango [34].In [4], conditional KT complexity KT(x|y) was studied by making the string y available to the universal Turing machine U as an "oracle".Thus it makes sense to consider a "conditional complexity" version of MCSP by giving a string y available to a circuit via oracle gates.This problem was formalized and shown to be NP-complete under randomized reductions8 [34].This proof was adapted [5] to show that McKTP = {(x, y, i) : KT(x|y) ≤ i} is also NPcomplete under randomized reductions.Neither of these problems can be shown to be hard for NP (or even for ZPP) under ≤ P tt reductions, without first showing ZPP = EXP (by adapting the proof in [24]).
Many of the functions that we compute daily produce more than one bit of output.Thus it makes sense to study the circuit size that is required in order to compute such functions.This problem is called Multi-MCSP in [36], where it is shown to be NP-complete under randomized reductions.It will be interesting to see how the complexity of this problem varies, as the number of output bits of the functions under consideration shrinks toward one (at which point it becomes MCSP).
It has been known since the 1970's that computing the size of the smallest DNF expression for a given truth-table is NP-complete.(A simple proof, and a discussion of the history can be found in [9].)However, it remains unknown what the complexity is of finding the smallest depth-three circuit for a given truth table.(Some very weak intractability results for minimizing constant-depth circuits can be found in [9], giving subexponential reductions from the problem of factoring Blum integers.)The first real progress on this front was reported in [30], giving an NP-completeness result (under ≤ P m reductions) for a class of depth three circuits (with MOD gates on the bottom level).Ilango proved that computing the size of the smallest depth-d formula for a truth-table lies outside of AC 0 [p] for any prime p [34], and he has now followed that up with a proof that computing the size of the smallest depth-d formula is NP-complete under randomized quasipolynomial-time reductions [35].Note that a constant-depth circuit can be transformed into a formula with only a polynomial blow-up; thus in many situations we are able to ignore the distinction between circuits and formulas in the constant-depth realm.However, the techniques employed in [35,34] are quite sensitive to small perturbations in the size, and hence the distinction between circuits and formulae is important here.Still, this is dramatic progress on a front where progress has been very slow.
4.5.Why so many kinds of reducibility?I was pleased to be invited to give a lecture on Metacomplexity at the 2021 Computational Complexity Conference [3].One of the questions from the audience after the lecture essentially asked: "Why do you bother with so many different types of reducibility?"I do not think that I gave this question a sufficiently clear and compelling answer.Let me try again here.
Better lower bounds follow from hardness results using less-powerful forms of reducibility.For instance, the lower bound proved in [7], showing that MKTP requires large THRESHOLD•MAJORITY circuits of size 2 n o (1) would not follow if we did not have a ≤ proj m reduction from a problem in A ∈ L to MKTP, where A is known to require large circuits of this type.(Projections are typically the most restrictive notion of reducibility that is studied -although even in this instance we needed to use non-uniform projections, because hardness under uniform projections, or even uniform AC 0 reductions, cannot be established without first separating NP from TC 0 [11].)Similarly, the argument in [26] showing that MCSP ∈ AC 0 [p] required making use of ≤ AC 0 T reducibility.Using a more powerful notion of reducibility would not have yielded the lower bound.And we still don't know if hardness under a more restrictive reducibility holds.Thus, even if you don't care about restrictive reductions, they can still be used as the means to a desirable end.
On occasion, more powerful forms of reducibility are required, because hardness under more restrictive reducibilities fails to hold.The problem MKtP provides an instructive example.It is useful to know that MKtP is complete for EXP; but the only "efficient" reducibility for which this is known to hold is ≤ P/poly tt .It is provably not complete under the usual ≤ P m or even ≤ P tt reducibility [4] m reductions, then P = NP.Thus it seems like we're unlikely to avoid randomized reductions when considering the complexity of this problem, until some of the longstanding questions in complexity are resolved.(There may be reasons to consider whether McKTP is hard under, say, randomized or nonuniform AC 0 reductions, but this requires some extra work, and thus far there has not been a reason to take this step.In "most" cases, a problem that is hard under ≤ P/poly m reductions is actually hard under ≤ AC 0 m or even ≤ proj m reductions, although for MKTP in particular this is an open question [7].) The general lesson is: It's better to use more restrictive reducibilities, because doing so yields stronger conclusions.But more powerful notions of reducibility are sometimes the only feasible tool available, to draw an important connection about the complexity of a problem.

Average Case Complexity, One-Way Functions, and Cryptography
Cai and Kabanets gave birth to the modern study of MCSP in 2000 [39], in a paper that was motivated in part by the study of Natural Proofs [58], and which called attention to the fact that if MCSP is easy, then there are no cryptographicallysecure one-way functions.In the succeeding decades, there has been speculation about whether the converse implication also holds.That is, can one base cryptography on assumptions about the complexity of MCSP?
First, it should be observed that, in some sense, MCSP is very easy "on average".For instance the hardness results that we have (such as reducing SZK to MCSP) show that the "hard instances" of MCSP are the ones where we want to distinguish between n-ary functions that require circuits of size 2 n /n 2 (the "NO" instances) and those that have circuits of size at most 2 n/3 (the "YES" instances).However, an algorithm that simply says "no" on all inputs will give the correct answer more than 99% of the time.(We will return to this point later in this section.)Thus Hirahara and Santhanam [31] chose to study a different notion of heuristics for MCSP, where algorithms must always give an answer in {Yes, No, I don't know}, where the algorithm never gives an incorrect answer ("errorless heuristics"), and the algorithm is said to perform well "on average" if it only seldom answers "I don't know".They were able to show unconditionally that MCSP is hard on average in this sense for AC 0 [p] for any prime p, and to show that certain well-studied hypotheses imply that MCSP is hard on average.
More recently, Santhanam [61] has formulated a conjecture (which would involve too big of a digression to describe more carefully here), which -if truewould imply that a version of MCSP is hard on average in this sense if and only if cryptographically-secure one-way functions exist.That is, Santhanam's conjecture provides a framework for believing that one can base cryptography on the average-case complexity of MCSP.
But how does the average-case complexity of MCSP depend on its worst-case complexity?Hirahara [27] showed that GapMCSP has no solution in BPP if and only if a version of MCSP is hard on average.A related result stated in terms of K poly appears in the same paper.These results attracted considerable attention, because prior work had indicated that such worst-case-to-average-case reductions would be impossible to prove using black-box techniques.Additional work has given further evidence that the techniques of [27] are inherently non-black-box [32].
A flurry of recent activity has shown that the existence of cryptographicallysecure one-way functions can indeed be characterized in terms of the complexity of computing time-bounded Kolmogorov complexity.
The initial breakthrough was provided by Liu and Pass, who showed that oneway functions exist if and only if MK poly P is hard-on-average [44] (in the sense of "regular" heuristics, rather than "errorless" heuristics).
Let us digress for a moment, to highlight the significance of this result of Liu and Pass.Although one-way functions are essential for cryptography, the nomination of any particular candidate one-way function has largely been guided more by heuristics, experimentation, and conjecture, instead of a firm theoretical foundation.There had never been a natural example of a computational problem whose complexity is equivalent to the existence of cryptographically-secure one-way functions.(There had long been an "unnatural" example, arising from Levin's "universal oneway function" [42].But it is safe to say that this function, although of theoretical interest, has had little impact on practical cryptography.)In contrast, MK poly P has been studied for years, independent of any connection to cryptography.Thus [44] provided a new window into the theoretical foundations of cryptography.Furthermore, since Hirahara [27] had related the worst-case complexity of MK poly P to its average case complexity (albeit only for errorless heuristics), this seems to bring us closer to the goal of basing one-way functions on a worst-case complexity assumption for a problem where we have strong theoretical justification of intractability.
The result of [44] relates one-way functions to MK poly P. What about MKTP?Ren and Santhanam addressed this question, by showing that MKTP is hard-onaverage if and only if logspace-computable one-way functions exist [59].Furthermore, this happens if and only if the NP-complete problem McKTP (discussed earlier) is hard-on-average [5].In addition, if any one-way functions exist (not just those computable in logspace), then McKTP is "somewhat" hard-on-average [5]; thereby giving the first example of a "natural" NP-complete problem whose averagecase complexity is tightly linked to the existence of cryptographically-secure oneway functions.Liu and Pass [46] subsequently provided an alternative definition of conditional time-bounded Kolmogorov complexity (which they also called McKTP), and showed that (a) it is also NP-complete under randomized reductions, and (b) it is hard on average if and only if one-way functions exist.But NP is not the limit!It turns out that cryptographically-secure one-way functions exist if and only the EXP-complete problem MKtP is hard on average [59,47].Nor do things stop at EXP. Ilango, Ren, and Santhanam subsequently showed that one-way functions exist if and only if the undecidable problem MKP is hard on some samplable distribution (and they also provide yet another equivalent characterization, in terms of the average-case complexity of MCSP on a class of "locally-samplable" distributions) [37].This was subsequently generalized again by Liu and Pass [45].
This connection between complexity-theoretical considerations and undecidable languages connects well to our next topic:

Complexity Classes and Noncomputable Complexity Measures
The title of this section is the same as the title of Section 4 of my earlier survey [1].In that section, I described the work that had been done, studying the classes of sets that are reducible to the (non-computable) set of Kolmogorov-random strings R K , and to MKP, including the reasons why it seemed reasonable to conjecture that BPP and NEXP could be characterized in terms of different types of reductions to the Kolmogorov-random strings.
I won't repeat that discussion here, because both of those conjectures have been disproved (barring some extremely unlikely complexity class collapses).Taken together, the papers [32], [29], and [28] give a much better understanding of the classes of languages reducible to the Kolmogorov-random strings.
Previously, it was known that PSPACE ⊆ P R K , and NEXP ⊆ NP R K .Hirahara [28] has now shown NEXP ⊆ EXP NP ⊆ P R K .This same paper also gives a surprising answer to Open Question 4.6 of [1], in showing that Quasipolynomial-time nonadaptive reductions to R K suffice to capture NP (and also some other classes in the polynomial hierarchy).
As described in [1], when we consider uniform reductions to MKP (such as ≤ P T or ≤ NP T reductions) that hold regardless of the universal Turing machine that is used in defining Kolmogorov complexity, only subclasses of EXPSPACE result (and when ≤ P tt reductions are used, one obtains a class between BPP and PSPACE).It is not clear what the true picture is.
Similarly, when one considers nonuniform reductions to MKP all computablyenumerable sets are ≤ P/poly tt -reducible to MKP, but no complexity class larger than THE NEW COMPLEXITY LANDSCAPE AROUND CIRCUIT MINIMIZATION 599 co-NISZK L is known to be ≤ AC 0 m reducible to MKP [7].It seems unlikely that this is is optimal.

Magnification
Some of the most important and exciting developments relating to MCSP and related problems deal with the emerging study of "hardness magnification".This is the phenomenon whereby seemingly very modest lower bounds can be "amplified" or "magnified" and thereby be shown to imply superpolynomial lower bounds.I was involved in some of the early work in this direction [13] (which did not involve MCSP), but much stronger work has subsequently appeared.
It is important to note, in this regard, that lower bounds have been proved for MCSP that essentially match the strongest lower bounds that we have for any problems in NP [21].There is now a significant body of work, showing that slight improvements to those bounds, or other seemingly-attainable lower bounds for GapMKtP or GapMCSP or related problems, would yield dramatic complexity class separations [19,18,17,16,62,54,53,49].
In particular, I'd like to put a spotlight on two theorems.To state the theorems, let MCSP[s(n)] denote the set of truth tables f of n-ary Boolean functions that have circuits of size ≤ s(n).That is MCSP[s(n)] = {f : |f | = N = 2 n ∧ (f, s(n)) ∈ MCSP}.
• MCSP[2 n ]] requires time more than N 1.99 on any one-tape probabilistic Turing machine [20].• If MCSP[2 δn ]] requires time more than N 1.01 on any one-tape deterministic Turing machine, then P = NP [49].If it were not the case that δ < , this would yield a proof of P = NP.
This would be a good place to survey the field of hardness magnification, except that an excellent survey already appears in [16].Igor Carboni Oliveira has also written some notes entitled "Advances in Hardness Magnification" related to a talk he gave at the Simons Institute in December, 2019, available on his home page.These notes and [16] describe in detail the reasons that this approach seems to avoid the Natural Proofs barrier identified in the work of Razborov and Rudich [58].But they also describe some potential obstacles that need to be overcome, before this approach can truly be used to separate complexity classes.

Table 1 .
List of the main complexity measures and decision problems dealing with Kolmogorov complexity considered here.

Table 2 .
Summary of what is known about the consequences of MCSP being hard for NP under different types of reducibility.If MCSP is hard for the class in Column 1 under the reducibility shown in Column 2, then the consequence in Column 3 follows.
class C reductions R statement S Reference . It is a significant open question whether it is complete under ≤ P T reductions.It is known that MKtP is in ZPP iff EXP = ZPP [4], which is the conclusion one would obtain if MKtP were hard for EXP under ≤ ZPP T reductions -but we still do not know if hardness under ≤ ZPP T reductions holds.(This highlights the importance of Hirahara's proof that MK exp P is complete for EXP under ≤ ZPP T reductions [28].)Or consider the conditional KT problem McKTP.It is useful to know that McKTP is NP-complete under randomized reductions.If it's complete under ≤ P m reductions, then EXP = ZPP; if it's not complete under ≤ P