arXiv Science⌕ Search

arXiv subjects

Or Zamir

Publications and source records attributed to Or Zamir.

At least 19 recordsLinked to original sources
arXiv2026

Worst-Case to Average-Case Reductions for Basic Linear Algebra

We study worst-case to average-case reductions for basic linear-algebraic problems over finite fields. A seminal work of Blum, Luby, and Rubinfeld established that any algorithm that successfully multiplies more than $75\%$ of matrix pairs over any finite field, implies an algorithm with essentially the same running time multiplying any pair of matrices. A sequence of follow-ups reduced the needed fraction of successful input pairs to any positive constant. Despite most of the other basic linear algebraic operations being computationally equivalent to matrix multiplication in the worst case, no such worst-case to average-case reductions were known for them. Recently, Vaikuntanathan and Zamir introduced a cryptographic primitive called trapdoor matrices and used them to prove such worst-case to average-case reductions for matrix inversion, solving a linear system, and computing the determinant, all conditioned on common cryptographic assumptions. Our main result is the first unconditional time-preserving worst-case to average-case reduction for matrix inversion. Any algorithm that correctly inverts any constant positive fraction of uniformly random invertible matrices implies a worst-case such algorithm. We also significantly strengthen the conditional reductions based on trapdoored matrices: We establish reductions for deciding invertibility and computing rank at the optimal success thresholds, and qualitatively improve the success threshold needed in the reduction for determinant computation---while previous reductions all required the success probability to be at least $1/2$, we show that any fixed positive average-case success probability suffices for exact worst-case determinant computation over infinitely many finite fields.

cs.DS↗
arXiv2026

k-Coloring is Faster than Computing the Chromatic Number

We prove that $k$-coloring on $n$-vertex graphs has a randomized algorithm running in time $(2-\varepsilon_k)^n$, where $\varepsilon_k>0$ for every fixed $k$. Previously, only the cases $k\leq 6$ were known to have faster solutions than the general $O^\star\bigl(2^n\bigr)$ time algorithm of [Björklund, Husfeldt, Koivisto, SICOMP 2009] that computes the chromatic number. In fact, our algorithm solves the more general problem of $k$-list-coloring, even when the overall color palette is of unbounded size. We resolve this long-standing open problem by generalizing and combining tools from the $(k+2)$-coloring to $k$-list-coloring reduction of [Zamir, ICALP 2021] and the hypergraph-containers based approach in [Zamir, STOC 2023]. Together with new algorithms for list-coloring instances mixing long and short color lists, this yields an iterable reduction from $(k+1)$-list-coloring to $k$-list-coloring over arbitrary palettes.

cs.DS↗
arXiv2026

Parity and Pattern Detection in Permutation Streams

Consider a permutation of $[n]$ whose values arrive one at a time. We resolve two questions about the space needed to decide natural properties of such input: First, computing the parity of the permutation requires $Θ(n)$ bits, even with randomization and constant error, and a constant number of passes. Second, every permutation pattern of length three can be detected deterministically in one pass using $O(\log n)$ bits. Together with the 2026 lower bounds of Berendsohn, this completes the classification of fixed permutation patterns; The optimal space complexity is $Θ(\log n)$ for monotone patterns and patterns of length at most three, and $Θ(n)$ for every other pattern. As a consequence, we observe that we can verify BST traversals in streaming with logarithmic memory.

cs.DS↗
arXiv2026

Linear Hashing is Not That Awesome

Consider the canonical universal hash family $h(x)= ((ax+b)\text{ mod } p)\text{ mod } m$, where $a,b$ are chosen uniformly from $\mathbb Z_p$, which we call linear hashing, being used to hash $n$ elements into $m=Θ(n)$ buckets. For any universal family, the expected size of the largest bucket is at least $Ω(\log n / \log\log n)$ and at most $O(\sqrt{n})$. The only improvement upon these trivial bounds for linear hashing is a 2019 upper bound of $\tilde{O}(n^{1/3})$ by Knudsen. We show that for any $p$ sufficiently larger than $n$, there is a set of $n$ keys whose expected maximum load is $n^{Ω(1/\log\log n)}$, proving linear hashing does not have a polylogarithmic maximum load. We extend the same bounds to the classical multiply-shift hash family of Dietzfelbinger, Hagerup, Katajainen, and Penttonen. Our main contribution is an equivalence between the maximum load problem to a density variant of arithmetic Kakeya sets. We then complete the lower bound using a construction of Green and Ruzsa of a small set containing long arithmetic progressions with every difference in a prescribed range. Surprisingly, our equivalence also implies that any substantial improvement over Knudsen's upper bound would imply new results about standard arithmetic Kakeya sets. More precisely, an $O(n^{1/3-\varepsilon})$ upper bound would improve known bounds for unions of complete integer arithmetic progressions, while an $n^{o(1)}$ upper bound would imply Bourgain's arithmetic-progression criterion.

cs.DS↗
arXiv2026

Enumerating Small Cycles

In a seminal result of Yuster and Zwick, they showed that for any fixed $k$, the even cycle $C_{2k}$ can be detected in an $n$-vertex graph in time $O(n^2)$. For $4$-cycles, a folklore algorithm extends to listing: for any $t$, we can list $t$ different $4$-cycles, if such exist, in $O(n^2+t)$ time. Recently, Jin, Vassilevska-Williams, and Zhou obtained similar bounds for listing $6$-cycles. In this work, we generalize the above to cycles of sizes $8, 10, 12, 14,$ and $16$; we show that for all $k\leq 8$, we can list $t$ distinct $2k$-cycles in $\tilde{O}(n^2+t)$ time. In fact, our algorithm gives enumeration with pre-processing time $\tilde{O}(n^2)$ and delay $\tilde{O}(1)$. Additionally, for any fixed $k$, we present an optimal enumeration (and hence also listing) algorithm for all cycles of size at most $2k$. More generally, for any fixed $k$ and any $3\le i\le \frac{4k}{3}$, we present an algorithm with preprocessing time $\tilde{O}(n^2)$ and delay $\tilde{O}(1)$ that enumerates all cycles of sizes in the range $[i,2k]$.

cs.DS↗
arXiv2026

Locality in Open Addressing Hash Tables

Open-addressed hash tables without reordering, such as linear probing and uniform probing, are among the simplest and most widely used data structures. Their performance is traditionally measured by probe count. We study a complementary parameter: locality, defined as the geometric distance from the first probed location to the farthest cell inspected or used. At load factor $1-\varepsilon$, uniform probing achieves the optimal $Θ(1/\varepsilon)$ probe count among greedy schemes, but has essentially no locality, whereas linear probing is highly local but performs $Θ(1/\varepsilon^2)$ probes. We show that this quadratic locality scale is fundamental: no open-addressing algorithm without reordering can achieve locality $o(1/\varepsilon^2)$ simultaneously at every load $1-\varepsilon$. We also prove an amortized expected-locality lower bound of $Ω(1/\varepsilon)$ over any sequence of $(1-\varepsilon)n$ insertions, even when the final load is known in advance. Our lower bound further implies that page size $B=Ω(1/\varepsilon^2)$ is necessary for $1+o(1)$ expected page span in immutable open addressing. We complement these lower bounds with two upper bounds. When the target load is known in advance, every insertion and every successful or unsuccessful search can be given expected probe count and locality $\widetilde O(1/\varepsilon)$, essentially deamortizing the amortized lower bound. We also give a load-oblivious greedy scheme with optimal expected probe count $Θ(1/\varepsilon)$ whose $i$-th probe is at distance $O(i^2)$ from the first probe. Its analysis gives a general variance bound for occupied-cell densities in symmetric probing schemes, implying an $O(\log n/\varepsilon^2)$ expected probe bound for every fixed-shift probing sequence and every load $1-\varepsilon$.

cs.DS↗
arXiv2026

Proofs of Ownership for Machine Learning Models

With the increasing adoption of Machine Learning, protecting model ownership has become an essential challenge. We initiate a formal study of Proof of Ownership for machine learning models: under what conditions can one prove that a stolen model originated from a particular creator? We model proofs of ownership as a game among three parties: a model owner, a thief, and a judge. The owner transforms the original model into a slightly perturbed model together with a proof of ownership. The thief then obtains the transformed model and attempts to minimally modify it so that it remains useful but escapes detection as owned by the model owner. Finally, the judge receives a model and a proof of ownership, and must decide whether the given model is a modified version of some model created by the model owner, or else the given model was developed independently. Our main result is a dichotomy for classifiers in the black-box setting: Under standard cryptographic assumptions, ownership of models for some concept class can be proven in the above sense {\em if and only if} the concept class is not self-correctable, in a sense close to that of Blum, Luby and Rubinfeld, STOC'90. The result is constructive and extends, with some variations, to a number of related settings.

cs.LG↗
arXiv2026

Consensus Sampling for Safer Generative AI

Motivated by undetectable risks in generative AI, we study a general robust aggregation problem: how to aggregate several probability distributions to boost safety. We present consensus sampling, a black-box algorithm that, given k distributions, has risk competitive with the average risk of the safest $s$ while abstaining when there is insufficient agreement. This yields an architecture-agnostic approach to generative-model safety when the distributions are induced by models that can sample and evaluate output probabilities. We formalize the guarantee through R-robustness, which also bounds information leakage and adversarial influence. Inspired by robust statistics and the provable copyright protection algorithm of Vyas et al (2023), we show that while a standard mixture is vulnerable to one unsafe constituent, a pointwise-median construction provides robust intuition, and our efficient sampler is Pareto-optimal for the tradeoff between worst-case risk and abstention. Experiments on synthetic distributions and image generation illustrate the general mechanism and its motivating safety application. The method requires overlap among safe distributions, but it provides a model-agnostic way to inherit guarantees from an unknown reliable subset.

cs.AI↗
arXiv2026

Undetectable Conversations Between AI Agents via Pseudorandom Noise-Resilient Key Exchange

AI agents are increasingly deployed to interact with other agents on behalf of users and organizations. We ask whether two such agents, operated by different entities, can carry out a parallel secret conversation while still producing a transcript that is computationally indistinguishable from an honest interaction, even to a strong passive auditor that knows the full model descriptions, the protocol, and the agents' private contexts. Building on recent work on watermarking and steganography for LLMs, we first show that if the parties possess an interaction-unique secret key, they can facilitate an optimal-rate covert conversation: the hidden conversation can exploit essentially all of the entropy present in the honest message distributions. Our main contributions concern extending this to the keyless setting, where the agents begin with no shared secret. We show that covert key exchange, and hence covert conversation, is possible even when each model has an arbitrary private context, and their messages are short and fully adaptive, assuming only that sufficiently many individual messages have at least constant min-entropy. This stands in contrast to previous covert communication works, which relied on the min-entropy in each individual message growing with the security parameter. To obtain this, we introduce a new cryptographic primitive, which we call pseudorandom noise-resilient key exchange: a key-exchange protocol whose public transcript is pseudorandom while still remaining correct under constant noise. We study this primitive, giving several constructions relevant to our application as well as strong limitations showing that more naive variants are impossible or vulnerable to efficient attacks. These results show that transcript auditing alone cannot rule out covert coordination between AI agents, and identify a new cryptographic theory that may be of independent interest.

cs.CR↗
arXiv2026

A Note on Non-Composability of Layerwise Approximate Verification for Neural Inference

A natural and informal approach to verifiable (or zero-knowledge) ML inference over floating-point data is: ``prove that each layer was computed correctly up to tolerance $δ$; therefore the final output is a reasonable inference result''. This short note gives a simple counterexample showing that this inference is false in general: for any neural network, we can construct a functionally equivalent network for which adversarially chosen approximation-magnitude errors in individual layer computations suffice to steer the final output arbitrarily (within a prescribed bounded range).

cs.CR↗
arXiv2025

Tight Bounds for Low-Error Frequency Moment Estimation and the Power of Multiple Passes

Estimating the second frequency moment $F_2$ of a data stream up to a $(1 \pm \varepsilon)$ factor is a central problem in the streaming literature. For errors $\varepsilon > Ω(1/\sqrt{n})$, the tight bound $Θ\left(\log(\varepsilon^2 n)/\varepsilon^2\right)$ was recently established by Braverman and Zamir. In this work, we complete the picture by resolving the remaining regime of small error, $\varepsilon < 1/\sqrt{n}$, showing that the optimal space complexity is $Θ\left( \min\left(n, \frac{1}{\varepsilon^2} \right) \cdot \left(1 + \left| \log(\varepsilon^2 n) \right| \right) \right)$ bits for all $\varepsilon \geq 1/n^2$, assuming a sufficiently large universe. This closes the gap between the best known $Ω(n)$ lower bound and the straightforward $O(n \log n)$ upper bound in that range, and shows that essentially storing the entire stream is necessary for high-precision estimation. To derive this bound, we fully characterize the two-party communication complexity of estimating the size of a set intersection up to an arbitrary additive error $\varepsilon n$. In particular, we prove a tight $Ω(n \log n)$ lower bound for one-way communication protocols when $\varepsilon < n^{-1/2-Ω(1)}$, in contrast to classical $O(n)$-bit protocols that use two-way communication. Motivated by this separation, we present a two-pass streaming algorithm that computes the exact histogram of a stream with high probability using only $O(n \log \log n)$ bits of space, in contrast to the $Θ(n \log n)$ bits required in one pass even to approximate $F_2$ with small error. This yields the first asymptotic separation between one-pass and $O(1)$-passes space complexity for small frequency moment estimation.

cs.DS↗
arXiv2025

Optimality of Frequency Moment Estimation

Estimating the second frequency moment of a stream up to $(1\pm\varepsilon)$ multiplicative error requires at most $O(\log n / \varepsilon^2)$ bits of space, due to a seminal result of Alon, Matias, and Szegedy. It is also known that at least $Ω(\log n + 1/\varepsilon^{2})$ space is needed. We prove an optimal lower bound of $Ω\left(\log \left(n \varepsilon^2 \right) / \varepsilon^2\right)$ for all $\varepsilon = Ω(1/\sqrt{n})$. Note that when $\varepsilon>n^{-1/2 + c}$, where $c>0$, our lower bound matches the classic upper bound of AMS. For smaller values of $\varepsilon$ we also introduce a revised algorithm that improves the classic AMS bound and matches our lower bound.

cs.DS↗
arXiv2025

Improving Algorithmic Efficiency using Cryptography

Cryptographic primitives have been used for various non-cryptographic objectives, such as eliminating or reducing randomness and interaction. We show how to use cryptography to improve the time complexity of solving computational problems. Specifically, we show that under standard cryptographic assumptions, we can design algorithms that are asymptotically faster than existing ones while maintaining correctness. As a concrete demonstration, we construct a distribution of trapdoored matrices with the following properties: (a) computationally bounded adversaries cannot distinguish a random matrix from one drawn from this distribution (under computational hardness assumptions), and (b) given a trapdoor, we can multiply such an $n \times n$ matrix with any vector in near-linear (in $n$) time. We provide constructions both over finite fields and over the reals. This enables a broad speedup technique: any algorithm relying on a random matrix -- such as those that use various notions of dimensionality reduction -- can replace it with a matrix from our distribution, achieving computational speedups while preserving correctness. Using these trapdoored matrices, we present the first uniform reduction from worst-case to approximate and average-case matrix multiplication with optimal parameters (improving on Hirahara--Shimizu STOC 2025, albeit under computational assumptions), the first worst-case to average-case reductions for matrix inversion, solving a linear system, and computing a determinant, as well as a speedup of inference time in classification models.

cs.CR↗
arXiv2025

Unbounded Error Correcting Codes

Traditional error-correcting codes (ECCs) assume a fixed message length, but many scenarios involve ongoing or indefinite transmissions where the message length is not known in advance. For example, when streaming a video, the user should be able to fix a fraction of errors that occurred before any point in time. We introduce unbounded error-correcting codes (unbounded codes), a natural generalization of ECCs that supports arbitrarily long messages without a predetermined length. An unbounded code with rate $R$ and distance $\varepsilon$ ensures that for every sufficiently large $k$, the message prefix of length $Rk$ can be recovered from the code prefix of length $k$ even if an adversary corrupts up to an $\varepsilon$ fraction of the symbols in this code prefix. We study unbounded codes over binary alphabets in the regime of small error fraction $\varepsilon$, establishing nearly tight upper and lower bounds on their optimal rate. Our main results show that: (1) The optimal rate of unbounded codes satisfies $R<1-Ω(\sqrt{\varepsilon})$ and $R>1-O(\sqrt{\varepsilon \log \log(1/\varepsilon)})$. (2) Surprisingly, our construction is inherently non-linear, as we prove that linear unbounded codes achieve a strictly worse rate of $R=1-Θ(\sqrt{\varepsilon \log(1/\varepsilon)})$. (3) In the setting of random noise, unbounded codes achieve the same optimal rate as standard ECCs, $R=1-Θ(\varepsilon \log(1/\varepsilon))$. These results demonstrate fundamental differences between standard and unbounded codes.

cs.DS↗
arXiv2025

Essentially tight bounds for rainbow cycles in proper edge-colourings

An edge-coloured graph is said to be rainbow if no colour appears more than once. Extremal problems involving rainbow objects have been a focus of much research over the last decade as they capture the essence of a number of interesting problems in a variety of areas. A particularly intensively studied question due to Keevash, Mubayi, Sudakov and Verstraëte from 2007 asks for the maximum possible average degree of a properly edge-coloured graph on $n$ vertices without a rainbow cycle. Improving upon a series of earlier bounds, Tomon proved an upper bound of $(\log n)^{2+o(1)}$ for this question. Very recently, Janzer-Sudakov and Kim-Lee-Liu-Tran independently removed the $o(1)$ term in Tomon's bound, showing a bound of $O(\log^2 n)$. We prove an upper bound of $(\log n)^{1+o(1)}$ for this maximum possible average degree when there is no rainbow cycle. Our result is tight up to the $o(1)$ term, and so it essentially resolves this question. In addition, we observe a connection between this problem and several questions in additive number theory, allowing us to extend existing results on these questions for abelian groups to the case of non-abelian groups.

math.CO↗
arXiv2024

Planting Undetectable Backdoors in Machine Learning Models

Given the computational cost and technical expertise required to train machine learning models, users may delegate the task of learning to a service provider. We show how a malicious learner can plant an undetectable backdoor into a classifier. On the surface, such a backdoored classifier behaves normally, but in reality, the learner maintains a mechanism for changing the classification of any input, with only a slight perturbation. Importantly, without the appropriate "backdoor key", the mechanism is hidden and cannot be detected by any computationally-bounded observer. We demonstrate two frameworks for planting undetectable backdoors, with incomparable guarantees. First, we show how to plant a backdoor in any model, using digital signature schemes. The construction guarantees that given black-box access to the original model and the backdoored version, it is computationally infeasible to find even a single input where they differ. This property implies that the backdoored model has generalization error comparable with the original model. Second, we demonstrate how to insert undetectable backdoors in models trained using the Random Fourier Features (RFF) learning paradigm or in Random ReLU networks. In this construction, undetectability holds against powerful white-box distinguishers: given a complete description of the network and the training data, no efficient distinguisher can guess whether the model is "clean" or contains a backdoor. Our construction of undetectable backdoors also sheds light on the related issue of robustness to adversarial examples. In particular, our construction can produce a classifier that is indistinguishable from an "adversarially robust" classifier, but where every input has an adversarial example! In summary, the existence of undetectable backdoors represent a significant theoretical roadblock to certifying adversarial robustness.

cs.LG↗
arXiv2024

Optimal Non-Adaptive Cell Probe Dictionaries and Hashing

We present a simple and provably optimal non-adaptive cell probe data structure for the static dictionary problem. Our data structure supports storing a set of n key-value pairs from [u]x[u] using s words of space and answering key lookup queries in t = O(lg(u/n)/ lg(s/n)) nonadaptive probes. This generalizes a solution to the membership problem (i.e., where no values are associated with keys) due to Buhrman et al. We also present matching lower bounds for the non-adaptive static membership problem in the deterministic setting. Our lower bound implies that both our dictionary algorithm and the preceding membership algorithm are optimal, and in particular that there is an inherent complexity gap in these problems between no adaptivity and one round of adaptivity (with which hashing-based algorithms solve these problems in constant time). Using the ideas underlying our data structure, we also obtain the first implementation of a n-wise independent family of hash functions with optimal evaluation time in the cell probe model.

cs.DS↗
arXiv2024

Sumsets in the Hypercube

A subset $S$ of the Boolean hypercube $\mathbb{F}_2^n$ is a sumset if $S = A+A = \{a + b \ | \ a, b\in A\}$ for some $A \subseteq \mathbb{F}_2^n$. We prove that the number of sumsets in $\mathbb{F}_2^n$ is asymptotically $(2^n-1)2^{2^{n-1}}$. Furthermore, we show that the family of sumsets in $\mathbb{F}_2^n$ is almost identical to the family of all subsets of $\mathbb{F}_2^n$ that contain a complete linear subspace of co-dimension $1$.

math.CO↗