Abstract 1 Introduction 2 Preliminaries 3 Reduction to the one-sided error case 4 Worst-Case to Average-Case reduction 5 Reduction for a Finite Field of Prime order References Appendix A List decodable codes

A Simplified Reduction for Error Correcting Matrix Multiplication Algorithms

Igor Shinkar ORCID Simon Fraser University, Burnaby, Canada Harsimran Singh ORCID Simon Fraser University, Burnaby, Canada
Abstract

We study the problem of transforming an algorithm for matrix multiplication, whose output has a small fraction of the entries correct into a matrix multiplication algorithm, whose output is fully correct for all inputs. In this work, we provide a new and simple way to transform an average-case algorithm that takes two matrices A,Bβˆˆπ”½pnΓ—n for a prime p, and outputs a matrix that agrees with the matrix product A⁒B on a 1/p+Ο΅ fraction of entries on average for a small Ο΅>0, into a worst-case algorithm that correctly computes the matrix product for all possible inputs.

Our reduction employs list-decodable codes to transform an average-case algorithm into an algorithm with one-sided error, which are known to admit efficient reductions from the work of Gola, Shinkar, and Singh [12]. Our reduction is more concise and straightforward compared to the recent work of Hirahara and Shimizu [18], and improves the overhead in the running time incurred during the reduction.

Keywords and phrases:
Matrix Multiplication, Reductions, Worst case to average case reductions
Category:
RANDOM
Copyright and License:
[Uncaptioned image] © Igor Shinkar and Harsimran Singh; licensed under Creative Commons License CC-BY 4.0
2012 ACM Subject Classification:
Theory of computation β†’ Problems, reductions and completeness
Acknowledgements:
We thank Valentine Kabanets for suggesting to extend the result of [12] to zero error model over arbitrary finite fields. We are also thankful to the anonymous reviewers for their valuable comments.
Editors:
Alina Ene and Eshan Chattopadhyay

1 Introduction

The problem of efficiently multiplying two nΓ—n matrices is one of the most fundamental problems in computer science. The naive approach for Matrix Multiplication takes O⁒(n3) time, and there is a lot of ongoing research attempting to improve the running time. Strassen [29] first gave a well-known and widely adopted algorithm, with the running time of O⁒(n2.8074). Since then, a long line of work ([24, 5, 26, 25, 28, 8, 27, 31, 22, 3, 9, 32]) has achieved improvement in the exponent, with the current best known algorithm having the runtime of O⁒(n2.3713) [2]. It is still an open problem to find the optimal running time for Matrix Multiplication.

A natural and relaxed version of the above question is to come up with an algorithm which outputs the product of two matrices, but is allowed to have some incorrect entries. In this work, we address the problem of correcting the output of such an algorithm. Assume that we have an algorithm for matrix multiplication which gets two matrices and outputs a matrix which has a fraction of its entries correct, is it possible to correct the incorrect entries efficiently, i.e., without significantly increasing the running time? For two nΓ—n matrices A and B, define their agreement, denoted by agr⁒(A,B) as

agr⁒(A,B)=|{(i,j)|Ai,j=Bi⁒j}|n2.

Hence, the problem can be stated as correcting the output of the matrix multiplication algorithm which has some agreement with the correct product. It is perhaps more convenient to view this question as the problem of getting a worst-case to average-case approximate reduction for matrix multiplication. Worst-case to Average-case reductions could help us to get fast algorithms which work in the worst-case, if we could come up with fast average-case algorithms. On the opposite side, such reductions allow us to show that if a problem is known to be worst-case hard, then it is also average-case hard. So our problem could be restated as – Given an algorithm which gets two matrices A,Bβˆˆπ”½pnΓ—n, and outputs a matrix Cβˆˆπ”½pnΓ—n such that C has a non-trivial agreement with A⁒B in expectation, can we efficiently transform it into an algorithm which outputs the correct matrix product for all possible inputs?

1.1 Previous Work

Worst-Case to Average-case reductions for matrix multiplication have received considerable attention lately. Asadi, Golovnev, Gur, and Shinkar [4] and Hirahara and Shimizu [16] developed Worst-case to Average-case reductions for matrix multiplications. Specifically, they showed that if there exists an algorithm which, on input two matrices over a finite field, returns the correct matrix product on a small fraction of all possible inputs, then it is possible to transform it into an algorithm that computes the matrix product correctly on all the inputs.

Gola, Shinkar, and Singh [12] addressed the related problem of correcting matrix product efficiently, i.e., given an algorithm which on input two matrices over a finite field, outputs a matrix which agrees with the correct matrix product on a non-trivial fraction of entries, can it be reduced to an algorithm that computes the matrix product correctly on all the inputs? Note that this is a weaker assumption than the one used in previous works, since it only assumes a fraction of the output entries to be correct in expectation, whereas the previous works assumed that the output is fully correct for a small fraction of inputs. They showed that over a finite field when the output has a high agreement (>8/9) with the correct matrix product, a reduction can be obtained using standard self-correction techniques for linear functions [6]. In the same work, using techniques from additive combinatorics, it was shown that over 𝔽2, an optimal reduction can be performed in the case of one-sided error, i.e., when all the 1 entries in the output are correct, and the expected agreement is 1/2+Ο΅, for any Ο΅>0.

Hirahara and Shimizu [18] improved upon the previous results by providing a reduction from an algorithm which has a non-trivial agreement with the correct matrix product over a finite field (specifically, an agreement of 2/p+Ο΅ for a field of size p), to a worst-case algorithm. Their key idea was to apply a left-right encoding to the output, using error correcting codes that are encodable and list-decodable in nearly linear time, allowing them to list-decode the left-right encoding efficiently, thereby correcting the matrix product with the help of a matrix-vector product verification algorithm to identify the correct item from the list. Over larger fields, Reed-Solomon Codes satisfied these requirements and allowed for optimal reductions. However, for small fields, they used Ta-Shma codes [30] which are based on random walks over expander graphs, and were shown to be nearly linear time list-decodable by Jeronimo, Srivastava and Tulsiani [21] and Jeronimo [20]. Using efficient list-decoding properties of Ta-Shma codes, a reduction (optimal upto a factor of 2) over small fields was obtained. By using the same codes and modifying the approach through the use of the notion of approximate list-decoding, an optimal reduction, i.e. from an agreement of 1/p+Ο΅ for a field of size p, was obtained in [19].

1.2 Our Contributions

We provide a new worst-case to average-case approximate reduction over finite fields. Over the binary field 𝔽2, we prove the following.

Theorem 1.

Let nβˆˆβ„• be sufficiently large, and let Ο΅>0 be a small constant. Let ALG be an algorithm that gets as input two matrices A,Bβˆˆπ”½2nΓ—n and outputs a matrix ALG⁒(A,B)βˆˆπ”½2nΓ—n in time T⁒(n) such that

𝔼A,Bβˆˆπ”½2nΓ—n⁒[agr⁒(ALG⁒(A,B),Aβ‹…B)]β‰₯1/2+Ο΅.

Then, there exists an algorithm ALGβˆ— running in time 2O⁒(1/Ο΅2)β‹…O~⁒(T⁒(n)) that gets as input two matrices A,Bβˆˆπ”½2nΓ—n and outputs a matrix ALGβˆ—β’(A,B)βˆˆπ”½2nΓ—n such that for all A,B

PrALGβˆ—β’[ALGβˆ—β’(A,B)=Aβ‹…B]>1βˆ’o⁒(1).
β–ΆΒ Remark 2.

Theorem 1 works for all Ο΅β‰₯1/(log⁑log⁑(n))c for some absolute constant c>0. The exact limitations on Ο΅ come from Theorem 15. If we construct a list decodable code that supports smaller Ο΅ (say, all Ο΅>1/log⁑(n)), then we can allow a smaller Ο΅ in the reduction in Theorem 1.

It is an open problem to show a reduction whose running time is poly⁒(1/Ο΅)β‹…O~⁒(T⁒(n)).

Note that any trivial algorithm which returns all 0 or all 1 will have an expected agreement of 1/2. Hence, this result is optimal in terms of agreement, since it allows us to reduce any non-trivial algorithm doing slightly better than a trivial algorithm. Similarly, over a finite field of prime order p, a worst-case to average-case reduction for an expected agreement of 1/p+Ο΅ would be optimal.

Theorem 3.

Let nβˆˆβ„• be sufficiently large, and let Ο΅>0 be a small constant. Let ALG be an algorithm that gets as input two matrices A,Bβˆˆπ”½pnΓ—n and outputs a matrix ALG⁒(A,B)βˆˆπ”½pnΓ—n in time T⁒(n) such that

𝔼A,Bβˆˆπ”½2nΓ—n⁒[agr⁒(ALG⁒(A,B),Aβ‹…B)]β‰₯1/p+Ο΅.

Then, there exists an algorithm ALGβˆ— running in time 2O⁒(1/Ο΅2)β‹…pO⁒(log2⁑(1/Ο΅))β‹…O~⁒(T⁒(n)) that gets as input two matrices A,Bβˆˆπ”½pnΓ—n and outputs a matrix ALGβˆ—β’(A,B)βˆˆπ”½pnΓ—n such that for all A,B

PrALGβˆ—β’[ALGβˆ—β’(A,B)=Aβ‹…B]>1βˆ’o⁒(1).

The overhead in our reduction for a finite field of order p is exponential in poly⁒(1/ϡ). This improves upon the overhead of the reduction given by [18] over small fields, which is double-exponential in poly⁒(1/ϡ).

We believe that our reduction is conceptually simpler as compared to the reduction of [18]. For example, while both reductions use list decodable codes, in this paper we need the list decodable codes to have rather standard properties (which we construct in the Appendix), while [18] requires explicit expansion properties like splittablity of a collection of k-tuples. Our construction of the list-decodable code relies on simple code concatenation techniques, and does not require Walk-Amplified codes based on direct sum encodings of a collection of k-tuples obtained by taking random walks over expander graphs of large girth. In addition, the code we construct has a full rank partition (Definition 6), which is a more natural notion than the (m,Ξ΄)-partition defined in [18]. Furthermore, we do not require the notions of left-right encoding and approximate list-decoding for obtaining optimal reductions.

Finally, in the process of obtaining an optimal reduction, we also provide a way to generalize the one-sided error reduction over the binary field [12] to any finite field of prime order.

2 Preliminaries

We begin by recalling some basic coding theory terminology. A code C over the Finite Field 𝔽p is a subset CβŠ†π”½p. If C is a linear subspace of 𝔽p, it is called a linear code. When the field is 𝔽2, we call it a binary code. Elements of the code are referred to as codewords. A code can be equivalently described by an encoding, which is an injective mapping Enc:𝔽pn→𝔽pN, whose range gives the code C. For a linear code, the encoding Enc:𝔽pn→𝔽pN can be expressed as Enc⁒(x)=G⁒x, where Gβˆˆπ”½pNΓ—n is called a generator matrix. The rate of the code CβŠ†π”½pN is given by logp⁑(|C|)/N, or equivalently as n/N. The distance of the code C is defined as minc1,c2∈C⁒Δ⁒(c1,c2), where Δ⁒(c1,c2)=|{i|(c1)iβ‰ (c2)i}|/n. 111Strictly speaking, it is called the relative distance of the code. However, we shall simply refer to it as distance in this work. We refer the reader to [15] for further details on this subject.

A well-known linear code which we use in this work is the Reed-Solomon code.

Definition 4 (Reed-Solomon codes).

For n,Nβˆˆβ„• and a prime pβ‰₯N, a Reed-Solomon Encoding over a finite field 𝔽p with the message c=(c0,…,cnβˆ’1) and the set of evaluation points Ξ±=(Ξ±1,…⁒αN), denoted by R⁒Sp,Ξ±,n,N:𝔽pn→𝔽pN, is given by R⁒Sp,Ξ±,n,N⁒(c)=(f⁒(Ξ±1),…,f⁒(Ξ±N)), where f⁒(x)=βˆ‘i=0nβˆ’1ci⁒xi.

We now define the notion of list-decoding.

Definition 5 (List-decodable codes).

A code CβŠ†π”½pN given by the encoding Enc:𝔽pn→𝔽pN is (r,β„“)-list-decodable if for all yβˆˆπ”½pN, |{c∈C|Δ⁒(c,y)≀r}|≀ℓ. A list-decoding algorithm is an algorithm which takes as input yβˆˆπ”½pN and with high probability, outputs all the vectors xβˆˆπ”½pn such that Δ⁒(Enc⁒(x),y)≀r.

Next we define the notion of full-rank partition. This notion is a special case of the notion of (m,Ξ΄) full-rank partition used in [16]. Our definition corresponds to m=n and Ξ΄=0, which (in our opinion) is the most natural choice of parameters.

Definition 6 (Full-rank partition).

Let Nβ‰₯n be integers such that N=q⁒n for some qβˆˆβ„•. We say that a matrix Gβˆˆπ”½2NΓ—n admits a full-rank partition if there is a partition P1,P2,…,Pq of [N] such that:

  • β– 

    |Pi|=n for all i∈[q].

  • β– 

    For all i∈[q], the rows indexed by Pi are linearly independent. Equivalently, the submatrix G|Piβˆˆπ”½2nΓ—n is full rank.

We proceed to mention the linear list-decodable code which we crucially use in our reduction.

Lemma 7.

Fix Ο΅>0 and let nβˆˆβ„• be sufficiently large, such that Ο΅>(1/log⁑log⁑(n))c for some absolute constant c>0. There exists a randomized algorithm that runs in time O⁒((log⁑log⁑(n)/Ο΅)2) and with probability at least 2βˆ’O⁒(1/Ο΅2) outputs an advice M0, such that given M0 we have the following.

There exists a linear code C:𝔽2n→𝔽2N, where N/n=poly⁒(1/Ο΅) is an integer, and it satisfies the following properties.

  1. 1.

    C is encodable in time poly⁒(1/Ο΅)β‹…O~⁒(n).

  2. 2.

    C is (1/2βˆ’Ο΅,β„“)-list decodable for β„“=poly⁒(1/Ο΅), and the running time of the decoder is poly⁒(1/Ο΅)β‹…O~⁒(n).

  3. 3.

    The generating matrix for C has a full-rank partition. Furthermore, there exists an algorithm that outputs the generating matrix and the partition in time poly⁒(1/Ο΅)β‹…O~⁒(n).

We are certain that such codes are already known (see, e.g., [13]), however we could not find the exact statement in the literature. In particular, the notion of full-rank partition is a standard notion studied in the literature. We refer the reader to Appendix A for the proof of Lemma 7.

We now state a variant of Markov’s inequality which we use repeatedly in this work.

Lemma 8 (Markov’s Inequality).

Let X be a random variable taking values in the interval [0,1] that has non-zero mean μ. Then, for any λ∈[0,μ],

Pr⁑[Xβ‰₯ΞΌβˆ’Ξ»]β‰₯Ξ»1βˆ’ΞΌ+Ξ».
Proof.

Let p=Pr⁑[Xβ‰₯ΞΌβˆ’Ξ»]. Then,

ΞΌ =βˆ‘xx⁒Pr⁑[X=x]
≀(ΞΌβˆ’Ξ»)β‹…Pr⁑[X<ΞΌβˆ’Ξ»]+1β‹…Pr⁑[Xβ‰₯ΞΌβˆ’Ξ»]
=(ΞΌβˆ’Ξ»)β‹…(1βˆ’p)+p

This gives us that pβ‰₯Ξ»/(1βˆ’ΞΌ+Ξ»). β—€

We now state the verification algorithms we use in the reduction. Firstly, the well-known Freivald’s Randomized Algorithm for verifying matrix multiplication. Secondly, the data structure algorithm given by Hirahara and Shimizu [16] for verifying matrix-vector multiplication.

Lemma 9 (Freivald’s Algorithm [11]).

There exists a randomized algorithm R with runtime O⁒(k⁒n2) which, when given as input three matrices A,B,Cβˆˆπ”½pnΓ—n, outputs either YES or NO such that:

  • β– 

    Pr𝑅⁒[R⁒(A,B,C)=Y⁒E⁒S∣Aβ‹…B=C]=1.

  • β– 

    Pr𝑅⁒[R⁒(A,B,C)=N⁒O∣Aβ‹…Bβ‰ C]β‰₯1βˆ’2βˆ’k.

Lemma 10 (Lemma 6.2 from [17]).

There exists a data structure algorithm D=(Dp⁒r⁒e,Dq⁒u⁒e⁒r⁒y) such that:

  • β– 

    Dp⁒r⁒e⁒(M) is a randomized algorithm which gets as input Mβˆˆπ”½pmΓ—n, and outputs a string Οƒ in O⁒(m⁒n⁒log⁑m) time.

  • β– 

    Dq⁒u⁒e⁒r⁒yσ⁒(x,y) is a deterministic oracle algorithm which, when given oracle access to Οƒ and inputs x,yβˆˆπ”½pm, verifies whether x=M⁒y in O⁒(m⁒log⁑m) time, and is correct with probability 1βˆ’1/poly⁒(m) over the internal coin tosses of Dp⁒r⁒e.

Finally, we mention the one-sided error result from [12] which we use in our reduction.

Lemma 11 (Theorem 3 from [12]).

Let δ>0 be a constant. If there exists an algorithm ALG running in time T⁒(n) such that

  • β– 

    PrA,Bβˆˆπ”½2nΓ—ni,j∈[n]⁒[ALG⁒(A,B)(i,j)=1]β‰₯Ξ΄

  • β– 

    If (A⁒B)i,j=0, then ALG⁒(A,B)i,j=0.

Then, there exists an algorithm ALG~ with runtime T~⁒(n)=2O⁒(log3⁑(1/Ξ΄))β‹…O⁒(log⁑n)β‹…T⁒(n), such that for all A,Bβˆˆπ”½2nΓ—n,

PrALG~⁒[ALG~⁒(A,B)=Aβ‹…B]>1βˆ’o⁒(1).

3 Reduction to the one-sided error case

In this section, we present a reduction of matrix multiplication over the binary field to the one-sided error case of Lemma 11, using a binary linear code whose generating matrix has a full-rank partition. Specifically, we prove the following lemma.

Lemma 12.

For some constant Ο΅>0, let B⁒L⁒C:𝔽2n→𝔽2N be a binary linear code which can be encoded in time Te⁒n⁒c and is β„“-list decodable within radius 1/2βˆ’Ο΅/4 in time Td⁒e⁒c. Furthermore, assume that the generating matrix of B⁒L⁒C has a full-rank partition, such that the generating matrix and the partition are computable in time Tp⁒a⁒r.

Suppose there exists an algorithm ALG running in time T⁒(n) such that for inputs A,Bβˆˆπ”½2nΓ—n

𝔼A,Bβˆˆπ”½2nΓ—n⁒[agr⁒(ALG⁒(A,B),Aβ‹…B)]β‰₯1/2+Ο΅.

Then, there exists an algorithm ALGβˆ—, such that for inputs A,Bβˆˆπ”½2nΓ—n it holds that

  • β– 

    If (A⁒B)(i,j)=0, then ALGβˆ—β’(A,B)(i,j)=0, and

  • β– 

    PrA,Bi,j⁒[ALGβˆ—β’(A,B)(i,j)=1]β‰₯Ο΅2/8,

and the running time of ALGβˆ— is T′⁒(n)=nβ‹…Te⁒n⁒c+Tp⁒a⁒r+O⁒(Nn)β‹…T⁒(n)+O⁒(N⁒n)+O⁒(n2⁒log⁑n)+O⁒(nβ‹…(Td⁒e⁒c+β„“β‹…n⁒log⁑n)).

The reduction is outlined in Algorithm 1. We now describe the steps of the reduction.

Algorithm 1 Reduction to the one-sided error case.

Let Gβˆˆπ”½2NΓ—n be the generator matrix representing the binary linear code B⁒L⁒C:𝔽2n→𝔽2N. For a matrix Mβˆˆπ”½2nΓ—n, define Enc⁒(M)=M⁒GT, i.e. E⁒n⁒c is a function Enc:𝔽2nΓ—n→𝔽2nΓ—N applying the binary linear code B⁒L⁒C to every row of M.

Since G has a full-rank partition, its rows can be partitioned into sets P1,P2,…⁒Pt, such that for every i between 1 and t, |Pi|=n and the sub matrix G|Pi is full rank.

Now, for A,Bβˆˆπ”½2nΓ—n, we construct a matrix Cβˆˆπ”½2nΓ—N such that agr⁒(C,Enc⁒(A⁒B))β‰₯1/2+Ο΅ in expectation. To this end, we note that if Bβˆˆπ”½2nΓ—n is chosen uniformly at random, then the matrix given by B⁒GT|Piβˆˆπ”½2nΓ—m will also be a uniformly random matrix, since GT|Pi is full-rank. Our idea is to apply the encoding given by the sub-matrices GT|Pi and then constructing C by concatenating the columns of all the resultant matrices. Formally, we write C as:

C=A⁒L⁒G⁒(A,Bβ‹…GT|P1)βˆ˜β‹―βˆ˜A⁒L⁒G⁒(A,Bβ‹…GT|Pt)=A⁒L⁒G⁒(A,B⁒GT),

where ∘ denotes the column concatenation. Now, we observe that

𝔼A,Bβˆˆπ”½2nΓ—n[agr⁒(A⁒B⁒GT,C)] =𝔼i∈[t][𝔼A,Bβˆˆπ”½2nΓ—n[agr⁒(ALG⁒(A,Bβ‹…GT|Pi),A⁒B⁒GT|Pi)]]
β‰₯1/2+Ο΅,

where the last inequality follows from the fact that for every 1≀i≀t, Bβ‹…GT|Pi is a uniformly random matrix. In other words, all the columns are generated by taking the product of two uniformly random matrices, for which A⁒L⁒G has an agreement of 1/2+Ο΅.

Since 𝔼A,B[agr⁒(C,Enc⁒(A⁒B))]>1/2+Ο΅, by Markov’s inequality (Lemma 8), there must exist at least Ο΅ fraction of rows of C such that their agreement with the corresponding rows of E⁒n⁒c⁒(A⁒B) is at least 1/2+Ο΅/2 in expectation. Formally, there is a set RβŠ†[n] of rows of size |R|β‰₯ϡ⁒n such that 𝔼A,B[agr⁒(ci,B⁒L⁒C⁒(di))]>1/2+Ο΅/2 for all i∈R, where ciT is the row indexed by i in C and diT is the row indexed by i in A⁒B.

Now, for each row i∈R, by another application of Markov’s inequality (Lemma 8) we can imply that there exists a subset of good inputs G⁒O⁒O⁒Di of density at least Ο΅/2 such that if (A,B)∈G⁒O⁒O⁒Di, agr(ci,BLC(di))]>1/2+Ο΅/4. Therefore, with probability at least Ο΅β‹…Ο΅/2, the distance of the row i of C from the encoding of the row i of the correct product A⁒B is at most 1/2βˆ’Ο΅/4.

Hence, for random choices of A and B, we can list decode these rows in nearly linear time and identify the correct row using an efficient Matrix-Vector product verification algorithm. Furthermore, the verification algorithm (Lemma 10) also lets us identify these good rows.

The Matrix-Vector product verification algorithm gets each vector sβˆˆπ”½2n from the list obtained by decoding the row i, and checks whether s=BT⁒Ai, where AiT is the vector representing the row indexed by i in A. If the output is YES, it implies that sT is the row i of the correct matrix product A⁒B.

Finally, fixing all entries in the undecoded rows by 0 takes us to the one-sided error setting of [12], as stated in Lemma 11. That is,

  • β– 

    If (A⁒B)(i,j)=0, then M(i,j)=0, and

  • β– 

    For at least Ο΅/2 fraction of inputs A,Bβˆˆπ”½2nΓ—n, there are ϡ⁒n rows RβŠ†[n] such that (A⁒B)(i,j)=M(i,j) holds for all (i,j)∈RΓ—[n].

This implies the following.

Claim 13.

For random A,Bβˆˆπ”½2nΓ—n and M obtained by applying AlgorithmΒ 1 we have the following

  • β– 

    If (A⁒B)(i,j)=0, then M(i,j)=0, and

  • β– 

    PrA,Bβˆˆπ”½2nΓ—ni,j∈[n]⁒[M(i,j)=1]β‰₯Ο΅2/8.

Proof.

The first item follows directly from the reduction. For the second item, observe that the reduction guarantees that Pr⁑[M(i,j)=(A⁒B)(i,j)]β‰₯Ο΅2/2, since for Ο΅ fraction of rows i we have at least Ο΅/2 fraction of the inputs (A,B) such that M agree with Aβ‹…B on the i’th row.

For item 2, note that if for each i∈R we had the i’th row of M correct for all A,B, then we would have Pr⁑[M(i,j)=1]β‰₯Ο΅2/4βˆ’2βˆ’n, since (A⁒B)(i,j) is equally likely to be 0 or 1 for any i,j unless the i’th row of A is all zeros, which happens with probability 2βˆ’n.

However, by the argument above, for each i∈R we have only Ο΅/2 fraction of the inputs (A,B) for which the i’th row of M is correct. By the standard concentration inequality, the fraction of ones in each such row is at least Ο΅2/6 for all except for 2βˆ’Ξ©β’(n) fraction of the inputs, and thus Pr⁑[M(i,j)=1]β‰₯Ο΅2/6βˆ’2βˆ’Ξ©β’(n)β‰₯Ο΅2/8, as required. ⊲

Time Complexity of Algorithm 1

Encoding the n rows of B can be done in time nβ‹…Te⁒n⁒c and partitioning the rows of G can be done in time Tp⁒a⁒r. Steps 3 and 4 can be performed in O⁒(Nnβ‹…T⁒(n)) time. Step 5 takes O⁒(N⁒n) time. From Lemma 10, step 6 takes O⁒(n2⁒log⁑n) time and Steps 7 to 9 can be performed in time O⁒(nβ‹…(Td⁒e⁒c+β„“β‹…n⁒log⁑n)). The rest of the steps take O⁒(n2) time.

This completes the proof of Lemma 12.

4 Worst-Case to Average-Case reduction

We now use Lemma 12 and Lemma 11 to obtain a worst case to average case reduction. In particular, we provide the proof of Theorem 1.

Theorem 1. [Restated, see original statement.]

Let nβˆˆβ„• be sufficiently large, and let Ο΅>0 be a small constant. Let ALG be an algorithm that gets as input two matrices A,Bβˆˆπ”½2nΓ—n and outputs a matrix ALG⁒(A,B)βˆˆπ”½2nΓ—n in time T⁒(n) such that

𝔼A,Bβˆˆπ”½2nΓ—n⁒[agr⁒(ALG⁒(A,B),Aβ‹…B)]β‰₯1/2+Ο΅.

Then, there exists an algorithm ALGβˆ— running in time 2O⁒(1/Ο΅2)β‹…O~⁒(T⁒(n)) that gets as input two matrices A,Bβˆˆπ”½2nΓ—n and outputs a matrix ALGβˆ—β’(A,B)βˆˆπ”½2nΓ—n such that for all A,B

PrALGβˆ—β’[ALGβˆ—β’(A,B)=Aβ‹…B]>1βˆ’o⁒(1).
Proof.

We start by applying the reduction from Lemma 12 with the list-decodable code from Lemma 7. Assuming that the code from Lemma 7 satisfies the required properties, which happens with probability at least 2βˆ’O⁒(1/Ο΅2), we get an algorithm ALGβˆ— whose running time is T′⁒(n)=poly⁒(1/Ο΅)⁒O~⁒(n2)+poly⁒(1/Ο΅)β‹…T⁒(n) and it satisfies the conditions of Lemma 11 with Ξ΄=Ο΅2/8.

Then, by applying Lemma 11, we get an algorithm ALG~ whose running time is T~⁒(n)=2O⁒(log3⁑(1/Ο΅))β‹…O⁒(log⁑n)β‹…T′⁒(n), and it solves the matrix multiplication problem in worst case with high probability.

Finally, we can run ALG~, and verify the resulting product using Freivald’s Matrix Multiplication Algorithm (Lemma 9). Since the code in Lemma 7 satisfies the required properties with probability at least (0.288)O⁒(1/Ο΅2), we can repeat the procedure 2O⁒(1/Ο΅2) times to get the correct output with high probability. Therefore, the total running time of the algorithm we get is 2O⁒(1/Ο΅2)β‹…T~⁒(n), and since T⁒(n)β‰₯n2, it implies that the total running time is 2O⁒(1/Ο΅2)β‹…O~⁒(T⁒(n)). β—€

5 Reduction for a Finite Field of Prime order

In this section, we show that our reduction can be generalized to any finite field 𝔽p, where p is a prime.

This can be achieved by extending the one-sided error model of [12] to a zero-error model over 𝔽p. In the one sided error condition of Lemma 11, the output 1 can be viewed as corresponding to the correct entry, while 0 can be viewed as corresponding to βŠ₯ or β€œDon’t know”.

The proof of Lemma 11 relied on the techniques from Additive Combinatorics. The reduction given by [12] for the one-sided error model proceeded by defining the good coordinates, which output 1 with a significant probability on random input matrices. Thereafter, they expressed the input matrices as the sum of random matrices, and used the Probabilistic Bogolyubov Lemma to retrieve all the 1 entries in the correct output. Although they proved the Probabilistic Bogolyobuv lemma for the binary field 𝔽2, their proof can be extended through similar techniques for Fourier analysis over Fp. Hence, the worst-case algorithm ALGβˆ— in Lemma 14 can be obtained in the same way as the reduction for the one-sided error model, by tweaking the definition of good coordinates to be the coordinates which are not βŠ₯ with a significant probability.

Hence, the lemma can be generalized as follows.

Lemma 14.

Let Ξ΄>0 be a constant and p be a prime. If there exists an algorithm ALG running in time T⁒(n) such that for all A,Bβˆˆπ”½pnΓ—n

  • β– 

    PrA,Bβˆˆπ”½pnΓ—ni,j∈[n]⁒[ALG⁒(A,B)(i,j)=(A⁒B)(i,j)]β‰₯Ξ΄

  • β– 

    PrA,Bβˆˆπ”½pnΓ—ni,j∈[n][ALG(A,B)i,jβˆ‰{(AB)i,j,βŠ₯})]=0.

Then, there exists an algorithm ALG~ running in time T~⁒(n)=2O⁒(log3⁑(1/Ξ΄))β‹…pO⁒(log2⁑(1/Ξ΄))β‹…O⁒(log⁑n)β‹…T⁒(n) such that for all A,Bβˆˆπ”½pnΓ—n it holds that

PrALG~⁒[ALG~⁒(A,B)=Aβ‹…B]>1βˆ’o⁒(1).

Below we sketch the proof of the lemma, mostly referencing the reduction analyzed in [12].

Proof.

The lemma follows by slightly tweaking the reduction for the one-sided error regime, given in [12]. Similar to [12, Definition 12], we define the set of good coordinates G to be

G={(i,j)∈[n]Γ—[n]:PrA,Bβˆˆπ”½pnΓ—n⁑[ALG⁒(A,B)i,jβ‰ βŠ₯]>Ξ΄/2}.

Using the algorithm for approximating good coordinates [12, Algorithm 2] and modifying the if-condition in line 12 to take into account the new definition of good coordinates G, we get a zero-error algorithm Z such that for (i,j)∈G, Pr⁑[Z⁒(A,B)i,j=(Aβ‹…B)i,j]β‰₯2βˆ’O⁒(log3⁑(1/Ξ΄))β‹…pβˆ’O⁒(log2⁑(1/Ξ΄)) [12, Claim 19]. This is the most technical step in the proof, relying on the Probabilistic Bogolyubov Lemma. Finally, using random permutations and running Z several times [12, Algorithm 3], we get the desired result. β—€

For generalizing Theorem 1 to 𝔽p, we can proceed in the same way as in Algorithm 1 by initializing all the entries of M to be βŠ₯ rather than zero. This enables us to get a reduction to the zero-error case of Lemma 14. For this reduction, we need a linear code over 𝔽p which is list-decodable from a radius of 1/pβˆ’Ο΅/2 and admits a full-rank partition. This can be achieved by generalizing the construction of the binary linear code in Lemma 7 to a linear code with alphabet size p, which is addressed in Remark 20 in the appendix.

Hence, we get the following generalization for a field of prime order.

Theorem 3. [Restated, see original statement.]

Let nβˆˆβ„• be sufficiently large, and let Ο΅>0 be a small constant. Let ALG be an algorithm that gets as input two matrices A,Bβˆˆπ”½pnΓ—n and outputs a matrix ALG⁒(A,B)βˆˆπ”½pnΓ—n in time T⁒(n) such that

𝔼A,Bβˆˆπ”½2nΓ—n⁒[agr⁒(ALG⁒(A,B),Aβ‹…B)]β‰₯1/p+Ο΅.

Then, there exists an algorithm ALGβˆ— running in time 2O⁒(1/Ο΅2)β‹…pO⁒(log2⁑(1/Ο΅))β‹…O~⁒(T⁒(n)) that gets as input two matrices A,Bβˆˆπ”½pnΓ—n and outputs a matrix ALGβˆ—β’(A,B)βˆˆπ”½pnΓ—n such that for all A,B

PrALGβˆ—β’[ALGβˆ—β’(A,B)=Aβ‹…B]>1βˆ’o⁒(1).

References

  • [1] M. Alekhnovich. Linear diophantine equations over polynomials and soft decoding of reed-solomon codes. IEEE Transactions on Information Theory, 51(7):2257–2265, 2005. doi:10.1109/TIT.2005.850097.
  • [2] Josh Alman, Ran Duan, Virginia Vassilevska Williams, Yinzhan Xu, Zixuan Xu, and Renfei Zhou. More asymmetry yields faster matrix multiplication. In Proceedings of the 2025 Annual ACM-SIAM Symposium on Discrete Algorithms (SODA), pages 2005–2039. SIAM, 2025. doi:10.1137/1.9781611978322.63.
  • [3] Josh Alman and Virginia Vassilevska Williams. A refined laser method and faster matrix multiplication. In SODA 2021, pages 522–539. SIAM, 2021. doi:10.1137/1.9781611976465.32.
  • [4] Vahid R. Asadi, Alexander Golovnev, Tom Gur, and Igor Shinkar. Worst-case to average-case reductions via additive combinatorics. In Proceedings of the 54th Annual ACM SIGACT Symposium on Theory of Computing, STOC 2022, pages 1566–1574, New York, NY, USA, 2022. Association for Computing Machinery. doi:10.1145/3519935.3520041.
  • [5] Dario Bini, Milvio Capovani, Francesco Romani, and Grazia Lotti. O(n2.7799) complexity for n Γ— n approximate matrix multiplication. Information Processing Letters, 8(5):234–235, 1979. doi:10.1016/0020-0190(79)90113-3.
  • [6] Manuel Blum, Michael Luby, and Ronitt Rubinfeld. Self-testing/correcting with applications to numerical problems. Journal of Computer and System Sciences, 47(3):549–595, 1993. doi:10.1016/0022-0000(93)90044-W.
  • [7] A. Borodin and R. Moenck. Fast modular transforms. Journal of Computer and System Sciences, 8(3):366–386, 1974. doi:10.1016/S0022-0000(74)80029-2.
  • [8] Don Coppersmith and Shmuel Winograd. Matrix multiplication via arithmetic progressions. Journal of Symbolic Computation, 9(3):251–280, 1990. Computational algebraic complexity editorial. doi:10.1016/S0747-7171(08)80013-2.
  • [9] Ran Duan, Hongxun Wu, and Renfei Zhou. Faster matrix multiplication via asymmetric hashing. In 64th IEEE Annual Symposium on Foundations of Computer Science, FOCS 2023, Santa Cruz, CA, USA, November 6-9, 2023, pages 2129–2138. IEEE, 2023. doi:10.1109/FOCS57990.2023.00130.
  • [10] Charles M. Fiduccia. Polynomial evaluation via the division algorithm the fast fourier transform revisited. In Proceedings of the Fourth Annual ACM Symposium on Theory of Computing, STOC ’72, pages 88–93, New York, NY, USA, 1972. Association for Computing Machinery. doi:10.1145/800152.804900.
  • [11] Rusins Freivalds. Probabilistic machines can use less running time. In IFIP congress, volume 839, page 842, 1977.
  • [12] Ashish Gola, Igor Shinkar, and Harsimran Singh. Matrix Multiplication Reductions. In Amit Kumar and Noga Ron-Zewi, editors, Approximation, Randomization, and Combinatorial Optimization. Algorithms and Techniques (APPROX/RANDOM 2024), volume 317 of Leibniz International Proceedings in Informatics (LIPIcs), pages 34:1–34:15, Dagstuhl, Germany, 2024. Schloss Dagstuhl – Leibniz-Zentrum fΓΌr Informatik. doi:10.4230/LIPIcs.APPROX/RANDOM.2024.34.
  • [13] Venkatesan Guruswami. List decoding of binary codes–a brief survey of some recent results. In Yeow Meng Chee, Chao Li, San Ling, Huaxiong Wang, and Chaoping Xing, editors, Coding and Cryptology, pages 97–106, Berlin, Heidelberg, 2009. Springer Berlin Heidelberg. doi:10.1007/978-3-642-01877-0_10.
  • [14] Venkatesan Guruswami, Johan HΓ₯stad, and Swastik Kopparty. On the list-decodability of random linear codes. IEEE Transactions on Information Theory, 57(2):718–725, 2011. doi:10.1109/TIT.2010.2095170.
  • [15] Venkatesan Guruswami, Atri Rudra, and Madhu Sudan. Essential coding theory, 2023. Draft available at https://cse.buffalo.edu/faculty/atri/courses/coding-theory/book/.
  • [16] Shuichi Hirahara and Nobutaka Shimizu. Hardness self-amplification: Simplified, optimized, and unified. In Proceedings of the 55th Annual ACM Symposium on Theory of Computing, STOC 2023, pages 70–83, New York, NY, USA, 2023. Association for Computing Machinery. doi:10.1145/3564246.3585189.
  • [17] Shuichi Hirahara and Nobutaka Shimizu. Hardness self-amplification: Simplified, optimized, and unified, 2023. Full version of [16]. URL: https://eccc.weizmann.ac.il/report/2023/026/.
  • [18] Shuichi Hirahara and Nobutaka Shimizu. Error-correction of matrix multiplication algorithms. In Proceedings of the 57th Annual ACM SIGACT Symposium on Theory of Computing, STOC 2025. Association for Computing Machinery, 2025.
  • [19] Shuichi Hirahara and Nobutaka Shimizu. An optimal error-correcting reduction for matrix multiplication. In Proceedings of the 52nd EATCS International Colloquium on Automata, Languages, and Programming, ICALP, pages 97:1–97:17, 2025. doi:10.4230/LIPIcs.ICALP.2025.97.
  • [20] Fernando Granha Jeronimo. Fast Decoding of Explicit Almost Optimal Ο΅-Balanced q-Ary Codes And Fast Approximation of Expanding k-CSPs. In Nicole Megow and Adam Smith, editors, Approximation, Randomization, and Combinatorial Optimization. Algorithms and Techniques (APPROX/RANDOM 2023), volume 275 of Leibniz International Proceedings in Informatics (LIPIcs), pages 60:1–60:16, Dagstuhl, Germany, 2023. Schloss Dagstuhl – Leibniz-Zentrum fΓΌr Informatik. doi:10.4230/LIPIcs.APPROX/RANDOM.2023.60.
  • [21] Fernando Granha Jeronimo, Shashank Srivastava, and Madhur Tulsiani. Near-linear time decoding of ta-shma’s codes via splittable regularity. In Proceedings of the 53rd Annual ACM SIGACT Symposium on Theory of Computing, STOC 2021, pages 1527–1536, New York, NY, USA, 2021. Association for Computing Machinery. doi:10.1145/3406325.3451126.
  • [22] FranΓ§ois Le Gall. Powers of tensors and fast matrix multiplication. In Proceedings of the 39th International Symposium on Symbolic and Algebraic Computation, ISSAC ’14, pages 296–303, New York, NY, USA, 2014. Association for Computing Machinery. doi:10.1145/2608628.2608664.
  • [23] Ray Li and Mary Wootters. Improved List-Decodability of Random Linear Binary Codes. In Eric Blais, Klaus Jansen, JosΓ© D. P. Rolim, and David Steurer, editors, Approximation, Randomization, and Combinatorial Optimization. Algorithms and Techniques (APPROX/RANDOM 2018), volume 116 of Leibniz International Proceedings in Informatics (LIPIcs), pages 50:1–50:19, Dagstuhl, Germany, 2018. Schloss Dagstuhl – Leibniz-Zentrum fΓΌr Informatik. doi:10.4230/LIPIcs.APPROX-RANDOM.2018.50.
  • [24] V. Ya. Pan. Strassen’s algorithm is not optimal trilinear technique of aggregating, uniting and canceling for constructing fast algorithms for matrix operations. In 19th Annual Symposium on Foundations of Computer Science (SFCS 1978), pages 166–176, 1978. doi:10.1109/SFCS.1978.34.
  • [25] Francesco Romani. Some properties of disjoint sums of tensors related to matrix multiplication. SIAM Journal on Computing, 11(2):263–267, 1982. doi:10.1137/0211020.
  • [26] A. SchΓΆnhage. Partial and total matrix multiplication. SIAM Journal on Computing, 10(3):434–455, 1981. doi:10.1137/0210032.
  • [27] Andrew James Stothers. On the complexity of matrix multiplication, 2010. URL: https://api.semanticscholar.org/CorpusID:262795811.
  • [28] V. Strassen. The asymptotic spectrum of tensors and the exponent of matrix multiplication. In 27th Annual Symposium on Foundations of Computer Science (sfcs 1986), pages 49–54, 1986. doi:10.1109/SFCS.1986.52.
  • [29] Volker Strassen. Gaussian elimination is not optimal. Numerische Mathematik, 13(4):354–356, 1969.
  • [30] Amnon Ta-Shma. Explicit, almost optimal, epsilon-balanced codes. In Proceedings of the 49th Annual ACM SIGACT Symposium on Theory of Computing, STOC 2017, pages 238–251, New York, NY, USA, 2017. Association for Computing Machinery. doi:10.1145/3055399.3055408.
  • [31] Virginia Vassilevska Williams. Multiplying matrices faster than coppersmith-winograd. In Proceedings of the Forty-Fourth Annual ACM Symposium on Theory of Computing, STOC ’12, pages 887–898, New York, NY, USA, 2012. Association for Computing Machinery. doi:10.1145/2213977.2214056.
  • [32] Virginia Vassilevska Williams, Yinzhan Xu, Zixuan Xu, and Renfei Zhou. New bounds for matrix multiplication: from alpha to omega. In Proceedings of the 2024 Annual ACM-SIAM Symposium on Discrete Algorithms (SODA), pages 3792–3835. SIAM, 2024. doi:10.1137/1.9781611977912.134.

Appendix A List decodable codes

Theorem 15.

Fix Ο΅>0 and let nβˆˆβ„• be sufficiently large, such that Ο΅>(1/log⁑log⁑(n))c for some absolute constant c>0. There exists a randomized algorithm that runs in time O⁒((log⁑log⁑(n)/Ο΅)2) and with probability at least 2βˆ’O⁒(1/Ο΅2) outputs an advice M0, such that given M0 we have the following.

There exists a linear code C:𝔽2n→𝔽2N, where N/n=poly⁒(1/Ο΅) is an integer, and it satisfies the following properties.

  1. 1.

    C is encodable in time poly⁒(1/Ο΅)β‹…O~⁒(n).

  2. 2.

    C is (1/2βˆ’Ο΅,β„“)-list decodable for β„“=poly⁒(1/Ο΅), and the running time of the decoder is poly⁒(1/Ο΅)β‹…O~⁒(n).

  3. 3.

    The generating matrix for C has a full-rank partition, and there exists an algorithm that outputs the partition in time poly⁒(1/Ο΅)β‹…O~⁒(n).

β–ΆΒ Remark 16.

We make two comments about the advice M0 in Theorem 15.

  1. 1.

    The code C in Theorem 15 depends on M0, and the running times of the algorithms for encoding and list-decoding are poly⁒(1/Ο΅)β‹…O~⁒(n) when given the advice M0.

  2. 2.

    Given M0 we can verify that it satisfies the desired properties in time log(n)O⁒(1/ϡ2). In particular, by sampling 2O⁒(1/ϡ2) independent advices and verifying them, we can find the advice M0 with the desired properties in time log(n)O⁒(1/ϡ2) with probability 0.99.

Our construction will use the following result on list decoding of Reed-Solomon codes.

Lemma 17 (List Decoding Reed-Solomon Codes [1]).

Let 𝔽q be a finite field, and let Ξ±=(Ξ±1,…⁒αN)βŠ†π”½qN. Consider the Reed-Solomon code R⁒Sq,Ξ±,n,N:𝔽qn→𝔽qN of degree n. For Ξ΄>n/N the code R⁒Sq,Ξ±,n,N is (1βˆ’Ξ΄,O⁒(1/Ξ΄))-list decodable, and the list-decoding algorithm runs in time (N/n)O⁒(1)β‹…O⁒(N⁒log2⁑(N))

We start the proof of Theorem 15 with the following simple claim.

Claim 18.

Fix 0<Ξ΄<1/2, and let K=⌈3/Ξ΄2βŒ‰. For a sufficiently large tβˆˆβ„• such that t>poly⁒(1/Ξ΄) there exists a linear code C0:𝔽2t→𝔽2K⁒t defined as C0⁒(x)=M⁒x for some generating matrix Mβˆˆπ”½2K⁒tΓ—t such that

  • β– 

    C0 is (1/2βˆ’Ξ΄,2/Ξ΄2)-list decodable, and

  • β– 

    M has a full-rank partition defined as ({1,…,t},{t+1,…,2⁒t},…⁒{(Kβˆ’1)⁒t+1,…⁒K⁒t}).

A uniformly random matrix Mβˆˆπ”½2K⁒tΓ—t satisfies the desired properties with probability at least 0.288Kβˆ’2βˆ’poly⁒(Ξ΄)⁒t. Furthermore, given a matrix M, we can verify that it satisfies the desired properties in time 2O⁒(K⁒t).

Proof.

Let Mβˆˆπ”½2K⁒tΓ—t be a uniformly random matrix. Let C0={M⁒x:xβˆˆπ”½2t}βŠ†π”½K⁒t be the linear code corresponding to the generating matrix M.

By the result of Li and Wootters [23, Theorem 5], with probability 1βˆ’2βˆ’poly⁒(Ξ΄)⁒t the code C is (1/2βˆ’Ξ΄,2/Ξ΄2)-list decodable.

Next we show that with probability at least 0.288K the random matrix M has the full-rank partition ({1,…,t},{t+1,…,2⁒t},…⁒{(Kβˆ’1)⁒t+1,…⁒K⁒t}). Note that in each block of t rows are linearly independent with probability

∏i=0tβˆ’1(1βˆ’2i2t)β‰₯12β‹…34β‹…78β‹…1516⁒⋯>0.288788095.

By independence, between blocks we get that M has a full-rank partition with probability at least 0.2887K. Since t is sufficiently large, both events happen with probability at least 0.2887Kβˆ’2βˆ’poly⁒(Ξ΄)⁒t>0.288K.

For the β€œfurthermore” statement of the claim, note that if we are given a matrix M, then we can check that for all possible strings wβˆˆπ”½2K⁒t there are at most 2/Ξ΄2 codewords at distance (1/2βˆ’Ξ΄) in total time 2K⁒tΓ—2tΓ—poly⁒(K⁒t), as required. ⊲

Next we prove Theorem 15 by concatenating Reed-Solomon code as the outer code with the code from Claim 18 as the inner code. Specifically, we use the following lemma.

Lemma 19 (Concatenating codes).

Suppose Ci⁒n:𝔽2t→𝔽2Ki⁒n⁒t is a linear code defined as Ci⁒n⁒(x)=M⁒x for some matrix Mβˆˆπ”½2Ki⁒n⁒tΓ—t such that

  • β– 

    Ci⁒n has an encoding algorithm whose running time is E⁒(t),

  • β– 

    Ci⁒n is (1/2βˆ’Ο΅/2,β„“)-list decodable, and the running time of the list decoding algorithm is D⁒(t),

  • β– 

    Ci⁒n has a full-rank partition defined as ({1,…,t},{t+1,…,2⁒t},…⁒{(Kβˆ’1)⁒t+1,…⁒K⁒t}).

Let 4⁒(β„“/Ο΅)2≀Ko⁒u⁒t≀8⁒(β„“/Ο΅)2 be a power of 2.

Then, there exists a linear code C:𝔽2n→𝔽2K⁒n with n=tβ‹…2t/Ko⁒u⁒t and K=Ko⁒u⁒tβ‹…Ki⁒n, such that

  1. 1.

    There is an encoding algorithm for C with running time O~⁒(K⁒nβ‹…E⁒(t)),

  2. 2.

    C is (1/2βˆ’Ο΅,O⁒(β„“/Ο΅))-list decodable,

  3. 3.

    The list decoding algorithm runs in time D⁒(t)β‹…2t+poly⁒(β„“/Ο΅)β‹…O~⁒(2t),

  4. 4.

    C has a full-rank partition.

Proof.

We define C as the concatenation of Reed-Solomon code as the outer code and Ci⁒n as the inner code. Specifically, the encoding of C works as follows.

Given a message x of length n=tβ‹…2t/Ko⁒u⁒t view it as 2t/Ko⁒u⁒t blocks of length t each. Treating each block as an element of the finite field 𝔽q with q=2t we first apply the Reed-Solomon code R⁒S:q2t/Ko⁒u⁒tβ†’q2t on xβˆˆπ”½q2t/Ko⁒u⁒t to get an encoding in 𝔽q2t. Then, we apply the code Ci⁒n:𝔽2t→𝔽2Ki⁒n⁒t to each symbol of the Reed-Solomon codeword. Therefore, C is a linear code that takes n=tβ‹…2t/Ko⁒u⁒t bits and outputs Ki⁒nβ‹…Ko⁒u⁒tβ‹…n bits.

Next we prove that C satisfies the properties stated in the lemma.

  1. 1.

    Using the fast multipoint evaluation of polynomials [10, 7], Reed-Solomon codes are encodable in O~⁒(2t) time. Given the Reed-Solomon encoding, we apply C0 on each block, which takes E⁒(t) time for each of the 2t blocks. Therefore, the total running time is dominated by O~⁒(2tβ‹…E⁒(t)).

  2. 2.

    For the decoding algorithm, suppose we get a word wβˆˆπ”½2n that is 1/2βˆ’Ο΅ close to an encoding of some message cβˆ—=C⁒(xβˆ—). By Markov’s inequality there are at least Ο΅ fraction of blocks that are 1/2βˆ’Ο΅/2 close to Ci⁒n.

    We run the (1/2βˆ’Ο΅/2,β„“)-list decoding algorithm for Ci⁒n on each block of w, and get a list of size at most β„“ for each block. By choosing a uniformly random element in each list, we obtain a word of length 2t over the alphabet 𝔽q that agrees with the Reed-Solomon encoding of x in at least Ο΅/β„“ fraction of symbols in expectation. Furthermore, by Chernoff bound, with probability 1βˆ’eβˆ’Ξ©β’(Ο΅β‹…2t/β„“) the word we obtain agrees with the Reed-Solomon encoding of x in at least Ο΅/2⁒ℓ fraction of symbols. Let us assume from now on the event that at least Ο΅/2⁒ℓ fraction of symbols are correct. Since Ο΅/2⁒ℓβ‰₯1/Ko⁒u⁒t, we can apply Lemma 17 to obtain a list of length at most O⁒(β„“/Ο΅) that contains our message xβˆ—, as required.

    Therefore, any string xβˆˆπ”½2n belongs to the list of outputs with probability at least 1βˆ’eβˆ’Ξ©β’(Ο΅β‹…2t/β„“). Therefore, by union bound the output of the decoding algorithm contains all strings with probability at least 1βˆ’O⁒(β„“/Ο΅)β‹…eβˆ’Ξ©β’(Ο΅β‹…2t/β„“)>1βˆ’eβˆ’Ξ©β’(Ο΅β‹…2t/β„“), where the Ω⁒(β‹…) notations might hide different constants.

  3. 3.

    For the running time of the list decoder, we first run the decoder for Ci⁒n on each of the 2t blocks, which take total 2tβ‹…D⁒(t) time. After that we sample one element from each list, and run the list decoder for Reed-Solomon, which runs in time poly⁒(Ko⁒u⁒t)β‹…O~⁒(2t).

  4. 4.

    Consider first the generating matrix G of the Reed-Solomon code. By the interpolation properties of polynomials, it is easy to see that any partition of the rows of G is a full-rank partition. In particular, the restriction of G to any 2t/Ko⁒u⁒t blocks is a bijection mapping of the n bits to n bits, and hence the corresponding submatrix is invertible.

    Next, consider only the first n bits of the Reed-Solomon encoding corresponding to n/t blocks. (All other (Ko⁒u⁒tβˆ’1)Γ—(n/t) blocks are handled similarly.)

    Note that applying Ci⁒n on each of the n/t blocks, corresponds to multiplying G by a block-diagonal matrix Mβˆ—βˆˆπ”½2Ki⁒nβ‹…tβ‹…2tΓ—tβ‹…2t, where each block of Mβˆ— is the matrix Mβˆˆπ”½2Ki⁒n⁒tΓ—t. Consider the partition ({1,…,t},{t+1,…,2⁒t},…⁒{(Ki⁒nβˆ’1)⁒t+1,…⁒Ki⁒n⁒t}) of M, and denote Pi={(iβˆ’1)⁒t+1,(iβˆ’1)⁒t+2,…,i⁒t}.

    We claim that for each 1≀i≀Ki⁒n, if we take the union of the rows of Mβˆ— corresponding to Pi’s in each of the n/t blocks, then we get a full rank submatrix. That is because the n row are divided into n/t blocks on the diagonal of Mβˆ—, such that each of consists of a tΓ—t full-rank submatrix (one for each Pi), and the rows are linearly independent of each other. Multiplying the first n rows of G (which is a submatrix of full-rank) by that submatrix of Mβˆ— (which is also full-rank) gives a full-rank submatrix. This defines a full-rank partition of C.

This completes the proof of Lemma 19. β—€

Proof of Theorem 15.

Consider the code C0 and the matrix M0 from Claim 18 with t=Θ⁒(log⁑log⁑(n)) and Ξ΄=Ο΅/4. By the guarantee of Claim 18, M0 satisfies the desired properties with probability at least 2βˆ’O⁒(1/Ο΅2). Assuming that we have such M0, the encoding algorithm of C0 runs in time E0⁒(t)=O⁒(t2/Ο΅2), and the trivial list-decoding works in time D0⁒(t)=2tβ‹…poly⁒(t/Ο΅2) by simply encoding all possible messages and checking their distance from the given word.

We construct C in two steps.

  1. 1.

    First, we apply Lemma 19 with C0 as the inner code, obtaining the code

    C1:𝔽2t⁒2t/poly⁒(1/Ο΅)→𝔽2t⁒2tβ‹…poly⁒(1/Ο΅)

    such that

    1. (i)

      C1 is (1/2βˆ’Ο΅/2,poly⁒(1/Ο΅))-list decodable,

    2. (ii)

      the running time of the encoding algorithm is E1=O~⁒(2tβ‹…E0⁒(t))=O~⁒(2t)β‹…poly⁒(1/Ο΅),

    3. (iii)

      the decoding algorithm runs in time D1=D0⁒(t)β‹…2t+poly⁒(1/Ο΅)β‹…O~⁒(tβ‹…2t)=O~⁒(2t)β‹…poly⁒(1/Ο΅), and

    4. (iv)

      C1 has a full-rank partition.

  2. 2.

    Next we apply Lemma 19 with C1 as the inner code. We obtain the code C:𝔽2n→𝔽2poly⁒(1/Ο΅)⁒n, where n=tβ‹…2t/poly⁒(1/Ο΅)β‹…2tβ‹…2t/poly⁒(1/Ο΅)/poly⁒(1/Ο΅)=22t/poly⁒(1/Ο΅). By the guarantees of Lemma 19, C satisfies the following properties:

    1. (i)

      it is (1/2βˆ’Ο΅,poly⁒(1/Ο΅))-list decodable,

    2. (ii)

      the running time of the encoding algorithm is O~⁒(E1β‹…n)=poly⁒(1/Ο΅)β‹…O~⁒(n),

    3. (iii)

      the running time of the list decoding algorithm is upper bounded by D1β‹…poly⁒(1/Ο΅)β‹…O~⁒(n)=poly⁒(1/Ο΅)β‹…O~⁒(n), and

    4. (iv)

      C has a full-rank partition.

This completes the proof of Theorem 15. β—€

β–ΆΒ Remark 20.

It is not difficult to generalize Theorem 15 to a finite field 𝔽p for any prime p. To extend Claim 18 to a finite field of order p, apply the result of Guruswami, HΓ₯stad, Kopparty [14, Theorem 2.5] that the random linear code C0:𝔽pt→𝔽pK⁒t is (1βˆ’1/pβˆ’Ξ΄,poly⁒(1/Ξ΄))-list decodable with probability 1βˆ’2βˆ’poly⁒(Ξ΄)⁒t. Its generating matrix M will have a full-rank partition with probability greater than 0.288K. The rest of the construction goes through in a similar manner.