247 GUESSING SECRETS WITH INNER PRODUCT QUESTIONS

Suppose we are given some fixed (but unknown) subset X of a set ~ = ~ , where F2 denotes the field of two elements. We would like to learn as much as possible about the elements of X by asking certain binary questions. Each "question" Q is some element of ~, and the "answer" to Q is just the inner product Qz (in Fz ) for some z E X. However, the choice of x is made by a truthful (but possibly malevolent) adversary A, whom we may assume is trying to choose answers so as to yield as little information as possible about X. In this paper, we study various aspects of this problem. In particular, we are interested in extracting as much information as possible about X from A's answers. Although A can prevent us from learning the identity of any particular element of X, with appropriate questions we can still learn a lot about X. We determine the maximum amount of information that can be recovered and discuss the optimal strategies for selecting questions. For the case that IX[ = 2, we give an O(n s) algorithm for an optimal strategy. However, for the case that IX[ > 3, we show that no such polynomial-time algorithm can exist, unless P = NP. 1 I n t r o d u c t i o n and b a c k g r o u n d The following information-theoretic identification problem was introduced in [1, 2]. A fixed (but unknown) subset X of some finite set l~ is given. A game is played between two players: the "seeker" S and the "adversary" A. The object of the seeker S is to learn as much as possible about the elements of X by asking A binary questions. Each question is in general just some map Q : fi -+ {0,1}, so that l~ is partitioned into f~ = Q l ( 0 ) u Q-I(1) . For each Q, A chooses some element x E X, and answers Q with the value Q(x) e {0,1}. Thus, S knows that XNQ-X(Q(x)) • 0. Of course, A could always use the same element x E X to answer every question S asks, and so, S would never know anything about any of the other elements of X. As shown in [1, 2], with IX] = k, S can always ~ e a r c h supported in part by NSF Grant No. DMS 98-01446 ? University of California, San Diego, La Jells, California choose a sufficiently rich set of questions so that no matter how A selects the answers, the surviving set of possible k-element sets of secrets (consistent with all the answers) forms an intersecting k-uniform hypergraph, i.e., a family F of k-sets of F~ so that any F, F ' E F satisfy F n F' ¢ ~ (and this is the most that S can achieve). Any set of questions which always results in an intersecting hypergraph will be called a separating strategy for S. In this paper, we will take l'~ to be ~2 for some integer n, where F2 denotes the field of two elements. Each "question" Q will just be some element of 12, and an answer to Q will be the inner product Q-x (in F2 ) for some x E X. (In fact, we will only need to use Q with rather small weight, where the weight w(Q) is defined to be the number of coordinates of Q which are equal to 1). As we will see, with this restriction, S can no longer guarantee that any two surviving possible secret k-sets X and Y are intersecting. Rather, the best that S can hope for (and, in fact, which can always be achieved by what we call a weak separating strategy) is that two somewhat larger sets Odd(X) and Odd(Y) are always intersecting, where for V = {V1,. -, V~} C F~2 , we have k k Odd(V) := { Z eiV~ : ei = 0 or 1 and Z e, is odd}. i ~ l i----1 In the next section we show that the set of Q of weight at most 2 k 1 forms a weak separating strategy for secret k-sets in F~. 2 Separating strategies for k secrets The first issue we must address is the question of just how much separation can be achieved by inner product questions when we consider sets of k secrets, say, X -(X1 , . . . ,X~}. We remark that for arbitrary questions (i.e., functions from f~ to {0,1}), we can guarantee that any two surviving k-sets are intersecting, i.e., have a nonempty intersection.