Complexity of Monomial Prediction in Cryptography and Machine Learning

In this paper, we focus on the monomial prediction problem in two settings: (1) Decide whether a particular mono-mial <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$m$</tex> is present in a composite function <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$f:=f_{r}\circ f_{r-1}\circ\ldots f\mathrm{o}$</tex>, where <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$fi$</tex> are quadratic boolean functions, (2) Decide whether a particular monomial <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$m$</tex> is present in a composite function <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$f:= f_{r}\circ f_{r-1}\circ\ldots f0$</tex>, where polynomials <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$fi$</tex> are efficiently computable by Probabilistic Generating circuits over rationals. Probabilistic generating circuits (PGCs) are economical representations of multivariate probability generating polynomials (PGPs), which capture many tractable probabilistic models in machine learning. The first problem has a strong connection with the security of symmetric-key primitives. Dinur and Shamir proposed the cube attack for distinguishing a cryptographic primitive from a random function, which can be thought of as an efficient monomial prediction. In a general setting, over any large finite field or integers, monomial prediction is known to be NP-hard. Here, we show that in the quadratic setting, the problem is <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$\oplus \mathbf{P}$</tex> complete. <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$\oplus \mathbf{P}$</tex> is an interesting complexity class that is not known to contain NP, however, it is believed to contain computationally hard problems. On the other hand, we also present several new zero-sum distinguishers for 5-round Ascon, which is one of the ten finalists for NIST light weight cryptography standardization competition. We show that the second problem is #P-complete. It is known that PGCs have efficient inference, i.e. given a monomial, one can efficiently output (which signifies the probability) its coefficient in the polynomial computed by the circuit. However, a composition of such functions makes the inference hard. Composition of prob-abilistic models and their efficient inference play a crucial role in the semantic contextualization and framework of uncertainty theories in graphical modelling.