Expanders Meet Reed--Muller: Easy Instances of Noisy k-XOR

Abstract: In the noisy $k$-XOR problem, one is given $y \in \mathbb{F}_2<sup>M$ and must distinguish between $y$ uniform and $y = A x + e$, where $A$ is the adjacency matrix of a $k$-left-regular bipartite graph with $N$ variables and $M$ constraints, $x\in \mathbb{F}_2<sup>N$ is random, and $e$ is noise with rate $η$. Lower bounds in restricted computational models such as Sum-of-Squares and low-degree polynomials are closely tied to the expansion of $A$, leading to conjectures that expansion implies hardness. We show that such conjectures are false by constructing an explicit family of graphs with near-optimal expansion for which noisy $k$-XOR is solvable in polynomial time. Our construction combines two powerful directions of work in pseudorandomness and coding theory that have not been previously put together. Specifically, our graphs are based on the lossless expanders of Guruswami, Umans and Vadhan (JACM 2009). Our key insight is that by an appropriate interpretation of the vertices of their graphs, the noisy XOR problem turns into the problem of decoding Reed-Muller codes from random errors. Then we build on a powerful body of work from the 2010s correcting from large amounts of random errors. Putting these together yields our construction. Concretely, we obtain explicit families for which noisy $k$-XOR is polynomial-time solvable at constant noise rate $η= 1/3$ for graphs with $M = 2^{O(\log² N)}$, $k = (\log N)<sup>{O(1)}$, and $(N^{1-α}, 1-o(1))$-expansion. Under standard conjectures on Reed--Muller codes over the binary erasure channel, this extends to families with $M = N<sup>{O(1)}$, $k=(\log N)<sup>{O(1)}$, expansion $(N^{1-α}, 1-o(1))$ and polynomial-time algorithms at noise rate $η= N<sup>{-c}$.

• The paper demonstrates that explicit high-expansion graphs allow polynomial-time solutions for noisy k-XOR instances at constant noise rates.
• It leverages lossless expander constructions combined with Reed–Muller decoding techniques to refute expansion-based hardness conjectures.
• The findings caution against relying solely on expander properties for cryptographic hardness and encourage exploring additional algebraic and structural conditions.

Expansion Does Not Imply Hardness for Noisy $k$-XOR: From Lossless Expanders to Reed-Muller Decoding

Introduction

This paper presents a systematic refutation of the conjecture that expansion properties of constraint graphs in the noisy $k$-XOR problem yield hard computational instances. The authors construct explicit families of highly expanding, regular bipartite graphs for which the associated noisy $k$-XOR distinguishing problems admit efficient polynomial-time algorithms at nontrivial, even constant, noise rates. The core technical innovation combines lossless graph expanders, specifically those of Guruswami, Umans, and Vadhan (GUV), with recent insights from random error decoding for Reed–Muller (RM) codes, providing the first explicit counterexample to expansion-based hardness conjectures in the noisy $k$-XOR context.

The Noisy $k$-XOR Problem and Expansion Conjectures

Noisy $k$-XOR is a prototypical problem at the intersection of coding theory, average-case complexity, and computational learning. Given a constraint graph $H$ encoded as a sparse, $k$-left-regular bipartite adjacency matrix $A$, as well as a corrupted codeword $y = A x + e$ or a fully uniform $k$0, the problem is to distinguish the two distributions. Here, $k$1 is random and $k$2 is a noise vector with Bernoulli-corrupted entries at rate $k$3. When the number of constraints exceeds the number of variables, the underlying linear system induces a code with potentially high minimum distance and desirable pseudorandomness properties.

Extensive prior work has associated the presence of statistical-to-computational gaps in such problems with the expansion properties of $k$4. Notably, expansions ensure the absence of small "even covers" (low-weight dependencies), implying both strong local pseudorandomness and provable lower bounds in restricted models such as low-degree polynomials and Sum-of-Squares (SoS) proofs. This led to formal conjectures—stated explicitly in [FOCS:Alekhnovich03] and later work—that adequate expansion in $k$5 entails worst-case average-case hardness for circuits of feasible size at sufficiently high noise levels.

Main Results: Efficient Algorithms Over Near-Optimal Expanders

The paper demonstrates, by explicit construction, that near-optimal expansion does not suffice for computational hardness in noisy $k$6-XOR. The authors show:

• For any constant $k$7, there exists an infinite family of explicit $k$8-left-regular bipartite graphs, with $k$9-expansion, $k$0, and $k$1 constraints, for which noisy $k$2-XOR is polynomial-time solvable at constant noise rate $k$3.
• Assuming standard conjectures about the random erasure-correcting capacity of binary RM codes, there exist similar families with $k$4 and $k$5 for any constant $k$6, preserving strong expansion and efficient distinguishers.

These results decisively refute strong formulations of the expansion-based hardness conjectures for noisy $k$7-XOR, even in regimes not previously considered algorithmically tractable.

Technical Approach

The central construction exploits the affine structure of certain expander graphs to realize the adjacency matrix of the constraint system as a coset graph amenable to RM code techniques. Specifically, the GUV lossless expander constructions are shown, via an explicit field-linear embedding, to be $k$8-coset graphs aligning precisely with RM codes.

The key insight is that for these explicit expanders, the noisy $k$9-XOR distinguishing task can be reduced to decoding RM codes from random errors—a regime where recent work [ASW14, SSV15, KKMPSU16] has shown that RM codes can be efficiently decoded from a fraction of random errors far exceeding their minimum distance. Hence, the expansion properties of $k$0 provide no obstacle to the application of these fast decoding algorithms.

The paper further leverages sharp combinatorial bounds on the volume of Hamming balls (via the entropy function) and the Berry-Esséen theorem to analyze the asymptotic behavior of the code rate and the achievable noise levels. The construction also delicately balances blocklength, left-degree, code rate, and expansion properties to produce families both in the polynomial and quasi-polynomial constraint count regimes.

Implications and Theoretical Impact

The main theorems explicitly falsify the hypothesis that expansion, even in near-optimal form, is a sufficient condition for computational hardness in sparse random linear systems under random noise. This undermines several lines of work in coding theory, pseudorandomness, and cryptography that take such conjectures as foundational. The results show that other structural properties, potentially code symmetries or the algebraic nature of the constraint system, play an essential role in the existence of computational-statistical gaps.

The construction does not contradict the low-degree heuristic in the strongest sense, as the structural symmetry conditions that underpin the low-degree conjecture of Hopkins et al. are not met. However, it presents a "noisy" setting where all efficient low-degree methods fail, but an efficient algorithm exists—further challenging the predictive reach of the low-degree method outside its intended regime.

Practically, these results caution against any use of naive expander-based noisy $k$1-XOR instances for cryptographic hardness. Constructions relying on such hardness for public-key encryption (e.g., Goldreich-type PRGs or PKE schemes in [GHJS25]) are subject to careful reexamination, especially in instantiations over $k$2.

Outlook and Future Directions

This work suggests several avenues for further investigation. It raises the problem of characterizing additional graph or system properties—beyond expansion—that are necessary for computational hardness in planted XOR-type problems. Moreover, the explicit use of RM codes opens up the question of constructing constraints that evade all forms of algebraic decoding while maintaining high expansion.

Open theoretical directions include:

• Proving or disproving the efficient capacity-achieving conjectures for RM codes in the random erasure regime with explicit, practical blocklengths and decoding algorithms.
• Extending or refining the hardness conjectures to incorporate algebraic structure or code-based obstructions more precisely.
• Investigating whether similar techniques can yield counterexamples for $k$3-XOR over larger fields or non-binary alphabets, and their implications for broader classes of CSPs.

Conclusion

The paper provides a clear and explicit counterexample to the widely held belief that strong expansion properties alone induce computational hardness in the noisy $k$4-XOR problem. By synthesizing recent advances in expander graph constructions and Reed–Muller decoding theory, the authors elucidate a fundamental limitation of expansion-based lower bound methodologies—a finding with substantial implications for complexity theory, coding, and cryptography. Future research will likely explore conditions under which computational-to-statistical gaps persist, considering the nuanced interplay between expansion, algebraic structure, and code-theoretic symmetries.