Planted k-OV Model Analysis

• The planted k-OV model is a fine-grained complexity framework that embeds a unique orthogonal vector solution within i.i.d. Bernoulli-distributed instances.
• It uses structured randomization and (k-1)-wise independence to ensure the planted instance mimics pure randomness while preserving average-case hardness.
• Search-to-decision reductions convert decision oracles into efficient search algorithms, underpinning potential cryptographic applications.

The planted $k$-Orthogonal Vectors (planted $k$-OV) model is a rigorously defined average-case variant of the classical $k$-Orthogonal Vectors ($k$-OV) problem, central to fine-grained complexity theory. It formalizes the generation of problem instances in which a uniquely “planted” solution is embedded among vectors drawn from an i.i.d. $p$-biased Bernoulli distribution, in such a way that the average-case complexity is conjectured to match the worst-case barrier of $n^{k-o(1)}$, where $k$ is the number of vector sets and $n$ is the set size. The construction and properties of the planted $k$-OV model, as well as its implications for fine-grained hardness and cryptographic applications, are detailed in "The Planted Orthogonal Vectors Problem" (Kühnemann et al., 30 Apr 2025).

1. Formal Problem Statement and Definitions

The $k$-OV problem, in the worst-case setting, is defined as follows: given $k$0 subsets $k$1 with $k$2 for each $k$3, the task is to determine whether there exists a selection of vectors $k$4 with $k$5, such that for every coordinate $k$6, at least one of the $k$7 equals zero. This is equivalently characterized by the predicate $k$8 for all $k$9.

The planted $k$0-OV framework introduces two key distributions over problem instances:

• The model distribution $k$1: Each entry of each vector across all $k$2 sets is sampled independently as $k$3, with $k$4 chosen as a function of $k$5 and $k$6.
• The planted distribution $k$7: A tuple $k$8 is selected uniformly at random, and the vectors $k$9 are modified to ensure orthogonality, applying a structured randomization that preserves the global and marginal distributions except on the planted tuple.

The model ensures that for parameters $k$0 with $k$1 and $k$2, the generated instances typically contain no orthogonal $k$3-tuple except possibly the planted one (Kühnemann et al., 30 Apr 2025).

2. Planted Distribution Construction and Parameter Regimes

The construction of $k$4 carefully balances the objectives of statistical hiding and unique solution planting. For fixed $k$5, $k$6, set

$k$7

Vectors in all $k$8 sets are initially drawn i.i.d. as $k$9, yielding the model instance $p$0. Given a random planted solution $p$1, the planting transformation is performed coordinate-wise:

• For coordinate $p$2, compute $p$3.
• If $p$4, forcibly flip one bit to zero; more generally, with probability $p$5, flip only the $p$6-th bit to zero, otherwise leave all unchanged.

Post-planting, the $p$7 vectors corresponding to $p$8 are guaranteed to be orthogonal (i.e., at every coordinate at least one is zero). The joint distribution of each $p$9-bit column is

$n^{k-o(1)}$0

with $n^{k-o(1)}$1, ensuring orthogonality on the planted tuple. For all other tuples, statistical properties closely match those under $n^{k-o(1)}$2.

3. $n^{k-o(1)}$3-wise Independence and Marginals

A central property of the planted $n^{k-o(1)}$4-OV distribution is its $n^{k-o(1)}$5-wise independence. Under $n^{k-o(1)}$6, any subset of fewer than $n^{k-o(1)}$7 planted vectors is distributed identically to independent $n^{k-o(1)}$8 vectors. This is achieved by a planting procedure that only modifies the $n^{k-o(1)}$9-th bit of each column and does so based on the values of the other $k$0 bits.

Formally, if $k$1 denotes a column of the $k$2 target vectors, then for any fixed coordinate marginalizing out one of the $k$3 positions, the remaining $k$4 bits remain i.i.d. Bernoulli$k$5. The construction by case analysis demonstrates that even after planting, any detection algorithm restricted to examining $k$6 vectors observes precisely the same marginal laws as under the model distribution, thus destroying distinguishing power at this granularity (Kühnemann et al., 30 Apr 2025).

4. Average-Case Hardness Conjecture and Algorithmic Barriers

The principal conjecture is that for any $k$7 and constant $k$8, no randomized algorithm can run in $k$9 time and distinguish $n$0 from $n$1 with success probability exceeding $n$2. This assertion is supported by analogy to the fine-grained worst-case $n$3-OV conjecture, which itself is implied by SETH for suitable $n$4.

The conjectured hardness is bolstered by the following:

• The near-complete preservation of randomness in the planted instance, as only one $n$5-tuple is “special,” and any smaller tuple remains obfuscated by the marginal structure.
• The failure of sparsity- or projection-based attacks except when $n$6, which are countered by a “down-sampling attack” demonstrating algorithmic feasibility in that regime.

This suggests that under suitable $n$7, average-case $n$8-OV inherits the full fine-grained intractability of its worst-case analog (Kühnemann et al., 30 Apr 2025).

5. Search-to-Decision Reductions

Exploiting the $n$9-wise independence, two specific reductions transform decision algorithms for distinguishing $k$0 from $k$1 into efficient search algorithms that recover the planted solution.

Binary-Search Reduction

For each $k$2, the algorithm iteratively halves $k$3, resampling and querying a decision oracle on each half. If resampling the half that includes the planted index, the instance reduces to $k$4; otherwise, it remains as $k$5. After $k$6 calls per set, the true $k$7 is pinpointed. The total overhead is $k$8 decision queries.

Counter-Based Reduction

Over $k$9 rounds, each vector is independently resampled with probability $k$0. The decision oracle is run, and for each “planted” detection, counters corresponding to surviving candidate vectors are incremented. By concentration bounds, the planted tuple accumulates the highest score with high probability.

Both reductions execute in expected time $k$1 and succeed given a constant-advantage decision oracle. This feature is essential for cryptographic constructions requiring hardness of both the decision and search variants (Kühnemann et al., 30 Apr 2025).

6. Asymptotic Regimes and Solution Uniqueness

Parameter choices fundamentally dictate instance hardness and solution uniqueness. With $k$2, $k$3, and $k$4,

• The probability that any $k$5-tuple is orthogonal under $k$6 is $k$7, so a union bound shows that with probability $k$8, no solution exists.
• Under $k$9, exactly one orthogonal $k$00-tuple emerges with high probability.
• If $k$01, so $k$02, down-sampling attacks become effective, and sub-$k$03 algorithms appear; thus, $k$04 is required for conjectured hardness.

The model achieves average-case hardness only in the “large dimension” regime, paralleling the requirements in worst-case fine-grained complexity (Kühnemann et al., 30 Apr 2025).

7. Theoretical Contributions and Implications

Key results established for the planted $k$05-OV model include:

1. Definition of $k$06: A well-specified average-case distribution that plants a unique orthogonal $k$07-tuple while matching all $k$08-wise marginals with the pure-model $k$09.
2. $k$10-wise Independence Lemma: Any subset of fewer than $k$11 vectors remains identically distributed to independent Bernoulli$k$12 vectors, obstructing algorithms constrained to such views.
3. Hardness Conjecture: No $k$13 algorithm can solve the planted decision $k$14-OV$k$15 problem on $k$16 versus $k$17 for $k$18.
4. Search-to-Decision Reductions: Two fine-grained mechanisms for converting decision oracles into search algorithms, with only polylogarithmic overhead, underpinning cryptographic uses where both hardness properties are necessary.

Together, these insights establish the first robust planted $k$19-OV distribution with matching marginal indistinguishability, aligning the average-case fine-grained hardness with the worst-case conjectured bound, and opening avenues for cryptographic primitives (such as key exchange or public-key encryption) based on this new average-case assumption (Kühnemann et al., 30 Apr 2025).