Sustained-Space Complexity in Memory-Hard Computation

• Sustained-Space Complexity (SSC) is a measure that quantifies the number of rounds a computation maintains memory usage above a specified threshold.
• SSC refines traditional measures by emphasizing persistent high memory usage over time, crucial for assessing the true hardware cost in cryptographic applications.
• The formal definition using DAG pebbling models distinguishes SSC from peak and cumulative metrics, providing actionable insights for designing memory-hard functions.

Searching arXiv for the cited papers and closely related work on sustained-space complexity. Sustained-Space Complexity (SSC) is a complexity measure introduced for DAG pebbling and memory-hard computation to capture a specific temporal property of space usage: not merely that a computation reaches a large peak memory, and not merely that its integrated memory-time cost is high, but that it must use a large amount of memory for many rounds. In the formulation of Alwen, Blocki, and Pietrzak, the basic object is a thresholded count of rounds above a space level $s$: for a pebbling $P=\{P_0,\ldots,P_t\}$, the $s$-sustained-space complexity is

${}_ss(P,s)=|\{ i \in [t] : |P_i| \ge s\}|,$

with graph-level SSC obtained by minimizing this quantity over legal pebblings (Alwen et al., 2017). The notion arose in the study of memory-hard functions (MHFs), where the aim is to force evaluators—especially parallel or specialized adversaries—to keep substantial memory provisioned continuously rather than replacing memory with a long, low-memory schedule.

1. Origins and motivating problem

SSC was introduced in response to limitations of earlier measures for memory hardness, especially cumulative memory complexity (cmc), which sums memory usage over time. That measure improved on older space-time products because it accounts better for amortization and parallelism, but it was criticized as insufficient because it fails to capture possible time-memory trade-offs, because memory cost does not scale linearly, and because functions with the same cmc could still have very different actual hardware cost (Alwen et al., 2017).

The motivating hardware argument is concrete. The same source emphasizes that actual hardware cost is not linear in memory size $M$: wiring length to access memory of size $M$ grows like $\sqrt{M}$ under a $2$D layout, access latency grows like $\sqrt{M}$, and wiring area can grow like $M^{1.5}$ (Alwen et al., 2017). Two algorithms may therefore have the same cumulative memory cost while inducing materially different implementations: one may use memory $P=\{P_0,\ldots,P_t\}$0 for $P=\{P_0,\ldots,P_t\}$1 rounds, while another uses memory $P=\{P_0,\ldots,P_t\}$2 for $P=\{P_0,\ldots,P_t\}$3 rounds. SSC was designed to distinguish such cases by asking how long the computation remains above a prescribed space threshold.

This motivation is tightly tied to the cryptographic role of MHFs. The same paper situates the notion in password hashing, blockchain protocols, and proofs of work, where “egalitarianism” means that dedicated hardware should not enjoy a decisive advantage over commodity systems (Alwen et al., 2017). In that setting, a function with high SSC is meant to prevent an evaluator from dramatically lowering hardware cost by shrinking memory and stretching time.

2. Formal definition and models

The original formalism is the black-pebbling model on a DAG $P=\{P_0,\ldots,P_t\}$4 with target set $P=\{P_0,\ldots,P_t\}$5. A legal parallel pebbling is a sequence $P=\{P_0,\ldots,P_t\}$6 such that $P=\{P_0,\ldots,P_t\}$7, every target is pebbled at some step, and a pebble can be added only if all parents were pebbled in the previous round. In the sequential version one additionally requires $P=\{P_0,\ldots,P_t\}$8 for every round (Alwen et al., 2017).

Within that model, the standard measures are

$P=\{P_0,\ldots,P_t\}$9

SSC adds a thresholded persistence measure: $s$0 The graph complexity is then the minimum of this quantity over legal pebblings, with separate sequential and parallel versions. The edge case is explicit: if a graph can be pebbled using fewer than $s$1 pebbles with arbitrarily many steps, then $s$2 (Alwen et al., 2017).

Because plain SSC is not amortizable across multiple independent copies, the paper also defines an amortized $s$3-sustained-space measure,

$s$4

It satisfies

$s$5

and the inequality $s$6, so lower bounds on SSC imply lower bounds on amortized SSC (Alwen et al., 2017).

The same work transfers the concept from pebbling to functions in the parallel random oracle model (pROM). There, graph-labeling functions are used so that storing a vertex label corresponds to placing a pebble on the associated node. The abstract statement of the result is stronger than a generic correspondence claim: the constructed function can be evaluated using $s$7 steps and $s$8 memory, in each step making one query to the random oracle, while any algorithm that can make arbitrary many parallel queries to the random oracle still needs $s$9 memory for ${}_ss(P,s)=|\{ i \in [t] : |P_i| \ge s\}|,$0 steps (Alwen et al., 2017).

3. Core theorems and the structure of the original construction

The central graph theorem of the original SSC paper states that for some constants ${}_ss(P,s)=|\{ i \in [t] : |P_i| \ge s\}|,$1 there is a family of DAGs ${}_ss(P,s)=|\{ i \in [t] : |P_i| \ge s\}|,$2 with

${}_ss(P,s)=|\{ i \in [t] : |P_i| \ge s\}|,$3

${}_ss(P,s)=|\{ i \in [t] : |P_i| \ge s\}|,$4 nodes, and

${}_ss(P,s)=|\{ i \in [t] : |P_i| \ge s\}|,$5

This means that every legal parallel black-pebbling must spend linearly many rounds with ${}_ss(P,s)=|\{ i \in [t] : |P_i| \ge s\}|,$6 pebbles (Alwen et al., 2017).

At the function level, the abstract guarantee is that the honest evaluator uses ${}_ss(P,s)=|\{ i \in [t] : |P_i| \ge s\}|,$7 steps and ${}_ss(P,s)=|\{ i \in [t] : |P_i| \ge s\}|,$8 memory with one random-oracle query per step, whereas any adversary in the pROM must still use ${}_ss(P,s)=|\{ i \in [t] : |P_i| \ge s\}|,$9 memory for $M$0 steps (Alwen et al., 2017). The paper describes this as “almost optimal,” and its own justification is asymptotic: any constant-indegree DAG can be pebbled with space $M$1, so one cannot force a nonzero SSC threshold asymptotically larger than $M$2 in that regime (Alwen et al., 2017).

The construction combines three ingredients. The first is the Paul–Tarjan–Celoni graph, which already yields a high-space phenomenon: in any sequential pebbling there is an interval during which at least $M$3 pebbles are continuously present while many sources are pebbled or repebbled. The second is an overlay by extremely depth-robust DAGs. For every fixed $M$4, the paper constructs a family $M$5 with

$M$6

that is $M$7-depth robust for all constants $M$8 such that

$M$9

The third ingredient is indegree reduction, which restores indegree $M$0 while stretching path length and thereby converting a high-space interval into a genuinely sustained one (Alwen et al., 2017).

A key conceptual step is the move from “there exists a moment with many pebbles” to “there exist many moments with many pebbles.” The paper’s proof strategy is to show that either a long unpebbled ancestor path still exists, forcing many future rounds, or the path has already been compressed, which can only happen if many pebbles were maintained for many previous rounds (Alwen et al., 2017). That is the formal mechanism by which ordinary space lower bounds are upgraded to sustained-space lower bounds.

4. SSC/CMC trade-offs in later memory-hardness research

Later work reframed SSC as one side of an explicit trade-off with cumulative memory cost (CMC). In a 2025 development, the trace-based definition is stated directly for PROM executions: if $M$1 is an execution trace, then

$M$2

The same paper gives the analogous definitions for pebblings and emphasizes the intended ideal: an honest party should evaluate in sequential time $M$3 using $M$4 space, while any parallel evaluator should be forced to lock up $M$5 memory for $M$6 sequential steps (Blocki et al., 9 Aug 2025).

That ideal is also stated to be unattainable in full generality. The paper explains that if an MHF is computable in $M$7 sequential time, then classic time-space trade-offs imply alternate evaluations with much smaller space, so modern constructions aim instead for an SSC/CMC dichotomy: either the adversary sustains large memory for many rounds, or it pays a much larger cumulative penalty (Blocki et al., 9 Aug 2025).

The paper’s concrete construction is a new data-dependent MHF, EGSample, with a dynamic version obtained by a Dynamize transformation. Its main dynamic-pebbling theorem yields an either-or statement: any dynamic pebbling strategy either sustains $M$8 pebbles for $M$9 steps or incurs cumulative complexity $\sqrt{M}$0. At the PROM level, the headline bound is slightly weaker but direct: any PROM algorithm either sustains $\sqrt{M}$1 memory for $\sqrt{M}$2 steps or incurs cumulative memory complexity $\sqrt{M}$3 (Blocki et al., 9 Aug 2025).

The combinatorial machinery behind those bounds differs from the original SSC paper. Two properties are central. A DAG is $\sqrt{M}$4-fractionally depth-robust if for every set $\sqrt{M}$5 with $\sqrt{M}$6, the graph $\sqrt{M}$7 contains at least $\sqrt{M}$8 nodes of depth at least $\sqrt{M}$9. A DAG is $2$0-ancestrally robust if for every set $2$1 of size at most $2$2, there exist $2$3 nodes whose ancestors in $2$4 have cumulative complexity at least $2$5 (Blocki et al., 9 Aug 2025). The first property forces long response time when memory is low; the second forces large recomputation cost if memory falls even further during that response window. In this later literature, SSC is therefore not a stand-alone target but one half of a formally quantified trade-off.

5. Relation to broader notions of space

SSC is a per-execution persistence measure, and it should be distinguished from other temporal or operational uses of “space complexity.” A 2025 survey of space complexity in algorithms studies the historical evolution of asymptotic auxiliary space across 118 problem families and 800+ algorithms, using only auxiliary space complexity and a high-water mark measure of memory cells written to (Rome et al., 27 Nov 2025). Its annualized improvement metric,

$2$6

tracks long-run reductions in auxiliary memory demand over decades rather than rounds-above-threshold within a single computation (Rome et al., 27 Nov 2025). This suggests a different temporal meaning of “sustained”: historical memory improvement, not persistent working-set pressure.

A different but related reinterpretation appears in continuous-time computation. There, the claim is that “space complexity corresponds to precision and conversely,” and that a problem can be solved in polynomial space if and only if it can be simulated by some numerically stable ODE, using a polynomial precision (Blanc et al., 2024). The resource that must be maintained is numerical precision throughout the trajectory and recursive flow decomposition, not a block of discrete memory above a threshold. This is adjacent to SSC in spirit but not in formal definition.

Operational notions of space in programming-language semantics also diverge from SSC. The Interaction Abstract Machine literature measures the peak instantaneous size of machine states, and tree intersection types are used to characterize that peak exactly (Accattoli et al., 2021). Likewise, for stack automata the weak, accept, and strong measures are all defined via the maximum stack size attained during a run or class of runs, with the strong measure ranging over all partial computations (Ibarra et al., 2022). These are robust operational space notions, but they remain peak-based rather than duration-sensitive.

6. Misconceptions, limits, and terminological ambiguity

Several common conflations are explicitly rejected by the SSC literature. SSC is not peak space, because a strategy may have large peak memory for one round and low memory otherwise. It is not cumulative memory complexity, because $2$7 conflates “$2$8 for $2$9 rounds” with “$\sqrt{M}$0 for $\sqrt{M}$1 rounds.” It is not space-time product, because that metric also fails to encode whether high memory was required continuously or only at a short bottleneck (Alwen et al., 2017).

The original framework also has stated limitations. The strongest lower bounds are proved in the random oracle model, more specifically the pROM, and the construction is described as mainly existential and asymptotic rather than immediately practical. Open problems listed there include constructing practically useful DAGs with high SSC, determining whether simpler depth-robustness conditions already imply high SSC, and obtaining efficient local parent computation for high-SSC DAGs (Alwen et al., 2017). The later EGSample work removes expensive combinatorial gadgets and proves direct PROM trade-offs, but it also states that there is still no full reduction from PROM attacks on data-dependent MHFs to dynamic pebbling strategies, and that the PROM exponent remains $\sqrt{M}$2 rather than $\sqrt{M}$3 (Blocki et al., 9 Aug 2025).

There is also a terminological ambiguity external to complexity theory. In accelerator physics, “SSC” can denote the Separated Sector Cyclotron in the HIRFL accelerator complex; the paper on RFQ simulation explicitly uses “SSC-linac” in that sense (Chen et al., 2010). That usage is unrelated to sustained-space complexity.

Within theoretical computer science, SSC is best understood as a thresholded persistence measure on space usage. Its distinctive contribution is to formalize the idea that some computations are hard not because they ever become memory-intensive, and not because their total memory-time is large, but because they must remain memory-intensive for a long interval. In the original pebbling formulation, that interval is counted directly by $\sqrt{M}$4; in later MHF work, it becomes one branch of an SSC/CMC trade-off; and in adjacent literatures on auxiliary space, ODE computation, interaction machines, and automata, it serves as a useful contrast class rather than a synonymous notion.