Low-degree Security of the Planted Random Subgraph Problem
Andrej Bogdanov, Chris Jones, Alon Rosen, Ilias Zadik
TL;DR
The paper proves low-degree hardness for detecting planted random subgraphs in the full regime $k \le n^{1 - \Omega(1)}$, improving prior bounds and extending to $r$-uniform hypergraphs. It employs a low-degree polynomial framework with an averaging over the planted subgraph $H$, combined with a Fourier-Walsh analysis and a replica method, to bound the degree-$D$ likelihood ratio and its higher moments; the core technical contribution is a pair of propositions that tightly bound contributions from small and large vertex sets. These hardness results enable cryptographic applications: a hypergraph secret sharing scheme with leakage tolerance achieving share size $(1+o(1))\log k$, and communication-efficient multiparty private simultaneous messages for random functions with near-optimal parameters. Together, the results deepen the hardness landscape for planted random subgraph problems and yield practical, provably secure cryptographic primitives under the low-degree paradigm.
Abstract
The planted random subgraph detection conjecture of Abram et al. (TCC 2023) asserts the pseudorandomness of a pair of graphs $(H, G)$, where $G$ is an Erdos-Renyi random graph on $n$ vertices, and $H$ is a random induced subgraph of $G$ on $k$ vertices. Assuming the hardness of distinguishing these two distributions (with two leaked vertices), Abram et al. construct communication-efficient, computationally secure (1) 2-party private simultaneous messages (PSM) and (2) secret sharing for forbidden graph structures. We prove the low-degree hardness of detecting planted random subgraphs all the way up to $k\leq n^{1 - Ω(1)}$. This improves over Abram et al.'s analysis for $k \leq n^{1/2 - Ω(1)}$. The hardness extends to $r$-uniform hypergraphs for constant $r$. Our analysis is tight in the distinguisher's degree, its advantage, and in the number of leaked vertices. Extending the constructions of Abram et al, we apply the conjecture towards (1) communication-optimal multiparty PSM protocols for random functions and (2) bit secret sharing with share size $(1 + ε)\log n$ for any $ε> 0$ in which arbitrary minimal coalitions of up to $r$ parties can reconstruct and secrecy holds against all unqualified subsets of up to $\ell = o(ε\log n)^{1/(r-1)}$ parties.