Interleaved group products.

Let G be the special linear group SL(2, q). We show that if (a(1), . . . ,a(t)) and (b(1), . . . , b(t)) are sampled uniformly from large subsets A and B of G(t), then their interleaved product a(1)b(1)a(2)b(2) . . . a(t)b(t) is nearly uniform over G. This extends a result of the first author [W. T. Cowers, Combin. Probab. Comput., 17 (2008), pp. 363-387], which corresponds to the independent case where A and B are product sets. We obtain a number of other results. For example, we show that if X is a probability distribution on G(m) such that any two coordinates are uniform in G(2), then a pointwise product of s independent copies of X is nearly uniform in G(m), where s depends on m only. Extensions to other groups are also discussed. We obtain closely related results in communication complexity, which is the setting where some of these questions were first asked by Miles and Viola [Shielding circuits with groups, in ACM Symposium on the Theory of Computing (STOC), ACM, New York, 2013, pp. 251-260]. For example, suppose party A(i) of k parties A(1), . . . , A(k) receives on its forehead a t-tuple (a(i1), . . . , a(it)) of elements from G. The parties are promised that the interleaved product a(11) . . . a(k1a12) . . . a(k2) . . . a(1t) . . . a(kt) is equal either to the identity e or to some other fixed element g is an element of G, and their goal is to determine which of the two the product is equal to. We show that for all fixed k and all sufficiently large t the communication is Omega(t log vertical bar G vertical bar), which is tight. Even for k = 2 the previous best lower bound was Omega(t). As an application, we establish the security of the leakage-resilient circuits studied by Miles and Viola [Shielding circuits with groups, in ACM Symposium on the Theory of Computing (STOC), ACM, New York, 2013, pp. 251-260] in the "only computation leaks" model.