Revisiting Time-Space Tradeoffs for Function Inversion.

We study the black-box function inversion problem, which is the problem of finding x ∈ [ N ] such that f ( x ) = y , given as input some challenge point y in the image of a function f : [ N ] → [ N ] , using T oracle queries to f and preprocessed advice σ ∈ { 0 , 1 } S depending on f . We prove a number of new results about this problem, as follows. We show an algorithm that works for any T and S satisfying We observe that there is a very simple non-adaptive algorithm (i.e., an algorithm whose i th query x i is chosen based entirely on σ and y , and not on the f ( x 1 ) , … , f ( x i - 1 ) ) that improves slightly on the trivial algorithm. It works for any T and S satisfying S = Θ ( N log ( N / T ) ) , for example, T = N / poly log ( N ) , S = Θ ( N / log log N ) . This answers a question due to Corrigan-Gibbs and Kogan [TCC, 2019], who asked whether non-trivial non-adaptive algorithms exist; namely, algorithms that work with parameters T and S satisfying T + S / log N < o ( N ) . We also observe that our non-adaptive algorithm is what we call a guess-and-check algorithm, that is, it is non-adaptive and its final output is always one of the oracle queries x 1 , … , x T . For guess-and-check algorithms, we prove a matching lower bound, therefore completely characterizing the achievable parameters ( S , T ) for this natural class of algorithms. (Corrigan-Gibbs and Kogan showed that any such lower bound for arbitrary non-adaptive algorithms would imply new circuit lower bounds.) We show equivalence between function inversion and a natural decision version of the problem in both the worst case and the average case, and similarly for functions f : [ N ] → [ M ] with different ranges. Some of these equivalence results are deferred to the full version [ECCC, 2022]. All of the above results are most naturally described in a model with shared randomness (i.e., random coins shared between the preprocessing algorithm and the online algorithm). However, as an additional contribution, we show (using a technique from communication complexity due to Newman [IPL, 1991]) how to generically convert any algorithm that uses shared randomness into one that does not.