Bounded Indistinguishability for Simple Sources

A pair of sources X, Y over {0, 1}ⁿ are k-indistinguishable if their projections to any k coordinates are identically distributed. Can some AC⁰ function distinguish between two such sources when k is big, say k = n^0.1? Braverman's theorem (Commun. ACM 2011) implies a negative answer when X is uniform, whereas Bogdanov et al. (Crypto 2016) observe that this is not the case in general. We initiate a systematic study of this question for natural classes of low-complexity sources, including ones that arise in cryptographic applications, obtaining positive results, negative results, and barriers. In particular: - There exist Ω(√n)-indistinguishable X, Y, samplable by degree-O(log n) polynomial maps (over F₂) and by poly(n)-size decision trees, that are Ω(1)-distinguishable by OR. - There exists a function f such that all f(d, ϵ)-indistinguishable X, Y that are samplable by degree-d polynomial maps are ϵ-indistinguishable by OR for all sufficiently large n. Moreover, f(1, ϵ) = ⌈log(1/ϵ)⌉ + 1 and f(2, ϵ) = O(log¹⁰(1/ϵ)). - Extending (weaker versions of) the above negative results to AC⁰ distinguishers would require settling a conjecture of Servedio and Viola (ECCC 2012). Concretely, if every pair of n^0.9indistinguishable X, Y that are samplable by linear maps is ϵ-indistinguishable by AC⁰ circuits, then the binary inner product function can have at most an ϵ-correlation with AC⁰ ◦ ⨁ circuits. Finally, we motivate the question and our results by presenting applications of positive results to low-complexity secret sharing and applications of negative results to leakage-resilient cryptography.