on boolean functions with low polynomial degree and higher

On Boolean Functions with Low PolynomialDegree and Higher Order SensitivitySubhamoy Maitra !

Applied Statistics Unit, Indian Statistical Institute, Kolkata, India

Chandra Sekhar Mukherjee !

Indian Statistical Institute, Kolkata, India

Pantelimon Stanica !

Naval Postgraduate School, Monterey, USA

Deng Tang !

Southwest Jiaotong University, Chengdu, China

AbstractBoolean functions are important primitives in different domains of cryptology, complexity andcoding theory. In this paper, we connect the tools from cryptology and complexity theory in thedomain of Boolean functions with low polynomial degree and high sensitivity. It is well known thatthe polynomial degree of of a Boolean function and its resiliency are directly connected. Usingthis connection we analyze the polynomial degree-sensitivity values through the lens of resiliency,demonstrating existence and non-existence results of functions with low polynomial degree andhigh sensitivity on small number of variables (upto 10). In this process, borrowing an idea fromcomplexity theory, we show that one can implement resilient Boolean functions on a large numberof variables with linear size and logarithmic depth. Finally, we extend the notion of sensitivity tohigher order and note that the existing construction idea of Nisan and Szegedy (1994) can provideonly constant higher order sensitivity when aiming for polynomial degree of n − ω(1). In thisdirection, we present a construction with low (n − ω(1)) polynomial degree and super-constant ω(1)order sensitivity exploiting Maiorana-McFarland constructions, that we borrow from construction ofresilient functions. The questions we raise identify novel combinatorial problems in the domain ofBoolean functions.

2012 ACM Subject Classification Author: Please fill in 1 or more \ccsdesc macro

Keywords and phrases Higher Order Sensitivity, Resiliency, Maiorana-McFarland Construction,Polynomial Degree, Sensitivity, Separation.

Digital Object Identifier 10.4230/LIPIcs...

1 Introduction

Real polynomial degree (pdeg(f)) and sensitivity (s(f)) are two central properties of Booleanfunctions in complexity theory, and have been studied extensively over the past three decades.These notions have important implications in the domain of query complexity [3] (and notonly), where finding functions with lower polynomial degree than sensitivity generates morecandidates for obtaining super-linear separation between two of the query complexity models,the classical deterministic and exact quantum models. A detailed study of these propertiesand the relations can be found in [3].

Determining the maximum possible separation between sensitivity and polynomial degreeis an open problem that has been studied widely. Implicitly, the problem reduces to findingthe separation between the number of variables and the real polynomial degree in a fullysensitive function (a function f on n variables with s(f) = n). Informally, the sufficient andnecessary condition for obtaining full sensitivity in a function f on n variables is to have aninput point x ∈ 0, 1n such that f(x) = f(xi), 1 ≤ i ≤ n, where xi is obtained by altering

© Author: Please provide a copyright holder;licensed under Creative Commons License CC-BY 4.0

Leibniz International Proceedings in InformaticsSchloss Dagstuhl – Leibniz-Zentrum für Informatik, Dagstuhl Publishing, Germany

arX

iv:2

107.

1120

5v1

[cs

.CC

] 2

3 Ju

l 202

1

mailto:[email protected]




https://doi.org/10.4230/LIPIcs...

https://creativecommons.org/licenses/by/4.0/

https://www.dagstuhl.de/lipics/

https://www.dagstuhl.de

XX:2 Low Polynomial Degree and Higher Order Sensitivity

the value of the i-th bit of x. Thus, we fix the output corresponding to some n+1 input points,of the total 2n input points. Interestingly, this greatly restricts the real polynomial degree ofthe function. Without any restriction, a function that depends on all of its variables can havepdeg(f) as low as O(log n). However, one of the seminal papers [11] in the study of Booleanfunctions dictate that pdeg(f) = Ω

(s(f)

12)

. Furthermore, apart from the famous recursiveamplification method (which is also known as the function composition), there does notexist any known method to obtain functions with non-constant separation between s(f) andpdeg(f). In fact, the maximum separation known between s(f) and pdeg(f) is achieved byfinding a 6 variable function with s(f) = 6 and pdeg(f) = 3 (due to Kushilevitz [10]) and thenrecursively amplifying it. This results in a function f on n = 6d variables with full sensitivity(n) and polynomial degree of 3d so that s(f) = pdeg(f)log3 6 ≈ pdeg(f)1.63 [11]. On theother hand, the real polynomial degree is intrinsically connected to the cryptographicallyimportant property of resiliency. Specifically if a function f on n variables has pdeg(f) = m

then the function g = f ⊕ Ln is (n − m − 1)-resilient, where Ln is the all variable (symmetric)linear function. In this paper we refer to g and f as each other’s dual. In this regard, wedefine the dual sensitivity (ds(f)) property, where a function g has full dual sensitivity ifand only if there exists a point x ∈ 0, 1n such that g(x) = g(xi), 1 ≤ i ≤ n. This resultsin a one-to-one connection between the pdeg(f)-s(f) relationship and resiliency order-ds(g)relationship, where g is the dual of f . We should remark here that the resilient Booleanfunctions have received a lot of interest in construction of symmetric ciphers as evidentfrom [6, 8, 14].

In this paper, we show that the techniques from complexity theory and cryptology cansupplement each other with respect to combinatorial aspects of Boolean functions which areimportant in their own interests, and extend the notion of sensitivity to higher order towardsa better understanding how fixing of outputs with respect to flipping of more than one inputbits can effect the lower bound on the polynomial degree of a function. That is, we usedifferent properties of resiliency and polynomial degree to obtain results and constructionsthat apply to both paradigms of cryptology and complexity theory.

1.1 Contribution and Organization

Our paper is centered around two related concepts. In the first part we exploit the wellknown connection between resiliency and polynomial degree.

We observe an one to one connection between “low polynomial degree-high sensitivity”and “high resiliency-dual sensitivity” of Boolean functions, via their Fourier spectrum baseddefinitions. We use this connection to search for separation between s(f) and pdeg(f)for functions on all small number of variables through the resiliency approach. We findnew classes of functions with maximum s(f) − pdeg(f) separation and obtain super-linearseparation between n and pdeg(f) for second and third order sensitive functions. Specificallywe find the following which were not known earlier.

There exists second order six variable functions with pdeg(f) = 3. That is the maximumknown separation for n and pdeg is same for first and second order sensitivity.There does not exist any 7 variable fully sensitive function with pdeg(f) = 3.

Further, We analyze the famous recursive amplification (RA) method. We show that itsgeneralization allow us to obtain additional classes of functions with super-linear separationbetween s(f) and pdeg(f). Next, using the RA method we design efficient circuits (linearsize and logarithmic depth (in n) for highly resilient functions (n − o(n)), improving uponbest known results. We further obtain bounds on cryptographic properties of these functions,

Maitra, Mukherjee, Stanica and Tang XX:3

such as nonlinearity and describe different trade-offs.We use our resiliency based search method to obtain second order sensitive 6 variable

functions with pdeg(f) = 3. Coupled with the modified recursive amplification method thatwe propose in Section 3 (Further elaborated in Theorem 13 in Appendix B ), this gives ussecond order functions fu with n = 6u variables and pdeg(fu) = n

log 3log 6 , matching the best

known bound between n and pdeg(f) for first order sensitivity. This raises the question ofwhether asymptotic separation between n and pdeg(f) is a strictly decreasing function whenplotted against sensitivity order.

In the second part, we take a deeper look on higher (k-th) order sensitivity. Sensitivity ofa function f : Fn

2 → F2, at a point x ∈ Fn2 , is the number of bits of x so that, upon flipping

any one of them, the output of the function also flips. Extending this, a function is calledk-th order sensitive, if there is a point x such that changing any 1 ≤ i ≤ k of the input bitschanges the output of the function. This is a much stronger notion than simple sensitivity,where a fully sensitive function of present literature (s(f) = n) is a first order one. We areinterested in understanding the level of restriction higher order sensitivity (dual sensitivity)has on polynomial degree (resiliency).

In this direction we observe for constant sensitivity order, we can design functions withsub-linear polynomial degree o(n) using the recursive amplification method. However,even for functions with pdeg(f) = O (n − o(n)), we can only have constant sensitivityorder through this method.Finally, we show that the Maiorana-McFarland (MM) construction can be used to showsuper-constant separation between n and pdeg(f) for functions with super-constant (ω(1))sensitivity order. We first design a first order sensitive function with pdeg(f) = n log n,which is worse than the recursive amplification method as mentioned above. However,by concatenating non-linear symmetric function in one of the half spaces of the MMfunction, we obtain the desirable trade-off. We obtain k-th order sensitive functions,with pdeg(f) = n − log( n

2 −k)−log(k)k . This gives us functions with s(f) = ω(1) and

pdeg(f) = n − ω(1). For example, if we set k = log log(n), we get log log(n)-ordersensitive functions with polynomial degree of ≈ n − log n

log log n .The paper is organized as follows. In Section 1.2 we recall the definitions of sensitivity andpolynomial degree and the connection of polynomial degree with resiliency. Then we brieflydescribe the concept dual sensitivity, followed by that of higher order sensitivity and higherorder dual sensitivity with the fundamental equivalences. In Section 2 we obtain the searchbased results on sensitivity and higher order sensitivity vs. polynomial degree. In Section 3we study the recursive amplification method and obtain the related results. Section 4 isdedicated towards finding functions with higher order sensitivity and lower than n (n − w(1))polynomial degree. We conclude the paper in Section 5.

1.2 Preliminaries

The definitions of resiliency and polynomial degree are based on the Fourier spectrum ofa Boolean function [12]. A function f has polynomial degree k iff its Fourier spectrumvalues Wf (x) are 0 for all x ∈ 0, 1n with hamming weight wt of x being greater than k. Afunction f is k-resilient if and only if its Fourier spectrum values are 0 for all x : wt(x) ≤ k.We call a function to be k-th order resilient when it is k-resilient but not k + 1-resilient.Given a function f , Wf (x) = Wf⊕Ln

(x) where Ln is the linear function on n variables withx obtained by flipping each bit of x ∈ Fn

2 . These structural arguments gave rise to thefamous result connecting the resiliency order and polynomial degree of Boolean functions.


Theorem 1 ([12], page 150). If a function g is k-th order resilient then the functionf = g ⊕ Ln will have a polynomial degree equal to n − k − 1, where Ln = ⊕n

i=1xi.

Next, we study the notion of sensitivity and also, that of dual sensitivity, which we defineto better understand the connection between resiliency and polynomial degree.

1.3 SensitivitySensitivity s(f) is one of the most studied properties of Boolean function. For any x ∈ Fn

2 ,we let xi to be x with the i-th bit of x flipped (complemented). The sensitivity of a Booleanfunction f : Fn

2 → F2 at a point x can be defined as s(f, x) = |i ∈ [n] : f(x) = f(xi)|, andthe sensitivity of a function is s(f) = maxx∈Fn

2s(f, x). It is natural to consider the situation

where we want the function to have the same value even if multiple input bits of x are flippedregardless of their position. In this direction, we define the k-th order sensitivity of a Booleanfunction.

k-th order sensitivity: For any set S ⊆ [n] and the input point x ∈ Fn2 we define

x(S) as the input point obtained by flipping the j-th bit of x for all j ∈ S. Sensitivity isdefined around the notion of flipping any single component corresponding to a given inputwhere the output of the function remains unchanged. In this regard we define k-th ordersensitivity of a function in the following manner.

Definition 2. We call a function f : Fn2 → F2 k-th order sensitive if there exists x ∈ Fn

2such that f(x) = f

(x(S)) , ∀S ⊆ [n], 1 ≤ |S| ≤ k.

That is, f is k-th order sensitive if there exists an input so that flipping any i ≤ k ofthe component bits of the input, changes the function’s output. Thus a first order sensitivefunction is simply a function with s(f) = n. The main implication of k-th order sensitivityis that it indeed further restricts how low the degree of the real polynomial correspondingto the function can be. Without any restrictions we know pdeg(f) can be as low as log n

for functions that depend on n variables. If we fix s(f) = n then the polynomial degree isΩ (

√n). The paper is centered around obtaining functions with ω(1)-order sensitivity and

n − ω(1)-polynomial degree.

1.4 Dual sensitivityGiven a function f on n variables with polynomial degree m, we call the function g = f ⊕ Ln,the dual of f , which has n − m − 1 resiliency. The dual sensitivity of a function f : Fn

2 → F2at a point x is defined as ds(f, x) = |i ∈ [n] : f(x) = f(xi)|. The dual sensitivity of f isds(f) = maxx∈Fn

2ds(f, x). This notion can be extended to k-th order dual sensitivity in the

following manner.

Definition 3. We say a function f is k-th order dual sensitive if there exists x ∈ Fn2 , such

that, for all j : 1 ≤ j ≤ k we have:If j ≡ 0 mod 2, then f(x) = f

(x(S)) , ∀S ⊆ [n] with |S| = j.

If j ≡ 1 mod 2, then f(x) = f(x(S)) , ∀S ⊆ [n] with |S| = j.

That is, a function is k-th order dual sensitive if there is an input point such that ifwe flip the values of any odd number ≤ k of input bits then the function’s output remainsunchanged and if we flip any even number ≤ k of input bits then the function’s output getscomplemented.


Proposition 4. A function f on n variables is k-th order sensitive if and only if its dualg = f ⊕ Ln is k-th order dual sensitive.

Note 5. We use the following notations:An (n, k, p)-function is a Boolean function of n variables that is k-th order sensitive andhas real polynomial degree at most p.An [n, k, m]-function is a Boolean function of n variables that is k-th order dual sensitiveand m-resilient.

Thus we have the following proposition.

Proposition 6. Thus, if f is an (n, k, p)-function then g = f ⊕ Ln is an [n, k, n − p − 1]-function.

Let us now move onto the search based results.

2 Search On Small Variables

As we shall observe in Section 3, upon some modification, the recursive amplification methodcan be used to obtain k-th order sensitive functions fu on du variables with polynomial degreeof pu, starting from a function f on d variables and pdeg(f) = p. Here p is called the basefunction. Thus results of low pdeg of k-th order sensitive functions on small variables directlygenerate super-linear separations between n and pdeg for k-th order sensitive functions.

For example, if we obtain a fully sensitive (first oder sensitive) function on 7 variableswith pdeg(f) = 3, or a 10 variable first order sensitive function with polynomial degree4, then it would improve upon the best known separation between s(f) and pdeg(f). Inthis direction, the functions on up to 5 variables can be exhaustively searched to obtain allexisting combinations. However, for functions on 6 and more variables, an exhaustive searchis not possible given the size of search space (264 for n = 6, 2128 for n = 7 and so on), andwe instead use the properties of resiliency and dual sensitivity to completely exhaust thecase of fully sensitive functions for n = 6 and n = 7 in terms of obtaining all functions andproving non existence respectively.

2.1 [4, −, 0]-functions:It can be checked with a simple search that there does not exist any fully sensitive function on4 variables with pdeg(f) = 2. In fact, if that would have been the case then we could use therecursive amplification method to obtain a function fu on 4u variables with s(fu) = 4u andpdeg(fu) = 2u, which would give us quadratic separation between sensitivity and polynomialdegree, demonstrating a tight lower bound. Thus we look into the (4, −, 3) functions, whichare duals of [4, −, 0] functions. We have the following counts.

There are approximately 3760(≈ 211.87) many [4, 1, 0]-functions.Only 256(= 28) of these functions are [4, 2, 0]-functions and there are no [4, 3, 0]-functions.

2.2 [5, −, 1]-functions:In the case of 5 variable functions, the possible polynomial degree is between 3 and 4. As wehave already observed the case of 0-resiliency (n − 1 polynomial degree in the dual) for 3and 4, we compute the 1-resilient functions in this case, and get the following counts:

# [5, 1, 1]-functions = 12304(≈ 213.58), # [5, 3, 1]-functions = 0# [5, 2, 1]-functions = 2464(≈ 211.2), # [5, 4, 1]-functions = 0.


Finally let us look into the case of 6 variable functions, for which we have the best basefunction for first order sensitivity, which is the Kushilevitz function.

2.3 [6, −, 2]-functions:There are total 264 Boolean functions on 6 variables, and checking the resiliency and sensitivityof all possible functions requires computational resources that is unattainable. We insteaduse properties of dual sensitivity and resiliency to obtain all possible [6, 1, 2]-functions byconcatenating the truth tables of two 5 variable functions. Any 6 variable function f canbe written as f(x1, . . . , x6) = (1 ⊕ x6)f2(x1, . . . , x5) ⊕ x6f2(x1, . . . , x5) Where f1 and f2 arefunctions on 5 variables. Then we have the following constraints on the properties of f .

1. If f is 2-resilient then either both f1 and f2 are 1-resilient or both are 2-resilient [8].2. If f is fully dual sensitive then at least one of f1 and f2 are fully dual sensitive. This

is easy to see as if neither f1 nor f2 are dual sensitive then there is no input point forwhich the whole function can have full dual sensitivity.

Now we have only 213 many [5, 1, 1]-functions and 218 many [5, 0, 1]-functions, whichreduces the effective search space to approximately 233 from the naive 264. Using theseconstraints we get the full characterization of [6, −, 2]-functions, which was not previouslyreported.

We find that there are 33632(≈ 215.03) many [6, 1, 2]-functions. Here it should be notedthat the dual of any such function is a (6, 1, 3)-function. We can use the modified recursiveamplification technique of Theorem 13 on all such functions to obtain (6u, 1, 3u)-functions,which gives us the best known separation between sensitivity and polynomial degree,same as the function by Kushilevitz [10].We also get 192(≈ 27.6) many [6, 2, 2]-functions, and this gives us the maximum super-linear separation between number of variables and real polynomial degree in second ordersensitive functions, which is pdeg(f) = n

log 3log 6 , which is also the currently best known

separation for first order sensitivity.Furthermore, there is no [6, > 2, 2]-functions.

2.4 Nonexistence of (7, 1, 3)-functions and Searching the RotationSymmetric Functions

The existence or non-existence of a (7, 1, 3)-function is central to understanding the maximumseparation between s(f) and pdeg(f). If there does exist a (7, 1, 3)-function then we canobtain a (7u, 1, 3u)-function using the recursive amplification method, which gives s(f) =pdeg(f)

log 7log 3 , improving on the best known result. However the total number of functions on

7 variables is 2128 and therefore checking all functions for this profile through brute forceis not computationally possible. Against this background we use a mixed integer linearprogram (MILP) to investigate the existence of such a function. If f is a 7 variable Booleanfunction with s(f) = 7 and pdeg(f) = 3 iff there is a vector x ∈ F7

2 such that f(x) ⊕ (xi) = 1for every 1 ≤ i ≤ 7 and Wf (u) = 0 for every u ∈ F7

2 with wt(u ≥ 4. For every x ∈ F72.

We run the MILP and it returns no solution for all choice of x. This shows there are no(7, 1, 3)-functions. One can refer to Appendix A.1 for a formal description of the constraints.

Even with our strategy, it not possible to search for all fully sensitive and higher ordersensitive functions on more than 7 variables because of the size of the search space. Inthis regard we search 8, 9 and 10 variable rotation symmetric functions, which is another


cryptographically important class of functions to obtain with fully sensitive (first ordersensitive functions) using least possible polynomial degree (maximum resiliency in the dualfunction). Our findings can be found in Appendix A.2. Let us now proceed towards therecursive amplification method.

3 The Recursive Amplification Method

We have noted that fixing the value of a function corresponding to n + 1 input points tomake a function fully sensitive, will restrict the polynomial degree to Ω(

√n). The best

known results in this paradigm is derived through the recursive amplification method, whichis also the function composition method. This is a well known technique that is used toobtain super-linear separation between n and pdeg(f) and is also used to obtain super-linearseparation between s(f) and pdeg(f). In this section we use this technique and obtain thefollowing results:1. A slight modification of the recursive amplification method to obtain super-linear separa-

tion between s(f) and pdeg(f) by starting from any candidate base function.2. We build highly resilient functions with good nonlinearity, O(n) circuit size and O(log n)

circuit depth.3. We obtain super-linear separation between number of variables(n) and polynomial degree

(pdeg(f)) for functions with constant order sensitivity.

Recursive amplification was used to obtain the largest known separation between sensitivityand polynomial degree of Boolean functions [3], as well as the first example of separationbetween exact quantum query complexity and deterministic query complexity [1], amongother separation results. Let f be a function on d variables x1, x2 . . . xd with polynomialdegree p. Then the recursive amplification method generates the function fu on du variablesas:1. f1 = f .2. f i+1 (x1, . . . , xdi+1) = f

(f i (x1, . . . , xdi) , . . . , f i

(x(d−1)di+1, . . . , xdi+1

)).

Then for any f we have pdeg(fu) = pu. Thus if the sensitivity also gets amplified, we couldstart with any d variable function with and obtain fu with super-linear s(fu) − pdeg(fu)whenever s(f) > pdeg(f). However, sensitivity is not always amplified in the similar manner,and s(fu) can be arbitrarily low. To this end we propose a construction so that we can getsuper-linear separation between s() and pdeg() starting from any function. Furthermore theresults also follow for higher-order sensitivity. Let yi ∈ Fdi

2 be obtained by concatenatingd copies of yi−1. Then we define the amplification method w.r.t a base function f on d

variables as f i = f(

f i−1(x1, . . . , xdi−1)⊕f i−1(yi−1)⊕y1, . . . , f i−1(xjdi−1+1, . . . , x(j+1)di−1)⊕

f i−1(yi−1) ⊕ yj , . . . , f i−1(x(d−1)di−1+1, . . . , xdi) ⊕ f i−1(yi−1) ⊕ yd

).. Then fu is a k-th order

sensitive function on n = du variables and pdeg(fu) = pdeg(f)u, with k-th order sensitivityachieved at the input point yu. One can refer to Theorem 13 in Appendix B for the formalrepresentation and proof.

Now we look into the functions of 4 variables and then discuss how the recursive amplific-ation method can be used to obtain highly resilient functions with good nonlinearity.

3.1 Low cost resilient functions with recursive amplificationLet us consider a function f on d variables with pdeg(f) = p < d, where d is a constant.Then we can recursively amplify the function to obtain a function fu on n = du variables


with pdeg(fu) = pu = nlog plog d . Now if we add the all variables linear function to it we get an n

variable function with n − nlog plog d − 1 resiliency. However, there already exists many methods

of obtaining Boolean functions with high resiliency and other cryptographically importantproperties such as high nonlinearity.

Here the advantage of the recursive amplification method is the circuit size for buildingsuch functions. Building efficient low depth circuits for cryptographically important functionswith large number of input variables is a challenging problem. In this regard the work bySarkar et al. [15, 2003] is important. This work shows how to start with an m-resilientfunction on some d variables and generate an m + u-resilient function on n = d + u variablesthat requires O(u) depth, which is effectively O(n) as d is constant for any given construction.In fact, this has been the best known result in this direction for almost two decades inbuilding efficient circuits for resilient functions on large variables starting from base functions.Improving on this, we have the following result.

Result 1. Given a function f on d variables with pdeg(f) = p < d we can obtain a functionon gu on n = du variables with resiliency n − n

log plog d − 1 such that there is a circuit of linear

size and logarithmic depth (in n) for it. Here gu is the dual of fu where fu is the functionon nu variables obtained by recursively amplifying f .

The proof can be found in Theorem 14 in the appendix, followed by Figure 1 that gives anexample of building a 9 variable function using 4 instances of the circuit Cf corresponding toa 3-variable function f . We refer to Appendix C for elaborate discussion on the nonlinearitylower bounds we have derived for these highly resilient functions, along with algebraicdegree-resiliency trade-offs. Finally, we show that we can obtain super-linear separationbetween n and pdeg(f) for functions with any constant order sensitivity. This raises theinteresting problem of understanding the nature maximum super-linear separation possiblebetween n and pdeg(f) with increasing, constant order sensitivity k. Specifically we havethe following result.

Result 2. Given any constant k there exists a k-th order sensitive function f on n variablessuch that pdeg(f) = n

log klog k+1 , if k is even and pdeg(f) = n

log k+1log k+2 , if k is odd.

One may refer to Section C.1 for the detailed formal explanation.

4 Higher Order Sensitivity

Until now we have discussed functions with a constant higher order sensitivity, and havefound classes of functions f defined on the number of variables n for which we could obtainsuper-linear separation between n and pdeg(f) using the recursive amplification method.However, we cannot obtain any t(n)-order sensitive (or dual sensitive) function, where t(n)is an increasing function on n using any recursive amplification process, whenever we intendthe function to have less than n polynomial degree.

Theorem 7. The general recursive amplification process cannot obtain a function that hassuper-constant order of sensitivity where the polynomial degree of less than the number ofvariables, where the recursive amplification process is defined as

A base function f1 on some d variables.fk = f1

(fk−1, . . . , fk−1

)where fk−1 ∈ fk−1, fk−1.

Proof. Let us consider any function f on d variables and t(n)-order sensitivity wheret(n) = Ω(1). Then fn is a function on dn variables and there exists n0 ∈ N such that


t(dn0) > d. However it is easy to see (via induction) that any function built with a basefunction on d variables and sensitivity order less than d cannot be d-th order sensitive.

Thus the recursive amplification process does not help us anymore when we considerω(1)-order sensitive functions. In this regard we next explore the class of Maiorana-McFarland(MM) constructions, a heavily studied class for cryptographic and coding theoretic purposes.

Here, we use it from the perspective of polynomial degree-sensitivity to obtain results inthe domain of functions with non-constant order of sensitivity. The layout of this section isas follows. We first discuss the Maiorana-McFarland construction and then obtain separationbetween n and pdeg(f) while making the function first order sensitive (fully sensitive). Weextend this construction while discussing first order sensitivity only for ease of understanding.We analyze the polynomial structure of these functions and obtain logarithmic separationbetween n and pdeg(f). Finally we show that this construction can be modified for super-constant orders of sensitivity (upto o(log n) ) with only a few tweaks.

4.1 Maiorana-McFarland constructionThe Maiorana-McFarland (MM) construction [4] is based on dividing the input variablespace into two parts and attaching different linear functions from one subspace to each pointin the other subspace, defined as follows.

Definition 8. A function f : Fn2 → F2 is called an MM function if it can be expressed as

f(x, y) = (ϕ(x) · y) ⊕ g(x), wherex ∈ Fn1

2 , y ∈ Fn22 , n = n1 + n2;

ϕ is a mapping of the form ϕ : Fn12 → Fn2

2 ;g : Fn1

2 → F2 is an arbitrary Boolean function defined on the subspace Fn12 .

The Boolean functions due to Maiorana-McFarland construction can be visualized in differentways. We view them as different linear functions defined on y attached to activating valuesin x. Let there be an MM Boolean function with any arbitrary map ϕ : Fn1

2 → Fn22

and some Boolean function g : Fn12 → F2. Corresponding to any a ∈ F n1 , the quantity

ϕ(a) · y is essentially the outcome of the linear equation⊕

ϕ(a)i=1

yi. Thus ϕ(a) · y ⊕ g(a)

equals

⊕ϕ(a)i=1

yi

⊕ g(a) for all y in Fn22 . Let us denote this function defined on Fn2

2 as

Linϕ(a),g(a). We now describe two real polynomial structures.

1. Pa : Fn12 → R, a ∈ Fn1

2 is defined as Pa(x) =( ∏

ai=0(1 − xi)

)( ∏ai=1

xi

), so that Pa(x) =

1 if x = a and 0 otherwise

2. Linϕ(a),g(a) corresponding to each a ∈ Fn12 . Any linear function on y can be expressed as

⊕bi=1yi ⊕ c, b ∈ Fn22 , c ∈ F2. Then the L(b,c)(y) = 1

2 − (−1)c

2∏

bi=1(1 − 2yi).

Then we have the following real polynomial w.r.t to any MM type function.

Proposition 9. Given an MM function f(x, y) = (ϕ(x) · y) ⊕ g(x) on n variables withx ∈ Fn1

2 and y ∈ Fn22 , the corresponding real polynomial can be defined as

p(x, y) =∑

a∈Fn12

Pa(x) L(ϕ(a),g(a))(y). (1)

Let us now note down a simple result that this polynomial structure entails.


Note 10. For any b ∈ Fn22 we have Lb,c + Lb,c = 1 and pdeg(Lb,c) = wt(b).

The structure of the rest of this section is as follows. First we describe some sufficientcondition that allows a MM type function to have s(f) = n. Next we obtain a MM typefunction with n − 1 polynomial degree and then extend this technique to obtain a functionwith pdeg(f) = n − log n. Finally we extend this notion to higher order sensitivity by addingnon-linear functions on Fn2

2 , which is one of the main results of the paper.We first ensure s(f) = n. We add two restriction to a MM type function.

1. ϕ(1n1) = 1n2 and g(1n1) = 0. 2. wt(ϕ(1i

n1))

≡ 1 mod 2 and g(1in1

) ≡n2 mod 2.

Then for all such functions we have s(f) = n. We denote this class of MM functions asMMn. Refer to the formal presentation in Lemma 22 in Appendix D.1. Now we describe theconstruction for the first separation.

4.2 First Order Sensitive Functions With Lower Polynomial DegreeFirst we show a construction for getting pdeg(f) = n − 1.

Construction 1. Let f ∈ MMn be an MM function defined on n = n1 + n2 variablesso that n1 ≤ n2 ≤ n1 + 1 with n2 ≡ 0 mod 2. If f is defined using ϕ(1n1−200) = 1n2 ,g(x) =

∏n1−2i=1 xi(1 − xn−1)(1 − xn), the sensitivity of f is n and the polynomial degree is at

most n − 1. Refer to Appendix D.2 for the proof, along with examples and a count on thenumber of such functions.

Let us now better understand how the polynomial structure of the MM type functionscan be modified so that the modified polynomial still represents a Boolean function, butwith lower polynomial degree.

4.3 Interpreting real polynomial terms via the MM constructionWe saw in Proposition 9 that the real polynomial corresponding to any MM type functioncan be expressed as p(x, y) =

∑a∈Fn1

2Pa(x)

(L(ϕ(a),g(a))(y)

). We know that Pa(x) =(∏

i:ai=1 xi

) (∏j:aj=0(1 − xj)

).

If z = (z1, . . . , zk) ∈ Fk2 , it is easy to see

∑a∈Fk

2

((∏i:ai=0 zi

)(∏j:aj=0(1 − zj)

))= 1.

Corresponding to a Boolean function defined on n variables x = (x1, x2, . . . , xn), we definethree non-empty mutually disjoint sets S1, S2 and S3 such that S1∪S2∪S3 = [n] with |Si| = si.Let the variables indexed by elements in Si be denoted as xij and z ∈ Fs3

2 be representedas (z1, z2, . . . , zs3). Then the real polynomial

(∏i∈S1

xi

) (∏j∈S2

(1 − xj))

can be repres-

ented as(∏

i∈S1xi

) (∏j∈S2

(1 − xj))(∑

z∈Fs32

((∏i:zi=0 x3i

)(∏j:zj=0(1 − x3j

))))

that is,∑z∈Fs3

2

((∏

i∈S1xi)(

∏j∈S2

(1 − xj))(∏

i:zi=0 x3i)(∏

j:zj=0(1 − x3j )))

. This implies that cor-responding to an MM type function defined on n = n1 + n2 variables, the polynomialL(b,c)(y)(

∏k1i=1 xi)(

∏k2j=k1+1(1 − xj)) can be interpreted as

∑a∈Fn1−k1−k2

2

(k1∏

i=1xi)(

k2∏j=k1+1

(1 − xj))(∏

ai=1xk1+k2+i)(

∏aj=0

(1 − xk1+k2+j))

L(b,c)(y).


We represent it as∑

a∈Fn1−k1−k22

P(1k1 0k2 a)(x)L(b,c)(y). Thus, we get

(k1∏

i=1xi)(

k2∏j=k1+1

(1 − xj))

L(b,c)(y) =∑

t∈Fn1−k1−k22

(P(1k1 0k2 t)(x)L(b,c)(y)

). (2)

These considerations imply the following result.

Proposition 11. Let f be an MM function f(x, y) = x·ϕ(y)+g(x) such that if x = 1k10k2tthen ϕ(x) = 0 and g(1k10k2t) = 0, ∀t ∈ Fn1−k1−k2

2 . Then the polynomial corresponding to theBoolean function f can be written as p(x, y) =

∑a∈Fn1

2 ,a =1k1 0k2 t Pa(x)(L(ϕ(a),g(a))(y)

), and

the polynomial p′(x, y) = p(x, y) +(

(∏k1

i=1 xi)(∏k2

j=k1+1(1 − xj)))

L(b,c)(y) can be writtenas p′(x, y) =

∑a∈Fn1

2Pa(x) L(ϕ′(a),g′(a))(y), where

ϕ′(x) =

ϕ(x) if x = 1k10k2t for some tb otherwise,

g′(x) =

g(x) if x = 1k10k2t for some tc otherwise

and this represents another MM type function f ′ which differs from f only in the points1k10k2t.

Using this result we can attempt to obtain an MM type Boolean function with a pre-decidedreal polynomial structure. We start with the real polynomial of a particular MM type function,and then modifying its corresponding polynomial by adding

((∏k1

i∈1xi)(

∏k2j=k1+1(1 − xj))

)L(b,c)(y),

keeping in mind the respective necessary constraints we have discussed in terms of ϕ and g.This gives us another function f ′ whose structure and its properties can be recovered from f .Using this combinatorial approach we next have the following result.

Result 3. There exists a Boolean function f ∈ MMn with pdeg(f) = n − Θ(log n).

One can refer to Appendix D.3 for the buildup, along with the proof. Finally we extend ourconstructions and results for super-constant orders of sensitivity.

4.4 Extending to super-constant higher order sensitivity via the MMconstruction

We have so far observed the situation where we have defined a function on n variables inthe MM class as f(x, y) = (ϕ(x) · y) ⊕ g(x) where x ∈ Fn1

2 and y ∈ Fn22 with n1 + n2 = n.

The simplest interpretation is choosing a linear function in y (or its complement dependingon g) corresponding to each point x ∈ Fn1

2 . We can extend this to nonlinear functions in ybeing fixed with respect to the points in y, with ga being the non-linear function on y tobe evaluated when x = a. Then the real polynomial corresponding to the function f(x, y)can be written as p(x, y) =

∑a∈Fn1

2

Pa(x)ga(y) where ga : Fn22 → R is the real polynomial

corresponding to the function ga. Now let us discuss some sufficient conditions to obtaink-th order sensitivity by choosing the proper ga functions.


4.5 Obtaining k-th order sensitivity an reducing polynomial degree:We start by defining a function in Fn2

2 that is k-th order sensitive itself. We define thisfunction as symk

n2: Fn2

2 → F2, k ≤ n. The algebraic normal form of the function contains alldegree i, 1 ≤ i ≤ k monomials. For an example sym2

4(y) = y1 ⊕ y2 ⊕ y3 ⊕ y4 ⊕ y1y2 ⊕ y1y3 ⊕y1y4 ⊕ y2y3 ⊕ y2y4 ⊕ y3y4. Next we observe the sensitivity order of this function. Lemma 12. The function symk

m is a function defined on m variables. k-th order sensitivearound the all zero input point 0m.The proof can be found in Section E.1. Next we define an MM type function MMk

n withnonlinear functions in y, which is k-th order sensitive. Construction 2. Any function f : Fn1+n2

2 → F2 with the algebraic normal form f(x, y) =⊕a∈Fn1

2

(aca(x) · ga(y)) , where g1n1= symk

n2and ga = 1 for all a ∈ Fn1

2 : n1 > wt(a) ≥ n1 − k

is k-th order sensitive.Finally we extend the technique of Section D.3 to obtain non-constant separation betweennumber of variables and real polynomial degree in functions with super-constant order ofsensitivity.

Construction 3. There exists a k-th order sensitive function in MMkn with n− log( n

2 −k)−log k

k

real polynomial degree.The formal proofs of Constructions 2 and 3 can be found in Appendix E.2. To reflecton the implications of this result, we can have log log n-order sensitive functions withpdeg(f) ≈ n − log n

log log n . In fact as long as k = o(log n), we have pdeg(f) = n − ω(1). Theseresults could not be achieved via the recursive amplification constructions.

5 Conclusion

In this paper we have studied the interplay of resiliency and polynomial with respect tosensitivity, and have also extend the notion of sensitivity to higher order sensitivity. In thisdirection based on properties of resilient functions, we have obtained new classes of 6-variablefirst order sensitive functions with pdeg(f) = 3, while also obtaining the same result forsecond order sensitivity. Which indicates that the function of minimum polynomial degreevs. sensitivity order and may not be a strictly increasing functions.

Next we have studied the recursive amplification method and have designed slightmodifications that allow us to start with base function, removing the restrictions of thesimple function composition method. Furthermore, we use the resiliency-polynomial degreeconnection to design efficient circuits with linear size and logarithmic depth to realizehighly-resilient (n − o(n)) functions. Our result improves on the best result known in thisdomain.

Finally we observe that for constant orders of sensitivity, we can have functions with o(n)polynomial degree using the recursive amplification method. Against this backdrop we take theMM constructions and first obtain first order sensitive function with pdeg(f) = n − Θ(log n).Then we modify the MM construction with nonlinear function concatenation, and obtainfunctions with n − ω(1) polynomial degree and ω(1) order sensitivity. Specifically, we showconstruction of k-th order sensitive function with pdeg(f) = n − log( n

2 −k)−log k

k . Our resultsenrich the domain of cryptographically important Boolean functions as long as lay downimportant combinatorial problems that should further enhance our understanding of realpolynomial degree of Boolean functions.


References1 A. Ambainis, Superlinear advantage for exact quantum algorithms, Proceedings of the forty-fifth

annual ACM symposium on Theory of Computing (STOC’13), pp. 891–900, 2013.2 A. Ambainis, K. Balodis, A. Belovs, T. Lee, M. Santha, and J. Smotrovs, Separations in Query

Complexity Based on Pointer Functions, J. ACM 64:5 (2017), Art. 32, 24 pp.3 H. Buhrman and R. De Wolf, Complexity measures and decision tree complexity: a survey,

Theoretical Computer Science 288:1 (2002), 21–43.4 J. F. Dillon, Elementary Hadamard Difference sets, Ph.D. Dissertation, Univ. of Maryland

(1974).5 E. Friedgut and G. Kalai, Every monotone graph property has a sharp threshold, Proc. AMS

124:10 (1996), 2293–3002.6 S. Kavut, S. Maitra, and M. D. Yucel, Search for Boolean Functions With Excellent Profiles

in the Rotation Symmetric Class, IEEE Transactions on Information Theory, vol. 53, no. 5,pp. 1743-1751, May 2007, doi: 10.1109/TIT.2007.894696.

7 A. Klivans, R. O’Donnell, and R. Servedio, Learning intersections and thresholds of half-spaces,J. Computer and System Sciences 68:4 (2004), 808–840.

8 S. Maitra and P. Sarkar, Highly Nonlinear Resilient Functions Optimizing Siegenthaler’sInequality Advances in Cryptology — CRYPTO’ 99. CRYPTO 1999. Lecture Notes in ComputerScience, vol 1666. Springer, Berlin, Heidelberg. https://doi.org/10.1007/3-540-48405-1_13

9 Y. Mansour, Learning Boolean functions via the Fourier transform, Theoretical Advances inNeural Computation and Learning (V. Roychowdhury, K.-Y. Siu, A. Orlitsky, eds.), chapter11, pp. 391–424, Kluwer Academic Publishers, 1994.

10 N. Nisan and M. Szegedy, On the degree of Boolean functions as real polynomials, Comput.Complexity 4 (1994), 301–313.

11 N. Nisan and A. Wigderson, On rank vs. communication complexity, Combinatorica 15 (1995),557–565.

12 R. O’Donnell, Analysis of Boolean functions, Cambridge University Press, 2014.13 R. O’Donnell, J. Wright and Y. Zhou, The Fourier entropy–influence conjecture for certain

classes of Boolean functions, in: Proc. of Automata, Languages and Programming – 38thInternational Colloquium, 2011, pp. 330–341.

14 P. Sarkar and S. Maitra, Construction of Nonlinear Boolean Functions with ImportantCryptographic Properties, Advances in Cryptology - EUROCRYPT 2000, LNCS 1807, Springer-Verlag, pp. 485–506 (2000).

15 P. Sarkar and S. Maitra, Efficient implementation of cryptographically useful “large” Booleanfunctions, IEEE Transactions on Computers 52:4 (2003), 410–417.

A Notes on Search Based Results

A.1 Nonexistence of 7 variable fully sensitive function with PolynomialDegree Value of 3

We know that, for any n-variable Boolean function f , Wf (u) = 0 for every u ∈ Fn2 with

wt(u) ≥ n − m if and only if pdeg(f) ≤ n − m − 1. Thus, f is an n-variable Boolean functionwith full sensitivity and polynomial degree k if and only if f ⊕ 1 is an n-variable Booleanfunction with full sensitivity and polynomial degree k. Therefore, if there are 7-variableBoolean functions with sensitivity 7 and polynomial degree 3, there exist a 7-variable Booleanfunction f with sensitivity 7, polynomial degree 3, and a point x ∈ F7

2 such that f(x) = 0and f(x ⊕ ei) = 1 for all 1 ≤ i ≤ 7 where ei’s are pairwise distinct vectors with Hammingweight 1. Assume that f(i) = yi, where i is the binary expansion of i, and yi′ = 0 when


i′ = x and yi1 = yi2 = . . . = y8 = 1 when ej = ij , then we can search if there exist suchfunctions with sensitivity 7 and polynomial degree 3.

Minimize y1subject to ∑128

i=1(1 − 2yi)(−1)u·i = 0 wt(u) ≥ 4yi ∈ 0, 1 1 ≤ i ≤ 128yi′ = 0yi1 = yi2 = . . . = y8 = 1

.

With the help of Gurobi, we checked for every x ∈ F72 and received a negative outcome in

all cases, concluding that there is no 7 variable fully sensitive function with pdeg(f) = 3.

A.2 Rotation symmetric function for up to 10 variables

First we check the rotation symmetric functions on 7 variables to obtain functions of thirdorder sensitivity and then study rotation symmetric functions on ns > 7 variables. We thusobtain the following results:

There exists 12 many [7, 1, 3]-functions (respectively (7, 5, 3)-functions). Recursivelyamplifying this function gives us a (7u, 5u, 3)-function, an instance of pdeg(f) = n

log 7log 5 .

This is the best separation we are able to find for third order sensitive functions. It willbe interesting to observe if one can obtain better separation in this case.There exists only 12 functions in the rotation symmetric class that are [8, 1, 3]-functionsand none are [8, 2, 3]-functions. There cannot exist any [8, ℓ, 4]-function, where ℓ > 0.We also find 29 many [9, 1, 4] functions rotation symmetric functions, out of which 27 arealso [9, 2, 4]-functions. Furthermore, there cannot exist any [9, ℓ, 5]-function, where ℓ > 0.Here one should note that one can also obtain [9, 1, 4] and [9, 2, 4]-functions by recursivelyamplifying a (3, 1, 2) or a (3, 2, 2)-function respectively and then taking its dual, and thesewere the only known (9, 1, 4)-functions before now. However, we obtain [9, 1, 4]-rotationsymmetric functions with a nonlinearity of 224, where as the nonlinearity of the functionsobtained through recursive amplification is 192. Thus, we obtain previously unknown(9, 1, 4)-functions. The advantage of using the recursive amplification process is its efficientcircuit size and depth.There does not exist any [10, 1, 5]-rotation symmetric function. It should be noted thatif we can obtain a [10, 1, 5]-function (provided such a function exists) then that wouldimprove on the best known separation between sensitivity and polynomial degree. Thisis because we can then get a (10, 1, 4)-function and then recursively amplify the functionusing the modified amplification process described in Theorem 13 to get a (10u, 1, 4u)-function, thus giving s(f) = (pdeg(f))

log 10log 4 and this would be an improvement on the

best known result. Furthermore we took all (9, 1, 4)-functions that we constructed andused the reverse construction [15] where we concatenate the reverse of the truth table ofan even resilient function to itself to get a function with one more variable and one moreresiliency, but this construction only gave us (10, 0, 5)-function and the sensitivity wasnot maintained.

This concludes the study of sensitivity-polynomial degree (and higher order sensitivity-polynomial degree) study of functions on up to 10 variables.


B Results in Section 3

Theorem 13. Let f be a k-th order sensitive function on d variables with pdeg(f1) = p

and y = (y1, y2, . . . , yd) being the input with respect to which the function exhibits k-th ordersensitivity. We define the function fu on du variables such that:1. y1 = y2. yi ∈ Fdi

2 is obtained by concatenating d copies of yi−1.3. f1 = f

4. f i = f(

f i−1(x1, . . . , xdi−1)⊕f i−1(yi−1)⊕y1, . . . , f i−1(xjdi−1+1, . . . , x(j+1)di−1)⊕f i−1(yi−1)⊕

yj , . . . , f i−1(x(d−1)di−1+1, . . . , xdi) ⊕ f i−1(yi−1) ⊕ yd

).

Then fu is a k-th order sensitive function on n = du variables and pdeg(f) = pu with k-thorder sensitivity achieved at the input point yu.

Proof. Here we call the function f as the base function. Let us denote by [x]k any inputpoint that can be obtained by flipping at least 1 and at most k variables of x ∈ Fn

2 . Thus ifa function f is k-th order sensitive at the point y then f([y]k) = f(y) by definition. We nowprove the result using induction on u. The result holds for u = 1 by definition. Assume theresult holds for u − 1 and we need to show that the function fu has k-th order sensitivity atyu. The value of the function at yu is

fu(yu) =f(

fu−1(yu−1) ⊕ fu−1(yu−1) ⊕ y1, . . . , fu−1(yu−1) ⊕ fu−1(yu−1) ⊕ yd

)=f(y).

Let us now select any i ≤ k variables whose value we wish to flip resulting in an inputpoint of the form [yu]k. We define the d tuple S = (s1, s2, . . . , sd) where si denotes thenumber of bits to be flipped between x(i−1)du−1+1 and xidu−1 . Thus 0 ≤ si ≤ k, ∀i. If si = 0then

fu−1(xidu−1+1, . . . , x(i+1)du−1) ⊕ fu−1(yu−1) ⊕ ai

= fu−1(yu−1) ⊕ fn−1(yu−1) ⊕ ai = ai.

If 1 ≤ si ≤ k then

fu−1(xidu−1+1, . . . , x(i+1)du−1) ⊕ fu−1(yu−1) ⊕ ai

= fu−1([yu−1]k) ⊕ fu−1(yu−1) ⊕ ai = ai.

The number of nonzero values in S are at most k, which would change at most k of the d

points yi in the base function’s input to yi and result in an input to f of the form of f([y]k).Thus for the function fu we have fu([yu]k) = f([y]k) = f(y) = fu(yu).

The polynomial degree result holds from the basic definition of recursive amplification aspdeg(f) = pdeg(f) and this completes the proof.

Theorem 14. Given a function f on d variables with pdeg(f) = p < d we can obtain afunction on gu on n = du variables with resiliency n − n

log plog d − 1 such that there is a circuit

of linear size and logarithmic depth (in n) for it.Here gu is the dual of fu where fu is the function on nu variables obtained by recursivelyamplifying f .


Proof. We first define fu as the function obtained recursively amplifying the function f , u

times, which gives us a function on du variables with pdeg(fu) = nlog plog d . Let us assume the

circuit corresponding to the base function on d variables consists of some cd gates and has adepth of td. This circuit takes in d input variable bits and outputs a single bit. Then thecircuit corresponding to fu can be built using the circuits for f in a layered manner in thefollowing way.

In the first layer there are total du−1 circuits each taking in d variables each as input bits.In the i-th layer there du−i−1 circuits each taking as input d of the du−i output bits fromthe previous layer.The final layer contains a single circuit, whose output is the output of the final function.

Then the total number of circuit instances of f to be used is∑u−1

i=0 di = du−1u−1 and the

gate count is cd × du−1u−1 = O(du) = O(n). Moreover, the depth of this circuit is u × td as the

circuit for f is set up in u layers, which gives as a circuit for fu with O(logd n) depth.Now if we XOR the parity of all the input bits to this output we obtain a n − n

log plog d − 1

function gu via the resiliency-polynomial degree connection. The parity of the input bits canbe simply obtained in parallel using n gates and log n depth, which gives us the result.

Figure 1 Example of a circuit corresponding to recursive amplification.

C Cryptographic Properties of The Highly Resilient Functions

Other Properties:Having discussed the efficiency of this method, let us now look into the nonlinearity of suchfunctions, which is another very important cryptographic property. We consider the followingexamples:

Recursively amplifying a (3, 1, 2)-variable function f3 to get a 9 variable function f9(x) =f3(f3(x1, x2, x3) ⊕ a1, f3(x4, x5, x6) ⊕ a2, f3(x7, x8, x9) ⊕ a3

), ai ∈ 0, 1 and then adding

the all variable linear function to obtain g9, which is 4 resilient, irrespective of the choiceof ai. However, depending on the choice of ai, the nonlinearity can either be 96 or 192.Here the circuit for f3 needs 5 XOR gates and 3 AND gates and thus the circuit for f9only requires 20 XOR gates and 12 AND gates, and we can obtain g9 by adding the allvariable parity function, which requires a further 9 XOR gates, which makes the totalgate count to be only 41.Recursively amplifying a 4 variable function f4 to get a 16 variable function f16 andthen adding the all variable linear function to obtain g16. Here we obtain 16 variable


11-resilient functions with nonlinearity as high as 24576 = 215 − 213 where the bestpossible nonlinearity for 16 variable functions is 215 − 27 (bent functions).We also find (6, 1, 3)-functions in Section 2.3 that require 24 AND gates and 21 XORgates to compute. We can then get a 36 variable 26 resilient fully dual sensitive functionwith only 168 AND gates and 147 XOR gates.

Let us now look into some results on non trivial lower bounds on the nonlinearity offunctions based on the recursive amplification method. Here it should be noted that thealgebraic degree of the function gu is upper bounded by the real polynomial degree of fu,which is n

pdeg(f)d .

Let f be a Boolean function on s variables and g1, g2, . . . , gs be s Boolean functions on u

variables. We now define a us-variable Boolean function f by

f (x1, . . . , xus) = f (g1(x1, . . . , xu), g2(xu+1, . . . , x2u), . . . , gs(xus−u+1, . . . , xus)) . (3)

Theorem 15. Let f be the function defined in (3), then for any w = (w1, . . . , ws) ∈ Fus2

(where wi ∈ Fu2 for any 1 ≤ i ≤ s), we have

Wf (w) = 2−s∑v∈Fs

2

(Wf (v)

s∏i=1

Wvigi(wi)

),

where v = (v1, v2, . . . , vs) ∈ Fs2.

Proof. We denote by x the vector (x1, . . . , xus) and xi the vector (xui−u+1, . . . , xui) forany 1 ≤ i ≤ s. Then we have x = (x1, x2, . . . , xs) and f can be rewritten as f (x) =f (g1(x1), g2(x2), . . . , gs(xs)). For any x ∈ Fus

2 , we define g = (g1(x1), g2(x2), . . . , gs(xs)) ∈Fs

2. Then for any g ∈ Fs2, we have∑

y∈Fs2

∑v∈Fs

2

(−1)v·(y+g) = 2s, (4)

since∑

v∈Fs2(−1)z·v equals 0 if z = 0 and equals 2s if z = 0. By the definition of the Walsh

transform, for any w = (w1, w2, . . . , ws) ∈ Fus2 we have

Wf (w) =∑

x∈Fus2

(−1)f(x)⊕w·x

=∑

x∈Fus2

(−1)f(g)⊕w·x

= 2−s∑

x∈Fus2

(−1)f(y)⊕w·x∑y∈Fs

2

∑v∈Fs

2

(−1)v·(y⊕g) (by (4))

= 2−s∑v∈Fs

2

∑y∈Fs

2

∑x∈Fus

2

(−1)f(y)⊕v·y⊕v·g⊕w·x

= 2−s∑v∈Fs

2

∑y∈Fs

2

(−1)f(y)⊕v·y

∑x∈Fus

2

(−1)v·g⊕w·x

= 2−s

∑v∈Fs

2

Wf (v)∑

x1,x2,...,xs∈Fu2

(−1)⊕s

i=1vig(xi)⊕

⊕s

i=1wi·xi

= 2−s

∑v∈Fs

2

(Wf (v)

s∏i=1

Wvigi(wi)

).


Theorem 16. Let f be the function defined in (3) by taking g1, g2, . . . , gk ∈ Fk2 to be

balanced functions. Then for any w = (w1, w2, . . . , ws) ∈ Fks2 (where wi ∈ Fk

2 for any1 ≤ i ≤ s), we have

Wf (w) = 2−sWf (v′)s∏

i=1

(1 + (−1)v′

i

2 · 2k + 1 − (−1)v′i

2 · Wgi(wi)

),

where v′ = (v′1, v′

2, . . . , v′s) ∈ Fs

2 with v′i = 1 if and only if wi = 0k. Furthermore, we have

NL(f) ≥ 2ks−1 − 2ks−k−s−1(

2s − 2NL(f))(

2k − 2 min1≤i≤s

NL(gi))

,

where NL denotes the nonlinearity.

Proof. Note that the value of the Walsh transform at any nonzero point of a constantfunction is equal to null. Thus, for any 1 ≤ i ≤ s, we have W0(wi) = 0 if wi = 0k. As gi’sare balanced, we have Wgi

(0k) = 0 for any 1 ≤ i ≤ s. So we have∏s

i=1 Wvigi(wi) = 0 if

vi = v′i. Then by Theorem 15 we have

Wf (w) = 2−s∑v∈Fs

2

(Wf (v)

s∏i=1

Wvigi(wi)

)

= 2−sWf (v′)s∏

i=1Wv′

igi

(wi).

Then our first assertion comes from the fact Wv′igi

(wi) equals 2k if v′i = 0 and Wgi(wi)

if v′i = 1. Note that |Wgi

(wi)| ≤ maxw′i∈Fk

2|Wgi

(w′i)| ≤ 2k for any 1 ≤ i ≤ s. Then

we have |∏s

i=1 Wvigi(wi)| ≤ 2ks−k · max1≤i≤s,w′

i∈Fk

2|Wgi

(w′i)| by setting the Hamming

weight of v′ to be 1. Then we can obtain that the nonlinearity of f is at least 2ks−1 −2ks−k−s−1 maxu∈Fs

2|Wf (u)| · max1≤i≤s,w′

i∈Fk

2|Wgi(w′

i)|, which gives our second assertion.This finishes the proof.

Lemma 17. Let f be an n-variables function and f be an n2-variable function defined asf(x1, . . . , xn2) = f (f(x1, . . . , xn) + a1, . . . , f(xn2−n+1, . . . , xn2) + an), where ai’s belong toF2. Then the nonlinearity of f is at least 2n2−n+1NL(f) − 2n2−2n+1 (NL(f))2. Moreover,if f is m resilient, then f is (m + 1)2 − 1 resilient; if wf (w) = 0 for any w with Hammingweight no less than m′, then f is n2 − (m′ − 1)2 − 1 resilient.

Proof. The lower bound on nonlinearity of f directly follows from Theorem 16. By observingthe value of Wf (v′)

∏si=1 Wv′

igi

(wi) in the proof of Theorem 16, then we can easily obtainthe rest assertions. This completes the proof.

Corollary 18. Let f be an n-variables Boolean function and fi (i ≥ 2) be the function definedabove. Then we have NL(f i) ≥ 2ni−ni−1

NL(f i−1)+2ni−nNL(f)−2ni−ni−1−n+1NL(f i−1)NL(f)with NL(f1) = NL(f).

However, we can also have an algebraic degree-resiliency trade off in this constructionif we use two kinds of base functions on d variables, one with algebraic degree (and thuspolynomial degree) of d and the other having lower polynomial degree, and we can add thesefunctions in different stages of the recursion to obtain functions with various resiliency andalgebraic degree values. Thus we have two problems that we propose for further attention asthey are beyond the scope of our current discussion:


1. How much can we increase the nonlinearity in fu when the functions used in recursionare of the form f or f , where f is the base function defined on some d variables?

2. How good cryptographic profiles can we obtain using this method and using multiplefunctions on d variables throughout the recursion process?

Remark 19. Thus, in summary, we start with a d variable good resilient function g,take its dual f and then recursively amplify to obtain fu on du variable. Then we obtaingu = fu ⊕ Ldu which is the final highly recursive function.

We can also have an algebraic degree-resiliency tradeoff. Algebraic degree is the maximumsize of the monomials in the ANF of a function (the maximum number of variables in aproduct term). Higher algebraic degree is needed to protect a system against algebraic degreeattack, where as high resiliency protects the system against correlation attack, two of themost powerful attacks in cryptanalysis of ciphers. In this construction we can also controlwhether the resultant function should be fully sensitive (using Theorem 13) or should it havelower sensitivity value and this does not affect the possible resiliency and algebraic degreevalues.

C.1 Superlinear Separation Between n and pdeg(f) For Constant OrderSensitivity

First we observe how high can sensitivity order be for a function with less than n polynomialdegree. It is easy to see that if a function is n-th order sensitive then its real polynomialdegree is also n. This is because a function can be n-th order sensitive if for a point a ∈ Fn

2 ,f(a) = 0 and f(x) = 1, ∀x ∈ Fn

2 \ a. Then such a function will have an odd number ofones in its truth table and thus will have pdeg(f) = n.

The first separation between n and polynomial degree can be found for (n − 1)-th ordersensitivity when n is odd, and for (n − 2)-th order, otherwise.

Lemma 20. The maximum value of k such that there exists a k-th order sensitive functionwith polynomial degree less than n is n − 1, where n is odd, and n − 2, otherwise.

Proof. We prove this result via the resiliency idea. The dual of an (n, k, n − 1)-function isan [n, k, 0]-function, which is a balanced k-th order dual sensitive function.

Let g be an (n − 1)-th order dual sensitive function with respect to a point y ∈ Fn2 .

Without loss of generality we assume that f(y) = 0. Then, corresponding to all the pointsthat can be obtained by flipping an odd number of bits, the output is 0, and 1, otherwise,where the maximum number bits that can be flipped is n − 1. That is, g(y) can be bothzero or one, which does not affect the sensitivity order, and the output corresponding to allother 2n − 1 points is fixed.

Case n odd: The minimum number of points x for which f(x) must be zero is

1 +(

n

1

)+(

n

3

)+ · · · +

(n

n − 2

)= 2n−1.

We can then fix f(y) = 1 and the other 2n−1 − 1 points have output 1, by definition,which gives us an (n − 1)-th order dual sensitive 0-resilient function whose dual f = g ⊕ Ln

is then an (n, n − 1, n − 1)-function.Case n even: Here, the minimum number of points x for which f(x) = 0 is

1 +(

n

1

)+(

n

3

)+ · · · +

(n

n − 1

)= 2n−1 + 1


and thus the corresponding function cannot be balanced.On the other hand if we try to form an (n − 2)-th order dual sensitive function, then

the restriction reduces by(

nn−1)

and becomes 2n−1 − n + 1. Meanwhile, the restriction onthe minimum number of points with f(x) = 1 remains the same and then the remainingn − 1 points can be fixed accordingly to make the function balanced, which gives us an[n, n − 2, 0]-function whose dual is an (n, n − 2, n − 1)-function.

Then our result of super-linear separation between n and pdeg() follows from our modifiedrecursive amplification construction.

Theorem 21. Given any constant k there exists a k-th order sensitive function f on n

variables such that pdeg(f) = nlog k

log k+1 , if k is even and pdeg(f) = nlog k+1log k+2 , if k is odd.

Proof. Given any k, we form a function f in the following manner:If k is even we form a (k + 2)-variable balanced k-th order dual sensitive function g whichis a [k + 2, k, 0]-function as per Lemma 20. Then we take its dual f = g ⊕ Ln, which is a(k + 2, k, k + 1)-function.If k is odd we form a (k+1)-variable balanced k-th order dual sensitive function g which isa [k + 1, k, 0]-function. Then we take its dual f = g ⊕ Ln, which is a (k + 1, k, k)-function,via Lemma 20.

Next we use the recursive amplification process described in Theorem 13. This gives a((k + 2)u

, k, (k + 1)u)-function, when k is even and a ((k + 1)u, k, ku)-function, otherwise,

which gives us the desired super-linear advantage.

D Results in Section 4

D.1 Sufficient Conditions for s(f) = n

Lemma 22. Let us denote by MMn the set of MM type functions with the followingconditions.1. ϕ(1n1) = 1n2 and g(1n1) = 0.2. wt

(ϕ(1i

n1))

≡ 1 mod 2 and g(1in1

) ≡ n2 mod 2.Then for any function f ∈ MMn we have s(f) = n.

Proof. It suffices to show that s(f, 1n) = n. By definition we have ϕ(1n1) = 1n2 . Thus forany input of the form 1n1 ||y we have f(1n1 ||y) =

⊕n2i=1 yi. Then if yi = 1, for all i, we get

f(1n1 ||1n2) = n2 mod 2. Corresponding to this point, if any one of the components in y isflipped, then the function evaluates to n2 + 1 mod 2.

If any of the points (say xi : 1 ≤ i ≤ n1) in x is flipped then the output of thefunction is f(1i

n1||1n2). Since the number of variables of the linear functions is odd and

g(1in1

) ≡ n2 mod 2 we have f(1in1

||1n2) = n2 + 1 mod 2.

D.2 An MM function with s(f) = n and pdeg(f) ≤ n − 1Let us first denote some notations that we shall use in the proof. We denote by Xj

i themonomial

(∏jk=i xk

)and by Xi the monomial

(∏ik=1 xk

). We define the polynomial

Ln2 =∏n2

i=1(1 − 2yi). Then we can write L1n2 ,0 = 1−Ln22 and L1n2 ,1 = 1+Ln2

2 .


Theorem 23. Let f ∈ MMn be an MM function defined on n = n1 + n2 variablesso that n1 ≤ n2 ≤ n1 + 1 with n2 ≡ 0 mod 2. If f is defined using ϕ(1n1−200) = 1n2 ,g(x) =

∏n1−2i=1 xi(1 − xn−1)(1 − xn), the sensitivity of f is n and the polynomial degree is at

most n − 1.

Proof. First we have s(f) = n, which follows directly from the constraints described and thesubsequent proof of Lemma 22. As n2 is even, g(1n1 ||1n1) should be 0, which it is, as theonly point in x for which g(x||y) = 1 is 1n1−200.

We now show that pdeg(f) = n − 1. Apart from the constraints given, we have twomore constraints as f ∈ MMn, namely, wt(ϕ(1i

n1)) ≡ 1 mod 2, ϕ(1n1) = 1n2 . We have

defined the real polynomial p(x, y) that represents f in Proposition 9. The degree of thepolynomial is ≤ max(wt(ϕ))+n1. We know that p(x, y) =

∑a∈0,1n1 Pa(x)

(L(ϕ(a),g(a))(y)

)has monomials of degree n only in the terms Lb,c where wt(b) = n2, which is the case onlywhen b = 1n1−200 or 1n1 . Additionally g(1n1−200) = 1 and g(1n1) = 0. Therefore, we canwrite the polynomial as

p(x, y) = p′(x, y) + P(1n1−200)(x)Lϕ(1n1−200),g(1n1−200)(y) + P(1n1 )(x)Lϕ(1n1 ),g(1n1 )(y)

where p′(x, y) =∑

a∈Fn12 \ 1n1 ,1n1−200

Pa(x)(L(ϕ(a),g(a))(y)

).

Thus in this case pdeg(p′) = n − 1. Now, expanding p(x, y) we get

p(x, y) =

p′(x, y) +(

n1−2∏i=1

xi

)(1 − xn1−1)(1 − xn1)L(1n2 ,1)(y) +

(n1∏

i=1xi

)L(1n2 ,0)(y)

= p′(x, y) + Xn1−2(1 − xn1−1 − xn1 + xn1−1xn1)L(1n2 ,1)(y) + Xn1L(1n2 ,0)(y)

= p′(x, y) +(Xn1−2

1 − Xn1−21 xn1−1 − Xn1−2

1 xn1

)L(1n2 ,1)(y)

+ Xn1(

L(1n2 ,0)(y) + L(1n2 ,1)(y))

= p′(x, y) +(Xn1−2

1 − Xn1−21 xn1−1 − Xn1−2

1 xn1

)L(1n2 ,1)(y) + Xn1 .

In this case, the polynomial degree of the terms are:p′(x, y) has a degree of at most n − 1;(Xn1−2

1 − Xn1−21 xn1−1 − Xn1−2

1 xn1

)L(1n2 ,1)(y) has a degree of n − 1.

the degree of Xn1 is n1.

Thus, the polynomial degree of p(x, y) is at most n − 1 and the proof is complete.

In this case, any function in MMn with the added constraint that ϕ(1n1−100) = 1n2

and g(x) =(∏n1−2

i=1 xi

)(1 − xn1−1)(1 − xn) would have this property of s(f) = n and

pdeg(f) = n − 1. Except for 1n200 and 1n2 , all the points can have any linear function ofweight less than n2, with the only restriction being that n1 points in x should have oddweighted linear functions attached to them. This gives us a loose lower bound on the numberof functions that we can recover with this construction technique with the given property.We can in fact construct 2EXP(n) functions with such property, which we state next. Let usnow look at an example function.

We let n = 7 and n1 = 3, n2 = 4 and show the structure of the Boolean function. Observethat for the inputs 001, 011 and 110 in x the corresponding linear function contains only a


single variable and the linear function corresponding to 111 contains 4 variables, implyingthat f is in the class MM7. Additionally the linear function at 100 is the complement of thelinear function at 111, which satisfies the conditions of Theorem 23.

x The linear function on y000 y2 ⊕ y3

001 y1

010 y2

011 y1 ⊕ y2

100 y1 ⊕ y2 ⊕ y3 ⊕ y4 ⊕ 1101 y1 ⊕ y3

110 y3

111 y1 ⊕ y2 ⊕ y3 ⊕ y4

Table 1 A Boolean function f with D(f) = 7 and pdeg(f) = 6.

Corollary 24. For any n, there are at least Ω(

22n2)

MM type functions with D(f) = n

and pdeg(f) = n − 1.

Proof. By definition we have ⌈ n2 ⌉ ≤ n2⌈ n

2 ⌉ + 1. For simplicity, let us assume that n is even.Then each distinct mapping ϕ that satisfies the constraint of Theorem 23 will represent anMM type function with s(f) = n and pdeg(f) = n − 1. We have already defined ϕ at thepoints 1n1−200 and 1n1 . Let us consider the mapping where ϕ(1i

n1) = 0i

n2. That is, the

function attached corresponding to the i-th critical point (1 ≤ i ≤ n) is yi and since n2 > n1,this is feasible. Therefore, corresponding to the other 2 n

2 − 2 − n2 points in x we can put

any of the 2 n2 linear functions defined on y, and each such function would have the desired

property.

Thus, the number of such functions will be(2 n

2 − 2 − n2)2

n2 , which we denote by C(n, n−

1). Then for n > 6 we have

C(n, n − 1) >(2 n

2 −1)2n2

= Ω(

22n2)

.

D.3 Logarithmic separation Between n and pdeg(f) with s(f) = n

We finally design a method of constructing an MM type function in MMn that has polynomialdegree of n − Θ(log n). Before proceeding to the proof, we derive some more results relatedto the structure of different polynomials and their interaction upon addition. In the lastsubsection we observed how given an MM type function f , where ϕ and g are defined to bezero in many points, say all points of the form 1k10k2t ∈ Fn1

2 then adding a polynomial termof the form

(∏k1i=1 xi

∏k2j=k1+1(1 − xj)

)Lb,c(y) transforms it to another MM type function

f ′ whose map ϕ′ and sub-function on g′ differs from f only for the points 1k100k2t ∈ Fn12 .

With these observations in mind we analyze a function f1 ∈ MMn such that its polynomialsatisfies the constraint of Theorem 23 and then further add some constraints so as to be ableto make modifications as discussed in Proposition 11. We define the corresponding map ϕ1


and sub-function g1 in the lines of Theorem 23:

ϕ1(x) =

1n2 if x = 1n1 or x = 1n1−2000i

n2if x = 0i

n1

0 otherwise,

g1(x) =(

n1−2∏i=1

xi

)(1 − xn1−1)(1 − xn1). (5)

This definition differs from the function in Theorem 23 in that the map ϕ1 is defined as 0 inall but n1 + 2 positions. However it satisfies all the constraints of Theorem 23. This meansthat the real polynomial corresponding to f0 can be expressed as

p1(x, y) = p′1(x, y) +

(Xn1−2

1 − Xn1−21 xn1−1 − Xn1−2

1 xn1

)L(1n2 ,1)(y) + Xn1

= p′1(x, y) +

(Xn1−2

1 − Xn1−21 xn1−1 − Xn1−2

1 xn1

) 1 + Ln2

2 + Xn1 ,

where p′1(x, y) defined in the same manner as p′ in Theorem 23. Consider the term

−Xn1−21 xn1−1

1+Ln22 which has a degree of n − 1. If we add the polynomial Xn1−4

1 (1 −xn1−3)(1 − xn1−2)xn1−1

1−Ln22 to this term we get

Xn1−41 (1 − xn1−3 − xn1−2 + xn1−3xn1−2)xn1−1

1 − Ln2

2 − Xn1−21 xn1−1

1 + Ln2

2

= Xn1−41 xn1−1 − Xn1−4

1 xn1−3xn1−11 − Ln2

2 − Xn1−41 xn1−2xn1−1

1 − Ln2

2

+ Xn1−21 xn1−1

1 − Ln2

2 − Xn1−11

1 + Ln2

2 + Xn1−11

1 − Ln2

2

=(Xn1−4

1 xn1−1 − Xn1−41 xn1−3xn1−1 − Xn1−4

1 xn1−2xn1−1) 1 − Ln2

2 + Xn1−11 .

This polynomial has degree n − 2, which reduces the degree of the polynomial by 1 andcreates 2 terms of the same type of degree n − 2 and one of degree n − 3. Similarly, if wecould modify the other degree n − 1 polynomial in the same way it would bring down theoverall degree of the real polynomial of the function to n − 2. This modification is centralto our construction method and we now generalize it, starting with defining two genericpolynomial structures:1. p(i, s) = (

∏ij=1 xj)(1 − xi+1)(1 − xi+2)(

∏j=si

xj), s ⊂ [n] \ [i + 2],2. p(i, u) = (

∏ij=1 xj)(

∏j=ui

xj), u ⊂ [n] \ [i].From these definitions we get the following two relations.

pdeg(p(i, u)) = pdeg(p(i − 2, u)) = i + |u|, (6)

p(i, u) = p(i − k, uk) where uk = u ∪ i, i − 1, . . . i − k + 1. (7)

Then corresponding to any p(i, u) 1+Ln22 , we have

p(i, u)1 + Ln2

2 + p(i − 2, u)1 − Ln2

2 (8)

=p(i − 2, u)1 + Ln2

2 − p(i − 2, u)xi−11 + Ln2

2 − p(i − 2, u)xi1 + Ln2

2 + p(i, u)

=p(i − 2, u)1 + Ln2

2 − p(i − 2, u1)1 + Ln2

2 − p(i − 2, u2)1 + Ln2

2 + p(i, u),


where |u1| = |u2| = |u + 1|. Then this addition of the polynomial p(i − 2, u) 1−Ln22 reduces

the degree of the polynomial by 1 and forms two similar terms of degree 1 less, one term ofdegree 2 less, and one term that is only defined on x and therefore has degree less than n1.Next we note another property of p before proceeding with the final proof.

Lemma 25. Corresponding to the polynomial p1 of an MM function f1 where ϕ1 is nonzeroin only the points 1n1 , 1n1−2, 0i

n1such that f1 ∈ MMn (s(f, 1n) = n) then adding of any

arbitrary number of polynomial terms p(i, u)( 1±Ln22 ) to p1 transforms it to another MM

Boolean function in MMn, provided that for any two added polynomial terms p(i1, u1) andp(i2, u2) we have |i1 − i2| ≥ 2 and i < n1 − 2, ∀ p(i, u).

Proof. Consider any two p(i1, u1) and p(i2, u2) with i1 ≤ i2 − 2. Then, from Equation (2)we have that adding p(i1, u1)( 1±Ln2

2 ) and p(i2, u2)( 1±Ln22 ) to a polynomial corresponding

to an MM function only works (the resultant function is still in MMn) if ϕ(x) = 0 for all xsuch that p(i1, u1)(x) = 1 or p(i2, u2)(x) = 1 and moreover p(i1, u1) and p(i1, u2) should notboth return 1 for any input x.

The first condition is true as any polynomial of the type p(i, u) can only return 1 if bothxi+1 and xi+2 are set to 0. This cannot happen for any critical point as their weight isminimum n1 − 1. And since we have defined i < n1 − 2 none of these polynomials can return1 for the point 1n1−200.

Also for any two polynomials p1 = p(i1, u1) and p2 = p(i2, u2) with i1 ≤ i2 − 2 theycannot both be 1 for any input a ∈ Fn1

2 for the simple reason that for p1(x) to be 1, xi1

and xi1+1 should be set as 1 and for p2(x) to be 1 both xi1 and xi2 should be set to 0, bydefinition. This completes the proof.

Finally, we use the results and equations we have defined so far to develop a stepwiseconstruction technique to obtain a function with s(f) = n and pdeg(f) = n − Θ(log n).

Theorem 26. There exists a Boolean function f ∈ MMn with pdeg(f) = n − Θ(log n).

Proof. We define the function f1 as in Equation (5) and the corresponding polynomial isp1 = p′

1(x, y) +(Xn1−2

1 − Xn1−21 xn1−1 − Xn1−2

1 xn1

)( 1+Ln2

2 ) + Xn11 where deg(p′) = n1 + 1.

We start with f1 and recursively reduce the polynomial degree by adding polynomials ofthe form p(i, u) where i starts with n1 − 3 and decreases by 2 with every new polynomialthat we add. The terms Xn1−2

1 ( 1+Ln22 ), Xn1−2

1 xn1( 1+Ln22 ) and Xn1−2

1 xn1−1( 1+Ln22 ) can all

be expressed as polynomials p(i, ui)(1±Ln2

2 ) for some ui. Here i = n1 − 2. We also know fromEquation (6) that any such polynomial can also be represented as some p(i − k, uk

i )( 1±Ln22 ).

Then corresponding to the term (−1)cp(i − k, uki )( 1+(−1)dLn2

2 ) we add the polynomialp(i − k − 2, uk

i )( 1+(−1)c+d+1Ln22 ) and this results in at most 3 new polynomial terms of the

form p(i − k − 1, uki

′) of degree at least one less (specifically one polynomial of degree 2less and two polynomials of degree 1 less). For each new polynomial we add, if the lastpolynomial that we added was p(i, u)( 1±Ln2

2 ), then the next polynomial is p(i−2, u′)( 1±Ln22 ),

where u and u′ depend on the lower degree polynomials that form. Therefore for any definedn1 we can at most add ⌊ n1−2

2 ⌋ polynomials. This polynomial term addition is valid and themodified function is still in MMn as we have shown in Lemma 25.

At the first step we have 3 such polynomial terms to which we add a p polynomial. Then,at the i-th step, if we have 3i polynomials of the form p of degree n − i. Corresponding toeach such, we add polynomials p(k, u) where n1 − 3i ≥ k ≥ n1 − 3i+1 for each polynomialp(k + 2, u), and this would form 3i+1 polynomials of degree at most n − (i + 1). Thisstep can at most be continued for z iterations, where

∑zi=1 2 × 3z ≤ n1 − 1, that is,


z ≤ log3(n1 − 1). If we fix n1 = n2 this gives us a function in MMn with polynomial degree

n − log3( n2 ) = n − Θ(log n).

It is easy to see that when we have not used some k bits of x as the zero bits in p, ourmodifications do not affect the map ϕ in the point with at least any two of those k-bits beingzero. This gives us the following corollary.

Corollary 27. There are Ω(

22k)

functions in MMn with polynomial degree n − log3( n2 ) +

log3(k) that we can recover using the construction method of Theorem 26.

E Super-constant sensitivity with MM functions

E.1 Proof of Lemma 12Proof. We have symk

m(0m) = 0 by definition. Now it suffices to see for any input pointb ∈ Fm

2 that can be obtained by flipping i ≤ k bits of 0m returns true for an odd number ofmonomials of symk

m, in which case we will have symkm(b) = 1. This can be verified as follows.

Any input point obtained by flipping i points in 0m has exactly i variables set as oneand the rest as zero. These i values will return 1 for i monomials of degree 1,

(i2)

monomialsof degree 2, and so on. Thus the total number of monomials for which it will return 1 is∑i

j=1(

ij

)= 2i − 1, which is odd for all values of i > 0. This completes the proof.

E.2 Proofs of Constructions 2 and 3 Lemma 28. Any function f : Fn1+n2

2 → F2 with the algebraic normal form f(x, y) =⊕a∈Fn1

2

(aca(x) · ga(y)) , where g1n1= symk

n2and ga = 1 for all a ∈ Fn1

2 : n1 > wt(a) ≥ n1 − k

is k-th order sensitive.

Proof. We show that the function is k-th order sensitive in the point (a, b) = (1n1 , 0n2).We have f(1n1 , 0n2) = symk

n2(0n2) = 0. Now, we consider any input that can be obtained by

flipping at most k bits of (1n1 , 0n2). There can be two cases.All bits are flipped in y: In this case the input point is of the form (x′, y′) =

(1n1 , [0n2 ]k) for which the output is of the form f(x′, y′) = symkn2

([0n2 ]k) which is 1 fromLemma 12.

At least one bit is flipped in x: Any such point is of the form (x′, y′) =([1n1 ]k , [0n2 ]k−1

).

Then the output of the function is of the form f(x′, y′) = g[1n1 ]k

(y) = 1.

This shows that the output of the function is flipped if any 1 ≤ i ≤ k of the input bitsare flipped at the point (1n1 , 0n2).

Finally we extend the technique of Section D.3 to obtain non-constant separation betweennumber of variables and real polynomial degree in functions with super-constant order ofsensitivity.

Theorem 29. There exists a k-th order sensitive function in MMkn with n − log( n

2 −k)−log k

k

real polynomial degree.

Proof. We construct the corresponding function analogous to the result for first order ordersensitive functions defined in Theorem 26.


We start with partial description of an MM type function f : Fn1+n22 → F2 with

nonlinear functions in Fn22 attached to the points in Fn1

2 . As we have discussed, thisfunction can be written as f(x, y) =

⊕a∈Fn1

2(aca(x) · ga(y)), where ga : Fn2

2 → F2, ∀a,

and the corresponding real polynomial is written as p(x, y) =∑

a∈Fn12

Pa(x)ga(y) where

ga(y) : Fn22 → R is the real polynomial corresponding to ga(y).

The function f has ga defined for all points with wt(a) ≥ n−k, which consists of∑k

i=0(

ki

)points, with g1n2

= symnk. Let us denote by sym

nk (y) the corresponding real polynomial.

Then the real polynomial corresponding to symnk is 1 − sym

nk (y).

From this point our construction is analogous to that of Theorem 26. In case of firstorder sensitivity, the polynomial terms we added to reduce the degree was of the form(∏j1

i=1(xi)(1 − xj1+1)(1 − xj1+2)∏

j∈S xj

)g(y), where g(y) ∈ 1+Ln2

2 ,1−Ln2

2 and S ⊆[n1] − [j1 + 2] so that high degree polynomial terms cancel out.

In case of k-th order sensitive function, any new polynomial term that we add will be ofform

T (j, S) =

j∏i1=1

(xi1)j+1+k∏i2=j+1

(1 − xi2)∏

i3∈S

xi3

g(y),

where g(y) ∈ symnk (y), 1 − sym

nk (y) and S ⊆ [n1] − [j + k + 1].

Let us suppose the total degree of the constructed polynomials at some point is n′. Ifwe add a term of the form T (j, S) that cancels out a polynomial term of degree n′, then itcreates

(k

i−1)

terms of degree n′ − i where 0 < i < k. Moreover with a new polynomial termthat is added, the value of j reduces by k and as we know j ≥ 0. Then we have the followinglower bound on how much can we reduce the polynomial degree of the function dependingon the value of k.

Let us assume the polynomial degree of the function is n − p. To reduce the polynomialdegree by p we have to cancel (2k − 1)p terms, and adding such a term will reduce the valueof j by k. Let us assume that n1 = n

2 . Then we have

k · (2k − 1)p = n

2 − k =⇒ log(k) + p log(2k − 1) = log(n

2 − k)

=⇒ log(k) + pk ≥ log(n

2 − k)

=⇒ p ≥log(

n2 − k

)− log(k)

k.

Thus, even if we have k = o(log n) we get a non-constant separation between number ofvariables n and the real polynomial degree n − p.

on boolean functions with low polynomial degree and higher

Documents