SETH-Based Lower Bounds for Subset Sum and Bicriteria Path∗

Amir Abboud† Karl Bringmann‡ Danny Hermelin§ Dvir Shabtay¶

Abstract 1 Introduction Subset Sum and k-SAT are two of the most extensively The field of fine-grained complexity is anchored around studied problems in computer science, and conjectures about their hardness are among the cornerstones of fine-grained certain hypotheses about the exact time complexity of a complexity. An important open problem in this area is to small set of core problems. Due to dozens of reductions, base the hardness of one of these problems on the other. we now know that the current algorithms for many Our main result is a tight reduction from k-SAT important problems are optimal unless breakthrough to Subset Sum on dense instances, proving that Bellman’s 1962 pseudo-polynomial O∗(T )-time algorithm for Subset algorithms for the core problems exist. A central Sum on n numbers and target T cannot be improved to time challenge in this field is to understand the connections T 1−ε · 2o(n) for any ε > 0, unless the Strong Exponential and relative difficulties among these core problems. In Time Hypothesis (SETH) fails. As a corollary, we prove a “Direct-OR” theorem for this work, we discover a new connection between two Subset Sum under SETH, offering a new tool for proving core problems: a tight reduction from k-SAT to Subset conditional lower bounds: It is now possible to assume that Sum. deciding whether one out of N given instances of Subset In the first part of the introduction we discuss Sum is a YES instance requires time (NT )1−o(1). As an application of this corollary, we prove a tight SETH-based this new reduction and how it affects the landscape lower bound for the classical Bicriteria s, t-Path prob- of fine-grained complexity. Then, in Section 1.2, we lem, which is extensively studied in Operations Research. highlight a corollary of this reduction which gives a We separate its complexity from that of Subset Sum: On graphs with m edges and edge lengths bounded by L, we new tool for proving conditional lower bounds. As show that the O(Lm) pseudo-polynomial time algorithm by an application, in Section 1.3, we prove the first tight Joksch from 1966 cannot be improved to O˜(L + m), in con- bounds for the classical Bicriteria s, t-Path problem trast to a recent improvement for Subset Sum (Bringmann, from Operations Research. SODA 2017). Subset Sum. Subset Sum is one of the most fundamental problems in computer science. Its most basic form is the following: given n integers x1, . . . , xn ∈ N, and a target value T ∈ N, decide whether there is a subset of the numbers that sums to T . The two most classical algorithms for the problem are the pseudo- polynomial O(T n) algorithm using dynamic programming [28], and the O(2n/2 ·poly(n, log T )) algorithm via “meet-in-the-middle” [67]. A central open question in Exact Algorithms [114] is whether faster algorithms exist, e.g., can we combine the two approaches to get a ∗We would like to thank Jesper Nederlof for an inspiring T 1/2 · nO(1) time algorithm? Such a bound was recently discussion on Subset Sum. A.A. was supported by the grants found in a Merlin-Arthur setting [94]. of Virginia Vassilevska Williams: NSF Grants CCF-1417238, CCF-1528078 and CCF-1514339, and BSF Grant BSF:2012338. Open Question 1. Is Subset Sum in time T 1−ε · D.H. has received funding from the People Programme (Marie o(n) (1−ε) n o(1) 2 or 2 2 · T , for some ε > 0? Curie Actions) of the European Union’s Seventh Framework Pro- gramme (FP7/2007-2013) under REA grant agreement number The status of Subset Sum as a major problem has 631163.11, and by the ISRAEL SCIENCE FOUNDATION (grant been established due to many applications, deep con- No. 551145/). † nections to other fields, and educational value. The IBM Almaden Research Center O(T n) algorithm from 1957 is an illuminating example ‡Max Planck Institute for Informatics, Saarland Informatics Downloaded 10/14/20 to 24.61.9.56. Redistribution subject SIAM license or copyright; see https://epubs.siam.org/page/terms of dynamic programming that is taught in most under- Campus, Germany. graduate algorithms courses, and the NP-hardness proof § Department of Industrial Engineering and Management, Ben- (from Karp’s original paper [78]) is a prominent example Gurion University, Israel of a reduction to a problem on numbers. Interestingly, ¶Department of Industrial Engineering and Management, Ben- one of the earliest cryptosystems by Merkle and Hell- Gurion University, Israel

Copyright © 2019 by SIAM 41 Unauthorized reproduction of this article is prohibited man was based on Subset Sum [92], and was later ex- [73], and is known to be impossible with popular tended to a host of Knapsack-type cryptosystems1 (see techniques like resolution [25]. [106, 31, 97, 46, 69] and the references therein). A seminal paper of Cygan, Dell, Lokshtanov, Marx, The version of Subset Sum where we ask for k Nederlof, Okamoto, Paturi, Saurabh, and Wahlström numbers that sum to zero (the k-SUM problem) is con- [48] strives to classify the exact complexity of important jectured to have ndk/2e±o(1) time complexity. Most fa- NP-hard problems under SETH. The authors design a mously, the k = 3 case is the 3-SUM conjecture high- large collection of ingenious reductions and conclude lighted in the seminal work of Gajentaan and Over- that 2(1−ε)n algorithms for problems like Hitting Set, mars [57]. It has been shown that this problem lies at Set Splitting, and Not-All-Equal SAT are impossible the core and captures the difficulty of dozens of prob- under SETH. Notably, Subset Sum is not in this list lems in computational geometry. Searching in Google nor any problem for which the known algorithms are Scholar for “3sum-hard” reveals more than 250 papers non-trivial (e.g., require dynamic programming). As (see [80] for a highly partial list). More recently, these the authors point out: “Of course, we would also like to conjectures have become even more prominent as core show tight connections between SETH and the optimal problems in fine-grained complexity since their interest- growth rates of problems that do have non-trivial exact ing consequences have expanded beyond geometry into algorithms.” purely combinatorial problems [102, 113, 38, 72, 12, 6, Since the work of Cygan et al. [48], SETH has 83, 7, 62, 72]. Note that k-SUM inherits its hardness enjoyed great success as a basis for lower bounds in from Subset Sum, by a simple reduction: to answer Parameterized Complexity [87] and for problems within Open Question 1 positively it is enough to solve k-SUM P [112]. Some of the most fundamental problems in T 1−ε · no(k) or nk/2−ε · T o(1) time. on strings (e.g., [9, 17, 2, 35, 18, 34]), graphs (e.g., Entire books [91, 79] are dedicated to the algorith- [86, 104, 6, 58]), curves (e.g., [32]), vectors [110, 111, mic approaches that have been used to attack Subset 19, 29] and trees [1] have been shown to be SETH- Sum throughout many decades, and, quite astonish- hard: a small improvement to the running time of these ingly, major algorithmic advances are still being dis- problems would refute SETH. Despite the remarkable covered in our days, e.g., [88, 68, 26, 51, 14, 108, 77, 61, quantity and diversity of these results, we are yet to 44, 15, 16, 85, 56, 22, 94, 82, 33], not to mention the see a (tight) reduction from SAT to any problem like recent developments on generalized versions (see [24]) Subset Sum, where the complexity comes from the and other computational models (see [107, 41]). At hardness of analyzing a search space defined by addition STOC’17 an algorithm was presented that beats the of numbers. In fact, all hardness results for problems of trivial 2n bound while using polynomial space, under a more number theoretic or additive combinatoric flavor certain assumptions on access to random bits [22]. At are based on the conjectured hardness of Subset Sum SODA’17 we have seen the first improvements (beyond itself. log factors [100]) over the O(T n) algorithm, reducing the bound to O˜(T +n) [82, 33]. And a few years earlier, In this paper, we address an important open ques- a surprising result celebrated by cryptographers [68, 26] tions in the field of fine-grained complexity: Can we showed that 20.499 algorithms are possible on random prove a tight SETH-based lower bound for Subset instances. All this progress leads to the feeling that a Sum? positive resolution to Open Question 1 might be just The standard NP-hardness proofs imply loose lower around the corner. bounds under SETH (in fact, under the weaker ETH) SETH. k-SAT is an equally fundamental problem √ stating that 2o( n) algorithms are impossible. A (if not more) but of a Boolean rather than additive stronger but still loose result rules out 2o(n) · T o(1)- nature, where we are given a k-CNF formula on n time algorithms for Subset Sum under ETH [75, 37]. variables and m clauses, and the task is to decide Before that, Patrascu and Williams [98] showed that whether it is satisfiable. All known algorithms have if we solve k-SUM in no(k) · T o(1) time, then ETH is a running time of the form O(2(1−c/k)n) for some false. These results leave the possibility of O(T 0.001) constant c > 0 [99, 49, 8], and the Strong Exponential algorithms. While it is open whether such algorithms Time Hypothesis (SETH) of Impagliazzo and Paturi (1−ε)n imply new SAT algorithms, it has been shown that they Downloaded 10/14/20 to 24.61.9.56. Redistribution subject SIAM license or copyright; see https://epubs.siam.org/page/terms [70, 71, 39] states that no O(2 ) time algorithms would imply new algorithms for other famous problems. are possible for k-SAT, for some ε > 0 independent of k. Bringmann [33] recently observed that a an O(T 0.78) al- Refuting SETH implies advances in circuit complexity gorithm for Subset Sum implies a new algorithm for k- Clique, via a reduction of Abboud, Lewi, and Williams 1Cryptographers usually refer to Subset Sum as Knapsack. [5]. Cygan et al. [48] ruled out O(T 1−εpoly(n)) algo-

Copyright © 2019 by SIAM 42 Unauthorized reproduction of this article is prohibited rithms for Subset Sum under the conjecture that the instances to bypass the easyness of random inputs. This Set Cover problem on m sets over a universe of size n leads us to a candidate distribution of hard instances for cannot be solved in O(2(1−ε)n · poly(m)) time. Whether Subset Sum, which could be of independent interest: this conjecture can be replaced by the more popular Start from hard instances of SAT (e.g., random formulas SETH remains a major open question. around the threshold) and map them with our reduction (the obtained distribution over numbers will be highly 1.1 Main Result We would like to show that SETH structured). implies a negative resolution to Open Question 1. Our Recently, it was shown that the security of certain main result accomplishes half of this statement, showing cryptographic primitives can be based on SETH [20, 21]. a tight reduction from SAT to Subset Sum on instances We hope that our SETH-hardness for an already popu- where T = 2δn, also known as dense instances2, ruling lar problem in cryptography will lead to further interac- out T 1−ε · 2o(n) time algorithms under SETH. tion between fine-grained complexity and cryptography. In particular, it would be exciting if our hard instances Theorem 1.1. Assuming SETH, for any ε > 0 there could be used for a new Knapsack-type cryptosystem. exists a δ > 0 such that Subset Sum is not in time Such schemes tend to be much more computationally 1−ε δn 1−ε δk O(T 2 ), and k-Sum is not in time O(T n ). efficient than popular schemes like RSA [31, 97, 69], but almost all known ones are not secure (as famously Thus, Subset Sum is yet another SETH-hard prob- shown by Shamir [106]). Even more recently, Bennett, lem. This is certainly a major addition to this list. This Golovnev, and Stephens-Davidowitz [29] proved SETH also adds many other problems that have reductions hardness for another central problem from cryptogra- from Subset Sum, e.g., the famous Knapsack problem, phy, the Closest-Vector-Problem (CVP). While CVP or from k-SUM (e.g., [54, 30, 4, 43, 81]). For some of is a harder problem than Subset Sum, their hardness these problems, to be discussed shortly, this even leads result addresses a different regime of parameters, and to better lower bounds. rules out O(2(1−ε)n) time algorithms (when the dimen- Getting a reduction that also rules out 2(1−ε)n/2 · sion is large). It would be exciting to combine the two T o(1) algorithms under SETH is still a fascinating open techniques and get a completely tight lower bound for question. Notably, the strongest possible reduction, CVP. ruling out ndk/2e−ε · T o(1) algorithms for k-SUM, is provably impossible under the Nondeterministic SETH 1.2 A Direct-OR Theorem for Subset Sum of Carmosino et al. [42], but there is no barrier for an Some readers might find the above result unnecessary: nk/2−o(1) lower bound. What is the value in a SETH-based lower bound if we al- A substantial technical barrier that we had to ready believe the Set Cover Conjecture of Cygan et al.? overcome when designing our reduction is the fact that The rest of this introduction discusses new lower bound there was no clear understanding of what the hard results that, to our knowledge, would not have been instances of Subset Sum should look like. Significant possible without our new SETH-based lower bound. To effort has been put into finding and characterizing the clarify what we mean, consider the following “Direct- instances of Subset Sum and Knapsack that are hard OR” version of Subset Sum: Given N different and to solve. This is challenging both from an experimental independent instances of Subset Sum, each on n num- viewpoint (see the study of Pisinger [101]) and from bers and each with a different target T ≤ T , decide the worst-case analysis perspective (see the discussion i whether any of them is a YES instance. It is natural of Austrin et al. [16]). Recent breakthroughs refute to expect the time complexity of this problem to be the common belief that random instances are maximally (NT )1−o(1), but how do we formally argue that this is hard [68, 26], and show that better upper bounds are the case? If we could assume that this holds, it would possible for various classes of inputs. Our reduction be a very useful tool for conditional lower bounds (as is able to generate hard instances by crucially relying we show in Section 1.3). on a deep result on the combinatorics of numbers: Many problems, like SAT, have a simple self- the existence of dense average-free sets. A surprising reduction proving that the “Direct-OR” version is hard, construction of these sets from 1946 due to Behrend [27] assuming the problem itself is hard: To solve a SAT in- (see also [52, 96]) has already lead to breakthroughs in x Downloaded 10/14/20 to 24.61.9.56. Redistribution subject SIAM license or copyright; see https://epubs.siam.org/page/terms stance on n variables, it is enough to solve 2 instances various areas of theoretical computer science [45, 47, on n−x variables. This is typically the case for problems 10, 65, 50, 3]. These are among the most non-random- where the best known algorithm is essentially matched like structures in combinatorics, and therefore allow our with a brute force algorithm. But what about Subset Sum or Set Cover? Can we use an algorithm that solves 2The density of an instance is the ratio n . log2 max xi

Copyright © 2019 by SIAM 43 Unauthorized reproduction of this article is prohibited N instances of Subset Sum in O(N 0.1 ·T ) time to solve was improved last year to O˜(T + n), it is natural to Subset Sum in O(T 1−ε) time? We cannot prove such wonder if the similar O(Lm) algorithm for Bicriteria statements; however, we can prove that such algorithms s, t-Path from 1966 can also be improved to O˜(L + m) would refute SETH. or even just to O(Lm0.99). Such an improvement would be very interesting since the pseudo-polynomial algorithm is commonly used in practice, and since it would Corollary 1.1. Assuming SETH, for any ε > 0 and γ > 0 there exists a δ > 0 such that no algorithm can speed up the running time of the approximation algorithms. We prove that s, t is in fact solve the OR of N given instances of Subset Sum on Bicriteria -Path γ a harder problem than Subset Sum, and an improved target values T1,...,TN = O(N ) and at most δ log N numbers each, in total time O(N 1+γ−ε). algorithm would refute SETH. The main application of Corollary 1.1 that we report in this paper is a tight 1.3 The Fine-Grained Complexity of Bicriteria SETH-based lower bound for Bicriteria s, t-Path, which (conditionally) separates the time complexity of Path The Bicriteria s, t-Path problem is the natural s, t and . bicriteria variant of the classical s, t-Path problem Bicriteria -Path Subset Sum where edges have two types of weights and we seek an Theorem 1.2. Assuming SETH, for any ε > 0 and s, t-path which meets given demands on both criteria. γ > 0 no algorithm solves Bicriteria s, t-Path on More precisely, we are given a directed graph G where sparse n-vertex graphs and budgets L, C = Θ(nγ ) in each edge e ∈ E(G) is assigned a pair of non-negative time O(n1+γ−ε). integers `(e) and c(e), respectively denoting the length and cost of e, and two non-negative integers L and Intuitively, our reduction shows how a single instance of C representing our budgets. The goal is to determine Bicriteria s, t-Path can simulate multiple instances of Subset Sum and solve the “Direct-OR” version of whether there is an s, t-path e1, . . . , ek in G, between a given source and a target vertex s, t ∈ V (G), such that it. Our second application of Corollary 1.1 concerns Pk `(e ) ≤ L and Pk c(e ) ≤ C. i=1 i i=1 i the number of different edge-lengths and/or edge-costs This natural variant of s, t-Path has been exten- in our given input graph. Let λ denote the former sively studied in the literature, by various research com- parameter, and χ denote the latter. Note that λ and χ munities, and has many diverse applications in several are different from L and C, and each can be quite small areas. Most notable of these are perhaps the applica- in comparison to the size of the entire input. In fact, tions in the area of transportation networks [60], and in many of the scheduling applications for Bicriteria the quality of service (QoS) routing problem studied in s, t-Path discussed above it is natural to assume that the context of communication networks [89, 115]. There one of these is quite small. We present a SETH-based are also several applications for Bicriteria s, t-Path lower bound that almost matches the O(nmin{λ,χ}+2) in Operations Research domains, in particular in the upper bound for the problem. area of scheduling [36, 84, 93, 105], and in column generation techniques [66, 116]. Additional applications can Theorem 1.3. Bicriteria s, t-Path can be solved in be found in road traffic management, navigation sys- O(nmin{λ,χ}+2) time. Moreover, assuming SETH, for tems, freight transportation, supply chain management any constants λ, χ ≥ 2 and ε > 0, there is no and pipeline distribution systems [60]. O(nmin{λ,χ}−1−ε) time algorithm for the problem. A simple reduction proves that Bicriteria s, t- Finally, we consider the case where we are search- Path is at least as hard as Subset Sum (see Garey ing for a path that uses only k internal vertices. This and Johnson [59]). In 1966, Joksch [76] presented a dy- parameter is naturally small in comparison to the total namic programming algorithm with pseudo-polynomial input length in several applications of Bicriteria s, t- running time O(Lm) (or O(Cm)) on graphs with m Path, for example the packet routing application dis- edges. Extensions of this classical algorithm appeared in cussed above. We show that this problem is equivalent abundance since then, see e.g., [13, 63, 103] and the var- to the k-Sum problem, up to logarithmic factors. For ious FPTASs for the optimization variant of the prob- this, we consider an intermediate exact variant of Bi- lem [53, 60, 64, 90, 109]. The reader is referred to the criteria s, t-Path, the Zero-Weight-k-Path prob- survey by Garroppo et al. [60] for further results on Bi- Downloaded 10/14/20 to 24.61.9.56. Redistribution subject SIAM license or copyright; see https://epubs.siam.org/page/terms lem, and utilize the known bounds for this variant to criteria s, t-Path. obtain the first improvement over the O(nk)-time brute- Our SETH-based lower bound for Subset Sum eas- force algorithm, as well as a matching lower bound. ily transfers to show that a O(L1−ε2o(n)) time algorithm for Bicriteria s, t-Path refutes SETH. However, af- Theorem 1.4. Bicriteria s, t-Path can be solved in ter the O(T n) algorithm for Subset Sum from 1960 O˜(nd(k+1)/2e) time. Moreover, for any ε > 0, there is no

Copyright © 2019 by SIAM 44 Unauthorized reproduction of this article is prohibited O˜(nd(k+1)/2e−ε)-time algorithm for the problem, unless Conjecture 2.2. k-Sum cannot be solved in time k-Sum has an O˜(ndk/2e−ε)-time algorithm. O˜(ndk/2e−ε) for any ε > 0 and k ≥ 3.

2 Preliminaries 3 From SAT to Subset Sum For a fixed integer p, we let [p] denote the set of integers In this section we present our main result, the hard- {1, . . . , p}. All graphs in this paper are, unless otherwise ness of Subset Sum and k-Sum under SETH. Our re- stated, simple, directed, and without self-loops. We use duction goes through three main steps: We start with standard graph theoretic notation, e.g., for a graph G a k-SAT formula φ that is the input to our reduc- we let V (G) and E(G) denote the set of vertices and tion. This formula is then reduced to subexponentially edges of G, respectively. Throughout the paper, we use many Constraint Satisfaction Problems (CSP) with a the O∗(·) and O˜(·) notations to suppress polynomial and restricted structure. The main technical part is then logarithmic factors. to reduce these CSP instances to equivalent Subset Hardness Assumptions: The Exponential Time Sum instances. The last part of our construction, re- Hypothesis (ETH) and its strong variant (SETH) are ducing Subset Sum to k-Sum, is rather standard. In conjectures about running time of any algorithm for the final part of the section we provide a proof for Corol- the k-SAT problem: Given a boolean CNF formula lary 1.1, showing that Subset Sum admits the “Direct- φ, where each clause has at most k literals, determine OR” property discussed in Section 1.2. whether φ has a satisfying assignment. Let sk = inf{δ : k-SAT can be solved in O∗(2δn) time}. The 3.1 From k-SAT to Structured CSP We first Exponential Time Hypothesis, as stated by Impagliazzo, present a reduction from k-SAT to certain structured Paturi and Zane [71], is the conjecture that s3 > 0. instances of Constraint Satisfaction Problems (CSP). It is known that s3 > 0 if and only if there is a This is a standard combination of the Sparsification k ≥ 3 such that sk > 0 [71], and that if ETH is Lemma with well-known tricks. ∞ true, the sequence {sk}k=1 increases infinitely often [70]. The Strong Exponential Time Hypothesis, coined by Lemma 3.1. Given a k-SAT instance φ on n variables and m clauses, for any ε > 0 and a ≥ 1 we can Impagliazzo and Paturi [40, 70], is the conjecture that εn compute in time poly(n)2 CSP instances ψ1, . . . , ψ`, limk→∞ sk = 1. In our terms, this can be stated in the εn following more convenient manner: with ` ≤ 2 , such that φ is satisfiable if and only if some ψi is satisfiable. Each ψi has nˆ = dn/ae variables Conjecture 2.1. For any ε > 0 there exists k ≥ 3 over universe [2a] and mˆ = dn/ae constraints. Each such that k-SAT on n variables cannot be solved in time variable is contained in at most cˆk,ε · a constraints, and (1−ε)n O(2 ). each constraint contains at most cˆk,ε · a variables, for some constant cˆ depending only on k and ε. We use the following standard tool by Impagliazzo, k,ε Paturi and Zane: Proof. Let φ be an instance of k-SAT with n variables and m clauses. We start by invoking the Sparsification Lemma 2.1. (Sparsification Lemma [71]) For any Lemma (Lemma 2.1). This yields k instances ε > 0 and k ≥ 3, there exists c > 0 and an algo- -SAT k,ε φ , . . . , φ with ` ≤ 2εn such that φ is satisfiable if and rithm that, given a k-SAT instance φ on n variables, 1 ` only if some φ is satisfiable, and where each φ has n computes k-SAT instances φ , . . . , φ with ` ≤ 2εn such i i 1 ` variables, and each variable in φ appears in at most that φ is satisfiable if and only if at least one φ is satis- i i c clauses of φ , for some constant c . In particular, fiable. Moreover, each φ has n variables, each variable k,ε i k,ε i the number of clauses is at most c n. in φ appears in at most c clauses, and the algorithm k,ε i k,ε We combine multiple variables to a super-variable runs in time poly(n)2εn. and multiple clauses to a super-constraint, which yields The k-SUM Problem: In k-SUM we are given a certain structured CSP. Specifically, let a ≥ 1, and sets Z1,...,Zk of non-negative integers and a tar- partition the variables into dn/ae blocks of length a. We get T , and we want to decide whether there are z1 ∈ replace each block of a variables by one super-variable a Z1, . . . , zk ∈ Zk such that z1 + ... + zk = T . This over universe [2 ]. Similarly, we partition the clauses dk/2e problem can be solved in time O(n ) [67], and it is into dn/ae blocks, each containing γ := ack,ε clauses. Downloaded 10/14/20 to 24.61.9.56. Redistribution subject SIAM license or copyright; see https://epubs.siam.org/page/terms somewhat standard by now to assume that this is es- We replace each block of γ clauses C1,...,Cγ by one sentially the best possible [4]. This assumption, which super-constraint C that depends on all super-variables generalizes the more popular assumption of the k = 3 containing variables appearing in C1,...,Cγ . case [57, 102], remains believable despite recent algo- Clearly, the resulting CSP ψi is equivalent to φi. rithmic progress [14, 23, 44, 77, 108]. Since each variable appears in at most ck,ε clauses in φi,

Copyright © 2019 by SIAM 45 Unauthorized reproduction of this article is prohibited and we combine a variables to obtain a variable of ψi, Run Lemma 3.1 to obtain CSP instances ψ1, . . . , ψ` εn each variable appears in ψi in at most ack,ε constraints. with ` ≤ 2 , each withn ˆ = dn/ae variables over a Similarly, each clause in φi contains at most k variables, universe [2 ] andm ˆ =n ˆ constraints, such that each and each super-constraint consists of γ = ack,ε clauses, variable is contained in at most λ constraints and each so each super-constraint contains at mostc ˆk,εa variables constraint contains at most λ variables. Fix a CSP forc ˆk,ε = kck,ε. This finishes the proof. ψ = ψi. We create an instance (Z,T ) of Subset Sum, i.e., a set Z of positive integers and a target value T . We 3.2 From Structured CSP to Subset Sum Next define these integers by describing blocks of their bits, we reduce to Subset Sum. Specifically, we show the from highest to lowest. (The items in Z are naturally following. partitioned, as for each variable x of ψ there will be Ok,ε(1) items of type x, and for each clause C of ψ there For any ε > 0, given a k instance Theorem 3.1. -SAT will be Ok,ε(1) items of type C.) εn φ on n variables we can in time poly(n)2 construct We first ensure that any correct solution picks εn 2 instances of Subset Sum on at most c˜k,εn items exactly one item of each type. To this end, we start (1+2ε)n and a target value bounded by 2 such that φ is with a block of O(logn ˆ) bits where each item has value satisfiable iff at least one of the Subset Sum instances 1, and the target value isn ˆ +m ˆ , which ensures that we is a YES-instance. Here c˜k,ε is a constant depending pick exactlyn ˆ +m ˆ items. This is followed by O(logn ˆ) only on k and ε. many 0-bits to avoid overflow from the lower bits (we will have O (ˆn) items overall). In the followingn ˆ +m ˆ As discussed in Section 1.1, our reduction crucially k,ε bits, each position is associated to one type, and each relies on a construction of average-free sets. For any item of that type has a 1 at this position and 0s at all k ≥ 2, a set S of integers is k-average-free iff for all 0 other positions. The target T has all these bits set to k ≤ k and (not necessarily distinct) x1, . . . , xk0+1 ∈ S 0 1. Together, these O(logn ˆ) +n ˆ +m ˆ bits ensure that with x +...+x 0 = k ·x 0 we have x = ... = x 0 . 1 k k +1 1 k +1 we pick exactly one item of each type. We again add A surprising construction by Behrend [27] has been O(logn ˆ) many 0-bits to avoid overflow from the lower slightly adapted in [5], showing the following. bits. Lemma 3.2. There exists a universal constant c > 0 The remainingn ˆ blocks of bits correspond to the such that, given ε ∈ (0, 1), k ≥ 2, and n ≥ 1, a k- variables of ψ. For each variable we have a block average-free set S of size n with S ⊂ [0, kc/εn1+ε] can consisting of dlog(2λB + 1)e = log B + log λ + O(1) bits. be constructed in poly(n) time. The target number T has bits forming the number λB in each block of each variable. While it seems natural to use this lemma when Now we describe the items of type x, where x is a working with an additive problem like Subset Sum, variable. For each assignment α ∈ [2a] of x, there is we are only aware of very few uses of this result in an item z(x, α) of type x. In the block corresponding conditional lower bounds [5, 55, 74]. One example is to variable x, the bits of z(x, α) form the number 2 a reduction from k-Clique to k -SUM on numbers in λB − d(x) · f(α), where d(x) is the number of clauses k+o(1) n [5]. Our result can be viewed as a significant containing x. In all blocks corresponding to other boosting of this reduction, where we exploit the power variables, the bits of z(x, α) are 0. of Subset Sum further. Morally, k-Clique is like MAX- Next we describe the items of type C, where C is 2-SAT, since faster algorithms for k-Clique imply faster a constraint. Let x1, . . . , xs be the variables that are algorithms for MAX-2-SAT [110]. We show that even a contained in C. For any assignment α1, . . . , αs ∈ [2 ] of MAX-d-SAT, for any d, can be reduced to k-SUM, x1, . . . , xs that satisfies the clause C, there is an item which corresponds to a reduction from Clique on hyper- z(C, α1, . . . , αs) of type C. In the block corresponding graphs to k-SUM. to variable xi the bits of z(C, α1, . . . , αs) form the number f(α ), for any 1 ≤ i ≤ s. In all blocks Proof. [of Theorem 3.1] We let a ≥ 1 be a sufficiently i corresponding to other variables, the bits are 0. large constant depending only on k and ε. We need Example: Suppose a = 1 andc ˆk,ε = 2, and a λ-average-free set, with λ :=c ˆk,εa, wherec ˆk,ε is consider a CSP with variables x1, x2, x3 over the uni- the constant from Lemma 3.1. Lemma 3.2 yields a Downloaded 10/14/20 to 24.61.9.56. Redistribution subject SIAM license or copyright; see https://epubs.siam.org/page/terms verse [2 ] = {1, 2}, and constraints C = (x = x ), a λ-average-free set S of size 2a consisting of non- 1 1 2 C = (x 6= x ), and C = (x = 1 ⇒ x = 1). negative integers bounded by B := λc/ε(2a)1+ε, for 2 2 3 3 1 3 Note that λ = 2. We construct the 2-average-free set some constant c depending only on ε. We let f : [2a] → S = {1, 2}; in particular, we may set B = 2, and use S be any injective function. Note that since a and B the injective mapping f : [2a] → S defined by f(x) = x. are constants constructing f takes constant time.

Copyright © 2019 by SIAM 46 Unauthorized reproduction of this article is prohibited The following items correspond to the CSP variables Note that the length of blocks corresponding to (the |-symbols mark block boundaries and have no other variables is set so that there are no carries between meaning): blocks, which is necessary for the above argument. Indeed, the degree d(x) of any variable x is at most λ, z(x1, 1) = 1|000|100000|000|0010|0000|0000| so the clauses containing x can contribute at most λ · B to its block, while the item of type x also contributes z(x1, 2) = 1|000|100000|000|0000|0000|0000| 0 ≤ λB − d(x) · f(α) ≤ λB, which gives a number in z(x2, 1) = 1|000|010000|000|0000|0010|0000| [0, 2λB]. Size Bounds: Let us count the number of bits in z(x , 2) = 1|000|010000|000|0000|0000|0000| 2 the constructed numbers. We have O(logn ˆ) +n ˆ +m ˆ

z(x3, 1) = 1|000|001000|000|0000|0000|0010| bits from the ﬁrst part ensuring that we pick one item of each type, andn ˆ · (log B + log λ + O(1)) bits from z(x3, 2) = 1|000|001000|000|0000|0000|0000| the second part ensuring to pick coherent and satisfying c/ε a 1+ε And the following items correspond to the constraints: assignments. Plugging in B = λ (2 ) and λ = cˆk,εa and usingn ˆ =m ˆ = dn/ae yields a total number z(C1, 1, 1) = 1|000|000100|000|0001|0001|0000| of bits of

z(C1, 2, 2) = 1|000|000100|000|0010|0010|0000| log T = O(logn ˆ) +n ˆ +m ˆ +n ˆ · (log B + log λ + O(1))

z(C2, 1, 2) = 1|000|000010|000|0000|0001|0010| = (1 + ε)n + Ok,ε(n log(a)/a),

z(C2, 2, 1) = 1|000|000010|000|0000|0010|0001| where the hidden constant depends only on k and ε. Since log(a)/a tends to 0 for a → ∞, we can choose z(C3, 1, 1) = 1|000|000001|000|0001|0000|0001| a sufficiently large, depending on k and ε, to obtain z(C3, 2, 1) = 1|000|000001|000|0010|0000|0001| log T ≤ (1 + ε)n + εn ≤ (1 + 2ε)n. Let us also count the number of constructed items. z(C3, 2, 2) = 1|000|000001|000|0010|0000|0010| We have one item for each variable x and each assign- a a a We set the target to ment α ∈ [2 ], amounting to 2 nˆ ≤ 2 n items. More- over, we have one item for each clause C and all assign- a T = 110|000|111111|000|0100|0100|0100|. ments α1, . . . , αs ∈ [2 ] that jointly satisfy the clause C, where s ≤ λ is the number of variables contained in C. 2 One can readily verify that T sums up to z(x1, 2) + This amounts to up to 2aλmˆ ≤ 2aλn ≤ 2cˆk,εa n items. z(x2, 2) + z(x2, 1) + z(C1, 2, 2) + z(C2, 2, 1) + z(C3, 2, 1), Note that both factors only depend on k and ε, since a and that no other subset sums up to T . That is, the only depends on k and ε. Thus, the number of items is subsets summing to T are in one-to-one correspondence bounded byc ˜k,εn, wherec ˜k,ε only depends on k and ε. to the satisfying assignments of the CSP. In total, we obtain a reduction that maps an Correctness: Recall that the first O(logn ˆ)+ˆn+m ˆ instance φ of k-SAT on n variables to 2εn instances of bits ensure that we pick exactly one item of each type. Subset Sum with target at most 2(1+2ε)n on at most Consider any variable x and the corresponding block of c˜k,εn items. The running time of the reduction is clearly bits. The item of type x picks an assignment α, resulting poly(n)2εn. in the number λB −d(x)·f(α), where d(x) is the degree of x. The d(x) constraints containing x pick assignments Our main result (Theorem 1.1) now follows. α1, . . . , αd(x) and contribute f(α1) + ... + f(αd(x)). Hence, the total contribution in the block is Proof. [of Theorem 1.1] Subset Sum: For any ε > 0 set ε0 := ε/5 and let k be sufficiently large so that k- f(α1) + ... + f(αd(x)) − d(x) · f(α) + λB, 0 SAT has no O(2(1−ε )n) algorithm; this exists assuming 0 where d(x) ≤ λ. Since f maps to a λ-average-free set, SETH. Set δ := ε /c˜k,ε0 , wherec ˜k,ε0 is the constant we can only obtain the target λB if f(α1) = ... = from Theorem 3.1. Now assume that Subset Sum 1−ε δn f(αd(x)) = f(α). Since f is injective, this shows that can be solved in time O(T 2 ). We show that this Downloaded 10/14/20 to 24.61.9.56. Redistribution subject SIAM license or copyright; see https://epubs.siam.org/page/terms any correct solution picks a coherent assignment α for contradicts SETH. Let φ be a k-SAT instance on n 0 variable x. Finally, this coherent choice of assignments variables, and run Theorem 3.1 with ε0 to obtain 2ε n for all variables satisfies all clauses, since clause items Subset Sum instances on at mostc ˜k,ε0 n items and 0 only exist for assignments satisfying the clause. Hence, target at most 2(1+2ε )n. Using the assumed O(T 1−ε2δn) we obtain an equivalent Subset Sum instance. algorithm on each Subset Sum instance, yields a total

Copyright © 2019 by SIAM 47 Unauthorized reproduction of this article is prohibited time for k-SAT of instances of Subset Sum on target at most N γ , each 0 0 0 1−ε having at mostc ˜k,ε0 n2 ≤ c˜k,ε0 n items. ε n ε n (1+2ε )n δ·c˜k,ε0 n poly(n)2 + 2 · 2 2 Using the assumed algorithm, the OR of these 0 0 0 0 0 = 2(ε +(1+2ε )(1−5ε )+ε )n ≤ 2(1−ε )n, instances can be solved in total time O(N (1+γ)(1−ε)). n Since (1 + γ)n1 = (1 + γ)d e ≤ n + 1 + γ = n + O(1) 0 1+γ where we used the definitions of ε and δ as well as and (1 + ε/2)(1 − ε) ≤ 1 − ε/2, this running time is (1+2ε0)(1−5ε0) ≤ 1−3ε0. This running time contradicts SETH, yielding the lower bound for Subset Sum. (1+γ)(1−ε) ON (1+γ)(1−ε) = O2(1+ε/2)n1 k-SUM: The lower bound O(T 1−εnδk) for k-Sum (1−ε/2)n now follows easily from the lower bound for Subset = O 2 , Sum. Consider a Subset Sum instance (Z,T ) on |Z| = n items and target T . Partition Z into sets which contradicts SETH. Specifically, for some k = k(ε) this running time is less than the time required for k- Z1,...,Zk of of equal size, up to ±1. For each set SAT. Setting δ :=c ˜k,ε0 finishes the proof. Zi, enumerate all subset sums Si of Zi, ignoring the subsets summing to larger than T . Consider the k- 4 The Bicriteria s, t-Path Problem Sum instance (S1,...,Sk,T ), where the task is to pick items si ∈ Si with s1 + ... + sk = T . Since |Si| ≤ In this section we apply the results of the previous sec- O(2n/k), an O(T 1−εnδk) time algorithm for k-Sum now tion to the Bicriteria s, t-Path problem. We will implies an O(T 1−ε2δn) algorithm for Subset Sum, thus show that the Bicriteria s, t-Path problem is in fact contradicting SETH. harder than Subset Sum, by proving that the classical pseudo-polynomial time algorithm for the problem 3.3 Direct-OR Theorem for Subset Sum We cannot be improved on sparse graphs assuming SETH. now provide a proof for Corollary 1.1. We show that de- We also prove Theorem 1.3 concerning a bounded num- ciding whether at least one of N given instances of Sub- ber of different edge-lengths λ and edge-costs χ in the set Sum is a YES-instance requires time (NT )1−o(1), input network, and Theorem 1.4 concerning a bounded where T is a common upper bound on the target. Here number k of internal vertices in a solution path. we crucially use our reduction from k-SAT to Subset Sum, since the former has an easy self-reduction allow- 4.1 Sparse networks We begin with the case of ing us to tightly reduce one instance to multiple subin- sparse networks; i.e. input graphs on n vertices and stances, while such a self-reduction is not known for O(n) edges. We embed multiple instances of Subset Subset Sum. Sum into one instance of Bicriteria s, t-Path to prove Theorem 1.2, namely that there is no algorithm for Proof. [of Corollary 1.1] Let ε > 0 and γ > 0, we will fix Bicriteria s, t-Path on sparse graphs faster than the δ > 0 later. Assume that the OR of N given instances well-known O(min{nL, nC})-time algorithm. γ of Subset Sum on target values T1,...,TN = O(N ) and at most δ log N numbers each, can be solved in total Proof. [of Theorem 1.2] We show that for any ε > (1+γ)(1−ε) time O(N ). We will show that SETH fails. 0, γ > 0, an algorithm solving Bicriteria s, t-Path Let φ be an instance of k-SAT on n variables. Split on sparse n-vertex graphs and budgets L, C = Θ(nγ ) the set of variables into X1 and X2 of size n1 and n2, in time O(n(1+γ)(1−ε)) contradicts SETH. As in Corol- such that n2 = γ · n1 up to rounding. Specifically, we lary 1.1, let (Z1,T1),..., (ZN ,TN ) be instances of Sub- n γn γ can set n1 := d 1+γ e and n2 := b 1+γ c and thus have set Sum on targets Ti ≤ N and number of items n2 ≤ γn1. Enumerate all assignments of the variables in |Zi| ≤ δ log N for all i. Without loss of generality, X1. For each such assignment α let φα be the resulting we can assume that all sets Zi have the same size k-SAT instance after applying the partial assignment α. k = δ log N (e.g., by making Zi a multiset containing For each φα, run the reduction from Theorem 3.1 0 the number 0 multiple times). 0 ε n2 with ε = min{1/2, 1/γ}· ε/2, resulting in at most 2 Fix an instance (Zi,Ti) and let Zi = {z1, . . . , zk}. instances of Subset Sum on at mostc ˜k,ε0 n2 items and We construct a graph Gi with vertices s, v1, . . . , vk, t. 0 (1+2ε )n2 target at most 2 . In total, we obtain at most Writing v0 := s for simplicity, for each j ∈ [k] we 0 n1+ε n2 2 instances of Subset Sum, and φ is satisfiable add an edge from vj−1 to vj with length zj and cost Downloaded 10/14/20 to 24.61.9.56. Redistribution subject SIAM license or copyright; see https://epubs.siam.org/page/terms γ 3 iff at least one of these Subset Sum instances is a YES- N − zj, and we add another edge from vj−1 to vj instance. Set N := 2(1+ε/2)n1 and note that the number with length 0 and cost N γ . Finally, we add an edge 0 0 of instances is at most 2n1+ε n2 ≤ 2(1+γε )n1 ≤ N, (1+2ε0)n and that the target bound is at most 2 2 ≤ 3Note that parallel edges can be avoided by subdividing all 0 2(1+2ε )γn1 ≤ N γ . Thus, we constructed at most N constructed edges.

Copyright © 2019 by SIAM 48 Unauthorized reproduction of this article is prohibited γ from vk to t with length N − Ti and cost Ti. Then the compute a table T [v, i1, . . . , iλ], where v ∈ V (G) and set of s, t-paths corresponds to the power set of Zi, and i1, . . . , iλ ∈ {0, . . . , n}, which stores the minimum the s, t-path corresponding to Y ⊆ Zi has total length cost of any s, v-path that has exactly ij edges of γ P γ P ˜ N − Ti + y∈Y y and cost kN + Ti − y∈Y y. Hence, length `j, for each j ∈ {1, . . . , λ}. For the base setting the upper bound on the length to L = N γ and case of our computation, we set T [s, 0,..., 0] = 0 and γ on the cost to C = kN , there is an s, t-path respecting T [s, i1, . . . , iλ] = ∞ for entries with some ij 6= 0. these bounds iff there is a subset Y of Zi summing to The remaining entries are computed via the following Ti, i.e., iff (Zi,Ti) is a YES-instance. recursion: We combine the graphs G1,...,GN into one graph G by identifying all source vertices s, identifying all T [v, i1, . . . , iλ] = target vertices t, and then taking the disjoint union min min T [u, i1, . . . , ij − 1, . . . , iλ] + c((u, v)). of the remainder. With the common length bound 1≤j≤λ (u,v)∈E(G), ˜ L = N γ and cost bound C = kN γ , there is an s, t- `((u,v))=`j . path respecting these bounds in G iff some instance It is easy to see that the above recursion is correct, (Zi,Ti) is a YES-instance. Furthermore, note that G since if e , . . . , e is an optimal s, v-path corresponding has n = Θ(N log N) vertices, is sparse, and can be con- 1 k to an entry T [v, i1, . . . , iλ] in T , with ek = (u, v) and structed in time O(N log N). Hence, an O(n(1+γ)(1−ε)) ˜ `(ek) = `j for some j ∈ {1, . . . , λ}, then e1, . . . , ek−1 time algorithm for Bicriteria s, t-Path would imply is an optimal s, u-path corresponding to the entry an O(N (1+γ)(1−ε)polylogN) = O(N (1+γ)(1−ε/2)) time T [u, i1, . . . , ij − 1, . . . , iλ]. Thus, after computing table algorithm for deciding whether at least one of N Sub- T , we can determine whether there is a feasible s, t-path set Sum instances is a YES-instance, a contradiction in G by checking whether there is an entry T [t, i , . . . , i ] to SETH by Corollary 1.1. 1 λ with Pλ i · `˜ ≤ L and T [t, i , . . . , i ] ≤ C. As there Finally, let us ensure that L, C = Θ(nγ ). Note that j=1 j j 1 λ λ+1 the budgets L and C are both bounded by O(N γ log N). are O(n ) entries in T in total, and each entry can be If γ ≥ 1, then add a supersource s0 and one edge computed in O(n) time, the entire algorithm requires λ+2 from s0 to s with length and cost equal to N γ logγ N, O(n ) time. and add N γ logγ N to L and C. This results in We now turn to proving the lower-bound given an equivalent instance, and the new bounds L, C are in Theorem 1.3. The starting point is our lower Θ(N γ logγ N) = Θ(nγ ). If γ < 1, then do the same bound for k ruling out O(T 1−εnδk) algorithms where the length and cost from s0 to s is N γ log N, and -Sum (Theorem 1.1). We present a reduction from k to then add N log1/γ N dummy vertices to the graph to -Sum s, t , where the resulting graph in the increase n to Θ(N log1/γ N). Again we obtain budgets Bicriteria -Path Bicriteria s, t-Path instance has few different edge- L, C = Θ(N γ log N) = Θ((N log1/γ N)γ ) = Θ(nγ ). In lengths and edge-costs. both cases, the same running time analysis as in the Let (Z ,...,Z ,T ) be an instance of k-Sum with last paragraph goes through. This completes the proof 1 k Z ⊂ [0,T ] and |Z | ≤ n for all i, and we want to of Theorem 1.2. i i decide whether there are z1 ∈ Z1, . . . , zk ∈ Zk with z + ... + z = T . We begin by constructing an acyclic 4.2 Few different edge-lengths or edge-costs 1 k multigraph G∗, using similar ideas to those used for We next consider the parameters λ (the number of proving Theorem 1.2. The multigraph G∗ has k + 1 different edge-lengths) and χ (the number of different vertices s = v , . . . , v = t, and is constructed as follows: edge-costs). We show that Bicriteria s, t-Path can 0 k For each i ∈ {1, . . . , k}, we add at most n edges from be solved in O(nmin{λ,χ}+2) time, while its unlikely to v to v , one for each element in Z . The length of an be solvable in O(nmin{λ,χ}−1−ε) for any ε > 0, providing i−1 i i edge e ∈ E(G∗) corresponding to element z ∈ Z is set a complete proof for Theorem 1.3. The upper bound of i i to `(e) = z , and its cost is set to c(e) = T − z . this theorem is quite easy, and is given in the following i i lemma. ∗ Lemma 4.2. (Z1,...,Zk,T ) has a solution iff G has Lemma 4.1. Bicriteria s, t-Path can be solved in an s, t-path of length at most L = T and cost at most min{λ,χ}+2 C = T (k − 1).

Downloaded 10/14/20 to 24.61.9.56. Redistribution subject SIAM license or copyright; see https://epubs.siam.org/page/terms O(n ) time.

λ+2 Proof. It suﬃces to give an O(n ) time algorithm, Proof. Suppose there are z1 ∈ Z1, . . . , zk ∈ Zk that χ+2 ∗ as the case of time O(n ) is symmetric, and a sum to T . Consider the s, t-path e1, . . . , ek in G , combination of these two algorithms yields the claim. where ei is the edge from vi−1 to vi corresponding ˜ ˜ Pk Pk Let `1,..., `λ be all diﬀerent edge-length values. We to zi. Then i=1 `(ei) = i=1 zi = T = L, and

Copyright © 2019 by SIAM 49 Unauthorized reproduction of this article is prohibited Pk Pk ˜ i=1 c(ei) = i=1 T − zi = kT − T = C. Conversely, (G, s, t, L, C). For δ := δ(ε/τ) from Theorem 1.1 and k ∗ 1−ε/τ δ(ε/τ)k any s, t-path in G has k edges e1, . . . , ek, where ei is set to τ/δ, this running time is O(T n ) and an edge from vi−1 to vi. If such a path is feasible, thus contradicts SETH by Theorem 1.1. Pk Pk meaning that i=1 `(ei) ≤ L = T and i=1 c(ei) ≤ C = T (k − 1), then these two inequalities must be tight 4.3 Solution paths with few vertices In this sec- because c(ei) = T − `(ei) for each i ∈ [k]. This implies tion we investigate the complexity of Bicriteria s, t- that the integers z1, . . . , zk corresponding to the edges Path with respect to the number of internal vertices k ∗ e1, . . . , ek of G , sum to T . in a solution path. Assuming k is fixed and bounded, we obtain a tight classification of the time complexity Let τ ≥ 1 be any constant and let B := dT 1/τ e. for the problem, up to sub-polynomial factors, under We next convert G∗ into a graph G˜ which has τ + 1 Conjecture 2.2. different edge-lengths and τ + 1 different edge-costs, Our starting point is the Exact k-Path problem: both taken from the set {0,B0,B1,...,Bτ−1}. Recall Given an integer T ∈ {0,...,W }, and a directed ∗ that V (G ) = {v0, . . . , vk}, and the length and cost of graph G with edge weights, decide whether there is a each edge in G∗ is non-negative and bounded by T . The simple path in G on k vertices in which the sum of vertex set of G˜ will include all vertices of G∗, as well as the weights is exactly T . Thus, this is the ”exact” additional vertices. variant of Bicriteria s, t-Path on graphs with a single For an edge e ∈ E(G∗), write its length as `(e) = edge criteria, and no source and target vertices. The Pτ−1 i Pτ−1 i ˜ d(k+1)/2e i=0 aiB , and its cost as c(e) = i=0 biB , for Exact k-Path problem can be solved in O(n ) integers a1, . . . , aτ−1, b1, . . . , bτ−1 ∈ {0,...,B − 1}. We time by a “meet-in-the-middle” algorithm [4], where replace the edge e of G∗ with a path in G˜ between the the O˜(·) notation suppresses poly-logarithmic factors Pτ−1 endpoints of e that has i=0 (ai + bi) internal vertices. in W . It is also known that Exact k-Path has no ˜ d(k+1)/2e−ε For each i ∈ {0, . . . , τ − 1}, we set ai edges in this path O(n ) time algorithm, for any ε > 0, unless i to have length B and cost 0, and bi edges to have length the k-Sum conjecture is false [4]. We will show how 0 and cost Bi. Replacing all edges of G∗ by paths in this to obtain similar bounds for Bicriteria s, t-Path by way, we obtain the graph G˜ which has O(nB) vertices implementing a very efficient reduction between the two and edges (since k and τ are constant). As any edge in problems. ∗ G between vi and vi+1 corresponds to a path between To show that Exact k-Path can be used to solve these two vertices in G˜ with the same length and cost, Bicriteria s, t-Path, we will combine multiple ideas. we have: The first is the observation that Exact k-Path can easily solve the Exact Bicriteria k-Path problem, a ∗ Lemma 4.3. Any s, t-path in G corresponds to an s, t- variant which involves bicriteria edge weights: Given path in G˜ with same length and cost, and vice-versa. a pair of integers (T1,T2), and a directed graph G with two edge weight function w1(·) and w2(·), decide Lemma 4.4. Assuming SETH, for any constant λ, χ ≥ whether there is a simple path in G on k vertices 2 there is no O(nmin{λ,χ}−1−ε) algorithm for Bicrite- in which the sum of the wi-weights is exactly Ti for ria s, t-Path for any ε > 0. i ∈ {1, 2}.

Proof. Suppose Bicriteria s, t-Path has a Lemma 4.5. There is an O(n2) time reduction that min{λ,χ}−1−ε O(n ) time algorithm. We use this reduces an instance of Exact Bicriteria k-Path with algorithm to obtain a fast algorithm for k-Sum, edge weights in {0, 1,...,W }2 to an instance of Exact contradicting SETH by Theorem 1.1. On a given k-Path with edge weights in {0, 1,..., 2kW 2 + W }. input (Z1,...,Zk,T ) of k-Sum on n items, for τ := min{λ, χ} − 1 we construct the instance Proof. Define a mapping of a pairs in {0, 1,...,W }2 (G,˜ s, t, L, C) described above. Then G˜ is a directed to single integers {0,..., 2kW 2 + W } by setting acyclic graph with τ + 1 = min{λ, χ} different f(w1, w2) = w2 +w1 ·2kW for each w1, w2 ∈ {0,...,W }. 0 1 τ−1 1 1 k k edge-lengths and edge-costs {0,B ,B ,...,B }. Observe that for any k pairs (w1, w2),..., (w1 , w2 ), Moreover, due to Lemmas 4.2 and 4.3, there are Pk i Pk i we have ( i=1 w1 = T1 ∧ i=1 w2 = T2) iff z1 ∈ Z1, . . . , zk ∈ Zk summing to T iff G˜ has a feasible Pk i i Downloaded 10/14/20 to 24.61.9.56. Redistribution subject SIAM license or copyright; see https://epubs.siam.org/page/terms i=1 f(w1, w2) = f(T1,T2). Therefore, given a graph s, t-path. Thus, we can use our assumed Bicriteria as in the statement, we can map each pair of edge ˜ s, t-Path algorithm on (G, s, t, L, C) to solve the given weights into a single edge weight, thus reducing to Ex- ˜ k-Sum instance. As G has O(nB) vertices and edges, act k-Path without changing the answer. where B = dT 1/τ e, an O(nmin{λ,χ}−1−ε) algorithm runs in time O((nB)τ−ε) = O(T 1−ε/τ nτ ) time on The next and more difficult step is to reduce Bicri-

Copyright © 2019 by SIAM 50 Unauthorized reproduction of this article is prohibited (i) teria s, t-Path to Exact Bicriteria k-Path. This First, we add the weight functions w1 = w1, with requires us to reduce the question of whether there is (i) target T1 = L−a for any a ∈ [4k]. Call these the initial a path of length and cost at most L and C, to ques- (i)’s. Then, for any x ∈ [log W ] and a ∈ [2k], we add the tions about the existence of paths with length and cost (i) weight function w (e) = [w1(e)]x, and set the target equalling exactly T and T . A naive approach would 1 1 2 to T (i) = [L] − k − a. This defines O(k log W ) new be to check if there is a path of exact length and cost 1 x functions and targets, and we will show below that for (T1,T2) for all values T1 ≤ L and T2 ≤ C. Such a reduc- any subset X ⊆ U we have that w1(X) ≤ L iff for some tion will incur a very large O(LC) overhead. We will (i) (i) improve this to O(logO(1) (L + C)). i we have w1 (X) = T1 . Then, we apply the same construction for w2, and take every pair of constructed In the remainder of this section, let W be the 2 2 maximum of L and C. The idea behind our reduction functions and targets, to obtain a set of O(k log W ) is to look for the smallest x, y ∈ [log W ] such that if functions and targets that satisfy the required property. we restrict all edge lengths ` to the x most significant The correctness will be based on the following bits of `, and all edge costs c to the y most significant bound, which follows because when summing k numbers bits of c, then there is a path that satisfies the threshold the carry from removed least significant bits cannot constraints with equality. To do this, we can check for be more than k. For any x ∈ [log W ], a1, . . . , ak ∈ every pair x, y, whether after restricting edge lengths {0,...,W }, and costs, there is a k-path with total weight exactly  k  k  k  equal to the restriction of the vector (L, C), possibly X X X a − k ≤ [a ] ≤ a minus the carry from the removed bits. Since the carry  j j x  j j=1 j=1 j=1 from summing k numbers can be at most k, we will x x not have to check more than O(k2) “targets” per pair Fix some X ⊂ U. For the first direction, assume x, y ∈ [log W ]. (i) (i) To implement this formally, we will need the fol- that for some i, w1 (X) = T1 . If it is one of the lowing technical lemma. The proof uses a bit scaling initial (i)’s, then we immediately have that w1(X) ≤ L. technique that is common in approximation algorithms. Otherwise, let X = {v1, . . . , vk}, then we get that Previously, tight reductions that use this technique were  k  k presented by Vassilevska and Williams [113] (in a very X X [w (X)] = w (v ) ≤ [w (v )] + k specific setting), and by Nederlof et al. [95] (who proved 1 x  1 j  1 j x j=1 j=1 a general statement). We will need a generalization of x (i) the result of [95] in which we introduce a parameter k, = w1 (X) + k and show that the overhead depends only on k and W , = T (i) + k ≤ [L] − 1 and does not depend on n. 1 x which implies that w (X) < L. Lemma 4.6. Let U be a universe of size n with two 1 For the other direction, assume that w1(X) < L. If weight functions w1, w2 : U → {0,...,W }, and let w1(X) ≥ L − 4k then for one of the initial (i)’s we will T1,T2 ∈ {0,...,W } be two integers. Then, there (i) (i) is a polynomial time algorithm that returns a set of have w1 (X) = w1(X) = L−a = T1 for some a ∈ [4k]. (i) (i) Otherwise, let x be the smallest integer in [log W ] for weight functions w1 , w2 : U → {0,...,W } and (i) (i) which [w1(X)]x ≤ [L]x − k. Because x is the smallest, integers T1 ,T2 ∈ {0,...,W }, for i ∈ [q] and q = we also know that [w (X)] ≥ [L] − 2k. Therefore, O(k2 log2 W ), such that: For every subset X ⊆ U of 1 x x

size |X| = k it holds that (w1(X) ≤ T1 ∧ w2(X) ≤ T2) k  k  iﬀ (w(i)(X) = T (i) ∧ w(i)(X) = T (i)) for some i ∈ [q]. (i) X X 1 1 2 2 w1 (X) = [w1(vj)]x ≤  w1(vj) ≤ [L]x − k j=1 j=1 Proof. We will assume that a number in {0,...,W } is x encoded in binary with log W bits in the standard way. and For numbers a ∈ {0,...,W } and x ∈ [log W ] we let k  k  [a]x be the x-bit number that is obtained by taking Downloaded 10/14/20 to 24.61.9.56. Redistribution subject SIAM license or copyright; see https://epubs.siam.org/page/terms (i) X X the x most signiﬁcant bits in a. Alternatively, [a]x = w1 (X) = [w1(vj)]x ≥  w1(vj) −k ≥ [L]x−3k. log W −x j=1 j=1 ba/2 c. In what follows, we will construct weight x functions and targets for each dimension independently and in a similar way. We will present the construction Therefore, for some a ∈ [2k], we will have that (i) (i) for the w1’s. w1 (X) = [L]x − k − a = T1 .

Copyright © 2019 by SIAM 51 Unauthorized reproduction of this article is prohibited We are now ready to present the main reduction cP , then by correctness of the color coding technique, of this section. Let (G, s, t, L, C) be a given instance there is some α ∈ [p] such that Gα contains P with of Bicriteria s, t-Path. Our reduction follows three (α) V (P )∩Vi = {vi} for each i ∈ [k]. Moreover, the total general steps that proceed as follows: weight of v1, . . . , vk in Gα is (`P , cP ). By Lemma 4.6, there is some β ∈ [q] for which the total weight of 1. Color coding: At the first step, we use the deran- (β) (β) domized version of the color coding technique [11] v1, . . . , vk in Gα,β is (T1 ,T2 ). Thus, P is a solution 0 (β) (β) to obtain p = O(lg n) partitions of the vertex set for (Gα,β,T1 ,T2 ). Conversely, by the same line of V (G) \{s, t} into k classes V (α),...,V (α), α ∈ [p0], arguments, any solution path for some Exact Bicri- 1 k (β) (β) with the following property: If there is a feasible teria k-Path instance (Gα,β,T1 ,T2 ) corresponds s, t-path P with k internal vertices in G, we are to a feasible s, t-path in G with k internal vertices. guaranteed that for at least one partition we will Thus, we have obtained a reduction from Bicrite- (α) ria s, t-Path to Exact Bicriteria k-Path. Com- have |V (P ) ∩ Vi | = 1 for each i ∈ [k]. By trying out all possible O(1) orderings of the classes in each bining this with reduction from Exact Bicriteria k- to k given in Lemma 4.5, we obtain partition, we can assume that if P = s, v1, . . . , vk, t, Path Exact -Path (α) the following. then V (P ) ∩ Vi = {vi} for each i ∈ [k]. Let p denote the total number of ordered Lemma 4.7. Fix k ≥ 1, and let (G, s, t, L, C) be an in- partitions. For each ordered partition α ∈ [p], stance of Bicriteria s, t-Path where G has n vertices. we remove all edges between vertices inside the Set W = max{L, C}. Then one can determine whether (α) same class, and all edges (u, v) where u ∈ Vi , (G, s, t, L, C) has a solution with k internal vertices by (α) 2 v ∈ Vj , and j 6= i + 1. We also remove all solving O(log n log W ) instances of Exact k-Path on edges from s to vertices not in V (α), and all edges graphs with O(n) vertices and edge weights bounded by 1 W 2. to t from vertices not in Vk. Let Gα denote the resulting graph, with α ∈ [p] for p = O(lg n). Corollary 4.1. There is an algorithm solving Bicri- teria s, t-Path in O˜(nd(k+1)/2e) time. 2. Removal of s and t: Next, we next remove s and t from each G . For every vertex v ∈ V (α), if v Proof. By Lemma 4.7, an instance of Bicriteria s, t- α 1 2 was connected with an edge from s of length ` Path can be reduced to O(log n log W ) instances of and cost c, then we remove this edge and add this Exact k-Path. Using the algorithm in [4], each length ` and cost c to all the edges outgoing from of these Exact k-Path instances can be solved in (α) O˜(nd(k+1)/2e) time. v. Similarly, we remove the edge from v ∈ Vk to t, and add its length and cost to all edges ingoing We next turn to proving our lower bound for to v. Finally, any vertex in V (α) that was not 1 Bicriteria s, t-Path. For this, we show a reduction in connected with an edge from s is removed from (α) the other direction, from Exact k-Path to Bicriteria the graph, and every vertex in Vk that was not s, t-Path. connected to t is removed. Lemma 4.8. Let ε > 0. There is no O˜(nd(k+1)/2e−ε) time algorithm for Bicriteria s, t-Path unless the k- 3. Inequality to equality reduction: Now, for each Gα, we apply Lemma 4.6 with the universe U being the Sum conjecture (Conjecture 2.2) is false. edges of G , and w , w : U → {0,...,W } being α 1 2 Proof. We show a reduction from Exact k-Path to the lengths and costs of the edges. We get a set of Bicriteria s, t-Path. This proves the claim, as it q = O(log2 W ) weight functions and targets. For is known that an O˜(nd(k+1)/2e−ε) time algorithm for β ∈ [q], let G be the graph obtained from G by α,β Exact k-Path, for any ε > 0, implies that the k- replacing the lengths and costs with new functions (β) (β) Sum conjecture is false [4]. Let (G, T ) be an instance of w1 , w2 . The final Exact Bicriteria k-Path (β) (β) Exact k-Path, where G is an edge-weighted graph and Downloaded 10/14/20 to 24.61.9.56. Redistribution subject SIAM license or copyright; see https://epubs.siam.org/page/terms is then constructed as (Gα,β,T1 ,T2 ). T ∈ {0,...,W } is the target. We proceed as follows: As Thus, we reduce our Bicriteria s, t-Path instance in the upper-bound reduction, we first apply the color- to at most O(log n log2 W ) instances of coding technique [11] to obtain p = O(log n) vertex- Exact Bicri- (α) teria k-Path. Note that if G contains a feasible s, t- partitioned graphs G1,...,Gp, V (Gα) = V1 ]···] (α) path P = s, v1, . . . , vk, t of length `P ≤ L and cost Vk for each α ∈ [p], such that G has a solution path

Copyright © 2019 by SIAM 52 Unauthorized reproduction of this article is prohibited P = v1, . . . , vk iff for at least one graph Gα we have [3] Amir Abboud and Greg Bodwin. The 4/3 additive (α) spanner exponent is tight. In Proc. of the 48th Annual V (P ) = Vi ∩ {vi} for each i ∈ [k]. ACM SIGACT Symposium on Theory of Computing We then construct a new graph Hα from each graph (STOC), pages 351–361, 2016. Gα as follows: We first remove from Gα all edges (α) [4] Amir Abboud and Kevin Lewi. Exact weight sub- inside the same vertex class Vi , and all edges between graphs and the k-Sum conjecture. In Proc. of the 40th (α) (α) vertices in Vi and vertices in Vj with j 6= i + 1. International Colloquium on Automata, Languages, We then replace each remaining edge with weight x ∈ and Programming (ICALP), pages 1–12, 2013. {0,...,W } in Gα with an edge with length x and cost [5] Amir Abboud, Kevin Lewi, and R. Ryan Williams. W − x in Hα. Then, we add vertices s, t to Hα, connect Losing weight by gaining edges. In Proc. of the 22th (α) annual European Symposium on Algorithms (ESA), s to all the vertices in V1 , connect all the vertices in (α) pages 1–12, 2014. Vk to t, and set the length and cost of all these edges [6] Amir Abboud and Virginia Vassilevska Williams. Pop- to 0. To complete the proof, we argue that G has a ular conjectures imply strong lower bounds for dynamic simple path of weight exactly T iff some Hα contains a problems. In Proc. of the 55th Annual IEEE Sym- feasible s, t-path for L = T and C = (k − 1)W − T . posium on Foundations of Computer Science (FOCS), Suppose P = v1, . . . , vk is a simple path in G with pages 434–443, 2014. w(P ) = T . Then there is some α ∈ [p] such that P is [7] Amir Abboud, Virginia Vassilevska Williams, and (α) Huacheng Yu. Matching triangles and basing hard- a path in Gα with V (P ) = Vi ∩ {vi} for each i ∈ [k]. 0 ness on an extremely popular conjecture. In Proc. of By construction of Hα, P = s, v1, . . . , vk, t is a path in 0 the 47th Annual ACM SIGACT Symposium on Theory Hα, and it has total length `(P ) = w(P ) = T ≤ L, and 0 of Computing (STOC), pages 41–50, 2015. total cost c(P ) = (k−1)W −w(P ) = (k−1)W −T ≤ C. [8] Amir Abboud, R. Ryan Williams, and Huacheng Yu. 0 Conversely, if P = s, v1, . . . , vk, t is a feasible s, t- More applications of the polynomial method to al- 0 path in some Hα with length `(P ) ≤ L and cost gorithm design. In Proc. of the 26th Annual ACM- 0 c(P ) ≤ C, then P = v1, . . . , vk is path in G. We SIAM Symposium on Discrete Algorithms (SODA), know that the weight of P in G is bounded by above pages 218–230, 2015. by w(P ) = `(P 0) ≤ L = T . Furthermore, we have [9] Amir Abboud, Virginia Vassilevska Williams, and (k − 1)W − w(P ) = (k − 1)W − `(P 0) = c(P 0) ≤ C = Oren Weimann. Consequences of faster alignment of (k − 1)W − T , implying that w(P ) ≥ T . These two sequences. In Proc. of the 41st International Col- inequalities imply w(P ) = T , and thus P is a solution loquium on Automata, Languages, and Programming (ICALP), pages 39–51, 2014. for (G, T ). [10] Noga Alon, Michael Krivelevich, Eldar Fischer, and Thus, we can solve (G, T ) by solving O(log n) Mario Szegedy. Efficient testing of large graphs. In instances of Bicriteria s, t-Path. This means that Proc. of the 40th Annual IEEE Symposium on Foun- ˜ d(k+1)/2e−ε an O(n ) algorithm for Bicriteria s, t-Path, dations of Computer Science (FOCS), pages 656–666, for ε > 0, would imply an algorithm with the same 1999. running time for Exact k-Path. By the reductions [11] Noga Alon, Raphael Yuster, and Uri Zwick. Color- in [4], this refutes the k-Sum conjecture. coding. Journal of the ACM, 42(4):844–856, 1995. [12] Amihood Amir, Timothy M. Chan, Moshe Lewenstein, Theorem 1.4 now immediately follows from the and Noa Lewenstein. On hardness of jumbled indexing. upper and lower bounds given in Corollary 4.1 and In Proc. of the 41st International Colloquium on Au- Lemma 4.8 for finding a solution for a Bicriteria s, t- tomata, Languages, and Programming (ICALP), pages Path instance that has k internal vertices. 114–125, 2014. [13] Yash P. Aneja and Kunhiraman P.K. Nair. The constrained shortest path problem. Naval Research References Logistics Quarterly, 25:549–553, 1978. [14] Per Austrin, Petteri Kaski, Mikko Koivisto, and Jussi [1] Amir Abboud, Arturs Backurs, Thomas Dueholm Määttä. Space–time tradeoffs for Subset Sum: An Hansen, Virginia Vassilevska Williams, and Or Za- improved worst case algorithm. In Proc. of the 40th mir. Subtree isomorphism revisited. In Proc. of the International Colloquium on Automata, Languages, 27th Annual ACM-SIAM Symposium on Discrete Al- and Programming (ICALP), pages 45–56, 2013. [15] Per Austrin, Petteri Kaski, Mikko Koivisto, and Jesper Downloaded 10/14/20 to 24.61.9.56. Redistribution subject SIAM license or copyright; see https://epubs.siam.org/page/terms gorithms (SODA), pages 1256–1271, 2016. [2] Amir Abboud, Arturs Backurs, and Virginia Vas- Nederlof. Subset Sum in the absence of concentration. silevska Williams. Tight hardness results for LCS and In Proc. of the 32nd International Symposium on other sequence similarity measures. In Proc. of the 56th Theoretical Aspects of Computer Science (STACS), Annual IEEE Symposium on Foundations of Computer pages 48–61, 2015. Science (FOCS), pages 59–78, 2015. [16] Per Austrin, Petteri Kaski, Mikko Koivisto, and Jesper

Copyright © 2019 by SIAM 53 Unauthorized reproduction of this article is prohibited Nederlof. Dense Subset Sum may be the hardest. In ear dependence problems in vector spaces. In Proc. of Proc. of the 33rd Symposium on Theoretical Aspects of the 1st ACM Conference on Innovations in Theoretical Computer Science (STACS), pages 13:1–13:14, 2016. Computer Science (ICS), pages 496–508, 2011. [17] Arturs Backurs and Piotr Indyk. Edit Distance Can- [31] Ernest F Brickell and Andrew M Odlyzko. Cryptanal- not Be Computed in Strongly Subquadratic Time (un- ysis: A survey of recent results. Proceedings of the less SETH is false). In Proc. of the 47th Annual IEEE, 76(5):578–593, 1988. ACM SIGACT Symposium on Theory of Computing [32] Karl Bringmann. Why walking the dog takes time: (STOC), pages 51–58, 2015. Frechet distance has no strongly subquadratic algo- [18] Arturs Backurs and Piotr Indyk. Which regular ex- rithms unless SETH fails. In Proc. of the 55th Annual pression patterns are hard to match? In Proc. of IEEE Symposium on Foundations of Computer Science the 57th Annual IEEE Symposium on Foundations of (FOCS), pages 661–670, 2014. Computer Science (FOCS), pages 457–466, 2016. [33] Karl Bringmann. A near-linear pseudopolynomial time [19] Arturs Backurs, Piotr Indyk, and Ludwig Schmidt. algorithm for Subset Sum. In Proc. of of the 28th An- On the fine-grained complexity of empirical risk mini- nual ACM-SIAM Symposium on Discrete Algorithms mization: Kernel methods and neural networks. arXiv (SODA), pages 1073–1084, 2017. preprint arXiv:1704.02958, 2017. [34] Karl Bringmann, Allan Grønlund, and Kasper Green [20] Marshall Ball, Alon Rosen, Manuel Sabin, and Larsen. A dichotomy for regular expression member- Prashant Nalini Vasudevan. Average-case fine-grained ship testing. In 58th IEEE Annual Symposium on hardness. In Proc. of the 49th Annual ACM SIGACT Foundations of Computer Science (FOCS 2017), pages Symposium on Theory of Computing (STOC), to ap- 307–318. IEEE, 2017. pear, 2017. [35] Karl Bringmann and Marvin Künnemann. Quadratic [21] Marshall Ball, Alon Rosen, Manuel Sabin, and conditional lower bounds for string problems and dy- Prashant Nalini Vasudevan. Proofs of useful work. namic time warping. In Proc. of the 56th Annual IACR Cryptology ePrint Archive, 2017:203, 2017. IEEE Symposium on Foundations of Computer Science [22] Nikhil Bansal, Shashwat Garg, Jesper Nederlof, and (FOCS), pages 79–97, 2015. Nikhil Vyas. Faster space-efficient algorithms for [36] Dirk Briskorn, Byung-Cheon Choi, Kangbok Lee, Subset Sum, k-Sum and related problems. In Proc. of Joseph Y.-T. Leung, and Michael Pinedo. Complexity the 49th Annual ACM SIGACT Symposium on Theory of single machine scheduling subject to nonnegative in- of Computing (STOC), to appear, 2017. ventory constraints. European Journal of Operational [23] Ilya Baran, Erik D. Demaine, and Mihai Pˇatra¸scu. Research, 207:605–619, 2010. Subquadratic algorithms for 3SUM. Algorithmica, [37] Harry Buhrman, Bruno Loff, and Leen Torenvliet. 50(4):584–596, 2008. Hardness of approximation for knapsack problems. [24] Luis Barba, Jean Cardinal, John Iacono, Stefan Theory Comput. Syst., 56(2):372–393, 2015. Langerman, AurélienOoms, and Noam Solomon. Sub- [38] Ayelet Butman, Peter Clifford, Raphaël Clifford, quadratic algorithms for algebraic generalizations of Markus Jalsenius, Noa Lewenstein, Benny Porat, Ely 3SUM. In Proc. of the 15th international Workshop Porat, and Benjamin Sach. Pattern matching under on Algorithms and Data Structures (WADS), pages 97– polynomial transformation. SIAM Journal on Com- 108, 2017. puting, 42(2):611–633, 2013. [25] Christopher Beck and Russell Impagliazzo. Strong [39] Chris Calabro, Russell Impagliazzo, and Ramamohan ETH holds for regular resolution. In Proc. of the Paturi. A duality between clause width and clause den- 45th Annual ACM SIGACT Symposium on Theory of sity for SAT. In Proc. of 21st Conference on Compu- Computing (STOC), pages 487–494, 2013. tational Complexity (CCC), pages 252–260, 2006. [26] Anja Becker, Jean-SébastienCoron, and Antoine Joux. [40] Chris Calabro, Russell Impagliazzo, and Ramamohan Improved generic algorithms for hard knapsacks. In Paturi. The complexity of satisfiability of small depth Proc. of 30th Annual International Conference on the circuits. In Proc. of the 4th International Workshop Theory and Applications of Cryptographic Techniques on Parameterized and Exact Computation (IWPEC), (EUROCRYPT), pages 364–385, 2011. pages 75–85, 2009. [27] Felix A. Behrend. On sets of integers which contain no [41] Jean Cardinal, John Iacono, and AurélienOoms. Solv- three terms in arithmetical progression. Proceedings of ing k-SUM using few linear queries. In Proc. of the 24th the National Academy of Sciences of the United States Annual European Symposium on Algorithms (ESA), of America, 32(12):331–332, 1946. pages 25:1–25:17, 2016. [28] Richard E. Bellman. Dynamic programming. Prince- [42] Marco L. Carmosino, Jiawei Gao, Russell Impagliazzo, ton University Press, 1957. Ivan Mihajlin, Ramamohan Paturi, and Stefan Schnei- Downloaded 10/14/20 to 24.61.9.56. Redistribution subject SIAM license or copyright; see https://epubs.siam.org/page/terms [29] Huck Bennett, Alexander Golovnev, and Noah der. Nondeterministic extensions of the strong ex- Stephens-Davidowitz. On the quantitive hardness of ponential time hypothesis and consequences for non- CVP. CoRR, abs/1704.03928, 2017. reducibility. In Proc. of the 7th ACM Conference on [30] Arnab Bhattacharyya, Piotr Indyk, David P. Innovations in Theoretical Computer Science (ITCS), Woodruff, and Ning Xie. The complexity of lin- pages 261–270, 2016.

Copyright © 2019 by SIAM 54 Unauthorized reproduction of this article is prohibited [43] David Cattanéoand Simon Perdrix. The parameter- [58] Jiawei Gao, Russell Impagliazzo, Antonina Kolokolova, ized complexity of domination-type problems and ap- and R. Ryan Williams. Completeness for first-order plication to linear codes. In Proc. of the 11th Interna- properties on sparse structures with algorithmic appli- tional Conference on Theory and Applications of Mod- cations. In Proc. of the 28th Annual ACM-SIAM Sym- els of Computation (TAMC), pages 86–103, 2014. posium on Discrete Algorithms (SODA), pages 2162– [44] Timothy M. Chan and Moshe Lewenstein. Clustered 2181, 2017. integer 3SUM via additive combinatorics. In Proc. [59] Michael R. Garey and David S. Johnson. Computers of the 47th annual ACM Symposium on Theory Of and Intractability: A Guide to the Theory of NP Computing (STOC), pages 31–40, 2015. Completeness. W.H. Freeman & Co., 1976. [45] Ashok K. Chandra, Merrick L. Furst, and Richard J. [60] Rosario G. Garroppo, Stefano Giordano, and Luca Ta- Lipton. Multi-party protocols. In Proc. of the 15th vanti. A survey on multi-constrained optimal path annual ACM Symposium on Theory Of Computing computation: Exact and approximate algorithms. (STOC), pages 94–99, 1983. Computer Networks, 54:3081–3107, 2010. [46] Benny Chor and Ronald R. Rivest. A knapsack-type [61] Omer Gold and Micha Sharir. Improved bounds for public key cryptosystem based on arithmetic in finite 3SUM, k-SUM, and linear degeneracy. In Proc. of fields. IEEE Transactions on Information Theory, the 25th annual European Symposium on Algorithms 34(5):901–909, 1988. (ESA), pages 42:1–42:13, 2017. [47] Don Coppersmith and Shmuel Winograd. Matrix [62] Isaac Goldstein, Tsvi Kopelowitz, Moshe Lewenstein, multiplication via arithmetic progressions. Journal of and Ely Porat. How hard is it to find (honest) symbolic computation, 9(3):251–280, 1990. witnesses? In Proc. of the 24th annual European [48] Marek Cygan, Holger Dell, Daniel Lokshtanov, Dániel Symposium on Algorithms (ESA), pages 45:1–45:16, Marx, Jesper Nederlof, Yoshio Okamoto, Ramamohan 2016. Paturi, Saket Saurabh, and Magnus Wahlström. On [63] Pierre Hansen. Bicriterion path problems. In Proc. problems as hard as CNF-SAT. ACM Transactions on of the 3rd confernece om Multiple Criteria Decision Algorithms, 12(3):41, 2016. Making Theory and Application, pages 109–127, 1980. [49] Evgeny Dantsin and Edward A. Hirsch. Worst-case [64] Refael Hassin. Approximation schemes for the re- upper bounds. In Handbook of Satisfiability, pages 403– stricted shortest path problem. Mathematics of Op- 424. 2009. erations Research, 17:36–42, 1992. [50] Holger Dell and Dieter Van Melkebeek. Satisfia- [65] Johan H˚astadand Avi Wigderson. Simple analysis of bility allows no nontrivial sparsification unless the graph tests for linearity and PCP. Random Structures polynomial-time hierarchy collapses. In Proc. of the & Algorithms, 22(2):139–160, 2003. 42th annual ACM Symposium on Theory Of Comput- [66] Kaj Holmberg and Di Yuan. A multicommodity ing (STOC), pages 251–260, 2010. network-flow problem with side constraints on paths [51] Itai Dinur, Orr Dunkelman, Nathan Keller, and solved by column generation. INFORMS Journal on Adi Shamir. Efficient dissection of composite prob- Computing, 15(1):42–57, 2003. lems, with applications to cryptanalysis, knapsacks, [67] Ellis Horowitz and Sartaj Sahni. Computing partitions and combinatorial search problems. In Proc. of the with applications to the knapsack problem. Journal of 32nd Annual Conference on Advances in Cryptology the ACM, 21(2):277–292, 1974. (CRYPTO), pages 719–740, 2012. [68] Nick Howgrave-Graham and Antoine Joux. New [52] Michael Elkin. An improved construction of generic algorithms for hard knapsacks. In Proc. of progression-free sets. In Proc. of the 21st An- 29th Annual International Conference on the Theory nual ACM-SIAM Symposium on Discrete Algorithms and Applications of Cryptographic Techniques (EURO- (SODA), pages 886–905, 2010. CRYPT), pages 235–256, 2010. [53] Funda Ergun, Rakesh Sinha, and Lisa Zhang. An im- [69] Russell Impagliazzo and Moni Naor. Efficient cryp- proved FPTAS for the restricted shortest path prob- tographic schemes provably as secure as subset sum. lem. Information Processing Letters, 83:287–291, 2002. Journal of cryptology, 9(4):199–216, 1996. [54] Jeff Erickson. New lower bounds for convex hull prob- [70] Russell Impagliazzo and Ramamohan Paturi. On the lems in odd dimensions. SIAM Journal on Computing, complexity of k-SAT. Journal of Computer and System 28(4):1198–1214, 1999. Sciences, 62(2):367 – 375, 2001. [55] Fedor V. Fomin, Petr A. Golovach, Daniel Lokshtanov, [71] Russell Impagliazzo, Ramamohan Paturi, and Francis and Saket Saurabh. Almost optimal lower bounds Zane. Which problems have strongly exponential com- for problems parameterized by clique-width. SIAM J. plexity? Journal of Computer and System Sciences, Comput., 43(5):1541–1563, 2014. 63(4):512–530, 2001. Downloaded 10/14/20 to 24.61.9.56. Redistribution subject SIAM license or copyright; see https://epubs.siam.org/page/terms [56] Ari Freund. Improved subquadratic 3SUM. Algorith- [72] Zahra Jafargholi and Emanuele Viola. 3SUM, 3XOR, mica, 77(2):440–458, 2017. triangles. Algorithmica, 74(1):326–343, 2016. [57] Anka Gajentaan and Mark H. Overmars. On a class [73] Hamid Jahanjou, Eric Miles, and Emanuele Viola. Lo- of O(n2) problems in computational geometry. Com- cal reductions. In Proc. of the 42nd International Col- putational Geometry, 5(3):165–185, 1995. loquium on Automata, Languages, and Programming

Copyright © 2019 by SIAM 55 Unauthorized reproduction of this article is prohibited (ICALP), pages 749–760, 2015. Transactions on Networking, 6:768–778, 1998. [74] Klaus Jansen, Stefan Kratsch, DánielMarx, and Ildikó [90] Dean H. Lorenz and Danny Raz. A simple efficient Schlotter. Bin packing with fixed number of bins approximation scheme for the restricted shortest path revisited. J. Comput. Syst. Sci., 79(1):39–49, 2013. problem. Operations Research Letters, 28:213–219, [75] Klaus Jansen, Felix Land, and Kati Land. Bounding 2001. the running time of algorithms for scheduling and [91] Silvano Martello and Paolo Toth. Knapsack problems: packing problems. SIAM J. Discrete Math., 30(1):343– algorithms and computer implementations. John Wiley 366, 2016. & Sons, Inc., 1990. [76] Hans C. Joksch. The shortest route problem with [92] Ralph Merkle and Martin Hellman. Hiding information constraints. Journal of Mathematical Analysis and and signatures in trapdoor knapsacks. IEEE transac- Applications, 14:191–197, 1966. tions on Information Theory, 24(5):525–530, 1978. [77] Allan Grønlund Jørgensen and Seth Pettie. Three- [93] Joseph Naor, Hadas Shachnai, and Tami Tamir. Real- somes, degenerates, and love triangles. In Proc. of time scheduling with a budget. Algorithmica, 47:343– the 55th Annual IEEE Symposium on Foundations of 364. Computer Science (FOCS), pages 621–630, 2014. [94] Jesper Nederlof. A short note on Merlin-Arthur pro- [78] Richard M. Karp. Reducibility among combinatorial tocols for subset sum. Information Processing Letters, problems. In Complexity of computer computations, 118:15–16, 2017. pages 85–103. Springer, 1972. [95] Jesper Nederlof, Erik Jan van Leeuwen, and Ruben [79] Hans Kellerer, Ulrich Pferschy, and David Pisinger. van der Zwaan. Reducing a target interval to a Knapsack problems. Springer, 2004. few exact queries. In Proc. of the 37th international [80] James King. A survey of 3SUM-hard problems. 2004. symposium on Mathematical Foundations of Computer [81] Tomasz Kociumaka, Solon P. Pissis, and Jakub Ra- Science (MFCS), pages 718–727, 2012. doszewski. Parameterizing PWM-and profile-matching [96] Kevin O’Bryant. Sets of integers that do not contain and knapsack by the feasible-weight solutions count. long arithmetic progressions. Electronic Journal of arXiv:1604.07581, 2016. Combinatorics, 18(1):P59, 2011. [82] Konstantinos Koiliaris and Chao Xu. A faster pseu- [97] Andrew M. Odlyzko. The rise and fall of knapsack dopolynomial time algorithm for Subset Sum. In Proc. cryptosystems. Cryptology and computational number of the 28th Annual ACM-SIAM Symposium on Discrete theory, 42:75–88, 1990. Algorithms (SODA), pages 1062–1072, 2017. [98] Mihai P˘atra¸scuand Ryan Williams. On the possibility [83] Tsvi Kopelowitz, Seth Pettie, and Ely Porat. Higher of faster SAT algorithms. In Proceedings of the twenty- lower bounds from the 3SUM conjecture. In Proc. of first annual ACM-SIAM symposium on Discrete Algo- the 27th Annual ACM-SIAM Symposium on Discrete rithms, pages 1065–1075. SIAM, 2010. Algorithms (SODA), pages 1272–1287, 2016. [99] Ramamohan Paturi, Pavel Pudlák,Michael E. Saks, [84] Kangbok Lee, Byung-Cheon Choi, Joseph Y.-T. Leung, and Francis Zane. An improved exponential-time and Michael L. Pinedo. Approximation algorithms for algorithm for k-SAT. Journal of the ACM, 52(3):337– multi-agent scheduling to minimize total weighted com- 364, 2005. pletion time. Information Processing Letters, 109:913– [100] David Pisinger. Dynamic programming on the word 917, 2009. RAM. Algorithmica, 35(2):128–145, 2003. [85] Andrea Lincoln, Virginia Vassilevska Williams, [101] David Pisinger. Where are the hard knapsack prob- Joshua R. Wang, and R. Ryan Williams. Determin- lems? Computers & Operations Research, 32(9):2271– istic time-space trade-offs for k-SUM. In Proc. of the 2284, 2005. 43rd International Colloquium on Automata, Lan- [102] Mihai Pˇatra¸scu.Towards polynomial lower bounds for guages, and Programming (ICALP), pages 58:1–58:14, dynamic problems. In Proc. of the 42nd Annual ACM 2016. Symposium on Theory Of Computing (STOC), pages [86] Daniel Lokshtanov, DánielMarx, and Saket Saurabh. 603–610, 2010. Known algorithms on graphs on bounded treewidth [103] Andrea Raith and Matthias Ehrgott. A comparison are probably optimal. In Proc. of the 27th 2nd An- of solution strategies for biobjective shortest path nual ACM-SIAM Symposium on Discrete Algorithms problems. Computers & OR, 36(4):1299–1331, 2009. (SODA), pages 777–789, 2011. [104] Liam Roditty and Virginia Vassilevska Williams. Fast [87] Daniel Lokshtanov, DánielMarx, and Saket Saurabh. approximation algorithms for the diameter and ra- Lower bounds based on the exponential time hypothe- dius of sparse graphs. In Proc. of the 45th Annual sis. Bulletin of the EATCS, 105:41–72, 2011. ACM SIGACT Symposium on Theory of Computing [88] Daniel Lokshtanov and Jesper Nederlof. Saving space (STOC), pages 515–524, 2013. Downloaded 10/14/20 to 24.61.9.56. Redistribution subject SIAM license or copyright; see https://epubs.siam.org/page/terms by algebraization. In Proc. of the 42nd Annual [105] Dvir Shabtay, Kfir Arviv, Yael Edan, and Helman ACM SIGACT Symposium on Theory of Computing Stern. A combined robot selection and schedul- (STOC), pages 321–330, 2010. ing problem for flow-shops with no-wait restrictions. [89] Dean H. Lorenz and Ariel Orda. QoS routing on Omega, 43:96–107, 2014. networks with uncertain parameters. IEEE/ACM [106] Adi Shamir. A polynomial-time algorithm for break-

Copyright © 2019 by SIAM 56 Unauthorized reproduction of this article is prohibited ing the basic Merkle-Hellman cryptosystem. IEEE transactions on information theory, 30(5):699–704, 1984. [107] Emanuele Viola. The communication complexity of addition. Combinatorica, 35(6):703–747, 2015. [108] Joshua R. Wang. Space-efficient randomized algorithms for k-SUM. In Proc. of the 22th annual Euro- pean Symposium on Algorithms (ESA), pages 810–829, 2014. [109] Arthur Warburton. Approximation of pareto optima in multiple-objective, shortest-path problems. Opera- tions Research, 35(1):70–79, 1987. [110] R. Ryan Williams. A new algorithm for optimal 2- constraint satisfaction and its implications. Theoretical Computer Science, 348(2–3):357–365, 2005. [111] R. Ryan Williams and Huacheng Yu. Finding orthog- onal vectors in discrete structures. In Proc. of the 25th Annual ACM-SIAM Symposium on Discrete Al- gorithms (SODA), pages 1867–1877, 2014. [112] Virginia Vassilevska Williams. Hardness of easy problems: basing hardness on popular conjectures such as the strong exponential time hypothesis (invited talk). In LIPIcs-Leibniz International Proceedings in Infor- matics, volume 43, 2015. [113] Virginia Vassilevska Williams and R. Ryan Williams. Finding, minimizing, and counting weighted sub- graphs. In Proc. of the 41st Annual ACM Sympo- sium on Theory Of Computing (STOC), pages 455– 464, 2009. [114] Gerhard J. Woeginger. Open problems around exact algorithms. Discrete Applied Mathematics, 156(3):397–405, 2008. [115] O. Younis and S. Fahmy. Constraint-based routing in the internet: Basic principles and recent research. IEEE Communications Surveys and Tutorials, 5(1):2– 13, 2003. [116] U. Zimmermann and M.E. Lübbecke. Computer aided scheduling of switching engines. In Willi Jäger and Hans-Joachim Krebs, editors, Mathematics — Key Technology for the Future: Joint Projects between Universities and Industry, pages 690–702. Springer Berlin Heidelberg, 2003. Downloaded 10/14/20 to 24.61.9.56. Redistribution subject SIAM license or copyright; see https://epubs.siam.org/page/terms