Why is tabulated hashing 3-wise independent but not 4-wise independent?

Question

Tabulated hashing uses tables of random numbers to compute hash values. Suppose $|\mathcal{U}| = 2^w \times 2^w$ and $m = 2^l$, so that the items being hashed are pairs $(x,y)$ where $x$ and $y$ are $w$-bit strings (or $2w$-bit strings broken in half), and hash values are $l$-bit strings.

Let $A[0 \cdots 2^w-1]$ and $B[0 \cdots 2^w-1]$ be arrays of $l$-bit strings. $A$ and $B$ can be though of as $2^w \times l$ dimensional array of bits.

Define the hash function $h_{A, B} : \mathcal{U} \to [m]$ by setting $h_{A, B}(x, y) = A[x] \oplus B[y]$, where $\oplus$ denotes bit-wise exclusive-or.

Let $\mathcal{H}'$ denote the set of all possible functions $h_{A, B}$.

Can someone explain why is $\mathcal{H}'$ 3-wise independent and not 4-wise independent?

Answer 1

For any $h = h_{A,B}$ and $x,x',y,y' \in \{0,1\}^w$, $$ h(x,y) \oplus h(x',y) \oplus h(x,y') \oplus h(x',y') = 0. $$

Answer 2

To be clear, you're asking why the following holds for $k=3$ but not for $k=4$:

$$ \forall (x_1,y_1),...,(x_k,y_k)\in\{0,1\}^{2w}, z_1,...,z_k\in\{0,1\}^m, s.t. (x_i,y_i)\neq (x_j,y_j):\\ \Pr\limits_{A,B}\left[\bigwedge\limits_{i=1}^k A(x_i)\oplus B(y_i)=z_i\right]=m^{-k} $$

Where $A,B$ are independent and uniformly distributed over $(\{0,1\}^l)^{\{0,1\}^w}$ and $m=2^l$.

Applying the law of total probability:

$$ \Pr\limits_{A,B}\left[\bigwedge\limits_{i=1}^k A(x_i)\oplus B(y_i)=z_i\right]=\sum\limits_{b_1,...,b_k\in\{0,1\}^l}\Pr\limits_{A,B}\left[\bigwedge\limits_{i=1}^k A(x_i)=z_i\oplus b_i\Big| \bigwedge\limits_{i=1}^k B(y_i)=b_i\right]\cdot\Pr\left[\bigwedge\limits_{i=1}^k B(y_i)=b_i\right] $$

Now let us denote by $\alpha,\beta$ the number of unique $x_i$'s,$y_i$'s correspondingly, i.e. $\alpha = |\{x_1,...,x_k\}|$, and $\beta=|\{y_1,...,y_k\}|$. Consider the number of non zero summands. Note that if $y_i=y_j$, then $b_i=b_j$ or the righthand expression in the above sum is zero. Similarly, if $x_i=x_j$ then $z_i\oplus b_i=z_j\oplus b_j$ or the lefthand expression becomes zero. For any "good" sequence of $b_i$'s (i.e. one which is consistent with repetitions in the $x_i$'s or $y_i$'s), we have $\Pr\limits_{A,B}\left[\bigwedge\limits_{i=1}^k A(x_i)=z_i\oplus b_i\Big| \bigwedge\limits_{i=1}^k B(y_i)=b_i\right]=m^{-\alpha}$ (as $A,B$ are independent) and $\Pr\left[\bigwedge\limits_{i=1}^k B(y_i)=b_i\right]=m^{-\beta}$. It thus remains to compute the number of sequences $b_1,...,b_k\in\{0,1\}^l$ such that $x_i=x_j$ implies $b_i=b_j\oplus z_j\oplus z_i$ and $y_i=y_j$ implies $b_i=b_j$ (the number of degrees of freedom in the above sum). Denote the number of such sequences by $C=C((x_1,y_1),...,(x_n,y_n))$ (unfortunately it is not determined by $k,\alpha,\beta$ alone). $C$ is the number of equivalence classes in the relation $b_i\sim b_j$ (to be read as $b_i$ determines $b_j$) which is the transitive closure of $\{(b_i,b_j)| x_i=x_j \lor y_i=y_j\}$. We conclude now that:

$$ \Pr\limits_{A,B}\left[\bigwedge\limits_{i=1}^k A(x_i)\oplus B(y_i)=z_i\right]=\frac{m^C}{m^{\alpha+\beta}} $$

For $k=3$ you can manually check that the only options (up to renaming $\alpha,\beta$) are: $(\alpha = 1, \beta =3, C=1)$, $(\alpha = 2, \beta =2, C=1)$, $(\alpha = 2, \beta=3, C=2)$, $(\alpha = 3, \beta=3, C=3)$ and in each case the above probability is $m^{-3}$. For $k=4$ you can get $(\alpha=2,\beta=2, C=1)$ which sets the above probability to $m^{-3}$ (instead of $m^{-4}$). I don't know why I wrote this lengthy answer to this simple problem, but I did and there is no going back.