Do we happen to know of any promise problems where the problem is both conditionally hard (say, NP-hard) while simultaneously being able to certify that the instance satisfies the given promise?
For example, in the case of Unique-SAT, we have some form of NP-hardness under randomized reductions (by the Valiant-Vazirani theorem), but there does not seem to be a way or certifying the promise of the instance (namely, that the input formula has at most one satisfying assignment). I have heard that some promise problems in lattice-based cryptography admit certificates that guarantee the promise holds, but NP-hardness of the problem is not known.
Is there any problem satisfying these two conditions? Is there a good reason why these should not exist? I could imagine that, in the presence of the certificate that guarantees the promise, the problem might no longer be hard because we can extract some valuable information from the certificate, but note that I don’t want the certificate to be handed in together with the instance, I just want the certificate to exist.
EDIT: Thanks to the comment below I realized that in fact my question was imprecise. It forgot to add that both sides of the promise should themselves be certifiable.
That is, I am interested in NP problems $A$ and $B$, possibly with $A \cap B \neq \emptyset$, but where the promise guarantees that an instance $x$ does not belong to both at the same time, and the task is to decide whether $x$ is in $A$ or in $B$. So there should be three types of certificates:
- for a given promise instance $x$, it must be possible to certify that $x$ does not belong to both $A$ and $B$ simultaneously; this certificate should be some additional object, possibly hard to find;
- if $x$ is in $A $, this is certifiable because $A$ is in NP;
- similarly, if $x$ is in $B$, this is again certifiable because $B$ is in NP.
And, on top of this, the promise problem of distinguishing $A$ from $B$ under the disjointness promise should still be hard. So, in particular, one cannot take $A$ and $\bar A$, because then $A$ is both in NP and coNP and thus it's unlikely to be NP-hard.