Complexity 24-1 Complexity Andrei Bulatov Interactive Proofs

Complexity 24-2 Interactive Proofs ProverVerifier Has unlimited computational power Can perform polynomial time computations They can exchange messages Wants to convince Verifier in something Accepts or rejects after performing some computation

Complexity 24-3 Formal Model Prover and Verifier are represented by functions: Verifier (V) Input: an input string, w a random string, r message history Output: A message, that is a string, or accept or reject Prover (P) Input: an input string, w message history Output:A message, that is a string

Complexity 24-4 A Prover’s move is the message A Verifier’s move is the message We write if for some k and if for some k We assume that the length of messages, the length of r, and k are bounded with a polynomial p(|w|) Finally, we denote where r is a random string of length p(|w|)

Complexity 24-5 The Class IP Definition A language L belongs to IP if some polynomial time function V and arbitrary function P exist, such that for every function R and string w w  L implies Pr[V  P accepts w]  w  L implies Pr[V  R accepts w] 

Complexity 24-6 Examples Instance: Graphs G and H. Question: Are G and H non-isomorphic? Graph Non-Isomorphism Instance: A formula  in CNF and a number k Question: Is it true that  has exactly k satisfying assignments? #SAT Theorem #SAT  IP

Complexity 24-7 Proof Given a formula  and a number k. Let be the variables of  The first stage is “arithmetization” of  : We construct a polynomial such that

Complexity 24-8 By induction for X define the corresponding polynomial to be x for  X define the corresponding polynomial to be 1 – x for    with corresponding polynomials g and h, define the corresponding polynomial to be gh (the product) Arithmetization for    with corresponding polynomials g and h, define the corresponding polynomial to be 1 – (1 – g)(1 – h) for  with corresponding polynomial g, define the corresponding polynomial to be 1 – g

Complexity 24-9 Protocol Let be the result of arithmetization of  Then The protocol will go in n rounds On every round, we will construct from an equality an equality of the form

Complexity The property we are trying to achieve is if and only if If this is possible, starting off with after n rounds we get an equality which is easy to verify The last equality is true if and only if the first one is true

If was true before this round, then Complexity Randomness Unfortunately, the condition above is impossible to achieve Instead, we use a probabilistic one is true after this round with probability 1 If was false before the this round, then is false after this round with probability 1– 

Complexity Thus, after n rounds If we started off with a correct equality, then after n rounds we have a correct equality with probability 1 If we started off with an incorrect equality, then after n rounds the probability that we end up with a correct equality is the probability that the error was made in one of the n rounds, which is at most n . Thus, with probability at least 1 – n , we will have an incorrect equality We get an equality of the form that can be easily checked We need to organize every round such that

Complexity Round Having the equality Verifier sends to Prover the polynomial g Prover returns the polynomial or what he pretends this polynomial is Verifier checks if the degree of h is not higher than that of g Verifier checks if Verifier randomly chooses a number r, such that where m is the number of clauses in , and replace the original equality with

Complexity Analysis If the original equality is true then Prover should behave honestly, that is return actual coefficients of h(x). Then - The degree of h is not higher than that of g - h(0) + h(1) = k - For any r,

Complexity If the original equation is not true then consider two cases - if Prover is honest that is he returns the actual coefficients of h, then h(0) + h(1)  k - if Prover is dishonest that is he returns some polynomial p(x) such that the degree of p is not higher than that of g and p(0) + p(1) = k In this case g and h are different. Therefore their values can be equal for at most d = max{deg(g), deg(h)} values of x. The probability that for a randomly chosen is

Complexity Note that the degree of f is at most mn. Therefore

Complexity IP = PSPACE Theorem IP = PSPACE Proof. IP  PSPACE If we consider Prover’s messages as nondeterministic guesses, then we get IP  NPSPACE Then, by Savitch’s theorem IP  NPSPACE = PSPACE

Complexity PSPACE  IP It is sufficient to show that some PSPACE-complete problem belongs to IP Instance: A quantified Boolean formula where each is a Boolean variable, is a Boolean expression involving and each is a quantifier (  or  ). Question: Is  logically valid ? Quantified Boolean Formula

Complexity Arithmetization Given a formula Let be the arithmetization of  Then define polynomials by setting Clearly,  is true if and only if

Complexity Reducing degree Since the degree of may be exponential, we need to reduce it. Replace  with or where and We define as follows:

Complexity Properties of the new polynomials If then when is linear in x Therefore if then is a linear polynomial

Complexity Protocol Step 0. P  V: Prover sends to Verifier Verifier checks if and reject if not Step i. P  V: Prover sends as a polynomial in z. Here denotes the previously selected random values for variables Verifier computes and. Then it checks the degree of the polynomial and that or If either fails, Verifier rejects V  P: Verifier picks a random value and sends it to Prover

Complexity Step k + 1. Verifier checks if If yes then Verifier accept, if not rejects