Probabilistically Checkable and Interactive Proof Systems (original) (raw)

2017.01.19

Introduction (scribe notes by Pratyush Mishra)

introduction to the course
definition of interactive proofs
sumcheck protocol
- coNP contained in IP
  * arithmetization
- #P contained in IP (and thus all of PH)
  * better arithmetization
IP contained in PSPACE

Lecture notes:

Formulation of interactive proofs:

The sumcheck protocol:

Lund Fortnow Karloff Nisan 1992: Algebraic methods for interactive proof systems

Additional:

2017.01.24

Interactive Proofs 1 (scribe notes by Mariel Supina)

definition of QBF
PSPACE is contained in IP
- TQBF is the starting point
- arithmetizing formula and quantifiers
- Shamir's protocol (with Shen's degree reduction)
TQBF is PSPACE-complete

Lecture notes:

Shamir's protocol:

Additional:

2017.01.26

Interactive Proofs 2 (scribe notes by Bryan O'Gorman)

public vs private coins
GNI is contained in IP (with private coins)
definition of AM (same as IP but public coins)
GNI is contained in AM[2]
- reduction to approximate counting
- approximate counting via universal hashing
IP[k] is contained in AM[k+2]
achieving perfect completeness in AM

Lecture notes:

Goldwasser--Sipser transformation:

Goldwasser Sipser 1986: Private coins versus public coins in interactive proof systems
- emulating any interactive proof, with public coins

Additional:

Goldreich Leshkowitz 2016: On emulating interactive proofs with public coins
- an alternative emulation that is more efficient than GS86

2017.01.31

Interactive Proofs 3 (scribe notes by Peter Manohar)

interactive proofs with bounded communication/randomness
- prover bits ≤ p
- verifier bits ≤ v
- random bits ≤ r
- IP[p,v,r] and AM[p,v,r]
IP[p,v,r] is contained in DTime(2O(p+v+r)poly)
- [GH98, Theorem 1]
- compute value of game tree
IP[p,v] is contained in BPTime(2O(p+v)poly)
- [GH98, Theorem 2]
- approximate value of game tree
  * sub-sample by random tapes
- proof via Chernoff bound and union bound
AM[p] is contained in BPTime(2O(p log p)poly)
- [GH98, Theorem 3]
- approximate value of game tree
  * sub-sample by transcript-consistent next messages
- refine previous analysis via hybrids
IP[p] is contained in BPTime(2O(p log p)poly)NP
- [GH98, Theorem 4]
- (sketch) as above but not transcript consistency is harder
  * see [GH98, Appendix B]

Main:

Goldreich Håstad 1998: On the complexity of interactive proofs with bounded communication

Additional:

2017.02.02

Interactive Proofs 4 (scribe notes by Lynn Chua)

inefficiency of Shamir's protocol
- honest prover in Shamir's protocol is 2O(n^2)
- honest prover in Shen's protocol is 2O(n)
- T-time S-space machines yield 2O(S log T)-time provers
doubly-efficient interactive proofs
- motivation of delegation of computation
  * [GKR, Section 1.0]
- theorem statement for log-space uniform circuits
  * [GKR, Section 1.1]
bare bones protocol [GKR, Section 3]
- layered arithmetic circuits
- wiring predicates
- one sumcheck per layer

Main:

Goldwasser Kalai Rothblum 2015: Delegating computation: interactive proofs for muggles

Additional on doubly-efficient interactive proofs:

2017.02.07

Interactive Proofs 5 (scribe notes by Patrick Lutz)

low-degree extensions [GKR, Section 2.3]
- definition
- the equality polynomial
  * [GKR, Proposition 2.2]
- space-efficient evaluation of LDEs
  * [GKR, Claim 2.3]
implementing the bare bones protocol [GKR, Section 4]
- wiring predicates of s-space uniform circuits have LDEs that are computable in log-space
  * [GKR, Claim 4.6]
- doubly-efficient IPs for log-space computations
  * [GKR, Theorem 4.4] ([GKR, Claim 4.3])
- combining the above two facts
  * [GKR, Theorem 4.7]
corollary for Turing machines [GKR, Corollary 4.8]

Main:

Goldwasser Kalai Rothblum 2015: Delegating computation: interactive proofs for muggles

Additional on doubly-efficient interactive proofs:

Goldreich Rothblum 2017: Simple doubly-efficient interactive proof systems for locally-characterizable sets

Additional on interactive proofs of proximity:

Rothblum Vadhan Wigderson 2013: Interactive proofs of proximity: delegating computation in sublinear time

Additional on implementations of GKR's protocol:

2017.02.09

Interactive Proofs 6

IP for GI
definition of honest-verifier zero knowledge (HVZK)
the IP for GI is HVZK
definition of malicious-verifier zero knowledge (ZK)
the IP for GI is ZK
PZK ⊆ SZK ⊆ CZK
towards SZK ⊆ coAM
- running simulator when x ∉ L
- IP for GI → IP for GNI (!)

Main:

Zero knowledge and graph isomoprhism (class by Rafael Pass)

Additional:

Videos:

Zero knowledge probabilistic proof systems (by Shafi Goldwasser)

2017.02.14

Basic Probabilistic Checking 1

the PCP complexity class PCPc,s[r,q]Σ
PCPc,s[r,q]Σ ↔ gap of 2r q-ary constraints over Σ
simple class inclusions
exponential-size PCP for circuit satisfiability
- NP ⊆ PCP1,0.5[poly(n),O(1)]{0,1}
- good query complexity, bad proof length

Lecture notes:

Additional:

Arora Lund Motwani Sudan Szegedy 1998: Proof verification and the hardness of approximation problems

New York Times article about the PCP Theorem:

Kolata 1992: New short cut found for long math proofs

2017.02.16

Basic Probabilistic Checking 2 (scribe notes by Aditya Mishra)

linear PCPs
- the complexity class LPCPc,s[r,q,l]Σ
- last time: NP ⊆ LPCP1,0.75[m,3,(n+1)2]{0,1}
- today: compiling any LPCP into a PCP via linearity test
testing linearity
- BLR test
- analysis via majority decoding

Lecture notes:

Linearity testing (in a course by Moshkovitz)

Main:

Blum Luby Rubinfeld 1990: Self-testing/correcting with applications to numerical problems

Additional:

Bellare Coppersmith Håstad Kiwi Sudan 1996: Linearity testing in characteristic two
- first connection of Fourier analysis and testing

New York Times article about ZCash, which uses linear PCPs as part of so-called zkSNARKs:

Popper 2016: Zcash, a harder-to-trace virtual currency, generates price frenzy

2017.02.21

Basic Probabilistic Checking 3 (scribe notes by Izaak Meckler)

NP ⊆ PCP[log, polylog] (up to low-degree testing)
- start from satisfiability of degree-3 polynomials
- amplify gap via an error-correcting code such as Reed--Solomon
- arithmetization via Reed--Muller instead of Hadamard
- reduce to sumcheck problem

Lecture notes:

Main:

Additional:

2017.02.23

Basic Probabilistic Checking 4

NP ⊆ PCP[log, polylog] with low-degree testing
definition of low-degree testing
univariate polynomials
- d+2 random points (any ε)
  * [S92, Section 3.1.1]
- d+2 random evenly-spaced points (ε ~ 1/d2)
  * [S92, Section 3.1.2]
multivariate polynomials
- total degree via random lines (ε ~ 1/d2)
  * [S92, Section 3.2.1]

Lecture notes:

Additional:

Sudan 1992: Efficient checking of polynomials and proofs and the hardness of approximation problems

2017.02.28

Basic Probabilistic Checking 5

NEXP ⊆ PCP[poly, poly]
- why last lecture's approach fails
  * verifier would run in exponential time
- definition of oracle satisfiability (OSAT)
  * [BFL90, Definition 4.1]
- OSAT is NEXP-complete
  * [BFL90, Proposition 4.2]
- OSAT to zero testing
- zero testing to sumcheck
  * Method 1: via random evaluation [BFLS91, Section 5.2]
  * Method 2: via additional polynomials [BS08, Lemma 4.11]

Lecture notes:

Main:

Additional:

2017.03.02

Basic Probabilistic Checking 6

NTIME(T) ⊆ PCP[ptime=poly(T), vtime=poly(n,log(T))]
- low-degree extension with H of logarithmic size
  * [BFLS91, Section 4.1]
- low-degree projection polynomials to obtain bits
  * [BFLS91, Section 6]
consequences of the PCP Theorem
- delegation of computation
  * comparison of BFLS91 and GKR08
  * key parameters:
  * prover running time
  * verifier running time
- hardness of approximation
  * Gap-CLIQUE
  * FGLSS graph [GO05, Section 2]

Lecture notes:

Main:

Babai Fortnow Levin Szegedy 1991: Checking computations in polylogarithmic time
- PCP=NEXP
Feige Goldwasser Lovász Safra Szegedy 1996: Interactive proofs and the hardness of approximating cliques
- from PCPs to hardness of approximation

Additional:

Samorodnitsky Trevisan 2000: A PCP characterization of NP with optimal amortized query complexity
- obtaining strong hardness of approximation results for CLIQUE (and other problems)

2017.03.07

Reducing Query Complexity 1

Part I of NP ⊆ PCP[O(log n), O(1)] via proof composition
definition of robust PCPs
definition of PCPs of Proximity (PCPPs)
proof composition
- outer robustness and inner proximity
plan for the next two lectures

Lecture notes:

Main:

Additional:

Arora Lund Motwani Sudan Szegedy 1998: Proof verification and the hardness of approximation problems

2017.03.09

Reducing Query Complexity 2

Part II of NP ⊆ PCP[O(log n), O(1)] via proof composition
1st proof composition:
- outer: NP ⊆ robust-PCP[log, polylog] (robustization of LDE-PCP)
- inner: NP ⊆ PCPP[log, polylog] (prox variant of LDE-PCP - next lecture)
- result: NP ⊆ PCP[log, polyloglog]
2nd proof composition:
- outer: NP ⊆ robust-PCP[log, polyloglog] (robustization of previous step)
- inner: NP ⊆ PCPP[poly(n),O(1)] (prox variant of Had-PCP)
- result: desired claim
robustization
- 1st step: NP ⊆ PCP[O(log n), O(1)]{0,1}polylog(n) - next lecture
- 2nd step: PCP[r, q] ⊆ O(1/q)-robust-PCP[r,O(q)]
proximity variant of Had-PCP
- Had-PCP + consistency check

Lecture notes on robustization:

Lecture notes on proximity variant of Had-PCP:

2017.03.14

Reducing Query Complexity 3

Part III of NP ⊆ PCP[O(log n), O(1)] via proof composition
NP ⊆ PCPP[log, polylog] (needed to prove from last lecture)
- LDE-PCP + consistency check
- the consistency check relies on self-correction
NP ⊆ PCP[O(log n), O(1)]{0,1}polylog(n) (needed to prove from last lecture)
- in general: PCP[r,q]{0,1} ⊆ PCP[r+O(log n), O(1)]{0,1}q polylog(n)
- prover writes LDE of the assignment & restrictions to curves
- verifier checks low-degreeness and does a consistency check
This concludes the proof that NP ⊆ PCP[O(log n), O(1)]!

Additional on O(1)-query tests:

Section 7.2 of Arora Lund Motwani Sudan Szegedy 1998: Proof verification and the hardness of approximation problems

Additional on aggregation:

Section 7.4 of Arora Lund Motwani Sudan Szegedy 1998: Proof verification and the hardness of approximation problems

Additional on self-correction:

2017.03.16

Reducing Query Complexity 4

reducing alphabet size at expense of queries:
- PCPc,s[r,q]Σ ⊆ PCPc,s[r,q log |Σ|]{0,1}
binary alphabet and two queries and perfect completeness is easy:
- PCP1,s[r,2]{0,1} ⊆ P via reduction to 2SAT
reducing queries at expense of alphabet size:
- PCPc,1-ε[r,q]Σ ⊆ PCPc,1-ε/q[r+log(q),2]Σq
- corollary: ∃ ε and a,b s.t. NP ⊆ PCP1,1-ε[a log(n),2]{0,1}b
sequential repetition:
- ∀ t, PCPc,s[r,q]Σ ⊆ PCPc,st[tr,tq]Σ
- reduces soundness error at expense of queries
parallel repetition (statement only):
- ∀ s ∃ σ ∀ t, PCPc,s[r,2]Σ ⊆ PCPc,σt[tr,2]Σt
- reduces soundness error at expense of alphabet size
- corollary: ∃ a,b ∀ s, NP ⊆ PCP1,s[a log(n) log(1/s),2]{0,1}b log(1/s)
sliding scale conjecture:
- statement: ∀ s>1/n, NP ⊆ PCP1,s[O(log(n)),O(1)]{0,1}O(log(1/s))
why parallel repetition is non-trivial:
- equivalence with 2-prover 1-round games
- Feige's "non-interactive agreement" counterexample

Lecture notes:

Additional on 'counterexample':

Feige 1991: On the success probability of the two provers in one-round proof systems

Additional on parallel repetition

Towards the sliding scale conjecture:

2017.03.21

Reducing Query Complexity 5

Verbitsky's Theorem
- combinatorial lines
- Furstenberg–Katznelson Theorem (statement only)
- value of repeated game is the density of largest line-free set
- why it generalizes to more than two provers/players
parallel repetition yields 3-query PCPs over binary alphabets
- ∀ δ>0, NP ⊆ PCP1,7/8+δ[O(log n),3]{0,1}
  * and the verifier's predicate is the OR of three bits
  * yields optimal hardness of approximating MAX-E3-SAT
  * [H01, Theorem 6.5]
- ∀ ε,δ>0, NP ⊆ PCP1-ε,1/2+δ[O(log n),3]{0,1}
  * and the verifier's predicate is the XOR of three bits
  * yields optimal hardness of approximating MAX-E3-LIN-2
  * [H01, Theorem 5.4]
introduction to Fourier analysis of boolean functions [H01, Section 2.4]
- linear functions are an orthonormal basis
- Fourier expansion
- Plancherel's Theorem
- Parseval's Theorem

Main on parallel repetition:

Verbitsky 1996: Towards the parallel repetition conjecture

Additional on explicit bounds for Furstenberg–Katznelson:

Polymath 2010: A new proof of the density Hales-Jewett theorem

More on Fourier analysis of boolean functions:

Additional on 3-query PCPs:

Håstad 2001: Some optimal inapproximability results

2017.03.23

Reducing Query Complexity 6

using Fourier analysis of boolean functions:
- linearity testing with 0.5+δ agreement
- dictator testing with c=1-ε and s=0.5+δ with 3LIN predicate
unique games conjecture (statement only)
∀ ε,δ>0, NP ⊆ PCP1-ε,1/2+δ[O(log n),3]{0,1}
- and the verifier's predicate is the OR of three bits
- proof assumes UGC (only for simplicity)

Lecture notes:

Main:

Håstad 2001: Some optimal inapproximability results

Additional:

Bellare Goldreich Sudan 2006: Free bits, PCPs, and nonapproximability --- towards tight results

2017.03.28

No class (spring break).

2017.03.30

No class (spring break).

2017.04.04

Reducing Proof Length 1

the proof length in the LDE-PCP
- recall LDE-PCP from a few lectures ago
- reduction from NEXP to OSAT causes cubic blowup
- reduction from vanishing to sumcheck causes quadratic blowup
idea: structure computation via "programmable" structured CSPs
routing networks
- butterfly networks and their reverses
- Beneš networks (butterfly network concatenated with its reverse)
- routing algorithm for Beneš networks

On proof length vs query complexity:

Babai Fortnow Levin Szegedy 1991: Checking computations in polylogarithmic time
- achieving proof T1+ε with (log T)O(1/ε) queries for NTIME(T)

On Beneš networks:

Waksman 1968: A permutation network
- proof and algorithm for the Beneš network
Nassimi Sahni 1982: Parallel algorithms to set up the Beneš permutation network
- O(k2) parallel algorithm to compute the switch settings

Additional on the limits of PCP proof length:

Fortnow Santhanam 2007: Infeasibility of Instance Compression and Succinct PCPs for NP
- SAT is unlikely to have PCPs with length that is polynomial in the number of variables (as opposed to the number of clauses)
Kalai Raz 2008: Interactive PCP
- "PCP followed by an IP" allows circumventing the above limitation

2017.04.06

Reducing Proof Length 2

structuring 3SAT via routing networks
univariate algebraic CSP (UACSP)
- [BS08, Definition 3.6]
PCP based on UACSP
- reduces to proximity testing to Reed--Solomon code
- [BS08, Section 3.3.1]
univariate arithmetization
- from domino tiling to UACSP
- [BS08, Section 5.1]

Lecture notes:

Lecture 6 and 7 of Ben-Sasson's 2007 course

More on efficient NP reductions (using sorting or routing):