CS151 Complexity Theory. Lecture 13 May 15, 2017

Transcription

1 CS151 Complexity Theory Lecture 13 May 15, 2017

2 Relationship to other classes To compare to classes of decision problems, usually consider P #P which is a decision class easy: NP, conp P #P easy: P #P PSPACE Toda s Theorem (homework): PH P #P. May 15,

3 Relationship to other classes Question: is #P hard because it entails finding NP witnesses? or is counting difficult by itself? May 15,

4 Bipartite Matchings Definition: G = (U, V, E) bipartite graph with U = V a perfect matching in G is a subset M E that touches every node, and no two edges in M share an endpoint May 15,

5 Bipartite Matchings Definition: G = (U, V, E) bipartite graph with U = V a perfect matching in G is a subset M E that touches every node, and no two edges in M share an endpoint May 15,

6 Bipartite Matchings #MATCHING: given a bipartite graph G = (U, V, E) how many perfect matchings does it have? Theorem: #MATCHING is #P-complete. But can find a perfect matching in polynomial time! counting itself must be difficult May 15,

7 Cycle Covers Claim: 1-1 correspondence between cycle covers in G and perfect matchings in G #MATCHING and #CYCLE-COVER parsimoniously reducible to each other G = (U, V, E) May 15, G = (V, E ) 3 4

8 Cycle Covers cycle cover: collection of node-disjoint directed cycles that touch every node #CYCLE-COVER: given directed graph G = (V, E) how many cycle covers does it have? Theorem: #CYCLE-COVER is #P-complete. implies #MATCHING is #P-complete May 15,

9 Cycle Cover is #P-complete variable gadget: every cycle cover includes left cycle or right cycle clause gadget: cycle cover cannot use all three outer edges and each of 7 ways to exclude at least one gives exactly 1 cover using those external edges May 15, x i x i

10 Cycle Cover is #P-complete May 15,

11 Cycle Cover is #P-complete May 15,

12 Cycle Cover is #P-complete clause gadget corresponding to (A B C) has xor gadget between outer 3 edges and A, B, C u v xor v u A A B B xor gadget ensures that exactly one of two edges can be in cover C C May 15,

13 Cycle Cover is #P-complete Proof outline (reduce from #SAT) ( x 1 x 2 x 3 ) ( x 3 x 1 ) (x 3 x 2 ) xor gadgets (exactly 1 of two edges is in cover)... clause gadgets x 1 x 1 x 2 x 2 x 3 x 3 N.B. must avoid reducing SAT to MATCHING! variable gadgets May 15,

14 Cycle Cover is #P-complete Introduce edge weights cycle cover weight is product of weights of its edges implement xor gadget by weight of cycle cover that obeys xor multiplied by 4 (mod N) weight of cycle cover that violates xor multiplied by N large integer May 15,

15 Cycle Cover is #P-complete Weighted xor gadget: N-1 u v xor v u weight of cycle cover that obeys xor multiplied by 4 (mod N) weight of cycle cover that violates xor multiplied by N u v (unlabeled weights are 1) N-1 N v u May 15,

16 Cycle Cover is #P-complete Simulating positive edge weights need to handle 2, 3, 4, 5,, N k k times 3 May 15,

17 Cycle Cover is #P-complete ( x 1 x 2 x 3 ) ( x 3 x 1 ) (x 3 x 2 ) xor gadget (exactly 1 of two edges is in cover)... clause gadget variable gadgets: x 1 x 1 x 2 x 2 x 3 x 3 m = # xor gadgets; n = # variables; N > 4 m 2 n # covers (mod N) = (4 m ) (#sat. assignments) May 15,

18 New Topic proof systems interactive proofs and their power Arthur-Merlin games May 15,

19 Proof systems L = { (A, 1 k ) : A is a true mathematical assertion with a proof of length k} What is a proof? complexity insight: meaningless unless can be efficiently verified May 15,

20 Proof systems given language L, goal is to prove x L proof system for L is a verification algorithm V completeness: x L 9 proof, V accepts (x, proof) true assertions have proofs soundness: x L 8 proof*, V rejects (x, proof*) false assertions have no proofs efficiency: 8 x, proof: V(x, proof) runs in polynomial time in x May 15,

21 Classical Proofs previous definition: recall: classical proof system L NP iff expressible as L = { x 9y, y < x k, (x, y) R } and R P. NP is the set of languages with classical proof systems (R is the verifier) May 15,

22 Interactive Proofs Two new ingredients: randomness: verifier tosses coins, errs with some small probability interaction: rather than reading proof, verifier interacts with computationally unbounded prover NP proof systems lie in this framework: prover sends proof, verifier does not use randomness May 15,

23 Interactive Proofs interactive proof system for L is an interactive protocol (P, V) Prover common input: x Verifier... # rounds = poly( x ) accept/ reject May 15,

24 Interactive Proofs interactive proof system for L is an interactive protocol (P, V) completeness: x L Pr[V accepts in (P, V)(x)] 2/3 soundness: x L 8 P* Pr[V accepts in (P*, V)(x)] 1/3 efficiency: V is p.p.t. machine repetition: can reduce error to any ε May 15,

25 Interactive Proofs IP = {L : L has an interactive proof system} Observations/questions: philosophically interesting: captures more broadly what it means to be convinced a statement is true clearly NP IP. Potentially larger. How much larger? if larger, randomness is essential (why?) May 15,

26 Graph Isomorphism graphs G 0 = (V, E 0 ) and G 1 = (V, E 1 ) are isomorphic (G 0 G 1 ) if exists a permutation π:v V for which (x, y) E 0 (π(x), π(y)) E May 15,

27 Graph Isomorphism GI = {(G 0, G 1 ) : G 0 G 1 } in NP not known to be in P, or NP-complete GNI = complement of GI not known to be in NP Theorem (GMW): GNI IP indication IP may be more powerful than NP May 15,

28 GNI in IP interactive proof system for GNI: Prover if H G 0 r = 0, else r = 1 input: (G 0, G 1 ) H = π(g c ) r Verifier flip coin c {0,1}; pick random π accept iff r = c May 15,

29 GNI in IP completeness: if G 0 not isomorphic to G 1 then H is isomorphic to exactly one of (G 0, G 1 ) prover will choose correct r soundness: if G 0 G 1 then prover sees same distribution on H for c = 0, c = 1 no information on c any prover P* can succeed with probability at most 1/2 May 15,

30 The power of IP We showed GNI 2 IP GNI IP suggests IP more powerful than NP, since we don t know how to show GNI in NP GNI in conp Theorem (LFKN): conp IP May 15,

31 The power of IP Proof idea: input: φ(x 1, x 2,, x n ) prover: I claim φ has k satisfying assignments true iff φ(0, x 2,, x n ) has k 0 satisfying assignments φ(1, x 2,, x n ) has k 1 satisfying assignments k = k 0 + k 1 prover sends k 0, k 1 verifier sends random c {0,1} prover recursively proves φ = φ(c, x 2,, x n ) has k c satisfying assignments at end, verifier can check for itself. May 15,

32 The power of IP Analysis of proof idea: Completeness: φ(x 1, x 2,, x n ) has k satisfying assignments accept with prob. 1 Soundness: φ(x 1, x 2,, x n ) does not have k satisfying assigns. accept prob n Why? It is possible that k is only off by one; verifier only catches prover if coin flips c are successive bits of this assignment May 15,

33 The power of IP Solution to problem (ideas): replace {0,1} n with (F q ) n verifier substitutes random field element at each step vast majority of field elements catch cheating prover (rather than just 1) Theorem: L = { (φ, k): CNF φ has exactly k satisfying assignments} is in IP May 15,

34 The power of IP First step: arithmetization transform φ(x 1, x n ) into polynomial p φ (x 1, x 2, x n ) of degree d over a field F q ; q prime > 2 n recursively: x i x i φ (1 - p φ ) φ φ (p φ )(p φ ) φ φ 1 - (1 - p φ )(1 - p φ ) for all x {0,1} n we have p φ (x) = φ(x) degree d φ can compute p φ (x) in poly time from φ and x May 15,

35 The power of IP Prover wishes to prove: k = Σ x1 = 0, 1 Σ x 2 = 0,1 Σ xn = 0, 1 p φ (x 1, x 2,, x n ) Define: k z = Σ x2 = 0,1 Σ xn = 0, 1 p φ (z, x 2,, x n ) prover sends: k z for all z F q verifier: checks that k 0 + k 1 = k sends random z F q continue with proof that k z = Σ x2 = 0,1 Σ xn = 0, 1 p φ (z, x 2,, x n ) at end: verifier checks for itself May 15,

36 The power of IP Prover wishes to prove: k = Σ x1 = 0, 1 Σ x 2 = 0,1 Σ xn = 0, 1 p φ (x 1, x 2,, x n ) Define: k z = Σ x2 = 0,1 Σ xn = 0, 1 p φ (z, x 2,, x n ) a problem: can t send k z for all z F q solution: send the polynomial! recall degree d φ May 15,

37 The actual protocol input: (φ, k) Prover p 1 (x) p 1 (x) = Σ x2,,x n {0,1} p φ (x, x 2,, x n ) p 2 (x) = Σ x3,,x n {0,1} p φ (z 1, x, x 3,, x n ) p 2 (x) z 2 z 1 Verifier p 1 (0)+p 1 (1)=k? pick random z 1 in F q p 2 (0)+p 2 (1)=p 1 (z 1 )? pick random z 2 in F q p 3 (x) = Σ x4,,x n {0,1} p φ (z 1, z 2, x, x 4, x n ) p 3 (x) p 3 (0)+p 3 (1)=p 2 (z 2 )?. pick random z 3 in F q. p n (x) p n (0)+p n (1)=p n-1 (z n-1 )? p n (z n ) = p φ (z 1, z 2,, z n )? pick random z n in F q May 15,

38 Analysis of protocol Completeness: if (φ, k) L then honest prover on previous slide will always cause verifier to accept May 15,

39 Analysis of protocol Soundness: let p i (x) be the correct polynomials let p i *(x) be the polynomials sent by (cheating) prover (φ, k) L p 1 (0) + p 1 (1) k either p 1 *(0) + p 1 *(1) k (and V rejects) or p 1 * p 1 Pr z1 [p 1 *(z 1 ) = p 1 (z 1 )] d/q φ /2 n assume (p i+1 (0)+p i+1 (1)= ) p i (z i ) p i *(z i ) either p i+1 *(0) + p i+1 *(1) p i *(z i ) (and V rejects) or p i+1 * p i+1 Pr zi+1 [p i+1 *(z i+1 ) = p i+1 (z i+1 )] φ /2 n May 15,

40 Analysis of protocol Soundness (continued): if verifier does not reject, there must be some i for which: p i * p i and yet p i *(z i ) = p i (z i ) for each i, probability is φ /2 n union bound: probability that there exists an i for which the bad event occurs is n φ /2 n poly(n)/2 n << 1/3 May 15,

41 Analysis of protocol Conclude: L = { (φ, k): CNF φ has exactly k satisfying assignments} is in IP L is conp-hard, so conp IP Question remains: NP, conp IP. Potentially larger. How much larger? May 15,

42 IP = PSPACE Theorem: (Shamir) IP = PSPACE Note: IP PSPACE enumerate all possible interactions, explicitly calculate acceptance probability interaction extremely powerful! An implication: you can interact with master player of Generalized Geography and determine if she can win from the current configuration even if you do not have the power to compute optimal moves! May 15,