How proofs are prepared at Camelot

Transcription

1 How proofs are prepared at Camelot Andreas Björklund Lund University Petteri Kaski Aalto University Fine-Grained Complexity and Algorithm Design Reunion Simons Institute, UC Berkeley 15 December 2016

2 Fine-grained design and analysis of proof systems Nondeterministic strong exponential-time hypothesis (Carmosino, Gao, Impagliazzo, Mihajlin, Paturi, Schneider 2016) fine-grained design & analysis with a deterministic verifier Merlin Arthur proofs of batch evaluation (Williams 2016) fine-grained design & analysis with a randomized verifier SETH breaks with Merlin and Arthur

3 (Noninteractive) proofs Claim [Clipart: Merlin] Proof [Clipart: Arthur] Prover Verifier

4 Completeness, (probabilistic) soundness, ease of verification Claim [Clipart: Merlin] Proof [Clipart: Arthur] Prover Verifier

5 SETH fails with Merlin and Arthur (Williams 2016) Claim (#CNFSAT): This n-variable CNF-formula φ has exactly A satisfying [Clipart: Merlin] assignments [Clipart: Arthur] Proof string Pφ of length O*(2 n/2 ) Runs in time O*(2 n/2 ), always accepts correct proof, rejects bad proof w.h.p.

6 But what if Merlin is taking [Clipart: Arthur panic] a vacation? (How powerful does the prover need to be?)

7 Interactive proofs for muggles 1 [Goldwasser, Kalai, Rothblum 2015] Claim [Clipart: Polynomial-time prover] [Clipart: lowerpolynomial-time verifier] Prover Verifier 1 In the fiction of J. K. Rowling: a person who possesses no magical powers (Oxford English Dictionary)

8 [Clipart: Merlin] [Clipart: Arthur] [Clipart: Merlin] [Clipart: Arthur] [Clipart: Arthur] [Clipart: Arthur]

9 K Knights prepare the proof, in parallel (+ any single Knight can verify the proof, probabilistically, using about the same effort that he put into the preparation) Claim [Clipart: Knights around the Round Table of Camelot] Proof [Clipart: Arthur]

10 Modern computers are parallel Titan (Oak Ridge) #3 top500.org Courtesy of Oak Ridge National Laboratory, U.S. Department of Energy. Image in the public domain. (18,688 GPUs, 50,233,344 cores)

11 Modern computers make (some) errors [Clipart: faulty prover] [Figure 2 from Tiwari et al.] Tiwari et al. Supercomputing 15

12 Proof preparation Courtesy of Oak Ridge National Laboratory, U.S. Department of Energy. Image in the public domain. Preparation takes place in parallel Errors may occur

13 Proof verification Can error-correct proof? Always accept good proof Reject bad proof w.h.p.

14 What is the overhead for parallel proof preparation and error-tolerance? (Compared with best sequential algorithm that just solves the problem on error-free hardware)

15 Camelot [Clipart: Knights around the Round Table of Camelot] KE = Õ(T) T = best known sequential runtime K = number of Knights E = effort (runtime) of each Knight

16 Camelot algorithms for e.g. Permanent, #Hamiltonian cycles, #Orthogonal vectors, are implicit in Williams (2016) [Björklund & K. 2016]: Replace Merlin with mere Knights + more Camelot algorithms e.g. #k-clique, #triangles, #Graph Coloring,

17 Example: Camelot algorithm for #6-clique (Björklund & K. 2016) KE = Õ(T) [Clipart: Knights around the Round Table of Camelot] T = O(n 2ω+ε ) for any constant ε>0 = best known sequential runtime (Nešetřil & Poljak 1985) K = O(n ω+ε ) = number of Knights E = Õ(n ω+ε ) = effort of each Knight for any constant ε >0 ω = limn (log rk0 <n,n,n>)/(log n)

18 G [Clipart: Knights around the Round Table of Camelot] Proof (ξ1,pg(ξ1)), (ξ2,pg(ξ2)),, (ξk,pg(ξk)) The proof is a list of K evaluations of a degree d univariate polynomial p G (x) K d+1 (modulo q, for 3 distinct primes q, with q d+1) d = ϴ(n ω+ε ) Effort to evaluate pg(x) at a given point x=ξ: E = Õ(n ω+ε )

19 To design a Camelot algorithm is to design (i) the low-degree proof polynomial p (x), and G (ii) a fast algorithm for computing p (ξ) G given x=ξ and G as input Error-correcting the proof: Reed-Solomon decoding (using Gao s (2003) fast decoder) Proof verification: Polynomial identity testing (using (ii) to randomly access the true polynomial)

20 Near-linear-time toolbox for univariate polynomials Addition Multiplication Division (quotient and remainder) Batch evaluation (at d+1 given points) Interpolation (from d+1 given evaluations) Extended Euclid (gcd) Õ(d) operations for inputs of degree at most d [These algorithms are practical]

21 Fast interpolation from (partly) erroneous data Interpolation of degree d polynomial from K given evaluations, when at most (K d 1)/2 evaluations are in error Runs in Õ(K) operations, uses one (error-free) interpolation one extended Euclid one division [This is a practical algorithm] (Gao 2003)

22 To design a Camelot algorithm is to design (i) the low-degree proof polynomial p (x), and G (ii) a fast algorithm for computing p (ξ) G given x=ξ and G as input pg(x) for #6-cliques?

23 The 15-linear form (~ #6-cliques) Let be an N N matrix We seek to compute the 6 2 -linear form X ( 6 2) = X a,b,c,d,e,f ab ac ad ae af bc bd be bf cd ce cf de df ef A direct evaluation takes O(N 6 ) operations c b d a e f

24 Nešetřil & Poljak (1985) algorithm Nešetřil and Poljak (1985) observe that we can precompute the three N 2 N 2 matrices U ab,cd = ab ac ad bc bd S ab,ef = ae af be bf ef T cd,ef = cd ce cf de df and then use fast matrix multiplication to compute X ( 6 2) = X a,b,c,d U ab,cd V ab,cd, V ab,cd = X e,f S ab,ef T cd,ef This takes O(N 2!+ ) operations for any constant > 0

25 New evaluation formula (Björklund & K. 2016) Nešetřil & Poljak (1985) formula appears not to split naturally into O(N ω+ε ) parts with O(N ω+ε ) effort each We want such a formula ideally it should be a simple sum of O(N ω+ε ) terms, with O(N ω+ε ) effort to prepare each term Such a formula exists, and it extends to a univariate proof polynomial P(x)

26 Trilinear decomposition of <N,N,N> For d, e, f =1, 2,...,N and r =1, 2,...,R let de (r), ef (r), df (r) be integers that satisfy the polynomial identity X RX X X X d,e,f u de v ef w df = r=1 d,e 0 de 0(r)u de 0 e,f 0 ef 0 (r)v ef 0 d 0,f d 0 f (r)w d 0 f We can assume that R = O(N!+ ) for an arbitrary constant > 0 Furthermore, the N 2 R matrices,, are Kronecker powers of matrices of size O(1) Example: Strassen s 4 x 7 trilinear decomposition of <2,2,2> α0 = β0 = γ0 =

27 New evaluation formula (Björklund & K. 2016) For each r =1, 2,...,R, compute, using fast matrix multiplication, H ad (r) = X e 0 de 0(r) ae 0 de 0, A ab (r) = X d ad bdh ad (r), K be (r) = X f 0 ef 0 (r) bf 0 ef 0, B bc (r) = X e be cek be (r), L cf (r) = X d 0 d 0 f (r) cd 0 d 0 f, C ac (r) = X f af cf L cf (r) Finally, compute, again using fast matrix multiplication, Q ab (r) = X c ac bcb bc (r)c ac (r), P (r) = X a,b aba ab (r)q ab (r) Each term P (r) takes O(N!+ ) operations to compute

28 New evaluation formula (Björklund & K. 2016) Theorem. X ( 6 2) = P R r=1 P (r) Proof. Extension to Camelot : The integer values P(r) extend to a degree-at-most 3R polynomial P(x) that admits, using Yates s (1937) algorithm, an evaluation algorithm that for a given x 0 computes P(x 0 ) mod q in O(N ω+ε ) operations mod q RX r=1 P (r) = RX r=1 X a,b,c ab ac bca ab (r)b bc (r)c ac (r) RX X = X X ab ac bc de 0 (r) ad ae 0 bd de 0 ef 0 (r) be bf 0 ce ef 0 r=1 a,b,c d,e 0 e,f 0 d 0,f, = X a,b,c = X a,b,c ab ac bc ab ac bc RX X X de 0 (r) ad ae 0 bd de 0 d,e 0 X r=1 ad ae af bd be bf cd ce cf de df ef d,e,f X e,f 0 ef 0 (r) be bf 0 ce ef 0 d 0 f (r) af cd 0 cf d 0 f X d 0 f (r) af cd 0 cf d 0 f d 0,f

29 CAMELOT ALGORITHMS (IMPLICIT, WILLIAMS 2016) #CNF-SAT Matrix permanent #Hamiltonian cycles #Orthogonal vectors Closest pairs in Hamming metric CAMELOT ALGORITHMS (BJÖRKLUND & K. 2016) Polynomial extension of many fastest known sequential algorithms k-clique [Nešetřil & Poljak 1985] graph colouring [Björklund et al. 2006, 2009] triangle counting in sparse graphs** [Itai & Rodeh 1978] [Alon, Yuster & Zwick 1997] Tutte polynomial** [Björklund et al. 2008] (** We almost match the best sequential running time)

30 [Clipart: Arthur] [Clipart: Merlin] THANK YOU