Strong ETH Breaks With Merlin and Arthur. Or: Short Non-Interactive Proofs of Batch Evaluation

Transcription

1 Strong ETH Breaks With Merlin and Arthur Or: Short Non-Interactive Proofs of Batch Evaluation Ryan Williams Stanford

2 Two Stories Story #1: The ircuit and the Adversarial loud. Given: a 1,, a K F n Want: a 1,, a K F Let me do it! Would naively take ~ s K time / n variables = Arithmetic ircuit over +, in field F omputes some polynomial x 1,, x n F x 1,, x n of degree d

3 Two Stories Story #1: The ircuit and the Adversarial loud. Given: a 1,, a K F n Want: a 1,, a K F a 1 = 0,, a K = 0 You owe me $200. / n variables = Arithmetic ircuit over +, in field F omputes some polynomial x 1,, x n F x 1,, x n of degree d

4 Two Stories Story #1: The ircuit and the Adversarial loud. Given: a 1,, a K F n Want: a 1,, a K F a 1 = 0,, a K = 0 You owe me $200. / n variables How can very quickly check the work of the loud? (without just doing the work himself ) IP = PSPAE [LFKN 92, Shamir 92] - intractable provers Delegating omputation [GKR 08,,RRR 16] O(1)-round interactive proofs for low-depth ckts with fast verification

5 Two Stories Story #1: The ircuit and the Adversarial loud. Given: a 1,, a K F n Want: a 1,, a K F Note the input itself is K n + s size NON-INTERATIVE! Deg. d / n variables Thm: Verifier alg. where for all x 1,, x n and a 1,, a K F n, There is a proof of length O(K d) the loud can send, along with values a 1,, a K F, such that dk F The Verifier can toss poly log coins and check the proof in about O(K n + d + s) time, with probability of error ε. ε

6 Two Stories Story #2: The Many Exponential Time Hypotheses. Once upon a time 3-SAT = { satisfiability of formulas in NF, all clauses have at most 3 literals} Exponential Time Hypothesis (ETH) [IPZ 01] : 3-SAT requires at least 2 αn (randomized) time, for some α > 0 (n = # of variables in the formula) Best known 3-SAT algorithm: about n time Vast strengthening of P NP

7 Many Exponential-Time Lower Bounds, assuming ETH! Assuming ETH, the problems Independent Set, lique, Vertex over, Dominating Set, Graph oloring, Max ut, Set Splitting, Hitting Set, Min Bisection, Feedback Vertex Set, Hamiltonian Path, Max Leaf Spanning Tree, Subset Sum, Knapsack, 3-Dimensional Matching, luster Editing, Treewidth and many others do not have 2 o(n) time algorithms. (Note: Not easy! These do not follow from typical NP-completeness reductions)

8 ould We Predict the Exact Exponents of Running Times? Find evidence that 3-SAT is not in n time? (Note for n 10 8, n is pretty small!) Assuming ETH, we can distinguish between runtimes like 2 n and 2 n/log n, but not between 1.2 n and 1.3 n Need a stronger ETH... Best known k-sat algorithms: 2 n n/o(k) time Achieved by four different algorithmic paradigms!

9 Strong Exponential Time Hypothesis (SETH) [IP 01,IP 09] SETH: For every ε > 0 there exists a k 3 such that Satisfiability of k-nfs requires (2-ε) n time. Theorem: SETH ETH An even more productive hypothesis! Tight lower bounds on many natural polynomial-time tasks, edit distance [BI 15], LS [ABV 15], dynamic graph algorithms [AV 14], many refs very recently! Refuting SETH new circuit lower bounds [JMV] (Valiant series-parallel circuits)

10 Nondeterministic Strong ETH (NSETH) [GIMPS 16] NSETH: For every ε > 0 there exists a k 3 such that refuting unsatisfiable k-nfs requires (2-ε) n nondeterministic time. We cannot (yet?) refute this. But we can lay some other conjectures to rest MA-SETH AM-SETH We hardly knew ye

11 Non-Interactive Proofs of UNSAT That Beat Exhaustive Search Thm: There is a proof system for UNSAT such that every UNSAT Boolean formula of poly(n) size has a proof of length ~ 2 n/2 verifiable with poly(n) bits of randomness in ~ 2 n/2 time. (an even count SAT assignments) If this proof system can be de-randomized then NSETH is false! The derandomization problem reduces to an interesting univariate polynomial identity test

12 Thm: For all x 1,, x n and all a 1,, a K F n, there is a Verifier alg: There is a proof of length O(K d) the loud can send, along with values a 1,, a K F, such that the Verifier can toss poly log dk F coins and check the proof in ε about O(K n + d + s) time, with probability of error ε. Given: a 1,, a K F n Want: a 1,, a K F Naively takes ~ s K time get ~ s + K Degree d n variables / Idea: Define a univariate polynomial that simulates evaluation of on the a i Degree d n variables

13 Thm: For all x 1,, x n and all a 1,, a K F n, there is a Verifier alg: There is a proof of length O(K d) the loud can send, along with values a 1,, a K F, such that the Verifier can toss poly log dk F coins and check the proof in ε about O(K n + d + s) time, with probability of error ε. Given: a 1,, a K F n Want: a 1,, a K F Naively takes ~ s K time get ~ s + K Degree d n variables / Idea: Define a univariate polynomial that simulates evaluation of on the a i p 1 (x) p 2 (x) Degree d The loud sends this polynomial Q(x), of degree K d. Verifier: 1. Evals Q β 1,, Q β K to get a 1,, a K 2. Picks random r F, F large extension of F 3. hecks Q r = p 1 (r),, p n (r). p n 1 p (x) degree K polys. Let β 1,, β K F be distinct. for all i = 1,, n, & j = 1,, K, p i β j = α j i

14 Given: a 1,, a K F n Want: a 1,, a K F Would naively take s K time to compute Idea: Define a univariate polynomial that simulates evaluation of on the a i Q x : = p 1 (x) p 2 (x) Degree d The loud sends Q (x), of degree K d Verifier: 1. Evaluates Q β 1,, Q β K to obtain the values a 1,, a K [ Use Fast Fourier Transform: O K d time] 2. Picks unifom random r F, where p n 1 p (x) degree K polynomials For all i, j, p i β j = α j i for distinct β 1,, β K F poly dk F ε F is an extension field of F 3. hecks Q r = p 1 (r),, p n (r) [ Evaluate each p i on r, then evaluate Takes O s + K n time] orrectness: [Euler??] For every pair p(x), q(x) of distinct polynomials of degree D, p(r) = q(r) for D + 1 points r.

15 Thm: There is a proof system for UNSAT such that every UNSAT Boolean formula of poly(n) size has a proof of length ~ 2 n/2 verifiable with poly(n) bits of randomness in ~ 2 n/2 time. Proof: Let F be a field of char 2 n. Given a Boolean formula B: 1. Arithmetize B: WLOG, B has O log n depth. Define n-variate polynomial P over F equivalent to B (over 0, 1 n ) by replacing a b a b, a b a + b a b, a (1 a) For all a 0, 1 n, P a 1,, a n = B a 1,, a n 2. Partial-Sum P: Define a new polynomial P in n/2 variables: P x 1,, x n/2 a n/2+1,,a n {0,1} P x 1,, x n/2, a n/2+1,, a n Note that degree(p ) poly(n) and size(p ) 2 n/2 poly(n) 3. Apply Protocol! loud proves that P a = 0 for all a 0, 1 n/2 The proof is a polynomial Q y of degree poly(n) 2 n/2 over F such that Q β i = P a i, where a i 0, 1 n/2. Verifier checks Q(β i ) = 0 on all 2 n/2 relevant points.

16 onclusion Similar results hold for Permanent, ounting liques,., any problem in the class VNP 3-Round (AMA) proof system for QBF in 2 3n/4 time Are there more tombstones? Suppose we are given two arithmetic circuits (x), D(x) of size n, degree n, and one variable x. Testing whether D is easy: O n 2 deterministic time O n randomized time an D be tested in O n A yes answer NSETH is false! time? Thank you!