2 IP[poly] = PSPACE [Sha92]. However, the

Transcription

1 Pollogarithmic-round Interactive Proofs for conp Collapse the Exponential Hierarch Alan L. Selman Department of Computer Science and Engineering Universit at Buffalo, Buffalo, NY 1460 Samik Sengupta Department of Computer Science and Engineering Universit at Buffalo, Buffalo, NY 1460 Februar 3, 004 Abstract It is known [BHZ87] that if ever language in conp has a constant-round interactive proof sstem, then the polnomial hierarch collapses. On the other hand, Lund et al. [LFKN9] have shown that #SAT, the #P-complete function that outputs the number of satisfing assignments of a Boolean formula, can be computed b a linear-round interactive protocol. As a consequence, the conp-complete set SAT has a proof sstem with linear rounds of interaction. We show that if ever set in conp has a pollogarithmic-round interactive protocol then the exponential hierarch collapses to the third level. In order to prove this, we obtain an exponential version of Yap s result [Yap83], and improve upon an exponential version of the Karp-Lipton theorem [KL80], obtained first b Buhrman and Homer [BH9]. 1 Introduction Bábai [Báb85] and Bábai and Moran [BM88] introduced Arthur-Merlin Games to stud the power of randomiation in interaction. Soon afterward, Goldwasser and Sipser [GS89] showed that these classes are equivalent in power to Interactive Proof Sstems, introduced b Goldwasser et al. [GMR85]. Stud of interactive proof sstems and Arthur-Merlin classes has been exceedingl successful [ZH86, BHZ87, ZF87, LFKN9, Sha9], eventuall leading to the discover of Probabilisticall Checkable Proofs [BOGKW88, LFKN9, Sha9, BFL81, BFLS91, FGL + 91, AS9, ALM + 9]. Interactive proof sstems are successfull placed relative to traditional complexit classes. In particular, it is known that for an constant k, IP[k] Π p [BM88], and IP[pol] = PSPACE [Sha9]. However, the relationship between conp and interactive proof sstems is not entirel clear. On the one hand, Boppana, Håstad and Zachos [BHZ87] proved that if ever set in conp has a constant-round interactive proof sstem, then the polnomial-time hierarch collapses below the second level. On the other hand, the best interactive protocol for an language in conp comes from the result of Lund et al. [LFKN9], who show that #SAT, a problem hard for the entire polnomial-time hierarch [Tod91], is accepted b an interactive proof sstem with O(n) rounds of interaction on an input of length n. Can ever set in conp be accepted b an interactive Research partiall supported b NSF grant CCR selman@cse.buffalo.edu samik@cse.buffalo.edu 1

2 proof sstem with more that constant but sublinear number of rounds? Answering this question has been the motivation for this paper. We show in this paper that conp cannot have a pollogarithmic-round interactive proof sstem unless the exponential hierarch collapses to the third level, i.e., NEXP Σp = conexp Σ p. Three principal steps lead to the proof of our main result, and these results are of independent interest. Note that although we use Arthur-Merlin protocols to obtain our results, our main theorem holds for interactive proof sstems as well due to the result of Goldwasser and Sipser [GS89], who showed that an interactive proof sstem with m rounds can be simulated b an m + 4-move Arthur-Merlin protocol. An Arthur-Merlin protocol with m moves where both Arthur and Merlin exchange at most l(n) bits at ever move can be simulated b a two-move AM protocol where Arthur moves first and uses O(l(n) m 1 ) random bits (Theorem 3.1). If L is accepted b a two-move AM protocol where Arthur uses pollog random bits, then L belongs to the advice class NP/ pollog (Lemma 3.3). If conp NP/ pollog (equivalentl NP conp/ pollog ) then NEXP Σp = conexp Σ p = S exp P NP (Theorem 4.1). In addition to these results, we improve upon a result of Buhrman and Homer [BH9], showing that if NP has pollog -sie famil of circuits, then NEXP NP = conexp NP = S EXP. We note that Goldreich and Håstad [GH98] and Goldreich, Vadhan, and Wigderson [GVW01] have studied Arthur-Merlin games and interactive proof sstems with bounded message complexit. Their results are incomparable to our Theorem 3.1. In particular, our simulation of an m-move Arthur-Merlin protocol b a -move Arthur-Merlin protocol assumes that l, the number of message bits used in ever move, is polnomial in the length of the input, and we obtain that the number of random bits used b Arthur in the -move protocol is not exponential in l. This is crucial in order to get Theorem 4.1. Preliminaries For definitions of standard complexit classes, we refer the reader to Homer and Selman [HS01]. The exponential hierarch is defined as follows: EXP = Σ exp 0, NEXP = Σ exp 1, NEXP NP = Σ exp, and in general, for k 0, For ever k 0, Π exp k Σ exp k+1 = NEXPΣp k. = {L L Σ exp k }. We define pollog = k>0 logk n and pollog = k>0 logk n. Let C be a complexit class. A set L C/ pollog if there is a function s : 1 Σ, some constant k > 0, and a set A C such that 1. For ever n, s(1 n ) logk n, and. For all x, x L (x, s(1 x )) A. Here A is called the witness language.

3 It is eas to see that D C/ pollog if and onl if cod coc/ pollog. Bábai [Báb85] introduced Arthur-Merlin protocol, a combinatorial game that is plaed b Arthur, a probabilistic polnomial-time machine, and Merlin, a computationall unbounded Turing machine. Arthur can use random bits, but these bits are public, i.e., Merlin can see them and move accordingl. Given an input string x, Merlin tries to convince Arthur that x belongs to some language L. The game consists of a predetermined finite number of moves with Arthur and Merlin moving alternatel. In each move Arthur (or Merlin) prints a finite string on a read-write communication tape. Arthur s moves depend on his random bits. After the last move, Arthur either accepts or does not accept x. Definition.1 ([Báb85, BM88]) ever string x of length n For an m > 0, a language L is in AM[m] (respectivel MA[m]) if for The game consists of m moves Arthur (resp., Merlin) moves first After the last move, Arthur behaves deterministicall to either accept or not accept the input string If x L, then there exists a sequence of moves b Merlin that leads to the acceptance of x b Arthur with probabilit is at least 3 4 if x / L then for all possible moves of Merlin, the probabilit that Arthur accepts x 1 is less than 4. Bábai and Moran [BM88] showed that AM[k], where k > 1 is some constant, is the same as AM[] = AM. Note that MA[] = MA, AM[1] = BPP, and MA[1] = M = NP. Bábai [Báb85] proved that MA AM. Now we need to extend modestl the notion of Arthur-Merlin protocols. In the following limited manner, we consider the possibilit that Arthur is a probabilisitic Turing machine, but not necessaril polnomialtime-bounded. Let f : N N be some function. Then we define the class AM(f) to be the class of languages accepted b protocols in which there are onl two moves, Arthur moves first, and Arthur can use at most f(n) random bits on an input of length n. In particular, we will have occasion to consider f to be quasipolnomial; that is, we will consider the class AM( logc n ), where c is a positive constant. We note the following standard proposition. Proposition. Let E 3 be an event that occurs with probabilit at least. Then, for an polnomial 4 p( ) such that p(n) n, there is a constant c such that within t def = c p(n) independent trials, E occurs for t 1 more than times with probabilit (1 p(n) ). We define S exp as the exponential version of the S operator defined b Russell and Sundaram [RS98] and Canetti [Can96]. A set L is in S exp C if there is some k > 0 and A C such that for ever x {0, 1} n, x L = (x,, ) A, and x / L = (x,, ) / A, where, nk. def Similar to S P = S P, the class S exp C can be thought of as a game between two provers and a verifier. Let L S exp C. On an input x of length n, the Yes-prover attempts to show that x L, and the No-prover attempts to show that x / L. Both the proofs are at most exponentiall long in x. If x L, then there must be a proof b the es-prover (called a es-proof) that convinces the verifier that x L no matter what the proof provided b the no-prover (called a no-proof) is; smmetricall, if x / L, then there must exist some no-proof such that the verifier rejects x irrespective of the es-proof. For ever input x, 3

4 there is a es-prover and a no-prover such that exactl one of them is correct. The verifier has the abilit of the class C; for example, if C = P, then the verifier is a deterministic polnomial-time Turing machine, and if C = P NP, then the verifier is a polnomial-time oracle Turing machine with SAT as the oracle. It is also eas to see that if C is closed under complement, then S exp C is also closed under complement. We concentrate on the classes S EXP can be easil modified to show the following. def = S exp P and S exp P NP. The proofs of Russell and Sundaram Proposition.3 1. S EXP NEXP NP conexp NP.. NEXP NP conexp NP S exp P NP NEXP ΣP conexp Σ P. Proof We give a short proof of the second inclusion of item (). Note that since S exp P NP is closed under complement, it suffices to show that S exp P NP is a subset of NEXP ΣP. Let L S exp P NP ; therefore, k > 0, L P NP such that x L = (x,, ) L, and x / L = (x,, ) / L, where, x k. We define the language A = {(x,, 0 x k ) (x,, ) / L }. A is in Σ p. We define a NEXP machine N that decides L with A as an oracle. On input x, N guesses, x k, and accepts x if and onl if (x,, 0 x k ) / A. If x L, then for the correctl guessed, (x,, ) L for ever ; therefore, N accepts x. On the other hand, if x / L, then there is a such that for ever, (x,, ) / L, and therefore, (x,, 0 x k ) A and N rejects x. This completes the proof. 3 Arthur-Merlin Games with Pollogarithmic Moves In this section, we show that languages accepted b an Arthur-Merlin protocol with m moves where Arthur and Merlin exchange at most l(n) bits in ever move (on an input of length n) can be accepted b a twomove Arthur-Merlin protocol where Arthur moves first and uses O(l(n) m 1 ) random bits. This implies that if conp has a pollogarithmic-move Arthur-Merlin protocol, then conp can be accepted b a two-move Arthur-Merlin protocol where Arthur uses pollog random bits. As a consequence, using Lemma 3.3, we obtain that conp can be solved b nondeterministic polnomial-time machines with pollog -length advice. Theorem 3.1 Let m >, and let L AM[m] where on an input of length n, Arthur and Merlin exchange messages of length at most l(n) in ever move. Then there is a constant k m such that L AM(k m l(n) m 1 ). Proof We show this b induction on m. We assume that in an move during the interaction, Arthur and Merlin exchange at most l(n) bits. We will show the following stronger result. For m >, there is some constant k m such that 1. AM[m] AM(k m l(n) m 1 ) 4

5 . MA[m] AM(k m l(n) m 1 ) Our proof is reminiscent of the proof of MA AM. In order to help the reader understand the proof of Theorem 3.1, we digress to recall that proof. Let L MA. There is L P so that for an w {0, 1} n, where v, l(n). w L = v Pr [(w, v, ) L ] 3 4, and w / L = v Pr [(w, v, ) L ] 1 4, B Proposition. there exists some constant c > 0 such that if Arthur repeats its computation cl(n) times and takes the majorit vote, then it will get an error probabilit of at most Therefore, w L = v Pr[(w, v, ) L ] 1 1 w / L = v Pr[(w, v, ) L 1 ] l(n)+3, l(n)+3, and 1 l(n)+3. where cl(n). Now we want to switch quantifiers, i.e., Arthur should move first. When w is in L, there is at least one v for which 1 1 (w, v, ) l(n)+3 fraction of result in L. Therefore, for 1 1 l(n)+3 fraction of, the same v will result in acceptance of w. On the other hand, the maximum number of strings v, v l(n), provided b Merlin is l(n)+1. Therefore, when w / L, the fraction of for which there exists some v where (w, v, ) L 1 is at most l(n)+1 1 l(n)+3. Hence, we have the following: 4 w L = Pr [ v (w, v, ) L ] 1 1 l(n)+3 3 4, and w / L = Pr [ v (w, v, ) L ] 1 4, where cl(n). Therefore, MA AM. Observe that the total number of random bits required b Arthur is at most cl(n). Now we prove the base cases, i.e., m = 3. Let L AMA. Then there is L MA such that for ever x of length n x L = Pr [(x, ) L ] 3 4, and [(x, ) L ] 1 4, where l(n). We reduce the error probabilit to 1 8 b increasing the length of to kl(n), where k is some constant. B the above proof of MA AM, we know that L AM for a random of length at most cl(n). Therefore, there is a set B P such that w L = Pr [ v (w, v, ) B] 3 4, and w / L = Pr [ v (w, v, ) B] 1 4. Again, we reduce the error probabilit to 1 8 b increasing the length of to k cl(n). This implies the following: x L = Pr Pr [ v (x,, v, ) B] 3 4, and Pr [ v (x,, v, ) B] 1 4, 5

6 where kl(n), and kcl(n). This bound works since for both and the error probabilit is 1 at most, and therefore, when considered as one move (i.e. 8 (, ) is Arthur s random bit string) the error probabilit is at most = 1. Therefore, the total number of random bits required b Arthur is at most 4 kl(n) + kcl(n). Similarl, let L MAM. There is L AM such that x L = (x, ) L, and x / L = (x, ) / L, where l(n). We amplif the success probabilit of the AM protocol for L to 1 1 l(n)+3 ; so, Arthur requires at most cl(n) random bits, and there is an NP set L such that the following holds: x L = Pr[(x,, ) L ] 1 1 x / L = Pr[(x,, ) L 1 ] l(n)+3. l(n)+3, and Here l(n) and cl(n). Again, we switch the quantifiers as we have done before for the proof of MA AM. The critical counting is that the fraction of for which there is some such that (x,, ) L is at most Σ l(n) 1 l(n) Therefore, we have x L = Pr[ (x,, ) L ] 1 1 [ (x,, ) L ] 1 4, l(n)+3, and with cl(n). Note that since L NP, this shows that L is in AM. Take k 3 = kc; we have shown that MAM AM(k 3 l(n) ) and AMA AM(k 3 l(n) ) as well. Therefore, our base case is proved. Now, let m > 3, and L AM[m], i.e., Arthur moves first. Then, similar to the case of m = 3, we have that there is a constant k and L MA[m 1] such that x L = Pr [(x, ) L ] 3 4, and [(x, ) L ] 1 4, where l(n). We reduce the error probabilit of this protocol to 1 8 b increasing the length of to kl(n). length n Since L MA[m 1] AM(k m 1 l(n) m ), there is a set B P such that for ever x of x L = Pr Pr [ v (x,, v, ) B] 3 4, and Pr [ v (x,, v, ) B] 1 4, where kl(n) and kk m 1 l(n) m. Note that is also increased k-fold so that the error probabilit of L is reduced to 1 8. Therefore, we have L AM(kl(n) + kk m 1l(n) m ). On the other hand, let us assume that Merlin moves first. Then, there is a set L in AM[m 1], and therefore, in AM(k m 1 l(n) m ), such that for ever string x of length n, x L = (x, ) L, and x / L = (x, ) / L, 6

7 where l(n). Using the same technique described above to show that MA AM, we need to amplif the success probabilit of the Arthur-Merlin protocol for L to 1 1 l(n)+3. Therefore, there is a set L NP and some c > 0 such that Arthur has to repeat the protocol cl(n) times to obtain the following: x L = Pr[(x,, ) L ] 1 1 x / L = Pr[(x,, ) L 1 ] l(n)+3, l(n)+3, and where cl(n) k m 1 l(n) m = k m 1 cl(n) m 1. Switching quantifiers as before, we obtain x L = Pr[ (x,, ) L ] 1 1 l(n)+3 3 4, and [ (x,, ) L ] 1 l(n) Σ l(n) Note that Arthur now needs at most cl(n) k m 1 l(n) m = k m 1 cl(n) m 1 random bits. Also observe that L NP; therefore, the above equations define an Arthur-Merlin protocol. B taking k m = kk m 1 c, we prove the induction step: AM[m] AM(k m l(n) m 1 ), and This completes the proof. MA[m] AM(k m l(n) m 1 ). Corollar 3. For an k > 0, there is a c > 0 such that AM[log k n] AM( logc n ). Proof Assume that Arthur and Merlin exchange at most l(n) bits during ever move of communication. From Theorem 3.1, we obtain that there is a constant k such that AM[log k n] AM(k l(n) logk n 1 ). Taking an appropriate c such that logc n k l(n) logk n 1, we obtain the result. Lemma 3.3 AM( pollog ) NP/ pollog. Proof Let L AM( logk n ). Consider an input x of length n. There is a constant k and a polnomial-time predicate R such that: x L = Pr [ R(x,, )] 3 4 [ R(x,, )] 1 4 where, logk n. Note that b repeating the above protocol c 1 n times for some constant c 1, we can 1 reduce the probabilit of error to x {0, n+1. Therefore, for ever 1}n, we get x L = Pr [ R(x,, )] 1 1 n+1 [ R(x,, )] 1 n+1 7

8 where c 1 n logk n = logk n+log c 1 +log n logc n for some appropriate c > k. There are at most n man strings of length n, and for ever the error probabilit is at most 1 n+1. Therefore an random will be correct on ever input string with probabilit at least 1 ( n 1 n+1 ) > 0. Hence there must be some ŷ, ŷ logc n such that the following holds for ever x of length n: x L = R(x, ŷ, ) x / L = R(x, ŷ, ) This shows that L NP/ logc n. Corollar 3.4 For an constant k > 0, there is a constant c > 0 such that conp AM[log k n] = conp NP/ logc n. Proof This follows directl from Corollar 3. and Lemma Quasipolnomial advice for NP In this section, we stud the consequences of the existence of quasipolnomial length (i.e., pollog -length) advice for NP. This question was first studied b Buhrman and Homer [BH9]. The showed that if NP has pollog -sie famil of circuits, then the exponential hierarch collapses to the second level (i.e. NEXP NP = conexp NP ). In Theorem 4.4, we improve this collapse to S EXP. In Theorem 4.1 we obtain an exponential version of Yap s theorem [Yap83]. We prove that if NP is contained in conp/ pollog, then the exponential hierarch collapses to S exp P NP. We use this theorem to obtain the main result of this paper, which is Theorem 4.. We note that Cai et al. [CCHO03] improved Yap s theorem. The use self-reducibilit of a language in NP A (for an set A) to show that NP conp/pol = PH = S P NP. Theorem 4.1 is somewhat similar in form to the result of Cai et al. However, we use a completel different technique from theirs. Furthermore, in Theorem 4.5 below, we will use our technique to give an independent (and hopefull easier) proof of their result. Theorem 4.1 NP conp/ pollog = NEXP ΣP = conexp Σ P = S exp P NP. Proof Since S exp P NP is closed under complement, it suffices to show under the hpothesis that NEXP ΣP = S exp P NP. Let L NEXP ΣP via some exponential-time nondeterministic oracle machine N that has some Σ p language A as an oracle. For an input x {0, 1}n, M runs in nk time. Therefore, an quer that N makes to A is also of length nk, and the number of queries is also bounded b nk. The es-proof consists of an accepting computation P of N on x, with queries and their answers. Note that for an quer q, q A q φ q,q / SAT. When q = nk, let φ q,q be denoted b m (some exponential in n). B our assumption, SAT is in conp/ pollog ; let us assume that the advice for strings of length m is w, where w = pollog(m) = nc for some constant c, and let B conp be the witness language. For ever quer q that is answered Yes on the path P, the es-prover also provides and φ q,q. Note that the total length of the es-proof is bounded b some exponential in n. Also, since the verifier is a P NP machine, it can find out (making one oracle quer) whether φ q,q SAT. Obviousl, if some φ q,q provided 8

9 with an Yes quer is satisfiable, the verifier rejects x. In the following, therefore, we show how the verifier can verif whether No queries are answered correctl on the path P. The no-proof consists of the advice w for strings in SAT of length m. Note that there is a set C conp such that for an quer q, q / A q φ q,q SAT q (φ q,q, w) B (q, w) C where C = {(q, w) q (φ q,q, w) B}. Therefore, if q / A, and w is the correct advice string, the verifier can make a quer to the NP oracle and determine whether (q, w) C. If this happens for ever quer q answered No on P where w is supplied b the no-prover, the verifier accepts x. This does not automaticall impl that w is the correct advice string; however, b the definition of the S exp operator, we can alwas assume that one of the provers is correct, and therefore, when the agree (in this case, that x L) the consensus decision must be correct. Otherwise, there must be some q such that (q, w) / C. This ma result from the fact that the quer is answered incorrectl on P, or it ma happen that the advice string is wrong. (As outlined before, the case when both the proofs are wrong need not be considered.) In this case, b making prefix search using the NP oracle, the verifier can construct q and from that, it can obtain φ q,q. The verifier accepts x if and onl if its NP oracle sas that φ q,q SAT. If q / A, it must hold that for ever q, φ q,q SAT. Therefore, in particular, for the q that is obtained b the prefix search, φ q,q SAT as well. On the other hand, if w is the correct advice string, and q A, then the prefix search will produce the correct q for which φ q,q and x / L. This completes the proof. / SAT; therefore, the es-prover is ling, Now we prove our main theorem. Theorem 4. For ever constant k, if conp AM[log k n], then NEXP ΣP = conexp Σ P = S exp P NP. Proof If ever language in conp has an Arthur-Merlin proof sstem with log k n moves for an k > 0, then b Corollar 3.4, we obtain that conp NP/ logc n for some constant c > 0. This is equivalent to saing that NP conp/ logc n. From Theorem 4.1, we get the consequence that NEXP ΣP = conexp Σ P = S exp P NP. This completes the proof. We can prove a version of Theorem 4. for (log n) log log n -round interactive proof for SAT. Let NEEXP be the set of languages that can be decided b a nondeterministic Turing machine that takes at most nk time on an input of length n, and let coneexp = {L L NEEXP}. Theorem 4.3 If SAT AM[(log n) log log n ], then NEEXP ΣP = coneexp Σ P. Proof The proof is similar to the proof of Theorem 4.. We first observe that SAT AM[(log n) log log n ] implies that SAT NP/ (log n)o(log log n). As a consequence, we obtain NEEXP ΣP = coneexp Σ P. The crucial point to note is that if m = nk, then (log m)o(log log m) = nc for some c > k. In the following theorem, we improve the result of Buhrman and Homer [BH9, Theorem 1], who showed under the same hpothesis that NEXP NP = conexp NP. Theorem 4.4 If NP has pollog -sie famil of circuits, then NEXP NP = conexp NP = S EXP. 9

10 Proof Since S EXP NEXP NP conexp NP (Proposition.3), it suffices to show that NEXP NP = S EXP. Let L NEXP NP be accepted b a nondeterministic machine N with SAT as an oracle. There is some k > 0 such that N runs in time nk on an input of length n. Therefore, the formulas queried b N on an input of length n are of sie m nk, and therefore, have circuit sie pollog(m) = nc for some c. On an input x, x = n, the es-proof consists of the following: Accepting path P of N on x, including the queries made on that path and their answers One satisfing assignment for ever quer φ that is answered es The verifier can verif whether the assignments provided with each quer that is answered es is satisfing, and will reject x if an of them is not satisfing. Therefore, in the following, we consider the queries that are answered no on P. We can assume that an circuit for SAT outputs not onl 1 or 0 indicating whether the input formula is satisfiable or not, but also outputs a satisfing assignment when it claims that the input formula is satisfiable. This can be done b a polnomial blow-up in the sie of the circuit, and therefore, the circuit still remains of the sie pollog. The no-proof is such a circuit C for SAT at length m. Given C, the verifier inputs each quer φ that is answered no on P. If C outputs 0 on all these formulas, indicating that the are unsatisfiable, then the verifier accepts x. On the other hand, if C outputs a satisfing assignment for some φ that is answered no on P, then the verifier rejects x. If x L, then there must be an accepting path of N on x, and the es-prover can provide this path with the queries and their correct answers. No circuit (correct or otherwise) can output a satisfing assignment on an formula that is answered no correctl on this path. On the other hand, if x / L, the path provided b the es-prover must be wrong. There are two possible scenarios in this case. First, some quer that is answered es on this path is unsatisfiable and is not satisfied b the assignment that is provided b the esprover, in which case the verifier rejects x. Otherwise, some formula that is answered no is unsatisfiable, and a correct circuit for SAT (provided b the no-prover) can output a satisfing assignment for that formula. In this case, the verifier rejects x as well. This completes the proof. Now we improve Yap s theorem. Theorem 4.5 If NP conp/pol, then PH = S P NP. Proof Since S P NP is closed under complement, it suffices to show under the hpothesis that NP ΣP = S P NP. Let L NP ΣP via some polnomial-time nondeterministic oracle machine N that has some Σ p language A as an oracle. For an input x {0, 1} n, M runs in n k time. Therefore, an quer that N makes to A is also of length n k, and the number of queries is also bounded b n k. The es-proof consists of an accepting computation P of N on x, with queries and their answers. Note that for an quer q, q A q φ q,q / SAT. When q = n k, let φ q,q be denoted b m (some polnomial in n). B our assumption, SAT is in conp/pol; let us assume that the advice for strings of length m is w, where w = n c for some constant c, and let B conp be the witness language. For ever quer q that is answered Yes on the path P, the es-prover also provides and φ q,q. Also, since the verifier is a P NP machine, it can find out (making one oracle quer) whether φ q,q SAT. Obviousl, if some φ q,q provided with an Yes quer is satisfiable, the verifier rejects x. In the following, therefore, we show how the verifier can verif whether No queries are answered correctl on the path P. The no-proof consists of the advice w for strings in SAT of length m. Note that there is a set C conp such that for an quer q, q / A q φ q,q SAT q (φ q,q, w) B (q, w) C 10

11 where C = {(q, w) q (φ q,q, w) B}. Therefore, if q / A, and w is the correct advice string, the verifier can make a quer to the NP oracle and determine whether (q, w) C. If this happens for ever quer q answered No on P where w is supplied b the no-prover, the verifier accepts x. This does not automaticall impl that w is the correct advice string; however, b the definition of the S operator, we can alwas assume that one of the provers is correct, and therefore, when the agree (in this case, that x L) the consensus decision must be correct. Otherwise, there must be some q such that (q, w) / C. This ma result from the fact that the quer is answered incorrectl on P, or it ma happen that the advice string is wrong. (As outlined before, the case when both the proofs are wrong need not be considered.) In this case, b making prefix search using the NP oracle, the verifier can construct q and from that, it can obtain φ q,q. The verifier accepts x if and onl if its NP oracle sas that φ q,q SAT. If q / A, it must hold that for ever q, φ q,q SAT. Therefore, in particular, for the q that is obtained b the prefix search, φ q,q SAT as well. On the other hand, if w is the correct advice string, and q A, then the prefix search will produce the correct q for which φ q,q and x / L. / SAT; therefore, the es-prover is ling, 4.1 Interactive Proof Sstems Let IP[g(n)] denote an interactive proof sstem with g(n) rounds in the Goldwasser, Micali and Rackoff [GMR85] formaliation. Goldwasser and Sipser [GS89] proved that IP[g(n)] AM[g(n) + 4] as long as g(n) is bounded b a polnomial. Thus, if L IP[log k n], then L AM[log k+1 n]. So the following corollar follows immediatel from Theorem 4.. Corollar 4.6 If ever set in conp has a pollogarithmic-round interactive proof sstem, then NEXP ΣP = conexp ΣP = S exp P NP. 5 Conclusions We have shown that if conp has pollogarithmic-round interactive proofs then the exponential hierarch collapses to the third level. Similarl, the double exponential hierarch collapses if SAT has a (log n) log log n - round interactive protocol. An obvious extension would be to obtain consequences of SAT having n ɛ -round interactive proof sstems for some ɛ < 1. One longstanding open problem in this area is to show that if SAT has polnomial-sied circuits, then PH collapses to AM. Since conp AM implies that PH collapses to AM, it suffices to show under this hpothesis that conp is included in AM. Moreover, Arvind et al. [AKSS95] have shown that if SAT has a polnomial-sie famil of circuits, then MA = AM. Since MA S P, this would improve the best-known version of Karp-Lipton theorem [KL80] (b Sengupta, reported in Cai [Cai01]). It is not known whether AM is properl included in AM[pollog], but Aiello, Goldwasser and Håstad [AGH90] have shown that AM is properl included in AM[pollog] in a relativied world. 6 Acknowledgements The authors thank D. Sivakumar for suggesting the question that we address in this paper. 11

12 References [AGH90] W. Aiello, S. Goldwasser, and J. Hastad. On the power of interaction. Combinatorica, 10(1):3 5, [AKSS95] V. Arvind, J. Köbler, U. Schöning, and R. Schuler. If NP has polnomial-sie circuits, then MA = AM. Theoretical Computer Science, 137():79 8, [ALM + 9] S. Arora, C. Lund, R. Motwani, M. Sudan, and M. Seged. Proof verification and hardness of approximation problems. In Proceedings of the 33rd Annual IEEE Smposium on Foundations of Computer Science, pages 14. IEEE Computer Societ Press, 199. [AS9] S. Arora and S. Safra. Approximating clique is NP-complete. In Proceedings of the 33rd Annual IEEE Smposium on Foundations on Computer Science, pages 13. IEEE Computer Societ Press, 199. [Báb85] L. Bábai. Trading group theor for randomness. In Proceedings of the 17th Smposium on Theor of Computing, pages ACM Press, [BFL81] L. Bábai, L. Fortnow, and C. Lund. Nondeterministic exponential time has two-prover interactive protocols. Computational Complexit, 1(1):3 40, [BFLS91] L. Bábai, L. Fortnow, L. Levin, and M. Seged. Checking computations in pollogarithmic time. In Proceedings of the 3rd Annual ACM Smopsium on Theor of Computing, pages 1 31, [BH9] H. Buhrman and S. Homer. Superpolnomial circuits, almost sparse oracles, and the exponential hierarch. In Foundations of Software Technolog and Theoretical Computer Science, 1th Conference, New Delhi, India, December 18-0, 199, Proceedings, volume 65 of Lecture Notes in Computer Science, pages Springer-Verlag, 199. [BHZ87] R. B. Boppana, J. Håstad, and S. Zachos. Does co-np have short interactive proofs? Information Processing Letters, 5():17 13, [BM88] L. Bábai and S. Moran. Arthur-merlin games : a randomied proof sstem, and a hierarch of complexit classes. Journal of Computer and Sstem Sciences, 36:54 76, [BOGKW88] M. Ben-Or, S. Goldwasser, J. Kilian, and A. Wigderson. Multiprover interactive proofs: How to remove the intractabilit assumptions. In Proceedings of the 0th Annual ACM Smposium on Theor of Computing, pages , [Cai01] J-Y. Cai. S P ZPPNP. In Proceedings of the 4nd IEEE Conference on Foundations of Computer Science, pages 60 69, 001. [Can96] R. Canetti. On BPP and the polnomial-time hierarch. Information Processing Letters, pages 37 41, [CCHO03] J-Y. Cai, V. Chakaravarth, L. Hemaspaandra, and M. Ogihara. Competing provers ield improved karp-lipton collapse results. In Proceedings 0th Smposium on Theoretical Aspects of Computer Science, pages ,

13 [FGL + 91] U. Feige, S. Goldwasser, L. Lovás, S. Safra, and M. Seged. Approximating clique is almost NP-complete. In Proceedings 3nd Smposium on Foundations of Computer Science, pages 1. IEEE Computer Societ Press, [GH98] O. Goldreich and J. Hastad. On the complexit of interactive proofs with bounded communication. Information Processing Letters, 67(4):05 14, [GMR85] S. Goldwasser, S. Micali, and C. Rackoff. The knowledge complexit of interactive proofs. In Proceedings of the 17th Annual ACM Smposium on Theor of Computing, pages , [GS89] S. Goldwasser and M. Sipser. Private coins versus public coins in interactive proof sstems. In S. Micali, editor, Randomness and Computation, volume 5 of Advances in Computing Research, pages JAI Press, [GVW01] O. Goldreich, S. Vadhan, and A. Wigderson. On interactive proofs with laconic provers. In Proceedings of the 8th International Colloquium on Automata, Languages, and Programming, volume 076 of Lecture Notes in Computer Science, pages Springer Verlag, 001. [HS01] S. Homer and A. Selman. Computabilit and Complexit Theor. Springer-Verlag, 001. [KL80] R. Karp and R. Lipton. Some connections between nonuniform and uniform complexit classes. In Proceedings of the 1th ACM Smposium on Theor of Computing, pages , [LFKN9] C. Lund, L. Fortnow, H. Karloff, and N. Nisan. Algebraic methods for interactive proof sstems. Journal of the Association of Computing Machines, 39(4): , 199. [RS98] A. Russell and R. Sundaram. Smmetric alternation captures BPP. Journal of Computational Complexit, 7():15 16, [Sha9] A. Shamir. IP = PSPACE. Journal of the Association of Computing Machines, 39(4): , 199. [Tod91] S. Toda. PP is as hard as the polnomial time hierarch. SIAM Journal on Computing, 0: , [Yap83] C. Yap. Some consequences of non-uniform conditions on uniform classes. Theoretical Computer Science, 6(3):87 300, [ZF87] S. Zachos and M. Fürer. Probabilistic quantifiers vs distrustful adversaries. In Foundations of Software Technolog and Theoretical Computer Science, 1987, Proceedings, volume 87 of Lecture Notes in Computer Science, pages Springer-Verlag, [ZH86] S. Zachos and H. Heller. A decisive characteriation of BPP. Information and Control, 69:15 135,