CS151 Complexity Theory. Lecture 14 May 17, 2017

Size: px

Start display at page:

Download "CS151 Complexity Theory. Lecture 14 May 17, 2017"

August Long
5 years ago
Views:

1 CS151 Complexity Theory Lecture 14 May 17, 2017

2 IP = PSPACE Theorem: (Shamir) IP = PSPACE Note: IP PSPACE enumerate all possible interactions, explicitly calculate acceptance probability interaction extremely powerful! An implication: you can interact with master player of Generalized Geography and determine if she can win from the current configuration even if you do not have the power to compute optimal moves! May 17,

3 IP = PSPACE need to prove PSPACE IP use same type of protocol as for conp some modifications needed May 17,

4 IP = PSPACE protocol for QSAT arithmetization step produces arithmetic expression p φ : (9x i ) φ Σ x i = 0, 1 p φ (8x i ) φ xi = 0, 1 p φ start with QSAT formula in special form ( simple ) no occurrence of x i separated by more than one 8 from point of quantification May 17,

5 IP = PSPACE quantified Boolean expression φ is true if and only if p φ > 0 Problem: s may cause p φ > 2 2 φ Solution: evaluate mod 2 n q 2 3n prover sends good q in first round good q is one for which p φ mod q > 0 Claim: good q exists # primes in range is at least 2 n May 17,

6 Prover The QSAT protocol k, q, p 1 (x) input: φ p 1 (x): remove outer Σ or from p φ p 2 (x): remove outer Σ or from p φ [x 1 z 1 ] p 2 (x) p 3 (x): remove outer Σ or from p φ [x 1 z 1, x 2 z 2 ] p3 (x).. p n (x) Verifier p 1 (0)+p 1 (1) = k? or p 1 (0)p 1 (1) = k? pick random z 1 in F q May 17, z 1 z 2 p 2 (0)+p 2 (1)=p 1 (z 1 )? or p 2 (0)p 2 (1) = p 1 (z 1 )? pick random z 2 in F q p n (0)+p n (1)=p n-1 (z n-1 )? or p n (0)p n (1) = p n-1 (z n-1 )? pick random z n in F q p n (z n ) = p φ [x 1 z 1,, x n z n ]

7 Analysis of the QSAT protocol Completeness: if φ QSAT then honest prover on previous slide will always cause verifier to accept May 17,

8 Analysis of the QSAT protocol Soundness: let p i (x) be the correct polynomials let p i *(x) be the polynomials sent by (cheating) prover φ QSAT 0 = p 1 (0) +/x p 1 (1) k either p 1 *(0) +/x p 1 *(1) k (and V rejects) or p 1 * p 1 Pr z1 [p 1 *(z 1 ) = p 1 (z 1 )] 2 φ /2 n assume (p i+1 (0) +/x p i+1 (1)=) p i (z i ) p i *(z i ) either p i+1 *(0) +/x p i+1 *(1) p i *(z i ) (and V rejects) φ is simple or p i+1 * p i+1 Pr zi+1 [p i+1 *(z i+1 ) = p i+1 (z i+1 )] 2 φ /2 n May 17,

9 Analysis of protocol Soundness (continued): if verifier does not reject, there must be some i for which: p i * p i and yet p i *(z i ) = p i (z i ) for each i, probability is 2 φ /2 n union bound: probability that there exists an i for which the bad event occurs is 2n φ /2 n poly(n)/2 n << 1/3 Conclude: QSAT is in IP May 17,

10 Example Papadimitriou pp φ =8x9y(x y) 8z((x z) (y z)) 9w(z (y w)) p φ = x=0,1 Σ y=0,1 [(x + y) * z=0,1 [(xz + y(1-z)) + Σ w=0,1 (z + y(1-w))]] (p φ = 96 but V doesn t know that yet!) May 17,

11 Example p φ = x=0,1 Σ y=0,1 [(x + y) * z=0,1 [(xz + y(1-z)) + Σ w=0,1 (z + y(1-w))]] Round 1: (prover claims p φ > 0) prover sends q = 13; claims p φ = 96 mod 13 = 5; sends k = 5 prover removes outermost ; sends verifier checks: p 1 (x) = 2x 2 + 8x + 6 p 1 (0)p 1 (1) = (6)(16) = 96 5 (mod 13) verifier picks randomly: z 1 = 9 May 17,

12 Example φ =8x9y(x y) 8z((x z) (y z)) 9w(z (y w)) p φ = x=0,1 Σ y=0,1 [(x + y) * z=0,1 [(xz + y(1-z)) + Σ w=0,1 (z + y(1-w))]] p φ [x 9] = Σ y=0,1 [(9 + y) * z=0,1 [(9z + y(1-z)) + Σ w=0,1 (z + y(1-w))]] May 17,

13 Example p 1 (9) = Σ y=0,1 [(9 + y) * z=0,1 [(9z + y(1-z)) + Σ w=0,1 (z + y(1-w))]] Round 2: (prover claims this = 6) prover removes outermost Σ ; sends verifier checks: p 2 (y) = 2y 3 + y 2 + 3y p 2 (0) + p 2 (1) = = 6 6 (mod 13) verifier picks randomly: z 2 = 3 May 17,

14 Example φ =8x9y(x y) 8z((x z) (y z)) 9w(z (y w)) p φ = x=0,1 Σ y=0,1 [(x + y) * z=0,1 [(xz + y(1-z)) + Σ w=0,1 (z + y(1-w))]] p φ [x 9, y 3] = [(9 + 3) * z=0,1 [(9z + 3(1-z)) + Σ w=0,1 (z + 3(1-w))]] May 17,

15 Example p 2 (3) = [(9 + 3) * z=0,1 [(9z + 3(1-z)) + Σ w=0,1 (z + 3(1-w))]] Round 3: (prover claims this = 7) everyone agrees expression = 12*( ) prover removes outermost ; sends p 3 (z) = 8z + 6 verifier checks: p 3 (0) * p 3 (1) = (6)(14) = 84; 12*84 7 (mod 13) verifier picks randomly: z 3 = 7 May 17,

16 Example φ =8x9y(x y) 8z((x z) (y z)) 9w(z (y w)) p φ = x=0,1 Σ y=0,1 [(x + y) * z=0,1 [(xz + y(1-z)) + Σ w=0,1 (z + y(1-w))]] p φ [x 9, y 3, z 7] = 12 * [(9*7 + 3(1-7)) + Σ w=0,1 (7 + 3(1-w))] May 17,

17 Example 12*p 3 (7) = 12 * [(9*7 + 3(1-7)) + Σ w=0,1 (7 + 3(1-w))] Round 4: (prover claims = 12*10) everyone agrees expression = 12*[6+( )] prover removes outermost Σ ; sends p 4 (w) = 10w + 10 verifier checks: p 4 (0)+p 4 (1) = = 30; 12*[6+30] 12*10 (mod 13) verifier picks randomly: z 4 = 2 Final check: 12*[(9*7+3(1-7))+(7+3(1-2))] = 12*[6+p 4 (2)] = 12*[6+30] May 17,

18 Arthur-Merlin Games IP permits verifier to keep coin-flips private necessary feature? GNI protocol breaks without it Arthur-Merlin game: interactive protocol in which coin-flips are public Arthur (verifier) may as well just send results of coin-flips and ask Merlin (prover) to perform any computation Arthur would have done May 17,

19 Arthur-Merlin Games Clearly Arthur-Merlin IP private coins are at least as powerful as public coins Proof that IP = PSPACE actually shows PSPACE Arthur-Merlin IP PSPACE public coins are at least as powerful as private coins! May 17,

20 Arthur-Merlin Games Delimiting # of rounds: AM[k] = Arthur-Merlin game with k rounds, Arthur (verifier) goes first MA[k] = Arthur-Merlin game with k rounds, Merlin (prover) goes first Theorem: AM[k] (MA[k]) equals AM[k] (MA[k]) with perfect completeness. i.e., x L implies accept with probability 1 proof on problem set May 17,

21 Arthur-Merlin Games Theorem: for all constant k 2 Proof: AM[k] = AM[2]. we show MA[2] AM[2] implies can move all of Arthur s messages to beginning of interaction: AMAMAM AM = AAMMAM AM = AAA AMMM M May 17,

22 Arthur-Merlin Games Proof (continued): given L MA[2] x L 9m Pr r [(x, m, r) R] = 1 order reversed Pr r [ 9m (x, m, r) R] = 1 x L 8m Pr r [(x, m, r) R] ε Pr r [ 9m (x, m, r) R] 2 m ε by repeating t times with independent random strings r, can make error ε < 2 -t set t = m+1 to get 2 m ε < ½. May 17,

23 MA and AM Two important classes: MA = MA[2] AM = AM[2] definitions without reference to interaction: L MA iff 9 poly-time language R x L 9 m Pr r [(x, m, r) R] = 1 x L 8 m Pr r [(x, m, r) R] ½ L AM iff 9 poly-time language R x L Pr r [ 9 m (x, m, r) R] = 1 x L Pr r [ 9 m (x, m, r) R] ½ May 17,

24 MA and AM L AM iff 9 poly-time language R x L Pr r [ 9 m (x, m, r) R] = 1 x L Pr r [ 9 m (x, m, r) R] ½ Relation to other complexity classes: both contain NP (can elect to not use randomness) both contained in 2. L 2 iff 9 R P for which: x L Pr r [ 9 m (x, m, r) R] = 1 x L Pr r [ 9 m (x, m, r) R] < 1 so clear that AM 2 know that MA AM May 17,

25 MA and AM Π 2 Σ 2 AM MA NP coam coma conp P May 17,

26 MA and AM Theorem: conp AM PH = AM. Proof: suffices to show Σ 2 AM (and use AM Π 2 ) L Σ 2 iff 9 poly-time language R x L 9 y 8 z (x, y, z) R x L 8 y 9 z (x, y, z) R Merlin sends y 1 AM exchange decides conp query: 8z (x, y, z) R? 3 rounds; in AM May 17,

27 MA and AM We know Arthur-Merlin = IP. public coins = private coins Theorem (GS): IP[k] AM[O(k)] stronger result implies for all constant k 2, IP[k] = AM[O(k)] = AM[2] So, GNI IP[2] = AM May 17,

28 Back to Graph Isomorphism The payoff: not known if GI is NP-complete. previous Theorems: if GI is NP-complete then PH = AM unlikely! Proof: GI NP-complete GNI conpcomplete conp AM PH = AM May 17,

29 Derandomization revisited L MA iff 9 poly-time language R x L 9 m Pr r [(x, m, r) R] = 1 x L 8 m Pr r [(x, m, r) R] ½ Recall PRGs: AM MA NP seed t bits G output string u bits for all circuits C of size at most s: Pr y [C(y) = 1] Pr z [C(G(z)) = 1] ε May 17,

30 Using PRGs for MA L MA iff 9 poly-time language R x L 9 m Pr r [(x, m, r) R] = 1 x L 8 m Pr r [(x, m, r) R] ½ produce poly-size circuit C such that C(x, m, r) = 1, (x,m,r) 2 R for each x, m can hardwire to get C x,m 9 m Pr y [C x,m (y) = 1] = 1 ( yes ) 8 m Pr y [C x,m (y) = 1] 1/2 ( no ) May 17,

31 Using PRGs for MA poly(n) can compute Pr z [C x,m (G(z)) = 1] exactly evaluate C x,m (G(z)) on every seed z {0,1} t running time (O( C x,m )+(time for G))2 t x L 9 m [Pr z [C x,m (G(z)) = 1] = 1] x L 8 m [Pr z [C x,m (G(z)) = 1] ½ + ²] L 2 NP if PRG with t = O(log n), ² < 1/4 Theorem: E requires exponential size circuits MA = NP. poly-time May 17,

32 MA and AM (under a hardness assumption) Π 2 Σ 2 AM MA NP coam coma conp P May 17,

33 MA and AM (under a hardness assumption) Π 2 Σ 2 AM coam MA = NP conp = coma P What about AM, coam? May 17,

34 Derandomization revisited Theorem (IW, STV): If E contains functions that require size 2 Ω(n) circuits, then E contains functions that are 2 Ω(n) - unapproximable by circuits. Theorem (NW): if E contains 2 Ω(n) -unapproximable functions there are poly-time PRGs fooling poly(n)-size circuits, with seed length t = O(log n), and error ² < 1/4. May 17,

35 Oracle circuits circuit C directed acyclic graph nodes: AND ( ); OR ( ); NOT ( ); variables x i x 1 x 2 x 3 x n A-oracle circuit C also allow A-oracle gates 1 iff x 2 A A May 17, x

36 Relativized versions Theorem: If E contains functions that require size 2 Ω(n) A-oracle circuits, then E contains functions that are 2 Ω(n) - unapproximable by A-oracle circuits. Recall proof: encode truth table to get hard function if approximable by s(n)-size circuits, then use those circuits to compute original function by size s(n) Ω(1) -size circuits. Contradiction. May 17,

37 Relativized versions f:{0,1} log k {0,1} m: f :{0,1} log n {0,1} Enc(m): R: decoding procedure i 2 {0,1} log k D C small A-oracle circuit C approximating f small A-oracle circuit computing f exactly f(i) May 17,

38 Relativized versions Theorem: if E contains 2 Ω(n) -unapproximable fns., there are poly-time PRGs fooling poly(n)-size A-oracle circuits, with seed length t = O(log n), and error ² < 1/4. Recall proof: PRG from hard function on O(log n) bits if doesn t fool s-size circuits, then use those circuits to compute hard function by size s n ± - size circuits. Contradiction. May 17,

39 Relativized versions G n (y)=f log n (y S 1 ) f log n (y S2 ) f log n (y Sm ) f log n : doesn t fool A-oracle circuit of size s: Pr x [C(x) = 1] Pr y [C( G n (y) ) = 1] > ε implies A-oracle circuit P of size s = s + O(m): Pr y [P(G n (y) 1 i-1 ) = G n (y) i ] > ½ + ε/m May 17,

40 Relativized versions G n (y)=f log n (y S 1 ) f log n (y S2 ) f log n (y Sm ) f log n : output f log n (y ) A-oracle circuit approximating f P y May 17, 2017 hardwired tables 40

41 Using PRGs for AM L AM iff 9 poly-time language R x L Pr r [ 9 m (x, m, r) R] = 1 x L Pr r [ 9 m (x, m, r) R] ½ produce poly-size SAT-oracle circuit C such that 1 SAT query, accepts iff answer is yes C(x, r) = 1, 9 m (x,m,r) 2 R for each x, can hardwire to get C x Pr y [C x (y) = 1] = 1 ( yes ) Pr y [C x (y) = 1] ½ ( no ) May 17,

42 Using PRGs for AM x L [Pr z [C x (G(z)) = 1] = 1] x L [Pr z [C x (G(z)) = 1] ½ + ²] C x makes a single SAT query, accepts iff answer is yes if G is a PRG with t = O(log n), ² < ¼, can check in NP: does C x (G(z)) = 1 for all z? May 17,

43 Relativized versions Theorem: If E contains functions that require size 2 Ω(n) A-oracle circuits, then E contains functions that are 2 Ω(n) -unapproximable by A-oracle circuits. Theorem: if E contains 2 Ω(n) -unapproximable functions there are PRGs fooling poly(n)-size A- oracle circuits, with seed length t = O(log n), and error ² < ½. Theorem: E requires exponential size SAToracle circuits AM = NP. May 17,

44 MA and AM (under a hardness assumption) Π 2 Σ 2 AM coam MA = NP conp = coma P May 17,

45 MA and AM (under a hardness assumption) Π 2 Σ 2 AM = MA = NP conp = coma = coam P May 17,

CS151 Complexity Theory. Lecture 13 May 15, 2017

CS151 Complexity Theory. Lecture 13 May 15, 2017 CS151 Complexity Theory Lecture 13 May 15, 2017 Relationship to other classes To compare to classes of decision problems, usually consider P #P which is a decision class easy: NP, conp P #P easy: P #P