Analyzing Quantum Coin-Flipping Protocols using Optimization Techniques

Size: px

Start display at page:

Download "Analyzing Quantum Coin-Flipping Protocols using Optimization Techniques"

Lenard Berry
5 years ago
Views:

1 Anlyzing Quntum Coin-Fliing Protocols using Otimiztion Techniques Jmie Sikor (Université Pris 7, Frnce) joint work with Ashwin Nyk (University of Wterloo, Cnd) Levent Tunçel (University of Wterloo, Cnd) IMS Quntum Worksho December 3, 203

2 Secure Comuttion Inut Inut Alice nd Bob communicte over (quntum) communiction chnnel Alice nd Bob do not trust ech other Communiction Protocol Gol: To design rotocols which minimize cheting E.g., oblivious trnsfer, coin fliing, bit commitment, etc. Outut Outut

3 Coin-Fliing Alice nd Bob wnt to generte rndom coin Coin-Fliing Wnt to design rotocols tht sto Alice nd Bob from forcing ny desired outcome Wnt to minimize cheting \

4 Coin-Fliing Cheting definitions PA,0 := mx Pr[Alice cn force outcome 0] PA, := mx Pr[Alice cn force outcome ] PB,0 := mx Pr[Bob cn force outcome 0] PB, := mx Pr[Bob cn force outcome ] Coin-Fliing Does nture llow coin-fliing? Clssicl: mx{pa,0,p A,,P B,0,P B,} < is imossible Quntum: mx{pa,0,p A,,P B,0,P B,} =/2 is imossible [Lo, Chu 997] Quntum: mx{pa,0,p A,,P B,0,P B,} < is ossible [Ahronov, T-Shm, Vzirni, Yo 2000]

5 Coin-Fliing Cheting definitions PA,0 := mx Pr[Alice cn force outcome 0] PA, := mx Pr[Alice cn force outcome ] PB,0 := mx Pr[Bob cn force outcome 0] PB, := mx Pr[Bob cn force outcome ] Coin-Fliing Does nture llow coin-fliing? Clssicl: mx{p A,0,P A,,P B,0,P B,} < is imossible Quntum: mx{p A,0,P A,,P B,0,P B,} =/2 is imossible [Lo, Chu 997] Wht is the best quntum rotocol? Quntum: mx{p A,0,P A,,P B,0,P B,} < is ossible [Ahronov, T-Shm, Vzirni, Yo 2000]

6 Coin-Fliing Best Exlicit Construction mx{p A,0,P A,,P B,0,P B,} =3/4 [Ambinis 200] Coin-Fliing Otiml Bounds mx{p A,0,P A,,P B,0,P B,} / 2 for every rotocol [Kitev 2002] mx{p A,0,P A,,P B,0,P B,} le / 2+ is ossible for ny > 0 [Chilloux nd Kerenidis 2009]

7 Coin-Fliing Best Exlicit Construction mx{p A,0,P A,,P B,0,P B,} =3/4 [Ambinis 200] Coin-Fliing Otiml Bounds mx{p A,0,P A,,P B,0,P B,} / 2 for every rotocol [Kitev 2002] How do we construct better rotocols? mx{p A,0,P A,,P B,0,P B,} le / 2+ is ossible for ny > 0 [Chilloux nd Kerenidis 2009]

8 Bd Coin-Fliing Protocol Alice chooses uniformly t rndom Bob chooses b uniformly t rndom Alice sends to Bob Bob sends b to Alice Alice oututs b Bob oututs b

9 Bd Coin-Fliing Protocol Alice chooses uniformly t rndom Bob chooses b uniformly t rndom Alice oututs b Alice sends to Bob Bob sends b to Alice P B,0 = P B, = Before sending b, Bob cn chnge it nd Alice wouldn t know better Bob oututs b

10 Bd Coin-Fliing Protocol Alice chooses uniformly t rndom Alice cnnot chet t ll Alice oututs b Alice sends to Bob Bob sends b to Alice PB,0 = PB, = PA,0 = PA, =/2 Bob chooses b uniformly t rndom Before sending b, Bob cn chnge it nd Alice wouldn t know better Bob oututs b

11 Better Coin-Fliing Protocol Alice chooses uniformly t rndom Bob chooses b uniformly t rndom Alice smles n n-bit string x = xx2...xn with robbility distribution Bob smles n n-bit string y = yy2...yn with robbility distribution b For i = to n Alice sends xi to Bob Bob sends yi to Alice Alice oututs b Alice sends to Bob Bob sends b to Alice Bob oututs b (if y 2 su( b )) (if x 2 su( ))

12 Better Coin-Fliing Protocol Alice chooses uniformly t rndom Bob chooses b uniformly t rndom Alice smles n n-bit string x = xx2...xn with robbility distribution Bob smles n n-bit string y = yy2...yn with robbility distribution b xx2x3 b yy2 y3

13 Better Coin-Fliing Protocol Alice chooses uniformly t rndom Bob chooses b uniformly t rndom Alice smles n n-bit string x = xx2...xn with robbility distribution Bob smles n n-bit string y = yy2...yn with robbility distribution b x2 x3 b x yy2 y3

14 Better Coin-Fliing Protocol Alice chooses uniformly t rndom Bob chooses b uniformly t rndom Alice smles n n-bit string x = xx2...xn with robbility distribution Bob smles n n-bit string y = yy2...yn with robbility distribution b yx2 x3 b xy2 y3

15 Better Coin-Fliing Protocol Alice chooses uniformly t rndom Bob chooses b uniformly t rndom Alice smles n n-bit string x = xx2...xn with robbility distribution Bob smles n n-bit string y = yy2...yn with robbility distribution b yx3 b xx2 y2 y3

16 Better Coin-Fliing Protocol Alice chooses uniformly t rndom Bob chooses b uniformly t rndom Alice smles n n-bit string x = xx2...xn with robbility distribution Bob smles n n-bit string y = yy2...yn with robbility distribution b y y2 x3 b xx2 y3

17 Better Coin-Fliing Protocol Alice chooses uniformly t rndom Bob chooses b uniformly t rndom Alice smles n n-bit string x = xx2...xn with robbility distribution Bob smles n n-bit string y = yy2...yn with robbility distribution b y y2 b xx2x3 y3

18 Better Coin-Fliing Protocol Alice chooses uniformly t rndom Bob chooses b uniformly t rndom Alice smles n n-bit string x = xx2...xn with robbility distribution Bob smles n n-bit string y = yy2...yn with robbility distribution b y y2 y3 b xx2x3

19 Better Coin-Fliing Protocol Alice chooses uniformly t rndom Bob chooses b uniformly t rndom Alice smles n n-bit string x = xx2...xn with robbility distribution Bob smles n n-bit string y = yy2...yn with robbility distribution b y y2y3 b xx2x3

20 Better Coin-Fliing Protocol Alice chooses uniformly t rndom Bob chooses b uniformly t rndom Alice smles n n-bit string x = xx2...xn with robbility distribution Bob smles n n-bit string y = yy2...yn with robbility distribution b byy2y3 xx2x3

21 Better Coin-Fliing Protocol Alice chooses uniformly t rndom Bob chooses b uniformly t rndom Alice smles n n-bit string x = xx2...xn with robbility distribution Bob smles n n-bit string y = yy2...yn with robbility distribution b byy2y3 xx2x3 Cn y be smled using b? Cn x be smled using? Yes: Continue Yes: Continue No: Abort No: Abort

22 Better Coin-Fliing Protocol Alice chooses uniformly t rndom Bob chooses b uniformly t rndom Alice smles n n-bit string x = xx2...xn with robbility distribution Bob smles n n-bit string y = yy2...yn with robbility distribution b byy2y3 xx2x3 Alice oututs b Bob oututs b

23 Modelling Cheting Alice s n LP (s ) x =, x x 2 (s 2 ) x,y,x 2 = (s ) x, 8x,y. x n (s n ) x,y,...,x n = (s n ) x,y,...,x n,y n, 8x,y,...,x n,y n. informtion she currently hs) (s) x,y,...,x n,y n, = (s n ) x,y,...,y n,y n,x n, 8x,y,...,x n,y n Probbility of reveling x (s,s 2,...,s n,s) 2 P A (Nonnegtive vribles) Freedom: Alice cn choose ech bit ccording to ny robbility distribution (deending on ll the Constrints: She needs to reserve mrginl Succinctly: robbility distributions over messges lredy sent

24 Modelling Cheting Alice s n LP (s ) x =, x (s 2 ) x,y,x 2 = x 2 (s ) x, 8x,y. x n (s n ) x,y,...,x n = (s n ) x,y,...,x n,y n, 8x,y,...,x n,y n. (s) x,y,...,x n,y n, = (s n ) x,y,...,y n,y n,x n, 8x,y,...,x n,y n (Nonnegtive vribles) Probbility of reveling x2 given y nd x lredy reveled Succinctly: (s,s 2,...,s n,s) 2 P A

25 Modelling Cheting Alice s n LP (s ) x =, x = (s 2 ) x,y,x 2 = x 2 (s ) x, 8x,y. (s n ) x,y,...,x n x n (s n ) x,y,...,x n,y n, 8x,y,...,x n,y n. (s) x,y,...,x n,y n, = (s n ) x,y,...,y n,y n,x n, 8x,y,...,x n,y n (Nonnegtive vribles) Probbility of reveling xn given y,..., yn- nd x,..., xn- lredy reveled Succinctly: (s,s 2,...,s n,s) 2 P A

26 Modelling Cheting Alice s n LP (s ) x =, x = (s 2 ) x,y,x 2 = x 2 (s ) x, 8x,y. (s n ) x,y,...,x n x n (s n ) x,y,...,x n,y n, 8x,y,...,x n,y n. (s) x,y,...,x n,y n, = (s n ) x,y,...,y n,y n,x n, 8x,y,...,x n,y n Succinctly: (s,s 2,...,s n,s) 2 P A (Nonnegtive vribles) Probbility of reveling given y nd x lredy reveled

27 Modelling Cheting Alice s n LP (s ) x =, x = (s 2 ) x,y,x 2 = x 2 (s ) x, 8x,y. (s n ) x,y,...,x n x n (s n ) x,y,...,x n,y n, 8x,y,...,x n,y n. (s) x,y,...,x n,y n, = (s n ) x,y,...,y n,y n,x n, 8x,y,...,x n,y n (Nonnegtive vribles) Succinctly: (s,s 2,...,s n,s) 2 P A Alice s cheting olytoe

28 Cheting LPs for Alice P A,0 = mx P A, = mx 8 < : 8 < : 2 2 y y x2su( ) x2su( ā) 9 =,ys,x,y :(s,...,s n,s) 2 P A ; 9 =,ys,x,y :(s,...,s n,s) 2 P A ; Sum of robbilities leding to successful cheting

29 Cheting LPs for Alice If honest: s,x,y = 2,x P A,0 = mx P A, = mx 8 < : 8 < : 2 2 y y x2su( ) x2su( ā) 9 =,ys,x,y :(s,...,s n,s) 2 P A ; 9 =,ys,x,y :(s,...,s n,s) 2 P A ; Sum of robbilities leding to successful cheting

30 Cheting Strtegy for Bob ( ) x,y =, 8x y (Nonnegtive vribles) ( 2 ) x,y,x 2,y 2 = y 2 ( ) x,y, 8x,y,x 2 ( n ) x,y,...,x n,y n y n. = ( n ) x,y,...,x n,y n, 8x,y,...,y n,x n Succinctly: (, 2,..., n ) 2 P B Bob s cheting olytoe

31 Cheting LPs for Bob P B,0 = mx P B, = mx 8 < : 8 < : 2 2 y2su( ) y2su( ā) x x 9 =,x ( n ) x,y :(,..., n ) 2 P B ; 9 =,x ( n ) x,y :(,..., n ) 2 P B ; Sum of robbilities leding to successful cheting

32 Cheting LPs for Bob If honest: ( n ) x,y := 2,y P B,0 = mx P B, = mx 8 < : 8 < : 2 2 y2su( ) y2su( ā) x x 9 =,x ( n ) x,y :(,..., n ) 2 P B ; 9 =,x ( n ) x,y :(,..., n ) 2 P B ; Sum of robbilities leding to successful cheting

33 We now consider Quntum rotocols

34 Quntum Coin-Fliing Protocol Construction Alice chooses uniformly t rndom nd smles x with robbility This cn be done in suerosition using quntum sttes (This llows for stronger chet detection) Uon choosing rndomly, Alice cn crete the stte: x,x xi

35 Quntum Coin-Fliing Protocol Construction Alice chooses uniformly t rndom nd smles x with robbility This cn be done in suerosition using quntum sttes (This llows for stronger chet detection) OR, she cn just crete the stte i 2 x,x xi

36 Quntum Coin-Fliing Protocol Construction Alice chooses uniformly t rndom nd smles x with robbility This cn be done in suerosition using quntum sttes (This llows for stronger chet detection) And, to mke it bit better... i :=, i 2 x For Alice For Bob,x x, xi Extr x for chet detection

37 Quntum Coin-Fliing Protocol Construction Bob chooses b uniformly t rndom nd smles y with robbility b This cn be done in suerosition using quntum sttes (This llows for stronger chet detection) Uon choosing b rndomly, Bob cn crete the stte: y b,y yi

38 Quntum Coin-Fliing Protocol Construction Bob chooses b uniformly t rndom nd smles y with robbility b This cn be done in suerosition using quntum sttes (This llows for stronger chet detection) OR, he cn just crete the stte b bi 2 y b,y yi

39 Quntum Coin-Fliing Protocol Construction Bob chooses b uniformly t rndom nd smles y with robbility b This cn be done in suerosition using quntum sttes (This llows for stronger chet detection) And, to mke it bit better... i := b b, bi 2 y For Bob For Alice b,y y, yi Extr y for chet detection

40 Quntum Coin-Fliing Protocol Alice cretes the quntum stte i := 2, i x,x x, xi Bob cretes the quntum stte i := b 2 b, bi y b,y y, yi For i = to n Alice sends xi to Bob Bob sends yi to Alice Alice sends to Bob Bob sends b to Alice Alice mesures to determine: () The vlue of b (2) If Bob cheted Bob mesures to determine: () The vlue of b (2) If Alice cheted

41 Quntum Coin-Fliing Protocol Alice cretes the quntum stte i := 2, i x,x x, xi Bob cretes the quntum stte i := b 2 b, bi y b,y y, yi x xx2x3 bby yy2 y3

42 Quntum Coin-Fliing Protocol Alice cretes the quntum stte i := 2, i x,x x, xi Bob cretes the quntum stte i := b 2 b, bi y b,y y, yi x x2x3 bby xyy2 y3

43 Quntum Coin-Fliing Protocol Alice cretes the quntum stte i := 2, i x,x x, xi Bob cretes the quntum stte i := b 2 b, bi y b,y y, yi x yx2x3 bby x y2 y3

44 Quntum Coin-Fliing Protocol Alice cretes the quntum stte i := 2, i x,x x, xi Bob cretes the quntum stte i := b 2 b, bi y b,y y, yi x y x3 bby xx2 y2 y3

45 Quntum Coin-Fliing Protocol Alice cretes the quntum stte i := 2, i x,x x, xi Bob cretes the quntum stte i := b 2 b, bi y b,y y, yi x y2 y x3 bby xx2 y3

46 Quntum Coin-Fliing Protocol Alice cretes the quntum stte i := 2, i x,x x, xi Bob cretes the quntum stte i := b 2 b, bi y b,y y, yi x yy2 bby xx2x3 y3

47 Quntum Coin-Fliing Protocol Alice cretes the quntum stte i := 2, i x,x x, xi Bob cretes the quntum stte i := b 2 b, bi y b,y y, yi x yy2 y3 bby xx2x3

48 Quntum Coin-Fliing Protocol Alice cretes the quntum stte i := 2, i x,x x, xi Bob cretes the quntum stte i := b 2 b, bi y b,y y, yi x yy2 y3 bby xx2x3 Alice is now relly entngled with Bob!

49 Quntum Coin-Fliing Protocol Alice cretes the quntum stte i := 2, i x,x x, xi Bob cretes the quntum stte i := b 2 b, bi y b,y y, yi y bby x y2y3 xx2x3

50 Quntum Coin-Fliing Protocol Alice cretes the quntum stte i := 2, i x,x x, xi Bob cretes the quntum stte i := b 2 b, bi y b,y y, yi b y yy2 y3 b x xx2x3

51 Quntum Coin-Fliing Protocol Alice cretes the quntum stte i := 2, i x,x x, xi Bob cretes the quntum stte i := b 2 b, bi y b,y y, yi Outcome? b y yy2 y3 b x xx2 x3 Alice mesures to lern nd b. Deending on b, she mesures y, y, y2, y3 to see if it s in the stte bi := y b,y y, yi

52 Quntum Coin-Fliing Protocol Alice cretes the quntum stte i := 2, i x,x x, xi Bob cretes the quntum stte i := b 2 b, bi y b,y y, yi Bob cheted? b y yy2 y3 b x xx2 x3 Alice mesures to lern nd b. Deending on b, she mesures y, y, y2, y3 to see if it s in the stte bi := y b,y y, yi

53 Quntum Coin-Fliing Protocol Alice cretes the quntum stte i := 2, i x,x x, xi Bob cretes the quntum stte i := b 2 b, bi y b,y y, yi Outcome? b y yy2 y3 b x xx2 x3 Bob mesures to lern nd b. Deending on, he mesures x, x, x2, x3 to see if it s in the stte i := x,x x, xi

54 Quntum Coin-Fliing Protocol Alice cretes the quntum stte i := 2, i x,x x, xi Bob cretes the quntum stte i := b 2 b, bi y b,y y, yi Alice cheted? b y yy2 y3 b x xx2 x3 Bob mesures to lern nd b. Deending on, he mesures x, x, x2, x3 to see if it s in the stte i := x,x x, xi

55 Clculting the quntum cheting robbilities s n SDP Probbility Bob PA,0 = su h F, B,0 i s.t. Tr ( ) = ih Tr 2 ( 2 ) = Tr Y ( ) oututs 0. Tr n ( n ) = Tr Yn ( n ) Tr,A ( F ) = Tr Yn ( n ) i 0 Vribles re Bob s quntum sttes throughout the rotocol Alice cnnot lter ll of Bob s stte

56 Clculting the quntum cheting robbilities Probbility Alice PB,0 = su h F, A,0 i s.t. Tr Y ( ) = Tr ih Tr Y2 ( 2 ) = Tr 2 ( ) oututs 0. Tr Yn ( n ) = Tr n ( n ) Tr B,Y ( F ) = Tr A, ( n ) i 0 Vribles re Alice s quntum sttes throughout the rotocol Bob cnnot lter ll of Alice s stte

57 Where we re going...?

58 Simlifying Alice s SDPs Clssicl cheting olytoe Theorem: P A,0 := mx where: ( 2 y,yf (s (,y), ):(s,...,s n,s) 2 P A ) F (, q) := i i qi! 2 n := mx h, o T i : dig() =q, < = := mx i j t i,j :(q i,q j,t i,j ) 2 RSOC 3, 8i, j : 2 ; i,j

59 Simlifying Alice s SDPs Clssicl cheting olytoe Theorem: P A,0 := mx where: ( 2 y,yf (s (,y), ):(s,...,s n,s) 2 P A ) F (, q) := i i qi! 2 n := mx h, o T i : dig() =q, < = := mx i j t i,j :(q i,q j,t i,j ) 2 RSOC 3, 8i, j : 2 ; i,j Time to solve: 0. seconds

60 Simlifying Alice s SDPs Clssicl cheting olytoe Theorem: P A,0 := mx where: ( 2 y,yf (s (,y), ):(s,...,s n,s) 2 P A ) F (, q) := i i qi! 2 n := mx h, o T i : dig() =q, < = := mx i j t i,j :(q i,q j,t i,j ) 2 RSOC 3, 8i, j : 2 ; i,j Time to solve: 0. seconds

61 Simlifying Bob s SDPs Theorem: P B,0 := mx where: ( 2 ) F (( I) T n, ) :(,..., n ) 2 P B F (, q) := i i qi! 2 n := mx h, o T i : dig() =q, < = := mx i j t i,j :(q i,q j,t i,j ) 2 RSOC 3, 8i, j : 2 ; i,j

62 Clssicl LPs vs Quntum SDPs

63 Duls...

64 ... Point Gmes

65 Point Gme Ide Strt with two oints [,0] nd [0,], ech with robbility /2. The ide is to merge the oints/robbilities into single oint Points re eigenvlues of dul vribles. The ide is to stri wy the messy bsis informtion Nottion: q [x,y] is oint [x,y] with robbility q

66 Bsic Point Gme Moves Point Rising: q[x, y]! q[x 0,y] (x 0 x) Point Merging: n q i [x i,y]! n q i! lepn i= q ix i P n i= q i,y i= i= Point Slitting: n i= q i! 2 4 P n i= q i,y5! q i i= x i Pn 3 n i= q i [x i,y]

67 Esy Point Gme Merged two oints [ (Tr A 2 A n (α 0 ), Tr A2 A n (α )), ] Rised oint Finl oint

68 Esy Point Gme Rised this oint Merged two oints [, (β 0, β ) ] Finl oint

69 Bob s Quntum Dul P B, := min Px (w ) x s.t. (w ) x Px 2 (w 2 ) x,y,x 2 (w 2 ) x,y,x 2 Px 3 (w 3 ) x,y,x 2,y 2,x 3 (w n ) x,y,...,x n P 2,xv,y Dig(v ) T ā ā.

70 Bob s Quntum Dul P B, := min Px (w ) x s.t. (w ) x Px 2 (w 2 ) x,y,x 2 (w 2 ) x,y,x 2 Px 3 (w 3 ) x,y,x 2,y 2,x 3. (w n ) x,y,...,x n P 2,xv,y Dig(v ) T ā ā () y ā,y v,y le

71 Bob s Quntum Dul Point Merges P B, := min Px (w ) x s.t. (w ) x Px 2 (w 2 ) x,y,x 2 (w 2 ) x,y,x 2 Px 3 (w 3 ) x,y,x 2,y 2,x 3 Point Rises. (w n ) x,y,...,x n P 2,xv,y Dig(v ) T ā ā () y ā,y v,y le Point Slits

72 Alice s Quntum Dul P A,0 := min z s.t. z Py (z 2 ) x,y (z 2 ) x,y Py 2 (z 3 ) x,y,x 2,y 2 (z n ) x,y,...,x n,y n (z n+ ) x,y Dig(z (y) n+ ) 2,y T.

73 Alice s Quntum Dul Point Merges P A,0 := min z s.t. z Py (z 2 ) x,y (z 2 ) x,y Py 2 (z 3 ) x,y,x 2,y 2 Point Rises Point Slits (z n ) x,y,...,x n,y n (z n+ ) x,y Dig(z (y) n+ ) 2,y T. () y,y,x 2(z n+ ) x,y le

74 Quntum Point Gme ( of 3)

75 Quntum Point Gme (2 of 3)

76 Quntum Point Gme (3 of 3)

77 Quntum Point Gme (3 of 3) Finl oint [ B,, A,0 ] B, = x (w ) x so P B, le B, A,0 = z so P A,0 le A,0

78 Observtions Protocol is defined only by the four robbility vectors 0, nd 0, Point gme is defined only by the (four) different oint slittings Therefore rotocol (nd dul fesible solution) defines oint gme nd oint gme defines rotocol (nd fesible dul solution). Moreover, the endoint of the oint gme gives n uer bound on cheting (nd cn be equl to the otiml cheting strtegies)!

79 Observtions Therefore, otimizing oint gme is equivlent to otimizing over cheting strtegies! The moves lso hve context: Point slittings occur when there is mesurement, merges occur when there is messge generted, nd rises occur when you receive messge. Moving either horizontlly or verticlly corresonds to either Alice or Bob If this is true, then clssicl oint gmes shouldn t hve oint slits...

80 Lst Piece: Clssicl Point Gmes

81 Clssicl Point Gme (Fvouring Cheting Alice) Finl oint [ (Tr A 2 A n (α 0 ), Tr A2 A n (α )), ]

82 Clssicl Point Gme (Fvouring Cheting Bob) Finl oint [, (β 0, β ) ]

83 Finl Crystl Structure

84 Security Results Clssicl rotocols re insecure (t lest one rty cn chet erfectly) At most one rty cn chet erfectly (holds in the clssicl nd quntum cse) If quntum rotocol hs P B,0P A,0 =/2 nd P B,P A, =/2 then quntum nd clssicl robbilities re equl. Thus, is imossible P B,0 = P B, = P A,0 = P A, =/ 2

85 Security Results Clssicl rotocols re insecure Wht bout better quntum rotocols? Emiricl Answer: NO Comuttionl er will be on the rxiv soon!

86 Thnk you!

Quantum and Classical Coin-Flipping Protocols based on Bit-Commitment and their Point Games

Quantum and Classical Coin-Fliing Protocols based on Bit-Commitment and their Point Games Ashwin Nayak, Jamie Sikora, Levent Tunçel Follow-u work to a aer that will aear on the arxiv on Monday Berkeley