Efficient Probabilistically Checkable Proofs and Applications to Approximation Abstract 1 Introduction

Home , BPP (complexity), DTIME, NC (complexity), PP (complexity), RE (complexity), SL (complexity)

Appears in Proceedings of the 25th Annual ACM Symposium on the Theory of Computing, ACM (1993).

Eﬃcient Probabilistically Checkable Proofs and Applications to Approximation

M. Bellare∗ S. Goldwasser† C. Lund‡ A. Russell§

May 1993

Abstract 1 Introduction

We construct multi-prover proof systems for NP which The last two years have witnessed major advances in use only a constant number of provers to simultaneously classifying the complexity of approximating classical op- achieve low error, low randomness and low answer size. timization problems [Co, FGLSS, AS, ALMSS, BR, FL, As a consequence, we obtain asymptotic improvements Be, Zu, LY1, LY2]. These works indicate that a prob- to approximation hardness results for a wide range of lem P is hard to approximate by showing that the ex- optimization problems including minimum set cover, istence of a polynomial time algorithm that approxi- dominating set, maximum clique, chromatic number, mates problem P to within some factor Q would im- and quartic programming; and constant factor improve- ply an unlikely conclusion like NP ⊆ DTIME(T (n)) ments on the hardness results for MAXSNP problems. or NP ⊆ RTIME(T (n)), with T polynomial or quasi- In particular, we show that approximating minimum polynomial. These results are derived by reductions set cover within any constant is NP-complete; approx- from interactive proofs. Namely, by first characteriz- imating minimum set cover within Θ(log n) implies ing NP as those languages which have efficient interac- NP ⊆ DTIME(nlog log n); approximating the maximum tive proofs of membership; and second by reducing the of a quartic program within any constant is NP-hard; problem of whether there exists an interactive proof for approximating maximum clique within n1/30 implies membership in L (L ∈ NP) to the problem of approxi- NP ⊆ BPP; approximating chromatic number within mating the cost of an optimal solution to an instance of n1/146 implies NP ⊆ BPP; and approximating MAX- problem P . 3SAT within 113/112 is NP-complete. Today such results are known for many important ∗Department of Computer Science & Engineering, Mail Code problems P , with values of Q and T which differ from 0114, University of California at San Diego, 9500 Gilman Drive, problem to problem; for example, it was shown by [LY1] La Jolla, CA 92093. E-mail: [email protected]. † that approximating the size of the minimum set cover to MIT Laboratory for Computer Science, 545 Technology polylog n Square, Cambridge, MA 02139, USA. e-mail: shafi@theory. within Θ(log N) implies NP ⊆ DTIME(n ), and lcs.mit.edu. Partially supported by NSF FAW grant No. it was shown by [FGLSS, AS, ALMSS] that for some 9023312-CCR, DARPA grant No. N00014-92-J-1799, and grant constant c > 0 approximating the size of a maximum No. 89-00312 from the United States - Israel Binational Science clique in a graph within factor nc implies that P = NP. Foundation (BSF), Jerusalem, Israel. ‡AT&T Bell Laboratories, Room 2C324, 600 Mountain Av- The values of Q and T achieved depend on the effi- enue, P. O. Box 636, Murray Hill, NJ 07974-0636, USA. email: ciency parameters of the underlying proof system used [email protected]. in the reduction to optimization problem P . The precise § MIT Laboratory for Computer Science, 545 Technology manner in which Q and T depend on these parameters Square, Cambridge, MA 02139, USA. e-mail: [email protected]. mit.edu. Supported by a NSF Graduate Fellowship and by NSF depends on the particular problem P and the particular grant 92-12184, AFOSR 89-0271, and DARPA N00014-92-J-1799. reduction used.

1 r = r(n) p = p(n) a = a(n) = (n) How (in a word)

1 (1) O(log n) 2 O(1) 2 + ∗ [ALMSS]+[FRS]+[Fe] (2) O(log n) O(k(n)) O(1) 2−k(n) O(k(n)) [CW, IZ]-style repetitions of (1). (3) O(k(n) log2 n) 2 O(k(n) log2 n) 2−k(n) [FL]

(4) O(k(n) log n) + poly(k(n), log log n) 4 poly(k(n), log log n) 2−k(n) This paper.

Figure 1: Number of random bits (r), number of provers (p), answer size (a) and error probability () in results of the form NP ⊆ MIP1[r, p, a, q, ]. Here k(n) is any function bounded above by O(log n) and ∗ is any positive constant.

The goal of this paper is to improve the values of We emphasize that the model (PCP or MIP1) is not Q and T in such reductions. Thus we need to reduce as important, in this context, as the values of the pa- the complexity of the underlying proof systems. Let us rameters p, r, a, . Although the parameterized versions begin by seeing what are the proof systems in question of PCP and MIP1 are not known to have equal language and what within these proof systems are the complexity recognition power for a given r, p, a, ,1 most known re- parameters we need to consider. ductions to approximation problems in one model are easily modified to work in the other as long as p, r, a, remain the same. Accordingly, we sometimes state re- 1.1 PCP and MIP sults in terms of MIP1 and sometimes in terms of PCP, Several variants of the interactive proof model have been and leave the translations to the reader. used to derive intractability of approximation results. We note that there may be a motivation to move to We focus on two of them. The first is the (single round the PCP model when proving an approximation hard- version of the) multi-prover model of Ben-Or, Gold- ness result if one could prove results of the form NP ⊆ wasser, Kilian and Wigderson [BGKW]. The second PCP[r, p, a, q, ] which attain better values of the param- is the “oracle” model of Fortnow, Rompel and Sipser eters than results of the form NP ⊆ MIP1[r, p, a, q, ]. [FRS], renamed “probabilistically checkable proofs” by Arora and Safra [AS]. In each case, we may distin- 1.2 New Proof Systems for NP guish five parameters which we denote by r, p, a, q and (all are in general functions of the input length n). In a Our main result is the construction of low complexity, multi prover proof these are, respectively, the number of low error proof systems for NP which have only a con- random bits used by the verifier, the number of provers, stant number of provers. In its most general form the the size of each prover’s answer, the size of each of the result is the following. verifier’s questions to the provers, and the error probability. Correspondingly in a probabilistically checkable Theorem 1.1 Let k(n) ≤ O(log n) be any func- −k(n) proof these are the number of random bits used by the tion. Then NP ⊆ MIP1[r, 4, a, q, 2 ], where verifier, the number of queries to the oracle, the size r = O(k(n) log n) + poly(k(n), log log n), a = of each of the oracle’s answers, the size of each indi- poly(k(n), log log n), and q = O(r). vidual query, and the error probability. We denote by MIP1[r, p, a, q, ] and PCP[r, p, a, q, ] the corresponding The table of Figure 1 summarizes previous results of classes of languages. the form NP ⊆ MIP1[r, p, a, q, ] in comparison with Note that the total number of bits returned by the ours. We omit the question size q from the table be- provers or oracle is pa; we will sometimes denote this cause it is in all cases O(r) and doesn’t matter in re- quantity by t. In some applications the important pa- ductions anyway. The main result of [ALMSS], which rameter is the expected value of t. To capture this we states that there is a constant t such that NP = 0 define PCP as PCP except that the p parameter is the PCP[O(log n), t, 1,O(log n), 1/2], is incorporated as the expected number of queries made by the verifier. 1 The parameters which are important in applications It is easy to see that MIP1[r, p, a, q, ] ⊆ PCP[r, p, a, q, ], to approximation seem to be r, p, a, . However, as q is but the converse containment is not known to be true. When complexity is ignored the models are of course the same [FRS, important in transformations of one type of proof sys- BFL]. For explanations and more information we refer the reader tem to another, we included it in the list. to §2.

2 special case k(n) = 1 of the result shown in (2). The re- and quartic programming (using Theorem 1.1), and we sult shown in (1) is obtained as follows. First apply the have improvements in the factor Q for maximum clique, transformation of [FRS] to the [ALMSS] result to get chromatic number, MAX3SAT, and quadratic program- NP ⊆ MIP1[O(log n), 2, t, O(log n), 1 − 1/(2t)] where t ming (using Theorem 1.2). is the constant from [ALMSS] as above. Then apply [Fe] to bring the error to any constant strictly greater than Set Cover. For a definition of the problem we re- 1/2, at constant factor cost in the other parameters. fer the reader to §4.1. Recall that there exists a poly- Comparing these results with ours, we note the follow- nomial time algorithm for approximating the size of ing features, all of which are important to our applica- the minimum set cover to within a factor of Θ(log N), tions. First, by setting k(n) to an appropriate constant, where N is the number of elements in the base set we can achieve any constant error using only logarith- [Jo, Lo]. Hardness of approximation was recently shown mic randomness and answer sizes, which improves the by Lund and Yannakakis [LY1]. The reduction they result shown in (1), where logarithmic randomness and used has the property that T is proportional to 2r+a answer size are only achievable for a particular constant while Q increases as decreases, and decreases as error. Second, the number of provers we use is a con- r + a increases.2 Ideally we would like r + a to be stant independent of the error, which is not true of the O(log n) (so that the conclusion is that approxima- result shown in (2). Finally, for small k(n) and given er- tion to within Q is NP-complete) while making as ror 2−k(n) our randomness and answer sizes are smaller small as possible (so that Q can tend to its optimal than those of the result of [FL] shown in (3); in par- value of Θ(log N)). However, the reduction, like those ticular, for k(n) = logo(1) n we have O(k(n) log n) ran- of [BR, FL, Be], additionally requires that the num- domness and answer sizes, and for k(n) = O(log log n) ber of provers be p = 2, although (in this case) it we have polyloglog(n) answer sizes. On the other hand, can be extended easily to any constant. Lund and the number of provers we use is four rather than the two Yannakakis were thus constrained to use either the achieved in the results (1) and (3), but this will suffice result NP ⊆ MIP1[O(log n), 2,O(1),O(log n), θ(1)], or 2 2 for our applications to approximation. the result NP ⊆ MIP1[O(k(n) log n), 2,O(k(n) log n), 2 −k(n) The (constant) number of bits t that one needs to O(k(n) log n), 2 ] (cf. (1) and (3) of Figure 1). Us- check in the [ALMSS] result NP ⊆ PCP[O(log n), t, 1, ing the first they conclude that there exists some (par- O(log n), 1/2] is of the order of 104. Some reductions in ticular) constant c > 0 such that approximating the this value were obtained by [PS]. Our improved com- value of the minimum set cover to within factor c is NP- plexity of four prover proofs for NP in terms of random- complete. Using the second they conclude that approx- ness and answer size for a given error, together with a imating the value of the minimum set cover to within polylog n careful analysis of the [ALMSS] construction and proofs Θ(log N) implies NP ⊆ DTIME(n ). Based on enable us to obtain substantially smaller values than Theorem 1.1 we can improve these results, as follows. previously known. Specifically, focusing on the expected Theorem 1.3 Let c > 0 be any constant. Suppose value, we show the following. there is a polynomial time algorithm which approximates Theorem 1.2 NP = PCP0[O(log n), 29, 1,O(log n), the size of the minimum set cover to within c. Then 1/2]. P = NP. Theorem 1.4 For any constant c < 1/8 the following Both of the above results have applications to approxi- is true. Suppose there is a polynomial time algorithm mation. which approximates the size of the minimum set cover to within c log N. Then NP ⊆ DTIME(nlog log n). 1.3 Applications to Approximation Similar improvements follow for all of the following A “hardness of approximation” result for a particular problems: dominating set, hitting set, hypergraph optimization problem P is, as we said above, a proof transversal, minimum exact cover (cf. [KT, LY1]). that the existence of a polynomial time, factor Q approximation algorithm for P would imply something like Max Clique, Chromatic number. Known results NP ⊆ DTIME(T (n)) or NP ⊆ RTIME(T (n)). Our new for Max-Clique are based on the result of [ALMSS] proof systems lead to improvements in the values of the which states that there are constants t, d such that quality Q of the approximation shown to be hard, and NP = PCP[d log n, t, 1,O(log n), 1/2]. Using the reduc- the time T for the deterministic or probabilistic simu- tion of [FGLSS], it follows that there exists a constant lation of NP in the conclusion, in known results for a 2 This is a simplification of the actual situation, but will suffice variety of problems P . Specifically, we have improve- for the purpose of this discussion. See Lemma 4.1 for the precise ments in both factor Q and conclusion T for set cover tradeoff.

3 c > 0 such that approximating the size of the maximum Theorem 1.8 Let c ∈ (0, 1) be any constant. Sup- clique in a graph to within nc is NP-complete; this re- pose there exists a polynomial time algorithm for c- sult uses randomness efficient error reduction techniques approximating the maximum of a quartic program. such as [CW, IZ, BGG], and c depends on t, d as well as Then P = NP. other constants arising from the error-reduction. Zuck- erman [Zu] uses a random construction which achieves c = 1/(1 + t) at the cost of weakening the conclusion 1.4 Open Problems to NP ⊆ BPP. Based on Theorem 1.2, we can improve We believe that the optimal result to reach is the value of c in this result. NP ⊆ MIP1[O(log n), 2,O(log n), q(n), 1/n] for some q(n). That is, NP has two prover proof systems with Theorem 1.5 Suppose there exists a polynomial time logarithmic randomness and answer sizes, and 1/n er- algorithm which can approximate the size of the max- −Θ(1) 1/30 ror. One implication would be that (1 − n )- imum clique in a graph to within n . Then NP ⊆ approximating a quadratic program implies P = NP. BPP. For set cover, a weaker result would suffice. If for some ω(1) The factor can be increased to n1/25 if the conclusion constant p and (n) = 1/ log n we could show that is weakened to NEXP ⊆ BPEXP. For the problem of NP ⊆ MIP1[O(log n), p, O(log n), q(n), (n)] for some approximating the chromatic number of a graph, the q(n), then we would get: approximating the size of a reduction of [LY1] implies the following. minimum set cover to within c log N implies P = NP for any constant c < 1/(2p). Theorem 1.6 Suppose there exists a polynomial time algorithm which can approximate the chromatic number 1.5 Notes of a graph to within n1/146. Then NP ⊆ BPP. This is essentially the STOC version of our paper but 1/121 The factor can be increased to n if the conclusion corrects a few mistakes which have been pointed out to is weakened to NEXP ⊆ BPEXP. us subsequently. The changes are summarized below. In the STOC version we said that the variant of the Using the same characterization of NP as Max-3SAT. [FGLSS] clique reduction given in [Zu] shows that ap- for Max-Clique, it was also shown by [ALMSS] that proximating clique to within n1/t implies NP ⊆ BPP, there exists a constant c > 1 such that approximat- and thus had Theorem 1.5 with a factor of n1/29. ing the maximum number of simultaneously satisfiable In truth [Zu] achieves n1/(1+t) so that the factor in clauses in a 3SAT instance to within factor c is NP- Theorem 1.5 should be the n1/30 which now appears complete. We can prove the same with a higher value there. Thanks to David Zuckerman for pointing this of c than previously achieved. out. Theorem 1.7 Suppose there exists a polynomial time In the STOC version we implied that our result for algorithm which approximates the maximum number of clique implied a result for chromatic number with the simultaneously satisfiable clauses in a 3SAT instance to same approximation factor. We had forgotten to factor within 113/112. Then P = NP. in the cost of the reduction of [LY1] which increases the size of the graph. So the factor for chromatic number is The factor can be improved to 94/93 if the conclusion n1/146 as now stated in Theorem 1.6. Thanks to Madhu is weakened to EXP = NEXP. Sudan for pointing this out. In the STOC version we said that the best known Quartic Programming. This is the problem of maxi- value of the constant error achievable for the result mizing a n-variate polynomial of total degree four over a NP ⊆ MIP1[O(log n), 2,O(1),O(log n), ] was a value (compact) subset of Rn specified by linear constraints. close to 1, namely = 1 − 1/(2t) where t is the number We know that there exists a constant c ∈ (0, 1) such of bits queried in the [ALMSS] proof. However the result that the following is true: the existence of a polynomial of [Fe] can be used to bring to any constant greater time algorithm for c-approximating3 the maximum of a than 1/2, as now indicated in Figure 1(1). Thanks to quartic program implies P = NP; this follows from the Uri Feige for pointing this out. corresponding result of [BR, FL] for quadratic programming. Based on Theorem 1.1 we can improve this to show the same for any constant. 2 Preliminaries 3 The definition of approximation used in this context of “continuous” optimization problems is not the usual one of approxi- We extend notations and terminology for multi-prover mating to within a multiplicative factor; see §4.3 for details. and probabilistically checkable proofs to take into ac-

4 count the five measures of complexity (r, p, a, q, ) in is easy to see that MIP1[r, p, a, q, ] ⊆ PCP[r, p, a, q, ]. which we will be interested. But whether or not the converse containment is true In a (one round) multi-prover proof system for a remains an open question. In particular, known simu- language L, a verifier V interacts on common input lations of probabilistically checkable proofs by multi- x ∈ {0, 1}n with p = p(n) provers. The interaction prover ones (such as those used by [FRS] to show 4 consists of a single round. Namely, V flips r = r(n) PCP = MIP1) don’t preserve complexity. coins to get a random string R, and as a function of Let us now state the (well known) lemma which x and R computes p queries Q1,...,Qp, each of length will be our starting point. It is obtained by apply- q = q(n). Qi is sent to the i-th prover, who is regarded ing standard transformations (cf. [BGKW, FRS]) to as a function from {0, 1}q to {0, 1}a. This prover re- the NP ⊆ PCP[O(log n),O(1), 1,O(log n), 1/2] result of sponds with a string Ai of length a = a(n). As a func- [ALMSS]. tion of x, R, A1,...,Ap the verifier decides whether or not to accept. Usually the common input x and its Lemma 2.1 Suppose k(n) ≤ O(log n). Then NP ⊆ −k(n) length n will be understood. We will denote by QV (R, i) MIP1[O(k(n) log n),O(k(n)),O(1),O(log n), 2 ]. the question posed to the i-th prover when the verifier’s coins are R; this is computable in time polyno- Note we could further reduce the randomness to mial in n. We let QV (R) = (QV (R, 1),...,QV (R, p)). O(log n) by using the techniques of [CW, IZ]; this is We denote by V (R,A1 ...Ap) the verifier’s decision on the result we stated in Figure 1(2). But the advantage whether or not to accept. We demand that this decision will be lost in the transformations we will apply later, procedure can be expressed as a circuit CR(A1 ...Ap) so we don’t bother. of size poly(p, a), where the verifier accepts if and only if CR(A1 ...Ap) = 1. We require that CR be con- structible from x, R in time poly(n). We say that V 3 Efficient Proof Systems is a MIP1[r, p, a, q, ] verifier for L if (1) when x ∈ L there are provers who can make the verifier accept We prove our main theorem in two steps. The starting with probability 1, while (2) if x 6∈ L then for all point is the proof system of Lemma 2.1. This proof sys- collections of provers, the probability that the veri- tem has O(k(n)) provers, and we need to reduce this to fier accepts is at most the specified error-probability a constant. Applying the transformation of [LS, FL] will = (n) < 1. MIP1[r, p, a, q, ] denotes the class of not suffice, because in reducing the number of provers languages possessing MIP1[r, p, a, q, ] verifiers. We let this transformation increases the amount of randomness MIP1 = MIP1[poly(n), poly(n), poly(n), poly(n), 1/2]. as well as the answer sizes (cf. Figure 1(3)). We tackle It is known that MIP1 = NEXP [BFL]. this problem by concentrating first on keeping the ran- Probabilistically checkable proofs, as defined in [AS, domness down. In a first step we show how to reduce ALMSS] are the same as what [FRS] had earlier called the number of provers to two while not increasing the the oracle model. In this model, a verifier V has ac- randomness, but at the cost of an exponential blowup n cess to an input x ∈ {0, 1} and an oracle which is in answer sizes. However, in a second step we apply q a regarded as a function from {0, 1} to {0, 1} . The recursion to reduce the answer sizes while keeping the verifier flips r coins, as a function of which he com- other quantities under control. Let us now proceed to q putes p queries Q1,...,Qp ∈ {0, 1} for the oracle. our first step. a The oracle returns answers A1,...,Ap ∈ {0, 1} , and the verifier decides whether or not to accepts as a function of x, R, A1,...,Ap. Attributes of the verifier 3.1 Reducing Randomness are as for the multi-prover case. V is said to be a As discussed above, the transformation of [FL, LS] PCP[r, p, a, q, ] verifier for L if (1) when x ∈ L there reduces the error without increasing the number of is an oracle which makes the verifier accept with prob- provers, but costs in randomness. We combine this ability 1, while (2) if x 6∈ L then for any oracle the transformation with the idea of [BFLS] of using as “base probability that the verifier accepts is at most the spec- field” not {0, 1} but some larger subset H of the under- ified error-probability = (n). Conventions and no- lying finite field F . Choosing h = log |H| appropriately tation used will also be analogous to the MIP case. 1 we need use only O(k(n) log n) random bits to get error In particular, PCP[r, p, a, q, ] denotes the class of lan- 2−k(n) at the cost of answer sizes which grow exponen- guages possessing PCP[r, p, a, q, ] verifiers, and PCP = tially in h. PCP[poly(n), poly(n), poly(n), poly(n), 1/2]. We also let PCP[r, p] = PCP[r, p, 1,O(r), 1/2] as defined in [AS]. 4 The basic result of [FRS] is PCP[r, p, a, q, ] ⊆ MIP1[r + It is known that PCP = MIP1 [FRS]. Furthermore, it lg p, 2, a, q, 1 − (1 − )/p].

5 Theorem 3.1 Let k = k(n) ≤ O(log n) be any functions. The error stemming from the construction of tion. Let h(n) = max(k(n), log log n). Then NP ⊆ [LS] (i.e. the probability that the provers’ replies are h(n) −k(n) MIP1[k(n) log n, 2, k(n) log n · 2 , k(n) log n, 2 ]. not “functional”) can be bounded by r Proof: Let L ∈ NP. By Lemma 2.1 there is a sd p f MIP1[r, p, a, q, ] verifier V for L with p = O(k(n)), 2 r = O(k(n) log n), q = O(log n), a = O(1), and −h−1 −k−1 −k(n)−1 which is at most 2 ≤ 2 = for large enough = 2 . n. So the total error is at most 2 = 2−k. We omit the 0 0 0 0 We construct a MIP1[r , 2, a , q , 2] verifier V for L, details. with r0, q0, a0 to be specified later, as follows. Let s = h h q/h, d = 2 − 1, and H = {0, 1} . Fix a finite field 3.2 Reducing Answer Sizes F ⊇ H with f def= log |F | def= 3h+log(q/h). V 0 flips coins to get a r bit random string R, and for i = 1, . . . , p lets Answer sizes will be reduced by recursion (cf. [AS]). q Qi = QV (R, i) ∈ {0, 1} be the query that V would send First need to define carefully how we look at MIP1 −k(n) to prover i. Regard each Qi as divided into s pieces, each verifiers. Let V be a MIP1[r, p, a, q, 2 ] verifier for 1 s j some language L. Note that any strategy of a prover of size h (that is, Qi = Qi ...Qi with each Qi in H) so s s that Qi is an element of H ⊆ F . We now apply the in the single question model is a (deterministic) func- technique of [LS]. V 0 chooses, randomly and uniformly, tion from questions to answers. We view the verification s s y1, . . . , yp from F . For each i we let li : F → F be process as a family of circuits {CR(y1, . . . , yp)} each of (a canonical representation of) the unique line through size poly(p, a); one for every random seed of V . The Qi and yi. Let ti,1, ti,2 ∈ F satisfy li(ti,1) = Qi and variables yi will correspond to the ith prover as follows: 0 li(ti,2) = yi. V sends l1, . . . , lp to the first prover, and any assignment Yi to yi will correspond to a strategy of y1, . . . , yp to the second. the ith prover (i.e specifying all answers to all question). For every query Q, that V can ask the ith prover, the It is assumed that the first prover’s reply has the form a input variable yi to CR contains a segment of variables (A1,...,Ap) where each Ai : F → F is a degree sd (y1 , . . . , ya ) such that yj corresponds to the jth bit polynomial, and the second prover’s reply has the form iQ iQ iQ a of the ith provers answer to the query Q. We say that (α1, . . . , αp) with each αi in F . For i = 1, . . . , p the 0 the input yi is a-segmented, since the length of each verifier V sets ai = Ai(ti,1). It also sets a bit CT segment is bounded by a. Note that CR for every R (“consistency check”) to 1 if for all i = 1, . . . , p it is the 0 only depends on one segment from each input yi.A case that Ai(ti,2) = αi, and 0 otherwise. V accepts iff family of circuit CR with this property we denote by CT = 1 and V (R, a1 . . . ap) = 1. {CR([y1],..., [yp])}, i.e., there is a way of segmenting s a For each i let gi : H → {0, 1} represent an optimal the inputs yi such that CR(y1, . . . , yp) only depend on strategy for the i-th prover in the protocol of V . Let one segment from yi for any R. s a gî : F → F denote an extension of gi to a multinomial First we will describe an encoding scheme of n bit of degree d = 2h − 1 in each variable. Suppose the strings. Let m = dlog n/ log log ne and F be a finite provers are honest. Then the first prover chooses his field such that |F | ≥ log n. Let H = {1, 2,... dlog ne} ⊂ m m reply polynomials according to Ai =g îli for i = 1, . . . , p F . Since |H | ≥ n we can use H as indexes of the and the second prover chooses his reply points according bits, i.e., we fix an injective map τ : {1, 2, . . . , n} → m to αi =g î(yi) for i = 1, . . . , p. It is easy to see that these H . Note that for any n bit string Y there exists a 0 answers lead V to accept with probability 1. multivariate polynomial Y˜ (x1, x2, . . . , xm) such that the degree of any variable is at most d = |H| − 1 and such The amount of randomness used is O(k(n) log n) to gen- that for every i ∈ {1, 2, . . . , n} : Y = Y˜ (τ(i)). We call erate R, plus psf = O(k) · (q/h) · [3h + log(q/h)] to gen- i E (Y ) = hY˜ (α , . . . , α )i m the low degree erate y , . . . , y . The latter is ≤ O(kq) + O(k) · log q/h, P 1 m (α1,...,αm)∈F 1 p encoding of Y . Given any two functions f, f 0 : F m → F which is O(k(n) log n) (because h(n) ≥ log log n and we define ∆(f, f 0) = |{u ∈ F m|f(u) 6= f 0(u)}|/|F |m, q = O(log n)), so total randomness used is r0 = i.e., the fraction of points where f and f 0 disagree. O(k(n) log n) as desired. Query size q0 is clearly of the The following lemma describes that a given circuit C same order. The answer size a0 is dominated by the with p n-bit inputs it is possible to construct a family answer size for the first prover, which is p(sd)(af) = of smaller circuits that verifies in a probabilistic sense O(k) · (q2h/h) · [3h + log(q/h)]. Since h(n) ≥ log log n that C outputs 1. The circuit family corresponds to a and q = O(log n) this is O(k(n) log n · 2h(n)) as desired. p + 2 prover MIP1-proof system, such that if the first p To prove the soundness, we need to trace through provers answer accordingly to the low degree encoding the proof of [LS], making the appropriate modifica- of assignments X1,...,Xp such that C(X1,...,Xp) = 1

6 then there exist strategies for the two last provers such random bits, reading poly(log |C|) bits and perform- that the MIP1-verifier always accepts. On the other ing a computation that corresponds to circuits of size hand if the first p provers’ answers are not close to a poly(log |C|). low degree encoding of some satisfying assignment to Lastly, assuming that there exists some W such that C, then for all possible strategies of the last two provers ∆(W 0,E (W )) < 1/3, we use the idea of self-correction the MIP -verifier rejects with very high probability. P 1 [BLR, GS], which allows us to probabilistically access the segments of X00. For any segment s of W using Lemma 3.2 (Circuit Verification) Given a circuit i poly(log |W 0|) random, reading poly(log |W 0|) bits from C(x , x , . . . , x ) and k0(n) then there exists a 1 2 p W 0 we can compute W by a circuit of size poly(log |W 0|) polynomial-time computable (from C and k0(n)) circuit s with probability 1/2. family 00 The circuits CR00 will probabilistically verify that Z en- 0 0 0 0 00 00 {CR0 ([x1], [x2],..., [xp], [z1], [z2])} codes W = (X1,...,Xp,X1 ,...,Xp ) that satisfies the properties. Furthermore they will probabilistically ver- 0 0 with such that |C 0 | = poly(log |C|, k (n)), the in- 0 R ify that for every i that a random segment of Xi equals puts are poly(log |C|, k0(n))-segmented and, |R0| = 00 the same segment of Xi . All the tests are performed 0 0 poly(log |C|, k (n)). Furthermore: so as that the error is at most 2−k (n). (We perform all 0 (1) ∀ assignments X1,...,Xp, if C(X1,...,Xp) = the tests O(k (n) times.) 1 then there exist assignments Z1,Z2 such that By the construction it follows that if C(X ,...,X ) = 0 0 1 p C 0 (E (X ),...,E (X ),Z ,Z ) = 1 ∀ R . R P 1 P p 1 2 1 then there exist assignments Z1,Z2 such that 0 0 (2) ∀ assignments X ,...,X ,Z1,Z2, if ∀ assignments 0 0 1 p CR0 (EP (X1),...,EP (Xp),Z1,Z2) = 1 for all R . X ,X ,...,X such that C(X ,...,X ) = 1 there 1 2 p 1 p 0 0 0 exists an 1 ≤ i ≤ p such that ∆(X0,E (X )) ≥ On the other hand if PrR0 [CR0 (X1,...,Xp,Z1,Z2) = i P i 0 −k0(n) 0 0 0 1] > 2−k (n) then it implies that there exists assign- 1 − 2 , then PrR0 [CR0 (X1,...,Xp,Z1,Z2) = 0 1] ≤ 22−k (n). ments X1,...,Xp such that C(X1,...,Xp) = 1 and 0 −k0(n) ∆(Xi,EP (Xi)) < 2 for every i = 1, . . . , p. Proof: The proof combines ideas in [BFLS, BLR, FRS, Step 2: Next we transform the C00 circuits into cir- LS, FL]. 000 0 0 (1) (p0) cuits {CR00,R000 ([x1],..., [xp], [z ],..., [z ])} (i.e., a Step 1: First we obtain a circuit family one-round p + p0-prover proof system) as follows using the standard method in [FRS]. (For every j = 00 0 0 0 0 (j) 00 {C 00 ([x ], [x ],..., [x ], z)}, R 1 2 p 1, 2, . . . , p , Z should equal Z.) Assume that CR00 de- 00 pends on the variables zi1 , . . . , ziq . Note that q ≤ |CR00 |. where the circuit size and number of additional random 000 0 C 00 000 partitions randomly {1, 2, . . . , p } into q subset 0 R ,R bits are poly(log |C|, k (n)). The notation implies that 000 (j) S ,...,S . Then C 00 000 reads z for every l = 1, . . . , l 1 q R ,R il the first p inputs can be segmented in such a way that 0 00 and j ∈ S . If for some l and j, j0 ∈ S , z(j) 6= z(j ) then CR00 only depends on one segment for each input. For l l il il 000 00 the last input z this is not the case as we shall see. CR00,R000 outputs 0. Otherwise it simulates CR00 . It can now be shown that the increase in error probability is The basic idea is that z “proves” that C would out- −k0(n) 0 0 00 0 less than 2 , when p = poly(k (n), |CR00 |). put 1 when the inputs to C are the xi inputs decoded. The “proof” contain bit strings X ,...,X and strings 1 p Step 3: Lastly we transform the C000 circuits into the C0 X00,...,X00 over the alphabet F for some finite field F . 1 p circuits using the same construction as in Theorem 3.1. The string X should equal the decoding of an assign- i I.e., we use the transformation from p0 provers into 2 ment X0 to the variables x0 . The string X00 should equal i i i provers in [LS, FL] on the inputs z(j) to get segmented E (X ). The proof z contains W 0 the concatenation W P i circuits with p + 2 inputs. This will use an additional of all these strings encoded using the low-degree encod- O(p0 log(|z|)k0(n)) random bits. Using the same analysis ing. The other part of z contains a probabilistically 0 as in the proof of Theorem 3.1 we get the circuits C 0 , checkable proof W 00 that all the strings have the right R 0 where the increase in error probability can be made less properties (i.e., that there exists a W = (X1,...,Xp) −k0(n)+1 0 than 2 . such that ∆(W ,EP (W )) < 1/3, C(X1,...,Xp) = 1 00 and for every i that Xi = EP (Xi)). We use the con- −k(n) struction of [BFLS] to construct these proofs. From Theorem 3.3 MIP1[r, p, a, q, 2 ] ⊆ MIP1[r + [BFLS] it follows that we verify with probability 1/2 poly(log a, k), p + 2, poly(log a, k), r + poly(log a, k), that W 0 has the correct properties by using poly(log |C|) 2−(k(n)/p)+3].

7 −k(n) Proof: Let V be a MIP1[r, p, a, q, 2 ] verifier for 3.3 An efficient PCP for SAT some language L. Let {CR([y1],..., [yp])} be the corresponding circuit family. We will now construct a circuit In this subsection we construct a probabilistically check- 0 0 able proof for SAT in which the expected number of family {CR,R0 ([y1],..., [yp], [z1], [z2])}, such that for ev- 0 bits read is 29. The proof will use Theorem 1.1 and ery segment yis of yi there will be a meta-segment yis 0 ideas in [AS, ALMSS]. The main improvement over the of yi. This meta-segment supposedly contains the encoding of an assignment to yis and it is divided into construction of [ALMSS] is our improved recursion step m segments; one for each point in F . The inputs zj for (Lemma 3.2 and Lemmas 3.5 and 3.10) which allows j = 1, 2 are also divided into meta-segments zjR; one us to combine proof systems with almost no increase for each R. in the error probability. Furthermore we have an improved analysis of the linearity test in [BLR] and of the Using Lemma 3.2 with C equal to CR we get matrix multiplication test for the special case needed in 0 0 0 00 00 a family of circuits CR0 (x1, . . . , xp, x1 , x2 ). Let [ALMSS]. We will now sketch our construction. Some 0 0 CR,R0 (y1, . . . , yp, z1, z2) be the circuit obtained from knowledge of the proof in [ALMSS] is assumed of the 0 0 0 C 0 , where the variables x are substituted by y , R i iQi reader. where Q = Q (R, i) and the variables x00 are substi- i V j First we need some different encoding schemes. Let X tuted by zjR. be an n-bit string. The robust encoding ER(X) of X is n an element of {0, 1}2 , indexed by elements v of {0, 1}n, It follows by construction that if x ∈ L then there exists th Pn such that the v bit of ER(x) is vixi mod 2. Fur- 0 0 i=1 assignments (i.e., provers) Y1 ,...,Yp,Z1,Z2 such that thermore we will have another encoding scheme E that 0 0 0 CR,R0 ([Y1 ],..., [Yp], [Z1], [Z2]) = 1 for all R,R . encodes n-bit strings into f(n)-bit strings such that On the other hand assume that x 6∈ L. Thus f(n) is a polynomial, E(X) is polynomial-time com- −k(n) putable and the following is true: if X,X0 are distinct PrR[CR(Y1,...,Yp) = 1] ≤ 2 for all assignments strings then ∆(E(X),E(X0)) > 1/2 − δ for some con- Y1,...,Yp. stant δ > 0. Such encodings exist for any fixed δ > 0. 0 First define for every meta-segment yis good decodings. Fix > 0. From Theorem 1.1 we get for any in- 0 This will be any string Y such that ∆(Y ,EP (Y )) < is put x a segmented circuit family CR([y1],..., [y4]) such −k0(n) 2 . It follows from the Lemma 3.4 that for any that the size of the circuits are at most poly log log(n). k0(n)+1 segment there can not be more than 2 such de- Furthermore if x ∈ SAT then there exist assignments codings, assuming that |F | is large enough. Next for 0 Y1,...,Y4 such that CR(Y1,...,Y4) = 1 for all R, oth- every i = 1, . . . , p define l = 2k (n)+1 assignments erwise PrR(CR(Y1,...,Y4) = 1) < for all assignments. (1) (l) Y ,...,Y such that for any segment s and any good 0 0 i i We construct another circuit family CR,R0 (y1,..., 0 (j) 0 decoding Y of Yis there exist a j such that of Y = Yis . y4, z). Each of the circuits will have constant size. The For any R we say that R is good if there exist assign- inputs to the new circuits are divided into two groups. First there are four inputs y0 , . . . , y0 that correspond ments Y (j1),...,Y (jp) such that C (Y (j1),...,Y (jp)) = 1 4 1 p R 1 p to the inputs to C . These inputs are meant to be 1. R y1 . . . , y4 encoded such that each segment is encoded Note that if R is not good then from Lemma 3.2 using the encoding scheme E. 0 0 −k0(n)+2 r PrR0 [CR,R0 ([Y1 ],..., [Yp], [Z1], [Z2]) = 1) ≥ 2 . The second group of inputs are divided into 2 parts 0 0 Thus PrR,R0 [CR,R0 ([Y1 ],..., [Yp], [Z1], [Z2]) = 1) is at {zR}, one for each R. The idea is that an assignment −k0(n)+2 (k0(n)+1)p −k(n) −(k(n)/p)+3 most 2 + 2 2 < 2 , when ZR to zR “proves” that CR would output 1 when the k(n)+3 0 0 inputs to CR are the y inputs decoded. More precisely k (n) = p+1 − 1 and k(n) ≥ 3p. i ZR contains 8 binary strings A1,...,A4 and B1,...,B4. The string Ai should equal to the segment si of yi that Lemma 3.4 For any string Y 0 if |F | > 2m(|H| − 1)/2 CR depend on. The string Bi should equal E(Ai). Let 0 D be a circuit with inputs A1,...,B4 that computes then |{Y |∆(Y ,EP (Y )) < }| < 2/. the predicate “CR(A1,...,A4) = 1 and Bi = E(Ai) for every i = 1,..., 4.” (Note that |D| = poly(|C |) since Theorem 1.1 now follows from combining Theorem 3.1 R E is a polynomial-time computable encoding scheme.) and Theorem 3.3. Furthermore the “proof” contains one string W that Remark The precise values for the randomness and contains a bit for every gate in D. This string can be answer sizes in Theorem 1.1 resulting from this proof seen as a witness for the facts that D(A1,...,B4) = 1. 2¯ 0 are r(n) = O(k(n) log n) + O(k(n) k(n)) and a(n) = Let W = (WjWk)j

8 0 In [ALMSS] it was shown how to probabilistically of Yi can only be decoded to a constant number of dif- 0 0 verify such proofs. Assume that (Y1 ,...,Y4 , {ZR}R) is ferent segments of Yi. 0 such a proof and that l = |A1|+|A2|+···+|W |. Hence l 0 |ZR| = 2 for every R. Let 0 < δ, δ < 1/10. For a ﬁxed Lemma 3.6 [MS] Let A = A(n, d, w) be the maximum 0 R and for i = 1,..., 4 the circuits CR,R0 depends on number of binary vectors of length n, each with weight Y 0 , where s is the segment of y that C depends on. isi i i R (i.e., number of non-zeroes) at most w, and any two of 0 Furthermore CR,R0 depends on ZR. Let π = ZR for which are distance at least d apart. Then A ≤ dn/(dn− notational convenience. The veriﬁcation has four parts, 2nw + 2w2) if dn − 2nw + 2w2 > 0. one for each the following properties: R 0 0 Linearity Property (P ): There exists (A ,...,B , This implies for any Y that |{Bi|∆(Bi,Y ) < 1/2 − 1 1 4 √ √ isi isi 0 0 0 W, W ) such that ∆(π, ER(A1,...,B4, W, W )) < δ . δ}| ≤ 1/(2 δ). Thus, using the same arguments as Quadratic Property (P R): W 0 = (W W ) (as- in the proof of Theorem 3.3, the√ error probability is the 2 j k jcomplement Consistency Test (T R): In [ALMSS] they showed S 3 to GS. The number of edge colored 1 in G is at least |W | S that from D and s ∈ {0, 1} it is possible to com- 2(|S||S| − |S|2), because the number of edge that leaves 0 pute an index vs of ER(A1,...,B4, W, W ) and a bit S and does not end in S is at least |S||S| − |S|2 (the bs such that for all W if D(A1,...,B4) = 0 then number of edges from S minus the maximum number Pr [E (A ,...,B , W, W 0) 6= b ] = 1/2. On the other s R 1 4 vs s of edges from S to S). The number of edge colored 0 hand if D(A1,...,B4) = 1 then there exists W such that in G is at most 2(|S|2), since there are at most |S|2 0 S Pr [E (A ,...,B , W, W ) = b ] = 1. Thus using self- 2 l s R 1 4 vs s edges from S to S. Thus q ≥ (2(|S||S| − |S| ) + 2 |S| − |W | correction the test is the following: Pick s ∈R {0, 1} , 2 2l 2 l 2(|S| ))/2 = 3s − 6s . u ∈R {0, 1} and test that πvs−u + πu = bs. R Input Tests (T4 ): For every input segment si that CR The following lemmas give bounds on the error proba- depends on pick uniformly at random j ∈ {1,..., |Y 0 |} bility for the last three tests. Their proofs are omitted isi and u ∈ {0, 1}l and test that Y 0 = π + π . in this abstract. R isij Bij −u u R R The next lemma implies that when x 6∈ L then we can Lemma 3.8 If P1 and ¬P2 then the probability that R 3−δ02 0 assume that for almost all R that some property is false. T2 rejects is at least 8 (1 − 2δ ). √ R R R R R R R 4 Lemma 3.9 [ALMSS] If P1 ,P2 and ¬P3 then the Lemma 3.5 If PrR[P1 ,P2 ,P3 and P4 ] > /(2 δ) R 0 then x ∈ L. probability that T3 rejects is at least (1/2)(1 − 2δ ). R R R R Lemma 3.10 If P1 ,P2 ,P3 and ¬P4 √then the proba- R 0 Proof: The following lemma implies that each segment bility that T4 rejects is at least (1/2 − δ)(1 − 2δ ).

9 0 Proof of Theorem 1.2: First let δ = 0.06366 and Let V be a MIP1[r, p, a, q, ] veriﬁer for SAT. The choose δ, small, say δ = 0.01 and = 10−7. set cover reduction (used to show that mincover(S) is hard to approximate) requires that V satisfy some Secondly, note that we do not need independence be- extra properties which we now detail. The ﬁrst, func- tween the tests. This implies that we can reuse the ran- tionality, requires that for each R ∈ {0, 1}r and each dom bit locations read in T R in the other tests. This 1 A ∈ {0, 1}a there is at most one vector (A ,...,A ) implies that all the self-correcting can be done reading 1 2 p with the property that V (R,A ...A ) = 1. The sec- no extra bits. 1 p ond, uniformity, requires that for each i = 1, . . . , p R q We will use the following protocol: Perform T1 3 times there is a set Qi ⊆ {0, 1} such that the queries of V with probability 0.18 otherwise 4 times (3 bits read each to the i-th prover are uniformly distributed over Qi. R time), perform T2 once with probability 0.20 otherwise The third, equality of question space sizes, requires that R twice (3 bits each), T3 once with probability 0.70 oth- the sets Q1,..., Qp from the uniformity condition are R erwise twice (each times 1 bit) and T4 once with prob- all of the same size. The last, disjointness of answer ability 0.70 otherwise twice (each time 8 bits). In all spaces, requires that for each i = 1, . . . , p there is a set a 28.56 bits on average. Ai ⊆ {0, 1} such that A1,..., Ap are disjoint and V rejects answers A ,...,A from the provers if it is not the We bound the error probability as follows: Because of 1 p case that A ∈ A ,...,A ∈ A . We call V canonical the choice of how many tests to do we have that if for 1 1 p p R if all four properties hold. some R there exists some j = 1,..., 4 such that Pj 0 We now state a general formulation of Lund and Yan- does not hold then the C 0 circuits will only output 1 R,R nakakis’s reduction of a canonical proof system to set with probability at most 0.4997. Lastly we know from cover. In this lemma, l is a parameter to be chosen at Lemma 3.5 that if x 6∈ L then the probability that the √ will, and Q refers to the question spaces of the unifor- above will not happen is at most /(2 δ)4 < 0.0003. i mity condition. The statement and proof of this lemma Thus the error probability is at most 1/2. that appear in [LY1] are only for the case p = 2, but the authors say later that it extends to any constant, and this extension is indeed easy.5 For completeness we 4 Applications provide the construction for this extension.

Fix a combinatorial optimization problem and let g(x) Lemma 4.1 Suppose verifier V defines a canonical be the optimal value at input x. An approximation MIP1[r, p, a, q, ] proof system for SAT. Fix a function algorithm A is said to approximate g(x) to within f(N) l: N → N. To any SAT instance ϕ of size n we can as- if for every input x it is the case that sociate a set cover instance Sϕ such that the following properties hold: • f(N)−1g(x) ≤ A(x) ≤ g(x) if the problem is maxi- Pp mization (1) If ϕ ∈ SAT then mincover(Sϕ) ≤ i=1 |Qi|. • g(x) ≤ A(x) ≤ f(N)g(x) if the problem is mini- p l (2) If ϕ 6∈ SAT then mincover(Sϕ) ≥ (1 − l ) · p · mization. Pp i=1 |Qi|. Here N = kxk ∈ N is the “norm” of the input x, O(r+a+l) The size of the instance Sϕ is p2 , and the trans- i.e. some aspect of the input in terms of which approxi- formation of ϕ to Sϕ is computable in time polynomial mation is measured. For example for set cover it is the in n and this quantity. The number of points in the base number of elements in the base set. r+2a+2l set of Sϕ is O(2 ). We will now discuss some of the applications men- tioned in §1.3. Specifically, we discuss set cover, max Proof: Let A1,..., Ap denote the sets specified by 3SAT, and the programming problems; the other appli- the disjointness of answer spaces condition. For each r cations are omitted due to lack of space. R ∈ {0, 1} and each A1 ∈ A1 let UA(R,A1) denote the unique vector (A2,...,Ap) such that V (R,A1 ...Ap) = 1, if this vector exists (otherwise UA(R,A1) is unde- 4.1 Set Cover def a Pp fined). Let m = 2 ≥ i=1 |Ai|. Let (B; B1,...,Bm) We say that sets S1,...,Sm cover a set U if U ⊆ S1 ∪ be a “set system” as per [LY1, Lemma 3.3]. The base set · · · ∪ Sm. An instance of the set cover problem consists S of the set cover instance Sϕ associated to ϕ is defined r of a base set U of size N and a sequence S1,...,Sm of by S = {0, 1} × B. The sets in Sϕ are the following. subsets of U. We denote by mincover(S) the size of a 5 In fact, the extension does not even actually require that p minimum sized subcollection of S1,...,Sm which covers be constant, and although it is constant in our applications, we the base set U. thought it worthwhile to state the general lemma.

10 First, for each Q ∈ Q1 and each A ∈ A1 we have the above, in the context of continuous optimization prob- set S(1, Q, A) defined as lems. Quartic programming is important in applications {hR, bi ∈ S : UA((R,A) = (A ,...,A ) is defined, such as the “molecule embedding problem.” 2 p The reduction of two prover proofs to quadratic pro- Q = Q (R, 1), and b ∈ B ∩ · · · ∩ B } . V A2 Ap gramming in [BR, FL] is easily extended to a reduc- Second, for each i = 2, . . . , p and each Q ∈ Qi, A ∈ Ai tion of four prover proofs to quartic programming. we have the set S(i, Q, A) defined as Theorem 1.1 guarantees for us four prover proof sys- { hR, bi ∈ S : Q = Q (R, i) and b ∈ B } . tems for NP with logarithmic randomness and answer V A sizes, and error an arbitrary constant. Put together The proof that this construction works is a simple ex- these facts enable us to prove Theorem 1.8. We omit tension of the proof for the case p = 2 in [LY1]. the details.

We claim (proof omitted) that the verifier of Theorem 1.1 satisfies functionality and uniformity. Acknowledgments Equality of question space sizes can then be achieved We are grateful to Dror Lapidot, for explaining to us the by a simple transformation as shown in [LY1], and dis- construction and proof of [LS]: these were crucial to the jointness of answer spaces by a simple padding; the proof of Theorem 3.1. We thank Rajeev Motwani, Nick cost is only a constant factor in randomness, ques- Reingold, Muli Safra, Madhu Sudan, Mario Szegedy, tion sizes, and answer sizes. Thus we have canonical Steve Vavasis and Mihalis Yannakakis for their helpful MIP [r, 4, a, q, 2−k(n)] verifiers for SAT with r, q, a being 1 insights. as in Theorem 1.1. Based on this fact and Lemma 4.1 Work done while the first author was at the IBM T.J. we can prove Theorems 1.3 and 1.4. Briefly, for the Watson Research Center, New York. first, set l = 2cp and choose k(n) = O(1) to satisfy 2−klp < 1/2. For the second set l = O(log n · log log n) and k(n) = O(log log n). References

[AS] S. Arora and S. Safra. Approximating clique 4.2 Max-3SAT is NP-complete. Proceedings of the 33rd Annual We include a proof for Theorem 1.7 based on the con- IEEE Symposium on the Foundations of Com- puter Science, IEEE (1992). struction in Section 3.3. [ALMSS] S. Arora, C. Lund, R. Motwani, M. Su- R Proof of Theorem 1.7: Note that T1 needs 4 dan and M. Szegedy. Proof veriﬁcation and in- R R clauses, T2 needs 15 clauses, T3 needs 2 clauses and tractability of approximation problems. Proceed- R T4 needs 16 clauses. Now it follows that if we perform ings of the 33rd Annual IEEE Symposium on the R R R T1 with probability 1, T2 with probability 0.51, T3 Foundations of Computer Science, IEEE (1992). R with probability 0.385 and T4 with probability 0.385, [ADP] G. Ausiello, A. D’Atri and M. Protasi. then the overall error probability is at most 5/6. On av- Structure preserving reductions among convex erage we have 18.52 clauses. This completes the proof optimization problems. Journal of Computer and since 18.58 · 6 < 112. System Sciences 21, 136–153 (1980). [BFL] L. Babai, L. Fortnow and C. Lund. Non- Deterministic Exponential Time has Two-Prover 4.3 Quartic Programming Interactive Protocols. Proceedings of the 31st An- nual IEEE Symposium on the Foundations of We recall that quartic programming is the problem of Computer Science, IEEE (1990). maximizing a n-variate polynomial f(x , . . . , x ) of to- 1 n [BFLS] L. Babai, L. Fortnow, L. Levin, and M. tal degree four, subject to linear constraints Ax ≤ b. We n Szegedy. Checking Computations in Polyloga- will assume that the feasible region { x ∈ R : Ax ≤ b } rithmic Time. Proceedings of the 23rd Annual is compact. Note that we are maximizing over a sub- ACM Symposium on the Theory of Computing, n set of R ; solutions are not restricted to integers. We ACM (1991). denote by f ∗ the maximum of f over the feasible re- [Be] M. Bellare. Interactive Proofs and Approxi- gion, and by f∗ the minimum. Following [ADP, Va] mation: Reductions from Two Provers in One ˜ we say that f is a µ-approximation, where µ ∈ [0, 1], Round. Proceedings of the 2nd Israel Symposium ∗ ˜ ∗ if |f − f| ≤ µ · |f − f∗|. We refer the reader to [Va] on Theory and Computing Systems, IEEE (June for discussion of the appropriateness of this deﬁnition, 1993). Preliminary version: IBM Research Re- and the inappropriateness of the one we have been using port RC 17969 (May 1992).

11 [BGG] M. Bellare, O. Goldreich and S. Gold- [LS] D. Lapidot and A. Shamir. Fully Parallelized wasser. Randomness in Interactive Proofs. Pro- Multi-Prover Protocols for NEXP-time. Proceed- ceedings of the 31st Annual IEEE Symposium ings of the 32nd Annual IEEE Symposium on the on the Foundations of Computer Science, IEEE Foundations of Computer Science, IEEE (1991). (1990). [Lo] L. Lovasz.´ On the ratio of optimal integral and [BR] M. Bellare and P. Rogaway. The Complexity fractional covers. Discrete Mathematics 13, 383- of Approximating a Nonlinear program. Complex- 390 (1975). ity of Numerical Optimization, Ed. P.M. Parda- [LY1] C. Lund and M. Yannakakis. On the Hardness los, World Scientiﬁc (1993). Preliminary version: of Approximating Minimization Problems. Pro- IBM Research Report RC 17831 (March 1992). ceedings of the 25th Annual ACM Symposium on [BGKW] M. Ben-Or, S. Goldwasser, J. Kilian and the Theory of Computing, ACM (1993). A. Wigderson. Multi-Prover Interactive Proofs: How to Remove Intractability Assumptions. Pro- [LY2] C. Lund and M. Yannakakis. The Approxima- ceedings of the 20th Annual ACM Symposium on tion of Maximum Subgraph Problems. ICALP 93. the Theory of Computing, ACM (1988). [MS] F. MacWilliams and N. Sloane. The Theory [BLR] M. Blum, M. Luby, and R. Rubinfeld. Self- of Error-Correcting Codes. North-Holland, 1981. testing and self-correcting programs, with appli- [PY] C. Papadimitriou and M. Yannakakis. Opti- cations to numerical programs. Proceedings of the mization, approximation, and complexity classes. 22nd Annual ACM Symposium on the Theory of Proceedings of the 20th Annual ACM Symposium Computing, ACM (1990). on the Theory of Computing, ACM (1988). [CW] A. Cohen and A. Wigderson. Dispersers, De- [PS] S. Phillips and terministic Ampliﬁcation, and Weak Random S. Safra. PCP and tighter bounds for approx- Sources. Proceedings of the 30th Annual IEEE imating MAXSNP. Manuscript, 1992. Symposium on the Foundations of Computer Sci- [Va] On approximation algorithms for ence, IEEE (1989). S. Vavasis. concave programming. Recent Advances in Global [Co] A. Condon. The complexity of the max word Optimization, C. A. Floudas and P.M. Pardalos, problem, or the power of one-way interactive pp. 3-18, Princeton University Press, 1992. proof systems. STACS 91. [Zu] D. Zuckerman. NP-Complete Problems have a [FRS] . On the L. Fortnow, J. Rompel and M. Sipser version that is hard to Approximate. Structure in power of multiprover interactive protocols. Struc- Complexity Theory, 1993. tures 1988. [Fe] U. Feige. On the Success Probability of the Two Provers in One Round Proof Systems. Struc- tures 1991. [FGLSS] U. Feige, S. Goldwasser, L. Lovasz,´ S. Safra, and M. Szegedy. Approximating clique is almost NP-complete. Proceedings of the 32nd Annual IEEE Symposium on the Founda- tions of Computer Science, IEEE (1991). [FL] U. Feige and L. Lovasz´ . Two-Prover One Round Proof Systems: Their Power and their Problems. Proceedings of the 24th Annual ACM Symposium on the Theory of Computing, ACM (1992). [GS] P. Gemmell and M. Sudan. Highly Resilient Correctors For Polynomials. IPL, 1992. [IZ] R. Impagliazzo and D. Zuckerman. How to Recycle Random Bits. Proceedings of the 30th Annual IEEE Symposium on the Foundations of Computer Science, IEEE (1989). [Jo] D. Johnson. Approximation algorithms for combinatorial problems. J. of Computer and System Sciences 9, 256–278 (1974). [KT] P. Kolaitis and M. Thakur. Approximation properties of NP minimization classes. Structure in Complexity Theory, 1991.