Polylogarithmic-round Interactive Proofs for coNP Collapses the Exponential Hierarchy

Alan L. Selman Department of Computer Science and Engineering University at Buffalo, Buffalo, NY 14260 Samik Sengupta† Department of Computer Science and Engineering University at Buffalo, Buffalo, NY 14260

January 13, 2004

Abstract It is known [BHZ87] that if every language in coNP has a constant-round interactive proof system, then the polynomial hierarchy collapses. On the other hand, Lund et al. [LFKN92] have shown that #SAT #P , the -complete function that outputs the number of satisfying assignments of a Boolean for- mula, can be computed by a linear-round interactive protocol. As a consequence, the coNP-complete set SAT has a proof system with linear rounds of interaction. We show that if every set in coNP has a polylogarithmic-round interactive protocol then the expo- nential hierarchy collapses to the third level. In order to prove this, we obtain an exponential version of Yap’s result [Yap83], and improve upon an exponential version of the Karp-Lipton theorem [KL80], obtained first by Buhrman and Homer [BH92].

1 Introduction

Ba´bai [Ba´b85] and Ba´bai and Moran [BM88] introduced Arthur-Merlin Games to study the power of randomization in interaction. Soon afterward, Goldwasser and Sipser [GS89] showed that these classes are equivalent in power to Interactive Proof Systems, introduced by Goldwasser et al. [GMR85]. Study of interactive proof systems and Arthur-Merlin classes has been exceedingly successful [ZH86, BHZ87, ZF87, LFKN92, Sha92], eventually leading to+the discovery of +Probabilistically Checkable Proofs [BOGKW88, LFKN92, Sha92, BFL81, BFLS91, FGL 91, AS92, ALM 92]. Interactive proof systems are successfully placed relative to traditional complexity classes. In particular, k IP[k] p IP[poly] = PSPACE it is known that for any constant , 2 [BM88], and [Sha92]. However, the relationship between coNP and interactive proof systems is not entirely clear. On the one hand, Boppana, Ha˚stad and Zachos [BHZ87] proved that if every set in coNP has a constant-round interactive proof system, then the polynomial-time hierarchy collapses below the second level. On the other hand, the best interactive #SAT protocol for any language in coNP comes from the result of Lund et al. [LFKN92], who show that , a problem hard for the entire polynomial-time hierarchy [Tod91], is accepted by an interactive proof system O(n) n with rounds of interaction on an input of length . Can every set in coNP be accepted by an interactive

Research partially supported by NSF grant CCR-0307077. Email: [email protected] †Email: [email protected]

1

proof system with more that constant but sublinear number of rounds? Answering this question has been the motivation for this paper. We show in this paper that coNP cannot have a polylogarithmipc-round interactpive proof system unless NEXP 2 = coNEXP 2 the exponential hierarchy collapses to the third level, i.e., . Three principal steps lead to the proof of our main result, and these results are of independent interest. Note that although we use Arthur-Merlin protocols to obtain our results, our main theorem holds for interactive proof systems as well m due to the result of Goldwasser and Sipser [GS89], who showed that an interactive proof system with 2m + 4 rounds can be simulated by an -move Arthur-Merlin protocol. m l(n) An Arthur-Merlin protocol with moves where both Arthur and Merlin exchange at most bits at every move can be simulated by a two-move AM protocol where Arthur moves first and uses O(l(n)m 1) random bits (Theorem 3.1). L 2polylog L If is accepted by a two-move AM protocol where Arthur uses random bits, then belongs NP/2polylog to the advice class (Lemma 3.3). NP/2polylog NP /2polylog If coNP (equivalently coNP ) then p p exp NP NEXP 2 = coNEXP 2 = S P . 2 (Theorem 4.1) NP In addition to these results, we improve upon a result of Buhrman and Homer [BH92], showing that if 2polylog NEXPNP = coNEXPNP = SEXP has -size family of circuits, then 2 . We note that Goldreich and Ha˚stad [GH98] and Goldreich, Vadhan, and Wigderson [GVW01] have studied Arthur-Merlin games and interactive proof systems with bounded message complexity. Their results m are incomparable to our Theorem 3.1. In particular, our simulation of an -move Arthur-Merlin protocol l by a 2-move Arthur-Merlin protocol assumes that , the number of message bits used in every move, is polynomial in the length of the input, and we obtain that the number of random bits used by Arthur in the l 2-move protocol is not exponential in . This is crucial in order to get Theorem 4.1.

2 Preliminaries

For definitions of standard complexity classes, we refer the reader to Homer and Selman [HS01]. The exponential hierarchy is defined as follows: exp exp NP exp EXP = 0 , NEXP = 1 , NEXP = 2 ,

k 0 and in general, for , exp p k k+1 = NEXP . k 0 For every , exp exp = L L . k { ∈ k } k polylog = logk n 2polylog = 2log n We define k>0 and k>0 . Let C be a complexity class. A set L /2polylog s : 1 k > 0 A ∈ C if there is aSfunction 7→ , some cSonstant , and a set ∈ C such that k n s(1n) 2log n 1. For every , | | , and x x L (x, s(1 x )) A A 2. For all , ∈ ⇔ | | ∈ . Here is called the witness language.

2

/2polylog co co /2polylog It is easy to see that D C if and only if D C . Ba´bai [Ba´b85] introduced Arthur-Merlin protocol, a combinatorial game that is played by Arthur, a probabilistic polynomial-time machine, and Merlin, a computationally unbounded Turing machine. Arthur can use random bits, but these bits are public, i.e., Merlin can see them and move accordingly. x x L Given an input string , Merlin tries to convince Arthur that belongs to some language . The game consists of a predetermined finite number of moves with Arthur and Merlin moving alternately. In each move Arthur (or Merlin) prints a finite string on a read-write communication tape. Arthur’s moves depend x on his random bits. After the last move, Arthur either accepts or does not accept . m > 0 L AM[m] MA[m] Definition 2.1 ([Ba´b85, BM88]) For any , a language is in (respectively ) if for x n every string of length m The game consists of moves

Arthur (resp., Merlin) moves first

After the last move, Arthur behaves deterministically to either accept or not accept the input string x L x If ∈ , then there exists a3 sequence of moves by Merlin that leads to the acceptance of by Arthur with probability is at least 4 x / L x 1 if ∈ then for all possible moves of Merlin, the probability that Arthur accepts is less than 4 . AM[k] k > 1 AM[2] = AM Ba´bai and Moran [BM88] showed that , where is some constant, is the same as . MA[2] = MA AM[1] = BPP MA[1] = M = NP MA AM Note that , , and . Ba´bai [Ba´b85] proved that . Now we need to extend modestly the notion of Arthur-Merlin protocols. In the following limited manner, we consider the possibility that Arthur is a probabilisitic Turing machine, but not necessarily polynomial- f : N N AM(f) time-bounded. Let 7→ be some function. Then we define the class to be the class of languages accepted by protocols in which there are only two moves, Arthur moves first, and Arthur can use f(n) n f at most random bits on an input of length . In particuclar, we will have occasion to consider to be AM(2log n) c quasipolynomial; that is, we will consider the class , where is a positive constant. We note the following standard proposition. E 3 p( ) Proposition 2.2 Let be an event that occurs with probability at least 4 . Then, for any polynomial def p(n) n c t = c p(n) E such that , there is a constant such that within independent trials, occurs for t (1 1 ) more than 2 times with probability 2p(n) . Sexp S We define 2 as the exponential version of the 2 operator defined by Russell and Sundaram [RS98] L Sexp k > 0 A x 0, 1 n and Canetti [Can96]. A set is in 2 C if there is some and ∈ C such that for every ∈ { } , x L = y z (x, y, z) A, ∈ ⇒ ∃ ∀ ∈ and x / L = z y (x, y, z) / A, ∈ ⇒ ∃ ∀ ∈ k y , z 2n where | | | | . P def exp S2 = S2 P S2 Similar to exp , the class C can be thought of as a game between two provers and a L S x n x L verifier. Let ∈ 2 C. On any input of length , the Yes-prover attempts to show that ∈ , and the x / L x x L No-prover attempts to show that ∈ . Both the proofs are at most exponentially long in | |. If ∈ , x L then there must be a proof by the yes-prover (called a yes-proof) that convinces the verifier that ∈ no x / L matter what the proof provided by the no-prover (called a no-proof) is; symmetrically, if ∈ , then there x x must exist some no-proof such that the verifier rejects irrespective of the yes-proof. For every input ,

3

there is a yes-prover and a no-prover such that exactly one of them is correct. The verifier has the ability of = P the class C; for example, if C , then the verifier is a deterministic polynomial-time Turing machine, and = PNP if C , then the verifier is a polynomial-time oraclexpe Turing machine with SAT as the oracle. It is also S2 easy to see that if C is closed under compdeflement, then C is also closed under complement. SEXP = Sexp P Sexp PNP We concentrate on the classes 2 2 and 2 . The proofs of Russell and Sundaram can be easily modified to show the following.

Proposition 2.3 SEXP NEXPNP coNEXPNP 1. 2 ∩ . exp P P NEXPNP coNEXPNP S PNP NEXP2 coNEXP2 2. ∪ 2 ∩ . exp NP S2 P Proof We give a short proof of the secexpond inclusion of item (2). Note thPat since exp is closed under S PNP NEXP2 L S PNP complement, it suffices to show that 2 is a subset of . Let ∈ 2 ; therefore, k > 0, L PNP ∃ 0 ∈ such that

x L = y z (x, y, z) L0, ∈ ⇒ ∃ ∀ ∈ and x / L = z y (x, y, z) / L0, ∈ ⇒ ∃ ∀ ∈ k y , z 2 x where | | | | | | . We define the language k 2 x A = (x, y, 0 | | ) z(x, y, z) / L0 . { ∃ ∈ } A p N L A x N is in 2. We define a NEXP machine that decides with as an oracle. On input , guesses k x k y, y 2 x x (x, y, 02| | ) / A x L y | | | | , and accepts if and only if ∈ . If ∈ , then for the correctly guessed , (x, y, z) L0 z N x x / L z ∈ for every ; therefore, accepts .x Ok n the other hand, if ∈ , then there is a such that y (x, y, z) / L (x, y, 02| | ) A N x for every , 0, and therefore, and rejects . This completes the proof. ∈ ∈ 2

3 Arthur-Merlin Games with Polylogarithmic Moves m In this section, we show that languages accepted by an Arthur-Merlin protocol with moves where Arthur l(n) n and Merlin exchange at most bits in every move (on an input of length ) can be accepted by a two- O(l(n)m 1) move Arthur-Merlin protocol where Arthur moves first and uses random bits. This implies that if coNP has a polylogarithmic-move Arthur-Merlin protocol, then coNP can be accepted by a two-move 2polylog Arthur-Merlin protocol where Arthur uses random bits. As a consequence, using Lemma 3.3, we 2polylog obtain that coNP can be solved by nondeterministic polynomial-time machines with -length advice. m > 2 L AM[m] n Theorem 3.1 Let , and let ∈ where on an input of length , Arthur and Merlin exchange l(n) k L AM(k l(n)m 1) messages of length at most in every move. Then there is a constant m such that ∈ m . m Proof We show this by induction on . We assume that in any move during the interaction, Arthur and l(n) m > 2 Merlin exchange at most bits. We will show the following stronger result. For , there is some k constant m such that AM[m] AM(k l(n)m 1) 1. m

4

MA[m] AM(k l(n)m 1) 2. m MA AM Our proof is reminiscent of the proof of . In order to help the reader understand the proof of L MA L P w 0, 1 n Theorem 3.1, we digress to recall that proof. Let ∈ . There is 0 ∈ so that for any ∈ { } , 3 w L = v Pr[(w, v, z) L0] , ∈ ⇒ ∃ z ∈ 4 and 1 w / L = v Pr[(w, v, z) L0] , ∈ ⇒ ∀ z ∈ 4 v , z l(n) c > 0 where | | | | . By Proposition 2.2 there exists some constant such that if Arthur repeats its cl(n) 1 computation times and takes the majority vote, then it will get an error probability of at most 2l(n)+3 . Therefore, 1 w L = v Pr[(w, v, z) L0] 1 , ∈ ⇒ ∃ z ∈ 2l(n)+3 and 1 w / L = v Pr[(w, v, z) L0] , ∈ ⇒ ∀ z ∈ 2l(n)+3 z cl(n)2 w L where | | . Now we want to switch quantifiers, i.e., Arthur should move first. When is in , v 1 1 z (w, v, z) L 1 1 there is at least one for which 2l(n)+3 fraction of result in ∈ 0. Therefore, for 2l(n)+3 z v w fraction of , the same will result in acceptance of . On the other hand, the maximum number of strings v, v l(n) 2l(n)+1 w / L z | | , provided by Merlin is . Therefore, when ∈ , the fraction of for which there exists v (w, v, z) L 1 2l(n)+1 1 some where ∈ 0 is at most 2l(n)+3 4 . Hence, we have the following: 1 3 w L = Pr[ v (w, v, z) L0] 1 , ∈ ⇒ z ∃ ∈ 2l(n)+3 4 and 1 w / L = Pr[ v (w, v, z) L0] , ∈ ⇒ z ∃ ∈ 4 z cl(n)2 MA AM where | | . Therefore, . Observe that the total number of random bits required by cl(n)2 Arthur is at most . m = 3 L AMA L MA x Now we prove the base cases, i.e., . Let ∈ . Then there is 0 ∈ such that for every n of length 3 x L = Pr[(x, y) L0] , ∈ ⇒ y ∈ 4 and 1 x / L = Pr[(x, y) L0] , ∈ ⇒ y ∈ 4 y l(n) 1 y kl(n) k where | | . We reduce the error probability to 8 by increasing the length of to , where is MA AM L AM z some constant. By the above proof of , we know that 0 ∈ for a random of length at most cl(n)2 B P . Therefore, there is a set ∈ such that 3 w L0 = Pr[ v (w, v, z) B] , ∈ ⇒ z ∃ ∈ 4 and 1 w / L0 = Pr[ v (w, v, z) B] . ∈ ⇒ z ∃ ∈ 4 1 z k cl(n)2 Again, we reduce the error probability to 8 by increasing the length of to . This implies the following: 3 x L = Pr Pr[ v (x, y, v, z) B] , ∈ ⇒ y z ∃ ∈ 4 and 1 x / L = Pr Pr[ v (x, y, v, z) B] , ∈ ⇒ y z ∃ ∈ 4

5

y kl(n) z kcl(n)2 y z where | | , and | | . This bound works since for both and the error probability is 1 (y, z) at most 8 , and therefore, when considered as one move (i.e. is Arthur’s random bit string) the error 1 + 1 = 1 probability is at most 8 8 4 . Therefore, the total number of random bits required by Arthur is at most kl(n) + kcl(n)2 . L MAM L AM Similarly, let ∈ . There is 0 ∈ such that x L = y (x, y) L0, ∈ ⇒ ∃ ∈ and x / L = y (x, y) / L0, ∈ ⇒ ∀ ∈ y l(n) L 1 1 where | | . We amplify the success probability of the AM protocol for 0 to 2l(n)+3 ; so, Arthur cl(n)2 L requires at most random bits, and there is an NP set 00 such that the following holds: 1 x L = y Pr[(x, y, z) L00] 1 , ∈ ⇒ ∃ z ∈ 2l(n)+3 and 1 x / L = y Pr[(x, y, z) L00] . ∈ ⇒ ∀ z ∈ 2l(n)+3 y l(n) z cl(n)2 Here | | and | | . Again, we switch the quantifiers as we have done before for the proof of MA AM z y (x, y, z) L00 . The crit1ical cou1nting is that the fraction of for which there is some such that ∈ 2l(n)+3 4 is at most l(n) . Therefore, we have y ∈ P 1 x L = Pr[ y (x, y, z) L00] 1 , ∈ ⇒ z ∃ ∈ 2l(n)+3 and 1 x / L = Pr[ y (x, y, z) L00] , ∈ ⇒ z ∃ ∈ 4 z cl(n)2 L NP L k = 2kc with | | . Note that since 00 ∈ , this shows that is in AM. Take 3 ; we have shown MAM AM(k l(n)2) AMA AM(k l(n)2) that 3 and 3 as well. Therefore, our base case is proved. m > 3 L AM[m] m = 3 Now, let , and ∈ , i.e., Arthur moves first. Then, similar to the case of , we have k L MA[m 1] that there is a constant and 0 ∈ such that 3 x L = Pr[(x, y) L0] , ∈ ⇒ y ∈ 4 and 1 x / L = Pr[(x, y) L0] , ∈ ⇒ y ∈ 4 1 y l(n) 8 y where | | . We reduce the error probability ofmth2is protocol to by increasing the length of to kl(n) L0 MA[m 1] AM(km 1 l(n) ) B P x . Since ∈ , there is a set ∈ such that for every of n length 3 x L = Pr Pr[ v (x, y, v, z) B] , ∈ ⇒ y z ∃ ∈ 4 and 1 x / L = Pr Pr[ v (x, y, v, z) B] , ∈ ⇒ y z ∃ ∈ 4 m 2 y kl(n) z kkm 1l(n) z k where | | a1nd | | . Note that is also increasemd 2-fold so that the error probability L0 L AM(kl(n) + kkm 1l(n) ) of is reduced to 8 . Therefore, we have ∈ . L0 AM[m 1] On the other hand, let ums a2ssume that Merlin moves first. Then, there is a set in , and AM(km 1l(n) ) x n therefore, in , such that for every string of length , x L = y (x, y) L0, ∈ ⇒ ∃ ∈ and x / L = y (x, y) / L0, ∈ ⇒ ∀ ∈

6

y l(n) MA AM where | | . Using the same technique described above to show that , we need to amplify L 1 1 L NP the success probability of the Arthur-Merlin protocol for 0 to 2l(n)+3 . Therefore, there is a set 00 ∈ c > 0 cl(n) and some such that Arthur has to repeat the protocol times to obtain the following: 1 x L = y Pr[(x, y, z) L00] 1 , ∈ ⇒ ∃ z ∈ 2l(n)+3 and 1 x / L = y Pr[(x, y, z) L00] , ∈ ⇒ ∀ z ∈ 2l(n)+3 m 2 m 1 z cl(n) km 1l(n) = km 1cl(n) where | | . Switching quantifiers as before, we obtain 1 3 x L = Pr[ y (x, y, z) L00] 1 , ∈ ⇒ z ∃ ∈ 2l(n)+3 4 and 1 1 x / L = Pr[ y (x, y, z) L00] . ∈ ⇒ z ∃ ∈ 2l(n)+3 4 y l(n) ∈X m 2 m 1 cl(n) km 1l(n) = km 1cl(n) Note that Arthur now needs at most random bits. Also observe L00 NP km = kkm 1c that ∈ ; therefore, the above equations define an Arthur-Merlin protocol. By taking , we prove the induction step: m 1 AM[m] AM(k l(n) ), m

and m 1 MA[m] AM(k l(n) ). m 2 This completes the proof.

k > 0 c > 0 Corollary 3.2 For any , there is a such that c AM[logk n] AM(2log n). l(n) Proof Assume that Arthur and Merlin exchange at most bits during evekry move of commulognikcantio1n. k0 AM[log n] AM(k0l(n) ) From Theorem 3.1, we obtain that tchere is a consktant such that . c 2log n k l(n)log n 1 Taking an appropriate such that 0 , we obtain the result. 2

AM(2polylog) NP/2polylog. Lemma 3.3 k L AM(2log n) x n k Proof Let ∈ . Consider any input of length . There is a constant and a polynomial-time R predicate such that: 3 x L = Pr[ z R(x, y, z)] ∈ ⇒ y ∃ 4 1 x / L = Pr[ z R(x, y, z)] ∈ ⇒ y ∃ 4

k y , z 2log n c n c where | | | | . Note that by repeating the above protocol 1 times for some constant 1, we can 1 x 0, 1 n reduce the probability of error to 2n+1 . Therefore, for every ∈ { } , we get 1 x L = Pr[ z R(x, y, z)] 1 ∈ ⇒ y ∃ 2n+1 1 x / L = Pr[ z R(x, y, z)] ∈ ⇒ y ∃ 2n+1

7

k k c log n log n+log c1+log n log n n y c1n 2 = 2 2 c > k 2 where | | for some appropr1iate . There are at most n y 2n+1 y many strings of length , and for every the error probability isnat mos1t . Therefore any random will 1 (2 2n+1 ) > 0 be correct onc every input string with probability at least . Hence there must be some yˆ, yˆ 2log n x n | | such that the following holds for every of length : x L = z R(x, yˆ, z) ∈ ⇒ ∃ x / L = z R(x, yˆ, z) ∈ ⇒ ∀ ¬ c L NP/2log n. 2 This shows that ∈

k > 0 c > 0 Corollary 3.4 For any constant , there is a constant such that c AM[logk n] = NP/2log n. coNP ⇒ coNP 2 Proof This follows directly from Corollary 3.2 and Lemma 3.3.

4 Quasipolynomial advice for NP 2polylog In this section, we study the consequences of the existence of quasipolynomial length (i.e., -length) advice for NP. This question was first studied by Buhrman and Homer [BH92]. They showed that if NP has 2polylog NEXPNP = -size family of circuits, then the exponential hierarchy collapses to the second level (i.e. coNEXPNP SEXP ). In Theorem 4.4, we improve this collapse to 2 . In Theorem 4.1 we obtain an exponential /2polylog version of Yap’s theorem [Yap83]. We prove that if NP is contained in coNP , then the exponential Sexp PNP hierarchy collapses to 2 . We use this theorem to obtain the main result of this paper, which is Theorem 4.2. We note that Cai et al. [CCHO03] improved Yap’s theorem . They use self-reducibility of a language NPA A NP /poly = PH = S PNP in (for any set ) to show that coNP ⇒ 2 . Theorem 4.1 is somewhat similar in form to the result of Cai et al. However, we use a completely different technique from theirs. Furthermore, in Theorem 4.5 below, we will use our technique to give an independent (and hopefully easier) proof of their result. P P exp NP /2polylog = NEXP2 = coNEXP2 = S PNP Theorem 4.1 coNP ⇒ 2 . exp NP S2 P Proof SPince is closed undePr complement, it suffices to show under the hypothesis that 2 exp NP 2 NEXP = S2 P L NEXP N p . Let ∈ via some exponential-timn e nondeterminnikstic oracle machine 2 A x 0, 1 M 2 that has some language as an oracle. Fkor any input ∈ { } , runs in time. Thekrefore, any N A 2n 2n query that makes to is also of length , and the number of queries is also bounded by . N x The yes-proof consists of an accepting computation P of on ,kwith queries and their answers. Note q q A y / SAT q = 2n m that for any query , ∈ ⇔ ∃ q q,yq ∈ . When | | , let | q,yq | be denoted by (some n SAT coNP/2polylog exponential in ). By our assumption, is inc ; let us assume that the advice for strings m w w = 2polylog(m) = 2n c B coNP of length is , where | | for some constant , and let ∈ be the witness language. q y For every query that is answered “Yes” on the path P, the yes-prover also provides and q,yq . Note n PNP that the total length of the yes-proof is bounded by some exponential in . Also, since the verifier is a SAT machine, it can find out (making one oracle query) whether q,yq ∈ . Obviously, if some q,yq provided

8

x with an “Yes” query is satisfiable, the verifier rejects . In the following, therefore, we show how the verifier can verify whether “No” queries are answered correctly on the path P. w SAT m C The no-proof consists of the advice for strings in of length . Note that there is a set ∈ coNP q such that for any query , q / A y SAT ∈ ⇔ ∀ q q,yq ∈ y ( , w) B ⇔ ∀ q q,yq ∈ (q, w) C ⇔ ∈ C = (q, w) y ( , w) B q / A w where { ∀ q q,yq ∈ }. Therefore, if ∈ , and is the correct advice string, the (q, w) C verifier can make a query to the NP oracle and determine whether ∈ . If this happens for every q w x query answered “No” on P where is supplied by the no-prover, the verifier accepts exp. This does not w S automatically imply that is the correct advice string; however, by the definition of the 2 operator, we x L can always assume that one of the provers is correct, and therefore, when they agree (in this case, that ∈ ) the consensus decision must be correct. q (q, w) / C Otherwise, there must be some such that ∈ . This may result from the fact that the query is answered incorrectly on P, or it may happen that the advice string is wrong. (As outlined before, the case when both the proofs are wrong need not be considered.) In this case, by making prefix search using the NP y x oracle, the verifier can construct q and from that, it can obtain q,yq . The verifier accepts if and only if its SAT NP oracle says that q,yq ∈ . q / A y SAT y If ∈ , it must hold that for every q, q,yq ∈ . Therefore, in particular, for the q that is obtained SAT w q A by the prefix search, q,yq ∈ as well. On the other hand, if is the correct advice string, and ∈ , y / SAT then the prefix search will produce the correct q for which q,yq ∈ ; therefore, the yes-prover is lying, x / L 2 and ∈ . This completes the proof.

Now we prove our main theorem. k P P exp k AM[log n] NEXP2 = coNEXP2 = S PNP Theorem 4.2 For every constant , if coNP , then 2 . logk n k > 0 Proof If every language in coNP has an Arthur-Mecrlin proof system with moves for any , then NP/2log n c > 0 by Corollary 3.4, we obc tain that coNP for some constant . This isPequivalent to sayPing NP /2log n NEXP2 = coNEXP2 = thexpat coNP . From Theorem 4.1, we get the consequence that S PNP 2 2 . This completes the proof. (log n)log log n SAT NEEXP We can prove a version of Theorem 4.2 for -round interactive proof for . Let nk be 22 the set of languages that can be decided by a nondeterministic Turing machine that takes at most time n coNEEXP = L L NEEXP on an input of length , and let { ∈ }. P P SAT AM[(log n)log log n] NEEXP2 = coNEEXP2 Theorem 4.3 If ∈ , then . SAT AM[(log n)log log n] Proof The proof is similar to thOe(logprologofn)of Theorem 4.2. We first observe that P ∈ P SAT NP/2(log n) NEEXP2 = coNEEXP2 implies that ∈ nk . As a conseOq(ulogenlogcem,)we obntac in . The m = 22 2(log m) = 22 c > k 2 crucial point to note is that if , then for some .

In the following theorem, we improve the result of Buhrman and Homer [BH92, Theorem 1], who showed NEXPNP = coNEXPNP under the same hypothesis that . NP 2polylog NEXPNP = coNEXPNP = SEXP Theorem 4.4 If has -size family of circuits, then 2 .

9

SEXP NEXPNP coNEXPNP NEXPNP = SEXP Proof Since 2 ∩ (Proposition 2.3), it suffices to show that 2 . L NEXPNP N Let ∈ be acceptedk by a nondeterministic machine with SAT as an oracle. There is some k > 0 N 2n n N such that runs in time okn any input of length . Therefore, the formulas qc ueried by on any n m 2n 2polylog(m) = 2n c input of length are of size , and therefore, have circuit size for some . x, x = n On an input | | , the yes-proof consists of the following: N x Accepting path P of on , including the queries made on that path and their answers One satisfying assignment for every query that is answered “yes” The verifier can verify whether the assignments provided with each query that is answered “yes” is satisfy- x ing, and will reject if any of them is not satisfying. Therefore, in the following, we consider the queries that are answered “no” on P. We can assume that any circuit for SAT outputs not only 1 or 0 indicating whether the input formula is satisfiable or not, but also outputs a satisfying assignment when it claims that the input formula is satisfiable. This can be done by a polynomial blow-up in the size of the circuit, and therefore, the circuit still remains 2polylog C m of the size . The no-proof is such a circuit for SAT at length . C C Given , the verifier inputs each query that is answered “no” on P. If outputs 0 on all these x C formulas, indicating that they are unsatisfiable, then the verifier accepts . On the other hand, if outputs x a satisfying assignment for some that is answered “no” on P, then the verifier rejects . x L N x If ∈ , then there must be an accepting path of on , and the yes-prover can provide this path with the queries and their correct answers. No circuit (correct or otherwise) can output a satisfying assignment x / L on any formula that is answered “no” correctly on this path. On the other hand, if ∈ , the path provided by the yes-prover must be wrong. There are two possible scenarios in this case. First, some query that is answered “yes” on this path is unsatisfiable and is not satisfied by the assignment that is provided by the yes- x prover, in which case the verifier rejects . Otherwise, some formula that is answered “no” is unsatisfiable, and a correct circuit for SAT (provided by the no-prover) can output a satisfying assignment for that formula. x 2 In this case, the verifier rejects as well. This completes the proof.

Now we improve Yap’s theorem. NP /poly PH = S PNP Theorem 4.5 If coNP , then 2 . NP P S2 P NP 2 = Proof Since isP closed under complement, it suffices to show under the hypothesis that p S PNP L NP2 N 2 . Let ∈ via some polynomial-time nondeterministic oracle machine that has some 2 A x 0, 1 n M nk N language as an oracle. For any input ∈ { } , runs in time. Therefore, any query that makes A nk nk to is also of length , and the number of queries is also bounded by . N x The yes-proof consists of an accepting computation P of on , with queries and their answers. Note q q A y / SAT q = nk m that for any query , ∈ ⇔ ∃ q q,yq ∈ . When | | , let | q,yq | be denoted by (some n SAT /poly polynomial in ). By our assumption, is in coNP ; let us assume that the advice for strings of m w w = nc c B coNP length is , where | | for some constant , and let ∈ be the witness language. q y For every query that is answered “Yes” on the path P, the yes-prover also provides and q,yq . PNP SAT Also, since the verifier is a machine, it can find out (making one oracle query) whether q,yq ∈ . x Obviously, if some q,yq provided with an “Yes” query is satisfiable, the verifier rejects . In the following, therefore, we show how the verifier can verify whether “No” queries are answered correctly on the path P. w SAT m C The no-proof consists of the advice for strings in of length . Note that there is a set ∈ coNP q such that for any query , q / A y SAT ∈ ⇔ ∀ q q,yq ∈ y ( , w) B ⇔ ∀ q q,yq ∈ (q, w) C ⇔ ∈

10

C = (q, w) y ( , w) B q / A w where { ∀ q q,yq ∈ }. Therefore, if ∈ , and is the correct advice string, the (q, w) C verifier can make a query to the NP oracle and determine whether ∈ . If this happens for every q w x query answered “No” on P where is supplied by the no-prover, the verifier accepts . This does not w S automatically imply that is the correct advice string; however, by the definition of the 2 operator, we can x L always assume that one of the provers is correct, and therefore, when they agree (in this case, that ∈ ) the consensus decision must be correct. q (q, w) / C Otherwise, there must be some such that ∈ . This may result from the fact that the query is answered incorrectly on P, or it may happen that the advice string is wrong. (As outlined before, the case when both the proofs are wrong need not be considered.) In this case, by making prefix search using the NP y x oracle, the verifier can construct q and from that, it can obtain q,yq . The verifier accepts if and only if its SAT NP oracle says that q,yq ∈ . q / A y SAT y If ∈ , it must hold that for every q, q,yq ∈ . Therefore, in particular, for the q that is obtained SAT w q A by the prefix search, q,yq ∈ as well. On the other hand, if is the correct advice string, and ∈ , y / SAT then the prefix search will produce the correct q for which q,yq ∈ ; therefore, the yes-prover is lying, x / L 2 and ∈ .

4.1 Interactive Proof Systems IP[g(n)] g(n) Let denote an interactive proof system with rounds in the Goldwasser, Micali and Rackoff IP[g(n)] AM[2g(n) + 4] [GMR85] formalization. Goldwasser and Sipser [GS89] proved that as long g(n) L IP[logk n] L AM[logk+1 n] as is bounded by a polynomial. Thus, if ∈ , then ∈ . So the following corollary follows immediately from Theorem 4.2. P NEXP2 = Corollary P4.6 Ifexpevery set in coNP has a polylogarithmic-round interactive proof system, then coNEXP2 = S PNP 2 .

5 Conclusions

We have shown that if coNP has polylogarithmic-round interactive proofs then the exponential hierarchy SAT (log n)log log n collapses to the third level. Similarly, the double exponential hierarchy collapses if has a - SAT n round interactive protocol. An obvious extension would be to obtain consequences of having -round < 1 interactive proof systems for some . One longstanding open problem in this area is to show that if SAT has polynomial-sized circuits, then AM PH collapses to AM. Since coNP implies that PH collapses to AM, it suffices to show under this hypothesis that coNP is included in AM. Moreover, Arvind et al. [AKSS95] have shown that if SAT has a MA = AM MA SP polynomial-size family of circuits, then . Since 2 , this would improve the best-known version of Karp-Lipton theorem [KL80] (by Sengupta, reported in Cai [Cai01]). AM[polylog] It is not known whether AM is properly included in , but Aiello, Goldwasser and Ha˚stad polylog [AGH90] have shown that AM is properly included in AM[ ] in a relativized world.

6 Acknowledgements

The authors thank D. Sivakumar for suggesting the question that we address in this paper.

11

References

[AGH90] W. Aiello, S. Goldwasser, and J. Hastad. On the power of interaction. Combinatorica, 10(1):3–25, 1990.

[AKSS95] V. Arvind, J. Ko¨bler, U. Scho¨ning, and R. Schuler. If NP has polynomial-size circuits, then MA = AM. Theoretical Computer Science, 137(2):279–282, 1995. + [ALM 92] S. Arora, C. Lund, R. Motwani, M. Sudan, and M. Szegedy. Proof verification and hard- ness of approximation problems. In Proceedings of the 33rd Annual IEEE Symposium on Foundations of Computer Science, pages 14–22. IEEE Computer Society Press, 1992.

[AS92] S. Arora and S. Safra. Approximating clique is NP-complete. In Proceedings of the 33rd Annual IEEE Symposium on Foundations on Computer Science, pages 2–13. IEEE Computer Society Press, 1992.

[Ba´b85] L. Ba´bai. Trading group theory for randomness. In Proceedings of the 17th Symposium on Theory of Computing, pages 421–429. ACM Press, 1985.

[BFL81] L. Ba´bai, L. Fortnow, and C. Lund. Nondeterministic exponential time has two-prover inter- active protocols. Computational Complexity, 1(1):3–40, 1981.

[BFLS91] L. Ba´bai, L. Fortnow, L. Levin, and M. Szegedy. Checking computations in polylogarithmic time. In Proceedings of the 23rd Annual ACM Symopsium on Theory of Computing, pages 21–31, 1991.

[BH92] H. Buhrman and S. Homer. Superpolynomial circuits, almost sparse oracles, and the expo- nential hierarchy. In Foundations of Software Technology and Theoretical Computer Science, 12th Conference, New Delhi, India, December 18-20, 1992, Proceedings, volume 652 of Lecture Notes in Computer Science, pages 116–127. Springer-Verlag, 1992.

[BHZ87] R. B. Boppana, J. Ha˚stad, and S. Zachos. Does co-NP have short interactive proofs? Infor- mation Processing Letters, 25(2):127–132, 1987.

[BM88] L. Ba´bai and S. Moran. Arthur-merlin games : a randomized proof system, and a hierarchy of complexity classes. Journal of Computer and System Sciences, 36:254–276, 1988.

[BOGKW88] M. Ben-Or, S. Goldwasser, J. Kilian, and A. Wigderson. Multiprover interactive proofs: How to remove the intractability assumptions. In Proceedings of the 20th Annual ACM Symposium on Theory of Computing, pages 113–131, 1988. SP ZPPNP [Cai01] J-Y. Cai. 2 . In Proceedings of the 42nd IEEE Conference on Foundations of Computer Science, pages 620–629, 2001.

[Can96] R. Canetti. On BPP and the polynomial-time hierarchy. Information Processing Letters, pages 237–241, 1996.

[CCHO03] J-Y. Cai, V. Chakaravarthy, L. Hemaspaandra, and M. Ogihara. Competing provers yield im- proved karp-lipton collapse results. In Proceedings 20th Symposium on Theoretical Aspects of Computer Science, pages 535–546, 2003.

12

+ [FGL 91] U. Feige, S. Goldwasser, L. Lova´sz, S. Safra, and M. Szegedy. Approximating clique is almost NP-complete. In Proceedings 32nd Symposium on Foundations of Computer Science, pages 2–12. IEEE Computer Society Press, 1991.

[GH98] O. Goldreich and J. Hastad. On the complexity of interactive proofs with bounded commu- nication. Information Processing Letters, 67(4):205–214, 1998.

[GMR85] S. Goldwasser, S. Micali, and C. Rackoff. The knowledge complexity of interactive proofs. In Proceedings of the 17th Annual ACM Symposium on Theory of Computing, pages 291–304, 1985.

[GS89] S. Goldwasser and M. Sipser. Private coins versus public coins in interactive proof systems. In S. Micali, editor, Randomness and Computation, volume 5 of Advances in Computing Research, pages 73–90. JAI Press, 1989.

[GVW01] O. Goldreich, S. Vadhan, and A. Wigderson. On interactive proofs with laconic provers. In Proceedings of the 28th International Colloquium on Automata, Languages, and Program- ming, volume 2076 of Lecture Notes in Computer Science, pages 334–345. Springer Verlag, 2001.

[HS01] S. Homer and A. Selman. Computability and Complexity Theory. Springer-Verlag, 2001.

[KL80] R. Karp and R. Lipton. Some connections between nonuniform and uniform complexity classes. In Proceedings of the 12th ACM Symposium on Theory of Computing, pages 302– 309, 1980.

[LFKN92] C. Lund, L. Fortnow, H. Karloff, and N. Nisan. Algebraic methods for interactive proof systems. Journal of the Association of Computing Machines, 39(4):859–868, 1992.

[RS98] A. Russell and R. Sundaram. Symmetric alternation captures BPP. Journal of Computational Complexity, 7(2):152–162, 1998.

[Sha92] A. Shamir. IP = PSPACE. Journal of the Association of Computing Machines, 39(4):869– 877, 1992.

[Tod91] S. Toda. PP is as hard as the polynomial time hierarchy. SIAM Journal on Computing, 20:865–877, 1991.

[Yap83] C. Yap. Some consequences of non-uniform conditions on uniform classes. Theoretical Computer Science, 26(3):287–300, 1983.

[ZF87] S. Zachos and M. Fu¨rer. Probabilistic quantifiers vs distrustful adversaries. In Foundations of Software Technology and Theoretical Computer Science, 1987, Proceedings, volume 287 of Lecture Notes in Computer Science, pages 449–455. Springer-Verlag, 1987.

[ZH86] S. Zachos and H. Heller. A decisive characterization of BPP. Information and Control, 69:125–135, 1986.

13