2018 IEEE 59th Annual Symposium on Foundations of Computer Science
Counting t-Cliques: Worst-Case to Average-Case Reductions and Direct Interactive Proof Systems
Oded Goldreich Guy N. Rothblum Department of Computer Science Department of Computer Science Weizmann Institute of Science Weizmann Institute of Science Rehovot, Israel Rehovot, Israel oded.goldreich@weizmann.ac.il [email protected]
Abstract—We study two aspects of the complexity of counting 3) Counting t-cliques has an appealing combinatorial the number of t-cliques in a graph: structure (which is indeed capitalized upon in our 1) Worst-case to average-case reductions: Our main result work). reduces counting t-cliques in any n-vertex graph to counting t-cliques in typical n-vertex graphs that are In Sections I-A and I-B we discuss each study seperately, 2 drawn from a simple distribution of min-entropy Ω(n ). whereas Section I-C reveals the common themes that lead 2 For any constant t, the reduction runs in O(n )-time, us to present these two studies in one paper. We direct the and yields a correct answer (w.h.p.) even when the reader to the full version of this work [18] for full details. “average-case solver” only succeeds with probability / n 1 poly(log ). A. Worst-case to average-case reductions 2) Direct interactive proof systems: We present a direct and simple interactive proof system for counting t-cliques in 1) Background: While most research in the theory of n-vertex graphs. The proof system uses t − 2 rounds, 2 2 computation refers to worst-case complexity, the impor- the verifier runs in O(t n )-time, and the prover can O(1) 2 tance of average-case complexity is widely recognized (cf., be implemented in O(t · n )-time when given oracle O(1) e.g., [13, Chap. 1–10.1] versus [13, Sec. 10.2]). Worst-case access to counting (t − 1)-cliques in O(t · n)-vertex graphs. to average-case reductions, which allow for bridging the gap The results are both obtained by considering weighted versions between the two theories, are of natural appeal (to say the of the t-clique problem, where weights are assigned to vertices least). Unfortunately, worst-case to average-case reductions and/or to edges, and the weight of cliques is defined as the are known only either for “very high” complexity classes, product of the corresponding weights. These weighted problems such as E and #P (see [4] and [23], [10], [15]1, resp.), or are shown to be easily reducible to the unweighted problem. for “very low” complexity classes, such as AC0 (cf. [2], Keywords-counting cliques; worst-case to average-case reduc- [3]). In contrast, presenting a worst-case to average-case tions; interactive proofs, fine-grained complexity; reduction for NP is a well-known open problem, which faces significant obstacles as articulated in [12], [9]. I. INTRODUCTION In the context of fine-grained complexity. A recent work We study two (seemingly unrelated) aspects of the com- by Ball, Rosen, Sabin, and Vasudevan [5] initiated the study plexity of counting t-cliques. The first study refers to the of worst-case to average-case reductions in the context of 2 relation between the worst-case complexity of problems fine-grained complexity. The latter context focuses on the P in P and their average-case complexity. The second study exact complexity of problems in (see, e.g., the survey seeks (direct and intuitive) doubly-efficient interactive proof by V. Williams [31]), attempting to classify problems into system for problems in P. Indeed, both studies are related to classes of similar polynomial-time complexity (and distin- the recently emerging theory of “hardness within P” [31], guishing, say, linear-time from quadratic-time and cubic- and counting t-cliques in graphs is a good test case for both time). Needless to say, reductions used in the context of studies for several reasons: 1The basic idea underlying the worst-case to average-case reduction of 1) Counting t-cliques in (n-vertex) graphs is a natural the “permanent” is due to Lipton [23], but his proof implicitly presumes candidate for “hardness within P” (i.e., it is in P and that the field is somehow fixed as a function of the dimension. This issue is assumed to have worst-case complexity nΘ(t)); was addressed independently by [10] and in the proceeding version of [15]. t In the current work, we shall be faced with the very same issue. 2) Counting -cliques is a well-studied and natural prob- 2In retrospect, as will be discussed shortly below, some prior results can lem; and be reinterpreted as belonging to this setting.
2575-8454/18/$31.00 ©2018 IEEE 77 DOI 10.1109/FOCS.2018.00017 fine-grained complexity must preserve the foregoing classi- where the Ai’s are n-by-n matrices over a finite field and fication, and the simplest choice – taken in [5] – is to use (n)=O(log n). They conjectured that this function cannot almost linear-time reductions. be computed in time 2 (n)/3, and showed that it is random The pioneering paper of Ball et al. [5] shows that there self-reducible (by O(n) queries).3 Note, however, that the exist (almost linear-time) reductions from the worst-case of foregoing problem is not as well-studied as the problems several natural problems in P, which are widely believed to considered in [5], [17], including counting t-cliques. be “somewhat hard” (i.e., have super-linear worst-case time complexity), to the average-case of some other problems 2) Our results: Our main result in this work is reduc- t that are in P. In particular, this is shown for the Orthogonal ing the worst-case complexity of counting -cliques to the t Vector problem, for the 3-SUM problem, and for the All Pairs average-case complexity of counting -cliques. Doing so, we Shortest Path problem. Hence, the worst-case complexity of show that the worst-case and average-case complexity of t problems that are widely believed to be “somewhat hard” is counting -cliques are essentially equal. reduced to the average-case complexity of problems in P. Theorem 1.1: (worst-case to average-case reduction for Furthermore, the worst-case complexity of the latter prob- counting cliques of given size): For any constant t, there lems matches (approximately) the best algorithms known exists a simple distribution on n-vertex graphs and a O(n2)- for the former problems (although the actual worst-case time worst-case to average-case reduction of counting t- complexity of these problems may in fact be lower). cliques in n-vertex graphs to counting t-cliques in graphs In our prior work [17], we tighten the foregoing result generated according to this distribution such that the reduc- p by defining, for each polynomial , a worst-case complexity tion outputs the correct value with probability 2/3 provided C(p) p1+o(1) class that is a subset of Dtime( ), and showing, that the error rate (of the average-case solver) is a constant C(p) for any problem Π in , an almost linear-time reduction smaller than one fourth. Furthermore, the reduction makes from solving Π in the worst-case to solving a different poly(log n) queries, and the distribution Gn can be generated ∈C(p) problem Π in the average-case. Furthermore, we in O (n2)-time and is uniform on a set of exp(Ω(n2)) graphs. C(p) showed that contains problems whose average-case t complexity almost equals their worst-case complexity. We obtain a similar reduction for counting (simple) -cycles p (for odd t ≥ 3), see the full version [18] for details. Loosely speaking, the class C( ) consists of counting problems that refer to p(n) local conditions regarding the n- The notion of average-case complexity that underlies the bit long input, where each local condition refers to no(1) bit foregoing discussion (and Theorem 1.1) refers to solving o . locations and can be evaluated in n (1)-time. In particular, the problem on at least a 0 76 fraction of the instances. This t p for any constant t>2 and pt(n)=n , the class C( t) notion may also be called typical-case complexity. A much contains problems such as t-CLIQUE and t-SUM. more relaxed notion, called rare-case complexity, refers to 4 We emphasize that the foregoing results present worst- solving the problem on a noticeable fraction of the instances /poly n n case to average-case reductions for classes of problems (i.e., (say, on a 1 (log ) fraction of the -bit long instances). reducing the worst-case complexity of one problem to the average-case complexity of another problem). Hence, the Theorem 1.2: (worst-case to rare-case reduction for foregoing results leave open the question whether there counting cliques): For any constant t, there exists a simple exists an almost linear-time worst-case to average-case re- distribution on n-vertex graphs and a O(n2)-time worst- duction for a problem in P, let alone a natural problem of case to rare-case reduction of counting t-cliques in n-vertex conjectured high worst-case complexity. graphs to counting t-cliques in graphs generated according to this distribution such that the reduction outputs the correct Worst-case to average-case reductions for individual value with probability 2/3 provided that the success rate (of problems. As stated in Footnote 2, some prior results can the rare-case solver) is at least 1/poly(log n). Furthermore, be reinterpreted as worst-case to average-case reductions for the reduction makes O(n) queries, and the distribution Gn P seemingly hard problem in . In particular, this holds for can be generated in O(n2)-time and is uniform on a set of problems shown to be random self-reducible. An archetyp- exp(Ω( n2)) graphs. ical case, presented by Blum, Luby, and Rubinfeld [8], is Theorem 1.2 is meaningful only for t>3 (since the that of matrix multiplication: the product AB is computed reduction makes Ω(n) queries regarding (related) instances as (A+R)(B +S)−(A+R)S −R(B +S)+RS, where R and S are random matrices. Note, however, that in this case the potential hardness of the problem is quite modest (as 3 . They also showed that it is downwards self-reducible when the field n × n matrix products can be computed in time o(n2 373)). has the form GF (2m(n)) such that m(n)=2 log2 n (or m(n)=2· n A far less known case was presented by Goldreich and 3 log3 ). 4Here a “noticeable fraction” is the ratio of a linear function over an Wigderson [19], who considered the problem of computing almost linear function. We stress that this is not the standard definition of f A , ..., A DET A the function n( 1 (n))= S⊆[ (n)] ( i∈S i), this notion (at least not in cryptography).
78 of description length Ω(n2)).5 Rothblum, and Rothblum [26] provided such (constant- round) proof systems for any set that can be decided in B. Doubly-efficient interactive proof systems polynomial-time and a bounded amount of space (e.g., for all sets in SC). 1) Background: The notion of interactive proof systems, put forward by Goldwasser, Micali, and Rackoff [21], and Towards algorithmic design of proof systems. In our prior the demonstration of their power by Lund, Fortnow, Karloff, work [16], we proposed to develop a more “algorithmic” and Nisan [24] and Shamir [27] are among the most cele- understanding of doubly-efficient interactive proofs; that is, brated achievements of complexity theory. Recall that an to identify structures and patterns that facilitate the design interactive proof system for a set S is associated with an of efficient proof systems. Specifically, we identified a natu- interactive verification procedure, V , that can be made to ral class of polynomial-time computations, and constructed 6 accept any input in S but no input outside of S. That is, simpler doubly-efficient proof systems for this class. The there exists an interactive strategy for the prover that makes aforementioned class consists of all sets that can be locally- V accepts any input in S, but no strategy can make V accept characterized by the conjunction of polynomially many local an input outside of S, except with negligible probability. conditions, each of which can be expressed by Boolean (See [13, Chap. 9] for a formal definition as well as a wider formulae of polylogarithmic size. The class of locally- p perspective.) characterizable sets is believed not to be in Dtime( ) for p The original definition does not restrict the complexity of any fixed polynomial , and contains natural problems of the strategy of the prescribed prover and the constructions interest such as determining whether a given graph does not t of [24], [27] use prover strategies of high complexity. contain a clique of constant size . This fact limits the applicability of these proof systems in The proof system presented in [16] capitalizes on the practice. (Nevertheless, such proof systems may be actually fact that membership in a locally characterizable set can be applied when the prover knows something that the verifier cast as satisfying polynomially many low-degree equations. does not know, such as an NP-witness to an NP-claim, and Hence, analogously to [24], [27], the first step is recasting when the proof system offers an advantage such as zero- membership in a locally-characterizable set as an algebraic knowledge [21], [14].) problem, which consists of computing the sum of polyno- mially many evaluations of a low-degree polynomial (where Doubly-efficient proof systems. Seeking to make interac- the particular polynomial is derived from the description of tive proof systems available for a wider range of appli- the locally-characterizable set). The interactive proof uses cations, Goldwasser, Kalai and Rothblum put forward a the sum-check protocol [24] to verify the correctness of notion of doubly-efficient interactive proof systems (also the sum, and the same applies to counting versions of called interactive proofs for muggles [20] and interactive locally charcatizeable sets. Hence, the intuitive appeal of proofs for delegating computation [26]). In these proof the problem of counting t-cliques is lost at the first step (in systems the prescribed prover strategy can be implemented which we consider an algebraic version or extension of the in polynomial-time and the verifier’s strategy can be im- original problem). plemented in almost-linear-time. (We stress that unlike in 2) Our results: In the current work, we present a new argument systems, the soundness condition holds for all (doubly-efficient) interactive proof for counting t-cliques in possible cheating strategies, and not only for feasible ones.) a graph. The proof system proceeds in iterations, where in Restricting the prescribed prover to run in polynomial-time the ith iteration verifying the number of (t − i +1)-cliques implies that such systems may exist only for sets in BPP, in a graph is reduced to verifying the number of (t − i)- and thus a polynomial-time verifier can check membership cliques in a related graph. Hence, the claims made in these in such sets by itself. However, restricting the verifier to run iterations, whose complexity gradually decreases from one in almost-linear-time implies that something can be gained iteration to the next, all have a clear intuitive meaning that by interacting with a more powerful prover, even though the is similar to the original problem (counting the number of latter is restricted to polynomial-time. cliques in a graph). The potential applicability of doubly-efficient interactive Beyond its conceptual appeal, this proof system has the proof systems was demonstrated by Goldwasser, Kalai and concrete advantage that the (honest) prover’s complexity is Rothblum [20], who constructed such proof systems for any directly related to the complexity of the statement being set that has log-space uniform circuits of bounded depth proved: the prover can be implemented in linear time given (e.g., log-space uniform NC). A recent work of Reingold, an oracle for counting t-cliques. The proof system extends t t n 5The time bound of the reduction itself refers to a model of computation to varying = ( ), yielding an alternative interactive proof in which the cost of making the (equal length) queries q1, ..., qm is |q1| + q ,q x, y 6Indeed, the aforementioned class (of locally-characterizable sets) is a j∈[n−1] Δ( j j+1), where Δ( ) denotes the Hamming distance between x and y. This model is justified by the actual cost of composing sub-class of NC ∩ SC, yet the interactive proofs presented in [16] are the reduction with a procedure that solves the reduced instances. significantly simpler than those in [20], [26].
79 system for #P; in particular, we note that this proof system the current interactive proof system over the one in [16] is does not use the sum-check protocol of [24]. that the prover’s complexity is proportional to the complexity of counting t-cliques (which is lower than n2.373·t/3) rather Theorem 1.3: (interactive proof systems for counting than being proportional to nt. The foregoing procedure cliques of given size): For an efficiently computable function works also for varying t = t(n), yielding an alternative t : N → N, let St denote the set of pairs (G, N) such interactive proof system for #P. (We comment that the that the graph G =([n],E) has N distinct t(n)-cliques. resulting interactive proof system bears some similarity Then, St has a (t − 2)-round (public coin) interactive proof to the original interactive proof system for the permanent system (of perfect completeness) in which the verifier’s presented in [24]; see further discussion in the full version running time is O(t(n)2 · n2), and the prover’s running time ωmm· t n − / [18].) is O(t(n)2 · n1+ ( ( ) 1) 3 ), where ωmm is the matrix multiplication exponent. Furthermore, the prover can be im- Detour: On a scaled-down version of the permanent. plemented in poly(t(n)) · O(n2)-time, when given access to We mention that, under the exponential-time hypothesis, a an oracle for counting (t(n)−1)-cliques in poly(t(n))·O (n)- scaled-down version of the permanent, in which we consider vertex graphs. computing the permanent of an -by- matrix padded to length n =2 /O(1), constitutes a relatively hard problem High-level structure of the new interactive proof system. in P. Furthermore, the original interactive proof system for As discussed above, the interactive proof proceeds in itera- the permanent can be adapted to yield a doubly-efficient tions. The ith iteration is a (doubly efficient and interactive) interactive proof system with O(log ) rounds. An alternative reduction from verifying the number of (t − i +1)-cliques proof system that uses a constant number of rounds is in a graph to verifying the number of (t − i)-cliques in a presented in the full version. related graph. This proceeds in two conceptual steps. First, we reduce verifying the number of t -cliques in Application to proofs of work. Proofs of work were G =([n ],E ) to verifying, for each vertex j ∈ [n ], the introduced by Dwork and Naor [11] as a method for number of t -cliques in G that contain the vertex j, which certifying, in an easily verifiable way, that an untrusted equals the number of (t − 1)-cliques in the graph induced party expended non-trivial computational resources. This by the neighbors of j. Next, we let the parties reduce the may be useful, for example, in fighting denial of service latter n claims to a single claim regarding the number of attacks. A proof of work usually consists of a procedure for (t − 1)-cliques in a new graph, which has the same number generating puzzles that are moderately hard to solve, and of vertices as G , where the reduction is via a single-round a doubly-efficient procedure for verifying the correctness randomized interaction. That is, while the first step employs of solutions. Our results immediately yield proofs of work downwards reducibility, where the decreased parameter is based on the problem of counting t-cliques. Puzzles can be the size of the counted cliques, the second step employes generated by sampling graphs from the hard distribution batch verification (cf., [26]), where the verification of n of Theorem 1.1, where the solution is the number of t- claims is reduced to a verification of a single claim of the cliques in the graph. Solutions can be verified using the same type. interactive proof system of Theorem 1.3. In particular, this Essentially, the foregoing batch verification is performed yields an appealing proof of useful work system (cf. [6]). by considering an error correcting encoding of the n graphs Moreover, our results imply that the work needed to solve by a sequence of poly(n ) graphs, each having n vertices. puzzles and to prove the correctness of solutions is closely The prover sends a succinct description of the number of related to the complexity of counting t-cliques in worst- (t − 1)-cliques in these poly(n ) graphs, and the verifier case graphs. Another desired feature of proofs of work is verifies that the sum of the values associated with the n the non-existence of efficient batching algorithms (a.k.a. former graphs equals the claim regarding the number of “non-amortization” [6]). Our techniques provide a result that t-cliques in G . If so, then the verifier select one of the partially addresses this concern (see the full version [18] for poly(n ) graphs at random for the next iteration (in which it details). verifiers the number of (t −1)-cliques in the selected graph). Indeed, the crucial point is finding a suitable encoding C. Techniques scheme, and this is discussed in Section I-C1. One common theme in the two parts of this work is that We stress that the foregoing procedure does not use the we find it beneficial to consider “weighted generalizations” sum-check protocol, and that each iteration starts and ends of the problem of counting t-cliques. Specifically, we con- with an intuitive combinatorial claim to be verified. (Algebra sider graphs with either vertex or edge weights, and define “raises its ugly head” only in the encoding scheme, which the weight of the clique as the product of the corresponding utilizes a so-called multiplication code [25], and in the fact weights (where arithmetic is performed over a finite field). that cliques are indicated by products of all corresponding Our definition stands in contrast to the standard practice “edge indicators”.) As noted above, a concrete advantage of of defining the weight of a set as the sum of its elements
80 (cf. [1]), but in the case of vertex-weights it has a very the prover a random position in the codeword (i.e., a random appealing interpretation (see Section I-C1). In any case, after r ∈ [m]). The next iteration will refer to the weighted graph working with the weighted problems, we present reductions G with weights that are determined by the rth coordinate of from the weighted problems back to the original problem (of the codewords c1, ..., cn (i.e., the weights are c1[r], ..., cn[r]), counting t-cliques). The reduction for the case of weighted and the claimed value will be cr (i.e., the rth coordinate of edges is more complex than the one for weighted vertices. the codeword sent by the prover). A second common theme is the manipulation of graphs Note that we capitalize on the fact that the sum of the via the manipulation of their vertex (or edge) weights. weights of t-cliques in a weighted graph is expressed as a Encoding a sequence of weighted graphs is performed sum of t-way products of vertex weights. A crucial feature by encoding the corresponding sequences of weights (see of the Reed-Solomon code, which enables the foregoing Section I-C1), and performing self-correction is possible by manipulation, is that multiplying together t codewords of considering sequences that extend each of the weights (see the original code that has large distance (i.e., 1 − ) yield a Section I-C2). These comments will hopefully become more codeword of a code that has sufficiently large distance (i.e., clear when we get to the specifics. 1 − t). And we also use the fact that the code is linear, but c’est tout. In particular, unlike Meir [25], we do not use 1) For the direct interactive proof systems: Here it is tensor codes. Furthermore, unlike most work in the area, we n useful to consider vertex-weighted graphs. A -vertex graph do not use the sum-check protocol nor refer to objects (like w , ..., w i ∈ n with vertex weights ( 1 n) such that vertex [ ] is low-degree extensions of Boolean functions) that have no w assigned the weight i may be thought of as a succinct direct intuitive meaning. n representation of a larger graph consisting of independent The foregoing description refers to vertex weights that ith w sets such that the independent set has i vertices and reside in a finite field of polynomial (in n) size. To get the edges represent complete bipartite graphs between the back to the unweighted problem of counting t-cliques, corresponding independent sets. From this perspective, it is we first reduce the weighted problem over GF(p) to S w natural to define the weight of the clique as i∈S i. O(t2 log p) weighted problems over smaller fields, each of G n ,E Given such a weighted graph =([] ), the set of size O(t2 log p). Next, we reduce each of these problems to t sum of the weights of the -cliques that contain a specific an unweighted problem using the reduction outlined in the j ∈ n w vertex [ ] equals j times the sum of the weighted first paragraph of this section (i.e., replacing each vertex by t − ( 1)-cliques in the graph induced by the neighbors of an independent set of size that equals the vertex’s weight and j . The latter graph is obtained by resetting the weights connecting vertices that reside in different independent sets j of non-neighbors of to 0 and keeping the weights of if and only if the original vertices were connected). Since j the neighbors of intact. Note that the topology of the the weights are currently small, this blows-up the size of the graph (i.e., its vertex and edge sets) remain intact, only the graph by a small amount. weights are updated; that is, the weights w =(w1, ..., wn) w(j) w(j), ..., w(j) 2) For the worst-case to average-case reductions: Here are replaced by the weights =( 1 n ) such (j) (j) it is useful to considered edge-weighted graphs. In fact, we that w = wi if {i, j}∈E and w =0otherwise. Next, i i may ignore the graph and just consider weights assigned to we encode the resulting sequence of weighted graphs, all all edges of the complete graph, since the non-existence of having the same topology G, by encoding the n weights an edge can be represented by a weight of zero. Hence, we of each vertex such that the kth codeword, denoted ck, consider a symmetric matrix W =(wj,k), and allow non- encodes the weights of k ∈ [n] in each of the n graphs w(1), ..., w(n) zero diagonal entries as representations of vertex-weights (i.e., k k ). Specifically, using the Reed-Solomon (as in Section I-C1).8 We define the weight of the set of code (which is a “good” linear “multiplication code” [25]), vertices S as a product of the weights of all edges that are we obtain n codewords such that multiplying any t of them S w m incident at (i.e., j≤k∈S j,k). Similarly to Section I-C1, (in a coordinatewise manner) yields an ( -long) encoding of we show that the sum of the weights of all t-subsets of the weights of the corresponding t-subset in the n graphs.7 [n] is proportional to the number of t-cliques in a (much) In the corresponding iteration of the interactive proof sys- larger graph, but the reduction in this case is more complex c c , ..., c tem, the prover sends a codeword, denoted =( 1 m), n than in Section I-C1. Before discussing this reduction, we that represents the sum of the t codewords that encode outline the ideas used in the worst-case to average-case and t n the weights of all -subsets of [ ]. The verifier will decode rare-case reductions of the edge-weighted problems. this (m-long) codeword, check that the sum of the resulting n values equals the value claimed in this iteration, and send The worst-case to average-case reduction. We first observe that the problem of computing the sum of the weights of t- 7Note that if all original weights are in {0, 1, ..., b}, then we can work subsets of vertices in an edge-weighted graph, when defined with a prime field of size p = O(ntbt), since the weight of each t-subset resides in [0,bt]. In subsequent iterations, the claims will refer to the value 8Alternatively, one may consider the weights of the diagonal entries as modulo p. Recall that in this case m = p. weights of the corresponding self-loops.
81 over a finite field, is random self-reducible. Specifically, In this work we extend Definition 1.4 by allowing the given a n-by-n matrix W =(wj,k) such that all wj,k’s reside sample to be drawn from an arbitrary distribution over 2 n s n in {0, 1, ..., b}, we pick a prime field of size p = O(ntbt ), ({0, 1} ) ( ); in particular, the s(n) individual samples need select uniformly a random matrix R ∈ GF(p)n×n, and not be independently and identically distributed. We note obtain the values of the sum of weighted t-subsets for the that both the foregoing implications hold also under this matrices W +iR, for i =1, ..., t2. Note that we are interested extension, where for the second implication we also require in val(W ), where val(X) is the sum over all t-subset S of that the sample distribution be efficiently sampleable. x p val W ζR j≤k∈S j,k (reduced modulo ). Hence, ( + ) is a Our worst-case to rare-case reduction utilizes the worst- t t
82 our proof system (of Theorem 1.3) has the salient feature there is no need to specify a graph since non-edges can be of deviating from the arithmetization approach of [24], and represented as edges with weight zero. The weight of a t- maintaining the combinatorial flavor of the original problem subset of vertices will be defined as equal the product of throughout interaction. Furthermore, the complexity of our the weights of all edges in the induced graph (including the prover strategy is directly related to the complexity of self-loops). Hence, for a symmetric (and possibly reflexive) t n n W w CWC W counting the number of -cliques in a graph. In particular, -by- matrix =( j,k)j,k∈[n], we let t( ) denote for fixed t ≥ 3, known algorithms for this problem give a the sum of the weights of all t-subsets of vertices; that is, ωmm· t− / t− prover runtime of O(n1+ ( 1) 3 ) |E|·n 2, where CWC W def w ωmm is the matrix multiplication exponent. t( ) = j,k (1) S∈ [n] j≤k:j,k∈S While it is unknown whether non-deterministic algorithms ( t ) (equiv., NP proof systems) can outperform the best algo- Computing this quantity is tightly related to counting the rithm known for counting t-cliques, Williams [32] showed number of t-cliques in simple unweighted graphs. In one that such an improvement is possible when allowing ran- direction, for a simple graph G =([n],E), taking Wj,j =1 domization; that is, non-interactive and randomized proof j ∈ n W {j, k}∈E MA for every [ ], and j,k =1 if and systems (as captured by the complexity class ) can [n] Wj,k =0otherwise (i.e., if {j, k}∈ \ E), the quantity outperform algorithms. Specifically, his (single-message) 2 CWC W t G proof system for counting the number of t-cliques has t( ) equals the number of -cliques in . In the other proof length and verification time O nt/2 +2 n0.666t. direction, we shall show how to reduce the computation of ( ) CWC t Subsequent improvement by Bjorklund¨ and Kaski [7] yields t to counting -cliques in graphs, (the reduction, which an MA proof system with length and verification time is presented in Section II-A), incurs a significant overhead ωmm ·t/ t O(n( + ) 6), where >0 is an arbitrarily small con- in terms of the parameter ). CWC stant. The time to construct proofs in their system is We also consider the restriction and reduction of t to ωmm t/ p O(n( + ) 3), matching the best algorithm known for prime fields; that is, abusing notation, for a prime , we let CWCp W def CWC W p solving the problem. Recall, however, that we construct t ( ) = t( )mod . interactive proof systems: this lets us reduce the verification Our motivation for this generalization is that it supports a time to O(n2) and the communication to O(n). worst-case to average-case reduction, which will be used to prove Theorem 1.1. But before describing this reduction, we E. Notation and organization show that the quantity supports a downward self-reduction For a natural number n, we let [n]= {1, ..., n} and (in terms of the parameter t), which proves useful for several U [[n]] = {0}∪[n]. For a set U,welet t = {S ⊆ U : of our results: |S| = t}. For a prime p,weletGF(p) denote the finite field of cardinality p. We often conduct our discussion with t · CWC W w · CWC W (i) , reference to a seemingly fixed number of vertices (denoted t( )= i,i t−1( ) (2) n), clique size (denoted t), and prime p; the reader should i∈[n] n t p (i) (i) think of as varying (or generic), and of and as possibly where W =(wj,k) satisfies: n ⎧ depending on . ⎨ 0 if j = k = i w(i) w · w j k ∈ n \{i} Organization. The remainder of this extended abstract pro- j,k = ⎩ i,j j,j if = [ ] vides additional details about the worst-case to average-case wj,k otherwise (i.e., j = k) reductions for counting t-cliques in graphs, using the notion W (i) W of edge-weighted t-cliques as a methodological vehicle. Note that and differ only on the self-loops (i.e., w(i) w j k w(i) w(i) See the full version [18] for full details, as well as a j,k = j,k for every = ), where i,i =0and j,j = w · w j ∈ n \{i} full exposition about the worst-case to rare-case reductions, i,j j,j for every [ ] . To see that Eq. (2) holds, S, i S t n direct interactive proofs (in particular, we mention that the note that each pair ( ) such that is a -subset of [ ] i ∈ S interactive proofs use the notion of vertex-weighted t-cliques and contributes equally to each side of Eq. (2), where the contribution is wi,j · wj,k, which as a methodological vehicle), and further extensions and j∈S j≤k∈S\{i} (i) related discussions. equals wi,i · w , since both expressions equal j≤k∈S\{i} j,k t II. ON COUNTING EDGE-WEIGHTED -CLIQUES wi,i · j∈S\{i} wi,j · wj,j · j 83 t magnitude of the weights in the matrix, and then reducing i ∈ p (2) G t ( j,k)j 84 p augmented graph. We denote the augmented graph derived For every fixed t, the computation of CWCt can be reduced from W when wishing to compute CWCi(W ) by T (i, W ), in O(n2)-time to computing the number of t-cliques in and note that T (i, W ) has n − (t − i) vertices. unweighted O (n)-vertex graphs (see the full version [18] for details). Hence, for t = O(1) and p = poly(log n), the p n×n B. The worst-case to average-case reduction worst-case complexity of CWCt :GF(p) τGF(p) is upper bounded by the average-case complexity of counting t- We consider the worst-case and average-case problems of p n×n cliques in unweighted O(n)-vertex graphs that are uniformly computing CWCt :GF(p) → GF(p), while allowing t n×n distributed over the set {T (W ):W ∈ GF(p) }, where and p to vary with n. While it is natural to assume that T is the mapping presented in Theorem 2.2. t = t(n) is easily determined given n, we cannot make this assumption regarding the determination of a prime p = p(n) Proof: Fixing t = t(n) > 1 and p = p(n), we let n×n of size Θ(nt), since determining such a prime may take F =GF(p(n)). For any W, R ∈F , consider the t p time Ω(n ), whereas our focus here is on reductions that univariate polynomial Pt(z)=CWCt (W + zR), where the arithmetic is over F. Recalling Eq. (1), observe that Pt run much faster (i.e., they must be certainly faster than the t 11 t 11 we consider the problem Πn in which the instances are Indeed, this issue is less acute in the context of interactive proofs, since p, W p n we may instruct the parties to select such a prime at random (rather than pairs of the form ( ) such that is an ( )-bit long n×n determine it). prime and W ∈ GF(p) , and the problem is to compute 12Indeed, for our purposes, it suffices to assume that interval [m, m + p CWCt n (W ). poly(log m)] contains a prime. Actually, we can get meaningful results ( ) m, m mo(1) Showing a worst-case to average-case reduction for Πn is even when only assuming that interval [ + ] contains a prime. p 13Recall that a problem is is randomly self-reducible in time T with more complex than doing so for Πn, because when given the q queries if there exists an oracle machine of time complexity T and input (p, W ) it may be the case that the average-case solver q query complexity that solves the problem (in the worst-case) by making just fails on all inputs of the form (p, ·). Hence, we shall use uniformly distributed queries to the problem itself. (We stress that the Chinese Remaindering (with errors [15]) in order to obtain queries may depend on one another; it is only required that each query p is uniformly distributed among the problem’s instances.) Indeed, such CWC W CWC W the value of t(n)( ) (or rather t(n)( )) from the a reduction yields a worst-case to average-case reduction that supports p n − n / q CWC W p ∈ ( ) 1, ( ) average-case error rate of 1 3 . values of t(n)( ) for other primes [2 2 ]. 85 Theorem 2.5: (worst-case to average-case reduction for probability, at least a 0.5+0.5 fraction of the primes 14 Πn): Let : N → N be such that (n) ∈ [3 log t(n)+ selected in Step 1 are good. log log n + ω(1),O(t(n)logn)]. Then, there exists a worst- Corollary 2.6: (worst-case to average-case reduction for case to average-case reduction of Πn to itself that makes counting cliques): Let t be a constant and b n O(t(n)5 log n) queries, runs in O(t(n)6 · n2) time, and ( )= t3 n G O n outputs the correct value with probability 2/3, provided that Θ( log ). Let n be a distribution on ( )-vertex graphs obtained by selecting uniformly at random a prime p ∈ the error rate of the average-case solver is a constant smaller b n , b n W ∈ p n×n T W than one fourth. [ ( ) 2 ( )] and GF( ) , and outputting ( ) where T is the mapping presented in Theorem 2.2. Then, Proof: Denoting the error rate of the average-case there exists a worst-case to average-case reduction of count- solver by η<1/4, and letting =1/4 − η, we first ing t-cliques in n-vertex graphs to counting t-cliques in observe that for at least a 0.5+ fraction the primes in graphs generated according to Gn such that the reduction def n − n O n2 O n 2 In =[2( ) 1, 2 ( )], the solver has an error rate of at most runs in ( ) time, makes (log ) queries, and outputs 0.5−; that is, for each such prime p, hereafter called good, the correct value with probability 2/3, provided that the error p the solver solves Πn correctly on at least a 0.5+ fraction rate of the average-case solver is a constant smaller than one of the instances. Hence, for each good prime, we can apply fourth. the reduction presented in the proof of Theorem 2.4, but Proof: Given an n-vertex graph G, using Proposi- the problem is that the prime that is part of the worst-case tion 2.1, we reduce counting the number of t-cliques in G instance may not be good. p to making O(log n) queries to oracles of the form CWCt p, W p ∈ I W ∈ Hence, on input ( ), where n and such that p is a prime in [b(n), 2b(n)]. Next, setting (n)= p n×n GF( ) , we first try to obtain the (integer) value of log b(n) (and using Theorem 2.5), we reduce answering CWCt n (W ), and then reduce the result modulo p. Basi- ( ) each of these queries to solving the problem Πn on at least CWC W cally, we shall obtain the value of t(n)( ) by selecting 0.75+ of the instances, where >0 is an arbitrary constant. m O −1t n 3 n / n p , ..., p = ( ( ) log ) ( ) random primes 1 m in (We do so after reducing the error probility of the reduction In, hoping that at least (0.5+0.5) · m of them are good, o / n T pi to (1 log ).) Lastly, using the mapping of Theorem 2.2, and combining the values (CWC (W ))i∈ m using Chinese t(n) [ ] we map the O(t5 log n) random queries made by the worst- Remaindering with errors [15, Sec. 3]. The analysis of the case to average-case reduction to O (n)-vertex graphs. We latter decoding relies on the fact that the (non-negative) value 2 stress that a procedure that counts t-cliques in Gn correctly CWC W n · (n) t(n) < of t(n)( ) is bounded above by t(n) (2 ) . 3 with probability 0 75 + , yields a procedure that answers nO(t(n) ) m , whereas the product of the smallest primes in Πn correctly with probability 0.75 + . n − m 15 In exceeds (2 ( ) 1) =exp(O(t(n)3 log n)). Specifi- cally, on input (p, W ), we proceed as follows. 3) Length reduction: Corollary 2.6 falls short from estab- −1 3 O( ·t(n) log n) lishing Theorem 1.1 only in one aspect: It reduces worst- 1) Select at random m primes in In. = (n) case n-vertex graph instances to average-case instances that pi 2) For each selected prime, denoted , invoke the worst- are n -vertex graphs, for n = O(n). Wishing to have pi case to average-case procedure for Πn on the instance a worst-case to average-case reduction that preserves the p ,W v ( i ), and denote the result by i. (The aforemen- number of vertices (in the corresponding instances), we seek tioned reduction is the one presented in the proof of a reduction that reduces the number of vertices in the graph. Theorem 2.4, except that the error probability should It seems easiest to present such a reduction in the worst-case / m 16 be reduced to 1 3 .) setting. Indeed, we show a reduction of counting t-cliques 3) Apply Chinese Remaindering with errors (for er- in n-vertex graphs to counting t-cliques in n -vertex graphs . − . v , ..., v ror rate 0 5 0 5 )on 1 m (and the priomes such that n = n/poly(log n). Applying Corollary 2.6 to the p , ..., p p 1 m), and output the result reduced modulo . resulting n -vertex graphs, we reduce to n -vertex graphs The theorem follows by using the fact that, with high such that n = O(n )=n. 14Recall that Πn is defined in terms of of the functions t, : N → N. Proposition 2.7: (reducing the number of vertices in the It refers to instances of the form (p, W ) such that p is an (n)-bit long t t k N → p -clique counting problem): Let be a constant and : prime and W ∈ GF(p)n×n, and calls for computing CWC (W ). t(n) N such that k(n) ∈ [t +1,n − 1]. Then, there exists an 15Specifically, if (n) ≤ c · t(n)logn, then letting m = t 2 2 O((n/k(n)) ·k(n) )-time reduction of counting t-cliques in c · −1t n 3 n / n n · (n) t(n) < 2 ( ( ) log ) ( ) will do, since t(n) (2 ) n t k n 3 3 -vertex graphs to counting -cliques in ( )-vertex graphs. n(c+o(1))·t(n) (n)−1 m (1−o(1))·2c·t(n) log n , whereas (2 ) =2 . The Furthermore, the reduction performs O(n/k(n))t queries. unique decoding condition in [15] essentially requires an error rate of . − 0.5k k m 0 5 m , assuming that the product of the smallest (out of ) primes Proof: Consider an arbitrary partition of [n] into m = exceeds the encoded (non-zero) integer. t · n/ k n − t V , ..., V |V |≤k n /t 16Hence, each invokation generates O(t(n)2 log m) queries, totaling in ( ( ) ) sets 1 m such that i ( ) O(m) · t(n)2 queries. (for every i ∈ [m]). For every I ⊂ [m] of size at most t, let 86 VI = ∪i∈I Vi and GI be the subgraph of G induced by VI . [7] Andreas Bjorklund¨ and Petteri Kaski. How Proofs are Next, augment each GI to a k(n)-vertex graph, denoted GI , Prepared at Camelot. In 35th ACM Symposium on Principles of Distributed Computing, pages 391–400, 2016. by possiblly adding k(n) −|VI | isolated vertices (and note t G G that the -cliques in I are exactly those in I ). Observe [8] Manuel Blum, Michael Luby, and Ronitt Rubinfeld. Self- that for each t-clique of G there exists a unique I (of size Testing/Correcting with Applications to Numerical Problems. at most t) such that this t-clique appears in GI but does Journal of Computer and System Science, Vol. 47 (3), pages not appear in any GI such that I ⊂ I. Letting NI denote 549–595, 1993. Preliminary version in 22nd STOC, 1990. the number of t-cliques that appear in GI but do not appear [9] Andrej Bogdanov and Luca Trevisan. On Worst-Case to in any GI such that I ⊂ I, it follows that the number of t G N Average-Case Reductions for NP Problems. SIAM Journal -cliques in equals i∈ t I∈ [m] I . Hence, on input [ ] ( i ) on Computing, Vol. 36 (4), pages 1119–1159, 2006. G =([n],E), the reduction proceeds as follows: I ∈ [m] [10] Jin-yi Cai, Aduri Pavan, and D. Sivakumar. On the Hardness 1) For each i∈[t] i , it queries for the number of Permanent. In 16th STACS, pages 90–99, 1999. of t-cliques in GI , denoting the result by rI . 2) It computes all NI based on the values obtained in [11] Cynthia Dwork and Moni Naor. Pricing via Processing or Step 1. Specifically, for i =1, ..., t, and for every I ∈ Combatting Junk Mail. In the proceedings of CRYPTO, pages [m] 139–147, 1992. i , it sets NI ← rI − I ⊂I NI , where N∅ =0. The reduction outputs the sum of all the NI ’s. Observing [12] Joan Feigenbaum and Lance Fortnow. Random-Self- m [1] Amir Abboud, Kevin Lewi, and Ryan Williams. Losing [17] Oded Goldreich and Guy N. Rothblum. Worst-case to Weight by Gaining Edges. In 22nd ESA, pages 1–12, 2014 Average-case reductions for subclasses of P. ECCC TR17- 130, 2017. 1 [2] Miklos Ajtai. Σ1-formulae on finite structures. Ann. Pure Appl. Logic, Vol. 24 (1), pages 1–48, 1983. [18] Oded Goldreich and Guy N. Rothblum. Counting t-cliques: Worst-case to average-case reductions and Direct interactive [3] Laszlo Babai. Random oracles separate PSPACE from the proof systems. ECCC, TR18-046, 2018. Polynomial-Time Hierarchy. IPL, Vol. 26, pages 51–53, 1987. [19] Oded Goldreich and Avi Wigderson. Derandomization that is [4] Laszlo Babai, Lance Fortnow, Noam Nisan, and Avi Wigder- rarely wrong from short advice that is typically good. ECCC, son. BPP has Subexponential Time Simulations unless TR02-039, 2002. EXPTIME has Publishable Proofs. Complexity Theory, Vol. 3, pages 307–318, 1993. [20] Shafi Goldwasser, Yael Tauman Kalai, and Guy N. Rothblum. Delegating Computation: Interactive Proofs for Muggles. [5] Marshall Ball, Alon Rosen, Manuel Sabin and Prashant Nalini Journal of the ACM, Vol. 62(4), Art. 27:1-27:64, 2015. Vasudevan. Average-case fine-grained hardness. In 49th ACM Extended abstract in 40th STOC, pages 113–122, 2008. Symposium on the Theory of Computing, pages 483–496, 2017. [21] Shafi Goldwasser, Silvio Micali, and Charles Rackoff. The Knowledge Complexity of Interactive Proof Systems. SIAM [6] Marshall Ball, Alon Rosen, Manuel Sabin and Prashant Nalini Journal on Computing, Vol. 18, pages 186–208, 1989. Pre- Vasudevan. Proofs of Useful Work. IACR Cryptology ePrint liminary version in 17th STOC, 1985. Earlier versions date Archive, Report 2017/203, 2017. to 1982. 87 [22] Russell Impagliazzo and Avi Wigderson. Randomness vs Time: Derandomization under a Uniform Assumption. Jour- nal of Computer and System Science, Vol. 63 (4), pages 672– 688, 2001. [23] Richard J. Lipton. New directions in testing. Distributed Computing and Cryptography, J. Feigenbaum and M. Merritt (ed.), DIMACS Series in Discrete Mathematics and Theoreti- cal Computer Science, American Mathematics Society, Vol. 2, pages 191–202, 1991. [24] Carsten Lund, Lance Fortnow, Howard Karloff, and Noam Nisan. Algebraic methods for interactive proof systems. Journal of the ACM, Vol. 39, No. 4, pages 859–868, 1992. Extended abstract in 31st FOCS, 1990. [25] Or Meir. IP = PSPACE Using Error-Correcting Codes. SIAM Journal on Computing, Vol. 42 (1), pages 380–403, 2013. [26] Omer Reingold, Guy N. Rothblum, Ron D. Rothblum. Constant-round interactive proofs for delegating computation. In 48th ACM Symposium on the Theory of Computing, pages 49–62, 2016. [27] Adi Shamir. IP = PSPACE. Journal of the ACM, Vol. 39, No. 4, pages 869–877, 1992. Preliminary version in 31st FOCS, 1990. [28] Justin Thaler. Semi-Streaming Algorithms for Annotated Graph Streams. In 43rd International Colloquium on Au- tomata, Languages, and Programming, pages 59:1–59:14, 2016. [29] Madhu Sudan, Luca Trevisan, and Salil P. Vadhan. Pseu- dorandom Generators without the XOR Lemma. Journal of Computer and System Science, Vol. 62 (2), pages 236–266, 2001. [30] Leslie G. Valiant. The Complexity of Computing the Perma- nent. Theoretical Computer Science, Vol. 8, pages 189–201, 1979. [31] Virginia Vassilevska Williams. Hardness of Easy Problems: Basing Hardness on Popular Conjectures such as the Strong Exponential Time Hypothesis. In 10th International Sympo- sium on Parameterized and Exact Computation, pages 17–29, 2015. [32] Ryan Williams. Strong ETH Breaks With Merlin and Arthur: Short Non-Interactive Proofs of Batch Evaluation. In 31st Conference on Computational Complexity, pages 2:1–2:17, 2016. 88