Relationship to other classes

CS151 Question: is #P hard because it entails Complexity Theory finding NP witnesses? Lecture 13 …or is counting difficult by itself? May 11, 2021

May 11, 2021 CS151 Lecture 13

Bipartite Matchings Bipartite Matchings

• Definition: • Definition: – G = (U, V, E) bipartite graph with |U| = |V| – G = (U, V, E) bipartite graph with |U| = |V| – a perfect matching in G is a subset M ⊆ E – a perfect matching in G is a subset M ⊆ E that touches every node, and no two edges in that touches every node, and no two edges in M share an endpoint M share an endpoint

May 11, 2021 CS151 Lecture 13 May 11, 2021 CS151 Lecture 13

Bipartite Matchings Cycle Covers

• #MATCHING: given a bipartite graph • Claim: 1-1 correspondence between cycle G = (U, V, E) how many perfect covers in G’ and perfect matchings in G matchings does it have? – #MATCHING and #CYCLE-COVER parsimoniously reducible to each other 2 Theorem: #MATCHING is #P-complete. 1 2 3 4 5 3 • But… can find a perfect matching in 1 polynomial time! 4 – counting itself must be difficult 1 2 3 4 5 5 G = (U, V, E) G’ = (V, E’)

May 11, 2021 CS151 Lecture 13 May 11, 2021 CS151 Lecture 13

1 Cycle Covers Cycle Cover is #P-complete

• cycle cover: collection of node-disjoint • variable gadget: every cycle cover directed cycles that touch every node includes left cycle or right cycle

• #CYCLE-COVER: given directed graph G xi ¬xi •clause gadget: cycle = (V, E) how many cycle covers does it cover cannot use all three have? outer edges – and each of 7 ways to Theorem: #CYCLE-COVER is #P-complete. exclude at least one gives – implies #MATCHING is #P-complete exactly 1 cover using those external edges May 11, 2021 CS151 Lecture 13 May 11, 2021 CS151 Lecture 13

Cycle Cover is #P-complete Cycle Cover is #P-complete

May 11, 2021 CS151 Lecture 13 May 11, 2021 CS151 Lecture 13

Cycle Cover is #P-complete Cycle Cover is #P-complete

• clause gadget corresponding to (A∨B∨C) • Proof outline (reduce from #SAT)

has “xor” gadget between outer 3 edges (¬x1∨x2∨ ¬x3)∧(¬x3∨x1)∧ … ∧(x3∨ ¬ x2) and A, B, C xor gadgets ¬A B ¬B clause A (exactly 1 of . . . u v two edges is in gadgets xor cover) v’ u’ x 1 ¬x1 x2 ¬x ¬x xor gadget ensures that 2 x3 3 exactly one of two C ¬C N.B. must avoid reducing variable gadgets edges can be in cover SAT to MATCHING!

May 11, 2021 CS151 Lecture 13 May 11, 2021 CS151 Lecture 13

2 Cycle Cover is #P-complete Cycle Cover is #P-complete

• Introduce edge weights • Weighted xor gadget: N-1 – cycle cover weight is product of weights of its u v u v edges xor N-1 v’ u’ v’ 2 u’ • “implement” xor gadget by N-1 3 – weight of cycle cover that “obeys” xor (unlabeled weights are 1) multiplied by 4 (mod N) – weight of cycle cover that “obeys” xor – weight of cycle cover that “violates” xor multiplied by 4 (mod N) multiplied by N – weight of cycle cover that “violates” xor large integer multiplied by N

May 11, 2021 CS151 Lecture 13 May 11, 2021 CS151 Lecture 13

Cycle Cover is #P-complete Cycle Cover is #P-complete

• Simulating positive edge weights (¬x1∨x2∨ ¬x3)∧(¬x3∨x1)∧ … ∧(x3∨ ¬ x2) – need to handle 2, 3, 4, 5, …, N-1 xor gadget (exactly 1 of . . . clause two edges is in gadget 2 cover)

2k x variable gadgets: 1 ¬x1 x2 ¬x ¬x k times 2 x3 3

3 – m = # xor gadgets; n = # variables; N > 4m2n – # covers (mod N) = (4m)⋅(#sat. assignments)

May 11, 2021 CS151 Lecture 13 May 11, 2021 CS151 Lecture 13

New Topic Proof systems

• proof systems L = { (A, 1k) : A is a true mathematical assertion with a proof of length k} • interactive proofs and their power

What is a “proof”? • Arthur-Merlin games

complexity insight: meaningless unless can be efficiently verified

May 11, 2021 CS151 Lecture 13 May 11, 2021 CS151 Lecture 13

3 Proof systems Classical Proofs

• given language L, goal is to prove x ∈ L • previous definition: “classical” proof system • proof system for L is a verification algorithm V • recall: – completeness: x ∈ L ⇒ ∃ proof, V accepts (x, proof) “true assertions have proofs” L ∈ NP iff expressible as – soundness: x ∉ L ⇒ ∀ proof*, V rejects (x, proof*) L = { x | ∃y, |y| < |x|k, (x, y) ∈ R } and R ∈ P. “false assertions have no proofs” • NP is the set of languages with classical – efficiency: ∀ x, proof: V(x, proof) runs in polynomial time in |x| proof systems (R is the verifier)

May 11, 2021 CS151 Lecture 13 May 11, 2021 CS151 Lecture 13

Interactive Proofs Interactive Proofs

• Two new ingredients: • interactive proof system for L is an – randomness: verifier tosses coins, errs with interactive protocol (P, V) some small probability common input: x – interaction: rather than “reading” proof, Prover Verifier verifier interacts with computationally unbounded prover . . # rounds = • NP proof systems lie in this framework: prover . poly(|x|) sends proof, verifier does not use randomness accept/ reject May 11, 2021 CS151 Lecture 13 May 11, 2021 CS151 Lecture 13

Interactive Proofs Interactive Proofs

• interactive proof system for L is an IP = {L : L has an interactive proof interactive protocol (P, V) system} – completeness: x ∈ L ⇒ • Observations/questions: Pr[V accepts in (P, V)(x)] ≥ 2/3 – philosophically interesting: captures more – soundness: x ∉ L ⇒ ∀ P* broadly what it means to be convinced a statement is true Pr[V accepts in (P*, V)(x)] ≤ 1/3 – clearly NP ⊆ IP. Potentially larger. How much – efficiency: V is p.p.t. machine larger? • repetition: can reduce error to any ε – if larger, randomness is essential (why?)

May 11, 2021 CS151 Lecture 13 May 11, 2021 CS151 Lecture 13

4 Graph Isomorphism Graph Isomorphism

• graphs G0 = (V, E0) and G1 = (V, E1) are • GI = {(G0, G1) : G0 ≃ G1 } isomorphic (G0 ≃ G1) if exists a – in NP permutation π:V → V for which – not known to be in P, or NP-complete

(x, y) ∈ E0 ⇔ (π(x), π(y)) ∈ E1 • GNI = complement of GI

1 1 – not known to be in NP 1 4 2 3 Theorem (GMW): GNI ∈ IP 3 4 2 3 – indication IP may be more powerful than NP 2 4

May 11, 2021 CS151 Lecture 13 May 11, 2021 CS151 Lecture 13

GNI in IP GNI in IP

• interactive proof system for GNI: • completeness:

– if G0 not isomorphic to G1 then H is input: (G0, G1) isomorphic to exactly one of (G , G ) Prover Verifier 0 1 – prover will choose correct r H = π(Gc) flip coin ∈ if H ≃G0 c {0,1}; • soundness: pick r = 0, – if G ≃ G then prover sees same distribution else r = 1 r random π 0 1 accept on H for c = 0, c = 1 iff r = c – no information on c ⇒ any prover P* can succeed with probability at most 1/2

May 11, 2021 CS151 Lecture 13 May 11, 2021 CS151 Lecture 13

The power of IP The power of IP

• We showed GNI ∈ IP • Proof idea: input: φ(x1, x2, …, xn) – prover: “I claim φ has k satisfying assignments” • GNI ∈ IP suggests IP more powerful than – true iff

NP, since we don’t know how to show GNI • φ(0, x2, …, xn) has k0 satisfying assignments in NP • φ(1, x2, …, xn) has k1 satisfying assignments • k = k0 + k1

• GNI in coNP – prover sends k0, k1 – verifier sends random c ∈ {0,1}

– prover recursively proves “φ’ = φ(c, x2, …, xn) has kc Theorem (LFKN): coNP ⊆ IP satisfying assignments” – at end, verifier can check for itself.

May 11, 2021 CS151 Lecture 13 May 11, 2021 CS151 Lecture 13

5 The power of IP The power of IP

• Analysis of proof idea: • Solution to problem (ideas): – replace {0,1}n with (F )n – Completeness: φ(x1, x2, …, xn) has k q satisfying assignments ⇒ accept with prob. 1 – verifier substitutes random field element at – Soundness: φ(x1, x2, …, xn) does not have k each step satisfying assigns. ⇒ accept prob. ≤ 1 – 2-n – vast majority of field elements catch cheating prover (rather than just 1) – Why? It is possible that k is only off by one; verifier only catches prover if coin flips c are Theorem: L = { (φ, k): CNF φ has exactly k successive bits of this assignment satisfying assignments} is in IP

May 11, 2021 CS151 Lecture 13 May 11, 2021 CS151 Lecture 13

The power of IP The power of IP • Prover wishes to prove: • First step: arithmetization … k = Σx Σx Σx p (x , x , …, x ) – transform φ(x , … x ) into polynomial p (x , x , … x ) 1 = 0, 1 2 = 0,1 n = 0, 1 φ 1 2 n 1 n φ 1 2 n … n • Define: kz = Σx = 0,1 Σx = 0, 1pφ(z, x2, …, xn) of degree d over a field Fq; q prime > 2 2 n – recursively: • prover sends: kz for all z ∈ Fq

• xi → xi ¬φ → (1 - pφ) • verifier: ’ • φ ∧ φ → (pφ)(pφ’) – checks that k0 + k1 = k ’ • φ ∨ φ → 1 - (1 - pφ)(1 - pφ’) – sends random z ∈ Fq n – for all x ∈ {0,1} we have pφ(x) = φ(x) • continue with proof that – degree d ≤ |φ| … kz = Σx2 = 0,1 Σxn = 0, 1pφ(z, x2, …, xn) – can compute pφ(x) in poly time from φ and x • at end: verifier checks for itself

May 11, 2021 CS151 Lecture 13 May 11, 2021 CS151 Lecture 13

The power of IP The actual protocol input: (φ, k) Prover Verifier • Prover wishes to prove: p1(x) p1(0)+p1(1)=k? … p1(x) = Σx …,x ∈{0,1} pφ(x, x2, …, xn) k = Σx Σx Σx p (x , x , …, x ) 2, n z1 1 = 0, 1 2 = 0,1 n = 0, 1 φ 1 2 n pick random z1 in Fq … p (x) = Σx x ∈ p (z , x, x , …, x ) • Define: k = Σx Σx p (z, x , …, x ) 2 3,…, n {0,1} φ 1 3 n z 2 = 0,1 n = 0, 1 φ 2 n p (0)+p (1)=p (z )? p2(x) 2 2 1 1 z 2 pick random z2 in Fq p3(x) = Σx …,x ∈ {0,1} pφ(z1, z2, x, x4 …, xn) • a problem: can’t send kz for all z ∈ Fq 4, n p3(x) p3(0)+p3(1)=p2(z2)? . • solution: send the polynomial ! pick random z3 in Fq . p (x) – recall degree d ≤ |φ| n pn(0)+pn(1)=pn-1(zn-1)? pick random zn in Fq pn(zn) = pφ(z1, z2, …, zn)? May 11, 2021 CS151 Lecture 13 May 11, 2021 CS151 Lecture 13

6