Interactive Proof Systems∗

Home , LH (complexity), PSPACE, RE (complexity)

Interactive proof systems∗

Imagine we want to know whether a theorem is true or not. A clever person, which we call a prover, might tell us a proof of the theorem and if it is not too long or complicated, we can be convinced in a short time. If the theorem is false, then we assume that no proof can convince us. Now, assume that no short proof exists. Is it still possible to be convinced that a theorem is true? Imagine a PhD student claims to have proven a difficult theorem and wants to defend his thesis. Unfortunately, the professors in the committee have only a few days time to study the manuscript, and can impossibly learn about all the necessarily background from the references to check all details. Still, the people in the committee must figure out whether the theorem is true or not. The student and the committee will participate in a discussion. Members of the committee might ask for generalizations of some claims in the proof. Then they consider special cases of these generalizations, and then ask again about new generalizations of these special cases and so on. If the student can give logically sound answers, it is likely the committee will grant the student his PhD degree. In computational complexity, the class NP contains all sets whose elements allow for short “proofs” of set membership. Elements outside the set have no such proofs. For example, it is not known how to make short proofs that Boolean formulas are unsatisfiable. The goal of this section is to define the class IP of sets for which a randomized dialogue can convince a verifier that an element belongs to the set. If the element does not belong to the set, then it should be unlikely that the verifier can be convinced by such a dialogue. We show that this class coincides with PSPACE. Hence, it is believed to be much larger than NP. In these notes, the proof that PSPACE ⊂ IP is presented in a slightly different way than in Sipser’s book. I provide detailed inductive statements of for the main lemmas and use an approach that is a bit more technical, but conceptually easier.

1 Example: graph non-isomorphism

To illustrate the power of randomized dialogues, consider the following story about a blind man who has two socks and to whom is told that they are of different colour, say blue and red. The blind man does not believe the seeing people, but is willing to do a test. How can he test that his socks are different? He proceeds as follows: First, he hides both socks. Then he randomly selects one of them, shows it to a person and asks him whether it is blue or red. He repeats this experiment several times and if this person gives consistent answers, i.e., always call the same sock red and the other blue, he concludes his socks are somehow different or some rare event has occurred. Otherwise, he concludes that either the person is not honest, or the socks are indistinguishable.

∗First version 7 March Update 8 March: renamed PCP to IPPC.

1 b c b c

a d a d

Figure 1: Two isomorphic graphs. The bijection f maps a, b, c, d to a, d, c, b.

A similar strategy exists to determine whether two graphs are not isomorphic. A graph G = (V,E) is represented as a set V of vertices and a set E ⊂ V × V of edges. Informally, two graphs are isomorphic if they are equal after renaming the vertices. More formally, A bijection from V to W is a function f : V → W for which for each w ∈ W there is exactly one v ∈ V such that f(v) = w. If there exists a bijection from V to W , then |V | = |W |. Two graphs G = (V,E) and H = (W, F ) are isomorphic if there exists a bijection f : V → W such that (a, b) ∈ E ⊂ V × V if and only if (f(a), f(b)) ∈ F ⊂ W × W , see ﬁgure 1 for an example. Let

ISO = {hG, Hi : G and H are isomorphic graphs} .

ISO is in NP, because a bijection provides a certificate. Extensive research has so far failed to demonstrate that ISO is in P or NP-complete.1 Here, we consider the complement of this language NONISO = {hG, Hi : G and H are not ismorphic graphs}. It is unknown whether this language is in NP, i.e., nobody knows how to make short certificates that imply graphs are not isomorphic. However, with a dialogue a prover can convince a verifier that two graphs are not isomorphic. Assume G1 and G2 have the same sets of vertices V . The verifier randomly selects either G1 or G2. Then he randomly reorders the vertices of the graph. The verifier sends this graph H to the prover, and the prover must identify whether H came from G1 or G2. If G1 and G2 are not isomorphic, then the prover can figure out from which graph H was generated. Otherwise, he can not do better than guessing with 1/2 chance of success, see exercise 1 for the formal details.

Exercise 1. Let BV →W be the set of all bijections from a set V to a set W . For f ∈ BV →W and for g ∈ BW →X , let f ◦ g be the function that maps v ∈ V to f(g(v)) ∈ X. Show that for any f ∈ BV →W we have BV →X = {f ◦ g : g ∈ BW →X }. Let f[G] represent the graph G after renaming the vertices V using a bijection f ∈ BV →W . Suppose that there exists a bijection f such that f[G1] = G2. Show that for all graphs H: Probg(g[G1] = H) = Probg(g[G2] = H), where all functions g ∈ BV →V are selected uniformly, i.e., with probability 1/|BV →V |.

2 Deﬁnition

An interactive proof system is a pair (P,V ) where P is called the prover and V is called the veriﬁer. The veriﬁer is a Turing machine with a private work tape and a tape that contains randomly generated bits. He interacts with the prover through a separate communication

1Recently it L. Babai invented a proof that ISO can be decided in quasi polynomial time, i.e., ISO ∈ k TIME(2log n).

2 P any function

⇐ x t m1 t m2 t t t ... communication tape

1 1 0 0 1 0 ... private randomness V 0 1 1 0 t t ... private work tape

Figure 2: Definition of an interactive proof system tape, see figure 2. On input x ∈ Σ∗, this interaction happens as follows: Initially, the communication tape contains x. The verifier reads the contents of the communication tape, ∗ makes a computation and writes a message m1 ∈ Σ . When he halts, the prover reads the communication tape and writes a message m2 on the tape. Then the verifier reads the tape, computes and writes m3, and so on. The process terminates if the verifier arrives either in an accept or a reject state. Messages are separated with blank symbols t 6∈ Σ.

Deﬁnition 1. For a function t : N → N and a proof system (P,V ), the statement

(Vt ↔ P )(x, r) = accept. means that if the process is started with x on the communication tape, and a sequence r on the verifier’s private randomness tape, then the verifier terminates in an accept state and in the total interaction the verifier executed at most t(|x|) computation steps, When r is generated uniformly, the probability that a proof system accepts x in time t is written as Prob (Vt ↔ P ) accepts x = Probr (Vt ↔ P )(x, r) = accept .

Deﬁnition 2. A set A is in IP if there exists a veriﬁer V , a prover P , and a polynomial p such that: • If x ∈ A, then Prob (Vp ↔ P ) accepts x ≥ 2/3,

0 0 • If x 6∈ A, then for every prover P , Prob (Vp ↔ P ) accepts x ≤ 1/3.

Observe that BPP ⊂ IP and NP ⊂ IP. For similar reasons as in the deﬁnition of BPP, the class IP does not change if we replace the constants 2/3 and 1/3 by any ε and ε0 < ε. The class also does not change, if we replace these constants by 1 − 2−q(|x|) and 2−q(|x|) for any polynomial q. In the proof of IP ⊂ PSPACE, we also use the class called “IP with Perfect Com- pleteness”, which we will denote as IPPC. In this class, the prover P should accept with probability one if x ∈ A.

Deﬁnition 3. A set A is in IPPC if there exists a veriﬁer V , a prover P , and a polynomial t such that:

3 • If x ∈ A, then Prob (Vt ↔ P ) accepts x = 1,

0 0 • If x 6∈ A, then for every prover P , Prob (Vt ↔ P ) accepts x ≤ 1/2.

Note that IPPC ⊂ IP, and we will see that the proof of IP = PSPACE also implies IP = IPPC.

Exercise 2. Suppose that in the deﬁnition of IP the veriﬁer is deterministic (i.e., has no access to random bits). Show that this class equals NP.

Exercise 3. Let A ⊂ N be a set such that both A and its complement N \ A are in IP. Show that P A ⊂ IP. What about NPA?

Exercise 4. In this definition, we can assume that the verifier always reaches either an accepting or a rejecting state after at most t(|x|) computation steps. Suppose we want to show that the complement of a set in IP is also in IP. Why is it not enough to convert all accepting states in the verifier to rejecting ones and vice versa? (Note that the result IP = PSPACE implies that IP is closed under complement, but no short direct proof seems to be known.)

3 IP ⊂ PSPACE

Proof that IP ⊂ PSPACE. Let A be a language in IP and let V be the verifier in the definition of IP. To determine whether x ∈ A, it suffices to know the maximal probability with which some prover can make the verifier accept: this probability exceeds 2/3 if x ∈ A and otherwise it is at most 1/3. Hence, we only need to make an algorithm that on input x runs in polynomial space in |x| and computes this probability. Let t be the polynomial time bound for V . We assume that the verifier always terminates in time t(|x|). Fix an input x. Consider all dialogues that can appear on the communication tape for all possible reactions of the verifier (depending on r) and all provers. Represent these dialogues in a tree. This is illustrated in figure 3 for a bitwise dialogue. Every prover defines a subtree in this tree. The subtree of one such prover is represented in red. To represent the probability that a prover makes the verifier accept in this tree, we add a leaf for every string r of length t(|x|) on the random tape that makes the verifier accept. Note that the verifier can read at most t(|x|) bits on the tape with random bits. We call these leaves accepting leaves and in the figure they are labelled with a red +. By construction, the probability that this prover makes the verifier accept equals the number of such accepting leaves divided by 2t(|x|). In the example of the figure, there are 6 accepting leaves for the strategy in red. Before we considered leaves associated to a specific prover, but we can add accepting leaves for all provers. We denote them with + in the figure. The probability that any prover P will make the verifier accept equals the number of leaves in the subtree corresponding to P divided by 2t(|x|). Now it is easy to construct an optimal prover by induction. We assign a value 1 to every accepting leaf. At each level in the tree that corresponds to a message from the verifier, the value of the nodes equal the sum of the values of the children. At each level corresponding to a message from the prover, the values of the nodes is the maximum of the children’s values. By induction one shows that the root value of the tree equals the maximal number of leaves of

4 6

V : m1 3 3 P : m2 3 2 2 3 V : m3 2 1 1 1 2 0 3 0 P : m4 0 2 1 0 0 1 1 1 1 2 0 0 3 1 0 0 V accepts?

++ + + + + + + + + + + +

Figure 3: Tree of possible dialogues for a fixed verifier and a fixed input x. Every prover defines a subtree in this tree. The reactions of one such prover is given in red. The number of accepting leaves below each node in an optimal strategy is given in blue. Note that the prover’s reactions in red results in a maximal probability of acceptance of 6/8 when strings r of length 3 are used. a subtree corresponding to a prover. This number determines the maximal probability with which a verifier can accept x. In the figure, these numbers are represented in blue for a tree where leaves appear at a constant depth. In general, this depth need not to be constant. It remains to note that we can determine the value of the root in polynomial space. Although the tree is exponentially large, we can compute the value at the root while traversing the tree in a depth-first way. We only need to store the values in all nodes of the current branch, and each such value is bounded by 2t(|x|). Hence, the algorithm uses space O(t(|x|)2).

Exercise* 5. Assume that in the proof above both the veriﬁer and the prover send 1bit messages. Show that it is possible to decide whether x ∈ A in space O(t(|x|))3/2 by observing that one does only need to know the label at the root with relative error 1/4. (Hint: after taking the maximum of two numbers, the relative error does not increase. What is the problem with the levels in which an addition happens?)

4 coNP ⊂ IP

Recall the deﬁnition of IPPC given below the deﬁnition of IP. IPPC is a subset of IP and in the next section we will show that PSPACE ⊂ IPPC. This implies that IP = IPPC. We start with an easier result with a simpler proof that uses similar ideas. We already know that NP ⊂ IPPC. The class of complements of sets in NP is called coNP.

Proposition 4. coNP ⊂ IPPC.

We use the technique of arithmetization. We already used this technique when we showed that one can decide the equivalence of two read once branching programs in polynomial time. We will encode polynomials only with multiplications and additions and do not use powers, for example: (x + y) ∗ (x ∗ x + 1). In the proof of the proposition we use the following.

5 Corollary 5. The following set is in IPPC: n hp, ki : p is a polynomial with m variables, X X X o and ··· p(x1, x2, . . . , xm) = k . x1 x2 xm Proof of Proposition 4. The set of Boolean formula that have no satisfying assignments, i.e.,

UNSAT = {hφi : φ is an unsatisﬁable Boolean formula}

is coNP-complete. It suﬃces to prove that this set is in IPPC. We convert a Boolean formula to a polynomial such that if the formula is true for some values of the variables, then the polynomial is one, and otherwise the polynomial is zero. This is done as follows: x ∧ y → xy x ∨ y → x + y − xy x → 1 − x. Let p be the polynomial obtained from a Boolean formula φ. Note that φ is unsatisﬁable if and only if X X 0 = ··· p(x1, . . . , xm).

x1=0,1 xm=0,1 Now, the result follows from Corollary 5 with k = 0.

Corollary 5 follows from Lemma 6. First we give some more deﬁnitions. Let `p be one plus the number of additions and multiplications needed to evaluate a polynomial p. Note that `p is at most the degree of the polynomial (this is why we add one). Let SUM -POLY ={hp, k, qi : p is a polynomial with m variables, q is prime, X X X and ··· p(x1, x2, . . . , xm) ≡ k mod q}. x1 x2 xm Lemma 6. There exists an interactive proof system (P,V ) and a polynomial t, such that • If the input belongs to SUM -POLY , then (P ↔ V ) always accepts.

• For any input outside SUM -POLY and any other prover P 0, (P ↔ V ) accepts with probability at most m`p/q.

0 • For any prover P and any input, V makes at most (m+1)t(log q, `p) computation steps. To prove the corollary using this lemma, we use that PRIMES ∈ NP, and that for every n there is a prime between n and 2n. The result that PRIMES ∈ NP will not be needed in the proof of PSPACE ⊂ IPPC.

Exercise 6. Prove Corollary 5 using Lemma 6 and the two results stated above.

Exercise 7. The corollary can also be proven in a diﬀerent way. On input hp, ki, let the veriﬁer choose a random prime number q and then use an interactive proof from Lemma 6 on input hp, k, qi ∈ SUM -POLY . For this, one needs to that there are many small primes. For example, one may use that the nth prime number is at most O(n log n). Why is this needed?

6 Proof of Lemma 6. The lemma is proven by induction on the number m of variables in p. If m = 0, then p evaluates to a constant and the veriﬁer can directly check whether this constant equals k modulo q. This requires time t(log q, `p). Otherwise, the prover and the veriﬁer operate as follows:

d P : Sends a polynomial f(X) in the form a0 +a1X +···+adX with coeﬃcients in [0, q −1], such that X X f(X) ≡ ··· p(X, x2, . . . , xm) mod q. x2 xm

Note that the degree d of the polynomial is at most `p. V : Veriﬁes that k ≡ f(0) + f(1) mod q and rejects if this is false. Otherwise, he sends a random number r ∈ [0, q − 1].

V,P : Use the induction hypothesis to verify that f(r) ≡ P ··· P p(r, x , . . . , x ) mod q, x2 xm 2 m i.e., whether (p(r, ·,..., ·), f(r), q) ∈ SUM -POLY .

In the recursive call in the third step, the number of variables m, decreases by one. The number `p and q remain the same. Hence, the total computation time needed for the verifier is bounded by t(log q, `p) + (m − 1 + 1) t(log q, `p) = (m + 1) t(log q, `p) for some sufficiently large polynomial t. Hence, the last condition of the lemma is satisfied. It is easy to verify that the prover accepts any element hp, k, qi ∈ SUM -POLY . It remains to show the second condition of the lemma. We show by induction on m that if P ··· P p(x , . . . , x ) 6≡ k mod q, the probability of acceptance is at most m` /q. If x1 xm 1 m p m = 0, the verifier will never accept. If m ≥ 1, then in the first step the prover must send a wrong polynomial f˜, otherwise the verifier rejects in the second step. But even with a wrong polynomial, the verifier might accept: it might happen that in the point r we have f˜(r) = f(r). Because the degree of the polynomial is at most `p, such an error happens with probability at most `p/q; indeed, a polynomial of degree d over a field of of size q has at most d zeros, and d ≤ `p. Even if f˜(r) 6= f(r), it is possible that the verifier accepts, because the verifier might accept by error during the inductive call. The probability of such an error is at most (m − 1)`p/q by the induction hypothesis. The total probability is at most `p/q + (m − 1)`p/q = m`p/q. The verifier and the prover satisfy all conditions of the lemma.

Exercise 8. What is the problem with the following protocol to prove Lemma 6? d P : Sends a polynomial f(X) in the form a0 +a1X +···+adX with coeﬃcients in [0, q −1], such that X X f(X) ≡ ··· p(X, x2, . . . , xm) mod q. x2 xm

Note that the degree d of the polynomial is at most `p. V : Veriﬁes that k ≡ f(0) + f(1) mod q and rejects if this is false. Otherwise, he sends a random number r ∈ [0, q − 1].

V,P : Use the induction hypothesis to verify that f(0) and f(1) are correct, i.e., that f(i) ≡ P ··· P p(i, x , . . . , x ) mod q for i ∈ {0, 1}. x2 xm 2 m

7 5 PSPACE ⊂ IP

Theorem 7. PSPACE ⊂ IPPC. In Chapter 8, we learned that the set TQBF of true quantified Boolean formula is PSPACE-complete. Before, we gave an interactive protocol to check whether formulas φ are satisfiable, i.e., whether ∃x1∃x2 ... ∃xmφ(x1, . . . , xm) is true. To do this, we replaced φ P by a polynomial and quantifiers ∃x by x. Now, it seems natural to replace ∀x quantifiers Q by x. Unfortunately, this creates a problem in the proof above. Taking products rather than sums increases the degree of the polynomial that needs to be send by the prover. For example, in the protocol for a formula ∀x1∀x2 ... ∀xm(φ(x1, . . . , xm)) one needs to send a polynomial Y Y f(X) ≡ ··· p(X, x2, . . . , xm) mod q. x2 xm This polynomial can have degree 2(2m−1). Such polynomials create two problems: First, they are too large for the polynomial time verifier. Secondly, polynomials of large degree over the field q can have too many zero’s and the verifier might accept wrong polynomials with too large probability. We can decrease the degree of the polynomial using Fermat’s little theorem.

Theorem 8 (Fremat). If b is no multiple of a prime number p, then bq−1 ≡ 1 mod q.

This implies that the values of a polynomial modulo q does not change if we replace factors Xq by X. Hence, any polynomial can be represented by an equivalent polynomial modulo q with size polynomial in q. Unfortunately, polynomials of degree q − 1 can still have q − 1 zeros, so sampling a random q will detect an error with probability only 1/q. To keep the degree small, we consider only quantified Boolean formula that satisfy some special condition, which we formulate now. The scope of a quantifier ∀x or ∃x in a quantified formula, is the subformula that starts with the quantifier of the variable, for example, in ∃z ∀x (∃y B(x, y)) ∨ C(z, x) ∧ D(z) the scope of ∀x is (∃y B(x, y)) ∨ C(z, x).

Definition 9. For any c, a quantified Boolean formula has c-shallow scopes if within the scope of each quantifier, at each position in which the quantified variable appears, it is in the scope of at most c other quantifiers.

Assume that B, C and D are Boolean formulas (without quantifiers). The formula above has 1-shallow scopes. Indeed, within the scope of ∀x, the variable x appears in two places: first it appears in B(x, y) which is only in the scope of the variable ∃y, and the second time it appears outside any scope. Within the scope of ∃z, this variable appears in C(z, x) where it is only in the scope of x, and in D(z), where it is free. However, the formula ∃z ∀x (∃y B(x, y, z)) ∨ C(z, x) ∧ D(z) does not have 1-shallow scopes: within the scope of ∃z, this variable appears in B(x, y, z), and this is in the scope of both ∀x and ∃y. Let TQBFc be the set of true quantified Boolean formula that have c-shallow scopes.

8 Exercise 9. Show that TQBF6 is PSPACE-complete.

To show that TQBFc is in IPPC for any k, we formulate a more general form of Lemma 6. We consider formulas deﬁned by the operations addition (+), multiplication (∗), product over Q P a variable x ( x), and a special type of sum over x (fx). For such a formula F , let `F denote one plus the number of these operations. We consider formula without free variables and each such formula evaluates to a natural number. The operations +, ∗, have their natural Q P interpretation. x B(x) evaluates to B(0)B(1) and fxB(x) evaluates to B(0) + B(1) − B(0)B(1). Let SUM -PROD-POLYc be the set of hF, k, qi for which P Q • F is a formula such that within the scope of each fx and x operation, in each place the variable x appears, it is in the scope of at most c other such operations. (For such F , we also say that F has c-shallow scopes.)

• F evaluates to a number which equals k modulo q.

Lemma 6 is now adapted to show that there is a proof system for SUM -PROD-POLYc.

Corollary 10. For every c, the following set is in IPPC: n o hF, ki : the formula F has c-shallow scopes and evaluates to k .

Proof of Theorem 7. We convert a quantiﬁed Boolean formula φ to a formula F as follows:

x ∧ y → xy x ∨ y → x + y − xy x → 1 − x P ∃x (B(x)) → fxB(x) Q ∀x (B(x)) → x B(x). Note that φ is unsatisﬁable if and only if F evaluates to 0. Also note that if φ has c-shallow scopes, then F has c-shallow scopes. The theorem follows directly from Corollary 10.

It remains to prove Corollary 10. It follows from Lemma 11 in the same way as before, also using that there is a prime between n and 2n, and that PRIMES ∈ NP.

2c Lemma 11. Fix any c and let LF = (`F ) . There exists an interactive proof system (P,V ) and a polynomial t, such that

• If the input belongs to SUM -PROD-POLYc, then (P ↔ V ) always accepts.

0 • For any input outside SUM -PROD-POLYc and any other prover P , (P ↔ V ) accepts 2 with probability at most LF /q.

0 • For any prover P and any input, V makes at most LF t(log q) computation steps.

Exercise 10. Show that we can prove Theorem 7 from Lemma 11 only using one additional assumption: for all n there exists a prime between n and 2n. (Hint, use that the formulas F in the proof of the theorem evaluate to zero or one.)

9 Proof. We prove the lemma by induction on the number `F of operations in the formula F . If P Q F contains no operations, i.e. no +, ∗, x and x, then F is a constant, `F = 1, and hence, LF = 1. Clearly this constant can be compared to k in time polynomial in LF t(log q) for Q P some polynomial t. Otherwise, F is either of the form G + H, G ∗ H, x G(x), or fxG(x). We describe the interactive proof system in these four cases. Cases G + H and G ∗ H. P : Sends the values g and h of the formulas G and H.

V : Checks whether the sum or the product of these values equals k. Rejects if this is not true.

P,V : Using induction, they check that hG, gi and hH, hi are in SUM -PROD-POLYc.

Q P Cases x G(x) and fxG(x). P : The prover sends a polynomial g(x) obtained by evaluating the formula G(x). He sends d it in the form a0 + a1x + . . . adx , with coeﬃcients in [0, q − 1]. V : Checks whether g(0)g(1) = k or g(0) + g(1) − g(0)g(1) = k, and rejects if this is false. Otherwise, he sends a random number r ∈ [0, q − 1].

P,V : Using induction, they check that hG(r), g(r)i ∈ SUM -PROD-POLYc.

We show that the computation time of the algorithm is bounded by a polynomial t(`F , log q). For the cases F = G + H and F = G ∗ H, we have `F = 1 + `G + `H . Hence, the total computation time is at most

LGt(log q) + LH t(log q) + poly in log q,

and this exceeds LF t(log q) for a sufficiently large polynomail t. For the other cases, we need to bound the size of the polynomial G(x). Because at every position where x appears in the formula, x is in the scope of at most c other operations Q P 2c or f. The degree of G is bounded by `G = LG. Hence, the computation time of the first two steps is LG times a polynomial in log q. Because `F = `G + 1, the computation time is bounded by LF t(log q). Now suppose that the value of F does not equal k modulo q. We need to bound the probability that the verifier accepts hF, k, qi for any prover. The argument is similar as before. The probability that that g(r) ≡ G(r) mod q for g 6≡ G mod k, is at most d/q = LG/q. The probability that the algorithm accepts after the inductive call if g 6≡ G mod q, is at most 2 LG /q. Because LG + 1 ≤ LF , we have that

2 2 LG/q + LG /q ≤ LF /q. P P Exercise* 11. Suppose we use formulas with ordinary sums x rather than fx. Show that there exists a formula that uses O(n) operations and evaluates to the product of the 2n smallest primes. Show that we can still prove Theorem 7 using Lemma 11. (Hint for the ﬁrst part: think about the Levin-Cook theorem. For the second part: use the technique from exercise 7.)

10 Exercise* 12. A black box contains a polynomial p with n variables of a degree that is bounded by a polynomial in n. On input x1, . . . , xn, this black box computes a polynomial over a ﬁeld of at least exponential size and outputs the result. Note that this polynomial might have an exponentially long description. A prover claims to have a list of observations from the black box, more precisely:

p(u1, . . . , un) = a

p(v1, . . . , vn) = b ...

p(z1, . . . , zn) = e.

He also claims to know p.A verifier wants to be convinced that the values a, b, . . . , e in the list are the same as the values given by the polynomial in the black box. Unfortunatley, he can only do one test with the box. Before the test, the prover and the verifier have a dialogue. The prover has unlimited computational power, the verifier should make at most polynomially many computation steps in the whole process (as in the definition of IP). How should the dialogue proceed and for which unique point should they test the black box to convince the verifier that a, b, . . . , e are correct?