Interactive Proofs Lecture 17 IP = PSPACE 1 So far 2 So far IP 2 So far IP AM, MA 2 So far IP AM, MA GNI ∈ IP 2 So far IP AM, MA GNI ∈ IP GNI ∈ AM 2 So far IP AM, MA GNI ∈ IP GNI ∈ AM Using AM protocol for set lower-bound 2 So far IP AM, MA GNI ∈ IP GNI ∈ AM Using AM protocol for set lower-bound In fact, IP[k] in AM[k+2] 2 IP = PSPACE 3 IP = PSPACE Recall, IP means IP[poly] 3 IP = PSPACE Recall, IP means IP[poly] IP ⊆ PSPACE 3 IP = PSPACE Recall, IP means IP[poly] IP ⊆ PSPACE Even though prover unbounded, cannot convince poly time verifier of everything 3 IP = PSPACE Recall, IP means IP[poly] IP ⊆ PSPACE Even though prover unbounded, cannot convince poly time verifier of everything PSPACE ⊆ IP 3 IP = PSPACE Recall, IP means IP[poly] IP ⊆ PSPACE Even though prover unbounded, cannot convince poly time verifier of everything PSPACE ⊆ IP Prover can convince verifier of high complexity statements 3 IP ⊆ PSPACE 4 IP ⊆ PSPACE Easier direction! 4 IP ⊆ PSPACE Easier direction! Plan: For given input calculate Pr[yes] of honest verifier, maximum over all “prover strategies” 4 IP ⊆ PSPACE Easier direction! Plan: For given input calculate Pr[yes] of honest verifier, maximum over all “prover strategies” Warm-up: public-coins (i.e., AM[poly]) 4 IP ⊆ PSPACE Easier direction! Plan: For given input calculate Pr[yes] of honest verifier, maximum over all “prover strategies” Warm-up: public-coins (i.e., AM[poly]) Could then use the “fact” that IP[poly]=AM[poly] 4 IP ⊆ PSPACE Easier direction! Plan: For given input calculate Pr[yes] of honest verifier, maximum over all “prover strategies” Warm-up: public-coins (i.e., AM[poly]) Could then use the “fact” that IP[poly]=AM[poly] Or modify the proof (as we’ll do) 4 AM[poly] ⊆ PSPACE 5 AM[poly] ⊆ PSPACE Plan: For given input calculate max Pr[yes] over all “prover strategies” 5 AM[poly] ⊆ PSPACE Plan: For given input calculate max Pr[yes] over all “prover strategies” Assume for convenience (w.l.o.g) each message is a single bit and P, V a lte r n ate 5 AM[poly] ⊆ PSPACE Plan: For given input calculate max Pr[yes] over all “prover strategies” Assume for convenience (w.l.o.g) each message is a single bit and P, V a lte r n ate Since public-coin, V messages are simply uniform random bits 5 AM[poly] ⊆ PSPACE Plan: For given input calculate max Pr[yes] over all “prover strategies” Assume for convenience (w.l.o.g) each message is a single bit and P, V a lte r n ate Since public-coin, V messages are simply uniform random bits Protocol’s configuration tree: path to a node corresponds to the transcript so far 5 AM[poly] ⊆ PSPACE V Plan: For given input calculate max Pr[yes] over all “prover strategies” Assume for convenience (w.l.o.g) P P each message is a single bit and P, V a lte r n ate V V V Since public-coin, V messages are simply uniform random bits Protocol’s configuration tree: path to a node corresponds to the transcript so far 5 AM[poly] ⊆ PSPACE V P P V V V 6 AM[poly] ⊆ PSPACE Plan: For given input calculate maximum value, over all “prover strategies,” of Pr[yes] V P P V V V 6 AM[poly] ⊆ PSPACE Plan: For given input calculate maximum value, over all “prover strategies,” of Pr[yes] V Note that finding the honest prover strategy may require super-PSPACE computation P P V V V 6 AM[poly] ⊆ PSPACE Plan: For given input calculate maximum value, over all “prover strategies,” of Pr[yes] V Note that finding the honest prover strategy may require super-PSPACE computation P P Recursively for each node, calculate maximum Pr[yes] V V V 6 AM[poly] ⊆ PSPACE Plan: For given input calculate maximum value, over all “prover strategies,” of Pr[yes] V Note that finding the honest prover strategy may require super-PSPACE computation P P Recursively for each node, calculate maximum Pr[yes] Leaves: Pr[yes] = 0 or 1, determined by V V V running verifier’s program 6 AM[poly] ⊆ PSPACE Plan: For given input calculate maximum value, over all “prover strategies,” of Pr[yes] V Note that finding the honest prover strategy may require super-PSPACE computation P P Recursively for each node, calculate maximum Pr[yes] Leaves: Pr[yes] = 0 or 1, determined by V V V running verifier’s program P nodes: max of children 6 AM[poly] ⊆ PSPACE Plan: For given input calculate maximum value, over all “prover strategies,” of Pr[yes] V Note that finding the honest prover strategy may require super-PSPACE computation P P Recursively for each node, calculate maximum Pr[yes] Leaves: Pr[yes] = 0 or 1, determined by V V V running verifier’s program P nodes: max of children V nodes: average of children 6 AM[poly] ⊆ PSPACE Plan: For given input calculate maximum value, over all “prover strategies,” of Pr[yes] V Note that finding the honest prover strategy may require super-PSPACE computation P P Recursively for each node, calculate maximum Pr[yes] Leaves: Pr[yes] = 0 or 1, determined by V V V running verifier’s program P nodes: max of children V nodes: average of children In PSPACE: depth polynomial 6 IP ⊆ PSPACE V P P V V V 7 IP ⊆ PSPACE Calculate max Pr[yes] when prover’s strategy can V depend only on messages and not private coins P P V V V 7 IP ⊆ PSPACE Calculate max Pr[yes] when prover’s strategy can V depend only on messages and not private coins Maintain the set of consistent random-tapes at each V node P P V V V 7 IP ⊆ PSPACE Calculate max Pr[yes] when prover’s strategy can V depend only on messages and not private coins Maintain the set of consistent random-tapes at each V node P P Children of V node not always chosen with 1/2-1/2 probability. Instead weighted by fraction of consistent random-tapes V V V 7 IP ⊆ PSPACE Calculate max Pr[yes] when prover’s strategy can V depend only on messages and not private coins Maintain the set of consistent random-tapes at each V node P P Children of V node not always chosen with 1/2-1/2 probability. Instead weighted by fraction of consistent random-tapes V V V Leaves: Pr[yes] determined by running verifier’s program on all consistent random-tapes of verifier 7 IP ⊆ PSPACE Calculate max Pr[yes] when prover’s strategy can V depend only on messages and not private coins Maintain the set of consistent random-tapes at each V node P P Children of V node not always chosen with 1/2-1/2 probability. Instead weighted by fraction of consistent random-tapes V V V Leaves: Pr[yes] determined by running verifier’s program on all consistent random-tapes of verifier P nodes: max of children 7 IP ⊆ PSPACE Calculate max Pr[yes] when prover’s strategy can V depend only on messages and not private coins Maintain the set of consistent random-tapes at each V node P P Children of V node not always chosen with 1/2-1/2 probability. Instead weighted by fraction of consistent random-tapes V V V Leaves: Pr[yes] determined by running verifier’s program on all consistent random-tapes of verifier P nodes: max of children V nodes: (weighted) average of children 7 PSPACE ⊆ IP 8 PSPACE ⊆ IP Enough to show an IP protocol for TQBF 8 PSPACE ⊆ IP Enough to show an IP protocol for TQBF For any L in PSPACE, both prover and verifier can first reduce input to a TQBF instance, and then prover proves its membership 8 PSPACE ⊆ IP Enough to show an IP protocol for TQBF For any L in PSPACE, both prover and verifier can first reduce input to a TQBF instance, and then prover proves its membership Recall TQBF 8 PSPACE ⊆ IP Enough to show an IP protocol for TQBF For any L in PSPACE, both prover and verifier can first reduce input to a TQBF instance, and then prover proves its membership Recall TQBF Decide whether a QBF is true or not 8 PSPACE ⊆ IP Enough to show an IP protocol for TQBF For any L in PSPACE, both prover and verifier can first reduce input to a TQBF instance, and then prover proves its membership Recall TQBF Decide whether a QBF is true or not QBF: Q1x1 Q2x2 ... Qnxn F(x1,...,xn) for quantifiers Qi and a formula F on boolean variables 8 Arithmetization 9 Arithmetization A Boolean formula as a polynomial 9 Arithmetization A Boolean formula as a polynomial Arithmetic over a field (finite, exponentially large characteristic) 9 Arithmetization A Boolean formula as a polynomial Arithmetic over a field (finite, exponentially large characteristic) 0 and 1 (identities of addition and multiplication) instead of False and True 9 Arithmetization A Boolean formula as a polynomial Arithmetic over a field (finite, exponentially large characteristic) 0 and 1 (identities of addition and multiplication) instead of False and True For formula F, polynomial P such that for boolean vector b and corresponding 0-1 vector x we have F(b) = P(x) 9 Arithmetization A Boolean formula as a polynomial Arithmetic over a field (finite, exponentially large characteristic) 0 and 1 (identities of addition and multiplication) instead of False and True For formula F, polynomial P such that for boolean vector b and corresponding 0-1 vector x we have F(b) = P(x) NOT: (1-x); AND: x.y 9 Arithmetization A Boolean formula as a polynomial Arithmetic over a field (finite, exponentially large characteristic) 0 and 1 (identities of addition and multiplication) instead of False and True For formula F, polynomial P such that for boolean vector b and corresponding 0-1 vector x we have F(b) = P(x) NOT: (1-x); AND: x.y OR (as NOT of AND of NOT): 1 - (1-x).(1-y) 9 Arithmetization A Boolean formula as a polynomial Arithmetic over a field (finite, exponentially large characteristic) 0 and 1 (identities of addition and multiplication) instead of False and True For formula F, polynomial P such that for boolean vector b and corresponding 0-1 vector x we have F(b) = P(x) NOT: (1-x); AND: x.y OR (as NOT of AND of NOT): 1 - (1-x).(1-y) Alternately, OR: x+y.