Polylogarithmic-round Interactive Proofs for coNP Collapses the Exponential Hierarchy Alan L. Selman¤ Department of Computer Science and Engineering University at Buffalo, Buffalo, NY 14260 Samik Senguptay Department of Computer Science and Engineering University at Buffalo, Buffalo, NY 14260 January 13, 2004 Abstract It is known [BHZ87] that if every language in coNP has a constant-round interactive proof system, then the polynomial hierarchy collapses. On the other hand, Lund et al. [LFKN92] have shown that #SAT #P , the -complete function that outputs the number of satisfying assignments of a Boolean for- mula, can be computed by a linear-round interactive protocol. As a consequence, the coNP-complete set SAT has a proof system with linear rounds of interaction. We show that if every set in coNP has a polylogarithmic-round interactive protocol then the expo- nential hierarchy collapses to the third level. In order to prove this, we obtain an exponential version of Yap's result [Yap83], and improve upon an exponential version of the Karp-Lipton theorem [KL80], obtained first by Buhrman and Homer [BH92]. 1 Introduction Ba´bai [Ba´b85] and Ba´bai and Moran [BM88] introduced Arthur-Merlin Games to study the power of randomization in interaction. Soon afterward, Goldwasser and Sipser [GS89] showed that these classes are equivalent in power to Interactive Proof Systems, introduced by Goldwasser et al. [GMR85]. Study of interactive proof systems and Arthur-Merlin classes has been exceedingly successful [ZH86, BHZ87, ZF87, LFKN92, Sha92], eventually leading to+the discovery of +Probabilistically Checkable Proofs [BOGKW88, LFKN92, Sha92, BFL81, BFLS91, FGL 91, AS92, ALM 92]. Interactive proof systems are successfully placed relative to traditional complexity classes. In particular, k IP[k] ¦p IP[poly] = PSPACE it is known that for any constant , 2 [BM88], and [Sha92]. However, the relationship between coNP and interactive proof systems is not entirely clear. On the one hand, Boppana, Ha˚stad and Zachos [BHZ87] proved that if every set in coNP has a constant-round interactive proof system, then the polynomial-time hierarchy collapses below the second level. On the other hand, the best interactive #SAT protocol for any language in coNP comes from the result of Lund et al. [LFKN92], who show that , a problem hard for the entire polynomial-time hierarchy [Tod91], is accepted by an interactive proof system O(n) n with rounds of interaction on an input of length . Can every set in coNP be accepted by an interactive ¤Research partially supported by NSF grant CCR-0307077. Email: [email protected] yEmail: [email protected] 1 proof system with more that constant but sublinear number of rounds? Answering this question has been the motivation for this paper. We show in this paper that coNP cannot have a polylogarithm§ipc-round interac§tpive proof system unless NEXP 2 = coNEXP 2 the exponential hierarchy collapses to the third level, i.e., . Three principal steps lead to the proof of our main result, and these results are of independent interest. Note that although we use Arthur-Merlin protocols to obtain our results, our main theorem holds for interactive proof systems as well m due to the result of Goldwasser and Sipser [GS89], who showed that an interactive proof system with 2m + 4 rounds can be simulated by an -move Arthur-Merlin protocol. m l(n) ² An Arthur-Merlin protocol with moves where both Arthur and Merlin exchange at most bits at every move can be simulated by a two-move AM protocol where Arthur moves first and uses O(l(n)m 1) ¡ random bits (Theorem 3.1). L 2polylog L ² If is accepted by a two-move AM protocol where Arthur uses random bits, then belongs NP=2polylog to the advice class (Lemma 3.3). NP=2polylog NP =2polylog ² If coNP (equivalently coNP ) then §p §p exp NP NEXP 2 = coNEXP 2 = S P : 2 ± (Theorem 4.1) NP In addition to these results, we improve upon a result of Buhrman and Homer [BH92], showing that if 2polylog NEXPNP = coNEXPNP = SEXP has -size family of circuits, then 2 . We note that Goldreich and Ha˚stad [GH98] and Goldreich, Vadhan, and Wigderson [GVW01] have studied Arthur-Merlin games and interactive proof systems with bounded message complexity. Their results m are incomparable to our Theorem 3.1. In particular, our simulation of an -move Arthur-Merlin protocol l by a 2-move Arthur-Merlin protocol assumes that , the number of message bits used in every move, is polynomial in the length of the input, and we obtain that the number of random bits used by Arthur in the l 2-move protocol is not exponential in . This is crucial in order to get Theorem 4.1. 2 Preliminaries For definitions of standard complexity classes, we refer the reader to Homer and Selman [HS01]. The exponential hierarchy is defined as follows: exp exp NP exp EXP = §0 ; NEXP = §1 ; NEXP = §2 ; k 0 and in general, for , exp p ¸ §k §k+1 = NEXP : k 0 For every ¸ , exp exp ¦ = L L § : k f 2 k g k polylog = logk n 2polylog ¯= 2log n We define k>0 and ¯ k>0 . Let C be a complexity class. A set L =2polylog s : 1 § k > 0 A 2 C if there is aSfunction ¤ 7! ¤, some cSonstant , and a set 2 C such that k n s(1n) 2log n 1. For every , j j · , and x x L (x; s(1 x )) A A 2. For all , 2 , j j 2 . Here is called the witness language. 2 =2polylog co co =2polylog It is easy to see that D C if and only if D C . Ba´bai [Ba´b85] introduced Arthur-Merlin protocol, a combinatorial game that is played by Arthur, a probabilistic polynomial-time machine, and Merlin, a computationally unbounded Turing machine. Arthur can use random bits, but these bits are public, i.e., Merlin can see them and move accordingly. x x L Given an input string , Merlin tries to convince Arthur that belongs to some language . The game consists of a predetermined finite number of moves with Arthur and Merlin moving alternately. In each move Arthur (or Merlin) prints a finite string on a read-write communication tape. Arthur's moves depend x on his random bits. After the last move, Arthur either accepts or does not accept . m > 0 L AM[m] MA[m] Definition 2.1 ([Ba´b85, BM88]) For any , a language is in (respectively ) if for x n every string of length m ² The game consists of moves ² Arthur (resp., Merlin) moves first ² After the last move, Arthur behaves deterministically to either accept or not accept the input string x L x ² If 2 , then there exists a3 sequence of moves by Merlin that leads to the acceptance of by Arthur with probability is at least 4 x = L x 1 ² if 2 then for all possible moves of Merlin, the probability that Arthur accepts is less than 4 . AM[k] k > 1 AM[2] = AM Ba´bai and Moran [BM88] showed that , where is some constant, is the same as . MA[2] = MA AM[1] = BPP MA[1] = M = NP MA AM Note that , , and . Ba´bai [Ba´b85] proved that . Now we need to extend modestly the notion of Arthur-Merlin protocols. In the following limited manner, we consider the possibility that Arthur is a probabilisitic Turing machine, but not necessarily polynomial- f : N N AM(f) time-bounded. Let 7! be some function. Then we define the class to be the class of languages accepted by protocols in which there are only two moves, Arthur moves first, and Arthur can use f(n) n f at most random bits on an input of length . In particuclar, we will have occasion to consider to be AM(2log n) c quasipolynomial; that is, we will consider the class , where is a positive constant. We note the following standard proposition. E 3 p( ) Proposition 2.2 Let be an event that occurs with probability at least 4 . Then, for any polynomial def ¢ p(n) n c t = c p(n) E such that ¸ , there is a constant such that within £ independent trials, occurs for t (1 1 ) more than 2 times with probability ¡ 2p(n) . Sexp S We define 2 as the exponential version of the 2 operator defined by Russell and Sundaram [RS98] L Sexp k > 0 A x 0; 1 n and Canetti [Can96]. A set is in 2 ±C if there is some and 2 C such that for every 2 f g , x L = y z (x; y; z) A; 2 ) 9 8 2 and x = L = z y (x; y; z) = A; 2 ) 9 8 2 k y ; z 2n where j j j j · . P def exp S2 = S2 P S2 Similar to exp ± , the class ± C can be thought of as a game between two provers and a L S x n x L verifier. Let 2 2 ± C. On any input of length , the Yes-prover attempts to show that 2 , and the x = L x x L No-prover attempts to show that 2 . Both the proofs are at most exponentially long in j j. If 2 , x L then there must be a proof by the yes-prover (called a yes-proof) that convinces the verifier that 2 no x = L matter what the proof provided by the no-prover (called a no-proof) is; symmetrically, if 2 , then there x x must exist some no-proof such that the verifier rejects irrespective of the yes-proof. For every input , 3 there is a yes-prover and a no-prover such that exactly one of them is correct.