Notes on Complexity Theory Last updated: November, 2011 Lecture 19 Jonathan Katz 1 IP = PSPACE A small modi¯cation of the previous protocol gives an interactive proof for any language in PSPACE, and hence PSPACE ⊆ IP. Before showing this, however, we quickly argue that IP ⊆ PSPACE. To see this, ¯x some proof system (P; V) for a language L (actually, we really only care about the veri¯er algorithm V). We claim that L 2 PSPACE. Given an input x 2 f0; 1gn, we compute exactly (using polynomial space) the maximum probability with which a prover can make V accept. (Although the prover is allowed to be all-powerful, we will see that the optimal strategy can be computed in PSPACE and so it su±ces to consider PSPACE provers in general.) Imagine a tree where each node at level i (with the root at level 0) corresponds to some sequence of i messages exchanged between the prover and veri¯er. This tree has polynomial depth (since V can only run for polynomially many rounds), and each node has at most 2nc children (for some constant c), since messages in the protocol have polynomial length. We recursively assign values to each node of this tree in the following way: a leaf node is assigned 0 if the veri¯er rejects, and 1 if the veri¯er accepts. The value of an internal node where the prover sends the next message is the maximum over the values of that node's children. The value of an internal node where the veri¯er sends the next message is the (weighted) average over the values of that node's children. The value of the root determines the maximum probability with which a prover can make the veri¯er accept on the given input x, and this value can be computed in polynomial space. If this value is greater than 2=3 then x 2 L; if it is less than 1=3 then x 62 L. 1.1 PSPACE ⊆ IP We now turn to the more interesting direction, namely showing that PSPACE ⊆ IP. We will now work with the PSPACE-complete language TQBF, which (recall) consists of true quanti¯ed boolean formulas of the form: 8x19x2 ¢ ¢ ¢ Qnxn Á(x1; : : : ; xn); where Á is a 3CNF formula. We begin by arithmetizing Á as we did in the case of #P; recall, if Á has m clauses this results in a degree-3m polynomial © such that, for x1; : : : ; xn 2 f0; 1g, we have ©(x1; : : : ; xn) = 1 if Á(x1; : : : ; xn) is true, and ©(x1; : : : ; xn) = 0 if Á(x1; : : : ; xn) is false. We next must arithmetize the quanti¯ers. Let © be an arithmetization of Á as above. The arithmetization of an expression of the form 8xn Á(x1; : : : ; xn) is Y def ©(x1; : : : ; xn) = ©(x1; : : : ; xn¡1; 0) ¢ ©(x1; : : : ; xn¡1; 1): xn2f0;1g If we ¯x values for x1; : : : ; xn¡1, then the above evaluates to 1 if the expression 8xn Á(x1; : : : ; xn) is true, and evaluates to 0 if this expression is false. The arithmetization of an expression of the 19-1 form 9xn Á(x1; : : : ; xn) is a def ¡ ¢ ¡ ¢ ©(x1; : : : ; xn) = 1 ¡ 1 ¡ ©(x1; : : : ; xn¡1; 0) ¢ 1 ¡ ©(x1; : : : ; xn¡1; 1) : xn2f0;1g Note again that if we ¯x values for x1; : : : ; xn¡1 then the above evaluates to 1 if the expression 9xn Á(x1; : : : ; xn) is true, and evaluates to 0 if this expression is false. Proceeding in this way, a quanti¯ed boolean formula 9x18x2 ¢ ¢ ¢ 8xnÁ(x1; : : : ; xn) is true i® a Y Y 1 = ¢ ¢ ¢ ©(x1; : : : ; xn): (1) x12f0;1g x22f0;1g xn2f0;1g A natural idea is to use Eq. (1) in the protocols we have seen for coNP and #P, and to have the prover convince the veri¯er that the above holds by \stripping o®" operators one-by-one. While this works in principle, the problem is that the degrees of the intermediate results are too large. For example, the polynomial Y Y P (x1) = ¢ ¢ ¢ ©(x1; : : : ; xn) x22f0;1g xn2f0;1g n Q ` may have degree as high as 2 ¢ 3m (note that the degree of x1 doubles each time a or operator is applied). Besides whatever e®ect this will have on soundness, this is even a problem for completeness since a polynomially bounded veri¯er cannot read an exponentially large polynomial (i.e., with exponentially many terms). 1 To address the above issue, we use a simple trick. In Eq. (1) the fxig only take on boolean k values. But for any k > 0 we have xi = xi when xi 2 f0; 1g. So we can in fact reduce the degree of every variable in any intermediate polynomial to (at most) 1. (For example, the polynomial 5 4 6 7 x1x2 +x1 +x1x2 would become 2x1x2 +x1.) Let Rxi be an operator denoting this \degree reduction" operation applied to variable xi. Then the prover needs to convince the veri¯er that a Y a Y 1 = Rx1 Rx1 Rx2 ¢ ¢ ¢ Rx1 ¢ ¢ ¢ Rxn¡1 Rx1 ¢ ¢ ¢ Rxn ©(x1; : : : ; xn): x12f0;1g x22f0;1g x32f0;1g xn2f0;1g As in the previous protocols, we will actually evaluate the above modulo some prime q. Since the above evaluates to either 0 or 1, we can take q any size we like (though soundness will depend inversely on q as before). We can now apply the same basic idea from the previous protocols to construct a new protocol in which, in each round, the prover helps the veri¯er \strip" one operator from the above expression. Denote the above expression abstractly by: FÁ = O1O2 ¢ ¢ ¢ O` ©(x1; : : : ; xn) mod q ; P Q ` where ` = n (i + 1) and each O is one of , , or R (for some i). At every round k the i=1 j xi xi xi veri¯er holds some value vk and the prover wants to convince the veri¯er that vk = Ok+1 ¢ ¢ ¢ O` ©k mod q; 1Of course, it seems simple in retrospect. 19-2 where ©k is some polynomial. At the end of the round the veri¯er will compute some vk+1 and the prover then needs to convince the veri¯er that vk+1 = Ok+2 ¢ ¢ ¢ O` ©k+1 mod q; for some ©k+1. We explain how this is done below. At the beginning of the protocol we start with v0 = 1 and ©0 = © (so that the prover wants to convince the veri¯er that the given quanti¯ed formula is true); at the end of the protocol the veri¯er will be able to compute ©` itself and check whether this is equal to v`. It only remains to describe each of the individual rounds. There are three cases corresponding to the three types of operators (we omit the \ mod q" from our expressions from now on, for simplicity): Q Case 1: O = (for some i). Here, the prover wants to convince the veri¯er that k+1 xi Y a Y vk = Rx1 ¢ ¢ ¢ ¢ ¢ ¢ Rx1 ¢ ¢ ¢ Rxn ©(r1; : : : ; ri¡1; xi; : : : ; xn): (2) xi xi+1 xn (Technical note: when we write an expression like the above, we really mean 0 1 Y a Y @ A Rx1 ¢ ¢ ¢ ¢ ¢ ¢ Rx1 ¢ ¢ ¢ Rxn ©(x1; : : : ; xi¡1; xi; : : : ; xn) [r1; : : : ; ri¡1]: xi xi+1 xn That is, ¯rst the expression is computed symbolically, and then the resulting expression is evaluated by setting x1 = r1; : : : ; xi¡1 = ri¡1.) This is done in the following way: ² The prover sends a degree-1 polynomial P^(xi). Q ² The veri¯er checks that v = P^(x ). If not, reject. Otherwise, choose random r 2 F , set k xi i i q vk+1 = P^(ri), and enter the next round with the prover trying to convince the veri¯er that: a Y vk+1 = Rx1 ¢ ¢ ¢ ¢ ¢ ¢ Rx1 ¢ ¢ ¢ Rxn ©(r1; : : : ; ri¡1; ri; xi+1; : : : ; xn): (3) xi+1 xn To see completeness, assume Eq. (2) is true. Then the prover can send a Y ^ def P (xi) = P (xi) = Rx1 ¢ ¢ ¢ ¢ ¢ ¢ Rx1 ¢ ¢ ¢ Rxn ©(r1; : : : ; ri¡1; xi; : : : ; xn); xi+1 xn the veri¯er will not reject and Eq. (3) will hold for any choice of ri. As for soundness, if Eq. (2) does not hold then the prover must send P^(xi) 6= P (xi) (or else the veri¯er rejects right away); but then Eq. (3) will not hold except with probability 1=q. ` Case 2: O = (for some i). This case and its analysis are similar to the above and are k+1 xi therefore omitted. Case 3: Ok+1 = Rxi (for some i). Here, the prover wants to convince the veri¯er that Y vk = Rxi ¢ ¢ ¢ Rx1 ¢ ¢ ¢ Rxn ©(r1; : : : ; rj; xj+1; : : : ; xn); (4) xn where j ¸ i. This case is a little di®erent from anything we have seen before. Now: 19-3 ² The prover sends a polynomial P^(xi) of appropriate degree (see below). ³ ´ ^ ² The veri¯er checks that Rxi P (xi) [ri] = vk. If not, reject. Otherwise, choose a new random ri 2 Fq, set vk+1 = P^(ri), and enter the next round with the prover trying to convince the veri¯er that: Y vk+1 = Ok+2 ¢ ¢ ¢ Rx1 ¢ ¢ ¢ Rxn ©(r1; : : : ; ri; : : : ; rj; xj+1; : : : ; xn): (5) xn Completeness is again easy to see: assuming Eq. (4) is true, the prover can simply send Y ^ def P (xi) = P (xi) = Ok+2 ¢ ¢ ¢ Rx1 ¢ ¢ ¢ Rxn ©(r1; : : : ; ri¡1; xi; ri+1; : : : ; rj; xj+1; : : : ; xn) xn and then the veri¯er will not reject and also Eq. (5) will hold for any (new) choice of ri. As for soundness, if Eq. (4) does not hold then the prover must send P^(xi) 6= P (xi); but then Eq.