Relationship to other classes CS151 Question: is #P hard because it entails Complexity Theory finding NP witnesses? Lecture 13 …or is counting difficult by itself? May 11, 2021 May 11, 2021 CS151 Lecture 13 Bipartite MatchinGs Bipartite MatchinGs • Definition: • Definition: – G = (U, V, E) bipartite graph with |U| = |V| – G = (U, V, E) bipartite graph with |U| = |V| – a perfect matching in G is a subset M ⊆ E – a perfect matching in G is a subset M ⊆ E that touches every node, and no two edGes in that touches every node, and no two edGes in M share an endpoint M share an endpoint May 11, 2021 CS151 Lecture 13 May 11, 2021 CS151 Lecture 13 Bipartite MatchinGs Cycle Covers • #MATCHING: given a bipartite graph • Claim: 1-1 correspondence between cycle G = (U, V, E) how many perfect covers in G’ and perfect matchings in G matchinGs does it have? – #MATCHING and #CYCLE-COVER parsimoniously reducible to each other 2 Theorem: #MATCHING is #P-complete. 1 2 3 4 5 3 • But… can find a perfect matching in 1 polynomial time! 4 – countinG itself must be difficult 1 2 3 4 5 5 G = (U, V, E) G’ = (V, E’) May 11, 2021 CS151 Lecture 13 May 11, 2021 CS151 Lecture 13 1 Cycle Covers Cycle Cover is #P-complete • cycle cover: collection of node-disjoint • variable GadGet: every cycle cover directed cycles that touch every node includes left cycle or right cycle • #CYCLE-COVER: given directed graph G xi ¬xi •clause GadGet: cycle = (V, E) how many cycle covers does it cover cannot use all three have? outer edges – and each of 7 ways to Theorem: #CYCLE-COVER is #P-complete. exclude at least one gives – implies #MATCHING is #P-complete exactly 1 cover using those external edGes May 11, 2021 CS151 Lecture 13 May 11, 2021 CS151 Lecture 13 Cycle Cover is #P-complete Cycle Cover is #P-complete May 11, 2021 CS151 Lecture 13 May 11, 2021 CS151 Lecture 13 Cycle Cover is #P-complete Cycle Cover is #P-complete • clause GadGet correspondinG to (A∨B∨C) • Proof outline (reduce from #SAT) has “xor” gadget between outer 3 edges (¬x1∨x2∨ ¬x3)∧(¬x3∨x1)∧ … ∧(x3∨ ¬ x2) and A, B, C xor gadgets ¬A B ¬B clause A (exactly 1 of . u v two edges is in gadgets xor cover) v’ u’ x 1 ¬x1 x2 ¬x ¬x xor GadGet ensures that 2 x3 3 exactly one of two C ¬C N.B. must avoid reducinG variable gadgets edges can be in cover SAT to MATCHING! May 11, 2021 CS151 Lecture 13 May 11, 2021 CS151 Lecture 13 2 Cycle Cover is #P-complete Cycle Cover is #P-complete • Introduce edGe weiGhts • WeiGhted xor GadGet: N-1 – cycle cover weiGht is product of weights of its u v u v edges xor N-1 v’ u’ v’ 2 u’ • “implement” xor GadGet by N-1 3 – weiGht of cycle cover that “obeys” xor (unlabeled weights are 1) multiplied by 4 (mod N) – weiGht of cycle cover that “obeys” xor – weiGht of cycle cover that “violates” xor multiplied by 4 (mod N) multiplied by N – weiGht of cycle cover that “violates” xor larGe inteGer multiplied by N May 11, 2021 CS151 Lecture 13 May 11, 2021 CS151 Lecture 13 Cycle Cover is #P-complete Cycle Cover is #P-complete • SimulatinG positive edGe weiGhts (¬x1∨x2∨ ¬x3)∧(¬x3∨x1)∧ … ∧(x3∨ ¬ x2) – need to handle 2, 3, 4, 5, …, N-1 xor gadget (exactly 1 of . clause two edges is in gadget 2 cover) 2k x variable gadgets: 1 ¬x1 x2 ¬x ¬x k times 2 x3 3 3 – m = # xor gadgets; n = # variables; N > 4m2n – # covers (mod N) = (4m)⋅(#sat. assiGnments) May 11, 2021 CS151 Lecture 13 May 11, 2021 CS151 Lecture 13 New Topic Proof systems • proof systems L = { (A, 1k) : A is a true mathematical assertion with a proof of lenGth k} • interactive proofs and their power What is a “proof”? • Arthur-Merlin Games complexity insiGht: meaninGless unless can be efficiently verified May 11, 2021 CS151 Lecture 13 May 11, 2021 CS151 Lecture 13 3 Proof systems Classical Proofs • given language L, goal is to prove x ∈ L • previous definition: “classical” proof system • proof system for L is a verification algorithm V • recall: – completeness: x ∈ L ⇒ ∃ proof, V accepts (x, proof) “true assertions have proofs” L ∈ NP iff expressible as – soundness: x ∉ L ⇒ ∀ proof*, V rejects (x, proof*) L = { x | ∃y, |y| < |x|k, (x, y) ∈ R } and R ∈ P. “false assertions have no proofs” • NP is the set of lanGuaGes with classical – efficiency: ∀ x, proof: V(x, proof) runs in polynomial time in |x| proof systems (R is the verifier) May 11, 2021 CS151 Lecture 13 May 11, 2021 CS151 Lecture 13 Interactive Proofs Interactive Proofs • Two new ingredients: • interactive proof system for L is an – randomness: verifier tosses coins, errs with interactive protocol (P, V) some small probability common input: x – interaction: rather than “readinG” proof, Prover Verifier verifier interacts with computationally unbounded prover . # rounds = • NP proof systems lie in this framework: prover . poly(|x|) sends proof, verifier does not use randomness accept/ reject May 11, 2021 CS151 Lecture 13 May 11, 2021 CS151 Lecture 13 Interactive Proofs Interactive Proofs • interactive proof system for L is an IP = {L : L has an interactive proof interactive protocol (P, V) system} – completeness: x ∈ L ⇒ • Observations/questions: Pr[V accepts in (P, V)(x)] ≥ 2/3 – philosophically interesting: captures more – soundness: x ∉ L ⇒ ∀ P* broadly what it means to be convinced a statement is true Pr[V accepts in (P*, V)(x)] ≤ 1/3 – clearly NP ⊆ IP. Potentially larGer. How much – efficiency: V is p.p.t. machine larGer? • repetition: can reduce error to any ε – if larGer, randomness is essential (why?) May 11, 2021 CS151 Lecture 13 May 11, 2021 CS151 Lecture 13 4 Graph Isomorphism Graph Isomorphism • graphs G0 = (V, E0) and G1 = (V, E1) are • GI = {(G0, G1) : G0 ≃ G1 } isomorphic (G0 ≃ G1) if exists a – in NP permutation π:V → V for which – not known to be in P, or NP-complete (x, y) ∈ E0 ⇔ (π(x), π(y)) ∈ E1 • GNI = complement of GI 1 1 – not known to be in NP 1 4 2 3 Theorem (GMW): GNI ∈ IP 3 4 2 3 – indication IP may be more powerful than NP 2 4 May 11, 2021 CS151 Lecture 13 May 11, 2021 CS151 Lecture 13 GNI in IP GNI in IP • interactive proof system for GNI: • completeness: – if G0 not isomorphic to G1 then H is input: (G0, G1) isomorphic to exactly one of (G , G ) Prover Verifier 0 1 – prover will choose correct r H = π(Gc) flip coin ∈ if H ≃G0 c {0,1}; • soundness: pick r = 0, – if G ≃ G then prover sees same distribution else r = 1 r random π 0 1 accept on H for c = 0, c = 1 iff r = c – no information on c ⇒ any prover P* can succeed with probability at most 1/2 May 11, 2021 CS151 Lecture 13 May 11, 2021 CS151 Lecture 13 The power of IP The power of IP • We showed GNI ∈ IP • Proof idea: input: φ(x1, x2, …, xn) – prover: “I claim φ has k satisfying assignments” • GNI ∈ IP suGGests IP more powerful than – true iff NP, since we don’t know how to show GNI • φ(0, x2, …, xn) has k0 satisfying assignments in NP • φ(1, x2, …, xn) has k1 satisfying assignments • k = k0 + k1 • GNI in coNP – prover sends k0, k1 – verifier sends random c ∈ {0,1} – prover recursively proves “φ’ = φ(c, x2, …, xn) has kc Theorem (LFKN): coNP ⊆ IP satisfying assignments” – at end, verifier can check for itself. May 11, 2021 CS151 Lecture 13 May 11, 2021 CS151 Lecture 13 5 The power of IP The power of IP • Analysis of proof idea: • Solution to problem (ideas): – replace {0,1}n with (F )n – Completeness: φ(x1, x2, …, xn) has k q satisfyinG assiGnments ⇒ accept with prob. 1 – verifier substitutes random field element at – Soundness: φ(x1, x2, …, xn) does not have k each step satisfyinG assiGns. ⇒ accept prob. ≤ 1 – 2-n – vast majority of field elements catch cheating prover (rather than just 1) – Why? It is possible that k is only off by one; verifier only catches prover if coin flips c are Theorem: L = { (φ, k): CNF φ has exactly k successive bits of this assiGnment satisfyinG assiGnments} is in IP May 11, 2021 CS151 Lecture 13 May 11, 2021 CS151 Lecture 13 The power of IP The power of IP • Prover wishes to prove: • First step: arithmetization … k = Σx Σx Σx p (x , x , …, x ) – transform φ(x , … x ) into polynomial p (x , x , … x ) 1 = 0, 1 2 = 0,1 n = 0, 1 φ 1 2 n 1 n φ 1 2 n … n • Define: kz = Σx = 0,1 Σx = 0, 1pφ(z, x2, …, xn) of degree d over a field Fq; q prime > 2 2 n – recursively: • prover sends: kz for all z ∈ Fq • xi → xi ¬φ → (1 - pφ) • verifier: ’ • φ ∧ φ → (pφ)(pφ’) – checks that k0 + k1 = k ’ • φ ∨ φ → 1 - (1 - pφ)(1 - pφ’) – sends random z ∈ Fq n – for all x ∈ {0,1} we have pφ(x) = φ(x) • continue with proof that – degree d ≤ |φ| … kz = Σx2 = 0,1 Σxn = 0, 1pφ(z, x2, …, xn) – can compute pφ(x) in poly time from φ and x • at end: verifier checks for itself May 11, 2021 CS151 Lecture 13 May 11, 2021 CS151 Lecture 13 The power of IP The actual protocol input: (φ, k) Prover Verifier • Prover wishes to prove: p1(x) p1(0)+p1(1)=k? … p1(x) = Σx …,x ∈{0,1} pφ(x, x2, …, xn) k = Σx Σx Σx p (x , x , …, x ) 2, n z1 1 = 0, 1 2 = 0,1 n = 0, 1 φ 1 2 n pick random z1 in Fq … p (x) = Σx x ∈ p (z , x, x , …, x ) • Define: k = Σx Σx p (z, x , …, x ) 2 3,…, n {0,1} φ 1 3 n z 2 = 0,1 n = 0, 1 φ 2 n p (0)+p (1)=p (z )? p2(x) 2 2 1 1 z 2 pick random z2 in Fq p3(x) = Σx …,x ∈ {0,1} pφ(z1, z2, x, x4 …, xn) • a problem: can’t send kz for all z ∈ Fq 4, n p3(x) p3(0)+p3(1)=p2(z2)? .