\documentclass[11pt]{article}
\include{lecture}
\usepackage{alg}
\begin{document}
\lecture{24}{4/20/2010}{Interactive Proofs}{Jeff Kinne and Ashutosh Kumar}
%\draft % put this here only if you want to indicate this is a draft

Last time we introduced the notion of universal families of hash
functions and used them to establish results that relate the
counting complexity classes to the polynomial hierarchy. We were in
the middle of the proof of the theorem stating that any language in
the polynomial hierarchy can be decided in polynomial time with a
single query to a $\SHARPP$ function. Today we'll complete this
proof by completing the proofs of the inclusions $\PH \subseteq
\BPP^{\PARITYP}$ and $\BPP^{\PARITYP} \subseteq\P^{\SHARPP[1]}$.

Next we'll introduce the notion of interactive proof systems which
models computation as a result of interaction between two parties.
We make some remarks on how various modifications of the definition
affect the class of languages this model can compute. We'll define
public/private coin protocols, and first show that the graph non-isomorphism problem 
admits an interactive proof using private coins. After that, we'll also show that there is an interactive proof for the same problem that uses \emph{public} coins. In subsequent lectures, we'll see that this provides further evidence that the graph isomorphism problem is not \NP-complete. 

\section{Proof of  $\PH \subseteq \P^{\SHARPP[1]}$}

Note that we had already shown that $\NP\subseteq\RP^{\text{UNIQUE-SAT}}$. We'll use this to get a randomized reduction of PH to $\PARITYP$. Because UNIQUE-SAT only cares about formulas with exactly 0 or 1 satisfying 
assignments, $\oplus$SAT solves UNIQUE-SAT on formulas within the promise.
This shows that $\NP\subseteq\BPP^\PARITYP$.

Given this, we use the fact that a problem from the first homework 
relativizes.  Namely, $\NP\subseteq\BPP \Rightarrow\PH\subseteq\BPP$ 
relativizes.  So $\NP^\PARITYP\subseteq\BPP^\PARITYP \Rightarrow
\PH^\PARITYP\subseteq\BPP^\PARITYP$.  We want to show the hypothesis of 
this.  To get this, we notice that $\NP\subseteq\BPP^\PARITYP$ relativizes
as well, giving $\NP^\PARITYP\subseteq(\BPP^{\PARITYP})^\PARITYP$.  

In general, giving an additional oracle $O_2$ to an oracle machine with
access to $O_1$ can be solved by the base machine by giving it access 
to oracles $O_1$ and $O_1^{O_2}$.  For the case of
$(\BPP^{\PARITYP})^{\PARITYP}$, we get that a $\BPP$ machine requires
access to a $(\PARITYP)^{\PARITYP}$ oracle in addition to a
$\PARITYP$ oracle.  
These can be combined into a 
single $(\PARITYP)^{\PARITYP}$ oracle using the completeness of 
$\oplus$SAT, and using the fact that $(\PARITYP)^{\PARITYP}=\PARITYP$,
we get
$\NP^\PARITYP\subseteq\BPP^{(\PARITYP^\PARITYP)}=\BPP^\PARITYP$.  Having
achieved $\NP^\PARITYP\subseteq\BPP^\PARITYP$, we conclude that 
$\PH\subseteq\PH^\PARITYP\subseteq\BPP^\PARITYP$.

We point out that the proof given here of this result is simpler than
the original proof.  This is a demonstration of the power of relativization.



\subsection{Deterministic reduction of $\BPP^\PARITYP$ to $\SHARPP$}
Given a language $L$ in $\BPP^\PARITYP$, we wish to determine if $x\in L$
by making a single query to a $\SHARPP$ function.  We first show that we 
can separate out the randomized portion of $L$ from the counting portion.
This will be useful in performing the reduction.  
\begin{definition}
  Let $\CC$ be a complexity class.  We define the $\BP$ operator to give 
  a new complexity class of languages, where 
  $\BP\cdot\CC = \{L | (\exists c>0) (\exists L'\in\CC) $
  $$\begin{array}{l}
    x\in L \Rightarrow \Pr_{y\in|x|^c}[\left< x,y\right>\in L'] > 2/3,\\
    x\notin L \Rightarrow \Pr_{y\in|x|^c}[\left< x,y\right>\in L'] < 1/3 
    \hspace{12 pt} \}
  \end{array}
  $$
\end{definition}
Notice that $\BP\cdot\P = \BPP$, so this is a reasonable definition of the
$\BP$ operator.  The alternative characterization of $\BPP^\PARITYP$ we 
use is given by the following.
\begin{claim}
  $\BPP^\PARITYP = \BP\cdot\PARITYP$.
\end{claim}
\begin{proof}
  We show that for any complexity class $\CC$, 
  $\BPP^\CC = \BP\cdot\P^\CC$.  The result then follows by using 
  $\PARITYP$ as $\CC$ and the fact that $\P^\PARITYP=\PARITYP$.  

  Consider a $\BPP$ machine that can ask
  queries to a $\CC$ language.  Without changing the computation, the machine 
  can guess its random bits at the beginning the computation before proceeding.
  What is left is a $\P^\CC$ predicate.  Now consider a 
  $\BP\cdot\P^\CC$ language.  The $\BPP^\CC$ machine computing the 
  same language simply generates enough random bits to be the second input
  of the $\P^\CC$ machine and then simulates that machine.
\end{proof}

\medskip

Now consider a language $L\in \BP\cdot\PARITYP$ which we hope to solve in 
$\P^{\SHARPP[1]}$.  By definition, there is some $f\in\SHARPP$ such that
$$
\begin{array}{l}
  x\in L \Rightarrow \Pr_{|y|=n^c}[f(x,y)\equiv 1\pmod 2] > 2/3\\
  x\notin L \Rightarrow \Pr_{|y|=n^c}[f(x,y)\equiv 1\pmod 2] < 1/3\\
\end{array}
$$
We would like to create a $\SHARPP$ function which sums $f$ over all 
$y$ such that we can detect the gap in probability.  The following claim 
is the main ingredient to make this happen.
\begin{claim}
  Let $f\in\SHARPP$.  Then there is a function $g\in\SHARPP$ such that
  $$\begin{array}{l}
    f(z)\equiv 1\pmod 2 \Rightarrow g(z,0^M)\equiv -1 \pmod {2^{M}}\\
    f(z)\equiv 0\pmod 2 \Rightarrow g(z,0^M)\equiv  0 \pmod {2^{M}}
  \end{array}$$
  where $M=2^m$ is some power of 2.
  \label{clm:20:mod}
\end{claim}
Before proving this claim, we see how it allows us to complete the 
construction.  Notice that if $f(z)\equiv 1\pmod 2$, then the last $M$ 
bits of $-g(z,0^M)$ are $000...001$; if $f(z)\equiv 0\pmod 2$, the last
$M$ bits are $000...000$.  We would like to sum up $-g(z)$ for all 
$z=(x,y)$ in such a way that the results do not ``spill over'' past the 
last $M$ bits.  Because we must sum over $2^{n^c}$ many $y$, we need to 
pick $M>n^c$ to ensure there is no spill over.  Namely
notice that if $M>n^c$, then 
$$\begin{array}{l}
  x\in L \Rightarrow \sum_{|y|=n^c} -g(x,y,0^M)\pmod {2^M} >
  \frac{2}{3} 2^{|x|^c} \\
  x\notin L \Rightarrow \sum_{|y|=n^c} -g(x,y,0^M)\pmod {2^M} <
  \frac{1}{3} 2^{|x|^c}.
\end{array}$$
In fact, by picking $M>n^{c}$ we ensure there is a single bit of 
the sum that we can check to distinguish between the two cases.  Thus, 
$g'(x)=\sum_{|y|=n^c}g(x,y,0^M)$ is the $\SHARPP$ function that we 
query once to determine if $x\in L$ or not.  That is, we compute 
$g'(x)$, and check if $-g'(x)\pmod {2^M}$ is $>\frac{2}{3} 2^{|x|^c}$ or not.
Notice that $g'$ is in fact a $\SHARPP$ function because
a machine can branch on all $y$ and then compute $g(x,y,0^M)$ on each branch.


\medskip

All that remains is the proof of the claim.
\begin{proof}[Proof of Claim \ref{clm:20:mod}]
  The base of the construction is the function $h(z)=4z^3+3z^4$ which has 
  the nice property that 
  $$\begin{array}{l}
    z\equiv -1\pmod {2^M} \Rightarrow h(z)\equiv -1 \pmod {2^{2M}}\\
    z\equiv 0\pmod {2^M} \Rightarrow h(z)\equiv 0 \pmod {2^{2M}}\\
  \end{array}$$
  Given this property of $h$, $g(z)$ is the result of applying $h$ 
  recursively $m=\log M$
  times to $f(z)$.  The claimed property of $g(z)$ follows from the property
  of $h$.  Consider the running time of the underlying NTM machine whose number
  of accepting paths is $g$. Each application of $h$ increases the 
  running time by a constant factor, so overall $g$ is a factor 
  $2^{O(m)}=M^{O(1)}$ slower than $f$ - thus $g\in\SHARPP$.

  All that remains is to prove the claimed property of $h$.  Suppose 
  $z\equiv b\pmod {2^M}$, that is $z=q 2^M+b$ for some integer $q$.  Then 
  if we look at the expansion of $h(z)$ and remove all terms with a 
  factor of $2^{2M}$ or higher power of $2^M$, we get 
  $h(z)\equiv 4(3 b^2 q2^M+b^3)+3(4 b^3 q2^M+b^4)\pmod {2^{2M}}$.  
  For $b=0$, this gives us $0\pmod {2^{2M}}$, and for 
  $b=-1$, $-1 \pmod {2^{2M}}$.
\end{proof}


\section{Interactive Proof Systems}
\begin{definition}[Interactive Proof Systems]
  An interactive proof system for $L$ is a \emph{protocol} $(P,V)$,
  where $P$ is called the \emph{prover}, and $V$ is called the \emph{verifier}.
  $P$ is an all-powerful(\emph{i.e.}, 
  no restrictions on its computational resources), 
  randomized Turing machine, and $V$ is a randomized
  Turing machine running in time polynomial in the input length. In a protocol
  $(P,V)$, we have:
  \begin{enumerate}
  \item $P,V$ have read-only access to the input $x$.
  \item $P,V$ have read-only access to separate random-bit tapes.
  \item $P$ can write messages on tape $T_{P\rightarrow V}$ which $V$ has read
    access to.
  \item $V$ can write messages to $P$ on tape $T_{V\rightarrow P}$ which $P$ has 
    read access to.
  \item $x\in L$ iff $V$ accepts.
  \item At any one time, exactly one of $V$ and $P$ is active, and the 
    protocol defines how they take turns being active.
  \end{enumerate}

  The protocol $(P,V)$ also
  has to satisfy the following conditions:
  \begin{itemize}
  \item completeness(easy to prove membership of members):
    $$
    x\in L \implies \Pr[(V\leftrightarrow P)\ accepts\ x]\geq c
    $$ 
  \item soundness(hard to prove membership of non-members):
    $$
    x\notin L \implies (\forall P') \Pr[(V\leftrightarrow P')\ accepts\ x]\leq s
    $$
  \end{itemize}
  where the probabilities are over all coin flips of $P$ and $V$; 
  $(V\leftrightarrow P)$ refers to an interaction between the $P$ and $V$; 
  $c,s$ are the \emph{completeness} and \emph{soundness} parameters 
  of the interactive proof system, respectively. $c$ is normally set to 2/3
  and $s$ to 1/3. 
\end{definition}

  For the soundness condition, 
  we choose to quantify over all provers since the critical issue is that the
  verifier itself needs to be sufficiently robust even 
  against ``malicious'' provers that do not follow the protocol. Note that
  we can also apply the amplification technique to boost the probability of 
  deciding correctly, and the verifier would still be poly-time. For 
  completeness, $c=1$ means \emph{perfect completeness} and this means that no
  true statement is rejected, and is something we strive for.

  We make the following observations:
  \begin{enumerate}
  \item Randomness for $P$ is not essential. For each turn it takes,
    since it is all-powerful, it can figure out the coin flips that will 
    maximize the probability of the verifier accepting, and perform the 
    computation corresponding to those coin flips.
  \item On the other hand, the randomness of $V$ is essential, as 
    otherwise, we get only NP. If $V$ is
    deterministic, then it accepts/rejects with probability 1. Then, using
    the above fact that we can assume $P$ is deterministic, and that
    $c>0$, we get that $(V\leftrightarrow P)$ always accepts members of $L$. 
    Since $V$ can only read and write a polynomial number of symbols, the 
    length of the transcript of the interaction $(V\leftrightarrow P)$ is
    polynomial in the length of $x$, and is a polynomial-length 
    certificate of $x$'s membership. In particular, the sequence of responses
    of $P$ convinces $V$ of $x$'s membership.
  \item If we assume perfect soundness, we get NP as well. This is because
    $x\in L$ iff there exists a sequence of random ``questions'' by the 
    verifier and a sequence of ``answers'' by $P$ that convinces $V$ of $x$'s
    membership. The converse holds by the assumption of perfect soundness. The
    other direction has a similar proof as above.
  \item Without interaction, since the verifier does not receive any information
    from the prover, we get BPP.
  \item By requiring the verifier's random bit tape to be separate from the
    prover's, the proofs we defined are actually \emph{private coin} interactive
    proofs. \emph{Public coin} interactive proofs are where the verifier tosses
    coins and reveals them to the prover after it's turn is up.
  \end{enumerate}
  
  The corresponding complexity class is $\IP = \{L|L\ has\ an\ interactive\
  proof\ system\}$.

\section{Power of interaction}
Let us now illustrate what we can do with interaction and randomness in the 
verifier. In particular, we would like to be able to obtain short interactive 
proofs for problems for which we do not know a short standard proof. One example 
of such a problem is \emph{graph non-isomorphism}($GNI$). 

\begin{theorem}
  $GNI \in \IP$
\end{theorem}

Remember that $GI$ is one of the problems that we think are NP-intermediate. Also,
$GI$ has short standard proofs. This theorem by itself will not show that
the set of tautologies have short interactive proofs(coNP vs IP). 
$GI$ is probably not NP-complete, and equivalently, $GNI$ is probably not coNP-complete. In fact, 
we will give some evidence that $GI$ is not NP-complete.

Before we begin with the proof, we give an intuitive analogy for the way the IP 
protocol for $GNI$ works. One day, Merlin shows a sword to King Arthur and 
claims that it is Excalibur.
However, Arthur is unconvinced since to him it looks exactly like his own sword.
So, Arthur would like Merlin to convince him that at least he could tell
the difference between Excalibur and Arthur's sword. To this end, Arthur turns 
around, hides the swords and flips a coin. Based on the coin flip, he produces
one of the swords and asks Merlin whether it is the purported Excalibur or 
Arthur's sword. If Merlin answers incorrectly, then Arthur knows that Merlin had
lied. Otherwise, he repeats the procedure until he is convinced. 

Note that the usage of the name ``Arthur'' for the verifier and ``Merlin'' for the
prover is standard in the literature, but for public coin systems. The system 
below uses private coins.

\begin{proof}[Proof Sketch]
  Given 2 graphs $(G_0,G_1)$, we would like to show that they are non-isomorphic.
  An initial idea, based on the analogy above, is to have $V$ flip a coin, 
  produce one of the graphs $G$ based on the coin flip and ask $P$ which of 
  $G_0,G_1$ it is. But this is too easy since $V$ could compare $G$ with 
  $G_0,G_1$ by itself. So, instead we have $V$ pick $G$ at random, permute the 
  vertices of $G$ randomly, and ask $P$ to identify $G$. 

  Using $\equiv$ to denote isomorphism, if $G_0 \not\equiv G_1$, then $P$ can 
  identify $G$ by trying all permutations on $G_0,G_1$ and since 
  $G_0 \not\equiv G_1$
  exactly one permutation on exactly one of the 2 graphs give $G$. Otherwise,
  there exists permutations $\pi, \sigma$ such that $\pi(G_0)=\sigma(G_1)=G$, and 
  so
  $P$ has no way of identifying which of $G_0,G_1$ was used to produce $G$. The
  best it can do then is flip a coin and guess an answer.

  So, this protocol satisfies perfect completeness and has $s \geq 1/2$. We
  can decrease $s$ by increasing the number of rounds.
\end{proof}

We remark that since the verifier is essentially requiring the prover to determine
the result of its coin toss, it is crucial that the protocol uses private coins. 
We next consider interactive protocols that remain secure even when the 
verifier's random coins are made public.  Although the above protocol for
$GNI$ does not work in this setting, there is an alternate protocol that does
work with public coins.

\section{Bounded-round interactive proof systems}

We start with the formal definition of AM.  In addition to requiring public
coins, we limit the number of rounds of interaction between the verifier
and prover.

\begin{definition}
  AM is a public coin system in which Arthur moves first. He flips some coins
  to determine what to ask Merlin. Arthur then runs a deterministic predicate
  on the coins, Merlin's reply and the input. 
  
  Formally, a language $L$ is in AM if for some $V\in \P$:
  $$
  x\in L \implies \Pr_{|z|=n^c}[(\exists y\in \Sigma^{n^c})V(x,y,z)]\geq 2/3$$$$
  x\notin L \implies \Pr_{|z|=n^c}[(\exists y\in \Sigma^{n^c})V(x,y,z)]\leq 1/3
  $$
\end{definition}

Now we present the AM protocol for $GNI$.

\begin{theorem}
  $GNI \in AM$
\end{theorem}

  Firstly, we review the \emph{Lower Bound Protocol}. We have some subset 
  $S_x\subseteq \{0,1\}^n$ whose size we would like to estimate. We have
  a universal family of hash functions from $n$ bits to $m$ bits,
  where the range of the hash functions is roughly the same as the size of 
  $S_x$.
  Then, there is a good chance that a hash function chosen randomly from that 
  family will map $S_x$ ``evenly'' on $\{0,1\}^m$. In particular, a few hash 
  functions from that family will suffice to cover $\{0,1\}^m$ as an image of
  $S_x$. The key point is that if $S_x$ is sufficiently big relative to 
  $\{0,1\}^m$, then it is possible, otherwise we need much more functions.

  The modifications we will make to the protocol is that we will pick some 
  $l^2$ points in the range at random, for some parameter $l$. And now, we
  would like to determine if we can pick $l$ hash functions such that 
  each of the selected points is in the image of $S_x$ under one of the chosen
  hash functions. We saw in last lecture that this gives a $\Sigma_2^p$ predicate.

  We can obtain from this an AM protocol to distinguish between the case 
  when $|S_x| \geq 2^m$ and the case when $|S_x| \leq 2^{m-1}$. Arthur picks
  some points $p_i$ in the range uniformly at random and reveals them to Merlin.
  Merlin then responds with hash functions $h_i$ and points $p'_i$ in $S_x$ 
  along with certificates of their membership in $S_x$. Finally, Arthur verifies 
  the membership of points $p'_i$ in $S_x$ and that the image of $p'_i$ under the 
  hash functions indeed covers all the points $p_i$.

  Applying some modifications to the analysis of the original protocol gives
  us the following results:
  the AM protocol accepts with probability 1 in the case that 
  $|S_x| \geq 2^m$, and in the other case accepts with probability 
  at most 1/3.

\begin{proof}[Proof sketch]
  Define $S_i = \{ H | H \equiv G_i\}$ and $S = S_0 \cup S_1$.

  The key property that we use is that if $G_0 \equiv G_1$, then 
  $S_0 = S_1$ so $|S| = |S_0| = |S_1|$, and otherwise, 
  $|S| \geq 2\min\{|S_0|,|S_1|\}$. 

  Since for $GNI$, we would like to distinguish between 2 sets of size 
  differing by at least a factor of 2, we can adapt the above AM protocol
  for $GNI$. However, we need to know the sizes of $S_0,S_1,S$ to use it. By
  group theory, $|S_i||Aut(G_i)|=n!$ since $S_i$ are the cosets of the subgroup
  $Aut(G_i)$ in the symmetric group on $n$ points.

  Define $T_i = \{(H,\pi)|H\equiv G_i\ and\ \pi\in Aut(G_i)\}$ and 
  $T = T_0\cup T_1$. By the above, $|T_i| = n!$. So, if $G_0\equiv G_1$, $|S|=n!$
  and otherwise $|S|=2n!$. 

  Since we have a constant factor gap in the sizes, we can use approximate 
  counting to distinguish the 2 sets, such that the larger set 
  corresponds to the non-isomorphic case. We modify it into an AM protocol as
  above and we are done.
\end{proof}


\section{Next Lecture}
Next time we'll show that if the graph isomorphism problem is \NP-complete then the polynomial hierarchy collapses to the second
level. Our proof will use the fact that $GNI \in \AM$. We'll also show that $\coNP \subseteq \IP$. The result that we're aiming for
is $\PSPACE = \IP$.



\end{document}