Upload
wilbur
View
21
Download
1
Embed Size (px)
DESCRIPTION
Low-End Uniform Hardness vs. Randomness Tradeoffs for Arthur-Merlin Games. Ronen Shaltiel, University of Haifa Chris Umans, Caltech. coin tosses. message. Arthur-Merlin Games [B,GMR]. - PowerPoint PPT Presentation
Citation preview
Low-End Uniform Hardness vs. Randomness Tradeoffs for Arthur-Merlin Games.
Ronen Shaltiel, University of HaifaChris Umans, Caltech
Arthur-Merlin Games [B,GMR]
Interactive games in which the all-powerful prover Merlin attempts to prove some statement to a probabilistic poly-time verifier.
Merlin Arthur“xL”
toss coinscoin tosses
message
I accept
Arthur-Merlin Games [B,GMR]
Completeness: If the statement is true then Arthur accepts.
Soundness: If the statement is false then Pr[Arthur accepts]<½.
Merlin Arthur“xL”
toss coinscoin tosses
message
I accept
Arthur-Merlin Games [B,GMR]
Completeness: If the statement is true then Arthur accepts.
Soundness: If the statement is false then Pr[Arthur accepts]<½.
The class AM: All languages L which have an Arthur-Merlin protocol.
Contains many interesting problems not known to be in NP.
Derandomization goals: Efficient deterministic
simulation of prob. algs. BPP=P BPPSUBEXP=DTIME(2no(1))
Efficient nondeterministic simulation of prob. protocols
AM=NP AMNSUBEXP=NTIME(2no(1))
• We don’t know how to separate BPP from NEXP.
• Such a separation implies certain circuit lower bounds [IKW01,KI02].
Hardness versus Randomness
Initiated by [BM,Yao,Shamir,NW].
Assumption: hard functions exist.
Conclusion: Derandomization.
A lot of works: [BM82,Y82,HILL,NW88,BFNW93, I95,IW97,IW98,KvM99,STV99,ISW99,MV99, ISW00,SU01,U02,TV02,GST03,SU05,U05,…]
A quick survey of (nonuniform) hardness/randomness tradeoffs
Assumption: There exists a function in E=DTIME(2O(l)) which is hard for “small” (size s(l)) circuits.
BPPAM
A hard function for:
Deterministic circuits
Nondeterministic circuits
High-end: s(l)=2Ω(l)
BPP=P [IW97,STV99]
AM=NP [KvM99,MV99,SU05]
Low-end:s(l)=lω(1)
BPPSUBEXP [BFNW93,SU01,U02]
AMNSUBEXP [SU01,SU05]
A quick survey of (uniform) hardness/randomness tradeoffs
Assumption: There exists a function in E=DTIME(2O(l)) which is hard for “small” (time s(l)) algorithms/protocols.
BPPAM
A hard function for:
Prob. algsAM protocols.
High-end: s(l)=2Ω(l)
BPP=P (*) [TV02*]
AM=NP (*) [GST03]
Low-end:s(l)=lω(1)
BPPSUBEXP (*) [IW98]
AMNSUBEXP (*)
This paper*
)*(The simulation only succeeds on “feasibly generated inputs.”
A low-end gap theorem for AM.
Informal statement: Either AM protocols are very strong. Or, AM protocols are somewhat weak.
Formal statement: Either E=DTIME(2O(l)) has Arthur-Merlin protocols
running in time 2(log l)3. Or, for every LAM there is a nondeterministic
machine M that runs in subexponential time and agrees with L on “feasibly generated inputs”.
No polynomial time machine can produce inputs on which M fails.
Should have been
poly(l)
Jargon: Just like [IW98]
paper but for AM instead of
BPP
A uniform hardness vs. randomness tradeoff for AM
Informal statement: Either AM protocols are very strong. Or, AM protocols are somewhat weak.
Formal statement: For l<s(l)<2l. Either E=DTIME(2O(l)) has Arthur-Merlin protocols
running in time s(l). Or, for every LAM there is a nondeterministic
machine M that runs in time 2O(l) and agrees with L on “feasibly generated inputs” of length n=s(l)1/(log(l)-loglog(s(l)))2.
No polynomial time machine can produce inputs on which M fails.
Should have been
Ω(1)
Motivation: weak unconditional derandomization
We believe that AM=NP (= Σ1). We only know that AM is in Σ3. Goal: Unconditional proof that AMΣ2
(or even AMΣ2-TIME(2no(1)). Conditional => Unconditional ?? Approach [GST03]:
Either AM is weak: AM=NP ⇒ AM⊆Σ2. Or AM is very strong: AM=E ⇒ ??? ⇒ AM=coAMΣ2. Missing step: remove “feasibly generated inputs”.
A low-end gap theorem for AM∩coAM.
Informal statement: Either AM∩coAM is very strong. Or, AM∩coAM is somewhat weak.
Formal statement: Either E=DTIME(2O(l)) has Arthur-Merlin protocols
running in time 2(log l)3. Or, for every LAM∩coAM there is a
nondeterministic machine M that runs in subexponential time and agrees with L on all inputs (not necessarily feasibly generated).
Should have been
poly(l)
Plan for rest of talk Explain the overall approach of getting
uniform hardness vs. randomness tradeoffs for AM (which is in [GST03]).
This approach uses a “hitting-set generator” construction by [MV99] which only works in the high end.
Main technical contribution of this paper is improving the [MV99] construction so that it works in the low-end.
Improvement uses “PCP tools” which were not used previously in this framework.
The high level approach (following [GST03])
The uniform tradeoff of [GST03]: resilient AM protocols
Arthur Merlin
nonuniform advice
Constructs nondet. Circuit C that is supposed to compute f
f(y)?= f(y)=b
witness showing C(y)=b
AM protocol verifying that C=f. (exists as f is complete for E)
C is supposed to define a function: For every y, C is supposed to have witnesses showing C(y)=0 or C(y)=1 but not both! (single valued circuit)
Use nonuniform tradeoffs for AM. Derandomization fails
=> hard function f has small nondeterministic circuits.
Want to show that: => f has small AM protocol.
Observation [GST03]: The [MV99] tradeoff has an AM protocol in which Arthur verifies that the circuit obtained is single-valued (defines a function).
Suppose Arthur could verify that this is indeed the
case.
The uniform tradeoff of [GST03]: Use nonuniform tradeoffs for
AM. Derandomization fails
=> hard function f has small nondeterministic circuits.
Want to show that: => f has small AM protocol.
Observation [GST03]: The [MV99] tradeoff has an AM protocol in which Arthur verifies that the circuit obtained is single-valued (defines a function).
=> AM protocol for f. Problem: The [MV99] generator
only works in the “high end”. Our contribution: Modify [MV99]
into a “low-end” generator.
Arthur Merlin
C is supposed to compute f
f(y)?= f(y)=b
witness showing C(y)=b
AM protocol verifying that C=f. (exists as f is complete for E)
AM protocol in which Arthur receives a certified valid circuit C
C is guaranteed to define a function: For every y, C is has witnesses showing C(y)=0 or
C(y)=1 but not both !
Abstraction: commit-and-evaluate AM protocols and resiliency.
Commit-and-evaluate AM protocols for function f(y).
Properties: Input y can be revealed to
Merlin after commit phase. Conformity: Honest Merlin
can make Arthur output f(y). Resiliency: Following
commit phase Merlin is (w.h.p) committed to some function g(y) (may differ from f).
Thm: If E has such AM protocols then E has standard AM protocols.
Arthur Merlin
f(y)?= f(y)=b
Evaluation phase: AM protocol that uses advice string and outputs a value v(y).
Commit phase: AM protocol generating “advice string”.
The big picture: How to derandomize an AM protocol
Nondet machine M(x) (supposed to accept
LAM) Use function f to
construct small “hitting set” of “pseudorandom strings”.
Run AM protocol on input x (using pseudorandom strings as random coins) and accept if all runs accept.
Proof of correctness by reduction
Suppose M fails on an input x.
Construct an efficient commit-and-evaluate AM protocol that uses x and conforms resiliently with f.
=> f has a standard efficient AM protocol.
Where do “feasibly generated inputs” come in?
How can Arthur obtain x ?
From his point of view x is a nonuniform advice string.
No problem if we only care about
inputs that can be “feasibly
generated” by some efficient TM.
Following [GST03]: In the case of
AM∩coAM we can trust Merlin to send
a “good” x.
This is where uniformity comes
in: Protocols rather than
circuits.
Improving Miltersen-Vinodchandran hitting set generator
(How to derandomize an AM language)
The MV hitting set generator
Nondet. Machine M(x): derandomizes AM protocol with m coins For every output string guess a response for Merlin and accept if Arthur accepts all of
them. x∊L ⇒ Merlin can answer any string ⇒ M accepts (no error). x∉L ⇒ Merlin can answer ½ strings ⇒ M may err.
truth table f:{0,1}l→{0,1}
field size q=102l/2
p(x,y)
deg. 2l/2
A
{0,1}m
extractor
rows and
columns Z
small set
(≈2m)
deg 2l/2 polys
Hitting set
A commit-and-evaluate AM protocol for p.
truth table f:{0,1}l→{0,1}
field size q=102l/2
p(x,y)
deg. 2l/2
A
{0,1}m
extractor
rows and columns
Z
very small set
truth table f:{0,1}l→{0,1}
field size q=102l/2
p(x,y)
deg. 2l/2 A
{0,1}m
extractor
rows and
columns Z
small set
(≈2m)
A commit-and-evaluate AM protocol for p.
Conformity: v Resiliency: v (RS code).
w.h.p. over S ∀univariate poly g∊Z, g(S) is unique.
Efficiency: (on high end m=2Ω(l)).
Protocol runs in time poly(m). Protocol requires passing
polynomials of degree 2l/2.
Arthur Merlin
p(x,y)=?
p(x,y)=b
commit phase:S∊RField of size mp(S2)
evaluation phase:• Both compute path to
(x,y)• ∀ line on path:p|line and witness
w Arthur checks:
• small set: p|line∊Z using w.
• consistency of p|line.
deg 2l/2 polys
deg 2l/2 polys truth table f:{0,1}l→{0,1}
field size q=102l/2
p(x,y)
deg. 2l/2 A
{0,1}m
extractor
rows and
columns Z
very small set
A commit-and-evaluate AM protocol for p.
Conformity: v Resiliency: v (RS code).
w.h.p. over S ∀univariate poly g∊Z, g(S) is unique.
Efficiency: (on high end m=2Ω(l)).
Protocol runs in time poly(m). Protocol requires passing
polynomials of degree 2l/2.
Arthur Merlin
commit phase:S∊RField of size mp(S2)
evaluation phase:• Both compute path to
(x,y)• ∀ line on path:p|line and witness
w Arthur checks:
• small set: p|line∊Z using w.
• consistency of p|line.
For low end (say
m=lO(1) ) we need to reduce degree
Can get deg=2l/d
using p(x1,..,xd)
with d variables .
S2→Sd |Sd|=2Ω(l) no
gain!
p(x,y)=?
p(x,y)=b
truth table f:{0,1}l→{0,1}
field size q=102l/2
p(x,y)
deg. 2l/2 A
{0,1}m
extractor
rows and
columns Z
very small set
The best of both worlds
Best of both worlds: Use p(x1,..,xd) deg 2l/d. Run MV as if p=p(x,y). Resiliency: v (RM code). Size of box=|S|2 ≈ m2.
doesn’t depend on d! Sending p|”line” costs 2l/2 bits.
Arthur Merlin
commit phase:S∊RField of size mp(S2)
evaluation phase:• Both compute path to
(x,y)• ∀ line on path:p|line and witness
w Arthur checks:
• small set: p|line∊Z using w.
• consistency of p|line.
deg 2l/2 polys
p(x,y)=?
p(x,y)=b
p(x1,..,xd/2;xd/
2+1,..,xd).
p|”line” has many
coefficients
Suppose p|”line”
could be sent more
efficiently:
p|”line” has small
(non-det) circuit
p|”line” has commit-and-
evaluate protocol
Arthur can verify that he gets a low-degree polynomial by
performing low-degree testing!
truth table f:{0,1}l→{0,1}
field size q=102l/2
p(x,y)
deg. 2l/2 A
{0,1}m
extractor
rows and
columns Z
very small set
Locally computable extractors
Story so far: Use polynomials p with
many variables and pretend they are bivariate.
Assume that p|”line” can be sent efficiently. (Not yet justified).
Is the AM protocol efficient?
Arthur Merlin
commit phase:S∊RField of size mp(S2)
evaluation phase:• Both compute path to
(x,y)• ∀ line on path:p|line and witness
w Arthur checks:
• small set: p|line∊Z using w.
• consistency of p|line.
deg 2l/2 polys
p(x,y)=?
p(x,y)=b
v
v
vv
v
X
Requires running the extractor on p|line(t) for all qd inputs t to p|line.
Need locally
computable
extractors!
• Thm: [V] no locally computable extractors for low-entropy.• We know that inputs to extractors are low-degree polynomials!• Can use extractor construction [SU01] which is locally computable.
• Thm: [V] no locally computable extractors for low-entropy.• We know that inputs to extractors are low-degree polynomials!• Can use extractor construction [SU01] which is locally computable.
v
Efficient AM protocol!
v
truth table f:{0,1}l→{0,1}
field size q=102l/2
p(x,y)
deg. 2l/2 A
{0,1}m
extractor
rows and
columns Z
very small set
Win-win analysis
Main ideas: Use polynomials p with many
variables and pretend they are bivariate.
Assume that p|”line” can be sent efficiently. (Not yet justified).
Use locally computable extractors (exist when inputs are low degree polynomials.
Arthur Merlin
commit phase:S∊RField of size mp(S2)
evaluation phase:• Both compute path to
(x,y)• ∀ line on path:p|line and witness
w Arthur checks:
• small set: p|line∊Z using w.
• consistency of p|line.
deg 2l/2 polys
p(x,y)=?
p(x,y)=b
v
v
vv
v
Efficient AM protocol!
????
Intuition: If p|”line” doesn’t have an efficient
commit-and-evaluate protocol then it’s better to use it as the hard function. (It is over less variables!)Recursive win-win analysis a-la [ISW99].
The recursive HSGtruth table of f
…
each row and column
ALL rows and
columns
to extractor
(2l bits)
(2l/2 bits each )
Recursive commit-and-evaluate AM protocol
truth table of f
…
• Arthur: random m x m box• Merlin: commits to top board• ! (input revealed)• Arthur/ Merlin: commit to each
line’s board• Arthur: random points for
checking lines• Merlin: commits to lines…
Parameters
Start with 2l bit truth table < log l levels # “lines” ≈ 2O(l). v Efficiency of AM protocol:
poly(m) blow-up at each level ) poly(m)log l
running time convert O(log l) rounds to two rounds )
poly(m)(log l)2 time for final AM protocol
Conclusions Key ideas:
commit-and-evaluate protocols as abstraction. operate implicitly on lines.
PCP tools: low-degree testing, self-correction. “local extractor” when know in advance it will
applied to low-degree polynomials. “Recursive win-win analysis” allows large objects to
have short descriptions. Open problems:
improve poly(m)(log l)2 to poly(m) (“optimal”). remove “feasibly generated inputs” from main
theorem. ⇒ Uncondtional proof that AM⊆Σ2 (TIME(2no(1))).
That’s it…