lect18 - 6.841 Advanced Complexity Theory Lecture 18...

6.841 Advanced Complexity Theory Apr 13, 2009
Lecture 18
Lecturer: Madhu Sudan Scribe: Jinwoo Shin
In this lecture, we will discuss about PCP ( probabilistically checkable proof ). We first overview the history
followed by the formal definition of PCP and then study its connection to inapproximability results.
1 History of PCP
Interactive proofs were first independently investigated by Goldwasser-Micali-Rackoff and Babai. Goldwasser-
Micali-Wigderson were focused on the cryptographic implications of this technique; they are interested in
zero-knowledge proofs, which prove that one has a solution of a hard problem without revealing the solution
itself. Their approach is based on the existence of one-way functions.
Another development on this line was made by BenOr-Goldwasser-Kilian-Wigderson who introduced
several provers. 2 IP has two provers who may have agreed on their strategies before the interactive proof
starts. However, during the interactive proof, no information-exchange is allowed between two provers. The
verifier can them questions in any order. The authors showed that with 2 provers, zero-knowledge proofs
are possible without assuming the existence of one-way functions.
Clearly, 2 IP is at least as powerful as IP since the verifier could just ignore the second prover. Further-
more, one can define 3 IP , 4 IP , . . . , MIP and naturally ask whether those classes get progressively more
powerful. It turns out that the answer is no by Fortnow-Rompel-Sipser. They proved that 2 IP = 3 IP =
. . . = MIP = OIP , where OIP is called oracle interactive proof . OIP is an interactive proof system with a
memoryless oracle; all answers are committed to the oracle before the interactive proof starts and the oracle
just answer them (without considering the previous query-history) when the verifier query them.
Now we consider the difference between OIP and NEXPT IME . They both have an input x of n bits
and a proof(certificate) π of length 2 n
c
for some constant c . The difference relies on the verifier V . If
L ∈ NEXPT IME , there exists a deterministic-exptime V such that
• If x ∈ L , then there exists a π such that V ( x, π ) accepts,
• If x / ∈ L , then ∀ π , V ( x, π ) rejects.
Similarly, if L ∈ OIP , there exists a randomized-polytime V such that
• If x ∈ L , then there exists a π such that V ( x, π ) accepts with high probability,
• If x / ∈ L , then ∀ π , V ( x, π ) accepts with low probability.
Hence the relation OIP ⊆ NEXPT IME is obvious since one can build the verifier for NEXPT IME
by simulating all random coins of V in OIP . More interestingly, Babai-Fortnow-Lund showed the other
direction OIP ⊇ NEXPT IME . Using this relation MIP = OIP = NEXPT IME , Feige-Goldwasser-