This preview shows pages 1–2. Sign up to view the full content.
This preview has intentionally blurred sections. Sign up to view the full version.View Full Document
Unformatted text preview: Notes on Complexity Theory Last updated: November, 2011 Lecture 21 Jonathan Katz 1 Probabilistically Checkable Proofs Work on interactive proof systems motivates further exploration of non-interactive proof systems (e.g., the class NP ). One specific question is: how many bits of the proof does the verifier need to read? Note that in the usual certificate-based definition of NP , the deterministic “verifier” reads the entire certificate, and correctness and soundness hold with probability 1. If we allow the verifier to be probabilistic, and are willing to tolerate non-zero soundness error, is it possible to have the verifier read fewer bits of the proof? (Turning as usual to the analogy with mathematical proofs, this would be like probabilistically verifying the proof of a mathematical theorem by reading only a couple of words of the proof!) Amazingly, we will see that it is possible to have the verifier read only a constant number of bits while being convinced with high probability. Abstracting the above ideas, we define the class PCP of probabilistically checkable proofs : Definition 1 Let r,q be arbitrary functions. We say L ∈ PCP ( r ( · ) ,q ( · )) if there exists a probabilistic polynomial-time verifier V such that: • V π ( x ) uses O ( r ( | x | )) random coins and reads O ( q ( | x | )) bits of π . 1 • If x ∈ L then there exists a π such that Pr[ V π ( x ) = 1] = 1 . • If x 6∈ L then for all π we have Pr[ V π ( x ) = 1] < 1 / 2 . Some remarks are in order: • One can view a probabilistically checkable proof as a form of interactive proof where the (cheating) prover is restricted to committing to its answers in advance (rather than choosing them adaptively based on queries in previous rounds). Since the power of the cheating prover is restricted but the abilities of an honest prover are unaffected, IP ⊆ PCP ( poly , poly ) def = S c PCP ( n c ,n c ). In particular, PSPACE ⊆ PCP ( poly , poly ). • Since V runs in polynomial time (in | x | ), the length of i (cf. footnote 1) is polynomial and so it is only meaningful for the length of π to be at most exponential in | x | . In fact, if the verifier uses r ( n ) random coins and makes q ( n ) queries then we may as well assume that any proof π for a statement of length n satisfies | π | ≤ 2 r ( n ) · q ( n ). • The soundness error can, as usual, be reduced by repetition. The completeness condition could also be relaxed (as long as there is an inverse polynomial gap between the acceptance probabilities when x ∈ L and when x 6∈ L ). In either case, the parameters r,q may be affected. 1 Formally, V has an oracle tape on which it can write an index i and obtain the i th bit of π in the next step....
View Full Document
This note was uploaded on 01/13/2012 for the course CMSC 652 taught by Professor Staff during the Fall '08 term at Maryland.
- Fall '08