Probabilistically Checkable Proofs Research Articles

Shielding Probabilistically Checkable Proofs: Zero-Knowledge PCPs from Leakage Resilience.

Probabilistically Checkable Proofs (PCPs) allows a randomized verifier, with oracle access to a purported proof, to probabilistically verify an input statement of the form “” by querying only a few proof bits. Zero-Knowledge PCPs (ZK-PCPs) enhance standard PCPs to additionally guarantee that the view of any (possibly malicious) verifier querying a bounded number of proof bits can be efficiently simulated up to a small statistical distance. The first ZK-PCP construction of Kilian, Petrank and Tardos (STOC 1997), and following constructions employing similar techniques, necessitate that the honest verifier makes several rounds of queries to the proof. This undesirable property, which is inherent to their technique, translates into increased round complexity in cryptographic applications of ZK-PCPs. We survey two recent ZK-PCP constructions—due to Ishai, Yang and Weiss (TCC 2016-A), and Hazay, Venkitasubramaniam and Weiss (ITC 2021)—in which the honest verifier makes a single round of queries to the proof. Both constructions use entirely different techniques compared to previous ZK-PCP constructions, by showing connections to the seemingly-unrelated notion of leakage resilience. These constructions are incomparable to previous ZK-PCP constructions: while on the one hand the honest verifier only makes a single round of queries to the proof, these ZK-PCPs either obtain a smaller (polynomial) ratio between the query complexity of the honest and malicious verifiers or obtain a weaker ZK guarantee in which the ZK simulator is not necessarily efficient.

Succinct Non-Interactive Arguments via Linear Interactive Proofs

Succinct non-interactive arguments (SNARGs) enable verifying NP statements with lower complexity than required for classical NP verification. Traditionally, the focus has been on minimizing the length of such arguments; nowadays, researchers have focused also on minimizing verification time, by drawing motivation from the problem of delegating computation. A common relaxation is a preprocessing SNARG, which allows the verifier to conduct an expensive offline phase that is independent of the statement to be proven later. Recent constructions of preprocessing SNARGs have achieved attractive features: they are publicly-verifiable, proofs consist of only O(1) encrypted (or encoded) field elements, and verification is via arithmetic circuits of size linear in the NP statement. Additionally, these constructions seem to have “escaped the hegemony” of probabilistically-checkable proofs (PCPs) as a basic building block of succinct arguments. We present a general methodology for the construction of preprocessing text{ SNARG } s, as well as resulting new efficiency features. Our contribution is threefold: (1)We introduce and study a natural extension of the interactive proof model that considers algebraically-bounded provers; this new setting is analogous to the common study of algebraically-bounded “adversaries” in other fields, such as pseudorandomness and randomness extraction. More concretely, in this work we focus on linear (or affine) provers, and provide several constructions of (succinct two-message) linear interactive proofs (LIPs) for NP. Our constructions are based on general transformations applied to both linear PCPs (LPCPs) and traditional “unstructured” PCPs.(2)We give conceptually simple cryptographic transformations from LIPs to preprocessing SNARGs, whose security can be based on different forms of linear targeted malleability (implied by previous knowledge assumptions). Our transformations convert arbitrary (two-message) LIPs into designated-verifier SNARGs, and LIPs with degree-bounded verifiers into publicly-verifiable SNARGs. We also extend our methodology to obtain zero-knowledge LIPs and SNARGs. Our techniques yield SNARGs of knowledge and thus can benefit from known recursive composition and bootstrapping techniques.(3)Following this methodology, we exhibit several constructions achieving new efficiency features, such as “single-ciphertext preprocessing SNARGs.” We also offer a new perspective on existing constructions of preprocessing SNARGs, revealing a direct connection of these to LPCPs and LIPs.

Smooth and Strong PCPs

Probabilistically checkable proofs (PCPs) can be verified based only on a constant amount of random queries, such that any correct claim has a proof that is always accepted, and incorrect claims are rejected with high probability (regardless of the given alleged proof). We consider two possible features of PCPs: We prove that all sets in $$\mathcal{NP}$$ have PCPs that are both smooth and strong, are of polynomial length and can be verified based on a constant number of queries. This is achieved by following the proof of the PCP theorem of Arora et al. (JACM 45(3):501–555, 1998), providing a stronger analysis of the Hadamard and Reed–Muller based PCPs and a refined PCP composition theorem. In fact, we show that any set in $$\mathcal{NP}$$ has a smooth strong canonical PCP of Proximity (PCPP), meaning that there is an efficiently computable bijection of $$\mathcal{NP}$$ witnesses to correct proofs. This improves on the recent construction of Dinur et al. (in: Blum (ed) 10th innovations in theoretical computer science conference, ITCS, San Diego, 2019) of PCPPs that are strong canonical but inherently non-smooth. Our result implies the hardness of approximating the satisfiability of “stable” 3CNF formulae with bounded variable occurrence, where stable means that the number of clauses violated by an assignment is proportional to its distance from a satisfying assignment (in the relative Hamming metric). This proves a hypothesis used in the work of Friggstad, Khodamoradi and Salavatipour (in: Chan (ed) Proceedings of the 30th annual ACM-SIAM symposium on discrete algorithms, SODA, San Diego, 2019), suggesting a connection between the hardness of these instances and other stable optimization problems.

Review of Introduction To Property Testing by Oded Goldreich

The area of property testing is concerned with designing methods to decide whether an input object possesses a certain property or not. Usually the problem is described as a promise problem: either the input object has the property or the input object is far from possessing the property. Here, the meaning of object being far from possessing the property is based on a specified and meaningful notion of distance. The main objective of property testing is accomplishing this decision making by developing a super efficient tester. A tester that reads through the entire object can easily determine whether the property is satisfied or not. However, one wishes the tester to probe the input at very few random locations and determine whether the property is satisfied. As such, randomness is a necessary ingredient for testing and having the tester erring on few instances is a necessary price to pay for designing highly efficient methodologies. Much of the literature on property testing has focused on two types of objects: functions and graphs. Naturally they form the major portion of the book: functions are discussed from Chapters 2 to 6 and graph properties are discussed from Chapters 8 to 10. The final three chapters focus on distribution testing, probabilistically checkable proofs (PCPs) and locally testable codes, and ramifications of property testing on other related topics in Computer Science and Statistics. A separate chapter is devoted to query lower bound techniques.

SETH vs Approximation

Our story is about hardness of problems in P, but its roots begin with two algorithmic approaches that have been developed to cope with NP-hard problems: approximation algorithms and fasterthan- brute-force algorithms. Approximation algorithms were proposed as a response for NP-hardness almost immediately (in historical perspective of almost half a century), and have been one of the most celebrated success stories of our eld. An outstanding complexity result in this area, which has since turned into a sub- eld of its own, is the Probabilistically Checkable Proof (PCP) Theorem. For many problems like Max-3-SAT we now have nearly tight hardness-of-approximation results.

Sliding Scale Conjectures in PCP

The PCP (i.e., Probabilistically Checkable Proofs) Theorem [8, 7, 22, 5, 4] states that any mathematical proof can be converted to a format that can be checked by a veri er making only a constant number of queries to the proof. The veri er picks the queries in a randomized way and might err with low probability.

The Constant Inapproximability of the Parameterized Dominating Set Problem

A set $D$ of vertices of a graph $G$ is a dominating set if every vertex of $G$ is contained in $D$ or adjacent to some vertex of $D$. The number of vertices in a smallest dominating set of $G$ is denoted by $\gamma(G)$. We prove that, under the assumption ${FPT}\ne {W}[1]$ from parameterized complexity, for any constant $c\in \mathbb{N}^+$ and computable function $f: \mathbb{N}\to \mathbb{N}$ there is no algorithm which on every input graph $G$ finds a dominating set of size at most $c\cdot \gamma(G)$ in $f(\gamma(G))\cdot |G|^{O(1)}$ time. In other words, any constant approximation of the parameterized dominating set problem is ${W}[1]$-hard. Furthermore, assuming the exponential time hypothesis (ETH) [R. Impagliazzo and R. Paturi, J. Comput. System Sci., 62 (2001), pp. 367--375], we can even rule out the existence of a $f(\gamma(G))\cdot |G|^{{({log}\;\gamma(G))}^{{\varepsilon}/{12}}}$-time algorithm which on every input graph $G$ outputs a dominating set of size at most $\sqrt[3+\varepsilon]{{log}\; (\gamma(G))} \cdot \gamma(G)$ for every $0<\varepsilon<1$. Our hardness reduction is built on the second author's recent ${W}[1]$-hardness proof of the biclique problem [B. Lin, The parameterized complexity of $k$-Biclique, in Proceedings of the 26th Annual ACM--SIAM Symposium on Discrete Algorithms, SODA 2015 (San Diego, CA), ACM, New York, SIAM, Philadelphia, 2015, pp. 605--615]. This yields, among other things, a proof without the probabilistically checkable proof (PCP) machinery that the classic dominating set problem has no polynomial time constant approximation under ETH.

心配症の数学者と時間に追われる研究者とに贈るコンピュータ・サイエンス : ゼロ知識証明と確率検査証明-(1)

心配症の数学者と時間に追われる研究者とに贈るコンピュータ・サイエンス : ゼロ知識証明と確率検査証明-(1)

心配症の数学者と時間に追われる研究者とに贈るコンピュータ・サイエンス : ゼロ知識証明と確率検査証明-(2)

心配症の数学者と時間に追われる研究者とに贈るコンピュータ・サイエンス : ゼロ知識証明と確率検査証明-(2)

Hardness of Coloring 2-Colorable 12-Uniform Hypergraphs with $2^{(\log {n})^{\Omega(1)}}$ Colors

We show that it is quasi-NP-hard to color 2-colorable 12-uniform hypergraphs with $2^{(\log n)^{\Omega(1) }}$ colors where $n$ is the number of vertices. Previously, Guruswami Harsha, H\aa stad, Srinivasan, and Varma showed that it is quasi-NP-hard to color 2-colorable 8-uniform hypergraphs with $2^{2^{\Omega(\sqrt{\log \log n})}}$ colors. Their result is obtained by composing a standard outer probabilistically checkable proof (PCP) with an inner PCP based on the short code of superconstant degree. Our result is instead obtained by composing a new outer PCP with an inner PCP based on the short code of degree two.

Constant Rate PCPs for Circuit-SAT with Sublinear Query Complexity

The PCP theorem [Arora et al. 1998; Arora and Safra 1998] says that every NP-proof can be encoded to another proof, namely, a probabilistically checkable proof (PCP), which can be tested by a verifier that queries only a small part of the PCP. A natural question is how large is the blow-up incurred by this encoding, that is, how long is the PCP compared to the original NP-proof? The state-of-the-art work of Ben-Sasson and Sudan [2008] and Dinur [2007] shows that one can encode proofs of length n by PCPs of length n · poly log n that can be verified using a constant number of queries. In this work, we show that if the query complexity is relaxed to n ε , then one can construct PCPs of length O ( n ) for circuit-SAT, and PCPs of length O ( t log t ) for any language in NTIME( t ). More specifically, for any ε &gt; 0, we present (nonuniform) probabilistically checkable proofs (PCPs) of length 2 O (1/ε) · n that can be checked using n ε queries for circuit-SAT instances of size n . Our PCPs have perfect completeness and constant soundness. This is the first constant-rate PCP construction that achieves constant soundness with nontrivial query complexity ( o ( n )). Our proof replaces the low-degree polynomials in algebraic PCP constructions with tensors of transitive algebraic geometry (AG) codes. We show that the automorphisms of an AG code can be used to simulate the role of affine transformations that are crucial in earlier high-rate algebraic PCP constructions. Using this observation, we conclude that any asymptotically good family of transitive AG codes over a constant-sized alphabet leads to a family of constant-rate PCPs with polynomially small query complexity. Such codes are constructed in the appendix to this article for the first time for every message length, building on an earlier construction for infinitely many message lengths by Stichtenoth [2006].

Combinatorial PCPs with Short Proofs

The Probabilistically Checkable Proof (PCP) theorem (Arora and Safra in J ACM 45(1):70---122, 1998; Arora et al. in J ACM 45(3):501---555, 1998) asserts the existence of proofs that can be verified by reading a very small part of the proof. Since the discovery of the theorem, there has been a considerable work on improving the theorem in terms of the length of the proofs, culminating in the construction of PCPs of quasi-linear length, by Ben-Sasson and Sudan (SICOMP 38(2):551---607, 2008) and Dinur (J ACM 54(3):241---250, 2007). One common theme in the aforementioned PCP constructions is that they all rely heavily on sophisticated algebraic machinery. The aforementioned work of Dinur (2007) suggested an alternative approach for constructing PCPs, which gives a simpler and arguably more intuitive proof of the PCP theorem using combinatorial techniques. However, this combinatorial construction only yields PCPs of polynomial length and is therefore inferior to the algebraic constructions in this respect. This gives rise to the natural question of whether the proof length of the algebraic constructions can be matched using the combinatorial approach. In this work, we provide a combinatorial construction of PCPs of length $${n\cdot\left(\log n\right)^{O(\log\log n)}}$$n·lognO(loglogn), coming very close to the state-of-the-art algebraic constructions (whose proof length is $${n\cdot\left(\log n\right)^{O(1)}}$$n·lognO(1)). To this end, we develop a few generic PCP techniques which may be of independent interest. It should be mentioned that our construction does use low-degree polynomials at one point. However, our use of polynomials is confined to the construction of error-correcting codes with a certain simple multiplication property, and it is conceivable that such codes could be constructed without the use of polynomials. In addition, we provide a variant of the main construction that does not use polynomials at all and has proof length $${n^{4} \cdot\left(\log n\right)^{O(\log\log n)}}$$n4·lognO(loglogn). This is already an improvement over the aforementioned combinatorial construction of Dinur.

Label Cover Instances with Large Girth and the Hardness of Approximating Basic k -Spanner

We study the well-known Label Cover problem under the additional requirement that problem instances have large girth. We show that if the girth is some k , the problem is roughly 2 log 1-ϵ n)/k hard to approximate for all constant ϵ &gt; 0. A similar theorem was claimed by Elkin and Peleg [2000] as part of an attempt to prove hardness for the basic k -spanner problem, but their proof was later found to have a fundamental error. Thus, we give both the first nontrivial lower bound for the problem of Label Cover with large girth as well as the first full proof of strong hardness for the basic k -spanner problem, which is both the simplest problem in graph spanners and one of the few for which super-logarithmic hardness was not known. Assuming NP ⊆ BPTIME (2 polylog(n) , we show (roughly) that for every k ⩾ 3 and every constant ϵ &gt; 0, it is hard to approximate the basic k -spanner problem within a factor better than 2 log 1-ϵ n)/k . This improves over the previous best lower bound of only Ω(log n )/ k from Kortsarz [2001]. Our main technique is subsampling the edges of 2-query probabilistically checkable proofs (PCPs), which allows us to reduce the degree of a PCP to be essentially equal to the soundness desired. This turns out to be enough to basically guarantee large girth.

Shorter arithmetization of nondeterministic computations

Arithmetizing computation is a crucial component of many fundamental results in complexity theory, including results that gave insight into the power of interactive proofs, multi-prover interactive proofs, and probabilistically-checkable proofs. Informally, an arithmetization is a way to encode a machine's computation so that its correctness can be easily verified via few probabilistic algebraic checks.We study the problem of arithmetizing nondeterministic computations for the purpose of constructing short probabilistically-checkable proofs (PCPs) with polylogarithmic query complexity. In such a setting, a PCP's proof length depends (at least!) linearly on the length, in bits, of the encoded computation. Thus, minimizing the number of bits in the encoding is crucial for minimizing PCP proof length.In this paper we show how to arithmetize any T-step computation on a nondeterministic Turing machine by using a polynomial encoding of lengthO(T⋅(log⁡T)2). Previously, the best known length was Ω(T⋅(log⁡T)4). For nondeterministic random-access machines, our length is O(T⋅(log⁡T)2+o(1)), while prior work only achieved Ω(T⋅(log⁡T)5).The polynomial encoding that we use is the Reed–Solomon code. When combined with the best PCPs of proximity for this code, our result yields quasilinear-size PCPs with polylogarithmic query complexity that are shorter, by at least two logarithmic factors, than in all prior work.Our arithmetization also enjoys additional properties. First, it is succinct, i.e., the encoding of the computation can be probabilistically checked in (log⁡T)O(1) time; this property is necessary for constructing short PCPs with a polylogarithmic-time verifier. Furthermore, our techniques extend, in a certain well-defined sense, to the arithmetization of yet other NEXP-complete languages.

Composition of Low-Error 2-Query PCPs Using Decodable PCPs

The main result of this paper is a generic composition theorem for low-error two-query probabilistically checkable proofs (PCPs). Prior to this work, composition of PCPs was well understood only in the constant error regime. Existing composition methods in the low-error regime were nonmodular (i.e., very much tailored to the specific PCPs that were being composed), resulting in complicated constructions of PCPs. Furthermore, until recently, composition in the low-error regime suffered from incurring an extra “consistency” query, resulting in PCPs that are not “two-query” and hence, much less useful for hardness-of-approximation reductions. In a recent breakthrough, Moshkovitz and Raz (Proceedings of the 49th IEEE Symposium on Foundations of Computer Science (FOCS), 2008) [J. ACM, 57 (2010)] constructed almost linear-sized low-error 2-query PCPs for every language in NP. Indeed, the main technical component of their construction is a novel composition of certain specific PCPs. We generalize and abstract their composition method, thereby giving a modular and simpler proof of their result. To facilitate the modular composition, we introduce a new variant of PCP, which we call a decodable PCP (dPCP). A dPCP is an encoding of an NP witness that is both locally checkable and locally decodable. The dPCP verifier, in addition to verifying the validity of the given proof like a standard PCP verifier, also locally decodes the original NP witness. Our composition is generic in the sense that it works regardless of the way the component PCPs are constructed.

New Direct-Product Testers and 2-Query PCPs

The “direct-product code” of a function $f$ gives its values on all $k$-tuples $(f(x_1),\dots, f(x_k))$. This basic construct underlies “hardness amplification” in cryptography, circuit complexity, and probabilistically checkable proofs (PCPs). Goldreich and Safra [SIAM J. Comput., 29 (2000), pp. 1132--1154] pioneered its local testing and its PCP application. A recent result by Dinur and Goldenberg [Proceedings of the Forty-Ninth Annual IEEE Symposium on Foundations of Computer Science, 2008, pp. 613--622] enabled for the first time testing proximity to this important code in the “list-decoding” regime. In particular, they give a $2$-query test which works for polynomially small success probability $1/k^{\alpha}$ and show that no such test works below success probability $1/k$. Our main result is a $3$-query test which works for exponentially small success probability $\exp({-k^{\alpha}})$. Our techniques (based on recent simplified decoding algorithms for the same code [R. Impagliazzo et al., Proceeding...

Guest column: testing linear properties

The last two decades have seen enormous progress in the development of sublinear-time algorithms -- i.e., algorithms that examine/reveal properties of "data" in less time than it would take to read all of the data. A large, and important, subclass of such properties turn out to be "linear". In particular, these developments have contributed to the rich theory of probabilistically checkable proofs (PCPs) and locally testable codes (LTCs). In this survey, we focus on some of the general technical themes at work behind the many results in this area.

Parallel Repetition in Projection Games and a Concentration Bound

A two-player game is played by cooperating players who are not allowed to communicate. A referee asks the players questions sampled from some known distribution and decides whether they win or not based on a known predicate of the questions and the players' answers. The parallel repetition of the game is the game in which the referee samples n independent pairs of questions and sends the corresponding questions to the players simultaneously. If the players cannot win the original game with probability better than $(1-\epsilon)$, what's the best they can do in the repeated game? We improve earlier results of [R. Raz, SIAM J. Comput., 27 (1998), pp. 763–803] and [T. Holenstein, Theory Comput., 5 (2009), pp. 141–172], who showed that the players cannot win all copies in the repeated game with probability better than $(1-\epsilon/2)^{\Omega(n\epsilon^2/c)}$ (here c is the length of the answers in the game), in the following ways: (i) We show that the probability of winning all copies is $(1-\epsilon/2)^{\Omega(\epsilon n)}$ as long as the game is a “projection game,” the type of game most commonly used in hardness of approximation results. (ii) We prove a concentration bound for parallel repetition (of general games) showing that for any constant $0<\delta <\epsilon$, the probability that the players win a $(1-\epsilon+\delta)$ fraction of the games in the parallel repetition is at most $\exp\left(-\Omega_{\epsilon}(\delta^3 n/c)\right)$ (here the constant may depend on $\epsilon$); our result has applications to testing Bell inequalities, since it implies that the parallel repetition of the CHSH game can be used to get an experiment that has a very large classical versus quantum gap. Our first bound is independent of the answer length and has a better dependence on $\epsilon$. By the recent work of Raz [Proceedings of the $49$th Annual IEEE Symposium on Foundations of Computer Science, 2008, pp. 369–373], this bound is tight. Our bound gives a generic way to improve the soundness of a probabilistically checkable proof (PCP), in a way that is independent of the answer length of the PCP. Using it, for every k, one can convert any q query PCP with answer length c, size $sc$, and soundness $(1-\epsilon)$ into a two-query PCP with answer length $ck$, size $O(ck (2s)^k)$, and soundness $(1-\epsilon/2q)^{\Omega(\epsilon k/q)}$. Another consequence of our bound is that the unique games conjecture of Khot [Proceedings of the $34$th Annual ACM Symposium on Theory of Computing, 2002, pp. 767–775] can now be shown to be equivalent to the following a priori weaker conjecture: There is an unbounded increasing function $f:\mathbb{R}^+\rightarrow \mathbb{R}^+$ such that for every $\epsilon> 0$, there exists an alphabet size $M(\epsilon)$ for which it is NP-hard to distinguish a unique game with alphabet size M in which a $(1-\epsilon^2)$ fraction of the constraints can be satisfied from one in which a $(1-\epsilon f(1/\epsilon))$ fraction of the constraints can be satisfied.

Are PCPs Inherent in Efficient Arguments?

Starting with Kilian (STOC `92), several works have shown how to use probabilistically checkable proofs (PCPs) and cryptographic primitives such as collision-resistant hashing to construct very efficient argument systems (a.k.a. computationally sound proofs), for example with polylogarithmic communication complexity. Ishai et al. (CCC `07) raised the question of whether PCPs are inherent in efficient arguments, and to what extent. We give evidence that they are, by showing how to convert any argument system whose soundness is reducible to the security of some cryptographic primitive into a PCP system whose efficiency is related to that of the argument system and the reduction (under certain complexity assumptions).

Integrality Gaps of $2-o(1)$ for Vertex Cover SDPs in the Lovász–Schrijver Hierarchy

Linear and semidefinite programming are highly successful approaches for obtaining good approximations for NP-hard optimization problems. For example, breakthrough approximation algorithms for Max Cut and Sparsest Cut use semidefinite programming. Perhaps the most prominent NP-hard problem whose exact approximation factor is still unresolved is Vertex Cover. Probabilistically checkable proof (PCP)-based techniques of Dinur and Safra [Ann. of Math./ (2), 162 (2005), pp. 439-486] show that it is not possible to achieve a factor better than 1.36; on the other hand no known algorithm does better than the factor of 2 achieved by the simple greedy algorithm. There is a widespread belief that semidefinite programming (SDP) techniques are the most promising methods available for improving upon this factor of 2. Following a line of study initiated by Arora et al. [Theory Comput., 2 (2006), pp. 19-51], our aim is to show that a large family of linear programming (LP)- and SDP-based algorithms fail to produce an approximation for Vertex Cover better than 2. Lovasz and Schrijver [SIAM J. Optim., 1 (1991), pp. 166-190] introduced the systems $LS$ and $LS_+$ for systematically tightening LP and SDP relaxations, respectively, over many rounds. These systems naturally capture large classes of LP and SDP relaxations; indeed, $LS_+$ captures the celebrated SDP-based algorithms for Max Cut and Sparsest Cut mentioned above. We rule out polynomial-time SDP-based $2-\Omega(1)$ approximations for Vertex Cover using $LS_+$. In particular, for every $\epsilon>0$ we prove an integrality gap of $2-\epsilon$ for Vertex Cover SDPs obtained by tightening the standard LP relaxation with $\Omega(\sqrt{\log n/\log\log n})$ rounds of $LS_+$. While tight integrality gaps were known for Vertex Cover in the weaker $LS$ system [G. Schoenebeck, L. Trevisan, and M. Tulsiani, Proceedings of the 39th Annual ACM Symposium on Theory of Computing, ACM Press, New York, 2007, pp. 302-310], previous results did not rule out a $2-\Omega(1)$ approximation after even two rounds of $LS_+$.