All interactive proof systems have two requirements:
Notice that we don't care what happens if the verifier is dishonest; we trust the verifier.
The specific nature of the system, and so the complexity class of languages it can recognize, depends on what sort of bounds are put on the verifier, as well as what abilities it is given — for example, most interactive proof systems depend critically on the verifier's ability to make random choices. It also depends on the nature of the messages exchanged — how many and what they can contain. Interactive proof systems have been found to have some surprisingly profound implications for traditional complexity classes defined using only one machine. The main complexity classes (really, hierarchies of complexity classes) defined using interactive proof systems are AM, MA, IP, and PCP.
In the case where a valid proof certificate exists, the prover is always able to make the verifier accept by giving it that certificate. In the case where there is no valid proof certificate, however, the input is not in the language, and no prover, however malicious it is, can convince the verifier otherwise, because any proof certificate will be rejected.
The class MA in particular is a simple generalization of the NP interaction above in which the verifier is probabilistic instead of deterministic. Also, instead of requiring that the verifier always accept valid certificates and reject invalid certificates, we are more lenient:
This machine is potentially more powerful than an ordinary NP interaction protocol, and the certificates are no less practical to verify, since BPP algorithms are practical (see BPP). We'll come back to Babai's other classes later.
Shortly after Babai defined his proof system for MA, Shafi Goldwasser et al. published a draft of a paper defining the interactive proof system IP[f(n)]. This has the same machines as the MA protocol, except that f(n) rounds are allowed for an input of size n. In each round, the verifier performs computation and passes a message to the prover, and the prover performs computation and passes information back to the verifier. At the end the verifier must make its decision. For example, in an IP protocol, the sequence would be VPVPVPV, where V is a verifier turn and P is a prover turn.
In Arthur-Merlin protocols, Babai defined a similar class AM[f(n)] which allowed f(n) rounds, but he put one extra condition on the machine: the verifier must show the prover all the random bits it uses in its computation. The result is that the verifier cannot "hide" anything from the prover, because the prover is powerful enough to simulate everything the verifier does if it knows what random bits it used. We call this a public coin protocol, because the random bits ("coin flips") are visible to both machines. The IP approach is called a private coin protocol by contrast.
The essential problem with public coins is this: if the prover wishes to maliciously convince the verifier to accept a string which is not in the language, it seems like the verifier might be able to thwart its plans if it can hide its internal state from it. This was a primary motivation in defining the IP proof systems.
In 1986, Goldwasser and Sipser showed a surprising result: the verifier's ability to hide coin flips from the prover does it little good after all, in that an Arthur-Merlin public coin protocol with only two more rounds can recognize all the same languages. The result is that public-coin and private-coin protocols are roughly equivalent. In fact, as Babai shows in 1988, AM[k]=AM for all constant k, so the IP[k] have no advantage over AM.
To demonstrate the power of the class IP, consider the graph isomorphism problem, the problem of determining whether it is possible to permute the vertices of one graph so that it is identical to another graph. This problem is in NP, since the proof certificate is the permutation which makes the graphs equal. Of course this problem is in IP, since NP is even contained in MA. Much more surprising was Adi Shamir's discovery of an IP algorithm to solve the complement of the graph isomorphism problem, a co-NP problem not known or believed to be in NP.
Not only can such a machine solve many problems not believed to be in NP, but under practical assumptions about the existence of one-way functions, it is able to determine whether many problems have solutions without ever giving the verifier information about the solution. These are important when the verifier cannot be trusted with the full solution. At first it seems impossible that the verifier could be convinced that there is a solution when it has not seen it, but these so-called zero-knowledge proofs are in fact believed to exist for all problems in NP and are valuable in cryptography. Zero-knowledge proofs were invented in the original paper on IP by Goldwasser et al., but the extent of their power was shown by Oded Goldreich.
So many problems seemed to topple before this powerful machine that an effort was made to establish just how much it could do. In 1992, Adi Shamir revealed in one of the central results of complexity theory that in fact, IP = PSPACE, the class of problems solvable by an ordinary deterministic Turing machine in polynomial space. This strong relationship between a probabilistic interactive protocol and a classical deterministic space-bounded machine gave a concept of the power and the limitations of interactive proof systems and established valuable ties between the two subfields. See IP for details.
One goal of IP's designers was to create the most powerful possible interactive proof system, and at first it seems like it cannot be made more powerful without making the verifier more powerful and so impractical. Goldwasser et al. overcame this in their 1988 "Multi prover interactive proofs[...]", which defines a new version of IP called MIP in which there are two independent provers.
The two provers cannot communicate once the verifier has begun sending messages to them. Just as it's easier to tell if a criminal is lying if he and his partner are interrogated in separate rooms, it's considerably easier to detect a malicious prover trying to trick the verifier into accepting a string not in the language if there is another prover it can double-check with.
In fact, this is so helpful that Babai, Fortnow, and Lund were able to show a result as astonishing as IP = PSPACE: that MIP = NEXPTIME, the class of all problems solvable by a nondeterministic machine in exponential time, a very large class. Adding a constant number of additional provers beyond two does not enable recognition of any more languages. This result would prove an inspiration to the designer of PCP, described next, who sought a "scaled-down" version that would relate an interactive proof system to NP.
MIP also has the helpful property that zero-knowledge proofs for every language in NP can be described without the assumption of one-way functions that IP must make. This has bearing on the design of provably unbreakable cryptographic algorithms. Moreover, a MIP protocol can recognize all languages in IP in only a constant number of rounds, and if a third prover is added, it can recognize all languages in NEXPTIME in a constant number of rounds, showing again its power over IP.
There are a number of easy-to-prove results about various PCP classes. PCP(0,poly) (no randomness) is just NP, and PCP(poly,0) (no looking at the proof) is just co-RP. Arora and Safra's first major result was that PCP(log, log) = NP; put another way, if you take the verifier in the NP protocol and tell it that it can only choose log n bits of the proof certificate to look at, this won't make any difference as long as you also give it log n random bits to use.
But there's more: although Arora and Safra knew they could not asymptotically lower both the number of random bits and the number of accesses, they believed they could lower one of them. Arora et al. eventually managed to show the PCP theorem, another major complexity theory result asserting that the number of proof accesses could be brought all the way down to a constant. That is, NP = PCP(log, O(1)). They used this valuable characterization of NP to prove that approximation algorithms do not exist for the optimization versions of certain NP-complete problems unless P = NP.
The Role Of Finance In M&A Results; Senior finance executives wear four key hats during the dealmaking process, and each has bearing on the M&A lifecycle.(Corporate Fature)
Dec 15, 2008; Byline: Carol O. Bailey and Trevear A. Thomas The current credit crisis may have put a squeeze on some deal-making dreams, but...