Constant-Round Interactive Proof Systems for AC0[2] and NC1

Abstract

We present constant-round interactive proof systems for sufficiently uniform versions of $\mathcal{AC}^0[2]$ and $\mathcal{NC}^1$. Both proof systems are doubly-efficient, and offer a better trade-off between the round complexity and the total communication than the work of Reingold, Rothblum, and Rothblum (STOC, 2016). Our proof system for $\mathcal{AC}^0[2]$ supports a more relaxed notion of uniformity and offers a better trade-off between the number of rounds and the round complexity that our proof system for $\mathcal{NC}^1$. We observe that all three aforementioned systems yield constant-round doubly-efficient proof systems for the All-Pairs Shortest Paths problem.

Appendix: The Sum-Check Protocol

The Sum-Check protocol, designed by Lund, Fortnow, Karloff, and Nisan [12], is a key ingredient in the constructions that we present.

Fixing a finite field $\mathcal{F}$ and a set $H\subset \mathcal{F}$ (e.g., H may be a two-element set), we consider an m-variate polynomial $P:\mathcal{F}^m\rightarrow \mathcal{F}$ of individual degree d. Given a value v, the Sum-Check protocol is used to prove that

$$\begin{aligned} \sum _{\sigma _1,...,\sigma _m\in H} P(\sigma _1,...,\sigma _m)=v, \end{aligned}$$

(21)

assuming that the verifier can evaluate P by itself. The Sum-Check protocol proceeds in m iterations, such that in the $i^\mathrm{th}$ iteration the number of summations (over H) decreases from $m-i+1$ to $m-i$. Specifically, the $i^\mathrm{th}$ iteration starts with a claim of the form $\sum _{\sigma _i,...,\sigma _m\in H} P(r_1,...,r_{i-1},\sigma _i,...,\sigma _m)=v_{i-1}$, where $r_1,...,r_{i-1}$ and $v_{i-1}$ are as determined in prior iterations (with $v_0=v$), and ends with a claim of the form $\sum _{\sigma _{i+1},...,\sigma _m\in H} P(r_1,...,r_{i},\sigma _{i+1},...,\sigma _m)=v_{i}$, where $r_i$ and $v_i$ are determined in the $i^\mathrm{th}$ iteration. Initializing the process with $v_0=v$, in the $i^\mathrm{th}$ iteration the parties act as follows.

• Prover’s move: The prover computes a univariate polynomial of degree d over $\mathcal{F}$

  $$\begin{aligned} P_i(z){\mathop {=}\limits ^\mathrm{def}}\sum _{\sigma _{i+1},...,\sigma _m\in H} P(r_1,...,r_{i-1},z,\sigma _{i+1},...,\sigma _m) \end{aligned}$$

  (22)

  where $r_1,...,r_{i-1}$ are as determined in prior iterations, and sends $P_i$ to the verifier (claiming that $\sum _{\sigma \in H}P_i(\sigma )=v_{i-1}$).

• Verifier’s move: Upon receiving a degree d polynomial, denoted ${\widetilde{P}}$, the verifier checks that $\sum _{\sigma \in H}{\widetilde{P}}(\sigma )=v_{i-1}$ and rejects if inequality holds. Otherwise, it selects $r_i$ uniformly in $\mathcal{F}$, and sends it to the prover, while setting $v_i\leftarrow {\widetilde{P}}(r_i)$.

If all m iterations are completed successfully (i.e., without the verifier rejecting in any of them), then the verifier conducts a final check. It computes the value of $P(r_1,...,r_m)$ and accepts if and only if this value equals $v_m$.

Clearly, if Eq. (21) holds (and the prover acts according to the protocol), then the verifier accepts with probability 1. Otherwise (i.e., Eq. (21) does not hold), no matter what the prover does, the verifier accepts with probability at most $m\cdot d/|\mathcal{F}|$, because in each iteration if the prover provides the correct polynomial, then the verifier rejects (since $\sum _{\sigma \in H}P_i(\sigma )=P_{i-1}(r_{i-1})\ne v_{i-1}$), and otherwise the (degree d) polynomial sent agrees with $P_i$ on at most d points.¹⁹

The complexity of verification is dominated by the complexity of evaluating P (on a single point). As for the prescribed prover, it may compute the relevant $P_i$’s by interpolation, which is based on computing the value of P at $(d+1)\cdot |H|^{m-i}$ points, for each $i\in [m]$. (That is, the polynomial $P_i$ is computed by obtaining its values at $d+1$ points, where the value of $P_i$ at each point is obtained by summing the values of P at $|H|^{m-i}$ points.)²⁰