WEBVTT 00:00:00.000 --> 00:00:05.904 align:middle line:84% [SQUEAKING] [RUSTLING] [CLICKING] 00:00:05.904 --> 00:00:13.100 align:middle line:90% 00:00:13.100 --> 00:00:16.700 align:middle line:84% PROFESSOR: OK, ready for last hour? 00:00:16.700 --> 00:00:22.830 align:middle line:84% OK, before I start, was this too slow, too fast? 00:00:22.830 --> 00:00:26.060 align:middle line:90% Too slow? 00:00:26.060 --> 00:00:28.580 align:middle line:90% Too fast? 00:00:28.580 --> 00:00:29.700 align:middle line:90% OK, I have an idea. 00:00:29.700 --> 00:00:30.870 align:middle line:90% Everybody, close your eyes. 00:00:30.870 --> 00:00:32.630 align:middle line:90% [LAUGHTER] 00:00:32.630 --> 00:00:33.410 align:middle line:90% OK. 00:00:33.410 --> 00:00:36.480 align:middle line:84% Now, you have to say, too slow, too fast, or good. 00:00:36.480 --> 00:00:37.980 align:middle line:84% OK, no, you need to close your eyes. 00:00:37.980 --> 00:00:39.105 align:middle line:90% Everybody, close your eyes. 00:00:39.105 --> 00:00:42.680 align:middle line:90% OK, too slow? 00:00:42.680 --> 00:00:45.050 align:middle line:90% Too fast? 00:00:45.050 --> 00:00:46.320 align:middle line:90% Good? 00:00:46.320 --> 00:00:47.460 align:middle line:90% AUDIENCE: Good. 00:00:47.460 --> 00:00:48.380 align:middle line:90% PROFESSOR: Yes. 00:00:48.380 --> 00:00:49.430 align:middle line:90% OK. 00:00:49.430 --> 00:00:51.098 align:middle line:90% OK, thank you. 00:00:51.098 --> 00:00:53.390 align:middle line:90% AUDIENCE: Hands up. 00:00:53.390 --> 00:00:54.980 align:middle line:90% Oh, what is it for? 00:00:54.980 --> 00:00:56.540 align:middle line:90% PROFESSOR: All good. 00:00:56.540 --> 00:00:57.210 align:middle line:90% It's all good. 00:00:57.210 --> 00:00:58.040 align:middle line:90% Passed. 00:00:58.040 --> 00:00:59.880 align:middle line:90% OK. 00:00:59.880 --> 00:01:02.610 align:middle line:90% OK, great. 00:01:02.610 --> 00:01:05.470 align:middle line:84% OK, so I want to say first, one thing 00:01:05.470 --> 00:01:07.470 align:middle line:84% I forgot to mention about the sum-check protocol 00:01:07.470 --> 00:01:09.820 align:middle line:84% that we actually use later-- it has a nice property, 00:01:09.820 --> 00:01:12.690 align:middle line:84% which is look at what-- so the prover 00:01:12.690 --> 00:01:15.130 align:middle line:90% sends low-degree polynomials. 00:01:15.130 --> 00:01:17.310 align:middle line:90% What does the verifier send? 00:01:17.310 --> 00:01:20.310 align:middle line:84% The verifier just sends random field elements-- 00:01:20.310 --> 00:01:21.790 align:middle line:90% so really, randomness. 00:01:21.790 --> 00:01:26.130 align:middle line:84% He chooses random Logf bits and send them over. 00:01:26.130 --> 00:01:31.840 align:middle line:84% This is called a public coin protocol-- public coin, 00:01:31.840 --> 00:01:33.240 align:middle line:90% meaning the coins-- 00:01:33.240 --> 00:01:35.310 align:middle line:84% so each round, you should think the verifier 00:01:35.310 --> 00:01:39.060 align:middle line:84% chooses coins and just sends them publicly to the prover. 00:01:39.060 --> 00:01:40.390 align:middle line:90% Here are my Logf coins. 00:01:40.390 --> 00:01:41.380 align:middle line:90% Here they go. 00:01:41.380 --> 00:01:46.290 align:middle line:84% This defines a field element, and that's my field element. 00:01:46.290 --> 00:01:49.620 align:middle line:84% This kind of public coin protocols 00:01:49.620 --> 00:01:52.930 align:middle line:84% are very useful because we can later, 00:01:52.930 --> 00:01:56.130 align:middle line:84% as we'll see in this class, we can use cryptography 00:01:56.130 --> 00:01:58.880 align:middle line:84% to eliminate this interaction from this protocol. 00:01:58.880 --> 00:02:02.300 align:middle line:84% So the fact that it's public coin, we'll come back to it. 00:02:02.300 --> 00:02:06.160 align:middle line:84% But just notice the very first message is truly random. 00:02:06.160 --> 00:02:07.480 align:middle line:90% OK. 00:02:07.480 --> 00:02:09.520 align:middle line:90% One more-- Shenian? 00:02:09.520 --> 00:02:10.840 align:middle line:90% OK, yeah, sorry. 00:02:10.840 --> 00:02:12.100 align:middle line:90% AUDIENCE: I'm just wondering. 00:02:12.100 --> 00:02:15.453 align:middle line:84% Are there also protocols with the prover as randomness? 00:02:15.453 --> 00:02:16.120 align:middle line:90% PROFESSOR: Good. 00:02:16.120 --> 00:02:17.350 align:middle line:90% OK. 00:02:17.350 --> 00:02:20.180 align:middle line:84% So as I said, we mentioned the verifier has to be randomized. 00:02:20.180 --> 00:02:22.570 align:middle line:84% If it's not randomized, the interactive protocol 00:02:22.570 --> 00:02:23.540 align:middle line:90% has no power. 00:02:23.540 --> 00:02:26.990 align:middle line:84% The question here was, does the prover need to be randomized? 00:02:26.990 --> 00:02:28.850 align:middle line:84% Is it helpful if he's randomized? 00:02:28.850 --> 00:02:32.210 align:middle line:84% And the answer is, I mean, it doesn't 00:02:32.210 --> 00:02:34.210 align:middle line:84% help him to be randomized because you can always 00:02:34.210 --> 00:02:36.340 align:middle line:90% fix his coins. 00:02:36.340 --> 00:02:37.700 align:middle line:90% The verifier doesn't. 00:02:37.700 --> 00:02:42.775 align:middle line:90% 00:02:42.775 --> 00:02:46.210 align:middle line:84% When is it helpful for the prover to have randomness? 00:02:46.210 --> 00:02:47.420 align:middle line:90% When you want to hide. 00:02:47.420 --> 00:02:50.750 align:middle line:84% When we do zero knowledge where the goal is to hide thing, 00:02:50.750 --> 00:02:52.510 align:middle line:84% then the verifier has random coins 00:02:52.510 --> 00:02:54.820 align:middle line:90% that the verifier doesn't know. 00:02:54.820 --> 00:02:58.460 align:middle line:84% But in this case, the verifier is not-- we're not 00:02:58.460 --> 00:02:59.940 align:middle line:90% trying to protect the verifier. 00:02:59.940 --> 00:03:02.660 align:middle line:84% So why is randomness is helpful-- 00:03:02.660 --> 00:03:05.670 align:middle line:84% why is it important that the verifier uses randomness? 00:03:05.670 --> 00:03:08.730 align:middle line:84% Because the prover needs to send the polynomial. 00:03:08.730 --> 00:03:13.040 align:middle line:84% He should not know which element t the prover, the verifier, 00:03:13.040 --> 00:03:13.620 align:middle line:90% will send. 00:03:13.620 --> 00:03:18.870 align:middle line:84% If he knew at which point t will be asked, then he can cheat. 00:03:18.870 --> 00:03:21.380 align:middle line:84% He'll give you a polynomial that happened 00:03:21.380 --> 00:03:24.170 align:middle line:84% to coincide with the true polynomial at that point t. 00:03:24.170 --> 00:03:26.130 align:middle line:84% there are d such points, so he can choose it. 00:03:26.130 --> 00:03:29.510 align:middle line:84% He can choose the fake polynomial to coincide. 00:03:29.510 --> 00:03:32.420 align:middle line:84% The power comes from the fact that the prover 00:03:32.420 --> 00:03:33.590 align:middle line:90% doesn't know this t. 00:03:33.590 --> 00:03:36.770 align:middle line:84% So we don't trust the prover, and we 00:03:36.770 --> 00:03:39.650 align:middle line:90% use randomness against it. 00:03:39.650 --> 00:03:40.902 align:middle line:90% The verifier is trusted. 00:03:40.902 --> 00:03:41.610 align:middle line:90% We're not trying. 00:03:41.610 --> 00:03:44.970 align:middle line:84% So it doesn't help the prover to use randomness in a sense. 00:03:44.970 --> 00:03:48.680 align:middle line:84% Or in other words, if you can fix this randomness 00:03:48.680 --> 00:03:52.740 align:middle line:84% once and for all time, think of it as a non-uniform prover. 00:03:52.740 --> 00:03:54.120 align:middle line:90% And that's it. 00:03:54.120 --> 00:03:57.280 align:middle line:84% The verifier is not going to change his behavior depending 00:03:57.280 --> 00:03:59.470 align:middle line:90% on-- because he's honest. 00:03:59.470 --> 00:04:00.890 align:middle line:90% The verifier is always honest. 00:04:00.890 --> 00:04:04.090 align:middle line:84% It's the malicious prover that we're worried about. 00:04:04.090 --> 00:04:06.640 align:middle line:84% And therefore, the prover doesn't help him 00:04:06.640 --> 00:04:10.420 align:middle line:84% to-- he doesn't need randomness because you can always hardwire 00:04:10.420 --> 00:04:12.440 align:middle line:84% the best randomness possible to him, 00:04:12.440 --> 00:04:18.190 align:middle line:84% and now he's just a non-uniform machine, a circuit, as opposed 00:04:18.190 --> 00:04:19.870 align:middle line:90% to a randomized machine. 00:04:19.870 --> 00:04:23.840 align:middle line:84% So in this context, randomness to the prover is not needed, 00:04:23.840 --> 00:04:25.990 align:middle line:84% but randomness to the verifier is paramount. 00:04:25.990 --> 00:04:26.080 align:middle line:90% Yes? 00:04:26.080 --> 00:04:27.110 align:middle line:84% AUDIENCE: So when you say public coin, 00:04:27.110 --> 00:04:29.367 align:middle line:84% does that mean that you can't see those bits? 00:04:29.367 --> 00:04:29.950 align:middle line:90% PROFESSOR: No. 00:04:29.950 --> 00:04:33.645 align:middle line:84% Public coin means that the verifier doesn't hide anything. 00:04:33.645 --> 00:04:36.405 align:middle line:90% 00:04:36.405 --> 00:04:39.580 align:middle line:90% Of course, the prover-- 00:04:39.580 --> 00:04:40.350 align:middle line:90% good question. 00:04:40.350 --> 00:04:40.850 align:middle line:90% Thank you. 00:04:40.850 --> 00:04:45.140 align:middle line:84% The prover, he never sees the coins in advance. 00:04:45.140 --> 00:04:49.000 align:middle line:84% So if he saw the coins before he said anything, he can cheat. 00:04:49.000 --> 00:04:53.550 align:middle line:84% But the verifier never hides coins to himself. 00:04:53.550 --> 00:04:57.200 align:middle line:84% So public coin means when the verifier-- the verifier just 00:04:57.200 --> 00:04:58.260 align:middle line:90% sends random coins. 00:04:58.260 --> 00:05:00.180 align:middle line:90% So I'm the verifier. 00:05:00.180 --> 00:05:02.690 align:middle line:84% You guys gave me a univariate polynomial, 00:05:02.690 --> 00:05:04.250 align:middle line:90% a degree-d polynomial. 00:05:04.250 --> 00:05:07.350 align:middle line:84% I choose coins, a field element that's random coins. 00:05:07.350 --> 00:05:08.130 align:middle line:90% I send it over. 00:05:08.130 --> 00:05:10.310 align:middle line:90% I don't keep any state. 00:05:10.310 --> 00:05:12.230 align:middle line:90% All my messages are just random. 00:05:12.230 --> 00:05:14.880 align:middle line:84% You give me another polynomial, I'll just send randomness. 00:05:14.880 --> 00:05:18.210 align:middle line:84% That's the definition of a public coin protocol. 00:05:18.210 --> 00:05:21.170 align:middle line:84% So public coin protocol just means-- 00:05:21.170 --> 00:05:31.160 align:middle line:84% so note sum-check is a public coin protocol which means that 00:05:31.160 --> 00:05:40.410 align:middle line:84% verifier's messages are truly random-- 00:05:40.410 --> 00:05:41.560 align:middle line:90% just random bits. 00:05:41.560 --> 00:05:45.980 align:middle line:90% 00:05:45.980 --> 00:05:47.035 align:middle line:90% Or I should say uniform. 00:05:47.035 --> 00:05:56.790 align:middle line:90% 00:05:56.790 --> 00:05:59.430 align:middle line:84% I just had random, but it's truly uniform bits. 00:05:59.430 --> 00:06:01.620 align:middle line:90% That's what public point means. 00:06:01.620 --> 00:06:03.000 align:middle line:90% Yes? 00:06:03.000 --> 00:06:04.700 align:middle line:84% AUDIENCE: I guess, is it known what 00:06:04.700 --> 00:06:07.200 align:middle line:84% happens if the prover does know all the randomness in the s? 00:06:07.200 --> 00:06:08.200 align:middle line:90% PROFESSOR: Yeah, yeah. 00:06:08.200 --> 00:06:11.110 align:middle line:84% If the prover knows all the randomness in advance, 00:06:11.110 --> 00:06:11.890 align:middle line:90% he can cheat. 00:06:11.890 --> 00:06:12.390 align:middle line:90% Why? 00:06:12.390 --> 00:06:14.015 align:middle line:84% Let me tell you how I'm going to cheat. 00:06:14.015 --> 00:06:16.380 align:middle line:90% So I'm a cheating prover. 00:06:16.380 --> 00:06:19.485 align:middle line:84% Let's say, before we started, you 00:06:19.485 --> 00:06:21.750 align:middle line:90% gave me all your t1 up to tn. 00:06:21.750 --> 00:06:24.790 align:middle line:84% Actually, even if you just gave me t1, I'm golden. 00:06:24.790 --> 00:06:26.570 align:middle line:90% Why? 00:06:26.570 --> 00:06:27.460 align:middle line:90% I faked. 00:06:27.460 --> 00:06:29.590 align:middle line:90% I said, the sum is B, beta. 00:06:29.590 --> 00:06:30.370 align:middle line:90% It's not beta. 00:06:30.370 --> 00:06:31.910 align:middle line:90% It's something else. 00:06:31.910 --> 00:06:38.760 align:middle line:84% And now all I want is to find a univariate polynomial that 00:06:38.760 --> 00:06:40.740 align:middle line:90% sums to beta. 00:06:40.740 --> 00:06:42.220 align:middle line:90% So it's not the true polynomial. 00:06:42.220 --> 00:06:47.280 align:middle line:84% It sums to beta, but it agrees with a true polynomial all on t1 00:06:47.280 --> 00:06:49.940 align:middle line:84% because once it agrees with t1, from now on, 00:06:49.940 --> 00:06:52.180 align:middle line:84% I need to prove a true statement because I 00:06:52.180 --> 00:06:54.740 align:middle line:84% need to prove this, which is actually a true statement. 00:06:54.740 --> 00:06:56.170 align:middle line:90% So I'm good. 00:06:56.170 --> 00:06:59.840 align:middle line:84% So if I knew t1, I can always come up with such a polynomial. 00:06:59.840 --> 00:07:02.260 align:middle line:84% The thing is, I don't know what t1 is. 00:07:02.260 --> 00:07:03.490 align:middle line:90% So actually, I want to give-- 00:07:03.490 --> 00:07:06.560 align:middle line:84% Chima actually asked me a very good question in the break. 00:07:06.560 --> 00:07:12.190 align:middle line:84% And I want to give nice a geometric interpretation 00:07:12.190 --> 00:07:13.490 align:middle line:90% of the soundness proof. 00:07:13.490 --> 00:07:16.030 align:middle line:84% So let me give you a geometric interpretation 00:07:16.030 --> 00:07:18.970 align:middle line:84% of why this protocol is sound, what's 00:07:18.970 --> 00:07:20.180 align:middle line:90% happening in this protocol. 00:07:20.180 --> 00:07:23.540 align:middle line:84% So here's the geometric interpretation. 00:07:23.540 --> 00:07:25.940 align:middle line:84% We have a little box, h to the m. 00:07:25.940 --> 00:07:29.320 align:middle line:84% You can think of it, this is the little box h to the m. 00:07:29.320 --> 00:07:32.390 align:middle line:84% I want to prove to you that this low-degree polynomial, 00:07:32.390 --> 00:07:35.030 align:middle line:84% if you sum over the value at this point, this point, 00:07:35.030 --> 00:07:37.780 align:middle line:84% all these h-to-the-m points, it's beta. 00:07:37.780 --> 00:07:44.140 align:middle line:84% Now let's look at the big F. I have this big F. 00:07:44.140 --> 00:07:44.840 align:middle line:90% OK. 00:07:44.840 --> 00:07:46.210 align:middle line:90% Now what happens? 00:07:46.210 --> 00:07:50.720 align:middle line:84% If you were incorrect, if you cheated me, then this sum-- 00:07:50.720 --> 00:07:52.680 align:middle line:90% you sum over all the points. 00:07:52.680 --> 00:07:56.960 align:middle line:84% Let's fix this point here, the one possible h1. 00:07:56.960 --> 00:07:59.570 align:middle line:90% 00:07:59.570 --> 00:08:01.340 align:middle line:90% Maybe what you gave me is false. 00:08:01.340 --> 00:08:05.600 align:middle line:84% What you gave me is-- this sum is either false on h1 or on h2. 00:08:05.600 --> 00:08:07.220 align:middle line:84% Somewhere, it must be false because it 00:08:07.220 --> 00:08:09.372 align:middle line:84% was true on everything, it would be true. 00:08:09.372 --> 00:08:11.580 align:middle line:84% So you gave me something that's false on one of them. 00:08:11.580 --> 00:08:14.540 align:middle line:90% I don't know which one. 00:08:14.540 --> 00:08:18.060 align:middle line:84% But now I'm going to use error correction to say, well, 00:08:18.060 --> 00:08:19.940 align:middle line:84% if it was false on one of them, it's 00:08:19.940 --> 00:08:22.430 align:middle line:90% false on a random point, t1. 00:08:22.430 --> 00:08:24.420 align:middle line:90% So now I forget about this sum. 00:08:24.420 --> 00:08:26.130 align:middle line:90% I just look at t1. 00:08:26.130 --> 00:08:31.310 align:middle line:84% And I know that the sum only over the rest of the dimension 2 00:08:31.310 --> 00:08:33.890 align:middle line:90% is false on t1. 00:08:33.890 --> 00:08:36.679 align:middle line:84% And now, again, false on t1, that means h2. 00:08:36.679 --> 00:08:38.220 align:middle line:90% One of them must be false. 00:08:38.220 --> 00:08:41.150 align:middle line:84% I go to a random point in the extension, 00:08:41.150 --> 00:08:43.559 align:middle line:84% and there, with high probability, it's false. 00:08:43.559 --> 00:08:49.770 align:middle line:84% And this is how I bop up around from dimensions-- so t1, t2, 00:08:49.770 --> 00:08:52.680 align:middle line:84% to dimension t3, t4, and so on, up to the point 00:08:52.680 --> 00:08:56.170 align:middle line:84% that I get a random point and left it there. 00:08:56.170 --> 00:08:58.260 align:middle line:84% So that's a geometric interpretation 00:08:58.260 --> 00:09:00.960 align:middle line:90% of what's going on. 00:09:00.960 --> 00:09:02.760 align:middle line:90% OK? 00:09:02.760 --> 00:09:03.930 align:middle line:90% OK. 00:09:03.930 --> 00:09:07.215 align:middle line:90% Any questions before we-- 00:09:07.215 --> 00:09:07.715 align:middle line:90% OK. 00:09:07.715 --> 00:09:08.910 align:middle line:90% So we saw this sum-check. 00:09:08.910 --> 00:09:10.000 align:middle line:90% So let's see where we are. 00:09:10.000 --> 00:09:13.000 align:middle line:84% We introduced this interactive proof model. 00:09:13.000 --> 00:09:14.700 align:middle line:90% We saw sum-check protocol. 00:09:14.700 --> 00:09:17.080 align:middle line:90% Seems very specific. 00:09:17.080 --> 00:09:19.102 align:middle line:84% Let's try to see why it's very interesting, 00:09:19.102 --> 00:09:20.060 align:middle line:90% the sum-check protocol. 00:09:20.060 --> 00:09:25.590 align:middle line:90% 00:09:25.590 --> 00:09:28.230 align:middle line:84% First thing, let me give you an example where 00:09:28.230 --> 00:09:30.550 align:middle line:90% the sum-check is useful. 00:09:30.550 --> 00:09:31.763 align:middle line:90% And here's the example. 00:09:31.763 --> 00:09:35.940 align:middle line:90% 00:09:35.940 --> 00:09:43.050 align:middle line:84% # Let me show you that #SAT has an interactive piece. 00:09:43.050 --> 00:09:48.380 align:middle line:84% IP is the set of all languages that have interactive proofs. 00:09:48.380 --> 00:09:52.070 align:middle line:84% # So let me prove to you that #SAT set has an interactive proof. 00:09:52.070 --> 00:09:52.970 align:middle line:90% That's an example. 00:09:52.970 --> 00:09:54.910 align:middle line:84% This will use the sum-check protocol. 00:09:54.910 --> 00:09:57.250 align:middle line:84% By the way, let me just mention, all the examples 00:09:57.250 --> 00:09:59.923 align:middle line:84% that I'm giving you are not just examples. 00:09:59.923 --> 00:10:01.340 align:middle line:84% I'm teaching something through it. 00:10:01.340 --> 00:10:02.798 align:middle line:84% So don't just, ah, it's an example. 00:10:02.798 --> 00:10:06.310 align:middle line:90% I'll forget about it. 00:10:06.310 --> 00:10:07.850 align:middle line:90% They're specially crafted. 00:10:07.850 --> 00:10:10.120 align:middle line:90% OK, so what is #SAT? 00:10:10.120 --> 00:10:14.140 align:middle line:84% # #SAT, we're giving a formula, phi. 00:10:14.140 --> 00:10:18.700 align:middle line:84% And we're asking, what is the number of satisfying assignments 00:10:18.700 --> 00:10:20.000 align:middle line:90% to this formula? 00:10:20.000 --> 00:10:21.020 align:middle line:90% That's the question. 00:10:21.020 --> 00:10:24.070 align:middle line:90% That's the aim. 00:10:24.070 --> 00:10:29.270 align:middle line:84% So phi, you should think of it as a Boolean formula. 00:10:29.270 --> 00:10:30.525 align:middle line:90% We're given a Boolean formula. 00:10:30.525 --> 00:10:34.210 align:middle line:90% 00:10:34.210 --> 00:10:38.950 align:middle line:90% Let's say phi is over-- 00:10:38.950 --> 00:10:41.196 align:middle line:84% sorry-- over, let's say, n variables. 00:10:41.196 --> 00:10:44.930 align:middle line:90% 00:10:44.930 --> 00:10:50.570 align:middle line:84% And Boolean formula, just think of it's AND and OR. 00:10:50.570 --> 00:10:54.200 align:middle line:90% And we have NAND gates. 00:10:54.200 --> 00:11:00.170 align:middle line:84% And the question is, how many assignments over 0, 1 to the n 00:11:00.170 --> 00:11:01.862 align:middle line:90% make this formula accept? 00:11:01.862 --> 00:11:02.695 align:middle line:90% That's the question. 00:11:02.695 --> 00:11:06.780 align:middle line:90% 00:11:06.780 --> 00:11:12.720 align:middle line:84% So by the way, when we say formula, we mean it's a binary. 00:11:12.720 --> 00:11:14.110 align:middle line:90% Think of it as a binary tree. 00:11:14.110 --> 00:11:17.360 align:middle line:90% 00:11:17.360 --> 00:11:19.680 align:middle line:84% So a formula is just a binary tree. 00:11:19.680 --> 00:11:22.740 align:middle line:84% Each gate, you can think of it as an AND or an OR. 00:11:22.740 --> 00:11:28.860 align:middle line:84% And then the final, final leaves are all xi or not xi. 00:11:28.860 --> 00:11:31.850 align:middle line:90% So phi is of the following form. 00:11:31.850 --> 00:11:35.780 align:middle line:84% It's, let's say, AND, then you can have OR or AND, 00:11:35.780 --> 00:11:37.550 align:middle line:90% so on and so forth. 00:11:37.550 --> 00:11:43.580 align:middle line:84% And at the end, it has x3, NAND x7, and so on, and so forth. 00:11:43.580 --> 00:11:46.840 align:middle line:84% So you can think of the size of this formula 00:11:46.840 --> 00:11:49.182 align:middle line:84% as the number of leaves because up to a factor of 2, 00:11:49.182 --> 00:11:51.140 align:middle line:84% it's the number of gates, the number of leaves. 00:11:51.140 --> 00:11:52.005 align:middle line:90% It's the same. 00:11:52.005 --> 00:11:54.730 align:middle line:90% 00:11:54.730 --> 00:11:59.500 align:middle line:84% And just note, x3 may appear many, many, many times 00:11:59.500 --> 00:12:03.050 align:middle line:84% because I really opened it up to a tree. 00:12:03.050 --> 00:12:05.990 align:middle line:84% So each variable here can appear many, many times. 00:12:05.990 --> 00:12:08.660 align:middle line:90% So this is what our formula is. 00:12:08.660 --> 00:12:11.380 align:middle line:84% # And #SAT-- so now I want to say that, let's say, 00:12:11.380 --> 00:12:16.900 align:middle line:90% phi and k is in #SAT. 00:12:16.900 --> 00:12:22.040 align:middle line:84% It's in the language if and only if phi has-- 00:12:22.040 --> 00:12:23.410 align:middle line:90% so the number. 00:12:23.410 --> 00:12:27.640 align:middle line:84% If you look at all the x's in 0, 1 00:12:27.640 --> 00:12:31.690 align:middle line:84% to the n such that phi of x is 1, 00:12:31.690 --> 00:12:36.430 align:middle line:84% this set equals k if there is exactly 00:12:36.430 --> 00:12:40.070 align:middle line:90% k-satisfying assignments. 00:12:40.070 --> 00:12:42.480 align:middle line:84% Questions about this language, free SAT? 00:12:42.480 --> 00:12:43.740 align:middle line:90% We're good? 00:12:43.740 --> 00:12:44.240 align:middle line:90% OK. 00:12:44.240 --> 00:12:45.830 align:middle line:84% I just want to point out, a formula 00:12:45.830 --> 00:12:48.290 align:middle line:84% is different than a circuit in the sense 00:12:48.290 --> 00:12:49.590 align:middle line:90% that the formula is a tree. 00:12:49.590 --> 00:12:50.760 align:middle line:90% It's a binary tree. 00:12:50.760 --> 00:12:55.890 align:middle line:84% A circuit is an arbitrary directed acyclic graph. 00:12:55.890 --> 00:13:01.010 align:middle line:84% And in particular, in a circuit-- 00:13:01.010 --> 00:13:03.600 align:middle line:84% in a formula, you need to recompute everything. 00:13:03.600 --> 00:13:08.390 align:middle line:84% So if this gate uses a value and this gate 00:13:08.390 --> 00:13:10.620 align:middle line:84% also uses the same value, you need to recompute it. 00:13:10.620 --> 00:13:12.110 align:middle line:90% You need to compute it twice. 00:13:12.110 --> 00:13:15.830 align:middle line:84% In a circuit, you can do things much more efficiently. 00:13:15.830 --> 00:13:18.110 align:middle line:90% So there's also circuits SATs. 00:13:18.110 --> 00:13:19.655 align:middle line:90% That's a sharp circuit set. 00:13:19.655 --> 00:13:20.780 align:middle line:90% That's a different problem. 00:13:20.780 --> 00:13:26.036 align:middle line:84% # Here, we're talking about #SAT for formulas, for trees. 00:13:26.036 --> 00:13:29.160 align:middle line:84% So I'm going to give you actually-- 00:13:29.160 --> 00:13:34.190 align:middle line:84% so this is known to be a very hard problem. 00:13:34.190 --> 00:13:37.700 align:middle line:84% I'm giving you-- think of three sets. 00:13:37.700 --> 00:13:40.660 align:middle line:84% Look at the number, like, 10 people a number? 00:13:40.660 --> 00:13:43.450 align:middle line:84% How do you know how many satisfying assignments it has? 00:13:43.450 --> 00:13:46.726 align:middle line:84% It's considered a very hard problem. 00:13:46.726 --> 00:13:49.447 align:middle line:84% But If you think about it, it's really surprising 00:13:49.447 --> 00:13:51.030 align:middle line:84% that you can give an interactive proof 00:13:51.030 --> 00:13:52.990 align:middle line:90% for it, which is really nice. 00:13:52.990 --> 00:13:55.260 align:middle line:84% And moreover, the interactive proof 00:13:55.260 --> 00:13:56.660 align:middle line:90% is really just the sum-check. 00:13:56.660 --> 00:13:57.160 align:middle line:90% That's all. 00:13:57.160 --> 00:13:58.590 align:middle line:90% That's all it is. 00:13:58.590 --> 00:14:02.640 align:middle line:84% So I'm going to show you how I embed this kind of question 00:14:02.640 --> 00:14:05.970 align:middle line:90% into a sum-check. 00:14:05.970 --> 00:14:08.500 align:middle line:84% And note that this is just a Boolean formula. 00:14:08.500 --> 00:14:10.470 align:middle line:90% Where's the polynomial? 00:14:10.470 --> 00:14:12.060 align:middle line:90% I'm going to make a sum-check. 00:14:12.060 --> 00:14:14.080 align:middle line:84% But to have sum-check, I need a polynomial. 00:14:14.080 --> 00:14:16.110 align:middle line:90% This is just a Boolean formula. 00:14:16.110 --> 00:14:18.750 align:middle line:84% So the idea is to use-- so I'm going 00:14:18.750 --> 00:14:20.767 align:middle line:90% to use sum-check for this IP. 00:14:20.767 --> 00:14:22.350 align:middle line:84% And the way I'm going to use sum-check 00:14:22.350 --> 00:14:25.230 align:middle line:84% is by a technique called arithmetization, 00:14:25.230 --> 00:14:28.080 align:middle line:90% which we'll use. 00:14:28.080 --> 00:14:33.300 align:middle line:84% So the idea of using sum-check or the idea behind this IP 00:14:33.300 --> 00:14:40.820 align:middle line:84% is to arithmetize the formula phi. 00:14:40.820 --> 00:14:45.422 align:middle line:84% # So I want to prove to you that phi, comma, k is in #SAT. 00:14:45.422 --> 00:14:46.880 align:middle line:84% I want to use a sum-check protocol. 00:14:46.880 --> 00:14:48.230 align:middle line:90% That's the only protocol I know. 00:14:48.230 --> 00:14:49.940 align:middle line:90% And I want to use it. 00:14:49.940 --> 00:14:52.090 align:middle line:90% But I need a polynomial. 00:14:52.090 --> 00:14:54.890 align:middle line:84% I need some polynomial in the sum over this polynomial. 00:14:54.890 --> 00:14:56.420 align:middle line:90% What is this polynomial? 00:14:56.420 --> 00:15:00.580 align:middle line:84% It's going to be an arithmetization of the set 00:15:00.580 --> 00:15:01.130 align:middle line:90% formula. 00:15:01.130 --> 00:15:02.650 align:middle line:90% So how do I arithmetize? 00:15:02.650 --> 00:15:04.280 align:middle line:90% The idea is very, very simple. 00:15:04.280 --> 00:15:08.900 align:middle line:84% I'm going to convert any-- so this is Booleans all over 0, 00:15:08.900 --> 00:15:09.400 align:middle line:90% 1, yeah. 00:15:09.400 --> 00:15:10.300 align:middle line:90% I have AND and OR. 00:15:10.300 --> 00:15:11.800 align:middle line:90% Everything is over 0, 1. 00:15:11.800 --> 00:15:25.150 align:middle line:84% I'm going to convert an AND gate into MULT gate. 00:15:25.150 --> 00:15:27.762 align:middle line:84% So actually, fix any finite field. 00:15:27.762 --> 00:15:29.470 align:middle line:84% You can make it very, very big, so you'll 00:15:29.470 --> 00:15:37.580 align:middle line:84% have good soundness with respect to finite field F. 00:15:37.580 --> 00:15:40.880 align:middle line:90% So it fits any finite field. 00:15:40.880 --> 00:15:43.070 align:middle line:90% It can be very large. 00:15:43.070 --> 00:15:48.180 align:middle line:84% I'm going to convert any AND gate into a multiplication gate. 00:15:48.180 --> 00:15:54.740 align:middle line:84% So MULT is just take x and y and just output 00:15:54.740 --> 00:15:58.190 align:middle line:90% x times y in the field. 00:15:58.190 --> 00:16:01.280 align:middle line:84% But in particular, what it means-- 00:16:01.280 --> 00:16:03.110 align:middle line:90% anything times 0 is 0. 00:16:03.110 --> 00:16:04.290 align:middle line:90% And 1 times 1 is 1. 00:16:04.290 --> 00:16:07.190 align:middle line:90% It's exactly an AND gate. 00:16:07.190 --> 00:16:13.610 align:middle line:90% I have an OR gate into-- 00:16:13.610 --> 00:16:16.050 align:middle line:90% so this is a bit more problem. 00:16:16.050 --> 00:16:17.780 align:middle line:90% So actually, let me say-- 00:16:17.780 --> 00:16:19.340 align:middle line:90% maybe I'll write it. 00:16:19.340 --> 00:16:24.560 align:middle line:84% So I'm going to write AND of x, y. 00:16:24.560 --> 00:16:26.905 align:middle line:84% I'm just going to write as x times y. 00:16:26.905 --> 00:16:29.420 align:middle line:90% 00:16:29.420 --> 00:16:35.370 align:middle line:84% And I'm going to write OR of x and y. 00:16:35.370 --> 00:16:36.580 align:middle line:90% Any idea? 00:16:36.580 --> 00:16:37.320 align:middle line:90% Yeah? 00:16:37.320 --> 00:16:38.770 align:middle line:90% AUDIENCE: X, y equals x plus y. 00:16:38.770 --> 00:16:40.380 align:middle line:90% PROFESSOR: Exactly, exactly. 00:16:40.380 --> 00:16:41.830 align:middle line:90% X plus y-- that's the idea. 00:16:41.830 --> 00:16:43.500 align:middle line:90% But of course, then it's 2. 00:16:43.500 --> 00:16:46.710 align:middle line:90% So I subtract x times y. 00:16:46.710 --> 00:16:48.880 align:middle line:90% Exactly. 00:16:48.880 --> 00:16:51.280 align:middle line:90% So of course, 0 goes to 0. 00:16:51.280 --> 00:16:54.000 align:middle line:84% If only one of them is 1, you get 1. 00:16:54.000 --> 00:16:54.820 align:middle line:90% And 0, nothing. 00:16:54.820 --> 00:16:57.310 align:middle line:84% And if both of them are 1, then this one is 1. 00:16:57.310 --> 00:16:58.750 align:middle line:90% So it takes care of it. 00:16:58.750 --> 00:16:59.250 align:middle line:90% Good. 00:16:59.250 --> 00:17:00.513 align:middle line:90% And then the NOT-- 00:17:00.513 --> 00:17:03.990 align:middle line:90% 00:17:03.990 --> 00:17:08.422 align:middle line:84% NOT, I go into NOT of x is simply what? 00:17:08.422 --> 00:17:09.598 align:middle line:90% AUDIENCE: 1 minus x. 00:17:09.598 --> 00:17:10.390 align:middle line:90% PROFESSOR: Exactly. 00:17:10.390 --> 00:17:11.670 align:middle line:90% 1 minus x. 00:17:11.670 --> 00:17:16.020 align:middle line:84% So now I have actually an arithmetic circuit. 00:17:16.020 --> 00:17:20.670 align:middle line:84% So this arithmetization allowed me to go from a circuit 00:17:20.670 --> 00:17:24.550 align:middle line:84% into an arithmetic circuit or from a formula-- 00:17:24.550 --> 00:17:26.390 align:middle line:84% sorry-- into an arithmetic circuit. 00:17:26.390 --> 00:17:29.430 align:middle line:90% 00:17:29.430 --> 00:17:36.010 align:middle line:84% First, note that each gate is now an arithmetic 00:17:36.010 --> 00:17:38.560 align:middle line:90% circuit of size at most 3. 00:17:38.560 --> 00:17:40.550 align:middle line:90% It's a tiny circuit. 00:17:40.550 --> 00:17:45.970 align:middle line:84% So each gate really is only blew up by only a constant. 00:17:45.970 --> 00:17:48.850 align:middle line:84% And now, really, what I want to do a sum-check over 00:17:48.850 --> 00:17:53.080 align:middle line:84% my protocol-- what I want is to look at-- so let's denote 00:17:53.080 --> 00:17:55.550 align:middle line:90% the arithmetization by-- 00:17:55.550 --> 00:18:12.760 align:middle line:84% so if we denote arethmetized formula by phi tilde-- 00:18:12.760 --> 00:18:15.410 align:middle line:90% 00:18:15.410 --> 00:18:19.810 align:middle line:84% so phi tilde goes from F to the n to F. 00:18:19.810 --> 00:18:21.430 align:middle line:84% It's just addition and multiplication. 00:18:21.430 --> 00:18:23.230 align:middle line:84% It's defined over the big F. Yes? 00:18:23.230 --> 00:18:27.040 align:middle line:84% AUDIENCE: I'm worried that since OR now has x twice and y 00:18:27.040 --> 00:18:29.500 align:middle line:84% twice, since you said it has to be a tree, 00:18:29.500 --> 00:18:33.437 align:middle line:84% do you have to copy and paste y in order to plug it into that? 00:18:33.437 --> 00:18:34.020 align:middle line:90% PROFESSOR: OK. 00:18:34.020 --> 00:18:35.440 align:middle line:90% Actually, I don't care. 00:18:35.440 --> 00:18:37.050 align:middle line:90% We'll see. 00:18:37.050 --> 00:18:38.340 align:middle line:90% What you're saying is, wait. 00:18:38.340 --> 00:18:41.290 align:middle line:90% 00:18:41.290 --> 00:18:43.650 align:middle line:84% All I care is that I started with an arithmetic-- 00:18:43.650 --> 00:18:44.425 align:middle line:90% with a formula. 00:18:44.425 --> 00:18:46.300 align:middle line:84% I don't care in the middle what I do with it. 00:18:46.300 --> 00:18:47.925 align:middle line:84% AUDIENCE: So right now, it's not a formula anymore. 00:18:47.925 --> 00:18:48.420 align:middle line:90% Is that OK? 00:18:48.420 --> 00:18:49.545 align:middle line:90% PROFESSOR: Yeah, oh, sorry. 00:18:49.545 --> 00:18:53.980 align:middle line:90% 00:18:53.980 --> 00:18:54.480 align:middle line:90% Good. 00:18:54.480 --> 00:18:55.100 align:middle line:90% Thank you. 00:18:55.100 --> 00:18:57.640 align:middle line:90% 00:18:57.640 --> 00:18:58.140 align:middle line:90% Good. 00:18:58.140 --> 00:19:00.510 align:middle line:90% Thank you very much. 00:19:00.510 --> 00:19:01.250 align:middle line:90% Thank you. 00:19:01.250 --> 00:19:04.830 align:middle line:90% 00:19:04.830 --> 00:19:06.060 align:middle line:90% Great. 00:19:06.060 --> 00:19:07.120 align:middle line:90% Wow, you guys are good. 00:19:07.120 --> 00:19:07.840 align:middle line:90% Thank you. 00:19:07.840 --> 00:19:10.800 align:middle line:84% OK, so let's denote the arithmetized version 00:19:10.800 --> 00:19:12.060 align:middle line:90% by phi tilde. 00:19:12.060 --> 00:19:13.618 align:middle line:90% Now, of course, it's natural. 00:19:13.618 --> 00:19:15.660 align:middle line:84% What would be sum-check protocol that makes sense 00:19:15.660 --> 00:19:16.930 align:middle line:90% to do at this point? 00:19:16.930 --> 00:19:19.885 align:middle line:90% Any ideas? 00:19:19.885 --> 00:19:20.385 align:middle line:90% Hmm? 00:19:20.385 --> 00:19:22.170 align:middle line:84% AUDIENCE: Replace F with phi tilde. 00:19:22.170 --> 00:19:23.740 align:middle line:90% PROFESSOR: Exactly, exactly. 00:19:23.740 --> 00:19:31.380 align:middle line:84% Let's prove that sum of phi tilde over b1 up to bn in 0, 00:19:31.380 --> 00:19:36.880 align:middle line:90% 1 is equal to k. 00:19:36.880 --> 00:19:38.320 align:middle line:90% Why that makes sense? 00:19:38.320 --> 00:19:40.600 align:middle line:84% The only thing we need to be careful with 00:19:40.600 --> 00:19:44.560 align:middle line:84% is, what is the degree of this thing? 00:19:44.560 --> 00:19:50.390 align:middle line:84% So now let's just argue that the degree is not too big. 00:19:50.390 --> 00:19:53.530 align:middle line:84% But if I convince you that the degree is small, 00:19:53.530 --> 00:19:54.830 align:middle line:90% then we're done. 00:19:54.830 --> 00:19:56.560 align:middle line:90% We just do a sum-check. 00:19:56.560 --> 00:20:00.252 align:middle line:84% And this is exactly what you want to prove. 00:20:00.252 --> 00:20:01.960 align:middle line:84% So let's just make sure that the degree-- 00:20:01.960 --> 00:20:05.140 align:middle line:84% so n here, like the number of rounds is going to be n. 00:20:05.140 --> 00:20:06.730 align:middle line:90% There's going to be a degree d. 00:20:06.730 --> 00:20:08.890 align:middle line:84% We just need to ensure that d times n 00:20:08.890 --> 00:20:13.060 align:middle line:84% is much, much, much smaller than F, which governs-- 00:20:13.060 --> 00:20:14.860 align:middle line:90% I put here the-- 00:20:14.860 --> 00:20:17.380 align:middle line:90% which govern the soundness. 00:20:17.380 --> 00:20:19.840 align:middle line:90% So let's just see the degree. 00:20:19.840 --> 00:20:21.135 align:middle line:90% So here's a claim. 00:20:21.135 --> 00:20:24.370 align:middle line:90% 00:20:24.370 --> 00:20:32.550 align:middle line:84% The degree of phi tilde is at most-- 00:20:32.550 --> 00:20:34.956 align:middle line:90% or let me write it differently. 00:20:34.956 --> 00:20:37.550 align:middle line:90% 00:20:37.550 --> 00:20:42.320 align:middle line:84% The sum-- let's look at the degree for each variable. 00:20:42.320 --> 00:20:48.055 align:middle line:84% The sum of the degree for variable i of phi-- 00:20:48.055 --> 00:20:50.840 align:middle line:90% 00:20:50.840 --> 00:20:53.640 align:middle line:84% so we have n variables, x1 up to xn. 00:20:53.640 --> 00:20:55.970 align:middle line:90% Each one has some degree. 00:20:55.970 --> 00:20:59.450 align:middle line:84% The sum of these degrees, I'm going to argue, is, at most, 00:20:59.450 --> 00:21:03.050 align:middle line:90% s, s being the number of-- 00:21:03.050 --> 00:21:08.330 align:middle line:90% 00:21:08.330 --> 00:21:13.830 align:middle line:84% s size of phi, which is defined to be-- 00:21:13.830 --> 00:21:23.460 align:middle line:84% this is by definition-- the number of leaves in phi. 00:21:23.460 --> 00:21:31.350 align:middle line:84% So let me argue that the size is, at most, phi-- 00:21:31.350 --> 00:21:37.410 align:middle line:84% the degree is, at most, the sum of the degree is, at most, s 00:21:37.410 --> 00:21:40.250 align:middle line:90% or the size. 00:21:40.250 --> 00:21:41.940 align:middle line:84% By the way, before actually I do that, 00:21:41.940 --> 00:21:44.340 align:middle line:84% just to make sure because I actually noticed that I 00:21:44.340 --> 00:21:47.370 align:middle line:90% glossed over too quickly-- 00:21:47.370 --> 00:21:50.590 align:middle line:84% I said that this is all we need to prove. 00:21:50.590 --> 00:21:52.030 align:middle line:90% But I just want to make sure. 00:21:52.030 --> 00:21:57.660 align:middle line:84% Is it clear that phi tilde and 0, 1 to the n 00:21:57.660 --> 00:22:00.157 align:middle line:90% is actually equal to phi? 00:22:00.157 --> 00:22:01.740 align:middle line:84% Yeah, that's very important because we 00:22:01.740 --> 00:22:03.282 align:middle line:84% want to make sure that we're actually 00:22:03.282 --> 00:22:04.912 align:middle line:84% summing over the actual phi, like in 0, 00:22:04.912 --> 00:22:10.390 align:middle line:84% # 1, because we want to prove #SAT of the phi formula. 00:22:10.390 --> 00:22:13.680 align:middle line:84% And the reason is, as we said, is that on 0, 00:22:13.680 --> 00:22:17.505 align:middle line:84% 1, we really behave like the AND and OR. 00:22:17.505 --> 00:22:19.480 align:middle line:84% So of course, outside of 0, 1, who knows? 00:22:19.480 --> 00:22:20.170 align:middle line:90% We're over a big field. 00:22:20.170 --> 00:22:21.040 align:middle line:90% Who knows what's going on? 00:22:21.040 --> 00:22:23.212 align:middle line:84% But on 0, 1, we behave exactly like the AND and OR, 00:22:23.212 --> 00:22:24.170 align:middle line:90% like the original tree. 00:22:24.170 --> 00:22:27.820 align:middle line:84% And therefore, this arithmetic formula 00:22:27.820 --> 00:22:30.670 align:middle line:84% is actually equal to the original formula on 0, 1 00:22:30.670 --> 00:22:32.480 align:middle line:90% to the n. 00:22:32.480 --> 00:22:32.980 align:middle line:90% Yeah? 00:22:32.980 --> 00:22:33.940 align:middle line:90% OK. 00:22:33.940 --> 00:22:34.645 align:middle line:90% So good. 00:22:34.645 --> 00:22:36.020 align:middle line:84% So this is what we want to prove. 00:22:36.020 --> 00:22:37.490 align:middle line:84% Now let's just look at the degree. 00:22:37.490 --> 00:22:37.990 align:middle line:90% Yeah? 00:22:37.990 --> 00:22:39.780 align:middle line:84% AUDIENCE: What degree sub i is this? 00:22:39.780 --> 00:22:40.947 align:middle line:90% PROFESSOR: Good, good, good. 00:22:40.947 --> 00:22:47.380 align:middle line:84% This just means this is the degree of xi in phi. 00:22:47.380 --> 00:22:53.090 align:middle line:90% 00:22:53.090 --> 00:22:56.740 align:middle line:84% Or in other words, I can argue that each variable has degree, 00:22:56.740 --> 00:22:57.422 align:middle line:90% at most, s. 00:22:57.422 --> 00:22:58.880 align:middle line:84% But I can argue something stronger. 00:22:58.880 --> 00:23:02.830 align:middle line:84% The sum of the degrees of all the variables is, at most, s. 00:23:02.830 --> 00:23:05.882 align:middle line:84% Note that's s is polynomial here. 00:23:05.882 --> 00:23:06.590 align:middle line:90% That's the input. 00:23:06.590 --> 00:23:08.720 align:middle line:90% The input is a set formula. 00:23:08.720 --> 00:23:10.030 align:middle line:90% It's polynomial. 00:23:10.030 --> 00:23:13.070 align:middle line:84% So as long as this is the degree, we're happy. 00:23:13.070 --> 00:23:15.370 align:middle line:84% The communication complexity, the verifier complexity 00:23:15.370 --> 00:23:18.100 align:middle line:84% is going to be n the number of variables, 00:23:18.100 --> 00:23:24.360 align:middle line:84% d, which is like s polynomial, and poly log in the field. 00:23:24.360 --> 00:23:26.690 align:middle line:84% So the verifier is going to be polynomial. 00:23:26.690 --> 00:23:28.370 align:middle line:90% Now we care about-- 00:23:28.370 --> 00:23:31.620 align:middle line:84% now there's a notion of polynomial time verifier. 00:23:31.620 --> 00:23:33.920 align:middle line:84% But if the degree is, at most, s, s is polynomial. 00:23:33.920 --> 00:23:35.360 align:middle line:90% We're good. 00:23:35.360 --> 00:23:36.830 align:middle line:90% OK. 00:23:36.830 --> 00:23:39.030 align:middle line:90% So why is this the degree? 00:23:39.030 --> 00:23:43.460 align:middle line:84% So to prove that this is the degree, the proof of this claim 00:23:43.460 --> 00:23:49.700 align:middle line:90% is by induction. 00:23:49.700 --> 00:23:52.710 align:middle line:84% It's actually a pretty straightforward proof. 00:23:52.710 --> 00:23:56.820 align:middle line:84% And it really uses the fact that phi is a formula. 00:23:56.820 --> 00:23:59.030 align:middle line:90% The original phi is a formula. 00:23:59.030 --> 00:24:05.570 align:middle line:90% 00:24:05.570 --> 00:24:06.610 align:middle line:90% So let's see. 00:24:06.610 --> 00:24:09.800 align:middle line:90% 00:24:09.800 --> 00:24:18.080 align:middle line:84% So the proof is just by induction. 00:24:18.080 --> 00:24:19.560 align:middle line:90% And here's how-- OK. 00:24:19.560 --> 00:24:23.070 align:middle line:84% So we're going to prove by induction 00:24:23.070 --> 00:24:27.213 align:middle line:90% on the depth of this formula. 00:24:27.213 --> 00:24:30.840 align:middle line:90% 00:24:30.840 --> 00:24:34.680 align:middle line:84% If we have just one gate, then, OK, it's 00:24:34.680 --> 00:24:36.750 align:middle line:90% clear the degree is just 1. 00:24:36.750 --> 00:24:39.030 align:middle line:90% So that's fine. 00:24:39.030 --> 00:24:46.140 align:middle line:84% So if number of gates or the depth if you want 00:24:46.140 --> 00:24:52.243 align:middle line:84% is 1, then, of course, the degree 00:24:52.243 --> 00:24:53.660 align:middle line:84% is going to be less than the size. 00:24:53.660 --> 00:24:55.030 align:middle line:90% It's degree is just 1. 00:24:55.030 --> 00:24:58.500 align:middle line:84% That's if you just have a single gate. 00:24:58.500 --> 00:25:01.420 align:middle line:84% And now if you have a more general-- 00:25:01.420 --> 00:25:03.700 align:middle line:84% so now suppose you have a circuit of the form, 00:25:03.700 --> 00:25:06.990 align:middle line:84% let's say, ADD or MULT-- it doesn't matter-- or AND, 00:25:06.990 --> 00:25:08.940 align:middle line:90% you can have phi 1. 00:25:08.940 --> 00:25:11.760 align:middle line:90% Suppose phi is phi 1 AND or OR-- 00:25:11.760 --> 00:25:14.280 align:middle line:90% I don't care-- phi 2. 00:25:14.280 --> 00:25:15.850 align:middle line:90% This can [INAUDIBLE] at the AND. 00:25:15.850 --> 00:25:18.190 align:middle line:84% But of course, it can be also an OR. 00:25:18.190 --> 00:25:21.770 align:middle line:90% Then how do we arithmetize this? 00:25:21.770 --> 00:25:24.160 align:middle line:90% So now what is phi tilde? 00:25:24.160 --> 00:25:34.090 align:middle line:84% Phi tilde is going to be either phi 1 tilde times phi 2 tilde. 00:25:34.090 --> 00:25:37.300 align:middle line:84% Or in the case of-- this is for AND. 00:25:37.300 --> 00:25:44.350 align:middle line:84% If it was OR, then it would be phi 1 tilde plus phi 2 00:25:44.350 --> 00:25:49.180 align:middle line:84% tilde minus phi 1 tilde times phi 2 tilde-- 00:25:49.180 --> 00:25:52.360 align:middle line:84% all, of course, over x1 to xn over x1 to xn. 00:25:52.360 --> 00:25:56.000 align:middle line:90% 00:25:56.000 --> 00:25:56.500 align:middle line:90% Yeah? 00:25:56.500 --> 00:25:57.050 align:middle line:90% OK. 00:25:57.050 --> 00:25:58.690 align:middle line:90% So let's look at the-- 00:25:58.690 --> 00:26:02.770 align:middle line:84% I want to argue that the arithmetic version is 00:26:02.770 --> 00:26:06.470 align:middle line:84% of the sum of the degrees of all the variables, at most, s. 00:26:06.470 --> 00:26:07.610 align:middle line:90% So let's see. 00:26:07.610 --> 00:26:08.715 align:middle line:90% Let's look at phi tilde. 00:26:08.715 --> 00:26:11.620 align:middle line:90% 00:26:11.620 --> 00:26:16.230 align:middle line:84% If the original phi was AND of phi 1 and phi 2, 00:26:16.230 --> 00:26:21.730 align:middle line:84% then phi tilde is just the multiplication-- by definition, 00:26:21.730 --> 00:26:23.580 align:middle line:84% we replaced n with multiplication-- 00:26:23.580 --> 00:26:29.040 align:middle line:84% of the phi 1 tilde polynomial times phi 2 to the polynomial. 00:26:29.040 --> 00:26:30.760 align:middle line:90% But what do we know here? 00:26:30.760 --> 00:26:33.750 align:middle line:90% Here, the degree of each-- 00:26:33.750 --> 00:26:35.610 align:middle line:90% so now let's suppose-- 00:26:35.610 --> 00:26:41.700 align:middle line:84% OK, suppose phi 1-- let's say it's of size s1. 00:26:41.700 --> 00:26:45.150 align:middle line:90% And suppose phi 2 is of size s2. 00:26:45.150 --> 00:26:49.340 align:middle line:90% 00:26:49.340 --> 00:26:54.900 align:middle line:84% Now we know that the size of phi s is equal to s1 plus s2 00:26:54.900 --> 00:26:56.580 align:middle line:90% because it's a tree. 00:26:56.580 --> 00:26:58.440 align:middle line:90% So there's no kind of-- 00:26:58.440 --> 00:26:59.710 align:middle line:90% everything is open. 00:26:59.710 --> 00:27:03.910 align:middle line:84% So the left sides of the tree is s1, size s1. 00:27:03.910 --> 00:27:05.800 align:middle line:84% The right side of the tree is size s2. 00:27:05.800 --> 00:27:08.620 align:middle line:84% The entire tree is the size 2, which is s1 plus s2. 00:27:08.620 --> 00:27:13.090 align:middle line:90% 00:27:13.090 --> 00:27:15.440 align:middle line:90% So what can we say in this case? 00:27:15.440 --> 00:27:17.260 align:middle line:90% So let's focus on the AND. 00:27:17.260 --> 00:27:19.360 align:middle line:90% The OR is exactly the same. 00:27:19.360 --> 00:27:22.280 align:middle line:84% So what can we say about the sum of the degrees? 00:27:22.280 --> 00:27:27.340 align:middle line:90% So sum of degree-- 00:27:27.340 --> 00:27:35.750 align:middle line:84% the degree of the i-th element-- of xi in phi is equal sum and i. 00:27:35.750 --> 00:27:40.100 align:middle line:84% What is the degree of the i-th variable in phi? 00:27:40.100 --> 00:27:42.500 align:middle line:84% It's the degree here plus the degree here. 00:27:42.500 --> 00:27:45.940 align:middle line:84% When you multiply things, I need to sum the degrees. 00:27:45.940 --> 00:27:52.990 align:middle line:84% So it's the degree of xi in phi 1 tilde 00:27:52.990 --> 00:27:58.410 align:middle line:84% plus the degree of variable i in phi 2 tilde. 00:27:58.410 --> 00:28:01.720 align:middle line:90% 00:28:01.720 --> 00:28:03.080 align:middle line:90% We have two polynomials. 00:28:03.080 --> 00:28:05.950 align:middle line:90% Multiply the degree x. 00:28:05.950 --> 00:28:16.880 align:middle line:84% But this is just s1 plus s2 by induction-- 00:28:16.880 --> 00:28:18.516 align:middle line:90% by the induction hypothesis. 00:28:18.516 --> 00:28:27.530 align:middle line:90% 00:28:27.530 --> 00:28:29.570 align:middle line:90% OK, so the degree here-- 00:28:29.570 --> 00:28:32.697 align:middle line:84% the sum of the degrees is like the size of the formula. 00:28:32.697 --> 00:28:34.530 align:middle line:84% We actually don't really care about the sum. 00:28:34.530 --> 00:28:35.863 align:middle line:90% We care about the degree itself. 00:28:35.863 --> 00:28:38.300 align:middle line:84% But this shows you at least the degree of each one 00:28:38.300 --> 00:28:41.600 align:middle line:84% is also, at most, the size of the formula. 00:28:41.600 --> 00:28:43.650 align:middle line:90% And therefore, the sum-- 00:28:43.650 --> 00:28:45.350 align:middle line:90% so now when we run-- 00:28:45.350 --> 00:28:48.050 align:middle line:90% so let me put this back up. 00:28:48.050 --> 00:28:52.800 align:middle line:84% So we run the sum-check on this polynomial, 00:28:52.800 --> 00:28:59.760 align:middle line:84% and we get the communication complexity. 00:28:59.760 --> 00:29:02.960 align:middle line:84% And the verify runtime will be n-- 00:29:02.960 --> 00:29:08.960 align:middle line:84% or the number of variables here, n times the degree, which is s-- 00:29:08.960 --> 00:29:11.940 align:middle line:84% essentially the size of the input, that's s-- 00:29:11.940 --> 00:29:13.350 align:middle line:90% and polylog the field. 00:29:13.350 --> 00:29:15.330 align:middle line:90% So you just need to take-- 00:29:15.330 --> 00:29:18.660 align:middle line:90% and similarly-- and the verify-- 00:29:18.660 --> 00:29:22.060 align:middle line:84% yeah, the degree, which is s, the completeness is always 1. 00:29:22.060 --> 00:29:24.150 align:middle line:84% And the soundness-- importantly, the soundness 00:29:24.150 --> 00:29:31.810 align:middle line:84% of this protocol is n, the number of variables, 00:29:31.810 --> 00:29:37.350 align:middle line:84% the degree, which is s, divided by the size of F. 00:29:37.350 --> 00:29:39.840 align:middle line:84% So all we need to make sure is to arithmetize 00:29:39.840 --> 00:29:42.060 align:middle line:84% with a field that's significantly 00:29:42.060 --> 00:29:44.405 align:middle line:90% larger than n times s. 00:29:44.405 --> 00:29:45.905 align:middle line:84% And this will be the soundness here. 00:29:45.905 --> 00:29:49.440 align:middle line:90% 00:29:49.440 --> 00:29:52.050 align:middle line:84% And of course, then you can repeat all this 00:29:52.050 --> 00:29:55.980 align:middle line:90% to get here as long as you want. 00:29:55.980 --> 00:29:57.216 align:middle line:90% OK. 00:29:57.216 --> 00:29:58.990 align:middle line:90% Any, yeah, questions? 00:29:58.990 --> 00:30:07.740 align:middle line:90% 00:30:07.740 --> 00:30:09.720 align:middle line:90% Yeah? 00:30:09.720 --> 00:30:10.490 align:middle line:90% You can go first. 00:30:10.490 --> 00:30:11.032 align:middle line:90% AUDIENCE: OK. 00:30:11.032 --> 00:30:14.900 align:middle line:84% So when you do the sum-check, when the sum is happening, 00:30:14.900 --> 00:30:17.350 align:middle line:84% is that necessarily a sum over the field? 00:30:17.350 --> 00:30:20.880 align:middle line:84% Or can it be any sum over a different field? 00:30:20.880 --> 00:30:25.482 align:middle line:84% If your original field is just, I don't know, some prime field. 00:30:25.482 --> 00:30:27.440 align:middle line:84% PROFESSOR: Just note, in this specific problem, 00:30:27.440 --> 00:30:29.800 align:middle line:84% I don't have an original field actually. 00:30:29.800 --> 00:30:32.210 align:middle line:84% # For this specific #SAT, I'm over 0 0, 1. 00:30:32.210 --> 00:30:32.990 align:middle line:90% There's no field. 00:30:32.990 --> 00:30:34.400 align:middle line:90% It's not an algebraic. 00:30:34.400 --> 00:30:36.130 align:middle line:90% It's a Boolean thing. 00:30:36.130 --> 00:30:39.680 align:middle line:84% I don't have any polynomial, any algebra, any field, nothing. 00:30:39.680 --> 00:30:42.830 align:middle line:84% I just have 0, 1, and I have AND and OR gates. 00:30:42.830 --> 00:30:48.130 align:middle line:84% And to prove that the number of satisfying assignment 00:30:48.130 --> 00:30:53.200 align:middle line:84% in the Boolean cube is k, I choose a field of my liking, 00:30:53.200 --> 00:30:55.690 align:middle line:90% and I arithmetize. 00:30:55.690 --> 00:30:58.610 align:middle line:84% I think of this circuit as polynomials, 00:30:58.610 --> 00:31:01.550 align:middle line:84% as having addition and multiplication gates. 00:31:01.550 --> 00:31:06.190 align:middle line:84% And in my head, I think of this circuit as this formula 00:31:06.190 --> 00:31:08.140 align:middle line:90% as a polynomial. 00:31:08.140 --> 00:31:10.800 align:middle line:90% So I choose the field. 00:31:10.800 --> 00:31:12.210 align:middle line:90% It's not actually the problem. 00:31:12.210 --> 00:31:16.340 align:middle line:84% I, on purpose, chose a field so that I 00:31:16.340 --> 00:31:18.293 align:middle line:90% can do the sum-check protocol. 00:31:18.293 --> 00:31:18.960 align:middle line:90% AUDIENCE: Right. 00:31:18.960 --> 00:31:19.610 align:middle line:90% Yeah. 00:31:19.610 --> 00:31:25.040 align:middle line:84% But I guess what I'm asking is, for the sum in the sum-check, 00:31:25.040 --> 00:31:26.455 align:middle line:90% let's say not for this problem. 00:31:26.455 --> 00:31:27.330 align:middle line:90% PROFESSOR: Oh, I see. 00:31:27.330 --> 00:31:27.470 align:middle line:90% I see. 00:31:27.470 --> 00:31:28.070 align:middle line:90% You're saying, in general. 00:31:28.070 --> 00:31:30.210 align:middle line:84% You're saying, look, let's say you have a sum-check problem. 00:31:30.210 --> 00:31:31.610 align:middle line:84% Someone gave you sum-check problem. 00:31:31.610 --> 00:31:33.120 align:middle line:84% And you're not happy with the field. 00:31:33.120 --> 00:31:34.662 align:middle line:84% The field is not good enough for you, 00:31:34.662 --> 00:31:36.690 align:middle line:84% or it doesn't give you enough soundness. 00:31:36.690 --> 00:31:38.160 align:middle line:90% Can you amplify? 00:31:38.160 --> 00:31:39.960 align:middle line:84% Can you work over a different field? 00:31:39.960 --> 00:31:41.100 align:middle line:90% Is that what you're asking? 00:31:41.100 --> 00:31:42.767 align:middle line:84% AUDIENCE: Or I guess what I'm asking is, 00:31:42.767 --> 00:31:45.812 align:middle line:84% if you have sum-check and there is some field-- 00:31:45.812 --> 00:31:47.270 align:middle line:84% let's say you're working mod, like, 00:31:47.270 --> 00:31:49.020 align:middle line:90% some large prime or something. 00:31:49.020 --> 00:31:52.040 align:middle line:84% But then, will the sum that you're doing 00:31:52.040 --> 00:31:55.340 align:middle line:84% be also over that field, necessarily? 00:31:55.340 --> 00:31:57.383 align:middle line:84% Can you just change those arbitrarily? 00:31:57.383 --> 00:31:58.050 align:middle line:90% PROFESSOR: Good. 00:31:58.050 --> 00:31:59.780 align:middle line:84% So when I do a sum-check over the field, 00:31:59.780 --> 00:32:01.620 align:middle line:84% everything will be over that field, yes. 00:32:01.620 --> 00:32:03.037 align:middle line:84% Everything will be over the field. 00:32:03.037 --> 00:32:06.087 align:middle line:84% However, that said, if I'm not happy, the p of-- 00:32:06.087 --> 00:32:07.920 align:middle line:84% you're saying, so I got a sum-check protocol 00:32:07.920 --> 00:32:12.300 align:middle line:90% with certain p over gf2 or gfp. 00:32:12.300 --> 00:32:14.490 align:middle line:84% So everything is mod p with certain p. 00:32:14.490 --> 00:32:16.900 align:middle line:84% Now, yes, everything should be over this field. 00:32:16.900 --> 00:32:19.288 align:middle line:84% Now you can say, well, this p is not that great 00:32:19.288 --> 00:32:21.330 align:middle line:84% because it's not that much bigger than m times d. 00:32:21.330 --> 00:32:23.230 align:middle line:84% And I'm not really happy with this field. 00:32:23.230 --> 00:32:25.980 align:middle line:84% Or maybe even it's smaller than m times d, for all i know. 00:32:25.980 --> 00:32:27.820 align:middle line:84% It's not a good field, not big enough. 00:32:27.820 --> 00:32:29.652 align:middle line:90% Then what do I do? 00:32:29.652 --> 00:32:30.610 align:middle line:90% So I'm saying, it's OK. 00:32:30.610 --> 00:32:31.210 align:middle line:90% Don't worry. 00:32:31.210 --> 00:32:32.730 align:middle line:90% Just take an extension field. 00:32:32.730 --> 00:32:38.070 align:middle line:84% Instead of looking over p, you work over gfp to the n. 00:32:38.070 --> 00:32:41.417 align:middle line:84% So you can take a field of size p to the n for any n 00:32:41.417 --> 00:32:42.000 align:middle line:90% that you want. 00:32:42.000 --> 00:32:45.810 align:middle line:84% And you're only going to pay polynomially or linearly 00:32:45.810 --> 00:32:47.820 align:middle line:90% with this n. 00:32:47.820 --> 00:32:49.990 align:middle line:84% And then you can amplify your soundness. 00:32:49.990 --> 00:32:50.550 align:middle line:90% AUDIENCE: OK. 00:32:50.550 --> 00:32:51.720 align:middle line:84% I was just wondering because I was wondering 00:32:51.720 --> 00:32:54.248 align:middle line:84% what happens if k is larger than the size of the field 00:32:54.248 --> 00:32:54.790 align:middle line:90% or something? 00:32:54.790 --> 00:32:56.220 align:middle line:84% PROFESSOR: Oh, I'm going to choose the field 00:32:56.220 --> 00:32:56.950 align:middle line:90% to be much bigger. 00:32:56.950 --> 00:32:57.650 align:middle line:90% AUDIENCE: OK, I see. 00:32:57.650 --> 00:32:58.810 align:middle line:84% PROFESSOR: Yeah, I'm going to choose the field. 00:32:58.810 --> 00:33:00.310 align:middle line:90% Otherwise, you can't-- yeah. 00:33:00.310 --> 00:33:03.000 align:middle line:84% I need to choose the field to be much bigger than k. 00:33:03.000 --> 00:33:03.660 align:middle line:90% Yeah? 00:33:03.660 --> 00:33:04.480 align:middle line:90% AUDIENCE: So like-- 00:33:04.480 --> 00:33:05.780 align:middle line:90% PROFESSOR: Oh, sorry. 00:33:05.780 --> 00:33:06.890 align:middle line:90% I forgot you. 00:33:06.890 --> 00:33:07.390 align:middle line:90% Yeah. 00:33:07.390 --> 00:33:08.223 align:middle line:90% OK, yeah? 00:33:08.223 --> 00:33:09.890 align:middle line:84% AUDIENCE: This is related to this point, 00:33:09.890 --> 00:33:11.890 align:middle line:84% but we need to choose a field that 00:33:11.890 --> 00:33:13.900 align:middle line:84% has really big characteristics, and we to choose 00:33:13.900 --> 00:33:17.060 align:middle line:90% a really big prime number. 00:33:17.060 --> 00:33:20.940 align:middle line:84% We can't just raise it to the n because k can be 2 to the n. 00:33:20.940 --> 00:33:27.071 align:middle line:90% 00:33:27.071 --> 00:33:30.190 align:middle line:84% AUDIENCE: Can you find field that's bigger than k? 00:33:30.190 --> 00:33:32.510 align:middle line:84% PROFESSOR: Yeah, no, but the question is, can you-- no, 00:33:32.510 --> 00:33:34.340 align:middle line:90% but the question-- 00:33:34.340 --> 00:33:38.220 align:middle line:90% well, OK. 00:33:38.220 --> 00:33:39.970 align:middle line:84% In our case, you can just choose the field 00:33:39.970 --> 00:33:41.200 align:middle line:90% to be as big as you want. 00:33:41.200 --> 00:33:45.100 align:middle line:84% In the case where you're giving a sum-check, of course, 00:33:45.100 --> 00:33:46.100 align:middle line:90% the sum is in the field. 00:33:46.100 --> 00:33:48.172 align:middle line:90% It's something about the field. 00:33:48.172 --> 00:33:49.880 align:middle line:84% You're giving something about the fields. 00:33:49.880 --> 00:33:51.610 align:middle line:84% So, OK, we'll always be in the field. 00:33:51.610 --> 00:33:53.115 align:middle line:84% # AUDIENCE: But for this #SAT one-- 00:33:53.115 --> 00:33:54.490 align:middle line:84% PROFESSOR: For this specific one, 00:33:54.490 --> 00:33:57.860 align:middle line:84% I'm thinking of, yeah, you choose a k that's bigger. 00:33:57.860 --> 00:34:00.950 align:middle line:84% However, I'm not 100% sure that-- 00:34:00.950 --> 00:34:03.340 align:middle line:90% hey, let me think. 00:34:03.340 --> 00:34:06.705 align:middle line:84% Can you use small characteristic? 00:34:06.705 --> 00:34:07.830 align:middle line:90% AUDIENCE: Can you Chinese-- 00:34:07.830 --> 00:34:08.679 align:middle line:84% PROFESSOR: Yeah, that's what I'm thinking. 00:34:08.679 --> 00:34:11.096 align:middle line:84% I'm not sure if you can't use some Chinese remainder trick 00:34:11.096 --> 00:34:12.677 align:middle line:84% and use over a small characteristic. 00:34:12.677 --> 00:34:13.719 align:middle line:90% I need to think about it. 00:34:13.719 --> 00:34:15.989 align:middle line:84% But anyway, in this case, just choose a f 00:34:15.989 --> 00:34:20.370 align:middle line:84% to the gfp for a large p, and that's bigger than k. 00:34:20.370 --> 00:34:20.969 align:middle line:90% Yeah. 00:34:20.969 --> 00:34:21.730 align:middle line:90% Sorry. 00:34:21.730 --> 00:34:23.268 align:middle line:90% Did you have a question? 00:34:23.268 --> 00:34:24.810 align:middle line:84% AUDIENCE: I was going to ask, is this 00:34:24.810 --> 00:34:29.889 align:middle line:84% # the only way we know how to do for the #SAT that's easy? 00:34:29.889 --> 00:34:30.909 align:middle line:90% PROFESSOR: This is easy. 00:34:30.909 --> 00:34:31.679 align:middle line:90% What do you mean? 00:34:31.679 --> 00:34:32.697 align:middle line:90% You want easier? 00:34:32.697 --> 00:34:33.530 align:middle line:90% AUDIENCE: It's easy. 00:34:33.530 --> 00:34:34.290 align:middle line:90% It's nice. 00:34:34.290 --> 00:34:35.730 align:middle line:90% I'm just wondering. 00:34:35.730 --> 00:34:38.670 align:middle line:84% PROFESSOR: So no, I think this is the simplest way. 00:34:38.670 --> 00:34:44.760 align:middle line:84% # So let me just say-- so we put #SAT into IP in this way. 00:34:44.760 --> 00:34:47.295 align:middle line:84% You can ask, what about, let's say, sharp circuit SAT? 00:34:47.295 --> 00:34:49.420 align:middle line:84% Which is the same thing, but we're given a circuit. 00:34:49.420 --> 00:34:51.060 align:middle line:84% So we're given a circuit, and you 00:34:51.060 --> 00:34:53.040 align:middle line:84% want to know how many satisfying assignment 00:34:53.040 --> 00:34:54.540 align:middle line:90% does it have over 0, 1 to the n. 00:34:54.540 --> 00:34:57.510 align:middle line:84% It's the same thing, except for phi is now-- 00:34:57.510 --> 00:34:58.660 align:middle line:90% it's not a tree anymore. 00:34:58.660 --> 00:35:01.798 align:middle line:90% It's a directed acyclic graph. 00:35:01.798 --> 00:35:03.520 align:middle line:84% And it turns out that it also has 00:35:03.520 --> 00:35:05.150 align:middle line:90% an IP because it's in p space. 00:35:05.150 --> 00:35:07.660 align:middle line:84% You can go over all possible x's-- 00:35:07.660 --> 00:35:10.280 align:middle line:84% x1 up to xn-- and check if it's satisfying or not. 00:35:10.280 --> 00:35:11.710 align:middle line:90% And it's small space. 00:35:11.710 --> 00:35:15.890 align:middle line:84% So it's in p space, and so you can ask, OK, so what about this? 00:35:15.890 --> 00:35:18.620 align:middle line:84% Now you can do sum-check because the degree won't be small. 00:35:18.620 --> 00:35:19.850 align:middle line:90% So actually, you can do it. 00:35:19.850 --> 00:35:20.630 align:middle line:90% But that's much. 00:35:20.630 --> 00:35:23.740 align:middle line:84% Much more complicated and requires this degree reduction 00:35:23.740 --> 00:35:24.790 align:middle line:90% thing. 00:35:24.790 --> 00:35:27.267 align:middle line:84% That's how Shamir proves IP equals p space. 00:35:27.267 --> 00:35:29.350 align:middle line:84% It's that there's some degree reduction there that 00:35:29.350 --> 00:35:31.010 align:middle line:90% really complicates matters. 00:35:31.010 --> 00:35:32.900 align:middle line:84% So you need that for a circuit set. 00:35:32.900 --> 00:35:36.530 align:middle line:84% But for SAT, because it's so low degree immediately, it's nice. 00:35:36.530 --> 00:35:38.170 align:middle line:90% And that's all you do. 00:35:38.170 --> 00:35:40.090 align:middle line:90% Yeah, you should be-- 00:35:40.090 --> 00:35:41.330 align:middle line:90% where's the gratitude? 00:35:41.330 --> 00:35:42.490 align:middle line:90% [LAUGHTER] 00:35:42.490 --> 00:35:45.680 align:middle line:84% AUDIENCE: So I guess, the one interpretation of this question, 00:35:45.680 --> 00:35:48.290 align:middle line:84% I suppose, is that suppose you're given another problem. 00:35:48.290 --> 00:35:49.550 align:middle line:90% It's a permanent or something. 00:35:49.550 --> 00:35:53.060 align:middle line:84% So I guess, it's a formula you define. 00:35:53.060 --> 00:35:58.640 align:middle line:84% # But I want to direct without reducing to a #SAT and so forth. 00:35:58.640 --> 00:36:01.700 align:middle line:84% I mean, I want a direct protocol. 00:36:01.700 --> 00:36:03.133 align:middle line:90% It's not very well-defined. 00:36:03.133 --> 00:36:03.800 align:middle line:90% PROFESSOR: Yeah. 00:36:03.800 --> 00:36:08.540 align:middle line:84% So I have to say, almost all the protocols I know for IP 00:36:08.540 --> 00:36:10.632 align:middle line:90% go through sum-check. 00:36:10.632 --> 00:36:12.590 align:middle line:84% AUDIENCE: Actually, there's this weird one by-- 00:36:12.590 --> 00:36:15.260 align:middle line:90% 00:36:15.260 --> 00:36:16.020 align:middle line:90% I might be wrong. 00:36:16.020 --> 00:36:18.347 align:middle line:84% I hoped that Irena Mano was one of the authors, not 00:36:18.347 --> 00:36:18.930 align:middle line:90% the other one. 00:36:18.930 --> 00:36:22.130 align:middle line:84% But this is a weird one that goes through a quantum problem. 00:36:22.130 --> 00:36:24.630 align:middle line:84% If they were trying to prove verification, 00:36:24.630 --> 00:36:27.230 align:middle line:84% information theoretic verification or BPP and they 00:36:27.230 --> 00:36:32.130 align:middle line:84% failed, but they got sharp peers in IP in some other way. 00:36:32.130 --> 00:36:34.772 align:middle line:90% 00:36:34.772 --> 00:36:36.480 align:middle line:84% PROFESSOR: So I'm not familiar with that. 00:36:36.480 --> 00:36:41.510 align:middle line:84% But I think the main ones go through sum-check. 00:36:41.510 --> 00:36:43.442 align:middle line:90% AUDIENCE: [INAUDIBLE] sum-check? 00:36:43.442 --> 00:36:46.460 align:middle line:90% 00:36:46.460 --> 00:36:48.412 align:middle line:84% AUDIENCE: What I remember is there's this-- 00:36:48.412 --> 00:36:49.620 align:middle line:90% it's a little like sum-check. 00:36:49.620 --> 00:36:53.600 align:middle line:84% But they're also looking at reduced densities 00:36:53.600 --> 00:36:55.025 align:middle line:90% over updates and stuff. 00:36:55.025 --> 00:36:59.550 align:middle line:90% 00:36:59.550 --> 00:37:01.900 align:middle line:84% # PROFESSOR: Any other questions about #SAT? 00:37:01.900 --> 00:37:03.510 align:middle line:90% Yeah? 00:37:03.510 --> 00:37:05.250 align:middle line:84% AUDIENCE: Sum-check protocol is-- 00:37:05.250 --> 00:37:06.877 align:middle line:84% I believe, it's operating over a field, 00:37:06.877 --> 00:37:08.585 align:middle line:84% like all the summation goes to the field. 00:37:08.585 --> 00:37:09.340 align:middle line:90% PROFESSOR: Right, right, right. 00:37:09.340 --> 00:37:10.248 align:middle line:90% Yeah, yeah, yeah. 00:37:10.248 --> 00:37:11.790 align:middle line:84% AUDIENCE: So does that mean that we'd 00:37:11.790 --> 00:37:13.930 align:middle line:84% be safe to make sure to ensure correctness, 00:37:13.930 --> 00:37:15.660 align:middle line:84% we must ensure that the field has 00:37:15.660 --> 00:37:19.283 align:middle line:84% characteristic greater than the number of satisfying solutions? 00:37:19.283 --> 00:37:20.325 align:middle line:90% PROFESSOR: Yeah, exactly. 00:37:20.325 --> 00:37:23.445 align:middle line:84% AUDIENCE: In this case 2 to the n. 00:37:23.445 --> 00:37:24.070 align:middle line:90% PROFESSOR: Yes. 00:37:24.070 --> 00:37:29.910 align:middle line:84% Yes, but the verifier runs in time log in this circuit. 00:37:29.910 --> 00:37:33.370 align:middle line:84% So in the log in the-- sorry, in the size of the field. 00:37:33.370 --> 00:37:33.960 align:middle line:90% Yeah. 00:37:33.960 --> 00:37:34.920 align:middle line:90% Log in the size of the field. 00:37:34.920 --> 00:37:36.215 align:middle line:90% So the field can be 2 to the n. 00:37:36.215 --> 00:37:36.840 align:middle line:90% AUDIENCE: Yeah. 00:37:36.840 --> 00:37:38.610 align:middle line:90% So that's a requirement. 00:37:38.610 --> 00:37:40.763 align:middle line:84% You can't fix small characteristic. 00:37:40.763 --> 00:37:41.430 align:middle line:90% PROFESSOR: Yeah. 00:37:41.430 --> 00:37:44.560 align:middle line:90% So yeah, OK. 00:37:44.560 --> 00:37:48.990 align:middle line:84% So what we should do is take gfp, large field, 00:37:48.990 --> 00:37:50.170 align:middle line:90% like, large characteristic. 00:37:50.170 --> 00:37:52.598 align:middle line:84% I'm not sure you can take small characteristic, actually. 00:37:52.598 --> 00:37:55.140 align:middle line:84% I need to think about it because maybe some Chinese remainder 00:37:55.140 --> 00:37:56.430 align:middle line:90% theorem can help you. 00:37:56.430 --> 00:38:01.090 align:middle line:84% AUDIENCE: But that was quite expensive not using the p. 00:38:01.090 --> 00:38:04.960 align:middle line:84% What's [INAUDIBLE] protocol over many small primes 00:38:04.960 --> 00:38:07.547 align:middle line:84% and make sure that the answers are all the number of suspects. 00:38:07.547 --> 00:38:08.380 align:middle line:90% AUDIENCE: Oh, I see. 00:38:08.380 --> 00:38:10.108 align:middle line:90% [INTERPOSING VOICES] 00:38:10.108 --> 00:38:11.150 align:middle line:90% PROFESSOR: Yeah, exactly. 00:38:11.150 --> 00:38:11.890 align:middle line:90% AUDIENCE: Multiple times. 00:38:11.890 --> 00:38:13.510 align:middle line:84% PROFESSOR: Yeah, exactly, exactly. 00:38:13.510 --> 00:38:16.052 align:middle line:84% AUDIENCE: You need to target those primes to be larger than k 00:38:16.052 --> 00:38:17.410 align:middle line:90% anyway. 00:38:17.410 --> 00:38:18.700 align:middle line:90% AUDIENCE: Yeah, it does. 00:38:18.700 --> 00:38:19.538 align:middle line:90% Yeah. 00:38:19.538 --> 00:38:20.830 align:middle line:90% PROFESSOR: Why doesn't it help? 00:38:20.830 --> 00:38:21.622 align:middle line:90% AUDIENCE: Because-- 00:38:21.622 --> 00:38:23.440 align:middle line:90% [INTERPOSING VOICES] 00:38:23.440 --> 00:38:24.510 align:middle line:90% PROFESSOR: Yeah, but-- 00:38:24.510 --> 00:38:25.390 align:middle line:90% [INTERPOSING VOICES] 00:38:25.390 --> 00:38:26.900 align:middle line:84% PROFESSOR: Yeah, yeah, yeah, yeah. 00:38:26.900 --> 00:38:28.990 align:middle line:84% No, but if you don't want to, sometimes-- 00:38:28.990 --> 00:38:30.448 align:middle line:84% AUDIENCE: Actually, I'm not so sure 00:38:30.448 --> 00:38:34.090 align:middle line:84% because the computational complexity is going to be-- 00:38:34.090 --> 00:38:35.780 align:middle line:90% is probably going to be smaller. 00:38:35.780 --> 00:38:40.380 align:middle line:84% Instead of log, a big field size to the power of 3 or something, 00:38:40.380 --> 00:38:44.410 align:middle line:84% you have sum of log small-size fields to the power of 3, 00:38:44.410 --> 00:38:45.410 align:middle line:90% which is-- 00:38:45.410 --> 00:38:46.217 align:middle line:90% I see. 00:38:46.217 --> 00:38:46.833 align:middle line:90% Yeah. 00:38:46.833 --> 00:38:48.250 align:middle line:84% AUDIENCE: And you can parallelize. 00:38:48.250 --> 00:38:49.542 align:middle line:90% AUDIENCE: You can probably see. 00:38:49.542 --> 00:38:51.970 align:middle line:90% PROFESSOR: Yeah. 00:38:51.970 --> 00:38:57.373 align:middle line:84% OK, so by the way, just note about the proof of runtime here, 00:38:57.373 --> 00:38:59.540 align:middle line:84% of course, it's large because it needs to find the-- 00:38:59.540 --> 00:39:00.540 align:middle line:90% I mean, what can you do? 00:39:00.540 --> 00:39:02.090 align:middle line:84% You need to at least count the number 00:39:02.090 --> 00:39:03.210 align:middle line:90% of satisfying assignments. 00:39:03.210 --> 00:39:05.610 align:middle line:84% It takes 2 to the n, at least, to find them. 00:39:05.610 --> 00:39:07.888 align:middle line:90% And then-- OK. 00:39:07.888 --> 00:39:10.890 align:middle line:90% So far, we gave some examples. 00:39:10.890 --> 00:39:12.110 align:middle line:90% So where are we? 00:39:12.110 --> 00:39:13.080 align:middle line:90% We talked about IP. 00:39:13.080 --> 00:39:17.810 align:middle line:84% We showed the magical, amazing sum-check protocol. 00:39:17.810 --> 00:39:20.000 align:middle line:84% We showed how to use the sum-check protocol 00:39:20.000 --> 00:39:24.240 align:middle line:84% # to give an IP for an inductive proof for #SAT. 00:39:24.240 --> 00:39:24.740 align:middle line:90% In 00:39:24.740 --> 00:39:27.570 align:middle line:84% In some sense, maybe you're not so blown away at this point 00:39:27.570 --> 00:39:31.220 align:middle line:84% # because, actually, #SAT, like a formula, 00:39:31.220 --> 00:39:33.570 align:middle line:84% is really going to-- arithmetization is not like, 00:39:33.570 --> 00:39:35.990 align:middle line:84% wow, we know we all know that n is like multiplication, 00:39:35.990 --> 00:39:40.345 align:middle line:84% and AND and OR can be written as small arithmetic thing. 00:39:40.345 --> 00:39:41.970 align:middle line:84% So it's actually an arithmetic circuit. 00:39:41.970 --> 00:39:45.020 align:middle line:84% So it actually gives you a set of low-degree polynomials. 00:39:45.020 --> 00:39:46.680 align:middle line:90% So it calls for something. 00:39:46.680 --> 00:39:47.720 align:middle line:90% It is a sum-check. 00:39:47.720 --> 00:39:52.640 align:middle line:84% Without much change, it presents itself almost as a sum-check. 00:39:52.640 --> 00:39:56.200 align:middle line:84% So maybe we're not convinced of the generality of the sum-check. 00:39:56.200 --> 00:39:59.370 align:middle line:84% And the next thing I want to do is show you actually 00:39:59.370 --> 00:40:00.750 align:middle line:84% a completely different thing that 00:40:00.750 --> 00:40:03.970 align:middle line:84% doesn't seem to be at all low degree or anything, 00:40:03.970 --> 00:40:07.630 align:middle line:84% and try to show you how you can use the sum-check. 00:40:07.630 --> 00:40:12.330 align:middle line:84% And actually, this takes us at a nice way 00:40:12.330 --> 00:40:17.320 align:middle line:84% into the idea of doubly efficient proofs. 00:40:17.320 --> 00:40:19.720 align:middle line:84% So far, when we talked about interactive proofs, 00:40:19.720 --> 00:40:21.910 align:middle line:84% our focus was the verifier is efficient. 00:40:21.910 --> 00:40:23.080 align:middle line:90% He's polynomial time. 00:40:23.080 --> 00:40:24.940 align:middle line:90% The prover can be whatever. 00:40:24.940 --> 00:40:27.610 align:middle line:84% # And indeed, in the protocols, both sum-check and #SAT, 00:40:27.610 --> 00:40:29.200 align:middle line:84% of course, the prover runs in exponential time. 00:40:29.200 --> 00:40:29.908 align:middle line:90% He has no choice. 00:40:29.908 --> 00:40:31.530 align:middle line:90% He needs to do the computation. 00:40:31.530 --> 00:40:33.282 align:middle line:90% OK. 00:40:33.282 --> 00:40:36.960 align:middle line:84% The idea that-- so now let's shift gears and talk 00:40:36.960 --> 00:40:40.950 align:middle line:84% about the notion of a doubly efficient interactive proof. 00:40:40.950 --> 00:40:44.230 align:middle line:84% So the notion of a doubly efficient interactive proof-- 00:40:44.230 --> 00:40:47.440 align:middle line:84% the idea is actually, you know what? 00:40:47.440 --> 00:40:51.160 align:middle line:84% So the main idea is we care about the runtime of the proof. 00:40:51.160 --> 00:40:52.950 align:middle line:84% So the prover paper is not all-powerful. 00:40:52.950 --> 00:40:55.260 align:middle line:90% It brings us to real life. 00:40:55.260 --> 00:40:57.255 align:middle line:84% It's very nice that the verifier is polynomial. 00:40:57.255 --> 00:40:58.380 align:middle line:90% The prover is all-powerful. 00:40:58.380 --> 00:41:01.670 align:middle line:84% But guess what, all-powerful doesn't exist. 00:41:01.670 --> 00:41:03.450 align:middle line:84% Everything is limited, to some extent. 00:41:03.450 --> 00:41:05.670 align:middle line:84% There's more powerful and less powerful, 00:41:05.670 --> 00:41:07.170 align:middle line:90% but there's not all-powerful. 00:41:07.170 --> 00:41:09.222 align:middle line:84% So what we want is, yes, the prover 00:41:09.222 --> 00:41:10.680 align:middle line:84% is more powerful than the verifier. 00:41:10.680 --> 00:41:11.525 align:middle line:90% Otherwise, we don't need it. 00:41:11.525 --> 00:41:12.775 align:middle line:90% The verifier doesn't need him. 00:41:12.775 --> 00:41:14.790 align:middle line:84% But even the prover is not all-powerful. 00:41:14.790 --> 00:41:17.190 align:middle line:84% So in a double efficient interactive proof, 00:41:17.190 --> 00:41:20.430 align:middle line:84% we want to say, the prover has a problem at hand. 00:41:20.430 --> 00:41:24.050 align:middle line:84% And he should not spend too much overhead 00:41:24.050 --> 00:41:30.230 align:middle line:84% in convincing the verifier that his solution-- 00:41:30.230 --> 00:41:32.420 align:middle line:84% let's say that x is in the language. 00:41:32.420 --> 00:41:38.730 align:middle line:84% And this is interesting even if the problem-- 00:41:38.730 --> 00:41:41.340 align:middle line:84% so when we talk about doubly efficient interactive proofs, 00:41:41.340 --> 00:41:44.412 align:middle line:90% we even care of problems in p. 00:41:44.412 --> 00:41:46.370 align:middle line:84% So often, when we talk about interactive proof, 00:41:46.370 --> 00:41:50.490 align:middle line:84% we think, even, let's say, the problem is polynomial time. 00:41:50.490 --> 00:41:57.850 align:middle line:84% So I want to argue proofs of polynomial time, a language. 00:41:57.850 --> 00:41:59.020 align:middle line:90% But I want to verify. 00:41:59.020 --> 00:42:01.960 align:middle line:84% Let's say the time to determine this language is, 00:42:01.960 --> 00:42:03.210 align:middle line:90% I don't know, n to the fourth. 00:42:03.210 --> 00:42:06.390 align:middle line:84% I want the verifier to be linear time. 00:42:06.390 --> 00:42:09.270 align:middle line:84% So the idea is there should always 00:42:09.270 --> 00:42:11.640 align:middle line:84% be a gap between how powerful the prover is, 00:42:11.640 --> 00:42:13.690 align:middle line:90% and the verifier is weaker. 00:42:13.690 --> 00:42:15.687 align:middle line:90% But I really care about both. 00:42:15.687 --> 00:42:17.520 align:middle line:84% The verifier should be very, very efficient. 00:42:17.520 --> 00:42:20.910 align:middle line:84% And the prover should also be somewhat efficient. 00:42:20.910 --> 00:42:23.460 align:middle line:90% That's the idea. 00:42:23.460 --> 00:42:25.985 align:middle line:84% OK, so what is a doubly efficient interactive proof? 00:42:25.985 --> 00:42:32.130 align:middle line:90% 00:42:32.130 --> 00:42:37.500 align:middle line:84% So a doubly efficient-- let's say, for example, L in some D 00:42:37.500 --> 00:42:43.390 align:middle line:84% time T. So it can be computed in deterministic time T. Again, 00:42:43.390 --> 00:42:46.410 align:middle line:84% you can think of T even to be n to the fourth. 00:42:46.410 --> 00:42:47.580 align:middle line:90% It can be polynomial. 00:42:47.580 --> 00:42:57.350 align:middle line:84% Is an IP where the prover runtime-- the honest prover-- 00:42:57.350 --> 00:43:07.450 align:middle line:84% the honest prover's runtime is only polynomial overhead 00:43:07.450 --> 00:43:09.760 align:middle line:84% in the time of determining the language. 00:43:09.760 --> 00:43:14.110 align:middle line:84% So it takes time T to determine runtime, at most, poly T. 00:43:14.110 --> 00:43:23.980 align:middle line:84% And the verifier runtime should be much, much less. 00:43:23.980 --> 00:43:29.080 align:middle line:84% Ideally, we want the verifier to run in time almost linear 00:43:29.080 --> 00:43:30.850 align:middle line:90% or quasi-linear-- 00:43:30.850 --> 00:43:35.890 align:middle line:84% so n polylog n, let's say, which is denoted by O tilde of n. 00:43:35.890 --> 00:43:38.680 align:middle line:84% So ideally, we want the verifier to run in linear time 00:43:38.680 --> 00:43:40.750 align:middle line:90% or quasi-linear time. 00:43:40.750 --> 00:43:43.092 align:middle line:84% And the prover should not have too much overhead. 00:43:43.092 --> 00:43:44.800 align:middle line:84% Actually, ideally, the prover should also 00:43:44.800 --> 00:43:47.460 align:middle line:90% have just linear overhead. 00:43:47.460 --> 00:43:48.970 align:middle line:84% But definitely, by definition, it 00:43:48.970 --> 00:43:51.905 align:middle line:84% should not have more than polynomial overhead. 00:43:51.905 --> 00:43:53.780 align:middle line:84% AUDIENCE: So again, here is just [INAUDIBLE]. 00:43:53.780 --> 00:43:55.340 align:middle line:90% PROFESSOR: And sorry, yes, yes. 00:43:55.340 --> 00:43:56.120 align:middle line:90% Thank you. 00:43:56.120 --> 00:43:57.260 align:middle line:90% This is T of n. 00:43:57.260 --> 00:43:58.218 align:middle line:90% N is the instance size. 00:43:58.218 --> 00:43:58.718 align:middle line:90% Yes. 00:43:58.718 --> 00:44:01.100 align:middle line:84% So of course, the verifier needs to read the instance, 00:44:01.100 --> 00:44:04.790 align:middle line:90% but not do much more than that. 00:44:04.790 --> 00:44:06.800 align:middle line:84% So it's just an interactive proof 00:44:06.800 --> 00:44:09.050 align:middle line:84% where we care about both the prover and the verifier. 00:44:09.050 --> 00:44:10.400 align:middle line:90% OK. 00:44:10.400 --> 00:44:15.377 align:middle line:84% And yeah, and so let me mention that these things 00:44:15.377 --> 00:44:17.210 align:middle line:84% that people actually care about because they 00:44:17.210 --> 00:44:19.440 align:middle line:84% use it in these blockchain protocols and so on. 00:44:19.440 --> 00:44:22.160 align:middle line:84% And so they really actually-- a lot of work that's 00:44:22.160 --> 00:44:24.020 align:middle line:84% done on this-- and I think in the lecture 00:44:24.020 --> 00:44:26.025 align:middle line:84% notes of Justin Taylor, I'm now going 00:44:26.025 --> 00:44:27.150 align:middle line:90% to refer to these sections. 00:44:27.150 --> 00:44:29.420 align:middle line:84% We won't cover them, but they exist sections 00:44:29.420 --> 00:44:32.255 align:middle line:84% where he really talks about the exact parameters, 00:44:32.255 --> 00:44:34.130 align:middle line:84% the exact numbers, the exact implementations, 00:44:34.130 --> 00:44:35.690 align:middle line:84% and so on, and so forth because these 00:44:35.690 --> 00:44:37.130 align:middle line:84% are things that actually people care about 00:44:37.130 --> 00:44:38.520 align:middle line:90% because they want to run it. 00:44:38.520 --> 00:44:40.790 align:middle line:84% So actually, we really care about the overheads 00:44:40.790 --> 00:44:42.510 align:middle line:90% here in practice, at least. 00:44:42.510 --> 00:44:45.440 align:middle line:90% 00:44:45.440 --> 00:44:47.950 align:middle line:84% So far, we said the sum-check is really-- 00:44:47.950 --> 00:44:51.450 align:middle line:84% of course, it seems like outside the realm, even, 00:44:51.450 --> 00:44:53.710 align:middle line:90% of double efficiency. 00:44:53.710 --> 00:44:57.520 align:middle line:84% But actually, now let me show you a specific example, which, 00:44:57.520 --> 00:45:01.290 align:middle line:84% again, is beyond just an example because we'll 00:45:01.290 --> 00:45:05.650 align:middle line:84% use it to teach something where it's actually in p. 00:45:05.650 --> 00:45:11.490 align:middle line:84% And I'll show you an interactive proof for this problem using 00:45:11.490 --> 00:45:13.140 align:middle line:84% the sum-check protocol-- a doubly 00:45:13.140 --> 00:45:14.680 align:middle line:84% efficient interactive proof for this problem. 00:45:14.680 --> 00:45:15.060 align:middle line:90% Yeah? 00:45:15.060 --> 00:45:16.477 align:middle line:84% AUDIENCE: They're different roots, 00:45:16.477 --> 00:45:18.203 align:middle line:90% like T and the other D time. 00:45:18.203 --> 00:45:18.870 align:middle line:90% PROFESSOR: Good. 00:45:18.870 --> 00:45:19.578 align:middle line:90% Yeah, yeah, yeah. 00:45:19.578 --> 00:45:21.870 align:middle line:84% So take any problem, any language, 00:45:21.870 --> 00:45:23.640 align:middle line:84% for which membership in this language 00:45:23.640 --> 00:45:26.180 align:middle line:90% can be decided in time T. 00:45:26.180 --> 00:45:28.680 align:middle line:84% So these empty means there is a deterministic algorithm that 00:45:28.680 --> 00:45:31.140 align:middle line:84% runs in time T. What T is-- it can be anything. 00:45:31.140 --> 00:45:34.860 align:middle line:84% You can think of T of n to the fourth, n to the 10th. 00:45:34.860 --> 00:45:35.790 align:middle line:90% I don't know. 00:45:35.790 --> 00:45:39.660 align:middle line:84% N to the log n, quasi, poly, whatever. 00:45:39.660 --> 00:45:42.982 align:middle line:84% All I care-- so of course, the prover needs to compute. 00:45:42.982 --> 00:45:45.440 align:middle line:84% If he's proving something, he needs to know that it's true. 00:45:45.440 --> 00:45:47.540 align:middle line:84% So he needs to do this deterministic computation. 00:45:47.540 --> 00:45:49.490 align:middle line:84% So of course, he needs to run in time T, 00:45:49.490 --> 00:45:53.380 align:middle line:84% but should not run in much more than T. And by not more, 00:45:53.380 --> 00:45:56.020 align:middle line:84% theorists say, poly T. Applied people 00:45:56.020 --> 00:46:01.810 align:middle line:84% say linear in T. The real applied say not more than 128 00:46:01.810 --> 00:46:02.510 align:middle line:90% or whatever. 00:46:02.510 --> 00:46:07.510 align:middle line:84% But yeah, depending how far you are in that spectrum. 00:46:07.510 --> 00:46:11.000 align:middle line:90% OK, so good. 00:46:11.000 --> 00:46:14.560 align:middle line:84% So now let me show you how a doubly efficient 00:46:14.560 --> 00:46:17.890 align:middle line:84% interactive proof for counting the number 00:46:17.890 --> 00:46:20.300 align:middle line:90% of triangles in a graph. 00:46:20.300 --> 00:46:21.792 align:middle line:90% That's the example. 00:46:21.792 --> 00:46:24.250 align:middle line:84% Next week, I'm going to show you actually interactive proof 00:46:24.250 --> 00:46:25.090 align:middle line:90% for all-- 00:46:25.090 --> 00:46:28.130 align:middle line:84% doubly efficient proof for all low-depth circuits. 00:46:28.130 --> 00:46:30.020 align:middle line:84% So I'm going to generalize it by a lot. 00:46:30.020 --> 00:46:31.920 align:middle line:90% But let's start with an example. 00:46:31.920 --> 00:46:37.330 align:middle line:90% 00:46:37.330 --> 00:46:42.650 align:middle line:84% So let's say we're given a graph G, 00:46:42.650 --> 00:46:46.850 align:middle line:84% and we want to count the number of triangles in the graph. 00:46:46.850 --> 00:46:51.260 align:middle line:84% So given G-- so we want an interactive proof 00:46:51.260 --> 00:47:02.030 align:middle line:84% for counting the number of triangles in a graph 00:47:02.030 --> 00:47:09.300 align:middle line:84% G with vertices V and edges E. OK. 00:47:09.300 --> 00:47:13.340 align:middle line:84% So I want to cast it as a doubly efficient subset protocol-- 00:47:13.340 --> 00:47:15.200 align:middle line:90% kind of subset protocol, but-- 00:47:15.200 --> 00:47:17.270 align:middle line:84% so notice this is a problem in p. 00:47:17.270 --> 00:47:22.220 align:middle line:84% I can go over all possible three vertices, triple to vertices, 00:47:22.220 --> 00:47:23.850 align:middle line:90% and check if there's a triangle. 00:47:23.850 --> 00:47:29.000 align:middle line:84% So I can check this from time n to the third. 00:47:29.000 --> 00:47:31.580 align:middle line:84% I want that my verifier to be linear. 00:47:31.580 --> 00:47:34.820 align:middle line:84% So I want a prover that runs in time not much more than n 00:47:34.820 --> 00:47:36.260 align:middle line:90% to the third. 00:47:36.260 --> 00:47:40.410 align:middle line:84% Or let's say polynomial time to convince a linear verifier 00:47:40.410 --> 00:47:45.266 align:middle line:84% that this graph has exactly k triangles. 00:47:45.266 --> 00:47:48.000 align:middle line:90% 00:47:48.000 --> 00:47:50.590 align:middle line:84% And I want to cast it somehow in a sum-check protocol. 00:47:50.590 --> 00:47:53.760 align:middle line:90% So how do I do that? 00:47:53.760 --> 00:47:57.720 align:middle line:84% So first, I need to come up with a polynomial. 00:47:57.720 --> 00:47:59.560 align:middle line:84% I need to embed a polynomial here. 00:47:59.560 --> 00:48:01.660 align:middle line:84% Not, there's nothing polynomial-like here. 00:48:01.660 --> 00:48:04.470 align:middle line:90% Talking about graphs. 00:48:04.470 --> 00:48:07.900 align:middle line:84% So remember how I told you everything is a polynomial? 00:48:07.900 --> 00:48:09.400 align:middle line:84% Everything can become a polynomial. 00:48:09.400 --> 00:48:11.190 align:middle line:84% This is an example that shows you 00:48:11.190 --> 00:48:14.230 align:middle line:84% why you take anything and make it a polynomial. 00:48:14.230 --> 00:48:15.760 align:middle line:90% So what is the idea? 00:48:15.760 --> 00:48:19.110 align:middle line:84% Let's look at the adjacency matrix 00:48:19.110 --> 00:48:21.270 align:middle line:84% corresponding to this graph that checks 00:48:21.270 --> 00:48:24.000 align:middle line:84% if there's an edge between a pair of vertices. 00:48:24.000 --> 00:48:29.310 align:middle line:84% Now, we can write this matrix as a function f 00:48:29.310 --> 00:48:31.860 align:middle line:84% that goes from, let's say, V, like number 00:48:31.860 --> 00:48:34.470 align:middle line:84% of vertices times number of vertices to 0, 1. 00:48:34.470 --> 00:48:37.650 align:middle line:84% It takes a pair of vertices, output 0 if there's 00:48:37.650 --> 00:48:39.740 align:middle line:90% no edge, 1 if there's an edge. 00:48:39.740 --> 00:48:43.370 align:middle line:84% Let's denote the number of vertices here by n. 00:48:43.370 --> 00:48:47.070 align:middle line:84% So sorry, I denoted there the input length by n-- 00:48:47.070 --> 00:48:47.700 align:middle line:90% close enough. 00:48:47.700 --> 00:48:50.075 align:middle line:84% It's not really the input length, the number of vertices, 00:48:50.075 --> 00:48:51.940 align:middle line:90% but it's denoted by n. 00:48:51.940 --> 00:48:56.280 align:middle line:84% So now we can think of the adjacency matrix as a function. 00:48:56.280 --> 00:48:58.000 align:middle line:84% So think of the adjacency matrix-- 00:48:58.000 --> 00:49:03.080 align:middle line:90% 00:49:03.080 --> 00:49:08.420 align:middle line:84% let me write it as a function, f, that goes from 0, 1 00:49:08.420 --> 00:49:09.780 align:middle line:90% to the log n. 00:49:09.780 --> 00:49:14.010 align:middle line:84% I'm going to assume that n is a power of 2. 00:49:14.010 --> 00:49:16.205 align:middle line:84% So I'm going to think of a vertex. 00:49:16.205 --> 00:49:18.900 align:middle line:90% So v, as I said, is of size n. 00:49:18.900 --> 00:49:22.940 align:middle line:84% I'll write it here, so it won't be in my way. 00:49:22.940 --> 00:49:24.620 align:middle line:84% I'm going to think of the function 00:49:24.620 --> 00:49:31.790 align:middle line:84% as taking a pair of vertices where I represent 00:49:31.790 --> 00:49:37.062 align:middle line:84% a vertex as a vector in 0, 1 to the log n and any number of n, 00:49:37.062 --> 00:49:38.520 align:middle line:84% like binary representation of the-- 00:49:38.520 --> 00:49:41.680 align:middle line:84% I think of the vertices as numbers between 1 and n. 00:49:41.680 --> 00:49:44.760 align:middle line:84% I'm thinking of the binary representation. 00:49:44.760 --> 00:49:47.250 align:middle line:84% And I output 0, 1 whether there's an edge 00:49:47.250 --> 00:49:51.870 align:middle line:84% or whether there's no edge between these two vertices. 00:49:51.870 --> 00:49:56.040 align:middle line:84% So this says 1 if and only if there 00:49:56.040 --> 00:50:02.790 align:middle line:84% exists an edge between the two vertices. 00:50:02.790 --> 00:50:07.230 align:middle line:84% Now, suppose you want to argue that the number of triangles 00:50:07.230 --> 00:50:11.400 align:middle line:90% is, let's say, k. 00:50:11.400 --> 00:50:13.360 align:middle line:90% So what do you need to prove? 00:50:13.360 --> 00:50:21.450 align:middle line:84% You need to prove that the sum over all i, j, and k in n-- 00:50:21.450 --> 00:50:25.200 align:middle line:84% or let me even make myself in 0, 1 to the log n 00:50:25.200 --> 00:50:27.480 align:middle line:84% to make it easy for myself because I'm 00:50:27.480 --> 00:50:28.900 align:middle line:90% representing in binary. 00:50:28.900 --> 00:50:35.260 align:middle line:84% So for any three vertices, let's count the number of triangles. 00:50:35.260 --> 00:50:41.930 align:middle line:84% So when there's a triangle, if i and j are connected, 00:50:41.930 --> 00:50:48.662 align:middle line:84% this is one, and f j,k is connected, this is one, and f i, 00:50:48.662 --> 00:50:52.120 align:middle line:90% k is connected, this is one. 00:50:52.120 --> 00:50:55.035 align:middle line:84% They all need to be connected in order for it to be a triangle. 00:50:55.035 --> 00:50:59.620 align:middle line:90% 00:50:59.620 --> 00:51:01.215 align:middle line:90% So if it's a triangle, I get 1. 00:51:01.215 --> 00:51:03.340 align:middle line:84% If it's not a triangle, I get 0 because one of them 00:51:03.340 --> 00:51:04.690 align:middle line:90% is going to be a 0. 00:51:04.690 --> 00:51:07.220 align:middle line:84% So I'm going to count the number of triangles. 00:51:07.220 --> 00:51:10.030 align:middle line:90% 00:51:10.030 --> 00:51:13.690 align:middle line:84% And I want to prove check that this is k-- 00:51:13.690 --> 00:51:15.010 align:middle line:90% almost, almost. 00:51:15.010 --> 00:51:17.080 align:middle line:90% I lied a little bit. 00:51:17.080 --> 00:51:21.850 align:middle line:84% I overcounted because there's permutation-- i j, k; j k, i. 00:51:21.850 --> 00:51:24.340 align:middle line:84% So I need to divide by 1 over 6, which 00:51:24.340 --> 00:51:27.070 align:middle line:84% is the number of ways to permute any i j, k because any i j, 00:51:27.070 --> 00:51:30.580 align:middle line:84% k is counted like all permutations. 00:51:30.580 --> 00:51:33.230 align:middle line:90% So this is what I want to prove. 00:51:33.230 --> 00:51:41.270 align:middle line:84% I want to prove that the sum of all possible triangles i j, k-- 00:51:41.270 --> 00:51:44.430 align:middle line:84% I counted each i j, k here essentially six times, 00:51:44.430 --> 00:51:48.230 align:middle line:90% so I need to divide by 1 over 6. 00:51:48.230 --> 00:51:53.460 align:middle line:84% The sum, the number of triangles, is k, almost. 00:51:53.460 --> 00:51:55.057 align:middle line:90% At least, I have some. 00:51:55.057 --> 00:51:56.640 align:middle line:84% It's getting to look like a sum-check, 00:51:56.640 --> 00:51:58.520 align:middle line:90% but there's no algebra. 00:51:58.520 --> 00:51:59.520 align:middle line:90% I just wrote in numbers. 00:51:59.520 --> 00:52:02.370 align:middle line:84% I mean, I took binary representation. 00:52:02.370 --> 00:52:07.470 align:middle line:90% But at least, I have some sums. 00:52:07.470 --> 00:52:11.030 align:middle line:84% So if I had some nice algebra here, 00:52:11.030 --> 00:52:15.410 align:middle line:84% if this was all over a finite field, and let's say this f 00:52:15.410 --> 00:52:19.430 align:middle line:84% was also low degree, then I can use sum-check. 00:52:19.430 --> 00:52:23.055 align:middle line:84% So again, suppose this was over a finite field. 00:52:23.055 --> 00:52:24.680 align:middle line:84% And suppose this f was very low degree, 00:52:24.680 --> 00:52:27.140 align:middle line:84% and the field was large, so we have good soundness. 00:52:27.140 --> 00:52:37.140 align:middle line:84% I want to prove sum of this big F is k sum-check. 00:52:37.140 --> 00:52:42.960 align:middle line:84% So I just need to tell you how do I get to-- 00:52:42.960 --> 00:52:47.950 align:middle line:84% how do I add algebra to make this degree a low degree? 00:52:47.950 --> 00:52:51.840 align:middle line:84% And where does the finite field come from, and so on? 00:52:51.840 --> 00:52:52.900 align:middle line:90% I'll do that. 00:52:52.900 --> 00:52:59.070 align:middle line:84% But before I'll do that, also note the sum here is only over 00:52:59.070 --> 00:53:02.820 align:middle line:90% 0, 1 to the 3 log n. 00:53:02.820 --> 00:53:09.430 align:middle line:84% So remember, the problem was the prover runtime is very large. 00:53:09.430 --> 00:53:13.440 align:middle line:84% It's H to the m times the time it 00:53:13.440 --> 00:53:16.230 align:middle line:90% takes to compute one function. 00:53:16.230 --> 00:53:17.400 align:middle line:90% m times this n. 00:53:17.400 --> 00:53:19.540 align:middle line:90% This m is going to be small. 00:53:19.540 --> 00:53:21.490 align:middle line:84% But the H to the m is the problem. 00:53:21.490 --> 00:53:26.610 align:middle line:84% But here, H to the m is just 2 to the 3 log n to the log n. 00:53:26.610 --> 00:53:28.320 align:middle line:90% So it's poly. 00:53:28.320 --> 00:53:32.650 align:middle line:84% So if I'm able to put a sum-check like algebra here, 00:53:32.650 --> 00:53:33.970 align:middle line:90% I will get double-- 00:53:33.970 --> 00:53:36.170 align:middle line:84% the proof will still be polynomial time, 00:53:36.170 --> 00:53:39.520 align:middle line:90% which is what I want. 00:53:39.520 --> 00:53:41.565 align:middle line:84% The question is, how do I put algebra here? 00:53:41.565 --> 00:53:44.830 align:middle line:90% 00:53:44.830 --> 00:53:47.913 align:middle line:90% So this is where-- 00:53:47.913 --> 00:53:54.970 align:middle line:90% 00:53:54.970 --> 00:53:56.780 align:middle line:84% so I'll say a little bit about this. 00:53:56.780 --> 00:54:01.090 align:middle line:84% And then we'll break for today and continue next week. 00:54:01.090 --> 00:54:06.430 align:middle line:84% But there's a generic way to convert any function 00:54:06.430 --> 00:54:09.590 align:middle line:90% into a polynomial. 00:54:09.590 --> 00:54:12.550 align:middle line:84% And the way to do it is via a technique 00:54:12.550 --> 00:54:14.480 align:middle line:90% called low-degree extension. 00:54:14.480 --> 00:54:25.900 align:middle line:90% 00:54:25.900 --> 00:54:30.830 align:middle line:84% So if you actually remember, I started class 00:54:30.830 --> 00:54:33.920 align:middle line:84% with an example of the matrix multiplication. 00:54:33.920 --> 00:54:37.400 align:middle line:84% And if you remember the matrix multiplication, 00:54:37.400 --> 00:54:38.580 align:middle line:90% also, there's no polynomial. 00:54:38.580 --> 00:54:40.170 align:middle line:90% It's a matrix, nothing. 00:54:40.170 --> 00:54:41.460 align:middle line:90% But what we did-- 00:54:41.460 --> 00:54:43.890 align:middle line:84% the randomized algorithm that we showed, 00:54:43.890 --> 00:54:48.930 align:middle line:84% we thought of a row in the matrix as a polynomial. 00:54:48.930 --> 00:54:51.990 align:middle line:84% So we took a row, which consists of n elements, 00:54:51.990 --> 00:54:55.700 align:middle line:84% and we thought about it as a univariate polynomial 00:54:55.700 --> 00:54:57.920 align:middle line:90% of degree n. 00:54:57.920 --> 00:55:00.980 align:middle line:84% Remember, we thought of the row as coefficients 00:55:00.980 --> 00:55:02.280 align:middle line:90% of the polynomial. 00:55:02.280 --> 00:55:05.070 align:middle line:84% So we thought it was a polynomial of degree n minus 1, 00:55:05.070 --> 00:55:05.570 align:middle line:90% I guess. 00:55:05.570 --> 00:55:06.487 align:middle line:90% There were n elements. 00:55:06.487 --> 00:55:09.090 align:middle line:84% One is the free coefficient, so degree n minus 1. 00:55:09.090 --> 00:55:12.440 align:middle line:84% So we started already the class with an example 00:55:12.440 --> 00:55:14.610 align:middle line:90% that I have a row-- 00:55:14.610 --> 00:55:17.730 align:middle line:84% nothing, no algebra, nothing, an arbitrary row of matrix. 00:55:17.730 --> 00:55:21.620 align:middle line:84% And we converted it to a univariate polynomial of degree 00:55:21.620 --> 00:55:25.070 align:middle line:90% n, like the length of the row. 00:55:25.070 --> 00:55:28.970 align:middle line:84% What we do here is a very similar idea, 00:55:28.970 --> 00:55:31.240 align:middle line:90% but in the multivariate setting. 00:55:31.240 --> 00:55:34.030 align:middle line:90% So what we can do-- 00:55:34.030 --> 00:55:37.300 align:middle line:84% we could have taken any n elements-- 00:55:37.300 --> 00:55:39.170 align:middle line:90% that row, for example. 00:55:39.170 --> 00:55:46.120 align:middle line:84% Or in this case, the elements are all the kind of-- 00:55:46.120 --> 00:55:49.960 align:middle line:84% for any F, you can think of it like a matrix. 00:55:49.960 --> 00:55:53.330 align:middle line:84% It's like n squared elements, if you want, for any two elements, 00:55:53.330 --> 00:55:55.795 align:middle line:84% whether there's a edge or not an edge. 00:55:55.795 --> 00:55:57.670 align:middle line:84% So you can think of it as n squared elements. 00:55:57.670 --> 00:55:58.820 align:middle line:90% It doesn't matter. 00:55:58.820 --> 00:56:04.300 align:middle line:84% We can take any set of elements and convert it either 00:56:04.300 --> 00:56:08.200 align:middle line:84% to a univariate polynomial, as we did before of that degree. 00:56:08.200 --> 00:56:10.870 align:middle line:84% Or that's not good for us because here's the degree 00:56:10.870 --> 00:56:13.270 align:middle line:90% is going to be n squared. 00:56:13.270 --> 00:56:15.087 align:middle line:84% The verifier runs and the degree and more. 00:56:15.087 --> 00:56:16.670 align:middle line:84% It's not going to be efficient enough. 00:56:16.670 --> 00:56:18.190 align:middle line:84% But the idea is we can convert it 00:56:18.190 --> 00:56:24.370 align:middle line:84% to a multivariate polynomial with much, much smaller degree. 00:56:24.370 --> 00:56:27.570 align:middle line:84% And that's what's called the low-degree extension. 00:56:27.570 --> 00:56:32.670 align:middle line:84% So whereas before, we just did a univariate polynomial-- 00:56:32.670 --> 00:56:39.120 align:middle line:84% so we had to put the n elements as coefficients. 00:56:39.120 --> 00:56:41.780 align:middle line:84% Each one added a degree, if you will. 00:56:41.780 --> 00:56:45.710 align:middle line:84% If we put it in a multivariate polynomial-- 00:56:45.710 --> 00:56:48.800 align:middle line:84% so if we think of it as a polynomial over, 00:56:48.800 --> 00:56:55.550 align:middle line:84% let's say, H to the m, then we can stack inside H to the m-- 00:56:55.550 --> 00:56:57.480 align:middle line:90% we can stack n points. 00:56:57.480 --> 00:56:59.390 align:middle line:84% We can make H and m much smaller-- 00:56:59.390 --> 00:57:03.600 align:middle line:84% each H and both H and m to be much, much smaller than that. 00:57:03.600 --> 00:57:05.130 align:middle line:84% And that's what we're going to do. 00:57:05.130 --> 00:57:09.586 align:middle line:84% So let me explain this more and more precisely. 00:57:09.586 --> 00:57:12.285 align:middle line:90% 00:57:12.285 --> 00:57:12.785 align:middle line:90% OK. 00:57:12.785 --> 00:57:21.740 align:middle line:90% 00:57:21.740 --> 00:57:25.010 align:middle line:84% OK, so here's the theorem we're going to use for this. 00:57:25.010 --> 00:57:30.966 align:middle line:90% 00:57:30.966 --> 00:57:34.890 align:middle line:84% For any function, not polynomial, can be arbitrary, 00:57:34.890 --> 00:57:41.520 align:middle line:84% like the adjacency matrix function-- for any function f, 00:57:41.520 --> 00:57:44.620 align:middle line:84% there it's from 0, 1 to the 2 log n. 00:57:44.620 --> 00:57:49.020 align:middle line:84% But let me take it more generally from H to the m 00:57:49.020 --> 00:57:51.660 align:middle line:90% to 0, 1. 00:57:51.660 --> 00:57:54.660 align:middle line:84% Again, in this example, H is just 0, 1. 00:57:54.660 --> 00:57:57.625 align:middle line:84% And m is 2 log n because we have there 2 log n. 00:57:57.625 --> 00:57:59.500 align:middle line:84% But let me give you something more generally. 00:57:59.500 --> 00:58:01.360 align:middle line:90% So take any function. 00:58:01.360 --> 00:58:03.460 align:middle line:90% This is essentially any set. 00:58:03.460 --> 00:58:09.990 align:middle line:84% You can think of this as any set of this-- 00:58:09.990 --> 00:58:16.020 align:middle line:84% or this is equivalent to any element in 0, 1 to the H 00:58:16.020 --> 00:58:18.390 align:middle line:90% to the m. 00:58:18.390 --> 00:58:23.420 align:middle line:84% So it's just a binary string of length H to the m. 00:58:23.420 --> 00:58:27.700 align:middle line:84% So take any binary string of length H to the m. 00:58:27.700 --> 00:58:30.460 align:middle line:84% It just tells you, for each element H of m 00:58:30.460 --> 00:58:33.700 align:middle line:90% what the value is, 0 or 1. 00:58:33.700 --> 00:58:45.720 align:middle line:84% So for any function and any finite field f that contains H-- 00:58:45.720 --> 00:58:52.180 align:middle line:90% 00:58:52.180 --> 00:58:58.820 align:middle line:84% of course, in that example 0, 1, any f contains 0 and 1, 00:58:58.820 --> 00:59:01.720 align:middle line:90% so that's not a problem. 00:59:01.720 --> 00:59:05.005 align:middle line:90% There exists a unique-- 00:59:05.005 --> 00:59:08.146 align:middle line:90% 00:59:08.146 --> 00:59:10.656 align:middle line:84% what's called low-degree extension. 00:59:10.656 --> 00:59:14.440 align:middle line:90% 00:59:14.440 --> 00:59:17.020 align:middle line:84% I'll explain what this means in a second. 00:59:17.020 --> 00:59:25.970 align:middle line:84% It's a function f tilde from F to the n to F 00:59:25.970 --> 00:59:29.550 align:middle line:84% such that-- so in what sense, is a low-degree extension. 00:59:29.550 --> 00:59:34.940 align:middle line:84% First, it's an extension, namely f tilde. 00:59:34.940 --> 00:59:38.690 align:middle line:84% If you look at an H to the m, for the element 00:59:38.690 --> 00:59:42.410 align:middle line:84% and the little cube, it's exactly f. 00:59:42.410 --> 00:59:44.010 align:middle line:90% So it extends. 00:59:44.010 --> 00:59:45.260 align:middle line:90% It extends f. 00:59:45.260 --> 00:59:47.990 align:middle line:90% F was an H to the m. 00:59:47.990 --> 00:59:51.990 align:middle line:90% F tilde is in a bigger cube. 00:59:51.990 --> 00:59:52.760 align:middle line:90% It extends. 00:59:52.760 --> 00:59:55.700 align:middle line:84% So on the small cube, they agree. 00:59:55.700 --> 00:59:58.830 align:middle line:84% The second thing is that it's low degree. 00:59:58.830 --> 01:00:02.880 align:middle line:84% So it's a low-degree extension-- an extension and a low degree. 01:00:02.880 --> 01:00:04.050 align:middle line:90% How low? 01:00:04.050 --> 01:00:15.085 align:middle line:84% So f tilde is of degree H minus 1 in each variable. 01:00:15.085 --> 01:00:21.000 align:middle line:90% 01:00:21.000 --> 01:00:27.130 align:middle line:90% So again, what is the theorem? 01:00:27.130 --> 01:00:31.050 align:middle line:84% The theorem is you can take any set-- 01:00:31.050 --> 01:00:33.190 align:middle line:84% if you want, you can take any set. 01:00:33.190 --> 01:00:35.140 align:middle line:90% So let's say I have n numbers. 01:00:35.140 --> 01:00:38.980 align:middle line:84% Take any fixed-- so take any set. 01:00:38.980 --> 01:00:45.570 align:middle line:90% Let's say fix any vector. 01:00:45.570 --> 01:00:49.355 align:middle line:84% Let's say w, and let's say 0, 1 to the n. 01:00:49.355 --> 01:00:52.320 align:middle line:90% 01:00:52.320 --> 01:00:54.670 align:middle line:90% You can always embed it. 01:00:54.670 --> 01:00:57.840 align:middle line:90% You can think of w-- 01:00:57.840 --> 01:01:00.760 align:middle line:84% and a equivalent way is to think of w-- 01:01:00.760 --> 01:01:02.280 align:middle line:90% oh, sorry. 01:01:02.280 --> 01:01:04.330 align:middle line:84% I meant to say, sorry, as a field. 01:01:04.330 --> 01:01:09.260 align:middle line:84% Let's say w1 up to wn and 0, 1 to the n. 01:01:09.260 --> 01:01:11.790 align:middle line:90% 01:01:11.790 --> 01:01:13.330 align:middle line:90% You can embed it. 01:01:13.330 --> 01:01:21.010 align:middle line:84% You can think of it as a function from H to the m to 0, 01:01:21.010 --> 01:01:25.150 align:middle line:90% 1 as long as H to the m is n. 01:01:25.150 --> 01:01:28.570 align:middle line:84% So you have a long sequence of 0, 01:01:28.570 --> 01:01:37.730 align:middle line:84% 1's folded into a nice cube of size H to the m. 01:01:37.730 --> 01:01:44.550 align:middle line:84% So essentially, you should think of the H representation of n-- 01:01:44.550 --> 01:01:46.370 align:middle line:90% the H representation. 01:01:46.370 --> 01:01:52.250 align:middle line:84% So H to the m is equivalent to the set. 01:01:52.250 --> 01:01:54.310 align:middle line:84% You can think of a bijection between that 01:01:54.310 --> 01:01:58.720 align:middle line:84% and all the numbers between 0 and 1 to between 1 up to n. 01:01:58.720 --> 01:02:01.990 align:middle line:84% And now the claim is, actually, you can take this-- 01:02:01.990 --> 01:02:04.430 align:middle line:84% so this is the, let's say, H by m. 01:02:04.430 --> 01:02:13.310 align:middle line:84% You can extend it to a bigger function, tilde over F. 01:02:13.310 --> 01:02:19.310 align:middle line:84% This is over F to the m such that it has degree 01:02:19.310 --> 01:02:23.960 align:middle line:90% H minus 1 in each variable. 01:02:23.960 --> 01:02:28.440 align:middle line:84% So just note, if we think of m as being 1, 01:02:28.440 --> 01:02:34.020 align:middle line:84% the univariate case is exactly what we had before. 01:02:34.020 --> 01:02:39.770 align:middle line:84% If you had just a string of size-- 01:02:39.770 --> 01:02:43.700 align:middle line:84% if n is 1H, essentially is like n. 01:02:43.700 --> 01:02:45.050 align:middle line:90% I take n. 01:02:45.050 --> 01:02:50.780 align:middle line:84% I just expand it in this way to a degree n. 01:02:50.780 --> 01:02:52.770 align:middle line:84% But then the degree is very large. 01:02:52.770 --> 01:02:53.930 align:middle line:90% That's not good. 01:02:53.930 --> 01:02:55.650 align:middle line:84% The verifier runs in time the degree. 01:02:55.650 --> 01:02:56.870 align:middle line:90% That's awful. 01:02:56.870 --> 01:02:59.090 align:middle line:84% So I make the degree much smaller. 01:02:59.090 --> 01:03:00.960 align:middle line:84% How do I make the degree much smaller? 01:03:00.960 --> 01:03:02.900 align:middle line:90% I add more variables. 01:03:02.900 --> 01:03:07.560 align:middle line:84% So the idea is add many more variables. 01:03:07.560 --> 01:03:11.420 align:middle line:84% Now in each dimension, the degree 01:03:11.420 --> 01:03:15.920 align:middle line:84% is only h because now I don't need the size of H is n, 01:03:15.920 --> 01:03:18.991 align:middle line:90% but H to the m is n. 01:03:18.991 --> 01:03:24.350 align:middle line:84% And now in each dimension, the number of elements is like H. 01:03:24.350 --> 01:03:28.090 align:middle line:84% And the unit on each dimension, the degree 01:03:28.090 --> 01:03:32.290 align:middle line:84% will be H minus 1 instead of n minus 1, 01:03:32.290 --> 01:03:35.440 align:middle line:84% like it was in the univariate case. 01:03:35.440 --> 01:03:39.020 align:middle line:84% I'll prove all this, but this is just a high-level idea. 01:03:39.020 --> 01:03:40.780 align:middle line:90% So again, the high-level idea-- 01:03:40.780 --> 01:03:43.040 align:middle line:84% we'll go into the proof next time of this theorem. 01:03:43.040 --> 01:03:48.670 align:middle line:84% But the high-level idea is we all know by the univariate case 01:03:48.670 --> 01:03:51.530 align:middle line:84% that you can take any string of length n, 01:03:51.530 --> 01:03:56.590 align:middle line:84% encode it as a univariate function of degree n minus 1 01:03:56.590 --> 01:03:57.290 align:middle line:90% by-- 01:03:57.290 --> 01:03:59.530 align:middle line:84% there's two ways of doing it-- either by thinking 01:03:59.530 --> 01:04:01.760 align:middle line:84% of the string as the coefficients. 01:04:01.760 --> 01:04:03.650 align:middle line:84% That's one element, one way to do it. 01:04:03.650 --> 01:04:06.880 align:middle line:84% Another way to do it, which is how the low-degree extension 01:04:06.880 --> 01:04:10.000 align:middle line:84% works, is by thinking of the string 01:04:10.000 --> 01:04:16.110 align:middle line:84% as the value of the polynomial in, let's say, polynomial on 1, 01:04:16.110 --> 01:04:17.280 align:middle line:90% 2, 3, up to n. 01:04:17.280 --> 01:04:19.620 align:middle line:84% Let's say 1 up to n is in the field. 01:04:19.620 --> 01:04:21.180 align:middle line:90% So think of gfp, let's say. 01:04:21.180 --> 01:04:23.690 align:middle line:90% 01:04:23.690 --> 01:04:28.130 align:middle line:84% Here, what we do-- we take your points. 01:04:28.130 --> 01:04:31.250 align:middle line:84% We take a polynomial F for which your points 01:04:31.250 --> 01:04:33.750 align:middle line:90% are sitting in this small cube. 01:04:33.750 --> 01:04:37.620 align:middle line:84% So let's say you have a vector of size 1 up to n. 01:04:37.620 --> 01:04:40.850 align:middle line:90% We'll put here w1, w2, w3, wH-- 01:04:40.850 --> 01:04:43.400 align:middle line:90% all the w's we put here. 01:04:43.400 --> 01:04:45.410 align:middle line:84% And then the theorem says there's 01:04:45.410 --> 01:04:48.770 align:middle line:84% a way to extend this entire thing into a bigger 01:04:48.770 --> 01:04:58.400 align:middle line:84% polynomial of degree H minus 1 in each variable such that the-- 01:04:58.400 --> 01:05:00.390 align:middle line:84% if you look at the polynomial in this cube, 01:05:00.390 --> 01:05:02.010 align:middle line:90% it's exactly what we had before. 01:05:02.010 --> 01:05:08.000 align:middle line:84% So you have your vector or your function from H 01:05:08.000 --> 01:05:09.410 align:middle line:90% to the m to 0, 1. 01:05:09.410 --> 01:05:14.340 align:middle line:84% Here and the rest, it's just extended and extended in a way 01:05:14.340 --> 01:05:19.110 align:middle line:84% that the degree of each variable is H minus 1. 01:05:19.110 --> 01:05:24.480 align:middle line:84% So for example, if you want H to the m 01:05:24.480 --> 01:05:30.840 align:middle line:84% to be n, what you can take, for example, is H to be log n. 01:05:30.840 --> 01:05:33.430 align:middle line:84% The degree is only log n, which is great. 01:05:33.430 --> 01:05:35.770 align:middle line:84% And you can take n to be even smaller than log n. 01:05:35.770 --> 01:05:39.710 align:middle line:84% If you do the math, it's going to be log n over log log n. 01:05:39.710 --> 01:05:42.510 align:middle line:90% 01:05:42.510 --> 01:05:47.310 align:middle line:84% And note that the verifier runs in time that depends on m, m, H, 01:05:47.310 --> 01:05:49.470 align:middle line:84% and D. And D is going to be also H. So all of this 01:05:49.470 --> 01:05:54.180 align:middle line:84% is going to be poly log, which is great. 01:05:54.180 --> 01:05:55.680 align:middle line:84% So next time, what we're going to do 01:05:55.680 --> 01:05:57.960 align:middle line:84% is prove this low-degree extension theorem 01:05:57.960 --> 01:06:02.018 align:middle line:84% and then show how to use it first for the triangle. 01:06:02.018 --> 01:06:03.310 align:middle line:90% That would be pretty immediate. 01:06:03.310 --> 01:06:05.070 align:middle line:84% And then we'll show how to use it 01:06:05.070 --> 01:06:09.030 align:middle line:84% for a general low-degree, low-depth circuit. 01:06:09.030 --> 01:06:10.500 align:middle line:90% OK, thanks. 01:06:10.500 --> 01:06:11.000 align:middle line:90%