WEBVTT 00:00:00.000 --> 00:00:00.996 align:middle line:90% 00:00:00.996 --> 00:00:01.992 align:middle line:90% [SQUEAKING] 00:00:01.992 --> 00:00:03.486 align:middle line:90% [RUSTLING] 00:00:03.486 --> 00:00:04.482 align:middle line:90% 00:00:04.482 --> 00:00:06.972 align:middle line:90% [CLICKING] 00:00:06.972 --> 00:00:13.390 align:middle line:90% 00:00:13.390 --> 00:00:15.200 align:middle line:90% YAEL KALAI: OK, so let's start. 00:00:15.200 --> 00:00:17.900 align:middle line:90% Thank you, everyone, for coming. 00:00:17.900 --> 00:00:22.200 align:middle line:84% This is going to be an advanced class on cryptography. 00:00:22.200 --> 00:00:25.380 align:middle line:84% Those who do not have background in cryptography, it's OK. 00:00:25.380 --> 00:00:27.060 align:middle line:84% It's not actually hardcore cryptography. 00:00:27.060 --> 00:00:30.080 align:middle line:84% This is actually a class on the evolution 00:00:30.080 --> 00:00:31.800 align:middle line:90% of proofs in computer science. 00:00:31.800 --> 00:00:34.105 align:middle line:84% So this class is really about proofs. 00:00:34.105 --> 00:00:35.480 align:middle line:84% That's what we're going to learn, 00:00:35.480 --> 00:00:39.420 align:middle line:84% and how proofs evolved with the years, 00:00:39.420 --> 00:00:42.470 align:middle line:84% starting from the mid-80s all the way to today 00:00:42.470 --> 00:00:44.640 align:middle line:84% and how we think about proofs differently today. 00:00:44.640 --> 00:00:48.600 align:middle line:84% So this is what this class is about. 00:00:48.600 --> 00:00:52.190 align:middle line:84% Actually, before I go into the content of the class 00:00:52.190 --> 00:00:54.515 align:middle line:84% and what I'm going to be teaching, first of all, 00:00:54.515 --> 00:00:55.140 align:middle line:90% quick question. 00:00:55.140 --> 00:00:57.060 align:middle line:84% How many students here are not MIT students, 00:00:57.060 --> 00:00:58.350 align:middle line:90% but cross-registered students? 00:00:58.350 --> 00:00:59.880 align:middle line:90% OK, a bunch. 00:00:59.880 --> 00:01:01.380 align:middle line:90% So do you guys have access-- 00:01:01.380 --> 00:01:05.010 align:middle line:84% so I hope I made the website public. 00:01:05.010 --> 00:01:07.010 align:middle line:90% It's on Canvas. 00:01:07.010 --> 00:01:08.700 align:middle line:84% But now I think it should be public. 00:01:08.700 --> 00:01:11.070 align:middle line:90% So you should have access. 00:01:11.070 --> 00:01:13.580 align:middle line:84% If anyone has problems with accessing the website, 00:01:13.580 --> 00:01:14.880 align:middle line:90% just let me know. 00:01:14.880 --> 00:01:17.030 align:middle line:90% I'll try to fix it. 00:01:17.030 --> 00:01:21.120 align:middle line:84% So this class is meeting once a week weekly from 1:00 to 4:00 00:01:21.120 --> 00:01:21.800 align:middle line:90% PM. 00:01:21.800 --> 00:01:24.980 align:middle line:84% In terms of expectations or what-- 00:01:24.980 --> 00:01:27.563 align:middle line:84% so the expectation's that you'll enjoy it. 00:01:27.563 --> 00:01:28.230 align:middle line:90% I hope you will. 00:01:28.230 --> 00:01:30.290 align:middle line:84% I think it's really, really beautiful material. 00:01:30.290 --> 00:01:33.300 align:middle line:84% But beyond having fun, I want to ask-- 00:01:33.300 --> 00:01:37.290 align:middle line:84% I have two kind of requirements from you guys. 00:01:37.290 --> 00:01:41.750 align:middle line:84% So one, I want to have Scribenotes for the classes. 00:01:41.750 --> 00:01:43.500 align:middle line:90% I have written notes. 00:01:43.500 --> 00:01:46.156 align:middle line:84% I can give it to you to help you out. 00:01:46.156 --> 00:01:48.560 align:middle line:90% So we have about-- 00:01:48.560 --> 00:01:53.280 align:middle line:84% actually, we have 11 classes total in this class. 00:01:53.280 --> 00:01:58.210 align:middle line:84% But we're going to have a bunch of-- 00:01:58.210 --> 00:02:01.950 align:middle line:84% one day, we're going to have a guest lecture by Oded 00:02:01.950 --> 00:02:05.020 align:middle line:84% Regev, who's an-- he has a beautiful result. 00:02:05.020 --> 00:02:08.919 align:middle line:84% He's going to come here on October 6 and present it to us. 00:02:08.919 --> 00:02:11.890 align:middle line:84% So that won't need to be scribed. 00:02:11.890 --> 00:02:14.190 align:middle line:84% And then one day there's a crypto day, which 00:02:14.190 --> 00:02:15.640 align:middle line:90% also won't need to be scribed. 00:02:15.640 --> 00:02:24.150 align:middle line:84% Well, there's more-- anybody wants to sit 00:02:24.150 --> 00:02:26.590 align:middle line:84% But for the rest, we'll need scribe notes. 00:02:26.590 --> 00:02:29.620 align:middle line:84% I'm happy if you want to do it in pairs to the scribe, 00:02:29.620 --> 00:02:32.850 align:middle line:84% unless we'll run out of people, and then we'll 00:02:32.850 --> 00:02:35.010 align:middle line:90% need to keep it for one. 00:02:35.010 --> 00:02:36.700 align:middle line:90% So that's one requirement. 00:02:36.700 --> 00:02:39.220 align:middle line:84% And then I was told that I need to do something more. 00:02:39.220 --> 00:02:40.420 align:middle line:90% That's not enough. 00:02:40.420 --> 00:02:43.420 align:middle line:84% So we'll do a P set sometime in the middle of the course. 00:02:43.420 --> 00:02:46.210 align:middle line:84% It won't be anything too difficult. 00:02:46.210 --> 00:02:49.200 align:middle line:84% It's mainly to make sure you're on board. 00:02:49.200 --> 00:02:52.800 align:middle line:84% But I really do recommend that before class, 00:02:52.800 --> 00:02:56.730 align:middle line:84% just every time before-- so here's a real homework. 00:02:56.730 --> 00:02:59.920 align:middle line:84% Every time before you come to class, in the website, 00:02:59.920 --> 00:03:01.060 align:middle line:90% there's reading. 00:03:01.060 --> 00:03:04.710 align:middle line:84% I really recommend you look at the reading and try to read. 00:03:04.710 --> 00:03:09.780 align:middle line:84% So there's a beautiful survey by Justin Taylor. 00:03:09.780 --> 00:03:12.450 align:middle line:90% There's a link on the website. 00:03:12.450 --> 00:03:15.190 align:middle line:90% The survey is on proof system. 00:03:15.190 --> 00:03:17.950 align:middle line:84% It's more on the applied side of proof system. 00:03:17.950 --> 00:03:19.180 align:middle line:90% This is a more theory class. 00:03:19.180 --> 00:03:22.860 align:middle line:84% But he does have really beautifully written sections 00:03:22.860 --> 00:03:25.410 align:middle line:84% that are very theoretical that I'm going to link to. 00:03:25.410 --> 00:03:31.650 align:middle line:84% So I recommend, or you can think of it as informal homework 00:03:31.650 --> 00:03:33.490 align:middle line:90% before class to do the reading. 00:03:33.490 --> 00:03:37.240 align:middle line:84% I think it will be very helpful for understanding this class. 00:03:37.240 --> 00:03:40.500 align:middle line:84% And also, after the lecture to look at the reading, 00:03:40.500 --> 00:03:43.597 align:middle line:84% and I think it will be very, very helpful. 00:03:43.597 --> 00:03:49.410 align:middle line:84% So any questions about bureaucracy stuff? 00:03:49.410 --> 00:03:50.970 align:middle line:84% So let me tell you a little bit more 00:03:50.970 --> 00:03:53.350 align:middle line:84% about what the class is actually about. 00:03:53.350 --> 00:03:56.790 align:middle line:84% So proofs is something that has been studied in mathematics 00:03:56.790 --> 00:03:58.770 align:middle line:90% for thousands of years. 00:03:58.770 --> 00:04:03.370 align:middle line:84% And usually when people think about what a proof is, a proof, 00:04:03.370 --> 00:04:05.130 align:middle line:84% you write kind line by line, and you 00:04:05.130 --> 00:04:08.950 align:middle line:84% can verify it line by line to make sure the proof is correct. 00:04:08.950 --> 00:04:12.510 align:middle line:84% That's how most people think of what a proof is. 00:04:12.510 --> 00:04:15.790 align:middle line:84% Starting from the mid-80s, in computer science, 00:04:15.790 --> 00:04:19.990 align:middle line:84% in particular in cryptography, the way we thought about proofs 00:04:19.990 --> 00:04:20.890 align:middle line:90% started changing. 00:04:20.890 --> 00:04:26.140 align:middle line:84% This came about because of the idea of zero-knowledge proofs. 00:04:26.140 --> 00:04:28.590 align:middle line:84% So there was a hope to construct proofs 00:04:28.590 --> 00:04:33.040 align:middle line:84% that reveal no information about why the claim is true. 00:04:33.040 --> 00:04:39.390 align:middle line:84% And around '85, Goldwasser, Micali, and Rackoff 00:04:39.390 --> 00:04:42.100 align:middle line:84% constructed the first zero-knowledge proof. 00:04:42.100 --> 00:04:44.440 align:middle line:84% By the way, this class is not about zero knowledge. 00:04:44.440 --> 00:04:46.720 align:middle line:84% Actually, it's not about crypto, per se. 00:04:46.720 --> 00:04:49.810 align:middle line:84% It's just about coming up with new proof systems. 00:04:49.810 --> 00:04:50.770 align:middle line:90% Do you have a question? 00:04:50.770 --> 00:04:51.270 align:middle line:90% No? 00:04:51.270 --> 00:04:52.330 align:middle line:90% OK. 00:04:52.330 --> 00:04:53.860 align:middle line:84% But they constructed-- they wanted 00:04:53.860 --> 00:04:56.068 align:middle line:84% to construct these proofs that reveal no information. 00:04:56.068 --> 00:04:58.280 align:middle line:84% And to do that, they needed to change the model. 00:04:58.280 --> 00:05:01.090 align:middle line:84% Turns out they could not do it using what we think of, 00:05:01.090 --> 00:05:02.900 align:middle line:90% a classical proof. 00:05:02.900 --> 00:05:04.750 align:middle line:84% And the way they change the model 00:05:04.750 --> 00:05:09.220 align:middle line:84% is by defining a new proof system, a new model, which 00:05:09.220 --> 00:05:10.640 align:middle line:90% is called interactive proofs. 00:05:10.640 --> 00:05:12.280 align:middle line:84% We're going to talk about this today. 00:05:12.280 --> 00:05:14.480 align:middle line:84% But they defined this notion of interactive proof. 00:05:14.480 --> 00:05:19.000 align:middle line:84% So we're going to start this course by talking about what 00:05:19.000 --> 00:05:21.971 align:middle line:90% interactive proofs are. 00:05:21.971 --> 00:05:25.240 align:middle line:84% And we're going to construct interactive proofs. 00:05:25.240 --> 00:05:28.390 align:middle line:84% In the '80s and '90s, when people thought about interactive 00:05:28.390 --> 00:05:33.040 align:middle line:84% proofs, usually the model is we think of the verifier as being 00:05:33.040 --> 00:05:33.820 align:middle line:90% efficient. 00:05:33.820 --> 00:05:36.260 align:middle line:84% For us, efficient means polynomial time. 00:05:36.260 --> 00:05:41.120 align:middle line:84% But of course, in practice, it has a more specific meaning. 00:05:41.120 --> 00:05:43.610 align:middle line:84% But for now, think of efficient as being polynomial time. 00:05:43.610 --> 00:05:45.920 align:middle line:84% And the verifier can be all powerful. 00:05:45.920 --> 00:05:49.930 align:middle line:84% So the time complexity of the prover 00:05:49.930 --> 00:05:51.620 align:middle line:90% was not even a consideration. 00:05:51.620 --> 00:05:53.955 align:middle line:84% Actually, they called the prover Merlin, 00:05:53.955 --> 00:05:56.330 align:middle line:84% like he's a wizard who can do whatever the hell he wants, 00:05:56.330 --> 00:05:58.510 align:middle line:90% like infinite power. 00:05:58.510 --> 00:06:01.300 align:middle line:84% What we're going to talk about after introducing this model 00:06:01.300 --> 00:06:03.070 align:middle line:84% and giving some protocols, we're going 00:06:03.070 --> 00:06:06.500 align:middle line:84% to talk about the model of double efficient g proofs. 00:06:06.500 --> 00:06:07.830 align:middle line:90% And here, we say, no. 00:06:07.830 --> 00:06:09.080 align:middle line:90% The proof is not all powerful. 00:06:09.080 --> 00:06:11.990 align:middle line:84% We don't have all-powerful machines in the world. 00:06:11.990 --> 00:06:13.400 align:middle line:90% Every machine is bounded. 00:06:13.400 --> 00:06:15.250 align:middle line:84% So what we want, yes, the verifier 00:06:15.250 --> 00:06:18.130 align:middle line:84% should be very efficient, but the prover should not 00:06:18.130 --> 00:06:19.220 align:middle line:90% be all-powerful leader. 00:06:19.220 --> 00:06:21.470 align:middle line:84% So we care about the prover running time, too. 00:06:21.470 --> 00:06:24.890 align:middle line:84% That's what's called doubly efficient interactive proofs. 00:06:24.890 --> 00:06:28.300 align:middle line:84% We're going to construct double efficient interactive proof. 00:06:28.300 --> 00:06:31.040 align:middle line:84% We're going to show the GKR protocol, a specific protocol, 00:06:31.040 --> 00:06:33.470 align:middle line:84% and then we're going to show application of this protocol. 00:06:33.470 --> 00:06:34.887 align:middle line:84% And we're going to see application 00:06:34.887 --> 00:06:39.670 align:middle line:84% to really nice models such as PCP, which is probabilistically 00:06:39.670 --> 00:06:43.130 align:middle line:84% checkable proofs, MIP, multiprover interactive proofs. 00:06:43.130 --> 00:06:44.950 align:middle line:84% And in particular, we're going to show 00:06:44.950 --> 00:06:47.890 align:middle line:90% how to use this to get a-- 00:06:47.890 --> 00:06:52.300 align:middle line:84% reprove a celebrated result, which is the IP equals P space 00:06:52.300 --> 00:06:54.100 align:middle line:90% theorem of Shamir. 00:06:54.100 --> 00:06:57.620 align:middle line:84% So if you don't know any of these buzzwords, 00:06:57.620 --> 00:06:58.720 align:middle line:90% I'll explain everything. 00:06:58.720 --> 00:07:00.970 align:middle line:84% I'm just kind of doing a very quick overview for those 00:07:00.970 --> 00:07:03.850 align:middle line:84% who heard these buzzwords a little bit so you'll 00:07:03.850 --> 00:07:06.280 align:middle line:90% know what to expect. 00:07:06.280 --> 00:07:09.710 align:middle line:90% So up to here, no crypto at all. 00:07:09.710 --> 00:07:11.180 align:middle line:90% This is not at all about crypto. 00:07:11.180 --> 00:07:12.560 align:middle line:90% It's just about proof systems. 00:07:12.560 --> 00:07:16.570 align:middle line:84% Then we're going to show how to use cryptography to get 00:07:16.570 --> 00:07:19.370 align:middle line:90% our proofs more succinct. 00:07:19.370 --> 00:07:24.190 align:middle line:84% And then we're going to leave the idea that-- 00:07:24.190 --> 00:07:28.660 align:middle line:84% the classical idea of a proof, that if the theorem is false, 00:07:28.660 --> 00:07:29.420 align:middle line:90% you can't cheat. 00:07:29.420 --> 00:07:30.520 align:middle line:90% It's impossible to cheat. 00:07:30.520 --> 00:07:32.210 align:middle line:90% There's no fake proof. 00:07:32.210 --> 00:07:34.090 align:middle line:90% There's no false proof. 00:07:34.090 --> 00:07:36.320 align:middle line:84% There's none-- if the theorem is incorrect, 00:07:36.320 --> 00:07:37.720 align:middle line:90% there's no proof, period. 00:07:37.720 --> 00:07:40.760 align:middle line:84% We're going to use crypto to say maybe there are false proofs, 00:07:40.760 --> 00:07:42.320 align:middle line:90% but they're very hard to find. 00:07:42.320 --> 00:07:45.310 align:middle line:84% So the only way you can find a convincing proof 00:07:45.310 --> 00:07:47.510 align:middle line:84% to a false statement is by breaking 00:07:47.510 --> 00:07:50.100 align:middle line:90% a hard cryptographic problem. 00:07:50.100 --> 00:07:51.590 align:middle line:84% You can factor large numbers, you 00:07:51.590 --> 00:07:53.990 align:middle line:84% can break lattice assumptions, and so on. 00:07:53.990 --> 00:07:55.820 align:middle line:84% So we're going to use cryptography 00:07:55.820 --> 00:07:58.290 align:middle line:84% to make our proofs more succinct. 00:07:58.290 --> 00:08:00.575 align:middle line:84% But then what's going on here is that our 00:08:00.575 --> 00:08:01.950 align:middle line:84% proofs we can make them succinct, 00:08:01.950 --> 00:08:03.690 align:middle line:90% but they're still interactive. 00:08:03.690 --> 00:08:05.540 align:middle line:84% And then we're going to show how to use 00:08:05.540 --> 00:08:08.330 align:middle line:84% this beautiful Fiat-Shamir paradigm, which 00:08:08.330 --> 00:08:10.830 align:middle line:84% is a paradigm for reducing interaction. 00:08:10.830 --> 00:08:14.120 align:middle line:84% And we're going to study the security of this paradigm 00:08:14.120 --> 00:08:17.130 align:middle line:84% and show how to make this paradigm secure. 00:08:17.130 --> 00:08:20.520 align:middle line:84% So these are results that have happened very recently. 00:08:20.520 --> 00:08:23.900 align:middle line:84% Actually, one of the students here, Alex Lombardi at MIT, 00:08:23.900 --> 00:08:24.410 align:middle line:90% was-- 00:08:24.410 --> 00:08:27.410 align:middle line:84% Vinod's student was one of the people who showed 00:08:27.410 --> 00:08:29.067 align:middle line:90% the security of this paradigm. 00:08:29.067 --> 00:08:30.150 align:middle line:90% So we're going to show it. 00:08:30.150 --> 00:08:31.850 align:middle line:84% We're going to use it then to show 00:08:31.850 --> 00:08:34.700 align:middle line:84% how to get our doubly efficient interactive proof, how to make 00:08:34.700 --> 00:08:36.870 align:middle line:90% it non-interactive anymore. 00:08:36.870 --> 00:08:39.470 align:middle line:84% So make it completely non-interactive. 00:08:39.470 --> 00:08:42.289 align:middle line:84% We're going to also show how to use this Fiat-Shamir paradigm 00:08:42.289 --> 00:08:45.680 align:middle line:84% to do batch proofs non-interactively 00:08:45.680 --> 00:08:46.800 align:middle line:90% in a very succinct way. 00:08:46.800 --> 00:08:50.360 align:middle line:84% So taking a bunch of claims and giving one 00:08:50.360 --> 00:08:51.440 align:middle line:90% short proof from them. 00:08:51.440 --> 00:08:52.940 align:middle line:84% And finally, we're going to show how 00:08:52.940 --> 00:08:54.920 align:middle line:84% to use that to go all the way to what's 00:08:54.920 --> 00:08:58.250 align:middle line:84% called a SNARG, which is a succinct, non-interactive 00:08:58.250 --> 00:08:59.040 align:middle line:90% argument. 00:08:59.040 --> 00:09:01.970 align:middle line:84% "Argument" is just another word for a computationally sound 00:09:01.970 --> 00:09:02.790 align:middle line:90% proof. 00:09:02.790 --> 00:09:06.260 align:middle line:84% So this is kind of very, very high level of what you should 00:09:06.260 --> 00:09:09.390 align:middle line:90% expect to learn in this class. 00:09:09.390 --> 00:09:14.360 align:middle line:84% If you didn't understand a word what I said, then this is what-- 00:09:14.360 --> 00:09:16.250 align:middle line:84% the goal is that you will understand this 00:09:16.250 --> 00:09:17.515 align:middle line:90% by the end of this class. 00:09:17.515 --> 00:09:20.300 align:middle line:90% 00:09:20.300 --> 00:09:22.740 align:middle line:90% Questions before I start? 00:09:22.740 --> 00:09:23.300 align:middle line:90% OK. 00:09:23.300 --> 00:09:26.720 align:middle line:84% I need a volunteer to scribe for today. 00:09:26.720 --> 00:09:27.900 align:middle line:90% Oh, fantastic. 00:09:27.900 --> 00:09:29.250 align:middle line:90% Thanks. 00:09:29.250 --> 00:09:31.200 align:middle line:90% So with that, let's start. 00:09:31.200 --> 00:09:34.410 align:middle line:84% So let's start with the notion of interactive proofs. 00:09:34.410 --> 00:09:36.780 align:middle line:84% And before I go to interactive proofs, 00:09:36.780 --> 00:09:39.450 align:middle line:84% let me just-- even before interactive proofs, 00:09:39.450 --> 00:09:42.950 align:middle line:84% let's look at the class NP, non-deterministic polynomial 00:09:42.950 --> 00:09:43.680 align:middle line:90% time. 00:09:43.680 --> 00:09:45.740 align:middle line:84% Even this class is about proof systems. 00:09:45.740 --> 00:09:50.960 align:middle line:84% So what is-- this class is trying to-- 00:09:50.960 --> 00:09:53.250 align:middle line:84% by the way, there's another chair here. 00:09:53.250 --> 00:09:55.810 align:middle line:84% For those who don't have a chair, there's one right here. 00:09:55.810 --> 00:09:59.805 align:middle line:90% 00:09:59.805 --> 00:10:00.305 align:middle line:90% Great. 00:10:00.305 --> 00:10:02.870 align:middle line:90% 00:10:02.870 --> 00:10:03.420 align:middle line:90% Great. 00:10:03.420 --> 00:10:05.665 align:middle line:84% So even before we go to the interactive setting, 00:10:05.665 --> 00:10:07.040 align:middle line:84% let's even think of the class NP. 00:10:07.040 --> 00:10:08.090 align:middle line:90% What is the class NP? 00:10:08.090 --> 00:10:13.100 align:middle line:84% If you think about it, it's all the languages 00:10:13.100 --> 00:10:17.510 align:middle line:84% that have a proof, that's the witness, that can 00:10:17.510 --> 00:10:20.100 align:middle line:90% be verified by polynomial time. 00:10:20.100 --> 00:10:22.610 align:middle line:90% So we want to think-- 00:10:22.610 --> 00:10:25.110 align:middle line:84% the framework for this class is the following. 00:10:25.110 --> 00:10:26.450 align:middle line:90% We want to ask-- 00:10:26.450 --> 00:10:30.311 align:middle line:84% we have-- the verifiers are polynomial time, or even-- 00:10:30.311 --> 00:10:31.800 align:middle line:90% they're very efficient. 00:10:31.800 --> 00:10:35.490 align:middle line:84% What can you prove to these verifiers? 00:10:35.490 --> 00:10:38.120 align:middle line:84% So that's exactly what NP captures. 00:10:38.120 --> 00:10:42.120 align:middle line:84% NP is all the languages that you can 00:10:42.120 --> 00:10:48.190 align:middle line:84% prove membership in the language to a polynomial time verifier. 00:10:48.190 --> 00:10:58.710 align:middle line:84% So NP is exactly the set of languages, 00:10:58.710 --> 00:11:11.050 align:middle line:84% membership can be proved in poly time. 00:11:11.050 --> 00:11:17.890 align:middle line:84% So for a-- or can prove to a poly time. 00:11:17.890 --> 00:11:25.413 align:middle line:84% Maybe I should say, can prove to a polynomial time verifier. 00:11:25.413 --> 00:11:28.410 align:middle line:90% 00:11:28.410 --> 00:11:32.190 align:middle line:84% So a polynomial time verifier can verify membership 00:11:32.190 --> 00:11:33.630 align:middle line:90% in the language. 00:11:33.630 --> 00:11:35.715 align:middle line:90% So far so good? 00:11:35.715 --> 00:11:38.970 align:middle line:90% But NP is not that rich. 00:11:38.970 --> 00:11:43.030 align:middle line:90% So we want more, more than NP. 00:11:43.030 --> 00:11:46.210 align:middle line:84% So one thing we can add-- so what is the class IP? 00:11:46.210 --> 00:11:49.770 align:middle line:84% The first thing that-- so IP, interactive proofs 00:11:49.770 --> 00:11:51.456 align:middle line:90% and two components. 00:11:51.456 --> 00:11:55.920 align:middle line:90% 00:11:55.920 --> 00:11:59.410 align:middle line:84% So in NP, the proof is classical. 00:11:59.410 --> 00:12:02.610 align:middle line:84% It's the class of languages for which a membership can be 00:12:02.610 --> 00:12:06.960 align:middle line:90% proved using a classical proof. 00:12:06.960 --> 00:12:12.240 align:middle line:84% A proof that you can verify just running a Turing machine. 00:12:12.240 --> 00:12:15.370 align:middle line:84% Interactive proofs are different in two ways. 00:12:15.370 --> 00:12:21.840 align:middle line:84% First of all, we allow interaction between the prover 00:12:21.840 --> 00:12:22.720 align:middle line:90% and the verifier. 00:12:22.720 --> 00:12:26.250 align:middle line:90% They can talk back and forth. 00:12:26.250 --> 00:12:30.514 align:middle line:84% Importantly, we allow randomization. 00:12:30.514 --> 00:12:36.960 align:middle line:90% 00:12:36.960 --> 00:12:37.800 align:middle line:90% Now note. 00:12:37.800 --> 00:12:39.160 align:middle line:90% What do we mean, randomization? 00:12:39.160 --> 00:12:42.990 align:middle line:84% The verifier can be randomized and there 00:12:42.990 --> 00:12:45.930 align:middle line:84% can be some chance that the theorem is false 00:12:45.930 --> 00:12:46.660 align:middle line:90% and he'll accept. 00:12:46.660 --> 00:12:48.460 align:middle line:90% But that's very, very small. 00:12:48.460 --> 00:12:51.810 align:middle line:84% We can make it kind of-- if the communication complexity is, 00:12:51.810 --> 00:12:53.640 align:middle line:90% let's say, n, we can make-- 00:12:53.640 --> 00:12:56.220 align:middle line:84% you'll accept the false statement 00:12:56.220 --> 00:12:58.612 align:middle line:84% with probability something like 2 to the minus n. 00:12:58.612 --> 00:13:00.070 align:middle line:84% So we can make it very, very small. 00:13:00.070 --> 00:13:02.280 align:middle line:84% But there is a nonzero chance that you'll 00:13:02.280 --> 00:13:04.030 align:middle line:90% accept a false statement. 00:13:04.030 --> 00:13:06.270 align:middle line:84% So in that sense, we weaken the model. 00:13:06.270 --> 00:13:10.620 align:middle line:84% Now note, if there is no randomization, 00:13:10.620 --> 00:13:14.880 align:middle line:84% if we force the verifier to be deterministic, 00:13:14.880 --> 00:13:17.550 align:middle line:84% if the interaction-- so again, the interactive proof 00:13:17.550 --> 00:13:21.240 align:middle line:84% is a kind of interactive protocol between prover 00:13:21.240 --> 00:13:22.270 align:middle line:90% and verifier. 00:13:22.270 --> 00:13:25.000 align:middle line:84% If the prover knew what the verifier was going to send, 00:13:25.000 --> 00:13:27.570 align:middle line:84% if he was completely deterministic, 00:13:27.570 --> 00:13:31.170 align:middle line:84% then the prover can just generate the entire transcript 00:13:31.170 --> 00:13:32.640 align:middle line:90% and give it as a proof. 00:13:32.640 --> 00:13:35.220 align:middle line:90% So it will really be NP. 00:13:35.220 --> 00:13:38.040 align:middle line:84% There was no point of this interaction. 00:13:38.040 --> 00:13:41.430 align:middle line:84% So really, the power of this IP comes from the fact 00:13:41.430 --> 00:13:43.063 align:middle line:84% that the verifier is interactive. 00:13:43.063 --> 00:13:44.730 align:middle line:84% It comes from the fact that the verifier 00:13:44.730 --> 00:13:46.290 align:middle line:90% is interactive, is randomized. 00:13:46.290 --> 00:13:48.420 align:middle line:84% Sorry, it's randomized, and the prover 00:13:48.420 --> 00:13:50.590 align:middle line:84% doesn't know what this randomness is going to be. 00:13:50.590 --> 00:13:53.940 align:middle line:84% So if I'm trying to prove to you a statement, 00:13:53.940 --> 00:13:55.630 align:middle line:90% I send you my first message. 00:13:55.630 --> 00:13:57.768 align:middle line:84% I don't know what question you're going to ask me. 00:13:57.768 --> 00:13:59.560 align:middle line:84% You're going to answer some random question 00:13:59.560 --> 00:14:00.895 align:middle line:90% and I'll need to give an answer. 00:14:00.895 --> 00:14:02.770 align:middle line:84% And then I don't know what the next question. 00:14:02.770 --> 00:14:05.395 align:middle line:84% If I knew all your questions in advance, then there's no point. 00:14:05.395 --> 00:14:08.800 align:middle line:90% It's like it loses the power. 00:14:08.800 --> 00:14:11.070 align:middle line:84% So really, the power comes from the fact that 00:14:11.070 --> 00:14:13.650 align:middle line:84% there's interaction and the prover cannot predict ahead 00:14:13.650 --> 00:14:16.535 align:middle line:84% of time what questions he's going to get from the verifier. 00:14:16.535 --> 00:14:19.566 align:middle line:90% 00:14:19.566 --> 00:14:21.926 align:middle line:90% So any questions? 00:14:21.926 --> 00:14:27.474 align:middle line:90% 00:14:27.474 --> 00:14:31.510 align:middle line:84% So I can identify this formally yet. 00:14:31.510 --> 00:14:32.920 align:middle line:84% I'll define it formally in a bit. 00:14:32.920 --> 00:14:38.350 align:middle line:84% But I hope I convinced you that without randomness, this model 00:14:38.350 --> 00:14:39.830 align:middle line:90% is really useless. 00:14:39.830 --> 00:14:41.090 align:middle line:90% There's no point. 00:14:41.090 --> 00:14:44.330 align:middle line:84% How about just-- how about without interaction? 00:14:44.330 --> 00:14:46.480 align:middle line:90% Let's say I had only randomness. 00:14:46.480 --> 00:14:48.430 align:middle line:90% Do I get more? 00:14:48.430 --> 00:14:53.170 align:middle line:84% And actually-- so what if we allow only randomness? 00:14:53.170 --> 00:14:55.150 align:middle line:90% So proofs. 00:14:55.150 --> 00:15:04.030 align:middle line:84% So let's talk about non-interactive proofs 00:15:04.030 --> 00:15:07.646 align:middle line:84% where the verifier, V, is randomized. 00:15:07.646 --> 00:15:12.340 align:middle line:90% 00:15:12.340 --> 00:15:16.840 align:middle line:84% By the way, I forgot to say, please stop me at any point 00:15:16.840 --> 00:15:17.810 align:middle line:90% and ask me questions. 00:15:17.810 --> 00:15:18.680 align:middle line:90% I like questions. 00:15:18.680 --> 00:15:21.230 align:middle line:84% Questions are good for me to-- can't slow me down. 00:15:21.230 --> 00:15:23.240 align:middle line:84% It gives you an opportunity to digest. 00:15:23.240 --> 00:15:24.350 align:middle line:90% So it's a great thing. 00:15:24.350 --> 00:15:28.960 align:middle line:84% So please, just at any point, stop me with questions. 00:15:28.960 --> 00:15:30.810 align:middle line:90% Questions? 00:15:30.810 --> 00:15:31.310 align:middle line:90% No. 00:15:31.310 --> 00:15:31.880 align:middle line:90% OK. 00:15:31.880 --> 00:15:34.610 align:middle line:90% So good. 00:15:34.610 --> 00:15:38.600 align:middle line:84% So what about if we-- so we said if we get rid of randomness, 00:15:38.600 --> 00:15:39.380 align:middle line:90% we get nothing. 00:15:39.380 --> 00:15:40.810 align:middle line:84% What if we get rid of interaction 00:15:40.810 --> 00:15:42.500 align:middle line:90% and we just allow randomness? 00:15:42.500 --> 00:15:43.850 align:middle line:90% Do we get more? 00:15:43.850 --> 00:15:45.740 align:middle line:90% And actually, we do get more. 00:15:45.740 --> 00:15:48.590 align:middle line:84% And actually, this complexity test has a name. 00:15:48.590 --> 00:15:51.680 align:middle line:90% This is MA for Merlin Arthur. 00:15:51.680 --> 00:15:54.320 align:middle line:84% "Arthur" is known as a verifier, "Merlin" is known as a prover. 00:15:54.320 --> 00:15:56.510 align:middle line:90% So the prover sends a message. 00:15:56.510 --> 00:15:59.840 align:middle line:84% Arthur, the verifier, can toss coins and based on that, 00:15:59.840 --> 00:16:01.220 align:middle line:90% decide if to accept or not. 00:16:01.220 --> 00:16:07.060 align:middle line:84% But anyway, the non-interactive randomized version is believed 00:16:07.060 --> 00:16:07.600 align:middle line:90% to be-- 00:16:07.600 --> 00:16:09.382 align:middle line:84% I mean, it may be more powerful than NP. 00:16:09.382 --> 00:16:10.340 align:middle line:90% We actually don't know. 00:16:10.340 --> 00:16:12.410 align:middle line:84% But it seems there's some more power. 00:16:12.410 --> 00:16:14.270 align:middle line:84% And actually, let me give you an example. 00:16:14.270 --> 00:16:17.600 align:middle line:84% This is an example that will kind be useful for us later. 00:16:17.600 --> 00:16:19.010 align:middle line:90% So it's not only an example. 00:16:19.010 --> 00:16:21.640 align:middle line:84% But let me give you an example where randomness 00:16:21.640 --> 00:16:23.230 align:middle line:90% can be helpful for us. 00:16:23.230 --> 00:16:26.230 align:middle line:90% So suppose you want to verify-- 00:16:26.230 --> 00:16:30.890 align:middle line:84% let's say you have two n by n matrices, A and B. 00:16:30.890 --> 00:16:32.913 align:middle line:90% These are n by n matrices. 00:16:32.913 --> 00:16:36.940 align:middle line:90% 00:16:36.940 --> 00:16:39.705 align:middle line:84% Let's say over 0, 1, or over a finite field. 00:16:39.705 --> 00:16:47.650 align:middle line:90% 00:16:47.650 --> 00:16:50.750 align:middle line:84% And let's say you want to verify-- 00:16:50.750 --> 00:16:55.570 align:middle line:84% suppose you want to verify that some matrix, C, is 00:16:55.570 --> 00:16:59.290 align:middle line:84% equal to A times B. So you're also given, let's say, 00:16:59.290 --> 00:17:06.178 align:middle line:84% C. So you need to verify task of matrix multiplication. 00:17:06.178 --> 00:17:07.910 align:middle line:90% We can do it efficiently. 00:17:07.910 --> 00:17:09.579 align:middle line:84% And in general, the best known algorithm 00:17:09.579 --> 00:17:15.220 align:middle line:84% is something like order O of n to the 236 maybe, 00:17:15.220 --> 00:17:16.310 align:middle line:90% something like that. 00:17:16.310 --> 00:17:20.470 align:middle line:84% That's the best known matrix multiplication algorithm. 00:17:20.470 --> 00:17:22.300 align:middle line:90% Why are you looking at me? 00:17:22.300 --> 00:17:23.359 align:middle line:90% Oh, the number? 00:17:23.359 --> 00:17:25.810 align:middle line:90% Yeah, close. 00:17:25.810 --> 00:17:29.610 align:middle line:84% But it turns out that using randomization, 00:17:29.610 --> 00:17:31.520 align:middle line:90% you can do it more efficiently. 00:17:31.520 --> 00:17:36.230 align:middle line:84% So let's show how you can verify that a matrix, C, is 00:17:36.230 --> 00:17:42.290 align:middle line:84% a product of two matrices, A and B in time order n squared. 00:17:42.290 --> 00:17:44.330 align:middle line:84% So kind of the best can do because you 00:17:44.330 --> 00:17:46.670 align:middle line:90% need to read the input. 00:17:46.670 --> 00:17:48.630 align:middle line:90% So how will you do that? 00:17:48.630 --> 00:17:49.560 align:middle line:90% Here is the idea. 00:17:49.560 --> 00:17:56.305 align:middle line:84% So here's a randomized algorithm for verifying this. 00:17:56.305 --> 00:17:59.150 align:middle line:90% 00:17:59.150 --> 00:18:01.590 align:middle line:90% So let's assume that f-- 00:18:01.590 --> 00:18:08.120 align:middle line:84% first assume-- this is kind of without loss of generality, 00:18:08.120 --> 00:18:12.740 align:middle line:90% that F is much bigger than n. 00:18:12.740 --> 00:18:16.790 align:middle line:84% If not, you can take kind of an extension field of F embedded 00:18:16.790 --> 00:18:18.180 align:middle line:90% in a much bigger field. 00:18:18.180 --> 00:18:20.060 align:middle line:90% So just let's assume-- 00:18:20.060 --> 00:18:22.620 align:middle line:84% those who are not comfortable with extension fields, 00:18:22.620 --> 00:18:25.680 align:middle line:84% let's assume it's just much bigger. 00:18:25.680 --> 00:18:26.760 align:middle line:90% Then what do you do? 00:18:26.760 --> 00:18:27.750 align:middle line:90% Here's my algorithm. 00:18:27.750 --> 00:18:28.625 align:middle line:90% What I'm going to do? 00:18:28.625 --> 00:18:32.095 align:middle line:84% I'm going to choose a random element in the field. 00:18:32.095 --> 00:18:35.600 align:middle line:90% 00:18:35.600 --> 00:18:40.760 align:middle line:84% I'm going to consider x, which is just 1, 00:18:40.760 --> 00:18:45.780 align:middle line:84% r, r squared up to r to the n minus 1. 00:18:45.780 --> 00:18:46.970 align:middle line:90% So all the powers of r. 00:18:46.970 --> 00:18:48.900 align:middle line:90% I chose a random r in the field. 00:18:48.900 --> 00:18:52.730 align:middle line:90% I look at all the powers of r. 00:18:52.730 --> 00:18:53.830 align:middle line:90% And then what do I do? 00:18:53.830 --> 00:18:56.930 align:middle line:90% 00:18:56.930 --> 00:18:58.000 align:middle line:90% Yeah? 00:18:58.000 --> 00:19:00.350 align:middle line:84% STUDENT: Check whether it's Cx [INAUDIBLE]. 00:19:00.350 --> 00:19:01.820 align:middle line:90% YAEL KALAI: Exactly. 00:19:01.820 --> 00:19:09.350 align:middle line:84% And then I'm going to check if C times x, I guess transpose, 00:19:09.350 --> 00:19:15.100 align:middle line:84% because I wrote it, is equal to AB times x. 00:19:15.100 --> 00:19:18.020 align:middle line:90% 00:19:18.020 --> 00:19:20.480 align:middle line:90% That's my algorithm. 00:19:20.480 --> 00:19:27.140 align:middle line:90% So note-- yeah. 00:19:27.140 --> 00:19:31.520 align:middle line:84% So note this is just a vector, and vector times matrix-- 00:19:31.520 --> 00:19:33.590 align:middle line:84% so to multiply a matrix by a vector 00:19:33.590 --> 00:19:40.020 align:middle line:84% is time n squared, as opposed to n to the 2, 3, 6. 00:19:40.020 --> 00:19:42.330 align:middle line:90% So this is more efficient. 00:19:42.330 --> 00:19:44.000 align:middle line:90% Why is it OK? 00:19:44.000 --> 00:19:45.240 align:middle line:90% So of course, it's complete. 00:19:45.240 --> 00:19:48.330 align:middle line:84% If these are equal, I'm going to accept. 00:19:48.330 --> 00:19:50.990 align:middle line:90% But if they're not equal? 00:19:50.990 --> 00:19:53.720 align:middle line:90% So why is it sound? 00:19:53.720 --> 00:19:55.410 align:middle line:90% So maybe you can convince me. 00:19:55.410 --> 00:19:56.670 align:middle line:90% Let's say they're not equal. 00:19:56.670 --> 00:19:58.795 align:middle line:84% Maybe you can still convince me that they're equal. 00:19:58.795 --> 00:20:00.950 align:middle line:90% That would be a problem. 00:20:00.950 --> 00:20:02.587 align:middle line:90% So-- yeah? 00:20:02.587 --> 00:20:04.670 align:middle line:84% STUDENT: You could move the term over and write it 00:20:04.670 --> 00:20:06.540 align:middle line:84% as a polynomial that opens that r. 00:20:06.540 --> 00:20:10.430 align:middle line:84% And since the size of the field is much greater than n, 00:20:10.430 --> 00:20:13.213 align:middle line:84% it's less probable that in a random point [INAUDIBLE]. 00:20:13.213 --> 00:20:14.130 align:middle line:90% YAEL KALAI: Fantastic. 00:20:14.130 --> 00:20:14.640 align:middle line:90% Fantastic. 00:20:14.640 --> 00:20:17.370 align:middle line:84% So let me just repeat what you said a bit more formally. 00:20:17.370 --> 00:20:19.260 align:middle line:90% So suppose they're not equal. 00:20:19.260 --> 00:20:21.360 align:middle line:84% There's one row that they're not equal in. 00:20:21.360 --> 00:20:23.730 align:middle line:90% Let's focus on that row. 00:20:23.730 --> 00:20:28.500 align:middle line:84% So you can think of-- when I do C times x, let's say C1, 00:20:28.500 --> 00:20:33.660 align:middle line:84% the first row of C. When I do C times x, 00:20:33.660 --> 00:20:38.260 align:middle line:84% you can think of this as I take-- 00:20:38.260 --> 00:20:41.650 align:middle line:84% I look at this, the row, as a polynomial. 00:20:41.650 --> 00:20:45.540 align:middle line:84% So if you look at the first row, maybe I'll write it as C, 1, 1 00:20:45.540 --> 00:20:50.980 align:middle line:84% up to-- or C 1, 0 up to C1, n minus 1. 00:20:50.980 --> 00:20:52.750 align:middle line:90% Let's look at this n row. 00:20:52.750 --> 00:20:55.960 align:middle line:84% When I multiply by x, which is 1 r, r squared, 00:20:55.960 --> 00:21:01.530 align:middle line:84% this is nothing but sum C1i x to the i. 00:21:01.530 --> 00:21:03.170 align:middle line:90% Or, sorry, r to the i. 00:21:03.170 --> 00:21:08.130 align:middle line:90% 00:21:08.130 --> 00:21:10.360 align:middle line:90% So now what do I check? 00:21:10.360 --> 00:21:12.180 align:middle line:90% So now if this row-- 00:21:12.180 --> 00:21:16.620 align:middle line:84% let's say it is different than the row here. 00:21:16.620 --> 00:21:20.290 align:middle line:84% Then I have two different polynomial. 00:21:20.290 --> 00:21:26.040 align:middle line:84% So if I write the row there, let's say, as I don't know, D0, 00:21:26.040 --> 00:21:29.820 align:middle line:84% or D1, 0 up to D1 n minus 1, let's 00:21:29.820 --> 00:21:33.720 align:middle line:84% say this is the row corresponding to A times B. 00:21:33.720 --> 00:21:35.980 align:middle line:90% If these are different-- 00:21:35.980 --> 00:21:41.640 align:middle line:84% if these are different, then I have two different polynomials 00:21:41.640 --> 00:21:45.360 align:middle line:84% that agree on a random out-- two random degree 00:21:45.360 --> 00:21:48.160 align:middle line:90% n minus 1 polynomials. 00:21:48.160 --> 00:21:51.715 align:middle line:84% So the polynomial is defined by this row. 00:21:51.715 --> 00:21:53.590 align:middle line:84% These are the coefficients of the polynomial. 00:21:53.590 --> 00:21:54.820 align:middle line:90% There are n coefficient. 00:21:54.820 --> 00:21:58.270 align:middle line:84% So it's a degree n minus 1 polynomial. 00:21:58.270 --> 00:22:02.710 align:middle line:84% So when would I accept a false claim? 00:22:02.710 --> 00:22:06.270 align:middle line:84% If there exists two things that are equal that are different. 00:22:06.270 --> 00:22:10.050 align:middle line:84% There exists a row in C that's different than a row in A 00:22:10.050 --> 00:22:13.680 align:middle line:84% times B. So there exists a polynomial 00:22:13.680 --> 00:22:16.680 align:middle line:84% of degree n minus 1 here and a different polynomial degree 00:22:16.680 --> 00:22:17.740 align:middle line:90% n minus 1. 00:22:17.740 --> 00:22:22.270 align:middle line:84% And these two polynomials are equal in this r. 00:22:22.270 --> 00:22:26.940 align:middle line:90% 00:22:26.940 --> 00:22:30.930 align:middle line:84% But what is the probability that two distinct polynomials 00:22:30.930 --> 00:22:33.970 align:middle line:90% of degree n minus 1 are equal? 00:22:33.970 --> 00:22:38.010 align:middle line:84% It's just-- this happens with probability at most n 00:22:38.010 --> 00:22:43.650 align:middle line:84% minus 1, the degree divided by the field size. 00:22:43.650 --> 00:22:46.110 align:middle line:90% Two polynomials agree. 00:22:46.110 --> 00:22:49.650 align:middle line:84% Two distinct polynomials agree, and at most, or the fraction. 00:22:49.650 --> 00:22:54.360 align:middle line:84% Now they will, at most, n minus 1 points, and which is n minus 1 00:22:54.360 --> 00:23:00.130 align:middle line:90% over F fraction of the field. 00:23:00.130 --> 00:23:02.500 align:middle line:90% So I'll reject this probability. 00:23:02.500 --> 00:23:03.930 align:middle line:84% And if we're not happy with this, 00:23:03.930 --> 00:23:06.540 align:middle line:84% F is not big enough for us, then we do everything 00:23:06.540 --> 00:23:08.460 align:middle line:90% over a bigger extension field. 00:23:08.460 --> 00:23:10.200 align:middle line:84% So our rejection probability will 00:23:10.200 --> 00:23:15.480 align:middle line:90% be high If the claim is false. 00:23:15.480 --> 00:23:18.970 align:middle line:90% Any questions about this? 00:23:18.970 --> 00:23:21.715 align:middle line:84% So far, what we saw is that red-- 00:23:21.715 --> 00:23:22.340 align:middle line:90% STUDENT: Ma'am? 00:23:22.340 --> 00:23:23.560 align:middle line:90% YAEL KALAI: Oh, yeah. 00:23:23.560 --> 00:23:24.080 align:middle line:90% Oh, yes. 00:23:24.080 --> 00:23:24.580 align:middle line:90% Please. 00:23:24.580 --> 00:23:25.080 align:middle line:90% Thank you. 00:23:25.080 --> 00:23:25.630 align:middle line:90% Thank you. 00:23:25.630 --> 00:23:27.130 align:middle line:84% STUDENT: Is that the Schwartz-Zippel 00:23:27.130 --> 00:23:27.910 align:middle line:90% lemma we're doing? 00:23:27.910 --> 00:23:29.510 align:middle line:84% YAEL KALAI: This is not a Schwartz-Zippel lemma. 00:23:29.510 --> 00:23:31.130 align:middle line:84% Schwartz-Zippel lemma is similar, 00:23:31.130 --> 00:23:33.350 align:middle line:90% but in a multivariate setting. 00:23:33.350 --> 00:23:34.450 align:middle line:90% So this-- good. 00:23:34.450 --> 00:23:36.080 align:middle line:84% So let me-- that's a good question. 00:23:36.080 --> 00:23:36.800 align:middle line:90% So thank you. 00:23:36.800 --> 00:23:39.830 align:middle line:84% So I just want to say-- oh, by the way, 00:23:39.830 --> 00:23:43.640 align:middle line:84% I should tell you guys this is being recorded. 00:23:43.640 --> 00:23:44.720 align:middle line:90% I hope it's OK with you. 00:23:44.720 --> 00:23:46.160 align:middle line:90% You're not being recorded. 00:23:46.160 --> 00:23:48.702 align:middle line:84% It's supposed to-- I'm supposed to be the one being recorded. 00:23:48.702 --> 00:23:52.330 align:middle line:84% But I think you should know that there's a cameraman behind you. 00:23:52.330 --> 00:23:55.150 align:middle line:84% But actually, I don't think I'm going to put this-- 00:23:55.150 --> 00:23:56.630 align:middle line:84% I mean, it's in the website for us. 00:23:56.630 --> 00:23:59.700 align:middle line:84% Well, now the website is public, so it will be public. 00:23:59.700 --> 00:24:00.670 align:middle line:90% [LAUGHING] 00:24:00.670 --> 00:24:02.570 align:middle line:84% I can make it private if you prefer. 00:24:02.570 --> 00:24:04.820 align:middle line:84% If people come to me and ask for it to be private, 00:24:04.820 --> 00:24:05.695 align:middle line:90% I'll make it private. 00:24:05.695 --> 00:24:08.910 align:middle line:90% 00:24:08.910 --> 00:24:10.130 align:middle line:90% So good. 00:24:10.130 --> 00:24:12.380 align:middle line:84% So the question was, was this Schwartz-Zippel lemma? 00:24:12.380 --> 00:24:13.810 align:middle line:90% And that's exactly-- 00:24:13.810 --> 00:24:17.440 align:middle line:84% Schwartz-Zippel Lemma is a multivariate version of this. 00:24:17.440 --> 00:24:20.120 align:middle line:84% This is for the single variate case. 00:24:20.120 --> 00:24:25.720 align:middle line:84% So the fact that two univariate polynomials of degree d distinct 00:24:25.720 --> 00:24:28.270 align:middle line:84% are-- they're equal and a random value-- 00:24:28.270 --> 00:24:33.700 align:middle line:84% they're equal and at most d element, d being the degree, 00:24:33.700 --> 00:24:36.130 align:middle line:90% is kind of-- 00:24:36.130 --> 00:24:39.120 align:middle line:84% I don't remember the theorem, basic something of math-- 00:24:39.120 --> 00:24:40.763 align:middle line:90% [INTERPOSING VOICES] 00:24:40.763 --> 00:24:42.680 align:middle line:84% YAEL KALAI: You said Lagrangian interpolation? 00:24:42.680 --> 00:24:42.790 align:middle line:90% Yeah. 00:24:42.790 --> 00:24:44.350 align:middle line:84% But Schwartz-Zippel is exactly that, 00:24:44.350 --> 00:24:45.880 align:middle line:90% but in the multivariate setting. 00:24:45.880 --> 00:24:47.800 align:middle line:84% STUDENT: So it's a generalization of that? 00:24:47.800 --> 00:24:48.830 align:middle line:90% YAEL KALAI: Exactly. 00:24:48.830 --> 00:24:49.360 align:middle line:90% Exactly. 00:24:49.360 --> 00:24:52.850 align:middle line:84% The Schwartz-Zippel is exactly a generalization of this theorem. 00:24:52.850 --> 00:24:55.250 align:middle line:84% And it will come up, actually, later in this class. 00:24:55.250 --> 00:24:57.980 align:middle line:90% So yeah, we'll talk about that. 00:24:57.980 --> 00:24:59.230 align:middle line:90% Any other questions? 00:24:59.230 --> 00:24:59.908 align:middle line:90% Yeah? 00:24:59.908 --> 00:25:01.450 align:middle line:84% STUDENT: Are there any examples where 00:25:01.450 --> 00:25:04.960 align:middle line:84% having randomness but not interaction 00:25:04.960 --> 00:25:07.460 align:middle line:84% gives you more than a polynomial time speed up or something. 00:25:07.460 --> 00:25:07.740 align:middle line:90% YAEL KALAI: Good. 00:25:07.740 --> 00:25:07.880 align:middle line:90% Good. 00:25:07.880 --> 00:25:08.020 align:middle line:90% Good. 00:25:08.020 --> 00:25:08.900 align:middle line:90% Very good question. 00:25:08.900 --> 00:25:12.070 align:middle line:84% So the question is, do we have examples 00:25:12.070 --> 00:25:16.060 align:middle line:84% where randomness gives you more speed up than just kind 00:25:16.060 --> 00:25:17.030 align:middle line:90% of pathetic? 00:25:17.030 --> 00:25:19.301 align:middle line:90% This is not very interesting. 00:25:19.301 --> 00:25:21.850 align:middle line:84% Or in other words, let me rephrase your question, 00:25:21.850 --> 00:25:24.830 align:middle line:84% is the class MA different than NP? 00:25:24.830 --> 00:25:25.930 align:middle line:90% That's the question. 00:25:25.930 --> 00:25:27.962 align:middle line:90% We don't know. 00:25:27.962 --> 00:25:31.160 align:middle line:84% STUDENT: And so MA said that the verifier has to be polynomial? 00:25:31.160 --> 00:25:32.140 align:middle line:90% YAEL KALAI: Yeah. 00:25:32.140 --> 00:25:33.620 align:middle line:90% Yeah. 00:25:33.620 --> 00:25:34.220 align:middle line:90% So yeah. 00:25:34.220 --> 00:25:35.320 align:middle line:90% So let me explain. 00:25:35.320 --> 00:25:39.622 align:middle line:84% There's a kind of-- there's this class called as MA, MA, MA, 00:25:39.622 --> 00:25:40.970 align:middle line:90% as many as you want. 00:25:40.970 --> 00:25:44.150 align:middle line:84% And the idea is M means Merlin speaks. 00:25:44.150 --> 00:25:45.350 align:middle line:90% Merlin is the prover. 00:25:45.350 --> 00:25:46.250 align:middle line:90% He's the wizard. 00:25:46.250 --> 00:25:50.140 align:middle line:84% "A" means Arthur, the King, he's the verifier, answers. 00:25:50.140 --> 00:25:52.220 align:middle line:90% M speaks, A answers. 00:25:52.220 --> 00:25:53.360 align:middle line:90% M speaks, A answers. 00:25:53.360 --> 00:25:58.930 align:middle line:84% So there's these classes, MA, MA, MA, MA. 00:25:58.930 --> 00:26:02.260 align:middle line:84% Here, MA means M, the Merlin, speaks. 00:26:02.260 --> 00:26:06.450 align:middle line:84% Arthur kind of uses randomness and then kind of sends 00:26:06.450 --> 00:26:06.950 align:middle line:90% randomness. 00:26:06.950 --> 00:26:07.700 align:middle line:90% Well, he doesn't speak-- 00:26:07.700 --> 00:26:08.825 align:middle line:90% Merlin doesn't speak again. 00:26:08.825 --> 00:26:10.430 align:middle line:90% But Merlin speaks. 00:26:10.430 --> 00:26:12.380 align:middle line:90% Arthur chooses coins. 00:26:12.380 --> 00:26:14.300 align:middle line:84% And then there's a verdict function that 00:26:14.300 --> 00:26:17.060 align:middle line:90% decides if to accept or reject. 00:26:17.060 --> 00:26:20.550 align:middle line:84% And we don't know if MA is different than NP. 00:26:20.550 --> 00:26:21.290 align:middle line:90% Yes? 00:26:21.290 --> 00:26:23.810 align:middle line:90% STUDENT: So this actually is a-- 00:26:23.810 --> 00:26:26.000 align:middle line:84% the polynomial identity testing, right? 00:26:26.000 --> 00:26:26.750 align:middle line:90% YAEL KALAI: Right. 00:26:26.750 --> 00:26:28.270 align:middle line:84% You're saying this is polynomial identity. 00:26:28.270 --> 00:26:28.560 align:middle line:90% STUDENT: Yeah. 00:26:28.560 --> 00:26:29.227 align:middle line:90% YAEL KALAI: Yes. 00:26:29.227 --> 00:26:30.805 align:middle line:84% STUDENT: So I give you a circuit. 00:26:30.805 --> 00:26:33.170 align:middle line:84% It's supposedly not a degree polynomial. 00:26:33.170 --> 00:26:35.840 align:middle line:84% I claim that it's identically zero circuits. 00:26:35.840 --> 00:26:39.587 align:middle line:84% You can check it clearly with this multivariate [INAUDIBLE]? 00:26:39.587 --> 00:26:40.920 align:middle line:90% YAEL KALAI: Right, right, right. 00:26:40.920 --> 00:26:43.040 align:middle line:84% STUDENT: So you don't want to [INAUDIBLE]. 00:26:43.040 --> 00:26:43.790 align:middle line:90% YAEL KALAI: Right. 00:26:43.790 --> 00:26:46.180 align:middle line:90% But-- oh, you're saying-- 00:26:46.180 --> 00:26:46.680 align:middle line:90% sorry. 00:26:46.680 --> 00:26:50.618 align:middle line:84% You're saying to test whether a circuit is-- 00:26:50.618 --> 00:26:52.160 align:middle line:84% STUDENT: Identically zero, let's say. 00:26:52.160 --> 00:26:53.220 align:middle line:90% YAEL KALAI: But wait. 00:26:53.220 --> 00:26:55.100 align:middle line:84% Oh, you're giving us just as a circuit. 00:26:55.100 --> 00:26:55.580 align:middle line:90% STUDENT: Circuit, yeah. 00:26:55.580 --> 00:26:56.955 align:middle line:84% YAEL KALAI: As a circuit, testing 00:26:56.955 --> 00:26:59.840 align:middle line:90% if it's identically zero. 00:26:59.840 --> 00:27:03.230 align:middle line:84% But it needs to be low degree, because otherwise-- 00:27:03.230 --> 00:27:06.920 align:middle line:84% STUDENT: So somehow, like, it's syntactically low degree, right. 00:27:06.920 --> 00:27:09.182 align:middle line:90% Low depth or something, right? 00:27:09.182 --> 00:27:10.430 align:middle line:90% Low depth arithmetic circuit. 00:27:10.430 --> 00:27:13.567 align:middle line:84% YAEL KALAI: Low depth, like log, log depth arithmetic circuit. 00:27:13.567 --> 00:27:15.400 align:middle line:84% Then you're saying it has polynomial degree. 00:27:15.400 --> 00:27:15.780 align:middle line:90% STUDENT: [INAUDIBLE]. 00:27:15.780 --> 00:27:17.322 align:middle line:84% YAEL KALAI: It has polynomial degree. 00:27:17.322 --> 00:27:21.410 align:middle line:84% You can test it by taking a large extension field. 00:27:21.410 --> 00:27:21.990 align:middle line:90% You can test. 00:27:21.990 --> 00:27:24.768 align:middle line:84% You don't know how to predict if it's, yes, good. 00:27:24.768 --> 00:27:26.810 align:middle line:84% STUDENT: If you don't know how to derandomize it. 00:27:26.810 --> 00:27:27.810 align:middle line:90% YAEL KALAI: How to randomize. 00:27:27.810 --> 00:27:29.150 align:middle line:84% STUDENT: If we do randomize it, then 00:27:29.150 --> 00:27:30.380 align:middle line:84% there are circuit lower bonds, which 00:27:30.380 --> 00:27:32.885 align:middle line:84% means that you can randomize everything probably, right? 00:27:32.885 --> 00:27:34.275 align:middle line:90% More or less. 00:27:34.275 --> 00:27:35.650 align:middle line:84% STUDENT: There's like-- yeah, you 00:27:35.650 --> 00:27:36.900 align:middle line:90% get some circuit lower bounds. 00:27:36.900 --> 00:27:37.640 align:middle line:90% But it's like-- 00:27:37.640 --> 00:27:38.430 align:middle line:90% YAEL KALAI: Yeah. 00:27:38.430 --> 00:27:39.290 align:middle line:90% Yeah. 00:27:39.290 --> 00:27:41.415 align:middle line:84% STUDENT: Although, that's a problem in [INAUDIBLE], 00:27:41.415 --> 00:27:43.297 align:middle line:90% promising [INAUDIBLE] 00:27:43.297 --> 00:27:44.130 align:middle line:90% YAEL KALAI: No, why? 00:27:44.130 --> 00:27:45.560 align:middle line:90% Why is it not an MA? 00:27:45.560 --> 00:27:47.705 align:middle line:90% So you look at the class-- 00:27:47.705 --> 00:27:48.580 align:middle line:90% STUDENT: It is an MA. 00:27:48.580 --> 00:27:49.372 align:middle line:90% STUDENT: I'm sorry. 00:27:49.372 --> 00:27:50.660 align:middle line:90% STUDENT: But it's [INAUDIBLE]. 00:27:50.660 --> 00:27:50.750 align:middle line:90% YAEL KALAI: Ah. 00:27:50.750 --> 00:27:51.140 align:middle line:90% So, Right. 00:27:51.140 --> 00:27:51.720 align:middle line:90% OK. 00:27:51.720 --> 00:27:53.518 align:middle line:90% Yeah, yeah, yeah, yeah, yeah. 00:27:53.518 --> 00:27:54.060 align:middle line:90% You're right. 00:27:54.060 --> 00:27:54.690 align:middle line:90% It's in BPP. 00:27:54.690 --> 00:27:55.567 align:middle line:90% Yeah. 00:27:55.567 --> 00:27:57.650 align:middle line:84% STUDENT: So again, I just wanted to make the point 00:27:57.650 --> 00:28:00.410 align:middle line:84% that what Yael described is essentially 00:28:00.410 --> 00:28:04.550 align:middle line:84% the only-- the canonical problem in MA [INAUDIBLE]. 00:28:04.550 --> 00:28:05.210 align:middle line:90% STUDENT: OK. 00:28:05.210 --> 00:28:06.230 align:middle line:90% YAEL KALAI: Yeah. 00:28:06.230 --> 00:28:06.920 align:middle line:90% Yeah. 00:28:06.920 --> 00:28:09.415 align:middle line:84% STUDENT: Up to details, which I think 00:28:09.415 --> 00:28:12.200 align:middle line:90% that they're going to depart. 00:28:12.200 --> 00:28:13.070 align:middle line:90% YAEL KALAI: Thanks. 00:28:13.070 --> 00:28:13.700 align:middle line:90% Thanks, Vinod. 00:28:13.700 --> 00:28:15.760 align:middle line:90% Yeah. 00:28:15.760 --> 00:28:16.260 align:middle line:90% OK. 00:28:16.260 --> 00:28:19.360 align:middle line:84% So now let's go ahead and just define this class of NP-- 00:28:19.360 --> 00:28:24.590 align:middle line:90% 00:28:24.590 --> 00:28:28.026 align:middle line:84% of IP, sorry, interactive proofs. 00:28:28.026 --> 00:28:33.590 align:middle line:84% And then we'll show how an actual-- 00:28:33.590 --> 00:28:35.330 align:middle line:84% and we'll actually show why we believe 00:28:35.330 --> 00:28:38.600 align:middle line:84% this class is more powerful than NP 00:28:38.600 --> 00:28:42.620 align:middle line:84% will give a protocol that solves a problem that 00:28:42.620 --> 00:28:44.510 align:middle line:90% seems pretty hard. 00:28:44.510 --> 00:28:47.060 align:middle line:90% So let's see. 00:28:47.060 --> 00:28:49.190 align:middle line:90% So here is the-- 00:28:49.190 --> 00:28:50.965 align:middle line:90% so what is an interactive proof? 00:28:50.965 --> 00:28:54.620 align:middle line:90% 00:28:54.620 --> 00:29:01.385 align:middle line:90% An interactive proof, IP. 00:29:01.385 --> 00:29:04.760 align:middle line:90% 00:29:04.760 --> 00:29:17.940 align:middle line:84% This is a protocol between a possibly all-powerful-- 00:29:17.940 --> 00:29:26.460 align:middle line:90% I'm not a prover, P. 00:29:26.460 --> 00:29:30.400 align:middle line:84% So P can be run as long as you want. 00:29:30.400 --> 00:29:42.160 align:middle line:84% And A polytime verifier, V, such that-- 00:29:42.160 --> 00:29:45.390 align:middle line:84% here's the requirement from the protocol. 00:29:45.390 --> 00:29:48.640 align:middle line:90% We want to say that A-- 00:29:48.640 --> 00:29:52.680 align:middle line:84% so interactive protocol, let's say, for-- 00:29:52.680 --> 00:30:00.330 align:middle line:84% sorry, between a prover, P for a language, L. 00:30:00.330 --> 00:30:05.430 align:middle line:84% For some language, or some problem, L. So the problem 00:30:05.430 --> 00:30:07.930 align:middle line:84% corresponding to this membership in L, that's the problem. 00:30:07.930 --> 00:30:09.940 align:middle line:90% Is x a member or not a member? 00:30:09.940 --> 00:30:14.200 align:middle line:84% So an interactive proof should satisfy the following. 00:30:14.200 --> 00:30:18.690 align:middle line:84% So it's a protocol such that it should have two properties, 00:30:18.690 --> 00:30:22.200 align:middle line:90% completeness and soundness. 00:30:22.200 --> 00:30:31.090 align:middle line:84% Completeness says that if x is in the language, 00:30:31.090 --> 00:30:34.080 align:middle line:84% the prover should convince you to accept. 00:30:34.080 --> 00:30:41.020 align:middle line:84% So for every x in the language, if you look-- if you denote, 00:30:41.020 --> 00:30:48.660 align:middle line:84% let's say, by t, the transcript, so let's say P and V, 00:30:48.660 --> 00:30:50.248 align:middle line:90% which has secret randomness. 00:30:50.248 --> 00:30:52.290 align:middle line:84% The prover doesn't know what it is ahead of time. 00:30:52.290 --> 00:30:55.630 align:middle line:84% And input x, let's run this protocol. 00:30:55.630 --> 00:30:57.960 align:middle line:90% We get a transcript. 00:30:57.960 --> 00:31:01.060 align:middle line:90% So it's an interactive protocol. 00:31:01.060 --> 00:31:02.590 align:middle line:84% It actually-- you can think of it, 00:31:02.590 --> 00:31:04.245 align:middle line:84% the protocol consists in two phases. 00:31:04.245 --> 00:31:06.120 align:middle line:84% First, there's interaction between the-- they 00:31:06.120 --> 00:31:07.380 align:middle line:90% talk back and forth. 00:31:07.380 --> 00:31:10.230 align:middle line:84% Let's denote the transcript by T. 00:31:10.230 --> 00:31:12.100 align:middle line:90% I often denote like PV. 00:31:12.100 --> 00:31:13.630 align:middle line:90% That's kind of the protocol. 00:31:13.630 --> 00:31:14.700 align:middle line:90% The prover has r. 00:31:14.700 --> 00:31:17.130 align:middle line:90% Both of them know the input x. 00:31:17.130 --> 00:31:18.900 align:middle line:90% They generate a transcript. 00:31:18.900 --> 00:31:25.750 align:middle line:84% And at the end, the probability that V, with his input-- 00:31:25.750 --> 00:31:28.500 align:middle line:84% he gets the transcript, the randomness 00:31:28.500 --> 00:31:31.890 align:middle line:84% in x, the probability that he accepts-- 00:31:31.890 --> 00:31:33.300 align:middle line:90% outputs 1. 00:31:33.300 --> 00:31:36.660 align:middle line:84% When we say "outputs 1," we usually mean he accepts, 00:31:36.660 --> 00:31:39.640 align:middle line:90% is large. 00:31:39.640 --> 00:31:45.270 align:middle line:84% Let me call it least C. And C is going 00:31:45.270 --> 00:31:46.750 align:middle line:90% to be a completeness parameter. 00:31:46.750 --> 00:31:58.440 align:middle line:84% So protocol between P and V for language L with completeness, 00:31:58.440 --> 00:32:12.700 align:middle line:90% C, and soundness, S. 00:32:12.700 --> 00:32:15.320 align:middle line:84% STUDENT: Yael, do you mean L, x, and L? 00:32:15.320 --> 00:32:18.255 align:middle line:84% YAEL KALAI: Yes, I do mean L, x, and L. Oh, thank you. 00:32:18.255 --> 00:32:23.770 align:middle line:90% 00:32:23.770 --> 00:32:25.403 align:middle line:90% Thanks, Sally. 00:32:25.403 --> 00:32:28.040 align:middle line:90% 00:32:28.040 --> 00:32:31.340 align:middle line:84% So if it's in the language, he's accepted with high probability. 00:32:31.340 --> 00:32:34.570 align:middle line:84% There's some completeness parameter, C. And most of what 00:32:34.570 --> 00:32:37.330 align:middle line:84% we see in class today, this is 1. 00:32:37.330 --> 00:32:39.220 align:middle line:90% You accept with probability 1. 00:32:39.220 --> 00:32:42.540 align:middle line:90% And [INAUDIBLE] says this. 00:32:42.540 --> 00:32:47.080 align:middle line:90% 00:32:47.080 --> 00:32:51.866 align:middle line:84% [INAUDIBLE] says that for any x not in the language-- 00:32:51.866 --> 00:33:01.120 align:middle line:90% 00:33:01.120 --> 00:33:04.540 align:middle line:84% for every x that's not in the language, 00:33:04.540 --> 00:33:08.060 align:middle line:84% no matter how you try to cheat, you'll fail. 00:33:08.060 --> 00:33:13.870 align:middle line:84% So for any cheating prover, or for any P star, 00:33:13.870 --> 00:33:15.330 align:middle line:90% because it can be any. 00:33:15.330 --> 00:33:17.860 align:middle line:84% Any prover that tries to convince 00:33:17.860 --> 00:33:24.100 align:middle line:84% me to accept, if the probability for the same t is above, 00:33:24.100 --> 00:33:27.190 align:middle line:84% the probability that the verifier, given 00:33:27.190 --> 00:33:31.390 align:middle line:84% the transcript, the randomness, and x, outputs 1 accepts 00:33:31.390 --> 00:33:36.760 align:middle line:90% is at most S. 00:33:36.760 --> 00:33:39.370 align:middle line:84% So that's-- it's in the language, 00:33:39.370 --> 00:33:41.750 align:middle line:84% it should be accepted with high probability C is high. 00:33:41.750 --> 00:33:43.450 align:middle line:84% If it's not in the language, you should 00:33:43.450 --> 00:33:47.230 align:middle line:84% accept with small probability S is small. 00:33:47.230 --> 00:33:49.540 align:middle line:90% OK? 00:33:49.540 --> 00:33:51.910 align:middle line:90% Question about the model? 00:33:51.910 --> 00:33:53.830 align:middle line:90% Yeah. 00:33:53.830 --> 00:33:56.620 align:middle line:84% STUDENT: Is there any restriction on S and C, 00:33:56.620 --> 00:33:57.370 align:middle line:90% or are they just-- 00:33:57.370 --> 00:33:59.180 align:middle line:90% YAEL KALAI: Great question. 00:33:59.180 --> 00:34:00.180 align:middle line:90% What are S and C? 00:34:00.180 --> 00:34:01.110 align:middle line:90% Are they constant? 00:34:01.110 --> 00:34:03.170 align:middle line:84% So that was my next remark, which 00:34:03.170 --> 00:34:05.480 align:middle line:84% means that the question was right in place. 00:34:05.480 --> 00:34:09.000 align:middle line:84% So often, if you look at the literature, 00:34:09.000 --> 00:34:11.060 align:middle line:84% there won't be a mention of S and C. 00:34:11.060 --> 00:34:16.020 align:middle line:84% And C will be taken to be 2/3 and S will be taken to be 1/3. 00:34:16.020 --> 00:34:18.739 align:middle line:84% That's kind of a canonical-- so when people say there's an-- 00:34:18.739 --> 00:34:20.600 align:middle line:84% here's an interactive proof, often, 00:34:20.600 --> 00:34:25.460 align:middle line:84% you think of S as 1/3 and C as 2/3. 00:34:25.460 --> 00:34:27.447 align:middle line:90% And this seems very arbitrary. 00:34:27.447 --> 00:34:28.530 align:middle line:90% And you should be alarmed. 00:34:28.530 --> 00:34:34.113 align:middle line:84% So where do these constants come from? 00:34:34.113 --> 00:34:35.030 align:middle line:90% STUDENT: I don't know. 00:34:35.030 --> 00:34:38.217 align:middle line:84% I think it's possible to just repeat the procedure to-- 00:34:38.217 --> 00:34:39.050 align:middle line:90% YAEL KALAI: Exactly. 00:34:39.050 --> 00:34:41.306 align:middle line:84% STUDENT: [INAUDIBLE] paper defined [INAUDIBLE] 00:34:41.306 --> 00:34:42.139 align:middle line:90% YAEL KALAI: Exactly. 00:34:42.139 --> 00:34:45.800 align:middle line:84% So the reason why we don't care so much about these constants is 00:34:45.800 --> 00:34:50.030 align:middle line:84% because if you have an interactive proof with a gap 00:34:50.030 --> 00:34:53.130 align:middle line:84% between C and S, so for example, 1/3 and 2/3, 00:34:53.130 --> 00:34:56.429 align:middle line:84% what we're going to do is repeat the protocol. 00:34:56.429 --> 00:34:58.040 align:middle line:84% So let's say that it's 1/3 and 2/3. 00:34:58.040 --> 00:35:01.280 align:middle line:84% Let's repeat the protocol, let's say, n times. 00:35:01.280 --> 00:35:04.990 align:middle line:84% And then we're going to accept if you're closer to C 00:35:04.990 --> 00:35:10.210 align:middle line:84% and reject if you're closer to S. So in other words, 00:35:10.210 --> 00:35:16.730 align:middle line:84% if more than C plus S over 2, like right in the middle, 00:35:16.730 --> 00:35:18.912 align:middle line:84% if more than C plus S over 2 are accepted, 00:35:18.912 --> 00:35:19.870 align:middle line:90% you're going to accept. 00:35:19.870 --> 00:35:21.670 align:middle line:90% If less, you're going to reject. 00:35:21.670 --> 00:35:25.310 align:middle line:84% In this case of 2/3 and a third, let's say, 00:35:25.310 --> 00:35:28.040 align:middle line:84% more than half repeated many, many, many times, 00:35:28.040 --> 00:35:29.900 align:middle line:84% you should accept if it's in the language, 00:35:29.900 --> 00:35:33.340 align:middle line:84% you should expect to see about 2/3 acceptance. 00:35:33.340 --> 00:35:36.700 align:middle line:84% If it's not in the language, you should expect to see 1/3 of them 00:35:36.700 --> 00:35:37.850 align:middle line:90% being accepted. 00:35:37.850 --> 00:35:42.230 align:middle line:84% And if you repeat enough times, by the law of large numbers, 00:35:42.230 --> 00:35:45.590 align:middle line:84% you're going to get closer and closer to the expectation. 00:35:45.590 --> 00:35:48.400 align:middle line:84% So you're going to be either very close to the 2/3 00:35:48.400 --> 00:35:50.708 align:middle line:84% if you're in the language or very close to the 1/3 00:35:50.708 --> 00:35:52.000 align:middle line:90% if you're outside the language. 00:35:52.000 --> 00:35:58.410 align:middle line:84% And there's very strong concentration. 00:35:58.410 --> 00:36:00.600 align:middle line:84% So if you repeat it, let's say n times, 00:36:00.600 --> 00:36:02.330 align:middle line:84% then now you're going to be accepted-- 00:36:02.330 --> 00:36:06.170 align:middle line:84% or the soundness and completeness gap 00:36:06.170 --> 00:36:09.500 align:middle line:84% will be something like 2 to the minus n versus 1 minus 2 00:36:09.500 --> 00:36:10.290 align:middle line:90% to the minus n. 00:36:10.290 --> 00:36:14.270 align:middle line:84% So you can really very fast make these things 00:36:14.270 --> 00:36:17.390 align:middle line:84% go to 0 and 1, which is why often we don't really 00:36:17.390 --> 00:36:18.120 align:middle line:90% care about these. 00:36:18.120 --> 00:36:19.550 align:middle line:84% And you can think of them as very close to zero 00:36:19.550 --> 00:36:20.550 align:middle line:90% and very close to 1. 00:36:20.550 --> 00:36:23.973 align:middle line:84% So if it's in the language, acceptable probability almost 1. 00:36:23.973 --> 00:36:25.640 align:middle line:84% If it's not in the language, you reject. 00:36:25.640 --> 00:36:28.610 align:middle line:90% You accept probability only 0. 00:36:28.610 --> 00:36:29.930 align:middle line:90% OK? 00:36:29.930 --> 00:36:32.400 align:middle line:90% Great. 00:36:32.400 --> 00:36:38.130 align:middle line:84% Any questions about what an interactive proof is? 00:36:38.130 --> 00:36:38.630 align:middle line:90% OK. 00:36:38.630 --> 00:36:40.580 align:middle line:84% I just want to mention one thing. 00:36:40.580 --> 00:36:47.190 align:middle line:84% This notation, like PV and input x, is overloaded. 00:36:47.190 --> 00:36:50.370 align:middle line:84% We use this notation to denote the transcript. 00:36:50.370 --> 00:36:53.670 align:middle line:84% We also use this notation to denote the verdict function, 00:36:53.670 --> 00:36:55.290 align:middle line:90% whether we accept or not. 00:36:55.290 --> 00:36:58.920 align:middle line:84% And also I'll use that in class, and also wherever you read, 00:36:58.920 --> 00:37:01.050 align:middle line:90% you'll see both of them used. 00:37:01.050 --> 00:37:03.180 align:middle line:90% So it's good to get used to. 00:37:03.180 --> 00:37:05.460 align:middle line:84% So this sometimes denotes the entire transcript. 00:37:05.460 --> 00:37:08.060 align:middle line:84% Sometimes, it just denotes the acceptance or rejection 00:37:08.060 --> 00:37:10.038 align:middle line:90% bit of the verifier. 00:37:10.038 --> 00:37:11.455 align:middle line:84% And it'll be clear in the context. 00:37:11.455 --> 00:37:14.036 align:middle line:90% 00:37:14.036 --> 00:37:17.270 align:middle line:84% So now the question you should ask is, OK, 00:37:17.270 --> 00:37:23.900 align:middle line:84% is this model more expressive than NP? 00:37:23.900 --> 00:37:27.800 align:middle line:90% What can we do with this model? 00:37:27.800 --> 00:37:30.830 align:middle line:90% What's the power of this model? 00:37:30.830 --> 00:37:34.310 align:middle line:84% So let me actually go to the punchline 00:37:34.310 --> 00:37:43.580 align:middle line:84% and say there's a celebrated result by Shamir from '92, 00:37:43.580 --> 00:37:45.320 align:middle line:90% I believe. 00:37:45.320 --> 00:37:47.570 align:middle line:90% And he showed-- look. 00:37:47.570 --> 00:37:50.010 align:middle line:84% Oh, this model is very, very powerful. 00:37:50.010 --> 00:37:54.770 align:middle line:84% And actually, you can prove any P space computation 00:37:54.770 --> 00:37:55.710 align:middle line:90% in this model. 00:37:55.710 --> 00:37:59.220 align:middle line:84% Namely, if I want to prove to you any language in P space, 00:37:59.220 --> 00:38:01.340 align:middle line:84% take any language in P space, I can 00:38:01.340 --> 00:38:03.770 align:middle line:84% prove membership in this language 00:38:03.770 --> 00:38:07.850 align:middle line:84% to a verifier that only runs in polynomial time. 00:38:07.850 --> 00:38:11.330 align:middle line:84% So that's Shamir-- so P space, we believe, 00:38:11.330 --> 00:38:15.155 align:middle line:84% is much, much more expressive, stronger than NP. 00:38:15.155 --> 00:38:17.280 align:middle line:84% We actually don't know how to prove it, by the way. 00:38:17.280 --> 00:38:20.300 align:middle line:90% But we believe that's the case. 00:38:20.300 --> 00:38:26.240 align:middle line:84% So we believe this is a much stronger kind of proof system. 00:38:26.240 --> 00:38:28.610 align:middle line:84% Actually, before-- I'm going to show you-- actually now, 00:38:28.610 --> 00:38:32.210 align:middle line:84% I'm going to give you an example of the power of this proof 00:38:32.210 --> 00:38:32.850 align:middle line:90% system. 00:38:32.850 --> 00:38:36.150 align:middle line:84% But before I go into the technicality, 00:38:36.150 --> 00:38:40.730 align:middle line:84% I want to step back for a second and think 00:38:40.730 --> 00:38:42.210 align:middle line:84% a little bit about the story here, 00:38:42.210 --> 00:38:43.800 align:middle line:90% which is a very nice story. 00:38:43.800 --> 00:38:49.100 align:middle line:84% So this introduction of interactive proofs, this model 00:38:49.100 --> 00:38:52.870 align:middle line:84% came about for the goal of doing zero-knowledge. 00:38:52.870 --> 00:38:55.110 align:middle line:84% Nobody thought at that point about 00:38:55.110 --> 00:38:57.850 align:middle line:84% whether you can prove more languages, not more languages. 00:38:57.850 --> 00:39:00.130 align:middle line:84% The only thing you want is to hide. 00:39:00.130 --> 00:39:03.160 align:middle line:84% I just want to hide why a theorem is true. 00:39:03.160 --> 00:39:04.630 align:middle line:90% I want to hide the proof. 00:39:04.630 --> 00:39:06.610 align:middle line:84% I want to convince you, but hide. 00:39:06.610 --> 00:39:12.090 align:middle line:84% That was the only goal that kind of introduced this model. 00:39:12.090 --> 00:39:15.768 align:middle line:84% And it's kind of interesting how very fact. 00:39:15.768 --> 00:39:17.560 align:middle line:84% Like, also, who cares about zero knowledge? 00:39:17.560 --> 00:39:18.580 align:middle line:84% This is a really interesting model. 00:39:18.580 --> 00:39:19.955 align:middle line:84% Let's see what we can do with it. 00:39:19.955 --> 00:39:22.890 align:middle line:84% And this kind of opened our eyes, just the idea 00:39:22.890 --> 00:39:25.950 align:middle line:84% that we can shift from the traditional way of thinking 00:39:25.950 --> 00:39:30.750 align:middle line:84% about proofs to this interactive and randomized land, 00:39:30.750 --> 00:39:32.920 align:middle line:84% and brought about a lot of really, 00:39:32.920 --> 00:39:35.320 align:middle line:84% really beautiful and fascinating results. 00:39:35.320 --> 00:39:38.170 align:middle line:84% Including the fact, this is the first time that realized, wow, 00:39:38.170 --> 00:39:39.660 align:middle line:90% we can prove a lot of-- 00:39:39.660 --> 00:39:41.970 align:middle line:84% to a polynomial time verifier, much more 00:39:41.970 --> 00:39:45.780 align:middle line:90% than what was believed to be-- 00:39:45.780 --> 00:39:49.440 align:middle line:84% what we believed we can do with a classical proof. 00:39:49.440 --> 00:39:51.700 align:middle line:84% So this was kind of really, I think, 00:39:51.700 --> 00:39:56.020 align:middle line:84% eye opening and very interesting. 00:39:56.020 --> 00:40:00.090 align:middle line:84% So now I'm going to convince you-- try to convince you 00:40:00.090 --> 00:40:06.510 align:middle line:84% of why this proof system, this model 00:40:06.510 --> 00:40:11.400 align:middle line:84% is so powerful by giving you an example of things, of a problem 00:40:11.400 --> 00:40:14.430 align:middle line:84% that I can prove to you using an interactive proof 00:40:14.430 --> 00:40:18.130 align:middle line:84% that we really don't know how to prove using a classical proof. 00:40:18.130 --> 00:40:19.603 align:middle line:90% So let me give you the example. 00:40:19.603 --> 00:40:27.780 align:middle line:90% 00:40:27.780 --> 00:40:28.853 align:middle line:90% So here is the example. 00:40:28.853 --> 00:40:31.560 align:middle line:90% 00:40:31.560 --> 00:40:33.873 align:middle line:84% So the protocol is called sum-check protocol. 00:40:33.873 --> 00:40:43.530 align:middle line:90% 00:40:43.530 --> 00:40:46.270 align:middle line:84% And I'm going to give you an interactive-- 00:40:46.270 --> 00:40:49.600 align:middle line:84% this is an interactive proof for the following problem. 00:40:49.600 --> 00:40:53.940 align:middle line:90% So take any degree fix, or-- 00:40:53.940 --> 00:41:02.200 align:middle line:84% OK, given a polynomial, f, let's say, 00:41:02.200 --> 00:41:08.610 align:middle line:84% from f to the m, so a multivariate polynomial, 00:41:08.610 --> 00:41:12.830 align:middle line:90% of degree d in each variable. 00:41:12.830 --> 00:41:18.510 align:middle line:90% 00:41:18.510 --> 00:41:26.005 align:middle line:84% I want a proof that sum of f b1-- 00:41:26.005 --> 00:41:29.340 align:middle line:90% 00:41:29.340 --> 00:41:32.640 align:middle line:84% let me just make sure how I wrote it down. 00:41:32.640 --> 00:41:36.000 align:middle line:90% OK, sorry. 00:41:36.000 --> 00:41:44.550 align:middle line:84% So take any-- fix any subset H in F. 00:41:44.550 --> 00:41:48.880 align:middle line:84% You can think of H as 0, 1, you can think of a bigger set. 00:41:48.880 --> 00:41:58.336 align:middle line:84% I want you to convince me that sum f of h1 up to hm 00:41:58.336 --> 00:42:06.210 align:middle line:84% for all h1 up to hm in H is equal to some value beta. 00:42:06.210 --> 00:42:09.910 align:middle line:90% 00:42:09.910 --> 00:42:13.130 align:middle line:84% So there is a fixed polynomial f. 00:42:13.130 --> 00:42:14.625 align:middle line:84% Let's say I know this polynomial. 00:42:14.625 --> 00:42:18.280 align:middle line:84% And either it actually has a succinct circuit, 00:42:18.280 --> 00:42:20.450 align:middle line:84% or maybe I have oracle access to it. 00:42:20.450 --> 00:42:22.210 align:middle line:90% So I'm a verifier. 00:42:22.210 --> 00:42:23.830 align:middle line:90% I'm a verifier. 00:42:23.830 --> 00:42:26.240 align:middle line:84% Let's say I have oracle access to this polynomial, 00:42:26.240 --> 00:42:29.060 align:middle line:84% or there is some succinct way to compute it. 00:42:29.060 --> 00:42:31.460 align:middle line:84% So I can compute this polynomial easily. 00:42:31.460 --> 00:42:33.620 align:middle line:84% Let's think for now I have oracle access to it. 00:42:33.620 --> 00:42:36.880 align:middle line:84% So I can query it in some point, and after that, 00:42:36.880 --> 00:42:37.755 align:middle line:90% get back an answer. 00:42:37.755 --> 00:42:41.440 align:middle line:90% 00:42:41.440 --> 00:42:43.630 align:middle line:84% I want to prove you-- you're going 00:42:43.630 --> 00:42:49.510 align:middle line:84% to prove to me that the sum of this polynomial and h to the m 00:42:49.510 --> 00:42:50.050 align:middle line:90% points. 00:42:50.050 --> 00:42:52.360 align:middle line:84% On all the points, there's some set, h. 00:42:52.360 --> 00:42:53.540 align:middle line:90% You can think of h as 0, 1. 00:42:53.540 --> 00:42:54.950 align:middle line:90% You can think of it bigger. 00:42:54.950 --> 00:42:59.560 align:middle line:84% And I want you to sum this polynomial on all the elements 00:42:59.560 --> 00:43:02.560 align:middle line:90% in the set h to the m. 00:43:02.560 --> 00:43:06.430 align:middle line:84% All of this is done over some finite field, F. 00:43:06.430 --> 00:43:08.590 align:middle line:90% And there's a result, beta. 00:43:08.590 --> 00:43:10.440 align:middle line:84% I want to prove that this sum is beta. 00:43:10.440 --> 00:43:15.570 align:middle line:90% 00:43:15.570 --> 00:43:17.320 align:middle line:84% I'm going to show you an interactive proof 00:43:17.320 --> 00:43:19.130 align:middle line:90% for this language. 00:43:19.130 --> 00:43:21.613 align:middle line:84% Now, before you guys are like, seriously? 00:43:21.613 --> 00:43:23.030 align:middle line:84% Why do I care about this language? 00:43:23.030 --> 00:43:23.840 align:middle line:90% Is it interesting? 00:43:23.840 --> 00:43:25.390 align:middle line:84% Where did I come up with this thing? 00:43:25.390 --> 00:43:29.770 align:middle line:84% Let me tell you, I think this is the most important protocol 00:43:29.770 --> 00:43:32.270 align:middle line:84% in all the literature on proof systems. 00:43:32.270 --> 00:43:34.220 align:middle line:84% We all use this protocol all the time. 00:43:34.220 --> 00:43:36.890 align:middle line:84% It turns out to be super, super influential. 00:43:36.890 --> 00:43:39.100 align:middle line:84% I mean, every single thing we'll use from now 00:43:39.100 --> 00:43:41.720 align:middle line:90% on relies on this protocol. 00:43:41.720 --> 00:43:44.680 align:middle line:84% So it turns out, and I'm going to convince you that later, 00:43:44.680 --> 00:43:49.000 align:middle line:84% but that this is a very, very important, actually, problem. 00:43:49.000 --> 00:43:52.150 align:middle line:84% If you have interactive proof for this problem, 00:43:52.150 --> 00:43:54.280 align:middle line:84% it kind of gives you rise to interactive proof 00:43:54.280 --> 00:43:57.310 align:middle line:84% for many, many, many other problems. 00:43:57.310 --> 00:43:59.360 align:middle line:90% Actually, we use this. 00:43:59.360 --> 00:44:01.670 align:middle line:84% If you give me an interactive proof for this problem, 00:44:01.670 --> 00:44:04.030 align:middle line:84% I can use it to get an interactive proof for all 3D 00:44:04.030 --> 00:44:06.250 align:middle line:90% space. 00:44:06.250 --> 00:44:08.470 align:middle line:90% In kind of a black box way. 00:44:08.470 --> 00:44:12.010 align:middle line:84% So really, this is the heart of coming up 00:44:12.010 --> 00:44:13.810 align:middle line:90% with interactive proofs. 00:44:13.810 --> 00:44:16.005 align:middle line:84% This is the most important interactive proof. 00:44:16.005 --> 00:44:18.880 align:middle line:90% 00:44:18.880 --> 00:44:21.850 align:middle line:84% So with that, let me show you the interactive proof 00:44:21.850 --> 00:44:25.550 align:middle line:90% for proving this. 00:44:25.550 --> 00:44:27.740 align:middle line:90% Any questions before we jump in? 00:44:27.740 --> 00:44:28.300 align:middle line:90% Yeah? 00:44:28.300 --> 00:44:31.060 align:middle line:84% STUDENT: So just to clarify, h is like a subset of F, 00:44:31.060 --> 00:44:32.170 align:middle line:90% like one dimensional. 00:44:32.170 --> 00:44:33.567 align:middle line:90% So it's not like-- 00:44:33.567 --> 00:44:34.400 align:middle line:90% YAEL KALAI: Exactly. 00:44:34.400 --> 00:44:36.140 align:middle line:84% You can think of H as 0, 1, for example. 00:44:36.140 --> 00:44:39.320 align:middle line:84% You can think of H as 0, 1, 2, I mean, if 2 is in the field. 00:44:39.320 --> 00:44:41.360 align:middle line:84% Yeah, it's a one dimensional thing. 00:44:41.360 --> 00:44:44.330 align:middle line:90% And you sum over-- 00:44:44.330 --> 00:44:47.883 align:middle line:84% you sum here over h to the m, size of h to the m elements. 00:44:47.883 --> 00:44:51.005 align:middle line:90% 00:44:51.005 --> 00:44:53.540 align:middle line:84% STUDENT: So any of the two h's can be equal, 00:44:53.540 --> 00:44:56.568 align:middle line:84% or it doesn't have to be distinct from F? 00:44:56.568 --> 00:44:58.803 align:middle line:84% STUDENT: Wouldn't it still [INAUDIBLE]? 00:44:58.803 --> 00:44:59.720 align:middle line:90% YAEL KALAI: It can be. 00:44:59.720 --> 00:45:00.762 align:middle line:90% You sum over all of them. 00:45:00.762 --> 00:45:03.650 align:middle line:84% You sum over also like 0, 0, 0, 0, 0, 1. 00:45:03.650 --> 00:45:04.530 align:middle line:90% Yeah. 00:45:04.530 --> 00:45:06.840 align:middle line:84% Yeah, h1 and h2 do not need to be distinct at all. 00:45:06.840 --> 00:45:07.640 align:middle line:90% Yeah, exactly. 00:45:07.640 --> 00:45:09.170 align:middle line:90% Over all possible-- yeah. 00:45:09.170 --> 00:45:10.920 align:middle line:84% You sum over h to the m elements, 00:45:10.920 --> 00:45:13.620 align:middle line:84% each one over all the possibilities. 00:45:13.620 --> 00:45:15.110 align:middle line:90% Good? 00:45:15.110 --> 00:45:17.870 align:middle line:90% Other questions? 00:45:17.870 --> 00:45:18.510 align:middle line:90% Thank you. 00:45:18.510 --> 00:45:19.160 align:middle line:90% Yes? 00:45:19.160 --> 00:45:20.750 align:middle line:84% STUDENT: So degree d in each variable 00:45:20.750 --> 00:45:24.147 align:middle line:84% just means like any variable is then just exponential? 00:45:24.147 --> 00:45:24.980 align:middle line:90% YAEL KALAI: Exactly. 00:45:24.980 --> 00:45:26.330 align:middle line:90% So yeah, let me-- good. 00:45:26.330 --> 00:45:27.170 align:middle line:90% Great. 00:45:27.170 --> 00:45:29.300 align:middle line:84% So degree D in each variable means-- 00:45:29.300 --> 00:45:30.390 align:middle line:90% f is a polynomial. 00:45:30.390 --> 00:45:32.520 align:middle line:84% So you can write it as a sum of monomials. 00:45:32.520 --> 00:45:37.200 align:middle line:84% Each monomial-- each variable has a degree. 00:45:37.200 --> 00:45:40.010 align:middle line:84% So I was saying, if you look at all the monomials, 00:45:40.010 --> 00:45:44.840 align:middle line:84% each variable has a degree at most D in each of the monomials. 00:45:44.840 --> 00:45:45.630 align:middle line:90% Great questions. 00:45:45.630 --> 00:45:46.820 align:middle line:90% Thank you. 00:45:46.820 --> 00:45:48.390 align:middle line:90% Any other questions? 00:45:48.390 --> 00:45:53.450 align:middle line:90% 00:45:53.450 --> 00:45:54.240 align:middle line:90% Great. 00:45:54.240 --> 00:45:57.980 align:middle line:90% So let me give you the protocol. 00:45:57.980 --> 00:45:59.980 align:middle line:90% So let's do it. 00:45:59.980 --> 00:46:06.380 align:middle line:90% 00:46:06.380 --> 00:46:08.780 align:middle line:84% By the way, I want to tell you, I get such satisfaction 00:46:08.780 --> 00:46:10.050 align:middle line:90% from your questions. 00:46:10.050 --> 00:46:11.970 align:middle line:84% So if you just want to make me happy, 00:46:11.970 --> 00:46:15.480 align:middle line:84% which is a great goal on its own, you should ask questions. 00:46:15.480 --> 00:46:20.565 align:middle line:90% 00:46:20.565 --> 00:46:21.065 align:middle line:90% OK. 00:46:21.065 --> 00:46:31.880 align:middle line:90% 00:46:31.880 --> 00:46:33.150 align:middle line:90% Ready for the protocol? 00:46:33.150 --> 00:46:34.580 align:middle line:90% OK. 00:46:34.580 --> 00:46:43.130 align:middle line:84% Prover convinces a verifier that the sum f on h1 up to hn 00:46:43.130 --> 00:46:49.700 align:middle line:84% is equal to beta, where the h's are all elements in the set 00:46:49.700 --> 00:46:51.690 align:middle line:90% H, which is in the field. 00:46:51.690 --> 00:46:55.490 align:middle line:84% We have some fixed field that we're working over. 00:46:55.490 --> 00:46:58.080 align:middle line:84% How would he prove-- what would he do? 00:46:58.080 --> 00:46:59.340 align:middle line:90% So here is the idea. 00:46:59.340 --> 00:47:02.000 align:middle line:84% The idea is the prover will first 00:47:02.000 --> 00:47:06.450 align:middle line:90% send this sum, this polynomial. 00:47:06.450 --> 00:47:10.230 align:middle line:84% But where the first variable is open. 00:47:10.230 --> 00:47:12.350 align:middle line:90% So he will compute-- 00:47:12.350 --> 00:47:14.240 align:middle line:90% Let me get those. 00:47:14.240 --> 00:47:23.510 align:middle line:84% He will compute sum only over h2 up to hm, f of x, this 00:47:23.510 --> 00:47:27.440 align:middle line:90% is a variable, h2 up to hm. 00:47:27.440 --> 00:47:29.720 align:middle line:90% And he will send this over. 00:47:29.720 --> 00:47:34.440 align:middle line:90% Let's call this g1 of x. 00:47:34.440 --> 00:47:39.340 align:middle line:84% So he sends a univariate polynomial 00:47:39.340 --> 00:47:48.240 align:middle line:84% where he sums over h2 to hm, but leaves the first variable open. 00:47:48.240 --> 00:47:51.186 align:middle line:84% What is the degree of this polynomial? 00:47:51.186 --> 00:47:54.090 align:middle line:90% 00:47:54.090 --> 00:47:54.660 align:middle line:90% d. 00:47:54.660 --> 00:47:55.570 align:middle line:90% Very good. 00:47:55.570 --> 00:47:58.200 align:middle line:84% So this is a degree d polynomial. 00:47:58.200 --> 00:48:10.650 align:middle line:84% The verifier checks that g1 is of degree at most d. 00:48:10.650 --> 00:48:13.260 align:middle line:84% If not, he rejects, because he knows 00:48:13.260 --> 00:48:16.590 align:middle line:84% that this is a degree, d polynomial multivariate 00:48:16.590 --> 00:48:18.030 align:middle line:90% polynomial. 00:48:18.030 --> 00:48:22.380 align:middle line:84% So he knows that each variable is of degree at most d. 00:48:22.380 --> 00:48:24.300 align:middle line:84% So if the same thing it's gotta be, 00:48:24.300 --> 00:48:25.890 align:middle line:90% it's like you're cheating him. 00:48:25.890 --> 00:48:29.100 align:middle line:84% So he's going to immediately reject you. 00:48:29.100 --> 00:48:39.970 align:middle line:84% He will also check that sum g1 one of h, 00:48:39.970 --> 00:48:43.140 align:middle line:90% I guess, 1, let me call it h1. 00:48:43.140 --> 00:48:52.050 align:middle line:84% That if you take g1 and you sum it over all possible h's in H, 00:48:52.050 --> 00:48:53.530 align:middle line:90% what does he expect to get? 00:48:53.530 --> 00:48:54.970 align:middle line:90% What would he check for? 00:48:54.970 --> 00:48:55.590 align:middle line:90% STUDENT: Beta. 00:48:55.590 --> 00:48:57.090 align:middle line:90% YAEL KALAI: Exactly, beta. 00:48:57.090 --> 00:48:59.320 align:middle line:90% Because the claim is beta. 00:48:59.320 --> 00:49:03.630 align:middle line:84% So he checks that this is a degree at most d, 00:49:03.630 --> 00:49:06.890 align:middle line:84% that when you sum over h's, you get what was claimed. 00:49:06.890 --> 00:49:11.382 align:middle line:90% 00:49:11.382 --> 00:49:13.540 align:middle line:84% If this does not hold, then you reject him. 00:49:13.540 --> 00:49:14.950 align:middle line:90% You say, Bob, I reject you. 00:49:14.950 --> 00:49:16.210 align:middle line:90% I'm not going to continue. 00:49:16.210 --> 00:49:24.000 align:middle line:84% If this holds, then he chooses a random t1 in the field. 00:49:24.000 --> 00:49:26.040 align:middle line:84% This is often a notation, left arrow, 00:49:26.040 --> 00:49:28.200 align:middle line:84% that we use for choosing at random. 00:49:28.200 --> 00:49:33.210 align:middle line:84% So he uses a-- he chooses at random a random element 00:49:33.210 --> 00:49:33.970 align:middle line:90% in the field. 00:49:33.970 --> 00:49:37.380 align:middle line:90% Not in h but in the big field. 00:49:37.380 --> 00:49:39.720 align:middle line:84% You need to think of this field as being big. 00:49:39.720 --> 00:49:44.800 align:middle line:84% Well, the bigger the field, the better the soundness will get. 00:49:44.800 --> 00:49:47.015 align:middle line:84% So it chooses a random t1 in the field. 00:49:47.015 --> 00:49:50.620 align:middle line:90% 00:49:50.620 --> 00:49:51.120 align:middle line:90% Good. 00:49:51.120 --> 00:49:53.100 align:middle line:90% Then what happens? 00:49:53.100 --> 00:50:01.140 align:middle line:84% The prover-- in some sense, this reduces the problem from 00:50:01.140 --> 00:50:07.053 align:middle line:84% checking that this sum is beta to checking sum-- 00:50:07.053 --> 00:50:09.415 align:middle line:90% 00:50:09.415 --> 00:50:10.290 align:middle line:90% let me write it here. 00:50:10.290 --> 00:50:15.850 align:middle line:84% To checking that sum of ft. t is fixed. 00:50:15.850 --> 00:50:17.110 align:middle line:90% Or t1, we called it. 00:50:17.110 --> 00:50:26.160 align:middle line:84% And then h2 up to hm is this fixed, I don't know, g1 of t1. 00:50:26.160 --> 00:50:29.390 align:middle line:84% We kind of reduced the problem to this problem, 00:50:29.390 --> 00:50:33.610 align:middle line:84% which is of one dimension less because it's-- the sum is only 00:50:33.610 --> 00:50:36.860 align:middle line:90% over m minus 1 variables. 00:50:36.860 --> 00:50:38.367 align:middle line:90% Yes? 00:50:38.367 --> 00:50:40.700 align:middle line:84% STUDENT: When we see the verifiers polynomial time here. 00:50:40.700 --> 00:50:41.882 align:middle line:90% What are we polynomial in? 00:50:41.882 --> 00:50:42.590 align:middle line:90% YAEL KALAI: Good. 00:50:42.590 --> 00:50:44.480 align:middle line:84% What are we going to polynomial in? 00:50:44.480 --> 00:50:45.410 align:middle line:90% Very good question. 00:50:45.410 --> 00:50:47.710 align:middle line:84% When I said the verifiers polynomial time, 00:50:47.710 --> 00:50:49.310 align:middle line:90% polynomial in what? 00:50:49.310 --> 00:50:53.702 align:middle line:90% So he's going to be polynomial-- 00:50:53.702 --> 00:50:54.880 align:middle line:90% we think of f. 00:50:54.880 --> 00:50:57.140 align:middle line:84% I said F can be-- has oracle access to it. 00:50:57.140 --> 00:50:59.270 align:middle line:90% So polynomial and what? 00:50:59.270 --> 00:51:02.990 align:middle line:84% So we're going to analyze his runtime in a bit. 00:51:02.990 --> 00:51:07.450 align:middle line:84% But his runtime will depend polynomial on n, 00:51:07.450 --> 00:51:12.610 align:middle line:84% which is the number of variables, and on the degree. 00:51:12.610 --> 00:51:16.570 align:middle line:90% And we think of a-- 00:51:16.570 --> 00:51:19.790 align:middle line:84% today, and actually-- throughout the course, 00:51:19.790 --> 00:51:22.000 align:middle line:84% and it's common in this field, we 00:51:22.000 --> 00:51:25.810 align:middle line:84% think of f, that he can add, and multiply things 00:51:25.810 --> 00:51:27.520 align:middle line:90% in order one time. 00:51:27.520 --> 00:51:29.440 align:middle line:90% It's a constant. 00:51:29.440 --> 00:51:32.360 align:middle line:84% And typically these fields are going to take polylog. 00:51:32.360 --> 00:51:35.297 align:middle line:84% But we don't want to chase after these polylog terms. 00:51:35.297 --> 00:51:37.130 align:middle line:84% So we're not going to consider them, really. 00:51:37.130 --> 00:51:38.510 align:middle line:84% Sometimes we do, sometimes we don't. 00:51:38.510 --> 00:51:39.010 align:middle line:90% Depends. 00:51:39.010 --> 00:51:43.930 align:middle line:84% But beyond-- so if you want to be very pedantic, 00:51:43.930 --> 00:51:47.710 align:middle line:90% then you should log f here. 00:51:47.710 --> 00:51:49.510 align:middle line:90% STUDENT: Also h, maybe. 00:51:49.510 --> 00:51:51.520 align:middle line:90% YAEL KALAI: Yes, thank you. 00:51:51.520 --> 00:51:52.730 align:middle line:90% Yes, of course. 00:51:52.730 --> 00:51:54.230 align:middle line:90% Thanks, Surya. 00:51:54.230 --> 00:51:59.690 align:middle line:84% The size of h and log F. That's what's going to happen. 00:51:59.690 --> 00:52:02.410 align:middle line:84% But you write that here, the polynomial time doesn't really 00:52:02.410 --> 00:52:02.990 align:middle line:90% apply here. 00:52:02.990 --> 00:52:05.720 align:middle line:84% Because you say-- I said that he has oracle access. 00:52:05.720 --> 00:52:07.520 align:middle line:90% So what polynomial over? 00:52:07.520 --> 00:52:09.635 align:middle line:84% So this is what he's going to be after. 00:52:09.635 --> 00:52:11.510 align:middle line:84% When we're going to use him for applications, 00:52:11.510 --> 00:52:13.552 align:middle line:84% you'll see it will correspond to polynomial time. 00:52:13.552 --> 00:52:17.655 align:middle line:84% But we're going to go over this when we analyze the protocol. 00:52:17.655 --> 00:52:21.350 align:middle line:90% 00:52:21.350 --> 00:52:23.330 align:middle line:90% So let's just continue. 00:52:23.330 --> 00:52:26.030 align:middle line:90% So let me actually start it. 00:52:26.030 --> 00:52:28.490 align:middle line:84% Let me even say-- before I continue the protocol, 00:52:28.490 --> 00:52:30.940 align:middle line:84% let's continue the protocol with a high level idea of what 00:52:30.940 --> 00:52:32.150 align:middle line:90% we're trying to do here. 00:52:32.150 --> 00:52:34.360 align:middle line:90% The idea is the following. 00:52:34.360 --> 00:52:36.823 align:middle line:84% We want to catch a prover cheating. 00:52:36.823 --> 00:52:37.990 align:middle line:90% That's the goal of a prover. 00:52:37.990 --> 00:52:39.730 align:middle line:84% We want to catch you if you're cheating. 00:52:39.730 --> 00:52:43.150 align:middle line:84% So suppose a prover is cheating here. 00:52:43.150 --> 00:52:45.100 align:middle line:90% How will we catch it? 00:52:45.100 --> 00:52:47.600 align:middle line:84% The way we're going to catch it is we're going to tell them, 00:52:47.600 --> 00:52:48.910 align:middle line:90% you know what? 00:52:48.910 --> 00:52:51.100 align:middle line:90% Give me this g1. 00:52:51.100 --> 00:52:56.290 align:middle line:84% Now he cannot give me the actual true g1, 00:52:56.290 --> 00:53:00.830 align:middle line:84% because the actual true g1 will not sum up to beta. 00:53:00.830 --> 00:53:03.980 align:middle line:90% Beta is the false thing. 00:53:03.980 --> 00:53:06.970 align:middle line:90% So if a prover cheats-- 00:53:06.970 --> 00:53:09.280 align:middle line:84% I'm trying to-- let's come up with this protocol 00:53:09.280 --> 00:53:14.420 align:middle line:84% together with the goal of trying to catch the prover. 00:53:14.420 --> 00:53:17.710 align:middle line:84% So how do we catch a prover cheating? 00:53:17.710 --> 00:53:19.630 align:middle line:84% So the idea is we'll tell them, you know what? 00:53:19.630 --> 00:53:23.080 align:middle line:84% Give me this sum but with this open. 00:53:23.080 --> 00:53:26.270 align:middle line:84% I'm going to check that this something-- 00:53:26.270 --> 00:53:31.040 align:middle line:84% that the sum of g1 is equal to beta and then its low degree. 00:53:31.040 --> 00:53:35.395 align:middle line:84% If it passes, then this g1 cannot be the true, true g1. 00:53:35.395 --> 00:53:37.020 align:middle line:84% It can't actually be the real sum of f, 00:53:37.020 --> 00:53:38.820 align:middle line:84% because the real sum of f is not beta. 00:53:38.820 --> 00:53:39.680 align:middle line:90% He's cheating. 00:53:39.680 --> 00:53:42.800 align:middle line:90% So this must be a cheat. 00:53:42.800 --> 00:53:50.720 align:middle line:84% Now when we send him t1 and we consider-- 00:53:50.720 --> 00:53:52.410 align:middle line:90% so now we send him t1. 00:53:52.410 --> 00:53:57.500 align:middle line:84% And we reduce the claim to claiming this. 00:53:57.500 --> 00:54:01.370 align:middle line:84% But with very high probability, g1 is also a cheat, 00:54:01.370 --> 00:54:06.360 align:middle line:90% because g1/t1 is a cheat. 00:54:06.360 --> 00:54:10.860 align:middle line:84% So g1/t1 is not really the sum, because they're different. 00:54:10.860 --> 00:54:12.800 align:middle line:90% g1 is different than that. 00:54:12.800 --> 00:54:14.970 align:middle line:84% So we know that if they're different, 00:54:14.970 --> 00:54:18.060 align:middle line:90% they agree only on d elements. 00:54:18.060 --> 00:54:20.370 align:middle line:84% Two distinct polynomials in d elements. 00:54:20.370 --> 00:54:23.120 align:middle line:84% What's the probability that this one is one of the t? 00:54:23.120 --> 00:54:25.460 align:middle line:90% Very small, d over all f. 00:54:25.460 --> 00:54:27.870 align:middle line:84% OK, so I think of f as really large. 00:54:27.870 --> 00:54:28.370 align:middle line:90% Great. 00:54:28.370 --> 00:54:31.000 align:middle line:90% So this is also false, actually. 00:54:31.000 --> 00:54:33.000 align:middle line:84% It gave me g1, but it's actually not the real f. 00:54:33.000 --> 00:54:36.050 align:middle line:84% He's going to claim it's the real f, but I know it's not. 00:54:36.050 --> 00:54:38.330 align:middle line:84% Now I'm going to tell him-- next thing I'm going 00:54:38.330 --> 00:54:39.700 align:middle line:90% to tell him, OK, give me g2. 00:54:39.700 --> 00:54:43.160 align:middle line:90% 00:54:43.160 --> 00:54:47.720 align:middle line:90% g2 of x is sum-- 00:54:47.720 --> 00:54:50.730 align:middle line:90% it should be sum f t1. 00:54:50.730 --> 00:54:57.440 align:middle line:84% I'm going to only sum over h3 up to hm. 00:54:57.440 --> 00:55:02.216 align:middle line:84% The x2, the 2 is going to be open, and then h3 up to hm. 00:55:02.216 --> 00:55:06.840 align:middle line:90% 00:55:06.840 --> 00:55:11.030 align:middle line:84% So we started by getting rid of summing over h1. 00:55:11.030 --> 00:55:13.070 align:middle line:84% We gave him the univariate polynomial, 00:55:13.070 --> 00:55:14.880 align:middle line:90% or we chose a random t1. 00:55:14.880 --> 00:55:19.760 align:middle line:84% Now we're getting rid of summing over the second coordinate. 00:55:19.760 --> 00:55:23.790 align:middle line:84% We're asking for a univariate polynomial g2. 00:55:23.790 --> 00:55:27.170 align:middle line:90% What do we check? 00:55:27.170 --> 00:55:35.570 align:middle line:84% So the verifier checks that g2 is of degree at most d. 00:55:35.570 --> 00:55:37.780 align:middle line:90% And what else does he check? 00:55:37.780 --> 00:55:44.586 align:middle line:90% 00:55:44.586 --> 00:55:46.190 align:middle line:90% STUDENT: The [INAUDIBLE] of g1. 00:55:46.190 --> 00:55:47.160 align:middle line:90% YAEL KALAI: Very good. 00:55:47.160 --> 00:55:52.340 align:middle line:90% So sum g2 and h-- 00:55:52.340 --> 00:55:53.990 align:middle line:90% maybe I'll write h2-- 00:55:53.990 --> 00:55:57.638 align:middle line:90% is equal to what? 00:55:57.638 --> 00:55:59.510 align:middle line:90% STUDENT: g1-- g1 of t1. 00:55:59.510 --> 00:56:01.010 align:middle line:90% YAEL KALAI: Exactly. 00:56:01.010 --> 00:56:04.250 align:middle line:90% g1 of t1. 00:56:04.250 --> 00:56:09.200 align:middle line:84% So essentially, we checked this polynomial exactly 00:56:09.200 --> 00:56:10.000 align:middle line:90% as we did before. 00:56:10.000 --> 00:56:13.340 align:middle line:90% 00:56:13.340 --> 00:56:17.780 align:middle line:84% So now, note, if, in the Alice case, 00:56:17.780 --> 00:56:21.450 align:middle line:84% of course that's the case. g2, of course, is degree at most d, 00:56:21.450 --> 00:56:22.800 align:middle line:90% because f is degree at most d. 00:56:22.800 --> 00:56:29.820 align:middle line:84% And when you sum over all of h2, you should get exactly g1 and t. 00:56:29.820 --> 00:56:34.650 align:middle line:90% That's how we-- great. 00:56:34.650 --> 00:56:38.040 align:middle line:84% If this does not hold, he immediately aborts and say, 00:56:38.040 --> 00:56:39.130 align:middle line:90% I reject you. 00:56:39.130 --> 00:56:44.010 align:middle line:84% If he's happy, he's going to send a t2 at random 00:56:44.010 --> 00:56:44.945 align:middle line:90% from the field. 00:56:44.945 --> 00:56:51.810 align:middle line:90% 00:56:51.810 --> 00:56:53.440 align:middle line:90% What am I going to reply with? 00:56:53.440 --> 00:56:56.730 align:middle line:84% What should the prover reply with? 00:56:56.730 --> 00:57:01.895 align:middle line:90% So let's see. g3 of x is what? 00:57:01.895 --> 00:57:04.560 align:middle line:90% 00:57:04.560 --> 00:57:11.490 align:middle line:84% STUDENT: Sum over h4 hl plus t1 t2 and then x. 00:57:11.490 --> 00:57:13.110 align:middle line:90% YAEL KALAI: Very good. 00:57:13.110 --> 00:57:20.710 align:middle line:84% Very good. f of t1 t2 x and h4 up to hm. 00:57:20.710 --> 00:57:25.000 align:middle line:90% 00:57:25.000 --> 00:57:25.500 align:middle line:90% Yeah. 00:57:25.500 --> 00:57:27.730 align:middle line:84% Again, we take, essentially-- what happened here? 00:57:27.730 --> 00:57:30.810 align:middle line:84% We reduced-- after t2, we reduced the problem 00:57:30.810 --> 00:57:38.530 align:middle line:84% to proving a sum-check over sum f1 t1 t2 h3 up to hm. 00:57:38.530 --> 00:57:47.820 align:middle line:84% And we need to check whether this is equal to g2 of h2. 00:57:47.820 --> 00:57:48.785 align:middle line:90% Of t2, sorry. 00:57:48.785 --> 00:58:01.420 align:middle line:90% 00:58:01.420 --> 00:58:03.780 align:middle line:84% So again, each time we kind of layer-- 00:58:03.780 --> 00:58:07.360 align:middle line:84% get rid of one variable in the sum check. 00:58:07.360 --> 00:58:10.380 align:middle line:84% We start with an n variate sum check, and each round, 00:58:10.380 --> 00:58:11.645 align:middle line:90% we get rid of one variable. 00:58:11.645 --> 00:58:15.210 align:middle line:90% 00:58:15.210 --> 00:58:16.360 align:middle line:90% OK, last one. 00:58:16.360 --> 00:58:17.790 align:middle line:90% What do we check here? 00:58:17.790 --> 00:58:18.632 align:middle line:90% We got G3. 00:58:18.632 --> 00:58:19.340 align:middle line:90% What do we check? 00:58:19.340 --> 00:58:28.960 align:middle line:90% 00:58:28.960 --> 00:58:29.460 align:middle line:90% What is-- 00:58:29.460 --> 00:58:31.337 align:middle line:90% STUDENT: g3, h3 [INAUDIBLE]. 00:58:31.337 --> 00:58:32.170 align:middle line:90% YAEL KALAI: Exactly. 00:58:32.170 --> 00:58:36.900 align:middle line:84% So first, that g3 is low degree-- is degree at most d, 00:58:36.900 --> 00:58:43.320 align:middle line:90% and sum g3 is g2 t2. 00:58:43.320 --> 00:58:45.990 align:middle line:84% And we continue in this way until-- 00:58:45.990 --> 00:58:49.090 align:middle line:84% we continue, continue, continue until we got rid of everything. 00:58:49.090 --> 00:58:52.110 align:middle line:84% So in the last around-- what will happen in the last round? 00:58:52.110 --> 00:59:04.630 align:middle line:84% In the last round, we will send gm minus 1 gm of gmx, 00:59:04.630 --> 00:59:10.020 align:middle line:84% which is f of t1 up to tm minus 1x. 00:59:10.020 --> 00:59:13.380 align:middle line:90% 00:59:13.380 --> 00:59:14.790 align:middle line:90% That's what he should check. 00:59:14.790 --> 00:59:16.030 align:middle line:90% That's what he should send. 00:59:16.030 --> 00:59:17.655 align:middle line:84% If you're honest, that's what you send. 00:59:17.655 --> 00:59:19.330 align:middle line:90% You peel off everything. 00:59:19.330 --> 00:59:27.330 align:middle line:84% Finally, you're left with gm, which is f, and t minus 1x. 00:59:27.330 --> 00:59:29.350 align:middle line:90% And then the verifier is done. 00:59:29.350 --> 00:59:34.560 align:middle line:84% He'll choose a random tm and he will check whether this 00:59:34.560 --> 00:59:37.030 align:middle line:90% is indeed f of t1 up to tm. 00:59:37.030 --> 00:59:39.480 align:middle line:84% We assumed he has oracle access so we can check 00:59:39.480 --> 00:59:42.330 align:middle line:90% if this value is t1 up to tm. 00:59:42.330 --> 00:59:45.780 align:middle line:84% So finally, this is this, and verifier-- 00:59:45.780 --> 00:59:48.750 align:middle line:84% I'm out of room, but maybe I'll write it here. 00:59:48.750 --> 01:00:03.720 align:middle line:84% V chooses a random tm and checks that gm of tm 01:00:03.720 --> 01:00:05.290 align:middle line:90% is equal to the oracle. 01:00:05.290 --> 01:00:08.410 align:middle line:90% He has f on t1 up to tf. 01:00:08.410 --> 01:00:12.292 align:middle line:90% 01:00:12.292 --> 01:00:13.125 align:middle line:90% That's the protocol. 01:00:13.125 --> 01:00:22.472 align:middle line:90% 01:00:22.472 --> 01:00:24.430 align:middle line:84% I'll give you a minute to appreciate the beauty 01:00:24.430 --> 01:00:25.530 align:middle line:90% while I erase the board. 01:00:25.530 --> 01:00:31.390 align:middle line:90% 01:00:31.390 --> 01:00:32.890 align:middle line:84% STUDENT: Do you have a different set 01:00:32.890 --> 01:00:34.190 align:middle line:90% for each variable than just-- 01:00:34.190 --> 01:00:36.440 align:middle line:84% YAEL KALAI: You're asking, can I have a different set? 01:00:36.440 --> 01:00:36.615 align:middle line:90% STUDENT: Yeah. 01:00:36.615 --> 01:00:38.290 align:middle line:84% YAEL KALAI: I can have a different set, yes. 01:00:38.290 --> 01:00:38.870 align:middle line:90% Yeah. 01:00:38.870 --> 01:00:42.127 align:middle line:84% So the question was, do the h's have to be identical? 01:00:42.127 --> 01:00:44.210 align:middle line:84% And the answer is they don't have to be identical. 01:00:44.210 --> 01:00:45.700 align:middle line:90% You can take a-- 01:00:45.700 --> 01:00:47.060 align:middle line:90% we didn't use that anywhere. 01:00:47.060 --> 01:00:49.310 align:middle line:90% And yeah. 01:00:49.310 --> 01:00:49.810 align:middle line:90% Yeah. 01:00:49.810 --> 01:00:51.950 align:middle line:84% Somehow, we always use it when it is. 01:00:51.950 --> 01:00:57.340 align:middle line:90% 01:00:57.340 --> 01:00:59.860 align:middle line:84% But that's a very good point, because it's 01:00:59.860 --> 01:01:01.130 align:middle line:90% like-- it seems more general. 01:01:01.130 --> 01:01:03.930 align:middle line:84% It seems like it can be useful, but somehow we don't use it. 01:01:03.930 --> 01:01:07.870 align:middle line:90% 01:01:07.870 --> 01:01:09.470 align:middle line:90% But that's a very good point. 01:01:09.470 --> 01:01:12.080 align:middle line:84% Yeah, you can-- the H does not have to be the same h. 01:01:12.080 --> 01:01:15.970 align:middle line:84% It can be the sum over h1 up to hm. 01:01:15.970 --> 01:01:19.155 align:middle line:84% STUDENT: So in particular, h could be equal to f, right? 01:01:19.155 --> 01:01:19.780 align:middle line:90% YAEL KALAI: OK. 01:01:19.780 --> 01:01:23.030 align:middle line:90% h could be equal to f. 01:01:23.030 --> 01:01:24.600 align:middle line:90% Yes, h could be equal to f. 01:01:24.600 --> 01:01:29.200 align:middle line:90% 01:01:29.200 --> 01:01:31.470 align:middle line:84% STUDENT: How do you do the summation over-- 01:01:31.470 --> 01:01:33.460 align:middle line:90% in g1 up to h1? 01:01:33.460 --> 01:01:34.480 align:middle line:90% STUDENT: Sorry? 01:01:34.480 --> 01:01:37.098 align:middle line:84% STUDENT: The first line, the summation over g1 of h1. 01:01:37.098 --> 01:01:39.140 align:middle line:84% STUDENT: You will take time proportional to that. 01:01:39.140 --> 01:01:39.430 align:middle line:90% YAEL KALAI: Yeah. 01:01:39.430 --> 01:01:41.005 align:middle line:84% STUDENT: But let's say that's OK. 01:01:41.005 --> 01:01:42.315 align:middle line:84% STUDENT: I think your soundness goes away also. 01:01:42.315 --> 01:01:43.107 align:middle line:90% STUDENT: Say again? 01:01:43.107 --> 01:01:44.680 align:middle line:84% STUDENT: Your soundness goes away? 01:01:44.680 --> 01:01:45.670 align:middle line:90% YAEL KALAI: Yeah. 01:01:45.670 --> 01:01:49.120 align:middle line:84% We'll talk about soundness in a minute. 01:01:49.120 --> 01:01:57.640 align:middle line:84% Actually, if f is degree d, the soundness won't decay. 01:01:57.640 --> 01:01:59.470 align:middle line:90% I think-- actually, A-- 01:01:59.470 --> 01:02:01.720 align:middle line:84% let's talk about soundness and then we'll see. 01:02:01.720 --> 01:02:04.120 align:middle line:90% Actually, the soundness won't-- 01:02:04.120 --> 01:02:07.090 align:middle line:84% in general, usually when h is big, 01:02:07.090 --> 01:02:11.300 align:middle line:84% in applications, what happens often is when you take big h, 01:02:11.300 --> 01:02:14.990 align:middle line:84% the f turns out to be degree h, or h minus 1. 01:02:14.990 --> 01:02:17.300 align:middle line:90% So when we use this protocol-- 01:02:17.300 --> 01:02:19.378 align:middle line:90% so as I said, this problem. 01:02:19.378 --> 01:02:21.170 align:middle line:84% You say, what do I care about this problem? 01:02:21.170 --> 01:02:22.460 align:middle line:90% Who cares about this problem? 01:02:22.460 --> 01:02:24.650 align:middle line:90% So it turns out we care a lot. 01:02:24.650 --> 01:02:25.850 align:middle line:90% It comes up all the time. 01:02:25.850 --> 01:02:27.860 align:middle line:90% The way we use it in-- 01:02:27.860 --> 01:02:31.960 align:middle line:84% like, the way it comes up is the f that we use usually 01:02:31.960 --> 01:02:34.700 align:middle line:84% is of degree h minus 1 in each variable. 01:02:34.700 --> 01:02:38.710 align:middle line:84% We use it in a way that turns out to be the degree of f. 01:02:38.710 --> 01:02:41.180 align:middle line:84% And the soundness decays with a degree. 01:02:41.180 --> 01:02:43.618 align:middle line:84% So if the h is big, the soundness-- 01:02:43.618 --> 01:02:45.410 align:middle line:84% if the degree is big, the soundness is big. 01:02:45.410 --> 01:02:48.980 align:middle line:84% But actually, if you're promised that the degree is small, 01:02:48.980 --> 01:02:49.880 align:middle line:90% then we're good. 01:02:49.880 --> 01:02:52.000 align:middle line:90% We'll analyze it right now. 01:02:52.000 --> 01:02:52.638 align:middle line:90% Yeah? 01:02:52.638 --> 01:02:54.430 align:middle line:84% STUDENT: Can you say something about what's 01:02:54.430 --> 01:02:56.230 align:middle line:84% so special about polynomials here? 01:02:56.230 --> 01:02:58.870 align:middle line:84% I see that they only agree on the coordinates, 01:02:58.870 --> 01:03:00.440 align:middle line:84% and you can do the summation thing. 01:03:00.440 --> 01:03:02.180 align:middle line:84% But is there something more general happening? 01:03:02.180 --> 01:03:02.847 align:middle line:90% YAEL KALAI: Yes. 01:03:02.847 --> 01:03:03.530 align:middle line:90% Yes. 01:03:03.530 --> 01:03:04.730 align:middle line:90% Great question. 01:03:04.730 --> 01:03:05.600 align:middle line:90% Love the question. 01:03:05.600 --> 01:03:09.930 align:middle line:84% So what's so fascinating about polynomials that comes up here? 01:03:09.930 --> 01:03:12.840 align:middle line:90% So why is this so interesting? 01:03:12.840 --> 01:03:17.370 align:middle line:84% Why is polynomials so important that this comes up everywhere? 01:03:17.370 --> 01:03:21.890 align:middle line:84% So here's my take on this question. 01:03:21.890 --> 01:03:23.860 align:middle line:90% Everything can be-- 01:03:23.860 --> 01:03:24.360 align:middle line:90% OK. 01:03:24.360 --> 01:03:26.510 align:middle line:84% First of all, polynomials are tough. 01:03:26.510 --> 01:03:30.800 align:middle line:84% They're very, very useful because of their power 01:03:30.800 --> 01:03:31.980 align:middle line:90% of error correction. 01:03:31.980 --> 01:03:35.990 align:middle line:84% So in other words, what happens, if you cheated once, 01:03:35.990 --> 01:03:37.710 align:middle line:84% we're going to amplify your cheat. 01:03:37.710 --> 01:03:39.300 align:middle line:90% That's kind of what we do here. 01:03:39.300 --> 01:03:41.240 align:middle line:84% You cheating once, we're going to-- 01:03:41.240 --> 01:03:47.300 align:middle line:84% for a random point, t, if you're low degree, then-- 01:03:47.300 --> 01:03:48.800 align:middle line:84% we're assuming that this prover gets 01:03:48.800 --> 01:03:50.700 align:middle line:84% kind of low degree, low degree, low degree all the time. 01:03:50.700 --> 01:03:52.158 align:middle line:84% If you give low degree, low degree, 01:03:52.158 --> 01:03:54.530 align:middle line:84% low degree and you cheated, then the cheat 01:03:54.530 --> 01:03:57.450 align:middle line:84% must correspond to a cheat at a random point. 01:03:57.450 --> 01:04:00.210 align:middle line:84% Like at the end, a random point t1 to tm, 01:04:00.210 --> 01:04:01.350 align:middle line:90% you should be different. 01:04:01.350 --> 01:04:03.512 align:middle line:90% And we'll analyze this. 01:04:03.512 --> 01:04:04.470 align:middle line:90% This is just intuition. 01:04:04.470 --> 01:04:06.345 align:middle line:84% But that's kind of the beauty of polynomials, 01:04:06.345 --> 01:04:09.150 align:middle line:84% that if you're wrong, you're wrong almost everywhere. 01:04:09.150 --> 01:04:11.580 align:middle line:84% Because if it's not the correct polynomial, 01:04:11.580 --> 01:04:13.550 align:middle line:84% then it's different from the correct polynomial 01:04:13.550 --> 01:04:14.580 align:middle line:90% almost everywhere. 01:04:14.580 --> 01:04:17.690 align:middle line:84% That's the Schwartz-Zippel lemma for the multivariate case. 01:04:17.690 --> 01:04:19.490 align:middle line:84% For the single variate case, it's just 01:04:19.490 --> 01:04:21.510 align:middle line:84% a Lagrange interpolation, I guess it's called. 01:04:21.510 --> 01:04:22.880 align:middle line:90% But OK. 01:04:22.880 --> 01:04:25.320 align:middle line:84% Now you're saying, OK, but that's just polynomial. 01:04:25.320 --> 01:04:28.485 align:middle line:84% Why am I saying it-- what's so special about polynomials? 01:04:28.485 --> 01:04:29.485 align:middle line:90% Why are they so general? 01:04:29.485 --> 01:04:29.985 align:middle line:90% OK. 01:04:29.985 --> 01:04:32.340 align:middle line:84% If you happen to have a polynomial, good for you. 01:04:32.340 --> 01:04:35.670 align:middle line:84% You won, because it has such error correcting guarantees, 01:04:35.670 --> 01:04:36.607 align:middle line:90% you're lucky. 01:04:36.607 --> 01:04:37.440 align:middle line:90% It's your lucky day. 01:04:37.440 --> 01:04:39.620 align:middle line:84% But what if it's like-- why is every day a lucky day 01:04:39.620 --> 01:04:40.203 align:middle line:90% kind of thing? 01:04:40.203 --> 01:04:43.070 align:middle line:84% Why does this polynomial come up everywhere? 01:04:43.070 --> 01:04:45.710 align:middle line:84% And the answer is that you can actually 01:04:45.710 --> 01:04:49.920 align:middle line:84% embed many, many problems into polynomials. 01:04:49.920 --> 01:04:51.440 align:middle line:90% So there's a way-- 01:04:51.440 --> 01:04:54.480 align:middle line:84% there's a technique, which we'll call low degree extension. 01:04:54.480 --> 01:04:56.040 align:middle line:90% We'll see that pretty soon. 01:04:56.040 --> 01:04:58.220 align:middle line:84% If not today, then tomorrow-- then next week, 01:04:58.220 --> 01:05:05.750 align:middle line:84% where you can convert many problems into polynomials 01:05:05.750 --> 01:05:07.470 align:middle line:90% and then use the sum-check. 01:05:07.470 --> 01:05:08.880 align:middle line:90% So that's often what we do. 01:05:08.880 --> 01:05:12.090 align:middle line:84% We take a problem, we embed it into a polynomial. 01:05:12.090 --> 01:05:15.120 align:middle line:84% We kind extend it to look like a polynomial of low degree. 01:05:15.120 --> 01:05:16.970 align:middle line:90% And then we use sum-check to it. 01:05:16.970 --> 01:05:18.580 align:middle line:90% So that's how we will come up. 01:05:18.580 --> 01:05:21.260 align:middle line:90% 01:05:21.260 --> 01:05:28.070 align:middle line:84% Any more questions before we analyze the subject protocol? 01:05:28.070 --> 01:05:31.180 align:middle line:84% Questions on the protocol itself, or? 01:05:31.180 --> 01:05:34.490 align:middle line:90% 01:05:34.490 --> 01:05:35.510 align:middle line:90% Yeah? 01:05:35.510 --> 01:05:36.470 align:middle line:84% STUDENT: So sorry, just to follow up. 01:05:36.470 --> 01:05:38.012 align:middle line:84% So is there some version of sum-check 01:05:38.012 --> 01:05:41.370 align:middle line:84% you can run on some generic error correcting codes, 01:05:41.370 --> 01:05:43.040 align:middle line:84% or do you need not only the error 01:05:43.040 --> 01:05:45.410 align:middle line:84% correcting properties of polynomials, but also 01:05:45.410 --> 01:05:47.015 align:middle line:90% their average structures. 01:05:47.015 --> 01:05:47.640 align:middle line:90% YAEL KALAI: Oh. 01:05:47.640 --> 01:05:49.098 align:middle line:84% You're asking-- what you're asking, 01:05:49.098 --> 01:05:52.370 align:middle line:84% you're saying this sum-check, do I really need 01:05:52.370 --> 01:05:55.520 align:middle line:84% this specific kind of polynomial code or can 01:05:55.520 --> 01:05:57.600 align:middle line:84% I do it using arbitrary codes kind of thing. 01:05:57.600 --> 01:06:00.170 align:middle line:84% So actually, this is a great, great question. 01:06:00.170 --> 01:06:04.810 align:middle line:84% There is a paper by [INAUDIBLE] from several years ago, 01:06:04.810 --> 01:06:06.570 align:middle line:84% I don't remember exactly, where he 01:06:06.570 --> 01:06:12.010 align:middle line:84% shows how to do a sum-check over more general codes. 01:06:12.010 --> 01:06:15.070 align:middle line:84% Not any kind of code, but more general than that. 01:06:15.070 --> 01:06:16.550 align:middle line:90% Things like tensor codes, or-- 01:06:16.550 --> 01:06:17.550 align:middle line:90% Rachel, do you remember? 01:06:17.550 --> 01:06:18.402 align:middle line:90% You looked into it. 01:06:18.402 --> 01:06:19.860 align:middle line:84% STUDENT: Yeah, he did tensor codes. 01:06:19.860 --> 01:06:20.940 align:middle line:90% YAEL KALAI: Tensor codes. 01:06:20.940 --> 01:06:22.086 align:middle line:84% STUDENT: Oh, he did multiplication property 01:06:22.086 --> 01:06:22.470 align:middle line:90% [INAUDIBLE]. 01:06:22.470 --> 01:06:23.178 align:middle line:90% YAEL KALAI: Yeah. 01:06:23.178 --> 01:06:25.350 align:middle line:84% So he generalized it, not to any code, 01:06:25.350 --> 01:06:27.600 align:middle line:84% but he gave a generalization of the sum-check protocol 01:06:27.600 --> 01:06:30.960 align:middle line:84% to work for a larger family of codes. 01:06:30.960 --> 01:06:33.420 align:middle line:84% STUDENT: But when we're trying to parse the question, 01:06:33.420 --> 01:06:35.670 align:middle line:84% what does it mean for the subject protocol 01:06:35.670 --> 01:06:37.870 align:middle line:84% to work for a more general approach? 01:06:37.870 --> 01:06:38.495 align:middle line:90% YAEL KALAI: OK. 01:06:38.495 --> 01:06:39.203 align:middle line:90% Good, good, good. 01:06:39.203 --> 01:06:43.110 align:middle line:84% So you can think of it as I'm proving something about-- 01:06:43.110 --> 01:06:45.430 align:middle line:84% I don't remember exactly how his formalization was, 01:06:45.430 --> 01:06:50.130 align:middle line:84% but it's like I'm proving something about a code word, 01:06:50.130 --> 01:06:52.290 align:middle line:90% and I want kind of-- 01:06:52.290 --> 01:06:53.800 align:middle line:84% STUDENT: Sort of reinterpret this. 01:06:53.800 --> 01:06:55.470 align:middle line:84% YAEL KALAI: You can reinterpret this, 01:06:55.470 --> 01:06:59.430 align:middle line:84% because you can think of this f as being an error correcting 01:06:59.430 --> 01:07:00.150 align:middle line:90% code. 01:07:00.150 --> 01:07:03.940 align:middle line:84% So does it work only for this kind of Reed-Muller? 01:07:03.940 --> 01:07:05.260 align:middle line:90% This is called the Reed-Muller. 01:07:05.260 --> 01:07:06.677 align:middle line:84% Does it work only for Reed-Muller? 01:07:06.677 --> 01:07:08.700 align:middle line:84% Can you do it for arbitrary codes? 01:07:08.700 --> 01:07:10.810 align:middle line:84% And it proves it for arbitrary codes. 01:07:10.810 --> 01:07:13.420 align:middle line:90% So this is kind of-- 01:07:13.420 --> 01:07:15.760 align:middle line:84% any polynomial is an error-correcting code. 01:07:15.760 --> 01:07:17.520 align:middle line:84% It's a type of error-correcting code. 01:07:17.520 --> 01:07:19.660 align:middle line:84% For a multivariate case, it's called Reed-Muller. 01:07:19.660 --> 01:07:21.910 align:middle line:84% For univariate case, it's called Reed-Solomon. 01:07:21.910 --> 01:07:25.337 align:middle line:84% And so the sum-check protocol for-- 01:07:25.337 --> 01:07:27.670 align:middle line:84% you can think of it as a protocol for Reed-Muller codes. 01:07:27.670 --> 01:07:30.490 align:middle line:84% And then you can ask, is there a analog for other codes? 01:07:30.490 --> 01:07:32.950 align:middle line:84% And actually, there are analogs out there. 01:07:32.950 --> 01:07:33.450 align:middle line:90% Yeah. 01:07:33.450 --> 01:07:36.460 align:middle line:90% 01:07:36.460 --> 01:07:37.630 align:middle line:90% Any other questions? 01:07:37.630 --> 01:07:38.400 align:middle line:90% Yeah? 01:07:38.400 --> 01:07:39.050 align:middle line:90% STUDENT: Yeah. 01:07:39.050 --> 01:07:42.827 align:middle line:84% [INAUDIBLE] like making the size page the same as the side of-- 01:07:42.827 --> 01:07:43.410 align:middle line:90% YAEL KALAI: F. 01:07:43.410 --> 01:07:48.030 align:middle line:84% STUDENT: If I hear correctly, in that case, 01:07:48.030 --> 01:07:50.220 align:middle line:84% wouldn't there be no point of doing 01:07:50.220 --> 01:07:54.660 align:middle line:84% this, because it's only of size of h and log f. 01:07:54.660 --> 01:07:55.960 align:middle line:90% YAEL KALAI: OK, you're right. 01:07:55.960 --> 01:07:56.560 align:middle line:90% You're right. 01:07:56.560 --> 01:07:59.140 align:middle line:90% So if-- let me go back. 01:07:59.140 --> 01:08:01.780 align:middle line:84% So the question is, what should this h be? 01:08:01.780 --> 01:08:02.980 align:middle line:90% What is this h? 01:08:02.980 --> 01:08:05.890 align:middle line:84% And the answer is this h can actually be all of f. 01:08:05.890 --> 01:08:07.950 align:middle line:84% Of course, if it's all of f, the verifier 01:08:07.950 --> 01:08:09.990 align:middle line:84% runs in time, which is like the size of f, 01:08:09.990 --> 01:08:12.823 align:middle line:90% because he checks sum over h. 01:08:12.823 --> 01:08:14.490 align:middle line:84% If it's all of f, he runs them all of f. 01:08:14.490 --> 01:08:16.149 align:middle line:90% But maybe f it's not that big. 01:08:16.149 --> 01:08:17.680 align:middle line:90% Maybe f is polynomial. 01:08:17.680 --> 01:08:22.950 align:middle line:84% Even if f is polynomial size, still, checking this sum 01:08:22.950 --> 01:08:24.279 align:middle line:90% is much bigger than f. 01:08:24.279 --> 01:08:27.910 align:middle line:84% It's like h to the n, like f to the n, and it can be big. 01:08:27.910 --> 01:08:32.609 align:middle line:84% So the hardness does not come only from f, it comes from m. 01:08:32.609 --> 01:08:33.569 align:middle line:90% It's exponential in m. 01:08:33.569 --> 01:08:36.520 align:middle line:84% It's the m that kind of makes it very hard. 01:08:36.520 --> 01:08:40.090 align:middle line:84% And so h can be as large as the entire field. 01:08:40.090 --> 01:08:43.272 align:middle line:84% And you can run some check over that, too. 01:08:43.272 --> 01:08:44.830 align:middle line:84% It's still an interesting protocol. 01:08:44.830 --> 01:08:45.444 align:middle line:90% Yeah? 01:08:45.444 --> 01:08:47.069 align:middle line:84% STUDENT: But if we do that, wouldn't we 01:08:47.069 --> 01:08:50.340 align:middle line:84% need to do this as an extension of f or something to get the-- 01:08:50.340 --> 01:08:51.120 align:middle line:90% YAEL KALAI: Good. 01:08:51.120 --> 01:08:52.060 align:middle line:90% OK. 01:08:52.060 --> 01:08:52.560 align:middle line:90% Good. 01:08:52.560 --> 01:08:54.010 align:middle line:90% So the question is, wait. 01:08:54.010 --> 01:08:57.310 align:middle line:84% Do we get any error-correcting guarantees here, because-- 01:08:57.310 --> 01:08:58.880 align:middle line:90% if we're doing over all of f. 01:08:58.880 --> 01:09:02.050 align:middle line:84% And I think the answer is yes, we do need to extend it further. 01:09:02.050 --> 01:09:05.479 align:middle line:84% Because as we'll see now when we analyze it, 01:09:05.479 --> 01:09:10.120 align:middle line:84% the soundness error goes down with something like d over f. h 01:09:10.120 --> 01:09:12.920 align:middle line:84% does not come into play there, but we'll see that. 01:09:12.920 --> 01:09:14.618 align:middle line:90% Let's see that together. 01:09:14.618 --> 01:09:15.160 align:middle line:90% You're right. 01:09:15.160 --> 01:09:17.560 align:middle line:84% I agree when you say that, yeah, that should, right? 01:09:17.560 --> 01:09:18.939 align:middle line:90% Things should degrade with age. 01:09:18.939 --> 01:09:20.090 align:middle line:90% But actually, they don't. 01:09:20.090 --> 01:09:23.120 align:middle line:84% So we'll see that now when we analyze it. 01:09:23.120 --> 01:09:26.845 align:middle line:90% 01:09:26.845 --> 01:09:28.220 align:middle line:84% These are great, great questions. 01:09:28.220 --> 01:09:28.970 align:middle line:90% So thank you. 01:09:28.970 --> 01:09:33.069 align:middle line:84% Any other questions before we go to the analysis? 01:09:33.069 --> 01:09:33.770 align:middle line:90% OK. 01:09:33.770 --> 01:09:35.380 align:middle line:84% So actually, before we do soundness, 01:09:35.380 --> 01:09:37.370 align:middle line:84% let's just first do a sanity check 01:09:37.370 --> 01:09:42.020 align:middle line:84% on the communication complexity, and the runtime, and so on. 01:09:42.020 --> 01:09:43.899 align:middle line:90% So first, let's see this. 01:09:43.899 --> 01:09:46.850 align:middle line:90% Protocol has m rounds. 01:09:46.850 --> 01:09:50.930 align:middle line:84% Each round, we get rid of one sum in the sum-check. 01:09:50.930 --> 01:10:04.900 align:middle line:84% So the-- so the communication complexity, our round complexity 01:10:04.900 --> 01:10:06.217 align:middle line:90% is m rounds. 01:10:06.217 --> 01:10:08.800 align:middle line:84% m back and forth. m, 2m, I don't know if you want to call each 01:10:08.800 --> 01:10:10.490 align:middle line:90% one a round is 1, 2. 01:10:10.490 --> 01:10:14.620 align:middle line:90% So let me just say order m. 01:10:14.620 --> 01:10:25.570 align:middle line:84% The communication complexity is what? 01:10:25.570 --> 01:10:31.250 align:middle line:84% So each time one polynomial is sent and one field element. 01:10:31.250 --> 01:10:34.460 align:middle line:84% So it's really-- a polynomial is a degree, d. 01:10:34.460 --> 01:10:40.660 align:middle line:84% So it's just d field elements each time times m. 01:10:40.660 --> 01:10:41.590 align:middle line:90% So fine. 01:10:41.590 --> 01:10:45.170 align:middle line:84% We can do times log f, if you want to. 01:10:45.170 --> 01:10:50.170 align:middle line:90% 01:10:50.170 --> 01:10:52.840 align:middle line:84% So that's the communication complexity. 01:10:52.840 --> 01:10:54.705 align:middle line:90% What about the verifier runtime? 01:10:54.705 --> 01:10:58.750 align:middle line:90% 01:10:58.750 --> 01:11:02.740 align:middle line:84% So the verifier, he gets a polynomial-- degree 01:11:02.740 --> 01:11:03.590 align:middle line:90% d polynomial. 01:11:03.590 --> 01:11:07.280 align:middle line:84% So d essentially field elements, of d plus 1 field elements. 01:11:07.280 --> 01:11:08.790 align:middle line:90% And he just sums them up. 01:11:08.790 --> 01:11:10.790 align:middle line:84% He checks that it's a degree d and sums them up. 01:11:10.790 --> 01:11:11.690 align:middle line:90% That's all he does. 01:11:11.690 --> 01:11:15.820 align:middle line:84% So it's really essentially the same. 01:11:15.820 --> 01:11:19.270 align:middle line:84% For m rounds, he has a degree d polynomial. 01:11:19.270 --> 01:11:20.680 align:middle line:90% And he sums them-- 01:11:20.680 --> 01:11:24.610 align:middle line:84% I should put here maybe probably log them, because the sum-- 01:11:24.610 --> 01:11:27.640 align:middle line:84% I'm assuming addition will take polylog f. 01:11:27.640 --> 01:11:31.450 align:middle line:84% Again, as I said, often, I think maybe even in the notes, 01:11:31.450 --> 01:11:34.760 align:middle line:84% just in Taylor's notes, this is admitted. 01:11:34.760 --> 01:11:37.307 align:middle line:84% It's like, the field thinks of it as one operation. 01:11:37.307 --> 01:11:38.140 align:middle line:90% So just so you know. 01:11:38.140 --> 01:11:41.620 align:middle line:84% If you read things, often you won't see this part. 01:11:41.620 --> 01:11:42.160 align:middle line:90% Question? 01:11:42.160 --> 01:11:44.950 align:middle line:84% STUDENT: The verifier of them, like, h, that's [INAUDIBLE] 01:11:44.950 --> 01:11:47.510 align:middle line:84% YAEL KALAI: The verifier also needs to choose the t you said? 01:11:47.510 --> 01:11:48.010 align:middle line:90% STUDENT: No. 01:11:48.010 --> 01:11:50.007 align:middle line:90% Like, you'll see the sum over h. 01:11:50.007 --> 01:11:51.090 align:middle line:90% YAEL KALAI: Yeah, exactly. 01:11:51.090 --> 01:11:52.747 align:middle line:84% So sum over h is like h additions. 01:11:52.747 --> 01:11:53.330 align:middle line:90% STUDENT: Yeah. 01:11:53.330 --> 01:11:54.510 align:middle line:90% YAEL KALAI: OK. 01:11:54.510 --> 01:11:55.070 align:middle line:90% Yeah. 01:11:55.070 --> 01:11:55.830 align:middle line:90% Oh, sorry. 01:11:55.830 --> 01:11:56.330 align:middle line:90% Yeah. 01:11:56.330 --> 01:11:57.600 align:middle line:90% So OK. 01:11:57.600 --> 01:11:58.760 align:middle line:90% Good. 01:11:58.760 --> 01:12:01.430 align:middle line:84% You're saying he needs to compute-- 01:12:01.430 --> 01:12:03.000 align:middle line:90% it's still-- yeah. 01:12:03.000 --> 01:12:05.940 align:middle line:84% So the verifier, he gets a polynomial. 01:12:05.940 --> 01:12:10.500 align:middle line:84% He needs to evaluate the polynomial in h. 01:12:10.500 --> 01:12:11.430 align:middle line:90% So yeah. 01:12:11.430 --> 01:12:14.880 align:middle line:84% So for m rounds, he gets a degree d polynomial. 01:12:14.880 --> 01:12:19.670 align:middle line:90% He needs to evaluate it. 01:12:19.670 --> 01:12:20.210 align:middle line:90% Oh. 01:12:20.210 --> 01:12:23.570 align:middle line:90% Sorry, this does not have h. 01:12:23.570 --> 01:12:24.110 align:middle line:90% Yeah. 01:12:24.110 --> 01:12:30.470 align:middle line:84% He needs to evaluate it in H points, the degree d polynomial, 01:12:30.470 --> 01:12:37.100 align:middle line:90% and then a log F. Thanks. 01:12:37.100 --> 01:12:37.600 align:middle line:90% Good. 01:12:37.600 --> 01:12:44.540 align:middle line:90% 01:12:44.540 --> 01:12:45.390 align:middle line:90% Thanks a lot. 01:12:45.390 --> 01:12:46.580 align:middle line:90% Good catch. 01:12:46.580 --> 01:12:47.750 align:middle line:90% That's awesome. 01:12:47.750 --> 01:12:49.740 align:middle line:90% OK, great. 01:12:49.740 --> 01:12:50.910 align:middle line:90% So that's the verifier. 01:12:50.910 --> 01:12:52.890 align:middle line:84% As I said, the prover, we care less about. 01:12:52.890 --> 01:12:55.700 align:middle line:90% But just-- if you want to just-- 01:12:55.700 --> 01:12:59.340 align:middle line:84% and by the way, this is assuming the verifier has access to f. 01:12:59.340 --> 01:13:01.910 align:middle line:84% He knows f. f is kind of-- he has oracle access to it. 01:13:01.910 --> 01:13:05.550 align:middle line:84% Because, of course, then he needs to check equality with f. 01:13:05.550 --> 01:13:08.250 align:middle line:84% So this, we just assume he has oracle access to f. 01:13:08.250 --> 01:13:10.297 align:middle line:84% And then the prover, what does he need to do? 01:13:10.297 --> 01:13:11.880 align:middle line:84% Well, he needs to do this computation. 01:13:11.880 --> 01:13:15.150 align:middle line:84% So he runs in time like h to the f. 01:13:15.150 --> 01:13:16.490 align:middle line:90% He needs to do all the sum. 01:13:16.490 --> 01:13:17.970 align:middle line:90% He needs to run-- 01:13:17.970 --> 01:13:19.560 align:middle line:90% so the polynomial. 01:13:19.560 --> 01:13:23.960 align:middle line:84% So let's call it T sub f is the time to run-- 01:13:23.960 --> 01:13:24.990 align:middle line:90% to compute f. 01:13:24.990 --> 01:13:26.690 align:middle line:90% So he needs to compute f. 01:13:26.690 --> 01:13:30.620 align:middle line:84% He needs to do the sum over all f's and he does 01:13:30.620 --> 01:13:34.637 align:middle line:90% that kind of m times, right? 01:13:34.637 --> 01:13:35.470 align:middle line:90% Something like this. 01:13:35.470 --> 01:13:40.955 align:middle line:90% 01:13:40.955 --> 01:13:44.600 align:middle line:90% M polylog H-- polylog F, sorry. 01:13:44.600 --> 01:13:50.000 align:middle line:90% 01:13:50.000 --> 01:13:52.430 align:middle line:90% Yeah. 01:13:52.430 --> 01:13:56.160 align:middle line:90% So that's the prover's time. 01:13:56.160 --> 01:13:56.660 align:middle line:90% OK. 01:13:56.660 --> 01:13:59.570 align:middle line:90% 01:13:59.570 --> 01:14:01.130 align:middle line:90% Yes? 01:14:01.130 --> 01:14:04.250 align:middle line:84% STUDENT: Doesn't the fact that it required us [INAUDIBLE], 01:14:04.250 --> 01:14:07.570 align:middle line:84% as [INAUDIBLE] of using a prover? 01:14:07.570 --> 01:14:08.360 align:middle line:90% YAEL KALAI: No. 01:14:08.360 --> 01:14:09.630 align:middle line:90% Good, good, good, good. 01:14:09.630 --> 01:14:10.350 align:middle line:90% Great question. 01:14:10.350 --> 01:14:11.040 align:middle line:90% No. 01:14:11.040 --> 01:14:11.540 align:middle line:90% OK. 01:14:11.540 --> 01:14:15.110 align:middle line:84% So even if V has random oracle access to F, 01:14:15.110 --> 01:14:17.340 align:middle line:84% he can compute this entire thing, 01:14:17.340 --> 01:14:20.240 align:middle line:84% but it will take him time, H to the m, because he 01:14:20.240 --> 01:14:21.740 align:middle line:90% needs to compute the sum. 01:14:21.740 --> 01:14:24.440 align:middle line:84% So the goal-- he needs to check-- 01:14:24.440 --> 01:14:26.690 align:middle line:84% so let's say computing F once, it takes him long time. 01:14:26.690 --> 01:14:28.020 align:middle line:90% He can ask. 01:14:28.020 --> 01:14:34.200 align:middle line:84% But to check the sum, he needs to ask this H to the m question. 01:14:34.200 --> 01:14:36.770 align:middle line:90% Now think of H to the m as huge. 01:14:36.770 --> 01:14:41.910 align:middle line:84% Even if h is 2, think of m as being big. m is n variables. 01:14:41.910 --> 01:14:43.320 align:middle line:90% So it's like exponential. 01:14:43.320 --> 01:14:44.630 align:middle line:90% That's it. 01:14:44.630 --> 01:14:46.983 align:middle line:90% Great question. 01:14:46.983 --> 01:14:48.900 align:middle line:84% STUDENT: But should I think of the description 01:14:48.900 --> 01:14:51.162 align:middle line:90% of f as polynomial, or? 01:14:51.162 --> 01:14:51.870 align:middle line:90% YAEL KALAI: Good. 01:14:51.870 --> 01:14:53.290 align:middle line:84% So you can-- there's two options. 01:14:53.290 --> 01:14:56.110 align:middle line:84% You can think of the description of f as being polynomial. 01:14:56.110 --> 01:14:57.037 align:middle line:90% That's one option. 01:14:57.037 --> 01:14:58.120 align:middle line:90% Or that you can compute f. 01:14:58.120 --> 01:15:00.280 align:middle line:84% And it's like described by a polynomial size circuit. 01:15:00.280 --> 01:15:01.680 align:middle line:84% Or you can think it can be large, 01:15:01.680 --> 01:15:03.480 align:middle line:84% but the verifier has access to it. 01:15:03.480 --> 01:15:05.730 align:middle line:84% Somehow, the verifier has a trusted oracle 01:15:05.730 --> 01:15:07.830 align:middle line:90% that computes F for him. 01:15:07.830 --> 01:15:09.480 align:middle line:90% OK? 01:15:09.480 --> 01:15:11.500 align:middle line:90% Great. 01:15:11.500 --> 01:15:14.770 align:middle line:90% So now the-- yes? 01:15:14.770 --> 01:15:16.140 align:middle line:90% STUDENT: The break from t sub f. 01:15:16.140 --> 01:15:16.470 align:middle line:90% YAEL KALAI: Good. 01:15:16.470 --> 01:15:16.840 align:middle line:90% Yeah. 01:15:16.840 --> 01:15:17.715 align:middle line:90% This is just-- sorry. 01:15:17.715 --> 01:15:25.740 align:middle line:84% This is just the time it takes to compute F. Thanks. 01:15:25.740 --> 01:15:26.283 align:middle line:90% Yeah. 01:15:26.283 --> 01:15:27.450 align:middle line:90% Because he needs to compute. 01:15:27.450 --> 01:15:29.370 align:middle line:84% The prover supposedly doesn't have-- he needs 01:15:29.370 --> 01:15:32.730 align:middle line:90% to actually do the computation. 01:15:32.730 --> 01:15:34.020 align:middle line:90% OK, great. 01:15:34.020 --> 01:15:35.810 align:middle line:90% Yes? 01:15:35.810 --> 01:15:36.810 align:middle line:90% STUDENT: Where in that-- 01:15:36.810 --> 01:15:42.833 align:middle line:84% I do not see take into account the prover finding g sub 1 of x? 01:15:42.833 --> 01:15:44.250 align:middle line:84% Don't they have to combine a bunch 01:15:44.250 --> 01:15:46.535 align:middle line:90% of terms in that order of d? 01:15:46.535 --> 01:15:47.410 align:middle line:90% YAEL KALAI: Oh, yeah. 01:15:47.410 --> 01:15:49.710 align:middle line:90% But he runs in time F anyway. 01:15:49.710 --> 01:15:51.900 align:middle line:90% F is much bigger than d. 01:15:51.900 --> 01:15:55.890 align:middle line:84% So the degree is also always much smaller than f. 01:15:55.890 --> 01:15:59.190 align:middle line:90% So I'm kind of lumping it in. 01:15:59.190 --> 01:16:00.330 align:middle line:90% Yeah. 01:16:00.330 --> 01:16:00.945 align:middle line:90% Thanks. 01:16:00.945 --> 01:16:01.570 align:middle line:90% Great question. 01:16:01.570 --> 01:16:02.400 align:middle line:90% Yeah? 01:16:02.400 --> 01:16:04.080 align:middle line:84% STUDENT: So if I want to really foster 01:16:04.080 --> 01:16:06.660 align:middle line:84% [INAUDIBLE] like a multiplicative subgroup 01:16:06.660 --> 01:16:10.710 align:middle line:84% or something for h so I can evaluate a polynomial faster, 01:16:10.710 --> 01:16:12.630 align:middle line:90% can I do something else to it? 01:16:12.630 --> 01:16:15.210 align:middle line:84% YAEL KALAI: Again, you're saying if-- you want to be-- 01:16:15.210 --> 01:16:16.890 align:middle line:84% you're saying, let's say the verifier 01:16:16.890 --> 01:16:19.090 align:middle line:84% wants to be even more efficient than this. 01:16:19.090 --> 01:16:20.230 align:middle line:90% Then what can he do? 01:16:20.230 --> 01:16:22.870 align:middle line:84% STUDENT: Can I choose H to be a special structure? 01:16:22.870 --> 01:16:23.500 align:middle line:90% YAEL KALAI: OK. 01:16:23.500 --> 01:16:25.410 align:middle line:90% But you're changing the problem. 01:16:25.410 --> 01:16:26.610 align:middle line:90% What you're saying is-- 01:16:26.610 --> 01:16:29.620 align:middle line:84% so the problem is H is given to us and you want to prove. 01:16:29.620 --> 01:16:32.920 align:middle line:84% Now you're saying maybe if H has a special structure, 01:16:32.920 --> 01:16:35.620 align:middle line:84% maybe we can be even more efficient is what you're saying. 01:16:35.620 --> 01:16:39.960 align:middle line:90% A good question. 01:16:39.960 --> 01:16:42.013 align:middle line:90% I haven't thought about it. 01:16:42.013 --> 01:16:43.180 align:middle line:90% STUDENT: I think [INAUDIBLE] 01:16:43.180 --> 01:16:44.710 align:middle line:84% YAEL KALAI: Yeah, you can probably-- 01:16:44.710 --> 01:16:45.850 align:middle line:90% yeah. 01:16:45.850 --> 01:16:46.430 align:middle line:90% Yeah. 01:16:46.430 --> 01:16:49.000 align:middle line:84% Probably you can-- so Vinod was saying 01:16:49.000 --> 01:16:51.520 align:middle line:84% you can probably batch things, or probably-- yeah. 01:16:51.520 --> 01:16:53.470 align:middle line:90% I think if you can choose H-- 01:16:53.470 --> 01:16:56.780 align:middle line:84% if H is of a certain structure, then I think you can do better. 01:16:56.780 --> 01:16:58.150 align:middle line:90% But this is kind of-- 01:16:58.150 --> 01:16:59.740 align:middle line:90% the verifier doesn't choose it. 01:16:59.740 --> 01:17:00.880 align:middle line:90% That's what's given to him. 01:17:00.880 --> 01:17:01.380 align:middle line:90% Great. 01:17:01.380 --> 01:17:02.060 align:middle line:90% OK, great. 01:17:02.060 --> 01:17:05.270 align:middle line:90% 01:17:05.270 --> 01:17:10.270 align:middle line:90% Any more questions? 01:17:10.270 --> 01:17:11.710 align:middle line:90% Yeah? 01:17:11.710 --> 01:17:15.220 align:middle line:84% STUDENT: So why would an oracle [INAUDIBLE]? 01:17:15.220 --> 01:17:18.460 align:middle line:84% Is it the size of all these [INAUDIBLE]? 01:17:18.460 --> 01:17:19.310 align:middle line:90% YAEL KALAI: Oh, OK. 01:17:19.310 --> 01:17:22.520 align:middle line:84% It's degree d, but it's m variables. 01:17:22.520 --> 01:17:25.630 align:middle line:84% So in general, degree d polynomial with m variables 01:17:25.630 --> 01:17:29.300 align:middle line:84% can have size like m to the d, which can be very big. 01:17:29.300 --> 01:17:30.430 align:middle line:90% Great question. 01:17:30.430 --> 01:17:32.075 align:middle line:90% d to the m, sorry. 01:17:32.075 --> 01:17:32.700 align:middle line:90% Great question. 01:17:32.700 --> 01:17:36.760 align:middle line:90% 01:17:36.760 --> 01:17:37.310 align:middle line:90% OK. 01:17:37.310 --> 01:17:39.790 align:middle line:84% So let's go to completeness and soundness then. 01:17:39.790 --> 01:17:43.820 align:middle line:84% So what is the completeness of this protocol? 01:17:43.820 --> 01:17:46.690 align:middle line:84% Let's say the prover is on it, the statement is correct. 01:17:46.690 --> 01:17:49.520 align:middle line:84% What probability will the verifier accept? 01:17:49.520 --> 01:17:50.440 align:middle line:90% STUDENT: 1. 01:17:50.440 --> 01:17:51.400 align:middle line:90% YAEL KALAI: 1, exactly. 01:17:51.400 --> 01:17:53.210 align:middle line:90% Because you'll just be honest. 01:17:53.210 --> 01:17:54.640 align:middle line:84% You'll always give the correct polynomial, always 01:17:54.640 --> 01:17:56.600 align:middle line:84% the low degree, will always sum to what it should be. 01:17:56.600 --> 01:17:58.142 align:middle line:84% And you're always going to accept it. 01:17:58.142 --> 01:17:59.345 align:middle line:90% That's easy. 01:17:59.345 --> 01:18:00.470 align:middle line:90% The hard part is soundness. 01:18:00.470 --> 01:18:01.700 align:middle line:90% So let's do the soundness. 01:18:01.700 --> 01:18:03.617 align:middle line:84% And then, after soundness, we'll take a break. 01:18:03.617 --> 01:18:09.970 align:middle line:90% 01:18:09.970 --> 01:18:14.530 align:middle line:84% So for soundness, here's the idea. 01:18:14.530 --> 01:18:16.880 align:middle line:90% So let's look at a-- 01:18:16.880 --> 01:18:20.110 align:middle line:84% suppose there's a cheating prover that 01:18:20.110 --> 01:18:21.410 align:middle line:90% generates a false claim. 01:18:21.410 --> 01:18:28.035 align:middle line:84% So suppose that the claim is false. 01:18:28.035 --> 01:18:32.260 align:middle line:90% 01:18:32.260 --> 01:18:38.000 align:middle line:84% Namely this sum of f is actually not great. 01:18:38.000 --> 01:18:43.780 align:middle line:90% 01:18:43.780 --> 01:18:46.000 align:middle line:84% OK, so we start with the false claim. 01:18:46.000 --> 01:18:49.300 align:middle line:84% The first thing we know is that-- 01:18:49.300 --> 01:18:53.180 align:middle line:84% so fix any-- so you fix a claim that's false. 01:18:53.180 --> 01:18:56.500 align:middle line:90% Fix any P star. 01:18:56.500 --> 01:18:57.830 align:middle line:90% He tries to cheat. 01:18:57.830 --> 01:19:00.910 align:middle line:90% Let's show that he fails. 01:19:00.910 --> 01:19:01.780 align:middle line:90% He won't succeed. 01:19:01.780 --> 01:19:03.655 align:middle line:84% Or he succeeds with a very small probability, 01:19:03.655 --> 01:19:05.000 align:middle line:90% if the field is large enough. 01:19:05.000 --> 01:19:07.670 align:middle line:90% So let's see. 01:19:07.670 --> 01:19:10.790 align:middle line:84% The first thing I want to point out, which I mentioned before, 01:19:10.790 --> 01:19:14.890 align:middle line:90% is g1 must be false. 01:19:14.890 --> 01:19:17.330 align:middle line:84% So it must be the case, no matter how we cheat. 01:19:17.330 --> 01:19:19.810 align:middle line:90% And it gives me a bad g1. 01:19:19.810 --> 01:19:24.830 align:middle line:84% It cannot-- if he's accepted, if the prover is accepted, 01:19:24.830 --> 01:19:30.430 align:middle line:90% then g1 cannot be sum of-- 01:19:30.430 --> 01:19:37.960 align:middle line:84% let me call g1 x is not some of f h2 up to hm, 01:19:37.960 --> 01:19:40.580 align:middle line:84% because I'm going to check that it's equal to beta. 01:19:40.580 --> 01:19:42.910 align:middle line:90% But the sum of f is not beta. 01:19:42.910 --> 01:19:47.050 align:middle line:84% So the g that he gives me cannot be the correct f, 01:19:47.050 --> 01:19:48.080 align:middle line:90% like the correct g. 01:19:48.080 --> 01:19:51.770 align:middle line:90% 01:19:51.770 --> 01:19:54.530 align:middle line:84% So in other words, he starts the protocol by a cheat. 01:19:54.530 --> 01:19:58.760 align:middle line:84% I mean, the first message is not the correct polynomial. 01:19:58.760 --> 01:20:00.700 align:middle line:84% Because the correct polynomial, if you sum it, 01:20:00.700 --> 01:20:07.846 align:middle line:84% you'll get the real beta, not the fake beta that he claimed. 01:20:07.846 --> 01:20:11.980 align:middle line:84% However, at the end of the day, if you're accepted, 01:20:11.980 --> 01:20:15.160 align:middle line:84% the final check, when you check-- then 01:20:15.160 --> 01:20:19.940 align:middle line:84% you check with respect to the honest f and that verifies. 01:20:19.940 --> 01:20:21.940 align:middle line:84% So at the end of the day, when you look at it 01:20:21.940 --> 01:20:25.750 align:middle line:84% with g to the-- like last one, gm to the tm, 01:20:25.750 --> 01:20:28.240 align:middle line:90% that's actually honest. 01:20:28.240 --> 01:20:35.590 align:middle line:84% So somewhere in the protocol, you had to move from a bad g 01:20:35.590 --> 01:20:38.980 align:middle line:90% to good g. 01:20:38.980 --> 01:20:42.370 align:middle line:90% So again, here's the claim. 01:20:42.370 --> 01:20:45.130 align:middle line:84% So I want to argue if-- so I want 01:20:45.130 --> 01:20:49.280 align:middle line:84% to argue there must exist a round such that-- a round, 01:20:49.280 --> 01:20:50.180 align:middle line:90% let's say i. 01:20:50.180 --> 01:21:01.840 align:middle line:84% So to prove-- to cheat, there must exist a round i such 01:21:01.840 --> 01:21:06.710 align:middle line:90% that gi is false. 01:21:06.710 --> 01:21:18.290 align:middle line:84% So gi is not sum of t1, ti minus xhi plus 1 up to hm. 01:21:18.290 --> 01:21:21.150 align:middle line:84% This is what it should be, but it's not. 01:21:21.150 --> 01:21:25.810 align:middle line:90% 01:21:25.810 --> 01:21:34.310 align:middle line:84% And yet at some point-- but gi plus 1 is actually equal 01:21:34.310 --> 01:21:37.010 align:middle line:90% to-- oh, I forgot the f. 01:21:37.010 --> 01:21:42.273 align:middle line:84% Is actually equal to sum f t1 up to ti. 01:21:42.273 --> 01:21:50.330 align:middle line:90% 01:21:50.330 --> 01:21:53.700 align:middle line:90% So to cheat, you must go-- 01:21:53.700 --> 01:21:59.850 align:middle line:84% so you start with-- you start with an incorrect polynomial. 01:21:59.850 --> 01:22:01.610 align:middle line:84% We know that's for sure, because you-- 01:22:01.610 --> 01:22:03.150 align:middle line:90% assuming you're accepted. 01:22:03.150 --> 01:22:05.810 align:middle line:90% If you're accepted, g1 is false. 01:22:05.810 --> 01:22:08.935 align:middle line:84% Now either now g2 is true, and then 01:22:08.935 --> 01:22:11.060 align:middle line:84% I'll show that happens with very small probability, 01:22:11.060 --> 01:22:12.480 align:middle line:90% or g2 is also false. 01:22:12.480 --> 01:22:15.990 align:middle line:84% If g2 is false, either g3 is true, 01:22:15.990 --> 01:22:18.590 align:middle line:84% I'm going to show that happens with very small probability, 01:22:18.590 --> 01:22:20.240 align:middle line:90% or g3 is false. 01:22:20.240 --> 01:22:25.320 align:middle line:84% Until we're left with GM, which, again, let's say it's still-- 01:22:25.320 --> 01:22:27.810 align:middle line:84% I'm going to argue that if gm minus 1 was false, 01:22:27.810 --> 01:22:30.000 align:middle line:84% gm is also false with very high probability. 01:22:30.000 --> 01:22:33.440 align:middle line:84% But if gm is false, you're not going 01:22:33.440 --> 01:22:39.840 align:middle line:84% to be-- if gm is actually not f, then for random t, 01:22:39.840 --> 01:22:42.950 align:middle line:84% the probability that you'll get f is very, very-- you'll be 01:22:42.950 --> 01:22:44.540 align:middle line:84% consistent with f is very, very small, 01:22:44.540 --> 01:22:47.030 align:middle line:84% because these are two different polynomials. 01:22:47.030 --> 01:22:49.288 align:middle line:90% And they agree only in d points. 01:22:49.288 --> 01:22:51.830 align:middle line:84% So what's the probability that he chose one of these d's, one 01:22:51.830 --> 01:22:55.040 align:middle line:90% of these points, d over f? 01:22:55.040 --> 01:22:57.290 align:middle line:84% So let me be a little more formal now. 01:22:57.290 --> 01:23:00.090 align:middle line:90% 01:23:00.090 --> 01:23:02.330 align:middle line:90% So I want to argue that-- 01:23:02.330 --> 01:23:04.050 align:middle line:90% first, let argue that-- 01:23:04.050 --> 01:23:08.000 align:middle line:84% so first, to cheat, there must exist some round 01:23:08.000 --> 01:23:10.880 align:middle line:90% where we go from false to true. 01:23:10.880 --> 01:23:14.600 align:middle line:84% Because the final, final check must be true. 01:23:14.600 --> 01:23:17.220 align:middle line:84% Otherwise, I'm going to check you with a true. 01:23:17.220 --> 01:23:20.820 align:middle line:84% So there must exist a round that you go from false to true. 01:23:20.820 --> 01:23:22.430 align:middle line:84% Let's say, what's the probability 01:23:22.430 --> 01:23:23.905 align:middle line:90% of going from false to true? 01:23:23.905 --> 01:23:27.330 align:middle line:90% 01:23:27.330 --> 01:23:27.830 align:middle line:90% Good. 01:23:27.830 --> 01:23:29.430 align:middle line:90% So what's the probability? 01:23:29.430 --> 01:23:33.440 align:middle line:90% So let's denote this event-- 01:23:33.440 --> 01:23:36.830 align:middle line:90% let's denote this event by Bi. 01:23:36.830 --> 01:23:38.450 align:middle line:84% Now let's see what's the probability 01:23:38.450 --> 01:23:40.460 align:middle line:90% that this event happened. 01:23:40.460 --> 01:23:42.920 align:middle line:84% This is kind of a bad event, an event 01:23:42.920 --> 01:23:46.640 align:middle line:84% that you go from an incorrect-- a false to true. 01:23:46.640 --> 01:23:48.740 align:middle line:84% For the verifier, it's a very bad event, 01:23:48.740 --> 01:23:50.570 align:middle line:84% because then he accepts a false statement. 01:23:50.570 --> 01:23:54.510 align:middle line:84% What is the probability that this bad event happens? 01:23:54.510 --> 01:24:01.203 align:middle line:84% So the probability of Bi, I want to argue, is at most. 01:24:01.203 --> 01:24:04.910 align:middle line:90% 01:24:04.910 --> 01:24:10.250 align:middle line:90% d over F. Let's see why. 01:24:10.250 --> 01:24:13.500 align:middle line:90% So when is it-- let's see. 01:24:13.500 --> 01:24:15.230 align:middle line:90% When is gi plus 1 true? 01:24:15.230 --> 01:24:20.060 align:middle line:84% We're sending here-- the probability, let's fix-- 01:24:20.060 --> 01:24:22.050 align:middle line:90% we fixed our t1 up to ti plus 1. 01:24:22.050 --> 01:24:23.090 align:middle line:90% That's fixed. 01:24:23.090 --> 01:24:24.710 align:middle line:90% So fixed. 01:24:24.710 --> 01:24:28.913 align:middle line:84% And I don't care how. t1 up to t minus 1, this defines. 01:24:28.913 --> 01:24:33.060 align:middle line:90% 01:24:33.060 --> 01:24:36.640 align:middle line:84% what the prover gives gi in the protocol. 01:24:36.640 --> 01:24:38.390 align:middle line:84% The cheating prover gives in the protocol. 01:24:38.390 --> 01:24:41.970 align:middle line:90% 01:24:41.970 --> 01:24:46.520 align:middle line:84% Now the verifier chooses a random t, a random-- 01:24:46.520 --> 01:24:47.020 align:middle line:90% good. 01:24:47.020 --> 01:24:50.360 align:middle line:90% So this defines gi, which is-- 01:24:50.360 --> 01:24:50.860 align:middle line:90% OK. 01:24:50.860 --> 01:24:51.443 align:middle line:90% This is my gi. 01:24:51.443 --> 01:24:56.250 align:middle line:84% Now the prover, the verifier, the probability over ti 01:24:56.250 --> 01:25:04.150 align:middle line:84% that the verifier chooses, this ti tells you if gi-- 01:25:04.150 --> 01:25:05.400 align:middle line:90% this defines gi plus. 01:25:05.400 --> 01:25:06.960 align:middle line:90% 1. 01:25:06.960 --> 01:25:11.520 align:middle line:84% But what is-- what do we know about when-- 01:25:11.520 --> 01:25:19.290 align:middle line:84% if we know that, because the verifier is accepted, 01:25:19.290 --> 01:25:31.710 align:middle line:84% we know that sum gi plus 1 of h is equal to gi, 01:25:31.710 --> 01:25:33.400 align:middle line:90% which is the wrong polynomial. 01:25:33.400 --> 01:25:42.540 align:middle line:90% 01:25:42.540 --> 01:25:43.480 align:middle line:90% Sorry, and ti. 01:25:43.480 --> 01:25:46.500 align:middle line:90% 01:25:46.500 --> 01:25:48.420 align:middle line:84% And this is the wrong polynomial. 01:25:48.420 --> 01:25:52.230 align:middle line:84% So what is the probability that for-- so in other words, 01:25:52.230 --> 01:25:55.620 align:middle line:84% gi plus 1 is the wrong polynomial. 01:25:55.620 --> 01:25:58.350 align:middle line:84% What is the probability that for a random t, 01:25:58.350 --> 01:26:01.740 align:middle line:90% it will be the right one? 01:26:01.740 --> 01:26:02.600 align:middle line:90% d over f. 01:26:02.600 --> 01:26:06.270 align:middle line:90% 01:26:06.270 --> 01:26:09.130 align:middle line:84% Because two polynomials that are different agree on, 01:26:09.130 --> 01:26:10.090 align:middle line:90% at most, d points. 01:26:10.090 --> 01:26:11.500 align:middle line:90% I choose a random point. 01:26:11.500 --> 01:26:15.480 align:middle line:84% The probability that it's one of d's is the d over f. 01:26:15.480 --> 01:26:17.555 align:middle line:84% So what is the probability that you cheat? 01:26:17.555 --> 01:26:24.330 align:middle line:90% 01:26:24.330 --> 01:26:30.270 align:middle line:84% This is the probability that there exists some i such 01:26:30.270 --> 01:26:31.320 align:middle line:90% that Bi holds. 01:26:31.320 --> 01:26:32.303 align:middle line:90% A bad event holds. 01:26:32.303 --> 01:26:33.720 align:middle line:84% Namely, there exists an i that you 01:26:33.720 --> 01:26:39.030 align:middle line:84% go from true-- from false to true on that i. 01:26:39.030 --> 01:26:46.200 align:middle line:84% By the union bound, this is, at most, m number of rounds times 01:26:46.200 --> 01:26:49.890 align:middle line:84% the probability of one-- of a specific Bi bad event, which 01:26:49.890 --> 01:26:58.620 align:middle line:84% is d over F. So just note h actually doesn't come up 01:26:58.620 --> 01:26:59.590 align:middle line:90% in the soundness. 01:26:59.590 --> 01:27:00.850 align:middle line:90% This is the soundness. 01:27:00.850 --> 01:27:03.720 align:middle line:90% 01:27:03.720 --> 01:27:09.990 align:middle line:84% So the soundness needs m times d to be significantly 01:27:09.990 --> 01:27:12.870 align:middle line:90% smaller than the field size. 01:27:12.870 --> 01:27:16.350 align:middle line:84% That's all that's important for soundness. 01:27:16.350 --> 01:27:16.860 align:middle line:90% Yeah? 01:27:16.860 --> 01:27:18.818 align:middle line:84% STUDENT: So is the point that you can pick a dh 01:27:18.818 --> 01:27:20.027 align:middle line:90% that you actually care about. 01:27:20.027 --> 01:27:21.690 align:middle line:84% And then you have some potential with F 01:27:21.690 --> 01:27:23.890 align:middle line:84% and then this will be a really big field for [INAUDIBLE]. 01:27:23.890 --> 01:27:24.620 align:middle line:90% YAEL KALAI: Exactly. 01:27:24.620 --> 01:27:25.120 align:middle line:90% Exactly. 01:27:25.120 --> 01:27:27.020 align:middle line:84% The point is, if you're not happy, 01:27:27.020 --> 01:27:29.770 align:middle line:84% if F is not large enough, if it's not much bigger than m 01:27:29.770 --> 01:27:33.200 align:middle line:84% to the m times d, then you just make it bigger. 01:27:33.200 --> 01:27:34.450 align:middle line:90% You can take extension fields. 01:27:34.450 --> 01:27:36.550 align:middle line:84% You can take-- so you just kind of artificially 01:27:36.550 --> 01:27:39.770 align:middle line:84% increase F so that F will be much larger than m times d. 01:27:39.770 --> 01:27:43.530 align:middle line:84% And hence, you'll get a small soundness here. 01:27:43.530 --> 01:27:44.650 align:middle line:90% STUDENT: [INAUDIBLE]. 01:27:44.650 --> 01:27:45.080 align:middle line:90% YAEL KALAI: Yeah. 01:27:45.080 --> 01:27:46.913 align:middle line:84% STUDENT: So the applications, looking ahead, 01:27:46.913 --> 01:27:49.760 align:middle line:84% what happens is you're given h, right? 01:27:49.760 --> 01:27:54.080 align:middle line:84% And the degree happens to be h, as it here, or h minus 1. 01:27:54.080 --> 01:27:56.680 align:middle line:84% And that's why it doesn't make sense for h and F 01:27:56.680 --> 01:27:57.470 align:middle line:90% to be the same. 01:27:57.470 --> 01:27:58.690 align:middle line:90% But you can-- 01:27:58.690 --> 01:27:59.523 align:middle line:90% YAEL KALAI: Exactly. 01:27:59.523 --> 01:28:00.982 align:middle line:84% STUDENT: You can disentangle these. 01:28:00.982 --> 01:28:01.700 align:middle line:90% YAEL KALAI: 100%. 01:28:01.700 --> 01:28:06.855 align:middle line:84% So let me repeat it because I'm recorded, you're not. 01:28:06.855 --> 01:28:08.480 align:middle line:84% Yeah, because that's a very good point. 01:28:08.480 --> 01:28:11.960 align:middle line:84% The point is for sum-check in general, 01:28:11.960 --> 01:28:13.870 align:middle line:84% it makes sense to consider any h. 01:28:13.870 --> 01:28:16.390 align:middle line:84% Even h, which is of size F, is interesting 01:28:16.390 --> 01:28:18.260 align:middle line:90% for the sum-check protocol. 01:28:18.260 --> 01:28:21.280 align:middle line:84% In application, because-- as long as the d 01:28:21.280 --> 01:28:22.720 align:middle line:90% is small, of course. 01:28:22.720 --> 01:28:25.630 align:middle line:84% In applications, often, it turns out 01:28:25.630 --> 01:28:28.070 align:middle line:84% that the-- when we use the sum-check, 01:28:28.070 --> 01:28:33.880 align:middle line:84% it turns out that the d is often equal to the size of h. 01:28:33.880 --> 01:28:36.220 align:middle line:84% Because we do this low-degree extension, which 01:28:36.220 --> 01:28:39.400 align:middle line:90% makes the field as large as h. 01:28:39.400 --> 01:28:45.350 align:middle line:84% And then if we take h, which becomes the degree to be f, 01:28:45.350 --> 01:28:48.610 align:middle line:90% this is meaningless. 01:28:48.610 --> 01:28:53.030 align:middle line:84% So for application, often, indeed, h is small. 01:28:53.030 --> 01:28:55.307 align:middle line:84% But for the sum-check protocol on its own, 01:28:55.307 --> 01:28:56.890 align:middle line:84% you can take h to be the entire field. 01:28:56.890 --> 01:28:57.880 align:middle line:90% Yes? 01:28:57.880 --> 01:29:00.610 align:middle line:84% STUDENT: Is it true that any finite field, it's 01:29:00.610 --> 01:29:02.752 align:middle line:84% easy to just put in another bigger kind of field? 01:29:02.752 --> 01:29:03.460 align:middle line:90% YAEL KALAI: Yeah. 01:29:03.460 --> 01:29:04.335 align:middle line:90% OK, good, good, good. 01:29:04.335 --> 01:29:05.480 align:middle line:90% Yes, exactly. 01:29:05.480 --> 01:29:05.980 align:middle line:90% Yeah. 01:29:05.980 --> 01:29:09.920 align:middle line:84% So there's-- you can take-- so this is a fact from mathematics. 01:29:09.920 --> 01:29:13.600 align:middle line:84% You can take any finite field and embed it 01:29:13.600 --> 01:29:15.530 align:middle line:90% into a bigger finite field. 01:29:15.530 --> 01:29:17.375 align:middle line:84% And how big is the bigger finite field? 01:29:17.375 --> 01:29:18.500 align:middle line:90% Kind of as big as you want. 01:29:18.500 --> 01:29:20.120 align:middle line:90% So you can take any-- 01:29:20.120 --> 01:29:22.540 align:middle line:84% loosely speaking, you can take any f 01:29:22.540 --> 01:29:26.920 align:middle line:84% and embed it into a field f to the n. 01:29:26.920 --> 01:29:28.640 align:middle line:84% And you can take n as big as you want. 01:29:28.640 --> 01:29:30.010 align:middle line:90% So you can kind of-- 01:29:30.010 --> 01:29:33.280 align:middle line:84% that's what's called an extension field. 01:29:33.280 --> 01:29:36.220 align:middle line:84% So you can extend it to as large a size 01:29:36.220 --> 01:29:41.180 align:middle line:84% as you want, while still keeping F as a subfield. 01:29:41.180 --> 01:29:43.930 align:middle line:84% So operations in F kind of behave exactly as they 01:29:43.930 --> 01:29:44.510 align:middle line:90% did before. 01:29:44.510 --> 01:29:48.360 align:middle line:84% So without ruining this sum or anything like that. 01:29:48.360 --> 01:29:48.860 align:middle line:90% Yeah? 01:29:48.860 --> 01:29:50.350 align:middle line:84% STUDENT: These are not the same [INAUDIBLE], right? 01:29:50.350 --> 01:29:53.017 align:middle line:84% Is it really the case that there is actually a cheating strategy 01:29:53.017 --> 01:29:54.267 align:middle line:90% that succeeds whether or not-- 01:29:54.267 --> 01:29:55.140 align:middle line:90% YAEL KALAI: Yes. 01:29:55.140 --> 01:29:55.640 align:middle line:90% Yeah. 01:29:55.640 --> 01:29:56.420 align:middle line:90% This is good. 01:29:56.420 --> 01:29:57.860 align:middle line:90% This analysis is really tight. 01:29:57.860 --> 01:30:02.330 align:middle line:84% So I mean, if I'm malicious, I can always hope for the best. 01:30:02.330 --> 01:30:04.370 align:middle line:84% If it happens to be I'm malicious, 01:30:04.370 --> 01:30:06.110 align:middle line:84% I gave you the wrong polynomial, look, 01:30:06.110 --> 01:30:08.830 align:middle line:84% you may find-- so I want to go from the wrong polynomial 01:30:08.830 --> 01:30:09.800 align:middle line:90% to the true polynomial. 01:30:09.800 --> 01:30:11.360 align:middle line:90% That's what-- to cheat, right? 01:30:11.360 --> 01:30:12.460 align:middle line:90% That's what I want to do. 01:30:12.460 --> 01:30:15.970 align:middle line:84% Now the my wrongful polynomial and the true polynomial, 01:30:15.970 --> 01:30:17.540 align:middle line:84% they agree, actually, on d points. 01:30:17.540 --> 01:30:20.240 align:middle line:84% Any two polynomials can agree on d points. 01:30:20.240 --> 01:30:23.610 align:middle line:90% So as long as the verifier-- 01:30:23.610 --> 01:30:26.580 align:middle line:84% I'm lucky enough that this is one of the d points, 01:30:26.580 --> 01:30:27.450 align:middle line:90% I'm in luck. 01:30:27.450 --> 01:30:29.240 align:middle line:84% I got a good polynomial and I'll continue 01:30:29.240 --> 01:30:30.698 align:middle line:84% with the good polynomial till then. 01:30:30.698 --> 01:30:34.320 align:middle line:90% Now I'm la-la land. 01:30:34.320 --> 01:30:36.110 align:middle line:90% I'm happy. 01:30:36.110 --> 01:30:37.820 align:middle line:84% But the problem is the chance each one-- 01:30:37.820 --> 01:30:40.770 align:middle line:84% the chance that you give me a t that's one of the d points, 01:30:40.770 --> 01:30:43.980 align:middle line:84% is only d over F. And a union bound over everything, 01:30:43.980 --> 01:30:46.820 align:middle line:84% it's n times d over F. And if F is much, much bigger 01:30:46.820 --> 01:30:51.860 align:middle line:84% than n times d, then the chances that the prover will succeed-- 01:30:51.860 --> 01:30:53.620 align:middle line:84% will be in this la-la land is very small. 01:30:53.620 --> 01:30:57.950 align:middle line:90% 01:30:57.950 --> 01:31:01.795 align:middle line:84% Any further questions about the sum-check protocol? 01:31:01.795 --> 01:31:05.370 align:middle line:90% 01:31:05.370 --> 01:31:05.870 align:middle line:90% OK. 01:31:05.870 --> 01:31:09.320 align:middle line:84% So let's take maybe a five-minute break 01:31:09.320 --> 01:31:10.890 align:middle line:90% to stretch and so on. 01:31:10.890 --> 01:31:12.420 align:middle line:90% And then we'll show-- 01:31:12.420 --> 01:31:15.160 align:middle line:84% we'll start showing applications for this. 01:31:15.160 --> 01:31:16.000 align:middle line:90%