WEBVTT 00:00:00.000 --> 00:00:02.485 align:middle line:90% 00:00:02.485 --> 00:00:03.479 align:middle line:90% [SQUEAKING] 00:00:03.479 --> 00:00:04.970 align:middle line:90% [RUSTLING] 00:00:04.970 --> 00:00:05.964 align:middle line:90% [CLICKING] 00:00:05.964 --> 00:00:13.412 align:middle line:90% 00:00:13.412 --> 00:00:14.120 align:middle line:90% RACHEL ZHANG: OK. 00:00:14.120 --> 00:00:15.060 align:middle line:90% So what is GKR? 00:00:15.060 --> 00:00:19.092 align:middle line:90% 00:00:19.092 --> 00:00:20.050 align:middle line:90% Can you guys read this? 00:00:20.050 --> 00:00:20.530 align:middle line:90% Is this too big? 00:00:20.530 --> 00:00:21.130 align:middle line:90% Too small? 00:00:21.130 --> 00:00:21.896 align:middle line:90% It's fine? 00:00:21.896 --> 00:00:22.729 align:middle line:90% AUDIENCE: It's fine. 00:00:22.729 --> 00:00:27.512 align:middle line:90% 00:00:27.512 --> 00:00:28.220 align:middle line:90% RACHEL ZHANG: OK. 00:00:28.220 --> 00:00:31.020 align:middle line:84% So the idea is given a circuit C, 00:00:31.020 --> 00:00:34.060 align:middle line:84% we're going to-- instead of hash computing circuit C by yourself, 00:00:34.060 --> 00:00:35.630 align:middle line:84% you can delegate it to a prover who 00:00:35.630 --> 00:00:37.380 align:middle line:84% would do the computation for you and prove 00:00:37.380 --> 00:00:41.160 align:middle line:84% the computation is correct in an interactive protocol. 00:00:41.160 --> 00:00:43.320 align:middle line:84% And the main idea of how you can do it-- 00:00:43.320 --> 00:00:52.200 align:middle line:84% So let's say this is the depth D and size S. What you're 00:00:52.200 --> 00:00:54.030 align:middle line:84% going to do is you're going to take 00:00:54.030 --> 00:00:57.210 align:middle line:84% every single layer of the circuit, 00:00:57.210 --> 00:00:59.560 align:middle line:84% extend it to a low-degree extension. 00:00:59.560 --> 00:01:03.100 align:middle line:90% 00:01:03.100 --> 00:01:05.923 align:middle line:90% So is this going to be the hat. 00:01:05.923 --> 00:01:07.840 align:middle line:84% So you're basically going to take all the wire 00:01:07.840 --> 00:01:11.530 align:middle line:84% values on each layer, find a low-degree extension of it, 00:01:11.530 --> 00:01:14.170 align:middle line:84% and then you're going to have some low-degree extension 00:01:14.170 --> 00:01:15.370 align:middle line:90% of each layer. 00:01:15.370 --> 00:01:20.420 align:middle line:84% The top layer is going to be the V1, then V1 layer, and so on. 00:01:20.420 --> 00:01:23.100 align:middle line:84% The final layer is going to be VD. 00:01:23.100 --> 00:01:25.510 align:middle line:84% And the way GKR works is essentially as follows. 00:01:25.510 --> 00:01:27.880 align:middle line:84% You're going to reduce some claims about the top layer-- 00:01:27.880 --> 00:01:28.680 align:middle line:90% the upper layer-- 00:01:28.680 --> 00:01:30.360 align:middle line:90% to claims about layers below it. 00:01:30.360 --> 00:01:31.230 align:middle line:84% And you're going to keep doing this 00:01:31.230 --> 00:01:33.230 align:middle line:84% until you reach the bottom layer, at which point 00:01:33.230 --> 00:01:35.190 align:middle line:84% the verifier can check themselves. 00:01:35.190 --> 00:01:39.600 align:middle line:84% So at the beginning, you might have that the output gate-- 00:01:39.600 --> 00:01:41.850 align:middle line:90% you want this to be equal to 0. 00:01:41.850 --> 00:01:45.390 align:middle line:84% You're going to reduce this, via sum check protocol, 00:01:45.390 --> 00:01:46.990 align:middle line:90% to two claims. 00:01:46.990 --> 00:01:53.700 align:middle line:84% So let's call this V11 equals, maybe, the value of V11. 00:01:53.700 --> 00:01:57.120 align:middle line:84% And also, the claim that the low-degree extension 00:01:57.120 --> 00:01:59.160 align:middle line:90% on the second point-- 00:01:59.160 --> 00:02:02.618 align:middle line:84% so that's also equal to the different value of you 00:02:02.618 --> 00:02:03.160 align:middle line:90% want it here. 00:02:03.160 --> 00:02:06.540 align:middle line:84% And this is [INAUDIBLE] assumption protocol. 00:02:06.540 --> 00:02:07.780 align:middle line:90% And then you can do it again. 00:02:07.780 --> 00:02:10.960 align:middle line:84% So last time, [INAUDIBLE] two-to-two fashion. 00:02:10.960 --> 00:02:13.210 align:middle line:84% So we're going to reduce the two claims to two claims, 00:02:13.210 --> 00:02:14.222 align:middle line:90% [INAUDIBLE]. 00:02:14.222 --> 00:02:23.722 align:middle line:90% 00:02:23.722 --> 00:02:24.930 align:middle line:90% I'm just going to keep going. 00:02:24.930 --> 00:02:26.972 align:middle line:84% At the end, you're going to reduce the assumption 00:02:26.972 --> 00:02:29.160 align:middle line:84% to the claim about the output layer. 00:02:29.160 --> 00:02:30.703 align:middle line:90% So maybe ZD1. 00:02:30.703 --> 00:02:40.950 align:middle line:90% 00:02:40.950 --> 00:02:43.170 align:middle line:84% And at this point in time, this is just 00:02:43.170 --> 00:02:45.090 align:middle line:84% a low-degree extension of all the input 00:02:45.090 --> 00:02:47.670 align:middle line:90% gates, which is size n. 00:02:47.670 --> 00:02:49.620 align:middle line:84% The verifier knows what all these inputs are, 00:02:49.620 --> 00:02:51.453 align:middle line:84% so they can compute the low-degree extension 00:02:51.453 --> 00:02:52.170 align:middle line:90% by themselves. 00:02:52.170 --> 00:02:53.940 align:middle line:84% And so all together, this is going 00:02:53.940 --> 00:02:59.850 align:middle line:84% to take a prover time poly (S) to prove the computation's done 00:02:59.850 --> 00:03:00.990 align:middle line:90% correctly to the verifier. 00:03:00.990 --> 00:03:05.610 align:middle line:84% And the verifier will run, in time-- 00:03:05.610 --> 00:03:11.190 align:middle line:84% let's see it's going to be D times polylog S, 00:03:11.190 --> 00:03:13.025 align:middle line:84% plus n times maybe polylog S, also. 00:03:13.025 --> 00:03:15.965 align:middle line:90% 00:03:15.965 --> 00:03:17.340 align:middle line:84% So this is what we did last time. 00:03:17.340 --> 00:03:18.620 align:middle line:90% Yeah. 00:03:18.620 --> 00:03:22.460 align:middle line:84% AUDIENCE: Can you go over how using the same randomness help 00:03:22.460 --> 00:03:23.720 align:middle line:90% you get the thing-- 00:03:23.720 --> 00:03:25.677 align:middle line:90% you just do all the way down? 00:03:25.677 --> 00:03:26.510 align:middle line:90% RACHEL ZHANG: Right. 00:03:26.510 --> 00:03:28.310 align:middle line:84% So the idea is, instead of having 00:03:28.310 --> 00:03:30.050 align:middle line:84% to run a different subject protocol 00:03:30.050 --> 00:03:32.690 align:middle line:84% with independent randomness for each of these two claims, what 00:03:32.690 --> 00:03:35.600 align:middle line:84% you can do is use the same randomness for both claims 00:03:35.600 --> 00:03:36.800 align:middle line:90% simultaneously. 00:03:36.800 --> 00:03:38.867 align:middle line:84% And turns out that the gates you have 00:03:38.867 --> 00:03:41.450 align:middle line:84% to check at the very bottom, at the end of sum check protocol, 00:03:41.450 --> 00:03:43.895 align:middle line:84% will be based on the random method that 00:03:43.895 --> 00:03:46.080 align:middle line:84% was used during from the verifier's point of view. 00:03:46.080 --> 00:03:47.210 align:middle line:84% So as long as the same randomness 00:03:47.210 --> 00:03:48.920 align:middle line:84% using both of these things, then you'll 00:03:48.920 --> 00:03:51.777 align:middle line:84% have to use the same two final checks at the very bottom 00:03:51.777 --> 00:03:52.485 align:middle line:90% of the sum check. 00:03:52.485 --> 00:03:55.250 align:middle line:90% 00:03:55.250 --> 00:03:56.060 align:middle line:90% Yeah. 00:03:56.060 --> 00:03:59.030 align:middle line:90% OK. 00:03:59.030 --> 00:03:59.630 align:middle line:90% Cool. 00:03:59.630 --> 00:04:02.462 align:middle line:84% And maybe I should also just tell you-- 00:04:02.462 --> 00:04:05.510 align:middle line:84% yeah, I also wanted to write out sum check equation 00:04:05.510 --> 00:04:07.220 align:middle line:84% just so we have it for later because it's 00:04:07.220 --> 00:04:09.298 align:middle line:90% going to be important. 00:04:09.298 --> 00:04:11.340 align:middle line:84% Used up an entire board range is kind of awkward. 00:04:11.340 --> 00:04:14.330 align:middle line:84% So maybe I'll put it somewhere else. 00:04:14.330 --> 00:04:15.237 align:middle line:90% Yeah. 00:04:15.237 --> 00:04:16.420 align:middle line:90% Oh, it can move there. 00:04:16.420 --> 00:04:16.920 align:middle line:90% Maybe? 00:04:16.920 --> 00:04:17.560 align:middle line:90% OK. 00:04:17.560 --> 00:04:20.060 align:middle line:84% I guess-- I told the camera man we wouldn't need that board. 00:04:20.060 --> 00:04:22.040 align:middle line:84% But I'll just put it here because it shouldn't 00:04:22.040 --> 00:04:23.720 align:middle line:90% be important, I guess. 00:04:23.720 --> 00:04:26.100 align:middle line:84% Or it would be important for us, but we did last time. 00:04:26.100 --> 00:04:27.350 align:middle line:90% So hopefully, it won't be new. 00:04:27.350 --> 00:04:31.626 align:middle line:90% 00:04:31.626 --> 00:04:34.970 align:middle line:84% So you're checking an element of the ith layer. 00:04:34.970 --> 00:04:37.570 align:middle line:84% You want to reduce it to 2 and things in the previous layer. 00:04:37.570 --> 00:04:41.590 align:middle line:84% And so what you can do is you can take an output gate and two 00:04:41.590 --> 00:04:46.430 align:middle line:84% input gates, and it's going to be this giant thing. 00:04:46.430 --> 00:04:57.440 align:middle line:84% So whether or not it was at gate times-- 00:04:57.440 --> 00:05:01.970 align:middle line:84% times this one-- times-- whether-- times the sum of it. 00:05:01.970 --> 00:05:28.458 align:middle line:90% 00:05:28.458 --> 00:05:30.500 align:middle line:84% And then you need to take a low-degree extension. 00:05:30.500 --> 00:05:34.365 align:middle line:90% 00:05:34.365 --> 00:05:35.680 align:middle line:90% And so that's the equation. 00:05:35.680 --> 00:05:38.263 align:middle line:84% What's going to happen is you're going to essentially do a sum 00:05:38.263 --> 00:05:41.525 align:middle line:84% check with this entire thing here as a polynomial in your sum 00:05:41.525 --> 00:05:42.610 align:middle line:90% check. 00:05:42.610 --> 00:05:44.123 align:middle line:84% So we'll come back to this later and we'll just leave it up 00:05:44.123 --> 00:05:44.270 align:middle line:90% for now. 00:05:44.270 --> 00:05:44.342 align:middle line:90% AUDIENCE: Sorry. 00:05:44.342 --> 00:05:45.440 align:middle line:90% What's the Q2? 00:05:45.440 --> 00:05:47.603 align:middle line:84% RACHEL ZHANG: Yeah, it's a polynomial of degree-- 00:05:47.603 --> 00:05:50.200 align:middle line:90% 00:05:50.200 --> 00:05:52.450 align:middle line:84% I'm going to say it's, like, the size of H, 00:05:52.450 --> 00:05:53.810 align:middle line:90% maybe, in each variable. 00:05:53.810 --> 00:05:57.550 align:middle line:84% So individual degree size h minus 1. 00:05:57.550 --> 00:05:59.880 align:middle line:90% Or just take it over-- 00:05:59.880 --> 00:06:03.340 align:middle line:84% to the M. And it's going to basically test 00:06:03.340 --> 00:06:04.850 align:middle line:90% the quality of z and p. 00:06:04.850 --> 00:06:08.440 align:middle line:84% So if z-- if p is in this hypercube, 00:06:08.440 --> 00:06:10.720 align:middle line:84% then it should be 1, if and only if p is equal to z, 00:06:10.720 --> 00:06:12.470 align:middle line:84% and then the low-degree extension of that. 00:06:12.470 --> 00:06:18.930 align:middle line:90% 00:06:18.930 --> 00:06:21.010 align:middle line:84% OK, so today we're going to ask some questions. 00:06:21.010 --> 00:06:23.070 align:middle line:90% So we knew how to do this. 00:06:23.070 --> 00:06:24.940 align:middle line:84% So last time, I showed how to do this, 00:06:24.940 --> 00:06:29.100 align:middle line:84% as long as we had Oracle access to the add and mult gates. 00:06:29.100 --> 00:06:32.130 align:middle line:84% So the goal of the first part of today's class 00:06:32.130 --> 00:06:33.700 align:middle line:90% is to remove this Oracle access. 00:06:33.700 --> 00:06:35.997 align:middle line:84% We're going to show how to get these things. 00:06:35.997 --> 00:06:38.080 align:middle line:84% Actually, we have a little bit more in this board. 00:06:38.080 --> 00:06:43.860 align:middle line:84% So I guess-- so question one is how to get 00:06:43.860 --> 00:06:45.910 align:middle line:90% these low-degree extensions. 00:06:45.910 --> 00:06:51.365 align:middle line:90% 00:06:51.365 --> 00:06:52.490 align:middle line:90% Maybe you guys can tell me. 00:06:52.490 --> 00:06:53.240 align:middle line:90% Do you have any ideas? 00:06:53.240 --> 00:06:54.115 align:middle line:90% How can we get these? 00:06:54.115 --> 00:07:00.752 align:middle line:90% 00:07:00.752 --> 00:07:02.710 align:middle line:84% So I feel like Arnan is bouncing, which clearly 00:07:02.710 --> 00:07:03.960 align:middle line:90% means he has something to say. 00:07:03.960 --> 00:07:04.664 align:middle line:90% AUDIENCE: Oh. 00:07:04.664 --> 00:07:06.193 align:middle line:90% [LAUGHTER] 00:07:06.193 --> 00:07:08.020 align:middle line:84% Could you arithmetize the circuit's 00:07:08.020 --> 00:07:10.162 align:middle line:84% [INAUDIBLE] succinct description? 00:07:10.162 --> 00:07:11.120 align:middle line:90% RACHEL ZHANG: OK, good. 00:07:11.120 --> 00:07:13.440 align:middle line:84% So maybe I'm going to say something like maybe you 00:07:13.440 --> 00:07:15.190 align:middle line:84% can compute these things yourself somehow, 00:07:15.190 --> 00:07:18.010 align:middle line:90% if you can arithmetize it. 00:07:18.010 --> 00:07:20.200 align:middle line:84% And we're going to see how do this in a sec. 00:07:20.200 --> 00:07:22.510 align:middle line:84% Another way to do it is we already know how to do GKR. 00:07:22.510 --> 00:07:25.820 align:middle line:84% Like, we already know how to delegate a circuit. 00:07:25.820 --> 00:07:28.780 align:middle line:84% So let's redelegate the add and mult gates. 00:07:28.780 --> 00:07:37.410 align:middle line:84% So we're going to redelegate add and mult. 00:07:37.410 --> 00:07:41.362 align:middle line:84% And this is, indeed, what they do in the original GKR paper. 00:07:41.362 --> 00:07:42.820 align:middle line:84% But we're not going to do it today. 00:07:42.820 --> 00:07:44.470 align:middle line:84% So this is another thing you could do. 00:07:44.470 --> 00:07:48.100 align:middle line:84% But today, we're going to show how to compute them. 00:07:48.100 --> 00:07:50.350 align:middle line:84% Actually, this is a bit weird because we're actually 00:07:50.350 --> 00:07:53.017 align:middle line:84% going to compute the low-degree extensions of these add and mult 00:07:53.017 --> 00:07:53.620 align:middle line:90% circuits. 00:07:53.620 --> 00:07:55.480 align:middle line:84% We're actually going to compute a different, 00:07:55.480 --> 00:07:58.570 align:middle line:84% somewhat low-degree polynomial on these-- 00:07:58.570 --> 00:08:01.360 align:middle line:84% that share the same values on the hypercube. 00:08:01.360 --> 00:08:07.120 align:middle line:84% So it's actually not going to be the canonical LDE. 00:08:07.120 --> 00:08:10.040 align:middle line:90% 00:08:10.040 --> 00:08:12.010 align:middle line:84% I think last time, Leo had said something 00:08:12.010 --> 00:08:14.957 align:middle line:84% about-- can you use a different low-degree polynomial? 00:08:14.957 --> 00:08:16.540 align:middle line:84% And the answer here is, yes, and we're 00:08:16.540 --> 00:08:18.165 align:middle line:84% going to see application of that today. 00:08:18.165 --> 00:08:21.100 align:middle line:90% 00:08:21.100 --> 00:08:21.770 align:middle line:90% OK, cool. 00:08:21.770 --> 00:08:23.090 align:middle line:90% So the idea is-- 00:08:23.090 --> 00:08:25.160 align:middle line:90% so if you want to compute them-- 00:08:25.160 --> 00:08:27.890 align:middle line:84% so you can't compute the actual canonical low-degree extension. 00:08:27.890 --> 00:08:29.110 align:middle line:90% So what can you do? 00:08:29.110 --> 00:08:34.632 align:middle line:84% Well-- and the reason is basically 00:08:34.632 --> 00:08:36.590 align:middle line:84% because if you compute the add and mult gates-- 00:08:36.590 --> 00:08:38.507 align:middle line:84% because the circuit is too complicated for you 00:08:38.507 --> 00:08:40.730 align:middle line:90% to compute yourself. 00:08:40.730 --> 00:08:42.480 align:middle line:90% So maybe here's an idea. 00:08:42.480 --> 00:08:44.479 align:middle line:90% What if, instead of computing-- 00:08:44.479 --> 00:08:46.170 align:middle line:84% doing GKR in the original circuit, 00:08:46.170 --> 00:08:47.600 align:middle line:84% we do it on a much simpler circuit 00:08:47.600 --> 00:08:49.100 align:middle line:84% that computes the same functionality 00:08:49.100 --> 00:08:51.017 align:middle line:84% as a circuit you're trying to-- that you want? 00:08:51.017 --> 00:09:00.850 align:middle line:90% 00:09:00.850 --> 00:09:11.030 align:middle line:84% So idea-- replace C with a simpler to describe circuit. 00:09:11.030 --> 00:09:16.340 align:middle line:90% 00:09:16.340 --> 00:09:18.090 align:middle line:84% And I guess by simpler to describe, 00:09:18.090 --> 00:09:21.000 align:middle line:84% I just mean that add and mult should be easily computable. 00:09:21.000 --> 00:09:33.440 align:middle line:90% 00:09:33.440 --> 00:09:35.373 align:middle line:84% And so let's use the universal circuit. 00:09:35.373 --> 00:09:37.540 align:middle line:84% So universal circuit is going to be a circuit that's 00:09:37.540 --> 00:09:39.498 align:middle line:84% going to take as inputs the circuit that you're 00:09:39.498 --> 00:09:41.960 align:middle line:84% trying to compute, along with the input. 00:09:41.960 --> 00:09:43.060 align:middle line:90% And it's going to output-- 00:09:43.060 --> 00:09:45.310 align:middle line:84% it's going to simulate the computation of your circuit 00:09:45.310 --> 00:09:50.532 align:middle line:84% C on the input x and then compute C of x. 00:09:50.532 --> 00:09:52.990 align:middle line:84% And the claim is going to be that this universal circuit is 00:09:52.990 --> 00:09:54.865 align:middle line:84% going to have a simpler description, at least 00:09:54.865 --> 00:09:57.572 align:middle line:84% for the add and mult gates, than the original circuit 00:09:57.572 --> 00:09:59.030 align:middle line:84% because it's going to take us input 00:09:59.030 --> 00:10:00.300 align:middle line:84% like the description of the circuit. 00:10:00.300 --> 00:10:01.770 align:middle line:84% And then it's going to simulate description, 00:10:01.770 --> 00:10:04.160 align:middle line:84% but all these simulation is easy to describe because it's 00:10:04.160 --> 00:10:05.515 align:middle line:90% very general and very easy. 00:10:05.515 --> 00:10:08.990 align:middle line:90% 00:10:08.990 --> 00:10:10.585 align:middle line:84% So maybe let's see how this will work. 00:10:10.585 --> 00:10:13.130 align:middle line:90% 00:10:13.130 --> 00:10:14.970 align:middle line:84% So you have this universal circuit here. 00:10:14.970 --> 00:10:18.285 align:middle line:90% It's going to look like this. 00:10:18.285 --> 00:10:20.910 align:middle line:84% And it's going to take as input a description of the circuit C, 00:10:20.910 --> 00:10:23.940 align:middle line:90% along with your input x. 00:10:23.940 --> 00:10:25.650 align:middle line:90% And then it's going to run-- 00:10:25.650 --> 00:10:29.945 align:middle line:84% the hope is that this is going to be D times poly log-- 00:10:29.945 --> 00:10:32.837 align:middle line:90% 00:10:32.837 --> 00:10:33.670 align:middle line:90% maybe it should be-- 00:10:33.670 --> 00:10:34.370 align:middle line:90% OK. 00:10:34.370 --> 00:10:36.015 align:middle line:90% We'll talk about this later. 00:10:36.015 --> 00:10:37.390 align:middle line:84% So this should be, hopefully, not 00:10:37.390 --> 00:10:39.640 align:middle line:84% so much bigger than the circuit C because you're going 00:10:39.640 --> 00:10:41.020 align:middle line:90% to want to do it efficiently. 00:10:41.020 --> 00:10:43.330 align:middle line:84% What is this description C over here? 00:10:43.330 --> 00:10:44.960 align:middle line:90% This is-- yeah, maybe I should-- 00:10:44.960 --> 00:10:45.460 align:middle line:90% OK. 00:10:45.460 --> 00:10:50.810 align:middle line:90% 00:10:50.810 --> 00:10:52.540 align:middle line:90% So what does the circuit C? 00:10:52.540 --> 00:10:55.390 align:middle line:84% What should input to this be like? 00:10:55.390 --> 00:10:58.575 align:middle line:84% Well, it's basically going to be a function that will tell you-- 00:10:58.575 --> 00:11:01.570 align:middle line:90% 00:11:01.570 --> 00:11:03.070 align:middle line:84% yeah, so I guess it would tell you-- 00:11:03.070 --> 00:11:06.010 align:middle line:84% for every single-- maybe this should be an add 1 00:11:06.010 --> 00:11:08.590 align:middle line:90% and then mult 1. 00:11:08.590 --> 00:11:10.570 align:middle line:84% So for both add and mult, it'll tell if, 00:11:10.570 --> 00:11:13.125 align:middle line:84% at a single location in the original circuit, C-- 00:11:13.125 --> 00:11:16.516 align:middle line:90% 00:11:16.516 --> 00:11:18.730 align:middle line:84% if there is a gate of that form or not. 00:11:18.730 --> 00:11:20.810 align:middle line:84% So it's going to be a pretty large description. 00:11:20.810 --> 00:11:22.230 align:middle line:84% It's going to be size 2 to the s. 00:11:22.230 --> 00:11:25.889 align:middle line:90% 00:11:25.889 --> 00:11:26.930 align:middle line:90% Does that make sense? 00:11:26.930 --> 00:11:30.520 align:middle line:90% 00:11:30.520 --> 00:11:31.600 align:middle line:90% Yeah. 00:11:31.600 --> 00:11:33.350 align:middle line:84% AUDIENCE: So the circuit [INAUDIBLE] size. 00:11:33.350 --> 00:11:35.660 align:middle line:84% We're going to give a description of size 2 to the s. 00:11:35.660 --> 00:11:36.813 align:middle line:90% RACHEL ZHANG: Yes. 00:11:36.813 --> 00:11:37.730 align:middle line:90% We'll start with that. 00:11:37.730 --> 00:11:40.380 align:middle line:84% And as Ted is alluding to-- so would not be so good for us, 00:11:40.380 --> 00:11:41.670 align:middle line:84% but we'll discuss how to do in a little bit. 00:11:41.670 --> 00:11:42.160 align:middle line:90% AUDIENCE: S this is just-- 00:11:42.160 --> 00:11:42.952 align:middle line:90% RACHEL ZHANG: Yeah. 00:11:42.952 --> 00:11:45.978 align:middle line:84% AUDIENCE: Just-- literally, just two-bit strings. 00:11:45.978 --> 00:11:47.270 align:middle line:90% RACHEL ZHANG: Yeah, yeah, yeah. 00:11:47.270 --> 00:11:48.120 align:middle line:90% It's supposed to be really long. 00:11:48.120 --> 00:11:50.328 align:middle line:84% It's going to tell you what every gate of the circuit 00:11:50.328 --> 00:11:52.560 align:middle line:90% looks like. 00:11:52.560 --> 00:11:55.090 align:middle line:84% AUDIENCE: Didn't pw1 and w2 range 00:11:55.090 --> 00:11:58.900 align:middle line:84% over the horizontal distance of the circuit, 00:11:58.900 --> 00:12:00.040 align:middle line:90% not the vertical distance? 00:12:00.040 --> 00:12:02.770 align:middle line:90% RACHEL ZHANG: Yeah, OK. 00:12:02.770 --> 00:12:04.570 align:middle line:84% Maybe we can have pw1 and w2 range 00:12:04.570 --> 00:12:06.290 align:middle line:84% over all the possible gates or something. 00:12:06.290 --> 00:12:07.720 align:middle line:84% So we can change the notation a little bit. 00:12:07.720 --> 00:12:08.235 align:middle line:90% That's OK. 00:12:08.235 --> 00:12:12.870 align:middle line:90% 00:12:12.870 --> 00:12:15.078 align:middle line:90% OK. 00:12:15.078 --> 00:12:15.745 align:middle line:90% AUDIENCE: Sorry. 00:12:15.745 --> 00:12:16.010 align:middle line:90% Last question. 00:12:16.010 --> 00:12:16.650 align:middle line:90% RACHEL ZHANG: Yeah. 00:12:16.650 --> 00:12:17.950 align:middle line:84% AUDIENCE: I guess this is a very small detail, 00:12:17.950 --> 00:12:20.070 align:middle line:84% but how do you handle knots at the input layer? 00:12:20.070 --> 00:12:21.750 align:middle line:84% RACHEL ZHANG: So what you can do-- this is also, actually, 00:12:21.750 --> 00:12:23.670 align:middle line:84% a huge issue with the GKR protocol, because you only 00:12:23.670 --> 00:12:24.670 align:middle line:90% have add and mult gates. 00:12:24.670 --> 00:12:28.110 align:middle line:84% But you can do is you can have , and then also the flip of x 00:12:28.110 --> 00:12:29.162 align:middle line:90% or the not of x. 00:12:29.162 --> 00:12:30.870 align:middle line:84% And then now you can simulate everything. 00:12:30.870 --> 00:12:31.412 align:middle line:90% AUDIENCE: OK. 00:12:31.412 --> 00:12:34.160 align:middle line:90% 00:12:34.160 --> 00:12:36.020 align:middle line:90% RACHEL ZHANG: OK. 00:12:36.020 --> 00:12:38.187 align:middle line:84% So my claim is basically that this universal circuit 00:12:38.187 --> 00:12:39.812 align:middle line:84% is going to be much simpler to describe 00:12:39.812 --> 00:12:41.540 align:middle line:84% than the original circuit, C. And maybe 00:12:41.540 --> 00:12:44.780 align:middle line:84% let's just see why in, hopefully, a not too in detail 00:12:44.780 --> 00:12:46.770 align:middle line:84% view, but hopefully, we can get an idea. 00:12:46.770 --> 00:12:48.183 align:middle line:90% So the idea is-- 00:12:48.183 --> 00:12:49.975 align:middle line:84% let's say this is your circuit C over here. 00:12:49.975 --> 00:12:55.297 align:middle line:90% 00:12:55.297 --> 00:12:57.630 align:middle line:84% It's going to be a bunch of layers with a bunch of gates 00:12:57.630 --> 00:12:59.047 align:middle line:84% in each of the layers, and they're 00:12:59.047 --> 00:13:01.120 align:middle line:84% going to each have some functionality. 00:13:01.120 --> 00:13:04.475 align:middle line:90% 00:13:04.475 --> 00:13:07.400 align:middle line:84% And so what the universal circuit is basically going 00:13:07.400 --> 00:13:11.210 align:middle line:90% to do is it's going to say-- 00:13:11.210 --> 00:13:14.810 align:middle line:84% I want you to compute this value of this circuit C gate here. 00:13:14.810 --> 00:13:16.760 align:middle line:84% Let me look at all the previous ones, 00:13:16.760 --> 00:13:19.310 align:middle line:84% because you don't know which one is a tattoo. 00:13:19.310 --> 00:13:22.250 align:middle line:84% So you're going to look at all the possible values, 00:13:22.250 --> 00:13:24.740 align:middle line:84% and you're going to, then, see what their circuit C says 00:13:24.740 --> 00:13:27.560 align:middle line:84% and then compute the appropriate function of the previous layer 00:13:27.560 --> 00:13:29.300 align:middle line:84% based on what the circuit C says. 00:13:29.300 --> 00:13:32.610 align:middle line:90% So in particular-- yeah. 00:13:32.610 --> 00:13:34.680 align:middle line:84% So the particular in the ith layer-- 00:13:34.680 --> 00:13:36.740 align:middle line:90% so the value of the circuit-- 00:13:36.740 --> 00:13:40.370 align:middle line:84% of this thing in the ith layer-- is going to be-- 00:13:40.370 --> 00:13:44.365 align:middle line:84% so maybe this is a layer, and this is a gate. 00:13:44.365 --> 00:13:47.940 align:middle line:90% 00:13:47.940 --> 00:13:50.820 align:middle line:84% And it's going to be a sum of possible gates 00:13:50.820 --> 00:13:53.800 align:middle line:84% in the previous layer of the following thing. 00:13:53.800 --> 00:13:55.220 align:middle line:90% So it's going to be whether C-- 00:13:55.220 --> 00:14:01.940 align:middle line:90% 00:14:01.940 --> 00:14:03.890 align:middle line:84% so it's going to be whether C has an add gate 00:14:03.890 --> 00:14:05.910 align:middle line:84% corresponding to the three gates you're picking. 00:14:05.910 --> 00:14:10.160 align:middle line:84% So this is J, And then maybe K and K prime, 00:14:10.160 --> 00:14:17.250 align:middle line:90% and then times the sum of them. 00:14:17.250 --> 00:14:19.580 align:middle line:84% So it's a similar thing as in the GKR thing. 00:14:19.580 --> 00:14:23.940 align:middle line:84% We're going to have an add and a mult condition. 00:14:23.940 --> 00:14:27.448 align:middle line:84% So if it's an add gate, you're going to compute the sum. 00:14:27.448 --> 00:14:28.990 align:middle line:84% And if it's a mult gate, you're going 00:14:28.990 --> 00:14:43.700 align:middle line:90% to compute the mult. Is that OK? 00:14:43.700 --> 00:14:46.802 align:middle line:84% AUDIENCE: What is that inside the parentheses on the add gate. 00:14:46.802 --> 00:14:47.760 align:middle line:90% RACHEL ZHANG: Yeah, OK. 00:14:47.760 --> 00:14:51.290 align:middle line:84% So this is going to be whether the circuit is 00:14:51.290 --> 00:14:53.550 align:middle line:84% an add gate at these particular three gates-- 00:14:53.550 --> 00:14:55.710 align:middle line:90% J, K and K prime. 00:14:55.710 --> 00:14:59.970 align:middle line:84% And this is going to be the values, V I plus 1K. 00:14:59.970 --> 00:15:01.260 align:middle line:90% So it's what this value is. 00:15:01.260 --> 00:15:01.680 align:middle line:90% AUDIENCE: [INAUDIBLE] 00:15:01.680 --> 00:15:02.250 align:middle line:84% RACHEL ZHANG: Yeah, sorry So maybe this 00:15:02.250 --> 00:15:03.170 align:middle line:90% is a little bit small. 00:15:03.170 --> 00:15:06.010 align:middle line:90% 00:15:06.010 --> 00:15:06.510 align:middle line:90% OK. 00:15:06.510 --> 00:15:08.343 align:middle line:84% I don't really know how to make this bigger. 00:15:08.343 --> 00:15:13.520 align:middle line:90% 00:15:13.520 --> 00:15:14.364 align:middle line:90% Yeah. 00:15:14.364 --> 00:15:15.947 align:middle line:84% AUDIENCE: The subscript on the C add-- 00:15:15.947 --> 00:15:17.570 align:middle line:84% I actually think of it as an input [? text. ?] 00:15:17.570 --> 00:15:18.737 align:middle line:90% RACHEL ZHANG: Yeah, exactly. 00:15:18.737 --> 00:15:21.080 align:middle line:84% So these are both going to be given from the description 00:15:21.080 --> 00:15:24.208 align:middle line:84% of the circuit C, which-- this will also have to take-- 00:15:24.208 --> 00:15:26.000 align:middle line:84% the description of circuit C, and it's also 00:15:26.000 --> 00:15:27.320 align:middle line:90% going to read into here. 00:15:27.320 --> 00:15:28.190 align:middle line:84% AUDIENCE: And this is the same thing 00:15:28.190 --> 00:15:29.900 align:middle line:84% that's written on the board [INAUDIBLE]. 00:15:29.900 --> 00:15:30.960 align:middle line:84% RACHEL ZHANG: Yeah, it's essentially the same thing. 00:15:30.960 --> 00:15:32.793 align:middle line:84% AUDIENCE: It's just not [INAUDIBLE] section. 00:15:32.793 --> 00:15:34.964 align:middle line:90% [INTERPOSING VOICES] 00:15:34.964 --> 00:15:38.730 align:middle line:90% 00:15:38.730 --> 00:15:39.953 align:middle line:90% RACHEL ZHANG: Yeah. 00:15:39.953 --> 00:15:40.620 align:middle line:90% AUDIENCE: Sorry. 00:15:40.620 --> 00:15:40.980 align:middle line:90% RACHEL ZHANG: No. 00:15:40.980 --> 00:15:42.480 align:middle line:84% AUDIENCE: I'm still hung up on this. 00:15:42.480 --> 00:15:46.350 align:middle line:84% C add is defined over three inputs, all of which range 00:15:46.350 --> 00:15:48.598 align:middle line:90% from 1 to [? test, ?] right? 00:15:48.598 --> 00:15:49.390 align:middle line:90% RACHEL ZHANG: Sure. 00:15:49.390 --> 00:15:49.830 align:middle line:90% OK. 00:15:49.830 --> 00:15:50.170 align:middle line:90% Yeah. 00:15:50.170 --> 00:15:51.520 align:middle line:90% AUDIENCE: Why is it a size 3? 00:15:51.520 --> 00:15:53.800 align:middle line:84% So it's essentially the same [INAUDIBLE] size like s cubed. 00:15:53.800 --> 00:15:54.100 align:middle line:90% RACHEL ZHANG: Good. 00:15:54.100 --> 00:15:54.600 align:middle line:90% Yes. 00:15:54.600 --> 00:15:55.120 align:middle line:90% Yes. 00:15:55.120 --> 00:15:57.310 align:middle line:84% So we're going to have to deal with that in a bit. 00:15:57.310 --> 00:15:59.710 align:middle line:84% So yeah, instead of saying that the circuit C here is-- 00:15:59.710 --> 00:16:01.750 align:middle line:84% the description of circuit C is too big-- 00:16:01.750 --> 00:16:03.760 align:middle line:84% we're going to have to do something for that. 00:16:03.760 --> 00:16:04.385 align:middle line:90% AUDIENCE: Wait. 00:16:04.385 --> 00:16:06.460 align:middle line:90% So why is it 2 the s, though? 00:16:06.460 --> 00:16:07.780 align:middle line:90% Is it because we have-- 00:16:07.780 --> 00:16:08.030 align:middle line:90% RACHEL ZHANG: Sorry. 00:16:08.030 --> 00:16:08.530 align:middle line:90% It's just s. 00:16:08.530 --> 00:16:09.050 align:middle line:90% It's just S. 00:16:09.050 --> 00:16:09.300 align:middle line:90% AUDIENCE: OK. 00:16:09.300 --> 00:16:09.590 align:middle line:90% RACHEL ZHANG: You're right. 00:16:09.590 --> 00:16:10.132 align:middle line:90% You're right. 00:16:10.132 --> 00:16:12.115 align:middle line:90% It's just S. 00:16:12.115 --> 00:16:12.740 align:middle line:90% AUDIENCE: Wait. 00:16:12.740 --> 00:16:14.310 align:middle line:90% Wasn't it S-cubed? 00:16:14.310 --> 00:16:15.486 align:middle line:90% RACHEL ZHANG: S-cubed? 00:16:15.486 --> 00:16:16.748 align:middle line:90% Oh, yes. 00:16:16.748 --> 00:16:20.164 align:middle line:90% [LAUGHTER] 00:16:20.164 --> 00:16:21.140 align:middle line:90% 00:16:21.140 --> 00:16:22.960 align:middle line:90% Does that makes sense? 00:16:22.960 --> 00:16:23.460 align:middle line:90% Sorry. 00:16:23.460 --> 00:16:25.590 align:middle line:84% I tried to explain that [INAUDIBLE] really badly. 00:16:25.590 --> 00:16:28.920 align:middle line:84% But you're basically trying to simulate the computation of C. 00:16:28.920 --> 00:16:33.660 align:middle line:84% And to do that you're going to introduce a new circuit-- 00:16:33.660 --> 00:16:36.750 align:middle line:84% like, a new small circuit for every single gate 00:16:36.750 --> 00:16:39.335 align:middle line:84% in your universal circuit that will look at the previous layer 00:16:39.335 --> 00:16:41.460 align:middle line:84% and then compute appropriate functionality based on 00:16:41.460 --> 00:16:44.860 align:middle line:90% [INAUDIBLE] is supposed to say. 00:16:44.860 --> 00:16:46.052 align:middle line:90% OK. 00:16:46.052 --> 00:16:46.760 align:middle line:90% AUDIENCE: Rachel? 00:16:46.760 --> 00:16:47.552 align:middle line:90% RACHEL ZHANG: Yeah. 00:16:47.552 --> 00:16:49.500 align:middle line:84% AUDIENCE: What is the p [INAUDIBLE] on this? 00:16:49.500 --> 00:16:50.710 align:middle line:90% RACHEL ZHANG: Yeah, OK. 00:16:50.710 --> 00:16:52.468 align:middle line:84% AUDIENCE: On the off-camera board. 00:16:52.468 --> 00:16:53.510 align:middle line:90% RACHEL ZHANG: Yeah, yeah. 00:16:53.510 --> 00:16:56.560 align:middle line:84% So-- yeah-- so these are all going to be H to the m. 00:16:56.560 --> 00:16:59.840 align:middle line:84% H to the m here is going to be the size of, like, a layer. 00:16:59.840 --> 00:17:00.730 align:middle line:90% AUDIENCE: OK, OK. 00:17:00.730 --> 00:17:02.188 align:middle line:84% RACHEL ZHANG: So it's going to be-- 00:17:02.188 --> 00:17:04.220 align:middle line:84% so p you can think of as being in the ith layer. 00:17:04.220 --> 00:17:07.603 align:middle line:84% And then omega 1 and omega 2 are in the i plus 1th layer. 00:17:07.603 --> 00:17:08.270 align:middle line:90% AUDIENCE: I see. 00:17:08.270 --> 00:17:08.950 align:middle line:90% I see. 00:17:08.950 --> 00:17:12.057 align:middle line:84% And p to z is just an arbitrary [INAUDIBLE]. 00:17:12.057 --> 00:17:12.849 align:middle line:90% RACHEL ZHANG: Yeah. 00:17:12.849 --> 00:17:14.738 align:middle line:90% AUDIENCE: OK. 00:17:14.738 --> 00:17:15.530 align:middle line:90% RACHEL ZHANG: Yeah. 00:17:15.530 --> 00:17:20.150 align:middle line:84% AUDIENCE: So that summation there really represents-- 00:17:20.150 --> 00:17:22.980 align:middle line:84% you're trying to compute that summation with a bunch of gates. 00:17:22.980 --> 00:17:23.730 align:middle line:90% RACHEL ZHANG: Yeah, yeah, yeah. 00:17:23.730 --> 00:17:25.855 align:middle line:84% So this is going-- this is going to correspond to-- 00:17:25.855 --> 00:17:26.355 align:middle line:90% I'm sorry. 00:17:26.355 --> 00:17:27.180 align:middle line:90% This is really bad. 00:17:27.180 --> 00:17:28.555 align:middle line:84% Yeah, this is going to correspond 00:17:28.555 --> 00:17:31.490 align:middle line:84% to a pretty big circuit here that's going 00:17:31.490 --> 00:17:33.240 align:middle line:84% to look at the previous layer, and-- yeah. 00:17:33.240 --> 00:17:35.448 align:middle line:84% AUDIENCE: So the depth of U could be, like, the depth 00:17:35.448 --> 00:17:36.770 align:middle line:90% of that mini circuit times p. 00:17:36.770 --> 00:17:37.340 align:middle line:90% RACHEL ZHANG: Exactly. 00:17:37.340 --> 00:17:38.300 align:middle line:90% Yeah, that's perfect. 00:17:38.300 --> 00:17:49.170 align:middle line:90% So-- yeah. 00:17:49.170 --> 00:17:50.765 align:middle line:84% So I don't know what your name is. 00:17:50.765 --> 00:17:51.390 align:middle line:90% AUDIENCE: Gabe. 00:17:51.390 --> 00:17:52.182 align:middle line:90% RACHEL ZHANG: Gabe. 00:17:52.182 --> 00:17:55.440 align:middle line:84% So as Gabe said, the depth of the circuit is going to be-- 00:17:55.440 --> 00:17:58.770 align:middle line:84% the depth of the original circuit of C times 00:17:58.770 --> 00:18:00.748 align:middle line:90% this depth here. 00:18:00.748 --> 00:18:02.540 align:middle line:84% So the question is, what is the depth here? 00:18:02.540 --> 00:18:05.920 align:middle line:90% 00:18:05.920 --> 00:18:06.420 align:middle line:90% Thoughts? 00:18:06.420 --> 00:18:11.510 align:middle line:90% 00:18:11.510 --> 00:18:12.240 align:middle line:90% Roughly. 00:18:12.240 --> 00:18:12.782 align:middle line:90% I don't know. 00:18:12.782 --> 00:18:13.380 align:middle line:90% [INAUDIBLE] 00:18:13.380 --> 00:18:16.260 align:middle line:90% 00:18:16.260 --> 00:18:16.933 align:middle line:90% AUDIENCE: log S? 00:18:16.933 --> 00:18:17.850 align:middle line:90% RACHEL ZHANG: Yeah OK. 00:18:17.850 --> 00:18:20.727 align:middle line:84% Something has log S. Like, polylog, maybe, at worse. 00:18:20.727 --> 00:18:30.180 align:middle line:90% 00:18:30.180 --> 00:18:33.240 align:middle line:84% Yeah, and the reason is because you can think of this big sum 00:18:33.240 --> 00:18:37.890 align:middle line:90% as a binary tree of sums. 00:18:37.890 --> 00:18:40.420 align:middle line:84% And then at the very bottom of this binary tree, 00:18:40.420 --> 00:18:45.095 align:middle line:84% you have poly S many things you're looking at. 00:18:45.095 --> 00:18:48.208 align:middle line:90% 00:18:48.208 --> 00:18:50.250 align:middle line:84% So this entire depth, because it's a binary tree, 00:18:50.250 --> 00:18:53.240 align:middle line:84% is only going to be to depth log S or something. 00:18:53.240 --> 00:18:54.860 align:middle line:90% AUDIENCE: What's U? 00:18:54.860 --> 00:18:55.950 align:middle line:84% RACHEL ZHANG: The depths of the universal circuit. 00:18:55.950 --> 00:18:56.180 align:middle line:90% AUDIENCE: OK. 00:18:56.180 --> 00:18:56.680 align:middle line:90% Good. 00:18:56.680 --> 00:18:57.440 align:middle line:90% U. 00:18:57.440 --> 00:18:59.710 align:middle line:90% RACHEL ZHANG: Yeah. 00:18:59.710 --> 00:19:02.220 align:middle line:84% And what about the size of this universal circuit? 00:19:02.220 --> 00:19:10.410 align:middle line:90% 00:19:10.410 --> 00:19:12.045 align:middle line:90% AUDIENCE: [INAUDIBLE] 00:19:12.045 --> 00:19:13.420 align:middle line:84% RACHEL ZHANG: Yeah, so it's going 00:19:13.420 --> 00:19:15.730 align:middle line:84% to be the size of original circuit times, 00:19:15.730 --> 00:19:20.460 align:middle line:84% like, poly S, so it's just going to be poly S. 00:19:20.460 --> 00:19:22.350 align:middle line:84% And the reason for that is because the size 00:19:22.350 --> 00:19:24.720 align:middle line:84% of this universal circuit is basically going to be-- 00:19:24.720 --> 00:19:26.500 align:middle line:84% for every gate of the original circuit, 00:19:26.500 --> 00:19:29.960 align:middle line:84% you have-- this poly S-size circuit's replacing it. 00:19:29.960 --> 00:19:32.100 align:middle line:84% So you get to poly S size here and then 00:19:32.100 --> 00:19:36.820 align:middle line:84% times the size of the circuit, which is poly S. 00:19:36.820 --> 00:19:37.320 align:middle line:90% OK. 00:19:37.320 --> 00:19:40.050 align:middle line:84% So this is going to be like part of the circuit we're 00:19:40.050 --> 00:19:41.670 align:middle line:84% going to end up using to delegate, 00:19:41.670 --> 00:19:44.040 align:middle line:84% instead of using the original circuit, C. 00:19:44.040 --> 00:19:47.430 align:middle line:84% I guess the last claim that I made is that this circuit U is 00:19:47.430 --> 00:19:50.435 align:middle line:84% much simpler to describe than the circuit C. 00:19:50.435 --> 00:19:51.810 align:middle line:84% So particularly, the add and mult 00:19:51.810 --> 00:19:57.430 align:middle line:84% gates are easily computable or describable, very simply. 00:19:57.430 --> 00:20:01.185 align:middle line:84% And maybe let's look at this and think about it for a minute. 00:20:01.185 --> 00:20:05.130 align:middle line:90% 00:20:05.130 --> 00:20:09.270 align:middle line:84% So I guess if you're trying to figure out-- 00:20:09.270 --> 00:20:11.550 align:middle line:84% I have-- I'm trying to look at this specific gate, 00:20:11.550 --> 00:20:13.758 align:middle line:84% and I want to see if it's, like, an add or mult gate. 00:20:13.758 --> 00:20:16.210 align:middle line:84% But you do, and you figure out where in this tree you are. 00:20:16.210 --> 00:20:18.948 align:middle line:84% And you can be like, oh, look, I'm part of this binary tree. 00:20:18.948 --> 00:20:19.990 align:middle line:90% It should be an add gate. 00:20:19.990 --> 00:20:21.740 align:middle line:84% And then you're like, OK, I'm an add gate. 00:20:21.740 --> 00:20:23.350 align:middle line:84% Or you can read, maybe, in the leaves. 00:20:23.350 --> 00:20:26.130 align:middle line:84% You're like, oh, this particular gate corresponds 00:20:26.130 --> 00:20:31.762 align:middle line:84% to some add gate in the original circuit times some values. 00:20:31.762 --> 00:20:34.470 align:middle line:84% And you figure out-- oh, this is supposed to be multiplied or add 00:20:34.470 --> 00:20:35.810 align:middle line:90% gate or something. 00:20:35.810 --> 00:20:37.810 align:middle line:84% The point is that this is a pretty easy function 00:20:37.810 --> 00:20:38.560 align:middle line:90% to describe. 00:20:38.560 --> 00:20:45.460 align:middle line:84% In particular-- so there's going to be low-depth Boolean formulas 00:20:45.460 --> 00:20:48.430 align:middle line:84% that compute both the add and mult gates. 00:20:48.430 --> 00:20:54.050 align:middle line:84% So there's going to be a Boolean formula of-- 00:20:54.050 --> 00:20:54.580 align:middle line:90% let's see. 00:20:54.580 --> 00:21:02.020 align:middle line:84% So it's going to be a Boolean formula of size 00:21:02.020 --> 00:21:16.460 align:middle line:84% polylog S that computes the add and mult functionalities. 00:21:16.460 --> 00:21:19.610 align:middle line:90% 00:21:19.610 --> 00:21:21.140 align:middle line:90% So it tells you that-- 00:21:21.140 --> 00:21:24.590 align:middle line:84% within U, these-- because they're 00:21:24.590 --> 00:21:27.980 align:middle line:84% small formulas that tell you whether a particular gate in U 00:21:27.980 --> 00:21:29.920 align:middle line:90% is an add or mult gate. 00:21:29.920 --> 00:21:32.780 align:middle line:90% That good? 00:21:32.780 --> 00:21:38.850 align:middle line:84% Cool And so now, like these formulas 00:21:38.850 --> 00:21:42.720 align:middle line:84% are much easier to compute than the previous add and mult. 00:21:42.720 --> 00:21:46.590 align:middle line:84% So ostensibly, the verifier can do it themselves now. 00:21:46.590 --> 00:21:48.295 align:middle line:90% So-- 00:21:48.295 --> 00:21:49.170 align:middle line:90% AUDIENCE: [INAUDIBLE] 00:21:49.170 --> 00:21:49.995 align:middle line:90% RACHEL ZHANG: Yeah. 00:21:49.995 --> 00:21:51.962 align:middle line:84% AUDIENCE: Can you use [INAUDIBLE]? 00:21:51.962 --> 00:21:52.670 align:middle line:90% RACHEL ZHANG: OK. 00:21:52.670 --> 00:21:55.030 align:middle line:90% So I guess, originally-- 00:21:55.030 --> 00:21:57.280 align:middle line:84% yeah, originally-- so how do you compute add and mult? 00:21:57.280 --> 00:21:59.330 align:middle line:84% We're going to-- I didn't write it yet, 00:21:59.330 --> 00:22:03.800 align:middle line:84% but you're going to assume that z is a logspace-uniform circuit, 00:22:03.800 --> 00:22:07.750 align:middle line:84% which means that you-- you can do maybe up to time poly S 00:22:07.750 --> 00:22:11.590 align:middle line:84% computation to compute it, which is too much. 00:22:11.590 --> 00:22:14.980 align:middle line:84% Here, since the circuit-- the formula is only of size polylog, 00:22:14.980 --> 00:22:17.348 align:middle line:90% you can compute it yourself. 00:22:17.348 --> 00:22:19.640 align:middle line:84% So then when you're doing GKR in the universal circuit, 00:22:19.640 --> 00:22:21.760 align:middle line:84% you just have to do a small computation as opposed 00:22:21.760 --> 00:22:23.900 align:middle line:90% to the big one. 00:22:23.900 --> 00:22:24.400 align:middle line:90% Yeah. 00:22:24.400 --> 00:22:26.192 align:middle line:84% AUDIENCE: Are these-- if we add [INAUDIBLE] 00:22:26.192 --> 00:22:28.450 align:middle line:90% mults it's a logspace uniform? 00:22:28.450 --> 00:22:31.875 align:middle line:84% RACHEL ZHANG: I guess maybe a log logspace uniform, right? 00:22:31.875 --> 00:22:33.588 align:middle line:90% Is that how it works? 00:22:33.588 --> 00:22:38.290 align:middle line:84% [LAUGHS] I mean, there's is polylog, right? 00:22:38.290 --> 00:22:39.700 align:middle line:84% So basically, what I mean by this 00:22:39.700 --> 00:22:43.990 align:middle line:84% is you can feed in any p omega 1 and omega 2 00:22:43.990 --> 00:22:45.640 align:middle line:84% and then compute a formula of this size 00:22:45.640 --> 00:22:48.250 align:middle line:84% and it'll tell you what the answer is. 00:22:48.250 --> 00:22:49.655 align:middle line:90% So it's only polylog size. 00:22:49.655 --> 00:22:50.530 align:middle line:90% So you only have to-- 00:22:50.530 --> 00:22:52.030 align:middle line:84% AUDIENCE: Does there exist a formula 00:22:52.030 --> 00:22:53.838 align:middle line:84% such that, for all p1, omega 1, omega 2-- 00:22:53.838 --> 00:22:54.630 align:middle line:90% RACHEL ZHANG: Yeah. 00:22:54.630 --> 00:22:56.588 align:middle line:84% AUDIENCE: --the formula computes it, correctly? 00:22:56.588 --> 00:22:57.840 align:middle line:90% RACHEL ZHANG: Yeah, yeah. 00:22:57.840 --> 00:22:58.215 align:middle line:90% AUDIENCE: Right. 00:22:58.215 --> 00:22:58.715 align:middle line:90% But-- yeah. 00:22:58.715 --> 00:23:01.140 align:middle line:84% The naive way I would do it is advice of polylog size. 00:23:01.140 --> 00:23:03.390 align:middle line:84% But I'm assuming there's a way to make it-- to get rid 00:23:03.390 --> 00:23:04.870 align:middle line:90% of this advice, right? 00:23:04.870 --> 00:23:07.130 align:middle line:90% [INAUDIBLE] 00:23:07.130 --> 00:23:10.150 align:middle line:84% RACHEL ZHANG: Yeah, I think it's log, log uniform. 00:23:10.150 --> 00:23:13.070 align:middle line:84% AUDIENCE: I think it's just, like, [? max ?] 00:23:13.070 --> 00:23:15.890 align:middle line:84% If-- to figure out what level i is to figure out what 00:23:15.890 --> 00:23:17.050 align:middle line:90% [INAUDIBLE] is. 00:23:17.050 --> 00:23:18.880 align:middle line:84% AUDIENCE: [INAUDIBLE] universal circuit. 00:23:18.880 --> 00:23:19.500 align:middle line:90% AUDIENCE: Yeah, that's right. 00:23:19.500 --> 00:23:20.310 align:middle line:90% Yeah, that is. 00:23:20.310 --> 00:23:32.988 align:middle line:90% 00:23:32.988 --> 00:23:35.030 align:middle line:84% AUDIENCE: Oh, the size for the universal circuit. 00:23:35.030 --> 00:23:35.822 align:middle line:90% RACHEL ZHANG: Yeah. 00:23:35.822 --> 00:23:36.390 align:middle line:90% AUDIENCE: OK. 00:23:36.390 --> 00:23:40.150 align:middle line:90% OK, I understand. 00:23:40.150 --> 00:23:42.890 align:middle line:84% RACHEL ZHANG: Yeah, maybe-- just to summarize what we've done, 00:23:42.890 --> 00:23:45.020 align:middle line:84% we've essentially replaced this C, 00:23:45.020 --> 00:23:47.650 align:middle line:84% which has complicated add and mult gate description, 00:23:47.650 --> 00:23:49.906 align:middle line:84% with a universal circuit, which has a much simpler add 00:23:49.906 --> 00:23:50.989 align:middle line:90% and mult gate description. 00:23:50.989 --> 00:23:52.531 align:middle line:84% And then, now, what we're going to do 00:23:52.531 --> 00:23:55.090 align:middle line:84% is we're going to run GKR on the universal circuit instead 00:23:55.090 --> 00:23:57.755 align:middle line:84% of the original circuit, C. The output is still the same 00:23:57.755 --> 00:24:00.130 align:middle line:84% because the universal circuit will simulate C and compute 00:24:00.130 --> 00:24:00.940 align:middle line:90% C of x. 00:24:00.940 --> 00:24:03.790 align:middle line:84% But now, the verifier can, themselves, 00:24:03.790 --> 00:24:06.272 align:middle line:90% compute. add and mult. 00:24:06.272 --> 00:24:09.540 align:middle line:84% AUDIENCE: But the input [? N ?] would increase because you 00:24:09.540 --> 00:24:10.920 align:middle line:90% have to write the description. 00:24:10.920 --> 00:24:12.410 align:middle line:90% RACHEL ZHANG: Good, good. 00:24:12.410 --> 00:24:13.050 align:middle line:90% Yeah, OK. 00:24:13.050 --> 00:24:18.913 align:middle line:90% 00:24:18.913 --> 00:24:24.212 align:middle line:84% So now, we're going to run a CPR on U. You can have U of C 00:24:24.212 --> 00:24:25.420 align:middle line:90% because it's on the circuit-- 00:24:25.420 --> 00:24:31.110 align:middle line:84% this is U, instead of C. So issues. 00:24:31.110 --> 00:24:33.325 align:middle line:90% 00:24:33.325 --> 00:24:34.450 align:middle line:90% Maybe I should also write-- 00:24:34.450 --> 00:24:54.830 align:middle line:90% 00:24:54.830 --> 00:24:56.100 align:middle line:90% So issues. 00:24:56.100 --> 00:24:57.635 align:middle line:90% So one is that-- 00:24:57.635 --> 00:24:59.130 align:middle line:90% that Arnan pointed out-- 00:24:59.130 --> 00:25:01.315 align:middle line:84% which is that the input is now really large. 00:25:01.315 --> 00:25:04.640 align:middle line:90% 00:25:04.640 --> 00:25:07.045 align:middle line:90% So issue one-- input is large. 00:25:07.045 --> 00:25:21.050 align:middle line:90% 00:25:21.050 --> 00:25:23.980 align:middle line:84% And if you remember from the GKR protocol, 00:25:23.980 --> 00:25:26.880 align:middle line:84% the verifier at the very end has to compute some points 00:25:26.880 --> 00:25:29.650 align:middle line:84% in the low-degree extension of the input. 00:25:29.650 --> 00:25:31.948 align:middle line:84% Before, we said, OK, the input is only size n. 00:25:31.948 --> 00:25:33.490 align:middle line:84% So they can compute it by themselves. 00:25:33.490 --> 00:25:36.200 align:middle line:84% It's only n times polylog time to compute it. 00:25:36.200 --> 00:25:41.100 align:middle line:84% But now the input also has C, which is size S. So now 00:25:41.100 --> 00:25:45.270 align:middle line:84% you have to actually spend time poly S to compute 00:25:45.270 --> 00:25:47.868 align:middle line:90% the final layer, which is bad. 00:25:47.868 --> 00:25:49.660 align:middle line:84% Like, we want the verifier to be efficient. 00:25:49.660 --> 00:25:52.210 align:middle line:90% Now we're back to square one. 00:25:52.210 --> 00:25:54.450 align:middle line:84% So we're going to deal with this. 00:25:54.450 --> 00:25:55.335 align:middle line:90% Any other issues? 00:25:55.335 --> 00:26:03.363 align:middle line:90% 00:26:03.363 --> 00:26:04.030 align:middle line:90% AUDIENCE: Sorry. 00:26:04.030 --> 00:26:08.313 align:middle line:84% In the GKR protocol, the add times poly S's, do I only 00:26:08.313 --> 00:26:10.480 align:middle line:84% need to compute a couple of bits in the input layer, 00:26:10.480 --> 00:26:12.615 align:middle line:84% or do I need to compute the entire input layer? 00:26:12.615 --> 00:26:13.990 align:middle line:84% RACHEL ZHANG: You need to read it 00:26:13.990 --> 00:26:15.340 align:middle line:84% all because what you're going to do 00:26:15.340 --> 00:26:17.090 align:middle line:84% is you're going to look at the input layer 00:26:17.090 --> 00:26:18.850 align:middle line:84% and then compute the low-degree extension. 00:26:18.850 --> 00:26:19.900 align:middle line:84% And the only way you can do something 00:26:19.900 --> 00:26:20.935 align:middle line:84% with the low-degree extension-- if you 00:26:20.935 --> 00:26:22.570 align:middle line:90% know everything in the coding. 00:26:22.570 --> 00:26:29.433 align:middle line:90% Otherwise-- yeah Yeah. 00:26:29.433 --> 00:26:30.100 align:middle line:90% AUDIENCE: Sorry. 00:26:30.100 --> 00:26:31.058 align:middle line:90% I just have a question. 00:26:31.058 --> 00:26:33.580 align:middle line:84% Before you [? have ?] issues, is it obvious 00:26:33.580 --> 00:26:36.540 align:middle line:84% that the verifier can compute like add and mult tilde, given 00:26:36.540 --> 00:26:39.120 align:middle line:90% that you can add, but like--? 00:26:39.120 --> 00:26:40.740 align:middle line:90% RACHEL ZHANG: Good, good. 00:26:40.740 --> 00:26:41.350 align:middle line:90% AUDIENCE: Oh, is that the issue? 00:26:41.350 --> 00:26:41.970 align:middle line:90% RACHEL ZHANG: Yeah. 00:26:41.970 --> 00:26:42.470 align:middle line:90% So-- 00:26:42.470 --> 00:26:43.758 align:middle line:90% AUDIENCE: [LAUGHS] 00:26:43.758 --> 00:26:52.018 align:middle line:90% 00:26:52.018 --> 00:26:52.810 align:middle line:90% RACHEL ZHANG: Yeah. 00:26:52.810 --> 00:26:54.250 align:middle line:84% So Nikon's question is, how do you 00:26:54.250 --> 00:26:56.950 align:middle line:84% compute the low-degree extension of add and mult? 00:26:56.950 --> 00:26:59.680 align:middle line:84% Right now, I've only given you a Boolean formula to compute them. 00:26:59.680 --> 00:27:02.115 align:middle line:84% So you can compute the values on the hypercube, 00:27:02.115 --> 00:27:03.490 align:middle line:84% but you can't necessarily compute 00:27:03.490 --> 00:27:05.170 align:middle line:90% the logic extensions of them. 00:27:05.170 --> 00:27:07.640 align:middle line:84% So we're going to see how to fix both of these things. 00:27:07.640 --> 00:27:10.140 align:middle line:84% And hopefully, if I'm honest, these are the only two issues. 00:27:10.140 --> 00:27:11.070 align:middle line:90% So we'll see. 00:27:11.070 --> 00:27:13.820 align:middle line:90% 00:27:13.820 --> 00:27:14.905 align:middle line:90% Is this OK so far? 00:27:14.905 --> 00:27:32.165 align:middle line:90% 00:27:32.165 --> 00:27:35.390 align:middle line:84% So issue one-- the input is now all 00:27:35.390 --> 00:27:37.620 align:middle line:84% of the circuit, plus the original input, 00:27:37.620 --> 00:27:39.807 align:middle line:90% so it's very large. 00:27:39.807 --> 00:27:41.390 align:middle line:84% So right now, this is what our circuit 00:27:41.390 --> 00:27:48.300 align:middle line:84% looks like-- is U. Big part is C And small part is x. 00:27:48.300 --> 00:27:51.260 align:middle line:84% So here's when the logspace uniformity of C 00:27:51.260 --> 00:27:52.120 align:middle line:90% is going to come in. 00:27:52.120 --> 00:27:56.120 align:middle line:90% 00:27:56.120 --> 00:27:58.880 align:middle line:84% So if you ever read GKR statements, 00:27:58.880 --> 00:28:01.160 align:middle line:84% the theorem only holds for when C 00:28:01.160 --> 00:28:03.320 align:middle line:84% is logspace-uniform, which means that there's 00:28:03.320 --> 00:28:04.945 align:middle line:90% some small description of it. 00:28:04.945 --> 00:28:08.900 align:middle line:90% 00:28:08.900 --> 00:28:18.630 align:middle line:84% So some small log S size description of C. 00:28:18.630 --> 00:28:23.400 align:middle line:84% And maybe let's call this description this. 00:28:23.400 --> 00:28:25.770 align:middle line:90% And this is Turing machine M-- 00:28:25.770 --> 00:28:29.530 align:middle line:90% 00:28:29.530 --> 00:28:34.610 align:middle line:84% that, basically, if it reads in this description, 00:28:34.610 --> 00:28:38.910 align:middle line:84% it can then output like the entire circuit C. 00:28:38.910 --> 00:28:45.970 align:middle line:84% And this Turing machine should run in logspace. 00:28:45.970 --> 00:28:47.790 align:middle line:84% But it can run for as much as S time. 00:28:47.790 --> 00:28:55.270 align:middle line:90% 00:28:55.270 --> 00:28:56.940 align:middle line:90% So C is too big. 00:28:56.940 --> 00:28:57.700 align:middle line:90% Yeah. 00:28:57.700 --> 00:28:59.560 align:middle line:90% AUDIENCE: So M is, like, fixed. 00:28:59.560 --> 00:29:00.820 align:middle line:90% RACHEL ZHANG: Yeah, M is-- 00:29:00.820 --> 00:29:02.510 align:middle line:84% yeah, it's just a-- it's fixed Turing machine. 00:29:02.510 --> 00:29:03.010 align:middle line:90% Yeah. 00:29:03.010 --> 00:29:06.080 align:middle line:90% 00:29:06.080 --> 00:29:06.580 align:middle line:90% Yeah. 00:29:06.580 --> 00:29:09.080 align:middle line:84% AUDIENCE: Just to make sure, intuitively, why this matters-- 00:29:09.080 --> 00:29:10.610 align:middle line:84% it's because C has to have, somehow, 00:29:10.610 --> 00:29:13.940 align:middle line:84% nice structure for it to be defined on inputs of different 00:29:13.940 --> 00:29:15.740 align:middle line:90% lengths and stuff-- 00:29:15.740 --> 00:29:18.125 align:middle line:90% being non-uniform? 00:29:18.125 --> 00:29:20.750 align:middle line:84% RACHEL ZHANG: I think one main thing is that the verifier needs 00:29:20.750 --> 00:29:25.030 align:middle line:84% to be able to know what C is because like in order to get get 00:29:25.030 --> 00:29:26.520 align:middle line:84% on the circuit C for the verifier, 00:29:26.520 --> 00:29:29.370 align:middle line:84% they need to have some way of describing the circuit, 00:29:29.370 --> 00:29:30.270 align:middle line:90% in some sense. 00:29:30.270 --> 00:29:33.980 align:middle line:84% This is basically saying, the circuit has to be like log size 00:29:33.980 --> 00:29:36.980 align:middle line:84% so that the verifier can hold it and have some way of knowing 00:29:36.980 --> 00:29:38.648 align:middle line:90% what circuit C is. 00:29:38.648 --> 00:29:40.190 align:middle line:84% AUDIENCE: I guess I'm trying to think 00:29:40.190 --> 00:29:42.530 align:middle line:84% about what kinds of circuits are excluded by this-- 00:29:42.530 --> 00:29:45.440 align:middle line:84% circuits that-- basically, you have to write out all-- 00:29:45.440 --> 00:29:47.180 align:middle line:84% the entire truth table to describe. 00:29:47.180 --> 00:29:48.950 align:middle line:84% Is that what we're trying to get rid of? 00:29:48.950 --> 00:29:51.990 align:middle line:84% RACHEL ZHANG: So I think Ted is our local complexity theorist, 00:29:51.990 --> 00:29:52.760 align:middle line:90% so I'm going to-- 00:29:52.760 --> 00:29:53.720 align:middle line:84% AUDIENCE: This is the door I want. 00:29:53.720 --> 00:29:55.178 align:middle line:84% Basically, the circuit [INAUDIBLE]. 00:29:55.178 --> 00:29:58.270 align:middle line:90% [INTERPOSING VOICES] 00:29:58.270 --> 00:29:59.977 align:middle line:90% AUDIENCE: OK. 00:29:59.977 --> 00:30:01.810 align:middle line:84% AUDIENCE: You can't hardcode things, though. 00:30:01.810 --> 00:30:04.010 align:middle line:84% You can't hardcode a random string or something like that. 00:30:04.010 --> 00:30:04.677 align:middle line:90% AUDIENCE: Right. 00:30:04.677 --> 00:30:07.370 align:middle line:90% 00:30:07.370 --> 00:30:09.728 align:middle line:84% AUDIENCE: Yeah, [INAUDIBLE] circuit [INAUDIBLE]. 00:30:09.728 --> 00:30:13.810 align:middle line:90% 00:30:13.810 --> 00:30:15.070 align:middle line:90% RACHEL ZHANG: So C is large. 00:30:15.070 --> 00:30:17.890 align:middle line:84% And the problem was that reading this entire thing is too much. 00:30:17.890 --> 00:30:20.440 align:middle line:84% But we have a short description of C. 00:30:20.440 --> 00:30:25.605 align:middle line:84% So let's also, maybe, have a circuit that computes C. Maybe 00:30:25.605 --> 00:30:26.980 align:middle line:84% we'll call this M just because we 00:30:26.980 --> 00:30:29.563 align:middle line:84% have a Turing machine called M, but it's not a Turing machine. 00:30:29.563 --> 00:30:30.250 align:middle line:90% It's a circuit. 00:30:30.250 --> 00:30:34.330 align:middle line:84% And this circuit will take, as input, the description C, 00:30:34.330 --> 00:30:36.640 align:middle line:84% with the things around it, and then it 00:30:36.640 --> 00:30:39.520 align:middle line:84% will output the entire circuit description. 00:30:39.520 --> 00:30:40.780 align:middle line:84% And that will feed into the universal gate universal K ?] 00:30:40.780 --> 00:30:41.863 align:middle line:90% that we just talked about. 00:30:41.863 --> 00:30:44.640 align:middle line:90% 00:30:44.640 --> 00:30:47.570 align:middle line:84% So this circuit here is our circuit C prime 00:30:47.570 --> 00:30:49.440 align:middle line:84% that we will actually be delegating on. 00:30:49.440 --> 00:30:56.590 align:middle line:90% 00:30:56.590 --> 00:30:58.820 align:middle line:84% And just to be clear, which ones are the inputs? 00:30:58.820 --> 00:31:00.580 align:middle line:90% The inputs are this-- 00:31:00.580 --> 00:31:02.750 align:middle line:84% this description of z and also x. 00:31:02.750 --> 00:31:05.620 align:middle line:84% Like, this entire C here is now wrapped into the circuit. 00:31:05.620 --> 00:31:07.060 align:middle line:90% Yeah. 00:31:07.060 --> 00:31:08.650 align:middle line:84% AUDIENCE: I put the notation-- like M, 00:31:08.650 --> 00:31:12.890 align:middle line:84% parentheses, bracket C equals C. So what do you mean by equal C? 00:31:12.890 --> 00:31:13.390 align:middle line:90% Like-- 00:31:13.390 --> 00:31:13.650 align:middle line:90% RACHEL ZHANG: Yeah. 00:31:13.650 --> 00:31:15.250 align:middle line:84% AUDIENCE: --is there some other description of the circuit, 00:31:15.250 --> 00:31:17.800 align:middle line:84% or would say the Turing machine is able to run 00:31:17.800 --> 00:31:20.170 align:middle line:90% the circuit on any [INAUDIBLE]? 00:31:20.170 --> 00:31:24.070 align:middle line:84% RACHEL ZHANG: So it will run on log S space and up to S time, 00:31:24.070 --> 00:31:26.403 align:middle line:84% and then it can output any gate of the circuit you want. 00:31:26.403 --> 00:31:27.528 align:middle line:90% AUDIENCE: Any gate of the-- 00:31:27.528 --> 00:31:29.920 align:middle line:84% RACHEL ZHANG: Yeah, and maybe if you have an output here 00:31:29.920 --> 00:31:32.427 align:middle line:84% that's separate from its actual space that you can compute 00:31:32.427 --> 00:31:35.860 align:middle line:84% on compute on, ?] you can just output the gate by one. 00:31:35.860 --> 00:31:37.000 align:middle line:90% AUDIENCE: Oh, OK. 00:31:37.000 --> 00:31:39.548 align:middle line:84% So you say equal C means find the gate. 00:31:39.548 --> 00:31:40.340 align:middle line:90% RACHEL ZHANG: Sure. 00:31:40.340 --> 00:31:40.960 align:middle line:90% Yeah. 00:31:40.960 --> 00:31:43.390 align:middle line:84% I'll put in the description of C, 00:31:43.390 --> 00:31:47.040 align:middle line:84% or description of the gates of C So output gates. 00:31:47.040 --> 00:31:51.480 align:middle line:90% 00:31:51.480 --> 00:31:52.110 align:middle line:90% Yeah. 00:31:52.110 --> 00:31:53.527 align:middle line:84% AUDIENCE: If you're just unrolling 00:31:53.527 --> 00:31:55.458 align:middle line:90% M, isn't that really deep? 00:31:55.458 --> 00:31:56.500 align:middle line:90% RACHEL ZHANG: Good, good. 00:31:56.500 --> 00:31:57.280 align:middle line:90% OK, yeah. 00:31:57.280 --> 00:31:58.680 align:middle line:90% So what's the depth of this? 00:31:58.680 --> 00:32:01.500 align:middle line:84% So-- OK, M can run in time up to S. 00:32:01.500 --> 00:32:03.487 align:middle line:84% So this could, ostensibly, be depth S, which 00:32:03.487 --> 00:32:05.070 align:middle line:84% is bad because our verifier would have 00:32:05.070 --> 00:32:06.800 align:middle line:90% to depend on the depth also. 00:32:06.800 --> 00:32:09.660 align:middle line:90% 00:32:09.660 --> 00:32:12.150 align:middle line:84% Well, it turns out you can do it in depth log S. 00:32:12.150 --> 00:32:14.320 align:middle line:84% And I'm not going to tell you how to do it. 00:32:14.320 --> 00:32:16.153 align:middle line:84% You're going to tell me by the end of class. 00:32:16.153 --> 00:32:19.230 align:middle line:90% So that's the goal, by 3:00 PM. 00:32:19.230 --> 00:32:27.020 align:middle line:84% And this will also be size S. So we'll get there. 00:32:27.020 --> 00:32:28.897 align:middle line:84% But it'll be your job to convince me. 00:32:28.897 --> 00:32:30.230 align:middle line:90% It's not my job to convince you. 00:32:30.230 --> 00:32:33.720 align:middle line:90% 00:32:33.720 --> 00:32:34.220 align:middle line:90% Cool. 00:32:34.220 --> 00:32:34.803 align:middle line:90% Anything else? 00:32:34.803 --> 00:32:35.420 align:middle line:90% Yeah. 00:32:35.420 --> 00:32:37.350 align:middle line:84% AUDIENCE: How do you turn this Turing machine into a circuit? 00:32:37.350 --> 00:32:37.520 align:middle line:90% RACHEL ZHANG: Good. 00:32:37.520 --> 00:32:38.020 align:middle line:90% OK. 00:32:38.020 --> 00:32:38.940 align:middle line:90% You'll tell me. 00:32:38.940 --> 00:32:43.640 align:middle line:90% 00:32:43.640 --> 00:32:45.910 align:middle line:84% It's the weekend, so the weekend don't worry. 00:32:45.910 --> 00:32:48.410 align:middle line:84% I think you'll be able to figure it out at the end of class. 00:32:48.410 --> 00:32:54.620 align:middle line:90% 00:32:54.620 --> 00:32:57.440 align:middle line:84% And then the other claim is that this is-- 00:32:57.440 --> 00:32:59.340 align:middle line:90% has easy add and mult gates. 00:32:59.340 --> 00:33:02.840 align:middle line:84% And also-- you'll also tell me that by the end of class. 00:33:02.840 --> 00:33:04.490 align:middle line:84% So basically, the circuit is going 00:33:04.490 --> 00:33:06.198 align:middle line:84% to have all the nice properties you want. 00:33:06.198 --> 00:33:08.840 align:middle line:84% It's going to be depth, log S size S. The whole circuit-- now, 00:33:08.840 --> 00:33:12.500 align:middle line:84% C prime is going to be size poly S because it was also size poly 00:33:12.500 --> 00:33:19.410 align:middle line:84% S. This should probably be poly S, not just size S. 00:33:19.410 --> 00:33:22.865 align:middle line:84% And then total depth is going to be, like, poly log S. So-- yeah. 00:33:22.865 --> 00:33:24.740 align:middle line:84% AUDIENCE: The statement is, like, truth table 00:33:24.740 --> 00:33:27.050 align:middle line:90% of M on C equals C-- 00:33:27.050 --> 00:33:30.821 align:middle line:84% on bracket C equals C. So do we need 00:33:30.821 --> 00:33:33.548 align:middle line:84% size of C different copies of M [INAUDIBLE] bits? 00:33:33.548 --> 00:33:34.340 align:middle line:90% RACHEL ZHANG: Sure. 00:33:34.340 --> 00:33:34.960 align:middle line:90% Yeah, yeah. 00:33:34.960 --> 00:33:35.460 align:middle line:90% Sure. 00:33:35.460 --> 00:33:36.740 align:middle line:84% AUDIENCE: [INAUDIBLE] all of them? 00:33:36.740 --> 00:33:36.950 align:middle line:90% OK. 00:33:36.950 --> 00:33:37.742 align:middle line:90% RACHEL ZHANG: Sure. 00:33:37.742 --> 00:33:39.020 align:middle line:90% Yeah or you can think-- 00:33:39.020 --> 00:33:41.810 align:middle line:84% it's a thing-- you can have an output tape, where you can just 00:33:41.810 --> 00:33:43.740 align:middle line:84% output everything to, or another thing. 00:33:43.740 --> 00:33:44.450 align:middle line:90% AUDIENCE: Yeah. 00:33:44.450 --> 00:33:44.950 align:middle line:90% Yeah. 00:33:44.950 --> 00:33:48.458 align:middle line:84% I just-- I want to make sure that it doesn't break. 00:33:48.458 --> 00:33:49.250 align:middle line:90% RACHEL ZHANG: Yeah. 00:33:49.250 --> 00:33:50.910 align:middle line:84% AUDIENCE: No, it doesn't break [INAUDIBLE] for me either. 00:33:50.910 --> 00:33:52.220 align:middle line:90% You can take it [INAUDIBLE]. 00:33:52.220 --> 00:33:53.720 align:middle line:90% RACHEL ZHANG: OK, yeah. 00:33:53.720 --> 00:33:55.803 align:middle line:84% AUDIENCE: You might have just said this, actually, 00:33:55.803 --> 00:33:58.490 align:middle line:84% but [INAUDIBLE] on the line that says log S size description 00:33:58.490 --> 00:33:59.570 align:middle line:90% of C-- 00:33:59.570 --> 00:34:00.450 align:middle line:90% like, C in brackets. 00:34:00.450 --> 00:34:01.650 align:middle line:90% Like, C in brackets is a string. 00:34:01.650 --> 00:34:03.233 align:middle line:84% It's not actually, like, log S, right? 00:34:03.233 --> 00:34:05.940 align:middle line:84% It's, like-- S or something, isn't it? 00:34:05.940 --> 00:34:06.440 align:middle line:90% Or-- 00:34:06.440 --> 00:34:08.565 align:middle line:84% RACHEL ZHANG: No, this is going to be a log S size. 00:34:08.565 --> 00:34:12.370 align:middle line:90% 00:34:12.370 --> 00:34:14.949 align:middle line:84% So the circuit C is size S, but there's 00:34:14.949 --> 00:34:18.130 align:middle line:84% a short description that can tell you what circuit C is 00:34:18.130 --> 00:34:20.592 align:middle line:90% going to look like. 00:34:20.592 --> 00:34:22.550 align:middle line:84% AUDIENCE: I guess we got a family of circuits-- 00:34:22.550 --> 00:34:23.900 align:middle line:90% like, C1 through CM. 00:34:23.900 --> 00:34:26.449 align:middle line:84% The description could be, like, the number n that you 00:34:26.449 --> 00:34:28.719 align:middle line:90% should print or something. 00:34:28.719 --> 00:34:29.808 align:middle line:90% Like a copy of that. 00:34:29.808 --> 00:34:30.600 align:middle line:90% RACHEL ZHANG: Sure. 00:34:30.600 --> 00:34:31.100 align:middle line:90% Yeah. 00:34:31.100 --> 00:34:32.780 align:middle line:84% AUDIENCE: Then why is that tree there? 00:34:32.780 --> 00:34:39.206 align:middle line:84% That log S-- wouldn't the number of leaves just be S? 00:34:39.206 --> 00:34:40.050 align:middle line:90% [INAUDIBLE] M tree. 00:34:40.050 --> 00:34:42.050 align:middle line:84% RACHEL ZHANG: So this description is size log S, 00:34:42.050 --> 00:34:46.190 align:middle line:84% so this entire thing here is log-S size. 00:34:46.190 --> 00:34:50.037 align:middle line:84% AUDIENCE: Isn't that a full [INAUDIBLE]? 00:34:50.037 --> 00:34:52.204 align:middle line:84% RACHEL ZHANG: I guess it goes like this, more than-- 00:34:52.204 --> 00:34:53.393 align:middle line:90% yes, Alex. 00:34:53.393 --> 00:34:55.653 align:middle line:90% [INTERPOSING VOICES] 00:34:55.653 --> 00:34:56.060 align:middle line:90% 00:34:56.060 --> 00:34:58.060 align:middle line:84% AUDIENCE: Yes, because this is [INAUDIBLE] log S 00:34:58.060 --> 00:35:00.080 align:middle line:84% and [INAUDIBLE] size log S. It's roughly [? one ?] [? or ?] 00:35:00.080 --> 00:35:01.043 align:middle line:90% [? two ?] [? things. ?] 00:35:01.043 --> 00:35:03.626 align:middle line:84% AUDIENCE: [INAUDIBLE] circuit that everyone could [INAUDIBLE]. 00:35:03.626 --> 00:35:05.928 align:middle line:90% 00:35:05.928 --> 00:35:07.220 align:middle line:90% AUDIENCE: There are conditions. 00:35:07.220 --> 00:35:09.088 align:middle line:90% [INAUDIBLE] 00:35:09.088 --> 00:35:11.130 align:middle line:84% AUDIENCE: But we don't know how to unroll it yet. 00:35:11.130 --> 00:35:12.865 align:middle line:84% When we unroll it, we might [INAUDIBLE]. 00:35:12.865 --> 00:35:21.430 align:middle line:90% 00:35:21.430 --> 00:35:22.780 align:middle line:90% RACHEL ZHANG: Cool. 00:35:22.780 --> 00:35:25.480 align:middle line:84% OK, so the claim is given the circuit 00:35:25.480 --> 00:35:29.750 align:middle line:84% and given all these properties you can prove to me later about, 00:35:29.750 --> 00:35:32.750 align:middle line:90% then you can do GKR. 00:35:32.750 --> 00:35:34.450 align:middle line:90% So according to our-- 00:35:34.450 --> 00:35:35.180 align:middle line:90% I put it behind. 00:35:35.180 --> 00:35:36.390 align:middle line:90% I should push it forward. 00:35:36.390 --> 00:35:38.140 align:middle line:84% So the prover is going to run in time poly 00:35:38.140 --> 00:35:40.900 align:middle line:84% S, where S is the size of this new circuit, C prime. 00:35:40.900 --> 00:35:42.920 align:middle line:84% This is size poly S. This is size poly. 00:35:42.920 --> 00:35:47.170 align:middle line:84% So everything is poly S, and poly of polys, polys of poly S 00:35:47.170 --> 00:35:48.700 align:middle line:90% for the prover. 00:35:48.700 --> 00:35:52.510 align:middle line:84% And the verifier is the depth of the circuit, plus the input 00:35:52.510 --> 00:35:54.670 align:middle line:90% length. 00:35:54.670 --> 00:35:56.650 align:middle line:84% Steps here-- this is going to be, like-- 00:35:56.650 --> 00:35:59.050 align:middle line:84% I think we said it was, basically, 00:35:59.050 --> 00:36:00.820 align:middle line:84% depth of the original circuit times log. 00:36:00.820 --> 00:36:02.540 align:middle line:84% And this is going to be really small. 00:36:02.540 --> 00:36:04.623 align:middle line:84% It's going to be, like, log S So it's going to be, 00:36:04.623 --> 00:36:07.090 align:middle line:84% overall, the same depth of the original circuit. 00:36:07.090 --> 00:36:09.383 align:middle line:84% And then the input size is now log S plus n. 00:36:09.383 --> 00:36:10.800 align:middle line:84% So it's not so much bigger either. 00:36:10.800 --> 00:36:22.810 align:middle line:90% 00:36:22.810 --> 00:36:24.430 align:middle line:90% OK, input. 00:36:24.430 --> 00:36:26.717 align:middle line:90% Maybe-- yeah, OK. 00:36:26.717 --> 00:36:28.550 align:middle line:84% So the second issue that Nikon pointed out-- 00:36:28.550 --> 00:36:31.720 align:middle line:84% how do you compute the low-degree extensions of the add 00:36:31.720 --> 00:36:34.730 align:middle line:84% and mult gates, whereas we only currently have Boolean formulas 00:36:34.730 --> 00:36:36.422 align:middle line:90% that compute them on the-- 00:36:36.422 --> 00:36:38.630 align:middle line:84% I guess, in this case, it's even a Boolean hypercube. 00:36:38.630 --> 00:36:40.130 align:middle line:90% It's not even the h- hypercube. 00:36:40.130 --> 00:36:40.630 align:middle line:90% Yeah. 00:36:40.630 --> 00:36:41.130 align:middle line:90% Yeah. 00:36:41.130 --> 00:36:41.630 align:middle line:90% AUDIENCE: [? 00:36:41.630 --> 00:36:43.900 align:middle line:84% Wait, I got another ?] [? question. ?] [INAUDIBLE] 00:36:43.900 --> 00:36:46.900 align:middle line:84% So the idea here was you wanted to ultimately get the bottom 00:36:46.900 --> 00:36:49.270 align:middle line:90% layer to be size small? 00:36:49.270 --> 00:36:51.670 align:middle line:84% But still, this middle layer that you get to that 00:36:51.670 --> 00:36:54.000 align:middle line:84% has C written on it when you run the algorithm. 00:36:54.000 --> 00:36:55.000 align:middle line:90% That's big. 00:36:55.000 --> 00:36:57.280 align:middle line:84% So at some point, you have to be able to get 00:36:57.280 --> 00:36:59.368 align:middle line:84% low-degree evaluations in this middle layer? 00:36:59.368 --> 00:37:00.910 align:middle line:84% RACHEL ZHANG: The prover would do it. 00:37:00.910 --> 00:37:02.653 align:middle line:90% You would never have to do it. 00:37:02.653 --> 00:37:03.320 align:middle line:90% AUDIENCE: I see. 00:37:03.320 --> 00:37:06.020 align:middle line:90% 00:37:06.020 --> 00:37:08.450 align:middle line:84% So the GKR-- the protocol we had last time 00:37:08.450 --> 00:37:10.580 align:middle line:84% was only for circuits with extensions 00:37:10.580 --> 00:37:11.870 align:middle line:90% that get smaller, right? 00:37:11.870 --> 00:37:13.700 align:middle line:84% RACHEL ZHANG: [INAUDIBLE] Doesn't 00:37:13.700 --> 00:37:15.410 align:middle line:84% matter, because what-- the way I did 00:37:15.410 --> 00:37:18.683 align:middle line:84% is she extended every layer to size S anyway. 00:37:18.683 --> 00:37:20.100 align:middle line:84% So even if it wasn't S originally, 00:37:20.100 --> 00:37:22.160 align:middle line:90% she extended it to be big. 00:37:22.160 --> 00:37:24.710 align:middle line:84% So I think, sometimes, S can be viewed as an upper bound 00:37:24.710 --> 00:37:25.930 align:middle line:90% of each layer size, also. 00:37:25.930 --> 00:37:32.100 align:middle line:90% 00:37:32.100 --> 00:37:36.257 align:middle line:84% So second issue-- how do we compute add and mult? 00:37:36.257 --> 00:37:38.590 align:middle line:84% So we have-- let me just write down what I put up there. 00:37:38.590 --> 00:37:39.382 align:middle line:90% I can push this up. 00:37:39.382 --> 00:37:43.055 align:middle line:84% So we have these two Boolean formulas. 00:37:43.055 --> 00:38:04.565 align:middle line:90% 00:38:04.565 --> 00:38:06.190 align:middle line:84% And it's going to compute add and mult. 00:38:06.190 --> 00:38:07.890 align:middle line:84% This doesn't have a go on top because it's not a low-degree ?] 00:38:07.890 --> 00:38:08.590 align:middle line:90% extension. 00:38:08.590 --> 00:38:32.270 align:middle line:90% 00:38:32.270 --> 00:38:34.500 align:middle line:84% So, So this ?] is what phi of add looks like. 00:38:34.500 --> 00:38:37.540 align:middle line:84% It's a Boolean formula, so it's, like, a big tree. 00:38:37.540 --> 00:38:38.290 align:middle line:90% Not big, actually. 00:38:38.290 --> 00:38:39.207 align:middle line:90% It's very small trees. 00:38:39.207 --> 00:38:41.570 align:middle line:90% It's, like, polylog size. 00:38:41.570 --> 00:38:43.660 align:middle line:90% I know output at the end. 00:38:43.660 --> 00:38:47.600 align:middle line:90% 00:38:47.600 --> 00:38:50.990 align:middle line:90% Yeah, what you're like-- 00:38:50.990 --> 00:38:53.750 align:middle line:84% yeah, out of b1 option something. 00:38:53.750 --> 00:38:57.130 align:middle line:84% So here's-- the inputs are all bits. 00:38:57.130 --> 00:38:59.315 align:middle line:84% So it's going to be 0, 1 to the-- 00:38:59.315 --> 00:39:01.860 align:middle line:90% 00:39:01.860 --> 00:39:03.835 align:middle line:84% I guess this should be taking as input. 00:39:03.835 --> 00:39:04.960 align:middle line:90% So the size of the circuit. 00:39:04.960 --> 00:39:07.230 align:middle line:84% And telling you whether or not that particular gate 00:39:07.230 --> 00:39:08.605 align:middle line:84% is add or mult gate, so it should 00:39:08.605 --> 00:39:13.972 align:middle line:84% be like size of like log n of the size of the C prime. 00:39:13.972 --> 00:39:15.080 align:middle line:90% So this should be-- 00:39:15.080 --> 00:39:25.430 align:middle line:90% 00:39:25.430 --> 00:39:25.930 align:middle line:90% OK. 00:39:25.930 --> 00:39:28.990 align:middle line:90% 00:39:28.990 --> 00:39:29.490 align:middle line:90% Cool. 00:39:29.490 --> 00:39:31.233 align:middle line:90% And our goal is to compute-- 00:39:31.233 --> 00:39:38.110 align:middle line:90% 00:39:38.110 --> 00:39:40.780 align:middle line:90% and so, here, we have-- 00:39:40.780 --> 00:39:44.560 align:middle line:84% H is going to be an H. And so here, M 00:39:44.560 --> 00:39:54.237 align:middle line:90% is log base H of S prime. 00:39:54.237 --> 00:39:56.320 align:middle line:84% So this is what we want, and this is what we have. 00:39:56.320 --> 00:40:00.350 align:middle line:90% 00:40:00.350 --> 00:40:01.698 align:middle line:90% I want to repeat again. 00:40:01.698 --> 00:40:03.240 align:middle line:84% This is not the low-degree extension. 00:40:03.240 --> 00:40:05.160 align:middle line:84% This is going to be a low-degree extension. 00:40:05.160 --> 00:40:07.770 align:middle line:90% 00:40:07.770 --> 00:40:14.530 align:middle line:84% So what do we do for sharp set or sharpie Do you guys remember? 00:40:14.530 --> 00:40:15.090 align:middle line:90% Yeah. 00:40:15.090 --> 00:40:15.420 align:middle line:90% AUDIENCE: Sorry. 00:40:15.420 --> 00:40:16.380 align:middle line:90% One more question. 00:40:16.380 --> 00:40:18.420 align:middle line:84% Is a low-degree extension-- but aren't 00:40:18.420 --> 00:40:20.820 align:middle line:90% low-degree extensions unique? 00:40:20.820 --> 00:40:24.550 align:middle line:84% RACHEL ZHANG: So it's a extension that has low degree, 00:40:24.550 --> 00:40:25.540 align:middle line:90% but it's not that low. 00:40:25.540 --> 00:40:26.280 align:middle line:90% It's, like, somewhat low. 00:40:26.280 --> 00:40:27.280 align:middle line:90% It's low to [INAUDIBLE]. 00:40:27.280 --> 00:40:29.860 align:middle line:84% AUDIENCE: So we're talking about just extension [INAUDIBLE]. 00:40:29.860 --> 00:40:30.660 align:middle line:90% RACHEL ZHANG: Yeah. 00:40:30.660 --> 00:40:32.452 align:middle line:84% And it's not going to be the lowest degree, 00:40:32.452 --> 00:40:34.600 align:middle line:84% but it will have low enough degree We 00:40:34.600 --> 00:40:35.850 align:middle line:90% can call it low enough degree. 00:40:35.850 --> 00:40:36.350 align:middle line:90% [LAUGHTER] 00:40:36.350 --> 00:40:39.820 align:middle line:84% Yeah, low enough degree extension. 00:40:39.820 --> 00:40:45.312 align:middle line:90% 00:40:45.312 --> 00:40:47.663 align:middle line:90% So you can call this the LEID. 00:40:47.663 --> 00:40:51.298 align:middle line:90% [LAUGHTER] 00:40:51.298 --> 00:40:57.770 align:middle line:90% 00:40:57.770 --> 00:40:58.270 align:middle line:90% OK. 00:40:58.270 --> 00:40:59.810 align:middle line:84% So it's not going to be the low-degree extension, 00:40:59.810 --> 00:41:00.970 align:middle line:90% but it will be kind of. 00:41:00.970 --> 00:41:03.250 align:middle line:90% It'll be OK. 00:41:03.250 --> 00:41:06.063 align:middle line:84% So what did we do for sharpie the other-- 00:41:06.063 --> 00:41:06.980 align:middle line:90% like, the first class. 00:41:06.980 --> 00:41:10.510 align:middle line:84% This is, like, going three weeks ago. 00:41:10.510 --> 00:41:12.580 align:middle line:84% The idea there, we took a Boolean formula-- 00:41:12.580 --> 00:41:15.085 align:middle line:90% or a formula, right? 00:41:15.085 --> 00:41:16.460 align:middle line:84% OK, let me maybe jog your memory. 00:41:16.460 --> 00:41:20.080 align:middle line:84% So the idea was you want to count the number of satisfied 00:41:20.080 --> 00:41:22.690 align:middle line:90% equations through some of CSP. 00:41:22.690 --> 00:41:26.350 align:middle line:84% You first turn this into some Boolean formula. 00:41:26.350 --> 00:41:29.507 align:middle line:90% And then you do something to it. 00:41:29.507 --> 00:41:31.340 align:middle line:84% And then you can apply the subject protocol. 00:41:31.340 --> 00:41:32.640 align:middle line:90% So what do you do in the middle? 00:41:32.640 --> 00:41:33.170 align:middle line:90% AUDIENCE: Arithmetize. 00:41:33.170 --> 00:41:34.253 align:middle line:90% RACHEL ZHANG: Arithmetize. 00:41:34.253 --> 00:41:35.785 align:middle line:90% Let's arithmetize is this thing. 00:41:35.785 --> 00:41:37.410 align:middle line:84% So maybe, first, before we arithmetize, 00:41:37.410 --> 00:41:38.930 align:middle line:84% we should change the input formats. 00:41:38.930 --> 00:41:40.138 align:middle line:90% So over here, we have h here. 00:41:40.138 --> 00:41:42.170 align:middle line:90% We have Boolean, like 0, 1. 00:41:42.170 --> 00:41:43.820 align:middle line:84% But what you can do is you can just 00:41:43.820 --> 00:41:47.240 align:middle line:90% take maybe a chunk of size-- 00:41:47.240 --> 00:41:48.990 align:middle line:84% sorry, this is a like really minor detail. 00:41:48.990 --> 00:41:50.460 align:middle line:90% I think-- it's fine. 00:41:50.460 --> 00:41:51.500 align:middle line:90% Let's do it anyway. 00:41:51.500 --> 00:41:52.930 align:middle line:90% So this is going to be size-- 00:41:52.930 --> 00:41:55.570 align:middle line:90% 00:41:55.570 --> 00:41:57.050 align:middle line:90% log of size of h. 00:41:57.050 --> 00:41:59.560 align:middle line:84% And then-- so this is how many bits are going to be here. 00:41:59.560 --> 00:42:01.030 align:middle line:90% And you're going to take h. 00:42:01.030 --> 00:42:04.900 align:middle line:84% And you can convert it via some polynomial. 00:42:04.900 --> 00:42:11.330 align:middle line:84% It's going to be a degree h minus 1 poly. 00:42:11.330 --> 00:42:16.040 align:middle line:84% It's going to convert any element, h, of your bigger 00:42:16.040 --> 00:42:20.608 align:middle line:90% set, capital H, to 0 string. 00:42:20.608 --> 00:42:22.150 align:middle line:84% And you can do this a bunch of times. 00:42:22.150 --> 00:42:31.640 align:middle line:90% 00:42:31.640 --> 00:42:36.920 align:middle line:84% So now we have this weird thing where you're feeding in h, 00:42:36.920 --> 00:42:41.450 align:middle line:84% and then you can use a degree like h polynomial to convert it 00:42:41.450 --> 00:42:42.900 align:middle line:90% to 0, 1s. 00:42:42.900 --> 00:42:45.320 align:middle line:84% And then now you can feed it into this Boolean formula. 00:42:45.320 --> 00:42:48.620 align:middle line:84% And for this part, we're going to just arithmetize it. 00:42:48.620 --> 00:42:51.170 align:middle line:84% So with arithmetizing-- just to recall. 00:42:51.170 --> 00:42:58.190 align:middle line:84% So arithmetizing is you can take an and gate 00:42:58.190 --> 00:43:01.310 align:middle line:84% and replace it with the polynomial-- a plus b 00:43:01.310 --> 00:43:03.530 align:middle line:90% minus a times b. 00:43:03.530 --> 00:43:07.340 align:middle line:84% And then-- sorry, this is-- should be in, not add. 00:43:07.340 --> 00:43:11.150 align:middle line:90% And then OR of a, b-- 00:43:11.150 --> 00:43:12.000 align:middle line:90% is this right? 00:43:12.000 --> 00:43:12.500 align:middle line:90% No. 00:43:12.500 --> 00:43:14.175 align:middle line:90% It's the way. 00:43:14.175 --> 00:43:19.110 align:middle line:84% This is a plus b minus a, b, and this is a times b. 00:43:19.110 --> 00:43:20.920 align:middle line:84% So every time there's a OR gate here, 00:43:20.920 --> 00:43:23.410 align:middle line:84% you can replace it by this polynomial. 00:43:23.410 --> 00:43:26.118 align:middle line:84% And if it's an AND gate, you can replace it with this polynomial. 00:43:26.118 --> 00:43:30.230 align:middle line:90% 00:43:30.230 --> 00:43:32.192 align:middle line:84% So maybe-- there's another lemma that Yael 00:43:32.192 --> 00:43:34.150 align:middle line:84% proved during the first class that-- maybe it's 00:43:34.150 --> 00:43:35.817 align:middle line:84% been too long to remember, but maybe you 00:43:35.817 --> 00:43:37.060 align:middle line:90% can try to rethink about it. 00:43:37.060 --> 00:43:39.940 align:middle line:84% So the question is, what is the degree 00:43:39.940 --> 00:43:43.220 align:middle line:84% of the final polynomial you get here when you arithmetize it? 00:43:43.220 --> 00:43:58.308 align:middle line:90% 00:43:58.308 --> 00:43:59.600 align:middle line:90% AUDIENCE: Is it 2 to the depth? 00:43:59.600 --> 00:44:01.243 align:middle line:90% [INAUDIBLE] 00:44:01.243 --> 00:44:02.660 align:middle line:84% RACHEL ZHANG: Yeah, yeah, exactly. 00:44:02.660 --> 00:44:04.270 align:middle line:84% So it's a number of input gates here. 00:44:04.270 --> 00:44:06.520 align:middle line:84% I think that's the way she said it in the first class. 00:44:06.520 --> 00:44:08.440 align:middle line:84% It was just a number of input gates, times-- 00:44:08.440 --> 00:44:10.315 align:middle line:84% I guess, here, you had to times by the degree 00:44:10.315 --> 00:44:13.390 align:middle line:84% of each thing you're feeding in, which is to be h minus 1. 00:44:13.390 --> 00:44:17.130 align:middle line:90% So it's going to be-- 00:44:17.130 --> 00:44:21.378 align:middle line:84% log S prime, which is the number of gates in the bottom, times-- 00:44:21.378 --> 00:44:22.920 align:middle line:84% let's just say h instead of h minus 1 00:44:22.920 --> 00:44:24.170 align:middle line:90% because it's a little shorter. 00:44:24.170 --> 00:44:26.990 align:middle line:90% 00:44:26.990 --> 00:44:29.390 align:middle line:84% So this is going to be the polynomial 00:44:29.390 --> 00:44:33.590 align:middle line:84% that we're going to use for add tilde and mult tilde. 00:44:33.590 --> 00:44:38.100 align:middle line:84% So it's not the low-degree extension but it's a good thing. 00:44:38.100 --> 00:44:38.600 align:middle line:90% Yeah. 00:44:38.600 --> 00:44:39.740 align:middle line:90% AUDIENCE: Is this is over-- 00:44:39.740 --> 00:44:40.700 align:middle line:90% just to be clear. 00:44:40.700 --> 00:44:42.090 align:middle line:90% The extension is over-- 00:44:42.090 --> 00:44:44.450 align:middle line:84% is that right, or is this over [INAUDIBLE]? 00:44:44.450 --> 00:44:46.408 align:middle line:84% RACHEL ZHANG: Yeah, so I guess what's happening 00:44:46.408 --> 00:44:50.130 align:middle line:84% is you're first converting your h over-- 00:44:50.130 --> 00:44:50.640 align:middle line:90% yeah. 00:44:50.640 --> 00:44:51.510 align:middle line:90% Sorry. 00:44:51.510 --> 00:44:52.113 align:middle line:90% Yeah. 00:44:52.113 --> 00:44:53.530 align:middle line:84% AUDIENCE: The way you've drawn it, 00:44:53.530 --> 00:44:56.880 align:middle line:84% it makes it seem like you're converting h into log h bits. 00:44:56.880 --> 00:44:59.167 align:middle line:84% What if I just want to convert it to a single? 00:44:59.167 --> 00:45:00.750 align:middle line:84% RACHEL ZHANG: So h is big. h is, like, 00:45:00.750 --> 00:45:03.580 align:middle line:84% 2 to the log h sort of information. 00:45:03.580 --> 00:45:07.410 align:middle line:84% Or-- maybe it's the wrong information. 00:45:07.410 --> 00:45:10.120 align:middle line:84% So h comes from this bigger set H. 00:45:10.120 --> 00:45:11.620 align:middle line:84% So you want to convert it to 0, 1 so 00:45:11.620 --> 00:45:13.328 align:middle line:84% you can feed it into the Boolean formula. 00:45:13.328 --> 00:45:14.950 align:middle line:84% Otherwise, it's not type-compatible. 00:45:14.950 --> 00:45:19.038 align:middle line:84% AUDIENCE: But the Boolean formula only takes in-- 00:45:19.038 --> 00:45:20.580 align:middle line:84% like, when you fix a Boolean formula, 00:45:20.580 --> 00:45:23.000 align:middle line:84% it has a bunch of inputs that are bits. 00:45:23.000 --> 00:45:27.830 align:middle line:84% But each bit-- you called them [INAUDIBLE]. 00:45:27.830 --> 00:45:31.940 align:middle line:84% So how do you plug in log h bits into an input 00:45:31.940 --> 00:45:33.112 align:middle line:90% that only have one bit? 00:45:33.112 --> 00:45:34.070 align:middle line:90% RACHEL ZHANG: OK, Yeah. 00:45:34.070 --> 00:45:37.460 align:middle line:84% So you can convert this into a number of bits. 00:45:37.460 --> 00:45:41.510 align:middle line:84% It's going to be log h many bits. 00:45:41.510 --> 00:45:44.630 align:middle line:84% AUDIENCE: The first log n [INAUDIBLE]. 00:45:44.630 --> 00:45:46.647 align:middle line:90% AUDIENCE: [INAUDIBLE] 00:45:46.647 --> 00:45:50.778 align:middle line:90% 00:45:50.778 --> 00:45:52.320 align:middle line:84% RACHEL ZHANG: Yeah, so the conversion 00:45:52.320 --> 00:45:54.610 align:middle line:84% isn't from one h symbol to one bit. 00:45:54.610 --> 00:45:56.920 align:middle line:84% It's going to be one h symbol to many bits. 00:45:56.920 --> 00:45:57.917 align:middle line:90% AUDIENCE: To many bits. 00:45:57.917 --> 00:45:58.750 align:middle line:90% RACHEL ZHANG: Right. 00:45:58.750 --> 00:46:01.793 align:middle line:90% Many is going to 1 h bits. 00:46:01.793 --> 00:46:03.210 align:middle line:84% AUDIENCE: I thought we just wanted 00:46:03.210 --> 00:46:06.112 align:middle line:84% to find a big argument in circuits 00:46:06.112 --> 00:46:10.247 align:middle line:84% is that when you evaluate it, when the h and r is 0 and 1, 00:46:10.247 --> 00:46:11.580 align:middle line:90% it's equivalent to the original. 00:46:11.580 --> 00:46:11.730 align:middle line:90% RACHEL ZHANG: OK. 00:46:11.730 --> 00:46:12.190 align:middle line:90% Yeah, sure. 00:46:12.190 --> 00:46:13.857 align:middle line:84% So if you want to keep this-- this in 0, 00:46:13.857 --> 00:46:16.170 align:middle line:84% 1 so you can have big set here H just be 0, 1, 00:46:16.170 --> 00:46:17.530 align:middle line:90% then this is just identity. 00:46:17.530 --> 00:46:18.990 align:middle line:84% You can just plug it straight in. 00:46:18.990 --> 00:46:20.640 align:middle line:90% I guess this conversion is-- 00:46:20.640 --> 00:46:22.410 align:middle line:90% I don't know. 00:46:22.410 --> 00:46:26.070 align:middle line:84% Yael called the thing based on whether H is like a bigger set. 00:46:26.070 --> 00:46:27.570 align:middle line:84% So I've just been converting it to H 00:46:27.570 --> 00:46:29.160 align:middle line:90% is pretty much that, basically. 00:46:29.160 --> 00:46:31.620 align:middle line:84% AUDIENCE: Oh, OK h is different than f. 00:46:31.620 --> 00:46:33.248 align:middle line:90% RACHEL ZHANG: Yeah. 00:46:33.248 --> 00:46:33.790 align:middle line:90% AUDIENCE: OK. 00:46:33.790 --> 00:46:41.258 align:middle line:90% 00:46:41.258 --> 00:46:43.800 align:middle line:84% AUDIENCE: So you're literally just saying arithmetize, right? 00:46:43.800 --> 00:46:46.290 align:middle line:84% RACHEL ZHANG: I'm literally just saying arithmetize, yeah. 00:46:46.290 --> 00:46:49.710 align:middle line:84% AUDIENCE: And it's still a deterministic procedure. 00:46:49.710 --> 00:46:51.675 align:middle line:84% So you'll get to some unique point, 00:46:51.675 --> 00:46:53.050 align:middle line:84% given the same [INAUDIBLE] point, 00:46:53.050 --> 00:46:54.842 align:middle line:84% but it's just not the low-degree extension. 00:46:54.842 --> 00:46:56.430 align:middle line:90% RACHEL ZHANG: Yeah. 00:46:56.430 --> 00:46:58.590 align:middle line:84% But it's low enough degree, which 00:46:58.590 --> 00:47:01.182 align:middle line:84% is going to be the number here, because if it 00:47:01.182 --> 00:47:04.090 align:middle line:84% was a really low degree, it would just be h degree. 00:47:04.090 --> 00:47:06.400 align:middle line:90% But this is a log factor bigger. 00:47:06.400 --> 00:47:10.380 align:middle line:84% But that's going to be OK for us because, as a verifier, that's 00:47:10.380 --> 00:47:10.990 align:middle line:90% fine, I guess. 00:47:10.990 --> 00:47:11.490 align:middle line:90% Yeah. 00:47:11.490 --> 00:47:13.805 align:middle line:90% 00:47:13.805 --> 00:47:16.080 align:middle line:84% AUDIENCE: I'm still a little bit confused about-- 00:47:16.080 --> 00:47:23.310 align:middle line:84% so b add basically computes for one gate, right? 00:47:23.310 --> 00:47:26.670 align:middle line:84% That essentially like computes-- given one gate 00:47:26.670 --> 00:47:29.430 align:middle line:84% it simulates the circuit for one particular gate, right? 00:47:29.430 --> 00:47:30.210 align:middle line:90% RACHEL ZHANG: No. 00:47:30.210 --> 00:47:34.710 align:middle line:84% So this formula-- so the input is going to be any particular 00:47:34.710 --> 00:47:37.710 align:middle line:84% location in your entire circuit, and it's going to compute this 00:47:37.710 --> 00:47:38.820 align:middle line:90% log depth-- 00:47:38.820 --> 00:47:41.460 align:middle line:84% this polylog-size formula to tell you what that gate should 00:47:41.460 --> 00:47:42.288 align:middle line:90% be-- 00:47:42.288 --> 00:47:43.830 align:middle line:84% whether that was the add gate or not. 00:47:43.830 --> 00:47:45.520 align:middle line:84% So the input is not the specific gate. 00:47:45.520 --> 00:47:49.830 align:middle line:84% It's going to be any of the gates in the entire circuit. 00:47:49.830 --> 00:47:54.320 align:middle line:84% AUDIENCE: Yeah, so it's one formula for the entire circuit. 00:47:54.320 --> 00:47:56.612 align:middle line:84% RACHEL ZHANG: Yeah, one formula for the entire circuit. 00:47:56.612 --> 00:47:58.260 align:middle line:90% AUDIENCE: But then why are you-- 00:47:58.260 --> 00:48:01.210 align:middle line:90% 00:48:01.210 --> 00:48:02.930 align:middle line:90% and so where exactly-- 00:48:02.930 --> 00:48:05.330 align:middle line:90% what-- we have these h's. 00:48:05.330 --> 00:48:07.590 align:middle line:84% And that means that we have, technically, I 00:48:07.590 --> 00:48:08.990 align:middle line:90% guess the same number of inputs. 00:48:08.990 --> 00:48:11.960 align:middle line:84% But we have blocks of inputs now. 00:48:11.960 --> 00:48:14.120 align:middle line:84% And how exactly does that change? 00:48:14.120 --> 00:48:16.960 align:middle line:84% Because that means that we have-- 00:48:16.960 --> 00:48:25.300 align:middle line:84% technically, we're combining-- it just feels weird 00:48:25.300 --> 00:48:29.140 align:middle line:84% because, in some sense, it feels like we're mixing up information 00:48:29.140 --> 00:48:30.340 align:middle line:90% because we're saying-- 00:48:30.340 --> 00:48:34.060 align:middle line:90% we're assigning one thing-- 00:48:34.060 --> 00:48:38.950 align:middle line:84% one thing in a large space to a bunch of things in the Boolean 00:48:38.950 --> 00:48:41.410 align:middle line:90% space, of the [INAUDIBLE]. 00:48:41.410 --> 00:48:44.050 align:middle line:84% In the large field-- h is in the larger field, right? 00:48:44.050 --> 00:48:46.390 align:middle line:84% And we're saying that we're just assigning 00:48:46.390 --> 00:48:49.678 align:middle line:84% one h to this spread of things in the [INAUDIBLE] field. 00:48:49.678 --> 00:48:50.470 align:middle line:90% And it just feels-- 00:48:50.470 --> 00:48:53.290 align:middle line:90% 00:48:53.290 --> 00:48:55.480 align:middle line:84% I'm not [INAUDIBLE] a lot [? of things. ?] 00:48:55.480 --> 00:48:56.510 align:middle line:90% RACHEL ZHANG: OK, yeah. 00:48:56.510 --> 00:48:59.123 align:middle line:84% So maybe the confusion is, like, this part is 0, 1, 00:48:59.123 --> 00:49:00.290 align:middle line:90% so it's really just Boolean. 00:49:00.290 --> 00:49:02.207 align:middle line:84% And then over here, we have this weird h going 00:49:02.207 --> 00:49:04.095 align:middle line:90% into it, which is not Boolean. 00:49:04.095 --> 00:49:05.470 align:middle line:84% So, what is this polynomial doing 00:49:05.470 --> 00:49:06.680 align:middle line:90% with all this Boolean stuff? 00:49:06.680 --> 00:49:07.972 align:middle line:90% So that's part of the question? 00:49:07.972 --> 00:49:10.010 align:middle line:84% Yeah, so maybe we should think about it as in-- 00:49:10.010 --> 00:49:12.562 align:middle line:84% Let's first arithmetize this circuit here. 00:49:12.562 --> 00:49:15.020 align:middle line:84% So we're going to get something over a large field already. 00:49:15.020 --> 00:49:17.350 align:middle line:84% And now we're going to plug in these polynomials 00:49:17.350 --> 00:49:19.270 align:middle line:84% into the arithmetized thing, which is already 00:49:19.270 --> 00:49:20.228 align:middle line:90% going to be polynomial. 00:49:20.228 --> 00:49:24.218 align:middle line:84% So we're-- it's like polynomial composition. 00:49:24.218 --> 00:49:26.510 align:middle line:84% AUDIENCE: But the thing is you're not doing one to one. 00:49:26.510 --> 00:49:27.967 align:middle line:90% You're doing one to many. 00:49:27.967 --> 00:49:30.550 align:middle line:84% RACHEL ZHANG: If you think about it, the amount of information 00:49:30.550 --> 00:49:33.140 align:middle line:84% is conserved because here, there's H options-- 00:49:33.140 --> 00:49:35.150 align:middle line:90% capital H options-- for this h1. 00:49:35.150 --> 00:49:36.800 align:middle line:84% And then when you plug it up here, 00:49:36.800 --> 00:49:38.860 align:middle line:84% you now still have only h options 00:49:38.860 --> 00:49:43.140 align:middle line:90% for the resulting 0, 1 string. 00:49:43.140 --> 00:49:46.590 align:middle line:84% AUDIENCE: Well-- I mean, yes, but it also-- 00:49:46.590 --> 00:49:52.920 align:middle line:84% it felt that-- yes, but in the higher field, we only have-- 00:49:52.920 --> 00:49:57.840 align:middle line:84% now we only have the log S prime different inputs 00:49:57.840 --> 00:49:59.230 align:middle line:90% from the larger field. 00:49:59.230 --> 00:50:03.466 align:middle line:84% Now we're jamming them into this-- 00:50:03.466 --> 00:50:06.810 align:middle line:90% or rather, we only have a few-- 00:50:06.810 --> 00:50:10.050 align:middle line:90% we have much less things-- 00:50:10.050 --> 00:50:13.170 align:middle line:84% the input from the larger field, and we're jamming that in. 00:50:13.170 --> 00:50:18.190 align:middle line:84% And it just-- each element is getting 00:50:18.190 --> 00:50:21.400 align:middle line:84% is covering a bunch of bits, and those might [INAUDIBLE]. 00:50:21.400 --> 00:50:23.900 align:middle line:84% RACHEL ZHANG: So it turns out that there is a unique mapping 00:50:23.900 --> 00:50:27.720 align:middle line:90% from the string of h1 up to hm. 00:50:27.720 --> 00:50:31.520 align:middle line:84% And then the 0, 1 to the log S prime string. 00:50:31.520 --> 00:50:32.820 align:middle line:90% And so it's a bijection. 00:50:32.820 --> 00:50:34.445 align:middle line:84% You can go back and forth between them. 00:50:34.445 --> 00:50:36.420 align:middle line:84% So it's actually-- there's no clashing. 00:50:36.420 --> 00:50:38.860 align:middle line:84% It's going to be just one to one. 00:50:38.860 --> 00:50:39.520 align:middle line:90% AUDIENCE: OK. 00:50:39.520 --> 00:50:40.430 align:middle line:90% I'm sorry. 00:50:40.430 --> 00:50:42.350 align:middle line:84% I'm just not following the bijection. 00:50:42.350 --> 00:50:43.090 align:middle line:90% [INAUDIBLE] 00:50:43.090 --> 00:50:44.500 align:middle line:90% RACHEL ZHANG: Sure, OK. 00:50:44.500 --> 00:50:45.110 align:middle line:90% Yeah. 00:50:45.110 --> 00:50:47.060 align:middle line:84% AUDIENCE: I guess that's where my [INAUDIBLE]. 00:50:47.060 --> 00:50:47.852 align:middle line:90% RACHEL ZHANG: Sure. 00:50:47.852 --> 00:50:50.420 align:middle line:84% OK, so what's going to happen is-- 00:50:50.420 --> 00:50:51.670 align:middle line:90% maybe let me zoom out of that. 00:50:51.670 --> 00:50:52.503 align:middle line:90% It's a little messy. 00:50:52.503 --> 00:50:55.812 align:middle line:84% So let's say you have-- this is going to be just-- 00:50:55.812 --> 00:50:58.020 align:middle line:84% because this is going to be our 0, 1 layer over here. 00:50:58.020 --> 00:50:58.880 align:middle line:90% AUDIENCE: I'm sorry again for-- 00:50:58.880 --> 00:50:59.810 align:middle line:84% RACHEL ZHANG: Yeah, no, you're fine. 00:50:59.810 --> 00:51:00.990 align:middle line:90% It's good to ask questions. 00:51:00.990 --> 00:51:05.450 align:middle line:84% So this is going to be log h number of bits. 00:51:05.450 --> 00:51:09.350 align:middle line:84% And the idea is we're going to take some h, 00:51:09.350 --> 00:51:15.600 align:middle line:84% and we're going to map it here to log h many different bits. 00:51:15.600 --> 00:51:17.810 align:middle line:84% So here-- one way you can do this-- 00:51:17.810 --> 00:51:19.890 align:middle line:84% and you can write this in binary. 00:51:19.890 --> 00:51:22.560 align:middle line:84% So maybe this-- maybe h here is, like, size 8. 00:51:22.560 --> 00:51:24.750 align:middle line:84% So this would correspond to a binary string. 00:51:24.750 --> 00:51:26.240 align:middle line:90% AUDIENCE: I get you can do that. 00:51:26.240 --> 00:51:29.550 align:middle line:84% But I'm like, why are we allowed to do that? 00:51:29.550 --> 00:51:32.840 align:middle line:84% And how exactly-- why exactly is this helping us? 00:51:32.840 --> 00:51:36.530 align:middle line:84% I understand that you can write it in binary on only that. 00:51:36.530 --> 00:51:38.850 align:middle line:84% How exactly is this helping us again? 00:51:38.850 --> 00:51:42.900 align:middle line:84% Because it feels like now each element-- 00:51:42.900 --> 00:51:45.650 align:middle line:84% each big element in the extension-- like, before, 00:51:45.650 --> 00:51:49.370 align:middle line:84% we were just saying that we're going to extend each 00:51:49.370 --> 00:51:50.990 align:middle line:90% individual-- 00:51:50.990 --> 00:51:53.420 align:middle line:84% we're going to assume that 0, 1 values 00:51:53.420 --> 00:51:55.810 align:middle line:84% are actually now extended values. 00:51:55.810 --> 00:51:59.265 align:middle line:84% But then, now, we're doing it in such a way that-- 00:51:59.265 --> 00:52:02.310 align:middle line:84% because before, we were assuming these values 00:52:02.310 --> 00:52:04.260 align:middle line:90% from the large circuit are-- 00:52:04.260 --> 00:52:08.388 align:middle line:90% 00:52:08.388 --> 00:52:10.950 align:middle line:90% we're going to say-- 00:52:10.950 --> 00:52:14.400 align:middle line:84% if happen to have, obviously, an AND gate, then we're 00:52:14.400 --> 00:52:17.340 align:middle line:84% going to have one big value and another big value, 00:52:17.340 --> 00:52:19.350 align:middle line:84% and then multiply them together [INAUDIBLE]. 00:52:19.350 --> 00:52:19.785 align:middle line:90% RACHEL ZHANG: OK. 00:52:19.785 --> 00:52:20.220 align:middle line:90% Can you hold that? 00:52:20.220 --> 00:52:21.210 align:middle line:84% How about if we take a break now, 00:52:21.210 --> 00:52:22.500 align:middle line:84% and then we'll come back in five minutes, 00:52:22.500 --> 00:52:23.740 align:middle line:84% and then we'll do the second half of the class? 00:52:23.740 --> 00:52:25.030 align:middle line:84% I think that's all for this part. 00:52:25.030 --> 00:52:26.110 align:middle line:90% And maybe we can talk offline. 00:52:26.110 --> 00:52:26.530 align:middle line:90% AUDIENCE: Sorry. 00:52:26.530 --> 00:52:28.113 align:middle line:84% RACHEL ZHANG: No, you're totally fine. 00:52:28.113 --> 00:52:29.610 align:middle line:90% Let's talk about it then. 00:52:29.610 --> 00:52:30.690 align:middle line:90% [INTERPOSING VOICES] 00:52:30.690 --> 00:52:34.710 align:middle line:84% So how many of you guys know the theorem exists 00:52:34.710 --> 00:52:37.950 align:middle line:90% or what it says or anything? 00:52:37.950 --> 00:52:39.450 align:middle line:84% AUDIENCE: Somehow, I already forgot. 00:52:39.450 --> 00:52:40.380 align:middle line:90% RACHEL ZHANG: OK, it's fine. 00:52:40.380 --> 00:52:41.200 align:middle line:90% We'll talk about it again. 00:52:41.200 --> 00:52:42.640 align:middle line:84% So this is a really famous theorem. 00:52:42.640 --> 00:52:43.515 align:middle line:90% It's a great theorem. 00:52:43.515 --> 00:52:45.060 align:middle line:90% It's very good. 00:52:45.060 --> 00:52:47.140 align:middle line:84% So we should talk about what these things are. 00:52:47.140 --> 00:52:50.370 align:middle line:84% So can one of the local complexity theorists people 00:52:50.370 --> 00:52:51.245 align:middle line:90% tell you what IP is? 00:52:51.245 --> 00:52:53.763 align:middle line:90% 00:52:53.763 --> 00:52:55.930 align:middle line:84% It doesn't have to be the local complexity theorist. 00:52:55.930 --> 00:52:57.374 align:middle line:90% It could be any of you. 00:52:57.374 --> 00:52:59.310 align:middle line:90% [LAUGHS] 00:52:59.310 --> 00:53:01.810 align:middle line:84% AUDIENCE: Positive statements about [INAUDIBLE] 00:53:01.810 --> 00:53:04.935 align:middle line:84% the interactive protocol between polytime [INAUDIBLE] verifier 00:53:04.935 --> 00:53:06.560 align:middle line:84% and the computationally-bounded prover. 00:53:06.560 --> 00:53:09.628 align:middle line:90% 00:53:09.628 --> 00:53:10.920 align:middle line:90% RACHEL ZHANG: Unbounded prover. 00:53:10.920 --> 00:53:13.780 align:middle line:90% 00:53:13.780 --> 00:53:15.130 align:middle line:90% [INTERPOSING VOICES] 00:53:15.130 --> 00:53:21.410 align:middle line:90% 00:53:21.410 --> 00:53:22.020 align:middle line:90% Let's see. 00:53:22.020 --> 00:53:38.130 align:middle line:90% 00:53:38.130 --> 00:53:38.630 align:middle line:90% OK. 00:53:38.630 --> 00:53:39.130 align:middle line:90% Yeah. 00:53:39.130 --> 00:53:41.330 align:middle line:84% So-- OK, so IP is a class of all statements that 00:53:41.330 --> 00:53:43.400 align:middle line:90% have interactive proofs. 00:53:43.400 --> 00:53:44.200 align:middle line:90% Interactive. 00:53:44.200 --> 00:53:44.800 align:middle line:90% That's right. 00:53:44.800 --> 00:53:45.410 align:middle line:90% OK, yeah. 00:53:45.410 --> 00:53:47.930 align:middle line:84% And the prover can be unbounded time. 00:53:47.930 --> 00:53:49.937 align:middle line:84% And then the verifier's running on poly time. 00:53:49.937 --> 00:53:52.020 align:middle line:84% So the interactive proof should also be poly size. 00:53:52.020 --> 00:53:53.950 align:middle line:84% Otherwise, the verifier can't read it. 00:53:53.950 --> 00:53:54.950 align:middle line:90% And then what is PSPACE? 00:53:54.950 --> 00:54:03.190 align:middle line:90% 00:54:03.190 --> 00:54:05.500 align:middle line:84% AUDIENCE: Polynomial space-bounded TM languages? 00:54:05.500 --> 00:54:06.333 align:middle line:90% RACHEL ZHANG: Great. 00:54:06.333 --> 00:54:06.910 align:middle line:90% OK. 00:54:06.910 --> 00:54:09.350 align:middle line:90% Polyspace computations. 00:54:09.350 --> 00:54:09.850 align:middle line:90% Yay. 00:54:09.850 --> 00:54:15.660 align:middle line:90% 00:54:15.660 --> 00:54:18.410 align:middle line:90% And so the easier direction-- 00:54:18.410 --> 00:54:19.600 align:middle line:90% so it was shown in 1992. 00:54:19.600 --> 00:54:22.030 align:middle line:84% These two things are actually equal. 00:54:22.030 --> 00:54:26.050 align:middle line:84% So the easier direction to show is that IP is in PSPACE. 00:54:26.050 --> 00:54:28.120 align:middle line:84% The way you do that is by simulating 00:54:28.120 --> 00:54:29.680 align:middle line:84% all possible transcripts, and then 00:54:29.680 --> 00:54:31.360 align:middle line:90% you can do some counting stuff. 00:54:31.360 --> 00:54:32.950 align:middle line:90% We won't go into the details. 00:54:32.950 --> 00:54:35.950 align:middle line:84% But in 1992, it was shown the other direction, also held. 00:54:35.950 --> 00:54:40.980 align:middle line:90% So this is by Shamir in 1992. 00:54:40.980 --> 00:54:44.230 align:middle line:84% So in fact, PSPACE is also in IP, 00:54:44.230 --> 00:54:48.900 align:middle line:84% which means that these two classes are actually equal. 00:54:48.900 --> 00:54:52.860 align:middle line:84% And to do this, he constructed an interactive proof 00:54:52.860 --> 00:54:55.950 align:middle line:84% for any PSPACE computation, and that 00:54:55.950 --> 00:54:58.890 align:middle line:90% would give you the inclusion. 00:54:58.890 --> 00:55:08.940 align:middle line:84% So in particular, this means that any PSPACE computation 00:55:08.940 --> 00:55:10.040 align:middle line:90% has interactive proof. 00:55:10.040 --> 00:55:14.780 align:middle line:90% 00:55:14.780 --> 00:55:16.817 align:middle line:84% So going back to the concept of delegation, 00:55:16.817 --> 00:55:18.650 align:middle line:84% which is what this class is entirely about-- 00:55:18.650 --> 00:55:20.930 align:middle line:84% how do you delegate a computation 00:55:20.930 --> 00:55:23.820 align:middle line:84% to a bigger prover, one you can run very quickly? 00:55:23.820 --> 00:55:25.880 align:middle line:90% Well, this is delegation, right? 00:55:25.880 --> 00:55:27.480 align:middle line:90% OK. 00:55:27.480 --> 00:55:30.290 align:middle line:84% It's basically like, I want you to compute some small space 00:55:30.290 --> 00:55:32.120 align:middle line:90% computation, like polyspace. 00:55:32.120 --> 00:55:33.680 align:middle line:84% And I can ask the cloud, hey, can you 00:55:33.680 --> 00:55:36.030 align:middle line:84% run this awesome Shamir interactive proof for me 00:55:36.030 --> 00:55:39.065 align:middle line:84% and just tell me-- prove to me that you did it correctly? 00:55:39.065 --> 00:55:41.870 align:middle line:90% And we're good, right? 00:55:41.870 --> 00:55:43.080 align:middle line:90% So what's the issue? 00:55:43.080 --> 00:55:45.140 align:middle line:90% Why aren't we done? 00:55:45.140 --> 00:55:46.970 align:middle line:90% Why did we do GKR at all? 00:55:46.970 --> 00:55:53.040 align:middle line:84% The reason is because, here, the prover runtime 00:55:53.040 --> 00:55:54.065 align:middle line:90% is 2 to the S squared. 00:55:54.065 --> 00:55:57.930 align:middle line:90% 00:55:57.930 --> 00:56:01.170 align:middle line:84% So in PSPACE-- any computation is doable in time 2 to the S. 00:56:01.170 --> 00:56:05.850 align:middle line:84% But here's this additional-- so this is S2 that's squared. 00:56:05.850 --> 00:56:08.310 align:middle line:84% So basically, the time to prove is much more than the time 00:56:08.310 --> 00:56:10.303 align:middle line:84% necessary to simply compute, which 00:56:10.303 --> 00:56:11.970 align:middle line:84% is why there's all these follow-up works 00:56:11.970 --> 00:56:15.630 align:middle line:84% and why this is actually so-- an interesting question today. 00:56:15.630 --> 00:56:17.230 align:middle line:84% And there are some follow-up work. 00:56:17.230 --> 00:56:19.390 align:middle line:84% I don't know the reference, and Yael didn't either. 00:56:19.390 --> 00:56:20.980 align:middle line:84% And I don't know if memory is wrong either. 00:56:20.980 --> 00:56:21.640 align:middle line:90% So it could be wrong. 00:56:21.640 --> 00:56:22.360 align:middle line:90% It could be true. 00:56:22.360 --> 00:56:23.920 align:middle line:90% So it's a possible statement. 00:56:23.920 --> 00:56:26.790 align:middle line:90% [LAUGHTER] 00:56:26.790 --> 00:56:29.010 align:middle line:84% So it's possible that there's a follow-up work that 00:56:29.010 --> 00:56:32.400 align:middle line:84% showed how to have a proved runtime of 2 to the S log S, 00:56:32.400 --> 00:56:34.900 align:middle line:84% which is significantly better than 2 to the S squared. 00:56:34.900 --> 00:56:36.990 align:middle line:84% But it's still not 2 to the S, which 00:56:36.990 --> 00:56:39.810 align:middle line:84% would be the best you could hope for any arbitrary PSPACE 00:56:39.810 --> 00:56:41.550 align:middle line:90% computation. 00:56:41.550 --> 00:56:43.595 align:middle line:84% So today, what we're going to show is-- 00:56:43.595 --> 00:56:47.280 align:middle line:90% 00:56:47.280 --> 00:56:50.390 align:middle line:84% so today, the theorem is going to be as follows. 00:56:50.390 --> 00:56:52.880 align:middle line:84% So assuming GKR, which is an unconditional statement. 00:56:52.880 --> 00:56:53.520 align:middle line:90% It's not an assumption. 00:56:53.520 --> 00:56:55.895 align:middle line:84% It's just-- this is what we're going to use in the proof. 00:56:55.895 --> 00:57:06.620 align:middle line:84% So since we have GKR, we can get IP equals PSPACE with-- 00:57:06.620 --> 00:57:09.380 align:middle line:90% time 2 to the-- 00:57:09.380 --> 00:57:14.555 align:middle line:84% I should probably right poly 2 to the S prover. 00:57:14.555 --> 00:57:21.780 align:middle line:90% 00:57:21.780 --> 00:57:23.480 align:middle line:84% So what this means is-- so for, maybe, 00:57:23.480 --> 00:57:26.470 align:middle line:84% the hardest PSPACE computations, assuming that, I guess, 00:57:26.470 --> 00:57:28.470 align:middle line:84% the hardest thing you can do is time 2 to the S, 00:57:28.470 --> 00:57:31.580 align:middle line:84% then we do have actually efficient delegation protocols 00:57:31.580 --> 00:57:32.460 align:middle line:90% for these things. 00:57:32.460 --> 00:57:34.168 align:middle line:84% And they're, in fact, also proof systems. 00:57:34.168 --> 00:57:38.510 align:middle line:84% So they are, like, information theoretically secure. 00:57:38.510 --> 00:57:41.510 align:middle line:84% And maybe I'll just mention one open question is, what 00:57:41.510 --> 00:57:44.240 align:middle line:90% about general time TSPACE-- 00:57:44.240 --> 00:57:45.000 align:middle line:90% space computation? 00:57:45.000 --> 00:57:51.570 align:middle line:84% So-- where T's not necessarily S, 00:57:51.570 --> 00:57:58.169 align:middle line:84% can you do an interactive proof as efficient? 00:57:58.169 --> 00:58:03.330 align:middle line:90% 00:58:03.330 --> 00:58:05.460 align:middle line:90% I think this is not known. 00:58:05.460 --> 00:58:07.655 align:middle line:84% So if you want to think about some proof systems, 00:58:07.655 --> 00:58:09.280 align:middle line:84% this is a question you can think about. 00:58:09.280 --> 00:58:15.830 align:middle line:90% 00:58:15.830 --> 00:58:17.370 align:middle line:90% Are you guys OK if I raise this? 00:58:17.370 --> 00:58:18.160 align:middle line:90% This is probably fine, right? 00:58:18.160 --> 00:58:18.350 align:middle line:90% OK. 00:58:18.350 --> 00:58:19.940 align:middle line:84% AUDIENCE: Here, efficient is, like, poly T? 00:58:19.940 --> 00:58:22.190 align:middle line:84% RACHEL ZHANG: Yeah, poly T. And you can definitely ask 00:58:22.190 --> 00:58:23.730 align:middle line:90% more-- even stronger questions. 00:58:23.730 --> 00:58:27.120 align:middle line:84% Can you do it with linear time overhead, additive, whatever, 00:58:27.120 --> 00:58:29.600 align:middle line:90% overhead? 00:58:29.600 --> 00:58:31.590 align:middle line:90% Yeah, there's many questions. 00:58:31.590 --> 00:58:51.390 align:middle line:90% 00:58:51.390 --> 00:58:55.500 align:middle line:84% OK, so how do we describe a PSPACE computation? 00:58:55.500 --> 00:58:58.080 align:middle line:84% Someone said that it's a space of all computations that 00:58:58.080 --> 00:59:00.840 align:middle line:84% are doable by a Turing machine with bounded space. 00:59:00.840 --> 00:59:02.340 align:middle line:84% So let's say that we have our Turing 00:59:02.340 --> 00:59:13.530 align:middle line:84% machine, M. And let's say it runs in space, S. 00:59:13.530 --> 00:59:20.390 align:middle line:84% And maybe I could say, on input 0, 1 to the n. 00:59:20.390 --> 00:59:24.545 align:middle line:90% And maybe the thing we want is-- 00:59:24.545 --> 00:59:27.200 align:middle line:90% 00:59:27.200 --> 00:59:28.940 align:middle line:90% and maybe we can just say time-- 00:59:28.940 --> 00:59:32.900 align:middle line:84% and also time, T. And I guess I could set it to 2 to the S, 00:59:32.900 --> 00:59:33.560 align:middle line:90% just for now. 00:59:33.560 --> 00:59:34.140 align:middle line:90% Is that OK? 00:59:34.140 --> 00:59:36.140 align:middle line:84% So let's say that maybe we have a Turing machine 00:59:36.140 --> 00:59:38.900 align:middle line:84% and we want to see that within time T, which is 2 to the S, 00:59:38.900 --> 00:59:41.060 align:middle line:84% that eventually, it will get to the output, 00:59:41.060 --> 00:59:43.195 align:middle line:84% like the accepting configuration, or not. 00:59:43.195 --> 00:59:45.920 align:middle line:90% 00:59:45.920 --> 00:59:55.930 align:middle line:84% So by this point, it should get to accepting configuration. 00:59:55.930 --> 01:00:05.220 align:middle line:90% 01:00:05.220 --> 01:00:06.830 align:middle line:90% So here's a trick. 01:00:06.830 --> 01:00:09.770 align:middle line:84% The idea here, we're going to use GKR to prove the theorem. 01:00:09.770 --> 01:00:11.970 align:middle line:84% So we're going to have to construct some circuit 01:00:11.970 --> 01:00:14.780 align:middle line:84% to delegate some computation with GKR with. 01:00:14.780 --> 01:00:17.430 align:middle line:90% 01:00:17.430 --> 01:00:21.150 align:middle line:84% So this Turing machine here-- it runs in space S-- can run time-- 01:00:21.150 --> 01:00:24.407 align:middle line:84% up to 2 to the S. So if you naively do this, 01:00:24.407 --> 01:00:26.490 align:middle line:84% you would be [INAUDIBLE] depth 2 to the S circuit. 01:00:26.490 --> 01:00:27.460 align:middle line:90% That's not so good. 01:00:27.460 --> 01:00:31.870 align:middle line:84% We want it, really, to be depth S. 01:00:31.870 --> 01:00:33.620 align:middle line:84% So the thing about let me write that down. 01:00:33.620 --> 01:00:50.720 align:middle line:84% So the goal is to convert to depth S. That's the goal. 01:00:50.720 --> 01:00:52.280 align:middle line:90% So here's the trick. 01:00:52.280 --> 01:00:53.290 align:middle line:90% The trick is as follows. 01:00:53.290 --> 01:00:54.832 align:middle line:84% We're going to look at the transition 01:00:54.832 --> 01:01:00.180 align:middle line:84% matrix of all the possible states of the Turing tape, 01:01:00.180 --> 01:01:03.095 align:middle line:90% basically. 01:01:03.095 --> 01:01:05.670 align:middle line:84% So we're to have a bunch of different possible states here 01:01:05.670 --> 01:01:07.940 align:middle line:84% and a bunch of different possible states here. 01:01:07.940 --> 01:01:12.680 align:middle line:84% So how many possible states are there? 01:01:12.680 --> 01:01:17.030 align:middle line:84% Well, there is 0, 1 to the S. That's what the state could 01:01:17.030 --> 01:01:18.570 align:middle line:90% actually say on the tape. 01:01:18.570 --> 01:01:21.710 align:middle line:84% But that's also where the Turing machine is right now. 01:01:21.710 --> 01:01:26.060 align:middle line:84% So maybe times the index and S should 01:01:26.060 --> 01:01:28.190 align:middle line:84% say where the Turing machine is right now. 01:01:28.190 --> 01:01:31.670 align:middle line:84% And then it would do one computation, move somewhere, 01:01:31.670 --> 01:01:34.105 align:middle line:84% and then it'll be an adjacent place at a different state. 01:01:34.105 --> 01:01:35.480 align:middle line:84% And then, now, the new state will 01:01:35.480 --> 01:01:36.980 align:middle line:84% be like a slightly different string, 01:01:36.980 --> 01:01:38.730 align:middle line:84% and it'll be-- the Turing pointer will 01:01:38.730 --> 01:01:40.280 align:middle line:90% be at a different location. 01:01:40.280 --> 01:01:42.970 align:middle line:84% So here is also going to be the same states. 01:01:42.970 --> 01:01:49.850 align:middle line:90% 01:01:49.850 --> 01:01:55.460 align:middle line:84% And the point is we're going to put a 1 at a location 01:01:55.460 --> 01:01:58.340 align:middle line:84% if there's a way to get from this state here to this state 01:01:58.340 --> 01:01:59.545 align:middle line:90% here in one time step. 01:01:59.545 --> 01:02:02.820 align:middle line:90% 01:02:02.820 --> 01:02:03.880 align:middle line:90% And 0s everywhere else. 01:02:03.880 --> 01:02:04.380 align:middle line:90% Yeah. 01:02:04.380 --> 01:02:10.115 align:middle line:84% AUDIENCE: Does this state include the internal automaton? 01:02:10.115 --> 01:02:11.740 align:middle line:84% RACHEL ZHANG: Yes, that's a good point. 01:02:11.740 --> 01:02:13.115 align:middle line:84% It's actually a very good-- yeah. 01:02:13.115 --> 01:02:16.470 align:middle line:84% AUDIENCE: So there should only be, like, one 1 in each row. 01:02:16.470 --> 01:02:18.720 align:middle line:84% RACHEL ZHANG: Yeah, there should be one 1 in every row 01:02:18.720 --> 01:02:21.600 align:middle line:84% because the thing you were going to do after one time step should 01:02:21.600 --> 01:02:24.240 align:middle line:84% be deterministic based on your current location-- 01:02:24.240 --> 01:02:26.850 align:middle line:90% your state based on your-- 01:02:26.850 --> 01:02:28.810 align:middle line:84% your internal state of your Turing machine, 01:02:28.810 --> 01:02:32.220 align:middle line:84% as well as what you see around you. 01:02:32.220 --> 01:02:34.620 align:middle line:84% I'm using this as just the number of states in the Turing 01:02:34.620 --> 01:02:35.538 align:middle line:90% machine. 01:02:35.538 --> 01:02:37.580 align:middle line:84% Anything else I'm forgetting within these states? 01:02:37.580 --> 01:02:38.940 align:middle line:84% There's just a bunch of information 01:02:38.940 --> 01:02:39.857 align:middle line:90% that I don't remember. 01:02:39.857 --> 01:02:44.280 align:middle line:90% 01:02:44.280 --> 01:02:46.340 align:middle line:90% So anyway-- so I guess-- 01:02:46.340 --> 01:02:49.680 align:middle line:84% the key point here is that this matrix is actually very easy 01:02:49.680 --> 01:02:55.120 align:middle line:84% to compute, because given maybe a state here and a state here, 01:02:55.120 --> 01:02:59.123 align:middle line:84% you can compare very-- in very low depth, very efficiently. 01:02:59.123 --> 01:03:00.540 align:middle line:84% So it's a very uniform description 01:03:00.540 --> 01:03:03.010 align:middle line:84% of this check, or of the circuit that will generate, 01:03:03.010 --> 01:03:05.640 align:middle line:84% whether or not the particular corresponding matrix 01:03:05.640 --> 01:03:09.460 align:middle line:90% value is a 0 or 1. 01:03:09.460 --> 01:03:12.480 align:middle line:84% And that'll be important for us because we want-- 01:03:12.480 --> 01:03:15.760 align:middle line:84% we want a uniform circuit, I guess, at this point. 01:03:15.760 --> 01:03:17.245 align:middle line:90% And this will make it uniform. 01:03:17.245 --> 01:03:18.942 align:middle line:84% AUDIENCE: So [INAUDIBLE] previously. 01:03:18.942 --> 01:03:19.900 align:middle line:90% RACHEL ZHANG: Yeah, OK. 01:03:19.900 --> 01:03:24.040 align:middle line:84% So the matrix here is easy to compute, is my claim. 01:03:24.040 --> 01:03:27.450 align:middle line:84% The reason is you can take any state here, any state here. 01:03:27.450 --> 01:03:29.580 align:middle line:90% You can do some checks. 01:03:29.580 --> 01:03:31.558 align:middle line:84% It's a very-- it's a small formula. 01:03:31.558 --> 01:03:33.850 align:middle line:84% You can just check it very easily by knowing what M is, 01:03:33.850 --> 01:03:34.877 align:middle line:90% by knowing what you see. 01:03:34.877 --> 01:03:36.960 align:middle line:84% And you can tell if there's a transition from that 01:03:36.960 --> 01:03:38.280 align:middle line:90% to the next state. 01:03:38.280 --> 01:03:41.020 align:middle line:84% So the matrix here is easy to compute, is my claim. 01:03:41.020 --> 01:03:56.950 align:middle line:90% 01:03:56.950 --> 01:04:01.270 align:middle line:84% So maybe let's call this matrix A. So 01:04:01.270 --> 01:04:03.520 align:middle line:90% what I just said is that Aij-- 01:04:03.520 --> 01:04:06.730 align:middle line:84% this is going to be the ith row in the jth column-- 01:04:06.730 --> 01:04:11.020 align:middle line:84% entry of A. This is going to be a 1 if-- 01:04:11.020 --> 01:04:13.050 align:middle line:84% so state i goes to state j in one time step. 01:04:13.050 --> 01:04:29.910 align:middle line:90% 01:04:29.910 --> 01:04:32.160 align:middle line:90% And so that's good. 01:04:32.160 --> 01:04:36.653 align:middle line:84% What we really want to know is whether i will go to j 01:04:36.653 --> 01:04:38.070 align:middle line:84% or the starting configuration will 01:04:38.070 --> 01:04:41.352 align:middle line:84% go to the accepting configuration in T time steps. 01:04:41.352 --> 01:04:42.185 align:middle line:90% That's what we want. 01:04:42.185 --> 01:05:26.680 align:middle line:90% 01:05:26.680 --> 01:05:33.630 align:middle line:84% So here, we have a copy of A. Maybe let's just 01:05:33.630 --> 01:05:36.010 align:middle line:84% do some computations just for fun and see what happens. 01:05:36.010 --> 01:05:39.840 align:middle line:84% So you have a copy of matrix A here, a copy of matrix A here. 01:05:39.840 --> 01:05:42.645 align:middle line:84% Just multiply them via matrix multiplication. 01:05:42.645 --> 01:05:43.520 align:middle line:90% So we have A squared. 01:05:43.520 --> 01:05:46.880 align:middle line:90% 01:05:46.880 --> 01:05:50.480 align:middle line:84% What is the value of the entry in the ith row 01:05:50.480 --> 01:05:52.402 align:middle line:90% and the jth column of A squared? 01:05:52.402 --> 01:05:54.170 align:middle line:90% AUDIENCE: [INAUDIBLE] 01:05:54.170 --> 01:05:55.320 align:middle line:90% RACHEL ZHANG: Yeah, so-- 01:05:55.320 --> 01:05:56.737 align:middle line:84% I guess I'll write here, actually. 01:05:56.737 --> 01:05:59.925 align:middle line:90% 01:05:59.925 --> 01:06:04.200 align:middle line:84% So A squared-- so the ijth entry of A squared 01:06:04.200 --> 01:06:10.327 align:middle line:84% is whether i goes to j in two steps. 01:06:10.327 --> 01:06:12.660 align:middle line:84% And maybe for those of you who haven't seen this before, 01:06:12.660 --> 01:06:14.305 align:middle line:90% let's just do it so you see why. 01:06:14.305 --> 01:06:18.050 align:middle line:90% 01:06:18.050 --> 01:06:22.130 align:middle line:84% So if you want to look at the ijth entry of this product 01:06:22.130 --> 01:06:23.990 align:middle line:84% of these two matrices, what you want to do 01:06:23.990 --> 01:06:25.970 align:middle line:84% is you want to take the ith row, look 01:06:25.970 --> 01:06:28.950 align:middle line:84% at all the entries across it, take the jth column, 01:06:28.950 --> 01:06:31.310 align:middle line:84% look at all the entries down it, and you 01:06:31.310 --> 01:06:33.200 align:middle line:84% want to take the pairwise-- you want to take 01:06:33.200 --> 01:06:34.110 align:middle line:90% the product and the sum. 01:06:34.110 --> 01:06:36.568 align:middle line:84% So you want to take this entry times this entry, this entry 01:06:36.568 --> 01:06:38.510 align:middle line:90% times this entry, and so on. 01:06:38.510 --> 01:06:40.040 align:middle line:84% So what's essentially happening is, 01:06:40.040 --> 01:06:42.020 align:middle line:84% here, you want to take-- you want 01:06:42.020 --> 01:06:43.730 align:middle line:84% to look at the entry corresponding 01:06:43.730 --> 01:06:44.870 align:middle line:90% to going from i to k. 01:06:44.870 --> 01:06:49.250 align:middle line:84% And then you go from k to l and k to j. 01:06:49.250 --> 01:06:51.080 align:middle line:84% And then you do this for k equals 2, also. 01:06:51.080 --> 01:06:51.680 align:middle line:90% We do it for-- 01:06:51.680 --> 01:06:52.722 align:middle line:90% llike you go from i to k. 01:06:52.722 --> 01:06:55.400 align:middle line:84% And then you'll do it from k to j. 01:06:55.400 --> 01:06:58.287 align:middle line:84% And so the final entry will-- the sum of all of this-- 01:06:58.287 --> 01:06:59.870 align:middle line:84% these products-- will be 1 if and only 01:06:59.870 --> 01:07:02.330 align:middle line:84% if there is a way to go from i to some k 01:07:02.330 --> 01:07:05.948 align:middle line:90% to j in two time steps. 01:07:05.948 --> 01:07:06.920 align:middle line:90% That OK? 01:07:06.920 --> 01:07:08.270 align:middle line:90% Or-- I don't know. 01:07:08.270 --> 01:07:08.770 align:middle line:90% OK. 01:07:08.770 --> 01:07:11.320 align:middle line:90% 01:07:11.320 --> 01:07:14.650 align:middle line:84% So in general then, if we want to look at the transition 01:07:14.650 --> 01:07:16.450 align:middle line:90% matrix of having-- 01:07:16.450 --> 01:07:18.320 align:middle line:90% after going for T time steps-- 01:07:18.320 --> 01:07:19.720 align:middle line:90% you keep doing this. 01:07:19.720 --> 01:07:27.900 align:middle line:84% And you get that the ijth entry of A to the power 01:07:27.900 --> 01:07:29.135 align:middle line:90% is whether i goes to j. 01:07:29.135 --> 01:07:38.270 align:middle line:90% 01:07:38.270 --> 01:07:43.740 align:middle line:84% AUDIENCE: So here, [INAUDIBLE] whether [INAUDIBLE] exactly T 01:07:43.740 --> 01:07:44.240 align:middle line:90% steps? 01:07:44.240 --> 01:07:45.682 align:middle line:90% Like, no more, no less? 01:07:45.682 --> 01:07:46.640 align:middle line:90% RACHEL ZHANG: Yeah, OK. 01:07:46.640 --> 01:07:48.020 align:middle line:90% That's a good point. 01:07:48.020 --> 01:07:51.410 align:middle line:84% So maybe we can say this should be in exactly T time steps. 01:07:51.410 --> 01:07:53.368 align:middle line:84% And maybe you can have your Turing machine stay 01:07:53.368 --> 01:07:55.910 align:middle line:84% as accepting configuration if it's already reached it, maybe, 01:07:55.910 --> 01:07:56.740 align:middle line:90% for instance. 01:07:56.740 --> 01:07:57.990 align:middle line:90% That's one thing you could do. 01:07:57.990 --> 01:07:59.570 align:middle line:84% Another way you could do it is you-- 01:07:59.570 --> 01:08:00.860 align:middle line:84% you could change this matrix because it's 01:08:00.860 --> 01:08:02.810 align:middle line:84% a one-to-one diagonal so that you can always 01:08:02.810 --> 01:08:04.100 align:middle line:90% waste time if you want. 01:08:04.100 --> 01:08:05.760 align:middle line:84% But whatever version you want is fine. 01:08:05.760 --> 01:08:09.000 align:middle line:84% Just-- maybe, let's say for now, after exactly T time steps, 01:08:09.000 --> 01:08:10.800 align:middle line:84% it should reach the existing configuration. 01:08:10.800 --> 01:08:13.000 align:middle line:84% And just have it start accepting place. 01:08:13.000 --> 01:08:20.069 align:middle line:90% 01:08:20.069 --> 01:08:21.830 align:middle line:84% So the point is if we can compute 01:08:21.830 --> 01:08:24.800 align:middle line:84% what AT of the input configuration, comma, 01:08:24.800 --> 01:08:26.600 align:middle line:84% the accepting configuration is, we 01:08:26.600 --> 01:08:30.930 align:middle line:84% know if this PSPACE computation is accepting or not. 01:08:30.930 --> 01:08:31.930 align:middle line:90% That good? 01:08:31.930 --> 01:08:36.628 align:middle line:90% 01:08:36.628 --> 01:08:38.214 align:middle line:90% So what we want is-- 01:08:38.214 --> 01:08:51.239 align:middle line:90% 01:08:51.239 --> 01:08:53.489 align:middle line:84% OK, so we're going to write a circuit to compute this. 01:08:53.489 --> 01:09:02.590 align:middle line:90% 01:09:02.590 --> 01:09:05.500 align:middle line:84% Is it OK if I'm very loose about this? 01:09:05.500 --> 01:09:07.000 align:middle line:84% I just feel like all these things 01:09:07.000 --> 01:09:09.680 align:middle line:84% about exactly how everything ends up is just terrible. 01:09:09.680 --> 01:09:10.640 align:middle line:90% I don't know. 01:09:10.640 --> 01:09:13.729 align:middle line:90% 01:09:13.729 --> 01:09:15.399 align:middle line:84% OK, so I guess one thing you could do 01:09:15.399 --> 01:09:16.840 align:middle line:84% is you could just compute and then 01:09:16.840 --> 01:09:19.529 align:middle line:84% A squared, then A cubed and A to the fourth. 01:09:19.529 --> 01:09:21.279 align:middle line:84% But it's not so good because you can do it 01:09:21.279 --> 01:09:23.810 align:middle line:84% for T times your circuit C, depth T. 01:09:23.810 --> 01:09:25.963 align:middle line:90% So what should you do instead? 01:09:25.963 --> 01:09:27.130 align:middle line:90% AUDIENCE: Repeated squaring. 01:09:27.130 --> 01:09:28.040 align:middle line:90% RACHEL ZHANG: Repeated squaring. 01:09:28.040 --> 01:09:28.180 align:middle line:90% Great. 01:09:28.180 --> 01:09:28.810 align:middle line:90% OK. 01:09:28.810 --> 01:09:29.310 align:middle line:90% Yay. 01:09:29.310 --> 01:09:35.390 align:middle line:90% 01:09:35.390 --> 01:09:35.890 align:middle line:90% OK. 01:09:35.890 --> 01:09:39.830 align:middle line:84% So the idea is we can compute this matrix A 01:09:39.830 --> 01:09:43.340 align:middle line:84% So this is going to be very easy to compute because we 01:09:43.340 --> 01:09:46.412 align:middle line:84% talked a little bit about how every entry of this matrix is-- 01:09:46.412 --> 01:09:47.870 align:middle line:84% you can compute it very easily just 01:09:47.870 --> 01:09:49.550 align:middle line:84% by looking at the two configurations 01:09:49.550 --> 01:09:50.800 align:middle line:90% are that you're interested in. 01:09:50.800 --> 01:09:54.200 align:middle line:90% 01:09:54.200 --> 01:09:57.800 align:middle line:84% And then you can compute A squared from this by just-- 01:09:57.800 --> 01:10:02.690 align:middle line:84% I guess you do one division, one multiplication. 01:10:02.690 --> 01:10:05.600 align:middle line:84% And then we can do A to the fourth, A to the eighth and so 01:10:05.600 --> 01:10:06.680 align:middle line:90% on. 01:10:06.680 --> 01:10:08.670 align:middle line:84% And eventually we'll get to A the T, 01:10:08.670 --> 01:10:09.970 align:middle line:90% which I don't have room for. 01:10:09.970 --> 01:10:19.397 align:middle line:90% 01:10:19.397 --> 01:10:20.730 align:middle line:90% This is going to be our matrix-- 01:10:20.730 --> 01:10:21.365 align:middle line:90% or our circuit. 01:10:21.365 --> 01:10:24.270 align:middle line:90% 01:10:24.270 --> 01:10:25.620 align:middle line:90% Let's look at the depth-- 01:10:25.620 --> 01:10:28.230 align:middle line:90% what the depth of the circuit. 01:10:28.230 --> 01:10:31.230 align:middle line:90% [INTERPOSING VOICES] 01:10:31.230 --> 01:10:33.817 align:middle line:90% 01:10:33.817 --> 01:10:36.520 align:middle line:90% OK, so it's, like, log T-ish. 01:10:36.520 --> 01:10:38.038 align:middle line:84% AUDIENCE: But each, like, thing-- 01:10:38.038 --> 01:10:38.830 align:middle line:90% RACHEL ZHANG: Yeah. 01:10:38.830 --> 01:10:39.330 align:middle line:90% OK. 01:10:39.330 --> 01:10:40.120 align:middle line:90% Times something. 01:10:40.120 --> 01:10:41.536 align:middle line:90% [LAUGHTER] 01:10:41.536 --> 01:10:43.185 align:middle line:84% AUDIENCE: But don't you have to do-- 01:10:43.185 --> 01:10:46.960 align:middle line:90% 01:10:46.960 --> 01:10:51.500 align:middle line:84% you have to add up T thetas to that thing. 01:10:51.500 --> 01:10:53.900 align:middle line:84% But you can make it a binary tree, so that will have 01:10:53.900 --> 01:10:54.760 align:middle line:90% [INAUDIBLE]. 01:10:54.760 --> 01:10:55.490 align:middle line:90% Yeah. 01:10:55.490 --> 01:10:55.990 align:middle line:90% OK. 01:10:55.990 --> 01:10:58.960 align:middle line:90% [INTERPOSING VOICES] 01:10:58.960 --> 01:11:00.078 align:middle line:90% AUDIENCE: Poly S. 01:11:00.078 --> 01:11:01.620 align:middle line:84% RACHEL ZHANG: We're going to say poly 01:11:01.620 --> 01:11:04.560 align:middle line:84% S. It's probably, like, log t times poly S anyway. 01:11:04.560 --> 01:11:08.360 align:middle line:90% 01:11:08.360 --> 01:11:09.400 align:middle line:90% So that's pretty good. 01:11:09.400 --> 01:11:12.730 align:middle line:84% Means that it's a verifier when running this computation 01:11:12.730 --> 01:11:13.870 align:middle line:90% with the prover in GKR. 01:11:13.870 --> 01:11:15.080 align:middle line:90% It's a scale to the depths. 01:11:15.080 --> 01:11:18.090 align:middle line:84% The depth is now in poly S. What's the size of the circuit? 01:11:18.090 --> 01:11:27.930 align:middle line:90% 01:11:27.930 --> 01:11:33.208 align:middle line:84% AUDIENCE: Poly S-ish, [INAUDIBLE] 2 to the S. 01:11:33.208 --> 01:11:35.670 align:middle line:84% AUDIENCE: [? Just ?] [? write ?] [? it out. ?] 01:11:35.670 --> 01:11:38.465 align:middle line:90% [INTERPOSING VOICES] 01:11:38.465 --> 01:11:40.712 align:middle line:90% 01:11:40.712 --> 01:11:42.420 align:middle line:84% RACHEL ZHANG: Yeah, so I guess the matrix 01:11:42.420 --> 01:11:45.135 align:middle line:84% stuff is going to be size 2 the 2, or something times 2 01:11:45.135 --> 01:11:45.640 align:middle line:90% to the S. 01:11:45.640 --> 01:11:46.350 align:middle line:90% AUDIENCE: 2 to the S squared. 01:11:46.350 --> 01:11:47.142 align:middle line:90% RACHEL ZHANG: Yeah. 01:11:47.142 --> 01:11:51.456 align:middle line:84% 2 to the S. So poly 2 to the S. 2 to the S times 2 to the S is 2 01:11:51.456 --> 01:11:52.110 align:middle line:90% to the 2S. 01:11:52.110 --> 01:11:52.780 align:middle line:90% So yeah. 01:11:52.780 --> 01:11:56.530 align:middle line:90% 01:11:56.530 --> 01:11:57.280 align:middle line:90% Yeah. 01:11:57.280 --> 01:11:58.010 align:middle line:90% OK. 01:11:58.010 --> 01:12:03.200 align:middle line:84% [LAUGHS] OK, so if we apply GKR to this, what do we get? 01:12:03.200 --> 01:12:06.176 align:middle line:90% So let's run GKR. 01:12:06.176 --> 01:12:08.885 align:middle line:84% Oh, and at the very top, we need to, then, 01:12:08.885 --> 01:12:11.510 align:middle line:84% look at the input state and then check the corresponding entry. 01:12:11.510 --> 01:12:15.050 align:middle line:84% So you want to read this particular entry, maybe. 01:12:15.050 --> 01:12:19.120 align:middle line:84% But you can read it by doing some of pretty small computation 01:12:19.120 --> 01:12:22.910 align:middle line:84% on what the input and accepting computations are. 01:12:22.910 --> 01:12:23.670 align:middle line:90% So let's run GKR. 01:12:23.670 --> 01:12:26.890 align:middle line:90% 01:12:26.890 --> 01:12:27.915 align:middle line:90% So prover runtime? 01:12:27.915 --> 01:12:38.727 align:middle line:90% 01:12:38.727 --> 01:12:39.810 align:middle line:90% AUDIENCE: Poly 2 to the S. 01:12:39.810 --> 01:12:40.330 align:middle line:90% RACHEL ZHANG: Yay. 01:12:40.330 --> 01:12:41.330 align:middle line:90% OK I'll let you do this. 01:12:41.330 --> 01:12:44.860 align:middle line:90% 01:12:44.860 --> 01:12:45.585 align:middle line:90% Verifier runtime? 01:12:45.585 --> 01:12:50.000 align:middle line:90% 01:12:50.000 --> 01:12:50.910 align:middle line:90% AUDIENCE: Poly S. 01:12:50.910 --> 01:12:51.660 align:middle line:90% RACHEL ZHANG: Yay. 01:12:51.660 --> 01:12:55.100 align:middle line:84% OK I guess that's what we wanted to prove, huh? 01:12:55.100 --> 01:12:56.160 align:middle line:90% OK. 01:12:56.160 --> 01:12:56.660 align:middle line:90% Nice. 01:12:56.660 --> 01:12:57.830 align:middle line:90% [LAUGHTER] 01:12:57.830 --> 01:12:59.290 align:middle line:90% Good work. 01:12:59.290 --> 01:13:00.870 align:middle line:84% Are there any questions about this? 01:13:00.870 --> 01:13:01.950 align:middle line:90% Or is this-- does it make sense? 01:13:01.950 --> 01:13:02.090 align:middle line:90% Yeah. 01:13:02.090 --> 01:13:04.423 align:middle line:84% AUDIENCE: Sorry, I might have missed an important point, 01:13:04.423 --> 01:13:07.045 align:middle line:84% but where is the cost of actually doing the squaring? 01:13:07.045 --> 01:13:08.907 align:middle line:90% 01:13:08.907 --> 01:13:11.240 align:middle line:84% RACHEL ZHANG: I guess a really good depth in the circuit 01:13:11.240 --> 01:13:13.430 align:middle line:84% is each square you do is going to take some more 01:13:13.430 --> 01:13:14.460 align:middle line:90% depth of your circuit. 01:13:14.460 --> 01:13:14.755 align:middle line:90% AUDIENCE: Yeah. 01:13:14.755 --> 01:13:16.463 align:middle line:84% RACHEL ZHANG: Is that what you're saying? 01:13:16.463 --> 01:13:18.440 align:middle line:84% AUDIENCE: Yeah, that's the question. 01:13:18.440 --> 01:13:20.010 align:middle line:84% RACHEL ZHANG: Maybe I didn't understand the question. 01:13:20.010 --> 01:13:21.000 align:middle line:90% AUDIENCE: Oh, is it-- 01:13:21.000 --> 01:13:23.350 align:middle line:90% what is the cost of squaring A? 01:13:23.350 --> 01:13:25.350 align:middle line:84% Just going from A to A squared, what's the cost? 01:13:25.350 --> 01:13:25.610 align:middle line:90% RACHEL ZHANG: Sure. 01:13:25.610 --> 01:13:26.110 align:middle line:90% Yeah. 01:13:26.110 --> 01:13:29.630 align:middle line:90% So how do you compute a squared. 01:13:29.630 --> 01:13:31.550 align:middle line:84% You can do every row and every column. 01:13:31.550 --> 01:13:34.133 align:middle line:90% And then what if I add them? 01:13:34.133 --> 01:13:34.675 align:middle line:90% AUDIENCE: Oh. 01:13:34.675 --> 01:13:35.930 align:middle line:90% So is it-- you're just doing-- 01:13:35.930 --> 01:13:38.055 align:middle line:84% RACHEL ZHANG: You're just doing matrix application. 01:13:38.055 --> 01:13:38.768 align:middle line:90% AUDIENCE: I see. 01:13:38.768 --> 01:13:41.060 align:middle line:84% RACHEL ZHANG: So maybe you can tell me how [INAUDIBLE]. 01:13:41.060 --> 01:13:43.328 align:middle line:90% [LAUGHTER] 01:13:43.328 --> 01:13:43.828 align:middle line:90% 01:13:43.828 --> 01:13:46.290 align:middle line:90% [INTERPOSING VOICES] 01:13:46.290 --> 01:13:48.340 align:middle line:90% 01:13:48.340 --> 01:13:50.987 align:middle line:84% AUDIENCE: But are we supposed to know how that thing that you 01:13:50.987 --> 01:13:53.320 align:middle line:84% said we need to prove to you-- are we supposed to know-- 01:13:53.320 --> 01:13:55.320 align:middle line:84% RACHEL ZHANG: Oh, yeah, that's a great question. 01:13:55.320 --> 01:14:00.040 align:middle line:84% So earlier-- I already erased it, I think. 01:14:00.040 --> 01:14:00.540 align:middle line:90% Wait. 01:14:00.540 --> 01:14:03.082 align:middle line:84% Are there any more questions about this before we go to that? 01:14:03.082 --> 01:14:05.507 align:middle line:90% 01:14:05.507 --> 01:14:07.520 align:middle line:84% AUDIENCE: So we're asking you this to prove that 01:14:07.520 --> 01:14:08.930 align:middle line:90% because [INAUDIBLE]. 01:14:08.930 --> 01:14:12.628 align:middle line:90% 01:14:12.628 --> 01:14:13.920 align:middle line:90% RACHEL ZHANG: You can't use IP. 01:14:13.920 --> 01:14:17.520 align:middle line:90% 01:14:17.520 --> 01:14:18.990 align:middle line:90% Just use the logic you just had. 01:14:18.990 --> 01:14:20.030 align:middle line:90% AUDIENCE: OK, OK. 01:14:20.030 --> 01:14:20.822 align:middle line:90% RACHEL ZHANG: Yeah. 01:14:20.822 --> 01:14:24.690 align:middle line:84% So how do we construct the circuit now? 01:14:24.690 --> 01:14:26.310 align:middle line:90% [INTERPOSING VOICES] 01:14:26.310 --> 01:14:39.183 align:middle line:90% 01:14:39.183 --> 01:14:40.600 align:middle line:84% AUDIENCE: So that's another reason 01:14:40.600 --> 01:14:42.444 align:middle line:84% we need logspace uniform [INAUDIBLE]. 01:14:42.444 --> 01:14:43.694 align:middle line:90% AUDIENCE: It runs in logspace. 01:14:43.694 --> 01:14:46.030 align:middle line:90% That's a Turing machine. 01:14:46.030 --> 01:14:47.425 align:middle line:90% So [INAUDIBLE] 01:14:47.425 --> 01:14:48.050 align:middle line:90% AUDIENCE: Yeah. 01:14:48.050 --> 01:14:52.280 align:middle line:90% 01:14:52.280 --> 01:14:53.250 align:middle line:90% RACHEL ZHANG: Yeah, OK. 01:14:53.250 --> 01:14:55.820 align:middle line:84% So this is basically a scaled-down version of that. 01:14:55.820 --> 01:14:57.900 align:middle line:90% This is logspace uniform. 01:14:57.900 --> 01:14:59.180 align:middle line:90% So you're running in logspace. 01:14:59.180 --> 01:15:01.190 align:middle line:84% Then you're running in time space S. 01:15:01.190 --> 01:15:04.243 align:middle line:84% So this is a exponentially smaller version of that. 01:15:04.243 --> 01:15:05.660 align:middle line:84% So all the parameters over there-- 01:15:05.660 --> 01:15:06.810 align:middle line:90% you scale them down. 01:15:06.810 --> 01:15:08.360 align:middle line:90% So we have the depth over here. 01:15:08.360 --> 01:15:14.150 align:middle line:84% Was poly S. The log of that is log S. The log of the size 01:15:14.150 --> 01:15:16.700 align:middle line:84% here is S So we have all those things we wanted. 01:15:16.700 --> 01:15:22.030 align:middle line:90% 01:15:22.030 --> 01:15:26.030 align:middle line:84% AUDIENCE: How do you incorporate that input into this-- 01:15:26.030 --> 01:15:27.888 align:middle line:84% you need to know what the starting state is. 01:15:27.888 --> 01:15:29.888 align:middle line:84% RACHEL ZHANG: With this one or with [INAUDIBLE]? 01:15:29.888 --> 01:15:31.330 align:middle line:90% AUDIENCE: With that one. 01:15:31.330 --> 01:15:32.580 align:middle line:90% RACHEL ZHANG: The input state. 01:15:32.580 --> 01:15:33.890 align:middle line:90% Yeah. 01:15:33.890 --> 01:15:36.230 align:middle line:84% So I think the way I normally think-- or I 01:15:36.230 --> 01:15:38.895 align:middle line:84% like to think about it is you only check the input 01:15:38.895 --> 01:15:40.520 align:middle line:84% configuration at the very end, once you 01:15:40.520 --> 01:15:42.105 align:middle line:90% complete the entire thing. 01:15:42.105 --> 01:15:44.480 align:middle line:84% So then you only have to read the input, comma, accepting 01:15:44.480 --> 01:15:46.160 align:middle line:90% configurations entry. 01:15:46.160 --> 01:15:49.250 align:middle line:84% And there you can just do a formula 01:15:49.250 --> 01:15:51.350 align:middle line:84% to read off what it says and then look 01:15:51.350 --> 01:15:53.990 align:middle line:90% at the corresponding value. 01:15:53.990 --> 01:15:56.870 align:middle line:84% AUDIENCE: So almost the entire circuit is just-- 01:15:56.870 --> 01:15:58.100 align:middle line:90% doesn't even read the input. 01:15:58.100 --> 01:15:59.892 align:middle line:84% RACHEL ZHANG: Yeah, it's only the very end. 01:15:59.892 --> 01:16:08.890 align:middle line:90% 01:16:08.890 --> 01:16:11.110 align:middle line:84% AUDIENCE: But, I mean, this is very accepting, 01:16:11.110 --> 01:16:14.670 align:middle line:84% and that one doesn't really accept it in print. 01:16:14.670 --> 01:16:16.446 align:middle line:90% RACHEL ZHANG: Yeah. 01:16:16.446 --> 01:16:18.008 align:middle line:90% AUDIENCE: [INAUDIBLE] 01:16:18.008 --> 01:16:19.050 align:middle line:90% RACHEL ZHANG: Yeah, yeah. 01:16:19.050 --> 01:16:19.550 align:middle line:90% OK. 01:16:19.550 --> 01:16:25.580 align:middle line:84% So maybe-- yeah, so I guess each configuration corresponds 01:16:25.580 --> 01:16:27.450 align:middle line:90% to-- it's a configuration. 01:16:27.450 --> 01:16:30.170 align:middle line:84% So there's some data about what the gate's output-- 01:16:30.170 --> 01:16:32.040 align:middle line:90% gate value is or something. 01:16:32.040 --> 01:16:34.570 align:middle line:84% Maybe you can read off the value there. 01:16:34.570 --> 01:16:38.930 align:middle line:90% 01:16:38.930 --> 01:16:41.030 align:middle line:84% AUDIENCE: Each entry, [INAUDIBLE] [? comma-- ?] is 01:16:41.030 --> 01:16:44.366 align:middle line:84% the gate here [? or not, ?] and then each entry [INAUDIBLE]? 01:16:44.366 --> 01:16:48.760 align:middle line:90% 01:16:48.760 --> 01:16:51.470 align:middle line:84% AUDIENCE: And this sounds like an easy add, mult situation, 01:16:51.470 --> 01:16:51.970 align:middle line:90% right? 01:16:51.970 --> 01:16:53.798 align:middle line:84% Because [? it's just ?] [? computation? ?] 01:16:53.798 --> 01:16:54.590 align:middle line:90% RACHEL ZHANG: Yeah. 01:16:54.590 --> 01:16:57.550 align:middle line:84% The important point here is that computing the matrix A 01:16:57.550 --> 01:16:58.550 align:middle line:90% is very easy. 01:16:58.550 --> 01:17:01.210 align:middle line:84% That's, really, the key thing here. 01:17:01.210 --> 01:17:03.850 align:middle line:84% And that's also why, when we said what-- 01:17:03.850 --> 01:17:04.970 align:middle line:90% we were behind. 01:17:04.970 --> 01:17:07.940 align:middle line:84% But when we said what A looks like, 01:17:07.940 --> 01:17:10.958 align:middle line:84% it really had to be also where the Turing pointer was, 01:17:10.958 --> 01:17:13.000 align:middle line:84% because if you didn't know where the pointer was, 01:17:13.000 --> 01:17:14.300 align:middle line:90% it could be very large. 01:17:14.300 --> 01:17:16.300 align:middle line:90% Yeah. 01:17:16.300 --> 01:17:24.360 align:middle line:90% AUDIENCE: [INAUDIBLE] 01:17:24.360 --> 01:17:29.040 align:middle line:84% AUDIENCE: So you can factor out what 01:17:29.040 --> 01:17:31.858 align:middle line:84% you're saying into the form of-- if you have a low space 01:17:31.858 --> 01:17:33.900 align:middle line:84% computation, you can turn to a low-depth circuit. 01:17:33.900 --> 01:17:37.063 align:middle line:84% Is that a is that a fair [INAUDIBLE]? that you've used? 01:17:37.063 --> 01:17:38.730 align:middle line:84% RACHEL ZHANG: Yeah, it's actually a kind 01:17:38.730 --> 01:17:40.658 align:middle line:90% of interesting statement, huh? 01:17:40.658 --> 01:17:41.200 align:middle line:90% I don't know. 01:17:41.200 --> 01:17:43.658 align:middle line:84% I didn't know that you could do this until recently either. 01:17:43.658 --> 01:17:47.270 align:middle line:90% 01:17:47.270 --> 01:17:48.950 align:middle line:84% So I guess-- the interesting thing here 01:17:48.950 --> 01:17:52.200 align:middle line:84% is instead of being a really tall and skinny computation, 01:17:52.200 --> 01:17:55.490 align:middle line:84% you can turn it into a circuit that's really fat and short. 01:17:55.490 --> 01:17:57.920 align:middle line:84% AUDIENCE: That's why we're getting [INAUDIBLE] depth, not 01:17:57.920 --> 01:17:58.835 align:middle line:90% [INAUDIBLE]. 01:17:58.835 --> 01:18:04.365 align:middle line:90% 01:18:04.365 --> 01:18:04.990 align:middle line:90% AUDIENCE: Wait. 01:18:04.990 --> 01:18:05.320 align:middle line:90% Sorry. 01:18:05.320 --> 01:18:05.820 align:middle line:90% OK. 01:18:05.820 --> 01:18:08.240 align:middle line:84% I was just-- in terms of where we're at in class. 01:18:08.240 --> 01:18:10.390 align:middle line:90% So we just proved this theorem. 01:18:10.390 --> 01:18:14.770 align:middle line:84% And is this the same reasoning for why the logic conformity 01:18:14.770 --> 01:18:16.310 align:middle line:90% thing works out, too-- 01:18:16.310 --> 01:18:17.380 align:middle line:90% by the same [INAUDIBLE]? 01:18:17.380 --> 01:18:18.463 align:middle line:90% RACHEL ZHANG: You tell me. 01:18:18.463 --> 01:18:18.970 align:middle line:90% [LAUGHTER] 01:18:18.970 --> 01:18:20.980 align:middle line:90% AUDIENCE: Yeah. 01:18:20.980 --> 01:18:22.780 align:middle line:90% You tell me. 01:18:22.780 --> 01:18:23.680 align:middle line:90% I'm delegating. 01:18:23.680 --> 01:18:25.650 align:middle line:90% [LAUGHTER] 01:18:25.650 --> 01:18:27.942 align:middle line:84% AUDIENCE: It's kind of weird because you don't actually 01:18:27.942 --> 01:18:29.030 align:middle line:90% take A as input. 01:18:29.030 --> 01:18:32.290 align:middle line:84% A is [? hardcoded ?] into the circuit, right? 01:18:32.290 --> 01:18:34.520 align:middle line:84% That's why the input can still be the small thing. 01:18:34.520 --> 01:18:37.045 align:middle line:84% That's just describing the starting state. 01:18:37.045 --> 01:18:39.070 align:middle line:84% RACHEL ZHANG: Yeah, The Turing machine, M, 01:18:39.070 --> 01:18:41.330 align:middle line:84% is what determines what the circuit action looks like. 01:18:41.330 --> 01:18:42.830 align:middle line:84% So maybe as part of the input of this, 01:18:42.830 --> 01:18:44.500 align:middle line:84% you're also going to have a description-- like, the Turing 01:18:44.500 --> 01:18:45.723 align:middle line:90% machine in its entirety. 01:18:45.723 --> 01:18:48.140 align:middle line:84% The Turing machines are finite size, so it doesn't matter. 01:18:48.140 --> 01:18:48.765 align:middle line:90% AUDIENCE: Yeah. 01:18:48.765 --> 01:18:51.015 align:middle line:90% 01:18:51.015 --> 01:18:52.390 align:middle line:84% AUDIENCE: And that's why we don't 01:18:52.390 --> 01:18:55.180 align:middle line:84% need to worry about complicated add, mult predicates inside, 01:18:55.180 --> 01:18:56.972 align:middle line:84% because it's actually just looks like this. 01:18:56.972 --> 01:19:07.225 align:middle line:90% 01:19:07.225 --> 01:19:08.850 align:middle line:84% AUDIENCE: I'm still kind of weirded out 01:19:08.850 --> 01:19:12.660 align:middle line:90% by the fact that all of that-- 01:19:12.660 --> 01:19:14.850 align:middle line:84% until the star at the top, all of this 01:19:14.850 --> 01:19:16.620 align:middle line:84% is not even dependent on the input. 01:19:16.620 --> 01:19:20.240 align:middle line:84% So it's like-- in this case, it's just going to be constant. 01:19:20.240 --> 01:19:21.330 align:middle line:90% Like, [INAUDIBLE]. 01:19:21.330 --> 01:19:23.970 align:middle line:84% So then why are we going through the trouble 01:19:23.970 --> 01:19:26.700 align:middle line:84% of computing all these layers, instead of just 01:19:26.700 --> 01:19:28.440 align:middle line:90% using the top layer, where we-- 01:19:28.440 --> 01:19:32.310 align:middle line:84% RACHEL ZHANG: I mean, how do you hold the top layer? 01:19:32.310 --> 01:19:34.170 align:middle line:84% AUDIENCE: So you're saying that it's easier 01:19:34.170 --> 01:19:37.812 align:middle line:84% to encode the entire computation thing than just the result. 01:19:37.812 --> 01:19:39.270 align:middle line:84% RACHEL ZHANG: It's easy to say what 01:19:39.270 --> 01:19:43.130 align:middle line:84% you have to do to compute it than to actually compute it. 01:19:43.130 --> 01:19:47.238 align:middle line:90% AUDIENCE: [INAUDIBLE] 01:19:47.238 --> 01:19:52.875 align:middle line:84% AUDIENCE: [INAUDIBLE] M, not C. M [INAUDIBLE] C. 01:19:52.875 --> 01:19:55.125 align:middle line:84% AUDIENCE: Or brackets used a compressed representation 01:19:55.125 --> 01:19:59.727 align:middle line:90% of C. [INAUDIBLE] 01:19:59.727 --> 01:20:02.060 align:middle line:84% AUDIENCE: But I'm saying, why don't you just hardcode it 01:20:02.060 --> 01:20:04.150 align:middle line:90% in the top layer of M? 01:20:04.150 --> 01:20:08.540 align:middle line:84% AUDIENCE: That would [INAUDIBLE] C. 01:20:08.540 --> 01:20:10.925 align:middle line:84% RACHEL ZHANG: They didn't even [INAUDIBLE] 01:20:10.925 --> 01:20:12.050 align:middle line:90% AUDIENCE: Well, it's just-- 01:20:12.050 --> 01:20:14.860 align:middle line:84% I mean, it's just a string of size of C. 01:20:14.860 --> 01:20:19.006 align:middle line:84% So you can't hardcode [INAUDIBLE] solution. 01:20:19.006 --> 01:20:19.548 align:middle line:90% AUDIENCE: OK. 01:20:19.548 --> 01:20:22.486 align:middle line:84% It's weird, but I can kind of see. 01:20:22.486 --> 01:20:24.718 align:middle line:90% 01:20:24.718 --> 01:20:26.885 align:middle line:84% AUDIENCE: So basically, we went through this trouble 01:20:26.885 --> 01:20:28.677 align:middle line:84% and we were able to go through this trouble 01:20:28.677 --> 01:20:31.320 align:middle line:84% because we assume that C can be described succinctly, 01:20:31.320 --> 01:20:32.790 align:middle line:90% like logspace succinctly. 01:20:32.790 --> 01:20:36.558 align:middle line:90% 01:20:36.558 --> 01:20:37.350 align:middle line:90% RACHEL ZHANG: Yeah. 01:20:37.350 --> 01:20:40.822 align:middle line:84% AUDIENCE: Is poly log S uniform [INAUDIBLE]? 01:20:40.822 --> 01:20:42.697 align:middle line:84% RACHEL ZHANG: I'm going to delegate-- push it 01:20:42.697 --> 01:20:44.420 align:middle line:90% to somebody else. 01:20:44.420 --> 01:20:48.380 align:middle line:90% I don't know how log blows up. 01:20:48.380 --> 01:20:51.140 align:middle line:84% Probably not, because if you take-- 01:20:51.140 --> 01:20:52.880 align:middle line:84% the transition matrix A you have is 01:20:52.880 --> 01:20:55.110 align:middle line:84% going to be 2 to the description size or whatever. 01:20:55.110 --> 01:20:56.430 align:middle line:90% Like, the space. 01:20:56.430 --> 01:20:58.610 align:middle line:84% So if you have larger space, it's really bad. 01:20:58.610 --> 01:21:01.760 align:middle line:90% 01:21:01.760 --> 01:21:03.780 align:middle line:84% AUDIENCE: But space S gets turned 01:21:03.780 --> 01:21:07.740 align:middle line:84% into depth like S squared, roughly, in this transformation. 01:21:07.740 --> 01:21:08.580 align:middle line:90% RACHEL ZHANG: Yeah. 01:21:08.580 --> 01:21:11.824 align:middle line:84% AUDIENCE: So if we have space S squared to start, 01:21:11.824 --> 01:21:15.160 align:middle line:90% we can definitely [INAUDIBLE]. 01:21:15.160 --> 01:21:16.660 align:middle line:84% RACHEL ZHANG: Yeah, but the question 01:21:16.660 --> 01:21:19.650 align:middle line:90% is the prover runtime, right? 01:21:19.650 --> 01:21:21.400 align:middle line:84% But the reason why we're doing any of this 01:21:21.400 --> 01:21:22.410 align:middle line:90% is because the prover runtime. 01:21:22.410 --> 01:21:24.577 align:middle line:84% You actually get an advantage in the prover runtime. 01:21:24.577 --> 01:21:35.220 align:middle line:90% 01:21:35.220 --> 01:21:36.560 align:middle line:90% So we're done early. 01:21:36.560 --> 01:21:39.080 align:middle line:84% So maybe we can all go get some corn. 01:21:39.080 --> 01:21:40.640 align:middle line:90% And-- yay. 01:21:40.640 --> 01:21:43.690 align:middle line:90% [APPLAUSE] 01:21:43.690 --> 01:21:46.000 align:middle line:90%