WEBVTT 00:00:00.000 --> 00:00:00.484 align:middle line:90% [SQUEAKING] 00:00:00.484 --> 00:00:00.984 align:middle line:90% [RUSTLING] 00:00:00.984 --> 00:00:02.420 align:middle line:90% [CLICKING] 00:00:02.420 --> 00:00:13.390 align:middle line:90% 00:00:13.390 --> 00:00:14.870 align:middle line:90% YAEL KALAI: OK, so let's start. 00:00:14.870 --> 00:00:17.530 align:middle line:90% So first of all, wow. 00:00:17.530 --> 00:00:19.010 align:middle line:90% Thank you all for coming back. 00:00:19.010 --> 00:00:23.380 align:middle line:84% I'm happy I didn't push you away. 00:00:23.380 --> 00:00:27.440 align:middle line:84% So before we start with today's lectures, just a few logistics. 00:00:27.440 --> 00:00:31.550 align:middle line:84% So for some reasons, you guys are taking a holiday next week, 00:00:31.550 --> 00:00:34.090 align:middle line:84% unfortunately, so we won't have class. 00:00:34.090 --> 00:00:37.640 align:middle line:84% The week after, on the 29th, unfortunately, 00:00:37.640 --> 00:00:41.080 align:middle line:84% I'm away that week at Germany, but we're going to have 00:00:41.080 --> 00:00:46.750 align:middle line:84% our amazing Rachel in the back give a fantastic lecture. 00:00:46.750 --> 00:00:48.310 align:middle line:90% So you'll enjoy that. 00:00:48.310 --> 00:00:55.358 align:middle line:84% And then the week after, which I believe is October 6, 00:00:55.358 --> 00:00:57.900 align:middle line:84% I would have loved to give you a great lecture, and I'm here. 00:00:57.900 --> 00:00:59.483 align:middle line:84% However, you're going to get something 00:00:59.483 --> 00:01:04.550 align:middle line:84% even better because there is a really, really amazing work, 00:01:04.550 --> 00:01:08.690 align:middle line:84% a new work by Oded Regev, who does 00:01:08.690 --> 00:01:13.700 align:middle line:84% a new construct, a new factoring algorithm, quantum factoring 00:01:13.700 --> 00:01:19.100 align:middle line:84% algorithm, so kind of improves Shor's algorithm in some way. 00:01:19.100 --> 00:01:21.470 align:middle line:84% It's a really, really exciting piece of work. 00:01:21.470 --> 00:01:23.720 align:middle line:84% Oded is in Paris, but that's the one 00:01:23.720 --> 00:01:27.510 align:middle line:84% day he was able to come here and present his work, 00:01:27.510 --> 00:01:29.730 align:middle line:90% and it's exactly on this class. 00:01:29.730 --> 00:01:32.060 align:middle line:84% So I think what we should do, we should all-- 00:01:32.060 --> 00:01:34.670 align:middle line:84% this class will move on October 6, 00:01:34.670 --> 00:01:37.250 align:middle line:84% and we'll all go to Oded Regev's talk. 00:01:37.250 --> 00:01:39.708 align:middle line:84% It's going to be this class, it's going to be a colloquium, 00:01:39.708 --> 00:01:41.542 align:middle line:84% and it's going to be a theory reading group. 00:01:41.542 --> 00:01:42.870 align:middle line:90% It's going to be all in one. 00:01:42.870 --> 00:01:47.270 align:middle line:84% It's going to have a very nice format where the first hour 00:01:47.270 --> 00:01:50.330 align:middle line:84% or so is going to be kind of a very general theory audience 00:01:50.330 --> 00:01:54.750 align:middle line:84% talk, and then we're going to have the next two or less 00:01:54.750 --> 00:01:56.970 align:middle line:84% hours, depending on how much he'll have the energy 00:01:56.970 --> 00:01:58.800 align:middle line:84% to speak to us, we're going to talk 00:01:58.800 --> 00:02:02.400 align:middle line:84% about more details about his algorithm and his work. 00:02:02.400 --> 00:02:04.050 align:middle line:90% So that's October 6. 00:02:04.050 --> 00:02:05.503 align:middle line:90% And then I'm going to be back. 00:02:05.503 --> 00:02:07.170 align:middle line:84% So you're going to have a bit of a break 00:02:07.170 --> 00:02:10.740 align:middle line:84% from me now, which I'm kind of sad about, but you may be happy. 00:02:10.740 --> 00:02:15.210 align:middle line:84% So let's first kind of recap where we 00:02:15.210 --> 00:02:17.970 align:middle line:90% were and continue from there. 00:02:17.970 --> 00:02:22.380 align:middle line:84% So last time, we defined this new class 00:02:22.380 --> 00:02:25.860 align:middle line:84% of proofs, kind of going away from the classical proofs 00:02:25.860 --> 00:02:29.590 align:middle line:84% to the regime of interactive proofs. 00:02:29.590 --> 00:02:32.080 align:middle line:84% We showed the power of these interactive proofs 00:02:32.080 --> 00:02:35.590 align:middle line:84% by showing one protocol in particular, the Sumcheck 00:02:35.590 --> 00:02:36.610 align:middle line:90% protocol. 00:02:36.610 --> 00:02:38.980 align:middle line:84% I wrote the Sumcheck protocol kind of very loosely 00:02:38.980 --> 00:02:43.410 align:middle line:84% in that board because we're going to refer to it today 00:02:43.410 --> 00:02:44.080 align:middle line:90% again. 00:02:44.080 --> 00:02:46.900 align:middle line:84% So the Sumcheck protocol, just to recap, 00:02:46.900 --> 00:02:50.160 align:middle line:84% it's a way to prove that the sum of a multivariate 00:02:50.160 --> 00:02:53.670 align:middle line:84% polynomial over, let's say, a small set h-- 00:02:53.670 --> 00:02:55.770 align:middle line:84% you can think of h as 0,1 as an example, 00:02:55.770 --> 00:02:58.390 align:middle line:84% over a Boolean cube or just a bigger cube, 00:02:58.390 --> 00:03:02.320 align:middle line:84% the sum is some value over some finite field. 00:03:02.320 --> 00:03:05.470 align:middle line:84% And of course, to compute the sum takes a very long time. 00:03:05.470 --> 00:03:06.720 align:middle line:90% It's, like, h to the m. 00:03:06.720 --> 00:03:08.440 align:middle line:84% You need to just sum everything up. 00:03:08.440 --> 00:03:10.440 align:middle line:84% But it turns out that you can verify 00:03:10.440 --> 00:03:13.660 align:middle line:84% it using an interactive proof very, very efficiently. 00:03:13.660 --> 00:03:15.790 align:middle line:84% Assuming you have oracle access to this function, 00:03:15.790 --> 00:03:18.000 align:middle line:84% you can compute it efficiently on any random element 00:03:18.000 --> 00:03:19.810 align:middle line:90% in the field. 00:03:19.810 --> 00:03:23.200 align:middle line:84% So this is what we covered last time, the Sumcheck protocol. 00:03:23.200 --> 00:03:24.930 align:middle line:84% As I told you, this object protocol 00:03:24.930 --> 00:03:29.050 align:middle line:84% is really the bread and butter of proof systems. 00:03:29.050 --> 00:03:31.030 align:middle line:84% Almost every proof system uses this protocol. 00:03:31.030 --> 00:03:33.180 align:middle line:84% It's a beautiful protocol, in my opinion, 00:03:33.180 --> 00:03:36.970 align:middle line:84% and we'll use it throughout this course. 00:03:36.970 --> 00:03:40.720 align:middle line:84% So if anyone has any questions about the Sumcheck protocol, 00:03:40.720 --> 00:03:43.720 align:middle line:90% please ask. 00:03:43.720 --> 00:03:46.190 align:middle line:84% And if it doesn't sit with you yet, 00:03:46.190 --> 00:03:49.360 align:middle line:84% I really encourage you to review the notes and-- 00:03:49.360 --> 00:03:56.140 align:middle line:84% in the website, there's also notes to Justin Thaler's survey 00:03:56.140 --> 00:03:58.030 align:middle line:84% which contains a very nice exposition. 00:03:58.030 --> 00:04:00.050 align:middle line:84% And also we have now Scribe for that, 00:04:00.050 --> 00:04:05.720 align:middle line:84% so you have various resources to look at the protocol. 00:04:05.720 --> 00:04:09.330 align:middle line:84% And then we start to look at applications for the protocol. 00:04:09.330 --> 00:04:13.870 align:middle line:84% The first application we got is to show interactive proof 00:04:13.870 --> 00:04:17.260 align:middle line:84% for Sharp-SAT, and we showed this interactive. 00:04:17.260 --> 00:04:21.040 align:middle line:84% The idea was to it was via this technique of arithmetization 00:04:21.040 --> 00:04:23.140 align:middle line:84% converting kind of a Boolean circuit 00:04:23.140 --> 00:04:25.520 align:middle line:90% into an arithmetic circuit. 00:04:25.520 --> 00:04:28.090 align:middle line:84% We'll use this technique today as well. 00:04:28.090 --> 00:04:30.970 align:middle line:84% And then we departed and talked about this idea 00:04:30.970 --> 00:04:33.472 align:middle line:84% of a doubly efficient interactive proof, where 00:04:33.472 --> 00:04:35.180 align:middle line:84% in a doubly efficient interactive proofs, 00:04:35.180 --> 00:04:38.650 align:middle line:84% we really care about the runtime of the prover in addition 00:04:38.650 --> 00:04:40.100 align:middle line:90% to the runtime of the verifier. 00:04:40.100 --> 00:04:43.230 align:middle line:84% So in the classical interactive proof setting, 00:04:43.230 --> 00:04:45.570 align:middle line:84% all the focus was on efficient verification. 00:04:45.570 --> 00:04:49.145 align:middle line:84% Nobody cared about the runtime of the prover. 00:04:49.145 --> 00:04:51.020 align:middle line:84% For all practical purposes, we thought of him 00:04:51.020 --> 00:04:53.060 align:middle line:90% as an all powerful. 00:04:53.060 --> 00:04:56.065 align:middle line:84% But doubly efficient, interactive proof, now, yeah, 00:04:56.065 --> 00:04:57.690 align:middle line:84% the proof, of course, is more powerful. 00:04:57.690 --> 00:04:59.857 align:middle line:84% Otherwise the verifier would do the work on his own. 00:04:59.857 --> 00:05:04.170 align:middle line:84% But we don't have all-powerful things in this world, 00:05:04.170 --> 00:05:07.070 align:middle line:84% unfortunately, so we also care about the efficiency 00:05:07.070 --> 00:05:07.920 align:middle line:90% of the prover. 00:05:07.920 --> 00:05:10.820 align:middle line:84% So he's just more efficient, but we don't want 00:05:10.820 --> 00:05:15.560 align:middle line:90% his work to be crazy expensive. 00:05:15.560 --> 00:05:18.420 align:middle line:84% So that was the doubly efficient interactive proofs. 00:05:18.420 --> 00:05:21.770 align:middle line:84% And we just started, and we'll continue today 00:05:21.770 --> 00:05:25.190 align:middle line:84% to show how we get a doubly efficient interactive proofs 00:05:25.190 --> 00:05:31.130 align:middle line:84% for counting triangles, for counting triangles in a graph, 00:05:31.130 --> 00:05:34.850 align:middle line:84% and it was via technique called the low-degree extension. 00:05:34.850 --> 00:05:38.180 align:middle line:84% So now the plan for this class today 00:05:38.180 --> 00:05:41.300 align:middle line:84% is to look at the low-degree extension. 00:05:41.300 --> 00:05:43.680 align:middle line:84% Again, this low-degree extension, it's a theorem. 00:05:43.680 --> 00:05:44.780 align:middle line:90% It's written here. 00:05:44.780 --> 00:05:46.430 align:middle line:90% I'll explain it. 00:05:46.430 --> 00:05:48.890 align:middle line:84% It's, again, the bread and butter that actually-- 00:05:48.890 --> 00:05:51.230 align:middle line:84% this low-degree extension theorem in some sense 00:05:51.230 --> 00:05:56.120 align:middle line:84% is what makes the subject protocol so popular, so 00:05:56.120 --> 00:05:58.850 align:middle line:90% kind of important. 00:05:58.850 --> 00:06:01.430 align:middle line:84% This theorem is what gives the Sumcheck protocol 00:06:01.430 --> 00:06:03.120 align:middle line:90% its power in a sense. 00:06:03.120 --> 00:06:07.340 align:middle line:84% So really together, the low-degree extension theorem 00:06:07.340 --> 00:06:11.840 align:middle line:84% together with the Sumcheck is like everything follows from it, 00:06:11.840 --> 00:06:13.760 align:middle line:90% via corollaries almost. 00:06:13.760 --> 00:06:20.030 align:middle line:84% So that's what we'll see this lecture and the next lecture. 00:06:20.030 --> 00:06:23.540 align:middle line:84% OK, so what is the low-degree extension theorem? 00:06:23.540 --> 00:06:31.070 align:middle line:84% What it says is that take any function from H to the m to 0,1. 00:06:31.070 --> 00:06:31.860 align:middle line:90% H is just any set. 00:06:31.860 --> 00:06:34.680 align:middle line:84% It can be 0,1 to the m, can be Boolean hypercube, 00:06:34.680 --> 00:06:37.072 align:middle line:84% but it can be a bigger hypercube. 00:06:37.072 --> 00:06:39.530 align:middle line:84% If you're more comfortable, if it's easier for you to think 00:06:39.530 --> 00:06:42.170 align:middle line:84% of H as 0,1, just think of it as 0,1. 00:06:42.170 --> 00:06:46.097 align:middle line:84% So take any function from H to the m to 0,1. 00:06:46.097 --> 00:06:48.180 align:middle line:84% So when I say any function, it's not a polynomial, 00:06:48.180 --> 00:06:49.347 align:middle line:90% it's just a set of elements. 00:06:49.347 --> 00:06:51.570 align:middle line:84% So when I say any function from H of them to 0,1, 00:06:51.570 --> 00:06:56.600 align:middle line:84% you should think of it as just an arbitrary sequence of H 00:06:56.600 --> 00:07:00.060 align:middle line:84% to the m bits, and then just ordered them, 00:07:00.060 --> 00:07:03.070 align:middle line:90% like in a hypercube. 00:07:03.070 --> 00:07:05.480 align:middle line:84% So I have this sequence of H to the m bits 00:07:05.480 --> 00:07:07.310 align:middle line:90% defined by this function. 00:07:07.310 --> 00:07:12.380 align:middle line:84% And the theorem says that if you take any finite field that 00:07:12.380 --> 00:07:17.410 align:middle line:84% contains this set H, so if H, let's say, is Boolean 0,1, 00:07:17.410 --> 00:07:18.660 align:middle line:90% you can take any finite field. 00:07:18.660 --> 00:07:21.840 align:middle line:84% Every finite field contains 0,1, but more generally, 00:07:21.840 --> 00:07:27.390 align:middle line:84% any finite field, there exists a unique polynomial. 00:07:27.390 --> 00:07:30.050 align:middle line:84% So now we move from an arbitrary set of bits 00:07:30.050 --> 00:07:35.130 align:middle line:90% to a polynomial f from f tilde. 00:07:35.130 --> 00:07:38.180 align:middle line:84% This is the extension, so we call it from f to f tilde. 00:07:38.180 --> 00:07:41.730 align:middle line:84% From f to the m, not H to the m, but f to the m, 00:07:41.730 --> 00:07:47.080 align:middle line:84% so I extended it to f to the m, to f such that if you look 00:07:47.080 --> 00:07:52.240 align:middle line:84% at the extended polynomial and the small hypercube H to the m, 00:07:52.240 --> 00:07:55.140 align:middle line:90% it really is exactly f. 00:07:55.140 --> 00:07:59.770 align:middle line:84% And this f tilde has small degree, 00:07:59.770 --> 00:08:06.090 align:middle line:84% so it's degree in each variable is the size of H minus 1. 00:08:06.090 --> 00:08:09.530 align:middle line:84% So if you want to visualize it, here's what you should think. 00:08:09.530 --> 00:08:14.380 align:middle line:84% I have a bunch of bits sitting on some hypercube. 00:08:14.380 --> 00:08:18.690 align:middle line:84% It can be Boolean or it can be more elements here. 00:08:18.690 --> 00:08:22.050 align:middle line:84% But I have arbitrary sequence of bits sitting here 00:08:22.050 --> 00:08:23.610 align:middle line:90% in this hypercube. 00:08:23.610 --> 00:08:27.435 align:middle line:84% And the theorem says you can extend this 00:08:27.435 --> 00:08:34.280 align:middle line:84% to a function over a big field, over f to the m in a unique way. 00:08:34.280 --> 00:08:37.030 align:middle line:84% I don't know if I specified, it's a unique way in a way 00:08:37.030 --> 00:08:37.929 align:middle line:90% that it extends. 00:08:37.929 --> 00:08:41.260 align:middle line:84% So the values are exactly as before. 00:08:41.260 --> 00:08:45.820 align:middle line:84% And the degree of this polynomial in each variable 00:08:45.820 --> 00:08:47.625 align:middle line:90% is exactly H minus 1. 00:08:47.625 --> 00:08:50.810 align:middle line:90% 00:08:50.810 --> 00:08:52.220 align:middle line:90% This is the theorem. 00:08:52.220 --> 00:08:56.720 align:middle line:84% By the way, in the case where H is 0,1, 00:08:56.720 --> 00:09:02.130 align:middle line:84% then the degree in each variable is 1 because H is 0,1, 00:09:02.130 --> 00:09:03.990 align:middle line:84% so the size of it is two degree 1. 00:09:03.990 --> 00:09:06.290 align:middle line:84% This is often called multilinear extension 00:09:06.290 --> 00:09:09.560 align:middle line:84% because the resulting f tilde is of degree 00:09:09.560 --> 00:09:14.640 align:middle line:84% 1 in each variable, in which case it's called multilinear. 00:09:14.640 --> 00:09:18.340 align:middle line:84% Any questions about what this theorem says, 00:09:18.340 --> 00:09:21.090 align:middle line:90% the meaning of this theorem. 00:09:21.090 --> 00:09:23.430 align:middle line:84% So we're going to prove this theorem next. 00:09:23.430 --> 00:09:25.710 align:middle line:84% And then we're going to go back to this counting 00:09:25.710 --> 00:09:28.420 align:middle line:84% triangles, which was just kind of a motivating example. 00:09:28.420 --> 00:09:31.140 align:middle line:84% But the focus is really this theorem. 00:09:31.140 --> 00:09:34.520 align:middle line:84% And before I go into the proof, I 00:09:34.520 --> 00:09:38.820 align:middle line:84% want to say why this thing is so powerful is that it allows you 00:09:38.820 --> 00:09:41.970 align:middle line:84% to go from an arbitrary sequence of bits 00:09:41.970 --> 00:09:45.540 align:middle line:84% to a polynomial, which is of low degree. 00:09:45.540 --> 00:09:48.820 align:middle line:84% And a polynomial of low degree has a lot of structure, 00:09:48.820 --> 00:09:51.280 align:middle line:84% and that kind of really helps us. 00:09:51.280 --> 00:09:53.850 align:middle line:84% For example, once you have polynomials of low degree 00:09:53.850 --> 00:09:57.660 align:middle line:84% with structures of low degree, we can apply Sumcheck protocols. 00:09:57.660 --> 00:10:01.247 align:middle line:84% So that's kind of the way we often use Sumcheck protocol. 00:10:01.247 --> 00:10:02.580 align:middle line:90% We're first going to go to look. 00:10:02.580 --> 00:10:04.015 align:middle line:90% We have an arbitrary sequence. 00:10:04.015 --> 00:10:05.890 align:middle line:84% We're going to take the low-degree extension, 00:10:05.890 --> 00:10:12.540 align:middle line:84% and now we can argue we can then use the Sumcheck protocol. 00:10:12.540 --> 00:10:16.620 align:middle line:90% Any questions before we-- 00:10:16.620 --> 00:10:18.126 align:middle line:90% yeah. 00:10:18.126 --> 00:10:23.010 align:middle line:84% STUDENT: Is another way to get these [INAUDIBLE] maybe not 00:10:23.010 --> 00:10:24.300 align:middle line:90% for arbitrary constants. 00:10:24.300 --> 00:10:27.260 align:middle line:90% So you take the arithmetized-- 00:10:27.260 --> 00:10:28.440 align:middle line:90% YAEL KALAI: Arithmetize? 00:10:28.440 --> 00:10:28.940 align:middle line:90% STUDENT: f. 00:10:28.940 --> 00:10:30.800 align:middle line:90% YAEL KALAI: Yeah, right. 00:10:30.800 --> 00:10:33.755 align:middle line:84% STUDENT: That should give you a low-ish degree, lower degree, 00:10:33.755 --> 00:10:40.670 align:middle line:84% if the depth of f is small on the Boolean hypercube 00:10:40.670 --> 00:10:41.280 align:middle line:90% [INAUDIBLE]. 00:10:41.280 --> 00:10:43.030 align:middle line:84% YAEL KALAI: So what you're saying is good. 00:10:43.030 --> 00:10:45.380 align:middle line:84% Let me just repeat what you're saying. 00:10:45.380 --> 00:10:49.010 align:middle line:84% What you're saying is if f has already-- 00:10:49.010 --> 00:10:51.470 align:middle line:84% is not arbitrary, but actually is 00:10:51.470 --> 00:10:55.085 align:middle line:84% kind of a circuit, an arithmetic circuit with and, 00:10:55.085 --> 00:10:57.830 align:middle line:84% and or, with addition and multiplication, 00:10:57.830 --> 00:11:00.420 align:middle line:84% and it's very low depth, like log depth, 00:11:00.420 --> 00:11:06.070 align:middle line:84% let's say, or let me call it depth D, then just kind of think 00:11:06.070 --> 00:11:07.640 align:middle line:90% of it as over a big field. 00:11:07.640 --> 00:11:10.610 align:middle line:84% Especially if it's 0,1, you can think of over a big field. 00:11:10.610 --> 00:11:15.370 align:middle line:84% And then the degree of this thing will be 2 to the depth. 00:11:15.370 --> 00:11:16.750 align:middle line:90% You're right. 00:11:16.750 --> 00:11:19.660 align:middle line:90% But 2 to the depth, eh. 00:11:19.660 --> 00:11:20.750 align:middle line:90% So you're right. 00:11:20.750 --> 00:11:23.800 align:middle line:84% And so actually for Sharp-SAT set, that's what we did. 00:11:23.800 --> 00:11:24.980 align:middle line:90% How did we use the Sumcheck? 00:11:24.980 --> 00:11:26.120 align:middle line:90% That's exactly what we did. 00:11:26.120 --> 00:11:27.953 align:middle line:84% But then you need to assume a lot of things. 00:11:27.953 --> 00:11:29.860 align:middle line:90% You need to assume that-- 00:11:29.860 --> 00:11:30.650 align:middle line:90% so you're right. 00:11:30.650 --> 00:11:32.900 align:middle line:84% If you start with an f that has structure, 00:11:32.900 --> 00:11:35.570 align:middle line:84% that it's very, very low depth, or the degree is very small, 00:11:35.570 --> 00:11:36.278 align:middle line:90% then you're done. 00:11:36.278 --> 00:11:37.300 align:middle line:90% You already have it. 00:11:37.300 --> 00:11:40.010 align:middle line:84% But what this is saying for any sequence, 00:11:40.010 --> 00:11:43.790 align:middle line:84% so any sequence of bits can be arbitrary. 00:11:43.790 --> 00:11:46.810 align:middle line:90% You can put it in this way. 00:11:46.810 --> 00:11:50.140 align:middle line:84% STUDENT: So I was just dropping to the uniqueness claim. 00:11:50.140 --> 00:11:54.578 align:middle line:84% So for these kind of low-depth f's, you might have 00:11:54.578 --> 00:11:55.120 align:middle line:90% a different-- 00:11:55.120 --> 00:11:55.990 align:middle line:90% YAEL KALAI: Different. 00:11:55.990 --> 00:11:57.490 align:middle line:84% STUDENT: It's probably-- but I guess 00:11:57.490 --> 00:12:00.220 align:middle line:84% the point is that degree will prevent you, right? 00:12:00.220 --> 00:12:01.210 align:middle line:90% YAEL KALAI: Exactly. 00:12:01.210 --> 00:12:04.600 align:middle line:84% So what you're saying for the functions that 00:12:04.600 --> 00:12:07.380 align:middle line:84% are kind of natively small degree, 00:12:07.380 --> 00:12:09.900 align:middle line:84% you can immediately get an extension, 00:12:09.900 --> 00:12:13.020 align:middle line:84% but the degree will not be the minimal, minimal degree. 00:12:13.020 --> 00:12:16.890 align:middle line:84% So to get the minimal degree, that's how you do it. 00:12:16.890 --> 00:12:18.270 align:middle line:90% Yeah, good. 00:12:18.270 --> 00:12:19.830 align:middle line:90% Thanks. 00:12:19.830 --> 00:12:21.930 align:middle line:90% Any other questions? 00:12:21.930 --> 00:12:24.100 align:middle line:84% OK, I just want to remind you, questions are great. 00:12:24.100 --> 00:12:25.808 align:middle line:84% I hope you just witnessed it because it's 00:12:25.808 --> 00:12:27.220 align:middle line:90% good for all of you. 00:12:27.220 --> 00:12:30.150 align:middle line:90% So please ask questions. 00:12:30.150 --> 00:12:31.660 align:middle line:90% OK. 00:12:31.660 --> 00:12:33.310 align:middle line:90% Should we dive in? 00:12:33.310 --> 00:12:33.830 align:middle line:90% OK. 00:12:33.830 --> 00:12:38.980 align:middle line:84% So the first thing to notice is, actually, you 00:12:38.980 --> 00:12:42.340 align:middle line:84% should be familiar with this theorem for the case 00:12:42.340 --> 00:12:44.040 align:middle line:90% where m equals 1. 00:12:44.040 --> 00:12:48.130 align:middle line:84% So first, just notice, for m equals 1, 00:12:48.130 --> 00:12:54.130 align:middle line:84% this theorem is simply known as the Lagrange interpolation 00:12:54.130 --> 00:12:55.450 align:middle line:90% theorem. 00:12:55.450 --> 00:12:56.805 align:middle line:90% This is really just Lagrange. 00:12:56.805 --> 00:13:05.890 align:middle line:90% 00:13:05.890 --> 00:13:08.180 align:middle line:84% What does Lagrange interpolation theorem says? 00:13:08.180 --> 00:13:12.800 align:middle line:84% Just to recap, it says that if you have arbitrary-- 00:13:12.800 --> 00:13:15.080 align:middle line:84% if you have an f exactly the same, 00:13:15.080 --> 00:13:19.870 align:middle line:84% I'll just write it from H to 0,1, 00:13:19.870 --> 00:13:24.190 align:middle line:84% then there is a unique way of extending it to f to be 00:13:24.190 --> 00:13:26.470 align:middle line:90% of degree H minus 1. 00:13:26.470 --> 00:13:39.660 align:middle line:84% So there is a unique f tilde from f to f of degree H minus 1. 00:13:39.660 --> 00:13:42.310 align:middle line:84% And Moreover, I'll tell you what it is. 00:13:42.310 --> 00:13:44.380 align:middle line:84% Let me just tell you what this f tilde is. 00:13:44.380 --> 00:13:54.725 align:middle line:84% The F tilde is simply sum over all the h's in h-- 00:13:54.725 --> 00:13:57.450 align:middle line:90% 00:13:57.450 --> 00:14:00.960 align:middle line:90% sorry, f of h-- 00:14:00.960 --> 00:14:07.170 align:middle line:84% times some polynomial chi h of x, 00:14:07.170 --> 00:14:13.470 align:middle line:84% where this polynomial is 0 on all the h elements, 00:14:13.470 --> 00:14:16.770 align:middle line:90% except for on this specific one. 00:14:16.770 --> 00:14:20.770 align:middle line:90% So this polynomial where-- 00:14:20.770 --> 00:14:30.650 align:middle line:84% so this is the f where chi h of x is what? 00:14:30.650 --> 00:14:43.890 align:middle line:84% Is 1, where if for every h prime in H, 00:14:43.890 --> 00:14:50.030 align:middle line:84% it's 1 if h prime is equal to h, and 0 otherwise. 00:14:50.030 --> 00:14:50.780 align:middle line:90% Yes? 00:14:50.780 --> 00:14:52.905 align:middle line:84% STUDENT: Shouldn't that be the inverse [INAUDIBLE]? 00:14:52.905 --> 00:14:55.540 align:middle line:84% YAEL KALAI: Shouldn't it be the inverse? 00:14:55.540 --> 00:14:59.135 align:middle line:90% STUDENT: [INAUDIBLE] 00:14:59.135 --> 00:15:02.220 align:middle line:84% YAEL KALAI: I want the output to be-- so OK, let's see. 00:15:02.220 --> 00:15:05.020 align:middle line:84% What I want that if I'm somewhere in H, 00:15:05.020 --> 00:15:07.780 align:middle line:84% so I want to say that if I'm somewhere in H prime, 00:15:07.780 --> 00:15:14.030 align:middle line:84% I want to get f of H. I want f tilde of-- 00:15:14.030 --> 00:15:18.350 align:middle line:84% so for any H star, I want f tilde of H star 00:15:18.350 --> 00:15:22.478 align:middle line:90% to be f of H star. 00:15:22.478 --> 00:15:24.620 align:middle line:90% STUDENT: Either 0 or 1, right? 00:15:24.620 --> 00:15:27.270 align:middle line:84% YAEL KALAI: Which is either 0 or 1. 00:15:27.270 --> 00:15:28.240 align:middle line:90% Yeah? 00:15:28.240 --> 00:15:29.150 align:middle line:90% Yeah. 00:15:29.150 --> 00:15:29.820 align:middle line:84% STUDENT: So that's what I'm saying. 00:15:29.820 --> 00:15:30.600 align:middle line:90% YAEL KALAI: Oh, sorry. 00:15:30.600 --> 00:15:32.683 align:middle line:84% STUDENT: Instead of this, it should be the inverse 00:15:32.683 --> 00:15:40.192 align:middle line:84% so that when you apply on the H star, it cancels. 00:15:40.192 --> 00:15:42.650 align:middle line:84% YAEL KALAI: What do you mean, f of H should be the inverse? 00:15:42.650 --> 00:15:45.025 align:middle line:84% I'm not sure-- you're saying here, I should have inverse? 00:15:45.025 --> 00:15:45.670 align:middle line:90% STUDENT: Yeah. 00:15:45.670 --> 00:15:47.230 align:middle line:90% YAEL KALAI: Why? 00:15:47.230 --> 00:15:52.125 align:middle line:84% STUDENT: So the next H will give you something that's non-zero. 00:15:52.125 --> 00:15:53.750 align:middle line:84% YAEL KALAI: OK, so let me try to argue. 00:15:53.750 --> 00:15:55.490 align:middle line:84% Maybe let's try to do this together. 00:15:55.490 --> 00:15:58.480 align:middle line:90% So if this is chi-- 00:15:58.480 --> 00:16:02.980 align:middle line:84% So I first define chi of H that I'm 00:16:02.980 --> 00:16:04.580 align:middle line:90% going to define it in a second. 00:16:04.580 --> 00:16:06.163 align:middle line:84% Actually, I didn't finish defining it, 00:16:06.163 --> 00:16:12.680 align:middle line:84% but what's important to me that on every h prime in H, 00:16:12.680 --> 00:16:16.010 align:middle line:84% it's 1 if h prime is equal to h and 0 otherwise. 00:16:16.010 --> 00:16:17.340 align:middle line:90% Suppose I defined it. 00:16:17.340 --> 00:16:18.810 align:middle line:90% Now, let's see what I get here. 00:16:18.810 --> 00:16:23.720 align:middle line:84% I have f tilde of H star is sum fH. 00:16:23.720 --> 00:16:26.860 align:middle line:90% 00:16:26.860 --> 00:16:31.600 align:middle line:84% Chi h of H star, but this is always 0. 00:16:31.600 --> 00:16:37.150 align:middle line:84% Except it's 1 when h equals H star. 00:16:37.150 --> 00:16:42.130 align:middle line:84% So it's always 0, except for when h equals H star 00:16:42.130 --> 00:16:45.880 align:middle line:84% and when h-- oh, you're saying when h equals H star, 00:16:45.880 --> 00:16:53.340 align:middle line:90% then I have f of H star. 00:16:53.340 --> 00:16:57.160 align:middle line:90% 00:16:57.160 --> 00:16:59.950 align:middle line:90% So this does extend. 00:16:59.950 --> 00:17:01.360 align:middle line:90% Yeah? 00:17:01.360 --> 00:17:02.830 align:middle line:90% So we're good? 00:17:02.830 --> 00:17:04.160 align:middle line:90% OK, great. 00:17:04.160 --> 00:17:06.760 align:middle line:84% OK, but let me just mention what is-- 00:17:06.760 --> 00:17:08.060 align:middle line:90% I said, this is the chi. 00:17:08.060 --> 00:17:09.839 align:middle line:90% But let me actually be explicit. 00:17:09.839 --> 00:17:12.190 align:middle line:90% So let me erase this. 00:17:12.190 --> 00:17:17.380 align:middle line:84% The chi in the Lagrange interpolation theorem, 00:17:17.380 --> 00:17:18.859 align:middle line:90% it satisfies this. 00:17:18.859 --> 00:17:21.700 align:middle line:84% But let me actually tell you exactly what it is. 00:17:21.700 --> 00:17:22.730 align:middle line:90% It's pretty simple. 00:17:22.730 --> 00:17:30.670 align:middle line:84% It's just sum over h prime in H, and then it's, 00:17:30.670 --> 00:17:37.270 align:middle line:84% I think, H prime minus x divided by h. 00:17:37.270 --> 00:17:39.810 align:middle line:90% Oh, sorry, multiplication. 00:17:39.810 --> 00:17:44.120 align:middle line:90% 00:17:44.120 --> 00:17:52.110 align:middle line:84% h prime in H minus except for h, and its h prime minus h. 00:17:52.110 --> 00:17:56.670 align:middle line:84% So first, note, this is of degree h minus 1. 00:17:56.670 --> 00:17:59.825 align:middle line:84% And when you look at it for any element-- 00:17:59.825 --> 00:18:02.515 align:middle line:90% 00:18:02.515 --> 00:18:12.650 align:middle line:84% oh, yeah, for any element h prime, it's going to be-- 00:18:12.650 --> 00:18:17.870 align:middle line:84% this is going to cancel out unless you happen to be h. 00:18:17.870 --> 00:18:19.180 align:middle line:90% Wait, did I do it wrong? 00:18:19.180 --> 00:18:22.530 align:middle line:90% 00:18:22.530 --> 00:18:24.430 align:middle line:84% Unless you're h, and then you're 1. 00:18:24.430 --> 00:18:25.850 align:middle line:90% Good. 00:18:25.850 --> 00:18:29.600 align:middle line:84% OK, so this is just a recap for Lagrange interpolation. 00:18:29.600 --> 00:18:32.300 align:middle line:90% Now, let me tell you here. 00:18:32.300 --> 00:18:35.100 align:middle line:84% So this theorem says the same thing, 00:18:35.100 --> 00:18:38.570 align:middle line:90% but for m bits, for m variables. 00:18:38.570 --> 00:18:42.110 align:middle line:84% And it turns out, you know how this was f tilde? 00:18:42.110 --> 00:18:47.600 align:middle line:90% Here f tilde, of Z-- 00:18:47.600 --> 00:18:50.930 align:middle line:90% Z now is in f to the m-- 00:18:50.930 --> 00:18:52.230 align:middle line:90% is very similar. 00:18:52.230 --> 00:19:00.850 align:middle line:84% It's also sum f of h1 up to hm, so for every point 00:19:00.850 --> 00:19:11.270 align:middle line:90% times this chi h1hm of z. 00:19:11.270 --> 00:19:12.960 align:middle line:90% And what is this? 00:19:12.960 --> 00:19:19.530 align:middle line:84% This is 1 if z-- and the small hypercube, this 00:19:19.530 --> 00:19:22.980 align:middle line:84% is 1 if the Z is h1 up to hm and is 0. 00:19:22.980 --> 00:19:24.990 align:middle line:90% Otherwise, and it extends. 00:19:24.990 --> 00:19:27.490 align:middle line:84% So but actually, let me be more specific. 00:19:27.490 --> 00:19:34.660 align:middle line:84% It's really where chi h1 up to hm 00:19:34.660 --> 00:19:44.140 align:middle line:84% of-- let me call it x1 up to xm is just the multiplication 00:19:44.140 --> 00:19:48.580 align:middle line:90% of chi hi xi. 00:19:48.580 --> 00:19:51.550 align:middle line:90% i goes from 1 to m. 00:19:51.550 --> 00:19:53.385 align:middle line:90% OK, so let me move this board. 00:19:53.385 --> 00:19:57.890 align:middle line:90% 00:19:57.890 --> 00:19:59.610 align:middle line:90% Don't let me erase this board. 00:19:59.610 --> 00:20:00.110 align:middle line:90% OK? 00:20:00.110 --> 00:20:00.950 align:middle line:90% We'll need it. 00:20:00.950 --> 00:20:04.980 align:middle line:84% So again, what is the low-degree extension f tilde? 00:20:04.980 --> 00:20:09.490 align:middle line:84% It's similar to the univariate case. 00:20:09.490 --> 00:20:12.350 align:middle line:84% You sum over the entire hypercube, 00:20:12.350 --> 00:20:18.560 align:middle line:84% and you multiply by the degree h minus 1 in each variable. 00:20:18.560 --> 00:20:22.790 align:middle line:84% It's just the multiplication, all of these chi i's that 00:20:22.790 --> 00:20:23.560 align:middle line:90% were defined here. 00:20:23.560 --> 00:20:27.010 align:middle line:90% 00:20:27.010 --> 00:20:27.510 align:middle line:90% OK. 00:20:27.510 --> 00:20:28.610 align:middle line:90% So let's see if-- 00:20:28.610 --> 00:20:32.770 align:middle line:84% let me try to prove that this works and that it's unique. 00:20:32.770 --> 00:20:38.750 align:middle line:90% 00:20:38.750 --> 00:20:41.730 align:middle line:84% So first, what do we need to argue? 00:20:41.730 --> 00:20:43.140 align:middle line:90% So we have this f tilde. 00:20:43.140 --> 00:20:45.980 align:middle line:84% Now I need to argue that it extends. 00:20:45.980 --> 00:20:48.080 align:middle line:90% So the fact-- 00:20:48.080 --> 00:20:50.360 align:middle line:90% OK, so proof. 00:20:50.360 --> 00:20:58.010 align:middle line:84% So let's first see that for every h1 star up to hm star in H 00:20:58.010 --> 00:21:06.420 align:middle line:84% to the m, let's look at f tilde of h, hm. 00:21:06.420 --> 00:21:07.140 align:middle line:90% What is it? 00:21:07.140 --> 00:21:19.615 align:middle line:84% It's just sum f of h1 up to hm times chi of-- 00:21:19.615 --> 00:21:24.740 align:middle line:90% 00:21:24.740 --> 00:21:26.900 align:middle line:90% so let's look at f tilde. 00:21:26.900 --> 00:21:29.420 align:middle line:84% f tilde, on any point in the hypercube, 00:21:29.420 --> 00:21:32.180 align:middle line:84% I defined it by star because it's a specific point. 00:21:32.180 --> 00:21:34.910 align:middle line:90% And I just substituted. 00:21:34.910 --> 00:21:36.570 align:middle line:90% I defined this f tilde. 00:21:36.570 --> 00:21:39.050 align:middle line:84% I just substituted Z because this is my Z point. 00:21:39.050 --> 00:21:40.470 align:middle line:90% And now what do I have? 00:21:40.470 --> 00:21:45.140 align:middle line:84% I know that this is equal to 1, if and only 00:21:45.140 --> 00:21:51.080 align:middle line:84% if hi star is equal to hi for every i, 00:21:51.080 --> 00:21:53.250 align:middle line:84% because this is how the chi is defined. 00:21:53.250 --> 00:21:57.610 align:middle line:84% This is just the multiplication of these kinds. 00:21:57.610 --> 00:21:59.590 align:middle line:90% So therefore, that's it. 00:21:59.590 --> 00:22:03.990 align:middle line:84% This is just f of h1 star up to hm star, 00:22:03.990 --> 00:22:06.330 align:middle line:84% because the rest of the terms cancel. 00:22:06.330 --> 00:22:08.330 align:middle line:90% Done. 00:22:08.330 --> 00:22:08.830 align:middle line:90% Yeah? 00:22:08.830 --> 00:22:10.950 align:middle line:90% So it extends. 00:22:10.950 --> 00:22:11.915 align:middle line:90% How about the degree? 00:22:11.915 --> 00:22:16.330 align:middle line:90% 00:22:16.330 --> 00:22:18.340 align:middle line:90% What's the degree of f tilde? 00:22:18.340 --> 00:22:23.090 align:middle line:84% It's just the degree of these chis. 00:22:23.090 --> 00:22:26.850 align:middle line:84% So let's look at degree i of variable i. 00:22:26.850 --> 00:22:31.122 align:middle line:84% It's the degree i of chi of h1hm. 00:22:31.122 --> 00:22:37.870 align:middle line:90% 00:22:37.870 --> 00:22:38.860 align:middle line:90% Which is what? 00:22:38.860 --> 00:22:44.200 align:middle line:84% It's just the degree of a single chi hi on xi, 00:22:44.200 --> 00:22:55.820 align:middle line:84% because this just factors to the multiplication chi i and xi. 00:22:55.820 --> 00:22:59.710 align:middle line:84% So that's just the degree of this, which is, 00:22:59.710 --> 00:23:03.100 align:middle line:84% by what we saw there, simply h minus 1. 00:23:03.100 --> 00:23:05.400 align:middle line:90% Done. 00:23:05.400 --> 00:23:06.570 align:middle line:90% So it is indeed. 00:23:06.570 --> 00:23:08.430 align:middle line:90% It extends f. 00:23:08.430 --> 00:23:10.677 align:middle line:84% The degree is correct, h minus 1 in each variable. 00:23:10.677 --> 00:23:13.010 align:middle line:84% The only thing that I need to argue is that it's unique. 00:23:13.010 --> 00:23:16.500 align:middle line:90% 00:23:16.500 --> 00:23:17.430 align:middle line:90% Questions? 00:23:17.430 --> 00:23:22.060 align:middle line:90% 00:23:22.060 --> 00:23:23.040 align:middle line:90% OK. 00:23:23.040 --> 00:23:26.250 align:middle line:84% So the uniqueness will follow from the uniqueness 00:23:26.250 --> 00:23:28.060 align:middle line:90% in the univariate case. 00:23:28.060 --> 00:23:31.920 align:middle line:84% So we already know from Lagrange interpolation theorem 00:23:31.920 --> 00:23:37.040 align:middle line:84% that in the univariate case, f tilde is unique. 00:23:37.040 --> 00:23:39.080 align:middle line:84% Now we're going to rely on that to argue 00:23:39.080 --> 00:23:43.550 align:middle line:84% that in the multivariate case, f tilde is unique. 00:23:43.550 --> 00:23:46.240 align:middle line:90% OK? 00:23:46.240 --> 00:23:48.390 align:middle line:90% Questions? 00:23:48.390 --> 00:23:50.430 align:middle line:90% OK, so let's do it. 00:23:50.430 --> 00:23:51.696 align:middle line:90% So uniqueness. 00:23:51.696 --> 00:23:56.690 align:middle line:90% 00:23:56.690 --> 00:24:00.430 align:middle line:84% So suppose for contradiction that it's not unique. 00:24:00.430 --> 00:24:09.540 align:middle line:84% So suppose for contradiction that it's not unique. 00:24:09.540 --> 00:24:12.260 align:middle line:84% So there exists two ways to extend 00:24:12.260 --> 00:24:16.290 align:middle line:90% that agree on the hypercube. 00:24:16.290 --> 00:24:20.190 align:middle line:84% This means that if you subtract these two, 00:24:20.190 --> 00:24:23.370 align:middle line:84% you'll get a degree h minus 1 polynomial 00:24:23.370 --> 00:24:25.980 align:middle line:84% in each variable that in the hypercube is 0. 00:24:25.980 --> 00:24:31.630 align:middle line:84% But it's not 0 because there are two different polynomials. 00:24:31.630 --> 00:24:36.060 align:middle line:84% So suppose for contradiction-- let me just erase this 00:24:36.060 --> 00:24:37.190 align:middle line:90% because it's in my way. 00:24:37.190 --> 00:24:44.400 align:middle line:84% Suppose for contradiction that there exists a g from f to the m 00:24:44.400 --> 00:24:57.040 align:middle line:84% to f, non-zero, but g in the hypercube is 0-- that's 00:24:57.040 --> 00:25:05.150 align:middle line:84% the contradiction-- and of degree h minus 1 00:25:05.150 --> 00:25:06.530 align:middle line:90% in each variable. 00:25:06.530 --> 00:25:07.910 align:middle line:90% Yes, that's a contradiction. 00:25:07.910 --> 00:25:09.740 align:middle line:84% Say, suppose there exist two polynomials 00:25:09.740 --> 00:25:13.200 align:middle line:84% that agree on the hypercube of this degree. 00:25:13.200 --> 00:25:14.740 align:middle line:90% We're going to subtract them. 00:25:14.740 --> 00:25:17.090 align:middle line:84% We're going to get a single polynomial 00:25:17.090 --> 00:25:19.520 align:middle line:84% that just 0 on the hypercube because the two agreed. 00:25:19.520 --> 00:25:22.850 align:middle line:84% But it's not 0 because they were not the same polynomial. 00:25:22.850 --> 00:25:26.530 align:middle line:90% What does it mean, non-zero? 00:25:26.530 --> 00:25:29.310 align:middle line:84% What does this mean, of degree m minus 1 in each variable? 00:25:29.310 --> 00:25:32.880 align:middle line:90% 00:25:32.880 --> 00:25:35.760 align:middle line:84% The fact that it's non-zero means 00:25:35.760 --> 00:25:45.810 align:middle line:84% that there exists some t1 up to tm in f to the m such that g 00:25:45.810 --> 00:25:50.810 align:middle line:90% and t1 up to tm is not 0. 00:25:50.810 --> 00:25:51.310 align:middle line:90% Yeah? 00:25:51.310 --> 00:25:53.800 align:middle line:84% So we're starting to think, suppose we have g. 00:25:53.800 --> 00:25:58.040 align:middle line:84% It's not 0, but it's 0 on the hypercube. 00:25:58.040 --> 00:25:59.540 align:middle line:84% I'm going to argue, no, it can't be. 00:25:59.540 --> 00:26:01.930 align:middle line:84% I'm going to find an element in the hypercube for which it's not 00:26:01.930 --> 00:26:02.430 align:middle line:90% 0. 00:26:02.430 --> 00:26:07.140 align:middle line:90% 00:26:07.140 --> 00:26:09.090 align:middle line:90% OK, how do I do that? 00:26:09.090 --> 00:26:12.210 align:middle line:84% What I'm going to do, I'm going to go into the hypercube 00:26:12.210 --> 00:26:15.147 align:middle line:84% coordinate by coordinate, kind of by induction. 00:26:15.147 --> 00:26:16.480 align:middle line:90% And here's what I'm going to do. 00:26:16.480 --> 00:26:24.260 align:middle line:84% I'm going to say, OK, let's look at g mt t2 up to tm. 00:26:24.260 --> 00:26:27.160 align:middle line:90% 00:26:27.160 --> 00:26:31.760 align:middle line:84% This is non-zero because on t1 it's not 0. 00:26:31.760 --> 00:26:41.690 align:middle line:84% So this is non-zero of degree H minus 1. 00:26:41.690 --> 00:26:47.810 align:middle line:84% But from the Lagrange interpolation theorem, 00:26:47.810 --> 00:26:51.410 align:middle line:84% it says that if it's not 0, there 00:26:51.410 --> 00:26:57.410 align:middle line:84% must exist small h in H, for which it's not 0, 00:26:57.410 --> 00:26:59.600 align:middle line:84% because if it was 0 in all h, there's a unique way 00:26:59.600 --> 00:27:02.030 align:middle line:90% to extend the 0 polynomial. 00:27:02.030 --> 00:27:05.840 align:middle line:84% So because the uniqueness of the Lagrange, it means that-- 00:27:05.840 --> 00:27:12.850 align:middle line:84% so from Lagrange's theorem, this is just univariate. 00:27:12.850 --> 00:27:22.600 align:middle line:84% It means that there must exist h1 such that g of h1t2 up to tm 00:27:22.600 --> 00:27:24.620 align:middle line:90% is non-zero. 00:27:24.620 --> 00:27:26.840 align:middle line:90% Again, why? 00:27:26.840 --> 00:27:28.290 align:middle line:90% So, the t's are fixed. 00:27:28.290 --> 00:27:29.990 align:middle line:90% This is a univariate polynomial. 00:27:29.990 --> 00:27:38.310 align:middle line:84% If it was 0 on H, then you could extend it to the all zeros. 00:27:38.310 --> 00:27:40.890 align:middle line:84% But there's another way to extend, 00:27:40.890 --> 00:27:44.100 align:middle line:90% because the g's not all zeros. 00:27:44.100 --> 00:27:45.900 align:middle line:90% That would be a contradiction. 00:27:45.900 --> 00:27:50.920 align:middle line:84% So therefore, there must exist H1 such that this is 0. 00:27:50.920 --> 00:27:54.040 align:middle line:84% And now we're going to slowly continue in this manner. 00:27:54.040 --> 00:28:01.940 align:middle line:84% OK, now let's look at gh1t3 up to tm. 00:28:01.940 --> 00:28:04.800 align:middle line:90% 00:28:04.800 --> 00:28:08.230 align:middle line:84% So h1 is fixed in the small cube. 00:28:08.230 --> 00:28:09.840 align:middle line:90% These are fixed in f. 00:28:09.840 --> 00:28:14.500 align:middle line:84% It's non-zero because on t2, it's not 0. 00:28:14.500 --> 00:28:16.650 align:middle line:90% That's what we established. 00:28:16.650 --> 00:28:22.900 align:middle line:84% So this is non-zero of degree h minus 1, 00:28:22.900 --> 00:28:27.130 align:middle line:84% and therefore somewhere in this small hypercube-- 00:28:27.130 --> 00:28:31.390 align:middle line:84% somewhere on h, sorry, it should be non-zero from Lagrange 00:28:31.390 --> 00:28:32.540 align:middle line:90% interpolation theorem. 00:28:32.540 --> 00:28:36.310 align:middle line:84% So therefore from Lagrange interpolation theorem, 00:28:36.310 --> 00:28:51.060 align:middle line:84% there exists h2 such that gh1h2 t3 up to tm is non-zero. 00:28:51.060 --> 00:28:54.240 align:middle line:84% And you just continue one by one until you 00:28:54.240 --> 00:29:00.110 align:middle line:84% get that there exists gh1h2 up to hm that's non-zero, 00:29:00.110 --> 00:29:03.130 align:middle line:84% and that's a contradiction because we 00:29:03.130 --> 00:29:08.450 align:middle line:84% assumed it is 0 everywhere on the small hypercube. 00:29:08.450 --> 00:29:09.010 align:middle line:90% Yeah? 00:29:09.010 --> 00:29:09.510 align:middle line:90% OK. 00:29:09.510 --> 00:29:12.740 align:middle line:84% So in the notes, I have the reduction. 00:29:12.740 --> 00:29:15.330 align:middle line:84% There's a proof that, kind of by induction, very formal, 00:29:15.330 --> 00:29:17.672 align:middle line:84% but I think this is good enough for class. 00:29:17.672 --> 00:29:19.380 align:middle line:84% Otherwise, it's going to be a bit boring. 00:29:19.380 --> 00:29:19.760 align:middle line:90% Questions. 00:29:19.760 --> 00:29:20.370 align:middle line:90% Yes? 00:29:20.370 --> 00:29:22.495 align:middle line:84% STUDENT: Can you also just use a counting argument? 00:29:22.495 --> 00:29:24.530 align:middle line:84% Like, you can just count how many 00:29:24.530 --> 00:29:27.420 align:middle line:84% polynomials of degree [INAUDIBLE] when there are? 00:29:27.420 --> 00:29:29.850 align:middle line:84% You break it up into all the terms, 00:29:29.850 --> 00:29:32.215 align:middle line:84% and that's just equal to the number of functions? 00:29:32.215 --> 00:29:33.090 align:middle line:90% YAEL KALAI: OK, good. 00:29:33.090 --> 00:29:34.050 align:middle line:84% So you're saying maybe you can also 00:29:34.050 --> 00:29:35.590 align:middle line:84% prove it using just a counting algorithm 00:29:35.590 --> 00:29:37.290 align:middle line:84% and say, if there is too many, then you'll 00:29:37.290 --> 00:29:39.030 align:middle line:84% have too many polynomials, and that's a contradiction 00:29:39.030 --> 00:29:40.090 align:middle line:84% because the number of polynomials, 00:29:40.090 --> 00:29:42.935 align:middle line:84% like the number of coefficients, probably you can do something 00:29:42.935 --> 00:29:43.685 align:middle line:90% like that as well. 00:29:43.685 --> 00:29:49.550 align:middle line:90% 00:29:49.550 --> 00:29:50.050 align:middle line:90% Yeah. 00:29:50.050 --> 00:29:50.550 align:middle line:90% Yeah? 00:29:50.550 --> 00:29:53.310 align:middle line:84% STUDENT: Can I try to make the case for the arithmetized-- 00:29:53.310 --> 00:29:54.400 align:middle line:90% YAEL KALAI: Yes, please. 00:29:54.400 --> 00:29:56.510 align:middle line:90% Good, good. 00:29:56.510 --> 00:29:58.740 align:middle line:84% STUDENT: So the arithmetization, we can compute it 00:29:58.740 --> 00:30:02.838 align:middle line:84% on any element [INAUDIBLE] easily, 00:30:02.838 --> 00:30:04.380 align:middle line:84% I guess, without looking at the truth 00:30:04.380 --> 00:30:05.950 align:middle line:90% table of the original function. 00:30:05.950 --> 00:30:06.720 align:middle line:90% YAEL KALAI: Good. 00:30:06.720 --> 00:30:07.650 align:middle line:84% STUDENT: If I can just repeat it. 00:30:07.650 --> 00:30:08.358 align:middle line:90% YAEL KALAI: Yeah. 00:30:08.358 --> 00:30:10.330 align:middle line:84% STUDENT: If you have to compute f on any point, 00:30:10.330 --> 00:30:12.150 align:middle line:84% you need to look at the entire [INAUDIBLE]. 00:30:12.150 --> 00:30:12.690 align:middle line:90% YAEL KALAI: Good. 00:30:12.690 --> 00:30:13.240 align:middle line:90% Very good. 00:30:13.240 --> 00:30:15.130 align:middle line:84% OK, so what you're saying is you're saying, 00:30:15.130 --> 00:30:20.020 align:middle line:90% look, once you force me-- 00:30:20.020 --> 00:30:20.560 align:middle line:90% look at me. 00:30:20.560 --> 00:30:22.050 align:middle line:90% I don't assume anything about f. 00:30:22.050 --> 00:30:23.570 align:middle line:90% You assume all degree. 00:30:23.570 --> 00:30:24.070 align:middle line:90% Look at me. 00:30:24.070 --> 00:30:26.300 align:middle line:84% I assume nothing, and look what I get. 00:30:26.300 --> 00:30:28.810 align:middle line:84% Now you're saying, well, you assume nothing, 00:30:28.810 --> 00:30:30.610 align:middle line:84% but you don't get that much either, 00:30:30.610 --> 00:30:33.490 align:middle line:84% because this f tilde is so inefficient. 00:30:33.490 --> 00:30:35.770 align:middle line:90% Note, to compute this f tilde-- 00:30:35.770 --> 00:30:39.410 align:middle line:84% where is it-- it takes time h to the m. 00:30:39.410 --> 00:30:42.290 align:middle line:84% You need to sum over all the hypercube. 00:30:42.290 --> 00:30:45.050 align:middle line:84% So computing f tilde is really inefficient, 00:30:45.050 --> 00:30:47.270 align:middle line:84% whereas your f tilde is so efficient and nice. 00:30:47.270 --> 00:30:49.570 align:middle line:90% 100%, yes, you're right. 00:30:49.570 --> 00:30:52.240 align:middle line:90% 00:30:52.240 --> 00:30:53.980 align:middle line:90% I'll give it to you Vinod, yeah? 00:30:53.980 --> 00:30:56.260 align:middle line:84% No, but this will be useful in settings 00:30:56.260 --> 00:30:58.240 align:middle line:84% that the arithmetized version will not be. 00:30:58.240 --> 00:31:00.160 align:middle line:90% But that's a good point. 00:31:00.160 --> 00:31:01.150 align:middle line:90% Thanks. 00:31:01.150 --> 00:31:04.300 align:middle line:84% STUDENT: Is there an easy way to bound the number of monomials? 00:31:04.300 --> 00:31:12.280 align:middle line:84% Is there some unique f that has at most so many monomials? 00:31:12.280 --> 00:31:14.457 align:middle line:84% YAEL KALAI: OK, so the question is, can we bound, 00:31:14.457 --> 00:31:16.540 align:middle line:84% essentially asking, well, can we make this f tilde 00:31:16.540 --> 00:31:18.690 align:middle line:84% a little more efficient maybe, kind of? 00:31:18.690 --> 00:31:22.670 align:middle line:84% So in general, we cannot because in general-- 00:31:22.670 --> 00:31:24.780 align:middle line:84% it depends what you want to assume about the f. 00:31:24.780 --> 00:31:27.190 align:middle line:84% So I'm saying, I don't want to make any assumptions 00:31:27.190 --> 00:31:27.700 align:middle line:90% about the f. 00:31:27.700 --> 00:31:29.770 align:middle line:84% And as you will see, it's not just 00:31:29.770 --> 00:31:33.370 align:middle line:84% because I want to just be as generous as general 00:31:33.370 --> 00:31:35.150 align:middle line:84% as possible for the sake of generality. 00:31:35.150 --> 00:31:38.870 align:middle line:84% Actually, in the way we use it, it really has no structure. 00:31:38.870 --> 00:31:42.730 align:middle line:84% The f we use is very arbitrary, so we 00:31:42.730 --> 00:31:46.150 align:middle line:84% can't assume that it comes from a low degree, whatever, nothing. 00:31:46.150 --> 00:31:49.970 align:middle line:84% And in that case, if you want to allow any f, 00:31:49.970 --> 00:31:53.780 align:middle line:84% then you have to have all the monomials because just 00:31:53.780 --> 00:31:59.090 align:middle line:84% by a counting argument, if the number of f's is, like, all 00:31:59.090 --> 00:32:00.298 align:middle line:90% the possible h to the m bits. 00:32:00.298 --> 00:32:02.382 align:middle line:84% So you have to have that many monomials, otherwise 00:32:02.382 --> 00:32:04.100 align:middle line:84% where would you store that information? 00:32:04.100 --> 00:32:07.290 align:middle line:84% So in general, you can't do with less monomials. 00:32:07.290 --> 00:32:11.420 align:middle line:84% However, in many cases, you can do. 00:32:11.420 --> 00:32:14.100 align:middle line:84% And actually, even, we'll use it, the fact that in some cases, 00:32:14.100 --> 00:32:17.480 align:middle line:90% you can do with less monomials. 00:32:17.480 --> 00:32:18.810 align:middle line:90% So we'll see that. 00:32:18.810 --> 00:32:22.600 align:middle line:90% But that's a great, great point. 00:32:22.600 --> 00:32:25.360 align:middle line:90% Any other questions? 00:32:25.360 --> 00:32:28.210 align:middle line:84% So let me just tell you, this is a very good theorem 00:32:28.210 --> 00:32:30.880 align:middle line:84% to stop and ask questions because it really 00:32:30.880 --> 00:32:32.300 align:middle line:90% will get back to this so much. 00:32:32.300 --> 00:32:34.840 align:middle line:84% And even if not in this class, you'll see it in-- 00:32:34.840 --> 00:32:36.790 align:middle line:90% it will come at you. 00:32:36.790 --> 00:32:40.365 align:middle line:84% It's a really, really important and fundamental theorem. 00:32:40.365 --> 00:32:44.570 align:middle line:90% 00:32:44.570 --> 00:32:47.450 align:middle line:84% So I guess, next, I'm going to try 00:32:47.450 --> 00:32:50.510 align:middle line:84% to convince you why it is such an important and fundamental 00:32:50.510 --> 00:32:51.240 align:middle line:90% theorem. 00:32:51.240 --> 00:32:56.930 align:middle line:84% And I'm going to start with just looking back 00:32:56.930 --> 00:32:59.930 align:middle line:84% at the example of doubly efficient interactive proofs 00:32:59.930 --> 00:33:04.880 align:middle line:84% for counting triangles, just as a motivating example. 00:33:04.880 --> 00:33:05.750 align:middle line:90% We'll do it quick. 00:33:05.750 --> 00:33:10.910 align:middle line:84% And then we'll go into I think the more interesting and general 00:33:10.910 --> 00:33:13.970 align:middle line:84% way of using this low-degree extension together 00:33:13.970 --> 00:33:16.550 align:middle line:84% with the Sumcheck to get doubly efficient proofs 00:33:16.550 --> 00:33:19.780 align:middle line:84% for any low-depth computation, so 00:33:19.780 --> 00:33:21.080 align:middle line:90% kind of arbitrary computation. 00:33:21.080 --> 00:33:22.460 align:middle line:90% So we'll see that next. 00:33:22.460 --> 00:33:24.490 align:middle line:84% But let's first, kind of as a warm-up, 00:33:24.490 --> 00:33:28.160 align:middle line:84% look at the example for counting triangles. 00:33:28.160 --> 00:33:30.430 align:middle line:84% Why this low-degree extension with Sumcheck, 00:33:30.430 --> 00:33:35.140 align:middle line:84% how can we use these together to count triangles in a graph? 00:33:35.140 --> 00:33:37.130 align:middle line:90% So now, note, what's the goal? 00:33:37.130 --> 00:33:38.345 align:middle line:90% We have a graph. 00:33:38.345 --> 00:33:39.970 align:middle line:84% I want to know how many triangles there 00:33:39.970 --> 00:33:40.880 align:middle line:90% are in the graph. 00:33:40.880 --> 00:33:42.080 align:middle line:90% Now, it's not that hard. 00:33:42.080 --> 00:33:43.540 align:middle line:90% It takes time, n to the third. 00:33:43.540 --> 00:33:46.000 align:middle line:84% I go over every three pairs of vertices and check 00:33:46.000 --> 00:33:47.000 align:middle line:90% if there's a triangle. 00:33:47.000 --> 00:33:49.660 align:middle line:84% So I have an n to the n cubed algorithm. 00:33:49.660 --> 00:33:52.310 align:middle line:84% But let's say the verifier can't run in time n cubed. 00:33:52.310 --> 00:33:55.990 align:middle line:84% The poor guy, he gets the graph, so size n squared. 00:33:55.990 --> 00:33:59.470 align:middle line:84% All he can do is run time n squared, essentially, 00:33:59.470 --> 00:34:02.660 align:middle line:84% with some polylog overhead, but only n squared. 00:34:02.660 --> 00:34:03.970 align:middle line:90% So he can't count. 00:34:03.970 --> 00:34:06.820 align:middle line:90% So now what does he do? 00:34:06.820 --> 00:34:08.199 align:middle line:90% He needs help. 00:34:08.199 --> 00:34:11.590 align:middle line:84% Now I'll show you how the prover can help him in a way 00:34:11.590 --> 00:34:15.340 align:middle line:84% that now, yes, he only needs to run in time n squared 00:34:15.340 --> 00:34:17.650 align:middle line:90% or tilde of n squared. 00:34:17.650 --> 00:34:21.510 align:middle line:84% OK, so let's look at that example. 00:34:21.510 --> 00:34:22.639 align:middle line:90% So let me erase this. 00:34:22.639 --> 00:34:32.510 align:middle line:90% 00:34:32.510 --> 00:34:35.019 align:middle line:84% So here is an example where this is useful. 00:34:35.019 --> 00:34:38.620 align:middle line:90% 00:34:38.620 --> 00:34:39.645 align:middle line:90% We're given a graph. 00:34:39.645 --> 00:34:44.639 align:middle line:90% 00:34:44.639 --> 00:34:47.639 align:middle line:84% And the goal, we want a protocol, a proof where 00:34:47.639 --> 00:34:49.590 align:middle line:84% the prover will convince to the verifier 00:34:49.590 --> 00:34:59.770 align:middle line:84% that the number of triangles in g is, 00:34:59.770 --> 00:35:03.400 align:middle line:90% let's say, some number beta. 00:35:03.400 --> 00:35:06.480 align:middle line:90% I want to prove for this fact. 00:35:06.480 --> 00:35:08.700 align:middle line:84% How will I-- so I'm going to prove to you. 00:35:08.700 --> 00:35:11.190 align:middle line:90% You guys are time of n squared. 00:35:11.190 --> 00:35:12.780 align:middle line:90% You can only read the graph. 00:35:12.780 --> 00:35:17.780 align:middle line:84% I'm going to help you, prove to you that the number of triangles 00:35:17.780 --> 00:35:22.640 align:middle line:84% is exactly beta while you just run time n squared. 00:35:22.640 --> 00:35:24.930 align:middle line:90% How do I do that? 00:35:24.930 --> 00:35:28.500 align:middle line:84% Let's look at the function f from-- 00:35:28.500 --> 00:35:32.150 align:middle line:90% so suppose v is n. 00:35:32.150 --> 00:35:40.010 align:middle line:84% So I look at the function from 0,1 to log n to 0,1, 00:35:40.010 --> 00:35:43.130 align:middle line:90% and this just tells me whether-- 00:35:43.130 --> 00:35:44.850 align:middle line:90% so it's like 0,1 to the log. 00:35:44.850 --> 00:35:49.760 align:middle line:84% It's you can think of this as being kind of n by n, 00:35:49.760 --> 00:35:53.870 align:middle line:84% so it takes log n bits that describe one vertex log 00:35:53.870 --> 00:35:56.600 align:middle line:84% n bit to describe another vertex, and it outputs 1 if 00:35:56.600 --> 00:35:58.620 align:middle line:90% and only if there's an edge. 00:35:58.620 --> 00:36:00.360 align:middle line:90% So you can think of each-- 00:36:00.360 --> 00:36:10.280 align:middle line:84% so f takes two vertices i and j, and outputs 1 00:36:10.280 --> 00:36:16.220 align:middle line:84% if there is an edge and 0 otherwise. 00:36:16.220 --> 00:36:19.020 align:middle line:84% So f is just the adjacency matrix. 00:36:19.020 --> 00:36:21.660 align:middle line:84% The adjacency matrix is n squared bits. 00:36:21.660 --> 00:36:25.540 align:middle line:84% This is n squared, so I just put it in, define it this way. 00:36:25.540 --> 00:36:28.240 align:middle line:90% So again, f takes two vertices. 00:36:28.240 --> 00:36:30.735 align:middle line:84% It outputs 1 if there is an edge between these vertices. 00:36:30.735 --> 00:36:33.558 align:middle line:90% 00:36:33.558 --> 00:36:39.410 align:middle line:90% Now, so what do we need? 00:36:39.410 --> 00:36:41.150 align:middle line:90% So now, what do we know? 00:36:41.150 --> 00:36:46.460 align:middle line:84% We know that this f has a low-degree extension. 00:36:46.460 --> 00:36:51.810 align:middle line:90% 00:36:51.810 --> 00:36:53.225 align:middle line:90% So this is of degree. 00:36:53.225 --> 00:36:56.200 align:middle line:90% 00:36:56.200 --> 00:37:00.760 align:middle line:84% Essentially this is multilinear because I started with 0,1. 00:37:00.760 --> 00:37:07.900 align:middle line:84% So f tilde is multilinear, so degree 1 in each variable. 00:37:07.900 --> 00:37:12.770 align:middle line:84% Now, why am I looking at these adjacency matrix? 00:37:12.770 --> 00:37:13.880 align:middle line:90% What do I want? 00:37:13.880 --> 00:37:15.850 align:middle line:90% What do I want to prove? 00:37:15.850 --> 00:37:18.270 align:middle line:84% How does this relate to the number of triangles? 00:37:18.270 --> 00:37:20.770 align:middle line:84% So the number of triangles-- we started discussing this last 00:37:20.770 --> 00:37:21.280 align:middle line:90% time-- 00:37:21.280 --> 00:37:27.260 align:middle line:84% is just the sum over all kind of triangles, 00:37:27.260 --> 00:37:30.180 align:middle line:84% i, j, k, or sorry, all kind of three nodes, 00:37:30.180 --> 00:37:34.400 align:middle line:84% i, j, k, and v. And it's a triangle if what? 00:37:34.400 --> 00:37:47.480 align:middle line:84% If f, i, j is one and f, j, k is and f, i, k is one. 00:37:47.480 --> 00:37:52.370 align:middle line:84% So I want to know how many triplets is this thing one? 00:37:52.370 --> 00:37:55.110 align:middle line:84% If an edge is missing in one of them, 00:37:55.110 --> 00:37:58.330 align:middle line:84% then this is going to be 0 because I multiplied. 00:37:58.330 --> 00:38:03.180 align:middle line:84% So I want to know how many of them do I have one? 00:38:03.180 --> 00:38:05.250 align:middle line:84% And that's almost the number of triangles, 00:38:05.250 --> 00:38:08.660 align:middle line:84% except that I need to divide by 6 because I 00:38:08.660 --> 00:38:11.060 align:middle line:84% counted each triangle, each three vertices, all 00:38:11.060 --> 00:38:11.940 align:middle line:90% the permutations. 00:38:11.940 --> 00:38:14.950 align:middle line:84% So that's what the prover wants to prove to the verifier. 00:38:14.950 --> 00:38:17.610 align:middle line:90% 00:38:17.610 --> 00:38:23.600 align:middle line:84% So let me-- I said v, but let me call it 0,1 to the log n, 00:38:23.600 --> 00:38:25.890 align:middle line:90% which is the same. 00:38:25.890 --> 00:38:27.940 align:middle line:90% Now I'm done. 00:38:27.940 --> 00:38:28.953 align:middle line:90% Why am I done? 00:38:28.953 --> 00:38:30.370 align:middle line:84% Because I'm saying, you know what? 00:38:30.370 --> 00:38:31.980 align:middle line:90% So how do I prove this? 00:38:31.980 --> 00:38:33.690 align:middle line:90% I'm going to use the Sumcheck. 00:38:33.690 --> 00:38:36.560 align:middle line:84% But you're saying, wait, but this is not a polynomial. 00:38:36.560 --> 00:38:37.650 align:middle line:90% No worries. 00:38:37.650 --> 00:38:40.370 align:middle line:90% Here you go. 00:38:40.370 --> 00:38:41.930 align:middle line:90% Now it's a polynomial. 00:38:41.930 --> 00:38:44.720 align:middle line:84% Now, I didn't change anything because it's only 00:38:44.720 --> 00:38:46.130 align:middle line:90% over the small cube. 00:38:46.130 --> 00:38:52.230 align:middle line:84% So the fact that I extended doesn't change the sum 00:38:52.230 --> 00:38:54.530 align:middle line:90% because of the extension. 00:38:54.530 --> 00:38:59.120 align:middle line:84% So the prover needs to prove that the sum of this 00:38:59.120 --> 00:39:02.310 align:middle line:84% polynomial-- so before, it was multilinear. 00:39:02.310 --> 00:39:04.800 align:middle line:84% Now it's degree 2 because each variable, 00:39:04.800 --> 00:39:07.710 align:middle line:84% we multiply 3 polynomials, each one appears in two. 00:39:07.710 --> 00:39:10.510 align:middle line:90% Fine, degree 2 in each variable. 00:39:10.510 --> 00:39:16.340 align:middle line:84% And we need to prove that the sum is beta. 00:39:16.340 --> 00:39:20.870 align:middle line:84% This is exactly what Sumcheck is for, precisely. 00:39:20.870 --> 00:39:22.455 align:middle line:90% Note, what does the prover-- 00:39:22.455 --> 00:39:23.580 align:middle line:90% so what are we going to do? 00:39:23.580 --> 00:39:25.300 align:middle line:84% We're going to do Sumcheck protocol. 00:39:25.300 --> 00:39:27.670 align:middle line:84% What is the runtime of the verifier in the Sumcheck 00:39:27.670 --> 00:39:28.280 align:middle line:90% protocol? 00:39:28.280 --> 00:39:29.230 align:middle line:90% So they interact. 00:39:29.230 --> 00:39:33.220 align:middle line:84% We do, every time you get rid of one variable, one by one by one. 00:39:33.220 --> 00:39:38.380 align:middle line:84% At the end, the verifier needs to compute 00:39:38.380 --> 00:39:41.560 align:middle line:84% the final polynomial, which in our case 00:39:41.560 --> 00:39:46.930 align:middle line:84% is this entire polynomial, and a single point in the extension. 00:39:46.930 --> 00:39:50.620 align:middle line:84% Namely, he needs to compute f tilde on a random point in f 00:39:50.620 --> 00:39:56.570 align:middle line:84% in, I guess, f squared three times. 00:39:56.570 --> 00:39:58.910 align:middle line:84% But that he can do very, very easily. 00:39:58.910 --> 00:40:01.250 align:middle line:84% Or what do you mean, in time n squared. 00:40:01.250 --> 00:40:02.630 align:middle line:90% Because what is f tilde? 00:40:02.630 --> 00:40:07.100 align:middle line:84% f tilde, as Vinod said, you need to enumerate over 00:40:07.100 --> 00:40:09.530 align:middle line:90% all the small cube. 00:40:09.530 --> 00:40:10.220 align:middle line:90% It's a lot. 00:40:10.220 --> 00:40:12.920 align:middle line:84% But here are the small cube is n squared. 00:40:12.920 --> 00:40:16.178 align:middle line:84% So it really takes time n squared, so order of n , 00:40:16.178 --> 00:40:17.390 align:middle line:90% I think it is, three times. 00:40:17.390 --> 00:40:20.640 align:middle line:84% He needs to compute this, but this is polylog. 00:40:20.640 --> 00:40:22.243 align:middle line:90% So by the way, throughout this-- 00:40:22.243 --> 00:40:24.410 align:middle line:84% I mentioned it last time, but I'll mention it again. 00:40:24.410 --> 00:40:29.480 align:middle line:84% Throughout this course, the polylog factors, I'm not even-- 00:40:29.480 --> 00:40:34.340 align:middle line:84% these are all you can put things in tildes. 00:40:34.340 --> 00:40:39.050 align:middle line:84% I don't want to pay attention too much to polylog factors. 00:40:39.050 --> 00:40:42.140 align:middle line:84% So really what he worked, the runtime of the verifier 00:40:42.140 --> 00:40:43.260 align:middle line:90% is just n squared. 00:40:43.260 --> 00:40:45.960 align:middle line:84% The communication complexity is nothing. 00:40:45.960 --> 00:40:48.860 align:middle line:84% m number of variables is order log n. 00:40:48.860 --> 00:40:52.940 align:middle line:90% d, the degree is constant. 00:40:52.940 --> 00:40:56.090 align:middle line:84% Log f, well, don't take f to be too long, too big. 00:40:56.090 --> 00:41:00.580 align:middle line:84% Take f so the log f is not small. 00:41:00.580 --> 00:41:04.190 align:middle line:84% And note, even the prover doesn't run in too long. 00:41:04.190 --> 00:41:08.300 align:middle line:84% What's the runtime of the prover in the Sumcheck protocol? 00:41:08.300 --> 00:41:12.720 align:middle line:84% It's m, the number of variables, log n, times h to the m. 00:41:12.720 --> 00:41:15.010 align:middle line:84% Now, h to the m seems big, but again, it's 00:41:15.010 --> 00:41:19.190 align:middle line:84% n squared, times the time it takes to compute f once, 00:41:19.190 --> 00:41:22.410 align:middle line:90% which is, again, n squared. 00:41:22.410 --> 00:41:23.600 align:middle line:90% So it is polynomial. 00:41:23.600 --> 00:41:25.815 align:middle line:84% And now the verifier runs in time of n squared. 00:41:25.815 --> 00:41:28.590 align:middle line:90% 00:41:28.590 --> 00:41:30.880 align:middle line:90% So that's just to illustrate. 00:41:30.880 --> 00:41:34.130 align:middle line:90% 00:41:34.130 --> 00:41:34.680 align:middle line:90% Yeah. 00:41:34.680 --> 00:41:36.513 align:middle line:84% STUDENT: [INAUDIBLE] runtime has to be [INAUDIBLE] cubed 00:41:36.513 --> 00:41:37.200 align:middle line:90% [INAUDIBLE]. 00:41:37.200 --> 00:41:39.090 align:middle line:84% YAEL KALAI: Yeah, right, and he is. 00:41:39.090 --> 00:41:42.060 align:middle line:84% He is actually n to the fourth in this example, 00:41:42.060 --> 00:41:46.530 align:middle line:84% because he needs to compute this-- 00:41:46.530 --> 00:41:47.167 align:middle line:90% OK, let's see. 00:41:47.167 --> 00:41:48.000 align:middle line:90% He's more, actually. 00:41:48.000 --> 00:41:49.450 align:middle line:90% He needs to compute this thing. 00:41:49.450 --> 00:41:52.743 align:middle line:84% So he needs to do it for every i, j, k in-- 00:41:52.743 --> 00:41:56.820 align:middle line:90% 00:41:56.820 --> 00:41:58.840 align:middle line:84% not just the compute, to do the entire Sumcheck. 00:41:58.840 --> 00:42:01.890 align:middle line:84% So in the Sumcheck, he needs to h 00:42:01.890 --> 00:42:08.090 align:middle line:84% to the m, which is m here is going to be 3 log n in this. 00:42:08.090 --> 00:42:11.380 align:middle line:84% So it's already m cubed, and then he 00:42:11.380 --> 00:42:15.170 align:middle line:84% needs to compute t of f, the polynomial, which is n squared. 00:42:15.170 --> 00:42:17.220 align:middle line:90% So he's n to the fifth. 00:42:17.220 --> 00:42:21.600 align:middle line:84% Because computing this once is n squared without the sum. 00:42:21.600 --> 00:42:26.060 align:middle line:84% But he also needs to run over all the sum and then also log 00:42:26.060 --> 00:42:26.560 align:middle line:90% factors. 00:42:26.560 --> 00:42:28.710 align:middle line:90% Yeah, he's running more. 00:42:28.710 --> 00:42:31.020 align:middle line:84% But it's considered doubly efficient 00:42:31.020 --> 00:42:34.450 align:middle line:84% because he's still polynomial overhead. 00:42:34.450 --> 00:42:34.960 align:middle line:90% Yeah? 00:42:34.960 --> 00:42:36.890 align:middle line:84% STUDENT: Is there a way to get into the omega 00:42:36.890 --> 00:42:39.300 align:middle line:84% or something [INAUDIBLE] runtime [INAUDIBLE] that's 00:42:39.300 --> 00:42:41.167 align:middle line:90% the actual runtime? 00:42:41.167 --> 00:42:42.510 align:middle line:90% STUDENT: Even n cubed. 00:42:42.510 --> 00:42:44.940 align:middle line:84% YAEL KALAI: Yeah, even n cubed, you're saying. 00:42:44.940 --> 00:42:46.590 align:middle line:90% Yeah, currently. 00:42:46.590 --> 00:42:51.120 align:middle line:84% So n cubed, you can get it using recent kind 00:42:51.120 --> 00:42:56.310 align:middle line:84% of really nice works, with just optimizing a little bit. 00:42:56.310 --> 00:43:01.000 align:middle line:84% That's the work of Dan Sung and friends, they get a linear time. 00:43:01.000 --> 00:43:02.350 align:middle line:90% So they can get an n cubed. 00:43:02.350 --> 00:43:04.170 align:middle line:90% I don't know how-- 00:43:04.170 --> 00:43:06.700 align:middle line:84% but it may be that for this specific protocol it's possible. 00:43:06.700 --> 00:43:07.658 align:middle line:90% Actually, I don't know. 00:43:07.658 --> 00:43:10.100 align:middle line:90% It's a good question. 00:43:10.100 --> 00:43:12.900 align:middle line:84% But let me, actually, before you get too excited about it-- 00:43:12.900 --> 00:43:15.440 align:middle line:90% so yeah. 00:43:15.440 --> 00:43:18.260 align:middle line:84% STUDENT: [INAUDIBLE] the number of rounds is log n, right? 00:43:18.260 --> 00:43:20.170 align:middle line:84% YAEL KALAI: The number of rounds is log n. 00:43:20.170 --> 00:43:22.140 align:middle line:84% STUDENT: [INAUDIBLE] actually get a-- 00:43:22.140 --> 00:43:22.890 align:middle line:90% YAEL KALAI: Great. 00:43:22.890 --> 00:43:23.450 align:middle line:90% Great. 00:43:23.450 --> 00:43:25.170 align:middle line:90% Question of two messages. 00:43:25.170 --> 00:43:29.150 align:middle line:84% So when I finished-- where's Gabe? 00:43:29.150 --> 00:43:31.536 align:middle line:84% So you came to me last time, right? 00:43:31.536 --> 00:43:34.230 align:middle line:84% So when I started talking about this last lecture, 00:43:34.230 --> 00:43:37.430 align:middle line:84% Gabe came to me, rightly so, and said, well-- 00:43:37.430 --> 00:43:40.680 align:middle line:84% we just started talking about it, and he's like, well, OK, 00:43:40.680 --> 00:43:42.930 align:middle line:84% but you can do it so much easier. 00:43:42.930 --> 00:43:44.510 align:middle line:90% And it's true. 00:43:44.510 --> 00:43:48.990 align:middle line:84% This was kind of as an example to show. 00:43:48.990 --> 00:43:52.260 align:middle line:84% But actually, going since you asked the question also, 00:43:52.260 --> 00:43:54.500 align:middle line:84% actually, there's very much simpler protocol 00:43:54.500 --> 00:43:55.590 align:middle line:90% that Gabe noticed. 00:43:55.590 --> 00:43:59.390 align:middle line:90% So let me just write it here. 00:43:59.390 --> 00:44:04.340 align:middle line:84% The idea is that the prover will only send two matrices over. 00:44:04.340 --> 00:44:06.140 align:middle line:84% So it's a bit communication complexity. 00:44:06.140 --> 00:44:08.060 align:middle line:84% Here, the communication complexity is polylog. 00:44:08.060 --> 00:44:11.240 align:middle line:84% But if we just care about verifier runtime 00:44:11.240 --> 00:44:13.470 align:middle line:84% and we don't care about the communication complexity, 00:44:13.470 --> 00:44:17.210 align:middle line:84% then the prover can just send the verifier the-- 00:44:17.210 --> 00:44:20.070 align:middle line:84% so let A be the adjacency matrix. 00:44:20.070 --> 00:44:23.390 align:middle line:84% Let me now instead of f write it in the more classical notation 00:44:23.390 --> 00:44:29.130 align:middle line:84% of a matrix A, the adjacency matrix, where there's a 1, 00:44:29.130 --> 00:44:31.280 align:middle line:84% if and only if there's an edge, and 0 otherwise. 00:44:31.280 --> 00:44:39.440 align:middle line:84% The prover will send the matrix A 2, which is A squared-- 00:44:39.440 --> 00:44:41.830 align:middle line:84% he can also send A, but the verifier knows A-- 00:44:41.830 --> 00:44:45.040 align:middle line:90% and A3, which is A cubed. 00:44:45.040 --> 00:44:48.570 align:middle line:90% 00:44:48.570 --> 00:44:54.560 align:middle line:84% Now, the number of triangles is just the trace of A cubed. 00:44:54.560 --> 00:44:56.040 align:middle line:90% So it's very easy to compute. 00:44:56.040 --> 00:44:56.820 align:middle line:90% You just compute. 00:44:56.820 --> 00:44:59.970 align:middle line:84% Now, how do you know that this is A squared 00:44:59.970 --> 00:45:02.000 align:middle line:90% and this is A cubed? 00:45:02.000 --> 00:45:04.260 align:middle line:84% Well, we saw last time a protocol, 00:45:04.260 --> 00:45:06.650 align:middle line:84% a randomized protocol for checking equality 00:45:06.650 --> 00:45:10.850 align:middle line:84% between matrices via this Reed-Solomon kind 00:45:10.850 --> 00:45:12.500 align:middle line:90% of decoding idea. 00:45:12.500 --> 00:45:13.590 align:middle line:90% So you do that. 00:45:13.590 --> 00:45:14.940 align:middle line:90% So there you go. 00:45:14.940 --> 00:45:18.250 align:middle line:84% STUDENT: That's really, really nice, but I'm not happy. 00:45:18.250 --> 00:45:21.428 align:middle line:84% YAEL KALAI: But then blame Gabe, of course. 00:45:21.428 --> 00:45:22.880 align:middle line:90% STUDENT: [INAUDIBLE] 00:45:22.880 --> 00:45:24.458 align:middle line:90% YAEL KALAI: Exactly. 00:45:24.458 --> 00:45:25.000 align:middle line:90% You're right. 00:45:25.000 --> 00:45:34.150 align:middle line:90% STUDENT: [INAUDIBLE] 00:45:34.150 --> 00:45:35.930 align:middle line:90% YAEL KALAI: You can get-- 00:45:35.930 --> 00:45:36.430 align:middle line:90% OK. 00:45:36.430 --> 00:45:41.140 align:middle line:90% 00:45:41.140 --> 00:45:45.430 align:middle line:84% So there's a really beautiful work of R, R, R, 00:45:45.430 --> 00:45:48.940 align:middle line:84% and they get constant round complexity. 00:45:48.940 --> 00:45:52.400 align:middle line:84% And so using their particle, probably you can get very good. 00:45:52.400 --> 00:45:54.170 align:middle line:84% But I need to think about the parameters. 00:45:54.170 --> 00:45:58.660 align:middle line:84% I think you can get in constant round probably really 00:45:58.660 --> 00:46:03.410 align:middle line:84% good parameters, but I need to think about the details. 00:46:03.410 --> 00:46:05.480 align:middle line:90% Yeah. 00:46:05.480 --> 00:46:07.880 align:middle line:90% OK. 00:46:07.880 --> 00:46:09.560 align:middle line:84% So this was just a motivating example 00:46:09.560 --> 00:46:12.620 align:middle line:84% to show you that you can take something also with no structure 00:46:12.620 --> 00:46:15.097 align:middle line:84% whatsoever, like adjacency matrix. 00:46:15.097 --> 00:46:15.930 align:middle line:90% It's a no structure. 00:46:15.930 --> 00:46:16.880 align:middle line:90% It's arbitrary. 00:46:16.880 --> 00:46:20.850 align:middle line:84% But using the technique of a low-degree extension, 00:46:20.850 --> 00:46:23.960 align:middle line:84% you can add structure to it, and then you can use the Sumcheck. 00:46:23.960 --> 00:46:27.450 align:middle line:90% 00:46:27.450 --> 00:46:31.900 align:middle line:84% So more generally, I want to say, 00:46:31.900 --> 00:46:34.650 align:middle line:84% I think what's really the power of this 00:46:34.650 --> 00:46:38.070 align:middle line:84% is in error correcting codes, what's nice about error 00:46:38.070 --> 00:46:41.290 align:middle line:84% correcting codes is if you cheat, 00:46:41.290 --> 00:46:44.010 align:middle line:84% you need to cheat everywhere in the sense. 00:46:44.010 --> 00:46:45.990 align:middle line:90% Things kind of percolate. 00:46:45.990 --> 00:46:47.910 align:middle line:84% In proof system, this kind of thing 00:46:47.910 --> 00:46:51.270 align:middle line:84% is very, very useful because we want to-- 00:46:51.270 --> 00:46:54.900 align:middle line:84% proof systems about catching cheaters. 00:46:54.900 --> 00:46:57.190 align:middle line:84% When we construct a constructive proof, 00:46:57.190 --> 00:47:00.700 align:middle line:84% our goal is to catch a prover, a cheating prover. 00:47:00.700 --> 00:47:03.345 align:middle line:90% And so you want some encoding. 00:47:03.345 --> 00:47:05.230 align:middle line:84% You want to say, if you cheat somewhere, 00:47:05.230 --> 00:47:06.970 align:middle line:90% he has to cheat everywhere. 00:47:06.970 --> 00:47:10.050 align:middle line:90% So this idea of having-- 00:47:10.050 --> 00:47:12.450 align:middle line:84% in some sense, you want kind of-- 00:47:12.450 --> 00:47:13.740 align:middle line:90% if you want the proof to-- 00:47:13.740 --> 00:47:16.670 align:middle line:90% 00:47:16.670 --> 00:47:17.990 align:middle line:90% it's very natural. 00:47:17.990 --> 00:47:21.360 align:middle line:84% Some encoding comes into proof systems, 00:47:21.360 --> 00:47:24.560 align:middle line:84% and we'll see that next when we look at the GKR protocol 00:47:24.560 --> 00:47:27.860 align:middle line:90% for low-depth computation. 00:47:27.860 --> 00:47:29.790 align:middle line:90% So that's coming next. 00:47:29.790 --> 00:47:32.270 align:middle line:84% Now, before I start this protocol, 00:47:32.270 --> 00:47:33.820 align:middle line:90% I have a question for you. 00:47:33.820 --> 00:47:36.320 align:middle line:84% So last time-- this is a long class. 00:47:36.320 --> 00:47:37.320 align:middle line:90% It's a three hour class. 00:47:37.320 --> 00:47:40.228 align:middle line:90% It's tiring. 00:47:40.228 --> 00:47:42.720 align:middle line:84% And it's technical, which is even more tiring. 00:47:42.720 --> 00:47:45.530 align:middle line:84% So now I want to ask you two options. 00:47:45.530 --> 00:47:49.020 align:middle line:84% Option 1, we'll take two breaks, one after one hour, 00:47:49.020 --> 00:47:51.200 align:middle line:90% one after the second hour. 00:47:51.200 --> 00:47:52.410 align:middle line:90% It will give you-- 00:47:52.410 --> 00:47:57.110 align:middle line:84% or we take one in the middle, which is maybe a little longer. 00:47:57.110 --> 00:48:02.820 align:middle line:84% How many people are for two kind of short breaks to decompose? 00:48:02.820 --> 00:48:05.466 align:middle line:84% Let's take a break now for five minutes and then we'll do GKR. 00:48:05.466 --> 00:48:08.800 align:middle line:90% 00:48:08.800 --> 00:48:10.552 align:middle line:90% OK. 00:48:10.552 --> 00:48:18.368 align:middle line:84% So so far, the applications, we saw for the Sumcheck and even 00:48:18.368 --> 00:48:19.910 align:middle line:84% if you want the low-degree extension, 00:48:19.910 --> 00:48:21.460 align:middle line:90% were both kind of counting. 00:48:21.460 --> 00:48:26.600 align:middle line:84% We said, let's count the Sharp-SAT, 00:48:26.600 --> 00:48:28.790 align:middle line:84% let's count the number of triangles. 00:48:28.790 --> 00:48:32.780 align:middle line:84% So you may think, OK, well, Sumcheck is about counting, 00:48:32.780 --> 00:48:36.513 align:middle line:84% so yeah, I can see how you can do counting problems by either 00:48:36.513 --> 00:48:37.930 align:middle line:84% they're already kind of low degree 00:48:37.930 --> 00:48:39.910 align:middle line:84% and you just apply Sumcheck automatically, 00:48:39.910 --> 00:48:41.620 align:middle line:84% or they're not low degree and then you 00:48:41.620 --> 00:48:44.860 align:middle line:84% do a low-degree extension, and now you have the Sumcheck. 00:48:44.860 --> 00:48:48.490 align:middle line:84% So maybe you can do counting things, but that's it. 00:48:48.490 --> 00:48:50.980 align:middle line:84% So now what I want to show you next 00:48:50.980 --> 00:48:53.810 align:middle line:84% is that, no, actually you can do a ton with that. 00:48:53.810 --> 00:48:57.050 align:middle line:84% So just the low-degree extension and Sumcheck together, 00:48:57.050 --> 00:48:57.963 align:middle line:90% that's all you need. 00:48:57.963 --> 00:48:59.380 align:middle line:84% And what I'm going to show you now 00:48:59.380 --> 00:49:03.010 align:middle line:84% is how to do a doubly efficient interactive proof 00:49:03.010 --> 00:49:06.640 align:middle line:90% for all low-depth circuits. 00:49:06.640 --> 00:49:08.630 align:middle line:90% So let me explain. 00:49:08.630 --> 00:49:12.490 align:middle line:84% So suppose you have here some circuit 00:49:12.490 --> 00:49:17.590 align:middle line:84% C. It's really, really big, but it's shallow. 00:49:17.590 --> 00:49:23.140 align:middle line:84% OK, so think of this circuit size S, which is really big. 00:49:23.140 --> 00:49:30.590 align:middle line:84% The depth is d, which is very small. 00:49:30.590 --> 00:49:33.730 align:middle line:84% Now what I'm going to show you is 00:49:33.730 --> 00:49:38.260 align:middle line:84% a doubly efficient, interactive proof where the verifier runs 00:49:38.260 --> 00:49:45.742 align:middle line:84% in time only d, or linear in d or d and poly log in S. 00:49:45.742 --> 00:49:48.200 align:middle line:84% And the prover, of course, he needs to compute the circuit. 00:49:48.200 --> 00:49:51.040 align:middle line:84% He runs in time S. He has to run the computation. 00:49:51.040 --> 00:49:53.865 align:middle line:84% And only poly overhead, so poly of S. 00:49:53.865 --> 00:49:55.240 align:middle line:84% So I'm going to show you a doubly 00:49:55.240 --> 00:49:57.530 align:middle line:84% efficient interactive proof for any bounded depth. 00:49:57.530 --> 00:49:58.030 align:middle line:90% Yes. 00:49:58.030 --> 00:49:59.290 align:middle line:84% STUDENT: Just to clarify here, circuit size 00:49:59.290 --> 00:50:00.440 align:middle line:90% is just the number of gates? 00:50:00.440 --> 00:50:00.610 align:middle line:90% YAEL KALAI: Good. 00:50:00.610 --> 00:50:02.140 align:middle line:84% The circuit size is just number of gates, yeah. 00:50:02.140 --> 00:50:03.130 align:middle line:90% STUDENT: Thank you. 00:50:03.130 --> 00:50:04.030 align:middle line:90% YAEL KALAI: Yeah. 00:50:04.030 --> 00:50:09.230 align:middle line:84% Now, note, this already seems weird because-- 00:50:09.230 --> 00:50:11.230 align:middle line:84% OK, so the prover, I said, the goal 00:50:11.230 --> 00:50:13.540 align:middle line:84% is the prover is going to convince the verifier 00:50:13.540 --> 00:50:20.970 align:middle line:84% that, let's say, so the goal is to convince the verifier that C 00:50:20.970 --> 00:50:23.970 align:middle line:90% of x equals, let's say, 1. 00:50:23.970 --> 00:50:27.270 align:middle line:90% 00:50:27.270 --> 00:50:32.550 align:middle line:84% Think of C as any Boolean circuit of small depth. 00:50:32.550 --> 00:50:35.040 align:middle line:84% And the verifier should be very efficient. 00:50:35.040 --> 00:50:38.115 align:middle line:84% But now you're saying, just reading C is not efficient. 00:50:38.115 --> 00:50:39.490 align:middle line:84% If you have an arbitrary circuit, 00:50:39.490 --> 00:50:42.030 align:middle line:84% just reading the circuit is not efficient. 00:50:42.030 --> 00:50:42.910 align:middle line:90% You're right. 00:50:42.910 --> 00:50:45.360 align:middle line:84% So for this to be meaningful, C needs 00:50:45.360 --> 00:50:47.500 align:middle line:84% to have a succinct representation. 00:50:47.500 --> 00:50:49.470 align:middle line:84% So it needs to be kind of a uniform circuit 00:50:49.470 --> 00:50:52.060 align:middle line:84% that you can specify it succinctly. 00:50:52.060 --> 00:50:54.570 align:middle line:84% And indeed we will assume that C is 00:50:54.570 --> 00:51:05.380 align:middle line:84% what's called logspace uniform, which essentially means 00:51:05.380 --> 00:51:09.160 align:middle line:84% that there's a logspace machine, a log S space 00:51:09.160 --> 00:51:15.040 align:middle line:84% machine, a uniform Turing machine that 00:51:15.040 --> 00:51:17.060 align:middle line:90% generates the circuit. 00:51:17.060 --> 00:51:19.900 align:middle line:84% But actually, for now, don't think about. 00:51:19.900 --> 00:51:23.100 align:middle line:84% Just suppose it's just kind of there's some uniform condition. 00:51:23.100 --> 00:51:25.990 align:middle line:84% So the verifier has succinct representation of the C, 00:51:25.990 --> 00:51:28.030 align:middle line:84% because it will only come much, much later 00:51:28.030 --> 00:51:29.860 align:middle line:90% when you'll see this-- 00:51:29.860 --> 00:51:31.660 align:middle line:84% you'll need to deal with this issue. 00:51:31.660 --> 00:51:37.150 align:middle line:84% So the goal is for the prover to prove to the verifier 00:51:37.150 --> 00:51:39.790 align:middle line:90% that C of x equals 1. 00:51:39.790 --> 00:51:43.360 align:middle line:84% And the idea, the way we're going to do this essentially is, 00:51:43.360 --> 00:51:48.400 align:middle line:84% the high-level idea, is we're going to-- 00:51:48.400 --> 00:51:51.550 align:middle line:90% so I want to catch the prover. 00:51:51.550 --> 00:51:52.250 align:middle line:90% He's cheating. 00:51:52.250 --> 00:51:53.120 align:middle line:90% How am I going to catch him? 00:51:53.120 --> 00:51:54.495 align:middle line:84% I want to make sure he's correct. 00:51:54.495 --> 00:51:57.710 align:middle line:84% So the prover comes to me and says, look, C of x equal 1. 00:51:57.710 --> 00:51:59.830 align:middle line:90% The value here is 1. 00:51:59.830 --> 00:52:03.520 align:middle line:84% I want to reduce the claim on the output value 00:52:03.520 --> 00:52:07.470 align:middle line:84% to a claim about something in one layer below, 00:52:07.470 --> 00:52:09.300 align:middle line:90% by the small cell protocol. 00:52:09.300 --> 00:52:13.050 align:middle line:84% And then I want to reduce the claim about something 00:52:13.050 --> 00:52:15.507 align:middle line:84% about layer below to layer below and layer below 00:52:15.507 --> 00:52:18.090 align:middle line:84% and layer below and layer below and so on, until I get a claim 00:52:18.090 --> 00:52:21.090 align:middle line:84% about the input, which the verifier can compute on its own. 00:52:21.090 --> 00:52:22.670 align:middle line:90% That's kind of the idea. 00:52:22.670 --> 00:52:25.030 align:middle line:84% So for this, the first thing we assume, 00:52:25.030 --> 00:52:30.620 align:middle line:84% and this is without loss of generality, that C is layered. 00:52:30.620 --> 00:52:33.380 align:middle line:90% 00:52:33.380 --> 00:52:34.740 align:middle line:90% What do I mean by layered? 00:52:34.740 --> 00:52:36.060 align:middle line:90% There's an output gate. 00:52:36.060 --> 00:52:38.630 align:middle line:84% There's kind of that let's call it layer 0. 00:52:38.630 --> 00:52:41.420 align:middle line:84% And then you go to gate, and then there's 00:52:41.420 --> 00:52:44.130 align:middle line:84% kind of wires to one layer below. 00:52:44.130 --> 00:52:45.227 align:middle line:90% We'll call it layer 1. 00:52:45.227 --> 00:52:47.060 align:middle line:84% And then there are gates to one layer below. 00:52:47.060 --> 00:52:48.018 align:middle line:90% We'll call the layer 2. 00:52:48.018 --> 00:52:51.470 align:middle line:84% So there's no kind of long gate that goes from the input 00:52:51.470 --> 00:52:54.440 align:middle line:84% straight to-- it's really layer by layer. 00:52:54.440 --> 00:52:56.133 align:middle line:90% So that's the first assumption. 00:52:56.133 --> 00:52:57.300 align:middle line:90% So we can talk about layers. 00:52:57.300 --> 00:53:06.020 align:middle line:84% So what it means is that gate in layer i 00:53:06.020 --> 00:53:23.520 align:middle line:84% is connected only to gates in layer i plus 1, 00:53:23.520 --> 00:53:31.040 align:middle line:84% where we think of i equals 0 is output 00:53:31.040 --> 00:53:34.090 align:middle line:90% and i equal d is input layer. 00:53:34.090 --> 00:53:39.713 align:middle line:90% 00:53:39.713 --> 00:53:41.505 align:middle line:84% So this is just for the sake of simplicity. 00:53:41.505 --> 00:53:45.180 align:middle line:84% You can always add dummy gates to make 00:53:45.180 --> 00:53:49.330 align:middle line:84% sure that each gate is only connected to one layer below. 00:53:49.330 --> 00:53:53.440 align:middle line:84% If before it was connected to someone closer to the input, 00:53:53.440 --> 00:53:58.570 align:middle line:84% you just add dummy gates to go up, up, up. 00:53:58.570 --> 00:54:03.400 align:middle line:84% So again, let me just make sure everyone's on board. 00:54:03.400 --> 00:54:05.900 align:middle line:84% When I say a gate is in layer i, essentially what I mean, 00:54:05.900 --> 00:54:09.830 align:middle line:84% the depth from there to the input, the number, the path, 00:54:09.830 --> 00:54:11.170 align:middle line:90% the length of the path is i. 00:54:11.170 --> 00:54:16.150 align:middle line:84% So any gate that is kind of i away from the input, it's 00:54:16.150 --> 00:54:20.080 align:middle line:84% connected to gates that are only i minus 1 away from the input. 00:54:20.080 --> 00:54:22.490 align:middle line:84% So that's an assumption I'm going to make. 00:54:22.490 --> 00:54:26.650 align:middle line:84% And the way I can realize it is by just if the original circuit 00:54:26.650 --> 00:54:28.810 align:middle line:84% was not in this way, I'm just going to add 00:54:28.810 --> 00:54:30.070 align:middle line:90% dummy gates in the middle. 00:54:30.070 --> 00:54:33.070 align:middle line:84% So if a circuit at layer 3 was connected immediately 00:54:33.070 --> 00:54:35.810 align:middle line:84% to the input, I'm going to just copy the input in 1, 2, 00:54:35.810 --> 00:54:39.260 align:middle line:84% and then I'm going to connect it. 00:54:39.260 --> 00:54:42.490 align:middle line:84% So things are going to be layered. 00:54:42.490 --> 00:54:45.270 align:middle line:90% Questions about this assumption? 00:54:45.270 --> 00:54:45.850 align:middle line:90% OK. 00:54:45.850 --> 00:54:50.830 align:middle line:84% So now the circuit is layered, and now what I want to do, 00:54:50.830 --> 00:54:51.640 align:middle line:90% I want to reduce. 00:54:51.640 --> 00:54:53.860 align:middle line:84% So now I'm going to have an interactive protocol. 00:54:53.860 --> 00:55:07.810 align:middle line:84% So the idea in GKR is to have an interactive protocol that 00:55:07.810 --> 00:55:25.570 align:middle line:84% consists of d sub protocol, and each sub protocol essentially 00:55:25.570 --> 00:55:30.700 align:middle line:84% reduces a claim about some layer i 00:55:30.700 --> 00:55:34.570 align:middle line:84% to a claim about layer i plus 1, so a claim about the layer 00:55:34.570 --> 00:55:37.800 align:middle line:90% that's one closer to the input. 00:55:37.800 --> 00:55:42.610 align:middle line:84% So these are how these sub protocols will go. 00:55:42.610 --> 00:55:45.040 align:middle line:84% I'm going to explain the GKR protocol formally, 00:55:45.040 --> 00:55:47.280 align:middle line:90% but this is just intuition. 00:55:47.280 --> 00:55:51.610 align:middle line:90% 00:55:51.610 --> 00:55:55.260 align:middle line:90% So let me take this, actually. 00:55:55.260 --> 00:56:04.790 align:middle line:90% 00:56:04.790 --> 00:56:06.550 align:middle line:90% So the first thing is-- 00:56:06.550 --> 00:56:11.930 align:middle line:90% 00:56:11.930 --> 00:56:15.720 align:middle line:84% here is here is kind of the idea. 00:56:15.720 --> 00:56:18.210 align:middle line:84% So, again, this is not the protocol. 00:56:18.210 --> 00:56:23.700 align:middle line:84% I'm giving you an intuition of, helping you understand 00:56:23.700 --> 00:56:24.650 align:middle line:90% where I'm going to go. 00:56:24.650 --> 00:56:28.013 align:middle line:84% So we want to prove a cheating prover. 00:56:28.013 --> 00:56:28.930 align:middle line:90% Suppose he's cheating. 00:56:28.930 --> 00:56:32.130 align:middle line:84% He's trying to argue that C of x equals 1. 00:56:32.130 --> 00:56:33.905 align:middle line:90% But think of it, it's not. 00:56:33.905 --> 00:56:34.780 align:middle line:90% We want to catch him. 00:56:34.780 --> 00:56:36.040 align:middle line:90% How do we catch him? 00:56:36.040 --> 00:56:38.310 align:middle line:84% If he's cheating, how do we catch him? 00:56:38.310 --> 00:56:42.240 align:middle line:84% So one idea is to say, well, if he's cheating here, 00:56:42.240 --> 00:56:44.670 align:middle line:84% he must-- so let's say this is an AND gate. 00:56:44.670 --> 00:56:47.670 align:middle line:84% Suppose it's 0, but he's claiming it's 1. 00:56:47.670 --> 00:56:51.600 align:middle line:84% So it means that I'm going to ask him, you know what? 00:56:51.600 --> 00:56:54.310 align:middle line:84% It can't be, if I tell him, give me both of these. 00:56:54.310 --> 00:56:55.780 align:middle line:90% He also must be cheating. 00:56:55.780 --> 00:56:58.020 align:middle line:84% So I'm going to tell him, you know what, 1 is 1. 00:56:58.020 --> 00:57:01.110 align:middle line:84% So in that case, you claim that both of these are 1. 00:57:01.110 --> 00:57:01.990 align:middle line:90% He's like, yeah. 00:57:01.990 --> 00:57:04.455 align:middle line:84% Or if it was an OR, I'm saying, this is 1, 00:57:04.455 --> 00:57:06.330 align:middle line:84% so you claim that one of them is [INAUDIBLE]. 00:57:06.330 --> 00:57:07.560 align:middle line:90% He's like, yeah. 00:57:07.560 --> 00:57:10.890 align:middle line:90% But in reality, they're both 0. 00:57:10.890 --> 00:57:12.670 align:middle line:84% So now, what I can say, you know what? 00:57:12.670 --> 00:57:13.240 align:middle line:90% OK, fine. 00:57:13.240 --> 00:57:14.790 align:middle line:84% I'm going to choose one of them at random. 00:57:14.790 --> 00:57:15.290 align:middle line:90% Really? 00:57:15.290 --> 00:57:15.900 align:middle line:90% OK. 00:57:15.900 --> 00:57:17.470 align:middle line:90% Tell me that this is a 1. 00:57:17.470 --> 00:57:23.550 align:middle line:90% 00:57:23.550 --> 00:57:25.340 align:middle line:90% One of these has to be a cheat. 00:57:25.340 --> 00:57:27.050 align:middle line:84% So I'm going to press him-- really? 00:57:27.050 --> 00:57:28.550 align:middle line:90% So show me. 00:57:28.550 --> 00:57:30.532 align:middle line:90% Show me this. 00:57:30.532 --> 00:57:31.490 align:middle line:90% And then I'll go down-- 00:57:31.490 --> 00:57:32.948 align:middle line:84% show me, show me, show me, show me. 00:57:32.948 --> 00:57:35.520 align:middle line:84% And then he's stuck because it's an input. 00:57:35.520 --> 00:57:36.770 align:middle line:90% So this is very easy approach. 00:57:36.770 --> 00:57:39.560 align:middle line:84% The problem with this approach, I lose probability 1/2 in each 00:57:39.560 --> 00:57:45.380 align:middle line:84% layer because suppose if it's an AND, let's say it's a 0, 00:57:45.380 --> 00:57:49.790 align:middle line:84% then he tells me one of them is zeroes. 00:57:49.790 --> 00:57:53.360 align:middle line:84% But in reality, I know they're both 1. 00:57:53.360 --> 00:57:55.380 align:middle line:84% So I'm going to tell them, really? 00:57:55.380 --> 00:57:56.250 align:middle line:90% Both of them are 0? 00:57:56.250 --> 00:57:58.430 align:middle line:90% Fine, I'll choose one of them. 00:57:58.430 --> 00:57:59.610 align:middle line:90% Show me this is 0. 00:57:59.610 --> 00:58:03.120 align:middle line:84% But maybe this really was the 0,1, and then he'll, of course, 00:58:03.120 --> 00:58:03.670 align:middle line:90% cheat. 00:58:03.670 --> 00:58:06.840 align:middle line:84% So I'm like, finger crossed, this was actually a 1, 00:58:06.840 --> 00:58:10.350 align:middle line:90% but only with probability 1/2. 00:58:10.350 --> 00:58:11.790 align:middle line:90% So that idea works very well. 00:58:11.790 --> 00:58:14.507 align:middle line:84% It's just the sum is 1 over 2 to the d. 00:58:14.507 --> 00:58:16.340 align:middle line:84% So that's not good because 1 over 2 to the d 00:58:16.340 --> 00:58:17.880 align:middle line:90% is the size of the circuit. 00:58:17.880 --> 00:58:19.830 align:middle line:90% I need to-- that sucks. 00:58:19.830 --> 00:58:22.670 align:middle line:90% OK, no good. 00:58:22.670 --> 00:58:24.050 align:middle line:90% So what do we do? 00:58:24.050 --> 00:58:25.930 align:middle line:90% So here is the basic idea. 00:58:25.930 --> 00:58:27.620 align:middle line:90% The idea is, you know what? 00:58:27.620 --> 00:58:30.200 align:middle line:90% Don't ask per gate, per gate. 00:58:30.200 --> 00:58:31.820 align:middle line:90% That's not a good idea. 00:58:31.820 --> 00:58:36.220 align:middle line:84% Let's ask something about an encoding of the entire layer. 00:58:36.220 --> 00:58:38.500 align:middle line:84% So instead, I'm going to have to give me 00:58:38.500 --> 00:58:40.810 align:middle line:84% something kind of about the low-degree extension 00:58:40.810 --> 00:58:43.000 align:middle line:90% of this layer. 00:58:43.000 --> 00:58:44.760 align:middle line:84% So I'm not going to ask, reduce it. 00:58:44.760 --> 00:58:45.700 align:middle line:90% Tell me this. 00:58:45.700 --> 00:58:46.690 align:middle line:90% Tell me this. 00:58:46.690 --> 00:58:50.080 align:middle line:84% No, tell me something about this. 00:58:50.080 --> 00:58:53.560 align:middle line:84% And then I'm going to argue, if he cheated here, 00:58:53.560 --> 00:58:59.010 align:middle line:84% he must also cheat here with very high probability. 00:58:59.010 --> 00:59:00.780 align:middle line:84% And again, if you cheat here, I'm 00:59:00.780 --> 00:59:03.060 align:middle line:84% going to argue that you must cheat here 00:59:03.060 --> 00:59:07.042 align:middle line:84% with very high probability, and so on and so forth. 00:59:07.042 --> 00:59:08.500 align:middle line:84% That's kind of the high-level idea. 00:59:08.500 --> 00:59:11.440 align:middle line:84% But now you can say, well, this is a bit confusing. 00:59:11.440 --> 00:59:14.200 align:middle line:84% Before, when I said, if you cheated here, 00:59:14.200 --> 00:59:17.970 align:middle line:84% I'm going to ask him open cheat on one of these, 00:59:17.970 --> 00:59:19.410 align:middle line:90% it's very easy for me to check. 00:59:19.410 --> 00:59:21.720 align:middle line:84% If you say, this is 0, and it's an AND, 00:59:21.720 --> 00:59:25.170 align:middle line:84% you're claiming that one of these is 0. 00:59:25.170 --> 00:59:27.070 align:middle line:90% But I know one of these is 1. 00:59:27.070 --> 00:59:29.790 align:middle line:90% So it's very easy to argue. 00:59:29.790 --> 00:59:31.240 align:middle line:90% How do I go-- 00:59:31.240 --> 00:59:35.490 align:middle line:84% So I can just say, OK, prove to me that this is a 0. 00:59:35.490 --> 00:59:36.610 align:middle line:90% That's easy. 00:59:36.610 --> 00:59:42.180 align:middle line:84% How do I go from arguing about the low-degree extension 00:59:42.180 --> 00:59:46.080 align:middle line:84% of a layer to a low-degree extension of another layer? 00:59:46.080 --> 00:59:47.570 align:middle line:90% What do I ask you even? 00:59:47.570 --> 00:59:50.100 align:middle line:90% 00:59:50.100 --> 00:59:52.380 align:middle line:84% And it turns out that what I do here 00:59:52.380 --> 00:59:56.540 align:middle line:84% is really low-degree extension and Sumcheck. 00:59:56.540 --> 00:59:58.320 align:middle line:90% So I go from here to here. 00:59:58.320 --> 01:00:00.080 align:middle line:90% It's just a Sumcheck. 01:00:00.080 --> 01:00:02.790 align:middle line:84% So that's what we're going to see. 01:00:02.790 --> 01:00:06.590 align:middle line:84% That's kind of the high-level idea. 01:00:06.590 --> 01:00:10.100 align:middle line:90% Any questions? 01:00:10.100 --> 01:00:12.456 align:middle line:84% Let me just make sure I didn't forget to say something. 01:00:12.456 --> 01:00:15.150 align:middle line:90% 01:00:15.150 --> 01:00:17.270 align:middle line:90% OK, good. 01:00:17.270 --> 01:00:19.940 align:middle line:84% STUDENT: What's the goal for the verifier runtime? 01:00:19.940 --> 01:00:20.840 align:middle line:90% YAEL KALAI: Good, OK. 01:00:20.840 --> 01:00:21.882 align:middle line:90% What we're going to get-- 01:00:21.882 --> 01:00:24.750 align:middle line:84% OK, goal, as efficient as possible. 01:00:24.750 --> 01:00:28.230 align:middle line:84% What we get is the verifier's runtime 01:00:28.230 --> 01:00:31.970 align:middle line:84% and the communication complexity will be d, the depth, 01:00:31.970 --> 01:00:34.210 align:middle line:90% times polylog the circuit size. 01:00:34.210 --> 01:00:36.890 align:middle line:84% And the reason we paid this depth 01:00:36.890 --> 01:00:39.620 align:middle line:84% is because in the protocol, we're 01:00:39.620 --> 01:00:41.790 align:middle line:90% going to run d sub protocols. 01:00:41.790 --> 01:00:46.190 align:middle line:84% We're going to go from a claim on layer i 01:00:46.190 --> 01:00:47.450 align:middle line:90% to another claim of layer i. 01:00:47.450 --> 01:00:53.600 align:middle line:84% And each kind of reduction in the layers 01:00:53.600 --> 01:00:56.120 align:middle line:84% is going to be kind of a Sumcheck protocol, which 01:00:56.120 --> 01:01:01.100 align:middle line:84% will consist of log S rounds or log S-- 01:01:01.100 --> 01:01:04.490 align:middle line:84% the variable's going to be log S. 01:01:04.490 --> 01:01:07.220 align:middle line:84% So eventually, the runtime of the verifier 01:01:07.220 --> 01:01:11.450 align:middle line:84% will be something like the depth times log the circuit size. 01:01:11.450 --> 01:01:14.660 align:middle line:84% And the prover is going to run time poly in the circuit size. 01:01:14.660 --> 01:01:17.520 align:middle line:84% But we'll go over all these parameters 01:01:17.520 --> 01:01:18.730 align:middle line:90% once we see the protocol. 01:01:18.730 --> 01:01:21.060 align:middle line:84% But that's kind of the theorem that we'll 01:01:21.060 --> 01:01:23.130 align:middle line:90% write when we get there. 01:01:23.130 --> 01:01:23.830 align:middle line:90% Great. 01:01:23.830 --> 01:01:24.820 align:middle line:90% Thanks. 01:01:24.820 --> 01:01:26.180 align:middle line:90% Any other questions? 01:01:26.180 --> 01:01:26.860 align:middle line:90% Yes. 01:01:26.860 --> 01:01:30.010 align:middle line:84% STUDENT: So the verifier isn't able to see the whole circuit. 01:01:30.010 --> 01:01:30.790 align:middle line:90% YAEL KALAI: Right. 01:01:30.790 --> 01:01:32.230 align:middle line:84% STUDENT: How does the verifier get-- 01:01:32.230 --> 01:01:34.188 align:middle line:84% YAEL KALAI: Good, good, good, good, good, good. 01:01:34.188 --> 01:01:37.000 align:middle line:84% So the verifier, as I said, he can't even 01:01:37.000 --> 01:01:38.010 align:middle line:90% see the entire circuit. 01:01:38.010 --> 01:01:41.050 align:middle line:84% All he has is some uniform Turing machine 01:01:41.050 --> 01:01:42.450 align:middle line:90% that generates the circuit. 01:01:42.450 --> 01:01:44.540 align:middle line:90% So that's a very good question. 01:01:44.540 --> 01:01:49.400 align:middle line:90% How does he-- we'll see. 01:01:49.400 --> 01:01:52.530 align:middle line:84% The answer is, it's complicated, but we'll see. 01:01:52.530 --> 01:01:55.310 align:middle line:90% We'll see as we go along. 01:01:55.310 --> 01:01:59.430 align:middle line:84% He'll use his kind of uniform access to help him out. 01:01:59.430 --> 01:02:02.480 align:middle line:84% It's really unclear how at this point. 01:02:02.480 --> 01:02:03.020 align:middle line:90% Great. 01:02:03.020 --> 01:02:05.260 align:middle line:90% OK, so what do we do? 01:02:05.260 --> 01:02:11.000 align:middle line:84% So first thing, so step 1, this is just, again, for simplicity, 01:02:11.000 --> 01:02:13.430 align:middle line:90% arithmetize the circuit. 01:02:13.430 --> 01:02:19.030 align:middle line:84% Remember last time we had arithmetization? 01:02:19.030 --> 01:02:23.320 align:middle line:84% So arithmetize, all I mean here is convert an OR to-- 01:02:23.320 --> 01:02:25.570 align:middle line:84% convert an AND to multiplication, 01:02:25.570 --> 01:02:28.540 align:middle line:84% convert an OR into the sum minus multiplication. 01:02:28.540 --> 01:02:35.350 align:middle line:84% Just convert the AND/OR gates into addition and multiplication 01:02:35.350 --> 01:02:36.190 align:middle line:90% gate. 01:02:36.190 --> 01:02:55.490 align:middle line:84% So step 1, arithmetize C so that it consists of only and-- 01:02:55.490 --> 01:02:59.865 align:middle line:90% sorry, add, and multi gates. 01:02:59.865 --> 01:03:03.730 align:middle line:90% 01:03:03.730 --> 01:03:04.580 align:middle line:90% Now, you're right. 01:03:04.580 --> 01:03:07.510 align:middle line:84% At this point, the verifier doesn't even know-- 01:03:07.510 --> 01:03:10.630 align:middle line:84% so we'll talk about how the verifier has 01:03:10.630 --> 01:03:12.350 align:middle line:90% access to these things later. 01:03:12.350 --> 01:03:15.320 align:middle line:84% But the prover, what he does at least, 01:03:15.320 --> 01:03:17.900 align:middle line:84% the prover first arithmetizes the circuit. 01:03:17.900 --> 01:03:22.010 align:middle line:84% So it's add, and now everything all the gates are multiplication 01:03:22.010 --> 01:03:24.520 align:middle line:90% gates and addition gates. 01:03:24.520 --> 01:03:25.770 align:middle line:90% Good. 01:03:25.770 --> 01:03:29.700 align:middle line:84% Now, what he does, so I want to convince you that C of x we 01:03:29.700 --> 01:03:31.590 align:middle line:90% said 1, so I'll make it 1. 01:03:31.590 --> 01:03:33.270 align:middle line:90% What do I do? 01:03:33.270 --> 01:03:34.800 align:middle line:90% I'm the prover. 01:03:34.800 --> 01:03:37.050 align:middle line:90% I take my input x. 01:03:37.050 --> 01:03:41.990 align:middle line:84% I compute the values of all the gates in the circuit. 01:03:41.990 --> 01:03:43.115 align:middle line:90% So what does the prover do? 01:03:43.115 --> 01:03:46.340 align:middle line:90% 01:03:46.340 --> 01:04:02.110 align:middle line:84% First, compute the value of all the gates of C. So now 01:04:02.110 --> 01:04:06.190 align:middle line:84% the prover computed all these bits, which 01:04:06.190 --> 01:04:08.290 align:middle line:90% are the values of the gates. 01:04:08.290 --> 01:04:10.150 align:middle line:90% Note, this is still over-- 01:04:10.150 --> 01:04:10.790 align:middle line:90% it's Boolean. 01:04:10.790 --> 01:04:13.810 align:middle line:90% It's over g of 2. 01:04:13.810 --> 01:04:16.090 align:middle line:90% Everything is 0,1. 01:04:16.090 --> 01:04:16.900 align:middle line:90% OK. 01:04:16.900 --> 01:04:21.640 align:middle line:90% Next thing I do is-- 01:04:21.640 --> 01:04:25.600 align:middle line:84% the prover does, he computes the low-degree extension 01:04:25.600 --> 01:04:27.730 align:middle line:90% of each layer. 01:04:27.730 --> 01:04:30.310 align:middle line:90% So what are the parameters? 01:04:30.310 --> 01:04:31.400 align:middle line:90% How do we do it? 01:04:31.400 --> 01:04:32.880 align:middle line:90% There's many ways to do it. 01:04:32.880 --> 01:04:37.070 align:middle line:90% 01:04:37.070 --> 01:04:40.580 align:middle line:84% Let me add, actually, another assumption just for simplicity. 01:04:40.580 --> 01:04:44.830 align:middle line:84% Let's assume that the number of gates in each layer 01:04:44.830 --> 01:04:47.880 align:middle line:84% is exactly S, like the size of the circuit. 01:04:47.880 --> 01:04:50.380 align:middle line:84% I'm just assuming that so I don't need to now have different 01:04:50.380 --> 01:04:50.880 align:middle line:90% S's. 01:04:50.880 --> 01:04:52.180 align:middle line:90% It's just going to be annoying. 01:04:52.180 --> 01:04:55.300 align:middle line:84% Why can I assume that the number of gates in each layer 01:04:55.300 --> 01:04:56.050 align:middle line:90% is exactly S? 01:04:56.050 --> 01:04:57.980 align:middle line:90% Just add dummy gates or just 0. 01:04:57.980 --> 01:04:59.710 align:middle line:90% Nobody's going to look at them. 01:04:59.710 --> 01:05:00.700 align:middle line:90% I'm just going to-- 01:05:00.700 --> 01:05:03.650 align:middle line:84% it'll just make my notations easy. 01:05:03.650 --> 01:05:07.550 align:middle line:84% So now, if there's less, just add zeroes, 0, 0, 0, 0. 01:05:07.550 --> 01:05:09.760 align:middle line:84% So now it's like this kind of circuit 01:05:09.760 --> 01:05:12.610 align:middle line:84% by just adding zeroes everywhere. 01:05:12.610 --> 01:05:13.930 align:middle line:90% OK, good. 01:05:13.930 --> 01:05:17.060 align:middle line:90% Now, what does the prover do? 01:05:17.060 --> 01:05:30.520 align:middle line:84% He thinks-- so now, each layer consists of S values. 01:05:30.520 --> 01:05:33.530 align:middle line:84% That's an assumption, that we added demi gates. 01:05:33.530 --> 01:05:36.280 align:middle line:84% So now we have S values per layer. 01:05:36.280 --> 01:05:38.810 align:middle line:84% Many of them can be 0, if the layer was short, 01:05:38.810 --> 01:05:41.480 align:middle line:90% but there's S values. 01:05:41.480 --> 01:05:44.560 align:middle line:90% 01:05:44.560 --> 01:05:46.270 align:middle line:90% So let's write these values. 01:05:46.270 --> 01:05:51.980 align:middle line:84% This is for layer i, let's write these values in a hypercube. 01:05:51.980 --> 01:05:55.780 align:middle line:84% So let's write these values as kind of a function from H 01:05:55.780 --> 01:06:06.450 align:middle line:84% to the n to 0,1, where H to the m is exactly S. 01:06:06.450 --> 01:06:09.210 align:middle line:84% So we said each layer has S elements. 01:06:09.210 --> 01:06:12.238 align:middle line:84% Write them in some hypercube where the size of the hypercube 01:06:12.238 --> 01:06:14.280 align:middle line:84% is exactly S, so you can write all these elements 01:06:14.280 --> 01:06:17.500 align:middle line:84% in the hypercube in some order that makes sense to you. 01:06:17.500 --> 01:06:20.830 align:middle line:84% So if you want to take H to be 0,1, 01:06:20.830 --> 01:06:23.960 align:middle line:84% just take the binary representation of each gate. 01:06:23.960 --> 01:06:28.210 align:middle line:84% The gates are numbered, and Vi of this number 01:06:28.210 --> 01:06:32.850 align:middle line:84% is the value of this gate in layer i. 01:06:32.850 --> 01:06:37.400 align:middle line:84% So each gate in layer i has kind of a number, which 01:06:37.400 --> 01:06:42.780 align:middle line:84% is a number in H to the m, and this is the value of the gate. 01:06:42.780 --> 01:06:45.020 align:middle line:90% Now, what is H and what is m? 01:06:45.020 --> 01:06:48.650 align:middle line:84% I said it needs to be of size H to the m. 01:06:48.650 --> 01:06:50.840 align:middle line:84% H to the m needs to be S so I have place to write 01:06:50.840 --> 01:06:55.080 align:middle line:90% all the values of the layers. 01:06:55.080 --> 01:06:57.720 align:middle line:84% But which H and which m do I choose? 01:06:57.720 --> 01:06:59.750 align:middle line:84% And now, actually, there's freedom. 01:06:59.750 --> 01:07:03.410 align:middle line:84% So many times, it's easier to think 01:07:03.410 --> 01:07:06.920 align:middle line:84% like we're used to binary because we're kind of computers. 01:07:06.920 --> 01:07:11.300 align:middle line:84% So it's comfortable to think of H as being 0,1 and m to be log 01:07:11.300 --> 01:07:14.530 align:middle line:90% S. You can think of it this way. 01:07:14.530 --> 01:07:15.510 align:middle line:90% That's fine. 01:07:15.510 --> 01:07:24.310 align:middle line:84% However, later, like probably Rachel will tell you about it, 01:07:24.310 --> 01:07:25.950 align:middle line:90% it'll be convenient, actually-- 01:07:25.950 --> 01:07:27.940 align:middle line:84% Rachel is like, oh no, what did I sign up for. 01:07:27.940 --> 01:07:30.510 align:middle line:84% It's like, I'm not going to tell you. 01:07:30.510 --> 01:07:32.880 align:middle line:84% It'll be convenient, actually, to take 01:07:32.880 --> 01:07:44.690 align:middle line:84% the parameters, which are H being log S and m being log S-- 01:07:44.690 --> 01:07:45.190 align:middle line:90% fine. 01:07:45.190 --> 01:07:46.607 align:middle line:84% I tried to put in the same, didn't 01:07:46.607 --> 01:07:54.920 align:middle line:84% work-- m being log S over log log S. 01:07:54.920 --> 01:07:58.050 align:middle line:84% So it'll be convenient to think of these parameters. 01:07:58.050 --> 01:08:05.070 align:middle line:84% So first, just note that log S to the power of m, 01:08:05.070 --> 01:08:11.240 align:middle line:84% which is log S over log log S, is just-- 01:08:11.240 --> 01:08:17.374 align:middle line:84% this is just 2 to the log log S times this thing. 01:08:17.374 --> 01:08:21.870 align:middle line:90% 01:08:21.870 --> 01:08:24.700 align:middle line:84% These two cancels, and therefore you get indeed S. 01:08:24.700 --> 01:08:27.640 align:middle line:84% So I'm just saying, these parameters, 01:08:27.640 --> 01:08:30.210 align:middle line:84% indeed, if you take H to the power of m, 01:08:30.210 --> 01:08:36.729 align:middle line:84% you get S back because H log S to the power of m 01:08:36.729 --> 01:08:41.093 align:middle line:84% log S over log log S, log S is like 2 to the log log S, 01:08:41.093 --> 01:08:43.260 align:middle line:84% and then the two log log S canceled, and you get two 01:08:43.260 --> 01:08:47.439 align:middle line:84% to the log S, which is S. So this is good. 01:08:47.439 --> 01:08:50.080 align:middle line:90% You get what you want. 01:08:50.080 --> 01:08:52.180 align:middle line:84% So you can be like, why am I taking 01:08:52.180 --> 01:08:53.380 align:middle line:90% this setting of parameters? 01:08:53.380 --> 01:08:54.880 align:middle line:84% And you also may be kind of annoyed, 01:08:54.880 --> 01:08:56.870 align:middle line:84% like, why are we talking so much about parameters? 01:08:56.870 --> 01:08:57.920 align:middle line:90% This is kind of boring. 01:08:57.920 --> 01:08:58.870 align:middle line:90% And I agree. 01:08:58.870 --> 01:09:01.779 align:middle line:84% However, this is important because these parameters 01:09:01.779 --> 01:09:04.279 align:middle line:84% are used a lot and for a good reason. 01:09:04.279 --> 01:09:07.240 align:middle line:84% So let me tell you why these parameters, why am I 01:09:07.240 --> 01:09:09.250 align:middle line:84% spending your time on these parameters, 01:09:09.250 --> 01:09:11.100 align:middle line:90% this specific choice. 01:09:11.100 --> 01:09:14.279 align:middle line:84% And the reason is that later, when 01:09:14.279 --> 01:09:16.859 align:middle line:84% we'll take extension-- remember, we 01:09:16.859 --> 01:09:18.279 align:middle line:90% take an extension over a field. 01:09:18.279 --> 01:09:19.580 align:middle line:90% We'll take a big field. 01:09:19.580 --> 01:09:24.490 align:middle line:84% Now, the field, if you remember the Sumcheck protocol, 01:09:24.490 --> 01:09:28.380 align:middle line:84% the soundness you get is like m times 01:09:28.380 --> 01:09:32.939 align:middle line:84% d, the number of variables times the degree over f. 01:09:32.939 --> 01:09:38.399 align:middle line:84% So f needs to be of size at least m times d. 01:09:38.399 --> 01:09:43.260 align:middle line:84% So it will need to be at least like this m, which is, 01:09:43.260 --> 01:09:47.920 align:middle line:84% if you take binary, like 0,1, it'll need to be at least log S, 01:09:47.920 --> 01:09:48.660 align:middle line:90% which is the m. 01:09:48.660 --> 01:09:52.439 align:middle line:84% Or here, the number of variables is not constant usually, 01:09:52.439 --> 01:09:55.590 align:middle line:84% and it'll need to be bigger than the number of variables. 01:09:55.590 --> 01:10:01.710 align:middle line:84% And now the problem is if you take-- 01:10:01.710 --> 01:10:05.760 align:middle line:84% so what's very desirable in later applications, 01:10:05.760 --> 01:10:07.573 align:middle line:84% in particular for PCP applications, 01:10:07.573 --> 01:10:09.490 align:middle line:84% which we'll talk about, it's really beautiful. 01:10:09.490 --> 01:10:11.715 align:middle line:84% For those who haven't heard of what PCPs are, 01:10:11.715 --> 01:10:12.590 align:middle line:90% we'll learn about it. 01:10:12.590 --> 01:10:13.670 align:middle line:90% It's really, really nice. 01:10:13.670 --> 01:10:19.090 align:middle line:84% But for these applications, what you want is that f the size 01:10:19.090 --> 01:10:27.060 align:middle line:84% of the extension you take is poly in H. 01:10:27.060 --> 01:10:30.340 align:middle line:84% And now if you take H to be 0,1, which is binary, 01:10:30.340 --> 01:10:35.130 align:middle line:84% which is what we all like, then the field becomes constant size 01:10:35.130 --> 01:10:37.020 align:middle line:84% because it needs to be for applications. 01:10:37.020 --> 01:10:39.940 align:middle line:84% Like, to get the PCP, you need f. 01:10:39.940 --> 01:10:43.150 align:middle line:84% If f is bigger, you'll get a super polynomial object. 01:10:43.150 --> 01:10:48.810 align:middle line:84% So for later applications, it's important that the field is not 01:10:48.810 --> 01:10:53.070 align:middle line:84% too much bigger than H, that it's polynomially related to H. 01:10:53.070 --> 01:10:58.090 align:middle line:84% And then if you take H to be small, like constant, like 0,1, 01:10:58.090 --> 01:11:00.840 align:middle line:84% then f is a constant, and then you don't get sums because m is 01:11:00.840 --> 01:11:01.850 align:middle line:90% not a constant. 01:11:01.850 --> 01:11:03.100 align:middle line:90% So you get sums bigger than 1. 01:11:03.100 --> 01:11:04.260 align:middle line:90% You got nothing. 01:11:04.260 --> 01:11:07.735 align:middle line:84% So if you didn't follow, it doesn't matter. 01:11:07.735 --> 01:11:09.360 align:middle line:84% You will see it when we talk about PCP. 01:11:09.360 --> 01:11:12.870 align:middle line:84% But this is just to tell you why I'm choosing these weird 01:11:12.870 --> 01:11:14.675 align:middle line:90% parameters as opposed to 0,1. 01:11:14.675 --> 01:11:16.800 align:middle line:84% The point is that later we'll need these parameters 01:11:16.800 --> 01:11:18.300 align:middle line:90% when we'll talk about PCP. 01:11:18.300 --> 01:11:20.610 align:middle line:84% And so that's why we're using them now. 01:11:20.610 --> 01:11:22.950 align:middle line:90% STUDENT: [INAUDIBLE] GKR itself? 01:11:22.950 --> 01:11:24.600 align:middle line:84% YAEL KALAI: GKR itself you don't need. 01:11:24.600 --> 01:11:27.017 align:middle line:84% STUDENT: Of course, you're never writing down the entire-- 01:11:27.017 --> 01:11:28.630 align:middle line:90% YAEL KALAI: Exactly. 01:11:28.630 --> 01:11:29.130 align:middle line:90% Exactly. 01:11:29.130 --> 01:11:30.670 align:middle line:84% Because in GKR, it's interactive. 01:11:30.670 --> 01:11:32.560 align:middle line:84% You're never writing down the entire thing. 01:11:32.560 --> 01:11:37.180 align:middle line:84% For GKR itself, you can take H to be 0,1 and you can take f 01:11:37.180 --> 01:11:40.470 align:middle line:84% to be big and the kind of parameters you want. 01:11:40.470 --> 01:11:42.550 align:middle line:84% I was actually debating if to teach it with 0,1, 01:11:42.550 --> 01:11:44.800 align:middle line:84% and then to change all the parameters. 01:11:44.800 --> 01:11:48.250 align:middle line:84% In many-- if you look at Justin Thaler's notes that are 01:11:48.250 --> 01:11:50.780 align:middle line:84% in the website, I gave the exact chapter, 01:11:50.780 --> 01:11:54.580 align:middle line:84% then he uses 0,1 because it's easier. 01:11:54.580 --> 01:11:57.055 align:middle line:84% But since I'm going to change the parameters anyway, 01:11:57.055 --> 01:11:58.430 align:middle line:84% I thought I'll just start with m. 01:11:58.430 --> 01:12:00.760 align:middle line:84% And I think it's good to get accustomed to these type 01:12:00.760 --> 01:12:03.900 align:middle line:84% of parameters because they show up a lot. 01:12:03.900 --> 01:12:06.840 align:middle line:84% So this is just kind of-- if you didn't follow exact choice, 01:12:06.840 --> 01:12:07.990 align:middle line:90% don't worry about it. 01:12:07.990 --> 01:12:10.800 align:middle line:84% It turns out this is the choice I want. 01:12:10.800 --> 01:12:15.000 align:middle line:84% And why, you'll learn about it when we talk about PCPs. 01:12:15.000 --> 01:12:20.280 align:middle line:84% But if you want to think about H as 0,1 and m as log S, 01:12:20.280 --> 01:12:21.360 align:middle line:90% you can do so. 01:12:21.360 --> 01:12:22.800 align:middle line:84% All the lecture, everything I say 01:12:22.800 --> 01:12:26.010 align:middle line:84% makes sense in that parameters, and you'll understand everything 01:12:26.010 --> 01:12:28.310 align:middle line:84% with these parameters as well for today. 01:12:28.310 --> 01:12:31.590 align:middle line:90% 01:12:31.590 --> 01:12:34.090 align:middle line:90% So good. 01:12:34.090 --> 01:12:37.270 align:middle line:90% So now what will the prover do? 01:12:37.270 --> 01:12:46.120 align:middle line:84% The prover will-- he has for every layer, 01:12:46.120 --> 01:12:49.090 align:middle line:90% he has the values of the gates. 01:12:49.090 --> 01:12:54.930 align:middle line:84% He computes the values of the gates of that layer, which 01:12:54.930 --> 01:13:02.350 align:middle line:84% you can think about it as for each layer i, 01:13:02.350 --> 01:13:07.360 align:middle line:84% the prover computes Vi, which is the value of all 01:13:07.360 --> 01:13:09.130 align:middle line:90% the gates in layer i. 01:13:09.130 --> 01:13:15.680 align:middle line:84% So we can think of the gates as going from H to the m to 0,1. 01:13:15.680 --> 01:13:17.950 align:middle line:84% Each gate has a label in H to the m 01:13:17.950 --> 01:13:20.470 align:middle line:84% because it's kind of the same as it is amorphous to S. 01:13:20.470 --> 01:13:23.540 align:middle line:90% So each gate has a label here. 01:13:23.540 --> 01:13:29.170 align:middle line:84% And this is just the value of the gate on input x. 01:13:29.170 --> 01:13:30.690 align:middle line:90% So this is the proof. 01:13:30.690 --> 01:13:31.690 align:middle line:90% There's no protocol yet. 01:13:31.690 --> 01:13:32.760 align:middle line:84% I'm just telling you what the prover computes 01:13:32.760 --> 01:13:33.885 align:middle line:90% before the protocol begins. 01:13:33.885 --> 01:13:36.600 align:middle line:90% 01:13:36.600 --> 01:13:43.860 align:middle line:84% And now the prover can compute the low-degree extension. 01:13:43.860 --> 01:13:46.760 align:middle line:84% So this-- let me actually be careful with room. 01:13:46.760 --> 01:13:47.710 align:middle line:90% So I'll write it here. 01:13:47.710 --> 01:13:53.070 align:middle line:90% 01:13:53.070 --> 01:13:57.040 align:middle line:84% This is nothing but the low-degree extension of Vi. 01:13:57.040 --> 01:14:01.270 align:middle line:90% 01:14:01.270 --> 01:14:03.590 align:middle line:90% OK, now we're in business. 01:14:03.590 --> 01:14:07.650 align:middle line:84% Once the prover computed this, then we're in good shape. 01:14:07.650 --> 01:14:08.150 align:middle line:90% So now what? 01:14:08.150 --> 01:14:09.810 align:middle line:84% Now let's go back to the protocol. 01:14:09.810 --> 01:14:11.500 align:middle line:90% What do they do? 01:14:11.500 --> 01:14:16.260 align:middle line:84% So as we said, the goal is to reduce. 01:14:16.260 --> 01:14:19.580 align:middle line:84% So remember, the first thing the prover gave the verifier-- you 01:14:19.580 --> 01:14:21.110 align:middle line:84% can think of the protocol started 01:14:21.110 --> 01:14:26.680 align:middle line:84% with V0, which is the output layer, and one element. 01:14:26.680 --> 01:14:28.510 align:middle line:84% Let me call it Z0, because we're going 01:14:28.510 --> 01:14:33.700 align:middle line:84% to call them Z, and Z0 in H to the m in this time, which 01:14:33.700 --> 01:14:34.510 align:middle line:90% is kind of-- 01:14:34.510 --> 01:14:36.860 align:middle line:84% actually, the output layer has just one gate. 01:14:36.860 --> 01:14:37.880 align:middle line:90% It's 0,1. 01:14:37.880 --> 01:14:41.848 align:middle line:84% We added a bunch of zeros to it because dummy gates assume 01:14:41.848 --> 01:14:42.890 align:middle line:90% that it's kind of size S. 01:14:42.890 --> 01:14:45.340 align:middle line:90% But there's one gate. 01:14:45.340 --> 01:14:46.940 align:middle line:90% Let's call this gate Z0. 01:14:46.940 --> 01:14:49.940 align:middle line:84% And he's arguing on Z0 there's a certain value V0. 01:14:49.940 --> 01:14:51.910 align:middle line:90% In our case, we said it's 1. 01:14:51.910 --> 01:14:54.160 align:middle line:90% So he comes with an argument. 01:14:54.160 --> 01:14:57.110 align:middle line:84% He tells it, look, if you look at the output layer-- 01:14:57.110 --> 01:14:58.215 align:middle line:90% this is the output layer. 01:14:58.215 --> 01:15:02.390 align:middle line:90% 01:15:02.390 --> 01:15:05.540 align:middle line:84% If you look at the output layer and the relevant gate 01:15:05.540 --> 01:15:11.150 align:middle line:84% and the actual single, not dummy gate, I claim the output is V0, 01:15:11.150 --> 01:15:12.980 align:middle line:90% namely, let's say 1. 01:15:12.980 --> 01:15:15.860 align:middle line:84% Now, I say, why would I trust you? 01:15:15.860 --> 01:15:18.035 align:middle line:84% And he said, OK, let me help you. 01:15:18.035 --> 01:15:18.535 align:middle line:90% Here. 01:15:18.535 --> 01:15:21.990 align:middle line:90% 01:15:21.990 --> 01:15:24.340 align:middle line:90% I can always add tilde. 01:15:24.340 --> 01:15:26.100 align:middle line:90% So now let's see. 01:15:26.100 --> 01:15:31.320 align:middle line:84% What is V0 tilde and any element Z? 01:15:31.320 --> 01:15:32.830 align:middle line:90% What is this value? 01:15:32.830 --> 01:15:34.050 align:middle line:90% Remember, this is the output. 01:15:34.050 --> 01:15:34.860 align:middle line:90% Yeah? 01:15:34.860 --> 01:15:38.860 align:middle line:90% So it is what? 01:15:38.860 --> 01:15:41.340 align:middle line:84% And what I'm saying here is actually general. 01:15:41.340 --> 01:15:43.720 align:middle line:90% Even let's think of i, layer i. 01:15:43.720 --> 01:15:46.310 align:middle line:84% You can think of layer 0 if you want, but in any layer. 01:15:46.310 --> 01:15:49.790 align:middle line:84% Take any layer, and take any Zi, even in the extension, 01:15:49.790 --> 01:15:51.440 align:middle line:90% in f to the n. 01:15:51.440 --> 01:15:54.290 align:middle line:84% Here, it happened to be that the Z0 was actually 01:15:54.290 --> 01:15:56.180 align:middle line:84% kind of not in the extension even because we 01:15:56.180 --> 01:15:57.800 align:middle line:90% started with a certain gate. 01:15:57.800 --> 01:16:00.440 align:middle line:84% But let's think of it more broadly because later we'll 01:16:00.440 --> 01:16:02.630 align:middle line:90% go to will be in the extension. 01:16:02.630 --> 01:16:08.990 align:middle line:84% So the prover claims that this is Vi. 01:16:08.990 --> 01:16:12.790 align:middle line:90% We start with i equals 0. 01:16:12.790 --> 01:16:14.030 align:middle line:90% I don't know if that's true. 01:16:14.030 --> 01:16:17.210 align:middle line:84% I want to reduce it to a claim about layer i plus 1, 01:16:17.210 --> 01:16:18.250 align:middle line:90% one layer down. 01:16:18.250 --> 01:16:20.020 align:middle line:90% How do I do that? 01:16:20.020 --> 01:16:22.400 align:middle line:90% What is Vi tilde and Zi? 01:16:22.400 --> 01:16:24.860 align:middle line:84% Zi in general is in the extension. 01:16:24.860 --> 01:16:27.590 align:middle line:84% In this case, it's not, but in general it's in the extension. 01:16:27.590 --> 01:16:30.920 align:middle line:84% So first thing, let me move Zi not in the extension. 01:16:30.920 --> 01:16:33.760 align:middle line:84% So let's remember, what is Vi tilde? 01:16:33.760 --> 01:16:34.905 align:middle line:90% Vi tilde is sum. 01:16:34.905 --> 01:16:38.680 align:middle line:90% 01:16:38.680 --> 01:16:43.370 align:middle line:84% Vi, that's kind of the original Vi, and H-- 01:16:43.370 --> 01:16:45.500 align:middle line:84% let me make sure I'm consistent with my notation 01:16:45.500 --> 01:16:46.635 align:middle line:90% so I won't confuse myself-- 01:16:46.635 --> 01:16:51.590 align:middle line:90% 01:16:51.590 --> 01:17:05.900 align:middle line:84% and point P in H to the m times this chi P of Zi. 01:17:05.900 --> 01:17:07.310 align:middle line:90% I just kind of-- 01:17:07.310 --> 01:17:09.590 align:middle line:84% so what is the low-degree extension of V? 01:17:09.590 --> 01:17:14.200 align:middle line:84% It's the Vi on every point, not in the extension, in the cube, 01:17:14.200 --> 01:17:19.010 align:middle line:84% in H to the m, times this kind of chi function, 01:17:19.010 --> 01:17:20.550 align:middle line:84% which was this-- oh, I erased it. 01:17:20.550 --> 01:17:23.390 align:middle line:84% But it's the-- yeah, this multiplication. 01:17:23.390 --> 01:17:28.210 align:middle line:84% Each one of them was this degree H minus 1 function. 01:17:28.210 --> 01:17:33.310 align:middle line:90% But what is Vi? 01:17:33.310 --> 01:17:39.370 align:middle line:84% Vi, we can easily relate it to the layer one below. 01:17:39.370 --> 01:17:42.940 align:middle line:84% Vi is either an add gate or a multiplication gate. 01:17:42.940 --> 01:17:45.743 align:middle line:84% If it's an add gate, it's an add of two elements below. 01:17:45.743 --> 01:17:47.160 align:middle line:84% And if it's a multiplication, it's 01:17:47.160 --> 01:17:49.470 align:middle line:84% a multiplication of two elements below. 01:17:49.470 --> 01:17:53.110 align:middle line:84% So now, to connect it to the layer below, 01:17:53.110 --> 01:17:56.220 align:middle line:84% and this goes to the question of what is the verifier 01:17:56.220 --> 01:17:57.960 align:middle line:90% know or doesn't know. 01:17:57.960 --> 01:18:00.810 align:middle line:84% What I'm going to use is the circuit has-- 01:18:00.810 --> 01:18:03.630 align:middle line:84% so the circuit is associated for every i 01:18:03.630 --> 01:18:08.850 align:middle line:84% with an add function and the multiplication function. 01:18:08.850 --> 01:18:19.310 align:middle line:84% And this function goes from 0,1 to the, I guess, 3 log S to 0,1. 01:18:19.310 --> 01:18:24.680 align:middle line:84% And it just says whether you take a gate in layer i 01:18:24.680 --> 01:18:28.010 align:middle line:84% and two gates in layer i plus 1, and it checks 01:18:28.010 --> 01:18:30.450 align:middle line:90% whether there's an ad there. 01:18:30.450 --> 01:18:35.220 align:middle line:84% So it takes kind of i, j, and k, and it 01:18:35.220 --> 01:18:40.495 align:middle line:90% says 1 if and only if gate i-- 01:18:40.495 --> 01:18:43.500 align:middle line:90% 01:18:43.500 --> 01:18:46.800 align:middle line:90% sorry, i is taken. 01:18:46.800 --> 01:18:49.410 align:middle line:90% What notation did I use? 01:18:49.410 --> 01:18:51.820 align:middle line:90% OK. 01:18:51.820 --> 01:18:52.510 align:middle line:90% Sorry. 01:18:52.510 --> 01:19:02.360 align:middle line:84% It takes a gate P, w1, and w2 in S, one of the gates, 01:19:02.360 --> 01:19:08.870 align:middle line:84% and it outputs 1 if and only if gate P in layer 01:19:08.870 --> 01:19:29.460 align:middle line:84% i is a add of gates w1 and w2 in layer i plus 1, and 0 otherwise. 01:19:29.460 --> 01:19:34.500 align:middle line:90% 01:19:34.500 --> 01:19:37.930 align:middle line:90% I start 0 and I go down to d. 01:19:37.930 --> 01:19:40.400 align:middle line:90% Yeah, and 0 otherwise. 01:19:40.400 --> 01:19:43.880 align:middle line:90% 01:19:43.880 --> 01:19:47.660 align:middle line:84% So just check if there's an and there, if there's an add there. 01:19:47.660 --> 01:19:49.350 align:middle line:90% And mult is exactly the same. 01:19:49.350 --> 01:19:51.930 align:middle line:84% Mult checks if there's a multiplication gate. 01:19:51.930 --> 01:19:56.240 align:middle line:84% So mult also takes P, a point P in layer i, 01:19:56.240 --> 01:19:59.180 align:middle line:84% two points in layer i plus 1, and it outputs 1 if and only 01:19:59.180 --> 01:20:02.360 align:middle line:84% if this gate P in layer i is actually 01:20:02.360 --> 01:20:04.830 align:middle line:84% a mult gate, a multiplication gate, 01:20:04.830 --> 01:20:08.770 align:middle line:84% and it connects to gates w1w2 in layer ii plus 1. 01:20:08.770 --> 01:20:11.690 align:middle line:90% 01:20:11.690 --> 01:20:12.590 align:middle line:90% So what is this? 01:20:12.590 --> 01:20:19.680 align:middle line:84% Now we can say this is nothing but sum of P. 01:20:19.680 --> 01:20:24.480 align:middle line:84% Let sum over all the possible w1 and w2, 01:20:24.480 --> 01:20:27.940 align:middle line:84% all the gates in the layer below, and see. 01:20:27.940 --> 01:20:28.930 align:middle line:90% Maybe it adds. 01:20:28.930 --> 01:20:37.560 align:middle line:84% So if there's add, if add ipw1w2, if that's 1, 01:20:37.560 --> 01:20:41.160 align:middle line:90% then you have Vi. 01:20:41.160 --> 01:20:44.774 align:middle line:90% Then VP is just Viw1 plus Viw2. 01:20:44.774 --> 01:20:50.110 align:middle line:90% 01:20:50.110 --> 01:20:54.320 align:middle line:90% Again, if P is an add gate. 01:20:54.320 --> 01:20:56.050 align:middle line:84% If it's not, an add gate, you'll get a 0. 01:20:56.050 --> 01:20:57.630 align:middle line:90% So you're not adding anything. 01:20:57.630 --> 01:21:01.810 align:middle line:84% If it happens to be an add gate, then the value of this gate 01:21:01.810 --> 01:21:03.945 align:middle line:84% is just the sum of the values of the gates below. 01:21:03.945 --> 01:21:06.590 align:middle line:90% 01:21:06.590 --> 01:21:09.680 align:middle line:84% If P is not an add gate, all this is 0. 01:21:09.680 --> 01:21:14.125 align:middle line:84% I didn't do anything, because I multiplied by add, which is 0. 01:21:14.125 --> 01:21:14.625 align:middle line:90% OK. 01:21:14.625 --> 01:21:18.650 align:middle line:90% 01:21:18.650 --> 01:21:30.580 align:middle line:84% plus-- let me just open-- plus mult Ipw1w2 if it's 01:21:30.580 --> 01:21:37.450 align:middle line:84% a multiplication gate, and let's say it's connected to w1, w2, 01:21:37.450 --> 01:21:38.550 align:middle line:90% I'm still the sum. 01:21:38.550 --> 01:21:40.060 align:middle line:90% Then what do I do then? 01:21:40.060 --> 01:21:42.890 align:middle line:90% What's the value of VIP-- 01:21:42.890 --> 01:21:44.976 align:middle line:90% I mean, Vi in point P? 01:21:44.976 --> 01:21:49.240 align:middle line:84% STUDENT: Vi and point w1 times [INAUDIBLE]. 01:21:49.240 --> 01:21:52.630 align:middle line:84% YAEL KALAI: Exactly, Vi and point w1 times, 01:21:52.630 --> 01:21:57.670 align:middle line:84% because it's a multiplication gate, Vi in w2. 01:21:57.670 --> 01:21:58.990 align:middle line:90% Sorry, plus 1. 01:21:58.990 --> 01:21:59.600 align:middle line:90% Thank you. 01:21:59.600 --> 01:22:01.180 align:middle line:90% Thank you. 01:22:01.180 --> 01:22:02.960 align:middle line:90% Yes, great. 01:22:02.960 --> 01:22:03.460 align:middle line:90% Good. 01:22:03.460 --> 01:22:07.900 align:middle line:90% 01:22:07.900 --> 01:22:15.610 align:middle line:84% And all of these times this polynomial Chi P of Zi. 01:22:15.610 --> 01:22:23.735 align:middle line:90% 01:22:23.735 --> 01:22:24.235 align:middle line:90% Good. 01:22:24.235 --> 01:22:28.020 align:middle line:90% 01:22:28.020 --> 01:22:30.370 align:middle line:90% So now where are we? 01:22:30.370 --> 01:22:34.890 align:middle line:84% We want to prove something about layer i, 01:22:34.890 --> 01:22:38.610 align:middle line:84% but we managed to write it as sum 01:22:38.610 --> 01:22:41.700 align:middle line:90% of elements in layer i plus 1. 01:22:41.700 --> 01:22:42.632 align:middle line:90% That's great. 01:22:42.632 --> 01:22:43.840 align:middle line:90% That's really what we wanted. 01:22:43.840 --> 01:22:44.798 align:middle line:90% We want one layer down. 01:22:44.798 --> 01:22:47.880 align:middle line:90% 01:22:47.880 --> 01:22:57.000 align:middle line:84% And note, this is really similar to a Sumcheck. 01:22:57.000 --> 01:22:57.910 align:middle line:90% What do we have here? 01:22:57.910 --> 01:22:59.520 align:middle line:90% We want to prove that Vi-- 01:22:59.520 --> 01:23:02.940 align:middle line:84% so I want to tell the prover, prove to me 01:23:02.940 --> 01:23:06.100 align:middle line:84% that instead of-- he claims Vi is this value. 01:23:06.100 --> 01:23:08.040 align:middle line:84% I'm like, I don't know what this value is. 01:23:08.040 --> 01:23:10.130 align:middle line:84% Prove to me that Vi is equal to the sum. 01:23:10.130 --> 01:23:12.840 align:middle line:90% 01:23:12.840 --> 01:23:15.750 align:middle line:84% So prove to me that Vi is equal to something about the layer 01:23:15.750 --> 01:23:18.280 align:middle line:90% below. 01:23:18.280 --> 01:23:22.424 align:middle line:84% How does he prove that something is equal to the sum? 01:23:22.424 --> 01:23:24.790 align:middle line:90% Sumcheck, right? 01:23:24.790 --> 01:23:27.160 align:middle line:90% So do the Sumcheck protocol. 01:23:27.160 --> 01:23:29.920 align:middle line:84% And now we're saying, wait, but where is the polynomials? 01:23:29.920 --> 01:23:30.842 align:middle line:90% No problem. 01:23:30.842 --> 01:23:32.050 align:middle line:90% Everything's over h of the m. 01:23:32.050 --> 01:23:33.290 align:middle line:90% Look at the extensions. 01:23:33.290 --> 01:23:36.040 align:middle line:90% 01:23:36.040 --> 01:23:37.430 align:middle line:90% This is already polynomial. 01:23:37.430 --> 01:23:38.000 align:middle line:90% We don't care about it. 01:23:38.000 --> 01:23:38.500 align:middle line:90% That's good. 01:23:38.500 --> 01:23:41.410 align:middle line:90% 01:23:41.410 --> 01:23:43.660 align:middle line:90% Look at the extensions. 01:23:43.660 --> 01:23:49.440 align:middle line:84% We have a low-degree extension up here. 01:23:49.440 --> 01:23:52.660 align:middle line:90% Any polynomial can be extended. 01:23:52.660 --> 01:23:54.640 align:middle line:90% Look at the extension. 01:23:54.640 --> 01:24:00.930 align:middle line:84% So now we want to argue that Vi equals the sum. 01:24:00.930 --> 01:24:06.570 align:middle line:84% This entire thing-- this entire thing, I argue, 01:24:06.570 --> 01:24:09.530 align:middle line:90% is a low-degree polynomial. 01:24:09.530 --> 01:24:11.650 align:middle line:84% Why is this a low-degree polynomial? 01:24:11.650 --> 01:24:12.270 align:middle line:90% Let's see. 01:24:12.270 --> 01:24:16.850 align:middle line:84% First of all, it's a polynomial over H to the 3m because m here 01:24:16.850 --> 01:24:21.410 align:middle line:84% and two w's here, so we're talking about 3m variables. 01:24:21.410 --> 01:24:22.460 align:middle line:90% But Mm is small. 01:24:22.460 --> 01:24:29.790 align:middle line:84% This is good. m is log S over log log S, so that's good. 01:24:29.790 --> 01:24:31.200 align:middle line:90% What about here? 01:24:31.200 --> 01:24:32.680 align:middle line:84% So let's first look at the degree. 01:24:32.680 --> 01:24:36.130 align:middle line:84% The degree of these things, it's the low-degree extension. 01:24:36.130 --> 01:24:39.600 align:middle line:84% It's H minus 1 of each one, because I'm really taking each 01:24:39.600 --> 01:24:42.690 align:middle line:84% one is H. Each add, everything is kind of-- oh, 01:24:42.690 --> 01:24:48.090 align:middle line:84% add is even better because we did 0,1, so add is even better. 01:24:48.090 --> 01:24:54.033 align:middle line:90% You could do-- oh, sorry. 01:24:54.033 --> 01:24:56.800 align:middle line:90% 01:24:56.800 --> 01:24:57.825 align:middle line:90% Can I take it back? 01:24:57.825 --> 01:25:02.190 align:middle line:90% 01:25:02.190 --> 01:25:08.520 align:middle line:84% I also wanted to add an H. Everything is in-- 01:25:08.520 --> 01:25:11.380 align:middle line:84% I made a mistake of putting 0,1, but I need to be consistent. 01:25:11.380 --> 01:25:12.840 align:middle line:90% If I'm in, I'm in H. 01:25:12.840 --> 01:25:18.370 align:middle line:84% So everything is in H. So everything here 01:25:18.370 --> 01:25:21.230 align:middle line:90% is degree H minus 1, so good. 01:25:21.230 --> 01:25:23.440 align:middle line:84% So it's more than H1 is 1 because I have 01:25:23.440 --> 01:25:26.920 align:middle line:84% your multiplication. w1 appears here, w1 appears here, 01:25:26.920 --> 01:25:29.180 align:middle line:84% so it's going to be degree 2H minus 1. 01:25:29.180 --> 01:25:29.680 align:middle line:90% Fine. 01:25:29.680 --> 01:25:30.860 align:middle line:90% But H minus 1 is small. 01:25:30.860 --> 01:25:32.360 align:middle line:90% It's like log, so two logs. 01:25:32.360 --> 01:25:34.610 align:middle line:84% So the degree is small, the number of variables small. 01:25:34.610 --> 01:25:35.680 align:middle line:90% Perfect. 01:25:35.680 --> 01:25:37.250 align:middle line:90% Just do Sumcheck. 01:25:37.250 --> 01:25:40.450 align:middle line:84% So now you're asking, what is the GKR protocol? 01:25:40.450 --> 01:25:41.880 align:middle line:90% Sumcheck. 01:25:41.880 --> 01:25:43.350 align:middle line:90% That's it. 01:25:43.350 --> 01:25:46.720 align:middle line:90% You start with V0. 01:25:46.720 --> 01:25:47.830 align:middle line:90% You tell him, do Sumcheck. 01:25:47.830 --> 01:25:51.220 align:middle line:90% 01:25:51.220 --> 01:25:54.290 align:middle line:84% Convert this claim about the output, 01:25:54.290 --> 01:25:55.600 align:middle line:90% which the verifier has no idea. 01:25:55.600 --> 01:25:56.930 align:middle line:90% It's so far away from him. 01:25:56.930 --> 01:25:59.030 align:middle line:90% He doesn't know what-- 01:25:59.030 --> 01:26:04.110 align:middle line:84% let's do the Sumcheck protocol to reduce this claim to a claim 01:26:04.110 --> 01:26:05.280 align:middle line:90% about-- 01:26:05.280 --> 01:26:09.240 align:middle line:90% about this thing, essentially. 01:26:09.240 --> 01:26:11.760 align:middle line:84% But now this is very confusing because what happens when 01:26:11.760 --> 01:26:13.240 align:middle line:90% we do the Sumcheck protocol? 01:26:13.240 --> 01:26:15.300 align:middle line:84% When we do the Sumcheck protocol, 01:26:15.300 --> 01:26:18.660 align:middle line:84% we reduce, if you remember-- let's look for a second 01:26:18.660 --> 01:26:20.280 align:middle line:90% at the Sumcheck here. 01:26:20.280 --> 01:26:25.720 align:middle line:84% We want to prove that the sum of something there, 01:26:25.720 --> 01:26:26.470 align:middle line:90% it's a huge thing. 01:26:26.470 --> 01:26:32.640 align:middle line:84% Add V plus mult, multiplication, all this craziness, whatever. 01:26:32.640 --> 01:26:35.100 align:middle line:84% Low degree is equal to beta, is equal to something, 01:26:35.100 --> 01:26:37.170 align:middle line:90% in that case, V0. 01:26:37.170 --> 01:26:39.070 align:middle line:90% We run the Sumcheck protocol. 01:26:39.070 --> 01:26:43.380 align:middle line:84% At the end, the verifier needs to compute to check. 01:26:43.380 --> 01:26:45.090 align:middle line:84% In the Sumcheck protocol, we assume 01:26:45.090 --> 01:26:50.300 align:middle line:84% that the verifier has oracle access to the polynomial. 01:26:50.300 --> 01:26:53.340 align:middle line:84% But essentially, he needs to compute this function, 01:26:53.340 --> 01:26:56.240 align:middle line:90% the polynomial, at some point. 01:26:56.240 --> 01:26:58.380 align:middle line:84% Now, maybe he has oracle access at that point. 01:26:58.380 --> 01:27:00.530 align:middle line:90% Great but maybe. 01:27:00.530 --> 01:27:04.410 align:middle line:84% But there's no oracles in this, in GKR. 01:27:04.410 --> 01:27:06.110 align:middle line:90% So what do we do now? 01:27:06.110 --> 01:27:08.510 align:middle line:84% But here's an important observation that we'll use. 01:27:08.510 --> 01:27:11.930 align:middle line:90% Note, yes, the prover needs-- 01:27:11.930 --> 01:27:13.370 align:middle line:90% sorry, the verifier. 01:27:13.370 --> 01:27:14.960 align:middle line:84% When he verifies the Sumcheck, he 01:27:14.960 --> 01:27:19.970 align:middle line:84% needs to compute the polynomial on a single point. 01:27:19.970 --> 01:27:25.700 align:middle line:84% But this point t, t1 of the tm, is a random point 01:27:25.700 --> 01:27:29.270 align:middle line:90% that's chosen by the verifier. 01:27:29.270 --> 01:27:30.660 align:middle line:90% What is the Sumcheck protocol? 01:27:30.660 --> 01:27:33.120 align:middle line:84% The verifier chooses a random t1. 01:27:33.120 --> 01:27:36.290 align:middle line:84% He gets a polynomial, then chooses a random t2, 01:27:36.290 --> 01:27:37.440 align:middle line:90% and so on and so forth. 01:27:37.440 --> 01:27:40.370 align:middle line:84% At the end, he needs to evaluate f and t1 of the tm 01:27:40.370 --> 01:27:42.800 align:middle line:90% that he chose. 01:27:42.800 --> 01:27:45.480 align:middle line:90% We will use this. 01:27:45.480 --> 01:27:47.120 align:middle line:90% So now let's see. 01:27:47.120 --> 01:27:49.440 align:middle line:90% What happened here? 01:27:49.440 --> 01:27:55.560 align:middle line:84% After we did the Sumcheck, the poor verifier needs to compute-- 01:27:55.560 --> 01:27:59.650 align:middle line:84% let me again, make sure I'm consistent with my notation. 01:27:59.650 --> 01:28:00.610 align:middle line:90% Good. 01:28:00.610 --> 01:28:03.860 align:middle line:84% The verifier now, so he does the Sumcheck. 01:28:03.860 --> 01:28:07.690 align:middle line:84% Let's denote kind of the randomness 01:28:07.690 --> 01:28:13.240 align:middle line:90% that he used in Sumcheck by a-- 01:28:13.240 --> 01:28:14.950 align:middle line:90% so we started with i. 01:28:14.950 --> 01:28:18.640 align:middle line:84% Let's say that when we reached here, let's say, 01:28:18.640 --> 01:28:29.140 align:middle line:84% he needs to compute a add tilde on Zi plus 1, because we moved 01:28:29.140 --> 01:28:44.760 align:middle line:84% to layer i plus 1, 0 Zi plus 1, 1, Zi plus 1, 2 times Vi plus 1, 01:28:44.760 --> 01:28:45.550 align:middle line:90% and another-- 01:28:45.550 --> 01:28:46.990 align:middle line:90% and so that was one. 01:28:46.990 --> 01:28:50.110 align:middle line:90% So Z-- don't like this notation. 01:28:50.110 --> 01:28:50.610 align:middle line:90% Sorry. 01:28:50.610 --> 01:28:51.610 align:middle line:90% Let me change it. 01:28:51.610 --> 01:28:54.610 align:middle line:90% 01:28:54.610 --> 01:28:56.830 align:middle line:84% It's more cumbersome on the board than in the-- 01:28:56.830 --> 01:28:57.490 align:middle line:90% OK. 01:28:57.490 --> 01:28:59.780 align:middle line:90% Let me call Z0, Z1, Z2. 01:28:59.780 --> 01:29:01.960 align:middle line:84% So suppose they do a Sumcheck protocol. 01:29:01.960 --> 01:29:05.010 align:middle line:84% In the Sumcheck, it's on three n variables. 01:29:05.010 --> 01:29:07.320 align:middle line:84% So let's denote the randomness used 01:29:07.320 --> 01:29:10.690 align:middle line:84% by the verifier and the protocol by Z0, Z1, Z2. 01:29:10.690 --> 01:29:13.093 align:middle line:90% Each of them is in f to the n. 01:29:13.093 --> 01:29:16.480 align:middle line:90% 01:29:16.480 --> 01:29:19.900 align:middle line:84% So now the verifier needs to compute this function 01:29:19.900 --> 01:29:21.970 align:middle line:90% and the points Z0, Z1, Z2. 01:29:21.970 --> 01:29:23.720 align:middle line:84% What is this function at this point? 01:29:23.720 --> 01:29:32.000 align:middle line:84% It's add times Vi plus 1 tilde on Z1 plus Vi 01:29:32.000 --> 01:29:46.230 align:middle line:84% plus 1 tilde on Z2 plus mult Z0, Z1, Z2 times Vi 01:29:46.230 --> 01:29:53.010 align:middle line:84% plus 1 Z1 tilde times Vi plus 1 Z2 tilde, 01:29:53.010 --> 01:30:02.210 align:middle line:84% and then all this times this chi. 01:30:02.210 --> 01:30:08.440 align:middle line:84% I'll put it here, chi p of Z of-- oh, oops. 01:30:08.440 --> 01:30:12.420 align:middle line:90% 01:30:12.420 --> 01:30:15.120 align:middle line:90% Sorry, I messed this notation. 01:30:15.120 --> 01:30:16.530 align:middle line:90% This is the Zi. 01:30:16.530 --> 01:30:23.520 align:middle line:90% OK, sorry. 01:30:23.520 --> 01:30:26.410 align:middle line:84% Zi is the original point that we started with. 01:30:26.410 --> 01:30:30.610 align:middle line:84% We started a claim about Vi equals Vi tilde of Zi. 01:30:30.610 --> 01:30:33.930 align:middle line:84% Zi is a fixed point that we started with. 01:30:33.930 --> 01:30:37.140 align:middle line:84% The randomness of the verifier in the subject 01:30:37.140 --> 01:30:39.940 align:middle line:90% protocol I denote by Z0 Z1, Z2. 01:30:39.940 --> 01:30:41.500 align:middle line:84% These are chosen by the verifier. 01:30:41.500 --> 01:30:42.320 align:middle line:90% Yes, Vinod? 01:30:42.320 --> 01:30:43.860 align:middle line:84% STUDENT: The V should be Z0, right? 01:30:43.860 --> 01:30:44.710 align:middle line:90% [INAUDIBLE] 01:30:44.710 --> 01:30:45.440 align:middle line:90% YAEL KALAI: B? 01:30:45.440 --> 01:30:48.707 align:middle line:90% STUDENT: [INAUDIBLE] 01:30:48.707 --> 01:30:49.790 align:middle line:90% YAEL KALAI: Yeah, exactly. 01:30:49.790 --> 01:30:50.708 align:middle line:90% But I'm in layer i. 01:30:50.708 --> 01:30:51.250 align:middle line:90% You're right. 01:30:51.250 --> 01:30:53.070 align:middle line:90% In layer 0, it's just Z0. 01:30:53.070 --> 01:30:54.070 align:middle line:90% STUDENT: No, no, no, no. 01:30:54.070 --> 01:30:58.160 align:middle line:84% The V, the V, you replace it with Z0 in this notation. 01:30:58.160 --> 01:30:58.872 align:middle line:90% [INAUDIBLE] 01:30:58.872 --> 01:31:00.039 align:middle line:90% YAEL KALAI: Oh, I replaced-- 01:31:00.039 --> 01:31:03.530 align:middle line:84% STUDENT: [INAUDIBLE] so P is Z0, w1 is Z1. 01:31:03.530 --> 01:31:04.660 align:middle line:90% Right? 01:31:04.660 --> 01:31:07.105 align:middle line:90% YAEL KALAI: Yes. 01:31:07.105 --> 01:31:07.605 align:middle line:90% Yes. 01:31:07.605 --> 01:31:12.736 align:middle line:90% 01:31:12.736 --> 01:31:13.670 align:middle line:90% STUDENT: [INAUDIBLE] 01:31:13.670 --> 01:31:14.337 align:middle line:90% YAEL KALAI: Yes. 01:31:14.337 --> 01:31:14.940 align:middle line:90% Yes, yes, yes. 01:31:14.940 --> 01:31:16.190 align:middle line:90% Through the name you're right. 01:31:16.190 --> 01:31:16.750 align:middle line:90% Yes. 01:31:16.750 --> 01:31:19.330 align:middle line:90% Yes. 01:31:19.330 --> 01:31:20.190 align:middle line:90% Z0, yes. 01:31:20.190 --> 01:31:21.000 align:middle line:90% Yes, you're right. 01:31:21.000 --> 01:31:21.710 align:middle line:90% You're right. 01:31:21.710 --> 01:31:25.500 align:middle line:84% You're right, and this is still a low-degree polynomial in Z0. 01:31:25.500 --> 01:31:26.220 align:middle line:90% Good point. 01:31:26.220 --> 01:31:30.230 align:middle line:84% It's sitting-- yeah, maybe I erased it, but this. 01:31:30.230 --> 01:31:32.220 align:middle line:90% No, but I didn't write this. 01:31:32.220 --> 01:31:34.247 align:middle line:84% STUDENT: We need it though below the-- 01:31:34.247 --> 01:31:35.205 align:middle line:90% YAEL KALAI: Below here? 01:31:35.205 --> 01:31:37.730 align:middle line:90% 01:31:37.730 --> 01:31:40.880 align:middle line:90% No, but I need to write-- 01:31:40.880 --> 01:31:48.173 align:middle line:90% it's like this is xi minus-- 01:31:48.173 --> 01:32:00.130 align:middle line:90% 01:32:00.130 --> 01:32:00.680 align:middle line:90% I think. 01:32:00.680 --> 01:32:01.240 align:middle line:90% Yes. 01:32:01.240 --> 01:32:06.700 align:middle line:84% So it's-- oh, maybe I need to take extension of this. 01:32:06.700 --> 01:32:07.660 align:middle line:90% Sorry, one second. 01:32:07.660 --> 01:32:11.700 align:middle line:90% This is-- hold on. 01:32:11.700 --> 01:32:12.340 align:middle line:90% Sorry. 01:32:12.340 --> 01:32:13.320 align:middle line:90% Maybe I missed this. 01:32:13.320 --> 01:32:15.970 align:middle line:84% Let me think because I missed in the notes. 01:32:15.970 --> 01:32:16.690 align:middle line:90% So hold on. 01:32:16.690 --> 01:32:31.360 align:middle line:84% So here the point is H. I think I need to take extension of this 01:32:31.360 --> 01:32:39.720 align:middle line:84% too, because the point here, this is not a polynomial in H. 01:32:39.720 --> 01:32:41.510 align:middle line:90% OK, so let's do that carefully. 01:32:41.510 --> 01:32:42.670 align:middle line:90% Sorry, I missed that. 01:32:42.670 --> 01:32:46.590 align:middle line:84% So chi is a low-degree polynomial, 01:32:46.590 --> 01:32:49.340 align:middle line:84% but it's a low-degree polynomial in x. 01:32:49.340 --> 01:32:52.850 align:middle line:84% It's not a low-degree polynomial in this H. H here 01:32:52.850 --> 01:32:57.800 align:middle line:84% is in the denominator, so it's not a low-degree polynomial 01:32:57.800 --> 01:33:00.585 align:middle line:90% in H, sadly. 01:33:00.585 --> 01:33:03.200 align:middle line:90% 01:33:03.200 --> 01:33:05.840 align:middle line:90% But you can extend, so it's OK. 01:33:05.840 --> 01:33:06.550 align:middle line:90% Don't worry. 01:33:06.550 --> 01:33:08.050 align:middle line:84% So it's not a low-degree polynomial. 01:33:08.050 --> 01:33:09.930 align:middle line:90% However, it is in-- 01:33:09.930 --> 01:33:24.270 align:middle line:84% all we care about is, if we think of it as a function of Z0 01:33:24.270 --> 01:33:27.120 align:middle line:90% of p, then we just extend. 01:33:27.120 --> 01:33:36.410 align:middle line:84% We can-- I just want to make sure 01:33:36.410 --> 01:33:38.660 align:middle line:84% that I'm not missing something, so hold on one second. 01:33:38.660 --> 01:33:46.390 align:middle line:90% 01:33:46.390 --> 01:33:48.710 align:middle line:90% Yeah. 01:33:48.710 --> 01:33:49.230 align:middle line:90% OK. 01:33:49.230 --> 01:33:49.730 align:middle line:90% Yeah. 01:33:49.730 --> 01:33:52.770 align:middle line:84% So the way to think about this-- sorry about that. 01:33:52.770 --> 01:33:55.100 align:middle line:84% The way to think about it is to think 01:33:55.100 --> 01:34:00.460 align:middle line:90% of this as chi of P and Zi. 01:34:00.460 --> 01:34:03.440 align:middle line:90% It's low degree in this. 01:34:03.440 --> 01:34:05.480 align:middle line:90% It's not low degree in this. 01:34:05.480 --> 01:34:08.190 align:middle line:84% But you can think about it-- it's in 0,1. 01:34:08.190 --> 01:34:11.070 align:middle line:90% You can think of Chi as 0-- 01:34:11.070 --> 01:34:11.570 align:middle line:90% sorry. 01:34:11.570 --> 01:34:17.000 align:middle line:84% You can think of chi as being in H to the m times 01:34:17.000 --> 01:34:20.108 align:middle line:90% f to the m to whatever to-- 01:34:20.108 --> 01:34:30.570 align:middle line:90% 01:34:30.570 --> 01:34:41.350 align:middle line:90% STUDENT: [INAUDIBLE] 01:34:41.350 --> 01:34:43.450 align:middle line:84% YAEL KALAI: I'm not sure how to, because-- 01:34:43.450 --> 01:34:44.990 align:middle line:90% maybe, but I'm not sure. 01:34:44.990 --> 01:34:47.650 align:middle line:90% But there is, actually. 01:34:47.650 --> 01:34:50.050 align:middle line:84% The low-degree polynomial is one of them. 01:34:50.050 --> 01:34:52.810 align:middle line:90% So the answer is yes, there is. 01:34:52.810 --> 01:34:56.300 align:middle line:90% It's the low-degree-- yeah. 01:34:56.300 --> 01:34:58.930 align:middle line:84% So it's defined only on H. You can 01:34:58.930 --> 01:35:01.450 align:middle line:90% think of it as defined only-- 01:35:01.450 --> 01:35:03.740 align:middle line:90% this chi is an extension. 01:35:03.740 --> 01:35:06.310 align:middle line:84% This chi on its own is extension. 01:35:06.310 --> 01:35:07.490 align:middle line:90% What is this chi? 01:35:07.490 --> 01:35:09.890 align:middle line:90% This chi is a function. 01:35:09.890 --> 01:35:12.760 align:middle line:90% You can think-- OK, sorry. 01:35:12.760 --> 01:35:14.710 align:middle line:90% Let me write it differently. 01:35:14.710 --> 01:35:16.370 align:middle line:90% OK, let me fix this. 01:35:16.370 --> 01:35:19.270 align:middle line:90% Sorry about that. 01:35:19.270 --> 01:35:23.330 align:middle line:90% Instead of this, think of chi-- 01:35:23.330 --> 01:35:25.250 align:middle line:90% I'm just changing the notation-- 01:35:25.250 --> 01:35:30.573 align:middle line:84% H1 up to Hm Z, which is Z1 up to Zm. 01:35:30.573 --> 01:35:31.990 align:middle line:84% I don't want to put it down there. 01:35:31.990 --> 01:35:33.930 align:middle line:90% They're both here. 01:35:33.930 --> 01:35:39.383 align:middle line:90% And now-- actually, I don't. 01:35:39.383 --> 01:35:40.300 align:middle line:90% So what are we saying? 01:35:40.300 --> 01:35:44.380 align:middle line:84% We're saying, so this is the extension. 01:35:44.380 --> 01:35:45.750 align:middle line:90% So you're saying, what is chi? 01:35:45.750 --> 01:35:47.080 align:middle line:90% I'll tell you what Chi is. 01:35:47.080 --> 01:35:49.156 align:middle line:90% Chi is the extension-- 01:35:49.156 --> 01:35:51.790 align:middle line:90% 01:35:51.790 --> 01:35:53.335 align:middle line:90% OK, let me rewrite this. 01:35:53.335 --> 01:35:57.520 align:middle line:90% 01:35:57.520 --> 01:36:10.680 align:middle line:84% Chi H1 up to Hm, Z1 up to Zm is just 01:36:10.680 --> 01:36:14.880 align:middle line:90% multiplication of chi Hi, Zi. 01:36:14.880 --> 01:36:16.420 align:middle line:90% So it's exactly the same thing. 01:36:16.420 --> 01:36:19.390 align:middle line:84% I just don't want to put Hi on the bottom, like I did before. 01:36:19.390 --> 01:36:21.070 align:middle line:90% So let me put it as a variable. 01:36:21.070 --> 01:36:22.450 align:middle line:90% I didn't change anything. 01:36:22.450 --> 01:36:25.240 align:middle line:84% And now this original-- what is this? 01:36:25.240 --> 01:36:28.870 align:middle line:84% This is the low-degree extension of the function. 01:36:28.870 --> 01:36:32.260 align:middle line:84% Let me first define chi and H to the 2m. 01:36:32.260 --> 01:36:35.220 align:middle line:84% So chi is such that an H to the 2m, 01:36:35.220 --> 01:36:43.530 align:middle line:84% so for every Hi or for every H and Z in H to the m, 01:36:43.530 --> 01:36:50.460 align:middle line:84% chi HZ is equal to 1 if and only if H is equal to Z. 01:36:50.460 --> 01:36:53.370 align:middle line:84% I only define an H to the m, now extended. 01:36:53.370 --> 01:36:57.340 align:middle line:84% That's how we define chi, the unique low-degree extension. 01:36:57.340 --> 01:36:58.870 align:middle line:90% What is exactly the extension? 01:36:58.870 --> 01:37:01.100 align:middle line:84% Yeah, it's this multiplication, blah, blah, blah. 01:37:01.100 --> 01:37:03.790 align:middle line:90% I don't want to go into it. 01:37:03.790 --> 01:37:05.560 align:middle line:84% But it's just a unique extension. 01:37:05.560 --> 01:37:09.210 align:middle line:90% 01:37:09.210 --> 01:37:11.030 align:middle line:90% So now with that-- 01:37:11.030 --> 01:37:14.320 align:middle line:90% 01:37:14.320 --> 01:37:17.920 align:middle line:84% and the reason there is a unique-- 01:37:17.920 --> 01:37:22.710 align:middle line:84% actually, I should say, this is kind of chi 1. 01:37:22.710 --> 01:37:25.320 align:middle line:90% 01:37:25.320 --> 01:37:27.670 align:middle line:84% And the reason there is a unique extension-- 01:37:27.670 --> 01:37:29.541 align:middle line:90% this is kind of H1, Hi, Zi. 01:37:29.541 --> 01:37:32.510 align:middle line:90% 01:37:32.510 --> 01:37:34.260 align:middle line:84% And the reason there is a unique exception 01:37:34.260 --> 01:37:37.440 align:middle line:84% is from the Lagrange interpolation theorem. 01:37:37.440 --> 01:37:41.100 align:middle line:84% So it's just a multiplication of the unique kind of Lagrange 01:37:41.100 --> 01:37:42.590 align:middle line:90% interpolation extensions. 01:37:42.590 --> 01:37:44.800 align:middle line:84% So all I did here-- so sorry about this, 01:37:44.800 --> 01:37:48.240 align:middle line:84% but all I did here is I changed the notation from the H 01:37:48.240 --> 01:37:50.590 align:middle line:84% kind of as a subscript to H as input. 01:37:50.590 --> 01:37:53.830 align:middle line:84% And now I'm treating them both symmetrically, 01:37:53.830 --> 01:37:55.480 align:middle line:84% which was important because otherwise. 01:37:55.480 --> 01:37:56.560 align:middle line:90% So thank you. 01:37:56.560 --> 01:37:57.725 align:middle line:90% Wow, you guys are great. 01:37:57.725 --> 01:38:00.940 align:middle line:90% 01:38:00.940 --> 01:38:04.650 align:middle line:84% So now let's fix the mistake here. 01:38:04.650 --> 01:38:11.510 align:middle line:90% So this is chi of P and Zi. 01:38:11.510 --> 01:38:14.940 align:middle line:90% 01:38:14.940 --> 01:38:17.080 align:middle line:84% We're summing over P, but Zi is an input. 01:38:17.080 --> 01:38:18.630 align:middle line:84% That's the input we started with. 01:38:18.630 --> 01:38:20.130 align:middle line:90% That's the claim. 01:38:20.130 --> 01:38:21.660 align:middle line:90% Good. 01:38:21.660 --> 01:38:25.990 align:middle line:84% But for me, chi is a low-degree polynomial already. 01:38:25.990 --> 01:38:32.430 align:middle line:84% So this is just chi of Z0 and Xi. 01:38:32.430 --> 01:38:34.780 align:middle line:90% Thank you. 01:38:34.780 --> 01:38:35.380 align:middle line:90% Yeah. 01:38:35.380 --> 01:38:37.297 align:middle line:84% STUDENT: I guess what I still don't understand 01:38:37.297 --> 01:38:41.580 align:middle line:84% is isn't chi not a polynomial in the first variable since-- 01:38:41.580 --> 01:38:43.692 align:middle line:90% YAEL KALAI: Why? 01:38:43.692 --> 01:38:45.150 align:middle line:84% STUDENT: So the definition for chi, 01:38:45.150 --> 01:38:46.908 align:middle line:84% doesn't it only appear in the denominator? 01:38:46.908 --> 01:38:49.200 align:middle line:84% YAEL KALAI: OK, so let's look at the definition of chi. 01:38:49.200 --> 01:38:51.960 align:middle line:84% The definition of chi and m variables 01:38:51.960 --> 01:38:55.140 align:middle line:84% is just-- so chi takes two variables. 01:38:55.140 --> 01:38:58.360 align:middle line:84% The definition of 2m variables, just the multiplication, 01:38:58.360 --> 01:39:02.970 align:middle line:84% i goes from 1 to m of a chi 1 on Hi and Zi. 01:39:02.970 --> 01:39:06.710 align:middle line:84% So now I need to define what is chi 1. 01:39:06.710 --> 01:39:09.530 align:middle line:84% Oh, you're saying it's two variables. 01:39:09.530 --> 01:39:11.650 align:middle line:84% You're saying it's not one variable. 01:39:11.650 --> 01:39:14.830 align:middle line:84% STUDENT: Or rather more like in chi 1, 01:39:14.830 --> 01:39:18.360 align:middle line:90% isn't it not a polynomial in Hi? 01:39:18.360 --> 01:39:19.610 align:middle line:90% YAEL KALAI: It's a polynomial? 01:39:19.610 --> 01:39:24.530 align:middle line:84% No, I only think of it as a polynomial in Hi and Zi. 01:39:24.530 --> 01:39:25.877 align:middle line:90% Chi-- sorry. 01:39:25.877 --> 01:39:27.710 align:middle line:84% OK, maybe I didn't understand your question. 01:39:27.710 --> 01:39:30.850 align:middle line:84% Chi 1 is a two-variate polynomial. 01:39:30.850 --> 01:39:31.760 align:middle line:90% It has two variables. 01:39:31.760 --> 01:39:32.427 align:middle line:90% So you're right. 01:39:32.427 --> 01:39:36.280 align:middle line:84% It's two variables, not one, because I 01:39:36.280 --> 01:39:37.540 align:middle line:90% said it reduces to Lagrange. 01:39:37.540 --> 01:39:38.998 align:middle line:84% You're saying, no, Lagrange is one. 01:39:38.998 --> 01:39:41.050 align:middle line:90% I'm thinking it is 2. 01:39:41.050 --> 01:39:42.290 align:middle line:90% That's what you said, right? 01:39:42.290 --> 01:39:43.150 align:middle line:90% Or maybe I didn't-- 01:39:43.150 --> 01:39:44.650 align:middle line:84% STUDENT: I guess my question is more 01:39:44.650 --> 01:39:48.080 align:middle line:84% emphasizing, when you write out the definition for chi 1, 01:39:48.080 --> 01:39:51.730 align:middle line:84% are we going to get that it's not a polynomial in Hi? 01:39:51.730 --> 01:39:52.850 align:middle line:90% YAEL KALAI: No, it is. 01:39:52.850 --> 01:39:53.590 align:middle line:90% It is. 01:39:53.590 --> 01:39:54.877 align:middle line:90% So I want to-- 01:39:54.877 --> 01:39:56.960 align:middle line:84% STUDENT: Is it going to be a ratio of polynomials? 01:39:56.960 --> 01:39:58.085 align:middle line:90% YAEL KALAI: No, no, no, no. 01:39:58.085 --> 01:39:58.870 align:middle line:90% No, no, no, no. 01:39:58.870 --> 01:40:03.440 align:middle line:90% So what is exactly chi 1? 01:40:03.440 --> 01:40:06.440 align:middle line:84% How did it-- chi is well-defined. 01:40:06.440 --> 01:40:09.430 align:middle line:90% It's just a product of chi 1s. 01:40:09.430 --> 01:40:12.200 align:middle line:90% Now you can ask, what is chi 1? 01:40:12.200 --> 01:40:13.960 align:middle line:84% If you understand what chi 1 is, then you 01:40:13.960 --> 01:40:16.418 align:middle line:84% understand what chi is, because chi is just multiplication. 01:40:16.418 --> 01:40:17.390 align:middle line:90% What is chi 1? 01:40:17.390 --> 01:40:19.220 align:middle line:90% Chi 1 is a bivariate polynomial. 01:40:19.220 --> 01:40:23.950 align:middle line:90% It's defined over f 2m to f. 01:40:23.950 --> 01:40:26.000 align:middle line:84% And so now you're asking, how is it defined? 01:40:26.000 --> 01:40:28.370 align:middle line:84% Let me tell you how it's defined an H first. 01:40:28.370 --> 01:40:30.280 align:middle line:90% So if both of them-- 01:40:30.280 --> 01:40:31.710 align:middle line:90% first of all, it's a polynomial. 01:40:31.710 --> 01:40:32.960 align:middle line:90% It's a two-variate polynomial. 01:40:32.960 --> 01:40:34.690 align:middle line:84% So it's a polynomial and two variables, 01:40:34.690 --> 01:40:38.240 align:middle line:90% and both its degree H minus 1. 01:40:38.240 --> 01:40:42.390 align:middle line:84% Now you can say, how is it defined on H? 01:40:42.390 --> 01:40:44.060 align:middle line:90% On H, I'll tell you. 01:40:44.060 --> 01:40:46.808 align:middle line:84% It's 1 if and only if they're equal. 01:40:46.808 --> 01:40:48.350 align:middle line:84% That's how it's defined, 0 otherwise. 01:40:48.350 --> 01:40:50.480 align:middle line:90% So I defined it on H. 01:40:50.480 --> 01:40:53.480 align:middle line:84% Now you can ask, how do I define on f? 01:40:53.480 --> 01:40:58.280 align:middle line:84% So on f, I'm going to define it in the unique way that 01:40:58.280 --> 01:41:01.465 align:middle line:84% extends it on H. That's how it's going to be defined. 01:41:01.465 --> 01:41:05.980 align:middle line:90% 01:41:05.980 --> 01:41:09.640 align:middle line:84% So chi is a low-degree polynomial 01:41:09.640 --> 01:41:11.440 align:middle line:90% in each and every variable. 01:41:11.440 --> 01:41:15.160 align:middle line:84% Before, I wrote it only on Z. But that 01:41:15.160 --> 01:41:19.450 align:middle line:84% wasn't good because I need it also to be low degree on H. So-- 01:41:19.450 --> 01:41:20.403 align:middle line:90% yes, Vinod? 01:41:20.403 --> 01:41:21.820 align:middle line:84% STUDENT: Just the point, the point 01:41:21.820 --> 01:41:24.770 align:middle line:84% is that the way it was written down previously 01:41:24.770 --> 01:41:26.710 align:middle line:90% had H in the denominator. 01:41:26.710 --> 01:41:27.830 align:middle line:90% It's not a polynomial. 01:41:27.830 --> 01:41:28.170 align:middle line:90% YAEL KALAI: Exactly. 01:41:28.170 --> 01:41:29.962 align:middle line:84% STUDENT: [INAUDIBLE] it's not a polynomial. 01:41:29.962 --> 01:41:30.830 align:middle line:90% YAEL KALAI: Exactly. 01:41:30.830 --> 01:41:31.910 align:middle line:90% STUDENT: And this one is. 01:41:31.910 --> 01:41:34.245 align:middle line:90% 01:41:34.245 --> 01:41:34.870 align:middle line:90% YAEL KALAI: OK. 01:41:34.870 --> 01:41:36.040 align:middle line:90% So I write it-- 01:41:36.040 --> 01:41:39.440 align:middle line:84% what's important to me is that chi 1 is a polynomial. 01:41:39.440 --> 01:41:40.790 align:middle line:90% It's a two-variate polynomial. 01:41:40.790 --> 01:41:43.820 align:middle line:84% Both of them are degree H minus 1. 01:41:43.820 --> 01:41:46.300 align:middle line:90% So with that, if we believe-- 01:41:46.300 --> 01:41:47.990 align:middle line:90% yeah. 01:41:47.990 --> 01:41:49.782 align:middle line:84% STUDENT: If they're not equal, is it 0? 01:41:49.782 --> 01:41:50.490 align:middle line:90% YAEL KALAI: Yeah. 01:41:50.490 --> 01:41:51.500 align:middle line:90% Yeah, yeah, yeah, yeah. 01:41:51.500 --> 01:41:53.750 align:middle line:90% So if H and Z are equal, it's 1. 01:41:53.750 --> 01:41:55.090 align:middle line:90% If they're not equal, it's 0. 01:41:55.090 --> 01:41:57.480 align:middle line:90% Yes, great. 01:41:57.480 --> 01:41:58.200 align:middle line:90% Thank you. 01:41:58.200 --> 01:41:59.080 align:middle line:90% Thank you, guys. 01:41:59.080 --> 01:42:01.680 align:middle line:90% You're great. 01:42:01.680 --> 01:42:02.850 align:middle line:90% Fantastic. 01:42:02.850 --> 01:42:08.430 align:middle line:84% So now we reduce this big sum to this. 01:42:08.430 --> 01:42:13.322 align:middle line:84% Because we sum over the P, so the P becomes Z0, this. 01:42:13.322 --> 01:42:16.120 align:middle line:90% 01:42:16.120 --> 01:42:18.300 align:middle line:90% Wow, what's going on here? 01:42:18.300 --> 01:42:19.800 align:middle line:84% What is the verifier supposed to do? 01:42:19.800 --> 01:42:27.210 align:middle line:84% So before, he need to verify one little point in Vi tilde, 01:42:27.210 --> 01:42:29.000 align:middle line:84% and now he needs to verify this mess. 01:42:29.000 --> 01:42:35.930 align:middle line:90% 01:42:35.930 --> 01:42:39.150 align:middle line:90% But let's deconstruct. 01:42:39.150 --> 01:42:39.650 align:middle line:90% Yes. 01:42:39.650 --> 01:42:40.730 align:middle line:90% STUDENT: Sorry. 01:42:40.730 --> 01:42:45.100 align:middle line:84% Is the argument [INAUDIBLE] chi [INAUDIBLE] Z1 or Zi? 01:42:45.100 --> 01:42:46.810 align:middle line:90% YAEL KALAI: This is good. 01:42:46.810 --> 01:42:49.970 align:middle line:90% Sorry, this is Zi. 01:42:49.970 --> 01:42:51.870 align:middle line:84% This is the claim we started with. 01:42:51.870 --> 01:42:59.110 align:middle line:84% We started with a claim on layer i. 01:42:59.110 --> 01:43:01.070 align:middle line:84% You can think of i as 0 in the beginning. 01:43:01.070 --> 01:43:02.830 align:middle line:84% But we start with the claim that Vi 01:43:02.830 --> 01:43:06.700 align:middle line:84% is equal the low-degree extension 01:43:06.700 --> 01:43:08.830 align:middle line:90% of layer i in point Zi. 01:43:08.830 --> 01:43:11.960 align:middle line:90% This is the Zi here because-- 01:43:11.960 --> 01:43:13.130 align:middle line:90% why is it the Zi? 01:43:13.130 --> 01:43:13.790 align:middle line:90% Let's see. 01:43:13.790 --> 01:43:14.720 align:middle line:90% What did we say? 01:43:14.720 --> 01:43:18.820 align:middle line:84% We said that Vi, we need to argue that it's this. 01:43:18.820 --> 01:43:21.370 align:middle line:84% But this is just sum-- that's the definition 01:43:21.370 --> 01:43:24.670 align:middle line:84% of a low-degree extension, sum of the points times this. 01:43:24.670 --> 01:43:28.600 align:middle line:90% Let me change this to P Zi. 01:43:28.600 --> 01:43:29.737 align:middle line:90% The Zi I is fixed. 01:43:29.737 --> 01:43:30.320 align:middle line:90% This is fixed. 01:43:30.320 --> 01:43:33.460 align:middle line:90% This is from the claim. 01:43:33.460 --> 01:43:34.190 align:middle line:90% Good. 01:43:34.190 --> 01:43:38.560 align:middle line:84% Now we say let's sum over the P, so we sum over the P. The P 01:43:38.560 --> 01:43:39.170 align:middle line:90% is not fixed. 01:43:39.170 --> 01:43:40.180 align:middle line:90% It's summed over. 01:43:40.180 --> 01:43:43.390 align:middle line:84% And now we say, let's instead of this, let's sum 01:43:43.390 --> 01:43:46.340 align:middle line:84% over the two w's, which are the possible kids. 01:43:46.340 --> 01:43:48.565 align:middle line:90% All the possible pair of kids-- 01:43:48.565 --> 01:43:50.020 align:middle line:90% oh, I think I didn't say. 01:43:50.020 --> 01:43:53.980 align:middle line:84% I assume that C is fan in two, that each gate has 01:43:53.980 --> 01:43:54.820 align:middle line:90% only two children. 01:43:54.820 --> 01:43:56.680 align:middle line:84% And that's, again, with all this generality, 01:43:56.680 --> 01:44:01.000 align:middle line:84% you just increase the depth by log factor. 01:44:01.000 --> 01:44:07.180 align:middle line:84% So I'm assuming fan in two, so it's only two. 01:44:07.180 --> 01:44:13.510 align:middle line:84% Each gate has either an addition of two or multiplication of two. 01:44:13.510 --> 01:44:15.130 align:middle line:90% OK, so this is what we get. 01:44:15.130 --> 01:44:21.080 align:middle line:84% And now when we do the Sumcheck protocol, the P and the-- 01:44:21.080 --> 01:44:24.970 align:middle line:90% so we sum over P, w1 and w2. 01:44:24.970 --> 01:44:27.567 align:middle line:84% At the end of the day, we need to compute this polynomial. 01:44:27.567 --> 01:44:29.650 align:middle line:84% The verifier will need to compute this polynomial. 01:44:29.650 --> 01:44:35.200 align:middle line:84% Instead of over some fixed P w1, w2, it's over some-- 01:44:35.200 --> 01:44:40.583 align:middle line:84% I called it Z0, Z1, Z2 chosen by the verifier. 01:44:40.583 --> 01:44:42.500 align:middle line:84% That's kind of the randomness of the verifier. 01:44:42.500 --> 01:44:45.020 align:middle line:90% So P becomes Z0. 01:44:45.020 --> 01:44:48.150 align:middle line:90% w1 becomes Z1, and this is Z2. 01:44:48.150 --> 01:44:49.900 align:middle line:90% That's kind of the after. 01:44:49.900 --> 01:44:50.550 align:middle line:90% Yeah. 01:44:50.550 --> 01:44:52.217 align:middle line:84% STUDENT: I'm very confused because then, 01:44:52.217 --> 01:44:55.270 align:middle line:90% if i is equal to 1 [INAUDIBLE]? 01:44:55.270 --> 01:44:56.872 align:middle line:90% YAEL KALAI: I know, I know. 01:44:56.872 --> 01:44:58.330 align:middle line:84% STUDENT: So that's the different Z. 01:44:58.330 --> 01:44:59.372 align:middle line:90% YAEL KALAI: Yeah, I know. 01:44:59.372 --> 01:45:00.130 align:middle line:90% I'm so sorry. 01:45:00.130 --> 01:45:01.783 align:middle line:90% These are stars. 01:45:01.783 --> 01:45:03.700 align:middle line:84% STUDENT: OK, now, that makes a lot more sense. 01:45:03.700 --> 01:45:04.780 align:middle line:90% STUDENT: It's a constant. 01:45:04.780 --> 01:45:06.070 align:middle line:90% YAEL KALAI: It's a constant. 01:45:06.070 --> 01:45:07.680 align:middle line:90% Yeah, I know that. 01:45:07.680 --> 01:45:11.525 align:middle line:84% Sorry, that's a bad notation on my end. 01:45:11.525 --> 01:45:12.025 align:middle line:90% Yeah. 01:45:12.025 --> 01:45:15.190 align:middle line:90% 01:45:15.190 --> 01:45:17.200 align:middle line:84% This is a very, very different Z. 01:45:17.200 --> 01:45:20.410 align:middle line:84% It's like a totally different animal. 01:45:20.410 --> 01:45:24.110 align:middle line:84% These are random Z's chosen by the honest verifier. 01:45:24.110 --> 01:45:27.247 align:middle line:84% This is kind of, I don't know, a Z star 01:45:27.247 --> 01:45:28.455 align:middle line:90% that was fixed ahead of time. 01:45:28.455 --> 01:45:31.770 align:middle line:90% 01:45:31.770 --> 01:45:35.700 align:middle line:84% So now, the verifier needs to verify this. 01:45:35.700 --> 01:45:36.280 align:middle line:90% Yeah. 01:45:36.280 --> 01:45:39.210 align:middle line:90% STUDENT: [INAUDIBLE] is fixed. 01:45:39.210 --> 01:45:42.480 align:middle line:84% Can you just use the same chi [INAUDIBLE] 01:45:42.480 --> 01:45:44.968 align:middle line:84% before and put it in the subscript of the chi? 01:45:44.968 --> 01:45:47.010 align:middle line:84% So then you don't need the extension or whatever. 01:45:47.010 --> 01:45:50.500 align:middle line:84% You can just write it out [INAUDIBLE]. 01:45:50.500 --> 01:45:53.710 align:middle line:84% YAEL KALAI: The thing is that before, I assumed that the chi, 01:45:53.710 --> 01:45:57.280 align:middle line:84% when I fixed the H, it was an H to the m. 01:45:57.280 --> 01:45:58.760 align:middle line:90% This isn't the extension. 01:45:58.760 --> 01:46:00.610 align:middle line:84% It's not going to be an H to the m. 01:46:00.610 --> 01:46:05.320 align:middle line:84% So I think we should keep the two, yeah. 01:46:05.320 --> 01:46:10.720 align:middle line:90% But that's a good idea. 01:46:10.720 --> 01:46:12.250 align:middle line:90% OK, so what is this? 01:46:12.250 --> 01:46:14.757 align:middle line:84% So it seems like we had something that looked really 01:46:14.757 --> 01:46:16.840 align:middle line:84% kind of reasonable, and we ended up with something 01:46:16.840 --> 01:46:18.050 align:middle line:90% that's horrifying. 01:46:18.050 --> 01:46:21.550 align:middle line:84% So what does the verifier do now? 01:46:21.550 --> 01:46:23.500 align:middle line:84% Now the verifier is like, I just need 01:46:23.500 --> 01:46:27.000 align:middle line:84% to verify that this equals some value that we got out 01:46:27.000 --> 01:46:28.250 align:middle line:90% of the Sumcheck protocol. 01:46:28.250 --> 01:46:31.913 align:middle line:84% So we did the Sumcheck protocol, we got some value, whatever. 01:46:31.913 --> 01:46:33.080 align:middle line:90% I don't know what to denote. 01:46:33.080 --> 01:46:34.497 align:middle line:84% I'm now scared to denote anything. 01:46:34.497 --> 01:46:35.900 align:middle line:90% So this equals something. 01:46:35.900 --> 01:46:37.192 align:middle line:90% Now, what is he supposed to do? 01:46:37.192 --> 01:46:39.330 align:middle line:90% He's supposed to verify that. 01:46:39.330 --> 01:46:41.030 align:middle line:90% What do you do? 01:46:41.030 --> 01:46:44.780 align:middle line:84% So here is the idea, and then we'll take a break. 01:46:44.780 --> 01:46:47.280 align:middle line:84% So he needs to verify a lot of things. 01:46:47.280 --> 01:46:50.760 align:middle line:84% First, he needs to compute this add tilde and mult tilde. 01:46:50.760 --> 01:46:52.480 align:middle line:84% This goes back to your question now. 01:46:52.480 --> 01:46:55.443 align:middle line:84% Add tilde, these are a function of the circuit. 01:46:55.443 --> 01:46:56.610 align:middle line:90% He doesn't have the circuit. 01:46:56.610 --> 01:47:00.440 align:middle line:84% How does he compute these add tilde and mult tilde? 01:47:00.440 --> 01:47:04.610 align:middle line:84% Turns out, actually, this is sad news. 01:47:04.610 --> 01:47:06.160 align:middle line:90% He actually can't compute. 01:47:06.160 --> 01:47:07.630 align:middle line:90% We don't know how to compute. 01:47:07.630 --> 01:47:10.580 align:middle line:84% He doesn't know how to compute add tilde and mult tilde. 01:47:10.580 --> 01:47:13.180 align:middle line:90% 01:47:13.180 --> 01:47:17.200 align:middle line:84% Even if he gets this kind of uniform description 01:47:17.200 --> 01:47:21.020 align:middle line:84% of the Turing machine that generates the circuit, 01:47:21.020 --> 01:47:23.390 align:middle line:90% he can't compute them. 01:47:23.390 --> 01:47:24.900 align:middle line:90% Let's deal with that later. 01:47:24.900 --> 01:47:26.600 align:middle line:90% Suppose he has oracle access. 01:47:26.600 --> 01:47:29.630 align:middle line:84% Suppose someone-- there's a trusted oracle 01:47:29.630 --> 01:47:33.020 align:middle line:84% that lets him compute these values for now. 01:47:33.020 --> 01:47:36.540 align:middle line:84% In the paper, it's called the bare bones protocol. 01:47:36.540 --> 01:47:38.390 align:middle line:84% So suppose somehow, magically he has 01:47:38.390 --> 01:47:40.380 align:middle line:84% a trusted oracle, but only to compute 01:47:40.380 --> 01:47:41.660 align:middle line:90% add tilde and mult tilde. 01:47:41.660 --> 01:47:43.950 align:middle line:84% Note, these are only functions of the circuit. 01:47:43.950 --> 01:47:47.780 align:middle line:84% They have nothing to do with the claim of the prover. 01:47:47.780 --> 01:47:49.830 align:middle line:84% It's just information about the circuit. 01:47:49.830 --> 01:47:51.215 align:middle line:90% It's whether kind of-- 01:47:51.215 --> 01:47:54.620 align:middle line:90% 01:47:54.620 --> 01:47:57.500 align:middle line:84% not in the extension, it's whether this gate 01:47:57.500 --> 01:48:00.500 align:middle line:84% is connected by an AND to these two gates, yes or no, 01:48:00.500 --> 01:48:03.870 align:middle line:84% or by a multiplication to these two gates, yes or no. 01:48:03.870 --> 01:48:05.910 align:middle line:84% So it's not enough for him to compute that. 01:48:05.910 --> 01:48:08.310 align:middle line:84% He needs to compute the low-degree extension of that. 01:48:08.310 --> 01:48:10.102 align:middle line:84% But this has nothing to do with the prover. 01:48:10.102 --> 01:48:12.660 align:middle line:84% This is just a function of the circuit. 01:48:12.660 --> 01:48:14.700 align:middle line:84% So suppose first-- so first, we're 01:48:14.700 --> 01:48:18.220 align:middle line:84% going to assume this is not without loss of generality. 01:48:18.220 --> 01:48:20.220 align:middle line:84% But just for simplicity, we're going 01:48:20.220 --> 01:48:24.935 align:middle line:90% to assume that we can compute. 01:48:24.935 --> 01:48:29.296 align:middle line:90% 01:48:29.296 --> 01:48:30.767 align:middle line:90% add tilde and mult tilde. 01:48:30.767 --> 01:48:36.611 align:middle line:90% 01:48:36.611 --> 01:48:39.277 align:middle line:90% Suppose he can. 01:48:39.277 --> 01:48:40.860 align:middle line:84% Actually, what we're going to do today 01:48:40.860 --> 01:48:43.200 align:middle line:84% is we're going to show the entire GKR protocol, 01:48:43.200 --> 01:48:45.820 align:middle line:90% assuming you can compute this. 01:48:45.820 --> 01:48:47.410 align:middle line:84% And then only next time, we're going 01:48:47.410 --> 01:48:49.120 align:middle line:84% to show how to compute this thing. 01:48:49.120 --> 01:48:53.570 align:middle line:84% And actually, there's-- we're going to show that next time. 01:48:53.570 --> 01:48:55.600 align:middle line:84% How can we help them compute it or how can we 01:48:55.600 --> 01:48:59.408 align:middle line:84% compute in a different-- how can we deal with this issue? 01:48:59.408 --> 01:49:01.200 align:middle line:84% But for now, let's say he can compute this. 01:49:01.200 --> 01:49:04.720 align:middle line:90% 01:49:04.720 --> 01:49:06.350 align:middle line:84% So the verifier is like, OK, let's see. 01:49:06.350 --> 01:49:07.680 align:middle line:90% This I can definitely compute. 01:49:07.680 --> 01:49:08.970 align:middle line:90% That's easy. 01:49:08.970 --> 01:49:10.950 align:middle line:84% So the verifier can compute this. 01:49:10.950 --> 01:49:13.570 align:middle line:90% He can compute this. 01:49:13.570 --> 01:49:16.120 align:middle line:90% He can compute this. 01:49:16.120 --> 01:49:17.530 align:middle line:90% And what does he's left? 01:49:17.530 --> 01:49:21.400 align:middle line:84% He's left with two things he can't compute, 01:49:21.400 --> 01:49:23.830 align:middle line:90% V tilde and i plus 1-- 01:49:23.830 --> 01:49:27.810 align:middle line:84% V tilde and i plus 1, and point Z1 and Z2. 01:49:27.810 --> 01:49:30.880 align:middle line:90% So now, how do we continue? 01:49:30.880 --> 01:49:32.680 align:middle line:84% What we're going to say is the following. 01:49:32.680 --> 01:49:38.200 align:middle line:84% Suppose in this sum he was cheated, namely the Vi value, 01:49:38.200 --> 01:49:41.470 align:middle line:90% Vi star is not correct. 01:49:41.470 --> 01:49:43.660 align:middle line:84% By the Sumcheck protocol, it means 01:49:43.660 --> 01:49:46.060 align:middle line:84% that this entire value is also not 01:49:46.060 --> 01:49:48.398 align:middle line:84% correct with very high probability. 01:49:48.398 --> 01:49:49.940 align:middle line:84% I mean, the probability depends on f. 01:49:49.940 --> 01:49:51.890 align:middle line:84% You'll take f large enough that it can 01:49:51.890 --> 01:49:53.590 align:middle line:90% be with very high probability. 01:49:53.590 --> 01:49:56.967 align:middle line:84% So you're left with a false claim. 01:49:56.967 --> 01:49:58.550 align:middle line:84% Now, what the verifier is going to do, 01:49:58.550 --> 01:50:00.883 align:middle line:84% the verifier is going to tell the prover, you know what? 01:50:00.883 --> 01:50:05.410 align:middle line:90% Tell me what these two-- 01:50:05.410 --> 01:50:07.660 align:middle line:84% you gave me something I don't know what to do with it. 01:50:07.660 --> 01:50:08.950 align:middle line:90% Tell me the values. 01:50:08.950 --> 01:50:15.050 align:middle line:84% You tell me the values of Vi plus 1 tilde and Z1 and Z2. 01:50:15.050 --> 01:50:18.290 align:middle line:84% So the verifier, the prover comes in, OK, sure. 01:50:18.290 --> 01:50:28.346 align:middle line:84% V tilde and i plus 1 and Z1 is Vi plus 1 star 1, 01:50:28.346 --> 01:50:33.050 align:middle line:90% and V tilde and Z2-- 01:50:33.050 --> 01:50:38.030 align:middle line:84% sorry, i plus 1, is V star i plus 1, 2. 01:50:38.030 --> 01:50:40.740 align:middle line:90% Here are the values. 01:50:40.740 --> 01:50:42.772 align:middle line:90% Now I'm the verifier. 01:50:42.772 --> 01:50:43.480 align:middle line:90% I'm the verifier. 01:50:43.480 --> 01:50:44.290 align:middle line:90% What do I do? 01:50:44.290 --> 01:50:44.860 align:middle line:90% I check. 01:50:44.860 --> 01:50:49.810 align:middle line:84% I check that add times the sum of these two values 01:50:49.810 --> 01:50:52.800 align:middle line:84% you gave me plus mult times the multiplication of these two 01:50:52.800 --> 01:50:56.270 align:middle line:84% values you gave me is equal what we got. 01:50:56.270 --> 01:51:00.150 align:middle line:84% Now, by the soundness of the Sumcheck protocol, 01:51:00.150 --> 01:51:02.070 align:middle line:90% we know what we got is false. 01:51:02.070 --> 01:51:04.380 align:middle line:90% It's not true. 01:51:04.380 --> 01:51:07.500 align:middle line:90% So the only way-- 01:51:07.500 --> 01:51:14.903 align:middle line:84% if the prover gives the correct thing, then he will fail. 01:51:14.903 --> 01:51:16.820 align:middle line:84% If you give the correct thing, I'll catch him. 01:51:16.820 --> 01:51:18.528 align:middle line:84% Because if he gives me the correct thing, 01:51:18.528 --> 01:51:21.240 align:middle line:90% I get the true value. 01:51:21.240 --> 01:51:25.100 align:middle line:84% But I'm going to check him against the false value. 01:51:25.100 --> 01:51:26.820 align:middle line:90% Again, what do we know? 01:51:26.820 --> 01:51:29.490 align:middle line:90% He started with a false Vi star. 01:51:29.490 --> 01:51:33.220 align:middle line:84% We did sum of such Sumcheck, we're left with a false-- 01:51:33.220 --> 01:51:35.430 align:middle line:84% we said that this is something false 01:51:35.430 --> 01:51:37.380 align:middle line:84% because the sum of the Sumcheck protocol 01:51:37.380 --> 01:51:39.520 align:middle line:84% says if you started with a sum that's false, 01:51:39.520 --> 01:51:41.880 align:middle line:84% you'll get a false claim about the f. 01:51:41.880 --> 01:51:44.740 align:middle line:84% So now I get that this thing is equal to some beta, 01:51:44.740 --> 01:51:47.700 align:middle line:90% but this beta is not true. 01:51:47.700 --> 01:51:50.920 align:middle line:84% So now I tell him, OK, I don't know how to compute this thing. 01:51:50.920 --> 01:51:56.160 align:middle line:84% Tell me what the two values in the low-degree extensions are. 01:51:56.160 --> 01:51:58.320 align:middle line:84% If you tell me this, assuming I compute 01:51:58.320 --> 01:52:00.760 align:middle line:84% this add tilde and mult tilde for now, 01:52:00.760 --> 01:52:02.780 align:middle line:90% then I compute this thing. 01:52:02.780 --> 01:52:04.700 align:middle line:84% Now, the important thing to note, 01:52:04.700 --> 01:52:10.150 align:middle line:84% that if this value was false, he must-- 01:52:10.150 --> 01:52:11.680 align:middle line:84% if he gives me the true values, I'm 01:52:11.680 --> 01:52:14.260 align:middle line:84% going to reject them because I'm going to compute this thing 01:52:14.260 --> 01:52:18.130 align:middle line:84% and check if it's what he claimed it is after the Sumcheck 01:52:18.130 --> 01:52:19.640 align:middle line:90% protocol. 01:52:19.640 --> 01:52:21.840 align:middle line:84% And because he claimed the false value, 01:52:21.840 --> 01:52:24.442 align:middle line:84% if he give me the true things, I'm going to reject him. 01:52:24.442 --> 01:52:26.150 align:middle line:84% So the only thing he can do if he doesn't 01:52:26.150 --> 01:52:28.400 align:middle line:84% want to be rejected off the bat is 01:52:28.400 --> 01:52:32.637 align:middle line:84% to give me one of them false, or both false. 01:52:32.637 --> 01:52:34.220 align:middle line:84% STUDENT: So he has to give two values. 01:52:34.220 --> 01:52:36.660 align:middle line:90% YAEL KALAI: Right. 01:52:36.660 --> 01:52:39.320 align:middle line:90% Exactly. 01:52:39.320 --> 01:52:40.010 align:middle line:90% So where are we? 01:52:40.010 --> 01:52:41.800 align:middle line:90% What did we do? 01:52:41.800 --> 01:52:47.010 align:middle line:84% After a lot of sweat, we started with a claim on layer i. 01:52:47.010 --> 01:52:49.900 align:middle line:84% We did manage to get down to layer i plus 1, 01:52:49.900 --> 01:52:51.260 align:middle line:90% as I promised you guys. 01:52:51.260 --> 01:52:52.610 align:middle line:90% Here's the price. 01:52:52.610 --> 01:52:54.690 align:middle line:84% First, miraculously, we assume he 01:52:54.690 --> 01:52:59.690 align:middle line:84% can compute add tilde and mult tilde on its own, Assumed Why? 01:52:59.690 --> 01:53:00.410 align:middle line:90% Whatever. 01:53:00.410 --> 01:53:05.720 align:middle line:84% Second, we went from one claim about layer i 01:53:05.720 --> 01:53:08.460 align:middle line:84% to two claims about layer i plus 1. 01:53:08.460 --> 01:53:10.828 align:middle line:84% That doesn't sound very reassuring. 01:53:10.828 --> 01:53:12.370 align:middle line:84% STUDENT: Isn't that where we started? 01:53:12.370 --> 01:53:14.070 align:middle line:90% STUDENT: Yeah. 01:53:14.070 --> 01:53:16.290 align:middle line:90% YAEL KALAI: Exactly. 01:53:16.290 --> 01:53:17.285 align:middle line:90% It's where we started. 01:53:17.285 --> 01:53:20.500 align:middle line:90% 01:53:20.500 --> 01:53:23.220 align:middle line:84% This is a great time for a break.