On IP = PSPACE and Theorems with Narrow Proofs

It has been shown that the class of languages with interactive proofs, IP, is exactly the class PSPACE. This surprising result elegantly places IP in the standard classification of feasible computations. Furthermore, the IP = PSPACE result reveals some very interesting and unsuspected properties of mathematical proofs. In this column we define the width of a proof in a formal system F and show that it is an intuitively satisfying and robust definition. Then, using the IP = PSPACE result, it is seen that the width of a proof (as opposed to the length) determines how quickly one can give overwhelming evidence that a theorem is provable without showing the full proof. 1 On Proofs and Interactive Proofs A mathematician has the most confidence in the truth of a theorem when he/she is given a complete proof of the theorem in a trusted formal system. Let F be such a formal system in which the correctness of a proof can be checked by a verifier in polynomial time. The class NP clearly captures all the theorems which have polynomially long proofs. The NP =? P question is the question about the quantitative computational difference between finding a proof of a theorem and checking the correctness of a given proof. Some years ago, theoretical computer scientists asked whether it is possible to give convincing evidence that a theorem is provable in F without showing a complete This research was supported in part by NSF Research Grant CCR 88-23053. Supported in part by an IBM Graduate Fellowship. Current Address: Department of Computer Science, University of Maryland, Baltimore County Campus, Baltimore, MD 21228, USA. Current Address: Max Plank Institut für Informatik, Im Stadtwald, W 6600 Saarbrücken, Germany. On leave from Department of Computer Science, New Mexico State University, Las Cruces, NM 88003, USA. proof. Clearly, if we do not give a complete proof to a verifier (that does not have the power or time to generate and check the proof), then we cannot expect the verifier to be completely convinced that the theorem is provable. This led to a very fascinating problem: how can a verifier be convinced with high probability that a given theorem is provable without seeing the whole proof? and how rapidly can this be done? This problem has been formulated and extensively studied in terms of interactive protocols [Gol89]. Informally, an interactive protocol consists of a Prover and a Verifier. The Prover is an all powerful Turing Machine (TM) and the Verifier is a TM which operates in time polynomial in the length of the input. In addition, the Verifier has a random source (e.g., a fair coin) not visible to the Prover. In the beginning of the interactive protocol the Prover and the Verifier receive the same input string. Then, the Prover tries to convince the Verifier, through a series of queries and answers, that the input string belongs to a given language. The Prover succeeds if the Verifier accepts with probability greater than 2/3. The probability is computed over all possible coin tosses made by the Verifier. However, the Verifier must guard against imposters masquerading as the real Prover. That is, the Verifier must not be convinced to accept a string not in the language with probability greater than 1/3—even if the Prover lies. Definition Let V be a probabilistic polynomial time TM and let P be an arbitrary TM. P and V share the same input tape and communicate via a communication tape. P and V form an interactive protocol for a language L if 1. x ∈ L =⇒ Prob[ P -V accepts x ] > 2/3. 2. x 6∈ L =⇒ ∀P , Prob[ P -V accepts x ] < 1/3. A language L is in IP if there exist P and V which form an interactive protocol for L. Clearly, IP contains all NP languages, because in polynomial time the Prover can give the Verifier the entire proof. In such a protocol, the Verifier cannot be fooled and never accepts a string not in the language. To illustrate how randomness can generalize the concept of a proof, we look at an interactive protocol for a language not known to be in NP. Consider GNI, the set of pairs of graphs that are not isomorphic. GNI is known to be in co-NP and believed not to be in NP. However, GNI does have an interactive protocol [GMW86]. For small graphs, the Verifier can easily determine if the two graphs are not isomorphic. For sufficiently large graphs, the Verifier solicits help from the Prover to show that Gi and Gj are not isomorphic, as follows: 1. The Verifier randomly selects Gi or Gj and a random permutation of the selected graph. This process is independently repeated n times, where n is the number of vertices in Gj. If the graphs do not have the same number of vertices, they are clearly not isomorphic. This sequence of n randomly chosen, randomly permuted graphs is sent to the Prover. Recall that the Prover has not seen the Verifier’s random bits. This assumption is not necessary, but simplifies the exposition. 2. The Verifier asks the Prover to determine, for each graph in the sequence, which graph, Gi or Gj , was the one selected. If the Prover answers all the queries correctly, then the Verifier accepts. Suppose the two original graphs are not isomorphic. Then, only one of the original graphs is isomorphic to the permuted graph. The Prover simply answers by picking that graph. If the graphs are isomorphic, then the Prover has at best a 2 chance of answering all n questions correctly. Thus, the Verifier cannot be fooled with high probability. Therefore, GNI ∈ IP. Note that GNI is believed to be incomplete for co-NP. So, the preceding discussion does not show that co-NP ⊆ IP. For a while, it was believed that co-NP is not contained in IP, because there are oracle worlds where co-NP 6⊆ IP [FS88]. In fact, the computational power of interactive protocols was not fully appreciated until Lund, Fortnow, Karloff and Nisan [LFKN90] showed that IP actually contains the entire Polynomial Hierarchy. This result then led Shamir [Sha90] to completely characterize IP by showing that IP = PSPACE. Babai, Fortnow and Lund [BFL90] characterized the computational power of multiprover interactive protocols MIP = NEXP. In both cases, it is interesting to see that interactive proof systems provide alternative definitions of classic complexity classes. Thus, they fit very nicely in the overall classification of feasible computations. Furthermore, both of these problems have contradictory relativizations [FS88]. That is, there exist oracles A and B such that IP = PSPACE and IP 6= PSPACE, and similarly for the multi-prover case. Thus, these results provide the first natural counterexamples to the belief that problems with contradictory relativizations are beyond our proof techniques. The IP = PSPACE result also provides a very dramatic counterexample to the already battered Random Oracle Hypothesis. In [HCRR90], we showed that ProbA[ IP A 6= PSPACE ] = 1. 2 On Theorems with Polynomially Wide Proofs In this section, we define the notion of the width of a proof of a theorem in a formal system. The notion of “formal system” goes back to Hilbert who wanted to develop a complete system to formalize all of mathematics. There are several equivalent ways