how to delegate computations: the power of no-signaling proofs

How to Delegate Computations:The Power of No-Signaling Proofs

Ran Raz(Weizmann Institute & IAS)

Joint work with:Yael Tauman Kalai

Ron Rothblum

Delegation of Computation

Delegation of Computation:Alice has Alice needs to compute , where is publicly knownBob offers to compute for AliceAlice sends to BobBob sends to Alice

𝒙

𝒇 (𝒙)

1-Round Delegation Scheme for :

or 1) Completeness: if is honest:

2) Soundness: if:

3) Running time of : 4) Running time of :

𝑽 𝑷𝒙 ,𝒒

𝒃= 𝒇 (𝒙 ) ,𝒘

Previous Work [GKR+KR]:If is a logspace-uniform circuit

ofsize and depth :1-round delegation scheme s.t.:Running time of : Running time of : (under exponential hardness

assumptions)

Our Result:If 1-round delegation scheme s.t.:Running time of : Running time of : (under exponential hardness

assumptions)

Variants of Delegation Schemes:1-Round or InteractiveComputational or Statistical

soundness:

• 1-Round, Computational: This talk!

• 1-Round, Statistical: Impossible!• Interactive, Computational:

Solved! (with only 2-rounds) [Killian,Micali], (based on ) [BFL]

• Interactive, Statistical: [GKR 08]

• Many other works, under unfalsifiable assumptions, or with preprocessing.

The Approach of Aiello et al.

2-Prover Interactive Proofs [BGKW]:Provers claim that sends a query to and to no communication between

and answers by answers by decides accept/reject by

𝒒 𝒓𝑨 𝑩𝒂 𝒃

MIP=NEXP (scaled down) [BFL+FL]:, 2-provers MIP s.t.:1) Completeness: if are honest:

2) Soundness: if:

3) Running time of : 4) Running time of : 5) Communication:

𝒒 𝒓𝑨 𝑩𝒂 𝒃

[Aiello Bhatt Ostrovsky Sivarama 00]:MIP 1-Round Argument ?!?

MIP:

= FHE of (with different keys) = FHE of

𝒒 𝒓𝑨 𝑩

𝒂=𝑨(𝒒) 𝒃=𝑩(𝒓 )

𝑽 𝑷�̂� ,𝒓�̂� , �̂�

“Proof” of Soundness: generates and

decrypts to get

If we are doneIf then given , the answer gives information on . Thus, if first

keyis known, one can get information

on (without knowing the second key)

= FHE of (with different keys) = FHE of

𝑽 𝑷�̂� ,𝒓�̂� , �̂�

The “Proof” is Wrong [DLNNR 00]: can depend on both as a function,but not as a random variables

Example: , (where is a random bit)

Given , the random variables are independent

Given , the random variables are independent

No-Signaling Strategies:

, (where is a shared random

string):

Given , the random variables are independent

Given , the random variables are independent

𝒒 𝒓𝑨 𝑩𝒂 𝒃

No-Signaling Strategies for provers:queries: , answers , ( random string)

For every : Given ,,, are independent

Soundness Against No-Signaling:, if:

We Show (using [ABOS 00]):MIP with no-signaling

soundness 1-Round Argument (we need soundness for almost-no-signaling

strategies)

Corollary:Interactive Proof 1-Round Argument(under exponential hardness

assumptions)

Gives a simpler proof for [KR 09]

Challenge: Show stronger MIPs withno-signaling soundness

= FHE of (with different keys) = FHE of

No-Signaling Strategies

Entangled Strategies:

share entangled quantum state gets , gets measures , measures answers , answers Soundness Against Entangled Strategies:, if:

[IV12, V13]:

𝒒 𝒓𝑨 𝑩𝒂 𝒃

Entangled vs. No-Signaling:Entangled strategies are no-signaling

Signaling information travels faster than

light

Hence, no-signaling is likely to hold in

any future ultimate theory of physics

No-signaling soundness is likely to ensure

soundness in any future physical theory

𝒒 𝒓𝑨 𝑩𝒂 𝒃

MIPs with No-Signaling Soundness:No-Sig cheating provers are powerful:

(by linear programing)

In particular, all known protocols for

are not sound for no-signaling

Example: Assume: checks Let . Let . ( is random)Then always accepts (and the strategy is no-signaling)

Our Result:

If MIP s.t.:Running time of : Running time of : Number of provers: Communication: Completeness: Soundness: against no-sig

strategies (with negligible error)(gives soundness against entangled

provers)

Delegating Computation to the Martians:

Delegating Computation to the Martians:

Running time of provers: Running time of : Number of provers: Number of provers: Completeness: Soundness: against no-sig

strategies (with negligible error)

𝒒𝟏 . .𝒒𝒌

𝑷 𝟏 𝑷 𝒌

𝒂𝟏 𝒂𝒌

𝑷 𝟐……

Steps of the Proof

Step I: Switch to PCP:

PCP:

A proof for that can be(probabilistically) verified by

readinga small number of its bits.

proof is correct ) P(V accepts) = 1 ) P(V accepts) ≤ ε

No-Signaling PCPs:For every subset of locationss.t. , distribution If queries locations , theanswers are given by Guarantee: if , then agree on their intersection

Soundness Against No-Signaling:, if:

Our Result: PCP s.t.:Running time of prover: Running time of : Number of queries:Completeness: Soundness: against no-sig

strategies with (with negligible error)

Step I: Switch to PCP:PCP with no-sig soundness

implies MIPwith no-sig soundness. with provers

Step II: Amplification Lemma: If there exists a cheating no-sig

PCPthat cheats our verifier with exp

smallprob, then there exists a cheating

no-sig PCP that cheats (a slightly differentverifier) with prob close to 1

Step III: Let be a circuit for . Let bethe outputs of all gates of . Our PCP contains the low degree extension ofWe “read” each by a procedure, as inlocally decodeable codes. Denote thesevalues by . Note that only of can be defined simultaneously.For every gate in the circuit, with parent and children , we show that satisfy the gate w.h.p.

Step IV: If , the circuit is of width . So all the variables in the same level of can bedefined simultaneously. We can work our

wayup and prove that the output is computed correctly w.h.p.

Thank You!