how to delegate computations: the power of no-signaling proofs
DESCRIPTION
How to Delegate Computations: The Power of No-Signaling Proofs. Ran Raz (Weizmann Institute & IAS) J oint work with: Yael Tauman Kalai Ron Rothblum. Delegation of Computation. Delegation of Computation: Alice has Alice needs to compute , where is publicly known - PowerPoint PPT PresentationTRANSCRIPT
How to Delegate Computations:The Power of No-Signaling Proofs
Ran Raz(Weizmann Institute & IAS)
Joint work with:Yael Tauman Kalai
Ron Rothblum
Delegation of Computation
Delegation of Computation:Alice has Alice needs to compute , where is publicly knownBob offers to compute for AliceAlice sends to BobBob sends to Alice
𝒙𝒇 (𝒙)
1-Round Delegation Scheme for :
or 1) Completeness: if is honest:
2) Soundness: if:
3) Running time of : 4) Running time of :
𝑽 𝑷𝒙 ,𝒒
𝒃= 𝒇 (𝒙 ) ,𝒘
Previous Work [GKR+KR]:If is a logspace-uniform circuit
ofsize and depth :1-round delegation scheme s.t.:Running time of : Running time of : (under exponential hardness
assumptions)
Our Result:If 1-round delegation scheme s.t.:Running time of : Running time of : (under exponential hardness
assumptions)
Variants of Delegation Schemes:1-Round or InteractiveComputational or Statistical
soundness:• 1-Round, Computational: This
talk!• 1-Round, Statistical: Impossible!• Interactive, Computational:
Solved! (with only 2-rounds) [Killian,Micali], (based on ) [BFL]
• Interactive, Statistical: [GKR 08]
• Many other works, under unfalsifiable assumptions, or with preprocessing.
The Approach of Aiello et al.
2-Prover Interactive Proofs [BGKW]:Provers claim that sends a query to and to no communication between
and answers by answers by decides accept/reject by
𝒒 𝒓𝑨 𝑩𝒂 𝒃
MIP=NEXP (scaled down) [BFL+FL]:, 2-provers MIP s.t.:1) Completeness: if are honest:
2) Soundness: if:
3) Running time of : 4) Running time of : 5) Communication:
𝒒 𝒓𝑨 𝑩𝒂 𝒃
[Aiello Bhatt Ostrovsky Sivarama 00]:MIP 1-Round Argument ?!?
MIP:
= FHE of (with different keys) = FHE of
𝒒 𝒓𝑨 𝑩
𝒂=𝑨(𝒒) 𝒃=𝑩(𝒓 )
𝑽 𝑷�̂� ,𝒓�̂� , �̂�
No-Signaling Strategies:
, (where is a shared random
string):Given , the random variables
are independent Given , the random variables
are independent
𝒒 𝒓𝑨 𝑩𝒂 𝒃
No-Signaling Strategies for provers:queries: , answers , ( random string)For every : Given ,,, are independent Soundness Against No-Signaling:, if:
We Show (using [ABOS 00]):MIP with no-signaling
soundness 1-Round Argument (we need soundness for almost-no-signaling
strategies)
Corollary:Interactive Proof 1-Round Argument(under exponential hardness
assumptions)Gives a simpler proof for [KR 09]
Challenge: Show stronger MIPs withno-signaling soundness
= FHE of (with different keys) = FHE of
No-Signaling Strategies
Entangled Strategies:
share entangled quantum state gets , gets measures , measures answers , answers Soundness Against Entangled Strategies:, if:
[IV12, V13]:
𝒒 𝒓𝑨 𝑩𝒂 𝒃
Entangled vs. No-Signaling:Entangled strategies are no-signalingSignaling information travels faster than
lightHence, no-signaling is likely to hold
in any future ultimate theory of
physicsNo-signaling soundness is likely to
ensuresoundness in any future physical
theory
𝒒 𝒓𝑨 𝑩𝒂 𝒃
MIPs with No-Signaling Soundness:No-Sig cheating provers are powerful: (by linear programing)
In particular, all known protocols for
are not sound for no-signalingExample: Assume: checks Let . Let . ( is random)Then always accepts (and the strategy is no-signaling)
Our Result: If MIP s.t.:Running time of : Running time of : Number of provers: Communication: Completeness: Soundness: against no-sig
strategies (with negligible error)(gives soundness against entangled
provers)
Delegating Computation to the Martians:
Delegating Computation to the Martians:
Running time of provers: Running time of : Number of provers: Number of provers: Completeness: Soundness: against no-sig
strategies (with negligible error)
𝒒𝟏 . .𝒒𝒌
𝑷 𝟏 𝑷 𝒌𝒂𝟏 𝒂𝒌
𝑷 𝟐……
Steps of the Proof
Step I: Switch to PCP:
PCP:A proof for that can be(probabilistically) verified by
readinga small number of its bits.
proof is correct ) P(V accepts) = 1 ) P(V accepts) ≤ ε
No-Signaling PCPs:For every subset of locationss.t. , distribution If queries locations , theanswers are given by Guarantee: if , then agree on their intersectionSoundness Against No-Signaling:, if:
Our Result: PCP s.t.:Running time of prover: Running time of : Number of queries:Completeness: Soundness: against no-sig
strategies with (with negligible error)
Step I: Switch to PCP:PCP with no-sig soundness
implies MIPwith no-sig soundness. with provers
Step II: Amplification Lemma: If there exists a cheating no-sig
PCPthat cheats our verifier with exp
smallprob, then there exists a cheating
no-sig PCP that cheats (a slightly differentverifier) with prob close to 1
Step III: Let be a circuit for . Let bethe outputs of all gates of . Our PCP contains the low degree extension ofWe “read” each by a procedure, as inlocally decodeable codes. Denote thesevalues by . Note that only of can be defined simultaneously.For every gate in the circuit, with parent and children , we show that satisfy the gate w.h.p.
Step IV: If , the circuit is of width . So all the variables in the same level of can bedefined simultaneously. We can work our
wayup and prove that the output is computed correctly w.h.p.
Thank You!