How to Delegate Computations: The Power of No-Signaling Proofs

1. How to Delegate Computations:The Power of No-Signaling Proofs Ran Raz (Weizmann Institute & IAS) Joint work with: Yael TaumanKalai Ron Rothblum

2. Delegation of Computation

3. Delegation of Computation: • Alice has • Alice needs to compute , where • is publicly known • Bob offers to compute for Alice • Alice sends to Bob • Bob sends to Alice

4. 1-Round Delegation Scheme for : • or • 1)Completeness: if is honest: • 2)Soundness: if: • 3)Running time of : • 4)Running time of :

5. Previous Work [GKR+KR]: • If is a logspace-uniform circuit of • size and depth : • 1-round delegation scheme s.t.: • Running time of : • Running time of : • (under exponential hardness assumptions)

6. Our Result: • If • 1-round delegation scheme s.t.: • Running time of : • Running time of : • (under exponential hardness assumptions)

7. Variants of Delegation Schemes: • 1-Round or Interactive • Computational or Statistical soundness: • 1-Round, Computational: This talk! • 1-Round, Statistical: Impossible! • Interactive, Computational: Solved! (with only 2-rounds) [Killian,Micali],(based on ) [BFL] • Interactive, Statistical: [GKR 08] • Many other works, under unfalsifiable assumptions, or with preprocessing.

8. The Approach of Aiello et al.

9. 2-Prover Interactive Proofs [BGKW]: • Proversclaim that • sends a query toandto • no communication between and • answers by • answers by • decides accept/reject by

10. MIP=NEXP (scaled down) [BFL+FL]: • ,2-provers MIP s.t.: • 1)Completeness: if are honest: • 2)Soundness:if: • 3)Running time of : • 4)Running time of : • 5) Communication:

11. [Aiello Bhatt OstrovskySivarama 00]: • MIP 1-Round Argument ?!? • MIP: • = FHE of (with different keys) • = FHEof

12. “Proof” of Soundness: • generatesand • decryptsto get • Ifwe are done • If then given , the answer • gives information on . Thus, if first key • is known, one can get information on • (without knowing the second key) • = FHE of (with different keys) • = FHEof

13. The “Proof” is Wrong [DLNNR 00]: • can depend on both as a function, • but not as a random variables • Example: • , • (where is a random bit) • Given , the random variables are independent • Given , the random variables are independent

14. No-Signaling Strategies: • , • (where is a shared random string): • Given , the random variables are independent • Given , the random variables are independent

15. No-Signaling Strategies for provers: • queries: , answers • , ( random string) • For every : Given , • ,, are independent • Soundness Against No-Signaling: • , if:

16. We Show (using [ABOS 00]): • MIP with no-signaling soundness • 1-Round Argument • (we need soundness for almost-no-signaling strategies) • Corollary: • Interactive Proof 1-Round Argument • (under exponential hardness assumptions) • Gives a simpler proof for [KR 09] • Challenge: Show stronger MIPs with • no-signaling soundness • = FHE of (with different keys) • = FHEof

17. No-Signaling Strategies

18. Entangled Strategies: • share entangled quantum state • gets , gets • measures , measures • answers , answers • Soundness Against Entangled Strategies: • , if: • [IV12, V13]:

19. Entangled vs. No-Signaling: • Entangled strategies are no-signaling • Signaling • information travels faster than light • Hence, no-signaling is likely to hold in • any future ultimate theory of physics • No-signaling soundness is likely to ensure • soundness in any future physical theory

20. MIPs with No-Signaling Soundness: • No-Sig cheating provers are powerful: • (by linear programing) • In particular, all known protocols for • are not sound for no-signaling • Example: Assume: checks • Let . Let . ( is random) • Thenalways accepts • (and the strategy is no-signaling)

21. Our Result: • If MIP s.t.: • Running time of : • Running time of : • Number of provers: • Communication: • Completeness: • Soundness: against no-sig strategies • (with negligible error) • (gives soundness against entangled provers)

22. Delegating Computation to the Martians:

23. Delegating Computation to the Martians: • Running time of provers: • Running time of : • Number of provers: • Number of provers: • Completeness: • Soundness: against no-sig strategies • (with negligible error)

24. Steps of the Proof

25. Step I: Switch to PCP:

26. PCP: • A proof for that can be • (probabilistically) verified by reading • a small number of its bits. proof is correct ) P(Vaccepts) = 1 ) P(V accepts) ≤ ε

27. No-Signaling PCPs: • For every subset of locations • s.t., distribution • If queries locations , the • answers are given by • Guarantee: if , then • agree on their intersection • Soundness Against No-Signaling: • , if:

28. Our Result: • PCP s.t.: • Running time of prover: • Running time of : • Number of queries: • Completeness: • Soundness: against no-sig strategies • with • (with negligible error)

29. Step I: Switch to PCP: • PCP with no-sig soundness implies MIP • with no-sig soundness. • with provers

30. Step II: Amplification Lemma: • If there exists a cheating no-sig PCP • that cheats our verifier with exp small • prob, then there exists a cheating no-sig • PCP that cheats (a slightly different • verifier) with prob close to 1

31. Step III: • Let be a circuit for . Let be • the outputs of all gates of . Our PCP • contains the low degree extension of • We “read” each by a procedure, as in • locally decodeable codes. Denote these • values by . Note that only of • can be defined simultaneously. • For every gate in the circuit, with parent • and children , we show that • satisfy the gate w.h.p.

32. Step IV: • If , the circuit is of width . So all • the variables in the same level of can be • defined simultaneously. We can work our way • up and prove that the output is computed • correctly w.h.p.

33. Thank You!