Probabilistic verification

1. Probabilistic verification Mario Szegedy, Rutgers www/cs.rutgers.edu/~szegedy/07540 Lecture 5

2. C= (n,k,d)q codes • n = Block length • k = Information length • d = Distance • k/n = Information rate • d/n = Distance rate • q = Alphabet size

3. Linear Codes • C = {x | xЄL} (L is a linear subspace of Fqn) • Δ(x,y) = Δ(x-z,y-z) • min Δ(0,x) = min Δ(x,y) x,y Є L • k = dimension of the message space = dim L • n = dimension of the whole space (in which the code words lie) • Generator matrix: {xG | x Є Fqk} • “Parity” check matrix: {y Є Fqn | yH = 0}

4. Reed-Solomon codes • The Reed–Solomon code is an error-correcting code that works by oversampling a polynomial constructed from the data. • C is a [n, k, n-k+1] code; in other words, it is a linear code of length n (over F) with dimensionk and minimum distance n-k+1.

5. Welch-Berlekamp decoding algorithm for RS codes • Length = n (n ≤ |F|) • Degree = k • # of errors =e We assume: k+2e < n. • Received code word = y • E = non-zero polynomial that is zero at the bad “bits” of y y E = B. deg E ≤ e deg B ≤ e + k NOTATION: • v = w (exc e) means “word v is the same as word w except at e places) • v = w (exc H) means “word v is the same as word w except on set H) We have P = y (exc Err), where P is the encoded word, and |Err| ≤ e. We can find E and B such that y E = B by solving a system of linear equations: E0 + E1fj + E2 fj2 + … + Ee fje = yjB0+ yjB1 fj + yjB2 fj2 + … + yjBefje+k (1 ≤ j≤ n)

6. Welch-Berlekamp decoding algorithm for RS codes Since P = y (exc Err), it follows that PE = yE = B (exc Err), But deg PE = k + e, and deg B = k + e, and since k+e < n–e, we have PE = B. Now we can easily recover P by simply dividing polynomial B by E.

7. Generalization of the WB algorithm • C is a general code (replacing RS) α.A * C is a subset of B β. dim A > e γ. d(B) > e δ. d(A) + d(C) ≥ n solve y a = b (we need β. for such non-zero a to exist) let c be the code word we are looking for ca = ya = b (exc Err) → ca = b, since ca Є B. → → b/a = c (exc zeros(a)) → b/a = c (exc n – d(A)) → we can recover c α.,γ. δ.

8. Multi-variate polynomials Two variate polynomial of multi-degree (2,2): General n variate polynomial: P(x1,x2,…,xn) = P(x) = Σαaα xα

9. Multi-degree deg y x3y5 x2y3 deg x Multi-degree (3,5)

10. Multi-degree deg y deg x General multi-degree pattern. Multi-degree polynomials of a fix pattern form a vector space over F.

11. Multi-degree deg y P → P + P deg x Under multiplication degree patterns add like vectors

12. Total degree d deg y leading terms total degree 5 deg x for each coeff vector αin P(x) we have Σiαi ≤ d

13. LEMMA: Let S be a subset of a field F, |S|=d+1 ≥ 1. Then any function from Sn to F has a unique extension to a multi-degree (d,…,d) polynomial. • PROOF: • there exists a low degree extension: • By linearity it is enough to show that any function that takes a single non-zero value has an extension. Assume the non-zero value is taken over (a1,a2,…,an). Then over S it can be expressed as: • const ∙ΠiΠs(xi- s) • s runs through S, but leaves outai

14. LEMMA: Let S be a subset of a field F, |S|=d+1 ≥ 1. Then any function from Sn to F has a unique extension to a multi-degree (d,…,d) polynomial. 2. The low degree extension is unique: Because of linearity it is enough to show that the identically zero function on Snhas a unique extension (which is the 0 polynomial). In 1 dimension this follows from the fact that a degree d polynomial cannot have more than d roots. Assume that we have proven the statement for d-1. → If we fix xi to any constant s in S, we get an identically zero polynomial. → Now fix all the other variables (anyhow), except xi, we get a polynomial taking zeros on all points of S. → All such uni-variate polynomial has to take zero everywhere. → P(x)=0.

15. (d+1)n-1 xi 0 d+1 All other variables

16. Zippel’s lemma • THEOREM(Schwartz-Zippel). Let • be a polynomial of degree d over a field, F. Let S be a finite subset of F and let be selected randomly from S. Then

17. PROOF: Induction on n. For n = 1, P can have at most d roots. This gives us the base case. Now, assume that the theorem holds for all polynomials in n − 1 variables. We can then consider P to be a polynomial in x1 by writing it as Since P is not identically 0, there is some i such that Pi is not identically 0. Take the largest such i. Then .

18. PROOF: Induction on n. For n = 1, P can have at most d roots. This gives us the base case. Now, assume that the theorem holds for all polynomials in n − 1 variables. We can then consider P to be a polynomial in x1 by writing it as Since P is not identically 0, there is some i such that Pi is not identically 0. Take the largest such i. Then . Now we randomly pick . from S. By the induction hypothesis,

19. PROOF: Induction on n. For n = 1, P can have at most d roots. This gives us the base case. Now, assume that the theorem holds for all polynomials in n − 1 variables. We can then consider P to be a polynomial in x1 by writing it as Since P is not identically 0, there is some i such that Pi is not identically 0. Take the largest such i. Then . Now we randomly pick . from S. By the induction hypothesis, If then is of degree i.

20. Event A: Event B:

21. Maximal number of zeros of a multi-degree (d,…,d) polynomial qn – (q – d)n Homework