On Zero Error Algorithms Having Oracle Access to ... - Semantic Scholar

On Zero Error Algorithms Having Oracle Access to One Query

∗

Venkatesan T. Chakaravarthy † IBM India Research Lab IIT-Campus, New Delhi 110016 India. Email: [email protected]

Jin-Yi Cai Computer Sciences Department University of Wisconsin Madison, WI 53706, USA. Tsinghua University Beijing, China. Email: [email protected]

January 5, 2006

Abstract It is known that Sp2 ⊆ ZPPNP [3]. The reverse direction of whether ZPPNP is contained in remains open. We show that if the zero-error algorithm is allowed to ask only one query to the NP oracle (for any input and random string), then it can be simulated in Sp2 . That is, we prove that ZPPNP[1] ⊆ Sp2 . Next we consider whether the above result can be improved as ZPPNP[1] ⊆ PNP and point out a difficulty in doing so. Via a simple proof, we observe that BPP ⊆ ZPPNP[1] (a result implicitly proven in some prior work). Thus, achieving the above improvement would imply BPP ⊆ PNP , settling a long standing open problem. We then argue that the above mentioned improvement canp be obtained for the next level of p the polynomial time hierarchy. Namely, we prove that ZPPΣ2 [1] ⊆ PΣ2 [2] . On the other hand, p NP[1] by adapting our proof of our main result it can be shown that ZPPΣ2 [1] ⊆ S2 . For the p NP[1] . We conclude by observing purpose of comparing these two results, we prove that PΣ2 ⊆ S2 that the above claims extend to the higher levels of the hierarchy: for k ≥ 2, Sp2

p

p

ZPPΣk [1] ⊆ PΣk [2]

1

and

p

Σp

[1]

PΣk ⊆ S2 k−1 .

Introduction

Symmetric alternation, or the class Sp2 , was introduced by Russell and Sundaram [16] and independently by Canetti [6]. It is a proof system in which a polynomial time verifier ascertains whether or not an input string x belongs to a language L by interacting with two mutually adversarial and computationally all powerful provers. The two provers, called the Yes-prover and the No-prover, make contradictory claims: x ∈ L and x 6∈ L, respectively. Of course, only one of them could be honest. In order to substantiate their claims, the two competing provers provide polynomially long strings y and z, respectively, as certificates. The verifier analyzes the input x and the certificates ∗

Research supported in part by NSF grant CCR-0208013. A preliminary version of the paper was presented at COCOON’05 [4]. † Part of the research was conducted while the author was at the University of Wisconsin, Madison.

1

Πp2 cH O HH

p

: Σ2 tt O t t tt tt t t

HH HH HH

Σp2 ∩ Πp2 O

ZPPO NP p

coAM : S2 eJ O uu O JJJJ u u J u JJ u JJ uu J uu NP MA coMA O dJJJ :P eLLL r9 O JJJtttt LLrLrrr t rr LLLL tt JJJJ tt rrr BPP coNP NP eJ O 8 JJ rr r JJ r r JJ rr JJ J rrrr AM O

P

Figure 1: Sp2 and other classes y and z, and votes in favor of one of the provers. We require that if x ∈ L, then there exists a certificate y using which the Yes-prover can win the vote, for any certificate z provided by the No-prover. Similarly, if x 6∈ L, then there should exist a z using which the No-prover can win the vote, for any certificate y provided by the Yes-prover. We call the certificates satisfying the above requirements as irrefutable certificates. We can rephrase the requirements as follows. If x ∈ L, then the Yes-prover has an irrefutable certificate, and if x 6∈ L, then the No-prover has an irrefutable certificate. The symmetric alternation class Sp2 consists of languages having a proof system of the above type. We will formally define Sp2 later. Russell and Sundaram [16] and independently Canetti [6] introduced the class Sp2 and showed that BPP ⊆ Sp2 . As it is easy to show Sp2 ⊆ Σp2 ∩ Πp2 , the above result improves the classical Sipser– Lautemann theorem that BPP ⊆ Σp2 ∩ Πp2 [18, 13]. Obtaining this improvement was one of their motivations in introducing Sp2 . It was also shown in [16] that Sp2 contains MA and PNP . Symmetric alternation has been gaining attention recently and several interesting results involving the class are known (see [3, 5, 7, 8, 9, 17]). Sp2 shares some nice properties with ZPPNP . For instance, both contain PNP and MA, and both are contained in Σp2 ∩ Πp2 . Based on this observation, Goldreich and Zuckerman [9] raised the relationship between the two as an open question. Cai [3] answered the question in part by showing that Sp2 ⊆ ZPPNP . Figure 1 illustrates the relationships among Sp2 and other classes. As discussed above, we have that PNP ⊆ Sp2 ⊆ ZPPNP [16, 3]. The reverse containments remain challenging open problems, but they can be obtained under some widely-believed complexity theoretic assumptions. A long line of research has demonstrated that randomized computations can be simulated deterministically for broad classes of problems under plausible assumptions. Working in this framework, Klivans and van Melkebeek [12] built on a famous result of Impagliazzo and

2

Wigderson [11] and showed that if there is a language L ∈ NE ∩ coNE such that any family of circuits with SAT oracle gates computing L is of size 2Ω(n) then BPPNP = PNP . Clearly, the same assumption also implies that ZPPNP = Sp2 = PNP . On the other hand, Shaltiel and Umans [17] showed that a weaker assumption is sufficient to obtain Sp2 = PNP . Their assumption involves co-nondeterministic circuits, instead of circuits with SAT gates and it is the one used in [14] to derandomize AM. The above discussion shows that PNP = Sp2 = ZPPNP under some plausible assumptions. However, it remains a challenging open problem to derive the above result unconditionally. In this paper, we focus on the issue of whether ZPPNP is contained in Sp2 and prove a weak result along this line. Recall that L ∈ ZPPNP means that the language is computed by a zero-error polynomial time algorithm having oracle access to a NP language. Such an algorithm may ask polynomially many queries to the oracle. We consider a subset of these algorithms that make only one oracle query (for any input and any random string). Our main result is that such algorithms can be simulated in Sp2 , i.e., we prove that ZPPNP[1] ⊆ Sp2 . We note that whether ZPPNP[2] is contained in Sp2 remains open. The class ZPPNP[2] contains the class AM∩coAM, which in turn contains ZPPGI , where GI is the graph isomorphism problem. Even determining whether AM ∩ coAM or ZPPGI is contained in Sp2 remain interesting open problems. Our result that ZPPNP[1] ⊆ Sp2 is tight in the following sense. We consider the containment of ZPPNP[1] in other important classes in the second level of the polynomial time hierarchy. It is unlikely that ZPPNP[1] is contained in AM, since coNP ⊆ ZPPNP[1] and it is shown in [2] that coNP ⊆ AM implies PH collapses to AM. Consequently, ZPPNP[1] is unlikely to be contained in smaller classes such as MA and NP. One potential candidate that might contain ZPPNP[1] is PNP . As remarked before, under some widely-believed hypothesis, ZPPNP[1] (or more generally, BPPNP ) is contained in PNP [12]. But, it is difficult to prove the above claim unconditionally, since BPP ⊆ ZPPNP[1] and the unconditional containment of BPP in PNP has been a long standing open problem. It was known that BPP ⊆ ZPPNP . It turns out that it can be improved to BPP ⊆ ZPPNP[1] , and this fact can be shown in several ways. Nisan and Wigderson [15] and Goldreich and Zuckerman [9] present alternative proofs for BPP ⊆ ZPPNP . The former proof is based on Nisan-Wigderson pseudorandom generator [15] and the latter uses extractor based amplification [19] of BPP. These proofs indeed show that BPP ⊆ ZPPNP[1] . But, they use the more sophisticated machinery mentioned above. We observe that the result can be obtained through a small modification of a standard proof of BPP ⊆ ZPPNP . We also present the details of this observation. We now sketch the main idea of the proof of ZPPNP[1] ⊆ Sp2 . Since the satisfiability problem SAT is NP-Complete, it suffices to show that ZPPSAT[1] ⊆ Sp2 . Let L ∈ ZPPSAT[1] . Because the underlying computation is of the ZPP type, it is easy to handle an input string x, if there is some random string y such that M accepts or rejects x, i.e., M reaches a definitive answer, and the oracle query ϕ asked by M along the computational path specified by y is satisfiable. We call such strings nice. For nice strings, the honest prover has an irrefutable certificate consisting of the string y and a satisfying truth assignment of ϕ. The harder part of the proof involves handling input strings that are not nice. For this purpose, we consider the following randomized algorithm M ′ . Given an input x, the algorithm randomly chooses a string y and simulates M on input x. When M asks a query ϕ, M ′ assumes that the answer is “No” (i.e., M ′ assumes ϕ is not satisfiable) and continues the simulation. Of course, M ′ is an incorrect simulation of M , but notice that M ′ does not need any oracles. Our main observation is that for non-nice inputs, M ′ behaves like a BPP algorithm.

3

Meaning, for any non-nice input x, if x ∈ L then the set of all accepting paths of M ′ is “large” and if x 6∈ L then the above set is “small”. Thus, for any non-nice input x, x ∈ L if and only if the set of accepting paths of M ′ is “large”. In our proof system, the Yes-prover (resp., the No-prover) would try to prove that x ∈ L (x 6∈ L) by showing that the above set is large (small). This is achieved by using ideas from the proof of BPP ⊆ Sp2 . We next consider analogous issues in the next level of the polynomial time hierarchy. In the case of ZPPNP[1] , we prove that the class is contained in Sp2 , but we are unable to prove a containment in PNP . The main difficulty is that we do not know how to simulate a BPP computation in PNP . Notice that we can accomplish the above task, if we have a Σp2 oracle, instead of an NP oracle. p p Using this observation, we show that ZPPpΣ2 [1] is contained in PΣ2 . More precisely, we show that p two queries to the Σp2 oracle suffice: ZPPΣ2 [1] ⊆ PΣ2 [2] . On the other hand, by adapting the proof p NP[1] of ZPPNP[1] ⊆ Sp2 , we can show that ZPPΣ2 [1] ⊆ S2 . In order to compare the above two results, p p NP[1] NP[1] Σ . We conclude by and show that PΣ2 ⊆ S2 we consider the relationship between P 2 and S2 observing that the above claims hold for higher levels of the hierarchy: for k ≥ 2, p

p

ZPPΣk [1] ⊆ PΣk [2]

and

p

Σp

[1]

PΣk ⊆ S2 k−1 .

Organization. The paper is organized as follows. Section 2 provides the necessary definitions. The main result is proved in Section 3. Section 4 presents the details of our observation that BPP ⊆ ZPPNP[1] . In Section 5, we present our results for the higher levels of the polynomial time hierarchy. We conclude the paper by stating some open problems in Section 6.

2

Preliminaries

In this section we present the required definitions and notations. Throughout this paper, (∃m y) will denote (∃y : y ∈ {0, 1}m ) and similarly, (∀m y) will denote (∀y : y ∈ {0, 1}m ). We now present the formal definition of Sp2 . Definition 2.1 ([6, 16]) A language L is in Sp2 if there exists a polynomial-time computable boolean predicate V (·, ·, ·) and a polynomial p such that, for all x, x ∈ L ⇐⇒ ∃m y∀m z[V (x, y, z) = 1], and x 6∈ L ⇐⇒ ∃m z∀m y[V (x, y, z) = 0], where m = p(|x|). Relativized versions of Sp2 will be useful in our discussion and we define these next. In the case of Sp2 , we require that the verifier’s predicate lie in the class P. When we substitute a class C in place of P in this definition, we get the class S2 .C. Thus, S2 .C is the set of languages having a S2 proof system in which the verifier’s predicate lies in the class C. A formal definition follows. Definition 2.2 Let C be any complexity class. We define S2 .C to be the set of languages L such that there exists a 3-argument boolean predicate V ∈ C and a polynomial p(·) such that, for any x, x ∈ L ⇐⇒ ∃m y∀m z[V (x, y, z) = 1], 4

and x 6∈ L ⇐⇒ ∃m z∀m y[V (x, y, z) = 0], where m = p(|x|). Notice that when we take C to be P in the above definition, we get Sp2 (i.e., S2 .P = Sp2 ). In this paper, we will be particularly interested in the case where the verifier runs in polynomial time and has oracle access to a language in a class C. Towards that end, we present the following notation. Definition 2.3 Let C be a complexity class. We denote by SC2 the class S2 .PC . For a constant C[k] k ≥ 0, we denote by S2 the class S2 .PC[k] . NP[1]

Thus, S2 denotes the set of languages having a S2 proof system where the verifier runs in polynomial time and has access to one query to an NP oracle. Our next task is to define ZPPC[k] (for a class C and a constant k) and in particular, we want to define the class ZPPNP[1] . We first consider an issue arising in this context. For the sake of concreteness, we discuss the issue with respect to ZPPNP[1] . The usual approaches for amplifying the success probability of randomized computations involve running it multiple times using strings chosen independently at random (or according to some suitable distribution). In the case of a ZPPNP[1] algorithms, this approach involves asking multiple queries to the NP oracle. It is not clear whether the success probability ZPPNP[1] algorithms can be amplified asking only one query. In general, the issue arises in the context of randomized bounded query computations. It seems to be an interesting problem worthy of further investigation. In our discussion, we circumvent the issue by defining ZPPNP[1] in a way that would make our ZPPNP[1] ⊆ Sp2 result stronger: we require the success probability to be only 1/2 + 1/poly(n). We note that it remains open whether ZPPNP[1] machines with success probabilities less than 1/2 can be simulated in Sp2 . We now present the definition of ZPPC[k] , for a class C. Definition 2.4 Let C be a complexity class and k ≥ 0 be a constant. We say that a language L ∈ ZPPC[k] , if there exists a randomized oracle Turing machine M (·, ·), a language A ∈ C and a polynomial p(·) such that, given oracle access to A, the machine M satisfies the following requirements for any input string x ∈ {0, 1}n . • On any random string, M asks at most k queries to the oracle A. • The machine has zero-error. Meaning, for any random string, the output belongs to {accept , reject , ?}, such that if x ∈ L then the output is either accept or ?, and if x 6∈ L then the output is either reject or ?. • The machine has good success probability: Pr[M outputs accept or reject ] ≥

1 1 + , 2 p(n)

where the probability is taken over the random coin tosses of M .

5

3

ZPPNP[1] ⊆ Sp2

In this section, we prove our main result. As outlined in the introduction, the proof involves considering two types of input strings. The first consists of input strings x such that for some random string y, the zero-error algorithm outputs accept or reject and the query ϕ asked by the algorithm is satisfiable. The second type consists of inputs strings that do not satisfy the above property. It is easy to handle the first type of strings. For the second type of strings, we consider an incorrect simulation of the algorithm that assumes the answer to the query is “No”. Under this simulation, the set of accepting paths is “large” if and only if x belongs to the language. We make use of a standard lemma regarding “large” and “small” sets for handling the second type of input strings. The following notation is used in the lemma and our proof. For two m-bit strings u = u1 u2 . . . um and v = v1 v2 . . . vm , let u ⊕ v denote the bitwise XOR of u and v: u ⊕ v = u1 ⊕ v1 . . . um ⊕ vm . For a set S ⊆ {0, 1}m , let S ⊕ u be the set {s ⊕ u|s ∈ S}. We call S ⊕ u the shift of S by u. Suppose a set S ⊆ {0, 1}m is sufficiently large. Then, if we choose a suitable number of shift vectors s1 , s2 ,S . . . , sk at random, with high probability, the union of these shifts will “cover” the entire space: ki=1 (S ⊕ ui ) = {0, 1}m . On the other hand, if S is a sufficiently small and k is small enough, then for any set of vectors s1 , s2 , . . . , sk , the shifts will cover at most a small fraction of {0, 1}m . The following lemma formalizes the above discussion. Lemma 3.1 [13] Let S ⊆ {0, 1}m and k ≥ 0. 1. If |S|/2m ≥ 1 − 1/m then Pr

s1 ,s2 ,...,sk ∈{0,1}m

"

k [

m

(S ⊕ si ) = {0, 1}

i=1

#

≥1−

2m . mk

2. If |S|/2m ≤ 1/m then for any s1 , s2 , . . . , sk ∈ {0, 1}m , # " k [ k (S ⊕ si ) ≤ . Pr u∈ m u∈{0,1}m i=1

Theorem 3.2 ZPPNP[1] ⊆ Sp2 . Proof: Since the satisfiability problem (SAT) is NP-complete, it suffices to show that ZPPSAT[1] ⊆ Sp2 . Let L ∈ ZPPSAT[1] via a randomized oracle Turing machine M . Let r(n) be the number of random bits used by M on an input of length n, where r(·) is a polynomial. Consider running the machine M with some x ∈ {0, 1}n as the input and some y ∈ {0, 1}r(n) as the random string. Without loss of generality, we assume that the machine asks a query to the SAT oracle and let ϕx,y denote that query. Let M (x, y) be the output of the machine when the query is answered correctly. Let Mno (x, y) denote the output when the answer to the query is taken as “No” (which is an incorrect answer, if ϕx,y is satisfiable). Myes (x, y) is defined similarly. Notice that Myes (·, ·) and Mno (·, ·) can be computed in polynomial time without using any oracle queries. Fix an input string x ∈ {0, 1}n and write r = r(n). We call x nice if there exists y ∈ {0, 1}r such that ϕx,y ∈ SAT and M (x, y) is either accept or reject . Define Ex = {y | y ∈ {0, 1}r and Mno (x, y) = accept }. 6

We observe that, if x is not nice, then the following two implications are true. x ∈ L =⇒ x 6∈ L =⇒

|Ex | 1 1 ≥ + r 2 2 p(n) |Ex | 1 1 ≤ − r 2 2 p(n)

We wish to amplify the gap in the size of Ex in the two cases and we do it in a standard way. Write ex ⊆ {0, 1}m as follows. t = (p(n))2 and m = t · r. Define a set E ex = {y1 ◦ y2 ◦ · · · ◦ yt | majority of y1 , y2 , . . . , yt belong to the set Ex } E

By Chernoff bounds, if x is not nice then we have the following two implications. x ∈ L =⇒ x 6∈ L =⇒

ex | |E 1 ≥1− m 2 m e 1 |Ex | ≤ 2m m

We now present our proof system. Let x ∈ {0, 1}n be the input string. The Yes-prover’s certificate consists of two components. The first component is a single bit using which he makes his claim on whether x is nice or not. If he claims it to be nice, then the second component should consist of a string y ∈ {0, 1}r and a truth assignment σ to the formula ϕx,y . (We expect that M (x, y) = accept , ϕx,y ∈ SAT and σ is a satisfying truth assignment of ϕx,y , proving that x ∈ L. Of course, the prover could be lying!) If he claims x is not nice, then the second component should → be sequence of k strings − s = (s1 , s2 , . . . , sk ) ∈ ({0, 1}m )k , where k = ⌊ m 2 ⌋. (The expectation is e that the union of the shifts of Ex by these strings covers the entire space). The No-prover’s certificate is similar. Its first component is a bit using which the No-prover makes his claim on whether x is nice or not. If he claims it to be nice, then the second component should consist of a string y ∈ {0, 1}r and a truth assignment σ to the formula ϕx,y . If he claims x is not nice, then → the second component should consist of a sequence of ℓ strings − u = (u1 , u2 , . . . , uℓ ) ∈ ({0, 1}m )ℓ , where ℓ = km + 1. (The expectation is that for any set of strings s1 , s2 , . . . , sk , there is at least one ui that is not covered by these shifts). The verifier’s algorithm works as follows. If the Yes-prover claims that x is nice, the verifier checks whether the string y and σ provided by him satisfy the conditions ϕx,y (σ) = 1 and Myes (x, y) = accept . If so, he votes in favor of the Yes-prover, else he votes in favor of the No-prover. Suppose the Yes-prover claims x is not nice. If the No-prover claims x is nice, then the verifier checks whether the string y and σ provided by the No-prover satisfy the conditions ϕx,y (σ) = 1 and Myes (x, y) = reject . If so, he votes in favor of the No-prover, else he votes in favor of the Yes-prover. The interesting case is where both provers claim that x is not nice. Here we consider the → → second components of the certificates − s = (s1 , s2 , . . . , sk ) and − u = (u1 , u2 , . . . , uℓ ), provided by − → → the Yes-prover and No-prover, respectively. We say that s beats − u , if # " k [ ex ⊕ si . (1) E ∀(1 ≤ j ≤ ℓ) uj ∈ i=1

7

→ → → → → → If the above predicate is false, then we say that − u beats − s . Given − s and − u , if − s beats − u , then the verifier votes in favor of the Yes-prover and otherwise, he votes in favor of the No-prover. Notice that ex ⊕ si ⇐⇒ uj ⊕ si ∈ E ex . uj ∈ E

ex involves membership testing in Ex , which can be Checking whether a given string belongs to E carried out in polynomial time. Thus the verifier’s algorithm runs in polynomial time. We next argue the correctness of the proof system. It is clear that the honest prover has an irrefutable certificate, if the input string x is nice. The interesting case is where x is not nice. Suppose x ∈ L and we will show that the Yes-prover has an irrefutable certificate. In this → ex |/2m ≥ 1 − 1/m, by Lemma 3.1, there exists − scenario, since |E s = (s1 , s2 , . . . , sk ) such that Sk m − → − → (S ⊕ u ) = {0, 1} . It follows that s beats any u = (u , u , . . . , uℓ ). So the Yes-prover has i 1 2 i=1 m e an irrefutable certificate. Now suppose x 6∈ L. Here |Ex |/2 ≤ 1/m and hence, by Lemma 3.1, for → any − s = (s1 , s2 , . . . , sk ), # " k [ ex ⊕ ui ) ≤ 1/2. (E Pr u∈ u∈{0,1}m

i=1

It follows that, choosing u1 , u2 , . . . , uℓ independently at random,

1 → → Pr [− s beats − u ] ≤ ℓ. − → 2 u =(u1 ,u2 ,...,uℓ ) As a consequence, Pr

− → u =(u1 ,u2 ,...,uℓ )

h

i 2km 1 → → → ∃− s ∈ {0, 1}km (− s beats − u) ≤ ℓ ≤ , 2 2

→ where the last inequality follows from our choice of ℓ. We conclude that there exists some − u that km − → beats all s ∈ {0, 1} and hence, the No-prover has an irrefutable certificate. 

4

BPP ⊆ ZPPNP[1] : A Simple Proof

A standard way of proving BPP ⊆ ZPPNP (via Lemma 3.1) involves asking two oracle queries. We observe that the number of queries can be reduced to one via a small modification to the construction. This observation leads to a simple proof of BPP ⊆ ZPPNP[1] . We note that the result can also be obtained by other means. For instance, Nisan and Wigderson [15] and Goldreich and Zuckerman [9] present alternative proofs for BPP ⊆ ZPPNP , by using Nisan-Wigderson pseudorandom generator [15] and extractor based amplification [19], respectively. The constructions in these proofs, in fact, make use of only one query. Theorem 4.1 BPP ⊆ ZPPNP[1] . Proof: One standard way of proving BPP ⊆ ZPPNP uses Lemma 3.1 and it goes as follows. Let L ∈ BPP and let M be a randomized algorithm for L. Let x be an input string. Via suitable amplification, we assume that M has error probability < 1/m, where m is the number of coin tosses of M on input x. Let Ex = {y|M (x, y) = 1}. We will apply Lemma 3.1 to the set Ex with

8

the number of shift vectors k < m. To be precise, we let k = ⌊m/2⌋. Given the input x, our ZPPNP simulation chooses s1 , s2 , . . . , sk ∈ {0, 1}m at random and asks two queries to NP oracle: (Q1 ) (Q2 )

k [

i=1 k \

[Ex ⊕ si ] = {0, 1}m [Ex ⊕ si ] = φ

i=1

If the answer to Q1 is “yes”, then the simulation outputs accept . If the answer to Q2 is “yes” then it outputs reject . If both the answers are “no” it outputs “?”. (It is not possible to have “yes” answers to both questions). Lemma 3.1 guarantees that the simulation is correct and that it has high probability of success. The above simulation uses two queries. We observe that the number of queries can be reduced to one, using the following simple idea. We first simulate the machine M on input x, using a randomly chosen string y. The outcome of the machine gives us a clue as to whether or not x ∈ L, which is correct with high probability. Then we take only one of the two paths of the previous ZPPNP simulation, where the path is chosen according to the outcome. Formally, if M (x, y) = 1, then we ask the query Q1 . If the oracle answers “yes”, then output accept , else output “?”. On the other hand, if M (x, y) = 0, then we ask the query Q2 . If the oracle answers “yes”, then output reject , else “?”. It is easy to argue that this algorithm is correct and that it has high probability of success. 

5

Results for the Higher Levels of the Polynomial Time Hierarchy

In this section, we study zero error algorithms having oracle access to one query to a language in p p Σp2 [1] Σk , for k ≥ 2. Our main result is that ZPP ⊆ PΣ2 [2] . We also present similar results for higher levels of the hierarchy. p p We start with an informal discussionp of the proof of ZPPΣ2 [1] ⊆ PΣ2 [2] . The argument is similar to that of Theorem 3.2. Let L ∈ ZPPΣ2 [1] via a zero error algorithm M . We classify input strings into nice and non-nice strings. We can find out whether an input x is nice using one Σp2 query. If x is nice, we can determine whether x ∈ L using another Σp2 query. If x is not nice, we consider a simulation of M where the answer to its single query is taken to be a “No”. As in proof of Theorem 3.2, the main observation is that, under this possibly incorrect simulation, M becomes a BPP type algorithm for non-nice input strings. Thus, for a non-nice inputs, the issue of membership in L reduces to a BPP question. By the classical Sipser-Lautemann theorem [18, 13], we can answer the question via one query to the Σp2 oracle. To be more precise, the main observation is that if x is not nice, then the set of accepting paths of M in the above simulation is “large” if and only if x ∈ L. Using Lemma 3.1, we can find out whether the above set is “large” or “small” using a Σp2 query. p

p

Theorem 5.1 ZPPΣ2 [1] ⊆ PΣ2 [2] . p

Proof: Let L ∈ ZPPΣ2 [1] . We have a zero error algorithm M that computes L given access for one query to an oracle A ∈ Σp2 . We assume PA is a deterministic polynomial time predicate, such that (∃p z)(∀p w)PA (·, z, w) defines A, where ∃p and ∀p , as usual, denote polynomially bounded 9

quantifiers. Let r(n) be the number of random bits used by M on an input of length n, where r(·) is polynomial. Consider simulating the machine M on an input x ∈ {0, 1}n using a string y ∈ {0, 1}r(n) as the random coin tosses. We setup the following notations for the pair x and y. Let qx,y denote the single query to the oracle A asked by M . Let M (x, y) denote the output of M , when the query qx,y is answered correctly. Let Myes (x, y) denote the output, when we supply a “yes” answer to the oracle query qx,y . Similarly, let Myes (x, y) denote the output, if we supply a “no” answer to the oracle query qx,y . p Our goal is to show that L ∈ PΣ2 [2] . We exhibit a polynomial time algorithm that decides L given oracle access to a Σp2 -complete language Q. Consider an input string x ∈ {0, 1}n and write r = r(n). We say that x is nice, if there exists y ∈ {0, 1}r such that qx,y ∈ A and Myes (x, y) 6=?. Notice that the above criterion is expressible as a property in Σp2 , namely, we first guess a y ∈ {0, 1}r , from which we can compute in deterministic polynomial time the query qx,y , and verify that Myes (x, y) 6=?, and we further guess some z such that for all w, PA (qx,y , z, w), where z and w are both polynomially bounded in |qx,y |, and thus in |x|. Therefore, we can test whether x is nice or not by making one query to the oracle Q. The algorithm proceeds according to the answer to the above query. Suppose x is nice. Since M has zero error, we have that x ∈ L ⇐⇒ ∃r y[qx,y ∈ A and Myes (x, y) = accept ]. (A similar equivalence can be written for the case where x 6∈ L). The right hand side of the above equivalence can be expressed as a Σp2 predicate. Thus, we can test whether x ∈ L or not by using one query to the oracle Q. Suppose x is not nice. Define Ex = {y ∈ {0, 1}r |Mno (x, y) = accept }. The main observation is the following. Since x is not nice, we have that x ∈ L =⇒

1 1 |Ex | ≥ + 2r 2 p(n)

x 6∈ L =⇒

|Ex | 1 1 , ≤ − r 2 2 p(n)

and

where p(·) is some polynomial that specifies the success probability of M . We wish to amplify the gap in the size of Ex in the above two cases and do it in a routine way. Write t = (p(n))2 and let ex as follows: m = t · r. Define the set E ex = {y1 ◦ y2 ◦ · · · ◦ yt | majority of y1 , y2 , . . . , yt belong to Ex }. E

By Chernoff bounds, we have that

x ∈ L =⇒ and

ex 1 E >1− 2m m

x 6∈ L =⇒

ex 1 E < . m 2 m

10

Write k = m/2. By Lemma 3.1, we have m

x ∈ L ⇐⇒ ∃ s1 , s2 , . . . , sk [

k [

i=1

By rewriting the right hand side, we get

ex ⊕ si = {0, 1}m ]. E

x ∈ L ⇐⇒ ∃m s1 , s2 , . . . , sk ∀m z[

k _

ex )]. (z ⊕ si ∈ E

i=1

ex in polynomial time. Thus, the right hand side is a Notice that we can test for membership in E p Σ2 expression. So, we can find out whether x is in L or not using one query to the oracle Q. The above algorithm makes two (adaptive) queries to the Σp2 -complete oracle Q. We have shown p p that ZPPΣ2 [1] ⊆ PΣ2 [2] .  p It is interesting to compare our results regarding ZPPNP[1] and ZPPΣ2 [1] . With respect to the NP[1] former, we showed that BPP ⊆ ZPPNP[1] , but we are unable to prove that ZPP ⊆ PNP . Our p Σp2 [1] Σ ⊆ P 2 . Unforturesults regarding the latter have an opposite flavor.p We showed that ZPP nately, we are unable to show that BPPNP ⊆ ZPPΣ2 [1] . Notice that proving the above would lead p to the remarkable result that BPPNP ⊆ PΣ2 . p NP[1] By adapting the proof of Theorem 3.2, one can show that ZPPΣ2 [1] ⊆ S2 . We would like to p NP[1] compare the above claim with Theorem 5.1. Towards that end, we prove that PΣ2 ⊆ S2 . Thus, p Σ2 [1] Theorem 5.1 provides a better upper bound for ZPP . p

NP[1]

Theorem 5.2 PΣ2 ⊆ S2

.

p

Proof: Let L ∈ PΣ2 . We have a polynomial time machine M that computes L, given oracle access to a language A ∈ Σp2 . For A, there exists a polynomial time computable predicate D and a polynomial r such that for any q, q ∈ A ⇐⇒ ∃t y∀tz[D(q, y, z) = 1], where t = r(|q|). Our S2 proof system for L works as follows. Let x ∈ {0, 1}n be an input. On input x, the machine M can ask at most m queries, where m is polynomial in n. The two provers’ certificates are similar in nature. The Yes-prover’s certificate consists of two parts, the first being a sequence of m bits b1 , b2 , . . . , bm , where the bit bi represents the prover’s claim as to whether the ith query made by M belongs to A or not. In the second part of the certificate, the prover should include a proof of membership in A for those queries that he claims to be in A. Meaning, for every i, if bi = 1, then the prover should provide a string yi . Similarly, the No-prover’s certificate is made of bits b′1 , b′2 , . . . , b′m and a string yi′ , for each i with b′i = 1. Given the input x and the certificates, the verifier works as follows. We simulate M on x. When it asks the first query q1 , we check if the provers agree on the membership of q1 in A, namely check whether b1 = b′1 . If so, we continue the simulation taking b1 as the answer to the query. The process is repeated for each query asked by M . The above process can stop in two ways: (i) the provers agree on every query asked by M and the machine halts with an output; (ii) the provers disagree on some query qi (i.e., bi 6= b′i ) before the machine halts. In the former case, we simply accept the outcome of the machine: vote in 11

favor of the Yes-prover, if the machine accepts and otherwise, vote in favor of the No-prover. Suppose we end up in the second case. Let i be the smallest index such bi 6= b′i and let qi be the query. It is clear that either bi = 1 or b′i = 1. The two possibilities are handled similarly. Consider the case where bi = 1. Here the Yes-prover is claiming that qi ∈ A and has provided purported proof yi . The NP oracle is used to verify the claim. Using the NP oracle, we test whether ∀t z[D(x, yi , z) = 1], where t = r(|qi |). If the test passes then we vote in favor of the Yes-prover and otherwise, vote in favor of the No-prover. The case where b′i = 1 is handled similarly. We use the NP oracle to test whether ∀t z[D(x, yi′ , z) = 1], where t = r(|qi |). If the test passes, we vote in favor of the No-prover and otherwise, vote in favor of the Yes-prover. It is easy to verify the correctness of the proof system. The honest prover can provide the correct answers to all the queries made by M along with suitable proofs that would pass the test for queries in the language A. Next, notice that the verifier asks only one query to the NP oracle. NP[1] Thus, we have shown that L ∈ S2 .  We can generalize Theorem 5.1 and Theorem 5.2 to the higher levels the polynomial time hierarchy as follows. The generalization can be shown by suitably adapting the proofs of the base cases. p

p

Theorem 5.3 For k ≥ 2, ZPPΣk [1] ⊆ PΣk [2] . p

Σp

[1]

Theorem 5.4 For k ≥ 2, PΣk ⊆ S2 k−1 .

6

Open Problems

As we discussed before, it is known that PNP ⊆ Sp2 ⊆ ZPPNP [16, 3]. The reverse containments are challenging open problems. But, we can prove them under some complexity theoretic assumptions. Under a plausible hypothesis, we know that ZPPNP = PNP [12]. In a recent work, Shaltiel and Umans [17] present a conditional derandomization of Cai’s simulation [3] of Sp2 in ZPPNP . They show that a hypothesis weaker than the one used in [12] suffices to obtain Sp2 = PNP . Their hypothesis is the one used in [14] to show AM = NP. In a similar spirit, it would be nice if we could weaken the assumptions needed for showing ZPPNP ⊆ Sp2 . It is also worthwhile to consider classes contained in ZPPNP and show them to be in Sp2 . We proved that ZPPNP[1] is in Sp2 , but we required that the randomized algorithms have success probability greater than half by an inverse polynomial quantity. It would be nice to show the same result when the success probability is less than half (say, 1/4). Whether ZPPNP[2] (even with success probability close to one) is contained in Sp2 also remains open. AM ∩ coAM is another interesting class contained in ZPPNP that is not known to be in Sp2 . The last two questions are related since, we know that AM ∩ coAM ⊆ ZPPNP[2] . Another open question along these lines is the containment of ZPPGI in Sp2 , where GI refers to the graph isomorphism problem. This might be easier to prove, since ZPPGI ⊆ AM ∩ coAM [1, 10].

12

Acknowledgments We thank Denis Charles and Rajasekar Krishnamurthy for the interesting discussions on this topic. We thank the anonymous referees of an earlier version of the paper for their useful suggestions and comments.

References [1] L. Babai and S. Moran. Arthur-merlin games: A randomized proof system, and a hierarchy of complexity classes. Journal of Computer and System Sciences, 36(2):254–276, 1988. [2] R. Boppana, J. H˚ astad, and S. Zachos. Does Co-NP have short interactive proofs? Information Processing Letters, 25(2):127–132, 1987. [3] J. Cai. Sp2 ⊆ ZPPNP . In Proceedings of the 42nd IEEE Symposium on Foundations of Computer Science, 2001. [4] J. Cai and V. Chakaravarthy. A note on zero algorithms having oracle access to one NP query. In Proceedings of the 11th Annual International Computing and Combinatorics Conference, 2005. [5] J. Cai, V. Chakaravarthy, L. Hemaspaandra, and M. Ogihara. Competing provers yield improved Karp–Lipton collapse results. In Proceedings of the 20th Annual Symposium on Theoretical Aspects of Computer Science, 2003. [6] R. Canetti. More on BPP and the polynomial-time hierarchy. Information Processing Letters, 57(5):237–241, 1996. [7] L. Fortnow, R. Impagliazzo, V. Kabanets, and C. Umans. On the complexity of succinct zerosum games. In Proceedings of the 20th Annual IEEE Conference on Computational Complexity, 2005. [8] L. Fortnow, A. Pavan, and S. Sengupta. Proving SAT does not have small circuits with an application to the two queries problem. In Proceedings of the 18th Annual IEEE Conference on Computational Complexity, 2003. [9] O. Goldreich and D. Zuckerman. Another proof that BPP ⊆ PH (and more). Technical Report TR97–045, Electronic Colloquium on Computational Complexity, 1997. Available at http://www.eccc.uni-trier.de/eccc. [10] S. Goldwasser and M. Sipser. Private coins versus public coins in interactive proof systems. In Proceedings of the 18th ACM Symposium on Theory of Computing, 1986. [11] R. Impagliazzo and A. Wigderson. P=BPP unless E has subexponential circuits: Derandomizing the XOR lemma. In Proceedings of the 29th ACM Symposium on Theory of Computing, 1997. [12] A. Klivans and D. van Melkebeek. Graph nonisomorphism has subexponential size proofs unless the polynomial hierarchy collapses. SIAM Journal on Computing, 31(5):1501–1526, 2002. 13

[13] C. Lautemann. BPP and the polynomial hierarchy. Information Processing Letters, 17(4):215– 217, 1982. [14] P. Miltersen and N. Vinodchandran. Derandomizing Arthur-Merlin games using hitting sets. In Proceedings of the 40th IEEE Symposium on Foundations of Computer Science, 1999. [15] N. Nisan and A. Wigderson. Hardness vs randomness. Journal of Computer and System Sciences, 49(2):149–167, 1994. [16] A. Russell and R. Sundaram. Symmetric alternation captures BPP. Computational Complexity, 7(2):152–162, 1998. [17] R. Shaltiel and C. Umans. Pseudorandomness for approximate counting and sampling. In Proceedings of the 20th Annual IEEE Conference on Computational Complexity, 2005. [18] M. Sipser. A complexity theoretic approach to randomness. In Proceedings of the 15th ACM Symposium on Theory of Computing, 1983. [19] D. Zuckerman. Simulating BPP using a general weak random source. 16(4/5):367–391, 1996.

14

Algorithmica,