Constant Rate PCPs for Circuit-SAT with Sublinear Query Complexity

Abstract

The PCP theorem (Arora et. al., J. ACM 45(1,3)) says that every NP-proof can be encoded to another proof, namely, a probabilistically checkable proof (PCP), which can be tested by a verifier that queries only a small part of the PCP. A natural question is how large is the blow-up incurred by this encoding, i.e., how long is the PCP compared to the original NP-proof. The state-of-the-art work of Ben-Sasson and Sudan (SICOMP 38(2)) and Dinur (J. ACM 54(3)) shows that one can encode proofs of length n by PCPs of length n · poly log n that can be verified using a constant number of queries. In this work, we show that if the query complexity is relaxed to n ε , then one can construct PCPs of length O(n) for circuit-SAT, and PCPs of length O(t log t) for any language in NTIME(t).More specifically, for any ε > 0 we present (non-uniform) probabilistically checkable proofs (PCPs) of length 2 O(1/ε) · n that can be checked using n ε queries for circuit-SAT instances of size n. Our PCPs have perfect completeness and constant soundness. This is the first constant-rate PCP construction that achieves constant soundness with nontrivial query complexity (o(n)).Our proof replaces the low-degree polynomials in algebraic PCP constructions with tensors of transitive algebraic geometry (AG) codes. We show that the automorphisms of an AG code can be used to simulate the role of affine transformations which are crucial in earlier high-rate algebraic PCP constructions. Using this observation we conclude that any asymptotically good family of transitive AG codes over a constant-sized alphabet leads to a family of constant-rate PCPs with polynomially small query complexity. Such codes are constructed in the appendix to this paper for the first time for every message length, after they have been constructed for infinitely many message lengths by Stichtenoth [Trans. Information Theory 2006].

Linear-Size Constant-Query IOPs for Delegating Computation

“…For example, it is not known how to reduce a random-access machine, or even a Turing machine, to a circuit of linear size. Indeed, the linear-size sublinear-query PCP of [BKKMS13] only works for circuit but not machine computations. We thus view Theorem 3 as particularly appealing, because it achieves linear length for a powerful model of computation, algebraic machines, which facilitates linear-size reductions from many other problems.…”

“…For example, one cannot rely on arithmetization via multivariate polynomials and standard lowdegree tests, nor rely on algebraic embeddings via de Bruijn graphs for routing; in addition, query-reduction techniques for interactive PCPs [KR08] do not apply to the linear proof length regime. The state-of-the-art in linear-length PCPs is due to [BKKMS13], and the construction is based on a non-uniform family of algebraic geometry (AG) codes (every input size needs a polynomial-size advice string). In more detail, [BKKMS13] proves that for every ∈ (0, 1) there is a (non-uniform) PCP for the NP-complete problem CSAT (Boolean circuit satisfiability) with proof length 2 O(1/ ) N and query complexity N , much more than our goal of O(1).…”

“…The state-of-the-art in linear-length PCPs is due to [BKKMS13], and the construction is based on a non-uniform family of algebraic geometry (AG) codes (every input size needs a polynomial-size advice string). In more detail, [BKKMS13] proves that for every ∈ (0, 1) there is a (non-uniform) PCP for the NP-complete problem CSAT (Boolean circuit satisfiability) with proof length 2 O(1/ ) N and query complexity N , much more than our goal of O(1).…”

“…While the proof length is asymptotically close to optimal, c is a fairly large constant, and moreover the construction uses gap amplification techniques that are not believed to be concretely efficient. The only construction of PCPs with linear proof length has query complexity O(N ) and a verifier that runs in non-uniform polynomial time [BKKMS13]; the running time of the prover is not specified. Clearly, these parameters are a long way from those desired of PCPs for fast verification of computation.…”

Computational complexity

“…This talk presented a recent result [6], which constructed the first PCPs of linear length with nontrivial query complexity. Specifically, it was shown that for every , Circuit-SAT (and hence for 3-SAT) instances with n gates, there are non-uniform PCPs of length O(n) which can be tested with O(n ) queries.…”