Given disjoint sets S , S' ⊆ 𝔽 q of size n and a function f : S → 𝔽 q , where 𝔽 q is a finite field, the low-degree extension (LDE) of f to S' is the function f ' : S ' → 𝔽 q obtained by restricting the interpolating polynomial of f to S' . LDE computation is a fundamental primitive of modern algebraic coding theory and cryptography. The best asymptotic running time for LDE with parameter n is O(n log n ) arithmetic operations over 𝔽 q - when q and the sets S, S' are special. This running time is achieved via the Fast Fourier Transform (FFT), and requires 𝔽 q to contain a multiplicative subgroup of smooth order ≥ n (smoothness means being the product of small primes). Another variant uses an additive subgroup of smooth order ≥ n . Most finite fields do not contain such a subgroup, which raises the question of computing the LDE in time O(n · log n ) over general finite fields, for some disjoint pair of sets S , S ' of size n . The main result of this paper is a positive answer to this question, presenting O(n log n )-time LDE for special S , S ' shown to exist over all fields, as long as q = Ω( n 2 ). This result is achieved by introducing a new FFT-like transform, the Elliptic Curve Fast Fourier Transform (ECFFT), which gives an approach to fast algorithms (using preprocessing) for polynomial operations over all large finite fields. The key idea is to replace the group of roots of unity with a set of points L ⊂ 𝔽 q suitably related to a well-chosen elliptic curve group over 𝔽 q (the set L itself is not a group). The key advantage of this approach is that elliptic curve groups can be of any size in the Hasse-Weil interval and thus can have subgroups of large, smooth order, which an FFT-like divide and conquer algorithm can exploit. Compare this with multiplicative subgroups over 𝔽 q whose order must divide q − 1. By analogy, our method extends the standard, multiplicative FFT in a similar way to how Lenstra's elliptic curve method [Len87] extended Pollard's p − 1 algorithm [Pol74] for factoring integers. Representing polynomials by their evaluation over (well-chosen) subsets of L , we use the ECFFT to compute the LDE in time O(n log n ). We also give small arithmetic circuits for polynomial multiplication, division, degree-computation, interpolation, evaluation and Reed-Solomon encoding (also known as low-degree extension) with fixed evaluation points , matching the circuit size of classical FFT-based algorithms when the field size q is special. For the classical problems (in the standard representation) of low degree extension with chosen evaluation points, and evaluating elementary symmetric polynomials, this yields the asymptotically smallest known arithmetic circuits. The efficiency of the classical FFT follows from using the 2-to-1 squaring map to reduce the evaluation set of roots of unity of order 2 k to similar groups of size 2 k-i , i > 0. Our algorithms operate similarly, using isogenies of elliptic curves with kernel size 2 as 2-to-1 maps to reduce L of size 2 k to sets of size 2 k-i that are, like L , suitably related to elliptic curves, albeit different ones.

A collection of sets displays a proximity gap with respect to some property if for every set in the collection, either (i) all members are δ-close to the property in relative Hamming distance or (ii) only a tiny fraction of members are δ-close to the property. In particular, no set in the collection has roughly half of its members δ-close to the property and the others δ-far from it. We show that the collection of affine spaces displays a proximity gap with respect to Reed-Solomon (RS) codes, even over small fields, of size polynomial in the dimension of the code, and the gap applies to any δ smaller than the Johnson/Guruswami-Sudan list-decoding bound of the RS code. We also show near-optimal gap results, over fields of (at least) linear size in the RS code dimension, for δ smaller than the unique decoding radius. Concretely, if δ is smaller than half the minimal distance of an RS code V ⊂ Fqn, every affine space is either entirely δ-close to the code, or alternatively at most an ( n/q)-fraction of it is δ-close to the code. Finally, we discuss several applications of our proximity gap results to distributed storage, multi-party cryptographic protocols, and concretely efficient proof systems. We prove the proximity gap results by analyzing the execution of classical algebraic decoding algorithms for Reed-Solomon codes (due to Berlekamp-Welch and Guruswami-Sudan) on a formal element of an affine space. This involves working with Reed-Solomon codes whose base field is an (infinite) rational function field. Our proofs are obtained by developing an extension (to function fields) of a strategy of Arora and Sudan for analyzing low-degree tests.

Motivated by the quest for scalable and succinct zero knowledge arguments, we revisit worst-case-to-average-case reductions for linear spaces, raised by [Rothblum, Vadhan, Wigderson, STOC 2013]. The previous state of the art by [Ben-Sasson, Kopparty, Saraf, CCC 2018] showed that if some member of an affine space U is δ-far in relative Hamming distance from a linear code V - this is the worst-case assumption - then most elements of U are almost-δ-far from V - this is the average case. However, this result was known to hold only below the "double Johnson" function of the relative distance δ_V of the code V, i.e., only when δ < 1-(1-δ_V)^(1/4). First, we increase the soundness-bound to the "one-and-a-half Johnson" function of δ_V and show that the average distance of U from V is nearly δ for any worst-case distance δ smaller than 1-(1-δ_V)^(1/3). This bound is tight, which is somewhat surprising because the one-and-a-half Johnson function is unfamiliar in the literature on error correcting codes. To improve soundness further for Reed Solomon codes we sample outside the box. We suggest a new protocol in which the verifier samples a single point z outside the box D on which codewords are evaluated, and asks the prover for the value at z of the interpolating polynomial of a random element of U. Intuitively, the answer provided by the prover "forces" it to choose one codeword from a list of "pretenders" that are close to U. We call this technique Domain Extending for Eliminating Pretenders (DEEP). The DEEP method improves the soundness of the worst-case-to-average-case reduction for RS codes up their list decoding radius. This radius is bounded from below by the Johnson bound, implying average distance is approximately δ for all δ < 1-(1-δ_V)^(1/2). Under a plausible conjecture about the list decoding radius of Reed-Solomon codes, average distance from V is approximately δ for all δ. The DEEP technique can be generalized to all linear codes, giving improved reductions for capacity-achieving list-decodable codes. Finally, we use the DEEP technique to devise two new protocols: - An Interactive Oracle Proof of Proximity (IOPP) for RS codes, called DEEP-FRI. The soundness of the protocol improves upon that of the FRI protocol of [Ben-Sasson et al., ICALP 2018] while retaining linear arithmetic proving complexity and logarithmic verifier arithmetic complexity. - An Interactive Oracle Proof (IOP) for the Algebraic Linking IOP (ALI) protocol used to construct zero knowledge scalable transparent arguments of knowledge (ZK-STARKs) in [Ben-Sasson et al., eprint 2018]. The new protocol, called DEEP-ALI, improves soundness of this crucial step from a small constant < 1/8 to a constant arbitrarily close to 1.

Early childhood developmental screening is critical for timely detection and intervention. babyTRACKS (Formerly Baby CROINC, CROwd INtelligence Curation.) is a free, live, interactive developmental tracking mobile app with over 3,000 children's diaries. Parents write or select short milestone texts, like "began taking first steps," to record their babies' developmental achievements, and receive crowd-based percentiles to evaluate development and catch potential delays.

This paper studies families of distributions T that are amenable to retentive learning, meaning that an expert can retain users that seek to predict their future, assuming user attributes are sampled from T and exposed gradually over time. Limited attention span is the main problem experts face in our model. We make two contributions. First, we formally define the notions of retentively learnable distributions and properties. Along the way, we define a retention complexity measure of distributions and a natural class of retentive scoring rules that model the way users evaluate experts they interact with. These rules are shown to be tightly connected to truth-eliciting "proper scoring rules" studied in Decision Theory since the 1950's [McCarthy, PNAS 1956]. Second, we take a first step towards relating retention complexity to other measures of significance in computational complexity. In particular, we show that linear properties (over the binary field) are retentively learnable, whereas random Low Density Parity Check (LDPC) codes have, with high probability, maximal retention complexity. Intriguingly, these results resemble known results from the field of property testing and suggest that deeper connections between retentive distributions and locally testable properties may exist.

Algebraic proof systems reduce computational problems to problems about estimating the distance of a sequence of functions vec{u}=(u_1,..., u_k), given as oracles, from a linear error correcting code V. The soundness of such systems relies on methods that act "locally" on vec{u} and map it to a single function u^* that is, roughly, as far from V as are u_1,..., u_k. Motivated by these applications to efficient proof systems, we study a natural worst-case to average-case reduction of distance for linear spaces, and show several general cases in which the following statement holds: If some member of a linear space U=span(u_1,...,u_k) is delta-far from (all elements) of V in relative Hamming distance, then nearly all elements of U are (1-epsilon)delta-far from V; the value of epsilon depends only on the distance of the code V and approaches 0 as that distance approaches 1. Our results improve on the previous state-of-the-art which showed that nearly all elements of U are 1/2delta-far from V [Rothblum, Vadhan and Wigderson, STOC 2013]. When V is a Reed-Solomon (RS) code, as is often the case for algebraic proof systems, we show how to boost distance via a new "local" transformation that may be useful elsewhere. Relying on the affine-invariance of V, we map a vector u to a random linear combination of affine transformations of u, and show this process amplifies distance from V. Assuming V is an RS code with sufficiently large distance, this amplification process converts a function u that is somewhat far from V to one that is (1-epsilon)-far from V; as above, epsilon depends only on the distance of V and approaches 0 as the distance of V approaches 1. We give two concrete application of these techniques. First, we revisit the axis-parallel low-degree test for bivariate polynomials of [Polischuk-Spielman, STOC 1994] and prove a "list-decoding" type result for it, when the degree of one axis is extremely small. This result is similar to the recent list-decoding-regime result of [Chiesa, Manohar and Shinkar, RANDOM 2017] but is proved using different techniques, and allows the degree in one axis to be arbitrarily large. Second, we improve the soundness analysis of the recent RS proximity testing protocol of [Ben-Sasson et al., ICALP 2018] and extend it to the "list-decoding" regime, bringing it closer to the Johnson bound.

The family of Reed-Solomon (RS) codes plays a prominent role in the construction of quasilinear probabilistically checkable proofs (PCPs) and interactive oracle proofs (IOPs) with perfect zero knowledge and polylogarithmic verifiers. The large concrete computational complexity required to prove membership in RS codes is one of the biggest obstacles to deploying such PCP/IOP systems in practice. To advance on this problem we present a new interactive oracle proof of proximity (IOPP) for RS codes; we call it the Fast RS IOPP (FRI) because (i) it resembles the ubiquitous Fast Fourier Transform (FFT) and (ii) the arithmetic complexity of its prover is strictly linear and that of the verifier is strictly logarithmic (in comparison, FFT arithmetic complexity is quasi-linear but not strictly linear). Prior RS IOPPs and PCPs of proximity (PCPPs) required super-linear proving time even for polynomially large query complexity. For codes of block-length N, the arithmetic complexity of the (interactive) FRI prover is less than 6 * N, while the (interactive) FRI verifier has arithmetic complexity <= 21 * log N, query complexity 2 * log N and constant soundness - words that are delta-far from the code are rejected with probability min{delta * (1-o(1)),delta_0} where delta_0 is a positive constant that depends mainly on the code rate. The particular combination of query complexity and soundness obtained by FRI is better than that of the quasilinear PCPP of [Ben-Sasson and Sudan, SICOMP 2008], even with the tighter soundness analysis of [Ben-Sasson et al., STOC 2013; ECCC 2016]; consequently, FRI is likely to facilitate better concretely efficient zero knowledge proof and argument systems. Previous concretely efficient PCPPs and IOPPs suffered a constant multiplicative factor loss in soundness with each round of "proof composition" and thus used at most O(log log N) rounds. We show that when delta is smaller than the unique decoding radius of the code, FRI suffers only a negligible additive loss in soundness. This observation allows us to increase the number of "proof composition" rounds to Theta(log N) and thereby reduce prover and verifier running time for fixed soundness.

A theoretical model is suggested for abstracting the interaction between an expert system and its users, with a focus on reputation and incentive compatibility. The model assumes users interact with the system while keeping in mind a single "retention parameter" that measures the strength of their belief in its predictive power, and the system's objective is to reinforce and maximize this parameter through "informative" and "correct" predictions. We define a natural class of retentive scoring rules to model the way users update their retention parameter and thus evaluate the experts they interact with. Assuming agents in the model have an incentive to report their true belief, these rules are shown to be tightly connected to truth-eliciting "proper scoring rules" studied in Decision Theory. The difference between users and experts is modeled by imposing different limits on their predictive abilities, characterized by a parameter called memory span. We prove the monotonicity theorem ("more knowledge is better"), which shows that experts with larger memory span retain better in expectation. Finally, we focus on the intrinsic properties of phenomena that are amenable to collaborative discovery with a an expert system. Assuming user types (or "identities") are sampled from a distribution D, the retention complexity of D is the minimal initial retention value (or "strength of faith") that a user must have before approaching the expert, in order for the expert to retain that user throughout the collaborative discovery, during which the user "discovers" his true "identity". We then take a first step towards relating retention complexity to other established computational complexity measures by studying retention dynamics when D is a uniform distribution over a linear space.

We study interactive oracle proofs (IOPs) [BCS16,RRR16], which combine aspects of probabilistically checkable proofs (PCPs) and interactive proofs (IPs). We present IOP constructions and techniques that enable us to obtain tradeoffs in proof length versus query complexity that are not known to be achievable via PCPs or IPs alone. Our main results are: 1. Circuit satisfiability has 3-round IOPs with linear proof length (counted in bits) and constant query complexity. 2. Reed-Solomon codes have 2-round IOPs of proximity with linear proof length and constant query complexity. 3. Tensor product codes have 1-round IOPs of proximity with sublinear proof length and constant query complexity. For all the above, known PCP constructions give quasilinear proof length and constant query complexity [BS08,Din07]. Also, for circuit satisfiability, [BKKMS13] obtain PCPs with linear proof length but sublinear (and super-constant) query complexity. As in [BKKMS13], we rely on algebraic-geometry codes to obtain our first result; but, unlike that work, our use of such codes is much "lighter" because we do not rely on any automorphisms of the code. We obtain our results by proving and combining "IOP-analogues" of tools underlying numerous IPs and PCPs: * Interactive proof composition. Proof composition [AS98] is used to reduce the query complexity of PCP verifiers, at the cost of increasing proof length by an additive factor that is exponential in the verifier's randomness complexity. We prove a composition theorem for IOPs where this additive factor is linear. * Sublinear sumcheck. The sumcheck protocol [LFKN92] is an IP that enables the verifier to check the sum of values of a low-degree multi-variate polynomial on an exponentially-large hypercube, but the verifier's running time depends linearly on the bound on individual degrees. We prove a sumcheck protocol for IOPs where this dependence is sublinear (e.g., polylogarithmic). Our work demonstrates that even constant-round IOPs are more efficient than known PCPs and IPs.

Finite fields of characteristic 2 -- "binary fields" -- are used in a variety of applications in cryptography and data storage. Multiplication of two finite field elements is a fundamental operation and a well-known computational bottleneck in many of these applications, as they often require multiplication of a large number of elements. In this work we focus on accelerating multiplication in "large" binary fields of sizes greater than 232. We devise a new parallel algorithm optimized for execution on GPUs. This algorithm makes it possible to multiply large number of finite field elements, and achieves high performance via bit-slicing and fine-grained parallelization.

The PCP theorem [Arora et al. 1998; Arora and Safra 1998] says that every NP-proof can be encoded to another proof, namely, a probabilistically checkable proof (PCP), which can be tested by a verifier that queries only a small part of the PCP. A natural question is how large is the blow-up incurred by this encoding, that is, how long is the PCP compared to the original NP-proof? The state-of-the-art work of Ben-Sasson and Sudan [2008] and Dinur [2007] shows that one can encode proofs of length n by PCPs of length n · poly log n that can be verified using a constant number of queries. In this work, we show that if the query complexity is relaxed to n ε , then one can construct PCPs of length O ( n ) for circuit-SAT, and PCPs of length O ( t log t ) for any language in NTIME( t ). More specifically, for any ε > 0, we present (nonuniform) probabilistically checkable proofs (PCPs) of length 2 O (1/ε) · n that can be checked using n ε queries for circuit-SAT instances of size n . Our PCPs have perfect completeness and constant soundness. This is the first constant-rate PCP construction that achieves constant soundness with nontrivial query complexity ( o ( n )). Our proof replaces the low-degree polynomials in algebraic PCP constructions with tensors of transitive algebraic geometry (AG) codes. We show that the automorphisms of an AG code can be used to simulate the role of affine transformations that are crucial in earlier high-rate algebraic PCP constructions. Using this observation, we conclude that any asymptotically good family of transitive AG codes over a constant-sized alphabet leads to a family of constant-rate PCPs with polynomially small query complexity. Such codes are constructed in the appendix to this article for the first time for every message length, building on an earlier construction for infinitely many message lengths by Stichtenoth [2006].

Subspace codes have received an increasing interest recently due to their application in error correction for random network coding. In particular, cyclic subspace codes are possible candidates for large codes with efficient encoding and decoding algorithms. In this paper, we consider such cyclic codes and provide constructions of optimal codes for which their codewords do not have full orbits. We further introduce a new way to represent subspace codes by a class of polynomials called subspace polynomials. We present some constructions of such codes, which are cyclic and analyze their parameters.

Subspace codes have received an increasing interest recently due to their application in error-correction for random network coding. In particular, cyclic subspace codes are possible candidates for large codes with efficient encoding and decoding algorithms. In this paper we consider such cyclic codes. We provide constructions of optimal cyclic codes for which their codewords do not have full length orbits. We further introduce a new way to represent subspace codes by a class of polynomials called subspace polynomials. We present some constructions of such codes which are cyclic and analyze their parameters.

Non-interactive zero-knowledge proofs (NIZKs) are a powerful cryptographic tool, with numerous potential applications. However, succinct NIZKs (e.g., zk-SNARK schemes) necessitate a trusted party to generate and publish some public parameters, to be used by all provers and verifiers. This party is trusted to correctly run a probabilistic algorithm (specified by the the proof system) that outputs the public parameters, and publish them, without leaking any other information (such as the internal randomness used by the algorithm), violating either requirement may allow malicious parties to produce convincing "proofs" of false statements. This trust requirement poses a serious impediment to deploying NIZKs in many applications, because a party that is trusted by all users of the envisioned system may simply not exist. In this work, we show how public parameters for a class of NIZKs can be generated by a multi-party protocol, such that if at least one of the parties is honest, then the result is secure (in both aforementioned senses) and can be subsequently used for generating and verifying numerous proofs without any further trust. We design and implement such a protocol, tailored to efficiently support the state-of-the-art NIZK constructions with short and easy-to-verify proofs (Parno et al. IEEE S&P '13, Ben-Sasson et al. USENIX Sec '14, Danezis et al., ASIACRYPT '14). Applications of our system include generating public parameters for systems such as Zero cash (Ben-Sasson et al. IEEE S&P '13) and the scalable zero-knowledge proof system of (Ben-Sasson et al. CRYPTO '14).

We establish a new connection between affine and two-source extractors by presenting black-box constructions of two-source extractors for min-entropy rate below half from any affine extractor for min-entropy rate below half. Two such constructions are presented, and one of our constructions can reach arbitrarily small min-entropy rate assuming that the affine extractor has sufficiently good parameters. The first part of our analysis shows that our constructions are two-source dispersers which are weak (but nontrivial) kinds of two-source extractors, also known as “bipartite Ramsey graphs.” To strengthen this result and obtain two-source extractors we introduce the approximate duality conjecture (ADC) and initiate its study. The ADC leads to a rather general result that can be used to convert a natural class of two-source dispersers---``low-rank dispersers''---into two-source extractors. More specifically, we first prove a special case of ADC that implies that the constructions mentioned above are two-source extractors with large (but nontrivial) constant error. In an attempt to reduce the error in our constructions we show that the polynomial Freiman--Ruzsa conjecture (PFR) in additive combinatorics implies a stronger “approximate duality” statement (and that this stronger statement also implies a weak but as-of-yet-unknown version of PFR). This stronger statement implies in turn that our constructions are two-source extractors with exponentially small error.

28 pages

Bit coin is the first digital currency to see widespread adoption. While payments are conducted between pseudonyms, Bit coin cannot offer strong privacy guarantees: payment transactions are recorded in a public decentralized ledger, from which much information can be deduced. Zero coin (Miers et al., IEEE S&P 2013) tackles some of these privacy issues by unlinking transactions from the payment's origin. Yet, it still reveals payments' destinations and amounts, and is limited in functionality. In this paper, we construct a full-fledged ledger-based digital currency with strong privacy guarantees. Our results leverage recent advances in zero-knowledge Succinct Non-interactive Arguments of Knowledge (zk-SNARKs). First, we formulate and construct decentralized anonymous payment schemes (DAP schemes). A DAP scheme enables users to directly pay each other privately: the corresponding transaction hides the payment's origin, destination, and transferred amount. We provide formal definitions and proofs of the construction's security. Second, we build Zero cash, a practical instantiation of our DAP scheme construction. In Zero cash, transactions are less than 1 kB and take under 6 ms to verify - orders of magnitude more efficient than the less-anonymous Zero coin and competitive with plain Bit coin.

Identifying complexity measures that bound the communication complexity of a {0,1}-valued matrix M is one the most fundamental problems in communication complexity. Mehlhorn and Schmidt [1982] were the first to suggest matrix-rank as one such measure. Among other things, they showed log rank F(M) CC(M) rankF2(M), where CC ( M ) denotes the (deterministic) communication complexity of the function associated with M , and the rank on the left-hand side is over any field F and on the right-hand side it is over the two-element field F 2. For certain matrices M , communication complexity equals the right-hand side, and this completely settles the question of “communication complexity vs. F 2-rank”. Here we reopen this question by pointing out that, when M has an additional natural combinatorial property---high discrepancy with respect to distributions which are uniform over submatrices---then communication complexity can be sublinear in F 2-rank. Assuming the Polynomial Freiman-Ruzsa (PFR) conjecture in additive combinatorics, we show that CC(M) O(rank F2(M)/log rank F2(M)) for any matrix M which satisfies this combinatorial property. We also observe that if M has low rank over the reals, then it has low rank over F 2 and it additionally satisfies this combinatorial property. As a corollary, our results also give the first (conditional) sublinear bound on communication complexity in terms of rank over the reals, a result improved later by Lovett [2014]. Our proof is based on the study of the “approximate duality conjecture” which was suggested by Ben-Sasson and Zewi [2011] and studied there in connection to the PFR conjecture. First, we improve the bounds on approximate duality assuming the PFR conjecture. Then, we use the approximate duality conjecture (with improved bounds) to get our upper bound on the communication complexity of low-rank matrices.

The PCP theorem (Arora et. al., J. ACM 45(1, 3)) says that every NP-proof can be encoded to another proof, namely, a probabilistically checkable proof (PCP), which can be tested by a verifier that queries only a small part of the PCP. A natural question is how large is the blow-up incurred by this encoding, i.e., how long is the PCP compared to the original NP-proof. The state-of-the-art work of Ben-Sasson and Sudan (SICOMP 38(2)) and Dinur (J. ACM 54(3)) shows that one can encode proofs of length n by PCPs of quasi-linear length that can be verified using a constant number of queries. In this work, we show that if the query complexity is relaxed to polynomial, then one can construct PCPs of linear length for circuit-SAT, and PCPs of length O(tlog t) for any language in NTIME(t). Our PCPs have perfect completeness and constant soundness. This is the first constant-rate PCP construction that achieves constant soundness with nontrivial query complexity. Our proof replaces the low-degree polynomials in algebraic PCP constructions with tensors of transitive algebraic geometry (AG) codes. We show that the automorphisms of an AG code can be used to simulate the role of affine transformations which are crucial in earlier high-rate algebraic PCP constructions. Using this observation we conclude that any asymptotically good family of transitive AG codes over a constant-sized alphabet leads to a family of constant-rate PCPs with polynomially small query complexity. Such codes are constructed for the first time for every message length.

Succinct arguments for NP are proof systems that allow a weak verifier to retroactively check computation done by a powerful prover. Constructions of such protocols prove membership in languages consisting of very large yet succinctly-represented constraint satisfaction problems that, alas, are unnatural in the sense that the problems that arise in practice are not in such form. For general computation tasks, the most natural representation is typically as random-access machine (RAM) algorithms, because such a representation can be obtained very efficiently by applying a compiler to code written in a high-level programming language. Thus, understanding the efficiency of reductions from RAM computations to other NP-complete problem representations for which succinct arguments (or proofs) are known is a prerequisite to a more complete understanding of the applicability of these arguments.

Probabilistically-Checkable Proofs (PCPs) form the algorithmic core that enables fast verification of long computations in many cryptographic constructions. Yet, despite the wonderful asymptotic savings they bring, PCPs are also the infamous computational bottleneck preventing these powerful cryptographic constructions from being used in practice. To address this problem, we present several results about the computational efficiency of PCPs. We construct the first PCP where the prover and verifier time complexities are quasi-optimal (i.e., optimal up to poly-logarithmic factors). The prover and verifier are also higly-parallelizable, and these computational guarantees hold even when proving and verifying the correctness of random-access machine computations. Our construction is explicit and has the requisite properties for being used in the cryptographic applications mentioned above.

We describe new constructions of error correcting codes, obtained by "degree-lifting" a short algebraic geometry base-code of block-length q to a lifted-code of block-length qm, for arbitrary integer m. The construction generalizes the way degree-d, univariate polynomials evaluated over the q-element field (also known as Reed-Solomon codes) are "lifted" to degree-d, m-variate polynomials (Reed-Muller codes). A number of properties are established: The rate of the degree-lifted code is approximately a 1/m!-fraction of the rate of the base-code. The relative distance of the degree-lifted code is at least as large as that of the base-code. This is proved using a generalization of the Schwartz-Zippel Lemma to degree-lifted Algebraic-Geometry codes. [Local correction] If the base code is invariant under a group that is "close" to being doubly-transitive (in a precise manner defined later then the degree-lifted code is locally correctable with query complexity at most q2. The automorphisms of the base-code are crucially used to generate query-sets, abstracting the use of affine-lines in the local correction procedure of Reed-Muller codes. Taking a concrete illustrating example, we show that degree-lifted Hermitian codes form a family of locally correctable codes over an alphabet that is significantly smaller than that obtained by Reed-Muller codes of similar constant rate, message length, and distance.

For a {0, 1}-valued matrix M let CC(M) denote the deterministic communication complexity of the boolean function associated with M. It is well-known since the work of Mehlhorn and Schmidt [STOC 1982] that CC(M) is bounded from above by rank(M) and from below by log rank(M) where rank(M) denotes the rank of M over the field of real numbers. Determining where in this range lies the true worst-case value of CC(M) is a fundamental open problem in communication complexity. The state of the art is log1.631rank(M) ≤ CC(M) ≤ 0.415 rank(M), the lower bound is by Kushilevitz [unpublished, 1995] and the upper bound is due to Kotlov [Journal of Graph Theory, 1996]. Lovasz and Saks [FOCS 1988] conjecture that CC(M) is closer to the lower bound, i.e., CC(M)≤ logcrank(M)) for some absolute constant c - this is the famous "log-rank conjecture'' - but so far there has been no evidence to support it, even giving a slightly non-trivial (o(rank(M))) upper bound on the communication complexity. Our main result is that, assuming the Polynomial Freiman-Ruzsa (PFR) conjecture in additive combinatorics, there exists a universal constant c such that CC(M) ≤ c ·rank(M)/log rank(M). Although our bound is stated using the rank of M over the reals, our proof goes by studying the problem over the finite field of size 2, and there we bring to bear a number of new tools from additive combinatorics which we hope will facilitate further progress on this perplexing question. In more detail, our proof is based on the study of the "approximate duality conjecture'' which was suggested by Ben-Sasson and Zewi [STOC 2011] and studied there in connection to the PFR conjecture. First we improve the bounds on approximate duality assuming the PFR conjecture. Then we use the approximate duality conjecture (with improved bounds) to get our upper bound on the communication complexity of low-rank martices.

We show that sparse affine-invariant linear properties over arbitrary finite fields are locally testable with a constant number of queries. Given a finite field Fqand an extension field Fqn, a property is a set of functions mapping Fqnto Fq. The property is said to be affine-invariant if it is invariant under affine transformations of Fqn, and it is said to be sparse if its size is polynomial in the domain size. Our work completes a line of work initiated by Grigorescu et al. [RANDOM 2009] and followed by Kaufman and Lovett [FOCS 2011]. The latter showed such a result for the case when q was prime. Extending to non-prime cases turns out to be non-trivial and our proof involves some detours into additive combinatorics, as well as a new calculus for building property testers for affine-invariant linear properties.

An affine disperser over F2n for sources of dimension d is a function f: F2n → F2 such that for any affine space S ⊆ F2n of dimension at least d, we have {f(s) : s in S} = F2. Affine dispersers have been considered in the context of deterministic extraction of randomness from structured sources of imperfect randomness. Previously, explicit constructions of affine dispersers were known for every d = Ω(n), due to Barak et. al.[2] and Bourgain[10] (the latter in fact gives stronger objects called affine extractors). In this work we give the first explicit affine dispersers for sublinear dimension. Specifically, our dispersers work even when d = Ω(n4/5). The main novelty in our construction lies in the method of proof, which relies on elementary properties of subspace polynomials. In contrast, the previous works mentioned above relied on sum-product theorems for finite fields.

Locally testable codes, i.e., codes where membership in the code is testable with a constant number of queries, have played a central role in complexity theory. It is well known that a code must be a "low-density parity check'' (LDPC) code for it to be locally testable, but few LDPC codes are known to be locally testable, and even fewer classes of LDPC codes are known not to be locally testable. Indeed, most previous examples of codes that are not locally testable were also not LDPC. The only exception was in the work of Ben-Sasson et al. [SIAM J. Computing, 2005] who showed that random LDPC codes are not locally testable. Random codes lack "structure'' and in particular "symmetries'' motivating the possibility that "symmetric LDPC'' codes are locally testable, a question raised in the work of Alon et al. [IEEE Trans. Inf. Th., 2005]. If true such a result would capture many of the basic ingredients of known locally testable codes. In this work we rule out such a possibility by giving a highly symmetric ("2-transitive'') family of LDPC codes that are not testable with a constant number of queries. We do so by continuing the exploration of ``affine-invariant codes'' - codes where the coordinates of the words are associated with a finite field, and the code is invariant under affine transformations of the field. New to our study is the use of fields that have many subfields, and showing that such a setting allows sufficient richness to provide new obstacles to local testability, even in the presence of structure and symmetry.

The main open problem in the area of locally testable codes (LTCs) is whether there exists an asymptotically good family of LTCs and to resolve this question it suffices to consider the case of query complexity 3. We argue that to refute the existence of such an asymptotically good family one should prove that the number of dual codewords of weight at most 3 is super-linear in the blocklength of the code. The main technical contribution of this paper is an improvement of the combinatorial lemma of Goldreich et al. [2006] which bounds the rate of 2-query locally decodable codes (LDCs) and is used in state-of-the-art rate-bounds for linear LDCs. The lemma of Goldreich et al. bounds the rate of 2-query LDCs of blocklength n in terms of the corruption parameter δ(n) - this is the maximal fraction of corrupted codeword bits for which a (2-query) decoder can recover correctly every message bit (with high probability). Our combinatorial lemma gives nontrivial rate bounds for any corruption parameter δ(n) such that δ(n) · n = ω(1), whereas the previous lemma works only for corruption parameter δ(n) such that δ(n) · n ≥ log n. The study of LDCs with sublinear corruption parameter is also motivated by Dvir's [2010] observation that sufficiently strong bounds on the rate of such LDCs imply explicit constructions of rigid matrices.

Clause learning is a technique used by backtracking-based propositional satisfiability solvers, where some clauses obtained by analysis of conflicts are added to the formula during backtracking. It has been observed empirically that clause learning does not significantly improve the performance of a solver when restricted to learning clauses of small width only. This experience is supported by lower bound theorems. It is shown that lower bounds on the runtime of width-restricted clause learning follow from lower bounds on the width of resolution proofs. This yields the first lower bounds on width-restricted clause learning for formulas in 3-CNF.

Two-source and affine extractors and dispersers are fundamental objects studied in the context of derandomization. This paper shows how to construct two-source extractors and dispersers for arbitrarily small min-entropy rate in a black-box manner given affine extractors with sufficiently good parameters. Our analysis relies on the study of approximate duality, a concept related to the polynomial Freiman-Ruzsa conjecture (PFR) from additive combinatorics. Two black-box constructions of two-source extractors from affine ones are presented. Both constructions work for min-entropy rate ρ0. We show that assuming the PFR conjecture, the error of this two-source extractor is exponentially small.The extractor-to-disperser reduction arises from studying approximate duality, a notion related to additive combinatorics. The duality measure of two sets A,B ⊆ F_2n aims to quantify how close these sets are to being dual and is defined as [u(A,B)=|Ea ∈ A, b ∈ B[(-1)∑i=1n ai bi]|] Notice that u(A,B)=1 implies that A is contained in an affine shift of B⊥ --- the space dual to the F2span of B. We study what can be said of A,B when their duality measure is large but strictly smaller than 1 and show that A,B contain subsets A',B' of nontrivial size for which u(A',B')=1 and consequently A' is contained in an affine shift of (B')⊥. This implies that our constructions are two-source extractors with constant error. Surprisingly, the PFR implies that such A',B' exist exist when A,B are large, even if the duality measure is exponentially small in $n$, and this implication leads to two-source extractors with exponentially small error.

Locally testable codes (LTCs) are error-correcting codes for which membership, in the code, of a given word can be tested by examining it in very few locations. Most known constructions of LTCs are linear codes and give error-correcting codes whose duals have (superlinearly) many small weight codewords. Examining this feature appears to be one of the promising approaches to proving limitation results for (i.e., upper bounds on the rate of) LTCs. Unfortunately, until now it has not even been known whether LTCs need to be nontrivially redundant, i.e., need to have one linear dependency among the low-weight codewords in their dual. In this paper we give the first lower bound of this form, by showing that every positive rate constant query strong LTC must have linearly many redundant low-weight codewords in its dual. We actually prove the stronger claim that the actual test itself must use a linear number of redundant dual codewords (beyond the minimum number of basis elements required to characterize the code); in other words, nonredundant (in fact, low redundancy) local testing is impossible. Our main theorem is a special case of a more general theorem that applies to any tester for an arbitrary linear LTC $\mathcal{C}$. The general theorem can be used, for instance, to provide an arguably simpler proof of the main result of Ben-Sasson, Harsha, and Raskhodnikova [SIAM J. Comput., 35 (2005), pp. 1–21], which says that testing random low density parity check (LDPC) codes requires linear query complexity. Informally, our more general theorem says the following. Take any basis B for the dual code of $\mathcal{C}$ that is composed of words of small support; i.e., every element of B has very few nonzero entries. Then the dual code of $\mathcal{C}$ must contain many words that (i) are not in B, (ii) have small support, and, most importantly, (iii) are a linear combination of a constant fraction of B.

We show combinatorial limitations on efficient list decoding of Reed-Solomon codes beyond the Johnson-Guraswami-Sudan bounds. In particular, we show that for arbitrarily large fields FN, |FN| = N, for any ¿ ¿ (0,1), and K = N¿: (1) Existence: there exists a received word wN: FN¿ FNthat agrees with a super-polynomial number of distinct degree K polynomials on ¿ N¿¿points each; (2) Explicit: there exists a polynomial time constructible received word w'N: FN¿ FNthat agrees with a superpolynomial number of distinct degree K polynomials, on ¿2¿(log N)K points each. In both cases, our results improve upon the previous state of the art, which was ¿ N¿/¿ points of agreement for the existence case (proved by Justesen and Hoholdt), and ¿ 2N¿points of agreement for the explicit case (proved by Guruswami and Rudra). Furthermore, for ¿ close to 1 our bound approaches the Guruswami-Sudan bound (which is ¿(N K)) and implies limitations on extending their efficient Reed-Solomon list decoding algorithm to larger decoding radius. Our proof is based on some remarkable properties of sub-space polynomials. Using similar ideas, we then present a family of low rate codes that are efficiently list-decodable beyond the Johnson bound. This leads to an optimal list-decoding algorithm for the family of matrix-codes.

We present a simple proof of the bounded-depth Frege proof lower bounds of Pitassi et al. [1993] and Krajíček et al. [1995] for the pigeonhole principle. Our method uses the interpretation of proofs as two player games given by Pudlák and Buss. Our lower bound is conceptually simpler than previous ones, and relies on tools and intuition that are well known in the context of computational complexity. This makes the lower bound of Pitassi et al. [1993] and Krajíček et al. [1995] accessible to the general computational complexity audience. We hope this new view will open new directions for research in proof complexity.

Locally testable codes (LTCs) are error- correcting codes for which membership, in the code, of a given word can be tested by examining it in very few locations. Most known constructions of locally testable codes are linear codes, and give error-correcting codes whose duals have (superlinearly) many small weight codewords. Examining this feature appears to be one of the promising approaches to proving limitation results for (i.e., upper bounds on the rate of) LTCs. Unfortunately till now it was not even known if LTCs need to be non-trivially redundant, i.e., need to have one linear dependency among the low-weight codewords in its dual. In this paper we give the first lower bound of this form, by showing that every positive rate constant query strong LTC must have linearly many redundant low-weight codewords in its dual. We actually prove the stronger claim that the actual test itself must use a linear number of redundant dual codewords (beyond the minimum number of basis elements required to characterize the code); in other words, non-redundant (in fact, low redundancy) local testing is impossible.

A number of works have looked at the relationship between length and space of resolution proofs. A notorious question has been whether the existence of a short proof implies the existence of a proof that can be verified using limited space.In this paper we resolve the question by answering it negatively in the strongest possible way. We show that there are families of 6-CNF formulas of size n, for arbitrarily large n, that have resolution proofs of length O(n) but for which any proof requires space Omega(n / log n). This is the strongest asymptotic separation possible since any proof of length O(n) can always be transformed into a proof in space O(n / log n).Our result follows by reducing the space complexity of so called pebbling formulas over a directed acyclic graph to the black-white pebbling price of the graph.The proof is somewhat simpler than previous results (in particular, those reported in [Nordstrom 2006, Nordstrom and Hastad 2008]) as it uses a slightly different flavor of pebbling formulas which allows for a rather straightforward reduction of proof space to standard black-white pebbling price.

We give constructions of probabilistically checkable proofs (PCPs) of length $n \cdot polylog n$ proving satisfiability of circuits of size n that can be verified by querying $polylog n$ bits of the proof. We also give analogous constructions of locally testable codes (LTCs) mapping n information bits to $n\cdot polylog n$ bit long codewords that are testable with $polylog n$ queries. Our constructions rely on new techniques revolving around properties of codes based on relatively high-degree polynomials in one variable, i.e., Reed–Solomon codes. In contrast, previous constructions of short PCPs, beginning with [L. Babai, L. Fortnow, L. Levin, and M. Szegedy, Checking computations in polylogarithmic time, in Proceedings of the 23rd ACM Symposium on Theory of Computing, ACM, New York, 1991, pp. 21–31] and until the recent [E. Ben-Sasson, O. Goldreich, P. Harsha, M. Sudan, and S. Vadhan, Robust PCPs of proximity, shorter PCPs, and applications to coding, in Proceedings of the 36th ACM Symposium on Theory of Computing, ACM, New York, 2004, pp. 13–15], relied extensively on properties of low-degree polynomials in many variables. We show how to convert the problem of verifying the satisfaction of a circuit by a given assignment to the task of verifying that a given function is close to being a Reed–Solomon codeword, i.e., a univariate polynomial of specified degree. This reduction also gives an alternative to using the “sumcheck protocol” [C. Lund, L. Fortnow, H. Karloff, and N. Nisan, J. ACM, 39 (1992), pp. 859–868]. We then give a new PCP for the special task of proving that a function is close to being a Reed–Solomon codeword. The resulting PCPs are not only shorter than previous ones but also arguably simpler. In fact, our constructions are also more natural in that they yield locally testable codes first, which are then converted to PCPs. In contrast, most recent constructions go in the opposite direction of getting locally testable codes from PCPs.

We show combinatorial limitations on efficient list decoding of Reed-Solomon codes beyond the Johnson and Guruswami-Sudan bounds in the works of S.M. Johnson (1962, 1963) and V. Guruswami and M. Sudan (1999). In particular, we show that for arbitrarily large fields FN, |FN| - N, for any delta isin (0,1), and K = Ndelta;: middot Existence: there exists a received word wN: FNrarr FNthat agrees with a super-polynomial number of distinct degree K polynomials on ap Nradicdeltapoints each; middot Explicit: there exists a polynomial time constructible received word w'N: FNrarr FNthat agrees with a super-polynomial number of distinct degree K polynomials, on ap 2radic(log N)K points each. In both cases, our results improve upon the previous state of the art, which was ap Ndelta/delta for the existence case in the work J. Justesen and T. Hoboldt (2001), and ap 2Ndeltafor the explicit one in the work of V. Guruswami and M. Sudan (2005). Furthermore, for delta close to 1 our bound approaches the Guruswami-Sudan bound (which is radicNK) and implies limitations on extending their efficient RS list decoding algorithm to larger decoding radius. Our proof method is surprisingly simple. We work with polynomials that vanish on subspaces of an extension field viewed as a vector space over the base field. These sub-space polynomials are a subclass of linearized polynomials that were first studied by O. Ore (1933, 1934) in the 1930s, and later by coding theorists. For us their main attraction is their sparsity and abundance of roots, virtues that recently won them pivotal roles in probabilistically checkable proofs of proximity in the works of E. Ben-Sasson et al. (2004) and E. Ben-Sasson and M. Sudan (2005) and sub-linear proof verification in the work of E. Ben-Sasson et al. (2005)

A central question in game theory and artificial intelligence is how a rational agent should behave in a complex environment, given that it cannot perform unbounded computations. We study strategic aspects of this question by formulating a simple model of a game with additional costs (computational or otherwise) for each strategy. First we connect this to zero-sum games, proving a counter-intuitive generalization of the classic min-max theorem to zero-sum games with the addition of strategy costs. We then show that potential games with strategy costs remain potential games. Both zero-sum and potential games with strategy costs maintain a very appealing property: simple learning dynamics converge to equilibrium. 1 The Approach and Basic Model How should an intelligent agent play a complicated game like chess, given that it does not have unlimited time to think? This question reflects one fundamental aspect of "bounded rationality," a term coined by Herbert Simon [1]. However, bounded rationality has proven to be a slippery concept to formalize (prior work has focused largely on finite automata playing simple repeated games such as prisoner's dilemma, e.g. [2, 3, 4, 5]). This paper focuses on the strategic aspects of decisionmaking in complex multi-agent environments, i.e., on how a player should choose among strategies of varying complexity, given that its opponents are making similar decisions. Our model applies to general strategic games and allows for a variety of complexities that arise in real-world applications. For this reason, it is applicable to one-shot games, to extensive games, and to repeated games, and it generalizes existing models such as repeated games played by finite automata. To easily see that bounded rationality can drastically affect the outcome of a game, consider the following factoring game. Player 1 chooses an n-bit number and sends it to Player 2, who attempts to find its prime factorization. If Player 2 is correct, he is paid 1 by Player 1, otherwise he pays 1 to Player 1. Ignoring complexity costs, the game is a trivial win for Player 2. However, for large n, the game should is essentially a win for Player 1, who can easily output a large random number that Player 2 cannot factor (under appropriate complexity assumptions). In general, the outcome of a game (even a zero-sum game like chess) with bounded rationality is not so clear. To concretely model such games, we consider a set of available strategies along with strategy costs. Consider an example of two players preparing to play a computerized chess game for $100K prize. Suppose the players simultaneously choose among two available options: to use a $10K program A or an advanced program B, which costs $50K. We refer to the row chooser as white and to the column chooser as black, with the corresponding advantages reflected by the win probabilities of white described in Table 1a. For example, when both players use program A, white wins 55% of the time and black wins 45% of the time (we ignore draws). The players naturally want to choose strategies to maximize their expected net payoffs, i.e., their expected payoff minus their cost. Each cell in Table 1b contains a pair of payoffs in units of thousands of dollars; the first is white's net expected payoff and the second is black's. a) A B A 55% 93% B 13% 51% b) A (-10) B (-50) A (-10) 45, 35 43,-3 B (-50) 3, 37 1,-1 Figure 1: a) Table of first-player winning probabilities based on program choices. b) Table of expected net earnings in thousands of dollars. The unique equilibrium is (A,B) which strongly favors the second player. A surprising property is evident in the above game. Everything about the game seems to favor white. Yet due to the (symmetric) costs, at the unique Nash equilibrium (A,B) of Table 1b, black wins 87% of the time and nets $34K more than white. In fact, it is a dominant strategy for white to play A and for black to play B. To see this, note that playing B increases white's probability of winning by 38%, independent of what black chooses. Since the pot is $100K, this is worth $38K in expectation, but B costs $40K more than A. On the other hand, black enjoys a 42% increase in probability of winning due to B, independent of what white does, and hence is willing to pay the extra $40K. Before formulating the general model, we comment on some important aspects of the chess example. First, traditional game theory states that chess can be solved in "only" two rounds of elimination of dominated strategies [10], and the outcome with optimal play should always be the same: either a win for white or a win for black. This theoretical prediction fails in practice: in top play, the outcome is very nondeterministic with white winning roughly twice as often as black. The game is too large and complex to be solved by brute force. Second, we have been able to analyze the above chess program selection example exactly because we formulated as a game with a small number of available strategies per player. Another formulation that would fit into our model would be to include all strategies of chess, with some reasonable computational costs. However, it is beyond our means to analyze such a large game. Third, in the example above we used monetary software cost to illustrate a type of strategy cost. But the same analysis could accommodate many other types of costs that can be measured numerically and subtracted from the payoffs, such as time or effort involved in the development or execution of a strategy, and other resource costs. Additional examples in this paper include the number of states in a finite automaton, the number of gates in a circuit, and the number of turns on a commuter's route. Our analysis is limited, however, to cost functions that depend only on the strategy of the player and not the strategy chosen by its opponent. For example, if our players above were renting computers A or B and paying for the time of actual usage, then the cost of using A would depend on the choice of computer made by the opponent. Generalizing the example above, we consider a normal form game with the addition of strategy costs, a player-dependent cost for playing each available strategy. Our main results regard two important classes of games: constant-sum and potential games. Potential games with strategy costs remain potential games. While two-person constant-sum games are no longer constant, we give a basic structural description of optimal play in these games. Lastly, we show that known learning dynamics converge in both classes of games. 2 Definition of strategy costs We first define an N -person normal-form game G = (N , S, p) consisting of finite sets of (available) pure strategies S = (S1 , . . . , SN ) for the N players, and a payoff function p : S1 . . . SN RN . Players simultaneously choose strategies si Si after which player i is rewarded with pi (s1 , . . . , sN ). A randomized or mixed strategy i for player i is a probability distribution over its pure strategies Si , x . x i i = R|Si | : = 1, xj 0 j We extend p to 1 . . . N in the natural way, i.e., pi (1 , . . . , N ) = E[pi (s1 , . . . , sN )] where each si is drawn from i , independently. Denote by s-i = (s1 , s2 , . . . , si-1 , si+1 , . . . , sN ) and similarly for -i . A best response by player i to -i is i i such that pi (i , -i ) = maxi i pi (i , -i ). A (mixed strategy) Nash equilibrium of G is a vector of strategies (1 , . . . , N ) 1 . . . N such that each i is a best response to -i . We now define G-c , the game G with strategy costs c = (c1 , . . . , cN ), where ci : Si R. It is simply an N -person normal-form game G-c = (N , S, p-c ) with the same sets of pure strategies as G, but with a new payoff function p-c : S1 . . . SN RN where, p-c (s1 , . . . , sN ) = pi (s1 , . . . , sN ) - ci (si ), for i = 1, . . . , N . i We similarly extend ci to i in the natural way. 3 Two-person constant-sum games with strategy costs Recall that a game is constant-sum (k -sum for short) if at every combination of individual strategies, the players' payoffs sum to some constant k. Two-person k -sum games have some important properties, not shared by general sum games, which result in more effective game-theoretic analysis. In particular, every k -sum game has a unique value v R. A mixed strategy for player 1 is called optimal if it guarantees payoff v against any strategy of player 2. A mixed strategy for player 2 is optimal if it guarantees k - v against any strategy of player 1. The term optimal is used because optimal strategies guarantee as much as possible (v + k - v = k ) and playing anything that is not optimal can result in a lesser payoff, if the opponent responds appropriately. (This fact is easily illustrated in the game rock-paper-scissors randomizing uniformly among the strategies guarantees each player 50% of the pot, while playing anything other than uniformly random enables the opponent to win strictly more often.) The existence of optimal strategies for both players follows from the min-max theorem. An easy corollary is that the Nash equilibria of a k -sum game are exchangeable: they are simply the cross-product of the sets of optimal mixed strategies for both players. Lastly, it is well-known that equilibria in two-person k -sum games can be learned in repeated play by simple dynamics that are guaranteed to converge [17]. With the addition of strategy costs, a k -sum game is no longer k -sum and hence it is not clear, at first, what optimal strategies there are, if any. (Many examples of general-sum games do not have optimal strategies.) We show the following generalization of the above properties for zero-sum games with strategies costs. Theorem 1. Let G be a finite two-person k -sum game and G-c be the game with strategy costs c = (c1 , c2 ). 1. There is a value v R for G-c and nonempty sets OPT1 and OPT2 of optimal mixed strategies for the two players. OPT1 is the set of strategies that guarantee player 1 payoff v - c2 (2 ), against any strategy 2 chosen by player 2. Similarly, OPT2 is the set of strategies that guarantee player 2 payoff k - v - c1 (1 ) against any 1 . 2. The Nash equilibria of G-c are exchangeable: the set of Nash equilibria is OPT1 OPT2 . 3. The set of net payoffs possible at equilibrium is an axis-parallel rectangle in R2 . For zero-sum games, the term optimal strategy was natural: the players could guarantee v and k - v , respectively, and this is all that there was to share. Moreover, it is easy to see that only pairs of optimal strategies can have the Nash equilibria property, being best responses to each other. In the case of zero-sum games with strategy costs, the optimal structure is somewhat counterintuitive. First, it is strange that the amount guaranteed by either player depends on the cost of the other player's action, when in reality each player pays the cost of its own action. Second, it is not even clear why we call these optimal strategies. To get a feel for this latter issue, notice that the sum of the net payoffs to the two players is always k - c1 (1 ) - c2 (2 ), which is exactly the total of what optimal strategies guarantee, v - c2 (2 ) + k - v - c1 (1 ). Hence, if both players play what we call optimal strategies, then neither player can improve and they are at Nash equilibrium. On the other hand, suppose player 1 selects a strategy 1 that does not guarantee him payoff at least v - c2 (2 ). This means that there is some response 2 by player 2 for which player 1's payoff is < v - c2 (2 ) and hence player 2's payoff is > k - v - c1 (1 ). Thus player 2's best response to 1 must give player 2 payoff > k - v - c1 (1 ) and leave player 1 with < v - c2 (2 ). The proof of the theorem (the above reasoning only implies part 2 from part 1) is based on the following simple observation. Consider the k -sum game H = (N , S, q ) with the following payoffs: q1 (s1 , s2 ) = p1 (s1 , s2 ) - c1 (s1 ) + c2 (s2 ) = p-c (s1 , s2 ) + c2 (s2 ) 1 q2 (s1 , s2 ) = p2 (s1 , s2 ) - c2 (s1 ) + c1 (s1 ) = p-c (s1 , s2 ) + c1 (s1 ) 2 That is to say, Player 1 pays its strategy cost to Player 2 and vice versa. It is easy to verify that, 1 , 1 1 , 2 2 q1 (1 , 2 ) - q1 (1 , 2 ) = p-c (1 , 2 ) - p-c (1 , 2 ) 1 1 (1) This means that the relative advantage in switching strategies in games G-c and H are the same. In particular, 1 is a best response to 2 in G-c if and only if it is in H . A similar equality holds for player 2's payoffs. Note that these conditions imply that the games G-c and H are strategically equivalent in the sense defined by Moulin and Vial [16]. Proof of Theorem 1. Let v be the value of the game H . For any strategy 1 that guarantees player 1 payoff v in H , 1 guarantees player 1 v - c2 (2 ) in G-c . This follows from the definition of H . Similarly, any strategy 2 that guarantees player 2 payoff k - v in H will guarantee k - v - c1 (1 ) in G-c . Thus the sets OPT1 and OPT2 are non-empty. Since v - c2 (2 ) + k - v - c1 (1 ) = k - c1 (1 ) - c2 (2 ) is the sum of the payoffs in G-c , nothing greater can be guaranteed by either player. Since the best responses of G-c and H are the same, the Nash equilibria of the two games are the same. Since H is a k -sum game, its Nash equilibria are exchangeable, and thus we have part 2. (This holds for any game that is strategically equivalent to k -sum.) Finally, the optimal mixed strategies OPT1 , OPT2 of any k -sum game are convex sets. If we look at the achievable costs of the mixed strategies in OPTi , by the definition of the cost of a mixed strategy, this will be a convex subset of R, i.e., an interval. By parts 1 and 2, the set of achievable net payoffs at equilibria of G-c are therefore the cross-product of intervals. To illustrate Theorem 1 graphically, Figure 2 gives a 4 4 example with costs of 1, 2, 3, and 4, respectively. It illustrates a situation with multiple optimal strategies. Notice that player 1 is completely indifferent between its optimal choices A and B, and player 2 is completely indifferent between C and D. Thus the only question is how kind they would like to be to their opponent. The (A,C) equilibrium is perhaps most natural as it is yields the highest payoffs for both parties. Note that the proof of the above theorem actually shows that zero-sum games with costs share additional appealing properties of zero-sum games. For example, computing optimal strategies is a polynomial time-computation in an n n game, as it amounts to computing the equilibria of H . We next show that they also have appealing learning properties, though they do not share all properties of zero-sum games.1 3.1 Learning in repeated two-person k -sum games with strategy costs Another desirable property of k -sum games is that, in repeated play, natural learning dynamics converge to the set of Nash equilibria. Before we state the analogous conditions for k -sum games with costs, we briefly give a few definitions. A repeated game is one in which players chooses a sequence of strategies vectors s1 , s2 , . . ., where each st = (st , . . . , st ) is a strategy vector of some 1 N fixed stage game G = (N , S, p). Under perfect monitoring, when selecting an action in any period the players know all the previous selected actions.As we shall discuss, it is possible to learn to play without perfect monitoring as well. 1 One property that is violated by the chess example is the "advantage of an advantage" property. Say Player 1 has the advantage over Player 2 in a square game if p1 (s1 , s2 ) p2 (s2 , s1 ) for all strategies s1 , s2 . At equilibrium of a k-sum game, a player with the advantage must have a payoff at least as large as its opponent. This is no longer the case after incorporating strategy costs, as seen in the chess example, where Player 1 has the advantage (even including strategy costs), yet his equilibrium payoff is smaller than 2's. a) A B C D b) A (-1) B (-2) C (-3) D (-4) A 6, 4 7, 3 7.5, 2.5 8.5, 1.5 A (-1) 5, 3 5, 2 4.5, 1.5 4.5, 0.5 B 5, 5 6, 4 6.5, 3.5 7, 3 B (-2) 4, 3 4, 2 3.5, 1.5 3, 1 C 3, 7 4, 6 4.5, 5.5 5.5, 4.5 C (-3) 2, 4 2, 3 1.5, 2.5 1.5, 1.5 D 2, 8 3, 7 3.5, 6.5 4.5, 5.5 D (-4) 1, 4 1, 3 0.5, 2.5 0.5, 1.5 PLAYER 2 NET PAYOFF

We continue the study of the trade‐off between the length of probabilistically checkable proofs (PCPs) and their query complexity, establishing the following main results (which refer to proofs of satisfiability of circuits of size n): 1. We present PCPs of length $\exp(o(\log\log n)^2)\cdot n$ that can be verified by making $o(\log\log n)$ Boolean queries. 2. For every \epsilon>0, we present PCPs of length $\exp(\log^\epsilon n)\cdot n$ that can be verified by making a constant number of Boolean queries. In both cases, false assertions are rejected with constant probability (which may be set to be arbitrarily close to 1). The multiplicative overhead on the length of the proof, introduced by transforming a proof into a probabilistically checkable one, is just quasi polylogarithmic in the first case (of query complexity $o(\log\log n)$), and is $2^{(\log n)^\epsilon}$, for any $\epsilon > 0$, in the second case (of constant query complexity). Our techniques include the introduction of a new variant of PCPs that we call “robust PCPs of proximity.” These new PCPs facilitate proof composition, which is a central ingredient in the construction of PCP systems. (A related notion and its composition properties were discovered independently by Dinur and Reingold.) Our main technical contribution is a construction of a “length‐efficient” robust PCP of proximity. While the new construction uses many of the standard techniques used in PCP constructions, it does differ from previous constructions in fundamental ways, and in particular does not use the “parallelization” step of Arora et al. [J. ACM, 45 (1998), pp. 501–555]. The alternative approach may be of independent interest. We also obtain analogous quantitative results for locally testable codes. In addition, we introduce a relaxed notion of locally decodable codes and present such codes mapping k information bits to codewords of length $k^{1+\epsilon}$ for any $\epsilon>0$.

We show that every language in NP has a probabilistically checkable proof of proximity (i.e., proofs asserting that an instance is "close" to a member of the language), where the verifier's running time is polylogarithmic in the input size and the length of the probabilistically checkable proof is only polylogarithmically larger that the length of the classical proof. (Such a verifier can only query polylogarithmically many bits of the input instance and the proof. Thus it needs oracle access to the input as well as the proof, and cannot guarantee that the input is in the language - only that it is close to some string in the language.) If the verifier is restricted further in its query complexity and only allowed q queries, then the proof size blows up by a factor of 2/sup (log n)c/q/ where the constant c depends only on the language (and is independent of q). Our results thus give efficient (in the sense of running time) versions of the shortest known PCPs, due to Ben-Sasson et al. (STOC '04) and Ben-Sasson and Sudan (STOC '05), respectively. The time complexity of the verifier and the size of the proof were the original emphases in the definition of holographic proofs, due to Babai et al. (STOC '91), and our work is the first to return to these emphases since their work. Of technical interest in our proof is a new complete problem for NEXP based on constraint satisfaction problems with very low complexity constraints, and techniques to arithmetize such constraints over fields of small characteristic.

We give constructions of probabilistically checkable proofs (PCPs) of length n . poly(log n) (to prove satisfiability of circuits of size n) that can verified by querying poly(log n) bits of the proof. We also give constructions of locally testable codes (LTCs) with similar parameters.Previous constructions of short PCPs (from [5]to [9]) relied extensively on properties of low degree multi-variate polynomials. In contrast, our constructions rely on new problems and techniques revolving around the properties of codes based on high degree polynomials in one variable (also known as Reed-Solomon codes). We show how to convert the problem of verifying the satisfaction of a circuit by a given assignment to the task of verifying that a given function is close to being a Reed-Solomon codeword, i.e., a univariate polynomial of specified degree. This reduction is simpler than the corresponding steps in previous reductions, and gives a new alternative to using the popular "sum-check protocol". We then give a new PCP for the special task of proving that a function is close to being a Reed-Solomon codeword. This step of the construction is by a self-contained recursion, and the only ingredient needed in the analysis is the bi-variate low-degree test of Polischuk and Spielman[27].Note that our constructions yield LTCs first, which are then converted to PCPs. In contrast, most recent constructions go in the opposite (and less natural) direction of getting LTCs from PCPs.

For a Boolean formula $\phi$ on n variables, the associated property $P_\phi$ is the collection of n-bit strings that satisfy $\phi$. We study the query complexity of tests that distinguish (with high probability) between strings in $P_\phi$ and strings that are far from $P_\phi$ in Hamming distance. We prove that there are 3CNF formulae (with O(n) clauses) such that testing for the associated property requires $\Omega(n)$ queries, even with adaptive tests. This contrasts with 2CNF formulae, whose associated properties are always testable with $O(\sqrt{n})$ queries [E. Fischer et al., Monotonicity testing over general poset domains, in Proceedings of the 34th Annual ACM Symposium on Theory of Computing, ACM, New York, 2002, pp. 474--483]. Notice that for every negative instance (i.e., an assignment that does not satisfy $\phi$) there are three bit queries that witness this fact. Nevertheless, finding such a short witness requires reading a constant fraction of the input, even when the input is very far from satisfying the formula that is associated with the property. A property is linear if its elements form a linear space. We provide sufficient conditions for linear properties to be hard to test, and in the course of the proof include the following observations which are of independent interest: In the context of testing for linear properties, adaptive two-sided error tests have no more power than nonadaptive one-sided error tests. Moreover, without loss of generality, any test for a linear property is a linear test. A linear test verifies that a portion of the input satisfies a set of linear constraints, which define the property, and rejects if and only if it finds a falsified constraint. A linear test is by definition nonadaptive and, when applied to linear properties, has a one-sided error.Random low density parity check codes (which are known to have linear distance and constant rate) are not locally testable. In fact, testing such a code of length n requires $\Omega(n)$ queries.

We continue the study of the trade-off between the length of PCP sand their query complexity, establishing the following main results(which refer to proofs of satisfiability of circuits of size n): 1 We present PCPs of length exp(Õ(log log n)2)•n that can be verified by making o(log logn) Boolean queries.For every ε>0, we present PCPs of length exp(logε n)• n that can be verified by making a constant number of Boolean queries. In both cases, false assertions are rejected withconstant probability (which may be set to be arbitrarily close to 1). The multiplicative overhead on the length of the proof, introduced by transforming a proof into a probabilistically checkable one, is just quasi-polylogarithmic in the first case (ofquery complexity o(log logn)), and 2(log n)ε, for any ε>0, in the second case (of constant query complexity). In contrast, previous results required at least 2 √logn overhead in the length, even to get query complexity 2 √log n. Our techniques include the introduction of a new variant of PCPs that we call "Robust PCPs". These new PCPs facilitate proof composition, which is a central ingredient in construction of PCP systems. (A related notion and its composition properties were discovered independently by Dinur and Reingold. ) Our main technical contribution is a construction of a "length-efficient" Robust PCP. While the new construction uses many of the standard techniques in PCPs, it does differ from previous constructions in fundamental ways, and in particular does not use the "parallelization" step of Arora et al. . The alternative approach may be of independent interest. We also obtain analogous quantitative results for locally testable codes. In addition, we introduce a relaxed notion of locally decodable codes,and present such codes mapping k information bits to code words of length κ1+ε, for any ε>0.

We call a pseudorandom generator $G_n:\{0,1\}^n\to \{0,1\}^m$ hard for a propositional proof system P if P cannot efficiently prove the (properly encoded) statement $G_n(x_1,\ldots,x_n)\neq b$ for any string $b\in\{0,1\}^m$. We consider a variety of "combinatorial" pseudorandom generators inspired by the Nisan--Wigderson generator on the one hand, and by the construction of Tseitin tautologies on the other. We prove that under certain circumstances these generators are hard for such proof systems as resolution, polynomial calculus, and polynomial calculus with resolution (PCR).

We analyze the efficiency of the random walk algorithm on random 3‐CNF instances and prove linear upper bounds on the running time of this algorithm for small clause density, less than $1.63$. This is the first subexponential upper bound on the running time of a local improvement algorithm on random instances. Our proof introduces a simple, yet powerful tool for analyzing such algorithms, which may be of further use. This object, called a terminator, is a weighted satisfying assignment. We show that any CNF having a good (small weight) terminator is assured to be solved quickly by the random walk algorithm. This raises the natural question of the terminator threshold which is the maximal clause density for which such assignments exist (with high probability). We use the analysis of the pure literal heuristic presented by Broder, Frieze, and Upfal [Proceedings of the Fourth Annual ACM‐SIAM Symposium on Discrete Algorithms, 1993, pp. 322–330] and Luby, Mitzenmacher, and Shokrollahi [Proceedings of the Ninth Annual ACM‐SIAM Symposium on Discrete Algorithms, 1998, pp. 364–373] and show that for small clause densities good terminators exist. Thus we show that the pure literal threshold ($\approx$1.63) is a lower bound on the terminator threshold. (We conjecture the terminator threshold to be in fact higher.) One nice property of terminators is that they can be found efficiently via linear programming. This makes tractable the future investigation of the terminator threshold and also provides an efficiently computable certificate for short running time of the simple random walk heuristic.

For a boolean formula φ on n variables, the associated property Pφ is the collection of n-bit strings that satisfy φ. We prove that there are 3CNF properties that require a linear number of queries, even for adaptive tests. This contrasts with 2CNF properties that are testable with O(√n) queries[7]. Notice that for every bad instance (i.e. an assignment that does not satisfy φ) there is a 3-bit query that witnesses this fact. Nevertheless, finding such a short witness requires a linear number of queries, even for assignments that are very far from satisfying.We provide sufficient conditions for linear properties to be hard to test, and in the course of the proof include a couple of observations which are of independent interest.

We present the first explicit construction of Probabilistically Checkable Proofs (PCPs) and Locally Testable Codes (LTCs) of fixed constant query complexity which have almost-linear (= n * 2Õ(√log n)) size. Such objects were recently shown to exist (nonconstructively) by Goldreich and Sudan[17]. Previous explicit constructions required size n1 + Ω(ε) with 1/ε queries. The key to these constructions is a nearly optimal randomness-efficient version of the low degree test[32]. In a similar way we give a randomness-efficient version of the BLR linearity test[13] (which is used, for instance, in locally testing the Hadamard code). The derandomizations are obtained through ε-biased sets for vector spaces over finite fields. The analysis of the derandomized tests rely on alternative views of ε-biased sets --- as generating sets of Cayley expander graphs for the low degree test, and as defining linear error-correcting codes for the linearity test.

We prove exponential lower bounds on the size of a bounded depth Frege proof of a Tseitin graph-based contradiction, whenever the underlying graph is an expander. This is the first example of a contradiction, naturally formalized as a 3-CNF, that has no short bounded depth Frege proofs.

We investigate tradeoffs of various important complexity measures such as size, space and width. We show examples of CNF formulas that have optimal proofs with respect to any one of these parameters, but optimizing one parameter must cost an increase in the other. These results, the first of their kind, have implications on the efficiency (or rather, inefficiency) of some commonly used SAT solving heuristics.Our proof relies on a novel and somewhat surprising connection of the variable space of a proof, to the black white pebbling measure of an underlying graph.

We prove exponential lower bounds on the size of a bounded depth Frege proof of a Tseitin graph-based contradiction, whenever the underlying graph is an expander. This is the first example of a contradiction, naturally formalized as a 3-CNF, that has no short bounded depth Frege proofs. Previously, lower bounds of this type were known only for the pigeonhole principle [18, 17], and for Tseitin contradictions based on complete graphs [19].Our proof is a novel reduction of a Tseitin formula of an expander graph to the pigeonhole principle, in a manner resembling that done by Fu and Urquhart [19] for complete graphs.In the proof we introduce a general method for removing extension variables without significantly increasing the proof size, which may be interesting in its own right.

We study space complexity in the framework of propositional proofs. We consider a natural model analogous to Turing machines with a read-only input tape and such popular propositional proof systems as resolution, polynomial calculus, and Frege systems. We propose two different space measures, corresponding to the maximal number of bits, and clauses/monomials that need to be kept in the memory simultaneously. We prove a number of lower and upper bounds in these models, as well as some structural results concerning the clause space for resolution and Frege systems.

We study the space complexity of refuting unsatisfiable random k-CNFs in the resolution proof system. We prove that for any large enough /spl Delta/, with high probability a random k-CNF over n variables and /spl Delta/n clauses requires resolution clause space of /spl Omega/(n/spl middot//spl Delta//sup -1+/spl epsiv//k-2-/spl epsiv//), for any 0>/spl radic/n. This bound is nearly tight. Specifically, we show that with high probability, a random 3-CNF with /spl Delta/n clauses requires tree-like refutation size of exp(/spl Omega/(n//spl Delta//sup 1+/spl epsiv//1-/spl epsiv//)), for any 0</spl epsiv/<1/2. Our space lower bound is the consequence of three main contributions. 1. We introduce a 2-player matching game on bipartite graphs G to prove that there are no perfect matchings in G. 2. We reduce lower bounds for the clause space of a formula F in resolution to lower bounds for the complexity of the game played on the bipartite graph G(F) associated with F. 3. We prove that the complexity of the game is large whenever G is an expander graph. Finally, a simple probabilistic analysis shows that for a random formula F, with high probability G(F) is an expander. We also extend our result to the case of G-PHP, a generalization of the pigeonhole principle based on bipartite graphs G. We prove that the clause space for G-PHP can be reduced to the game complexity on G.

The width of a Resolution proof is defined to be the maximal number of literals in any clause of the proof. In this paper, we relate proof width to proof length (=size), in both general Resolution, and its tree-like variant. The following consequences of these relations reveal width as a crucial “resource” of Resolution proofs. In one direction, the relations allow us to give simple, unified proofs for almost all known exponential lower bounds on size of resolution proofs, as well as several interesting new ones. They all follow from width lower bounds, and we show how these follow from natural expansion property of clauses of the input tautology. In the other direction, the width-size relations naturally suggest a simple dynamic programming procedure for automated theorem proving—one which simply searches for small width proofs. This relation guarantees that the runnuing time (and thus the size of the produced proof) is at most quasi-polynomial in the smallest tree-like proof. This algorithm is never much worse than any of the recursive automated provers (such as DLL) used in practice. In contrast, we present a family of tautologies on which it is exponentially faster.

We call a pseudorandom generator G/sub n/:{0,1}/sup n//spl rarr/{0,1}/sup m/ hard for a propositional proof system P if P can not efficiently prove the (properly encoded) statement G/sub n/(x/sub 1/,...,x/sub n/)/spl ne/b for any string b/spl epsiv/{0,1}/sup m/. We consider a variety of "combinatorial" pseudorandom generators inspired by the Nisan-Wigderson generator on one hand, and by the construction of Tseitin tautologies on the other. We prove that under certain circumstances these generators are hard for such proof systems as resolution, polynomial calculus and polynomial calculus with resolution (PCR).

We develop a general strategy for proving width lower bounds, which follows Haken's original proof technique but is now simple and clear. It reveals that large width is implied by certain natural expansion properties of the clauses (axioms) of the tautology in question. We show that in the classical examples of the Pigeonhole principle, Tseitin graph tautologies, and random k-CNFs, these expansion properties are quite simple to prove. We further illustrate the power of this approach by proving new exponential lower bounds to two different restricted versions of the pigeon-hole principle. One restriction allows the encoding of the principle to use arbitrarily many extension variables in a structured way. The second restriction allows every pigeon to choose a hole from some constant size set of holes.

We show a general reduction that derives lower bounds on degrees of polynomial calculus proofs of tautologies, over any field of characteristic (other than 2) from lower bounds for resolution proofs of a related set of linear equations module 2. We apply this to derive linear lower bounds on the degrees of PC proofs of randomly generated tautologies.

The width of a Resolution proof is defined to be the max.imal number of liter& in any clause of the proof.In this paper we relate proof width to proof length (&size), in both general Resolution, and its tree-like variant.The following consequences of these relations reveal width as a crucial "resource" of Resolution proofs.In one direction, the relations allow us to give simple, unified proofs of all known exponential lower bounds on size of resolution proofs, as well a.5 several interesting new ones.They all follow from width lower bounds, and we show how these follow from natural expansion property of clauses of the input tautology.In the other direction, the width-size relations naturally suggest a simple dynamic programming procedure for automated theorem proving -one which simply searches for small width proofs.This relation guarantees that the running time (and thus the size of the produced proof) is at most qua+polynomial in the smallest tree-like proof.The new algorithm is never much worse than any of the recursive automated provers (such as DLL) used in practice.In contrast, we present a family of tautologies on which it is exponentially faster.The lower bound part of this gap is proved using a new general connection between the pebbling number of any graph and the tree-like proof size of a related tautology.A byproduct is an exponential gap between the power of general and tree-like Resolution, improving the recent sub-exponential gap of [BEGJ98].