Delegating Computation: Interactive Proofs for Muggles 学习笔记

1. 引言

Goldwasser的等人2008年论文《Delegating Computation: Interactive Proofs for Muggles》，该论文的full version版本见：full verion 版本的 Delegating Computation: Interactive Proofs for Muggles》。

在该论文中，关注的是interactive proofs for tractable languages。要求：

• （honest）prover（又称为“muggle”） 为efficient， run in polynomial time。
• Verifier为super-efficient，run in nearly-linear time。

这种proof sysstem 可用于算力外包：

• server run a computation for a client 的同时，interactively prove the correctness of the result。
• client可verify the result’s correctness in nearly-linear time (而不是run the entire computation itselt)。

本文实现了a public coin interactive proof for any language computable by a log-space uniform boolean circuit with depth $d$ and input length $n$：

• Verifier：runs in time $(n+d)\cdot polylog(n)$ and space $O(\log (n))$；
• communication complexity：$d\cdot polylog(n)$；
• Prover：runs in time $poly(n)$。

特别地，对于languages ccomputable by log-space unifrom $\mathcal{N}\mathcal{C}$ （circuits of $polylog(n)$ depth）：

• Prover：efficient；
• Verifier：runs in time $n\cdot polylog(n)$ and space $O(\log (n))$；
• communication complexity：$polylog(n)$。

目前，针对interactive proofs的大量研究都着力于改进Verifier的complexity in terms of various resouce measures，如：

• time
• space
• depth
• rounds
• randomness

而通常认为Prover端的算力是无限的。如Arthur-Merlin游戏中，认为Merlin（作为Prover）的算力是无限的。

本文则针对真实场景，考虑的是：

• Prover端的算力也是有限的，即将unbounded magical Merlin替换为a “Muggle” prover。“Muggle” 限制为具有probabilistic polynomial-time computation。
• input to the interactive proof来自于outside source，甚至来自于the Verifier。（即Prover无法获取auxiliary secret。）

本文着力于针对polynomial-time computable languages构建interactive proofs，具有：

• super-efficient verifier；【time complexity为linear in the size of the input $x$ and poly-logarithmic in the size of the computation of $L$。同时，要求Verifier验证所需的时间和资源要远远小于自己完成相应计算。】
• efficient prover；【time complexity为polynomial in the size of the input。】
• 具有unconditionally soundness；（即对dishonest prover不做任何算力上的假设限制。）
• communication complexity：polylogarithmic in the size of the computation。

1.1 算力外包

interactive proofs的一个真实场景的主要应用为：
delegate polynomial time computations to an untrusted party。

如网络中有多个算力不同的设备，某些设备由于资源有限算力较弱，当任务过于复杂时，算力弱的设备delegate computation to 同网络中算力强的设备。

典型的例子有：

• 1）large scale distributed computing 大规模分布式计算：
  “Volunteer Computing” 是指：a server split large computations into small units, send these units to volunteers for processing, and reassemble the result (via a much easier computation)。
  相应的例子使用Berkeley Open Infrastructure for Network Computing (BOINC) [5,6] 的SETI@home [3,1]，用于扫描是否存在外星人的无线电信号。另一个例子是Great Internet Mersenne Prime Search，用于寻找梅森素数。

• 2）weak peripheral devices 弱外围设备：
  越来越多小的、低算力外围设备（如手机、打印机、相机、安全门禁卡、音乐播放器以及传感器）通过网络与强算力的远程计算机连接。假设的一个场景为：a sensor that is presented with an access-card, sends it a ranom challenge, and receives a digitial signature of the random challenge. The computation required to verify the signature involves public-key operations which are too expensive both in time and space for the sensor to run。相反的，sensor可interact with a remote mainframe (delegatee)， which can do the computation。
  存在的一个主要问题为：
  how can a delegator verifiy that the delegatees performed the computation correctly, without running the computation itself？
  因此要求delegatee提供a proof that the computation was performed correctly。（这就要求delegator验证proof的时间 要远小于 自己独立完成相应计算的时间；同时要求delegatee生成proof不会引入过多的时间。）
  因此，interactive proofs with efficient provers (the delgatees) and super-efficient verifiers (the delegators) provide a natural solution to this problem。

1.2 相关研究

除ineractive proof model之外，针对check the correctness of computations的相关研究有：

• Babai等人[10] 的Holographic proofs model (or alternatively the PCP model)。
• Micali [50] 和 Kilian [45] 的computationally sound argument systems。

以上这些研究类似本文，但是需要super-efficient verifiability, and efficient provability (polynomial time in the non-deterministic time complexity of accepting the input)。

In contrast, our work is in the standard interactive proof model [37] where soundness is achieved unconditionally, making no assumptions on the power of the dishonest prover (as in [50, 45]), nor making assumptions on the non-adaptivity of the dishonest prover(as in [10]).

1.3 low degree extension

1.4 low degree test

Fix a finite field $\mathbb{F}$，假设Verifier想要验证whether a function $\pi :{\mathbb{F}}^m\to \mathbb{F}$ is an $m$-variate polynomial of degree $\le d$ (think of $d$ as significantly smaller than $|\mathbb{F}|$)。

可将low degree test看成是an interactive proof for $\pi$ being close to an $m$-variate polynomial of degree $\le d$。该proof应short （即size $\le poly(|\mathbb{F}|,m)$）。Verifier 仅需要oracle access to $\pi$，允许query $\pi$ at only a few points (也就是 only one point)。

1.5 interactive sum-check protocol

Fix a finite field $\mathbb{F}$ and a subset $H\subseteq \mathbb{F}$。
在sum-check protocol中，a (not necessarily efficient) prover 的输入为：
an $m$-variate polynomial $f:{\mathbb{F}}^m\to \mathbb{F}$ of degree $\le d$ in each variable (think of $d$ as significantly smaller than $|\mathbb{F}|$)。
Prover的目标是证明：
${\sum }_{z\in H^m}f(z)=\beta$
for some constant $\beta \in \mathbb{F}$。
Verifier仅具有oracle access to $f$，以及constant $\beta \in \mathbb{F}$，要求Verifier为efficient in both its running time 和 its number of oracle queries。

2. 主要技术点

假设circuit $C$为a depth $d$ arithmetic circuit in a layered form where there are as many layers as the depth of the circuit。【Every circuit can be converted into this format by at most squaring its size and not changing the depth。】

本文采用interactive protocol来实现（parallelized）computation of $C$, layer by layer, from the output layer to the input layer，numbering the layers in increasing order from the top (output) of the circuit to the bottom (input) of the circuit。【如layer $0$对应为output layer，layer $d$为input layer。】
The verifier has no time to compute points in the low-degree extension of the computation on $x$ in layer $i$: this is the low-degree extension (a high distance encoding) of the vector of values that the gates in the circuit’s $i$-th layer take on input $x$，and to compute it one needs to actually evaluate $C$, which we want to avoid!
因此，the low-degree extension of the $i$-th layer, 将由Prover提供。为了防止Prover作弊，在each phase of the protocol，允许Verifier能 reduce, verification of a single point in the low-degree extension of an advanced step (layer) in parallel computation, to, verification of a single point in the low-degree extension of the previous step (layer)。整个过程将repeated iteratively (for as many layers as the circuit has)，直到the verification has been reduced to verifying a single poin in the extension of the first step in the computation。在the first step of the computation (即the input layer)， the only information “computed” is the input $x$， the verifier can compute the low degree extension of the input $x$ on its own。

根据以上描述，关键点在于：如何reduce, verification of a single point in the low degree extension of a layer in the circuit, to, verification of a single point in the low degree extension of the previous layer。

观察可发现：
every point in the low degree extension (LDE) of the advanced layer (layer $i$) is a linear combination or a weighted sum, of the values of that layer’s gates。假设circuit具有fan-in 2，则可 express the value of each gate $g$ in layer $i$ as a sum，over all possible pairs $(k,l)$ of gates in the layer below (layer $i+1$), of some (low degree) function of the values of the gates $k$ and $l$，as well as a predicate that indicates whether those gates are indeed the “children” of gate $g$。
Arithmetizing this entire sum of sums，可运行sum-check protocol来verify the value of one point in the low-degree extension of layer $i$。

为了简化，可假设现在Verifier具有access to (a low-degree extension of) the predicate that says wheter a pair of gates $(g,l)$ are the children of the gate $g$。然后（modulo many details）at the end of this sum-check protocol the verifier only needs to verify the values of a pair of points in the LDE of layer $i+1$。但是这仍然不够，我们需要reduce, the verification of a single point in the LDE of layer $i$, to, the verification of a single point in layer $i+1$ and not of a pair of points。因此，最终需要使用an interactive protocol来reduce, verifying two points in the LDE of layer $i+1$, to, verifying just one。

接下来的关键问题在于：
how the verifier gains access to such LDE’s of predicates that decide whether circuit gates are connected, without looking at the entire circuit (as the circuit itself is much larger than the verifier’s running time)。

The verifier’s running time in each of these phases is polylogarithmic in the circuit size。在最后一步，computing one point in the low-degree extension of the input requires only nearly-linear time, indepedent of the rest of the circuit。
另一个重要的点是，the Verifier不需要记住anything about earlier phases of the verification, at any point in time it only needs to remember what is being verified about a certain point in the computation，这样就可以大量解压Verfier的空间。
而对于Prover来说，其running time的节约在于the prover does not need to arithmetize the entire computation, but rather proves statements about one (parallel) computation step at a time。

剩下的问题为：
how the verifier can compute (a low-degree extensions of) a predicate that decides whether circuit gates are connected, without looking at the entire circuit。
为了解决该问题，约定了circuit的uniformity一致性，这样就有非常short implicit representation。
类似地，在[11]中，相应的computation reduce为an (exponential) 3SAT formula， and the (polynomial-time) verifier needs to access a low-degree extension of a function computing which variables are in a specific clause of the formula。【利用了Cook-Levin reduction transform。】
而本文无法使用Cook-Levin reduction transform，因为在本文中要求transform unifrom computations into low-depth circuits without blowing up the input size。

为了解决该问题，本文：

• 1）检查low space computations，如，uniform log-space Turing Machines (deterministic or non-deterministic)。A log-space machine can be transformed into a family of boolean circuits with poly-logarithmic depth and polynomial size。在这样的circuits簇中，it is possible to compute the predicate that decides whether circuit gates are connected in poly-logarithmic time and constant (${\mathcal{A}\mathcal{C}}^0$) depth。This computation can itself be arithmetized, which allows the verifier to compute a low-degree extension of the predicate in poly-logarithmic time。然后就可obtain an interactive proof with an efficient prover and super-efficient verifier for any $\mathcal{L}$ or $\mathcal{N}\mathcal{L}$ computation。
• 2）对于non-uniform circuits，the only “heavy” computation that the verifier needs to do is computing low-degree extensions of the predicate that decides whether circuit gates are connected。The locations at which the verifier needs to access this predicate are only a function of its own randomness (and not of the input or the prover’s responses)。
  这就意味着，对于completely non-uniform circuit, the verifier can compute these evaluations of the predicate’s low-degree extension off-line on its own，without knowing the input or interacting with the prover。该off-line phase requires run-time that is proportional to the circuit size。Once the input is specified, the verifier, who has the (poly-logarithmically many) evaluations of the predicate’s low degree extension that it computed off-line, can run the interactive proof on-line with the prover。
  The verifier will be super efficient in this on-line phase。

3. a bare-bones protocol

3.1 相关约定

针对circuit $C:\{0,1{\}}^n\to \{0,1\}$ of size $S$ and of depth $d\le S$，and a string $x\in \{0,1{\}}^n$， provess to a verifier that $C(x)=0$。
$C$为a layered arithmetic circuit of fan-in 2 (over the gates $\times$ and $+$ and the field $\mathbb{F}$)，且all its layers are of size $S$。【只有input layer 例外，input layer的size为$n$。】A depth-$d$ layered circuit，其gates会切分为$(d+1)$层，其中$0$ layer为the output layer （由output gate组成），$d$ layer为the input layer（由input gates组成）。
对于layered circuit，wires仅可连接相邻层的gates，即，the output wire of a gate in layer $i$ can only be the input wire for a gate in layer $(i-1)$。为了简单起见，假设$C$中的所有layers都具有相同的size（except for the input layer），假设the size of each layer is $S$。
任意的circuit (of size $S$) 都可tranform为one with exactly $S$ gates in each level, by adding $<S$ dummy gates (that are the constant zero) to each layer。
特别地，会add dummy gates to the output layer, 使得the transformed circuit $C^{\prime }:{\mathbb{F}}^n\to {\mathbb{F}}^s$ satisfies that for every $(x_1,\cdots ,x_n)\in {\mathbb{F}}^n$：
$C^{\prime }(x_1,\cdots ,x_n)=(C(x_1,\cdots ,x_n),0,\cdots ,0)$
这会increase the size of the circuit by at most a quadratic factor，但是不会增加circuit的depth。

【可将任意的arithmetic circuit 转换为 layered arithmetic circuit of fan-in 2，代价是increase the size of the circuit by at most a polynomial factor and increase the depth of the circuit by at most a factor of $O(\log (S))$。】

对于任意的$0\le i\le d-1$，label the $S$ gates in the $i$-th layer of $C$ by values in $\{g_{i,0},g_{i,1},\cdots ,g_{i,S-1}\}$。【the $n$ gates in the $d$-th layer of $C$(即，the input layer) 表示为$(g_{d,0},g_{d,1},\cdots ,g_{d,n-1})$。】

对于任意的$i\in [d-1]$，associate with $C$ two functions $ad{d}_i,mul{t}_i:{\mathbb{H}}^m\times {\mathbb{H}}^m\times {\mathbb{H}}^m\to \{0,1\}$【即$ad{d}_i,mul{t}_i:\{0,1,S-1{\}}^3\to \{0,1\}$】。这两个function的输入为3 gate labels $(j_1,j_2,j_3)$，输出为$1$当且仅当the gate $j_1$ in layer $i-1$ is the addition or multiplication (respectively) of gates $(j_2,j_3)$ in layer $i$，否则输出为$0$。【注意，gate labels in $[S]$ are represented as vectors in ${\mathbb{H}}^m$】
即有：

• 对于任意的$i\in [d-1]$，设置${\widetilde{add}}_i,{\widetilde{mult}}_i:{\mathbb{F}}^{3m}\to \mathbb{F}$ 为the low-degree extensions of $ad{d}_i,mul{t}_i$ with respect to $\mathbb{H},\mathbb{F},m$, of degree $\delta$ in each variable (recall $\delta <|\mathbb{F}|$)。
  对于每一个 $z_1,z_2,z_3\in {\mathbb{H}}^m$，使得 $\alpha (z_1),\alpha (z_2),\alpha (z_3)\le S-1$（其中$\alpha :{\mathbb{H}}^m\to \{0,1,\cdots ,|\mathbb{H}{|}^m-1\}$ is the lexicographic order。），${\widetilde{add}}_i,{\widetilde{mult}}_i$与$ad{d}_i,mul{t}_i$的关系为：
  ${\widetilde{add}}_i(z_1,z_2,z_3)=ad{d}_i(\alpha (z_1),\alpha (z_2),\alpha (z_3))$
  ${\widetilde{mult}}_i(z_1,z_2,z_3)=mul{t}_i(\alpha (z_1),\alpha (z_2),\alpha (z_3))$
  若$z_1,z_2,z_3\in {\mathbb{H}}^m$，但是其中的某个值$\alpha (z_j)>S-1$，则${\widetilde{add}}_i,{\widetilde{mult}}_i$均返回0值。

• 对于$i=d$，即input layer，有：
  ${\widetilde{add}}_d,{\widetilde{mult}}_d:{\mathbb{F}}^m\times {\mathbb{F}}^{m^{\prime }}\times {\mathbb{F}}^{m^{\prime }}\to \mathbb{F}$
  为multivariate polynomials of degree $\le \delta$ in each variable。
  其中每一个$z_1\in {\mathbb{H}}^m$应满足$\alpha (z_1)\le S-1$；每一个$z_2,z_3\in {\mathbb{H}}^{m^{\prime }}$应满足$\alpha (z_2),\alpha (z_3)\le n-1$，有：
  ${\widetilde{add}}_d(z_1,z_2,z_3)=ad{d}_d(\alpha (z_1),\alpha (z_2),\alpha (z_3))$
  ${\widetilde{mult}}_d(z_1,z_2,z_3)=mul{t}_d(\alpha (z_1),\alpha (z_2),\alpha (z_3))$
  若$\alpha (z_1)>S-1$ 或 $\alpha (z_2)>n-1$ 或 $\alpha (z_3)>n-1$，则${\widetilde{add}}_d,{\widetilde{mult}}_d$均返回0值。

注意：
$\{ad{d}_i,mul{t}_i{\}}_{i\in [d]}$可唯一确定circuit $C$，而extensions $\{{\widetilde{add}}_i,{\widetilde{mult}}_i{\}}_{i\in [d]}$ 无法唯一确定circuit $C$。
对于$\delta >|\mathbb{H}|-1$的情况下，有很多符合条件的extensions $\{{\widetilde{add}}_i,{\widetilde{mult}}_i{\}}_{i\in [d]}$ 。

定义oracle $\mathcal{F}$ accessed by the prover and verifier in the bare-bones protocol：
$\mathcal{F}=\{{\widetilde{add}}_i,{\widetilde{mult}}_i{\}}_{i\in [d]}$
其中，Prover和Verifier可access ${\widetilde{add}}_i$ or ${\widetilde{mult}}_i$ by querying $\mathcal{F}$ with the proper $i$, a bit specifying $\widetilde{add}$ or $\widetilde{mult}$, and an input in $({\mathbb{F}}^m{)}^3$ or (for $i=d$) in ${\mathbb{F}}^m\times ({\mathbb{F}}^{m^{\prime }}{)}^2$。

在bare-bones protocol中，假设the verifier 具有oracle access to the functions ${\widetilde{add}}_i,{\widetilde{mult}}_i$ for every $i\in [d-1]$。

最后，对于任意的$0\le i\le d-1$，为the $i$-th layer of the circuit $C$ 关联a vector $v_i=(v_{i,0},\cdots ,v_{i,S-1})\in {\mathbb{F}}^s$。the $d$-th layer of circuit $C$ 关联的vector为$v_d=(v_{d,0},\cdots ,v_{d,n-1})\in {\mathbb{F}}^n$。
这些vectors为functions of the input $x=(x_1,\cdots ,x_n)\in {\mathbb{F}}^n$，可定义为：
For each $0\le i\le d$，设置$v_i$为vector that consists of the values of all the gates in the $i$-th layer of the circuit when it is evaluated on input $x$。
因此，$v_0$对应output layer，满足$v_0=(C(x),0,\cdots ,0)\in {\mathbb{F}}^s$；$v_d$对应input layer，满足$v_d=(x_1,\cdots ,x_n)$。
类似地，对于$0\le i\le d-1$，设置 ${\tilde{V}}_i:{\mathbb{F}}^m\to \mathbb{F}$ 为the (unique) low degree extension of $v_i$ with respect to $\mathbb{H},\mathbb{F},m$。【${\tilde{V}}_d:{\mathbb{F}}^{m^{\prime }}\to \mathbb{F}$】
注意function ${\tilde{V}}_i$具有degree $\le |\mathbb{H}|-1$ in each of its $m$ variables and is efficiently computable。

3.2 Bare-Bones protocol

对于bare-bones protocol，Prover想证明$C(x)=0$，等价地，想证明${\tilde{V}}_0(0,\cdots ,0)=0$。证明过程包含$d$ phases，其中$d$为the depth of $C$：

• 在第$i$-th phase（$1\le i\le d$），Prover reduce the task of proving that ${\tilde{V}}_{i-1}(z_{i-1})=r_{i-1}$ to the task of proving that ${\tilde{V}}_i(z_i)=r_i$。其中$z_i$为a random value determined by the protocol（有$z_0=(0,\cdots ,0),r_0=0$）。
• 最后，在$d$ phase后，Verifier自己验证${\tilde{V}}_d(z_d)=r_d$。注意，${\tilde{V}}_d$为the low degree extension of the input $x$ with respect to $\mathbb{H},\mathbb{F},m^{\prime }$。
  在此，Verifier需compute a single point in the low degree extension of the input $x$，这是Verifier的最大算力开销，且该计算与circuit $C$无关，can be done in quasi-linear time in the input length。
  此外，若Verifier具有oracle access to the low-degree extension of $x$，则此时仅需要一次oracle call。

在每一个phase，communication complexity为$poly(d,\log S)$，Prover running time为不多于$poly(S)$，Verifier running time为$poly(d,\log S)$。

针对的场景为：

在第$i$-th phase ($i\in [d-1]$)，需reduce the task of proving that ${\tilde{V}}_{i-1}(z_{i-1})=r_{i-1}$ to the task of proving that ${\tilde{V}}_i(Z_i)=r_i$，其中$z_i\in {\mathbb{F}}^m$ 为 a random value determined by the verifier，$r_i$为a value determined by the protocol。

对于$p,w_1,w_2\in {\mathbb{F}}^m$，定义：
$f_i(p,w_1,w_2)={\widetilde{add}}_i(p,w_1,w_2)\cdot ({\tilde{V}}_i(w_1)+{\tilde{V}}_i(w_2))+{\widetilde{mult}}_i(p,w_1,w_2)\cdot {\tilde{V}}_i(w_1)\cdot {\tilde{V}}_i(w_2)$
对于每个$p\in {\mathbb{H}}^m$，${\tilde{V}}_{i-1}(p)={\sum }_{w_1,w_2\in {\mathbb{H}}^m}{f}_i(p,w_1,w_2)$。
根据low-degree extension的定义，对于每一个$z\in {\mathbb{F}}^m$，有${\tilde{V}}_{i-1}(z)={\sum }_{p\in {\mathbb{H}}^m}\tilde{\beta }(z,p)\cdot {\tilde{V}}_{i-1}(p)$，其中$\tilde{\beta }:{\mathbb{F}}^m\times {\mathbb{F}}^m\to \mathbb{F}$为 a polynomial of degree at most $|\mathbb{H}|-1$ in each variable，that can be computed in time $\le poly(|\mathbb{H}|,m)$。

结论为，对于每一个$z\in {\mathbb{F}}^m$，有：
${\tilde{V}}_{i-1}(z)={\sum }_{p,w_1,w_2\in {\mathbb{H}}^m}\tilde{\beta }(z,p)\cdot f_i(p,w_1,w_2)$

因此，证明${\tilde{V}}_{i-1}(z_{i-1})=r_{i-1}$ reduce为证明$r_{i-1}={\sum }_{p,w_1,w_2\in {\mathbb{H}}^m}\tilde{\beta }(z_{i-1},p)\cdot f_i(p,w_1,w_2)$，可通过运行interactive sum-check protocol来证明。
在该sum-check protocol中，最终Verifier需自己计算$\tilde{\beta }(z_{i-1},p)\cdot f_i(p,w_1,w_2)$ on random inputs $p,w_1,w_2{\in }_R{\mathbb{F}}^m$（chosen by the verifier）。
注意，本文假设Verifier具有oracle access to the functions ${\widetilde{add}}_i,{\widetilde{mult}}_i$，因此计算function $\tilde{\beta }$ 需要时间为 $\le poly(|\mathbb{H}|,m)$，因此verification中的主要开销在于计算${\tilde{V}}_i(w_1)$ 和 ${\tilde{V}}_i(w_2)$，which requres time $poly(S)$ (and thus cannot be computed by our computationally bounded verifier)。因此，需要由Prover来计算$v_1={\tilde{V}}_i(w_1)$ 和 $v_2={\tilde{V}}_i(w_2)$发送给Verifier，而Verifier需要验证${\tilde{V}}_i(w_1)=v_1$ 和 ${\tilde{V}}_i(w_2)=v_2$成立。

目前为止，使用the sum-check protocol，可reduce the task of proving that ${\tilde{V}}_{i-1}(z_{i-1})=r_{i-1}$ to the task of proving that both ${\tilde{V}}_i(w_1)=v_1$ and ${\tilde{V}}_i(w_2)=v_2$。注意，此处有2个等式需要判断，而本文的目标是reduce the task of proving that ${\tilde{V}}_{i-1}(z_{i-1})=r_{i-1}$ to the task of proving a single equality of the form ${\tilde{V}}_i(z_i)=r_i$。
因此，在第$i$-th phase，需要reudce the task of proving that both ${\tilde{V}}_i(w_1)=v_1$ and ${\tilde{V}}_i(w_2)=v_2$ to the task of proving a single equality of the form ${\tilde{V}}_i(z_i)=r_i$。

详细的Bare-Bones protocol为：

4. Interactive Proofs: Implementing the Bare-Bones Protocol

引入了sub-circuit的概念。。。。。。

参考资料

[1] Justin Thaler A Note on the GKR Protocol