Constant-Space, Constant-Randomness Verifiers with Arbitrarily Small Error
aa r X i v : . [ c s . CC ] J un Constant-Space, Constant-Randomness Verifiers withArbitrarily Small Error ✩ M. Utkan Gezer ∗ , A. C. Cem Say Boğaziçi University, Bebek, İstanbul, Turkey
Abstract
We study the capabilities of probabilistic finite-state machines that act as ver-ifiers for certificates of language membership for input strings, in the regimewhere the verifiers are restricted to toss some fixed nonzero number of coinsregardless of the input size. Say and Yakaryılmaz showed that the class of lan-guages that could be verified by these machines within an error bound strictlyless than / is precisely NL, but their construction yields verifiers with errorbounds that are very close to / for most languages in that class. We charac-terize a subset of NL for which verification with arbitrarily low error is possibleby these extremely weak machines. It turns out that, for any ε >
0, one canconstruct a constant-coin, constant-space verifier operating within error ε forevery language that is recognizable by a linear-time multi-head finite automaton( ( k )). We discuss why it is difficult to generalize this method to all of NL,and give a reasonably tight way to relate the power of linear-time ( k )’s tosimultaneous time-space complexity classes defined in terms of Turing machines. Keywords:
Interactive Proof Systems, Multi-head finite automata,Probabilistic finite automata
1. Introduction
The classification of languages in terms of the resources required for verifyingproofs (“certificates”) of membership in them is a main concern of computationalcomplexity theory. Major results in this area have demonstrated importanttradeoffs among different types of resources such as time, space, and random-ness: The power of deterministic polynomial-time, polynomial-space boundedverifiers, characterized by the class NP, has, for instance, been shown to beidentical to that of probabilistic bounded-error polynomial-time logarithmic-space verifiers that toss only logarithmically many coins in terms of the input ✩ This paper is a substantially improved version of [1]. ∗ Corresponding author
Email addresses: [email protected] (M. Utkan Gezer), [email protected] (A. C.Cem Say)
Preprint submitted to Elsevier June 23, 2020 ize [2]. More recently, Say and Yakaryılmaz initiated the study of the powerof finite-state verifiers that are restricted to toss some fixed nonzero number ofcoins regardless of the input size, and proved [3] that the class of languages thatcould be verified by these machines within an error bound strictly less than / is precisely NL, i.e. languages with deterministic logarithmic-space verifiers.The construction given in [3] could exhibit a constant-randomness verifieroperating within error ε for some ε < / for any language in NL, however, it didnot provide a method for reducing this error to more desirable smaller values.Indeed, for many languages in NL, the constructed verifier’s error bound isuncomfortably close to / , raising the question of whether the class of languagesfor which it is possible to obtain verifiers with arbitrarily small positive errorbounds is a proper subset of NL or not.In this paper, we characterize a subset of NL for which verification witharbitrarily low error is possible by these extremely weak machines. It turns outthat, for any ε >
0, one can construct a constant-coin, constant-space verifieroperating within error ε for every language that is recognizable by a linear-time multi-head finite automaton ( ( k )). We discuss why it is difficult togeneralize this method to all of NL, and give a reasonably tight way to relatethe power of linear-time ( k )’s to simultaneous time-space complexity classesdefined in terms of Turing machines. We conclude with a list of open questions.
2. Preliminaries
The reader is assumed to be familiar with the standard concepts of automatatheory, Turing machines, and basic complexity classes [4].The following notation will be used throughout this paper:• σ i is the i th element of the sequence σ • στ is the sequences σ and τ concatenated• h O , . . . , O k i is the encoding of objects O i in the alphabet of context• A ⊔ B is the union of sets A and B , also asserting that A and B are disjoint A k -head nondeterministic finite automaton, denoted ( k ) , is a 6-tupleconsisting of1. a finite set of states Q ,2. an input alphabet Σ,3. a transition function δ : Q × Γ k → P (cid:0) Q × ∆ k (cid:1) , where;• Γ = Σ ⊔{ ⊲ , ⊳ } is the tape alphabet, where ⊲ and ⊳ are respectivelythe left and right end markers The in ( k ) is to indicate that they can move their heads in both directions. { − , , } is the set of head movements, where − q ,5. an accept state q accept , and6. a reject state q reject .A ( k ) M = ( Q, Σ , δ, q , q accept , q reject ) initially starts from q , and with ⊲ x ⊳ written on its single read-only tape, where x ∈ Σ ∗ is the input string. All k tapeheads are initially on the ⊲ symbol. The function δ maps the current state andthe k symbols under the tape heads to a set of alternative steps M can take.By picking an alternative ( q, d ), M transitions into the state q , and moves its i th head by d i .The configuration of a ( k ) M at a step of its execution is the ( k + 1)-tuple consisting of its state and its head positions at that moment. The initialconfiguration of M is ( q , k ).Starting from its initial configuration, and following different alternativesoffered by δ , a ( k ) M may have several computational paths on the samestring. A computational path of M halts if it reaches q accept or q reject , or if δ does not offer any steps for M to follow. M accepts an input string x , if thereis a computational path of M running on x that halts on q accept . M rejects aninput string x , if M running on x halts on a state other than q accept on everycomputational path. The language recognized by M is the set of all stringsaccepted by M .Given an input string x , M may have computational paths that never halt.In the special case that M given any input string halts on every computationalpath, M is said to be an always halting ( k ).A k -head deterministic finite automaton, denoted ( k ), differs from a ( k ) in its transition function, which is defined as δ : Q × Γ k → Q × ∆. (1)’s are simply called finite automata, and are denoted as ’s and ’sfor the deterministic and nondeterministic counterparts, respectively.For a particular k >
0, let L ( ( k )) denote the class of languages recognizedby a ( k ). For when k is unspecified, let L ( ( k )) denote the class oflanguages that has a ( k ) recognizing them for some k . In other words; L ( ( k )) = [ k> L ( ( k )) L ( (1)) is the class of regular languages.For any growth function f ( n ), NSPACE( f ( n )) denotes the class of lan-guages recognized by nondeterministic Turing machines which are allowed touse O ( f ( n )) space for inputs of length n . The class NSPACE(log n ) is com-monly denoted as NL. Lemma 1.
Nondeterministic multi-head finite automata are equivalent to non-deterministic logarithmic space TM s in terms of language recognition power [5].Put formally; L ( ( k )) = NL3 emma 2. The languages in NL are organized in a hierarchy based on the num-ber of heads of the nondeterministic automata recognizing them. [6] Formally,the following is true for any k > : L ( ( k )) ( L ( ( k + 1))For any given k , let L ( ( k ) , f ( n )) denote the class of languages that arerecognized by a ( k ) running for O ( f ( n )) steps on every alternative compu-tational path on any input of length n . Clearly, those machines are also alwayshalting. Let L ( ( k ) , f ( n )) denote the class of languages that are recognizedby a nondeterministic multi-head finite automata with any number of heads, andrunning in O ( f ( n )) time. We use linear - time designation instead of f ( n ) = n . Lemma 3.
The following is true for any k > : L ( ( k )) ⊆ L (cid:0) (2 k ) , n k (cid:1) Proof.
Let M be any ( k ) recognizing A with Q as its set of states. Runningon an input string of length n , M can have T = | Q | · ( n + 2) k different con-figurations. If M executes for more than T steps, then it must have repeateda configuration, and be in a loop. Therefore, for every input string in A , M should have an accepting computation path of at most T steps.With the help of k additional counter heads, the (2 k ) M ′ can simulate M while imposing it a runtime limit of T steps. Machine M ′ can count up to T as follows: Let c , . . . , c k denote the counter heads. Head c moves right every | Q | th step of M ’s simulation. For i < k , whenever the head c i reaches the rightend marker, it rewinds back to the left end, and head c i +1 moves once to right.If c k attempts to move past the right end, M ′ rejects.The (2 k ) M ′ recognizes the same language as M , but within the timelimit of O (cid:0) n k (cid:1) .Lemmas 2 and 3 can be combined into the following useful fact. Corollary 4.
For every A ∈ NL , there is a minimum number k A , such thatthere exists an always halting ( k A ) recognizing A , but not an always halting ( h ) with h < k A .Proof. By Lemma 2, A ∈ L ( ( k )), but A / ∈ L ( ( k − k . Theexistence of an always halting ( k A ) recognizing A for a minimum k A between k and 2 k is guaranteed by Lemmas 2 and 3, respectively. Lemma 5.
HALTING = { h M i | M is an always halting } is decid-able.Proof . The two-way alternating finite automaton , denoted , is a general-ization of the model. The state set of a is partitioned into universal We thank Neal E. Young, who introduced us the algorithm for this proof. existential states. A accepts a string x , if and only if starting from theinitial state, every alternative transition from the universal states, and at leastone of the alternative transitions from the existential states leads to acceptance.Thus, a is a with only existential states.A one-way finite automaton , denoted , is a that cannot move itshead to left. A is a nondeterministic .Consider the following algorithm to recognize HALTING : D = “On input h M i , where M is an , and Σ is its alphabet: Construct a M ′ by modifying M to accept whenever it halts anddesignating every state as universal. Convert M ′ to an equivalent M ′ . Check whether M ′ recognizes Σ ∗ . If it does, accept . Otherwise, reject .”By its construction, M ′ recognizes Σ ∗ if and only if M halts in everycomputation path, running on every possible input string, i.e. it is alwayshalting. Stage 2 can be implemented by the algorithms given in [7] and [4]The final check in stage 3, also known as the universality problem, has a well-known algorithm. So the algorithm D decides whether a given M is alwayshalting. A probabilistic Turing machine (
PTM ) is a Turing machine equipped witha randomization device. In its designated coin-tossing states, a
PTM obtains arandom bit using the device, and proceeds by its value. The language of a
PTM is the set of strings that it accepts with a probability greater than / .A probabilistic finite automaton ( ) is a restricted PTM with a singleread-only tape. This model can also be viewed as an extension of a withdesignated coin-tossing states. A tosses a hypothetical coin whenever it isin one of those states, and proceeds by its random outcome. Formally, a consists of the following:1. a finite set of states Q = Q d ⊔ Q r , where;• Q d is the set of deterministic states, and• Q r is the set of coin-tossing states,
2. an input alphabet Σ,3. a transition function overloaded as deterministic δ d and coin-tossing δ r ;• δ d : Q d × Γ → Q × ∆, where Γ and ∆ are as defined for the ( k )’s,and• δ r : Q r × Γ × R → Q × ∆, where R = { , } is a random bit providedby a “coin toss”, The letters d and r stand for deterministic and random , respectively.
5. an initial state q ,5. an accept state q accept , and6. a reject state q reject .The language of a is similarly the set of strings which are accepted witha probability greater than / .Due to its probabilistic nature, a PTM may occasionally err, and disagreewith its language. In this paper, we will be concerned about the following typesof error:1.
Failing to accept – rejecting or looping indefinitely given a member input2.
Failing to reject – accepting or looping indefinitely given a non-memberinput
Our definitions of interactive proof systems (
IPS es) are based on [8]. We willonly be interested with a single variant, namely, the private-coin one-way
IPS .An
IPS consists of a verifier and a prover . The verifier is a
PTM vestedwith the task of recognizing an input string’s membership, and the prover is afunction providing the purported proof of membership.In private-coin one-way
IPS , the prover P can be viewed as a certificatefunction c : Σ ∗ → Λ ∞ that maps input strings to infinitely long certificates,where Σ and Λ are respectively the input and certificate alphabets. The verifier V , in turn, can be thought of as having an additional certificate tape (with ahead that cannot move left) to read from. Given an input string x ∈ Σ ∗ , V executes on it as usual, and with c ( x ) written on its certificate tape.In this paper, the term “ PTM verifier in a private-coin one-way
IPS ” will beabbreviated as “
PTM verifier”.The language A of PTM verifier V is the set of strings that V , paired withsome c ( x ), accepts with a probability greater than / . The error bound of V , denoted ε V , is then defined as the minimum value satisfying both of thefollowing, given any such input string x :• V , paired with some c ( x ), accepts x ∈ A with a probability at least 1 − ε V .• V , paired with any c ( x ), rejects x / ∈ A with a probability at least 1 − ε V .Let 1IP ε ( t ( n ) , s ( n ) , r ( n )) be the class of languages that have verifiers withan error at most ε ( ε < / ) using O ( s ( n )) space, and O ( r ( n )) amount of coinsin the worst case, and with an expected runtime in O ( t ( n )), where n denotesthe length of the input string. Instead of a function of n , and when appropriate,we write simply cons , log , poly , or exp to describe a constant, logarithmic,polynomial, or exponential limit, respectively, in terms of the input length. Our definition of the error bound corresponds to the “strong” version of the
IPS definitionin [8].
6e write 0 and ∞ to describe that a resource is unavailable and unlimited,respectively. Furthermore, let;1IP( t ( n ) , s ( n ) , r ( n )) = [ ε < ε ( t ( n ) , s ( n ) , r ( n ))1IP ∗ ( t ( n ) , s ( n ) , r ( n )) = \ ε > ε ( t ( n ) , s ( n ) , r ( n ))We note the following known results: [9, 2, 3]NP = 1IP( poly , poly ,
0) = 1IP( poly , log , log ) = 1IP( poly , log , poly )NL = 1IP( poly , log ,
0) = 1IP( ∞ , cons , cons )For polynomial-time verifiers with the ability to use at least logarithmicspace, the class 1IP ∗ ( t ( n ) , s ( n ) , r ( n )) is identical to the corresponding class1IP( t ( n ) , s ( n ) , r ( n )), since such an amount of memory can be used to time one’sown execution and reject computations that exceed the time limit, enabling theverifier to run through several consecutively appended copies of certificates forthe same string, and deciding according to the majority of the results of theindividual controls. For constant-space verifiers, this procedure is not possi-ble, and the question of whether 1IP ∗ ( ∞ , cons , cons ) equals 1IP( ∞ , cons , cons )is nontrivial, as we will examine in the following sections.
3. Linear-time 2nfa( k )’s and verification with small error In [3], Say and Yakaryılmaz showed that membership in any language in NLmay be checked by a verifier using some constant number of random bits.They also showed how the weak error of the verifier can be made arbitrarilysmall. We will now describe their approach, which forms the basis of our ownwork.The method, which we will name µ , for producing a constant-randomness verifier, given any language A ∈ NL, takes an always halting ( k ) M A recognizing A (for some k ), which exists by Lemmas 1 and 3, as its startingpoint. The constructed verifier µ ( A ) will attempt to simulate M A , relyingon the certificate and its private coins to compensate for the fact that it has k − M A . Given any input string x , µ ( A ) expects acertificate c ( x ) to provide the following information for each transition of M A en route to purported acceptance: the symbols read by the k heads, and thenondeterministic branch taken. µ ( A ) tracks the described computational pathof M A according to c ( x ), until either the path reaches a halting state, or µ ( A )catches a “lie” in the certificate, in which case it rejects. If a nondeterministic In contrast to the (strong) error definition we use in this paper, the weak error definition(also by [8]) does not regard the verifier looping forever on an input which is not a memberof the language as an error. c ( x ) reports turns out to be unavailable with the given readings,or the simulation arrives at the reject state, µ ( A ) rejects. At the beginning of M A ’s simulation, µ ( A ) chooses a head at random using ⌈ log k ⌉ coins. Through-out the simulation, µ ( A ) mimics the movements of this chosen head, verifying c ( x )’s claims about what is being scanned by that head at any step, while leav-ing the claims about the remaining k − m rounds, all of which end with the described computationalpath of M A reaching acceptance without any lies being caught, µ ( A ) finallyaccepts.For any language in A ∈ NL which can be recognized by an always halting ( k ) M A , the verifier of µ simulating M A for m rounds uses a total of m · ⌈ log k ⌉ coins, which is a constant with respect to the input length.Paired with the proper certificate c ( x ), µ ( A ) accepts all strings x ∈ A withprobability 1. As mentioned earlier, the “weak error” of µ ( A ) therefore dependsonly on its worst-case probability of accepting some x / ∈ A .For x / ∈ A , there does not exist an accepting computation of M A on x . Still,a certificate may describe a fictional computational path of M A to acceptance,by reporting inaccurate values for the symbols read by at least one of the heads.Since µ ( A ) can not check many of the actual readings, it may fail to noticethose inaccuracies. However, since µ ( A ) chooses a head to verify in random,there is a non-zero chance that µ ( A ) detects any such lie.The likelihood that µ ( A ) chooses the same head to verify as the certificateis inaccurate about is at least / k . Therefore, the weak error of µ ( A ) is atmost ( ( k − / k ) m . This upper bound for weak error can be made as close to 0as one desires by increasing m , the number of rounds to simulate.Although the underlying ( k ) M A recognizing A ∈ NL is an always halt-ing machine, the verifier µ ( A ) can still be wound up in an infinite loop bysome certificate: M A might be relying on the joint effort of its many heads toensure that it always halts. Since µ ( A ) validates only a single head’s readings,inaccuracies on what others read may tamper this joint effort, and lead µ ( A )into a loop. A malicious certificate might lead µ ( A ) in a loop due to beinginaccurate about one head alone. This might happen during the first round,and then, there would not be any more rounds for µ ( A ), as it would be in aloop. The (strong) error ε µ ( A ) of µ ( A ) is therefore at most ( k − / k . This up-per bound to ε µ ( A ) cannot be reduced to less than ( k A − / k A , where k A is theminimum number of heads required in an always halting machine to recognize A , by Corollary 4.Say and Yakaryılmaz also propose the method µ , a slightly modified versionof µ that produces verifiers with errors less than / , albeit barely so. Let A ∈ NL, and M A be an always halting ( k ) recognizing A , for some k .Regardless of the input string, the verifier µ ( A ) rejects at the very beginningwith a probability ( k − / k , using ⌈ log k ⌉ + 1 coins. Then, it continues just like The error in the approximation k ≈ ⌈ log k ⌉ used in this analysis does not affect the endresult, and simplifies the explanation. ( A ). The bounds for the error ε µ ( A ) of µ ( A ) are as follows: k − k ≤ ε µ ( A ) ≤ k − k How much of NL may yet fit into 1IP ∗ ( ∞ , cons , cons )? Method µ was ourstarting point in working towards a lower bound for 1IP ∗ ( ∞ , cons , cons ).Let M A be the ( k ) that µ ( A ) uses to verify A ∈ NL. The cause for µ ( A )’s high strong error turns out to be a decidable characteristic of M A ’sheads. We call such undependable heads risky heads . Definition 1 (Safe and risky heads).
Let M be a ( k ) with the transi-tion function δ : Q × Γ k → P (cid:0) Q × ∆ k (cid:1) . For i between 1 and k , let M i be a with the transition function δ i : Q × Γ → P ( Q × ∆) defined as follows: δ i ( q, x ) = [ y ∈ Γ k y i = x { ( r, d i ) | ( r, d ) ∈ δ ( q, y ) } If M i is always halting, then the i th head of M is a safe head. Otherwise, it isa risky head.The execution of each M i in Definition 1 is designed to correspond tothe i th -head-only simulation of the ( k ) M by the verifier of µ . Just like theverifier of µ , M i can make any of the transitions that M ’s transition functionallows, chooses one by the certificate, but making sure that the i th symbol fed to M ’s transition function is the same as the symbol it is reading itself. Crucially,if a certificate can wind the verifier of µ into a loop during the one-headedsimulation of M , then the M i has a branch of computation that loops withan analogous certificate. The converse is also true. Therefore, the verifier of µ can be wound up in a loop during a round of verification, if and only if it haschosen a risky head to verify. Lemma 6.
Being safe or risky is a decidable property of a ( k ) ’s heads.Proof. To decide whether the i th head of a ( k ) M is safe, an algorithmcan construct the M i described in Definition 1, and then test whether M i ∈ HALTING by the algorithm in Lemma 5.Consider a language A ∈ NL that is recognized by a ( k ) M A that alwayshalts, and has safe heads only. The verifier µ ( A ) using M A cannot choose arisky head, and therefore can never loop. Thus, it verifies A with ε µ ( A ) ≤ ( ( k − / k ) m . 9 .2. ( k ) ’s with a safe head and small-error verification The distinction of safe and risky heads has been the key to our improvementto the method µ . Method µ , to be introduced in the proof of the followinglemma, is able to produce verifiers with an error bound equaling any desirednon-zero constant, for a subset of languages in NL. Lemma 7.
Let A ∈ NL . If there exists an always halting ( k ) with at leastone safe head recognizing A , then A ∈ ∗ ( ∞ , cons , cons ) .Proof idea. The method µ in the proof will construct verifiers similar to thoseof µ , except for a key difference. Given a language A ∈ NL recognized by analways halting ( k ) M A that has at least one safe head, every head of M A has essentially the same probability of getting chosen by µ ( A ). In contrast, µ ( A ) will be more likely to choose safe heads than the risky heads. Since µ ( A ) cannot loop while tracking a safe head, one can reduce the probability of µ ( A ) looping in any round to any non-zero constant P R by increasing its biastowards the safe heads.The (redeemable) disadvantage of µ ( A ) for having a bias towards the safeheads is that it will be less likely to choose any risky head. So a certificate’s liesabout the risky heads will be less likely to get detected. However, the probability p of choosing any head is still non-zero, as long as the bias is not absolute. Thus,the chances of repeatedly missing lies for m rounds will be at most (1 − p ) m ,which can also be lowered to any non-zero value by increasing m . Proof.
Let A ∈ NL , and M A = ( Q, Σ , δ, q , q accept , q reject ) be an always halting ( k ) recognizing A with at least one safe head.Let s = ⌈ log k ⌉ . Regarding the risky heads, let H R be the set of their indices, k R be their count, and if k R >
0, let ν R : { , } s → H R be any total function,such that each i in H R is mapped to by ν R exactly ⌊ s / k R ⌋ or ⌈ s / k R ⌉ many times.Regarding the safe heads, let H S , k S , and ν S be defined analogously.The following parameters will be controlling the error of the verifier:• m as the number of rounds to simulate• P R < k R is zeroLet r be the minimum number of fractional digits to represent P R in binary.Then, the algorithm for µ ( A ) is as follows: µ ( A ) = “On input x : Repeat m times: Move the tape head to its original position. Choose i from { , . . . , k } randomly with bias, as follows: Flip r coins for a uniformly random binary probability value t with r fractional digits. Flip s more coins. Let u ∈ { , } s be the outcomes. Choose i as ν R ( u ) if t < P R , and as ν S ( u ) otherwise.10 . Let q = q . Repeat the following until q = q accept : Read y ∈ Σ k from the certificate. If y i differs from the symbolunder the tape head, reject . Read ( q ′ , d ) ∈ Q × ∆ k from the certificate. If ( q ′ , d ) / ∈ δ ( q, y ),or q ′ = q reject , reject . Set q = q ′ . Move the tape head by d i . Accept .”An iteration of stage 1 is called a round . The string of symbols read fromthe certificate during a round is called a round of certificate . Running on a non-member input string, µ ( A ) false accepts for a round , when that round endswithout rejecting. Similarly, µ ( A ) loops on a round , when that round does notend.Verifier µ ( A ) keeps track of M A ’s state, starting from q , and advancing itby δ and the reports of the certificate. At any given round, µ ( A ) can either beled to the state q accept and pass, to the state q reject and reject, to follow a loopof transitions availed by δ and run indefinitely, or to a verification failure andagain reject. Since these are events of distinct premises, a certificate may notlead µ ( A ) to any combination of those at the same time, regardless of µ ( A )’srandom choice of head to verify.Verifier µ ( A ) running on an input string x ∈ A always accepts, if pairedwith a proper certificate that provides m rounds of certificate, each logging anaccepting execution path of M A .Given an input x / ∈ A , every execution path of the always halting ( k ) M A recognizing A rejects eventually. For µ ( A ) to accept x , or loop on it,a certificate c ( x ) must be reporting an execution path that is possible by δ ,however impossible for M running on x . The weak point of µ ( A )’s verificationis the fact that it overlooks k − c ( x ) must lieabout those overlooked symbols. Since, however, µ ( A ) chooses a head to verifyrandomly and in private, lies about a head in c ( x ) have just as much chance ofbeing detected as how often that head gets selected.Let p be the probability of µ ( A ) choosing the least likely head of M A . Bythe restrictions on P R , and the definition of ν S and ν R , every head of M A has anon-zero chance of being chosen, and therefore p >
0. If c ( x ) has an inaccuracy,then p is also the minimum probability of it being detected.Falsely accepting a string x is possible for µ ( A ), only if x is not a memberof A , c ( x ) is an inaccurate certificate with more than m rounds, and µ ( A ) failsto detect the inaccuracies in each round. The probability of this event is atmost (1 − p ) m . (1)Looping on a string x / ∈ A is possible for µ ( A ), only if c ( x ) is an inaccuratecertificate with m ′ ≤ m rounds, µ ( A ) fails to detect the inaccuracies in eachround, and µ ( A ) chooses a risky head on the final and infinite round. Theprobability of this event is at most(1 − p ) m ′ − · P R . (2)11he probability that µ ( A ) falsely accepts (Equation (1)) can be reducedarbitrarily to any non-zero value by increasing m . The probability that it loopson a non-member input (Equation (2)) can also be reduced to any positive valueby reducing P R if k R >
0, and is necessarily 0 otherwise.Verifier µ ( A ) uses m · ( r + s ) coins in its execution; a constant amount thatdoes not depend on the input string.In summary, given any language A ∈ NL that can be recognized by a ( k )with at least one safe head, and for any error bound ε > µ ( A ) can verifymemberships to A within that bound. The amount of coins µ ( A ) uses dependsonly on ε , and is constant with respect to the input string. ( k ) ’s and safe heads Lemma 8.
Given a language A , the following statements are equivalent:(1) A ∈ L ( ( k ) , linear - time ) .(2) A is recognized by a ( k ) with at least one safe head. The proof of Lemma 8 will be in two parts.
Proof of (1) = ⇒ (2). Given A ∈ L ( ( k ) , linear - time ), for some k , there ex-ists a ( k ) M recognizing A together with a constant c , such that given anyinput string x , M halts in at most c · | x | steps. Consider the ( k + 1) M ′ ,which operates its first k heads by M ’s algorithm, and uses its last head T asa timer that moves to the next cell on the input tape every c th step of the exe-cution. Head T times out when it reaches the end of the string, and M ′ rejectsin that case.Note that M ′ recognizes indeed the same language as M , given that M ,as well as M ′ , runs for at most c · | x | steps for any given input string x , andtherefore T cannot ever reach the end of x . Moreover, head T in M ′ is a safehead. Proof of (2) = ⇒ (1). Let M be a ( k ) recognizing A , such that its i th headis a safe head. Let δ : Q × Γ k → P (cid:0) Q × ∆ k (cid:1) be the transition function of M .Let M i be the with the following transition function as in Definition 1: δ i ( q, x ) = [ y ∈ Γ k y i = x { ( r, d i ) | ( r, d ) ∈ δ ( q, y ) } Note the relationship between the computational paths (sequences of con-figurations) of M and M i running on the same input string. These machineshave the same state set, but M i is running a program which has been obtainedfrom the program of M by removing all constraints provided by all the other k − M through“filters” that only show the current state and the present position of the i th head, and hide the rest of the information in M ’s configurations, one will onlysee legitimate computational paths of M i .12ince the i th head is safe, M i is always halting, and δ i does not allow M i toever repeat its configuration in a computation. But this means that M is alsounable to loop forever, since the two components of its configuration (the stateand the position of its i th head) can never be in the same combination of valuesat two different steps. So M can not run for more than | Q | · ( n + 2) steps, where n is the length of the input string.We have proven the following theorem. Theorem 9. L ( ( k ) , linear - time ) ⊆ ∗ ( ∞ , cons , cons ) . Note that the following nonregular languages, among others, have linear-time ( k )’s, and can therefore be verified with arbitrarily small error byconstant-randomness, constant-space verifiers: EQ1 = (cid:8) i i (cid:12)(cid:12) i ∈ N (cid:9) PAL = { x | x is the reverse of itself } EQ2 = (cid:8) x (cid:12)(cid:12) x ∈ { , } ∗ and contains equally many ’s and ’s (cid:9) CERT = (cid:8) x · · · x l x +1 · · · x + l (cid:12)(cid:12) l > x , . . . , x l ∈ { , } (cid:9) There are (2)’s without risky heads recognizing the languages
EQ1 and
PAL . We have not been able to find ( k )’s without risky heads that recognizethe languages EQ2 and
CERT .
4. Discussion and conclusion
Having determined that L ( ( k ) , linear - time ) ⊆ ∗ ( ∞ , cons , cons ) ⊆ NL,it is natural to ask if any one of these subset relationships can be replaced byequalities. Let us review the evidence we have at hand in this matter.One approach to prove the claim that constant-space, constant-randomnessverifiers can be constructed for every desired positive error bound (i.e. that1IP ∗ ( ∞ , cons , cons ) = 1IP( ∞ , cons , cons )) would be to show that NL equals L ( ( k ) , linear - time ), i.e. that any ( k ) has a linear-time counterpart rec-ognizing the same language. This, however, is a difficult open question [3]. Asa matter of fact, there are several examples of famous languages in NL, e.g. PATH = { h G, s, t i | there is a path from node s to node t on the graph G } , for which we have not been able to construct ( k )’s with a safe head, and weconjecture that L ( ( k ) , linear - time ) = NL.We will now show that L ( ( k ) , linear - time ) is contained in a subset ofNL corresponding to a tighter time restriction of O ( n / log( n ) ) on the underlyingnondeterministic Turing machine. NTISP( f ( n ) , g ( n )) denotes the class of lan-guages that can be verified by a TM that uses O ( f ( n )) time and O ( g ( n )) space,simultaneously. Recall that logarithmic-space TM ’s require Ω( n / log( n ) ) time for recognizing the palin-dromes language [10, 11, 12], which is easily recognized by a linear-time (2). heorem 10. L ( ( k ) , linear - time ) ⊆ NTISP( n / log( n ) , log n ) Proof idea . Given a ( k ) M that runs in linear time, an NTM N can simulateit in O ( n / log( n ) ) steps. One such N uses k counters for keeping the headpositions of M , and k caches for a faster access to the symbols in the vicinity ofeach head, on a tape with 2 k tracks. N initializes its caches with a ⊲ symbol,followed by the first log( n ) symbols of the input, and puts a mark on ⊲ symbolsto indicate the position of each simulated head. Counters are initialized as 0 foryet another indication of the head positions.To mimic M reading its tape, N reads the marked symbols on its caches. Tomove the simulated heads, N both moves the marks on the caches, and adjuststhe counters. If a mark reaches the end of its cache, N re-caches by copying thelog( n ) symbols centered around the corresponding head from the input to thatcache. Counters provide the means for N to locate these symbols on the input.As the analysis will show, the algorithm described for N runs within thepromised time and space bounds. In the following proof, N will have an addi-tional track that has a mark on its log( n ) / cell to indicate the middle of thecaches. Proof.
Let M = ( Q, Σ , δ, q , q accept , q reject ) be a ( k ) that runs in linear time.An NTM N can simulate M , by using 2 k + 1 tracks on its tape to have;• k log( n ) digit binary counters, κ , . . . , κ k , with their least significant digiton their left end,• k caches of input excerpts of log( n ) length, η , . . . , η k , and• a mark on the log( n ) / cell to indicate the middle.The work tape alphabet Γ = Γ kκ × Γ kη × { ⊲⊳, ␣ } allows N to encode thoseinformation, where;• Γ κ = { , , ␣ } to represent each κ i • Γ η = Σ ⋄ ∪ H Σ ⋄ to represent each cache, where; – Σ ⋄ = Σ ⊔ { ⊲ , ⊳ , , ␣ } , and – H Σ ⋄ is a clone of Σ ⋄ , containing “marked” versions of all Σ ⋄ ’s symbols.Initially, all cells of the work tape contain the symbol ␣ k +1 . The algorithmof N is as follows: N = “On input x of length n : Write to each κ i . Write H ⊲ x · · · x log( n ) on to each η i . Write ⊲⊳ to the log( n ) / cell of the last track. Let q = q . Repeat the following until q = q accept : We thank Martin Kutrib for providing us with an outline of this proof. . Scan the caches. Note the marked symbol in η i as y i . Guess a ( r, d ) ∈ δ ( q, y · · · y k ). Reject if the set is empty, or r = q reject . For all i , adjust κ i , and move the mark on η i by d i . Re-cache each η i that has a H symbol, as follows: Clear the mark on H of η i . Go to κ i th cell on the input. Go to middle of η i on the work tape. Move both tape heads left, until the left end of η i is reached. Copy log( n ) symbols from the input to between the symbols of η i . Move both tape heads left, until the middle of η i is reached. Mark the middle symbol on η i . Set κ i to the input head’s position index. Update q as r . Accept .” N should carefully prepend/append the left/right end marker to a cachewhen copying the beginning/end of the input in stage 13, respectively. N shouldalso skip stage 7 for an i , if the corresponding movement is done while readingan end marker and attempting a movement beyond it. These details have beenomitted from the algorithm to reduce clutter.Counting up to n in binary is a common task across this algorithm, andtakes linear time, by a standard result of amortized analysis. Only the stagesthat take a constant amount of steps are omitted from the following analysis.Stage 2 takes O ( n ) time as it involves counting up to n in binary to find andmarking the log( n ) th cell on the caches. After putting on both ends, copying x · · · x log( n ) in takes log( n ) more steps. Stage 3 can be performed in O (cid:0) log n (cid:1) steps, by copying symbols over from a cache, and moving them towards thecenter one by one until they meet.Given that M runs in linear time, the loop of stage 4 is repeated for at most O ( n ) many times. Stages 5 and 7 take logarithmic time.The re-caching in stage 8 is to shift the window of input on a cache by log( n ) / , so that the mark will be centered on that cache. Stages 10 and 16 arethe most time consuming sub-stages of a re-cache, involving decrementing of κ i down to 1, and setting it back to its original value, respectively. They bothtake O ( n ) time, for that they count down from or up to n at most. Every othersub-stage of a re-cache takes O (log n ) time. As a result, each re-cache takes O ( n ) time.Re-caches are prohibitively slow. Luckily, since the head marker is shiftedto the middle with each re-cache, a subsequent re-cache will not happen on thesame cache for at least another log( n ) / steps of the simulation. Moreover, sincethe number of steps that M runs is in O ( n ), the number of times a cache canbe re-cached is in O ( n / log( n ) ) for the entire simulation. Hence, stage 8’s time This is done using the states of N , and does not use work tape. N is O ( n / log( n ) ).Caches and counters occupy O (log n ) cells on N ’s tape. Since every stage of N runs in O ( n / log( n ) ) time, so does N .It is not known whether NL contains any languages that are not membersof NTISP( n / log( n ) , log n ).If 1IP ∗ ( ∞ , cons , cons ) is indeed a proper subset of 1IP( ∞ , cons , cons ), study-ing the effects of imposing an additional time-related bound on the verifier maybe worthwhile in the search for a characterization. We conclude by noting thefollowing relationship between runtime, the amount of randomness used, andthe probability of being fooled by a certificate to run forever in our setup: Lemma 11.
Let V be a verifier flipping r coins at most in a private-coinone-way IPS , and recognizing the language A . If V running on some string x / ∈ A of length n paired with some certificate c ( x ) always takes ω (cid:0) n r − (cid:1) steps,then its error is at least / .Proof. Let V be a as described above, recognizing A . By an idea introducedin [3], we will construct a verifier equivalent to V . For z ∈ { , } r , let V z bethe verifier that is based on V , but hard-wired to assume that its i th “coinflip” has the outcome z i . Construct the verifier V ′ that flips r coins atthe beginning of its execution, and obtains the r -bit random string z . Then, V ′ passes the execution to V z .Verifiers V and V ′ have the same control, whenever their random bits arethe same. Therefore, they are equivalent.Each V z has O ( n ) different configurations, where n denotes the length of theinput string. Similarly, any collection of 2 r − distinct V z has O (cid:0) n r − (cid:1) differentcollective configurations. Let V be any one of those collections.Let x and c ( x ) be a nonmember string and its certificate satisfying thepremise of the statement. Then, each V z paired with c ( x ) also runs on x for ω (cid:0) n r − (cid:1) steps. The collection V , in that many steps, necessarily repeats acollective configuration.Consider the prefix p ( x ) of c ( x ) consumed by V ′ until the first time a col-lective configuration of V is repeated. Also consider the suffix s ( x ) of p ( x ) con-sumed by V ′ since the first occurrence of the repeated collective configuration.Then, V ′ paired with the certificate c ′ ( x ) = p ( x ) s ( x ) ∞ repeats its configurationsindefinitely whenever it chooses any of the V z ∈ V to pass the execution to.Both V ′ and V paired with c ′ ( x ) loop on x with a probability at least / .Consequently, their errors are at least / . Acknowledgements
We are grateful to Martin Kutrib, Neal E. Young, Ryan O’Donnell, andRyan Williams for their helpful answers to our questions. We also thank theanonymous referees of [1] for their constructive comments.16 eferenceseferences