Proof-Labeling Schemes: Broadcast, Unicast and In Between
PProof-Labeling Schemes: Broadcast, Unicast and InBetween
Boaz Patt-Shamir and Mor Perry
School of Electrical Engineering, Tel Aviv University, Tel Aviv 6997801, Israel.
Abstract.
We study the effect of limiting the number of different messages anode can transmit simultaneously on the verification complexity of proof-labelingschemes (PLS). In a PLS, each node is given a label, and the goal is to verify,by exchanging messages over each link in each direction, that a certain globalpredicate is satisfied by the system configuration. We consider a single parameter r that bounds the number of distinct messages that can be sent concurrently byany node: in the case r = 1 , each node may only send the same message to all itsneighbors (the broadcast model), in the case r ≥ ∆ , where ∆ is the largest nodedegree in the system, each neighbor may be sent a distinct message (the unicastmodel), and in general, for ≤ r ≤ ∆ , each of the r messages is destined to asubset of the neighbors.We show that message compression linear in r is possible for verifying funda-mental problems such as the agreement between edge endpoints on the edge state.Some problems, including verification of maximal matching, exhibit a large gapin complexity between r = 1 and r > . For some other important predicates,the verification complexity is insensitive to r , e.g., the question whether a sub-set of edges constitutes a spanning-tree. We also consider the congested cliquemodel. We show that the crossing technique [5] for proving lower bounds on theverification complexity can be applied in the case of congested clique only if r = 1 . Together with a new upper bound, this allows us to determine the verifi-cation complexity of MST in the broadcast clique. Finally, we establish a generalconnection between the deterministic and randomized verification complexity forany given number r . Keywords: verification complexity, proof-labeling schemes, CONGEST model,congested clique
Similarly to classical complexity theory, studying the verification complexity of variousproblems is one of the major approaches in the quest to understand the complexity ofnetwork tasks. The basic idea, proposed by Korman, Kutten and Peleg [22] under thename Proof-Labeling Schemes (PLS for short), is to assume that an oracle assigns alabel to each node, so that by exchanging these labels, the nodes can collectively verifythat a certain global predicate holds (see Sec. 2 for details). The verification complexityof a predicate π is defined to be the minimal label length which suffices to verify π .This node-centric, space-based view was generalized in subsequent work, in which itwas allowed for nodes to send different messages to different neighbors, rather than a r X i v : . [ c s . D C ] A ug B. Patt-Shamir and M. Perry the whole local label to all neighbors. Specifically, in [5] the verification complexity isdefined to be the minimal message -length required to verify the given predicate.The distinction between these two models is natural and appears in other contextsas well, like the broadcast and the unicast flavors of congested clique, proposed byDrucker et al. [9]: in the unicast flavor, a node may send a different message to eachof its neighbors, while in the broadcast flavor, all neighbors receive the same message.Following up on this model, Becker et al. [6] proposed considering a spectrum of con-gested clique models, where a node may send up to r distinct messages in a round,where ≤ r < n is a given parameter. This model, called henceforth MCAST ( r ) , canbe motivated by observing that r can be viewed as the number of network interfaces(NICs) a node possesses: Each interface may be connected to a subset of the neighbors,and it can send only a single message at a time. Our Results.
In this paper we present a few preliminary results concerning PLS in the
MCAST ( r ) model. Our main focus is on the tradeoff between the number r of differ-ent messages a node can send in one round and the verification complexity (messagelength) κ . While there are problems whose verification complexity is independent of r , we prove that the verification complexity of some fundamental problems is highlydependent on r . First, we consider the problem of matching verification ( MV ), whereevery node has at most one incident edge marked, and the goal is to verify whether theset of marks implies a well defined matching, i.e., an edge is either marked in both end-points or unmarked in both, and that this set is a matching. In [19], among other results,it is shown that maximal matching has verification complexity Θ (1) , and that the verifi-cation complexity of maximum matching in bipartite graphs is also Θ (1) . These resultsimplicitly assume that the subset of edges is well defined; our results show that in fact,the main difficulty is in ensuring that both endpoints of an edge agree on its status.This motivates our next problem that focuses on consistency. Specifically, we define theprimitive problem edge agreement ( EA ) as follows. Each node has a b -bit string for eachincident edge, and a state is considered legal iff both endpoints of each edge agree onthe string associated with that edge. It turns out that the arboricity of the graph, denoted α ( G ) , plays an important role in the verification complexity of EA (and all problemsthat EA can locally be reduced to). In Theorem 2, we prove that κ ( EA ) · r ∈ Θ ( α ( G ) b ) .Next, as a more sophisticated example, we consider the important problem of maximumflow ( MF ): In Theorem 3 we show that κ ( MF ) · r ∈ Θ ( α ( G ) log f max ) , where f max isthe largest flow value over an edge. In [22], a scheme to verify that the maximum flowbetween a given pair of nodes s and t is exactly k is given in the broadcast model, withcomplexity O ( k (log k + log n )) . We prove, in Theorem 4, that the verification com-plexity of this problem in the broadcast model is O (min { α ( G ) , k } (log k + log ∆ )) ,which is an exponential improvement in some cases. In addition, our upper bound scaleslinearly with r in the MCAST ( r ) model.We also consider the congested clique model. To date, no lower bounds on theverification complexity in the congested clique were known. We show that the knowntechnique of crossing [5] can be applied, but only in broadcast clique (i.e., MCAST (1) ).We use this argument, along with a new scheme, to obtain a tight Θ (log n + log w max ) bound for MST verification in broadcast cliques, where w max denotes the largest edgeweight. roof-Labeling Schemes: Broadcast, Unicast and In Between 3 Finally, we show that all results translate to randomized PLS (RPLS) [5]. Extendinga result of [5], we show that if both PLS and RPLS are using the same number r , thenan exponential difference in verification complexity holds in both directions, i.e., in the MCAST ( r ) model, an RPLS with verification complexity O (log κ d ) can be constructedout of every PLS with verification complexity κ d , and every RPLS with verificationcomplexity κ r can be used to construct a PLS with verification complexity O (2 κ r ) . Related Work.
Drucker et al. [9] propose a local broadcast communication in the con-gested clique, where every node broadcasts a message to all other nodes in each round.Becker et al. [6] proposed, still for congested cliques, a bounded number r of differentmessages a node can send in each round.Verification of a given property in decentralized systems finds applications in vari-ous domains, such as, checking the result obtained from the execution of a distributedprogram [4,17], establishing lower bounds on the time required for distributed ap-proximation [8], estimating the complexity of logic required for distributed run-timeverification [18], general distributed complexity theory [16], and self stabilizing algo-rithms [7,21].The notion of distributed verification in a single round was introduced by Kor-man, Kutten, and Peleg in [22]. The verification complexity of minimum spanning-trees(MST) was studied in [20]. Constant-round schemes were studied in [19]. Verificationprocesses in which the global result is not restricted to be the logical conjunction oflocal outputs had been studied in [2,3]. The role of unique node identifiers in local de-cision and verification was extensively studied in [14,13,15]. Proof-labeling schemesin directed networks were studied in [11], where both one-way and two-way commu-nication over directed edges is considered. Verification schemes for dynamic networks,where edges may appear or disappear after label assignment and before verification,are studied in [12]. Recently, a hierarchy of local decision as an interaction between aprover and a disprover was presented in [10]. Paper Organization.
The remainder of this paper is organized as follows. In Section 2we formalize the model and recall some graph-theoretic concepts. In Section 3 wepresent two general techniques that apply to the
MCAST ( r ) model. In Section 4 wepresent results for verification of matching, edge agreement, and max-flow. In Section 5we present our results for congested cliques. In Section 6 we analyze the relation be-tween deterministic and randomized PLSs. We conclude in Section 7 with some openquestions and directions for future work. Computational Framework and the
MCAST
Model.
Our model is derived from the
CONGEST model [27]. Briefly, a distributed network is modeled as a connected undi-rected graph G = ( V, E ) , where V is the set of nodes, E is the set of edges, and everynode has a unique identifier. In each synchronous round every node performs a localcomputation, sends a message to each of its neighbors, and receives messages from allneighbors. We denote the number of nodes | V | by n and the number of edges | E | by m . For every node v ∈ V , let d ( v ) be the degree of v . We denote by ∆ ( G ) the maximal B. Patt-Shamir and M. Perry degree of a node in G . We assume that the edges incident to a node v are numbered , . . . , d ( v ) .The main difference between the model considered in this paper, called MCAST ( r ) ,and CONGEST , is that in
MCAST ( r ) we are given a parameter r ∈ N such that a nodemay send at most r distinct messages simultaneously. More precisely, we assume thatprior to sending messages, the neighbors of a node are partitioned into r disjoint subsets(some of which may be empty), such that v sends the same message to all neighbors ina subset. We emphasize that in our model, for simplicity, r is a uniform parameter forall nodes. Proof-Labeling Schemes in the
MCAST model. A configuration G s includes an un-derlying graph G = ( V, E ) and a state assignment function s : V → S , where S isa (possibly infinite) state space. The state of a node v , denoted s ( v ) , includes all localinput to v . In particular, the state usually includes a unique node identity ID( v ) and, inthe case of weighted graphs, the weight w ( e ) of each incident edge e . The state of v typically include additional data whose integrity we would like to verify. For example,node state may contain a marking of incident edges, such that the set of marked edgesconstitutes a spanning tree.Let F be a family of configurations, and let P be a boolean predicate over F . Aproof-labeling scheme consists of two conceptual components: a prover p , and a verifier v . The prover is an oracle which, given any configuration G s ∈ F satisfying P , assignsa bit string (cid:96) ( v ) to every node v , called the label of v . The verifier is a distributedalgorithm running at every node. At each node v , the local verifier takes as input thestate s ( v ) of v , its label (cid:96) ( v ) and based on them sends messages to all neighbors. Then,using as input the messages received from the neighbors, the local state and the locallabel, the local verifier computes a boolean value. If the outputs are TRUE at all nodes,the global verifier v is said to accept the configuration, and otherwise (i.e., at least onelocal verifier outputs FALSE ), v is said to reject the configuration. For correctness, aproof-labeling scheme Σ = ( p , v ) for ( F , P ) must satisfy the following requirements,for every G s ∈ F : – If P ( G s ) = TRUE then, using the labels assigned by p , the verifier v accepts G s . – If P ( G s ) = FALSE then, for every label assignment, the verifier v rejects G s .Given a configuration G s , we denote by c Σ ( G s ) the vector of length | E | that containsthe messages sent according to the scheme Σ , and we refer to this vector as the com-munication pattern of Σ over G s . For an underlying graph G , we denote by L ( G ) thenumber of legal configurations of G , and by W Σ ( G ) the number of different commu-nication patterns of Σ in G , over all legal configurations. In our analysis, given an edge ( v, u ) ∈ E , we denote by M v ( e ) the message over e from v to u .Our central measure for PLSs is its verification complexity, defined as follows. Definition 1.
The verification complexity of a proof labeling scheme Σ = ( p , v ) forthe predicate P over a family of configurations F is the maximal length of a messagegenerated by the verifier v based on the labels assigned to the nodes by the prover p ina configuration G s for which P ( G s ) = TRUE . In this paper we consider PLSs in the
MCAST ( r ) model, namely we impose theadditional restriction that at most r distinct messages may be sent by a node. roof-Labeling Schemes: Broadcast, Unicast and In Between 5 Arboricity, degeneracy and average degree.
The average degree of a graph playsa central role in our study. However, graphs may have dense and sparse regions. Wetherefore use the following refined concepts.
Definition 2.
The arboricity of a graph G = ( V, E ) , denoted by α ( G ) , is defined as theminimum number of acyclic subsets of edges that cover E . The degeneracy of a graph G , denoted by δ ( G ) , is defined as the smallest value i such that the edges of G can beoriented to form a directed acyclic graph with out-degree at most i . The following properties are well known [25,26].
Lemma 1.
For all graphs G , α ( G ) ≤ δ ( G ) < α ( G ) . Lemma 2.
For a given graph G = ( V, E ) , α ( G ) = max (cid:110)(cid:108) m H n H − (cid:109) | V H ⊆ V, | V H | ≥ (cid:111) ,where m H = | E H | and n H = | V H | over all induced subgraphs H = ( V H , E H ) of G . Note that by Lemmas 1 and 2, the minimal number of outgoing edges in the best ori-entation of a graph G is proportional to the maximal average degree over all inducedsubgraphs of G . MCAST
Model
In this work, we consider problems expressible as a conjunction of edge predicates,where a node may have a different input for every edge. We present two techniques thatcan be used as building blocks in the design of efficient PLSs in the
MCAST model.The first technique, which we call minimizing orientation , reduces the number ofincident edges a node sends its input on. We orient the edges such that the maximumout degree is minimized. Lemma 1 ensures that the maximum out degree is bounded by α . Using a minimizing orientation, we can prove the following lemma. Lemma 3.
Suppose that a verification problem ( F , P ) is expressible as a conjunctionof edge predicates, each involving variables from a single pair of neighbors. Then thereexists a PLS Σ = ( p , v ) for ( F , P ) in the MCAST (2 α ) model with verification complex-ity k , where k is the length of the largest local input to an edge predicate. Proof:
We describe the scheme Σ = ( p , v ) . The prover p orients the edges such thatthe maximum out-degree of a node is minimized (this can be done in linear time, see,e.g., [24]). Then, every node sends its input only on outgoing edges.The orientation can be verified simply by a local verification that a node receives amessage from every incoming edge and does not receive a message on every outgoingedge. Note that the empty message is also counted in the number r of different mes-sages. By definition of degeneracy, the maximum out degree is δ , and by Lemma 1 δ is strictly smaller than α . Therefore, in the MCAST (2 α ) model, in addition to send-ing a different message on every outgoing edge, we may use the empty message for Given a graph G = ( V, E ) , the induced subgraph H = ( V H , E H ) over the set of nodes V H ⊆ V satisfies that E H = E ∩ ( V H × V H ) . B. Patt-Shamir and M. Perry incoming edges. After verifying that the orientation is correct (i.e., consistent betweenneighbors), by definition of the scheme, the function of every edge is computed by oneof its endpoints and the verification is completed. Color addressing.
In the unicast model, each node receives its own message. How-ever, if we want to use a unicast PLS in the
MCAST ( r ) model with r < α , we mayneed to bundle together a few messages, and hence we need to somehow tag each partof the message with its intended recipient. Clearly this can be done by tagging eachsub-message by the unique ID of recipient, but this adds Θ (log n ) bits to each sub-message. The color addressing technique reduces this overhead to O (log ∆ ) . The ideais that each node need only distinguish between its neighbors. We solve this difficultyby coloring the nodes so that no two neighbors of a node get the same color. Formally, color addressing is a PLS Σ COL = ( p , v ) in the broadcast model, where the prover p first colors the nodes so that no two nodes at distance 1 or 2 receive the same color.This is possible using at most ∆ + ∆ + 1 ∈ O ( ∆ ) colors, because every node hasat most ∆ neighbors and ∆ nodes at distance from it. Next, the prover assigns toevery incident edge of a node the color of the neighbor at the other end of the edge.The verifier v at a node v broadcasts the color assigned to v by the prover. Every nodeverifies that every incident edge is assigned a different color and that the color receivedfrom every edge is the color assigned by the prover to this edge.Clearly, Σ COL guarantees a proper coloring as desired to use for addressing, andthis coloring is locally verifiable. Moreover, since a color can be represented using O (log ∆ ) bits, we obtain local addressing with verification complexity O (log ∆ ) in the broadcast model. We summarize in the following lemma. Lemma 4. Σ COL is a PLS in the broadcast model, which assigns and verifies an O (log ∆ ) -bit coloring for proper addressing. The verification complexity of Σ COL is O (log ∆ ) . MCAST ( r ) Model
In this section, we study the effect of r on the verification complexity of PLSs in the MCAST ( r ) model. We start with the observation that for some problems, the asymptoticverification complexity is independent of r . These problems include the deterministicverification of a spanning-tree and vertex bi-connectivity, and the randomized verifi-cation of an MST. For each of these problems, we provide a scheme for r = 1 withverification complexity that matches the lower bound for r = ∆ [22,5]. In contrast,there are problems for which the verification complexity is sensitive to r . Specifically,we present a tight bound for the matching verification problem in the broadcast model,which is reduced dramatically even for r = 2 . Finally, we show tight bounds for theprimitive problem of edge agreement and the more sophisticated application of maxi-mum flow, which scales linearly with r . We note that using simple port numbering requires agreement with the neighbors, which iscostly, as we prove in Theorem 2.roof-Labeling Schemes: Broadcast, Unicast and In Between 7
In the literature, in verification problems of the form “does a subset of edges satisfy aspecified property,” it is usually assumed that the subset of edges is well defined, i.e.,for every edge e = ( u, v ) , the local state of v indicates that e is in the subset if and onlyif the local state of u indicates it. However, since edges do not have storage, an edge setis actually represented by the local state at the nodes, and hence consistency betweenneighbors is not always guaranteed.In fact, there are problems for which the verification of consistency is the dominantfactor of the verification complexity. In particular, consider matching problems: maxi-mal matching, and maximum matching in bipartite graphs. Both problems are known tohave constant verification complexity [19]. However, these results make the problem-atic assumption that the edge set in question is well defined. We consider the matchingverification problem using the following definition. Definition 3 (Matching Verification( MV )). Instance : At each node v , at most one edge is marked. We use I v ( e ) ∈ { TRUE , FALSE } to denote whether e is marked in v . Question : Is the set M of marked edges well defined, i.e., I v ( e ) = I u ( e ) for every edge e = ( u, v ) ∈ E , and M is a matching? We argue that in the broadcast model, the verification complexity of this problemis Θ (log ∆ ) . Formally, we study the problem ( F m , MV ) , where F m is the family ofconnected configurations with edge indication at each node. We obtain the followingresult. Theorem 1.
The verification complexity of ( F m , MV ) in the broadcast model is Θ (log ∆ ) . We start with proving the lower bound of the theorem as stated in the followinglemma. The proof uses a variant of crossing arguments [5].
Lemma 5.
The verification complexity of any PLS for ( F m , MV ) in the broadcast modelis Ω (log ∆ ) . Proof:
By contradiction. Let n and ≤ ∆ ≤ n/ be given. We construct thefollowing graph G = ( V, E ) with maximum degree ∆ . The n -node graph G consistsof two parts. One part is a complete bipartite graph over two sets of nodes A and B of size ∆ − each: H = ( A, B, E H ) = K ∆ − ,∆ − ; the second part consists of an n − ∆ − path, connected by an edge to a node in A .Given a configuration G s of G , let I G s v ( e ) denote I v ( e ) (the mark of edge e asrepresented in the state of v ). Given a configuration H s of the nodes of H , extend it toa configuration G ( H s ) of G as follows. For every e = ( u, v ) ∈ E H let I G ( H s ) v ( e ) = I H s v ( e ) , and for every e = ( u, v ) ∈ E \ E H , let I G ( H s ) v ( e ) = 0 . Clearly, H s is legal ifand only if G ( H s ) is legal. We note that the number of different matchings in H , L ( H ) ,is at least ( ∆ − , because every permutation of ∆ − elements represents a differentmatching in H . B. Patt-Shamir and M. Perry
Now, let Σ = ( p , v ) be a PLS for ( F m , MV ) in the broadcast model, and assumefor contradiction that κ ( Σ ) < log( ∆ − − . Recall that W Σ ( H ) is the number ofdifferent communication patterns of Σ in H . Then W Σ ( H ) (1) ≤ ∆ − κ (2) < ( ∆ −
1) log ∆ − e = (cid:18) ∆ − e (cid:19) ∆ − ≤ ( ∆ − ≤ L ( H ) . Inequality (1) is true since for every PLS in the broadcast model with verification com-plexity κ , every communication pattern in H can be constructed by choosing a κ -bitmessage for each of the ∆ − nodes in H . Inequality (2) follows from our as-sumption that κ < log( ∆ − − and the fact that log e < . Therefore, thenumber of communication patterns of Σ in H is strictly smaller than the numberof legal configurations of H . Therefore, there must be two different legal configura-tions G ( H s ) and G ( H (cid:48) s ) with the same communication pattern in H . Since G ( H s ) and G ( H (cid:48) s ) differ only over E H edges, there must exist an edge e ∗ = ( v, u ) ∈ E H such that I G ( H s ) v ( e ∗ ) = I G ( H s ) u ( e ∗ ) (cid:54) = I G ( H (cid:48) s ) v ( e ∗ ) = I G ( H (cid:48) s ) u ( e ∗ ) . Consider the configurationobtained from G ( H s ) with I G ( H (cid:48) s ) w ( e ) replacing I G ( H s ) w ( e ) for every node w ∈ B andevery edge e = ( w, w (cid:48) ) ∈ E H . Intuitively, in this configuration, the state of all nodesin V \ B is as in G ( H s ) , and the state of nodes in B is as in G ( H (cid:48) s ) . Obviously, thisconfiguration is illegal, because I G ( H s ) u ( e ∗ ) (cid:54) = I G ( H (cid:48) s ) v ( e ∗ ) , and e ∈ A × B . However,since all nodes in H send the same messages in G ( H s ) and in G ( H (cid:48) s ) under Σ , we getthe following. With the labels assigned by p to the set of nodes B in G ( H (cid:48) s ) and thelabels assigned by p to all V \ B nodes in G ( H s ) , since all edges connected to B are in E H , the local view of B in verification is exactly as in G ( H (cid:48) s ) , and the local view of allother nodes in verification is exactly as in G ( H s ) . Therefore, all nodes output TRUE onan illegal configuration, which contradicts the correctness of Σ .The following lemma shows a matching upper bound for this problem. This com-pletes the proof of Theorem 1. Lemma 6.
There exists a PLS Σ = ( p , v ) for ( F m , MV ) in the broadcast model withverification complexity O (log ∆ ) . Proof:
The constructed scheme Σ = ( p , v ) uses color addressing. Let Col v be the colorassigned to node v . The verifier v at every node v locally verifies that it has at most onemarked incident edge. If none of the edges of v is marked, then it sends the emptymessage, and if there is a marked edge ( v, u ) , then the verifier at node v sends Col u .Finally, locally verify consistency at every node v as follows. The message receivedfrom edge ( v, w ) is Col v if and only if edge ( v, w ) is marked.We now prove the correctness of Σ . According to the correctness of color address-ing, every node reliably broadcasts the indication of its marked edge if any. If the mark-ing is consistent and indicates a matching, then on every marked edge, every endpointsends the color of the other endpoints, and all nodes output TRUE . If there exists a nodewith more than one marked edge, by definition of the scheme, this node outputs
FALSE .Finally, if every node has at most one marked edge but the marking is inconsistent, thenthere exists an edge e = ( v (cid:48) , u (cid:48) ) such that M v (cid:48) ( e ) = 0 and M u (cid:48) ( e ) = 1 . By definition roof-Labeling Schemes: Broadcast, Unicast and In Between 9 of the scheme, u (cid:48) broadcasts COL v (cid:48) , and v (cid:48) receives its color from an unmarked edge.Therefore, v (cid:48) outputs FALSE .The result above says that in the broadcast model, the verification complexity ofthe maximal matching problem and the maximum matching in bipartite graphs is dom-inated by the consistency verification. Observe that in the
MCAST (2) model, the veri-fication complexity of ( F m , MV ) is O (1) , by letting every node v send on every edge e = ( v, u ) the bit I v ( e ) : only two types of messages are needed!We also note that for the problem of maximum matching in cycles, the asymptoticverification complexity is unchanged if we must verify consistency, since the verifica-tion complexity of this problem in the broadcast model is Θ (log n ) [19]. Motivated by the results for matching verification, we now formalize and study thefundamental problem of consistency across edges.
Definition 4 ( b -bit Edge Agreement ( EA b )). Instance : Each node v holds in its state a b -bit string B v ( e ) for each incident edge e . Question : Is B v ( e ) = B u ( e ) for every edge e = ( u, v ) ∈ E ? Let F be the family of all configurations, and let α denote the arboricity of thegraph. Our first main result is the following tight trade-off between r (the number ofdifferent messages for a node) and verification complexity of EA b . Theorem 2.
Let b ∈ Ω (log ∆ ) . For every ≤ r ≤ min (cid:8) ∆, b/ (cid:9) , the verificationcomplexity of ( F , EA b ) in the MCAST ( r ) model is Θ ( (cid:6) αr (cid:7) b ) . This theorem states both an upper and a lower bound. We start with the lower bound.
Lemma 7.
For every ≤ r ≤ min (cid:8) ∆, b/ (cid:9) , the verification complexity of any PLSfor ( F , EA b ) in the MCAST ( r ) model is Ω (( αr + 1) b ) . To prove Lemma 7, we prove the following claim using ideas similar to those used inthe proof of Lemma 5.
Claim.
Let G = ( V, E ) be a graph, let ≤ r ≤ min (cid:8) ∆, b/ (cid:9) and consider a PLS for ( F , EA b ) in the MCAST ( r ) model. For every induced subgraph H = ( V H , E H ) of G , W Σ ( H ) ≥ L ( H ) . Proof:
Given ≤ r ≤ min (cid:8) ∆, b/ (cid:9) , let Σ = ( p , v ) be a PLS for ( F , EA b ) in the MCAST ( r ) model. Given G = ( V, E ) , let H = ( V H , E H ) be an induced subgraphof G . Let B G s v ( e ) be B v ( e ) (the bit-string held by v for the edge e ) in configuration G s . Given a configuration H s of the nodes of H , extend it to a configuration G ( H s ) of G as follows: for every e = ( u, v ) ∈ E H let B G ( H s ) v ( e ) = B H s v ( e ) , and for every e = ( u, v ) ∈ E \ E H , let B G ( H s ) v ( e ) = 0 b . Clearly, H s is legal if and only if G ( H s ) islegal. Now, to prove the claim, assume for contradiction that W Σ ( H ) < L ( H ) . Then theremust be two different legal configurations G ( H s ) and G ( H (cid:48) s ) with the same commu-nication pattern. There must exist an edge e ∗ = ( v, u ) ∈ E H such that B G ( H s ) v ( e ∗ ) = B G ( H s ) u ( e ∗ ) (cid:54) = B G ( H (cid:48) s ) v ( e ∗ ) = B G ( H (cid:48) s ) u ( e ∗ ) : This is because we assume G ( H s ) (cid:54) = G ( H (cid:48) s ) , and by construction, the difference can be only in E H edges. Consider the con-figuration obtained from G ( H s ) with B G ( H (cid:48) s ) v ( e ) replacing B G ( H s ) v ( e ) for every edge e = ( v, w ) ∈ E . This configuration is illegal, because B G ( H s ) u ( e ∗ ) (cid:54) = B G ( H (cid:48) s ) v ( e ∗ ) .However, since all nodes send the same messages in G ( H s ) and in G ( H (cid:48) s ) under Σ , weget that with the label assigned by p to v in G ( H (cid:48) s ) and the labels assigned by p to all V \ { v } nodes in G ( H s ) , the local view of v in verification is exactly as in G ( H (cid:48) s ) , andthe local view of all other nodes in verification is exactly as in G ( H s ) . Therefore, allnodes output TRUE on an illegal configuration, a contradiction.
Proof of Lemma 7:
It is known that the non-deterministic two-party communica-tion complexity of verifying the equality ( EQ ) of b -bit strings is Ω ( b ) [23, Example2.5]. Simulating a verification scheme for ( F , EA b ) on a network of one edge, is a cor-rect non-deterministic two-party communication protocol for EQ . Therefore, Ω ( b ) is alower bound for ( F , EA b ) .We now prove that Ω ( αr b ) is also a lower bound for ( F , EA b ) . Let G s ∈ F bea configuration with an underlying graph G = ( V, E ) , and let H = ( V H , E H ) bethe densest induced subgraph of G , i.e., m H /n H ≥ m H (cid:48) /n H (cid:48) for every V (cid:48) H ⊆ V .By Lemma 2, α = (cid:100) m H / ( n H − (cid:101) . W.l.o.g., let V H = { v , . . . , v n H } , and let d H ( v i ) = |{ ( v i , v j ) ∈ E H }| be the degree of node v i in H .We now show that for ≤ r ≤ min (cid:8) ∆, b/ (cid:9) and any scheme Σ for ( F , EA b ) withverification complexity κ < αb r − in the MCAST ( r ) model, it holds that W Σ ( H ) For every ≤ r < α , there exists a PLS for ( F , E ψ b ) in the MCAST ( r ) model with verification complexity O ( αr ( b + log ∆ )) , and for every α ≤ r ≤ ∆ , thereexists a PLS for ( F , E ψ b ) in the MCAST ( r ) model with verification complexity O ( b ) . Proof: Let ≤ r < α be given. We construct a scheme Σ = ( p , v ) in the MCAST ( r ) model as follows. Σ uses color addressing and minimizing orientation. Let Col v bethe color assigned to node v , and let d o ( v ) denote the out-degree of node v under theorientation. The verifier v at node v partitions the outgoing edges into r parts, each ofsize at most Q def = (cid:100) d o ( v ) /r (cid:101) , such that all edges in a part are sent the same message asfollows. Let { e = ( v, w ) , . . . , e Q = ( v, w Q ) } be one part of outgoing edges of v . Themessage v sends over these edges is the list of Q pairs (Col w i , B v ( e i )) for ≤ i ≤ Q .One of the messages that are sent over outgoing edges is sent over all incoming edges(in order to meet the limit of only r different messages.) Every node v , upon receivinga message M w ( e ) over an edge e = ( v, w ) , verifies the following conditions.1. If e is an outgoing edge, then there exists no pair (Col , x ) in M w ( e ) such that Col = Col v .2. If e is an incoming edge then:(a) There exists exactly one pair (Col , x ) in M w ( e ) such that Col = Col v .(b) For the pair (Col v , x ) , it holds that ψ b ( x, B v ( e )) = TRUE .Obviously, this is a PLS in the MCAST ( r ) model. We now prove its correctness. ByLemma 4, we can assume that the colors of neighbors of each node are different fromeach other and from the color of the node. If the configuration is legal and labels areassigned according to p , all nodes output TRUE . Suppose now that the configuration isillegal. Hence, there must be two neighbors, v and u , such that for the edge e = ( u, v ) we have ψ b ( B u ( e ) , B v ( e )) = FALSE . Since r < α , Lemma 3 does not imply a properverification of the orientation. Therefore, our scheme should verify it. If both v and u consider e as an outgoing edge, then M v ( e ) contains the pair (Col u , B v ( e )) . Therefore, u rejects condition (2) and outputs FALSE . If both v and u consider e as an incomingedge, then M v ( e ) does not contain a pair (Col , x ) such that Col = Col u . Therefore, u rejects condition (3.a) and outputs FALSE . Assume now, w.l.o.g., that e is oriented from v to u . By definition of the scheme, there exists exactly one pair (Col u , x ) in M v ( e ) ,and for this pair we know that x = B v ( e ) . Since ψ b ( B u ( e ) , B v ( e )) = FALSE , u rejectscondition (3.b) and outputs FALSE . Regarding complexity, by definition of degeneracy, for every v , it holds that d o ( v ) ≤ δ ( G ) . By Lemma 1, δ ( G ) < α ( G ) . By Lemma 4, every Col can be represented using O (log ∆ ) bits, and overall, every message is of size O ( αr ( b + log ∆ )) .For α ≤ r ≤ ∆ , by Lemma 3 and the fact that every scheme in the MCAST ( r ) model is in particular a scheme in the MCAST ( r ) model for r ≥ r , there exists a PLS Σ (cid:48) = ( p (cid:48) , v (cid:48) ) for ( F , E ψ b ) in the MCAST ( r ) model with verification complexity b . EA b is a special case of E ψ b , where ψ is the equality predicate. Therefore, Lemma 8gives a tight upper bound for ( F , EA b ) for the case b ∈ Ω (log ∆ ) . This concludes theproof of Theorem 2.We note that Theorem 2, in conjunction with Theorem 7, gives the following corol-lary. Corollary 1. Let b ∈ Ω (log ∆ ) . For every ≤ r ≤ min (cid:8) ∆, b/ (cid:9) , the randomizedverification complexity of ( F , EA b ) in the MCAST ( r ) model is Θ (log( (cid:6) αr (cid:7) b )) . In this section we consider a more sophisticated problem, namely Maximum Flowin the context of the MCAST ( r ) model. The best previously known result [22] wasfor verification of “ k -flow”: the goal is to verify that the maximum flow between agiven pair of nodes is exactly k . The verification complexity of the scheme of [22] is O ( k (log k + log n )) in the broadcast model. In Theorem 4, we show an improvementof this result and a generalization to the MCAST ( r ) model.First, we solve a slightly different problem, formalized as follows. Let F st be thefamily of configurations of graphs, where a graph in F st has two distinct nodes de-noted s and t called source and sink , respectively, and a natural number c ( e ) called the capacity associated with each edge e . The MF problem is defined over the family ofconfigurations F st as follows. Definition 6 (Maximum Flow ( MF )). Instance : A configuration G s ∈ F st , where each node v has an integer f ( v, u ) forevery neighbor u . Question : Interpreting f ( v, u ) as the amount of flow from v to u ( f ( v, u ) < meansflow from u to v ), is f a maximum flow from s to t ? Recall that f is a legal flow iff it satisfies the following three conditions (see, e.g., [1]). – Anti symmetry: for every ( v, u ) ∈ E , f ( v, u ) = − f ( u, v ) . – Capacity compliance: for every ( v, u ) ∈ E , | f ( v, u ) | ≤ c ( v, u ) . – Flow conservation: for every node v ∈ V \ { s, t } , (cid:80) u ∈ V f ( v, u ) = 0 .If all three conditions hold, then, by the max-flow min-cut theorem, f is maximum iffthere is a saturated cut.We denote by f max the maximal flow amount over all edges of G (note that f max need not be polynomial in n ). Also, for a bit string x = x x · · · x k , let ¯ x = (cid:80) ki =0 x i i . Theorem 3. Let log f max ∈ Ω (log n ) . There exists a constant c > such that for every ≤ r ≤ min (cid:8) α/c, √ f max (cid:9) , the verification complexity of ( F st , MF ) in the MCAST ( r ) model is Θ (log( f max ) α/r ) . roof-Labeling Schemes: Broadcast, Unicast and In Between 13 Again, we start with the lower bound. We note that the counting argument used for EA b (Lemma 7) cannot be applied to this problem. To prove the lower bound for MF ,we show a non-trivial reduction from a problem in ( F , EA b ) to a problem in ( F st , MF ) . Lemma 9. Let log f max ∈ Ω (log n ) . There exists a constant c > such that for every ≤ r ≤ min (cid:8) α/c, √ f max (cid:9) , the verification complexity of any PLS for ( F st , MF ) inthe MCAST ( r ) model is Ω (log( f max ) α/r ) . Proof: We reduce the problem ( F , EA b ) to the problem ( F st , MF ) with f max ≤ m · b .Let Σ f = ( p f , v f ) be a PLS for ( F st , MF ) in the MCAST ( r ) model. We constructfrom Σ f a PLS Σ = ( p , v ) for ( F , EA b ) in the MCAST ( r ) model. Let G s ∈ F besuch that EA b ( G s ) = TRUE with an underlying graph G = ( V, E ) , whose arboricityis α . Let T = ( V, E T ) be a breadth-first spanning tree of G rooted at some node w ∈ V . We denote by p ( v ) the parent of v in T . Intuitively, the prover constructs from alegal ( F , EA b ) instance G s a legal ( F st , MF ) instance G (cid:48) s by letting exactly one nodeto simulate nodes s and t which are connected to the rest of the network with edgesof capacity . Assigning a capacity to every edge in E results in G (cid:48) s ∈ F st . Then,the prover defines a cyclic legal flow according to the input strings B v ( u ) . Think ofan arbitrary orientation of the edges, and assume that for the oriented edge ( v, u ) with B v ( u ) = B u ( v ) = B we assign the flow f ( v, u ) = − B and f ( u, v ) = B . Of course, f does not necessarily satisfy flow conservation. The actual flow we define would be thesum of f with the convergecast on T of excess flow from all nodes. The result is a legalflow of value in a network where the minimum cut is . Therefore, MF ( G (cid:48) s ) = TRUE .Formally, the prover orients all edges arbitrarily. Let h v ( u ) be the variable indicat-ing to v the orientation of edge ( v, u ) . If the prover orient e = ( v, u ) from v to u thenh v ( u ) = − and h u ( v ) = 1 . We define X ( v ) as the excess flow of node v if the flowover every edge e = ( v, u ) were h v ( u ) · B v ( u ) , i.e., X ( v ) = (cid:80) ( v,u ) ∈ E h v ( u ) · B v ( u ) .We denote by T v the set of nodes in the sub-tree rooted at v , and define X ( T v ) as thesum of all excess flow in this sub-tree, X ( T v ) = (cid:80) u ∈ T v X ( u ) . Let G (cid:48) s ∈ F st be a con-figuration as follows. Add to G nodes s and t connected to w with edges ( s, w ) , ( t, w ) of capacity . The idea is that w simulates in addition to the verification of MF of it-self, the verification of MF of s and t . For every edge e ∈ E , c ( e ) = m · b . Forevery node v ∈ V and neighbor u ∈ V the flow f ( v, u ) in configuration G (cid:48) s is de-fined as follows. If u = p ( v ) then f ( v, u ) = h v ( u ) · B v ( u ) − X ( T v ) , if v = p ( u ) then f ( v, u ) = h v ( u ) · B v ( u ) + X ( T u ) , and otherwise f ( v, u ) = h v ( u ) · B v ( u ) . Forcompleteness, we define f ( s, w ) = f ( w, s ) = f ( t, w ) = f ( w, t ) = 0 .We first prove that if EA b ( G s ) = TRUE then MF ( G (cid:48) s ) = TRUE . By construction, thevalue of flow going out of s and into t is , and the capacity of the cut ( { s } ; V ∪ { t } ) is . Therefore, if f is a legal flow then it is a maximum flow. Asymmetry holds byconstruction and the assumption that B v ( u ) = B u ( v ) for every u and v . Capacityconstraints hold by definition of X ( T v ) and the fact that B v ( u ) ≤ b . Finally, we provethat flow conservation holds. Let C ( v ) = { u | p ( u ) = v } be the set of children of v in T , and let Y ( v ) = { u | ( v, u ) ∈ E, u (cid:54) = p ( v ) , v (cid:54) = p ( u ) } be the set of neighbors of v which are neither the children of v nor v ’s parent in T . The flow at every node v (cid:54) = w satisfies the following. (cid:88) ( v,u ) ∈ E f ( v, u ) = f ( v, p ( v )) + (cid:88) u ∈C ( v ) f ( v, u ) + (cid:88) u ∈Y ( v ) f ( v, u )= h v ( u ) · B v ( u ) − X ( T v ) + (cid:88) u ∈C ( v ) ( h v ( u ) · B v ( u ) + X ( T u )) + (cid:88) u ∈Y ( v ) ( h v ( u ) · B v ( u )) (6) = (cid:88) ( v,u ) ∈ E h v ( u ) · B v ( u ) − X ( T v ) + (cid:88) u ∈C ( v ) X ( T u )= X ( v ) − X ( T v ) + (cid:88) u ∈C ( v ) X ( T u ) = 0 (7)Equality (6) is true by construction of f , and Equality (7) is true since by definition,X ( T v ) = X ( v ) + (cid:80) u ∈C ( v ) X ( T u ) .For w , we know that f ( w, s ) = f ( w, t ) = 0 . Therefore, we only need to prove flowconservation over the edges ( w, u ) ∈ E . (cid:88) ( w,u ) ∈ E f ( w, u ) = (cid:88) u ∈C ( w ) ( h w ( u ) · B w ( u ) + X ( T u )) (8) = (cid:88) ( w,u ) ∈ E h w ( u ) · B w ( u ) + (cid:88) u ∈C ( w ) X ( T u )= X ( w ) + (cid:88) u ∈C ( w ) X ( T u ) = (cid:88) v ∈ V X ( v ) (9) = (cid:88) v ∈ V (cid:88) ( v,u ) ∈ E h v ( u ) · B v ( u ) = 0 (10)Equality (8) is true since T is a BFS rooted at w and therefore, every neighborof w is a child of w in T , and Equality (9) is true since by definition, X ( T w ) = X ( w ) + (cid:80) u ∈C ( w ) X ( T u ) is the sum of all excess flow of nodes in T , and T spans G . Equality (10) is true by assumption that for every u and v , B v ( u ) = B u ( v ) andh v ( u ) · h u ( v ) = − . For s and t , flow conservation holds immediately by construction.This concludes the proof that if EA b ( G s ) = TRUE then MF ( G (cid:48) s ) = TRUE .We now describe the details of the scheme Σ = ( p , v ) for ( F , EA b ) . Given a config-uration G s ∈ F such that EA b ( G s ) = TRUE , the prover p constructs the configuration G (cid:48) s ∈ F st and assigns for every node v ∈ V a label which is composed of seven parts: – (cid:96) ,v = ID w . – (cid:96) ,v = dist( w, v ) is the distance between w and v in T . – (cid:96) ,v = ID p ( v ) . – (cid:96) ,v = { h v ( u ) | ( v, u ) ∈ E } . – (cid:96) ,v = { f ( v, u ) | ( v, u ) ∈ E } . – (cid:96) ,v = X ( T v ) . – (cid:96) ,v = (cid:96) f ( v ) is the label assigned by p f to v in G (cid:48) s (if v = w then it receives also (cid:96) f ( s ) and (cid:96) f ( t ) ). roof-Labeling Schemes: Broadcast, Unicast and In Between 15 The verifier v at node v operates as follows. The message sent from node v ∈ V toits neighbor u ∈ V is M v ( u ) = (ID v , (cid:96) ,v , (cid:96) ,v , (cid:96) ,v , (cid:96) ,v , M fv ( u )) where M fv ( u ) is themessage v sends to u according to Σ f ( G (cid:48) s ) . Upon receiving messages M u ( v ) from allneighbors, v outputs the conjunction of the following.1. If (cid:96) ,v = 0 then (cid:96) ,v = ID v .2. (cid:96) ,u = (cid:96) ,v for every neighbor u .3. If (cid:96) ,v > then there exists a neighbor u such that (cid:96) ,u = (cid:96) ,v − and (cid:96) ,v = ID u .4. For u such that (cid:96) ,v = ID u , f ( v, u ) = h v ( u ) · B v ( u ) − (cid:96) ,v .5. For u such that (cid:96) ,u = ID v , f ( v, u ) = h v ( u ) · B v ( u ) + (cid:96) ,u .6. For u such that neither (cid:96) ,v = ID u nor (cid:96) ,u = ID v , f ( v, u ) = h v ( u ) · B v ( u ) .7. If (cid:96) ,v > then v simulates the output of v according to v f with the set of flows (cid:96) ,v , label (cid:96) ,v and the received message M fu ( v ) from every neighbor u .8. If (cid:96) ,v = 0 then v simulates the output of v according to v f with the set of flows (cid:96) ,v ∪ { f ( v, s ) = 0 , f ( v, t ) = 0 } , label (cid:96) ,v and the received message M fu ( v ) fromevery neighbor u and messages M fs ( v ) and M ft ( v ) that are sent from s with la-bel (cid:96) f ( s ) and from t with label (cid:96) f ( t ) according to v f respectively. In addition, v simulates the output of s and t according to v f with the flows f ( s, v ) = 0 and f ( t, v ) = 0 , labels (cid:96) f ( s ) and (cid:96) f ( t ) , and received messages M fv ( s ) and M fv ( t ) re-spectively. The result of this verification item is the conjunction of outputs of v, s and t .By construction, if M fv ( u ) = M fv ( u ) then M v ( u ) = M v ( u ) . Therefore, if Σ f is a PLS in the MCAST ( r ) model then Σ is a PLS in the MCAST ( r ) model. Let c ∗ bea constant such that every ID is at most n c ∗ . If the verification complexity of Σ f is κ ,then the verification complexity of Σ is κ + b + 3( c ∗ + 1) log n . This is true becauseX ( T v ) ≤ n · b . If Σ is a correct verification scheme for ( F , EA b ) , by the proof ofLemma 7, its verification complexity is greater than α r b − . If b ≥ log n and αr > c ∗ + 16 we get that κ ∈ Ω ( αr b ) . Since by construction f max ≤ m · b , it follows that κ ∈ Ω ( αr log( f max /n )) , and if log f max ∈ Ω (log n ) we get that κ ∈ Ω ( αr log f max ) .We now prove the correctness of Σ . If EA b ( G s ) = TRUE and labels are assignedaccording to p , then clearly, all nodes output TRUE . Suppose now that EA b ( G s ) = FALSE . Then, there is at least one edge ( v, u ) ∈ E such that B v ( u ) (cid:54) = B u ( v ) . Weassume that all nodes output TRUE and show that it leads to a contradiction. If all nodesverify properties (1),(2) and (3) then there is exactly one node w which simulates s and t . Therefore, the simulated configuration is in F st . If all nodes verify properties(7) and (8) then the simulated configuration ˆ G s satisfies MF ( ˆ G s ) = TRUE . In particular, f ( v, u ) = − f ( u, v ) . If u and v verify properties (4),(5) and (6) then the following holds.If (cid:96) ,u = ID v then f ( v, u ) = h v ( u ) · B v ( u ) + (cid:96) ,u and f ( u, v ) = h u ( v ) · B u ( v ) − (cid:96) ,u .If (cid:96) ,v = ID u then f ( v, u ) = h v ( u ) · B v ( u ) − (cid:96) ,v and f ( u, v ) = h u ( v ) · B u ( v ) + (cid:96) ,v .If neither (cid:96) ,v = ID u nor (cid:96) ,u = ID v then f ( v, u ) = h v ( u ) · B v ( u ) and f ( u, v ) = h u ( v ) · B u ( v ) . In all three possible cases, since h v ( u ) and h u ( v ) have values either or − , it holds that f ( v, u ) = − f ( u, v ) if and only if B v ( u ) = B u ( v ) . Contradicting theassumption that B v ( u ) (cid:54) = B u ( v ) . This concluded the proof. Lemma 10. For every ≤ r < α , there exists a PLS for ( F st , MF ) in the MCAST ( r ) model with verification complexity O ( αr (log f max +log ∆ )) , and for every α ≤ r ≤ ∆ , there exists a PLS for ( F st , MF ) in the MCAST ( r ) model with verification complexity O (log f max ) . Proof: Let ψ be the function of two input strings such that ψ ( x, y ) = TRUE iff x = − y ,and let Σ A = ( p A , v A ) be a PLS for ( F , E ψ b ) in the MCAST ( r ) model. We describe thedetails of a PLS Σ = ( p , v ) for ( F st , MF ) in the MCAST ( r ) model. Let G s ∈ F st be aconfiguration with an underlying graph G = ( V, E ) and MF ( G s ) = TRUE . Consider theconfiguration G (cid:48) s defined as follows. The underlying graph of G (cid:48) s is G = ( V, E ) and forevery node v ∈ V and every edge e = ( v, u ) , B v ( e ) = f ( v, u ) . Obviously, G (cid:48) s ∈ F . Inaddition, E ψ b ( G (cid:48) s ) = TRUE since, in particular, the flow in G s satisfies asymmetry onevery edge. Let Z ⊂ V be such that ( Z ; V \ Z ) is a minimum s - t cut in G s with s ∈ Z and t / ∈ Z . The label assigned by p to every node v ∈ V is composed of two parts: (cid:96) ,v = z ( v ) where z ( v ) is a bit such that z ( v ) = 1 ⇐⇒ v ∈ Z , and (cid:96) ,v = (cid:96) A ( v ) isthe label assigned by p A to v in G (cid:48) s .The verifier v at node v operates as follows. The message sent from v over edge e = ( v, u ) is M v ( e ) = ( (cid:96) ,v , M Av ( e )) where M Av ( e ) is the message v sends over e in Σ A ( G (cid:48) s ) . Upon receiving a message M u ( e ) over every edge e = ( u, v ) , node v outputsthe conjunction of the following.1. The output of v A upon receiving a message M Au ( e ) from every neighbor u of v ,where the label of v is (cid:96) ,v .2. For every edge ( v, u ) , | f ( v, u ) | ≤ c ( v, u ) .3. If v (cid:54) = s, t then (cid:80) u ∈ V f ( v, u ) = 0 .4. If v = s then (cid:96) ,v = 1 .5. If v = t then (cid:96) ,v = 0 .6. For every neighbor u of v , if (cid:96) ,u (cid:54) = (cid:96) ,v then | f ( v, u ) | = c ( v, u ) .If Σ A is a PLS in the MCAST ( r ) model with verification complexity κ , then Σ is aPLS in the MCAST ( r ) model with verification complexity κ + 1 . This is true because if M Av ( e ) = M Av ( e ) then M v ( e ) = M v ( e ) and (cid:96) ,v is one bit. Σ A is a verificationscheme for ( F , E ψ b ) where b = log( f max ) . By Lemma 8, the upper bounds follow.We now prove the correctness of Σ . If MF ( G s ) = TRUE then for every v and u , f ( v, u ) = − f ( u, v ) . From correctness of Σ A , the result of v in (1) is TRUE . The resultof v in (2) and (3) is also TRUE since the flow is legal. If labels are assigned as described,then ( Z ; V \ Z ) is a minimum s - t cut. Since f is a maximum flow, we know that everyminimum cut is saturated. Therefore, the result of v in (4),(5) and (6) is TRUE , and v outputs TRUE . If all nodes output TRUE then, by (1),(2) and (3), f is a legal flow. By (4)and (5), the z ( v ) bits indicate an s - t cut, and by (6) cut ( Z ; V \ Z ) is saturated, andtherefore, f is a maximum flow, MF ( G s ) = TRUE .For log f max ∈ Ω (log n ) , Lemma 10 gives a tight upper bound for ( F st , MF ) whichconcludes the proof of Theorem 3.Consider now the k - MF problem as defined in [22] over the family of configurations F st . Definition 7 ( k -Maximum Flow ( k - MF )). Instance : A configuration G s ∈ F st . Question : Is the maximum flow between s and t in G s is exactly k ? roof-Labeling Schemes: Broadcast, Unicast and In Between 17 We give an upper bound for ( F st , k - MF ) in the MCAST ( r ) model, which generalizesand improves the previous bound. Theorem 4. For every ≤ r < α , there exists a PLS for ( F st , k - MF ) in the MCAST ( r ) model, with verification complexity O (cid:16) min { α,k } r (log k + log ∆ ) (cid:17) , and for every α ≤ r ≤ ∆ , there exists a PLS for ( F st , k - MF ) in the MCAST ( r ) model, with verificationcomplexity O (log k ) . Proof: In a verification scheme for ( F st , k - MF ) , the prover can assign the flow values f ( v, u ) for every edge ( v, u ) . W.l.o.g, assume that f does not contain cycles of positiveflow. In this case, f max ≤ k and, since the flow value over each edge is an integer,the number of incident edges of every node v carrying non-zero flow is at most k . ByLemma 10, and the observation that it is sufficient that every node verifies the value offlow only on edges with f ( v, u ) (cid:54) = 0 , the upper bounds follow.To be precise, the problem solved in [22] required in addition that every node holdsthe value k in its state. Verifying that all nodes hold the same value k is simply anadditive log k factor to message length – every node sends its value and verifies that allits neighbors have the same value. We argue in the following lemma, that Ω (log k ) is alower bound for ( F st , k - MF ) verification even if k is known to all nodes. Lemma 11. For every ≤ k ≤ Θ ( n ) , the verification complexity of any PLS for ( F st , k - MF ) is Ω (log k ) , even in the unicast model and for constant degree graphs. Proof: Consider the following graph family F (cid:48) . Node s is connected to two nodes s Fig. 1. An example of G a,b configuration. All capacities which are not specified are n . In thisexample, the sum of capacities in the upper part is and in the lower part is . Therefore, thisis G , . and s , and node t is connected to two nodes t and t with edges of capacity n . Eachof the nodes s , s , t and t is connected to y additional different nodes with edges ofcapacity n . For i ∈ { , } consider the following structure. Let V i = (cid:8) v i , . . . , v iy − (cid:9) be the y nodes connected to s i in addition to s and let U i = (cid:8) u i , . . . , u iy − (cid:9) be the y nodes connected to t i in addition to t . For every ≤ j ≤ y − there is an edge ( v ij , u ij ) with capacity either c ( v ij , u ij ) = 0 or c ( v ij , u ij ) = 2 j . In particular, (cid:80) y − j =0 c ( v ij , u ij ) canbe every integer between and y − . We denote by G a,b the configuration wherethe sum of capacities in the subgraph induced by the set of nodes V ∪ U is a , andthe sum of capacities in the subgraph induced by the set of nodes V ∪ U is b (seeFigure 1). F (cid:48) = { G a,b | ≤ a, b ≤ y − } . Clearly, for every k ≤ y − Ω ( n ) and ≤ a ≤ k it holds that G a,k − a ∈ F (cid:48) and k - MF ( G a,k − a ) = TRUE .Assume by contradiction that there is a unicast proof-labeling scheme Σ for the ( F st , k - MF ) problem with verification complexity less than log k . Consider the collec-tion of messages sent over edges ( s, s ) and ( t, t ) . By assumption, there are lessthan log k bits in this sequence of messages. Hence, there are less than k differentcommunication patterns over these edges. Therefore, there must be two configurations G a,k − a and G a (cid:48) ,k − a (cid:48) , where a (cid:54) = a (cid:48) , such that the communication pattern of Σ overedges ( s, s ) and ( t, t ) is the same for both configurations. Consider the configuration G a,k − a (cid:48) . Obviously, since a (cid:54) = a (cid:48) , k - MF ( G a,k − a (cid:48) ) = FALSE .By construction, the state of every node v ∈ W = { s, t, s , t }∪ V ∪ U in G a,k − a (cid:48) is the same as in G a,k − a , and the state of every node v ∈ W (cid:48) = { s , t } ∪ V ∪ U in G a,k − a (cid:48) is the same as in G a (cid:48) ,k − a (cid:48) . Let (cid:96) a ( v ) (respectively (cid:96) a (cid:48) ( v ) ) be the label assignedto node v according to Σ ( G a,k − a ) (respectively Σ ( G a (cid:48) ,k − a (cid:48) ) ), and consider the follow-ing labeling (cid:96) for G a,k − a (cid:48) . For every v ∈ W assign (cid:96) ( v ) = (cid:96) a ( v ) , and for every v ∈ W (cid:48) assign (cid:96) ( v ) = (cid:96) a (cid:48) ( v ) . Since the state and label of every v ∈ W (respectively v ∈ W (cid:48) )in G a,k − a (cid:48) are exactly as in Σ ( G a,k − a ) (respectively Σ ( G a (cid:48) ,k − a (cid:48) ) ), all messages thesenodes send are as in Σ ( G a,k − a ) (respectively Σ ( G a (cid:48) ,k − a (cid:48) ) ).By assumption on the communication patterns of Σ ( G a,k − a ) and Σ ( G a (cid:48) ,k − a (cid:48) ) , andthe fact that ( s, s ) and ( t, t ) are the only edges in W × W (cid:48) , all nodes in G a,k − a (cid:48) output TRUE , a contradiction to the correctness of Σ . Therefore, the verification complexityof any proof-labeling scheme for ( F (cid:48) , k - MF ) is Ω (log k ) . Since F (cid:48) ⊂ F st , the lowerbound holds for ( F st , k - MF ) .In order to show that this lower bound holds even for constant degree graphs, wechange the construction so that every star structure induced by { s i }∪ V i , for i ∈ { , } ,is replaced by a binary tree rooted at s i and its leaves are V i . In the same way, wereplace every star structure induced by { t i } ∪ U i , for i ∈ { , } , by a binary tree. Themaximum degree of the new graph family is O (1) , and the lemma follows.By Theorem 4, this lower bound is tight for α ≤ r ≤ ∆ , and the following theoremholds. Theorem 5. For every ≤ k ≤ Θ ( n ) and every α ≤ r ≤ ∆ , the verificationcomplexity of ( F st , k - MF ) in the MCAST ( r ) model is Θ (log k ) . In the congested clique model, the communication network is a fully connected graphover n nodes (i.e., an n -clique). Given an input graph G = ( V, E ) with n = | V | , thenodes of G are mapped 1-1 to the nodes of the clique, and the state of each node containsa bit for each port, indicating whether the edge to that port is in E or not, and, if the roof-Labeling Schemes: Broadcast, Unicast and In Between 19 edge is present and G is weighted, the weight of the edge. We assume that the part inthe state that specifies whether the edge connected to this port is in E is reliable: sinceverification is done with respect to the given graph as input, there is no way to verifyits authenticity, but only whether the combination of input and output satisfies the givenpredicate. Moreover, we assume that the input is consistent, in the sense that the state atnode v indicates that ( v, u ) is an edge in E (possibly with some weight w ), if and onlyif so does the state of u (namely edge agreement on the input graph is guaranteed). In what follows, we say that an edge is oriented to indicate a specific order over itsendpoints. Definition 8 (Independent Edges). Let G = ( V, E ) be a graph and let e = ( v , u ) and e = ( v , u ) be two oriented edges of G . The edges e and e are said to be independent if and only if v , u , v , u are four distinct nodes and ( v , u ) , ( v , u ) / ∈ E . The following definition is illustrated in Figure 2. Definition 9 (Crossing [5]). Let G = ( V, E ) be a graph, let e = ( v , u ) and e =( v , u ) be two independent oriented edges of G , and for i ∈ { , } , let p i and q i be the port numbers of e i at v i and u i respectively. The crossing of e and e in G ,denoted by G ( e , e ) , is the graph obtained from G by replacing e and e with theedges e (cid:48) = ( v , u ) and e (cid:48) = ( v , u ) so that e (cid:48) connects port p at v and port q at u and e (cid:48) connects port p at v and port q at u . Fig. 2. An illustration of the cross-ing operation on a clique network.Solid edges are input graph edges,and dashed edged are communication-only edges. (a) edges e = ( v , u ) and e = ( v , u ) are two indepen-dent oriented edges of an input graph G . (b) the subgraph induced by nodes v , u , v and u in G ( e , e ) . Consider an input graph G = ( V, E ) in theclique, assume that e , e ∈ E are indepen-dent edges and let G ( e , e ) = ( V, E (cid:48) ) . Note thatcrossing a graph over a clique network does notresult in a change of state: Due to the port preser-vation of the crossing operation, for every node v ∈ V and every port ≤ i ≤ n − , the edge ( v, u ) on port number i in G satisfies ( v, u ) ∈ E if and only if the edge ( v, u (cid:48) ) on port number i in G ( e , e ) satisfies ( v, u (cid:48) ) ∈ E (cid:48) .Whether we can prove a lower bound for ver-ification in the congested clique for r > isstill an open question. However, for the broadcastclique model (i.e., r = 1 ), it turns out that we can.The following lemma is the key to proving lowerbounds for PLSs in the broadcast clique. Lemma 12. Let F be a family of configurations,let P be a boolean predicate over F , and let Σ be a PLS for ( F , P ) in the broadcastclique model with verification complexity κ . Suppose that there is a configuration G s ∈F such that P ( G s ) = TRUE and G contains q pairwise independent oriented edges e , . . . , e q . If κ < log q , then there are ≤ i < j ≤ q such that G s ( e i , e j ) is acceptedby Σ . Proof: Let Σ = ( p , v ) be a PLS for ( F , P ) in the broadcast clique model, with ver-ification complexity κ , and let G s be a configuration as described in the statement.Assume that κ < log q , and consider a collection of q pairwise independent orientededges e = ( v , u ) , . . . , e q = ( v q , u q ) . Let (cid:96) ( v ) is the label given by p to v , let M v bethe message sent by v to all its neighbors according to v , and for every i , consider thebit-string M i = M v i ◦ M u i . We have | M i | < log q for every i , and thus there are lessthan q possible distinct M i ’s in total. Therefore, by the pigeonhole principle, there are ≤ i < j ≤ q such that M i = M j . Consider the output of the verifier v in G s and in G s ( e i , e j ) .By assumption, G s is accepted by Σ , i.e., with the labels provided by p , the verifier v outputs TRUE at all nodes of G s . Therefore, clearly, all nodes other than v i , u i , v j , u j output TRUE in G s ( e i , e j ) . Now, consider node v i . Its neighbor u i in G s is replacedin G s ( e i , e j ) by the node u j , and its communication edge ( v i , u j ) in G s is replacedin G s ( e i , e j ) by communication edge ( v i , u i ) . Since M u i = M u j , the verifier acts thesame at v i in both G s and G s ( e i , e j ) . The same argument works for u i , v j , and u j , andtherefore, the verifier also outputs TRUE at all nodes in G s ( e i , e j ) , which implies that G s ( e i , e j ) is accepted by Σ .We use the following corollary of Lemma 12 to lower-bound verification complexityof broadcast clique PLSs. Corollary 2. Let F be a family of configurations, and let P be a boolean predicate over F . If there is a configuration G s ∈ F satisfying that P ( G s ) = TRUE and G contains q pairwise independent oriented edges e , . . . , e q such that for every ≤ i < j ≤ q itholds that P ( G s ( e i , e j )) = FALSE , then the verification complexity of any deterministicPLS for ( F , P ) in the broadcast clique model is Ω (log q ) . Note that we essentially cross two pairs of edges in the crossing operation: one pairof edges in E , and one pair of edges in ¯ E . These two pairs are uniquely associated witheach other in a way that if we assume a PLS in the MCAST (2) clique model, then wewould not be able to apply the pigeonhole principle even with -bit messages. To seewhy this is true, consider any set of independent oriented edges ( v , u ) , . . . , ( v q , u q ) .For every i (cid:54) = j , both edges ( v i , u j ) , ( v j , u i ) ∈ ¯ E are associated only with the pairof edges ( v i , u i ) , ( v j , u j ) ∈ E . Therefore, with a PLS in the MCAST (2) clique model,it is possible that M v i ( u j ) (cid:54) = M v j ( u i ) for every i (cid:54) = j independently of other pairs.Hence, the crossing of any two edges may change the local view of at least one node.Therefore, the crossing technique can not be applied for every r > in the congestedclique. In this section we illustrate the use of Corollary 2 and prove tight bounds for the verifi-cation complexity of the Minimum Spanning-Tree (MST) problem. Recall that an MSTof a weighted graph G is a spanning tree of G whose sum of all its edge-weights is roof-Labeling Schemes: Broadcast, Unicast and In Between 21 minimum among all spanning trees of G . In particular, in the clique, there is a fullyconnected communication network, a weighted input graph G = ( V, E, w ) where E isa subset of communication edges, w : E → N is the edge weight assignment, and asubset T ⊆ E is specified as the MST. It is important to notice that all specificationsof edge subsets are local in the sense that every node v ∈ V has n − ports and in itsstate there is a specification for every edge e i on port number i whether e i ∈ E andwhether e i ∈ T . According to our assumption on the clique model, the input graph G is given in a reliable way, i.e., an edge ( v, u ) is considered by v to be in E if and onlyif it is considered by u to be in E . However, this consistency has to be verified for theedges of T . In addition, since the communication network is fully connected and doesnot depend on the input graph G , we also consider the case where G is disconnected.In this case, we define the MST as the set of minimum spanning-trees of all connectedcomponents of G .Let F w max be the family of all weighted configurations (not necessarily connected)with maximum weight w max . Formally, if e is an edge of the underlying weighted graphof a configuration G s ∈ F w max , then w ( e ) ≤ w max . Edge weights are assumed to beknown at their endpoints. Theorem 6. The verification complexity of ( F w max , MST ) in the broadcast clique modelis Θ (log n + log w max ) . Proof: We first use Corollary 2 to show Ω (log n ) lower bound for MST in the broadcastclique model. Consider the weighted graph G = ( V, E, w ) where V = { v , . . . , v n − } , E = { ( v i , v i +1 ) | ≤ i ≤ n − } , and w ( e ) = 1 for every e ∈ E . Intuitively, G is apath of n nodes with edges of weight . We define the configuration G s to be thegraph G where T = E . Obviously, MST ( G s ) = TRUE . Next, we define the set of q = (cid:4) n (cid:5) − independent oriented edges e , . . . , e q as follows. For ≤ i ≤ (cid:4) n (cid:5) − ,let e i = ( v i , v i +1 ) . For every ≤ i < j ≤ (cid:4) n (cid:5) − , G (cid:48) s = G s ( e i , e j ) is obtainedfrom G s by removing edges ( v i , v i +1 ) and ( v j , v j +1 ) from G , and replacing themby ( v i , v j +1 ) and ( v j , v i +1 ) . Thus, the crossing creates two connected components:the cycle C = ( v i +1 , v i +2 , . . . , v j − , u j ) and a path the contains the rest of thenodes, and therefore, MST ( G (cid:48) s ) = FALSE . It follows from Corollary 2 that the verifi-cation complexity of any deterministic PLS for MST in the broadcast clique model is Ω (log q ) = Ω (log n ) .For the Ω (log W ) lower bound, we show a variation of the proof in [22], whichholds also for the broadcast clique model. Assume for contradiction that there exists ascheme Σ for MST over F W in the broadcast clique model with verification complexity κ < log (cid:0) W − (cid:1) . Let G i = ( V, E, w i ) be a graph where V = { v , u , v , u } , E = { ( v , u ) , ( v , u ) , ( v , v ) , ( u , u ) } , w ( v , v ) = w ( u , u ) = 1 , w ( v , u ) = 2 i and w ( v , u ) = 2 i + 1 (see Figure 3(a)). Let G is be the configuration over the graph G i with T = E \ ( v , u ) . Obviously, MST ( G is ) = TRUE for every i ∈ N . In particular,for every ≤ i ≤ W − it holds that G is ∈ F W and Σ accepts G is . Let (cid:96) i ( v ) be the labelassigned by p to v in G is . Since κ < log (cid:0) W − (cid:1) and the fact that Σ is a broadcastscheme, we get that there exist ≤ i < j ≤ W − such that c Σ ( G is ) = c Σ ( G js ) . Let G s be the same as G is except that w ( v , u ) = 2 j (see Figure 3(b)). Since i < j itfollows that i + 1 = w ( v , u ) < w ( v , u ) = 2 j . Therefore, since T = E \ ( v , u ) , Fig. 3. The configurations described in the proof of Theorem 6 for the Ω (log W ) lower bound.Dashed edged are communication edges, solid edges are in E and thick solid edges are in T . (a)the configuration G is which satisfies MST ( G is ) = TRUE . (b) the configuration G s which satisfies MST ( G s ) = FALSE since i < j . MST ( G s ) = FALSE . However, since c Σ ( G is ) = c Σ ( G js ) , with the labeling (cid:96) ( v ) = (cid:96) j ( v ) , (cid:96) ( u ) = (cid:96) j ( u ) , (cid:96) ( v ) = (cid:96) i ( v ) and (cid:96) ( u ) = (cid:96) i ( u ) for G s we get that nodes v and u act exactly as in G js and output TRUE , and nodes v and u act exactly as in G is and output TRUE , a contradiction to the correctness of Σ . This concludes the proofof the Ω (log n + log W ) lower bound.Finally, we show a PLS for MST in the broadcast clique model with verificationcomplexity O (log n + log W ) . Consider the following scheme ( p , v ) . Given a legalconfiguration G s , i.e., the set of edges T is consistent and is an MST, the prover p roots T , and gives every node a pointer to its parent in T . The verifier v uses onecommunication round in which every non-root node sends its identity, the identity of itsparent and the weight of the edge connecting it to its parent; the root sends an indicationthat it is the root. When all messages are received, each node locally constructs T (cid:48) fromthe collection of all edges sent by all nodes. Finally, every node v outputs TRUE if thefollowing conditions are met.1. For all incident edges e = ( v, u ) : e ∈ T if and only if e ∈ T (cid:48) .2. T (cid:48) is a tree spanning all n nodes.3. For all e = ( v, u ) ∈ E : if e / ∈ T then w ( e ) ≥ w ( e (cid:48) ) for every e (cid:48) in the unique pathbetween v and u in T (cid:48) .We now prove the correctness of the scheme. Recall that by the “red rule” (cf. [28]),the heaviest edge of every cycle is not in the MST. Suppose MST ( G s ) = TRUE , i.e.,the set of edges T is an MST. With the labels assigned by p , since T is an MST andhence satisfies the red rule, all nodes output TRUE . Assume now that all nodes output TRUE . Then by (1), T must be consistent over all nodes, and by (2), we know that T isa spanning tree. If (3) holds at all nodes, T satisfies the red rule and therefore T is anMST, i.e., MST ( G s ) = TRUE . MCAST model The concept of randomized proof labeling schemes was introduced in [5]. Briefly, theidea is that the messages generated by the verifier may depend not only on the localstate and label, but also on local random bits, and the correctness requirement is that if G s satisfies P , then, using the labels assigned by the prover, all local verifiers accepts roof-Labeling Schemes: Broadcast, Unicast and In Between 23 G s ; and if P ( G s ) = FALSE then, for every label assignment, with probability at least / , at least one local verifier rejects G s . (We consider only one-sided error RPLSshere.)An RPLS for a given family F of configurations and a boolean predicate P over F , in the MCAST ( r ) model is defined in the same way deterministic PLS for ( F , P ) is defined, with the exception that the messages sent by the verifier are a function ofthe local state, local label and a string of random bits. The restriction of the MCAST ( r ) model means that the number of distinct messages (which are now random variables)that may be sent out by a node is at most r . In accordance with our concern aboutdynamic partitioning of the neighbors, we stress that in this case too, we assume thatthe partitioning of neighbors into same-message groups is done obliviously of the actualrandom bits. The correctness requirement are the same as in the standard requirementsfrom a (one-sided) RPLS: A randomized scheme ( p , v ) for ( F , P ) must satisfy thefollowing requirements, for every G s ∈ F : – If P ( G s ) = TRUE then, using the labels assigned by p , the verifier v accepts G s . – If P ( G s ) = FALSE then, for every label assignment, Pr[ v rejects G s ] ≥ .In this section, we extend the exponential relation between verification complex-ity of deterministic and randomized schemes (shown in [5] for broadcast deterministicschemes and unicast randomized schemes) to the MCAST ( r ) model. Theorem 7. Let F be a family of configurations, let P be a boolean predicate over F ,and consider schemes for ( F , P ) in the MCAST ( r ) model. If there exists a (determin-istic) PLS with verification complexity κ d then there exists an RPLS with verificationcomplexity O (log κ d ) , and if there exists an RPLS with verification complexity κ r thenthere exists a PLS with verification complexity O (2 κ r ) . Proof: In [5] it is shown that an RPLS (recall that this means a unicast RPLS) with ver-ification complexity O (log κ ) can be constructed from a (broadcast) PLS with verifica-tion complexity κ . The proof of this result can be easily adapted to show the followinggeneralization. Lemma 13. Let F be a family of configurations and let P be a boolean predicate over F . If there exists a PLS for ( F , P ) in the MCAST ( r ) model with verification complex-ity κ , then there exists an RPLS for ( F , P ) in the MCAST ( r ) model with verificationcomplexity O (log κ ) . The converse holds as well, as stated in the following lemma. Lemma 14. Let F be a family of configurations and let P be a boolean predicate over F . If there exists a one-sided RPLS for ( F , P ) in the MCAST ( r ) model with verificationcomplexity κ , then there exists a PLS for ( F , P ) in the MCAST ( r ) model with verifica-tion complexity O (2 κ ) . Proof: Let ( p , v ) be a one-sided randomized proof-labeling scheme for ( F , P ) in the MCAST ( r ) model with verification complexity κ . Let G s ∈ F be a configuration satis-fying predicate P . For every node v , let (cid:96) ( v ) be the label assigned to v by p , let u , . . . u d be the d = deg ( v ) neighbors of v and let g , . . . , g r be the partition of u , . . . u d to r groups used by ( p , v ) (some groups may be empty). For every non-empty group of neighbors g i , let C ( v, g i ) = (cid:110) c ( v,g i )1 , . . . , c ( v,g i ) y (cid:111) be the collection of all certificateswith positive probability to be sent from v to its neighbors in group g i according to v where labels are assigned by p . By definition of MCAST ( r ) , all neighbors that belong tothe same group receive the same certificate. We construct a deterministic proof-labelingscheme ( p (cid:48) , v (cid:48) ) for ( F , P ) in the MCAST ( r ) model as follows. For every v , the labelassigned by p (cid:48) to v is (cid:96) (cid:48) ( v ) = (cid:96) ( v ) . For every neighbor u of v , let g v ( u ) be the groupcontaining u in the partition of v . The message sent from v to u according to v (cid:48) is M (cid:48) v ( u ) = x ( v,u )1 , . . . , x ( v,u )2 κ where x ( v,u ) j is a bit whose value is iff j ∈ C ( v, g v ( u )) .Upon receiving M (cid:48) u ( v ) , . . . , M (cid:48) u d ( v ) , the verifier at v outputs FALSE if and only ifthere exist j , . . . , j d such that v ( v ) = FALSE upon receiving j , . . . , j d from neighbors u , . . . u d respectively, and for every ≤ i ≤ d it holds that x ( u i ,v ) j i = 1 . Intuitively, iffor some combination of certificates in the support of v it holds that v ( v ) = FALSE then v (cid:48) ( v ) = FALSE , otherwise v (cid:48) ( v ) = TRUE . This concludes the construction of ( p (cid:48) , v (cid:48) ) .The correctness of the scheme ( p (cid:48) , v (cid:48) ) follows from the observation that by con-struction, every combination of messages j , . . . , j d , such that for every ≤ i ≤ d itholds that x ( u i ,v ) j i = 1 , has positive probability to occur in v . Therefore, since ( p , v ) isa one-sided scheme, all combinations must lead to an output of TRUE . Regarding com-munication complexity, the length of the messages sent by v (cid:48) is exactly the number ofpossible messages sent by v . Since the verification complexity of ( p , v ) is κ , the numberof bits in the messages of v (cid:48) is κ . In this paper we studied the MCAST ( r ) model from the perspective of verification. Thisangle seems particularly convenient, because it involves a single round of message ex-change. (If multiple rounds are allowed, one has to consider the possibility of recon-figuring the neighbor partitions: is it allowed to partition the neighbors anew in eachround, and if so, at what cost?). We focus on the relation between the number of differ-ent messages of each node and the verification complexity of proof-labeling schemes.We gave tight bounds on the verification complexity of edge agreement and max flowin the MCAST ( r ) model. We have shown that in the restrictive broadcast model, a welldefined matching is harder to verify than the maximality of a given matching, and that itis possible to obtain lower bounds on the verification complexity in congested cliques.Many interesting questions remain open. We list a few below. – Develop a theory for a restricted number of interface cards (NICs). The number ofNICs limits the number of messages that can be simultaneously transmitted. In thispaper we looked only at a simple case of one round of communication. We believethat developing a tractable and realistic model in which the number of NICs is aparameter is an important challenge. – As mentioned, in multiple round algorithms, dynamic reconfigurations can be ex-ploited to convey information. It seems that an interesting challenge would be toaccount for dynamic reconfigurations. – We considered a model in which a single parameter r is used to indicate the restric-tion of all nodes. What can be said about a model in which every node has its ownrestriction? roof-Labeling Schemes: Broadcast, Unicast and In Between 25 – We have given examples of problems that have a linear improvement in verificationcomplexity as a function r , and on the other hand, we have given examples ofproblems that are not sensitive at all to r . Can a characterization of problems beshown, according to their sensitivity of verification complexity to r ? References 1. R. K. Ahuja, T. L. Magnanti, and J. B. Orlin. Network Flows . Prentice-Hall, EngelwoodCliffs, New Jersey, 1993.2. H. Arfaoui, P. Fraigniaud, D. Ilcinkas, and F. Mathieu. Distributedly testing cycle-freeness.In , LNCS,pages 15–28. Springer, 2014.3. H. Arfaoui, P. Fraigniaud, and A. Pelc. Local decision and verification with bounded-sizeoutputs. In ,LNCS, pages 133–147. Springer, 2013.4. B. Awerbuch, B. Patt-Shamir, and G. Varghese. Self-stabilization by local checking andcorrection. In , pages 268–277. IEEE, 1991.5. M. Baruch, P. Fraigniaud, and B. Patt-Shamir. Randomized proof-labeling schemes. In Proc.34th ACM Symp. on Principles of Distributed Computing (PODC) , pages 315–324, 2015.6. F. Becker, A. Fern´andez Anta, I. Rapaport, and E. R´emila. The effect of range and band-width on the round complexity in the congested clique model. In Proc. 22nd Int. Conf. onComputing and Combinatorics (COCOON) , pages 182–193, 2016.7. L. Blin, P. Fraigniaud, and B. Patt-Shamir. On proof-labeling schemes versus silent self-stabilizing algorithms. In , LNCS, pages 18–32. Springer, 2014.8. A. Das Sarma, S. Holzer, L. Kor, A. Korman, D. Nanongkai, G. Pandurangan, D. Peleg, andR. Wattenhofer. Distributed verification and hardness of distributed approximation. SIAM J.Comput. , 41(5):1235–1265, 2012.9. A. Drucker, F. Kuhn, and R. Oshman. On the power of the congested clique model. In Proceedings of the 2014 ACM Symposium on Principles of Distributed Computing , PODC’14, pages 367–376, New York, NY, USA, 2014. ACM.10. L. Feuilloley, P. Fraigniaud, and J. Hirvonen. A Hierarchy of Local Decision. In , pages 118:1–118:15. Schloss Dagstuhl–Leibniz-Zentrum fuer Informatik, 2016.11. K.-T. Foerster, T. Luedi, J. Seidel, and R. Wattenhofer. Local checkability, no strings at-tached. In Proceedings of the 17th International Conference on Distributed Computing andNetworking , ICDCN ’16, pages 21:1–21:10, New York, NY, USA, 2016. ACM.12. K.-T. Foerster, O. Richter, J. Seidel, and R. Wattenhofer. Local checkability in dynamicnetworks. In Proceedings of the 18th International Conference on Distributed Computingand Networking , ICDCN ’17, pages 4:1–4:10, New York, NY, USA, 2017. ACM.13. P. Fraigniaud, M. G¨o¨os, A. Korman, and J. Suomela. What can be decided locally with-out identifiers? In Proceedings of the 2013 ACM Symposium on Principles of DistributedComputing , PODC ’13, pages 157–165, New York, NY, USA, 2013. ACM.14. P. Fraigniaud, M. M. Halld´orsson, and A. Korman. On the impact of identifiers on localdecision. In Principles of Distributed Systems: 16th International Conference, OPODIS.Proceedings , pages 224–238. Springer Berlin Heidelberg, 2012.15. P. Fraigniaud, J. Hirvonen, and J. Suomela. Node labels in local decision. In StructuralInformation and Communication Complexity: 22nd International Colloquium, SIROCCO.Post-Proceedings , pages 31–45. Springer International Publishing, 2015.6 B. Patt-Shamir and M. Perry16. P. Fraigniaud, A. Korman, and D. Peleg. Towards a complexity theory for local distributedcomputing. J. ACM , 60(5):35, 2013.17. P. Fraigniaud, S. Rajsbaum, and C. Travers. Locality and checkability in wait-free comput-ing. Distributed Computing , 26(4):223–242, 2013.18. P. Fraigniaud, S. Rajsbaum, and C. Travers. On the number of opinions needed for fault-tolerant run-time monitoring in distributed systems. In ,LNCS, pages 92–107. Springer, 2014.19. M. G¨o¨os and J. Suomela. Locally checkable proofs. In , pages 159–168, 2011.20. A. Korman and S. Kutten. Distributed verification of minimum spanning trees. DistributedComputing , 20:253–266, 2007.21. A. Korman, S. Kutten, and T. Masuzawa. Fast and compact self stabilizing verification,computation, and fault detection of an MST. In , pages 311–320, 2011.22. A. Korman, S. Kutten, and D. Peleg. Proof labeling schemes. Distributed Computing ,22(4):215–233, 2010.23. E. Kushilevitz and N. Nisan. Communication complexity . Cambridge University Press, 1997.24. D. W. Matula and L. L. Beck. Smallest-last ordering and clustering and graph coloringalgorithms. J. ACM , 30(3):417–427, July 1983.25. C. S. A. Nash-Williams. Edge-disjoint spanning trees of finite graphs. Journal of the LondonMathematical Society , s1-36(1):445–450, 1961.26. C. S. A. Nash-Williams. Decomposition of finite graphs into forests. Journal of the LondonMathematical Society , s1-39(1):12, 1964.27. D. Peleg. Distributed Computing: A Locality-Sensitive Approach . Society for Industrial andApplied Mathematics, Philadelphia, PA, USA, 2000.28. R. E. Tarjan. Data Structures and Network Algorithms , volume 44 of