A New Approach to Multi-Party Peer-to-Peer Communication Complexity

TL;DR

This paper introduces new models and measures for multi-party peer-to-peer communication complexity, proving tight lower bounds for Disjointness and parity functions, advancing understanding in natural peer-to-peer settings.

Contribution

It presents the first tight lower bounds for multi-party peer-to-peer communication complexity, improving upon previous models and results.

Findings

Proves a tight  lower bound of  on Disjointness complexity.

Establishes a tight  lower bound for parity function.

Shows an  lower bound on random bits for private computation.

Abstract

We introduce new models and new information theoretic measures for the study of communication complexity in the natural peer-to-peer, multi-party, number-in-hand setting. We prove a number of properties of our new models and measures, and then, in order to exemplify their effectiveness, we use them to prove two lower bounds. The more elaborate one is a tight lower bound of $\Omega(kn)$ on the multi-party peer-to-peer randomized communication complexity of the $k$-player, $n$-bit Disjointness function. The other one is a tight lower bound of $\Omega(kn)$ on the multi-party peer-to-peer randomized communication complexity of the $k$-player, $n$-bit bitwise parity function. Both lower bounds hold when ${n=\Omega(k)}$. The lower bound for Disjointness improves over the lower bound that can be inferred from the result of Braverman et al.~(FOCS 2013), which was proved in the coordinator model and can yield a lower bound of $\Omega(kn/\log k)$ in the peer-to-peer model. To the best of our knowledge, our lower bounds are the first tight (non-trivial)lower bounds on communication complexity in the natural {\em peer-to-peer} multi-party setting. In addition to the above results for communication complexity, we also prove, using the same tools, an $\Omega(n)$ lower bound on the number of random bits necessary for the (information theoretic) private computation of the $k$-player, $n$-bit Disjointness function .

Equations

$$\sum _{i=1}^{k}H({\Pi }_i)$$

$$\le \sum _{i=1}^{k}E[|{\Pi }_i^{\prime }|]\text{(by Theorem refthm:Shannon)}$$

$$\le \sum _{i=1}^k\left(2E[|{\Pi }_i|]+4(k-1)\right)$$

$$\le 2\cdot E[|\Pi |]+4k^2$$

$$\le 4\cdot \mathsf{CC}(\pi )+4k^2,$$

$${\mathsf{MIC}}_{\mu }(\pi )=\sum _{i=1}^k\left(I(X_{-i};{\Pi }_i\mid X_i{R}_i)+I(X_i;{\Pi }_i\mid X_{-i}{R}_{-i})\right).$$

$${\mathsf{MIC}}_{\mu }^{ϵ}(f)=\underset{\pi \text{ ϵ-computing }f}{\inf }{\mathsf{MIC}}_{\mu }(\pi ).$$

$${\mathsf{MIC}}^{ϵ}(f)=\underset{\pi \text{ ϵ-computing }f}{\inf }\underset{\mu }{\sup }{\mathsf{MIC}}_{\mu }(\pi ).$$

$$\mathsf{CC}(\pi )\ge \frac{1}{8}{\mathsf{MIC}}_{\mu }(\pi )-k^2.$$

$${\mathsf{MIC}}_{\mu }(\pi )$$

$$\le 2\sum _{i=1}^{k}H({\Pi }_i)$$

$$\le 8\cdot \mathsf{CC}(\pi )+8k^2,$$

$${\mathsf{MIC}}_{{\mu }^n}(\pi )\ge n\cdot {\mathsf{MIC}}_{\mu }({\pi }^{\prime }).$$

$${\mathsf{MIC}}_{\mu }({\pi }^{\prime })=\sum _{i=1}^k\left(I(Y_{-i};R^{\prime p}{\Pi }_i^{\prime }\mid Y_i{R}_i^{\prime })+I(Y_i;R^{\prime p}{\Pi }_i^{\prime }\mid Y_{-i}{R}_{-i}^{\prime })\right).$$

$$I(Y_{-i};R^{\prime p}{\Pi }_i^{\prime }\mid Y_i{R}_i^{\prime })$$

$$=I(Y_{-i};X^{<L}{R}^p{\Pi }_i\mid Y_i{X}_i^{>L}{R}_i)\text{ (because I(Y−i;L∣YiXi>LRiX<LRpΠi)=0)}$$

$$=I(Y_{-i};R^p{\Pi }_i\mid Y_i{X}_i^{>L}{R}_i{X}^{<L})\text{ (because Y−i and X<L are independent)}$$

$$=\underset{\ell }{E}[I(X_{-i}^{\ell };R^p{\Pi }_i\mid X_i^{\ell }{X}_i^{>\ell }{R}_i{X}^{<\ell })]$$

$$=\underset{\ell }{E}[I(X_{-i}^{\ell };R^p{\Pi }_i\mid X_i^{\ell }{X}_i^{>\ell }{R}_i{X}_i^{<\ell }{X}_{-i}^{<\ell })]$$

$$=\underset{\ell }{E}[I(X_{-i}^{\ell };R^p{\Pi }_i\mid X_i{R}_i{X}_{-i}^{<\ell })]$$

$$=\frac{1}{n}\sum _{\ell }[I(X_{-i}^{\ell };R^p{\Pi }_i\mid X_i{R}_i{X}_{-i}^{<\ell })]$$

$$=\frac{1}{n}I(X_{-i};R^p{\Pi }_i\mid X_i{R}_i)\text{ (chain rule) ,}$$

$$I(Y_i;R^{\prime p}{\Pi }_i^{\prime }\mid Y_{-i}{R}_{-i}^{\prime })$$

$$=I(Y_i;X^{<L}{R}^p{\Pi }_i\mid Y_{-i}{X}_{-i}^{>L}{R}_{-i})\text{ (because I(Yi;L∣Y−iX−i>LR−iX<LRpΠi)=0)}$$

$$=I(Y_i;R^p{\Pi }_i\mid Y_{-i}{X}_{-i}^{>L}{R}_{-i}{X}^{<L})\text{ (because Yi and X<L are independent )}$$

$$=\underset{\ell }{E}[I(X_i^{\ell };R^p{\Pi }_i\mid X_{-i}^{\ell }{X}_{-i}^{>\ell }{R}_{-i}{X}_{-i}^{<\ell }{X}_i^{<\ell })]$$

$$=\underset{\ell }{E}[I(X_i^{\ell };R^p{\Pi }_i\mid X_{-i}{R}_{-i}{X}_i^{<\ell })]$$

$$=\frac{1}{n}\sum _{\ell }[I(X_i^{\ell };R^p{\Pi }_i\mid X_{-i}{R}_{-i}{X}_i^{<\ell })]$$

$$=\frac{1}{n}I(X_i;R^p{\Pi }_i\mid X_{-i}{R}_{-i})\text{ (chain rule).}$$

$${\mathcal{I}}_i(\overline{\tau })=\{(x^{\prime },r^{\prime }),\exists (x,r)\in {\mathcal{A}}_i(\overline{\tau }),x^{\prime }=x_i\&r^{\prime }=r_i\},$$

$${\mathcal{J}}_i(\overline{\tau })=\{(x^{\prime },r^{\prime }),\exists (x,r)\in {\mathcal{A}}_i(\overline{\tau }),x^{\prime }=x_{-i}\&r^{\prime }=r_{-i}\}.$$

$$\forall \overline{\tau }\in {\mathcal{T}}_i,{\mathcal{I}}_i(\overline{\tau })\times {\mathcal{J}}_i(\overline{\tau })\subseteq {\mathcal{A}}_i(\overline{\tau }).$$

$$\exists (\hat{x},\hat{r})\in {\mathcal{A}}_i(\overline{\tau })\mid x_{-i}={\hat{x}}_{-i}\&r_{-i}={\hat{r}}_{-i}.$$

$$(x,r)\in {\mathcal{A}}_i(\overline{\tau }).$$

$$\forall \tau \in \mathcal{T},{\mathcal{I}}_i({\tau }_i)\times {\mathcal{H}}_i(\tau )\subseteq \mathcal{B}(\tau ),$$

$${\mathcal{I}}_i({\tau }_i)\times {\mathcal{H}}_i(\tau )\subseteq {\mathcal{I}}_i({\tau }_i)\times {\mathcal{J}}_i({\tau }_i)\subseteq {\mathcal{A}}_i({\tau }_i),$$

$$\forall x\in \mathcal{X},\forall \tau =({\tau }_1,\dots ,{\tau }_k)\in \mathcal{T},\mathrm{Pr}[{\Pi }_i(x)={\tau }_i]=q_i(x_i,{\tau }_i)q_{-i}(x_{-i},{\tau }_i),$$

$$\forall x\in \mathcal{X},\forall \tau =({\tau }_1,\dots ,{\tau }_k)\in \mathcal{T},\mathrm{Pr}[\Pi (x)=\tau ]=q_i(x_i,{\tau }_i)p_{-i}(x_{-i},\tau ).$$

$${\mathsf{Par}}_k^n(x)=\left({\oplus }_{i=1}^k{x}_i^1,{\oplus }_{i=1}^k{x}_i^2,\dots ,{\oplus }_{i=1}^k{x}_i^n\right)$$

$${\mathsf{MIC}}_{\mu }(\pi )$$

Full text

A New Approach to Multi-Party Peer-to-Peer Communication Complexity111A preliminary version of this paper

appeared in the proceedings of ITCS 2019 [43].

Adi Rosén CNRS and Université de Paris, 75205 Paris, France, email: adiro@irif.fr. Research supported in part by ANR project RDAM.   

Florent Urrutia Université de Paris, 75205 Paris, France, email: urrutia@irif.fr. Research supported in part by ERC QCC and by ANR project RDAM.

We introduce new models and new information theoretic measures for the study of communication complexity in the natural peer-to-peer, multi-party, number-in-hand setting. We prove a number of properties of our new models and measures, and then, in order to exemplify their effectiveness, we use them to prove two lower bounds. The more elaborate one is a tight lower bound of $\Omega(kn)$ on the multi-party peer-to-peer randomized communication complexity of the $k$-player, $n$-bit function Disjointness, $\mathsf{Disj}_{k}^{n}$. The other one is a tight lower bound of $\Omega(kn)$ on the multi-party peer-to-peer randomized communication complexity of the $k$-player, $n$-bit bitwise parity function, $\mathsf{Par}_{k}^{n}$. Both lower bounds hold when ${n=\Omega(k)}$. The lower bound for $\mathsf{Disj}_{k}^{n}$ improves over the lower bound that can be inferred from the result of Braverman et al. (FOCS 2013), which was proved in the coordinator model and can yield a lower bound of $\Omega(kn/\log k)$ in the peer-to-peer model.

To the best of our knowledge, our lower bounds are the first tight (non-trivial) lower bounds on communication complexity in the natural peer-to-peer multi-party setting.

In addition to the above results for communication complexity, we also prove, using the same tools, an $\Omega(n)$ lower bound on the number of random bits necessary for the (information theoretic) private computation of the function $\mathsf{Disj}_{k}^{n}$.

1 Introduction

Communication complexity, first introduced by Yao [49], has become a major topic of research in Theoretical Computer Science, both for its own sake, and as a tool which has yielded important results (mostly lower bounds) in various theoretical computer science fields such as circuit complexity, streaming algorithms, or data structures (e.g., [37, 40, 25, 44, 24]). Communication complexity is a measure for the amount of communication needed in order to solve a problem whose input is distributed among several players. The two-party case, where two players, usually called Alice and Bob, cooperate in order to compute a function of their respective inputs, has been widely studied with many important results; yet major questions in this area are still open today (e.g., the log-rank conjecture, see [37]). The multi-party case, where $k\geq 3$ players cooperate in order to compute a function of their inputs, is much less understood.

A number of variants have been proposed in the literature to extend the two-party setting into the multi-party one. In this paper we consider the more natural number-in-hand (NIH) setting, where each player has its own input, as opposed to the so-called number-on-forehead (NOF) setting, where each player knows all pieces of the input except one, its own. Moreover, also the communication structure between the players in the multi-party setting was considered in the literature under a number of variants. For example, in the blackboard (or broadcast) model the communication between the players is achieved by each player writing, in turn, a message on the board, to be read by all other players. In the coordinator model, introduced in [21], there is an additional entity, the coordinator, and all players communicate back and forth only with the coordinator. The most natural setting is, however, the peer-to-peer message-passing model, where each pair of players is connected by a communication link, and each player can send a separate message to any other player. This latter setting has been studied, in the context of communication complexity, even less than the other multi-party settings, probably due to the difficulty in tracking the distributed communication patterns that occur during a run of a protocol in that setting. This setting is, however, not only the most natural one, and the one that occurs the most in real systems, but is the setting studied widely in the distributed algorithms and distributed computation communities, for complexity measures which are usually other than communication complexity.

In the present paper we attempt to fill this gap in the study of peer-to-peer communication complexity, and, further, to create a more solid bridge between the research field of communication complexity and the research field of distributed computation. We propose a computation model, together with an information theoretic complexity measure, for the analysis of the communication complexity of protocols in the asynchronous multi-party peer-to-peer (number-in-hand) setting. We argue that our model is, on the one hand, only a slight restriction over the asynchronous model usually used in the distributed computation literature, and, on the other hand, stronger than the models that have been previously suggested in order to study communication complexity in the peer-to-peer setting common in the distributed computation literature (e.g., [21, 47]). Furthermore, our model lends itself to the analysis of communication complexity, most notably using information theoretic tools.

Indeed, after defining our model and our information theoretic measure, that we call Multi-party Information Cost ($\mathsf{MIC}$), we prove a number of properties of that measure, and then prove a number of fundamental properties of protocols in our model. We then exemplify the effectiveness of our model and information theoretic measure by proving two tight lower bounds. The more elaborate one is a tight lower bound of $\Omega(kn)$, when ${n=\Omega(k)}$, on the peer-to-peer randomized communication complexity of the function set-disjointness ($\mathsf{Disj}_{k}^{n}$). This function is a basic, important function, which has been the subject of a large number of studies in communication complexity, and is often seen as a test for our ability to give lower bounds in a given model (cf. [16]). We note that the communication complexity of Disjointness in the two-party case is well understood [30, 42, 3, 7, 9]. From a quantitative point of view, our result for peer-to-peer multi-party Disjointness improves by a $\log k$ factor the lower bound that could be deduced for the peer-to-peer model from the lower bound on the communication complexity of Disjointness in the coordinator model [8]. The second lower bound that we prove is a tight lower bound of $\Omega(kn)$, when ${n=\Omega(k)}$, on the peer-to-peer randomized communication complexity of the bitwise parity function $\mathsf{Par}_{k}^{n}$. Both our lower bounds are obtained by giving a lower bound on the $\mathsf{MIC}$ of the function at hand, which yields the lower bound on the communication complexity of that function. We believe that our lower bounds are the first tight (non-trivial) lower bound on communication complexity in a peer-to-peer multi-party setting.222Lower bounds in a seemingly peer-to-peer setting were given in [47]. However, in the model of that paper, the communication pattern is determined by an external view of the transcript, which makes the model equivalent to the coordinator model.

It is important to note that, to the best of our knowledge, there is no known method to obtain tight lower bounds on multi-party communication complexity in a peer-to-peer setting via lower bounds in other known multi-party settings. Lower bounds obtained in the coordinator model can be transferred to the peer-to-peer model at the cost of a $\log k$ factor, where $k$ is the number of players, because any peer-to-peer protocol can be simulated in the coordinator model by having the players attach to every message the identity of the destination of that message [41, 22]. The loss of this factor in the lower bounds is unavoidable when the communication protocols can exploit a flexible communication pattern, since there are examples of functions where this factor in the communication complexity is necessary, while others, e.g., the parity function of single-bit inputs, have the same communication complexity in the coordinator and peer-to-peer settings (see a more detailed discussion on this point in Section 2.2). Therefore, one cannot prove tight lower bounds in the peer-to-peer setting by proving corresponding results in the coordinator model. Note that flexible communication configurations arise naturally for mobile communicating devices, for example, when these devices exchange information with the nearby devices. Constructions based on the pointer jumping problem also seem to be harder in the coordinator model, as solving the problem usually requires exchanging information in a specific order determined by the inputs of the players. It is thus important to develop lower bound techniques which apply directly in the peer-to-peer model, as we do in the present paper. Information theoretic tools seem, as we show, most suitable for this task.

Information theoretic complexity measures. As indicated above, our work makes use of information theoretic tools. Based on information theory, developed by Shannon [45], Information Complexity (IC), originally defined in [2, 14], is a powerful tool for the study of two-party communication protocols. Information complexity is a measure of how much information, about each other’s input, the players must learn during the course of the protocol, if that protocol must compute the function correctly. Since IC can be shown to provide a lower bound on the communication complexity, this measure has proven to be a strong and useful tool for obtaining lower bounds on two-party communication complexity in a sequence of papers (e.g., [3, 4, 11, 7]). However, information complexity cannot be extended in a straightforward manner to the multi-party setting. This is because with three players or more, any function can be computed privately (cf. [5, 19]), i.e., in a way such that the players learn nothing but the value of the function to compute. This implies that the information complexity of any function is too low to provide a meaningful lower bound on the communication complexity in the natural peer-to-peer multi-party setting. Therefore, before the present paper, information complexity and its variants have been used to obtain lower bounds on multi-party communication complexity only in settings which do not allow for private protocols (and most notably not in the natural peer-to-peer setting), with the single exception of [31]. For example, a number of lower bounds have been obtained via information complexity for a promise version of set-disjointness in the broadcast model [3, 13, 27] (also cf. [29]), and external information complexity was used in [10] for a lower bound on the general disjointness function, also in the broadcast model. In the coordinator model, lower bounds on the communication complexity of set-disjointness were given via variants of information complexity [8]. The latter result was extended in [15] to the function Tribes. A notion of external information cost in the coordinator model was introduced in [28] to study maximum matching in a distributed setting. We note that the study of communication complexity in number-in-hand multi-party settings via techniques other than those based on information theory is limited to very few papers. One such example is the technique of symmetrization that was introduced for the coordinator model in [41], and was shown to be useful to study functions such as the bitwise $\mathsf{AND}$. That technique was further developed along with other reduction techniques in [46, 47, 48]. Another example is the notion of strong fooling sets, introduced in [12] to study deterministic communication complexity of discreet protocols, also defined in [12].

Private computation. It is well known that in the multi-party number-in-hand peer-to-peer setting, unlike in the two-party case, any function can be privately computed [5, 19]. The model that we define in the present paper does allow for (information theoretic) private computation of any function [5, 19, 1]. The minimum amount of private randomness needed in order to compute privately a given function is often referred to in this context as the randomness complexity of that function. Randomness complexity (in private computation) is of interest because true randomness is considered a costly resource, and since randomness complexity in private computation has been shown to be related to other complexity measures, such as the circuit size of the function or its sensitivity. For example, it has been shown [38] that a boolean function $f$ has a linear size circuit if and only if $f$ has constant randomness complexity. A small number of works [6, 36, 26, 31] prove lower bounds on the randomness complexity of the parity function. The parity and other modulo-sum functions are, to the best of our knowledge, the only functions for which randomness complexity lower bounds are known. Using the information theoretic results that we obtain in the present paper for the set-disjointness function, we are able to give a lower bound of $\Omega(n)$ on the randomness complexity of $\mathsf{Disj}_{k}^{n}$. The significance of this result lies in that it is the first such lower bound that grows with the size of the input (which is $kn$), while the output remains a single bit, contrary to the sum function (see [6]) or the bitwise parity function (see [31]).

1.1 Our techniques and contributions

Our contribution in the present paper is twofold.

First, on the conceptual, modeling and definitions side we lay the foundations for proving lower bounds on (randomized) communication complexity in the natural peer-to-peer multi-party setting. Specifically, we propose a model that, on the one hand, is a very natural peer-to-peer model, and very close to the model used in the distributed computation literature, and, at the same time, does have properties that allow one to analyze protocols in terms of their information complexity and communication complexity. While at first sight the elaboration of such model does not seem to be a difficult task, many technical, as well as fundamental, issues render this task non-trivial. For example, one would like to define a notion of “transcript” that would guarantee both a relation between the length of the transcript and the communication complexity, and at the same time will contain all the information that the players get and use while running the protocol. The difficulty in elaborating such model may be the reason for which, prior to the present paper, hardly any work studied communication complexity directly in a peer-to-peer, multi-party setting (cf. [22]), leaving the field with only the results that can be inferred from other models, hence suffering the appropriate loss in the obtained bounds. We propose our model (see Section 2.1) and prove a number of fundamental properties that allow one to analyze protocols in that model (see Section 3.2), as well as prove the accurate relationship between the entropy of the transcript and the communication complexity of the protocol (Proposition 2.4).

We then define our new information theoretic measure, that we call “Multi-party Information Cost” ($\mathsf{MIC}$), intended to be applied to peer-to-peer multi-party protocols, and prove that it provides, for any (possibly randomized) protocol, a lower bound on the communication complexity of that protocol (Lemma 3.4). We further show that $\mathsf{MIC}$ has certain properties such as a certain direct-sum property (Theorem 3.5). We thus introduce a framework as well as tools for proving lower bounds on communication complexity in a peer-to-peer multi-party setting.

Second, we exemplify the effectiveness of our conceptual contributions by proving, using the new tools that we define, two tight lower bounds on the randomized communication complexity of certain functions in the peer-to-peer multi-party setting. Both these lower bounds are proved by giving a lower bound on the Multi-party Information Complexity of the function at hand. The more elaborate lower bound is a tight lower bound of $\Omega(nk)$ on the randomized communication complexity of the function $\mathsf{Disj}_{k}^{n}$ (under the condition that $n=\Omega(k)$). The function Disjointness is a well studied function in communication complexity and is often seen as a test-case of one’s ability to give lower bounds in a given model (cf. [16]). While the general structure of the proof of this lower bound does have similarities to the proof of a lower bound for Disjointness in the coordinator model [8],333The lower bound in [8] would yield an $\Omega(\frac{1}{\log k}\cdot nk)$ lower bound in the peer-to-peer setting. we do, even in the parts that bear similarities, have to overcome a number of technical difficulties that require new ideas and new proofs. For example, the very basic rectangularity property of communication protocols is, in the multi-party (peer-to-peer) setting, very sensitive to the details of the definition of the model and the notion of a transcript. We therefore need first to give a proof of this property in the peer-to-peer model (Lemma 3.6 and Lemma 3.7). We then use a distribution of the input which is a modification over the distributions used in [8, 15] (see Section 5). Our proof proceeds, as in [8], by proving a lower bound for the function $\mathsf{AND}$, on a certain information theoretic measure that, in our proof, is called $\mathsf{SMIC}$ (for Switched Multi-party Information Cost), and then, by using a direct-sum-like lemma, to infer a lower bound on $\mathsf{SMIC}$ for Disjointness (we note that $\mathsf{SMIC}$ is an adaptation to the peer-to-peer model of a similar measure used in [8]). However, the lack of a “coordinator” in a peer-to-peer setting necessitates a definition of a more elaborate reduction protocol, and a more complicated proof for the direct-sum argument, inspired by classic secret-sharing primitives. See Lemma 6.1 for our construction and proof. We then show that $\mathsf{SMIC}$ provides a lower bound on $\mathsf{MIC}$, which yields our lower bound on the communication complexity of Disjointness.

We further give a tight lower bound of $\Omega(nk)$ on the randomized communication complexity of the function $\mathsf{Par}_{k}^{n}$ (bitwise parity) in the peer-to-peer multi-party setting (under the condition that $n=\Omega(k)$). This proof proceeds by first giving a lower bound on $\mathsf{MIC}$ for the parity function $\mathsf{Par}_{k}^{1}$, and then using a direct-sum property of $\mathsf{MIC}$ to get a lower bound on $\mathsf{MIC}$ for $\mathsf{Par}_{k}^{n}$. The latter yields the lower bound of $\Omega(nk)$ on the communication complexity of $\mathsf{Par}_{k}^{n}$.

To the best of our knowledge, our lower bounds are the first tight (non-trivial) lower bound on communication complexity in a peer-to-peer multi-party setting.

In addition to our results on communication complexity, we analyze the number of random bits necessary for private computations [5, 19], making use of the model, tools and techniques we develop in the present paper. It has been shown [31] that the public information cost (defined also in [31]) can be used to derive a lower bound on the randomness complexity of private computations. In the present paper we give a lower bound on the public information cost of any synchronous protocol computing the Disjointness function by relating it to its Switched Multi-party Information Cost, which yields the lower bound on the randomness complexity of Disjointness.

Organization. The appendix contains a short review of information theoretic notions that we use in the present paper. We start the paper, in Section 2, by introducing our model and by comparing it to other models. In Section 3 we define our new information theoretic measure, $\mathsf{MIC}$, and prove some of its properties, and then prove a number of fundamental properties of protocols in our peer-to-peer model. In Section 4 we give the lower bound for the bitwise parity function. In Section 5 we prove a lower bound on the switched multi-party information cost of the function $\mathsf{AND}_{k}$, and in Section 6, we prove, using the results of Section 5, the lower bound on the communication complexity of the disjointness function $\mathsf{Disj}_{k}^{n}$. In Section 7, we show how to apply our information theoretic lower bounds in order to give a lower bound on the number of random bits necessary for the private computation of the function $\mathsf{Disj}_{k}^{n}$. Last, in Section 8 we discuss some open questions.

2 Multi-party communication protocols

We start with our model, and, to this end, give a number of notations.

Notations. We denote by $k$ the number of players. We often use $n$ to denote the size (in bits) of the input to each player. Calligraphic letters will be used to denote sets. Upper case letters will be used to denote random variables, and given two random variables $A$ and $B$, we will denote by $AB$ the joint random variable $(A,B)$. Given a string (of bits) $s$, $|s|$ denotes the length of $s$. Using parentheses we denote an ordered set (family) of items, e.g., $(Y_{i})$. Given a family $(Y_{i})$, $Y_{-i}$ denotes the sub-family which is the family $(Y_{i})$ without the element $Y_{i}$. The letter $X$ will usually denote the input to the players, and we thus use the shortened notation $X$ for $(X_{i})$, i.e., the input to all players. A protocol will usually be denoted by $\pi$.

We now define a natural communication model which is a slight restriction of the general asynchronous peer-to-peer model. The restriction of our model compared to the general asynchronous peer-to-peer model is that for a given player at a given time, the set of players from which that player waits for a message before sending any message of its own is determined by that player’s own local view, i.e., from that player’s input and the messages it has read so far, as well as its private randomness, and the public randomness. This allows us to define information theoretic tools that pertain to the transcripts of the protocols, and at the same time to use these tools as lower bounds for communication complexity. This restriction however does not exclude the existence of private protocols, as other special cases of the general asynchronous model do. We observe that practically all multi-party protocols in the literature are implicitly defined in our model, and that without such restriction, one bit of communication can bring $\log k$ bits of information, because not only the content of the message, but also the identity of the sender may reveal information. To exemplify why the general asynchronous model is problematic consider the following simple example (that we borrow from our work in [31]).

Example 2.1**.**

There are $4$ players $A$, $B$ and $C$, $D$. The protocol allows $A$ to transmit to $B$ its input bit $x$. But all messages sent in the protocol are the bit [math], and the protocol generates only a single transcript over all possible inputs. The protocol works as follows:

A*: If $x=0$ send [math] to $C$; after receiving [math] from $C$, send [math] to $D$.*

If $x=1$ send [math] to $D$; after receiving [math] from $D$, send [math] to $C$

B*: After receiving [math] from a player, send [math] back to that player.*

C,D*: After receiving [math] from $A$ send [math] to $B$. After receiving [math] from $B$ send [math] to $A$.*

It is easy to see that $B$ learns the value of $x$ from the order of the messages it gets.

In what follows we formally define our model, compare it to the general one and to other restricted ones, and explain the usefulness and logic of our specific model.

2.1 Definition of the model

We work in a multi-party, number-in-hand, peer-to-peer setting. Each player $1\leq i\leq k$ has unbounded local computation power and, in addition to its input $X_{i}$, has access to a source of private randomness $R_{i}$. We will use the notation $R$ for $(R_{i})$, i.e., the private randomness of all players. A source of public randomness $R^{p}$ is also available to all players. We will call a protocol with no private randomness a public-coins protocol. The system consists of $k$ players and a family of $k$ functions $f=(f_{i})_{i\in[\![1,k]\!]}$, with $\forall~{}i\in[\![1,k]\!],~{}f_{i}:\Pi_{\ell=1}^{k}\mathcal{X}_{\ell}\rightarrow\mathcal{Y}_{i}$, where $\mathcal{X}_{\ell}$ denotes the set of possible inputs of player $\ell$, and ${\mathcal{Y}_{i}}$ denotes the set of possible outputs of player $i$. The players are given some input $x=(x_{i})\in\Pi_{i=1}^{k}\mathcal{X}_{i}$, and for every $i$, player $i$ has to compute $f_{i}(x)$.

We define the communication model as follows, which is the asynchronous setting, with some restrictions. To make the discussion simpler we assume a global time which is unknown to the players. Every pair of players is connected by a bidirectional communication link that allows them to send messages to each other. There is no bound on the delivery time (i.e., when the message arrives to its destination node) of a message, but every message is delivered in finite time, and the communication link maintains FIFO order in each of the two directions. Messages that arrive to the head of the link at the destination node of that link are buffered until they are read by that node. Given a specific time we define the view of player $i$ as the input of this player, $X_{i}$, its private randomness, $R_{i}$, the public randomness, $R^{p}$, and the messages read so far by player $i$. After the protocol has started,The protocol of each player $i$ runs in local rounds. In each round, player $i$ sends messages to some subset of the other players. The identity of these players, as well as the content of these messages, depend on the current view of player $i$. The player also decides whether it should stop, and output (or “return”) the result of the function $f_{i}$. Then (if player $i$ did not stop and return the output), the player waits for messages from a certain subset of the other players, this subset being also determined by the current view of the player. That is, the player reads a single message from each of the incoming links that connect it to that subset of other players; If for a certain such link no message is available, then the player waits until such message is available (i.e., arrives). Then the (local) round of player $i$ terminates.444The fact that the receiving of the incoming messages comes as the last step of the (local) round comes only to emphasize that the sending of the messages and the output are a function of only the messages received in previous (local) rounds. To make it possible for the player to identify the arrival of the complete message that it waits for, we require that each message sent by a player in the protocol is self-delimiting.

Denote by ${\cal D}_{i}^{\ell}$ the set of possible views of player $i$ at the end of local round $\ell$, $\ell\geq 0$, where the beginning of the protocol is considered round [math].

Formally, a protocol $\pi$ is defined by a set of local programs, one for each player $i$, where the local program of player $i$ is defined by a sequence of functions, parametrized by the index of the local round $\ell$, $\ell\geq 1$:

• •

$S_{i}^{\ell,s}:{\cal D}_{i}^{\ell-1}\rightarrow 2^{\{1,\ldots,k\}\setminus\{i\}}$, defining the set of players to which player $i$ sends the messages.

• •

$m_{i,j}^{\ell}:{\cal D}_{i}^{\ell-1}\rightarrow\{0,1\}^{*}$, such that for any $D_{i}^{\ell-1}\in{\cal D}_{i}^{\ell-1}$, if $j\in S_{i}^{\ell,s}(D_{i}^{\ell-1})$, then $m_{i,j}^{\ell}(D_{i}^{\ell-1})$ is the content of the message player $i$ sends to player $j$. Each such message is self-delimiting.

• •

$O_{i}^{\ell}:{\cal D}_{i}^{\ell-1}\rightarrow\{0,1\}^{*}\cup\{\bot\}$, defining whether or not the local program of player $i$ stops and the player returns its output, and what is that output. If the value is $\bot$ then no output occurs. If the value is $y\in\{0,1\}^{*}$, then the local program stops and the player returns the value $y$.

• •

$S_{i}^{\ell,r}:{\cal D}_{i}^{\ell-1}\rightarrow 2^{\{1,\ldots,k\}\setminus\{i\}}$, defining the set of players from which player $i$ waits to receive a message.

To define the transcript of a protocol we proceed as follows. We first define $k(k-1)$ basic transcripts $\Pi_{i,j}^{r}$, denoting the transcript of the messages read by player $i$ from its link from player $j$, and another $k(k-1)$ basic transcripts $\Pi_{i,j}^{s}$, denoting the transcript of the messages sent by player $i$ on its link to player $j$.

We then define the transcript of player $i$, $\Pi_{i}$, as the $2(k-1)$-tuple of the $2(k-1)$ basic transcripts $\Pi_{i,j}^{r},\Pi_{i,j}^{s}$, $j\in[\![1,k]\!]\setminus\{i\}$. The transcript of the whole protocol $\Pi$ is defined as the $k$-tuple of the $k$ player transcripts $\Pi_{i}$, $i\in[\![1,k]\!]$. We denote by $\Pi_{i}(x,r)$ the transcript of player $i$ when protocol $\pi$ is run on input $x$ and on randomness (public and private of all players) $r$. By $\Pi_{i}^{\ell}(x,r)$ we denote $\Pi_{i}(x,r)$ modified such that all the messages that player $i$ sends in local rounds $\ell^{\prime}>\ell$, and all the messages that player $i$ reads in local rounds $\ell^{\prime}>\ell$ are eliminated from the transcript. Observe that while $\Pi_{i,j}^{r}$ is always a prefix of $\Pi_{j,i}^{s}$, the definition of a protocol does not imply that they are equal. Further observe that each bit sent in $\pi$ appears in $\Pi$ at most twice.

We note that while seemingly the model that we introduce here is the same as the one used in  [31], there are important differences between the models, and that these differences are crucial for the properties that we prove in the present paper to hold. See Section 2.2 for a comparison.

For a $k$-party protocol $\pi$ we denote the set of possible inputs as $\mathcal{X}$, and denote the projection of this set on the $i$’th coordinate (i.e., the set of possible inputs for player $i$) by $\mathcal{X}_{i}$. Thus $\mathcal{X}\subseteq\mathcal{X}_{1}\times\cdots\times\mathcal{X}_{k}$. The set of possible transcripts for a protocol is denoted $\mathcal{T}$, and the projection of this set on the $i$’th coordinate (i.e., the set of possible transcripts of player $i$) is denoted $\mathcal{T}_{i}$. Observe that $\mathcal{T}\subseteq\mathcal{T}_{1}\times\cdots\times\mathcal{T}_{k}$.

Furthermore, in the course of the proofs, we sometimes consider a protocol that does not have access to public randomness (but may have private randomness). We call such protocol a private-coins protocol.

We now formally define the notion of a protocol computing a given function with certain bounded error. We will give most of the following definitions for the case where all functions $f_{i}$ are the same function, that we denote by $f$. The definitions in the case of family of functions are similar.

Definition 2.2**.**

For a given $0\leq\epsilon<1$, a protocol $\pi$ $\epsilon$-computes a function $f$ if for all $x\in\Pi_{i=1}^{k}\mathcal{X}_{i}$:

• •

For all possible assignments for the random sources $R_{i}$, $1\leq i\leq k$, and $R^{p}$, every player eventually stops and returns an output.

• •

With probability at least $1-\epsilon$ (over all random sources) the following event occurs: each player $i$ outputs the value $f(x)$, i.e., the correct value of the function.

The communication complexity of a protocol is defined as the worst case, over the possible inputs and the possible randomness, of the number of bits sent by all players. For a protocol $\pi$ we denote its communication complexity by $\mathsf{CC}(\pi)$. For a given function $f$ and a given $0\leq\epsilon<1$, we denote by $\mathsf{CC}^{\epsilon}(f)$ the $\epsilon$-error communication complexity of $f$, i.e., \mathsf{CC}^{\epsilon}(f)=\inf\limits_{\pi~{}\text{\epsilon-computing}~{}f}\mathsf{CC}(\pi).

In addition to the notion of a protocol computing a function, we also consider the notion of external computation by a protocol.

Definition 2.3**.**

For a given ${0\leq\epsilon<1}$, a protocol $\pi$ externally $\epsilon$-computes $f$ if there exists a deterministic function $\theta$ taking as input the possible transcripts of $\pi$ and verifying ${\forall~{}x\in\mathcal{X},~{}\Pr[\theta(\Pi(x))=f(x)]\geq 1-\epsilon}$.

We remark that an $\epsilon$-computing protocol can be converted into an externally $\epsilon$-computing protocol keeping the same communication complexity (up to a multiplicative factor of $2$, and an additive term being the size of the output): every bit sent in the original protocol is replaced by two identical bits; when some player, w.l.o.g. player $1$, outputs the value of the function, it concatenates to the string it has to send to some other player, w.l.o.g. player $2$, a string composed of the bits $01$ followed by the value of the function it outputs (the concatenated new string is to be sent as a self delimiting message as all other messages in the protocol). The new protocol operates as the original one, and will be an externally computing protocol. Thus, for any function with constant-size output (in particular boolean functions), a lower bound on the communication complexity of externally $\epsilon$-computing protocols implies the same (up to a constant factor of $2$) lower bound for $\epsilon$-computing protocols.

We further remark that an externally $\epsilon$-computing protocol is a weaker notion than an $\epsilon$-computing protocol, as it only requires that the the function can be computed from the transcript, not that all, or any specific, players can compute the function. For example, for the function $f=x_{1}$, $x_{i}\in\{0,1\}^{n}$ (i.e., the value of the function is the input of player $1$) a protocol where player $1$ sends to player $2$ its input $x_{1}$ is a [math]-externally computing protocol with communication complexity $n$. But, a [math]-computing protocol for $f$ requires communication complexity of $n(k-1)$ in order that all players can compute the function.

Finally, we give a proposition that relates the communication complexity of a $k$-party protocol $\pi$ to the entropy of the transcripts of the protocol $\pi$.

Proposition 2.4**.**

Let the input to a $k$-party protocol $\pi$ be distributed according to an arbitrary distribution. Then, $\sum_{i=1}^{k}H(\Pi_{i})\leq 4\cdot\mathsf{CC}(\pi)+4k^{2}$, where the entropy is according to the input distribution and the randomization of protocol $\pi$.

Proof.

We first encode $\Pi_{i}$, for any $i$, into a variable $\Pi_{i}^{\prime}$ such that the set of possible values of $\Pi_{i}^{\prime}$ is a prefix-free set of strings. Observe that the transcript $\Pi_{i}$ is composed of a number of basic transcripts: for every $j\in[\![1,k]\!]\setminus\{i\}$, a pair of transcripts of messages, $\Pi_{i,j}^{s}$, $\Pi_{i,j}^{r}$ containing the messages sent by player $i$ to player $j$, and the messages read by player $i$ from player $j$, respectively. We convert $\Pi_{i}$ into $\Pi_{i}^{\prime}$ as follows: In each one of the above $2(k-1)$ components we replace every bit $b\in\{0,1\}$ by $b.b$, and then add at the end of the component the two bits $01$. We then concatenate all components in order. Clearly this a one-to-one encoding, and the set of possible values of $\Pi_{i}^{\prime}$ is a prefix-free set of strings.

Defining ${|\Pi_{i}|=\sum\limits_{j\neq i}|\Pi_{i,j}^{s}|+|\Pi_{i,j}^{r}|}$ and ${|\Pi|=\sum\limits_{i=1}^{k}|\Pi_{i}|}$, we have ${H(\Pi_{i}^{\prime})=H(\Pi_{i})}$, and ${\operatorname*{\mathbb{E}}[|\Pi_{i}^{\prime}|]=2\operatorname*{\mathbb{E}}[|\Pi_{i}|]+4(k-1)}$.

We get

[TABLE]

where the last factor of $2$ is due to the fact that each message sent from, say, player $i$ to player $j$, may appear in at most $2$ basic transcripts $\Pi_{i,j}^{s}$ and $\Pi_{j,i}^{r}$. ∎

2.2 Comparison to other models

The somewhat restricted model (compared to the general asynchronous model) that we work with allows us to use information theoretic tools for the study of protocols in this model, and in particular to give lower bounds on the multi-party communication complexity. Notice that the general asynchronous model is problematic in this respect since one bit of communication can bring $\log k$ bits of information, because not only the content of the message, but also the identity of the sender may reveal information. Thus, information cannot be used as a lower bound on communication. In our case, the sets $S_{i}^{l,r}$ and $S_{i}^{l,s}$ are determined by the current view of the player, $\Pi$ contains only the content of the messages, and thus the desirable relation between the communication and the information is maintained. On the other hand, our restriction is natural, does not seem to be very restrictive (practically all protocols in the literature adhere to our model), and does not exclude the existence of private protocols. To exemplify why the general asynchronous model is problematic see Example 2.1.

While the model that we introduce in the preset paper bears some similarities to the model used in [31], there are a number of important differences between them. First, the definition of the transcript is different, resulting in a different relation between the entropy of the transcript and the communication complexity. More important is the natural property of the model in the present paper that the local program of a protocol in a given node ends its execution when it locally gives its output. It turns out that the very basic rectangularity property of protocols, used in many papers, holds in this case (and when the transcript is defied as we define in the present paper), while if the local protocol may continue to operate after output, there are examples where this property does not hold. Thus, we view the introduction of the present model also as a contribution towards identifying the necessary features of a peer-to-peer model so that basic and useful properties of protocols hold in the peer-to-peer setting.

There has been a long series of works about multi-party communication protocols in different variants of models, for example [21, 13, 27, 29, 41, 17, 18] (see [22] for a comparison of a few of these models). In the coordinator model (cf. [21, 41, 8]), an additional player (the coordinator) with no input can communicate privately with each player, and the players can only communicate with the coordinator. We first note that the coordinator model does not yield exact bounds for the multi-party communication complexity in the peer-to-peer setting (neither in our model nor in the most general one). Namely, any protocol in the peer-to-peer model can be transformed into a protocol in the coordinator model with an $O(\log k)$ multiplicative factor in the communication complexity, by sending each message to the coordinator with an $O(\log k)$-bit label indicating its destination. This factor is sometimes necessary, e.g., for the permutation functional defined as follows: Given a permutation $\sigma:[\![1,k]\!]\rightarrow[\![1,k]\!]$, each player $i$ has as input a bit $b_{i}$ and $\sigma^{-1}(\sigma(i)-1)$ and $\sigma^{-1}(\sigma(i)+1)$ (i.e., each player has as input the indexes of the players before and after itself in the permutation).555All additions are modulo $k$. This is a promise problem. For player $i$ the function $f_{i}$ is defined as $f_{i}=b_{\sigma^{-1}(\sigma(i)+1)}$ (i.e., the value of the input bit of the next player in the permutation $\sigma$). Clearly in our model the communication complexity of this function is $k$ (each player sends its input bit to the correct player), and the natural protocol is valid in our model. On the other hand, in the coordinator model $\Omega(k\log k)$ bits of communication are necessary. But this multiplicative factor between the complexities in the two models is not always necessary: the communication complexity of the parity function $\mathsf{Par}$ is $\Theta(k)$ both in the peer-to-peer model and in the coordinator model.

Moreover, when studying private protocols in the multi-party setting, the coordinator model does not offer any insight. In the coordinator model, described in [21] and used for instance in [8], if one does not impose any privacy requirement with respect to the coordinator, it is trivial to have a private protocol by all players sending their input to the coordinator, and the coordinator returning the results to the players. If there is a privacy requirement with respect to the coordinator, then if there is a random source shared by all the players (but not the coordinator), privacy is always possible using the protocol of [23]. If no such source exists, privacy is impossible in general. This follows from the results of Braverman et al. [8] who show a non-zero lower bound on the total internal information complexity of all parties (including the coordinator) for the function Disjointness in that model. Our model, on the other hand, does allow for the private computation of any function [5, 19, 1].

It is worthwhile to contrast our model, and the communication complexity measure that we are concerned with, with work in the so-call congested-clique model that has gained increasing attention in the distributed computation literature (cf. [34, 35]). While both models are based on a communication network in the form of a complete graph (i.e., every player can send messages to any other player, and these messages can be different) there are two significant differences between them. Most of the works in the congested clique model deal with graph-theoretic problems and the input to each player is related to the adjacency list of a node (identified with that player) in the input graph, while in our model the input is not associated in any way with the communication graph. More importantly, the congested clique model is a synchronous model while ours is an asynchronous one. This brings about a major difference between the complexity measures studied in each of the models. Work in the congested clique model is concerned with giving bounds on the number of rounds necessary to fulfill a certain task under the condition that in each round each player can send to any other player a limited number of bits (usually $O(\log k)$ bits). The measure of communication complexity, that is of interest to us in the present paper, deals with the total number of communication bits necessary to fulfill a certain task in an asynchronous setting without any notion of global rounds.666Any function can be computed in the congested clique model with $O(k)$ communication complexity (at a cost of having many rounds) by each player, having input $x$, sending a single bit to player $1$ only at round number $x$. On the other hand, in the asynchronous model any function can be computed in a single “round” (at a cost of high communication complexity) by each player sending its whole input to player $1$.

3 Tools for the study of multi-party communication protocols

In this section we consider two important tools for the study of peer-to-peer multi-party communication protocols. First, we define and introduce an information theoretic measure that we call Multi-party Information Cost (MIC); we later use it to prove our lower bounds. Then, we prove, in the peer-to-peer multi-party model that we define, the so-called rectangularity property of communication protocols, that we also use in our proofs.

3.1 Multi-party Information Cost

We now introduce an information theoretic measure for multi-party peer-to-peer protocols that we later show to be useful for proving lower bounds on the communication complexity of multi-party peer-to-peer protocols. We note that a somewhat similar measure was proposed in [8] for the coordinator model, but, to the best of our knowledge, never found an application as a tool in a proof of a lower bound.

Definition 3.1**.**

For any $k$-player protocol $\pi$ and any input distribution $\mu$, we define the multi-party information cost of $\pi$:

[TABLE]

Observe that the second part of each of the $k$ summands can be interpreted as the information that player $i$ “leaks” to the other players on its input. While the “usual” intuitive interpretation of two-party $\mathsf{IC}$ is “what Alice learns on Bob’s input plus what Bob learns on Alice’s input”, one can also interpret two-party $\mathsf{IC}$ as “what Alice learns on Bob’s input plus what Alice leaks on her input”. Thus, $\mathsf{MIC}$ can be interpreted as summing over all players $i$ of “what player $i$ learns on the other players’ inputs, plus what player $i$ leaks on its input.” Indeed, the expression defining $\mathsf{MIC}$ is equal to the sum, over all players $i$, of the two-party $\mathsf{IC}$ for the two-party protocol that results from collapsing all players, except $i$, into one virtual player. Thus, for number of players $k=2$, $\mathsf{MIC}=2\cdot\mathsf{IC}$. We note that defining our measure without the private randomness in the condition of the mutual information expressions would yield the exact same measure (as is the case for $2$-party $\mathsf{IC}$); we prefer however to define $\mathsf{MIC}$ with the randomness in the conditions, as we believe that it allows one to give shorter, but still clear and accurate, proofs.

On the other hand observe that the second of the two mutual information expressions has $X_{-i}$ in the condition, contrary to a seemingly similar measure used in [8] (Definition 3 in [8]). Our measure is thus “internal” in nature, while the one of [8] has an “external” component.

Further observe that the summation, over all players, of each one of the two mutual information expressions alone would not yield a measure useful for proving lower bounds on the communication complexity of functions. The first mutual information expression would yield a measure for functions that would never be higher than the entropy of the function at hand, due to the existence of private protocols for all functions [5, 19]. For the second mutual information expression there are functions for which that measure would be far too low compared to the communication complexity: e.g., the function $f=x_{1}$, $x\in\{0,1\}^{n}$ (i.e., the value of the function is the input of player $1$); in that case the measure would equal only $n$, while the communication complexity of that function is $\Omega(kn)$.

We now define the multi-party information complexity of a function.

Definition 3.2**.**

For any function $f$, any input distribution $\mu$, and any $0\leq\epsilon\leq 1$, we define the quantity

[TABLE]

Definition 3.3**.**

For any $f$, and any $0\leq\epsilon\leq 1$, we define the quantity

[TABLE]

We now claim that the multi-party information cost and the communication complexity of a protocol are related, as formalized by the following lemma.

Lemma 3.4**.**

For any $k$-player protocol $\pi$, and for any input distribution $\mu$,

[TABLE]

Proof.

[TABLE]

where the first inequality follows from Proposition A.2, and the last one from Proposition 2.4. ∎

We now show that the multi-party information cost satisfies a direct sum property for product distributions. In what follows, the notation $f^{\otimes n}$ denotes the task of computing $n$ instances of $f$, where the requirement from an $\epsilon$-computing protocol is that each instance is computed correctly with probability at least $1-\epsilon$ (as opposed to the stronger requirement that the whole vector of instances is computed correctly with probability at least $1-\epsilon$).

Theorem 3.5**.**

For any protocol $\pi$ $\epsilon$-computing a function $f^{\otimes n}$, and for any product distribution $\mu$ for the input, there exists a protocol $\pi^{\prime}$ $\epsilon$-computing $f$ such that,

[TABLE]

Proof.

We define $\pi^{\prime}$ on input $(Y_{i})_{i\in[\![1,k]\!]}$ as follows. We denote by $R^{\prime p}$ the public randomness available to the players, and by $R^{\prime}_{i}$ the private randomness available to the players.

We consider the public and private randomness $R^{\prime}_{i}$, $1\leq i\leq k$, and $R^{\prime p}$ as strings of random bits. The players first use the first bits of the public randomness to publicly sample a random index $L$ uniformly in $[\![1,n]\!]$, and define $X_{i}^{L}=Y_{i}$. The players then, using the next random bits of the public randomness, publicly sample, for every $d<L$, $X^{d}$ according to $\mu$. Each player $i$ then, using the first bits of its private randomness, samples privately, for every $d>L$, $X_{i}^{d}$ according to $\mu$. The players then run $\pi$ on input $X$. They output, as the output of $\pi^{\prime}$, the $L$’th coordinate of the output of $\pi$. Observe that $\pi^{\prime}$ has error at most $\epsilon$, and that if the input to $\pi^{\prime}$ is distributed according to $\mu$, then the input of $\pi$ is distributed according to $\mu^{n}$.

Note that there is no extra communication in $\pi^{\prime}$ compared to $\pi$, only some (private and public) sampling. Therefore we have $\Pi^{\prime}_{i}=\Pi_{i}$ for every $1\leq i\leq k$. We further denote by $R^{p}$ the random bits of $R^{\prime p}$ beyond those used by the public sampling at the start of $\pi^{\prime}$. Similarly, we denote by $R_{i}$, $1\leq i\leq k$, the random bits of $R^{\prime}_{i}$ beyond those used by the private sampling at the start of $\pi^{\prime}$.

We now show that $\mathsf{MIC}_{\mu}(\pi^{\prime})=\frac{1}{n}\mathsf{MIC}_{\mu^{n}}(\pi)$. In what follows we explicitly state the public randomness next to the transcript. Thus,

[TABLE]

We have, for every player $i$,

[TABLE]

and

[TABLE]

Summing over $i\in[\![1,k]\!]$ concludes the proof. ∎

3.2 The rectangularity property

Rectangularity. The rectangularity property (or Markov property) is one of the key properties that follow from the structure and definition of (some) protocols. For randomized protocols it was introduced in the two-party setting and in the multi-party blackboard model in [3], and in the coordinator model in [8]. We prove a similar rectangularity property in the peer-to-peer model that we consider in the present paper.

We note that the proof of this property in the peer-to-peer model makes explicit use of the specific properties of the model we defined: the proof that follows explicitly uses the definition of the transcript on an edge by edge basis as in our model, as well as the fact that a player returns and stops as one operation. One can build examples where if any of these two properties does not hold, then the rectangularity property of protools does not hold. Thus we view the following proof of rectangularity in our model also as an identification of model properties needed for the useful rectangularity property of multiparty peer-to-peer protocols to hold.

To define this property, for any transcript $\overline{\tau}\in\mathcal{T}_{i}$, let $\mathcal{A}_{i}(\overline{\tau})=\{(x,r)\mid\Pi_{i}(x,r)=\overline{\tau}\}$ (i.e., the set of input, randomness pairs that lead to transcript $\overline{\tau}$), and define the projection of $\mathcal{A}_{i}(\overline{\tau})$ on coordinate $i$ as

[TABLE]

and the projection of $\mathcal{A}_{i}(\overline{\tau})$ on the complement of coordinate $i$ as

[TABLE]

Similarly, for any transcript $\tau\in\mathcal{T}$, let $\mathcal{B}(\tau)=\{(x,r)\mid\Pi(x,r)=\tau)\}$, and for any player $i$, let $\mathcal{H}_{i}(\tau)=\{(x^{\prime},r^{\prime}),\exists~{}(x,r)\in\mathcal{B}(\tau),x^{\prime}=x_{-i}~{}\&~{}r^{\prime}=r_{-i}\}$.

We start by proving a combinatorial property of transcripts of communication protocols, which intuitively follows from the fact that each player has access to only its own input and private randomness. The proof of this property is technically more involved compared to the analogous property in other settings, since the structure of protocols and the manifestation of the transcripts in the peer-to-peer setting are more flexible than in the other settings.

Lemma 3.6**.**

Let $\pi$ be a $k$-player private-coins protocol 777Recall that a private-coins protocol does not have access to public randomness, but may have private randomness. with inputs from $\mathcal{X}=\mathcal{X}_{1}\times\cdots\times\mathcal{X}_{k}$. Let $\mathcal{T}$ denote the set of possible transcripts of $\pi$, and for $i\in[\![1,k]\!]$ let $\mathcal{T}_{i}$ denote the set of possible transcript observed by player $i$, so that $\mathcal{T}\subseteq\mathcal{T}_{1}\times\cdots\times\mathcal{T}_{k}$. Then, $\forall~{}i\in[\![1,k]\!]$:

• •

$\forall~{}\overline{\tau}\in\mathcal{T}_{i},~{}~{}\mathcal{A}_{i}(\overline{\tau})=\mathcal{I}_{i}(\overline{\tau})\times\mathcal{J}_{i}(\overline{\tau})$.

• •

$\forall~{}\tau\in\mathcal{T},~{}~{}\mathcal{B}(\tau)=\mathcal{I}_{i}(\tau_{i})\times\mathcal{H}_{i}(\tau)$.

Proof.

We start by proving the first claim. Since the other inclusion is immediate from the definition, we only need to show that

[TABLE]

To this end take an arbitrary $(x_{i},r_{i})\in\mathcal{I}_{i}(\overline{\tau})$ and an arbitrary $(x_{-i},r_{-i})\in\mathcal{J}_{i}(\overline{\tau})$. Since ${(x_{i},r_{i})\in\mathcal{I}_{i}(\overline{\tau})}$, we have that $\exists~{}(\tilde{x},\tilde{r})\in\mathcal{A}_{i}(\overline{\tau})$ s.t. $x_{i}=\tilde{x}_{i}~{}\&~{}r_{i}=\tilde{r}_{i}$. Similarly, since $(x_{-i},r_{-i})\in\mathcal{J}_{i}(\overline{\tau})$,

[TABLE]

Let $(x,r)$ be $((x_{i},r_{i}),(x_{-i},r_{-i}))\in\mathcal{I}_{i}(\overline{\tau})\times\mathcal{J}_{i}(\overline{\tau})$. We will now show that

[TABLE]

Let $L$ be the number of local rounds of player $i$ in the run of $\pi$ on input $(x,r)$. We will show by induction on the index of the local round of player $i$ that for any $\ell\leq L$, $\Pi_{i}^{\ell}(x,r)=\Pi_{i}^{\ell}(\tilde{x},\tilde{r})$. Observe that whether or not the protocol of a player stops and returns its output at a given round is a function of its input and its transcript until that round, as well as its private randomness. Therefore, since the protocol of player $i$ stops and returns its value at local round $L$ if the input is $(x,r)$, it will follow from $\Pi_{i}^{L}(x,r)=\Pi_{i}^{L}(\tilde{x},\tilde{r})$ that player $i$ stops and returns its output at local round $L$ also when the input is $(\tilde{x},\tilde{r})$. We will thus get that $\Pi_{i}(x,r)=\overline{\tau}$, and hence $(x,r)\in\mathcal{A}_{i}(\overline{\tau})$.

The base of the induction, for $\ell=0$, follows since the transcript is empty. We now prove the claim for $\ell+1\leq L$, based on the induction hypothesis that the claim holds for $\ell$.888Note that $\Pi_{i}(x,r)$ by itself does not define which messages are sent/read in which local round.

The messages that player $i$ sends at local round $\ell+1$ are a function of $x_{i}$, $r_{i}$ and $\Pi_{i}^{\ell}(x,r)$. As $x_{i}=\tilde{x}_{i}$ and $\tilde{r}_{i}=r_{i}$, and using the induction hypothesis, we get that the messages sent by player $i$ at local round $\ell+1$ are the same in $\pi_{i}(x,r)$ and in $\pi_{i}(\tilde{x},\tilde{r})$.

For the same reason we also get that the set of players from which player $i$ waits for a message at round $\ell+1$ is the same when $\pi$ is run on input in $(x,r)$ and on input $(\tilde{x},\tilde{r})$.

We now claim that the messages read by player $i$ at round $\ell+1$ are the same when $\pi$ is run on input $(x,r)$ and on input $(\tilde{x},\tilde{r})$. To this end we define an imaginary “protocol” $\psi$ where player $i$ sends in its first local round all the messages that it sends in $\overline{\tau}$, and the players in $Q_{i}=[\![1,k]\!]\setminus\{i\}$ run $\pi$.999Technically speaking, this is not a protocol according to our definition as more than one message may be sent in a single round on a single link. Player $i$ sends the messages on each link according to the order in $\overline{\tau}$.101010Recall that a transcript of a players is a $2(k-1)$-tuple of transcripts, one for each of its $2(k-1)$ directed links. The messages that the players in $Q_{i}$ send in each of their local rounds are a function of their inputs (and their local randomness) and the messages they read from the links that connect to player $i$. Since $\Pi(\hat{x},\hat{r})=\overline{\tau}$, we can conclude that in $\psi$ (when the input is $(\hat{x},\hat{r})$) the messages sent by the players in $Q_{i}$ (in particular, to player $i$) are the same as those sent in $\pi$ on input $(\hat{x},\hat{r})$.

Recall that we have proved above that when $\pi$ is run on $(x,r)$, the messages player $i$ sends up to round $\ell+1$ are consistent with $\overline{\tau}$. We therefore can consider now a “protocol” $\psi^{\prime}$ which is the same as $\psi$ with the only difference that player $i$ sends (in its first local round) only the messages of $\overline{\tau}$ it would have sent in $\pi(x,r)$ until (and including) round $\ell+1$ (and not all the message it sends in $\overline{\tau}$). It follows that in $\psi^{\prime}$, when run on input $(\hat{x},\hat{r})$, the sequences of messages sent from the players in $Q_{i}$ to $i$ are a prefix of the sequences they send in $\psi$. Since $x_{-i}=\hat{x}$ and $r_{-i}=\hat{r}$, the same claim holds when $\psi^{\prime}$ is run on $(x,r)$. Observe now that when $\pi$ is run on $(x,r)$, at the time where player $i$ is waiting at local round $\ell+1$ for incoming messages it, has sent exactly the messages that player $i$ sends in $\psi^{\prime}$.

Using the induction hypothesis $\Pi_{i}^{\ell}(x,r)=\Pi_{i}^{\ell}(\tilde{x},\tilde{r})$, the fact hat $x_{i}=\tilde{x}_{i}$ and $r_{i}=\tilde{r}_{i}$, and the fact that the set of players from which player $i$ waits for a message at local round $\ell+1$ is the same for input $(x,r)$ and $(\tilde{x},\tilde{r})$, we can conclude that the messages that player $i$ reads while waiting for messages at local round $\ell+1$ when $\pi$ is run on $(x,r)$ are consistent with the messages it would read when $\pi$ is run on $(\tilde{x},\tilde{r})$. Since player $i$ running $\pi$ must, by the definition of a protocol, reach its “return” statement, it must receive messages from all the players it is waiting for. We therefore conclude that the messages read by player $i$ in local round $\ell+1$ when $\pi$ is run on $(x,r)$ are the same as those it read when run on $(\tilde{x},\tilde{r})$.

Together with the induction hypothesis, and the fact (proved above) that the messages sent by player $i$ at local round $\ell+1$ are the same when $\pi$ is run on in $(x,r)$ and on $(\tilde{x},\tilde{r})$, we have that $\Pi_{i}^{\ell+1}(x,r)=\Pi_{i}^{\ell+1}(\tilde{x},\tilde{r})$.

We now prove the second claim. We only need to show that

[TABLE]

the other inclusion being immediate from the definitions, since $\mathcal{B}(\tau)\subseteq\mathcal{A}_{i}(\tau_{i})$.

Take an arbitrary $(x_{i},r_{i})\in\mathcal{I}_{i}(\tau_{i})$ and an arbitrary $(x_{-i},r_{-i})\in\mathcal{H}_{i}({\tau})$. Since $(x_{-i},r_{-i})\in\mathcal{H}_{i}({\tau})$, $\exists~{}(\hat{x},\hat{r})$ s.t. $\pi(\hat{x},\hat{r})=\tau$ and $x_{-i}=\hat{x}_{-i}$ and $r_{-i}=\hat{r}_{-i}$. Let $(x,r)=((x_{i},r_{i}),(x_{-i},r_{-i}))$. Since $\mathcal{B}(\tau)\subseteq\mathcal{A}(\tau_{i})$, we have $\mathcal{H}_{i}(\tau)\subseteq\mathcal{J}_{i}(\tau_{i})$. Thus, using the first claim,

[TABLE]

and $\Pi_{i}(x,r)=\tau_{i}$. It remains to show that $\forall~{}j\neq i,~{}\Pi_{j}(x,r)=\tau_{j}$.

Consider the two runs of protocol $\pi$ on the input $(x,r)$ and on the input $(\hat{x},\hat{r})$. We have that $\Pi(\hat{x},\hat{r})=\tau$, and that $\Pi_{i}(x,r)=\tau_{i}$. Since $~{}x_{-i}=\hat{x}_{-i}$ and $r_{-i}=\hat{r}_{-i}$, we have that also for all $j\neq i$ $\Pi_{j}({x},{r})=\Pi_{j}(\hat{x},\hat{r})=\tau_{j}$. It follows that $(x,r)\in\mathcal{B}(\tau)$ as needed.

∎

We now prove the rectangularity property of randomized protocols in the peer-to-peer setting. It follows from Lemma 3.6 and straightforward calculations. The full proof is given in the appendix.

Lemma 3.7**.**

Let $\pi$ be a $k$-player private-coins protocol with inputs from $\mathcal{X}=\mathcal{X}_{1}\times\cdots\times\mathcal{X}_{k}$. Let $\mathcal{T}$ denote the set of possible transcripts of $\pi$, and for $i\in[\![1,k]\!]$ let $\mathcal{T}_{i}$ denote the set of possible transcript observed by player $i$, so that $\mathcal{T}\subseteq\mathcal{T}_{1}\times\cdots\times\mathcal{T}_{k}$. Then for every $i\in[\![1,k]\!]$, there exist functions $q_{i}:\mathcal{X}_{i}\times\mathcal{T}_{i}\rightarrow[0,1]$, $q_{-i}:\mathcal{X}_{-i}\times\mathcal{T}_{i}\rightarrow[0,1]$ and $p_{-i}:\mathcal{X}_{-i}\times\mathcal{T}\rightarrow[0,1]$ such that

[TABLE]

and

[TABLE]

The following lemma formalizes the fact that the distribution of the transcript of a protocol that externally-computes a function $f$ must differ on two inputs with different values of $f$ (see also [3]). The proof is deferred to the appendix.

Lemma 3.8**.**

Let $f$ be a $k$-party function, and let $\pi$ be a protocol externally $\epsilon$-computing $f$. If $x$ and $y$ are two inputs such that $f(x)\neq f(y)$, then $h(\Pi(x),\Pi(y))\geq\frac{1-2\epsilon}{\sqrt{2}}$.

The Diagonal Lemma. The following lemma is often called the diagonal lemma. It was proved in [3] for the two-party setting under the name of the Pythagorean lemma, and in [8] for the coordinator model. We show here that is also holds in the peer-to-peer model. This lemma follows from Lemma 3.7 and Proposition A.12 in the same way that its two-party analogue follows from the analogous lemma and proposition. For completeness we give the proof in the appendix. For $x\in\{0,1\}^{k}$ and $b\in\{0,1\}$, let $x_{[i\leftarrow b]}$ represent the input obtained from $x$ by replacing the $i^{\text{th}}$ bit of $x$ by $b$.

Lemma 3.9**.**

Let $\pi$ be a $k$-party private-coins protocol taking input in $\{0,1\}^{k}$. Then ${\forall~{}x\in\{0,1\}^{k}}$, $\forall~{}y\in\{0,1\}^{k}$, $\forall~{}i\in[\![1,k]\!]$, $h^{2}(\Pi(x),\Pi(y))\geq\frac{1}{2}\left[h^{2}(\Pi(x),\Pi(y_{[i\leftarrow x_{i}]}))+h^{2}(\Pi(x_{[i\leftarrow y_{i}]}),\Pi(y))\right]$.

4 The function parity

We now prove a lower bound on the multi-party peer-to-peer randomized communication complexity of the $k$-party $n$-bit parity function $\mathsf{Par}_{k}^{n}$, defined as follows: each player $i$ receives $n$ bits $(x_{i}^{p})_{p\in[\![1,n]\!]}$ and player $1$ has to output the bitwise sum modulo $2$ of the inputs, i.e.,

[TABLE]

(the case where all $k$ players compute the function is trivial). To start, we prove a lower bound on the multi-party information complexity of the parity function, where each player has a single input bit. For simplicity we denote this function $\mathsf{Par}_{k}$, rather than $\mathsf{Par}_{k}^{1}$.

Theorem 4.1**.**

Let $\mu$ be the uniform distribution on $\{0,1\}^{k}$. Given any fixed $0\leq\epsilon<\frac{1}{2}$, for any protocol $\pi$ $\epsilon$-computing $\mathsf{Par}_{k}$, it holds that $\mathsf{MIC}_{\mu}(\pi)=\Omega(k)$.

Proof.

[TABLE]

∎

The next theorem follows immediately from Theorem 4.1 and Theorem 3.5.

Theorem 4.2**.**

Let $\mu$ be the uniform distribution on $\{0,1\}^{k}$. Given any fixed $0\leq\epsilon<\frac{1}{2}$, for any protocol $\pi$ $\epsilon$-computing $\mathsf{Par}^{n}_{k}$, it holds that $\mathsf{MIC}_{\mu^{n}}(\pi)=\Omega(kn)$.

We can now prove a lower bound on the communication complexity of $\mathsf{Par}^{n}_{k}$. Note that the lower bound for $\mathsf{Par}^{n}_{k}$ given in [31] is valid only for a restricted class of protocols, called “oblivious” in [31].

Theorem 4.3**.**

Given any fixed $0\leq\epsilon<\frac{1}{2}$, there is a constant $\alpha$ such that for $n\geq\frac{1}{\alpha}k$,

[TABLE]

Proof.

Let $\pi$ be a protocol $\epsilon$-computing $\mathsf{Par}_{k}^{n}$. By Lemma 3.4 and Theorem 4.2, there exists a constant $\beta$ such that ${\mathsf{CC}(\pi)\geq\beta kn-k^{2}}$. Let $\alpha<\beta$ be a constant. For $n\geq\frac{1}{\alpha}k$, we have $k^{2}\leq\alpha kn$ and we get $\mathsf{CC}(\pi)\geq(\beta-\alpha)kn=\Omega(kn)$.

∎

5 The function $\mathsf{AND}$

In this section we consider an arbitrary $k$-party protocol, $\pi$, where each player has an input bit $x_{i}$, and where $\pi$ has to compute the $\mathsf{AND}$ of all the input bits. We prove a lower bound on a certain information theoretic measure (that we define below) for $\pi$. The proof makes use of a certain input distribution that we will define below. In the proof we use the following notations. Denote by $\overline{1}^{t}$ the all-$1$ bit-vector of length $t$. Denote by $\overline{e}^{t}_{a_{1},\dots,a_{d}}$ the vector obtained from $\overline{1}^{t}$ by changing the bit $1$ into the bit [math] at indexes $a_{1},\dots,a_{d}$. To simplify notations, we sometimes omit the superscript $t$ when $t=k$, and write $\overline{e}_{a_{1},\dots,a_{d}}$ or $\overline{1}$. We further use in the sequel the notation $\delta_{a,b}$ for the Kronecker delta, i.e., $\delta_{a,b}=1$ if $a=b$ and [math] otherwise.

Input distribution. Consider the distribution $\mu$ defined as follows. Draw a bit $M\sim\text{{Ber}}(\frac{2}{3},\frac{1}{3})$, and a uniformly random index $Z\in[\![1,k]\!]$. Assign [math] to $X_{Z}$. If $M=0$, sample $X_{-Z}$ uniformly in $\{0,1\}^{k-1}$; if $M=1$, assign $1^{k-1}$ to $X_{-Z}$. We will also work with the product distribution $\mu^{n}$. Our distribution is similar to the ones of [8, 15] in that it leads to a high information cost (or similar measures) for the function $\mathsf{AND}_{k}$. The distribution that we use has the property that the AND of any input in the support of $\mu$ is [math]. This allows us to prove lower bounds for the Disjointness function without the constraint that $k=\Omega(\log n)$ which was necessary in [8] (but not in [15]).

Given a protocol $\pi$, let $\Pi_{i}[x_{i},m,z]$ denote the distribution of $\Pi_{i}$, when the input $X$ is sampled as follows: $X\sim\mu$, conditioned on the fact that $X_{i}=x_{i}$, $M=m$ and $Z=z$.

5.1 Basic properties

We first prove a number of basic properties of $\pi$, under the input distribution $\mu$. The proofs make use of the general properties of protocols, proved in Section 3.2.

Rectangularity. We first prove the following lemma, which is an application of Lemma 3.7 to the specific case of the distribution $\mu$ that we defined above. Its proof is given in the appendix.

Lemma 5.1**.**

Let $\pi$ be a private-coins protocol. Let $\mathcal{T}$ denote the set of possible transcripts of $\pi$, and for $i\in[\![1,k]\!]$ let $\mathcal{T}_{i}$ denote the set of possible transcript of by player $i$ so that $\mathcal{T}\subseteq\mathcal{T}_{1}\times\cdots\times\mathcal{T}_{k}$. Then there exists a function $c:\{0,1\}\times[\![1,k]\!]\times\mathcal{T}\rightarrow[0,1]$, and for every $i\in[\![1,k]\!]$ there is a function $c_{i}:\{0,1\}\times[\![1,k]\!]\times\mathcal{T}_{i}\rightarrow[0,1]$, such that $\forall~{}i\in[\![1,k]\!]$, $\forall~{}x^{\prime}\in\{0,1\}$, $\forall~{}m\in\{0,1\}$, $\forall~{}z\in[\![1,k]\!]\setminus\{i\}$, $\forall~{}\tau=(\tau_{1},\dots,\tau_{k})\in\mathcal{T}$,

[TABLE]

and

[TABLE]

Diagonal lemma. The following lemma is a version of Lemma 3.9 adapted to our distribution. Its proof is given in the appendix.

Lemma 5.2**.**

Let $\pi$ be a private-coins protocol. For any $i,j\in[\![1,k]\!]$ with $i\neq j$, we have $h^{2}(\Pi_{i}[0,0,j],\Pi_{i}[1,1,j])\geq\frac{1}{2}h^{2}(\Pi_{i}(\overline{e}_{i,j}),\Pi_{i}(\overline{e}_{j}))$.

Localization. The following lemma formalizes the fact that if changing the input of a player changes the transcript of the protocol, then this change necessarily appears in the partial transcript of that player. For randomized protocols this change is observed and quantified by the Hellinger distance between the distributions of the transcripts. The proof is given in the appendix.

Lemma 5.3**.**

Let $\pi$ be a private-coins protocol. $\forall i\in[\![1,k]\!],~{}\forall j\in[\![1,k]\!]\setminus\{i\}$,

[TABLE]

5.2 Switched multi-party information cost of $\mathsf{AND}_{k}$

We propose the following definition, which is an adaptation of the switched information cost of [8]. We call it Switched Multi-party Information Cost ($\mathsf{SMIC}$).

Definition 5.4**.**

For a $k$-player protocol $\pi$ with inputs drawn from $\mu^{n}$ let

[TABLE]

Note that the notion of $\mathsf{SMIC}$ is only defined with respect to the distribution $\mu^{n}$ that we defined, and we may thus omit the distribution from the notation. We note that in order to simplify the expressions we often consider the public randomness as implicit in the information theoretic expressions we use below. It can be materialized either as part of the transcript or in the conditioning of the information theoretic expressions.

We can now prove the main result of this section.

Theorem 5.5**.**

For any fixed $0\leq\epsilon<\frac{1}{2}$, for any protocol $\pi$ externally $\epsilon$-computing $\mathsf{AND}_{k}$,

[TABLE]

Proof.

We prove below the claim for an arbitrary private-coins protocol $\pi$. The claim for general protocols (i.e., with public randomness) then follows from averaging over all possible assignments to the public randomness.

Observe that by the definition of $\mu$, for any $i\in[\![1,k]\!]$, if $M=0$ and $Z=z\neq i$, then $X_{i}\sim\text{{Ber}}(\frac{1}{2},\frac{1}{2})$. We therefore get by Lemma A.13 that

[TABLE]

Similarly, by the definition of $\mu$ we have that for any $i\in[\![1,k]\!]$, if $X_{i}=1$ and $Z=z\neq i$, then $M\sim\text{{Ber}}(\frac{1}{2},\frac{1}{2})$, and we get by Lemma A.13 that

[TABLE]

Let us now define $\mathsf{SMIC}_{i}(\pi)=I(X_{i};\Pi_{i}\mid MZ)+I(M;\Pi_{i}\mid X_{i}Z)$, so that $\mathsf{SMIC}(\pi)=\sum\limits_{i=1}^{k}\mathsf{SMIC}_{i}(\pi)$. We get

[TABLE]

By the definition of $\mu$, $\Pr[M=0\mid Z=z]=\frac{2}{3}$ for any $z$. Also, for any $i\neq z$,

[TABLE]

Thus, using Inequalities (1) and (2), we have

[TABLE]

We have

[TABLE]

∎

6 The function Disjointness

In the $k$ players $n$-bit disjointness function $\mathsf{Disj}_{k}^{n}$, every player $i\in[\![1,k]\!]$ has an $n$-bit string $(x_{i}^{\ell})_{\ell\in[\![1,n]\!]}$, and the players have to output $1$ if and only if there exists a coordinate $\ell$ where all players have the bit $1$. Formally, $\mathsf{Disj}_{k}^{n}(x)=\bigvee_{\ell=1}^{n}\bigwedge_{i=1}^{k}x_{i}^{\ell}$.

6.1 Switched multi-party information cost of $\mathsf{Disj}_{k}^{n}$

We first prove a direct-sum-type property which allows us to make the link between the functions $\mathsf{AND}_{k}$ and $\mathsf{Disj}_{k}^{n}$. A similar property was proved in [8] in the coordinator model; our peer-to-peer model requires a different, more involved, construction, since we do not have the coordinator, and moreover no player can act as the coordinator since it would get too much information. Since $\mathsf{Disj}_{k}^{n}$ is the disjunction of $n$ $\mathsf{AND}_{k}$ functions, we analyze the switched multi-party information cost of $\mathsf{Disj}_{k}^{n}$ using the distribution $\mu^{n}$.

Lemma 6.1**.**

Let $k>3$. For any protocol $\pi$ externally $\epsilon$-computing $\mathsf{Disj}_{k}^{n}$, there exists a protocol $\pi^{\prime}$ externally $\epsilon$-computing $\mathsf{AND}_{k}$ such that

[TABLE]

Proof.

Based on an arbitrary protocol $\pi$ for $\mathsf{Disj}_{k}^{n}$, we define a protocol $\pi^{\prime}$ for $\mathsf{AND}_{k}$, and then analyze $\mathsf{SMIC}_{\mu^{n}}(\pi)$ and $\mathsf{SMIC}_{\mu}(\pi^{\prime})$. Let $u\in\{0,1\}^{k}$ be the input to $\pi^{\prime}$ such that $u_{i}$ is given to player $i$. We note that we cannot use a protocol similar to the one used in [8] since in the peer-to-peer setting one does not have a coordinator that can sample the inputs for the player. We thus need to sample the inputs in a distributed way, while keeping the information complexity under control using classic secret sharing techniques. The protocol $\pi^{\prime}$ is defined as follows.

The players first sample publicly an index $L$ uniformly in $[\![1,n]\!]$, and then sample publicly $Z^{t}$, for ${t\in[\![1,n]\!]\setminus\{L\}}$, independently and uniformly in $[\![1,k]\!]$. 2. 2.

They then proceed to sample $M^{t}$, for ${t\in[\![1,n]\!]\setminus\{L\}}$, as follows. The set of players is partitioned into two subsets, $\{1,2\}$ and $\{3,\dots,k\}$. Player $1$ samples $M^{1}\dots M^{L-1}$ and sends the sampled values to player $2$ (player $3$ samples $M^{L+1}\dots M^{n}$, see below). 3. 3.

Then Player $1$ samples $X_{1}^{1}\dots X_{1}^{L-1}$ according to the distribution $\mu$, and player $2$ samples $X_{2}^{1}\dots X_{2}^{L-1}$, according to the distribution $\mu$. Observe that they can do this as they know $M^{1},\dots,M^{L-1},Z^{1},\dots,Z^{L-1}$. 4. 4.

Players $1$ and $2$ then apply the following procedure to communicate $X_{j}^{t}$ to player $j$, for $j>2$ and $t<L$: Player $1$ sends a bit $p_{j}^{t}$ to player $j$, and sends a bit $v_{j}^{t}$ to player $2$. Player $2$ then sends a bit $q_{j}^{t}$ to player $j$. Player $j$ then defines $X_{j}^{t}=p_{j}^{t}\oplus q_{j}^{t}$. The bits $p_{j}^{t}$, $q_{j}^{t}$ and $v_{j}^{t}$ are generated in the following way.

• •

If $Z^{t}=j$ player $1$ privately samples a random bit $v_{j}^{t}$. It then sets $p_{j}^{t}=v_{j}^{t}$. Player $2$ sets $q_{j}^{t}=v_{j}^{t}$. Player $j$ thus defines $X_{j}^{t}=0$.

• •

If $Z^{t}\neq j$ and $M^{t}=0$, player $1$ privately samples two independent random bits $p_{j}^{t}$ and $v_{j}^{t}$. Player $2$ privately samples a random bit $q_{j}^{t}$. The bit $X_{j}^{t}$ defined by player $j$ is in this case a uniform random bit. Note that it is not necessary for the correctness of the protocol that bit $v_{j}^{t}$ is sent to Player 2 in this case; it is sent here only to make our notations simpler.

• •

If $Z^{t}\neq j$ and $M^{t}=1$, player $1$ privately samples a random bit $v_{j}^{t}$. It then sets $p_{j}^{t}=v_{j}^{t}$. Player $2$ defines $q_{j}^{t}=v_{j}^{t}\oplus 1$. Player $j$ thus defines $X_{j}^{t}=1$. 5. 5.

Player $3$ samples $M^{L+1}\dots M^{n}$ and sends the sampled values to players $4$ to $k$. Every player $i\geq 3$ privately samples $X_{i}^{L+1}\dots X_{i}^{n}$. 6. 6.

Players $3$ and $4$ then apply the same procedure as players $1$ and $2$, in order to communicate $X_{j}^{t}$ to player $j$, for $j\leq 2$ and $t>L$. We denote by $p_{1}^{t}$ and by $p_{2}^{t}$ the bits sent by player $3$ to player $1$ and to player $2$, respectively; by $q_{1}^{t}$ and by $q_{2}^{t}$ the bits sent by player $4$ to player $1$ and to player $2$, respectively; and by $v_{1}^{t}$ and by $v_{2}^{t}$ the bits sent by player $3$ to player $4$. 7. 7.

Now all the players run protocol $\pi$, on the input composed of (1) the values defined above for $x_{i}^{t}$, $i\in[\![1,k]\!]$, $t\in[\![1,n]\!]\setminus\{L\}$ , and (2) $x_{i}^{L}=u_{i}$, for $i\in[\![1,k]\!]$. 8. 8.

The output of the protocol $\pi^{\prime}$ is the output of the protocol $\pi$. Observe that one can define the function needed as in the definition of an externally $\epsilon$-computing protocol, since the transcript of $\pi^{\prime}$ is composed of a fixed-length initial portion and then the transcript of $\pi$.

First observe that if $\pi$ computes $\mathsf{Disj}_{k}^{n}$ with error $\epsilon$, then $\pi^{\prime}$ computes $\mathsf{AND}_{k}$ with error $\epsilon$, and this is regardless of the values of the random bits used in the construction of the input to $\pi$ (this property of the distribution of the input to $\pi$ is called collapsing on coordinate $L$ in, e.g.,  [8]).

Now observe that if the input to protocol $\pi^{\prime}$, denote it $U$, is distributed according to $\mu$ (as defined above) then the definition of $\pi^{\prime}$ guarantees that the input to protocol $\pi$, $X$, is distributed according to $\mu^{n}$. Using the notation we use for $\mu$ we can write that if $(U,N,S)\sim\mu$ then $(X,M,Z)\sim\mu^{n}$.

We now give an upper bound on $\mathsf{SMIC}_{\mu}(\pi^{\prime})$ in terms of $\mathsf{SMIC}_{\mu^{n}}(\pi)$. To this end we first express the transcripts of protocol $\pi^{\prime}$, $\Pi^{\prime}_{i}$, $1\leq i\leq k$, in terms of the transcripts $(\Pi_{i})$ of the protocol $\pi$, run in Step 7.

Let us take player $2$ and express $\Pi^{\prime}_{2}$ as a function of $\Pi_{2}$. Taking into account the preliminary sampling procedure of protocol $\pi^{\prime}$, we can write $\Pi^{\prime}_{2}$ in four parts.

The values which are a function of the public randomness used by $\pi^{\prime}$: $L,Z^{-L}$ (for simplicity we include the sampled values and not the random bits). 2. 2.

• •

Read by player $2$ (and sent by player $1$), $M^{<L}$.

• •

Read by player $2$ (and sent by player $1$), all the $v_{j}^{t}$ for $j>2,t<L$ (denoted below as $v_{>2}^{<L}$).

• •

Sent by player $2$, all the $q_{j}^{t}$, for $j>2,t<L$ (denoted below as $q_{>2}^{<L}$). 3. 3.

Player $2$ also receives $p_{2}^{L+1}\dots p_{2}^{n},q_{2}^{L+1}\dots q_{2}^{n}$ from players $3$ and $4$ (denoted below as $p_{2}^{>L}$ and $q_{2}^{>L}$). 4. 4.

The last part is the transcript of player $2$ when running $\pi$.

Thus, the transcript $\Pi^{\prime}_{2}$ can be written as $LZ^{-L}M^{<L}v_{>2}^{<L}q_{>2}^{<L}p_{2}^{>L}q_{2}^{>L}\Pi_{2}$. However, in the manipulations of $\mathsf{SMIC}$ we can write $\Pi^{\prime}_{2}$ also as $Z^{-L}M^{<L}X_{2}^{>L}\Pi_{2}$. This is because

[TABLE]

where the second equality follows from the fact that the distribution of $p_{2}^{t}q_{2}^{t}$, for all $t>L$, is uniform for $p_{2}^{t}\oplus q_{2}^{t}=x_{2}^{t}$ and independent of $U_{2}$ (resp., of N), conditioned on $X_{2}^{>L}$, the rest of the transcript $\Pi^{\prime}_{2}$, and $S$ (resp., $U_{2}$); the third equality follows from the chain rule; and the last equality follows from the fact that $I(U_{2};Lv_{>2}^{<L}q_{>2}^{<L}\mid NSZ^{-L}M^{<L}X_{2}^{>L}\Pi_{2})=0$ and ${I(N;Lv_{>2}^{<L}q_{>2}^{<L}\mid U_{2}SZ^{-L}M^{<L}X_{2}^{>L}\Pi_{2})=0}$. These last two equations follow from the fact that $Lv_{>2}^{<L}q_{>2}^{<L}$ is independent of $U_{2}$ (resp., of $N$), even conditioned on $SZ^{-L}M^{<L}X_{2}^{>L}\Pi_{2}$ and on $N$ (resp., on $U_{2}$).

By similar argument we can write, in the manipulations of $\mathsf{SMIC}$, $\Pi^{\prime}_{1}$ as $Z^{-L}M^{<L}X_{1}^{>L}\Pi_{1}$, and for $i\geq 3$, $\Pi^{\prime}_{i}$ as $Z^{-L}M^{>L}X_{i}^{<L}\Pi_{i}$.

We have

[TABLE]

Now, applying Lemma A.9, we have that for any $\ell$

[TABLE]

Thus

[TABLE]

∎

Coupled with the lower bound on $\mathsf{SMIC}(\pi^{\prime})$ for any protocol $\pi^{\prime}$ that computes $\mathsf{AND}_{k}$ (Section 5), the above lemma gives us a lower bound on $\mathsf{SMIC}(\pi)$ for any protocol that computes the function $\mathsf{Disj}_{k}^{n}\,$:

Theorem 6.2**.**

Let $k>3$. Given any fixed $0\leq\epsilon<\frac{1}{2}$, for any protocol $\pi$ externally $\epsilon$-computing $\mathsf{Disj}_{k}^{n}$ it holds that

[TABLE]

6.2 Multi-party information complexity and communication complexity of $\mathsf{Disj}_{k}^{n}$

We now prove a lemma that will allow us to obtain a lower bound on the multi-party peer-to-peer communication complexity of the disjointness function.

Lemma 6.3**.**

For any $k$-player protocol $\pi$, $\mathsf{SMIC}_{\mu^{n}}(\pi)\leq\mathsf{MIC}_{\mu^{n}}(\pi)$.

Proof.

We first prove that

[TABLE]

[TABLE]

We now prove that

[TABLE]

Since by the definition of $\mu$ $I(X_{i};X_{-i}R_{-i}\mid MZ)=0$, we get by Lemma A.9 that

[TABLE]

and

[TABLE]

Thus we have

[TABLE]

Summing over $i\in[\![1,k]\!]$ concludes the proof. ∎

The next theorem follows immediately from Theorem 6.2 and Lemma 6.3.

Theorem 6.4**.**

Let $k>3$. Given any fixed $0\leq\epsilon<\frac{1}{2}$, for any protocol $\pi$ externally $\epsilon$-computing $\mathsf{Disj}_{k}^{n}$, it holds that

[TABLE]

We now conclude with a lower bound on the randomized communication complexity of the disjointness function.

Theorem 6.5**.**

Given any fixed $0\leq\epsilon<\frac{1}{2}$, there is a constant $\alpha$ such that for $n\geq\frac{1}{\alpha}k$,

[TABLE]

Proof.

For $k=3$ the theorem follows from the fact that $\mathsf{CC}^{\epsilon}(\mathsf{Disj}_{3}^{n})\geq\mathsf{CC}^{\epsilon}(\mathsf{Disj}_{2}^{n})$ (simply by letting Alice simulate internally a third player with an all-$1$ input), and from $\mathsf{CC}^{\epsilon}(\mathsf{Disj}_{2}^{n})=\Omega(n)$ (cf. [16]).

Assume now that $k>3$. Let $\pi$ be a protocol $\epsilon$-computing $\mathsf{Disj}_{k}^{n}$. We first convert $\pi$ into a protocol $\pi^{\prime}$ which externally $\epsilon$-computes $\mathsf{Disj}_{k}^{n}$. The protocol $\pi^{\prime}$ is defined as follows. For every bit $b$ sent by a player in $\pi$, the same player sends in $\pi^{\prime}$ two bits $b.b$. In addition, in $\pi^{\prime}$, when player $1$ stops and returns its output, it sends to player $2$ the message $b.(1-b)$, where $b$ is the output it computed.

Since in $\pi$ player $1$ $\epsilon$-computes the function $\mathsf{Disj}_{k}^{n}$, $\pi^{\prime}$ externally $\epsilon$-computes $\mathsf{Disj}_{k}^{n}$. Observe that $\mathsf{CC}(\pi^{\prime})=2\cdot\mathsf{CC}(\pi)+2$.

By Lemma 3.4 and Theorem 6.4, there exists a constant $\beta$ such that $\mathsf{CC}(\pi^{\prime})\geq\beta kn-k^{2}$. Let $\alpha<\beta$ be a constant. For $n\geq\frac{1}{\alpha}k$, we have $k^{2}\leq\alpha kn$ and we get $\mathsf{CC}(\pi^{\prime})\geq(\beta-\alpha)kn=\Omega(kn)$, and $\mathsf{CC}(\pi)=\Omega(kn)$.

∎

We note that our tight lower bound holds also for protocols where only one player is required to output the value of the function.

7 Randomness complexity of private protocols

In this section we give a lower bound of $\Omega(n)$ on the (information theoretic private computation) randomness complexity of the function $\mathsf{Disj}_{k}^{n}$, i.e., we prove that in order to privately compute $\mathsf{Disj}_{k}^{n}$ one needs $\Omega(n)$ random bits. The significance of this result lies in that it is the first such lower bound that grows with the size of the input, which is $kn$, while the output remains a single bit.

7.1 Private protocols and randomness

A protocol $\pi$ is said to privately compute a given function if, at the end of the execution of the protocol, the players have learned nothing but the value of that function. We note that the literature devoted to private computation usually focuses on [math]-error protocols, and therefore, in the rest of this section, we will restrict ourselves to the case of [math]-error protocols.

Furthermore, the literature on private computation is focused on synchronous protocols. In what follows we therefore only consider protocols in that setting. In the synchronous setting, protocols advance according to a global round structure. At every round, each player sends a message to every other player. In addition, each player has an output tape. In order to ensure that no player is ever engaged in an infinite computation process, it is required that on any input and randomness assignment, every player eventually stops sending messages. That is, for a synchronous protocol $\pi$ let $t_{i}(x,r)$ be the smallest integer such that if $\pi$ is run on $(x,r)$ then player $i$ does not send any message and does not write on its output tape after round $t_{i}(x,r)$. If no such integer exists then $t_{i}(x,r)=\infty$. The requirement is that for every player $i$, input $x$, and randomness assignment $r$ $t_{i}(x,r)<\infty$.

The following lemma, which is a consequence of König’s lemma (cf. [32]), applies to any synchronous protocol.

Lemma 7.1**.**

Let $\pi$ be a synchronous protocol. If for any $i$, $x$, and $r$, $t_{i}(x,r)<\infty$, then there exists an integer $t_{f}$ such that for any $i$, $x$, and $r$, $t_{i}(x,r)<t_{f}$.

Based on the above lemma one can transform any synchronous protocol into a protocol that always runs in a fixed number of rounds, and where all players output at the protocol’s end. This is done by simply delaying the output until round $t_{f}$. Observe that such transformation does not change the transcript of the protocol or any other measure such as the number of random bits used.

We can now formally define privacy:

Definition 7.2**.**

A $k$-player protocol $\pi$ computing a function $f$ is private111111In this paper we consider only the setting of $1$-privacy, which we call here for simplicity, privacy. if for every player $i\in[\![1,k]\!]$, for all pairs of inputs $x=(x_{1},\dots,x_{k})$ and $x^{\prime}=(x^{\prime}_{1},\dots,x^{\prime}_{k})$, such that ${f(x)=f(x^{\prime})}$ and $x_{i}=x^{\prime}_{i}$, for all possible private random assignments $r_{i}$ of player $i$, and all possible public random assignments $r^{p}$, it holds that for any transcript $T$

[TABLE]

where the probability is over the randomness $R_{-i}$, and where $\Pi_{i}$ is the sequence of all messages sent to player $i$.

It is well known that in the multi-party case, i.e., when we have $k\geq 3$ players, any function can be computed privately in the peer-to-peer model [5, 19]. Private protocols require the players to make use of their private randomness. The minimal amount of private randomness needed to design a private protocol for a given function is referred to as the randomness complexity of that function. While in the present paper we make use of the notion of entropy, many papers on randomness in private protocols make use of the notion of the number of random bits in order to measure “the amount of randomness used”. We repeat here the definitions used in those papers.

Definition 7.3**.**

A communication protocol is said to be $d$-random if, on any run, the total number of private random bits used by all the players is at most $d$.

Definition 7.4**.**

The randomness complexity $\mathcal{R}(f)$ of a function $f$ is the minimal integer $d$ such that there exists a $d$-random private protocol computing $f$.

We will also use the following two (finer) notions which in fact make use of the notion of entropy.

Definition 7.5**.**

The randomness complexity of a protocol $\pi$ on input distribution $\eta$ is defined as

[TABLE]

Definition 7.6**.**

The randomness complexity of a function $f$ on input distribution $\eta$ is defined as

[TABLE]

Once the input and the public coins are fixed, the entropy of the transcript of a protocol comes solely from the private randomness. Thus, for any input distribution $\eta$, $\mathcal{R}_{\eta}(\pi)$ provides a lower bound on the entropy of the private randomness used by all the players in the protocol $\pi$. In order to relate our results (which are stated in terms of entropy) to the notions previously used in the literature on the analysis of randomness in private protocols, we use the fact that, up to constant factors, the number of (uniform) random bits necessary for the generation of a random variable with a given entropy is equal to that entropy (cf. [33]). The following lemma is then immediate.

Lemma 7.7**.**

Let $d$ be an integer. If there exists an input distribution $\eta$ such that $\mathcal{R}_{\eta}(f)>d$, then $\mathcal{R}(f)>d$.

This means that in order to give a lower bound on the randomness complexity of a function $f$, we can find an input distribution $\eta$ such that the randomness complexity of a function $f$ on $\eta$ is high. Since we are interested here in characterizing the randomness used in private protocols, in the rest of this section, when we use information terms such as $\mathsf{SMIC}$, we will make the randomness appear explicitly in the conditioning.

To make private protocols formally fit into our model (Section 2.1), we further technically modify them such that whenever a player does not send a message, it sends instead a special message indicating “empty message”. Such protocols formally fit in our model and satisfy several additional properties. We call such protocols proper synchronous protocols as defined below.

Definition 7.8**.**

We say that a protocol as defined in Section 2.1 is proper synchronous if there is an integer $t_{f}$ such that for every player $i$, every input $x$, and every random assignment $r$ it holds that

• •

In every (local) round $t<t_{f}$ player $i$ sends messages to all other players, and reads messages from all other players.

• •

Player $i$ stops at (local) round $t_{f}$.

Observe that the above transformation from a synchronous protocol to a proper synchronous protocol preserves privacy (if the original protocol was private), and the number of random bits used by the protocol does not change. We therefore prove below our lower bound for (private) proper synchronous protocols.

7.2 Public information cost

The notion of public information cost was introduced in [31].

Definition 7.9**.**

For any $k$-player protocol $\pi$ and any input distribution $\eta$, we define the public information cost of $\pi$:

[TABLE]

Note that this definition of $\mathsf{PIC}_{\eta}(\pi)$ slightly differs from the one given in [31], as the “transcript” $\Pi_{i}$ is defined in the present paper in a different way compared to the way it is defined in [31]. However, since we work in this section in the setting of proper synchronous protocols, the two definitions of a “transcript” are completely equivalent in terms of information, and thus the definition of $\mathsf{PIC}_{\eta}(\pi)$ in the present paper is equivalent to the one of [31].121212In fact, they would be equivalent even if we were not restricting ourselves to proper synchronous protocols. This is because of the appearance of $X_{i},R_{i}$ in the conditioning.

Definition 7.10**.**

For any function $f$ and any input distribution $\eta$, the zero-error public information cost of $f$ is

[TABLE]

where the infimum is taken over all protocols $\pi$ which compute $f$ with [math] error.

It was shown [31] that the public information cost can be used to prove randomness complexity lower bounds via the following theorem.

Theorem 7.11** ([31]).**

For any function of $k$ variables $f$, for any input distribution $\eta$,

[TABLE]

We will need the following property of the public information cost.

Theorem 7.12** ([31]).**

For any function $f$ and input distribution $\eta$,

[TABLE]

7.3 Randomness complexity of Disjointness

We will prove that the switched multi-party information cost gives a lower bound on the public information cost. Let $\mu$ be the input distribution for the function $\mathsf{AND}_{k}$ defined in Section 5.

Theorem 7.13**.**

For any public-coins proper synchronous $k$-player protocol $\pi$, where the players have $n$-bits inputs $X$ from $(X,M,Z)\sim\mu^{n}$, it holds that

[TABLE]

We start with a number of notations. Recall that we consider a proper synchronous protocol $\pi$. We denote by (\IfEqCase{s}{{r}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell}}{s}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell}}}[]\,)_{\ell\geq 0} the sequence of messages sent by player $i$ in the protocol $\pi$, ordered by local round of player $i$, and within each round ordered by the index of the recipient player. Further denote by $j(i,\ell)$ the player to which message \IfEqCase{s}{{r}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}l}}{s}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}l}}}[] is sent. Similarly, we denote by (\IfEqCase{r}{{r}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell}}{s}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell}}}[]\,)_{\ell\geq 0} the sequence of messages received by player $i$, ordered in the same way. Observe that since $\pi$ is proper synchronous there exists a function $\ell^{\prime}(i,\ell)$, for $1\leq i\leq k$, $\ell\geq 0$, such that \IfEqCase{s}{{r}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell}}{s}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell}}}[] and \IfEqCase{r}{{r}{T_{j(i,\ell)}^{\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell^{\prime}(i,\ell)}}{s}{T_{j(i,\ell)}^{\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell^{\prime}(i,\ell)}}}[] denote the same message.131313 $j(i,\ell)=(\ell\mod k)+1$; $\ell^{\prime}(i,\ell)=k\cdot\lfloor\frac{\ell+1}{k}\rfloor+(\ell\mod k)$. Further, for any $\ell_{0}\geq 0$, let \IfEqCase{s}{{r}{T_{i}^{<\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell_{0}}}{s}{T_{i}^{<\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell_{0}}}}[] be the random variable representing the so-far history, i.e., all the messages sent by player $i$ and all the messages received by player $i$ until player $i$ sends message \IfEqCase{s}{{r}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell_{0}}}{s}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell_{0}}}}[] (for the same local round we define the order by the identity of the player sending or receiving the message). In a similar way, define \IfEqCase{r}{{r}{T_{i}^{<\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell_{0}}}{s}{T_{i}^{<\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell_{0}}}}[] to be the random variable representing the messages sent by player $i$ and the messages received by player $i$ until it receives message \IfEqCase{r}{{r}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell_{0}}}{s}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell_{0}}}}[]. Further, we denote by $\overleftarrow{{}_{~{}}\Pi_{i}}$ the partial transcript of player $i$ composed only of the incoming messages. I.e., $\overleftarrow{{}_{~{}}\Pi_{i}}$ is the $(k-1)$-tuple $(\Pi_{i,j}^{r})_{j\neq i}$.

Before giving the actual proof of Theorem 7.13 we define two information theoretic measures, which we will use as intermediate quantities in that proof. These measures are defined only with respect to the input distribution $\mu^{n}$, and thus we do not indicate the distribution in the notation of these measures.

Definition 7.14**.**

[TABLE]

Definition 7.15**.**

[TABLE]

We now start the proof with two lemmas that relate the intermediate measures that we just defined to the measure $\mathsf{PIC}$.

Lemma 7.16**.**

For any public-coins protocol $\pi$, $\widehat{\mathsf{IC}}(\pi)\leq\mathsf{PIC}_{\mu^{n}}(\pi)$.

Proof.

For any $i\in[\![1,k]\!]$,

[TABLE]

Summing over $i\in[\![1,k]\!]$ concludes the proof. ∎

Lemma 7.17**.**

For any public-coins protocol $\pi$, $\widetilde{\mathsf{IC}}(\pi)\leq\mathsf{PIC}_{\mu^{n}}(\pi)$.

Proof.

The proof is similar to the one of Lemma 7.16. For any $i\in[\![1,k]\!]$,

[TABLE]

Summing over $i\in[\![1,k]\!]$ concludes the proof. ∎

The next two lemmas together relate $\mathsf{SMIC}$ to the intermediate measures that we defined.

Lemma 7.18**.**

For any public-coins protocol $\pi$, $\sum\limits_{i=1}^{k}I(M;\Pi_{i}\mid X_{i}R^{p}Z)\leq\widetilde{\mathsf{IC}}(\pi)$.

Proof.

We prove that $\forall~{}i\in[\![1,k]\!],~{}~{}I(M;\Pi_{i}\mid X_{i}R^{p}Z)\leq I(X_{-i};\Pi_{i}\mid X_{i}R^{p}Z)$.

[TABLE]

Summing over $i$ concludes the proof. ∎

The ideas behind the proof of the next lemma are similar to the ones developed in the proof of the lower bound on the randomness complexity of the Parity function in [31]. However, the distribution and the quantities involved being different, a different analysis is required here. We differ the proof of the next lemma to the appendix.

Lemma 7.19**.**

For any public-coins proper synchronous protocol $\pi$, $\sum\limits_{i=1}^{k}I(X_{i};\Pi_{i}\mid R^{p}MZ)\leq\widehat{\mathsf{IC}}(\pi)$.

We can now give the actual proof of Theorem 7.13.

Proof of Theorem 7.13.

By Lemma 7.18 and Lemma 7.19 we have that

[TABLE]

and using Lemma 7.17 and Lemma 7.16 we get

[TABLE]

∎

We can now give a lower bound on the public information cost of the disjointness function.

Theorem 7.20**.**

Let $k>3$. For any proper synchronous protocol $\pi$ computing $\mathsf{Disj}_{k}^{n}$ it holds that

[TABLE]

Proof.

By Theorem 7.12, we only have to consider public-coins protocols. Observe that by adding an additional round to all players, such that, say, player $1$ sends to player $2$ his output, and all other ${k(k-1)-1}$ messages are constant, we can convert $\pi$ into a protocol $\pi^{\prime}$ externally computing $\mathsf{Disj}_{k}^{n}$. By Theorem 6.2 and Theorem 7.13, it holds that ${\mathsf{PIC}_{\mu^{n}}(\pi^{\prime})=\Omega(kn)}$. Since $\mathsf{PIC}_{\mu^{n}}(\pi^{\prime})\leq\mathsf{PIC}_{\mu^{n}}(\pi)+1$, we get that ${\mathsf{PIC}_{\mu^{n}}(\pi)=\Omega(kn)}$.

∎

Our lower bound on the randomness complexity of the disjointness function then follows.

Theorem 7.21**.**

Let $k>3$. $\mathcal{R}(\mathsf{Disj}_{k}^{n})=\Omega(n)$.

Proof.

By Theorem 7.20, $\mathsf{PIC}_{\mu^{n}}(\mathsf{Disj}_{k}^{n})=\Omega(kn)$. But $H_{\mu^{n}}(\mathsf{Disj}_{k}^{n})=0$, and applying Theorem 7.11 we get

[TABLE]

By Lemma 7.7 we have that any proper synchronous protocol privately computing $\mathsf{Disj}_{k}^{n}$ must use $\Omega(n)$ random bits. Since by Lemma 7.1 any (synchronous) private protocol can be transformed into a proper synchronous one without increasing the number of random bits used we have that

[TABLE]

∎

8 Conclusions and open problems

We introduce new models and new information theoretic tools for the study of communication complexity, and other complexity measures, in the natural peer-to-peer, multi-party, number-in-hand setting. We prove a number of properties of our new models and measures, and exemplify their effectiveness by proving two lower bounds on communication complexity, as well as a lower bound on the amount of randomness necessary for certain private computations.

To the best of our knowledge, our lower bounds on communication complexity are the first tight (non-trivial) lower bounds on communication complexity in the natural peer-to-peer multi-party setting, and our lower bound on the randomness complexity of private computations is the first that grows with the size of the input, while the computed function is a boolean one (i.e., the size of the output does not grow with the size of the input).

We believe that our models and tools may find additional applications and may open the way to further study of the natural peer-to-peer setting and to the building of a more solid bridge between the the fields of communication complexity and of distributed computation.

Our work raises a number of questions. First, how can one relax the restrictions that we impose on the general asynchronous model and still prove communication complexity lower bounds in a peer-to-peer setting? Our work seems to suggest that novel techniques and ideas, possibly not based on information theory, are necessary for this task, and it would be most interesting to find those. Second, it would be interesting to identify the necessary and sufficient conditions that guarantee the “rectangularity” property of communication protocols in a peer-to-peer setting. While this property is fundamental to the analysis of two-party protocols, it turns out that once one turns to the multi-party peer-to-peer setting, not only does this property become subtle to prove, but also this property does not always hold. Given the central (and sometimes implicit) role of the rectangularity property in the literature, it would be interesting to identify when it holds in the multi-party peer-to-peer number-in-hand setting.

Acknowledgments. We thank Iordanis Kerenidis and Rotem Oshman for very useful discussions.

Appendix A Background in Information Theory

We give a reminder on basic information theory tools that are of use in the present paper. A good reference is the book of Cover and Thomas [20]. We always consider a probability space over a discrete domain.

A.1 Entropy and mutual information

Definition A.1**.**

The entropy141414In this paper we refer to the binary entropy by simply saying “entropy”. of a random variable $X$ is

[TABLE]

We further use the notation

[TABLE]

The conditional entropy $H(X\mid Y)$ is defined as $\operatorname*{\mathbb{E}}\limits_{y}[H(X\mid Y=y)]$.

Proposition A.2**.**

For any random variables $X$ and $Y$, $H(X\mid Y)\leq H(X)$.

The entropy of a random variable is always non-negative.

Theorem A.3** (Shannon).**

For all prefix-free finite set $\mathcal{X}\subseteq\{0,1\}^{*}$ and all random variable $X$ with support $\text{supp}(X)\subseteq\mathcal{X}$, it holds

[TABLE]

Definition A.4**.**

The mutual information between two random variables $X,Y$ is

[TABLE]

The mutual information of $X$ and $Y$ conditioned on $Z$ is

[TABLE]

The mutual information measures the change in the entropy of $X$ when one learns the value of $Y$. It is symmetric, and non-negative.

Proposition A.5**.**

For any random variables $X$, $Y$ and $Z$, $I(X;Y\mid Z)=0$ if and only if $X$ and $Y$ are independent conditioned on every possible value of $Z$.

We will use extensively the following proposition, known under the name of chain rule.

Proposition A.6**.**

For any random variables $A$, $B$, $C$, $D$,

[TABLE]

The data processing inequality expresses the fact that information can only be lost when applying a function to a random variable.

Proposition A.7**.**

For any random variables $X$, $Y$, $Z$, and any function $f$

[TABLE]

We will occasionally make use of the two following lemmas, which allow to add or remove a random variable from the conditioning.

Lemma A.8** ([7]).**

For any random variables $A$, $B$, $C$, $D$ such that $I(B;D\mid AC)=0$,

[TABLE]

Lemma A.9** ([7]).**

For any random variables $A$, $B$, $C$, $D$ such that $I(B;D\mid C)=0$,

[TABLE]

We further give a lemma which is an certain extension of the data processing inequality, allowing the processing to depend also on part of the conditioning.

Lemma A.10**.**

Let $A$, $B$, $C$, $D$, $\phi=\varphi(C,B)$ be random variables. Then,

[TABLE]

Proof.

[TABLE]

∎

A.2 Hellinger distance

We will make an extensive use of the Hellinger distance.

Definition A.11**.**

Let $P$ and $Q$ be two distributions over a domain $\Omega$. The Hellinger distance between $P$ and $Q$ is $h(P,Q)=\frac{1}{\sqrt{2}}\sqrt{\sum\limits_{\omega\in\Omega}\mid\sqrt{P(\omega)}-\sqrt{Q(\omega)}\mid^{2}}$.

It can be easily checked that the Hellinger distance is indeed a “distance”. When using the square of the Hellinger distance, we often use the following identity.

Proposition A.12**.**

Let $P$ and $Q$ be two distributions over a domain $\Omega$.

[TABLE]

Hellinger distance can be related to mutual information by the following relation.

Lemma A.13** ([3]).**

Let $\eta_{0},\eta_{1}$ be two distributions over the same domain, and suppose that $Y$ is generated as follows: first select $S$ uniformly in $\{0,1\}$, and then sample $Y$ according to $\eta_{S}$. Then $I(S;Y)\geq[h(\eta_{0},\eta_{1})]^{2}$.

Another useful measure is the statistical distance.

Definition A.14**.**

Let $P$ and $Q$ be two distributions over a domain $\Omega$. The statistical distance between $P$ and $Q$ is

[TABLE]

Hellinger distance and statistical distance are related by the following relation.

Lemma A.15**.**

Let $P$ and $Q$ be two distributions over the same domain. $h(P,Q)\geq\frac{1}{\sqrt{2}}\Delta(P,Q)$.

Appendix B A technical lemma

Claim B.1**.**

Let $\pi$ be a protocol, let $i$ be a given player, and let $0\leq\epsilon\leq\frac{1}{2}$ be fixed. If, when running $\pi$, player $i$ $\epsilon$-computes a boolean function $f$, then $H(f(X)\mid X_{i}R_{i}R^{p}\Pi_{i})\leq h(\epsilon)$, where $h$ is the binary entropy function.

Proof.

Let $\theta$ be the (deterministic) function that takes as parameter $(x_{i},r_{i},r^{p},\pi_{i})$ and returns the output of player $i$. Define the random variable $P=\theta(X_{i},R^{p},R_{i},\Pi_{i})$, and the random variable $M=1-\delta_{f(X),P}$, i.e., the indicator variable of the event $f(X)\neq P$. Observe that

[TABLE]

Thus we have

[TABLE]

∎

Appendix C Some of the proofs

This section contains the proofs that were deferred to the appendix.

Proof of Lemma 3.7.

We prove the claim for an arbitrary player $i\in[\![1,k]\!]$. To prove the statement of the lemma define, for $x^{\prime}_{i}\in\mathcal{X}_{i}$,

[TABLE]

and for $x^{\prime}_{-i}\in\mathcal{X}_{-i}$,

[TABLE]

We have, for $x\in\mathcal{X}$,

[TABLE]

We now prove the second claim. Define, for $x^{\prime}_{-i},\in\mathcal{X}_{-i}$,

[TABLE]

We have

[TABLE]

∎

Proof of Lemma 3.8.

By Lemma A.15, we only need to show that ${\Delta(\Pi(x),\Pi(y))\geq 1-2\epsilon}$. By definition, there exists a function $\theta$ taking as input the possible transcripts of ${\pi}$ and verifying ${\forall~{}x\in\mathcal{X},\Pr[\theta(\Pi(x))=f(x)]\geq 1-\epsilon}$.

Let ${\Omega^{\prime}=\theta^{-1}(f(x))}$. We have ${\Pr[\Pi(x)\in\Omega^{\prime}]=\Pr[\theta(\Pi(x))=f(x)]\geq 1-\epsilon}$ and

[TABLE]

Thus

[TABLE]

∎

Proof of Lemma 3.9.

Let ${\cal T}$ be the set of all possible transcripts of $\pi$. In what follows we simplify notation and write $\sum\limits_{\tau}$ instead of $\sum\limits_{\tau\in{\cal T}}$. Using Proposition A.12,

[TABLE]

∎

Proof of Lemma 5.1.

We write $\Pr[\Pi_{i}=\tau_{i}\mid X_{i}=x^{\prime},M=m,Z=z]$ as

[TABLE]

Note that

[TABLE]

since, conditioned on $M=m$ and $Z=z$, $X_{i}$ and $X_{-i}$ are independent. Further note that for $x$ such that $x_{i}=x^{\prime}$,

[TABLE]

By Lemma 3.7, there exist functions $q_{i}$ and $q_{-i}$ such that

[TABLE]

Therefore we can write

[TABLE]

where $c_{i}(m,z,\tau_{i})=\sum\limits_{\hat{x}\in\{0,1\}^{k-1}}q_{-i}(\hat{x},\tau_{i})\Pr[X_{-i}=\hat{x}\mid M=m,Z=z]$.

The proof of the second statement is similar:

[TABLE]

Note that $\Pr[X=x\mid X_{i}=x^{\prime},M=m,Z=z]=\delta_{x_{i},x^{\prime}}\Pr[X_{-i}=x_{-i}\mid M=m,Z=z]$, since, conditioned on $M=m$ and $Z=z$, $X_{i}$ and $X_{-i}$ are independent. Further note that for $x$ such that $x_{i}=x^{\prime}$,

[TABLE]

By Lemma 3.7, there exist functions $q_{i}$ and $p_{-i}$ such that

[TABLE]

Therefore we can write

[TABLE]

where $c(m,z,\tau)=\sum\limits_{\hat{x}\in\{0,1\}^{k-1}}p_{-i}(\hat{x},\tau)\Pr[X_{-i}=\hat{x}\mid M=m,Z=z]$.

∎

Proof of Lemma 5.2.

Using Lemma 5.1, we write

$\Pr[\Pi_{i}[0,0,j]=\overline{\tau}]=q_{i}(0,\overline{\tau})c_{i}(0,j,\overline{\tau})$ and $\Pr[\Pi_{i}[1,1,j]=\overline{\tau}]=q_{i}(1,\overline{\tau})c_{i}(1,j,\overline{\tau})$.

Using Lemma 3.7, we write

$\Pr[\Pi_{i}(\overline{e}^{k}_{i,j})=\overline{\tau}]=q_{i}(0,\overline{\tau})q_{-i}(\overline{e}^{k-1}_{j},\overline{\tau})$ and $\Pr[\Pi_{i}(\overline{e}^{k}_{j})=\overline{\tau}]=q_{i}(1,\overline{\tau})q_{-i}(\overline{e}^{k-1}_{j},\overline{\tau})$.

Note that $\Pi_{i}[1,1,j]=\Pi_{i}(\overline{e}^{k}_{j})$, and thus $q_{i}(1,\overline{\tau})\neq 0\Rightarrow c_{i}(1,j,\overline{\tau})=q_{-i}(\overline{e}^{k-1}_{j},\overline{\tau})$.

By Proposition A.12,

[TABLE]

∎

Proof of Lemma 5.3.

Using Lemma 3.7, we write

[TABLE]

and

[TABLE]

As $\Pr[\Pi_{i}(\overline{e}^{k}_{i,j})=\overline{\tau}]=\sum\limits_{\tau\mid\tau_{i}=\overline{\tau}}\Pr[\Pi(\overline{e}^{k}_{i,j})=\tau]$ we have

[TABLE]

and thus

[TABLE]

Using Proposition A.12, we can write

[TABLE]

∎

Proof of Lemma 7.19.

For the purpose of the proof we define a certain order on the messages in $\Pi_{i}$, i.e., on all messages sent and received by player $i$ as follows. We order the messages of $\Pi_{i}$ by (local) rounds of player $i$, and inside each round have first the messages sent by player $i$, ordered by the index of the recipient, and have then the messages received by player $i$, ordered by the index of the sender. For a given player $i$, we denote the sequence thus defined as $(B^{d})_{d\geq 0}$.

Now, by the chain rule, applied on the messages of $\Pi_{i}$ by the order we just defined, and after rearranging the summands, we have

[TABLE]

We now show that every summand of the second sum equals [math].

To this end, we now show by induction on the index $d$ that $\forall d,~{}I(X_{i};X_{-i}\mid MZR^{p}B^{0}\dots B^{d})=0$. We have $I(X_{i};X_{-i}\mid MZR^{p})=0$, because according to $\mu^{n}$, conditioned on $MZ$, $X_{i}$ and $X_{-i}$ are independent. Assume now the induction hypothesis that for some $d$, ${I(X_{i};X_{-i}\mid MZR^{p}B^{0}\dots B^{d})=0}$. If the message $B^{d+1}$ is sent by player $i$, then $B^{d+1}$ is a function of $X_{i}$, $R^{p}$ and $B^{0}\dots B^{d}$ and thus

[TABLE]

Similarly, if the message $B^{d+1}$ is received by player $i$, then $B^{d+1}$ is a function of $X_{-i}$, $R^{p}$ and $B^{0}\dots B^{d}$ and thus

[TABLE]

Thus we have that

[TABLE]

From Eq. (3), by choosing the relevant $d$ for any given $\ell$, we can also write for all $\ell$

I(X_{i};X_{-i}\mid\IfEqCase{r}{{r}{T_{i}^{<\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell}}{s}{T_{i}^{<\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell}}}[]R^{p}MZ)=0. Applying Lemma A.10 with $A=X_{i}$, $B=X_{-i}$, C=(\IfEqCase{r}{{r}{T_{i}^{<\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell}}{s}{T_{i}^{<\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell}}}[],R^{p}), $D=(M,Z)$ and \phi=\IfEqCase{r}{{r}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell}}{s}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell}}}[]=\varphi(\IfEqCase{r}{{r}{T_{i}^{<\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell}}{s}{T_{i}^{<\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell}}}[],R^{p},X_{-i}) yields I(X_{i};\IfEqCase{r}{{r}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell}}{s}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell}}}[]\mid\IfEqCase{r}{{r}{T_{i}^{<\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell}}{s}{T_{i}^{<\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell}}}[]R^{p}MZ)=0. We have thus shown that

[TABLE]

and thus

[TABLE]

We note that the equation I(X_{i};\Pi_{i}\mid R^{p}MZ)=\sum\limits_{\ell}I(X_{i};\IfEqCase{s}{{r}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell}}{s}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell}}}[]\mid\IfEqCase{s}{{r}{T_{i}^{<\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell}}{s}{T_{i}^{<\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell}}}[]R^{p}MZ) that we proved above formalizes the intuitive assertion that if we consider the messages of $\Pi_{i}$ in their order of appearance, then additional information on $X_{i}$ is obtained only from messages sent by player $i$, but not from messages received by player $i$.

We now relate $\widehat{\mathsf{IC}}$ to the right-hand-side of Eq. (4). Starting from the definition of $\widehat{\mathsf{IC}}$ and using the chain rule, we decompose $\widehat{\mathsf{IC}}$ into a sum over all messages received in the protocol:

[TABLE]

where the second equality follows from the fact that the messages in \IfEqCase{r}{{r}{T_{j}^{<\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell^{\prime}}}{s}{T_{j}^{<\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell^{\prime}}}}[] which are sent by player $j$ are a function of $X_{j}$, $R^{p}$ and of the messages in \IfEqCase{r}{{r}{T_{j}^{<\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell^{\prime}}}{s}{T_{j}^{<\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell^{\prime}}}}[] which are received by player $j$.

We now rearrange this sum by considering the messages from the point of view of the sender rather than the receiver. In what follows we use $j$ as a shorthand of $j(i,\ell)$ and $\ell^{\prime}$ as a shorthand of $\ell^{\prime}(i,\ell)$.151515Recall that $j(i,\ell)$ and $\ell^{\prime}(i,\ell)$ are defined such that message \IfEqCase{s}{{r}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell}}{s}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell}}}[] is identified with the message \IfEqCase{r}{{r}{T_{j(i,\ell)}^{\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell^{\prime}(i,\ell)}}{s}{T_{j(i,\ell)}^{\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell^{\prime}(i,\ell)}}}[]. We have

[TABLE]

To conclude the proof our objective now is to show that for any message \IfEqCase{s}{{r}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell}}{s}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell}}}[],

[TABLE]

Observe that since \IfEqCase{s}{{r}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell}}{s}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell}}}[] is determined by X_{i}R^{p}\IfEqCase{s}{{r}{T_{i}^{<\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell}}{s}{T_{i}^{<\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell}}}[], we have H(\IfEqCase{s}{{r}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell}}{s}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell}}}[]\mid X_{i}\IfEqCase{s}{{r}{T_{i}^{<\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell}}{s}{T_{i}^{<\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell}}}[]R^{p}MZ)=0, and thus

{I(X_{i};\IfEqCase{s}{{r}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell}}{s}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell}}}[]\mid\IfEqCase{s}{{r}{T_{i}^{<\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell}}{s}{T_{i}^{<\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell}}}[]R^{p}MZ)=H(\IfEqCase{s}{{r}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell}}{s}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell}}}[]\mid\IfEqCase{s}{{r}{T_{i}^{<\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell}}{s}{T_{i}^{<\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell}}}[]R^{p}MZ)}. Similarly, we have that

I(X_{-{j}};\IfEqCase{s}{{r}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell}}{s}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell}}}[]\mid\IfEqCase{r}{{r}{T_{j}^{<\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell^{\prime}}}{s}{T_{j}^{<\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell^{\prime}}}}[]X_{j}R^{p}MZ)=H(\IfEqCase{s}{{r}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell}}{s}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell}}}[]\mid\IfEqCase{r}{{r}{T_{j}^{<\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell^{\prime}}}{s}{T_{j}^{<\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell^{\prime}}}}[]X_{j}R^{p}MZ). Thus,

[TABLE]

The last inequality clearly holds if I(\IfEqCase{s}{{r}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}l}}{s}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}l}}}[];\IfEqCase{s}{{r}{T_{i}^{<\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell}}{s}{T_{i}^{<\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell}}}[]R^{p}MZ)=I(\IfEqCase{s}{{r}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell}}{s}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell}}}[];\IfEqCase{s}{{r}{T_{i}^{<\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell}}{s}{T_{i}^{<\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell}}}[]\IfEqCase{r}{{r}{T_{j}^{<\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell^{\prime}}}{s}{T_{j}^{<\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell^{\prime}}}}[]X_{j}R^{p}MZ), which itself holds if

[TABLE]

Notice that given the value of \IfEqCase{s}{{r}{T_{i}^{<\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}l}}{s}{T_{i}^{<\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}l}}}[]R^{p}MZ, \IfEqCase{s}{{r}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell}}{s}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell}}}[] is determined by $X_{i}$, and thus by the data processing inequality (Proposition A.7) we have

[TABLE]

and Eq. 6 holds if I(X_{i};\IfEqCase{r}{{r}{T_{j}^{<\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell^{\prime}}}{s}{T_{j}^{<\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell^{\prime}}}}[]X_{j}\mid\IfEqCase{s}{{r}{T_{i}^{<\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell}}{s}{T_{i}^{<\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell}}}[]R^{p}MZ)=0.

Let $t$ be the (global) round in which player $j$ receives \IfEqCase{r}{{r}{T_{j}^{\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell^{\prime}}}{s}{T_{j}^{\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell^{\prime}}}}[], which is also the (global) round in which player $i$ sends \IfEqCase{s}{{r}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell}}{s}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell}}}[] (recall that in fact \IfEqCase{r}{{r}{T_{j}^{\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell^{\prime}}}{s}{T_{j}^{\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell^{\prime}}}}[] is the same message as \IfEqCase{s}{{r}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell}}{s}{T_{i}^{\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell}}}[]). Now, all the messages in \IfEqCase{r}{{r}{T_{j}^{<\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell^{\prime}}}{s}{T_{j}^{<\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell^{\prime}}}}[] are received or sent by player $j$ no later than (global) round $t$, and all the messages sent by player $i$ which are not in \IfEqCase{s}{{r}{T_{i}^{<\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell}}{s}{T_{i}^{<\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell}}}[] are sent by player $i$ no earlier than (global) round $t$. Hence, \IfEqCase{r}{{r}{T_{j}^{<\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell^{\prime}}}{s}{T_{j}^{<\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell^{\prime}}}}[] is a function of (X_{-i},\IfEqCase{s}{{r}{T_{i}^{<\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell}}{s}{T_{i}^{<\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell}}}[]). We also have trivially that $X_{j}$ is a function of $X_{-i}$. Thus, the data processing inequality implies that

[TABLE]

By Eq. (3), I(X_{i};X_{-i}\mid\IfEqCase{s}{{r}{T_{i}^{<\text{\makebox[0.0pt]{\,\,\overleftarrow{\color[rgb]{1,1,1}l}}}\ell}}{s}{T_{i}^{<\text{\makebox[0.0pt]{\,\,\overrightarrow{\color[rgb]{1,1,1}l}}}\ell}}}[]R^{p}MZ)=0, which concludes the proof of Eq. (6) and therefore of Eq. (5) and of the lemma. ∎