Trade-offs in Distributed Interactive Proofs

TL;DR

This paper explores the capabilities and limitations of distributed interactive proofs, analyzing trade-offs among key parameters like interaction rounds, certificate size, and randomness, and linking them to distributed verification.

Contribution

It introduces a structured analysis of distributed interactive proofs, establishing trade-offs between parameters and connecting them to existing distributed verification frameworks.

Findings

Trade-offs between interaction rounds, certificate size, and randomness are characterized.

Distributed interactive proofs are connected to distributed verification, enriching the theoretical landscape.

The study provides a structured understanding of the power and limitations of distributed interactive proofs.

Abstract

The study of interactive proofs in the context of distributed network computing is a novel topic, recently introduced by Kol, Oshman, and Saxena [PODC 2018]. In the spirit of sequential interactive proofs theory, we study the power of distributed interactive proofs. This is achieved via a series of results establishing trade-offs between various parameters impacting the power of interactive proofs, including the number of interactions, the certificate size, the communication complexity, and the form of randomness used. Our results also connect distributed interactive proofs with the established field of distributed verification. In general, our results contribute to providing structure to the landscape of distributed interactive proofs.

Equations

$${\pi }_v(\mathcal{I},\text{p},r)=\left(c_0(v),r_1(v),c_1(v),\dots ,r_{\lfloor \frac{k}{2}\rfloor }(v),c_{\lfloor \frac{k}{2}\rfloor }(v)\right)$$

$$\left\{\begin{array}[]{lcl}(G,\mbox{\rm id},x)\in{\mathcal{L}}&\Rightarrow&\exists\textsf{p}:\Pr_{r}[\textsf{v}(\pi(\mathcal{I},\textsf{p},r))\;\mbox{accepts at all nodes}]\geq\nicefrac{{2}}{{3}};\\ (G,\mbox{\rm id},x)\notin{\mathcal{L}}&\Rightarrow&\forall\textsf{p}:\Pr_{r}[\textsf{v}(\pi(\mathcal{I},\textsf{p},r))\;\mbox{rejects in at least one node}]\geq\nicefrac{{2}}{{3}}.\end{array}\right.$$

$${\Psi }_u(i_0)$$

$$|\bigcup _{y_1^I}{\mathcal{B}}^I(y_1^I)|\le \sum _{y_1^I}\left|{\mathcal{B}}^I(y_1^I)\right|\le \sum _{y_1^I}\frac{2^{k\rho }}{3^k}=2^{n\sigma }\frac{2^{k\rho }}{3^k}.$$

$$\mathrm{Pr}[\mathcal{P}\text{mbox}acceptsatallnodes]\le \frac{2^{n\sigma }\frac{2^{k\rho }}{3^k}}{2^{k\rho }}=\frac{2^{n\sigma }}{3^k}.$$

$$\mu :\{0,1{\}}^{(2t+1)k\cdot \sigma (n)+k\cdot \rho (n)}\to \{\text{mbox}\mathrm{accept},\text{mbox}\mathrm{reject}\}$$

$$2^{2^{(2t+1)k\cdot \sigma (n)+k\cdot \rho (n)}}.$$

$$2^{n_0{2}^{(2t+1)k\cdot \sigma (n_0)+k\cdot r(n_0)}}<2^{2^{n_0}}.$$

$$n_{min}(m)=\min \{n\ge 1:S(n,m)\ne \varnothing \}.$$

$$m_{max}(n)=\max \{m\ge 0:S(n,m)\ne \varnothing \}.$$

$$m_{max}(n_{min}(m))\ge m.$$

$$\mathcal{L}=\bigcup _{n\ge 3}L(n,m_{max}(n)).$$

$$\mathcal{L}\notin \text{mbox}\mathsf{dAMH}(\sigma ,\infty ).$$

$${\mathcal{L}}^{\prime }=\mathcal{L}(n_{min}(m),m_{max}(n_{min}(m))).$$

$$\mathcal{L}\notin \text{mbox}\mathsf{dAMH}(o(n),\infty ).$$

$$\mathcal{L}\in {\Sigma }_1\text{mbox}\mathsf{LD}(O(n),O(n)).$$

$$\Pr[\mathcal{E}_{u}]=d!\Big{(}\frac{1}{d}\Big{)}^{d}=\frac{\sqrt{2\pi d}}{e^{d}}\,\Big{(}1+O\Big{(}\frac{1}{d}\big{)}\Big{)}.$$

$$\Pr[\overline{\mathcal{E}_{u}}]\leq\Big{(}1-\frac{\sqrt{2\pi d}}{e^{d}}\,\Big{(}1+O\Big{(}\frac{1}{d}\Big{)}\Big{)}\Big{)}^{c\log n}.$$

Full text

Trade-offs in Distributed Interactive Proofs

Pierluigi Crescenzi

  

Pierre Fraigniaud

  

Ami Paz

1 Introduction

This paper is concerned with distributed network computing, in which $n$ processing nodes occupy the $n$ vertices of a connected simple graph $G$, and communicate through the edges of $G$. In this context, distributed decision [25] refers to the task in which the nodes have to collectively decide whether the network $G$ satisfies some given graph property, which may refer also to input labels given to the nodes (basic examples of such tasks are whether the network is acyclic or whether the network is properly colored). If the property is satisfied then all nodes must accept, otherwise at least one node must reject. Distributed decision finds immediate applications to distributed fault-tolerant computing, in which the nodes must check whether the current network configuration is in a legal state with respect to some Boolean predicate [15]. (If this is not the case, the rejecting node(s) may raise an alarm or launch a recovery procedure.)

While some properties (e.g., whether a given coloring is proper) are locally decidable (LD) by exchanging information between neighbors only, other properties are not (e.g., whether the network is acyclic, or whether a given set of pointers forms a spanning tree of the network). As a remedy, the notion of proof-labeling scheme (PLS) was introduced [15], and variants were considered, including non-deterministic local decision (NLD) [14], and locally checkable proofs (LCP) [19]. All these settings assume the existence of a prover assigning certificates to the nodes, and a distributed verifier in charge of verifying that these certificates form a distributed proof that the network satisfies some given property. For instance, acyclicness can be certified by a prover picking one arbitrary node $u$, and assigning to each node $v$ a certificate $c(v)$ equal its distance to $u$. The distributed verifier running at every node $v$ checks that $v$ has one neighbor $w$ satisfying $c(w)=c(v)-1$, and all its other neighbors $w^{\prime}$ satisfying $c(w^{\prime})=c(v)+1$. If the network contains a cycle, then these equalities will be violated in at least one node.

Note that the prover is not necessarily an abstract entity, as an algorithm constructing some distributed data structure (e.g., a spanning tree) may construct in parallel a proof that this data structure is correct. Interestingly, all (Turing decidable) graph properties can be certified by PLS and LCP with $O(n^{2})$-bits certificates [15], and this is tight [19] — for instance, symmetry111$G$ is symmetric if $G$ has a non trivial automorphism, i.e., a one-to-one mapping from the set of nodes to itself preserving edges, and distinct from the identity map. ($\mathsf{Sym}$) was shown to require $\Omega(n^{2})$-bit certificates. However, not only such universal certification requires high space complexity at the nodes for storing large certificates, it also requires high communication complexity between neighbors for verifying the correctness of these certificates. Hence, the concern is minimizing the size of the certificates for specific graph properties, e.g., minimum-weight spanning trees (MST) [22].

Recently, the notion of randomized proof-labeling schemes (RPLS) was introduced [16]. RPLS assumes that the distributed verifier is randomized, and the global verdict provided by the nodes about the correctness of the network configuration should hold with probability at least $\nicefrac{{2}}{{3}}$. Such randomized distributed verification schemes were proven to be very efficient in terms of communication complexity (with $O(\log n)$-bit messages exchanged between neighbors), but this often holds at the cost of actually increasing the size of the certificates provided by the prover.

Another recent direction for reducing the certificate size introduces a local hierarchy of complexity classes defined by alternating quantifiers (similarly to the polynomial hierarchy [28]) for local decision [11]. Interestingly, many properties requiring $\Omega(n^{2})$-bit certificates with a locally checkable proof stand at the bottom levels of this hierarchy, with $O(\log n)$-bit certificates. This is for instance the case of non 3-colorability ($\overline{\mathsf{3Col}}$), which stands at the second level of the hierarchy, and $\mathsf{Sym}$, which stands at the third level of the hierarchy. More generally, all monadic second order graph properties belong to this hierarchy with $O(\log n)$-bit certificates. However, it is not clear how to implement the protocols resulting from this hierarchy.

Even more recently, a very original and innovative approach was adopted [21, 24], bearing similarities with the local hierarchy but perhaps offering more algorithmic flavor. This approach considers distributed interactive proofs. Such proofs consist of a constant number of interactions between a centralized prover $\mathsf{M}$ (a.k.a. Merlin) and a randomized distributed verifier $\mathsf{A}$ (a.k.a. Arthur). For instance, a dAM protocol is a protocol with two interactions: Arthur queries Merlin by sending a random string, and Merlin replies to this query by sending a certificate. Similarly, a dMAM protocol involves three interactions: Merlin provides a certificate to Arthur, then Arthur queries Merlin by sending a random string, and finally Merlin replies to Arthur’s query by sending another certificate. This series of interactions is followed by a phase of distributed verification performed between every node and its neighbors, which may be either deterministic or randomized.

Although the interactive model seems weaker than the alternation of quantifiers in the local hierarchy, many properties requiring $\Omega(n^{2})$-bits certificates with a locally checkable proof admit an Arthur-Merlin protocol with small certificates, and very few interactions. For instance, this is the case of $\mathsf{Sym}$ that admits a dMAM protocol with $O(\log n)$-bit certificates, and a dAM protocol with $O(n\log n)$-bit certificates [21] (on the other hand, any dAM protocol for $\mathsf{Sym}$ requires $\Omega(\log\log n)$-bit certificates [21]). It is also known that non symmetry ($\overline{\mathsf{Sym}}$) can be decided by a dAMAM protocol with $O(\log n)$-bit certificates [24]. These results raise several interesting questions, such as:

Are there ways to establish trade-offs between space complexity (i.e., the size of the certificates) and communication complexity (i.e., the size of the messages exchanged between nodes)? The dMA protocols [21] as well as the RPLS protocols [16] enable to gain a lot in terms of message complexity, but at the cost of still high space complexity. Would it be possible to compromise between these two complexities? In particular, would it be possible to reduce the certificate size at the cost of increasing the communication complexity? 2. 2.

The theory of distributed decision has somehow restricted itself to distributed randomness, in the sense that each node has only access to a private source of random coins. These coins are public to the prover, but remain private to the other nodes. Shared randomness is known to be stronger than private randomness for communication complexity, as witnessed by, e.g., deciding equality [23]. How much shared randomness could help in the context of distributed decision? 3. 3.

Last, but not least, are there general reduction theorems between Arthur-Merlin classes for trading the number of interactions with the certificate size? Indeed, it is known that, in the centralized setting, $\mathsf{AM}[k]=\mathsf{AM}[2]$ for any $k\geq 2$, but it is not known whether such collapse holds in the distributed setting [21]. Also, the Sipser–Lautemann theorem tells us that, in the centralized setting, $\mathsf{MA}\subseteq\Sigma_{2}\,\cap\,\Pi_{2}$ and $\mathsf{MA}\subseteq\mathsf{AM}\subseteq\Pi_{2}$. It is not known whether the distributed Arthur-Merlin classes stand so low in the local alternating hierarchy too.

Our Results.

In this paper, we study the power of distributed interactive proofs. This is achieved via a series of results establishing trade-offs between various parameters impacting the power of interactive proofs, including the number of interactions, the certificate size, the communication complexity, and the form of randomness used. Our results also connect distributed interactive proofs with the established field of distributed verification. We address the above three questions as follows. For the first question, we show how to apply techniques developed in the framework of multi-party communication complexity to get trade-offs between space and communication for the classical triangle detection problem. For the second question, we show that shared randomness helps significantly, enabling to exponentially reduce the communication complexity while preserving the space complexity for important problems such as spanning tree, and a vast class of optimization problems, including, for example, maximum independent set and minimum dominating set. For the third question, we give a general technique for reducing the number of interactions at the cost of increasing the certificate and message size.

More specifically, for the first question, we explore the trade-off of space vs. communication, and establish that, for every $\alpha$, there exists a Merlin-Arthur protocol for triangle-freeness, using $O(\log n)$ bits of shared randomness, with $\widetilde{O}(n/\alpha)$-bit certificates and $\widetilde{O}(\alpha)$-bit messages between nodes (see Theorem 3.2). To our knowledge, this is the first example of a decision task for which one can trade communication for space, and vice versa. In addition, the proof reveals an interesting connection between dMA and communication complexity with a referee. Note that, for $\alpha=\sqrt{n}$, we obtain a distributed Merlin-Arthur protocol for triangle-freeness with message and space complexities $\widetilde{O}(\sqrt{n})$ bits. In contrast, any proof-labeling scheme for triangle-freeness must have certificate size at least $n/e^{O(\sqrt{\log n})}$ bits (see Proposition 3.4). A similar tradeoff can be obtained when using distributed randomness, though with higher space complexity.

Regarding the second question, we explore the significance of having access to shared randomness. We show that, for any minimization problem $\pi$ in graphs whose admissibility can be decided locally, there exists a Merlin-Arthur protocol for certifying the existence of a solution whose cost is at most $k$, using $O(\log n)$ bits of shared randomness, with $O(\log n)$-bit certificates and $O(\log\log n)$-bit messages between nodes (see Theorem 4.1). The same result holds for maximization problems whose admissibility can be decided locally. Note that this class of problems includes, for example, maximum independent set, minimum dominating set, and minimum vertex cover (potentially weighted). This exponentially improves the communication complexity of locally checkable proofs for such problems. The same communication complexity could be obtained using randomized proof-labeling schemes, but at the cost of increasing the certificate size to up to $O(n\log n)$ bits. As another interesting result in the context of exploring the significance of having access to shared randomness, we show that even shared randomness remains limited both in terms of the certificate size and of the amount of communication. We show that every Arthur-Merlin protocol for $\mathsf{Sym}$, and every Arthur-Merlin protocol for $\overline{\mathsf{Sym}}$ must have both certificate size and message size $\Omega(\log\log n)$ bits, even with shared randomness (see Theorem 4.8). Interestingly, for the class of graphs used in the proof of this latter result, there is a Merlin-Arthur protocol with certificates and messages of constant length. This shows that the inclusion $\mathsf{MA}\subseteq\mathsf{AM}$ which holds in the centralized setting does not hold in the distributed setting.

Finally, we consider general reductions within the Arthur-Merlin hierarchy, and compare the power of this hierarchy to the power of proof-labeling schemes with certificates of linear size. We show that, for every $\sigma$ and $\gamma$, any graph property verifiable with an Arthur-Merlin protocol with 3 or 4 interactions (dMAM or dAMAM) using $\sigma$-bit certificates and $\gamma$-bit messages can also be verified by an Arthur-Merlin (dAM) protocol using $O(n\sigma^{2})$-bit certificates and $O(n\gamma\sigma)$-bit messages (see Theorem 5.1 and Corollary 5.3). Although the linear blowup in terms of both certificate size and message complexity may seem huge at a first glance, it fits (up to logarithmic factors) with the different results obtained previously [21, 24] regarding $\mathsf{Sym}$ and graph non-isomorphism ($\overline{\mathsf{Iso}}$). Finally, we compare the power of Arthur-Merlin protocols with an arbitrarily large number of interactions with the power of proof-labeling schemes. We show that there exists a graph property admitting a proof-labeling scheme with certificates and messages on $O(n)$ bits, that cannot be solved by an Arthur-Merlin protocol with $o(n)$-bit certificates, for any fixed number $k\geq 0$ of interactions between Arthur and Merlin, even using shared randomness, and even with messages of unbounded size (see Theorem 5.6). This latter result demonstrates that, in general, one cannot trade the number of interactions between Merlin and Arthur for reducing the certificate size, at least for certificates of linear size.

Most of our results are stated by assuming that nodes have access to shared randomness. However, as all our protocols are local, all our 1-round protocols can be simulated by 2-round protocols using distributed randomness. In general, our results contribute to providing structure to the landscape of distributed interactive proofs.

Related Work.

Local decision (LD) and the central notion of locally-checkable labellings were introduced and thoroughly studied in the 90s [25]. Local verification was introduced fifteen years later [15], through the original notion of proof-labeling schemes (PLS). Proof-labeling schemes find important applications to self-stabilization, but are subject to some restrictions (only certificates are exchanged between neighbors). These restrictions were lifted by considering the general notion of locally checkable proofs (LCP) [19]. By definition, we have $\mbox{\sf LCP}=\Sigma_{1}\mbox{\sf LD}$ (the same way $\mathsf{NP}=\Sigma_{1}\mathsf{P}$). A third notion of distributed verification was introduced, by considering the class NLD [14]. NLD differs from $\Sigma_{1}\mbox{\sf LD}$ in the fact that, in NLD, the certificates cannot depend on the identities given to the nodes.

Randomized versions of local decision and local verification have been considered in the literature [16, 13, 14, 21]. A Merlin-Arthur (dMA) protocol is actually a randomized version of locally checkable proof ($\Sigma_{1}\mbox{\sf LD}$) that was previously studied [16]: Merlin provides each node with a certificate, and Arthur performs a randomized verification algorithm at each node. The benefit of using dMA over $\Sigma_{1}\mbox{\sf LD}$ can be exponential in terms of communication complexity (i.e., of the size of the messages exchanged between neighbors), at the cost of a linear increase in space complexity (i.e., of the size of the certificates provided by Merlin) [16].

Very closely related to the line of work about interactive distributed proofs is the local hierarchy \mbox{\sf LH}=\bigcup_{k\geq 0}\Big{(}\Sigma_{k}\mbox{\sf LD}\cup\Pi_{k}\mbox{\sf LD}\Big{)} with certificates and messages of logarithmic size [11], extending the known $\mathsf{logLCP}$ class [19]. In particular, it is proved that $\mathsf{Sym}\in\Sigma_{3}\mbox{\sf LD}$ [11]. Also, it is easy to show that $\overline{\mathsf{3Col}}\in\Pi_{2}\mbox{\sf LD}$. In contrast, placing $\mathsf{Sym}$ or $\overline{\mathsf{3Col}}$ in $\Sigma_{1}\mbox{\sf LD}$ requires $\Omega(n^{2})$-bit certificates [19]. The same hierarchy was later considered, but under the constraint that the certificates must not depend on the identifier assignment to the nodes. With $O(n^{2})$-bit certificates, this hierarchy collapses at the second level $\Pi_{2}\mbox{\sf LD}$ [5]. (This is in contrast with the hierarchy in which certificates can depend on the node identifiers, which collapses at the first level $\Sigma_{1}\mbox{\sf LD}$ with $O(n^{2})$-bit certificates.) Nevertheless, apart from the bottom levels, the hierarchies based on alternating quantifiers with $O(\log n)$-bit certificates are essentially the same [5]. See the recent survey [10] for more results on distributed decision.

This work is inspired by very recent achievements in the field of distributed interactive protocols [21, 24]. In addition to the aforementioned results regarding $\mathsf{Sym}$ and $\overline{\mathsf{Sym}}$, two versions of $\overline{\mathsf{Iso}}$ (Given two sub-graphs $G_{1}$ and $G_{2}$ of $G$, $G_{1}\not\sim G_{2}$, that is, are $G_{1}$ and $G_{2}$ non-isomorphic?) were considered. For the easiest version, in which the input of each node $v$ is formed by the two sets of neighbors of $v$ in the two graphs $G_{1}$ and $G_{2}$, a dAMAM protocol with $O(\log n)$-bit certificates for deciding $G_{1}\not\sim G_{2}$ was designed [24]. For the more complicated version, in which $G_{1}=G$ (that is, $G_{1}$ is the communication network) and the input of each node $v$ is the set of neighbors of $v$ in $G_{2}$, a dAMAM protocol with $O(n\log n)$-bit certificates for deciding $G_{1}\not\sim G_{2}$ was proposed [21], and an Arthur-Merlin protocol with a constant number of interactions and $O(\log n)$-bit certificates, for deciding $G_{1}\not\sim G_{2}$, was successively designed [24]. Interestingly, this latter result is obtained via a general connection between efficient centralized computation (under various models) and the ability to design Arthur-Merlin protocols with a constant number of interactions between the prover and the verifier, using logarithmic-size certificates.

We use a variety of techniques and results from the theory of communication complexity [23]. Specifically, we use an Arthur-Merlin style protocol for two-party disjointness [1], in a recent variant [2] that allows a trade-off between communication complexity and certificate size. We also use recent lower bounds for the equality and non-equality problems in the same setting [18]. Finally, we use multi-party communication protocol with a referee for the SumZero problem with bounded inputs [26], and with unbounded inputs [20].

2 Model and Definitions

A network configuration is a triple $(G,\mbox{\rm id},x)$ where $G=(V,E)$ is a connected simple graph, $\mbox{\rm id}:V\to\{1,\dots,n^{c}\}$ for some constant $c\geq 1$ is the identity one-to-one assignment to the nodes, and $x:V\to\{0,1\}^{*}$ is the input label assignment (i.e., the state of the node). A distributed language is a collection ${\mathcal{L}}$ of network configurations. Note that it may be the case that, for some language ${\mathcal{L}}$, $(G,\mbox{\rm id},x)\in{\mathcal{L}}$ while $(G,\mbox{\rm id}^{\prime},x)\notin{\mathcal{L}}$ for two different identity assignments id and $\mbox{\rm id}^{\prime}$. This typically occurs for languages where the label of a node refers to the identities of its neighbors, e.g., for encoding spanning trees. (Throughout the paper, we assume that all considered distributed languages are Turing-decidable). Distributed decision for ${\mathcal{L}}$ is the following task: given any network configuration $(G,\mbox{\rm id},x)$, the nodes of $G$ must collectively decide whether $(G,\mbox{\rm id},x)\in{\mathcal{L}}$. If this is the case, then all nodes must accept, otherwise at least one node must reject (with certain probabilities, depending on the model).

We consider interactive protocols for distributed decision [21]. A distributed interactive protocol ${\mathcal{P}}$ consists of a constant series of interactions between a prover called Merlin, and a verifier called Arthur (see Fig. 1 for a visual representation of such a protocol). The prover Merlin is centralized, and has unlimited computing power. It is aware of the whole network configuration $(G,\mbox{\rm id},x)$ under consideration, but it cannot be trusted. The verifier Arthur is distributed, and has bounded knowledge, that is, at each node $v$, Arthur is initially aware solely of $(\mbox{\rm id}(v),x(v))$, i.e., of its identity and its input label.

In a distributed Arthur-Merlin interactive protocol performed on $\mathcal{I}=(G,\mbox{\rm id},x)$, whenever Arthur is the one that starts interacting, it picks a random string $r_{1}(v)$ at each node $v$ of $G$ (this random string might be private to each node, or the nodes may have access to shared randomness). Given the collection $r_{1}$ of random strings selected by the nodes, Merlin provides every node $v$ with a certificate $c_{1}(v)=\textsf{p}(v,\mathcal{I},r_{1})$, where $\textsf{p}:\{0,1\}^{*}\to\{0,1\}^{*}$. At this point, Arthur picks another random string $r_{2}(v)$ at each node $v$. Then Merlin replies to each node $v$ by sending a second certificate $c_{2}(v)=\textsf{p}(v,\mathcal{I},r_{1},r_{2})$, and so on. Whenever Merlin is the one that starts interacting, the process starts with Merlin constructing a binary string $c_{0}(v)=\textsf{p}(v,\mathcal{I})$ that it sends to every node $v$. These interactions proceed for a constant number $k\geq 0$ of times, and Merlin interacts last, by sending $c_{\lfloor\frac{k}{2}\rfloor}(v)$ to every node $v$. A sequence of interactions can then be summarized by a transcript \pi(\mathcal{I},\textsf{p},r)=\Big{(}\pi_{v}(\mathcal{I},\textsf{p},r)\Big{)}_{v\in V}, where $r=\left(r_{1},\dots,r_{\lfloor\frac{k}{2}\rfloor}\right)$ with $r_{i}=(r_{i}(v))_{v\in V}$ for $i=1,\dots,\lfloor\frac{k}{2}\rfloor$, and

[TABLE]

with $c_{0}(v)=\varnothing$ if Arthur starts the interactions. In other words, an Arthur-Merlin protocol with $k$ interactions results in a transcript with $c_{0}(v)=\varnothing$ if $k$ is even, and with $c_{0}(v)$ equal to the first certificate provided by Merlin otherwise. The Arthur-Merlin protocol completes by performing a deterministic distributed verification algorithm v executed at each node. Specifically, Algorithm v proceeds as follows at every node $v$:

A message $M_{v,u}$ destined for every neighboring node $u$ of $v$ is forged, and sent to $u$. This message may depend on the identity $\mbox{\rm id}(v)$, the input $x(v)$, all random strings generated by Arthur at $v$, and all certificates received by $v$ from Merlin. 2. 2.

Based on all the knowledge accumulated by $v$ (i.e., its identity, its input label, the generated random strings, the certificates received from Merlin, and all the messages received from its neighbors), Algorithm v accepts or rejects at node $v$.

A distributed Arthur-Merlin protocol ${\mathcal{P}}$ thus consists of two consecutive stages: (1) interactions between the nodes and the prover p (Arthur-Merlin phases), and (2) communication among neighboring nodes (algorithm v). Note that, for the sake of simplifying the presentation, and unifying the comparison with previous work, we restrict ourselves to verification algorithms v that perform in a single round. Performing more than one round enables to improve the complexity of verification protocols in some cases [12]. However, this does not conceptually change the nature of the protocol. For zero interactions (i.e., $k=0$), a distributed Arthur-Merlin protocol simply consists in performing a (deterministic) decision algorithm at each node [15]. For one interaction (i.e., $k=1$), a distributed Arthur-Merlin verification protocol is a (1-round) locally-checkable proof algorithm [19].

Definition 2.1**.**

The class $\mbox{\sf dAM}[k](\sigma,\gamma)$ is the class of languages ${\mathcal{L}}$ for which there exists a distributed Arthur-Merlin verification protocol with at most $k\geq 0$ interactions between Arthur and Merlin, where Merlin provides certificates of at most $\sigma\geq 0$ bits to the nodes, and the verification algorithm v exchanges messages of at most $\gamma\geq 0$ bits between nodes, such that, for every configuration $\mathcal{I}=(G,\mbox{\rm id},x)$,

[TABLE]

The definition of distributed Merlin-Arthur interactive protocols, and of $\mbox{\sf dMA}[k](\sigma,\gamma)$ is similar, apart from the fact that, as opposed to Arthur-Merlin protocols in which Merlin always interacts last, Arthur has one more “interaction” during which it picks a random bit-string $r^{\prime}(v)$ at every node $v$, which is used to perform a randomized verification algorithm v. Therefore, for $k\geq 1$, a Merlin-Arthur protocol with $k$ interactions can be defined as an Arthur-Merlin protocol with $k-1$ interactions, but where the verification algorithm v is randomized. For zero interactions, a distributed Merlin-Arthur protocol simply consists in performing a (deterministic) decision algorithm at each node [15]. For one interaction, a distributed Merlin-Arthur protocol is a (1-round) randomized decision algorithm as studied previously [13]. For two interactions, a distributed Merlin-Arthur protocol is a (1-round) randomized locally-checkable proof algorithm, also as studied previously [16].

In the following, we may avoid mentioning the parameters $\sigma$ and $\gamma$ when they are clear from the context, or when they are respectively identical in the two terms of an equality. For small values of $k\geq 2$, $\mbox{\sf dAM}[k]$ and $\mbox{\sf dMA}[k]$ are rewritten as an alternating sequence of $\mathsf{A}$s and $\mathsf{M}$s. For instance, $\mbox{\sf dAM}[2]=\mbox{\sf dAM}$, $\mbox{\sf dMA}[2]=\mbox{\sf dMA}$, $\mbox{\sf dAM}[3]=\mbox{\sf dMAM}$, $\mbox{\sf dMA}[3]=\mbox{\sf dAMA}$, and $\mbox{\sf dAM}[4]=\mbox{\sf dAMAM}$, and so on. For $k\leq 1$, it follows from the definition that $\mbox{\sf dAM}[0]=\mbox{\sf dMA}[0]=\mbox{\sf LD}.$ We also have $\mbox{\sf dAM}[1]=\Sigma_{1}\mbox{\sf LD}\;\mbox{and}\;\mbox{\sf dMA}[1]=\mbox{\sf BPLD}(\nicefrac{{2}}{{3}},\nicefrac{{2}}{{3}})$ where the class $\mbox{\sf BPLD}(p,q)$ is the distributed version of BPP [17], with $p$ being the acceptance probability of the interactive protocol on legal instances, and $q$ being the rejection probability of the protocol on illegal instances [13]. As a last example, dMA is the class of languages that can be decided by a randomized locally checkable proof, as studied previously [16].

As opposed to the sequential setting in which it is known that $\mathsf{AM}[k]=\mathsf{AM}[2]$ for all $k\geq 2$, it is not known whether such “collapse” occurs in the distributed setting. Therefore, we define the Arthur-Merlin hierarchy as $\mbox{\sf dAMH}(\sigma,\gamma)=\bigcup_{k\geq 0}\mbox{\sf dAM}[k](\sigma,\gamma).$ That is, ${\mathcal{L}}\in\mbox{\sf dAMH}(\sigma,\gamma)$ if and only if there exists $k\geq 0$ such that ${\mathcal{L}}\in\mbox{\sf dAM}[k](\sigma,\gamma)$.

Boosting the Success Probability.

In classical, sequential randomized algorithm, the success probability constant $\nicefrac{{2}}{{3}}$ can be easily increased using repetitions. On the other hand, it was shown that this boosting technique is not applicable for randomized distributed decision algorithms in general [13], making the choice of constant significant when considering such settings. The inability of boosting in the distributed setting is due to the fact that, when repeating the algorithm on a “no” instance for several times, different nodes may reject in different repetitions, causing each node to sees very few rejections and decide on acceptance. Somewhat surprisingly, we can show that in the case of distributed Arthur-Merlin protocols (i.e., $\mbox{\sf dAM}[k]$ classes), parallel repetition is possible, and at a relatively low blowup in communication and certificates. This allows us to boost the success probability, as follows.

Proposition 2.2**.**

Let $1>p^{\prime}>p>\nicefrac{{1}}{{2}}$. If there exists an Arthur-Merlin verification protocol ${\mathcal{P}}$ with $k\geq 2$ interactions that enables to verify a distributed language ${\mathcal{L}}$ with $\sigma$-bit certificates, $\gamma$-bit messages, and success probability $p$, then there exists an Arthur-Merlin verification protocol ${\mathcal{P}}^{\prime}$ with $k$ interactions that enables to verify ${\mathcal{L}}$ with $\sigma+O(\log n)$-bit certificates, messages on $\gamma+O(\log n)$ bits, and success probability $p^{\prime}$.

Proof 2.3**.**

Moving from success probability $p$ to success probability $p^{\prime}>p$ is achieved in a standard way, by merely repeating ${\mathcal{P}}$ a constant number of times (depending on $p$ and $p^{\prime}$), and adopting the majority of the outcomes. However, this cannot be done in a straightforward manner because, for a configuration $(G,x,\mbox{\rm id})\notin{\mathcal{L}}$, it may be the case that the (at least one) node rejecting $(G,x,\mbox{\rm id})$ is different at each repetition. Therefore, during the last interaction with the prover, Merlin provides every node with a local encoding of a spanning tree $T$ enabling to count the number of executions of ${\mathcal{P}}$ resulting in at least one node rejecting. It is known that certificates of $O(\log n)$ bits suffice for certifying such a tree [15]. The root of the tree $T$ accepts or rejects depending on whether the majority of executions of ${\mathcal{P}}$ accepted or rejected, respectively.

3 Space vs. Communication

In this section, we study the trade-off between space and communication complexity for Merlin-Arthur interactive protocols. Specifically, we consider the classical triangle-freeness problem, and establish a trade-off between space and communication for this problem. Recall that a graph $G=(V,E)$ is triangle-free if, for every three nodes $u,v,w$ in $V$, either $\{u,v\}\notin E$, $\{u,w\}\notin E$, or $\{v,w\}\notin E$. We denote by $\Delta_{\mathsf{free}}$ the corresponding distributed language. There is a recent deterministic distributed algorithm for triangle-freeness running in $\widetilde{O}(\sqrt{n})$ rounds in the congest model [7]. A general scheme for designing dMA protocol has also been proposed [16]. This scheme enables to reduce communication complexity to $O(\log n)$, at the cost of increasing the space complexity to $O(n^{2})$. When more interactions are allowed, say a constant number $k$, a recent reduction [24] — from centralized small-space algorithms to our setting — implies a protocol with $O(\log n)$-bit certificates and $O(\log n)$-bit messages for the triangle-freeness problem, i.e., $\Delta_{\mathsf{free}}\in\mbox{\sf dMA}[k](\log n,\;\log n)$ for some constant $k>1$.

In order to prove the trade-off between space and communication complexities for triangle-freeness, we first state the following result, which will be used at several places in the paper.

Lemma 3.1**.**

For any network of maximum degree $d$, there exists a proof-labeling scheme (and thus a $\Sigma_{1}\mbox{\sf LD}$ protocol) with $O(\log n)$-bit certificates providing each node $v$ with the certified value $n$ of the number of nodes, and a color $c(v)\in\{1,\dots,\min\{d^{2}+1,n\}\}$ such that $c$ forms a certified proper distance-2 coloring of the network.

Proof idea. The certification of the number of nodes can be done by using a rooted spanning tree and by counting nodes in the sub-trees. The certification of a proper distance-2 coloring can be done by assigning colors to nodes, with every node checking that all its neighbors have different colors, all different from its own color. ∎

Since triangle-freeness is a local property, nodes do not need to be represented by identifiers that are different throughout the entire network. Instead, identifiers resulting from a proper distance-2 coloring suffice. Therefore, using Lemma 3.1, we can assume that nodes are provided with identifiers in $\{1,\dots,n\}$ such that $\mbox{\rm id}(u)\neq\mbox{\rm id}(v)$ whenever the distance between $u$ and $v$ is at most $2$.

Theorem 3.2**.**

For every $\alpha=O(n)$, there exists a Merlin-Arthur protocol for triangle-freeness, using $O(\log n)$ bits of shared randomness, with $O(\frac{n}{\alpha}\log n)$-bit certificates and $O(\alpha\log n)$-bit messages between nodes. In short $\Delta_{\mathsf{free}}\in\mbox{\sf dMA}(\frac{n}{\alpha}\log n,\;\alpha\log n)$.

Proof 3.3**.**

We identify the space $\{1,\dots,n\}$ of IDs with $[n/\alpha]\times[\alpha]$, for some $\alpha=O(n)$ of choice. Each node $u$ thus has a set $S_{u}$ of pairs of the form $(i,t)$ representing its neighbors. Let $q$ be a prime such that $cn\alpha<q\leq 2cn\alpha$, for a large enough constant $c>1$, and let ${\textstyle\mathop{\mathbb{F}}_{q}}$ be the field of $q$ elements. Each node $u$ represents $S_{u}$ as $\alpha$ functions $\psi_{S_{u},t}:[n/\alpha]\to\left\{0,1\right\},$ where $\psi_{S_{u},t}(i)=1\iff(i,t)\in S_{u}.$ Node $u$ then extends these functions to polynomials $\Psi_{S_{u},t}:{\textstyle\mathop{\mathbb{F}}_{q}}\to{\textstyle\mathop{\mathbb{F}}_{q}}$ of degree at most $n/\alpha-1$ that agree with $\psi_{S_{u},t}$ on $[n/\alpha]$. To make sure that an edge $\{u,v\}$ is not a part of a triangle, the nodes $u$ and $v$ need to verify that $S_{u}\cap S_{v}=\emptyset$, which is equivalent to $\Psi_{S_{u},t}(i)\cdot\Psi_{S_{v},t}(i)=0$ for all $i\in[n/\alpha]$ and $t\in[\alpha]$. Node $u$ then defines its neighbors polynomials $\Psi_{uv,t}=\Psi_{S_{u},t}\cdot\Psi_{S_{v},t}$ for every $v\in S_{u}$, and every $t\in[\alpha]$. Let $\Psi_{u}=\sum_{t\in[\alpha]}\sum_{v\in S_{u}}\Psi_{uv,t}.$ The degree of each polynomial $\Psi_{uv,t}$ is at most $2(n/\alpha-1)$, and thus this is also the case for the degree of $\Psi_{u}$. Node $u$ is not part of a triangle if and only if $\Psi_{uv,t}(i)=0$ for every $t\in[\alpha]$, $i\in[n/\alpha]$ and $v\in S_{u}$. Since $q>n\alpha$, it follows that $u$ is not part of a triangle if and only if $\Psi_{u}(i)=0$ for every $i\in[n/\alpha]$. (For each $i$, we have a sum of $n\alpha$ values, each in $\left\{0,1\right\}$.)

Merlin assigns to node $u$ the certificate $\Phi_{u}$, which is supposed to be equal to $\Psi_{u}$. Since this is a polynomial of degree at most $2(\frac{n}{\alpha}-1)$, the same number of coefficients are sufficient for representing $\Phi_{u}$. Therefore, the certificates are of $O(\frac{n}{\alpha}\log q)$ bits, which are actually $O(\frac{n}{\alpha}\log n)$ bits, as $q\leq 2cn\alpha=O(n^{2})$.

Each node $u$ first verifies that $\Phi_{u}(i)=0$ for every $i\in[n/\alpha]$. Then, it checks that indeed $\Phi_{u}=\Psi_{u}$, as follows. The protocol uses the shared randomness to choose a field element $i_{0}\in{\textstyle\mathop{\mathbb{F}}_{q}}$ known to all nodes. Each node $v$ broadcasts $\{\Psi_{S_{v},t}(i_{0}):t\in[\alpha]\}$ to each of its neighbors, using $O(\alpha\log q)\leq O(\alpha\log n)$ bits of communication. Node $u$ then computes

[TABLE]

and accepts if and only if $\Phi_{u}(i_{0})=\Psi_{u}(i_{0})$. The probability that two non-equal polynomials on ${\textstyle\mathop{\mathbb{F}}_{q}}$ of degree at most $2(\frac{n}{\alpha}-1)$ are equal at a random point $i$ is at most $2(\frac{n}{\alpha}-1)/q$. Therefore, since $q>cn\alpha$, the probability of error can be made arbitrarily small by choosing $c$ large enough.

Remark. Similar trade-offs can still be obtained even if nodes have only access to distributed randomness. For instance, in two rounds, with the same notations as in the proof of Theorem 3.2, we can have each node $u$ choose its own random $i_{u}\in{\textstyle\mathop{\mathbb{F}}_{q}}$, and send it to all its neighbors $v$. To get a 1-round dMA protocol, with $O(\frac{n^{2}}{\alpha}\log n)$-bit certificates, and $O(\alpha\log n)$-bit communication, Merlin sends to $u$ a specific certificate for each edge incident to $u$. That is, $u$ gets a polynomial $\Phi_{v}$ for each $v\in S_{u}$, which equals (allegedly) to $\Psi_{uv}(i)=\sum_{t\in T}\Psi_{uv,t}(i)=\sum_{t\in T}\Psi_{S_{u},t}(i)\cdot\Psi_{S_{v},t}(i)$ on each $i\in{\textstyle\mathop{\mathbb{F}}_{q}}$. In this case, $v$ chooses $i_{v}$ at random locally, and sends to $u$ the value $i_{v}$ in addition to the $\alpha$ evaluations $\Psi_{S_{v},t}(i_{v})$ for all $t\in[\alpha]$.

A particular application of Theorem 3.2 is the existence of a Merlin-Arthur protocol with both space and message complexities $\widetilde{O}(\sqrt{n})$. This contrasts with the following lower bound.

Proposition 3.4**.**

Any proof-labeling scheme for triangle-freeness must have certificate size at least $n/e^{O(\sqrt{\log n})}$ bits.

Proof idea. The lower bound graph construction for the broadcast-congested-clique model [9] obviously gives a lower bound to the weaker, broadcast-congest model. This lower bound is based on a lower bound for multiparty communication complexity of disjointness [27], which also applies for the non-deterministic case. Finally, as noted in previous work on PLS [19, 6], a lower bound for non-deterministic communication complexity in the broadcast-congest model implies a certificate-size lower bound for PLS. ∎

We can then conclude that, as opposed to the dMA protocol of Theorem 3.2, any PLS for triangle freeness must use almost-linear communication. Put differently, the trivial protocol of sending all the list of neighbors is almost optimal, even if non-determinism is used.

4 Distributed vs. Shared Randomness

In this section we compare the power of distributed interactive protocols using shared randomness (the nodes have access to a common source of random coins) with the power of protocols using distributed randomness (each node has access to a private source of random coins only) — in both cases, the outcomes of the random trials are public to Merlin.

4.1 Interactive Protocols that use Shared Randomness

Certifying Solutions to Optimization Problems.

We consider optimization problems on graphs, such as finding a minimum dominating set, or a maximum independent set, and their weighted counterparts. Similar problems where previous studied in the context of non-interactive distributed verification [11]. In such a problem $\pi$, an admissible solution is a set $S$ of nodes satisfying a set of constraints depending on $\pi$, and the quality of a solution $S$ is measured by its weight $w(S)=\sum_{s\in S}w(s)$ where $w(s)$ is the weight of node $s$, given as input (where $w(s)=1$ for every node $s$ when considering only the cardinality of the solution). We assume that all weights are polynomial in the size $n$ of the network. A set $S$ is distributively encoded by a Boolean variable $x(v)$ at each node $v$, indicating whether the node is in $S$ or not. We consider two distributed languages:

• •

The language $\mathsf{Adm}_{\pi}$ is composed of all configurations $(G,(w,x),\mbox{\rm id})$ such that $x$ encodes an admissible solution for $\pi$ in the weighted graph $G$ (weights are assigned by $w$).

• •

The language $\mathsf{OptVal}_{\pi,k}$, for $k\geq 0,$ is composed of all configurations $(G,w,\mbox{\rm id})$ such that there exists an admissible solution for $\pi$ of weight at most $k$ (respectively, at least $k$) for the minimization (respectively, maximization) problem $\pi$.

This framework can easily be extended to study problems whose solutions are sets of edges.

Theorem 4.1**.**

For any optimization problem $\pi$ on graphs such that checking whether a given solution $x$ is admissible can done by exchanging $O(\log\log n)$ bits between neighbors, there exists a Merlin-Arthur protocol for $\mathsf{OptVal}_{\pi,k}$, using $O(\log n)$ bits of shared randomness, with $O(\log n)$-bit certificates and $O(\log\log n)$-bit messages between nodes. In short, $\mathsf{OptVal}_{\pi,k}\in\mbox{\sf dMA}(\log n,\;\log\log n)$.

Proof 4.2**.**

Let $\pi$ be an optimization problem, and assume, w.l.o.g., that $\pi$ is a minimization problem (e.g., minimum dominating set). Let us consider a legal configuration $(G,w,\mbox{\rm id})$, i.e., there exists $S\subseteq V$ such that $w(S)\leq k$. Merlin assigns a Boolean $x(v)$ to every node $v$, stating whether $v$ is in $S$ or not. Note that, by hypothesis, the admissibility of $S$ is checkable by exchanging only $O(\log\log n)$ bits between neighbors. (Just one bit suffices in the case of minimum dominating set.) In order to measure the quality of the solution, Merlin also provides the nodes with a distributed encoding of a tree $T$ spanning $G$ rooted at an arbitrary node $r$ (i.e., provide every node $v$ with the identifier of its parent $p(v)$), and a distributed proof that $T$ is a spanning tree. Again, it is known (see [15]) that certificates of $O(\log n)$ bits suffice for certifying such a tree (by using, e.g., $(\mbox{\rm id}(r),cpt(v))$ where $cpt(v)$ is the distance to $r$ in $T$). Every node $u$ is also given the partial sum $s(u)=\sum_{v\in V(T_{u})\cap S}w(v)$ as part of its certificate, where $T_{u}$ denotes the subtree of $T$ rooted at $u$. Each certificate consumes $O(\log n)$ bits at each node.

Verifying at every node $u$ that (1) the identifier of $r$ given to $u$ is the same as the one given to its neighbors in $G$, (2) its distance $cpt(u)$ to $r$ in $T$ is one more than the one of its parent in $T$, and one less than the one of its children in $T$, and (3) $s(u)=\sum_{p(v)=u}s(v)+x(u)\cdot w(u)$, can trivially be done by exchanging $O(\log n)$ bits between neighbors. We show how, using shared randomness, we can reduce this to $O(\log\log n)$ bits, without increasing the certificate size.

The tests (1) and (2) are equality tests, which can be done by exchanging only $O(1)$ bits between neighbors with access to $O(\log n)$ shared random bits [23]. The test (3) consists of checking that $x(u)\cdot w(u)-s(u)+\sum_{p(v)=u}s(v)=0$ which is known as the SumZero problem in multi-party communication complexity. The protocol in [26] achieves this test with $O(\log\log n)$-bit communication complexity, using $O(\log\log n)$ shared random bits.

For Theorem 4.1, we assumed that all weights are polynomial in the size $n$ of the network. If the weights are $m$-bit long, we can adapt the proof, and show that there exists a Merlin-Arthur protocol for $\mathsf{OptVal}_{\pi,k}$, using $O(\log(m+\log n))$ bits of shared randomness, with $O(\log n)$-bit certificates and $O(\log n)$-bit messages between nodes. In short, $\mathsf{OptVal}_{\pi,k}\in\mbox{\sf dMA}(\log n,\;\log n)$ even with weights exponential in $n$.

Certifying Coloring and Lucky Labeling.

Similar arguments as the ones used to establish Theorem 4.1 allow us to verify specific optimization problems, for which checking that a solution is admissible is not easy. We exemplify this with the coloring problem, and its variant the lucky labeling problem [4, 8].

Checking that a given graph coloring is proper is a simple task, which can be solved by having each node broadcast its color. Here, we show that verifying a given $c$-coloring can be done using a dMA protocol with $O(\Delta\log\log c)$-bit certificates and $O(1)$ bits of communication in networks of maximum degree $\Delta$. This stands in contrast to the trivial verification algorithm where the communication is of $O(\log c)$ bits. In the dMA protocol, Merlin provides every node $v$ with the location $p(v,u)$ of a bit where the colors of $u$ and $v$ differ, for each of its neighbors $u$. A node $v$ then checks with each neighbor $u$ the fact that $p(v,u)=p(u,v)$, and at the same time sends to $u$ the value of the corresponding bit. The Merlin step requires certificates of $O(\Delta\log\log c)$ bits. The Arthur step requires constant communication when shared randomness is available, using the equality protocol.

Lemma 4.3**.**

There is a Merlin-Arthur protocol for verifying a given $c$-coloring using $O(\log\log c)$ bits of shared randomness, certificates of size $O(\Delta\log\log c)$ bits, and constant communication complexity. In short, $c$-coloring of graphs of degree at most $\Delta$ is in $\mbox{\sf dMA}(\Delta\log\log c,\;1)$.

We apply this observation to the so-called lucky labeling. For a graph $G=(V,E)$ and a positive integer $c$, let $\ell:V\to\{1,\dots,c\}$, and, for every node $v$ of $G$, let $S(v)=\sum_{u\in N(v)}\ell(u)$. The labeling $\ell$ is lucky if, for every two adjacent nodes $u$ and $v$, we have $S(u)\neq S(v)$. The lucky coloring number of a graph $G$, denoted by $\eta(G)$, is the least positive integer $c$ such that $G$ has a lucky labeling $\ell:V\to\{1,\dots,c\}$. We refer to [4, 8] for properties of the lucky coloring number. In particular, it is conjectured that $\eta(G)\leq\chi(G)$, and it is known that $\eta(G)\leq\Delta^{2}-\Delta+1$, even for list lucky labeling.

Verifying a given graph coloring is trivial, even without labels or interaction. To verify an upper bound on the chromatic number $\chi$ of a graph, there is a simple PLS giving each node a color. The situation with lucky labeling is much more subtle: it is impossible to verify lucky labeling in a single round (this can be easily seen by considering different labelings on a short path). There is a simple PLS for verifying a given labeling is lucky, or for bounding $\eta$ from above, which gives each node $v$ the sum $S(v)$, and also labels for the latter case.

This PLS has label size and communication of $O(\log\Delta)$. Applying RPLS [16] gives $\sigma=O(\Delta\log\Delta)$ and $\gamma=O(\log\log\Delta)$, which can be reduced to $\gamma=O(1)$ using shared randomness. Here, we show an MA protocol using shared randomness with $\sigma=O(\Delta\log\log\Delta)$ and $\gamma=O(\log\log\Delta)$, establishing another trade-off between space and communication.

Theorem 4.4**.**

For every $\lambda=O(n)$, there exists a Merlin-Arthur protocol for $\eta(G)\leq\lambda$, using $O(\log\log\Delta)$ bits of shared randomness, with $O(\Delta\log\log\Delta)$-bit certificates and $O(\log\log\Delta)$-bit messages between nodes. In short, lucky labeling is in $\mbox{\sf dMA}(\Delta\log\log\Delta,\;\log\log\Delta)$.

Proof 4.5**.**

Merlin sends to every node $v$ its label $\ell(v)$ and the alleged sum $S(v)$ of the labels of its neighbors. For the verification, the nodes verify that the sums $S(v)$ constitute a proper coloring, using the protocol from Lemma 4.3. In addition, they use a multiparty protocol for the SumZero problem [26, 3], in order to verify $S(v)=\sum_{u\sim v}\ell(u)$.

Note that a similar protocol can be used for the problem of verifying that a given labeling is lucky.

4.2 A General Reduction Between Distributed and Shared Randomness

Interestingly, assuming distributed randomness does not limit the power of Arthur-Merlin protocols compared to shared randomness, up to a small additive factor in the certificate size. The same holds for Merlin-Arthur protocols, but solely up to one additional interaction between Arthur and Merlin. This result is not hard to achieve using a classical spanning-tree verification technique already applied in proof labeling schemes [15]. Yet, it both generalizes and simplifies the previous results on shared vs. distributed randomness [21], so we present it here in full.

Theorem 4.6**.**

For any distributed language ${\mathcal{L}}$, and for any number $k\geq 1$ of interactions, and for any certificate size $\sigma\geq 0$, if ${\mathcal{L}}\in\mbox{\sf dAM}[k](\sigma,\gamma)$ (respectively, ${\mathcal{L}}\in\mbox{\sf dMA}[k](\sigma,\gamma)$) using $\rho(n)$ shared random bits, then ${\mathcal{L}}\in\mbox{\sf dAM}[k](\sigma+\log n+\rho,\gamma+\log n+\rho)$ (respectively, ${\mathcal{L}}\in\mbox{\sf dAM}[k+1](\sigma+\log n+\rho,\gamma+\log n+\rho)$) with distributed randomness.

Proof 4.7**.**

Let ${\mathcal{L}}\in\mbox{\sf dAM}[k](\sigma,\gamma)$ with an interactive Arthur-Merlin protocol ${\mathcal{P}}$ using $\rho(n)$ shared random bits. If nodes have only access to distributed random coins, then they can simulate ${\mathcal{P}}$ as follows. At every interaction with Merlin, every node sends a random string of $\rho(n)$ bits to Merlin, and Merlin is bound to choose the one generated by the node with minimum identifier. To prove that Merlin does so, it provides every node $v$ with a distributed certificate $c(v)$ for proving a spanning tree $T$ of the network, rooted at the node with minimum identifier. As we already mentioned previously in the paper, it is known that certificates of $O(\log n)$ bits suffice for certifying such a tree [15]. All nodes are also provided with the random string $r$ produced by the node with smaller identifier, which consume $\rho(n)$ bits of certificates. All nodes check that they are given the same random bits, and the root of the tree checks that these bits are those it gave to Merlin.

For the case of ${\mathcal{L}}\in\mbox{\sf dMA}[k](\sigma,\gamma)$, the proof is identical, except for the last stage of the interactive Merlin-Arthur protocol ${\mathcal{P}}$ verifying ${\mathcal{L}}$, which involves a distributed verification algorithm using shared randomness. This latter algorithm can be simulated in the distributed randomness setting by adding another interaction with Merlin, which enables to certify the random string generated by the node with minimum identifier, to be used instead of the shared random string originally used by the distributed verification algorithm.

4.3 Lower Bounds for Shared Randomness

For many verification problems, the number of random bits used by Arthur remains limited, typically $\rho(n)=O(\log n)$, which shows that, often, shared randomness does not add much power to Arthur-Merlin protocols. The next result states a lower bound on the certificate and message size in the case of $\mathsf{Sym}$ and $\overline{\mathsf{Sym}}$, even when using shared randomness.

Theorem 4.8**.**

Any Arthur-Merlin protocol for (non) symmetry must have certificate and message size $\Omega(\log\log n)$. In short, $\mathsf{Sym},\overline{\mathsf{Sym}}\not\in\mbox{\sf dAM}(o(\log\log n),\infty)\cup\mbox{\sf dAM}(\infty,o(\log\log n))$, even using shared randomness.

Proof 4.9**.**

In [18], a communication complexity variant of Arthur-Merlin protocols has been proposed. In this variant, Arthur consists of two parties, Alice and Bob, and the input is split between them: Alice holds $x$, Bob holds $y$, and they wish to decide whether the value of a specified function $f$ with input $x$ and $y$ is equal to 1. At the beginning, Alice and Bob start by tossing some coins, then Merlin publishes a certificate, and finally Alice and Bob separately decide whether to accept (the acceptance/rejection criteria are the same as for the Arthur-Merlin protocols). The communication cost of the protocol is defined as the worst-case length of Merlin’s certificates. At the end of the paper, the authors observe that, with respect to this variant of Arthur-Merlin protocols, any such protocol for $\mathsf{Eq}$ and for $\overline{\mathsf{Eq}}$ must have communication complexity $\Omega(\log\log n)$. We will now show that the existence of a dAM protocol with one interaction for the $\mathsf{Sym}$ (respectively, $\overline{\mathsf{Sym}}$) problem with certificate size $o(\log\log n)$ would imply a two-player Arthur-Merlin protocol for $\mathsf{Eq}$ (respectively, $\overline{\mathsf{Eq}}$) with communication complexity $o(\log\log n)$. The theorem thus follows.

Given two binary vectors $x=(x_{1},\ldots,x_{n})$ and $y=(y_{1},\ldots,y_{n})$, recall that $\mathsf{Eq}(x,y)=1$ if and only if $x_{i}=y_{i}$ for every $i$ with $1\leq i\leq n$ (for the sake of simplicity, we will assume that $x\neq\mathbf{0}$ and that $y\neq\mathbf{0}$, but our construction can be also adapted to the case in which $x=\mathbf{0}$ or $y=\mathbf{0}$). We now define a graph $G_{x,y}$ such that $\mathsf{Sym}(G_{x,y})=1$ if and only if $\mathsf{Eq}(x,y)=1$ (and, hence, $\overline{\mathsf{Sym}}(G_{x,y})=1$ if and only if $\overline{\mathsf{Eq}}(x,y)=1$). The graph includes $6n+2$ nodes $a$, $b$, $a_{i}$, $b_{i}$, $u_{i}$, $v_{i}$, $y_{i}$, and $z_{i}$, for $1\leq i\leq n$, and the following edges (see Fig. 2):

• •

$(a,b)$, $(a,a_{i})$, for $1\leq i\leq n$ such that $x_{i}=1$, and $(b,b_{i})$, for $1\leq i\leq n$ such that $y_{i}=1$;

• •

$(u_{i},a_{j})$* and $(v_{i},b_{j})$, for $1\leq i\leq j\leq n$;*

• •

$(u_{i},u_{j})$* and $(v_{i},v_{j})$, for $1\leq i<j\leq n$, and $(u_{i},y_{j})$ and $(v_{i},z_{j})$, for $1\leq i,j\leq n$;*

• •

$(y_{i},y_{i+1})$* and $(z_{i},z_{i+1})$, for $1\leq i<n$, and $(y_{1},y_{n})$ and $(z_{1},z_{n})$.*

Clearly, if $x=y$, then $\mathsf{Sym}(G_{x,y})=1$: indeed, we can simply map each $a$-node (respectively, $u$-node and $y$-node) to the corresponding $b$-node (respectively, $v$-node and $z$-node). On the other hand, because of the degree distribution of its nodes, any non-trivial automorphism of $G_{x,y}$ has to map the $u$-nodes to the corresponding $v$-nodes: this in turn implies that, because of their neighborhoods, each $a$ node has to be mapped to the corresponding $b$-node. Hence, since the mapping is an automorphism, the neighborhood of node $a$ and node $b$ has to be the same: that is, $x=y$.

Let us now suppose that there exists a dAM protocol ${\mathcal{P}}$ with one interaction for the $\mathsf{Sym}$ (respectively, $\overline{\mathsf{Sym}}$) problem which uses certificates of size $o(\log\log n)$. We now show how ${\mathcal{P}}$ can be used to design an Arthur-Merlin protocol for $\mathsf{Eq}$ (respectively, $\overline{\mathsf{Eq}}$) with communication complexity $o(\log\log n)$ (for the sake of brevity, we will show this statement for $\mathsf{Sym}$ and $\mathsf{Eq}$: the proof for $\overline{\mathsf{Sym}}$ and $\overline{\mathsf{Eq}}$ is almost identical). Given $x$ (respectively, $y$), Alice (respectively, Bob) can construct the $(a,u,y)$-subgraph (respectively, $(b,v,z)$-subgraph) of $G_{x,y}$: let $G_{x,y}^{A}$ (respectively, $G_{x,y}^{B}$) denote such subgraph. After having sent to Merlin the shared random string $r$, Alice and Bob waits for Merlin’s certificate which is supposed to be formed by the two certificates $\pi_{a}$ and $\pi_{b}$ that nodes $a$ and $b$ would have received during the execution of ${\mathcal{P}}$ with random string $r$. By simulating ${\mathcal{P}}$ for every possible certificate assignment to the nodes of $G_{x,y}^{A}$ (respectively, $G_{x,y}^{B}$), Alice (respectively, Bob) can verify whether there exists an assignment that makes all the nodes of its corresponding subgraph accept: if this is the case, Alice (respectively, Bob) accepts. By definition, we have that if $x=y$, then, for any random string $r$ there exist a certificate assignment to $G_{x,y}^{A}$ (respectively, $G_{x,y}^{B}$) and a certificate for Alice and Bob which make Alice and Bob accept. On the other hand, if $x\neq y$, then, for at least $\nicefrac{{2}}{{3}}$ of all possible random strings, any certificate assignment to $G_{x,y}^{A}$ (respectively, $G_{x,y}^{B}$) and any certificate for Alice and Bob makes Alice and Bob reject. Since the size of the certificate for Alice and Bob is twice the size of the certificate size of ${\mathcal{P}}$, this implies that this protocol is an Arthur-Merlin protocol for $\mathsf{Eq}$ with communication complexity $o(\log\log n)$. This contradicts the lower bound observed in [18]: we have thus proved that $\mathsf{Sym},\overline{\mathsf{Sym}}\not\in\mbox{\sf dAM}(o(\log\log n),\infty)$.

The above proof can be adapted in order to obtain a lower bound on the communication complexity of any dAM for the $\mathsf{Sym}$ and $\overline{\mathsf{Sym}}$ problems. Indeed, instead of asking Merlin for the certificates of the nodes $a$ and $b$, Alice and Bob ask Merlin for the message transmitted on the edge $(a,b)$. They then try to find a certificate assignment that suits this message. Hence, we have also shown that $\mathsf{Sym},\overline{\mathsf{Sym}}\not\in\mbox{\sf dAM}(\infty,o(\log\log n))$ and the theorem follows.

A result similar to previous theorem was proved in [21] in an ad-hoc manner, but only for the $\mathsf{Sym}$ problem and with respect to space complexity. The authors have recently reported to improve the lower bound from $\log\log n$ to $\log n$ [24].

5 Interactions vs. Space and Communication

In this section, we explore the power given to interactive protocols by allowing many interactions between Merlin and Arthur, in terms of both space complexity and communication complexity.

5.1 Reducing the Number of Interactions

The following general result allows us to reduce the number of interactions between Arthur and Merlin, at the cost of increasing the certificate size and the communication cost of the protocol.

Theorem 5.1**.**

For any two functions $\sigma$ and $\gamma$, $\mbox{\sf dMAM}(\sigma,\gamma)\subseteq\mbox{\sf dAM}(n\sigma^{2},n\sigma\gamma)$.

Proof 5.2**.**

Let ${\mathcal{P}}$ be a $\mbox{\sf dMAM}(\sigma,\gamma)$ 1-sided protocol for a language ${\mathcal{L}}$ using $\rho(n)$ shared random bits. Given a configuration $I=(G,\mbox{\rm id},x)$, let $y^{I}_{1}:V\rightarrow\Sigma^{\sigma}$ be the function specifying the certificate sent by Merlin to each node during the first iteration. Moreover, for any string $r\in\Sigma^{\rho(n)}$, let $y^{I,r}_{2}:V\rightarrow\Sigma^{\sigma}$ be the function specifying the certificate sent by Merlin to each node during the second iteration, whenever $r$ is the shared randomly chosen string by Arthur. From the definition, it follows that, if $I\not\in{\mathcal{L}}$, then $\Pr[{\mathcal{P}}\;\mbox{accepts at all nodes}]\leq\nicefrac{{1}}{{3}}$, that is, for at most $\frac{2^{\rho}}{3}$ random strings $r$ there exists a function $y^{I,r}_{2}$ which makes the protocol ${\mathcal{P}}$ accept. By repeating $k$ times the protocol ${\mathcal{P}}$ on the configuration $I$, we then have that, for at most $\frac{2^{k\rho}}{3^{k}}$ $k$-tuples of random strings $r_{1},\ldots,r_{k}$, there exists a $k$-tuple of functions $y^{I,r_{1}}_{2},\ldots,y^{I,r_{k}}_{2}$ which makes the protocol ${\mathcal{P}}$ accept at each repetition. Let ${\cal{B}}^{I}(y^{I}_{1})$ denote the set of such $k$-tuples of random strings: we have that $|{\cal{B}}^{I}(y^{I}_{1})|\leq\frac{2^{k\rho}}{3^{k}}$.

We can now define a dAM protocol ${\mathcal{P}}^{\prime}$ in the following way. Arthur chooses $k$ shared random strings $r_{1},\ldots,r_{k}$ and sends $R=r_{1}\cdots r_{k}$ to Merlin. Merlin sends to each node a label formed by $k+1$ strings in $\Sigma^{\sigma}$ chosen according to $k+1$ functions $y^{I,R}_{1},y^{I,R}_{2,1},\ldots,y^{I,R}_{2,k}:V\rightarrow\Sigma^{\sigma}$. At this point, each node $u$ executes $k$ repetitions of protocol ${\mathcal{P}}$, assuming that the first certificate received by Merlin is $y^{I,R}_{1}(u)$, and that the second certificate received from Merlin at the $i$-th repetition is $y^{I,R}_{2,i}(u)$: $u$ accepts if and only if all repetitions accept. If $I\in{\mathcal{L}}$, then all nodes will accept with probability one, since ${\mathcal{P}}$ is a 1-sided protocol. On the other hand, if $I\not\in{\mathcal{L}}$, then the probability that ${\mathcal{P}}^{\prime}$ accepts can be bounded by referring to the cardinality of $\bigcup_{y^{I}_{1}}{\cal{B}}^{I}(y^{I}_{1})$, where the union is over all possible functions $y^{I}_{1}:V\rightarrow\Sigma^{\sigma}$: indeed, given the function $y^{I,R}_{1}=y^{I}_{1}$, this cardinality is an upper bound on the number of random strings $R=r_{1}\cdots r_{k}$ such that there exist $k$ functions $y^{I,R}_{2,1},\ldots,y^{I,R}_{2,k}$ which allows Merlin to make all nodes accept.

From the bound above and from the fact that we have exactly $2^{n\sigma}$ functions mapping $n$ nodes to strings of length $\sigma$, we have that

[TABLE]

Hence,

[TABLE]

If we choose $k=n\sigma$, the above probability is at most $\nicefrac{{1}}{{3}}$. On the other hand, with $k=n\sigma$ we have that ${\mathcal{P}}^{\prime}$ uses certificates of size $(n\sigma+1)\sigma$ and has a communication complexity equal to $n\sigma\gamma$ (since it has to simulate $n\sigma$ repetitions of protocol ${\mathcal{P}}$ which has communication cost equal to $\gamma$). The theorem is thus proved.

Corollary 5.3**.**

For any two functions $\sigma$ and $\gamma$, $\mbox{\sf dAMAM}(\sigma,\gamma)\subseteq\mbox{\sf dAM}(n\sigma^{2},n\sigma\gamma)$.

As a direct application of Theorem 5.1, we have that $\mathsf{Sym}$ admits a dAM protocol with one interaction and certificate size $O(n\log^{2}n)$. This is a consequence of the theorem and of the existence of a dAM protocol with two interactions [21]. It is worth noting that this consequence of our general reduction result is only a $\log$ factor away from the “ad-hoc” result of [21] which establishes the existence of a dAM protocol with one interaction and certificate size $O(n\log n)$. Corollary 5.3 can be applied to a more recent result[24], which establishes the existence of a dAM protocol with three interactions and certificate size $O(\log n)$ for the non-isomorphism graph problem, in the case in which the nodes can communicate on both graphs. As a consequence of the corollary, we have that this problem admits a dAM protocol with one interaction and certificate size $O(n\log^{2}n)$. As far as we know, this is the first dAM protocol with one interaction for this version of the non-isomorphism graph problem An interesting open question is whether such a protocol can exist also for the problem in which nodes can communicate only on one graph, while the other graph is locally given as input to the nodes themselves. For this latter problem, a dAM protocol with one interaction and certificate size $O(n\log n)$ was given [21], as well as an dAM protocol with a constant number of interactions and certificate size $O(\log n)$ [24]. Observe that the two applications of Theorem 5.1 and of Corollary 5.3 are obtained at the cost of an increase of the communication complexity by a factor $\widetilde{O}(n)$. We do not know if this linear increase of communication complexity can be avoided in general.

5.2 The Arthur-Merlin Hierarchy

We analyze the power of the Arthur-Merlin hierarchy. Recall that, for any $\sigma\geq 0$ and $\gamma\geq 0$, $\mbox{\sf dAMH}(\sigma,\gamma)=\bigcup_{k\geq 0}\mbox{\sf dAM}[k](\sigma,\gamma)$. We show that increasing the number of interactions cannot help much for reducing the certificate size to $o(n)$, even for languages defined on a very simple subclass of regular graphs, with 1-bit inputs, and admitting a locally checkable proof with $O(n)$-bit certificates.

Theorem 5.4**.**

There exists a distributed language ${\mathcal{L}}$ on cycles, with 1-bit inputs, admitting a locally checkable proof with $O(n)$-bit certificates, and $O(n)$-bit messages, that is outside the Arthur-Merlin hierarchy with $o(n)$-bit certificates, even with messages of unbounded size, and even if the verifier performs an arbitrarily large constant number of rounds, whenever Arthur generates $\rho(n)=o(n)$ random bits at each node for each interaction with Merlin. In short, there exists a distributed language ${\mathcal{L}}$ on regular graphs satisfying ${\mathcal{L}}\in\Sigma_{1}\mbox{\sf LD}(O(n),O(n))\setminus\mbox{\sf dAMH}(o(n),\infty).$

Proof 5.5**.**

We show that there exists a language on 0/1-labelled oriented cycles that is outside $\mbox{\sf dAMH}(o(n),\infty)$, where an oriented cycles is a cycle $C_{n}=(u_{0},\dots,u_{n-1})$ in which the nodes are provided with IDs in $\{0,\dots,n-1\}$, given consecutively to the nodes, i.e., $\mbox{\rm id}(u_{i})=i$. (Node $u_{i}$ is adjacent to nodes $u_{i+1\bmod n}$ and $u_{i-1\bmod n}$). In addition, 0/1-labelled oriented cycles means that we restrict ourselves to languages with binary inputs. The proof is based on a construction and a counting argument similar to the ones used in [11] for proving that there are languages outside the local hierarchy LH.

Let $k$ and $t$ be two non-negative integers, and let $\sigma:\mathbb{N}\to\mathbb{N}$ with $\sigma\in o(n)$. First, we show that there exists an integer $n$, and a language on 0/1-labelled oriented cycles that cannot be recognized by a protocol in $\mbox{\sf dAM}[k](\sigma,\infty)$ with Arthur generating $r=o(n)$ random bits at each interaction, and running in $t$-round verifier. Observe that the verifier at every node $u_{i}$ takes as input the $(2t+1)k\cdot\sigma(n)$ bits provided by Merlin to the nodes in the $t$-ball around $u_{i}$ during the $k$ interactions between Arthur and Merlin at these nodes, the $k\cdot\rho(n)$ random bits generated by Arthur, and the identifier $i$ of $u_{i}$. The number of functions

[TABLE]

is at most

[TABLE]

It follows that the number of interactive protocols at $u_{i}$ with Arthur generating $\rho(n)$ random bits at each interaction, and running a $t$-round verifier, with Merlin using certificates of size at most $\sigma(n)$ bits is at most $2^{2^{(2t+1)k\cdot\sigma(n)+k\cdot\rho(n)}}$. Since the nodes have IDs, the total number of protocols is at most $2^{n2^{(2t+1)k\cdot\sigma(n)+k\cdot\rho(n)}}$.

On the other hand, the number of languages on binary strings of length $n$ is exactly $2^{2^{n}}$. So, let $n_{0}$ be such that

[TABLE]

Such an $n_{0}$ exists since $\sigma(n)=o(n)$ and $\rho(n)=o(n)$, and $k$ and $t$ are constant. By the pigeon-hole principle, there exists a language on the 0/1-labeled oriented cycle $C_{n_{0}}$ that cannot be decided by any protocol in $\mbox{\sf dAM}[k](\sigma(n_{0}),\infty)$ with Arthur generating $r(n_{0})$ random bits at each interaction, and running a $t$-round verifier. Indeed, on the $n_{0}$-node oriented cycle, the verifier acts exactly the same for at least two languages ${\mathcal{L}}$ and ${\mathcal{L}}^{\prime}$, and thus is incorrect for at least one of these two languages.

Let $m$ be a nonnegative integer, and let $S(n,m)$ be the set of languages on 0/1-labeled oriented cycles with $n$ nodes that cannot be recognized by a protocol with $k=t=m$ (i.e., $m$ interactions between Arthur and Merlin, and $m$ rounds of communication between the nodes). It follows from the first part of the proof that, for every $m$, there exists $n$ such that $S(n,m)\neq\emptyset$. So, let

[TABLE]

Also, let

[TABLE]

Note that $m_{max}$ is well defined since, for every $n\geq 3$, there are languages on 0/1-labeled $C_{n}$ that cannot be decided in zero rounds without interactions with a prover (corresponding to $m=0$), and every language on $C_{n}$ is decidable in $\lceil n/2\rceil$ rounds (corresponding to $m=\lceil n/2\rceil$). Note also that, for every $n\geq 3$ and $m\geq 0$, we have

[TABLE]

Given $n$ and $m$ such that $S(n,m)\neq\emptyset$, let ${\mathcal{L}}(n,m)$ be the smallest language of $S(n,m)$ according to the lexicographic ordering of the collections of binary words of $n$ bits corresponding to the inputs in the language. Let

[TABLE]

Note that $L$ is indeed a distributed language, for it is Turing-computable. We show that

[TABLE]

Suppose, for the sake of contradiction, that ${\mathcal{L}}\in\mbox{\sf dAMH}(\sigma,\infty)$. Then there exists an interactive protocol $\mathcal{P}$ in $\mbox{\sf dAM}[k](\sigma,\infty)$ for ${\mathcal{L}}$, with Arthur tossing $\rho(n)$ bits at each interaction, and performing a $t$-round verification algorithm, for some $k\geq 0$ and $t\geq 0$. Let $m=\max\{k,t\}$. We have ${\mathcal{L}}\in\mbox{\sf dAM}[m](\sigma,\infty)$. Let us then consider the restriction ${\mathcal{L}}^{\prime}$ of ${\mathcal{L}}$ on the oriented cycle with $n_{min}(m)$ nodes, that is,

[TABLE]

Since ${\mathcal{L}}^{\prime}\in S(n_{min}(m),m_{max}(n_{min}(m))),$ it cannot be recognized by an interactive $\mbox{\sf dAM}[m^{\prime}](\sigma,\infty)$ protocol with a $m^{\prime}$-round verification algorithm, for $m^{\prime}=m_{max}(n_{min}(m))$. On the other hand, $m^{\prime}\geq m$, and therefore $L^{\prime}$ cannot be recognized by an interactive protocol with parameter $m$ either. In particular, ${\mathcal{L}}^{\prime}$ cannot be recognized by $\mathcal{P}$, a contradiction. Therefore ${\mathcal{L}}\notin\mbox{\sf dAM}[m](\sigma,\infty)$, from which it follows that ${\mathcal{L}}\notin\mbox{\sf dAMH}(\sigma,\infty)$, and therefore

[TABLE]

We complete the proof by noticing that every language ${\mathcal{L}}$ on 0/1-labelled oriented cycles has a 1-round locally checkable proof with $O(n)$-bit certificate, where neighboring nodes exchange $O(n)$-bit messages. That is, we observe that

[TABLE]

The certificate given to every node consists of an $n$-bit string $s=(s_{1},\dots,s_{n})$ where $s_{i}\in\{0,1\}$ is supposed to be equal to the input of $u_{i}$, for every $i=1,\dots,n$. Every node checks that this is indeed the case, and that it is given the same bit-string as the ones given to its neighbors. Finally, it checks whether $s\in{\mathcal{L}}$. If all tests are passed, it accepts, otherwise it rejects.

We complete this section by showing that, in contrast to the previous theorem, every distributed language on regular graphs with $O(1)$-bit inputs has a locally checkable proof with $O(n)$-bit certificates, and a 2-round verifier.

Theorem 5.6**.**

Every distributed language on $d$-regular graphs with $O(1)$-bit input labels belongs to $\Sigma_{1}\mbox{\sf LD}(\widetilde{O}(n),O(dn)),$ with a verifier performing two rounds.

Proof 5.7**.**

Let ${\mathcal{L}}$ be a distributed language on regular graphs, and let $(G,\mbox{\rm id},x)\in{\mathcal{L}}$. Let $d$ be the degree of $G=(V,E)$. The prover acts as follows. The set $E$ of $nd/2$ edges of $G$ is partitioned into $d$ sets $E_{1},\dots,E_{d}$, each of cardinality at most $\lceil\frac{n}{2}\rceil$. Let every node $u$ pick a set $E_{i}$, $i\in\{1,\dots,d\}$ uniformly at random, and let $\mathcal{E}_{u}$ be the event “the union of the sets picked by $u$’s neighbors is $E$”. We have

[TABLE]

By repeating $c\log n$ times the experiment, we get

[TABLE]

It follows that $\Pr[\overline{\mathcal{E}_{u}}]\leq\frac{1}{n^{2}}$ for $c$ large enough. Hence, $\bigwedge_{u\in V}\mathcal{E}_{u}$ holds with high probability. This shows that the prover has a way to assign the sets $E_{i}$, $i=1,\dots,d$ to the nodes such that the verifier running at every node $u$ can gather the sets of edges stored at its neighbors, and reconstruct the graph $G$ from these sets.

By the same reasoning, it can be shown that the set of $n$ input labels can be split in $d$ sets $I_{1},\dots,I_{d}$, and distributed evenly to the nodes by the prover, with $O(\log n)$ sets per node, so that every node can recover the entire set of input labels from its neighbors.

Overall, with $\widetilde{O}(n)$-bit certificate, all the nodes can recover what is supposed to be the input configuration $(G,\mbox{\rm id},x)$. Every node then performs a second round, enabling all the nodes to check that they collectively agree on $(G,\mbox{\rm id},x)$. (If there is disagreement between two neighboring nodes about the given input configuration, these two nodes reject). A node that agree on $(G,\mbox{\rm id},x)$ with all its neighbors checks that this configuration agrees with its view at distance 1 in the actual network, i.e., that its incident edges and input are as specified by $(G,\mbox{\rm id},x)$. Finally, a node that passed all these test completes the verification by checking whether $(G,\mbox{\rm id},x)\in{\mathcal{L}}$, and accept or reject accordingly.

The protocol is correct as, if $(G,\mbox{\rm id},x)\notin{\mathcal{L}}$, then the verifier must provide all nodes with the same input configuration $(G^{\prime},\mbox{\rm id}^{\prime},x^{\prime})\in{\mathcal{L}}$ for expecting all nodes to accept. However, since $(G^{\prime},\mbox{\rm id}^{\prime},x^{\prime})\neq(G,\mbox{\rm id},x)$, there exists at least one node $u\in V$ satisfying either $E^{\prime}(u)\neq E(u)$ or $x^{\prime}(u)\neq x(u)$, leading this node to reject ($E^{\prime}(u)$ and $E(u)$ denotes the edges incident to $u$ in $G^{\prime}$ and $G$, respectively).

Since $\Sigma_{1}\mbox{\sf LD}\subseteq\mbox{\sf dAM}\cap\mbox{\sf dMA}$, an immediate corollary of this theorem is that every distributed language on $d$-regular graphs with $O(1)$-bit inputs belongs to $\mbox{\sf dAM}(\widetilde{O}(n),O(dn))$. Using a known RPLS protocol [16], we can also show that each such language belongs to $\mbox{\sf dMA}(\widetilde{O}(dn),O(\log n))$.