Lecture 6 — Complexity Theory II: Interactive Proofs, IP=PSPACE, and PCP

Course 2-INF-135/15 Pravdepodobnostné algoritmy, LS 2025/26. Source slides: RA_zlozitostII_tlac.pdf (34 pages) and RA_slidy_IPaPSPACEPCPstart_tlac.pdf (38 pages). Štátnicové syllabus topics covered here: the polynomial hierarchy; BPP inside the hierarchy (Sipser–Gács $\mathrm{BPP}\subseteq\Sigma_2^p\cap\Pi_2^p$); interactive proofs IP, public vs. private coins, Arthur–Merlin classes AM/MA; graph non-isomorphism $\mathrm{GNI}\in\mathrm{AM}[2]$ and the set–lower-bound protocol; $\mathrm{IP}=\mathrm{PSPACE}$ via arithmetization and SumCheck; the PCP theorem $\mathrm{NP}=\mathrm{PCP}[\log n,O(1)]$, linearity testing, self-correction, and inapproximability.

The one-paragraph map of the whole lecture

So far “randomness” lived inside the algorithm. This lecture puts randomness inside a verifier and asks what a coin-flipping checker can be convinced of. Three movements, each a famous theorem.

1. Where does BPP sit? A randomized decider with two-sided error is not obviously anywhere in the classical hierarchy. Sipser–Gács pins it down: $\mathrm{BPP} \subseteq \Sigma_2^p \cap \Pi_2^p$ — only two quantifier alternations above P. The whole proof is one clever idea: a large set of random witnesses can be shifted a few times to cover the entire cube, a small one never can.

2. What can a prover convince a randomized verifier of? If the prover is all-powerful and the verifier flips coins and interacts, the answer is astonishingly large: $\mathrm{IP}=\mathrm{PSPACE}$ (Shamir). The engine is arithmetization — turn a Boolean formula into a polynomial — plus the SumCheck protocol, where the verifier pins down a giant exponential sum by asking for one low-degree polynomial per variable and spot-checking it at a random point. The same idea handles graph non-isomorphism cheaply ($\mathrm{GNI}\in \mathrm{AM}$), which is evidence that graph isomorphism is not NP-complete.

3. How short and how local can a proof be? Shockingly local. The PCP theorem says $\mathrm{NP}=\mathrm{PCP}[O(\log n),O(1)]$: every NP statement has a proof you can verify by flipping $O(\log n)$ coins and reading only a constant number of bits. Its alter ego is the hardness of approximation: getting a good approximation for Max-3-SAT (or Max-Clique / Independent Set) is as hard as solving it exactly. We build the bottom layer by hand: linearity testing, self-correction, and arithmetization give $\mathrm{NP}\subseteq \mathrm{PCP}[O(n^3),O(1)]$.

The unifying thread: arithmetization + a random spot-check. Convert “is this formula satisfied / how many ways” into “does this polynomial equal that value,” then exploit the one magic fact about low-degree polynomials — two different degree-$d$ polynomials agree on at most $d$ points, so a random point exposes any lie.

Part I — The polynomial hierarchy and BPP

1. The polynomial hierarchy (PH)

NP is “$\exists$ a short witness, checkable in poly time.” coNP is “$\forall$ short witnesses…”. The polynomial hierarchy is what you get by stacking quantifier alternations. Fix a poly-time machine $M$ and a polynomial $q$.

In general $L\in\Sigma_i^p$ if there is a poly-time $M$ and polynomial $q$ with

with $i$ alternating quantifiers (the $u_j\in\{0,1\}^{q(|x|)}$), starting with $\exists$. The class $\Pi_i^p = \mathrm{co}\Sigma_i^p$ starts with $\forall$. Then

Intuition. Think of a two-player game with a bounded number of moves. “$\exists y\,\forall z$” is “I (the prover) make a move $y$; you (the refuter) reply $z$; I win iff $M$ accepts.” $\Sigma_i$ = the existential player moves first and the game lasts $i$ rounds. PH measures how many rounds of this debate you need.

A concrete $\Sigma_2^p$ statement worth keeping: “$k$ is the size of the maximum independent set.” “$\exists$ an IS of size $k$” is plain NP. “$k$ is the maximum” needs a second quantifier: $\exists$ an IS of size $k$ such that $\forall$ vertex sets of size $k+1$, that set is not independent — an $\exists\forall$, i.e. $\Sigma_2^p$ statement.

Punchline — the collapse principle. The hierarchy is believed to be strict (infinitely many genuinely harder levels), but it is fragile from below:

$$\Sigma_i^p=\Pi_i^p \ \Rightarrow\ \mathrm{PH}=\Sigma_i^p \quad(\text{collapse to level }i), \qquad \mathrm{P}=\mathrm{NP}\ \Rightarrow\ \mathrm{PH}=\mathrm{P}.$$

One coincidence anywhere makes everything above it cave in. “PH collapses” is therefore the standard way to say “this would be a shocking coincidence” — and it is exactly the currency we will pay in §6 (if GI were NP-complete, PH collapses).

2. Adleman & the target: where is BPP?

Two facts frame the question. First, the easy non-uniform bound (proved earlier in the course):

Theorem (Adleman). $\mathrm{BPP}\subseteq\mathrm{P/poly}$.

i.e. with polynomial advice (a good random string hard-wired per input length), randomness is free. But P/poly contains undecidable languages — it is too coarse to say BPP is “almost P.” We want a uniform bound. The headline:

Theorem (Sipser–Gács–Lautemann). $\ \mathrm{BPP}\subseteq\Sigma_2^p\cap\Pi_2^p.$

So a two-sided-error randomized class sits just two alternations above P — strong evidence BPP is genuinely low (and consistent with the belief BPP = P).

3. The Sipser–Gács proof — covering the cube by shifts

Let $M$ be a BPP machine for $L$ using $m=p(n)$ random bits. First amplify the success probability (run many times, majority vote) until the error is below $2^{-n}$:

where $S_x=\{r\in\{0,1\}^m : M(x,r)=1\}$ is the set of accepting random strings. So “$x\in L$” $\approx$ “$S_x$ is almost everything”; “$x\notin L$” $\approx$ “$S_x$ is a tiny $2^{-n}$ sliver.”

The trick is to detect “big vs. tiny” with two quantifiers using XOR-shifts. For $t\in\{0,1\}^m$ let $S_x\oplus t=\{r\oplus t : r\in S_x\}$ — the set translated by $t$ (a bijection of the cube, so $|S_x\oplus t|=|S_x|$). Set $k=\lceil m/n\rceil$.

Claim. $x\in L \iff \exists\,t_0,\dots,t_k\in\{0,1\}^m\ \forall r\in\{0,1\}^m:\ \displaystyle\bigvee_{i=0}^{k} \big[\,r\in S_x\oplus t_i\,\big]$ — i.e. a few shifts of $S_x$ cover the entire cube. Equivalently $\forall r\ \exists i:\ M(x,\,r\oplus t_i)=1$.

This is literally a $\Sigma_2^p$ formula ($\exists$ shifts $\forall r$). Two directions:

If $x\notin L$ ($S_x$ tiny), no shifts can cover. A union of $k+1$ shifts has size at most

If $x\in L$ ($S_x$ huge), random shifts cover w.h.p. Pick $t_0,\dots,t_k$ uniformly. For a fixed $r$,

Professor-pleaser — the one idea. The whole theorem is a set-size test with quantifiers: a set that fills almost the whole cube can be translated $k+1$ times to tile the cube; a set that is an exponentially small sliver provably cannot — its $k+1$ copies don’t have enough total mass. “$\exists$ shifts that cover” is a $\Sigma_2$ sentence, and because BPP is closed under complement we also get the $\Pi_2$ sentence, hence $\mathrm{BPP}\subseteq\Sigma_2^p\cap\Pi_2^p$. The probabilistic method (“failure probability $<1$ ⇒ a good object exists”) is doing the existential work — the same move as everywhere else in the course, now used to populate a quantifier.

Part II — Interactive proofs

4. What an interactive proof is

A classical NP-proof is a static string the verifier reads once. An interactive proof is a conversation: a (possibly cheating) prover $P$ of unbounded computational power tries to convince a probabilistic, polynomial-time verifier $V$ that $x\in L$. They exchange messages; the verifier has the last word.

The cast. $V$ = “the examiner”: poly-time, flips private coins. $P$ = “the student / oracle”: unlimited power, does not see $V$’s random bits (in the private-coin model). The verifier must be convincible by a truthful prover and un-foolable by a lying one.

$\mathrm{IP}$ = languages with such a protocol (poly many rounds). As always, the $\tfrac23/\tfrac13$ gap can be amplified to $1-2^{-n}/2^{-n}$ by repetition.

Why this is more powerful than NP. In NP the prover commits to one fixed proof. Here the verifier asks random, unpredictable questions: the prover would have to have prepared a consistent answer to all of them at once, which a cheating prover cannot. The randomness is the verifier’s leverage. (NP = IP with zero coins and one message.)

5. Public vs. private coins; Arthur–Merlin

The protocol above uses private coins: $P$ never learns $r$. A weaker-looking model uses public coins — the verifier’s messages are its random bits, sent in the clear. This is the Arthur–Merlin model (Arthur = the poor mortal king who can only flip coins; Merlin = the all-knowing wizard/prover).

• $\mathrm{MA}$ (“Merlin then Arthur”): Merlin sends a proof $y$, then Arthur flips $z$ and checks.
  $$x\in L \Rightarrow \exists y\ \Pr_z[V(x,y,z)=1]\ge\tfrac23,\qquad x\notin L \Rightarrow \forall y\ \Pr_z[V(x,y,z)=1]<\tfrac13.$$
• $\mathrm{AM}=\mathrm{AM}[2]$ (“Arthur then Merlin”): Arthur flips $y$ and sends it, Merlin replies $z$, Arthur checks deterministically.
  $$x\in L \Rightarrow \Pr_y[\exists z\ V(x,y,z)=1]\ge\tfrac23,\qquad x\notin L \Rightarrow \Pr_y[\forall z\ V(x,y,z)=0\ \text{w.h.p.}].$$

Public coins look strictly weaker — surely hiding the coins helps the verifier? The surprise:

Theorem (Goldwasser–Sipser). $\ \mathrm{IP}[k]\subseteq\mathrm{AM}[k+2].$ Private coins buy almost nothing: any private-coin protocol becomes a public-coin one with two extra rounds.

The mechanism: instead of secretly tossing $r$ and acting on it, Arthur tosses public coins, Merlin is then asked to certify properties of those coins (e.g. “this random hash hit the set”) without further use of hidden randomness. The set–lower-bound protocol below is exactly this in action.

6. Graph Non-Isomorphism is in AM — the set lower-bound protocol

The poster child: GNI (given $G_1,G_2$, decide $G_1\not\cong G_2$). GNI is in coNP (a single isomorphism refutes “non-isomorphic”), but no short certificate of non-isomorphism is known — yet it has a 2-message Arthur–Merlin proof.

Theorem. $\ \mathrm{GNI}\in\mathrm{AM}[2].$

The idea: count by hashing. Consider the set of “graphs reachable from the inputs together with a witnessing automorphism”:

Set lower-bound problem. $P,V$ both know a set $S\subseteq\{0,1\}^m$ (membership in $S$ is certifiable) and a threshold $K$. We want a protocol where

• if $|S|\ge K$, the prover convinces $V$ w.h.p.;
• if $|S|\le K/2$, $V$ rejects w.h.p. (Here $K=2\cdot n!$ vs. $|S|=n!=K/2$.)

The protocol uses pairwise-independent (universal) hashing. Pick $k$ with $2^{k-2}<K\le 2^{k-1}$ and a hash family $\mathcal H(m,k)$ of functions $h:\{0,1\}^m\to\{0,1\}^k$ that is pairwise independent: for any $x\ne x'$, the pair $(h(x),h(x'))$ is uniform on $\{0,1\}^k\times\{0,1\}^k$.

Protocol (one round, public coin).

1. Arthur picks $h\in_R \mathcal H(m,k)$ and $y\in_R\{0,1\}^k$, sends $(h,y)$.
2. Merlin sends some $x\in S$ with $h(x)=y$, plus a certificate that $x\in S$.
3. Arthur accepts iff the certificate checks and $h(x)=y$.

Arthur is asking: “does the random hash bucket $y$ contain an element of $S$?” A big $S$ hits a random bucket; a small $S$ usually misses.

Lemma. Let $h\in\mathcal H(m,k)$, $S\subseteq\{0,1\}^m$ with $|S|\le 2^{k-1}$, and $p=|S|/2^k$. Then

$$p\ \ge\ \Pr_{h,y}[\exists x\in S:\ h(x)=y]\ \ge\ \tfrac34\,p.$$

(Even pointwise: for every fixed $y$, $\Pr_h[\exists x\in S:h(x)=y]\ge \tfrac34 p$.)

Proof of the lower bound (inclusion–exclusion / Bonferroni). Let $E_x$ be the event $h(x)=y$. Then $\Pr[E_x]=2^{-k}$ and (pairwise independence) $\Pr[E_x\cap E_{x'}]=2^{-2k}$. By Bonferroni,

So the acceptance probability is $\ge\tfrac34 p$ when $|S|\ge K$ and $\le p$ when $|S|\le K/2$ (where the relevant $p$ halves) — a constant multiplicative gap. With the calibration $p^*=K/2^k$, Arthur accepts iff the fraction of accepting repetitions is at least $\tfrac{5}{8}p^*$; Chernoff over a constant number of repetitions pushes the gap to $\tfrac23$ vs. $\tfrac13$. ∎

Professor-pleaser. GNI has no known short classical certificate, yet a verifier who can flip coins decides it in two messages — by reducing “are these graphs non-isomorphic” to “is this set twice as big,” and deciding that by checking whether a random hash bucket is occupied. This is the prototype of “interaction + randomness > static proof.”

7. The structure of AM and MA

A run of small but important structural facts (state them; the proofs reuse the Sipser–Gács shift trick).

Perfect completeness. Both MA and AM can be made to never reject a true statement:

Collapse of the hierarchy of rounds. Public-coin interaction with a constant number of rounds gives nothing beyond two:

Location in PH. Unwinding the quantifiers:

Theorem (Boppana–Håstad–Zachos). If $\ \mathrm{coNP}\subseteq\mathrm{AM}$, then $\ \mathrm{PH}=\Sigma_2^p$ (the hierarchy collapses to the second level).

Idea. Since $\mathrm{AM}\subseteq\Pi_2^p$, it suffices to show $\Sigma_2^p\subseteq \mathrm{AM}$ under the hypothesis. Take $L\in\Sigma_2^p$, so $x\in L\iff\exists y,(x,y)\in L’$ with $L'\in\Pi_1^p=\mathrm{coNP}$. Build an MAM protocol: Merlin sends $y$, then run the assumed AM protocol for the coNP statement $(x,y)\in L'$. Thus $L\in \mathrm{MAM}=\mathrm{AM}, so $\Sigma_2^p\subseteq\mathrm{AM}\subseteq\Pi_2^p, forcing the collapse. ∎

Corollary (evidence GI is not NP-complete). If $\ \mathrm{GI}\in\mathrm{NPC}$, then $\ \mathrm{PH}=\Sigma_2^p$.

Why: if GI were NP-complete, then its complement GNI would be coNP-complete; since $\mathrm{GNI}\in\mathrm{AM}$ (§6) and AM is closed appropriately, every coNP language reduces into AM, i.e. $\mathrm{coNP}\subseteq\mathrm{AM}$, and Boppana–Håstad–Zachos collapses PH. Almost nobody believes PH collapses — so almost nobody believes GI is NP-complete. This is the precise sense in which “graph isomorphism is probably not NP-complete,” and AM is the tool that says it.

Part III — IP = PSPACE

The crowning theorem of interactive proofs: an all-powerful prover and a coin-flipping verifier can settle any problem solvable in polynomial space.

Theorem (Shamir 1990). $\ \mathrm{IP}=\mathrm{PSPACE}.$

Two inclusions.

8. The easy direction: IP ⊆ PSPACE

Given an IP protocol, we want to decide, in polynomial space, whether the best prover makes $V$ accept with probability $\ge\tfrac23$. The interaction is a game tree: at each prover move we maximize, at each verifier coin-flip we average. The verifier uses $r(n)$ private random bits and the prover sends messages of length $m(n)$; both polynomial. We can evaluate the optimal acceptance probability by recursively walking this tree — $\forall r\in\{0,1\}^{r(n)}$, simulating the $V$–$P$ communication for each prover response $m\in\{0,1\}^{m(n)}$ — reusing space across branches. Polynomial space suffices because the tree has polynomial depth and we never store a whole level. ∎

9. The hard direction: PSPACE ⊆ IP — arithmetization

We give an interactive protocol for a PSPACE-complete problem, TQBF (true fully quantified Boolean formulas). Warm up on counting first.

9a. Arithmetization — Boolean formulas become polynomials

Replace logic by arithmetic over the integers (later reduced mod a prime):

The number of satisfying assignments of $\varphi$ is then an exponential sum:

9b. The SumCheck protocol — the heart of everything

We must convince a poly-time verifier that

SumCheck (prime $p$, per-variable degree $d$).

• If $n=1$: $V$ checks $g(0)+g(1)=K$ and accepts/rejects.
• If $n\ge 2$: $V$ asks $P$ for the univariate polynomial
  $$h(X_1)=\sum_{b_2,\dots,b_n\in\{0,1\}} g(X_1,b_2,\dots,b_n).$$
  $P$ sends a polynomial $s(X_1)$ (claiming $s=h$), with $s(0)+s(1)=K$.
• $V$ rejects if $s(0)+s(1)\ne K$. Otherwise it picks a random $a\in_R\mathrm{GF}(p)$ and recurses, verifying
  $$s(a)\ \equiv_p\ \sum_{b_2,\dots,b_n\in\{0,1\}} g(a,b_2,\dots,b_n)$$
  — a SumCheck on $n-1$ variables with new target $K'=s(a)$.

Why it is sound (the magic fact). If the prover lied, $s\ne h$ as polynomials. Two distinct degree-$\le d$ polynomials agree on at most $d$ points, so a uniformly random $a$ has $s(a)=h(a)$ with probability $\le d/p$. Unless the verifier is unlucky, the lie propagates into the recursive call (now the prover must defend a false $K'=s(a)\ne h(a)$). Over $n$ levels,

$$\Pr[\,V\text{ rejects a false claim}\,]\ \ge\ \Big(1-\tfrac dp\Big)^n\ \ge\ 1-\tfrac{nd}{p},$$

which is overwhelming for a large enough prime $p$. The verifier never computes the big sum; it only forces the prover to be consistent between each claimed polynomial and a random evaluation of the next.

This already gives $\#\mathrm{3SAT}_D\in\mathrm{IP}$ — and $\#\mathrm{3SAT}_D$ is $\#$P-hard, so interactive proofs already reach the counting hierarchy.

9c. TQBF ∈ IP — handling quantifiers

A TQBF instance $B=\forall x_1\exists x_2\forall x_3\cdots\exists x_n\,\varphi(x_1,\dots,x_n)$ arithmetizes by turning quantifiers into sum and product over $\{0,1\}$:

(i) The numbers are astronomically large. A closed QBF of size $n$ can have arithmetization value as big as $O(2^{2^n})$ — because each $\forall$ (a product) can square the magnitude. (E.g. $\prod_{z_1}\cdots\prod_{z_n}(z_1+\cdots+z_n)$ produces a polynomial of degree $2^{n-1}$.) Fix: work modulo a prime $p$ of polynomial bit-length. We need $A\not\equiv_p 0 \iff B$ true, i.e. a prime that does not divide $A$. Since $A=O(2^{2^n})$ has at most $\sim 2^n$ prime factors, and there are plenty of poly-length primes, the prover can exhibit a prime $p$ (with a primality certificate) for which $A\not\equiv_p 0$. (If $p_1\cdots p_m$ all divided $A$ then $\prod p_i = \Omega(2^{2^n d})$ would exceed $A=O(2^{2^n})$ — impossible.)

(ii) The degree blows up. Products of quantifiers raise the polynomial’s degree exponentially, and SumCheck needs low degree. Fix: make the QBF “simple.”

Simple QBF: between a variable and its own quantifier there is at most one $\forall$ in between. Any QBF can be converted to a simple one with only polynomial size growth, by re-introducing each variable as a fresh copy after each $\forall$ it must “survive”:

$$\dots x\,\forall y\,Q \rightsquigarrow \dots x\dots\forall y\,\exists x_1\,(x_1=x)\wedge Q, \qquad (x_i=x_j)\rightsquigarrow z_iz_j+(1-z_i)(1-z_j).$$

Key consequence: if $B$ is simple, the degree of the polynomial describing the “functional form” grows only linearly in $|B|$ — so SumCheck stays efficient.

Correctness. With $B$ simple, the degree $t$ of the functional form is linear in $|B|$, and the per-round error $d/p$ accumulates over the rounds, giving

A worked micro-example (from the slides). For $B=\forall x_1(\neg x_1\vee \exists x_2\forall x_3(x_1\wedge x_2\vee x_3))$ the arithmetization is

$$A=\prod_{z_1}\Big[(1-z_1)+\underbrace{\sum_{z_2}\prod_{z_3}(z_1z_2+z_3)}_{A'}\Big],\qquad K\equiv_p A,\ K=2.$$

Each round: the prover sends a low-degree $g(z)$ with $g(0)\,J\,g(1)=K$ (e.g. $g(z_1)=z_1^2+1$ giving $g(0)\cdot g(1)=1\cdot2=2=K$ ✓), the verifier checks it, substitutes a random $z_1=a$, updates $K\leftarrow$ (the value forced for that branch), and recurses on the inner sum/product — peeling $z_2$ (an $\exists$, so use “+”), then $z_3$ (a $\forall$, so use “·”), until no quantifiers remain.

Professor-pleaser — the whole arithmetization philosophy. A Boolean formula is a brittle yes/no object; its polynomial lift is a rigid algebraic object that cannot lie locally. Replace “does this formula hold” with “does this polynomial sum to $K$ mod $p$,” and the single fact “a nonzero low-degree polynomial has few roots” turns one random evaluation into an avalanche of confidence. SumCheck is this fact deployed $n$ times. This same lift powers the PCP theorem next.

Part IV — Probabilistically Checkable Proofs (PCP)

10. The PCP model

Now make the verifier local: it does not read the whole proof, only a few bits of it, chosen using a few random bits.

Definition. $L\in\mathrm{PCP}[r(n),q(n)]$ if there is a probabilistic poly-time verifier $V$ with oracle access to a proof string $\Pi$ that

• uses $r(|x|)$ random bits and reads $q(|x|)$ bits of $\Pi$ (efficiency);
• $x\in L\Rightarrow \exists\Pi:\ \Pr_r[V^\Pi(x,r)=1]=1$ (completeness, perfect);
• $x\notin L\Rightarrow \forall\Pi:\ \Pr_r[V^\Pi(x,r)=1]<\tfrac12$ (soundness).

A tiny PCP for GNI (to fix the picture). Let the proof be a giant table $\Pi(H)\in\{0,1\}$ indexed by all $n$-vertex graphs, intended to say “which input is $H$ isomorphic to.” $V$ picks $b\in_R\{0,1\}$ and a random permutation $\tau$, forms $H=\tau(G_b)$, reads the single bit $\Pi(H)$, and checks $\Pi(H)=b$. If $G_0\not\cong G_1$, an honest table answers correctly every time. If $G_0\cong G_1$, the graph $H$ could equally have come from either input, so the table is wrong with probability $\ge\tfrac12$. (Reads one bit!)

11. The PCP theorem and its two faces

Theorem (PCP, Arora–Safra–Lund–Motwani–Sudan–Szegedy, 1992).

$$\boxed{\ \mathrm{NP}=\mathrm{PCP}[O(\log n),\,O(1)]\ }$$

Every NP language has proofs that a verifier checks by tossing $O(\log n)$ coins and reading a constant number of bits — yet a false statement is caught with probability $\ge\tfrac12$. Two readings, both fundamental.

Face 1 — locally checkable proofs. There exist robust proof formats: errors are “spread out” so that inspecting $O(1)$ random symbols already exposes any flaw. A correct proof passes always; a proof of a false statement fails on a constant fraction of the random checks.

Face 2 — hardness of approximation. This is the exam-relevant face.

Theorem (gap form). There is a constant $\rho<1$ such that for every $L\in\mathrm{NP}$ there is a poly-time $f$ mapping inputs to 3-CNF formulas with

$$x\in L\Rightarrow \mathrm{val}(f(x))=1,\qquad x\notin L\Rightarrow \mathrm{val}(f(x))<\rho,$$

where $\mathrm{val}$ = max fraction of simultaneously satisfiable clauses.

Corollary. There is $\rho<1$ such that a polynomial-time $\rho$-approximation for Max-3-SAT implies $\mathrm{P}=\mathrm{NP}$. Consequently (unless P = NP):

$$\mathrm{Max\text{-}3\text{-}SAT}\notin\mathrm{PTAS},\qquad \mathrm{MaxClique}\notin\mathrm{PTAS},\qquad \text{Independent Set is hard to approximate.}$$

Intuition for “gap = inapproximability.” The reduction creates a promise gap: either all clauses are satisfiable, or no assignment beats $\rho$. An approximation algorithm that always got within a factor better than $\rho$ could tell these two cases apart — and that decides the original NP problem exactly. No gap-crossing algorithm can exist unless P = NP. This is the standard route to Independent Set is hard to approximate asked on the exams.

12. Basic PCP containments

Read these as “the model is robust and the constants are tunable”:

• $\mathrm{PSPACE}\subseteq\mathrm{PCP}[\mathrm{poly},\mathrm{poly}]$ — immediate from $\mathrm{IP}=\mathrm{PSPACE}$.
• $\mathrm{PCP}[r(n),q(n)]\subseteq\mathrm{NTIME}\!\big(2^{O(r(n))}\cdot q(n)\big)$ — the proof has length $\le q(n)\cdot 2^{r(n)}$ (only that many bits are ever queried), so a nondeterministic machine can guess it. In particular $\mathrm{PCP}[\log n,1]\subseteq \mathrm{NP}$ and $\mathrm{PCP}[\log n,\mathrm{poly}]=\mathrm{NP}$.
• Soundness amplifies: repeating the verifier $c$ times drops soundness error to $1/2^c$.
• We assume a non-adaptive verifier (all queried positions fixed up front as a function of the random string); for constant query count adaptive = non-adaptive.

13. PCP ⇔ gap-amplifying reductions

The bridge between “local proofs” and “inapproximability” is a single equivalence.

Definition (gap-amplifying / $c$-zosilňujúca reduction). For $c<1$, a poly-time $f$ on 3-CNF formulas such that

$$\varphi\in\mathrm{SAT}\Rightarrow f(\varphi)\in\mathrm{SAT}\ \ (\mathrm{maxSAT}(f(\varphi))=1),$$

$$\varphi\notin\mathrm{SAT}\Rightarrow \forall\alpha:\ f(\varphi)\text{ satisfies }\le c\text{-fraction of clauses}\ \ (\mathrm{maxSAT}(f(\varphi))<c).$$

It manufactures a gap where there was none.

Lemma. $\ \mathrm{NP}\subseteq\mathrm{PCP}[\log n,1] \iff$ 3SAT has a gap-amplifying reduction.

($\Leftarrow$) gap reduction $\Rightarrow$ local verifier. Given $f$, the verifier on input $\varphi$ uses the proof $\Pi$ = a satisfying assignment of $f(\varphi)$. It picks a random clause of $f(\varphi)$ (its three variable indices $i,j,k$ need $O(\log n)$ random bits), reads the 3 bits $\Pi(i),\Pi(j),\Pi(k)$, and checks the clause. If $\varphi\in\mathrm{SAT}$, $f(\varphi)$ is satisfiable, so an honest $\Pi$ passes always. If $\varphi\notin\mathrm{SAT}$, every assignment leaves $\ge(1-c)$ of the clauses unsatisfied, so a random clause rejects with probability $\ge 1-c$ — amplify to $\tfrac12$. ($O(\log n)$ coins, $3$ queries. ✓)

($\Rightarrow$) local verifier $\Rightarrow$ gap reduction. Take $V$ for SAT using $c\log n$ random bits and $t$ queries. For each random string $r\in\{0,1\}^{c\log n}$ (there are only polynomially many), determine the queried positions $i_1,\dots,i_t$ and the predicate “$V$ accepts,” build a CNF $\varphi'_r(x_{i_1},\dots,x_{i_t})$ that is true iff $V(\varphi,r,\cdot)$ accepts, convert it to 3-CNF $\varphi_r$ with auxiliary variables, and set

Punchline. “Locally checkable proof” and “gap reduction” are literally the same object viewed two ways: the verifier’s accepting condition on a random check is a clause, and “caught with constant probability” is “constant fraction of clauses violated.” This is why the PCP theorem and inapproximability are one statement.

14. Building the bottom layer by hand: NP ⊆ PCP[O(n³), O(1)]

The full PCP theorem composes three pieces:

1. Exponentially long proof, $O(1)$ queries — via arithmetization (this section).
2. Polynomially long proof, polylog queries — via low-degree polynomial equality tests.
3. A composition lemma stitching (1) into (2) to reach $O(\log n)$ coins, $O(1)$ queries.

We construct step 1: a constant-query verifier for 3-SAT with an exponential proof. The tools are linear functions and their testability.

14a. δ-close functions, linear functions

For finite $D,R$ and $f,g:D\to R$, write $\Pr_{x\in D}\{P(x)\}=|\{x:P(x)\}|/|D|$. Then $f,g$ are $\delta$-close if

Lemma (Blum–Luby–Rubinfeld). Let $\delta<\tfrac13$ and suppose $g:\mathbb Z_2^m\to\mathbb Z_2$ satisfies $\Pr_{x,y}[\,g(x+y)\ne g(x)+g(y)\,]\le\delta/2$. Then there is a linear $f$ that is $\delta$-close to $g$, namely the “plurality vote”

$$f(x):=\text{the }b\text{ for which } \Pr_{y}\big[g(x+y)-g(y)=b\big]\ge\tfrac12.$$

The proof has three beats: (1) $f,g$ are $\delta$-close (else the linearity defect would exceed $\delta/2$, contradiction); (2) the vote is overwhelming, $p_a:=\Pr_x[f(a)=g(a+x)-g(x)]\ge 1-\delta$ (bootstrapped from $\ge\tfrac12$ using a pairing/second-moment argument $1-\delta\le p_a^2+(1-p_a)^2\le p_a$); (3) $f$ is linear, because for fixed $a,b$,