Lecture 7 — Interactive Proofs & the PCP Theorem

Course 2-INF-135/15 Pravdepodobnostné algoritmy, LS 2025/26. Source slides: RA_slidy_IPaPSPACEPCPstart_tlac.pdf (38 p., IP = PSPACE + start of PCP), RA_PCP_komplet.pdf (42 p., the full PCP proof), book chapter PCP_kniha.pdf [Crescenzi–Kann style text] (46 p., ch. 7 “The PCP theorem”). Štátnicové syllabus topics covered: interactive proofs and IP = PSPACE; the sum-check protocol and arithmetization; the PCP theorem NP = PCP[O(log n), O(1)]; the two readings of it (locally checkable proofs and hardness of approximation); the proof via linear / low-degree encodings and the composition lemma; inapproximability of Max-3-SAT and of the maximum independent set / clique.

The one-paragraph map of the whole lecture

There are two big theorems here, and they are siblings: both replace a combinatorial check (“is this formula satisfiable?”) by an algebraic one (“do these polynomials agree?”).

The first is IP = PSPACE: a polynomial-time, coin-flipping verifier chatting with an all-powerful but untrusted prover can be convinced of exactly the PSPACE statements. The engine is arithmetization — turn a Boolean formula into a polynomial — plus the sum-check protocol, where the verifier never computes a giant sum itself but forces the prover to “open up” the sum one variable at a time, spot-checking each step at a random point.

The second, the centrepiece, is the PCP theorem:

Part A — Interactive proofs and IP = PSPACE

A.1 What an interactive proof is

Picture a student (the prover $P$) trying to convince a teacher (the verifier $V$) that “$x \in L$.” It is an exam by conversation: they exchange messages, and the teacher has the last word.

• Verifier $V$ — a probabilistic, polynomial-time algorithm. It tosses private coins (the prover does not see $V$’s random bits) and sends/receives polynomially many messages of polynomial length.
• Prover $P$ — unbounded computational power, but untrusted. It will say anything to be believed.

The pair $(P,V)$ is an interactive protocol for $L$ if:

Intuition. If the statement is true, some honest prover convinces $V$ every time. If it is false, then no prover — however clever or malicious — fools $V$ more than half the time; any false “proof” gets caught by $V$’s coins with probability $\ge\tfrac12$. The private coins are the teacher’s secret: the student must commit to answers before learning what the teacher will check.

$\mathrm{IP}$ is the class of languages with such a protocol. The $\tfrac12$ is cosmetic — repeat and take majority to push the error to $2^{-k}$.

A.2 The easy half: IP ⊆ PSPACE

A PSPACE machine can simulate the whole game tree of conversations without writing it down all at once. The verifier uses $r(n)$ random bits and the prover sends messages of length $m(n)$. We want to know:

A.3 The hard half: PSPACE ⊆ IP, via the PSPACE-complete problem TQBF

It suffices to give a protocol for one PSPACE-complete problem; everything else reduces to it. That problem is TQBF (true quantified Boolean formulas):

Warm-up: arithmetization and #3SAT$_D \in$ IP

Arithmetize a Boolean formula $\varphi$ — translate logic into a polynomial $P_\varphi$ over the integers (working mod a prime later):

Example. $\varphi=(x\vee y\vee z)\wedge(\neg x\vee y\vee z)\wedge(x\vee\neg y\vee z)$ gives $P_\varphi=(1-(1-X)(1-Y)(1-Z))(1-X(1-Y)(1-Z))(1-(1-X)Y(1-Z)).$

Now #3SAT$_D$ $=\{(\Phi,K)\mid \Phi$ is a 3-CNF with exactly $K$ satisfying assignments$\}$. The number of satisfying assignments is just a sum of the polynomial over the cube:

The sum-check protocol

Setup: a polynomial $g(X_1,\dots,X_n)$ of total degree $d$, an integer $K$, a prime $p$. We want to verify

The verifier “peels one variable at a time”:

• If $n=1$: $V$ just checks $g(0)+g(1)=K$ directly and accepts/rejects.
• If $n\ge 2$: $V$ wants the univariate polynomial obtained by summing out all but the first variable,
  $$h(X_1)=\sum_{b_2}\cdots\sum_{b_n} g(X_1,b_2,\dots,b_n).$$
  $V$ asks $P$ for it. $P$ sends some univariate $s(X_1)$ (claimed to equal $h$).
• $V$ checks the consistency at the boundary: $s(0)+s(1)=K$? If not, reject.
• If yes, $V$ picks a random point $a\in_R \mathrm{GF}(p)$ and recurses: verify that
  $$s(a)=\sum_{b_2}\cdots\sum_{b_n} g(a,b_2,\dots,b_n),$$
  i.e. a sum-check on one fewer variable with new target $K':=s(a)$.

Why this is sound — the punchline. Suppose the prover lied, $s\ne h$. Two non-equal univariate polynomials of degree $\le d$ over $\mathrm{GF}(p)$ agree on at most $d$ points, so a random $a$ has $s(a)\ne h(a)$ with probability $\ge 1-d/p$. But if $s(a)\ne h(a)$, the prover is now stuck having to prove a new false statement about $g(a,\cdot)$ — the lie is pushed down one level, never erased. Over $n$ rounds,

$$\Pr[V \text{ rejects a false claim}] \ge \Big(1-\tfrac{d}{p}\Big)^{n}\ge 1-\tfrac{nd}{p},$$

which is close to $1$ once $p$ is a polynomially long prime. The prover’s only escape would be to guess $V$’s random $a$ in advance — impossible with private coins.

This is the whole soul of interactive proofs: the verifier never does the big computation; it forces the prover to reveal it step by step and audits each step at a random point.

TQBF ∈ IP — the two complications and their fixes

For $B=\forall x_1\exists x_2\cdots\Phi$, arithmetize quantifiers too: negation only on variables ($\neg x\rightsquigarrow 1-x$), then

Two things can go wrong, and the fixes are the examinable insight:

1. The numbers explode. A product of $n$ factors can reach value $O(2^{2^n})$ — doubly exponential, too big to send. Fix: work modulo a prime $p$ of polynomial bit-length. Such a $p$ exists with $A\not\equiv_p 0 \iff B$ true: if primes $p_1,\dots,p_m$ each divided $A$ then their product would divide $A$, but $p_1\cdots p_m=\Omega(2^{2^n d})$ while $A=O(2^{2^n})$ — a contradiction once we take enough primes. The prover sends $p$ together with a certificate of primality.
2. The degree explodes. Each $\prod$ over a variable can double the degree of remaining polynomials, so after many $\forall$’s the univariate messages would have exponential degree. Fix: put $B$ into “simple” form — between any variable and its own quantifier there is at most one $\forall$. Any QBF can be transformed to simple form with only polynomial growth (re-introduce a fresh copy $x_i\rightsquigarrow x_{j_i}$ after each $\forall$, enforcing equality $x_i=x_j \rightsquigarrow z_iz_j+(1-z_i)(1-z_j)$). For a simple QBF, the degree of the functional-form polynomial grows only linearly in $|B|$, so all messages stay polynomial.

Correctness bound. If $B$ is false, the verifier accepts with probability at most $t/p$, where $t$ is the degree of the functional form (linear in $|B|$). Polynomial $t$, polynomially-long prime $p$ ⇒ negligible error. Hence $\mathrm{PSPACE}\subseteq\mathrm{IP}$, and combined with A.2,

$$\boxed{\ \mathrm{IP}=\mathrm{PSPACE}.\ }$$

This matters for PCP because it immediately gives one boundary point of the PCP world: $\mathrm{PSPACE}\subseteq\mathrm{PCP}[\mathrm{poly},\mathrm{poly}]$ (below).

Part B — PCP: definition and meaning

B.1 The definition

A probabilistically checkable proof flips the picture from Part A: instead of a live conversation, the prover writes down a static proof string $\Pi$ once, and the verifier gets random access to it (an oracle) but only peeks at a few bits.

$L\in\mathrm{PCP}[r(n),q(n)]$ if there is a probabilistic polynomial-time verifier $V$ that, on input $x$, uses $r(|x|)$ random bits and reads $q(|x|)$ bits of a proof $\Pi$, with

$$x\in L \Rightarrow \exists\pi:\ \Pr_r[V(x,r)=1]=1 \quad\text{(completeness)},$$

$$x\notin L \Rightarrow \forall\pi:\ \Pr_r[V(x,r)=1]<\tfrac12 \quad\text{(soundness)}.$$

The two parameters are randomness $r$ and query complexity $q$ — and we measure efficiency by how stingy the verifier is with both.

A first example — PCP for graph non-isomorphism (GNI)

You are given two $n$-vertex graphs $G_0,G_1$ and want to be convinced they are not isomorphic. The proof $\Pi$ is a giant table: for every $n$-vertex graph $H$, $\Pi(H)$ records which of $G_0,G_1$ it is isomorphic to (if any):

Why it works. If $G_0\not\cong G_1$, an honest table answers correctly and $V$ always accepts. If $G_0\cong G_1$, then $H=\tau(G_b)$ is isomorphic to both, so its scrambled form leaks no information about which $b$ was used — any table is right with probability exactly $\tfrac12$. The randomness hides $b$; the verifier reads a single table entry.

B.2 The theorem and its two readings

Reading 1 — locally checkable proofs. Every NP statement has a polynomial-length proof that can be verified by tossing $O(\log n)$ coins and reading a constant number of its symbols. Correctness, normally a global property of a proof, can be made local and spot-checkable: a wrong proof is wrong “almost everywhere,” so a constant-size random sample exposes it.

Reading 2 — hardness of approximation (the exam’s favourite). PCP is equivalent to a gap-producing reduction:

Theorem. There is a constant $\rho<1$ such that for every $L\in\mathrm{NP}$ there is a polynomial-time $f$ mapping instances to 3-CNF formulas with

$$x\in L \Rightarrow \mathrm{val}(f(x))=1, \qquad x\notin L \Rightarrow \mathrm{val}(f(x))<\rho,$$

where $\mathrm{val}$ is the maximum fraction of simultaneously satisfiable clauses.

The reduction creates a gap: satisfiable formulas stay fully satisfiable, unsatisfiable ones become robustly unsatisfiable (you cannot even get a $\rho$-fraction). Consequences:

• Corollary. If there is a $\rho$-approximation algorithm for Max-3-SAT, then $\mathrm{P}=\mathrm{NP}$. (Run it on $f(x)$: a value $\ge\rho$ means $x\in L$, $<\rho$ means $x\notin L$ — the gap is exactly what an approximation could not cross.)
• Hence (Kráľovič’s inapproximability results): if $\mathrm{P}\ne\mathrm{NP}$, then Max-3-SAT $\notin$ PTAS and MaxClique $\notin$ PTAS — no polynomial-time approximation scheme exists. We work the independent-set / clique version out fully in Part D, because two of the practice exams ask for exactly it.

B.3 The easy containments (and the exam-2 problem)

These you can prove by hand; they bracket the theorem and one of them is a standalone exam question.

• $\mathrm{PSPACE}\subseteq\mathrm{PCP}[\mathrm{poly},\mathrm{poly}]$ — because $\mathrm{IP}=\mathrm{PSPACE}$ (Part A) and an interactive proof with public randomness can be written down as a checkable proof.
• The proof is never longer than it needs to be: the only proof positions that can ever be read are those queried for some random string, so effectively
  $$|\Pi|\le q(n)\cdot 2^{r(n)}.$$
• $\mathrm{PCP}[r,q]\subseteq \mathrm{NTIME}\big(2^{O(r)}\cdot q\big)$ — a nondeterministic machine guesses the (length-$\le q\,2^{r}$) proof, then enumerates all $2^{r}$ random strings and accepts iff $V$ accepts on every one.
• $\mathrm{PCP}[\log n,1]\subseteq\mathrm{NP}$ — special case: $2^{O(\log n)}=\mathrm{poly}$, so the guessed proof is polynomial and all $\mathrm{poly}$ random strings are checkable in polynomial time.
• $\mathrm{PCP}[\log n,\mathrm{poly}]=\mathrm{NP}$ — the matching lower bound; “$\supseteq$” is the harder construction (Part C, short proofs).

We may always assume soundness $\tfrac12$ (amplify to $2^{-c}$ by repeating $c$ times) and a non-adaptive verifier — one that fixes all its queries up front as a function of its coins, rather than letting later queries depend on earlier answers. (With a constant number of queries, adaptive vs. non-adaptive makes no difference.)

Exam connection (exam-2, Problem 2). “Show, without invoking the PCP theorem, that if 3-SAT $\in \mathrm{PCP}[\tfrac12\log n,\ c]$ then $\mathrm{P}=\mathrm{NP}$.” The mechanism is the bound above. With $r=\tfrac12\log n$ there are only $2^{r}=\sqrt n$ random strings, and the verifier reads $c$ bits for each, so only $\le c\sqrt n$ proof positions matter. Each random string $\rho$ imposes one constraint on $c$ of those proof bits; perfect completeness means $x\in\text{3-SAT}$ iff there is an assignment to those proof bits satisfying all $\sqrt n$ constraints, while $x\notin\text{3-SAT}$ leaves every assignment failing more than half of them. So 3-SAT reduces to deciding a tiny constraint system over $O(\sqrt n)$ Boolean variables — and the point the examiner wants is that the proof has collapsed to polynomial size with a verifier whose coins are almost gone, turning the probabilistic check into a deterministic search you can carry out directly. State the key inequality $|\Pi|\le q\cdot 2^{r}$, build the constraint system, and argue the gap makes the decision unambiguous.

B.4 The bridge: NP ⊆ PCP[log n, 1] ⟺ 3-SAT has an amplifying reduction

This lemma is how PCP and inapproximability are literally the same statement.

A polynomial-time $f$ on 3-CNF formulas is a $c$-amplifying reduction (for $c<1$) if

$$\mathrm{maxSAT}(\varphi)=1 \Rightarrow \mathrm{maxSAT}(f(\varphi))=1, \qquad \mathrm{maxSAT}(\varphi)<1 \Rightarrow \mathrm{maxSAT}(f(\varphi))<c.$$

Satisfiable stays satisfiable; unsatisfiable becomes “at most a $c$-fraction satisfiable.”

Lemma. $\mathrm{NP}\subseteq\mathrm{PCP}[\log n,1]$ $\iff$ 3-SAT has an amplifying reduction.

($\Leftarrow$) reduction ⇒ verifier. Given $f$, the proof is a satisfying assignment of $f(\varphi)$. The verifier picks a random clause of $f(\varphi)$ (that costs $O(\log n)$ coins), reads the 3 bits $\Pi(i),\Pi(j),\Pi(k)$ for its variables, and checks the clause is satisfied. If $\varphi\in$ SAT, some assignment satisfies all clauses ⇒ accept always. If $\varphi\notin$ SAT, at most a $c$-fraction of clauses are satisfied ⇒ reject probability $\ge 1-c$; repeat to push acceptance below $\tfrac12$. Constant queries, log randomness. ✓

($\Rightarrow$) verifier ⇒ reduction. Given a verifier $V$ for SAT using $c\log n$ coins and $t$ queries, construct $f$: for each random string $r\in\{0,1\}^{c\log n}$, the queried positions $i_1,\dots,i_t$ and the accept predicate define a Boolean function $\varphi'_r(x_{i_1},\dots,x_{i_t})$ with $\varphi'_r=1\iff V$ accepts on $r$. Convert each $\varphi'_r$ into 3-CNF $\varphi_r$ (auxiliary variables), and set

Part C — Proving the PCP theorem

C.1 The three-step plan

1. Every NP problem has an exponentially long proof checkable with $O(1)$ queries. Tool: arithmetization of Boolean formulas + linear functions and self-correction. Result: $\mathrm{NP}\subseteq\mathrm{PCP}[O(n^3),O(1)]$.
2. Every NP problem has a polynomially long proof checkable with polylog queries. Tool: low-degree polynomials (two distinct low-degree polynomials agree on few points)
   • low-degree test + sum-check. Result: $\mathrm{NP}\subseteq\mathrm{PCP}[O(\log n),O(\log^4 n)]$.
3. The composition lemma glues a verifier inside another to combine “log randomness” with “constant queries,” landing on $\mathrm{NP}=\mathrm{PCP}[O(\log n),O(1)]$.

The recurring slogans:

• Arithmetization reduces satisfiability to an algebraic property.
• Linear / low-degree functions are testable (you can check from a few samples that a table is close to one) and self-correctable (you can recover a true value despite errors).
• It is enough to do this for the NP-complete 3-CNF-SAT — validity there gives validity for all of NP by reduction.

We need one shared definition first.

$\delta$-close functions. For finite sets $D,R$ and $0<\delta<1$, functions $f,g:D\to R$ are $\delta$-close if they disagree on at most a $\delta$-fraction of inputs:

$$\Pr_{x\in D}[\,f(x)\ne g(x)\,]\le\delta.$$

A linear function $f:\mathbb{Z}_2^m\to\mathbb{Z}_2$ satisfies $f(x+y)=f(x)+f(y)$ for all $x,y$. (Over $\mathbb{Z}_2$, this is the same as a degree-1 polynomial, i.e. $f(x)=a\cdot x$.)

C.2 The long proof: NP ⊆ PCP[O(n³), O(1)]

C.2.1 The linearity test (Blum–Luby–Rubinfeld) and self-correction

Lemma (closeness to linear). Let $\delta<\tfrac13$ and $g:\mathbb{Z}_2^m\to\mathbb{Z}_2$ with $\Pr_{x,y}[\,g(x+y)\ne g(x)+g(y)\,]\le \delta/2$. Then there is a linear $f$ that is $\delta$-close to $g$.

The witness is the majority vote:

Program LT (linearity test). Repeat $k=\lceil 2/\delta\rceil$ times: pick random $x,y\in\mathbb{Z}_2^m$, and if $g(x)+g(y)\ne g(x+y)$ return NO; else YES.

• If $g$ is linear ⇒ always YES.
• If $g$ is not $\delta$-close to any linear function ⇒ $\Pr[\text{NO}]\ge\tfrac12$.

Program SCF (self-correction). To read the true value $f(x)$ from a corrupted table $g$ that is $\delta$-close to linear $f$: pick random $y$ and return $g(x+y)-g(y)$.

• Returns $f(x)$ with probability $\ge 1-2\delta$ (because both $y$ and $x+y$ are uniform, each is a good point except with probability $\delta$, and $f$ linear ⇒ $f(x)=f(x+y)-f(y)$).

Why self-correction, not just “read $g(x)$”? Reading $g(x)$ directly errs with probability $\le\delta$ — better than $2\delta$. But SCF randomizes the access: the point actually queried, $x+y$, is uniformly random, so different corrected reads are (nearly) independent. That independence is what lets us union-bound over several reads in the consistency and satisfiability tests.

C.2.2 Arithmetization for the long proof

Turn 3-SAT $\varphi$ into a degree-3 polynomial $P_\varphi$ over $\mathbb{Z}_2$:

The key structural theorem lets us evaluate any degree-3 polynomial using three linear functions of the assignment:

Theorem. For $a=(a_1,\dots,a_n)\in\mathbb{Z}_2^n$ there exist three linear functions $A_a:\mathbb{Z}_2^n\to\mathbb{Z}_2$, $B_a:\mathbb{Z}_2^{n^2}\to\mathbb{Z}_2$, $C_a:\mathbb{Z}_2^{n^3}\to\mathbb{Z}_2$, such that every degree-3 polynomial $p$ over $n$ variables satisfies

$$p(a_1,\dots,a_n)=\alpha_p+A_a(q_{p,1})+B_a(q_{p,2})+C_a(q_{p,3}),$$

where $\alpha_p$ and the index-vectors $q_{p,i}$ depend only on $p$ and are polynomial-time computable.

Here $A_a(x)=\sum_i a_i x_i$ evaluates linear terms, $B_a(y)=\sum_{i,j}a_ia_j y_{ij}$ the quadratic terms, $C_a(z)=\sum_{i,j,k}a_ia_ja_k z_{ijk}$ the cubic terms; and $q_{p,i}$ is the characteristic vector of which monomials appear in $p$. The clever part: $A_a,B_a,C_a$ depend only on the assignment $a$ (so they can be pre-tabulated as the proof), while the query vectors $q_{p,i}$ depend only on the polynomial $p$ (so the verifier computes them itself).

C.2.3 The verifier (Π = three linear-function tables)

The proof is a concatenation $\Pi=A'\,B'\,C'$ where $|A'|=2^n$, $|B'|=2^{n^2}$, $|C'|=2^{n^3}$ — the full value-tables of $A_a,B_a,C_a$ for the (claimed) satisfying $a$. The verifier runs three checks:

1. Linearity (Program LT on each of $A',B',C'$): each is $\delta$-close to some linear function — else caught with probability $\ge\tfrac12$.
2. Consistency (Program CT): even if all three are linear, they must come from the same $a$, i.e. $\tilde b_{(i-1)n+j}=\tilde a_i\tilde a_j$ and $\tilde c_{(i-1)n^2+(j-1)n+k}=\tilde a_i\tilde a_j\tilde a_k$. CT picks random $x,x'$, uses SCF to read $a=A'(x)$, $a'=A'(x')$, $b=B'(x\circ x')$ (where $(x\circ x')_{(i-1)n+j}=x_ix'_j$), and checks $a\cdot a'=b$; similarly checks $A'\cdot B'$ vs $C'$. (SCF’s randomization is what makes the three reads independent enough to bound the error.)

   Lemma. For $\delta<\tfrac{1}{24}$ there is a constant $k$ so that if no single $a$ makes $A',B',C'$ $\delta$-close to the linear functions with coefficients $a,\ a\circ a,\ a\circ a\circ a$, then one of $k$ runs of LT/CT returns NO with probability $\ge 1-\delta$.

3. Satisfiability (Program CSAT): pick random $r\in\mathbb{Z}_2^m$, compute $\alpha_{P^r_\varphi}$ and the query vectors, use SCF to read $a=A'(q_1)$, $b=B'(q_2)$, $c=C'(q_3)$, and check whether $\alpha+a+b+c=1$ (i.e. $P^r_\varphi(a)=1$, a violation). If so return NO. An unsatisfying $a$ is caught with probability $\ge\tfrac12$ by the random $r$.

Each test uses $O(n^3)$ random bits (a 3-CNF has $\le n^3$ clauses) and $O(1)$ queries; repeat a constant number of times. Therefore

C.3 The short proof: NP ⊆ PCP[O(log n), O(log⁴ n)]

The same three-part skeleton (testable encoding → arithmetize → assemble), but the linear functions are replaced by low-degree polynomials over a larger field, which encode the same information in polynomial length.

Parameters (worth memorizing the scale)

C.3.1 Why polynomials encode well — the agreement lemma

Lemma (Schwartz–Zippel-style). Two distinct polynomials in $\mathcal F_{d,k}$ agree on at most $d\,q^{k-1}$ of the $q^k$ points of $F^k$; equivalently a nonzero degree-$d$ polynomial has $\le d q^{k-1}$ roots.

So the agreement fraction is $\le d/q < \tfrac12$. Consequently a function that is $\delta$-close (for $\delta<\tfrac14$) to some low-degree polynomial is close to a unique one: polynomials make good error-correcting codes.

Low-degree extension (the encoding). A satisfying assignment is a function $a:H^k\to\{0,1\}$ (we use $|H^k|\ge n$, so $k$-tuples of $H$ index the $n$ bits). Its encoding is the unique low-degree polynomial agreeing with it on $H^k$:

Theorem. For $f:H^t\to\{0,1\}$ there is a unique $p_f\in\mathcal F_{t|H|,t}$ with $p_f(y)=f(y)$ for all $y\in H^t$, namely $p_f(x)=\sum_{h\in H^t}S_h(x)f(h)$, where the selector $S_h$ is $1$ at $h$ and $0$ on the rest of $H^t$.

This encodes $n$ bits as $q^k$ field elements — a polynomial blow-up (vs. $2^n$ before). A correct proof is exactly a low-degree polynomial encoding a satisfying assignment.

C.3.2 The low-degree test and its correction

A polynomial restricted to any line $\ell_{b,s}=\{b+st\mid t\in F\}$ is a univariate degree-$d$ polynomial — and conversely:

Program LDT. With an auxiliary line-table $T:F^{2k}\to F^{d+1}$ supplying, for each line, the coefficients of the best-fitting univariate degree-$d$ polynomial $P_{b,s}$: repeat $\lceil 3/\delta\rceil$ times — pick a random line $(b,s)$ and random point $t$, and reject if $P_{b,s}(t)\ne g(b+st)$.

• $g\in\mathcal F_{d,k}$ ⇒ a line-table makes LDT always accept.
• $g$ not $\delta$-close to any degree-$d$ polynomial ⇒ for every $T$, LDT rejects with probability $\ge\tfrac34$. (Relies on a deep but here-omitted theorem: high success rate on random lines ⇒ globally close to a low-degree polynomial.)
• Cost: $O(k\log q)$ random bits, $O(1)$ queries to $g$ and $T$.

Program CLDP (correction, the analogue of SCF): to read $f(x)$, pick a random line through $x$, check the table agrees at a random point, and return $P_{x,s}(0)$. It returns the true $f(x)$ with probability $\ge 1-2\sqrt\delta-d/q$.

C.3.3 Arithmetization revisited — characteristic functions and zero-testers

As before, each clause becomes one of four degree-3 monomials $p_0,\dots,p_3$ (indexed by how many variables are negated; assume negated variables first and indices increasing). Define clause-characteristic functions $\chi^j_\varphi:H^{3k}\to\{0,1\}$:

Zero-testers — turn “identically zero” into “a sum is zero.”

Lemma. There is a family $R$ of $q^{3k}$ polynomials (zero-testers) in $\mathcal F_{3k|H|,3k}$ such that for any $f:H^{3k}\to F$ not identically zero,

$$\Pr_{R\in\mathcal R}\Big[\textstyle\sum_{h\in H^{3k}}R(h)f(h)=0\Big]\le \tfrac{3}{100}.$$

Constructible in time $q^{O(k)}=\mathrm{poly}(n)$.

Idea: form $g(t_1,\dots,t_{3k})=\sum_h f(h)\prod_i t_i^{h_i}$; then $g\equiv 0\iff f\equiv 0$ on $H^{3k}$, and by the agreement lemma a nonzero $g$ vanishes on $\le 3|H|k/q<\tfrac{3}{100}$ of $F^{3k}$. Each $R_b(x)=s(b,x)$ has $\sum_h R_b(h)f(h)=g(b)$, so a random $b$ (i.e. random zero-tester) catches a nonzero $f$.

C.3.4 The sum-check (again!), and assembling the short verifier

Checking $g^j_\varphi\equiv 0$ now reduces to checking a single sum $\sum_{h\in H^{3k}} R(h)g^j_\varphi(h)=0$, done by sum-check — the same peel-one-variable idea as Part A, but now over the field $F$ and the cube $H^{3k}$. Define partial-sum polynomials $g_i(x_1,\dots,x_i)=\sum_{y_{i+1},\dots,y_{3k}\in H} f(x_1,\dots,x_i,y_{i+1},\dots,y_{3k})$, which satisfy $g_i(x_1,\dots,x_i)=\sum_{x\in H} g_{i+1}(x_1,\dots,x_i,x)$ and $\sum_{h}f(h)=\sum_{x_1\in H}g_1(x_1)$.