Tangled Interactive Proofs

We present a formalism to distribute an interactive proof between multiple interacting verifiers. Each verifier has a belief as to whether the claim to be proven is true or false, and verifiers convince one another based on input from a prover/oracle subject to a deformation parameter $d\in (0,1)$ which introduces `noise' into the system. Usual interactive proofs are recovered at the limit $d\to 1$. The utility of our theory is demonstrated by a network of nonadaptive 3-bit query PCP verifiers whose resulting soundness improves over the best known result for a single verifier of this class. There is a natural equivalence relation on such `tangled interactive proofs' stemming from their analogy with low-dimensional topological objects. Two such proofs are considered equivalent if, roughly, one can be completely reconstructed from the other. This induces a notion of zero knowledge for our tangled interactive proofs.

1. Introduction 1.1.A network of interacting verifiers.The decision of a crowd can converge to a correct answer even when each individual has limited knowledge.This phenomenon is known as wisdom of the crowds (Surowiecki, 2005).In line with 'the many being smarter than the few', we extend the notion of interactive proof systems (Goldwasser, 1989) to a system in which a collection of verifiers interact to prove a claim together.Such a crowd of verifiers can collaborate to prove more than could be proven by any individual verifier in the crowd.
Consider a crowd of people called verifiers amongst whom rumours propagate about the veracity of a claim.For concreteness, we take the claim to be that a given word x is an element of a given set L called a language.At each discrete time t = 0, 1, 2, . .., one verifier called the agent at time t may choose to share a rumour with any number of other verifiers called patients at time t.Whether or not patient W 's belief changes as a result of hearing a rumour from agent V depends on the content the rumour (does the rumour state x ∈ L or does it state x / ∈ L), on chance (probability), and on input from the prover which has access to a knowledgeable entity called an oracle.Verifiers are memoryless and have no communication besides rumour sharing and prover consultation (or, in Section 5, direct oracle consultation).A verifier may be a patient at some times and an agent at other times.
Figure 1 illustrates the propagation of beliefs in a group of four people A, B, C, and D. An arrow going between any two cells indicates the two people have interacted within the designated time-frame.An arrow emanates from agent to patients.Note that there is only one agent in each time-frame.On the other hand, one agent may have many patients.
Can such a network be used to ultimately prove or disprove a claim?This depends on the beliefs of its constituents; If there is at least one group member whose beliefs reflect the true nature of the underlying claim, then such a system can be used as a theorem proving mechanism.

Result summary.
• In Section 2 we define a complexity class BraidIP (braided interactive polynomial time) which deforms and extends the complexity class IP (Theorem 2.4).BraidIP is in turn extended by a class TangIP (tangled interactive polynomial time).Unlike class IP, in classes BraidIP and TangIP the soundness parameter s and the completeness parameter c are required only to satisfy 0 < s < c ≤ 1 (it is possible that both constants are below 1 2 or that both above 1 2 and bounded away from 1).In both BraidIP and TangIP, the verifier of interactive proof theory is replaced by a network of interacting verifiers in which each agent verifier V communicates with its patients subject to a deformation parameter or noise parameter δ t V ∈ Q ∩ (0, 1).The combinatorics of tangle machines, not the combinatorics of graphs, underlies classes BraidIP and TangIP (Carmi & Moskovich, 2014a,b).These particular deformations of IP are suggested by the tangle machine formalism, which originate in lowdimensional topology.Roughly, we can say that tangle machines capture the distributive nature of interactions in which a verifier queries a prover.
• In Section 5 we construct networks of PCP verifiers.We propose a particular network configuration which uses a number of 3-bit nonadaptive PCP verifiers with perfect completeness.This enables us to improve over the best achievable soundness for a single verifier in this class of PCPs.Three-bit query PCP verifiers exhibit a tradeoff between non-adaptiveness of the verifier and perfect completeness.An adaptive 3-bit PCP with perfect completeness and soundness above 1 2 can be constructed (Guruswami, 1998).When the verifier is restricted to be nonadaptive, however, the best soundness parameter of 3-bit PCPs has been conjectured to be 5 8 (Zwick, 1998).This conjecture implies that getting a 5 8 -approximation for 3-bit satisfiable CSP is NP-hard.The best known result for such a non-adaptive verifier has soundness parameter 20 27 + σ for some arbitrarily small σ > 0 (Khot, 2006).
We let a number of basic nonadaptive 3-bit PCP verifiers all of whose soundness is We show that this configuration achieves perfect completeness, and soundness of 5 8 + 1 24 , which is near the conjectured bound for a single verifier in PCP.In this sense, a tangle of verifiers behaves almost like one single very good verifier.
It is worthwhile noting that our networks do not reproduce the effect of adaptiveness in the usual sense, as our verifiers do not correlate their queries.
• The formalism of tangle machines provides a natural notion of equivalence for networks of interactions which decide languages in BraidIP and in TangIP.Namely, two such networks are equivalent if they are related by a finite sequence of certain local modifications, called local moves listed in Figure 9.If two networks of interactions are equivalent, then any interactive proof carried out on the basis of one of them can uniquely be simulated on the other.In particular, equivalent networks decide the same languages.The sense in which these local moves are canonical is discussed in (Carmi & Moskovich, 2014a), and their low dimensional topological interpretation is discussed in (Carmi & Moskovich, 2014b).The two most important local moves are R2 and R3.The R2 move tells us that our computations are reversible in distribution-i.e. that given the statistics |W t+1 ) for the patient belief, and |V t ) for the agent belief, we can uniquely reconstruct |W t ).The R3 move induces a notion of zero knowledge for our tangled networks.This note arose from discussions with M. Buliga and L. Kauffman about the meaning of tangle machines in the theory of computation.A number of simple computational interpretations for tangle machines are discussed in (Carmi & Moskovich, 2014a), and the present note discusses another such interpretation.The goal of this note is not to improve parameters of interactive provers.Rather, it is to explore a new framework for interactive proofs, whose inspiration stems from low dimensional topology.
The literature contains several other topologically inspired models of computation, in which topologically equivalent objects represent bisimilar computations (see e.g.(Kauffman, 1994;Meredith & Snyder, 2010;Vicary, 2012)) or in which low dimensional topological modifications are used directly to compute (see e.g.(Buliga, 2011b;Buliga & Kauffman, 2013)).To the best of the authors' understanding, none of these are directly related to the present work.
1.3.Organization of this note.The next section introduces the basic ingredients of a network and explains the notation we use throughout this work to represent its statistics.It proceeds in defining the class of languages decided by a network, BraidIP, in anticipation to the result IP ⊆ BraidIP which is obtained in the subsequent section.It also describes the diagrammatic language used inhere to represent networks.
Section 3 provides means to deform any standard IP system.The deformation thus obtained may then be used to compose a network.A proof to the above theorem is then provided which describes a particular network that decides any L ∈ IP.
Section 4 extends the former one by describing more efficient network configurations.It also defines the class TangIP which includes BraidIP.
Section 5 demonstrates the utility of the theory in the context of PCP verifiers.One of the interesting consequences of this is described in the Result Summary above.
Section 6 discusses the notion of network equivalence.It constitutes a link between interactive proofs and low-dimensional topology.
Some open issues are listed in the final section.

Distributing knowledge by deformation
How does our formalism fit into the landscape of interactive proof systems?
2.1.Deformation of a single interaction.The belief of a verifier W at time t is modeled as a Bernoulli random variable W t whose realizations w t are either |True) or |False).We interpret w t = |True) as 'W believes at time t that x ∈ L', and we interpret w t = |False) as 'W believes at time t that x / ∈ L'.Consider an interaction at time t with agent V , one of whose patients is W .The realization w t+1 of W t+1 may equal either the belief of the agent v t or the belief of the patient w t .In other words, W either retains his belief or is 'convinced' by V to change his belief to that of V (we use male pronouns for verifiers and a female pronoun for the prover).Whether or not V 'succeeds in convincing W ' depends on a message ξ t from a prover Π with access to an oracle.
Only the belief of patients changes at an interaction.The agents and of verifiers who do not participate in the interaction do not change their beliefs, so in particular v t+1 = v t always.
There are three constants associated to the agent V at an interaction at time t: A completeness parameter c t V , a soundness parameter s t V with 0 < s t V < c t V ≤ 1, and a deformation parameter δ t V ∈ Q ∩ (0, 1).In this note we will assume that these three parameters are the same for all agents in the network, and s t v , c t V , δ t V will be written s, c, δ correspondingly.Our basic requirement for an interaction is that the following pair of inequalities be satisfied: (1) Remark 2.1.The deformed completeness and soundness, cδ and sδ, may both be below 1 2 or may both be above 1 2 and bounded away from 1.In the limit δ → 1, specific values of c and of s turn the pair of inequalities (1) into familiar pairs of inequalities in interactive proof theory (Arora & Barak, 2009).For example, for s = 2 −|x| a and c = 1 − 2 −|x| b , where a, b > 0, we obtain the completeness and soundness constraints of an IP verification.

Statistics of beliefs and interactions.
When keeping track of the beliefs of many different verifiers at many different times, it is cumbersome to work directly with 1. Instead, we introduce a shorthand to keep track of the belief of a verifier, both if x ∈ L and also if x / ∈ L, in a single expression.
The belief statistics |W t ) of verifier W at time t is written: (2) where a ∈ [0, 1] denotes the greatest lower bound for the belief of W that x ∈ L at time t conditioned on this belief being indeed true, and b ∈ [0, 1] denotes the greatest lower bound for the belief of W that x / ∈ L at time t conditioned on this belief being indeed true.Note that a + b need not equal 1.In particular: (3) x ∈ L −→ a ≤ Pr(W t = |True)); An interaction between W and V at time t is concluded with W either accepting the belief of V or sticking to his own belief.Denoting by h the probability (or more precisely a lower bound on it) of W accepting the belief of V conditioned on either parties beliefs, w t = v t , an interaction is described by: (4) Remark 2.2.Belief statistics written as in (2) facilitate calculations of probabilities across a network.This tool is used throughout this work in an essential way (some examples would be given shortly).Here we explain how (2) and (4) combine to give a compact way of representing two entirely different interactions, one assuming x ∈ L and the other assuming x / ∈ L. This may be slightly confusing at first, so the reader's attention is called to this point.
Owing to (4) the probabilities anywhere in the network depend on the parameter h.We may do all calculations and treat it as a formal parameter.Having in mind that in practice an interaction is a procedure terminating with the statistics in (1), the parameter h is set using either one of the values h def = cδ or h def = sδ, depending on whether or not x is in L. To verify that a network decides L we will repeat the calculations twice, first for the case where x ∈ L and then for x / ∈ L. In the former case we will be interested only in the coefficient of |True) whereas in the latter case we will be interested only in the coefficient of |False).
Here is an illustrative calculation for a single interaction.Let W t = |False) and V t = |True).Invoke (4) using the completeness and soundness parameters in (1): first using h = cδ and then using h = sδ.Hence, This interaction decides L only if cδ > 1 2 and 1 − sδ > 1 2 .
2.3.Expressive power of a network: The class BraidIP.Verifiers in our framework are assumed to be probabilistic polynomial-time Turing machines whose beliefs are either internal states or stored on tapes.Similarly, an interaction is a polynomial-time procedure.Consider now a crowd of verifiers V 1 , V 2 , . . ., V µ whose initial beliefs at time t = 0 are V 1 0 , V 2 0 , . . ., |V µ 0 ).Allow them to interact at times t = 0, 1, 2, . . ., χ, subject to parameters 0 < c < s ≤ 1 and δ ∈ Q ∩ (0, 1).We write M for this sequence of interactions.A language L ⊆ {0, 1} * is said to be decided by such that for a fixed constant κ > 0, we have: This definition depends on the choice of κ > 0. The class braided interactive polynomial time (BraidIP) consists of those languages which are decidable for any fixed κ > 0 by some network M in time χ, polynomial in |x|.We denote this class BraidIP{δ, χ} where χ is the number of interactions in M .
Remark 2.3.The definition of class BraidIP is similar in spirit to the class BPP.We will see below that it includes class IP.Letting (5) reflect the class PP (i.e.taking strict inequalities and right-hand constants equal to 1 2 ) will result in networks that decide any L ∈ IPP.
In Section 3 we will prove the following result: Theorem 2.4.IP ⊆ BraidIP {δ, χ} where: . Tangle of beliefs.The networks inhere admit a convenient diagrammatic description.We represent an interaction as a wire cutting through other wires (see Figure 2).The overcrossing wire, which becomes slightly thickened in an interaction, carries the belief statistics of an agent whereas the undercrossing wires carry the belief statistics of her patients.An example of many concatenated interactions is given in Figure 3.The diagram representing the rumour passing system in Figure 1 is a tangle.It is shown on the right in Figure 3. Inhere such pictures are used to represent the flow of beliefs within a network of interacting machines (verifiers).This by itself is a sufficient reason to name them tangle machines.
tangle machine rumour-passing network (flow of beliefs) time time 2.5.An example.The capacity of a network to prove or disprove a claim is an emergent property.Out of a number of uncertain interactions, none of which prove the claim, the truth may eventually materialize.As an example, consider the two pairs of two consecutive interactions pictured in Figure 4.Both sequences involve three verifiers, designated X, Y and Z. Their initial beliefs are shown at the bottom.
Set the parameters to Allow the verifiers to interact in the left diagram.At time t = 2, beliefs X 0 and Y 0 of X and of Y have been updated to X 2 and to Y 2 (Z does not change his belief).The distributions are: Similarly, From this we see that X decides correctly at time χ = 2 with probability at least 5 8 or 21 32 , depending on whether x ∈ L or x / ∈ L. Both of these are greater that 1 2 , so the pair of inequalities 5, for a suitable κ > 0, a protocol underlied by the above interactions will succeed in deciding, at |X 2 ), whether or not x ∈ L.
Note again that and we evaluate with h = 1 2 for the coefficient of |True) and with h = 1 4 for the coefficient of |False).This is the same for all interactions in both diagrams.
Note that both diagrams in Figure 4 have the same initial beliefs |X 0 ), |Y 0 ), and |Z 0 ) and the same terminal beliefs |X 2 ), |Y 2 ), and |Z 2 ), and differ only in the belief of X at time t = 1.Thus, these two diagrams underlie equivalent deformed interactive proofs, each of which can uniquely be reconstructed from the other, which decide the same languages, but which differ at an intermediate step.This equivalence is the topic of Section 6.

Deformation of an IP system
In this section, we show how we may deform an IP system with any soundness parameters 0 < s < 1 2 < c ≤ 1, for any deformation parameter δ ∈ Q ∩ (0, 1).The completeness and soundness parameters of the deformed system will be sδ and cδ correspondingly.The deformation parameter δ serves to introduce noise between the prover and the verifiers.In the δ → 1 limit we recover IP, and the information obtained by a verifier at each interaction shrinks as δ → 0. But Theorem 2.4 proves that we can recover IP from BraidIP by concatenating many consecutive deformed interactions.
Before describing how IP may be deformed, we outline the major differences between a single interaction in IP and BraidIP: Verifiers may be thought of as probabilistic polynomial-time algorithms running on Turing machines.The prover is assumed to be an all-powerful Turing machine with an access to a proof or certificate to the effect that x ∈ L (Goldwasser, 1989).A deformed system requires any verifier to be equipped with an internal state or tape cell storing his current belief.
3.1.Two approaches to deform IP.We present two approaches to deform an IP protocol.The end result is the same, but the 'story' is different.
3.1.1.Agent and patient as a single verifier.We may think of a patient W and an agent V of an interaction at time t as representing different aspects of a single verifier.In this approach we conceive of W and V as being a single unit (W, V ).The verifier (W, V ) transmits to the prover Π the belief of both W and V .We may imagine W and V as litigants in a court case, presenting their claims to the judge Π, where W is the defendant and V is the plaintiff.If both W and V make the same claim, then Π throws the case out (i.e.W t+1 = w t and V t+1 = v t ).On the other hand, if V disagrees with W , then (W, V ) query the prover Π according to the original interactive protocol.If according to the original protocol, W 's claim should be accepted, then Π rules in W 's favour (i.e.W t+1 = w t and V t+1 = v t ).But if according to the original protocol W 's claim should be rejected and V 's claim should be accepted, then Π picks an integer uniformly at random between 1 and N .If the number Π picked is less than δN , then Π rules in favour of V (i.e.W t+1 = v t and V t+1 = v t ).Otherwise she rules in favour of W . Perhaps δ represents a chosen standard of 'reasonable doubt'.Constants s and c perhaps represent constants associated with the mechanics of the courthouse procedure.Note that as δ → 1, a single interaction involving two verifiers with opposite beliefs recovers IP.
3.1.2.Agent and patient as Alice and Bob.The following approach has an information-theoretic interpretation.Consider the prover Π as an information source, the agent verifier V as an encoder, and the patient verifier W as a decoder.The query information transmitted from W to Π is relayed via a perfect communication channel (i.e.there is no loss of information in this direction).The replies from Π are passed on to V who encodes them and transmits them back to W , this time through a noisy channel.This means that the prover replies emerge corrupted on W 's end, which consequently influences his decision.
Introducing a noisy channel into the formalism restricts the information obtained by the patient verifier from the prover.It tempting to state that the combination prover-agent-noisy channel behaves like a mendacious agent, in that the agent V decided whether to 'tell the truth' or to 'lie' to W .But to think of V as a mendacious agent is inaccurate.For one thing, the agent's strategy whether or not to reliably relay Π's replies to W must account for the beliefs of both V and W , either one of which may not be correct.His behavior does not stem from him being more knowledgeable; rather we may think of it as a manifestation of his own beliefs.
It is important to note that although V receives the replies from Π he is not allowed to use this information to update her own belief.One can think of protocols taking advantage of the fact that V is not aware of W 's queries wherein this restriction follows naturally.For now it is enough to assume that V will not use the prover replies for his own benefit.
Here is how such a protocol may run.Upon disagreement between W and V , i.e. v t = w t , the patient W sends his queries to Π.The replies to W 's queries are then sent by Π to the agent V .At this point, V , who is a verifier much like W , runs his own verification test on the prover replies.He obtains ξ t = 1 for accept/true and ξ t = −1 for reject/false.In case where ξ t = 1 he tampers with the prover replies such that when they are received by W his verification would indicate v t with probability δ.In case where ξ t = −1 the agent V tampers with the prover replies such that the test of W would indicate ¬v t .
Implicit in the above protocol is the fact that the capacity of V to deceive W is limited by V 's own belief.If her belief, v t , coincides with the true nature of claim then he may potentially have more power to deceive W .
The protocol just described underlies a noisy symmetric channel between W and V .If ξ t = 1, this channel is characterized by δ and has a capacity of 1 − H 2 (δ), where H 2 (δ) is the Shannon entropy of a Bernoulli random variable with parameter δ.It induces a maximal loss of 1 bit of information for δ = 1 2 .An illustration of the communication between the three parties patientagent-prover is given in Figure 5.
3.1.3.Further metaphors for deformed interactions.The agents in our picture all receive messages from the same oracle.This essentially suggests that a network of interactions is a construct quantizing the oracle knowledge.At every location within the network only a quanta of this knowledge is used by way of interaction between a patient and an agent.Later on we will show that although a single interaction may be limited in its capacity to prove the claim, the proof may yet emerge somewhere in the network depending on its topology.
The triple patients-agent-oracle brings to mind some basic models of reasoning and information transfer.Perhaps a patient is an entity whose beliefs reflect both prior knowledge and observations.The patient is exposed to a genuine phenomenon, which the patient has not seen before.The phenomenon, which is the metaphor for an oracle, is beyond the comprehension of the patient and hence a number of observations are collected in an attempt to reach a definitive conclusion.These observations, however, may be distorted by limitations of the patient measuring apparatus, or perhaps they contradict prevailing explanations and beliefs.In either cases observations contain, or otherwise introduce, uncertainty.Observations are the metaphor for agents.What the patient tries to accomplish underlies the Bayesian inference paradigm.
Here is another metaphor.A patient is a decoder, an oracle is an information source, and an agent is an encoder who relays the encoded oracle message through a noisy communication channel.Alternatively, an agent-patient pair is a verifier and the oracle is a prover who relays a message through a noisy communication channel.All metaphors reflect knowledge transfer subject to uncertainties.

Probabilistic theorem proving in networks.
Proof of Theorem 2.4.We explicitly construct a configuration of interactions which decide a language L in IP.This configuration, which is illustrated in Figure 6 for the case χ = 4 is a scaled up version of that in Figure 4.It involves χ + 1 verifiers W and V 1 , V 2 , . . ., V χ , and χ interactions.The parameters of all interactions are the same, and are c, s, δ. (10) Thus, at time zero there are two verifiers with opposite beliefs and χ − 1 verifiers whose initial belief is that the claim x ∈ L is 50% true and 50% false.
Calculating the output statistic |W χ ) (which occurs at time χ) yields ( 11) From (11) we see that the configuration in Figure 6 decides L if and only if: From here we obtain the following bounds for χ: .
Remark 3.1.Equation ( 6) tells us that χ has approximately the same behaviour as 1 δ .By definition of BraidIP, χ's growth rate is polynomial in the word length |x|, and so therefore δ is asymptotically bounded below by approximately one over a polynomial in |x|.

Efficient IP strategies
4.1.The complexity class TangIP.We may extend class BraidIP by allowing each verifier to have its own 'local' time parameter, so that a patient belief W t may interact with an agent belief V s for s = t, and become updated to W t+1 .
We also allow verifiers to travel backwards or forwards in time and to update their previous or future beliefs, so that V t may be updated by agent V s to become V t+1 , where V t and V s are beliefs of one and the same verifier.We write M for a network of such concatenated interactions, subject to parameters 0 < c < s ≤ 1 and δ ∈ Q ∩ (0, 1).An example of such a network is given in Section 4.2.
A language L ⊆ {0, 1} * is said to be decided by M if M contains a verifier V whose belief at time χ is |V χ ) def = a |True) + b |False), such that for a fixed constant κ > 0 the inequalities (5) are satisfied.
The class tangled interactive polynomial time (TangIP) consists of those languages which are decidable for any fixed κ > 0 by some network M which contains χ interactions, where χ is polynomial in |x|.We denote this class TangIP{δ, χ}.
We wonder about the connection between our classes BraidIP and TangIP and multi-prover IP (MIP) (Ben-Or, 1988).In particular, we wonder whether MIP ⊆ BraidIP or MIP ⊆ TangIP, particularly if we allow different interactions to have different parameters (in this note all interactions are required to have the same parameters because that's all we need, but there is no obstruction to considering the more general case).4.2.The Hopf-Chernoff configuration.Consider an IP system whose soundness s is nearly equal to its completeness c but for a small constant ǫ(|x|) that depends on the word length |x|, i.e. c − s = ǫ(|x|).As ǫ(|x|) → 0, the IP system becomes inefficient in the sense that it accepts every word with probability nearly c regardless of its membership in L. Yet we can still construct a deformed IP system that decides L. One may wonder how the number of interactions in such a system is affected by the decreasing gap ǫ(|x|).
The number of interactions in a network of the form given in Figure 6 is implicit in Theorem 2.4.Fix δ ∈ Q ∩ (0, 1) and note from Equation (6) that, as ǫ(|x|) decreases, the values bounding χ become nearly identical.But χ is an integer, so the two bounds must have an integer between them.In general, that means that the distance between them is at least 1.Therefore, the number of interactions grows as ǫ(|x|) decreases.We may need to take δ → 0 as ǫ(|x|) → 0. In fact it can be shown that in this case δ(|x|) = O(ǫ(|x|)) which means that we require χ = O(1/ǫ(|x|)) interactions.
Can fewer interactions decide L ?The configuration in Figure 7 decides L for any ǫ(|x|) using substantially less than O(1/ǫ(|x|)) interactions.This machine is a concatenation of a number of identical smaller configurations of interactions, denoted M 0 , M 1 , M 2 , . ... When concatenated to form a single configuration, we require approximately χ = O(log(1/ǫ(|x|))) copies of M 0 to decide L (the precise argument is given below).If we were to trace its colours (probability generating functions) we would notice that it behaves much like a repetition of a binary random experiment (e.g.coin flipping), hence the magnitude of χ.We have named this configuration the Hopf-Chernoff configuration suggesting both to its structure and, to some extent, its functionality.There exists a pair of beliefs, α and β, independent of any other belief in the machine, such that for any given set of initial beliefs In 0 j the machine decides any L ∈ IP using χ = O(log(1/ǫ)) submachines (and 4χ interactions).In particular, letting Proof.The proof is deferred to the Appendix.
The Hopf-Chernoff configuration is a recursive structure which is guaranteed to converge irrespective of its initial beliefs In 0 j .In fact it represents a two-dimensional homogeneous irreducible Markov chain whose rate of convergence is O(2 −χ ).Its stationary distribution, which depends on whether x ∈ L or x / ∈ L, is akin to (16).By virtue of its convergence properties we may just let it run forever (i.e.χ → ∞) knowing that it will eventually reach a stationary distribution not far from ( 16).For that reason we may as well substitute the open network in Figure 7 with its closed counterpart in Figure 8.

PCP networks
In this section we consider networks of PCP verifiers (Arora, 1998).Consequently we replace the prover with an oracle Π who holds the proof encoding π.Thus, a PCP verifier queries locations in π by passing their addresses to the oracle.We assume all PCP verifiers to be nonadaptive.
We adopt the notation of (Moshkovitz, 2010) and denote by PCP c,s [r(n), q(n)] Σ the class of languages having a PCP verifier with completeness c and soundness s, which makes use of r(n) random bits and q(n) queries to a proof over an alphabet Σ, where 1)] where Σ = {0, 1} is conventionally omitted.The numbers r(n) and q(n) are referred to as the verifier's randomness complexity and query complexity.

Deformed PCP verification.
A PCP network is a network whose interactions are governed by deformed PCP verifiers.To illustrate how such a deformation may be obtained it is useful to consider a particular PCP verifier.The Håstad 3-bit PCP verifier in (Håstad, 1997) makes a perfect example.It employs a linear test using only three bits obtained from the proof encoding (Long Code).Using the notation in Section 3, Π is now an oracle holding an encoding of the proof, which in this case is a Long Code representation of an assignment for a CSP instance (constrained satisfaction problem).In the original setting, where only one verifier is present, W provides the addresses of three bits to Π. Once these are received he is able to compute a certificate ξ t ∈ {−1, 1} according to which he decides to either accept (ξ t = 1) or reject (ξ t = −1).Now let us describe a corresponding deformed version of this procedure.Suppose the two verifiers disagree, v t = w t , where v t , w t ∈ {|True) , |False)}.In this case the interaction proceeds as follows.The patient verifier W provides the addresses of three bits to Π.These bits are received by the agent verifier V which computes his own certificate ξ t .He then may decide to flip one out of the three bits per the following rules: The fabricated set of bits is then sent back to W who computes his own certificate.This protocol is an actualization of the communication channel in Figure 5. 5.2.Query complexity and randomness complexity of a network.Consider a PCP verifier whose completeness is possibly imperfect, c < 1, and whose soundness is s = c − ǫ.By Theorem 4.1 a deformed version of such a PCP verifier running at every interaction in the Hopf-Chernoff network results in an output whose completeness and soundness parameters are, respectively, 1 2 + 1 12 ǫδ and 1 2 − 1 12 ǫδ.Such a machine uses O(log(1/ǫ)) interactions which amounts to O(q(n) log(1/ǫ)) queries.
At every interaction the deformed PCP protocol generates a random number which allows it to simulate the noisy channel in Figure 5. How many bits does this procedure consume throughout the entire network ?Fix a rational deformation parameter δ = D/N and suppose that random integers in the range [1 . . .N ] that are used throughout the network are written in advance on some "random tape" which can move only forward.In its turn, each interaction in the network reads one of these numbers (each of which is potentially encoded using log 2 N bits) and increments the "random head" to a position along the tape where the next integer is stored.This story line clearly shows that the number of "random bits" consumed when simulating the noisy channel depends on the total number of interactions, which in our case is O(log(1/ǫ)).
From the above it follows that the total randomness complexity in the machine is (r(n) + 1)O(log(1/ǫ)) bits.The machine itself may therefore be viewed as a single PCP verifier whose completeness and soundness parameters are those underlying its output, and whose complexity and soundness are those just mentioned.As log(1/ǫ) is a common factor for both overall completeness and soundness we may regard it as the number of sequential repetitions of a standard PCP verification.This interpretation of the Hopf-Chernoff configuration is formally expressed as Note that this interpretation does not account for the number of bits actually received by a patient verifier.As previously mentioned the patient loses H 2 (δ) bits of information due to the noisy channel induced by an agent.For that reason he literally inspects q(n) − H 2 (δ) ≥ q(n) − 1 bits from the proof.5.3.Perfect completeness (3-bit) PCP networks.Ideally a PCP verifier would have a perfect completeness and minimal soundness (Moshkovitz, 2010).In this respect an interesting case is that of 3-bit query PCP verifiers where a tradeoff has been shown to exist between non-adaptiveness of the verifier and perfect completeness.An adaptive 3-bit PCP with perfect completeness and soundness above 1 2 can be constructed (Guruswami, 1998).When the verifier is restricted to be nonadaptive, however, the best soundness parameter of 3-bit PCPs has been conjectured to be 5 8 (Zwick, 1998).This conjecture implies that getting a 5 8 -approximation for 3-bit satisfiable CSP is NP-hard.The best known result for such a non-adaptive verifier has soundness parameter 20 27 + σ for some arbitrarily small σ > 0 (Khot, 2006).Consider the previously best known result assuming non-adaptiveness (Håstad, 1997): PCP 1, 6 8 +σ [log n, 3], and let a deformed version of this verifier underlie any of the interactions in the Hopf-Chernoff configuration.By Theorem 4.1 the Hopf-Chernoff machine produces balanced completeness and soundness parameters in its output.However, by reading this machine differently we can achieve perfect completeness and a soundness parameter near the conjectured bound for a single verifier, specifically 5 8 + 1 24 .
5.3.1.The Hopf-Chernoff algorithm.The following algorithm is derived from the Hopf-Chernoff configuration in Figure 7.It merely describes a realization of such machine and the way its output may be read such that the desired performance is attained.It assumes perfect completeness of the underlying PCP verifier.
(ii) Draw a belief α from a Bernoulli distribution with parameter 1 2 .Set β = ¬α.(iii) Do the following for i = 1, . . ., χ, where χ = O(1): • Using the underlying PCP verifier, more precisely its deformed version according to the procedure described in Section 5.1, perform four interactions of the Hopf-Chernoff configuration.In detail, execute interactions consecutively for each of the two verifiers whose beliefs propagate from In i j to Out i j according to the diagram below.Theorem 5.1.The Hopf-Chernoff algorithm approaches perfect completeness and soundness at most 1 3−2s as δ → 1. Proof.The proof is deferred to the Appendix.
Corollary 5.2.A Hopf-Chernoff algorithm with a non-adaptive PCP verifier (17) has perfect completeness, and soundness at most 2 3 = 5 8 + 1 24 , as δ → 1. Proof.This corollary is an application of Theorem 5.1 using the soundness parameter s = 6 8 .6. Low-dimensional topology and network equivalence In (Carmi & Moskovich, 2014a) we defined tangle machines to be configurations of interactions such as those used in the definition of class TangIP.Diagrams of tangle machines contain thin and thick lines (thick lines are for agents), where two thin lines can cross in a virtual crossing, which is mere combinatorial information.Two tangle machine diagrams are considered stably equivalent if they are related by a finite sequence moves (local modifications in a tangle diagram) VR1, VR2, VR3, SV, R1, R2, R3, UC, and ST in Figure 9.We further add the move FS (false stabilization) to this collection of local moves, because in this note we do not distinguish between different interactions.In this note we consider only equivalence under all moves in Figure 9, and for simplicity we call the induced equivalence relation simply equivalence.Remark 6.1.In a more general setting in which different interactions may represent different protocols, and maybe even represent proof systems with different soundness and completeness parameters, we would omit FS.But in this note FS is included.As we prove in (Carmi & Moskovich, 2014b), the resulting equivalence classes are in bijective correspondence with w-tangles as in (Bar-Natan & Dancso, 2013).
Two machines related by the local moves in Figure 9 can be entirely recovered from one another, and any verification performed by one can be simulated by the other.For details, see (Carmi & Moskovich, 2014a).These moves are inspired by low-dimensional topology, as discussed in (Carmi & Moskovich, 2014a,b).In the rest of this section, we discuss the interpretation of R2 and of R3 (Reidemeister Moves) in terms of interactive proofs.All of the other local moves are trivial artifacts of our diagrammatic formalism, and do not appear to have philosophical content in the context of interactive proofs.
An patient which does not emerge from any interaction is said to be initial, and one that does not feed into any interaction is said to be terminal.Verifier states which are neither initial nor terminal are said to be intermediate.
That M and M ′ are equivalent, written M ′ ∼ M , means that they share some similarities.For example they have identical initial and terminal beliefs which entails that both machines have the same computational power in terms of deciding a language.Nevertheless, their local behaviour may be different.In other words, the outcome of intermediate interactions in between the same initial and terminal statistics may be different in equivalent machines.This was one of the earlier examples wherein a machine and its equivalent counterpart represented two different prover strategies arriving at the same proof (see Figure 4).We may think that: Equivalent tangle machines represent different ways of proving a theorem.
As an example, here are a few equivalent prover strategies for the machine in Figure 6 all which are obtained by application of R2 and R3 moves.
Topology, in particular the Reidemeister moves, dictate the spread of knowledge throughout the machine.This brings to mind a familiar concept.
6.1.Zero-Knowledge tangle machines.Here is an interesting question concerning the above.Does a machine M have an equivalent counterpart M ′ ∼ M wherein the proof emerges in one or more of its intermediate verifier states?What that means is that the proof could potentially be obtained by a submachine of M ′ which is a machine smaller than M .As M may be fairly complicated, there is no guarantee that this question is easy to answer in general.
If within M hides a smaller machine which can prove the same, then it means that M contains some redundancy.This 'redundancy' is in fact a set of interactions which dictate the process of getting the proof but which contribute no other knowledge apart from this.If someone where to give us the right combination of Reidemeister moves we could potentially extract a smaller machine that contains the same knowledge in terms of proving the theorem but which does not contain any of the redundant interactions.This concept is the machine analog of zero-knowledge proof.The precise definition is the following.Definition 6.2 (Zero-Knowledge tangle machine).A tangle machine M is said to be zeroknowledge if the following is satisfied.
(i) There are no intermediate interactions in M that decides L.
(ii) There exists a machine M ′ ∼ M which decides L at one of its intermediate interactions.
The notion of zero-knowledge proof (Goldwasser, 1989) essentially restricts the knowledge that may be gained by an arbitrary verifier in a course of interacting with a prescribed prover on some common input (x).The precise definition makes use of a simulator which is an arbitrary feasible algorithm that is able to reproduce the transcript of such an interaction without ever interacting with the prover.A good tutorial on the subject including a wealth of interesting discussions is (Goldreich, 2010).
In the following paragraphs we would show an analog of this concept from the perspective of tangle machines.6.2.R3: Knowledge extraction.Consider the machines M ′ ∼ M in Figure 10.Both have the same initial and terminal belief statistics.The explicit structure of the machines is mostly irrelevant except that they both contain a submachine S with an arbitrary internal structure which is represented by a blank disk.In M , the verifier Z is an agent to all initial states of S and the resulting beliefs from this interaction are characterized by |X i ), i = 1, 2, . . .,.In M ′ the same verifier is an agent to the terminal states of S and the resulting beliefs from this interaction are characterized by |Y i ).The machine M decides L in its terminal statistics, and by machine equivalence so does M ′ .Furthermore, some of S's terminal statistics, |Y i ), also decide L.
That M is zero-knowledge implies the proof should not appear somewhere within it.Assuming none of the In ′ s decide L, and neither do any intermediate belief states of S, this requirement implies that none of the |X i ) = (In i ) |Z) decide L. On the other hand, the machine M ′ shows us that an interaction between the terminal states of S, some of which decide L, with the agent Z are able to produce the proof.That is, some of Out i = |Y i ) |Z) decide L. These requirements completely characterize the belief distribution |Z).Perhaps unsurprisingly, it turns out that |Z) = 1 2 |True) + 1 2 |False).Ideally we would require that S reproduces the proof as if it was produced by M itself.This requirement translates into (18 for any Out i that decides L. As either sides of (18) normally depend on the deformation parameter δ it may be used to find δ such that M is zero-knowledge.Below we give an example of this.
6.2.1.Example.Consider the two machines in Figure 11.Assume they both employ a deformed IP system whose completeness and soundness are δ and 1 2 δ.Let |Z) = 1 2 |False) + 1 2 |True) and let us first see what the value of δ is for the machine to decide L. The output |X 2 ) of either machines is given by Figure 10.Two equivalent machines.The machine M is zero-knowledge.The proper submachine S determines L.
from which we conclude that δ > 1 2 .The machine on the right in this figure is zero-knowledge because |X 1 ) does not decide L: and on the other hand the submachine inside the small disk on the left decides L: If we further restrict the value of δ so as to satisfy (18), namely, we obtain δ = 1 2 which obviously contradicts the basic requirement of deciding L. If we slightly relax this condition to allow a small discrepancy between the underlying distributions then we may take δ = 1 2 + κ(x) where κ(x) is a statistical distance which potentially depends on x.

Some open issues
We list a number of standing problems that arise from this work.
Elegant approaches to deform an IP system.In Sections 3 and 5.1 we have shown how a deformed system may be reconstructed using a regular IP system via the process of deformation.Deformation can be seen as a way to introduce uncertainty into an interaction between a prover and a verifier.We use an additional verifier, an agent, in order to establish a one-way noisy communication between the prover and the (patient) verifier.One could think of more natural ways to introduce uncertainty into such an interaction.Perhaps this could be accomplished in the level of the proof itself.To illustrate this concept, imagine a PCP verifier with access to a proof encoding which has been fabricated by an agent verifier.The proof encoding may potentially be contaminated by noise, or maybe fragments from the original proof are encoded alongside pieces of irrelevant material.We suspect that a proper encoding strategy and a respective decoding (patient) verifier could reproduce the effect of deformation.
Expressive power of networks.We are unsure whether MIP ⊆ TangIP.An affirmative answer would suggest that the effect of coordinated provers such as those underlying MIP can be reproduced by multiple verifiers and a single prover. .
Explicitly writing (23) using the formal parameter h yields Letting In i+1 j = Out i j , j = 1, 2, equation ( 24) underlies a linear dynamical system.It is easy to verify that the eigenvalues of the transition matrix A(h) all are within the unit circle, i.e. |λ(A(h))| < 1 for any h > 0. That means that the system (24) reaches a steady-state as i → ∞.The steady-state can be obtained as follows.Rewrite (24) as where the fact that h = cδ for x ∈ L and h = (c − ǫ)δ for x / ∈ L has been used.Solving (29) for the coefficients a and b while assuming σ = 1 12 ǫδ yields (15).The underlying output probabilities in ( 16) are given by (28).
To complete the argument we need to show that the network converges within the stated number of iterations.It is sufficient to consider the case where the output probabilities (28)

Figure 1 .
Figure 1.Rumour-passing group members and their evolving belief states.

Figure 3 .
Figure 3.A rumour-passing network and its respective diagram.
and V 4 , and 4 interactions.Let L ∈ IP.The initial beliefs at time t = 0 are set to |W 0 ) def = |False) and Figure 7. Hopf-Chernoff configuration(open version).

Figure 9 .
Figure9.Local moves for machines, valid for any orientations of the strands.The FS move is valid when two interactions with the same parameters are considered the same (e.g. in this note), but in contexts where different interactions should be distinguished, we drop the FS move.

Figure 11 .
Figure 11.Example of a zero-knowledge machine.
Low-dimensional topology.To what extent can low-dimensional topology assist in designing networked proof strategies?We have seen that equivalent networks have the same expressive power yet they differ in their intermediate interactions.They may be viewed as different ways to prove the same things.What are the factors controlling the existence of zero-knowledge configurations?Appendix A. Proof of Theorem 4.1Let us begin by writing down the relations between the outputs Out j and inputs In j of this machine.
Communication between W and V when v t = w t .The channels between W and V are symmetric.The labels above edges indicate transition probabilities.The box of V is divided into two sections representing her belief v t (left section) and the outcome of his verification ξ t (right section).