An Exponential Separation Between MA and AM Proofs of Proximity

Interactive proofs of proximity allow a sublinear-time verifier to check that a given input is close to the language, using a small amount of communication with a powerful (but untrusted) prover. In this work, we consider two natural minimally interactive variants of such proofs systems, in which the prover only sends a single message, referred to as the proof. The first variant, known as MA-proofs of Proximity (MAP), is fully non-interactive, meaning that the proof is a function of the input only. The second variant, known as AM-proofs of Proximity (AMP), allows the proof to additionally depend on the verifier's (entire) random string. The complexity of both MAPs and AMPs is the total number of bits that the verifier observes—namely, the sum of the proof length and query complexity. Our main result is an exponential separation between the power of MAPs and AMPs. Specifically, we exhibit an explicit and natural property Π\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\Pi$$\end{document} that admits an AMP with complexity O(logn)\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$O(\log n)$$\end{document}, whereas any MAP for Π\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\Pi$$\end{document} has complexity Ω~(n1/4)\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\tilde{\Omega}(n^{1/4})$$\end{document}, where n denotes the length of the input in bits. Our MAP lower bound also yields an alternate proof, which is more general and arguably much simpler, for a recent result of Fischer et al. (ITCS, 2014). Also, Aaronson (Quantum Information & Computation 2012) has shown a Ω(n1/6)\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\Omega(n^{1/6})$$\end{document}QMA lower bound for the same property Π\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\Pi$$\end{document}. Lastly, we also consider the notion of oblivious proofs of proximity, in which the verifier's queries are oblivious to the proof. In this setting, we show that AMPs can only be quadratically stronger than MAPs. As an application of this result, we show an exponential separation between the power of public and private coin for oblivious interactive proofs of proximity.


Introduction
The field of property testing (Goldreich et al. 1998;Rubinfeld & Sudan 1996) deals with sublinear algorithms for deciding whether a given object has a predetermined property or is far from any object having this property. Such algorithms, called testers, obtain local views of the object by performing queries; that is, the object is seen as a function and the tester receives oracle access to this function. The goal of the tester is to ascertain a global property of the function based only on its local view.
In the last couple of decades, the area of property testing has attracted much attention (see surveys (Canonne 2015;Ron 2008Ron , 2009) and recent textbook (Goldreich 2017)). However, while much success was found in designing testers for a myriad of natural properties, which only make a small number of queries, many other natural properties were shown to require a very large number of queries to test (often linear in the length of the input).
Proofs of proximity, first considered by Ergün, Kumar and Rubinfeld (Ergün et al. 2004), are both intrinsically interesting as a natural notion of proof systems for sublinear algorithms, as well as provide means to significantly reduce the number of queries that the tester needs to make in order to verify, rather than decide. These probabilistic proof systems can be viewed as augmenting testers with help from a powerful, yet untrusted prover. In a recent line of works (Berman et al. 2017;Chiesa & Gur 2017;Fischer et al. 2014;Goldreich & Gur 2016b;Goldreich et al. 2015b;Gur & Rothblum 2016Kalai & Rothblum 2015;Reingold et al. 2016;Rothblum et al. 2013), various types of interactive (Rothblum et al. 2013) and non-interactive proofs of proximity (Gur & Rothblum 2018) were studied, including arguments of proximity (Kalai & Rothblum 2015), zero-knowledge proofs of proximity (Berman , and proofs of proximity for distribution testing (Chiesa & Gur 2017).
In this work, we study the relation between two types of proofs of proximity that are minimally interactive; namely, MA and AM proofs of proximity, which can be viewed as the property testing analogue of the class MA (i.e., "randomized NP") and AM, respectively, and are described in more detail next.
Informally speaking, an MA proof of proximity (MAP) protocol consists of a tester (or rather a verifier) that receives oracle access to an input function f and also receives explicit access to a short purported proof w. Based on the proof string and a few oracle queries to f , the verifier should decide whether f has some property Π (i.e., whether f ∈ Π). More specifically, after reading the proof w, the verifier tosses random coins, makes queries to the oracle f and decides whether to accept or reject. We require the following completeness and soundness conditions: if f ∈ Π, then there exists a proof w that the verifier accepts with high probability, and if f is "far" (in Hamming distance) from any function in Π, then the verifier rejects with high probability. Following the literature, the complexity of an MAP is the total number of bits that the verifier observes-namely, the sum of its proof length and query complexity. 1 The reason that the foregoing model is referred to as a "Merlin-Arthur" protocol is that we think of the prover as being Merlin (the all powerful magician) and the verifier as Arthur (a mere mortal). Then, in the MAP model Merlin "speaks" first (i.e., sends the proof) and Arthur "speaks" second (i.e., tosses his random coins).
It is natural to ask what happens if we switch the order-letting Arthur toss his coins first and Merlin send his proof after seeing Arthur's coin tosses. This type of protocol is typically referred to as an "Arthur-Merlin" protocol. More precisely, an AM proof of proximity (AMP) is defined similarly to an MAP, except that now cc Separation Between MAP and AMP Page 5 of 44 12 It is natural to ask the following converse question: Can any AMP protocol be emulated by an MAP, or is there a gap between the power of these two models?
Note that any AMP can be easily emulated by an MAP with at most an exponential overhead. 4 Thus, the question that we would really like to answer is whether such an exponential overhead is inherent.

Our results.
Our main result shows that it is indeed the case that AMPs can be exponentially stronger than MAPs and so the foregoing emulation strategy is optimal, up to polynomial factors: • Π has an AMP of complexity O (log(n)/ε), with respect to proximity parameter ε > 0; and • Every MAP for Π, with respect to proximity parameter ε ≤ 1 10 , must have complexity Ω(n 1 4 ).
The property Π that we use to prove Theorem 1.1 is actually very simple and natural. Specifically, Π is the set of all permutations over [n]; the goal of the verifier is to check whether a given function f : [n] → [n] is close to being a permutation by querying the function in a few locations and with a short interaction with the prover.
The AMP protocol for deciding whether a given function f : [n] → [n] is a permutation is extremely simple. The idea is that the random string specifies some random element y ∈ [n] and the prover should specify an inverse x of y (under f ). If f is a permutation such an element must exist whereas if f is ε-far from being a permutation, then with probability ε it holds that y simply does Our MAP lower bound for deciding whether a function is close to being a permutation can actually be established using techniques due to Aaronson (Aaronson 2012). In more detail, (Aaronson 2012) showed a QMA lower bound of Ω(n 1/6 ) for this problem, but it seems as though his technique can also be used to derive an Ω(n 1/4 ) MAP lower bound. However, we take a different and more general approach. We show that any property that satisfies a relaxed notion of k-wise independence requires MAPs with complexity roughly √ k. This result generalizes a recent result of Fischer, Goldhirsh and Lachish (Fischer et al. 2014) which can be interpreted as an MAP lower bound of √ k for properties that are exactly k-wise independent. 5 Our proof is also considerably simpler than that of (Fischer et al. 2014) and in particular uses only elementary arguments, see further discussion in Section 1.2. We show that the permutation property that we consider satisfies the relaxed notion of k-wise independence with respect to k = √ n, which implies a lower bound of Ω(n 1 4 ). Of particular relevance, Aaronson (Aaronson 2012) considered the problem of deciding whether a function is close to a permutation to derive a quantum query complexity separation between the class QMA and the class of statistical zero knowledge SZK, showing that every QMA query complexity algorithm with a w-qubit witness and query complexity q must satisfy q + w = Ω(n 1/6 ). This in turn implies that the permutation property requires MAP complexity Ω(n 1/6 ). We have been informed that a similar method may be used to show that the permutation property requires MAP complexity Ω(n 1/4 ). 5 More precisely, (Fischer et al. 2014) show that any linear code with large dual distance requires MAPs of complexity that is roughly square root of the code's blocklength. cc Separation Between MAP and AMP Page 7 of 44 12 1.1.1. Oblivious proofs of proximity. Having established Theorem 1.1, we revisit the MA versus AM problem within the context of proofs of proximity with prover-oblivious queries (a notion first considered in (Rothblum et al. 2013) and further explored in (Gur & Rothblum 2018)), or in short oblivious proofs of proximity.
These are proofs of proximity that have the special feature that the queries that the verifier makes are independent of the proof. Viewed from a temporal perspective, in these proof systems the verifier first makes its queries to the input function, and only after making all of its queries does it receive the proof. One reason that makes this feature appealing is because it allows the verifier to probe the object and obtain a certificate, which can then be used later when interacting with a prover, even if the object is no longer accessible. Another reason is that many of the interactive proof systems from the literature (e.g., the sumcheck protocol of (Lund et al. 1992)) are oblivious. Surprisingly, it turns out that the gap between the power of oblivious AMPs and MAPs is dramatically smaller than the one exhibited in Theorem 1.1. Loosely speaking, we show that oblivious AMPs can only be quadratically stronger than oblivious MAPs, and in fact, standard testers (that do not use a proof).
Theorem 1.2. For any property Π, if there exists an oblivious AMP for Π with proof complexity p and query complexity q, then there also exists a tester (i.e., MAP with proof complexity 0) for Π with query complexity O(p · q).
As an application, we use Theorem 1.2 to derive lower bounds on public-coin oblivious interactive proofs of proximity and show an exponential separation between public-coin and private-coin protocols in this setting. See further discussion in Section 5.

Related works.
The notion of proofs of proximity was originally proposed by Ergün, Kumar and Rubinfeld. Ben Sasson et al. (Ben-Sasson et al. 2006) and Dinur and Reingold (Dinur & Reingold 2006) considered such proofs in the context of PCPs. Rothblum, Vadhan and Wigderson (Rothblum et al. 2013) considered interactive proofs of proximity and showed that every lan-guage computable by a low-depth circuit has an interactive proof of proximity (IPP) with a sublinear time verifier. Reingold, Rothblum, and Rothblum (Reingold et al. 2016) showed constant-round IPPs for any language computable in polynomial-time and bounded polynomial-space. Goldreich and Gur (Goldreich & Gur 2016a,b) showed general-purpose IPP with only 3 rounds, albeit for a much smaller class.
Proofs of proximity were further studied by (Goldreich et al. 2015b) who showed more efficient constructions for certain restricted complexity classes, such as functions accepted by small read-once branching programs and context-free languages. Gur and Rothblum proved a round hierarchy theorem for IPPs (Gur & Rothblum 2017), showing that the power of IPPs gradually increases with the number of rounds of interaction. Several works focused on studying non-interactive (MA) proofs of proximity (Fischer et al. 2014;Goldreich et al. 2015a;Gur & Rothblum 2018) (see also (Gur 2017)). In addition, recent works studied (computationally sound) interactive arguments of proximity (Kalai & Rothblum 2015), zero-knowledge proofs of proximity (Berman et al. 2017), and proofs of proximity for distribution testing (Chiesa & Gur 2017). Proofs of proximity have also found applications to property testing and related models (Fischer et al. 2015;Gur & Rothblum 2016. We remark that a concurrent work of Berman et al. (Berman et al. 2017) utilizes our results (specifically Theorem 1.1) to derive a separation between the power of MAPs and zero-knowledge IPPs.
The notion of MA and AM proofs plays a central role in the study of proofs system in various computational models, other than in the setting of polynomial-time Turing machines in which they were originally conceived (Babai & Moran 1988). For example, in quantum computation, the class QMA (quantum MA proofs) captures the most fundamental type of quantum proof systems (since quantum algorithms are inherently randomized) and it has been extensively studied in the last couple of decades (see survey (Aharonov & Naveh 2002)).
In addition, MA and AM proof systems received much attention in the setting of communication complexity (Babai et al. 1986; cc Separation Between MAP and AMP Page 9 of 44 12 Göös et al. 2015;Klauck 2003Klauck , 2011Raz & Shpilka 2004;Sherstov 2016) and streaming algorithms (Chakrabarti et al. 2014(Chakrabarti et al. , 2015Cormode et al. 2010Cormode et al. , 2011Gur & Raz 2015;Thaler 2016). The former also has an interesting connection to the algebrization barrier (Aaronson & Wigderson 2009) and recently found important applications to distributed PCPs and hardness of approximation (Abboud et al. 2017). 6 The latter can be viewed as the property testing analogue of online annotated data streams (there, instead of oracle access to the input, the algorithm has one-pass sequential access to the input, and the goal is to minimize space complexity rather than query complexity). Indeed, part of our results concerning oblivious proofs of proximity are inspired by the techniques for online annotated data streams in (Chakrabarti et al. 2015).
Perhaps most relevant to us, the notion of MA and AM proofs for decision tree complexity (or the "query complexity model"), which can be thought of as property testing for exact (rather than approximate) decision problems, is closely related to proofs of proximity, though the query complexity model is much simpler to analyze than property testing. We remark that the high-level approach of our main lower bound for MAPs is inspired by the work of Raz et al. (Raz et al. 1998).

Comparison with the techniques in (Fischer et al. 2014).
As we discussed above, our MAP lower bound generalizes the main result of Fischer, Goldhirsh, and Lachish (Fischer et al. 2014). The latter result can be interpreted as an MAP lower bound for any kwise independent property. Our lower bound extends to a natural generalization of this family. We stress that this extension is crucial for our main result, as the permutation property (with respect to which we prove Theorem 1.1) is not k-wise independent, but does Gur, Liu & Rothblum cc satisfy our more general notion. 7 The proof in (Fischer et al. 2014) is technically quite involved and includes several subtle and non-trivial arguments. For example, while typically property testing lower bounds are shown by exhibiting two distributions that are chosen only as a function of the property, the argument in (Fischer et al. 2014) crucially relies on distributions that are functions of both the property and the description of the specific analyzed algorithm. This entails the usage of several complex mechanisms. For example, they rely on an involved treatment of adaptivity, which consists of procedures for "grafting" decision trees, and use a special type of algorithms (called "readers") that expose low-entropy portions. Perhaps the most significant complication is that their argument uses a delicate information theoretic analysis to handle MAPs that have a two-sided error.
In contrast, our proof is much shorter and consists purely of a combinatorial argument, which does not require any special treatment of adaptivity and two-sided error and does not use information theory.

Organization.
In Section 2, we introduce the notations and definitions that we use throughout this work. In Section 3, we prove our main technical contribution, which is an MAP lower bound for relaxed k-wise independent properties. In Section 4, we derive our main result: an exponential separation between MAPs and AMPs. In Section 5, we present and prove our results regarding oblivious proofs of proximity. Finally, in Section 6, we conclude with a discussion and raise open problems.

Preliminaries
In this section, we establish the definitions and notions that we will need throughout this work.

Properties and distance.
We focus on testing properties of functions and identify a "property" with the set of functions having that property. More accurately, for each n ∈ N, let D n and R n be sets. Let F n be the set of functions from D n to R n . We define a property as an ensemble Π = n Π n , where Π n ⊆ F n for all n.
For an alphabet Σ, we denote the Hamming distance between two strings x, y ∈ Σ n by Δ(x, y) we also say that x is ε-close to S and otherwise x is ε-far from S. We extend these definitions to functions by identifying functions with their truth tables (viewed as strings).
Integrality. Throughout this work, for simplicity of notation, we use the convention that all (relevant) integer parameters that are stated as real numbers are implicitly rounded to the closest integer.

Proofs of proximity.
We recall the definitions of MA and AM proofs of proximity (i.e., MAPs and AMPs), following (Gur & Rothblum 2018). Throughout, for an algorithm V we denote by V f (n, ε, w) the output of V given oracle access to a function f and explicit access to inputs n, ε, and w; if V is a probabilistic algorithm, we write Pr[V f (n, ε, w) = z] to represent the probability over the internal randomness of V that this outcome is z.
Definition 2.1 (MAP). A Merlin-Arthur proof of proximity (MAP) for a property Π = n Π n consists of a probabilistic algorithm V , called the verifier, that is given as explicit inputs an integer n ∈ N, a proximity parameter ε > 0, and a proof string w ∈ {0, 1} * . In addition, it is given oracle access to a function f ∈ F n . The verifier satisfies the following conditions.
(i) Completeness: For every n ∈ N and f ∈ Π n , there exists a string w (the proof) such that for every ε > 0 the verifier accepts with high probability; that is, (ii) Soundness: For every n ∈ N, function f ∈ F n , string w, and proximity parameter ε > 0, if f is ε-far from Π n , then the verifier rejects with high probability; that is, A MAP is said to have query complexity q : N × R + → N if for every n ∈ N, ε > 0, f ∈ F n , and string w ∈ {0, 1} * , the verifier reads at most q(n, ε) bits in its queries to f . We say that a MAP has proof complexity p : N → N if for every n ∈ N, there always exists a w ∈ {0, 1} p(n) satisfying the conditions of Definition 2.1. We define the complexity of the MAP to be t(n, ε) = q(n, ε) + p(n). Next, we define AM proofs of proximity (AMPs) similarly to MAPs, except that here the proof is also a function of the inner randomness of the verifier (alternatively, the verifier first sends the prover its entire random string and is deterministic after that). Here, we use Pr[V f (n, ε, w; r) = z] to represent the probability over the random string r that this outcome is z.
Definition 2.2 (AMP). An Arthur-Merlin proof of proximity (AMP) for a property Π = n Π n consists of a probabilistic algorithm V , called the verifier, that is given as explicit inputs an integer n ∈ N, a proximity parameter ε > 0, and a proof string w that depends on the verifier's random string r, as well as oracle access to a function f ∈ F n . The verifier must also be deterministic given the random string r. The protocol satisfies the following conditions.
(i) Completeness: For every n ∈ N and f ∈ Π n , cc Separation Between MAP and AMP Page 13 of 44 12 (ii) Soundness: For every n ∈ N, function f ∈ F n , and proximity parameter ε > 0, if f is ε-far from Π n , then: Analogously to MAPs, an AMP is said to have query complexity q : N × R + → N if for every n ∈ N, ε > 0, f ∈ F n , and string w ∈ {0, 1} * , the verifier reads at most q(n, ε) bits in its queries to f ; and proof complexity p : N × R + → N if for every n ∈ N and f ∈ F n , with probability at least 2 3 over coin tosses r in the first round, there exists a w(r) ∈ {0, 1} p(n,ε) satisfying the completeness condition of Definition 2.2. We define the complexity of the AMP to be t(n, ε) = q(n, ε) + p(n, ε).
We note that we do not include the randomness complexity of the verifier in the complexity of the protocol (although the randomness complexity in all the protocols described in this work is not large). This is a similar choice to what is done in similar contexts such as AM query and communication complexities. Moreover, we show in Appendix A (see Theorem A.1) that if a property Π of functions f : D n → R n , such that |R n | |Dn| = O(exp(poly(n))), admits an AMP verifier with query complexity q and proof complexity p, then it also admits an AMP verifier with query complexity O(q), proof complexity O(p), and randomness complexity O(log n). 8 This transformation is similar to known results of Newman (Newman 1991) in the context of communication complexity, Goldreich and Sheffet (Goldreich & Sheffet 2010) in the context of property testing, and Gur and Rothblum (Gur & Rothblum 2018) for MAPs. Its main disadvantage, however, is that it does not preserve the computational complexity of the verifier.

MAP lower bound for (relaxed) k-wise independence
In this section, we show a general MAP lower bound for a large class of properties. More specifically, we show that any MAP for a Gur, Liu & Rothblum cc (non-degenerate) property that is k-wise independent, must have complexity Ω( √ k). By a k-wise independent property, we mean that if we sample a random element having the property, then its restriction to any k coordinates looks uniform. As mentioned in the introduction, this generalizes a result due to Fischer et al. (Fischer et al. 2014).
We would like to apply this lower bound to the permutation property. However, the permutation property is not k-wise independent and so we cannot apply it directly. 9 Rather, we give a relaxed notion of k-wise independence that does capture the permutation property and for which we can similarly derive an MAP lower bound.
We proceed to define our relaxed notion of k-wise independence. Recall that we use F n to denote the set of all functions from D n to R n (see Section 2).
Definition 3.1 (Relaxed k-wise Independence). Let Π = n≥1 Π n be a property, where Π n ⊂ F n for every n. We say that Π is relaxed k-wise independent, for k = k(n), if there exists a constant C ≥ 1 such that for all positive integers n, all pairwise distinct k- Note that the standard definition of k-wise independence corresponds to the special case of Definition 3.1 when C = 1 (in which case the inequality in (3.2) can be replaced with an equality).
At first glance, it may seem that the relaxation that we allow in Definition 3.1 is relatively minor and any lower bound that holds for the full-fledged definition should easily be extendable to our relaxed variant. We argue that it is not the case. For example, in a seminal work, Braverman (Braverman 2011) showed that any k-wise independent distribution (for k that is poly-logarithmic) fools AC 0 circuits. Now, consider the permutation property (to be cc Separation Between MAP and AMP Page 15 of 44 12 defined formally in Section 4) which as noted above is not even pairwise independent but does satisfy our relaxed variant (with k = √ n). It is not too hard to see that there is a very simple AC 0 circuit for checking whether a function is a permutation: simply by checking whether there exist a pair of entries in the truth table that are identical-thus, our seemingly minor relaxation completely sidesteps Braverman's result. As a matter of fact, a similar situation occurs in the context of AMPs: Rothblum et al. (Rothblum et al. 2013) showed an AMP lower bound for any exact k-wise independent distribution, whereas we show a protocol for the permutation property with logarithmic complexity.
Having defined our notion of relaxed k-wise independence, we proceed to describe a second important condition that we require: namely, that the property is sparse, in the sense that a random function is far from the property. Sparsity is essential for our result since there are trivial properties that are k-wise independent but are testable with very few queries (e.g., the property that consists of all functions).
Definition 3.3 (Sparse Property). Fix the proximity parameter ε = 1 10 . We say that a property Π n = n∈N Π n is t(n)-sparse if: We can now state our main theorem for this section.
Theorem 3.4. Let Π be a relaxed k-wise independent and ksparse property. Then, any MAP for Π, with respect to proximity parameter ε = 1/10, with proof complexity p and query complexity q must satisfy p · q = Ω(k).
The intuition and high-level approach for the proof are as follows. First, we use the duality of an MAP as a collection of partial testers (Fischer et al. 2014). More specifically, the existence of an MAP for a property Π implies that there is some large "subproperty" Π ⊆ Π and a tester T that distinguishes between inputs in Π from those that are far from Π. This simple observation reduces lower bounding MAPs for Π to lower bounding a partial tester for an arbitrary, but large, subproperty. To show such a lower bound, consider the uniform distribution on Π vs. the uniform distribution over functions that are far from Π. We would like to argue that these two distributions look the same to T , which therefore cannot distinguish between them.
As a matter of fact, we will argue that both these distributions are "close" to being k-wise independent, which suffices as long as k is larger than the tester's query complexity. First, by the sparsity condition we have that the uniform distribution over functions that are far from Π is close to the uniform distribution over all functions. Clearly, the latter is k-wise independent.
As for the uniform distribution over Π , we would like to argue that since Π covers a substantial part of Π, which is relaxed kwise independent, then also Π is relaxed k-wise independent. The problem with this argument is that Π only consists of a 2 −p fraction of Π, and so it could be quite far from being even relaxed k-wise independent (e.g., it could be that the value of functions in Π on some fixed elements of R n is constant over all functions in Π ).
This seems like a significant difficulty and was overcome using highly elaborate techniques in (Fischer et al. 2014). In contrast, we suggest a much simpler argument. The idea is that we first reduce the soundness error of the MAP to 2 −O(p) by repetition. This increases the query complexity of the tester to O(p · q) but now that the soundness error is so small, that the fact that Π covers a 2 −p fraction of Π is sufficient to make the argument go through.
We proceed to the actual proof.

Proof of Theorem 3.4.
Let C be a constant such that Π n satisfies the constraints of Definition 3.1. Let V be an MAP verifier, with respect to proximity parameter ε, for Π n , and denote its proof complexity by p and query complexity by q. Note that any MAP with standard 2/3 completeness and soundness probability (as in Definition 2.1) can be amplified, via O(p) repetitions, to have completeness and soundness errors 1 10C · 2 −p at the cost of increasing the query (but not the proof) complexity by a multiplicative factor of O(p), to O(p · q). For concreteness, let us fix a constant C such that a (C ·p)-fold repetition of V has completeness and soundness errors 1 10C · 2 −p (while having proof complexity p and query complexity C · p · q). Assume toward a contradiction that p · q ≤ k 10C . Recall that for Π ⊆ Π, a (Π, Π )-partial tester (a notion due to (Fischer et al. 2014)) is a tester that is required to accept functions in the subset Π and reject functions that are ε-far from the superset Π. As pointed out by Fischer et al. (Fischer et al. 2014) an MAP as we assumed above, implies a covering of the property by partial testers as follows. For every possible proof string w ∈ {0, 1} p , let By the completeness requirement of an MAP, these sets cover the property Π n . That is, w S w = Π n .
Since the number of sets S w is at most 2 p , there exists a proof w that corresponds to a large S w . Namely, such that |S w | ≥ |Π n |·2 −p . We fix such a proof w and argue that the corresponding (Π n , S w )partial tester must make Ω(k) queries, which would contradict our assumption, thereby proving Theorem 3.4. Hence, we have reduced proving an MAP lower bound for Π n to proving a partial testing lower bound for (Π n , S w ).
Let V f w (n, ε) := V f (n, ε, w) be the (S w , Π n )-partial tester that is induced by V when we fix the proof string w (and with respect to parameters n and ε). We use the notation V f w (n, ε; r) to denote the deterministic output V f w when its random string is set to r. Let B ε = {f ∈ F n : f is ε-far from Π n } (i.e., the no-instances). As is standard in the property testing literature, we prove a lower bound on the query complexity q of a tester by presenting a distribution over YES-instances (f ∈ S w ) and a distribution over NO-instances (f ∈ B ε ) and bounding away from 1 the distinguishing probability for every deterministic algorithm making q queries. Specifically, we give distributions over S w and B ε such that any deterministic algorithm making q queries to f has at most a 1 − 1 4C · 2 −p probability of distinguishing between them, which is sufficient for our purposes. In our case, we simply consider the uniform distributions over S w and B ε .
More formally, we first observe that By Eq. (3.5), it suffices to bound the distinguishing probably for any deterministic verifier. We do this via the following lemma.
Lemma 3.6. For any deterministic verifier W with query complexity at most k 10 , we have that Proof. We first show that We can view the verifier W as a decision tree of depth q = k/10. Each leaf of the decision tree is associated with indices i 1 , i 2 , . . . , i q ∈ D n and values t 1 , t 2 , . . . , t q ∈ R n such that a function f ∈ F n is accepted at that leaf if and only if f (i j ) = t j for all j ∈ [q ]. We may assume without loss of generality that the sets of indices i 1 , . . . , i q for all paths in the decision tree are pairwise distinct. Fix such a sequence of indices i 1 , . . . , i q ∈ D n and values t 1 , . . . , t q ∈ R n . Then, Here, we have used k-sparsity to note that |Fn\Bε| |Bε| ≤ 1 |Rn| k −1 , and we used that q = k 10 . On the other hand, we also have that: Pr by relaxed q -wise independence and the lower bound on the size of S w .
Dividing (3.8) by (3.10), we obtain that Now, summing the above equation over all leaves of the decision tree corresponding to W (since these correspond to disjoint events) gives us (3.7).
Given (3.7), we now consider two cases. First, if we are obviously done. Otherwise, we can assume that and so: where the first inequality is by (3.7). The lemma follows. Now, we are ready to use Lemma 3.6 to complete our proof of Theorem 3.4. Because V f w has completeness and soundness errors 1 10C · 2 −p , we have that On the other hand, by (3.5) and Lemma 3.6, it holds that which is a contradiction. Therefore, we can conclude that p · q ≥ k 10C , as desired.

An exponential gap between MAP and AMP
In this section, we prove Theorem 1.1, by exhibiting a property with an exponential gap between its AMP and MAP complexities. In fact, we show this separation result with respect to the permutation property, which we define next: To prove Theorem 1.1, we prove the following upper and lower bounds for the permutation property.  Lemma 4.3 (MAP lower bound). Any MAP, with respect to proximity parameter ε ≤ 1/10, for Perm with proof complexity p and query complexity q must satisfy p · q = Ω( √ n).
Note that p · q = Ω( √ n) implies that p + q = Ω(n 1/4 ), and so combining Lemma 4.2 and Lemma 4.3 shows that Perm has an AMP with logarithmic complexity, whereas any MAP for Perm has complexity Ω(n 1/4 ). This proves Theorem 1.1.
Section organization. The rest of this section is devoted to the proofs of Lemma 4.2 and Lemma 4.3. We first prove the AMP upper bound (Lemma 4.2) in Section 4.1 and then, the MAP lower bound (Lemma 4.3) in Section 4.2.

AMP upper bound-proof of Lemma 4.2. The AMP for checking whether f : [n] → [n] is a permutation proceeds as follows. First, the verifier randomly selects O (1/ε) integers from [n] (with repetition). Denote this (multi-)set of integers by S.
The verifier sends S to the prover and expects to get in response a sequence of integers (t s ) s∈S . After receiving these, the verifier simply checks whether f (t s ) = s for every s ∈ S. If so, it accepts, and otherwise, it rejects.
The proof complexity of this protocol is O (log(n)/ε), as the prover uses O(log n) bits to specify each t s . The query complexity is O (1/ε).
Completeness. Suppose f ∈ Perm n , i.e., f is indeed a permutation. The prover can respond with (t s ) s∈S , where t s = f −1 (s) for every s ∈ S. Given this response, the verifier accepts with probability 1.

Soundness. Assume that f : [n] → [n]
is ε-far from Perm n . Note that the range of f has size at most (1 − ε) · n, i.e., |{f (i) : i ∈ [n]}| ≤ (1 − ε) · n. 10 The only way in which the prover can convince the verifier to accept is if for all s ∈ S it holds that s is in the range Gur, Liu & Rothblum cc of f . Therefore, the probability that the verifier accepts is at most (1 − ε) O(1/ε) which is smaller than 1/3 (by setting the constant in the big-Oh notation to be sufficiently large).

MAP lower bound -Proof of Lemma 4.3.
We proceed to show that any MAP for Perm must have complexity Ω(n 1 4 ). More accurately, for a fixed proximity parameter ε = 1 10 , we show that any MAP for Perm, with respect to proximity parameter ε, with proof complexity p and query complexity q must satisfy p · q = Ω( √ n).
To show this, we simply show that Perm is relaxed √ n 10 -wise independent and √ n-sparse (as defined in Section 3). The MAP lower bound then follows from Theorem 3.4. This is done in the two lemmas below. Recall that for our property Perm, we have that R n = [n]. If the t j 's are distinct, then: where the last inequality uses the fact that q = √ n cc Separation Between MAP and AMP Page 23 of 44 12 We still need to show that Perm is sparse. Recall that B ε = {f ∈ F n : f is ε-far from Perm} (i.e., the no-instances).
Claim 4.5. For any constant ε ≤ 1 10 , we have that Proof. Recall that f : [n] → [n] is ε-far from Perm n if and only if the image of f has size at most (1−ε)·n. Thus, we need to upper bound the probability that a random function f has an image of size greater than (1 − ε) · n. Let k = n 2 + εn and consider the set }. If f is to have an image with size greater than (1 − ε) · n, then certainly we must have |S| ≥ n 2 . Now, each of the values f (k + 1), . . . , f(n) has probability at least |S| n ≥ 1 2 of colliding with a previous value. By the Chernoff bound, the probability that we get at most εn collisions among these last n − k values is at most for any ε ≤ 1 10 , as desired.
Proof. We clearly have that e − n 10 ≤ n − √ n for sufficiently large n.
This completes the proof of Lemma 4.3.

MA vs AM revisited: oblivious proofs of proximity
We revisit the MA versus AM problem within the context of oblivious proofs of proximity. These are proofs of proximity that have the special feature that the queries that the verifier makes are independent of the proof (or prover messages in the interactive setting). Such oblivious proofs should be thought of as a two phase process.
First, there is a query phase in which the verifier can make its queries but is not allowed to interact with the prover. In the communication phase, the verifier interacts with the prover (or just receives the proof in the non-interactive setting) but is not allowed to make any more queries.
We thus define (equivalently to the definition in (Gur & Rothblum 2018;Rothblum et al. 2013)) an oblivious MAP as an MAP in which a verifier V operates in the following stages: (1) V queries the input f , (2) V receives a proof w, and (3) V decides whether to accept or reject according to w and the queries that it made in the first stage.
The definition of oblivious AMPs is analogous, except for one subtle point. Namely, it is crucial that the query phase is decoupled from the proof phase; that is, the verifier first queries the input f , then it engages in a public-coin interaction in which it sends a fresh random string r, receives a proof w that depends on f and r, and rules according to w and the queries it made. In particular, the randomness that was used for the first step is not revealed to the prover. 11 While we find this definition to be the most natural one, we do remark that it has the unfortunate consequence that an oblivious AMP according to our definition is not necessarily an AMP. The reason is that the verifier in an oblivious AMP is allowed to toss coins that are not revealed to the prover. Still, an oblivious AMP can be viewed as an AMAP (i.e., an AMP that is allowed to toss coins after receiving the proof).
In the next subsection, we show that the gap between the power of oblivious AMPs and oblivious MAPs is much smaller than the one exhibited in Theorem 1.1. Subsequently, we use this result to derive an exponential separation between the power of public and private coin oblivious proofs of proximity.

A generic lower bound.
In this subsection, we prove Theorem 1.2, which shows that oblivious AMPs can only be quadratically stronger than oblivious MAPs, and in fact, standard testers. We remark that this result generalizes the lower bound on oblivious MAPs in (Gur & Rothblum 2018). Fix ε > 0 and input length n ∈ N, and let Π be any property of inputs of length n. Suppose that there exists an AMP verifier V , with respect to proximity parameter ε, for Π with proof complexity p and query complexity q. We show that this implies that there exists a tester (i.e., MAP with proof complexity 0), also with respect to proximity parameter ε, for Π with query complexity O(p · q). We begin with a high-level overview, followed by a complete proof.
Overview. Recall that an AMP protocol has the following structure. The tester makes (possibly adaptive) queries a 1 , . . . , a q to the input function f , using randomness ρ queries . Then, the verifier samples fresh randomness ρ msg and sends it to the prover. In return, the prover replies with a proof w, which may arbitrarily depend on f , the proximity parameter ε, and the verifier message ρ msg . Finally the verifier reads w and decides according to it and the queries a 1 , . . . , a q .
The high-level idea is that since the query phase is independent of the proof phase (i.e., the verifier's message ρ msg and the prover's message w), a tester can emulate all possible proofs, while using the same samples for all invocations. To support a union bound over all possible proofs, we wish to perform standard parallel repetition. Indeed, this is the simple argument used in the lower bound on oblivious MAPs in (Gur & Rothblum 2018).
However, the situation is more involved when dealing with oblivious AMPs. Specifically, we cannot perform standard parallel repetition, as this would increase the proof complexity. 12 In addition, it is not clear a priori how the verifier should identify an (emulated) valid proof, since it is possible that for some verifier message there exists a proof that always fools the verifier. Gur, Liu & Rothblum cc The way these difficulties are dealt with is by observing that since the query phase and the proof phase are decoupled, then each oblivious AMP induces a family of testers that are determined by the verifier and prover messages. In particular, this allows us to perform soundness amplification on the induced testers, rather than on the protocol, and hence, this does not increase the proof complexity. This implies that, with high probability over verifier's message ρ msg , each of the corresponding induced testers decides correctly, with only an exponentially small probability of error.
Thus, we can invoke all the testers that are induced by all proofs that correspond to a particular verifier message ρ msg , while reusing the queries for all invocations. Finally, the completeness and soundness of the original AMP assert that with high probability we choose a good verifier message ρ msg , and so we can rule according to the induced tester. A complete proof follows.
Proof (Proof of Theorem 1.2). We follow the notation used in the overview. Assume, without loss of generality, that the AMP verifier V has soundness error at most 1/100 (this can be obtained via parallel repetition, while only increasing the proof and query complexity by a constant). For a verifier message ρ msg and prover message w denote by T ρmsg,w the tester that is induced by ρ msg and w = w(f, ρ msg , ε) (i.e., the decision procedure that the oblivious AMP verifier invokes after receiving the proof). Denote by T ρmsg,w (a 1 , . . . , a q ; ε), the random variable that represents the output of T ρmsg,w with respect to queries a 1 , . . . , a q drawn according to V 's distribution of queries. Let T ρmsg,w be the induced tester that is obtained by amplifying the soundness of T ρmsg,w via O(p) repetitions; denote its query complexity by q = O(p · q), to be determined precisely later. Note that all (amplified) induced testers perform queries according to the exact same distribution.
Consider the following tester T , which operates as follows.
1. Query step: Make the queries a 1 , . . . , a q that the (amplified) induced testers perform.
Clearly, the query complexity of T is as stated. We proceed to prove its correctness. For a function f (purportedly in the property Π), consider the quantity which can be viewed as measuring the hardness of the random "challenge" ρ msg that is posed by the verifier V ; that is, the probability of the optimal prover strategy to convince the verifier given the random message ρ msg . For completeness, suppose that f ∈ Π and observe that E ρmsg [hard f,Π (ρ msg )] ≥ 99/100. Thus, by an averaging argument, we have Pr ρmsg [hard f,Π (ρ msg ) ≥ 9/10] ≥ 9/10, which correspond to the "good" event that the verifier chose a random challenge ρ msg that admits a convincing prover strategy. In which case, there exists a proof w ∈ {0, 1} p such that The soundness argument is similar, only that now we need to rely on the amplification to tolerate a union bound over all possible proofs. More precisely, suppose f is ε-far from Π, and observe that E ρmsg [hard f,Π (ρ msg )] < 1/100. Thus, by an averaging argument, we have that Pr ρmsg [hard f,Π (ρ msg ) ≤ 1/10] ≥ 9/10, which correspond to the "good" event that the verifier chose a random challenge ρ msg that does not admit a con- Gur, Liu & Rothblum cc vincing prover strategy. Thus, We conclude the argument by choosing a sufficiently large q = O(pq) such that Pr[T f (ε) = 1] ≥ 2/3.

Application: a chasm between public and private coin.
As an application, we use Theorem 1.2 to derive lower bounds on public-coin oblivious interactive proofs of proximity and show an exponential separation between public-coin and private-coin protocols in this setting. More specifically, (private-coin) oblivious interactive proofs of proximity (oblivious IPPs) (Rothblum et al. 2013) are a natural extension of oblivious MAPs, in which the proof is replaced with a prover with whom the verifier can interact. More accurately, an r-round oblivious IPP consists of a verifier V and prover P that interact as follows: (1) V queries the input f , (2) V and P exchange messages in r rounds, where each round contains one message from each of the parties, and (3) at the end of the interaction, V rules according to the transcript of the interaction and the queries it made.
A public-coin oblivious interactive proof of proximity is simply referred to as an r-round oblivious AMP. Here, the definition is the same as with oblivious IPPs, except that now the verifier is only allowed to send a (fresh) random string in each round. Note that standard oblivious AMPs (to which we referred in the previous subsection) are simply 1-round oblivious AMPs. The complexity of an oblivious IPP is the sum of its communication complexity and query complexity.
We remark that in polynomial time computation, as well as in non-oblivious proofs of proximity, the aforementioned models are roughly equivalent (see, e.g., (Rothblum et al. 2013)). In stark contrast, as the following theorem shows, it turns out that oblivious IPPs can be much more powerful than their public-coin counterparts.
Theorem 5.1. There exists a property Π for which there exists a 2-round oblivious IPP whose complexity is exponentially smaller than that of any r-round oblivious AMP, for constant r ∈ N.
We prove Theorem 5.1 with respect to the following natural property that consists of all low-degree polynomials that have a root in a predetermined subset. More precisely, let F be a finite field, let m, d ∈ N such that d·m < |F|/10 and let H be an arbitrary subset of F of size d. Consider the following property. ∃z ∈ H m such that P (z) = 0}.
Throughout this section, we fix a fairly standard parameterization of low degree extension from the PCP literature; namely, we fix a size parameter n ∈ N, degree d = log(n) − 1, dimension m = log(n)/ log log(n), a finite field F of size 10 · dm, and a subset H of F of size d (note that |H| m = n). Then, we denote TensorRoot = TensorRoot F,m,d,H , with the respect to the parameters that we fixed. 13 We prove Theorem 5.1 via the following two lemmas. Proofs of proximity for distribution testing can be thought of as oblivious in a very strong sense (because the verifier cannot query its input, but rather passively receives a set of samples). This allows for a very strong lower bound on r-round AM proofs of proximity for distribution testing. Namely, for any number of rounds r (including super-constant values) these proofs of proximity can be emulated by standard distribution testers (i.e., without proof or prover) at only a quadratic cost.
In contrast, our lower bound on r-round oblivious AMPs degrades as the round complexity increases. Hence, it is natural to inquire whether our lower bound can be improved to match the stronger lower bound that holds in the distribution testing setting.
However, we remark that the above strengthening is impossible, and in fact there exists a property for which any lower bound for oblivious AMPs must degrade with the round complexity. This follows from the bounds on the Tensor Sum property that appears in (Gur & Rothblum 2018). More specifically, the argument in (Gur & Rothblum 2018) shows that for every r, there exist an rround AMP protocol for the Tensor Sum property with complexitỹ O(n 1/r ). 14 Moreover, their sumcheck-based protocol is actually an oblivious AMP. Since in (Gur & Rothblum 2018), it is shown that the Tensor Sum property requiresΩ(n) queries to test, then together with our Theorem 5.1, it holds that any r-round oblivious AMP must have complexity n Ω(1/r) . So the complexity of r-round oblivious AMPs for the Tensor Sum property decreases with as the number of rounds increases. 5.2.1. Proof of Lemma 5.3. By Corollary 5.5 (and the discussion that follows it), to prove Lemma 5.3 it suffices to prove that any (standard) property tester for TensorRoot must makẽ Ω(n) queries. We prove this via the framework of Blais, Brody, and Matulef (Blais et al. 2012) for showing property testing lower bounds via communication complexity lower bounds. To this end, we assume basic familiarity with communication complexity (for a comprehensive introduction to communication complexity, see (Kushilevitz & Nisan 1997)).
The basic approach of (Blais et al. 2012) is to reduce a hard communication complexity problem to the property testing problem for which we want to show a lower bound. We follow (Blais et al. 2012) by showing a reduction from the well-known communication complexity problem of set-disjointness. The aforementioned framework allows us to obtain a lower bound on the query complexity of testing the Tensor Root property.
Recall that the set-disjointness problem is the communication complexity problem wherein Alice gets an n-bit string x, Bob gets an n-bit string y, and their goal is to decide whether there exists i ∈ [n] such that x i = y i = 1. Equivalently, Alice and Bob's inputs can be viewed as indicator vectors of sets A, B ⊆ [n]. In this case, the goal of the players is to decide if the sets corresponding to their inputs intersect or not. We denote this problem by DISJ n .
It is well-known that the randomized communication complexity of the set-disjointness problem is linear in the size of the inputs, even under the promise that A and B intersect in at most one element.
Theorem 5.6 (Kalyanasundaram & Schnitger 1992). For every n ∈ N, every randomized communication complexity protocol for DISJ n must use Ω(n) bits of communication.
We are now ready to prove the property testing lower bound on the TensorRoot property via reduction from the set-disjointness problem DISJ n . Let T be a tester, with respect to proximity parameter ε = 1/10, for TensorRoot with query complexity q. We prove that q =Ω(n).
Consider the following randomized communication complexity protocol. There are two parties, Alice and Bob. Alice receives an input x ∈ {0, 1} n , and Bob receives an input y ∈ {0, 1} n . The goal is to decide whether (x, y) ∈ DISJ n , i.e., there exists an i ∈ [n] such that x i = y i = 1; or whether (x, y) / ∈ DISJ, i.e., for every i ∈ [n] either x i = 0 or y i = 0. 15 Recall that we fixed d = log(n) − 1, 3. The combining operator: For each query z ∈ F m asked by the tester and values P x (z) and P y (z) computed by Alice and Bob, Alice feeds the tester T with the evaluation of the m-variate individual degree 2d polynomial P (z) := 1−P x (z)· P y (z).
For completeness, note that if (x, y) ∈ DISJ n , then there exists an i ∈ [n] such that x i = y i = 1. Hence, there exists a t ∈ H m such that P x (t) = P y (t) = 1, and so 1 − P x (t) · P y (t) = 0. Therefore, the (combined) polynomial P has a root in H m , and so P ∈ TensorRoot.
For soundness, note that if (x, y) ∈ DISJ n , then for every i ∈ [n] either x i = 0 or y i = 0. Hence, for every t ∈ H m it holds that either P x (t) = 0 or P y (t) = 0, and so 1 − P x (t) · P y (t) = 1. Therefore, the (combined) polynomial P does not have a root in H m . By the distance of the Reed-Muller code (i.e., the Schwartz-Zippel Lemma), this implies that P is ε-far from TensorRoot.
Since Alice can obtain the answer to each query of the tester T to the function P using O(log n) bits of communication, then the reduction above implies a communication complexity protocol for DISJ n with communication complexity O(q · log(n)), where recall that q denotes the query complexity of T . Plugging the Ω(n) lower bound on the (randomized) communication complexity of DISJ n , we obtain that q =Ω(n), which concludes the proof of Lemma 5.3.
(b) A line through the root: The verifier sends (some canonical representation) of the line that passes through its secret query r and the purported root z. (Note that this does not reveal the full identity of r to the prover).
(c) Restricting the polynomial to the line: the prover sends the purported restriction of P to the line , denotedP | , specified by its 2d coefficients.
(d) Line-versus-point consistency: The verifier checks that P | , restricted to the point r, agrees with the value P (r) that it had originally queried.
Since low-degree testing can be performed via O(log(n)) queries, the protocol above clearly satisfies the query complexity requirement. In terms of communication, the verifier sends a line (which can be characterized by two canonically chosen points), and the prover sends 2d coefficients, thus the communication complexity is O(log 2 n). Completeness is immediate by construction. For soundness, suppose that P is ε-far from TensorRoot. If P is ε-far from being an individual degree 2d polynomial, then the low-degree test rejects with high probability. Otherwise, by the distance of the Reed-Muller code (i.e., the Schwartz-Zippel Lemma) we can assume that P is ε-close to an individual degree 2d polynomialP such that P (x) = 0 for all x ∈ H m . Note that with probability 1 − ε (and by our assumption we have 1 − ε > 9/10) the verifier queries a "good" point r such that P (r) =P (r). Suppose hereafter that this is the case.
The prover receives the line that passes through the secret query r and the purported root z. However, since this line is canonically represented, the prover does not know the location of the point r on the line . Since a low-degree polynomial restricted to a line is a Reed-Solomon codeword, thenP | must disagree with P except on a negligible number of points, and so the verifier rejects with probability at least 9/10 · (1 − o(1)) ≥ 2/3. Gur, Liu & Rothblum cc

Discussion and open problems
The complexity of the permutation property for testers, which do not use a proof, isΘ( √ n). In this work, we showed a lower bound ofΩ(n Second, our work shows that AMPs can be exponentially more efficient than MAPs. It is natural to ask whether the converse also holds-can MAPs be much more efficient than AMPs? A partial answer to this question is known. As mentioned in 3, every MAP with complexity c can be emulated by an AMP with complexity (roughly) c 2 .
Thus, MAPs can be at most quadratically more efficient than AMPs. However, we do not know a property for which this gap is tight. In particular, the following problem is open: Problem 6.2. Does there exist a property Π that has an MAP with complexity O( √ n) but every AMP for Π must have complexity Ω(n)?

A. Randomness reduction in AMPs
In this section, we prove the following theorem, which shows that for reasonable properties, we can reduce the randomness of any AMP for the property down to O(log n). Specifically, we have the following theorem.
Theorem A.1. Let Π be a property of functions f : D n → R n , where |R n | |Dn| ≤ exp(poly(n)). If Π has an AMP verifier that makes q queries, uses a proof of length p, and uses r random bits, then Π has an AMP that makes O(q) queries, uses a proof of length O(p), and uses O(log n) random bits. We note that most properties that are considered have |R n | = O(poly(n)) and |D n | = O(poly(n)), so properties that have |R n | |Dn| = ω(exp(poly(n))) seem quite pathological.
Proof. Our proof follows closely to the proof of MAP randomness reduction in (Gur & Rothblum 2018). Let F n denote the set of all functions D n → R n . Let V be an AMP verifier for Π n . For a function f ∈ F n , let V f (n, ε, w; t) denote the output of V when running with oracle access to f with random string t of length r.
We show, using the probabilistic method, that there exists a multiset S of strings in {0, 1} r of size poly(n) such that for all functions f ∈ F n it holds that β f (S) ≤ 1/7.
Fix a function f ∈ F n . Sample k strings from {0, 1} r uniformly at random and let these be the set S. By the Chernoff bound, we have that β f (S) ≤ 1/7 with probability 2 −Ω(k) over our random choice of S. Thus, by setting k = O(log |F n |) = O log(|R n | |Dn| ) = O(poly(n)) and applying the union bound over all f ∈ F n , we obtain that there exists a multiset S as desired. Now, we can obtain an AMP verifier using only O(log |S|) = O(log n) random bits by simply running the original verifier V but with respect to random strings selected uniformly from S (instead of {0, 1} r ). We can amplify the completeness and soundness to 2 3 with O(1) repetitions. Gur, Liu & Rothblum cc Open Access. This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material in this article are included in the article's Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article's Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To viewa copy of this licence, visit http://creativecommons.org/ licenses/by/4.0/.