Difference between revisions of "Complexity Zoo:S"

From Complexity Zoo
Jump to navigation Jump to search
(+ SIZE)
 
(5 intermediate revisions by 4 users not shown)
Line 7: Line 7:
 
  * If x is not in L, then M accepts x with probability exactly equal to p.
 
  * If x is not in L, then M accepts x with probability exactly equal to p.
 
Defined in <ref>Abuzer Yakaryılmaz and A.C. Cem Say. Languages recognized by nondeterministic quantum finite automata. https://arxiv.org/abs/0902.2081v2</ref>, where it was shown that S<sup>≠</sup> = [[Complexity Zoo:N#nql_2|NQL]].
 
Defined in <ref>Abuzer Yakaryılmaz and A.C. Cem Say. Languages recognized by nondeterministic quantum finite automata. https://arxiv.org/abs/0902.2081v2</ref>, where it was shown that S<sup>≠</sup> = [[Complexity Zoo:N#nql_2|NQL]].
 +
 +
----
  
 
===== <span id="s2p" style="color:red">S<sub>2</sub>P</span>: Second Level of the Symmetric Hierarchy =====
 
===== <span id="s2p" style="color:red">S<sub>2</sub>P</span>: Second Level of the Symmetric Hierarchy =====
Line 24: Line 26:
 
Contains (and contrast with) [[Complexity Zoo:O#o2p|O<sub>2</sub>P]]. If [[Complexity Zoo:N#np|NP]] is contained in [[Complexity Zoo:P#ppoly|P/poly]] then [[Complexity Zoo:P#ph|PH]] = S<sub>2</sub>P (attributed to Sengupta in [[zooref#cai01|[Cai01]]]), and even is equal to [[Complexity Zoo:O#o2p|O<sub>2</sub>P]] [[zooref#cr06|[CR06]]].
 
Contains (and contrast with) [[Complexity Zoo:O#o2p|O<sub>2</sub>P]]. If [[Complexity Zoo:N#np|NP]] is contained in [[Complexity Zoo:P#ppoly|P/poly]] then [[Complexity Zoo:P#ph|PH]] = S<sub>2</sub>P (attributed to Sengupta in [[zooref#cai01|[Cai01]]]), and even is equal to [[Complexity Zoo:O#o2p|O<sub>2</sub>P]] [[zooref#cr06|[CR06]]].
  
By a padding argument to a similar result in [[#s2e|S<sub>2</sub>E]], neither S<sub>2</sub>P nor [[Complexity Zoo:O#o2p|O<sub>2</sub>P]] has any fixed poly sized circuits [[zooref#li23|[Li23]]].
+
----
 
 
  
 
===== <span id="s2e" style="color:red">S<sub>2</sub>E</span>: Second Level of the Symmetric Linear Exponent Hierarchy =====
 
===== <span id="s2e" style="color:red">S<sub>2</sub>E</span>: Second Level of the Symmetric Linear Exponent Hierarchy =====
Line 31: Line 32:
 
Same as [[#s2p|S<sub>2</sub>P]], except that the predicate P may be exponential.
 
Same as [[#s2p|S<sub>2</sub>P]], except that the predicate P may be exponential.
  
Requires maximal sized circuits (that is, size &#937;(2<sup>n</sup>/n)) [[zooref#li23|[Li23]]]. In fact, this holds for the more general class of O<sub>2</sub>E (defined analaguosly to  [[Complexity Zoo:O#o2p|O<sub>2</sub>P]]).
+
Requires near-maximal sized circuits (that is, size &#937;(2<sup>n</sup>/n)) [[zooref#li23|[Li23]]]. In fact, this holds for the more general class O<sub>2</sub>E (defined analogously to  [[Complexity Zoo:O#o2p|O<sub>2</sub>P]]).
  
 
----
 
----
Line 171: Line 172:
  
 
----
 
----
 
+
===== <span id="sigma2p" style="color:red">&#931;<sub>2</sub>P</span>: [[Complexity Zoo:N#np|NP]] With [[Complexity Zoo:N#np|NP]] Oracle =====
===== <span id="sigma2p" style="color:red">&#931;<sub>2</sub>P</span>: [[Complexity Zoo:N#np|NP]] With [[Complexity Zoo:C#conp|coNP]] Oracle =====
 
 
Contains languages whose complements are in [[Complexity Zoo:P#pi2p|&#928;<sub>2</sub>P]].
 
Contains languages whose complements are in [[Complexity Zoo:P#pi2p|&#928;<sub>2</sub>P]].
  
 
Along with [[Complexity Zoo:P#pi2p|&#928;<sub>2</sub>P]], comprises the second level of [[Complexity Zoo:P#ph|PH]], the polynomial hierarchy.
 
Along with [[Complexity Zoo:P#pi2p|&#928;<sub>2</sub>P]], comprises the second level of [[Complexity Zoo:P#ph|PH]], the polynomial hierarchy.
 +
 +
Note that this is equal to [[Complexity Zoo:N#np|NP]] with a [[Complexity Zoo:C#conp|coNP]] oracle.
  
 
[[zooref#uma98|[Uma98]]] has shown that the following problems are complete for &#931;<sub>2</sub>P:
 
[[zooref#uma98|[Uma98]]] has shown that the following problems are complete for &#931;<sub>2</sub>P:
Line 188: Line 190:
  
 
----
 
----
 +
===== <span id="size" style="color:red">SIZE(f(n))</span>: Circuit Size f(n) =====
 +
See [[Complexity Zoo:C#csize|CSIZE(f(n))]].
  
 +
----
 
===== <span id="skc" style="color:red">SKC</span>: Statistical Knowledge Complexity =====
 
===== <span id="skc" style="color:red">SKC</span>: Statistical Knowledge Complexity =====
 
A hierarchy of generalizations of [[#szk|SZK]], in which Arthur is allowed to gain <i>some</i> information from his interaction with Merlin.
 
A hierarchy of generalizations of [[#szk|SZK]], in which Arthur is allowed to gain <i>some</i> information from his interaction with Merlin.
Line 312: Line 317:
 
The class of functions computable as |S|, where S is the set of output values returned by the accepting paths of an [[Complexity_Zoo:N#nl|NL]] machine.
 
The class of functions computable as |S|, where S is the set of output values returned by the accepting paths of an [[Complexity_Zoo:N#nl|NL]] machine.
  
Defined in [[zooref#aj93|[AJ93]]], where it is also shown that span-L is a hard class in the sense that span-L is contained in [[Complexity Zoo:F#fp|FP]] if and only if [[Complexity_Zoo:P#p|P]] = [[Complexity Zoo:N#np|NP]].
+
Defined in [[zooref#aj93|[AJ93]]], where it is also shown that span-L is a hard class in the sense that span-L is contained in [[Complexity Zoo:F#fp|FP]] if and only if [[Complexity_Zoo:F#fp|FP]] = [[Complexity Zoo:Symbols#sharpp|#P]].
  
 
Span-L is contained in [[Complexity Zoo:Symbols#sharpp|#P]], and if span-L = [[Complexity Zoo:Symbols#sharpp|#P]], then [[Complexity_Zoo:N#nl|NL]] = [[Complexity Zoo:N#np|NP]] [[zooref#aj93|[AJ93]]].
 
Span-L is contained in [[Complexity Zoo:Symbols#sharpp|#P]], and if span-L = [[Complexity Zoo:Symbols#sharpp|#P]], then [[Complexity_Zoo:N#nl|NL]] = [[Complexity Zoo:N#np|NP]] [[zooref#aj93|[AJ93]]].

Latest revision as of 17:00, 6 November 2024

Back to the Main Zoo - Complexity Garden - Zoo Glossary - Zoo References


Complexity classes by letter: Symbols - A - B - C - D - E - F - G - H - I - J - K - L - M - N - O - P - Q - R - S - T - U - V - W - X - Y - Z

Lists of related classes: Communication Complexity - Hierarchies - Nonuniform


S - S2P - S2E - S2-EXP•PNP - SAC - SAC0 - SAC1 - SAPTIME - SBP - SBPcc - SBQP - SC - SE - SEH - SelfNP - SFk - Σ2P - SIZE(f(n)) - SKC - SL - SLICEWISE PSPACE - SNP - SO - SO(Horn) - SO(Krom) - SO(LFP) - SO(TC) - SO[] - SP - span-L - span-P - SPARSE - SPL - SPP - SQG - SUBEXP - symP - SZK - SZKh



S: Exclusive Stochastic Languages

The class of languages L for which there is a real number p, and probabilistic finite automaton M, such that:

* If x is in L, then M accepts x with some probability not exactly equal to p
* If x is not in L, then M accepts x with probability exactly equal to p.

Defined in <ref>Abuzer Yakaryılmaz and A.C. Cem Say. Languages recognized by nondeterministic quantum finite automata. https://arxiv.org/abs/0902.2081v2</ref>, where it was shown that S = NQL.


S2P: Second Level of the Symmetric Hierarchy

The class of decision problems for which there is a polynomial-time predicate P such that, on input x,

  1. If the answer is 'yes,' then there exists a y such that for all z, P(x,y,z) is true.
  2. If the answer is 'no,' then there exists a z such that for all y, P(x,y,z) is false.

Note that this differs from Σ2P in that the quantifiers in the second condition are reversed.

Less formally, S2P is the class of one-round games in which a prover and a disprover submit simultaneous moves to a deterministic, polynomial-time referee. In Σ2P, the prover moves first.

Defined in [RS98], where it was also shown that S2P contains MA and Δ2P. Defined independently in [Can96].

Contained in ZPPNP [Cai01].

Contains (and contrast with) O2P. If NP is contained in P/poly then PH = S2P (attributed to Sengupta in [Cai01]), and even is equal to O2P [CR06].


S2E: Second Level of the Symmetric Linear Exponent Hierarchy

Same as S2P, except that the predicate P may be exponential.

Requires near-maximal sized circuits (that is, size Ω(2n/n)) [Li23]. In fact, this holds for the more general class O2E (defined analogously to O2P).


S2-EXP•PNP: Don't Ask

One of the caged classes of the Complexity Zoo.

Has been implicated in a collapse scandal involving AM[polylog], coNP, and EH.


SAC: Semi-Unbounded-Fanin AC

SACk is the class of decision problems solvable by a family of depth-O(logkn) circuits with unbounded-fanin OR & bounded-fanin AND gates. Negations are only allowed at the input level.

A uniformity condition may also be imposed.

Defined by [BCD+89], who also showed that SACk is closed under complement for every k>0.


SAC0: Semi-Unbounded-Fanin AC0

See SAC for definition.

Not closed under complement [BCD+89].


SAC1: Semi-Unbounded-Fanin AC1

See SAC for definition.

Equals LOGCFL/poly [Ven91].

Contained in ⊕SAC1 [GW96].


SAPTIME: Stochastic Alternating Polynomial-Time

The class of problems solvable by a polynomial-time Turing machine with three kinds of quantifiers: existential, universal, and randomized.

Defined in [Pap83], where it was also observed that SAPTIME = PSPACE.


SBP: Small Bounded-Error Probability

The class of decision problems for which the following holds. There exists a #P function f and an FP function g such that, for all inputs x,

  1. If the answer is "yes" then f(x) > g(x).
  2. If the answer is "no" then f(x) < g(x)/2.

Defined in [BGM02], where the following was also shown:

  • SBP contains MA, WAPP, and ∃BPP.
  • SBP is contained in AM and BPPpath.
  • There exists an oracle relative to which SBP is not contained in Σ2P.
  • SBP is closed under union.

There exists an oracle relative to which SBP is not closed under intersection [GLM+15].

If SAT can be solved by an NP-machine with sub-exponential number of accepting paths, then SBP = AM [Vol20].


SBPcc: Communication Complexity SBP

The corresponding model consists of randomized protocols such that yes-inputs are accepted with probability at least α and no-inputs are accepted with probability at most α/2 where α is to be thought of as a function of n. The cost of a protocol is defined to be its communication cost plus log(1/α).

Does not contain coNPcc [Raz92] [GW14].

Contains MAcc but does not equal it, since SBPcc is not closed under intersection [GLM+15].

Contained in AMcc and in PostBPPcc.

The complexity measure corresponding to SBPcc is equivalent to the "corruption bound" [GW14].


SBQP: Small Bounded-Error Quantum Polynomial-Time

The class of decision problems for which there exists a polynomial-time quantum algorithm that accepts with probability at least 2−p(n) if the answer is "yes", and with probability at most 2−p(n)−1 if the answer is "no", for some polynomial p.

Defined by Kuperberg in [Kup09], where he showed that SBQP = A0PP.


SC: Steve's Class

(Named in honor of Stephen Cook.)

The class of decision problems solvable by a Turing machine that simultaneously uses polynomial time and polylogarithmic space.

Note that SC might be smaller than PpolyL, since for the latter, it suffices to have two separate algorithms: one polynomial-time and the other polylogarithmic-space.

Deterministic context-free languages (DCFLs) can be recognized in SC [Coo79].

SC contains RL and BPL [Nis92].

SC equals DTISP(poly,polylog) by definition.


SE: Subexponentially-Solvable Search Problems

The class of FNP search problems solvable in O(2εn) time for every ε>0.

Defined in [IPZ01], who also gave reductions showing that if any of k-SAT, k-colorability, k-set cover, clique, or vertex cover is in SE, then all of them are.


SEH: Strong Exponential Hierarchy

The union of NE, NPNE, NPNP^NE, and so on.

Is called "strong" to contrast it with the ordinary Exponential Hierarchy EH.

Note that we would get the same class if we replaced NE by NEXP.

SEH collapses to PNE [Hem89]

There exists an oracle relative to which SEH is not contained in EH [Hem89]. EH and SEH are incomparable for all anyone knows.


SelfNP: Self-Witnessing NP

The class of languages L in NP such that the union, over all x in L, of the set of valid witnesses for x equals L itself.

Defined in [HT03], where it was shown that the closure of SelfNP under polynomial-time many-one reductions is NP.

They also show that if SelfNP = NP, then E = NE; and that SAT is contained in SelfNP.

See also: PermUP.


SFk: Width-k Bottleneck Turing Machines

The class of decision problems solvable by a k-bottleneck Turing machine. This is a machine that, after a polynomial amount of time, erases everything on the tape except for a single k-valued "safe-storage". There's also a counter recording the number of erasings, which is in effect a non-deterministic witness. For example, SF2 contains both ⊕P and NP by using the counter as a witness.

Defined in [CF91], where it was also shown that SF5 = PSPACE.

The complexity of SF2, SF3, and SF4 was studied in [Ogi94] and [Her97]. The following result of those authors is among the caged beasts of the Complexity Zoo:

SF4 is contained in BP ⊕PMod_3P ^ ⊕P ^ Mod_3P ^ ⊕P

(Here the BP operator means that one makes the class into a bounded-error probabilistic class, the same way one makes P into BPP and NP into AM.)


Σ2P: NP With NP Oracle

Contains languages whose complements are in Π2P.

Along with Π2P, comprises the second level of PH, the polynomial hierarchy.

Note that this is equal to NP with a coNP oracle.

[Uma98] has shown that the following problems are complete for Σ2P:

  • Minimum equivalent DNF. Given a DNF formula F and integer k, is there a DNF formula equivalent to F with k or fewer occurences of literals?
  • Shortest implicant. Given a formula F and integer k, is there a conjunction of k or fewer literals that implies F? (Note that this problem cannot be Σ2P-complete for DNF formulas unless Σ2P equals βPNP.)

The problem of deciding if a perfect graph is 2-clique-colorable (defined in [FMF16]) has been shown to be complete for Σ2P.

For any fixed k, there is a problem in Σ2P ∩ Π2P that cannot be solved by circuits of size nk [Kan82].


SIZE(f(n)): Circuit Size f(n)

See CSIZE(f(n)).


SKC: Statistical Knowledge Complexity

A hierarchy of generalizations of SZK, in which Arthur is allowed to gain some information from his interaction with Merlin.

Defined in [GP91].

There are several variants (which we only describe roughly), including:

  • SKChint(k(n)): Hint sense. The simulator can reproduce Arthur's view of the protocol if given a hint string of size k(n).
  • SKChint(k(n)): Strict oracle sense. The simulator can reproduce Arthur's view if allowed k(n) queries to an oracle O.
  • SKCavg(k(n)): Average oracle sense. For each input, the expected number of queries the simulator makes to oracle O is at most k(n).
  • SKCent(k(n)): Entropy sense. Defined in [ABV95]. For each input, the expectation (over Arthur's random coins) of -log(P) is at most k(n), where P is the probability that the view output by the simulator equals the view resulting from the actual protocol.

See also: PKC.


SL: Symmetric Logarithmic-Space

The class of problems solvable by a nondeterministic Turing machine in logarithmic space, such that

  1. If the answer is 'yes,' one or more computation paths accept.
  2. If the answer is 'no,' all paths reject.
  3. If the machine can make a nondeterministic transition from configuration A to configuration B, then it can also transition from B to A. (This is what 'symmetric' means.)

Defined in [LP82].

The undirected s-t connectivity problem (USTCON: is there a path from vertex s to vertex t in a given undirected graph?) is complete for SL, under L-reductions.

SL contains L, and is contained in NL.

It follows from [AKL+79] that SL is contained in L/poly.

[KW93] showed that SL is contained in ⊕L, as well as ModkL for every prime k.

SL is also contained in DSPACE(log3/2n) [NSW92], and indeed in DSPACE(log4/3n) [ATW+00].

[NT95] showed that SL equals coSL, and furthermore that SLSL = SL (that is, the symmetric logspace hierarchy collapses).

Reingold ultimately showed that SL = L [Rei04], even relative to an oracle. This subsumes many of the earlier results.


SLICEWISE PSPACE: Parametrized PSPACE

The parameterized version of PSPACE.

Same as FPT, except that now on input (x,k) (k a parameter), the space used must be f(k)p(|x|), where p is a polynomial.

If P = PSPACE, then FPT = SLICEWISE PSPACE.

Defined in [DF99].


SNP: Strict NP

[Fag74] showed that NP is precisely the class of decision problems reducible to a graph-theoretic property expressible in second-order existential logic.

Then SNP is the class of decision problems reducible to a graph-theoretic predicate with only universal quantifiers over vertices, no existential quantifiers. As an example, k-SAT (CNF satisfiability with at most k literals per clause, for k a constant) is in SNP. But general SAT is not in SNP, basically because we're not allowed to say, "There exists a literal in this clause that satisfies the clause."

Contains MMSNP.

See also: MaxSNP.


SO: Second-Order logic

We define second-order variable has got an arity and represent any proposition of arity . They are usually written in upper-case.

Second order logic is the set of FO formulae where we add quantification over second-order variables.

Every formuale is equivalent to a formulae in prenex normal form, where we first write quantification on variable on second order and then a FO-formulae in prenex normal form.

In Descriptive complexity we can see that SO is equal to PH, more precisely we have that formulae in prenex normal form where existential and universal of second order alternate times are the th level of the polynomial hierarchy.

This means that SO with only existential second-order quantification is equal to which is NP, and with only universal quantification is equal to which is Co-NP.


SO(Horn): Second-order in Horn form

SO(horn) is the set of boolean queries definable with second-order formulae in normal form such that the quantifier-free part of the formula is in conjunctive normal form with at most one positive instance of a quantified relation per clause. (Atomic queries to the database don't count.)

It was shown in [Grä92] that this class is equal to P.

Those formulae can be made in prenex form where the second order is existential and the first order universal without loss of generality.


SO(Krom): Second-order in Krom form

SO(krom) is the set of boolean queries definable with second-order formulae in normal form such that the quantifier-free part of the formula is in Krom form, which means that in every clause there is at most two literals and the first-order portion contains no existential quantifiers.

It was shown in [Grä92] that this class is equal to NL.

Those formulaes can be made in prenex form where the second order is existential and the first order universal without loss of generalities.


SO[LFP]: Second-Order logic with least fixed point

SO[LFP] is to SO what FO[LFP] is to FO. The LFP operator can now also take second-order variable as argument.

In Descriptive complexity we can see that SO[LFP] is equal to EXPTIME.


SO[TC]: Second-Order logic with transitive closure

SO[TC] is to SO as FO[TC] is to FO. The TC operator can now also take second-order variable as argument.

In Descriptive complexity we can see that SO[TC] is equal to PSPACE.


SO[]: Iterated Second-Order logic

SO[] is to SO as FO[] is to FO. But we now also have second-order quantifier in the quantifier block.

In Descriptive complexity we can see that :

  • SO[] is equal to PSPACE it is also another way to write SO(TC)
  • SO[] is equal to EXPTIME it is also another way to write SO(LFP)

SP: Semi-Efficient Parallel

The class of problems in P for which the best parallel algorithm (using a polynomial number of processors) is faster than the best serial algorithm by a factor of Ω(nε) for some ε>0.

Defined in [KRS90].

SP is also an alternate name for XPuniform


span-L: Span Logarithmic-Space

The class of functions computable as |S|, where S is the set of output values returned by the accepting paths of an NL machine.

Defined in [AJ93], where it is also shown that span-L is a hard class in the sense that span-L is contained in FP if and only if FP = #P.

Span-L is contained in #P, and if span-L = #P, then NL = NP [AJ93].

Span-L is contained in FPRAS [ACJ+21].


span-P: Span Polynomial-Time

The class of functions computable as |S|, where S is the set of output values returned by the accepting paths of an NP machine.

Defined in [KST+89], where it is also shown that span-P contains #P and OptP; and that span-P = #P if and only if UP = NP.


SPARSE: Sparse Languages

The class of decision problems for which the number of 'yes' instances of size n is upper-bounded by a polynomial in n. If SPARSE intersects NPC then P = NP [Mah82].

Contains TALLY.


SPL: Stoic PL

Has the same relation to PL as SPP does to PP.

Contains the maximum matching and perfect matching problems under a pseudorandom assumption [ARZ99].

Contains UL.

Contained in C=L and ModkL.

Equals the set of problems low for GapL.


SPP: Stoic PP

The class of decision problems solvable by an NP machine such that

  1. If the answer is "no," then the number of accepting computation paths exactly equals the number of rejecting paths.
  2. If the answer is "yes," then these numbers differ by 2.

(A technicality: If the total number of paths is even then the numbers can't differ by 1.)

Defined in [FFK94], where it was also shown that SPP is low for PP, C=P, ModkP, and SPP itself. (I.e. adding SPP as an oracle does not increase the power of these classes.)

Independently defined in [OH93], who called the class XP.

Contained in LWPP, C=P, and WPP among other classes.

Contains FewP; indeed, FewP is low for SPP, so that SPPFewP = SPP [FFK94].

Contains the problem of deciding whether a graph has any nontrivial automorphisms [KST92].

Indeed, contains graph isomorphism [AK02].

Contains a whole gaggle of problems for solvable black-box groups: solvability testing, membership testing, subgroup testing, normality testing, order verification, nilpotetence testing, group isomorphism, and group intersection [Vin04]

[AK02] also showed that the Hidden Subgroup Problem for permutation groups, of interest in quantum computing, is in FPSPP.


SQG: Short Quantum Games

Same as QRG(2), except that now the verifier can process the yes-prover's answer before preparing the no-prover's question.

Defined in [GW05], where it was also shown that SQG contains QIP.

SQG is contained in EXP [Gut05].

SQG is trivially contained in QRG(4) (and hence EXP).

SQG trivially contains QRG(2) (and hence PSPACE).

SQG is contained in PSPACE [GW10]. Hence SQG = QRG(2) = RG(2) = PSPACE and the addition of quantum information, combined with the ability of the verifier to process the one prover's answer before preparing the other prover's question, has no effect on the complexity of two-turn (one-round) zero-sum games.


SUBEXP: Deterministic Subexponential-Time

The intersection of DTIME(2n^ε) over all ε>0. (Note that the algorithm used may vary with ε.)


symP: Alternate Name for S2P

SZK: Statistical Zero Knowledge

The class of decision problems for which a "yes" answer can be verified by a statistical zero-knowledge proof protocol. In such an interactive proof (see IP), we have a probabilistic polynomial-time verifier, and a prover who has unbounded computational resources. By exchanging messages with the prover, the verifier must become convinced (with high probability) that the answer is "yes," without learning anything else about the problem (statistically).

What does that mean? For each choice of random coins, the verifier has a "view" of his entire interaction with prover, consisting of his random coins as well as all messages sent back and forth. Then the distribution over views resulting from interaction with the prover has to be statistically close to a distribution that the verifier could generate himself (in polynomial-time), without interacting with anyone. (Here "statistically close" means that, say, the trace distance is at most 1/10.)

The most famous example of such a protocol is for graph nonisomorphism. Given two graphs G and H, the verifier picks at random one of the graphs (each with probability 1/2), permutes its vertices randomly, sends the resulting graph to the prover, and asks, "Which graph did I start with, G or H?" If G and H are non-isomorphic, the prover can always answer correctly (since he can use exponential time), but if they're isomorphic, he can answer correctly with probability at most 1/2. Thus, if the prover always gives the correct answer, then the verifier becomes convinced the graphs are not isomorphic. On the other hand, the verifier already knew which graph (G or H) he started with, so he could simulate his entire view of the interaction himself, without the prover's help.

If that sounds like a complicated definition, well, it is. But it turns out that SZK has extremely nice properties. [Oka96] showed that:

  • SZK is closed under complement. E.g., a verifier can verify in zero-knowledge that two graphs are isomorphic, not only that they aren't.
  • We can assume without loss of generality that the whole interaction consists of a constant number of messages.
  • Amazingly, we can also assume without loss of generality that the protocol is public-coin. That is, the verifier (often called Arthur) doesn't need to hide any of his random bits, as he did in the graph nonisomorphism protocol above, but can just send them all to the prover (called Merlin)!
  • Finally, we can assume without loss of generality that the verifier (Arthur) is honest. A dishonest verifier would be one that tries to learn something about the problem (violating the zero-knowledge requirement) by deviating from the protocol.

Subsequently, [SV97] showed that SZK has a natural complete promise problem, called Statistical Difference (SD). Given two polynomial-size circuits, C0 and C1, let D0 and D1 be the distributions over their respective outputs when they're given as input a uniformly random n-bit string. We're promised that D0 and D1 have trace distance either at most 1/3 or at least 2/3; the problem is to decide which is the case.

Note: The constants 1/3 and 2/3 can be amplified to 2-poly(n) and 1-2-poly(n) respectively. But it is crucial that (2/3)2 > 1/3.

Another complete promise problem for SZK is Entropy Difference (ED) [GV99]. Here we're promised that either H(D0)>H(D1)+1 or H(D1)>H(D0)+1, where the distributions D0 and D1 are as above, and H denotes Shannon entropy. The problem is to determine which is the case.

If any hard-on-average language is in SZK, then one-way functions exist [Ost91].


See general zero-knowledge (ZK).

Contains PZK and NISZK, and is contained in AMcoAM, as well as CZK and QSZK.

There exists an oracle relative to which SZK is not in BQP [Aar02].

Contained in DQP [Aar02b].


SZKh: SZK With Limited Help

The class of decision problems for which a "yes" answer can be verified by a statistical zero-knowledge proof protocol, and the prover and verifier both have access to a string computed by a trusted probabilistic polynomial-time third party with access to the input.

Defined in [BG03], where it was also shown that SZKh = SZK.

Contains NISZKh.