Memory Delegation Kai-Min Chung Feng-Hao Liu . Cornell University Brown University . Yael Kalai Ran Raz. Microsoft Research Weizmann Inst. of Science . 1
Delegation of Computation • Emerging scenarios – Amazon, Gogrid, SETI@Home, Folding@Home , etc… I’d like to verify the answer! Can you evaluate Sure! The answer Here is a proof 𝜌 function F on is y = F(x). input x for me? 𝐺, 𝑦 Delegator 𝑧 Worker 𝜌 Accept / Reject 2
Important Properties • Computational Efficiency – verification must be faster than computation – want small overhead for the worker • Interaction – can the proofs be non-interactive ? • Generality – can we delegate all functions? 𝐺, 𝑦 • Assumptions Delegator 𝑧 – what assumptions do we need? Worker 𝑜 : length of input 𝑦 𝜌 Accept / Reject 𝑈 : time complexity of 𝐺 3
Holy Grail of Comp. Delegation 𝑜 : length of input 𝑦 , 𝑈 : time complexity of 𝐺 general func W 𝐺, 𝑦 𝑧, 𝜌 poly( 𝑜 ) time poly( 𝑈 ) time Accept / Reject non-interactive proof Completeness: D accepts correct 𝑧, 𝜌 w.p. 1 • Soundness: ∀ poly( 𝑈 )-time W * , • Pr[ D accepts wrong answer ] ≤ ngl 4
Previous Results on Comp. Del. Results Trade-offs Non-interactive proofs GKR scheme For low-depth functions [GKR ’08, KR ‘09] 4-message interactive proofs Universal Arguments For general functions [K ’92,M ’94,BG ‘02] With (inefficient) offline preprocessing Offline/Online Non-interactive & for general functions* [GGP ‘10, CKV ’10, AIK’10] All above results are efficient , but require assumptions ( * ) W * is not allowed to learn the decision bits of D 5
The Goal of Delegation • Holy grail of computation delegation: – Can we achieve efficient and non-interactive computation delegation for general functions under reasonable assumptions ? Delegator runs in O( 𝑜 ) time • We don’t know the answer to this question yet. But we want more ! Delegator should run in o( 𝑜 ) time ! 6
When data 𝑦 is large and in the cloud… Can D delegate the data 𝑦 as well, How many emails 100! have Bob sent me Here is a proof 𝜌 only keep Cert( 𝑦 ) & verify in 𝑝(𝑂) time? last month? W 𝐺 Cert(x) Yes, we can! 𝑦 = All e−mails 𝑦 = All e−mails 𝑧, 𝜌 Memory Delegation o( 𝑂 ) time Streaming Delegation 𝑂 : length of input 𝑦 , 𝑈 : time complexity of 𝐺 7
Our Main Results GKR Scheme & Universal Argument as Computation Delegation Schemes GKR Scheme & Universal Argument as Memory/Streaming Delegation Schemes 8
Outline • Computation Delegation • Memory Delegation • Streaming Delegation • Conclusion 9
Memory Delegation • Initial memory 𝑦 holds by delegator D • D computes a certificate Cert( 𝑦 ) • D sends 𝑦 to worker W W Cert(x) Memory x x[1] x[2] x[3] x[4] x[5] x[6] x[7] 10
Compute Operation • D can verify 𝜌 using certificate Cert( 𝑦 ) • Efficiency: D should run in time polylog(N,T) • W should run in time poly(T) W Compute( 𝐺 ) Cert(x) 𝑧, 𝜌 Memory x x[1] poly( 𝑈 ) time x[2] polylog( 𝑂, 𝑈 ) time Accept / Reject x[3] x[4] x[5] x[6] x[7] 11
Update Operation • Allow D sends a general update function 𝐻 to W • Allow W help D update certificate • Efficiency: D should run in time polylog(N,T) Can you update Sure, and here is the memory to the update info 𝜌 • W should run in time poly(T) 𝐻(𝑦) for me? W Update( 𝐻 ) Cert(x) ⇓ 𝜌 Memory x Memory G(x) x[1] G(x)[1] Cert(G(x)) x[2] G(x)[2] ⇒ Accept / Reject x[3] G(x)[3] x[4] G(x)[4] x[5] poly( 𝑈 ) time G(x)[5] polylog( 𝑂, 𝑈 ) time x[6] G(x)[6] x[7] G(x)[7] G(x)[8] 12
Desired Properties • Efficiency – D runs in time polylog(N,T) – W runs in time poly(T) • Completeness: D always accepts when W honest • Reusable Soundness: soundness game for D and W * – W ∗ can chooses inputs of D during interaction – W ∗ learns the decision of D – W ∗ wins if D ever accepts mistakenly – ∀ poly(T)-time W * can win with negligible probability 𝑂 : length of memory 𝑦 , 𝑈 : time complexity of 𝐺, 𝐻 13
Issue of Reusability • D uses cert(x) to compute his decision ⇒ one bit leakage info about cert(x) per input • Our memory scheme has public cert(x) – Simple! • Our streaming scheme has secret cert(x) – Challenging! Take ideas from continual-leakage model. – New geometric lemma “dual” to [BKKV ‘10] – New entropy lemma for lower bounding conditional computational entropy 14
Our Memory Delegation Schemes Under cryptographic assumptions*, we obtain efficient memory delegation schemes with Our Schemes Property Non-interactive proofs Based on For low-depth functions GKR scheme 4-message interactive proofs Based on For general functions Universal Arguments ( * ) Based on the same assumptions as the corresponding schemes 15
Outline • Computation Delegation • Memory Delegation • Streaming Delegation • Conclusion 16
Example: Streaming of Stock Ticks -0.4 -0.1 0.1 0.1 0.1 0.2 Should I buy the stock now? … 17
Comparison to Memory Delegation • Data stream arrives constantly at a high rate ⇒ Ideally, D should update certificate by himself • Luckily we can! – every update simply appends a data item 𝑦 𝑢 • Different from memory delegation – Recall update for memory delegation is general – D gets help from W 18
Our Streaming Delegation Schemes Assume the existence of fully homomorphic encryption schemes [G ’09] Our Schemes Property Non-interactive proofs Based on For low-depth functions GKR scheme 4-message interactive proofs Based on For general functions Universal Arguments 19
Outline • Computation Delegation • Memory Delegation • Streaming Delegation • Conclusion 20
Conclusion • We construct efficient memory/streaming delegation schemes – non-interactive for low depth functions – 4-message for general functions • Can we achieve the holy grail of computation/memory/ streaming delegation? – efficient and non-interactive schemes for general functions 21
Thanks you! 22
Recommend
More recommend
