Incrementally verifiable computation (IVC) is a computationally sound proof system that allows a prover to certify the correctness of a long or ongoing computation in an incremental manner, by repeatedly updating a proof certifying the computation so far. Updating the proof does not require access to the entire trace of the computation, which makes the IVC-prover memory efficient. Recently, such schemes were constructed for deterministic Turing machines from standard cryptographic assumptions (Paneth and Pass, FOCS 2022, and Devadas et al., FOCS 2022). In this work we generalize and extend IVC to support incremental certification and verifiability of a large set of computation models, focusing on distributed and online computation. This allows distributed algorithms to efficiently certify their own execution using low memory and communication overhead. We construct IVC for a variety of computation models by proving one generic lifting theorem from a classical (non-incremental) delegation scheme (also known as SNARG) into full-fledged IVC, while preserving the delegation scheme's succinctness properties (up to an additive factor which is polynomial in the security parameter and independent of the size of the computation). Using this lifting theorem, we obtain IVC for the following computation models: RAM and exclusive-read exclusive-write (EREW) PRAM algorithms, using existing delegation schemes for these models. Streaming algorithms, using the natural memory-efficiency properties of the model. Massively parallel computation (MPC). Notably, in this model, memory efficiency is a critical bottleneck: the machines participating in an MPC algorithm usually cannot store the entire trace of their computation. Thus, certifying MPC algorithms naturally benefits from IVC. Moreover, since prior to our work, no delegation scheme for this model was known, we also construct a delegation scheme for one-round massively parallel computations, and then apply our lifting theorem to it. Distributed graph algorithms, using existing distributed delegation schemes (also known as locally verifiable distributed SNARGs). Here, in order to use our lifting theorem we have to first make some observations about the verification procedure of these existing schemes. At the heart of this work is a new abstraction, updatable batch arguments for NP (UpBARGs), which we define and construct. Standard BARGs allow one to prove a batch of k NP-statements using a proof whose length barely grows with k; however, the statements and their witnesses must all be known in advance. In contrast, UpBARGs support adding statements and witnesses on the fly, making them a flexible tool for constructing IVC across different computational models. 2012 ACM Subject Classification Theory of computation -> Cryptographic protocols
The Range Avoidance (Avoid) problem rho-Avoid[n, m(n)] asks that, given a circuit in a class rho with input length n and output length m(n) > n, find a string not in the range of the circuit. This problem has been a central piece in several recent frameworks for proving circuit lower bounds and constructing explicit combinatorial objects. Previous work by Korten (FOCS' 21) and by Ren, Santhanam, and Wang (FOCS' 22) showed that algorithms for Avoid are closely related to circuit lower bounds. In particular, Korten's work reinterpreted an earlier result from bounded arithmetic, originally proved by Jerabek (Ann. Pure Appl. Log. 2004), as an equivalence in computational complexity between the existence of FPNP algorithms for the general Avoid problem and 2(Omega(n)) lower bounds against general Boolean circuits for the class E-NP. In this work, we significantly complement these works by generalizing the equivalence result to restricted circuit classes and obtain the following: For any constant depth unbounded fan-in circuit class rho superset of AC(0), there is an FPNP algorithm for rho-Avoid[n, n(1+epsilon)] (for any constant epsilon > 0) if and only if E-NP cannot be computed by rho circuits of size 2(o(n)). This addresses an open problem by Korten (Bulletin of EATCS' 25). If E-NP cannot be computed by o(2(n) /n) size formulas, then there is an FPNP algorithm for NC0-Avoid[n, 2n]. Note that by an extension of Ren, Santhanam, and Wang (FOCS' 22), an FPNP algorithm for NC40 -Avoid[n, n + n(delta)] for any constant delta is an element of(0, 1) implies E-NP cannot be computed by o(2(n) /n) size formulas. These results yield the first characterizations of FPNP rho-Avoid algorithms for low-complexity circuit classes such as AC(0). We also consider the average-case analog of Avoid, the Remote Point (Remote-Point) problem, and establish: For some suitable function c(n) and constant gamma > 0, there is an FPNP algorithm for Remote-Point[ n, n(6+gamma), c(O gamma (log n))] if and only if E-NP cannot be (1/2 - c(n))-approximated by circuits of size 2(o(n)). Finally, we also present two improved algorithms for NC0-Avoid: A family of 2(n1-e/k-1+o(1)) time algorithms for NCk0 -Avoid[ n, n(1+epsilon)] for any epsilon > 0, exhibiting the first subexponential-time algorithm for any super-linear stretch. Faster local algorithms for NCk0 -Avoid[n, n+1] running in time O(n2(k-2/k-1 n), improving the naive 2(n) center dot poly(n) bound. 2012 ACM Subject Classification Theory of computation -> Complexity classes; Theory of computation -> Circuit complexity; Theory of computation -> Pseudorandomness and derandomization; Theory of computation -> Expander graphs and randomness extractors
We prove algorithmic versions of the polynomial Freiman-Ruzsa theorem of Gowers, Green, Manners, and Tao (Annals of Mathematics, 2025) in additive combinatorics. In particular, we give classical and quantum polynomial-time algorithms that, for A subset of F (n)(2) with doubling constant K, learn an explicit description of a subspace V subset of F (n)(2) of size |V|<=|A| such that A can be covered by K-C translates of V, for a universal constant C > 1. 2012 ACM Subject Classification Theory of computation -> Randomness, geometry and discrete structures
We study the d-dimensional knapsack problem. We are given a set of items, each with a d-dimensional cost vector and a profit, along with a d-dimensional budget vector. The goal is to select a set of items that do not exceed the budget in all dimensions and maximize the total profit. A polynomial-time approximation scheme (PTAS) with running time n theta( d/epsilon) has long been known for this problem, where epsilon is the error parameter and n is the encoding size. Despite decades of active research, the best running time of a PTAS has remained O( n([d/e]-d)). Unfortunately, existing lower bounds only cover the special case with two dimensions d = 2, and do not answer whether there is a n(o)( d/epsilon)-time PTAS for larger values of d. In this work, we show that the running times of the best-known PTAS cannot be improved up to a polylogarithmic factor assuming the Exponential Time Hypothesis (ETH). Our techniques are based on a robust reduction from 2-CSP, which embeds 2-CSP constraints into a desired number of dimensions. Then, using a recent result of [Bafna Karthik and Minzer, STOC'25], we succeed in exhibiting tight trade-off between d and epsilon for all regimes of the parameters assuming d is sufficiently large. Informally, our result also shows that under ETH, for any function f there is no f (d/epsilon) center dot n (O) over tilde ((d/epsilon)_) time (1 - epsilon)-approximation for d-dimensional knapsack, where n is the number of items and (O) over tilde hides polylogarithmic factors in d/epsilon. 2012 ACM Subject Classification Theory of computation -> Approximation algorithms analysis; Theory of computation. Problems, reductions and completeness; Theory of computation -> Parameterized complexity and exact algorithms
We initiate the study of a new abstraction called incremental decentralized data archival (iDDA). Specifically, imagine that there is an ever-growing, massive database such as a blockchain, a comprehensive human knowledge base like Wikipedia, or the Internet archive. We want to build a decentralized archival system for such datasets to ensure long-term robustness and sustainability. We identify several important properties that an iDDA scheme should satisfy. First, to promote heterogeneity and decentralization, we want to encourage even weak nodes with limited space (e.g., users' home computers) to contribute. The minimum space requirement to contribute should be approximately independent of the data size. Second, if a collection of nodes together receive rewards commensurate with contributing a total of m blocks of space, then we want the following reassurances: 1) if m is at least the database size, we should be able to reconstruct the entire dataset; and 2) these nodes should actually be committing roughly m space in aggregate - specifically, when m is much larger than the data size, these nodes cannot store only one copy of the database, and be able to impersonate arbitrarily many pseudonyms and get unbounded rewards. We propose new definitions that mathematically formalize the aforementioned requirements of an iDDA scheme. We also devise an efficient construction in the random oracle model which satisfies the desired security requirements. Our scheme incurs only (O) over tilde (1) audit cost, as well as (O) over tilde (1) update cost for both the publisher and each node, where (O) over tilde(center dot) hides polylogarithmic factors. Further, the minimum space provisioning required to contribute is as small as polylogarithmic. Our construction exposes several interesting technical challenges. Specifically, we show that a straightforward application of the standard hierarchical data structure fails, since both our security definition and the underlying cryptographic primitives we employ lack the desired compositional guarantees. We devise novel techniques to overcome these compositional issues, resulting in a construction with provable security while still retaining efficiency. Finally, our new definitions also make a conceptual contribution, and lay the theoretical groundwork for the study of iDDA. We raise several interesting open problems along this direction. 2012 ACM Subject Classification Security and privacy -> Mathematical foundations of cryptography
