Incrementally verifiable computation (IVC) is a computationally sound proof system that allows a prover to certify the correctness of a long or ongoing computation in an incremental manner, by repeatedly updating a proof certifying the computation so far. Updating the proof does not require access to the entire trace of the computation, which makes the IVC-prover memory efficient. Recently, such schemes were constructed for deterministic Turing machines from standard cryptographic assumptions (Paneth and Pass, FOCS 2022, and Devadas et al., FOCS 2022). In this work we generalize and extend IVC to support incremental certification and verifiability of a large set of computation models, focusing on distributed and online computation. This allows distributed algorithms to efficiently certify their own execution using low memory and communication overhead. We construct IVC for a variety of computation models by proving one generic lifting theorem from a classical (non-incremental) delegation scheme (also known as SNARG) into full-fledged IVC, while preserving the delegation scheme's succinctness properties (up to an additive factor which is polynomial in the security parameter and independent of the size of the computation). Using this lifting theorem, we obtain IVC for the following computation models: RAM and exclusive-read exclusive-write (EREW) PRAM algorithms, using existing delegation schemes for these models. Streaming algorithms, using the natural memory-efficiency properties of the model. Massively parallel computation (MPC). Notably, in this model, memory efficiency is a critical bottleneck: the machines participating in an MPC algorithm usually cannot store the entire trace of their computation. Thus, certifying MPC algorithms naturally benefits from IVC. Moreover, since prior to our work, no delegation scheme for this model was known, we also construct a delegation scheme for one-round massively parallel computations, and then apply our lifting theorem to it. Distributed graph algorithms, using existing distributed delegation schemes (also known as locally verifiable distributed SNARGs). Here, in order to use our lifting theorem we have to first make some observations about the verification procedure of these existing schemes. At the heart of this work is a new abstraction, updatable batch arguments for NP (UpBARGs), which we define and construct. Standard BARGs allow one to prove a batch of k NP-statements using a proof whose length barely grows with k; however, the statements and their witnesses must all be known in advance. In contrast, UpBARGs support adding statements and witnesses on the fly, making them a flexible tool for constructing IVC across different computational models. 2012 ACM Subject Classification Theory of computation -> Cryptographic protocols

Abstract specifications of concurrent objects determine which values operations may return, but they also implicitly constrain which information operations may know, for example the arguments of other operations that do not affect their outcome, or even whether such operations occurred. Concrete implementations, while correct with respect to the abstract specification, may nonetheless expose additional information through their internal coordination mechanisms. We introduce a framework for reasoning about information leakage in concurrent implementations. The framework uses epistemic logic to compare what a process may know under an abstract specification with what it may know in a concrete implementation, using the abstract object itself as the reference for permissible observations. This yields several notions of non-leaking implementations. Using this framework, we investigate both the possibilities and limitations of non-leaking implementations. We present fully-non-leaking wait-free implementations of multi-valued registers and bounded max registers, but show that a fully-non-leaking unbounded max register cannot be implemented in a wait-free manner from finite-state base objects. We then consider a weaker guarantee, obtaining argument-non-leaking implementations of stacks, queues, and approximate agreement. These results demonstrate that non-leakage guarantees are often compatible with correctness and progress requirements, while also indicating their limitations.

Linear probing is one of the simplest and most space-efficient approaches to hash table design, and is widely used in sequential settings due to its compact memory layout. However, designing a concurrent linear-probing hash table with strong liveness guarantees has proved difficult, and only a handful of such algorithms have been proposed, all of which either restrict concurrency or rely on large per-entry metadata, thereby compromising space efficiency. We present a lock-free linear-probing hash table with wait-free lookups that retains the core advantages of sequential linear probing while handling contention gracefully. Our design uses only a small amount of metadata per table entry: a constant number of additional bits when using LL/SC, or a logarithmic number of bits when using CAS. The algorithm is linearizable and lock-free, supports insert, delete, and wait-free lookup operations, and is able to safely reclaim space used by deleted elements without rebuilding the table. We analyze the amortized step complexity of our hash table assuming no concurrent insertions of the same key, and show that each operation has expected amortized step complexity matching that of sequential linear probing, up to the point contention per key.

We study single-parameter, multi-buyer auctions in which buyers are subject to constraints that affect their bidding strategy. Such constraints arise in many real-world auction settings and fundamentally alter the auction design space. As a consequence, the Revelation Principle, Envelope Theorem, and Myerson's Lemma no longer hold. In this paper we focus on a large family of buyer constraints where the buyers are restricted in the manner in which they can bid or spend their budget, but do not have a hard budget cap. These include the common constraints of no-overbidding, ex-post individual rationality, and stagewise individual rationality. We ask whether the seller can leverage the buyers' constraints to obtain improved payoff. Our main finding is a separation between revenue-aligned seller objectives (e.g., revenue maximization, welfare, or any linear combination of the two), and consumer-aligned seller objectives, which are objectives where the seller prefers lower payments, e.g. to maximize consumer surplus. For revenue-aligned objectives, we establish a unified theory for all constraints in the family, which parallels Myerson's theory of optimal auctions for unconstrained buyers. We develop a new measure-theoretic technique to show that Myerson-style auctions remain optimal, despite the altered design space and failure of the classical theory's central tenets. For consumer-aligned objectives, the picture is different: we show that the seller can leverage the buyers' strategic limitations to strictly outperform classically incentive compatible mechanisms. We design an optimal deterministic auction for a wide class of instances, focusing in particular on buyers who cannot tolerate temporary debt.

We study the problem of constructing concurrent objects in a setting where P processes run in parallel and interact through a shared memory that is subject to write contention. Our goal is to transform hardware primitives that are subject to write contention into ones that handle contention gracefully. We give contention-resolution algorithms for several basic primitives, and analyze them under a relaxed, roughly-synchronous stochastic scheduler, where processes run at roughly the same rate up to a constant factor with high probability. Specifically, we construct read/write registers and CAS registers that have latency O(log P) w.h.p. under our scheduler model, using O(1) hardware read/write registers and, in the case of our CAS construction, one hardware CAS register. Our algorithms guarantee performance even when their operations are invoked by an adaptive adversary that is able to see the entire history of operations so far, including their timing and return values. This allows them to be used as building blocks inside larger programs; using this compositionality property, we obtain several other constructions (LL/SC, fetch-and-increment, bounded max registers, and counters). To complement our constructions, we give a trade-off showing that even under a perfectly synchronous schedule and even if each process only executes one operation, any algorithm that implements any of the primitives that we consider, uses space M, and has latency at most L with high probability must have expected latency at least Ω(log_ML P).

A history-independent data structure does not reveal the history of operations applied to it, only its current logical state, even if its internal state is examined. This paper studies history-independent concurrent dictionaries, in particular, hash tables, and establishes inherent bounds on their space requirements. This paper shows that there is a lock-free history-independent concurrent hash table, in which each memory cell stores two elements and two bits, based on Robin Hood hashing. Our implementation is linearizable, and uses the shared memory primitive LL/SC. The expected amortized step complexity of the hash table is $O(c)$, where $c$ is an upper bound on the number of concurrent operations that access the same element, assuming the hash table is not overpopulated. We complement this positive result by showing that even if we have only two concurrent processes, no history-independent concurrent dictionary that supports sets of any size, with wait-free membership queries and obstruction-free insertions and deletions, can store only two elements of the set and a constant number of bits in each memory cell. This holds even if the step complexity of operations on the dictionary is unbounded.

Incrementally verifiable computation (IVC) is a cryptographic scheme that allows a prover to certify the correctness of a long or ongoing computation in an incremental manner, by repeatedly updating a proof certifying the computation so far. Updating the proof does not require access to the entire trace of the computation, which makes the IVC prover memory efficient. In this work we construct incrementally verifiable distributed computation, which allows a distributed algorithm to efficiently certify its own execution using low memory and communication overhead. Our primary motivation is massively-parallel computation (MPC), where memory efficiency is make-or-break: the machines participating in an MPC algorithm usually cannot store the entire trace of their computation. Thus, certifying MPC algorithms essentially requires distributed IVC. At the heart of this work is a new abstraction, updatable batch arguments for NP (UpBARGs), which we define and construct. Standard BARGs allow one to prove a batch of k NP-statements using a proof whose length barely grows with k; however, the statements and their witnesses must all be known in advance. In contrast, UpBARGs support adding statements and witnesses on the fly, making them a flexible tool for constructing IVC across different computational models. We use UpBARGs to construct IVC for streaming algorithms, for MPC algorithms, and for PRAM algorithms in the exclusive-read exclusive-write (EREW) model. 2012 ACM Subject Classification Theory of computation -> Cryptographic protocols

In this paper we study a quantum version of the multiparty simultaneous message-passing (SMP) model, and we show that in some cases, quantum communication can replace public randomness, even with no entanglement between the parties. This was already known for two players, but not for more than two players, and indeed, so far all that was known was a negative result. Our main technical contribution is a compiler that takes any classical public-coin simultaneous protocol based on "modified equality queries," and converts it into a quantum simultaneous protocol without public coins with roughly the same communication complexity. We then use our compiler to derive protocols for several problems, including frequency moments, neighborhood diversity, enumeration of isolated cliques, and more.

Pointer-chasing is a central problem in two-party communication complexity: given input size n and a parameter k, the two players Alice and Bob are given functions N_A, N_B: [n] → [n] , respectively, and their goal is to compute the value of p_k , where p_0 = 1 , p_1 = N_A(p_0) , p_2 = N_B(p_1) = N_B(N_A(p_0)) , p_3 = N_A(p_2) = N_A(N_B(N_A(p_0))) and so on, applying N_A in even steps and N_B in odd steps, for a total of k steps. In some versions of the problem, the final output is not p_k itself, but rather some fixed function f(p_k) of p_k . It is trivial to solve the problem using k communication rounds, with Alice speaking first, by simply “chasing the function” for k steps. Many works have studied the communication complexity of pointer chasing, although the focus has always been on protocols with k-1 communication rounds, or with k rounds where Bob (the “wrong player”) speaks first. Many works have studied this setting giving sometimes tight or near-tight results. In this paper we study the communication complexity of the pointer chasing problem when the interaction between the two players is unlimited, i.e., without any restriction on the number of rounds. Perhaps surprisingly, this question was not studied before, to the best of our knowledge. Our main result is that the trivial k-round protocol is nearly tight (even) when the number of rounds is not restricted: we give a lower bound of (k log (n/k)) on the randomized communication complexity of the pointer chasing problem with unlimited interaction, and a somewhat stronger lower bound of (k loglogk) for protocols with zero error. When combined with prior work, our results also give a nearly-tight bound on the communication complexity of protocols using at most k-1 rounds, across all regimes of k; for k > √(n) there was previously a significant gap between the upper and lower bound.

We study rental games – a single-parameter dynamic mechanism design problem, in which a designer rents out an indivisible asset over n days. Each day, an agent arrives with a private valuation per day of rental, drawn from that day's (known) distribution. The designer can either rent out the asset to the current agent for any number of remaining days, charging them a (possibly different) payment per day, or turn the agent away. Agents who arrive when the asset is not available are turned away. A defining feature of our dynamic model is that agents are stagewise-IR (individually rational), meaning they reject any rental agreement that results in temporary negative utility, even if their final utility is positive. We ask whether and under which economic objectives it is useful for the designer to exploit the stagewise-IR nature of the agents. We show that an optimal rental mechanism can be modeled as a sequence of dynamic auctions with seller costs. However, the stagewise-IR behavior of the agents makes these auctions quite different from classical single-parameter auctions: Myerson's Lemma does not apply, and indeed we show that truthful mechanisms are not necessarily monotone, and payments do not necessarily follow Myerson's unique payment rule. We develop alternative characterizations of optimal mechanisms under several classes of economic objectives, including generalizations of welfare, revenue and consumer surplus. These characterizations allow us to use Myerson's unique payment rule in several cases, and for the other cases we develop optimal mechanisms from scratch. Our work shows that rental games raise interesting questions even in the single-parameter regime.

Massively-parallel graph algorithms have received extensive attention over the past decade, with research focusing on three memory regimes: the superlinear regime, the near-linear regime, and the sublinear regime. The sublinear regime is the most desirable in practice, but conditional hardness results point towards its limitations. In this work we study a heterogeneous model, where the memory of the machines varies in size. We focus mostly on the heterogeneous setting created by adding a single near-linear machine to the sublinear MPC regime, and show that even a single large machine suffices to circumvent most of the conditional hardness results for the sublinear regime: for graphs with n vertices and m edges, we give (a) an MST algorithm that runs in O(łogłog(m/n)) rounds; (b) an algorithm that constructs an O(k)-spanner of size O(n^1+1/k ) in O(1) rounds; and (c) a maximal-matching algorithm that runs in O(√łog(m/n) łogłog(m/n)) rounds. We also observe that the best known near-linear MPC algorithms for several other graph problems which are conjectured to be hard in the sublinear regime (minimum cut, maximal independent set, and vertex coloring) can easily be transformed to work in the heterogeneous MPC model with a single near-linear machine, while retaining their original round complexity in the near-linear regime. If the large machine is allowed to have superlinear memory, all of the problems above can be solved in O(1) rounds.

The field of distributed local decision studies the power of local network algorithms, where each network can see only its own local neighborhood, and must act based on this restricted information. Traditionally, the nodes of the network are assumed to have unbounded local computation power, and this makes the model incomparable with centralized notions of efficiency, namely, the classes P and NP. In this work we seek to bridge this gap by studying local algorithms where the nodes are required to be computationally efficient: we introduce the classes PLD and NPLD of polynomial-time local decision and non-deterministic polynomial-time local decision, respectively, and compare them to the centralized complexity classes P and NP, and to the distributed classes LD and NLD, which correspond to local deterministic and non-deterministic decision, respectively. We show that for deterministic algorithms, requiring both computational and distributed efficiency is likely to be more restrictive than either requirement alone: if the nodes do not know the network size, then PLD not subset of LD boolean AND P holds unconditionally; if the network size is known to all nodes, then the same separation holds under a widely believed complexity assumption (UP n coUP not equal P). However, when nondeterminism is introduced, this distinction vanishes, and NPLD = NLD boolean AND NP. To complete the picture, we extend the classes PLD and NPLD into a hierarchy akin to the centralized polynomial hierarchy, and we characterize its connections to the centralized polynomial hierarchy and to the distributed local decision hierarchy of Balliu, D'Angelo, Fraigniaud, and Olivetti.

Distributed certification is a proof system for detecting illegal network states or improper execution of distributed algorithms. A certification scheme consists of a proving algorithm, which assigns a certificate to each node, and a verification algorithm where nodes use these certificates to decide whether to accept or reject. The system must ensure that all nodes accept if and only if the network is in a legal state, adhering to the principles of completeness and soundness. The main goal is to design a scheme where the verification process is local and the certificates are succinct, while using as efficient as possible proving algorithm. In cryptographic proof systems, the soundness requirement is often relaxed to computational soundness, where soundness is guaranteed only against computationally bounded adversaries. Computationally sound proof systems are called arguments. Recently, Aldema Tshuva, Boyle, Cohen, Moran, and Oshman (TCC 2023) showed that succinct distributed arguments can be used to enable any polynomially bounded distributed algorithm to certify its execution with polylogarithmiclength certificates. However, their approach required a global communication phase, adding O(D) communication rounds in networks of diameter D, which limits its applicability to local algorithms. In this work, we give the first construction of a fully local succinct distributed argument system, where the prover and the verifier are both local. We show that a distributed algorithm that runs in R rounds, has polynomial local computation, and messages of B bits each can be compiled into a self-certifying algorithm that runs in R + polylog(n) rounds and sends messages of size B + polylog(n), with certificates of length polylog(n). This construction has several applications, including self-certification for local algorithms, ongoing certification of long-lived algorithms, and efficient local mending of the certificates when the network changes.

In the multi-party set disjointness problem, k players receive private inputs in the form of sets X 1 , ..., X k ⊆ [ n ], and their goal is to check whether their sets intersect. The set intersection problem is similar, except that the players are required to output the full intersection of their sets rather than just checking whether it is empty. We study the communication complexity of these two problems in the shared-blackboard model of communication complexity, where players communicate with one another by broadcast. Set disjointness and set intersection are two of the most well-studied problems in communication complexity. It has long been known that two-party set disjointness is significantly easier when the players' inputs are independent of one another, and similar results have recently been established for multi-party set disjointness and intersection; however, these results do not apply when the players' inputs have even a small amount of dependence. In this work we close this gap, and give nearly-tight upper and lower bounds for set disjointness and set intersection as a function of the amount of dependence between the players' inputs. Our work explores two existing notions of correlation between the inputs to a multi-party communication protocol, total correlation and dual total correlation , and shows how each is useful in deriving lower and upper bounds, respectively.

A data structure is called history independent if its internal memory representation does not reveal the history of operations applied to it, only its current state. In this paper we study history independence for concurrent data structures, and establish foundational possibility and impossibility results. We show that a large class of concurrent objects cannot be implemented from smaller base objects in a manner that is both wait-free and history independent; but if we settle for either lock-freedom instead of wait-freedom or for a weak notion of history independence, then at least one object in the class, multi-valued single-reader single-writer registers, can be implemented from smaller base objects, binary registers. On the other hand, using large base objects, we give a strong possibility result in the form of a universal construction: an object with s possible states can be implemented in a wait-free, history-independent manner from compare-and-swap base objects that each have O(s + 2^n) possible memory states, where n is the number of processes in the system.

In the directed minimum spanning tree problem (DMST, also called minimum weight arborescence ), we are given a directed weighted graph, and a root node r . Our goal is to construct a minimum-weight directed spanning tree, rooted at r and oriented outwards. We present the first sub-quadratic DMST algorithm in the distributed 𝖢𝖮𝖭𝖦𝖤𝖲𝖳 network model, where the messages exchanged between the network nodes are bounded in size. We consider three versions of the model: a network where the communication links are bidirectional but can have different weights in the two directions; a network where communication is unidirectional; and the Congested Clique model, where all nodes can communicate directly with each other. Our DMST algorithm is based on a variant of Lovász’ DMST algorithm for the PRAM model, and uses a distributed single-source shortest-path (SSSP) algorithm for directed graphs as a black box. In the bidirectional 𝖢𝖮𝖭𝖦𝖤𝖲𝖳 model, our algorithm has roughly the same running time as the SSSP algorithm that is used as a black box; using the state-of-the-art SSSP algorithm due to Chechik and Mukhtar (in: Symposium on principles of distributed computing (PODC), ACM, 2020, pp 464–473), we obtain a running time of O(√(n)D^1/4+D)) rounds for the bidirectional communication case. For the unidirectional communication model we give an O(n) algorithm, and show that it is nearly optimal. And finally, for the Congested Clique, our algorithm again matches the best known SSSP algorithm: it runs in O(n^1/3) rounds. On the negative side, we adapt an observation of Chechik in the sequential setting to show that in all three models, the DMST problem is at least as hard as the ( s , t )-shortest path problem. Thus, in terms of round complexity, distributed DMST lies between single-source shortest path and ( s , t )-shortest path.

We consider a multiparty setting where k parties have private inputs X-1,..., X-k subset of [n] and wish to compute the intersection boolean AND(k)(l=1) X-l of their sets, using as little communication as possible. This task generalizes the well-known problem of set disjointness, where the parties are required only to determine whether the intersection is empty or not. In the worst-case, it is known that the communication complexity of finding the intersection is the same as that of solving set disjointness, regardless of the size of the intersection: the cost of both problems is Omega(n log k + k) bits in the shared blackboard model, and Omega(nk) bits in the coordinator model. In this work we consider a realistic setting where the parties' inputs are independent of one another, that is, the input is drawn from a product distribution. We show that this makes finding the intersection significantly easier than in the worst-case: only (Theta) over tilde ((n(1-1/k) (H(S) + 1)(1/k)) + k) bits of communication are required, where H(S) is the Shannon entropy of the intersection S. We also show that the parties do not need to know the exact underlying input distribution; if we are given in advance O(n(1/k)) samples from the underlying distribution mu, we can learn enough about mu to allow us to compute the intersection of an input drawn from mu using expected communication (Theta) over tilde((n(1-1/k) E[|S|](1/k)) + k), where |S| is the size of the intersection.

In recent years there has been great interest in networks of passive, computationally-weak nodes, whose interactions are controlled by the outside environment; examples include population protocols, chemical reactions networks (CRNs), DNA computing, and more. Such networks are usually studied under one of two extreme regimes: the schedule of interactions is either assumed to be adversarial, or it is assumed to be chosen uniformly at random. In this paper we study an intermediate regime, where the interaction at each step is chosen from some not-necessarily-uniform distribution: we introduce the definition of a ( p, ε )-scheduler, where the distribution that the scheduler chooses at every round can be arbitrary, but it must have ℓ p -distance at most ε from the uniform distribution. We ask how far from uniform we can get before the dynamics of the model break down. For simplicity, we focus on the 3-majority dynamics, a type of chemical reaction network where the nodes of the network interact in triplets. Each node initially has an opinion of either X or Y , and when a triplet of nodes interact, all three nodes change their opinion to the majority of their three opinions. It is known that under a uniformly random scheduler, if we have an initial gap of Ω( √ n log n ) in favor of one value, then w.h.p. all nodes converge to the majority value within O ( n log n ) steps. For the 3-majority dynamics, we prove that among all non-uniform schedulers with a given ℓ 1 - or ℓ ∞ -distance to the uniform scheduler, the worst case is a scheduler that creates a partition in the network, disconnecting some nodes from the rest: under any ( p, ε )-close scheduler, if the scheduler’s distance from uniform only suffices to disconnect a set of size at most S nodes and we start from a configuration with a gap of Ω( S + √ n log n ) in favor of one value, then we are guaranteed that all but O ( S ) nodes will convert to the majority value. We also show that creating a partition is not necessary to cause the system to converge to the wrong value, or to fail to converge at all. We believe that our work can serve as a first step towards understanding the resilience of chemical reaction networks and population protocols under non-uniform schedulers