$\rm P$ has polynomial-time finite-state verifiers
Extracted source text · arXiv 2306.09542
% \RequirePackage{amsmath}
% \documentclass[runningheads]{llncs}
% \documentclass[preprint]{elsarticle}
% \documentclass{ceurart}
% \renewcommand{\nonumnote}[1]{}
% \renewcommand{\logonote}[1]{}
\documentclass{article}
% We strongly recommend to use natbib. Your colleagues deserve to be
% named in your text. PLEASE, ADAPT YOUR TEXT ACCORDINGLY, such that
% citations are grammatically correct.
\usepackage[square,sort,comma,numbers]{natbib}
\usepackage[svgnames,dvipsnames]{xcolor}
\usepackage{amssymb}
\usepackage[T1]{fontenc}
\usepackage{mathtools}
\usepackage{breqn}
\usepackage{xfrac}
% \usepackage{lmodern}
\usepackage{braket}
\usepackage{physics}
\usepackage{tikz}
\usepackage{xparse}
\usepackage{float}
\usepackage{varwidth}
\usepackage[inline]{enumitem}
% \usepackage{bm}
% \PassOptionsToPackage{hyphens}{url}
\usepackage[unicode]{hyperref}
% \usepackage{mathabx}
% \let\proof\relax\let\endproof\relax
% \usepackage{fullpage}
\usepackage[margin=1.25in,headheight=13.6pt]{geometry}
\usepackage{xurl}
%% NOT GOOD WITH LLNCS
\usepackage{amsthm}
\usepackage[noabbrev,capitalize,nameinlink]{cleveref}
\usepackage{changepage}
% \usepackage{calc}
% \usepackage{relsize}
\usepackage[normalem]{ulem}
\usepackage{booktabs}
\usepackage{array}
\usepackage{graphicx}
\usepackage{soul}
\usepackage[shortcuts]{extdash}
\usepackage{appendix}
\hypersetup{%
colorlinks,
bookmarksnumbered,
pdfencoding=unicode,
allcolors=DarkSlateGrey
}
% \floatstyle{plain} % Ensures it behaves like a standard float
\floatstyle{boxed}
% \floatstyle{ruled}
\newfloat{algorithm}{tbp}{loa} % Creates the "algorithm" float
\floatname{algorithm}{Algorithm} % Sets its displayed name
% \usepackage{caption}
% \newcolumntype{L}[1]{>{\raggedright\let\newline\\\arraybackslash\hspace{0pt}}m{#1}}
% \newcolumntype{C}[1]{>{\centering\let\newline\\\arraybackslash\hspace{0pt}}m{#1}}
% \newcolumntype{R}[1]{>{\raggedleft\let\newline\\\arraybackslash\hspace{0pt}}m{#1}}
% \captionsetup[table]{skip=10pt}
% \usetikzlibrary{automata, calc, fit, shapes.geometric, fadings, patterns, positioning, quotes}
\usetikzlibrary{automata, positioning, decorations.pathmorphing, calc, quotes, decorations.pathreplacing, backgrounds} %, arrows.meta}
% \pagestyle{plain} % Apply the 'plain' page style globally which includes page numbers.
\tikzset{
% loop right/.append style={
% every loop/.append style={
% out=30, in=-30, looseness=3,
% shorten >= 0pt
% }
% },
% loop above/.append style={
% every loop/.append style={
% out=120, in=60, looseness=3,
% shorten >= 0pt
% }
% },
% loop left/.append style={
% every loop/.append style={
% out=210, in=150, looseness=3,
% shorten >= 0pt
% }
% },
% loop below/.append style={
% every loop/.append style={
% out=300, in=240, looseness=3,
% shorten >= 0pt
% }
% },
% every edge/.append style={
% every node/.append style={
% execute at begin node=$,
% execute at end node=$
% % \setlength{\jot}{-5pt}\begin{gathered},
% % font=\ttfamily
% }
% },
every state/.append style={
execute at begin node=$,
execute at end node=$
},
% >=stealth,
% node distance = .7cm and 3.5cm,
% on grid,
% auto,
initial text =
}
% \tikzfading[name=fade out, inner color=transparent!0, outer color=transparent!100]{}
%\usepackage[pagewise]{lineno}
% \renewcommand{\linenumberfont}{\normalfont\small\color{lightgray}}
% \setlength\linenumbersep{1cm}
% bunlari yeni sildik
\usepackage{thmtools}
\usepackage{thm-restate}
\declaretheorem{theorem}
\declaretheorem[sibling=theorem]{lemma,corollary}
%% LLNCS
% \spnewtheorem{fact}[theorem]{Fact}{\bfseries}{}
% \makeatletter
% \let\c@lemma=\c@theorem
% \makeatother
%%% ELSARTICLE
% \newtheorem{theorem}{Theorem}
% \newtheorem{lemma}[theorem]{Lemma}
% \newtheorem{corollary}[theorem]{Corollary}
\theoremstyle{definition}
\newtheorem{fact}[theorem]{Fact}
\crefname{fact}{fact}{facts}
\Crefname{fact}{Fact}{Facts}
% \newtheorem{proposition}{Proposition}[theorem]
% \newtheorem{corollary}[theorem]{Corollary}
% \newdefinition{definition}{Definition}
% \newdefinition{example}{Example}
% \renewcommand{\theproposition}{\arabic{proposition}}
% \crefname{subsection}{subsection}{subsections}
% \Crefname{subsection}{Subsection}{Subsections}
% Thanks to: https://tex.stackexchange.com/a/443
% \makeatletter
% \newtheorem*{rep@theorem}{\rep@title}
% \newcommand{\newreptheorem}[2]{%
% \newenvironment{rep#1}[1]{%
% \def\rep@title{#2 \ref{##1}}%
% \begin{rep@theorem}}%
% {\end{rep@theorem}}}
% \makeatother
% \newreptheorem{theorem}{Theorem}
% \newreptheorem{lemma}{Lemma}
\NewDocumentEnvironment{delineate}{m}{\textcolor{cyan!70!black!}{> > > > Begin: #1 > > > >}}{\textcolor{red!70!black!}{< < < < End: #1 < < < <}}
\mathchardef\mhyphen="2D
% Math operators
\renewcommand{\P}[1]{\mathcal{P}\paren*{#1}}
% Paired Delimiters
\DeclarePairedDelimiter{\ceil}{\lceil}{\rceil}
\DeclarePairedDelimiter{\floor}{\lfloor}{\rfloor}
\DeclarePairedDelimiter\paren\lparen\rparen
\DeclarePairedDelimiter\aparen\langle\rangle
\DeclarePairedDelimiter\br{\lbrack}{\rbrack}
\newcommand{\BR}[1]{\br[\big]{#1}}
\DeclarePairedDelimiter\sqparen{[}{]}
% Expected values
\DeclareMathOperator{\EX}{\mathbb{E}}
\newcommand{\exv}[1]{\ensuremath{\EX\sqparen*{#1}}}
\newcommand{\given}{\ensuremath{\:\middle|\:}}
% Asymptotic classes
\newcommand{\justOH}{\ensuremath{\mathit{O}}}
\newcommand{\OH}[1]{\ensuremath{\justOH\paren*{#1}}}
\newcommand{\OHp}[2]{\ensuremath{\justOH\paren[#1]{#2}}}
\newcommand{\oh}[1]{\ensuremath{\mathit{o}\paren*{#1}}}
\newcommand{\OHMEGA}[1]{\ensuremath{\Omega\paren*{#1}}}
\newcommand{\OHMEGAp}[2][]{\ensuremath{\Omega\paren[#1]{#2}}}
\newcommand{\ohmega}[1]{\ensuremath{\omega\paren*{#1}}}
\newcommand{\THETA}[1]{\ensuremath{\Theta\paren*{#1}}}
\newcommand{\THETAp}[2]{\ensuremath{\Theta\paren[#1]{#2}}}
% \newcommand{\machine}{\ensuremath{\text{pfa-v}\paren{\text{rt-input}, \text{1-way certificate}}}}
% \newcommand{\langclass}{\ensuremath{\text{PFA-V}\paren{\text{rt-input}, \text{1-way certificate}, \text{cons-rand}}}}
% Language classes
\newcommand\langclassformat[1]{\begingroup\ensuremath{\rm #1}\endgroup}
\newcommand\restrictionformat[1]{\begingroup\ensuremath{\rm #1}\endgroup}
\newcommand\zeroX{\restrictionformat{0}}
\newcommand\consX{\restrictionformat{con}}
\newcommand\logX{\restrictionformat{log}}
\newcommand\linearX{\restrictionformat{linear}}
\newcommand\polyX{\restrictionformat{poly}}
\newcommand\rtX{\restrictionformat{rt}}
\newcommand\owayX{\restrictionformat{1way}}
\newcommand\Xspace[1]{\restrictionformat{#1\mhyphen\allowbreak{}space}}
\newcommand\Xrandom[1]{\restrictionformat{#1\mhyphen\allowbreak{}random\mhyphen\allowbreak{}bits}}
\newcommand\Xtime[1]{\restrictionformat{#1\mhyphen\allowbreak{}time}}
\newcommand\Xinput[1]{\restrictionformat{#1\mhyphen\allowbreak{}input}}
\newcommand{\vgeneric}[1]{\langclassformat{VER(\scriptstyle #1 \textstyle)}}
\newcommand{\vsri}[3]{\vgeneric{\Xspace{#1},\allowbreak\Xrandom{#2},\allowbreak\Xinput{#3}}}
\newcommand{\vtsri}[4]{\vgeneric{\Xtime{#1},\allowbreak\Xspace{#2},\allowbreak\Xrandom{#3},\allowbreak\Xinput{#4}}}
\newcommand{\vtsr}[3]{\vgeneric{\Xtime{#1},\allowbreak\Xspace{#2},\allowbreak\Xrandom{#3}}}
\newcommand{\vsr}[2]{\vgeneric{\Xspace{#1},\allowbreak\Xrandom{#2}}}
\newcommand{\langclass}{\vsri{\consX}{\consX}{\rtX}}
\newcommand\rt{\restrictionformat{rt}}
\newcommand\ow{\restrictionformat{1way}}
\newcommand\ze{\restrictionformat{0}}
\newcommand\co{\restrictionformat{con}}
\newcommand\lo{\restrictionformat{log}}
\newcommand\li{\restrictionformat{linear}}
\newcommand\po{\restrictionformat{poly}}
\newcommand\rexlabel{\ensuremath{_\%}}
\newcommand\rex{\restrictionformat{\rexlabel}}
\newcommand\pexlabel{\ensuremath{^\%}}
\newcommand\pex{\restrictionformat{\pexlabel}}
\newcommand\pub{\restrictionformat{\mhyphen\allowbreak{}public}}
\newcommand\pri{\restrictionformat{\mhyphen\allowbreak{}private}}
\newcommand\spa{\restrictionformat{\mhyphen\allowbreak{}space}}
\newcommand\ran{\restrictionformat{\mhyphen\allowbreak{}coins}} % random\mhyphen\allowbreak{}bits}}
\newcommand\tim{\restrictionformat{\mhyphen\allowbreak{}time}}
\newcommand\inp{\restrictionformat{\mhyphen\allowbreak{}input}}
% \NewDocumentCommand{\IP}{ e{^_} O{1} m }{\ensuremath{\langclassformat{IP^{\IfValueT{#1}{#1}\IfValueT{#2}{#2}}_{\IfValueT{#2}{\arbitrarilylow}}\paren*{\scalebox{#3}{$#4$}}}}}
% \NewDocumentCommand{\oIP}{ e{^_} O{1} m }{\ensuremath{\langclassformat{\oneway{}IP^{\IfValueT{#1}{#1}\IfValueT{#2}{#2}}_{\IfValueT{#2}{\arbitrarilylow}}\paren*{\scalebox{#3}{$#4$}}}}}
% \NewDocumentCommand{\tIP}{ e{^_} O{1} m }{\ensuremath{\langclassformat{\twoway{}IP^{\IfValueT{#1}{#1}\IfValueT{#2}{#2}}_{\IfValueT{#2}{\arbitrarilylow}}\paren*{\scalebox{#3}{$#4$}}}}}
\newcommand{\IPhighlabel}{\langclassformat{IP}}
\newcommand{\IPlabel}{\langclassformat{IP_*}}
\newcommand{\IPhigh}[2][1]{\langclassformat{\IPhighlabel(\scalebox{#1}{$#2$})}}
\newcommand{\IP}[2][1]{\langclassformat{\IPlabel(\scalebox{#1}{$#2$})}}
\newcommand{\CDEBhighlabel}{\langclassformat{CDEB}}
\newcommand{\CDEBlabel}{\langclassformat{CDEB_*}}
\newcommand{\CDEBhigh}[2][1]{\langclassformat{\CDEBhighlabel(\scalebox{#1}{$#2$})}}
\newcommand{\CDEB}[2][1]{\langclassformat{\CDEBlabel(\scalebox{#1}{$#2$})}}
\newcommand{\ODFAK}[1]{\langclassformat{1DFA\paren*{#1}}}
\newcommand{\ONFAK}[1]{\langclassformat{1NFA\paren*{#1}}}
\newcommand{\TAFA}{\langclassformat{2AFA}}
\newcommand{\eL}[1]{\mathcal{L}\paren*{#1}}
\newcommand{\TDFAK}[1]{\ensuremath{\eL{\tdfak{#1}}}}
\newcommand{\TNFAK}[1]{\ensuremath{\eL{\tnfak{#1}}}}
\newcommand{\TNFAS}{\TNFAK{*}}
\newcommand{\TNFAKT}[2]{\ensuremath{\eL{\tnfak{#1}, #2}}}
\newcommand{\TNFAST}[1]{\TNFAKT{*}{#1}}
\newcommand{\TNFAKL}[1]{\ensuremath{\eL{\tnfak{#1}, \li\tim}}}
\newcommand{\TNFASL}{\TNFAST{\li\tim}}
\newcommand{\PP}{\langclassformat{P}}
\newcommand{\NP}{\langclassformat{NP}}
\newcommand{\LL}{\langclassformat{L}}
\newcommand{\NL}{\langclassformat{NL}}
\newcommand{\REG}{\langclassformat{REG}}
\newcommand{\LOGCFL}{\langclassformat{LOGCFL}}
\newcommand{\NC}{\langclassformat{NC}}
\newcommand{\NCx}[1]{\ensuremath{\langclassformat{NC}^{#1}}}
% \newcommand{\DTIME}[2][]{\langclassformat{DTIME\paren[#1]{#2}}}
\NewDocumentCommand{\DTIME}{ o m }{\langclassformat{DTIME}\IfValueTF{#1}{\paren[#1]{#2}}{\paren*{#2}}}
\newcommand{\Complete}{\-/\langclassformat{complete}}
% Machines
\newcommand{\dfa}{\ensuremath{\mathrm{dfa}}}
\newcommand{\nfa}{\ensuremath{\mathrm{nfa}}}
\newcommand{\pfa}{\ensuremath{\mathrm{pfa}}}
\newcommand{\afa}{\ensuremath{\mathrm{afa}}}
\newcommand{\rtdfa}{\ensuremath{\mathrm{rt\mhyphen\dfa}}}
\newcommand{\odfa}{\ensuremath{\mathrm{1\dfa}}}
\newcommand{\odfak}[1]{\ensuremath{\odfa\paren*{#1}}}
\newcommand{\tdfa}{\ensuremath{\mathrm{2\dfa}}}
\newcommand{\tdfak}[1]{\ensuremath{\tdfa\paren*{#1}}}
\newcommand{\tpfa}{\ensuremath{\mathrm{2\pfa}}}
\newcommand{\tpfak}[1]{\ensuremath{\tpfa\paren*{#1}}}
\newcommand{\tafa}{\ensuremath{\mathrm{2\afa}}}
\newcommand{\tafak}[1]{\ensuremath{\tafa\paren*{#1}}}
\newcommand{\rtnfa}{\ensuremath{\mathrm{rt\mhyphen\nfa}}}
\newcommand{\onfa}{\ensuremath{\mathrm{1\nfa}}}
\newcommand{\onfak}[1]{\ensuremath{\onfa\paren*{#1}}}
\newcommand{\tnfa}{\ensuremath{\mathrm{2\nfa}}}
\newcommand{\tnfak}[1]{\ensuremath{\tnfa\paren*{#1}}}
\newcommand{\onfaklnrr}[2]{\ensuremath{\ensuremath{\mathrm{1\mathrm{ns}\nfa}}\paren*{#1, #2}}}
\newcommand{\ONFAKLNRR}[2]{\ensuremath{\langclassformat{\mathrm{1\mathrm{NS}\mathrm{NFA}}}\paren*{#1, #2}}}
\newcommand{\machine}{\ensuremath{\mathrm{\pfa\mhyphen v}(\Xspace{\consX},\allowbreak\Xinput{\rtX})}}
% Style
% \newcommand{\ith}[2][th]{\ensuremath{#2}\textsuperscript{#1}}
\newcommand{\ith}[2][th]{\ensuremath{#2}\text{#1}}
\newcommand{\inpAlp}{\Sigma}
\newcommand{\certAlp}{\Gamma}
\newcommand{\certAlpp}{\certAlp\cup\Set{\$,!}}
\newcommand{\certAlps}{\certAlp^{*}}
\newcommand{\inpAlpp}{\inpAlp\cup\Set{\$,!}}
\newcommand{\inpAlps}{\inpAlp^{*}}
% Languages
\newcommand{\langformat}[1]{\ensuremath{#1}}
\newcommand{\twin}{\langformat{L_{\mathrm{\langformat{twin}}}}}
\newcommand{\twinlong}{\ensuremath{\twin = \Set{w\#w | w \in \Set{0, 1}^*}}}
\newcommand{\pal}{\langformat{L_{\mathrm{\langformat{pal}}}}}
\newcommand{\nonpal}{\langformat{L_{\mathrm{\langformat{nonpal}}}}}
\newcommand{\lmatch}{\langformat{L_{\mathrm{\langformat{match}}}}}
\newcommand{\lfrac}{\ensuremath{L_{\frac23}}}
\newcommand\rev[1]{\ensuremath{#1^{R}}}
\newcommand{\lend}{\ensuremath{\rhd}}
\newcommand{\rend}{\ensuremath{\lhd}}
% Algorithm description keywords
\newcommand{\Accept}{\emph{Accept}}
\newcommand{\Reject}{\emph{Reject}}
\newcommand{\Pass}{\emph{Pass}}
\newcommand{\accept}{\emph{accept}}
\newcommand{\reject}{\emph{reject}}
\newcommand{\pass}{\emph{pass}}
\newcommand{\Accepts}{\emph{Accepts}}
\newcommand{\Rejects}{\emph{Rejects}}
\newcommand{\Passes}{\emph{Passes}}
\newcommand{\accepts}{\emph{accepts}}
\newcommand{\rejects}{\emph{rejects}}
\newcommand{\passes}{\emph{passes}}
\newcommand{\err}{\ensuremath{\varepsilon}}
\setlist{itemsep=0pt}
\newlist{differences}{enumerate}{1}
\setlist[differences]{
% leftmargin=\widthof{Difference~}+2em,
% label=Difference~\arabic{*}.,
label=\arabic{*}.,
ref=\arabic{*}
}
\crefname{differencesi}{difference}{differences}
\Crefname{differencesi}{Difference}{Differences}
\newsavebox{\stepsbox}
\newlength{\annotationwidth}
\setlength{\annotationwidth}{3.4em}
\newcommand\annotatesteps[2]{%
\begin{lrbox}{\stepsbox}%
\begin{minipage}{\linewidth}%
\raggedright%
#1%
\end{minipage}%
\end{lrbox}%
\par\usebox{\stepsbox}%
\rlap{\tikz[baseline]%, framed, inner frame sep=0pt]
{\draw[decorate, decoration={brace, mirror, amplitude=1ex, raise=1ex}] (0, -\dp\stepsbox) -- node[right=2ex]{\begin{minipage}{\annotationwidth-3ex}\raggedright\small #2\end{minipage}} (0, \ht\stepsbox)}}\par
}
% THANKS TO: https://tex.stackexchange.com/a/364111/69346
\newcommand{\hooklongrightarrow}{\lhook\joinrel\longrightarrow}
\newcommand\mybar{\smash{\kern1pt\rule[1.5pt-\dp\strutbox]{0.1pt}{\baselineskip}\kern1pt}}
\newcommand\titem[1]{\item \bgroup
\setbox0=\vbox{\hsize=\linewidth%
\hangindent=0.4em% 1.5em% Controls the indent of the text
#1}%
\bgroup
\dimen0=\ht0
\noindent\rlap{\begin{minipage}[b]{0.3em}% {1em}% Controls the indent of the line-wrap symbol
\strut
\loop\ifdim\dimen0 > \baselineskip
\advance\dimen0 by -\baselineskip
\null\hfill%\llap{\mybar}%\llap{$\vcenter{\hbox{\scalebox{0.55}[0.75]{$\hookrightarrow$}}}$}
\ifdim\dimen0 > \baselineskip
\newline
\fi
\repeat
\end{minipage}}\egroup\box0
\egroup}
% \newcommand\titem[1]{\item #1}
\usepackage{tracefnt}
\newlist{turinglist}{itemize}{4}
\setlist*[turinglist]{
itemsep=0em,
parsep=0em,
partopsep=0em,
topsep=0em,
labelsep=0em,
label=,
labelwidth=0em,
align=parleft,
itemindent=0em,
% before=\small,
% before=\footnotesize,
% itemindent=-0.5em,
% labelindent=0em
}
\setlist*[turinglist,1]{leftmargin=0em, first=\raggedright} %leftmargin=0.5em}
\setlist*[turinglist,2,3,4]{leftmargin=1em}
\newlist{turingmultienum}{enumerate}{4}
\setlist*[turingmultienum]{
itemsep=0em,
parsep=0em,
partopsep=0em,
topsep=0em,
itemindent=0em,
labelsep=0em,
align=parleft,
% before=\small,
% before=\footnotesize,
% labelindent=0em,
label*=\bfseries\arabic*.
}
\setlist*[turingmultienum,1]{leftmargin=2em, labelwidth=\leftmargin-0.5em, ref=\arabic*, first=\raggedright}
\setlist*[turingmultienum,2,3,4]{topsep=0em, leftmargin=1em}
\setlist*[turingmultienum,2]{labelwidth=1.5em+\leftmargin, ref=\arabic{turingmultienumi}.\arabic*}
\setlist*[turingmultienum,3]{labelwidth=2.5em+\leftmargin, ref=\arabic{turingmultienumi}.\arabic{turingmultienumii}.\arabic*}
\setlist*[turingmultienum,4]{labelwidth=3.5em+\leftmargin, ref=\arabic{turingmultienumi}.\arabic{turingmultienumii}.\arabic{turingmultienumiii}.\arabic*}
\crefname{turingmultienumi}{Stg.}{Stgs.}
\Crefname{turingmultienumi}{Stage}{Stages}
\crefname{turingmultienumii}{Stg.}{Stgs.}
\Crefname{turingmultienumii}{Stage}{Stages}
\crefname{turingmultienumiii}{Stg.}{Stgs.}
\Crefname{turingmultienumiii}{Stage}{Stages}
\crefname{turingmultienumiiii}{Stg.}{Stgs.}
\Crefname{turingmultienumiiii}{Stage}{Stages}
\newlist{turingenum}{enumerate}{1}
\setlist[turingenum]{
itemsep=-0.5em,
parsep=0.5em,
partopsep=-0.5em,
labelsep=.5em,
leftmargin=!,
labelwidth=1.5em,
label=\bfseries\arabic{*}.,
ref=\arabic{*}
}
\crefname{turingenumi}{Stg.}{Stgs.}
\Crefname{turingenumi}{Stage}{Stages}
\newenvironment{turing}[2]
{\begin{enumerate}[labelsep=0pt,align=left,parsep=0pt,leftmargin=\widthof{$#1={}$}+\parindent,listparindent=0pt,labelwidth=\widthof{$#1={}$}]
\item[$#1={}$]``\ignorespaces#2
\begin{turingenum}[
partopsep=0em,
topsep=0em,
leftmargin=\labelwidth %\widthof{$#1={}$}-0.6em %+1.5em
]}
{\unskip''\end{turingenum}\end{enumerate}}
\newcommand{\bitem}[1]{\item\begin{adjustwidth}{1em}{0pt}\ignorespaces#1\end{adjustwidth}}
\newcommand{\bbitem}[1]{\item\begin{adjustwidth}{2em}{0pt}\ignorespaces#1\end{adjustwidth}}
\newcommand{\bbbitem}[1]{\item\begin{adjustwidth}{3em}{0pt}\ignorespaces#1\end{adjustwidth}}
\newcommand{\bbbbitem}[1]{\item\begin{adjustwidth}{4em}{0pt}\ignorespaces#1\end{adjustwidth}}
\newcommand{\bbbbbitem}[1]{\item\begin{adjustwidth}{5em}{0pt}\ignorespaces#1\end{adjustwidth}}
\NewDocumentCommand{\branch}{ m o }{\makebox{\textsc{[#1]}\IfValueT{#2}{ Branch #2:}}}
\NewDocumentCommand{\branchpr}{ m o }{\branch{\,Probability: \ensuremath{#1}\,}[#2]}
\NewDocumentCommand{\branchperc}{ m o }{\branch{#1\% prob.}[#2]}
\makeatletter
\def\squiggly{\bgroup \markoverwith{\lower3.9\p@\hbox{\sixly \scalebox{1.2}[0.65]{\char58}}}\ULon}
\makeatother
\def\mysout{\leavevmode\bgroup\def\ULthickness{1pt}\ULdepth=-.4ex\ULset}
\newcommand{\stkout}[1]{\begingroup\ifmmode\text{\mysout{\ensuremath{#1}}}\else\mysout{#1}\fi\endgroup}
% \newcommand{\utkanadd}[2][0]{\textcolor{green!#1!blue!20!cyan!40!black}{\ifmmode\smash[b]{\squiggly{#2}}\else\squiggly{#2}\fi}}
% \newcommand{\utkanadd}[2][0]{\begingroup\color{blue!#1!cyan!70!black}\tikz[overlay]{\draw[color=blue!#1!cyan!50!black,line width=7,opacity=0.25] (0,0.1) circle (0.5);}#2\endgroup}
\newcommand{\utkanadd}[2][50]{\begingroup\color[Hsb]{210,1,1}%\tikz[overlay]{\draw[color=blue!#1!cyan!50!black,line width=7,opacity=0.25] (0,0.1) circle (0.5);}
#2\endgroup}
% \usepackage[outline]{contour}
% \contourlength{0.8pt}
% \contournumber{1}
\newcommand{\bigast}{\ensuremath{\mathop{\scalebox{1.3}{$\ast$}}}}
\newcommand{\tsim}{\contour{red!80!black!70}{$\bm{\sim}$}}
\newcommand{\utkanrem}[1]{\begingroup\color{red!80!black!70}\tikz[overlay]{\draw[color=red!50!black!70,line width=7,opacity=0.25] (0,0.1) circle (0.5);}\stkout{#1}\endgroup}
\newcommand{\utkanremlong}[2][\bigast\textbf{SUGGESTED FOR REMOVAL}\bigast]{\begingroup\color{red!80!black!70}#1 #2 #1\endgroup}
% \newcommand{\utkanremshort}[1]{\utkanrem[\contour{red!80!black!70}{$\bm{\sim\sim}$}]{#1}}
\newcommand{\utkanalt}[2]{\begingroup\color{green!45!black}\texttt{\Large[}#1\texttt{\Large]} $\thickapprox$OR$\thickapprox$ \texttt{\Large[}#2\texttt{\Large]}\endgroup}
% \newcommand{\utkanworry}[1]{\hl{#1}}
\newcommand{\utkanworry}[1]{\textcolor{red!45!black!90}{\ifmmode\smash[b]{\squiggly{#1}}\else\squiggly{#1}\fi}}
\newcommand{\triast}{\bigskip\par\noindent\parbox{\linewidth}{\centering\large{*}\\[-4pt]{*}\hskip 0.75em{*}}\bigskip\par}%
\newcommand{\threeast}{\bigskip\par\centerline{*\,*\,*}\medskip\par}%
\newcommand{\oneast}{\bigskip\par{\large\centerline{*\medskip}}\par}%
\renewcommand{\textvisiblespace}[1][.7em]{%
\makebox[#1]{%
\kern.07em
\vrule height.5ex
\hrulefill
\vrule height.5ex
\kern.07em
}% <-- don't forget this one!
}
\DeclareMathAlphabet{\mathsl}{\encodingdefault}{\familydefault}{m}{sl}
\SetMathAlphabet{\mathsl}{bold}{\encodingdefault}{\familydefault}{bx}{sl}
\usepackage{fancyhdr}
\pagestyle{fancy}
\renewcommand{\headrule}{}
\fancyhead{}
% \fancyhead[ER]{\small\itshape M. Utkan Gezer, A. C. Cem Say}
% \fancyhead[OL]{\small\itshape $\mathit{P}$ has polynomial-time finite-state verifiers}
\fancyhead[L]{\small\slshape%
\ifodd\value{page}
\makebox[0pt][l]{\parbox[b]{\headwidth}{\raggedleft{}M. Utkan Gezer, A. C. Cem Say}}%%
\else
$\mathsl{P}$ has polynomial-time finite-state verifiers%
\fi}
\author{M. Utkan Gezer\footnote{Utkan Gezer's participation in this work is supported by the Turkish Directorate of Strategy and Budget under the TAM Project number 2007K12-873.}\\\href{mailto:utkan.gezer@bogazici.edu.tr}{\texttt{utkan.gezer@bogazici.edu.tr}}
\and A. C. Cem Say\\\href{mailto:say@bogazici.edu.tr}{\texttt{say@bogazici.edu.tr}}}
\title{$\mathrm{P}$ has polynomial-time finite-state verifiers\footnote{This research was partially supported by Boğaziçi
University Research Fund Grant Number 19441. An earlier version of this paper~\cite{GS23} was presented in the 24th Italian Conference on Theoretical Computer Science, Palermo, Italy, September 13--15, 2023. This is a substantially extended version.}}
% put your affiliation here, not your full address.
% If you like to give away your email or other parts of your address,
% THIS IS NOT THE RIGHT PLACE, your address will change, this paper
% will not.
% Just watch that your personal data that you want to communicate on
% the episcience server is always up to date.
\date{\small \itshape
% one line per affiliation, no postal codes, grant numbers or similar
Department of Computer Engineering,
Bo\u{g}azi\c{c}i University,
Bebek 34342,
\.{I}stanbul,
T\"{u}rkiye
% INRIA, France\\
% ICube, university of Strasbourg, France\\
% Alma Mater, campus universalis, terra incognita
}
% \keywords{interactive proof systems, probabilistic finite automata, multihead finite automata, alternating finite automata}
\newcommand{\eg}{\textit{e.g.}}
\newcommand{\Eg}{\textit{E.g.}}
\newcommand{\ie}{\textit{i.e.}}
\newcommand{\Ie}{\textit{I.e.}}
\newcommand{\etc}{\textit{etc.}}
\newcommand{\False}{\texttt{false}}
\newcommand{\True}{\texttt{true}}
\DeclareMathOperator\bin{bin}
% \newcommand\bin[1]{\ensuremath{\mathit{bin}_{#1}}}
\newcommand\binleq[1]{\ensuremath{\mathit{BIN}_{\leq #1}}}
\newcommand\maj[1]{\ensuremath{\mathit{MAJ}_{#1}}}
\newcommand\pprefix[1]{\ensuremath{\mathit{PROPER\mhyphen{}PREFIX}\paren*{#1}}}
\newcommand\prefix[1]{\ensuremath{\mathit{PREFIX}\paren*{#1}}}
\newcommand\TICK{\textsf{TICK}}
\newcommand\HALVE{\textsf{HALVE}}
\newcommand\DOUBLE{\textsf{DOUBLE}}
\newcommand\timespec[1]{\raisebox{-1.5pt}{\setlength{\fboxsep}{2pt}\fbox{\raisebox{1.5pt}{#1}}}}
\makeatletter
\AtBeginDocument{% <-- add this
\catcode`_=12
\begingroup\lccode`~=`_
\lowercase{\endgroup\let~}\sb
\mathcode`_="8000
\immediate\write\@auxout{\catcode`_=12 }% <-- add this
\immediate\write\@auxout{\catcode`^=12 }% <-- add this
}
\makeatother
\makeatletter
\def\@testdef #1#2#3{%
\def\reserved@a{#3}\expandafter \ifx \csname #1@#2\endcsname
\reserved@a \else
\typeout{^^Jlabel #2 changed:^^J%
\meaning\reserved@a^^J%
\expandafter\meaning\csname #1@#2\endcsname^^J}%
\@tempswatrue \fi}
\makeatother
\newcommand\paragraphEnd{\vspace{3.25ex plus 1ex minus .2ex}}
% \includeonly{}
\begin{document}
%% CEURART
%%
%% Rights management information.
%% CC-BY is default license.
% \copyrightyear{2023}
% \copyrightclause{Copyright for this paper by its authors.
% Use permitted under Creative Commons License Attribution 4.0
% International (CC BY 4.0).}
% %%
% %% This command is for the conference information
% \conference{Proceedings of the 24th Italian Conference on Theoretical Computer Science, Palermo, Italy, September 13--15, 2023}
% %%
% %% The "title" command
% % \title{Finite-State Verifiers with Both Private and Public Coins}% BUNA GÖRE FOOTNOTE NETLEŞTİRİLECEK}
% % \shorttitle{Finite-State Verifiers with Both Private and Public Coins}
% \title{\PP{} has polynomial-time finite-state verifiers}% BUNA GÖRE FOOTNOTE NETLEŞTİRİLECEK}
% \shorttitle{\PP{} has polynomial-time finite-state verifiers}
% % \tnotemark[1]
% % \tnotetext[1]{!!!!!BU LAFI ACKNOWLEDGEMENTS'DE DESEK? "An earlier version of this paper (cite) was presented in falan filan. We thank the reviewers of that conference. This is a substantiall This is a substantially extended version" GİBİ?!?!??..... presented in the 24th Italian Conference on Theoretical Computer Science, Palermo, Italy, September 13--15, 2023.} Utkan: Yaptim
% %%
% %% The "author" command and its associated commands are used to define
% %% the authors and their affiliations.
% \author[1]{M. Utkan Gezer}[%
% % orcid=0000-0002-0877-7063,
% email=utkan.gezer@bogazici.edu.tr,
% % url=https://yamadharma.github.io/,
% ]
% \cormark[1]
% % \fnmark[1]
% \author[1]{A. C. Cem Say}[%
% % orcid=0000-0001-7116-9338,
% email=say@bogazici.edu.tr,
% % url=https://kmitd.github.io/ilaria/,
% ]
% \address[1]{Department of Computer Engineering,
% Bo\u{g}azi\c{c}i University,
% Bebek 34342,
% \.{I}stanbul, T\"{u}rkiye}
% % \fnmark[1]
% % \address[3]{Vrije Universiteit Amsterdam, De Boelelaan 1105, 1081 HV Amsterdam, The Netherlands}
% % \author[4]{Manfred Jeusfeld}[%
% % orcid=0000-0002-9421-8566,
% % email=Manfred.Jeusfeld@acm.org,
% % url=http://conceptbase.sourceforge.net/mjf/,
% % ]
% % \fnmark[1]
% % \address[4]{University of Skövde, Högskolevägen 1, 541 28 Skövde, Sweden}
% %% Footnotes
% \cortext[1]{Corresponding author.}
% % \fntext[1]{These authors contributed equally.}
% \publicationdata
% {vol. 25:3 special issue for main purpose}
% {2022}
% {1}
% {10.46298/dmtcs.10472}
% %{1998-10-14; 1998-10-14; 2002-07-19; 2014-02-05; 2015-09-09; 2022-12-25}
% %{2022-12-3}
% {2022-12-3; None}
% {2023-1-1}
\maketitle
%%
%% The abstract is a short summary of the work to be presented in the
%% article.
\begin{abstract}
\noindent Interactive proof systems whose verifiers are constant-space machines have interesting features that do not have counterparts in the better studied case where the verifiers operate under reasonably large space bounds. The language verification power of finite-state verifiers is known to be sensitive to the difference between private and public randomization.
These machines also lack the capability of imposing worst-case superlinear bounds on their own runtime, and long interactions with untrustable provers can involve the risk of being fooled to loop forever.
% No analogue of the theorem that guarantees perfect completeness (the property that the verifier will accept members of the language under consideration with probability 1) is known for finite\-/state machines. We address these issues by
We analyze such verifiers under different bounds on the numbers of private and public random bits that they are allowed to use. This separate accounting for the private and public coin budgets as resource functions of the input length provides interesting characterizations of the collections of the associated languages. When the randomness bound is constant, the verifiable class is $\mathrm{NL}$ for private-coin machines, but equals just the regular languages when one uses public coins. Increasing the public coin budget while keeping the number of private coins constant augments the power: We show that the set of languages that are verifiable by such machines in expected polynomial time (with an arbitrarily small positive probability of looping) equals the complexity class $\mathrm{P}$. This hints that allowing a minuscule probability of looping may add significant power to polynomial-time finite-state automata, since it is still not known whether those machines can verify all of $\mathrm{P}$ when required to halt with probability 1, even with no bound on their private coin usage. We also show that logarithmic-space machines which hide a constant number of their coins are limited to verifying the languages in $\mathrm{P}$.\vspace{1em}
\noindent\textbf{Keywords:} interactive proof systems, probabilistic finite automata, multihead finite automata, alternating finite automata
\end{abstract}
%%
%% Keywords. The author(s) should pick words that accurately describe
%% the work being presented. Separate the keywords with commas.
% \begin{keywords}
% Interactive proof systems \sep
% probabilistic finite automata \sep
% multihead finite automata \sep
% alternating finite automata
% \end{keywords}
%%
%% This command processes the author and affiliation and title
%% information and builds the first part of the formatted document.
% \maketitle
%% LLNCS
% \title{Finite-state verifiers with both private and public coins}
% \author{M. Utkan Gezer\inst{1} \and
% A. C. Cem Say\inst{1}}
% \institute{Department of Computer Engineering, Bo\u{g}azi\c{c}i University, Bebek 34342, \.{I}stanbul, Turkey\\
% \email{\{utkan.gezer,say\}@boun.edu.tr}}
% \maketitle
% \begin{abstract}
% We consider the effects of allowing a finite\-/state verifier in an interactive proof system to use a bounded number of private coins, in addition to ``public'' coins whose outcomes are visible to the prover. Although swapping between private and public\-/coin machines does not change the class of verifiable languages when the verifiers are given reasonably large time and space bounds, this distinction has well known effects for the capabilities of constant\-/space verifiers. We show that a constant private\-/coin ``budget'' (independent of the length of the input) increases the power of public\-/coin interactive proofs with finite\-/state verifiers considerably, and provide a new characterization of the complexity class $\PP$ as the set of languages that are verifiable by such machines with arbitrarily small error in expected polynomial time.
% \keywords{Interactive proof systems \and Delegating computation \and Verifiable computing.}
% \end{abstract}
%% ELSARTICLE
% \begin{frontmatter}
% \title{Finite-state verifiers with both private and public coins}
% % \title{Real-Time, Constant-Space, Constant-Randomness Verifiers\tnoteref{confref}}
% % \tnotetext[confref]{This paper is a substantially improved version of~\cite{DEGS22}.}
% % \titlerunning{Real-Time, Constant-Space, Constant-Randomness Verifiers}
% \author{M. Utkan Gezer\corref{cor1}}
% \ead{utkan.gezer@boun.edu.tr}
% \author{A. C. Cem Say}
% \ead{say@boun.edu.tr}
% \cortext[cor1]{Corresponding author}
% \address{Department of Computer Engineering, Bo\u{g}azi\c{c}i University, Bebek 34342, \.{I}stanbul, Turkey}
% \begin{abstract}
% We consider the effects of allowing a verifier in an interactive proof system to use a bounded number of private coins, in addition to ``public'' coins, whose outcomes are visible to the prover. Although swapping between private and public\-/coin machines does not change the class of verifiable languages when the verifiers are allowed reasonably large time and space bounds, this distinction has well known effects for the capabilities of constant\-/space verifiers. We show that a constant private\-/coin ``budget'' (independent of the length of the input) increases the power of public\-/coin interactive proofs with finite\-/state verifiers considerably, and provide a new characterization of the complexity class $\PP$ as the set of languages that are verifiable by such machines with arbitrarily small error in expected polynomial time.
% \end{abstract}
% \begin{keyword}
% Interactive proof systems \sep delegating computation \sep verifiable computing
% \end{keyword}
% \end{frontmatter}
\section{Introduction}
In addition to providing a new perspective on the age\-/old concept of proof, and offering possibilities for weak clients to check the correctness of difficult computations that they delegate to powerful servers, interactive proof systems also play an important role in the characterization of computational complexity classes~\cite{GMR89,GKR15,Sha92}.
% !!!!İlki89 diyor ama 85 versiyonuna gidiyor, 89 journal versiyonu yapalım!!sonuncusu: https://dl.acm.org/doi/pdf/10.1145/146585.146609!!! Utkan: Yaptim
These systems involve a computationally weak verifier (a probabilistic Turing machine with small resource bounds) engaging in a dialogue with a strong but possibly malicious prover, whose aim is to convince the verifier that a common input string is a member of the language under consideration. If the input is a non\-/member, the prover may well lie during this exchange to mislead the verifier to acceptance, or to trick it into running forever instead of rejecting. Interestingly, this setup allows the weak machines to be able to verify (that is, to determine the membership status of any given string with low probability of being fooled) a larger class of languages than they can manage to handle in a stand\-/alone fashion, \ie, without engaging with a prover.
Several specializations of the basic model described above have been studied until now. One parameter is whether the prover can directly see the outcomes of the random choices made by the verifier or not. A \emph{private\-/coin} system hides the results of the verifier's coin flips from the prover, and the verifier only sends information that it deems necessary through the communication channel. \emph{Public\-/coin} systems, on the other hand, hide nothing from the prover, who can be assumed to observe the coin flips and deduce the resulting changes to the configuration of the verifier as they unfold. It is known~\cite{DS92} that private\-/coin systems are more powerful (\ie, can verify more languages) than public\-/coin ones when the verifiers are restricted to be constant\-/space machines, but this distinction vanishes when the space restriction is lifted~\cite{GS86}.
In this paper, we study the capabilities of constant\-/space verifiers (essentially, two\-/way probabilistic finite\-/state automata) which are allowed to hide some, but not necessarily all, of their coin flips from the prover. The separate accounting for the private and public coin budgets as resource functions of the input length provides new characterizations of the collections of associated languages in terms of well known complexity classes.
The rest of the paper is structured as follows: \Cref{sec:prel} provides the preliminaries. A definition of interactive proof systems which allows separate accounting of private and public coin usage is given in \Cref{subs:vers}, together with notation that generalizes the standard IP classes in an accordingly parameterized manner. Since some of our constructions involve verifiers which do not halt with probability $1$, we introduce notation that enables us to talk about resource bounds that apply in the (highly probable) cases where the machines do halt. %\Cref{subs:deb} reviews debate systems, a generalization of alternation %\utkanadd{(akin to how interactive proof systems are to nondeterminism)}
%that will be used in some of our characterizations.
Our main result uses a technique that depends on the relationship between logarithmic\-/space computation and multihead finite automata. \Cref{subs:nfaks} contains a quick review of that fact. \Cref{sec:clock} describes two methods for implementing probabilistic ``alarm clocks'' for later use in our proofs. \Cref{subs:afas} presents the definition of the two\-/way alternating finite automaton model, which will be employed in the proof of \Cref{thm:conspubliconly}.
We start \Cref{sec:prelresults} by noting that finite\-/state verifiers which are only allowed to flip $\OH{1}$ private coins are already known to outperform deterministic verifiers, and consider the analogous question about public coins. It turns out (\Cref{thm:conspubliconly}) that finite\-/state verifiers tossing only $\OH{1}$ public coins can verify only regular languages. This section also includes a technical result (\Cref{thm:strictboundislinear}) establishing that one has to consider bounds on expected, rather than worst\-/case, %\utkanadd{[Utkan: ``expected bound'' KELİMELERİN ANLAMINI DÜŞÜNÜNCE MANTIKLI BİR TAMLAMA DEĞİL GİBİ. ``expected usage'' OLUR, ``statistical bound'' OLUR, AMA BOUND EXPECT EDILEMEZ]} on the
runtimes of finite\-/state verifiers to be able to conduct a meaningful study of superlinear resource bounds.
Our main result (\Cref{thm:P}, \Cref{sec:results}) is a demonstration of the equality of the set of languages verifiable by polynomial\-/time finite\-/state machines that flip $\OH{1}$ private coins and polynomially many public coins to the complexity class $\PP$. (The verifiers in question are allowed to be fooled by malicious provers to run forever without halting, but the probability of this error can be bounded below any desired positive value. The bounds on the runtime and number of public coin flips apply to halting computations.)
%\utkanadd{and only in the ``expected'' sense}.)
The proof builds on previous work~\cite{con89,GKR15,SY14,GS22} on logarithmic\-/space verification, prover\-/aided simulation of multihead automata by single\-/head probabilistic finite automata, and specialized loop avoidance techniques for such verifiers. Notably, \Cref{thm:P} hints that allowing a minuscule probability of looping may add significant power to polynomial\-/time finite\-/state machines, since it is still not known whether those machines can verify all of $\PP$ when required to halt with probability $1$, even with no bound on their private coin usage. We also show that logarithmic\-/space machines which hide a constant number of their coins are limited to verifying the languages in $\PP$, even with arbitrarily large time and public\-/coin budgets.
\Cref{sec:conc} lists some open problems. Detailed constructions involved in some of the proofs are presented in the Appendix to avoid cluttering the main text.
%We show that allowing these machines to use even only a constant number\footnote{That is, the number of such private coin flips is fixed, regardless of the length of the input.} of private coins enlarges the class of verified languages considerably. We adapt several previous results from the literature to this framework. Our main result (\Cref{thm:P}) is a new characterization of the complexity class $\PP$ as the set of languages that can be verified by such machines in polynomial time with arbitrarily small error.
\section{Background}\label{sec:prel}
\subsection{Interactive proof systems}\label{subs:vers}
%HEM CONSTANT-SPACE, HEM DE LOGSPACE (KARŞILIKLI KONUŞMALI(BUNUN TANIMI YS14'TEN BAKILABİLİR, COMMUNİCATİON CELL FALAN)) VE BİRAZ PRIVATE BİRAZ PUBLİC COİNLU VERIFIERLARIN TANIMI, ACCEPTANCE, ERROR FALAN TANIMI, DİL SINIFI NOTASYONU
We start by providing definitions of interactive proof systems and related language classes that are general enough to cover finite\-/state verifiers with both private and public coins, as well as the more widely studied versions with greater memory bounds~\cite{DS92,GMR89,B85}. %!!!BURAYA muggles paperının reflerinde bulabileceğin Goldwasser et al. [1989] ve Babai [1985] reflerini EKLEYELİM!!! Utkan: Ekledim
% https://tex.stackexchange.com/a/120231/69346
\NewDocumentCommand{\vartextvisiblespace}{ O{.7em} O{.7ex} }{%
\makebox[#1]{%
\kern.07em
\vrule height#2
\hrulefill
\vrule height#2
\kern.07em
}% <-- don't forget this one!
}
\newcommand{\estring}{\ensuremath{\lambda}}
\newcommand{\blanksymb}{\ensuremath{\text{\vartextvisiblespace}}}
\NewDocumentCommand{\qacc}{ e{_} o }{\ensuremath{q_{\IfValueT{#2}{#2,}\mathrm{acc}\IfValueT{#1}{,#1}}}}
\NewDocumentCommand{\qrej}{ e{_} o }{\ensuremath{q_{\IfValueT{#2}{#2,}\mathrm{rej}\IfValueT{#1}{,#1}}}}
% \newcommand{\qacc}{\ensuremath{q_{\mathrm{acc}}}}
% \newcommand{\qrej}{\ensuremath{q_{\mathrm{rej}}}}
\NewDocumentCommand{\Qpub}{ e{_} o }{\ensuremath{Q_{\IfValueT{#2}{#2,}\mathrm{pub}\IfValueT{#1}{,#1}}}}
\NewDocumentCommand{\Qpri}{ e{_} o }{\ensuremath{Q_{\IfValueT{#2}{#2,}\mathrm{pri}\IfValueT{#1}{,#1}}}}
\NewDocumentCommand{\Qcom}{ e{_} o }{\ensuremath{Q_{\IfValueT{#2}{#2,}\mathrm{com}\IfValueT{#1}{,#1}}}}
\NewDocumentCommand{\bpub}{ e{_} o }{\ensuremath{b_{\IfValueT{#2}{#2,}\mathrm{pub}\IfValueT{#1}{,#1}}}}
\NewDocumentCommand{\bpri}{ e{_} o }{\ensuremath{b_{\IfValueT{#2}{#2,}\mathrm{pri}\IfValueT{#1}{,#1}}}}
\NewDocumentCommand{\Qex}{ e{_} o }{\ensuremath{Q_{\IfValueT{#2}{#2,}\exists\IfValueT{#1}{,#1}}}}
\NewDocumentCommand{\Qun}{ e{_} o }{\ensuremath{Q_{\IfValueT{#2}{#2,}\forall\IfValueT{#1}{,#1}}}}
% \utkanadd{
An \emph{interactive proof system (IPS)} for some language $L$ is a protocol between a \emph{verifier} and a \emph{prover}. The verifier is a probabilistic Turing machine tasked with determining whether the prover's argument is sufficiently convincing to conclude that the input string is a member of $L$. %!!!!!ŞU CÜMLEYİ SİLİNCE BİR ŞEY KAYBETMEYİZ DİYE DÜŞÜNEREK COMMENTLEDİM:!!! \utkanadd{Utkan: Bence dogru olmak zorunda da degildi zaten. Sadece oyle kabul etsek de sorun olmuyordu.} %The prover always claims that the input string is in $L$, regardless of whether this is actually the case or not.
The messages of the prover at any step during its communication with the verifier are determined by a (not necessarily computable) function of the input string and the transcript of the communication up to that point. This function maximizes the probability that the verifier accepts if the input is in $L$, and minimizes the probability that it rejects otherwise.
% \newcommand{\randmark}{\ensuremath{\tikz[x=1ex,y=1ex,ultra thin]{
% \draw[->] (0,0) -- (1,1);
% \draw[->] (0,1) -- (1,0);
% }}}
\newcommand{\randmark}{\ensuremath{\tikz[x=1.2ex,y=0.7ex,ultra thin]{
\draw[->] (0,0) .. controls (0.5,0) and (0.1,1) .. (1,1);
\draw[ultra thick,white] (0,1) .. controls (0.5,1) and (0.1,0) .. (1,0);
\draw[->] (0,1) .. controls (0.5,1) and (0.1,0) .. (1,0);
}}}
The verifier has
%private access to !!!!BÖYLE DERSEN PROVER İNPUTU GÖRMÜYOR
a read\-/only input tape, a read\-/write work tape, and %shared access (shared with the prover) to
a read\-/write communication cell for interacting with the prover. It is modeled as a 6\=/tuple $\paren*{Q,\Sigma,\Phi,\Gamma,\delta,q_0}$, with the following components:
% }
% \utkanrem{A \emph{verifier} in an \emph{interactive proof system (IPS)} is a 6-tuple $(Q,\Sigma,\Phi,\Gamma,\delta,q_0)$, where}
\begin{enumerate}
\item $Q$ is the finite set of states. The following subsets of $Q$ are not necessarily disjoint, unless specified otherwise: % \utkanrem{such that $Q = \Qpri \cup \Qpub \cup \Set{\qacc, \qrej}$ where}
\begin{itemize}
\item $\Qpri$ is the set of states that flip private coins. %, as well as public coins,
\item $\Qpub$ is the set of states that flip public coins. % \utkanrem{$\Qpri \subseteq \Qpub$, and} % are not associated with private coins, such that $\Qpri \cap \Qpub = \emptyset$, and
\item $\Qcom$ is the set of communication states, \ie, those that
write to the communication cell. %A public coin flip entails communication of the outcome, therefore
$\Qpub \subseteq \Qcom$.
\item $\Set{\qacc, \qrej}$ % \utkanrem{$\qacc, \qrej \notin \Qpri \cup \Qpub$}
are the accept and reject states, respectively. $\qacc, \qrej \notin \Qpri %\cup \Qpub
\cup \Qcom$.%!!!!BU İFADEDEN Qpub ÇIKSA DA BİRAZ KISALSA????!!!!!!!!!! \utkanadd{Utkan: bilemedim, ayni sey tabii ki, yine de sanki acik acik yazilmasi daha sade. eger ikinci satira tasmamasini saglamak icinse, dokuman formatini submit edecegimiz yerin formatina degistirince muhtemelen bu da degisecek (ya cikarmis olmak yeterli olmayacak ya da cikarmamis olsak bile tek satirda olacak)}
\end{itemize}
\item $\inpAlp$ is the input alphabet.
\item $\Phi$ is the work tape alphabet, containing the special blank symbol \blanksymb.
% \utkanrem{which is guaranteed to include the special blank symbol, \blanksymb{}.}
\item $\certAlp$ is the communication alphabet. $\blanksymb \in \certAlp$.
% $\certAlp_{\randmark} = \certAlp \sqcup \Set{0_{\randmark}, 1_{\randmark}}$
\item $\delta$ %: Q \times \inpAlp^\prime \times \Phi \times \certAlp^\prime \times C \to Q \times \Delta$
is the transition function, described below.
\item $q_0$ is the initial state. $q_0 \in Q$.
\end{enumerate}
% \utkanadd{
The computation of a verifier on an input string $w \in \Sigma^*$ is initialized as follows:
\begin{itemize}
\item The input tape contains $\lend w \rend$, where $\lend, \rend \notin \Sigma$ are the left and right end\-/markers, respectively. The input tape head starts on the left end\-/marker.
\item The work tape is filled with blank symbols, and the work tape head is positioned at the beginning of the tape.
\item The communication cell is also blank.
\end{itemize}
% }
% \utkanrem{The computation of a verifier is initialized with $\lend w \rend$ written on its read\-/only input tape, where $w \in \Sigma^*$ is the input string, and $\lend, \rend \notin \Sigma$ are the left and right end\-/markers, respectively. The input head of the verifier is initially on the left end\-/marker.
% %first symbol of $w$.
% The read\-/write work tape is initially filled with blank symbols, with the work tape head positioned at the beginning of the tape. Apart from these two tapes, the verifier also has access to a communication cell, which is a single\-/cell tape that is initially blank.}
\newcommand\query{\ensuremath{\mathit{query}}}
\newcommand\qneg[1]{\ensuremath{\overline{#1}}}
Let $\Sigma_{\bowtie} = \Sigma \cup \Set{\lend, \rend}$.
% Let $\certAlp_{\estring} = \certAlp \cup \Set{\estring}$, where $\estring$ is the zero\-/length ``empty string'' that is the identity element of string concatenation (\ie, $x\lambda = \lambda x = x$ for any string $x$).
Let $\Delta = \Set{-1, 0, +1}$ be the set of possible head movements, where $-1$ means ``move left'', $0$ means ``stay put'', and $+1$ means ``move right''.
Let $\qneg{A}$ denote the complement of a set $A$, \eg, $\qneg{\Qpri} = Q \setminus \Qpri$. % !!!!BU İŞ İÇİN EĞRİ DEĞİL DÜZ ÇİZGİ STANDART, DEĞİL Mİ???!?!?!!!!!!!!! Utkan: Evet, bence de öyle. Eskiden 'complement EKSİ {qacc, qrej}' şeklinde tanımlamıştım, herhalde ondan ötürü böyle eğri kalmış. Dediğiniz gibi yaptım.
%\utkanrem{$\qneg{\Qpri} = Q \setminus \Qpri \setminus \Set{\qacc, \qrej}$, and let $\qneg{\Qpub}$ and $\qneg{\Qcom}$ be defined similarly.}
The computation of the verifier is governed by its transition function $\delta$, which is defined in parts in the manner depicted in \Cref{tab:transitionfunction} and explained below.
\begin{table}[!ht]
\centering
\caption{Parts of the verifier's transition function.}\label{tab:transitionfunction}
\renewcommand*{\arraystretch}{1.4}
$$
\begin{array}{l l}
\text{\textbf{Case}} & \text{\textbf{Mapping}}\\\midrule
q \in \Qpri \cap \Qpub &
\delta\paren{q,\sigma,\phi,\gamma,\bpri,\bpub} =
% \paren{q',\phi',\paren{\gamma',\bpub},d_i,d_w}\\%\midrule
\paren{q',\phi',\gamma',d_i,d_w}\\%\midrule
%
q \in \Qpri \cap \qneg{\Qpub} \cap \Qcom &
\delta\paren{q,\sigma,\phi,\gamma,\bpri} =
\paren{q',\phi',\gamma',d_i,d_w}\\%\midrule
%
q \in \Qpri \cap \qneg{\Qpub} \cap \qneg{\Qcom} &
\delta\paren{q,\sigma,\phi,\gamma,\bpri} =
\paren{q',\phi',d_i,d_w}\\%\midrule
% % % %
q \in \qneg{\Qpri} \cap \Qpub &
\delta\paren{q,\sigma,\phi,\gamma,\bpub} =
% \paren{q',\phi',\paren{\gamma',\bpub},d_i,d_w}\\%\midrule
\paren{q',\phi',\gamma',d_i,d_w}\\%\midrule
%
q \in \qneg{\Qpri} \cap \qneg{\Qpub} \cap \Qcom &
\delta\paren{q,\sigma,\phi,\gamma} =
\paren{q',\phi',\gamma',d_i,d_w}\\%\midrule
%
q \in \qneg{\Qpri} \cap \qneg{\Qpub} \cap \qneg{\Qcom}
\setminus \Set{\qacc, \qrej} &
\delta\paren{q,\sigma,\phi,\gamma} =
\paren{q',\phi',d_i,d_w}%\\\bottomrule
\end{array}
$$
\end{table}
%These parts of the transition function dictate the following orderly procedure, carried out by the verifier
At each step of its computation, the verifier does the following:
\begin{itemize}
\item It reads the symbols $\paren{\sigma, \phi, \gamma} \in \Sigma \times \Phi \times \Gamma$ from its input tape, work tape, and communication cell respectively. If its current state $q$ is in $\Qpri$, it tosses a private coin, obtaining the outcome $\bpri \in \Set{0, 1}$. If $q$ is in $\Qpub$, it tosses a public coin, obtaining the outcome $\bpub \in \Set{0, 1}$.
\item The value of $\delta$ corresponding to this tuple (see the template of the corresponding part of $\delta$ in \Cref{tab:transitionfunction}) dictates that the machine will switch to state $q' \in Q$, write $\phi' \in \Phi$ to its work tape, and move its input and work tape heads in the directions $d_i, d_w \in \Delta$, respectively. The verifier
%determines the symbol to write to
overwrites the communication cell with $\gamma' \in \Gamma$ if
% $q \in \Qcom \cap \qneg{\Qpub}$, and with $\paren{\gamma',\bpub} \in \Gamma$ !!!!!BUNA IN GAMMA DEMESEK DAHA MI HAYIRLI PEDAGOJİK OLARAK? BÖYLECE GAMMA'YA İKİNCİ ELEMANI 0 OLAN BİR TUPLE KOYSALAR BİLE AMBIGUITY OLMAZ!!!!!!!! if $q \in \Qpub$.
$q \in \Qcom$. If $q \in \Qpub$, the outcome of the public coin flip (\bpub) is also communicated to the prover automatically through a separate channel.% \utkanadd{in this stage}.
\end{itemize}
%The prover comes into play for a brief moment, immediately after
Each time the verifier writes a symbol to the shared communication cell, the prover overwrites that symbol with a (possibly different) member of $\Gamma$, determined as a function of $w$, the history of public coin outcomes, and the communication symbols written to the communication cell up to that point. %\footnote{\utkanadd{Note that the verifier might, at times, want to simply query the prover for a new communication symbol without having anything to say. To initiate this interaction, the verifier may write a special communication symbol to the communication cell, signifying just that.}}
% !!!!BU PARAGRAFIN GERİSİNDE YAZDIKLARINI COMMENTLEYİP REWRITE ETTİM; NASIL??!!!!!!!! Utkan: ok gibi; prover'in neyi bilip neyi bilmedigini daha iyi mi aciklasak diye dusundum
Since the prover is supposed to embody the optimal function to convince (or, when the input string is not in the language $L$, to deceive) the verifier, one can assume that the prover knows the algorithm of the verifier. Note, however, that the prover does not see the private coin outcomes, tape head positions, work tape content, and internal state of the verifier.
We define the \emph{configuration} of a verifier at any given time as the tuple composed of its state, the contents of its work tape, the symbol in the communication cell, and the positions of its input and work tape heads.
%!!!!!!!!!SEN BUNU TEZİNE AL BENCE\utkanadd{The significance of a configuration is that it summarizes a verifier's moment, completely disregarding its history, such that two moments with the same configuration are bound to evolve identically if they receive the same coin outcomes and communication symbols.}
%The prover function need not be computable (BUNU EN BASTA DA YAZDIM, BELKI TEKRAR ETMEK CIRKIN OLMUSTUR, YA DA BELKI HATIRLATMAKTA FAYDA VARDIR). It is taken to be statistically the most successful function in making the verifier accept the members of its language and in making the verifier fail to reject the nonmembers of its language. As a consequence of this definition, the prover function can be assumed to have hard\-/coded information regarding all the constants of computation that are predefined, including the complete algorithm of the verifier, which makes the design process and the performance analysis of the verifier much easier. The reader should note, however, that the prover function is not provided with the live details of the ongoing computation other than the inputs specified; particularly the private coins are missing, which allows verifier to keep its configuration uncertain from the prover's perspective for up to that many bits.}
% \utkanrem{The computation of a verifier evolves by its transition function $\delta$, which is constructed in two parts as follows: For $q \in \Qpri$ (which implies $q \in \Qpub$),
% % $q' \in Q$, $\sigma \in \Sigma_{\bowtie}$, $\phi, \phi' \in \Phi$, $\gamma \in \Gamma\cup \Set{%\lend,
% % \rend}$, $b \in \Set{0,1}$, $d_i, d_w \in \Set{-1,0,+1}$, and $d_c \in \Set{0,+1}$,
% $\delta(q,\sigma,\phi,\gamma,\bpri,\bpub)=(q',\phi',\gamma',d_i,d_w)$ dictates that if the machine is originally in state $q$, scanning $\sigma \in \Sigma_{\bowtie}$ in the input tape, $\phi \in \Phi$ in the work tape, and $\gamma \in \Gamma$ in the communication cell, and has obtained the ``private'' random bit $\bpri \in \Set{0, 1}$ and the ``public'' random bit $\bpub \in \Set{0, 1}$ as the result of two independent fair coin flips, then it will switch to state $q' \in Q$, write $\phi' \in \Phi$ to the work tape,
% overwrite the communication cell with $\gamma'$,
% %if $\gamma' \in \Gamma$ (otherwise $\gamma'$ is $\estring$ and the communication cell is left untouched),
% and move the input and work tape heads in the directions $d_i, d_w \in \Delta$
% % \in \Set{-1, 0, +1}$ (where $-1$ and $+1$ indicate movements to the left and to the right, respectively, and $0$ indicates staying in place)
% respectively.
% % \utkanadd{and ask the prover to put a new symbol into the communication cell if $\query \in \Set{0, 1}$ is $1$}.
% For $q\in \Qpub \setminus \Qpri$, $\delta(q,\sigma,\phi,\gamma,\bpub)=(q',\phi',\gamma',d_i,d_w)$ dictates a similar transition in which the outcome of only a single public coin is used.
% % \utkanadd{When $q \notin \Qpri \cup \Qpub$, $\delta(q,\sigma,\phi,\gamma)=(q',\phi',d_i,d_w,\query)$ dictates the transition whereby the transition is carried out deterministically.}
% %For $q\in D$, $\delta(q,\sigma,\phi,\gamma)=(q',\phi',d_i,d_w)$ dictates an even simpler, deterministic transition.
% }
% \utkanrem{The verifier is paired with another entity, the prover, whose aim is to convince the verifier to accept (or to prevent it from rejecting) its input string.
% At every step of the verifier's execution,
% % \utkanadd{outbound from a state in \Qpub{}},
% the outcome of the public coin flip is automatically communicated to the prover. The prover can be modeled as a function that determines the symbol $\gamma \in \Gamma$ which will be written in the communication cell in between the transitions of the verifier
% % \utkanadd{every time the verifier asks for it}
% based on the input string, the public coin outcomes, and
% % \utkanadd{and the communication history (including}
% the sequence of symbols written by the verifier to the communication cell up to that point.
% Note that the prover does not ``see'' (and, in the general case, cannot precisely deduce) the configuration of a verifier which uses private coins.}
%\utkanadd{The two halting states, \qacc{} and \qrej{}, are purposefully left out of the mapping of the transition function.}
A verifier halts with acceptance (rejection) when it executes a transition entering \qacc{} (\qrej). Any transition that moves the input head beyond an end\-/marker delimiting the string written on the read\-/only input tape leads to a rejection, unless that last move enters \qacc.
% !!!!ŞU CÜMLE REF2 İÇİN YETER Mİ???!!!
Any transition that attempts to move the work head off the left end of its tape also leads to rejection.
% !!!OK??!!!!!!!!!!!!!! \utkanadd{UTKAN: Bence yeterli.}
% The head on the certificate tape is defined to be one\-/way, since it is known~\cite{AB09} that allowing two\-/way access to that tape can lead to ``unfair'' accounting of the space usage.
Note that the verifier may possibly never halt, in which case it is said to be looping.
% To describe the language recognized by a verifier and also the error involved due to the randomness employed, we consider acceptances and rejections of the verifier when paired with the ``best'' prover (or \emph{one of the best}, when there are many satisfying that condition). The best prover is the function that, for each input string, maximizes the acceptance probability of the verifier as long as there exists a function that makes that probability greater than $\sfrac23$ given its interaction with the verifier so far, and minimizes the rejection probability otherwise.\footnote{The choice of $\sfrac23$ (and accordingly the $\sfrac13$ on the next paragraph) is arbitrary. It could be any constant strictly between $\sfrac12$ and $1$. We disallow $\sfrac12$ to exclude verifiers recognizing languages with errors infinitesimally close to $\sfrac12$ from our definition.}
% The best prover can trivially be assumed, without loss of generality, to be one of the infinitely many provers that have an undoubted assumption about the internal structure of the verifier they will be paired against, and that structure then matches the structure of the actual verifier it is paired against.
% Thus, it is assumed that the best prover ``sees'' the configuration of its verifier throughout the interaction, unless and until the verifier starts using private coins.
\newcommand{\verr}{\ensuremath{\varepsilon}}
\newcommand{\verracc}{\ensuremath{\verr^+}}
\newcommand{\verrrej}{\ensuremath{\verr^-}}
\newcommand{\verrloop}{\ensuremath{\verr^{\text{loop}}}}
% The largest set of strings that a verifier $V$ can accept paired with a prover $P$ in an IPS is the set of strings that $V$ accepts with a probability strictly greater than $0.5$ as a result of its interaction with $P$.
% The language $L$ of a verifier $V$ in an IPS is the maximum set of strings that are accepted with a probability higher than $0.5$ for every prover $P$ that $V$ might be paired against. Note that such an $L$ indeed includes every other set of strings $V$ would be accepting with high probability when paired against any other prover.
We say a verifier $V$ in an IPS \emph{verifies a language $L$ with %\utkanadd{(bounded)}
error $\verr = \max\paren*{\verracc, \verrrej}$} if there exist numbers $\verracc, \verrrej < \sfrac12$ satisfying the following: %\utkanrem{where}
%\footnote{The choice of $\sfrac13$ is arbitrary. It could be any constant strictly between $0$ and $\sfrac12$. We disallow $\sfrac12$ to exclude verifiers recognizing languages with errors infinitesimally close to $\sfrac12$ from our definition.}
\begin{itemize}
\item There exists a prover $P$ such that, for all input strings $w \in L$, $V$ halts by accepting with probability at least $1 - \verracc$ when started on $w$ and interacting with $P$. % \utkanrem{, and,}
\item For all provers $P^*$ and for all input strings $w \notin L$, $V$ halts by rejecting with probability at least $1-\verrrej$ when started on $w$ and interacting with $P^*$.
\end{itemize}
The terms $\verracc$ and $\verrrej$ bound the two possible types of error corresponding to failing to accept and reject, respectively.
%Some verifiers have!!!!!!PERFECT COMPLETENESS TANIMI İÇİN EN UYGUN YER BURASI, MEŞHUR LEMMADA Goldwasser MAKİNESİNDE TANIMA BENZEYEN YER DE ÇIKACAK!!!\footnote{In the proof of \Cref{lem:dir1}, we will also be considering verifiers with one\-/sided error, where members of the language are accepted with certainty, and the acceptance probabilities of non\-/members are strictly less than $1$.}
% !!!!!!!!BU PARAGRAFI ÇIKARTSAK MI?!!!!!!!Intuitively, this %\utkanadd{error}
%definition of error requires $V$ to be reasonable enough to accept legitimate arguments that prove that the input is a member of the language in question, yet skeptical enough to reject spurious claims of membership when the input is not in the language, both with high probability, even when it is interacting with the most cunning of all provers.
%When $\verracc = 0$ (BU DOGRU MU? YOKSA ``If $V$ accepts every member input with certainty'' MI YAZMALIYIZ?), $V$ is said to recognize $L$ \emph{with perfect completeness}, in which case the restriction upon $\verrrej$ is relaxed to $\verrrej < 1$.
% The input and work tape heads are two\-/way in the general definition above.
% % , although we will be considering restricting the movement types of the input tape head (and completely removing the work tape) in most of the following.
% More restricted verifiers may have a one\-/way or real\-/time input head where $d_i \in \Set{0, +1}$ or $\Set{+1}$, respectively; or they may be devoid of a work tape. Conversely, a verifier can be supplemented with further input or work tape heads to compute with, each moving independently from one another. This work will be dealing with the general type of verifiers, as well as some combinations of being devoid of a work tape and having multiple input heads.
%BURADA TANIMA İLİŞKİN BİR CÜMLE EKLEDİM, OKEYSE TAMAM!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
We will be using the notation
% !!!!!!!YILDIZSIZ!!!!!!!!!! Utkan: Yaptim
\IPhigh{\restrictionformat{resource}_1, \restrictionformat{resource}_2, \dotsc, \restrictionformat{resource}_k} to denote the class of languages that can be verified with error $\verr$ (for some $\verr < \sfrac{1}{2}$) %\utkanrem{with arbitrarily small (but possibly positive) errors}
by machines that operate within the resource bounds indicated in the parentheses. These may represent budgets for runtime, work tape (space) usage, and number of public and private random bits, given as a function of the length of the input string, in asymptotic terms. We reserve the symbol $n$ to denote the length of the input string. The terms %\ze,
\co, \lo, \li, and \po{} will be used to represent the well\-/known types of functions to be considered as resource bounds, with ``\co'' standing for constant functions of the input length, the others being self evident, to form arguments like ``\po\pri\ran''
% !!!!BUNUN YERİNE poly-private-coins YAZALIM!!!!! Utkan: yazdim
or ``\co\spa''.\footnote{Constant\-/space verifiers which do not use their work tape at all are also called \emph{finite\-/state verifiers}. (A Turing machine that is restricted to scan \OH{1}
% !!!!GÜZEL NOTASYON!! Utkan: Yaptim
work tape cells can be simulated by a finite\-/state machine.) Stand\-/alone finite\-/state verifiers (that do not ``listen'' to what the prover says) are called \emph{probabilistic finite automata}.} The symbol $\infty$ will be used to indicate that no upper bound limits the usage of a resource under consideration, as in ``$\infty\tim$''. The absence of a specification for a given type of resource (\eg, private coins) %\utkanrem{for the runtime and working memory usage}
shall indicate that that type of resource is simply unavailable to the verifiers of that class.%\footnote{\utkanrem{Verifiers that use only some private coins and no public coins can be described in the framework given above by simply specifying their transition functions to be insensitive to the value of the public random bit argument, \ie, $\delta(q,\sigma,\phi,\gamma,\bpri,0) = \delta(q,\sigma,\phi,\gamma,\bpri,1)$ and $\delta(q,\sigma,\phi,\gamma,0) = \delta(q,\sigma,\phi,\gamma,1)$ for all values of $q,\sigma,\phi,\gamma$, and $\bpri$.}}
%\utkanrem{is unbounded in terms of those resources, whilst the same for the private and public random bits should indicate that there are no such random bits at the verifier's disposal. The symbol $\infty$ will be used to indicate that a verifier is unbounded in its private or public random bit usage, \eg, $\infty\pub\ran$.}
By default, a given resource budget should be understood as a worst\-/case bound, indicating that it is impossible for the verifier to exceed those bounds.
To indicate bounds in terms of statistical expectations, we will add the ``\rexlabel'' denotation as a subscript, such as ``\po\rex\tim'' to indicate polynomial expected runtime.
%Note that such a statistical bound implies that the probability of the resource being used in higher amounts approaches to zero, since the expected usage analyis would be diverging otherwise.
% Importantly, some of the bounds we consider will be ``probabilistic'' in the sense that the verifiers in question will be guaranteed to operate within that bound with some (high) probability that may be less than 1. BU LAFA DİKKAT; BUNU ORADA DA IP()NOTASYONUNU KULLANDIĞIMIZDA HATIRLATMALIYIZ!!!!!!!!!!!!!!!
Some of the interactive protocols to be discussed
%\utkanadd{of our interest}
have the property that the verifier has some small probability of being fooled to run forever by a malicious prover trying to prevent it from rejecting the input. The designer of such protocols can set a parameter $\verrloop$, representing an upper bound to this probability, to any desired small positive value. The denotation ``\pexlabel'' will be used, this time as a superscript, to mark that the indicated amount corresponds to such a machine's expected consumption of a specific resource with the remaining (high) probability that is at least $1-\verrloop$ for any input string. For instance, ``\po\pex\tim'' will indicate that the verifier's expected runtime is polynomially bounded with probability almost, but possibly not exactly, $1$.
%To confer an unbounded amount of a resource to the verifier while we still expect it to use only a limited amount of it most of the time (statistically, with some constant probability less than 1 that can be set arbitrarily high), we will qualify the bound with the ``\pexlabel'' sign.
Some verifier algorithms we describe in this article will have ``dials'' that allow one to tune them to set their error bounds to any desired (positive) constant. Such verifiers will be qualified as verifying their language with \emph{(arbitrarily) low error}. %, or simply, \emph{low error}. %Contrarily, some other verifier algorithms to be considered do not support such control and have error bounds that cannot be improved beyond a limit. %Those will be named \emph{high error} verifiers.
To denote classes of languages that are verifiable with arbitrarily low error,
%instead of low,
we will be using the $\IP{\ldots}$ denotation instead of $\IPhigh{\ldots}$.
%\footnote{Note that the ``expected'' runtimes appearing in our IP complexity class notation defined in \Cref{sec:prel} are supposed to be interpreted as follows: The probability of the associated verifiers committing the ``error'' of being tricked by a malicious prover to run forever rather than rejecting some input strings can be reduced below any desired positive threshold $\varepsilon$. The verifier's runtime can thus be infinite with probability at most $\varepsilon$. With the remaining (large) probability $1-\varepsilon$, its expected runtime is bounded as indicated. If one lifts the restriction that $\varepsilon$ can be pushed to be arbitrarily low, and only requires it to be below $\frac{1}{2}$, these machines can verify all languages in \NL{}~\cite{SY14}. }
% BUNA GEREK YOK!!!!!!!!!!!!!!!!!
% The ``one\-/way'' mode, where the input head is not allowed to move left, will be indicated by the parameter ``\ow\inp'', whereas the further restriction to real\-/time movement, where the head is not allowed to pause at any step during its left\-/to\-/right scan, will be indicated by ``\rt\inp''.
We will also be considering verifiers with one\-/sided error: A verifier $V$ for language $L$ is said to have \emph{perfect completeness} if there exists a prover whose interaction with $V$ leads it to accept any string in $L$ with probability $1$, and no prover can convince $L$ to accept a string that is not in $L$ with probability $1$.
In one of our proofs in \Cref{sec:results},
we will be considering finite\-/state verifiers with multiple input tape heads that the machine can move independently of one another. This type of verifier can be modeled easily by modifying the tuples in the transition function definitions above to accommodate more scanned input symbols and input head directions. %\utkanadd{, and removing the parts involving the work tape}. !!!!HAYIR, BUNLARIN WORK TAPE'İ VAR AMA KULLANMIYOR DEMİŞİZ ALG2'DE!!!!!
% \Cref{subs:nfaks,sec:hartmanis}
\Cref{subs:nfaks}
provides more information on finite automata with multiple input heads and their relationships with the standard Turing machine model.
\subsection{Multihead finite automata and log-space machines}\label{subs:nfaks}
%\begin{definition}\label{def:tnfak}
A \emph{$k$\=/head nondeterministic finite automaton} (\tnfak{k}) is a nondeterministic finite\-/state machine with $k$ read\-/only heads that move on an input string flanked by two end\-/marker symbols. Each head can be made to stay put or move to an adjacent tape cell in each computational step. Formally, a \tnfak{k} is a 4\=/tuple $(Q,\Sigma,\delta,q_0)$, where
\begin{enumerate}
\item $Q$ is the finite set of internal states, which includes the two halting states $\qacc$ and $\qrej$,
\item $\Sigma$ is the finite input alphabet,
\item $\delta \colon Q \times \Sigma_{\bowtie}^k \to \P{Q \times \Delta^k}$ is the transition function describing the sets of alternative moves the machine may perform at each execution step, where each move is associated with a state to enter and a movement direction for each head, given the machine's current state and the list of symbols that are currently being scanned by the $k$ input heads, and $\Sigma_{\bowtie}$ and $\Delta$ are as defined previously in \Cref{subs:vers}, and%:
% \begin{itemize}
% \item $\Delta = \Set{-1, 0, +1}$ is the set of possible head movements, where $-1$ means ``move left'' $0$ means ``stay put'' and $+1$ means ``move right'',
% \item $\Sigma_{\bowtie} = \Sigma \cup \Set{\lend, \rend}$, where $\lend, \rend \notin \Sigma$ are respectively the left and right end\-/markers, placed automatically to mark the boundaries of the input,
% \end{itemize}
\item $q_0 \in Q$ is the initial state.
% \item $\qacc \in Q$ is the final state at which the machine halts and accepts, and
% \item $\qrej \in Q$ is the final state at which the machine halts and rejects.
\end{enumerate}
Given an input string $w \in \Sigma^*$, a \tnfak{k} $M = \paren*{Q, \Sigma, \delta, q_0}$ begins execution from the state $q_0$, with $\lend w \rend$ written on its tape, and all $k$ of its heads on the left end\-/marker.
%BUNLARI HEP FIRST SEMBOL OF w'DEN LEFT ENDMARKERA ÇEVİRDİM!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
At each step, $M$ nondeterministically updates its state and head positions according to the choices dictated by its transition function. Computation halts if one of the states \qacc{} or \qrej{} has been reached, or a head has moved beyond either end\-/marker.
%Each different sequence of choices $M$ may take corresponds to a different \emph{computation history}, \ie, a sequence of tuples describing all the state and head positions that $M$ goes through in that particular eventuality.
%and moves its \ith{i} head to $d_i$, where $\paren*{s, d_1, \dotsc, d_k}$ is one of the possibly many options in $\delta\paren*{q, x_1, \dotsc, x_k}$, where $q$ is the current state of $M$ and each $x_i$ is the symbol currently under the \ith{i} head.
$M$ is said to \emph{accept} $w$ if there exists a sequence of nondeterministic choices where it reaches the state \qacc{}, given $w$ as the input. $M$ is said to \emph{reject} $w$ if every sequence of choices either reaches \qrej{}, ends with a transition whose associated set of choices is $\emptyset$, or by a head moving beyond an end\-/marker without a halting state being entered. $M$ might also loop on the input $w$, neither accepting nor rejecting it.
The \emph{language recognized by $M$} is the set of strings that it accepts.
%
% BİRKAÇ SATIR TASARRUF İÇİN KAFA SAYISINI UMURSAMAYAN LINEAR-TIMELI CLASS DOĞRUDAN DA TANIMLANABİLİR!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! \utkanadd{BIR KISALTMA YAPTIM}
Let \TNFAS{} denote the set of languages that have a \tnfak{k} recognizer (for some $k > 0$), and \TNFASL{} denote the set of languages that have a \tnfak{k} recognizer running in linear time, regardless of the nondeterministic choices it makes.
% \begin{align*}
% \TNFAS &= \textstyle\bigcup_{k > 0} \TNFAK{k},\\
% \shortintertext{and}
% \TNFASL &= \textstyle\bigcup_{k > 0} \TNFAKL{k}.
% \end{align*}
% , we mean to let $M$ execute by $\delta$ starting from $q_0$ and with $\lend w \rend$ written on its input tape. A string $w$ is said to be \emph{accepted} or \emph{rejected} by $M$ if $M$ running on $w$ eventually halts at \qacc{} or \qrej{}, respectively. The language recognized by $M$ is the set of all strings in $\Sigma^*$ that are accepted by $M$.
%
% When we say that we \emph{run} a \tnfak{k} $M = \paren{Q, \Sigma, \delta, q_0, \qacc, \qrej}$ on $w$, we mean to let $M$ execute by $\delta$ starting from $q_0$ and with $\lend w \rend$ written on its input tape. A string $w$ is said to be \emph{accepted} or \emph{rejected} by $M$ if $M$ running on $w$ eventually halts at \qacc{} or \qrej{}, respectively. The language recognized by $M$ is the set of all strings in $\Sigma^*$ that are accepted by $M$.
%\end{definition}
%\paragraph{\utkanadd{In relation to finite\-/state verifiers.}} Our main result will be making use of a technique introduced by Say and Yakary\i{}lmaz~\cite{SY14} for ``simulating'' a multihead nondeterministic automaton in an interactive proof system whose verifier is a (single\-/head) probabilistic finite automaton. This method's application to the problem studied in this paper will be explained in detail in the proof of \Cref{lem:dir1} in \Cref{sec:results}.
% BURADAN SONRASINA GEREK YOK?????????????
% A \emph{one\-/way $k$\=/head deterministic finite automaton}, denoted \tdfak{k}, is a \tnfak{k} $(Q, \Sigma, \delta, q_0, \qacc, \qrej)$ whose transition function presents exactly one ``choice'' of move for every input ($\abs{\delta\paren*{q, x_1, \dotsc, x_k}} = 1$ for all $q \in Q$ and $x_1, \dotsc, x_k \in \Sigma_{\bowtie}$).
% %With that restriction in mind, $\delta$ is sometimes treated as a function to $Q \times \Delta^k$ instead of $\P{Q \times \Delta^k}$, mapping to the sole member of the set of possible actions, for simplicity.
% %The one\-/way counterparts of the \tnfak{k} and \tdfak{k} are denoted \tnfak{k} and \tdfak{k}, respectively, and defined the same but with $\Delta = \Set{0, +1}$. Consequently, they are unable to move their heads to the left.
% \tnfak{1} and \tdfak{1} are simply called \emph{one\-/way nondeterministic} and \emph{deterministic finite automata}%
% %(without a mention of ``$1$\=/head'')
% % and denoted as \onfa{} and \odfa{}
% , respectively. %Their one\-/way counterparts called and denoted in a similar fashion.
% The ``real\-/time'' versions of these single\-/head machines are obtained by forcing the head to move to the right at each step (by setting $\Delta = \Set{+1}$). Real\-/time nondeterministic and deterministic finite automata
% %(denoted \rtnfa{} and \rtdfa{}, respectively)
% have runtimes of at most $n+2$ on input strings of length $n$.
% %\footnote{A real\-/time machine clearly cannot benefit from having more heads.}
% %are denoted respectively denoted which have and therefore move their heads to the right non\-/stop at every step.
% %With this restriction in mind, and again for simplicity, the head movement specifications from the outputs of the transition function are dropped.
% The classes of languages recognized by each of the machine models defined above will be denoted by the uppercase versions of the associated machine denotations. For example, \TNFAK{6} denotes the class of languages recognizable by \tnfak{6}'s.
% The following facts~\cite{HKM11} about these language classes will be useful:
% For any $k\geq 1$,
% \begin{align*}
% \TDFAK{k} &\subsetneq \TDFAK{k+1}.\\
% \TNFAK{k} &\subsetneq \TNFAK{k+1}.
% \end{align*}
% \nonpal{} is the language which contains every string except palindromes on the alphabet $\Set{0,1}$. This language can be recognized by a \onfak{2}. Since its complement cannot be recognized by any \tdfak{k} for any $k$~\cite{KMW16}, there exists no deterministic one\-/way multihead automaton that recognizes \nonpal{} either, by the fact~\cite{R66} that the class of languages recognized by \tdfak{k}'s is closed under complementation. This proves the inequality
% $\TNFAK{2} \setminus \bigcup_k \TDFAK{k} \neq \emptyset$.
% % A multi\-/head one\-/way deterministic finite automaton, denoted \tdfak{k} where $k$ is the number of heads, is similar to \odfa{}, but has $k$ input heads instead of just one. Its transition function is defined accordingly to accommodate for $k$ input symbols on the input side and $k$ head movement indicators on the output side.
% \subsection{Multihead finite automata and logarithmic space Turing machines}\label{sec:hartmanis}
%\paragraph{\utkanadd{In relation to logarithmic space Turing machines.}}
Our characterization of \PP{} (\Cref{sec:results}) makes use of the equivalence of multiple input heads and logarithmic amounts of memory, discovered by Hartmanis~\cite{H72}.
%an interesting relationship~\cite{H72} between multihead finite automata and logarithmic\-/space Turing machines, which will be detailed in % \Cref{sec:hartmanis}. In this subsection,
%\Cref{thm:hartmanisextended}. We first provide the necessary definitions and establish the link between these machines and probabilistic finite\-/state verifiers.
The following theorem, whose proof is given in \Cref{sec:hartmanisextendedproof}, reiterates one direction of that result in detail, and will be useful for our purposes.%and also contains an analysis for the overhead in time incurred during the simulation.
\begin{restatable}{theorem}{hartmanisextended}\label{thm:hartmanisextended}
Any language recognized by a Turing machine that
% \utkanrem{, for inputs of length $n \ge 2$,}
uses at most
% \utkanrem{$\ceil*{\log n}$} \utkanrem{$\floor*{\log n}$}
$\floor*{\log(n+2)}$ space with a work tape alphabet of size at most $2^c$ (for some integer constant $c > 0$) and within $t(n)$ time can also be recognized by a $\paren*{c+5}$\=/head finite automaton within
% \utkanrem{$t(n) \cdot \paren*{(2c+3)n + c + 1}$}
$t(n) \cdot \paren*{\paren*{2c + \sfrac{3}{2}}n + 2c + 2}$
time.
\end{restatable}
%\utkanadd{The proof is given in \Cref{sec:hartmanisextendedproof}. BUNU KALDIRMISSINIZ SANIRIM AMA YANLISLIKLADIR DIYE TAHMIN ETTIM}
\newcommand{\head}{\ensuremath{h}}
% !!!!BU PROOF IDEALARI PROOFLARIN KOYULAMADIĞI VERSİYON İÇİN YAZMIŞTIN. BU DA "HERKESİN BİLDİĞİ" BİR ŞEY OLDUĞUNDAN BENCE SİLİP PROOF IN APPENDIX DEMEK YETERLİ. AYNI ŞEY LEMMA 3 İÇİN DE GEÇERLİ. EH ÖYLE YAPINCA DA BU SUBSECTİONLAR ÇOK KISA KALDIĞINDAN 2.2, 2.3 ve 2.4 NUMARALI SUBSECTIONLAR 2.3'ün BAŞLIĞI ALTINDA MERGE EDİLSİN, ŞIK OLSUN!!!!! Utkan: Şık yapmayı beceremeyebilirim ama proof idea'ları kaldırma ve merge etme kısmını yaptım :D
% \paragraph{Proof idea.}
% \begin{proof}[Proof idea.]\let\qed\relax
% Assume, for the sake of simplicity, that $n$ is a power of $2$. A string over the alphabet $\Set{0, 1}$ in a work tape of length $\log n$ can be seen as the digits of a number between $0$ and $n - 1$, inclusive, represented in binary. The index of a head on the input tape can similarly range between $0$ (when on \lend{}) and $n+1$ (when on \rend{}). This correspondence enables a multihead finite automaton to store the same information there is on a $\log n$ symbol string over an alphabet of size $2^c$ (which can be viewed as the binary digits of $c$ numbers stacked on top of each other), encoded at the indices of $c$ input heads.
% There is a way for a multihead finite automaton to retrieve a single binary digit of a head's index and also to change it. Four spare input heads are introduced and used to accomplish these functions, with one of them mimicking the position of the simulated work tape head, and the other three helping with the index manipulations for decoding, changing, and then re\-/encoding. One last input head is the input head of the multihead finite automaton.
% Using this method, a multihead finite automaton can simulate a $\ceil{\log n}$\=/space Turing machine directly.
% \end{proof}
%% W/O/APPENDIX VERSION
% The detailed proof can be found in~\cite[Appendix~A.1]{GS23a}.
%% W/APPENDIX VERSION
\newcommand{\errprematuretimeout}{\ensuremath{\err_{\mathrm{premature}}}}
\subsection{Probabilistic clocks}\label{sec:clock}
A logarithmic\-/space Turing machine can time its own execution to satisfy any desired polynomial bound by counting up to that bound in the logarithmic space available. The constant\-/space machines we construct in \Cref{sec:results} will employ a different technique using randomness, which is illustrated in the following lemma, to obtain the same bound on expected runtime.
\begin{restatable}{lemma}{polyclock}\label{lem:polyclock}
For any integer %constant
$t > 0$, integer\-/valued function $f(n) \in \OH{n^t}$, and desired ``error'' bound $\errprematuretimeout > 0$, there exists a probabilistic finite automaton with expected runtime in \OH{n^{t+1}}, such that the probability that this machine halts in fewer than $f(n)$ time\-/steps is \errprematuretimeout.
\end{restatable}
% \paragraph{Proof idea.}
% \begin{proof}[Proof idea.]\let\qed\relax
% Assume, for the sake of simplicity, that $t$ is an integer. We program a probabilistic finite\-/state automaton to make $t$ random walks with its input head, each starting from the first symbol on the input and ending at either one of the end\-/markers. If all the walks have ended on the right end\-/marker, the machine halts. Otherwise, the process is repeated. The analysis shows that such a machine has all the necessary characteristics in its runtime.
% \end{proof}
%% W/O/APPENDIX VERSION
% The detailed proof can be found in~\cite[Appendix~A.2]{GS23a}.
%% W/APPENDIX VERSION
The proof of \Cref{lem:polyclock}, based on the idea~\cite{DS92,AW02} of the machine performing a sequence of random walks with its head on the input tape, is given in \Cref{sec:polyclockproof}.
In the proof of \Cref{lem:dir2NEW} in \Cref{sec:results}, we describe a probabilistic log\-/space machine that uses a timer which is expected to run out after at least $2^{2^{p(n)}}$ ``ticks'', where $p$ is some polynomial, and $n$ is the length of the machine's input string. We describe the main idea, which was inspired by a similar construction in~\cite{C93b}, below; a detailed analysis can be found in \Cref{sec:dir2appendices}.
It will be helpful to imagine that we have fair coins of two colors, say, red and blue. The timer mechanism consists of a subroutine that embodies a single tick, and a global Boolean variable that tracks whether all the red coins flipped since the last reset of this variable came out heads. %\utkanadd{UTKAN: ya da alternatif olarak ``all \utkanrem{the} red coins flipped since the last reset of this variable \utkanadd[65]{have come} out heads''; ilk alternatifte ``since'' nitelemesi red coins'e baglaniyor, ikinci alternatifte fiile baglaniyor}.
Each call of this subroutine, which is named \TICK{}, %\utkanadd{UTKAN: Bu hep düz-yazı TICK mi kalacak yoksa şimdi veya ileride bold/sans-serif/vs.\ bir şey yapmayı düşünür müyüz? Bir de bu subroutine aslında $T$ adında bir read-write variable'a ihtiyaç duyuyor, onu indicate edecek bir şey yapmamız mümkün mü? TICK(T) yazsak çok iyi olmayacak, çünkü normalde (yaygın programalma dillerinde) böyle çağrılan fonksiyonlar parametre olarak aldığı T'yi değiştiremiyor, değiştirilebilir olarak iletmek için özel şeyler yapmak gerekiyor.}!!!!FONT İŞİ BENCE GEREKSİZ AMA KOLAY BİR MODİFİKASYON YAPMAK İSTERSEN OK. \utkanadd{Makroya aldım, eskisi ok'di, yine de şimdi bi sans-serif yapmayı denedim, istediğiniz gibi değiştirebiliriz.} % T'DEN DE BURADA HİÇ BAHSETMEYELİM; GENELDE BU GİBİ DİREKT HAKEM RAPORUNDA OLMAYAN ŞEYLERİ DEĞİŞTİRMEME PRENSİBİNDEN ŞAŞMAYALIM!!!!!!!! \utkanadd{Hakemlere giden halinde "TICK" ismi hiç yoktu, şu an yeni var ettiğimiz TICK konusunda baştan sona hakem raporunun dışında bir iş yapmaktayız. Yani demek istediğim, (T)'li hali de (T)'siz hali de "hakem raporunda olmayan şeyleri değiştirmeme prensibinden" şaşıyor, biri diğerinden daha az şaşmıyor.}
flips one red coin and $p(n)$ blue coins. If one or more blue coins come out tails, the subroutine call ends with the timer still running. If all the blue coin outcomes are heads, but the Boolean variable indicates that one or more red coins flipped since the last reset came out tails, the variable is reset, and the subroutine ends with the timer still running. If all the blue coin outcomes are heads, \emph{and} if all the red coins flipped since the last reset also came out heads, the timer runs out.
The expected number of ticks is at least double exponential in $p(n)$, %\utkanadd{UTKAN: bunu soyleyebilecegimizi sanmiyorum. benim tespit edebildigim kadariyla ``at least'' demeliyiz.}
since the timer runs out when an all\-/heads sequence of red coins is observed, and the expected length of this critical sequence is exponential in $p(n)$.
% \utkanadd{
\subsection{Alternating finite automata}\label{subs:afas}
A \emph{two\-/way alternating finite automaton} (\tafa{}) is a 4\=/tuple $(Q,\Sigma,\delta,q_0)$, %\hl{$q_0$'i buraya koyup da $\Qpub$, $\Qex$, $\qacc$ gibi $Q$'nun diger parcalarini koymamamiz garip olmamis mi?}
where
\begin{enumerate}
\item $Q$, the finite set of states, is the union of the following disjoint subsets:
\begin{itemize}
\item $\Qex$ is the set existential states,
\item $\Qun$ is the set of universal states,
\item $\Set{\qacc, \qrej}$ are the accept and reject states, respectively,
\end{itemize}
\item $\Sigma$ is the finite input alphabet,
\item $\delta \colon Q \times \Sigma_{\bowtie} \to \P{Q \times \Delta}$, which is identical in format to the corresponding item in the definition of a \tnfak{1} (\Cref{subs:nfaks}), is the transition function describing the sets of alternative moves that the machine may perform at each execution step,
%where each move is associated with a state to enter and \hl{how} % UTKAN: changed from "whether", is it formally appropriate?
%or not to move the head, given the machine's current state and the symbol that is currently being scanned by the input head, and $\Sigma_{\bowtie}$ and $\Delta$ are as defined previously in \Cref{subs:vers,subs:nfaks},
and%:
% \begin{itemize}
% \item $\Delta = \Set{-1, 0, +1}$ is the set of possible head movements, where $-1$ means ``move left'' $0$ means ``stay put'' and $+1$ means ``move right'',
% \item $\Sigma_{\bowtie} = \Sigma \cup \Set{\lend, \rend}$, where $\lend, \rend \notin \Sigma$ are respectively the left and right end\-/markers, placed automatically to mark the boundaries of the input,
% \end{itemize}
\item $q_0 \in Q$ is the initial state.
% \item $\qacc \in Q$ is the final state at which the machine halts and accepts, and
% \item $\qrej \in Q$ is the final state at which the machine halts and rejects.
\end{enumerate}
%is a nondeterministic finite\-/state machine with a single read\-/only head that moves on an input string flanked by two end\-/marker symbols. Each head can be made to stay put or move to an adjacent tape cell in each computational step. Formally, a \tnfak{k}
As a computational model, the \tafa{} is a generalization the \tnfak{1}. A \tnfak{1} is simply a \tafa{} whose set of universal states is empty, as will be evident from the definition (adapted from~\cite{DSY15}) of string acceptance by \tafa{}'s to be presented below.
%Given an input string $w \in \Sigma^*$, a \tafa{} $M = \paren*{Q, \Sigma, \delta, q_0}$ begins execution from the state $q_0$, with $\lend w \rend$ written on its tape, and its head on the left end\-/marker. At each step, $M$ nondeterministically updates its state and head positions according to the choices dictated by its transition function. Computation halts if one of the states \qacc{} or \qrej{} has been reached, or a head has moved beyond either end\-/marker.
%Each different sequence of choices $M$ may take corresponds to a different \emph{computation history}, \ie, a sequence of tuples describing all the state and head positions that $M$ goes through in that particular eventuality.
%and moves its \ith{i} head to $d_i$, where $\paren*{s, d_1, \dotsc, d_k}$ is one of the possibly many options in $\delta\paren*{q, x_1, \dotsc, x_k}$, where $q$ is the current state of $M$ and each $x_i$ is the symbol currently under the \ith{i} head.
%ALTERNATIVE 1:
%$M$ is said to \emph{accept} $w$ if there exists a \emph{tree} of nondeterministic choices where every existential (resp.\ universal) node branches to one (resp.\ all) of the choices available at those moments of computation corresponding to those nodes, and every chain from the root to a leaf reaches the state \qacc{}, given $w$ as the input.
%$M$ is said to \emph{reject} $w$ if there exists a \emph{tree} of nondeterministic choices where every existential (resp.\ universal) node branches to \emph{all} (resp.\ \emph{one}) of the choices available at those moments of computation corresponding to those nodes, and every chain from the root to a leaf reaches a configuration where the state is \qrej{} or the input head has moved beyond an end\-/marker without a final state being entered, given $w$ as the input.
%$M$ is said to loop on the input $w$, if it neither accepts nor rejects it.
%END OF ALTERNATIVE 1
%ALTERNATIVE 2:
%$M$ is said to \emph{accept} $w$ if, recursively, for each universal nondeterministic choice there exists an existential nondeterministic choice leading $M$ to the state \qacc{}, given $w$ as the input.
%$M$ is said to \emph{reject} $w$ if, recursively, for each existential nondeterministic choice there exists a universal nondeterministic choice leading $M$ either to the state \qrej{} or to move its head beyond an end\-/marker, given $w$ as the input.
%$M$ is said to loop on the input $w$, if it neither accepts nor rejects it.
%END OF ALTERNATIVE 2
%ALTERNATIVE 3:
\newcommand\suc[1]{\ensuremath{\vdash_{#1}}}
The \emph{configuration} of a \tafa{} $M = \paren*{Q, \Sigma, \delta, q_0}$ at any given time is the pair composed of $M$'s state and its input tape head position. In its initial configuration, %\utkanadd[80]{UTKAN: Burada herhalde bir typo var. Bir de böyle yazınca $\alpha_0$'yı $q_0$ gibi özel bir notasyon olarak tanıtıyormuşuz gibi olmuş. Bence burada $\alpha_0$ hiç demeyelim ve aşağıda $\alpha_0$ kullandığımız tek yerde de yerine $(q_0, \lend)$ yazalım.}
$M$ is in state $q_0$, with the head positioned on the left end\-/marker. A configuration $(q,i)$ %\utkanadd[80]{UTKAN: $p$ yerine $i$ kullanmayı düşünebiliriz.}
is said to be \emph{accepting} (resp.\ \emph{rejecting}) if $q$ is \qacc{} (resp.\ \qrej{}). A configuration is said to be \emph{universal} (resp.\ \emph{existential}) if its state is universal (resp.\ existential). % !!!!ŞİMDİ OK MİYİZ??!!! UTKAN: Ok'iz hocam, teşekkürler %Otherwise, it is said to be . %\utkanadd[80]{UTKAN: Yukarıdaki tanıma göre bu doğru değil. $\qacc$ ve $\qrej$ universal da existential da değil.}!!!İŞTE O YÜZDEN DE O KONFİGÜRASYONLAR EXISTENTIAL!!!!!
Given an input string $w$, a configuration $\beta$ is said to be a \emph{successor} of a configuration $\alpha$ of $M$, denoted $\alpha \suc{M, w} \beta$,
% (or simply $\alpha \suc[] \beta$)
if $\beta$ can follow $\alpha$ immediately according to $\delta$. Note that a configuration may have multiple successors, or none at all.%!!!!!!SON CÜMLEYİ NEDEN SİLMİYORUZ????!!! \utkanadd[80]{UTKAN: "Successor" kelimesi bence tekillik çağrıştırıyor. Yani mesela bugüne kadar yazılmış tüm metinlerdeki "successor" kelimelerine baksak, bana öyle geliyor ki kayda değer bir çoğunluğu tekil bir şeyden bahsediyordur. Şimdi ChatGPT'ye de sordum, o da öyle düşünüyor: \url{https://chatgpt.com/share/6799662e-5d8c-8007-ac48-f40ee0a08049} Bu doğal çağrışımdan arındırmak adına o açıklamayı yapmalıyız diye düşündüm. "Successor" yerine "child" da diyebiliriz, o zaman böyle bir çağrışım en baştan hiç oluşmamış olur.}
\newcommand\conflabelf[1]{\ensuremath{l_{#1}}}
$M$ is defined to \emph{accept} %(resp.\ \emph{reject})
$w$ if and only if % \utkanadd[80]{UTKAN: Burada "and only if" diyerek sadece "aksi takdirde accept etmemiştir" demiş oluyoruz, "aksi takdirde reject etmiştir" gibi bir şey demiyoruz, değil mi? 2nfa(k) tanımımızda benzer yerlere "and only if" yazmamışız hiç.} !!!! EVET, TEK DERDİMİZ ACCEPT'İ TANIMLAMAK. BURADA SORUN YOKSA MAVİLİKTEN KURTAR PLZ!!!!!!!!!!! Tamamdır
$\conflabelf{M,w}\paren*{\paren*{q_0, 0}}$ equals \True{},
%(resp.\ \False{}),
where the function $\conflabelf{M,w}$
% (or simply $\conflabelf[]$)
is defined recursively as follows:
% !!!!!!!!!BU or simply'lere NE GEREK VAR??!??!?!! \utkanadd[80]{UTKAN: Simple halleri sayesinde $\conflabelf[M,w]$ tanımını aşağıdaki gibi yazabiliyoruz, daha sade oluyor. "Simple hallerine ne gerek var" değil de "simple \textbf{olmayan} hallerine ne gerek var" mı demek istediniz? Simple halleri matematiksel olarak ill-defined. Doğruluk değeri context'e (tam olarak $M$'ye ve $w$'ya) bağlı. Yani mesela aynı $\alpha$ ve $\beta$ için input string $w$ iken $\alpha \suc[] \beta$ doğru, input string $w'$ iken aynı ifade yanlış olabilir. Çünkü mesela $(q_{123}, 2) \suc[] (q_{234}, 3)$ ifadesi "\texttt{>u\uline{t}kan<}" input stringi için doğru, "\texttt{>g\uline{e}zer<}" stringi için yanlış olabilir (mesela makine $q_{123}$ state'indeyken \texttt{t} okuyunca $q_{234}$ state'ine girip kafasını sağa oynatıyordur ama \texttt{e} okuyunca başka bir state'e girip sola gidiyordur). Benzer şekilde söz konusu makine değişince de sağdaki tuple soldaki tuple'ı succeed ederken/etmezken etmez/eder hale gelebilir.}!!!!!!!SIMPLE'LARI BOŞVERİP KARIŞIK HALİYLE YAZALIM; İKİ DEFACIK ZATEN!!!!!!
%\utkanremlong[]{
%\begin{equation*}
% \conflabelf{M,w}(\alpha) = \begin{cases}
% \True, & \text{if $\alpha$ is accepting},\\
% \False, & \text{if $\alpha$ is rejecting},\\
% \bigvee\limits_{\alpha \suc{M,w} \beta} \conflabelf{M,w}(\beta), & \text{if $\alpha$ is existential},\\
% \bigwedge\limits_{\alpha \suc{M,w} \beta} \conflabelf{M,w}(\beta), & \text{if $\alpha$ is universal}.
% \end{cases}
%\end{equation*}
%}
%\utkanadd{
\begin{equation*}
\conflabelf{M,w}(\alpha) = \begin{cases}
\True, & \text{if $\alpha$ is accepting},\\
\False, & \text{if $\alpha$ is rejecting},\\
\displaystyle\smashoperator[r]{\bigvee_{\alpha \suc{M,w} \beta}} \conflabelf{M,w}(\beta), & \text{if $\alpha$ is existential},\\
\displaystyle\smashoperator[r]{\bigwedge_{\alpha \suc{M,w} \beta}} \conflabelf{M,w}(\beta), & \text{if $\alpha$ is universal}.
\end{cases}
\end{equation*}
%}
%\utkanadd{
%\begin{equation*}
% \conflabelf{M,w}(\alpha) = \begin{cases}
% \vphantom{\displaystyle\smashoperator[r]{\bigvee_{\alpha \suc{M,w} \beta}}} \True, & \text{if $\alpha$ is accepting},\\
% \vphantom{\displaystyle\smashoperator[r]{\bigvee_{\alpha \suc{M,w} \beta}}} \False, & \text{if $\alpha$ is rejecting},\\
% \displaystyle\smashoperator[r]{\bigvee_{\alpha \suc{M,w} \beta}} \conflabelf{M,w}(\beta), & \text{if $\alpha$ is existential},\\
% \displaystyle\smashoperator[r]{\bigwedge_{\alpha \suc{M,w} \beta}} \conflabelf{M,w}(\beta), & \text{if $\alpha$ is universal}.
% \end{cases}
%\end{equation*}
%}
%$M$ is said to loop on the input $w$, if it neither accepts nor rejects it.
%END OF ALTERNATIVE 3
The \emph{language recognized by $M$} is the set of input strings that it accepts.
%
%We recall the following facts about two\-/way alternating finite automata~\cite{LLS78}: Each non\-/halting state in such an automaton is either \emph{existential} or \emph{universal}.
A good way to understand the relationship of a \tafa{} with the strings it accepts is to visualize a ``prover'' (whose aim is to make the machine accept the input) as dictating which move to make when the transition function allows multiple outgoing choices from a configuration with an existential state, and a ``refuter'' (with the opposite aim) as similarly dictating moves from configurations with universal states. The input string $w$ is accepted by the machine if and only if the prover has a winning strategy, whereby it can lead the machine from the initial configuration associated with $w$ to an accepting configuration, no matter what moves are made by the refuter, in this perfect information game. %We say that the machine \emph{recognizes} the set of strings that it accepts.
% BİRKAÇ SATIR TASARRUF İÇİN KAFA SAYISINI UMURSAMAYAN LINEAR-TIMELI CLASS DOĞRUDAN DA TANIMLANABİLİR!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! \utkanadd{BIR KISALTMA YAPTIM}
It is known~\cite{LLS78} that the class of all languages recognized by \tafa{}'s equals \REG{}, \ie, the class of regular languages.
% }
\section{Private vs.\ public coins and worst-case time bounds}\label{sec:prelresults}
In their seminal paper, Dwork and Stockmeyer~\cite{DS92} showed that finite\-/state verifiers employing only private coins are strictly more powerful than those using only public coins, even when the former machines are bounded to operate in polynomial expected time:
\begin{fact}\label{fact:DSpal}
$\IPhigh{\co\spa, \infty\pub\ran, \infty\tim} \subsetneq \IP{\co\spa, \po\rex\pri\ran, \po\rex\tim}$.
\end{fact}
% !!!!!SAĞ TARAFI YILDIZLI YAP LÜTFEN!!!! Utkan: Yaptim
%FACT BİLMEMNE: IP($\infty$-time, con-space, public-coins)
% PROPERSUBSET IP(poly-time, con-space, private-coins) (BUNU BİZİM NOTASYONA PLZ; THM NUMARASINA GEREK YOK)
A witness for the inequality in \Cref{fact:DSpal} is the
language of palindromes,
\begin{equation*}
\pal = \Set{w | w \in \Set{0, 1}^*, w = \rev{w}},
\end{equation*}
where $\rev{x}$ denotes the reverse of string $x$. The constant\-/space verifier provided for $\pal$
by Dwork and Stockmeyer uses only a constant number of private coins, irrespective of the length of the input. This inspired %(DID IT?) yes
the study~\cite{SY14,GS22,GDES23} of machines that flip a fixed number of coins, leading to the following results:
\begin{fact}\label{fact:GS22}
$\TNFASL \subseteq \IP{\co\spa, \co\pri\ran, \li\pex\tim}$~\cite{GS22}.\footnote{Recall from the definition of our IP complexity class notation in \Cref{sec:prel} that the verifier's runtime can be infinite with at most a small probability $\verrloop$, and its expected runtime is bounded as indicated with the remaining large probability.}% If one lifts the requirement that $\varepsilon$ can be pushed to be arbitrarily low, and only requires it to be below $\frac{1}{2}$, these machines can verify all languages in \NL{}~\cite{SY14}.}
\end{fact}
\begin{fact}\label{fact:SY14}
$\IPhigh{\co\spa, \co\pri\ran, \infty\tim} = \NL$~\cite{SY14}.
\end{fact}
In contrast to \Cref{fact:SY14}, we now show that the ability to use constant number of \emph{public} coin flips provides no additional language verification power over determinism to constant\-/space machines.
\begin{theorem}\label{thm:conspubliconly}
$\IPhigh{\co\spa, \co\pub\ran, \infty\tim} = \REG$. %\utkanadd{\REG{} ve \NL{} notasyonlarını hiç tanıtmamışız!}
\end{theorem}
\begin{proof}
Let $V$ be a finite\-/state machine that verifies a language $L$ with some error bound $\verr < \sfrac{1}{2}$, flipping at most $r>0$ public coins for any input. Let the prover that interacts with $V$ be named $P$. % Since all coins are public, we assume that $P$ will be able to infer $V$'s configuration at every step of their interaction and that $V$ sends no further information through the communication cell, without loss of generality.
We will construct a two\-/way alternating finite automaton $M$ that recognizes $L$. This will be enough to conclude that $L$ is regular, by the fact~\cite{LLS78} that two\-/way alternating finite automata recognize all and only the regular languages.
The construction is based on the following idea:
Consider the set of all possible bit sequences of length $r$. Each execution of $V$ would use (a prefix of) one of these sequences as its public coin outcomes during its interaction with the prover.
Any input string $w$ is in $L$ if and only if a majority of the members of this set of sequences leads $V$ to acceptance during this interaction. $M$ will be designed so that it accepts $w$ if and only if % UTKAN: This was missing.
it verifies that this condition is satisfied. Note that simply simulating $V$'s behavior sequentially, on one coin sequence after another, would not work, since this would give the simulated prover the opportunity to cheat by violating the condition that its responses to $V$ given two coin sequences with the same prefix (like $p0$ and $p1$, for some prefix $p\in \{0,1\}^*$) should be identical up to the point when the coin sequences finally differ. $M$ will use the ``parallel computation'' nature of alternation to enforce this consistency on the simulated prover.
$M$ starts with an existential state, where it guesses a prefix\-/free set $S$ of public coin sequences (of length at most $r$) whose probabilities add up to a value greater than $\sfrac{1}{2}$. (Since there are only finitely many sets of bit sequences %of length at most $r$
with this property, this choice can be made in a single step.)
%\utkanadd{UTKAN: bunu boyle yazacaksak eger, secilen sequence kumesinde hicbirinin bir digerinin prefixi olmamasini da garanti ettirmeliyiz, veya prefixler var olabilecekse de ``probability toplami'' hesabina ``kumede bir prefixi bulunan sequencelarin'' olasiliklarinin dahil edilmeyecegini yazmaliyiz. (buna ek olarak bir sonraki maviyle yazdigim kisimdaki eklemem de gerekli oluyor.) ALTERNATIF OLARAK: bence ``of length at most $r$'' yerine ``of length $r$'' (exactly $r$) yazsak her sey kolayca cozuluyor. ispatin kalanindaki mevcut anlati zaten simulasyon bitince refuterin $M$'yi takip ettirdigi sequence(lar)in artiklarinin kalmasini dert etmiyor. boyle yapinca ``probabilities add up to a value greater than \sfrac12'' yerine ``exactly $2^{r-1}+1$ tane'' de diyebiliyoruz; boyle demek constructionin bu asamasindaki gereksiz existential branchleri ($2^{r-1}+1$ elemandan fazla iceren kumeleri) eliyor ama demeyebiliriz de.}
%{a set of $2^{r-1}+1$ public coin sequences of length $r$. (Since there are finitely many such sets, $\binom{2^r}{2^{r-1}+1}$ to be exact, this choice can be made in a single step.)}
Recall that such choices of moves from existential states can be viewed as being made by a prover, which we will name $P_M$. By this first choice, $P_M$ would be claiming that all of these coin sequences would lead $V$ to acceptance in an interaction with $P$.
$M$ attempts to verify this claim: $M$'s transition function is based on that of $V$; essentially, $M$ uses alternation to create
a parallel simulation of $V$ (and its interaction with $P$) on all the coin sequences in the set $S$ obtained at the start.
At every step, $M$ keeps a record of the (simulated) coin sequence used up to that point in the present branch of its computation.
Whenever its simulation of $V$ reaches a new coin\-/flipping state, $M$ checks this record and \rejects{} if it determines that it is in a branch that would use a coin sequence that is not a member of $S$.
If only one of the outcomes of the coin to be flipped at the present state is consistent with $S$, $M$ plugs that bit into $V$ to advance the simulation.
If, on the other hand, \emph{both} of the 0 and 1 outcomes are consistent with $S$, $M$ makes a universal choice (controlled by the refuter $R_M$) to determine which bit to feed $V$.
%Each step of $V$ corresponding to a coin flip both of whose outcomes will be considered in this verification\footnote{Note that some coin flips of $V$ may \emph{not} be associated with universal branching in $M$. Such branchings occur for a coin only if \emph{both} of the 0 and 1 outcomes are included in the set of sequences guessed at the beginning.} corresponds to a universal choice (controlled by the ``refuter'' $R_M$).
%{a ``tree'' of ``parallel'' simulations of $V$ (and its interaction with $P$) corresponding to all prefixes of the coin sequences in the set obtained at the start. At each step of $V$ that corresponds to a coin flip, if the prefixes corresponding to both outcomes (\ie, $p0$ and $p1$, given $p$ as the sequence of outcomes so far) are in the obtained set, then both of them will be considered with a universal fan\-/out. Otherwise, the branch will continue with the outcome corresponding to the only prefix that exists in the obtained set, without fanning out.}
%\utkanadd{$M$ \emph{rejects} immediately if $V$'s simulation reaches a coin flipping state despite neither a $0$ or a $1$ outcome is included in the set of sequences that $P_M$ promised would lead $V$ to acceptance. BU SEQUENCE'IN KISA KACTIGI DURUMLAR ICIN. YA DA SEQUENCE KISA ISE ``bundan sonra refuter ne dese yas'' VEYA ``bundan sonra her ne random bit gelirse gelsin seni ikna edecegim'' ANLAMINA GELECEK SEKILDE BIR ONCEKI FOOTNOTE'U DEGISTIREBILIRIZ.}
Each communication symbol sent by $P$ to $V$ is obtained by an existential choice (as if $P_M$ is supplying that information). The accept state of $M$ corresponds to the accept state of $V$. %\utkanadd{(with $M$ having $\binom{2^r}{2^{r-1}+1}$ copies of them)}.
We see that $M$ recognizes $L$ by noting that any $w$ is in $L$ if and only if there exists a set of random bit sequences with total probability greater than $\sfrac{1}{2}$ such that all members of this set lead $V$ to acceptance of input $w$ after an interaction with $P$, and $M$ accepts all and only such input strings by design.
For completeness, a formal description of the \tafa{} $M$ is presented in \Cref{sec:tafaconstruction}.
\end{proof}
We will focus on the computational power of constant\-/space verifiers with a fixed private\-/coin budget when they are also allowed to use public coins. Although some of Dwork and Stockmeyer's results (\eg,~\cite[Theorem~3.12]{DS92}) involve such ``mixed\-/coin'' constructions, the asymptotic bounds on private and public coin tosses are equal in their machines. In those setups, all public coins can simply be replaced by private coins by a straightforward modification that increases the runtime of the protocol by a constant factor. The proof of the following lemma is in \Cref{sec:privatesimulatespublicproof}.
%\utkanadd{. It} %\utkanadd{\Cref{lem:privatesimulatespublic} below remarks the relationship between and how private coins are generally superior to the public ones. It
%will also be useful in one of the later proofs.
\begin{restatable}{lemma}{privatesimulatespublic}\label{lem:privatesimulatespublic}
The following is true for all % \utkanadd{complexity}!!!!!BU LAFA NE GEREK VAR?!??!!!! \utkanadd{UTKAN: Bilmem ki, fonksiyonlar çok çeşitli. Negatif değerli veya parçalı fonksiyonlar var. O tür fonksiyonlar big-O(...) içine yazılınca garip şeyler olur mu diye düşünerek yazmıştım da olmuyor bir şey sanırım.}
functions %\utkanrem{$s(n), f(n), g(n)$, and $t(n)$} \utkanadd{
$s$, $f$, $g$, and $t$:
% !!!!!!!!!!BÜTÜN IP ifadelerinde AYNI SIRADA GÖRÜNSÜNLER, BİRİNDE SPACE ÖNDE ÖBÜRÜNDE COINS ÖNDE OLMASIN!!!!!!!!! Utkan: Yaptim
\begin{multline*}
\IP{\OH{s(n)}\spa, \OH{f(n)}\pri\ran, \OH{g(n)}\pub\ran, \OH{t(n)}\tim} \subseteq\\
\IP{\OH{s(n)}\spa, \OH{f(n)+g(n)}\pri\ran, \OH{t(n)}\tim}.
\end{multline*}
This inclusion also holds for the $\IPhigh{\ldots}$ variants of the classes, and when worst\-/case time bounds are replaced with those corresponding to expected usage.% \utkanadd{on both ends of the inclusion simultaneously}. \utkanadd{The worst\-/case private and public coin bounds together may also be replaced with the corresponding expected bounds on both ends simultaneously.}
%worst\-/case or expectations. \utkanadd{and/or some bounds are given in expected terms, with or without allowing a low probability of unbounded usage}.
\end{restatable}
%\utkanadd{The proof is given in \Cref{sec:privatesimulatespublicproof}.}
\Cref{lem:privatesimulatespublic} implies that allowing the finite\-/state verifiers in the constructions of \Cref{fact:GS22,fact:SY14} to use a constant number of public coins in addition to their private\-/coin budgets would not enlarge the corresponding classes of verified languages.%: The added resource cannot make the verifiers less powerful, but also the function of any constant amount of public coins can readily be simulated by more of the existing constant private coin budget according to \Cref{lem:privatesimulatespublic}.
% \begin{theorem}
% \begin{multline*}
% \IPhigh[0.9]{\co\spa, \co\pri\ran, \co\pub\ran, \infty\tim} =\\ \IPhigh[0.9]{\co\spa, \co\pri\ran, \infty\tim}.
% \end{multline*}
% \end{theorem}
% \begin{proof}
% The following is trivially true, since the left\-/hand side has more resources:
% \begin{multline*}
% \IPhigh[0.9]{\co\spa, \co\pri\ran, \co\pub\ran, \infty\tim} \supseteq\\
% \IPhigh[0.9]{\co\spa, \co\pri\ran, \infty\tim}.
% \end{multline*}
% By \Cref{lem:privatesimulatespublic} we also have
% \begin{multline*}
% \IPhigh[0.9]{\co\spa, \OH{n}\pri\ran, \OH{n}\pub\ran, \infty\tim} \subseteq\\
% \IPhigh[0.9]{\co\spa, \paren*{\OH{n}+\OH{n}}\pri\ran, \infty\tim},
% \end{multline*}
% which is to say
% \begin{multline*}
% \IPhigh[0.9]{\co\spa, \co\pri\ran, \co\pub\ran, \infty\tim} \subseteq\\
% \IPhigh[0.9]{\co\spa, \co\pri\ran, \infty\tim}.
% \end{multline*}
% Thus, the two classes are equal to each other. By \Cref{fact:SY14}, they are also equal to \NL.
% \end{proof}
Our main result to be presented in the next section involves constant\-/space verifiers that flip a constant number of private coins and superlinear amounts of public coins. We note that expected (rather than worst\-/case) time bounds are appropriate for studying that scenario, since the imposition of any worst\-/case bound on the runtime of a finite\-/state verifier precludes it from benefiting from superlinear amounts of any kind of resource.
%Proceeding towards supplying verifiers with public coin budgets greater than a constant, one notices that a verifier must be careful about keeping its budgets so that it does not get disqualified as a verifier of the respective complexity class by exceeding it. This has the following implication for the constant\-/space, constant private randomness verifiers with any amount of public coins.
\begin{theorem}\label{thm:strictboundislinear}
For any time complexity function $t$,
%$f(n)$ and $g(n)$ such that $\OH{g(n)} \supseteq \OH{n}$,
\begin{multline*}
\IP{\co\spa, \infty\pri\ran, \infty\pub\ran, \OH{t(n)}\tim} \subseteq\\
\IP{\co\spa, \li\pri\ran, \li\pub\ran, \li\tim}.
\end{multline*}
The same is true also for the %high error
$\IPhigh{\ldots}$ variants of the two classes.
\end{theorem}
\begin{proof}
% The equality is trivial when $\OH{g(n)} = \OH{n}$. The former class being a superset of the latter is also trivial. We will show the other direction of the inclusion for when $\OH{g(n)} \supsetneq \OH{n}$ to complete the proof.
%
%Let $V$ be any verifier of the former class and $w$ be any input to it.
%There are $n+2$ different input head positions. The rest have a constant amount of variation.
The number of configurations available to a constant\-/space verifier $V$ running on an input of length $n$ is %\utkanadd{$f(n)$ for some $f(n) \in
in $\OH{n}$.
% \utkanrem{less than $k \cdot n$ for some constant $k$.} %BUNUN ESKI HALI KUCUK $n$'ler icin gecerli degildi, ``large enough $n$'' gibi bir sey demek gerekiyordu.
If $V$'s transition function allows it to enter the same configuration more than once with nonzero probability for some input string, it will do so arbitrarily many times with positive probability, exceeding any preset time bound. Therefore, all constant\-/space verifiers with a worst\-/case time bound $t(n)$ are actually limited to run within a linear bound. %run for more than %$\utkanadd{f(n) \in}
%\utkanadd{some} $\OH{n}$ steps.
The linear bounds on coin usage are established by noting that a machine that can run for at most $T$ steps is restricted to flipping at most $T$ coins of any type.
% !!!!!!!!OLMUŞ MU???!!! tesekkurler
% \utkanadd{UTKAN: \OH{n}'in bir küme olmasından kaynaklı huzursuzluklar yaşıyorum. İlkinde ``in'' sorunu kesin çözüyor, ikincisinde ``some'' çözebiliyor mu emin değilim.}
\end{proof}
\section{A new characterization of \texorpdfstring{\PP}{P}}\label{sec:results}
%Due to \Cref{thm:strictboundislinear}, any strict budget greater than linear cannot be utilized by the finite\-/state, constant private coin verifiers. We, therefore, turn our attention to statistical bounds.
Let us now examine finite\-/state verifiers employing a constant amount of private coins and an expected polynomial amount of public coins (unless they are tricked to loop forever with some arbitrarily small probability).
This setup turns out to provide a new characterization of the complexity class \PP, corresponding to the collection of languages decidable by deterministic Turing machines in polynomial time and space.
\begin{theorem}\label{thm:P}% !!!!!!!TEK SATIRDA DAHA GÜZEL OLUR?!?!?!!!!!! Utkan: Yaptim
% \begin{equation*}
% \utkanadd{The classes $\IP{\co\spa, \co\pri\ran, \po\pex\pub\ran, \po\pex\tim}$, $\IPhigh{\lo\spa, \co\pri\ran, \infty\pub\ran, \infty\tim}$, and $\PP$ are all equal.
% \begin{multline*}
% \IP{\co\spa, \co\pri\ran, \po\pex\pub\ran, \po\pex\tim} = \\
% \IPhigh{\lo\spa, \co\pri\ran, \infty\pub\ran, \infty\tim} = \PP.
%\end{multline*}
The following three classes are equal:
\begin{enumerate}
\item $\IP{\co\spa, \co\pri\ran, \po\pex\pub\ran, \po\pex\tim}$
\item $\IPhigh{\lo\spa, \co\pri\ran, \infty\pub\ran, \infty\tim}$
\item $\PP$
\end{enumerate}
% \utkanrem{$\IP[0.9]{\co\spa, \co\pri\ran, \po\pex\pub\ran, \po\pex\tim} = \PP$.}
% \end{equation*}
\end{theorem}
%\begin{proof}
% It is known~\cite{con89,GKR15} that
%\begin{equation*}
% \IP[0.9]{\lo\spa, \po\pub\ran, \po\tim} = \PP.
% \end{equation*}
% The proof follows from this fact and \Cref{lem:dir1,lem:dir2}.
% \qed %% LLNCS ONLY
%\end{proof}
%The equality \utkanadd{Equalities??} in
\Cref{thm:P} follows from \Cref{lem:dir1,lem:dir2NEW}.
\begin{lemma}\label{lem:dir1}
%\begin{multline*}
% \IP[0.9]{\lo\spa, \po\pub\ran, \po\tim}
$\PP \subseteq
\IP{\co\spa, \co\pri\ran, \po\pex\pub\ran, \po\pex\tim}$.
% \end{multline*}
% More specifically, for any $t > 1$,
% \begin{multline*}
% \IP[0.9]{\lo\spa, \OH{n^t}\pub\ran, \OH{n^t}\tim}\subseteq\\
% \IP[0.9]{\co\spa, \co\pri\ran, \OH{n^{t+2}}\pex\pub\ran, \OH{n^{t+2}}\pex\tim}.
%\end{multline*}
% \utkanrem{Languages that can be verified using log\-/space, poly\-/time, and infinite public coins \utkanadd{in an IPS (two\-/way)} with a non\-/zero probability of error can \utkanadd{also} be verified using \utkanadd{cons\-/private\-/coins instead of the log\-/space} \utkanrem{constant\-/space, constant private coins, and infinite public coins} with arbitrarily low non\-/zero probability of error. This new verifier is also expected to run for at most a polynomial time, except for some other and independent arbitrarily low non\-/zero probability of error.}
% Languages that can be verified using logarithmic space (in terms of the input string's length), polynomial time, and infinite public coins with arbitrarily low non\-/zero probability of error can also be verified by using constant\-/space, constant private coins, and infinite public coins with arbitrarily low non\-/zero probability of error.
\end{lemma}
\newcommand{\psimulation}{\ensuremath{p_{\mathrm{head}}}}
\newcommand{\ptimer}{\ensuremath{p_{\mathrm{timer}}}}
\begin{proof}
Let $L$ be any language in $\PP$. As Goldwasser et al.\ have proven in~\cite{GKR15}, there exists a public\-/coin verifier $V_1$ verifying $L$ with the following properties:
\begin{itemize}
\item $V_1$ has perfect completeness;
%, \ie, there exists a prover whose interaction with $V_1$ leads it to accept any string in $L$ with probability $1$;% when it interacts with a truthful \utkanadd{AND EXPERT? YA DA SADECE EXPERT? TRUTHFUL OLMASI YETERLI DEGIL, ISE YARAMAZ DOGRULAR YETMEZ, RESOURCEFUL/KNOWLEDGEABLE DA OLMALI (P3'un "truthful" olmasinin spesifik olarak "istenen bilgileri dogru iletmesi" gibi bir anlami oldugu icin yeterli oluyor ama bu genel olarak her verifier\-/prover etkilesimi icin gecerlidir diyebilir miyiz?)} prover about ;
\item %For any string $w$ not in $L$, no prover can convince $V_1$ to accept $w$ with probability greater than $\sfrac{1}{2}$ \utkanadd{UTKAN: olasiliklardan bahseden cumleler negatif kurulunca anlamasi cok zorlasiyor. (final itirazina gelen bir ogrencimizi animsadim. sizin okudugunuz ``guaranteed'' kelimesini iceren yargimizin contrapositive'ini almaya kalkinca cumle yanlis bir seye donusmus, belki siz de hatirlarsiniz.) pozitif kursak daha iyi olabilir. MESELA:\\
For any string $w$ not in $L$ and any prover $P^*$, the probability that $V_1$ is convinced to accept $w$ by $P^*$ is at most $\sfrac12$; and %\utkanadd{OLASILIK ORANININ NEYE BAGLANDIGI SYNTACTIC OLARAK KARISIK. [No prover can convince V to accept any string not in L] with probability greater than 1/2 mi, yoksa No prover can convince V to [accept any string not in L with probability greater than 1/2] mi? (ikincisi tabii ki ama ilki gibi de okunabilmesi okumayi zorlastiriyor)}
\item There exists an integer
$t>1$ such that $V_1$ uses $\OH{\log n}$ space and $\OH{n^t}$ time for any input of length $n$. % \utkanadd{UTKAN: miktar-cins ve cins-miktar seklinde ters yazmisiz, bu intended mi?} (for some ).
(These are worst\-/case bounds.) %!!!!BURADA FOR ANY INPUT LAFINI CÜMLENİN EN SONUNA ALMAK LAZIM, DEĞİL Mİ??!! UTKAN: Başta ve sonda olması arasındaki farkı göremedim.
\end{itemize}
%Let $V_1$ be a machine that simply runs $V$ $n$ times, and accepts the input if no run ends in rejection.
%The one\-/sided error bound of $V$ can be reduced easily to $2^{-n}$ by repetition. For any desired positive value $\varepsilon_1$, one can then obtain a machine
%$V_1$ operates in time $\OH{n^t}$ (for some $t>1$) and verifies $L$ with one\-/sided error $2^{-n}$. %!!!!!!!!YOKSA BUNU 2ÜSSÜEKSİn BIRAKIP SONDA V3'ÜN STATELERİYLE Mİ OYNASAK!!!!!!!!!!1 Note that one can reduce the error bound of $V_1$ by just increasing the number of its states, without changing its work tape usage. %Furthermore, $V_1$ . Note that one can obtain a verifier with any desired (positive) value for the one\-/sided error bound by modifying $V_1$ to repeat the protocol an appropriate number of times. % \utkanadd{that is allowed to be arbitrarily low}.
We will assume that exactly
% \utkanrem{$\ceil*{\log n}$}
$\floor*{\log(n+2)}$ cells are used in the work tape of $V_1$, and a multi\-/track alphabet (\eg, as in~\cite{H72}) is used to accommodate for the required amount of memory.
% Let $L$ be a language that can be verified using logarithmic space, polynomial time, and infinite public coins with arbitrarily low non\-/zero probability of error. Then, let $V_1$ be such a verifier with the probability of error $\varepsilon_1 > 0$. We will assume that the working tape of $V_1$ is exactly $\log n$ cells wide but with a stacked alphabet to accommodate for \OH{\log n} memory (where $n$ is the length of the input string), for the sake of simplicity.
% \utkanadd{The language verified in an IPS is determined by the verifier's decisions when it is paired against the most convincing prover, among the infinite domain of provers. Since the verifier is a fixed and finite entity in this scheme, such a domain includes provers that (assume to) know the verifier's algorithm by heart (albeit possibly being incorrect at that). Moreover, we can assume that the most convincing prover $P_1$ does indeed know the $V_1$'s algorithm correctly and by heart (since knowing $V_1$'s algorithm correctly cannot make the prover any less convincing). Since all the coins of $V_1$ are also public, any message that $V_1$ would send to $P_1$ would already be obvious to $P_1$, and redundant. Therefore, without loss of generality, we will assume that the only information that $V_1$ gives out in the dialogue of interaction is the outcomes of the public coins as they are tossed.}
In the following discussion, let any prover facing $V_1$ be called $P_1$. %Since $V_1$ cannot be fooled into accepting a non\-/member of $L$ with high probability no matter what prover it is facing, it is also immune against any such $P_1$ that ``knows'' $V_1$'s algorithm. Since all coins are public, such a $P_1$ can be assumed to have complete knowledge about $V_1$'s configuration at every step of their interaction.
% Since the definition stipulates that $V_1$ is faced with the ``best'' possible prover (named, say, $P_1$) for this job, one assumes that $P_1$ ``knows'' $V_1$'s algorithm. Since all coins are public, $P_1$ has complete knowledge about $V_1$'s configuration at every step of their interaction.
% As in the proof of \Cref{thm:conspubliconly}, we assume that $V_1$ sends no information to $P_1$ other than the coin outcomes, without loss of generality. \utkanadd{UTKAN: Bu cümle doğru, $V_1$'in ``information'' göndermesi gerekmiyor. Ancak $V_1$ hala ``prover'ın yönlendirmesine ihtiyacım var'' anlamında ``sinyal'' gönderebilmeli. Eğer onu da göndermiyor dersek bu generality'i bozar.}
%\utkanadd{In line with our definition for IPS'es, possibly among many other, one prover $P_1$ that is the most convincing at making $V_1$ accept its inputs would have complete knowledge of $V_1$'s algorithm. This renders any further communication from $V_1$'s part obvious and redundant. Hence, given the existence of such provers, without loss of generality, we will assume that $V_1$ does not write to the communication cell.}
There exists
a constant\-/space, public\-/coin, $k$\=/head verifier $V_2$ that can verify $L$ by simply executing $V_1$'s program, simulating $V_1$'s
logarithmic\-/length work tape by the technique of \Cref{thm:hartmanisextended}. (Note that $k$ depends on the precise worst\-/case memory requirement of $V_1$.) % APPENDIX REINCLUDE in \Cref{sec:hartmanis}.
% using most of its $k$ heads' positions over the input as a means of mimicking memory using the technique introduced in~\cite{H72},
% \item \textbf{public coins} using its own public coins, and
% \item \textbf{computation} by executing over the input string and accepting whenever the simulated $V_1$ accepts.
%\end{enumerate}
Since the simulation is direct and does not involve any additional use of randomness, $V_2$ verifies $L$ with the same amount of one\-/sided error as $V_1$. The only time overhead is caused by the simulation of the logarithmically bounded memory, so, by \Cref{thm:hartmanisextended}, % APPENDIX REINCLUDE in \Cref{sec:hartmanis},
$V_2$ will complete its execution in \OH{n^{t+1}} time. $V_2$'s prover, say, $P_2$, is supposed to follow the same protocol as $P_1$.
% Just like $V_1$, $V_2$ sends no information to its prover, say, $P_2$ (which is supposed to follow the same protocol as $P_1$), except the outcomes of its public coins. %Note that $P_2$ need not flip a coin at every step, since the procedure for aligning the heads of $V_2$ to simulate an individual step of $V_1$ (described in Appendix \ref{sec:hartmanisextendedproof}) is deterministic.
% The runtime of $V_1$ will be longer due to the overhead of simulating memory with the head positions. However, it will still be polynomial in the length of its input. The simulation overhead occurs at every simulated transition of $V_1$, thereby appearing as a factor in the total runtime, and involves the following:
% \begin{enumerate}
% \item Decoding the bit values at the \ith{i} index of simulated memory from a head's position, which requires halving of the heads' positions $i-1$ times (incurring less than $2n$ steps) and checking if the resulting index is even or odd (incurring less than $n$ steps).
% \item Possibly modifying the heads' positions to change the value of a bit at a particular index $i$, which requires moving a spare head to the \ith{2^i} index (incurring less than $2n$ steps) and moving the space\-/encoding head by $2^i$ cells (incurring less than $n$ steps). This needs to be done for all the space\-/encoding heads, whose total number is less than $k$.
% \end{enumerate}
% The total overhead factor $3n + 3nk$ is polynomial (even linear) in terms of the input length, allowing $V_2$ to run also in polynomial time, \OH{n^{t+1}}.
% \threeast{}
We now describe $V_3$, a constant\-/space, single\-/head verifier that uses a constant number of private coins, in addition to the public coins that it flips at almost \emph{every} step, %\utkanadd{V1 VE V2 SUREKLI PUBLIC COIN ATMIYOR DA OLABILIR. V3 YINE DE POLY TIMER'I ICIN SUREKLI PUBLIC COIN ATMALI, AMA BU KISMIN (sanki V2'nin simulasyonu icin HER adimda public coin atmak asikar bir gereklilikmis gibi) PARANTEZ ICINDE OLMASI GARIP})
to emulate $V_2$'s verification of $L$.\footnote{This is an adaptation of a technique introduced by Say and Yakary\i{}lmaz~\cite{SY14} for simulating a multihead nondeterministic automaton in an interactive proof system whose verifier is a (single\-/head) probabilistic finite automaton.}
%$V_3$ starts by scanning the input string $w$. If the length of $w$ is at most $n_0$, $V_3$ consults a lookup table to decide whether to accept or reject $w$. Otherwise,
% \pagebreak[2]
$V_3$ (\Cref{alg:multiheadsimulator}) performs the following $m$\=/round procedure:\footnote{The precise settings of $V_3$'s parameters (like $m$) will be discussed below.}
Each round begins with $V_3$ flipping $r$ of its private coins. %\utkanrem{Thanks to} \utkanadd{Through}
Using this randomness, it picks one of the $k$ heads of $V_2$. Each head has the same very small probability $p=2^{-r}$ of being selected. (How $V_3$ operates with the remaining high probability $1 - kp$ will be explained later.) %ESKIDEN "GERIYE KALAN OLASILIK" BU ASAMADA VARLIGI AKLA GELECEK BIR SEY DEGILDI AMA SIMDI $p$'NIN BURACIKTA SABITLENMESIYLE HEMEN AKLA GELIYOR.)}
$V_3$ then engages in an interaction with its own prover, say, $P_3$, to simulate the execution of $V_2$, including $V_2$'s interaction with $P_2$ about the input string.
% $V_3$ does not send any information other than the outcomes of its public coins to $P_3$.
Note that $V_2$ flips coins in some, but not necessarily all of its computation steps, whereas $V_3$ flips a public coin %\utkanadd{its public coins}
at each step of the %\utkanadd{$V_2$'s}
simulation. Only some of these coin outcomes are used to stand in for $V_2$'s public coins.
% $V_2$'s messages to $P_2$.
What $V_3$ does with the remaining public random bits will be explained below.
To simulate $V_2$, $V_3$ traces the selected head of $V_2$ with its own single head, and relies on $P_3$ to provide an unbroken stream of information about what the other heads of $V_2$ would be reading at every step of its execution. In its response to any coin flip of $V_3$, $P_3$ is expected to transmit its claims about the readings of all $k$ heads of $V_2$
at that step of the simulated interaction (and $P_2$'s response to $V_2$, if the currently simulated transition of $V_2$ emanated from a communication state).
% Furthermore, when
When the simulation arrives at an actual coin\-/flipping state of $V_2$, $P_3$ is supposed to interpret the latest coin outcome as a public coin flipped by $V_2$.
% , and include $P_2$'s response to $V_2$ in its message as well.
%\footnote{\utkanadd{Although $V_3$ tosses public coins at every step to not compromise the secrecy of the mode it is operating in (here, in simulation mode, rather than the timer mode that will be described shortly), in this mode, it will put them into use only when feeding them to the simulated $V_2$ when it needs one, and discard the rest.}} $P_3$, on the other hand, is expected to transmit both
% \begin{itemize}
% \item what $P_2$ would be transmitting to $V_2$, and
% \item %\utkanadd{(unaware of the head picked by $V_3$)}
% its claims about the readings of all $k$ heads of $V_2$
% \end{itemize}
%at every step of the simulated interaction.
%\utkanrem{purportedly accepting execution as narrated by the certificate.
%This narration consists of the readings of $V_2$'s $k$ heads throughout its execution.
%Paralleling this narration, $V_1$ also expects the certificate to provide the certificate that would bring $V_2$ (and $V_1$) to its purported acceptance.}
%This certificate is prepared on\-/the\-/fly by the prover that is also witnessing the outcomes of the public coins as they are tossed.
At any step, $V_3$ checks the part of $P_3$'s claims regarding the head it had chosen in private, and \rejects{} if it sees any discrepancy. If the information sent by $P_3$ has led the simulation of $V_2$ to reach acceptance at the current step, $V_3$ has not been able to catch a lie up to that point, and if this was not the \ith{m} round, $V_3$ moves its head back to the left end of the input tape without flipping coins, and proceeds to the next round.
\newcommand\mtimer{\ensuremath{M_{\mathrm{timer}}}}
\newcommand\hmode[1]{\ensuremath{H_{#1}}}
\newcommand\tmode{\ensuremath{\mathit{TIMER}}}
\newcommand\mode{\ensuremath{\mathit{mode}}}
The probability $\psimulation$ that $V_3$ will attempt to use its head to check the claims of $P_3$ in the manner described above is just $k p$.
%While the $p_i$ are positive for all $i$, their sum, $\psimulation = \sum_{i=1}^k p_i$ is very small by design, \utkanadd{and each are chosen to be
% maximally
% close to their mean by being set to equal either
% \begin{equation*}
% \psimulation \cdot \frac{\floor*{\sfrac{2^r}{k}}}{2^r}
% \qquad\text{or}\qquad
% \psimulation \cdot \frac{\ceil*{\sfrac{2^r}{k}}}{2^r},
%\end{equation*}
%making each $p_i$ strictly greater than $\sfrac{\psimulation}{2k}$.}
With the remaining high probability $\ptimer$ (\ie, $1 - \psimulation$),
$V_3$ simulates $V_2$ by relying on $P_3$'s claims about the head readings and $P_2$ responses blindly, while using its own head and the public coins it flips to simultaneously %\utkanrem{operate as a probabilistic timer}
simulate a probabilistic finite automaton $\mtimer$ that functions as a timer (\Cref{sec:polyclockproof}) in this round.
% \utkanrem{(\ie, longer than $V_2$'s runtime)}
This timer has an expected runtime of \OH{n^{t+2}}, and exceeds $V_2$'s runtime with probability $1-\errprematuretimeout$, for some positive $\errprematuretimeout$ that can be set to be arbitrarily close to $0$, by the premise of \Cref{lem:polyclock}. % APPENDIX REINCLUDE as demonstrated in \Cref{lem:polyclock} in \Cref{sec:clock}.
%\utkanrem{with the expected runtime of \OH{n^{t+2}}, running for longer than $V_2$'s polynomial runtime except for some arbitrarily low probability $\errprematuretimeout > 0$ , and timing out eventually with probability 1}
If the simulation of $V_2$ fed by $P_3$ reaches acceptance before the timer runs out, then $V_3$ %\utkanadd{again resets its head back to $\lend$ without tossing coins and}
completes this round of verification without rejecting. Otherwise (if the timer runs out before the simulation ends), $V_3$ \rejects.
$V_3$ \accepts{} if it does not reject for $m$ rounds of verification. The total number of private coins used is $mr$.
\begin{algorithm}[htb]
%{\fontsize{6}{0}\selectfont
% !!BU "FİGÜR" BİR ÇERÇEVENİN İÇİNDE OLSA (BASİT BİR DİKDÖRTGEN) MESELA? \utkanadd{Bu nasıl?} FONTU DA BİR TIK DEĞİŞTİRİRİZ; METİNLE KİMSE KARIŞTIRAMAZ!!!!!!!!
%\utkanadd{Fontu değiştirme konusunda açık yönlendirme yapmanıza ihtiyacım var. Benim aklıma bir şey gelmiyor. Sans-serif denedim, *çok* farklı gözüküyor, kötü duruyor. Bir boy küçülttüm, "farklı" gibi durmuyor, kapladığı yer açısından pek küçülmüyor, sadece biraz daha zor okunur bir şeye dönüşüyor. İsterseniz bir ara beraber canlı deneyelim.}
%}
% \fontfamily{pag}\selectfont% Avant Garde
% \fontfamily{fvs}\selectfont% Bitstream Vera Sans
% \fontfamily{pbk}\selectfont% Bookman
% \fontfamily{bch}\selectfont% Charter
% \fontfamily{ccr}\selectfont% Computer Concrete
% \fontfamily{cmr}\selectfont% Computer Modern
% \fontfamily{pcr}\selectfont% Courier
% \fontfamily{ugm}\selectfont% Garamond
% \fontfamily{phv}\selectfont% Helvetica
% \fontfamily{zi4}\selectfont% Inconsolata
% \fontfamily{lmr}\selectfont% Latin Modern
% \fontfamily{lmss}\selectfont% Latin Modern Sans
% \fontfamily{lmtt}\selectfont% Latin Modern Typewriter
% \fontfamily{LinuxBiolinumT-OsF}\selectfont% Linux Biolinum (formerly 'fxb' in older package versions)
% \fontfamily{LinuxLibertineT-OsF}\selectfont% Linux Libertine (formerly 'fxl' in older package versions)
% \fontfamily{pnc}\selectfont% New Century Schoolbook
% \fontfamily{ppl}\selectfont% Palatino
% \fontfamily{qag}\selectfont% TeX Gyre Adventor
% \fontfamily{qbk}\selectfont% TeX Gyre Bonum
% \fontfamily{qzc}\selectfont% TeX Gyre Chorus
% \fontfamily{qcr}\selectfont% TeX Gyre Cursor
% \fontfamily{qhv}\selectfont% TeX Gyre Heros
% \fontfamily{qpl}\selectfont% TeX Gyre Pagella
% \fontfamily{qcs}\selectfont% TeX Gyre Schola
% \fontfamily{qtm}\selectfont% TeX Gyre Termes
% \fontfamily{ptm}\selectfont% Times
% \fontfamily{uncl}\selectfont% Uncial
% \fontfamily{put}\selectfont% Utopia
% \fontfamily{pzc}\selectfont% Zapf Chancery
In the following, $V_2$ is assumed to never utilize its work tape and to always send a dummy symbol (\eg, $\blanksymb$) to its prover when it needs it to update its communication cell, without loss of generality. $\Set{\hmode1, \hmode2, \dotsc, \hmode{k}, \tmode}$ is the set of different modes in which $V_3$ can operate.
\vspace{\topsep}
\begin{turinglist}%{V_3}{On input $w$:}
\item Repeat the following for $m$ rounds:
\begin{turinglist}
\titem{Use $r$ private coin flips to select $\mode$ to be an element of $\Set{ \hmode1, \dotsc, \hmode{k} }$ with $p = 2^{-r}$ probability for each, %\utkanadd{UTKAN: Bu parantezi kaldırsak mı? Bu şekilde hemen aynı cümlenin devamında parantez dışında "*remaining* probability" dememiz havada kalmış gibi geldi.}
or \tmode{} with the remaining probability.}
\titem{Move the input head to the left end\-/marker.} %\utkanadd{\timespec{\OH{n}}}
\titem{Initialize a simulation of $V_2$, using a field $\gamma_2$ to keep its communication cell content.} %keeping its state $q_2$ and
\titem{Communicate with $P_3$ for it to reply with its claims about $V_2$'s initial head readings.}
\titem{If $\mode = \tmode$, initialize a parallel simulation for \mtimer.} %keeping its state.
\titem{Repeatedly execute the following move, which advances the simulation(s) by one step, until $V_2$ accepts:}
\begin{turinglist}
\item{(All actions described for this iteration are executed in a single verifier transition.)}
\item{If $\mode = \tmode$ and $\mtimer$ has halted, \reject.}
\item{If $V_2$ has rejected, \reject.}
\item{Let $\gamma_3$ denote the symbol in the communication cell.}
\item{Extract $P_3$'s claims about $V_2$'s head readings from $\gamma_3$.}
\item{If $\mode = \hmode{i}$, and the scanned input symbol does not match $P_3$'s claim, \reject.}
\item{If %\utkanadd{this is not the first step of $V_2$'s simulation and}
$V_2$ communicated in the previously simulated step, extract the new value for $\gamma_2$ from $\gamma_3$, retaining its old value otherwise.}
\item{Flip a public coin.}
\item{Advance the simulation(s) utilizing the extracted information about $V_2$'s head readings, communication symbol and the coin outcome, moving the input head to imitate the \ith{i} head of $V_2$ if $\mode = \hmode{i}$, and to imitate $\mtimer$'s head otherwise.}
% If the simulated $V_2$ step was from a communication state, send $\gamma'$ to $P_3$.
% Communicate with $P_3$ for it to reply with its claims for $V_2$'s readings, appended with $P_2$'s reply to $V_2$ if its simulation just transitioned from a communication state.
%\bitem{ If a verification error has occurred, \reject. Otherwise (meaning $V_2$ has accepted), continue.}
\end{turinglist}
\end{turinglist}
\titem{\Accept.}
\end{turinglist}
\caption{A constant-space, single-head verifier $V_3$.}
\label{alg:multiheadsimulator}
\end{algorithm}
The rest of the proof is an analysis of the error probability and runtime of $V_3$.
\paragraph{Arbitrarily small verification error.} %\utkanadd{The verification error of $V_3$ is defined as $\verr_3 = \max\paren{{\verracc_3, \verrrej_3}}$.}
%
For any input string that is a member of $L$, $P_3$ can simply tell $V_3$ the truth about what $V_2$ would read with its $k$ heads, and emit the messages that $P_2$ would send to $V_2$ alongside those readings. Even when communicating with such a truthful $P_3$, $V_3$ may erroneously reject at any given round, %either due to the simulated $V_2$ also rejecting,\footnote{Our definitions allow $V_1$, and therefore $V_2$, to reject members of $L$ with some small probability.} or
due to a premature timeout of the probabilistic timer. The probability of that is at most %$\psimulation \cdot \varepsilon_1 +$
$ \ptimer \cdot \errprematuretimeout$. To accept a member of $L$, $V_3$ must go through $m$ consecutive rounds of verification without %committing \utkanrem{such} %\utkanadd{those} errors.
this event occurring.
The maximum probability with which $V_3$ can fail to accept a string in $L$ is therefore
\begin{equation*}
\verracc_3 \le 1 - \paren*{1 - %\paren*%{%\psimulation \cdot \varepsilon_1 +
\ptimer \cdot \errprematuretimeout}^m.
\end{equation*}
% Since $\psimulation$ and $\errprematuretimeout$ can be lowered arbitrarily to any positive constant, $\varepsilon_3^+$ can also be lowered to any positive constant.
% Since $\psimulation$ and $\errprematuretimeout$ (and, although unnecessary, $\varepsilon_1$ as well) can be lowered arbitrarily to any positive constant, $\varepsilon_3^+$ can also be lowered to any positive constant.
\newcommand{\acclabel}{\mathsf{P}}
\newcommand{\acc}[1][]{\ensuremath{\acclabel^{#1}}}
% \NewDocumentCommand{\IP}{ e{^_} O{1} m }{\ensuremath{\langclassformat{IP^{\IfValueT{#1}{#1}\IfValueT{#2}{#2}}_{\IfValueT{#2}{\arbitrarilylow}}\paren*{\scalebox{#3}{$#4$}}}}}
\newcommand{\loo}{%
\mathchoice
{% Display style
\adaptivecircle{$\displaystyle\acclabel$}{0.09em}
}
{% Text style
\adaptivecircle{$\textstyle\acclabel$}{0.08em}
}
{% Script style
\adaptivecircle{$\scriptstyle\acclabel$}{0.062em}
}
{% Scriptscript style
\adaptivecircle{$\scriptscriptstyle\acclabel$}{0.05em}
}
}
\newcommand{\adaptivecircle}[2]{%
\tikz[baseline=(char.base)]{
\node[shape=circle,draw,inner sep=-1.5*#2,line width=#2] (char) {\phantom{#1}};%
}%
}
\renewcommand{\loo}{\mathsf{L}}
We will now determine a bound for $\verrrej_3$, the probability with which $V_3$ may fail to reject an input string that is not a member of $L$.
Unlike $\verracc_3$, $\verrrej_3$ is a value that $P_3$ ``wants'' to maximize, so one has to be careful to include all possible strategies for the prover in this consideration. The program of $V_3$ dictates that there are exactly $m+1$ different ways (corresponding to alternative strategies for $P_3$) in which $V_3$ may fail to reject a string $w$ not in $L$:
\begin{itemize}
\item $V_3$ may pass all $m$ rounds by carrying out an assisted simulation of $V_2$ that ends in what seems to it to be acceptance. %, or by ``watching'' the clock and receiving an acceptance claim from the prover.
We denote this event by $\acc[m]$.
\item $V_3$ may be tricked (as will be described below) by $P_3$ into entering an infinite loop during the \ith[st]{j+1} round, after passing the first $j$ rounds, for $j \in \Set{0, \dotsc, m-1}$. Such an event will be denoted by $\acc[j]\loo$. %\utkanadd{UTKAN: loop roundunun sembolunu \adaptivecircle{$\textstyle\acclabel$}{0.08em} yerine $\loo$ yaptim. nasil olmus? geri alabilirim.}
\end{itemize}
Recall that $P_3$ is expected to feed $V_3$ with information about the symbols that would be scanned by $V_2$'s input heads at any point of its execution, and the transmissions of $P_2$. For $w\notin L$, if $P_3$ always tells the truth about the head readings, %\utkanadd{each round of $V_3$'s simulation will end in at most \OH{n^{t+1}} simulation steps and will be passed} \utkanrem{
$V_3$ can pass any round with the probability (at most $2^{-1}$) that $V_2$ would be deceived about $w$, and finally accept with probability at most $2^{-m}$.
% !!!!DOĞRU; DEĞİL Mİ?!!!! \utkanadd{Utkan: Bence dogru}
Since $P_2$'s messages are optimal for convincing $V_2$, whose program is hard\-/coded in $V_3$, $P_3$'s only option for achieving better odds of deceiving $V_3$ is by lying about the head readings of $V_2$.
Since $V_3$ is able to track only one of $V_2$'s input heads with its own head, %; \utkanadd{BU NOKTALI VIRGUL DOGRU MU? BAGLACLA BAGLI CUMLECIKLERI COK FAZLA AYIRIYOR GIBI}
it is dependent on $P_3$ to carry out the simulation. If $V_3$ has picked some head $h$ of $V_2$ to track, a lie by $P_3$ about the symbol seen at that step by some other head $h'$ of $V_2$ may be enough to deceive $V_3$ into eventually believing that $V_2$ accepts $w$ in that round. $V_3$ can catch such a lie only if it has previously %\utkanadd{PREVIOUSLY DERKEN ASLINDA BU TUR, ONCEKI BIR TUR DEGIL. YANLIS ANLASILMIYORSA SORUN DEGIL}
picked the head that is being lied about, and detects the discrepancy between $P_3$'s claim and its own scan.
Unlike $P_1$ and $P_2$, which deal with verifiers that have sufficient memory to keep track of their own runtimes, $P_3$ also has the capability to trick $V_3$, whose number of different possible configurations is, in general, less than the runtime of $V_2$, which it is supposed to be simulating, into running forever.
%\utkanadd{DAHA NET BIR SEBEP ``the number of different configurations $V_3$ can be in is, in general, less than the runtime of the interaction it is simulating.'' BELKI YAZILI OLANA EK, OVERARCHING(?) BIR SEBEP OLARAK VERILEBILIR}
It is common (see, for instance, \Cref{sec:hartmanisextendedproof}) for multihead finite automata to require a head to wait at a tape location while another head is walking towards a specific symbol, \eg, an end\-/marker. If $V_3$ has picked to track such a waiting head of $V_2$ with its own head, it can be tricked into getting stuck in that configuration by an endless stream of claims from $P_3$ that the other head is still walking in the required direction. $V_3$ can catch such a lie directly, if it has picked the head that is being lied about; or indirectly, if it has been running in ``timer mode''.
Our analysis of the error probabilities associated with the $m+1$ alternative strategies for the prover mentioned above requires setting bounds for the two following values:
\begin{itemize}
\item $\verr_{\loo}$, the probability that $V_3$ is tricked to enter an infinite loop in a particular round.
\item $\verr_{\acc}$, the probability that $V_3$ is led to complete a round without rejection when $w\notin L$.
\end{itemize}
$V_3$ cannot run forever in any round in which it has selected to act as a timer. %, since it would reject when the clock runs out if $P_3$ has still not announced the end of $V_2$'s run by that point. %\utkanadd{SOLDAKI CUMLE COK UZUN, SADECE VIRGUL ONCESINI TUTUP "CLEARLY" DESEK OLMUYOR MU?}
The probability that $V_3$ has selected to simulate $V_2$ with a head % the probability with which it has picked a head
that $P_3$ would lie about is at least $p$.
%$\sfrac{\psimulation}{2k}$ that .
We conclude that %in any specific round, the probability
%\utkanrem{$\verr_{\loo}$ %that $V_3$ can be led to loop is at most $\psimulation - p= (k-1) \cdot p$.}
\begin{equation*}
\verr_{\loo} \le \psimulation - p= (k-1) \cdot p.
\end{equation*}
There are two different ways in which the prover can cause $V_3$ to complete a round without rejection when $w\notin L$:
\begin{enumerate}
\item $P_3$ can be truthful. With probability at most $\sfrac{1}{2}$, the public coin flips would lead the resulting faithful simulation to end in $V_2$'s accept state.
\item $P_3$ can lie about a reading of a head of $V_2$. In this case, $V_3$ may be tricked into believing that $V_2$ accepts $w$ %\utkanadd{proper,}
% \utkanadd{[[BUNU "V3 may be tricked into believing that V2 accepts w (as if it was a member of L, \ie, as if V2 were accepting it with probability 1 and not just 1/2)" MANASINDA YAZMAK ISTIYORUZ ASLINDA; "proper," EKLEMEM O ANLAMI SAGLIYOR MU, EMIN DEGILIM]]} !!!!!!!SENİN PROPER'I SİLDİM ÇÜNKÜ BENCE BURADA O MANADA YAZMAK İSTEMİYORUZ, V3'ün V2'nin ÖYLE VEYA BÖYLE ACCEPT ETTİĞİNİ SANMASINI KASTEDİYORUZ!!!!! Utkan: Doğru, artık katılıyorum.
if $V_3$ has not selected to track that head. The probability of this event is at most $1-p$.
\end{enumerate}
In this scenario, $P_3$ can maximize its chances of leading $V_3$ to passing a round by basing its decision about whether to lie or not on the public coin outcomes: Call a public coin sequence \emph{lucky} if it leads $V_2$ to accepting $w$ when guided by $P_2$. In such cases, honesty is the best $P_3$ policy, since it involves zero probability of rejection as a result of being caught lying. For unlucky coin sequences, honesty has no chance of success, and $P_3$ would have to lie for $V_3$ to complete the round.
To obtain an easy upper bound for $\verr_{\acc}$, we grant $P_3$ certain additional ``superpowers'' that allow it to always make the correct decision in the situations described above: In particular, we assume that $P_3$ can always correctly foresee %intuit \utkanadd{BU KELIMEYI ILK DEFA DUYUYORUM AMA INTUITION ILE PARALEL BIR ANLAMI VARSA EGER, BU YINE BULGUYA DAYALI AMA FORMULIZE ETMESI ZOR BIR SEZGISEL KARAR MEKANIZMASI IFADE EDER; BURADAYSA HICBIR BULGUYA DAYALI OLAMAYACAK BIR TRUE-RANDOMNESS GELECEK-GORUSU TARZI BIR SEY VAR}
whether the entire public coin sequence of the present round will be a lucky one or not, and that it is able to communicate with $V_3$ (lying about a single $V_2$ head or reporting all head readings truthfully) accordingly. Under these extremely favorable circumstances, $P_3$ can manage to be truthful exactly when the public coin sequence of the present round is a lucky one, and lie in the remaining cases. The probability of a lucky sequence is, as mentioned before, at most $\sfrac12$. We therefore have %Furthermore,
%\begin{itemize}
% \item $P_3$ has the magical ability to know at the beginning of a round whether the future public coin flips in that round will enable the event V2ACCw or not,
% \item A single lie about a single head of $V_2$ is sufficient to convince $V_3$ that $V_2$ accepts $w$ (unless $V_3$ has picked that head to track),
% \item Similarly, a single lie about a single head of $V_2$ is sufficient to trick $V_3$ into entering an infinite loop (unless it has picked that head to track).!!!!!!!BUNA GEREK VAR MI??!!!
%\end{itemize}
%
%Note that, under this extremely favorable set of circumstances, $P_3$ can maximize $V_3$'s probability of completing a round by simply following the following strategy:
%\begin{enumerate}
% \item If, at the beginning of the round, $P_3$ learns that V2ACCw is possible, mimic the behavior of $P_2$ and give truthful information about all of $V_2$'s head readings
% \item If, at the beginning of the round, $P_3$ learns that V2ACCw is not possible, it lies about a single head $h$ to convince $V_3$ (unless $V_3$ has picked $h$ to track) that $V_2$ accepts $w$
%\end{enumerate}
%
%
% To ensure that the strategy of our $P_3$ is not inferior to any other strategy for a prover against $V_3$, we will be giving $P_3$ an unfair advantage, granting it the following two ????!!!!??? ``superpowers'' at its disposal:
% \begin{enumerate}
% \item There shall be lie $P_3$ can tell about any one head at any step of the simulation which (if not caught by $V_3$) will bring the simulation to acceptance immediately.
% \item There shall be lie $P_3$ can tell about any one head at any step of the simulation which (if not caught by $V_3$) will bring the simulation to a state, from which point on $P_3$ can keep the simulation in a loop deterministically and without having to tell any more lies.
% \item At the beginning of each round, $P_3$ shall be prophesied about whether, given the public random bits that are about to be revealed, there is a course of interactions between $V_2$ and $P_2$ that make $V_2$ falsely accept. If there is, $P_3$ will additionally be informed about the messages of $P_2$ that would make $V_2$ accept.
%\end{enumerate}
% \utkanadd{Furthermore, we make the following assumption that informs $P_3$ }
%Equipped with such powers, and reminding ourselves that $p_i > \sfrac{\psimulation}{2k}$ for all $k$ heads, the chances of a $P_3$ making $V_3$ loop in a round is
%\begin{align*}
% \verr_{\loo} &< \psimulation - \sfrac{\psimulation}{2k},\\
%\intertext{and the chances of a $P_3$ making $V_3$ accept in a round is}
% $ \verr_{\acc} &< \verr_1 + \paren*{1-\verr_1} \cdot \paren*{1 - \sfrac{\psimulation}{2k}}= 1 - \paren*{1 - \verr_1} \cdot \sfrac{\psimulation}{2k}$.
\begin{equation*}
\verr_{\acc} \le \frac{1}{2} + \paren*{1-\frac{1}{2}} \cdot \paren*{1 - p}= 1 - \frac{p}{2}.
%\paren*{1 - 2^{-n}} \cdot p.
\end{equation*}
We can now establish bounds for the probabilities of the $m+1$ ``failure to reject'' events listed above.
The probability that $V_3$ is led to accept $w \notin L$
through $\acc[m]$ is %\utkanadd{UTKAN: ayni ifadede ``probability'' ve ``can'' olmasi anlamayi biraz zorlastiriyor. baska ne yapabilirdik? ``The probability that $V_3$ is led to accept...''? hemen asagida ve onceki sayfada $\verr_{\loo}$ ve $\verr_{\acc}$'i tanimladigimiz yerde de bu tip cumlelerden var.}
\begin{equation*}
\verr_{\acc[m]} = \verr_{\acc}^m \le \paren*{1 - \frac{p}{2}}^m.
\end{equation*}
The probability that $V_3$ is made to fail to reject $w$ through $\acc[j]\loo$ ($j \in \Set{0, \dotsc, m-1}$) is
\begin{equation*}
\verr_{\acc[j]\loo} = \verr_{\acc}^j\verr_{\loo} \le \paren*{%1 - \paren*{1 - 2^{-n}} \cdot p
1 - \frac{p}{2}}^j \cdot \paren*{k - 1}\cdot p.
\end{equation*}
% \utkanadd{NIYE $\verr_{\acc[m]} = \verr_{\acc}^m$ VE $\verr_{\acc[j]\loo} = \verr_{\acc}^j\verr_{\loo}$ DEMIYORUZ?}!!!!!!!HAKLISIN, ÖYLE DİYELİM PLZ!!!! Utkan: Der olduk
Although the prover has the ability to use the public coins to implement a probabilistic mixture of the $m+1$ mutually exclusive strategies in its repertory, it is easy to see that $P_3$ must focus only on the strategies associated with the highest ``success'' probabilities from its own point of view:
% Instead of deciding on which one to employ deterministically, $P_3$ can assign probabilities to each one of the $m+1$ strategies available to it and pick one at random. The failure to reject error probability of $V_3$ would then be
% \begin{equation*}
% \verrrej_3 =
% p_{\acc[0]\loo} \cdot \verr_{\acc[0]\loo} +
% p_{\acc[1]\loo} \cdot \verr_{\acc[1]\loo} +
% \dotsb +
% p_{\acc[m]} \cdot \verr_{\acc[m]},
% \end{equation*}
% where $p_{\acc[0]\loo} + p_{\acc[1]\loo} + \dotsb + p_{\acc[m]} = 1$. This affine combination, however, is again maximized by setting the assigned probability corresponding to the greatest error term to $1$. (BURASI DAHA IYI IFADE EDILEBILIR BELKI, $p_X$ of the greatest $\verr_X$ DEMEK ISTERDIM) Thus, the bound for the failure to reject error is
\begin{align*}
\verrrej_3 &\le \max\paren*{\verr_{\acc[0]\loo}, \verr_{\acc[1]\loo}, \dotsc, \verr_{\acc[m]}}.
\end{align*}
Since $\verr_{\acc[0]\loo}$ is clearly the maximum among all $\verr_{\acc[j]\loo}$'s, we have
\begin{align*}
\verrrej_3 &\le \max\paren*{\verr_{\acc[0]\loo}, \verr_{\acc[m]}}.
\end{align*}
Let us show that we can tune $V_3$ so that it verifies $L$ with error $\verr_3 = \max\paren*{\verracc_3, \verrrej_3}$, for any small positive value $\verr_3$. Since
\begin{equation*}
p=2^{-r} \quad \text{and} \quad \ptimer=1-\psimulation=\frac{2^r-k}{2^r},
\end{equation*}
% $p=2^{-r}$ and $\ptimer=1-\psimulation=\frac{2^r-k}{2^r}$,
we have established that the following three quantities should be less than or equal to the allowed error bound:
% !!!!!!BUNU MAX OLMAKTAN ÇIKARALIM; ALT ALTA O ÜÇ INEQUALITY'Yİ r'li şekilde YAZALIM!!!! Utkan: Yazdim. Substitution'larin dogru oldugundan emin olmak icin orijinal bulgularimizi da kopyaladim. Bence bunlar olmadan takip/teyit etmek (benim icin de, okur icin de) zor. Boyle de cirkin duruyor, silebiliriz; ama silince de okur icin ugrastirici oluyor.
\begin{align*}
\verracc_3 &\le 1 - \paren*{1 - \ptimer \cdot \errprematuretimeout}^m = 1 - \paren*{1 - \frac{2^r-k}{2^r} \cdot \errprematuretimeout}^m\\
\verr_{\acc[m]} &\le \paren*{1 - \frac{p}{2}}^m = \paren*{1 - 2^{-r-1}}^m\\
\verr_{\acc[0]\loo} &\le \paren*{k - 1}\cdot p = \paren*{k - 1}\cdot 2^{-r}
\end{align*}
Given some desired $\verr_3$, %the requirement above (!!!!!!!!BUNA BİR NUMARA VEREBİLİRİZ!!!) can be satisfied as follows:
\begin{enumerate}
\item Set $r$ to a value that ensures $\verr_{\acc[0]\loo}$ does not exceed $\verr_3$.
\item Set $m$ to a value that ensures that $\verr_{\acc[m]}$ does not exceed $\verr_3$.
\item Set $\errprematuretimeout$ so that $\verracc_3$ does not exceed $\verr_3$. This can be achieved by arranging the number of states in the implementation of the probabilistic timer, as described in \Cref{sec:polyclockproof}. %!!!BUNU ORADA SON CÜMLEYLE SÖYLEDİM!!!!! \utkanadd{Utkan: BEN BASKA BIR SON CUMLE ALTERNATIFI EKLEDIM}
\end{enumerate}
Note that the parameters $r$, $m$, and $\errprematuretimeout$ are independent, allowing each of them to be set without affecting the values of the other two.
\paragraph{Polynomial expected runtime with arbitrarily high probability.} With
% \utkanrem{$\verrloop_3$}
$\verr_3$ (and thereby also the probability of looping) set to a desired tiny value, $V_3$ will be running for at most $m$ rounds with the remaining high probability. At each of those rounds, $V_3$ will either complete $V_2$'s simulation in \OH{n^{t+1}} time, or will operate as a probabilistic timer that has expected runtime \OH{n^{t+2}}. Thus, it is expected to run in \OH{n^{t+2}} time with probability at least $1-\verr_3$.
\paragraphEnd{}
We conclude that $L\in \IP{\co\spa, \co\pri\ran, \po\pex\pub\ran, \po\pex\tim}$.
%\utkanrem{In a round of verification, $V_3$ can simulate $V_2$ with probability $\psimulation$ and then $P_3$ may lead that simulation to run forever with some probability that is at most $1 - p_{\min}$ when the input is a non\-/member. The probability that $V_3$ runs forever on the first round is the highest. $V_3$ running forever in any subsequent round is smaller since it requires $V_3$ to have not rejected in the preceding rounds. These are the only ways that $V_3$ may run forever.}
%\utkanrem{In any other case, $V_3$ will either complete a simulation of $V_2$ in \OH{n^{t+1}} time, or will operate as the probabilistic timer that has the expected runtime of \OH{n^{t+2}}. This proves that $V_3$ is expected to run in polynomial time \OH{n^{t+2}} except for an error probability of}
%\begin{equation*}
% \utkanrem{\varepsilon_r = \psimulation \cdot \paren*{1 - p_{\min}},}
%\end{equation*}
%\utkanrem{which can be reduced arbitrarily by lowering $\psimulation$.}
%
% Given an input of length $n$, in order to function as a timer that runs for $(n+3) \cdot \paren*{\paren*{n+1}^z - 1} - n \in \OH{n^{b+1}}$ expected steps, $V_1$ does as follows: It brings its input head to the beginning of the input string, then it starts flipping public coins and doing a \emph{random walk} (\ie, moving the input head in either direction with equal probability) until its head reaches either one of the end\-/markers. It repeats this process until $b$ consecutive random walks end up at the right end\-/marker, and then it halts with rejection.
%
% $$1 - \paren*{1 - \paren*{\frac1n}^{b+d-1}}^{\paren*{n^{b-1}}}$$
% $$1 - \paren*{\frac{n^{b+d-1} - 1}{n^{b+d-1}}}^{\paren*{n^{b-1}}}$$
% $$1 - \frac{\paren*{n^{b+d-1} - 1}^{\paren*{n^{b-1}}}}{n^{^{n^{b-1} \cdot \paren*{b+d-1}}}}$$
%
% The properties of the Markov chain governing each of those random walks is well known:
% \begin{itemize}
% \item The probability of ending up at the right end\-/marker is $\frac{1}{n+1}$.
% \item The expected time of reaching either one of the end\-/markers is $n$ steps.
% \end{itemize}
%
% Repeating the random walks until the right end\-/marker is reached for $b$ consecutive times poses yet another Markov chain. The following analysis shows that the process is expected to take steps.
%
% Let $\tilde{n}$ denote the expected time of reaching either one of the end\-/markers in each random walk. Then;
%
% ANALYSIS OMITTED
%
% BURADA BIR HATA OLABILIR, BIRAZ DAHA DUSUNECEGIM
%
% SU AN RANDOM WALK ILE NASIL POLY-TIME-TIMER IMPLEMENT EDEBILECEGIMIZI COZMEYE CALISIYORUM. $n$'LIK VE $n^n$'LIK TIMERLAR YAPABILDIM AMA HENUZ $n^m$'I BECEREMEDIM.
% \qed %% LLNCS ONLY
\end{proof}
% \begin{theorem}
% Languages that can be verified using log\-/space, poly\-/time, and inf-public-coins in an IPS with a non-zero probability of error \uline{and perfect completeness} can also be verified using cons-private-coins instead of the log-space with arbitrarily low non-zero probability of error \uline{and perfect completeness}. This new verifier is also expected to run for at most a polynomial time, except for some other and independent arbitrarily low non-zero probability of error.
% \end{theorem}
The following corollary to \Cref{lem:dir1} depicts that the class $\NC$ has finite\-/state verifiers flipping a fixed number of private coins and with a tighter upper bound on their public coin budget compared to those for \PP.
% \Cref{lem:dir1,lem:dir2} together prove the following:
% \begin{theorem}
% \begin{multline*}
% \IP[0.7]{\lo\spa, \po\pex\tim, \po\pex\pub\ran} = \\
% \IP[0.7]{\co\spa, \po\pex\tim, \po\pex\pub\ran, \co\pri\ran}.
% \end{multline*}
% \end{theorem}
% !!!BUNA COROLLARY DESEK DAHA İYİ!!!! Dedik
\begin{corollary}
% AYNI SATIRA ALAYIM MI?yes!!!!!
% \begin{equation*}
$\NC \subseteq \IP{\co\spa, \co\pri\ran, \OH{n^4}\pex\pub\ran, \OH{n^4}\pex\tim}$.
% \end{equation*}
\end{corollary}
\begin{proof}
Fortnow and Lund have proven~\cite{FL93} that
\begin{equation}\label{eq:FL93NC}
\NC \subseteq \IP{\lo\spa, % \ze\pri\ran,
\OH{n\log^2n}\pub\ran, \OH{n\log^2n}\tim}.
% !!!!BUNA BİR DENKLEM NUMARASI VERELİM!!! verdim sanirim
\end{equation}
% !!!!0-private-coins mu? BAŞTA KOYDUĞUMUZ RACONA AYKIRI!!! Utkan: sildim
The verifiers described in~\cite{FL93} for the right\-/hand side of % !!!BENCE BU BİR EQUATION DEĞİL, HİÇ İSİM VERMEDEN (1) DE GEÇ!! o zaman \Cref'i \ref yaptim, oldu hmm parantezi yok...İYİ GECELER- iyi geceler hocam
\eqref{eq:FL93NC} have perfect completeness. One can apply the sequence of constructions described in the proof of \Cref{lem:dir1}, starting with such a verifier playing the role played by $V_1$ in that proof, to obtain the claimed result. %!!!!!BU DEDİĞİM DOĞRU MU?? O LEMMAYA BAKAN BİR VATANDAŞ TAK TAK GİDEREK BUNU ELDE EDİYOR DEĞİL Mİ?? SADECE t BUNA ÖZGÜ BİR DEĞER ALIYOR, RIGHT?!!! \utkanadd{Utkan: Evet, $t=2$ icin gecerli oluyor. $\OH{n\log^2n} \subseteq \OH{n^2}$ oldugunu not edebiliriz belki kolay anlasilsin diye, ve/veya ``$t=2$ icin'' diyebiliriz.}
% eger bir degisiklik olmadiysa eskiden oyleydi, tekrar bakiyorum
% (Bu dedigim sorun degilmis:) NE YAZIK KI OLMUS, ARTIK O LEMMA DOGRUDAN P ILE KIYAS YAPIYOR, IP'LER ARASI BIR KIYAS YOK
%
% Since $\log^2n\in \OH{n}$ by standard asymptotic analysis, we also have
% \NC \subseteq \IP[0.8]{\lo\spa, \ze\pri\ran, \OH{n^2}\pub\ran, \OH{n^2}\tim}.
%
% The claimed result then follows directly from \Cref{lem:dir1}.
% \qed %% LLNCS ONLY
\end{proof}
% NASIL???????????????
% \newcommand{\errloop}{\ensuremath{\err_{\text{loop}}}}
% \newcommand{\errpremature}{\ensuremath{p_{\text{long}}}}
\begin{lemma}\label{lem:dir2NEW}
%\begin{multline*}
$\IPhigh{\lo\spa, \co\pri\ran, \infty\pub\ran, \infty\tim}\subseteq \PP$.%\\
%\IP[0.9]{\lo\spa, \po\pub\ran, \po\tim}.
%\end{multline*}
% More specifically, for any integer $t > 1$,
%\begin{multline*}
% \IP[0.9]{\co\spa, \co\pri\ran, \OH{n^t}\pex\pub\ran, \OH{n^t}\pex\tim}\subseteq\\
% \IP[0.9]{\lo\spa, \OH{n^{t+1}}\pub\ran, \OH{n^{t+1}}\tim}.
%\end{multline*}
\end{lemma}
\newcommand{\verrdiff}{\ensuremath{\verr_x}}
\begin{proof}
Let $V_1$ be a log\-/space verifier that uses at most $r$ private coins and an unlimited budget of public coins to verify a language $L$ with some error bound $\verr_1 < \sfrac{1}{2}$, for some constant $r$. %The two
% \utkanrem{three}
% sub\-/types of errors that $V_1$ may commit are that
% \begin{itemize}
% \item it might fail to accept %\utkanrem{reject}
% a member of $L$ %when communicating with %an honest
% !!!!GALİBA TANIMIMIZA GÖRE BU DURUMDA HONEST DEMEYE GEREK YOK; HONEST OLMAK ZORUNDA ZATEN!!!! \utkanadd{Utkan: honesty bu noktada ne demek ki? ortada verifier'in niyetli/beklentili framework veren bir tanimi yok. "honest" yerine "as desired" gibi bir sey denebilir diye dusunuyorum. member inputlarla da hata yapabilen bir verifier icin mesela, prover koyulan framework'u abuse ederek (= dishonest (?)) kabul ettirme sansini arttiriyor olabilir, ama bu da hala "as desired", cunku verifier member input'u olabildigince yuksek olasilikla kabul etmek istiyor}
% the prover
% with some probability $\verracc_1$,
% \item it might fail to reject
% \utkanrem{be tricked to accept}
% a non\-/member of $L$ with some probability $\verrrej_1$.!!!!!BUNLARIN İKİSİNİN ARKASINA DA "<= epsilon1" YAZALIM MI???!!!!
% \item \utkanrem{it might be tricked to run forever when the input is not a member of $L$ with some probability $\verrloop_1$.}
% \end{itemize}
In the following, the prover that $V_1$ interacts with will be named $P_1$. The length of the input string is denoted by $n$.
% Let $V_1$ be a (single\-/head) constant\-/space verifier that uses at most $r$ private coins and an unlimited budget of public coins to verify a language $L$, for some constant $r$. $V_1$ may run forever with some small probability $\errloop$; excluding those cases, it runs in expected time $f_1(n) \in \OH{n^t}$ where $t > 1$. In the following, the prover that $V_1$ interacts with will be named $P_1$.
We will now demonstrate the existence of a log\-/space verifier $V_2$ that verifies the same language $L$ with an error bound close to that of $V_1$ without using any private coins. $V_2$ also has an unlimited budget of public coins. In a nutshell, $V_2$ will interact with its prover, which we name $P_2$, to simulate $V_1$ parallelly for all the $2^r$ different possible private random bit sequences. It will feed all of these simulations with the same public random bit sequence that it will generate on the fly, while checking that $P_2$ is not trying to cheat by supplying messages in a way that would be impossible for $P_1$ (which, unlike $P_2$, does not know the current configuration of the verifier it is communicating with),
% !!!! YENİ HALİ. OK İSE !!SIZLAŞTIR PLZ!!!!! %\utkanadd{UTKAN: Burada "impossible" cok havada kalmis, bir tur qualification (mesela yazdigim "in a way" veya "[impossible for $P_1$...] to do something" gibi bir sey) faydali olur.}
or by attempting to trick $V_2$ into an unnecessarily long conversation. $V_2$ will be operating a probabilistic clock to ensure that its expected runtime will be within %!!!!BU OMEGA DEĞİL DE O OLMALI; YANILIYOR MUYUM??
$2^{2^{\OHMEGAp{p(n)}}}$, for a suitably chosen polynomial $p$. %!!!!!!BU OMEGA MI BİR DAHA DÜŞÜNELİM EN SONUNDA!!!!!!!%$2^{2^{\OHMEGA{n}}}$.
When this timer finally runs out, $V_2$ will pick one of the parallel simulations at random to imitate $V_1$'s decision.
We now present a detailed discussion of each of these points.
%\utkanadd{UTKAN: ``sim'' ne demek, kendi içimizde netleştirelim. Bence sim = ``simulation of $S_i$.'' Metinde ``sim'' yazan yerlerde gezinip bu şekilde okuyunca garip olan yerlere düzeltme önerilerimi bırakıyorum.}
\paragraph{The interaction between $V_2$ and $P_2$.} Let $\bin_r(i)$ denote the $r$\=/bit binary representation of the natural number $i \in \Set{0, \dotsc, 2^r - 1}$ (padded with $0$'s from left as needed). As mentioned above, $V_2$ will be running $2^r$ parallel simulations (``sims'') of $V_1$, where the \ith{i} simulated verifier $S_i$ %employs the \ith[st]{\paren*{i+1}} head of $V_2$, and
% \utkanadd{UTKAN: Burada $S_i$ isimlerini simülasyonlara vermişiz. Ama aşağıda $S_i$'ler doğrudan simülasyondaki verifier'ın ismiymişçesine initial state'inden bahsediyoruz, $P_1$'den kendilerine sembol gönderiyoruz. Algoritmayı yazarken de bu $S_i$ ismini (aşağıdaki gibi) simüle edilen verifier'ların adı olarak kullanmak istiyorum ama burada verifier'ın değil de simülasyonun adı olarak tanımlanmış olmaları tutarsız ve bundan ötürü yanlış hissettirdi.}
is hardwired to use the bits of $\bin_r(i)$ as its private ``random'' bits. More formally, for each non\-/halting state $q$ of $V_1$,
each $S_i$
has $r+1$ states of the form $(q,\pi)$, one for each postfix $\pi$ of $\bin_r(i)$ to keep track of the remaining unused bits. % \utkanadd{UTKAN: Bu $p$'leri de $\pi$ yapmaya ne dersiniz? !!!!İSTİYORSAN YAP; PRIME'LILYA GEREK YOK!!!!!!!! Eğer sonraki $\pi$'den farklı olsun diyorsanız, sonraki $\pi$'yi $\pi'$ da yapabiliriz.}
The initial state of $S_i$ is the pair consisting of the initial state of $V_1$ and $\bin_r(i)$ itself. For each transition of $V_1$ that emanates from a state $q$, consumes a private random bit $\bpri\in\Set{0, 1}$, and enters some state $q'$, $S_i$ has corresponding transitions emanating from each state of the form $(q,\bpri\pi)$ (where $\pi$ is a proper postfix of $\bin_r(i)$), employing no private coin, and entering state $(q',\pi)$. % \utkanadd{UTKAN: $V_1$'in private coin atan $q$ state'leri için $(q, \estring)$ tipi state'lerden şu an hiç transition çıkmıyor ama Sec2.1'deki makine tanımımız gereği çıkmalı. Unreachable oldukları için nereye gittikleri önemli değil ama yine de herhalde reject state daha sağduyulu bir seçim.!!!!DOĞRU AMA BURADAKİ MUHABBETİN DETAYINDA GEREKSİZ GİBİ GELDİ BANA!!!!!!! UTKAN: Bence şu veya bu şekilde tanımlanmaları şart. Paragrafın sonuna bir öneri bıraktım. Her alternatif benim için ok (mesela "tanımsız bırakılan her transition reject state'e gider" de denebilir), yeter ki makine modeline uygun şekilde tanımlı olsun.}
(Each such $S_i$ transition mimics every other aspect, \eg{}, communication symbols, input and work tape head actions, etc.\
% \utkanadd{UTKAN: ``etc.'' İngilizce bir kelime sayılır mı yoksa yabancı bir kelime mi?!!!! DİZGİCİLER DÜŞÜNSÜN??!!!!!}
of the corresponding $V_1$ transition faithfully.) Transitions of $V_1$ that do not consume private random bits are simulated by transitions of $S_i$ that do not change the second component of the machine's state. $V_1$\=/transitions entering halting states are mimicked by $S_i$\=/transitions entering the unique accept and reject states of $S_i$.
% !!! YENİ CÜMLE!!! \utkanadd{Çok iyi, teşekkür ederim}
$S_i$\=/transitions emanating from (unreachable) states of the form $(q, \estring)$, where $q$ is a private\-/coin\-/tossing state of $V_1$, are directed to the reject state. % of $S_i$ that are left to define are those going out of the states \utkanalt{where a private\-/coin\-/tossing state of $V_1$ is paired with the empty string}{$(q, \estring)$ where $q$ is a private\-/coin\-/tossing state of $V_1$}, which are unreachable due to the private coin budget of $V_1$. For completeness, those transitions are mapped to the reject state of $S_i$.}
% \utkanadd{!!!!!!!YUKARI YAZDIĞIM OK İSE BU MAVİ KISIM UÇSUN!!!!!!
% consists of $r+1$ copies of $V_1$, one for each prefix of $i$'s $r$\=/bit binary representation (padded with $0$'s from left as needed). The initial state of $S_i$ is the initial state of the copy that corresponds to the longest prefix, \ie, the entire binary representation. Transitions in each copy mimics the original and stays within the copy, except for the transitions that use a private random bit. For a copy corresponding to the prefix $b\pi$ where $b$ is in $\Set{0, 1}$, its transitions consuming $b$ as the private random bit and terminating at state $t$ are modified \begin{enumerate*}[label=(\roman*)]
% \item to terminate at the state that corresponds to $t$ in the copy corresponding to the prefix $\pi$ and
% \item to not consume any private random bit in doing so,
% \end{enumerate*} whereas the sibling transitions that consume $1-b$ as the private random bit are removed. In the copy for the prefix $\estring$, transitions emanating from private coin tossing states (which are unreachable due to definition of $V_1$) are rewired to terminate at the reject state of that copy. To comply with the definition of verifiers, all copies of the accept (resp.\ reject) states are mapped to a new accept (resp.\ reject) state of $S_i$.}
At each step of its interaction with $V_2$, $P_2$ is supposed to supply the responses that $P_1$ would supply to each sim at the corresponding point, according to the convention that will be explained below. Whenever $V_2$ is ready to receive the next $P_2$ symbol, it will use the communication cell to indicate this. As we will see, $V_2$ will flip public coins in some, but not necessarily all, of its communication steps.
The execution of $V_2$ (\Cref{alg:privatecoinsimulator}) proceeds in \emph{stages} delimited by its (public) coin flips. Each stage consists of one or more \emph{segments} delimited by communication steps.
Originally starting each $S_i$ from its initial configuration, $V_2$ proceeds in each segment by going through all the $S_i$'s sequentially,\footnote{Note that $V_2$'s logarithmic\-/space budget is sufficient to trace the executions of all the $2^r$ sims and store the configurations of those that are paused.} continuing the simulation of each $S_i$ until that sim has accepted, rejected, entered a communication state, or is determined to have entered an infinite loop. (Note that there exists a polynomial $f$, % \utkanadd{UTKAN: $q$ ismini stateler için de kullandığımız için çakışıyorlar.}!!!! LÜTFEN SAKINCASIZ BİR İSİM BULUP HER YERDE UYGULA!!!!
dependent on $V_1$, such that a sim that runs for more than $f(n)$ steps without entering a communication state must be in an infinite loop. $V_2$ has sufficient memory to count deterministically up to $f(n)$, which is simply the number of different possible configurations of $V_1$ on the present input string.) If no sims are in a communication state at the end of this scan of the $S_i$'s, %\utkanadd{UTKAN: aitlik belirten 's gibi durmasin diye ``sims'' desek?}
the overall simulation has finished. Otherwise, one or more sims are ``waiting'' for a response from the prover, and therefore $V_2$ should request the next $P_2$ symbol.
% \newcommand\rb{\ensuremath{R}}
% \newcommand\ihp{\ensuremath{\mathit{ITHI}}}
% \newcommand\whp{\ensuremath{\mathit{WTHI}}}
% \newcommand\wtc{\ensuremath{\mathit{WTC}}}
% \newcommand\conf{\ensuremath{C}}
% \newcommand\status{\ensuremath{\mathit{STATUS}}}
% \newcommand\readystatus{\ensuremath{\mathit{NONCOMM}}}
% \newcommand\accstatus{\ensuremath{\mathit{ACC}}}
% \newcommand\rejstatus{\ensuremath{\mathit{REJ}}}
% \newcommand\commstatus{\ensuremath{\mathit{COMM}}}
% \newcommand\commset{\ensuremath{\mathit{COMMSET}}}
% \newcommand\flipstatus{\ensuremath{\mathit{FLIP}}}
% \newcommand\flipset{\ensuremath{\mathit{FLIPSET}}}
% \newcommand\loopstatus{\ensuremath{\mathit{LOOP}}}
% \newcommand\timer{\ensuremath{\mathit{TIMER}}}
% \newcommand\segmentcounter{\ensuremath{\mathit{SEGMENT\mhyphen{}COUNTER}}}
% \newcommand\booleanvar{\ensuremath{T}}
% \newcommand\headindexcounter{\ensuremath{H}}
% \newcommand\bitsof[2]{\ensuremath{\mathit{BITSOF}_{#1}\paren*{#2}}}
% \newcommand\partitions{\ensuremath{\mathit{PARTITIONS}}}
% For completeness, we will give a step\-/by\-/step description of $V_2$'s algorithm below. Let $V_2 = \paren*{Q_2, \Sigma_2, \Phi_2, \Gamma_2, \delta_2, q_{2,0}}$ and \Qpub[2], \Qcom[2], $\Set{\qacc[2], \qrej[2]}$ be the respective subsets of $Q_2$.
% Let $V_1 = \paren*{Q_1, \Sigma_1, \Phi_1, \Gamma_1, \delta_1, q_{1,0}}$ and \Qpri[1], \Qpub[1], \Qcom[1], $\Set{\qacc[1], \qrej[1]}$ be the respective subsets of $Q_1$.
% Moreover, since $V_2$ uses only public random bits, any further communication from $V_2$ is redundant to $P_2$, given that $P_2$ is also assumed to know the algorithm of $V_2$ (see \Cref{subs:vers}). Thus, without loss of generality, we assume that $V_2$ always communicates the blank symbol $\blanksymb$ when it wants to communicate with $P_2$.
% For numbers $r$ and $N$ satisfying $0 \leq N < 2^r$, let $\bitsof{r}{N}$ be the sequence of $r$ bits corresponding to the number $N$ in binary, padded with zeroes from the left for as much as needed, \ie,
% \begin{equation*}
% \bitsof{r}{N} = \paren*{b_{r-1}, \dotsc, b_0}, \text{ such that } N = \sum_{i = 0}^{r-1} \paren*{b_i \cdot 2^i}.
% \end{equation*}
% For inputs of length $n$, let $q(n)$ be the number of distinct configurations $V_1$ has, and $g(n)$ be the number of distinct collective configurations for $2^r$ copies of $V_1$. Then, we have
% \begin{equation*}
% q(n) \le \abs{Q_1} \cdot \abs{\Phi}^{k_{\mathrm{space}} \cdot \log_2 n} \cdot \abs{\Gamma} \cdot (n + 2) \cdot \paren*{k_{\mathrm{space}} \cdot \log_2 n},
% \end{equation*}
% where $k_{\mathrm{space}}$ is some constant that exists due to $V_1$ being a log\-/space machine. We then also have
% \begin{equation*}
% q(n) \le k_1 \cdot n^{2^{k_2}},
% \end{equation*}
% for some integer constants $k_1$ and $k_2$.
% Let $f(n)$ be the number of distinct configurations $V_1$ has for inputs of length $n$. Then, we have
% \begin{equation*}
% f(n) \le \abs{Q_1} \cdot \abs{\Phi}^{k_{\mathrm{space}} \cdot \log_2 n} \cdot \abs{\Gamma} \cdot (n + 2) \cdot \paren*{k_{\mathrm{space}} \cdot \log_2 n},
% \end{equation*}
% where $k_{\mathrm{space}}$ is some constant that exists due to $V_1$ being a log\-/space machine. We then also have !!!k1'e NE GEREK VAR??!!! \utkanadd{UTKAN: Üstteki ifadede sabit katsayılar var. ``$k_2$'yi yeterince büyük seçer, sindirtiriz'' diyemeyiz, $n = 1$ için $k_2$ zaman zaman ($\abs{Q_1}$ ve $\abs{\Gamma}$ yeterince büyükse) yetersiz kalacaktır. (Yukarıdaki ifade tam doğru değilmiş bu arada. Work tape uzunluğunu $k_{\mathrm{space}} \cdot \log_2 n$ olarak almamalıymışım, additive sabit de olmalıymış (yoksa $n = 1$ için work tape "0 uzunluğunda" oluyor). Hatta sanırım $k_1$'in yanı sıra additive sabite de ihtiyaç var... 2'nin kuvveti olmaları meselesi ise algoritmada bu sayıları work tape'e yazmak üzere hesap etmesi kolay olsun diyeydi.)}
% \begin{equation*}
% f(n) \le 2^{k_1} \cdot n^{2^{k_2}},
% \end{equation*}
% for some integer constants $k_1$ and $k_2$. Furthermore, let $g(n)$ be the number of distinct collective configurations for $2^r$ copies of $V_1$ for inputs of length $n$. Then, we have
% \begin{equation*}
% g(n) = f(n)^{2^r},
% \end{equation*}
% and therefore
% \begin{align*}
% g(n) \le \paren*{2^{k_1} \cdot n^{2^{k_2}}}^{2^r}.
% \end{align*}
% \ie, $q(n) \in \OH{n^2 \cdot \log n}$)
% The blueprint of $S_i = \paren*{Q_{S,i}, \Sigma, \Phi, \Gamma, \delta_{S,i}, q_{S,i,0}}$ is given as follows:
% \begin{align*}
% Q_{S,i} &= Q_1 \times \prefix{\bitsof{r}{i}}\\
% q_{S,i,0} &= \paren*{q_{1,0}, \bitsof{r}{i}},
% \end{align*}
% and its transition function is defined in parts, as follows:
% \begin{table}[H]
% \centering
% \caption{Parts of the verifier's transition function.}\label{tab:privcoinsimulatortransitions}
% \renewcommand*{\arraystretch}{1.4}
% $$
% \begin{array}{l l}
% \text{\textbf{Case}} & \text{\textbf{Mapping}}\\\midrule
% q \in \Qpub &
% \delta_{S,i}\paren{q,\sigma,\phi,\gamma,\bpub} =
% \paren{q',\phi',\gamma',d_i,d_w}\\
% %
% q \in \qneg{\Qpub} \cap \Qcom &
% \delta\paren{q,\sigma,\phi,\gamma} =
% \paren{q',\phi',\gamma',d_i,d_w}\\%\midrule
% %
% q \in \qneg{\Qpub} \cap \qneg{\Qcom}
% \setminus \Set{\qacc, \qrej} &
% \delta\paren{q,\sigma,\phi,\gamma} =
% \paren{q',\phi',d_i,d_w}%\\\bottomrule
% \end{array}
% $$
% \end{table}
% \begin{turing}{V_2}{On input $w$ (assuming $n = \abs{w}$ is a power of $2$ for simplicity):}
% \item Mark the first cell of the work tape with an overlay symbol.
% \item Initialize $2^r$ copies of simulation for $V_1$'s interaction with $P_1$. Let $S_0, \dotsc, S_{2^r-1}$ denote the verifiers of those simulations. For each $S_i$, keep its configuration composed of its state $q_i$ (initially $q_{1,0})$, work tape content $\wtc_i$ (initially $\blanksymb^{\log n}$), communication cell content $\gamma_i$ (initially $\blanksymb$), input tape head index $\ihp_i$ (initially $0$), and work tape head index $\whp_i$ (initially $0$); moreover, $S_i$'s sequence of remaining ``hardwired private random bits'' as $\rb_i$ (initially $\bitsof{r}{i})$ and the status of its simulation as $\status_i$, which can be either one of \readystatus{}, \accstatus{}, \rejstatus{}, \commstatus{}, \flipstatus{}, or \loopstatus{}, and is initially \readystatus{}.
% \item Evolve the simulations in ``stages,'' by repeating the following until a halting command is reached:
% \bitem{For $i = 0, \dotsc, 2^r-1$, if $\status_i = \readystatus$, advance the simulation of $S_i$ for a ``stage'' by doing the following:}
% \bbitem{Initialize a timer $\timer$ as $k_1 \cdot n^{2^{k_2}}$ by doing the following:}
% \bbbitem{Set $\timer$ to $0$.}
% \bbbitem{Increment $\timer$ one\-/by\-/one while scanning $w$ from left to right, which finally reads as a power of $2$ in binary. The number of steps this takes is in \OH{n} by a result of amortized analysis~\cite{G20b}.}
% \bbbitem{Do the following $k_2$ times:}
% \bbbbitem{Mark all the zeros in $\timer$. The number of steps this takes is in \OH{\log n}.}
% \bbbbitem{For all the marked zero in $\timer$ (the number of which is in the order of \OH{\log n}), do the following:}
% \bbbbbitem{Remove the mark on the zero and append a zero to $\timer$. The number of steps this takes is in \OH{\log n}.}
% \bbbitem{Replace the leading $1$ with the binary representation of $k_1$.}
% \bbitem{Continue the simulation of $S_i$ by repeatedly doing the following, so long as $\status_i$ is $\readystatus$:}
% \bbbitem{Decode the symbol under $S_i$'s input tape head by doing the following:}
% \bbbbitem{Make a copy of $\ihp_i$ as \headindexcounter{}. The number of steps this takes is in \OH{\log n}.}
% \bbbbitem{Move the input head to $\lend$. The number of steps this takes is in \OH{n}.}
% \bbbbitem{Decrement \headindexcounter{} while moving the input head to right, until \headindexcounter{} becomes $0$. The number of steps this takes is in \OH{n}.}
% \bbbbitem{Make note of the symbol under the input tape head as $\sigma$.}
% \bbbitem{Decode the symbol under $S_i$'s work tape head by doing the following:}
% \bbbbitem{Make a copy of $\whp_i$ as \headindexcounter{}. The number of steps this takes is in \OH{\log \log n}.}
% \bbbbitem{Move the input head to $\lend$. The number of steps this takes is in \OH{n}.}
% \bbbbitem{Decrement \headindexcounter{} while moving the input head to right, until \headindexcounter{} becomes $0$. The number of steps this takes is in \OH{\log n}.}
% \bbbbitem{Move the work tape to the left end of $\wtc_i$. The number of steps this takes is in \OH{\log n}.}
% \bbbbitem{Move the work tape head to the right along the symbols of $\wtc_i$ while moving the input head to $\lend$. The number of steps this takes is in \OH{\log n}.}
% \bbbbitem{Make note of the symbol of $\wtc_i$ that the work tape head is currently on as $\phi$.}
% \bbbitem{Use $\delta_1\paren*{q_i, \sigma, \phi, \gamma_i}$ to obtain $\paren*{q', \phi', d_i, d_w}$. Update $q_i$ with $q'$.}
% \bbbitem{Change the symbol of $\wtc_i$ that the work tape head is currently on into $\phi'$.}
% \bbbitem{Adjust $\ihp_i$ by $d_i$. The number of steps this takes is in \OH{\log n}.}
% \bbbitem{Adjust $\whp_i$ by $d_w$. The number of steps this takes is in \OH{\log \log n}.}
% \bbbitem{Decrement \timer. The number of steps this takes is in \OH{\log n}.}
% \bbbitem{If $q_i = \qacc$, set $\status_i$ to $\accstatus$. If $q_i = \qrej$, set $\status_i$ to $\rejstatus$. If $q_i \in \Qcom[1] \cap \qneg{\Qpub[1]}$, set $\status_i$ to $\commstatus$. If $q_i \in \Qpub[1]$, set $\status_i$ to $\flipstatus$. If $\timer = 0$, set $\status_i$ to $\loopstatus$.}
% \bbitem{Double exponential timer tick!}
% \end{turing}
\begin{algorithm}[htb]
\begin{turinglist}%{V_2}{On input $w$:}
\titem{Initialize simulations of $S_0, \dotsc, S_{2^r-1}$ (the sims).} % Keep their configurations.
\titem{Initialize the \emph{communication partition} (that will keep track of groups of sims with identical communication transcripts) with all sims in the same block.} %Keep lists of sims that have (so far) communicated identically against $P_1$ as ``communication partitions.''
\titem{Initialize the Boolean variable to be used by the \TICK{} subroutine that will implement the timer.}
\titem{Repeatedly execute the following until the timer runs out: (Each iteration of this loop carries out one \emph{stage} of the protocol, as defined in the text.)} %Iterate sims collectively in stages until each one is halted or determined to be looping, for up to $2^{2^{p(n)}}$ expected stages tracked via the \TICK{} subroutine, as follows:
\begin{turinglist}
\titem{Initialize the \emph{segment counter} to $0$.}
\titem{Execute the following until each sim is labeled as halted, looping, or waiting for a coin toss:} % !!!PARANTEZ İYİ DEĞİL. LABEL'LARI İTALİK FALAN MI YAZSAK DEDİM AMA WAITING OLAN BİRDEN FAZLA KELİME OLDUĞU İÇİN GÜZEL OLMAZ!! \utkanadd{UTKAN: Parantez, olası labelların bu üçünden ibaret olduğunu belirtmek içindi. Bunu ayrı bir yerde de belirtebiliriz, mesela algoritmanın tepesinde (Alg1'deki gibi). Belirtmemek de bir seçenek. Ama belirtirsek daha sonra uzun uzun "not labeled as 1, 2, or 3" demek yerine "not labeled" diyerek kısaltabiliyoruz.}!!!!!!BANA PARANTEZ SEMBOLLERİNİ SİLMEK ANLAMI ASLA DEĞİŞTİRMEZ GİBİ GELİYOR!!!!!!! \utkanadd{Cümlenizi anlayamadım. Bu noktada bir sorun yok aslında, elzem olmayan bir iyileştirme önerisi: "Algoritmada kullanılacak labellar sadece 'halted', 'looping' ve 'waiting for a coin toss' labellarıdır." bilgisini herhangi bir yere yazarsak iyi olabilir diye düşündüm. Bu birinci önerinin üstüne, ama paket olarak değil, ayrı bir öneri olarak: Bu verdiğimiz bilgiyi kullanarak algoritmadaki bazı cümlelerimizi kısaltabiliriz. Önerilerim doğru anlaşıldıktan sonra "ikincisini ..." veya "hiçbirini yapmayalım" derseniz benim için hiç sorun değil.}!!!!ANLAŞTIK!!} % Iterate sims collectively in segments until each one is halted, determined to be looping, or waiting for a public coin toss, for up to $g(n)$ segments tracked via counting, as follows:}
\begin{turinglist}
% \titem{Increment the segment counter and \reject{} if its value exceeds $g(n)$.}
\titem{For each $S_i$ that is not labeled as halted, looping, or waiting for a coin toss, do the following:}
\begin{turinglist}
\titem{Proceed with $S_i$'s simulation %\utkanrem{(within a time limit of $f(n)$ steps)}
until it halts, enters a communication state, or runs for more than the time limit of $f(n)$ steps without entering a communication state. If $S_i$ has halted or exceeded the limit, label it as halted or looping, respectively. If $S_i$ has entered a coin\-/tossing state, label it as waiting for a coin toss.}
\end{turinglist}
\titem{Advance any unlabeled sims (every such sim is in a non\-/coin\-/tossing communication state) %\utkanadd{UTKAN: Takip edebildiysem sadece ``[any sims that are] not labeled'' da denebilir.}
for one more transition, refine the communication partition by arranging sims transmitting different symbols %!!!DEĞİŞMİŞ HALİ!!! \utkanadd{Çok teşekkürler, ellerinize sağlık, çok iyi olmuş}
into different blocks, and prompt $P_2$ to provide the corresponding responses.} %!!!OK????!!!
% \bbitem{!!!!ÖNCESİ OKSE BURAYI SİL!!!Break down the communication partitions by whether sims have just made a communicating transition, and if so, by the symbol sims wish to have communicated.}
\titem{Use the communication partition to check whether $P_2$ has attempted to give different responses to sims in the same block. If such a violation is detected, \reject{}. Otherwise, update the configurations of the communicating sims with the new responses.} %!!!OK!!!?
\titem{Increment the segment counter.}
\titem{If the value of the segment counter has exceeded $g(n)$, label all as yet unlabeled sims as looping.}
\end{turinglist}
\titem{Toss a public coin. Using its outcome, advance all sims that have been waiting for a coin toss %\utkanadd{= (işi bitmemiş) bütün simler, qualification hafiften redundant.}
for one more transition. Unlabel those sims.}
\titem{Refine the communication partition by arranging sims with different communications % !!!DEĞİŞTİ!!!
% \utkanadd{UTKAN: Burası da Stage 10'daki gibi. Oraya parantez içinde açıklama eklenirse burası olduğu gibi kalabilir.}
into different blocks.} % \utkanadd{UTKAN: Bu maddeyi Stage 10'daki gibi üsttekiyle birleştirelim mi? Tabii Stage 12'de "toss a public coin" ve "unlabel those sims" biraz farklı, gözden kaçmamaları önemli, ama kaçmaz herhalde.} %!!!!ÖNCESİ OKSE SONRAYI SİL!!!!Break down the communication partitions by whether sims have just made a communicating transition, and if so, by the symbol sims wish to have communicated.
\titem{Use the communication partition to check whether $P_2$ has attempted to give different responses to sims in the same block after the last coin toss. If such a violation is detected, \reject{}. Otherwise, update the configurations of the unlabeled sims % \utkanadd{UTKAN: ``Label'ı kaldırılmış'' mı demek istiyorsak ``de-labeled'' denebilir belki. ``Unlabeled'' eskiden beri label'ı olmayanları da kapsar (ama Stage 12'de dediğim gibi, Stage 12'deyken bütün sim'lerin label'ı vardı, o sebeple de-labeled ve unlabeled burada aynı şeye denk düşüyor).}
with the new responses.} %!!!OK!!!?
%For sims that just communicated, get their replies from $P_2$ and update their configurations. Verify that sims of same communication partition receive same replies.}
\titem{Call the \TICK{} subroutine.}
\end{turinglist}
\titem{Toss $r$ public coins and accordingly choose an $S_i$ at random. If $S_i$ has rejected or is labeled as looping, \reject. Otherwise, \accept.}
\end{turinglist}
\caption{A log-space verifier $V_2$.}
\label{alg:privatecoinsimulator}
\end{algorithm}
At this point, it may be the case that some sims are waiting in (communication) states that flip a public coin, whereas some other sims are in communication states that do not flip a coin. Since $V_2$ is designed to present the same public coin sequence to every sim, it performs a coin flip (which ends the present stage) only if \emph{all} the waiting sims are in coin\-/flipping states. Otherwise, $V_2$ flips no coin during its request to $P_2$; in this case, the sims waiting at coin\-/flipping states will be suspended in the subsequent segments of this stage, until the occurrence of the flip.
In response to $V_2$'s request, $P_2$ is supposed to provide a $2^r$\=/tuple whose \ith{i} element is the symbol that $P_1$ would send to $S_i$ if $S_i$ is a waiting sim that $V_2$ is going to continue simulating in the next segment, and a filler symbol %\utkanadd{UTKAN: ``null symbol'' tanim gerektirmeksizin anlamli bir terim mi?}!!!!!!!!BENCE ÖYLE? BLANK'İ BAŞKA İŞ İÇİN KULLANDIK SANKİ!!!
otherwise. (Since $V_2$ employs no private coins, $P_2$ has complete information about all of the sims' configurations, as well as all the communication symbols any sim would have transmitted had it been interacting with $V_1$, at this point.) $V_2$ performs some additional controls (to be detailed below under separate headings) upon receipt of this symbol, rejecting if it detects a ``cheating'' attempt by $P_2$ at this juncture.
After the single coin flip at the end of each stage, $V_2$ calls the %``double exponential timer tick''
\TICK{} subroutine, described in \
\Cref{sec:clock}.\footnote{$V_2$ flips % \utkanrem{up to}
polynomially many additional public coins for each such subroutine call. $P_2$ waits for the subroutine to finish and the next stage of $V_2$'s execution to resume.} %\utkanadd{UTKAN: Bu tırnak içindeki ismi nerede kullanıyoruz? Neye refer ettiğimiz iyi anlaşılıyor mu? Timer'ın tanıtıldığı yerde isimlendirmemiş gibiyiz, bir isim verip o isimle mi seslensek?}
% !!!!OLMUŞ MU? IF SO, !!'SIZLAŞTIRALIM !!!! \utkanadd{UTKAN: İsmin sabitlenmesi iyi olmuş. Ancak isimden "timer" kelimesi yok olunca hemen sonra gelen cümledeki "timer" tabiri biraz havada kalmış. İsmi TIMER TICK olarak değiştirmek bir çözüm olabilir. Veya "If the timer the TICK emulates does not run out in this call, ..." denebilir.}
If the timer does not run out at this tick, simulation proceeds with the next stage. If the timer does run out, $V_2$ considers the overall simulation finished.
When the overall simulation is finished, $V_2$ flips $r$ more coins to select one of the sims. %!!!EKLEME!!! \utkanadd{Teşekkürler}
(Essentially, where $V_2$ chooses a single computation branch randomly in private during its execution, $V_3$ simulates all those $2^r$ branches publicly and then chooses one of them at the very end.) If the selected sim has been determined to have rejected, or to have entered an infinite loop, $V_2$ \rejects. Otherwise, %\utkanadd{UTKAN: ``actually unfinished but considered finished'' simlerin de buna girdigini ekstradan not etmekte fayda olabilir mi?}, !!!!AZ SONRA BUNU DİYORUZ ??!!!!!
it \accepts.
\paragraph{Members of $L$ are accepted by $V_2$ with sufficiently high probability.} Consider an intermediate verifier $V'_1$, which is obtained by modifying $V_1$ so that it calls the same \TICK{} %\utkanadd{UTKAN: iki ust paragrafta ``timer tick'' denmis, burada ``time clock tick'' denmis}
subroutine that we mentioned above in $V_2$'s description after every actual public coin toss of $V_1$ to determine whether it should time out and accept. Since the only difference between $V_1$ and $V'_1$ is that $V'_1$ may accept some input strings (which can get involved in very long computations that are cut off by the timer) with higher probability than $V_1$, $P_1$ is clearly able to convince $V'_1$ to accept any member of $L$ with probability at least $1-\verr_1$.\footnote{Strictly speaking, $V'_1$ faces a slightly different prover that imitates $P_1$ faithfully, pausing this procedure only to wait for the coin tosses of the \TICK{} subroutines to be completed.} We claim that $P_2$ will be able to convince $V_2$ to accept any member of $L$ with the same probability, by simply obeying the protocol described above and transmitting precisely the symbols that $P_1$ would have transmitted in response to communications from $V_1$ at every step: In this case, $P_2$'s interaction with $V_2$ would be a perfectly faithful imitation of $P_1$'s interaction with $V'_1$, with identical probabilities of acceptance, determined by the public coins flipped during the simulations, and the $r$ final public random bits that stand for the $r$ private coin flips of $V'_1$.
\paragraph{$P_2$ cannot trick $V_2$ into looping forever within a stage.} We have already noted that each sim can have at most $f(n)$ different configurations, for some polynomial $f$.
Consider the $2^r$\=/tuple consisting of the configurations of all the sims, which we will refer to as the ``collective configuration''. Clearly, the number of different possible collective configurations is $g(n) \in \OH{f(n)^{2^r}}$, which is another polynomial in $n$. Considering the collective configurations at the end of each segment, a stage which has continued for more than $g(n)$ segments must have therefore repeated an end\-/of\-/segment collective configuration. Note that, within any particular stage of the execution of $V_2$, $P_2$ has complete, deterministic control of the evolution of the collective configuration between subsequent communication steps, through the responses it sends. This would give a malevolent prover a chance to trick the verifier into looping forever within a stage. Since any ``honest'' prover\-/verifier interaction that eventually terminates with the verifier reaching a halting state can be shortened to avoid all such collective configuration repetitions without changing the outcome, $V_2$ expects $P_2$ to respect this convention, and concludes any stage that is seen to contain more than $g(n)$ segments by labeling any active sims that have not reached a coin-flipping state by that time as looping. % !!!BU CÜMLE DEĞİŞTİ!!!! \utkanadd{Sadece sonunu değiştirerek çözebileceğimizi sanmıyordum ama olmuş (meğer önceki cümleler hep ince qualify edilmiş), teşekkürler}
\paragraph{$P_2$ will be caught if it does not mimic $P_1$.} As noted above, $P_2$ has complete information about all the sims that it is communicating with. This is quite different than the situation of $P_1$, which does not see the private bits of the verifier. It is sometimes possible for $P_1$ to deduce information about the private random bits used by $V_1$ by noting the communication symbols that it transmits during the interaction, but $P_1$ has no way of distinguishing two probabilistic branches of $V_1$ corresponding to distinct private coin sequences that have the same communication transcript, \ie, that have both communicated exactly the same string of symbols, punctuated with public coin flips in identical locations, up to the present point. This presents a devious $P_2$ an opportunity to attempt to achieve a lower rejection probability than $P_1$ by transmitting different messages to sims that would be indistinguishable to (and would therefore have to receive the same message from) $P_1$. As a countermeasure, $V_2$ maintains an up\-/to\-/date list of groups of sims that should be presently indistinguishable to $P_1$, and \rejects{} whenever it sees that the $P_2$ symbol is trying to convey different messages to different sims in the same group. As a result, any interaction where $P_2$ attempts to send messages that are not ``$P_1$\=/compliant'' in this sense leads to rejection with probability $1$.
% can operate similarly to keep the runtime of each sim throughout the entire simulation without resetting, limiting it to \OH{n^{t_2}}.
% the simulation of each $S_i$, $V_2$ will use
% , to constrain the runtime by some polynomial $c \cdot n^t$, which is ought to be enough (as will be proven below) for the prover demonstrate membership
\paragraph{Double exponential runtime is enough for $V_2$ to reject non\-/members of $L$ with sufficiently high probability.} It remains to analyze the probability that $V_2$ fails to reject a non\-/member of $L$. Since $P_2$ is unable to make $V_2$ loop forever, and any attempt to deviate from the protocol described above would be caught, all we need to focus on is the additional error possibly introduced by $V_2$ cutting off sims with very long computations, and regarding them as having accepted. %Fortunately, Condon and Lipton have shown~\cite{CL89,C93b} that a verifier whose space consumption is logarithmically bounded \utkanadd{UTKAN: CL05/th6.1 bunu 2pfa private-coin verifierlar icin soyluyor, C93b/th6 bunu log-space public-coin verifierlar icin en basta parantez icinde gecistirilen bir argumanla soyluyor (ustelik double-exponential da degil yeterince buyuk bir exponential'in yeterli olacagini soyluyor); log-space private-coin verifierlar icin bunu soyleyen yer neresi?} halts \utkanadd{UTKAN: halt edecegini degil de ``benzer bir hata ile bu kadar surede halt eden bir versiyonun yapilabilecegini'' soyluyorlar, degil mi?} with high probability in double exponential time.
Fortunately, Condon and Lipton have shown~\cite{CL89,C93b} that the execution of a verifier whose space consumption is logarithmically bounded can be cut off after a double\-/exponentially large number of steps without a significant change in the acceptance and rejection probabilities.\footnote{The verifier model in~\cite{CL89} uses only private coins. The validity of this result for our verifiers is a simple consequence of the argument in the proof of \Cref{lem:privatesimulatespublic}.} %Theorems~6.1, 6.2, and 6.3
By the reasoning in the proof of Theorem~6.1 of~\cite{CL89}, for any desired small positive value of $\verrdiff$, there exists a polynomial %\utkanrem{$p(n)$} \utkanadd{
$p$ such that the log\-/space verifier $V_1$ will have rejected any non\-/member input string of length $n$ with probability at least $1-\verr_1-\verrdiff$ within at most $2^{2^{p(n)}}$ computational steps. By tuning the parameters (\Cref{sec:clock}, \Cref{sec:dir2appendices}) of the double exponential timer, we can therefore set the error bound of $V_2$ to any desired value in the interval $\paren*{\verr_1, \sfrac{1}{2}}$. %\utkanadd{UTKAN: $0.5$ yazsak ifadenin acik aralik oldugu daha kolay anlasilir mi?}.!!!INTERVAL DEDİM!!!
% !!!BURADA BİR SATIR BOŞLUK OLMASI HAYIRLI OLUR!???!!!!!!!!!!!!!! \utkanadd{UTKAN: Bir boşluk koydum ama diğer \texttt{\textbackslash paragraph\{...\}} boşluklarıyla aynı miktarda değil. Ne yazık ki "diğerleriyle aynı miktarda boşluk koy" diye bir şey yazmak da mümkün gözükmüyor. Sadece bizim bu dosya için o boşluğun ne kadar olduğunu tespit edip aynı miktarda koyabilirim (ama başka bir formata geçince oradaki boşluk farklılaşırsa bu hala aynı kalır), hatta hemen aşağıda, comment-out edilmiş bir şekilde o alternatif duruyor.}
% \bigskip
% \vspace{3.25ex plus 1ex minus .2ex}
\paragraphEnd{}
We conclude the proof by noting that the language $L$ verified by $V_2$ is in $\PP$, due to the fact that
\begin{equation*}
\IPhigh{\lo\spa, \infty\pub\ran, \infty\tim} = \PP,
\end{equation*}
% !!!!!!!!!!LÜTFEN BUNU YILDIZSIZ IP YAPALIM!!!!!!!!!!!! %\utkanadd{Utkan: yaptim}
% $\IP[0.9]{\lo\spa, \po\pub\ran, \po\tim}\subseteq \PP$,!!!!!!BUNU ORTALAYIP SONRAKİ SATIRI SOLA YASLA PLZ!!!!!! Utkan: yaptim
which was proven by Condon in~\cite{con89}.%!!!!!!!!!!!REFERANSI NİYE DEĞİŞTİRDİN???????!!!!!!!!!! \utkanadd{Utkan: statement'i da degistirdim (eski statement yeterli degil sanki? makinemiz poly-time'da calismiyor). statement'i degistirince ayni referans calismiyor olabilir diye dusundum. bende con89'un kendisi yok, icinde ne var bilmiyorum. lemma'yi bu sekilde guncelleyelim dediginiz sirada c93b/theorem6'ya bastan siz isaret etmistiniz sanki.}
%\\
%.
%
% \utkanadd{Using some more tracks in its log\-/space, $V_3$ can time its run and ensure that it does not run for more than the necessary polynomial amount. AMA BUNUN DA BIR OVERHEAD'I VAR. ACABA $V_2$'NIN TIMER KAFALARINI DA TAKIP EDIVERSEK MI? HEM ZATEN LOG-SPACE'TE DOGRUDAN POLY-TIMER YAPARKEN TUTTUGUMUZ SAYILARLA $V_2$'NIN TIMER KAFALARININ INDEKSLERI BIREBIR AYNI}
% \qed %% LLNCS ONLY
\end{proof}
%Would increasing the public coin budget to superpolynomial levels enlarge the class of verifiable languages beyond \Cref{thm:P}? We only have a partial answer to this question. For the special case of verifiers with perfect completeness, no amount of public coins would help a finite\-/state verifier with a constant number of private coins verify a language outside $\PP$.
% with any fixed error bound $\epsilon$.
%To see this, note that an interactive proof system (IPS) with a verifier $V$ with no limitation on its use of public coins but obeying the constraints described above corresponds to a debate system (DS), where the prover of the DS corresponds precisely to the prover of the IPS, the verifier ($V_D)$ of the DS is a constant\-/space machine that only flips a constant number of private coins and runs a program that is identical to that of $V$, with the refuter of the DS supplying the ``public coin outcomes''. (Our argument does not require the refuter to make sure that those are ``fair'' coin outcomes.) Thanks to the perfect completeness of $V$, the language $L$ verified by $V$ is precisely the language which has debates checkable by $V_D$. We conclude by Fact \ref{fact:debinp} that $L \in \PP$.
Since it is obvious that
\begin{multline*}
\IP{\co\spa, \co\pri\ran, \po\pex\pub\ran, \po\pex\tim}\subseteq\\\IPhigh{\lo\spa, \co\pri\ran, \infty\pub\ran, \infty\tim},
\end{multline*}
% \IP{\co\spa, \co\pri\ran, \po\pex\pub\ran, \po\pex\tim}\subseteq\IPhigh{\lo\spa, \co\pri\ran, \infty\pub\ran, \infty\tim}$,
\Cref{lem:dir2NEW} concludes the proof of \Cref{thm:P}.
\section{Concluding remarks}\label{sec:conc}
%Although the construction in the proof of Lemma \ref{lem:dir1} starts from a verifier with perfect completeness, this is not a crucial requirement, and a straightforward modification of the analysis is sufficient to prove the equality $\IP{\co\spa, \co\pri\ran, \po\pex\pub\ran, \po\pex\tim}=$, \ie, that the additional freedom of failing to accept some members of the verified language does not increase the power of such verifiers.
We end with some remaining open questions on finite\-/state verifiers.
%Teoremden sildiğimiz eşitliği (bizim class ile standart logspace verifierlarınki arasında olanı) burada note edebiliriz!!!!!!!!!!ETMEYEBİLİRİZ::
Focusing on verifiers which halt with probability $1$, Dwork and Stockmeyer~\cite{DS92} proved that the class $\IPhigh{\co\spa, \po\rex\pri\ran, \po\rex\tim}$ contains all context\-/free languages and some \NP\Complete{} languages, but whether $\PP \subseteq \IPhigh{\co\spa, \po\rex\pri\ran, \po\rex\tim}$ or not is still an open question.\footnote{Dwork and Stockmeyer do construct finite\-/state verifiers that halt with probability $1$ for all languages in $\DTIME{2^{\OH{n}}}$, but those verifiers have double exponential runtime.~\cite{DS92}} On the other hand, our \Cref{thm:P} establishes that polynomial\-/time finite\-/state machines (even those with our additional restrictions on private\-/coin usage) which are allowed to be tricked into looping with an arbitrarily small probability have the capability to verify all languages in $\PP$. Does imposing the requirement that a constant\-/space machine should halt with probability $1$ preclude it from verifying some languages?
It has been proven~\cite{GMS87} that every language verifiable with arbitrarily low error by a polynomial\-/time verifier (with no bound imposed on the space consumption) is also verifiable with such a verifier that has perfect completeness. We do not know whether a counterpart of this result holds for finite\-/state verifiers. (Note that the construction of \Cref{lem:dir1} creates verifiers without perfect completeness.) %Although we used \Cref{fact:debinp} to show that finite\-/state verifiers with perfect completeness and a constant private\-/coin budget are restricted to languages in $\PP$ in \Cref{sec:results}, that fact cannot help one deduce that \emph{every} language in $\PP$ is verifiable by such verifiers, since the existence of a debate system for a language $L$ does not necessarily imply that the same language has an interactive proof system with a constant bound $\verr < 1$ on its probability of accepting input strings that are not members of $L$.
It would be interesting to characterize the classes that are associated by reducing the public coin budgets in \Cref{sec:results}, like %\IP{\co\spa, \co\pri\ran, \infty\pub\ran, \infty\tim} and
\IP{\co\spa, \co\pri\ran, \log\pex\pub\ran, \infty\tim}.
Does Condon and Ladner's result showing that logarithmic\-/space verifiers that flip only logarithmically many public coins cannot verify any language outside the class \LOGCFL{}~\cite{conlad95} have a counterpart for the constant\-/space case?
We also note that the following question, posed more than 30 years ago by Dwork and Stockmeyer~\cite{DS92}, is still open:
Is there a nonregular language in \IPhigh{\co\spa, \po\rex\pub\ran, \po\rex\tim}?
%Class of languages that can be verified by the constant\-/space, constant\-/randomness, one\-/way\-/input verifiers, which \cref{thm:SY} proves to be equal to the class of languages verified by multi\-/head finite automaton, encompasses the rest.
%The classes \vsri{\consX}{\consX}{\rtX} and \ODFAK{3} have members \nonpal{} and $\lfrac$ as exclusives from one another, respectively, as shown in \cref{theorem:nonpal,theorem:bomb2}. Moreover, \cref{theorem:1dfa2subset} shows that the class \ODFAK{2} resides at their intersection. Yet another language $\lmatch$ that can be verified with a two\-/headed one\-/way finite automaton is shown to be beyond real\-/time verification using a constant\-/space and a constant number of random bits in \cref{theorem:bombastik}.
%Unlike $\lfrac$, it may be impossible to recognize $\lmatch$ with a multi\-/head one\-/way finite automaton with any number of heads, which is an open question. Likewise, $\lfrac$, while seems to be outside of \ONFAK{2}, is not yet proven to be so. There are in total 9 regions in \cref{fig:conclusionvenn} without a definitive member written in it, not counting the inside of \ODFAK{2} and the outside of $\bigcup_k \ONFAK{k}$ which are trivially non\-/empty; it would be interesting to see that any one of them is actually empty.
%We think that the conjectures $\lmatch \notin \bigcup_k \ODFAK{k}$, $\Set{ww | w \in \Set{0, 1}^*} \notin \ODFAK{2}$, and even $\Set{ww | w \in \Set{0, 1}^*} \notin \vsri{\consX}{\consX}{\rtX}$ can be proved via a technique similar to that of \cref{theorem:bombastik} (???).
\section*{Acknowledgments}
% \begin{acknowledgments}
% \acknowledgements
% This research was partially supported by Boğaziçi University Research Fund Grant Number 19441.
% Utkan Gezer's participation in this work is supported by the Turkish Directorate of Strategy and Budget under the TAM Project number 2007K12-873.
We thank the user with the pseudonym \emph{obscurans} at \emph{Mathematics Stack Exchange} for their help with the analysis in the proof of \Cref{lem:polyclock}.
We are grateful to the anonymous referees for their helpful comments.
% We thank the reviewers of ICTCS '23 for their comments on~\cite{GS23}, the paper that precedes this substantially extended version.
% An earlier version of this paper~\cite{GS23} was presented in the 24th Italian Conference on Theoretical Computer Science, Palermo, Italy, September 13--15, 2023. We thank the reviewers of that conference for their comments. This is a substantially extended version.
% \end{acknowledgments}
% \nocite{*}
% \bibliographystyle{abbrv}
\bibliographystyle{abbrvnat}
% % use the following instead if you encounter problems
% \bibliographystyle{alpha}
% \bibliography{sample-dmtcs}
% \label{sec:biblio}
% \begingroup
% \raggedright
% % \bibliographystyle{elsarticle-num}
% \bibliographystyle{plainnat}
% \bibliographystyle{splncs04}
\bibliography{references}
% \endgroup
% \end{document} % CUTS OFF APPENDIX
% \begin{filecontents*}{appendix.tex}
\renewcommand{\appendixpagename}{Appendix}
\clearpage
\appendix
%% ELSARTICLE
% \appendixpage
%% LLNCS
\section*{\huge Appendix}
\renewcommand{\thesection}{A.\arabic{section}}
\section{Proof of \texorpdfstring{\Cref{thm:hartmanisextended}}{Theorem \ref{thm:hartmanisextended}}}\label{sec:hartmanisextendedproof}
\hartmanisextended*
\begin{proof}
Let $M$ be any logarithmic\-/space Turing machine as described in the theorem statement, and $L$ be its language. Without loss of generality, let the work tape alphabet of $M$ be the set of $c$\=/digit binary numbers from $0$ to $2^c - 1$, where $0$ corresponds to the blank symbol of the alphabet.
%by the language homomorphism \utkanadd{(DO WE NEED A REFERENCE?)}.
We will construct a $\paren*{c+5}$\=/head finite automaton $R$, whose heads will be denoted $\head_1, \dotsc, \head_c$, $\head_{\alpha}$, $\head_{\beta}$, $\head_{\gamma}$, $\head_{\delta}$, and $\head_{\epsilon}$. $R$ is to recognize $L$ by simulating $M$.
The locations (indices) of heads $\head_1$ through $\head_c$ will encode the contents of $M$'s work tape, with the \ith{i} head's index matching the number whose
% \utkanrem{$\ceil{\log n}$\=/bit}
$\floor{\log(n+2)}$\=/bit binary representation is written %\utkanadd{UTKAN: Bence burada yine work tape'e doğru aktiflik ifade eden fiiller kullanmamanın yollarını arayalım. Aynı ifade ``read'' fiiliyle yazılabilir belki.}
in reverse on the \ith{i} track, \ie, the sequence obtained by concatenating the \ith{i} bit of each symbol of the work tape string. (The leftmost input tape cell containing \lend{} has index $0$.)
%\utkanadd{ALTERNATIVE: The locations (indices) of heads $\head_1$ through $\head_c$ will encode the contents of $M$'s work tape with $R$ maintaining their positions to match the little\-/endian binary number on the \ith{i} track (\ie, the numeric value of the $\ceil{\log n}$\=/bit string obtained by concatenating the \ith{i} bit of each symbol on the work tape, taking its leftmost bit as the least significant) with the index of $\head_i$.}
%It will maintain the positions of heads $\head_1$ through $\head_c$ on the input tape to match the content of $M$'s work tape, such that
%\utkanadd{UTKAN: Burada multihead $R$ logspace $M$'yi simüle ediyor. O açıdan cümlenin devamında simüle edilen $M$'yi özne/aktör konumuna koymamız ("\ith{i} row of the work tape \textbf{represents}" dememiz) bence pek iyi olmamış. Bence $M$ (work tape content'iyle) represent etmesin de $R$ kafalarıyla $M$'nin work tape content'ini match etsin. Her şeye baktıktan sonra buraya dönüp öneri yazacağım. EVET; BU CÜMLEYİ ANLAMAK ÇOK ZOR. CHATGPT BÖYLE ŞEYLERİ İYİ REPHRASE EDİYOR. Ben anlamak için kullanıyorum ama yazı üretmek için kullanmaya hala çekiniyorum sanırım. Yazdığımı review'latmak için de kullanıyorum.}
%the \ith{i} ``row'' of the work tape (\ie, the $\ceil{\log n}$\=/bit string obtained by concatenating the \ith{i} bit of each symbol on the work tape)
% \utkanrem{taking the \ith{i} bit of each symbol on the work tape and concatenating them in reverse will form the binary number that}
%represents the index (location) of $\head_i$ on the input tape (with the location of the leftmost cell containing \lend{} denoted $0$) in binary and in reverse.
$\head_\alpha$ will mimic $M$'s input tape head exactly, and $\head_\beta$ %\utkanadd{UTKAN: Input kafası subscript'ini $\sigma$ ($\delta$ tanımlarında input sembolüne verdiğimiz harf), work tape kafası subscript'ini $\phi$ ($\delta$ tanımlarında work tape sembolüne verdiğimiz harf) yapmayı düşünebiliriz. Fakat bunlar bu şekilde ``anlamlı'' olurlarsa diğer dandik olanlardan da insanın anlam çıkarası gelir. Onlara belki iyice dandik duracak şekilde $\head_{\mathrm{(i)}}$, $\head_{\mathrm{(ii)}}$ ve $\head_{\mathrm{(iii)}}$ diyebiliriz (ama $\head_i$ ile karışmayacağından emin olalım).}
will mimic the distance of $M$'s work tape head from the left end in its position, albeit on the input tape of $R$. The remaining three heads will be used as auxiliaries to facilitate the manipulations of the indices of $\head_1$ through $\head_c$ required for the simulation of $M$'s memory.
We now recall some multihead automaton programming techniques that will be used in the machine described below.
% \item \textbf{Storing or multiplying an index.}
Our algorithms sometimes require a head to walk from its original position to the left end of the tape in order to control the number of iterations of a loop, or to perform calculations based on information encoded in its index. This original index position may also be needed for future operations.
For instance, since the content of the \ith{i} track is represented by the index of $h_i$ in $R$, one has to make sure that this information is stored elsewhere when $h_i$ needs to take such a walk. This is achieved by making some auxiliary head $h_a$ (that is originally at position $0$) mirror $h_i$, \ie, $h_a$ moves right whenever $h_i$ moves to the left during this procedure. For ease of reference, one can then simply swap the identities of $h_a$ and $h_i$ to restore $h_i$'s index to its original value before the walk. %\utkanadd{UTKAN: Çarpma olayı ayrı madde de olabilir.}
This mirroring method can be modified easily to double or halve %\utkanadd{UTKAN: Neden double tırnak içinde değil ama halve tırnak içinde? Bölümün sonucu buçuklu çıkabilir diye mi? (Eğer öyleyse, bizde olmasa gerek ama ikiyle çarparken de inputun uzunluğu aşılabilir.)}
the index of a given head: Starting with $h_i$ at index $x$ and $h_a$ at index $0$, move $h_a$ twice as fast (resp.\ slow) as $h_i$, so that $h_a$ arrives at index $2x$ (resp.\ $\floor*{\sfrac{x}{2}}$) when $h_i$ arrives at the left end. In the algorithms to be presented below, we will use a separate font to denote these \DOUBLE{} and \HALVE{} procedures as a reminder that they involve loops, and therefore take more than unit time to execute, although they are specified in a single line of the pseudocode. %\utkanadd{UTKAN: Burada da identity swap yapılmalı.} %Note that all these variants of the basic procedure take linear time, since they terminate when a head finishes a single one\-/directional sweep of the input tape. \utkanadd{UTKAN: Bu sanki alttaki madde için de geçerli, sadece burada yazması bi garip.}
% &\item \textbf{Increasing or decreasing an index by another index.} In order to add (resp.\ subtract) the present index of $h_i$ to (resp.\ from) the index of $h_j$, walk $h_i$ all the way to the left end\-/marker, while matching every move of $h_i$ with a move of $h_j$ to the right (resp.\ left).
%\end{itemize}
%\paragraph{Exponentiation.} Starting with head $h_i$ at some index $x$, we can use two additional heads, say, $h_a$ and $h_b$ to locate index $2^x$ as follows: After moving $h_a$ to index 1, perform a loop which doubles the index of $h_a$ (using $h_b$ as auxiliary) for every leftward move of $h_i$, until $h_i$ reaches the left end-marker.
%!!!BURAYA MİNİK BAŞLIKLAR ALTINDA "COPYING AN INDEX", "INCREMENTING/DECREMENTING AN INDEX BY ANOTHER INDEX" "HALVING/DOUBLING AN INDEX", "LOCATING THE $2^b$'TH INDEX, GIVEN A HEAD AT THE B'TH INDEX" gibi NUMARALARI ANLATIP ZAMANLARINI DA VERSEK SONRASINI BASİTLEŞTİREBİLİRİZ????
$R$ will simulate each transition of $M$ using a sequence of transitions of its own, and report the same decision as $M$.
Each transition of $M$
% \utkanrem{(and any Turing machine in general)} CUNKU COIN ATILABILIRDI, COMMUNICATION CELL ILE IS YAPILABILIRDI, VS.
consists of two parts:
\begin{enumerate}
\item ``Sensing'' by the current configuration; which involves taking account of the internal state of the machine and reading the symbols under both the input and work tape heads.
\item ``Acting'' on the current configuration; which can involve changing the internal state, the symbol under the work tape head, and the positions of both the input and work tape heads.
\end{enumerate}
% !!!AŞAĞIDAKİ KODLARI BU ŞEKİLDE ÇOK DAHA HIGH-LEVEL HALE GETİRELİM BENCE. ŞİMDİKİ HALLERİNDE 1.1.2'nin hesaba 0 adım eklemesi gibi normal psödokod analizine alışmış insanları mahveden ayrıntılar var!!!!!!!!!!!!!!
% \utkanadd{UTKAN: Fakat o halinin complexity overhead'i ve kullandığı kafa sayısı farklı olur. Biz burada bu ikisini de olabildiğince küçük tutan (aralarında tradeoff var, mesela sanırım kafa sayısını $2c+5$ yaparak overhead küçültülebiliyordu (sanırım yine \OH{n}'di), biz $c+5$ kalmasını daha makul bulmuştuk) bir algoritma çıkarıp onu analiz ediyorduk. Kesin olmamakla beraber bu bahsettiğiniz şekilde yapınca da overhead muhtemelen \OH{n} mertebesinde kalır ama tight analizi kaybederiz.
% Reviewer'lar bence bu konuda bir eleştiri yapmamışlar. (R2 sadece "mevcut numaralandırma şekli aldatıcı olmuş" demiş. Analiz konusunda hiçbir eleştirisi olmamış; okumuş, anlamış ve onaylamış gibi duruyor.) "Eleştirilmeyen şeylere dokunmayalım" shortcut'ını almak isterseniz diye hatırlatmak istedim.}
The rest of the proof describes the simulation of these parts. %\utkanrem{the ``sense'' and ``act'' parts of each simulated transition.} \utkanadd{UTKAN: Ama her birinin devamında süre analizi de var. Üstüne bir de toplam süre analizi ve nihai ``multiplicative runtime overhead'' claim'imiz var.}
\paragraph{Sensing.} $R$ traces $M$'s current state in its own finite memory and reads its input tape with $\head_\alpha$ to obtain the symbol $M$ is scanning with its input head.
% \utkanadd{QUESTION: CAN M ATTEMPT TO PUSH ITS WORK TAPE HEAD BEYOND LOG N (and fail)?}
Obtaining the symbol under $M$'s work tape head requires sophistication.
% At the beginning of this stage, $\head_\beta$'s location on the input tape of $R$ equals the location of $M$'s work tape head in the corresponding point of the simulation.
Let $b$ denote the index of $\head_\beta$, which can range from $0$ (when $\head_\beta$ is on $\lend$) up to $\floor*{\log(n+2)}-1$ (since $M$ uses at most $\floor*{\log(n+2)}$ work tape cells).
% \utkanrem{Let $b$ denote the index of $\head_\beta$ (which is $0$ when $\head_\beta$ is on $\lend$), which is at the same index as $M$'s work tape head in $M$'s work tape.}
To decode the symbol under $M$'s work tape head from the positions of heads $\head_1$ through $\head_c$, essentially, the least significant $b$ bits of their indices will be truncated and the last bits of what remains will be retrieved. %(which are the \ith{b} !!BURADA "LEAST SIGNIFICANT" MI DEMEK İSTİYORSUN?!!!! \utkanadd{Evet} BU PARANTEZ KOMPLE SİLİNSE NE KAYBEDERİZ???!!!!!! \utkanadd{Uygundur, sunduğu bilgi çok bariz, evet} bits of the original indices).
%This will be performed sequentially for each head \utkanadd{UTKAN: Bu cümle parçasında aslında "sequentially"de bir vurgu olmalı (önceki cümlenin üzerine bu cümle parçasının vermeyi amaçladığı tek bilgi o) ama sanki yazı o vurguyu veremiyor ("performed sequentially for each head"in tamamı bilgi olarak veriliyormuş gibi duruyor). Acaba "sequentially"i italik yapsak çözülür mü?!!! ONUN YERİNE BU CÜMLEYİ DİPNOTSUZ ŞEKİLDE
This is performed sequentially for each head, although a machine with more auxiliary heads could perform this in parallel to expedite the sensing routine.
%DESEK?????!! Bence çok iyi}, in order to back\-/up and restore the original positions of the heads.\footnote{It is possible to use more heads to perform this in parallel and expedite the sensing routine.}
In \Cref{alg:sensing}, the loop controlled by \Cref{stg:understandingindexdroploop} walks $\head_i$ to the left so that its original index $j_i$ is reduced to $\floor*{\sfrac{j_i}{2^b}}$ at the end of this walk. Each iteration of this loop runs for half as many steps as the previous one, while performing the \HALVE{} procedure described above. Since the runtime of the following parity check stage (\ref{stg:understandingparity}) is just $\floor*{\sfrac{j_i}{2^b}}$, we conclude that
``reading'' the symbol under the simulated work tape head with this procedure incurs at most
\begin{equation*}
\sum_{i=1}^c \paren[\Big]{\underbrace{\textstyle j_i + \floor*{\frac{j_i}{2}} + \floor*{\frac{j_i}{4}} + \dotsb + \floor*{\frac{j_i}{2^{b-1}}}}_{\text{\Cref{stg:understandingindexdroploop}}} +
\underbrace{\textstyle \floor*{\frac{j_i}{2^b}}}_{\mathclap{\text{\Cref{stg:understandingparity}}}}}
\le
\sum_{i=1}^c 2j_i
\le 2cn + 2c
\end{equation*}
% \utkanremlong[]{
% \begin{equation*}
% \sum_{i=1}^c \paren{\underbrace{j_i + \floor*{\sfrac{j_i}{2}} + \floor*{\sfrac{j_i}{4}} + \dotsb + \floor*{\sfrac{j_i}{2^{b-1}}}}_{\text{\Cref{stg:understandingindexdroploop}}} +
% \underbrace{\floor*{\sfrac{j_i}{2^b}}}_{\mathclap{\text{\Cref{stg:understandingparity}}}}}
% \le
% c \cdot \paren{n + \sfrac{n}{2} + \sfrac{n}{4} + \dotsb + 1} \le c + 2cn
% \end{equation*}
% }
% \begin{equation*}
% c \cdot \paren{{\underbrace{n + \sfrac{n}{2} + \sfrac{n}{4} + \dotsb + 1}_{\text{\Cref{stg:understandingindexdroploop,stg:understandingparity}}}}} \le c + 2cn
% \end{equation*}
steps. %Sensing the current simulated state and the input symbol can be handled parallelly, and would incur no additional time cost.
The reader should note that the execution of the procedure of \Cref{alg:sensing} leaves $\head_1, \dotsc, \head_c$, and $\head_{\beta}$ (after the reidentifications) at their original locations. We will justify the statement at \Cref{stg:understandinginitialization} of \Cref{alg:sensing} by the end of this proof.
% The procedure above completes the ``sense'' part of the simulation of an $M$\=/transition.
% \newcommand\annotatesteps[2]{%
% \begin{minipage}{\linewidth-5em}%
% #1%
% \end{minipage}%
% \hfill\vline\hfill%
% \begin{minipage}{4em}%
% #2%
% \end{minipage}%
% }
% \hfill\vline\hfill%
% \begin{minipage}{4em}%
% #2%
% \end{minipage}%
% }
% \newcommand\annotatesteps[2]{%
% \schema[closed]{\begin{minipage}{\linewidth-5em}%
% #1%
% \end{minipage}%
% }{%
% \begin{minipage}{4em}%
% #2%
% \end{minipage}%
% }%
% }
\begin{algorithm}[htb]
\begin{minipage}{\linewidth-\annotationwidth}
\begin{turingmultienum}[start=0]
% \setcounter{turingmultienumi}{-1}
\item\label{stg:understandinginitialization}
(At this point, $\head_{\gamma}$, $\head_{\delta}$, and $\head_{\epsilon}$ are guaranteed to be on \lend.)
\item\label{stg:understandingreadmemory} Do the following for $i = 1, \dotsc, c$:
\begin{turingmultienum}
\annotatesteps{
\item\label{stg:understandingindexdroploop}
Walk $\head_{\beta}$ to \lend, using $\head_{\gamma}$ to store $\head_{\beta}$'s original index, and repeating the following parallelly with every leftward move of $\head_{\beta}$: %\utkanadd{UTKAN: Bu da bence pek conventional bir loop başlığı olmamış. Bence conventional olsun istiyorsak ya burada sadece bir for-loop statement (Stage 1'deki gibi) ya da sadece bir while-loop statement (eski Stage 1.1'in ikinci cümlesindeki gibi) yazmalı. Aksiyonların tamamı loop içerisinde yazmalı. Ayrıca... ``Stage 1.1.2.'nin tutması gereken +1 adım nerede?'' sorunu burada da var, sadece ustaca (adım ve loop statement'larını iç içe giriştirerek) bu satıra gizlenmiş ama bence bu hakiki bir çözüm değil; resmen gizlemişiz, görememelerini umarak çözüyoruz, gördükleri anda yine aynı soru ile baş başa kalıyoruz. Esas çözüm, gerçekten aklımızda olan ve analizi yaparken düşündüğümüz şey: Bu ``move $\head_{\beta}$ one step to the left'' hareketinin paralel olarak işletiliyor olduğu gerçeği. Eğer ortada böyle bir sorunumuz varsa çözümü açık açık bunu yazmak olmalı.}
\begin{turingmultienum}
\item\label{stg:understandingindexhalving}
\HALVE{} the index of $\head_i$ (from $x$ to $\floor*{\sfrac{x}{2}}$), using $\head_{\delta}$ as auxiliary. In the first execution of this stage (\ie, the first iteration of loop~\ref{stg:understandingindexdroploop}), use $\head_{\epsilon}$ as auxiliary to parallelly store the original index of $\head_i$.
% Move $\head_i$ to the left such that its index is halved, \ie, is reduced to $\floor*{\sfrac{j}{2}}$ from its original value $j$.\footnote{In detail, move $\head_i$ towards \lend{} while moving $\head_{\delta}$ to the right in every second movement of $\head_i$. Then, reidentify $\head_{\delta}$ as $\head_i$, and vice versa.} \utkanadd{\timespec{\OH{n}} (Burada da aşağıda acting algoritmasında bahsettiğim durum var.)}
\end{turingmultienum}
}{\OH{n} steps}
\annotatesteps{
\item\label{stg:understandingparity}
Determine the parity of $\head_i$'s index by walking $\head_i$ to \lend%\utkanrem{: The parity is odd if $\head_i$ reaches \lend{} in an odd number of steps, and even otherwise}
.
If the parity is
even, ``read'' the \ith{i} bit of the symbol under $M$'s simulated work tape head as $0$. Otherwise, read it as $1$. %\utkanadd{\timespec{\OH{n}} (Bu analizde ``ekstra $n$ adım'' olarak gözükmüyor, çünkü in the worst case, Stage 2'deki loop $h_i$'nin indeksini ikiye böle böle en sola kadar getiriyor.)}
}{\OH{n} steps}
\item\label{stg:reid}
Reidentify the auxiliary heads $\head_\epsilon$ and $\head_\gamma$ to set $\head_i$ and $\head_\beta$ back to their locations at the beginning of the procedure.%\footnote{To do so, $\head_\gamma$ is made to mirror !!!!MIRROR LAFI TANIMLI MI? TERS YÖNDE GİTMEK Mİ DEMEK? AÇIKÇA YAZILMALI!!!! the movements of $\head_\beta$ throughout, and $\head_\epsilon$ is made to mirror the movements of $\head_i$ as it is moving towards $\lend$ during the first execution of \Cref{stg:understandingindexhalving}. Finally, the mirror\-/pairs are reciprocally reidentified in \Cref{stg:reid}.}
\end{turingmultienum}
\end{turingmultienum}
\end{minipage}
\caption{Using $R$'s heads to read a symbol on the work tape of $M$.}
\label{alg:sensing}
\end{algorithm}
% !!!!!MUTABIKSAK BU "SUB"SECTIONUN GERİSİ SİLİNSİN!!!!!!!!!!
% % \begin{turingenum}
% % \setcounter{turingenumi}{-1}
% % \item\label{stg:understandinginitialization}
% % (\utkanadd{At this point,} $\head_{\gamma}$, $\head_{\delta}$, and $\head_{\epsilon}$ are \utkanadd{guaranteed to be} on \lend.)
% % \item\label{stg:understandingreadmemory} Do the following for $i = 1, \dotsc, c$:
% % \bitem{\label{stg:understandingindexdroploop}
% % %BU MADDEDEKİ REWORDINGİM DOĞRU MU??????????????????
% % Move $\head_i$ to the left so that its index (on the input string) at the end of this walk equals the number that would be obtained by dropping the $b - 1$ least significant digits from the binary representation of its index before the walk, where $b$ is the index of the simulated work tape head on the simulated work tape (as well as $\head_{\beta}$'s index on $R$'s input tape). To achieve this, repeat the following until $\head_{\beta}$ reads \lend:}
% % \bbitem{\label{stg:understandingindexhalving}Walk $\head_i$ to the left such that its index
% % loses the least significant digit of its binary representation.
% % % DOĞRU MU?????????????????????
% % %is halved and floored.
% % If this is the first %iteration of %(FIRST ITERATION OF STAGE 2 NE DEMEK? STAGE 1'DEKİ DÖNGÜNÜN İLK DÖNÜŞÜ MÜ; YANİ i=1 Mİ DEMEK, YOKSA STAGE 3'TEKİ LOOP'Un İLK DÖNÜŞÜ MÜ DEMEK?!!!!!!!!!!!!!! IKINCISI, STAGE 3'UN *ICINDE BULUNDUGU* LOOP'UN ILK DONUSU)
% % % \Cref{stg:understandingindexdroploop},
% % such walk in this loop, move $\head_{\epsilon}$ to the original location of $\head_i$ as a backup. (In detail, move $\head_i$ towards \lend{} while simultaneously moving $\head_{\delta}$ to the right, pausing in every second movement of $\head_i$. During the first such leftward walk of $\head_i$ in this loop,
% % %\Cref{stg:understandingindexdroploop},
% % also move $\head_{\epsilon}$ to the right simultaneously with $\head_i$, non\-/stop. Then, reidentify $\head_{\delta}$ as $\head_i$, and vice versa.)}
% % \bbitem{Move $\head_{\beta}$ once to the left and $\head_{\gamma}$ once to the right.}
% % \bitem{\label{stg:understandingparity}Move $\head_i$ to \lend. If it reaches there in an odd number of steps, ``read'' the \ith{i} bit of the symbol under $M$'s simulated work tape head as $0$. Otherwise, ``read'' it as $1$.}
% % \bitem{Reidentify $\head_{\gamma}$ as $\head_{\beta}$, and vice versa. Reidentify $\head_{\epsilon}$ as $\head_i$, and vice versa.}
% % \end{turingenum}
% % ALTERNATIF HAZIRLIYORUM
% % \begin{turingenum}
% % \setcounter{turingenumi}{-1}
% % \item\label{stg:understandinginitialization}
% % (At this point, $\head_{\gamma}$, $\head_{\delta}$, and $\head_{\epsilon}$ are guaranteed to be on \lend.)
% % \item\label{stg:understandingreadmemory} Do the following for $i = 1, \dotsc, c$:
% % \bitem{Move $\head_\epsilon$ to the same position as $\head_i$. (This, in fact, is done simultaneously with the first time \Cref{stg:understandingindexhalving} is being performed for the current $i$, precisely when that stage is moving $\head_i$ towards \lend{} for the first time.)}
% % \bitem{\label{stg:understandingindexdroploop}
% % Walk $\head_i$ to the left so that its index (on the input string) at the end of this walk equals $\floor*{\sfrac{j}{2^{b-1}}}$ where $j$ is the current index of $\head_i$.
% % % the number that would be obtained by dropping the $b - 1$ least significant digits from the binary representation of its index before the walk.
% % % where $b$ is the index of the simulated work tape head on the simulated work tape (as well as $\head_{\beta}$'s index on $R$'s input tape).
% % To achieve this, repeat the following until $\head_{\beta}$ reads \lend:}
% % \bbitem{\label{stg:understandingindexhalving}Move $\head_i$ to the left such that its index
% % becomes $\floor*{\sfrac{j}{2}}$ where $j$ is the current index of $\head_i$.
% % % loses the least significant digit of its binary representation.
% % (In detail, move $\head_i$ towards \lend{} while simultaneously moving $\head_{\delta}$ to the right, pausing in every second movement of $\head_i$. Then, reidentify $\head_{\delta}$ as $\head_i$, and vice versa.)}
% % \bbitem{Move $\head_{\beta}$ once to the left and $\head_{\gamma}$ once to the right.}
% % \bitem{\label{stg:understandingparity}Move $\head_i$ to \lend. If it reaches there in an odd number of steps, ``read'' the \ith{i} bit of the symbol under $M$'s simulated work tape head as $0$. Otherwise, ``read'' it as $1$.}
% % \bitem{Reidentify $\head_{\gamma}$ as $\head_{\beta}$, and vice versa. Reidentify $\head_{\epsilon}$ as $\head_i$, and vice versa.}
% % \end{turingenum}
% % \utkanadd{LEANER BIR ALTERNATIF DENIYORUM}
% \begin{turingmultienum}[start=0]
% % \setcounter{turingmultienumi}{-1}
% \item\label{stg:understandinginitialization}
% (At this point, $\head_{\gamma}$, $\head_{\delta}$, and $\head_{\epsilon}$ are guaranteed to be on \lend.)
% \item\label{stg:understandingreadmemory} Do the following for $i = 1, \dotsc, c$:
% \begin{turingmultienum}
% \item\label{stg:understandingindexdroploop}
% Walk $\head_i$ to the left so that its index (on the input string) at the end of this walk will equal $\floor*{\sfrac{j}{2^{b-1}}}$, where $j$ is the current index of $\head_i$. To achieve this, repeat the following until $\head_{\beta}$ reads \lend:
% \begin{turingmultienum}
% \item\label{stg:understandingindexhalving}
% Move $\head_i$ to the left such that its index is halved, \ie, is reduced to $\floor*{\sfrac{j}{2}}$ from its original value $j$.\footnote{In detail, move $\head_i$ towards \lend{} while moving $\head_{\delta}$ to the right in every second movement of $\head_i$. Then, reidentify $\head_{\delta}$ as $\head_i$, and vice versa.} \utkanadd{\timespec{\OH{n}} (Burada da aşağıda acting algoritmasında bahsettiğim durum var.)}
% \item
% Move $\head_{\beta}$ one step !!!DEĞİŞTİ!!! \utkanadd{Uygundur (anlam farkı varsa da göremedim)} to the left.
% \end{turingmultienum}
% \item\label{stg:understandingparity}
% Check the parity of $\head_i$'s index. If it is odd, ``read'' the \ith{i} bit of the symbol under $M$'s simulated work tape head as $0$. Otherwise, read it as $1$.\footnote{To do the parity check, move $\head_i$ to \lend; the parity is odd if $\head_i$ reaches there in an odd number of steps, and even otherwise.} \utkanadd{\timespec{\OH{n}} (Bu analizde ``ekstra $n$ adım'' olarak gözükmüyor, çünkü in the worst case, Stage 2'deki loop $h_i$'nin indeksini ikiye böle böle en sola kadar getiriyor.)}
% \item\label{stg:reid}
% Move $\head_i$ and $\head_\beta$ back to their locations at the beginning of the procedure.\footnote{To do so, $\head_\gamma$ is made to mirror !!!!MIRROR LAFI TANIMLI MI? TERS YÖNDE GİTMEK Mİ DEMEK? AÇIKÇA YAZILMALI!!!! the movements of $\head_\beta$ throughout, and $\head_\epsilon$ is made to mirror the movements of $\head_i$ as it is moving towards $\lend$ during the first execution of \Cref{stg:understandingindexhalving}. Finally, the mirror\-/pairs are reciprocally reidentified in \Cref{stg:reid}.}
% \end{turingmultienum}
% \end{turingmultienum}
% The reader should note that $\head_1, \dotsc, \head_c$, and $\head_{\beta}$ (after the reidentifications) are located at exactly where they were before the procedure. We will justify the statement at \Cref{stg:understandinginitialization} by the end of this proof.
% The procedure above completes the ``sense'' part of the simulation of an $M$\=/transition. Sensing the current simulated state and the input symbol can be handled parallelly with the procedure described above, and would incur no additional time cost. ``Reading'' the symbol under the simulated work tape head with the above procedure incurs up to
% \begin{equation*}
% c \cdot \paren{{\underbrace{n + \sfrac{n}{2} + \sfrac{n}{4} + \dotsb + 1}_{\text{\Cref{stg:understandingindexdroploop,stg:understandingparity}}}}} \le c + 2cn
% \end{equation*}
% steps.
\paragraph{Acting.} Updating the internal state and head positions of the simulated machine is again straightforward: $R$ updates the simulated machine's state in its own finite memory. It also moves $\head_{\alpha}$ and $\head_{\beta}$, which mimic $M$'s input and work tape heads, in the required directions, after simulating the changes on $M$'s work tape contents at that step.
Changes on the work tape are accomplished as follows. Once again, let $b$ denote the index of $\head_\beta$, ranging from $0$ to $\floor*{\log(n+2)}-1$. If the %!!!BURALARDA DA LEAST SIGNIFICANT MI DEMEK LAZIM???!!!!! \utkanadd{Bence hayır, buradaki "bit" çok basamaklı bir sayı içindeki basamak olan "bit" değil. Buna "bit" yerine "symbol" bile diyebiliriz. Precisely work tape'teki $i$th track'in $b$'inci sembolünü (= $b$'inci sembolün $i$'inci component'ını) kastediyoruz. O sembol aynı zamanda tanımı gereği happens to be the $b$th least significant bit of the number represented in the $i$th track, ama burada tanıtıcı unsuru o değil, tanıtıcı unsur teybin soldan $b$'inci sembolü olması.}
bit on the \ith{i} track of the simulated work tape symbol at that index needs to be changed from $1$ to $0$, $h_i$ is moved $2^b$ cells to the left. If that bit is to change from $0$ to $1$, $h_i$ is moved $2^b$ cells to the right. In \Cref{alg:acting}, \Cref{stg:manipulatingoffsetpreparationinit,stg:manipulatingoffsetpreparationloop} have the combined effect of moving $\head_{\epsilon}$ to the \ith{2^b} index on the input tape. The exponentiation is achieved by repeated doubling. The loop controlled by \Cref{stg:manipulatingsimulatedmemory} then updates all relevant head indices by $2^b$ units in the required directions parallelly.
The loop controlled by \Cref{stg:manipulatingoffsetpreparationloop} is iterated up to
% \utkanrem{$\log n$}
$\floor{\log(n+2)}-1$ times, with each iteration taking twice as much time as its predecessor. The runtime of \Cref{stg:manipulatingsimulatedmemory} equals $2^b$, which is not greater than
% \utkanrem{the input length $n$}
$\sfrac{n}{2}+1$. The %, where $b$ is the index of $\head_{\beta}$ on the input tape.
procedure therefore incurs up to
\begin{equation*}
\underbrace{1}_{\mathclap{\text{\cref{stg:manipulatingoffsetpreparationinit}}}} + \underbrace{2 + 4 + 8 + \dotsb + 2^b}_{\text{\Cref{stg:manipulatingoffsetpreparationloop}}} + \underbrace{2^b}_{\mathclap{\text{\cref{stg:manipulatingsimulatedmemory}}}}
\le
3 \cdot 2^b - 1 \le \sfrac{3n}{2} + 2
\end{equation*}
% \utkanremlong[]{
% \begin{equation*}
% \underbrace{1}_{\mathclap{\text{\cref{stg:manipulatingoffsetpreparationinit}}}} + \underbrace{2 + 4 + 8 + \dotsb + 2^b}_{\text{\Cref{stg:manipulatingoffsetpreparationloop}}} + \underbrace{2^b}_{\mathclap{\text{\cref{stg:manipulatingsimulatedmemory}}}}
% \le
% 1 + 2 + 4 + \dotsb + n + n \le 1 + 3n
% \end{equation*}
% }
% \begin{equation*}
% {\underbrace{1 + 2 + 4 + 8 + \dotsb + n}_{\text{\Cref{stg:manipulatingoffsetpreparationinit,stg:manipulatingoffsetpreparationloop}}}} + {\underbrace{n}_{\text{\cref{stg:manipulatingsimulatedmemory}}}} \le 1 + 3n
% \end{equation*}
steps.% for $b>0$.
\footnote{Note that, when $b=0$, \ie, when $h_{\beta}$ is scanning $\lend$, $R$ can proceed to \Cref{stg:manipulatingsimulatedmemory} directly without performing any transition associated with \Cref{stg:manipulatingoffsetpreparationloop}. (``\Cref{stg:revertworkhead}'' always incurs $0$ steps.)} The task of updating the simulated machine state and the simulated input and work heads' positions would incur a single step by themselves, and are handled in parallel with the procedure of \Cref{alg:acting}, requiring no additional time.
\begin{algorithm}[htb]
\begin{minipage}{\linewidth-\annotationwidth}
\begin{turingmultienum}[start=0]
% \setcounter{turingmultienumi}{-1}
\item\label{stg:manipulatinginitialization}
(At this point, $\head_{\gamma}$, $\head_{\delta}$, and $\head_{\epsilon}$ are on \lend.)
\annotatesteps{
\item\label{stg:manipulatingoffsetpreparationinit}
Move $\head_{\epsilon}$ one step to the right.
\item\label{stg:manipulatingoffsetpreparationloop}
Walk $\head_{\beta}$ to \lend, using $\head_{\gamma}$ to store $\head_{\beta}$'s original index, and repeating the following parallelly with every leftward move of $\head_{\beta}$: %\utkanadd{UTKAN: [sensing loop'undaki yorumumun tekrarı]}
\begin{turingmultienum}
\item
\DOUBLE{} the index of $\head_\epsilon$, using $\head_{\delta}$ as auxiliary.
% Move $\head_i$ to the left such that its index is halved, \ie, is reduced to $\floor*{\sfrac{j}{2}}$ from its original value $j$.\footnote{In detail, move $\head_i$ towards \lend{} while moving $\head_{\delta}$ to the right in every second movement of $\head_i$. Then, reidentify $\head_{\delta}$ as $\head_i$, and vice versa.} \utkanadd{\timespec{\OH{n}} (Burada da aşağıda acting algoritmasında bahsettiğim durum var.)}
\end{turingmultienum}
}{\OH{n} steps}
\item\label{stg:revertworkhead}
Reidentify the auxiliary head $\head_\gamma$ to set $\head_\beta$ back to its location at the beginning of the procedure.
\annotatesteps{
\item\label{stg:manipulatingsimulatedmemory}
Walk $\head_{\epsilon}$ to \lend, repeating the following parallelly with every leftward move of $\head_{\epsilon}$: %\utkanadd{UTKAN: Burada da yine aynı ``gizlenmiş adım'' ve ``adım ve loop statement'ının birleştirilmesi'' sorunu var.}
% \utkanrem{$i$ between $1$ and $c$ where the transition being simulated changes the \ith{i} bit of the symbol under the simulated work tape head, do the following:}
\begin{turingmultienum}
\item\label{stg:manipulatingsimulatedmemoryiter}
If the bit on the \ith{i} track should change from $0$ to $1$, move $\head_i$ one step to the right. If the bit on the \ith{i} track should change from $1$ to $0$, move $\head_i$ one step to the left. All such heads move simultaneously in the same transition. %\utkanadd{UTKAN: Bence 4 ve 4.1 adımlarını birleştirelim. Burada sadece birer adım atılıyor. Üstelik yukarıda anlattığımız ``increase/decrease by'' rutini tam burada kullanmalık, hatta sanırım başka yerde de kullanmıyoruz, muhtemelen tam olarak burada kullanmak için yazmışsınız.}
\end{turingmultienum}
% \item \utkanrem{Move $\head_\epsilon$ to $\lend$.}\footnote{\utkanrem{This, in fact, is done by simply not moving $\head_\delta$ and keeping it on $\lend$ as $\head_\epsilon$ is moving to $\lend$ during the last time} \Cref{stg:manipulatingsimulatedmemoryiter} \utkanrem{is being performed.}}
}{\OH{n} steps}
\end{turingmultienum}
\end{minipage}
\caption{Rearranging $R$'s heads to simulate a change on the worktape of $M$.}
\label{alg:acting}
\end{algorithm}
The two routines for reading and changing the simulated memory contents are carried out back to back, and they both leave the heads $\head_{\gamma}$, $\head_{\delta}$, and $\head_{\epsilon}$ on the left end\-/marker as they finish. Moreover, these heads are on the left end\-/marker also when $R$ begins its execution, by definition. The assumptions in \Cref{stg:manipulatinginitialization} of both routines are thus justified. %Therefore, the assumptions at the beginning of each procedure holds, without those procedures having to spend any time on moving those heads.
The two parts together take at most
% \utkanrem{$1 + c + 3n + 2cn$}
$\paren*{2c + \sfrac{3}{2}}n + 2c + 2$ steps, which is an upper bound to the multiplicative runtime overhead of $R$ simulating $M$. Thus, $R$ completes its simulation within
% \utkanrem{$t(n) \cdot \paren*{1 + c + 3n + 2cn}$}
$t(n) \cdot \paren*{\paren*{2c + \sfrac{3}{2}}n + 2c + 2}$ steps.
\end{proof}
% !!!!!MUTABIKSAK BU SECTIONUN GERİSİ UÇSUN:
% % To change $M$'s simulated work tape's contents, $R$ updates the positions of $\head_1$ through $\head_c$ by moving each of them either $2^b$ cells to the left (if the bit on that track of the simulated work tape symbol at the index $b$ needs to be changed from $1$ to $0$) or to the right (if the change is from $0$ to $1$), or leave them where they are (if no change is needed at the corresponding bit), by doing the following:
% % (EĞER AŞAĞIDAKİ KODDA b hep aynı anlama gelen bir sabitse ONUN NE OLDUĞUNU CÜMLE İÇİNDE DEĞİL BURADA; EN BAŞTA SÖYLE!!!!!!!!!!!!!!!)
% \begin{turingmultienum}[start=0]
% % \setcounter{turingmultienumi}{-1}
% \item\label{stg:manipulatinginitialization} (At this point, $\head_{\gamma}$, $\head_{\delta}$ and $\head_{\epsilon}$ are guaranteed to be on \lend.)
% \item\label{stg:manipulatingoffsetpreparation} Bring $\head_{\epsilon}$ to the \ith{2^b} index on the input tape. %, where $b$ is the index of $\head_{\beta}$ on the input tape.
% To do so, move $\head_{\epsilon}$ one step to the right, and then repeat the following until $\head_{\beta}$ reads \lend:
% \begin{turingmultienum}
% \item Move $\head_{\epsilon}$ to the right such that its index is doubled.\footnote{In detail, move $\head_{\epsilon}$ to \lend{} while moving $\head_{\delta}$ to the right twice as fast. Then, reidentify $\head_{\delta}$ as $\head_{\epsilon}$, and vice versa.} \utkanadd{\timespec{\OH{n}} (fakat burada up to $\log n$ tekrar var ve böyle bakınca \OH{n \log n} adım tutacağı sanılabilir; ama aslında birinci, ikinci, üçüncü, ..., $\log(n)-1$'inci ve $\log n$'inci iterasyonlarda 2, 4, 8, ..., $n/2$ ve $n$ adım tutuyor ve bu sayıların toplamı $2n$ ediyor)}
% \item Move $\head_{\beta}$ once to the left and $\head_{\gamma}$ once to the right.
% \end{turingmultienum}
% \item Reidentify $\head_{\gamma}$ as $\head_{\beta}$, and vice versa.
% \item\label{stg:manipulatingsimulatedmemory} For all the bits of the work tape symbol that should undergo a change, do the following simultaneously:
% % \utkanrem{$i$ between $1$ and $c$ where the transition being simulated changes the \ith{i} bit of the symbol under the simulated work tape head, do the following:}
% \begin{turingmultienum}
% \item\label{stg:manipulatingsimulatedmemoryiter} Move $\head_i$ to the right by $2^b$ cells
% % \utkanrem{(with the help of $\head_\epsilon$)}
% %\footnote{\utkanrem{In detail, move $\head_{\epsilon}$ to \lend{} while moving $\head_i$ and $\head_\delta$ to the right. Then, reidentify $\head_{\delta}$ as $\head_{\epsilon}$, and vice versa.}}
% if the \ith{i} bit should change from $0$ to $1$, and to the left if it should change from $1$ to $0$. This is performed in tandem with $\head_\epsilon$ moving to the left until it reaches $\lend$. \utkanadd{\timespec{\OH{n}} (Burada içeriye girinti yapılmış olması loop olduğunu düşündürtebilir ama burası (``simultaneously'' denmesinden anlaşılacağını umduğum üzere) tek bir kere işliyor, bütün work tape katlarını tek bir seferde hallediyor.)}
% % Otherwise, move it to the left by the same amount.
% % \utkanrem{If the transition being simulated changes the \ith{i} bit of the symbol under the simulated work tape head from $0$ to $1$, then move $\head_i$ to the right by $2^b$ cells. (In detail, move $\head_{\epsilon}$ to \lend{} while simultaneously moving $\head_i$ and $\head_{\delta}$ to the right for each movement of $\head_{\epsilon}$. Then, reidentify $\head_{\delta}$ as $\head_{\epsilon}$, and vice versa.) If the change is from $1$ to $0$, move $\head_i$ to the left instead, by the same amount (using the same method, except $\head_i$ moves to the left). Otherwise (if there is no change), do nothing.}
% \end{turingmultienum}
% % \item \utkanrem{Move $\head_\epsilon$ to $\lend$.}\footnote{\utkanrem{This, in fact, is done by simply not moving $\head_\delta$ and keeping it on $\lend$ as $\head_\epsilon$ is moving to $\lend$ during the last time} \Cref{stg:manipulatingsimulatedmemoryiter} \utkanrem{is being performed.}}
% \end{turingmultienum}
% Once again, the reader should note that the head identified as $\head_{\beta}$ is located at the same place at the start and end of this procedure.
% %\utkanadd{And again, we will show that the assumption at} \Cref{stg:manipulatinginitialization} \utkanadd{holds by the end of this proof.}
% The procedure above completes the ``act'' part of $M$'s transition's simulation. Changing the simulated current state and the simulated input and work heads' positions would incur a single step by themselves, and are handled in parallel with the above procedure, thereby incurring no additional time. Finally, changing the symbol under the simulated work tape head with the above procedure incurs up to
% \begin{equation*}
% {\underbrace{1 + 2 + 4 + 8 + \dotsb + n}_{\text{\Cref{stg:manipulatingoffsetpreparation}}}} + {\underbrace{n}_{\text{\cref{stg:manipulatingsimulatedmemory}}}} \le 1 + 3n
% \end{equation*}
% steps.
% The two routines for reading and changing the simulated memory contents are carried out back to back, and they both leave the heads $\head_{\gamma}$, $\head_{\delta}$, and $\head_{\epsilon}$ on the left end\-/marker as they finish. Moreover, these heads are on the left end\-/marker also when $R$ begins its execution, by definition. The assumptions in \Cref{stg:manipulatinginitialization} of both routines are thus justified. %Therefore, the assumptions at the beginning of each procedure holds, without those procedures having to spend any time on moving those heads.
% The two parts together take at most $1 + c + 3n + 2cn$ steps, which is an upper bound to the multiplicative runtime overhead of $R$ simulating $M$. Thus, $R$ completes its simulation in $t(n) \cdot \paren*{1 + c + 3n + 2cn}$ steps.
% \qed %% LLNCS ONLY
\section{Proof of \texorpdfstring{\Cref{lem:polyclock}}{Lemma \ref{lem:polyclock}}}\label{sec:polyclockproof}
\polyclock*
\begin{proof}
By the implications of $f(n) \in \OH{n^t}$, let $c > 0$ and $n_0 > \errprematuretimeout^{-1}$ be integers large enough to satisfy $f(n) \le c \cdot n^t$ for all $n \ge n_0$. The extra constraint upon $n_0$ to be larger than $\errprematuretimeout^{-1}$ will be evident by the end of the proof.
We will analyze the runtime requirements of each stage of the probabilistic finite automaton $M_{t,c,n_0}$ presented in \Cref{alg:polyclock}.
% let $M_{t,c,n_0}$ be a probabilistic finite automaton embodying the following algorithm:
\begin{algorithm}[htb]
\begin{turingmultienum}%{M_{t,c,n_0}}{On input $w$:}
\item\label{stg:polyclockshortfilter} If $n < n_0$, %\footnote{\utkanrem{Note that this check brings the input head to the right end\-/marker.}}
pause for % \utkanrem{$\max\paren*{f(n), \ceil*{c \cdot n^{t+1}}}$}
$f(n)$ time\-/steps and \emph{halt}. % \utkanadd{\timespec{\OH{n}}}
\item\label{stg:polyclocksublinearfilter} If $t = 1$, % $t \le 1$,
move the input head back to \lend{}. Then, move the input head right until it reaches \rend{}, while pausing it for $c - 1$ time\-/steps after each movement, then \emph{halt}. % \utkanadd{\timespec{\OH{n}}}
\item\label{stg:polyclockbegin} Repeat the following $t$ % $\ceil{t}$
times:
\begin{turingmultienum}
\item\label{stg:polyclockheadreset}
Move the input head to the beginning of the input string. % \utkanadd{\timespec{\OH{n}}} %\utkanadd{Bu adim alttakinin altindaydi, buraya aldim.}
\item\label{stg:polyclockrandwalk}
Perform a random walk with the input head (\ie, repeatedly move the input head towards left or right by the flips of a coin) until the input head reaches \lend{} or \rend{}. Pause for $c - 1$ time\-/steps after each step moving the input head. % \utkanadd{\timespec{\OH{n}}}
\end{turingmultienum}
\item If any of the last $t$ % $\ceil{t}$
random walks have ended with the input head reaching \lend{}, go back to \Cref{stg:polyclockbegin}.
\item \emph{Halt}.
\end{turingmultienum}
\caption{The probabilistic finite automaton $M_{t,c,n_0}$.}
\label{alg:polyclock}
\end{algorithm}
% \utkanremlong{
% \begin{turing}{M_{t,c,n_0}}{On input $w$:}
% \item\label{stg:polyclockshortfilter} If $n < n_0$, %\footnote{\utkanrem{Note that this check brings the input head to the right end\-/marker.}}
% pause for % \utkanrem{$\max\paren*{f(n), \ceil*{c \cdot n^{t+1}}}$}
% $f(n)$ time\-/steps and \emph{halt}.
% \item\label{stg:polyclocksublinearfilter} If $t \le 1$, move the input head back to \lend{}. Then, move the input head to right until it reaches \rend{}, while pausing it for $c - 1$ time\-/steps after each movement, then \emph{halt}.
% \item\label{stg:polyclockbegin} Repeat the following $\ceil{t}$ times:
% \bitem{\label{stg:polyclockheadreset}Move the input head to the beginning of $w$. %\utkanadd{Bu adim alttakinin altindaydi, buraya aldim.}
% }
% \bitem{\label{stg:polyclockrandwalk}Perform a random walk with the input head (\ie, repeatedly move the input head towards left or right by the flips of a coin) until the input head reaches \lend{} or \rend{}. Pause for $c - 1$ time\-/steps after each step moving the input head.}
% \item If any of the last $\ceil{t}$ random walks have ended with the input head reaching \lend{}, go back to \Cref{stg:polyclockbegin}.
% \item \emph{Halt}.
% \end{turing}
% }
% \utkanadd{ASAGIDAKI HESAPLARDA EN SON HALT EDILEN ADIMI HIC SAYMAMISIM. SAYILMALI MI?}BOŞVER BENCE!!!!!!!!!!!!!!!!!!!!
% \utkanadd{We will now count the number of steps made at each stage, precisely. This requires us to decide whether $M_{t,c,n_0}$ will be ``chaining'' its actions or not; \eg, considering a case when $n \ge n_0$ and $t \le 1$, will $M_{t,c,n_0}$ start moving the input head immediately back to $\lend$ at \Cref{stg:polyclocksublinearfilter} after reading the \ith{n_0} symbol of the input at \Cref{stg:polyclockshortfilter}, or will it will start moving to the left after letting the input head stay put for once at the \ith{n_0} symbol? While $M_{t,c,n_0}$ should abide the constraints either way, for the sake of simplicity, we will do the analysis for the case when $M_{t,c,n_0}$ does not chain its actions.}
\Cref{stg:polyclockshortfilter} starts with $\min\paren{n + 2, n_0 + 1}$ steps to check whether $n < n_0$. If so, $M_{t,c,n_0}$ runs for a total of $n + 2 + f(n)$ time\-/steps and then halts, which yields a runtime within desired bounds with certainty.
% The extra $n$ steps here will not be an issue with the longer inputs whereby $M_{t,c,n_0}$ will halt on a subsequent stage, since $n \in \OH{n^{t+1}}$ for all $t > 0$.
When $n \ge n_0$ and $t=1$, % $t \le 1$,
$M_{t,c,n_0}$ halts after running for $2n_0 + cn + 2$ steps in \Cref{stg:polyclockshortfilter,stg:polyclocksublinearfilter} combined, which is again within the expected and minimum time limits, and with certainty.
The rest of the proof will examine the claims for $n \ge n_0$ and $t > 1$.
\paragraph{Expected runtime.} Each random walk at \Cref{stg:polyclockrandwalk} is commonly known as the \emph{gambler's ruin}, and the probability of each ending at the right\-/hand side of the input tape is $\paren*{n+1}^{-1}$ by their Markov chain analysis~\cite[Section~7.1]{KS60}. Consequently, the probability of having a \emph{terminating batch} (\ie, a batch of $t$ % $\ceil{t}$
random walks where each of them ends up at the right\-/hand side of the input tape) is $\paren*{n+1}^{-t %\ceil{t}
}$.
The expected number of independent trials to observe a binomial event is the reciprocal of its occurrence probability~\cite[Section~C.4]{CLRS09}. Therefore, the expected number of batches until termination is $\paren*{n+1}^{t %\ceil{t}
}$, and the same for random walks is $t %\ceil{t}
\cdot \paren*{n+1}^{t %\ceil{t}
}$.
The expected runtime of each random walk is $cn$ steps~\cite[Section~7.1]{KS60}. The reset in \Cref{stg:polyclockheadreset} takes exactly $n_0 + 2$ steps before the first random walk, and it is expected to take
% \utkanrem{another}
\begin{equation*}
{\underbrace{\paren{n+1}^{-1} \cdot (n + 2)}_{\text{resetting from \rend}}} + {\underbrace{\paren{1-\paren{n+1}^{-1}} \cdot 1}_{\text{resetting from \lend}}} = 2
\end{equation*}
steps
% \utkanrem{with each random walk}
before every subsequent one. Taking \Cref{stg:polyclockshortfilter} into account as well, the expected runtime of $M_{t,c,n_0}$ is
\begin{equation*}
t %\ceil{t}
\cdot \paren*{n+1}^{t %\ceil{t}
} \cdot \paren*{cn + 2} + 2n_0 + 1 \in \OH{n^{t %\ceil{t}
+1}}.
\end{equation*}
% !!!!BUNU TAM ANLAMIYORUM. İLK RANDOM WALK'TAN ÖNCE n0+1 sağa, n0 + 2 de sola adım atıyor değil mi? Bu ifade exact mi? Kaç random walk varsa o kadar da 2 adımlık dönüş süresi sayarsan 2 adım fazla saymış olmuyor musun? Bu mikroskopiklik yerine yukarıda "at most" falan desek iş kolaylaşır mı?!!!!! \utkanadd{}DUR DUR ANLADIM GALİBA, 2 SOLDAN SAĞA GİTMİŞ; HESAP DOĞRU evet o fazlalık iki sağdan çıkmış, ben de dün bakarken "kesin burada bir hata vardır" dedim ve yokmuş, kendime hayret ettim... yine de (for our purposes) gereksiz precise tabi bunların hepsi
\paragraph{Minimum runtime.} For simplicity, we note that $\paren*{n+1}^{-t %\ceil{t}
}$, the probability of a terminating batch occurring, is less than $n^{-t}$.%\footnote{The reader should note that we are loosening the bounds and inequalities here and throughout the analysis for the sake of simplicity.}
% (given $n \ge n_0 > \errprematuretimeout^{-1} > 0$)
It is evident that the execution of a terminating batch takes more than $%\ceil{t} \cdot nc \ge
tnc$ time\-/steps, and thus, in a time frame of $f(n) \le c \cdot n^t$ steps, there are at most $\frac{n^{t-1}}{t}$ opportunities for terminating batches to occur, which is less than $n^{t-1}$ (given $t > 1$).
The probability of an event with an occurrence probability less than $n^{-t}$ happening at least once given less than $n^{t-1}$ opportunities, is less than
\begin{align*}
g_t(n) &= 1 - \paren*{1 - n^{-t}}^{n^{t-1}}.\\
\intertext{Consider the following binomial expansion: %series:
}
g_t(n) &= 1 - \paren*{\sum_{k=0}^{n^{t-1} %\infty
} \paren*{-1}^k \cdot \binom{n^{t-1}}{k} \cdot n^{-tk}}\\
&= \frac{n^{t-1}}{n^t} - \frac{n^{t-1}}{n^t} \cdot \frac{n^{t-1} - 1}{2n^t} + \frac{n^{t-1}}{n^t} \cdot \frac{n^{t-1} - 1}{2n^t} \cdot \frac{n^{t-1} - 2}{3n^t} - \dotsb\\
\intertext{Since the terms are % series is
alternating and the magnitudes are decreasing, we have}
g_t(n) &< \frac{n^{t-1}}{n^t} = n^{-1}.
\end{align*}
$g_t(n)$ constitutes an upper bound to the ``error'' of $M_{t,c,n_0}$ halting sooner than the desired lower bound of $f(n)$ time\-/steps. Since $g_t(n)$ is monotone decreasing for positive $n$, $g_t(\bar{n}) < \errprematuretimeout$ follows for all $\bar{n} \ge n_0$ (recalling that $n_0 > \errprematuretimeout^{-1}$). With \Cref{stg:polyclockshortfilter} ensuring that $M_{t,c,n_0}$ waits long enough for the strings shorter than $n_0$ with probability 1, the probability of $M_{t,c,n_0}$ halting prematurely will be less than $\errprematuretimeout$ for strings of any length. Note that $\errprematuretimeout$ can be set to any desired small positive value by simply employing a suitably large number of states (to make $n_0$ appropriately large) in the implementation of \Cref{stg:polyclockshortfilter}.
% \utkanadd{Note that decreasing $\errprematuretimeout$ only affects $n_0$ by potentially increasing it. To accommodate for that increase, $M_{t,c,n_0}$ only needs an equal amount of more states for the counting in \Cref{stg:polyclockshortfilter}.}
%
% \paragraph{Finite runtime} \utkanrem{Since the probability of a terminating batch occurring is positive, such a batch will eventually happen, making the probability of $M_{t,c,n_0}$ running forever zero.}
% \qed %% LLNCS ONLY
\end{proof}
\section{The double exponential timer}\label{sec:dir2appendices}
%\paragraph{Double\-/exponential counter.}
\Cref{alg:tick} restates the subroutine \TICK{} described in \Cref{sec:clock}. Recall that we also maintain a global Boolean variable $T$ that tracks whether all the red coins flipped since the last reset of this variable came out heads. The integers $c$ and $t$ are parameters that we can use for setting the expected number of ticks. \Cref{stg:polycoins} uses logarithmic space in the work tape %\footnote{\utkanadd{Same feat can be achieved using $t$ heads if one seeks to use the \TICK{} subroutine in a multihead finite automaton.}} !!!!BÖYLE BİR ŞEY YAPAN BİR ÇOKKAFALI MAKİNEMİZ YOKSA BUNU DEMEYELİM!!!!
to count the coin tosses.
%It will be helpful to imagine that we have fair coins of two colors, say, red and blue. The timer mechanism consists of a subroutine that embodies a single tick, and a global Boolean variable that tracks whether all red coins flipped since the last reset of this variable came out heads. Each call of the tick subroutine flips one red coin and $p(n)$ blue coins. If one or more blue coins come out tails, the subroutine call ends with the timer still running. If all the blue coin outcomes are heads, but the Boolean variable indicates that one or more red coins flipped since the last reset came out tails, the variable is reset, and the subroutine ends with the timer still running. If all the blue coin outcomes are heads, \emph{and} if all the red coins flipped since the last reset also came out heads, the timer runs out.
%The proof of~\Cref{lem:dir2NEW} claims to design the verifier $V_2$ to ``check'' on a virtual counter that is expected to run out after $f_2(n) \in 2^{2^{\OHMEGA{n}}}$ ticks, initiated with each check. $V_2$ makes a check after each time it advances the sims of $V_1$ and halts when the check indicates that the counter has run out, thereby simulating the sims for exactly that many steps. There is not an actual counter to check, but this check itself creates the illusion of a counter with an expected ticking\-/limit of $f_2(n)$. The way $V_2$ makes this check is as follows:
% \utkanadd{
% \begin{turingenum}
% \item\label{stg:accumulate} Toss a red coin and update the Boolean variable $T$ according to the outcome.
% \item\label{stg:polycoins} Toss \utkanadd[50]{up to} $p(n) = c \cdot n^t$ blue coins. \utkanadd[50]{If one of them comes up tails, stop tossing and \emph{return} with the timer still running.} % by doing the following: Move all $t$ heads to the beginning of the input. Sweep $t$ heads across the input in a hierarchy akin to a $t$\=/handed clock, until they all are at the end of input. For some constant $c$, toss $c$ coins at each tick of the fastest head.
% \item\label{stg:judgement} (Arriving at this stage implies that \utkanadd[50]{$p(n)$ blue coins were flipped in this tick and they all came up heads.}) If $T$ indicates that one or more red coins flipped since the last reset came out tails, reset $T$ and \emph{return} with the timer still running.%skip the remaining stages of this round's check.
% \item\label{stg:timeup} (Arriving at this stage implies that all red coins flipped at \Cref{stg:accumulate} since %!!!İYİ DE BU STAGE DAHA BİR SANİYE ÖNCE REACH EDİLDİ?!?!?!?!the last time \Cref{stg:judgement} was reached (\ie,
% the last reset of $T$ were all heads.) \emph{Return} and announce that the timer has run out.
% \end{turingenum}
% }
% \utkanremlong{
% \pagebreak[2]
\begin{algorithm}[htb]
\begin{turingmultienum}
\item\label{stg:accumulate} Toss a red coin and update the Boolean variable $T$ according to the outcome.
\item\label{stg:polycoins} Toss $p(n) = c \cdot n^t$ blue coins.% by doing the following: Move all $t$ heads to the beginning of the input. Sweep $t$ heads across the input in a hierarchy akin to a $t$\=/handed clock, until they all are at the end of input. For some constant $c$, toss $c$ coins at each tick of the fastest head.
\item\label{stg:pass} If any blue coin outcome at \Cref{stg:polycoins} was tails, \emph{return} %\utkanadd{UTKAN: bunu Appendix A.2'de \emph{halt}'i yazdigimiz gibi veya Lemma 10'da \emph{accept} ve \emph{reject}'leri yazdigimiz gibi, \emph{return} olarak yazmaya ne dersiniz?}!!!!!!!!!HARİKA FİKİR; ÖYLE YAPALIM LÜTFEN!!!!!!
with the timer still running. %skip the remaining stages of this round's check (retaining the accumulation in $T$ for the next check).
\item\label{stg:judgement} (Arriving at this stage implies that all the blue coins of \Cref{stg:polycoins} came up heads.) If $T$ indicates that one or more red coins flipped since the last reset came out tails, reset $T$ and \emph{return} with the timer still running.%skip the remaining stages of this round's check.
\item\label{stg:timeup} (Arriving at this stage implies that all red coins flipped at \Cref{stg:accumulate} since %!!!İYİ DE BU STAGE DAHA BİR SANİYE ÖNCE REACH EDİLDİ?!?!?!?!the last time \Cref{stg:judgement} was reached (\ie,
the last reset of $T$ were %all
heads.) \emph{Return} and announce that the timer has run out.
\end{turingmultienum}
\caption{The \TICK{} subroutine.}
\label{alg:tick}
\end{algorithm}
% }
% \utkanadd{Note that \Cref{stg:polycoins} can be ``short\-/circuited'' to \Cref{stg:pass} as soon as a blue coin comes up as tails, since this does not have an effect on the number of ticks the timer makes. This modification improves the expected runtime of each tick to \OH{1} as the expected number of blue coin flips within each tick becomes \utkanadd[50]{less than} $2$,\footnote{\utkanadd[50]{$2 - 2^{-p(n)+1}$, to be exact, by simple calculation of the expectation. (SU HESAPLA: $p(n) \cdot 2^{-p(n)} + \sum_{k=1}^{p(n)} k \cdot 2^{-k}$.)}} while the worst\-/case runtime is still in \OH{n^t}.}!!!!BUNU PAPERDAN KALDIRSAK? KALIRSA HEM REWORDING HEM RE-PLACING GEREKİYOR \utkanadd{UTKAN: Bana bu yazdıklarımla seamlessly oluverdi gibi gelmişti. Çok işi var diyorsanız hiç is çıkmasın, ben istemem.} VE YİNE DE BURADA EFFICIENCYDEN BAHSETMEMİZ OKURU MUTLU ETMİYOR BENCE!!! \utkanadd{UTKAN: Mutluluğu nasıl ölçüyoruz :D Bu canavar timerın canavar ticklerinin time-complexity açısından sadece bir constant kadar overheadinin olduğunu fark etmek beni mutlu etti, belki okuyanları da eder. Tabii diğer taraftan ``bu ne perhiz bu ne lahana turşusu'' da dedirtebilir; bunu kullanan tek constructionımızda çalışma süresi yerine public coin sayısını takip ettiğimiz için simülasyonun time-complexitysinde $g(n)$ kat artış oluyor, ki o sürexw de zaten double-exponential; tüm bunlar olurken burada $p(n)$ kat tasarruf kovalanıyor oluşu biraz tezat. Yine de son bir kez not etmek isterim; burada tasarruf edilen süre, time edilen şey tarafından kullanılamayan, çöpe giden, sadece ziyan olan bir süre.}
To analyze the expected amount of subroutine calls (ticks) before the timer runs out, we define the following random variables to represent the described counts:
\begin{itemize}
\item[$X$:] Times the subroutine is called.
\item[$Y$:] Times the tick advances control to \Cref{stg:judgement}, \ie, all $p(n)$ blue coins come up heads.
\item[$Z$:] Number of red coins flipped since the last reset as the tick advances to \Cref{stg:judgement} (at any given time).
\item[$Z_i$:] Number of red coins flipped since the last reset as the tick advances to \Cref{stg:judgement} for the \ith{i} time.
\end{itemize}
% \begin{center}
% \begin{tabular}{r|p{32em}}
% \makecell[r]{\textbf{Random}\\\textbf{Variable}} & \textbf{Description} \\\midrule
% $X$ & Times the subroutine is called.\\
% $Y$ & Times the tick advances control to \Cref{stg:judgement}, \ie, all $p(n)$ blue coins come up heads.\\
% $Z$ & Number of red coins flipped since the last reset as the tick advances to \Cref{stg:judgement} (at any given time).\\
% $Z_i$ & Number of red coins flipped since the last reset as the tick advances to \Cref{stg:judgement} for the \ith{i} time.
% \end{tabular}
% \end{center}
Let \exv{O} denote the expected value of a random variable $O$. The expected value that we are after is \exv{X}.
The probability that any tick advances to \Cref{stg:judgement} (\ie, $p(n)$ blue coins come up heads) is $2^{-p(n)}$. % \utkanrem{By~\cite[Section~C.4]{CLRS09}}
Hence, we expect there to be $2^{p(n)}$ attempts, each one flipping another red coin, since the last reset of variable $T$ %and}
before control advances to \Cref{stg:judgement} in some subroutine call. Thus, we have
\begin{equation*}
\exv{Z} = 2^{p(n)}.
\end{equation*}
We can say the following for $X$, trivially by the fact that each tick flips exactly one red coin at its \Cref{stg:accumulate}:
\begin{equation*}
X = Z_1 + Z_2 + \dotsb + Z_Y.
\end{equation*}
Since the expected value operator is a linear operator, we have
\begin{equation*}
\exv{X} = \exv{Z_1} + \exv{Z_2} + \dotsb + \exv{Z_Y}.
\end{equation*}
Since each \exv{Z_i} trivially equals \exv{Z}, for a particular $Y = y$, we have
\begin{equation*}
\exv{X \given Y=y} = 2^{p(n)} \cdot y,
\end{equation*}
and by the Law of Total Expectation, we have
\begin{equation*}
\exv{X} = \exv{\exv{X \given Y}} = \exv{2^{p(n)} \cdot Y} = 2^{p(n)} \cdot \exv{Y}.
\end{equation*}
To determine \exv{Y},
consider a subroutine call in which control has just advanced to \Cref{stg:judgement}. Let $z$ denote the number of red coins flipped since the last reset if the program had reached \Cref{stg:judgement} before, and since the beginning of the program's run otherwise. Such a subroutine call will advance further to \Cref{stg:timeup}, indicating time\-/out, if all $z$ coin outcomes were heads. The probability of this is $2^{-z}$. If we had $Z = z$ at any given time \Cref{stg:judgement} was reached, then %by~\cite[Section~C.4]{CLRS09}
we would expect \Cref{stg:timeup} to be reached after \Cref{stg:judgement} having been reached the following number of times:
\begin{equation*}
\exv{Y \given Z = z} = 2^z.
\end{equation*}
Then, by the Law of Total Expectation, we have
\begin{equation*}
\exv{Y} = \exv{\exv{Y \given Z}} = \exv{2^Z}.
\end{equation*}
By Jensen's Inequality, we have
\begin{equation*}
\exv{2^Z} \ge 2^{\exv{Z}}.
\end{equation*}
If we multiply both sides with $2^{p(n)}$ and then make the substitutions by the equalities we established, we obtain our lower bound:
\begin{align*}
2^{p(n)} \cdot \exv{2^Z} &\ge 2^{p(n)} \cdot 2^{\exv{Z}},\\
2^{p(n)} \cdot \exv{Y} &\ge 2^{p(n)} \cdot 2^{2^{p(n)}},\\
\exv{X} &\ge 2^{p(n)} \cdot 2^{2^{p(n)}}.
\end{align*}
This proves that the expected number of subroutine calls is in $2^{2^{\OHMEGA{n^{t}}}}$. %\utkanadd{OMEGANIN ICINE UZERI-t EKLEDIM. ``is at least $2^{2^{p(n)}}$'' DE DIYEBILIRIZ?}
\section{\texorpdfstring%
{Construction of \tafa{} $M$ in the proof of \Cref{thm:conspubliconly}}%
{Construction of \tafa{} M in the proof of Theorem \ref{thm:conspubliconly}}}
\label{sec:tafaconstruction}
Given a constant\-/space verifier $V = \paren*{Q_V, \Sigma, \Phi, \Gamma, \delta_V, q_{V,0}}$ which flips at most $r$ public coins, we will construct a \tafa{} $M$ as described in the proof of \Cref{thm:conspubliconly}. Let $\Qpub$, $\Qcom$, and $\Set{\qacc[V], \qrej[V]}$ be the subsets of $Q_V$ that correspond to public coin flips, communications, and halting, respectively, as described in \Cref{subs:vers}. Since $V$ can simulate a constant\-/space work tape in its finite state, we will assume that $V$ repeatedly writes $\blanksymb$ with its work tape head without ever moving it, without loss of generality.
For any given set of coin\-/flip sequences $S$, where each such sequence is a string in $\Set{0,1}^*$ %!!!ŞİMDİ DOĞRU MU???!!! \utkanadd{UTKAN: Bence dogru.} %\utkanadd{UTKAN: "each such sequence is a string \textbf{over} X" dediğimizde X'in alfabe olması gerekir bence. $\Set{0,1}^+$ ise bir string kümesi, dil. "Over" yerine "in" yazmamız halinde de: Kümenin $\Set{0,1}^+$ değil de $\Set{0,1}^*$ olmasının, yani bir sequence'ın empty string olabilmesinin sakıncası var mı? Ben düşündüğümde yok gibi gelmişti. (Verifier'ın para atmaksızın kabul ettiği inputlara denk geliyor.) Hatta sanki "bazı (kısa) inputlar için deterministik karar veren" türde ön filtreleri olan verifier'lar için sequence'ın empty string olarak verilebilmesi ($S = \Set{ \estring }$ tahmininin yapılabilmesi) gerekiyor.}
representing the outcomes of a fair coin, % made up of symbols from some set of symbols $B$,
let $\prefix{S}$ (resp.\ $\pprefix{S}$) be the set of all prefixes (resp.\ proper prefixes) of sequences in $S$. %!!MALUM KISMI ATTIM!!! \utkanadd{UTKAN: Tamamdir} %, \ie,
%\begin{align*}
% \prefix{S} &= \Set{s | s \cdot B^* \in S},\\
% \pprefix{S} &= \Set{s | s \cdot B^+ \in S}.\\
% \shortintertext{VEYA}
%\pprefix{S} &= \prefix{S} \setminus S.
%\end{align*}
%(UTKAN: BU \ie{} ILE BASLAYAN KISIM GEREKLI DEGILSE ATABILIRIZ. ORAYI ATINCA "where each sequence is made up of symbols from some set of symbols $B$" DEMEYE DE GEREK KALMIYOR.)
% !!!!!!!!YUKARIDA YAPTIĞIM DEĞİŞİKLİK OK İSE BU KISMI ATABİLİRSİN!!!!!! \utkanadd{UTKAN: Yukarıda (eğer ``over'' yerine ``in'' yazarsak) eskiye kıyasla efektif olarak $B$'yi $\Set{0, 1}$ olarak sabitlemiş ve sequence'ları empty string olamaz hale getirmiş oluyoruz. Bu değişiklikler bu kısmı nasıl etkiliyor ki? Bundan bağımsız olarak atılabilirdi bence de ama yapılan değişikliğin bu kısmı nasıl daha fazla atılabilir kıldığını göremedim.}
Let $\binleq{r}$ denote the set of all coin\-/flip %!!!BU CÜMLEYİ DEĞİŞTİRDİM!!! \utkanadd{UTKAN: Bence ok.}
sequences up to length $r$ and let $\maj{r}$ be the set of all prefix\-/free subsets of $\binleq{r}$ which have total probability %\utkanadd{UTKAN: Bu total'ın her subset için, subsetin elemanlarının total'ı olduğu açık mı?}
greater than $\sfrac12$, \ie,
\begin{gather*}
\binleq{r} = \Set{x | x \in \Set{0, 1}^*, \abs{x} \le r},\\
\maj{r} = \Set{S | S \subseteq \binleq{r},S \cap \pprefix{S} = \emptyset, \textstyle\sum_{x \in S} 2^{-\abs{x}} > \sfrac12}.
\end{gather*} % !!!!!!!!!SUBSETLİ ŞARTI DA DİREĞİN SAĞ TARAFINA YAZMAK DAHA İYİ OLUR!!!!!!!
%UTKAN: PROPER-PREFIX tanimini \binleq{r} ve \maj{r} taniminin oncesine aldim, cunku \maj{r} tanimini yukaridaki gibi PROPER-PREFIX kullanarak yapinca bence daha dogal/anlasilir oluyor.
\newcommand\qmain{\ensuremath{Q_{\mathrm{main}}}}
\newcommand\qflip{\ensuremath{Q_{\mathrm{flip}}}}
Let $M = \paren*{Q, \Sigma, \delta, q_0}$. We define $Q$ as the union of four mutually exclusive sets.
\begin{gather*}
Q = \Set{q_0} \cup \qmain \cup \qflip \cup \Set{\qacc, \qrej},
\shortintertext{where}
% \qmain = \maj{r} \times Q_V \times \Gamma \times \binleq{r}, \text{ and}\\
% \qflip = \maj{r} \times \Qpub \times \Gamma \times \binleq{r} \times \Set{0, 1}.\\
\qmain = \Set{ \paren*{S, q_V, \gamma, p} | S \in \maj{r}, q_V \in Q_V, \gamma \in \Gamma, p \in \prefix{S} }, \\
% \utkanrem{\qflip = \Set{ \paren*{S, q_V, \gamma, p, \bpub} | S \in \maj{r}, q_V \in \Qpub, \gamma \in \Gamma, p \in \pprefix{S}, \bpub \in \Set{0, 1} }.}\\
% \\
% \qflip = \Set{ \paren*{S, q_V, \gamma, p, \bpub} | \begin{array}{l}
% S \in \maj{r}, q_V \in \Qpub, \gamma \in \Gamma, \\
% p \in \pprefix{S}, \bpub \in \Set{0, 1}
% \end{array} }.
% \\
% \begin{multlined}
% \qflip = \\
% \Set{ \paren*{S, q_V, \gamma, p, \bpub} | S \in \maj{r}, q_V \in \Qpub, \gamma \in \Gamma, p \in \pprefix{S}, \bpub \in \Set{0, 1} }.
% \end{multlined}\\
% \utkanadd{
\qflip = \Set{ \paren*{S, q_V, \gamma, p, \bpub} | S \in \maj{r}, q_V \in \Qpub, \gamma \in \Gamma, p \cdot \bpub \in \prefix{S}, \bpub \in \Set{0, 1} },
% }
\end{gather*}
% \utkanadd{
and $\qacc$ and $\qrej$ are the accepting and rejecting states, respectively.
% }
The set of universal states, \Qun{}, is the following subset of $\qmain$:
\begin{equation*}
\Qun = \Set{\paren*{S, q_V, \gamma, p} | S \in \maj{r}, q_V \in \Qpub, \gamma \in \Gamma, p \in \pprefix{S}}.
\end{equation*}
All other non\-/halting states of $M$ are existential.
At every step, the first four components of the states from $\qmain$ and $\qflip$ will keep
the following information:
\begin{enumerate}
\item A set of coin sequences that are supposed to lead $V$'s simulation to acceptance, which has been guessed by the initial transition and will remain constant for the rest of the execution.
\item The simulated state of $V$.
\item The content of the simulated communication cell.
\item The history of coin outcomes used in the simulation up to this point. (This component will initially contain the empty string, \estring.)
\end{enumerate}
The states in \Qun{} and $\qflip$ will be used in a two\-/step procedure to execute a universal branching (to simulate both possible outcomes of a coin toss of $V$ parallelly when necessary), immediately followed by an existential branching (to simulate the prover response to $V$), with the last component of states in $\qflip$ holding that coin outcome during the procedure, as will be detailed below.
% !!!!!GÖRDÜĞÜN GİBİ BURAYI KISALTTIM. EĞER AŞAĞIDA ZATEN ANLATTIĞIMIZ PROSEDÜR TANIMINDA EKSİK BİR ŞEY VARSA ORAYA EKLE PLZ!!!!!!!! \utkanadd{UTKAN: Kısaltma tamamdır. Eksiklik ne olabilir, düşünemedim, inceleyemedim, o sebeple burayı comment-out edemedim.}
% !!!BURADAN BİR ŞEY ÇIKARDIM!!!%to ensure that all the coin flip sequences in $S$ are covered universally,
%\utkanadd{UTKAN: Bence burada cikarilan yer guzel bir sey soyluyormus, coin tossing event'inin neden universal branching ile simule edildigini guzel ozetliyormus. Bu bilgiyi/niyeti baska bir yerde bu sekilde acikca veriyor muyuz?}
%in the first step of a two-step procedure !!!!DOĞRU MU?!!!!!!! \utkanadd{UTKAN: Asagida bunun benzerinin yazdigi yerde dedigim seyden oturu cok dogru olmayabilir gibi geliyor.}
%to execute a universal branching (simulating a coin toss of $V$) immediately followed by an existential branching (simulating the prover response to $V$), as will be detailed below.
%States in will be used in the final step of the two\-/step procedure !!!!DOĞRU MU?!!!!!!! \utkanadd{UTKAN: Bence tam doğru değil: $\qflip$'yi hem $\qflip$'den çıkan transition'lar (kayitli bilgiye erisirken), hem de $\qflip$'ye giren transition'lar (bilgiyi kaydetmek icin) kullanıyor. Yani bence $\qflip$ hakikatten two-step procedure'un tamamında (eski deyimimle "to carry out the coin tossing transitions of $V$" etmek için) kullanılıyor.}
%mentioned above. The last component of these states will keep the outcome of the !!!ŞİMDİ NASIL?!!! %last \utkanadd{UTKAN: Buna "last" degil de "current(ly)" demeliyiz belki de. Cunku aslinda 2afa zaten coin atmiyor, burada bahsedilen simule edilen V'nin attigi coin, ve simulasyonda bu sirada su an hala o adim hala henuz bitmis degil (simulasyonun ilk yarisi tamamlandi, ikinci yarisi bundan hemen sonra). Dolayisiyla "current" demek belki daha dogrudur.}
%simulated public coin toss, which will be appended to the history (\ie, the fourth component) with the step that follows.
% !!!BURADA DA in Q1 ŞARTI DİREĞİN SAĞINDA OLSA?!?!?!!! \utkanadd[80]{UTKAN: Sağ tarafa $\paren*{S, q_V, \gamma, p} \in \qmain$ yazmak bence garip olurdu (hem bütün tuple tekrar edileceği için hem de $q_V$ ve $p$ için sağ tarafta iki defa kısıt belirtilmiş olacağı için). Onun yerine sağ tarafa sadece $S$ ve $\gamma$ için kısıtları yazdım. Bence bu şekilde de açıklayıcılığı zayıflamış oldu. Eskiden $\Qun$'un $\qmain$'in bir alt kümesi olduğu çok aşikardı.}
%\utkanrem{where $\pprefix{S}$ is the set of all proper prefixes of sequences in $S$.}
We now present the transition function of $M$ in parts. For all $q\in Q \setminus \Set{\qacc, \qrej}$ and $\sigma\in\Sigma_{\bowtie}$, $\delta(q,\sigma)$ has the value $\Set{ \qrej }$, unless specified otherwise below.
\paragraph{The initial transition.}
The first step of $M$, which guesses a set $S$ from \maj{r}, is realized by
\begin{equation*}
\delta(q_0, \lend) = \Set{\paren*{\paren*{S, q_{V,0}, \blanksymb, \estring}, 0} | S \in \maj{r} }.
\end{equation*}%!!!!$\in \qmain \times \Delta$ FASLINI SİLDİM; OK??!!!!!!!! \utkanadd[80]{UTKAN: Bence bu yanlış olmuş, kümede sadece tek bir eleman varmış gibi durmuş ($\Set{x}$ kümesi $x$ belirsiz bırakılmışsa bile "($x$ ne bilmiyorum ama) tek elemanı $x$ olan bir küme" şeklinde okunur bence). Dik çizgi ve sağına $S \in \maj{r}$ belirtecini ekledim, bence böylesi ok.}
\paragraph{Transitions simulating the non\-/communicating transitions of $V$.} We have %\utkanadd[80]{UTKAN: Bu zaten tek elemanlı bir kümeymiş, böylesi daha sade:}
\begin{equation*}
% \delta\paren*{\paren*{S, q_V, \gamma, p}, \sigma} = \Set{\paren*{\paren*{S, q'_V, \gamma, p}, d_i} \in \qmain \times \Delta | \delta_V\paren*{q_V, \sigma, \blanksymb, \gamma} = \paren*{q'_V, \blanksymb, d_i, 0}}
\delta\paren*{\paren*{S, q_V, \gamma, p}, \sigma} = \Set{\paren*{\paren*{S, q'_V, \gamma, p}, d_i}} \text{ where } \delta_V\paren*{q_V, \sigma, \blanksymb, \gamma} = \paren*{q'_V, \blanksymb, d_i, 0},
\end{equation*}
for all $\paren*{\paren*{S, q_V, \gamma, p}, \sigma} \in \qmain \times \Sigma_{\bowtie}$, where $q_V$ is from $\qneg{\Qcom} \setminus \Set{\qacc[V], \qrej[V]}$.
\paragraph{Transitions simulating the communicating transitions of $V$ that do not flip a coin.} We have
%\utkanadd[80]{UTKAN: Burada $\forall\gamma'' \in \Gamma$ yazmak gereksizmiş, filtrelenmediği sürece zaten soldan gelen her alternatif (soldaki alternatiflerin nereden geldiği bilgisini ($\qmain \times \Delta$) yeni ekledim) kümeye dahil olacak:}!!!!!!!BÜTÜN $\in \qmain \times \Delta$'ları SİLSEN BENCE DAHA KOLAY ANLAŞILIR OLACAK!!!!!!!!!!!!
\begin{equation*}
\delta\paren*{\paren*{S, q_V, \gamma, p}, \sigma} = \Set{\paren*{\paren*{S, q'_V, \gamma'', p}, d_i} %\utkanadd[80]{\in \qmain \times \Delta}
| \gamma'' \in \Gamma, \delta_V\paren*{q_V, \sigma, \blanksymb, \gamma} = \paren*{q'_V, \blanksymb, \gamma', d_i, 0} %\utkanrem{\text{ and } \forall\gamma'' \in \Gamma}
}
\end{equation*}
for all $\paren*{\paren*{S, q_V, \gamma, p}, \sigma} \in \qmain \times \Sigma_{\bowtie}$, where $q_V$ is from $\qneg{\Qpub} \cap \Qcom$. Here, we note that the content of the simulated communication cell switches into $\gamma''$ (the response from the simulated prover) %\utkanadd{UTKAN: Burada "the guessed response from the \textbf{imagined} prover" yazarken "guess" eylemini $M$'nin yaptigini ($M$'nin hayal etmekte oldugu prover icin "ne derdi" diyerekten tahminde bulunmasi gibi bir senaryo) soylemeye calisiyordum (bilmiyorum tam oyle anlasiliyor muydu, belki de "[...] response \textbf{of} the prover" yazmaliydim). Simdi "the guessed response from the \textbf{simulated} prover" seklinde degistirilince "guess" eylemini prover yapiyormus gibi okuyorum/anliyorum (neden bilmiyorum, belki "imagined" derken daha $M$'nin hayalinin icinde gibiydik, simdi "simulated" deyince $M$'nin "kafasindan" ciktik, o yuzden ozne Prover olmaya dogru kaydi). Fakat prover'a "guess" eylemini yakistiramadim, bence "simulated prover" yazacaksak "guess"i de cikaralim.}
directly, without ever becoming $\gamma'$ (the communication from $V$). This transition is existential, meaning that $M$ will reach acceptance if and only if there is a symbol $\gamma'' \in \Gamma$ that, when communicated to $V$, can lead $V$ to acceptance.
\paragraph{Transitions simulating a coin toss and the ensuing communication.} As previously mentioned, $V$'s transitions involving a coin toss are simulated by $M$ in two consecutive transitions. The first one is to ensure that all the coin flip sequences in $S$ are covered universally:
\begin{equation*}
\delta\paren*{\paren*{S, q_V, \gamma, p}, \sigma} = %\begin{cases}
\Set{\paren*{\paren*{S, q_V, \gamma, p, \bpub}, 0} | \bpub \in \Set{0, 1}, p \cdot \bpub \in \prefix{S} %\utkanrem{p \cdot \bpub \cdot \Set{0, 1}^* \in S}
}% & \text{if } p \notin S,\\
% \Set{\qrej} & \text{if } p \in S,\\
% \end{cases}
\end{equation*}
%for all $\paren*{\paren*{S, q_V, \gamma, p}, \sigma} \in \qmain \times \Sigma_{\bowtie}$ where $q_V$ is from $\Qpub$, \hl{hence we have $\paren*{S, q_V, \gamma, p} \in \Qun$ if $p \in \pprefix{S}$.}
% !!!BUNU BÖYLE DEMESEK DE ŞÖYLE DESEK?!! "
for all $\paren*{\paren*{S, q_V, \gamma, p}, \sigma} \in \Qun \times \Sigma_{\bowtie}$. %!!SONRA DA YUKARIDAKİ İKİ SATIRLI ŞEYİN İLK SATIRINI SİLSEK VE AŞAĞIDA BİR YERE "YUKARIDA ÇIKIŞI TANIMLANMAMIŞ HER STATE-SEMBOL ÇİFTİ REJECT STATE'E GİDER" DEYİP KESİP ATSAK????!!!!!
%\utkanadd{UTKAN: Bilmiyorum ki hocam. Ben başta okunaklı olması hedefiyle yazmıştım ama çok şey değiştirdik artık, o hedefin çok dışına çıkmış gibiyiz (en azından bana her şey artık pek bir okunaksız geliyor). Bir tek bu noktada henüz hala o hedefin dışına çıkmamışız, o sebeple buradaki "büyük resmin" ne olduğuna işaret etmek istiyorum. $\delta(\ldots)$ şeklinde verdiğimiz tanımlar sırasıyla şu kümeler için veriliyor:
%\begin{enumerate}
% \item $\Set{(q_0, \lend)}$
% \item $\qmain \times \Sigma_{\bowtie}$ where $q_V \in \qneg{\Qcom} \setminus \Set{\qacc[V], \qrej[V]}$
% \item $\qmain \times \Sigma_{\bowtie}$ where $q_V \in \qneg{\Qpub} \cap \Qcom$
% \item $\qmain \times \Sigma_{\bowtie}$ where $q_V \in \Qpub$
% \item $\qflip \times \Sigma_{\bowtie}$
% \item $q_V \in \Set{\qacc[V], \qrej[V]}$
%\end{enumerate}
%Şu gerçeği hatırlayalım: $\Qcom \supseteq \Qpub$. Yani bu iki kümenin ayırdığı üç bölge var. Venn şemasından düşünecek olursak, $\Qcom$'un oluşturduğu çemberin dışı, iki çemberin arası ve $\Qpub$ çemberinin içi. Yukarıdaki listedeki ikinci, üçüncü ve dördüncü maddeler tam olarak bu üç bölgeyi ifade ediyor ($q_V \in \Set{\qacc[V], \qrej[V]}$ durumu hariç) ve böylece $\qmain \times \Sigma_{\bowtie}$ kümesini tamamlıyorlar.
%Dediğiniz gibi yapabiliriz, hatalı değil, ama bu yukarıda bahsetmiş olduğum sistematikliği (ve bunun doğal olarak doğurabileceğini umduğum takip edilebilirliği) yitirmiş oluruz.
%Bence kümelerimizin tanımını olabildiğince kartezyen hale getirelim ki hatırlaması ve takdimi kolay olsun. Böylesi bence çok detaylı ve durumu her açıdan (yazar için hazırlama, yazar/okur için hatırlama, okur için okuma) zorlaştırıyor.
%}
Note that this transition merely introduces the simulated coin outcome into the state, turning it into a member of $\qflip$.
% \hl{Furthermore, note that we have}
% \begin{equation*}
% \delta\paren*{\paren*{S, q_V, \gamma, p}, \sigma} = \emptyset
% \end{equation*}
% \hl{when $p$ is a member of the} prefix\-/free \hl{$S$ (since no continuation of $p$ can then be a member of $S$). When that is the case, $\paren*{S, q_V, \gamma, p}$ is no longer a member of \Qun{} by definition, and therefore such ``branches'' of $M$} \reject{} \hl{(whereas the lack of alternatives would lead a universal transition to accept).}!!!!!!!???BU SON PARANTEZİ VE ÖNCESİNDEKİ CÜMLENİN therefore'a KADARKİ KISMINI KOMPLE SİLSEK BİR ŞEY KAYBEDİYOR MUYUZ? LABELING FONKSIYONU ÇOCUĞU OLMAYAN BİR UNİVERSAL KONFİGÜRASYONU LABEL ETMİYOR DİYE DÜŞÜNÜYORUM AMA BU PARANTEZİ SİLEREK BUNLARDAN HİÇ BAHSETMEDEN ANLAŞABİLİYORSAK EN İYİSİ O!!!!!!!!!!!!
%BUNU NEREDE YAZDIK? SONRASINDA BİR ACCEPTING KONFİGURASYONA GİTMİYORSA NEDEN ACCEPT EDİYOR??!?!!! \utkanadd[80]{UTKAN: Labeling fonksoynunun tanımı o şekilde (ve bence o şekilde de olmalı). Büyük $\bigwedge$/$\bigvee$/$\sum$/$\prod$ operatörleri empty set üzerinde ilgili işlemin etkisiz elemanına, yani \True{}/\False{}/0/1 değerlerine gider. Debate analojisinde de refuter'ın hamlesiz kalması ("prover'ın yaptığı stratejik hamlelerle refuter'ı hamlesiz bırakması" da denebilir) durumuna, o şekilde refuter'ın debate'i kaybetmesine ve prover'ın kazanmasına tekabul ediyor.}
Following that first transition, the second transition finishes simulating the interaction of $V$ with its prover:
\begin{equation*}
\delta\paren*{\paren*{S, q_V, \gamma, p, \bpub}, \sigma} =
\Set{\paren*{\paren*{S, q'_V, \gamma'', p \cdot \bpub}, d_i} %\utkanadd[80]{\in \qmain \times \Delta}
| \gamma'' \in \Gamma, \delta_V\paren*{q_V, \sigma, \blanksymb, \gamma, \bpub} = \paren*{q'_V, \blanksymb, \gamma', d_i, 0} %\utkanrem{\text{ and } \forall\gamma'' \in \Gamma}
}
\end{equation*}
for all $\paren*{\paren*{S, q_V, \gamma, p, \bpub}, \sigma} \in \qflip \times \Sigma_{\bowtie}$. Since this transition is existential, every prover response %any one
$\gamma'' \in \Gamma$ is
considered, as described for other transitions from communicating states of $V$ above. %lead $M$ to acceptance.
The coin value $\bpub$ used in the present branch is added to the history of coin flips carried in the fourth component of the \tafa{} state.
% !!!BU İKİ CÜMLEYİ DEĞİŞTİRDİM??????!!!!!!! \utkanadd{UTKAN: Tamamdir}
Note that states of the form $\paren*{S, q_V, \gamma, p}$ such that $q_V\in \Qpub$ and $p\in S$ are directed to \reject{} immediately, since they correspond to a scenario where the verifier tosses an additional coin that is not covered by the set $S$. % it attains a state whose current history of public coin outcomes is a member of S, since the prefix-free S then clearly does not allow for any more public coin tosses to be made, rendering the current guess of S invalid."!!!!!!!!!!
\paragraph{Halting.}
If the simulation of $V$ reaches a halting state, $M$ also halts with the same decision in its next transition, \ie,
\begin{equation*}
\delta\paren*{\paren*{S, q_V, \gamma, p}, \sigma} = \begin{cases}
\Set{\qacc} & \text{if } q_V = \qacc[V],\\
\Set{\qrej} & \text{if } q_V = \qrej[V],
\end{cases}
\end{equation*}
for all $\paren*{\paren*{S, q_V, \gamma, p}, \sigma} \in \qmain \times \Sigma_{\bowtie}$ where $q_V$ is either $\qacc[V]$ or $\qrej[V]$.
% !!!!!!!!!BURADA KARARI SANA BIRAKIYORUM; SEVDİĞİN ALTERNATİFİ KESİNLEŞTİR LÜTFEN!!!! \utkanadd{UTKAN: Hiç tercihim yok, olduğu gibi kalsın diyorum.}
% \utkanadd{Alternative:
% \begin{align*}
% \delta\paren*{\paren*{S, \qacc[V], \gamma, p}, \sigma} &= \Set{\qacc},\\
% \delta\paren*{\paren*{S, \qrej[V], \gamma, p}, \sigma} &= \Set{\qrej},
% \end{align*}
% for all $S \in \maj{r}$, $\gamma \in \Gamma$, $p \in \prefix{S}$, and $\sigma \in \Sigma_{\bowtie}$.
% UTKAN: Hatta "tanımsız her şeyi $\Set{ \qrej }$'e gönderme" kuralından ötürü $\qrej[V]$'li satır atılabilir bile. Öyle yapılırsa belki "halting"leri de "accepting" yapmak gerekir. (Bence $\qrej[V]$'li satırın kalması daha iyi.)
% }
\section{Proof of \texorpdfstring{\Cref{lem:privatesimulatespublic}}{Lemma \ref{lem:privatesimulatespublic}}}\label{sec:privatesimulatespublicproof}
\privatesimulatespublic*
\begin{proof}
Let $V_1 = \paren*{Q_1,\Sigma,\Phi,\Gamma_1,\delta_1,q_0}$
be a verifier that uses \OH{f(n)} private and \OH{g(n)} public random bits for some functions $f$ and $g$. We construct a verifier $V_2 = \paren*{Q_2,\Sigma,\Phi,\Gamma_2,\delta_2,q_0}$ that uses \OH{f(n)+g(n)} private random bits and no public coins.
The protocol that $V_2$ engages in with the prover is almost identical to that of $V_1$, with the exception that $V_1$'s public coin outcomes are emulated by private random bits of $V_2$ that are sent through the communication cell.
$Q_2$ is a superset of $Q_1$, where all the states that flip public coins in $V_1$ have been rebranded as states that flip only private coins in $V_2$.
%to simulate $V_1$ directly (\ie, transition by transition), without flipping any public coins, as follows:
$V_2$'s program inherits all transitions of $V_1$ emanating from states that do not flip public coins. $V_2$ simulates each transition of $V_1$ from a state $q$ that involves such a flip as described below.
If $q$ does not flip a private coin, the $V_1$ transition (cf.\ \Cref{tab:transitionfunction})
\begin{align*}
\delta_1\paren{q,\sigma,\phi,\gamma,\bpub} &= \paren{q',\phi',\gamma',d_i,d_w}
\intertext{is replaced in $V_2$ by the transition}
\delta_2\paren{q,\sigma,\phi,\gamma,\bpri} &= \paren{q',\phi',\paren{\gamma',\bpri},d_i,d_w},
\end{align*}
making use of an additional symbol in $\Gamma_2$ that conveys both the original communication symbol $\gamma'$ and the simulated public coin outcome in a single package. Note that $q$ remains a communication state in $V_2$ in this case.
If, on the other hand, $q$ flips a private coin as well, the corresponding $V_1$ transition
\begin{align*}
\delta_1\paren{q,\sigma,\phi,\gamma,\bpri,\bpub} &=
% \paren{q',\phi',\paren{\gamma',\bpub},d_i,d_w}\\%\midrule
\paren{q',\phi',\gamma',d_i,d_w}
% \delta_2\paren{q,\sigma,\phi,\gamma,0,\bpub} &= \paren{q',\phi',\paren{\gamma',\bpub},d_i,d_w},
\intertext{is simulated by two $V_2$ transitions}
\delta_2\paren{q,\sigma,\phi,\gamma,\bpri_1} &= \paren{(q,\bpri_1),\phi,0,0},\\
\delta_2\paren{(q,\bpri_1),\sigma,\phi,\gamma,\bpri_2} &= \paren{q',\phi',\paren{\gamma',\bpri_2},d_i,d_w},
\end{align*}
that flip two private coins, utilize new states in $Q_2$ to store the first coin outcome temporarily, and then send the required information through the communication cell.
In this case, $q$ becomes a non\-/communication state in $V_2$. The two new states $(q,0)$ and $(q,1)$ (introduced for each such $q$) are branded as communication states that also flip (only) private coins.
% !!!BURADAKİ MATERYALİ DOKÜMANIN DIŞINA KOPYALADIM
For each public coin flip removed from $V_2$'s transition function (and thereby its execution), exactly one private
% public????!!!!PRIVATE???!!! Utkan: evet, duzelttim, affedersiniz
coin flip is introduced. $V_2$ emulates $V_1$, operating with the same verification error. Its runtime is at most double that of $V_1$. $V_2$ uses the same amount of work tape as $V_1$.
%
%
% We will begin $V_2$'s construction from its states as foundation, then provide its transitions to build up. In each step of this construction, we will divide the task into three sub\-/parts outlined by the partitioning of $Q_1$ as $\qneg{\Qpub_1}$, $\qneg{\Qpri_1} \cap \Qpub_1$, and $\Qpri_1 \cap \Qpub_1$.
%
% by partitioning the state set of $V_1$ into three.
%
% \paragraph{States of $V_2$.} For each state $q_{i,1} \in \qneg{\Qpub_1}$, $V_2$ has one state $q_{i,2} \in \qneg{\Qpub_2}$. Its memberships to subsets $\Qpri_2$ and $\Qcom_2$ correspond to those of $q_1$ against $\Qpri_2$ and $\Qcom_2$, respectively. $V_2$'s operation principle in $q_{i,2}$ will be identical to that of $V_1$'s in $q_{i,1}$.
%
% For each state $q_{i,1} \in \qneg{\Qpri_1} \cap \Qpub_1$, $V_2$ has one state $q_{i,2} \in \Qpri_2 \cap \Qcom_2$. $V_2$ in $q_2$ will simulate how $V_1$ acts in $q_1$ by communicating the outcome of the private coin it flips, just like $V_1$ (mandatorily) communicates the outcome of the public coin it flips.
%
% Finally, for each state $q_1 \in \Qpri_1 \cap \Qpub_1$, $V_2$ has three states; $q_2 \in \Qpri_2 \cap \qneg{\Qcom_2}$ and $\paren{q_2, 0}, \paren{q_2, 1} \in \Qpri_2 \cap \Qcom_2$. $V_2$ will simulate $V_1$'s operation in $q_1$ in two steps, detailed below.
%
% \paragraph{Transition function of $V_2$.}
%
% To construct $V_2$, the states and transitions of $V_1$ are transformed as follows
%
%
% The state set of $V_2$ is then prepared as follows:
% \begin{align*}
% \Qpri_2 &= \Qpri_1 \cup \Qpub_1 \cup \paren*{\Qpri_1 \cap \Qpub_1} \times \Set{0, 1}\\
% \Qpub_2 &= \emptyset\\
% \Qcom_2 &= \paren*{\Qcom_1 \setminus \paren*{\Qpri_1 \cap \Qpub_1}} \cup \paren*{\Qpri_1 \cap \Qpub_1} \times \Set{0, 1}\\
% \qneg{\Qpri_2} \cap \qneg{\Qpub_2} \cap \qneg{\Qcom_2} &= \qneg{\Qpri_1} \cap \qneg{\Qpub_1} \cap \qneg{\Qcom_1}
% \end{align*}
% $V_2$'s construction is made complete by defining its transition function.
% $$
% \begin{array}{l l}
% \text{\textbf{Case}} & \text{\textbf{Mapping}}\\\midrule
% q \in \Qpri \cap \Qcom &
% \delta_2\paren{q,\sigma,\phi,\gamma,\bpri} = \paren{q',\phi',\gamma',d_i,d_w}\\%\midrule
% q \in \Qpri \cap \qneg{\Qcom} &
% \delta_2\paren{q,\sigma,\phi,\gamma,\bpri} = \paren{q',\phi',d_i,d_w}\\%\midrule
% q \in \qneg{\Qpri} \cap \Qcom &
% \delta_2\paren{q,\sigma,\phi,\gamma} = \paren{q',\phi',\gamma',d_i,d_w}\\%\midrule
% q \in \qneg{\Qpri} \cap \qneg{\Qcom} \utkanadd{\setminus \Set{\qacc, \qrej}} &
% \delta_2\paren{q,\sigma,\phi,\gamma} = \paren{q',\phi',d_i,d_w}%\\\bottomrule
% \end{array}
% $$
%
% One obtains $V_2$ by modifying
%
% For all the states of $V_1$ that do not flip a public coin and the transitions emitted from them, $V_2$ inherits those states and their transitions as they are.
%
% For each state $q$ of $V_1$ that flips only a public coin, $V_2$ instead has a new state $r$ designated to flip a private coin and to make a communication. All the transitions coming into $q$ in $V_1$, comes into $r$ instead in $V_2$. Substituting each transition emitted from $q$, such as
% \begin{align*}
% \delta_1\paren{q,\sigma,\phi,\gamma,\bpub} &= \paren{q',\phi',\paren{\gamma',\bpub},d_i,d_w},
% \intertext{a transition is emitted from $r$, such as}
% \delta_2\paren{r,\sigma,\phi,\gamma,\bpub} &= \paren{q',\phi',\paren{\gamma',\bpub},d_i,d_w}.
% \end{align*}
%
% For each state $q$ of $V_1$ that flips both a private and a public coin, $V_2$ instead has three new states $r, (s, 0)$, and $(s, 1)$, each flipping a private coin. The state $r$ is not a communicating state, but $(s, 0)$ and $(s, 1)$ do make a communication. All the transitions coming into $q$ in $V_1$, comes into $r$ instead in $V_2$. Substituting each transition emitted from $q$ as
% \begin{align*}
% \delta_1\paren{q,\sigma,\phi,\gamma,\bpri,\bpub} &= \paren{q',\phi',\paren{\gamma',\bpub},d_i,d_w},
% \intertext{a transition is emitted from $r$ as}
% \delta_2\paren{r,\sigma,\phi,\gamma,\bpri} &= \paren{(s,\bpri),\phi,0,0}
% \intertext{and a transition is emitted from $(s,\bpri)$ as}
% \delta_2\paren{(s,\bpri),\sigma,\phi,\gamma,\bpub} &= \paren{q',\phi',\paren{\gamma',\bpub},d_i,d_w}.
% \end{align*}
%
% Having substituted the functions of all the states of $V_1$ that flip a public coin and the transitions involving them, such states are omitted from $V_2$. $V_2$ functions exactly the same as $V_1$, operating with the same verification error and under the same asymptotic resource bounds. The runtime of $V_2$ is at most double that of $V_1$.
\end{proof}
% Before proceeding with the remaining of the proof, we make the remark that, by~\cite[Theorem~6.1]{CL89}, a double\-/exponential number of steps, $f_1(n)$, is enough for $V_1$ to reject nonmember input strings with a probability close to $1 - \verr_1$.
% Before proceeding with the remaining of the proof, we make the remark that, by~\cite[Theorem~6.1]{CL89}, for some linear function $l$ and any large constant $k$, $V_1$ will have rejected any nonmember input string of length $n$ in $f_1(n) = k^2 \cdot 2^{2^{l(n)}}$ steps with high probability that is at least $1 - \paren*{\verr_1 + 2^{-k} + k^{-1}}$.
% \end{filecontents*}
% \include{appendix.tex}
\end{document}
cx1 = cx1l
..cx1r
cx2 = cx2l
..cx2r
cxx = cx1l
..cx2r
For every input string, there is a certificate persuasive enough to prevent all of the deterministic verifiers from rejecting by the time they read the first two thirds of the input, since it may very well be a part of a member input.
Proof by contradiction. Farklı sertifika alanları bu iş için okunuyor diyelim. Makinemiz dili verify ettiğine göre sertifikaya bakarak her x1#tx1 stringini tüm deterministik verifierlar kabul ediyor, sağda x1 bulunmayan her x1#tx2 stringini de en az bir verifier reddediyor olmalı.
Solda sertifika okuyan V1 x1# prefixi için sertifikadan cx11, sağda okuyan V2 x1#tx1'in sağ tarafındayken sertifikadan cx12 okuyor olsun.
Solda sertifika okuyan V1 x2# prefixi için sertifikadan cx21, sağda okuyan V2 x2#tx2'nin sağ tarafındayken sertifikadan cx22 okuyor olsun.
x1# prefixi okunduktan sonra olunabilecek state tuple'larının sayısı sonlu, sertifika filtresinden (farklı sertifikalarla) sonsuz sayıda x1 geçiyor, sonsuz sayıda böyle prefixin geldiği bir tuple var. Bu tuple x1 nedir bilemez, sertifika neydi bilemez, sertifika filtresinden geçtiyi bilir.
Aynı mantıkla sonsuz sayıda x1#t aynı tuple'a geliyor.
Yani aynı tuple'a hem x1#t, hem de x2#t sonrasında ulaştığımız x1 ve x2 var
Bu durumda x1#tx2 stringini makineye sadece x1#tx1 için üretilmiş sertifikanın cx12 kısmını çıkarıp yerine cx22 sokarak 1 olasılıkla (hem V1 hem V2'yi kabul ettirerek) verify ettiririz. QED
Eğer V1 de V2 de aynı sertifika alanını okumak zorunda olsaydı bunu yapamayacaktık, çünkü birini replace edip öbürünü aynen bırakabileceğimiz iki slot olmayacaktı.
Bugünkü "Lemma 3'ü iki farklı sertifika segment'i overlap etmesi case'ine genelleme" işi üzerine:
Lemma 3'ün yerini değiştirelim, son lemma olsun.
Bu durumda (eski numaralandırmadaki) Lemma 5'i doğru düzgün ispatlarsak V1 ve V2'nin sertifikadan x okumalarını çok farklı yerlerde yapmaları gerektiği, yani overlap olamayacağını göstermiş olmuyor muyuz zaten??????ne??????????
BU CENTERMARKED TWIN BU İŞ İÇİN BİR ÖRNEK DEĞİL, 1dfa(2)'si var!!!!
\begin{theorem}
\twin{} $\in$ \langclass{}
\end{theorem}
%\textbf{Theorem 3.1.}
The language \twinlong{} can be verified by a \machine{} using only 1 coin toss. Proof of this theorem is similar to the one made in~\cite{SY14}. In~\cite{SY14}, an interactive proof model of similar capacity to \machine{} is shown to verify \twin.
\noindent\texttt{Proof}
\Cref{fig:twin} encapsulates the general idea. In \cref{fig:twin}, (a,b,c) written on the transition arrows should be interpreted as $a$ is read on input tape, $b$ is read on certificate tape and if $c$ is 1, certificate head moves. The star symbol * should be interpreted as any symbol in corresponding alphabet. Some transition arrows are omitted for readability.
We construct a \machine{} M. For the input strings of the form $wcw$, M expects a certificate string only containing the part $w$. At $q_{start}$ M starts by consuming both the certificate and input left markers and makes a coin toss, branches out to two computational paths in doing so.
\texttt{Path 1}
In this path, verifier starts at $q_{11}$. Starts by consuming input symbols until it encounters the symbol $c$ in input but does not consume any certificate symbols during this process. After the point where it consumes $c$ (rejects if there is no $c$ in input), it transitions into $q_{12}$ and starts consuming both input and certificate symbols at the same time and keeps doing this as long as both symbols are same. If it detects any discrepancy between input and certificate, it goes to a reject state. Upon reaching the right end markers of both tapes (at the same time), it transitions into $q_{accept}$ if it is still in $q_{12}$
\begin{enumerate}
\item If the input is $wcw \in \twin$ and certificate is $w$, this path finishes at the accept state.
\item If the input is $wcw \in \twin$ and certificate contains anything other than $w$, this path rejects.
\item If the input is $w'cw \notin \twin$ where $w' \neq w$ and certificate is $w$, this path finishes at the accept state wrongfully.
\item If the input $x \notin \twin$ and third case does not apply, this path rejects.
\end{enumerate}
Third case is the only case where certificate can trick the verifier into accepting a nonmember.
\texttt{Path 2}
In this path, verifier starts at $q_{21}$. Starts by consuming both input and certificate symbols at the same time until it encounters the symbol $c$ in input. If it detects any discrepancy between input and certificate, it goes to a reject state. At the point where it consumes $c$\, it expects certificate to contain right end marker (rejects if there is no $c$ in input) and transitions into $q_{accept}$ state. .
\begin{enumerate}
\item If the input is $wcw \in \twin$ and certificate is $w$, this path finishes at the accept state.
\item If the input is $wcw \in \twin$ and certificate contains anything other than $w$, this path rejects.
\item If the input is $wcw' \notin \twin$ where $w \neq w'$ and certificate is $w$, this path finishes at the accept state wrongfully.
\item If the input $x \notin \twin$ and third case does not apply, this path rejects.
\end{enumerate}
As was in the case for \texttt{PATH 1}, third case is again the only case where certificate can trick the verifier into accepting a nonmember. But the two cases in both paths cannot happen at the same time because certificate can only contain one part of the input. Probability that verifier is in one of the paths is $\frac{1}{2}$ therefore M verifies \twin{} with a one\-/sided error of $\frac{1}{2}$.
\begin{figure}
\centering
\includegraphics[scale=.7]{./twin.png}
\caption{State diagram for verification of \twin.}
\label{fig:twin}
\end{figure}
Let $M = (Q, \inpAlp, \certAlp, \delta, q_0)$ be a \machine. In the case where $\delta(q_1, \sigma, \gamma, c) = (q_2, d)$, we say that M transitions into the state $q_2$ and moves the certificate head if d is 1, upon reading the symbols $\sigma$ and $\gamma$ from the input and certificate tapes, and getting a coin\-/toss result of c. In the case of $q \in D$, no coins are tossed, meaning $\delta(q, \sigma, \gamma, 0) = \delta(q, \sigma, \gamma, 1)$.
For some number $\epsilon$ in the interval $[0,1)$, we say that a \machine{} M verifies the language L
with error $\epsilon$
if
\begin{enumerate}
\item for every $x \in L$, there exists $\omega \in \certAlps$ such that M accepts $\aparen{x,\omega}$ with probability
1, and,
%at least $1 - \epsilon$
\item for every $x \notin L$ and for every $\omega \in \certAlps$, M rejects $\aparen{x,\omega}$ with probability
at least $1-\epsilon$.
\end{enumerate}
EN İYİSİ BAŞTAN "certificate verification" olayını bu şekilde dikkatli tanımlamak
%In the following sections, verifiers we construct will not have an error type such as above(namely, double\-/sided). In our cases, we will have one\-/sided error. One\-/sided error is when M accepts members of L(given a certificate) with probability 1 but rejects nonmembers with probability $1-\epsilon$ whatever certificate you give it. This type of error can be converted into double\-/sided error via a small modification made to the verifier.
In our work, we focus on a class of languages that we call \langclass. If a language $L \in \langclass$ then there exists a non\-/negative integer k and a \machine{} M such that:
\begin{enumerate}
\item M verifies members of L with constant error $\epsilon <1$
%\frac{1}{2}$
\item Throughout its computation, M tosses at most k coins.
\end{enumerate}
%\subsection{CONCLUSION AND DISCUSSION}
%Our results show that \langclass{} has an unexpected language that no \odfak{k} recognize. Namely, \nonpal. We have demonstrated that \machine{} can simulate \odfak{2} but we suspect that this does not generalize to $k > 2$. Reason being: Consider the language $\texttt{SAME} = \{ww : w \in \{0,1\}^*\}$. There is a \odfak{3} that can recognize this language but through trial and error, we strongly suspect that \machine{} cannot verify this language.
%The fact that \twin{} is not a context\-/free language and is non\-/regular means that no pushdown automata can recognize it.
%All in all, it is really surprising that a machine with constant\-/space and real\-/time input with only a single coin toss can recognize these languages. When we strip the property that certificate head can move one\-/way and make it real\-/time, power of our model is equal to that of PFA.
%\subsection{FUTURE WORK}
%There are many different threads to discover about this model. For example, when we let its input be one-way instead of real-time, we know that this relaxed model can verify $\texttt{SAME} = \{ww : w \in \{0,1\}^*\}$. It is still an open question whether \machine{} can simulate its one-way counterpart. We suspect not but if that is the case, that means this model even stronger.
%Another possible thread to tackle about this model is to get a better upper bound on (maybe a hierarchy) with respect to \langclass.
%The \machine{} which verifies \nonpal{} expects to get the information of the location of this symbol pair from the certificate to accept the members with probability 1. Information of the location of this symbol pair can be encoded to certificate as follows,
The verifier tosses a single coin at the beginning of the computation to split into two branches.
\texttt{Path 1}
First branch's duty is to make sure of the locations given in the certificate have the same distance to center of the string, in other words, symmetric with respect to center. First branch checks that by executing the following algorithm;
1. As reading the input in real time, move the certificate head 1 step to the right for every 2 steps input head moves to the right until a $1$ is seen in the certificate tape. After that continue to step 2. (\Cref{fig:nonpal1})
2. Move the certificate head in real time(with the input head) until you reach the end symbol on the certificate. Upon reaching, check that if the input head also sees the end symbol of the input at that moment, and accept if both tape heads are seeing end symbols. (\Cref{fig:nonpal1})
\begin{figure}
\centerline{
\includegraphics[scale=0.15]{./nonpalfig1.png}
}
\caption{Input and certificate head configurations for \texttt{PATH 1}}
\label{fig:nonpal1}
\end{figure}
This algorithm makes the branch accept only if summation of the indices of the symbol `1' and the end symbol on certificate is equal the length of the input(+/- 1 depending on the implementation of the algorithm). Notice that for the input string this sentence also means that these indices are symmetric with respect to middle of the string.
\texttt{Path 2}
Second branch, trusting the first branch about the certificate, checks that if the symbols at these indices on the input differ or not. This branch does this by moving its certificate head in real time, remembering the symbol on the input tape at the same index with the `1' on the certificate and comparing it to the other symbol which has the same index with the end symbol on the certificate. (\Cref{fig:nonpal2}) The branch accepts if the symbols it compared are different.
\begin{figure}
\centerline{
\includegraphics[scale=0.15]{./nonpalfig2.png}
}
\caption{Input and certificate head configurations for \texttt{PATH 2}}
\label{fig:nonpal2}
\end{figure}
Note that, a finite-state machine can `remember' a single bit by having two copies of its whole diagram and continuing the computation at the copy which corresponds to the bit value it wants to remember. The only difference in these two copies would be the transitions where this bit value matters.
If the input is not a palindrome and a correct certificate is given to the verifier, both branches accept. If the input is a palindrome than at most a single branch halts in an accept state.
If first branch accepts than we know that symmetric indices are given in certificate. If that is the case and the input is a palindrome than the symbols which second branch compares must be the same(since the input is a palindrome).
Similarly, if second branches accept than locations given in the certificate must not be symmetric with respect to center of the input string.
Therefore \machine{} can verify \nonpal{} with one-sided error of $\frac{1}{2}$.
\begin{figure}[H]
\centering
\includegraphics[width=0.7\textwidth]{conclusion.png}
\end{figure}
\begin{tikzpicture}
\begin{scope}[every node/.style={inner sep=3}]
\node (L2) at (.6,1.4) {$L_2$};
\node (L4) at (0,2.5) {$L_4$};
\node (L2over3) at (2,0.5) {$\lfrac$};
\node (nonpal) at (-2.7,1.1) {\nonpal};
\end{scope}
\begin{scope}[every node/.style={inner sep=0, outer sep=0}]
\node (1dfa2) [draw, ellipse, inner sep=12] {};
\node (1dfa3) [draw, circle, fit=(1dfa2) (L2over3) (L2.center)] {};
\node (1dfak) [draw, circle, fit=(1dfa3) (L4.center)] {};
\node (rtver) [draw, circle, fit=(1dfa2) (L2) (L4.center) (nonpal)] {};
\node (1wver) [draw, ellipse, fit=(rtver) (1dfak), scale=0.95, yshift=1mm] {};
\end{scope}
\begin{scope}[every node/.style={ellipse, fill=white, path fading=fade out, inner sep=0}]
\node at (1dfa2.60) {\ODFAK{2}};
\node at (1dfa3.40) {\ODFAK{3}};
\node at (1dfak.40) {$\bigcup_k\ODFAK{k}$};
\node [text width=2cm, align=left, xshift=5mm] at (rtver.140) {\small\vsri\consX\consX\rtX};
\node at (1wver.55) {$\text{\begin{varwidth}{4cm}\small\vsri\consX\consX\owayX\end{varwidth}} = \bigcup_k \ONFAK{k}$};
\end{scope}
\begin{scope}
\node (l1) at (1,-1) {\LMARK};
\node (l2) at (.4,-1.7) {\LMARK};
\node (l3) at (-.2,-2.4) {\LMARK};
\node (q1) at (1,-1.7) {\OQMARK};
\node (q2) at (.4,-2.4) {\OQMARK};
\end{scope}
\end{tikzpicture}
\cref{fig:conclusionvenn} gives a summary of the current landscape of the classes covered here and hints at some open questions. Class of languages that can be verified by the constant-space, constant-randomness, one-way-input verifiers, which \cref{thm:SY} proves to be equal to the class of languages verified by multi-head finite automaton, encompasses the rest.
The classes \vsri{\consX}{\consX}{\rtX} and \ODFAK{3} have members \nonpal{} and $\lfrac$ as exclusives from one another, respectively, as shown in \cref{theorem:nonpal,theorem:bomb2}. Moreover, \cref{theorem:1dfa2subset} shows that the class \ODFAK{2} resides at their intersection. Yet another language $\lmatch$ that can be verified with a two-headed one-way finite automaton is shown to be beyond real-time verification using a constant-space and a constant number of random bits in \cref{theorem:bombastik}.
Unlike $\lfrac$, it may be impossible to recognize $\lmatch$ with a multi-head one-way finite automaton with any number of heads, which is an open question. Likewise, $\lfrac$, while seems to be outside of \ONFAK{2}, is not yet proven to be so. There are in total 9 regions in \cref{fig:conclusionvenn} without a definitive member written in it, not counting the inside of \ODFAK{2} and the outside of $\bigcup_k \ONFAK{k}$ which are trivially non-empty; it would be interesting to see that any one of them is actually empty.
We think that the conjectures $\lmatch \notin \bigcup_k \ODFAK{k}$, $\Set{ww | w \in \Set{0, 1}^*} \notin \ODFAK{2}$, and even $\Set{ww | w \in \Set{0, 1}^*} \notin \vsri{\consX}{\consX}{\rtX}$ can be proved via a technique similar to that of \cref{theorem:bombastik} (???).
\noindent\rule[1pt]{\textwidth}{2pt}
\begin{verbatim}
- Our technique in the last theorem can be used to show
some languages (like twin without centermark)
to be outside \odfak{2}?????
- How can our last theorem be generalized to the full extent
to show such things to be unverifiable?
- akla gelecek diğer şeyler??????????
- Refuters????
\end{verbatim}
\begin{figure}[H]
\centering
% \def\firstcircle{(0,0) circle (3.0cm)}
% \def\secondcircle{(360:3.5cm) circle (3.0cm)}
\begin{tikzpicture}
\begin{scope}[every node/.style={inner sep=3}]
\node (L2) at (.6,1.4) {$L_2$};
\node (L4) at (0,2.5) {$L_4$};
\node (L2over3) at (2,0.5) {};%$\lfrac$};
\node (nonpal) at (-2.4,-.2) {\nonpal};
\end{scope}
\begin{scope}[every node/.style={inner sep=0, outer sep=0}]
\node (1dfa2) [draw, ellipse, inner sep=12] {};
\node (1dfa3) [draw, circle, fit=(1dfa2) (L2over3) (L2.center)] {};
\node (1dfak) [draw, circle, fit=(1dfa3) (L4.center)] {};
\node (rtver) [draw, circle, fit=(1dfa2) (L2) (L4.center) (nonpal)] {};
\node (1wver) [draw, rectangle, rounded corners=5mm, fit=(rtver) (1dfak), scale=1.3] {};
\node (1nfa2) [draw, rectangle, rounded corners=5mm, minimum width=50mm, minimum height=32mm] at (-.7,-.8) {};
\end{scope}
\begin{scope}[every node/.style={rectangle, fill=white, inner sep=1}]
\node at (1dfa2.45) {\ODFAK{2}};
\node at (1dfa3.25) {\ODFAK{3}};
\node at (1dfak.40) {$\bigcup_k\ODFAK{k}$};
\node [text width=2cm, align=left, xshift=2mm] at (rtver.140) {\small\vsri\consX\consX\rtX};
\node at (1nfa2.230) {\ONFAK{2}};
\node at (1wver.65) {$\text{\begin{varwidth}{4cm}\small\vsri\consX\consX\owayX\end{varwidth}} = \bigcup_k \ONFAK{k}$};
\end{scope}
\begin{scope}
\node (l1) at (0.9,-1) {\LMARK};
\node (l2) at (.1,-1.5) {\LMARK};
\node (l3) at (-.8,-1.8) {\LMARK};
\node (t1) [left=0mm of 1nfa2.12] {\LTOTMARK};
\node (t2) [right=0mm of 1nfa2.27] {\LTOTMARK};
% \node (q1) at (0.7,-1.6) {\OQMARK};
% \node (q2) at (-.3,-2.1) {\OQMARK};
% \node (q3) at (-1.1,-.5) {\OQMARK};
% \node (q4) at (-2.2,1.3) {\OQMARK};
% \node (q5) at (.2,-.9) {\OQMARK};
% \node (q6) at (1.4,-.9) {\OQMARK};
% \node (q7) at (2.1,-.2) {\OQMARK};
% \node (q8) at (2.8,.1) {\OQMARK};
% \node (q9) at (3.3,-2) {\OQMARK};
\end{scope}
\end{tikzpicture}
\caption{A Venn diagram of our results. Labels on the borders are of the complexity class delineated by that border. \nonpal{} is defined in \cref{subs:nfaks}, whereas $L_2$ and $L_4$ are defined in \cref{subsec:beyond1dfa2}. Regions marked with \LMARK{} and \LTOTMARK{} are where the language $\lmatch$ from \cref{theorem:bombastik} and $\lfrac$ from \cref{theorem:bomb2}, respectively, may be in. $L_2 \in \ODFAK{3} \setminus \ONFAK{2}$ and $L_4 \in \ODFAK{4} \setminus \ONFAK{3}$ are results from~\cite{YR78}.}
\label{fig:conclusionvenn}
\end{figure}
We have already established that correct certificates for members of $\lfrac$ (like $w_1=x_1 y x_1$, where $|x_1|=y$) must start with a prefix $c_{w_1,l}$ (to be read by the deterministic verifier designated $V_l$ in that? proposition), whose length is not longer than a third of the prefix of the input string (\ie, $\abs{x_1}$ in the case of $w_1$). By ?, the deterministic verifier $V_r$ must read a string description that we will be calling $c_{w_1,r}$ from the certificate while its input head is scanning the last third of $w_1$, and we also know that $c_{w_1,r}$ must be preceded by a prefix whose length is an increasing function of $|x_1|$. So the certificate of $w_1$ is of the form $c_1=c_{w_1,l}\alpha = \beta c_{w_1,r}$. In the case where $|\beta| \geq |x_1|$, the argument of 4.3 can be adapted without problems. Let us concentrate on the case where $|\beta| < |x_1|$.
We will specify $w_1$ and $w_2$ in greater detail.
Consider the tuple formed of the states of all the deterministic verifiers in the step when they arrive at the first symbol of the last third of the input. (Since the input prefix scanned up to that point may be completed to form a member of $\lfrac$, none of the $V_i$ could have committed to rejection at this time.)
At this point, $V_r$ has read $x_1 y$ in the input and $\beta$ in the certificate and has arrived in some state. Note that
%In the rest of this proof, consider $j$ to be sufficiently large so that $c_{w_1,l}$ and $c_{w_1,r}$ do not overlap in the certificate for $w_1$, and $c_{w_2,l}$ and $c_{w_2,r}$ do not overlap in the certificate for $w_2$. With this in mind, we will represent the certificates $c_{w_1}$ and $c_{w_2}$ for $w_1$ and $w_2$, respectively, as $c_{w_1}= c_{w_1,l} \alpha_1 c_{w_1,r} \beta_1$ and $c_{w_2}= c_{w_2,l} \alpha_2 c_{w_2,r} \beta_2$, where the $\alpha_i$ are the (long) intermediate substrings between the substring descriptions to be read by $V_l$ and $V_r$, and the $\beta_i$ represent any postfixes that may follow the description to be read by $V_r$.
It is important to see that the set of all such possible tuples of states is finite, and there must exist two distinct strings $x_1$ and $x_2$ (which, when plugged into the prefix positions, give rise to two distinct member strings $w_1$ and $w_2$, which themselves have two distinct certificates $c_{w_1}$ and $c_{w_2}$,) that lead $V$'s deterministic verifiers to the same tuple of states. We focus on strings $w_1$ and $w_2$ that have been formed in this way, from two such ``indistinguishable'' strings $x_1$ and $x_2$.
We will reach a contradiction by observing that $V$ accepts $w_3$ with probability 1 with the certificate $c_{w_3}= c_{w_1,l} \alpha_1 c_{w_2,r} \beta_2$, that can be obtained by ``crossing'' $c_{w_1}$ with $c_{w_2}$: We already know that $V_r$ accepts $w_2$ when presented with the certificate $c_{w_2}$; and $V_r$ has no way of recalling that the real prefix of the input was $x_1$, and not $x_2$, and therefore will accept $w_3$ with certificate $c_{w_3}$. It remains to show that none of the \emph{other} deterministic verifiers\footnote{We know that there are at least two deterministic verifiers since $V$ has to use at least one random bit, but there is nothing in the arguments above that puts an upper bound to their number.} can reject $w_3$ with this modified certificate.
Recall that our insistence on $V$ accepting correct membership certificates with probability 1 dictates that no deterministic verifier $V_i$ can decide to reject an input-certificate pair arbitrarily; if such a $V_i$ cannot detect a violation of the required input or certificate syntax, then it has to accept.
% a detection of the ``fakeness'' of this certificate would have to involve detecting that the input prefix ($x_1$) of $w_3$ does not equal the substring $y_j$ ($x_2$).
Although a more powerful machine could detect the inconsistency in the certificate $c_{w_1,l} \alpha_1 c_{w_2,r} \beta_2$ by decoding $c_{w_1,l}$ and $c_{w_2,r}$, and seeing that they match the unequal input substrings $x_1$ and $x_2$ respectively, $V_i$, which is a real-time finite-state device, is uncapable of doing this: $V_i$ only has time to match $c_{w_1,l}$ with $x_1$ and $c_{w_2,r}$ with $x_2$, and these matches would succeed; yielding no justification for a rejection. V would have to accept $w_3$ with probability 1 with this certificate.
--------------------
\begin{theorem}\label{theorem:bombastik}
\begin{equation*}
\vsri{\consX}{\consX}{\rtX} \subsetneq \vsri{\consX}{\consX}{\owayX}.
\end{equation*}
\end{theorem}
\begin{proof}
We will show that the language
\begin{equation*}
\lmatch=\Set{x\#y_1\#y_2\#\dotsm\#y_k | x, y_i \in \Set{0,1}^+ \text{ for all } i, k>0, \text{and } y_i=x \text{ for some } i},
\end{equation*}
which can be seen easily to be in \ONFAK{2}, and therefore in \vsri{\consX}{\consX}{\owayX} by \cref{thm:SY}, is not in \langclass. Our strategy is as follows: We will point out several features that any real-time constant-randomness finite-state machine that verifies $\lmatch$ has to possess. The proof will conclude when it becomes evident that these features are contradictory, in the sense that no such machine can possess all of them.
Assume that $\lmatch$ is verified by a real-time finite-state machine $V$ that uses at most $k$ random bits, for some constant $k$. (Since $\lmatch$ is nonregular, $k$ is necessarily greater than zero.) Once again, we will be calling the machines $V_1$, $V_2$, \dots, $V_{2^k}$ that are obtained by ``hard-wiring'' the $2^k$ different sequences of $k$ coin tosses into $V$'s transition function \emph{the deterministic verifiers}. Our definition of verification in \cref{subs:vers} dictates there exists a certificate that would make all these $V_i$ accept an input string $w$ if and only if $w\in \lmatch$. For any input $w$ not in $\lmatch$, at least one of the $V_i$ rejects, no matter what is written on the certificate tape.
Consider the behavior of $V$ on an input string $w$ of the form $x\#y_1\#y_2\#\dotsm\#y_k$, where $ x, y_i \in \Set{0,1}^+$ for all $i$ up to $k$.
\begin{proposition}\label{prop:bombastik1}
At least one of the deterministic verifiers moves the certificate head while its input head is scanning the prefix $x$. % For sufficiently long $x$, the length of the certificate substring consumed at this stage by this particular deterministic verifier grows in proportion to the length of $x$.
This machine uses the information that it obtains from the certificate at this stage to decide whether or not to reject the input string. This information has to be encoded within the first $\abs{x}$ symbols of the certificate.
\end{proposition}
\begin{proof}[Proof of \cref{prop:bombastik1}]
%Assume that one of the $y_i$ equals $x$, \ie, this input string is a member of $\lmatch$, and is accepted by all the $V_i$'s.
Assume that none of the deterministic verifiers read the certificate before the first $\#$. No such particular deterministic verifier $V_j$ could have committed itself to rejecting the input by the time it is reading the first $\#$, since it may well be the case that one of the $y_i$ substrings in the rest of the input equals $x$, and \emph{all} the deterministic verifiers, including $V_j$, are supposed to accept such strings. Being a finite-state machine, this $V_j$ cannot ``remember'' a sufficiently long $x$ in complete detail, and can only hold an incomplete ``summary'' of $x$, say, $s_j(x)$ in its state. According to our assumption,
all the deterministic verifiers will be holding such summaries, describable as a tuple $t(x)$ of the form $(s_1(x),s_2(x),\dotsc,s_{2^k}(x))$, when their input heads reach the first $\#$. Note that there are only finitely many different tuples of this kind.
Since there exist infinitely many strings that $V$ can encounter in the role of $x$, there are two distinct strings $x_1$ and $x_2$ which have the same tuple of summaries; $t(x_1)=t(x_2)$. Since $V$ is supposed to accept the input $w'=x_1\#y_1\#y_2\#\dotsm\#x_1\#\dotsm\#y_k$ (where only one of the $y_i$'s equals $x_1$, and none of the other $y_i$'s equals $x_2$) with probability 1, it will then also have to accept the input $w''=x_2\#y_1\#y_2\#\dotsm\#x_1\#\dotsm\#y_k$, obtained by replacing the first $x_1\#$ substring in $w'$ with the substring $x_2\#$, with probability 1. But this is impossible, since $w'' \notin \lmatch$. So it cannot be the case that none of the deterministic verifiers read the certificate before their input heads reach the first $\#$.
Let us now focus on the requirements on such a deterministic verifier, say, $V_l$, which, as we just saw, has to be consuming some certificate symbols (making up a string that we will call $c_{w,l}$) while scanning the first substring $x$ in the input. What is the use of reading the certificate at this stage?
%Note that when $V_l$ consumes the first $\#$ in the input, the combined information that it ``remembers'' about $x$ plus the certificate prefix $c_{w,l}$ that it has read until that point would again have to be an incomplete summary of $x$ and $c_{w,l}$, which would lead to precisely the same problem described above if $V_l$ went on to scan the rest of the input string to decide whether to accept or to reject it. There remains only one way in which $V_l$ could make use of $c_{w,l}$: $V_l$ can utilize $c_{w,l}$ to arrive at an immediate decision about the input, based only on the prefix $x$.
Noting that the problem identified above was accepting a string like $w''$ with probability 1, and keeping in mind the definition of $\lmatch$, we see that $V_l$ should attempt to use the certificate prefix $c_{w,l}$ that it is consuming at this stage to identify and reject input strings in which the prefix $x$ does not reappear as one of the $y_i$ substrings.
This amounts to attempting to ``match'' $c_{w,l}$ with $x$ as $V_l$ scans the input and the certificate tapes simultaneously,
%committing to accept if the match succeeds,
and committing to reject if the match fails.\footnote{Note that we are using the word ``match'' in a very general sense, to indicate any procedure that the verifier can perform to compute a Boolean result after consuming $x$ and $c_{w,l}$ in a ``parallel'' fashion. Checking whether $c_{w,l}=x$ is just one simple kind of matching.}
%We can therefore say that $c_{w,l}$ is a complete description of a $y_i$ substring that is claimed by the certificate to exist in the remainder of the input, and $V_l$ is checking whether the prefix $x$ is indeed equal to this purported $y_i$.
\textbf{We can therefore say that $c_{w,l}$ is the ``evidence'' provided by the certificate about a claim that a particular $y_i$ substring exists in the remainder of the input, and $V_l$ is checking whether \textcolor{red}{it can refute that the prefix $x$ equals} this purported $y_i$ by making use of its scans of $x$ and $c_{w,l}$.}\footnote{\textbf{This interpretation (that this certificate segment is supposed to correspond to a \textcolor{red}{unique} string $y_i$) also makes it evident that there is no constant that bounds the lengths of these certificate prefixes consumed by $V_l$; longer $y_i$'s would in general necessitate longer $c_{w,l}$'s.}}
(Of course, being just one branch of a probabilistic algorithm, $V_l$ can be tricked into accepting strings that are not members of $\lmatch$. We will return to this issue in the discussion after the proof of the theorem.)
The fact that $c_{w,l}$ has to be at most $\abs{x}$ symbols long follows from the fact that $V$ is a real-time machine, and spends only that many steps to traverse the input prefix $x$.
%Bu dilin 1w input makineler tarafından verify edilişini inceleyelim.
%
%Varsayalım ki bu dili halleden bir 1w-input, sabit-coin verifierımız (V1, V2, vs.) var. Bundan elde edilen deterministik verifierları düşünelim. Bu sistemin kabul ettiği "x#.......x...." tipi stringleri düşünüp sertifikayı nasıl okuduğuna dair çıkarımlar yapacağız.
%
%Lemma 1: V'lerin en az biri inputta #'ın solunda yürürken sertifikadan bir miktar okuma yapar ve buna bağlı olarak inputu reddedip reddetmeyeceğine oracıkta karar verir.
%
%Proof by contradiction: Aksi takdirde V'lerin hepsine (yani makinemize 1 olasılıkla) dile üye bir stringin sol kısmını x olmaktan çıkarıp sağda hiç geçmeyen başka bir string haline soktuğumuz nonmember bir stringi de kabul ettirebiliriz. Çünkü # öncesinde sertifika okumayan bir V'nin oradaki x'i reddetmek için bir nedeni yoktur (öyle bir şey yapan bir V'ye üye bir stringi reddettirebilirsiniz), yani V'lerimizin tümü #'ye vardığında sonlu sayıda nonreject stateinden birinde olacaktır. O anda V1, V2, vs. tarafından girilen stateler tuple'ı (s1, s2, ...) olsun. Bu tuple'lardan sadece sonlu sayıda var, yani illa ki iki farklı x ve y prefix'i V'lerimizi aynı state tuple'ına getirecektir. Makinemiz de sağda y içermeyen "x#.......x...." stringini kabul etmek zorunda olduğu için prefixi değiştirerek elde edilen "y#.......x...." stringini de kabul etme çelişkisine düşecektir. QED
%
%Bu "inputun A substringinin üzerinde yürürken sertifikadan B substringini okuyup ona göre reddedip etmemeye karar vermek" eylemine "A ile B'yi match etmek" diyelim.
\end{proof}
\begin{proposition}\label{prop:bombastik2}
Consider input strings of the form $x\#y_1\#y_2\#\dotsm\#x\#\dotsm\#y_k$, where only one of the $y_i$'s, say, $y_j$, equals $x$.
At least one of the deterministic verifiers moves the certificate head to read a ``claim'' about what the string $x$ was, while its input head is scanning the substring $y_j$.
%For sufficiently long $x$, tmhe length of the certificate substring consumed at this stage by this particular deterministic verifier grows in proportion to the length of $x$.
For sufficiently great $j$, the substring containing this claim in a correct certificate must be preceded by a prefix whose length is an increasing function of $j$.
\end{proposition}
\begin{proof}[Proof of \cref{prop:bombastik2}]
Assume that none of the deterministic verifiers read the certificate while their input heads are scanning $y_j$.
% At the step when they are reading the $\#$ just before $y_j$, none of these verifiers must have committed to reject the input, because it may well be the case that they are working on a member of $\lmatch$.
There must exist some certificate prefixes on which none of these verifiers could have committed to reject the input by the step when they are reading the $\#$ just before $y_j$, because it may well be the case that they are working on a member of $\lmatch$.
As described in the proof of \cref{prop:bombastik1}, what these verifiers can remember about the input prefix $x$ at that point can be described as a tuple $t(x)$. There are only finitely many such tuples, and there exist two distinct strings $x_1$ and $x_2$ for which $t(x_1)=t(x_2)$. The verifier $V$ can then be convinced to accept the strings $w_1=x_1\#y_1\#y_2\#\dotsm\#x_1\#\dotsm\#y_k$ (where only $y_j$ equals $x_1$, and none of the other $y_i$'s equals $x_2$), $w_2=x_2\#y_1\#y_2\#\dotsm\#x_2\#\dotsm\#y_k$ (obtained from $w_1$ by replacing the two $x_1$ substrings with $x_2$'s), and $w_3=x_1\#y_1\#y_2\#\dotsm\#x_2\#\dotsm\#y_k$ (obtained by replacing the substring $\#x_1\#$ in $w_1$ with the substring $\#x_2\#$), with probability 1. But this is impossible, since $w_3 \notin \lmatch$. So at least one deterministic verifier, say, $V_r$, must move its certificate head while scanning $y_j$.
Continuing with the example above, for $V$ to have any hope of verifying $\lmatch$ correctly, $V_r$ has to use what it reads from the certificate at this stage to differentiate strings like $w_3$, which should be rejected, from strings like $w_1$ and $w_2$, which should be accepted.
%This indicates that the certificate portion read at thishttps://www.overleaf.com/project/60be7c74477df8c1af78c44a stage should claim to contain a complete description of the input prefix up to the first $\#$, and $V_r$ should attempt to match this description with $y_j$.
\textbf{This indicates that the certificate portion read at this stage should contain evidence for a
claim that the input prefix up to the first $\#$ equals $y_j$. Since $V_r$ can be holding only a finite summary of that input prefix from its earlier scan, the certificate portion must purport to contain any information missing from that summary to enable $V_r$ to match the described prefix with $y_j$.}
As noted for $V_l$ in the proof of \cref{prop:bombastik1}, it is easy for an ``evil'' certificate to trick $V_r$ into accepting some non-members of $\lmatch$.
Consider the operation of $V_r$ after its input head has passed the first $\#$. Recall that $V_r$'s memory of the input prefix $x$ is incomplete, and if the next input segment $y_1$ equals any other string $x'$ which leaves the same summary as $x$ in $V_r$'s memory, the certificate can just claim that the input prefix was $x'$, and $V_r$ would accept the input if it compared that description with $y_1$.
Leaving the treatment of those evil certificates about non-members to the discussion below, let us concentrate on how $V_r$ is supposed to behave within the context of a properly working verifier $V$ for $\lmatch$. A correct certificate for a member of $\lmatch$ like $w_1$ needs to provide more information to $V_r$ than just a description of the input prefix $x_1$; it has to indicate which of the $y_i$ substrings is the one that equals $x_1$, so that $V_r$ attempts to match that substring (without rejecting on seeing the previous ones) with the purported prefix description in the certificate. This is easy to see if one adopts the point of view of $V_r$ on the first $\#$ in the input again. The substring $y_1$ that starts with the next input symbol may or may not be the one that matches the prefix description waiting to be read in the certificate, so should $V_r$ start consuming that description to match it with $y_1$ or not? If $y_1$ really is the substring in question, the prefix description should be consumed from the certificate right away, for $V_r$ cannot perform such matchings after it has walked away from, and therefore forgotten, parts of $y_1$. On the other hand, if $y_1$ is not the correct substring to match, consuming the correct prefix description now to attempt a match would end in failure. $V_r$ has no way of knowing which one the correct $y_j$ substring is, so in order to avoid the risk of rejecting a member of $\lmatch$ like $w_1$, it has to be ``walked'' over the substrings up to $y_j$ by the certificate. This requires an additional substring (that essentially encodes a message for which a very informal English translation would be ``Not $y_1$, not $y_2$, \dots{}, not $y_{j-1}$, YES, match the string in the rest of this message with $y_j$ NOW!'') to exist on the certificate tape before the actual purported prefix description $x_1$ that will be used by $V_r$, and the length of this substring grows as $j$ gets larger. (For instance, a substring of $j$ $\#$ symbols preceding the description of $x_1$ on the certificate can be used for this purpose.)
\end{proof}
In \cref{prop:bombastik1,prop:bombastik2}, we established some constraints on the form of a correct membership certificate to be expected by $V$. We will now show that these constraints lead to a contradiction, and conclude that no real-time, constant-randomness, constant-space machine which can verify proofs of membership in $\lmatch$ can exist.
\begin{proposition}\label{prop:bombastik3}
No verifier that satisfies the conditions in \cref{prop:bombastik1,prop:bombastik2} can verify $\lmatch$.
\end{proposition}
\begin{proof}[Proof of \cref{prop:bombastik3}]
We will again be considering the following three string patterns that we saw in the proof of \cref{prop:bombastik2}:
\begin{flalign*}
w_1 &= x_1\#y_1\#y_2\#\dotsm\#x_1\#\dotsm\#y_k & \tag*{(where only $y_j$ equals $x_1$, and none of the other $y_i$'s equals $x_2$),}\\
w_2 &= x_2\#y_1\#y_2\#\dotsm\#x_2\#\dotsm\#y_k & \tag*{(obtained from $w_1$ by replacing the two $x_1$ substrings with $x_2$'s),}\\
w_3 &= x_1\#y_1\#y_2\#\dotsm\#x_2\#\dotsm\#y_k & \tag*{(obtained by replacing the substring $\#x_1\#$ in $w_1$ with the substring $\#x_2\#$).}
\end{flalign*}
Clearly, $w_1, w_2 \in \lmatch$, and $w_3 \notin \lmatch$.
We have already established in \cref{prop:bombastik1} that correct certificates for members of $\lmatch$ (like $w_1$) must start with a prefix $c_{w_1,l}$ (to be read by the deterministic verifier designated $V_l$ in that proposition), whose length is not longer than the prefix of the input string up to the first $\#$ (\ie, $\abs{x_1}$ in the case of $w_1$). By \cref{prop:bombastik2}, the deterministic verifier $V_r$ must read a string description that we will be calling $c_{w_1,r}$ from the certificate while its input head is scanning $y_j$ on $w_1$, and we also know that $c_{w_1,r}$ must be preceded by a prefix whose length depends on $j$. In the rest of this proof, consider $j$ to be sufficiently large so that $c_{w_1,l}$ and $c_{w_1,r}$ do not overlap in the certificate for $w_1$, and $c_{w_2,l}$ and $c_{w_2,r}$ do not overlap in the certificate for $w_2$. With this in mind, we will represent the certificates $c_{w_1}$ and $c_{w_2}$ for $w_1$ and $w_2$, respectively, as
$c_{w_1}= c_{w_1,l} \alpha_1 c_{w_1,r} \beta_1$ and $c_{w_2}= c_{w_2,l} \alpha_2 c_{w_2,r} \beta_2$, where the $\alpha_i$ are the (long) intermediate substrings between the substring descriptions to be read by $V_l$ and $V_r$, and the $\beta_i$ represent any postfixes that may follow the description to be read by $V_r$.
We will now specify $w_1$ and $w_2$ in greater detail.
Consider the tuple formed of the states of all the deterministic verifiers in the step when they arrive at the first symbol of $y_j$. (Since the input prefix scanned up to that point may be completed to form a member of $\lmatch$, none of the $V_i$ could have committed to rejection at this time.) It is important to see that the set of all such possible tuples of states is finite, and there must exist two distinct strings $x_1$ and $x_2$ (which, when plugged into the prefix positions, give rise to two distinct member strings $w_1$ and $w_2$, which themselves have two distinct certificates $c_{w_1}$ and $c_{w_2}$,) that lead $V$'s deterministic verifiers to the same tuple of states. We focus on strings $w_1$ and $w_2$ that have been formed in this way, from two such ``indistinguishable'' strings $x_1$ and $x_2$.
We will reach a contradiction by observing that $V$ accepts $w_3$ with probability 1 with the certificate $c_{w_3}= c_{w_1,l} \alpha_1 c_{w_2,r} \beta_2$, that can be obtained by ``crossing'' $c_{w_1}$ with $c_{w_2}$: We already know that $V_r$ accepts $w_2$ when presented with the certificate $c_{w_2}$; and $V_r$ has no way of recalling that the real prefix of the input was $x_1$, and not $x_2$, and therefore will accept $w_3$ with certificate $c_{w_3}$. It remains to show that none of the \emph{other} deterministic verifiers\footnote{We know that there are at least two deterministic verifiers since $V$ has to use at least one random bit, but there is nothing in the arguments above that puts an upper bound to their number.} can reject $w_3$ with this modified certificate.
Recall that our insistence on $V$ accepting correct membership certificates with probability 1 dictates that no deterministic verifier $V_i$ can decide to reject an input-certificate pair arbitrarily; if such a $V_i$ cannot detect a violation of the required input or certificate syntax, then it has to accept.
% a detection of the ``fakeness'' of this certificate would have to involve detecting that the input prefix ($x_1$) of $w_3$ does not equal the substring $y_j$ ($x_2$).
Although a more powerful machine could detect the inconsistency in the certificate $c_{w_1,l} \alpha_1 c_{w_2,r} \beta_2$ by decoding $c_{w_1,l}$ and $c_{w_2,r}$, and seeing that they match the unequal input substrings $x_1$ and $x_2$ respectively, $V_i$, which is a real-time finite-state device, is uncapable of doing this: $V_i$ only has time to match $c_{w_1,l}$ with $x_1$ and $c_{w_2,r}$ with $x_2$, and these matches would succeed; yielding no justification for a rejection. V would have to accept $w_3$ with probability 1 with this certificate.
\end{proof}
%Lemma 2. V'lerin en az biri inputta #'ın sağında yürürken sertifikadan bir miktar okuma yapar ve buna bağlı olarak inputu reddedip reddetmeyeceğine karar verir. Bu karar soldaki stringin sağda geçip geçmediğine göre belirlenir.
%Proof: Hiçbir V'nin ilk #'ın sağında sertifika okumadığını varsayalım. (Bazıları daha solda okumuş olabilir, Lemma 1'de dediğimiz gibi.) Makinemiz dilin üyesi olan tipik bir x#....x..... stringi üzerinde (hazırlanabilecek en güzel sertifikayla) çalışırken ikinci x'i okumaya başlamak üzereyken sertifikadan şimdiye dek okuma yapmış olsun olmasın bütün V'lerin non-reject state'lerde olacağını (yani V'ler topluluğunun non-reject state'lerden oluşan bir (s1, s2, ...) state tuple'ında olacağını biliyoruz. Sonlu sayıda "özel" x için yaşanabilecek istisnalar haricinde bu tuple x'in tam olarak hangi string olduğu bilgisini tutamaz, sadece "şimdiye kadar her şey yolunda, önceden sertifika okuduysam stringin başı onunla uyumlu" gibi x'in detay bilgisini içermeyen, taş çatlasa x'in (mesela mod 35 değerinin kaç olduğu gibi) sonlu sayıda kategoriden hangisinde olduğuna ilişkin bir bilgi tutabilir sadece. İşte böyle istisnai olmayan genel x'lerin sayısı sonsuz, ama state tuple'larının sayısı sonlu olduğundan illa ki x1 ve x2 diye iki farklı prefixle başlayan iki member string (x1#tx1 ve x2#tx2) için bu noktada (tam t'nin sonunda) aynı state tuple'a girilmiş olmalı.Onları "çaprazlayarak" elde edeceğimiz x1#tx2 stringinin de böyle (sağda sertifika okumayan) V'lerce kabul edilmesi gerekir. QED
This concludes the proof of \cref{theorem:bombastik}.
\end{proof}
%\textbf{Proposition 4.}
%In Proposition 2, we established that at least one deterministic verifier, which we named $V_r$, reads a ``claim'' from the certificate about what the input prefix $x$ was, while its input head is scanning a substring $y_j$ to the right of the first $\#$ in the input.
%For sufficiently long $x$, the length of the certificate substring consumed at this stage by this particular deterministic verifier grows in proportion to the length of $x$.
%For sufficiently great $j$, the substring containing this claim in a correct certificate must be preceded by a prefix whose length grows in proportion with $j$.
%\emph{Proof of Proposition 4.}
%\begin{lemma}
%Ayrı bir lemma daha mı? FSA match edilecek string bilgisini başta okuyup uzun süre aklında tutamaz, o bilgi inputtan geçilirken okunacak yerde olmalıdır sertifikada. İnputta hızla ilerliyorsa L1 ve L2'de bahsedilen alanlar aynı olamaz
%Lemma 5. Sertifika "x ile match" kısmından önce sağdaki x'in pozisyon bilgisini de içermek zorundadır, bu da x'in kendisinden daha uzun bile olabilecek bir substring gerektirir!
%Proof. Bunu da ispatlarsak bu dilin rt verifierla tanınamadığını göstermiş oluruz diye düşünüyorum. İspatlayabilir misiniz?
%Malum, oradaki eksik son lemma için daha önce şöyle yazmıştım:
%---
%Bir V "inputun sol kısmı şu stringe uyuyor" diyen, diğer V ise "inputun sağ kısmında bir yerlerde şu string var" diyen sertifikalar bekliyorlar. Finite automatanın inputta sequential gitme zorunluluğuyla da birleştirilip burada "ikincinin beklediği sertifika daha çok bilgi içeriyor; string tarif bilgisi stringin kendisi uzunluğunda, üstüne o stringin sağdaki substringin neresinde konumlandığı bilgisiyse (FAlar binary bilgiyi decode edemeyecekleri için) unary bir sayı olarak verilmeli, bu yüzden ikincinin okuduğu sertifika daha uzun olmalı, ayrıca konum bilgisi string içeriğinden önce gelmeli" gibi bir argümanı sağlıklı şekilde kurabilirim diyen var mı?
%Bu yeni dil için eskiden "#'ın solu / sağı" dediğim yerleri "ilk #'ın solu / sağı" olarak okumak gerek.
%Eğer ilk birkaç lemmadaki fikirler doğruysa dili verify eden makineden coinları fiksleyerek elde edilen deterministik V'lerden birinin x üzerinde sertifika okuması (yani rt'lik şartımız nedeniyle sertifikanın en başında başka bir stringle değil de x'le paralel okunduğunda bir FA'ya evet dedirtebilen bir stringden oluşan bir segmentle başlaması) şart. (Sertifika alfabesi input alfabesiyle aynıysa x'in içerdiği kadar bilgi ancak o kadar karakterle ifade edilebileceğinden bu segmentin boyu da x'in boyuna eşit olmalı, değil mi?)
%Peki o ilk \#'in sağında bir yerde bir x olduğunu teyit etmek için sertifika okuması gerektiğini ilk lemmalardan birinde kanıtladığımız öteki V bu okumayı tam olarak inputun neresindeyken yapacak? Mesela $y_1$'in üstündeyken hiç sertifika okumayıp atlayıvermesi mümkün müdür? Hayır, çünkü o zaman $x=y_1$ case'ini kaçıracaktır. Peki $y_1$'in üstündeyken başka hiçbir denetleme yapmadan, sertifikadan başka hiçbir bilgi çekmeden doğrudan sertifikada "bu x'tir" bilgisini içeren segmenti tüketebilir mi? Hayır, çünkü belki $x=y_1$ değildir de $x=y_5$ falandır; bu V hoyratça $y_1$ üstündeyken sertifikadaki "bu x'tir" bilgisini tüketirse sonra doğru yerde o bilgiyi okuma şansını kaybetmiş olur (malum, x alabildiğine uzun olduğundan onu belleğinde tutma şansı yok).
We should note that the constant-space, constant-randomness verifiers with \emph{one-way} input that verify the language $\lmatch$ discussed in the proof of \cref{theorem:bombastik} do satisfy the constraints dictated by \cref{prop:bombastik1,prop:bombastik2}, except of course the one imposed by the real-time requirement. A typical certificate for a member of $\lmatch$ like $x\#y_1\#y_2\#\dotsm\#x\#\dotsm\#y_k$ (where $y_j=x$) could be $\#^j x$, and a verifier that uses a single random bit can split into two deterministic verifiers $V_l$ and $V_r$ that operate as follows:
$V_l$ pauses its input head while it consumes all the $\#$'s in the certificate, and then attempts to match the rest of the certificate with the input up to the first $\#$ in the input.
$V_r$ scans the input in real-time, consumes one $\#$ from the certificate for each $\#$ that it encounters in the input
until it runs out of $\#$'s in the certificate, and starts attempting to match the rest of the certificate with the currently scanned substring in the input. The problem noted in \cref{prop:bombastik3} does not occur, since this certificate contains not two, but just one string description that can be matched with two different regions of the input string by two different deterministic verifiers. Any ``evil'' certificate can trick only one, not both, of $V_l$ and $V_r$ into acceptance, so no input string that is not a member of $\lmatch$ would be accepted with probability 1.
\Cref{theorem:bombastik} can be modified to demonstrate the existence of a language recognizable by a multihead deterministic automaton to be unverifiable by constant-space, constant-randomness machines in real time.
\begin{theorem}\label{theorem:bomb2}
$\ODFAK{3} \nsubseteq \langclass$.
\end{theorem}
\begin{proof}
The proof is a adaptation of the proof of \cref{theorem:bombastik} to the language $\lfrac=\Set{xwx | x, w \in \Set{0,1}^* \text{ and } \abs{x}=\abs{w}}$. $\lfrac$ can be recognized by a \odfak{3} which uses its first $n+1$ steps on an input of length $n$ by moving its first head in real time, while moving its second head at ``two thirds'' speed, pausing on every third step. When the first head reaches the end of the input, the machine rejects if $n$ is not a multiple of three. Otherwise, the third head, which has been pausing on the left end up to this point, starts scanning the input at the same speed as the second head. The machine accepts if and only if these two heads read identical substrings until the second head reaches the end. (Note that, unlike the \onfak{2} that recognizes the language $\lmatch$ discussed in the proof of \cref{theorem:bombastik}, this \odfak{3} runs for longer than $n+2$ steps.)
To show that no real-time, constant-space, constant-randomness verifier
% \machine{}
can verify $\lfrac$, one assumes the existence of such a machine $V$, and reaches a contradiction by adapting the three propositions forming \cref{theorem:bombastik} to obtain statements about the ``deterministic verifiers'' that correspond to probabilistic paths of $V$ as in that proof in the following manner:
\begin{proposition}\label{prop:bomb21}
At least one of the deterministic verifiers moves the certificate head while its input head is scanning the prefix $x$ forming the first third of the input. % For sufficiently long $x$, the length of the certificate substring consumed at this stage by this particular deterministic verifier grows in proportion to the length of $x$.
This machine uses the information that it obtains from the certificate at this stage to decide whether or not to reject the input string. This information has to be encoded within the first $\abs{x}$ symbols of the certificate.
\end{proposition}
\begin{proof}[Proof of \cref{prop:bomb21}]
%Assume that one of the $y_i$ equals $x$, \ie, this input string is a member of $L$, and is accepted by all the $V_i$'s.
The reasoning in the proof of \cref{prop:bombastik1} can be adapted here to prove the existence of two distinct equal-length strings $x_1$ and $x_2$ that have the same tuple of summaries. This allows us to reach a contradiction where $V$ can be tricked into accepting the input $x_1 w x_2$ with probability 1 if no deterministic verifier reads the certificate while scanning the first third of the input.
\end{proof}
\begin{proposition}\label{prop:bomb22}
At least one of the deterministic verifiers moves the certificate head to read a ``claim'' about what the first third of the input string was, while its input head is scanning the last third of the input.
%For sufficiently long $x$, the length of the certificate substring consumed at this stage by this particular deterministic verifier grows in proportion to the length of $x$.
For sufficiently long inputs, the substring containing this claim in a correct certificate must be preceded by a prefix whose length is an increasing function of the input length.
\end{proposition}
\begin{proof}[Proof of \cref{prop:bomb22}]
The adaptation is similar to the one for the first proposition. Since a real-time deterministic automaton working on such binary input strings can not determine the moment when its input head has consumed exactly two thirds of the input without external assistance, the certificate has to contain a prefix providing additional information about where the claim about the first third of the input starts, and the length of such prefixes increase with the input length.
\end{proof}
\begin{proposition}\label{prop:bomb23}
No verifier that satisfies the conditions in \cref{prop:bomb21,prop:bomb22} can verify $\lfrac$.
\end{proposition}
\begin{proof}
A similar argument to the one in \cref{prop:bombastik3} applies here but a problem arises. In \cref{prop:bombastik3}, the two certificate sections that are matched against the input are ensured to not overlap. This is done by picking a member of \lmatch{} with a large enough $j$, but a similar method cannot be employed with \lfrac. However, we can relax the condition of non-overlapping just enough, such that the argument still holds and the problem mentioned here is alleviated.
As long as the beginnings of the two certificate sections are separated by at most a constant amount, a verifier can check to see if these two sections are identical using a constant memory. On the other hand, if the separation is not limited by a constant, a finite-state verifier will be unable to recall the prefix of the first certificate section that does not overlap with the second section in its entirety, therefore fail to match it all. As such, if we relax our non-overlapping condition to `having an unlimited separation between the beginnings of the two certificate sections' we can still say that the verifier has no way of making sure that those certificate sections are matching.
With this observation, the rest of the proof becomes similar to that of \cref{prop:bombastik3}: Consider a long enough string $u_1 = x_1 w x_1$ where $\abs{x_1} = \abs{w}$. Let $c_{u_1}$ be a certificate of $u_1$. According to \cref{prop:bomb21}, $c_{u_1}$ should contain $c_{u_1,l}$ at its beginning to be matched against the first $x_1$. By \cref{prop:bomb22}, $c_{u_1}$ should also contain $c_{u_1,r}$ as a substring to be matched against the last $x_1$, and that substring must follow a prefix of unbounded length that depends on the length of $x_1$. Now, also consider a different string $u_2 = x_2 w x_2$ such that
\begin{enumerate}[label=\roman*)]
\item $\abs{x_2} = \abs{x_1}$ and
\item the tuple of states that the deterministic verifiers brought to by the first two thirds of $u_1$ and $u_2$ alongside their member certificates are the same.
\end{enumerate} Existence of such $u_2$ (and therefore the analogous $c_{u_2}$, $c_{u_2,l}$, and $c_{u_2,r}$) is guaranteed for the longer $u_1$'s, as there are infinitely many pairs of distinct member strings of equal length, but only finitely many tuples of states.
The impasse occurs due to that any verifier accepting both $u_1$ and $u_2$ will have to yield and accept the nonmember string $u_3 = x_1 w x_2$ certified by a modification of $c_{u_1}$ that replaces the superimposed $c_{u_1,r}$ with $c_{u_2,r}$: The two and only excuses to reject $u_3$ and its certificate are the mismatches between $x_1$ and $x_2$ in the input, and between $c_{u_1,l}$ and $c_{u_2,r}$ in the certificate. None of the deterministic verifiers can reliably detect those mismatches when $x_1$ and $x_2$ (and therefore $c_{u_1,l}$, $c_{u_2,r}$, and the prefix of the latter) are long enough to overload their finite memory.
%
% Exhibiting the existence of two member strings $x_1 w x_1$ and $x_2 w x_2$, which would necessitate such a hypothetical verifier to be tricked into accepting $x_1 w x_2$ as a member of $\lfrac$, is straightforward.
\end{proof}
This contradiction proves the nonexistence of a real-time, constant-space, constant-randomness verifier for $\lfrac$.
\end{proof}
%%%%%%%%% OUR SPECULATIONS
\subsection{One-way vs. real-time input for finite-state, constant-randomness verifiers}
We conclude this section with a discussion on the open question of whether \vsri{\consX}{\consX}{\rtX} = \vsri{\consX}{\consX}{\owayX} or not, that is, whether constraining the input heads of one-way, constant-space, constant-randomness machines further to real-time movement reduces their language verification power.
Consider the language
\begin{equation*}
\lmatch=\Set{x\#y_1\#y_2\#\dotsm\#y_k | \begin{array}{l}
x, y_i \in \Set{0,1}^+ \text{ for all } i, k>0, \\
\text{and } y_i=x \text{ for some } i
\end{array} }.
\end{equation*}
\lmatch{ can} be seen easily to be in \ONFAK{2}, and therefore in \vsri{\consX}{\consX}{\owayX}, by \cref{thm:SY}.
We will now point out some features that any one-way finite-state machine $V$ that uses at most $k$ random bits (for some constant $k$) to verify $\lmatch$ has to possess.
(Since $\lmatch$ is nonregular, $k$ is necessarily greater than zero.) Once again, we will be calling the machines $V_1$, $V_2$, \dots, $V_{2^k}$ that are obtained by ``hard-wiring'' the $2^k$ different sequences of $k$ coin tosses into $V$'s transition function \emph{the deterministic verifiers}. Our definition of verification in \cref{subs:vers} dictates there exists a certificate that would make all these $V_i$ accept an input string $w$ if and only if $w\in \lmatch$. For any input $w$ not in $\lmatch$, at least one of the $V_i$ rejects, no matter what is written on the certificate tape. Assume, without loss of generality, that the deterministic verifiers make sure to move their input heads to the right end-marker before entering the accept state.
Consider the behavior of $V$ on an input string $w$ of the form $x\#y_1\#y_2\#\dotsm\#y_k$, where $ x, y_i \in \Set{0,1}^+$ for all $i$ up to $k$.
\begin{proposition}\label{prop:bombastik1}
At least one of the deterministic verifiers moves the certificate head while its input head is scanning the prefix $x$. % For sufficiently long $x$, the length of the certificate substring consumed at this stage by this particular deterministic verifier grows in proportion to the length of $x$.
This machine uses the information that it obtains from the certificate at this stage to decide whether or not to reject the input string. %\textbf{This information has to be encoded within the first $\abs{x}$ symbols of the certificate.}
\end{proposition}
\begin{proof}
%Assume that one of the $y_i$ equals $x$, \ie, this input string is a member of $\lmatch$, and is accepted by all the $V_i$'s.
Assume that none of the deterministic verifiers reads the certificate before consuming the first $\#$ in the input. No such particular deterministic verifier $V_j$ could have committed itself to rejecting the input by the time it is reading the first $\#$, since it may well be the case that one of the $y_i$ substrings in the rest of the input equals $x$, and \emph{all} the deterministic verifiers, including $V_j$, are supposed to accept such strings. Being a finite-state machine, this $V_j$ cannot ``remember'' a sufficiently long $x$ in complete detail, and can only hold an incomplete ``summary'' of $x$, say, $s_j(x)$ in its state. The collection of all such summaries held by the various deterministic verifiers when their input heads reach the first $\#$ (at possibly different times) is describable as a tuple $t(x)$ of the form $(s_1(x),s_2(x),\dotsc,s_{2^k}(x))$. Note that there are only finitely many different tuples of this kind.
Since there exist infinitely many strings that $V$ can encounter in the role of $x$, there are two distinct strings $x_1$ and $x_2$ which have the same tuple of summaries; $t(x_1)=t(x_2)$. Since $V$ is supposed to accept the input $w'=x_1\#y_1\#y_2\#\dotsm\#x_1\#\dotsm\#y_k$ (where only one of the $y_i$'s equals $x_1$, and none of the other $y_i$'s equals $x_2$) with probability 1, it will then also have to accept the input $w''=x_2\#y_1\#y_2\#\dotsm\#x_1\#\dotsm\#y_k$, obtained by replacing the first $x_1\#$ substring in $w'$ with the substring $x_2\#$, with probability 1. But this is impossible, since $w'' \notin \lmatch$. So it cannot be the case that none of the deterministic verifiers read the certificate before their input heads reach the first $\#$.
Let us now focus on the requirements on at least one such deterministic verifier, say, $V_l$, which, as we just saw, has to be consuming some certificate symbols (making up a string that we will call $c_{w,l}$) while scanning the first substring $x$ in the input. What is the use of reading the certificate at this stage?
%Note that when $V_l$ consumes the first $\#$ in the input, the combined information that it ``remembers'' about $x$ plus the certificate prefix $c_{w,l}$ that it has read until that point would again have to be an incomplete summary of $x$ and $c_{w,l}$, which would lead to precisely the same problem described above if $V_l$ went on to scan the rest of the input string to decide whether to accept or to reject it. There remains only one way in which $V_l$ could make use of $c_{w,l}$: $V_l$ can utilize $c_{w,l}$ to arrive at an immediate decision about the input, based only on the prefix $x$.
Noting that the problem identified above was accepting a string like $w''$ with probability 1, and keeping in mind the definition of $\lmatch$, we see that $V_l$ should attempt to use the certificate prefix $c_{w,l}$ that it is consuming at this stage to identify and reject input strings in which the prefix $x$ does not reappear as one of the $y_i$ substrings.
This amounts to attempting to ``match'' $c_{w,l}$ with $x$ as $V_l$ scans the input and the certificate tapes simultaneously,
%committing to accept if the match succeeds,
and committing to reject if the match fails.\footnote{Note that we are using the word ``match'' in a very general sense, to indicate any procedure that the verifier can perform to compute a Boolean result after consuming $x$ and $c_{w,l}$ in a ``parallel'' fashion. Checking whether $c_{w,l}=x$ is just one simple kind of matching.}
%We can therefore say that $c_{w,l}$ is a complete description of a $y_i$ substring that is claimed by the certificate to exist in the remainder of the input, and $V_l$ is checking whether the prefix $x$ is indeed equal to this purported $y_i$.
We can therefore say that $c_{w,l}$ is the ``evidence'' provided by the certificate about a claim that a particular $y_i$ substring exists in the remainder of the input, and $V_l$ is checking whether it can refute that the prefix $x$ equals this purported $y_i$ by making use of its scans of $x$ and $c_{w,l}$.\footnote{This interpretation (that this certificate segment is supposed to correspond to a unique string $y_i$) also makes it evident that there is no constant that bounds the lengths of these certificate prefixes consumed by $V_l$; longer $y_i$'s would in general necessitate longer $c_{w,l}$'s.}
%\textbf{(Of course, being just one branch of a probabilistic algorithm, $V_l$ can be tricked into accepting strings that are not members of $\lmatch$. We will return to this issue in the discussion after the proof of the theorem.)}
%\textbf{The fact that $c_{w,l}$ has to be at most $\abs{x}$ symbols long follows from the fact that $V$ is a real-time machine, and spends only that many steps to traverse the input prefix $x$.}
%Bu dilin 1w input makineler tarafından verify edilişini inceleyelim.
%
%Varsayalım ki bu dili halleden bir 1w-input, sabit-coin verifierımız (V1, V2, vs.) var. Bundan elde edilen deterministik verifierları düşünelim. Bu sistemin kabul ettiği "x#.......x...." tipi stringleri düşünüp sertifikayı nasıl okuduğuna dair çıkarımlar yapacağız.
%
%Lemma 1: V'lerin en az biri inputta #'ın solunda yürürken sertifikadan bir miktar okuma yapar ve buna bağlı olarak inputu reddedip reddetmeyeceğine oracıkta karar verir.
%
%Proof by contradiction: Aksi takdirde V'lerin hepsine (yani makinemize 1 olasılıkla) dile üye bir stringin sol kısmını x olmaktan çıkarıp sağda hiç geçmeyen başka bir string haline soktuğumuz nonmember bir stringi de kabul ettirebiliriz. Çünkü # öncesinde sertifika okumayan bir V'nin oradaki x'i reddetmek için bir nedeni yoktur (öyle bir şey yapan bir V'ye üye bir stringi reddettirebilirsiniz), yani V'lerimizin tümü #'ye vardığında sonlu sayıda nonreject stateinden birinde olacaktır. O anda V1, V2, vs. tarafından girilen stateler tuple'ı (s1, s2, ...) olsun. Bu tuple'lardan sadece sonlu sayıda var, yani illa ki iki farklı x ve y prefix'i V'lerimizi aynı state tuple'ına getirecektir. Makinemiz de sağda y içermeyen "x#.......x...." stringini kabul etmek zorunda olduğu için prefixi değiştirerek elde edilen "y#.......x...." stringini de kabul etme çelişkisine düşecektir. QED
%
%Bu "inputun A substringinin üzerinde yürürken sertifikadan B substringini okuyup ona göre reddedip etmemeye karar vermek" eylemine "A ile B'yi match etmek" diyelim.
\end{proof}
\begin{proposition}\label{prop:bombastik2}
Consider input strings of the form $x\#y_1\#y_2\#\dotsm\#x\#\dotsm\#y_k$, where only one of the $y_i$'s, say, $y_j$, equals $x$.
At least one of the deterministic verifiers moves its certificate head to read a ``claim'' about what the string $x$ was, while its input head is scanning the substring $y_j$.
%For sufficiently long $x$, tmhe length of the certificate substring consumed at this stage by this particular deterministic verifier grows in proportion to the length of $x$.
For sufficiently great $j$, the substring containing this claim in a correct certificate must be preceded by a prefix whose length is an increasing function of $j$.
\end{proposition}
\begin{proof}
Assume that none of the deterministic verifiers read the certificate while their input heads are scanning $y_j$.
% At the step when they are reading the $\#$ just before $y_j$, none of these verifiers must have committed to reject the input, because it may well be the case that they are working on a member of $\lmatch$.
There must exist some certificate prefixes on which none of these verifiers could have committed to reject the input by the step when they are reading the $\#$ just before $y_j$, because it may well be the case that a machine that has consumed such an input prefix is working on a member of $\lmatch$.
As described in the proof of \cref{prop:bombastik1}, what these verifiers can remember about the input prefix $x$ at that point can be described as a tuple $t(x)$. There are only finitely many such tuples, and there exist two distinct strings $x_1$ and $x_2$ for which $t(x_1)=t(x_2)$. The verifier $V$ can then be convinced to accept the strings $w_1=x_1\#y_1\#y_2\#\dotsm\#x_1\#\dotsm\#y_k$ (where only $y_j$ equals $x_1$, and none of the other $y_i$'s equals $x_2$), $w_2=x_2\#y_1\#y_2\#\dotsm\#x_2\#\dotsm\#y_k$ (obtained from $w_1$ by replacing the two $x_1$ substrings with $x_2$'s), and $w_3=x_1\#y_1\#y_2\#\dotsm\#x_2\#\dotsm\#y_k$ (obtained by replacing the substring $\#x_1\#$ in $w_1$ with the substring $\#x_2\#$), with probability 1. But this is impossible, since $w_3 \notin \lmatch$. So at least one deterministic verifier, say, $V_r$, must move its certificate head while scanning $y_j$.
Continuing with the example above, for $V$ to have any hope of verifying $\lmatch$ correctly, $V_r$ has to use what it reads from the certificate at this stage to differentiate strings like $w_3$, which should be rejected, from strings like $w_1$ and $w_2$, which should be accepted.
%This indicates that the certificate portion read at thishttps://www.overleaf.com/project/60be7c74477df8c1af78c44a stage should claim to contain a complete description of the input prefix up to the first $\#$, and $V_r$ should attempt to match this description with $y_j$.
This indicates that the certificate portion read at this stage should contain evidence for a
claim that the input prefix up to the first $\#$ equals $y_j$. Since $V_r$ can be holding only a finite summary of that input prefix from its earlier scan, the certificate portion must purport to contain any information missing from that summary to enable $V_r$ to match the described prefix with $y_j$.
%PROBLEM OF EVIL BURADAN ÇIKARILACAK??!?!?!?
%As noted for $V_l$ in the proof of \cref{prop:bombastik1}, it is easy for an ``evil'' certificate to trick $V_r$ into accepting some non-members of $\lmatch$.
%Consider the operation of $V_r$ after its input head has passed the first $\#$. Recall that $V_r$'s memory of the input prefix $x$ is incomplete, and if the next input segment $y_1$ equals any other string $x'$ which leaves the same summary as $x$ in $V_r$'s memory, the certificate can just claim that the input prefix was $x'$, and $V_r$ would accept the input if it compared that description with $y_1$.
%Leaving the treatment of those evil certificates about non-members to the discussion below, let us concentrate on how $V_r$ is supposed to behave within the context of a properly working verifier $V$ for $\lmatch$.
A correct certificate for a member of $\lmatch$ like $w_1$ needs to provide more information to $V_r$ than just a description of the input prefix $x_1$; it has to indicate which of the $y_i$ substrings is the one that equals $x_1$, so that $V_r$ attempts to match that substring (without rejecting on seeing the previous ones) with the purported prefix description in the certificate. This is easy to see if one adopts the point of view of $V_r$ on the first $\#$ in the input. The substring $y_1$ that starts with the next input symbol may or may not be the one that matches the prefix description waiting to be read in the certificate, so should $V_r$ start consuming that description to match it with $y_1$ or not? If $y_1$ really is the substring in question, the prefix description should be consumed from the certificate right away, for $V_r$ cannot perform such matchings after it has walked away from, and therefore forgotten, parts of $y_1$. On the other hand, if $y_1$ is not the correct substring to match, consuming the correct prefix description now to attempt a match would end in failure. $V_r$ has no way of knowing which one the correct $y_j$ substring is, so in order to avoid the risk of rejecting a member of $\lmatch$ like $w_1$, it has to be ``walked'' over the substrings up to $y_j$ by the certificate. This requires an additional substring (that essentially encodes a message for which a very informal English translation would be ``Not $y_1$, not $y_2$, \dots{}, not $y_{j-1}$, YES, match the string in the rest of this message with $y_j$!'') to exist on the certificate tape before the actual purported prefix description $x_1$ that will be used by $V_r$, and the length of this substring grows as $j$ gets larger. (For instance, a substring of $j$ $\#$ symbols preceding the description of $x_1$ on the certificate can be used for this purpose.)
\end{proof}
The simplest verifier we can design from scratch for this language
expects certificates of the form $\#^j x$ for members of $\lmatch$ of the form $x\#y_1\#y_2\#\dotsm\#y_k$, where $y_j=x$. It uses a single random bit to split into two deterministic verifiers $V_l$ and $V_r$ that operate as follows:
$V_l$ pauses its input head while it consumes all the $\#$'s in the certificate, and then attempts to match the rest of the certificate bit by bit with the input up to the first $\#$ in the input.
$V_r$ scans the input in real-time, consumes one $\#$ from the certificate for each $\#$ that it encounters in the input
until it runs out of $\#$'s in the certificate, and starts attempting to match the rest of the certificate bit by bit with the currently scanned substring in the input. The correspondence with Propositions \ref{prop:bombastik1} and \ref{prop:bombastik2} is evident.\footnote{Converting the obvious 1nfa(2) for $\lmatch$ with the method of Theorem \ref{thm:SY} also yields a verifier whose two probabilistic branches correspond to the two deterministic verifiers described in Propositions \ref{prop:bombastik1} and \ref{prop:bombastik2} in the same way as our simple example.}
Although the proofs of Propositions \ref{prop:bombastik1} and \ref{prop:bombastik2} mention two pieces of ``evidence'' about two different input segments that should be read from the certificate by the deterministic verifiers they describe, the certificate format used in the example above uses the same substring $x$ to play both those roles. The reader should note that this is what guarantees the verifier to catch any ``lie'' of the certificate with nonzero probability: In any nonmember of $\lmatch$, there exists no $y_j$ segment that matches the prefix $x$, and any substring contained in that position in a deceptive certificate will fail to match at least one of the two relevant input substrings and therefore be rejected by one of $V_l$ and $V_r$.
Let us now ask whether $\lmatch$ has a \emph{real-time} verifier. Such a machine would of course have to comply with Propositions \ref{prop:bombastik1} and \ref{prop:bombastik2}, but it also has to obey an additional constraint: Its input head must scan the prefix $x$ of the input string $x\#y_1\#y_2\#\dotsm\#y_k$ in exactly $|x|$ steps. Since Proposition \ref{prop:bombastik1} requires at least one deterministic verifier to consume the certificate's purported evidence about a later input segment $y_j$ during its consumption of the input prefix, this information has to be encoded within the first $|x|$ symbols of the certificate. Recalling that Proposition \ref{prop:bombastik2} dictates the other piece of evidence (about the input prefix) to be preceded by a prefix whose length grows with $j$, we see that any real-time verifier for $\lmatch$ would have to forgo the use of a single certificate substring for both purposes, and try to deal with nefarious certificates including two distinct substrings to attempt to deceive $V_l$ and $V_r$ separately. We conjecture that this is impossible, \ie, that $\lmatch \notin \vsri{\consX}{\consX}{\rtX}$, and therefore that
\begin{equation*}
\vsri{\consX}{\consX}{\rtX} \subsetneq \vsri{\consX}{\consX}{\owayX}.
\end{equation*}
%from getting away with a lie this certificate contains not two, but just one string description that can be matched with two different regions of the input string by two different deterministic verifiers. Any ``evil'' certificate can trick only one, not both, of $V_l$ and $V_r$ into acceptance, so no input string that is not a member of $\lmatch$ would be accepted with probability 1.
\begin{proof}
Let $V$ be a finite-state real-time verifier that tosses at most $r$ coins, recognizing the language $A$. Let $\Gamma$ be the certificate alphabet of $V$. For $i \in \Set{0, 1, \dotsc, 2^r-1}$, let $V_i$ be the finite-state real-time deterministic verifier simulating $V$ by feeding the bits of the $r$\=/digit binary representation of $i$ as the supposed coin outcomes. Then, the \onfaklnrr{2^r}{1} $M$ with the following algorithm recognizes the same language $A$:
\begin{turing}{M}{On input $x$:}
\item
Repeat the following until every $V_i$ accepts:
\bitem{Pick a $\gamma \in \Gamma$, nondeterministically.}
\bitem{For $i = 0, \dotsc, 2^r-1$:}
\bbitem{If $V_i$ had already accepted, continue with the next $i$.}
\bbitem{Simulate $V_i$ with the \ith{i} head until $V_i$ requests for a certificate symbol. Simulate $V_i$ for one more step providing $\gamma$ as the certificate symbol. If $V_i$ rejects at any step, \reject. If $V_i$ accepts at any step, run the head until the end of input and continue with the next $i$. \utkanadd{If $V_i$ is not the only deterministic verifier that has not yet accepted and it begins a step reading \rend{}, take $V_i$ as accepted or rejected as it would after that step, and interject the current step with the one to be done with the next $i$.}}
\item
\Accept.
\end{turing}
Any $x \in A$ will be accepted by $V$ with probability 1, and therefore by every $V_i$, and so will $M$ simulating every $V_i$ and accepting if they all do. Any $x \notin A$ will be rejected by at least one $V_i$, and so does $M$ during its simulation.
$M$ is a \onfaklnrr{2^r}{1} since it runs each of its heads in cyclic order, skipping heads only if they have reached the right end-marker, and makes a single nondeterministic choice in each cycle.
\end{proof}
%% MASSIVE MARKOV CHAIN TO ESTIMATE POLY-TIMER RUNTIME
We calculate the expected runtime of this timer by analyzing its process modeled as a Markov chain, shown in \Cref{fig:markov}. Let $s_{i, j}$ denote the node on the row $i \in \Set{0, 1, \dotsc, b}$ and column $j \in \Set{0, 1, \dotsc, n+1}$, and let $t_{i, j}$ be the expected number of steps to reach $s_{b, n+1}$ (the only absorbing node) from $s_{i, j}$. Each transition in the Markov chain takes 1 step, except for the transitions outbound from $s_{i, n+1}$ for $i < b$, which take $n$ steps.
We then begin analyzing the system for $i=0$ first. As a warm-up, we note that whenever the current state is $s_{0, 0}$, the finite-state machine necessarily transitions into $s_{0, 1}$ (taking 1 step), and then has $t_{0, 1}$ more expected steps ahead.
\begin{align*}
t_{0, 0} &= 1 + t_{0, 1}\\
\intertext{There are two options from $s_{0,1}$ with equal probability for each, yielding the following equations:}
t_{0, 1} &= 1 + 0.5 \cdot t_{0, 0} + 0.5 \cdot t_{0, 2}\\
&= 1 + 0.5 \cdot \paren*{t_{0, 1} + 1} + 0.5 \cdot t_{0, 2}\\
&= 3 + t_{0, 2}\\
\intertext{This pattern continues as}
t_{0, j} &= 2j + 1 + t_{0, j+1},\\
\intertext{and we derive the closed form estimation for our node of importance ($s_{0, 1}$) as}
t_{0, 1} &= \paren*{\textstyle\sum_{j=2}^{n+1} 2j + 1} + t_{0, n+1}\\
&= n^2 + 2n + t_{0, n+1}.
\end{align*}
\begin{figure}[H]
\centering
% \begin{tikzpicture}[y={(1.8cm, 0cm)}, x={(0cm, -1.8cm)}, state/.append style = {minimum width=width("$s_{0,n+1}$")+2mm, inner sep=0pt, font=\small}]
\begin{tikzpicture}[y={(1.5cm, 0cm)}, x={(0cm, -1.5cm)}, state/.append style={minimum size=5mm, inner sep=0pt}]
\foreach \i / \pi / \l in {0/0/0, 1/2/1, 3/6/b} {
\foreach \j in {0, 1, 2, 4, 5, 6}
\node[state] (s\i\j) at (\pi,\j) {};
\node at (\pi, -1) {$\l$};
\node (dots\i) at ($(s\i2)!0.5!(s\i4)$) {\LARGE$\cdots$};
}
\node[state, dashed] (s21) at (4,1) {};
\node[state, dashed] (s26) at (4,6) {};
\node[state, minimum size=4mm] at (6,6) {};
\foreach \j / \l in {0/0, 1/1, 2/2, 4/n-1, 5/n, 6/n+1}
\node at (-1, \j) {$\l$};
\path[->] ($(s01) - (0.5, 0)$) edge (s01);
\foreach \i in {0, 1, 3}
\path[->, bend left]
% (s\i0) edge ["$1$"] (s01)
(s\i1) edge ["$\sfrac12$"] (s\i0)
edge ["$\sfrac12$"] (s\i2)
(s\i2) edge ["$\sfrac12$"] (s\i1)
edge [dashed] (s\i4)
(s\i4) edge [dashed] (s\i2)
edge ["$\sfrac12$"] (s\i5)
(s\i5) edge ["$\sfrac12$"] (s\i4)
edge ["$\sfrac12$"] (s\i6);
\path[->]
(s00) edge [bend left, "$1$"] (s01)
(s10) edge [out=50, in=270, swap, pos=0.2, "$1$"] (s01)
(s30) edge [out=98, in=235, out distance=6.5cm, pos=0.02, swap, "$1$"] (s01);
\path[->, out=270, in=90, out distance=2cm, in distance=3cm]
(s06) edge [pos=0.35, "$1$ (cost: $n$ timesteps)"] (s11)
(s16) edge [dashed, pos=0.35, "$1$ (cost: $n$ timesteps)"] (s21)
(s26) edge [dashed, pos=0.35, "$1$ (cost: $n$ timesteps)"] (s31);
\path[->]
(s36) edge [out=302, in=238, looseness=0, distance=5mm, loop, "$1$"] ();
\node[rotate=90] at ($(dots1)!0.44!(dots3)$) {\LARGE$\cdots$};
% \path[dash pattern=on 0.5pt off 10pt, shorten >= 8mm, shorten <= 8mm, line width=2pt, line cap=round]
% (s02) edge (s04);
% \node[state] (q1) [right = of q0] {q_1};
% \node[state] (q2) [right = of q1] {q_2};
% \node[state ] (qa) [right = of q2] {\qacc};
% \node[state] (qr) [below = \BelowDist of qa] {\qrej};
% \path[->]
% (q0)
% edge node [ ] {\lend \to \mover} (q1)
% (q1)
% edge [loop above] node {\texttt0 \to \movep} ()
% edge node [ ] {\texttt0 \to \mover} (q2)
% edge [bend right=\BendAngle] node [swap] {\rend \to \movep} (qa)
% (q2)
% edge [loop above] node {\texttt0 \to \mover} ()
% edge node [ ] {\texttt1 \to \movep} (qa);
\end{tikzpicture}
\caption{Caption}
\label{fig:markov}
\end{figure}
\section{Real-time, finite-state, constant-randomness verification}\label{sec:results}
In this section, we will present a characterization of the class of languages that have proofs of membership that are verifiable by real-time, finite-state, constant-randomness machines in terms of a naturally restricted version of the one-way nondeterministic multihead automaton model.
We note that the proof of \Cref{thm:SY} provides a method to convert any one-way nondeterministic multihead automaton to an equivalent machine in a ``canonical form'': Given some machine $M$, one can first convert it to a verifier $V$ for the same language using the first construction described in that proof. When $V$ is converted back to an equivalent \onfak{k} $M'$ using the second construction, $M'$ is guaranteed to have the following properties:
\begin{itemize}
% \item It moves exactly one of its heads at every transition,
\item The heads ``move'' alternately according to a predefined order: The machine spends one or more steps for the first head (during which it may or may not move it forward for one or more cells on the input tape), then switches to the second head, then the third, and so on, switching back to the first head after the \ith{k} one. %\utkanadd{The first $k-1$}
Heads that reach the end of the input tape\footnote{When $k-1$ heads have already reached the end of the input tape, the last one is allowed to move beyond the right end-marker in its final step.} may be considered to be ``dropped out'' of this cycle,\footnote{\label{fn:consumebeforeaccept}Strictly speaking, the machine $M_V$ described in the proof of \Cref{thm:SY} can stop a head corresponding to a deterministic verifier that has accepted permanently without having to reach the end of the input tape, but every such machine can be transformed into one that moves every such head to the end of the tape.} in which case this process goes on with the remaining heads, and
%Zero or more stepsrun of each head\footnote{We refer to the maximal sequences of transitions that the multihead automaton makes moving the same head as \emph{runs of that head}.} is performed in a round-robin fashion (\ie, a run of a head is followed by that of the subsequent head in the same order) where a run is of zero length if and only if that head has reached the right end-marker on the input tape, and
\item the automaton makes at most %$m$
one nondeterministic choice during each iteration of this loop.% full cycle of runs.
\end{itemize}
As explained above, this is what one obtains if one converts an arbitrary constant-randomness finite-state verifier with one-way input to a \onfak{k} using the technique of \Cref{thm:SY}. When one submits a \emph{real-time} verifier to that procedure, though, the output machine satisfies an additional restriction: It moves every head (that has still not dropped out of the cycle) forward for at least one step on the tape during each iteration of the loop. This is because each ``deterministic verifier'' used in the procedure described in that proof is a real-time automaton in this case, and simulating every transition of such a machine involves moving the input head. We will show that ``canonical form'' \onfak{k}'s with this additional property %\utkanadd{(\onfaklnrr{k}{1} by the denotation introduced in the following paragraph)}
correspond exactly to real-time, constant-space, constant-randomness verifiers.
%For our following result, we first have to introduce a restricted version of the one-way multihead automata defined in \Cref{subs:nfaks}:
Let us define a slightly more powerful-looking model that will turn out to be equivalent to the restricted machines described above. For any positive integer $m$, A \emph{one-way $k$-head nonstop %\emph{round robin}
finite automaton} \emph{with (up to) $m$ nondeterministic choices per round} (\onfaklnrr{k}{m}) is a \onfak{k} such that
\begin{itemize}
\item exactly one head moves at every transition,
\item the heads which have not yet reached the end of the input tape %\footnote{\utkanadd{See} \Cref{fn:consumebeforeaccept}.}
take turns in moving for one or more steps in a round-robin fashion (with the very last head to move also allowed to spill beyond the right end-marker in its last step), and
%the run of each head\footnote{We refer to the maximal sequences of transitions that the multihead automaton makes moving the same head as \emph{runs of that head}.} is performed in a round-robin fashion (\ie, a run of a head is followed by that of the subsequent head in the same order) where a run is of zero length if and only if that head has reached the right end-marker on the input tape, and
\item the automaton makes at most $m$ nondeterministic choices during each iteration (``round'') of the head movements loop.
%full cycle of runs.
\end{itemize}
In keeping with our naming conventions, the class of languages recognized by some \onfaklnrr{k}{m} for any value of $k$ will be denoted \ONFAKLNRR{*}{m}.
\subsection{$\vsri{\consX}{\consX}{\rtX} = \ONFAKLNRR{*}{1}$}
We will show that every language recognizable by a \onfaklnrr{k}{m} is verifiable by a constant-space, constant-randomness verifier that scans its input in real time, and vice versa. One direction of this equivalence has, in fact, already been noted above. We state it below without proof for the sake of completeness:
\begin{lemma}\label{lem:vertonfak}
$\vsri{\consX}{\consX}{\rtX} \subseteq \ONFAKLNRR{*}{1}$
\end{lemma}
It remains to show that every language recognizable by a \onfaklnrr{k}{m} has a real-time verifier of the kind considered in this paper.
The technique employed in the proof of \cref{thm:SY} for constructing verifiers is not useful here, since it requires the verifier to pause its input head occasionally when processing certain portions of the certificate. We will show that, for all $m>0$, all languages in \ONFAKLNRR{*}{m} have more concise proofs of membership that can be checked by our restricted machines. %(THESE EXAMPLES NEED UPDATING, AND ALSO SHOW $\ODFAK{2} \subseteq \ONFAKLNRR{*}{1}$.) Some examples of languages on the alphabet $\Set{0,1,\#}$ in \ODFAK{2} are \twin, the set of all strings containing equal numbers of 0's and 1's, the set of all odd-length binary strings with the symbol $\#$ at the middle position, the language $\Set{w | w \in (x\#)^+, x \in (0\cup 1)^+}$, and their complements.
%\begin{delineate}{Utkan}
\begin{lemma}\label{lem:nfaktover}
For all $m>0$,
\begin{equation*}
\ONFAKLNRR{*}{m} \subseteq \vsri{\consX}{\consX}{\rtX}.
\end{equation*}
\end{lemma}
\begin{proof}
% Simulating 1dfa(2) with a pfa-v(1-way-certificate, cons-random-bits, cons-space)
%
% Let $M = \paren{Q_M, \Sigma, \delta_M, q_0, \qacc, \qrej}$ be a \odfak{2} recognizing some language $A$. At any given step of its execution, $M$ might be moving none, one, or both of its heads. We start by modifying $M$ to obtain a \odfak{2} $M' = \paren{Q_{M'}, \Sigma, \delta_{M'}, q_0, \qacc, \qrej}$ that recognizes the same language while moving exactly one of its heads at every step, starting with the first head. The details of this construction procedure are as follows:
%
% The state set of the machine $M'$ is defined as $Q_{M'} = Q_M \cup \Set{q' | q \in Q_M}$.
% Each transition of $M$ that moves both heads at once is simulated by two transitions that move the heads one after another in $M'$. Formally, for all $q, s \in Q_M$, $x, y \in \Sigma_{\bowtie}$,
% if $\delta_M(q, x, y) = (s, +1, +1)$, we set $\delta_{M'}(q, x, y) = (s', +1, 0)$. Furthermore, for all $s \in Q_M$, $x, y \in \Sigma_{\bowtie}$, we set $\delta_{M'}(s', x, y) = (s, 0, +1)$.
%
% If a transition of $M$ is stationary, \ie, is of the form $\delta_M(q, x, y) = (s, 0, 0)$, it is a member of either an infinite sequence representing a loop (of length at most $\abs{Q_M}$) in which $M$ scans the symbols $x$ and $y$ without changing the head positions, or a finite sequence ending with acceptance, rejection, or the moving of some head. In the infinite-loop case, we set the corresponding transition in $M'$ to $\delta_{M'}(q, x, y) = (\qrej, +1, 0)$.
% In the finite-sequence case, the value of $\delta_{M'}(q, x, y)$ will be set to $(\qacc, +1, 0)$ or $(\qrej, +1, 0)$ if the sequence is ending with acceptance or rejection, respectively, and to the value of the final transition in the sequence otherwise.
%
% Any transition of $M$ that moves a single head is inherited without modification by $M'$.
%
% It may be the case that the new machine built according to these specifications moves its second head first. This problem can be handled easily by just rearranging the transition function to effectively ``swap'' the names of the two heads.
% (Such a simple swap is possible, because the fact that both heads scan the left end-marker symbol at the beginning means that it is only the transition function, and not the particular input string, that determines which head moves first.)
%
\newcommand{\sh}{\ensuremath{H}}
\newcommand{\shn}{\ensuremath{m}}
\newcommand{\finald}{\ensuremath{d'}}
\newcommand{\finali}{\ensuremath{i'}}
%
Let $M = \paren{Q_M, \Sigma, \delta_M, q_0, \qacc, \qrej}$ be a \onfaklnrr{k}{m} recognizing the language $A$. Knowing about the way that $M$ moves its heads, a computation history of $M$ can be viewed as the concatenation of infinitely many sub-histories
%\utkanrem{$\sh_1,\allowbreak \sh_2, \dotsc,\allowbreak \sh_k,\allowbreak \sh_{k+1},\allowbreak \sh_{k+2}, \dotsc$}
$\sh_{1,1},\allowbreak \sh_{1,2}, \dotsc,\allowbreak \sh_{1,k},\allowbreak \sh_{2,1},\allowbreak \sh_{2,2}, \dotsc$, where only the \ith{i} head moves during %\utkanrem{$\sh_{i'}$ for $i \equiv i' \pmod{k}$}
$\sh_{d,i}$ (where $d>0$ is the round index), and $\sh_{d,i}$ is empty either if the \ith{i} head has already reached the end of the input or if $M$ has already halted by that time. Let $\sh_{\finald, \finali}$ be the halting (accepting or rejecting) sub-history at the end of which $M$ accepts or rejects, and beyond which all the sub-histories are empty. Let us call %\utkanrem{$\sh_i\sh_{k+i}\sh_{2k+i}\dotsm$}
$\sh_{1,i}\sh_{2,i}\sh_{3,i}\dotsm$, the concatenation of all the sub-histories corresponding to the \ith{i} head, the \emph{\ith{i} part} of the history.
Note that, if one visualizes the \ith{i} part of the history for any specific $i$, one sees the \ith{i} head moving in real time on the input until $M$ halts. Furthermore, the state sequence traversed during these moves is easy to trace
%\utkanrem{step by step}
for a real-time verifier that employs
%\utkanrem{employing knowledge of}
$M$'s transition function and that has been given a list of the nondeterministic choices made by $M$, except at the ``joints'' between sub-histories, where the machine's state and the positions of the other heads make ``leaps'' corresponding to (possibly long) sequences of moves carried out by those other heads while the \ith{i} head was pausing.
Intuitively, each part of the history can be thought of as describing the execution of a real-time automaton that momentarily ``blacks out'' as it switches from any %\utkanrem{$\sh_{i'}$ to $\sh_{i'+k}$}
$\sh_{d,i}$ to $\sh_{(d+1),i}$, finding the machine's state and the other heads' positions updated to new values when it ``wakes up.'' Our strategy for real-time verification will follow directly from this observation, and the certificate will supply the necessary information to deal with the blackouts.
\newcommand{\lst}{\ensuremath{s}}
\newcommand{\lsy}{\ensuremath{z}}
\newcommand{\lsn}{\ensuremath{y}}
We will construct a real-time, finite-state verifier $V$ that uses $r = \ceil{\log_2(k)}$ random bits to verify proofs of membership in the language $A$. $V$ will use these random bits to choose a head of $M$, say, the \ith{i} one, in private,
and trace the \ith{i} part of $M$'s (purportedly accepting) computation history.
The certificate $c_w$ for a string $w \in A$ is expected to present the succinct sequence of updates needed for $V$ to recover from the aforementioned blackouts.
To serve that purpose, and to also provide $V$ with the nondeterministic choices of $M$, the certificate alphabet of $V$ will be $\paren*{Q_{M} \times \Sigma_{\bowtie} \times Y^m}^k$, where $Y$ is the codomain of $\delta_M$, and
%\utkanrem{a $c_w$}
the \ith{d} symbol $c_{w,d}$ of the certificate will look like % with each symbol corresponding to a tuple of two states and two input symbols (including end-markers) of $M'$.
% the state of $M$ and symbol under the head that just finished its run for every sub-history.
% required by the two probabilistic paths of $V$ that will be assigned (as will be described shortly) to trace the odd and even parts of the computation history of $M'$ on $w$ to recover from the blackouts mentioned above:
%
%
%\utkanrem{c_w = \paren{\lst_1, \lsy_1, \lst_2, \lsy_2, \dotsc, \lst_k, \lsy_k, \lsn_1}\paren{\lst_{k+1}, \lsy_{k+1}, \lst_{k+2}, \lsy_{k+2}, \dotsc, \lst_{2k}, \lsy_{2k}, \lsn_2}\dotsm} %\\ \in \paren{Q_{M'} \times \Sigma_{\bowtie} \times Q_{M'} \times \Sigma_{\bowtie}}^*
%
% \begin{equation*}
% \utkanrem{c_{w,d} = \paren[\Big]{\lst_{d,1}, \lsy_{d,1}, \paren*{\lsn_{d,1,1}, \dotsc, \lsn_{d,1,m}}, \dotsc, \lst_{d,k}, \lsy_{d,k}, \paren*{\lsn_{d,k,1}, \dotsc, \lsn_{d,k,m}}}}
% \end{equation*}
\begin{align*}
c_{w,d} &= \paren*{c_{w,d,1}, c_{w,d,2}, \dotsc, c_{w,d,k}},\\
\intertext{where each sub-symbol $c_{w,d,i}$ is}
c_{w,d,i} &= \paren[\Big]{\lst_{d,i}, \lsy_{d,i}, \paren*{\lsn_{d,i,1}, \lsn_{d,i,2}, \dotsc, \lsn_{d,i,m}}}.
\end{align*}
%\utkanrem{The sequence above is to be interpreted as follows: For each $i' > 0$}
The certificate's ``claims'' about $M$'s computation that have been encoded into symbols like $c_{w,d}$ are as follows: For each $d, i > 0$, $M$ will be in state %\utkanrem{$\lst_{i'}$}
$\lst_{d, i}$, and the \ith{i} head will be scanning the input symbol
%\utkanrem{$\lsy_{i'}$ at the end of $\sh_{i'}$}
$\lsy_{d, i}$ at the end of
%\utkanrem{$\sh_{i'}$.}
$\sh_{d, i}$.
%\footnote{\utkanrem{This is true except for the $d,i$ pairs that refer to ``times'' after the last sub-history, as will be discussed in the next paragraph.}}
%\utkanrem{. For $i \equiv i' \pmod{k}$, it claims} \utkanrem{Finally, for $d > 0$, $\lsn_d$ indicates the nondeterministic direction to take on the \ith{d} cycle}
For any specific pair $d, i > 0$, some prefix of $\paren*{\lsn_{d,i,1}, \dotsc, \lsn_{d,i,m}}$ indicates the nondeterministic choices that $M$ would make in its \ith{d} round during the \ith{i} head's turn to stay on a path leading to acceptance.
%\utkanrem{$\lsn_d$ will be ignored by $V$ if there is no nondeterministic choices to make on a cycle.}
The rest of the $\lsn_{d, i,j}$'s are to be ignored.
% \utkanrem{To finalize the claim that $M$'s computation accepts at $\sh_{d,i}$ (with $\lst_{d,i} = \qacc$) for some $d, i > 0$, one last symbol $c_{w,(d+1)}$ is needed at the end of $c_w$ to facilitate the verification and inform all the other branches of $V$ that follow the \ith{j} head (for $j \neq i$) about $M$'s verdict upon halting.}
% \utkanadd{
$c_w$ concludes its claim that $M$'s computation accepts at $\sh_{\finald,\finali}$ (with $\lst_{\finald,\finali} = \qacc$) by the final symbol $c_{w,(\finald+1)}$. The sole function of the sub-symbols beyond $c_{w,\finald,\finali}$ is to inform the branches of $V$ that follow the \ith{j} head (for $j \neq i$) that $M$ has already accepted, as will be described below.
%\footnote{\utkanrem{If $V$ is tracing the \ith{j} head for any $j >i$, it receives that information from $c_{w,d}$, as we shall explain.}}
% \utkanchg{For a computation of $M$ accepting by the end of $\sh_{d,i}$ (with $\lst_{d,i} = \qacc$), the sub-histories $\sh_{d,j}$ for $j > i$ will be non-existent. The corresponding $\lst_{d,j}$ in $c_{w,d}$ and also a final symbol $c_{w,(d+1)}$ will be provided by $c_w$ to inform the branches of $V$ that follow the \ith{j} head (for $j \neq i$) that $M$ has already accepted, as will be described below.}{}
For the sake of simplifying the exposition ahead, let
\begin{equation*}
\begin{aligned}
\lst_{1, 0} &= q_0,\\
\lst_{d, 0} &= \lst_{(d-1), k} &&\text{for $d > 1$, and}\\
\lsy_{0, i} &= \lend &&\text{for $0 < i \leq k$}.
\end{aligned}
\end{equation*}
Given an input $w$ and a certificate $c_w$, $V$ starts by tossing $r$ coins to choose which head of $M$ to trace. (By definition, $V$ will have to move its input head while tossing these coins. We will first explain the general algorithm as if $V$ can hold its input head in place until this coin-tossing stage is over, and later elaborate on how this behavior can be simulated by a real-time verifier.) % We recommend that the reader defer this apparent issue until then.
$V$ will scan the input in real time in an attempt to verify the claims of the certificate about the part of $M$'s computation history corresponding to the chosen (say, \ith{i}) head of $M$ by simulating $M$'s actions in that part.
For each $d > 0$, $V$ starts its simulation of the sub-history $H_{d,i}$ (from the state
%\utkanrem{$\lst_{i-1}$}
$\lst_{d,(i-1)}$) with its certificate head scanning the symbol
$c_{w,d}$. If the certificate indicates that $M$ has already halted %\utkanrem{with acceptance}
%\utkanrem{or rejection}
during some sub-history prior to $\sh_{d, i}$, $V$ should halt with the same verdict at this step.
%For this sake, $V$ checks whether $\lst_{d, (i-1)}$ equals \qacc{} (the accept state of $M$)%, verifies that
%and $\lst_{d, i} = \lst_{d, (i-1)}$,% if that check holds (to ensure that the verdict propagates),
%and accepts its input string if %that verification is successful.
%this
%To check if this had happened in any sub-history prior to $\sh_{d, i}$, before starting to simulate $\sh_{d, i}$, $V$ checks the $\lst_{d, j}$ for $j < i$ and (if $d > 1$) also $\lst_{(d-1), j}$ for $j > i$, and accepts if any one of them is equal to the accept state of $M$.
Therefore, $V$ accepts (rejects) immediately if $\lst_{d, (i-1)}$ equals \qacc{} %\utkanrem{(the accept state of $M$)}
(\qrej{}).
%\utkanrem{
If the certificate claims that $M$ has not halted yet, $V$ %} If the check does not hold, $V$ then
memorizes $c_{w,d}$ in its internal state and %immediately
moves the certificate head forward in this first step (simultaneously with the always-moving input head) to scan $c_{w,(d+1)}$, which contains information that will be needed at the instant when this sub-history simulation comes to an end.
During this simulation, $V$ assumes that
%$V$ \utkanrem{initiates} \utkanadd{cuts into} a simulation of $M$ \utkanadd{from its round $d = 1$ and on the \ith{i} head's turn to move,} starting from the state \utkanrem{$\lst_{i-1}$} \utkanadd{$\lst_{d,(i-1)}$} \utkanrem{(or $q_0$ if $i = 1$) while}\utkanadd{,} assuming that
%\utkanrem{each}
every other head (``the \ith{j} head'' for any $j \neq i$) is paused on the symbol
% \begin{enumerate}[label=\alph*)]
% \item $\lsy_{d, j}$ for $j<i$,
% \item $\lsy_{(d-1), j}$ for $j>i$,
% \end{enumerate}
\begin{equation*}
\begin{aligned}
&\lsy_{d, j} &&\text{for } j<i,\\
&\lsy_{(d-1), j} &&\text{for } j>i,
\end{aligned}
\end{equation*}
and traces the \ith{i} head on its own in real time. If it reaches one or more nondeterministic branching points for $M$ during the simulation of
%to act out
the sub-history $\sh_{d, i}$, $V$
%. \utkanadd{For up to $m$ nondeterministic junctions encountered during the act, $V$
takes the paths indicated by $\lsn_{d,i,1}, \dotsc, \lsn_{d,i,m}$ in the order they are provided, rejecting if they are invalid at that point of the simulation.
If it faces an additional nondeterministic branching of $M$ for which the certificate has not provided a direction, $V$ again rejects.\footnote{%Rejection in this case is not essential for $V$ to recognize $A$; if such an event has occurred, then the
The certificate must contain a ``lie'' for $V$ to be faced with such a situation, and another probabilistic branch of the verifier is guaranteed to reject upon detecting that lie, as will be noted shortly.
%Indeed, $V$ may even go ahead and accept the input string in this case, if error rate is of no concern.
}
% \utkanrem{If the simulation accepts or rejects at any point, then so does $V$. This event will also be marked by the certificate, with the accept state of $M$ given as $\lst_{d, i}$.}
%$V$ moves its certificate head forward to the next cell as soon as it starts acting out a sub-history, since it will need to know the next certificate symbol immediately when this sub-history (and its act) comes to an end. \utkanrem{If a nondeterministic junction is encountered during the act, $V$ takes the path indicated by $\lsn_1$.}
$V$ maintains a list of the heads of $M$ that have previously been claimed by the certificate to have reached the end of the input. For each such head indexed by $j > 0$, $V$ checks whether the information in $c_{w,d}$ is consistent with that list, \ie, that $\lsy_{d, j} = \rend$ and $\lst_{d, j} = \lst_{d, (j-1)}$, rejecting immediately if it discovers an inconsistency. It also checks whether any new head should be added to the list by checking whether $\lsy_{d, j}=\rend$ for all other $j$.
\newcommand{\lsyc}{\ensuremath{\check{\lsy}}}
\newcommand{\lstc}{\ensuremath{\check{\lst}}}
% \utkanrem{As $\sh_{d,i}$ comes to an end, the simulated machine $M$ would pause the \ith{i} head,
% %\utkanrem{and move some other head},\footnote{\utkanrem{The only exception is the case where $\sh_{d,i}$ is the very last sub-history.}}
% whereas $V$ cannot pause its real-time head. When $V$ sees that its simulation of $M$ has reached such a juncture at state
% $\lstc$ while its input head is scanning the symbol $\lsyc$,
% %and $V$ (simulating $M$'s \ith{i} head) is scanning the input symbol $\lsyc$, $V$ instead
% it simply accepts if $\lstc = \qacc$. Otherwise,
% % initiates the second cycle of $M$'s simulation by performing
% it does the following two things at once in the next step:}
If $V$ reaches a halting state of $M$ during its simulation, it halts with the same decision. Otherwise, as $\sh_{d,i}$ comes to an end, the simulated machine $M$ would pause the \ith{i} head and move some other head, whereas $V$ cannot pause its real-time head. When $V$ sees that its simulation of $M$ has reached such a juncture at state $\lstc$ while its input head is scanning the symbol $\lsyc$, it does the following two things at once in the next step:
\begin{enumerate}
% \item For $j > 0$, if the \ith{j} head is marked as having reached the end of input (according to the list of $k$ Boolean values it is keeping), $V$ verifies that $\lsy_{d, j} = \rend$ and $\lst_{d, j} = \lst_{d, (j-1)}$, rejecting immediately if it discovers an inconsistency.
% \item For $j > 0$, $V$ updates its list of $k$ Boolean values indicating whether the \ith{j} head has reached the end of input, by checking if $\lsy_{d, j}$ is $\rend$.
\item $V$ verifies that $\lstc = \lst_{d, i}$ and that %its input head is currently scanning the symbol
$\lsyc=\lsy_{d, i}$ (in line with the claims of %the \utkanrem{first} \utkanadd{\ith{d}} certificate symbol
$c_{w,d}$)
% $\paren{\lst_1,\allowbreak \lsy_1,\allowbreak \dotsc,\allowbreak \lst_i,\allowbreak \lsy_i,\allowbreak \dotsc,\allowbreak \lst_k,\allowbreak \lsy_k,\allowbreak \lsn_1}$
and rejects immediately if it discovers an inconsistency.
\item
If %\utkanrem{$\lstc = \qacc$ or}
$\lsyc = \rend$, $V$ accepts. Otherwise, it starts a simulation of the sub-history $H_{(d+1),i}$ from the state $\lst_{(d+1),(i-1)}$ with its certificate head scanning the symbol $c_{w,(d+1)}$, repeating the process described above.
%\utkanrem{it initiates} \utkanadd{It cuts into} a new simulation of $M$ \utkanadd{from the subsequent round $d = 2, 3, \dotsc$, continuing just as in the beginning, and operating repeatedly in this loop.} %\utkanrem{starting from the state $\lst_{\paren*{1 \cdot k + i - 1}}$ while assuming that the \ith{j} head (for all $j \neq i$) is paused on the symbol}
%\begin{enumerate}[label=\alph*)]
% \item \utkanrem{$\lsy_{\paren*{1 \cdot k + j}}$ for $j<i$,}
% \item \utkanrem{$\lsy_{\paren*{0 \cdot k + j}}$ for $j>i$,}
%\end{enumerate}
%\utkanrem{and tracing the \ith{i} head on its own, to act out the sub-history $\sh_{\paren*{1 \cdot k + i}}$}
% $\lsy_{j'}$ is the symbol that the \ith{j} head is now scanning for $j' \equiv j \pmod{k}$, as claimed by the certificate
% continuing with the simulation by the transition $\delta_{M}(\lst_{k+i-1},\allowbreak \lsy_{k+1},\allowbreak \lsy_{k+2},\allowbreak \dotsc,\allowbreak \lsy_{k+i-1},\allowbreak \lsyc,\allowbreak \lsy_{i+1},\allowbreak \dotsc,\allowbreak \lsy_{k-1},\allowbreak \lsy_k)$\footnote{If this transition happens to move any head other than the \ith{i} head, $V$ rejects.}, \ie, out from the ``wake-up'' state $\lst_{k+i-1}$ (the state which $M$ is claimed to be left at by the previously running head) and assuming that $\lsy_{j'}$ is the symbol that the \ith{j} head is now scanning for $j' \equiv j \pmod{k}$, as claimed by the certificate
% \item advancing its certificate head
\end{enumerate}
%\utkanrem{$V$ again moves its certificate head forward by one step, and, if needed, takes the nondeterministic path indicated by $\lsn_2$.}
%\utkanrem{$V$ operates repeatedly in this manner to carry out the reenactment of the \ith{i} part of $M$'s purportedly accepting computation history.}
%consuming the first certificate symbol $\paren{\lst_1, \lsy_1, \lst_2, \lsy_2}$,
%and continues its simulation with the new state and with $\delta_{M'}(\lst_2, x, \lsy_2)$ where $x$ is the input symbol $V$ is reading itself, and verifies that it has just transitioned out of the state $\lst_1$, that $x = \lsy_1$, and that the transition actually moves the first head. The simulation of $M'$ will then continue, imagining a second head paused on top of $\lsy_2$, until the end of $\sh_3$ is reached, and so the algorithm repeats.
% The procedure to be followed by $V$ if it chooses any other head at the beginning is similar, with some minor differences: Let $i > 1$ be the index of the head. In this case, $V$ moves the certificate head at its first step, leaving the first certificate symbol $\paren{\lst_1, \lsy_1, \lst_2, \lsy_2, \dotsc, \lst_k, \lsy_k, \lsn_1}$ behind. (It stores $\lst_2$ and $\lsy_2$ in its memory for later use.) $V$ starts simulating $M'$ from the state $\lst_1$, trusting the certificate's claim that $M'$'s first head is paused on the symbol $\lsy_1$, and using its own real-time head to mimic $M'$'s second head.\footnote{If the first simulated step from state $\lst_1$ does not move the second head, $V$ rejects.}
% This simulation proceeds until the point where $M'$ pauses its second head. $V$ checks whether the certificate's claims about $\lst_2$ and $\lsy_2$ were indeed consistent with its current information about the simulation state and head reading, consumes the next certificate symbol, and proceeds simulation from the new ``wake-up'' setting as described above if it has not discovered a lie of the certificate.
It is important to note that the definition of a real-time verifier necessitates $V$ to move its input head while tossing its $r$ coins, and also that we can alleviate this issue: $V$ keeps these first $r$ input symbols in its finite-state storage. Coinciding with its latest coin flip, $V$ processes all these memorized input symbols at once in a single macro-step that is merely a concatenation of the individual steps described above. $V$ may also need to know about the first $r$ certificate symbols while taking that macro-step. To help with that, as with the input symbols, $V$ passes over and memorizes the first $r$ certificate symbols while tossing its coins, and uses as many of them as it needs during the macro-step. During the rest of its simulation, $V$ continues to consume this memorized certificate prefix until it is exhausted, and then proceeds to read the rest of certificate.
The number of input strings shorter than the constant $r$ are finite. Therefore, if $V$ reaches the right-end marker on the input before the coin-tossing stage is over, it %$V$---by itself---
can immediately decide upon the membership of that short input string with zero error by just using a look-up table.
% it simultaneously moves its certificate head as well, and puts the first $r$ input and certificate symbols into a finite and temporary memory accommodated by its finite-state. This is possible since $r$ is a constant and the input and certificate alphabets are finite. Coinciding with its latest coin flip, $V$ processes all of the memorized input symbols and some of the certificate symbols in a single macro-step that is the concatenation of the individual steps.
The reader might have observed that
$V$'s algorithm, as described, is able to simulate \onfak{k}'s which have an even higher ``nondeterminism budget'' than \onfaklnrr{k}{m}'s, namely, those which make at most $m$ nondeterministic choices during each individual head's movement turn in each round of their executions.
%$V$'s algorithm allows it to simulate an $M$ that can make more than $m$ (and possibly up to $k \cdot m$) nondeterministic choices in a round of its execution.\footnote{Indeed, $V$'s algorithm, as described, is also able to simulate \onfak{k}'s which have a somewhat higher ``nondeterminism budget'' than \onfaklnrr{k}{m}'s, namely, those which make at most $m$ nondeterministic choices during each individual head's movement turn in each round.} Although concerning at first sight, this is also a non-issue, since
Such an event can never occur in any real execution of $M$ by definition. For this to arise during $V$'s simulation, the certificate must have lied at some point prior to that event, which would be caught by the probabilistic branch that is verifying the respective part of the history, as described below.
Finally, we note that $V$ can use information written in up to two certificate symbols while simulating $M$ during a particular sub-history: The last two symbols ($c_{w,(d-1)}$ and $c_{w,d}$) to the left of the certificate head are kept in the machine's finite-state storage for this purpose.
%the two most recently consumed certificate symbols \utkanadd{and a third one that is under the certificate head, all} at once. \utkanrem{With the latest one being just under its certificate head, it keeps the previous certificate symbol} \utkanadd{It keeps these two previous certificate symbols} in its memory made available by its finite-state.
Each probabilistic branch of $V$ accepts if and only if their simulation of $M$ reaches an accept state of $M$ or its input head reaches the right end-marker without rejecting.
%It rejects otherwise, notably when the verifications fail.
$V$ accepts all $w \in A$ with probability 1 when coupled with a certificate $c_w$ describing the sub-history transitions correctly for at least $\finald+1$ rounds. Whenever $w \notin A$, a $c_w$ that describes any computation history of $M$ faithfully will lead all branches of $V$ to rejection.
Therefore, the first branch of $V$ to accept a $w \notin A$ must have been brought there by a lie regarding either a $\lsy_{d, i}$ or a $\lst_{d, i}$ before that point, which will be caught out by the branch that has direct access to the relevant state and head information (\ie, the branch that picks the \ith{i} head to trace).
%, and that branch must have been meticulously checking those claims from the certificate for that it has not yet halted.}
% \utkanrem{Any dishonest certificate trying to divert a branch to acceptance must be telling a lie regarding either a $\lsy_{d, i}$ or a $\lst_{d, i}$, and the first of those lies will be caught out by the branch that has direct access to the relevant state and head information (\ie, the branch that picks the \ith{i} head to trace),
%\utkanrem{for $i \equiv j \pmod{k}$}
% so}
As a result, all nonmembers of $A$ will be rejected with probability at least $\sfrac{1}{2^r}$.
%The $V$ described here uses its finite-state as its sole storage, only one coin for the randomness, and runs in real-time to verify an arbitrary language in $\ODFAK{2}$.
%
%
% An actual real-time automaton $V$ that knows the $\delta_{M'}$ by heart can verify memberships to $A$ starting with a coin toss to choose between the first and the second heads of $M'$, and then respectively reenacting the odd or the even part of the history whilst tracing the chosen head. With either choice, $V$ can carry out the reenactment by itself within the $\sh_i$s of its part of the history, but to advance from the end of an $\sh_i$ to the beginning of the corresponding $\sh_{i+2}$, $V$ will need an update from the certificate about the state $M'$ has arrived in and the input symbol that the other head has stopped on by the end of the corresponding $\sh_{i+1}$. This claim from the certificate is verified when the coin comes out the other way around and the other part of the history is reenacted, specifically, at the beginning of the corresponding $\sh_{i+3}$.
%
% To verify memberships to $A$ using a real-time automaton
%
% , Our verification trick will be to randomly choose between odd and even, and then
%
% We will focus on the moments at which the moving head changes.
%
% With the $M'$ established, and $Q'$ as its set of states, a proof $c(x)$ that a given input string $x$ is purportedly a member of $A$ may be as follows:
\end{proof}
%\end{delineate}
\Cref{lem:vertonfak,lem:nfaktover} constitute the proof of our main result:
\begin{theorem}\label{theorem:nfakequalsver}
$\vsri{\consX}{\consX}{\rtX} = \ONFAKLNRR{*}{1}$.
\end{theorem}
\subsection{Relationships with other subsets of $\bigcup_k \ONFAK{k}$}%Real-time verification beyond \ODFAK{2}}
\label{subsec:beyond1dfa2}
It is instructive to examine several concrete examples of languages that are real-time verifiable by constant-randomness, constant-space machines. Table \ref{table:dfa2} lists several members of the class \ODFAK{2} that are easily seen to be in \vsri{\consX}{\consX}{\rtX}, together with certificate templates for members of each example language.\footnote{We use the common alphabet $\Set{0,1,\#}$ for these languages. Note that the complements of all the languages listed in Table \ref{table:dfa2} are also in \vsri{\consX}{\consX}{\rtX}.} This is not surprising, as it turns out that $\ODFAK{2}$ is a subset of $\ONFAKLNRR{*}{1}$.
\newlength{\colpadding}
\begin{table}[H]
\caption{Certificate templates for some members of \ODFAK{2}.}\label{table:dfa2}
\centering
\aboverulesep=0ex
\belowrulesep=0ex
\renewcommand{\arraystretch}{1.42}
\setlength{\colpadding}{6pt}
\newcommand{\colstartendmultiplier}{0.7}
\begin{tabular}{@{\hspace{\colstartendmultiplier\colpadding}}L{13.95em}@{\hspace{\colpadding}} | @{\hspace{\colpadding}}L{11.75em}@{\hspace{\colpadding}} | @{\hspace{\colpadding}}C{5.3em}@{\hspace{\colstartendmultiplier\colpadding}}} \toprule
\textbf{Language} & \textbf{Archetypal member $w$} & \textbf{Certificate for $w$} \\ \midrule
\twin & $x\#x$, where $x \in \Set{0, 1}^*$ & $x$ \\ \midrule
The set of all strings containing equal numbers of 0's and 1's & $x$, where $x$ contains $m$ 0's and $m$ 1's & $1^m$ \\ \midrule
The set of all odd-length binary strings with the symbol~$\#$ at the middle position & $x\#y$, where $x, y \in \Set{0, 1}^*$ and $\abs{x}=\abs{y}$ & $1^{\abs{x}}$ \\ \midrule
$\Set{w | w \in (x\#)^+, x \in (0\cup 1)^+}$ & $(x\#)^m$, where $x \in (0\cup 1)^+$ & $(x\#)^{m-1}$ \\ \bottomrule
\end{tabular}
\end{table}
% \begin{table}[H]
% \caption{Certificate templates for some members of \ODFAK{2}.}%\label{table:dfa2}
% \centering
% \setlength{\colpadding}{8.3pt}
% \newcommand{\colstartendmultiplier}{0.2}
% \begin{tabular}{@{\hspace{\colstartendmultiplier\colpadding}}L{13.85em}@{\hspace{\colpadding}} @{\hspace{\colpadding}}L{11.55em}@{\hspace{\colpadding}} @{\hspace{\colpadding}}c@{\hspace{\colstartendmultiplier\colpadding}}} \toprule
% \textbf{Language} & \textbf{Archetypal member $w$} & \textbf{Certificate for $w$} \\ \midrule
% \twin & $x\#x$, where $x \in \Set{0, 1}^*$ & $x$ \\ \midrule
% The set of all strings containing equal numbers of 0's and 1's & $x$, where $x$ contains $m$ 0's and $m$ 1's & $1^m$ \\ \midrule
% The set of all odd-length binary strings with the symbol $\#$ at the middle position & $x\#y$, where $x, y \in \Set{0, 1}^*$ and $\abs{x}=\abs{y}$ & $1^{\abs{x}}$ \\ \midrule
% $\Set{w | w \in (x\#)^+, x \in (0\cup 1)^+}$ & $(x\#)^m$, where $x \in (0\cup 1)^+$ & $(x\#)^{m-1}$ \\ \bottomrule
% \end{tabular}
% \end{table}
%In addition to the previously mentioned , several members of the class \ODFAK{2}, like the set of all strings containing equal numbers of 0's and 1's, the set of all odd-length binary strings with the symbol $\#$ at the middle position, the language $\Set{w | w \in (x\#)^+, x \in (0\cup 1)^+}$, and their complements, are easily seen to be in \ONFAKLNRR{*}{1}.
\begin{theorem}\label{lem:1dfak2subseteq1nfaklnrr}
$\ODFAK{2} \subseteq \ONFAKLNRR{*}{1}$.
\end{theorem}
\begin{proof}
% !!!!!!!!!!SHOW $\ODFAK{2} \subseteq \ONFAKLNRR{*}{1}$.
%
Let $M = \paren{Q_M, \Sigma, \delta_M, q_0, \qacc, \qrej}$ be a \odfak{2}. At any step of its execution, $M$ might be moving none, one, or both of its heads. We can modify $M$ to obtain a \odfak{2} $M' = \paren{Q_{M'}, \Sigma, \delta_{M'}, q_0, \qacc, \qrej}$ that recognizes the same language while moving exactly one of its heads at every step, starting with the first head. With two heads moving in an alternating fashion, the resulting machine $M'$ will then also be a \onfaklnrr{2}{0} by definition (which is also a \onfaklnrr{2}{1}, again by definition). To complete the proof, the details of $M'$'s construction is as follows:
The state set of the machine $M'$ is defined as $Q_{M'} = Q_M \cup \Set{q' | q \in Q_M}$.
Each transition of $M$ that moves both heads at once is simulated by two transitions that move the two heads one after another in $M'$. Formally, for all $q, s \in Q_M$, $x, y \in \Sigma_{\bowtie}$,
if $\delta_M(q, x, y) = (s, +1, +1)$, we set $\delta_{M'}(q, x, y) = (s', +1, 0)$. Furthermore, for all $s \in Q_M$, $x, y \in \Sigma_{\bowtie}$, we set $\delta_{M'}(s', x, y) = (s, 0, +1)$.
If a transition of $M$ is stationary, \ie, is of the form $\delta_M(q, x, y) = (s, 0, 0)$, it is a member of either an infinite sequence representing a loop (of length at most $\abs{Q_M}$) in which $M$ scans the symbols $x$ and $y$ without changing the head positions, or a finite sequence ending with acceptance, rejection, or the moving of some head. In the infinite-loop case, we set the corresponding transition in $M'$ to $\delta_{M'}(q, x, y) = (\qrej, +1, 0)$.
In the finite-sequence case, the value of $\delta_{M'}(q, x, y)$ will be set to $(\qacc, +1, 0)$ or $(\qrej, +1, 0)$ if the sequence is ending with acceptance or rejection, respectively, and to the value of the final transition in the sequence otherwise.
Any transition of $M$ that moves a single head is inherited by $M'$ without modification.
It may be the case that the new machine built according to these specifications moves its second head first. This problem can be handled easily by just rearranging the transition function to effectively ``swap'' the names of the two heads.
(Such a simple swap is possible, because the fact that both heads scan the left end-marker symbol at the beginning means that it is only the transition function, and not the particular input string, that determines which head moves first.)
\end{proof}
%(???THESE EXAMPLES NEED UPDATING???)
\newcommand\LIK{\ensuremath{L_{\mathit{IK}}}}
Consider the language $\LIK=\Set{a^i b^j c^k | i=j \text{ or } i=k \text{ or } j=k}$, which is in \ODFAK{3}, but not in \ODFAK{2}~\cite{IK75}. A real-time, finite-state verifier using a single random bit can verify \LIK{} by checking certificates of the form $\sigma x^l$, where $\sigma$ is a ternary symbol that indicates which two of the three ``segments'' of the input string are claimed to be of the same length $l$. Depending on the values of $\sigma$ and the random bit, the verifier decides which segment to attempt to match with the certificate postfix $x^l$, and accepts only if this match succeeds.
More generally, for any $k>0$, there exists a language of the form
\begin{equation*}
L_n=\Set{y_1\#y_2\#\dotsm\#y_{2n} | y_i \in \Set{a,b}^{*} \text{ and } y_i = y_{2n+1-i}, \text{ for } 1 \leq i \leq n}
\end{equation*}
which can be recognized by
% multihead \dfa's that have $k$, but not by any multihead \nfa{} with fewer heads
a \odfak{k+1}, but not by any \onfak{k}~\cite{YR78}. Such a language $L_n$ can be verified by a real-time, constant-space machine using $\ceil{\log (n+1)}$ random bits to split into $n+1$ paths that would compare the relevant segments of a certificate of the form $y_1\#y_2\#\dotsm\#y_{n}$ with the corresponding input segments. So we have %$\ODFAK{k} \not\subseteq \langclass$
%$\vsri{\consX}{\consX}{\rtX} \setminus \ODFAK{k} \neq \emptyset$ and
$\vsri{\consX}{\consX}{\rtX} \setminus \ONFAK{k} \neq \emptyset$ for all $k \geq 1 $.
% \begin{equation}
% \bigcup_{k>0} \ODFAK{k} = \langclass
% \end{equation}
We now exhibit a language that is verifiable in real time by constant-random\-ness finite-state machines, but is unrecognizable by any deterministic multihead automaton.
\begin{theorem}\label{theorem:nonpal}
$\vsri{\consX}{\consX}{\rtX} \setminus \bigcup_k \ODFAK{k} \neq \emptyset$.
\end{theorem}
\begin{proof}
We will construct a verifier $V$ for the language \nonpal{}, which was noted to be outside $\bigcup_k \ODFAK{k}$ in \cref{sec:prel}.
Every string $w$ in \nonpal{} matches the pattern $x\sigma y\sigma'z$, where $x,y,z \in \Set{0,1}^*$ and $\sigma, \sigma' \in \Set{0,1}$, such that $\abs{x}=\abs{z}$ and $\sigma \neq \sigma'$. The correct certificate $c_w$ for such an input will encode the positions of the ``unmatching'' symbols $\sigma$ and $\sigma'$ as follows:
\begin{center} $c_w=0^{\abs{x}}10^{\abs{y}}$ \end{center}
$V$ tosses a single coin at the beginning of the computation to probabilistically ``branch'' to one of two ``deterministic verifiers'' $V_0$ and $V_1$, each of which checks the certificate $0^i10^j$ in a different way, as described below.
Note that, if $0^i10^j$ is indeed a correct certificate for the input, claiming that the two unmatching symbols are at positions $i+1$ and $i+j+2$, then the input string must be exactly $i+1$ symbols longer than this certificate. $V_0$ checks this by moving the certificate head only once for every two moves of the input head over the input string until it passes over the 1 in the certificate. At that point, it switches to moving the certificate head at every step as well. If the certificate is of the correct length, the two heads will consume their right end-markers simultaneously, in which case $V_0$ will accept.
The task of $V_1$ is to assume that the certificate is well-formed in the sense described above, and accept if the two symbols at positions $i+1$ and $i+j+2$ really are unequal. This can be done by moving the certificate head at the same speed as the input head, recording the symbol at position $(i+1)$ in memory, and comparing it with the input symbol scanned at the step where the certificate string has been consumed completely.
If the input is a member of \nonpal{}, both $V_0$ and $V_1$ accept with the correct certificate. % Otherwise, at least one of them will reject.
Otherwise, the input is a palindrome, and the certificate will either be malformed (and therefore be rejected by $V_0$), or the two symbols it points out will be equal, in which case it will be rejected by $V_1$.
\end{proof}
BURADAN SONRASI BİR DAHAKİ SUBSECTION BAŞINA DEK UÇSUN??????????????????????????????!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
The following characterizations in terms of zero-error verifiers are well known:
\begin{align*}
\IP{\po\spa, \ze\pri\ran, \ze\pub\ran, \po\tim} &= \NP\\
\IP{\lo\spa, \ze\pri\ran, \ze\pub\ran, \po\tim} &= \NL
\end{align*}
\begin{align*}
\NCx{i} &\subseteq \NCx{i + 1} \mathrlap{\hspace{4em}\text{for all $i \ge 1$}}\\
\NC &= \lim_{i \to \infty} \NCx{i}
\end{align*}
\begin{align*}
\IP{\lo\spa, \ze\pri\ran, \po\pub\ran, \po\tim} &= \PP\\
\IP{\lo\spa, \ze\pri\ran, \ze\pub\ran, \OH{n \log^2 n}\tim} &\supseteq \NC\\
\IP{\lo\spa, \ze\pri\ran, \lo\pub\ran} &\subseteq \LOGCFL
\end{align*}
BU SUBSECTIONUN BURADAN SONRASI HERHALDE UÇACAK AMA COPYPASTE İÇİN LAZIM OLUR DİYE ŞİMDİLİK DURSUN!!!!!!!!!!!!!!!!
When one allows nonzero error, significant gains in space usage seem to be achievable:
\begin{align*}
\vtsr{\polyX}{\logX}{\logX} &= \NP \tag*{\cite{CL95}}\\
\vsr{\consX}{\consX} &= \NL \tag*{\cite{SY14}}
\end{align*}
For verifiers using at least logarithmic space, the magnitude of the one-sided error can be reduced without significant increase in the runtime, whereas the constant-space verifiers of~\cite{SY14} (all of which have correct certificates that can be checked in polynomial time) do not seem~\cite{GS22} to have this property in general.\footnote{Note that a constant-space machine is equivalent to a finite-state automaton with no work tape, since the bounded amount of information in the work tape of a constant-space verifier can also be kept using a suitably large set of internal states.}
Say and Yakary\i{}lmaz~\cite{SY14} also considered the case where a constant-space, constant-randomness verifier is forbidden to move its input head to the left. Using their techniques, one can obtain the following characterization:
\begin{theorem}\label{thm:SY}
\begin{equation*}
\vsri{\consX}{\consX}{\owayX} = \bigcup_k \ONFAK{k}.
\end{equation*}
\end{theorem}
\begin{proof}
%Given a \onfak{k} $M$ recognizing a language $L_M$, one can construct a one-way, constant-space, constant-randomness verifier $V_M$ for $L_M$ as follows: $V_M$ expects the certificate to contain a proof of the existence of an accepting computation history (in the form of a sequence of tuples representing the state and list of symbols scanned by the heads at each step) of $M$ working on the input string. $V_M$ uses its random bits to select a head of $M$ and simulates its execution on the input, relying on the certificate for information on what symbols would be scanned by the other heads of $M$ at every step. If $V_M$ ever sees the certificate reporting that the head it is tracking is currently scanning a symbol other than the correct value, it rejects. If the input is in $L_M$, a correct certificate that carries $V_M$ to acceptance exists. Otherwise, in order to trick $V_M$ to reach an accept state, the certificate would have to ``lie'' about what is being seen by at least one of the heads of $M$ in at least one step, and $V_M$ has a constant probability of having selected that head, and therefore rejecting the input. Since $M$ can be assumed to run in linear time in all its nondeterministic branches without loss of generality, $V_M$ can also be equipped to run in linear time and reject any certificate whose length exceeds that bound.
%In the reverse direction, given a finite-state verifier $V$ with one-way input that uses at most $r$ random bits, one can build a \onfak{2^r} $M_V$ for the verified language $L_V$ as follows: $V$'s behavior on each different random bit sequence can be represented by a deterministic verifier obtained by ``hardwiring'' that particular sequence into $V$'s transition function. $M_V$ is designed to nondeterministically guess a certificate and use its heads to simulate all these $2^r$ deterministic verifiers operating on the input string and the common certificate. For each newly guessed certificate symbol, $M_V$ goes through all the deterministic verifiers, tracing each one's execution (by changing its state and possibly moving the corresponding head) until that deterministic verifier accepts, rejects, or performs a transition consuming that new certificate symbol by moving its certificate tape head. ($M_V$ can detect verifiers that are being tricked to run for too long by the certificate as described above; these verifiers are marked as having ``rejected'' and no longer simulated.) This procedure continues until either a deterministic verifier rejects, or all the $2^r$ deterministic verifiers are seen to accept. $M_V$ accepts if it arrives in a state representing all the deterministic verifiers having accepted.
Given a \onfak{k} $M$ recognizing a language $L_M$, one can construct a one-way, constant-space, constant-randomness verifier $V_M$ for $L_M$ as follows: $V_M$ expects the certificate to contain a proof of the existence of an accepting computation history (in the form of a sequence of tuples representing the nondeterministic branch taken and list of symbols scanned by the heads at each step) of $M$ working on the input string. $V_M$ uses its random bits to select a head of $M$ and simulates its execution on the input, relying on the certificate for information on what symbols would be scanned by the other heads of $M$ at every step. If $V_M$ ever sees the certificate reporting that the head it is tracking is currently scanning a symbol other than the correct value, it rejects. If the input is in $L_M$, a correct certificate that carries $V_M$ to acceptance with probability 1 exists. Otherwise, in order to trick $V_M$ to reach an accept state, the certificate would have to ``lie'' about what is being seen by at least one of the heads of $M$ in at least one step, and $V_M$ has a constant probability of having selected that head, and therefore rejecting the input. Since $M$ can be assumed to run in linear time in all its nondeterministic branches without loss of generality, any attempt by an overly long certificate to trick $V_M$ to loop without accepting will also be caught by nonzero probability.
In the reverse direction, given a finite-state verifier $V$ with one-way input that uses at most $r$ random bits,
% \utkanrem{we first ensure that its input head never goes beyond the right end-marker by replacing all the transitions instructing such ``spillover'' with transitions terminating at the appropriate final state without moving the input head. Then,}
one can build a \onfak{2^r} $M_V$ for the verified language $L_V$ as follows: $V$'s behavior on each different random bit sequence can be represented by a deterministic verifier obtained by ``hardwiring'' that particular sequence into $V$'s transition function. $M_V$ is designed to nondeterministically guess a certificate and use its heads to simulate all these $2^r$ deterministic verifiers operating on the input string and the common certificate. For each newly guessed certificate symbol, $M_V$ goes through all the deterministic verifiers one by one, tracing each one's execution (by changing its state and possibly moving the corresponding head) until that deterministic verifier accepts, rejects, is about to step beyond the right end-marker on the input tape\footnote{Whenever $M_V$ ``realizes'' that the deterministic verifier it is simulating is about to take such a step, it keeps the corresponding head in place and switches to the simulation of the next deterministic verifier in that very step.
%To realize that it is about to move its head forward (beyond the right end-marker), $M_V$ must have begun with the reading part of its next transition, whereby instead of performing what is imminent, it acts to start tracing the execution of the subsequent deterministic verifier and keeps the former head stationary on the right end-marker.
The only exception to this is the case where all but one of the deterministic verifier simulations have halted, in which case $M_V$ allows the corresponding head to ``spill over''.}
(in which case it will be interpreted as having made the same decision that it would have made at that final step), or performs a transition consuming that new certificate symbol by moving its certificate tape head.\footnote{%Since the collection of deterministic verifiers has only a fixed number of possible tuples of states,
$M_V$ can detect when a deterministic verifier enters an infinite loop that does not move any heads, and reject on such nondeterministic branches.% corresponding to unnecessarily long certificates.
}
This procedure continues until either a deterministic verifier rejects, or all the $2^r$ deterministic verifiers are
%\utkanadd{about to move their input heads beyond the right end-marker or}
seen to accept.
% \utkanadd{In the latter case, a final certificate symbol is guessed and the deterministic verifiers that have not yet accepted are simulated (with the certificate symbol if they need it) for their one last step\footnotemark{} all at once}\footnotetext{\utkanadd{Verifiers must come to a conclusion while stepping beyond the right end-marker, by definition.}}
$M_V$ accepts if it arrives in a state representing all the deterministic verifiers having accepted.
\end{proof}
%This ``one-sided'' definition is consistent with the fact~\cite{C93,CL95,ALMSS98,AS98} that the complexity class $NP$ of languages that have proof systems with polynomial-time probabilistic Turing machines as verifiers can also be defined to have the ``perfect completeness'' property, where a member of the language is never rejected, even when the verifier is restricted to use only logarithmically many random bits and logarithmically bounded space. NL and (union of all 1nfa(k) languages) also have such proof systems with appropriate restrictions on the verifier.~\cite{SY14}
!!!!!!!!!BURAYA KADAR GELDİM!!!!!!!!!!!
$\Qpri_1$ and $\Qpub_1$ denote the states in $Q_1$ that toss private and public coins, respectively, and let $\Qcom_1$ denote those that write to the communication cell. Let $\Qpri_2, \Qpub_2$, and $\Qcom_2$ denote the analogous subsets of $Q_2$.
To construct $V_2$, we start by equating all its components to the corresponding ones in $V_1$. We will modify this machine by removing the states in $\Qpub_2$ so that $V_2$ does not flip public coins, and we will add some new states in $\Qpri_2$ and $\Qcom_2$ to emulate the function of the states that are removed from $\Qpub_2$.
!!!!!AŞAĞIDAKİ PARAGRAFTA BİR SETLE COMPLEMENTİNİ Mİ KESİŞTİRİYORSUN?!BU GİBİ SORUNLARA VE AŞAĞIDAKİ TUPLE'LARDA (Utkan: YANLIS YAZMISIM, ortadaki Qpub olacakti, siralar hep Qpri-Qpub-Qcom SEKLINDE. HEPSI DUZELMIS OLMALI)
We move any state $q$ in $\qneg{\Qpri_2} \cap \Qpub_2$ (${}\cap \Qcom_2$) to instead be in $\Qpri_2 \cap \qneg{\Qpub_2} \cap \Qcom_2$, essentially making $V_2$ flip only a private coin instead of only a public coin (the outcome of which $V_2$ still communicates as if it was public). In coordination with this, we change any transition that originally comes out of $q$ as
\begin{align*}
\delta_2\paren{q,\sigma,\phi,\gamma,\bpub} &= \paren{q',\phi',\paren{\gamma',\bpub},d_i,d_w}
\shortintertext{into a transition as}
\delta_2\paren{q,\sigma,\phi,\gamma,\bpri} &= \paren{q',\phi',\paren{\gamma',\bpri},d_i,d_w}.
\end{align*}
The remaining states in $\Qpri_2 \cap \Qpub_2$ (${}\cap \Qcom_2$) entail flipping of two coins (and obtaining two random bits) in one step. A machine that flips only private coins will need two steps to obtain two random bits.
For that reason, we move any state $q$ in $\Qpri_2 \cap \Qpub_2$ (${}\cap \Qcom_2$) to instead be in $\Qpri_2 \cap \qneg{\Qpub_2} \cap \qneg{\Qcom_2}$ and make $V_2$ flip its private coin alone at first. We also introduce two more states $(q, 0)$ and $(q, 1)$ in $\Qpri_2 \cap \qneg{\Qpub_2} \cap \Qcom_2$ for $V_2$ to land right after leaving $q$ and recall its private coin outcome. There, $V_2$ will flip another private coin, communicate its outcome, and continue its execution by the outcomes of the last two coin flips. To dictate this behavior, we split any transition that leaves the state $q$ with the private coin outcome $0$,
\begin{align*}
\delta_2\paren{q,\sigma,\phi,\gamma,0,\bpub} &= \paren{q',\phi',\paren{\gamma',\bpub},d_i,d_w},
\shortintertext{into following two:}
\delta_2\paren{q,\sigma,\phi,\gamma,0} &= \paren{(q,0),\phi,0,0},\\
\delta_2\paren{(q,0),\sigma,\phi,\gamma,\bpri} &= \paren{q',\phi',\paren{\gamma',\bpri},d_i,d_w}.
\end{align*}
For completeness, we do the same for transitions that get the private coin outcome $1$, by transforming any transition
\begin{align*}
\delta_2\paren{q,\sigma,\phi,\gamma,1,\bpub} &= \paren{q',\phi',\paren{\gamma',\bpub},d_i,d_w},
\shortintertext{into}
\delta_2\paren{q,\sigma,\phi,\gamma,1} &= \paren{(q,1),\phi,0,0},\\
\delta_2\paren{(q,1),\sigma,\phi,\gamma,\bpri} &= \paren{q',\phi',\paren{\gamma',\bpri},d_i,d_w}.
\end{align*}
Since $\Qpub_2$ has become empty, $V_2$ now does not flip any public coins.
Studying machines that use a single type of coins, Dwork and Stockmeyer~\cite{DS92} have shown that finite state verifiers employing only private coins are strictly more powerful than those using only public coins. Consider the language of palindromes, $\pal = \Set{w \in \Set{0, 1}^* | w = \rev{w}}$, where $\rev{x}$ is the reverse any string $x$.
\begin{fact}\label{fact:palinconstantprivaterandomness}
$\pal \in \IP[0.9]{\co\spa, \co\pri\ran, \li\tim}$~\cite[Theorem~3.1]{DS92}.
% The language of palindromes on a binary alphabet is not verifiable by any constant\-/space machine that does not employ any private coins.
\end{fact}
% !!!!!RELEVANT FACT FROM DS92!!!BU SENİN POWEROFPRIVACY TEOREMİN, DOĞRUDAN PAL İÇİN VERMİŞLER!!!!!! Utkan: Dogru anladiysam ekledim sanirim
!!!BU NOKTADA PAYDOS EDİYORUM!!!!!! % tamamdir hocam iyi geceler diliyorum, cok tesekkurler
Trivially, $\pal \in \TNFASL$. We \utkanadd{further} recall the following facts about the power of finite\-/state verifiers at the two extreme ends of the ``public vs.\ private'' spectrum:
\begin{fact}\label{fact:palnotinpublicrandomness}
$\pal \notin \IP[0.9]{\co\spa, \infty\pub\ran, \infty\tim}$~\cite[Section~3.3]{DS92}.
% The language of palindromes on a binary alphabet is not verifiable by any constant\-/space machine that does not employ any private coins.
\end{fact}
\begin{fact}\label{fact:GS22}
$\TNFASL \subseteq \IP[0.9]{\co\spa, \co\pri\ran, \li\pex\tim}$~\cite{GS22}.\footnote{Recall from the definition of our IP complexity class notation in \Cref{sec:prel} that the verifier's runtime can be infinite with probability at most $\verrloop$, and its expected runtime is bounded as indicated with the remaining large probability.}% If one lifts the requirement that $\varepsilon$ can be pushed to be arbitrarily low, and only requires it to be below $\frac{1}{2}$, these machines can verify all languages in \NL{}~\cite{SY14}.}
\end{fact}
This \utkanadd{gives us the following theorem,} \utkanrem{shows us} that even a finite amount of private coins gives verifiers an edge that no amount of public coins can compensate: \utkanadd{
\begin{theorem}\label{thm:powerofprivacy}
\begin{equation*}
\IP[0.9]{\co\spa, \co\pri\ran, \infty\tim} \setminus \IP[0.9]{\co\spa, \infty\pub\ran, \infty\tim} \neq \emptyset.
\end{equation*}
\end{theorem}
\begin{proof}
$\pal$ is a member of the set difference by \Cref{fact:palnotinpublicrandomness,fact:GS22}.
% \qed %% LLNCS ONLY
\end{proof}
We will now examine the effects of allowing increasing amount of public coin budgets to finite\-/state verifiers with constant private randomness, and compare them against well known classes of complexity.
At the lowest level, we have \Cref{fact:GS22} for the verifiers that do not use any public coins and have a low verification error. Provisioning the same amount of resources while allowing high error leads to the following characterization for \NL{} (languages decidable by nondeterministic Turing machines using logarithmic space) is known against the verifiers that do not have any public coins.
\begin{fact}\label{fact:SY14}
$\IPhigh[0.9]{\co\spa, \co\pri\ran, \infty\tim} = \NL$~\cite{SY14}.
\end{fact}
\begin{corollary}
For any $f(n)$ and $g(n)$ such that $\OH{f(n)} \supseteq \OH{n}$ and $\OH{g(n)} \supseteq \OH{n}$,
\begin{multline*}
\IP[0.9]{\co\spa, \OH{f(n)}\pri\ran, \OH{g(n)}\tim} =\\
\IP[0.9]{\co\spa, \li\pri\ran, \li\tim}.
\end{multline*}
The same is true also for the high error variants of the two classes.
\end{corollary}
\begin{proof}
\Cref{thm:strictboundislinear} covers for the stricter preconditions for $f(n)$ here. So, we know that
\begin{multline*}
\IP[0.9]{\co\spa, \OH{f(n)}\pri\ran, \OH{g(n)}\tim} =\\
\IP[0.9]{\co\spa, \OH{f(n)}\pri\ran, \li\tim}.
\end{multline*}
Since a machine cannot use any resource more than its runtime, the corollary statement follows.
\end{proof}
\utkanrem{For any input not in $L$, $V_3$ can accept only if $P_3$ claims that $V_2$ accepts in all $m$ rounds.
%\utkanrem{narrations are ending}
Such a claim can either be true, since $V_2$ can genuinely accept such a string with probability at most $\varepsilon_1$; or false, in which case $P_3$ would be ``lying'', \ie, providing false information that could be detected when compared against the actual readings of at least one of $V_2$'s heads.
Let $p_{\min} = \min_{i=1}^k p_i$. The probability of $V_3$ failing to catch such a lie in any round is at most $1 - p_{\min}$. It follows that the probability that $V_3$ accepts a string not in $L$ is}
\begin{equation*}
\verrrej_3 \le \max\paren*{\varepsilon_1, \paren*{1 - p_{\min}}}^m.
\end{equation*}
% So long as $p_{\min}$ is positive,\footnote{Setting $\psimulation = 0$ forces $p_{\min}$ to be also 0, which is why one should avoid going that far.} one can reduce $\varepsilon_3^-$ arbitrarily to any positive constant by increasing $m$.
\utkanrem{The last kind of verification error for $V_3$ is getting tricked into running forever by an evil prover when given a non\-/member input string. The probabilistic timer function, when in play with probability $\ptimer$, will keep $V_3$ from running forever. The probability of $V_3$ looping on the \ith{i} round of its verification is at most $\max\paren*{\varepsilon_1, \paren*{1 - p_{\min}}}^{i-1} \cdot \psimulation$ (since it should pass the first $i - 1$ rounds without rejecting in that case). The probability that $V_3$ can be fooled to loop is at most the sum of those probabilities, \ie,}
\begin{equation*}
\verrloop_3 \le \psimulation \cdot \textstyle\sum_{i=0}^{m-1} \max\paren*{\varepsilon_1, \paren*{1 - p_{\min}}}^i.
\end{equation*}
% Executing on non\-/member input strings, the probabilistic timer function of $V_3$ ensures that the probability of $V_3$ being tricked into running forever by an evil prover that supplies wrong readings for some heads of $V_2$ is at most $\psimulation$. Lowering this down to a desired small positive constant is compatible with our means of lowering $\varepsilon_3^+$.
\utkanrem{The overall error bound of $V_3$ is the maximum of all three, \ie,}
\begin{equation*}
\verr_3 = \max\paren*{\verracc_3, \verrrej_3, \verrloop_3}.
\end{equation*}
\utkanrem{Since all of these bounds can be lowered arbitrarily to any positive constant (by first increasing $m$ to constrain $\varepsilon_3^-$, and then decreasing $\psimulation > 0$ and $\errprematuretimeout > 0$ to constrain the other two), $\varepsilon_3$ can also be lowered to any desired positive constant.}
\subsection{Debate systems}\label{subs:deb}
!!!!!!!!!BU SUBSECTION BİR SONRAKİ TURDA UÇACAK HERHALDE; ŞİMDİLİK DURSUN!!!!!!!
A \emph{debate system}~\cite{DSY15} for some language $L$ consists of a probabilistic Turing machine (``the verifier'') checking the transcript of a dialogue between two entities (named ``the prover'' and ``the refuter'') on whether a common input string $w$ is a member of $L$. The prover in a debate system plays the same role as its namesake in interactive proof systems; namely, it can be viewed as trying to convince the verifier to accept $w$. The refuter has the opposite aim. Unlike what we have in the IPS setup, the verifier in a debate system is always silent, \ie, it does not send any information to either the prover or the refuter at any time, and all of its coin outcomes are private. The prover and the refuter take turns in sending symbols to each other, and the concatenation of these symbols form the (possibly infinitely long) string called ``the debate'', which sits on a separate tape that the verifier accesses with a read\-/only head.
Language $L$ is said to have \emph{debates checkable with error} $\err$ if there exists a verifier $V$ such that
\begin{itemize}
\item for every $w \in L$, the prover is able to ``win'' (\ie, emit symbols so that, no matter what symbols are emitted by the refuter, the verifier halts by acceptance for the resulting debate on $w$) with probability at least $1-\err$;
\item for every $w \notin L$, the refuter is able to win (\ie, emit symbols so that, no matter what symbols are emitted by the prover, the resulting debate on $w$ leads the verifier to halt by rejection) with probability at least $1-\err$.
\end{itemize}
Demirci et al.~\cite{DSY15} studied the classes of such ``debatable'' languages under various resource restrictions on the underlying verifiers. Adapting their notation, let \CDEBhigh{\restrictionformat{resource}_1, \restrictionformat{resource}_2, \dotsc, \restrictionformat{resource}_k}%\footnote{\utkanadd{The ``\langclassformat{C}'' in \CDEBhighlabel{} stands for \emph{complete}, indicating that the refuter sees every message the prover sends.}}
denote the class of languages that have debates
checkable with some error probability $\err < \sfrac{1}{2}$, such that the verifier of the debate
operates within the indicated resource bounds. In the following, we shall use the following fact, proven in~\cite{DSY15}.
\begin{fact}\label{fact:debinp}
$\CDEBhigh{\co\spa, \co\pri\ran, \infty\tim} = \PP$.
\end{fact}
Debate systems where the verifier is a deterministic finite\-/state automaton are closely associated with two\-/way alternating finite automata~\cite{LLS78}: Each non-halting state in such a machine is either \emph{existential} or \emph{universal}. One can view a ``prover'' as dictating which move to make when the transition function allows multiple outgoing choices from a configuration with an existential state, and a ``refuter'' can be seen as similarly dictating moves from configurations with universal states. The input string $w$ is accepted by the machine if and only if the prover has a winning strategy, %\utkanadd{???!!! ``PERFECT INFORMATION'' NEDIR???!!! it's a well known property of some games, bizim complete dediğimiz şeye benziyor!!! DETERMINISTIK MI?}
whereby it can lead the machine from the initial configuration associated with $w$ to an accepting configuration, no matter what moves are made by the refuter, in this perfect information game. We say that the machine \emph{recognizes} the set of strings that it accepts.
\begin{fact}\label{fact:TAFAequalsREG}
Two-way alternating finite automata recognize all and only the regular languages.~\cite{LLS78}
\end{fact}
\begin{lemma}\label{lem:dir2}
%\begin{multline*}
$\IP[0.9]{\co\spa, \co\pri\ran, \po\pex\pub\ran, \po\pex\tim}\subseteq \PP$.%\\
%\IP[0.9]{\lo\spa, \po\pub\ran, \po\tim}.
%\end{multline*}
% More specifically, for any integer $t > 1$,
%\begin{multline*}
% \IP[0.9]{\co\spa, \co\pri\ran, \OH{n^t}\pex\pub\ran, \OH{n^t}\pex\tim}\subseteq\\
% \IP[0.9]{\lo\spa, \OH{n^{t+1}}\pub\ran, \OH{n^{t+1}}\tim}.
%\end{multline*}
\end{lemma}
\begin{proof}
Let $V_1$ be a (single\-/head) constant\-/space verifier that uses at most $r$ private coins and an unlimited budget of public coins to verify a language $L$, for some constant $r$. The three types of errors that $V_1$ may commit are that
\begin{itemize}
\item it might reject a member of $L$ when communicating with an honest prover with some probability $\verracc_1$,
\item it might be tricked to accept a non\-/member of $L$ with some probability $\verrrej_1$,
\item it might be tricked to run forever when the input is not a member of $L$ with some probability $\verrloop_1$.
\end{itemize}
When it is not running forever (\ie, with probability $1-\verrloop_1$), $V_1$ is expected to terminate in $f_1(n) \in \OH{n^t}$ steps where $t > 1$ is an integer. In the following, the prover that $V_1$ interacts with will be named $P_1$.
% Let $V_1$ be a (single\-/head) constant\-/space verifier that uses at most $r$ private coins and an unlimited budget of public coins to verify a language $L$, for some constant $r$. $V_1$ may run forever with some small probability $\errloop$; excluding those cases, it runs in expected time $f_1(n) \in \OH{n^t}$ where $t > 1$. In the following, the prover that $V_1$ interacts with will be named $P_1$.
A constant\-/space public\-/coin $\paren*{2^r+t}$\=/head verifier $V_2$ can verify $L$ in polynomial time and with an error bound close to that of $V_1$ as follows: $V_2$ will run $2^r$ parallel simulations (``sims'') of $V_1$, where the \ith{i} sim $S_i$ (for $i \in \Set{0, \dotsc, 2^r - 1}$) assumes its private random bits as the bits of the binary representation of the number $i$ and uses the \ith[st]{\paren*{i+1}} head of $V_2$. The prover that $V_2$ interacts with, which we name $P_2$, is supposed to mimic $P_1$ by providing a $2^r$\=/tuple containing the symbols that $P_1$ would send to each $S_i$ at each step.
At every step of its interaction, $V_2$ performs the following three tasks:
\begin{itemize}
\item
It checks the communication symbol received from $P_2$ to see if it is consistent with the simulated interaction that took place up to that point between $P_1$ and the sims (as will be detailed below), rejecting otherwise.
\item
It updates the simulated state information and moves the head corresponding to each sim in accordance with $V_1$'s transition function, the latest public coin outcome, the input symbol scanned by the corresponding head and the communication symbol received from $P_2$ addressed to that sim.
\item
It sends $P_2$ a $2^r$\=/tuple containing the communication symbols emitted by all the sims at the present step.
\end{itemize}
The consistency check mentioned above is necessary for the following reason: Consider two distinct sims which correspond to two probabilistic paths that emit precisely the same sequence of communication symbols up to a certain point during an interaction of $V_1$ with $P_1$. Since $P_1$ is unable to determine which of these two paths it is talking to at that point, it cannot send different communication symbols to these sims. $V_2$ is supposed to check that $P_2$ respects this condition, and never sends different symbols to two sims whose communications have been identical since the beginning of the interaction. $V_2$ can keep track of subsets of such similar\-/looking sims in its finite memory to implement this control at every step.
% The remaining $\ceil*{t}+1$ heads will be used to observe an \OH{n^{\ceil*{t}+1}} runtime limit.
% In order to accept its input string, $V_2$ will expect its own prover, $P_2$, to convince it that $P_1$ would have managed to convince $V_1$ about this input. $P_2$ will attempt to achieve this by demonstrating that $P_1$ would be able to convince a majority of the sims to accept.
% At every step of the interaction, the prover that $V_2$ interacts with (which we will name ``$P_2$'') communicates a symbol that is a $2^r$\=/tuple which is supposed to contain, for each $i$, the symbol that $P_1$ would put in the communication cell at this point if it were interacting with $S_i$.
$V_2$ uses its remaining $t$ heads to implement
% \utkanadd{(SY14'TE BUNUN ISPATI VAR MI? FACT 2.3'UN TEMELINDE YATIYOR AMA ORADA ISPAT YOK. BELKI BASKA BIR YERINDE VARDIR. GS22'DE OLMALI)}SY14'te yapılabilir diye bahsediliyor galiba,GS22'DE VARSA ONA REF VER!!!!!!!!!!!!!!!!!!!!
a deterministic clock that runs for $f_2(n) = c{n^{t}}$ steps (where $c$ is a positive integer whose value ensures that $f_2(n)\gg f_1(n)$, and determines the error committed by $V_2$, as will be described below) in
the background.\footnote{See~\cite[Lemma~3]{GS22} for an explanation of how such a clock can be constructed for any desired value of $c$.}
% parallel to the rest of the verification procedure described.
% $V_2$ makes its decision when this clock times out.
% \footnote{To be precise: $V_2$ will decide upon the membership of finitely many strings that are at most $n_0$ symbols long by using a lookup table embedded into its finite\-/state memory. For the remaining longer inputs, it will run its clock for $c \cdot n^{\ceil*{t}}$ steps, where $n_0$ and $c$ are any two integer constants that satisfy $f_1(\bar{n}) \le c \cdot \bar{n}^{\ceil*{t}}$ for all $\bar{n} \ge n_0$, which should exist by the definition of big\=/\justOH{} notation.}
% The clock is set so that $f_2(n) > c \cdot f_1(n)$ is true for all $n$, for some constant $c$ that can be increased to reduce the error due to premature termination of simulations, arbitrarily.
% At every step of its interaction with $P_2$, $V_2$ performs two other tasks simultaneously:
% \begin{itemize}
% \end{itemize}
% After the
% %$\OH{n^{\ceil*{t}+1}}$ time is up,
% clock times out,
$V_2$ makes its decision when the clock times out by picking one of the sims at random with equal probability by the result of $r$ public coin tosses. It accepts if the chosen sim has accepted on time, and rejects otherwise.
% $V_2$ accepts whenever it detects a majority of the sims has accepted, and rejects whenever a majority of the sims is seen to have rejected.
% BURADAN SONRASI SENİN VERSİYONUN!!!!!!!!!!!!!!!!!!!
% A constant\-/space public\-/coin $2^r$-head verifier $V_2$ can verify $L$ by simulating $V_3$ as follows:
% \begin{turingenum}
% \item Initialize $2^r$ simulations of $V_3$, where the \ith{i} simulation will assume its private random bits as the bits of the binary representation of the number $i$, for $i \in \Set{0, \dotsc, 2^r - 1}$.
% \item Initialize the simulated communication cell content $\gamma$ with $\blanksymb$.?????????VERIFIER BİR ŞEY YAZMIYOR Kİ????
% \item Repeat the following until all the simulations of $V_3$ reaches a conclusion:!!!!!!!!!!!!!!!!!
% \bitem{Flip a public coin and store the outcome as $\bpub$.}
% \bitem{Do the following for all $i \in \Set{0, \dotsc, 2^r - 1}$:}
% \bbitem{Advance the \ith{i} simulation of $V_3$ from where it was left off for one step using the \ith{(i + 1)} (ST MI OLMALI?) head of $V_2$ as the input head of the simulated $V_3$, providing $\gamma$ and $\bpub$ as the content of the simulated communication cell and the simulated public random bit, respectively.}
% \bitem{Update $\gamma$ with the contents of the communication cell.}
% \item \Accept{} if the majority of simulations accept. \Reject{} otherwise.
% \end{turingenum}
% YİNE BENİM VERSİYONUMA GEÇİYORUZZZZZZZZZZZZ!!!!!!!!!!!!!
%From an external point of view, the only apparent difference between the interactions of $V_1$ and $V_2$ is their runtime (and its consequences).
$V_2$ is not able to carry out a ``perfect'' simulation of $V_1$ (with identical acceptance and rejection probabilities) because of the strict bound on its runtime. This causes $V_2$'s decisions to differ from those of $V_1$ in the following two ways:
\begin{differences}
\item\label{diff:longrun} $V_1$ has a nonzero probability of accepting some inputs after running for more than $f_2(n)$ steps, whereas $V_2$ rejects in branches of its simulation corresponding to such cases.
\item\label{diff:loop} $V_2$ rejects and halts on each branch of its simulation corresponding to cases where $V_1$ is tricked to run forever.
\end{differences}
Let $\verracc_2$ and $\verrrej_2$
%, and $\verrloop_2$
be the counterparts in $V_2$ of the errors $\verracc_1$ and $\verrrej_1$,
%and $\verrloop_1$ of $V_1$
respectively. ($V_2$ cannot be fooled into looping, so we do not have to worry about that type of error.)
Let us analyze how the two differences described above affect the errors of $V_2$ compared to those of $V_1$.
$\verrrej_2$ is at most $\verrrej_1$,
%It might be less due to \Cref{diff:longrun}; the input string accepted by $V_1$ after a long run might have been accepted erroneously so, which $V_2$ will be rejecting because of the time limit.
since none of the differences between $V_2$ and $V_1$ can cause an increase in an acceptance probability.
$\verracc_2$ is greater than $\verracc_1$ by the probability that $V_1$ runs longer than $f_2(n)$ steps and then accepts.
%, due to \Cref{diff:longrun}. This probability is limited by that of halting after running for longer than $f_2(n)$ steps.
By definition, the expected runtime of $V_1$ is $f_1(n)$ when it is not running forever (\ie, with probability $1-\verrloop_1$). By Markov's inequality, the probability that $V_1$ runs for more than $f_2(n)$ steps when it is not running forever is at most $\sfrac{f_1(n)}{f_2(n)}$. This difference can be reduced by increasing
%the leading coefficient of $f_2(n)$,
$c$, thus bringing $\verracc_2$ arbitrarily close to $\verracc_1$, and proving our claim that the overall error bound of $V_2$ is close to that of $V_1$.
% There is only
% one
% %the following
% difference between the interactions of $V_1$ and $V_2$ with their respective provers:
% %, when the two IPSs are examined as black\-/boxes:
% The runtime of $V_2$ is sharply limited by $f_2(n)$. $V_1$, on the other hand, can run forever with probability $\verrloop_1$. Although $V_1$ has an expected runtime of
% %otherwise is expected to finish in
% $f_1(n)$ steps, it may take longer than even $f_2(n)$ with some probability \errpremature{}.
% $V_2$ considers the looping sims as rejecting, which is an improvement on its error bound over $V_1$'s by up to $\verrloop_1$. However, $V_2$ considers the sims taking longer than $f_2(n)$ as rejecting as well, despite they might be headed towards acceptance, which amounts to an increase in its error bound over $V_1$'s by up to \errpremature.
% To keep \errpremature{} low, an arbitrarily large constant $c$ is selected, and the timer function of $V_2$ is accordingly expedited to ensure $f_2(n) > c \cdot f_1(n)$ for all $n$.
% This forces \errpremature{} to be less than $\sfrac1c$, since otherwise the analysis of $V_1$'s expected runtime (excluding the cases where it is looping) would yield a function greater than $f_1(n)$.
% % Given that the expected runtime of $V_1$ is $f_1(n)$ when it is not looping, \errpremature{} then has to be at most $\sfrac1c$ (since otherwise the expected runtime had to be higher).
% The probability of $V_2$ running for any longer than that limit is small, and
% $V_2$ and $P_2$ emulate the interaction of $V_1$ and $P_1$ with one important exception: Recall that $V_1$ may be tricked by $P_1$ into running forever with a very small probability $\varepsilon$ for some inputs. $V_2$ has a strictly limited runtime of $\OH{n^{\ceil*{t}}}$ steps, which eliminates the probability of looping. The negligible and redeemable trade\-/off is that the decision error of $V_2$ is increased by up to $\varepsilon$. %\utkanadd{limiting the runtime of $V_2$ with \OH{n^{\ceil t}} strictly}.
% ŞİMDİKİ OKUYUŞUMDA ŞU CÜMLENİN NE İŞE YARADIĞINI ANLAMADIM. ZATEN ÖNCEKİ CÜMLEDE WORSTCASE $n^t$DİR DEDİK; BUNA NE GEREK VAR?????????? \utkanadd{[1, n) KAT DAHA İYİ BİR ZAMAN SINIRI (+) AMA HEP GEÇERLİ DEĞİL (-) VE DE SADECE EXPECTED (-). GEREKLİ OLMAYABİLİR. ESKİDEN WORST CASE SINIRIMIZ $n^{\ceil t + 1}$'Dİ, O ZAMAN BELKİ DAHA KIYMETLİYDİ}
% \utkanadd{Furthermore,} since $\varepsilon$ is small, the expected runtime of $V_2$ is almost the same as that of $V_1$, which is \OH{n^t}.
We now demonstrate the existence of $V_3$, a standard public coin log\-/space verifier with a single input head that verifies the same language.
The naive way of simulating a multi\-/head machine by a logarithmic space machine is rather straightforward. Specifically, $V_3$ can keep $V_2$'s head indices in multiple tracks of its work tape in binary format. (To accommodate for $2^r + t$ tracks in the work tape, $V_3$ should use a work tape alphabet of size $2^{2^r + t}$.) In each simulated transition of $V_2$, to decipher what $V_2$ is reading with its $2^r + t$ heads, $V_3$ will carry out the following steps:
\begin{turingenum}
\item Move the input head to $\lend$.
\item Do the following for all $i \in \Set{1, \dotsc, 2^r + t}$:
\bitem{Decrement the index on the \ith{i} track of the work tape and move the input head to the right. Repeat this until the index becomes $0$.}
\bitem{Register the symbol under the input head as $x_i$.}
\bitem{Increment the index on the \ith{i} track of the work tape and move the input head to the left. Repeat this until the head is reading $\lend$.}
\end{turingenum}
Having learned the symbols $x_1, \dotsc, x_{2^r + t}$ scanned by the simulated $V_2$'s heads, $V_3$ can use the latest public coin flip and consult the communication cell to complete a simulated transition of $V_2$, updating the work tape contents to reflect the new head positions of $V_2$ by incrementing or decrementing the indices on the respective tracks.
% \utkanrem{in a manner analogous to the algorithm above}. BU PARAGRAFTA YAPTIKLARIM DOĞRU MU??????????????????????
Note that the matching prover, $P_3$, which is supposed to send the messages that $P_2$ would be sending for each simulated step, %\utkanrem{sends blank symbols}
will send ``filler'' symbols (all of which will be ignored by $V_3$) through the communication cell while it waits for $V_3$ to complete these walks on its work tape. $V_3$ accepts the input only if it is convinced that $V_2$ accepts the same as a result of this interaction.
$V_3$'s runtime is simply the runtime of $V_2$ multiplied by the overhead of simulating multiple input heads within the logarithmic work tape.
Counting from $0$ to $n$ (or down from $n$ to $0$) in binary takes \OH{n} time for a Turing machine by amortized analysis. Incrementing or decrementing binary numbers with $\ceil*{\log n}$ digits takes \OH{\log n} time.
%PARDON; BURADA log n RAKAMLI BINARY SAYILAR DA MI VAR???? WORKTAPE HEAD'i SEMBOLİZE EDEN HEAD'in INDEXİ Mİ??? \utkanadd{TAM ANLAYAMADIM, $V_2$'NİN KAFA İNDEKSLERİNİ $\log n$'LİK BINARY SAYILARDA TUTUYORUZ. $V_2$'NİN NE OKUDUĞUNU DEŞİFRE ETME AŞAMASI $0$'dan $n$'e SAYMAYI GEREKTİRİYOR, ÇOKÇA DEFA. HEPSİ DEŞİFRE EDİLDİKTEN SONRA NE SİMÜLASYONDA TRANSITION YAPACAĞIMIZI ANLIYORUZ. SONRA SİMÜLASYON KAFALARINI (WORK TAPE'TEKİ İNDEKSLERİ) OYNATIYORUZ (ARTTIRIP AZALTIYORUZ)}
As a result, using the naive method of simulation explained above, $V_3$ is expected to run in \OH{n^{t+1}} time.\footnote{$V_3$ can be improved by introducing $2^r + t$ logarithmically\-/long caches in the memory, one for each head of the simulated $V_2$, each containing the slice from the input string where the corresponding head resides at that time. This slightly more advanced way of simulating multiple heads using logarithmic space~\cite{GS22} would save $V_3$ a factor of $\OH{\log n}$ in runtime.}
We conclude the proof by noting that the language $L$ verified by $V_3$ is in $\PP$, due to the fact that
\begin{equation*}
\IP{\lo\spa, \po\pub\ran, \po\tim}\subseteq \PP,
\end{equation*}
% $\IP[0.9]{\lo\spa, \po\pub\ran, \po\tim}\subseteq \PP$,!!!!!!BUNU ORTALAYIP SONRAKİ SATIRI SOLA YASLA PLZ!!!!!! Utkan: yaptim
which was proven~\cite{con89} by Condon.
%\\
%.
%
% \utkanadd{Using some more tracks in its log\-/space, $V_3$ can time its run and ensure that it does not run for more than the necessary polynomial amount. AMA BUNUN DA BIR OVERHEAD'I VAR. ACABA $V_2$'NIN TIMER KAFALARINI DA TAKIP EDIVERSEK MI? HEM ZATEN LOG-SPACE'TE DOGRUDAN POLY-TIMER YAPARKEN TUTTUGUMUZ SAYILARLA $V_2$'NIN TIMER KAFALARININ INDEKSLERI BIREBIR AYNI}
% \qed %% LLNCS ONLY
\end{proof}
\utkanadd{
Finally, it remains to show that $f_2(n) \in 2^{2^{\OHMEGA{n}}}$ steps of runtime budget for each sim's entire simulation will suffice for $V_2$ to attain an error bound close to that of $V_1$. Observe that the divergence between the error bounds of $V_1$ and $V_2$ stems entirely from the following differences between the two verifiers:
\begin{differences}
\item\label{diff:longrun} For the branches of $V_1$ that reject after running for more than $f_2(n)$ steps, the corresponding branches of $V_2$'s simulation instead times out and accepts.
\item\label{diff:loop} For the branches of $V_1$ that loop indefinitely, the corresponding branches of $V_2$'s simulation instead times out and accepts.
\end{differences}
% In the meantime, it be verifying the following:
% \begin{itemize}
% \item $P_2$ must provide symbols based solely on the respective sim's messages (despite them not being relayed to $P_2$) and the public coin outcomes so far. $V_2$ will reject if this is not satisfied.
% \item Each sim must ask for an interaction with the prover in at most $l(n) = \abs{Q_1} \cdot \paren*{n + 2}$ steps where $Q_1$ is the state set of $V_1$. Sims offending this restriction must have repeated a configuration in complete autonomy, therefore are destined to loop forever. They will be considered as rejected (and will not be simulated any further).
% \item Each sim must ask for a public coin flip after making at most $p(n) = l^{2^r}(n)$ interactions with the prover. Sims offending this will be considered as rejected.
% \end{itemize}
}
% \utkanremlong{
% We will now design a multihead verifier $V_2$ to verify the same language $L$ with an error bound close to that of $V_1$ without using any private coins. $V_2$ will have a constant space bound and an unlimited budget of public coins. Its expected runtime will be within $2^{2^{\OHMEGA{n}}}$.!!!!!!! SIPSER BÖYLE HALLERDE BİG-O'YU EXPONENT'İN ÖNÜNE KOYUYOR. BU GÖZLE BİR DAHA GÖZDEN GEÇİR LÜTFEN!!!!!!! \utkanadd{Utkan: ben bu notasyonu pek iyi anlamiyorum ama dediginiz gibi yaptim, cunku CL05/theorem6.1'de de yukarida yazilmis ve sanirim bu iki sinif farkliymis.}
% The details of $V_2$'s operation are given below.
% $V_2$ will use $2^r$ of its heads to run $2^r$ parallel simulations (``sims'') of $V_1$, where the \ith{i} sim $S_i$ (for $i \in \Set{0, \dotsc, 2^r - 1}$) employs the \ith[st]{\paren*{i+1}} head of $V_2$ and is hardwired to use the bits of the binary representation of the number $i$ as its private random bits. The prover that $V_2$ interacts with, which we name $P_2$, is supposed to mimic $P_1$ by providing a $2^r$\=/tuple containing the symbols that $P_1$ would send to each $S_i$ at each step.
% At every step of its interaction, $V_2$ performs the following three tasks:
% \begin{itemize}
% \item
% It checks the communication symbol received from $P_2$ to see if it is consistent with the simulated interaction that took place up to that point between $P_1$ and the sims (as will be detailed below), rejecting otherwise.
% \item
% It updates the simulated state information and moves the head corresponding to each sim in accordance with $V_1$'s transition function, the latest public coin outcome, the input symbol scanned by the corresponding head and the communication symbol received from $P_2$ addressed to that sim.
% \item
% It sends $P_2$ a $2^r$\=/tuple containing the communication symbols emitted by all the sims at the present step.
% \end{itemize}
% The consistency check mentioned above is necessary for the following reason: Consider two distinct sims which correspond to sequences of private coins which cause $V_1$ to emit precisely the same sequence of communication symbols up to a certain point during their interactions with $P_1$. Since $P_1$ is unable to determine which of these two paths it is talking to at that point, it cannot send different communication symbols to these sims. $V_2$ is supposed to check that $P_2$ respects this condition, and never sends different symbols to two sims whose communications have been identical since the beginning of the interaction. $V_2$ can keep track of subsets of such similar\-/looking sims in its finite memory to implement this control at every step.
% % The remaining $\ceil*{t}+1$ heads will be used to observe an \OH{n^{\ceil*{t}+1}} runtime limit.
% % In order to accept its input string, $V_2$ will expect its own prover, $P_2$, to convince it that $P_1$ would have managed to convince $V_1$ about this input. $P_2$ will attempt to achieve this by demonstrating that $P_1$ would be able to convince a majority of the sims to accept.
% % At every step of the interaction, the prover that $V_2$ interacts with (which we will name ``$P_2$'') communicates a symbol that is a $2^r$\=/tuple which is supposed to contain, for each $i$, the symbol that $P_1$ would put in the communication cell at this point if it were interacting with $S_i$.
% In between every simulation step, $V_2$ checks on a virtual counter.
% % \utkanadd{(SY14'TE BUNUN ISPATI VAR MI? FACT 2.3'UN TEMELINDE YATIYOR AMA ORADA ISPAT YOK. BELKI BASKA BIR YERINDE VARDIR. GS22'DE OLMALI)}SY14'te yapılabilir diye bahsediliyor galiba,GS22'DE VARSA ONA REF VER!!!!!!!!!!!!!!!!!!!!
% This counter is realized through the checks itself. It ticks every time it is checked, and is designed to run out after an expected amount of $f_2(n) \in 2^{2^{\OHMEGA{n}}}$ ticks. $V_2$ uses $t$ more heads, in addition to the ones dedicated for the sims, in the operation of this check. Details on the operation is given in \Cref{sec:dir2appendices}.
% % $c$ also determines the error committed by $V_2$, as will be described below.
% % parallel to the rest of the verification procedure described.
% % $V_2$ makes its decision when this clock times out.
% % \footnote{To be precise: $V_2$ will decide upon the membership of finitely many strings that are at most $n_0$ symbols long by using a lookup table embedded into its finite\-/state memory. For the remaining longer inputs, it will run its clock for $c \cdot n^{\ceil*{t}}$ steps, where $n_0$ and $c$ are any two integer constants that satisfy $f_1(\bar{n}) \le c \cdot \bar{n}^{\ceil*{t}}$ for all $\bar{n} \ge n_0$, which should exist by the definition of big\=/\justOH{} notation.}
% % The clock is set so that $f_2(n) > c \cdot f_1(n)$ is true for all $n$, for some constant $c$ that can be increased to reduce the error due to premature termination of simulations, arbitrarily.
% % At every step of its interaction with $P_2$, $V_2$ performs two other tasks simultaneously:
% % \begin{itemize}
% % \end{itemize}
% % After the
% % %$\OH{n^{\ceil*{t}+1}}$ time is up,
% % clock times out,
% $V_2$ will toss several public coins while it is checking on its counter. By our definition, this will oblige $V_2$ to get in an unneeded interaction with its prover. To skip over this obligation, while doing a check, $V_2$ will communicate ``filler'' symbols to $P_2$ and ignore the symbols it receives.
% $V_2$ iterates sims until the counter runs out, pausing the sims that halted early on. As the counter runs out, $V_2$ makes its decision by picking one of the sims at random with equal probability by the result of $r$ further public coin tosses. It rejects if the chosen sim has rejected (within the allotted time), and accepts otherwise.
% % $V_2$ uses its remaining $t$ heads to implement a probabilistic clock that is expected to run for $f_2(n) \ge 2^{p\paren*{n}} \cdot 2^{2^{p\paren*{n}}}$ steps in the background, where $p(n) = c \cdot n^t$, $t$ to be selected as no less than $2$, and $c$ is a positive integer whose value ensures that $p(n) \ge l(n)$ and consequently $f_2(n) \ge f_1(n)$ (recalling that $f_1(n) = k^2 \cdot 2^{2^{l(n)}}$) for large values of $n$. $V_2$ makes its decision when the clock times out by picking one of the sims at random with equal probability by the result of $r$ public coin tosses. It accepts if the chosen sim has accepted on time, and rejects otherwise.
% % $V_2$ accepts whenever it detects a majority of the sims has accepted, and rejects whenever a majority of the sims is seen to have rejected.
% % BURADAN SONRASI SENİN VERSİYONUN!!!!!!!!!!!!!!!!!!!
% % A constant\-/space public\-/coin $2^r$-head verifier $V_2$ can verify $L$ by simulating $V_3$ as follows:
% % \begin{turingenum}
% % \item Initialize $2^r$ simulations of $V_3$, where the \ith{i} simulation will assume its private random bits as the bits of the binary representation of the number $i$, for $i \in \Set{0, \dotsc, 2^r - 1}$.
% % \item Initialize the simulated communication cell content $\gamma$ with $\blanksymb$.?????????VERIFIER BİR ŞEY YAZMIYOR Kİ????
% % \item Repeat the following until all the simulations of $V_3$ reaches a conclusion:!!!!!!!!!!!!!!!!!
% % \bitem{Flip a public coin and store the outcome as $\bpub$.}
% % \bitem{Do the following for all $i \in \Set{0, \dotsc, 2^r - 1}$:}
% % \bbitem{Advance the \ith{i} simulation of $V_3$ from where it was left off for one step using the \ith{(i + 1)} (ST MI OLMALI?) head of $V_2$ as the input head of the simulated $V_3$, providing $\gamma$ and $\bpub$ as the content of the simulated communication cell and the simulated public random bit, respectively.}
% % \bitem{Update $\gamma$ with the contents of the communication cell.}
% % \item \Accept{} if the majority of simulations accept. \Reject{} otherwise.
% % \end{turingenum}
% % YİNE BENİM VERSİYONUMA GEÇİYORUZZZZZZZZZZZZ!!!!!!!!!!!!!
% %From an external point of view, the only apparent difference between the interactions of $V_1$ and $V_2$ is their runtime (and its consequences).
% $V_2$ is not able to carry out a ``perfect'' simulation of $V_1$ (with identical acceptance and rejection probabilities) because it has a bounded expected runtime. This causes $V_2$'s decisions to differ from those of $V_1$ in the following two ways:
% \begin{differences}
% \item\label{diff:longrun} For the branches of $V_1$ where it rejects after running for more than $f_2(n)$ steps, the corresponding branches of $V_2$ times out and accepts instead.
% % $V_1$ has a nonzero probability of rejecting some inputs after running for more than $f_2(n)$ steps, whereas $V_2$ accepts in branches of its simulation corresponding to such cases.
% \item\label{diff:loop} For the branches of $V_1$ where it is tricked to run forever, the corresponding branches of $V_2$ again times out and accepts instead.
% % $V_2$ accepts and halts on each branch of its simulation corresponding to cases where $V_1$ is tricked to run forever.
% \end{differences}
% }
% Importantly, in exchange for these imperfections, the looping probability $\verrloop_2$ of $V_2$ is zero.
Let \utkanadd{$\verracc_2$ and $\verrrej_2$}
% \utkanrem{$\verracc_2$, $\verrrej_2$, and $\verrloop_2$}
%, and $\verrloop_2$
be the errors of $V_2$ corresponding to \utkanadd{$\verracc_1$ and $\verrrej_1$, respectively}.
% \utkanrem{$\verracc_1$, $\verrrej_1$, and $\verrloop_1$}
%and $\verrloop_1$ of $V_1$
% ($V_2$ cannot be fooled into looping, so we do not have to worry about that type of error.)
Let us analyze how the two differences described above affect the errors of $V_2$ compared to those of $V_1$.
$\verracc_2$ is less than or equal to $\verracc_1$, since neither difference makes $V_2$ less likely to accept an input.
%It might be less due to \Cref{diff:longrun}; the input string accepted by $V_1$ after a long run might have been accepted erroneously so, which $V_2$ will be rejecting because of the time limit.
% of the differences between $V_2$ and $V_1$ can cause an increase in the rejection probability.
$\verrrej_2$ is greater than $\verrrej_1$ by the probability that $V_1$ rejects after running for more than $f_2(n)$ steps.
%, due to \Cref{diff:longrun}. This probability is limited by that of halting after running for longer than $f_2(n)$ steps.
However, a large constant factor in front of $f_2(n)$ ensures that $\verrrej_2$ is at most $\verr_1 + \verrdiff$ for some $\verrdiff$ that is arbitrarily small, through~\cite[Theorem~6.1]{CL89}. The detailed analysis of this conclusion is given in \Cref{sec:dir2appendices}.
\paragraph{\verrdiff{} is arbitrarily small.}
The proof of~\Cref{lem:dir2NEW} also claims that the $\verrrej_2$ is not more than $\verr_1 + \verrdiff$ for some arbitrarily small \verrdiff. As stated in the proof, this claim follows from~\cite[Theorem~6.1]{CL89} which allows us to assert the following: For some linear function $l$ and a positive integer constant $k$, $V_1$ will have rejected any nonmember input string of length $n$ in $f_1(n) = k^2 \cdot 2^{2^{l(n)}}$ steps with a probability that is at least $1 - \paren*{\verr_1 + 2^{-k} + k^{-1}}$. The term \verrdiff{} was introduced in the proof statement as an alias and an equal to the term $2^{-k} + k^{-1}$ of this statement.
Recall that $p(n) = c \cdot n^t$ and that the expected number of steps $V_1$ is simulated is at least $2^{p(n)} \cdot 2^{2^{p(n)}}$. We can ensure this to be larger than $f_1(n)$ for arbitrarily higher values of $k$ by choosing a large enough $c$ accordingly. Higher values of $k$ brings $\verrdiff = 2^{-k} + k^{-1}$ closer to zero, which ensures that a nonmember input string is rejected with the high probability $1 - \paren*{\verr_1 + \verrdiff}$. This proves the claimed bound upon $\verrrej_2$.
% By definition, the expected runtime of $V_1$ is $f_1(n)$ when it is not running forever (\ie, with probability $1-\verrloop_1$). By Markov's inequality, the probability that $V_1$ runs for more than $f_2(n)$ steps when it is not running forever is at most $\sfrac{f_1(n)}{f_2(n)}$. This difference can be reduced by increasing
%the leading coefficient of $f_2(n)$,
% $c$, thus bringing $\verracc_2$ arbitrarily close to $\verracc_1$, and proving our claim that the overall error bound of $V_2$ is close to that of $V_1$.
% \utkanrem{Finally, $\verrloop_2$ is zero.}
It is worth noting here that we do not have a strict bound over $V_2$'s runtime; the bound on the number of counter ticks is only an expected bound and not strict. Despite that, the probability that the counter ticks further, approaches to zero as the number of ticks increases. \utkanadd{Therefore, unlike $V_1$ which might have a non-zero probability of looping, the probability that $V_2$ loops is zero.}
% Before proceeding with the remaining of the proof, we make the remark that, by~\cite[Theorem~6.1]{CL89}, a double\-/exponential number of steps, $f_1(n)$, is enough for $V_1$ to reject nonmember input strings with a probability close to $1 - \verr_1$.
% Before proceeding with the remaining of the proof, we make the remark that, by~\cite[Theorem~6.1]{CL89}, for some linear function $l$ and any large constant $k$, $V_1$ will have rejected any nonmember input string of length $n$ in $f_1(n) = k^2 \cdot 2^{2^{l(n)}}$ steps with high probability that is at least $1 - \paren*{\verr_1 + 2^{-k} + k^{-1}}$.
% There is only
% one
% %the following
% difference between the interactions of $V_1$ and $V_2$ with their respective provers:
% %, when the two IPSs are examined as black\-/boxes:
% The runtime of $V_2$ is sharply limited by $f_2(n)$. $V_1$, on the other hand, can run forever with probability $\verrloop_1$. Although $V_1$ has an expected runtime of
% %otherwise is expected to finish in
% $f_1(n)$ steps, it may take longer than even $f_2(n)$ with some probability \errpremature{}.
% $V_2$ considers the looping sims as rejecting, which is an improvement on its error bound over $V_1$'s by up to $\verrloop_1$. However, $V_2$ considers the sims taking longer than $f_2(n)$ as rejecting as well, despite they might be headed towards acceptance, which amounts to an increase in its error bound over $V_1$'s by up to \errpremature.
% To keep \errpremature{} low, an arbitrarily large constant $c$ is selected, and the timer function of $V_2$ is accordingly expedited to ensure $f_2(n) > c \cdot f_1(n)$ for all $n$.
% This forces \errpremature{} to be less than $\sfrac1c$, since otherwise the analysis of $V_1$'s expected runtime (excluding the cases where it is looping) would yield a function greater than $f_1(n)$.
% % Given that the expected runtime of $V_1$ is $f_1(n)$ when it is not looping, \errpremature{} then has to be at most $\sfrac1c$ (since otherwise the expected runtime had to be higher).
% The probability of $V_2$ running for any longer than that limit is small, and
% $V_2$ and $P_2$ emulate the interaction of $V_1$ and $P_1$ with one important exception: Recall that $V_1$ may be tricked by $P_1$ into running forever with a very small probability $\varepsilon$ for some inputs. $V_2$ has a strictly limited runtime of $\OH{n^{\ceil*{t}}}$ steps, which eliminates the probability of looping. The negligible and redeemable trade\-/off is that the decision error of $V_2$ is increased by up to $\varepsilon$. %\utkanadd{limiting the runtime of $V_2$ with \OH{n^{\ceil t}} strictly}.
% ŞİMDİKİ OKUYUŞUMDA ŞU CÜMLENİN NE İŞE YARADIĞINI ANLAMADIM. ZATEN ÖNCEKİ CÜMLEDE WORSTCASE $n^t$DİR DEDİK; BUNA NE GEREK VAR?????????? \utkanadd{[1, n) KAT DAHA İYİ BİR ZAMAN SINIRI (+) AMA HEP GEÇERLİ DEĞİL (-) VE DE SADECE EXPECTED (-). GEREKLİ OLMAYABİLİR. ESKİDEN WORST CASE SINIRIMIZ $n^{\ceil t + 1}$'Dİ, O ZAMAN BELKİ DAHA KIYMETLİYDİ}
% \utkanadd{Furthermore,} since $\varepsilon$ is small, the expected runtime of $V_2$ is almost the same as that of $V_1$, which is \OH{n^t}.
We now demonstrate the existence of $V_3$, a standard \utkanadd{public\-/coin} log\-/space verifier with a single input head that verifies the same language.
The naive way of simulating a multi\-/head machine by a logarithmic space machine is rather straightforward. Specifically, $V_3$ can keep $V_2$'s head indices in multiple tracks of its work tape in binary format. (To accommodate for \utkanadd{$2^r + 1 + t_1 + 2^r \cdot t_2$} tracks in the work tape, $V_3$ should use a work tape alphabet of size $2^{\utkanadd{2^r + 1 + t_1 + 2^r \cdot t_2}}$.) In each simulated transition of $V_2$, to decipher what $V_2$ is reading with its \utkanadd{$2^r + 1 + t_1 + 2^r \cdot t_2$} heads, $V_3$ will carry out the following steps:
\begin{turingenum}
\item Move the input head to $\lend$.
\item Do the following for all $i \in \Set{1, \dotsc, \utkanadd{2^r + 1 + t_1 + 2^r \cdot t_2}}$:
\bitem{Decrement the index on the \ith{i} track of the work tape and move the input head to the right. Repeat this until the index becomes $0$.}
\bitem{Register the symbol under the input head as $x_i$.}
\bitem{Increment the index on the \ith{i} track of the work tape and move the input head to the left. Repeat this until the head is reading $\lend$.}
\end{turingenum}
Having learned the symbols $x_1, \dotsc, x_{\utkanadd{2^r + 1 + t_1 + 2^r \cdot t_2}}$ scanned by the simulated $V_2$'s heads, $V_3$ can
% \utkanrem{use the latest public coin flip and consult the communication cell to}
complete a simulated transition of $V_2$ \utkanadd{by} updating the work tape contents to reflect the new head positions of $V_2$ by incrementing or decrementing the indices on the respective tracks. \utkanadd{If the simulated transition requires it, $V_3$ tosses a public coin to provide the outcome to $V_2$, or pings its own prover $P_3$ to relay the message to $V_2$ as if it was from $P_2$.}
% \utkanrem{in a manner analogous to the algorithm above}. BU PARAGRAFTA YAPTIKLARIM DOĞRU MU??????????????????????
% \utkanrem{Note that the matching prover, $P_3$, which is supposed to send the messages that $P_2$ would be sending for each simulated step, %\utkanrem{sends blank symbols}
% will send ``filler'' symbols (all of which will be ignored by $V_3$) through the communication cell while it waits for $V_3$ to complete these walks on its work tape.}
$V_3$ \utkanadd{gets convinced and} accepts the input only if \utkanadd{the simulated}
% \utkanrem{it is convinced that}
$V_2$ accepts the same as a result of this interaction.
% \utkanrem{$V_3$'s runtime is simply the runtime of $V_2$ multiplied by the overhead of simulating multiple input heads within the logarithmic work tape. Counting from $0$ to $n$ (or down from $n$ to $0$) in binary takes \OH{n} time for a Turing machine by amortized analysis (BURADA BUNU DETAYLI ACIKLADIGIMIZ MASTER TEZIME REFERANS VERELIM MI?). Incrementing or decrementing binary numbers with $\ceil*{\log n}$ digits takes \OH{\log n} time.
%PARDON; BURADA log n RAKAMLI BINARY SAYILAR DA MI VAR???? WORKTAPE HEAD'i SEMBOLİZE EDEN HEAD'in INDEXİ Mİ??? \utkanadd{TAM ANLAYAMADIM, $V_2$'NİN KAFA İNDEKSLERİNİ $\log n$'LİK BINARY SAYILARDA TUTUYORUZ. $V_2$'NİN NE OKUDUĞUNU DEŞİFRE ETME AŞAMASI $0$'dan $n$'e SAYMAYI GEREKTİRİYOR, ÇOKÇA DEFA. HEPSİ DEŞİFRE EDİLDİKTEN SONRA NE SİMÜLASYONDA TRANSITION YAPACAĞIMIZI ANLIYORUZ. SONRA SİMÜLASYON KAFALARINI (WORK TAPE'TEKİ İNDEKSLERİ) OYNATIYORUZ (ARTTIRIP AZALTIYORUZ)}
% As a result, using the naive method of simulation explained above, $V_3$ is expected to run in \OH{n^{t+1}} time.}\footnote{\utkanrem{$V_3$ can be improved by introducing $2^r + t$ logarithmically\-/long caches in the memory, one for each head of the simulated $V_2$, each containing the slice from the input string where the corresponding head resides at that time. This slightly more advanced way of simulating multiple heads using logarithmic space~\cite{GS22} would save $V_3$ a factor of $\OH{\log n}$ in runtime.}}
\newcommand{\noop}[1]{}
\begin{thebibliography}{22}
\providecommand{\natexlab}[1]{#1}
\providecommand{\url}[1]{\texttt{#1}}
\expandafter\ifx\csname urlstyle\endcsname\relax
\providecommand{\doi}[1]{doi: #1}\else
\providecommand{\doi}{doi: \begingroup \urlstyle{rm}\Url}\fi
\bibitem[Ambainis and Watrous(2002)]{AW02}
A.~Ambainis and J.~Watrous.
\newblock Two-way finite automata with quantum and classical states.
\newblock \emph{Theoretical Computer Science}, 287\penalty0 (1):\penalty0 299--311, 2002.
\bibitem[Babai(1985)]{B85}
L.~Babai.
\newblock Trading group theory for randomness.
\newblock In \emph{Proceedings of the Seventeenth Annual ACM Symposium on Theory of Computing}, STOC '85, pages 421--429, New York, NY, USA, 1985. Association for Computing Machinery.
\bibitem[Condon(1989)]{con89}
A.~Condon.
\newblock \emph{Computational Models of Games}.
\newblock MIT Press, 1989.
\bibitem[Condon(1993)]{C93b}
A.~Condon.
\newblock The complexity of space bounded interactive proof systems.
\newblock In \emph{Complexity Theory: Current Research}, pages 147--189. Cambridge University Press, USA, 1993.
\bibitem[Condon and Ladner(1995)]{conlad95}
A.~Condon and R.~Ladner.
\newblock Interactive proof systems with polynomially bounded strategies.
\newblock \emph{Journal of Computer and System Sciences}, 50\penalty0 (3):\penalty0 506--518, 1995.
\bibitem[Condon and Lipton(1989)]{CL89}
A.~Condon and R.~J. Lipton.
\newblock On the complexity of space bounded interactive proofs.
\newblock In \emph{30th Annual Symposium on Foundations of Computer Science}, pages 462--467, 1989.
\newblock (Extended version: \url{https://www.cs.ubc.ca/~condon/papers/condon-lipton89.pdf}).
\bibitem[Cormen et~al.(2009)Cormen, Leiserson, Rivest, and Stein]{CLRS09}
T.~H. Cormen, C.~E. Leiserson, R.~L. Rivest, and C.~Stein.
\newblock \emph{Introduction to Algorithms}.
\newblock MIT Press, 3rd edition, 2009.
\bibitem[Demirci et~al.(2015)Demirci, Say, and Yakary\i{}lmaz]{DSY15}
H.~G. Demirci, A.~C.~C. Say, and A.~Yakary\i{}lmaz.
\newblock The complexity of debate checking.
\newblock \emph{Theory of Computing Systems}, 57\penalty0 (1):\penalty0 36--80, July 2015.
\bibitem[Dwork and Stockmeyer(1992)]{DS92}
C.~Dwork and L.~Stockmeyer.
\newblock Finite state verifiers {I}: The power of interaction.
\newblock \emph{J. ACM}, 39\penalty0 (4):\penalty0 800--828, Oct. 1992.
\bibitem[Fortnow and Lund(1993)]{FL93}
L.~Fortnow and C.~Lund.
\newblock Interactive proofs and alternating time\-/space complexity.
\newblock \emph{Theoretical Computer Science}, 113:\penalty0 55--73, 1993.
\bibitem[Gezer and Say(2022)]{GS22}
M.~U. Gezer and A.~C.~C. Say.
\newblock Constant\-/space, constant\-/randomness verifiers with arbitrarily small error.
\newblock \emph{Information and Computation}, 288:\penalty0 104744, 2022.
\bibitem[Gezer and Say(2023)]{GS23}
M.~U. Gezer and A.~C.~C. Say.
\newblock Finite state verifiers with both private and public coins.
\newblock In G.~Castiglione and M.~Sciortino, editors, \emph{Proceedings of the 24th Italian Conference on Theoretical Computer Science, Palermo, Italy, September 13--15, 2023}, volume 3587 of \emph{{CEUR} Workshop Proceedings}, pages 241--253. CEUR-WS.org, 2023.
\bibitem[Gezer et~al.(2023)Gezer, Dolu, Ersoy, and Say]{GDES23}
M.~U. Gezer, {\"{O}}.~Dolu, N.~Ersoy, and A.~C.~C. Say.
\newblock Real\-/time, constant\-/space, constant\-/randomness verifiers.
\newblock \emph{Theoretical Computer Science}, 976:\penalty0 114155, 2023.
\bibitem[Goldreich et~al.(1987)Goldreich, Mansour, and Sipser]{GMS87}
O.~Goldreich, Y.~Mansour, and M.~Sipser.
\newblock Interactive proof systems: Provers that never fail and random selection.
\newblock In \emph{28th Annual Symposium on Foundations of Computer Science (SFCS 1987)}, pages 449--461, 1987.
\bibitem[Goldwasser and Sipser(1986)]{GS86}
S.~Goldwasser and M.~Sipser.
\newblock Private coins versus public coins in interactive proof systems.
\newblock In \emph{Proceedings of the Eighteenth Annual ACM Symposium on Theory of Computing}, pages 59--68. Association for Computing Machinery, 1986.
\bibitem[Goldwasser et~al.(1989)Goldwasser, Micali, and Rackoff]{GMR89}
S.~Goldwasser, S.~Micali, and C.~Rackoff.
\newblock The knowledge complexity of interactive proof systems.
\newblock \emph{SIAM Journal on Computing}, 18\penalty0 (1):\penalty0 186--208, 1989.
\bibitem[Goldwasser et~al.(2015)Goldwasser, Kalai, and Rothblum]{GKR15}
S.~Goldwasser, Y.~T. Kalai, and G.~N. Rothblum.
\newblock Delegating computation: Interactive proofs for muggles.
\newblock \emph{J. ACM}, 62\penalty0 (4), Sept. 2015.
\bibitem[Hartmanis(1972)]{H72}
J.~Hartmanis.
\newblock On non\-/determinancy in simple computing devices.
\newblock \emph{Acta Informatica}, 1\penalty0 (4):\penalty0 336--344, 1972.
\bibitem[Kemeny and Snell(1960)]{KS60}
J.~Kemeny and J.~Snell.
\newblock \emph{Finite Markov Chains}.
\newblock Van Nostrand, 1960.
\bibitem[Ladner et~al.(1978)Ladner, Lipton, and Stockmeyer]{LLS78}
R.~E. Ladner, R.~J. Lipton, and L.~J. Stockmeyer.
\newblock Alternating pushdown automata.
\newblock In \emph{Proceedings of 19th Annual IEEE Symposium on Foundations of Computer Science}, pages 92--106. IEEE Computer Society, Oct. 1978.
\bibitem[Say and Yakary\i{}lmaz(2014)]{SY14}
A.~C.~C. Say and A.~Yakary\i{}lmaz.
\newblock Finite state verifiers with constant randomness.
\newblock \emph{Logical Methods in Computer Science}, 10\penalty0 (3), Aug. 2014.
\bibitem[Shamir(1992)]{Sha92}
A.~Shamir.
\newblock {IP} = {PSPACE}.
\newblock \emph{J. ACM}, 39\penalty0 (4):\penalty0 869--877, Oct. 1992.
\end{thebibliography}