Paper Title: Settling the Pass Complexity of Approximate Matchings in Dynamic Graph Streams.




 
 















Umathx45
Umathxmn
      <5> <6> <7> <8> <9> <10>
      <10.95> <12> <14.4> <17.28> <20.74> <24.88>
      mathx10
      
mathxUmathxmn
1mathx"91


skins,breakable
enhanced jigsaw














propertypropertyProperty
property(#1)#2#3
equationeqEq
equation(#1)#2#3








arrows
arrows.meta
shapes
backgrounds
positioning
decorations.markings
decorations.pathreplacing 
patterns
calc
fit
decorations





-@thistlm




[itemize]leftmargin=20pt
[enumerate]leftmargin=20pt








theoremTheorem
lemmaLemma[section]
proposition[lemma]Proposition
corollary[lemma]Corollary
claim[lemma]Claim
fact[lemma]Fact
assumption[lemma]Assumption
invariant[lemma]Invariant

conj[lemma]Conjecture
definition[lemma]Definition
problemProblem

*claim*Claim
*assumption*Assumption
*proposition*Proposition
*lemma*Lemma

observation[lemma]Observation
propertyProperty


*theorem*Theorem

lemmaLemmaLemmas
claimclaimclaims
propertyPropertyProperties
invariantInvariantInvariants

mdresultResult
result[backgroundcolor=lightgray!40,topline=false,rightline=false,leftline=false,bottomline=false,innertopmargin=2pt]





remark[lemma]Remark


definition

mdproblemProblem
Problem[backgroundcolor=ForestGreen!15,topline=false,bottomline=false, innerbottommargin=12pt,innertopmargin=12pt]
*mdproblem*Problem
Problem*[hidealllines=false,innerleftmargin=10pt,backgroundcolor=gray!10,innertopmargin=5pt,innerbottommargin=5pt,roundcorner=10pt]
mddefinition[lemma]Definition
Definition[hidealllines=false,innerleftmargin=10pt,backgroundcolor=white!10,innertopmargin=5pt,innerbottommargin=5pt,roundcorner=10pt]
*mddefinition*Definition
Definition*[hidealllines=false,innerleftmargin=10pt,backgroundcolor=white!10,innertopmargin=5pt,innerbottommargin=5pt,roundcorner=10pt]
mdremarkRemark
Remark[hidealllines=false,innerleftmargin=10pt,backgroundcolor=gray!10,innertopmargin=5pt,innerbottommargin=5pt,roundcorner=10pt]

ourbox[hidealllines=false,innerleftmargin=10pt,backgroundcolor=white!10,innertopmargin=2pt,innerbottommargin=5pt,roundcorner=10pt]


mdalgorithmAlgorithm
Algorithm


lemrestateinnerLemma


restate (restated)..5em#3
restate
*restate





































































































tbox[
		enlarge top by=5pt,
		enlarge bottom by=5pt,
		 breakable,
		 boxsep=0pt,
                  left=4pt,
                  right=4pt,
                  top=10pt,
                  arc=0pt,
                  boxrule=1pt,toprule=1pt,
                  colback=white
                  ]
	










































































































































































































































 






Settling the Pass Complexity of Approximate Matchings 
 in Dynamic Graph Streams
    Sepehr Assadi[(sepehr@assadi.info) Cheriton School of Computer Science, University of Waterloo. 
Supported in part by a  Sloan Research Fellowship, an NSERC
Discovery Grant, a University of Waterloo startup grant, and a Faculty of Math Research Chair grant. ] 

 University of Waterloo Soheil Behnezhad[(s.behnezhad@northeastern.edu) Khoury College of Computer Sciences, Northeastern University. ]
 
 Northeastern University Christian Konrad[(christian.konrad@bristol.ac.uk) School of Computer Science, University of Bristol, UK. 
Supported by EPSRC New Investigator Award EP/V010611/1. ] 
 University of Bristol Kheeran K. Naidu[(kheeran.naidu@bristol.ac.uk) School of Computer Science, University of Bristol, UK.
Supported by EPSRC Doctoral Training Studentship EP/T517872/1. ] 
 University of Bristol Janani Sundaresan[(jsundaresan@uwaterloo.ca) Cheriton School of Computer Science, University of Waterloo. Supported in part by a David R. Cheriton Scholarship from Cheriton School of Computer Science, Faculty of Math Graduate Research Excellence Award, and Sepehr Assadi's NSERC Discovery Grant. ] 
 University of Waterloo

    
===========================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================================






§ ABSTRACT 



A semi-streaming algorithm in dynamic graph streams processes any n-vertex graph by making one or multiple passes over a stream of insertions and deletions to edges of the graph and
using O(n ·(n)) space. Semi-streaming algorithms for dynamic streams were first obtained 
in the seminal work of Ahn, Guha, and McGregor in 2012, alongside the introduction of the graph sketching technique, 
which remains the de facto way of designing algorithms in this model and a highly popular technique for designing graph algorithms in general. 



We settle the pass complexity of approximating maximum matchings in dynamic streams via semi-streaming algorithms by improving the state-of-the-art in both upper and lower bounds: 


	
  * We present a randomized sketching based semi-streaming algorithm for O(1)-approximation of maximum matching in dynamic streams using O(loglogn) passes. 
	The approximation ratio of this algorithm can be improved to (1+) for any fixed > 0 even on weighted graphs using standard techniques. 
	
	
	This exponentially improves upon
	several O(logn) pass algorithms developed for this problem since the introduction of the dynamic graph streaming model. 
	
	
	
  * We prove that any semi-streaming algorithm (not only sketching based) for O(1)-approximation of maximum matching in dynamic streams requires Ω(loglogn) passes. 
	
	This presents the first multi-pass lower bound for this problem, which is already also optimal, settling a longstanding open question in this area.  






roman







arabic









§ INTRODUCTION


In the dynamic graph streaming model, we have a graph G=(V,E) with vertices V := [n]. 
The edges in E are defined by a sequence of insertions and deletions in a stream σ := (σ_1,…,σ_N) of length N which
is often assumed to be some (n). Each entry σ_i of the stream is either inserting a new edge (u_i,v_i) to E or deleting an already inserted edge from it. 
The goal is to make one or a few passes over the stream, use a limited memory—ideally, O(n ·log(n)) bits, referred to as semi-streaming space—and
compute the answer to a given problem on the graph G at the end of the last pass. We focus on the maximum matching problem in this model. 

Maximum matching is arguably the most studied problem in the graph streaming model at this point (including both dynamic and insertion-only streams); we refer the interested reader to <cit.> that lists various lines of work on this problem. 
The history of this problem, focusing solely on O(1)-approximation algorithms and in dynamic graph streams, is as follows: 


	
  * The first such algorithms for matchings were obtained in <cit.> alongside the introduction of the dynamic graph streaming model itself. 
	The authors in <cit.> observed that the prior techniques of <cit.> (in the MapReduce/MPC model) also imply an O(logn)-pass semi-streaming algorithm for 2-approximation of maximum matching in dynamic streams.
	[Technically, the algorithms of <cit.>, and some subsequent ones, use n^1+1/p-space in O(p) passes. This translates 
	to an O(log(n)/loglog(n))-pass algorithm in semi-streaming space. Yet, to keep the focus on the bigger picture, we 
	ignore this lower-order term improvement and refer to these algorithms as O(logn) passes still.]
	
  * In the same work, <cit.>, building on <cit.>, further improved the approximation ratio of the algorithm of <cit.> to (1+)-approximation for any fixed > 0 using O(log^2(n)) passes
	on general graphs and O(logn) passes on bipartite graphs. 
	
  * The algorithms of <cit.> were subsequently improved in <cit.> to an O(logn)-pass algorithm for (1+)-approximation even on weighted (general) graphs. 
	Very recently, this algorithm was simplified and slightly improved in <cit.>. Yet another algorithm with similar guarantees for unweighted bipartite graphs was obtained in <cit.>. 
	
	
  * In addition, some generic reductions from general to bipartite <cit.> or weighted to unweighted matchings <cit.> developed over the years 
	can be applied to the algorithms of <cit.> to obtain O(logn)-pass algorithms for (1+)-approximation for fixed > 0.[These algorithms generally have a (much) worse dependence on the parameter  
	compared to the ones in the bullet point above, but for constant > 0, their guarantees are still asymptotically the same.] 

	 
  * In parallel to the line of work on multi-pass algorithms, a series of work studied single-pass algorithms for this problem <cit.>. In particular, <cit.>
	 proved that any O(1)-approximation of matchings via single-pass algorithms requires n^2-o(1) space and <cit.> improved this to an optimal Ω(n^2) space lower bound.  

This constitutes the state-of-the-art for matchings in dynamic graph streams: 

For semi-streaming algorithms on dynamic streams, O(1)-approximation to maximum matching is possible in ≈logn passes and not possible in a single pass. 

Closing this huge gap between upper and lower bounds for dynamic streaming matchings has been a longstanding open question in the graph streaming literature. 
This is precisely the contribution of our work: we fully settle the pass complexity of O(1)-approximation of maximum matching in dynamic streams by improving both the upper and lower bounds for this problem. 
 
 



 §.§ Our Contributions
 


Our first main result shows that surprisingly—at least to the authors—the right answer to the problem is not even close to ≈logn passes:




one can exponentially improve the pass complexity of 
different algorithms developed for this problem in <cit.>. 


	There is a randomized O(loglogn)-pass O(1)-approximation semi-streaming algorithm for the maximum matching problem in dynamic streams. 
	The result continues to hold even for (1+)-approximation of weighted (general) matching for any constant > 0. 


We find our main contribution in <Ref> to be the O(1)-approximation algorithm, which relies on different sets of techniques compared to the prior work on this problem.
The improvement to (1+)-approximation and weighted graphs follows from this novel algorithm using the existing reductions developed in <cit.>. 
We emphasize that previously, no better than O(logn/loglogn)-pass dynamic semi-streaming algorithms were known even for log(n)-approximation of matchings in its simplest form, namely, for 
unweighted bipartite matching. 



Prior to our work, the only other problem with a similar pass complexity in dynamic streams that we are aware of is the maximal independent set (MIS) problem, which also admits an O(loglogn) pass algorithm <cit.> (this 
result is related to ours as we will discuss in <Ref>). For the maximum matching problem itself, the best approximation ratio achievable by O(loglogn)-pass 
algorithms was n^O(1/loglogn)-approximation that follows from <cit.>. 


Furthermore, in addition to our algorithmic improvement, we can also improve the single-pass lower bounds of <cit.> all the way to Ω(loglogn) passes. 


	Any randomized semi-streaming algorithm for O(1)-approximation of maximum matching in dynamic streams with constant probability of success 
	requires Ω(loglogn) passes. The lower bound holds even on (unweighted) bipartite graphs. 


The only other semi-streaming lower bounds of similar nature are the very recent  Ω(loglogn)-pass and Ω(logn)-pass lower bounds for, respectively, MIS in insertion-only streams <cit.> 
and exact minimum spanning tree (MST) in dynamic streams <cit.> (these work are related to ours technique-wise and we shall discuss them in <Ref>). 
For the maximum matching problem itself, we only knew Ω(logn)-pass lower bounds for finding exact maximum matchings <cit.> and a conditional Ω(log(1/))-pass lower bound for (1+)-approximation for small constant ∈ (0,1) <cit.>;
see also <cit.> for two-pass lower bounds for small approximation ratios (way) below 2; all these lower bounds for matchings hold even for insertion-only streams[The focus of these results is qualitatively different than ours; in insertion-only stream, obtaining a 2-approximation is trivial in a single pass, whereas in dynamic streams, 
the whole question is on obtaining some O(1)-approximation.]. 

Proving multi-pass semi-streaming lower bounds has been generally a challenging question (compared to the wealth of single-pass lower bounds; see the short survey in <cit.> for some discussion of this topic). 
With a few notable exceptions <cit.>, “strong” multi-pass semi-streaming lower bounds have only been obtained very recently for different problems, starting from two-pass algorithms <cit.> and now even for multi-pass ones <cit.>. 
<Ref> also contributes to this line of work and is among the very few optimal lower bounds (together with <cit.>). 

In conclusion, <Ref> and <Ref> together establish that the optimal pass complexity of approximate matchings in dynamic graph streams 
is Θ(loglogn) passes. 



Before moving on from our results, a quick detour is in order.  Similar to all other dynamic graph streaming algorithms, our algorithm is based on the graph sketching technique (see, e.g. <cit.> for the definition). 
	Our <Ref>, put differently, states that:
	
	There is an adaptive sketching algorithm that in O(loglogn)-rounds and (n)-size sketches can recover an O(1)-approximate matching with high probability.
	 
	Such a result is interesting on its own given the generality of graph sketching and its implications to other models as well. 
	
	For instance, this implies a Massively Parallel Computation (MPC) algorithm for approximating matchings in O(loglogn) rounds with
	machines of (n) memory (even O(n/log(n)) memory) and only (n) working memory. Prior work in <cit.> achieved MPC algorithms with similar guarantees 
	using various other techniques (and to our knowledge, all with n^1+Ω(1) working memory). Our result shows that graph sketching technique itself, which is one of the oldest techniques in the MPC model as well, 
	can achieve such bounds in a conceptually simpler way (and with the additional benefit of using a smaller working memory). As this is not the focus of the paper, we omit the definition and details of the model and instead
	refer the interested reader to the aforementioned papers for more details. 




 §.§ Our Techniques



Our upper and lower bounds are intimately connected to each other by looking at matching through the lens of maximal independent sets. Specifically:


  * Our upper bound uses the O(loglogn)-pass semi-streaming algorithm of <cit.> for MIS as a subroutine (in a non blackbox way) and borrows ideas and inspiration from the recent work of <cit.> that relates MIS to the vertex cover problem (the dual problem of maximum matching);

  * Our lower bound builds on and adapts the recent communication complexity techniques developed for proving an Ω(loglogn)-pass semi-streaming lower bound for MIS in <cit.>. 

We briefly discuss the techniques behind our work in this subsection and postpone a more elaborate discussion to our technical overview in <Ref>. 



  
Upper bound. The first main technical ingredient of our algorithm in <Ref> is a model-independent reduction from O(1)-approximate fractional matchings to the randomized greedy MIS algorithm[This is the algorithm that iterates over the vertices in a random order and greedily adds a vertex to the MIS as long as none of its neighbors that appear before it in the ordering are already chosen in the MIS.]. This reduction is inspired by the brilliant recent
work of <cit.> that showed that the complement of the randomized greedy MIS is a 2-approximate vertex cover in expectation! 
On the other hand, we show that in every step of the randomized greedy MIS, we can assign a fractional value to the edges in the 2-hop neighborhood of vertices that join the MIS, to instead form
a large fractional matching in expectation. 
It is worth noting that <cit.>, similar to us, relies on a primal-dual analysis and exhibits a 2-approximate fractional matching in the reduction; nevertheless, that fractional matching 
is only an analytical tool and in fact is a function of the randomized greedy MIS over all possible ordering of vertices and cannot be found by an algorithm[We shall note that while <cit.> has been
an important source of inspiration for us—and in the first place suggested to us that randomized greedy MIS might also be relevant to approximate matchings—our specific reduction and the techniques in its analysis
are almost entirely disjoint from <cit.>; see <Ref> for a more detailed comparison.].

The second main technical ingredient of our algorithm is a partial implementation of the above reduction in O(loglogn) passes of dynamic streams. To do this, 
we rely on the semi-streaming implementation of the randomized greedy MIS in O(loglogn) passes by <cit.>. We show that we can run this algorithm and additionally collect enough auxiliary information 
to also be able to somewhat recover the associated fractional matching defined in the reduction as well. The challenge is that this fractional matching, quite crucially, works with edges in the
 2-hop neighborhood of vertices that join the MIS; these edges however are not even visited by the randomized greedy MIS algorithm and its simulation in <cit.>. As a result, we are only able to work
 with them through certain “proxy” edges that we can sample algorithmically, and then delegate some part of the computation of this fractional matching to the analysis instead (the algorithm itself only returns a maximum matching
 of the sampled edges). 
 
 

  
Lower bound. Our lower bound follows the recently-developed hierarchical embedding technique of <cit.> (inspired by <cit.>) that (i) creates hard instances for p-pass streaming algorithms for a problem P
 by embedding many (p-1)-pass hard instances of P in a single graph G; and, (ii) applies a generalized round elimination argument to prove the lower bound (see <cit.> for the original round elimination
 and <cit.> for its generalization). There are two main differences in implementing this strategy in our work compared to <cit.> however. 
 
 The first key difference is in the combinatorial construction of hard instances. <cit.> designed a family of extremal graphs, based on a generalization of (RS) graphs <cit.>, that pack many induced collections of vertex-disjoint 
 “small” graphs inside a single “base” graph. This allows them to embed the (p-1)-pass hard instances as small graphs inside a single p-pass hard instance as the base graph. The inducedness guarantee of the base 
 graph now ensures that these embedded (p-1)-pass hard instances do not interfere with each other (e.g., do not add edges between vertices of each other) and thus remain hard even inside a single graph. 
 Instead, we create our hard instances by exploiting the power of edge deletions following the approach of <cit.> for proving 
 single-pass dynamic streaming lower bounds for approximate matchings. This way, our hard instances consists of a stream that inserts many (p-1)-pass hard instances together, not  necessarily with any induced subgraph collections (unlike <cit.>), followed by deletions of edges in many of these instances so that effectively only one large induced collection of (p-1)-pass instances remain. We show that in the context of O(1)-approximate matchings, 
 this is enough to force any algorithm for the p-pass instance to also solve many (p-1)-pass hard instances. 
 
 The second key difference is in the information-theoretic arguments. The new round elimination argument established in <cit.> crucially relies on
 the independence of the inputs of players in the corresponding communication game used to establish the streaming lower bound. In contrast, such an independence cannot hold for us given that 
 we need to ensure the input of one player is only deleting edges already inserted by another player (otherwise, the stream may delete edges that have not been inserted). Addressing this issue requires
 a careful sharing of the input of players with each other to guarantee that no not-inserted edge gets deleted, while making sure there is also not too much correlation between their inputs (correlation generally makes the task of proving these lower bounds
 harder or even impossible). 
 This part borrows ideas from the recent work of <cit.> in proving multi-pass dynamic streaming lower bounds for MST. Finally, proving the general round elimination argument 
 with these restrictions also requires a different direct-sum result
 based on internal information complexity <cit.> and a corresponding message compression argument for internal information <cit.> (in contrast to the external information complexity direct sum <cit.> used in <cit.> and its own message compression technique from <cit.>). 
 
 
 

 
 

 














 
























































§ TECHNICAL OVERVIEW


We use this section to unpack the main ideas behind our work and give a streamlined overview
of our approach. This section oversimplifies many details and the discussions
will be informal for the sake of intuition. Thus, while this section provides ample intuition and introduction to our approach, the rest of the paper is written in an independent way, and the reader 
can entirely skip this section and directly jump to technical arguments. Moreover, given the disjoint sets of techniques used in our upper bounds versus lower bounds, 
the following two subsections are entirely independent of each other and can be read in any order (this is also true of the rest of the paper). 



 §.§ Overview of Upper Bound


The starting point of our algorithm is a recent reduction of <cit.> from vertex cover to randomized greedy MIS, and a decade-old result of <cit.> that finds
the randomized greedy MIS in dynamic streams in O(loglogn) passes. Let us start with a quick overview of these works.



  §.§.§ Prior Work in <cit.>




  
Dynamic-streaming MIS algorithm of <cit.> Recall that in the randomized greedy MIS, we go over vertices in a random order, pick the first vertex in the MIS ℐ, remove all its neighbors from consideration from now on, 
and continue this way until we have visited all vertices.  

The algorithm of <cit.> is based on the following key observation: the effective degree of vertices, their degrees to not-yet-removed vertices, drops quite rapidly as we go through 
the random ordering of the vertices (this is often referred to as the “residual sparsity property” of the greedy algorithm <cit.>). Specifically, by the time we are processing
the k-th vertex, we expect the degree of each remaining vertex to be ≲ n/k. Intuitively, this is because a high degree vertex has a high chance of becoming a neighbor to one of the first k random
vertices in the beginning of this ordering and thus be removed itself (the actual argument is more nuanced because not all of the first k vertices of the ordering actually join the MIS; see <Ref>).  

<cit.> uses this property to simulate running the randomized greedy MIS in batches: pick a random ordering σ of vertices and let U_1 be the first batch of ≃ n^1/2 vertices of this ordering. 
Store all edges between them in a single pass using sparse-recovery (see <Ref>) since this subgraph can only have ≃ n edges. 
Using these edges, we can identify which vertices in U_1 will join the MIS in the algorithm, say, set ℐ_1 ⊆ U_1. Go over the stream one more time and this time mark each vertex 
that is neighbor to ℐ_1 as removed (this can be done by maintaining a counter for each vertex, to count the total number of insertions and deletions of its incident edges to ℐ_1). 

At this point, we have simulated the first ≃ n^1/2 iterations of the algorithm in O(1) passes. The residual sparsity property implies that degree of remaining vertices is only ≲ n^1/2. 
This means that we can now consider the next batch of ≃ n^3/4 vertices of the ordering as the set U_2 and with high probability still be able to store all their edges in ≃ n space[Sampling ≃ n^3/4 vertices
randomly or alternatively sampling each vertex w.p. ≃ n^-1/4 (implied by the random ordering of σ) means each sampled vertex only has ≲ n^-1/4· n^1/2 = n^1/4 neighbors in the sample.], and compute the 
independent set ℐ_2 ⊆ U_2. 
We can thus continue like this with batches U_2,U_3,…,U_t and by the time t ≃loglogn, all vertices are processed. This leads to an O(loglogn) pass semi-streaming algorithm that with high probability 
 simulates the randomized greedy MIS faithfully and outputs the same MIS. 



  
Model-independent reduction of <cit.>. A straightforward fact about any independent set of any graph G is that its complement must be a vertex cover. <cit.> made a beautiful discovery that 
the complement of the randomized greedy MIS on any graph G is in fact a 2-approximate vertex cover of G in expectation! This allows for “translating” many of the nice properties of the randomized greedy MIS
for obtaining a 2-approximation of vertex cover as well. 

The proof of this result is an elegantly simple application of LP duality. For a random order σ of vertices, we say an edge e ∈ E is blocking if one of its endpoints 
belongs to the MIS ℐ and it is the first neighbor (in ordering σ) of the other endpoint that joins the vertex cover 𝒞 = V ∖ℐ. I.e., e  is “blocking” this endpoint from joining ℐ and places it in the vertex cover instead. 
Let p_e denote the probability that e is blocking where the probability is over the randomness of σ. We have: 

    𝒞 = ∑_e p_e 
       for all v ∈ V:  ∑_e ∋ v1/2· p_e = v ∈𝒞≤ 1.

The first equation holds because for each vertex v that joins 𝒞, there is exactly one blocking edge incident on v. 
The second equation is more tricky and roughly holds because of the following: for any edge e=(u,v), conditioned on e being blocking, 
the probability that each of u or v belongs to the MIS is exactly half. This in turn implies that

    v ∈𝒞  = ∑_e ∋ ve is blocking∧ v ∈𝒞 = ∑_e ∋ v1/2· p_e,

where the first equality holds because these events are mutually exclusive (a vertex that joins 𝒞 can only have one incident blocking edge; this is not true of vertices that join ℐ). 
The upshot is that the assignment p_e/2 to every edge e ∈ E is a fractional matching of G 
with total value exactly half the size of the vertex cover 𝒞 of G. By duality of matching and vertex cover, these imply that 𝒞 is a 2-approximate vertex cover and p_e/2_e ∈ E is a 2-approximate fractional matching. 


It is worth pointing out that a direct combination of the above two works implies a semi-streaming algorithm that finds  a 2-approximate vertex cover in dynamic streams. We now discuss the challenges of extending these ideas to 
matching and how we address these challenges. 



  §.§.§ A Model-Independent Reduction from Matching to MIS
 




  
A similar reduction as in <cit.> for matching? While the reduction of <cit.> explicitly finds a 2-approximate vertex cover (in expectation), the fractional matching p_e/2_e∈ E introduced above 
is only an analysis tool: the algorithm itself is not actually finding this fractional matching; while the algorithm can identify the set of blocking edges used in the definition of p_e's for a single run of the randomized greedy MIS, these
edges are quite far from being any matching (see <Ref>). 










  
Our approach. We design a new scheme for finding a fractional matching from a single run of the randomized greedy MIS. We start with the following assignment x ∈^E to the edges: 

	
  * Whenever a vertex v joins the vertex cover 𝒞 (i.e., becomes incident to the MIS ℐ for the first time), assign
	a value of 1/(v) to every edge (v,w) with (w)≤(v). Here, the graph considered (including number of vertices or their degrees) is the one obtained
	by removing all vertices and their incident edges added in the previous iterations to ℐ and 𝒞. See <Ref>.



 



For now, let us ignore the technical (but necessary) condition that we only assign a value to edges (v,w) incident on v with (w) ≤(v) and instead assume we write 1/(v) over all remaining edges of v (we will  get back to this later). 
An easy observation now is that 

    ∑_e ∈ E x_e = 𝒞,

 because whenever a vertex v joins 𝒞, we increase total x-values by (v) · 1/(v) = 1. We want to establish that x is also not “far from” a fractional matching, meaning
that the x-value incident on any one vertex is not (much) more than one (thus a rescaling turns it into a fractional matching). 



Consider some vertex w ∈ V. There are two sources of x-value on edges of w: the ones that originate from w 
if and when it joins 𝒞, and the ones borrowed by w from its neighbors v that join 𝒞 before w is removed from the graph. The contribution of the first assignment is exactly 1 as argued for <Ref> and is thus bounded. As such, we only 
need to focus on the second assignment. 
 



This is where our crucial observation lies: in each iteration of the algorithm, if the expected borrowed assignment by a vertex is “high”, then this vertex also has an equally “high” chance of being removed from consideration after this iteration. 

Let us formalize this. Consider any iteration wherein we pick some vertex u in the random ordering to join ℐ in the algorithm. Firstly, 



    borrowed assignment of w in this iteration   = ∑_(v,w) ∋ wv joins 𝒞 in this iteration·1/(v)as v joining 𝒞 results in assigning 1/(v) value to one edge of w
       = ∑_(v,w) ∋ w(v)/n·1/(v)v joins 𝒞 if u ∈ N(v) and by the choice of σ, vertex u is chosen uniformly from remaining vertices = (w)/n.

Secondly, 

    w is removed in this iteration   = w joins ℐ or 𝒞 in this iteration = (w)+1/n,

where the second equality holds because w joins ℐ if u=w and joins 𝒞 if u ∈ N(w). Combining the above two equations gives us that
for any vertex w ∈ V, 

    borrowed assignment of w in this iteration≤w is removed in this iteration.



This brings us to an interesting probabilistic question. Fix a vertex w ∈ V and let X^w_1,X^w_2,…,X^w_n be n random variables where X^w_i is the borrowed assignment of w in iteration i of 
the randomized greedy MIS algorithm. We are interested in upper bounding: 

    ∑_i=1^n X^w_i  and  ∑_i=1^n X^w_i  subject to
    for all i ∈ [n]:     X^w_i | X^w_1,…,X^w_i-1≤X^w_i+1=⋯=X^w_n = 0 | X^w_1,…,X^w_i-1.

In words, we have a probabilistic experiment wherein the expected loss incurred in each step, no matter the history, is upper bounded by the probability of terminating the experiment at this step, and
we want to upper bound the total loss of the experiment. 

Suppose we could bound the expectation in <Ref> by O(1) and the variance by an O(1)-factor of the expectation. Then, using a somewhat careful application 
of Chebyshev's inequality, we can bound the expected “overflow” of the assignment x in total. In other words, we can say that (i) if we remove a constant fraction (less than one) of the x-value from 
vertices that have “too much” x-value on their edges, and (ii) further scale down x by some constant factor, we will end up with a fractional matching[While this step is non-trivial, it is mostly a careful calculation
and  there is not much more illuminating information that can be provided about it in this overview; so, we postpone more details of it to the actual proof.]. In conclusion, we can obtain a true fractional matching by “trimming down” x by a constant factor; combined with <Ref> and the duality of matchings and vertex covers,
this implies that the resulting fractional matching is an O(1)-approximation in expectation. 

Unfortunately however, we actually cannot achieve the desired bounds to the problem in <Ref> since the variables X^w_i can be unboundedly large. This is where our technical condition 
in the assignment of x comes in handy. In the actual definition of x, we are only assigning a value of 1/(v) to an edge (v,w) of a vertex v that joins 𝒞 if (w) ≤(v). Thus, for each vertex w, 
the total borrowed assignment in each iteration will be at most 

    ∑_(v,w) ∋ w 
    (w) ≤(v)1/(v)≤∑_(v,w) ∋ w 
    (w) ≤(v)1/(w)≤(w) ·1/(w) = 1.

In other words, in the problem of <Ref>, we additionally have that for every i ∈ [n], 0 ≤ X^w_i ≤ 1 holds deterministically. This extra condition is now enough to 
bound the expectation and the variance of this problem as desired, using a careful probabilistic analysis. 

Unfortunately, we now have one other problem. Under this actual definition of x, <Ref> no longer 
holds since the x-value we assign to edges of a vertex joining 𝒞 is no longer 1. However, we can analyze this step more carefully, and obtain an approximate version of this equation in expectation, i.e., prove that

    ∑_e ∈ E x_e≥1/2·𝒞.

This is sufficient to perform the above primal-dual analysis. 

In conclusion, we designed a “light weight” reduction that given a single execution of the randomized greedy MIS, finds an O(1)-approximate fractional matching in expectation. 



  §.§.§ Our Dynamic Streaming Algorithm for Matchings


The next step is to incorporate our reduction from fractional matchings to randomized greedy MIS in the semi-streaming implementation of <cit.>. 
We will be running the algorithm of <cit.> and then maintain enough auxiliary information along the way to be able to implement our own reduction
for finding a fractional matching. 
The issue here is to figure out which edges should be assigned a fractional matching, and with what value. Addressing this issue requires bypassing several challenges that we outline below, but we should right away note that we will not be able 
to  implement this reduction in a black-box way, and need to settle for some relaxations.  



  
Challenge 1: Large support in fractional matchings. An obvious but easy-to-address issue is that the support of the fractional matching x ∈^E returned by our reduction can be quite large (e.g., on a clique, it involves all the edges). 
Hence, we simply cannot hope to recover it with a semi-streaming algorithm. However, given that our original goal was not to recover this particular fractional matching, but rather find some large matching in the input graph, 
we can use a standard trick: we only need to sample each edge of the graph independently with probability ≃ x_e ·ln(n). Then, one can use a standard analysis[We emphasize that the independence in sampling is crucial here and is the key difference between our fractional matching and the one used in the analysis of <cit.>. Running the randomized greedy MIS and picking the blocking edges does indeed sample each edge with probability proportional to some fractional matching; however, the choice of edges are positively correlated, hence forming many stars instead of a large matching; see <Ref>.] to argue 
that the set of sampled edges contains an integral matching with size within a constant factor of the original fractional matching x. 

As such, our goal in implementing the reduction is to be able to determine the value of x_e for each edge in the stream at the time when an update to this edge happens (either insertion or deletion); then, using 
standard sparse-recovery primitives, we will be able to perform the sampling step above and recover a large enough matching. 



  
Challenge 2: Determining neighbors of a vertex v joining the vertex cover. In the fractional matching x ∈^E, 
whenever a vertex v joins the vertex cover 𝒞, it will assign a value of 1/(v) to (a subset of) its neighbors that are still present in the graph. 
But this requires the semi-streaming implementation to be able to determine the neighborhood of every vertex at the time it joins the vertex cover, despite the fact that <cit.> processes the input in large batches 
of vertices without looking at the entire graph. See <Ref>. 




To address this, we augment the semi-streaming algorithm to add a time stamp t(v) to each vertex v that joins the vertex cover: this is the index of the vertex u ∈ N(v) in the random ordering whose choice
in the MIS led the algorithm to add v to the vertex cover. If we compute these time stamps, then, for any vertex v, the set of its neighbors that are still present in the graph when v joins the vertex cover is all vertices w ∈ N(v) with t(w) ≥ t(v). 

But we now have another challenge: how can we compute these time stamps? As argued earlier, in <cit.>, figuring out if a vertex v needs to join the vertex cover after processing a batch U_i, amounts to finding 
if v has any neighbor to the newly added vertices ℐ_i ⊆ U_i to the MIS. This can be handled using a simple counter. But, figuring out the time stamps of v requires finding the smallest-index neighbor of v in ℐ_i.
In general, finding the minimum entry of an array of length m (corresponding to vertices in U_i) undergoing insertion and deletions is not possible in m^o(1) space and o(logm) passes which is way above our budget 
(indeed, this fact is the basis of the Ω(logn)-pass lower bound of <cit.> for findings MSTs in dynamic streams). 

Fortunately, it turns out the minimum-entry problem we need to solve here has a special form. To see this, we once again rely on the residual sparsity property of the randomized greedy MIS.
This time, we further partition each batch U_i into O(logn) sub-batches of geometrically increasing sizes. We can then prove that, with high probability, for every vertex v, 
the first sub-batch that contains at least one neighbor of v in ℐ_i, can also only have ≲logn neighbors of v (in ℐ_i) in total. In other words, except for a negligible probability, 
it is not possible that an “empty” sub-batch with no neighbor of v is followed by a “full” sub-batch with many neighbors of v. Using this property and standard sparse-recovery ideas, we show that 
we can run <cit.> as is, and then spend O(1) passes and O(n ·log(n)) space and recover the time stamps of all vertices as well. 



  
Challenge 3: Determining which edges receive fractional matchings. Recall that the fractional matching x ∈^E in our reduction, for each vertex v joining the vertex cover,  adds 1/(v) to each edge (v,w)
when (w) ≤(v) and not all neighbors of v; this was the crucial technical modification we needed for the correctness of the reduction. What we described so far allows us to determine the value of (v) at the time v joins the vertex cover. 
But to know which edges can receive this fractional value, we additionally need to compute (w) at the time v joins the vertex cover and not w itself. This is simply way too much information to even store, yet alone compute,
and we cannot hope to achieve this in the semi-streaming space at all. 

The solution to this challenge is to delegate some computation of the fractional matching in the reduction to the analysis instead. Specifically, in our semi-streaming implementation, we are simply going to
compute the time stamps as described before. Then, for every vertex v, we can figure out the remaining neighbors of v at the time v joins the vertex cover and sample ≃logn/(v) fraction of remaining neighbors of v. 
The total number of edges sampled this way will be ≃ nlogn edges still and we can find them using a sparse-recovery approach (albeit, for technical reasons, this part of the argument is more subtle and needs to work with limited-independence
hash functions). The rest of the algorithm is to simply return a maximum matching of these sampled edges. For the analysis only, we perform a simple rejection sampling idea to recover a sub-sampled version of the fractional matching x 
in the reduction, using the already sampled set of edges, and use this to argue about existence of a large matching among the sampled edges. 

In conclusion, our dynamic semi-streaming algorithm involves: (i) running the O(loglogn)-pass semi-streaming algorithm of <cit.> for simulating the randomized greedy MIS; (ii) spending O(1) passes to 
recover the time stamps of all vertices and using them to sample ≃ nlogn edges from the graph guided by our reduction of matching to greedy MIS; and finally (iii) returning
a maximum matching of the sampled edges. This gives an O(1)-approximate semi-streaming algorithm for maximum matching in O(loglogn) passes. As stated earlier, we can then use this algorithm in existing boosting frameworks 
for matchings to improve the approximation ratio to (1+) for any constant > 0 within the same asymptotic space and number of passes. 












 §.§ Overview of Lower Bound


Our lower bound uses the very recently developed technique of hierarchical embeddings in <cit.> and adapts it to proving dynamic streaming lower bounds, as opposed to insertion-only ones in <cit.>. 
We start by providing a quick overview of this technique and the challenges along the way in adapting it for our purpose. We then describe our fixes for them which also involve borrowing ideas from 
prior work in <cit.>—for single-pass dynamic streaming matching—to construct hard instances of the problem and <cit.>—for multi-pass dynamic streaming MST—as part of the information-theoretic 
analysis of these instances.  



Before starting the rest of this section, a quick comment in order. Our lower bounds (as well as prior work in <cit.> and almost all other streaming lower bounds) rely heavily on communication complexity arguments. 
As such, we go back and forth freely between communication and streaming in our discussions. A reader unfamiliar with communication complexity may want to review <Ref> for a basic introduction and its connection to streaming before proceeding. 



  §.§.§ The Hierarchical Embedding Technique of <cit.>


The Ω(loglogn) pass lower bound proven in <cit.> for finding MIS in insertion-only streams is based on a new communication/streaming lower bound technique termed hierarchical embeddings. 
At a (very) high level, this works as follows: A hard instance for p-pass 
streaming algorithms that solve MIS on n_p-vertices is constructed by `embedding' a collection of a × b hard instances 

    := G_i,j_i ∈ [a],j ∈ [b]

 for (p-1)-pass algorithms of MIS on smaller n_p-1-vertex graphs. All these smaller instances in  are put together inside a single graph G in such a way that: (i) finding MIS of G requires solving a special subset _ := _,j_j ∈ [b] of b of these (p-1)-hard 
instances for some ∈ [a]; but, (ii) these specific instances are hidden in the first pass of the algorithm, i.e.,  is not known to the algorithm, until effectively the end of its first pass. See <Ref>
for a rough illustration. 



Based on this construction, <cit.> proves that any algorithm now effectively has two choices: 

	
  * Either spends Ω(a · b) space to learn some non-trivial information about all the sub-instances in  with the hope of learning something non-trivial about the b special hidden ones; 
	
  * Or, spends its first pass simply to learn  only and then in the remaining p-1 passes, solve all the b special (p-1)-hard instances in _ independently, each on a different n_p-1-vertex graph. 

Let us use s_p(n) to denote the minimum space needed for solving MIS on p-pass instances of this distribution on graphs with n vertices. Then, the above two choices imply that 

    s_p(n_p) ≳mina · b , b · s_p-1(n_p-1);

the second term is because in the second scenario above, the algorithm has effectively learned nothing non-trivial about the special hidden instances and now only has (p-1) passes to solve b independent (p-1)-pass hard instances; 
thus, by induction and a direct-sum type argument, we can expect this task to require b · s_p-1(n_p-1) space. 

Working out the right parameters and using existing lower bound of s_1(n) = Ω(n^2) previously established <cit.> for the induction base implies that 

    s_p(n) ≳ n^1+1/2^Ω(p),

which in turn implies an Ω(loglogn)-pass lower bound for semi-streaming algorithms. 

Despite the clean plan above, formalizing this idea in <cit.> is quite challenging and involves handing the following two disjoint aspects of this approach: 



  
Combinatorial aspects. We need to pack many subgraphs of  inside a single graph G while ensuring that they do not interfere with 
each other so as to not “corrupt” their (p-1)-pass hardness properties. At the same time, the graph G should also force the algorithm—that is only tasked with solving MIS on a single graph G—to also solve MIS of all the special hidden instances in _, 
without revealing the identity of ∈ [a] in the first pass.  
This in particular requires the induced subgraph[This is actually only true about the graph appearing in the first half of the stream (which is oblivious to the choice of ) and not the entire graph; 
while this is a crucial aspect in <cit.>, we skip it in this informal discussion.]  of G on each of the sets _i for i ∈ [a] to consists of solely the edges of subgraphs in _i. This is a quite stringent combinatorial requirement and 
is handled in <cit.> by the introduction of a new family of extremal graphs that generalize (RS) graphs <cit.>; as this will be too much of a detour, we refer the reader to <cit.> for more details here.



  
Information-theoretic aspects. While the two scenarios for different types of semi-streaming algorithms outlined above provide a good intuition about  natural strategies, 
in reality, algorithms are not forced to follow such strategies. For instance, they may decide to correlate the b special instances in the remaining (p-1) passes 
instead of treating them independently. Analyzing arbitrary algorithms requires maintaining different (conditional) independence properties between different parts of the inputs and then using various information theory tools. 
This in particular includes information complexity direct sum arguments <cit.> and message compression techniques <cit.> on one hand, 
and generalizing standard round elimination arguments in <cit.> on the other. We again refer the reader to <cit.> for more details. 

We now mention the additional challenges of applying this technique for our purpose of proving a dynamic streaming lower bound for O(1)-approximation of matchings. 



  §.§.§ Challenges of Applying Hierarchical Embeddings for Approximate Matchings
 


To apply the hierarchical embedding technique of <cit.> for our purpose, we need to change both the above aspects of this technique entirely, due to the following challenges. 



  
Challenge 1: Combinatorial aspects of O(1)-approximate matchings. In the language of <cit.>, to force a p-pass O(1)-approximation algorithm for matchings on a graph G to have to solve
the (p-1)-pass instances of the matchings in the special hidden instances _, we need the majority of edges in all large matchings in G to come solely from instances _. This means that except for the edges of _, all other edges of G should admit a vertex cover with o(n) vertices. If we attempt to create our hard instances in the same way as <cit.>, 
this, at the very least, requires every _i for i ∈ [a] to contain an induced matching of size n-o(n) in the graph. This is way too stringent of a combinatorial requirement, and it is easy to argue that any graph admitting such a 
property can only contain O(n) edges in total (see <cit.>). Thus, the semi-streaming algorithm can simply store this graph in its memory and solve the problem exactly. 

Of course, it is no surprise that this approach does not work for matchings, since it is tailored toward  insertion-only streams (which admit a simple 2-approximation single-pass algorithm). 
For our purpose, we instead use an idea due to <cit.> for proving single-pass O(1)-approximation lower bounds for matchings in dynamic streams. This effectively allows us let go of the group-structure 
of sub-instances (i.e., their partitioning into _1,…,_a) and create an instance that involves only one induced set of (p-1)-pass instances (instead of many groups of them but then picking one group to be special as in <cit.>). 
We discuss our fix here in <Ref>. 



  
Challenge 2: Information-theoretic aspects of O(1)-approximate matchings. Addressing the previous challenge using edge deletions creates a significant hurdle in applying the information-theoretic arguments of <cit.>. 
On one hand, to ensure that we are working with correct dynamic streams, we need to ensure that the edges deleted in the second half of the stream already have appeared in its first half. 
But this means that the inputs in the second half and the first half of the stream have to be highly correlated, which breaks the independence properties 
used in <cit.> for their information-theoretic arguments. 

To address this challenge, we further borrow ideas from arguments of <cit.> for their single-pass lower bounds using augmented Index communication problem – roughly speaking, augmented Index
can be seen as the base case of the “augmented” round elimination technique of <cit.> (which <cit.> generalizes in the “non-augmented” case). Fortunately for us, <cit.> 
have recently showed a way to properly augment the input of players even for multi round/pass algorithms on dynamic streams, namely, which parts of the inputs of players to share, and which to keep hidden, 
in a way that generalizes the augmented Index the “right way”. Thus, to obtain our result, we need to generalize the augmented round elimination lemma of <cit.> and its dynamic streaming version in <cit.>, 
 in a similar manner that <cit.> did for the non-augmented round elimination in <cit.>. We discuss our approach in <Ref>. 



  §.§.§ Addressing Challenge 1: Our Combinatorial Construction


We now discuss our fix to challenge 1 above, starting with an overview of the prior work of <cit.>. 



  §.§.§ Single-pass lower bound construction of <cit.>
 

The authors in <cit.> proved an Ω(n^2)-space lower bound for O(1)-approximation of matchings in single-pass dynamic streams. Prior to <cit.>, all semi-streaming lower bounds for approximate matchings 
in insertion-only streams <cit.> or dynamic streams <cit.> relied on various combinatorially complex constructions 
based on RS graphs. On the other hand <cit.> designed an elegant method of replacing these combinatorial constructions in dynamic streams with much simpler graphs by crucially exploiting the edge deletions in the stream. 

Consider the following communication problem. 


  * Alice receives an n × n matrix A encoding the bipartite adjacency matrix of a random bipartite graph G between two sets of vertices L and R, each of size n. 
Each entry of A is independently chosen to be 0 or 1 with probability half. 

We think of the input to Alice as the insertions of edges  at the beginning of the stream. 

  * The input to Bob is random permutations σ_r and σ_c of [n] 
that reorder rows and columns of A, respectively. Bob is also given the following submatrix B of A: reorder the rows and columns of A according to σ_r and σ_c; then, 
for some previously-fixed = n-o(n), consider the (×) submatrix of A at the bottom right corner of A (after the reordering). Provide this sub-matrix except for its diagonal entries as B, and let 
diagonal entries of B be 0's instead. 

We think of the input to Bob as the deletion of edges  in the second half of the stream (based on the bipartite adjacency matrix). Since B is a submatrix of A, all edges deleted by Bob are already inserted by Alice. 
The input graph G at the end of the stream is then the bipartite graph on bipartition L and R and edges ∖. 


It is not hard to see that the graph G created this way has an induced matching M of size n/2-o(n) with high probability (inside the submatrix B of A with edges A - B). 
Moreover, the graph G ∖ M has a vertex cover of size o(n) (by picking the o(n) vertices not part of B). This implies that any O(1)-approximate matching algorithm
on the graph ∖ needs to recover many edges of M. See <Ref> for an illustration. 



In <cit.>, it was shown that given only A and without the knowledge of σ_r and σ_c, majority of edges in  have an equal chance of appearing as the edges of the induced matching M. 
Thus, from Alice's perspective, most edges in  can become important in finding a large matching in ∖. Hence, Alice needs to communicate Ω(n^2) bits before Bob can output
an O(1)-approximate matching in the graph (this argument misses the crucial information-theoretic aspect that Bob has the knowledge of  and thus knows “a lot” about A already; but we postpone this part to the discussion in <Ref>). 



  §.§.§ Our multi-pass lower bound construction
 

We are now finally ready to state how we create our hard instances. We define a new two-player communication problem, called Augmented Hidden Matrices (AHM), 
inspired by the construction of <cit.> described earlier. We then use the standard connection between streaming and communication complexity (<Ref>) to turn r-round communication lower bounds 
for AHM into Θ(r)-pass lower bounds for streaming algorithms. 

An r-round instance of AHM consists of two matrices A and B and is denoted by AHM_r(A,B). 
As before, matrix A (resp. B) corresponds to bipartite adjacency matrix of a bipartite graph on n vertices (resp. n-o(n) vertices) on each side. 
Moreover, A will determine edges  to be added to the graph and B will determine ⊆ to be deleted[ This is actually only true when r is an odd number but we will ignore this subtlety for this discussion; however, we 
note that in our streaming lower bounds, r will always be chosen to be odd.]. These edges are  such that any O(1)-approximation of matchings on the graph ∖ 
allows for solving the instance AHM_r(A,B). Crucially different from <cit.> however, it is not the case that A is entirely an input to Alice and B is input to Bob (but rather both players receive different parts of both matrices). 

Following the hierarchical embedding technique, an instance of AHM_r(A,B) is created from many instances of AHM_r-1 as follows (see <Ref> for an illustration): 

	
  * Let n_r and n_r-1 denote, respectively, the number of vertices in instances AHM_r and AHM_r-1, and t_r := n_r/n_r-1. 
	Start with a (t_r × t_r) matrix of (r-1)-hard instances 
	
    ℐ := (r-1_i,j, r-1_i,j)_i ∈ [t_r], j ∈ [t_r],

	where each (r-1_i,j,r-1_i,j) is an instance of AHM_r-1 on n_r-1 vertices. 
	
	
  * Matrix A is an (n_r × n_r) matrix 
	defined as follows. Partition the rows and columns of A into t_r groups of size n_r-1 (say, the first n_r-1 are in group one, the second in group two, and so on and so forth). 
	Then, matrix A is obtained by plugging matrix r-1_i,j between group i of rows and group j of columns.[It is worth making two remarks. Firstly, in a typical round elimination argument, we often remove the first round of 
	a protocol that Alice speaks first to obtain an (r-1)-round protocol wherein Bob speaks first. But, this means that for the underlying instances, the role of Alice and Bob keeps switching, hence, here the B_i,j-matrices (which one typically associated 
	with Bob's input) are instead defining A (which again is typically associated with Alice's input). Secondly, even though the matrices r-1_i,j are not used at the moment, some information about them actually will be revealed to Alice and Bob 
	which is crucial for the lower bound; this will be discussed later on.]
	
	In terms of the underlying graph, we think of each r-1_i,j inside A as defining edges between two distinct sets of n_r-1 vertices in the bipartite graph G (over the same grouping of vertices as rows and columns of A). 

	The set  of edges to be inserted to the graph are defined this way by the matrix A. 
	






	
  * Matrix B is an (n_r - o(n_r) × n_r - o(n_r)) matrix defined as follows. We pick two random permutations σ_r and σ_c of [t_r]; these correspond
	to reordering the row-groups and column-groups of the matrix A, or equivalently rows and columns of the instance-matrix ℐ.
	For some previously-fixed = t_r - o(t_r), define the instance-matrix ℐ_induced⊆ℐ as the (×) submatrix of ℐ 
	 in the bottom right corner after we apply the reorderings σ_r and σ_c. 
	 Similarly, define ℐ_special as the collection of  instances in the diagonals of ℐ_induced. Matrix B consists of submatrices r-1_i,j on 
	 the off-diagonal entries of ℐ_induced, i.e., instances in ℐ_induced∖ℐ_special and submatrices r-1_i,j on the diagonal entries, i.e., instances in ℐ_special. 
	
	In terms of the underlying graph, the sub-matrices in B are again mapped to the edges of the graph G in a similar way as matrix A. However, this time edges in B are being deleted from the graph G 
	and thus define the set  instead. 
	 	
	


The conclusion of this construction is that in the graph G, all edges inserted by A corresponding to instances in ℐ_induced∖ℐ_special are being deleted by B, 
while for the instances in ℐ_special, we will end up having a graph corresponding to an instance of AHM_r-1 (their B-side is inserted and their A-side is deleted here). This way, the graph G consists of 
a collection of = t_r - o(t_r) induced hard (r-1)-round instances in ℐ_induced on a set of n_r - o(n_r) vertices; if we ignore edges of these instances, then the entire graph 
has a vertex cover of size o(n_r). 







To see the intuition behind why such instances should be hard consider the following. Graph G created this way contains a very large induced subgraph consisting of vertex-disjoint copies of hard (r-1)-round instances, namely, 
the ones in ℐ_special. Moreover, all other edges of the graph can only form matchings of size o(n_r) given they are incident on o(n_r) vertices (i.e., the vertex cover argument above). 
This means that any O(1)-approximate matching algorithm needs to find large matchings from many of the AHM_r-1 instances in ℐ_special; in other words, it needs to “solve” these instances as well. 
In the language of hierarchical embeddings, we reduced AHM_r to t_r instances of AHM_r-1 (albeit with some loss in the parameters, which will be handled carefully in the proof). 



  
What about the parameters? Let us again consider the two natural choices of the algorithms: 

	
  * Either spend Ω(t_r^2) communication/space to learn something non-trivial about the t_r hidden instances in ℐ_special; the reason behind this “discounting” of information by a factor of t_r 
	is that, similar to the construction of <cit.>,  it is the case that the t_r instances in ℐ_special are effectively uniform (although only marginally) among the majority of the t_r^2 instances in ℐ; 
	
  * Or, spend communication/space proportional to what is needed to solve (most of) the t_r instances in ℐ_special in only (r-1)-rounds and independently. 

By using s_r(n_r) to denote the communication/space needed for solving AHM_r on n_r-size instances, the above suggests that 

    s_r(n_r) ≳mint_r^2 , t_r · s_r-1(n_r-1) = minn_r/n_r-1^2 , n_r/n_r-1· s_r-1(n_r-1).

Using s_1(n_1) = Ω(n_1^2) as the base case by the lower bound of <cit.>, we obtain 

    s_2(n_2) ≳minn_2/n_1^2 , n_2 · n_1 = n_2^4/3,

by letting n_2 = (n_1)^3. Repeating this inductively using <Ref> allows us to prove that 

    s_r(n) ≳ n^1+1/2^Ω(r).

This implies that Ω(loglogn) rounds are needed by (n)-communication protocols for AHM_r and in turn Ω(loglogn) passes are needed by semi-streaming algorithms for O(1)-approximation of matchings. 





  
How is the input partitioned? One thing that we have neglected so far is specifying what the input to Alice and Bob precisely are in the AHM_r(A,B) problem. 
Naturally, Alice receives the matrix A and Bob receives the submatrix B. But since these matrices have quite a lot of overlap with each other on one hand, and the recursive nature of the instances, on the other hand,
we need to specify this more accurately (for instance, in the special induced instances in ℐ_special, Alice again receives some parts of B, and recursively like this). 
Specifying full details of this partitioning recursively is beyond the scope of this overview, but roughly speaking this is how the partitioning of inputs looks like (see <Ref>): 
 


[20]r0.45
    
    < g r a p h i c s >

An illustration of the input partitioning of Alice and Bob in an instance of AHM_r with the sub-matrix of Bob shown (in blue). 
Here, A refers to some r-1_i,j∈ℐ given to (r-1)-round Alice and B similarly is for some r-1_i,j∈ℐ
given to (r-1)-round Bob. In the AHM_r instance, Alice receives all the B's and Bob receives all the A's, and additionally the B's on the off-diagonal sub-matrix (shown in bold).



	
  * The r-round Alice in AHM_r(A,B) receives all the inputs that (r-1)-round Bob receives (recursively) in all instances of ℐ. 
	
	
	
  * The r-round Bob in AHM_r(A,B) receives: 
	
	
  * all the inputs that both (r-1)-round Alice and (r-1)-round Bob (recursively defined) in all non-special (= off-diagonal) induced instances, i.e., in ℐ_induced∖ℐ_special; 
	
  * and, all the inputs of only (r-1)-round Alice (recursively defined) in the special (= diagonal) induced instances, i.e., in ℐ_special. 
	


With this input partitioning, Alice can insert all edges in B and Bob is able to delete all edges inserted by Alice in the off-diagonal instances to create the “inducedness property”, 
and delete just enough edges from the diagonal instances to make them truly a hard (r-1)-round instance (we  caution the reader that this view is only true for odd values of r; see <Ref>). 



It is also worth mentioning that edges entirely out of the sub-matrix B of Bob do not form any real instance of AHM_r, given that the other parts of their inputs is never added to the graph. 
However, these are the edges that are incident on the o(n_r) size vertex cover of the graph G minus edges of special instances in ℐ_special; our lower bound construction does not require any property
from these edges beside that they do not form a large matching which is guaranteed by the vertex cover argument. As such, not having real instances here is not a problem from the combinatorial aspect. At the same, 
information-theoretically it is quite crucial that Bob has no knowledge of this part of the graph, and we shall use this crucially in the next part. We remark that this way of partitioning the input in our work
has also appeared recently in the multi-pass dynamic streaming lower bound of <cit.> for MSTs to facilitate their information-theoretic arguments. 

The remaining and the most technical part of the argument is to formalize the intuitions in this subsection for the hardness of our instances and prove <Ref> information-theoretically. 













  §.§.§ Addressing Challenge II: Information-Theoretic Arguments


We now discuss the proof ideas in the communication lower bound in <Ref>. Let us go back to the one-round lower bound of <cit.> and the part we explicitly left out for here. Already in the one-round problem, 
why it should be the case that Alice's o(n^2)-size message cannot reveal much information about diagonal entries Bob needs to output, despite Bob knowing a great deal about Alice's matrix A, i.e., 
all the off-diagonal entries of B, which form the vast majority of A. 

The proof in <cit.> actually showed a weaker guarantee than what we advertised before (and need in our proofs). Specifically, <cit.> only proves that the entry A[σ_r()][σ_c()] (the top left entry of the diagonal) 
cannot be revealed by a small message from Alice even given Bob's matrix B. They then used this fact in a separate randomized reduction to extend this lower bound to O(1)-approximation of matchings. 
This proof however does not work in the  plan we outlined above, which requires the lower bound for solving many lower-round instances instead of just one. 

To handle this, we are going to provide a different proof here compared to <cit.> which is in fact a technical contribution of our work. In particular, this already shows that none of the diagonal entries of B (to be more accurate A on rows and columns of B) can be revealed by Alice's message (this is in a marginal sense, i.e., the information revealed about any one entry on the diagonal is o(1) bits, even conditioned on all the other diagonal values).   



  
A new one-round lower bound. Consider the input permutations σ_r and σ_c of [n] given to Bob and suppose our goal is to return the j-th diagonal entry, i.e., 
return A[σ_r(n-+j)][σ_c(n-+j)]. Define the following two sets of rows and columns (see <Ref> for an illustration):

	
  * T_row: the rows in the entire A that cover rows of B except for the j-th one, i.e., 
	
    T_row := σ_r(n),σ_r(n-1),…,σ_r(n-)∖σ_r(n-+j).

	
  * T_col: the columns in the entire A that cover columns of  B except for the j-th one, i.e., 
	
    T_col := σ_c(n),σ_r(n-1),…,σ_c(n-)∖σ_c(n-+j).
 




It is easy to see that if we provide Bob with A[T_row][T_col] (namely, A on the entries in T_row and T_col) we have provided him with more information than his original input in the off-diagonal entries of B. 
On the other hand, a critical observation is that conditioned on the choices of T_row,T_col  (but crucially not σ_r and σ_c), the special entry A[σ_r(n-+j)][σ_c(n-+j)]
is chosen uniformly from all unfixed entries of A, namely, A ∖ A[T_row][T_col]. This is sufficient (using a simple application of chain rule of mutual information) for proving that a 
message of size ≪ (n-T_row) · (n-T_col) cannot reveal more than o(1) bits about the special entry Bob needs to output, even conditioned on A[T_row][T_col] (which fixes off-diagonal entries of B). 
This proves the one-round lower bound. 

We note that these types of chain rule arguments (by conditioning on partial parts of permutations) have also appeared in somewhat similar contexts elsewhere, e.g., in <cit.>. 



  §.§.§ Our multi-round lower bound

 At last, we are ready to review our approach for proving our multi-round lower bound for the AHM_r problem introduced in <Ref>, namely, prove <Ref>.  
This follows the three-step approach put forward by <cit.> in proving their general round elimination argument, but with a different argument for each step, as we outline below. 



  
Step 1. Turn an r-round protocol _r for AHM_r with communication cost s to an r-round protocol 1_r for solving AHM_r-1 with communication cost s but information cost (see <Ref>) ≲ s/t_r. 
	
	The intuition behind this step is that any protocol for AHM_r needs to solve = t_r-o(t_r) independent instances of AHM_r-1. As such, we expect that the information it reveals about a random such instance
	to be 1/t_r times the total information cost of the protocol which is upper bounded by its communication cost. This is basically a direct sum argument. 
	
	The difference between our approach and <cit.> is in the nature of this direct sum argument. Specifically since our input distributions are not product, 
	we use internal information cost to implement this step (as opposed to external information in <cit.>). 
	A quick description of this step for a reader already
	familiar with internal information cost direct sum arguments (e.g. <cit.>) is the following[This is not the exact way we sample the input distribution and we have been slightly flexible in the overview.]: (i) Using public randomness, Alice and Bob sample j ∈ [] and all off-diagonal induced instances, 
	(ii) embed the given instance of AHM_r-1 at the j-th diagonal entry of the the special induced instances, and (iii) for every remaining instances (diagonal or entirely out of Bob's submatrix), 
	sample one part of the input publicly and the other privately (this way, we can sample from non-product distributions correctly). The exact choice of this public-private sampling is a function of the input sharing of the players
	and is similar in nature to <cit.>. 
	






  
Step 2. Turn the r-round protocol 1_r for AHM_r-1 with information cost s/t_r to an r-round protocol 2_r for solving AHM_r-1 with communication cost ≲ s/t_r ·(r). 
	
	This step is based on existing message compression arguments that allow for compressing the communication of a limited round protocol, down to its information cost. 
	The difference in this step between our approach and <cit.> is that we use the compression technique of <cit.> for internal information cost whereas <cit.> uses <cit.> 
	for external information. 
	


  
Step 3. Turn the r-round protocol 2_r for AHM_r-1 with communication cost s/t_r ·(r) to an (r-1)-round protocol _r-1 for solving AHM_r-1 with the same communication, 
while incuring an additional o(1) additive factor on error probability as long as s ≪ t_r^2. 
	
	This step is the real round elimination step, wherein we finally obtain an (r-1)-round protocol. This part of the argument is quite problem-specific and is entirely disjoint from <cit.>. Specifically, 	
	the additive factor in the error probability comes from a similar argument as our one-round lower bound outlined above. The choice of a 
	random special instance in ℐ_special among the t_r^2 instances in ℐ used in creating an instance of AHM_r, is random 
	among ≃ t_r^2 instances even conditioned on the input of Bob (namely, the off-diagonal entries in ℐ_induced∖ℐ_special). 
	As argued earlier, Alice's first message should only be able to reveal o(s/t_r^2) information about a random diagonal AHM_r-1 instance _r-1 is solving even conditioned on Bob's input in the entire AHM_r instance (and not only AHM_r-1). Thus, even if we ignore the first message of 2_r and instead run it from its second run onwards, as long as s ≪ t_r^2, we should expect 
	a very similar outcome for the underlying instance AHM_r-1 as if we run the whole protocol. 
	
	Given the technical nature of this step, we postpone more details of this step to the actual proof, and only mention that this step, is the heart
	of our information theoretic arguments.  
	



  
Concluding the proof. 

After these steps, we obtain that as long as s ≪ t_r^2, the resulting (r-1)-round protocol _r-1 for AHM_r-1 succeeds with a non-trivial probability. But, given that communication cost of _r-1 is s/t_r ·(r), 
we obtain that 

    s/t_r·(r) ≳ s_r-1(n_r-1),

where s_r-1(n_r-1) is the communication cost of protocols for AHM_r-1 on n_r-1-size inputs we have inductively established. Stated differently, this implies that either 

    s ≳ t_r^2     or     s ≳1/(r)· t_r · s_r-1(n_r-1),

which establishes <Ref> (the (r)-term is negligible for our purpose as r=O(loglogn) always). 



In conclusion, this way we can establish a lower bound of n^1+1/2^Ω(r) communication for r-round protocols for AHM_r. By our reduction to the matching problem, this in turn
implies that any p-pass streaming algorithm for O(1)-approximation of matchings requires n^1+1/2^Ω(p) space; in particular, semi-streaming algorithms require Ω(loglogn) passes as desired. 










































§ PRELIMINARIES




  
Notation. Throughout, for any integer n ≥ 1, we define [n] := 1,…,n. 
For a vector x ∈^n, we use x_0 to denote the number of non-zero entries in x. 


We use S_n to denote the set of all permutations over [n] for any n ≥ 1. 
For any permutation σ∈ S_n, we use σ(i) to denote the element in [n] that σ maps i to for each i ∈ [n]. 

For any tuple (x_1,…,x_n) and i ∈ [n],  
we define x_<i := (x_1,…,x_i-1). We define x_>i and x_-i, analogously. For a set of tuples (x,y) | x ∈ X, y ∈ Y for some 
sets X and Y, and any x ∈ X, we define (x,*) := (x,y) | y ∈ Y. 

For any matrix Z of dimensions m × n for integers m,n≥ 1, we use Z[i,j] to denote the value at row i and column j for i ∈ [m], j ∈ [n]. 

For a graph G=(V,E) and any vertex v ∈ V, we use N(v) to denote the neighbors of v and v := N(v) to denote its degree.  For any U ⊆ V, we use G[U] to denote the subgraph of G induced on vertices in U. 
We further use μ(G) to denote the maximum matching size in G. 



  
Random variables and information theory notation. When there is room for confusion, we use sans-serif letters for random
variables (e.g. ) and normal letters for their realizations (e.g. A). We use  and  to denote the distribution and support of , respectively. 

For random variables ,, we use  to denote the Shannon entropy
and  to denote the mutual information. For two distributions μ and ν on the same support, μν denotes their total variation distance 
and μν is their KL-divergence. <Ref> contains the definitions of these notions and standard
information theory facts that we use in this paper. 



  
Fractional matchings.  A fractional matching in a graph G=(V,E) is any assignment x ∈^E to the edges E of G with the following properties: 

    for all e ∈ E:   0 ≤ x_e ≤ 1;   and  for all v ∈ V:   x_v := ∑_e ∋ v x_e ≤ 1.

We use x := ∑_e ∈ E x_e to denote the size of the fractional matching x. 

It is easy to see that incidence vector of a matching M is also a fractional matching of size M. The following standard fact (see, e.g. <cit.>) provides the other direction as well. 


	For any graph G=(V,E), and any fractional matching x ∈^E, we have μ(G) ≥ 2/3 ·x. Moreover, if G is bipartite, then μ(G) ≥x. 





 §.§ Concentration Inequalities


We use the following standard form of Chernoff bound and its extension to negatively correlated variables in <cit.>. 


	Let X_1,…,X_n be n independent random variables in [0,1] and X := ∑_i=1^n X_i. For any δ > 0 and μ_min≤X≤μ_max, 
	
    X ≥ (1+δ) ·μ_max≤exp-δ^2 ·μ_max/2+δ   ,   X ≤ (1-δ) ·μ_min≤exp-δ^2 ·μ_min/2.
 	
	Moreover, the upper tail bound continues to hold as long X_1,…,X_n are negatively correlated, i.e., for every S ⊆ [n], 
	
    ∏_i ∈ S X_i≤∏_i ∈ SX_i.



We also need the extension of Chernoff-Hoeffding bounds to limited independence random variables. We define limited independence hash functions first. 


For integers r, t, k ≥ 1, a family  of hash functions from [r] to [t] is called a k-wise independent hash function iff for any two k-subsets a_1, a_2, …, a_k ⊆ [r] and b_1, b_2, …, b_k ⊆ [t], 

    h ∼(h(a_1) = b_1, h(a_2) = b_2, …, h(a_k)  = b_k) = 1/t^k.



k-wise independent hash functions behave like random functions, as long as sets of size at most k are considered. 
We know that we can store and access these functions in limited space. 


	For any integers r, t, k ≥ 1, there is a k-wise independent hash function family = h : [r] → [t] such that sampling and storing a function h ∈ takes O(k · (log (r· t))) space. 


We can now state the extension of Chernoff bounds for limited independence hash functions.


	Let X_1, X_2, …, X_n be k-wise independent random variables in [0,1] and X := ∑_i=1^n X_i. Then, for any δ≥ 1 and X≤μ_max, we have,
	
    (X ≥ (1+δ) ·μ_max) ≤exp-min{k/2, δ/3·μ_max}
.
		We also have the following lower tail bound for any δ'≤ 1 and μ_min≤X.
	
    (X ≤ (1-δ')·μ_min) ≤exp-min{k/2, (δ')^2/3·μ_min}.






 §.§ Sketching and Streaming Toolkit




  §.§.§ Sparse-Recovery Algorithms
 



We use standard sparse-recovery algorithms combined with a simple randomized test to ensure it can also detect non-sparse inputs; see, e.g. <cit.> that construct this using Vandermonde matrices and an equality test 
(see also <cit.> that explicitly shows how to use a PRGs for degree-2 polynomials in <cit.> to ensure that the latter algorithm does not need to store many random bits either). 


	There exists a single-pass deterministic algorithm that given integers q,n,m ≥ 1 and a dynamic stream defining a vector ϕ∈ [m]^n, 
	uses O(q ·log(m · n)) bits of space and recovers ϕ as long as vector ϕ is q-sparse (meaning ϕ_0 ≤ q). 
	
	Moreover, there is a single-pass randomized algorithm that given δ > 0 can test if the vector ϕ∈^n is q-sparse with probability at least 1-δ 
	using O(q ·log(m · n) + log(n/δ)) bits of space. 


We note that the use of sparse-recovery algorithms in graph sketching already dates back to the seminal work of <cit.>. Moreover, many dynamic streaming algorithms 
use a particular application of sparse-recovery in form of ℓ_0-samplers <cit.> that allows for sampling a single element of a given vector ϕ in a dynamic stream
in log(n) space (instead of recovering the entire vector only if it is sparse). However, for our applications, working with sparse-recovery algorithms directly is more convenient and thus 
we opted to skip using ℓ_0-samplers altogether. 






















  §.§.§ Prior Sketching and Streaming Tools for Matchings
 

We use a vertex sampling approach due to <cit.>  that allows for reducing the number of vertices in a graph in an oblivious manner, while preserving its largest matching approximately (see also <cit.> for a related but slightly different result). This is a key subroutine used for finding matchings in dynamic streams in a single pass also. We use the following formulation from <cit.> that presents this result explicitly. 


	Let G=(V,E) be any graph with maximum matching size μ(G) = ω(logn). For any ∈ (0,1), suppose we partition the vertices of G randomly into t ≥ 8μ(G)/ groups U_1,…,U_t 
	by sending each vertex to one group chosen independently and uniformly at random. Let E_U ⊆ E be a subset of edges such that for any pair of groups U_i,U_j for i ≠ j ∈ [t], we pick one arbitrary edge
	(x,y) with x ∈ U_i and y ∈ U_j (if at least one such edge exists). Then, with high probability, μ(E_U) ≥ (1-) ·μ(G). 




We also use the standard framework of boosting O(1)-approximation algorithms for maximum matching to (1+)-approximation algorithms in dynamic streams for any > 0. 
The original version of this framework is due to <cit.> which was de-randomized in <cit.> and extended to weighted graphs in <cit.>; for bipartite graphs, more efficient reductions are shown in <cit.>. 




	For any ∈ (0,1) and any integer n ≥ 1, suppose we have an O(1)-approximation algorithm for finding a maximum matching on n-vertex unweighted graphs in dynamic streams using s(n)-space and p(n)-passes with high probability. 
	Then, there is a dynamic streaming algorithm with O(f() · s(n))-space and O(f() · p(n))-passes that with high probability finds a (1+)-approximation to maximum matching even in weighted graphs, for some function f() that depends only on . 
	
	Furthermore, for general weighted graphs, we can set f() = (1/)^Θ(1/^2), for general unweighted graphs, set f() = (1/)^Θ(1/), and for (un)weighted bipartite graphs, set f() = (1/). 




 §.§ Two-Party Communication Complexity


We work in the standard two party communication model; we provide some basic definitions here and refer the interested reader to the excellent textbooks <cit.> for more details. 

There are two players Alice and Bob who receive input from  and  respectively. The players jointly compute some function f with domain ×. The players follows some protocol  to compute f.
They have access to a shared tape of randomness, referred to as public randomness, in addition to their own private randomness.  


Alice first sends a message to Bob, followed by a message from Bob to Alice and so on. The last player who receives a message has to output the answer. The total number of rounds is the total number of messages passed between Alice and Bob. 
Moreover, the message sent by any player only depends on their private input, the communicated messages so far, the public randomness, and the private randomness.






	For any protocol , the communication cost of , denoted by , is defined as the worst-case (maximum) total length of messages, measured in bits, communicated by the players
	on any input. We assume that all transcripts, i.e., the set of all messages sent by any player, in  have the same worst-case length (by padding).



The following standard result relates communication protocols and streaming algorithms. 


	For any p ≥ 1, s ≥ 1, and δ∈ (0,1), suppose there is a p-pass s-space streaming algorithm A for some problem  that succeeds with probability at least δ. Then, there also exists a two-party protocol  with 2p-1 rounds, communication cost = O(p · s), and success probability at least δ for the same problem . 


	Consider the stream σ = σ_A ∘σ_B where σ_A (resp. σ_B) is the input to Alice (resp. Bob) in  (ordered arbitrarily in the stream). 
	Alice runs A on σ_A and sends the memory content to Bob, which allows Bob to continue running A on σ_B, and send
	the memory content back to Alice to continue running the next pass. This allows the players to run one pass of A using communication cost at most O(s) and 2 rounds of communication.  
	The players can continue this, faithfully simulating the p passes of the algorithm, and at the end of the last pass, Bob can output the answer of A, instead of replying back to Alice. This 
	requires 2p-1 rounds of communication and O(p · s) communication, and has the same success probability as the algorithm A. 

<Ref> allows us to translate communication lower bounds into streaming ones. 





 §.§ Information Cost and Message Compression

We also work with the notion of information cost of protocols that originated in <cit.> and has since
found numerous applications (see, e.g., <cit.> for an excellent survey of this topic). There are various definitions of information cost that have been considered depending on the application.  
The following definition due to <cit.> is best suited for our purpose. 

	For any two-party protocol  whose inputs are distributed according to some distribution μ, the (internal) information cost is defined as: 
	
    μ := |,  + |, ,

	where , denote the random variable for the inputs X, Y sampled from μ,  denotes the random variable corresponding to the communicated messages, and  is the public randomness. 


Since a single bit of communication can only carry one bit of information, we can upper bound information cost by the communication cost. 
 
 	For any protocol  on any distribution μ, 
 	μ≤.
 

We also use message compression to reduce communication cost of limited-round protocols close to their information cost. 
The following is a simplified version of <cit.>.   


For r ≥ 1, any ∈ (0,1), and input distribution μ, any r-round protocol  can be simulated with error at most  in r-rounds by a protocol ' with communication at most

    ·r/·μ + r^2/

for some absolute constant ≥ 1. The simulation by ' uses a source of public randomness that is independent from any randomness used in .





































§ THE UPPER BOUND
 

We present our algorithms in this section. 
We start with a randomized greedy algorithm for finding an approximate fractional matching by growing a random maximal independent set (MIS). 
This algorithm is the power horse of our approach, and, given its general nature, we provide it in an entirely model-independent manner. 
We then show how this algorithm—in a non black-box way—can be implemented in dynamic graph streams as an O(loglogn)-pass semi-streaming algorithm.  
Finally, we show how to improve this algorithm to yield an approximation factor of 1+ and prove the following theorem, which formalizes <Ref>. 


	There is a randomized algorithm that, given any n-vertex graph G=(V,E) presented in a dynamic stream, finds an O(1)-approximate maximum matching in G using O(n ·(n)) space
	and O(loglogn) passes with high probability. 
	
	Moreover, for any > 0, the algorithm can be improved to finding a (1+)-approximation even in weighted graphs by increasing the space and number of passes with some f() factor,
	for some function f that only depends on  (and takes different forms depending on whether or not the graph is bipartite or weighted). 


The rest of this section is dedicated to the proof of this theorem. 





 §.§ A Random-Order Greedy Algorithm for Matching
 

We present a model-independent algorithm for computing an approximate fractional matching. 




The algorithm follows the strategy of <cit.> by computing a random order greedy MIS and letting its complement be a vertex cover. In addition to this, whenever the algorithm inserts a new vertex into the vertex cover, it also puts a certain fractional mass distributed uniformly on some subset of the not-yet-covered edges incident to this vertex. At the end, the algorithm further “trims down” these fractional values to turn them into a fractional matching, by reducing the mass on every vertex to become at most one explicitly. Formally, the algorithm is as follows. 



 An input graph G=(V,E) and an approximation parameter[We note that β is not exactly the approximation ratio that this algorithm achieves, but rather a quantity that governs this ratio.] β∈ (0,1/8). 



	
		
  * Let = ∅ and x_e = 0 for all e ∈ E. 
		
  * While G is not an empty graph: 
		
			
  *  Pick a vertex u uniformly at random from G. 
			
  * Add all neighbors v ∈ N(u) to .  
			
  *  For any v ∈ N(u) and e=(v,w) with (w) ≤(v) set x_e = β/(v). 
			
  * Remove u ∪ N(u) and all their edges from G. 
		
		
  *  Create y ∈^E initialized with y = x. Then, for any vertex v ∈ V with y_v := ∑_e ∋ v y_e > 1, reduce y_v to 1 by arbitrarily reducing the fractional values on incident edges of v. 
		
  * Return  as a vertex cover, x as an intermediate solution, and y as a fractional matching. 
	


The following theorem captures the main properties of this algorithm that are important for our purposes. Given how we use this result in the subsequent sections, we provide separate guarantees for the assignments x and y. 


	Given any graph G=(V,E) and parameter β < 1/8, <Ref> outputs an integral vertex cover , an intermediate solution x ∈^E, and a fractional matching y ∈^E such that 
	
    ∑_e ∈ E x_e≥β/2·, 
       ∑_e ∈ E y_e≥1-8β/1-2β·∑_e ∈ E x_e.



Notice that since  is always a vertex cover, the inequality ≥μ(G) always holds, and, thus, combining <Ref> and <Ref> in <Ref> also directly implies that 

    ∑_e ∈ E y_e≥1-8β/1-2β·β/2·μ(G).

In other words, the fractional matching y returned by the algorithm is a multiplicative approximation in terms of β. However, 
we need the separate guarantees of <Ref> for the analysis of our dynamic streaming algorithm. 

We now start the proof of <Ref>. 
Let T denote the number of iterations of the while-loop in <Ref> (which is a random variable). For each iteration t ∈ [T] of the while-loop, we define: 

    : the graph G in this iteration; 
       : the number of vertices in ; 
       : the number of edges in ; 
       : the vertex u chosen from G in this iteration in Line (<ref>); 
       : vertices added to  in this iteration;
    v   : for each v ∈,  the neighbors of v in ; 
    v   : for each v ∈,  the degree of v in ; 
    e   : for each e ∈,  the value added to x_e in this iteration; 
       : the entire random choices made in iterations 1,…,t-1 by the algorithm.


The first lemma relates the expected size of the vertex cover computed by <Ref> and 
the intermediate solution x that it computes, thus proving <Ref> in <Ref>. 


	For the intermediate solution x ∈^E computed in <Ref>, we have
	
    ∑_e ∈ E x_e≥β/2·.



	Fix any iteration t ≥ 1 in the algorithm and condition on all randomness  up until this iteration. This fixes the graph . 
	Over the randomness of iteration t, we have, 
	
    | = ∑_v ∈v ∈| = ∑_v ∈v/ = 2/,

	where the first equality is by the linearity of expectation, the second is because v joins  if  is chosen from v, and the last is by the handshaking lemma. 
	
	On the other hand, we have, 
	
    ∑_e ∈ Ge|
       =  ∑_u ∈(  = u |·∑_v ∈uw ∈v: w≤v·β/v) by the definition of the algorithm
       =  1/∑_v ∈∑_u ∈vw ∈v: w≤v·β/vas  is chosen uniformly from  and by re-ordering the sum for each edge
       = 1/∑_v ∈∑_w ∈v𝕀w≤v·βas v = v by definition and 𝕀· is the indicator function
       ≥β·/,

	since for each (v,w) at least one of 𝕀w≤v or 𝕀v≤w is true. 
	
	Combining the above two equations implies that, for any choice of , 
	
    ∑_e ∈ Ge|≥β/2·|,

	which, by the law of total expectation, implies that 
	
    ∑_e ∈ Ge≥β/2·.

	Noting that 
	
    ∑_e ∈ G x_e    = ∑_t ≥ 1∑_e ∈ Ge    and      = ∑_t ≥ 1,

	and linearity of expectation concludes the proof. 


While the size of x by <Ref> is sufficiently large, unfortunately, x 
is not necessarily a fractional matching. As such, we do need to run the update in Line (<ref>) to “trim down” x into y, which becomes a fractional matching. 
The main step of the proof is to show that this step is not going to reduce the size of x dramatically, proving <Ref> in <Ref>.  


	For the intermediate solution x ∈^E and fractional matching y ∈^E in <Ref>, 
	
    ∑_e ∈ E y_e≥1-8β/1-2β·∑_e ∈ E x_e.


To continue, we need a couple of more notation. For any iteration t ≥ 1, define: 

    v   : for each v ∈, v := ∑_e ∋ ve; 
    v   : for each v ∈, the value added to v by v itself; 
    v   : for each v ∈, the value added to v by any vertex other than v.

This way, for every v ∈ V and t ≥ 1, we have, 

    v = v + v.

Notice that v is non-zero in at most one iteration, wherein v joins . For that iteration t, 

    v = w ∈v: w≤v·β/v≤β.

This implies that 

    x_v := ∑_t ≥ 1v≤β + ∑_t ≥ 1v.

Thus, we only need to focus on bounding v across the iterations. We do this in the following claims. Note that in <Ref>, 
the vertices w in Line (<ref>) are the ones that have their w increase in this iteration; thus, to avoid confusion, we use w 
in place of v in the following. 

We first show that the total sum that can be assigned to w across the iterations is upper bounded by β in expectation. For technical reasons that will become clear shortly, 
we prove this bound in a more general form (in the following claim, the statement above corresponds to setting t' = 0). 

	For any iteration t' ≥ 1, any w ∈ V, and choice of all the random bits t' before iteration t', we have,
	
    ∑_t ≥ t'w|t'≤β.



	We know that the given choice of random bits before iteration t', t' fixes the graph t'. If w is no longer present in t', t'w = 0, and it remains zero for every iteration after t' also. Hence, proving the statement is trivial. Thus, we assume that the vertex w is present in t'.

For any iteration t ≥ t', and any choice of random bits  for all preceding iterations,
	
    w|   = ∑_v ∈w𝕀v≥w·v ∈|·β/vby the definition of the algorithm
       ≤w·v/·β/vas v belongs to  if  belongs to v
       = β·w/.

	On the other hand, for every vertex w ∈ define the event: 
	
    _w(t): vertex w is removed from  by being picked as  or joining .

	We have, 
	
    _w(t) | = ∈w∪w = w+1/.

	Thus, we have that 
	
    w|≤β·_w(t) |.

	Intuitively, this means that if w is expected to be “large”, then there is also a “good chance” that w is removed from  at this iteration and thus no longer receives w in the subsequent iterations. 
	We formalize this as follows: 
	
    ∑_t ≥ t'w|t'
       = ∑_t ≥ t'∑_𝕀w belongs to  after |t'·|t'·w|, t'by the law of total expectation
       ≤∑_t ≥ t'∑_𝕀w belongs to  after |t'·|t'·β·_w(t) |, t'by <Ref>
       = ∑_t ≥ t'w belongs to G^(t'),…,G^(t) but not G^(t+1)|t'·βby the definition of _w(t) and the probability in the inner sum
       = w is removed from some  with t ≥ t'·βas the events in the sum are mutually exclusive and partition the space
       = β, as w will be removed at some iteration after t'

	concluding the proof. 


We can also observe that the value of w in any iteration t is upper bounded by β. 


	For every t ≥ 1, regardless of the choice of , w≤β. 


	We have,
		
    w≤∑_v ∈w𝕀v≥w·β/v≤w·β/w = β.



Lastly, using <Ref> and <Ref>, we can show that the variance of the total value assigned to w is also low, enabling us to prove the required concentration bounds later. 


	For every w ∈ V, 
	
    ∑_t ≥ 1w≤ 3β·∑_t ≥ 1w .



	We can write the variance as,
	
    ∑_t ≥ 1w   = ∑_t ≥ 1w + 2  ·∑_t_1 < t_2 t_1w, t_2was ∑_iX_i = ∑_iX_i + ∑_i ≠ jX_i,X_j for any random variables X_1,X_2,⋯
       ≤∑_t ≥ 1(w)^2 + 2 ·∑_t_1 < t_2t_1w·t_2was X≤X^2 for any random variable X
       ≤β·∑_t ≥ 1w + 2 ·∑_t_1 < t_2t_1w·t_2wsince by <Ref>, we have w≤β

We will bound the second term by 2 β·∑_t ≥ 1w to complete the proof. 

    ∑_t_1 < t_2t_1w·t_2w   = ∑_t_1∑_t_2 ≥ t_1+1t_1w·t_2w
       = ∑_t_1∑_t_1+1t_1+1·∑_t_2 ≥ t_1+1t_1w·t_2w|t_1+1by the law of total expectation
       = ∑_t_1∑_t_1+1t_1+1·t_1w|t_1+1·∑_t_2 ≥ t_1+1t_2w|t_1+1as the value of t_1w is fixed when conditioned on t_1+1
       ≤∑_t_1∑_t_1+1t_1+1·t_1w|t_1 +1·βby <Ref>
       = β·∑_t_1t_1wby the law of total expectation
       = β·∑_t ≥ 1w, by the linearity of expectation

finishing the proof. 


We use <Ref> to bound the probability that w reaches a “too large” value. 


	For every w ∈ V and every θ≥ 1-β, 
	
    ∑_t ≥ 1w > θ≤3β/(θ-β)^2·∑_t ≥ 1w.



Let X := ∑_t ≥ 1w. Note that X is a sum of at most n random variables as there are at most n iterations in <Ref> (in each iteration, at least one vertex is removed). 

We have,

    ∑_t ≥ 1w > θ   = X> θ≤X/(θ-X)^2by Chebyshev's inequality
       ≤3β·X/(θ-X)^2by <Ref>
       ≤3β/(θ-β)^2·∑_t ≥ 1w. as X = ∑_t ≥ 1w≤β < θ, by <Ref> and since β < 1/8

This proves the claim. 







We are now ready to prove <Ref>. 


For every vertex v ∈ V, define 

    v := min∑_t ≥ 1v - (1-β), 0.





We first have

    v   = ∑_θ = (1-β)^∞∑_t ≥ 1v = θ· (θ-(1-β)) 
       ≤∑_θ = (1-β)^∞∑_t ≥ 1v = θ·θas β < 1/8 and thus removing -(1-β) can only increase the sum
       = ∫_θ=(1-β)^∞∑_t ≥ 1v≥θ· dθas for any non-negative variable X, X = ∫_0^∞ (1-F_X(x))dx where F_X(·) is the CDF function
       ≤∫_θ=(1-β)^∞3β/(θ-β)^2·∑_t ≥ 1v· dθby <Ref>
       =3β·∑_t ≥ 1v·∫_θ=(1-β)^∞1/(θ-β)^2 dθ
       = 3β·∑_t ≥ 1v·1/1-2β.
    	  as ∫ 1/x^2 dx = -1/x + constant

Finally, we have, 

    ∑_e ∈ E y_e   ≥∑_e ∈ E x_e  - ∑_v ∈ Vvby the update in Line (<ref>) and <Ref>. 
       ≥∑_e ∈ E x_e - 3β/(1-2β)·∑_v ∈ V∑_t ≥ 1v
       ≥1-8β/1-2β·∑_e ∈ E x_eas ∑_v ∈ V∑_t ≥ 1v≤ 2·∑_e ∈ E x_e

concluding the proof. 


The proof of <Ref> now follows from <Ref> for <Ref> and <Ref> for <Ref>. 











 





















 §.§ The Dynamic Streaming Implementation of <Ref>


We now show how to implement <Ref> in dynamic streams. For this, we follow the approach of <cit.> for implementing the randomized greedy MIS algorithm, 
which also forms the backbone of <Ref>. The main new step here is to find the assignments x and y to the edges of the graph in the algorithm (although we will not be able to explicitly find these, but rather a “proxy” to them). 
To do this, we need a procedure that can determine the exact iteration each vertex is being removed from the graph. This is done via <Ref> that we design. 


<Ref> finds the set  in <Ref>, and assigns a time stamp to each
vertex that indicates in which iteration of the while-loop this vertex was removed, namely, was settled. This algorithm, similar to <cit.>, processes the 
graph in O(loglogn) batches of vertices with growing sizes. A key new subroutine allows us to determine the time stamp of all vertices. 

 An input graph G=(V,E) in a dynamic stream. 
	
	

	
		
  * Set the time t=0 and let = ∅ and =∅. Let σ be a random permutation of V. 
		
  * For i=1 to loglogn batches: 
		
			
  * Let k_i := 2 · (n^1-1/2^i - n^1-1/2^i-1) and U_i := (u_1,…,u_k_i) be the next k_i vertices in σ to be processed[If the remaining graph has <k_i vertices, we let U_i be all remaining vertices.].  
			
  *  In a single pass over the stream, store G[U_i ∖ (∪)] using <Ref> below. 
			
  *  At the end of the pass: for j=1 to k_i do the following: 
			
				
  * If u_j is settled already, move to the next vertex of the for-loop in Line (<ref>). 
				
  *  Else, increase t ← t+1 and add u_j to  with t(u_j) = t and mark neighbors of u_j in U_i ∖ (∪) as settled. 
			
			
  *  In a single pass over the stream, for every v ∈ V ∖, find the vertex u ∈ N(v) ∩ with the smallest value of t(u) 
			using <Ref> (to be defined in <Ref>); if such a vertex u is found for v, add v to , set t(v) = t(u), and mark v as settled. 
		
	


We start by arguing that this algorithm faithfully simulates <Ref>. 


	For any graph G=(V,E), the set (v,t(v)) | v ∈ V in <Ref> is sampled from the same distribution as in <Ref> where t(v) in the latter refers 
	to the iteration of the while-loop wherein v joins  or is picked as the vertex u (i.e., is removed from the graph). 


	In <Ref>, we can think of sampling a vertex u uniformly from the remaining graph in each iteration of the while-loop, as first sampling a random permutation σ, and 
	then picking the remaining vertex of G with the smallest value of σ in each iteration of the while-loop. Moreover, we have that,
	
    ∑_i=1^loglogn k_i = 2 · n^1-1/2^loglogn = 2n/n^1/logn = n,

	and thus any remaining vertex will be sampled in the last iteration of the algorithm and will be processed. Then, it is easy to verify that the two algorithms are performing the same 
	exact computation, finalizing the proof.  


An important remark is in order here. Given the greedy nature of <Ref>, for the purpose of the analysis (and by using <Ref>), we can also consider the choice of vertices  right after 
we process a vertex u in <Ref> (to be added to ), even though in reality, vertices in  are only added after the batch is fully processed. In other words, in the analysis, we can add neighbors of u to  
right at that point even though these vertices will be added to  at the end of the batch. 

Let us define some useful notation about the random variables in <Ref> before we proceed. 

    i   : the graph G[U_i ∖ (∪)] that is stored in batch i; 
    i   := 2n^1-1/2^i = ∑_j=1^i k_j, which is the number of vertices in all of U_1 ∪ U_2 ∪…∪ U_i; 
    i   :  the set of i vertices in U_1 ∪ U_2 ∪…∪ U_i;  
    i(w)    : for any vertex w ∈i, this is the neighborhood of w in graph i.

(We emphasize that in the above notation, n_i is not the number of vertices in G_i and is larger.) 

We prove a helper lemma that allows us to bound the space complexity of this algorithm in Line (<ref>). This is a standard result at this point—originally due to <cit.>—and is often
referred to as the “residual sparsity property” of the greedy (MIS) algorithm <cit.>. We thus provide the proof only for completeness. 



	For 1 < i ≤loglog n, let Δ(i) denote the maximum degree of i. Then, with high probability, 
	
    Δ(i) ≤ 100 · (i/i-1) ·lnn.



	We prove the statement for i+1 with i ≥ 1.
	Fix the i+1 vertices in i+1, but not their order in the permutation σ. 
	
	We can think of sampling the set i as picking i vertices u_1,…,u_i uniformly at random from the set i+1 one at a time (without replacement). Now, consider a vertex v in i+1 
	and for j ∈ [i], let d_j(v) denote the degree of v in G[i+1∖ (^j ∪^j)] where ^j ∪^j includes the part of  and  that will be added due to the 
	choices of vertices u_1,…,u_j-1 and their neighbors. Finally, let d(v) 
	denote the degree of v in G_i+1. 
	We have,
	
    v ∈i+1∧ d(v) ≥ 100 ·i+1/i·lnn   ≤∏_j=1^iu_j is not in current neighbors of v| u_1,…,u_j-1as v remaining in G_i+1 means
    		none of its neighbors are sampled in 
       ≤∏_j=1^i1-d_j(v)/i+1as each u_j is chosen without replacement from i+1-1-(j-1) vertices at this point
       ≤1-100 · (i+1/i) ·lnn/i+1^ias d_j(v) ≥ d(v) since the degrees drop monotonically as  and  grow
       ≤exp-i· 100  ·lnn/ias 1-x ≤ e^-x = n^-100.

	 A union bound over all the vertices concludes the proof. 





	Line (<ref>) of <Ref> can be implemented in O(nlog^2n) space with high probability. 


	The statement holds vacuously for i = 1, because the total number of vertices in G_1 is k_1 = n_1 = 2√(n); hence, we can store a counter between all pairs of vertices in G_1 
	during the stream and recover all the edges in O(n log n) space trivially. 
	
	Consider each batch 1 <i ≤loglogn of the algorithm. By <Ref>, with high probability, we can bound the maximum degree of the graph i. We 
	We also know that the total number of vertices stored in batch i is k_i ≤i =  2n^1-1/2^i. Thus, the total number of edges in i is at most,
	
    i·Δ(i) ≤ 100 · (i^2/i-1)·lnn  = 100 · (4 n^2-2/2^i / 2 n^1-2^i-1) ·lnn = 200 · n ·lnn,

	where the first inequality is by <Ref> and the second equality is by the choice of i and i-1.

	
	We now run a sparse recovery algorithm to recover all edges of G[U_i ∖ (∪)] in Line (<ref>). Specifically, define ϕ∈0,1^m to be 
	the indicator vector of edges of this subgraph. Given that the algorithm explicitly stores U_i, , and , 
	we can define ϕ on the fly when seeing the updates to the edges of G. 
	
	The total number of non-zero elements of ϕ is O(n log n), by <Ref>. Thus, we can run the deterministic sparse-recovery of <Ref> with a single pass 
	over ϕ, and the choice of q = O(nlogn) using O(nlog^2n) bits of space. This concludes implementation of Line (<ref>). 




  §.§.§ Finding Time Stamps in <Ref>


We now show how to find the time stamps in Line (<ref>) of <Ref>. We devise the following algorithm for each batch i ∈ [loglogn]. 
Note that at this point, the algorithm has computed  and their time stamp for the current batch i but have not done so for  and that is the task of the following algorithm. 


	 
	For implementing Line (<ref>) of <Ref> in each batch i ∈ [loglogn]. 
	
	
		
  * Partition the set U_i into b = logk_i groups based on geometrically increasing sizes, 
		namely, for every j ∈ [b], U_i,j contains the next 2^j elements of U_i in the order of permutation σ:[The last group b may contain less than 2^b elements, as it only has all the remaining elements of U_i.]
		
    U_i,j = u_2^j-1, u_2^i, …, u_2^j+1-2.

		
  * For every v ∈ V and j ∈ [b], define the vector ϕ(v,j) ∈0,1^V as the indicator vector of N(v) ∩ U_i,j∩. 
		Note that by the end of Line (<ref>) of <Ref>, the set ∩ U_i,j is known and each update (u,v) to the dynamic stream for edges of the input graph G can be used to also update the vectors ϕ(u,j) and ϕ(v,j) for all j ∈ [b]. 
		
		
  * Let q := 200lnn and for every v ∈ V and j ∈ [b], run a randomized q-sparse recovery algorithm of <Ref> on ϕ(v,j) and test if ϕ(v,j) is q-sparse or not, using δ = 1/n^200. 
		
		
  * Let j ∈ [b] be the smallest index such that <Ref> declares 0 < ϕ(v,j)_0 ≤ q and returns ϕ(v,j); let u ∈ be the vertex with the minimum t(u) in the support of ϕ(v,j). 
		
		Return (u,t(u)) as the choice for the vertex v in Line (<ref>) of <Ref> (if no such j is found for v, return no u exists for v). 
	



	With high probability, <Ref> finds the time-stamps in 
	Line (<ref>) of <Ref> and can be implemented in O(nlog^3n) space. 


We will show that for any vertex v ∈ V ∖, <Ref> finds the required time-stamp t(v) with high probability.
	
 Consider the smallest index ∈ [b] where ϕ(v,)_0 > 0; if no such  exists then v is not a neighbor to any vertex in  and thus will not be added to . Otherwise, 
	the neighbor u of v in  with the smallest value of t(u) belongs to U_i,. Thus, returning such u is the correct answer. 

Let us see how the algorithm performs for any j ∈ [b], and enumerate the sources of error.
	
	 
  * For any j <, we know that ϕ(v, j)_0 = 0, but the randomized sparse-recovery may return that ϕ(v,j)_0 > q with probability at most δ. 
	 
  * For j =, it may be the case that ϕ(v, j)_0 > q or if ϕ(v,j)_0 ≤ q, but randomized sparse-recovery returns otherwise. 
	
	
	Firstly, let us condition on the fact that randomized sparse-recovery performs correctly and retrieves ϕ(v,j) for all v ∈ V ∖ and j ∈ [b]. 
	Using union bound over all vertices and j ∈ [b], we get that this event happens with probability at least 1-n^-198 for the choice of δ = n^-200. 
	

	Now, we only need to bound the probability that the case ϕ(v, )_0 > q happens.  We do so using the following intermediate claim.
	
	
	

		For any j > 1 and any vertex v ∈ V ∖, if ϕ(v,j-1)_0 = 0, then ϕ(v,j)_0 ≤ q with high probability. 


	 Let us fix the vertices U_i which are picked to be in σ, but not the order in which they are processed, i.e., we know the k_i vertices that belong to U_i but not the vertex groupings of U_i,j for j ∈ [b].
	We define some useful notation to prove this claim. 
	
    G_i,j   : the graph G[U_i ∖ (∪)] at the beginning of sampling U_i,j, where, ∪
       include all the vertices in U_i settled by  all the vertices in σ till U_i,j-1;
    
    	d_j(v)   :the degree of v in G_i,j; 
    
    	k_i,j   :k_i - (2^1 + 2^2 + … + 2^j-1),  the number of vertices left in U_i after
       U_i,1, U_i,2, …, U_i,j-1 are sampled


 For any j < b with 2^j ≤ k_i,j (group j is not the last group), we can think of picking U_i,j as sampling 2^j vertices from the k_i,j vertices of U_i ∖ (U_i,1∪ U_i,2∪…∪ U_i,j-1) without replacement. Each vertex  is picked in U_i,j with probability p_j, where,
	
    p_j := 2^j/k_i,j.


	Suppose d_j(v) < 100lnn/p_j. Then, in expectation, we know that there are at most 100 ln n neighbors of v in G ∖ (∪). We use Chernoff bound for negatively correlated random variables in <Ref> (because of sampling without replacement) to argue that 
	with high probability, we cannot have more than 200lnn = q neighbors of v in G ∖ (∪) that are sampled in U_i,j; even if all of those neighbors join , 
	we will still have that sparsity of ϕ(v,j) is at most q as desired. 
	
	Now we need to argue the case when d_j(v) ≥ 100lnn/p_j. This implies that, 
	
    d_j(v)   ≥ 100lnn/p_j  as the set ∪ only grows
       = 100lnn·k_i,j/2^jby value of p_j in <Ref>
       = 50 lnn·k_i,j/2^j-1
       = 50 lnn·1/p_j-1·k_i,j/k_i,j-1. given that p_j-1 = 2^j-1/k_i,j-1
       = 50 lnn·1/p_j-1·k_i,j-1-2^j-1/k_i,j-1by definition of k_i,j
       = 50 lnn·1/p_j-1· (1-p_j-1) 
       ≥ 25 lnn· (1/p_j-1). k_i,j-1≥ 2^j + 2^j-1≥ 2 · 2^j-1, we get p_j-1≤ 1/2

When group j is the last group with 2^j ≥ k_i,j (here p_j = 1), we have,

    d_j(v) ≥ 100 lnn≥ 25 lnn· (1/p_j-1),

 where we have used that k_i,j-1 < 2^j-1 + 2^j < 4 · 2^j-1, and  p_j-1≥ 1/4.

We have argued that d_j(v) ≥ 25 lnn/p_j-1 in all cases. Among these d_j(v) vertices, none of them are sampled in U_i,j-1 as v is not settled in U_i,j. However, in expectation, 25 lnn of these vertices must have been sampled in U_i,j-1. 
We use the same argument as in <Ref> to say that at least one of these d_j(v) vertices will be sampled in U_i,j-1 and v will have a neighbor in  already inside U_i,j-1, with high probability. This contradicts our assumption that ϕ(v,j-1)_0 = 0. 


	Thus, in this case j cannot be the first index with non-empty support in ϕ(v,j). clm:finding-label-min
	

	
	To finalize the proof, we have that if = 1, U_i,1 has only 2 vertices and ϕ(v, 1) is 2-sparse; for any >1, we use <Ref> to argue that for any vertex v, ϕ(v, ) is q-sparse with high probability. 
	This proves the correctness of the algorithm as argued earlier. 

We can now bound the space of the algorithm. For every v ∈ V, we are maintaining O(logn) randomized sparse-recovery algorithms, each for recovering an O(logn)-sparse vector from a domain of size ≤ n and error probability δ=1/(n); thus, 
by <Ref>, this needs O(log^3n) space per vertex, and O(nlog^3n) space in total, concluding the proof of <Ref>. 




  §.§.§ Finding a Large Matching from <Ref> via the Reduction of <Ref>


<Ref> allows us to recover the time stamps of all vertices in a single run of the randomized greedy MIS algorithm in O(loglogn) passes over a dynamic stream. 
We now use this information alongside our reduction of approximate matching to randomized greedy MIS in <Ref>, to recover a large matching from the input graph. 

Let us first recall some notation about some variables in <Ref>: 

    : the graph G at iteration t; 
    v   : for each v ∈, denotes the degree of v in ; 
    
    	x_e    :the value given to edge e in x ∈^E from <Ref>
    
    	y_e    : the value given to edge e in fractional matching y ∈ [0,1]^E from <Ref>.

As we have stated earlier, given the support of the fractional matching y can be too large, we cannot hope to recover it explicitly. Instead, 
our goal is to sample the edges of the graph with probabilities proportional to their y-values, and then use the sampled edges to find a large matching. 
Specifically, for every e ∈ E, define: 

    p_e:= min(1, y_e · 200 log n).

We would like to sample each edge of the graph with probability p_e. The challenge however is that we will not be able to actually recover the values of y (or even x) explicitly and learn p_e's, and thus need to use a “proxy” for them algorithmically. 




To start with, we have the time stamps of all the vertices. Let us show that this also gives us the degrees of all the vertices at the time in which they are settled. 

	Given the time stamps t(v) for all v ∈ V, using one pass and O(nlogn) space, we can find t(v)(v) for all vertices v ∈ V. 


	For any vertex v, t(v)(v) only includes the edges of v to vertices w ∈ V which have t(w) ≥ t(v). We know the labels of all vertices explicitly, so it is easy to count the total number of edges from v to vertices with labels after v
	using a counter per vertex. 


Equipped with <Ref>, we can assume we also have the remaining degree of every vertex v ∈ V at the time it is settled. This fixes the value x will assign to the edges of v. 
The problem however is that we still do not have sufficient information to perform the check in Line (<ref>) of <Ref> to know which incident edges of v receive
a non-zero fractional matching, i.e., which edges (v,w) satisfy (w) ≤(v); this is because for this check, we need to know the degree of w at the time v is being settled not w itself. 

We side step this issue in the following by defining an intermediate assignment z ∈^E which we can explicitly find for any pair of vertices. 
To formally define the vector z, we describe the notion of assigning a vertex pair to one of the vertices. 

[Assignment of vertex pairs to vertices] For any pair of vertices u,v,  we say the pair u,v is assigned to vertex u, denoted by (u,v), iff:


  *   u is settled before vertex v, i.e., t(u) < t(v), or else,

  *  u, v are removed at the same time with t(u) = t(v) and u ∈ while v ∈, or else,

  *  t(u) = t(v), u, v ∈, and t(u)(u) ≥t(v)(v) (breaking the ties between u and v in case of the equality consistently, say, based on whichever appear in σ first).



Note that by <Ref>, every pair u,v of vertices, regardless of whether or not is an edge, is assigned to one of its endpoints. 
We then define z_uv for a pair u,v∈ V as, 

    z_uv := 200 log n/t((u,v))((u,v));

that is z_uv is proportional to the inverse of the degree of its assigned vertex, at the time this assigned vertex was settled. 
When vertices u,v do contain an edge e = (u,v) in the input graph, we use z_e and (e) also to denote z_uv and (u,v) interchangeably. 

We observe that for any vertex pair u,v, the value of z_uv can be found easily.

	For any vertex pair u,v, the value of z_uv can be determined given the information collected by the algorithm.  


	The only information required to find (e) is the time stamps, the sets  and , and the degrees at the time of removal, and lastly the permutation σ, all of which is stored in the memory explicitly (using <Ref>
	and <Ref>). 
	Thus, we can find for each vertex pair what (u,v) is, and then, determining z_uv is trivial.


The following claims shows the relevance of z-values for us. 


	For every edge e ∈ E, p_e ≤ z_e where p_e ∈ [0,1] is from <Ref>.


	It is sufficient to show that x_e · 200log n ≤ z_e given that y_e ≤ x_e always (y is obtained from x by reducing some of its values) and by the definition of p_e based on y_e in <Ref>. 
	
	For any edge e = (u,v) ∈ E, the value of x_e is updated in at most one iteration of the loop in Line (<ref>) of <Ref>, i.e., the iteration where either of u or v are settled. We will argue that
	
    x_e ≤β/t((e))((e)).

	We have multiple cases to consider:
	
		
  * When v is settled (strictly) before u, that is t(v) < t(u), we have that (e) = v from Line <ref> of <Ref>. We know that x_e is set as β/t(v)(v) if t(v)(u) ≤t(v)(v),  otherwise x_e is set as zero. In either case, x_e is less than β/t((e))((e)). This is similarly true when u is settled (strictly) before v. 
		
  * When v and u are settled at the same time, with t(u) = t(v), and if u goes to  at this iteration, then v ∈, and x_e is again updated as β/t(v)(v). We have that (e) = v by Line <ref> of <Ref> and can apply the above reasoning.
		
  * When both u,v go to  and have the same timestamps, the value of x_e is set as β/t(v)(v) if v is the higher degree vertex among u,v at time t(u) = t(v). Again, we have that (e) = v by Line <ref> of <Ref> and can apply the above reasoning.
	
	The claim follows by observing that, 
	
    x_e · 200 ·log n ≤β· 200 ·log n/t((e))((e))≤200 ·log n/t((e))((e)) =  z_e,

	where we have used that β < 1.


Given <Ref>, for algorithmic purposes, we can instead sample the edges with probability proportional to z-values, which we can compute. 
We now need to check this can be done efficiently in dynamic streams (and that the size of the sampled edges are not too large, given z is  not a fractional matching).
Our sampling is done in two steps: we first sample all pairs u,v based on their value z_u,v to obtain a vector ϕ_z ∈^V2 and then maintain a sparse-recovery algorithm over ϕ_z to 
recover the actual edges inside this sample. Furthermore, we need to sample ϕ_z itself with limited independence hash functions (defined in <Ref>) 
and work with ϕ_z implicitly given that its size is larger than the allowed space. We now formalize this: 



  
Sampling process. Let κ := 200logn and sample a κ-wise independent hash function from <Ref> with domain of the set of vertex pairs and the range of [0,1]
[ For the simplicity of exposition, we let the range of the hash function to be the interval [0,1]. For algorithmic purposes, one needs to further discretize this range to integers. Specifically, use the range as {1, 2, …, (n)} for some large polynomial in n and consider a mapping of [0,1] to this range in a standard way. The distribution when sampling from the hash family with this large discrete domain varies from the range [0,1] 
by at most 1/(n) in total variation distance, and this negligible difference can be added to the probability of error of the algorithm.]:

    h : n2 → [0,1].

Let Φ_z ⊆V2 be the set of pairs such that h(u,v) ≤min(1,z_u,v) and ϕ_z ∈0,1^Φ_z be the incidence vector of E_z:= E ∩Φ_z. This way, the elements in the support of ϕ_z 
are obtained from E by sampling each edge e ∈ E, using a κ-wise independent hash function, with probability z_e. 



We now analyze this sampling process. The size of Φ_z may still be too large for us but we show that the total number of actual edges sampled, i.e., the support of ϕ_z will not be large
and can be found and stored explicitly by the algorithm. 


	The set E_z can be found and stored in O(n log^2 n) space explicitly with high probability. 


	We will prove that size of E_z is O(nlogn) with high probability (over the randomness of h alone). 
	This will be sufficient to prove the claim since we can implicitly maintain the set Φ_z using the hash function h, which itself can be stored in O(κ·logn) = O(log^2n) space using <Ref> (see also <Ref>); then, we will store a randomized sparse-recovery of <Ref> for the vector ϕ_z and each relevant update on the graph G can be passed to this vector given the implicit access to Φ_z. This way, 
	we can recover  E_z, the support of ϕ_z, in O(nlog^2n) space with high probability. 
	
	It thus suffices to prove the bound on the size of E_z.  For any vertex v ∈ V, let A(v) be the set of edges e ∈ E that are assigned to v, i.e., (e) = v. 
	We claim that A(v) ∩ E_z is of size O(logn) with high probability which implies the bound on E_z immediately since the set A(v) | v ∈ V covers all edges of the graph. 
	
	Let us fix a vertex v ∈ V. Let d_v = t(v)(v) be the degree of v at the time it is settled. 
	We argue that A(v)≤ d_v. This is because any edge e = (v,w) assigned to v satisfies t(w) ≥ t(v) and thus belongs to the graph at the time v is settled. 
	If d_v ≤ 200logn, we are already done, so in the following we assume d_v > 200logn. 
	
	For e ∈ A(v), define the indicator random variable X_e ∈0,1 which is 1 iff e is sampled in A_z. By <Ref>, we have X_e = 200logn/d_v
	and thus by the argument above
	
    E_z ∩ A(v) = A(v)·200logn/d_v≤ d_v ·200logn/d_v = 200logn.

	Moreover, Z_e_e ∈ A(v) are chosen via a κ-wise independent hash function. Thus, by <Ref>, 
	
    E_z ∩ A(v)≥ 400logn≤exp-minκ/2, 2/3· 200logn≤ n^-100,

	by the choice of κ = 200logn. A union bound over all the vertices concludes the proof.


We have proved that our sampling process does not violate the space constraint and we can obtain the set E_z
as well. We now finalize the argument by showing that E_z contains a large matching in expectation by relating it to the fractional matching y of <Ref>.  
This is a combination of the standard fact that sampling a fractional matching leads to a large matching as well (slightly modified to work even with limited-independence sampling), and a rejection sampling argument 
in the analysis to relate sampling with probability z_e to the one with p_e needed for the fractional matching sampling. 


	There exists a matching M in the sampled edges E_z with 
	
    M≥1-8β/1-2β·β/10·μ(G).



	Fix a choice of random ordering σ in <Ref> and its simulation in <Ref> and let y ∈^E be the fractional matching defined by this process. 
	Let R denote the entire randomness of these algorithms, which we condition on in the following proof. Thus, the only randomness remained at this point is in the sampling process of E_z. 


	Consider any choice of the hash function h in the sampling process from earlier. Define the following alternative sampling process for obtaining a set E_p as opposed to E_z: 
	add any edge e ∈ E to E_p iff h(e) ≤ p_e (recall p_e = min(1,200logn· y_e) by <Ref>). Since p_e ≤ z_e by <Ref>, for any choice of h, the set E_p ⊆ E_z. We can thus think of E_p as 
	obtained from E_z by rejecting the edges with p_e < h(e) ≤ z_e. We emphasize that we are not algorithmically finding E_p but rather only define it for the analysis. Thus, picking the random hash function h 
	defines a sampling process for picking E_p as well. 
	
	
	We now argue that 
	
    μ(E_p) | R≥1/5y,

	where y = ∑_e ∈ E y_e. This is sufficient to conclude the proof since, 
	
    μ(E_z)   = _R μ(E_z) | R≥_R μ(E_p) | Rby the law of total expectation and since μ(E_z) ≥μ(E_p) given E_p ⊆ E_z
       ≥1/5·_R y| R = 1/2·yby <Ref> and the law of total expectation again
       ≥1/5·1-8β/1-2β·β/2·μ(G) ·1-1/(n),

	where the final inequality holds by <Ref> for the choice of y in <Ref> with the additional 1-1/(n) accounting from the correctness probability  
	of <Ref> in <Ref>. 
	
	It thus remains to prove <Ref>. 
	Define the following assignment _e for each edge e ∈ E: 
	
    _e:= 
    			y_e        if e ∈ E_p and y_e ≥ 1/(200 log n),
    
    			y_e/p_e        if e ∈ E_p and y_e < 1/(200log n),
    
    			0        otherwise.

	This way, _e | R = y_e for all e ∈ E: if y_e ≥ 1/(200logn), we have p_e = 1 and thus h(e) ≤ p_e always meaning e ∈ E_p and _e = y_e deterministically. 
	Otherwise, e belongs to E_p with probability p_e < 1 and thus _e = p_e · y_e/p_e = p_e. 
	
	We have 
	
    ∑_e ∈ E_e | R  = ∑_e ∈ E y_e = y,

	and at the same time  is only supported on the edges in E_p. We are going to prove that, with a proper scaling,  can actually become a fractional matching. This means E_p contains a 
	fractional matching with expected size ≈y which will be sufficient to prove <Ref>. 
	
	Fix a vertex v ∈ V and define,

    _v := ∑_e ∋ v y_e ·(y_e ≥ 1/(200 log n))   and  _v  := ∑_e ∋ v_e ·(y_e < 1/(200log n)).

It is easy to see that _v ≤ 1 as y ∈^E is a fractional matching. Define E_p(v) as the edges in E_p that are incident on v. 
We can also observe that,

    _v = ∑_e ∋ v_e ·(y_e < 1/(200log n))    ≤1/200 log n·E_p(v).

because, when y_e < 1/(200log n), we know that y_e/p_e = 1/(200 log n). We have, 

    E_p(v)| R = ∑_e ∋ v p_e = ∑_e ∋ v y_e · (200logn) ≤ 200logn,

again using the fact that y is a fractional matching. Moreover, E_p(v) is a sum of κ-wise independent random variables (by the choice of h) and thus, by <Ref>, 

    E_p(v)≥ 400logn| R≤exp-minκ/2, 2/3· 200logn≤ n^-100,

by the choice of κ = 200logn. Plugging in this in <Ref> implies that with high probability, 

    _v ≤1/200 log n· 400logn = 2.

All in all, we have that for every vertex v ∈ V, with high probability

    ∑_e ∋ v_e ≤ 3.

A union bound over all the vertices, implies that /3 is with high probability a fractional matching. We thus have, 

    /3|/3 is a fractional matching, R≥y/3· (1-1/(n)).

To conclude the proof of <Ref>, we have, 

    μ(E_p) | R   ≥2/3·/3 is a fractional matching| R·/3|/3 is a fractional matching, R
       ≥2y/9· (1-1/(n)) > y/5;

the first inequality holds by the integrality gap of fractional matchings in <Ref> for the first term, and the trivial lower bound of μ(E_p) ≥ 0 when /3 is not a fractional matching; 
the second inequality holds by the fact that /3 is with high probability a fractional matching and the expectation calculated above. 





  §.§.§ The Final Dynamic Streaming Algorithm: Concluding the Proof of <Ref>


We are almost done with the proof of <Ref>. Up until now, we have already established that for any given graph G=(V,E), 


  * We can run <Ref> in O(nlog^3n) space and recover the time stamps of all vertices with high probability (<Ref>);

  * We can then extract the vector z ∈^E from the information collected above in an additional O(nlogn) space and O(1) passes deterministically (<Ref> and <Ref>);

  * We can further sample the edges E_z ⊆ E in another O(nlog^2n) space and O(1) passes with high probability (<Ref>);

  * Finally, we find a maximum matching in E_z; conditioned on the high probability events above, this gives us a matching M of expected size (<Ref>):

    M≥1-8β/1-2β·β/10·μ(G).



The main missing pieces are to (i) boost the probability of success of this algorithm to a high probability bound instead of an expectation-guarantee, and, subsequently, (ii) boost the approximation ratio of the algorithm 
to a (1+)-approximation (and extend it even to weighted graphs). We show that both these tasks can be achieved using the existing sketching and streaming results listed in <Ref>. 
The proofs in the following are pretty standard. 



  
Boosting the probability of success. Let G=(V,E) be the input graph. We can assume without loss of generality that μ(G) ≥log^2(n); the total number of edges in any graph is at most 2n ·μ(G) 
and thus we can run a randomized sparse-recovery in <Ref> for recovering 2nlog^2(n) edges in O(nlog^3n) space with high probability; if μ(G) < log^2(n), this algorithm succeeds in recovering the entire graph
and finding a maximum matching of G exactly. Otherwise, we continue with the main algorithm. 

Let = 1/2 and run the vertex-sampling approach of <Ref> for O(logn) guesses of μ(G) as powers of 2 between log^2(n) to n and run our algorithm for each guess separately in parallel. 
We  specify this more details in the following. 

For a given guess μ̃,
at the beginning of the stream, we partition the vertices randomly into groups U_1,…,U_t for t = 8μ̃/ = 16μ̃. This allows us to define a graph H := H(μ̃) on new vertices u_1,…,u_t (representing the groups U_1,…,U_t) and edges between u_i and u_j iff there exists at least one edge (x,y) ∈ E with x ∈ U_i and y ∈ U_j (note that multiple edges in E can be mapped to a single edge in H but H does not have multi-edges). Moreover, 
an update to the dynamic stream defining E can be also directly translated to an update to the graph H and thus we can run our algorithms over H.[We should mention a minor point here. 
There is a slight difference between the dynamic stream defining E(H) versus for E. In particular, we should treat the dynamic stream on E(H) as a vector ϕ∈^t2 where ϕ_u_i,u_j > 0 (but not necessarily ϕ_u_i,u_j = 1) is interpreted as the the existence of the edge (u_i,u_j) ∈ E(H) (whereas for the dynamic stream defining E, the vector ϕ∈0,1^V2 will be the characteristic vector of E). Nevertheless, our algorithms work the same exact 
way over H. This is because the only access 
of these algorithms to the edges of the graph was via sparse-recovery algorithms and these algorithms return the support of the vector ϕ (or whichever subsets of it they are being run on).
Moreover, since the entries of ϕ are still (n) bounded, the space complexity of the algorithm is exactly as before (as a function of n itself, i.e., we do not aim for a better dependence based on t ≤ n).]

Now consider, the guess μ̃ such that μ(G) ≤μ̃≤ 2 ·μ(G). Firstly, by <Ref>, we have that with high probability μ(H) ≥μ(G)/2.
As such, for this choice and by picking β = 1/16 in our algorithm, for the returned matching M, we have that 

    M≥1-8β/1-2β·β/10·μ(H) ≥1/40·μ(G).

On the other hand, in H, we deterministically have that M≤ t/2 since it is a matching and H has at most t vertices. This means that we also always have 

    M≤ 16 μ(G).

This implies that 

    M≥1/50·μ(G)≥1/3200

as otherwise 

    M < 1/50·μ(G) + 1/3200· 16μ(G) < 1/50+1/200·μ(G) = 1/40·μ(G),

a contradiction. Repeating this algorithm now O(logn) times and returning the largest matching implies that with high probability, we will find a matching of size at least μ(G)/50. 
Note that given a matching in H, we can spend O(1) more passes and O(nlog^2n) space to find a matching in G of the same size: for any edge (u_i,u_j) in the matching of H, we need
to just find a single edge between the vertices of the group U_i and U_j which we know exists. This can be done using a standard sampling trick and sparse-recovery algorithms: basically, we first count the number c_i,j of 
edges between U_i and U_j in a single pass and in the second pass, we sample ≃log(n)/c_i,j fraction of vertex-pairs between U_i and U_j and run a sparse-recovery algorithm for ≃ (logn)-sparse
vectors on this subsampled pairs. With high probability, the number of sampled edges is indeed ≲logn and the recovery algorithm finds at least one of those edges. 

In conclusion, by running our main algorithm O(log^2(n)) times in parallel for different guesses of μ(G) and different repetitions for each guess, we 
obtain an O(1)-approximation algorithm to the maximum matching of any given graph G=(V,E) in a dynamic stream with high probability[To simplify the proof, we have been quite cavalier with the choice
of constants in the analysis of the algorithm and only prove a 50-approximation guarantee. Given that we are going to boost the approximation ratio of this algorithm in a black-box way in the next step, 
any constant-approximation works for us and thus we did not optimize the approximation ratio of this base algorithm. A more careful analysis of the bounds can reduce this ratio dramatically, but we suspect the limit will be 
close to 6-approximation (or possibly 4 for bipartite graphs).]. Moreover, this algorithm
uses O(nlog^5n) space and O(loglogn) passes. 



  
Boosting the approximation ratio. Now that we have an O(1)-approximation algorithm that succeeds with high probability, this step becomes a black-box application of <Ref>. 



This concludes the proof of <Ref>. 









§ THE LOWER BOUND


We provide our multi-pass lower bound for approximate matchings in the dynamic streaming model in this section, formalizing <Ref>. 



Any semi-streaming algorithm that given any n-vertex graph in a dynamic streams, outputs an O(1)-approximation to the maximum matching problem with any constant probability of success requires Ω(loglog n) passes.


We prove <Ref> using the connection between the streaming and communication models (<Ref>). Our proof consists of two separate parts proven in the subsequent sections.

	
  * Part 1. In <Ref>, we define a new two-party communication problem for r-round protocols called Augmented Hidden Matrices (_r, see <Ref>) and prove the following lower bound on its communication complexity in <Ref>.

	
	
		For any sufficiently large n_r ∈, positive integer r = O(loglog(n_r)), positive number α≤ 1 - n_r^-1/2r and constant ≥ 1, any r-round protocol that successfully solves _r(n_r, α) with
		probability of success at least 
    1/2·1 + r/20 ·· (r+1)
 must have a communication cost of at least 
		
    s_r = n_r1+1/2^r-1·1-αr·2^r/2^r-1·(α/(1-α))^2/(·^2 · 80^2)^r · ((r+1)!)^3 .

	

	
  * Part 2. In <Ref>, we construct graph instances corresponding to the _r(n_r, α) problem. We prove the following connection between any p-pass dynamic streaming algorithm for approximate maximum matching and _r where r = 2p -1 in <Ref>.
	
	
		For any sufficiently large n_r ∈, integers p,s ≥ 1, and number ≥ 1, let  by any p-pass s-space
		dynamic streaming algorithm that computes a -approximate maximum matching on a (4n_r)-vertex bipartite graphs with probability of success at least 1-1/(n).
		Then, for r = 2p-1 and α = 1/(4 ·· r), there exists an r-round protocol  for _r(n_r, α) with 
		probability of success 
		
    ≥1/2·(1 + 1/3)

		and
		communication cost 
		
    ≤ r · s + O(r · n_r log(n_r)).

		



We now prove <Ref> using the above two lemmas.


	Without loss of generality, we can solely focus on proving the lower bound for semi-streaming algorithms that succeed with high probability instead of constant probability. 
	This is due to the following standard reduction.
	 
	Simply run a constant probability of success streaming algorithm in parallel O(logn) times 
	and consider all the outputs; then, spend one more pass to filter out all the ones that output an edge that does not belong to the graph (because they failed), and among the rest, output the largest matching. 
	This way, we still obtain a semi-streaming algorithm with just one more pass (which is negligible in this context) and a high probability of success. As such, in the rest of the proof, we focus on high-probability-of-success algorithms. 
	
	For sufficiently large n ∈, integers p,s ≥ 1 and any constant ≥ 1,
	let  be any p-pass s-space dynamic streaming algorithm that computes a -approximate maximum matching on any (4n)-vertex graph with probability of success at least 1-1/(n). 
	
	By <Ref> with r = 2p-1 and α = 1/(4 ·· r), there exists an r-round protocol  for _r(n, α) where 
	
    ≥1/2·(1 + 1/3)     and    ≤ r · s + O(r^2 · n log n).

	By <Ref> with n_r = n and =, we have that ≥ s_r since 
	
    ≥1/2·1+1/3≥1/2·1 + r/20 ·· (r+1).

	Then, by combining the bounds on  and re-arranging the inequality, we obtain the following lower bound on the space of  using the fact that  and β are constants (and thus α = Θ(1/r)):
	
    s    ≥s_r/r - O( n log n) 
       = n1+1/2^r-1·1-αr·2^r/2^r-1·(α/(1-α))^2/(·^2 · 80^2)^r · ((r+1)!)^3·1/r - O(n log n) 
       ≥n1+1/2^r-1· r^-Θ(r) - O(n log n).

	
	Overall, by considering  with p = o(loglog n) and thus r = 2p -1 = o(loglog n), we have that the space used by the algorithm is s ≫ n · (n) using <Ref>.
	Therefore, any dynamic streaming algorithm that uses n · (n) space, namely, a semi-streaming algorithm, to compute an O(1)-approximate maximum matching must use Ω(loglog n) passes.




 §.§ Augmented Hidden Matrices


For any r ≥ 1, the _r(n_r, α) problem is defined recursively using b_r^2 many instances of the _r-1(n_r-1, α) problem where n_r, b_r, n_r-1∈ℕ and α∈ (0,1).
The output of any instance is a single bit, pointed to by a search sequence (to be defined soon).


[Augmented Hidden Matrices]

The Augmented Hidden Matrices problem, denoted by _r(n_r, α), is defined as follows (see <Ref> for an illustration):

	
  * For 𝐫 = 0. Alice does not receive any input, i.e., 0 = ∅, and Bob receives a single 
	bit 0∈{0,1}. There is no communication and Alice has to output 0. 
	
  * For 𝐫 ≥ 1. Start with b_r^2 instances of the players' inputs in _r-1(n_r-1, α), denoted by (r-1_i,j, r-1_i,j) for i, j ∈ [b_r].
	Alice receives r = where  is a b_r × b_r matrix such that [i,j] = r-1_i,j for i, j ∈ [b_r]. 
	Bob receives the input r = (, , ) where , ∈ S_b_r are permutations of [b_r] and  is a b_r × b_r matrix such that, for i, j ∈ [b_r],
	 
    [i,j] =
    		(r-1_i,j, r-1_i,j)    if  b_r ·α <(i) ≠(j) ≤ b_r, 
    r-1_i,j   if  b_r ·α < (i) = (j) ≤ b_r, 
    ∅   otherwise.

	
	Alice starts the communication. After all the messages are sent, 
	the player receiving the last message is given a search sequence, which is a tuple of r integers, (r, r-1, …, 1) with i∈ [b_i · (1-α)]. This player must output the solution to _r-1 instance (r-1_i,j, r-1_i,j) where (i) = (j) = b_r ·α + r using the search sequence (r-1, r-2…1) .
	





We expound more on the defintion of _r problem, and give some useful terminology next. 

For r = 0 case, we set n_0 = 1, and _0(1, α) is also denoted by  _0(1). This is a base case that is trivially hard for 0-round protocols. 

For each of the b_r^2 many _r-1 instances (r-1,r-1) used in an instance of _r, the roles of Alice and Bob are swapped, i.e., Alice holds r-1 and Bob holds r-1.
Out of these instances, we call the set of the k_r := b_r · (1- α) many _r-1 instances (r-1_i,j, r-1_i,j) where b_r ·α < (i) = (j) ≤ b_r as the special sub-instances in an instance of _r.
Since each special sub-instance identifies another set of k_r-1 many _r-2 special (sub-)sub-instances, recursively applying this for all special sub-instances of _r identifies a set of k_r · k_r-1·…· k_1 many _0 special base instances, where each one corresponds to a single bit 0. 

It is useful to point to the number of special base instances explicitly for later. 


	In any instance of _r(n_r, α), there are k_r · k_r-1·…· k_1 many special base instances where k_i = b_i · (1- α) for each i ∈ [r].


Furthermore, we call the set of k_r^2 - k_r many _r-1 instances (r-1_i,j, r-1_i,j) where b_r ·α < (i) ≠(j) ≤ b_r as the off-diagonal sub-instances in an instance of _r. We define some more notation to point to the sub-instances. 



  
*Notation.
In any instance of _r, denoted by (r, r), we use the following notation.
We denote each of the k_r many special sub-instances as (_k, _k) = (r-1_i,j, r-1_i,j) where (i) = (j) = b_r ·α + k and i,j ∈ [b_r] for k ∈ [k_r].
We collectively denote these special sub-instances as (,) where 

    = (_1, _2, …, _k_r)   and   = (_1, _2, …, _k_r).
 

We denote the collection of the k_r^2 - k_r many off-diagonal sub-instances as (, ) where 

    = (r-1_i,j : b_r ·α < (i) ≠(j) ≤ b_r)  and   = (r-1_i,j : b_r ·α < (i) ≠(j) ≤ b_r).

We let  be the remaining b_r^2 - k_r^2 sub-instances  r-1_i,j where (i) ≤ b_r ·α or (j) ≤ b_r ·α.




  
Search Sequences.
After all the messages are sent, the search sequence given to the player who receives the last message is always uniformly random and independent of the players' inputs. That is, a search sequence (r, r-1, …, 1) is chosen where for i ∈ [r], i is chosen uniformly at random and independently from [b_i · (1-α)]. 
The solution to any instance of _r given (r, r-1, …, 1) is the same as the solution to the uniformly chosen special sub-instance (_r, _r) on the search sequence (r-1, …, 1).
Continuing this until the last index 1 in the search sequence ultimately identifies a uniform random special base instance, i.e., an instance of _0, whose solution is the solution to the _r instance.

Our definition of the _r(n_r, α) communication problem is non-standard as the uniformly random search sequence, which is a part of the input, is given to the final player at the very end of a protocol.
In particular, the search sequence is crucial to defining the output of the problem, but does not form part of the input held by the players throughout the protocol.

Although the search sequence defines the communication problem in a non-standard way, the easy direction of Yao's minmax theorem is still applicable.
Thus, 
we prove <Ref> by considering deterministic protocols for _r(n_r, α) where the players' inputs (r, r) are sampled from the hard distribution (which we define shortly). 


	The definition of _r(n_r, α) (<Ref>) always includes the uniform random search sequence, which is independent of the players' inputs and how they are distributed.
	However, when referring to the _r(n_r, α) problem, we do not explicitly mention the given search sequence if this is clear from context.








Next, we fix the parameters of the problem, and then define our hard distribution _r(n_r, α). 



  
Parameter Choices.
For all r ≥ 1, it is sufficient for us to consider the 
_r problem for parameters that satisfy the following conditions:

    n_r    = n_r-1· b_r 
    
    	b_r    = n_r2^r-1/2^r-1·1-αr· 2^r-1/2^r-1-1
    
    	n_r-1   = n_r2^r-1-1/2^r-1 / 1-αr·2^r-1/2^r-1 - 1.

From now on, we only consider _r(n_r, α) with these parameter choices.



	

	Hard Distribution _r(n_r, α) for _r(n_r, α):
	
		
  * For 𝐫=0. 
		Sample 0∈{0,1} uniformly and independently. We also use _0(1) to denote this distribution.
		
  * For 𝐫 ≥ 1. 
		Sample the b_r^2 instances (r-1_i,j, r-1_i,j) from _r-1(n_r-1, α) independently for each i, j ∈ [b_r] where b_r, n_r-1 are as defined in <Ref>. Sample the permutations , ∈ S_b_r uniformly and independently.
		
	


Recall that the distribution of the search sequence was already defined to be uniformly random, and independent of all other inputs. 

We have the following obvious observation. 


    Any 0-round protocol (wherein Alice outputs the answer) for solving _0(1) succeeds with probability at most 1/2 when the input is sampled from _0(1).





	




The proof of <Ref> relies on a round-elimination argument that shows that if there is a good deterministic protocol for _r(n_r, α) under the input distribution _r(n_r, α), then there must be a good deterministic protocol for _r-1(n_r-1, α) under the input distribution _r-1(n_r-1, α). 
We prove the following key lemma in <Ref>.


 
	For any r ≥ 1, sufficiently large n_r ∈, α,δ∈ (0,1), and integer s ≥ 1,
	suppose there exists a deterministic r-round protocol _r for _r(n_r, α) with
	
    _r≤ s

	and probability of success at least δ when the input is sampled from _r(n_r, α).  
	
	Then, for any ∈ (0,1), there exists a deterministic (r-1)-round protocol _r-1 for _r-1 with 
	
    _r-1≤· (r/) ·s/k_r + r,

	 and probability of success 
	 
    _r-1≥δ -  -√(s/2 · b_r^2 ·α^2)
 
	 when the players' input is sampled from _r-1(n_r-1, α).





With that, we have the main tools required to prove of our lower bound for _r(n_r, α).


  §.§.§ The Lower Bound for Augmented Hidden Matrices: Proof of <Ref>


	We prove this result by first assuming the existence of a deterministic r-round protocol _r for _r that is `too good to be true' (w.r.t. the statement of the lemma) on inputs sampled from _r(n_r, α). Then, by iteratively applying the round-elimination argument in <Ref>, we ultimately obtain a deterministic 0-round protocol _0 for _0 that is trivially `too good to be true' on inputs sampled from _0(1) (given <Ref>), a contradiction.
	
	Formally, we prove this by induction on r.
	
Base case for 𝐫=1.
Suppose that there exists a deterministic 1-round protocol _1 for _1(n_1, α) with communication cost 

    _1 < s_1 = n_1^2 ·α^2/·^2 · 80^2 · 8

and probability of success

    _1≥1/2·(1 + 1/40 ·)

when the input is sampled from _1(n_1, α).
Then, using <Ref> with ε = 1/(160 ·), we obtain a deterministic 0-round protocol _0 for _0(1) which has no communication cost (since no messages are communicated) and succeeds with probability

    _0   ≥1/2·(1 + 1/40 ·) - 1/160 · - √(n_1^2 ·α^2/·^2 · 80^2 · 16 · b_1^2 ·α^2)
       ≥1/2·(1 + 1/80 · - √(n_1^2/^2 · 160^2 · b_1^2)) since ≥ 1
        = 1/2·(1 + 1/160 ·) since b_1 = n_1 by <Ref>

when the input is sampled from _0(1).
This, however, contradicts <Ref> and thus proves the result for the base case when r = 1.

Inductive step for 𝐫 ≥ 2. Having proven the base case, we now prove the result for any r ≥ 2 given the result holds for r-1, i.e., the inductive hypothesis. Suppose that there exists a deterministic protocol _r for _r(n_r, α) with communication cost 

    _r < s_r = n_r1+1/2^r-1·1-αr·2^r/2^r-1·(α/(1-α))^2/(·^2 · 80^2)^r · ((r+1)!)^3

and probability of success

    _r≥1/2·(1+r/20 ·· (r+1))

when the input is sampled from _r(n_r, α).
Then, using <Ref> with
ε = 1/(40 ·· (r+1)^2),
we obtain a deterministic (r-1)-round protocol _r-1 for _r-1(n_r-1, α) with cost

    _r-1 < · (40 ·· (r+1)^2 · r) ·( s_r/k_r + r )

and probability of success

    _r-1≥1/2·(1+r/20 ·· (r+1)) - 1/40 ·· (r+1)^2 - √(s_r/2 · b_r^2 ·α^2)

when the input is sampled from _r-1(n_r-1, α).

We now argue that protocol _r-1 contradicts the result for r-1, namely, the inductive hypothesis.
In particular, we show that _r-1 < s_r-1 and 

    _r-1≥1/2·1 + (r-1)/20 ·· r.

The rest of the proof is a careful but rather tedious calculation of the values we obtain using the above reduction for the communication cost and probability of success of the protocol. 

To bound the communication cost, we first reiterate the relation between n_r and n_r-1 from <Ref> as follows:

    n_r1/2^r-1   = n_r-11/2^r-1-1·1-αr·2^r-1/2^r-1 - 1·1/2^r-1-1
       = n_r-11/2^r-1 -1·1-α(r-2)·2^r-1+1/(2^r-1) · (2^r-1-1).

Next, we use this to simplify the expression for the term s_r/k_r in <Ref>.

    s_r/k_r   = n_r1+1/2^r-1·1-αr·2^r/2^r-1·(α/(1-α))^2/(·^2 · 80^2)^r · ((r+1)!)^3_s_r·1/b_r · (1-α)_1/k_r
       = n_r/b_r·n_r1/2^r-1·1-αr · 2^r/2^r - 1 - 1·(α/(1- α))^2 /(·^2 · 80^2)^r · ((r+1)!)^3
       = n_r-1·n_r1/2^r-1·1-αr·2^r/2^r-1-1as n_r = n_r-1· b_r by <Ref>·(α/(1-α))^2/(·^2 · 80^2)^r · ((r+1)!)^3
       = n_r-11 + 1/2^r-1-1·1-αx·(α/(1-α))^2/(·^2 · 80^2)^r · ((r+1)!)^3. by <Ref>

	where the exponent of (1-α) in the above equation is

    x    = (r-2)·2^r-1+1/(2^r-1) · (2^r-1-1) + r·2^r/2^r-1 - 1 
       =(r-2)·(2^r-1-1)+1 + r-2/(2^r-1) · (2^r-1-1) + (r-1)·2^r+1/2^r-1
       =1/2^r-1·(r-1)2^r + 1 + (r-2) + r-1/2^r-1-1
       = (r-1)/2^r-1· (2^r + 1 + 1/2^r-1-1) 
       = (r-1)/2^r-1· (2^2r-1-2^r + 2^r-1-1 + 1/2^r-1-1) 
       = (r-1)/2^r-1· (2^2r-1-2^r-1/2^r-1-1) 
       = (r-1) · 2^r-1/2^r-1-1 .

Therefore, we have that

    s_r/k_r   =  n_r-11 + 1/2^r-1-1·1-α(r-1) · 2^r-1/2^r-1-1·(α/(1-α))^2/(·^2 · 80^2)^r · ((r+1)!)^3
       = s_r-1·1/·^2 · 80^2 · (r+1)^3.

By plugging this back into <Ref>, we obtain

    _r-1   < · (40 ·· (r+1)^2 · r)  ·s_r-1·1/·^2 · 80^2 · (r+1)^3 + r
       ≤1/^2 · 160· s_r-1 + 40 ··· (r+1)^4 using r ≤ r +1
       ≤ s_r-1 , as r^4 ≪ s_r-1 for r = O(loglog n) and α≤ 1 - n_r^-1/2r

which is our desired bound on the communication cost of _r-1.

To bound the probability of success, we first reiterate the following useful relation from <Ref>:

    b_r^2    = n_r2 · 2^r-1/2^r-1·1-αr· 2 · 2^r-1/2^r-1-2
       = n_r1 + 1/2^r -1·1-αr· 2^r/2^r-1 / (1- α)^2  .

Using this, we now simplify the term s_r/(2· b_r^2 ·α^2) in <Ref>.

    s_r/2 · b_r^2 ·α^2   = n_r1+1/2^r-1·1-αr·2^r/2^r-1·(α/(1-α))^2/(·^2 · 80^2)^r · ((r+1)!)^3_s_r·1/2 · b_r^2 ·α^2
       = b_r^2 ·α^2/(·^2 · 80^2)^r · ((r+1)!)^3·1/2 · b_r^2 ·α^2by <Ref>
       = 1/2 · (·^2 · 80^2)^r · ((r+1)!)^3  .

By plugging this back into <Ref>, we have that

    _r-1   ≥1/2·(1+r/20 ·· (r+1)) - 1/40 ·· (r+1)^2 - √(1/2 · (·^2 · 80^2)^r · ((r+1)!)^3)
       ≥1/2·(1+r/20 ·· (r+1)) - 1/40 ·· (r+1)^2 - √(1/^2 · 80^2 · (r+1)^4)since ≥ 1 and 2 · ((r + 1)!)^3 ≥ (r + 1)^4 for r ≥ 1
       = 1/2·(1+r/20 ·· (r+1)) - 1/· 80 · (r+1)^2
       = 1/2·(1+r/20 ·· (r+1) - 1/40 ·· (r+1)^2) 
       ≥1/2·(1+r-1/20 ·· r) ,

which is our desired bound.

Overall, we have that the deterministic protocol _r-1 constructed from _r using <Ref> contradicts the lemma for r-1 (inductive hypothesis) and thus the lemma must hold for deterministic r-round protocols when the input is sampled from the distribution _r for every r ≥ 1.
Finally, by the easy direction of Yao's minmax principle, the same result holds for any (even randomized) r-round protocol for any instance of _r (given a uniform random search sequence).










  §.§.§ The Round Elimination Argument: Proof of <Ref>


We now get to the main part of the argument, which is the proof of <Ref>, restated below. 

[<Ref>]
	For any r ≥ 1, sufficiently large n_r ∈, α,δ∈ (0,1), and integer s ≥ 1,
	suppose there exists a deterministic r-round protocol _r for _r(n_r, α) with
	
    _r≤ s

	and probability of success at least δ when the input is sampled from _r(n_r, α).  
	
	Then, for any ∈ (0,1), there exists a deterministic (r-1)-round protocol _r-1 for _r-1 with 
	
    _r-1≤· (r/) ·s/k_r + r,

	 and probability of success 
	 
    _r-1≥δ -  -√(s/2 · b_r^2 ·α^2)
 
	 when the players' input is sampled from _r-1(n_r-1, α).


 Starting with a deterministic r-round protocol _r for _r(n_r, α) where _r≤ s and _r≥δ under _r as in the statement of <Ref>, we construct a deterministic (r-1)-round protocol _r-1 for _r-1(n_r-1, α) that proves the lemma in three steps:

	
  * 
	 (Input Embedding) Construct a randomized r-round protocol 1_r under _r-1 with success probability the same as _r under _r, i.e., 1_r≥δ, and internal information cost less than the communication cost of _r by a k_r multiplicative factor, i.e., 
	
    1_r_r-1≤s/k_r.

	
  *  (Message Compression) Construct a randomized r-round protocol 2_r under _r-1 with success probability less than that of 1_r under _r-1 by at most an additive ε factor, i.e., 2_r≥δ - ε, and with communication cost similar to the internal information cost of 1_r under _r-1, i.e., 
	
    2_r≤·r/ε·1_r_r-1 + r≤·r/ε·s/k_r + r.

	
  *  (Guessing the First Message) Construct a deterministic (r-1)-round protocol _r-1 under _r-1 with success probability less than that of 2_r under _r-1 by at most an additive ≃√(s/(b_r^2 ·α^2)) factor, i.e, _r-1≥δ - ε - √(s/(2 · b_r^2 ·α^2)), and with communication cost no more than that of 2_r, i.e., 
	
    _r-1≤2_r≤·r/ε·s/k_r + r.
 




  §.§.§ Step <ref>: A Low Information Cost Protocol via Input Embedding


We construct a low information cost r-round protocol 1_r for _r-1 by considering an input (r-1, r-1) ∼_r-1(n_r-1, α) and  embedding it in a simulated input instance (r, r) ∼_r(n_r, α) for _r such that its output can be used to solve (r-1, r-1).
Then, the players simulate a run of the protocol _r in r rounds using the simulated input. 


To simplify the exposition, we disambiguate the players in the construction of 1_r (and _r-1 later in step <ref>).
We use Alice and Bob to denote the players in the input instance of _r-1 where Alice holds = r-1 and Bob holds = r-1. 
On the other hand, we use X and Y to refer to the players in the simulated input instance of _r where
player X holds r = and player Y holds r = (, , ).





	

	An r-round protocol 1_r for _r-1(n_r-1,α) on input (,) ∼_r-1(n_r-1, α) where (r-1, r-2, …, 1) is the given uniform random search sequence: 
	
		
  * Using public randomness, independently sample a uniform random search index ∈ [k_r]. Then, jointly sample the following from _r(n_r, α): 
		
			
  * The uniform random permutations , of [b_r];
			
  * Bob's part of all the k_r^2 - k_r many off-diagonal sub-instances 
			
    = (r-1_i,j : b_r ·α < (i) ≠(j) ≤ b_r);

			
  * Alice's part of -1 many special sub-instances _<  = (_k : 1 ≤ k < );
			
  * Bob's part of k_r- many special sub-instances _>  = (_k :  < k ≤ k_r).
		
		Let , ∈ [b_r] be such that (i) = (j) = b_r ·α +, which both players can compute since ,, are sampled using public randomness.
		
  * Bob takes on the role of player X and sets [,] =. 
		Bob privately samples  from _r(n_r,α) conditioned on all the random variables from step <ref> and [,], i.e., the remainder of X's input r.
		
  * Alice takes on the role of player Y and sets [,] =. 
		Alice privately samples  from _r(n_r, α) conditioned on all the variables from step <ref> and [,], i.e., the remainder of player Y's input r.
		
  * The players X (= Bob) and Y (= Alice) simulate a run of protocol _r in r rounds using their respective inputs r = and r = (,,) and starting with player X.
		
  * At the end of the protocol, the player that receives the final message gets the uniform random search sequence (r-1, r-2, …, 0) and then returns the answer of _r on the search sequence (, r-1, r-2, …, 0).
	




	In protocol 1_r, (r, r) in the simulation of _r is sampled from _r(n_r, α) and (, r-1, r-2, …, 0) is a uniform random search sequence. 



	The input to the simulation of _r is (r, r) where r = and r = (, , ).
	All variables of the input are jointly sampled from _r(n_r, α) except for Alice and Bob's embedded instance (, ) ∼_r-1(n_r-1, α) where [, ] = and [,] =.
	
	Since the instance of _r-1 corresponding to ([, ], [,]) is independent of all other variables in the distribution _r(n_r, α), all other variables are jointly distributed according to _r(n_r, α).
	It remains to show that ([, ], [,]) distributed according to _r-1(n_r-1,α), which is required in _r(n_r, α).
	This is immediate from the embedding as ([, ], [,]) = (, ) ∼_r-1(n_r-1, α)

	Each search index in (r-1, r-2, …, 0) is uniformly sampled. Then, since ∈ [k_r] is also uniformly sampled, we have (, r-1, r-2, …, 0) is a random search sequence as required.	


With this observation, we have that Alice and Bob have successfully simulated _r for _r(n_r, α) on the correct distribution, as the search sequence (, r-1, r-2, …, 0) is uniformly random and the players' inputs are distributed according to _r(n_r, α).
Since the messages communicated by the players are exactly the messages of the simulated protocol _r, the communication cost of 1_r is the same as _r. Although the communication cost is large, we now show that its internal information cost (about input (, )) is smaller by a multiplicative k_r factor.




  
Notation.
We use , to denote the random variables corresponding to the input instance of _r-1 given to Alice and Bob, which are distributed according to _r-1. We use  to denote the random variable corresponding to the set of messages sent by both Alice and Bob. For i ∈ [r], _i denotes the message sent in round i and _i denotes the random variable corresponding to _i. 
We use , , , , to denote the random variables corresponding to ,, ,  = (_1, _2, …, _k_r), = (_1, …, _k_r), respectively. 


The following claim proves that information cost of 1_r about its input sampled from _r-1 is 1/k_r times smaller than the information cost of _r about its own input sampled from _r. 


	In protocol 1_r, we have that
	
    1_r_r-1(n_r-1, α)≤1/k_r·_r_r(n, α).




	
	By the definition of internal information cost (<Ref>),
	
    1_r_r-1(n_r-1, α)   = |, , , , _>, _<_public randomness of 1_r, 
       + |, , , , _>, _<_public randomness 1_r, .

Each mutual information term corresponds to the amount of information communicated by each player about their input, and we bound them separately.

For Alice's mutual information term in <Ref>, we have that

    |, , , , _>, _<, 
       = 1/k_r·∑_k ∈ [k_r]|, , ,  = k, _> k, _<k, by the definition of conditional mutual information and the uniform distribution of 
       = 1/k_r·∑_k ∈ [k_r]_k|, , ,  = k, _≥ k, _<kas = _k,  = _k in protocol 1_r when = k
       = 1/k_r·∑_k ∈ [k_r]_k|, , , _≥ k, _<k;

 the last part holds because the joint distribution of (_≤ k,_≥ k, , , , ) is independent of the value of . 
In particular, if we sample any input (r, r) from _r(n, α) (which does not include = r), the values of , , , _≤ k, _≥ k are fixed and the value of  is also fixed as _r is deterministic. Hence, the distribution of  remains uniform over [k_r] irrespective of the instance (r, r).

Continuing the bounding of Alice's mutual information term, we have that

    1/k_r·∑_k ∈ [k_r]_k|, , , _≥ k, _<k
       ≤1/k_r·∑_k ∈ [k_r]_k|, , , , _<kby <Ref> as _<k⊥_k |, , , _<k
    	by the definition of distribution _r
       = 1/k_r·|, , , by the chain rule of mutual information, chain-rule
       ≤1/k_r·|, , , , by <Ref>, as ⊥|, , , by
    	the definition of distribution _r
       = 1/k_r·, |, , , , as  is fixed
       ≤1/k_r·, , , , |, , by the chain rule (chain-rule) and non-negativity of mutual information (info-zero)
       = 1/k_r·r|rrecall that input of Y (resp. X) simulated by Alice (resp. Bob) in 1_r is r (resp. r).


For Bob's mutual information term in <Ref>, following a similar argument, we have

    |, , , , _>, _<, 
       = 1/k_r·∑_k ∈ [k_r]_k|, , ,  = k, _>k, _≤ kby definition of conditional mutual information and , and the uniform distribution of 
       = 1/k_r·∑_k ∈ [k_r]_k|, , , _>k, _≤ kas in the previous case for Alice, for any k ∈ [k_r], ( = k) ⊥ (_≥ k, _≤ k, , ,)
       ≤1/k_r·∑_k ∈ [k_r]_k|, , , _>k, by <Ref>, as _>k⊥_k |,,,_> k by the definition of distribution _r
       = 1/k_r·|, , , by chain rule of mutual information, chain-rule
       ≤1/k_r·|, , , , by <Ref>, as ⊥|, , , by the definition of distribution _r
       ≤1/k_r·, , |, , , , by the chain rule (chain-rule) and non-negativity of mutual information (info-zero)
       = 1/k_r·r|rrecall that input of X (resp. Y) simulated by Bob (resp. Alice) in 1_r is r (resp. r).


With both these bounds, we can upper bound the LHS of <Ref> and obtain

    1_r_r-1   ≤1/k_r·( r|r + r|r) 
       = 1/k_r·_r_r,

where the last step follows since the messages communicated in 1_r are exactly the messages communicated in the simulation of _r and since (r, r) ∼_r in 1_r by <Ref>. 


We now obtain the following main lemma of this step of the argument:

	Protocol 1_r is an r-round protocol for _r-1(n_r-1, α) where Bob speaks first with communication cost at most s, probability of success at least δ, and internal information cost at most s/k_r when the input is sampled from _r-1(n_r-1, α).



	In protocol 1_r, the instance (r, r) used to simulate _r is constructed without any communication, so the total number of bits communicated in 1_r is at most the total number of bits communicated in _r, which is _r≤ s as in the statement of <Ref>. 
	Bob takes on the role of X in the simulation and thus Bob speaks first.

	By construction, protocol 1_r outputs the same answer as _r since the solution to (r, r) ∼_r on search sequence (, r-1, r-2, …, 0) is the same as the solution to the input (_, _) = (, ) ∼_r-1 on the search sequence (r-1, r-2, …, 0). Therefore, 1_r succeeds with probability at least δ. 
	Finally, the bound on the internal information cost of 1_r follows from <Ref> and the fact that the communication cost of _r, namely, s, is an upper bound of its internal information cost.




  §.§.§ Step <ref>: A Low Communication Cost Protocol via Message Compression


In this step, we compress the communication cost of 1_r using standard message compression techniques. As a direct corollary of <Ref>, we get the following:


	For any 0 < <1, there exists an r-round protocol 2_r for _r-1(n_r-1,α) where Bob speaks first with 
	
    2_r≤· (r/) ·s/k_r +  r.

	and probability of success at least δ - when the input is sampled from _r-1(n_r-1,α).



	We use <Ref> on protocol 1_r to get protocol 2_r such that the simulation fails with probability at most . Then, we have that
	
    2_r   ≤·r/·1_r_r-1 + r^2/≤· (r/) ·s/k_r +  r. by <Ref>

The simulation of 1_r using compressed messages fails with probability at most , so 2_r succeeds with probability at least δ-, as desired. 


Since this step only compresses the messages sent in 1_r, protocol 2_r is constructed in the same way as 1_r with an additional message compression step that uses an independent source of public randomness. 
In particular, 2_r is a simulation of _r on an instance of _r sampled from _r, but with communication cost smaller by a ≃ k_r multiplicative factor and with a slightly smaller probability of success.



  §.§.§ Step <ref>: An (r-1)-Round Protocol via Guessing the First Message


In this final and the most important step, we take the r-round protocol 2_r for _r-1 where Bob communicates first and we eliminate the first message by making the players guess it using public randomness, thus beginning the protocol from the second round. 
Therefore, we obtain an (r-1)-round protocol _r-1 for _r-1 where Alice communicates first as required.
This alters the joint distribution of the input and thus affects the guarantees of the protocol (as in <Ref>), but we will show that the effect is small.




	

	An (r-1)-round protocol _r-1 for _r-1 on inputs (r-1,r-1) ∼_r-1(n_r-1, α) where (r-1, r-2, …, 1) is the given uniform random search sequence: 
	
		
  * Using public randomness, jointly sample the first message _1 and the search index  from the protocol 2_r. Then, jointly sample the following from _r(n_r, α) conditioned on _1,:
		
			
  * The uniform random permutations , of [b_r];
			
  * Bob's part of all the k_r^2 - k_r many off-diagonal sub-instances 
			
    = (r-1_i,j : b_r ·α < (i) ≠(j) ≤ b_r);

			
  * Alice's part of the -1 many special sub-instances _<  = (_k : 1 ≤ k < );
			
  * Bob's part of the k_r- many special sub-instances _>  = (_k :  < k ≤ k_r).
		
		Let , ∈ [b_r] be such that (i) = (j) = b_r ·α +, which both players can compute since ,, are sampled using public randomness.

		
  * Bob takes on the role of player X and sets [,] =. 
		Bob privately samples  from _r(n_r,α) conditioned on all the random variables from step <ref> and [,], i.e., the remainder of X's input r.
		
  * Alice takes on the role of player Y and sets [,] =. 
		Alice privately samples  from _r(n_r, α) conditioned on all the variables from step <ref> and [,], i.e., the remainder of player Y's input r.
		
  * The players X (= Bob) and Y (= Alice) simulate protocol 2_r using their respective inputs r = , r = (,,) and the search sequence (, r-1, r-2, …, 1).
		They use _1 as a guess of the first message sent from X to Y and thus only simulate r-1 rounds of 2_r starting with the second round, i.e., player Y communicates first.
	


Observe that, similar to the construction of 2_r (which is identical to 1_r, except for the message compression), protocol _r-1 embeds the input for _r-1 sampled from _r-1 into a simulated instance (r, r) of _r.
Then, the players simulate a run of 2_r using (r, r) where, to remove the first round of communication, the first message is guessed using public randomness.
However, due to the random guessing of the first message, the simulated instance is no longer distributed according to _r(n_r, α) (recall <Ref>), i.e., the guarantees of 2_r do not hold for _r-1. 
Despite this, we show that the simulated instance and first message are statistically close  to being distributed as they are in 2_r and thus similar guarantees hold.

Let  denote the joint distribution of (r, r, _1, ) as it is in _r-1 and let  denote the joint distribution of (r, r, _1, ) as it is in 2_r.

Let 

    := (_1, , , , , _>, _<)

denote the public randomness used in step <ref> of _r-1. 
We show in <Ref> that the distributions  and  only differ in the way that the input (, ) = (_, _) is sampled.

 
	We have that
	
    = ×   _, _   ×, _> |, _×, _<|, _, 
       = ×_, _|×, _> |, _×, _<|, _.


	

	We first consider (r, r, _1, ) directly as it is sampled in _r-1.
	The random variable  in _r-1 is jointly sampled in step <ref>.
	Then, Alice and Bob embed (, ) ∼_r-1 as _ = and _ =, i.e., (_, _) ∼_r-1, which is not conditioned on .
	Finally, Bob and Alice privately sample the remainder of  and  (and thus the remainder of r and r), respectively, which is only conditioned on  and their respective embedded inputs. This defines .

	We then obtain  from  by including all previously sampled random variables in the conditioning of the subsequently sampled random variables. That is, we obtain
	
    = 
       ×_, _|
       ×, _> |, _, _
       ×, _<|, _, , _≥.

	It is easy to verify that this is exactly the distribution of (r, r, _1, ) as it is in 2_r.

	Finally, we simplify the third and fourth terms in  to show that they are identical to the corresponding terms in , which follows directly from the claims that 
	
    (, _>) ⊥_|, _  and  _<, ⊥, _≥|, _,

	respectively. 
	To prove these claims, it is sufficient to bound the corresponding mutual information terms as follows:
	
    , _>_|, _
       ≤, _>_≤, |, _by the chain rule (chain-rule) and non-negativity of mutual information (info-zero)
       =  , _>_≤, |_1, , , , , _>, _≤by the definition of 
       ≤, _>_≤, , _1 |, , , , _>, _≤by the chain rule (chain-rule) and non-negativity of mutual information (info-zero)
       = , _>_≤, |, , , , _>, _≤as _1 is fixed by , ,
       = 0, by info-zero and construction of distribution _r

	and
	
    _<, , _≥|, _
       ≤_<, , _1, _≥|, , , , _≥, _≤by the chain rule (chain-rule) and non-negativity of mutual information (info-zero)
       = _<, , _≥|, , , , _≥, _≤as _1 is fixed by , ,
       = 0 by info-zero and construction of distribution _r.

	This completes the proof.


We note here that the simulated instance (r, r) in  is sampled according to _r(n_r, α) (recall <Ref>). 
However, this is not true in  since (, ) = (_, _) is sampled according to =_r-1 instead of _r |.
Thus, to bound the total variation distance between  and , we show that the information revealed by the random variable 


about the input (, ) in 2_r, i.e., under distribution , is not too large.
We need an independence claim (<Ref>) and then a crucial bound on the information carried by the first message (<Ref>).


	
    _<⊥_|_1, , , , , _>, _<.



	Again, we bound the mutual information between the terms. Let  represent the independent source of public randomness used in the message compression in step <ref>. Then,

    _<_|_1, , , , , _>, _<
       ≤_<_, _1 |, , , , _>, _<moving _1 by chain rule in chain-rule, and non-negativity of mutual information info-zero
       ≤_<_, , |, , , , _>, _<by data processing inequality in data-processing, _1 is fixed by , , ,
       = _<_, |, , , , _>, _<since  is an entirely independent source of randomness
       ≤ 0. by info-zero and construction of _r



The following claim is the heart of the entire proof. 


	For any k ∈ [k_r], 
	
    _k_1 |, , , _<k, _>k≤s/b_r^2 ·α^2.




	Let , be the inverse of ,, and let , denote the random variables corresponding to , respectively.
	For ease of exposition, we represent any permutation ρ on [b_r] as an ordered set S := {ρ(ℓ) : ℓ∈ [b_r] } with the ordering that ρ(ℓ) < ρ(ℓ') for ℓ < ℓ'.
	Using this representation, we allow for partial definitions of permutations, i.e., ordered subsets T ⊂ S.
	In particular, we  require the following partial definitions of  and :
	
		
  * Let  be an ordered set 
    = (ℓ) | b_r ·α  <ℓ≤ b_r, ℓ≠ b_r·α +k

		of size b_r · (1-α) -1, which is the set of rows that corresponds to  except for the row corresponding to _k. Let  denote its random variable.
		
  * Let  be an ordered set 
		
    =  (ℓ) | b_r ·α  <ℓ≤ b_r, ℓ≠ b_r·α +k

		of size b_r · (1-α) -1, which is the set of columns that corresponds to  except for the column corresponding to _k. Let  denote its random variable.  
	
	We give an illustration of these definitions in <Ref>.

	

	This now allows us to write the indices i,j ∈ [b_r] of the instances corresponding to  and  using , , ,:
	
		
  * For any ℓ∈ [k_r], _ℓ is the same as the random variable _(b_r·α + ℓ), (b_r ·α + ℓ)
		where we omit the superscript r-1 as it is clear from context; 
		
  * , _<k, _>k is the union of combinatorial rectangles formed by 
		
    (×),    (×(b_r·α +k)),     ((b_r ·α + k)×).

	
	Finally, let  be defined as, 
	
    := (, _<k, _>k).

	With these at hand, we can start bounding the mutual information term in the claim. Firstly, it is easy to see that,

    _k_1 |, , , _<k, _>k = _k_1 |, , ,

by definition of . 

We need the following intermediate claim for our proof. 

    _k, _1, |,  = _k, _1, |, ,  (b_r ·α + k), (b_r ·α + k).



	Let ([b_r ·α]) and ([b_r ·α]) denote the random variables (i) and (i) for all i ∈ [b_r ·α] respectively. 
We know that random variable  is fixed by , as they are inverses of each other. Random variable  is in turn fixed by all the values each element of [b_r] is mapped to, i.e., (i) for i ∈ [b_r]. 

Hence, it is sufficient to argue that,

    (_k, _1, ) ⊥([b_r ·α]), ([b_r ·α])  |, , (b_r ·α +k), (b_r ·α + k),

to prove the claim. 
We know that _k, is the random variable corresponding to the instances in r inside the combinatorial rectangle 

    (∪{(b_r ·α +k)}) × (∪{(b_r ·α +k)}).

The entirety of this rectangle is fixed by the conditioning. 

Proving the claim amounts to proving that the joint distribution of r-1_i,j for a fixed set of positions of r (the ones inside the rectangle fixed by conditioning), and the transcript _1 is independent of the permutation of the rest of the positions of r. This is true because X, who sends  _1, does not have access to either of the permutations  or  (held by Y).clm:ind-rest-of-sigma



We can continue to bound the mutual information now. 

    _k_1 |, , 
       =  _k_1 |, , , (b_r ·α + k), (b_r·α + k)by <Ref>
       = _(,) 
    ∼ ( , )_k_1 |,  = ,  = , (b_r ·α + k), (b_r·α + k)by  definition of conditional mutual information
       (1)1/b_r^2 ·α^2_(,) 
    ∼ ( , )∑_i ∈ [b_r] ∖, 
     j ∈ [b_r] ∖_i,j_1 |, , , (b_r ·α + k) = i, (b_r·α + k) = j
       (2)1/b_r^2 ·α^2_(,) 
    ∼ ( , )∑_i ∈ [b_r] ∖, j ∈ [b_r] ∖_i,j_1 |,  = ,  = 
       (3)1/b_r^2 ·α^2∑_i ∈ [b_r] ∖, j ∈ [b_r] ∖_i,j_1 |, ,

where 
(1) holds by the definition of conditional mutual information since, conditioned on any = and =, the values of (b_r ·α + k) and (b_r ·α + k) are uniformly chosen from [b_r]\ and [b_r]\ (each of size b_r ·α + 1), respectively; 
(2) holds because, conditioned on any choice of = and =,  the event (b_r·α + k) = j, (b_r ·α + k) = i is independent of (_i,j, _1, ); and 
(3) holds by the linearity of expectation and the definition of conditional mutual information.


We re-index both the sets [b_r] ∖ and [b_r] ∖ as [b_r ·α + 1] for ease of exposition just for this final part of the proof. 
We know that _i,j for any i, j ∈ [b_r] are sampled independently of each other in distribution _r.
Hence, using <Ref>, we have that 

    1/b_r^2 ·α^2∑_i ∈ [b_r] ∖, j ∈ [b_r] ∖_i,j_1 |, , 
       ≤1/b_r^2 ·α^2∑_i ∈ [b_r ·α + 1], j ∈ [b_r ·α + 1] _i,j_1 |_i, >j, _>i,  , , 
       = 1/b_r^2 ·α^2·_1,1, …, _1, b_r·α + 1,_2,1, …, _b_r·α+1, b_r·α+1_1 |, , by chain rule of mutual information, chain-rule
       ≤1/b_r^2 ·α^2·r_1 |, , by the chain rule (chain-rule) and non-negativity of mutual information (info-zero)
       ≤s/b_r^2 ·α^2. as r_1 |, , ≤_1≤ s by uniform

This proves the claim.


We now use these claims to show that the information revealed by random variable  about the input (, ) is not too large in .


    _, _≤s/ b_r^2 ·α^2.




	First, by chain rule of mutual information (chain-rule), we have that
	
    _, _   = _ + _|_.

We can prove that the second term is zero as follows: Let  represent the independent source of public randomness used in the message compression in step <ref>. Then,  

    _|_
       = __1, , , , , _>, _<|_by expanding 
       = _, , , , _>, _<|_ + __1 |_, , , , , _>, _<by  chain rule in chain-rule
       = 0 + __1 |_, , , , , _>, _<. by info-zero and construction of _r
       ≤_, _<, |_, , , , , _>, _<. by data processing inequality data-processing as _1 is fixed by , , ,
       = _, _<|_, , , , , _>, _<. since  is an entirely independent source of randomness
       = 0 by info-zero and construction of _r.

Therefore, an upper bound on _ is an upper bound on _, _. We have, 

    _
       ≤_,_<by the chain rule (chain-rule) and non-negativity of mutual information (info-zero)
       = __1, , , , , _>, _<,_<by expanding 
       = _, , , , _>, _<,_<
        + __1 |, , , , _>, _<,_<by  chain rule in chain-rule
       = 0 + __1 |, , , , _>, _<,_<by info-zero and construction of _r
       ≤__1 |, , , , _>,_<removing _< in the conditioning by <Ref> and <Ref>
       = 1/k_r·∑_k ∈ [k_r]_k_1 |, , , =k, _>k, _<kby the definition of conditional mutual information
       = 1/k_r·∑_k ∈ [k_r]_k_1 |, , , _>k, _<kas event = k is independent of (, , _1, , ) (see proof of <Ref>)
       ≤s/b_r^2 ·α^2,

by applying <Ref> to bound each term, completing the proof. 


We are now ready to show that  and  are statistically close. 

	
    ≤√(s/2 · b_r^2 ·α^2).




Firstly, we use weak chain rule over total variation distance (<Ref>) using the definitions of distributions  and  established in <Ref> to obtain

    ≤_R ∼_, _| = R_, _
       ≤_R ∼√(1/2·_, _|=R_, _)by Pinsker's inequality in <Ref>
       ≤1/√(2)·√(_R ∼_, _|=R_, _)by Jensen's inequality as the function √(·) is concave
       = 1/√(2)·√(_, _)by the relation between mutual information and KL-divergence in <Ref>
       ≤√(s/2 · b_r^2 ·α^2)by <Ref>,

proving the lemma.


Finally, we complete the proof of the main round-elimination argument.


	By construction, we know that the total communication of protocol _r-1 is upper bounded by the communication of protocol 2_r (since the messages of the former are a subset of the ones for the latter). 
	Using <Ref>, we get that the communication of _r-1 is at most 
	
    _r-1≤· (r/) ·s/k_r + r.

	Furthermore, by construction, protocol _r-1 is an (r-1)-round protocol where Alice communicates first.
	
	We know, again from <Ref>, that the probability of success of 2_r is at least δ - when the simulated input (r, r) is sampled from _r, i.e., the random variables follow distribution . 
	However, in _r-1, due to the fact that we sample the first round message at random, the simulated input is only statistically close to being sampled from _r, i.e., the random variables follow distribution .
	Therefore, the probability of success of _r-1, using <Ref>, is bounded as follows:
	
    _r-1   ≥2_r  succeeds on input  - 
       ≥δ- -√(s/2· b_r^2 ·α^2).


Lastly, to get a deterministic protocol out of _r-1, we use an averaging argument and fix the random bits of _r-1 so that we have the same performance guarantee over the input distribution _r-1(n_r-1, α). This 
gives us the desired (r-1)-round deterministic protocol for _r-1(n_r, α) when the players' inputs are sampled from _r-1(n_r-1, α), and the search sequence is uniformly random. 










 §.§ Reduction to Bipartite Matching in Dynamic Streams
 
In this section, we prove the connection between maximum bipartite matching in the dynamic streaming model and the Augmented Hidden Matrices (_r) problem, which is presented as <Ref>.
We repeat this lemma for the convenience of the reader here. 

[<Ref>]
		For any sufficiently large n_r ∈, integers p,s ≥ 1, and number ≥ 1, let  by any p-pass s-space
		dynamic streaming algorithm that computes a -approximate maximum matching on a (4n_r)-vertex bipartite graphs with probability of success at least 1-1/(n).
		Then, for r = 2p-1 and α = 1/(4 ·· r), there exists an r-round protocol  for _r(n_r, α) with 
		probability of success 
		
    ≥1/2·(1 + 1/3)

		and
		communication cost 
		
    ≤ r · s + O(r · n_r log(n_r)).

	
	

The key to proving <Ref> is to construct a bipartite graph G = (L ∪ R, \), which is defined by edge insertions  and deletions , 
from any input instance for _r with the following property. An O(1)-approximate maximum bipartite matching in G can be used to solve _r on the
search sequence with a non-trivial advantage over randomly guessing the answer.






  §.§.§ The Bipartite Graph Construction using _r


Let us first recall the important aspects of _r. 
It is defined recursively using b_r^2 many _r-1 sub-instances, which are denoted (r-1_i,j, r-1_i,j) for i,j ∈ [b_r] (see <Ref> in <Ref>).
An instance of _r identifies k_r many special sub-instances (,). 
Each of these has its own k_r-1 many special (sub-)sub-instances and, continuing this, ultimately corresponds to the k_r · k_r-1·…· k_1 many special base instances, where each one corresponds to a single bit as they are instances of _0. 
Then, given the uniform random search sequence, which is provided at the end of a protocol, solving _r requires solving a uniform random special base instance.

We begin by showing how the base instances (or bits) are represented in our graph.
We will use the following basic bipartite graph construction on four vertices, called a bit graph, to encode bits in our construction of G. 



[Bit Graph]
	Given a bit x ∈{0,1 } and a graph G = (L ∪ R, E) with L = {ℓ_1, ℓ_2} and R = {r_1, r_2}, graph G is said to be the bit graph of x if
	
		
  * E = {(ℓ^1, r^1), (ℓ^2, r^2)} when x = 0, and E = {(ℓ^1, r^2), (ℓ^2, r^1)} when x = 1.
	
	The bit x can be identified by either of the edges in E. See <Ref> for an illustration.








With that, given an instance (r, r) of _r(n_r, α), we give the following recursive procedure that separately encodes r and r as the edges of a bipartite graph on the vertex sets L and R, where,


    L = {t1, t2| t ∈ [n_r]}    and     R = {t1, t2| t ∈ [n_r]}.

For ease of notation, we let 

    L[i] = t1, t2| (i-1) · n_r-1 < t ≤ i · n_r-1⊆ L

 for i ∈ [b_r], and we let R[j] ⊆ R for j ∈ [b_r] be defined similarly. 
The edges we add corresponding to the sub-instance (r-1_i,j, r-1_i,j) will be only across vertices in L[i] and R[j]. 

We also use (t) and (t) to denote the t × t matrix of all ones and all zeroes, respectively.
The construction of the graph is as follows. 



	

	(r, Z, L, R) where Z ∈{r, r, (n_r), (n_r) } with L = R = 2n_r:
	
		
  * For 𝐫=0. 
		
			
  * When Z ∈{0,1}, return the edges of the bit graph corresponding to Z.
			
  * When Z  = ∅, return the empty set of edges.
		
		
  * For 𝐫 ≥ 1. 
		
			
  * When Z ∈{(n_r), (n_r)}, return the edges 
    ⋃_i,j ∈ [b_r](r-1, Z', L[i], R[j])

			where Z' is the n_r-1× n_r-1 matrix with all its entries the same as the entries in Z.
			
  * When Z = r, return the edges 
    ⋃_i,j ∈ [b_r](r-1, r-1_i,j, L[i], R[j]).

			
  * When Z = r, return the edges[This procedure ignores = (r-1_i,j : b_r ·α < (i) ≠(j) ≤ b_r).]
			
    (⋃_i,j ∈ [b_r] 
     b_r ·α <(i) ≠(j) ≤ b_r(r-1, r-1_i,j, L[i], R[j])) 
       ∪(⋃_i,j ∈ [b_r] 
     b_r ·α <(i) = (j) ≤ b_r(r-1, r-1_i,j, L[i], R[j])).

			If r is even, in addition to the above, return the edges
			
    ⋃_i,j ∈ [b_r] 
    (i) ≤ b_r·α or (j) ≤ b_r·α((0, (n_r-1), L[i], R[j]) ∪(0, (n_r-1), L[i], R[j]) ).

		
	
See <Ref> for an illustration.




Note that this procedure does not yet define the graph G. However, it allows Alice and Bob to construct edges (insertions or deletions) from their respective inputs, which we now show can be done without any communication.



	For any r ≥ 0, given an instance (r, r) of _r(n_r, α), Alice and Bob can compute (r, r, L, R) and (r, r, L, R), respectively, without any communication.


 

	The proof of the claim is by induction on r where the base case when r = 0 is trivial, i.e., both (0, 0, L, R) and (0, 0, L, R) can be constructed without communication.
	
	For any r ≥ 1, the player holding r has access to all r-1_i,j for i, j ∈ [b_r]. Thus, the player can construct the required set of edges (r-1, r-1_i,j, L[i], R[j]) for all i,j ∈ [b_r] without any communication by the induction hypothesis. 
	The player holding r has access to permutations , and the following:
	
		
  * r-1_i,j for b_r ·α <(i) ≠(j) ≤ b_r and thus the player can construct construct the required 
		
    (r-1, r-1_i,j, L[i], R[j])

		without any communication by the induction hypothesis; and
		
  * r-1_i,j when b_r ·α <(i) = (j) ≤ b_r and thus the player can construct 
		
    (r-1, r-1_i,j, L[i], R[j])

		 without any communication, again, by the induction hypothesis.
	
Additionally, when r is even, this player constructs 

    (r-1, (n_r-1), L[i], R[j])  and  (r-1, (n_r-1), L[i], R[j])

 when (i) ≤ b_r ·α or (j) ≤ b_r ·α, which is trivial and does not need any communication since it only requires the knowledge of ,.




Using the above recursive definition, we obtain the main procedure for constructing a bipartite graph G  from any instance (r, r) of _r(n_r, α).

One player will be solely responsible for adding edges to G, and the other player only deletes edges from G. The particular roles of Alice and Bob depends on the parity of r. 






(r, r) for instance (r, r) of _r(n_r, α):

	
  * When r is odd, Alice inserts the edges = (r, r, L, R) and Bob deletes the edges = (r, r, L, R);
	
  * When r is even, Bob inserts the edges = (r, r, L, R) and Alice deletes the edges = (r, r, L, R). 

Return graph G = (L ∪ R, \). See <Ref> for an illustration of G.




Now, let us show that the instances we create are indeed valid graphs. 

	For any r ≥ 0, the graph G = (L ∪ R, \) = (r, r) is a valid graph, namely, ⊆.



	
	By construction, the player that inserts the edges and the player that deletes the edges depends on the parity of r.
	When r is odd, = (r, r, L, R) and = (r, r, L, R), and when r is even, the roles are reversed.
	Hence, we prove the claim by induction on r where, when r is odd, 
    (r, r, L, R) ⊂(r, r, L, R),
, and when r is even, the  vice-versa holds. 
	
	When r = 0 (even case), there are no edge deletions since (0, 0, L, R) = ∅, so the claim vacuously holds. 
	When r ≥ 1, we consider the cases where r is odd and even separately.
	

    Odd r.

	We consider the following groupings of the edges separately:
	
		
  * When b_r ·α <(i) ≠(j) ≤ b_r, the edge set (r-1, r-1_i,j, L[i], R[j]) held by Bob is directly contained in the edges (r, r, L, R) held by Alice.
		
  * When b_r ·α <(i) = (j) ≤ b_r, Bob holds the edge set (r-1, r-1_i,j, L[i], R[j]) and Alice holds the edge set (r-1, r-1_i,j, L[i], R[j]).
		Immediately by the induction hypothesis, since r-1 is even, we have that (r-1, r-1_i,j, L[i], R[j]) ⊆(r-1, r-1_i,j, L[i], R[j]).
		
	

	

    Even r.
 
Here, we have three different cases:
	
		
  * When b_r ·α < (i) ≠(j) ≤ b_r, the edges (r-1, r-1_i,j, L[i], R[j]) held by Alice are directly contained in the edges (r, r, L, R) by Bob. 
		
  * When b_r ·α < (i) = (j) ≤ b_r, by the induction hypothesis as r-1 is odd, we have that (r-1, r-1_i,j, L[i], R[j]) ⊆(r-1, r-1_i,j, L[i], R[j]) and are thus contained in (r, r, L, R).
		
  * When (i) ≤ b_r ·α or (j) ≤ b_r ·α, the edges (r-1, r-1_i,j, L[i], R[j]) are trivially a subset of (r-1, (n_r-1), L[i], R[j]) ∪(r-1, (n_r-1), L[i], R[j]), which are all included in (r, r, L, R) since r is even.
	


Overall, we have that ⊆ for any choice of r ≥ 0 and thus G = (L ∪ R, \) = (r, r) is a valid graph.




With that, we have that the players can take an instance (r, r) of _r and construct a valid graph G = (L ∪ R, \) without any communication. In the next section, we will show some structural properties of G that relate it to (r, r).



  §.§.§ Properties of the Constructed Graph

We need some notation before we begin proving the desirable properties of our construction. 
We define the following sets of special vertices: For i, j ∈ [b_r],

    _k := L[i]  when (i) = b_r ·α  + k    and    _k := R[j]  when (j) = b_r ·α  + k

for all k ∈ [k_r], and

    := ⋃_k ∈ [k_r]_k     and     := ⋃_k ∈ [k_r]_k.

See <Ref> for an illustration of the special vertices.
In the following claim, we show that the special vertices do, in fact, correspond to the special sub-instances (, ) of (r, r).


	For r ≥ 1, the subgraph of G = ( r, r) induced by the vertices ∪ is exactly the vertex-disjoint union of graphs  ( _k, _k) for all k ∈ [k_r].


	We only prove the claim when r is odd, as the case when r is even follows similarly. 
	
	Observe first that the only possible edges between  and  are the edges between L[i] and R[j] corresponding to (r-1_i,j, r-1_i,j) for any i , j ∈ [b_r] with b_r ·α <(i), (j) ≤ b_r.
	Considering only these edges, we split our analysis into two cases:
	
		
  * When b_r ·α < (i) ≠(j) ≤ b_r, Alice adds the edges corresponding to r-1_i,j,
		
		which is exactly the set of edges deleted by Bob. 
		Hence, none of these edges are present in G. 
		
  * When (i) = (j) = b_r ·α + k for k ∈ [k_r], Alice adds the edges corresponding to r-1_i,j,
		
		whereas Bob deletes the edges corresponding to r-1_i,j.
		
		As r-1 is even, these edge insertions and deletions exactly correspond to ( r-1_i,j, r-1_i,j).
		
		
		
		
		
	It then follows that the subgraph of G induced by L[i] ∪ R[j] = _k ∪_k is an exact copy of ( _k, _k).
	
	
	Finally, for any k_1, k_2 ∈ [k_r], _k_1∪_k_1 is disjoint from _k_2∪_k_2. Hence, the subgraph induced by ∪ is a vertex-disjoint union of the graphs (_k, _k) for k ∈ [k_r], proving the claim.


To highlight another key structural property in our construction of G, recall from <Ref> that any instance (r, r) of _r defines k_r · k_r-1·…· k_1 many special base instances.
We identify these special base instances and their corresponding sets of special base vertices in L and R using the tuples in [k_r] × [k_r-1] ×…× [k_1]. Formally, we have the following notation:



  
Notation.
Any tuple s = (s_r, s_r-1, …, s_1) identifies the special sub-instance (_s_r, _s_r) of (r, r), then the special sub-instance (_s_r-1, _s_r-1) inside (_s_r, _s_r), and so on until finally pointing to a single special base instance (_s_1, _s_1).
We denote this special base instance as (_s, _s). 
Furthermore, we use (, ) to denote the collection of special base instances (_s, _s) for all s = (s_r, s_r-1, …, s_1) ∈ [k_r] × [k_r-1] ×…× [k_1].


Any tuple s = (s_r, s_r-1, …, s_1) also identifies the sets of vertices _s_r⊆ L and _s_r⊆ R, then the sets _s_r-1⊆_s_r and _s_r-1⊆_s_r, and so on until identifying the sets of special base vertices _s_1⊆_s_2 in L and _s_1⊆_s_2 in R.
We denote these two sets of special base vertices as _s and _s. We further define

    := ⋃_s ∈ [k_r] × [k_r-1] ×…× [k_1]_s     and     := ⋃_s ∈ [k_r] × [k_r-1] ×…× [k_1]_s.


With this notation, we can now show that the special base vertices ∪ correspond to the special base instances (, ) using <Ref>.


	For r ≥ 1, the subgraph of G = (r, r) induced by the vertices ∪ is exactly the vertex-disjoint union of the bit graphs ( _s, _s) for all s ∈ [k_r] × [k_r-1] ×…× [k_1]. 	


	We prove this by induction on r.
	
	Base case for 𝐫=1. 
	
	For every s_1 ∈ [k_1], we have the following directly from the above definitions:
	
    _s = _s_1, _s = _s_1, _s = _s_1, _s = _s_1.
 
	Therefore, = and =. Then, by <Ref>, we have that the subgraph induced by the vertices  and  is a vertex-disjoint union of graphs 
	
    (_s_1, _s_1) = (_s_1, _s_1)
 
	for all s_1 ∈ [k_1]. 
	Furthermore, for each s_1 ∈ [k_1], (_s_1, _s_1) is a bit graph since it corresponds to the special base instance (_s_1, _s_1), which is an instance of _0.

	Inductive step for 𝐫 ≥ 2.
	Let := G[∪] be the subgraph in the statement.
	It will also be useful for us to consider the subgraph := G[∪].
	Since ⊆ and ⊆, we have that,
	
    = G[∪] = [∪].


	Now, by <Ref>,  is a vertex-disjoint union of subgraphs 
	_s_r := (_s_r, _s_r) for s_r∈ [k_r].
	Therefore, we only need to show that, for each s_r∈ [k_r], the subgraph _s_r, when restricted to the vertices in ∪ is exactly a vertex-disjoint union of the bit graphs (_s, _s) for all s ∈{s_r}× [k_r-1] ×…× [k_1].

	Since the only vertices of ∪ that are in _s_r are exactly its special base vertices, what we want immediately follows from the induction hypothesis applied to _s_r for each s_r∈ [k_r].
	
	
	
	
	
	
	
	
	
	
	
	
	
	


We can also show that these graphs have perfect matchings. 


	For r ≥ 0 and any (r, r), the graph G = (r, r) contains a perfect matching, i.e., of size 2n_r.




	


	

	

	






	We prove this claim by induction on r where the base case when r= 0 is trivial, i.e., we have that (0, 0) is a single bit graph, which has a perfect matching by <Ref>.

	When r ≥ 1, let H = G[∪] be its subgraph induced on the special vertices. By <Ref> and the induction hypothesis, we immediately have that H contains a perfect matching. Hence, it remains to argue that there is a perfect matching in the subgraph 
	
    H' = G[L \∪ R \].


By definition of the special vertices, L \ corresponds to L[i] where (i) ≤ b_r ·α and, similarly, R \ corresponds to R[j] where (j) ≤ b_r ·α for i,j ∈ [b_r].
	Then, to show that there is a perfect matching in H', it is sufficient to argue that 
	
    G[L[i] ∪ R[j]]  for each  i,j ∈ [b_r]  where (i) = (j) ≤ b_r ·α
 
	has a perfect matching since these are vertex disjoint graphs that cover all of L \ and R \.
We consider the case when r is odd and even separately.

	

    Odd r.
 
	By construction, Alice adds edges corresponding to r-1_i,j. 
	In order to obtain (r-1_i,j, r-1_i,j), which has a perfect matching by the induction hypothesis, Bob would need to delete the edges corresponding to r-1_i,j since r-1 is even.
	Instead, Bob deletes no edges so G[L[i] ∪ R[j]] is a superset of (r-1_i,j, r-1_i,j), which implies that it also has a perfect matching.

	

    Even r.
 By construction, Alice deletes the edges corresponding to r-1_i,j. 
	In order to obtain (r-1_i,j, r-1_i,j), which has a perfect matching by the induction hypothesis, Bob would need to add the edges corresponding to r-1_i,j since r-1 is odd.
	Instead, Bob adds a superset of these edges since he adds all possible edges 
	
    ((r-1, (n_r-1), L[i], R[j]) ∪(r-1, (n_r-1), L[i], R[j])).
 
	Therefore, (r-1_i,j, r-1_i,j)  is a subgraph of G[L[i] ∪ R[j]] and has a perfect matching. 


Finally, using these key structural properties, we show that any graph G has a perfect matching and that any -approximate maximum matching in G includes many edges that correspond to the bit graphs of the special base instances.



	For r ≥ 1, any -approximate maximum matching M in G = (r, r) identifies the bits of at least 
	
    n_r · (1/ - 2α r)
 
	many special base instances in (r, r).


	By <Ref>, we know that the edges in H = G[∪] are able to identify the bits of the special base instance.
	Therefore, we first obtain a bound on the number of edges in M that must have both endpoints in ∪, i.e., the number of its edges in H.

	Observe that the number of edges in M that are not in H have at least one endpoint not in ∪, i.e., there are at most |(L ∪ R) \ (∪)| many such edges.
	Therefore, M has at least 
	
    |M| - |(L ∪ R) \ (∪)|

	edges in H.
	Then, by definition of the special base vertices ∪ and the choice of parameters in <Ref> and <Ref>, we have that 
	
    || = || = 2 · k_r · k_r-1·…· k_1 = 2 n_r · (1-α)^r

	and 
	
    |(L ∪ R) \ (∪)| = 4n_r - 4 n_r · (1-α)^r = 4n_r (1 - (1- α)^r).

	Now, by <Ref> and since M is a -approximation, we have that M is of size at least 2n_r/, which gives us the following bound:
	
    |M| - |(L ∪ R) \ (∪)|    ≥ 2n_r/ -  4n_r (1 - (1- α)^r) 
       = 4n_r(1/2 - 1 + (1 - α)^r).


	Finally, by <Ref>, the only edges in H are the edges of the vertex-disjoint union of the bit graphs (_s, _s) for s ∈ [k_r] × [k_r-1] ×…× [k_1]. 
	By <Ref>, each bit graph is a matching of exactly two edges, each of which can be used to identify the underlying bit of the special base instance. Therefore, in the worst case, every two edges of M in H identifies a single bit of a special base instance and thus at least 
	
    2n_r(1/2 - 1 + (1 - α)^r)    ≥ 2n_r (1/2 - 1 + 1 - α· r) by Bernoulli's inequality
        = n_r · (1/ - 2α· r)

	many such bits are identified by M.




  §.§.§ A Protocol for _r(n_r, α) using a Dynamic Streaming Algorithm


Using the above graph construction and its key properties, we can now construct a protocol  for any instance (r, r) of _r(n_r, α) that simulates a run of any p-pass s-space dynamic streaming algorithm  for -approximate maximum matching on the bipartite graph G = (r, r).


We then use this protocol to prove <Ref>.


	

	A protocol  for _r(n_r, α) on any input (r,r) using the p-pass s-space dynamic streaming algorithm  where r = 2p-1:
	
		
  * Alice computes the edge insertions E_A = (r, r, L, R) and then constructs an arbitrary ordering σ_A of the edges E_A.
		Similarly, Bob computes the edge deletions E_B = (r, r, L, R) and then constructs an arbitrary ordering σ_B of the edges E_B.
		
  * The players simulate each pass of  on the stream of insertions σ_A followed by deletions σ_B in the usual manner: To simulate a single pass, Alice runs  on the insertions in σ_A then sends the memory state to Bob, who continues  on the deletions  in σ_B and sends the memory state back to Alice. In only the final pass, Bob computes the output matching M of  instead of sending its memory state.

		
  * In parallel to the simulation, Alice and Bob also exchange messages to identify the labels of all the special base instances in (,), each of which is identified by a tuple (s_r, s_r-1, …, s_1) ∈ [k_r] × [k_r-1] ×…× [k_1] as follows. 
		
			
  * In the first round, Alice does not send anything. In the second round, Bob sends the two input permutations , of [b_r] along with the message to Alice, using which Alice can identify k_r many special sub-instances of _r. 
			
  * For any round 2 < t ≤ r, the player who receives the message of round t-1 identifies the k_r · k_r-1·…· k_r-t+3 many special instances of _r-t+2 (sub-instances of _r-t+3). In round t, this player sends 2 · k_r · k_r-1·…· k_r-t+3 many permutations of [b_r-t+2], corresponding to the two input permutations of each of these instances of _r-t+2. 
			
  * After receiving message of round r, Bob is able to identify the k_r · k_r-1·…· k_2 many special instances of _1. Bob already knows the two input permutations of [b_1] associated with all these special instances of _1, and thus knows the labels of all the special base instances.
		










		
  * At the end of the protocol, the final player receives a uniform random search sequence s^* = (r, r-1, …, 1). Then, using the information obtained in the previous step, the player identifies the special base instance (_s^*, _s^*) and corresponding special base vertices _s^* = {ℓ_1, ℓ_2} and _s^* = { r_1, r_2 }. 
		The player returns x_s^* as the output of the protocol, which is determined as follows:
		
			
  * If M contains the edge (ℓ_1, r_1) or (ℓ_2, r_2), x_s^* = 0;
			
  * If M contains the edge (ℓ_1, r_2) or (ℓ_2, r_1), x_s^* = 1;
			
  * Otherwise, x_s^* is a uniform random bit.
		
	
	




We now use this constructed protocol to prove the desired connection between maximum bipartite matching in the dynamic streaming model and the _r problem, 
thus proving <Ref>. 


	To prove this lemma, we show that  is an r-round protocol with 
	
    ≤ r · s + O(r^2 · n_r log n_r)   and  ≥ 1/2 + 1/6

	where, as in the statement of the lemma, r = 2p-1, α = 1/(4  r), and ≥ 1 is the approximation guarantee of the maximum matching returned by .

	First, we argue the number of rounds of communication required by each step separately: 
	
		
  * By <Ref>, Alice and Bob can compute their edges E_A and E_B without any communication. 
		
  * In the simulation of , each pass of the algorithm is simulated using two rounds of communication, one message from Alice and one message from Bob, except for the final pass, which only requires one round, i.e., one message from Alice. Since  has p passes, simulating it requires r = 2p -1 rounds of communication. 
		
  * Identifying the labels of the special base instances (which is only required at the end to output the solution) also requires r rounds of communication since, at the end of each round t ∈ [r], k_r · k_r-1·…· k_r-t+1 many special instances of _r-t are identifiable by the player that receives the message.
		
  * Returning the output of protocol  is solely computed from the output of  and the identified labels, which can be done without any further communication.
	
	Since the simulation of  and identifying the labels is done in parallel, protocol  is an r-round protocol.

	Next, we argue the communication cost of  by considering separately the only two steps that require communication.
	To simulate , the players only exchange the memory state of . Since this requires at most s bits for each of the r messages, the overall communication required in the simulation is at most r · s bits.
	
		Next, we give an upper bound on the communication required to communicate the labels. In round t for 2 ≤ t ≤ r, the player sends 2 · k_r · k_r-1·…· k_r-t+3 many permutations of [b_r-t+2]. 
	Using <Ref>, we can say, in total,
		
    2 · k_r · k_r-1·…· k_r-t+3· b_r-t+2·log (b_r-t+2)    ≤ 2· b_r · b_r-1·…· b_r-t+3· b_r-t+2·log(b_r-t+2) 
       =  O(n_r ·log (n_r))

		bits are sent. In r rounds, the total number of bits to find the labels of all special instances is O(r · n_r ·log (n_r)).
	Therefore, ≤ r · s + O(r · n_r log n_r).

	Finally, we argue the probability of success of . The goal for solving the instance (r, r) of _r(n_r, α) is to output the bit of the special base instance (_s^*, _s^*) where s^* = (r, r-1, …, 1) is the uniform random search sequence given to the final player, i.e., Bob since r = 2p-1 is odd, at the end of the protocol. 
	In protocol , the predictor x_s^* of the solution is obtained from the matching M returned by  or is a uniform random guess.

	When  succeeds, which occurs with 1-1/(n) probability, it is guaranteed to output a -approximate maximum matching M in the bipartite graph (r, r).
	By <Ref>, the edges of M identify the bits of at least n_r · (1/ - 2α r) many special base instances, which are n_r · (1- α)^r many in total by <Ref>.
	Since s^* uniformly selects one of the special base instances to correspond to the solution bit, M identifies it with probability at least 
	
    1/ - 2α r/(1- α)^r≥ 1/ - 2α r = 1/ - 1/2 = 1/2

	since α = 1/(4  r) ∈ (0,1).

	Thus, we have, 
	
		
  * When  succeeds and M correctly identifies the solution bit, the predictor x_s^* returned by  is correct (with probability 1);
		
  * When  succeeds but M does not identify the solution bit, the predictor x_s^* returned by  is a random guess and thus is correct with probability 1/2;
		
  * When  fails, there is no guarantee on the predictor bit, and we might as well assume the answer is wrong (with probability 1); 
	
	As such, we have that the protocol succeeds with probability at least 
	
    1-1/(n)·1/2· 1 + 1-1/2·1/2 + 1/(n)· 0 ≥1/2·1+1/3,

	since β is a constant. This concludes the proof. 



	In the construction of (r, r), when r is even, Alice deletes the edges before Bob adds them: for the corresponding streaming problem, this corresponds to deleting edges that have not been inserted (although the final stream
	still ensures that any edge that is deleted will be inserted); this is not consistent with the definition of dynamic graph streams. 
	Nevertheless, in our construction, we only use the _r lower bound when r = 2p-1 and thus is odd. Here, Alice adds edges to the graph, and Bob deletes the edges after all the edges are added. As a result, in the corresponding
	streaming problem, no edge is deleted before it is inserted, thus adhering to the restriction of the dynamic graph streams. 





halpha-abbrv








PART: 
*Appendix



§ BACKGROUND ON INFORMATION THEORY


We now briefly introduce some definitions and facts from information theory that are needed in this thesis. We refer the interested reader to the text by Cover and Thomas <cit.> for an excellent introduction to this field, 
and the proofs of the statements used in this Appendix. 

For a random variable , we use  to denote the support of  and  to denote its distribution. 
When it is clear from the context, we may abuse the notation and use  directly instead of , for example, write 
A ∼ to mean A ∼, i.e., A is sampled from the distribution of random variable . 



  * We denote the Shannon Entropy of a random variable  by
, which is defined as: 

    := ∑_A ∈ = A·log1/ = A
 


  * The conditional entropy of  conditioned on  is denoted by | and defined as:

    | := _B ∼| = B,

where 
| = B is defined in a standard way by using the distribution of  conditioned on the event = B in Eq (<ref>). 

 

  * The mutual information of two random variables  and  is denoted by
 and is defined:

    := A - A |  B = B - B |  A.



  * The conditional mutual information is defined as |:= | - |,.




 §.§ Useful Properties of Entropy and Mutual Information


We shall use the following basic properties of entropy and mutual information throughout. 
Proofs of these properties mostly follow from convexity of the entropy function
and Jensen's inequality and can be found in <cit.>. 


  Let , , , and  be four (possibly correlated) random variables.
   
  
  *  0 ≤≤log. The right equality holds
    iff  is uniform.
  
  *  |≥ 0. The equality holds iff  and
     are independent conditioned on .
  
  *  Conditioning on a random variable reduces entropy:
    |,≤|.  The equality holds iff ⊥|.



  
  *  Chain rule for mutual information: ,| = | + |,.
  
  *  Data processing inequality: for a function f() of , f()|≤|. 
   












We also use the following two standard propositions on effect of conditioning on mutual information.


  For random variables , , ,, if ⊥|, then, 
  
    |≤|,  .


 
  Since  and  are independent conditioned on , by
  cond-reduce, (|) = (|, ) and (|, ) ≥(|, , ).  We have,
	 
    |   = (|) - (|, ) = (|, ) - (|, ) 
       ≤(|, ) - (|, , ) = |, .

	



  For random variables , , ,, if ⊥|,, then, 
  
    |≥|, .


 
 Since ⊥|,, by cond-reduce, (|,) = (|,,). Moreover, since conditioning can only reduce the entropy (again by cond-reduce), 
  
    |   = (|) - (|,) ≥(|,) - (|,) 
       = (|,) - (|,,) = |,.


























 §.§ Measures of Distance Between Distributions


We use two main measures of distance (or divergence) between distributions, namely the Kullback-Leibler divergence (KL-divergence) and the total variation distance. 



  
KL-divergence. For two distributions μ and ν over the same probability space, the Kullback-Leibler (KL) divergence between μ and ν is denoted by μν and defined as: 

    μν:= _a ∼μlogμ(a)/ν(a).

We also have the following relation between mutual information and KL-divergence. 

	For random variables ,,, 
	
    | = _(B,C) ∼(,)|=B,=C|=C.
 























  
Total variation distance. We denote the total variation distance between two distributions μ and ν on the same 
support Ω by μν, defined as: 

    μν:= max_Ω' ⊆Ωμ(Ω')-ν(Ω') = 1/2·∑_x ∈Ωμ(x) - ν(x).

We use the following basic properties of total variation distance. 

	Suppose μ and ν are two distributions for , then, 
	μ() ≤ν() + μν.











We also have the following (chain-rule) bound on the total variation distance of joint variables.


	For any distributions μ and ν on n-tuples (X_1,…,X_n), 
	
    μν≤∑_i=1^n_X_<i∼μμ(X_i | X_<i)ν(X_i | X_<i).


































The following Pinsker's inequality bounds the total variation distance between two distributions based on their KL-divergence, 

[Pinsker's inequality]
	For any distributions μ and ν, 
	μν≤√(1/2·μν). 


































 Paper Title: Quantum advantage from measurement-induced entanglement in random shallow circuits.







^1 Department of Pure Mathematics, University of Waterloo
^2 Institute for Quantum Computing, University of Waterloo
^3 Department of Combinatorics and Optimization, University of Waterloo
^4 Perimeter Institute for Theoretical Physics, Waterloo
^5 California Institute of Technology
§ ABSTRACT 

We study random constant-depth quantum circuits in a two-dimensional architecture.
While these circuits only produce entanglement between nearby qubits on the lattice, long-range entanglement can be generated by measuring a subset of the qubits of the output state. It is conjectured that this long-range measurement-induced entanglement (MIE) proliferates when the circuit depth is at least a constant critical value d^*.
For circuits composed of Haar-random two-qubit gates, it is also believed that this coincides with a quantum advantage phase transition in the classical hardness of sampling from the output distribution.

Here we provide evidence for a quantum advantage phase transition in the setting of random Clifford circuits. 
Our work extends the scope of recent separations between the computational power of constant-depth quantum and classical circuits, demonstrating that this kind of advantage is present in canonical random circuit sampling tasks. In particular, we show that in any architecture of random shallow Clifford circuits, the presence of long-range MIE gives rise to an unconditional quantum advantage. In contrast, any depth-d 2D quantum circuit that satisfies a short-range MIE property can be classically simulated efficiently and with depth O(d). 
Finally, we introduce a two-dimensional, depth-2, “coarse-grained" circuit architecture, composed of random Clifford gates acting on O(log(n)) qubits, for which we prove the existence of long-range MIE and establish an unconditional quantum advantage.


Quantum advantage from measurement-induced entanglement 
 in random shallow circuits
    Mehdi Soleimanifar^5
    August 5, 2024
====================================================================================





§ INTRODUCTION

Identifying computational tasks where quantum computers yield an advantage compared to classical ones is a central goal of quantum information science. To make effective progress, one hopes to understand which families of quantum circuits admit efficient classical simulation algorithms, with a focus on quantum circuit architectures that are experimentally feasible in the near-term.

A key task involving quantum circuits is simulating measurement of their output state in the standard basis. In the worst case, classically sampling from this output distribution is intractable—even for the 2D brickwork architecture, and with circuit depth as small as d=3 <cit.>.
However, the classical hardness of this problem for circuit architectures composed of random local gates remains less well understood. Such random quantum circuits have diverse applications:  they underpin quantum supremacy experiments <cit.>, provide benchmarking schemes for near-term quantum devices <cit.>, and model typical quantum states arising from the dynamics or ground states of locally-interacting quantum systems <cit.>.
Random instances of quantum circuits can also help identify generic features that relate to the classical hardness of simulating quantum circuits.

Perhaps surprisingly, it has been conjectured that the complexity of sampling from the output distribution of random geometrically local quantum circuits in a two-dimensional architecture undergoes a quantum advantage phase transition: polynomial-time classical simulation is believed to be possible if and only if the circuit depth is 
below a constant critical value d^* <cit.>.
Recent works have proposed an intriguing physical origin for this computational transition, linking it to a change in the amount of measurement-induced entanglement (MIE) in random quantum circuits <cit.>.

Measurement-induced entanglement, which enables quantum protocols such as teleportation and entanglement swapping, occurs when spatially separated subsystems of a many-body state become entangled due to measurements on other subsystems. When combined with unitary dynamics, MIE gives rise to emergent phases with distinctive entanglement patterns <cit.>. 
In 2D constant-depth quantum circuits, where only nearby qubits may be entangled prior to measurements, MIE can lead to the formation of entanglement between more distant qubits. This in turn can affect the cost of classically simulating measurement of all qubits in the output state of the quantum circuit.  Based on numerical simulations and heuristic mappings to statistical models, previous works <cit.> have suggested that for circuit depth d < d^*, MIE results in short-range entanglement, making the circuit amenable to classical simulation techniques. 
However, for depths d ≥ d^*, MIE induces long-range entanglement, which poses an obstacle for the efficient classical simulation of random quantum circuits. <ref> illustrates the change in behaviour of MIE  at the conjectured critical circuit depth d^*=6 for two-dimensional random Clifford circuits. 
A similar transition in MIE has been recently observed in random 2D circuits composed of one- and two-qubit gates that form a universal gate set <cit.>.

Establishing this quantum advantage of random quantum circuits—and more broadly, a separation between efficient quantum and classical computation—has remained elusive. 
A series of recent works <cit.> have provided unconditional results addressing a more limited notion of quantum advantage. 
In these works, a computational problem is introduced that can be solved by geometrically-local constant-depth quantum circuits, but not by any classical probabilistic circuit whose depth grows sub-logarithmically with the input size. These works also provide distributions over instances such that classical shallow circuits cannot even solve an instance in the average case (see e.g., <cit.>).
Existing results along these lines make use of certain specially tailored families of shallow quantum circuits. This raises the question of whether generic shallow quantum circuits over a fixed architecture demonstrate a similar quantum advantage. 

In this paper, we answer this question in the affirmative. We describe a family of random quantum circuits whose measurement distributions cannot be simulated with shallow classical circuits. The key to our findings is establishing a connection between the emergence of long-range MIE at the critical depth d^* and the limitations of low-depth classical simulation methods. 

Let us now describe our results in more detail.





§ OVERVIEW OF RESULTS



 §.§ Measurement-induced entanglement

Consider n qubits at the vertices of a 2D square lattice. 
These qubits are partitioned into three sets A, B, and C where A is a single qubit and B is a square region that shields A from C, see <ref>.
All qubits are initialized in the |0⟩ state. We apply a unitary U to A∪ B∪ C and then measure qubits in B in the computational basis. For the moment we consider the case where U is a random depth-d circuit in the brickwork architecture, see <ref>.  We study the setting where the side length of B is much larger than 2d. By a lightcone argument, this ensures that qubit A is unentangled from qubits in C in the output state of the quantum circuit, and only may become entangled as a result of the measurement of qubits in B. 

In this setting, one can ask: What is the shallowest depth d^* at which there is measurement-induced entanglement between A and C?

For simplicity we can imagine that we have already taken the  limit of an infinite lattice n→∞. Then for depth d<d^* it is conjectured that  the expected purity 𝔼[(ρ^2_A)] of qubit A (averaged over the random choice of circuit and measurement outcomes on B) approaches 1 exponentially fast as |B| grows, while for d≥ d^⋆ this expected purity is at most 1-γ(d) where γ(d)>0 is a constant that may depend on depth d, but is independent of the size of the shielding region B <cit.>.

This scenario motivates the following definitions of short-range and long-range MIE for output states of 2D random quantum circuits. In the following definitions, a 2D, n-qubit, random quantum circuit is described by a probability distribution over quantum circuits that act on n qubits arranged at the vertices of a two-dimensional square grid. A family of 2D random quantum circuits is described by a sequence of such probability distributions, with an increasing number of qubits n_1,n_2,n_3,…. Note that here we do not restrict the gates of the circuit to act on nearest-neighbor qubits.

[Short-range MIE]
A family ℱ of random 2D quantum circuits satisfies the short-range MIE property if the following holds. Suppose ψ is a random pure state on a 2D lattice of n qubits that is generated according to ℱ. We measure all qubits of ψ in an L× L shielding region B centred at qubit A∈ [n], obtaining outcome x∈{0,1}^|B|. Let ρ_A=ρ_A(x) be the postmeasurement state of qubit A. Then

    𝔼[Trρ_A^2]≥ 1-e^-Ω(L).

Here the expectation is taken over the randomness in generating ψ as well as the distribution of random measurement outcomes on qubits in B.






[Long-range MIE] A family ℱ of random 2D quantum circuits satisfies the long-range MIE property if there is a constant c∈ (0,1) such that the following holds. Let ψ be a random pure state on a 2D lattice of n qubits that is generated according to ℱ.  We measure all qubits of ψ in an L× L shielding region B centred at qubit A∈ [n], obtaining outcome x∈{0,1}^|B|. Let ρ_A=ρ_A(x) be the postmeasurement state of qubit A. Here L is any positive integer such that |C|≠ 0. Then

    𝔼[Trρ_A^2]< c,

where the expectation is taken over the randomness in generating ψ as well as the distribution of random measurement outcomes on qubits in B.



As noted above, we expect 2D brickwork random circuits to have the short-range MIE property for depth d<d^* and to satisfy the long-range MIE property for d≥ d^*. In fact, in the latter case we expect that measurement-induced entanglement is “everywhere"—that is, present with respect to more general tripartitions [n]=ABC of the qubits (not just the case discussed above where B is a square shielding region centred at A). We also expect that this proliferation of MIE gives rise to genuine multipartite entanglement. We shall use the following notion of long-range tripartite MIE, which is phrased in more general terms and can be applied to random circuits in other architectures. 

[Long-range tripartite MIE]
A family ℱ of random quantum circuits satisfies the long-range tripartite MIE property if there are constants c_1,c_2∈ (0,1) such that the following holds. Suppose ψ is a random n-qubit pure state that is generated according to ℱ. Let Ω={h,i,j}⊆ [n] be a uniformly random triple of qubits. Let ρ_Ω=ρ_Ω(x) be the state of qubits in Ω after measuring all other qubits of ψ in the computational basis and obtaining outcome x∈{0,1}^n-3. Let ρ_h, ρ_i, ρ_j be its one-qubit reduced density matrices. Then, with probability at least c_1>0 we have

    Tr[ρ_h^2]<c_2   and  Tr[ρ_i^2]<c_2   and  Tr[ρ_j^2]<c_2.

Here the probability is over the random choice of ψ, the choice of triple {h,i,j}, and the random measurement outcomes on qubits in [n]∖{h,i,j}.



Rigorously establishing the conjectures described above, and the existence of a phase transition in measurement-induced entanglement for 2D brickwork circuits at a constant depth d^*, is a challenging open problem. Part of the challenge is that the shallow circuit depth does not allow the quantum system to fully randomize in most senses of interest.  On the other hand, for larger circuit depths d growing with n, random circuits can be easier to analyze as they begin to inherit properties of the Haar-random unitary ensemble, such as the unitary t-design property and anticoncentration.

Indeed, we show that long-range MIE exists whenever there is  subsystem anticoncentration–a feature of random quantum circuits which is expected to hold for depth Ω(log(n)) <cit.>. Let P_AB(0)=⟨ 0^ABC|U^† |0⟩⟨ 0|_AB U|0^ABC⟩ be the probability of measuring all-zeros on qubits in AB. Define a measure of subsystem anticoncentration

    χ≡ 4^|AB|𝔼_U[P_AB(0)^2]-1.

Here χ depends on the tripartition ABC as well as the random circuit ensemble.  Note that if U is a Haar-random n-qubit unitary then 

    χ_Haar=2^|AB|-1/2^|ABC|+1

which is exponentially small in |C|. We say that the subsystem AB anticoncentrates with respect to a random circuit ensemble if χ→ 0 as |C| grows.

The following result shows that subsystem anticoncentration implies long-range MIE. 


For any tripartition of the qubits ABC where A is a single qubit, we have

    𝔼[Trρ_A^2]≤1/2+3/2√(χ).



We will use this bound to establish long-range MIE in a certain “coarse-grained" circuit architecture which is introduced below; this describes depth-2 circuits with gates acting on O(log(n)) qubits at a time. However, we expect long-range MIE to be present even in constant-depth 2D random quantum circuits composed of two-local gates and with depth above the critical value. Such circuits do not satisfy the subsystem anticoncentration condition considered above. Indeed, for |C|<n, the χ value for depth-d random quantum circuits composed of two-local gates over an arbitrary architecture admits the following lower bound

    χ   =∑_s∈{0,1}^|AB|𝔼_U[⟨0^n|U^† (Z(s)_AB⊗ I_C)|0^n⟩^2]-1
       ≥𝔼_U[⟨0^n|U^† Z_A U|0^n⟩^2]≥1/3(2/5)^d

where the last inequality follows from Lemma 2.12 in Ref. <cit.>; see also <cit.>. Thus, χ≥Ω(1) for d=O(1), demonstrating that a different proof technique is needed to establish long-range MIE in this setting.

Next we describe how MIE is related to classical simulation and quantum advantage.



 §.§ Shallow and efficient classical simulation



We obtain a simple, efficient, and shallow classical simulation of 2D quantum circuits 
under the condition that they only generate short-range MIE. We expect that this condition is satisfied by 2D brickwork random circuits in  the low-depth regime d < d^* where MIE is expected to be short-range. 

Our classical simulation algorithm is a modified version of the recently introduced “gate-by-gate" method <cit.>.

    Consider a depth-d quantum circuit U=U_tU_t-1… U_1 acting on n qubits arranged at the vertices of a 2D grid. Suppose that each gate in the circuit is either a CNOT gate between nearest-neighbor qubits on the grid, or a single-qubit gate. Suppose that the output state of any subcircuit of U satisfies the short-range MIE condition <ref>. Then there is an efficient algorithm which samples from the output distribution of U. Moreover, this probabilistic classical algorithm can be parallelized to depth O(d) using gates that act on O(log^2(n)) bits at a time. 



The classical circuit in the above can be parallelized to depth O(d) even in a “programmable" setting where it takes as input the specification of the individual gates U_1,U_2,…, U_t in the circuit and outputs a binary string approximately sampled from the output distribution. 

Our algorithm complements an existing technique from Ref. <cit.> for classically simulating low-depth 2D circuits which is efficient under a different criterion for short-range MIE. The `patching algorithm' described in  <cit.> proceeds by first sampling from small disjoint subregions of the 2D lattice and then patching them together to obtain an overall sample from the output distribution. 
This algorithm succeeds when the short-range MIE property holds for subregions A of size O(log^2(n)) and when X = A ∪ B ∪ C corresponds to a subregion X ⊂ [n] obtained by tracing out disconnected squares of side O(log(n)) from the lattice.  
In contrast, our simulation algorithm for the quantum circuit U in <ref> relies on any subcircuit of U exhibiting short-range MIE when A is a single qubit and  A ∪ B ∪ C = [n] is a tripartition of the entire lattice. 






 §.§ Quantum advantage with random shallow Clifford circuits

Next we specialize to shallow Clifford circuits. These circuits are capable of outperforming classical constant-depth circuits at certain tasks—the kind of quantum advantage described in Refs. <cit.>. More precisely, these works use classically controlled (or “programmable") Clifford circuits: the quantum circuit takes as input a binary string x and then samples from the output distribution of a Clifford circuit C_x that depends on the input. 

To study quantum advantage in random Clifford circuits we view them as programmable Clifford circuits with random inputs. That is, for any depth-d circuit architecture with gates acting on k-qubits at a time, we consider a controlled Clifford circuit that takes as input a specification of the individual gates in the circuit. Note that a k-qubit Clifford gate can be specified by O(k^2) bits. So the programmable Clifford circuit is also depth-d but has gates that act on O(k^2) qubits at a time.

Can this programmable Clifford circuit, with random input, be simulated by a shallow classical circuit?  For a given choice of gates (input) the classical simulator succeeds if its output distribution is close in total variation distance to the correct output distribution. We say that a classical probabilistic circuit simulates random Clifford circuits in this architecture if it succeeds with high probability over the choice of random gates. 


The following result shows that shallow random Clifford circuit families with k=O(1)-qubit gates that generate long-range tripartite MIE cannot be simulated by constant-depth classical circuits using gates that act on K=O(1) bits at a time.


 Consider a depth-d circuit architecture with random Clifford gates. Suppose that the family of random Clifford circuits in this architecture satisfies the long-range tripartite MIE property (<ref>). Suppose n is sufficiently large. Then a probabilistic classical circuit composed of gates with fan-in K and circuit depth D which simulates n-qubit random Clifford circuits in this architecture satisfies D ≥1/4log(n)/log(K).


Since it is conjectured that shallow Clifford circuits in a 2D brickwork architecture with depth d≥ d^* satisfy the long-range tripartite MIE property, this result provides evidence that such random shallow Clifford circuits attain a quantum advantage over classical shallow circuits.

The proof of <ref> extends the classical lower bound from Ref. <cit.> which can be viewed as exploiting the fact that tripartite MIE in 2D grid graph states is hard for a classical shallow circuit to simulate. While that proof made use of the structure of 2D grid graph states, here we show that long-range tripartite MIE is all that is needed for quantum advantage.

Note that <ref> applies to more general circuit architectures beyond the 2D brickwork architecture. Can we rigorously establish long-range MIE, long-range tripartite MIE,  and quantum advantage in some architecture of random 2D circuits?


To this end, we introduce a “coarse-grained” architecture  shown in <ref>. The qubits are arranged on a √(n)×√(n) two-dimensional lattice and the circuit applies only two layers of gates.
Each gate acts on a square τ×τ subgrid of qubits. Note that here the depth of the quantum circuit is 2 and τ is a parameter that describes the locality of gates. This parameter plays the same role as circuit depth in the 2D brickwork architecture—it measures the linear size of the lightcone of a single qubit [In particular, if U is a coarse-grained circuit and O_j is an operator acting on qubit j, then the support of UO_jU^† is contained within a square region of size O(τ^2) centered at j. ].

  
Random coarse-grained Clifford circuits with τ = O(√(log(n))) and with n sufficiently large, satisfy both the long-range MIE property, and the long-range tripartite MIE property.



To prove <ref> we first show that the coarse-grained architecture with the stated choice of τ satisfies a strong form of subsystem anticoncentration in which the parameter χ from <ref> decays exponentially with the size of C. This subsystem anticoncentration is established using a (first moment) probabilistic method. We then show that for Clifford circuits this strong form of subsystem anticoncentration is enough to guarantee both long-range and long-range tripartite MIE.

As a direct corollary of <ref> we obtain an unconditional quantum advantage with random Clifford circuits in the coarse-grained architecture:

Random coarse-grained Clifford circuits with τ = O(√(log(n))) and with n sufficiently large, cannot be simulated by any probabilistic classical circuit of depth D < 1/4log(n)/log(K) and fan-in K.



The family of random coarse-grained Clifford circuits with τ = O(√(log(n))) can be implemented (in a programmable sense) via a depth-2 quantum circuit with gates acting on k=O(log(n)^2) qubits. In contrast, <ref> states that any classical probabilistic circuit composed of gates with fan-in K=polylog(n) that simulates the random circuit family must have depth D>Ω(log(n)/loglog(n)).



 §.§ Discussion

We have shown that an unconditional quantum advantage with random shallow Clifford circuits follows from the presence of long-range tripartite MIE. We also exhibited a random circuit architecture with this property.

Moreover, <ref> provide evidence that 2D random shallow Clifford circuits in the standard brickwork architecture undergo a quantum advantage phase transition  that coincides with the emergence of long-range (and long-range tripartite) MIE at the critical depth d^*=6. This provides a scaled-down Clifford counterpart to the conjectured phase transition in the classical hardness of simulating random circuits composed of two-qubit Haar-random gates in the same architecture. 

There are several open questions related to this work. Can we prove the existence of a phase transition in MIE at a constant critical circuit depth d^* for 2D brickwork random shallow circuits? Can we show that the quantum advantage with shallow circuits follows from the long-range MIE property (rather than the tripartite version)? Can we establish a quantum advantage in circuit depth for random circuits composed of Haar-random gates (instead of Clifford gates)? 

In the remaining sections of the paper we prove Theorems 1-4, respectively.





§ SUBSYSTEM ANTICONCENTRATION IMPLIES LONG-RANGE MIE


Here we show that random circuits that anticoncentrate also exhibit long-range measurement-induced entanglement. In particular, we prove <ref>.  

Suppose U=U_mU_m-1… U_1 is an n-qubit quantum circuit where each gate U_j is a Haar random k-qubit gate acting on the qubits in its support.
Here our results apply to general quantum circuits—i.e.,  we do not specify an architecture or require the circuit to act on a system of qubits in a 2D geometry. In the following we shall relate properties of U to those of a random Clifford circuit D=D_mD_m-1… D_1 where each D_i is a random Clifford unitary that acts on the qubits in the support of U_i. 

For any s∈{0,1}^n, let Z(s)=∏_j=1^n Z_j^s_j. Here Z_j is the Pauli Z operator acting on the jth qubit. Let [n]=ABC be a tripartition of the qubits such that |A|=1. For the output state of the Clifford circuit D, the presence or absence of post-measurement entanglement between A and C after measuring B is determined by a set S defined as follows (this set indexes “entanglement-killing" stabilizers of the state D|0^n⟩). For P=X,Y,Z, let

    S_P≡   {s∈{0,1}^n: DZ(s)D^†=(-1)^α P_A⊗ Z(r)_B⊗  I_C 
        for some  r∈{0,1}^|B|, α∈{0,1}}

and let 

    S=S_X∪ S_Y∪ S_Z.
 



Suppose |ϕ⟩=D|0^n⟩ where D is a Clifford unitary. Let [n]=ABC be a tripartition of the qubits where |A|=1. There is post-measurement entanglement between A and C after measuring all qubits of B in the state ϕ, if and only if S=∅. 


Let G={DZ(s)D^†: s∈{0,1}^n} be the stabilizer group of ϕ.

First suppose S is nonempty. Then (-1)^α P_a⊗ Z(r)_B⊗ I_C is a stabilizer of ϕ, for some P∈{X,Y,Z}, r∈{0,1}^n, α∈{0,1}. After measuring all qubits in B in the computational basis, the postmeasurement state is stabilized by ± P_A for some choice of sign ± 1 determined by the measurement outcomes. In other words, the postmeasurement state is a pure 1-qubit stabilizer state.

Next suppose we measure all qubits in B , obtain measurement outcome x∈{0,1}^|B|, and the postmeasurement state ρ_A on qubit A is pure. The stabilizer group of this state is generated by

    G'={(-1)^x_j Z_j: j∈ B}∪ G”

where

    G”={P∈ G: P  is Z-type on B}.

(We say that an n-qubit Pauli operator is Z-type if it is a tensor product of I and Z Pauli operators.) Since ρ_A is pure, it must have a stabilizer ± P_A⊗ I_BC for some P∈{X,Y,Z}. This stabilizer can be expressed as a product of elements from the set of generators above. That is, for some T⊆ G” and R⊆ B we have

    P_A=∏_Q∈ TQ ∏_j∈ R(-1)^x_jZ_j.

From the above we conclude that 

    (-1)^∑_j∈ R x_j P_A⊗ Z(R)_B⊗ I_C=∏_Q∈ TQ =DZ(s)D^†

for some binary string s∈{0,1}^n. Therefore s∈ S and S≠∅.



<ref> shows that emptiness of S determines postmeasurement entanglement for Clifford circuits. We now show how this criterion can be extended to our random non-Clifford circuit U of interest.
 
Define Π(x)=|x⟩⟨ x|_B⊗ I_AC for x∈{0,1}^|B|. If we measure all qubits in B, we obtain x with probability

    q(x)≡⟨ 0^n|U^†Π(x) U|0^n⟩.

The postmeasurement state on A is then

    ρ(x)=1/q(x)Tr_BC(Π(x) U|0^n⟩⟨ 0^n|U^†Π(x)).


The expected purity of the postmeasurement state on A is upper bounded as

    𝔼_U 𝔼_x∼ qTr(ρ(x)^2)≤1/2+1/2√(3𝔼_D[|S|]).



Note that the LHS describes the purity of the postmeasurement state in the universal circuit U, while the RHS only involves an average over the Clifford circuit D. Moreover, this average is upper bounded as

    1/3𝔼_D[|S|]=𝔼_D[|S_Z|]
       ≤𝔼_D[∑_s∈{0,1}^AB, s≠ 0^|AB|⟨ 0^n|D^† Z(s)_AB⊗ I_C D|0^n⟩^2]
       =4^|AB|𝔼_D[|⟨ 0^n|D^†(|0⟩⟨ 0|_AB⊗ I_C) D |0^n⟩|^2]-1
       =4^|AB|𝔼_U[|⟨ 0^n|U^†(|0⟩⟨ 0|_AB⊗ I_C) U |0^n⟩|^2]-1
 
where in the last line we used the two-design property of the Clifford group. Here <ref> is the quantity denoted χ in the Introduction, which measures anticoncentration of subsystem AB.


Write

    α_P(x)≡1/2⟨ 0^n|U^†Π(x)·(P_A⊗ I_BC) U|0^n⟩,

so that

    ρ(x)=1/2α_I(x)∑_P∈{I,X,Y,Z}α_P(x) P.

Using the fact that ∑_xΠ(x)⊗Π(x)=2^-|B|∑_s∈{0,1}^|B| Z(s)⊗ Z(s) we get

    ∑_x∈{0,1}^|B| |α_P(x)|^2
       =1/4· 2^|B|∑_s∈{0,1}^|B| |⟨ 0^n|U^† (P_A⊗ Z(s)_B) U|0^n⟩|^2.

Then

    𝔼_U 𝔼_x∼ q(|α_P(x)|/2α_I(x))
    =2^|B|𝔼_U 𝔼_x∼unif |α_P(x)|
       ≤ 2^|B|(𝔼_U 𝔼_x∼unif |α_P(x)|^2)^1/2
       =(1/4∑_s∈{0,1}^|B|𝔼_U  |⟨ 0^n|U^† (P_A⊗ Z(s)_B) U|0^n⟩|^2)^1/2.

Now we use the fact that every gate in U is drawn from the Haar measure, and the fact that the Clifford group is a two-design. This allows us to replace the average over U with the average over the random Clifford circuit D in the above. Then for P∈{X,Y,Z} we have

    𝔼_U 𝔼_x∼ q(|α_P(x)|/2α_I(x))
       ≤(1/4∑_s∈{0,1}^|B|𝔼_D  |⟨ 0^n|D^† (P_A⊗ Z(s)_B) D|0^n⟩|^2)^1/2
       =1/2√(𝔼_D |S_P|)
       =1/2√(3)√(𝔼_D |S|).

Now the expected purity of the postmeasurement state is upper bounded as

    𝔼_U 𝔼_x∼ qTr(ρ(x)^2)   =𝔼_U 𝔼_x∼ q∑_P∈{I,X,Y,Z}2|α_P(x)|^2/4|α_I(x)|^2
       ≤𝔼_U 𝔼_x∼ q∑_P∈{I,X,Y,Z}|α_P(x)|/2|α_I(x)|
       =1/2+3𝔼_U 𝔼_x∼ q|α_Z(x)|/2|α_I(x)|

where we used the fact that |α_P(x)|≤α_I(x) for all x∈{0,1}^|B|. Plugging <ref> into the above completes the proof.





§ EFFICIENT AND SHALLOW CLASSICAL SIMULATION OF 2D CIRCUITS WITH SHORT-RANGE MIE


In this section we prove <ref>. In particular, we consider the output state |ψ⟩=U|0^n⟩ of a 2D, depth d, quantum circuit and describe an efficient classical simulation method that approximately samples from its output distribution, assuming that the state after each gate in the circuit has short-range MIE. We will also show that the algorithm can be parallelized to depth O(d). The simulation algorithm is a variant of the gate-by-gate method proposed in Ref. <cit.>.

Here we assume the circuit is expressed as U=U_mU_m-1… U_1|0^n⟩ where each U_t is either a CNOT gate or a single-qubit gate. 

In addition to the output state ψ and its output distribution P(z)=|⟨ z|ψ⟩|^2, it will also be convenient to consider states and output distributions associated with subcircuits. That is, define

    |ψ_t⟩=U_tU_t-1… U_1|0^n⟩  and   P_t(z)=|⟨ z|ψ_t⟩|^2,

for 0≤ t≤ m and z∈{0,1}^n. 

Now imagine that we measure all qubits in BC of the state ψ_t and obtain outcomes ω∈{0,1}^|BC|. The probability of this measurement outcome is P_t,BC(ω)≡∑_y_BC=ω_BC P_t(y). The postmeasurement state on A is

    ρ_t(ω)=1/P_t,BC(ω)⟨ω|_BC|ψ_t⟩⟨ψ _t|ω⟩_BC.


If instead we only measure the qubits in B of the state ψ_t, obtaining outcome ω_B, then the postmeasurement state of A is


    ρ̃_t(ω_B)≡1/P_t,B(ω_B)⟨ω_B |Tr_C(|ψ_t⟩⟨ψ_t|)| ω_B⟩

where P_t,B(ω_B)=∑_y: y_B=ω_B P_t(y). The following claim shows that the expected fidelity between ρ_t(ω) and ρ̃_t(ω_B) is equal to the average purity of the latter state.


    𝔼_z∼ P_t,BC[ F(ρ_t(z), ρ̃_t(z_B))]=𝔼_z_B∼ P_t,B[Tr( ρ̃_t(z_B)^2)]




Using the definitions (<ref>) we have

    𝔼_z∼ P_t,BC[ F(ρ_t(z), ρ̃_t(z_B))]
       =∑_z∈{0,1}^|BC|⟨ψ_t| (| z_B⟩⟨ z_B|⊗ |z_C⟩⟨ z_C| )ρ̃_t(z_B)|ψ_t⟩
       =∑_z_B∈{0,1}^|B|⟨ψ_t | (|z_B⟩⟨ z_B|⊗ I_C) ρ̃_t(z_B)|ψ_t⟩
       =∑_z_B∈{0,1}^|B|P_t,B(z_B)Tr( ρ̃_t(z_B)^2).


Define conditional probability distributions

    q_t(x_A|z_Bz_C)≡⟨ x_A|ρ_t(z_Bz_C)| x_A⟩

and

    q̃_t(x_A|z_B)≡⟨ x_A|ρ̃_t(z_B)| x_A⟩.


In the above discussion we fixed a partition [n]=ABC but in our classical simulation algorithm—<ref>—we allow this partition to depend on t in a simple way. In particular, let Γ⊆ [m] be such that U_t is a single-qubit gate if and only if t∈Γ (it is a CNOT otherwise).

 Then for t∈Γ we let A(t) be the qubit on which U_t acts, B(t) be all qubits within a square subgrid centred at A(t) with side length L, and C(t)=[n]∖(A(t)∪ B(t)). We write Square_L(A) for the set of all qubits that are a horizontal or vertical distance at most L/2 from qubit A, so that B(t)=Square_L(A(t)).

Let P̃ be the output distribution of <ref>. Recall that Γ⊆ [m] are the indices of one qubit gates in the circuit, and P_t(x)=|⟨ x|U_tU_t-1… U_1|ψ⟩|^2. Then

    P̃-P_m_1≤ 2∑_t∈Γ(1-_z∼ P_t,B(t)[Tr(ρ̃_t(z)^2)])^1/2.




The proof of <ref> is given in the Appendix. It is obtained by combining <ref> with a robustness property of the gate-by-gate algorithm established in Ref.<cit.>, which we adapt to our setting.


The left-hand side of <ref> is the approximation error of our algorithm: the total variation distance between the distribution sampled by our classical simulator, and the true output distribution of the quantum circuit.
We are successful in classically simulating the quantum circuit if we can make the right-hand-side of <ref> small— at most ϵ=O(n^-c) for a given constant c≥ 1. Let us assume that MIE in the circuit is short-ranged in the sense that, at each time 1≤ t≤ m in the circuit, the output state |ψ_t⟩ has the short-range MIE property (<ref>). In particular, for each t∈Γ this gives

    _z∼ P_t,B(t)[Tr(ρ̃_t(z)^2)]=1-e^-Ω(L).

Plugging this into <ref> we see that the RHS is O(me^-L). For polynomial-sized circuits (i.e., m=O(poly(n))) we can make this approximation error at most ϵ=O(n^-c) by choosing L=O(log(n)). 

Let us now show that <ref> has O(poly(n)) runtime with this choice of L.  The runtime of <ref> is O(mT(L)) where T(L) is the cost of classically computing the conditional probability q̃_t(y|x_B(t)) in line 9 of the algorithm. Using (<ref>) we see that this conditional probability is a ratio of the two marginal probabilities 

    ⟨ y_A x_B|Tr_C(|ψ_t⟩⟨ψ|_t)| y_A x_B⟩

and P_t,B(x_B). Since we are tracing out subsystem C, each of these marginals can be computed by removing all gates of U_tU_t-1… U_1 that lie outside of the so-called lightcone of AB. This gives a depth d circuit V acting on qubits of a subgrid with side length L+2d. Each of these marginal probabilities can be computed using a classical tensor network algorithm from Ref. <cit.> (see Thm 4.3 of that work), which uses runtime T(L)=2^O(d(L+d)). Thus, for constant-depth d=O(1) circuits with m=poly(n) gates and with the choice L=O(log(n)), the runtime of <ref> is poly(n).

Finally, we observe that <ref>, when applied to simulate a quantum circuit of depth d,  can be parallelized to depth O(d) if we allow classical gates that act on K=O(L^2) bits. To see this, let us describe how to parallelize all updates to the bit string x in step 2. of the algorithm for a single layer (depth-1 circuit) of quantum gates. To this end note that all updates of x corresponding to gates whose support is within a square region of side length L only depend on bits of x in a larger square region of side length ∼ 3L. These updates can therefore be performed by a single classical “gate" that acts on bits in the larger square region of side length 3L. By partitioning the grid into square regions with side length 3L we can update 1/9 of the
bits of x using a single layer of such gates in parallel. We can then simulate the entire depth-1 circuit using a classical circuit of depth 9.  






§ LONG-RANGE TRIPARTITE MIE IMPLIES UNCONDITIONAL QUANTUM ADVANTAGE IN ANY ARCHITECTURE


In this section we prove <ref>. We begin by describing what we mean by a circuit architecture and the associated family of random Clifford circuits. Then we consider the long-range tripartite MIE property (<ref>) and specialize it to Clifford circuits, using the fact that a three qubit stabilizer state that is entangled with respect to any bipartition of the qubits (Cf. <ref>), is locally Clifford equivalent to the GHZ state. Finally, we show random Clifford circuits which satisfy the long-range tripartite MIE property cannot be simulated by shallow probabilistic classical circuits. 

Our proof strategy for lower bounding classical circuits which is based on identifying GHZ-type measurement-induced entanglement is similar to the proof strategy from Ref. <cit.>. The difference is that here we aim to make this strategy work with Clifford circuits composed of uniformly random gates, and we find that long-range tripartite MIE is all that we require for quantum advantage. 




 §.§ Random Clifford circuits


An n-qubit circuit template 𝒯 is a tuple of subsets (m_1,m_2,…, m_R) such that m_i⊆ [n] for 1≤ i≤ R. A quantum circuit in this template is a product U_RU_R-1… U_2U_1 of gates such that U_i acts nontrivially only on qubits in m_i. The template is said to be k-local if |m_i|=k for all 1≤ i≤ R, and it is said to have depth d if any quantum circuit in this template can be implemented with circuit depth d.


A k-local, depth-d circuit architecture 𝒜={𝒯_n}_n∈Γ is a sequence of k-local, depth-d circuit templates with an increasing number of qubits Γ={n_1,n_2,n_3…}.


Any template 𝒯=(m_1,m_2,…, m_R) defines a random Clifford circuit, obtained by choosing the gates U_1,U_2,…, U_R to be uniformly random Clifford gates acting on their support. Similarly, an architecture 𝒜 is associated with a famiy of random Clifford circuits.


We will be particularly interested in random Clifford circuits which produce long-range tripartite entanglement in the sense of <ref>. We can specialize this property to Clifford circuits as follows.

We say that a three-qubit stabilizer state |Φ⟩ is GHZ-type entangled iff it is locally Clifford equivalent to the GHZ state. That is, there exist single-qubit Clifford unitaries C_1,C_2,C_3 such that 

    C_1⊗ C_2⊗ C_3|Φ⟩= 1/√(2)(|000⟩+|111⟩).

It is a well-known fact that any three qubit stabilizer state which is not a product state with respect to any bipartition of the qubits, is GHZ-type entangled. 

If ϕ is an n-qubit stabilizer state, we say that three qubits {h,i,j}⊆ [n] exhibit GHZ-type MIE iff they share GHZ-type entanglement after measuring all qubits in [n]∖{h,i,j}.
[Long-range tripartite MIE, Clifford version]
The architecture 𝒜={𝒯_n}_n∈Γ is said to satisfy the long-range tripartite MIE property if there is an absolute constant c>0 such that the following holds. Suppose n∈Γ and consider the circuit template 𝒯_n∈𝒜. Suppose U is a random Clifford circuit with template 𝒯_n, i.e. it is composed of gates U_1,U_2,…, U_R chosen uniformly at random from the set of k-qubit Clifford gates. Let |ψ⟩=U|0^n⟩.  Choose a uniformly random triple of qubits {h,i,j}⊆ [n]. Then, with probability at least c>0 (over the random choice of U and the triple h,i,j), the qubits h,i,j exhibit GHZ-type MIE in the state ψ.



It is not hard to see that <ref> is equivalent to <ref> for the random Clifford circuit family defined by an architecture 𝒜. The condition <ref> in the definition of long-range tripartite MIE property implies that the three-qubit state ρ_Ω is not a product state with respect to any bipartition of its qubits. Since in the case at hand it is also a stabilizer state, it is GHZ-type entangled. 



 §.§ Requirements for classical simulation of GHZ-type MIE




Let us begin by considering what kinds of classical circuits are capable of reproducing the measurement statistics of quantum states with GHZ-type MIE. 

Suppose U is an n-qubit Clifford circuit and |ψ⟩=U|0^n⟩.  Recall that we say that three qubits {h,i,j}⊆ [n] exhibit GHZ-type measurement-induced entanglement iff the state ρ_h,i,j after measuring all other qubits in the computational basis is locally Clifford equivalent to the GHZ state. We can rephrase this definition in terms of the stabilizer group of ψ, as follows: three qubits {h,i,j} of ψ   exhibit GHZ-type measurement-induced entanglement iff,  for some tensor product C_h⊗ C_i⊗ C_j of single-qubit Clifford unitaries on h,i,j, the stabilizer group of C_h⊗ C_i⊗ C_j|ψ⟩ contains elements

    g_1   =X_hX_iX_jZ(s)
    
    g_2   =Z_hZ_i I_jZ(t) 
    
    g_3   =I_h Z_iZ_jZ(u),

for some binary strings s,t,u∈{0,1}^n such that s_r=t_r=u_r=0 for r∈{h,i,j}. 


In the following Lemma we consider a classical function m:{0,1,2}^3→{0,1}^n which takes input b∈{0,1,2}^3 describing measurement bases X,Y,Z for qubits h,i,j respectively, and produces output m(b)∈{0,1}^n. We are interested in whether this function can simulate measurement of ψ in the given bases b on qubits h,i,j and the computational basis on all other qubits. Let Q(0),Q(1),Q(2) denote the single-qubit Clifford unitaries that change basis from the Z basis to the X,Y,Z bases respectively (i.e., Q(0)=(X+Z)/√(2), Q(1)=(Y+Z)/√(2), Q(2)=I). Let W(b)=Q(b_h)⊗ Q(b_i) ⊗ Q(b_j) be the tensor product of single-qubit unitaries that change basis to the one described by b. A necessary condition for such a simulation of ψ is that

    ⟨ m(b)|W(b)|ψ⟩≠ 0,    b∈{0,1,2}^3.

We show a condition under which <ref> is not possible.

Suppose h,i,j exhibit GHZ-type measurement-induced entanglement in the state |ψ⟩=U|0^n⟩. Let m:{0,1,2}^3→{0,1}^n and write m=m(b) with b=b_hb_ib_j∈{0,1,2}^3. Suppose that each output bit m_r depends on at most one of the input variables b_h,b_i,b_j, and that 


  * m_h is independent of b_i, b_j

  * m_i is independent of b_h, b_j

  * m_j is independent of b_h, b_i.

Then 

    Pr_b∼unif({0,1,2}^3)[ ⟨ m(b)|W(b)|ψ⟩= 0]≥ 1/27.



The proof of <ref> is given in the Appendix.
It says that classical circuits that are capable of simulating GHZ-type measurement induced entanglement must have certain kind of input-output correlations. In the next section we will see that this constraint is even more restrictive when ψ is an n-qubit state and many triples of qubits exhibit GHZ-type MIE.



 §.§ Lower bound for classical probabilistic simulation


In the following we shall view a random Clifford circuit as a fixed circuit with a random input that specifies the gates. That is, we construct a controlled Clifford circuit which takes the specification of all Clifford gates U_1,U_2,…, U_R as an input and then applies the corresponding Clifford circuit to an n-qubit register.

For any  k-local, n-qubit circuit template 𝒯_n=(m_1,m_2,…, m_R) we define a controlled-Clifford circuit as follows. The circuit has a data register of n qubits which are initialized in the |0^n⟩ state. In addition, there is one input register I_j of size O(k^2) for each gate j∈ R in the circuit, that contains enough qubits to store the description of an arbitrary k-qubit Clifford gate. The jth gate in the circuit applies Clifford unitary C on qubits m_j of the data register, controlled on the state |C⟩ of the input register I_j. An architecture 𝒜 defines a family of controlled Clifford circuits in this way, which we denote CC(𝒜).


Suppose 𝒜={𝒯_n}_n∈Γ is a depth-d, k-local architecture. As noted above we can construct an associated family CC(𝒜) of depth-d quantum circuits composed of O(k^2)-local controlled-Clifford gates.  Under what conditions can the input/output behaviour of this family of quantum circuits, with random inputs,  be simulated by a constant-depth classical circuit?  


Consider a family of probabilistic classical circuits which implement functions {F_n}_n∈Γ with the following input/output properties:


  * For each n∈Γ, F_n takes as input a list U_1,U_2,…, U_R of k-local Clifford gates that define a quantum circuit U=U_R… U_2U_1 of depth d in the template 𝒯_n.

  * F_n also takes as input a random string r∈{0,1}^ℓ(n) drawn from some probability distribution q_n. Here ℓ(n) can be any function of n and q_n can be any probability distribution over ℓ(n) bit strings.

  * The function outputs a binary string

    z=F_n(U_1,U_2,…, U_R,r)∈{0,1}^n.

For ease of notation, we sometimes write z=F_n(U,r).


We shall be interested in the case where each function F_n is implemented by a classical circuit with gates of fan-in K and circuit depth D. In this case each output bit z_j of F_n(U,r) depends on at most K^D input bits. In particular this implies that each output bit z_j depends on at most K^D of the gates in the circuit (each gate is specified by O(k^2) bits).

If we draw r∼ q_n and compute z=F_n(U,r) then z∈{0,1}^n samples from a distribution that we denote 

    P_U(z)      z∈{0,1}^n.

Let us also write Q_U(z)=|⟨ z|U|0^n⟩|^2 for the true output distribution. 



Suppose 𝒜 is a k-local, depth-d circuit architecture with the long-range tripartite MIE property (<ref>). Suppose n∈Γ satisfies n≥ (10d)^4 and let F_n be a function with input/outputs as described above. Suppose further that each output bit of z=F_n(U_1,U_2,…, U_R,r) depends on at most n^1/4 of the k-qubit Clifford gates U_1,U_2,…, U_R. Then for any r∈{0,1}^ℓ(n), we have

    Pr_U_1,U_2,…, U_R ∼𝒟_k[ ⟨ F_n(U,r)|U|0^n⟩=0]≥c/27-O(n^-1/4),

where c>0 is the absolute constant from <ref> and 𝒟_k is the uniform distribution on k-qubit Clifford unitaries.




In the following we fix r∈{0,1}^ℓ(n) and write z=F_n(U)=F_n(U,r).

Let U_1,U_2,…, U_R be the k-qubit gates that describe U. Here R≤ nd/k. These are arranged in d layers. For each t∈ [n] there is exactly one k-qubit gate that is the last one to act on qubit t. Call this gate V_t. Note that we may have V_t=V_ℓ for t≠ℓ.

For each gate w∈ [R], let ℒ^→(U_w)⊆ [n] consist of supp(U_w) as well as all output bits of F_n that depend on gate U_w. Here supp(U_w) denotes the support of U_w (the 
 k qubits on which it acts nontrivially). Let us consider a bipartite graph G with a vertex for each gate U_w with 1≤ w≤ R,  and a vertex for each output bit v∈ [n], and an edge {U_w,v} whenever v∈ℒ^→(U_w). Since each output bit depends on at most n^1/4 input gates, and each output bit can be in the support of at most d gates in the circuit, the maximum degree of any output bit is at most d+n^1/4≤ 1.1n^1/4 (since n≥ (10d)^4), and therefore the total number of edges in G is 

    ∑_w=1^R |ℒ^→(U_w)|≤ 1.1n^5/4.

Let 

    Bad={t∈ [n]: |ℒ^→(V_t)|≥ n^1/2}  and  Good=[n]∖Bad.

Then from <ref> we have

    |Bad|≤ 1.1n^3/4

and therefore 

    |Good|≥ n(1-1.1n^-1/4).

Now let us consider a graph G' with vertex set Good and an edge {s,t} iff

    ℒ^→(V_s)∩ℒ^→(V_t)≠∅.

The maximum degree Δ of G' satisfies 

    Δ≤max_t∈Good|ℒ^→(V_t)|· (d+n^1/4)≤  n^1/2· 1.1n^1/4=1.1n^3/4.

Now suppose we choose a triple of qubits {h,i,j}⊆ [n] uniformly at random. From <ref> we see that the probability that {h,i,j}⊆Good is 1-O(n^-1/4). Conditioned on this event, the probability that {h,i,j} form an independent set in G' can also be lower bounded as 1-O(n^-1/4). To see this note that since the maximum degree of G' is at most O(n^3/4), two randomly chosen vertices in Good have an edge between them with probability at most O(n^-1/4). Then apply this to the three pairs {h,i},{i,j} and {h,j} and use the union bound.

Let ℰ be the event that our three qubits h,i,j are an independent set in G'. Then we have shown Pr[ℰ]≥ 1-O(n^-1/4). Moreover, if ℰ occurs then 


    ℒ^→(V_h)∩ℒ^→(V_i)   =∅
    ℒ^→(V_i)∩ℒ^→(V_j)   =∅
    ℒ^→(V_h)∩ℒ^→(V_j)   =∅.



Now suppose that U_1,U_2,…, U_R ∼𝒟_k are uniformly random k-qubit Clifford gates. Let |ψ⟩=U|0^n⟩ be the output state of the circuit U. Let ℰ' denote the event that qubits h,i,j exhibit GHZ-type measurement-induced entanglement. That is, event ℰ' occurs iff there is GHZ-type entanglement between qubits h,i,j after measuring all other qubits of ψ in the computational basis. By the long-range GHZ property, event ℰ' occurs with probability at least c>0. 

By the union bound, the probability that both events ℰ and ℰ' occur is at least

    Pr[ℰ and ℰ']≥ c-O(n^-1/4).


Now let us suppose that events ℰ and ℰ' both occur. Starting with our circuit U_1,U_2,…, U_R we define a set of 27 quantum circuits as follows. For each of the qubits h,i,j there are three choices for a single-qubit Pauli basis X,Y,Z. Let us index these choices by a tuple b=b_hb_ib_j∈{0,1,2}^3, where 0,1,2 correspond to X,Y,Z respectively. Recall that we write Q(0),Q(1),Q(2) for the single-qubit Clifford unitaries that change basis from the Z basis to the X,Y,Z bases respectively (i.e., Q(0)=(X+Z)/√(2), Q(1)=(Y+Z)/√(2), Q(2)=I). For b_h,b_i,b_j∈{0,1,2}^3, let

    V_h(b_h)   =Q(b_h) V_h 
    
    V_i(b_i)   =Q(b_i) V_i 
    
    V_j(b_j)   =Q(b_j) V_j.

and let U(b) denote the circuit obtained from U_1,U_2,…, U_R by making the replacements V_h← V_h(b_h), V_i←  V_i(b_i), V_j← V_j(b_j).

Define a function m:{0,1,2}^3→{0,1}^n by m(b)=F_n(U(b)). From <ref> we see that each output bit m_j depends on at most one of the bits b_h,b_i,b_j, and that 


  * m_h is independent of b_i, b_j

  * m_i is independent of b_h, b_j

  * m_j is independent of b_h, b_i.

Therefore, from <ref> we conclude that 

    ⟨ F_n(U(b))|U(b)|0^n⟩=0     for some  b∈{0,1,2}^3.

Note that each of the circuits U(b) with b∈{0,1,2}^3 occurs in our random ensemble with the same probability as U. Therefore 

    Pr_U_1,U_2,…, U_R ∼𝒟_k[ ⟨ F_n(U)|U|0^n⟩=0]   ≥Pr[ℰ and ℰ']/27
       =c/27-O(n^-1/4).





Suppose 𝒜={𝒯_n}_n∈Γ is a k-local, depth-d circuit architecture with the long-range tripartite MIE property (<ref>). There exists a positive constant α >0 and positive integer n_0 such that the following holds. Suppose n∈Γ satisfies n≥max{n_0,(10d)^4}. Suppose there is a depth-D probabilistic classical circuit composed of gates of fan-in K with output distribution P_U on input circuit U satisfying

    𝔼_U_1,U_2,…, U_R ∼𝒟_k[P_U-Q_U_1]< α,

where 𝒟_k is the uniform distribution on k-qubit Clifford unitaries, and Q_U(z)=|⟨ z|U|0^n⟩|^2 is the true output distribution. Then D≥1/4log(n)/log(K).


Let F_n be the function which describes the classical circuit. Recall that F_n takes as input the gates U_1,U_2,…, U_R in the circuit as well as a random string r∈{0,1}^ℓ(n), and outputs a binary string z=F_n(U_1,U_2,…, U_R, r)=F_n(U,r). 

Suppose D<1/4log(n)/log(K). Then every output bit of the classical circuit depends on at most K^D< n^1/4 input bits. In particular, each output bit depends on at most n^1/4 of the input gates U_1,U_2,…, U_R. Then

    𝔼_U_1,U_2,…, U_R ∼𝒟_k(∑_x∈{0,1}^n |P_U(x)-Q_U(x)|)
       ≥𝔼_U_1,U_2,…, U_R ∼𝒟_k(∑_x:Q_U(x)=0 P_U(x))
       =𝔼_U_1,U_2,…, U_R ∼𝒟_kPr_r[⟨ F_n(U,r)|U|0^n⟩=0]
       =𝔼_rPr_U_1,U_2,…, U_R ∼𝒟_k[⟨ F_n(U,r)|U|0^n⟩=0]
       ≥𝔼_rc-O(n^-1/4)/27
       = c-O(n^-1/4)/27

where c>0 is the constant appearing in the definition of <ref>, and where we used <ref>. We choose n_0 large enough so that O(n^-1/4) is at most c/2 and then set α=c/54.




§ COARSE-GRAINED ARCHITECTURE



Here we discuss the “coarse-grained" two-dimensional circuit architecture where we are able to establish rigorous statements concerning measurement-induced entanglement and quantum advantage. In particular, we prove <ref>. The coarse-grained architecture shares salient features of shallow quantum circuits in the usual brickwork architecture; most importantly, there is a locality parameter τ that determines the linear size of the lightcone of a given qubit.   


Consider a family of random quantum circuits, shown in <ref>, acting on n qubits arranged on a √(n)×√(n) grid lattice. Each circuit U in this family consist of two layers of gates V and W applied consecutively such that 

    U |0^n⟩ = (W_m^2⊗⋯⊗ W_1)_W·(V_(m-1)^2⊗⋯⊗ V_1)_V|0^n⟩.

We refer to the gates V_1,…, V_(m-1)^2 in V as the first layer and W_1,…, W_m^2 in W as the second layer gates.

We shall consider two families of quantum circuits in this architecture. The first is obtained by choosing each gate to be a Haar-random unitary acting on a square of τ×τ qubits such that m^2 τ^2 = n. We will call a circuit U drawn from this family a random coarse-grained universal circuit. The second family we consider is obtained by choosing each gate to be a uniformly random τ^2-qubit Clifford unitary. We refer a circuit D drawn from this family as a random coarse-grained Clifford circuit. 






 §.§ Subsystem anticoncentration and long-range MIE


Below we show that random coarse-grained Clifford circuits exhibit subsystem anticoncentration in the sense described in the Introduction. In particular, we consider a tripartition [n]=ABC of the qubits such that |A|=1, and the corresponding set S defined in <ref>. We then give an upper bound on 𝔼_D[S] that approaches zero as |C|,n→∞. From our upper bound it follows directly that the family of random coarse-grained Clifford circuits satisfies the long-range MIE property. We use <ref> to infer that the family of random coarse-grained universal circuits also satisfies the long-range MIE property (<ref>).

To upper bound the expected size of S, we first bound the probability that a random Pauli operator becomes Z-type when it is evolved backwards in time through a random coarse-grained Clifford circuit. 

Given a Pauli operator P defined on the qubits [n], let (P) ⊆ [n] be set of qubits on which P takes a value other than the identity. For any Pauli operator P and random coarse-grained Clifford circuit D, it is relatively easy to see that the probability of D^† P D being Z-type is determined entirely by the overlap of (P) with the second layer of gates W_1,…, W_m^2. To keep track of this overlap, for any Pauli P we let the cluster 𝒢(P) denote the set of all second layer gates with non-trivial overlap with (P). Such a cluster can be specified by filling in squares of an m × m grid. This grid representation leads naturally to the notion of the size and perimeter of a cluster 𝒢(P), which we define next. 


    Given any cluster 𝒢(P), identify it with a subset of the m × m grid in the natural way. Then let the size of the cluster, denoted 𝒢(P) be the number of grid squares contained in the cluster. Also let the perimeter of the cluster, denoted Per(𝒢(P)) be the number of grid edges on the boundary of the cluster, excluding edges running along the outside of the grid (see <ref>). 




The following theorem bounds the probability that a Pauli is Z-type after conjugation by a random coarse-grained Clifford circuit.



Let P be a Pauli operator, and let D be a random coarse-grained Clifford circuit. Also let a = 𝒢(P) and l = Per(𝒢(P)) denote the size and perimeter of 𝒢(P), respectively.  Then 

    [D^†  P D  is Z-type] ≤(1/2) ^a τ^2 + 1/4l (τ^2 / 12 - 1).



Now let us consider the measurement-induced entanglement scenario in the case where A and C are single qubits. We will use first-moment methods to establish the existence of measurement-induced entanglement in the coarse-grained architecture for τ=Ω(√(log(m))).

We first bound the expected number of binary strings s ∈ S such that the perimeter of the cluster 𝒢(DZ(s)D^†) has a given length l.

 
    Let D be a random coarse-grained Clifford circuit  and let l be a positive integer. Let A ⊆[n] contain a single qubit and C ⊆ [n] contain at least one qubit, with A and C disjoint. Then 
    
    𝔼_D[{s ∈ S: Per(𝒢(DZ(s)D^†)) = l}] 
        
       ≤ 2^l(2log(m)-τ^2/48+5).




    Expanding out the definition of S gives 
    
    {s ∈ S: Per(𝒢(DZ(s)D^†)) = l}
       =|{s∈{0,1}^n: DZ(s)D^†=(-1)^α P_A⊗ Z(r)_B⊗  I_C 
        for some  r∈{0,1}^|B|, α∈{0,1}, P ∈{X,Y,Z}
        and Per(𝒢(DZ(s)D^†)) = l}|.


    But for any fixed r and P we have
    
    ∃ s ∈{0,1}^n : DZ(s)D^†=(-1)^α P_A⊗ Z(r)_B⊗  I_C 
       ⇔ D^†(P_A⊗ Z(r)_B⊗  I_C) D  is Z-type.


    Then we also have 
    
    {s ∈ S: Per(𝒢(DZ(s)D^†)) = l}
       =|{(r,P): Per(𝒢(P_A⊗ Z(r)_B⊗  I_C)) = l,  and 
        D^†(P_A⊗ Z(r)_B⊗  I_C) D  is Z-type} |.

    We can then bound the expected size of this set as follows. For a given cluster 𝒢', let Γ(𝒢') denote the set of all pairs r∈{0,1}^|B| and P∈{X,Y,Z} such that 𝒢(P_A⊗ Z(r)_B⊗  I_C) = 𝒢'. Then
    
    𝔼_D[{s ∈ S: Per(𝒢(DZ(s)D^†)) = l}] 
       = ∑_𝒢' : 
    Per(𝒢') = l ∑_(r,P)
    ∈Γ(𝒢')[D^†(P_A⊗ Z(r)_B⊗  I_C) D  is Z-type.] 
       ≤∑_𝒢'  : 
    Per(𝒢') = l ∑_(r,P)∈Γ(𝒢') 2^-𝒢'τ^2 - 1/4l(τ^2/12 - 1)
       ≤ 3 ∑_𝒢'  : 
    Per(𝒢') = l 2^-1/4l(τ^2/12 - 1)
       ≤ 6 2m(m-1)l 2^-1/4l(τ^2/12 - 1)
       ≤ 2^l( 2log(m) - τ^2/48 + 5).

    where we used <ref> to go from the first line to the second and that there are at most 2^𝒢'τ^2 strings r ∈{0,1}^n  such that 𝒢(P_A⊗ Z(r)_B⊗  I_C) = 𝒢' to go from the second line to the third. To go from the third line to the fourth we count the number of clusters 𝒢' with perimeter l. Any such cluster can be specified by first choosing the location of the l edges of the cluster, and then specifying the interior and exterior of the cluster. A crude upper bound gives that there are at most 2m(m-1)l ways to chose the l edges of the cluster, and then two possible options for how to specify the interior and exterior of the cluster once the edges are fixed. This argument gives {𝒢'  : Per(𝒢') = l }≤ 2 2m(m-1)l, which is the bound used above.


Finally, we upper bound the expected size of S.



    In the setting of <ref> and choosing τ≥√(1000log_2(m)), we have
    
    𝔼_D[S] ≤3/2^C + 1 + 2· 2^-τ^2/100.






We first observe 

    𝔼_D[S] ≤∑_l=0^∞𝔼_D[{s ∈ S: Per(𝒢(DZ(s)D^†)) = l}].

Then <ref> and our assumption on the size of d gives

    ∑_l=1^∞𝔼_D[{s ∈ S:    Per(𝒢(DZ(s)D^†)) = l}] 
       ≤∑_l=1^∞ 2^l(2log_2(m)-τ^2/48+5)
       =∑_l=1^∞ 2^l(2log_2(m)-τ^2/96+5)-lτ^2/96
       ≤∑_l=1^∞ 2^l(-τ^2/96)
       ≤ 2· 2^-τ^2/100

where in the second-to-last line we used the fact that 2log_2(m)-τ^2/96+5)≤ 2log_2(m)-10log_2(m)+5≤  0.
It remains to show a bound when l = 0. In this case, by the same logic what was used in the proof of <ref>, we have

    𝔼_D[{s ∈ S: Per(𝒢(DZ(s)D^†)) = 0}] 
       =𝔼_D[ |{ r∈{0,1}^B, P ∈{X,Y,Z} : 
       Per(𝒢(P_A⊗ Z(r)_B⊗  I_C)) = 0  and 
        D^†(P_A⊗ Z(r)_B⊗  I_C) D  is Z-type} | ].

But we have Per(𝒢(P_A⊗ Z(r)_B⊗  I_C)) = 0 only if  the cluster 𝒢(P_A⊗ Z(r)_B ⊗  I_C) is the entire m × m grid. This cluster has size m^2 and there are at most 

    3 (2^B) = 3 ( 2^n - A - C ) = 3 ( 2^n - 1 - C)

Pauli strings satisfying this condition. Then a straightforward application of <ref> gives 

    𝔼_D[{s ∈ S: Per(𝒢(DZ(s)D^†)) = 0}] 
       ≤ 3 ( 2^n - 1 - C) (2^- m^2 τ^2) = 3 (2^-C - 1)

and the result follows. 



The family of random coarse-grained universal circuits with τ≥√(1000log_2(m)) and n sufficiently large satisfies the long-range MIE property. The same statement holds for random coarse-grained Clifford circuits.


Let [n]=ABC be a tripartition of the qubits such that |A|=1 and B is a square shielding region with side length L, centred at A (see <ref>). Here L is chosen so that |C|≠ 0. Note that due to the 2D geometry, this implies |C|=Ω(√(n)).

Let U be a random coarse-grained universal circuit with τ≥√(1000log_2(m)). Plugging the upper bound from <ref> into <ref> we get 

    𝔼_U 𝔼_xTr(ρ(x)^2)≤1/2+O(1/poly(m))=1/2+O(1/poly(n)).

Taking n sufficiently large we can ensure the RHS is less than any constant c∈ (1/2,1).

If we replace U with a random coarse-grained Clifford circuit, then we can use <ref> along with <ref> and Markov's inequality to arrive at the same conclusion. 



 §.§ Long-range tripartite MIE


We have shown that random coarse-grained universal or Clifford circuits have the long-range MIE property (<ref>), as a consequence of the subsystem anticoncentration expressed in <ref>.  Below we specialize to random coarse-grained Clifford circuits, and we show that <ref> also implies long-range tripartite MIE. As discussed in the Introduction, this gives rise to an unconditional quantum advantage.


 We first review some facts about entanglement in stabilizer states.  For any graph G = (V,E), the V-vertex graph state |Φ_G⟩ is defined to be the stabilizer state with stabilizer group generated by 

    g_v = X_v (∏_u : (u,v) ∈ E Z_u).

It is known that any (finite dimensional) stabilizer state is locally Clifford equivalent to a graph state <cit.>. 

The following lemma shows that GHZ-type entanglement can always be produced by making computational basis measurements on a connected graph state with sufficiently many vertices.



Let G = (V,E) be a connected graph with at least 3 vertices and let |Φ_G⟩ be the associated graph state. Then there exist indices h,i,j ∈ V such that, for any x ∈{0,1}^V - 3, the state 

    |Φ_h,i,j⟩ 
        = ⟨x|_V \{h,i,j}|Φ_G⟩

is locally Clifford equivalent to a GHZ state (up to normalization).


The post-measurement state after measuring a qubit v of a graph state Φ_G in the computational basis and obtaining outcome y∈{0,1} is

    (∏_w:{v,w}∈ E(G) Z^y_w)|Φ_G(V∖{v})⟩

where G(V∖{v}) is the induced subgraph of G on all V∖{v},  obtained from G by removing vertex v and all edges incident to it. Starting from a connected graph G with at least three vertices, we choose 3 vertices Ω={h,i,j} such that the subgraph G(Ω) of G induced by Ω is a connected three-vertex graph. Using the above fact about computational basis measurement, we see that after measuring all vertices in V∖{h,i,j} the postmeasurement state is locally Clifford equivalent to the graph state |Φ_G(Ω)⟩ where G(Ω) is a connected three-vertex graph. Finally, we use the well-known fact that any 3 vertex connected graph state is locally Clifford equivalent to a GHZ state (this can be confirmed by a direct calculation).


Now consider a random coarse-grained Clifford circuit with τ≥√(1000log_2(m)) as in <ref>. In this setting, a straightforward consequence of <ref> is that measuring all but two output qubits of the randomly chosen circuit in the computational basis produces a two-qubit entangled stabilizer state on the unmeasured qubits with probability at least 1/4 - exp(-Ω(τ^2)). The next theorem shows that tripartite GHZ-type entanglement is also ubiquitous.



Random coarse-grained Clifford circuits with τ≥√(1000log_2(m)) satisfy the long-range tripartite MIE property (<ref>). In particular, let D be an n-qubit random coarse-grained Clifford circuit, with τ≥√(1000log_2(m)). Let {h,i,j} be a uniformly random triple of qubits. Then {h,i,j} exhibit GHZ-type MIE with probability at least 0.005 over the random choice of D and the random choice of {h,i,j}.


Let D be an n-qubit random coarse-grained Clifford circuit with τ≥√(1000log_2(m)).

Let us say that {h,i,j}⊆ [n] is a good triple, iff qubits  {h,i,j} share GHZ-type entanglement after all other qubits have been measured with probability at least 0.05 over the random choice of D.

Below we prove the following: for any set of qubits V⊆ [n] with V = 5, there exists a good triple {h,i,j}⊆ V.

The theorem then follows from this statement. To see this, consider the following procedure. First, choose a uniformly random subset of qubits V⊆ [n] of size |V|=5, and then choose a uniformly random triple {h,i,j}⊆ V. By the above, the probability that we are lucky and choose a good triple is at least 1/53=1/10.

Moreover, clearly this procedure samples a triple {h,i,j} from the uniform distribution over all n3 triples. 

It remains to show that for any set of qubits V⊆ [n] with V = 5, there exists a good triple {h,i,j}⊆ V.

We first consider the state of the qubits in V after the circuit D is applied and all other qubits are measured in the computational basis. For any qubit v ∈ V, <ref> give that there is no post-measurement entanglement between qubit v and qubits in the set V\{v} with probability at most 

    3/2^5 + 2· 2^-τ^2/100≤ 3/2^5 + 2· 2^-10< 0.1.

Then the union bound gives that there exists a qubit v' ∈ V with no post-measurement entanglement between v' and the qubits V\{v'} with probability at most 

    V· 0.1 < 0.5.

Equivalently, there is post measurement entanglement between each qubit v' ∈ V and qubits V\{v'} with probability at least 1/2. But then the post measurement state of the qubits V is locally Clifford equivalent to a graph state |Φ_G⟩ corresponding to a 5 vertex graph with no isolated vertices (this is because there is no entanglement between qubits corresponding to disconnected vertices of a graph state). It follows that the graph G must have either a 3 or 5 vertex connected component. If G has a 3 vertex connected component the qubits corresponding to this component are in a state locally Clifford equivalent to a GHZ state, and we are done. Otherwise, the graph state has a 5 vertex connected component. But then by <ref> there are vertices h,i,j ∈ V such that, for any x ∈{0,1}^2 we have that

    |Φ_hij⟩ = ⟨x|_V\{h,i,j}|Φ_G⟩

is locally Clifford equivalent to a GHZ state. Now let |Ψ_V⟩ denote the post measurement state of the qubits in the set V. Since this state is locally Clifford equivalent to |Φ_G⟩ we have 

    |Ψ_V⟩ = ⊗_v ∈ V C_v |Φ_G⟩

where each C_v is a 1-qubit Clifford unitary. Furthermore, since the distribution of coarse-grained Clifford circuits is unchanged under local Clifford operations, we can assume the Clifford unitaries C_v are chosen uniformly at random. 
Then the post measurement state of qubits h,i,j when the remaining two qubits of V are measured in the computational basis and outcome x∈{0,1}^2 is observed is given by

    |Ψ_h,i,j⟩   = ⟨x|_V\{h,i,j}⊗_v ∈ V C_v |Φ_G⟩.

Comparing with <ref> we see this is locally Clifford equivalent to a GHZ state provided the state 

    ⊗_v ∈ V\{h,i,j} C_v^†|x⟩_V\{h,i,j}

is a computational basis state. But since we can take the C_v to be random Cliffords this occurs with probability exactly 1/9. Putting this all together we see that {h,i,j} is a good triple: the state |Ψ_h,i,j⟩ is locally Clifford to a GHZ state with probability at least 
1/9·1/2≥ 0.05
over the random choice of D.





 §.§ Approximate implementation of coarse-grained circuits with two-qubit gates


Lastly, we demonstrate that coarse-grained circuits can be approximately implemented using two-qubit gates, instead of gates that act on blocks of τ×τ qubits.
We shall see that this yields a family of O(log(n))-depth quantum circuits composed of Haar-random two-qubit gates that satisfy the long-range MIE property.

Our construction replaces each τ×τ Haar random gate in a random coarse-grained universal circuit by an ε-approximate unitary 2-design for a sufficiently small approximation error ε=2^-Ω(τ^2).
Such unitary 2-designs can, for instance, be implemented using a 1D brickwork quantum circuit of depth O(τ^2) composed of Haar random two-qubit gates which is arranged in a snake-like pattern (or more formally, along a Hamiltonian path) on the square of τ×τ qubits <cit.>.
This results in a distribution of n-qubit random quantum circuits with an overall depth of O(τ^2). We denote these compiled random coarse-grained circuits by 𝒰̃.
We can analogously define 𝒟̃ to be the family of random Clifford circuits obtained by replacing the Haar random two-qubit gates in  𝒰̃ by random two-qubit Clifford gates.

The family of complied random coarse-grained circuits 𝒰̃ satisfies the long-range MIE property when τ≥√(1000log_2(m)) and n sufficiently large. The same statement holds for compiled random coarse-grained Clifford circuits 𝒟̃.


We begin by applying <Ref>, which allows us to reduce the analysis of the long-range MIE property in 𝒰̃ to that in 𝒟̃. 
To establish the long-range MIE property in 𝒟̃, we focus on bounding the expected size of the setS. 
In the Appendix, we demonstrate that the family of random Clifford circuits 𝒟̃ satisfies the bound in <ref> of <Ref>. 
We can then employ the same reasoning as in the proof of <Ref> to establish the long-range MIE property for circuits drawn from 𝒰̃, as stated in <Ref>.




Note added: As we finalized this paper, we became aware of concurrent works <cit.> that also study the 2D coarse-grained architecture introduced here. While we focus on establishing quantum advantage,  long-range MIE, and anti-concentration properties, these works demonstrate that with a suitable choice of log(n)-sized coarse-grained gates, a similar architecture can also exhibit the unitary k-design property. 



§ ACKNOWLEDGMENTS

DG acknowledges the support of
 the Natural Sciences and Engineering Research Council of Canada through grant number RGPIN-2019-04198. DG is a fellow of the Canadian Institute for
Advanced Research, in the quantum information science program. Research at Perimeter
Institute is supported in part by the Government of Canada through the Department of
Innovation, Science and Economic Development Canada and by the Province of Ontario
through the Ministry of Colleges and Universities.
MS is supported by AWS Quantum Postdoctoral Scholarship and funding from the National Science Foundation NSF CAREER award CCF-2048204.
Institute for Quantum Information and Matter is an NSF Physics Frontiers Center. 

unsrt








§ ANALYSIS OF <REF>

Here we prove <ref>. The proof is obtained by combining the fidelity bound from <ref> with the robustness property of the gate-by-gate algorithm established in Ref. <cit.>. Our setting differs slightly from the one considered there (this is due to the fact that ρ̃_t(ω_B) is not a pure state in general); below we adapt the proof to our setting.   

The gate-by-gate algorithm of Ref. <cit.> is obtained from <ref> by making a small but consequential replacement: replacing q̃_t(y|x_B(t)) with q_t(y|x_B(t)x_C(t)) in line 9. We shall analyze <ref> by comparing it to the gate-by-gate algorithm and using the performance guarantee of the latter algorithm. Specifically, in Ref. <cit.> it is shown that the binary string x at the end of the tth iteration of the for loop of the gate-by-gate algorithm is distributed according to 

    P_t(x)≡ |⟨ x|U_tU_t-1… U_1|0^n⟩|^2      x∈{0,1}^n.


Write W_t(x) for the probability of sampling x∈{0,1}^n at the end of the tth iteration of the for loop of <ref>.


First suppose that t∈Γ, so that U_t is a single-qubit gate. Let A=A(t), B=B(t), and C=C(t). Then

    W_t(x)   =∑_y:y_BC=x_BC W_t-1(y) q̃_t(x_A|x_B)
       =∑_y:y_BC=x_BC(W_t-1(y)-P_t-1(y)) q̃_t(x_A|x_B)+∑_y:y_BC=x_BCP_t-1(y) q̃_t(x_A|x_B)
       =∑_y:y_BC=x_BC(W_t-1(y)-P_t-1(y)) q̃_t(x_A|x_B)+∑_y:y_BC=x_BCP_t-1(y) (q̃_t(x_A|x_B)-q_t(x_A|x_Bx_C))+P_t(x),

where we used the fact that P_t(x)=∑_y:y_BC=x_BC P_t-1(y)q_t(x_A|x_Bx_C). Now using <ref>, summing over x∈{0,1}^n, and using the triangle inequality, we get

    W_t-P_t_1   ≤∑_x_BC∈{0,1}^BC∑_y:y_BC=x_BC |(W_t-1(y)-P_t-1(y))|∑_x_A∈{0,1}^|A|q̃_t(x_A|x_B)
       +∑_x_BC∈{0,1}^BC∑_y:y_BC=x_BCP_t-1(y) ∑_x_A∈{0,1}^|A||q̃_t(x_A|x_B)-q_t(x_A|x_Bx_C)|
       = W_t-1-P_t-1_1+𝔼_z∼ P_t-1,BC(q_t(·|z_Bz_C) -q̃_t(· |z_B)_1).


Using <ref> and the relationship between trace distance and quantum fidelity, we have

    q_t(·|z_Bz_C) -q̃_t(· |z_B)_1≤ρ_t(z_Bz_C)-ρ̃_t(z_B)_1≤  2√(1-F(ρ_t(z_Bz_C), ρ̃_t(z_B))).

Plugging <ref> into <ref> and using the fact that 𝔼[√(X)]≤ (𝔼[X])^1/2 for any non-negative random variable X gives

    W_t-P_t_1   ≤W_t-1-P_t-1_1+2(𝔼_z∼ P_t-1,BC[1-F(ρ_t(z_Bz_C), ρ̃_t(z_B))])^1/2
       ≤W_t-1-P_t-1_1+2(1-𝔼_z_B∼ P_t-1,B[Tr(ρ̃_t(z_B)^2)])^1/2     t∈ S.

where we used <ref> and the fact that P_t-1,BC=P_t,BC (since the unitary gate U_t acts only on qubit A and does not change the marginal distribution on BC). 

Next suppose t∉Γ, so U_t=CNOT_ij for some pair of qubits i≠ j. Let f_t(x) be the function applied to x in line 4 of <ref>; that is, it updates x by replacing x_j← x_i⊕ x_j. Then

    W_t(x)=W_t-1(f_t(x))    and    P_t(x)=P_t-1(f_t(x)),

so in this case 

    W_t-P_t_1=W_t-1-P_t-1_1      t∉Γ.


Applying <ref> for t=1,2,…, m and using the fact that P_0=W_0, we arrive at

    W_m-P_m_1≤ 2∑_t∈Γ(1-_z∼ P_t-1,B[Tr(ρ̃_t(z)^2)])^1/2=2∑_t∈Γ(1-_z∼ P_t,B[Tr(ρ̃_t(z)^2)])^1/2

where in the last equality we used the fact that U_t is a single-qubit gate acting on qubit A, so P_t-1,B=P_t,B. This completes the proof of <ref>.



§ PROOF OF <REF>

Before proving this theorem we require a preliminary result about the effect of conjugating Pauli operators through random Clifford circuits. 




Let P_1, P_2,…, P_r be uniformly random non-identity Pauli strings of various lengths, chosen so that P_1 ⊗ P_2 ⊗⋯⊗ P_r defines a Pauli string of length n. Denote this Pauli string P_[n] and for any Q ⊆ [n] let P_Q denote the corresponding truncation of this string. Let C be a uniformly random t-qubit Clifford operator. Then

    
  *  For any Q ⊆ [n] with Q = t: 
    
    [ C^† P_Q C  is Z-type] ≤(1/2)^t.

    
  * 
    For any Q ⊆ [n] with Q = k < t:
    
    [ C^†( P_Q ⊗ I ^⊗ t-k) C  is Z-type] ≤(1/4)^k + (1/2)^t.


Moreover, these bounds still hold even after arbitrary conditioning on the value of Paulis in the complimentary string P_[n] \ Q. 




We first argue that for any Q the probability of P_Q being identity is at most 4^-Q, even after conditioning on an arbitrary value for P_[n] \ Q. If the Pauli's P_1, P_2,…, P_r were uniformly random (including the possibility of being the identity) then each individual Pauli in P_[n] would be chosen uniformly at random and this statement would be immediate, with the bound 4^-Q holding exactly. That is, if we let P_1', P_2', …, P_r' be uniformly random Pauli strings which may be the identity we have 

    [(P_1' ⊗ P_2' ⊗⋯⊗ P_r')_Q = I   |  (P_1' ⊗ P_2' ⊗⋯⊗ P_r')_[n] \ Q = K' ] = 4^-Q

for any choice of Q and Pauli string K'. But now we observe that further enforcing that each P_i' is non-identity in the above equation can only increase the probability that (P_1' ⊗ P_2' ⊗⋯⊗ P_r')_Q is non-identity since, by Bayes' rule,

    [(P_1' ⊗ P_2' ⊗⋯⊗ P_r')_Q = I   |  (P_1' ⊗ P_2' ⊗⋯⊗ P_r')_[n] \ Q = K'  and  P_1', P_2', … , P_r' ≠ I ]/[(P_1' ⊗ P_2' ⊗⋯⊗ P_r')_Q = I   |  (P_1' ⊗ P_2' ⊗⋯⊗ P_r')_[n] \ Q = K' ]
       = [P_1', P_2', … , P_r' ≠ I    |  (P_1' ⊗ P_2' ⊗⋯⊗ P_r')_[n] \ Q = K'  and (P_1' ⊗ P_2' ⊗⋯⊗ P_r')_Q = I]/[P_1', P_2', … , P_r' ≠ I    |  (P_1' ⊗ P_2' ⊗⋯⊗ P_r')_[n] \ Q = K' ]

and the quantity on the on the right hand side of the above equation is clearly bounded above by one. The statement follows. 


A similar logic can be applied to prove statements (a) and (b) directly but, for concreteness, we will take a slightly more involved route. We start with (a). The random Clifford C will map a non-identity Pauli to a uniformly random non-identity Pauli on t qubits. There are 4^t - 1 such Paulis and 2^t - 1 of them are Z-type, so

    [ C^† P_Q C  is Z-type]    = [P_Q  is identity] + [P_Q  is non-identity] (2^t - 1/4^t - 1) 
       ≤ 4^-t + (1 - 4^-t)(2^t - 1/4^t - 1) 
       = 1/4^t + 2^t - 1/4^t = 1/2^t,

where we used our upper bound on the probability of P_Q begin the identity along with the fact that 2^t - 1/4^t - 1≤ 1 to go from the first line to the second. 

To prove (b) we begin with a similar expression and find

    [ C^†(P_Q⊗ I^⊗ t-k)C  is Z-type]    = [P_Q  is identity] + [P_Q  is non-identity] (2^t - 1/4^t - 1) 
       ≤ 4^-k + (1 - 4^-k)(2^t - 1/4^t - 1) 
       ≤ 4^-k + (2^t - 1/4^t - 1) ≤ 4^-k + 2^-t,

as desired. 


We now proceed to the proof of <ref>.


We write D = W V where V and W denote the first and second layer of random Clifford circuits, respectively. We first consider the Pauli string obtained by conjugating P by just the second layer of Cliffords, which we can write as P'=W^† P W. This string consists of a random non-identity Pauli string acting on every τ×τ patch of qubits in the support of 𝒢(P), and is identity elsewhere. There are a such patches by definition, and so a τ^2 qubits on which this random Pauli string can potentially be non-identity. Let Q' denote the set of all these qubits.

Now we consider the first layer of random Clifford unitaries. Recall from the definition of random coarse-grained circuits that we have V = V_1 ⊗ V_2 ⊗⋯⊗ V_(m-1)^2, where each V_i is a random τ×τ Clifford. For any 1≤ i≤ (m-1)^2 let Q'_i = Q' ∩(V_i) and let P'_i be the restriction of the Pauli string P' to the support of V_i. Finally let Q_0' = Q' \ (∪_i Q'_i) and P'_0 be the restriction of P' to Q'_0. Also, as a notational convenience, let V_0 denote the identity gate acting on the qubits in Q_0'. (This is to accommodate qubits in Q' which lie on the boundary of the circuit, and thus are not in the support of any V_i for i ≥ 1). We want to bound the quantity

    [D^† P D  is Z-type]    = [ V_i^† P'_i V_i  is Z-type for all 0 ≤ i ≤ (m-1)^2]
       = ∏_i = 0^(m-1)^2[ V_i^† P'_i V_i  is Z-type  |   V_j^† P'_j V_j  is Z-type for all 0 ≤ j < i].

It is immediate from definitions that 

    [V_0^† P_0' V_0  is Z-type] = [P_0'  is Z-type] ≤ 2^-Q_0'.

Then let 𝒱_int be the set of all V_i with 0 < i ≤ (m-1)^2 whose support is contained entirely in Q', and 𝒱_perim be the set of all V_i ith 0 < i ≤ (m-1)^2 whose support overlaps partially with Q'. 
As an immediate consequence of <ref> item:random Pauli and Clifford fully contained Pauli we see that for any V_i ∈𝒱_int

    [ V_i^† P'_i V_i  is Z-type  |   V_j^† P'_j V_j  is Z-type for all j < i] ≤ 2^-τ^2 = 2^- Q_i'.

Similarly, for any V_i ∈𝒱_perim, <ref> item:random Pauli and Clifford partially contained Pauli gives that 

    [ V_i^† P'_i V_i  is Z-type  |   V_j^† P'_j V_j  is Z-type for all j < i] ≤ 4^-Q_i' + 2^-τ^2.

For any V_i ∈𝒱_perim we have that at least 1/4 and at most 3/4's of the qubits in the support of V_i overlap with Q', and hence τ^2/4 ≤Q_i'≤ 3τ^2/4. Then we can also write 

    [ V_i^† P'_i V_i  is Z-type  |   V_j^† P'_j V_j  is Z-type for all j < i]    ≤ 4^-Q_i' + 2^-4 Q_i' / 3
       = 2^-Q_i'(2^-Q_i' + 2^-Q_i'/3)
       ≤ 2^-Q_i' - (τ^2/12) + 1.

Combining <ref> gives 

    [D^† PD is Z-type]   ≤ 2^-Q_0'(∏_V_i ∈𝒱_int 2^-Q_i')(∏_V_j ∈𝒱_perim 2^-Q_j - τ^2/12 + 1)
       = 2^- 𝒱_perim (τ^2/12 - 1) - ∑_i=0^(m-1)^2Q'_i
       = 2^- 𝒱_perim (τ^2/12 - 1) - Q'.

We observed previously that Q' = aτ^2. Every gate V_i∈𝒱_perim intersects with four edges, and in the worst case, all four of the edges could be perimeter edges. At the same time, every perimeter edge intersects with at least one gate in 𝒱_perim. Therefore, |𝒱_perim|≥1/4l. Inserting those two values into the equation above completes the proof. 





§ COMPILING THE COARSE-GRAINED ARCHITECTURE TO RANDOM QUANTUM CIRCUITS



Here we consider the setup of <Ref> which involves compiled random coarse-grained circuits 𝒰̃ and their Clifford versions 𝒟̃ composed of two-qubit gates. 
We show that an equivalent version of <ref> holds for 𝒟̃ with sufficiently small ε. 
The gates in the non-compiled coarse-grained circuits act on blocks of τ×τ qubits. 
Define t=τ^2. Let 𝒟_t denote the uniform distribution over t-qubit Clifford operators. 
Let 𝒟̃_t be a distribution of t-qubit random Clifford circuits forming an ε-approximate unitary 2-design w.r.t the operator norm. The approximate 2-design property of 𝒟̃_t in this notion implies that for every 2^t-by-2^t matrix A,B with ‖ A‖_F=‖ B‖_F=1, it holds that

    |_C̃∼𝒟̃_t[(BC̃^† AC̃)^2]-_C∼𝒟_t[(BC^† AC)^2]|≤ε.

While the compilation is agnostic to any specific construction of ε-approximate 2-design, for concreteness, we could implement the circuits in 𝒟̃_t using 1D brickwork random Clifford circuits with depth O(log(1/ε)) <cit.>. Alternatively, we can consider a local random quantum circuit architecture with O(tlog(1/ε)) gates where at each time step, a random 2-qubit Clifford gate is applied to a randomly chosen qubit and one of its neighbours on the 2D grid <cit.>.
We note that the constructions in <cit.> are known to from an ε-approximate 2-design if the circuits are composed of Haar random two-qubit gates or random gates drawn from a universal gate set.
However, we observe that the same constructions yield ε-approximate 2-design if the gates are chosen randomly from 2-qubit Clifford gates. 
This is the case because the 2-design bounds in <cit.> are established by analyzing mathematical objects defined solely using the second moment operator associated with the 2-qubit Haar measure 𝒰_2

    _U∼𝒰_2[U^⊗ 2⊗(U)^⊗ 2],

and the architecture template—for example by lower bounding the spectral gap of a local Hamiltonian defined in terms of <ref>. Since the uniform distribution over 2-qubit Clifford gates 𝒟_2 forms an exact unitary 2-design,

    _C∼𝒟_2[C^⊗ 2⊗(C)^⊗ 2]=_U∼𝒰_2[U^⊗ 2⊗(U)^⊗ 2].


Mirroring the proof strategy for <ref>, we begin by establishing a direct analog of <ref> in <Ref>.


Let K be an arbitrary non-identity t-qubit Pauli operator, draw a C̃∼𝒟̃_t, and define P=C̃^† KC̃. Let h,s≥ 1 satisfy h+s=t. Decompose P as P=± P_1⊗ P_2 such that P_1 and P_2 are h- and s-qubit Pauli operators respectively. Let ∅≠𝒫⊆{I,X,Y,Z}^⊗ s. Then for every ε≤1/3(4^t-1), it holds that

    (P_1=I^⊗ h|P_2∈𝒫)≤1/4^h(1+3(4^t-1)ε).




In the following, we make use of the fact that for every non-identity Pauli W∈{I,X,Y,Z}^⊗ t∖{I^⊗ t},

    (P=± W)=1/4^t_C̃∼𝒟̃_t[(W C̃^† K C̃)^2].

Thus, by <ref>,

    1/4^t-1-ε≤(P=± W)≤1/4^t-1+ε.

Since 𝒫≠∅, either I^⊗ s∉𝒫 or I^⊗ s∈𝒫. First consider the case where I^⊗ s∉𝒫. In this case, we have

    (P_1=I^⊗ h|P_2∈𝒫)   =(P_1=I^⊗ h and P_2∈𝒫)/(P_2∈𝒫)
       ≤|𝒫|(1/4^t-1+ε)/|𝒫|4^h(1/4^t-1-ε)
       ≤1/4^h(1+3(4^t-1)ε)

where in the last line, we use the fact that 1+x/1-x≤ 1+3x for every 0≤ x≤1/3. Secondly, for the case where I^⊗ s∈𝒫, we have

    (P_1=I^⊗ h|P_2∈𝒫)
    
    =   (P_1=I^⊗ h and P_2∈𝒫)/(P_2∈𝒫)
    =   (P_1=I^⊗ h and P_2=I^⊗ s)+(P_1=I^⊗ h and P_2∈𝒫∖{I^⊗ s})/(P_2=I^⊗ s)+(P_2∈𝒫∖{I^⊗ s})
    ≤   (|𝒫|-1)(1/4^t-1+ε)/(4^h|𝒫|-1)(1/4^t-1-ε)
    ≤   1/4^h(1+3(4^t-1)ε).





Let r∈{1,2,3,4}. Let K_1,…,K_r be arbitrary non-identity t-qubit Pauli operators. For every i∈{1,…,r}, draw an independent C̃_i∼𝒟̃_t, define P_i=C̃_i^† K_iC̃_i, and write P_i=± E_i⊗ F_i such that E_i and F_i are t/4- and 3t/4-qubit Pauli operators respectively. Define P_Q=⊗_i=1^r E_i, P_Q'=⊗_i=1^r F_i, and k=rt/4. Let ∅≠𝒫⊆{I,X,Y,Z}^3k. Then 


  * for r=4,

    _(C̃_1,…,C̃_r,C̃)∼𝒟̃_t[C̃^† P_QC̃ is Z-type|P_Q'∈𝒫]≤(1/2)^t-2^2t+2ε,



  * for r∈{1,2,3}, for every ε≤1/8^t,

    _(C̃_1,…,C̃_r,C̃)∼𝒟̃_t[C̃^†(P_Q⊗ I^⊗ t-k)C̃ is Z-type|P_Q'∈𝒫]≤1/4^k+2/2^t.





For every non-identity t-qubit Pauli operator W∈{I,X,Y,Z}^⊗ t∖{I^⊗ t}, it holds that

    _C̃∼𝒟̃_t(C̃^† WC̃ is Z-type)=2^t_C̃∼𝒟̃_t[⟨0^n|C̃^†W/√(2^t)C̃|0^n⟩^2]≤1/2^t+1+2^tε.

By the previous lemma and the independence among F_1,…,F_r, 

    (P_Q=I^⊗ k|P_Q'∈𝒫)   ≤1/4^k(1+3(4^t-1)ε)^r
       ≤1/4^k+15(4^t-1)/4^kε

where we use the fact that (1+x)^r≤ (1+x)^4≤ 1+5x for every 0≤ x≤ 0.15. Thus, for r=4, we get by convexity that

    (C̃^† P_Q C̃ is Z-type|P_Q'∈𝒫)
    ≤   (P_Q=I^⊗ k|P_Q'∈𝒫)+(1-(P_Q=I^⊗ k|P_Q'∈𝒫))(1/2^t+1+2^tε)
    ≤   1/4^t+15ε+(1-1/4^t-15ε)(1/2^t+1+2^tε)
    ≤   1/2^t+(2^t+15)ε
    
    =    2^-t+log(1+2^t(2^t+15)ε)
    ≤    2^-t+2^2t+2ε

where in the last line, we use the fact that log_2(1+x)≤ 2x for every x≥ 0. For the second bound, we have

    (C̃^†(P_Q⊗ I^⊗ t-k)C̃ is Z-type|P_Q'∈𝒫)
    ≤   1/4^k+15(4^t-1)/4^kε+(1-1/4^k-15(4^t-1)/4^kε)(1/2^t+1+2^tε)
    ≤   1/4^k+1/2^t+(15(4^t-1)/4^k+2^t)ε
    ≤   1/4^k+1/2^t+1/2^t

since ε≤1/8^t.




Let P be an n-qubit Pauli operator, and let D̃ be a compiled random Clifford circuit. Also let a = 𝒢(P) and l = Per(𝒢(P)) denote the size and perimeter of 𝒢(P), respectively. Assume τ≥Ω(√(log(m))) and choose ε=2^-ct=2^-cτ^2 for some large enough c so that (m-1)^22^2t+2ε≤ 1. Then 

    [D̃^†  P D̃ is Z-type] ≤(1/2) ^a τ^2 + 1/4l (τ^2 / 12 - 2)-1.



It suffices to establish bounds analogous to the ones appearing in the proof of <ref> for compiled random Clifford circuits. We inherit all the definitions from the proof of <ref>. 
For every V_i∈𝒱_int,

    [ V_i^† P'_i V_i  is Z-type  |   V_j^† P'_j V_j  is Z-type for all j < i] ≤ 2^-τ^2+2^2t+2ε = 2^- Q_i'+2^2t+2ε.

For every V_i∈𝒱_perim,

    [ V_i^† P'_i V_i  is Z-type  |   V_j^† P'_j V_j  is Z-type for all j < i]    ≤ 4^-Q_i' + 2^-τ^2+1
       ≤  4^-Q_i' + 2^-4 Q_i' / 3+1
       =2^-Q_i'(2^-Q_i' + 2^-Q_i'/3+1)
       ≤ 2^-|Q'|-τ^2/12+2.

Finally,

    [D^† PD is Z-type]   ≤ 2^-Q_0'+2^2t+2ε(∏_V_i ∈𝒱_int 2^-Q_i'+2^2t+2ε)(∏_V_j ∈𝒱_perim 2^-Q_j - τ^2/12 + 2)
       ≤ 2^- 𝒱_perim (τ^2/12 - 2) - ∑_i=0^(m-1)^2Q'_i+(m-1)^22^2t+2ε
       ≤ 2^- 𝒱_perim (τ^2/12 - 2) - Q'+1.

To finish the proof, we recall from the proof of <ref> that |Q_i|=aτ^2 and |𝒱_perim|≥1/4l.




§ PROOF OF <REF> 


Without loss of generality let us fix a local basis so that C_h, C_i, C_j are identity, and the stabilizer group of ψ contains stabilizers g_1,g_2,g_3 in <ref>. By taking products of these stabilizers g_1,g_2,g_3  we see that the stabilizer group of ψ contains the following elements:

    g_1   = X_hX_iX_j Z(s) 
    
    g_2   =Z_hZ_i I_j Z(t)
    
    g_3   =I_h Z_iZ_j Z(u)
    
    g_4   = -Y_hY_iX_j Z(s⊕ t)
    
    g_5   =-X_hY_iY_j Z(s⊕ u)
    
    g_6   =-Y_hX_iY_j Z(s⊕ t⊕ u)
    
    g_7   =Z_hI_iZ_j Z(u⊕ t).

Let us assume, to reach a contradiction, that m satisfies <ref>. Write

    m_s=∏_v∈ [n]m_v^s_v     m_t=∏_v∈ [n]m_v^t_v     m_u=∏_v∈ [n]m_v^u_v.


Note that our function m must only output binary strings that are consistent with stabilizers that are diagonal in the measurement basis b. In this way each of the stabilizers <ref> places a constraint on the possible outputs of m. 

For example, from the stabilizer g_2 we infer that 

    m_h· m_i· m_t=1     whenever   b_h=b_i=2.

Since each output bit depends on only one input bit, and  m_h,m_i are independent of b_j,  we can infer from the above that m_t is independent of b_j. We now explain this in more detail. Let L_h,L_i,L_j⊆ [n] be the set of output bits m_v that depend on inputs b_h,b_i,b_j respectively, so that

    m_t=(-1)^a∏_v∈ L_h m_v(b_h)∏_v∈ L_i m_v(b_i)∏_v∈ L_j m_v(b_j)

for some a∈{0,1}. Then <ref> implies

    ∏_v∈ L_j m_v(b_j)=(-1)^a m_h(2)· m_i(2)·∏_v∈ L_h m_v(2)∏_v∈ L_i m_v(2)     b_j∈{0,1,2}.

where b∈{0,1} is fixed. Plugging <ref> into <ref> gives 

    m_t=∏_v∈ L_h m_v(b_h)∏_v∈ L_i m_v(b_i)[m_h(2)· m_i(2)·∏_v∈ L_h m_v(2)∏_v∈ L_i m_v(2)]

which shows that m_t is independent of b_j. 

In exactly the same way, from the stabilizers g_3, g_7 we infer that m_u is independent of b_h and that m_u· m_t is independent of b_i.

Next consider the subset of inputs b_h,b_i,b_j∈{0,1} which correspond to measuring these qubits in the X or Y bases. Since m_t is independent of b_j and m_U is independent of b_h, there exist affine functions e,f,g,h:{0,1}→{0,1} such that 

    m_t=(-1)^e(b_h)+f(b_i)   m_u=(-1)^g(b_i)+h(b_j)     b_h,b_i,b_j∈{0,1}.

Since m_t· m_u is independent of b_i we may set 

    g(b_i)=f(b_i).


From the stabilizers g_1,g_4,g_5,g_6 we infer

    i^b_h+b_i+b_jm_hm_im_j m_sm_t^b_hm_u^b_j=1      b_h⊕ b_i⊕ b_j=0      b_h,b_i,b_j∈{0,1}.


Plugging <ref> into <ref> gives, for b_h,b_i,b_j∈{0,1}, 

    i^b_h+b_i+b_jm_hm_im_j m_s(-1)^b_h(e(b_h)+f(b_i))(-1)^b_j(f(b_i)+h(b_j))=1      b_h⊕ b_i⊕ b_j=0.


Now since each output bit m_v depends on at most one of the variables b_h,b_i,b_j, from the above we infer that for b_h,b_i,b_j∈{0,1} we have

    i^b_h+b_i+b_j(-1)^α_0+α_1b_h+α_2b_i+α_3b_j(-1)^β b_hb_i(-1)^β b_ib_j=1      b_h⊕ b_i⊕ b_j=0

for some coefficients

    α_0,α_1,α_2,α_3,β∈{0,1}

The claim below shows that we have reached a contradiction and we conclude that <ref> is not satisfied by any function m of the form described in the theorem statement. <ref> then follows directly.

<ref> is not satisfied for any choice of coefficients <ref>.


Assume, to reach a contradiction, that <ref> holds. We'll  plug in values of b_h,b_i,b_j and infer a set of linear equations that must be satisfied by the coefficients α_0,α_1,α_2,α_3,β. By plugging in b_h=b_i=b_j=0 we infer α_0=0. Next setting (b_h,b_i,b_j)={(1,1,0),(1,0,1),(0,1,1)} we get

    α_1+α_2+β   =1  2
    α_1+α_3    =1  2
    α_2+α_3+β   =1  2

Summing these three equations we are led to a contradiction (0=1  2) and therefore there is no solution.





 Paper Title: A Survey on the Applications of Zero-Knowledge Proofs.

 

Measuring the Spin of the Galactic Center Supermassive Black Hole with Two Pulsars
    Lijing Shao
    August 5, 2024
==================================================================================



§ ABSTRACT 
Zero-knowledge proofs (ZKPs) represent a revolutionary advance in computational integrity and privacy technology, enabling the secure and private exchange of information without revealing underlying private data. ZKPs have unique advantages in terms of universality and minimal security assumptions when compared to other privacy-sensitive computational methods for distributed systems, such as homomorphic encryption and secure multiparty computation. Their application spans multiple domains, from enhancing privacy in blockchain to facilitating confidential verification of computational tasks.
This survey starts with a high-level overview of the technical workings of ZKPs with a focus on an increasingly relevant subset of ZKPs called zk-SNARKS. While there have been prior surveys on the algorithmic and theoretical aspects of ZKPs,  our work is distinguished by providing a broader view of practical aspects and describing many recently-developed use cases of ZKPs across various domains. These application domains span blockchain privacy, scaling, storage, and interoperability, as well as non-blockchain applications like voting, authentication, timelocks, and machine learning. Aimed at both practitioners and researchers, the survey also covers foundational components and infrastructure such as zero-knowledge virtual machines (zkVM), domain-specific languages (DSLs), supporting libraries, frameworks, and protocols.
We conclude with a discussion on future directions, positioning ZKPs as pivotal in the advancement of cryptographic practices and digital privacy across many applications.




§ INTRODUCTION


Zero-knowledge proofs (ZKPs) are a set of cryptographic methods allowing one party to prove the validity of a claim to another without disclosing any of the claim's underlying details. The seminal work by Goldwasser, Micali, and Rackoff laid the groundwork for ZKPs in the 1980s <cit.>. It introduced the principle of knowledge complexity as a metric for quantifying the information transferred from the prover to the verifier. Subsequently, Goldreich and others <cit.> published several works until the 1990s that expanded the scope of ZKPs to a broader range of computational problems. They demonstrated their applicability to NP-complete problems under specific cryptographic assumptions. Another significant advancement in the development of ZKP's came with the introduction of succinctness in <cit.> to ZKP's following the design paradigm of Kilian's seminal 1992 paper <cit.>. The succinct and non-interactive properties of zk-SNARKs greatly enhance their practical applicability and versatility in blockchains and non-blockchain systems. The foundational principles of ZKPs offer innovative solutions to digital systems that prioritize both security and privacy <cit.>.

The advent of ZKPs has represented a significant leap forward in the convergence of privacy and verifiability, which has captivated significant interest from both the cryptographic scholarly community and the industry. It introduced a unique approach in the field of cryptography, differentiating itself from other privacy-sensitive computational innovations for distributed systems, such as homomorphic encryption and secure multiparty computation. 
While these methods are also being actively developed and advanced, each serves a specific purpose in information verification and privacy preservation. Homomorphic encryption enables computations on encrypted data without needing to decrypt, thereby preserving confidentiality while allowing the derivation of useful insights <cit.>. Secure multiparty computation enables trustless collaborations and allows parties to jointly compute a function over their inputs while keeping those inputs private <cit.>. From Table <ref>, we observe ZKPs offer several advantages, such as universality and minimal security assumptions over other techniques by proving the truth of a statement without disclosing any other information. 



In modern digital systems, a trade-off exists between openness and privacy. Blockchains, for example, prioritize transparency to ensure trust and prevent fraud, with every transaction openly verifiable. However, this transparency can compromise privacy <cit.>. Despite the pseudonymous nature of blockchain transactions, advanced analytics can de-anonymize users by correlating on-chain and off-chain data. Such exposure can reveal a user's entire transaction history, leading to privacy breaches and potential targeted threats. As digital infrastructures become increasingly complex, striking the right balance between transparency for security and preserving user privacy becomes a vital research challenge. In this context, ZKPs emerge as a robust solution addressing the challenges posed by such trade-offs in digital systems.

ZKPs enable users to verify private data such as bank balances or credit scores without revealing specifics. Furthermore, they can ensure anonymity in authorization processes by allowing access to restricted areas or proving regional origin without disclosing detailed credentials. In the financial domain, ZKPs can allow for identity-free payments and tax submissions without revealing exact earnings. Additionally, they facilitate trustless outsourcing by letting organizations validate results without redoing the entire operation in the computational field. Furthermore, ZKPs can modify blockchain operations, shifting from collective to singular computation with network-wide verification. Overall, ZKPs exemplify the merging of verification with privacy across diverse applications <cit.>.

In exploring the realm of ZKPs, it is fundamental to recognize verifiable computation as the cornerstone upon which the practical applications of ZKPs are built. Verifiable computation, at its core, is the ability to prove that an external computation was performed correctly without revealing the inputs or the computation process. This foundational attribute of ZKPs serves as a gateway to their two practical value propositions: succinctness and privacy. In the remainder of this survey, we will see how each of these two values contributes to the practical applications of ZKPs.

Succinctness in ZKPs allows for the quick verification of the correctness of a computation without the extensive resources typically required for direct computation execution. This is crucial in contexts where computational resources are limited or expensive, such as in blockchain networks. For instance, ZKPs enable the validation of transaction blocks or smart contract executions without necessitating each node to replay the entire sequence of transactions or computations. This aspect dramatically reduces the computational load on the network, enhancing scalability and throughput.

Privacy, the second major value proposition, emerges from the intrinsic nature of ZKPs to prove the correctness of information without revealing the information itself. This characteristic is particularly transformative in scenarios where sensitive or confidential data is involved. This capability opens the door to a wide range of applications, from private voting systems to confidential financial transactions, where the integrity of the process is maintained without compromising the privacy of the individuals or entities involved.

In the ZKP literature, there exist two key survey articles relevant to our work. The first survey by Morais et al. <cit.> dives deep into Zero-Knowledge Range Proofs (ZKRP) with a particular emphasis on the algorithmic details required for the implementation of ZKRPs. Furthermore, it defines the fundamental theoretical background behind ZKRPs and describes possible generic and blockchain-specific use cases of ZKRPs. In contrast, our survey covers a broader range of application categories and use cases. Further, we provide an overview of the underlying theoretical components, tools, and infrastructure needed for ZKP development. Additionally, we enlist and discuss the currently deployed and in-deployment application software that fall under the different blockchain and non-blockchain categories. The second survey by Sun et al. <cit.> takes a narrower approach, concentrating on the intersection of ZKPs with blockchain technology. It outlines the security challenges within blockchain's public and transparent nature and discusses how ZKPs can mitigate risks of private data exposure. Our work differentiates itself from these prior surveys by providing a more comprehensive practical application-oriented overview that covers both blockchain and non-blockchain applications of ZKPs in a broader context complemented by extensive analysis of the ZKP infrastructure being developed, including zkVMs, DSLs, and supportive technologies to guide developers to essential tools for building ZK-enabled applications efficiently.

This survey article serves as a comprehensive guide for practitioners and researchers, focusing on the broad range of practical applications and use cases of ZKPs. It systematically highlights the best practices, potential challenges, and the underlying impact of ZKPs on diverse application fields. Practitioners will find it a valuable roadmap that offers insights into incorporating ZKPs into various sophisticated digital systems. For researchers, it provides an overview of the current state of ZKP deployment, aiming to catalyze further research and development. By bridging the gap between theoretical cryptographic knowledge and practical application domains of ZKPs, this survey intends to enable professionals across disciplines to leverage the nuanced benefits of ZKPs in their work.



We organize the remainder of this article to methodically illustrate the intricacies of zkSNARKs and their wide range of applications. Section <ref> characterizes the foundational components and requisite properties of SNARKs. Section <ref> describes the infrastructure underpinning Zero-Knowledge Proofs, encompassing virtual machines, domain-specific languages, and pertinent libraries. Next, Section <ref> provides an extensive dissection of blockchain applications, which reviews the role of ZKPs across various blockchain layers and functionalities. Section <ref> extends the discussion to non-blockchain application domains, detailing ZKPs' utility in diverse contexts such as machine learning and digital identity verification. Finally, Section <ref> puts forward the future directions and discusses the expanding scope of ZKPs, then wraps up with a summary of our discussion and gives a reflective analysis of the presented content.



§ COMPONENTS OF ZKSNARKS
 


Zero-Knowledge Proofs (ZKPs) are a cryptographic tool that enables one party, known as the prover, to prove to another party, the verifier, that a certain statement is true without revealing any information beyond the validity of the statement itself <cit.>. A “statement" in the context of ZKPs refers to a claim that can be mathematically verified, such as “I know two factors to a large number" or “I have executed a set of instructions from a virtual machine (VM) instruction set correctly". This introduction aims to clarify the relationship between the broader category ZKPs and a particular subset known as Succinct Non-interactive Arguments of Knowledge (SNARKs), which aims to simplify the verification process by eliminating the need for interaction between two parties[Our introduction is necessarily brief, for a more thorough discussion, we refer the reader to more detailed explainers on zk-SNARKs such as <cit.>.].

There are several useful abstractions with which one could view the components that enable SNARKs. We will explore two such abstractions. First, we will follow the life-cycle of compiling high-level code into a provable form. Once the computational representation becomes provable, we will work with an interactive protocol, a process where two parties, referred to as a prover and verifier, exchange a series of messages to form a SNARK. First, we will explain the properties that a SNARK must adhere to.



 §.§ Definition and Properties of SNARKs

SNARKs, an acronym that stands for Succinct Non-interactive Arguments of Knowledge, represent a subset of zero-knowledge proofs with unique characteristics. Defining the acronym can help in highlighting these attributes:


    
  * Succinctness: SNARKs are distinguished by their compact proof size, which remains small regardless of the computational complexity or the size of the input data. This property is instrumental in environments where bandwidth or storage is limited, such as blockchain networks, ensuring that proofs can be transmitted and verified efficiently.
    
    
  * Non-interactivity: Unlike some Zero-Knowledge Proofs that require back-and-forth communication between the prover and the verifier, SNARKs are non-interactive. This means that the prover can generate a single proof that the verifier can independently check without further communication. Non-interactivity is achieved through the use of a common reference string shared between the prover and verifier.
    
    
  * Arguments of Knowledge: SNARKs assure not only that a certain statement is true but also that the prover possesses explicit knowledge of the information substantiating that statement. This aspect of SNARKs ensures that the proof carries with it a guarantee of knowledge, which is crucial for applications that require authentication or verification of authority.


SNARKs have several defining properties that ensure their functionality and security. These properties include:


    
  * Completeness: If a statement is true and both the prover and verifier follow the protocol honestly, the verifier will be convinced of this truth by a valid proof. Mathematically, for every valid deterministic input x and corresponding non-deterministic input w, often referred to as a witness, there exists a proof π such that the verifier accepts π as valid.
    
  * Soundness: If a statement is false, no cheating prover can convince the verifier of its truth. This is often a computational property, meaning that no efficient (polynomial time) prover can create a proof for a false statement that the verifier would accept.
    
  * Knowledge Soundness: Ensures that if a prover can convince a verifier of the truth of a statement, then the prover actually knows a private input for that statement. This distinguishes SNARKs from other non-interactive proof systems where a prover might be able to convince a verifier without actually knowing the private input.
    
  * Zero Knowledge: The proof does not reveal any information about the witness or the statement beyond its validity. There are different levels of zero-knowledge: 
    
        
  * Computational Zero Knowledge: The verifier learns nothing from the proof that they couldn't compute on their own.
        
  * Statistical Zero Knowledge: The verifier learns almost nothing from the proof, except with a small statistical difference.
        
  * Perfect Zero Knowledge: The proof gives absolutely no information to the verifier about the witness or statement, beyond the fact that the statement is true.
    


It's worth noting that the differences between computational, statistical, and perfect properties revolve around the nature of the information leakage (or lack thereof) and the strength of the security guarantee.



 §.§ Lifecycle of a SNARK: From Python to Polynomials





  §.§.§ Frontends: From High-level code to circuits

This section explores  the transition from high-level programming constructs to the more abstract representation as circuits, which are instrumental to the construction of a SNARK.

Consider the following Python function[A Practical Caveat: While the transition from Python code to an arithmetic circuit illustrates the conceptual process underlying the construction of SNARKs, it's important to note that, in practice, directly translating high-level programming languages to circuit representations may not be computationally efficient. To address this, developers often utilize zero-knowledge domain-specific languages (often referred to as zk-DSLs) or similar frameworks specifically designed for creating zero-knowledge proofs. These will be explored later in section <ref>.]:



This function calculates the evaluation of a three-variate polynomial f(a, b, c) = a^2 b^2 + b^2 c^2. Next, we represent this function as an arithmetic circuit. Arithmetic circuits are structured mathematical representations that decompose more-complex computations (such as the Python function above) into simple arithmetic operations (like addition and multiplication). This transformation, when coupled with the later transformations described below, will enable the properties of privacy and succinctness that enable the practicality of SNARKs.





  

In the context of cryptographic circuits like the one in Figure <ref>, the elements a, b, and c are typically considered to be elements of a finite field 𝔽_p, specifically numbers modulo a large prime number p. This use of a finite field ensures that all operations are performed within a closed, discrete set of numbers in the set {0, …, p-1}, providing properties that help maintain cryptographic security.



  §.§.§ Arithmetization: From circuits to matrices


Arithmetization is the process of encoding the wiring and gate operations of a digital circuit or model of computation into a mathematical representation. In the context of zero-knowledge proofs, this often involves translating the circuit into a format that is suitable for the generation of a proof that the circuit's execution satisfies certain conditions without revealing the specifics of the inputs or internal states. For brevity, we will focus on Rank-1 Constraint Systems (R1CS), which serve as a common arithmetization strategy for many zk-SNARKs. Some alternative arithmetization methods, namely Plonk-ish arithmetization, algebraic intermediate representations (AIR), and circuit constraint systems (CCS) have gained popularity in recent years as well <cit.>.


An R1CS is a way to represent a computation in the form of constraints that are linear equations. These constraints can be checked efficiently and are the foundation of various zero-knowledge proof systems. In an R1CS, each constraint is an equation of the form:

    𝐀·𝐰∘𝐁·𝐰 = 𝐂·𝐰

where 𝐀, 𝐁, and 𝐂 are matrices, 𝐰 is a vector of variables that correspond to the transcript of a digital circuit's execution, and ∘ denotes the Hadamard (element-wise) product.

As a mental model, one can think of R1CS as a system that verifies all parts of a program by checking individual, linear parts of its computation, ensuring that all constraints are satisfied for the program to be considered correct.

The operations performed by our example circuit can be encoded into an R1CS by expressing each operation as a set of linear constraints. In R1CS, the constraints take the form of equations where the left and right sides must multiply to give the output. For our circuit, we introduce variables and intermediate 'witness' variables to represent the computation steps. Here is how each operation in the circuit translates into constraints:


    
  * Multiply a by itself to get a^2 results in the constraint a × a - a^2 = 0.
    
  * Multiply b by itself to get b^2 results in the constraint b × b - b^2 = 0.
    
  * Multiply c by itself to get c^2 results in the constraint c × c - c^2 = 0.
    
  * Multiply a^2 by b^2 to get a^2 × b^2 results in the constraint a^2 × b^2 - a^2b^2 = 0.
    
  * Multiply b^2 by c^2 to get b^2 × c^2 results in the constraint b^2 × c^2 - b^2c^2 = 0.
    
  * Add a^2 × b^2 and b^2 × c^2 to get the final result leads to the constraint ab^2 + bc^2 - result = 0.


To encode these constraints into matrices 𝐀, 𝐁, and 𝐂, we introduce the following variables: w_1 = a, w_2 = b, w_3 = c, w_4 = a^2, w_5 = b^2, w_6 = c^2, w_7 = a^2b^2, w_8 = b^2c^2, and w_9 = result. Each matrix will have rows corresponding to constraints and columns corresponding to these variables, which can be further compressed as an array 𝐰 = [1, a, b, c, a^2, b^2, c^2, ab^2, bc^2, result].

The vector 𝐰, often referred to as the `witness', captures an  execution transcript of the circuit. The witness contains the values of all variables and intermediate steps that satisfy all the R1CS constraints for the given inputs. Given that anyone with a witness 𝐰 can execute the circuit to verify if 𝐰 is valid, a correct execution transcript 𝐰 can be viewed as a proof that the computation was carried out correctly and that all of the R1CS's constraints are satisfied. If, at any point, an attacker obtained access to the R1CS or witness vector, access to the inputs, intermediate values, and outputs of the computation would be leaked. 

Up to this point, there is no way to prove, in a publicly-verifiable way, that the computation was performed correctly without allowing others to re-run the computation themselves. The next section, however, converts the R1CS into a form that allows for maintaining privacy while allowing for public-verifiability and a sublinear verifier runtime.



  §.§.§ Backends: From matrices to polynomials


The backend phase of the SNARK lifecycle involves transforming the Rank-1 Constraint System (R1CS) matrices into a set of polynomial equations that form a Quadratic Arithmetic Program (QAP). This transformation is key to creating a SNARK, as it allows for the efficient verification of the computations represented by the R1CS. Succinctness, a property of SNARKs integral to a sub-linear verifier runtime, is achieved by encoding the matrix operations from the R1CS into polynomial equations. This more succinctly represents the original circuit's execution trace without sacrificing the soundness guarantees of the underlying argument.

Mathematically, a QAP is defined as a set of polynomial equations derived from the R1CS <cit.>. For matrices 𝐀, 𝐁, 𝐂 of size m × n, where m is the number of constraints and n is the number of variables, we define the QAP as follows: Let {A_i(x)}_i=1^m, {B_i(x)}_i=1^m, and {C_i(x)}_i=1^m be sets of polynomials where each A_i(x), B_i(x), C_i(x) is a polynomial corresponding to the i^th row of 𝐀, 𝐁, 𝐂 respectively. Then, the QAP consists of the set of equations { A_i(x) · B_i(x) - C_i(x) = h(x) · Z(x) }_i=1^m, where h(x) is the polynomial that represents a solution to the R1CS, and Z(x) is a verifier-chosen, fixed polynomial that evaluates to zero at {x_1, x_2, …, x_m}, the set of distinct points associated with each constraint.

The QAP allows for the succinct representation of the R1CS and enables the prover to compute a single proof, which is a small set of polynomial evaluations. This proof attests that there exists a polynomial h(x) that satisfies the QAP equation, implying that the prover knows a witness 𝐰 that satisfies the R1CS.

The verifier, given the proof and the public polynomials A(x), B(x), and C(x), can efficiently check the QAP verification equation without having to perform the full set of R1CS computations. This results in a verification process with a significant speedup over computing the function represented by the circuit directly.

In summary, the conversion from matrices to polynomials and the creation of a QAP forms the bridge between the arithmetic circuit and the final SNARK. This process ensures that a valid execution of the circuit, one that satisfies all the constraints, is encoded into a format that supports the creation of a compact, easily verifiable proof. The integrity of this transformation is fundamental to the trustworthiness and security of the SNARK.



 §.§ Conjoining Information Theory and Cryptography

Interactive proofs (IPs), when not paired with any cryptographic protocol, provide unconditional soundness, where the validity of a statement can only be confirmed if it is indeed true, independent of computational assumptions. Integrating an IP protocol with a cryptographic gadget, however, enhances both the security and other properties of the resulting SNARK. This cryptographic gadget, often referred to as a polynomial commitment scheme (PCS) <cit.>, increases security assumptions but is also a large part of what makes SNARKs practical today through the succinctness property and an improved verifier runtime. While PCSs have become a necessary component in the large taxonomy of SNARK designs today, the necessity for private randomness in PCSs for cryptographic security complicates their integration with an IP protocol. Trusted ceremonies, which are critical for generating this randomness securely and ensuring that no single participant can compromise the setup, thus need to be executed before the SNARK enters production. If a trusted ceremony is executed incorrectly, false proofs will be able to be created and the protocol will be insecure – this happened in 2016 with Zcash's Sapling ceremony and another ceremony was later ran to replace it <cit.>. Lastly, to ensure that SNARKs are publicly-verifiable, so that collusion between the prover and verifier is not possible, the SNARK must be made non-interactive. SNARKs achieve non-interactivity through the Fiat-Shamir heuristic <cit.>, which substitutes the verifier’s random challenges with outputs from a collision-resistant hash function. This modification not only simplifies the verification process but also makes the proofs publicly verifiable, enhancing both the practicality and security of SNARKs in broad applications.



§ ZKP SOFTWARE TOOLS AND PLATFORMS
 

In this section, we explore the underlying infrastructure and tooling currently available to produce ZKP by first examining zero-knowledge virtual machines (zkVM), domain specific languages (DSLs), and supporting libraries, frameworks, and protocols. These core pieces of the ZKP space allow for statements we are familiar with to be translated into an arbitrary computation that is then represented as a verifiable ZK circuit in an efficient manner.

At a broad scale, the process can be split into two sections: the frontend and the backend. Given a program, the process begins with the frontend. The frontend’s purpose is to take in a program and transform it into a format that a proving system discussed above can interpret and produce a proof from. The backend handles the proof generation process and does most of the heavy lifting in the process. 

After that, the intermediate representation is translated into a constraint system and passed to the backend. The backend begins by putting the circuit representation of the program from the artihmetization scheme into a proving system such as Groth16 <cit.> or Bulletproofs <cit.>. Finally, a proof of execution is produced and the user can succinctly verify its correctness.



 §.§ Zero-Knowledge Virtual Machines




  §.§.§ Motivation and Definition


With the increased dependency on distributed computing in industries such as blockchain and cloud computing, the importance of private computing at a large scale grew exponentially. ZKPs offer a solution for providing an environment that performs computations in a trustworthy manner through a zero-knowledge virtual machine (zkVM). A zkVM is a virtual machine (VM) designed to generate an efficiently verifiable proof for executing an arbitrary computation while preserving the privacy of the program and its data in zero knowledge. The zkVM acts as a programmable ZK circuit that implements a VM, receives public and private inputs, and creates a certificate of valid execution. Similar to a generalized virtual machine, a zkVM maintains its own virtualized components, such as memory management, instruction scheduling, error handling, and others, using a privacy-focused approach with the help of a ZKP. 

The motivation for building zkVMs stems from the desire to reduce the complexity of creating a ZKP. Previously, to produce a ZKP, a developer needed to have a strong background in cryptography, develop a circuit representation of their program, set up a backend for each proof, and have a large amount of computing power. To abstract away these steps from the developer, zero-knowledge virtual machines were developed with these features in mind.



  §.§.§ Methodology




The first step of most zkVMs is to receive an input program from a higher-level language such as C++, Circom <cit.>, Rust, or others. The program is then compiled to bytecode that the VM can translate to an instruction set architecture (ISA) that is generalized, like RISCV, or specialized, such as Miden Assembly <cit.>. These ISAs are minimal and optimized for cryptographic operations such as hashing to optimize the performance of the zkVM.

Depending on the proving system, the setup phase begins after the program has been interpreted and translated to bytecode. This step involves tasks such as concealing private inputs, initializing a polynomial commitment scheme, key generation, and others. A set of constraints is placed on the program and the witness to enforce computational integrity in the computation trace. Building on what was mentioned in Section 2, constraints ensure the zkVM execution trace follows the guidelines outlined in the ISA. Every constraint is a polynomial for each statement inside the execution trace. 

To check the validity of each instruction in the execution trace, a verifier can open any instruction in the zkVM to verify it was computed correctly. The prover defines a polynomial for each statement that the verifier can use the polynomial commitment scheme to verify. The verifier receives this polynomial and responds with a random value for evaluating the prover’s polynomial. If the verifier concludes that the output is correct, then the statement in question is also considered correct. 

The zkVM distinguishes itself from writing a specialized circuit for computations due to its high optimization level and reduction of complexity from designing a circuit. In a ZK computation, three common overheads must be taken into account:


    
  * Range Checks: A range check is a way to prove that an element in a finite field falls within a specific interval . Due to the variance in fields, the importance of correct bit-sized integers in these fields, and the intensive operations throughout them, it is important to verify the inputs are valid. This is done using a range proof to verify that a given integer fits the necessary criteria, such as fitting into 32 bits without overflowing.
    
  * Bitwise operations: Nearly every computation in a ZK context needs some bitwise operation for tasks such as hashing. On standard computer hardware, these operations are highly optimized for numbers of standard sizes rather than for large elements in a finite field. In a ZK context, every bit inside of a field element must be proved, the decomposition of a field element into its bits must be proved, and finally, the result of a bitwise operation must be aggregated from bits into another field operation. With current hardware that is not optimized for ZK computation, these can incur large overheads in common operations.
    
  * Hashing. Traditional primitives use existing complex optimizations for bitwise operations as mentioned in 2); however, these bitwise operations take more time because of the above reasoning. Fundamental hash functions such as SHA256 become obsolete on zkVMs unless improvements are made. Considering this, many zkVMs use rivaling primitives such as Rescue or Poseidon or use an entirely different processor to handle the hashing.


By prioritizing efficiency in cryptographic protocols that leverage zero-knowledge proofs, zkVM enhances the performance of applications involved in secure data exchange, anonymous transactions, and confidential smart contracts. This optimization ensures that cryptographic operations, integral to privacy-preserving technologies, are executed with heightened speed and effectiveness.



The projects in the timeline are an overview of the prominent zkVMs over the last decade such as TinyRAM <cit.>, Hawk <cit.>, Zinc <cit.> , RISC Zero <cit.>,  CarioVM <cit.>, Leo <cit.>, Miden <cit.>, Triton <cit.>, OlaVM <cit.> , Powdr <cit.>, and Jolt <cit.>.  Some other zkVMs that are on the rise as of writing this paper are SP1 <cit.>, Nexus <cit.>, and Valida <cit.>.

A project in the space is RISC Zero’s <cit.>  zkVM which allows users to demonstrate the accurate execution of arbitrary Rust and C++ code. This enables the construction of zero-knowledge applications that leverage the variety of existing Rust packages. Functioning as a verifiable computer, the zkVM mimics the operations of a genuine embedded RISC-V micro-processor, thus allowing any program that can compile down to the RISC-V instruction set to run on the zkVM. This emulation not only facilitates the development process for developers but also simplifies the creation of powerful zero-knowledge applications. RISC Zero also mains a ZK Validity Proof System that empowers users to substantiate the validity of Ethereum blocks. The zkVM is equipped to function on different computer systems, program sizes, hardware targets, and runtime/memory requirements. 

Starkware <cit.>, the company behind zk-STARKs (Zero Knowledge Scalable Transparent Argument of Knowledge) applications, created CairoVM. CairoVM is an efficient and practical architecture specifically compatible with the STARK proof system. It instantiates a STARK based von-Neumann architecture known for its instruction set that allows support for traditional language features such as conditional branching, function calls, recursion, and its ability to have a deterministic or a nondeterministic nature in aspects like its restrictive memory model. The bytecode of the Cairo zkVM, which are generated by the Cairo assembler, represents the input program from a given user. From there, the Cairo Runner is used to obtain the execution trace of the program. The Cairo Runner is a computer program designed for the execution of a compiled Cairo program that operates in a distinctive manner compared to running a typical computer program. The key disparity arises from Cairo's support for nondeterministic code. Finally, a STARK prover for the Cairo AIR mentioned in Section 2 is employed to generate a proof for the assertion from the program. 

Polygon’s Miden VM  <cit.> is another zkVM built to contribute to a zero-knowledge rollup, which is a modular second layer blockchain built on top of another blockchain such as Ethereum. Miden extends the capabilities of Ethereum by introducing features such as parallel transaction execution and client-side proving. This empowers developers to craft high-throughput and privacy-preserving decentralized applications (dApps) for sectors like DeFi, RWA, and the Metaverse. Popular programming languages like Rust are supported by Miden, which gives developers flexibility and familiarity. Another feature of Miden VM lies in its automatic generation of a STARK-based proof of execution for any program that runs on it. Miden VM operates by consuming programs in the form of a Merkelized Abstract Syntax Tree (MAST), where each node represents a code block in a binary tree structure. Execution begins at the tree's root, recursively processing each required block based on its semantics. If the execution of any code block encounters failure, the VM halts, preventing the execution of further blocks. The program structure involves a binary tree arrangement, with leaves containing linear instruction sequences and internal nodes determining control flow. As a stack machine, Miden VM utilizes a push-down stack of practically unlimited depth, aligning with the architecture of a STARK. The Miden standard library enhances functionality by providing optimized implementations of commonly-used primitives. This library facilitates the reduction of shared code between parties involved in proving and verifying program execution, achieved by serializing calls to standard library procedures as a fixed 32 bytes, irrespective of the procedure's size. These design goals collectively contribute to Miden VM's efficiency, flexibility, and security.

In conclusion, zkVMs offer a broader spectrum of applicability through its support for general and specialized computation. A zkVM is designed to accommodate a wide range of computations unlike some zero-knowledge proof systems. This flexibility permits developers to implement complex algorithms and diverse computations while benefiting from the privacy and security guarantees inherent in zero-knowledge proofs. 



 §.§ Domain Specific Languages





  §.§.§ Motivation and Definition


A zkDSL (zero-knowledge domain specific language) is a programming language written specifically to provide the programmer a connection between a high-level representation of a program and the low-level intricacies of a ZKP such as writing circuits. 




  §.§.§ Methodology


Some zkDSLs that are listed are O1JS <cit.>, Circom <cit.>, Cairo <cit.>, Noir <cit.>, Juvix <cit.>, and Lurk <cit.>,.

The goal of a zkDSL is to translate a high-level language into an arithmetic circuit that can be passed into a proving system to output a proof on execution of a given program. Some of the most common circuits targeted are R1CS, Plonk, and AIR, as shown in the Arithmetization Schemes table <ref>. Each language has a niche that it is trying to fulfill. For example, Circom is a language that is focused on writing arithmetic circuits whereas Lurk is meant to be a generalized programming language. 

While zkDSLs achieve the goal of abstraction, some drawbacks must be considered. First, zkDSLs encounter challenges in memory management complexity, primarily due to the inherent intricacies associated with zero-knowledge proofs and cryptographic computations. The nature of zkDSLs, which often involve complex mathematical transformations and intricate circuit representations, demands efficient memory management strategies. The need to handle cryptographic primitives, large-scale boolean circuits, and data structures introduces complexities that traditional memory management systems may find challenging to navigate. Languages like Cairo implement optimization techniques in their compiler or VM to reduce this overhead through constraint reduction and cycle elimination.



Second, for some time, zkDSLs have a history of problems with the developer paradigms of recursion, conventional conditionals (excluding ternaries), mutable variables, and user-defined structures, causing unique coding challenges. Recursion, a staple in conventional programming, faces challenges due to the absence of a direct stack and the deterministic path required by circuit-based computation. The representation of if-else statements becomes intricate within algebraic circuits, favoring ternary expressions but sacrificing the straightforwardness of traditional conditionals. The immutability inherent in algebraic circuits complicates the emulation of mutable variables that change state during computation. Furthermore, the structured and hierarchical nature of user-defined structures, commonplace in languages like C++, presents a unique set of challenges. Developers navigating the ZKP circuit structure must consider these drawbacks, as the departure from traditional programming paradigms necessitates a reevaluation and adaptation of coding practices.




  §.§.§ Applications


A classic example of a zkDSL is the circuit writing language Circom <cit.>, which has been used in applications such as TornadoCash <cit.> or DarkForest <cit.>. Circom represents both a programming language and a compiler designed for the creation of arithmetic circuits that are subsequently compiled into Rank-1 Constraint Systems (R1CS). This intricate process allows programmers using Circom to articulate arithmetic circuits at a constraint level, with the compiler generating a file containing the R1CS description, as well as WebAssembly and C++ programs. These output programs facilitate the computation of all circuit values. Additionally, an open-source library, Circomlib <cit.>, features circuit templates to be used in to support writing other circuits. On top of that, O1JS <cit.> is a library proficient in generating and validating Zero-Knowledge (ZK) proofs derived from R1CS. Collectively, this suite of software tools serves to abstract the intricacies of ZK proving mechanisms, providing an interface for modeling low-level descriptions of arithmetic circuits. 

Lurk <cit.> is a Turing complete LISP-based programming language that autonomously generates zk-SNARKs for arbitrary programs. It presents programs as data to the universal Lurk interpreter circuit to achieve Turing completeness without compromising the size of the proof artifacts generated. This departure from traditional approaches aims to enhance the scalability and capabilities of a ZKP. Further, the need for ad-hoc compilation of programs into flat circuits, a conventional process that imposes significant constraints on the size and complexity of achievable computations, is eliminated. 

Leo <cit.> is a programming language designed for the development of formally verified zero-knowledge applications on the blockchain. Leo establishes a execution environment devoid of restrictions on running time, stack size, or instruction sets, offering flexibility. Beyond the intrinsic benefits of ensuring application privacy and mitigating maximal-extractable value (MEV), Leo has two other helpful properties. Firstly, applications undergo formal verification concerning their high-level specifications. Secondly, the succinct verification of applications is made accessible to anyone, irrespective of the application's size. Leo maintains a set of tools, including a testing framework, package registry, import resolver, remote compiler, formally defined language, and theorem prover, specifically tailored for general-purpose zero-knowledge applications. 

To summarize, zkDSLs emerge as versatile tools with a broad spectrum of applications, ranging from smart contract programming to general computation. These specialized languages are instrumental in the development of privacy-preserving features within smart contracts, facilitating secure and confidential transactions on blockchain networks. Beyond blockchain, zkDSLs find utility in general computation scenarios, where their application extends to fields such as data privacy, machine learning, secure distributed computations, and confidential data analysis. In cryptographic applications and security protocols, zkDSLs play a pivotal role by enabling the creation of proofs for statements related to cryptographic properties, thereby enhancing the security and privacy of digital transactions and communication. This versatility positions zkDSLs as valuable tools for developers working on various applications, providing a user-friendly interface to harness the power of zero-knowledge proofs in diverse domains.



 §.§ Libraries and Frameworks



  §.§.§ Motivation and Definition

In the domain of zero-knowledge proofs (ZKP), the development process often entails numerous operations characterized by a high barrier to entry, necessitating a profound understanding of computational strategies, cryptographic primitives, elliptic curves, and the intricacies of ZKP mechanisms. For developers, the hardship lies in crafting reusable code and mitigating redundancy, particularly within ZK proofs, where constraints such as circuit size and gas usage can impose significant limitations. To address these challenges, a multitude of libraries have emerged, offering implementations for cryptographic “gadgets" that facilitate the construction of Rank-1 Constraint Systems (R1CS) instances from modular “gadget" classes as listed in Table <ref>. To faciliate the proving and verification process, elliptic curves as utilized, as mentioned in the previous section. Operations on these curves is relatively standardized and does not always need to be recreated, so libraries avoid the issue of duplicated code in this area. The combination of circuit gadgets and elliptic curves allow for the modular composition of an application in conjunction with a compatible proving system such as Groth16 <cit.> or Bulletproofs <cit.>. These libraries play a crucial role in abstracting the complexities of preprocessing in a modular manner, enabling developers to focus on higher-level design aspects and promoting code reusability across ZKP applications. This emphasis on modularization and abstraction enhances development efficiency and advances innovation within the ZKP domain by fostering collaboration and knowledge sharing among developers.








  §.§.§ Methodology


In the design of ZKP frameworks and libraries, several fundamental principles are leveraged to optimize performance and efficiency. One crucial aspect is the operation over small fields, as demonstrated by systems like ethSTARK <cit.> and Plonky2 <cit.>. Unlike traditional elliptic curve groups, which require large field sizes (e.g., 256 bits) for standard security levels, these systems utilize smaller prime fields (e.g., 64 bits). This approach capitalizes on the efficiency of small-field arithmetic, resulting in state-of-the-art proving performance. Additionally, using small-field elements reduces storage requirements, improving CPUs' cache efficiency. Another critical consideration is the flexibility in field selection. These schemes often use computationally structured fields, providing additional optimization opportunities. Finally, these frameworks and libraries prioritize using cheaper cryptographic primitives, ensuring cost-effective and efficient ZKP implementations <cit.>.

Abstracting away finite field operations holds paramount importance in zero-knowledge proofs (ZKPs).
This endeavor necessitates the implementation of fundamental arithmetic operations, including addition, subtraction, multiplication, (modular) exponentiation, and inverse exponentiation, over finite fields. Considering these operations are used so heavily in constructing a ZKP, their modularity and efficiency must be implemented to suffice for any use case. <cit.>

In elliptic curve cryptography, an elliptic curve is typically defined over a prime field of a specific order denoted as F_q. The elliptic curve group (E(F_q)) comprises the subgroup of points within the field that lie on the curve, including a distinguished point at infinity. While some SNARKs function over elliptic curves without necessitating pairings, others rely on pairings and thus necessitate pairing-friendly elliptic curves. Pairings, a fundamental operation in cryptographic protocols, involve taking an element from the first group (G_1) and another element from the second group (G_2) to compute an element in the target group (G_T), typically denoted as e(P, Q), where P belongs to G_1 and Q belongs to G_2. Efficient implementation of pairings, scalar multiplication, and multi-scalar multiplication (MSM) over pairing-friendly elliptic curves is essential for achieving computational efficiency. Therefore, prioritizing the efficient implementation of these operations is crucial for optimizing the performance of cryptographic protocols relying on pairing-friendly elliptic curves.<cit.>

To facilitate proof verification, ZKP frameworks often include the specification of cryptographic primitives within their design at the cost of the core SNARK implementation's efficiency, as mentioned above. However, not all computations conform to arithmetic modulo p, necessitating the development of circuits for non-native field operations. For instance, verifying elliptic-curve-based cryptographic primitives, such as ECDSA signatures, requires computations over a different field, such as ℤ_q, which SNARKs do not natively support. Additionally, SNARKs often exhibit inefficiencies when dealing with traditional hash algorithms and signature schemes, like SHA-2 and ECDSA. To address this, the community has proposed SNARK-friendly alternatives, such as Poseidon Hash, Keccak Hash, Pedersen Hash, MIMC Hash, and Ed25519 (EdDSA signature), which are specifically optimized for use within SNARKs. Despite the benefits of utilizing SNARK-optimized primitives, practical applications often necessitate CPU-optimized primitives due to constraints in non-native field arithmetic. For example, some applications require the verification of ECDSA signatures, which involves non-native field arithmetic, leading to numerous constraints that increase the complexity and verification time of the proof. <cit.>

By writing these building blocks piece by piece, researchers and developers can create SNARKs across diverse settings, thus facilitating informed decision-making and enhancing the practical utility of SNARK-based cryptographic protocols.





  §.§.§ Applications


Arkworks <cit.> is a Rust ecosystem tailored for zkSNARK programming, offering a set of libraries to streamline zkSNARK application development. These libraries implement essential components, including generic finite fields and R1CS constraints, enabling developers to integrate zkSNARK functionalities into their applications seamlessly. Arkworks also provides interfaces for various purposes, such as defining interfaces for SNARKs and relations (e.g., R1CS, AIR) and offering SNARK proving systems like Groth16 and Marlin. Further, the ecosystem includes tools for circuit building and algebraic operations for finite fields and elliptic curves, empowering developers to implement zkSNARKs in their projects efficiently.

Gnark <cit.> is a library that enables developers to design circuits using the programming language Go. It employs a versatile API and command line interface to accomplish the ZKP process in a familar way to developers. The two proving schemes that Gnark supports are Groth16 and Plonk, along with a variety of elliptic curves for developers to choose ranging such as BN254, BLS12-381, and BLS12-377. A core focus of the Gnark library is speed of the prover and verifier, since it offers an API for both the frontend and the backend of the proving process. The standard library of Gnark implements common functions such as the MiMC hash function, EdDSA signature verification, Merkle proof verification, and a generalized zk-SNARK verifier. The performance of circuits written in Gnark can be analyzed using the in suite profiling tools available within the library. 

CirC <cit.> is a project dedicated to compiler infrastructure for cryptosystems and verification. It focuses on cryptographic tools such as proof systems, multi-party computation, and fully homomorphic encryption, typically applied to computations expressed as systems of arithmetic constraints. These applications require compilers that can translate high-level programming languages (e.g., C) into such constraints. CirC aims to provide a shared infrastructure for building constraint compilers, offering a valuable resource across various applications. These compilers can translate code into a Rank-1 Constraint System (R1CS), enabling efficient implementation of cryptographic protocols and verification mechanisms. Circify simplifies certain aspects of supporting a new language by transforming stateful programs with complex control flow into flat circuits. However, it does not address language-specific features like type-checking and namespacing. Circify supports various frontends, including C, ZoKrates <cit.> (Z#) and Circom. This flexibility allows developers to choose or build the frontend that best suits their needs while benefiting from Circify's capabilities in managing program transformations for cryptographic applications. 

The TypeScript library O1JS <cit.> is designed to cater to users with a web development background, offering a user-friendly approach to writing ZK programs and smart contracts for the Mina <cit.> blockchain. It is described as “an embedded DSL” and is executed as normal Typescript. This library permits developers to write arbitrary ZK programs utilizing many built-in provable operations, including basic arithmetic, hashing, signatures, boolean operations, and comparators. With o1js, developers can create zkApps on Mina, smart contracts that execute client-side and handle private inputs. The entire o1js framework is packaged as a single TypeScript library, making it accessible in web browsers and Node.js environments, thus allowing developers to integrate their ZK programs into existing web applications. 

Various implementations of Zcash's Halo2 <cit.> proving system, such as those by Axiom and the Ethereum Foundation, provide fundamental primitives for writing zero-knowledge proof circuits. The proving system involves several stages, from committing to polynomials that encode the main components of the circuit, including cell assignments, permuted values, products for lookup arguments, and equality constraint permutations. The next step is constructing the vanishing argument, which constrains all circuit relations to zero, including standard and custom gates, lookup argument rules, and equality constraint permutation rules. The polynomials are then evaluated at all necessary points, including relative rotations used by custom gates and vanishing argument pieces. Finally, the multipoint opening argument is constructed to ensure the consistency of evaluations with their commitments, and the inner product argument is run to create a polynomial commitment opening proof for the multipoint opening argument polynomial. Halo2 is known as a relatively low-level library with high customizability.

Nova <cit.> is a recursive SNARK that enables incrementally verifiable computation (IVC), a cryptographic primitive that allows a prover to produce a proof of correct execution of a “long-running" sequential computation in an incremental fashion. IVC allows for proofs to build on top of each other in an efficient fashion that speeds up the entire proving and verification process. Nova is implemented in Rust and supports three curve cycles: Pallas/Vesta, BN254/Grumpkin, and secp/secq. It supports frontends such as Bellpepper <cit.>, and its native APIs accept circuits expressed with Bellpepper, Circom, and Lurk.




 §.§ Hardware Acceleration




  §.§.§ Motivation and Definition


Historically, the speed and memory requirements of ZK proof generation have limited their applicability. The required computations inside of a ZKP, such as hashing, multi-scalar multiplications, and fast-fourier transforms, create a burden for each use case. To reduce the overhead required by ZKPs, various projects have emerged to enhance the performance of ZKPs and their potential implementations.



  §.§.§ Methodology


Hardware acceleration is defined as the use of optimizing or creating dedicated computer components to improve the performance and efficiency of a specific operation. The main instruments used for this acceleration such as field programmable gate arrays (FPGAs), graphics processing units (GPUs), and application-specific integrated circuits (ASICs) in the ZK world. The limiting factors of hardware acceleration projects are the memory capacity, speed of memory access, speed of data transfer, and speed of arithmetic units. In proof systems where both number theoretic transforms (NTTs) and multi-scalar multiplications (MSMs) are used, the majority of the proof generation time is spent on MSMs, with NTTs accounting for the remainder. Both MSMs and NTTs present performance challenges that can be addressed in several ways. MSMs can be executed on multiple threads, allowing for parallel processing. However, when dealing with large vectors of elements, the multiplications may still be slow and demand considerable memory resources. Additionally, MSMs face scalability issues and can remain sluggish even when extensively parallelized. On the other hand, NTTs involve frequent data shuffling during the algorithm, making them difficult to distribute across a computing cluster. They also require significant bandwidth when run on hardware due to the need to load and unload elements from large datasets. For instance, if a hardware chip has 16GB of memory or less, running NTTs on a dataset larger than 100GB would necessitate data transfers over the network, significantly slowing down the operations <cit.>.

Both MSM and NTT can be accelerated on GPUs, particularly MSM through an algorithm called `Pippenger'. This process involves rewriting the computationally intensive tasks from the CPU to the GPU using CUDA or OpenCL, allowing the code to be compiled and executed directly on the GPU. For finer-grained acceleration, developers can optimize memory usage by maximizing the use of fast memory and minimizing slow-access memory to reduce costly data transfers, especially between the CPU and GPU. Additionally, optimizing execution configuration by balancing work across multiprocessors, building concurrent kernels, and allocating resources judiciously can maximize hardware utilization. The goal is to parallelize the entire workflow, minimizing sequential execution where different parts depend on each other’s results. Open-source implementations allow developers to quickly start their modifications <cit.>.

FPGAs, or field-programmable gate arrays, offer programmable hardware fabric that can be reconfigured multiple times, cutting manufacturing costs compared to ASICs and providing greater flexibility in hardware resource usage than GPUs. Although optimizing NTTs on GPUs is achievable, frequent data shuffling can lead to significant communication overhead between the GPU and CPU. By implementing the logic directly into the circuit design, FPGAs can potentially perform the task faster. Most open-source implementations for zero-knowledge proofs are written in Rust due to its memory safety and cross-platform compatibility. However, FPGA development tools are typically adapted to C/C++, requiring teams to translate these implementations <cit.>.

GPUs offer fast development times with well-documented frameworks like CUDA and OpenCL and are readily available and cost-effective. However, GPUs are power-hungry, even when exploiting data and thread-level parallelism. In contrast, FPGAs have a more complex development cycle, requiring specialized engineers but allowing for low-level optimizations and providing lower latency, especially for large data streams. FPGAs are more expensive and less readily available than GPUs <cit.>.

ASICs, or application-specific integrated circuits, are customized for particular uses and are permanently etched into silicon, making the design and manufacturing process much more complex and time-consuming compared to FPGAs. Despite this, advancements such as Leo's new integrated chip for accelerated proof generation demonstrate ongoing developments in this area. ASICs are believed to be the most promising hardware acceleration; however, they still have major barriers to entry. Programmability and logic modifications are difficult on ASICS as they possess write-once business logic, necessitating a complete rebuild of the system for any modifications. Conversely, FPGAs and GPUs can be reprogrammed multiple times, allowing the same hardware to be used across various projects with different proof systems or updates. This reprogrammability makes FPGAs a more versatile alternative compared to ASICs. Additionally, the time required for ASIC design, production, and deployment usually spans 12 to 18 months or more <cit.>.



  §.§.§ Applications


Ingonyama <cit.> is a hardware acceleration company that integrates chip design with mathematics and advanced algorithms to enhance the performance of compute-intensive cryptography. They maintain a library called ICICLE, a cryptography library for ZKPs using GPUs. ICICLE implements various cryptographic primitives such as elliptic curve (EC) operations, multi-scalar multiplication (MSM), number theoretic transform (NTT), and the Poseidon hash on GPUs. The Polynomial API offers a framework for polynomial operations for developer convenience. Additionally, ICICLE has bindings for Rust and Golang and integrates with projects like Gnark and EZKL. It can also be run in Google Colab. Ingonyama is advancing for a zero-knowledge processing unit (ZPU) defined as “a versatile and programmable hardware accelerator, designed to address the emerging needs of ZKP processing.”

Cysic <cit.> is a ZK accelerator focused on developing ASICs and their accelerated zkVM. The system architecture features an executor responsible for executing programs, hardware for controlling and distributing segments, and a configurable number of specialized chips to generate ZK proofs for each segment program. Leveraging its expertise in ASIC design and GPU engineering, Cysic aims to overcome challenges by offering ZK compute-as-a-service to various ZK projects. They aim to produce ASICs that specifically target MSMs, NTTs, and other general operations, while maintaining flexibility to adapt to many proving systems. Cysic's ongoing efforts concentrate on specialized ASIC design for real-time ZK proof generation.

Fabric Cryptography <cit.> introduces The Fabric Verifiable Processing Unit (VPU), a processor designed for cryptography applications ranging from ZKP to FHE. The VPU features a custom instruction set architecture tailored for next-generation cryptography, including ZKP, FHE, MPC, and other algorithms. It offers acceleration for MSM, NTT, polynomial evaluation, as well as Poseidon (1, 2), Blake, and other hash functions. The VPU supports multiprecision vector lanes up to 384-bit and includes a RISC-V core for enhanced programmability. It supports PCIe 4.0 x16 lanes, providing up to 256 Gbps per chip, and is equipped with high-bandwidth DRAM. In addition, Fabric Cryptography offers a PCIe card featuring 3x FC1000 chips for parallel ZK proof generation, a PCIe interface for comprehensive on-chip proving and encryption, and DRAM for recursive ZK proof generation and mining workloads. They also provide server systems and data centers to support larger workloads.

Irreducible <cit.> offers proving as a service designed for scalability, powered by FPGA-accelerated server clusters. Irreducible supports popular proof systems such as Plonky2 and Polygon zkEVM, with plans to support next-generation systems like Binius and Plonky3. Their FPGA-accelerated server clusters are specifically designed for cryptographic computation at scale. By connecting their FPGAs directly using AMD’s high-speed Aurora protocol, they minimize unnecessary data transfers between the CPU and FPGAs. Operating independently of public cloud infrastructure providers like Amazon Web Services and Google Cloud Platform provides redundancy essential for the decentralized networks they support. Irreducible also features a fully-pipelined FPGA architecture for ZKP-friendly Merkle trees using the Poseidon hash and NTT.

Supranational <cit.> offers hardware-accelerated cryptography for verifiable and confidential computing. They provide BLST, an IETF-compliant BLS12-381 signature library focused on security and performance. They also implement a simple API for generating VDF and SNARK proofs, powered by fast, open-source implementations running on a high-availability cloud. Additionally, Supranational is developing Sppark, an arbitrary-precision arithmetic accelerator for cryptographic operations, including VDFs, SNARKs, polynomial commitments, and accumulators.




§ BLOCKCHAIN APPLICATIONS
 





 §.§ Layer 1 Blockchains







  §.§.§ Motivation and Definition


Layer 1 blockchains, such as Ethereum and Bitcoin, are foundational blockchain networks that provide a transparent and immutable ledger for data storage. However, these platforms face challenges in privacy and scalability. The emergence of zero-knowledge proofs (ZKPs) has induced the development of novel Layer 1 solutions that prioritize privacy and data efficiency. These blockchains integrate ZKPs directly into their base layers, offering a dual advantage: enhanced privacy through transaction concealment and improved scalability via data compression, as illustrated in Figure <ref>. The primary motivation for ZKP-based Layer 1 blockchain is to bridge the gap between the inherent transparency of conventional blockchains with the increasing demand for data privacy and efficient on-chain data management.



  §.§.§ Methodology

Layer-1 blockchains utilize ZKPs to obscure critical transaction details, such as the identities of parties involved and the transaction amounts. This concealment is achieved through advanced cryptographic techniques, including zk-SNARKs or zk-STARKs, that validate transactions without revealing their underlying data. To address scalability challenges, ZKP-based Layer-1 blockchains employ state compression. This technique utilizes ZKPs to create compact proofs that validate large sets of transactions or state transitions, thereby reducing the data volume required on-chain. In these networks, participating nodes are responsible for generating and verifying ZKPs. This ensures transaction integrity while maintaining privacy. The consensus mechanisms of these blockchains are uniquely designed to incorporate ZKP validation. This integration ensures that only transactions authenticated through ZKPs are confirmed and appended to the blockchain.



  §.§.§ Applications




As a pioneering Layer 1 blockchain, ZCash <cit.> utilizes zk-SNARKs to offer private transactions, where the details of the sender, receiver, and transaction amounts are encrypted. In ZCash, zk-SNARKs enable the encryption of transaction data, ensuring the anonymity of both the sender and receiver, as well as the confidentiality of the transaction amount. This mechanism allows the network to validate transactions without disclosing the underlying data, thereby preserving the privacy of users. ZCash's implementation of zk-SNARKs is notable for its efficiency, allowing for the verification of transactions in a matter of milliseconds, which is a significant advancement over other cryptographic techniques that were more computationally intensive. The ZCash blockchain leverages a novel cryptographic method known as a “shielded transaction," where the transaction metadata is encrypted, and zk-SNARKs are used to prove that the transaction does not violate the network's consensus rules. This approach enables a high degree of privacy while maintaining the integrity and security of the blockchain. ZCash offers optional privacy features allowing users to choose between shielded and transparent transactions, unlike Aleo and Monero, where privacy is mandatory for all transactions as depicted in Table <ref>.  

Aleo <cit.> is a distinctive Layer 1 blockchain platform that employs zero-knowledge proofs to enhance privacy and scalability in decentralized applications (dApps). It is designed to facilitate the development and deployment of private applications on the blockchain. Aleo achieves this with the help of a unique framework for constructing dApps that can perform computations in a private and verifiable manner. Its adoption of zk-SNARKs based systems allows developers to create applications where users can interact and transact without revealing sensitive information. This system empowers users to maintain control over their data, ensuring privacy and security in their interactions on the blockchain. Aleo's approach to blockchain architecture is focused on providing a scalable solution that addresses the common limitations associated with public blockchains, such as privacy concerns and throughput bottlenecks.

The Mina Protocol <cit.> is an innovative Layer 1 blockchain that introduces a unique approach to scalability and privacy through the use of recursive zk-SNARKs. This innovative protocol is designed to maintain the succinctness of a blockchain by keeping the network size constant ( 22kB) regardless of the total number of transactions processed. This is achieved through the recursive composition of zk-SNARKs, which allows each new block to contain proof of the validity of the entire blockchain history. As a result, the Mina Protocol maintains a drastically reduced blockchain size compared to traditional blockchains, enhancing scalability and usability.



 §.§ Layer 2 Scaling
 



  §.§.§ Motivation and Definition

As aforementioned, ZKP can be used for the property of data succinctness, especially when it comes to blockchain validity proofs. A significant pain point of blockchains is the scarcity and cost of block space, which can be solved using Layer 2 scaling solutions such as rollups. The most prominent types of rollups are optimistic rollups and ZK rollups, but the latter will be our main focus. In ZK rollups, zero-knowledge proofs are used to succinctly prove the validity of state changes to a Layer 1 blockchain without requiring validator nodes on a Layer 1 chain to execute those transactions. In essence, the Layer 2 rollup becomes a cheap modular execution layer that benefits from the security and decentralization of Layer 1, and this enables blockchains to scale by significantly reducing usage costs. Some ZK rollups can also provide privacy-preserving properties using zero-knowledge proofs.



  §.§.§ Methodology


In Layer 2 rollups <cit.> (all of which achieve finality on Ethereum), computation is handled outside of Layer 1, and only state changes, deposits, and withdrawals are posted to Layer 1 through the rollup smart contract. This Layer 1 smart contract contains and maintains a state root, which is the Merkle tree root of the state of the rollup, including accounts and balances. A rollup sequencer is an entity, which could range from a single server to a decentralized network of nodes, which orders transactions,  produces L2 blocks, and adds rollup transactions to the ZK-rollup contract with a ZK validity proof. The sequencer publishes a batch of highly compressed transactions as well as the previous state root and the new state root after processing all transactions in the batch. Using the ZK validity proof provided by the sequencer, the rollup contract checks that the new state root is valid, then swaps the old root for the new one. The transaction batches published by sequencers are written to Ethereum in the form of encoded function calls, stored either in the calldata of the EVM, which is a data area used to pass arguments to a function and does not modify the blockchain's state, or in temporary data storage locations called blobs (post-EIP-4844). This serves as a cheap way to store data on-chain, making it possible for individuals to re-construct the state of the rollup using such compressed transactions. Since the Layer 1 rollup contract can quickly verify a zk-SNARK or zk-STARK proof on any amount of large computation, computation is almost fully offloaded to the Layer 2. Through these methodologies, ZK rollups minimize the space and computation restraints of Layer 1 Ethereum, which simply validates state changes and provides inherent decentralization and security <cit.>.



Because Layer 2 scaling solutions are built on top of smart contract-based blockchains, specifically Ethereum, rollups need to provide proofs for state transitions on the Ethereum Virtual Machine (EVM), which is Ethereum's Turing-complete computation engine. Since ZK-rollups must attest to the correctness of computations with ZKP before posting batches to Layer 1, they must go through extra steps in code execution which the EVM does not do. Rather than loading smart contract bytecode into the execution layer and simply posting the result of those computations, ZK-rollups must generate validity proofs for each transaction's state transition. 

Because EVM opcodes are designed for general-purpose computations, proving EVM computations in ZK circuits is too resource intensive and complex. Consequently, it is very difficult to ensure EVM-compatibility in ZK rollups, resulting in varying architectural designs:


    
  * zkEVM: A zkEVM is a solution which embeds zero-knowledge proofs into EVM smart contract execution by recreating existing EVM opcodes for proving in circuits. A zkEVM computes state transitions just like the typical EVM, however it creates ZK validity proofs to verify the correctness at every operation, including state changes and computations.
    
  * Custom VMs: Some approaches involve creating new high-level or intermediate languages and virtual machines that are more amenable to ZK proofs but can still support EVM-like operations.


zkEVMs allow easier execution of Solidity smart contracts, while custom VMs may require developers to write smart contracts in some other smart contract language or modify their existing EVM-based implementations due to ZK limitations.



  §.§.§ Applications
 

zkSync Era <cit.> is a zkEVM rollup developed by Matter Labs. Identical to the previously mentioned methodology, zkSync Era utilizes ZK-SNARKs to provide validity proofs of off-chain computation. Smart contracts can be written in Solidity or Vyper and called using the same clients as other EVM-compatible chains, thus making zkSync EVM-compatible. The zksolc compiler used on Era generates bytecode with optimizations in order to make operations more amenable to proof generation, using LLVM as an intermediate representation before executing zkEVM assembly code. Consequently, there are multiple differences from Ethereum, with many EVM opcodes having modified implementation rules. zkSync Era is the first EVM-compatible chain to implement native account abstraction, which is a system of smart-contract-based accounts with arbitrary logic, first introduced in EIP-4337. Thus, every user account on zkSync Era can utilize smart accounts with their existing externally owned account (EOA). 

Matter labs also provides an open framework for deploying additional modular chains similar to zkSync Era called the ZK stack <cit.>. A modular chain from the ZK stack, called a hyperchain, runs a separate instance of the zkSync zkEVM and settles transactions on Ethereum's Layer 1. Hyperchains are linked via Hyperbridges, ensuring asset transfer capabilities. While anyone can deploy Hyperchains, ensuring trust and full interoperability requires using the zkEVM engine from the ZK Stack, which powers zkSync Era. This uniformity in ZKP circuits across Hyperchains guarantees inherited security from Layer 1 without additional trust assumptions. Hyperchains implement a modular approach, allowing developers to choose or create their own blockchain components, except for the zkEVM core. Various options for sequencing transactions are available, ranging from centralized to decentralized sequencers, and even external protocols for customizing Hyperchain sequencing. Each Hyperchain can also manage its data availability (DA) policy, for example a “Validium" architecture which stores state data off-chain rather than posting the calldata to L1, providing flexibility tailored to specific needs.

Polygon zkEVM <cit.>, built by Polygon Labs, aims to offer full EVM-equivalency, with no separate compiler. Thus, ZK proving circuits verify most EVM opcodes as they are, with a few carrying minor differences that do not impact the developer experience. Because of this inherent equivalency and support of EVM opcodes, developers can deploy their existing L1 smart contracts directly to the Polygon zkEVM rollup, with no necessary tweaks. Much like the zkSync stack, Polygon has the Chain Development Kit (CDK) <cit.>, which allows developers to deploy application-specific chains as validiums using the Polygon zkEVM. 

Scroll <cit.> represents another approach within the zkEVM landscape, focusing on EVM compatibility with necessary adaptations for zero-knowledge proofs. Scroll's zkEVM modifies certain EVM opcode behaviors to fit the ZK-proof framework while maintaining the ability for developers to write and deploy Solidity contracts, with no custom compiler. Although these modifications alter how some operations are handled compared to Ethereum, they are clearly documented, ensuring that developers can account for these changes during smart contract development. The tailored modifications aim to preserve the core experience of Ethereum smart contract interaction within the constraints of a ZK rollup environment.

Linea's zkEVM <cit.>, developed by ConsenSys for the Linea L2, closely mirrors the Polygon zkEVM, providing an EVM-equivalent experience without requiring a custom compiler. Supporting Solidity compilers, Linea enables developers to use well-known Ethereum tools like Hardhat and Foundry seamlessly. This compatibility eases the developer transition to Linea, with minor considerations for Solidity version compatibility. Additionally, Linea integrates the Canonical Message Service, a system allowing arbitrary data transfer between Linea and other networks, enhancing cross-chain communication and utility.

StarkNet <cit.>, built by StarkWare, stands out as a unique ZK-rollup, fundamentally distinguished by its use of STARKs (Scalable Transparent ARguments of Knowledge), which offer quantum resistance and do not require a trusted setup, over SNARKs. Unlike other ZK-rollups, StarkNet utilizes Cairo – a specialized programming language – instead of Solidity. Cairo programs are compiled into Sierra, a safe intermediate representation, and subsequently into Cairo assembly (Casm) for execution by the StarkNet OS virtual machine. Use of the Cairo programming language and this two-step compilation process is necessary to bridge the gap between smart contract execution and the polynomial constraints of STARK proofs, which in turn validate StarkNet's block execution. Like zkSync, StarkNet's native account abstraction (AA) sets it apart by making all accounts ERC-4337 smart accounts with no externally owned accounts (EOAs) <cit.>.

StarkEx <cit.>, also developed by StarkWare, is a specialized Layer 2 scalability service utilizing STARK proofs for high-throughput, low-latency applications on Ethereum. Unlike StarkNet, StarkEx is not a standalone blockchain, but a service specifically tailored for certain use cases like decentralized exchanges (DEXs) and NFT platforms. It allows these applications to define their own logic off-chain and post transactions to the service, which then generates STARK proofs attesting to the validity of transaction batches. These proofs are submitted and verified on L1. StarkEx also offers various data availability modes - ZK-Rollup, Validium, and Volition. This flexibility allows applications to optimize with any mix of on-chain and off-chain components.

Aztec Network <cit.> is a Layer 2 rollup which focuses on privacy preservation through the Noir programming language. Noir, a Rust-based DSL for building ZK applications, simplifies the creation of ZKPs by abstracting the cryptographic process while retaining the robustness of circuit-building languages <cit.>. Smart contracts in Aztec, utilizing Noir, can have both public and private elements. These contracts are defined as sets of functions, both public and private, written as Noir circuits. Each function, representing a zk-SNARK verification key, operates on the contract's public and private state. Noir's compilation process is unique: it doesn't compile directly to circuits but to an Abstract Circuit Intermediate Representation (ACIR), which can then be compiled into an arithmetic circuit or R1CS, depending on the proving system being targeted <cit.>. In Aztec, the sequencer aggregates transactions into a block, generates state update proofs, and posts them to the Ethereum rollup contract. This architecture, while similar to other Layer 2 networks, differs notably in its handling of private state. The private execution environment within Aztec safeguards sensitive operations and data, ensuring that private information remains confidential <cit.>. This architecture is outlined in Figure <ref>.





 §.§ Blockchain Interoperability




  §.§.§ Motivation and Definition
 With a highly fragmented landscape of different blockchain technologies, including Layer 1 chains and additional modular layers built atop them, there has arisen the need for seamless composability among blockchains. For example, a significant pain point in blockchain user experience is the struggle of trying to bridge tokenized assets from one blockchain to another. This problem extends past cross-chain transactions and financial asset liquidity, as it also concerns general message passing and data storage across fragmented blockchain networks. Even for Layer 2 rollups built atop the same Layer 1, each rollup's state is a separate data moat, which results in the same fragmentation problem even in the case of shared transaction finality and consensus security. Cross-chain composability, also known as blockchain interoperability, has many innovative solutions, including those that utilize ZKP for succinct verifiable computation.



  §.§.§ Methodology
 Zero-knowledge proofs are used to verify the occurrence of a state change or block execution on one chain to another chain. This property allows protocol developers to coordinate application logic across multiple blockchains, letting users instantly transact and pass data between different networks. Typically, there is some middleware that generates the validity proofs to be verified on the receiving blockchain, where a smart contract will verify the proof and execute corresponding application logic, according to the application's specification. For example, asset bridges lock up tokens on one chain and mint them on another, allowing users to transfer liquidity between chains. Further use cases enable cross-chain DAO voting, Non-Fungible-Tokens (NFTs), and more. 



  §.§.§ Applications
 

The zkBridge protocol <cit.>, originally published as academic research and later implemented by Polyhedra<cit.>, operates through a modular design that separates application-specific logic from the core functionality of relaying block headers. This core functionality is provided by a block header relay network, which is trusted only for liveness. This network relays block headers of one blockchain along with zk-SNARK correctness proofs to an updater contract on another blockchain. The updater contract is responsible for maintaining a list of recent block headers from the sender chain, verifying proofs submitted by relay nodes, and updating the list accordingly. On the receiver blockchain, the updater contract provides an application-agnostic API that enables application smart contracts to obtain the latest block headers of the sender blockchain. This enables them to build application-specific logic on top of this information. Applications utilizing zkBridge generally deploy a pair of contracts: a sender contract on blockchain 1 and a receiver contract on blockchain 2. The receiver contract can call the updater contract to access block headers of blockchain 1, which it can then use to execute application-specific tasks. 



Telepathy<cit.> is an interoperability protocol that allows arbitrary message passing between Ethereum and other chains. For developers that want to send a cross-chain transaction, they call the Telepathy router contract on Ethereum and must wait until the transaction reaches finality. To verify that a block has been finalized, an off-chain component called the Telepathy operator utilizes a zk-SNARK that proves the block header has signatures from a large percentage Ethereum validators. This proof is passed to the Telepathy light client contract on the destination chain, which verifies proofs and provides access to Ethereum's block headers. The Telepathy relayer accesses that light client data and generates a Merkle proof on the block to verify that the transaction exists and reached finality on Ethereum. This Merkle proof is passed to the Telepathy receiver contract, which verifies it and relays the smart contract call to the receiving contract on the destination chain, which executes the corresponding application logic as specified by the developer.



 §.§ Blockchain Storage



  §.§.§ Motivation and Definition
Blockchain storage is essentially a way to save data in a decentralized network using the properties of the blockchain. In order to protect the saved data, blockchain uses data structures such as Merkel trees and Merkel Patricia trees. What is special about these data structures is that specific proofs can be constructed to show that a particular piece of data is contained in the structure and that once a single piece of data is changed, the entire structure changes drastically as well. This essential property of blockchain ensures data integrity and invariance. However, as the quantity of data contained in a proof rises, so does the size of the proof. As a result, the cost of validating such proofs on the chain rises, rendering ordinary inclusion proofs economically unsustainable in most circumstances. A more scalable option is now preferred, whereby the blockchain does not have to store large amounts of data but only smaller references to data stored in off-chain platforms. Zero-knowledge proofs make this possible: data and computations can be stored off-chain, and ZK Proofs can be used to communicate a summary of these operations to the main chain concisely, efficiently, and without trust.



  §.§.§ Methodology
Zero-knowledge proofs could be used to minimize the cost of activities associated with verifying the inclusion of data in massive datasets and to validate that the procedure was completed correctly. The prover carries out the necessary calculation and generates proof that proves its correctness. The verifier's job is to validate the proof's validity without redoing the whole analysis. Because of this feature, the prover only requires access to a subset of the data, such as some nodes of a Merkle tree, rather than the entire dataset. This paradigm shift is crucial because it offers a practical solution to lower the costs of employing proofs of inclusion in smart contracts, particularly when massive datasets are involved.



  §.§.§ Applications
 To prove the data is indeed stored in the blockchain, Herodotus <cit.> gives a new method called Storage Proofs to enable on-chain data access. It is essentially an on-chain accumulator that uses cryptographic means to improve access and verification of historical data on the Ether blockchain. The solution utilizes StarkWare's STARK proofs <cit.>. This allows users to validate data from any point on the Ethernet blockchain without the need for a third party. It combines proofs of inclusion (for verifying the existence of data) and proofs of computation (for proving the execution of multi-step workflows). These proofs are essential for verifying the integrity and correctness of one or more components of a large data set, thus ensuring that the data has not only been stored, but also remains untampered with and accurate over time.

Filecoin <cit.> has deployed a considerable zk-SNARK network, which uses the unused hard drive space of users around the world to store files. Using zk-SNARKs to generate the proofs, the resulting proofs are small, and the verification process is swift (and thus, cheap). For example, proofs that typically would require hundreds of kilobytes to verify can instead be compressed to just 192 bytes with zk-SNARKs. This significant reduction in proof size not only accelerates the verification process but also reduces the computational and financial costs associated with it, making blockchain storage both more scalable and accessible.



 §.§ Smart Contract/Transaction Privacy




  §.§.§ Motivation and Definition
 While creating entirely new blockchain networks or rollups serves as a solution for privacy demands, there are also ZKP-based approaches which offer selective privacy for certain decentralized applications (dApps) and transactions on existing, transparent blockchains such as Ethereum. These applications could be utilized in cases where users want to make certain actions or information private, but continue to use an existing blockchain network. These applications exist on the smart contract execution layer of a blockchain, where dApps are designed to utilize ZKP to enable private transactions in certain contexts, such as transaction mixing, for example. This application domain can be defined as Smart Contract/Transaction Privacy, which mostly benefits from the privacy prong of ZK.



  §.§.§ Methodology
 The core methodology in ZKP smart contract privacy centers around on-chain proof verification within a smart contract framework. Proof generation typically occurs off-chain due to its computationally intensive nature and the need for privacy in computation or the processing of sensitive data. Once a proof is generated, it is submitted to the blockchain. The contract assesses the proof against the protocol's predefined rules, and then acts accordingly if deemed valid, which could involve updating the blockchain's state, executing transactions, or any other protocol-specific actions.



  §.§.§ Applications
 


Tornado Cash <cit.> employs zero-knowledge proofs for enabling transaction privacy and mixing on Ethereum. Its core mechanism revolves around depositing Ether into a smart contract and withdrawing it in a manner that severs the link between the source and destination. The protocol utilizes zk-SNARKs to prove the legitimacy of withdrawals without revealing the original deposit's details. Users deposit Ether, generating a cryptographic commitment added to a Merkle tree within the contract. For withdrawal, a user generates a zk-SNARK proof that they own a leaf in this tree without revealing which one. This proof, once verified by the smart contract, allows the withdrawal of Ether to a new address, ensuring that the transaction's privacy is maintained by obscuring the link between the deposit and withdrawal addresses. This method effectively creates a privacy layer, allowing users to transact anonymously within the public Ethereum blockchain.

Due to its rampant use for illicit financial transactions such as money laundering, Tornado Cash has been heavily sanctioned and banned in countries like the US. This has given rise to the research problem of regulatory-compliant privacy solutions, which has been implemented in the Privacy Pools project, as delineated in <cit.>. Privacy Pools extends the usage of zk-SNARKs in other privacy solutions like Zcash and Tornado Cash. Rather than simply generating a ZKP to prove that a withdrawal attempt is linked to a specific deposit, users prove membership in a specific association set, which is a collection of transaction references, represented as a Merkle tree, from which a user's funds could have originated. Users define their set by providing the Merkle root as a public input. When withdrawing funds, the user does not directly prove a link to a specific transaction. Instead, they utilize zk-SNARKs to generate proofs that validate their funds' origin from within this predefined, public set of transactions. This approach allows users to demonstrate a connection to a pool of transactions without revealing the exact source, maintaining privacy while introducing an element of transparency.

The use of association sets in Privacy Pools addresses the challenge of aligning transaction privacy with regulatory compliance. By proving membership in a specific association set, users demonstrate that their funds originate from a group of transactions that are not flagged as high-risk or associated with illicit activities.

Penumbra <cit.> is a fully private proof-of-stake network and decentralized exchange within the Cosmos ecosystem, offering a unique approach to transaction privacy and cross-blockchain interoperability using zero-knowledge proofs. Penumbra connects to the Cosmos blockchain ecosystem through IBC (the inter-blockchain communication protocol) and maintains all value in a multi-asset shielded pool, inspired by the Zcash Sapling design. This allows for private transactions in any IBC-compatible asset. All transactions on Penumbra are private by default, enabled by zk-SNARKS which validate the correctness and legitimacy of transactions but shield the sender, receiver, and amount. Penumbra's decentralized exchange, called ZSwap, supports sealed-bid batch auctions and concentrated liquidity similar to Uniswap v3. This architecture prevents frontrunning and ensures that only the net flow across a pair of assets is revealed in each block. For cryptographic primitives, Penumbra utilizes BLS12-377 as the proving curve, which is compatible with the Groth16 proving system used. Penumbra may change to PLONK in the future.

A novel privacy problem exists within the space of on-chain decentralized autonomous organizations (DAOs), which are blockchain-based governance systems powered by smart contracts. Because of the transparent nature of public blockchains, DAO treasuries are completely public, which is a big issue for certain types of auctions. In a blog and research project by Griffin Dunaif and Dan Boneh, the authors design a system for a private DAO protocol utilizing ZKP <cit.>. The protocol utilizes a master contract deployed on the Ethereum network to manage multiple DAOs. This contract allows anyone to send funds to a DAO, but only the DAO manager can withdraw them.

The life cycle of a DAO in this system comprises three steps: creation, deposit, and withdrawal. During DAO creation, the manager establishes the DAO without any on-chain transactions, and posts a Schnorr public key on the DAO website. To contribute funds to the DAO, users compute the Merkle tree leaf using the DAO public key, in which the deposit is recorded in the master contract. The DAO manager is able to privately monitor deposits and keep track of the DAO treasury using their secret key. When withdrawing funds, the DAO manager again uses this secret key within a SNARK proof to show that a specific batch of deposit leaves in the Merkle tree belong to the DAO, without publicly revealing the secret key. After verifying the proof, the master contract releases the withdrawal amount to the DAO manager.

We have seen niche-specific privacy dApps, but there also exist entirely private smart contract frameworks for private blockchain applications. One example is Hawk <cit.>, which uses off-chain computation to conceal private portions of a smart contract. In Hawk, the programmer writes a smart contract with defined public and private components. The Hawk compiler will subsequently split the computation into pieces, where the private portion of the contract ϕ-priv is executed off-chain and handles sensitive data and computations. This off-chain execution is managed by a trusted party, known as the manager, who can see the users' inputs and is expected to not disclose them. The manager's role is to perform the private computations and generate a ZK-SNARK attesting to the correctness of these computations without revealing any sensitive data inputs. The proofs are then verified on-chain, ensuring the integrity of the private computations while keeping them hidden from the public blockchain. The public portion of the contract ϕ-pub, which executes on the blockchain, handles non-sensitive operations and provides transparency where necessary, but it does not deal directly with private data or currency transactions.

Mina, the previously mentioned Layer-1 blockchain, also provides a privacy-preserving smart contract framework called zkApps <cit.>. Mina zkApps are developed using the o1js TypeScript library and the Mina zkApp CLI, and comprise of two main components: a smart contract written with o1js, and a user interface (UI) for interaction. Upon zkApp interaction, the smart contract's code is executed locally in the user's web browser, where it generates a ZK-SNARK proof. This setup allows users to input data into the zkApp, which could be either private or public. Private data remains unseen by the blockchain, while public data may be stored on-chain or off-chain, depending on the zkApp's design. The prover function within the smart contract generates the SNARK proofs, maintaining user privacy by ensuring that sensitive data is processed locally and not disclosed on the blockchain. Once a user decides to submit a transaction to the chain, the transaction, containing the ZKP and associated state updates, is sent to the Mina network. The network verifies that the proof meets all constraints defined in the prover function. The state of a zkApp can be either on-chain or off-chain. On-chain state is stored directly on the Mina blockchain and offers limited storage space, while off-chain state refers to larger data stored elsewhere, like in external storage systems such as IPFS. In scenarios where off-chain storage is used, the zkApp updates an on-chain Merkle tree root of some fully off-chain Merkle tree. This method ensures that the integrity of both the proof and the associated account updates is maintained, allowing the Mina network to confirm the validity of the zkApp transactions and state changes.



 §.§ Blockchain-Based Proof of Identity




  §.§.§ Motivation and Definition
 Because of the aforementioned qualities of ZKP, there exists the unique use-case of a user proving group membership or identity without revealing any sensitive information about their identity, thus marrying the imperatives of authentication and privacy. While this can be implemented outside of the blockchain context (as will be covered in the “Proof of Identity" section below), there exist many identity-proving applications using blockchain smart contracts and execution layers. This application domain can be defined as Blockchain-Based Proof of Identity, which takes advantage of privacy-preserving ZKP.



  §.§.§ Methodology
 The core methodology behind blockchain-based proof of identity systems is the use of zero-knowledge proofs to enable users to prove membership in certain identity groups or ownership of credentials without revealing the actual identity information. This is achieved through cryptographic commitments to a user's information while keeping it secret. A privacy-preserving ZK identity proof can be easily verified by an on-chain smart contract, and this can act as a private credential system secured by the blockchain and open doors to a multitude of decentralized applications, without sensitive information compromise.



  §.§.§ Applications


Semaphore is a framework for zero-knowledge signaling on Ethereum that allows users to broadcast support for an arbitrary string, without revealing their identity to anyone besides being approved to do so <cit.>. It uses Pedersen commitments to hide user identities in an incremental Merkle tree stored on-chain. Users generate zk-SNARK proofs showing that:

    
  * Their Pedersen commitment identity is valid, by proving it exists as a leaf in the incremental Merkle tree using the Merkle path.
    
  * They know the secrets behind the Pedersen commitment.
    
  * The unique, pseudorandomly derived nullifier has not been used before, preventing double-spending. 
    
  * The signal is properly authorized using an EdDSA signature verification within the circuit.

A smart contract handles logic and state management, such as adding identity commitments to the Merkle tree, updating the nullifier map, and adding successful signals to the signal map. This enables fully on-chain privacy applications with proof verification, such as anonymous voting and reputation systems <cit.>.

Semaphore can serve as a verifiable credential protocol at the base level, as it allows developers to create identities, identity groups, and use identity commitments to prove group membership. An example of a prominent project that utilizes Semaphore for verifiable credentials on Ethereum is World ID, which is the proof-of-personhood verification system for the WorldCoin protocol <cit.>. When a user creates a unique World ID from their biometric data, their ID is enrolled in a group of verified World ID users. World ID's can then be safely verified without revealing the World ID public key.

The Galxe protocol is a self-sovereign identity service centered around verifiable credentials <cit.>. It addresses the digital identity multiplicity problem by embedding numerous identity commitments into a single user credential, enabling holders to connect identities across platforms privately. Credential holders can use ZKP to selectively prove requisite information of their identity, while maintaining a pseudonym. Like Semaphore, Galxe constructs identity commitments by computing the Poseidon hash of the private secret identity and a private internal nullifier. This can then be distinguished in a zero-knowledge proof, which is verified by an on-chain smart contract and attests to the user's identity. The internal and external nullifiers generate deterministic nullifiers per verification to prevent double-spending. The current verification stack of the Galxe protocol is BabyZK, which uses the BN254 curve, Groth16 proofs and Poseidon commitments. Use cases of the Galxe protocol could include sybil-resistant reputation systems, access control, achievement aggregation, and personal data markets with privacy.

Aleo, a Layer 1 privacy blockchain mentioned in this paper above, boasts its own ZK identity verification protocol called zPass <cit.>. zPass is a straightforward implementation due to the nature of enshrined zero-knowledge proofs and private execution available in Aleo. However, zPass also enables users to obtain anonymous credentials from existing identity documents, facilitating real-world adoption without necessitating changes to the protocol. Like Galxe protocol, it allows for selective attribute disclosure, enabling users to prove identity assertions across multiple credentials.



 §.§ Supply Chain/Enterprise Blockchain Privacy






  §.§.§ Motivation and Definition
 
Supply chains and global enterprises are increasingly recognizing the transformative potential of blockchain technology for enhancing transparency, provenance, immutability, and accountability. However, this shift towards blockchain adoption in supply chain comes with significant privacy concerns. In a typical supply chain, stakeholders, including suppliers, manufacturers, distributors, and retailers, share sensitive data such as pricing, inventory levels, and production schedules. The public and immutable nature of open blockchains could expose proprietary or sensitive information to competitors or the public. This trade-off between the need for transparency and privacy requirements has led to the exploration of privacy-enhancing technologies within blockchain frameworks for supply chain and enterprise applications. 



  §.§.§ Methodology

There are several strategic approaches for implementing privacy in supply chain and enterprise blockchains. Firstly, the adoption of permissioned blockchain architectures enables the creation of a controlled ecosystem where access is granted only to verified participants. This selective visibility is crucial for maintaining a competitive edge and for ensuring that relevant data is shared only among trusted stakeholders. 
Furthermore, the integration of ZKPs addresses the necessity for privacy by allowing participants to verify the authenticity and compliance of products without revealing detailed process histories or proprietary information. This technology is instrumental in convincing end consumers of product safety and quality, even in the absence of full process transparency.
To tackle the intricate and global nature of modern supply chains, data segmentation and encryption techniques are employed to protect business-sensitive information. By only storing cryptographic hashes of the actual data on-chain and keeping the detailed records off-chain or encrypted, these methodologies significantly reduce the risk of exposing trade secrets and sensitive business strategies.
Moreover, the use of smart contracts for privacy enforcement plays a pivotal role in automating compliance and access control based on pre-defined rules. This approach not only streamlines operations but also ensures that data disclosure is strictly governed by necessity and consent in the supply chain scenario.
Therefore, incorporating these enhanced privacy measures can achieve the goal of protecting end consumer interests and maintaining mutual trust among supply chain participants, as depicted in Figure <ref>.



  §.§.§ Applications
 
qedit <cit.> provides privacy-enhancing technology for enterprise blockchains, enabling secure collaboration and data sharing among parties without revealing sensitive information. It utilizes ZKPs to ensure that transactions are valid while keeping the transaction content private. It's designed for enterprises looking to monetize data assets safely, enhance business analytics, and derive actionable insights in a secure manner. The platform is cloud-hosted, highly scalable, and integrates easily with existing database systems for quick deployment. qedit features a configurable dashboard, advanced reporting, and real-time notifications to provide businesses with critical intelligence efficiently. It is aimed at transforming the way companies collaborate on sensitive data, ensuring privacy while enabling data-driven decisions.

zk-BeSC <cit.> introduces a blockchain-based framework for supply chain management that utilizes polynomial ZKPs to ensure privacy during transactions. The framework is designed to enable confidential transactions among supply chain participants, preserving the privacy of sensitive data while maintaining the traceability and immutability features of blockchain technology. It leverages advanced cryptographic techniques, including homomorphic encryption and elliptic curve pairings, to prove knowledge of polynomials without disclosing them. Implemented on the Ethereum testnet with a web3 application, zk-BeSC demonstrates efficient proof performance and reduced gas consumption for verification, addressing key privacy concerns in supply chain management.

Sahai et al. <cit.> present a blockchain-based solution for improving privacy and traceability in supply chains. This approach leverages Hyperledger Fabric and employs cryptographic tools like ZKPs to protect sensitive business data while ensuring the ability to trace product provenance and contamination. The model supports operations such as product entry, exit, transfer, merge, split, and processing within the supply chain, enabling efficient and private tracing of products from origin to consumer.



 §.§ Proof of Reserves



  §.§.§ Motivation and Definition

It has always been important in financial markets for companies to demonstrate their reserve assets to prove their solvency to savers. The global financial system often operates in an undercollateralized and highly opaque manner, relying heavily on trust in a central entity (either the system itself or a third-party certifier), but this can create fraud risks, mismanagement, and privacy breaches. Zero-knowledge proof of Reserves (ZK-PoR) (such as <cit.>) provides a trustless mechanism to verify reserves, enhancing trust and security in decentralized financial systems without sacrificing privacy. This innovation is particularly important for cryptocurrency exchanges and wallets, as users need verifiable assurance that their assets are being held securely without exposing those assets to potential threats. Specific to the scenario of a virtual currency exchange, the proof generated by this method can ensure that the verifier obtains proof of the exchange's repayment ability without knowing the specific amount of the exchange's reserves, the identity of the individual account holder, or any transaction details. Proof, thereby ensuring transparency on reserve adequacy while maintaining privacy and security.


  §.§.§ Methodology

The methodology behind ZK-PoR involves several key steps to ensure secure and private verification of assets. Initially, the entity holding the reserve constructs a commitment to the asset without revealing its details, using cryptography to generate proof of possession. The proof is rooted in a zero-knowledge proof algorithm and is then transmitted to the verifier. Validators use the same cryptographic algorithm to verify proofs without knowing the actual reserves, the identities of asset holders, or transaction details. The process often employs complex mathematical structures such as homomorphic encryption, elliptic curve encryption, and Merkle trees to ensure the integrity and confidentiality of the proof. The trust established by this approach stems from mathematical proof rather than the reputation or authority of the entity.


  §.§.§ Applications

ZK-PoR has numerous applications in the fields of blockchain and financial technology, especially in enhancing privacy and trust. In the financial domain, particularly within cryptocurrency exchanges, proving solvency without compromising sensitive information confidentiality is a critical concern. 

Provisions <cit.> offers a groundbreaking solution to this challenge by employing ZK-PoR. This technology enables a Bitcoin exchange, or any cryptocurrency platform, to transparently demonstrate that it possesses sufficient funds to cover all its obligations to users without disclosing the exact amounts held or the identities of the account holders. Allowing an exchange to prove its liquidity addresses the common concern of potential insolvency. Furthermore, this approach minimizes the risk of sensitive financial data being exposed, which could be detrimental in terms of privacy breaches or malicious exploitation.

Another application, Proven<cit.>, leverages ZK-PoR to provide a decentralized platform that enables companies and financial institutions to verifiably prove their liquidity or asset reserves without revealing specific asset values or compromising the confidentiality of their operations. These applications highlight ZK-PoR’s versatility in solving the twin challenges of transparency and privacy in digital finance, providing exchanges and institutions with a powerful solution to build trust with users and regulators while protecting sensitive financial data.

 

§ NON-BLOCKCHAIN APPLICATIONS
 





 §.§ Proof of Identity
 



  §.§.§ Motivation and Definition
 Although we have seen many blockchain-based proof of identity protocols, identity proving as a practical application of ZKP extends past the blockchain domain as well. Fundamentally, this methodology is derived from the ability to prove a statement about identity, specifically membership in a set or credential verification, without revealing any sensitive information about the identity. As we saw in the blockchain domain, the space of privacy-preserving verifiable credentials is a popular result of these properties. This also extends to non-decentralized technologies, as we will see in the following section. This application domain can be defined as Proof of Identity, utilizing the privacy properties of zero-knowledge verifiable computation. 



  §.§.§ Methodology
 These identity proving techniques utilize ZKP to validate a user's identity or membership in a group without revealing any specific, sensitive details about the identity itself. Compared to other application domains, this methodology is far more pure in the sense that the only unifying factor among applications is the ZKP itself; a proof is generated by a prover on some identity credential and given to an identity verifier, who does not get any identity information other than the proof itself.  



  §.§.§ Applications
 
One of the earliest papers on ZKP, first published in 1988, presents a novel identification scheme based on zero-knowledge proofs, providing a more efficient alternative to RSA-based schemes. <cit.>. In identification schemes, entity A proves their identity to entity B using some constant S in the form of a value or physical card, without enabling entity B to then falsify themselves as A afterwards. Traditional identification schemes utilize encryption and/or hashing along with credentials such as digital passwords, PINs, credit card chips, etc. This paper proposes a practical scheme where no sophisticated adversary is capable of cooperating with a dishonest verifier B to produce a falsified credential and pretend to be A. The methodology involves interactive proofs where an entity can demonstrate their identity by proving they know a secret key of their credentials without having to reveal the secret; simply submitting a proof of their knowledge of the secret is sufficient, with the secret acting as a digital signature unique to each individual. The paper outlines a directory-less scheme, meaning there is no need for a central repository of public keys or identities. The paper also proposes that such a scheme could be implemented in hypothetical “smart cards", which could act as physical credentials that generate zero-knowledge identity proofs using microprocessors to facilitate everyday identity verification. 

The zk-creds protocol leverages zero-knowledge proofs (specifically zk-SNARKs) to convert existing identity documents into anonymous credentials, thereby eliminating the need for credential issuers to hold signing keys <cit.>. This system contrasts with traditional methods where issuers sign credentials and identity documents for validation. By integrating with existing identity infrastructures like government-issued IDs or university diplomas, zk-creds transforms these traditional credentials into digital, anonymous, yet verifiable formats.



 §.§ Machine Learning




  §.§.§ Motivation and Definition

In a world where AI-generated material increasingly mimics human-created information, the potential use of zero-knowledge cryptography could assist us in determining that a specific piece of content was produced by applying a specific model to a given input. If a zero-knowledge circuit representation is built for them, this could give a technique for verifying outputs from large language models like GPT-4 <cit.>, text-to-image models, or any other models. The zero-knowledge quality of these proofs allows us to hide sections of the input or the model if necessary. A good example is enabling users to view the model's inference results without knowing the details of the model and prove that this result really comes from a specific model and input.

Zero-knowledge machine learning (ZKML) is a means to protect data privacy during model training and inference. They enable a data owner or a model owner to demonstrate the accuracy of a computation (such as the prediction of a machine learning model) without exposing any information about the data or the computation itself. This is especially effective in circumstances involving sensitive data.



  §.§.§ Methodology
 
In a typical machine learning situation, an application service provider (the prover) wants to provide a machine learning model it owns to the user (the verifier) while keeping the model private. Provers can use zero-knowledge proofs to show that they have indeed performed a computation using a particular model without exposing the model or the computation process itself. 



  §.§.§ Applications

ZKPs are commonly employed in machine learning, notably privacy-preserving and federated learning. service providers (provers) can use ZKP to prove the correctness of their model predictions without revealing the model itself to prevent model theft. The current state of the art in zero-knowledge systems coupled with performant hardware is still a few orders of magnitude shy of proving something as massive as currently available large language models (LLMs), but there has been considerable progress in establishing proofs of smaller models.

In verifying machine learning model predictions, vCNN <cit.> uses commit-and-prove to combine the typical quadratic arithmetic program (QAP) with the polynomial QAP in pairing-based zero-knowledge proofs. It supports convolutional neural networks and validates them using polynomial multiplications. 

However, by presenting a novel sumcheck technique, zkCNN <cit.> could prove fast Fourier transformations and convolutions in a linear prover time. It is verified that the convolutions directly using the sumcheck protocol and zkCNN are 34×faster than vCNN.

zkDL<cit.> is an innovative approach to meet the need for zero-knowledge proofs in deep learning training. The main challenge it addresses is verifying the nonlinear computations inherent in neural networks, especially the ReLU activation function and its backpropagation. By introducing zkReLU, zkDL can efficiently handle these non-arithmetic operations without resorting to polynomial approximations, which are usually computationally expensive and less accurate. The FAC4DNN utilized by zkDL is an arithmetic circuit that aggregates proofs from different layers and training steps. This design bypasses traditional sequential proof generation and greatly reduces computational and communication overheads. zkDL also achieves full compatibility with tensor structures and supports large-scale neural networks, with proofs generated in less than a second for each batch update for networks with up to 10 million parameters.

The research by Sanjam Garg et al.<cit.> explores the practical application of zero-knowledge proofs in verifying the training of machine learning models. It focuses on experimental settings to verify the feasibility of such proofs, taking into account computational complexity and scalability issues. Their work emphasizes the need to balance strong security guarantees with practical overhead, ensuring that the proofs are concise and the prover's workload is manageable. By experimenting with various configurations and optimization techniques, it provides insights into making zero-knowledge proofs applicable to real-world deep learning applications, which is very suitable as a reference.

Another recent study, Kaizen<cit.>, proposed a zero-knowledge proof system designed for deep neural networks (DNNs). It ensures that the submitted model is correctly trained on the submitted dataset without leaking any other information. Kaizen adopts a sum-check-based proof system optimized for the gradient descent algorithm and recursively combines these proofs in multiple iterations. This recursive combination ensures that the proof size and verifier time are independent of the number of iterations, making it highly scalable. Kaizen has the ability to handle large models such as VGG-11, and is more practical than general recursive proofs, significantly reducing prover runtime and memory overhead.

In the study of the reasoning process, zkLLM<cit.> focuses on providing zero-knowledge proofs for large language models, ensuring that the reasoning results are verifiable without revealing the underlying model or data. This is especially important for applications that require strong privacy protection, such as medical or financial fields where data confidentiality is critical. zkLLM uses advanced encryption technology to efficiently generate and verify proofs, and maintains the privacy of model parameters and input data through cryptographic means, enhancing trust in deployed AI systems.

In addition to the issue of the trustworthiness of its predictions, the model's reliance on opaque data sources has become a new challenge. People frequently desire to keep the inputs and parameters of machine learning models private and unknown to the general public. Because the input data may contain sensitive information such as personal finances or biometrics, and the model parameters may also hold critical secrets. To specify provers and verifiers, many ZKML tools represented by the ezkl library <cit.> can implement higher-level descriptions of machine learning models or other computational graph programs. A prover can demonstrate that a particular output is produced by running a specific neural network on a specific data set. 

Modulus Labs <cit.> is also developing a zero-knowledge machine learning solution, enabling trustful integration of AI outputs into blockchain systems without revealing sensitive data or model details. This allows developers to retain ownership and control over their AI models rather than relying on centralized platforms to host and manage their models. And their new zero-knowledge prover, Remainder<cit.>, is a fast AI prover for AI inference. It is based on a verifiable decision forest inference circuit using GKR protocol<cit.>.

Giza <cit.> is a machine learning platform built on StarkNet that can be used to deploy and extend machine learning models, as well as solve the interoperability issues faced in the use of cloud-based machine learning models, performance, and transparency issues. It uses the ONNX open format to improve interoperability. Through a series of common operators and file formats it defines, developers can freely use TensorFlow, PyTorch, Scikit-Learn, and other frameworks and tools. Since StarkNet runs on the Layer2 network, it can enable any decentralized application to achieve unlimited computing scale without affecting the composability and security of Ethereum. Therefore, you don’t have to worry about load and architecture issues when using Giza, and can concentrate on model development and iterate. Another benefit of being based on StarkNet is that most functions are managed by the blockchain, which makes it easier to monitor, track, and manage the model, greatly improving transparency.





 §.§ Other Applications





  §.§.§ Motivation and Definition

Zero-knowledge proofs (ZKPs) have a broad range of applications extending beyond blockchain technology. Their unique ability to verify the accuracy of information without revealing the data itself makes them valuable in various technological fields. This section further progresses into other diverse applications of ZKPs that may not necessarily fit into our predefined categorization. These applications leverage ZKPs to address challenges in other significant areas, including image authentication, decentralized voting systems, and secure multi-party processes by ensuring data privacy and computational integrity.



  §.§.§ Methodology

In particular, we focus on four different applications: 1) Image Authentication, 2) Secure Electronic Voting Systems, 3) Randomness Generation and Timelocks, and 4) Collaborative Computations. ZKPs can be used to authenticate images without revealing the original content while allowing certain transformations like cropping or rotation. This is achieved by attaching a zero-knowledge proof to each image, certifying its integrity through any permissible transformations. 
Secure voting systems can employ ZKPs to validate encrypted votes while simultaneously ensuring voter privacy and integrity. This allows the verification of the correctness of each vote while maintaining the confidentiality of the voter's choice. 
In applications such as randomness generation and timelocks, ZKPs can provide proof of computational integrity and delay in a verifiable delay function (VDF). These systems combine a delay function with the zkSTARK protocol in order to create a VDF that is slow to compute but fast to verify.
Other applications extend the use of zk-SNARKs to collaborative environments where multiple parties jointly produce a single proof over a distributed witness. It addresses the challenge of maintaining data privacy in multi-party computations. The approach involves adapting zk-SNARKs for multi-prover protocols using secret-sharing techniques. This allows the generation of a single proof that validates a computation over data distributed among several parties without revealing individual inputs.



  §.§.§ Applications

In the realm of digital media, journalism, and legal documentation, the authenticity of images is a critical concern. PhotoProof <cit.> addresses this by allowing images to be authenticated even after undergoing permissible transformations such as cropping or color adjustments. This application is particularly significant in legal scenarios where image evidence must remain untampered and in journalism, where the integrity of photographic evidence can be crucial in forming public opinion. PhotoProof utilizes ZKPs to ensure that any changes made to an image do not compromise its original authenticity, thereby maintaining the credibility of digital media.

Moreover, ZKPs can address the limitations of electronic voting systems, such as tampering or breaches in voter privacy. The integrity of the voting process in elections is of utmost importance in maintaining democratic principles. The proposed system for electronic voting using non-interactive zero-knowledge arguments <cit.> presents a secure method to validate votes while preserving voter anonymity. This application is significant in preventing electoral fraud and ensuring a fair and transparent voting process.

Generating unbiased randomness and implementing secure timelocks is essential in blockchain systems and cryptographic protocols. VeeDo <cit.> leverages ZKPs in VDFs to provide a reliable source of randomness that is resistant to manipulation, enhancing unpredictability and fairness in blockchain applications. In cryptographic protocols, VeeDo's timelock feature can be utilized to secure information for a predetermined period by adding an extra layer of security to sensitive transactions or processes.

In fields like scientific research, business analytics, and healthcare, there is often a need to perform multi-party computations over shared data without revealing individual inputs. Collaborative zk-SNARKs <cit.> enables multiple parties to compute a joint result while ensuring that the privacy of individual institutions' data is preserved.

For instance, hospitals and research institutions might collaborate on patient data for medical research while adhering to privacy laws set up by the government. Using collaborative zk-SNARKs, they can analyze aggregate data, such as treatment effectiveness or disease trends, without revealing individual patient details. This has profound implications for collaborative research, where data privacy is paramount, and for businesses that require secure multi-party computations for joint ventures or partnerships. 

Next, ZKP2P <cit.> emerges as an innovative bridge that integrates traditional finance with decentralized finance through a trustless and privacy-centric framework. At its core, ZKP2P employs ZKPs to verify DomainKeys Identified Mail (DKIM) signatures in payment confirmation emails. This use of ZKPs is instrumental in ensuring the authenticity of transactions while maintaining the privacy of sensitive information. The architecture of ZKP2P is characterized by its incorporation of several key components: circuits for the secure verification of transaction details, smart contracts for managing trustless interactions, and ZK-Email Libraries essential for the generation of private proofs relating to email contents.
The ZKP2P protocol is designed to be interoperable with prevalent Web2 payment systems, thereby bridging a significant gap between fiat and cryptocurrencies. By eliminating intermediaries and reducing transaction fees, ZKP2P aims to offer a more inclusive and efficient platform for crypto-fiat conversions with the potential to evolve into a global, on-chain, trustless payment network compatible with diverse financial applications in DeFi, NFTs, and gaming. 



§ CONCLUSION AND FUTURE WORK
  
In the rapidly evolving world of digital security and privacy, ZKPs have emerged as a revolutionary tool, offering a way to share proofs of computational integrity without revealing the computation's input. This survey explored a wide range of ZKPs' practical applications and use cases, showing their crucial role in advancing cryptographic solutions and enhancing privacy in digital interactions. By examining various use cases, from enhancing privacy in blockchain to securing verification processes, ZKPs have demonstrated their potential to meet some of the most pressing challenges in ensuring digital privacy and security. However, the journey from theoretical constructs to widely applied solutions for ZKPs is still ongoing. The survey uncovered the depth and breadth of ZKPs' applicability, highlighting the need for further research, especially in optimizing their implementation and expanding their use cases.

In concluding our survey on the applications of ZKPs, we identify some promising directions for future research to broaden their practical use and applicability. Future works could explore lightweight ZKP protocols that are feasible for devices with limited computational capabilities, enabling secure, privacy-preserving communication in the IoT landscape. Furthermore, the integration of ZKPs with ML, particularly in the context of bigger and more complex models, presents space for breakthroughs. Investigating the ways in which ZKPs can facilitate privacy-preserving computation and verification of large machine learning models without exposing the underlying data or the model itself has the potential to transform data privacy in AI.

In the domain of Layer-2 blockchain scalability using ZKPs, future research includes improving SNARK proof generation times in order to enable universal synchronous composability among different Layer-2 rollups. Universal synchronous composability allows different rollups to access and update the same universal blockchain state by sharing a sequencer that posts state changes to Layer-1 – this would defragment the Layer-2 rollup landscape and consolidate blockchain liquidity and state data among all Layer-2 rollups. In order for this to be possible, hardware custom-built for a proving system will likely be required.

Future research could also include finding the implications of merging ZKPs into game theoretic mechanisms. Specifically, there could be more formal research on finding equilibria in privacy-preserving systems augmented by ZK. For example, placing truthful bids in auctions without revealing sensitive information about underlying assets, similar to the private DAO application seen in section <ref>. Research could also be done on the feasability of financial price discovery in fully or partial private modes, for both auctions and exchanges. To extend from this, there is yet to be a ZK SNARK system which proves the valid execution of a private order-book exchange. This can also be extended to dark pools, which are privatized blockchain exchanges enabled by ZKPs, which can utilize the automated market maker (AMM) exchange model. 

Another potential application of ZKPs, specifically within the blockchain space, could be the use of privacy-preserving proofs to mitigate the negative externalities of maximal extractable value (MEV). Some possibilities could include creating encrypted transaction mempools and relays using ZKPs. 

Additional future applications and research could extend any of the application categories mentioned in this paper. There are set to be many more uses of ZKP for legal compliance in private financial applications, mitigation of AI risks such as deepfakes, and additional privacy enhancements in financial applications. As we advance our computational techniques, explore new applications, and deepen our theoretical understanding, ZKPs stand to significantly impact how privacy and security are achieved in the digital age. 



§ ACKNOWLEDGMENTS

This material is based in part on work supported by AFOSR under award number FA9550-23-1-0312. Any opinions, findings, and conclusions, or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of any funding agencies. We thank Prof Yupeng Zhang for his helpful comments on the paper.





IEEEtran




