Capacity of Interactive Communication over Erasure Channels and ...

Capacity of Interactive Communication over Erasure Channels and Channels with Feedback Ran Gelles

Bernhard Haeupler ∗

Princeton University [email protected]

Abstract We consider interactive communication performed over two simple types of noisy channels: binary error channels with noiseless feedback and binary erasure channels. In both cases, the noise model is adversarial. Assuming at most εfraction of the bits can be corrupted, we show coding schemes that simulate any alternating interactive protocol with rate 1 − Θ(H(ε)). All our simulations are simple, randomized, and computationally efficient. The rates of our coding schemes stand in contrast to the interactive communication rates supported by random or adversarial error channels without feedback, for which √ the best known p coding schemes achieve rates of 1 − Θ( ε) and 1 − Θ( ε log log 1/ε), respectively. As these rates are conjectured to be optimal, our result implies a large asymptotic gap between interactive communication rate over noisy channels with and without feedback. Such a gap has no equivalent in the standard one-way communication setting.

1

Introduction

When communication is performed in the presence of noise, redundancy must be added to allow communicating parties to decode/identify the intended message(s) of the other party. An important consideration in any such setting is to determine the minimal amount of redundancy needed for reliable communication, as a function of the specific channel and the type of communication. In 1948, Shannon [Sha48] laid the mathematical foundations for answering such questions by analyzing one-way message transmissions over noisy channels. For example, he considered the setting in which a party wants to reliably transmit a message of n bits, where n is sufficiently large, over a binary channel that flips each bit independently with probability ε, i.e., the binary symmetric channel with parameter ε, or BSC(ε) for short. Shannon showed that it is necessary and sufficient to send N bits such that the rate n/N of original symbols to transmitted symbols equals 1 − H(ε) − o(1), where 1 H(x) = x log x1 + (1 − x) log 1−x is the binary entropy ∗ Work

done while a student at UCLA.

CMU [email protected]

function. The value 1 − H(ε) is known as the capacity of the BSC(ε). Shortly thereafter, Hamming studied channels in which errors are not as nicely and evenly distributed as in the random BSC. In particular, he initiated the design of error correcting codes which work for any distribution of errors as long as the number of errors is bounded, e.g., to be an ε-fraction of all symbols. In this setting one can think of an adversary choosing the positions of the errors. Still a capacity of 1 − Θ(H(ε)) holds for this channel, which we denote with BSCadv (ε). Other channel types have been considered as well, such as channels with feedback, in which the sender learns about a corruption, and erasure channels, in which the receiver learns about a corruption in form of a transmitted symbol being replaced by a special erasure symbol ⊥. We denote these channels with BSCf(ε) and BEC(ε). While feedback was shown to not increase the capacity of the BSC, having erasures instead of errors does. In particular, the capacity of the random binary erasure channel, is 1 − ε. These initial and many subsequent results and insights had tremendous impact on technology and science and have developed into the still active and thriving fields of information theory and coding theory. Interactive communications and interactive channel capacity. In many modern settings and applications communication is not just uni-directional. Two decades ago, this prompted Schulman [Sch92, Sch93, Sch96] to consider similar questions for interactive communication settings. Instead of one party sending a single large n-bit input message to the other party, here two parties, Alice and Bob, hold inputs x and y, respectively, and the aim is for both of them to compute some function f (x, y) by exchanging bits for n rounds, say in an alternating manner. In the presence of noise, say the channel being a BSC(ε) or BSCadv (ε), we again ask how much redundancy is needed, or differently speaking, how many more rounds are required for both parties to correctly compute f (x, y) with high probability. The rate of a coding scheme achieving such a reliable interactive communication for any f is the ratio between

the number of rounds n needed in the noiseless setting and the number of communication rounds N required in the presence of noise. In the same way as for the standard one-way communication setting one can define the capacity 1 in the interactive setting as the limit of the best achievable rate of a reliable interactive coding scheme for large n. Coding schemes for interactive communication: a short overview. After the existence of constant rate coding schemes for random and adversarial channels was shown by Schulman many recent works extended and refined various aspects of interest, such as, the maximal noise tolerated and the computational complexity of the coding schemes (see related work below). The harder question of what rates are achievable was only attacked recently, initiated by the work of Kol and Raz [KR13], who considered the rate achievable over the BSC(ε) for small noise rates ε. The state of the art regarding these questions are the protocols of Haeupler [Hae14] that achieve a rate of √ 1−O( ε) for random errors and even for the BSCadv (ε) if the partiesphave access to shared randomness, and a rate of 1 − O( ε log log 1/ε) for BSCadv (ε) without shared randomness. While these results are conjectured to be tight for the BSC(ε) and BSCadv (ε), the same does not hold for erasure channels, or in the presence of feedback. Indeed, Pankratov [Pan13], who earlier presented a √ coding scheme for the BSCf(ε) of rate 1 − Θ( ε), leaves as an explicit open question the task of improving the rates of coding schemes for erasure channels and channels with feedback.

First we discuss the case of channels with feedback, and show the following main theorem. Theorem 1.1. There is a simple, computationally efficient, randomized coding scheme which simulates any binary n-round alternating interactive protocol over a BSCfadv (ε) with a rate of 1 − O(H(ε)) and an exponentially high success probability of 1 − 2−Ωε (n) . It is known that even for one-way communication over the BSCf(ε), that is, the random error channel with feedback, no rate higher than 1 − H(ε) can be achieved [Sha56]. This makes our achieved rate optimal and therefore also determines the interactive capacity for alternating protocols over the BSCf(ε) and BSCf adv (ε) channel, up to a constant in the second order term: Corollary 1.2. The interactive capacity for alternating protocols over the BSCf(ε) and the BSCfadv (ε) is 1 − Θ(H(ε)). For simplicity our main results are phrased as asymptotic statements for small noise rates ε. However, we want to emphasize that our coding schemes are very simple and for most settings have small hidden constants that can be easily determined. For example, our protocol for the BSCf adv (ε) has a rate of exactly maxk∈N 1−ε(2k+1) . As Figure 1 shows, this com1+2−k+1 pares very favorably with the previous coding scheme of [Pan13].2 This is true for any noise-rate ε and not just for small ε, when the almost quadratically different asymptotics kick in. See Appendix A for further details.

We also prove similar results for random and adversarial erasure channels: 1.1 Our results. We address the task of performing reliable interactive communication over channels with Theorem 1.3. There is a simple, computationally effeedback and erasure channels, and drastically improve ficient, randomized coding scheme which simulates any the state of the art for these settings. In particular, we binary n-round alternating interactive protocol over prove that any n round alternating interactive protocol a BECadv (ε) with a rate of 1 − O(H(ε)) and an excan be simulated over either of the above channels ponentially high success probability of 1 − 2−Ωε (n) . with rate 1 − Θ(H(ε)). For simplicity, our results are stated and proven for binary protocols and coding Even though the rate of one-way communication schemes but they work equally well for larger alphabets. over the BEC(ε) channel is 1 − ε we conjecture our rate More importantly, our coding schemes can even tolerate to be optimal for alternating interactive protocols. See adversarial errors. discussion in Section 7. Lastly, we mention that while most prior works 1 We remark that when defining capacity in the interactive assume the protocol to be simulated (as well as the setting, one has to be very careful in specifying the type and details simulation itself) to be alternating, such an assumption of the interactive protocols that are considered. In particular, as is not without loss of generality. In particular, converting shown in [Hae14] and also in this paper, many aspects have a an arbitrary protocol over a noiseless channel into an non-trivial influence on this quantity, e.g., the order of speaking in both the original and simulated protocol, and whether or alternating protocol can by itself cause a length increase not this order depends on the noise (i.e., robust vs. adaptive protocols [GHS14, GH14, AGS13]), the presence or absence of shared or private randomness and whether or not it is known to the adversary, etc.

2 Although

[Pan13] considers the case of random noise, the same scheme and resulted rate apply also for the case of adversarial noise.

1 [this paper] [Pan] [GV]

0.8

Rate

0.6 0.4 0.2 0

0

0.05

0.1 0.15 Noise ε

0.2

0.25

Figure 1: A comparison of the maximal rates in (i) our simulation for BSCf adv (ε) (Algorithm 3); (ii) the simulation of [Pan13]; and (iii) the Gilbert-Varshmov (existential) bound [Gil52, Var57], as a function of the fraction of the noise ε. of a constant factor. Interestingly, while for the standard BSC(ε) and BSCadv (ε) channel alternating protocols are conjectured to be the hardest interactive protocols to simulate (at least if one allows adaptive simulations [Hae14]) this seems not to be the case for the channels considered in this work. In Appendix B we thus provide interesting additional results which show how far our ideas extend to irregular protocols and also explain why highly-irregular protocols might be harder to simulate. In particular, all our results extend readily to Θ(log 1ε )semi-alternating protocols in which it is guaranteed that every Θ(log 1ε ) rounds each party talks at least Θ(log 1ε ) often. Beyond this we also show that a rate of 1 − Θ(H(ε)) can be achieved over a BSCf(ε), as long as the order of communication in the original protocol is a function of the round number alone (i.e., assuming robust protocols [BR11]). Theorem 1.4. There is a simple, computationally efficient, randomized coding scheme which simulates any robust, binary, n-round interactive protocol over the BSCf(ε) channel with a rate of 1 − O(H(ε)) and an exponentially high success probability of 1 − 2−Ωε (n) . We do not believe that similar results (i.e., for protocols with arbitrary order of speaking) hold for the BSCf adv (ε), the BECadv (ε), or even the BEC(ε). 1.2 More details on related work. Schulman and most subsequent works considered the possibility of reliably simulating any n-round alternating binary in-

teractive communication over random and adversarial error channels, often over a larger finite alphabet. In particular, Schulman gave a coding scheme tolerating some ε = 1/240 fraction of adversarial errors over a channel with a large finite alphabet. Schulman’s scheme achieves a small unspecified constant communication rate and requires exponential time computations. A flurry of subsequent works improved the computational complexity of such coding schemes for the random [GMS11, GMS14] and adversarial setting [BK12, BN13, GH14] as well as the maximal error rates that can be tolerated in various settings [BR11, FGOS13, GHS14, AGS13, BTT13, BE14, EGH15] and under various restrictions, e.g., [CPT13, GSW14]. By now these results have essentially settled the error rate regions for which (computationally efficient) coding schemes with a constant communication rate are possible. The works [FGOS13, GHS14, GH14, AGS13, EGH15] are relevant to this paper in particular as they show, among other results, that the maximal tolerable error rate (region) is larger for erasure channels than for error channels. As mentioned above, Kol and Raz [KR13] were the first to study the communication rate achievable in interactive communication. They gave a coding scheme for the random error channel BSC(ε) with p small noise rates ε and showed that a rate of 1 − O( H(ε)) could be achieved p for alternating protocols. They also gave a 1 − Ω( H(ε)) impossibility result for certain nonalternating protocols under the assumption that the simulation protocol has a fixed communication order. Pankratov [Pan13] considered the rate of interactive coding schemes over channels √ with feedback and gave a scheme with rate 1 − O( ε) for random errors with feedback, i.e., the BSCf(ε), giving an early indication that feedback might improve the communication rate in an interactive setting. Haeupler [Hae14] then showed √ that no feedback is needed to achieve a rate of 1−Θ( ε) over a BSC(ε). The same work also extends to the case of adversarial errors p and gives √ a coding scheme with rate 1−O( ε log log 1/ε) or 1 − O( ε) for the BSCadv (ε), depending on whether or not the coding scheme is given access to shared randomness. Furthermore, the above rates are conjectured to be optimal for the BSC(ε) and the BSCadv (ε), even when restricted to simulating alternating protocols. Interestingly, the coding schemes of [Hae14] produce an alternating simulations for any alternating input protocol but they also allow the input protocols to have arbitrary communication order, producing an adaptive [GHS14] simulation in this case. As pointed out in [Hae14] this adaptivity is conjectured to be necessary as there are non-alternating protocols for which any simulation with

a fixed communication order has a constant rate loss, Definition 2.3. The interactive capacity over a chani.e., a conjectured 1 − Ω(1) upper bound. These results nel CH is justify our primary focus on alternating protocols. n CCH = lim min , n→∞ f s.t. CCCH (f ) 2 Preliminaries CC(f )=n We sometimes refer to a bitstring a ∈ {0, 1}n as an array a[0], . . . , a[n − 1] and denote with a ◦ b the concatenation of the strings a and b. We use prefixk (a) to denote the first k characters in a string a, and suffixk (a) to denote the last k characters in a. Recall that H(x) = 1 x log x1 + (1 − x) log 1−x is the binary entropy functions and remark that H(ε) = Θ(ε log 1ε ) for small ε > 0. All logs are taken to base 2. Consider the noiseless interactive protocol π. We say that the length of π, denoted |π|, is the number of rounds in the protocol. In case where π is binary, |π| = CC(π). Similar to most prior works, we consider input protocols which are binary and of fixed length n. For most parts we also restrict ourselves to input protocols in which the parties take turns sending a symbol and we call these protocols alternating. As already roughly defined above, we consider the following channels and use the standard notion of simulation over a noisy channel introduced in [Sch92]:

where CCCH (f ) = minΠ CCCH (Π) over all the protocols that compute f over CH with vanishing error probability over the parties coin-flips (and the noise, in case it is random). 3

Overview

Let us begin with a brief high-level overview of our approach. Very roughly, our simulation process, for both the BSCf adv (ε) and the BECadv (ε), consists of the following three steps: 1. randomness exchange: The parties exchange ω(log n) random bits. These will be used to mask the simulated transcript, after being expended into a small-biased sample space [NN93, AGHP92]. We may assume that the masked transcript is very close to uniform, specifically, we assume that the probability to have a k-long sequence of consecutive zeroes is approximately 2−k .

Definition 2.1. We define the following channels: BSC(ε), BSCf(ε), BSCfadv (ε), BEC(ε), BECadv (ε) (etc.) to be interpreted in the following way: (type of noise:) BSC : {0, 1} → {0, 1} where a noise means a bit-flip, and BEC : {0, 1} → {0, 1, ⊥}, where a noise means an erasure, denoted by ⊥; (feedback:) an ‘f’ suffix denotes feedback: at any transmission the sender learns the (possibly erroneous) symbol received by the receiver; (power of adversary:) a superscript adv indicates adversarial noise, limited to at most ε-fraction of the transmissions. The lacking of an adv superscript means random noise, where each bit is flipped or erased independently with probability ε.

2. zero-elimination: We convert π into a protocol πr,nz that has no long runs of zeros (later in the simulation, such a sequence of zeros will carry a special meaning). Specifically, we split the transcript into blocks of size k = Θ(log 1ε ) each. If the first k − 1 places in a block are all zeros, then the k-th round of that block in πr,nz becomes a “void” round in which both parties send ‘1’ to the other side, and ignore the incoming bit. After this void round πr,nz continues exactly as π. Note that since the (masked) transcript bits are almost uniform, an all-zero block happens with small probability εΘ(1) , and we will not add too many void rounds.

Definition 2.2. A simulation of π over a channel CH is a protocol Π that assumes messages are communicated over CH, such that for any input (x, y), Π(x, y) outputs the transcript of π(x, y) with high probability over the parties coin-flips (and the noise, in case it is random). The rate of a simulation Π over a channel CH with respect to the noiseless protocol π it simulates is CC(π)/CCCH (Π).

3. Simulation: We simulate πr,nz over the noisy channel by running πr,nz in blocks3 of size k. At the end of every block, the parties verify that the other side received the block correctly. If a corruption is identified by either side, that party sends k zeroes in the following block; this indicates that a previous transmission was incorrectly received, and that both parties should backtrack 2k steps. Note that it is always possible for the parties to notice corruptions

As usual the capacity of a channel for a class of communications is the (limit of) the highest rate that 3 Working in blocks simplifies the analysis and does not affect can be achieved for all communications of this class. the asymptotic rate. However, for the BSCf adv (ε) case we actually wish to optimize the constants. For this reason, we simulate over the BSCf adv (ε) channel in a bit-by-bit manner rather than in blocks, yet the main idea remains the same.

and send the backtracking command: in the case of a feedback channel, the sender can verify that the receiver indeed received the correct information; for the erasure channel, it is the receiver that knows whether or not a block was received without any erasures.

zeroes is bounded by 2−k = εΘ(1) , and the expected length of πnz would become < |π|(1 + O(ε)) as needed. To achieve a uniform distribution of the transcript, we use randomness. Specifically, the parties exchange ω(log n) random bits which they expand into a longer bitstring, that is close to being uniform.

The remaining task is to make sure both parties are always synchronized, i.e., that they backtrack and re-simulate πr,nz from the same position. This is somewhat trivial in the feedback case since the noiseless feedback allows the parties to share the same “view”. In the erasure case the parties’ discrepancy can be at most one block, thus sending a small parity of the current simulated block number helps both parties to regain synchronization.

Definition 4.1. A sample space on n bits is γ-away from κ-wise independence P if for any κ positions i1 < · · · < iκ it holds that ξ∈{0,1}κ |Pr[xi1 xi2 · · · xiκ = ξ] − 2−κ | ≤ γ. Lemma 4.1. ([NN93, AGHP92]) There exists a function PRG : {0, 1}t → {0, 1}n such that given a uniform input, the output is γ-away from κ-wise independent and t = O(log n + κ + log γ −1 ).

We have a tradeoff between the amount of randomness we exchange and the success probability of the process. In order not to affect the total rate of the coding scheme, the amount of randomness exchanged can be at most O(ε log 1ε ·n), yet in order to optimize the constants of the asymptotical rate, we would prefer exchanging 4 Preprocessing: Randomness Exchange and T bits such that T /εn → 0 when n → ∞, ε → 0, denoted T = o(εn). On the other hand, with T bits of ranZero-Elimination −Ω(T ) . Let π be an alternating protocol of length n, and let ε > 0 domness, the success probability is limited to 1 − 2 The entire process (e.g., randomness exchange and be a small constant. We begin with eliminating long zero-elimination) is given in Algorithm 2. sequences of consecutive zeros. In the following section we formalize the randomization and zero-elimination preprocessing steps described above. Then, in Section 5 and Section 6 we show how to simulate the preprocessed protocol over a channel with feedback and over an erasure channel, respectively.

Algorithm 1 Protocol πnz — eliminating zero sequences Input: an alternating protocol π and a block size k. 1: cnt ← 0 2: while π has not finished do 3: if cnt = k − 3 and ‘0’ was sent by a party in all its 4: 5: 6: 7: 8:

previous k − 3 slots then in the next 3 rounds send ‘1’; ignore the incoming 3 bits (keep alternating rounds).4 cnt ← 0 else run the next round of π cnt ← cnt + 1 (mod k)

The problem with the above zero-elimination process, is that it might add too many “void” rounds and increase the rate. For instance, assume inputs x, y on which the transcript of π(x, y) is all zeros. In this case, the length of πnz would be |π|(1 + O(log−1 ( 1ε ))), assuming k = O(log 1ε ). However, was the transcript “random”, then the probability that a party sends k consecutive 4 Three

rounds are needed for the simulation of the BEC channel (1 bit delimiter and 2 parity bits); for the case of channels with feedback, one bit suffices, yet this has a negligible effect on the rate.

Lemma 4.2. For small enough ε > 0, assuming k = Θ(log 1ε ) and T = o(εn), it holds that |π| > 1 − εΘ(1) |πr,nz | except with probability

|π| −T . T 2

0 |+O(T ).5 Since T = o(εn) Proof. Note that |πr,nz | = |πnz it has no effect on the asymptotical rate, and we only 0 need to show that |πnz | is not too long. Let us assume that k = c log 1ε for some constant c > 1, and show that the expansion of π 0 caused by Algorithm 1 (line 4), is at most εc n additional rounds with high probability. We split the transcript of π 0 into segments of length T . Each such segment is 2−T away from T -wise independent string. Thus, we can assume that each segment is fully uniform, and bound the probability to have at most εc T additional rounds per segment. Due the statistical closeness, the real transcript at that segment will have the same expansion with a similar probability, up to an additive term of 2−T . 0 has length of πr,nz is measured only until the run of πnz ended, although we define it to continue forever by sending ‘1’s and ignoring the input for technical reasons. 5 The

Algorithm 2 Protocol πr,nz — masked transcript with no long zero runs Input: an alternating protocol π of length n, block size k, and parameter T = ω(log n). 1: Let π rand be a protocol with O(T ) alternating rounds, where at each round, a party chooses a uniform independent bit

and transmits it to the other party. The output is the concatenated random string of length O(T ) sent by the parties rand (the transcript). Let πnz be given by Algorithm 1 on input π rand . rand 2: Run πnz and let R be the output of the underlying π rand . 3: mask ← PRG(R)

. mask ∈ {0, 1}n is 2−T -away from T -wise independent, using Lemma 4.1

4: Let π 0 be a protocol similar to π such that at the i-th transmission, the protocol sends π[i] ⊕ mask[i] instead of π[i]. 0 Let πnz be given by Algorithm 1 on input π 0 with block size k. 0 5: Run πnz .

6: loop 7: Send ’1’ ; ignore received communication.

Given a uniform transcript, the probability that we add an extra “void” round6 after each k transmissions of the same user, is at most the probability that the masked transcript in those k-bits is all zero, which is bounded by 2−k . Split the T rounds into blocks of k-bits each (where the same user speaks in an entire chunk), and for i = 1, . . . , T /k, let xi = 1 if the P i-th block has k zeros. We have E[xi ] = 2−k , and E[ i xi ] = 2−k T /k. Setting k = c log 1ε we get by Chernoff inequality,

. artificially extend the protocol as needed

5

Simulation Over a Noisy Channel With Feedback

In this section we show how to simulate πr,nz over a noisy channel with feedback, BSCf adv (ε). The main idea is the following. The parties run πr,nz bit by bit, and verify (using the feedback) that each transmission was received correctly on the other side. When a transmitted bit is received incorrectly, the sender is aware of this event due to the feedback, and in order to signal this event to the other side, the sender sends a k-long all" # X zero string in the subsequent rounds. This instructs c Pr xi > (1 + ε )T the receiver to rewind the protocol 2k + 1 rounds from i " # its current position (from the erroneous bit, and until X k zeros are sent, each party talked for k rounds due to k −k = Pr xi > k(1 + 2 ) · 2 T /k the alternating rounds assumption). Note that due to i the zero-elimination in πr,nz , it can never happen that k < e−k2 T /3 the transcript contains a k-long all-zero string if no error has happened. = 2−Ω(T ) . It is possible that noise occurs during the transHence, using a union bound on all the n/T seg- mission of the all-zero control message, but again, the ments of the transcript, we get that except with proba- sender is aware of this, and can continue sending zeros bility Tn 2−Ω(T ) , the algorithm adds at most n · εc void to “delete” these erroneous transmissions as well, until the receiver rewinds to the longest correct prefix. rounds altogether. The obtained rate is The parties continue running the protocol for n(1 + 1 |π| n Θ(ε log ε )) rounds; note that πr,nz is well defined even = . |πr,nz | n(1 + εc ) + O(T ) after the termination of the underlying π. We formalize this procedure in Algorithm 3. With T = o(εn) this yields an asymptotical rate > 1−εc , as needed.  Theorem 5.1. For any binary alternating protocol π, inputs x, y, and small enough ε > 0, Algorithm 3 over a BSCfadv (ε) simulates the transcript of π(x, y) with 6 We neglect here the fact we actually add 3 rounds after k − 3 −Ωε (n) . The rate of the simulation all-zero rounds, and assume for simplicity, we add 1 round after probability 1 − 2 each k. We are also a bit negligent in separating blocks into rounds is 1 − Θ(H(ε)). where Alice speaks and rounds where Bob speaks, nor the specific position of a block (or any sequence of bits) in mask. These do not affect the analysis of the asymptotical rate and the claimed result.

Algorithm 3 Simulation of π over a BSCf adv (ε) Input: an alternating protocol π of length n, an error parameter ε > 0, and an input x. Set parameters: k = Θ(log 1ε ); N = n(1 + Θ(ε log 1ε )); T ← ∅; T F ← ∅. T is the simulated transcript viewed so far. We can split T into two substrings corresponding to alternating indices: T S are the sent characters, and T R the received characters. Let T F be the characters received by the other side (as learned via the feedback channel). Let πr,nz be given by Algorithm 2, on input π with block size k/2. 1: for i = 1 to N do 2: if T F = T S then 3: T ← T ◦ πr,nz (x | T ) . run one step of πr,nz , given the transcript so far is T 4: else 5: Send ‘0’ whenever it is your turn to speak;7 extend T, T F accordingly. 6: 7:

if suffixk (T R ) = 0k or suffixk (T F ) = 0k then T ← prefix|T |−2k−1 (T )

. remove the last 2k + 1 exchanged bits (delete the corresponding transmissions in T F as well)

Proof. Let B be the (bad) event that |πr,nz | > n(1 + ε2 ), which happens with probability 2−Ωε (n) given the appropriate choice of parameters (Lemma 4.2). In the following we assume that B does not happen. Due to the feedback, each party is fully aware of what the other side has received, so both parties are always in full sync regarding the current (received) transcript. This received transcript may be incorrect due to errors, but then at least one of the parties will send an allzero command util the erroneous transcript is removed. Nevertheless, the parties remain in sync throughout the protocol, so we only need to show that end of the simulation, the correct transcript of π was simulated with high probability. For any i = 1, . . . , N we can look at the transcript received by both parties Trec = (TAR , TBR ) as it appears at the end of the i-th instance of the for-loop (note, Trec = (T F , T R ) for both parties). If we compare Trec to the simulated transcript of π, then at any round i, Trec consists of a correct prefix possibly followed by an incorrect suffix. Let ϕ(i) denote the length of the correct prefix in Trec minus the incorrect suffix in Trec . Let λ(i) be the number of corruptions in Trec , and define the potential function ρ(i) = ϕ(i) − (2k + 1)λ(i).

If no corruption happens on the i-th transmission, then if Trec is fully correct (its incorrect suffix is empty, λ(i) = 0), then at end of the round Trec ’s correct prefix increases by one bit, ϕ(i) = ϕ(i − 1) + 1, and also ρ(i) = ρ(i − 1) + 1. If, on the other hand, Trec contains some corruptions, then either ϕ(i) = ϕ(i−1)−1 since the incorrect suffix increased by one, or ϕ(i) ≥ ϕ(i−1)−2k−1 when a “rewind” k-zeros command was received, but in this case also (at least) one corruption was removed, λ(i) ≤ λ(i − 1) − 1. Therefore, in both cases, ρ(i) ≥ ρ(i − 1) − 1. Note that the adversary is bounded to εN corruptions. Since any single corruption is corrected after at most 2k + 1 rounds (and multiple errors just accumulate linearly), the simulated Trec can contain corruptions in at most 2k · εN iteration of the for-loop. Thus, ϕ(N ) ≥ ρ(N ) ≥ (N − 2εkN − εN ) · 1 + 2εkN · (−1) + εN · −2(2k + 1) ≥ N (1 − ε(8k + 3)), setting k = c1 log 1ε and N = n(1 + c2 ε log 1ε ) with appropriate constants, ≥ n(1 + c2 ε log 1ε )(1 − 8c1 ε log 1ε − 3ε)

Consider the i-th instance of the for loop (line 1). If ≥ n(1 + ε2 ). the i-th transmission is corrupted, ϕ(i) ≥ ϕ(i−1)−2k−1, since at the worst case, 2k + 1 bits were removed from This ensures that the entire transcript of πr,nz is correctly the correct prefix of Trec . Also λ(i) increases by one, simulated by round N .  thus, ρ(i) ≥ ρ(i − 1) − 2(2k + 1). 7 In case the input protocol is not alternating, the next party to speak is determined by πr,nz (x | T F , T R ).

6

Simulation Over an Erasure Channel

We now turn to simulate πr,nz over an erasure channel, BECadv (ε). The simulation is carried on in a similar way to the case of a feedback channel, however for simplicity we work in blocks of size k rather than bit-by-bit. The protocol is split into blocks of size k = Θ(log 1ε ), and when an erasure happens anywhere inside a specific block, the receiver is now aware of this event. The receiver transmits, in the next block, an all-zero string which instructs the parties to rewind the protocol 2k steps back. Note that if a block Bi is received without any erasures, and the next block Bi+1 is not all-zero nor does it contain any erasures, then the receiver is guaranteed that Bi is correct. Thus the receiver can maintain a stack of the recently received blocks and make permanent any block whose consecutive block is non-zero and does not contain any erasures. Unfortunately, this approach can cause the parties to get out-of-sync, if one party (permanently) accepts a block, while the other does not (see Figure 2 for an illustrative example). Fortunately, the difference between the permanently accepted blocks at both sides is at most ±1. To remedy this unsynchronization issue, each all-zero “rewind” request will also contain a 2-bit parity of the length of the current permanent transcript. This allows re-synchronization even in the case of erasures in multiple consecutive blocks (see Figure 3). We formalize the simulation procedure in Algorithm 4, and claim it successfully simulates any alternating protocol with high probability over the BECadv (ε). Theorem 6.1. Let π be a binary alternating protocol. For any input x, y and any small enough ε > 0, Algorithm 4 over a BECadv (ε) simulates the transcript of π(x, y) with probability 1 − 2−Ω(n) . The rate of the simulation is 1 − Θ(H(ε)).

at the beginning of round i: (i) TA (i) = TB (i) is a correct prefix of πr,nz ’s transcript, and (ii) tempA [p + 1] = tempB [p + 1] is the correct next block of πr,nz ’s transcript. Lemma 6.2. If the parties are in sync at round i, and no erasures happen during round i, then at round i + 1 the parties are in steady state. Proof. We distinguish two cases: (1) TA (i) = TB (i) and tempA [p + 1] = tempB [p + 1], and (2) TB (i) = TA (i) ◦ tempA [pA (i) + 1] and temp[pB (i) + 1] = ∅ (or its symmetrical case exchanging the roles of Alice and Bob). The claim trivially holds for case (1). For case (2) both parties simulate the correct block of πr,nz , however Alice stores it in temp[pA (i) + 2] and thus at the end of the round she extends TA by one block (the one in temp[pA (i) + 1] that corresponds to the last block in TB (i)). Bob, on the other hand stores the new information in temp[pB (i) + 1] thus he does not extend TB , and the parties reach a steady state.  Lemma 6.3. Suppose that at the beginning of block i the parties are in steady state. Then, assuming no erasure happens during round i, the parties remain in steady state at round i + 1, and furthermore, |TA (i + 1)| > |TA (i)|. Proof. The claim is immediate from the protocol’s definition: at the beginning of round i the transcript T of both parties is the same, hence pA = pB = p and newA = newB = p + 2. It follows that both parties simulate the block that follows the one in temp[p + 1] (and they simulate it correctly since no erasure happens at round i). At line 18 both parties add temp[p + 1] to T . At the beginning of the next block, p increases by one since the transcript is longer in one block) so it still holds that temp[p + 1] is the (correct) continuation of T . 

We now argue that Algorithm 4 outputs the correct transcript with high probability. We begin by claiming that the simulation progresses correctly when no erasures occur. In the following we denote Alice’s variables with a subscript A, and Bob’s with B. When we say round i, The above immediately suggests that given an we mean the step where the for-loop (line 2) runs its i-th erasure-free channel, the simulation succeeds, i.e., instance. For a variable v we denote by v(i) the state of both parties correctly simulate the entire transcript the variable at the beginning of the i-th round. of πr,nz (x, y).

Definition 6.1. (in sync) We say that the parties are Next we claim that we can recover from a round that in sync at some round i, if during i both parties run contains erasures as long as the next round is erasure-free. line 6 and simulate the same block of πr,nz . That is, if TA ◦ tempA [pA + 1] = TB ◦ tempB [pB + 1], and SendZero = false for both parties. Proposition 6.4. If the parties are in sync, and eraDefinition 6.2. (Steady state) We say that the par- sures happen at round i, then if there is no erasure at ties are in steady state at round i if the following holds round i + 1, the parties are back in sync at round i + 2.

Algorithm 4 Simulation of π over a BECadv (ε) Input: an alternating protocol π of length n, an error parameter ε > 0, and an input x. Set parameters: k = Θ(log 1ε ); N = n(1 + Θ(ε log 1ε )); Let T = (T R , T S ) be the permanent transcript as viewed by the party: T S the sent characters and T R the received characters. temp[0] to temp[3] are temporary chunks of transcript, where temp[i] = (tempS [i], tempR [i]) for sent and received parts. To ease notations, we always consider the address modulo 4, i.e., temp[i] ≡ temp[i mod 4]. Let πr,nz be given by Algorithm 2 on input π with block size k/2. 1: Initialize: SendZero ← false; T ← ∅; temp[0], ..., temp[3] ← ∅ 2: for i = 1 to dN/ke do 3: p ← |T |/k mod 4 4: new ← |T ◦ temp[p + 1]|/k + 1 mod 4 5: 6: 7: 8: 9: 10: 11: 12: 13: 14: 15: 16: 17: 18:

. the parity (in blocks) of the saved transcript . the parity of the next simulated block . (note that temp[p + 1] may be empty)

if SendZero = false then temp[new] ← the next k steps of πr,nz (x | T ◦ temp[p + 1]) else send 0k/2−2 ◦ ((p + 1) mod 4) SendZero ← false if tempR [new] = 0k/2−2 ◦ p0 then temp[p0 ], temp[p0 + 1] ← ∅ if p0 ≡ new mod 4 then SendZero ← true else if temp[new] contains erasures then temp[new] ← ∅ SendZero ← true else if new = p + 2 then T ← T ◦ temp[p + 1]

. during the next k alternating rounds

. Received an all-zero block; rollback according to p0 . Happens only in case of multiple erasures: resend last rollback command . Erasure happened, send the all-zero command

. two consecutive blocks received correctly, . make the first temporary block permanent

Proof. There are three representative cases when the other variables (except for clearing the SendZero parties are in sync (up to changing the roles of Alice flag), and thus they become in sync. and Bob): (1) TA (i) = TB (i) and tempA [p + 1] = tempB [p + 1] = ∅; (2) TB (i) = TA (i) ◦ tempB [pB (i) + 1] Case (2): (2.1 Bob sees erasures): At the end of round i and temp[pB (i) + 1] = ∅; (3) the parties are in steady Bob empties temp[pB (i) + 1] = ∅ and does not state. We examine each case in turn (always starting at change T ; he sets the SendZeroB flag. Alice receives round i). For each one of the cases, we analyze the case an uncorrupt block and adds tempB [pA (i) + 1] to where at round i Alice sees erasures; Bob sees erasures; TA , so now TA = TB , yet they are not in sync since or both parties see erasures. Bob is in SendZero mode and will not simulate the Case (1): next block. (1.1 Only one party (wlog, Alice) sees erasures): At round i + 1 Bob sends the all-zero command with Alice notices the erasure and empties tempA [p + 1] parity pB (i) + 1. After receiving this Alice empties while keeping TA the same. Bob updates tempB [p + tempA [pA (i + 1) + 1] = tempA [pB (i) + 1] and the 1], and the parties are out of sync. At round i + 1 parties are back in sync. Alice sends an all-zero command with parity p + 1. Consequently, Bob performs tempB [p + 1] ← ∅ and (2.2 Alice sees erasures): At the end of round i Bob the parties are back in sync. has an incorrect value at tempB [pB (i) + 1]; Alice (1.2 Both parties see erasures): The parties keep TA and TB unchanged, they set the SendZero flag and empty tempA [p + 1], tempB [p + 1]. At round i + 1 both send an all-zero command, and ignore the incoming message, without changing the

notices an erasure, empties tempA [pA (i)+2] and sets the SendZeroA flag. In the next round Alice sends an all-zero command with parity pA (i) + 1 = pB (i); as a consequence, Bob empties tempB [pB (i) + 1] and the parties are back in sync.

(2.3 Both see erasures): Both parties notice an erasure and empty the most recent temporary block tempA [pA (i) + 2] and tempB [pB (i) + 1], but they are not in sync since both have SendZero flag on (but otherwise it holds that TB (i) = TA (i) ◦ tempA [pA (i) + 1] and temp[pB (i) + 1] = ∅). On the next round, Bob sends an all-zero command with parity pB (i) + 1 and Alice sends an all-zero command with parity pA (i) + 1 = pA (i); Yet, note that they ignore any incoming information in that round, thus at the end of this round they are in sync. Case (3): We begin with the case where only Alice sees erasure at round i and later consider the case that Both Alice and Bob see erasures. In this case, the parties get out of a steady state at round i: Alice notices the erasure and empties tempA [p + 2] while keeping TA and tempA [p + 1] the same, while Bob does not see any erasure and thus adds tempB [p + 1] to T . Note that tempB [p + 1] is indeed correct, yet tempB [p + 2] is not. We denote by p∗ the value of pA (i) = pB (i).

S3 TB = TA ◦ tempA [pA + 1] (where tempA [pA + 1] is nonempty and correct), tempB [pB + 1] = ∅ and SendZeroB = SendZeroA = true. S4 TA = TB , tempA [p + 1] = tempB [p + 1] nonempty and correct, and SendZeroA = SendZeroB = true. Additionally, we consider the following state, that happens when several consecutive blocks contain erasures: S5 TB = TA ◦ tempA [pA + 1], (where tempA [pA + 1] is either empty or correct), tempB [pB (i) + 1] is incorrect and SendZeroB = true. Proposition 6.4 shows that if the system is at state S1–S4, then a single round that contains no erasures gets the parties back in sync. We now show that if the state is S5, then a single erasure-free round will move the system to either S1 or S3 (thus two erasure-free rounds will get the parties back on sync). Lemma 6.5. If at round i the system is at state S5, and no erasure happens, then: if tempA [pA + 1] = ∅ the system moves to S1 at round i + 1, and if tempA [pA + 1] is nonempty (but correct), the system reaches state S3 at round i + 1.

At round i + 1 Alice sends an all-zero command with parity p∗ + 1, signaling that the previous round Proof. Suppose the system is in state S5, and was corrupt. It holds that pA (i) = p∗ , and neither temp [p + 1] = ∅ (thus new = p + 1). Bob sends an A A A A TA nor tempA [p + 1] changes. all-zero command with parity pB + 1 = pA + 1 = newA , At Bob’s side pB (i + 1) = p∗ + 1. Note that and does not change his memory. Alice receives the alltemp[pB (i + 1) + 1] is the incorrect block simulated zero command, and deletes the information received in at the previous round. At the end of this round that round, tempA [pA + 1] = ∅. Note that the received Bob notices that Alice sent an all-zero command, parity p0 = newA thus Alice sets SendZeroA (line 12). and deletes tempB [p∗ + 2] = temp[pB (i + 1) + 1] This implies we are in state S1. (line 11). Now the parties are in sync (both are Suppose the system is in state S5, and tempA [pA +1] about to simulate the block with parity p∗ + 2). is nonempty. Bob sends an all-zero command with parity Finally we consider the case where at round i both pB + 1 = pA + 2. This causes Alice to delete the just Alice and Bob had erasures. Then both empty received (incorrect) temp[pA + 2]. Additionally, since 0 0 temp[p∗ + 2] and set SendZero. On the next round newA = pA + 2 = p where p = pB + 1 is the parity sent they both send the all-zero command with the same by Bob, Alice sets the SendZeroA flag (line 12). This  parity p∗ +1 (yet, this command is ignored by both), implies the system reaches state S3. and at the end of the round they are back in sync.

To complete the proof of correctness, we just need  to show that any sequence of erasures keeps the system in one of the states S1–S5, unless the parties reach sync A careful examination of the proof of Proposition 6.4 or steady state. shows that after a single round that contains erasures, the parties must be in one of the following representative Proposition 6.6. Assume at round i the system is at states: one of the states S1–S5. Then at round i + 1 the system S1 TA = TB , tempA [p+1] = ∅, tempB [p+1] is incorrect is either in one of the states S1–S5, or the parties are in sync. and SendZeroA = true. S2 TB = TA ◦ tempA [pA + 1] (where tempA [pA + 1] is Proof. We already saw that in case there are no erasures nonempty and correct), tempB [pB + 1] is incorrect during round i, the claim holds. We are left to show and SendZeroA = true. that if erasures happen during round i, the scheme goes

i−1

i−1

i

tempA [pA + 1]

i+1

i

i+2

tempA [pA + 1]

TA (i)

block 1

⊥

TB (i)

block 1

block 2

TA (i + 1)

block 1

⊥

TB (i + 1)

block 2

tempB [pB + 1]

000..0

p0 = 1

tempB [pB + 1]

(a) An erasure (denoted by ⊥) occurs at round i at Alice’s side. Bob receives a wrong block, yet he extends his T by one block.

(b) at the round i + 1 the system is in S2. Alice sends an all-zero command; Both Alice and Bob delete the erroneous transmissions.

i−1

i

i+1

tempA [pA + 1]

TA (i + 2)

i+2 tempA [pA + 2]

block 1

⊥

TB (i + 2)

block 2

block 2 000..0

p0 = 1

block 2 tempB [pB + 1]

(c) At round i + 2 the parties are back in sync and simulate the same block. At the end of this round Alice extends T by a single block and the parties return to a steady state.

Figure 2: An illustration of the simulation of Algorithm 4 assuming the parties are in steady state and an erasure happens (at Alice’s side) during round i; It is assumed that pA (i) = pB (i) = 0. The blocks show the received information. to one of the above states. For each one of the states, State S5: (A,AB) Bob sends an all-zero command but we analyze the case where at round i (A) Alice sees Alice sees erasures. She thus empties tempA [pA + 1] erasures; (B) Bob sees erasures; or (AB) both parties and sets SendZeroA . We are now in state S2. (B) see erasures. Bob ignores the incoming transmissions, which is equivalent to the case of no erasures, and we reach State S1: (A) Alice has SendZeroA set, thus she igstate S1 if tempA [pA + 1] = ∅ or state S3 otherwise nores the incoming communication—this is equiv(Lemma 6.5). alent to having no erasures thus the parties get in sync. (B, AB) At round i Alice sends an all-zero  command, however Bob sees erasures. Bob empties tempB [pB + 2] but keeps the erroneous tempB [pB + We are now ready to complete the proof of Theorem 6.1. 1] in memory, and sets the flag SendZeroB . Alice Proof. (Theorem 6.1) The rate of the scheme is n/N = clears SendZeroA . Thus we are in state S5. 1/(1 + Θ(ε log 1ε )) = 1 − Θ(H(ε)). We now show that State S2: Same as state S1. the simulation succeeds with high probability. Let B be the event that |πr,nz | > n(1 + ε2 ), which State S3: In all cases (A, B, and AB) erasures are happens with probability 2−Ωε (n) given the appropriate being ignored since SendZeroA = SendZeroB = choice of parameters (Lemma 4.2). In the following we true. The only difference is that the parties turn assume that B does not happen. off their flags, and now they are in sync. Using Proposition 6.4 we know that a single round State S4: Same as state S3. that contains erasures puts the system in one of the states

i−1

(a) Round i: an erasure (denoted by ⊥) is seen at Alice’s side. Bob receives a wrong block, yet he extends his T by one block.

i

i+1

i+2

i+3

i+1

i+2

i+3

i+2

i+3

tempA [pA + 1]

TA (i)

block 1

⊥

TB (i)

block 1

block 2

tempB [pB + 1]

i−1 (b) At round i + 1 the system is in state S2. Alice sends an allzero command, but an erasure happens at Bob’s side.

i

tempA [pA + 1]

TA (i + 1)

block 1

⊥

000..0 p0 = 1

TB (i + 1)

block 2

⊥

tempB [pB + 1]

(c) At round i + 2 the system is in state S5. Bob sends an all-zero command with parity p0 = 2. Alice gets the allzero command, and sets her SendZeroA flag since the received parity p0 agrees with her current simulated block.

i−1

i

i+1

tempA [pA + 2]

tempA [pA + 1]

TA (i + 2)

block 1

⊥

TB (i + 2)

block 2

000..0

p0 = 2

⊥

tempB [pB + 1]

(d) At round i + 3 the system is back in S2. Alice sends an allzero command with parity p0 = 1 (as done in round i + 1; indeed, Bob did not receive that message). At the end of this round, the system is in a similar situation as in Figure 2(b) and thus by the next round the parties are in back sync.

i−1

i

i+1

i+2

i+3

tempA [pA + 1]

TA (i + 2)

block 1

⊥

TB (i + 2)

block 2 tempB [pB + 1]

000..0 ⊥

p0 = 2

000..0

p0 = 1

tempB [pB + 2]

Figure 3: An illustration of the simulation of Algorithm 4 assuming the parties are in steady state and erasures occur in two consecutive rounds. It is assumed that pA (i) = pB (i) = 0. The blocks show the received information.

S1–S4, from which it takes only one additional erasurefree round to get the parties back in sync. Proposition 6.6 guarantees us that if the system was in states S1–S4 and the next immediate round contains erasures, than the system gets into one of S1–S5 unless it gets back to sync. From S5, we always move back in the next round to S1–S4, regardless of erasures (Proposition 6.6 and Lemma 6.5). It follows that, regardless of the sequence of erasures, it takes two consecutive erasure-free rounds to get the parties back in sync. We also know that if the parties are in sync (but possibly not in a steady state) and no erasure happens, then in the next round they are in a steady state and any consecutive erasure-free round advances the correct transcript T = TA = TB by one block (Lemma 6.3). Note that under no circumstances T holds an incorrect prefix of π. With εN erasures, the amount of rounds that may contain erasures is at most εN , which means that the other N/k − εN rounds are erasure-free. Therefore, N/k − 4εN is a crude lower bound on the amount of erasure-free rounds in which the system is in a steady state, and also a lower bound on the length of T (in blocks of k bits). At the end of the simulation it holds that for both parties |T | ≥ k · ( N k − Θ(εN )) ≥ N (1 − O(kε)) ≥ n(1 + Θ(ε log 1ε ))(1 − O(ε log 1ε )) ≥ n(1 + ε2 ), and both parties correctly simulate the entire transcript of πr,nz , assuming an appropriate choice of constants.  7

Open Problems

communication setting the sender knows a priori all the information to be transmitted and can add redundancy without the need to know the exact positions of erasures; the receiver learns the positions of the erasures and can use the redundancy to fill in the missing information. However, in the interactive setting it is required that erased symbols are quickly corrected to allow the conversation to progress correctly. For example, even in the case where erasures only happen in Alice’s transmissions, there is essentially no way around making Alice aware of whether or not erasures have happened, i.e., whether the conversation can now continue, or should it first be corrected. However, Alice learning the positions of the erasures corresponds to H(ε) bits of information per transmitted bit, resulting in at least that much loss in the rate. 2. Show how to simulate, with rate 1 − O(H(ε)), any protocol with arbitrary, yet predetermined order of speaking, over a BEC(ε). Note that our method of rewinding does not seem to cope with such protocols: since the sender is not aware of erasures, if one party rewinds and the other does not (say, since the rewind command had erasures), then the parties simulate different rounds of the protocol. Due to this unsynchronization, it is possible that both parties always talk at the same rounds, and no further information transfer is possible. 3. What is the best achievable rate for simulating protocols with arbitrary order of speaking over a BSCf adv (ε)? What is the best achievable rate when considering non-robust protocols, either over a BSCf(ε) or a BSCf adv (ε)?

We conclude the paper with several open questions. 1. We have showed that the interactive capacity over the BEC(ε) channel is lower bounded by 1−Θ(H(ε)). We conjecture our rate to be optimal for alternating interactive protocols, despite the fact that the rate of one-way communication over the BEC(ε) channel is 1 − ε.

4. Our simulation technique, in particular the zeroelimination step, requires the use of randomness. Derandomizing this step and more generally finding a deterministic simulation with rate 1 − Θ(H(ε)) over either erasure or feedback channels remains an interesting open problem.

Conjecture 7.1. For a random alternating interactive protocol there is no robust simulation over References the BEC(ε) channel with communication rate larger than 1 − Ω(H(ε)). Differently speaking, the interactive capacity for alternating protocols over the [AGHP92] N. Alon, O. Goldreich, J. Håstad, and R. Peralta. Simple constructions of almost k-wise indepenBEC(ε) and the BECadv (ε), is 1 − Θ(H(ε)). The main difference between the one-way and the [AGS13] interactive setting, that may lead to this conjectured asymptotic gap, is the following. In the one-way

dent random variables. Random Structures & Algorithms, 3(3):289–304, 1992. S. Agrawal, R. Gelles, and A. Sahai. Adaptive protocols for interactive communication. Manuscript, arXiv:1312.4182 (cs.DS), 2013.

[BE14]

[BK12]

[BN13]

[BR11]

[BTT13]

[CPT13]

[EGH15]

[FGOS13]

[GH14]

[GHS14]

[Gil52]

[GMS11]

[GMS14]

[GSW14]

M. Braverman and K. Efremenko. List and unique coding for interactive communication in the presence of adversarial noise. In Proceedings of the IEEE Symposium on Foundations of Computer Science, FOCS ’14, 2014. Z. Brakerski and Y. T. Kalai. Efficient interactive coding against adversarial noise. Proceedings of the IEEE Symposium on Foundations of Computer Science, pages 160–166, 2012. Z. Brakerski and M. Naor. Fast algorithms for interactive coding. In Proceedings of the ACMSIAM Symposium on Discrete Algorithms, SODA ’13, pages 443–456, 2013. M. Braverman and A. Rao. Towards coding for maximum errors in interactive communication. In Proceedings of the ACM Symposium on Theory of Computing, STOC ’11, pages 159–166, 2011. G. Brassard, A. Tapp, and D. Touchette. Noisy interactive quantum communication, 2013. ArXiv eprint:1309.2643 [quant-ph]. K.-M. Chung, R. Pass, and S. Telang. Knowledgepreserving interactive coding. In Proceedings of the IEEE Symposium on Foundations of Computer Science, FOCS ’13, pages 449–458, 2013. K. Efremenko, R. Gelles, and B. Haeupler. Maximal noise in interactive communication over erasure channels and channels with feedback. In Proceedings of the 6th Conference on Innovations in Theoretical Computer Science, ITCS ’15, pages 11–20, 2015. M. Franklin, R. Gelles, R. Ostrovsky, and L. J. Schulman. Optimal coding for streaming authentication and interactive communication. In Advances in Cryptology – CRYPTO 2013, volume 8043 of LNCS, pages 258–276. Springer, 2013. M. Ghaffari and B. Haeupler. Optimal Error Rates for Interactive Coding II: Efficiency and List Decoding. In Proceedings of the IEEE Symposium on Foundations of Computer Science, FOCS ’14, 2014. M. Ghaffari, B. Haeupler, and M. Sudan. Optimal Error Rates for Interactive Coding I: Adaptivity and Other Settings. In Proceedings of the ACM Symposium on Theory of Computing, STOC ’14, pages 794–803, 2014. E. N. Gilbert. A comparison of signalling alphabets. Bell System Technical Journal, 31(3):504– 522, 1952. R. Gelles, A. Moitra, and A. Sahai. Efficient and explicit coding for interactive communication. In Proceeding of the IEEE Symposium on Foundations of Computer Science, FOCS ’11, pages 768–777, 2011. R. Gelles, A. Moitra, and A. Sahai. Efficient coding for interactive communication. Information Theory, IEEE Transactions on, 60(3):1899–1913, March 2014. R. Gelles, A. Sahai, and A. Wadia. Private

[Hae14]

[KR13]

[NN93]

[Pan13]

[Sch92]

[Sch93]

[Sch96]

[Sha48]

[Sha56]

[Var57]

interactive communication across an adversarial channel. In Proceedings of the Conference on Innovations in Theoretical Computer Science, ITCS ’14, pages 135–144. ACM, 2014. B. Haeupler. Interactive Channel Capacity Revisited. In Proceedings of the IEEE Symposium on Foundations of Computer Science, FOCS ’14, 2014. G. Kol and R. Raz. Interactive channel capacity. In Proceedings of the ACM Symposium on Theory of Computing, STOC ’13, pages 715–724, 2013. J. Naor and M. Naor. Small-bias probability spaces: Efficient constructions and applications. SIAM Journal on Computing, 22(4):838–856, 1993. D. Pankratov. On the power of feedback in interactive channels. [Online:] http://people.cs.uchicago.edu/~pankratov/ papers/feedback.pdf, 2013. L. J. Schulman. Communication on noisy channels: a coding theorem for computation. Foundations of Computer Science, Annual IEEE Symposium on, pages 724–733, 1992. L. J. Schulman. Deterministic coding for interactive communication. In Proceedings of the ACM Symposium on Theory of Computing, STOC ’93, pages 747–756, 1993. L. J. Schulman. Coding for interactive communication. IEEE Transactions on Information Theory, 42(6):1745–1756, 1996. C. E. Shannon. A mathematical theory of communication. ACM SIGMOBILE Mobile Computing and Communications Review, 5(1):3–55, 2001. Originally appeared in Bell System Tech. J. 27:379–423, 623–656, 1948. C. E. Shannon. The zero error capacity of a noisy channel. Information Theory, IRE Transactions on, 2(3):8–19, September 1956. R. R. Varshamov. Estimate of the number of signals in error correcting codes. In Dokl. Akad. Nauk SSSR, volume 117, pages 739–741, 1957.

Appendix A

Simulation over Channels with Feedback: a rate comparison

In this section we give a precise analysis of the best possible rate obtained when simulating an interactive protocol over a feedback channel BSCf adv (ε), using the approach of Algorithm 3. We then compare the obtained rate with two other related simulations: the GilbertVarshamov (existential) code for correcting up to εfraction of bit flips, and a simulation for interactive protocols over a BSCf adv (ε) by Pankratov [Pan13]. We begin with a precise analysis of the rate we achieve in our simulation (Algorithm 3). For a given parameter k, the length of our simulation is dominated

trivial changes) works even when π does not have alternating rounds, as long as both parties speak at least k times during each O(k)-bit long block. This where the first term is due to the zero-elimination,8 and enables each party to initiate a rewinding of an incorrect the second is due to “wasting” 2k + 1 steps per error,9 transmission with at most O(k) rounds of delay. and assuming ε is the maximal fraction of errors. For any specific error rate ε we can choose k ∈ N that maximizes Corollary B.1. For any input x, y and any small the rate n/N . This gives a maximal rate of enough ε > 0, Algorithm 3 over a BSCfadv (ε) simulates the transcript of π(x, y) with probability 1 − 2−Ω(n) , for n 1 − ε(2k + 1) . r[Alg. 3] = = max any protocol π in which each party talks Ω(log 1ε ) of k∈N N 1 + 2−k+1 the rounds in any O(log 1ε )-long block. The rate of the We compare our obtained rate to two other coding simulation is 1 − Θ(H(ε)). schemes. First is a simulation for interactive communication over a feedback channel by Pankratov √ [Pan13] B.2 Simulating any robust protocol over which asymptotically obtains a rate of 1 − O( ε). The a BSCf(ε). In this section we show that the above conmain idea in [Pan13] is to run π for k rounds, after which straint of semi-alternating order of speaking can be lifted each party sends a single bit to indicate if the transcript given the errors are random, and as long as the party so far is correct or not. In case there is an error, the that speaks at round i in the original protocol is deterprotocol rewinds 2(k + 2) steps. Thus, assuming ε is the mined by the protocol regardless of the transcript. Such maximal fraction of bit flips, the expansion is given by protocols are called robust. by

N ≥ n(1 + 2−k+1 ) + εN (2k + 1),

N ≥ n + 2n/k + εN (2k + 4),

Definition B.1. (robust protocols [BR11]) We say that an interactive protocol π is robust if (i) for all where the term 2n/k is due to adding 2 bits every k steps, inputs, the protocol runs for n rounds; (ii) at any round, and the last term is the amount of rounds rewinded it is predetermined which party speaks (independent of throughout the simulation. Again, for any given ε we input and noise) can optimize k to maximize the rate r[Pan] =

n 1 − ε(2k + 4) = max . k∈N N 1 + 2/k

Our main result in this section is a coding scheme for any robust protocol π that achieves rate 1 − Θ(H(ε)) over a BSCf(ε).

Finally, we compare our scheme to the rate implied by the Gilbert-Varshmov bound [Gil52, Var57], for a Theorem B.2. For any small enough ε > 0, any code that can correct any ε-fraction of bit-flips (in the robust protocol π can be simulated over a BSCf(ε) with one-way communication setting), probability 1 − 2−Ωε (n) , and rate 1 − Θ(H(ε)). r[GV ] = 1 − H(2ε). We plot the above three rates in Figure 1. B

Simulation with Feedback: extension to non-alternating protocols

B.1 Simulating semi-alternating protocols over a BSCf adv (ε). The Simulation of Algorithm 3 (with 8 In order to optimize the constant, we cannot work in “blocks” of size k, but rather we should work in a bit-by-bit manner. While Algorithm 3 is written in a bit-by-bit manner, the zero-elimination in Algorithm 1 should be converted into a non-blocked version, in which a ‘1’ is added after every k − 1 consecutive zeros, regardless of the block alignment. The expected amount of added ones is at most 2−(k−1) · n using a union bound, assuming the transcript is uniform. 9 Each corruption causes a delay of 2k + 1 rounds: (i) k zeros are sent to indicate that an error has happened; (ii) during that time the other party sends k bits (which are incorrect); (iii) the bit that was corrupted needs to be re-simulated.

The simulation process is similar to Algorithm 3. The only difference emerges from the following issue: it is possible that the order of speaking in π is such that Alice speaks a single bit and then Bob speaks for a long time. If an error occurs during Alice’s transmission, she will be able to inform Bob about this error only when she is to speak again. Yet, it is possible that it takes many rounds until it is Alice’s turn to speak, and all those rounds are incorrect and should be re-simulated. Although this has no effect on the expected amount of rounds that will be rewinded, the length of the simulation has a large variance and we are no longer guaranteed to complete the simulation with high probability after |π|(1 + Θ(H(ε))) rounds. To remedy this issue we add two “void” simulation rounds every 1/H(ε) rounds of π: one round in which Alice is the sender and another one for Bob. This allows a party to communicate an all-zero command within O(1/ε) rounds, even if the other party has the right of speak in π.

Proof. We begin by showing that the expected ex- Hoeffding’s bound, we have that for any δ > 0 pansion when running Algorithm 3 over a BSCf(ε) "i # max X is 1 + O(H(ε)). Then, we show that adding a chance max Pr 1i (ri + k) > (1 + δ) · N H(ε) for both parties to speak every 1/H(ε) rounds makes O i=1 the expansion concentrated around its expectation.   2i2max δ 2 This implies that running the simulation for N = = max exp − O imax k 2 /H(ε)2 n(1 + Θ(H(ε))) rounds succeeds in simulating the entire   transcript of π with high probability. 2N H(ε)3 δ 2 ≤ exp − Let ri be the amount of bits Bob sends between the k2 3 2 i-th bit sent by Alice and the i + k bit sent by Alice < 2−Ω(ε δ N ) . in the simulation. The maximal expected number of rounds rewinded due to noise in Alice’s transmissions is Hence, except with exponentially small probability in |π| = n, running the simulation for n(1 + Θ(H(ε))) X rounds correctly simulates the entire transcript of π.  (B.1) max ε[r + k], O

i

i

where the maximum is taken over all possible orders of speaking O, that Alice and Bob may have in π. Denote bi the amount of bits Bob sends between the i-th bit of Alice Pk−1 and the i + 1 bit of Alice, we can rewrite ri = j=0 bj+i . Assume that, given a specific order of speaking O, Alice speaks imax bits, and let bj = 0 for any j > imax . Pimax Note that i=1 bi = N − imax . The maximal expected backtracking (B.1) can thus be rewritten as,

max O

iX max k−1 X i=1 j=0

εbj+i +

iX max

εk.

i=1

Changing the order of summation and ignoring the inconsistency in first and last k b’s (those can add at most another ≈ 2εk 2 (1/ε) = O(1) rounds), the expected backtracking is bounded by max εk(N − imax ) + εk · imax = N · ε log 1ε O

additional rounds per user, regardless to the order of speaking O. Finally, we show that adding, every 1/H(ε) rounds, a “void” round in which Alice can speak, makes the amount of needed rewinding concentrated around its expectation. Specifically, in this case, for any order of speaking O, Alice speaks in at least imax ≥ N · H(ε) rounds. Also note that for any i it holds that ri ≤ (k − 1)/H(ε). Let 1i be the indicator of a bit-flip occurring at Alice’s i-th bit; those are i.i.d Bernoullis with E[1i ] = ε. It follows that for any i, it holds that 0 ≤ 1i (ri + k) ≤ (k − 1)/H(ε) + k, hand the analysisiabove shows that Pimax that for any O, E i=1 1i (ri + k) ≤ N H(ε). Using

Remark: We note that the above method of simulation does not seem to achieve a good rate if the protocol π is not robust, that is, when its order of speaking depends on the noise. To see that, assume a protocol π in which the parties exchange (long) messages of varying length, unknown in advance. To this end, every odd bit is an information bit, while every even bit is a ‘0’ if the there are more information bits to send and a ‘1’ if the current message is complete. After a ‘1’ is communicated the “right to speak” goes to the other party, who encodes its message in a similar way. This is repeated until the protocol concludes. If an error happens in an even bit, π grants the right to speak to the other user, which means that the simulation will recover only after k/H(ε) ≈ 1/ε rounds. This implies a constant rate which is bounded away from one regardless of the noise ε.