Two prover perfect zero knowledge for MIP*

In an interactive proof protocol, a prover tries to convince a verifier that a string $x$ belongs to $\mathcal{L}$. Interactive proof systems can be more powerful than non-interactive systems; famously, the class $\operatorname{IP}$ of interactive proofs with a polynomial time verifier and a single prover is equal to $\operatorname{PSPACE}$ [Sha92], and the class $\operatorname{MIP}$ with a polynomial time verifier and multiple provers is equal to $\operatorname{NEXP}$ [BFL90]. In this latter class, the provers can communicate with the verifier, but are assumed not to be able to communicate with each other. The proof systems used in [BFL90] are very efficient, and require only two provers and one-round of communication. Interactive proof systems also allow zero knowledge protocols, in which the prover demonstrates that $x\in\mathcal{L}$ without revealing any other information to the verifier. As a result, interactive proof systems are important to both complexity theory and cryptography. The first zero knowledge proof systems go back to the invention of interactive proof systems by Goldwasser, Micali, and Rackoff [GMR85], and every language in MIP admits a two-prover one-round perfect zero knowledge proof system by a result of Ben-Or, Goldwasser, Kilian, and Wigderson [BOGKW88]. Perfect means that absolutely no information is revealed to the verifier, in contrast to statistical zero knowledge (in which the amount of knowledge gained by the verifier is small but bounded), or computational zero knowledge (in which zero knowledge relies on some computational intractability assumption).

Since the provers in a MIP protocol are not allowed to communicate, it is natural to ask what happens if they are allowed to share entanglement. This leads to the complexity class $\operatorname{MIP}^{*}$, first introduced by Cleve, Hoyer, Toner, and Watrous [CHTW04]. Entanglement allows the provers to break some classical proof systems by coordinating their answers, but the improved ability of the provers also allows the verifier to set harder tasks. As a result, figuring out the power of $\operatorname{MIP}^{*}$ has been difficult, and there have been successive lower bounds in [KKM⁺11, IKM09, IV12, Vid16, Vid20, Ji16, NV18b, Ji17, NV18a, FJVY19]. Most recently (and spectacularly), Ji, Natarajan, Vidick, Wright, and Yuen showed that $\operatorname{MIP}^{*}=\operatorname{RE}$, the class of languages equivalent to the halting problem [JNV⁺22b]. Reichardt, Unger, and Vazirani also showed that $\operatorname{MIP}^{*}$ is equal to the class $\operatorname{QMIP}^{*}$, in which the verifier is quantum, and can communicate with the provers via quantum channels [RUV13]. On the perfect zero knowledge front, Chiesa, Forbes, Gur, and Spooner showed that every language in $\operatorname{NEXP}$ (and hence in classical $\operatorname{MIP}$) has a perfect zero knowledge $\operatorname{MIP}^{*}$ proof system, or in other words belongs to $\operatorname{PZK}$-$\operatorname{MIP}^{*}$ [CFGS22]. Grilo, Slofstra, and Yuen show that all of $\operatorname{MIP}^{*}$ belongs to $\operatorname{PZK}$-$\operatorname{MIP}^{*}$ [GSY19].

Combining $\operatorname{PZK}$-$\operatorname{MIP}^{*}=\operatorname{MIP}^{*}$ with $\operatorname{MIP}^{*}=\operatorname{RE}$ shows that there are one-round perfect zero-knowledge $\operatorname{MIP}^{*}$ proof systems for all languages that can be reduced to the halting problem, a very large class. However, the construction in [GSY19] is involved. The idea behind the proof is to encode a circuit for an arbitrary $\operatorname{MIP}$ verifier in a “simulatable” quantum error correcting code, and then hide information from the verifier by splitting the physical qubits of this code between different provers. The resulting proof systems in [GSY19] require $6$ provers, and because the core concept of the proof is to split information between provers, bringing this down to $2$ provers (as can be done with perfect zero-knowledge for $\operatorname{MIP}$) seems to require new ideas.

The purpose of this paper is to show that all languages in $\operatorname{MIP}^{*}$ do indeed have two-prover one-round perfect zero knowledge proof systems. Specifically, we show that:

The idea behind the proof is to use the output of the $\operatorname{MIP}^{*}=\operatorname{RE}$ theorem, rather than encoding arbitrary $\operatorname{MIP}^{*}$-protocols. The proof that $\operatorname{MIP}^{*}=\operatorname{RE}$ in [JNV⁺22b] is very difficult, but requires only two-prover one-round proof systems. Natarajan and Zhang have sharpened the proof to show that these proof systems require only a constant number of questions, and $\operatorname{polylog}$ length answers from the provers [NZ23]. This shows that $\operatorname{MIP}^{*}=\operatorname{AM}^{*}(2)$, the complexity class of languages with two-prover $\operatorname{MIP}^{*}$-protocols in which the verifier chooses their messages to the prover uniformly at random. A one-round $\operatorname{MIP}$ or $\operatorname{MIP}^{*}$ proof system is equivalent to a family of nonlocal games, in which the provers (now also called players) are given questions and return answers to a verifier (now also called a referee), who decides whether to accept (in which case the players are said to win) or reject (the players lose). In both [JNV⁺22b] and [NZ23], the games are synchronous, meaning that if the players receive the same question then they must reply with the same answer, and admit what are called oracularizable strategies. As we observe in this paper, one-round $\operatorname{MIP}^{*}$ proof systems in which the games are synchronous and oracularizable are equivalent to the class of $\operatorname{BCS}$-$\operatorname{MIP}^{*}$ proof systems, which are one-round two-prover proof systems in which the nonlocal games are boolean constraint system (BCS) games. In a boolean constraint system, two provers try to convince the verifier that a given BCS is satisfiable. BCS games were introduced by Cleve and Mittal [CM14], and include famous examples of nonlocal games such as the Mermin-Peres magic square [Mer90, Per90]. Boolean constraint systems are much easier to work with than general $\operatorname{MIP}^{*}$ protocols, so rather than showing that every $\operatorname{MIP}^{*}$ protocol can be transformed to a perfect zero knowledge protocol, we prove Theorem 1.1 by showing that every $\operatorname{BCS}$-$\operatorname{MIP}^{*}$ protocol can be transformed to a perfect zero knowledge protocol. As we explain at the end of Section 2, when combined with the $\operatorname{MIP}^{*}=\operatorname{RE}$ theorem this gives an effective way to transform any $\operatorname{MIP}^{*}$-protocol (including protocols with many provers and rounds) into a perfect zero knowledge $\operatorname{BCS}$-$\operatorname{MIP}^{*}$ protocol.

One way to transform a $\operatorname{BCS}$-$\operatorname{MIP}^{*}$ protocol to a perfect zero-knowledge protocol is to use graph colouring games, which are famous examples of perfect zero knowledge games. Classically, every BCS instance can be transformed to a graph such that the graph is $3$-colourable if and only if the BCS is satisfiable. Ji has shown that every BCS can be transformed to a graph such that the original BCS game has a perfect quantum strategy if and only if the $3$-colouring game for the graph has a perfect quantum strategy [Ji13] (see also [Har23]). Using the techniques in this paper, it is also possible to show that this transformation preserves soundness of $\operatorname{BCS}$-$\operatorname{MIP}^{*}$ protocols, and hence that every $\operatorname{BCS}$-$\operatorname{MIP}^{*}$ protocol can be transformed to a $\operatorname{MIP}^{*}$ protocol based on graph colouring games. Unfortunately graph colouring games are only perfect zero knowledge against honest verifiers, so this construction does not give a perfect zero knowledge protocol for dishonest verifiers. Instead, we use another classical transformation due to Dwork, Feige, Kilian, Naor, and Safra [DFK⁺92], which takes every 3SAT instance to a perfect zero-knowledge $\operatorname{MIP}$ protocol. We show that a modest variant of this construction remains perfect zero knowledge in the quantum setting, and preserves soundness of $\operatorname{BCS}$-$\operatorname{MIP}^{*}$ protocols. In both the original argument and our argument, it is necessary for soundness to work with $\operatorname{BCS}$-$\operatorname{MIP}$ protocols with small (meaning $\log$ or $\operatorname{polylog}$) question length. In the classical setting, $\operatorname{BCS}$-$\operatorname{MIP}$ with $\log$ question length is equal to $\operatorname{NP}$, so the construction in [DFK⁺92] only shows that $\operatorname{NP}$ is contained in $\operatorname{PZK}$-$\operatorname{MIP}$, rather than all of $\operatorname{NEXP}$. In the quantum setting, $\operatorname{BCS}$-$\operatorname{MIP}^{*}$ with $\operatorname{polylog}$ question length is equal to $\operatorname{MIP}^{*}$ and this construction suffices to prove perfect zero knowledge for any $\operatorname{MIP}^{*}$ protocol — an interesting difference in what techniques can be used between the classical and quantum setting.

In general, it’s a difficult question to figure out if a classical transformation of constraint systems (of which there are many) remains sound (meaning that it preserves soundness of protocols) in the quantum setting. For instance, one of the key parts of the $\operatorname{MIP}^{*}=\operatorname{RE}$ theorem is the construction of PCP of proximity which is quantum sound. On the other hand, there are some transformations which lift fairly easily to the quantum setting. We identify two such classes of transformations, “classical transformations” which are applied constraint by constraint, and “context subdivision transformations”, in which each constraint is split into a number of subclauses. Both types of transformations are used implicitly throughout the literature on nonlocal games, including in [Ji13], which was the first paper to consider reductions between quantum strategies in BCS games. In this paper, we systematically investigate the quantum soundness of these transformations. It’s relatively easy to show that classical transformations preserve soundness, and this is shown in Section 5. In subdivision, each subclause becomes a different question in the associated BCS game, and thus a strategy for the subdivided game has many more observables than the original game. Since these new observables don’t need to commute with each other, subdivision is more difficult to work with. Nonetheless, we show that if the subclauses have a bounded number of variables, then subdivision preserves soundness with a polynomial dropoff. This is shown in Section 6. The construction in [DFK⁺92] can be described as a composition of classical transformations and context subdivision transformations, so quantum soundness (with polynomial dropoff) of this construction follows from combining the soundness of these two transformations. We recover a constant soundness gap by using parallel repetition, which preserves the class of BCS games.

While reductions between nonlocal games have been important in previous work, they are difficult to reason about, since it’s necessary to keep track of how strategies for one game map to strategies for the other game. One advantage of working with constraint systems in the classical setting is that it’s more convenient to work with assignments (and think about the fraction of constraints in the system that can be satisfied) than it is to work with strategies and winning probabilities. In the quantum setting, it isn’t possible to work with assignments, because strategies involve observables that don’t necessarily commute with each other. However, we can achieve a similar conceptual simplification by replacing assignments with representations of the BCS algebra of the constraint system. This algebra is the same as the synchronous algebra of the BCS game introduced in [HMPS19, KPS18]; we refer to [PS23] for more background. With this approach, reductions between BCS games can be expressed as homomorphisms between BCS algebras, and these are much easier to describe and work with than mappings between strategies. For soundness arguments, we need to work with near-perfect strategies, and these correspond to approximate representations of the BCS algebra [Pad22]. Previous work using this idea (see e.g. [Pad22, Har23]) has focused on reductions between single games, and the definitions are not suitable for working with protocols, as they do not incorporate question distributions. To solve this problem, we introduce a notion of weighted algebras and weighted homomorphisms, which allows us to keep track of soundness of reductions between games using completely algebraic arguments involving sums of squares.

Another advantage of the weighted algebras framework is that arguments can be made simultaneously for both quantum and commuting operator strategies. Our proof methods extend to commuting operator strategies as a result. However, our results here are not as conclusive, as the exact characterization of the corresponding complexity class $\operatorname{MIP}^{co}$ is not known. There is a conjecture that $\operatorname{MIP}^{co}=\operatorname{coRE}$, and with that conjecture and a parallel repetition theorem for commuting operator strategies, we expect that it would be possible to extend Theorem 1.1 to show that all languages in $\operatorname{MIP}^{co}$ have a perfect zero knowledge commuting operator protocol. Without these ingredients, we are limited to showing that $\operatorname{BCS}$-$\operatorname{MIP}^{co}=\operatorname{PZK}$-$\operatorname{BCS}$-$\operatorname{MIP}^{co}$. Previous work on perfect zero knowledge for commuting operator protocols does not preserve soundness gaps [CS19].

Our results also have applications for the membership problem for quantum correlations. For exact membership, the cohalting problem is many-one reducible to membership in the set of quantum-approximable correlations $C_{qa}$, and to membership in the set of commuting operator correlations $C_{qc}$ [Slo19, CS19, FMS21]. It follows from $\operatorname{MIP}^{*}=\operatorname{RE}$ that the halting problem is Turing reducible to approximate membership in $C_{q}$, the set of quantum correlations, but this is not a many-one reduction. Theorem 1.1 immediately implies that there is a many-one reduction from the halting problem to approximate membership in $C_{q}$.

Because we use parallel repetition to reduce an inverse-polynomial soundness gap to a constant soundness gap, the protocols in Theorem 1.1 use polynomial length questions and answers. If an inverse-polynomial soundness gap is allowed, we get perfect zero-knowledge protocols with $\operatorname{polylog}$ question length and constant answer length. Whether it is possible to get perfect zero-knowledge protocols with $\operatorname{polylog}$ question length, constant answer length, and constant soundness gap is an interesting open question. This would be possible with an improved analysis or construction for subdivision such as appears in the low degree test [JNV⁺22a] used in the $\operatorname{MIP}^{*}=\operatorname{RE}$ theorem.

A two-player nonlocal (or Bell) scenario consists of a finite set of questions $I$, and a collection of finite answer sets $(O_{i})_{i\in I}$. Often in this definition there are separate question and answer sets for each player, but it’s convenient for us to assume that both players have the same question and answer sets, and we don’t lose any generality by assuming this. We often think of the question and answer sets as being subsets of $\{0,1\}^{n}$ and $\{0,1\}^{m_{i}}$, $i\in I$ respectively, in which case we say that the questions have length $n$ and the answers have length $\max_{i\in I}m_{i}$. A nonlocal game consists of a nonlocal scenario $(I,(O_{i})_{i\in I})$, along with a probability distribution $\pi$ on $I\times I$ and a family of functions $V(\cdot,\cdot|i,j):O_{i}\times O_{j}\to\{0,1\}$ for $(i,j)\in I\times I$. In the game, the players (commonly called Alice and Bob) receive questions $i$ and $j$ from $I$ with probability $\pi(i,j)$, and reply with answers $a\in O_{i}$ and $b\in O_{j}$ respectively. They win if $V(a,b|i,j)=1$, and lose otherwise.

A correlation for scenario $(I,\{O_{i}\}_{i\in I})$ is a family $p$ of probability distributions $p(\cdot,\cdot|i,j)$ on $O_{i}\times O_{j}$ for all $(i,j)\in I\times I$. Correlations are used to describe the players’ behaviour in a nonlocal scenario. The probability $p(a,b|i,j)$ is interpreted as the probability that the players answer $(a,b)$ on questions $(i,j)$. A correlation $p$ is quantum if there are

1. (a)

   finite-dimensional Hilbert spaces $H_{A}$ and $H_{B}$,

2. (b)

   a projective measurement $\{M^{i}_{a}\}_{a\in O_{i}}$ on $H_{A}$ for every $i\in I$,

3. (c)

   a projective measurement $\{N^{i}_{a}\}_{a\in O_{i}}$ on $H_{B}$ for every $i\in I$, and

4. (d)

   a state $\ket{v}\in H_{A}\otimes H_{B}$

such that $p(a,b|i,j)=\braket{v}{M^{i}_{a}\otimes N^{j}_{b}}{v}$ for all $i,j\in I$, $a\in O_{i}$, $b\in O_{j}$. A collection $(H_{A},H_{B},\{M^{i}_{a}\},\{N^{i}_{a}\},\ket{v})$ as in (a)-(d) is called a quantum strategy. A correlation $p$ is commuting operator if there is

1. (i)

   a Hilbert space $H$,

2. (ii)

   projective measurements $\{M^{i}_{a}\}_{a\in O_{i}}$ and $\{N^{i}_{a}\}_{a\in O_{i}}$ on $H$ for every $i\in I$, and

3. (iii)

   a state $\ket{v}\in H$

such that $M^{i}_{a}N^{j}_{b}=N^{j}_{b}M^{i}_{a}$ and $p(a,b|i,j)=\braket{v}{M^{i}_{a}N^{j}_{b}}{v}$ for all $i,j\in I$ and $a\in O_{i}$, $b\in O_{j}$. A collection $(H,\{M^{i}_{a}\},\{N^{i}_{a}\},\ket{v})$ as in (i)-(iii) is called a commuting operator strategy. The set of quantum correlations for a scenario $(I,\{O_{i}\})$ is denoted by $C_{q}(I,\{O_{i}\})$, and the set of commuting operator correlations is denoted by $C_{qc}(I,\{O_{i}\})$. If the scenario is clear from context, then we denote these sets by $C_{q}$ and $C_{qc}$. Any quantum correlation is also a commuting operator correlation, so $C_{q}\subseteq C_{qc}$. If a commuting operator correlation has a commuting operator strategy on a finite-dimensional Hilbert space $H$, then it is also a quantum correlation, but in general $C_{qc}$ is strictly larger than $C_{q}$.

The winning probability of a correlation $p$ in a nonlocal game $\mathcal{G}=(I,\{O_{i}\},\pi,V)$ is

The quantum value of $\mathcal{G}$ is

and the commuting operator value is

A correlation $p$ is perfect for $\mathcal{G}$ if $\omega(\mathcal{G};p)=1$, and $\epsilon$-perfect if $\omega(\mathcal{G};p)\geq 1-\epsilon$. A strategy is $\epsilon$-perfect if its corresponding correlation is $\epsilon$-perfect. The set $C_{qc}$ is closed and compact, so $\mathcal{G}$ has a perfect commuting operator correlation if and only if $\omega_{qc}(\mathcal{G})=1$. However, $C_{q}$ is not necessarily closed, and there are games $\mathcal{G}$ with $\omega_{q}(\mathcal{G})=1$ which do not have a perfect quantum correlation. A correlation $p$ is quantum approximable if it belongs to the closure $C_{qa}:=\overline{C_{q}}$, and a game $\mathcal{G}$ has a perfect quantum approximable correlation if and only if $\omega_{q}(\mathcal{G})=1$.

A nonlocal game $\mathcal{G}=(I,\{O_{i}\},\pi,V)$ is synchronous if $V(a,b|i,i)=0$ for all $i\in I$ and $a\neq b\in O_{i}$. A correlation $p$ is synchronous if $p(a,b|i,i)=0$ for all $i\in I$ and $a\neq b\in O_{i}$. The set of synchronous quantum (resp. commuting operator) correlations is denoted by $C_{q}^{s}$ (resp. $C_{qc}^{s}$). A correlation $p$ belongs to $C_{qc}^{s}$ (resp. $C_{q}^{s}$) if and only if there is

1. (A)

   a Hilbert space $H$ (resp. finite-dimensional Hilbert space $H$),

2. (B)

   a projective measurement $\{M^{i}_{a}\}_{a\in O_{i}}$ on $H$ for all $i\in I$, and

3. (C)

   a state $\ket{v}\in H$

such that $\ket{v}$ is tracial, in the sense that $\braket{v}{\alpha\beta}{v}=\braket{v}{\beta\alpha}{v}$ for all $\alpha$ and $\beta$ in the $*$-algebra generated by the operators $M^{i}_{a}$, $i\in I$, $a\in O_{i}$, and $p(a,b|i,j)=\braket{v}{M^{i}_{a}M^{j}_{b}}{v}$ for all $i,j\in I$, $a\in O_{i}$, $b\in O_{j}$. A collection $(H,\{M^{i}_{a}\},\ket{v})$ as in (A)-(C) is called a synchronous commuting operator strategy. If, in addition, $H$ is finite-dimensional, then $(H,\{M^{i}_{a}\},\ket{v})$ is also called a synchronous quantum strategy. The synchronous quantum and commuting operator values $\omega_{q}^{s}(\mathcal{G})$ and $\omega_{qc}^{s}(\mathcal{G})$ of a game $\mathcal{G}$ are defined equivalently to $\omega_{q}(\mathcal{G})$ and $\omega_{qc}(\mathcal{G})$, but with $C_{q}$ and $C_{qc}$ replaced by $C_{q}^{s}$ and $C_{qc}^{s}$. A synchronous strategy $(H,\{M^{i}_{a}\},\ket{v})$ for a game $\mathcal{G}=(I,\{O_{i}\},\pi,V)$ is oracularizable if $M^{i}_{a}M^{j}_{b}=M^{j}_{b}M^{i}_{a}$ for all $i,j\in I$, $a\in O_{i}$, $b\in O_{j}$ with $\pi(i,j)>0$.

A theorem of Vidick [Vid22] (see also [Pad22]) states that every quantum correlation which is close to being synchronous, in the sense that $p(a,b|i,i)\approx 0$ for all $i\in I$ and $a\neq b\in O_{i}$, is close to a synchronous quantum correlation. This theorem has been extended to commuting operator correlations by [Lin23]. As a result, the synchronous quantum and commuting values of a game are polynomially related to the non-synchronous quantum and commuting values. We use a version of this result due to Marrakchi and de la Salle [MdlS23]. Following [MdlS23], say that a probability distribution on $I\times I$ is $C$-diagonally dominant if $\pi(i,i)\geq C\sum_{j\in I}\pi(i,j)$ and $\pi(i,i)\geq C\sum_{j\in I}\pi(j,i)$ for all $i\in I$. Then:

A two-prover one-round $\operatorname{MIP}$ protocol is a family of nonlocal games $\mathcal{G}_{x}=(I_{x},\{O_{xi}\}_{i\in I_{x}},\pi_{x},V_{x})$ for $x\in\{0,1\}^{*}$, along with a probabilistic Turing machine $S$ and another Turing machine $V$, such that

• •

  for all $x\in\{0,1\}^{*}$ and $i\in I_{x}$, there are integers $n_{x}$ and $m_{xi}$ such that $I_{x}=\{0,1\}^{n_{x}}$ and $O_{xi}=\{0,1\}^{m_{xi}}$,

• •

  on input $x$, the Turing machine $S$ outputs $(i,j)\in I\times I$ with probability $\pi_{x}(i,j)$, and

• •

  on input $(x,a,b,i,j)$, the Turing machine $V$ outputs $V_{x}(a,b|i,j)$.

Let $c,s:\{0,1\}^{*}\to\mathbb{Q}$ be computable functions with $c(x)>s(x)$ for all $x\in\{0,1\}^{*}$. A language $\mathcal{L}\subset\{0,1\}^{*}$ belongs $\operatorname{MIP}^{*}(2,1,c,s)$ if there is a MIP protocol $(\{\mathcal{G}_{x}\},S,V)$ such that $n_{x}$ and $m_{xi}$ are polynomial in $|x|$, $S$ and $V$ run in polynomial time in $|x|$, if $x\in\mathcal{L}$ then $\omega_{q}(\mathcal{G}_{x})\geq c$, and if $x\not\in\mathcal{L}$ then $\omega_{q}(\mathcal{G}_{x})\leq s$. The function $c$ is called the completeness probability, and $s$ is called the soundness probability. The functions $n_{x}$ and $m_{xi}$ are called the question length and answer length respectively. The class $\operatorname{MIP}^{co}(2,1,c,s)$ is defined equivalently to $\operatorname{MIP}^{*}(2,1,c,s)$, but with $\omega_{q}$ replaced by $\omega_{qc}$. The protocols in these cases are called $\operatorname{MIP}^{*}$ and $\operatorname{MIP}^{co}$ protocols. A language belongs to $\operatorname{AM}^{*}(2)$ (resp. $\operatorname{AM}^{qc}(2)$) if it has a $\operatorname{MIP}^{*}$-protocol (resp. $\operatorname{MIP}^{qc}$-protocol) in which $\pi_{x}$ is the uniform distribution on $I_{x}\times I_{x}$. Such a protocol is called an $\operatorname{AM}^{*}(2)$ protocol. We can also define classes $\operatorname{SynMIP}^{*}$ and $\operatorname{SynMIP}^{co}$ by replacing the quantum and commuting operator values by $\omega_{q}^{s}$ and $\omega_{qc}^{s}$.

Any language in $\operatorname{MIP}^{*}(2,1,c,s)$ is contained in $\operatorname{RE}$, and this remains true even if we add more provers and rounds of communication. The $\operatorname{MIP}^{*}=\operatorname{RE}$ theorem of Ji, Natarajan, Vidick, Wright, and Yuen states that $\operatorname{MIP}^{*}(2,1,1,1/2)=\operatorname{RE}$ [JNV⁺22b]. In this paper, we use the following strong version of $\operatorname{MIP}^{*}=\operatorname{RE}$ due to Natarajan and Zhang [NZ23].

One corollary of Theorem 2.2 is that it is possible to transform any $\operatorname{MIP}^{*}$ protocol into an equivalent $\operatorname{AM}^{*}(2)$ protocol $(\{\mathcal{G}_{x}\},S,V)$ as in the theorem. Indeed, suppose $\mathcal{P}$ is a polynomial-time probabilistic interactive Turing machine which on input $x$ acts as the verifier in a $\operatorname{MIP}^{*}$ protocol with $k$ rounds, $p$ provers, completeness $c$, and soundness $s$, where $k$, $p$, $c$, and $s$ are computable functions of $|x|$. Let $\mathcal{T}$ be the Turing machine which on input $x$, searches through $k$-round $p$-prover quantum strategies, uses $\mathcal{P}$ to calculate the success probability, and halts if it finds a strategy with success probability $>s$. Let $\mathcal{T}(x)$ be the Turing machine which on empty input writes $x$ to the input tape and then runs $\mathcal{T}$. Finally, let $(\{\mathcal{G}_{M}\},S,V)$ be the one-round protocol for the language $\operatorname{HALT}=\{M:M\text{ is a Turing machine that halts on empty input}\}$. The Turing machines $S$ and $V$ run in polynomial time in the size $|M|$ of the input Turing machine $M$, and $\mathcal{T}(x)$ has size linear in $|x|$, so the one-round protocol which runs game $\mathcal{G}_{\mathcal{T}(x)}$ on input $x$ is a polynomial-time $\operatorname{AM}^{*}(2)$ protocol which recognizes the same language as $\mathcal{P}$. Strikingly, this works for any computable $k$, $p$, and $s$, not just polynomial functions of $|x|$, since the only requirement is that $\mathcal{T}(x)$ have polynomial description size.

We now introduce boolean constraint system games. If $V$ is a set of variables, a constraint on $V$is a subset $C$ of $\mathbb{Z}_{2}^{V}$. We think of $\mathbb{Z}_{2}$ as $\{\pm 1\}$ rather than $\{0,1\}$, since this is more convenient when working with observables and measurements. In particular, we use $-1$ and $1$ to represent true and false respectively, rather than $1$ and $0$. An assignment to $V$is an element $\phi\in\mathbb{Z}_{2}^{V}$, and we refer to the elements of $C$ as satisfying assignments for $C$. For convenience, we assume every constraint is non-empty, i.e. has a satisfying assignment. A boolean constraint system (BCS) $B$ is a pair $\left(X,\{(V_{i},C_{i})\}_{i=1}^{m}\right)$, where $X$ is an ordered set of variables, $V_{i}$ is a nonempty subset of $X$ for all $1\leq i\leq m$, and $C_{i}$ is a constraint on the variables $V_{i}$. When working with nonlocal games, the sets $V_{i}$ are sometimes called the contexts of the system. The order on $X$ induces an order on the contexts $V_{i}$, and this will be used for some specific models of the weighted BCS algebra in Section 6. This is the only thing we use the order on $X$ for, so it can be ignored otherwise. A satisfying assignment for $B$is an assignment $\phi$ to $X$ such that $\phi|_{V_{i}}\in C_{i}$ for all $1\leq i\leq m$. Although we won’t use it until later, we define the connectivity of a BCS $B$ to be the maximum over $i$ of $|\{(x,j)\in V_{i}\times[m]:x\in V_{j}\}|$, where $[m]:=\{1,\ldots,m\}$. In other words, the connectivity is the maximum over $i$ of the number of times the variables in constraint $i$ appear in the constraints of $B$. Also, if $V=\bigcup_{i=1}^{k}V_{i}$ and $C_{i}$ is a constraint on $V_{i}$, then the conjunction $\wedge_{i=1}^{k}C_{i}$ is the constraint $C$ on variables $V$ such that $\phi\in C$ if and only if $\phi|_{V_{i}}\in C_{i}$ for all $1\leq i\leq k$.

Let $B=\left(X,\{(V_{i},C_{i})\}_{i=1}^{m}\right)$ be a BCS, and let $\pi$ be a probability distribution on $[m]\times[m]$. The BCS game $\mathcal{G}(B,\pi)$ is the nonlocal game $([m],C_{i\in m},\pi,V)$, where $V(\phi_{i},\phi_{j}|i,j)=1$ if $\phi_{i}|_{V_{i}\cap V_{j}}=\phi_{j}|_{V_{i}\cap V_{j}}$, and is $0$ otherwise. In other words, in $\mathcal{G}(B,\pi)$, the players are given integers $i,j\in[m]$ according to the distribution $\pi$, and must reply with satisfying assignments $\phi_{i}\in C_{i}$ and $\phi_{j}\in C_{j}$ respectively. They win if their assignments agree on the variables in $V_{i}\cap V_{j}$. With this definition, $\mathcal{G}(B,\pi)$ has questions of length $\lceil\log m\rceil$, and answer sets of length $|V_{i}|$.

A $\operatorname{BCS}$-$\operatorname{MIP}$ protocol is a family of BCS games $\mathcal{G}(B_{x},\pi_{x})$, where $B_{x}=(X_{x},\{(V_{i}^{x},C_{i}^{x})\}_{i=1}^{m_{x}})$, along with a probabilistic Turing machine $S$ and another Turing machine $C$, such that

1. (1)

   on input $x$, $S$ outputs $(i,j)\in[m_{x}]\times[m_{x}]$ with probability $\pi_{x}(i,j)$, and

2. (2)

   on input $(x,\phi,i)$, $C$ outputs true if $\phi\in C_{i}^{x}$ and false otherwise.