Original: Trustworthy Monte Carlo
Revised: Trustworthy Monte Carlo

Original: Anonymous Author(s)

Original: AfﬁliationAddress email

Original: Abstract
Revised: Abstract

Original: Monte Carlo integration is a key technique for designing randomized approximationschemes for counting problems, with applications, e.g., in machine learning andstatistical physics.
Revised: Monte Carlo integration is a key technique for designing randomized approximation schemes for counting problems, with applications, e.g., in machine learning and statistical physics.

Original: The technique typically enables massively parallel computation,however, with the risk that some of the delegated computations contain spontaneousor adversarial errors.
Revised: The technique typically enables massively parallel computation, however, with the risk that some of the delegated computations contain spontaneous or adversarial errors.

Original: We present an orchestration of the computations such thatthe outcome is accompanied with a proof of correctness.
Revised: We present an orchestration of the computations such that the outcome is accompanied with a proof of correctness that can be veriﬁed with substantially less computational resources than it takes to run the computations from scratch with state-of-the-art algorithms.

Original: Speciﬁcally, we adopt analgebraic proof system developed in computational complexity theory, in whichthe proof is represented by a polynomial; evaluating the polynomial at a randompoint amounts to a veriﬁcation of the proof with probabilistic guarantees.
Revised: Speciﬁcally, we adopt an algebraic proof system developed in computational complexity theory, in which the proof is represented by a polynomial; evaluating the polynomial at a random point amounts to a veriﬁcation of the proof with probabilistic guarantees.

Original: We giveexamples of known Monte Carlo estimators that admit veriﬁable extensions withmoderate computational overhead: for the permanent of zero–one matrices, for themodel count of disjunctive normal form formulas, and for the gradient of logisticregression models.
Revised: We give examples of known Monte Carlo estimators that admit veriﬁable extensions with moderate computational overhead: for the permanent of zero–one matrices, for the model count of disjunctive normal form formulas, and for the gradient of logistic regression models.

Original: We also discuss the prospects and challenges of engineeringefﬁcient veriﬁable approximation schemes more generally.
Revised: We also discuss the prospects and challenges of engineering efﬁcient veriﬁable approximation schemes more generally.

Original:  Introduction
Revised:  Introduction

Original: Can we trust a result computed by a machine?
Revised: Can we trust a result computed by a machine?

Original: Putting aside questions about the sensibility of thecomputational task itself, trust stems from one’s belief in the correctness of the selected algorithm, itsimplementation in software, and execution on hardware.
Revised: Putting aside questions about the sensibility of the computational task itself, trust stems from one’s belief in the correctness of the selected algorithm, its implementation in software and execution on hardware.

Original: All these ingredients are prone to errors,especially when the task is hard, the algorithm is advanced and the computations are extensive(distributed and long).
Revised: All these ingredients are prone to errors, especially when the task is hard, the algorithm is advanced, and the computations are extensive (distributed and long).

Original: Trustworthy computation is one pillar of trustworthy AI [28] and it is an issueparticularly when one “outsources” computations to other computational agents, e g., to millions of
Revised: Trustworthy computation is one pillar of trustworthy AI [28] and it is an issue particularly when one “outsources” computations to other computational agents, e g., to millions of

Original: Internet users to make use of their idle cycles—some users could be dishonest and return seeminglyvalid results without running any actual computation [6, 26].
Revised: Internet users to make use of their idle cycles—some users could be dishonest and return seemingly valid results without running any actual computation [6, 26].

Original: Ideally, the outcome of the computations would be accompanied with a certiﬁcate of correctness, orproof , the user canefﬁciently verify .
Revised: Ideally, the outcome of the computations would be accompanied with a certiﬁcate of correctness, or proof , the user can verify .

Revised: Furthermore, veriﬁcation should be computationally easy in that it should consume substantially less computational resources than it takes to run the computations from scratch with state-of-the-art algorithms.

Original: For many decision and search problems such proofs are available;e.g. , a certiﬁcate of satisﬁability of a given Boolean formula is simply a satisfying truth assignment.
Revised: For many decision and search problems such proofs are available; e.g., a certiﬁcate of satisﬁability of a given Boolean formula is simply a satisfying truth assignment.

Original: For optimization problems, the cost of the found (locally optimal) solution is typically easy to verify,and certiﬁcates of optimality are sometimes obtained by linear programming duality.
Revised: For optimization problems, the cost of the found (locally optimal) solution is typically easy to verify, and certiﬁcates of optimality are sometimes obtained by linear programming duality.

Original: So-calledcertifying algorithms extend the output accordingly with an easy-to-verify proof [20].
Revised: Certifying algorithms extend the output accordingly with an easy-to-verify proof [20].

Original: For countingproblems, which are central in applications involving probabilistic reasoning, such certiﬁcates aretypically not readily available.
Revised: For counting problems, which are central in applications involving probabilistic reasoning, such certiﬁcates are typically not readily available, and it is not immediate whether such certiﬁcates exist in the ﬁrst place.

Original: In this paper, we initiate research on veriﬁable randomized approximation schemes for weightedcounting.
Revised: In this paper, we initiate research on veriﬁable randomized approximation schemes for weighted counting.

Original: Speciﬁcally, we investigate Monte Carlo estimators, which approximate a target quantity µby a sample-average of random variables W 1 , W 2 , . . .
Revised: Speciﬁcally, we investigate Monte Carlo estimators, which approximate a target quantity µ by a sample-average of random variables W 1 , W 2 , . . .

Original: , W N with mean µ so that
Revised: , W N with mean µ so that

Original: [Equation]
Revised: [Equation]

Original: For an accurate estimate, one may have to draw a large number of samples.
Revised: For an accurate estimate, one may have to draw a large number of samples.

Original: Fortunately, the simpleway of aggregating the N samples enables easy and efﬁcient parallelization of the computations,particularly if the samples are independent.
Revised: Fortunately, the simple way of aggregating the N samples enables easy and efﬁcient parallelization of the computations, particularly if the samples are independent.

Original: This motivates studying a setting where one agent, theveriﬁer , delegates most of the computations to one or more other, potentially computationally morepowerful, agents.
Revised: This motivates studying a setting where one agent, the veriﬁer , delegates most of the computations to one or more other, potentially computationally more powerful, agents.

Original: When aggregating the results of the delegated computations, how can the veriﬁerknow if some agents made errors, whether intentional or spontaneous, in their computations?
Revised: When aggregating the results of the delegated computations, how can the veriﬁer know if some agents made errors, whether intentional or spontaneous, in their computations?

Original: To address this question, we build on ideas and frameworks developed for probabilistic proof systemsin complexity theory and cryptography [9, 6, 8, 26, 27].
Revised: To address this question, we build on ideas and frameworks developed in the context of proof systems with probabilistic soundness in complexity theory and cryptography [9, 6, 8, 26, 27].

Original: One of the key ideas is to encode theproblem instance at hand by a univariate polynomial p of degree D such that knowing the D + 1coefﬁcients of p —or equivalently, evaluations of p at D +1 points—reveals the correct solution to theproblem instance.
Revised: One of the key ideas is to encode the problem instance at hand by a univariate polynomial p of degree D such that knowing the D + 1 coefﬁcients of p —or equivalently, evaluations of p at D + 1 points—reveals the correct solution to the problem instance.

Original: The veriﬁer delegates the task of computing p and receives a claimed polynomial˜ p .
Revised: The veriﬁer delegates the task of computing p and receives a claimed polynomial ˜ p .

Original: Now, the veriﬁer evaluates both the correct p and the claimed ˜ p at a single random point r drawnfrom a range signiﬁcantly larger than D : if p (cid:54) =
Revised: Now, the veriﬁer evaluates both the correct p and the claimed ˜ p at a single random point r drawn from a range signiﬁcantly larger than D : if p (cid:54) =

Original: ˜ p , then p ( r ) (cid:54) =
Revised: ˜ p , then p ( r ) (cid:54) =

Original: ˜ p
Revised: ˜ p

Original: ( r ) with high probability, sincep − ˜ p has at most D roots.
Revised: ( r ) with high probability, since p − ˜ p has at most D roots.

Original: Supposing the total time needed for solving the problem  is T ≈ DE ,where E is the time requirement per evaluation of p , an optimal veriﬁer time is achieved when D ≈ E ≈ √ T .
Revised: Supposing the total time needed for solving the problem with a state-of-the-art algorithm is T ≈ DE , where E is the time requirement per evaluation of p , an optimal veriﬁer time is achieved when D ≈ E ≈ √ T .

Revised: That is, veriﬁcation is computationally easy in the sense that it consumes essentially only a square root of the resources needed to solve the problem with state-of-the-art algorithms.

Original: Various problems can be cast in this way, with only a small overhead in relation tothe time requirement of the corresponding non-veriﬁable computation.
Revised: Various problems can be cast in this way, with only a small overhead in relation to the time requirement of the corresponding non-veriﬁable computation.

Original: Examples range from thematrix permanent and model counting for Boolean formulas [27] to graph coloring and countingsmall subgraphs [4], and to exact probabilistic inference in graphical models [14].
Revised: Examples range from the matrix permanent and model counting for Boolean formulas [27] to graph coloring and counting small subgraphs [4], and to exact probabilistic inference in graphical models [14].

Original: When extending the framework to Monte Carlo estimators of the form (1), we encounter a newchallenge: the randomness and independence of the summands W t .
Revised: When extending the framework to Monte Carlo estimators of the form (1), we encounter a new challenge: the randomness and independence of the summands W t .

Original: Indeed, if the veriﬁer outsourcesthe generation of random numbers, there is no deterministic correct result that could be veriﬁed.
Revised: Indeed, if the veriﬁer outsources the generation of random numbers, there is no deterministic correct result that could be veriﬁed.

Original: We circumvent this obstacle by letting the veriﬁer generate all needed random bits, given which theremaining computational task is deterministic.
Revised: We circumvent this obstacle by letting the veriﬁer generate all needed random bits, after which the remaining computational task is deterministic.

Original: This leads to another challenge: if the veriﬁer has togenerate N random numbers, how can the veriﬁer avoid its running time scaling as N , the goal forscaling being rather √ N ?
Revised: This leads to another challenge: if the veriﬁer has to generate N random numbers, how can the veriﬁer avoid its running time scaling as N , the goal for scaling being rather √ N ?

Original: Here we make use of the facts that (i) only O (log N ) independent randombits sufﬁce to generate N pairwise independent random bits, and (ii) pairwise independence sufﬁcesfor concentration results that stem from bounding the second moment of the random variables W t .
Revised: Here we make use of the facts that (i) only O (log N ) independent random bits sufﬁce to generate N pairwise independent random bits, and (ii) pairwise independence sufﬁces for concentration results that stem from bounding the second moment of the random variables W t .

Original: The rest of this paper is organized as follows.
Revised: The rest of this paper is organized as follows.

Original: Section 2 connects the task of designing a proofpolynomial to that of ﬁnding an appropriate low-degree arithmetic circuit [27].
Revised: Section 2 connects the task of designing a proof polynomial to that of ﬁnding an appropriate low-degree arithmetic circuit [27].

Original: In Section 3, wepresent our main contribution, a generic method for obtaining what we call a veriﬁable randomizedapproximation scheme (vras).
Revised: In Section 3, we present our main contribution, a generic method for obtaining what we call a veriﬁable randomized approximation scheme (vras).

Original: Section 4 extends the method to settings where our arithmetic circuitonly approximates a random variable W t .
Revised: Section 4 extends the method to settings where our arithmetic circuit only approximates a random variable W t .

Original: As a running example, we use the problem of computingthe permanent of a given matrix, for which practical approximating schemes have been sought in the
Revised: As a running example, we use the problem of computing the permanent of a given matrix, for which practical approximating schemes have been sought in the

Original: AI community recently [18, 10].
Revised: AI community recently [18, 10].

Original: We also apply the methods to known Monte Carlo estimators formodel counting of Boolean formulas given in a disjunctive normal form and for estimating gradientsof a Bayesian logistic regression model.
Revised: We also apply the methods to known Monte Carlo estimators for model counting of Boolean formulas given in a disjunctive normal form and for estimating gradients of a Bayesian logistic regression model.

Original: In the last section, we connect to recent work on learningand reasoning with arithmetic circuits [25] and probabilistic generating circuits [29].
Revised: In the last section, we connect to recent work on learning and reasoning with arithmetic circuits [25] and probabilistic generating circuits [29].

Original: We also discussdirections for future research.
Revised: We also discuss directions for future research.

Original: Although this work is theoretical and leavesimplementations and experimentation for future works,we include a proof-of-concept Mathematica [11] implementation for the example of Section 3.4 inthe supplement.
Revised: Although this work is theoretical and leaves experimentation for future works, we include a proof-ofconcept Mathematica [11] implementation for the example of Section 3.4 in the supplement.

Original: Throughout the paper, the notation ˜ O ( · ) suppresses factors polylogarithmic in the argument, [[ P ]]evaluates to 1 if P is true, and to 
Revised: Throughout the paper, the notation ˜ O ( · ) suppresses factors polylogarithmic in the argument, [[ P ]] evaluates to 1 if P is true, and to 0 otherwise, and ( † ) marks that a proof is given in the supplement.

Original:  Proving and verifying with polynomials
Revised:  Proving and verifying with polynomials

Original: We begin by introducing the proof system, synthetisizing ideas from related recent works [27, 4, 14].
Revised: We begin by introducing the proof system, synthetisizing ideas from related recent works [27, 4, 14].

Original: 2.1 Prove and verify
Revised: 2.1 Prove and verify

Original: Suppose one computational agent, the veriﬁer , wishes to delegate most of the computational taskat hand to another agent, the prover .
Revised: Suppose one computational agent, the veriﬁer , wishes to delegate most of the computational task at hand to another agent, the prover .

Original: Here the prover may consist of multiple agents workingindependently of each other, thus efﬁciently parallelizing the delegated computations.
Revised: Here the prover may consist of multiple agents working independently of each other, thus efﬁciently parallelizing the delegated computations.

Original: Deﬁnition 1.
Revised: Deﬁnition 1.

Original: Let A be an algorithm with access to another algorithm B .
Revised: Let A be an algorithm with access to another algorithm B .

Original: We call A a veriﬁer and
Revised: We call A a veriﬁer and

Original: B a prover , if given any problem instance, the output of A is correct whenever the output of B iscorrect, 1 and otherwise A outputs “untrusted” with probability at least 2 / 3 .
Revised: B a prover , if given any problem instance, the output of A is correct whenever the output of B is correct, 1 and otherwise A outputs “untrusted” with probability at least 2 / 3 .

Original: We refer to the timerequirements of A and B as the veriﬁer time and the prover time , respectively.
Revised: We refer to the time requirements of A and B as the veriﬁer time and the prover time , respectively.

Original: The constant 2 / 3 is customary but arbitrary.
Revised: The constant 2 / 3 is customary but arbitrary.

Original: As we will point out soon, the probability can beefﬁciently ampliﬁed to arbitrarily close to 1 .
Revised: As we will point out soon, the probability can be efﬁciently ampliﬁed to arbitrarily close to 1 .

Original: For constructing a veriﬁer, the idea is to represent the essence of the computational task as evaluationof a univariate polynomial p ( x ) =
Revised: For constructing a veriﬁer, the idea is to represent the essence of the computational task as evaluation of a univariate polynomial p ( x ) =

Original: p 0 + p 1 x 1 + · · · + p D x D over a ﬁnite ﬁeld F at some e ≥ D + 1distinct points ξ 1 , ξ 2 , . .
Revised: p 0 + p 1 x 1 + · · · + p D x D over a ﬁnite ﬁeld F at some e ≥ D +distinct points ξ 1 , ξ 2 , . .

Original: . , ξ e ∈ F , selected so that given the values p ( ξ 1 ) , p ( ξ 2 ) , . .
Revised: . , ξ e ∈ F , selected so that given the values p ( ξ 1 ) , p ( ξ 2 ) , . .

Original: , p ( ξ e ) —assumingthey are correct—the veriﬁer can, with little additional work, solve the original problem.
Revised: , p ( ξ e ) —assuming they are correct—the veriﬁer can, with little additional work, solve the original problem.

Original: Crucially,the correct polynomial p is speciﬁed by the problem instance in a way that is known to both theveriﬁer and the prover.
Revised: Crucially, the correct polynomial p is speciﬁed by the problem instance in a way that is known to both the veriﬁer and the prover.

Original: From the veriﬁer’s viewpoint the procedure is as follows.
Revised: From the veriﬁer’s viewpoint the procedure is as follows.

Original: [Table]
Revised: Algorithm V

Original: [Table] V1 Send 
Revised: V1 Send the prover the problem instance and the points ξ 1 , ξ 2 , . . . , ξ e .

Original: [-.V
-] Receive from the prover a proof, i
Revised: [-.V
-]V2 Receive from the prover a proof, i

Original: e., a claimed value y k of p (  k ) for each k = 1 , 
Revised: e., a claimed value y k of p ( ξ k ) for each k = 1 , 2 , . . .

Original: , e .V3 Find the coefﬁcients of ˜ p ( x ) =
Revised: , e . V3 Find the coefﬁcients of ˜ p ( x ) =

Original: (cid:80) D k =

Revised: (cid:80) Dk =

Original: ˜ p
Revised: ˜ p

Original: k x k such that ˜ p ( ξ k ) =
Revised: k x k such that ˜ p ( ξ k ) =

Original: y k for all k = 1 ,2 , . . .
Revised: y k for all k = 1 , , e .

Original: , e .V4{+V
+} Draw a random point ξ 0 ∈ F and evaluate ˜ p ( ξ 0 ) and p ( ξ 0 ) .
Revised: {+V
+} Draw a random point ξ 0 ∈ F and evaluate ˜ p ( ξ 0 ) and p ( ξ 0 ) .

Original: V

Revised: V

Original: If ˜ p ( ξ 0 ) = p ( ξ 0 ) , then accept the proof and consume the values y k ; otherwise reject the proof.
Revised: If ˜ p ( ξ 0 ) = p ( ξ 0 ) , then accept the proof and consume the values y k ; otherwise reject the proof.

Original: Note that if ˜ p (cid:54) = p , then ˜ p ( ξ 0 ) =
Revised: Note that if ˜ p (cid:54) = p , then ˜ p ( ξ 0 ) =

Original: p ( ξ 0 ) with probability D/ | F | , which we can make arbitrarily smallby using a ﬁnite ﬁeld F that is sufﬁciently large in relation the degree D .
Revised: p ( ξ 0 ) with probability D/ | F | , which we can make arbitrarily small by using a ﬁnite ﬁeld F that is sufﬁciently large in relation the degree D .

Original: Several remarks are in order.
Revised: Several remarks are in order.

Original: While D + 1 evaluations would sufﬁce for recovering the polynomial,we allow e ≥ D + 1 to enable error-correction.
Revised: While D + 1 evaluations would sufﬁce for recovering the polynomial, we allow e ≥ D + 1 to enable error-correction.

Original: Indeed, as long as at least ( e + D
Revised: Indeed, as long as at least ( e + D

Original: +
Revised: +

Original: 1) / 2 of the eevaluations are correct, the correct polynomial can be efﬁciently recovered using a Reed–Solomondecoder (see [4] and references therein); e.g., putting e = 2( D + 1) , one fourth of the prover’sevaluations can be incorrect.
Revised: 1) / 2 of the e evaluations are correct, the correct polynomial can be efﬁciently recovered using a Reed–Solomon decoder (see [4] and references therein); e.g., putting e = 2( D + 1) , one fourth of the prover’s evaluations can be incorrect.

Original: The procedure also enables the prover to run the e evaluations in parallelon e computing units without any communication among them.
Revised: The procedure also enables the prover to run the e evaluations in parallel on e computing units without any communication among them.

Original: Furthermore, the protocol is, inessence, non-interactive: the veriﬁer only sends one message to the prover and receives one.
Revised: Furthermore, the protocol is, in essence, non-interactive: the veriﬁer only sends one message to the prover and receives one.

Original: Finally,in step V3 the computational efﬁciency of the procedure stems from fast interpolation of univariatepolynomials; this is incorporated in Theorem 1, given in the next section.
Revised: Finally, in step V3 the computational efﬁciency of the procedure stems from fast interpolation of univariate polynomials; this is incorporated in Theorem 1, given in the next section.

Original: 2.2 Multipoint circuit evaluation
Revised: 2.2 Multipoint circuit evaluation

Original: For designing the polynomial and selecting the evaluation points, we adopt Williams’s [27] genericmethod, with some changes.
Revised: For designing the polynomial and selecting the evaluation points, we adopt Williams’s [27] generic method, with some changes.

Original: The idea is to represent the problem at hand as a task of evaluatingan arithmetic circuit at multiple points.
Revised: The idea is to represent the problem at hand as a task of evaluating an arithmetic circuit at multiple points.

Original: This approach differs from that of Björklund and Kaski[4], who craft their polynomials separately for each problem they consider to obtain a ﬁne-grainedoptimization of the running time.
Revised: This approach differs from that of Björklund and Kaski [4], who craft their polynomials separately for each problem they consider to obtain a ﬁne-grained optimization of the running time.

Original: An arithmetic circuit C in variables x 1 , x 2 , . . .
Revised: An arithmetic circuit C in variables x 1 , x 2 , . . .

Original: , x n over a ﬁeld F is a directed acyclic graph, in whicheach vertex is called a gate and labeled by + (sum) or × (product) if its in-degree is not zero, andotherwise by one of the variables x i or by a constant from F .
Revised: , x n over a ﬁeld F is a directed acyclic graph, in which each vertex is called a gate and labeled by + (sum) or × (product) if its in-degree is not zero, and otherwise by one of the variables x i or by a constant from F .

Original: Every gate v computes a polynomial
Revised: Every gate v computes a polynomial

Original: C v ∈ F [ x 1 , x 2 , . . .
Revised: C v ∈ F [ x 1 , x 2 , . . .

Original: , x n ] in an obvious way.
Revised: , x n ] in an obvious way.

Original: Unless stated otherwise, the circuit is assumed to have asingle output gate v (i.e., of out-degree zero) and C is identiﬁed with the polynomial C v .
Revised: Unless stated otherwise, the circuit is assumed to have a single output gate v (i.e., of out-degree zero) and C is identiﬁed with the polynomial C v .

Original: The size ,depth , and degree of C are, respectively, the number of gates, the length of the longest directed path,and the largest degree of the monomials in C .
Revised: The size , −−1 −−xxyy 2 + × + × + × × × + depth , and degree of C are, respectively, the number of gates, the length of the longest directed path, and the largest degree of the monomials in C .

Original: We assume that the maximum in-degree is at most 2 .
Revised: We assume that the maximum in-degree is at most 2 .

Original: Arithmetic circuits are powerful representations of functions and computation.
Revised: Arithmetic circuits are powerful representations of functions and computation.

Original: For example, tosimulate any Boolean circuit by an arithmetic circuit of about the same size and depth, simply replaceeach Boolean gate by a constant number of sum and product gates, e.g., x
Revised: For example, to simulate any Boolean circuit by an arithmetic circuit of about the same size and depth, simply replace each Boolean gate by a constant number of sum and product gates, e.g., x

Original: 1 ∨ x 2 by x 1 + x 2 − x 1 x 2 .
Revised: 1 ∨ x 2 by x 1 + x 2 − x 1 x 2 .

Original: Figure 1 shows a circuit for comparing two n -bit nonnegative integers.
Revised: Figure 1 shows a circuit for comparing two n -bit nonnegative integers.

Original: −−1 −−xxyy 2 + × + × + × × × +

Original: Typically we want to show that a given function admits a circuit that has small size and low degree.
Revised: Typically we want to show that a given function admits a circuit that has small size and low degree.

Original: While it is important that we can also efﬁciently construct such a circuit, usually it is clear thatconstruction takes time roughly linear in the size of the circuit, and we do not mention that.
Revised: While it is important that we can also efﬁciently construct such a circuit, usually it is clear that construction takes time roughly linear in the size of the circuit, and we do not mention that.

Original: The multipoint circuit evaluation problem (MCE) is as follows.
Revised: The multipoint circuit evaluation problem (MCE) is as follows.

Original: Given an arithmetic circuit C in nvariables over a ﬁnite ﬁeld F and points u 1 , u 2 , . . .
Revised: Given an arithmetic circuit C in n variables over a ﬁnite ﬁeld F and points u 1 , u 2 , . . .

Original: , u K ∈ F n , compute the values C ( u k ) ∈ F for allk = 1 , 2 , . . .
Revised: , u K ∈ F n , compute the values C ( u k ) ∈ F for all k = 1 , 2 , . . .

Original: , K .
Revised: , K .

Original: Denote by s and d the size and the degree of the circuit, respectively.
Revised: Denote by s and d the size and the degree of the circuit, respectively.

Original: The following result tells that we can design a veriﬁer by representing the problem as an instantiationof MCE.
Revised: The following result tells that we can design a veriﬁer by representing the problem as an instantiation of MCE.

Original: We attribute the result to Williams [27, Theorem 1.2]; we have made some modiﬁcations tothe proof to also take into account the prover’s time requirement (not considered by Williams).
Revised: We attribute the result to Williams [27, Theorem 1.2]; we have made some modiﬁcations to the proof to also take into account the prover’s time requirement (not considered by Williams).

Original: Theorem 1 ( † ) .
Revised: Theorem 1 ( † ) .

Original: MCE admits a veriﬁer with prover time ˜ O
Revised: MCE admits a veriﬁer with prover time ˜ O

Original: ( Kds ) and veriﬁer time ˜
Revised: ( Kds ) and veriﬁer time ˜

Original: O
Revised: O

Original: ( Kdn + s ) .
Revised: ( Kdn + s ) .

Original: Remark 1.
Revised: Proof sketch. The main idea is to transform the circuit C of n variables into a univariate circuit p , which then represents a univariate polynomial. We associate each point u i ∈ F n with an element ξ i from some large enough extension ﬁeld F of F . Next, we ﬁnd an interpolating polynomial for each variable of C such that for a point ξ i the polynomial λ j extracts the j th component u ij of u i .

Revised: As a result, we obtain a circuit with p ( ξ i )

Revised: =

Revised: C ( u i 1 , u i 2 , . . .

Revised: , u in ) .

Revised: The interpolating polynomials increase the degree of the circuit (polynomial) by a factor of K , and therefore we need Kd + 1 evaluations to determine the polynomial representation of p uniquely.

Revised: As a consequence, we evaluate p on some additional arbitrary distinct points ξ K +1 , ξ K +2 , . . .

Revised: , ξ Kd +1 .

Revised: The prover needs to evaluate a circuit of size s on Kd + 1 points, which takes time O ( Kds ) .

Revised: On the veriﬁer’s side, we need to send the circuit of size s to the prover, as well as n input variables of

Revised: C for each point ξ i to enable massive parallelization.

Revised: This and the other steps of Algorithm V can be computed efﬁciently in given time limits by using fast interpolation and multipoint evaluation of univariate polynomials.

Revised: Remark 1.

Original: The result relies on the prover’s and the veriﬁer’s ability to evaluate the circuit in a givenpoint from F n , where F is an extension ﬁeld of F .
Revised: The result relies on the prover’s and the veriﬁer’s ability to evaluate the circuit in a given point from F n , where F is an extension ﬁeld of F .

Original: For the time requirement of these evaluations, thecircuit size s gives an upper bound, which can be overly conservative—indeed, we may replace theterm s by the actual time required for computing the value of the circuit at a given point.
Revised: For the time requirement of these evaluations, the circuit size s gives an upper bound, which can be overly conservative—indeed, we may replace the term s by the actual time required for computing the value of the circuit at a given point.

Original: For example,the univariate polynomial 1 + x + · · · + x d in one variable has a circuit of size 2 d and degree d , butit can be evaluated in the form (1 − x d+1 ) / (1 − x ) using only O (log d ) ﬁeld operations.
Revised: For example, the univariate polynomial 1 + x + · · · + x d in one variable has a circuit of size 2 d and degree d , but it can be evaluated in the form (1 − x d − x ) using only O (log d ) ﬁeld operations.

Original: 2.3 Example: the permanent
Revised: 2.3 Example: the permanent

Original: The permanent of a square matrix A
Revised: The permanent of a square matrix A

Original: = ( a i,j ) ∈ F m × m is given byper
Revised: = ( a i,j ) ∈ F m × m is given by per A = (cid:88)

Original: A = (cid:88) σ m (cid:89) i = a i,σ ( i ) = (cid:88) t ∈{ 0 , 1 } m m (cid:89) i
Revised: σ m (cid:89) i = a i,σ ( i ) = (cid:88) t ∈{ 0 , 1 } m m (cid:89) i

Original: = ( − 1) 1 − t
Revised: = ( − 1) 1 − t

Original: i m (cid:88)
Revised: i m (cid:88)

Original: j = t i a i,j , where σ runs through all permutations on { 1 , 2 , . . .
Revised: j = t i a i,j , where σ runs through all permutations on { 1 , 2 , . . .

Original: , m } .
Revised: , m } .

Original: The second expression is due to Ryser [24].
Revised: The second expression is due to Ryser [24].

Original: Assume m is even and put n := m/ 2 and
Revised: Assume m is even and put n := m/ 2 and

Original: C ( t ) :
Revised: C ( t ) :

Original: = m (cid:89) i
Revised: = m (cid:89) i

Original: =
Revised: =

Original: ( − 1) t i −m (cid:88)
Revised: ( − 1) t i −m (cid:88)

Original: j = t i a i,j and C ∗ ( u ) :=
Revised: j = t i a i,j and C ∗ ( u ) :=

Original: (cid:88) v ∈{ 0 , 1 } n
Revised: (cid:88) v ∈{ 0 , 1 } n

Original: C ( u 1 , u 2 , . . . , u n , v 1 , v 2 , . .
Revised: C ( u 1 , u 2 , . . . , u n , v 1 , v 2 , . .

Original: . , v n ) .
Revised: . , v n ) .

Original: Now per A = (cid:80) u ∈{ 0 , 1 } n C ∗ ( u ) .
Revised: Now per A = (cid:80) u ∈{ 0 , 1 } n C ∗ ( u ) .

Original: Write ( − 1) 1 − t
Revised: Write ( − 1) 1 − t

Original: i
Revised: i

Original: as 2 t i − 1 to observe that C ∗ has an arithmeticcircuit of size O (2 n m 2 ) and degree 2 m .
Revised: as 2 t i − 1 to observe that C ∗ has an arithmetic circuit of size O (2 n m 2 ) and degree 2 m .

Original: By Theorem 1, the permanent admits a veriﬁer with provertime ˜ O
Revised: By Theorem 1, the permanent admits a veriﬁer with prover time ˜ O

Original: (2 m ) and veriﬁer time
Revised: (2 m ) and veriﬁer time

Original: ˜ O
Revised: ˜ O

Original: (2 m/ 2 ) .
Revised: (2 m/ 2 ) .

Original:  Veriﬁable Monte Carlo integration
Revised:  Veriﬁable Monte Carlo integration

Original: We next apply Theorem 1 to the computation of Monte Carlo estimators (1).
Revised: We next apply Theorem 1 to the computation of Monte Carlo estimators (1).

Original: 3.1 Multipoint evaluation and pairwise independence
Revised: 3.1 Multipoint evaluation and pairwise independence

Original: To reduce the Monte Carlo estimator to K circuit evaluations, we simply write the sum over N termsas a double summation:
Revised: To reduce the Monte Carlo estimator to K circuit evaluations, we simply write the sum over N terms as a double summation:

Original: [Equation]
Revised: [Equation]

Original: Naturally, K has to divide N .
Revised: Naturally, K has to divide N .

Original: To make this hold, we will assume that N and K are powers of 2 .
Revised: To make this hold, we will assume that N and K are powers of 2 .

Original: Now we view each random variable V k as an output of a ﬁxed arithmetic circuit evaluated at somepoint u k .
Revised: Now we view each random variable V k as an output of a ﬁxed arithmetic circuit evaluated at some point u k .

Original: In fact, we take the index k itself as the point u k .
Revised: In fact, we take the index k itself as the point u k .

Original: The circuit is obtained as a sum of K/Nevaluations of a smaller circuit C , each of which outputs W ( k − 1) K + j when given k and j as input.
Revised: The circuit is obtained as a sum of K/N evaluations of a smaller circuit C , each of which outputs W ( k − 1) K + j when given k and j as input.

Original: Crucially, the output of C is a deterministic function of ( k, j ) , implying that all randomness must beencoded in C .
Revised: Crucially, the output of C is a deterministic function of ( k, j ) , implying that all randomness must be encoded in C .

Original: Because of this, the N random variables cannot be independent, for then the encodingwould require at least N bits, rendering the circuit C large and undermining the pursuit of an efﬁcientveriﬁer.
Revised: Because of this, the N random variables cannot be independent, for then the encoding would require at least N bits, rendering the circuit C large and undermining the pursuit of an efﬁcient veriﬁer.

Original: To circumvent this obstacle, we resort to pairwise independence.
Revised: To circumvent this obstacle, we resort to pairwise independence.

Original: To develop these ideas more formally, we begin with the fact that (cid:96) independent random bits sufﬁce forgenerating 2 (cid:96) − 1 pairwise independent bits, by taking the exclusive-or of every nonempty subset [22,
Revised: To develop these ideas more formally, we begin with the fact that (cid:96) independent random bits sufﬁce for generating 2 (cid:96) − 1 pairwise independent bits, by taking the exclusive-or of every nonempty subset [22,

Original: Lemma 13.1].
Revised: Lemma 13.1].

Original: We may index by a bitvector t ∈ { 0 , 1 } (cid:96) , interpreted as the integer t 1 +2 t 2 + . . .
Revised: We may index by a bitvector t ∈ { 0 , 1 } (cid:96) , interpreted as the integer t 1 +2 t 2 + . . .

Original: 2 (cid:96) − 1 t (cid:96) .
Revised: 2 (cid:96) − 1 t (cid:96) .

Original: Deﬁnition 2.
Revised: Deﬁnition 2.

Original: The subset-sum expansion of x ∈ { 0 , 1 } (cid:96) is the bit vector y ∈ { 0 , 1 } 2 (cid:96) − 1 given byy t := (cid:96) (cid:77) i=
Revised: The subset-sum expansion of x ∈ { 0 , 1 } (cid:96) is the bit vector y ∈ { 0 , 1 } 2 (cid:96) − 1 given by y t : = (cid:96) (cid:77) i

Original: [Equation]
Revised: =

Original:  , (0 , 0 , . . . , 0) (cid:54) =
Revised: t i x i , (0 , 0 , . . . , 0) (cid:54) =

Original: t ∈ { 0 , 1 } (cid:96) .
Revised: t ∈ { 0 , 1 } (cid:96) .

Original: Fact 2.
Revised: Fact 2.

Original: Let x be a uniform draw from { 0 , 1 } (cid:96) and y its subset-sum expansion.
Revised: Let x be a uniform draw from { 0 , 1 } (cid:96) and y its subset-sum expansion.

Original: Then the bits y t arepairwise independent uniform draws from { 0 , 1 } .
Revised: Then the bits y t are pairwise independent uniform draws from { 0 , 1 } .

Original: Clearly, if the index t is given as a bit vector, the bit y t can be computed by a succinct circuit:
Revised: Clearly, if the index t is given as a bit vector, the bit y t can be computed by a succinct circuit:

Original: Proposition 3.
Revised: Proposition 3.

Original: Given a bit vector x ∈ { 0 , 1 } (cid:96) , there is a circuit C : F (cid:96) → F of size O ( (cid:96) ) and degree(cid:96) such that C ( t ) =
Revised: Given a bit vector x ∈ { 0 , 1 } (cid:96) , there is a circuit C : F (cid:96) → F of size O ( (cid:96) ) and degree (cid:96) such that C ( t ) =

Original: y t for all t ∈ { 0 , 1 } (cid:96) \ { (0 , 0 , . . .
Revised: y t for all t ∈ { 0 , 1 } (cid:96) \ { (0 , 0 , . . .

Original: , 0) } , where y is the subset-sum expansion of x .
Revised: , 0) } , where y is the subset-sum expansion of x .

Original: Proof.
Revised: Proof.

Original: The ﬁrst layer computes z i :=
Revised: The ﬁrst layer computes z i :=

Original: t i x i for i = 1 , 2 , . . .
Revised: t i x i for i = 1 , 2 , . . .

Original: , (cid:96) .
Revised: , (cid:96) .

Original: The second layer computes theexclusive-or of z 1 , z 2 , . . .
Revised: The second layer computes the exclusive-or of z 1 , z 2 , . . .

Original: , z (cid:96) using the arithmetization a ⊕ b = a (1 − b )
Revised: , z (cid:96) using the arithmetization a ⊕ b = a (1 − b )

Original: +(1 − a ) b = a + b − 2 ab .
Revised: +(1 − a ) b = a + b − 2 ab .

Original: A single random bit y t being generally insufﬁcient for generating the random variable W t of interest,we take n independent copies, where n will be set depending on the speciﬁc random variable.
Revised: A single random bit y t being generally insufﬁcient for generating the random variable W t of interest, we take n independent copies, where n will be set depending on the speciﬁc random variable.

Original: Lemma 4 ( † ) .
Revised: Lemma 4 ( † ) .

Original: Let C : F n → F be a circuit of size s and degree d .
Revised: Let C : F n → F be a circuit of size s and degree d .

Original: Let N ≤ 2 (cid:96) − 1 be a power of2 .
Revised: Let N ≤ 2 (cid:96) − 1 be a power of 2 .

Original: Then, given bit vectors x 1 , x 2 , . . .
Revised: Then, given bit vectors x 1 , x 2 , . . .

Original: , x n ∈ { 0 , 1 } (cid:96) and a factorization N = 2 a 2 b , there is a circuit
Revised: , x n ∈ { 0 , 1 } (cid:96) and a factorization N = 2 a 2 b , there is a circuit

Original: C ∗ : F a → F of size O
Revised: C ∗ : F a → F of size O

Original: 2 b ( (cid:96)n + s )) and degree (cid:96)d , such that
Revised: 2 b ( (cid:96)n + s )) and degree (cid:96)d , such that

Original: [Equation]
Revised: [Equation]

Original: t = C ( y 1 t , y 2 t , . . . , y n t ) , where y i ∈ { 0 , 1 } 2 (cid:96) − 1 is the subset-sum expansion of x i .
Revised: where y i ∈ { 0 , 1 } 2 (cid:96) − 1 is the subset-sum expansion of x i .

Original: 3.2 Veriﬁable approximation schemes
Revised: 3.2 Veriﬁable approximation schemes

Original: So far we have required that the veriﬁer’s output is correct if the prover’s output was correct(Deﬁnition 1).
Revised: So far we have required that the veriﬁer’s output is correct if the prover’s output was correct (Deﬁnition 1).

Original: While this applies to computing Monte Carlo estimators (with a ﬁxed sequence ofrandom bits), as shown above, we ﬁnd it convenient to extend the deﬁnition so that the veriﬁer’soutput is only required to have probabilistic error guarantees.
Revised: While this applies to computing Monte Carlo estimators (with a ﬁxed sequence of random bits), as shown above, we ﬁnd it convenient to extend the deﬁnition so that the veriﬁer’s output is only required to have probabilistic error guarantees.

Original: We focus on conrolling the relativeerror; call a random variable Z an ( (cid:15), δ ) -approximation of a real r if Pr( | Z/r − 1 | > (cid:15) ) <
Revised: We focus on conrolling the relative error; call a random variable Z an ( (cid:15), δ ) -approximation of a real r if Pr( | Z/r − 1 | > (cid:15) ) <

Original: δ .
Revised: δ .

Original: Deﬁnition 3.
Revised: Deﬁnition 3.

Original: Let A be an algorithm with access to another algorithm B .
Revised: Let A be an algorithm with access to another algorithm B .

Original: We call A a veriﬁablerandomized approximation scheme (vras) if, given an instance and tolerance parameters (cid:15), δ > 0 ,it outputs an ( (cid:15), δ ) -approximation whenever the output of B is correct, and otherwise A outputs“untrusted” with probability at least 2 / 3 .
Revised: We call A a veriﬁable randomized approximation scheme (vras) if, given an instance and tolerance parameters (cid:15), δ > 0 , it outputs an ( (cid:15), δ ) -approximation whenever the output of B is correct, and otherwise A outputs “untrusted” with probability at least 2 / 3 .

Original: We refer to A and B as the veriﬁer and the prover and theirtime requirements as the veriﬁer time and the prover time , respectively.
Revised: We refer to A and B as the veriﬁer and the prover and their time requirements as the veriﬁer time and the prover time , respectively.

Original: If a Monte Carlo estimator is an ( (cid:15), δ ) -approximation for sufﬁciently large N , we obtain a vras byapplying Lemma 4 and Theorem 5.
Revised: If a Monte Carlo estimator is an ( (cid:15), δ ) -approximation for sufﬁciently large N , we obtain a vras by applying Lemma 4 and Theorem 5.

Original: Typically, for averages of 0 – 1 random variables in particular,such estimators are derived using Chernoff bounds assuming independent samples, which we do nothave here.
Revised: Typically, for averages of 0 – 1 random variables in particular, such estimators are derived using Chernoff bounds assuming independent samples, which we do not have here.

Original: Fortunately, pairwise independence sufﬁces for concetration results based on the secondmoment; Chebysev’s inequality only needs control of the critical ratio E [ W 2 ] / E [ W ] 2 .
Revised: Fortunately, pairwise independence sufﬁces for concetration results based on the second moment; Chebysev’s inequality only needs control of the critical ratio E [ W 2 ] / E [ W ] 2 .

Original: Theorem 5 ( † ) .
Revised: Theorem 5 ( † ) .

Original: Let W be a random variable with the critical ratio at most a known upper bound R .
Revised: Let W be a random variable with the critical ratio at most a known upper bound R .

Original: Suppose there is an arithmetic circuit C : F n → F of size s and degree d such that W = C ( x ) forx drawn uniformly at random from { 0 , 1 } n .
Revised: Suppose there is an arithmetic circuit C : F n → F of size s and degree d such that W = C ( x ) for x drawn uniformly at random from { 0 , 1 } n .

Original: Then the mean of W admits a vras with a prover time˜ O ( T ) and a veriﬁer time ˜ O ( √ T
Revised: Then the mean of W admits a vras with a prover time ˜ O ( T ) and a veriﬁer time ˜ O ( √ T

Original: + s + d log
Revised: + s + d log

Original: δ − 1 ) , where T := R · d · s · (cid:15) − 2 · ln δ − 1 .
Revised: δ − 1 ) , where T := R · d · s · (cid:15) − 2 · ln δ − 1 .

Original: Note that the total work T is essentially—up to the factor d and the hidden polylogarithmic factors—the same as the requirement of the baseline algorithm that does not enable veriﬁcation.
Revised: Note that the total work T is essentially—up to the factor d and the hidden polylogarithmic factors— the same as the requirement of the baseline algorithm that does not enable veriﬁcation.

Original: Usually theterm √ T dominates the veriﬁer’s time requirement.
Revised: Usually the term √ T dominates the veriﬁer’s time requirement.

Original: Recall that we implicitly assume that the circuitcan also be efﬁciently constructed for the given problem instance.
Revised: Recall that we implicitly assume that the circuit can also be efﬁciently constructed for the given problem instance.

Original: The challenge is, however, ratherto show that the random variable W can be generated by a low-degree circuit.
Revised: The challenge is, however, rather to show that the random variable W can be generated by a low-degree circuit.

Original: 3.3 Example: The Godsil–Gutman estimator for the permanent
Revised: 3.3 Example: The Godsil–Gutman estimator for the permanent

Original: Let A =
Revised: Let A =

Original: ( a ij ) be an m × m binary matrix and B = ( b ij ) an m × m matrix where b ij are independentuniform draws from {− a ij , a ij } ⊂ {− 1 , 0 , 1 } .
Revised: ( a ij ) be an m × m binary matrix and B = ( b ij ) an m × m matrix where b ij are independent uniform draws from {− a ij , a ij } ⊂ {− 1 , 0 , 1 } .

Original: One can show that E (cid:2) (det B ) 2 (cid:3) = per A .
Revised: One can show that E (cid:2) (det B ) 2 (cid:3) = per A .

Original: Employingthis observation, the Godsil–Gutman estimator [7] for the permanent is given by N − 1 (cid:80)
Revised: Employing this observation, the Godsil–Gutman estimator [7] for the permanent is given by N − 1 (cid:80)

Original: Nt =1 W t ,where W t are copies of W := (det B ) 2 .
Revised: Nt =1 W t , where W t are copies of W := (det B ) 2 .

Original: The critical ratio of W is at most 3 m/ 2 [15].
Revised: The critical ratio of W is at most 3 m/ 2 [15].

Original: We show that the permanent admits a vras.
Revised: We show that the permanent admits a vras.

Original: By Theorem 5, it sufﬁces to give an arithmetic circuit
Revised: By Theorem 5, it sufﬁces to give an arithmetic circuit

Original: C that computes W given some number n of random bits as input.
Revised: C that computes W given some number n of random bits as input.

Original: We put n := m 2 so that thereis one random bit x ij per matrix entry.
Revised: We put n := m 2 so that there is one random bit x ij per matrix entry.

Original: The ﬁrst layer of C constructs B by b ij :=
Revised: The ﬁrst layer of C constructs B by b ij :=

Original: (1 − 2 x ij ) a ij .
Revised: (1 − 2 x ij ) a ij .

Original: The second layer computes the determinant of B using, e.g., Berkowitz’s division-free circuit of size
Revised: The second layer computes the determinant of B using, e.g., Berkowitz’s division-free circuit of size

Original: O ( m 4 ) [3]; in fact, by Remark 1, we may use division and replace the bound by O ( m 3 ) .
Revised: O ( m 4 ) [3]; in fact, by Remark 1, we may use division and replace the bound by O ( m 3 ) .

Original: The lastlayer raises the obtained result to the second power.
Revised: The last layer raises the obtained result to the second power.

Original: Since the degree of the determinant is m , thedegree of the circuit is 2 m .
Revised: Since the degree of the determinant is m , the degree of the circuit is 2 m .

Original: By Theorem 5, the prover time and veriﬁer times are ˜ O ( T ) and ˜ O ( √ T ) ,where T = 3 m/ 2 (cid:15) − 2 ln δ − 1 , ignoring a factor polynomial in m .
Revised: By Theorem 5, the prover time and veriﬁer times are ˜ O ( T ) and ˜ O ( √ T ) , where T = 3 m/ 2 (cid:15) − 2 ln δ − 1 , ignoring a factor polynomial in m .

Original: The circuit is deﬁned over the ﬁeld221 Z /q Z , where q is a large prime; it is sufﬁcient to have q ≥ 2 N ( n !)
Revised: The circuit is deﬁned over the ﬁeld Z /q Z , where q is a large prime; it is sufﬁcient to have q ≥ 2 N ( n !)

Original: 2 so that the arithmetic does notoverﬂow.
Revised: 2 so that the arithmetic does not overﬂow.

Original: Large primes can be efﬁciently found [2].
Revised: Large primes can be efﬁciently found [2].

Original: 3.4 Example: A quaternion based estimator for the permanent
Revised: 3.4 Example: A quaternion based estimator for the permanent

Original: A more sophisticated Godsil-Gutman type estimator [5] uses a random matrix B whose entry b ijis zero if a ij = 0 , and otherwise an independent uniform draw from the signed quaternion basis{± 1 , ± i , ± j , ± k } .
Revised: A more sophisticated Godsil-Gutman type estimator [5] uses a random matrix B whose entry b ij is zero if a ij = 0 , and otherwise an independent uniform draw from the signed quaternion basis {± 1 , ± i , ± j , ± k } .

Original: Representing the four basis elements, respectively, by the complex-valued 2 × 2matrices (cid:0) 1 0 0 1 (cid:1) , (cid:0) i 0 0 − i (cid:1) , (cid:0) 0 1 − 1 0 (cid:1) , and (cid:0) 

Revised: Representing the four basis elements, respectively, by the complex-valued 2 ×matrices (cid:0) 1 0 0 1 (cid:1) , (cid:0) i 0 0 − i (cid:1) , (cid:0) 0 1 − 1 0 (cid:1) , and (cid:0)

Original: i i 0 (cid:1) , and letting D =
Revised: i i 0 (cid:1) , and letting D =

Original: ( d ij ) be the corresponding 2 m × 2 mmatrix representation of B , the random variable of interest is W := det D .
Revised: ( d ij ) be the corresponding 2 m × 2 m matrix representation of B , the random variable of interest is W := det D .

Original: The mean of W equalsper A and the critical ratio of W is at most (3 / 2) m/ 2 [5], improving on the basic estimator.
Revised: The mean of W equals per A and the critical ratio of W is at most (3 / 2) m/ 2 [5], improving on the basic estimator.

Original: Accordingly, we can apply Theorem 5 to show that the permanent admits a vras with a prover time˜ O ( T ) and a veriﬁer time ˜ O ( √ T + log δ − 1 ) , where T = (3 / 2) m/ 2 (cid:15) − 2 ln δ − 1 .
Revised: Accordingly, we can apply Theorem 5 to show that the permanent admits a vras with a prover time ˜ O ( T ) and a veriﬁer time ˜ O ( √ T + log δ − 1 ) , where T = (3 / 2) m/ 2 (cid:15) − 2 ln δ − 1 .

Original: Now our circuit tocompute W takes as input 3 random bits x, y, z per entry a ij of A and puts 
Revised: Now our circuit to compute W takes as input 3 random bits x, y, z per entry a ij of A and puts (cid:18) d 2 i − 1 , 2 j −

Original: [Equation]
Revised: [Equation]

Original:  where M 1 , M 2 , M 3 , M 4 are the 2 × 2 matrices given above.
Revised: , where M 1 , M 2 , M 3 , M 4 are the 2 × 2 matrices given above.

Original: Thus the degree of each entry of D is 3 ,whence the degree of det D is 6 m .
Revised: Thus the degree of each entry of D is 3 , whence the degree of det D is 6 m .

Original: The circuit is deﬁned over Z /q Z , with an appropriate prime q :we require q ≥ 2 N ( n !)
Revised: The circuit is deﬁned over Z /q Z , with an appropriate prime q : we require q ≥ 2 N ( n !)

Original: 2 to avoid overﬂows and, additionally, that q = 1 mod 4 to guarantee that theﬁeld has fourth roots of unity (to serve as i , − 1 , − i , and 1 ); the roots can be efﬁciently found [1].
Revised: 2 to avoid overﬂows and, additionally, that q = 1 mod 4 to guarantee that the ﬁeld has fourth roots of unity (to serve as i , − 1 , − i , and 1 ); the roots can be efﬁciently found [1].

Original:  Extensions for approximate circuits
Revised:  Extensions for approximate circuits

Original: So far we have assumed that the random variable W can be exactly computed by a succinct arithmeticcircuit.
Revised: So far we have assumed that the random variable W can be exactly computed by a succinct arithmetic circuit.

Original: We next extend the method to allow for circuits that only approximate the random variable.
Revised: We next extend the method to allow for circuits that only approximate the random variable.

Original: 4.1 Small deviation with high probability
Revised: 4.1 Small deviation with high probability

Original: Clearly, to obtain an ( (cid:15), δ ) -approximation, the expected value of the circuit need not be exactly that of
Revised: Clearly, to obtain an ( (cid:15), δ ) -approximation, the expected value of the circuit need not be exactly that of

Original: W — achieving a relative error of order O ( (cid:15) ) should sufﬁce.
Revised: W — achieving a relative error of order O ( (cid:15) ) should sufﬁce.

Original: Likewise, the shape of the distributionneed not be similar to that of W —having a reasonable upper bound for the critical ratio should sufﬁce.
Revised: Likewise, the shape of the distribution need not be similar to that of W —having a reasonable upper bound for the critical ratio should sufﬁce.

Original: Moreover, we may let the circuit fail and not deliver these features with a small probability or order
Revised: Moreover, we may let the circuit fail and not deliver these features with a small probability or order

Original: O ( δ ) .
Revised: O ( δ ) .

Original: We next formalize this intuition.
Revised: We next formalize this intuition.

Original: For a random variable Y and event A , write σ [ Y | A ] for the standard deviation of the conditionaldistribution, i.e., for the (nonnegative) square root of the conditional variance E
Revised: For a random variable Y and event A , write σ [ Y | A ] for the standard deviation of the conditional distribution, i.e., for the (nonnegative) square root of the conditional variance E

Original: [ Y 2 | A ] − E [ Y |
Revised: [ Y 2 | A ] − E [ Y |

Original: A ] 2 .
Revised: A ] 2 .

Original: Deﬁnition 4.
Revised: Deﬁnition 4.

Original: Let (Ω i , F i , P i ) be probability spaces and X i : Ω i → R random variables, i ∈ { 1 , 2 } .
Revised: Let (Ω i , F i , P i ) be probability spaces and X i : Ω i → R random variables, i ∈ { 1 , 2 } .

Original: Let (cid:15), δ ∈ [0 , 1] .
Revised: Let (cid:15), δ ∈ [0 , 1] .

Original: We say that X 2 is an ( (cid:15), δ ) -deviate of X 1 if there exists an acceptance event A ∈ F 2such that P 2 ( A ) ≥ 1 − δ and E
Revised: We say that X 2 is an ( (cid:15), δ ) -deviate of X 1 if there exists an acceptance event A ∈ Fsuch that P 2 ( A ) ≥ 1 − δ and E

Original: [ X 2 | A ] and σ [ X 2 | A ] approximate E
Revised: [ X 2 | A ] and σ [ X 2 | A ] approximate E

Original: [ X 1 ] and σ [ X 1 ] to within arelative error of (cid:15) and 1 , respectively.
Revised: [ X 1 ] and σ [ X 1 ] to within a relative error of (cid:15) and 1 , respectively.

Original: Our choice of the upper bound 1 for the relative error of the standard deviation is somewhat arbitrary.
Revised: Our choice of the upper bound 1 for the relative error of the standard deviation is somewhat arbitrary.

Original: One may replace it by any small number, incurring only a respective small factor to the running time.
Revised: One may replace it by any small number, incurring only a respective small factor to the running time.

Original: Corollary 6 ( † ) .
Revised: Corollary 6 ( † ) .

Original: Let W be a random variable with the critical ratio at most a known upper bound
Revised: Let W be a random variable with the critical ratio at most a known upper bound

Original: R .
Revised: R .

Original: Suppose that, for any γ :=
Revised: Suppose that, for any γ :=

Original: ( α, β ) ∈ (0 , 1) 

Revised: ( α, β ) ∈ (0 , 1)

Original: , there is an arithmetic circuit C γ : F n γ → F ofsize s γ and degree d γ such that C γ ( x ) is an ( α, β ) -deviate of W when x is drawn uniformly atrandom from { 0 , 1 } n γ .
Revised: , there is an arithmetic circuit C γ : F n γ → F of size s γ and degree d γ such that C γ ( x ) is an ( α, β ) -deviate of W when x is drawn uniformly at random from { 0 , 1 } n γ .

Original: Then, for any α ≤ (cid:15)/ 3 and β ≤ δ(cid:15) 2 / (cid:0) 3456 R ln(2 /δ ) (cid:1) , the mean of Wadmits an ( (cid:15), δ ) -vras with a prover time ˜ O ( T ) and a veriﬁer time ˜ O ( √ T + s γ + d γ log δ − 1 ) , where
Revised: Then, for any α ≤ (cid:15)/ 3 and β ≤ δ(cid:15) 2 / (cid:0) 3456 R ln(2 /δ ) (cid:1) , the mean of W admits an ( (cid:15), δ ) -vras with a prover time ˜ O ( T ) and a veriﬁer time ˜ O ( √ T + s γ + d γ log δ − 1 ) , where

Original: T := R · d γ · s γ · (cid:15) − 2 · ln δ − 1 .
Revised: T := R · d γ · s γ · (cid:15) − 2 · ln δ − 1 .

Original: We have not optimized the constants.
Revised: We have not optimized the constants.

Original: Note also that we expect the parameter β to affect the circuitsize and degree only logaritmically, i.e., by a factor of (ln β − 1 ) O (1) ; see below for an example.
Revised: Note also that we expect the parameter β to affect the circuit size and degree only logaritmically, i.e., by a factor of (ln β − 1 ) O (1) ; see below for an example.

Original: 4.2 Example: Approximate model counting of disjunctive normal forms
Revised: 4.2 Example: Approximate model counting of disjunctive normal forms

Original: Given a Boolean formula ψ of n variables in a disjunctive normal form C 1 ∨ C 2 ∨ · · · ∨ C m , whereeach clause C j is a conjunction of literals, the DNF counting problem asks the number of truthassignments that satisfy ψ , denoted by c ( ψ ) .
Revised: Given a Boolean formula ψ of n variables in a disjunctive normal form C 1 ∨ C 2 ∨ · · · ∨ C m , where each clause C j is a conjunction of literals, the DNF counting problem asks the number of truth assignments that satisfy ψ , denoted by c ( ψ ) .

Original: The problem is a fundamental #P-complete withapplications in diverse domains ranging from network reliability to probabilistic databases (see,e.g., [21] and references therein).
Revised: The problem is a fundamental #P-complete with applications in diverse domains ranging from network reliability to probabilistic databases (see, e.g., [21] and references therein).

Original: We next present a veriﬁable extension of a classic Monte Carloalgorithm [16, 22, Sect.
Revised: We next present a veriﬁable extension of a classic Monte Carlo algorithm [16, 22, Sect.

Original: 10.2] that outputs an ( (cid:15), δ ) -approximation in time O ( m 2 n(cid:15) − 2 log δ − 1 ) .
Revised: 10.2] that outputs an ( (cid:15), δ ) -approximation in time O ( m 2 n(cid:15) − 2 log δ − 1 ) .

Original: Let S j be the set of truth assigments that satisfy C j .
Revised: Let S j be the set of truth assigments that satisfy C j .

Original: Generate a random variable W as follows:ﬁrst select j with probability proportional to the cardinality | S j | ; then draw an assignment a ∈ S juniformly at random; let W :
Revised: Generate a random variable W as follows: ﬁrst select j with probability proportional to the cardinality | S j | ; then draw an assignment a ∈ S j uniformly at random; let W :

Original: = 1 if a does not belong to S k for any k < j , and W := 0 otherwise.
Revised: = 1 if a does not belong to S k for any k < j , and W := 0 otherwise.

Original: Lemma 7 ([16], † ) .
Revised: Lemma 7 ([16], † ) .

Original: The mean of W equals c ( ψ ) / (cid:80) mj
Revised: The mean of W equals c ( ψ ) / (cid:80) mj

Original: =1 | S j | and the critical ratio is at most m .
Revised: =1 | S j | and the critical ratio is at most m .

Original: As computing the sum of the sizes | S j | is easy, it remains to give a succinct arithmetic circuitthat computes W .
Revised: As computing the sum of the sizes | S j | is easy, it remains to give a succinct arithmetic circuit that computes W .

Original: The challenge is to turn given (cid:96) random bits into a sample from the categoricaldistribution where the probability of j ∈ { 1 , 2 , . . .
Revised: The challenge is to turn given (cid:96) random bits into a sample from the categorical distribution where the probability of j ∈ { 1 , 2 , . . .

Original: , m } is proportional to | S
Revised: , m } is proportional to | S

Original: j | .
Revised: j | .

Original: We use rejectionsampling.
Revised: We use rejection sampling.

Original: When the random bit string, interpreted as an integer, falls in the range spanned by thesum of | S j | , the sample is accepted and output of the circuit is a copy of W .
Revised: When the random bit string, interpreted as an integer, falls in the range spanned by the sum of | S j | , the sample is accepted and output of the circuit is a copy of W .

Original: Otherwise, the samplingfails and the circuit outputs 0 .
Revised: Otherwise, the sampling fails and the circuit outputs 0 .

Original: The probability of failing can be made small:
Revised: The probability of failing can be made small:

Original: Lemma 8 ( † ) .
Revised: Lemma 8 ( † ) .

Original: For any β > 0 , there is an arithmetic circuit of size O (cid:0) m ( n + log β − 1 ) (cid:1) and degree
Revised: For any β > 0 , there is an arithmetic circuit of size O (cid:0) m ( n + log β − 1 ) (cid:1) and degree

Original: O (cid:0) mn ( n + log β − 1 ) (cid:1) such that the output of the circuit is an (0 , β ) -deviate of W when given
Revised: O (cid:0) mn ( n + log β − 1 ) (cid:1) such that the output of the circuit is an (0 , β ) -deviate of W when given

Original: O ( n + log β − 1 ) independent uniformly distributed bits as input.
Revised: O ( n + log β − 1 ) independent uniformly distributed bits as input.

Original: Remark 2.
Revised: Remark 2.

Original: If the mean of W is at most 1 / 2 (guaranteed, e.g., by duplicating each clause), then theconstructed random variable is also an ( β, 0) -deviate of W .
Revised: If the mean of W is at most 1 / 2 (guaranteed, e.g., by duplicating each clause), then the constructed random variable is also an ( β, 0) -deviate of W .

Original: Namely, when the sampling of j fails,the output is 0 .
Revised: Namely, when the sampling of j fails, the output is 0 .

Original: Thus, the mean of the Bernoulli variable is at most the exact mean µ and at least(1 − β ) µ .
Revised: Thus, the mean of the Bernoulli variable is at most the exact mean µ and at least (1 − β ) µ .

Original: The variance is at most µ (1 − (1 − β ) µ ) = µ (1 − µ ) + βµ 2 ≤ (1 + β ) µ (1 − µ ) and atleast (1 − β ) µ (1 − µ ) , implying that also the standard deviation is within a relative error of at most β .
Revised: The variance is at most µ (1 − (1 − β ) µ ) = µ (1 − µ ) + βµ 2 ≤ (1 + β ) µ (1 − µ ) and at least (1 − β ) µ (1 − µ ) , implying that also the standard deviation is within a relative error of at most β .

Original: Having a circuit for W , we are ready to apply Corollary 6.
Revised: Having a circuit for W , we are ready to apply Corollary 6.

Original: For simplicity of expressions, let us makethe modest assumption that ln δ − 1 =
Revised: For simplicity of expressions, let us make the modest assumption that ln δ − 1 =

Original: ˜ O ( n ) or ln (cid:15) − 

Revised: ˜ O ( n ) or ln (cid:15) −

Original: = ˜ O ( n ) .
Revised: = ˜ O ( n ) .

Original: By substituting the above size anddegree bounds to the formulas in the corollary, we get, after hiding logarithmic factors, that the DNFcounting problem admits a vras with a prover time ˜ O ( T ) and a veriﬁer time ˜ O ( √ T + mn 2 log δ − 1 ) ,where T =
Revised: By substituting the above size and degree bounds to the formulas in the corollary, we get, after hiding logarithmic factors, that the DNF counting problem admits a vras with a prover time ˜ O ( T ) and a veriﬁer time ˜ O ( √ T + mn 2 log δ − 1 ) , where T =

Original: ( mn ) 3 (cid:15) − 2 ln δ − 1 .
Revised: ( mn ) 3 (cid:15) − 2 ln δ − 1 .

Original: (We leave the veriﬁcation of these bounds to the reader.)
Revised: (We leave the veriﬁcation of these bounds to the reader.)

Original: This example highlights some new features of our method.
Revised: This example highlights some new features of our method.

Original: Since the required Monte Carlo samplesize is relative small (linear in m ) in comparison to the time requirement per sample (linear in mnin the original algorithm), the veriﬁable extension did incur a non-negligble overhead in the totalcomplexity, by a factor of mn 2 .
Revised: Since the required Monte Carlo sample size is relative small (linear in m ) in comparison to the time requirement per sample (linear in mn in the original algorithm), the veriﬁable extension did incur a non-negligble overhead in the total complexity, by a factor of mn 2 .

Original: Crucially, however, the cost of the veriﬁer remains signiﬁcantlylower than the total cost of the original algorithm.
Revised: Crucially, however, the cost of the veriﬁer remains signiﬁcantly lower than the total cost of the original algorithm.

Original: In particular, for small (cid:15) we have (cid:15) − 1 (cid:28) (cid:15) − 2 .
Revised: In particular, for small (cid:15) we have (cid:15) − 1 (cid:28) (cid:15) − 2 .

Original: 4.3 Example: Gradient estimation
Revised: 4.3 Example: Gradient estimation

Original: In variational inference the posterior distribution of model parameters w is approximated by aparametric distribution q ( w ; θ ) whose parameters θ are optimized to maximize the objective
Revised: In variational inference the posterior distribution of model parameters w is approximated by a parametric distribution q ( w ; θ ) whose parameters θ are optimized to maximize the objective

Original: [Equation]
Revised: [Equation]

Original: where f is the log-likelihood of the data, p is a prior of w , and KL is the Kullback–Leibler divergence[13].
Revised: where f is the log-likelihood of the data, p is a prior of w , and KL is the Kullback–Leibler divergence [13].

Original: A popular optimization method iteratively updates the parameters in the direction of the gradient∇ θ F ( θ ) , for which an approximation is obtained using a Monte Carlo method.
Revised: A popular optimization method iteratively updates the parameters in the direction of the gradient ∇ θ F ( θ ) , for which an approximation is obtained using a Monte Carlo method.

Original: As a concrete instantiation, consider Bayesian logistic regression [12, 23], in which the probability of aresponse y ∈ {− 1 , 1 } given a feature vector x ∈ R n is modeled as g ( yx · w ) , with g ( z )
Revised: As a concrete instantiation, consider Bayesian logistic regression [12, 23], in which the probability of a response y ∈ {− 1 , 1 } given a feature vector x ∈ R n is modeled as g ( yx · w ) , with g ( z )

Original: = 1 / (1+e − z ) .
Revised: = 1 / (1+e − z ) .

Original: The prior p for the parameter vector w ∈ R n is taken as a multivariate normal N (0 , cI ) withsome constant c > 0 , and the posterior approximation q is a multivariate normal N ( µ, Σ) withΣ = diag( σ 1 , σ 2 , . . .
Revised: The prior p for the parameter vector w ∈ R n is taken as a multivariate normal N (0 , cI ) with some constant c > 0 , and the posterior approximation q is a multivariate normal N ( µ, Σ) with Σ = diag( σ 1 , σ 2 , . . .

Original: , σ n ) .
Revised: , σ n ) .

Original: Thus θ = ( µ, Σ) and f ( w ) = (cid:80) ( x
Revised: Thus θ = ( µ, Σ) and f ( w ) = (cid:80) ( x

Original: ,y ) ∈
Revised: ,y ) ∈

Original: S ln g ( yx · w ) , where S is thegiven dataset of points ( x, y ) , which are modeled as exchangeable (i.e., independent given w ).
Revised: S ln g ( yx · w ) , where S is the given dataset of points ( x, y ) , which are modeled as exchangeable (i.e., independent given w ).

Original: Now, consider the estimation of the gradient of the expectation of f ( w ) ; the gradient of the KLdivergence can be obtained analytically.
Revised: Now, consider the estimation of the gradient of the expectation of f ( w ) ; the gradient of the KL divergence can be obtained analytically.

Original: The basic estimator is given by
Revised: The basic estimator is given by

Original: [Equation]
Revised: [Equation]

Original: A popular variant, we omit here for simplicity, constructs the estimator based on a subsample of thedata set, obtained by random sampling or by deterministically splitting the data set into batches [23].
Revised: A popular variant, we omit here for simplicity, constructs the estimator based on a subsample of the data set, obtained by random sampling or by deterministically splitting the data set into batches [23].

Original: To apply the method of trustworthy Monte Carlo, we need to ﬁnd an arithmetic circuit that approximates a random variable W := f ( w ) ∇ θ ln q ( w ; θ ) , where w ∼ q ( w ; θ ) , given some number ofuniformly distributed bits.
Revised: To apply the method of trustworthy Monte Carlo, we need to ﬁnd an arithmetic circuit that approximates a random variable W := f ( w ) ∇ θ ln q ( w ; θ ) , where w ∼ q ( w ; θ ) , given some number of uniformly distributed bits.

Original: In our example model, one can easily verify that the partial derivatives ofln q ( w ; θ ) with respect to µ i and σ 2 i equal ( µ i − w i ) /σ
Revised: In our example model, one can easily verify that the partial derivatives of ln q ( w ; θ ) with respect to µ i and σ 2 i equal ( µ i − w i ) /σ

Original: 2 i and [( µ i − w i ) 2 − σ 2 i ] / (2 σ 4 i ) , respectively.
Revised: 2 i and [( µ i − w i ) 2 − σ 2 i ] / (2 σ 4 i ) , respectively.

Original: These terms being simple polynomials of w i , they can be handled in a straightforward manner, oncethe scalar w i has been generated, increasing the size and degree of the circuit very little.
Revised: These terms being simple polynomials of w i , they can be handled in a straightforward manner, once the scalar w i has been generated, increasing the size and degree of the circuit very little.

Original: The actualchallenge is to construct a circuit for f ( w ) .
Revised: The actual challenge is to construct a circuit for f ( w ) .

Original: We next sketch a construction in four phases (details in
Revised: We next sketch a construction in four phases (details in

Original: Suppl.
Revised: Suppl.

Original: B).
Revised: B).

Original: Since f ( w ) can be arbitrarily close to 0 (assuming exact real arithmetic), our goal is toapproximate f ( w ) to within an absolute error (cid:15) > 0 with high probability (over the random w ).
Revised: Since f ( w ) can be arbitrarily close to 0 (assuming exact real arithmetic), our goal is to approximate f ( w ) to within an absolute error (cid:15) > 0 with high probability (over the random w ).

Original: The circuit takes as input n independent and uniformly distributed bit vectors r 1 , r 2 , . .
Revised: The circuit takes as input n independent and uniformly distributed bit vectors r 1 , r 2 , . .

Original: , r n ∈ { 0 , 1 } (cid:96) .
Revised: , r n ∈ { 0 , 1 } (cid:96) .

Original: It operates with numbers of the form k · 2 − m , where m is a positive integer and k is an integerbetween − 4 m + 1 and 4 m − 1 represented by 2 m + 1 bits; we denote by B m the set of these numbers.
Revised: It operates with numbers of the form k · 2 − m , where m is a positive integer and k is an integer between − 4 m + 1 and 4 m − 1 represented by 2 m + 1 bits; we denote by B m the set of these numbers.

Original: To enable exact arithmetic, we let m grow as the computations progress in the circuit, yet keepingm
Revised: To enable exact arithmetic, we let m grow as the computations progress in the circuit, yet keeping m =

Original: = O ( (cid:96) ) .
Revised: O ( (cid:96) ) .

Original: We assume that the data values x i , y i and model parameters σ i , µ i are represented aselements of B (cid:96) .
Revised: We assume that the data values x i , y i and model parameters σ i , µ i are represented as elements of B (cid:96) .

Original: We return to the question of how to set (cid:96) after the description of the four phases.
Revised: We return to the question of how to set (cid:96) after the description of the four phases.

Original: Sampling from the normal distribution.
Revised: Sampling from the normal distribution.

Original: For each dimension i = 1 , 2 , . . . , n , a subcircuitmaps r i to a w i ∈ B m that follows approximately a (discrete) normal distribution N ( µ i , σ 2 i ) .
Revised: For each dimension i = 1 , 2 , . . . , n , a subcircuit maps r i to a w i ∈ B m that follows approximately a (discrete) normal distribution N ( µ i , σ 2 i ) .

Original: We use a ﬁnite-precision version of an algorithm that would draw exact samples if we couldpeform exact arithmetic with real numbers.
Revised: We use a ﬁnite-precision version of an algorithm that would draw exact samples if we could peform exact arithmetic with real numbers.

Original: Each subcircuit is of size and degree (cid:96) O (1) .2.
Revised: Each subcircuit is of size and degree (cid:96) O (1) .

Original: Computing the dot product.
Revised: Computing the dot product.

Original: For each data point ( x, y ) ∈ S , a subcircuit maps w ∈ B nm to az ∈ B 2 m that equals yx · w .
Revised: For each data point ( x, y ) ∈ S , a subcircuit maps w ∈ B nm to a z ∈ B 2 m that equals yx · w .

Original: Each subcircuit is of size and degree (cid:96) O (1) , assuming (cid:96) =
Revised: Each subcircuit is of size and degree (cid:96) O (1) , assuming (cid:96) =

Original: Ω( n ) .3.
Revised: Ω( n ) .

Original: Evaluating the log-sigmoid.
Revised: Evaluating the log-sigmoid.

Original: For each data point ( x, y ) ∈ S , a subcircuit maps the corresponding z ∈ B 2 m to a number v x,y ∈ F that approximates ln g ( z ) with an absoluteerror at most α ; we let α = O
Revised: For each data point ( x, y ) ∈ S , a subcircuit maps the corresponding z ∈ B 2 m to a number v x,y ∈ F that approximates ln g ( z ) with an absolute error at most α ; we let α = O

Original: ( (cid:15)/ | S | ) to keep the total absolute error below (cid:15) .
Revised: ( (cid:15)/ | S | ) to keep the total absolute error below (cid:15) .

Original: We use acubic spline in an interval of length O (log α − 1 ) , centered at 0 .
Revised: We use a cubic spline in an interval of length O (log α − 1 ) , centered at 0 .

Original: Each subcircuit is of size O ( α − 1 / 4 log α − 1 ) and degree O (log α − 1 ) ; we assume m =
Revised: Each subcircuit is of size O ( α − 1 / 4 log α − 1 ) and degree O (log α − 1 ) ; we assume m =

Original: O (log α − 1 ) .4.
Revised: O (log α − 1 ) .

Original: Summing over the data points.
Revised: Summing over the data points.

Original: The last layer computes the sum (cid:80) (
Revised: The last layer computes the sum (cid:80) (

Original: x,y ) ∈ S v x,y .
Revised: x,y ) ∈ S v x,y .

Original: Thissubcircuit is of size O ( | S | ) and degree 1 .
Revised: This subcircuit is of size O ( | S | ) and degree 1 .

Original: We argue (Suppl.
Revised: We argue (Suppl.

Original: B) that in phases 1 and 2 the numbers z are generated from a distribution thatrapidly approaches the exact distribution as (cid:96) increases.
Revised: B) that in phases 1 and 2 the numbers z are generated from a distribution that rapidly approaches the exact distribution as (cid:96) increases.

Original: Phase 3 assumes the input numbers z to haveprecision O ( α ) ; we achieve this by setting (cid:96), m =
Revised: Phase 3 assumes the input numbers z to have precision O ( α ) ; we achieve this by setting (cid:96), m =

Original: O (log α − 1 ) , which is O (log | S | + log (cid:15) − 1 ) .
Revised: O (log α − 1 ) , which is O (log | S | + log (cid:15) − 1 ) .

Original: To bound the size and degree of the circuit, assume for simplicity that | S | ≥ n .
Revised: To bound the size and degree of the circuit, assume for simplicity that | S | ≥ n .

Original: Adding up thesize bounds for the subcircuits yields | S | ( (cid:96) O (1) + O ( α − 1 / 4 log α − 1 )) , which is ˜ O
Revised: Adding up the size bounds for the subcircuits yields | S | ( (cid:96) O (1) + O ( α − 1 / 4 log α − 1 )) , which is ˜ O

Original: ( | S | 5 / 4 (cid:15) − 1 / 4 ) .
Revised: ( | S | 5 / 4 (cid:15) − 1 / 4 ) .

Original: Multiplying the degree bounds for the four phases yields (cid:96) O
Revised: Multiplying the degree bounds for the four phases yields (cid:96) O

Original: (1) , which is (log | S | + log (cid:15) − 1 ) O (1) .
Revised: (1) , which is (log | S | + log (cid:15) − 1 ) O (1) .

Original: Weconclude, by the proof of Theorem 5, that asymptotically the prover time is ˜ O ( T ) and the veriﬁertime is ˜ O ( √ T + E ) , where E := | S | 5 / 4 (cid:15) − 1 / 4 and T := NE .
Revised: We conclude, by the proof of Theorem 5, that asymptotically the prover time is ˜ O ( T ) and the veriﬁer time is ˜ O ( √ T + E ) , where E := | S | 5 / 4 (cid:15) − 1 / 4 and T := NE .

Original: This example shows that we can engineer relatively succinct arithmetic circuits to approximatenon-polynomial functions.
Revised: This example shows that we can engineer relatively succinct arithmetic circuits to approximate non-polynomial functions.

Original: That said, it also shows that representing numbers as bit vectors to enablecomparison (in phase 3) incurs a cost that cumulates across the layers in the circuit; e.g., the dotproduct would require a very low-degree small circuit if the arithmetic was directly over F .
Revised: That said, it also shows that representing numbers as bit vectors to enable comparison (in phase 3) incurs a cost that cumulates across the layers in the circuit; e.g., the dot product would require a very low-degree small circuit if the arithmetic was directly over F .

Original:  Concluding remarks
Revised:  Concluding remarks

Original: We gave a generic method for equipping Monte Carlo estimators with a certiﬁcate of correctness.
Revised: We gave a generic method for equipping Monte Carlo estimators with a certiﬁcate of correctness.

Original: This method contributes towards general trustworthiness of machine learning and reasoning byenabling safe, veriﬁable outsourcing of sampling-based integration.
Revised: This method contributes towards general trustworthiness of machine learning and reasoning by enabling safe, veriﬁable outsourcing of sampling-based integration.

Original: When the random variables ofinterest can be (approximately) represented by low-degree arithmetic circuits, the method incursonly a small computational overhead and the veriﬁers’s work is about a square root of the total work.
Revised: When the random variables of interest can be (approximately) represented by low-degree arithmetic circuits, the method incurs only a small computational overhead and the veriﬁers’s work is about a square root of the total work.

Original: The framework readily supports massive and simple parallelization of the computations, along withefﬁcient error correction, with negligible additional cost [4, 14].
Revised: The framework readily supports massive and simple parallelization of the computations, along with efﬁcient error correction, with negligible additional cost [4, 14].

Original: We used a diverse set of exampleestimators to demonstrate the technical versality of the method, with the understanding that the needfor trustworthy computations may vary considerably across real application domains.
Revised: We used a diverse set of example estimators to demonstrate the technical versality of the method, with the understanding that the need for trustworthy computations may vary considerably across real application domains.

Original: The present work being theoretical, many practical issues remain to be addressed through implementation and experimentation.
Revised: The present work being theoretical, many practical issues remain to be addressed through implementation and experimentation.

Original: For example, our bounds hide polylogarithmic factors and leaveroom for “shaving logs” and optimizing constant factors.
Revised: For example, our bounds hide polylogarithmic factors and leave room for “shaving logs” and optimizing constant factors.

Original: Another direction is to more systematicallyengineer building blocks needed for constructing low-degree (approximating) arithmetic circuits; weexhibited a variety of ideas and techniques, but there is a need for a “catalogue” of primitive functionsand standard distributions.
Revised: Another direction is to more systematically engineer building blocks needed for constructing low-degree (approximating) arithmetic circuits; we exhibited a variety of ideas and techniques, but there is a need for a “catalogue” of primitive functions and standard distributions.

Original: Finally, there are fundamental questions regarding the limitations of themethod: Do random variables that result from sequential importance sampling or rejection sampling(e.g., for estimating the permanent [18, 10]) admit low-degree circuits?
Revised: Finally, there are fundamental questions regarding the limitations of the method: Do random variables that result from sequential importance sampling or rejection sampling (e.g., for estimating the permanent [18, 10]) admit low-degree circuits?

Original: Can the method be extendedbeyond pairwise independence, for example, to Markov chain Monte Carlo?
Revised: Can the method be extended beyond pairwise independence, for example, to Markov chain Monte Carlo?

Original: Given the challenges in engineering low-degree circuits, it would be tempting to learn succinctarithmetic circuits from examples, removing the need of human effort.
Revised: Given the challenges in engineering low-degree circuits, it would be tempting to learn succinct arithmetic circuits from examples, removing the need of human effort.

Original: Unfortunately, learningarithmetic circuits appears to be hard already for relatively restricted classes of circuits with blackbox access to the function [25]; however, some interesting classes of low-depth circuits do admitefﬁcient learning [17].
Revised: Unfortunately, learning arithmetic circuits appears to be hard already for relatively restricted classes of circuits with blackbox access to the function [25]; however, some interesting classes of low-depth circuits do admit efﬁcient learning [17].

Original: Arithmetic circuits have also found their use asso-called tractable probabilisticmodels.
Revised: Arithmetic circuits have also found their use as tractable probabilistic models.

Original: In particular, probabilistic generating circuits [29] support efﬁcient inference and subsumerelated models, such as determinantal point processes (e.g., [19]).
Revised: In particular, probabilistic generating circuits [29] support efﬁcient inference and subsume related models, such as determinantal point processes (e.g., [19]).

Original: Our work suggests that thesemodels might serve as building blocks that readily enable extensions to efﬁcient veriﬁable inference.Checklist
Revised: Our work suggests that these models might serve as building blocks that readily enable extensions to efﬁcient veriﬁable inference.

Original: For all authors...

Original: (a) Do the main claims made in the abstract and introduction accurately reﬂect the paper’scontributions and scope? [Yes] See Section 3 and Section 4. (b) Did you describe the limitations of your work? [Yes] Limitations are discussed inSection 5.
Revised: Acknowledgements

Original: (c) Did you discuss any potential negative societal impacts of your work?

Original: [N/A] We see

Original: no potential harm in having veriﬁable results.

Original: (d) Have you read the ethics review guidelines and ensured that your paper conforms to

Original: them?

Original: [Yes]

Original: If you are including theoretical results...

Original: (a) Did you state the full set of assumptions of all theoretical results?

Original: [Yes]

Original: (b) Did you include complete proofs of all theoretical results?

Original: [Yes] Some of the proofs

Original: are deferred to the supplement.

Original: If you ran experiments...

Original: (a) Did you include the code, data, and instructions needed to reproduce the main ex-

Original: perimental results (either in the supplemental material or as a URL)?

Original: [N/A] See our response to Question 4. (c). (b) Did you specify all the training details (e
Revised: This research is partially supported by the Academy of Finland, Grant 316771.

Original: g., data splits, hyperparameters,

Original: how they

Original: were chosen)?

Original: [N/A]

Original: (c) Did you report error bars (e.g., with respect to the random seed after running experi-

Original: ments multiple times)?

Original: [N/A]

Original: (d) Did you include the total amount of compute and the type of resources used (e.g., typeof GPUs, internal cluster, or cloud provider)?

Original: [N/A]

Original: If you are using existing assets (e

Original: g., code, data, models) or curating/releasing new assets...

Original: (a) If your work uses existing assets, did you cite the creators?

Original: [Yes] We cite Mathematica,

Original: in accordance with its license agreement.

Original: (b) Did you mention the license of the assets?

Original: [N/A]

Original: (c) Did you include any new assets either in the supplemental material or as a URL?

Original: [Yes] The supplemental material contains our proof-of-concept implementation of the

Original: veriﬁable estimator for the permanent of a matrix by Chien et al.

Original: (d) Did you discuss whether and how consent was obtained from people whose data you’re

Original: using/curating?

Original: [N/A]

Original: (e) Did you discuss whether the data you are using/curating contains personally identiﬁable

Original: information or offensive content?

Original: [N/A]

Original: If you used crowdsourcing or conducted research with human subjects...

Original: (a) Did you include the full text of instructions given to participants and screenshots, if

Original: applicable?

Original: [N/A]

Original: (b) Did you describe any potential participant risks, with links to Institutional Review

Original: Board (IRB) approvals, if applicable?

Original: [N/A]

Original: (c) Did you include the estimated hourly wage paid to participants and the total amount

Original: spent on participant compensation?

Original: [N/A]