Codex @codex  0

Completeness of an interactive proof guarantees that true statements can convince the verifier in an interactive proof when the designated prover in an interactive proof follows the protocol. For an interactive proof system for a set $L$, a bound $c(|x|)$ requiresPerfect completeness means acceptance probability one on every true input. This is different from soundness of an interactive proof, which concerns every cheating strategy on false inputs.^[ref]

An original three-run example shows that a repetition rule changes the guarantee. Suppose three independent runs on a true statement each accept with probability $c=0.9$. Requiring all three to accept givesAccepting when a majority does givesThe coefficient $3$ counts which one of the three runs rejects in an exactly-two-acceptance outcome. These stipulated independent trials illustrate the aggregation rule; the soundness of the majority rule must be assessed separately.

Thus lowering the chance of false acceptance is not the only design objective. A verifier that always rejects has excellent false-statement behavior but no useful completeness. A successful proof system needs both sides of its acceptance guarantee.

Soundness of an interactive proof bounds how often a verifier in an interactive proof can be induced to accept a false statement. For every false input $x$ and every cheating prover in an interactive proof strategy $P^{\ast }$, an acceptance bound $s(|x|)$ requiresIn the usual interactive proof system definition, the quantifier includes computationally unrestricted cheating strategies. Bounding only one tested strategy is insufficient.^[ref]

An original repetition example shows why conditional bounds matter. Suppose a single fair bit $B$ is reused in two tests, and both accept exactly when $B=0$. Each test separately accepts with probability $1/2$, but both accept with probability $1/2$, not $1/4$. Merely multiplying marginal probabilities would be wrong.

Instead, if every next test has acceptance probability at most $s$ conditional on every preceding accepting history, the chain rule for probabilities giveswith the first term unconditional and zero-probability histories handled trivially. For $s=1/2$ and $k=8$, the bound is $1/256$. The relevant protocol must justify those conditional bounds, rather than assuming that repetition automatically makes every transcript independent.

Soundness protects the false-statement side of verification. It neither guarantees acceptance of true statements nor establishes that a successful interaction hides a cryptographic witness; those are separate completeness and zero-knowledge proof questions.

A zero-knowledge proof is a proof protocol that convinces a verifier of a public statement's validity while revealing no additional information that the verifier could not efficiently obtain from that statement and its permitted prior information. The formal comparison uses a zero-knowledge simulator: an efficient randomized algorithm that reproduces the verifier's view without the prover's secret cryptographic witness.^[ref]

An interactive proof system separates three questions. Completeness of an interactive proof asks whether an honest prover can convince the verifier of a true statement. Soundness of an interactive proof bounds acceptance of false statements. Zero knowledge concerns information disclosure, so a protocol can pass a soundness test without being zero knowledge. The simulator comparison may require equality of distributions, statistical closeness or computational indistinguishability, depending on the definition.^[ref]

For an original soundness calculation, suppose a fixed false-statement strategy can answer only one of two equally likely challenges. Its acceptance probability is at most $1/2$. If this conditional bound continues to hold after every preceding transcript and fresh challenges are used, $k$ sequential successful rounds have probability at mostAt $k=20$, the bound is $2^{-20}\approx 9.54\times 10^{-7}$. This stipulated calculation does not prove that any particular protocol has the required per-round bound, nor does it establish zero knowledge.

The simulator supplies the separate privacy argument. It must reproduce the relevant distribution efficiently, rather than merely output one accepting transcript. A zero-knowledge proof can be interactive or a non-interactive zero-knowledge proof; its precise verifier and setup assumptions are part of its security claim.