On the Consistency of Circuit Lower Bounds
for Non-Deterministic Time

Abstract

We prove the first unconditional consistency result for superpolynomial circuit lower bounds with a relatively strong theory of bounded arithmetic. Namely, we show that the theory $\mathsf{V}^{0}_{2}$ is consistent with the conjecture that $\mathsf{NEXP}\not\subseteq\mathsf{P/poly}$, i.e., some problem that is solvable in non-deterministic exponential time does not have polynomial size circuits. We suggest this is the best currently available evidence for the truth of the conjecture. The same techniques establish the same results with $\mathsf{NEXP}$ replaced by the class of problems decidable in non-deterministic barely superpolynomial time such as $\mathsf{NTIME}(n^{O(\log\log\log n)})$. Additionally, we establish a magnification result on the hardness of proving circuit lower bounds.

1 Introduction

Bounded arithmetics are fragments of Peano arithmetic that formalize reasoning with concepts and constructions of bounded computational complexity. Their language is tailored so that natural classes of bounded formulas define important complexity classes. For example, the set of all bounded formulas defines precisely the problems in $\mathsf{PH}$ and the set of $\Sigma^{b}_{1}$-formulas those in $\mathsf{NP}$. The central theories are comprised in Buss’ hierarchy [6]

$$\textstyle\mathsf{S}^{1}_{2}\subseteq\mathsf{T}^{1}_{2}\subseteq\mathsf{S}^{2}_{2}\subseteq\mathsf{T}^{2}_{2}\subseteq\cdots\subseteq\mathsf{T}_{2}\subseteq\mathsf{V}^{0}_{2}\subseteq\mathsf{V}^{1}_{2}$$ (1)

The theory $\mathsf{S}^{1}_{2}$ can be understood as formalizing $\mathsf{P}$-reasoning, and $\mathsf{V}^{1}_{2}$ as formalizing $\mathsf{EXP}$-reasoning. The levels of $\mathsf{T}_{2}$ are determined by induction schemes for properties of bounded computational complexity. E.g., $\mathsf{T}^{1}_{2}$ has induction for $\mathsf{NP}$, and $\mathsf{T}_{2}$ for $\mathsf{PH}$. Intuitively, these theories can construct and reason with polynomially large objects of various computational complexities. The theories $\mathsf{V}^{0}_{2}$ and $\mathsf{V}^{1}_{2}$ are extensions with a second sort of variables ranging over bounded sets of numbers and are given by comprehension schemes. Intuitively, these sets represent exponentially large objects.

Low levels of the bounded arithmetic hierarchy formalize a considerable part of contemporary complexity theory. This includes some advanced topics such as the Arthur-Merlin hierarchy [17], hardness amplification [16], Toda’s theorem [7], and the PCP Theorem [30]. We refer to [26, Section 5] for a list of successful formalizations. Concerning circuit complexity, the topic of this paper, Jeřábek proved that his theory of approximate counting [15, 16, 17], which sits below $\mathsf{T}^{2}_{2}$, formalizes Rabin’s primality test, and proves that it is in $\mathsf{P/poly}$ [16, Example 3.2.10, Lemma 3.2.9]. Concerning lower bounds, many of the known (weak) circuit lower bounds can be formalized in a theory of approximate counting [26] and thus also in the theory $\mathsf{T}^{2}_{2}$. For example, the $\mathsf{AC}^{0}$ lower bound for parity has been formalized in [26, Theorem 1.1] via probabilistic reasoning with Furst, Saxe and Sipser’s random restrictions [13], and in [22, Theorem 15.2.3] via Razborov’s [32] proof of Håstad’s switching lemma.

Razborov asked in his seminal work from 1995 for the “right fragment capturing the kind of techniques existing in Boolean complexity” [32, p.344]. Showing that any theory that is strong enough to capture these techniques cannot prove lower bounds for general circuits would give a precise sense in which current techniques are insufficient. This however seems to be very difficult. We refer to [34, Introduction] or [23, Ch.27-30] for a description of the resulting research program, and to [31] for a recent result.

In contrast to unprovability, the first and final words of Krajíček’s 1995 monograph [22] ask for consistency results, namely to prove the conjecture in question “for nonstandard models of systems of bounded arithmetic”. These are “not ridiculously pathological structures, and a part of the difficulty in constructing them stems exactly from the fact that it is hard to distinguish these structures, by the studied properties, from natural numbers” [22, p.xii]. In particular, showing that a given conjecture is consistent with certain bounded arithmetics, already low ones, would exhibit a world where both the conjecture and a considerable part of complexity theory are true.

We therefore interpret consistency results as giving precise evidence for the truth of the conjecture. This is without doubt preferable to appealing to intuitions, or alluding to the experience that the conjectures appear to be theoretically coherent, exactly because a consistency result gives a precise meaning to this coherence.

1.1 Previous consistency results

Being well motivated, consistency results are also hard to come by, and not much is known. In particular, it is unknown whether $\mathsf{NP}\not\subseteq\mathsf{P/poly}$ is consistent with $\mathsf{S}^{1}_{2}$.

It is not straightforward to formalize $\mathsf{NP}\not\subseteq\mathsf{P/poly}$ because exponentiation is not provably total in bounded arithmetics. On the formal level, call a number $n$ small if $2^{n}$ exists. A size-$n^{c}$ circuit can be coded by a binary string of length at most $10\cdot n^{c}\cdot\log(n^{c})$, and hence by a number below $2^{10\cdot n^{c}\cdot\log(n^{c})}$; this bound exists for small $n$.

On the formal level, an $\mathsf{NP}$-problem is represented by a $\Sigma^{b}_{1}$-formula $\varphi(x)$. A sentence expressing that the problem defined by $\varphi(x)$ has size $n^{c}$ circuits looks as follows:

$$\alpha^{c}_{\varphi}:=\ \forall n{\in}\mathit{Log}_{>1}\ \exists C{<}2^{n^{c}}\ \forall x{<}2^{n}\ (C(x){=}1\leftrightarrow\varphi(x)).$$

Here, the quantifier on $n$ ranges over small numbers above $1$. We think of the quantifier on $C$ as ranging over circuits of encoding-size $n^{c}$, and of the quantifier on $x$ as ranging over length $n$ binary strings. Counting the $\exists$ hidden in $\varphi$, this is a bounded $\forall\exists\forall\exists$-sentence (namely a $\forall\Sigma^{b}_{3}$-sentence).

Now more precisely, the central question whether $\mathsf{S}^{1}_{2}$ is consistent with $\mathsf{NP}\not\subseteq\mathsf{P/poly}$ asks for a $\Sigma^{b}_{1}$-formula $\varphi(x)$ such that $\mathsf{S}^{1}_{2}+\big{\{}\neg\alpha^{c}_{\varphi}\mid c\in\mathbb{N}\big{\}}$ is consistent. As mentioned a model witnessing this consistency would be a world where a considerable part of complexity theory is true and the $\mathsf{NP}$-problem defined by $\varphi$ does not have polynomial-size circuits. This is faithful in that there also exists an $\mathsf{NP}$-machine $M$ that cannot be simulated by small circuits in the model. Namely, $\mathsf{S}^{1}_{2}$ proves that $\varphi(x)$ is equivalent to a formula

$$\exists y{<}2^{n^{d}}\textit{``$y$ is an accepting computation of $M$ on $x$''}$$ (2)

for a suitable $\mathsf{NP}$-machine $M$, namely a model-checker for $\varphi$. Here, the constant $d$ stems from the polynomial running time of $M$. We write $\alpha^{c}_{M}:=\alpha^{c}_{\varphi}$ for $\varphi(x)$ equal to (2). One can also fix the machine $M$ in advance to a universal one, namely a model-checker $M^{*}$ for an $\mathsf{S}^{1}_{2}$-provably $\mathsf{NP}$-complete problem (e.g., $\mathsf{SAT}$).

The predominant approach to the consistency of circuit lower bounds is based on witnessing theorems: a proof of $\alpha^{c}_{M}$ in some bounded arithmetic implies a low-complexity algorithm that computes a witness $C$ from $1^{n}$. E.g., if the theory has feasible witnessing in $\mathsf{P}$, then it does not prove $\alpha^{c}_{\varphi}$ for any $c$ unless the problem defined by $\varphi(x)$ is in $\mathsf{P}$. However, $\mathsf{S}^{1}_{2}$ is only known to have feasible witnessing in $\mathsf{P}$ for bounded $\forall\exists$-sentences and $\alpha^{c}_{\varphi}$ is a $\forall\exists\forall\exists$-sentence.

Fortunately, a self-reducibility argument implies that the quantifier complexity of this formula can be reduced. Up to suitable changes of $c$, the formula $\alpha^{c}_{M^{*}}$ is $\mathsf{S}^{1}_{2}$-provably equivalent to the following sentence of lower quantifier complexity:

$$\begin{array}[]{lcl}\beta^{c}_{M^{*}}&:=&\forall n{\in}\mathit{Log}_{>1}\ \exists C{<}2^{n^{c}}\ \exists D{<}2^{n^{c}}\ \forall x{<}2^{n}\ \forall y{<}2^{n^{d}}\\ &&\quad(C(x){=}0\to\neg\textit{``$y$ is an accepting computation of $M^{*}$ on $x$''})\ \wedge\\ &&\quad(C(x){=}1\to\textit{``$D(x)$ is an accepting computation of $M^{*}$ on $x$''}),\end{array}$$

where $d$ stems from the polynomial runtime of $M^{*}$. We define

$$\textit{``$\mathsf{NP}\not\subseteq\mathsf{P/poly}$''}\ :=\ \big{\{}\neg\beta^{c}_{M^{*}}\mid c\in\mathbb{N}\big{\}}.$$

Note, $\beta^{c}_{M^{*}}$ is a bounded $\forall\exists\forall$-sentence (namely a $\forall\Sigma^{b}_{2}$-sentence). For such sentences, $\mathsf{S}^{2}_{2}$ has feasible witnessing in $\mathsf{P}^{\mathsf{NP}}$ [6], and $\mathsf{S}^{1}_{2}$ has feasible witnessing by certain interactive polynomial-time computations [21]. This was exploited by Cook and Krajíček [12] to prove that “$\mathsf{NP}\not\subseteq\mathsf{P/poly}$” is consistent with $\mathsf{S}^{2}_{2}$ unless $\mathsf{PH}\subseteq\mathsf{P}^{\mathsf{NP}}$, and with $\mathsf{S}^{1}_{2}$ unless $\mathsf{PH}\subseteq\mathsf{P}^{\mathsf{NP}}_{\mathrm{tt}}$. Since the complexity of witnessing increases with the strength of the theory, it seems questionable whether this method yields insights for much stronger theories: by the Karp-Lipton Theorem [19], $\mathsf{PH}\not\subseteq\mathsf{NP}^{\mathsf{NP}}$ implies that “$\mathsf{NP}\not\subseteq\mathsf{P/poly}$” is true, and true sentences are consistent with any true theory. Moreover, the focus of this work is on unconditional consistency results.

Using similar methods, a recent line of works [24, 8, 9, 10] achieved unconditional consistency results for fixed-polynomial lower bounds, even for $\mathsf{P}$ instead of $\mathsf{NP}$ (based on [36]). For example, the main result in [8] implies that $\mathsf{S}^{2}_{2}+\neg\alpha_{\varphi}^{c}$ and $\mathsf{S}^{1}_{2}+\neg\alpha_{\psi}^{c}$ are consistent for certain formulas $\varphi(x)$ and $\psi(x)$ that define problems in $\mathsf{P}^{\mathsf{NP}}$ and $\mathsf{NP}$, respectively. Again it seems questionable whether the underlying methods can yield insights for much stronger theories: by Kannan [18], the lower bound stated by $\neg\alpha_{\chi}^{c}$ is true for some formula $\chi(x)$ defining a problem in $\mathsf{NP}^{\mathsf{NP}}$. Moreover, the formulas above depend on $c$ and new ideas seem to be required to reach the unconditional consistency of superpolynomial lower bounds.

1.2 New consistency results

The purpose of this paper is to prove the unconditional consistency of $\mathsf{NEXP}\not\subseteq\mathsf{P/poly}$ with the comparatively strong theory $\mathsf{V}^{0}_{2}$. Consistency results for $\mathsf{V}^{0}_{2}$ are meaningful, since $\mathsf{V}^{0}_{2}$ is stronger than $\mathsf{T}^{2}_{2}$ which, as discussed earlier, can formalize many results in complexity theory. Our approach is not via witnessing but via simulating comprehension.

The problems in $\mathsf{NEXP}$ are naturally represented on the formal level by $\hat{\Sigma}^{1,b}_{1}$-formulas $\varphi(x)$: an existentially quantified set variable followed by a bounded formula. We discuss three ways to formalize $\mathsf{NEXP}\not\subseteq\mathsf{P/poly}$, namely with $\{\neg\alpha^{c}_{\varphi}\mid c\geqslant 1\}$ for a $\hat{\Sigma}^{1,b}_{1}$-formula $\varphi(x)$, with $\{\neg\alpha^{c}_{M_{0}}\mid c\geqslant 1\}$ and with $\{\neg\beta^{c}_{M_{0}}\mid c\geqslant 1\}$ for a suitable universal $\mathsf{NEXP}$-machine $M_{0}$. We now discuss these formalizations; they are analogous to the formalizations discussed in the previous section.

The “direct formalization” of the consistency of $\mathsf{NEXP}\not\subseteq\mathsf{P/poly}$ is based on the formulas $\alpha^{c}_{\varphi}$. These are defined similarly as before but with $\varphi$ a $\hat{\Sigma}^{1,b}_{1}$-formula:

Definition 1.

Let $c\in\mathbb{N}$ and let $\varphi=\varphi(x)$ be a $\hat{\Sigma}^{1,b}_{1}$-formula (with only one free variable $x$, and in particular without free variables of the set sort). Define

$$\alpha_{\varphi}^{c}\ :=\ \forall n{\in}\mathit{Log}_{>1}\ \exists C{\leqslant}2^{n^{c}}\forall x{<}2^{n}\ \big{(}C(x)\leftrightarrow\varphi(x)\big{)}.$$

Then our direct formalization of the consistency of $\mathsf{NEXP}\not\subseteq\mathsf{P/poly}$ is:

Theorem 2.

There exists $\varphi(x)\in\hat{\Sigma}^{1,b}_{1}$ such that $\mathsf{V}^{0}_{2}+\big{\{}\neg\alpha^{c}_{\varphi}\mid c\in\mathbb{N}\big{\}}$ is consistent.

Theorem 2 can be strengthened to establish the consistency of $\mathsf{NEXP}\not\subseteq\mathsf{PH/poly}$ (see Section 2.3) but our focus is on $\mathsf{P/poly}$.

Theorem 2 is proved in Section 2.2 but in hindsight is not hard to prove. For $\varphi(x)$ take a formula negating the pigeonhole principle: it states that there exists a set coding an injection from $\{0,\ldots,x+1\}$ into $\{0,\ldots,x\}$, and thus is expressible as a $\hat{\Sigma}^{1,b}_{1}$-formula. The intermediate steps in the usual proof of the pigeonhole principle involve further sets encoding injections, and these can also expressed with $\hat{\Sigma}^{1,b}_{1}$-formulas. If these formulas were computed by polynomial-size circuits, then we could use quantifier-free induction to show that the pigeonhole principle is provable in $\mathsf{V}^{0}_{2}$. But it is well known that this is not the case (see [22, Corollary 12.5.5]).

Concerning the faithfulness of the direct formalization we get, as before, a model of $\mathsf{V}^{0}_{2}$ where a certain $\mathsf{NEXP}$-machine cannot be simulated by small circuits. Indeed, for an explicit $\mathsf{NEXP}$-machine $M$ we can write the formula (2) using instead of $\exists y$ a quantification $\exists Y$ for a set variable $Y$:

$$\exists Y\textit{``$Y$ is an accepting computation of $M$ on $x$''}.$$ (3)

Roughly, an explicit $\mathsf{NEXP}$-machine is one such that $\mathsf{S}^{1}_{2}$ can verify a suitable bound on its runtime; we defer the details to Section 3.1. It turns out that $\mathsf{V}^{0}_{2}$ proves that every $\hat{\Sigma}^{1,b}_{1}$-formula $\varphi(x)$ is equivalent to (3) for a suitable $M$, namely a model-checker for $\varphi(x)$. Proving this is not trivial because $\mathsf{V}^{0}_{2}$ is agnostic about the existence of computations of exponential-time machines. One of our contributions is to prove it; we give the details in Section 3.

Definition 3.

For an explicit $\mathsf{NEXP}$-machine $M$ and $c\in\mathbb{N}$ we set $\alpha^{c}_{M}:=\alpha^{c}_{\psi}$ where $\psi$ is the formula (3).

Intuitively, $\mathsf{V}^{0}_{2}$ does not know whether non-trivial exponential-size sets exist, namely sets not given by bounded formulas. But then, how meaningful is the consistency statement of Theorem 2 or the corresponding statement for $\{\neg\alpha^{c}_{M}\mid c\geqslant 1\}$? These sentences contain (universal and) existential set quantifiers. It turns out that we can move again to a suitably modified sentence $\beta^{c}_{M}$ of lower quantifier complexity, namely a sentence all of whose set quantifiers are universal (i.e., $\forall\Pi^{1,b}_{1}$): such sentences do not entail the existence of non-trivial large sets. This does not follow from simple self-reducibility arguments but is a deep result of complexity theory, namely the Easy Witness Lemma of Impagliazzo, Kabanets and Wigderson [14, Theorem 31]. We use Williams’ version as stated in [38, Lemma 3.1] (see [39, Theorem 3.1] for the equivalence):

Lemma 4 (Easy Witness Lemma).

If $\mathsf{NEXP}\subseteq\mathsf{P/poly}$, then every $\mathsf{NEXP}$-machine has polynomial-size oblivious witness circuits.

An oblivious witness circuit for a machine $M$ and input length $n$ is a circuit $D$ with at least $n$ inputs such that for every $x$ of length $n$, if $M$ accepts $x$, then $\mathit{tt}(D_{x})$ encodes an accepting computation of $M$ on $x$. Here, the circuit $D_{x}$ is obtained from $D$ by fixing the first $n$ inputs to the bits of $x$, and $\mathit{tt}(D_{x})$ is the truth table of $D_{x}$. In the statement of the lemma, polynomial-size refers to polynomial in $n$, and the qualifier oblivious refers to the fact that $D$ depends only on the length of $x$, not on $x$ itself.

In the language of two-sorted bounded arithmetic the string $\mathit{tt}(D_{x})$ corresponds to the set $D_{x}(\cdot)$ of numbers accepted by $D_{x}$. We thus define the formula $\beta^{c}_{M}$ by replacing $D(x)$ by $D_{x}(\cdot)$ and $\forall y$ by $\forall Y$:

Definition 5.

For $c\in\mathbb{N}$ and an explicit $\mathsf{NEXP}$-machine $M$ we set

$$\begin{array}[]{lcl}\beta_{M}^{c}&:=&\forall n{\in}\mathit{Log}_{>1}\ \exists C{<}2^{n^{c}}\ \exists D{<}2^{n^{c}}\ \forall x{<}2^{n}\ \forall Y\\ &&\quad(C(x){=}0\ \to\ \neg\textit{``$Y$ is an accepting computation of $M$ on $x$''})\ \wedge\\ &&\quad(C(x){=}1\ \to\ \textit{``$D_{x}(\cdot)$ is an accepting computation of $M$ on $x$''}).\end{array}$$

In Section 4.1 we define a suitable universal explicit $\mathsf{NEXP}$-machine $M_{0}$ and arrive at our formalization of $\mathsf{NEXP}\not\subseteq\mathsf{P/poly}$:

Definition 6.

$\textit{``$\mathsf{NEXP}\not\subseteq\mathsf{P/poly}$''}:=\{\neg\beta^{c}_{M_{0}}\mid c\in\mathbb{N}\}.$

The main result of this paper is:

Theorem 7.

The theory $\mathsf{V}^{0}_{2}$ is consistent with both formalizations of $\mathsf{NEXP}\not\subseteq\mathsf{P/poly}$; concretely, $\mathsf{V}^{0}_{2}+\{\lnot\alpha^{c}_{M_{0}}:c\in\mathbb{N}\}$ and $\mathsf{V}^{0}_{2}+\{\lnot\beta^{c}_{M_{0}}:c\in\mathbb{N}\}$ are consistent.

In the notation introduced above, this gives:

Corollary 8.

$\mathsf{V}^{0}_{2}+\textit{``$\mathsf{NEXP}\not\subseteq\mathsf{P/poly}$''}$ is consistent.

Both $\{\lnot\alpha^{c}_{M_{0}}:c\in\mathbb{N}\}$ and $\{\lnot\beta^{c}_{M_{0}}:c\in\mathbb{N}\}$ are formalizations of $\mathsf{NEXP}\not\subseteq\mathsf{P/poly}$. The first has the advantage of being more direct whereas the second has the advantage of having lower quantifier complexity: $\beta^{c}_{M_{0}}$ is $\forall\Pi^{1,b}_{1}$ while $\alpha^{c}_{M_{0}}$ is $\forall\Sigma^{b}_{\infty}(\Pi^{1,b}_{1})$. In addition, being $\forall\Pi^{1,b}_{1}$ is instrumental for our magnification result discussed below (Theorem 11). It is easy to see that $\mathsf{V}^{0}_{2}$ proves that $\{\lnot\alpha^{c}_{M_{0}}:c\in\mathbb{N}\}$ implies $\{\lnot\beta^{c}_{M_{0}}:c\in\mathbb{N}\}$. The converse implication is true too, but depends on the Easy Witness Lemma. It is open whether $\mathsf{V}^{0}_{2}$ proves this implication or the Easy Witness Lemma.

We emphasize here that our formalization of $\mathsf{NEXP}\not\subseteq\mathsf{P/poly}$ through the universal machine $M_{0}$ and the $\alpha^{c}_{M_{0}}$ and $\beta^{c}_{M_{0}}$ sentences refers exclusively to the setting of non-relativized complexity classes.

Second we show that $\mathsf{NEXP}$ can be lowered to just above $\mathsf{NP}$. For $k\in\mathbb{N}$, define $\log^{(k)}n$ inductively by $\log^{(1)}n:=\log n$, and $\log^{(k+1)}n:=\log\log^{(k)}n$. We prove:

Theorem 9.

$\mathsf{V}^{0}_{2}+\textit{``$\mathsf{NTIME}(n^{O(\log^{(k)}n)})\not\subseteq\mathsf{P/poly}$''}$ is consistent for every positive $k\in\penalty 10000\mathbb{N}$.

The formalization and proof proceeds similarly and relies on an Easy Witness Lemma for barely superpolynomial time by Murray and Williams [27]. Theorem 9 “almost” settles the central question for the consistency of $\mathsf{NP}\not\subseteq\mathsf{P/poly}$ with a strong bounded arithmetic. Closing the tiny gap, however, seems to require some new ideas.

1.3 Simulating comprehension

The proof of the consistency of circuit lower bounds is based on the complexity of constant depth propositional proofs for the pigeonhole principle. We shall see that $\mathsf{V}^{0}_{2}+\alpha^{c}_{M_{0}}$ (and thus $\mathsf{V}^{0}_{2}+\beta^{c}_{M_{0}}$) proves the pigeonhole principle. This implies Theorem 7 as it is well-known that $\mathsf{V}^{0}_{2}$ cannot prove this principle. Thereby, Theorem 7 is ultimately based on the exponential lower bound for this principle in bounded depth Frege systems [1, 4]. On a high level, while the approach based on witnessing uses complexity theoretic methods, our approach is based on methods that arose from mathematical logic, in particular forcing (cf. [3]).

The $\{\lnot\beta^{c}_{M_{0}}\}$ formulation of “$\mathsf{NEXP}\not\subseteq\mathsf{P/poly}$” provides an additional insight into the consistency lower bound. By the Easy Witness Lemma, the inclusion $\mathsf{NEXP}\subseteq\mathsf{P/poly}$ implies that a rich collection of sets is represented by circuits (via their truth tables). A weak theory can quantify over circuits and hence implicitly over this collection. Thus, intuitively, $\beta^{c}_{M_{0}}$ should enable a weak theory to simulate a two-sorted theory of considerable strength. More precisely, we show that $\beta^{c}_{M_{0}}$ can be used to simulate a considerable fragment of $\Sigma^{1,b}_{1}$-comprehension, i.e., a considerable fragment of $\mathsf{V}^{1}_{2}$.

The sketched idea can be made explicit as follows. By $\mathsf{S}^{1}_{2}(\alpha)$ we denote the two-sorted variant of $\mathsf{S}^{1}_{2}$. Its models consist of two universes $M$ and $\mathcal{X}$ interpreting the number and the set sort, respectively. Given such a model that additionally satisfies $\beta^{c}_{M_{0}}$ for some $c\in\mathbb{N}$, we will show in Lemma 45 that shrinking $\mathcal{X}$ to the sets represented by circuits in $M$ yields a model of $\mathsf{V}^{1}_{2}$. This has two interesting consequences. The first is:

Theorem 10.

Let $\mathsf{T}$ be a theory that contains $\mathsf{S}^{1}_{2}(\alpha)$ but does not prove all number-sort consequences of $\mathsf{V}^{1}_{2}$. Then $\mathsf{T}+\textit{``$\mathsf{NEXP}\not\subseteq\mathsf{P/poly}$''}$ is consistent.

By a number-sort formula we mean one that does not use set-sort variables. Note that the corollary refers to number-sort sentences of arbitrary unbounded quantifier complexity. It is conjectured that $\mathsf{V}^{1}_{2}$ has more number-sort consequences than all other theories mentioned so far. But this is known only for $\mathsf{S}^{1}_{2}$ [37, 20], and there even for $\forall\Pi^{b}_{1}$-sentences. Theorem 10 directly infers evidence for the truth of “$\mathsf{NEXP}\not\subseteq\mathsf{P/poly}$” from progress in mathematical logic on understanding independence. Loosely speaking, we view it in line with the belief that it is mathematical logic that ultimately bears on fundamental complexity-theoretic conjectures (see e.g. again the preface of [22]).

The second consequence is:

Theorem 11.

If $\mathsf{S}^{1}_{2}(\alpha)$ does not prove “$\mathsf{NEXP}\not\subseteq\mathsf{P/poly}$”, then $\mathsf{V}^{1}_{2}$ does not prove “$\mathsf{NEXP}\not\subseteq\mathsf{P/poly}$”.

This is a magnification result on the hardness of proving circuit lower bounds: it infers strong hardness (for $\mathsf{V}^{1}_{2}$) from weak hardness (for $\mathsf{S}^{1}_{2}(\alpha)$). The term magnification has been coined in [28] in the context of circuit lower bounds where such results are currently intensively investigated (cf. [11]). In proof complexity such results are rare so far. An example in propositional proof complexity appears in [26, Proposition 4.14]. Magnification results are interesting because they reveal inconsistencies in common beliefs about what is and what is not within the reach of currently available techniques. Theorem 11 might foster hopes to complete Razborov’s program to find a precise barrier in circuit complexity (cf. Remark 46).

2 Consistency of the direct formalization

In this section we provide the details of the simple proof of Theorem 2. We begin by recalling the necessary preliminaries on bounded arithmetic. This will be needed also in later sections. We refer to [22, Ch.5] for the missing details.

2.1 Preliminaries: bounded arithmetic

Bounded arithmetics have language $x{\leqslant}y$, $0$, $1$, $x{+}y$, $x{\cdot}y$, $\lfloor x{/}2\rfloor$, $x{\#}y$, $|x|$, and built-in equality $x{=}y$. Note that Cantor’s pairing $\langle x,y\rangle$ is given by a term. Iterating it gives $\langle x_{1},\ldots,x_{k}\rangle$ for $k>2$. A number $x$ is called small if it satisfies the formula $\exists y\ x{=}|y|$. We abbreviate $\exists y\ x{=}|y|$ by $x{\in}\mathit{Log}$ and $x{\in}\mathit{Log}\wedge 1{<}x$ by $x{\in}\mathit{Log}_{>1}$. The quantifiers $\forall x{\in}\mathit{Log}_{>1}$ and $\exists x{\in}\mathit{Log}_{>1}$ range over small numbers above $1$. If $x=|y|$, we write $2^{x}$ for $1\#y$ and similarly for other exponential functions. E.g., a formula of the form $\forall x{\in}\mathit{Log}_{>1}\ \ldots\ 2^{x^{2}}\ldots$ stands for the formula $\forall x\forall y\ (1{<}x\wedge x{=}|y|\to\ldots\ y\#y\ldots)$.

Theories.

The theories of bounded arithmetic are given by a set $\mathsf{BASIC}$ of universal sentences determining the meaning of the symbols, plus induction schemes. For a set of formulas $\Phi$, the set (of the universal closures) of formulas

$$\varphi(\bar{x},0)\wedge\forall y{<}z\ (\varphi(\bar{x},y)\to\varphi(\bar{x},y+1))\to\varphi(\bar{x},z),$$

for $\varphi\in\Phi$, is the scheme of $\Phi$-induction. Restricting to small numbers $z$ gives the scheme of $\Phi$-length induction; formally, replace $z$ by $|z|$ above. Here, and throughout, when writing a formula $\psi$ as $\psi(\bar{x})$ we mean that all free variables of $\psi$ are among $\bar{x}$.

The set $\Sigma^{b}_{\infty}$ contains all bounded formulas, and $\Sigma^{b}_{i},\Pi^{b}_{i}$, for $i\in\mathbb{N}$, are subsets of $\Sigma^{b}_{\infty}$ that are defined by counting alternations of bounded quantifiers $\exists x{\leqslant}t,\forall x{\leqslant}t$, not counting sharply bounded ones $\exists x{\leqslant}|t|,\forall x{\leqslant}|t|$. In particular, $\Sigma^{b}_{0}=\Pi^{b}_{0}$ is the set of sharply bounded formulas. The theories $\mathsf{T}^{i}_{2}$ are defined by $\mathsf{BASIC}+\text{$\Sigma^{b}_{i}$-induction}$. The theories $\mathsf{S}^{i}_{2}$ are defined by $\mathsf{BASIC}+\text{$\Sigma^{b}_{i}$-length-induction}$. Full bounded arithmetic $\mathsf{T}_{2}:=\bigcup_{i\in\mathbb{N}}\mathsf{T}^{i}_{2}$ has $\Sigma^{b}_{\infty}$-induction.

Two-sorted theories.

Two-sorted bounded arithmetics are obtained by adding a new set of variables $X,Y,\ldots$ of the set sort. Original variables $x,y,\ldots$ are of the number sort. We shall use capital letters also for number-sort variables. Therefore, for clarity, from now on we write $\exists_{2}X$ and $\forall_{2}X$ for quantifiers on set-sort variables $X$. The language is enlarged by adding a binary relation $x{\in}X$ between the number and the set sort. A number-sort formula is one that uses only the number sort. In particular, it has no set-sort parameters. By a term we mean a term in the number sort. We write $X{\leqslant}z$ for $\forall y\ (y{\in}X\to y{\leqslant}z)$.

Models have the form $(M,\mathcal{X})$ where $M$ is a universe for the number sort and $\mathcal{X}$ is a universe for the set sort. The symbol $\in$ is interpreted by a subset of $M\times\mathcal{X}$. The standard model is $(\mathbb{N},[\mathbb{N}]^{<\omega})$ where $[\mathbb{N}]^{<\omega}$ is the set of finite subsets of $\mathbb{N}$; the number sort symbols are interpreted as usual over $\mathbb{N}$ and $\in$ by actual element-hood.

The sets $\Sigma^{b}_{\infty}(\alpha),\Sigma^{b}_{i}(\alpha),\Pi^{b}_{i}(\alpha)$ are defined as $\Sigma^{b}_{\infty},\Sigma^{b}_{i},\Pi^{b}_{i}$, allowing free set-variables and the symbol $\in$, but not allowing set-sort quantifiers, nor set-sort equalities $X{=}Y$. Another name for the set $\Sigma^{b}_{\infty}(\alpha)$ is $\Sigma^{1,b}_{0}$. The theories $\mathsf{T}^{i}_{2}(\alpha)$, $\mathsf{S}^{i}_{2}(\alpha)$, and $\mathsf{T}_{2}(\alpha)$, are given by $\mathsf{BASIC}$ and analogous induction schemes as before, namely $\Sigma^{b}_{i}(\alpha)$-induction, $\Sigma^{b}_{i}(\alpha)$-length induction, and $\Sigma^{b}_{\infty}(\alpha)$-induction, respectively. Additionally, we add the following axioms with the set sort. Recalling the notation $X{\leqslant}z$ introduced above, the new axioms are (the universal closures of):

set-boundedness axiom:	$\exists z\ X{\leqslant}z$.
extensionality axiom:	$X{\leqslant}z\wedge Y{\leqslant}z\wedge\forall y{\leqslant}z\ (y{\in}X\leftrightarrow y{\in}Y)\to X{=}Y$.

We add the scheme of (bounded) $\Delta^{b}_{1}(\alpha)$-comprehension, given by (the universal closures of) the formulas

$$\exists_{2}Y{\leqslant}z\ \forall y{\leqslant}z\ \big{(}y\in Y\leftrightarrow\varphi(\bar{X},\bar{x},y)\big{)},$$ (4)

where $\varphi(\bar{X},\bar{x},y)$ is $\Delta^{b}_{1}(\alpha)$ with respect to the theory defined over the two-sorted language as $\mathsf{BASIC}$ plus $\Sigma^{b}_{1}(\alpha)$-length-induction, i.e., this theory proves $\varphi(\bar{X},\bar{x},y)$ equivalent to both a $\Pi^{b}_{1}(\alpha)$-formula and a $\Sigma^{b}_{1}(\alpha)$-formula.

For example, this scheme implies that there is a set $Y$ as described when $\varphi(\bar{X},\bar{x},y)$ is $f^{\bar{X}}(\bar{x},y){=}1$ where $f^{\bar{X}}(\bar{x},y)$ is a function that is $\Sigma^{b}_{1}(\alpha)$-definable in $\mathsf{S}^{1}_{2}(\alpha)$. The superscript indicates that $\bar{X}$ comprises all the free variables of the set sort that appear in the $\Sigma^{b}_{1}(\alpha)$-formula that defines $f^{\bar{X}}(\bar{x},y)$. It is well known [6] that these are precisely the functions that are computable in polynomial time with oracles denoted by the set variables. We do not distinguish $\mathsf{S}^{1}_{2}$ (or $\mathsf{S}^{1}_{2}(\alpha)$) from its variant in the language $\mathsf{PV}$ (resp., $\mathsf{PV}(\alpha)$) which has a symbol for all polynomial time functions (resp., with oracles denoted by the set variables). We shall often use that $\mathsf{S}^{1}_{2}(\alpha)$ proves induction for quantifier-free $\mathsf{PV}(\alpha)$-formulas (cf. [22, Lemma 5.2.9]). We write quantifier-free $\mathsf{PV}(\alpha)$-formulas with latin capital letters; e.g., $F(\bar{X},\bar{x})$.

A piece of notation.

For formulas $\varphi(Y,\bar{X},\bar{x})$ and $\psi(\bar{Z},\bar{z},u)$ we write

$$\varphi\big{(}\psi(\bar{Z},\bar{z},\cdot),\bar{X},\bar{x}\big{)}$$

for the formula obtained from $\varphi$ by replacing every atomic subformula of the form $t{\in}Y$, for $t$ a term, by the formula $\psi(\bar{Z},\bar{z},t)$, preceded by any necessary renaming of the bound variables of $\varphi$ to avoid the capturing of free variables. We use this notation only for formulas $\varphi$ without set equalities.

Genuine two-sorted theories.

It is easy to see that the theories $\mathsf{T}^{i}_{2}(\alpha),\mathsf{S}^{i}_{2}(\alpha)$ have the same number sort consequences as $\mathsf{T}^{i}_{2},\mathsf{S}^{i}_{2},$ respectively. Also $\mathsf{T}^{i}_{2}(\alpha),\mathsf{S}^{i}_{2}(\alpha)$ are conservative over their subtheories without $\Delta^{b}_{1}(\alpha)$-comprehension. Intuitively, the two-sorted versions of bounded arithmetics are the usual ones plus syntactic sugar. Genuine set-sorted theories are obtained from $\mathsf{T}_{2}(\alpha)$ by adding (bounded) $\Phi$-comprehension for certain sets of formulas $\Phi$, i.e., (4) for $\varphi(\bar{X},\bar{x},y)$ in $\Phi$.

The set $\Sigma^{1,b}_{\infty}$ contains all two-sorted formulas with quantifiers of both sorts, but bounded number-sort quantifiers. Again we disallow set equalities. The sets $\Sigma^{1,b}_{i},\Pi^{1,b}_{i}$, for $i\in\mathbb{N}$, are subsets of $\Sigma^{1,b}_{\infty}$ defined by counting the alternations of set quantifiers (and not counting number quantifiers). A $\hat{\Sigma}^{1,b}_{1}$-formula is of the form

$$\exists_{2}Y\ \varphi(\bar{X},Y,\bar{x})$$ (5)

where $\varphi(\bar{X},Y,\bar{x})$ is a $\Sigma^{1,b}_{0}$-formula.

For $i\in\mathbb{N}$ the theory $\mathsf{V}^{i}_{2}$ is given by $\Sigma^{1,b}_{i}$-comprehension. In particular, $\mathsf{V}^{0}_{2}$ is given by $\Sigma^{1,b}_{0}$-comprehension. It has the same number-sort consequences as $\mathsf{T}_{2}$.

Remark 12.

Sometimes, the sets $\Sigma^{1,b}_{i}(\alpha)$ are defined with bounded set quantifiers $\exists X{\leqslant t}$ and $\forall X{\leqslant}t$. The difference is not essential: for every $\Sigma^{1,b}_{\infty}$-formula $\varphi(\bar{X},Y,\bar{x})$ there is a term $t(\bar{x})$ such that $\mathsf{S}^{1}_{2}(\alpha)$ proves

$$t(\bar{x}){\leqslant}y\to\big{(}\varphi(\bar{X},Y,\bar{x})\leftrightarrow\varphi(\bar{X},Y^{\leqslant y},\bar{x})\big{)}$$

where $Y^{\leqslant y}$ stands for $\psi(Y,y,\cdot)$ with $\psi(Y,y,u):=(u{\leqslant}y\wedge u{\in}Y)$. By $\Delta^{b}_{1}(\alpha)$-comprehension, $\exists_{2}Y\varphi$ is $\mathsf{S}^{1}_{2}(\alpha)$-provably equivalent to $\exists_{2}Y{\leqslant}t(\bar{x})\ \varphi$. It follows that every $\Sigma^{1,b}_{i}(\alpha)$-formula is $\mathsf{S}^{1}_{2}(\alpha)$-provably equivalent to one with bounded set sort quantifiers.

Remark 13.

Disallowing set equalities is convenient but inessential in the sense that $\mathsf{V}^{i}_{2}$ does not change when set equalities are allowed in $\Sigma^{1,b}_{i}$. Indeed, let $\varphi(\bar{X},\bar{x})$ be a $\Sigma^{1,b}_{i}$-formula except that set equalities are allowed. Then there is a $\Sigma^{1,b}_{i}$-formula $\varphi^{*}(\bar{X},\bar{x},u)$ (without set equalities and) with bounded set quantifiers such that $\mathsf{S}^{1}_{2}(\alpha)$ proves

$$\exists u\ \big{(}\varphi(\bar{X},\bar{x})\leftrightarrow\varphi^{*}(\bar{X},\bar{x},u)\big{)}.$$

Proof.

The formula $\varphi^{*}$ is defined by a straightforward recursion on $\varphi$. For example, if $\varphi$ is $X_{1}{=}X_{2}$, then $\varphi^{*}$ is $\forall y{\leqslant}u\ (y{\in}X_{1}\to y{\in}X_{2})\wedge\forall y{\leqslant}u\ (y{\in}X_{2}\to y{\in}X_{1})$; a $u$ witnessing the equivalence is any common upper bound on $X_{1}$ and $X_{2}$. If $\varphi$ is $\exists_{2}Y\psi(\bar{X},Y,\bar{x})$ and $\psi^{*}=\psi^{*}(\bar{X},Y,\bar{x},u)$ is already defined, then $\varphi^{*}$ is $\exists_{2}Y{\leqslant}t(\bar{x},u)\ \psi^{*}(\bar{X},Y,\bar{x},u)$ where the term $t$ is chosen according to the previous remark. ∎

Circuits.

A circuit with $s$ gates is coded by a number below $2^{10\cdot s\cdot|s|}$. On the formal level we shall only consider small circuits, i.e., $s\in\mathit{Log}$, so $2^{10\cdot s\cdot|s|}$ exists. We use capital letters $C,D,E$ for number variables when they are intended to range over circuits. There is a $\mathsf{PV}$-function $\mathit{eval}(C,x)$ that (in the standard model) takes a circuit $C$ with, say, $n\leqslant|C|$ input gates, and evaluates it on inputs $x<2^{n}$. This means that the input gates of $C$ are assigned the bits of the length-$n$ binary representation of $x$; we assume $\mathit{eval}(C,x)=0$ if $x\geqslant 2^{n}$ or if $C$ does not code a circuit.

It is notationally convenient to have circuits take finite tuples $\bar{x}=(x_{1},\ldots,x_{k})$ as inputs; formally, such a circuit has $k$ sequences of input gates, the $i$-th taking the bits of $x_{i}$. Again, $\mathit{eval}(C,\bar{x})$ denotes the evaluation function; it outputs $0$ if any $x_{i}$ has length bigger than the length of its allotted input sequence. Our circuits have exactly one output gate, so $\mathsf{S}^{1}_{2}$ proves $\mathit{eval}(C,\bar{x}){<}2$. We write $C(\bar{x})$ for the quantifier-free $\mathsf{PV}$-formula $\mathit{eval}(C,\bar{x}){=}1$; in some places we also write $C(\bar{x}){=}1$ and $C(\bar{x}){=}0$ instead of $C(\bar{x})$ and $\neg C(\bar{x})$, respectively.

For a circuit $C$ taking $(\ell+k)$-tuples as inputs and an $\ell$-tuple $\bar{x}$ we let $C_{\bar{x}}$ be the circuit obtained by fixing the first $\ell$ inputs to $\bar{x}$; it takes $k$-tuples as inputs. Formally, $C_{\bar{x}}$ is a $\mathsf{PV}$-term with variables $C,\bar{x}$ and $\mathsf{S}^{1}_{2}(\alpha)$ proves $(C_{\bar{x}}(\bar{y})\leftrightarrow C(\bar{x},\bar{y}))$ and $|C_{\bar{x}}|{\leqslant}|C|$.

Lemma 14.

For every quantifier-free $\mathsf{PV}$-formula $F(\bar{x})$ there is a $c\in\mathbb{N}$ such that $\mathsf{S}^{1}_{2}$ proves

$$\forall n{\in}\mathit{Log}_{>1}\ \exists C{<}2^{n^{c}}\ \forall\bar{x}{<}2^{n}\ \big{(}C(\bar{x})\leftrightarrow F(\bar{x})\big{)}.$$

On the formal level, if $Y$ is a set and $C$ is a circuit, then we say that $Y$ is represented by $C$ if $\forall y\ (C(y)\leftrightarrow y{\in}Y)$. In our notation, such set $Y$ is written $C(\cdot)$, or $\mathit{eval}(C,\cdot){=}1$. More precisely, for a formula $\varphi(Y,\bar{X},\bar{x})$ and a circuit $C$ we write

$$\varphi\big{(}C(\cdot),\bar{X},\bar{x}\big{)},$$

for the formula obtained from $\varphi$ by replacing every formula of the form $t{\in}Y$ by $C(t)$, i.e., by $\mathit{eval}(C,t){=}1$. Note that if the set $Y$ is represented by a circuit with $n$ inputs, then $Y{<}2^{n}$, provably in $\mathsf{S}^{1}_{2}$. For example, we shall use circuits to represent computations of exponential-time machines $M$. Using the notation introduced in Section 3.1,

“$$C(\cdot) M \bar{x}$$ is a halting computation of on ”

is a $\Pi^{b}_{1}$-formula with free variables $C,\bar{x}$ stating that the circuit $C$ represents a halting computation of $M$ on $\bar{x}$.

2.2 Consistency of the direct formalization for $\mathsf{NEXP}$

The set of $\hat{\Sigma}^{1,b}_{1}$-formulas without free variables of the set sort is a natural class of formulas defining, in the standard model, all the problems in $\mathsf{NEXP}$. For such a formula $\psi$ it is straightforward to write down a set of sentences (a.k.a. a theory) stating that $\psi$ does not have polynomial-size circuits. We explicitly define this direct formalization of $\mathsf{NEXP}\not\subseteq\mathsf{P/poly}$ as the set of all sentences of the form $\neg\alpha^{c}_{\psi}$, for $c\in\mathbb{N}$, for the sentence $\alpha^{c}_{\psi}$ defined in the introduction, and then argue that its consistency with $\mathsf{V}^{0}_{2}$ follows from known lower bounds in proof complexity.

We are ready to prove Theorem 2.

Proof of Theorem 2:.

The (functional) pigeonhole principle $\mathit{PHP}(x)$ is the following $\Pi^{1,b}_{1}$-formula:

$$\forall_{2}X\ \big{(} \exists y{\leqslant}x{+}1\ \forall z{\leqslant}x\ \neg\langle y,z\rangle{\in}X\ \vee$$

$$\exists y{\leqslant}x{+}1\ \exists z{\leqslant}x\ \exists z^{\prime}{\leqslant}x\ (\neg z{=}z^{\prime}\wedge\langle y,z\rangle{\in}X\wedge\langle y,z^{\prime}\rangle{\in}X)\ \vee$$

$$\exists y{\leqslant}x{+}1\ \exists y^{\prime}{\leqslant}x{+}1\ \exists z{\leqslant}x\ (\neg y{=}y^{\prime}\wedge\langle y,z\rangle{\in}X\wedge\langle y^{\prime},z\rangle{\in}X)\big{)}.$$

Note that $\psi=\psi(x):=\neg\mathit{PHP}(x)$ is (logically equivalent to) a $\hat{\Sigma}^{1,b}_{1}$-formula. For the sake of contradiction assume that $\mathsf{V}^{0}_{2}+\big{\{}\neg\alpha^{c}_{\psi}\mid c\in\mathbb{N}\big{\}}$ is inconsistent. By compactness, there exists $c\in\mathbb{N}$ such that $\mathsf{V}^{0}_{2}$ proves $\alpha^{c}_{\psi}$.

Claim: $\mathsf{V}^{0}_{2}+\alpha^{c}_{\psi}$ proves $\mathit{PHP}(x)$.

The claim implies the theorem: it is well known [22, Corollary 12.5.5] that there is an expansion $(M,R^{M})$ of a model $M$ of $\mathsf{BASIC}$ by an interpretation $R^{M}\subseteq M$ of a new predicate $R$ such that $R^{M}$ is bounded and witnesses $\neg\mathit{PHP}(n)$ for some (nonstandard) $n\in M$, and, further, $(M,R^{M})$ models induction for bounded formulas. Let $\mathcal{Y}$ be the collection of bounded sets definable in $(M,R^{M})$ by bounded formulas. Then $(M,\mathcal{Y})$ is a model of $\mathsf{V}^{0}_{2}$ with $R^{M}\in\mathcal{Y}$, so $(M,\mathcal{Y})\models\neg\mathit{PHP}(n)$.

We are left to prove the claim. Argue in $\mathsf{V}^{0}_{2}$ and set $n:=\max\{|x|,2\}$. Then $\alpha^{c}_{\psi}$ gives a circuit $C$ such that

$$\forall u{\leqslant}x\ (\neg C(u)\leftrightarrow\mathit{PHP}(u)).$$

We observe that $\mathsf{V}^{0}_{2}$ proves that $\mathit{PHP}(x)$ is inductive, i.e.,

$$\mathit{PHP}(0)\wedge\forall u{<}x\ (\mathit{PHP}(u)\to\mathit{PHP}(u+1)).$$ (6)

Indeed, if $X$ is a set that witnesses $\neg\mathit{PHP}(u+1)$, then we construct a set $Y$ that witnesses $\neg\mathit{PHP}(u)$ as follows. If there does not exist any $v{\leqslant}u{+}1$ with $\langle v,u\rangle{\in}X$, then the set $Y:=X$ itself is the witness we want. On the other hand, if there exists $v{\leqslant}u{+}1$ with  $\langle v,u\rangle{\in}X$, then let $Y$ be the set of pairs $z=\langle x,y\rangle$ such that the two projections $x=\pi_{1}(z)$ and $y=\pi_{2}(z)$ satisfy the formula $\varphi(x,y,u,v)$ below, for the fixed parameters $u$ and $v$:

$$\varphi(x,y,u,v):=x{\leqslant}u\wedge y{<}u\wedge\big{(}(x{>}v\wedge\langle x{-}1,y\rangle{\in}X)\vee(x{<}v\wedge\langle x,y\rangle{\in}X)\big{)}.$$

Here, $x{-}1$ denotes the (truncated) predecessor $\mathsf{PV}$-function. In the definition of $Y$ we used the two projections $\pi_{1}$ and $\pi_{2}$, also as $\mathsf{PV}$-functions. Since the definition of $Y$ is a quantifier-free $\mathsf{PV}(\alpha)$-formula, the set $Y$ exists by quantifier-free $\mathsf{PV}(\alpha)$-comprehension, and it is clear by construction that it witnesses $\neg\mathit{PHP}(u)$.

To complete the proof, plug $\neg C(u)$ for $\mathit{PHP}(u)$ in (6) and quantifier-free $\mathsf{PV}(\alpha)$-induction gives $\neg C(x)$, and hence $\mathit{PHP}(x)$. ∎

Remark 15.

The model $(M,\mathcal{X})$ that witnesses the above consistency is a model of $\mathsf{V}^{0}_{2}$ where $\mathit{PHP}(n)$ fails for some nonstandard $n\in M$: otherwise $\alpha^{1}_{\neg\mathit{PHP}}$ would be true and witnessed by trivial circuits that always reject.

2.3 A strengthening to $\mathsf{PH/poly}$

While our focus is on $\mathsf{P/poly}$, in this section we point out a version of Theorem 2 stating the consistency of $\mathsf{NEXP}\not\subseteq\mathsf{PH/poly}$.

For $i>0$, let $T_{i}(e,t,x)$ denote a universal $\Sigma^{b}_{i}$-formula: for every $\Sigma^{b}_{i}$-formula $\varphi(x)$, there are $e,d\in\mathbb{N}$ such that $\mathsf{V}^{0}_{2}$ (in fact, $\mathsf{S}^{1}_{2}$ [22, Corollary 6.1.4]) proves

$$\varphi(x)\leftrightarrow T_{i}(e,2^{|x|^{d}+d},x).$$

Intuitively, the parameter $|x|^{d}+d$ serves as a runtime bound of a suitable model-checker coded by $e$. Thus, the formulas $T_{i}(e,2^{|x|^{d}+d},x)$ for varying $c,d\in\mathbb{N}$ define (in the standard model) precisely the problems in the $i$-th level $\Sigma^{\mathsf{P}}_{i}$of the polynomial hierarchy $\mathsf{PH}$.

We incorporate nonuniformity as follows. Again, let $\pi_{1},\pi_{2}$ be the $\mathsf{PV}$-functions computing the projections for pairs $\langle x,y\rangle$. Define

$$T_{i}^{\prime}(a,x):=T_{i}(\pi_{1}(a),2^{|a|},\langle\pi_{2}(a),x\rangle).$$

Thus, $a$ determines the runtime bound and some “advice” $\pi_{2}(a)$. Then $Q\subseteq\mathbb{N}$ is in $\mathsf{PH/poly}$ if there exists $i>0$ and a function $a(n)$ such that $|a(n)|$ is polynomially bounded in $n$ and such that for all $x$ we have $x\in Q$ if and only if $T_{i}^{\prime}(a(|x|),x)$ is true (in the standard model).

Definition 16.

Let $i,c\in\mathbb{N}$ and let $\varphi=\varphi(x)$ be a $\hat{\Sigma}^{1,b}_{1}$-formula (with only one free variable $x$, and in particular without free variables of the set sort). Define

$$\alpha_{\varphi}^{i,c}\ :=\ \forall n{\in}\mathit{Log}_{>1}\ \exists a{\leqslant}2^{n^{c}}\forall x{<}2^{n}\ \big{(}T^{\prime}_{i}(a,x)\leftrightarrow\varphi(x)\big{)}.$$

It is clear that $\bigl{\{}\neg\alpha^{i,c}_{\varphi}\mid i,c\in\mathbb{N}\bigr{\}}$ is true if and only if the $\mathsf{NEXP}$-problem defined by $\varphi(x)$ does not belong to $\mathsf{PH/poly}$. Hence, the following states the consistency of $\mathsf{NEXP}\not\subseteq\mathsf{PH/poly}$:

Theorem 17.

There exists $\varphi(x)\in\hat{\Sigma}^{1,b}_{1}$ such that $\mathsf{V}^{0}_{2}+\bigl{\{}\neg\alpha^{i,c}_{\varphi}\mid i,c\in\mathbb{N}\bigr{\}}$ is consistent.

This is proved in almost exactly the same way as the just-given proof of Theorem 2. The only difference is that, working in a model of $\mathsf{V}^{0}_{2}+\alpha^{i,c}_{\varphi}$, the circuit $C(x)$ is replaced with the formula $T^{\prime}_{i}(a,x)$ for an advice string $a\leqslant 2^{|x|^{c}}$. The details are left to the reader.

3 Formally verified model-checkers

We shall need to formally reason about certain straightforwardly defined exponential time machines, namely model-checkers and universal machines. A model-checker $M_{\varphi}$ for a formula $\varphi(\bar{X},\bar{x})$ has oracle access to $\bar{X}$ and, on input $\bar{x}$, decides whether $\varphi(\bar{X},\bar{x})$ is true. For example, by nesting a loop for each bounded quantifier, $\Sigma^{1,b}_{0}$-formulas have straightforward model-checkers that run in exponential time and polynomial space. We define such model-checkers with care, so that $\mathsf{S}^{1}_{2}(\alpha)$ verifies their time and space bounds as well as their correctness. This correctness statement has to be formulated carefully because, in general, $\mathsf{S}^{1}_{2}(\alpha)$ cannot prove that a halting computation of $M^{\bar{X}}_{\varphi}$ on $\bar{x}$ exists. Thus, proving correctness means to show that if a computation exists, then it does what it is supposed to do. To prove this we use some constructions that are similar in spirit to those in [5].

3.1 Preliminaries: explicit machines

In short, a machine will be called explicit if the theory $\mathsf{S}^{1}_{2}(\alpha)$ proves that its halting computations terminate within a specified number of steps, using no more than a specified amount of space in its work tapes, and by querying its oracles no further than a specified position.

Machine model.

Our model of computation is the multi-tape oracle Turing machine with one-sided infinite tapes (i.e., cells indexed by $\mathbb{N}$) and an alphabet containing $\{0,1\}$. The content of cell $0$ is fixed to a fixed symbol marking the end of the tape. At the start, the heads scan cell $1$. The machines can be deterministic or non-deterministic. Such a machine $M$ has read-only input tapes, and work tapes and oracle tapes. If there are $k$ input tapes, then its inputs are $k$-tuples $\bar{x}=(x_{1},\ldots,x_{k})$ of numbers with the length-$|x_{i}|$ binary representation of $x_{i}$ written on the $i$-th input tape. The length of the input is $|\bar{x}|=\max_{i}|x_{i}|$. If $M$ does not have oracle tapes, then it is a machine without oracles. If $M$ has $\ell\geqslant 1$ oracle tapes, then we write $M^{\bar{X}}$ for the machine with oracles $\bar{X}=(X_{1},\ldots,X_{\ell})$. When the machine enters a special query state, it moves to one out of $2^{\ell}$ many special answer states which codes the answers to the $\ell$ queries written on the $\ell$ oracle tapes, i.e., whether the number written (in binary) on the $i$-th oracle tape belongs to $X_{i}$ or not.

A partial space-$s$ time-$t$ query-$q$ computation of $M^{\bar{X}}$ on $\bar{x}$ comprises $t+1$ configurations, the first one being the starting configuration, every other being a successor of the previous one, and repeating halting configurations, if any. Being space-$s$ means that the largest visited cell on each tape is at most $s$, and being query-$q$ means that the largest visited cell on each oracle tape is at most most $|q|$; in other words, all queries have length at most $|q|$. Query lengths are bounded by $|q|$ instead of $q$ so that all queries are restricted to have polynomial length.

Coding computations.

Fix a machine $M$. Let $s,t,q\in\mathbb{N}$ and consider a partial space-$s$, time-$t$, query-$q$ computation of $M$ on an unspecified input with unspecified oracles. A configuration is coded by an $(s{+}1)$-tuple $(q,c_{0},\ldots,c_{s-1})$ of numbers: $q$ codes the current state of the machine; $c_{i}$ codes, for each tape, a position bit indicating whether the index of the currently scanned cell is at most $i$ and, for each work or oracle tape, the content of cell $i$. We assume that these numbers are smaller than $M$ (the machine is (coded by) a number), so we get an $(s{+}1)\times(t{+}1)$ matrix of such numbers. This matrix is coded by the set $Y$ of numbers bounded by $\langle s,t,|M|\rangle$ that contains exactly those $\langle i,j,k\rangle$ such that $i\leqslant s$, $j\leqslant t$, $k<|M|$ and the $(i,j)$-entry of the matrix has $k$-bit $1$.

The details of the encoding are irrelevant. What is required is that there is a $\mathsf{PV}(\alpha)$-function $f^{Y}$ such that $f^{Y}(t,s,q,j)$ gives, about the $j$-th configuration, a number coding the state, the positions of the heads, the contents of the cells they scan, and the numbers that are written in binary in the first $|q|$ cells of the oracle tapes. In the encoding sketched above, to find the position of a specific head, $f^{Y}$ uses binary search to find $i\leqslant s$ where its position bit flips; computing the oracle queries is possible because the oracle tapes contain numbers below $2^{|q|}$. Having $f^{Y}$, it is straightforward to write a natural $\Pi^{b}_{1}(\alpha)$-formula stating

$$\textit{``$Y$ is a partial space-$s$ time-$t$ query-$q$ computation of~{}$M^{\bar{X}}$ on~{}$\bar{x}$''}.$$ (7)

The free variables of this formula are $Y,\bar{X},\bar{x},s,t,q$. Exceptionally, we shall also consider $M$ on the formal level, in which case $M$ is an additional free number variable. All quantifiers in the $\Pi^{b}_{1}(\alpha)$-formula (7) can be $\mathsf{S}^{1}_{2}(\alpha)$-provably bounded by $p(s,t,|q|,|M|,|\bar{x}|)$ for a polynomial $p$, where $|\bar{x}|$ stands for $|x_{1}|,\ldots,|x_{k}|$. If $M$ is a machine without oracles, the formula is $\mathsf{S}^{1}_{2}(\alpha)$-provably equivalent to the one with $q=0$, and we omit ‘query-$q$’. We also omit ‘space $s$’ if $s=t$. Further, replacing ‘partial’ by ‘halting’ or ‘accepting’ or ‘rejecting’ are obvious modifications of the formula.

Explicit machines.

Binary search gives a $\mathsf{PV}(\alpha)$-function $\textit{time}^{Y}(s,t)$ such that, provably in $\mathsf{S}^{1}_{2}(\alpha)$, if $Y$ is a halting time-$t$ space-$s$ query-$q$ computation of $M^{\bar{X}}$ on $\bar{x}$, then $\textit{time}^{Y}(s,t)$ is the minimal $j\leqslant t$ such that the $j$-th configuration in $Y$ is halting. We make the further assumption that $M$ never writes blank (but can write a copy of this symbol), so heads leave marks on visited cells. Binary search can then compute the maximal non-blank cell in the $j$-th configuration on any tape. By quantifier-free induction for $\mathsf{PV}(\alpha)$-formulas, $\mathsf{S}^{1}_{2}(\alpha)$ proves that this cell number is non-decreasing for $j=0,1,\ldots,t$. Hence, there is a $\mathsf{PV}(\alpha)$-function $\textit{space}^{Y}(s,t)$ such that, provably in $\mathsf{S}^{1}_{2}(\alpha)$, if $Y$ is a halting time-$t$ space-$s$ query-$q$ computation of $M^{\bar{X}}$ on $\bar{x}$, then $\textit{space}^{Y}(s,t)$ is the maximal cell visited in $Y$ on any tape. Similarly, there is a $\mathsf{PV}(\alpha)$-function $\textit{query}^{Y}(s,t)$ that computes the maximal cell visited on a query tape.

Definition 18.

A machine $M$ is explicit if there are terms $s(\bar{x}),t(\bar{x}),q(\bar{x})$ such that

$$\begin{array}[]{lcl}\mathsf{S}^{1}_{2}(\alpha)&\vdash&\textit{``$Y$ is a halting space-$s^{\prime}$ time-$t^{\prime}$ query-$q^{\prime}$ computation of~{}$M^{\bar{X}}$ on~{}$\bar{x}$''}\to\\ &&\quad\textit{time}^{Y}(s^{\prime},t^{\prime})\leqslant t(\bar{x})\wedge\textit{space}^{Y}(s^{\prime},t^{\prime})\leqslant s(\bar{x})\wedge\textit{query}^{Y}(s^{\prime},t^{\prime})\leqslant|q(\bar{x})|.\end{array}$$

We say that the terms $s=s(\bar{x}),t=t(\bar{x}),q=q(\bar{x})$ witness that $M$ is explicit. Further, if $r(\bar{x})$ is another term, then we say that $r=r(\bar{x})$ witnesses that $M$ is an

explicit $\mathsf{NEXP}$-machine	if it is non-deterministic	with $t=s=q=r$;
explicit $\mathsf{EXP}$-machine	if it is deterministic	with $t=s=q=r$;
explicit $\mathsf{PSPACE}$-machine	if it is deterministic	with $t=q=r$ and $s=|r|$;
explicit $\mathsf{NP}$-machine	if it is non-deterministic	with $t=s=|r|$ and $q=r$;
explicit $\mathsf{P}$-machine	if it is deterministic	with $t=s=|r|$ and $q=r$.

Observe that, if $s,t,q$ witness that $M$ is explicit, and $s^{\prime}=s^{\prime}(\bar{x})$, $t^{\prime}=t^{\prime}(\bar{x})$, $q^{\prime}=q^{\prime}(\bar{x})$ are terms such that $\mathsf{S}^{1}_{2}\vdash s(\bar{x}){\leqslant}s^{\prime}(\bar{x})\wedge t(\bar{x}){\leqslant}t^{\prime}(\bar{x})\wedge q(\bar{x}){\leqslant}q^{\prime}(\bar{x})$, then also $s^{\prime},t^{\prime},q^{\prime}$ witness that $M$ is explicit. E.g., if $r$ witnesses that $M$ is an explicit $\mathsf{P}$-machine, then $r$ also witnesses that $M$ is an explicit $\mathsf{PSPACE}$-machine.

Given an explicit machine $M$, we omit ‘space-$s$ time-$t$ query-$q$’ in (7) and its variations with ‘halting’, ‘accepting’ or ‘rejecting’. E.g. for an explicit $\mathsf{EXP}$-machine $M$, say witnessed by $r=r(\bar{x})$, we have a $\Pi^{b}_{1}(\alpha)$-formula

$$\textit{``$Y$ is an accepting computation of $M^{\bar{X}}$ on $\bar{x}$''}.$$ (8)

This means that $Y$ is a space-$r(\bar{x})$ time-$r(\bar{x})$ query-$r(\bar{x})$ computation of $M^{\bar{X}}$ on $\bar{x}$ that ends in an accepting halting configuration, and all queries “$z\in X$?” during the computation satisfy $z<2^{|r(\bar{x})|}$. In particular,

$$Y{\leqslant}\langle r(\bar{x}),r(\bar{x}),|M|\rangle$$ (9)

provably in $\mathsf{S}^{1}_{2}(\alpha)$. Furthermore, all quantifiers in the $\Pi^{b}_{1}(\alpha)$-formula (8) can be $\mathsf{S}^{1}_{2}(\alpha)$-provably bounded by $p(r(\bar{x}),|M|,|\bar{x}|)$ for a polynomial $p$, where $|\bar{x}|$ stands for $|x_{1}|,\ldots,|x_{k}|$.

Thereby, our mode of speech follows [22, Definition 8.1.2] in that the time bound is used to determine the bound on the oracle tapes.

Polynomial-time computations.

It is well-known that $\mathsf{S}^{1}_{2}$ formalizes polynomial time computations. We shall use this in the form of the following lemma.

For an explicit $\mathsf{P}$-machine $M$, its computations $Y$ can be coded by numbers $y$ and we get a $\Pi^{b}_{1}(\alpha)$-formula

$$\textit{``$y$ is a halting computation of $M^{\bar{X}}$ on $\bar{x}$''}.$$

Here, $y$ is a number sort variable, and the free variables are $\bar{X},\bar{x},y$. If $M$ has a special output tape, we agree that the output of a computation is the number whose binary representation is written in cells $1,2,\ldots$ up to the first cell not containing a bit. We have a $\mathsf{PV}(\alpha)$-function $\textit{out}_{M}$ such that, provably in $\mathsf{S}^{1}_{2}(\alpha)$, if $y$ is a halting computation of $M^{\bar{X}}$ on $\bar{x}$, then $\textit{out}_{M}(y,j)$ is the content of cell $j$ of the output tape in the halting configuration in case this is a bit; otherwise $\textit{out}_{M}(y,j){=}2$. In particular, $\mathsf{S}^{1}_{2}(\alpha)$ proves $\textit{out}_{M}(y,j){\leqslant}2$,

Lemma 19.

For every $\mathsf{PV}(\alpha)$-function $f^{\bar{X}}(\bar{x})$ there are an explicit $\mathsf{P}$-machine $M$ and a $\mathsf{PV}(\alpha)$-function $g^{\bar{X}}(\bar{x})$ such that $\mathsf{S}^{1}_{2}(\alpha)$ proves

$$\big{(}\textit{``$y$ is a halting computation of $M^{\bar{X}}$ on $\bar{x}$''}\leftrightarrow y{=}g^{\bar{X}}(\bar{x})\big{)}\wedge$$

$$\big{(}j{<}|f^{\bar{X}}(\bar{x})|\to\textit{out}_{M}(g^{\bar{X}}(\bar{x}),j{+}1){=}\mathit{bit}(f^{\bar{X}}(\bar{x}),j)\big{)}\wedge$$

$$\big{(}j{\geqslant}|f^{\bar{X}}(\bar{x})|\to\textit{out}_{M}(g^{\bar{X}}(\bar{x}),j{+}1){=}2\big{)}.$$

In the statement of the lemma, $\mathit{bit}(n,i)$ is a $\mathsf{PV}$-function computing the $i$-bit of the binary representation of $n$, i.e., $\mathit{bit}(n,i)=\lfloor n/2^{i}\rfloor\ \mathrm{mod}\ 2$ (in the standard model). In particular, we have $\mathit{bit}(n,i)=0$ for $i\geqslant|n|$.

3.2 Deterministic model-checkers

For every $\Sigma^{1,b}_{0}$-formula $\varphi=\varphi(\bar{X},\bar{x})$ in the language $\mathsf{PV}(\alpha)$ we define its bounding term $\mathit{bt}_{\varphi}(\bar{x})$ as follows:

1. $\mathit{bt}_{\varphi}=0$ if $\varphi$ is atomic,

2. $\mathit{bt}_{\varphi}=\mathit{bt}_{\psi}$ if $\varphi=\neg\psi$,

3. $\mathit{bt}_{\varphi}=\mathit{bt}_{\psi}+\mathit{bt}_{\theta}$ if $\varphi=(\psi\wedge\theta)$,

4. $\mathit{bt}_{\varphi}=\mathit{bt}_{\psi}(\bar{x},t(\bar{x}))+t(\bar{x})$ if $\varphi=\exists y{\leqslant}t(\bar{x})\ \psi(\bar{X},\bar{x},y)$.

Lemma 20.

For every $\Sigma^{1,b}_{0}$-formula $\varphi=\varphi(\bar{X},\bar{x})$ there are an explicit $\mathsf{PSPACE}$-machine $M_{\varphi}^{\bar{X}}$, a $\Sigma^{1,b}_{0}$-formula $\mathit{C}_{\varphi}(\bar{X},\bar{x},u)$, terms $r_{\varphi}(\bar{x}),s_{\varphi}(\bar{x})$, and a polynomial $p_{\varphi}(m,\bar{n})$, such that

1. $\mathsf{S}^{1}_{2}(\alpha)\vdash\textit{``$Y$ is an accepting computation of~{}$M_{\varphi}^{\bar{X}}$ on $\bar{x}$''}\to\varphi(\bar{X},\bar{x})$,

2. $\mathsf{S}^{1}_{2}(\alpha)\vdash\textit{``$Y$ is a rejecting computation of~{}$M_{\varphi}^{\bar{X}}$ on $\bar{x}$''}\to\neg\varphi(\bar{X},\bar{x})$,

3. $\mathsf{S}^{1}_{2}(\alpha)\vdash\textit{``$\mathit{C}_{\varphi}(\bar{X},\bar{x},\cdot)$ is a halting computation of~{}$M_{\varphi}^{\bar{X}}$ on $\bar{x}$''}$,

4. $\mathsf{S}^{1}_{2}(\alpha)\vdash\ r_{\varphi}(\bar{x})\leqslant p_{\varphi}(\mathit{bt}_{\varphi}(\bar{x}),|\bar{x}|)$ ,

5. $r_{\varphi}(\bar{x}),s_{\varphi}(\bar{x})$ witness $M^{\bar{X}}_{\varphi}$ as explicit $\mathsf{EXP}$- and $\mathsf{PSPACE}$-machines, respectively.

In addition, if $\varphi=\varphi(\bar{X},\bar{x})$ is a $\Pi^{b}_{1}(\alpha)$-formula, then there are a term $t_{\varphi}(\bar{x})$ and a quantifier-free $\mathsf{PV}(\alpha)$-formula $\mathit{C}_{\varphi}(\bar{X},\bar{x},w,u)$ such that

1. $\mathsf{T}^{1}_{2}(\alpha)\vdash\ \exists w{\leqslant}t_{\varphi}(\bar{x})\ \textit{``$\mathit{C}_{\varphi}(\bar{X},\bar{x},w,\cdot)$ is a halting computation of~{}$M_{\varphi}^{\bar{X}}$ on $\bar{x}$''}$,

2. $\mathsf{S}^{1}_{2}(\alpha)\vdash\ \varphi(\bar{X},\bar{x})\to$ “$\mathit{C}_{\varphi}(\bar{X},\bar{x},t_{\varphi}(\bar{x}),\cdot)$ is an accepting computation of $M_{\varphi}^{\bar{X}}$ on $\bar{x}$”.

Proof.

Call a $\Sigma^{1,b}_{0}$-formula $\varphi=\varphi(\bar{X},\bar{x})$ good if it satisfies (a)–(e). Observe that all $\Sigma^{b}_{0}(\alpha)$-formulas are good: they are $\mathsf{S}^{1}_{2}(\alpha)$-provably equivalent to formulas of the form $f^{\bar{X}}(\bar{x}){=}1$ for some $\mathsf{PV}(\alpha)$-function $f^{\bar{X}}(\bar{x})$, and we can choose a machine according to Lemma 19. Recall that an explicit $\mathsf{P}$-machine is also an explicit $\mathsf{PSPACE}$-machine and explicit $\mathsf{EXP}$-machine (in this case, all three witnessed by the same term).

We leave it to the reader to check that the good formulas are closed under Boolean combinations. We are then left to show that if

$$\varphi(\bar{X},\bar{x})\ =\ \exists y{\leqslant}t(\bar{x})\ \psi(\bar{X},\bar{x},y)$$ (10)

for a term $t(\bar{x})$ and a good formula $\psi=\psi(\bar{X},\bar{x},y)$, then $\varphi$ is good. To lighten the notation, in the following we drop any reference to the set-parameters $\bar{X}$ in the formulas, and to the oracles $\bar{X}$ in machines, since they remain fixed throughout the proof.

The machine $M_{\varphi}$ runs a loop searching for a $y$ in $\{0,\ldots,t(\bar{x})\}$ that satisfies $\psi$. On input $\bar{x}$, it writes $y:=0$ on a work tape and then loops: it checks whether $y\leqslant t(\bar{x})$ and, if so, it updates $y:=y+1$ and runs $M_{\psi}$ on $(\bar{x},y)$; otherwise it halts. It accepts or rejects according to a flag bit $b$ stored in its state space: $b$ is initially set to $0$, and it is set to 1 when and if an $M_{\psi}$-run accepts.

To prove (a)–(e) we want a quantifier-free $\mathsf{PV}(\alpha)$-formula $D(Y,\bar{x},y,u)$ that extracts the $M_{\psi}$-computation simulated in the $y$-loop. More precisely, we want $\mathsf{S}^{1}_{2}(\alpha)$ to prove that, if $Y$ is a halting computation of $M_{\varphi}$ on $\bar{x}$, then $D(Y,\bar{x},y,\cdot)$ is a halting computation of $M_{\psi}$ on $(\bar{x},y)$. For this, we design the details of $M_{\varphi}$ in a way so that the $j$-th step of the computation of $M_{\psi}$ on $(\bar{x},y)$ is simulated by $M_{\varphi}$ at a time easily computed from $\bar{x},y,j$.

Description of $M_{\varphi}$. Set $r(\bar{x}):=r_{\psi}(\bar{x},t(\bar{x}))$ where $r_{\psi}(\bar{x},y)$ is the term claimed to exist for $\psi$. Note that $\mathsf{S}^{1}_{2}(\alpha)$ proves that $r_{\psi}(\bar{x},y)\leqslant r(\bar{x})$ for $y\leqslant t(\bar{x})$. Additionally to properties (a)–(e) for $\psi$, we assume inductively that $\mathsf{S}^{1}_{2}(\alpha)$ proves that the halting configuration of $M_{\psi}$ on $(\bar{x},y)$ equals the initial configuration except for the state, that is, $M_{\psi}$ cleans all worktapes and moves all heads back to cell $1$ before it halts.

Our machine initially computes $t=t(\bar{x})$ and $r=r(\bar{x})$ and two binary clocks initially set to $0^{|t|}$ and $0^{|r|}$. The terms are evaluated using explicit $\mathsf{P}$-machines according to Lemma 19. The initial settings of the clocks are simply computed by scanning the binary representations of $t$ and $r$ that were computed at the start. This initial computation of terms, and initialization of clocks, takes time exactly $\textit{ini}(\bar{x})$ for some $\mathsf{PV}$-function $\textit{ini}(\bar{x})$. Further, $\mathsf{S}^{1}_{2}(\alpha)$ proves $\textit{ini}(\bar{x})\leqslant|t_{\textit{i}}(\bar{x})|$ for a suitable term $t_{\textit{i}}(\bar{x})$.

The $y$-loop is implemented as follows. First update $y$, the value of the first clock. To do this, sweep over the first clock, and then back, in exactly $(2|t|+2)$ steps, doing the following: copy $y$ without leading $0$’s to some tape, so this tape holds the length-$|y|$ binary representation of $y$ (as expected by $M_{\psi}$); increase the clock by $1$ if $y<t$, and reset it to $0^{|t|}$ if $y=t$; in the latter case store a bit signaling this; this signal bit halts the computation (in the next $y$-loop) instead of doing the $y$-update. After this $y$-update, simulate $r$ steps of $M_{\psi}$ on $(\bar{x},y)$ by an inner loop: in $2|r|+2$ steps sweep twice over the second clock. If its value was smaller that $r$, then increase it by $1$ and simulate the next step of $M_{\psi}$’s computation; this can mean repeating the halting computation. If its value was not smaller than $r$, then set the clock back to $0^{|r|}$. Thus, exactly $2|r|+3$ steps are spent for one step of $M_{\psi}$ and one $y$-loop takes exactly $t_{\ell}(\bar{x}):=(r(\bar{x})+1)\cdot(2|r(\bar{x})|+3)$ steps.

If the signal bit halts the computation, then our machine first cleans all tapes and moves heads back to cell $1$, before halting. We omit a description of this final polynomial time computation. It can be implemented to take exactly $\mathit{fin}(\bar{x})$ steps for a $\mathsf{PV}$-function $\mathit{fin}(\bar{x})$, and $\mathsf{S}^{1}_{2}$ proves $\mathit{fin}(\bar{x})\leqslant|t_{\textit{f}}(\bar{x})|$ for a suitable term $t_{\textit{f}}(\bar{x})$.

Thus $M_{\varphi}$ runs in time exactly $\textit{ini}(\bar{x})+(t(\bar{x})+1)\cdot t_{\ell}(\bar{x})+\textit{fin}(\bar{x})$. It simulates $r$ steps of $M_{\psi}$ on $(\bar{x},y)$ at times

$$t(\bar{x},y,j):=\mathit{ini}(\bar{x})+y\cdot t_{\ell}(\bar{x})+(j+1)\cdot(2|r(\bar{x})|+3)$$ (11)

for $j<r(\bar{x})$.

Explicitness: proof of (d)–(e). Let $s_{\psi}(\bar{x},y)$ be the term that witnesses $M_{\psi}$ as an explicit $\mathsf{PSPACE}$-machine. Let $Y$ be a halting computation of $M_{\varphi}$ on $\bar{x}$. There is a $\mathsf{PV}(\alpha)$-function that from $\bar{x}$ computes (a number coding) the initial computation of terms and clocks, and $\mathsf{S}^{1}_{2}(\alpha)$ proves its halting configuration is as described. Clearly, $\mathsf{S}^{1}_{2}(\alpha)$ proves that the first $\textit{ini}(\bar{x})$ steps of $Y$ coincide with this computation. In particular, $\mathsf{S}^{1}_{2}(\alpha)$ proves that the clocks computed in $Y$ have the desired length. Similarly, there is a $\mathsf{PV}(\alpha)$-function that from $\bar{x},y,j$ computes (a number coding) the space-$|s_{\psi}(\bar{x},y)|$ configuration of $M_{\psi}$ at time $t(\bar{x},y,j)$ in $Y$.

We prove, by quantifier-free induction, that the computation $Y$ simulates the steps of $M_{\psi}$ at times $t(y,j):=t(\bar{x},y,j)$ for $y\leqslant t$ and $j<r$. Assume this holds for time $t(y,j)$. We verify it for time $t(y,j+1)$ or time $t(y+1,0)$ depending on whether $j<r$ or $j=r$. Assume the former; the latter case is similar. Compute the time-$(2|r|+3)$ computation (that sweeps twice over the clock and simulates one more step of $M_{\psi}$) starting at the configuration at time $t(y,j)$; then $Y$ must coincide with this computation between time $t(y,j)$ and time $t(y,j+1)$. Hence, $Y$ simulates a step of $M_{\psi}$ at time $t(y,j+1)$. Similarly, quantifier-free induction proves that the $M_{\psi}$-configurations at the times $t(y,j)$ in $Y$ are successors of each others. This yields a quantifier-free $\mathsf{PV}(\alpha)$-formula $D(Y,\bar{x},y,u)$ as desired.

From the configuration at time $\textit{ini}(\bar{x})+(t+1)\cdot t_{\ell}(\bar{x})$ one can compute the final $\textit{fin}(\bar{x})$ steps of the clean-up computation before $M_{\varphi}$ halts, and the last $\textit{fin}(\bar{x})$ steps of $Y$ must coincide with that. Hence, $\mathsf{S}^{1}_{2}(\alpha)$ proves that the configuration of $Y$ at time $\textit{ini}(\bar{x})+(t+1)\cdot t_{\ell}+\textit{fin}(\bar{x})$ is halting. Recalling that $\textit{ini}(\bar{x})\leqslant|t_{\textit{i}}(\bar{x})|$ and $\textit{fin}(\bar{x})\leqslant|t_{\textit{f}}(\bar{x})|$, this implies that the term

$$r_{\varphi}(\bar{x}) := |t_{\textit{i}}(\bar{x})|+(t(\bar{x})+1)\cdot t_{\ell}(\bar{x})+|t_{\textit{f}}(\bar{x})|$$

witnesses $M_{\varphi}$ as an explicit $\mathsf{NEXP}$-machine. Choose a term $s_{\varphi}(\bar{x})$ such that $\mathsf{S}^{1}_{2}$-provably $s_{\varphi}(\bar{x})\geqslant r_{\varphi}(\bar{x})$ and

$$|s_{\varphi}(\bar{x})|\geqslant|t_{\textit{i}}(\bar{x})|+(|t(\bar{x})|+1)+(|r(\bar{x})|+1)+|s_{\psi}(\bar{x},t(\bar{x}))|+|t_{\textit{f}}(\bar{x})|.$$

Then $s_{\varphi}(\bar{x})$ witnesses $M_{\varphi}$ as an explicit $\mathsf{PSPACE}$-machine. This shows (e).

For (d), recall $t_{\ell}(\bar{x})=(r(\bar{x})+1)\cdot(2|r(\bar{x})|+3)$ and hence $r_{\varphi}(\bar{x})\leqslant p(r(\bar{x}),t(\bar{x}),|\bar{x}|)$ for a suitable polynomial $p$, provably in $\mathsf{S}^{1}_{2}$. Recalling that $r(\bar{x})=r_{\psi}(\bar{x},t(\bar{x}))$, and that by (d) for $\psi$ we have $r_{\psi}(\bar{x},y)\leqslant p_{\psi}(\mathit{bt}_{\psi}(\bar{x},y),|\bar{x}|,|y|)$ provably in $\mathsf{S}^{1}_{2}$, from $\mathit{bt}_{\varphi}(\bar{x})=\mathit{bt}_{\psi}(\bar{x},t(\bar{x}))+t(\bar{x})$ we get, also provably in $\mathsf{S}^{1}_{2}$, that $r_{\varphi}(\bar{x})\leqslant p_{\varphi}(\mathit{bt}_{\varphi}(\bar{x}),|\bar{x}|)$ for a suitable polynomial $p_{\varphi}$.

Correctness: proof of (a)–(c). For (a) argue in $\mathsf{S}^{1}_{2}(\alpha)$ and suppose $Y$ is an accepting computation of $M_{\varphi}$ on $\bar{x}$. Being accepting means that the final state has flag $b=1$, while the starting state has flag $b=0$. By binary search we find a time when $b$ flips from $0$ to $1$. This time determines $y_{0}\leqslant t$ such that the $y_{0}$ loop accepts. Then $Z:=D(Y,\bar{x},y_{0},\cdot)$ is an accepting computation of $M_{\psi}$ on $(\bar{x},y_{0})$. Note that $Z$ exists by $\Delta^{b}_{1}(\alpha)$-comprehension. Then (a) for $\psi$ implies $\psi(\bar{x},y_{0})$ and thus $\varphi(\bar{x})$.

For (b), argue in $\mathsf{S}^{1}_{2}(\alpha)$ and suppose $Y$ is a rejecting computation of $M_{\varphi}$ on $\bar{x}$, so the flag is $0$ in the final configuration. Let $y\leqslant t$. Then $D(Y,\bar{x},y,\cdot)$ is a rejecting computation of $M_{\psi}$ on $(\bar{x},y)$: otherwise the $y$ loop sets the flag to $1$ and then binary search finds a time where the flag flips from $1$ to $0$ in $Y$ which contradicts the working of $M_{\varphi}$. Then (b) for $\psi$ implies $\neg\psi(\bar{x},y)$. As $y$ was arbitrary, we get $\neg\varphi(\bar{x})$.

For (c), it is easy to construct from $\mathit{C}_{\psi}$ a formula $\mathit{C}_{\psi,0}$ such that $\mathsf{S}^{1}_{2}(\alpha)$ proves that the set $\mathit{C}_{\psi,0}(\bar{x},y,\cdot)$ is the computation of the $y$-loop of $M_{\varphi}$ on $\bar{x}$ with flag $0$ stored in the state space. There is an analogous formula $\mathit{C}_{\psi,1}$ for flag $1$. These formulas just stretch the computation described by $\mathit{C}_{\psi}$ and interleave it with the trivial updates of the clocks. The desired formula $\mathit{C}_{\varphi}(\bar{x},u)$ ‘glues together’ these computations, plus the initial $\textit{ini}(\bar{x})$ steps of initialization, and the final $\textit{fin}(\bar{x})$ steps of clean-up. We sketch the definition of $\mathit{C}_{\varphi}(\bar{x},u)$: from $u$ we can compute $y$ such that the truth value of $\mathit{C}_{\varphi}(\bar{x},u)$ is one of the bits in the code of the computation of the $y$-loop of $M_{\varphi}$ on $\bar{x}$, or one of the bits in the code of the initial or final computation. Then $\mathit{C}_{\varphi}(\bar{x},u)$ states

$$\begin{array}[]{lcl}(\exists z{<}y\ \psi(\bar{x},z)\wedge\mathit{C}_{\psi,1}(\bar{x},y,u))\vee(\neg\exists z{<}y\ \psi(\bar{x},z)\wedge\mathit{C}_{\psi,0}(\bar{x},y,u)).\end{array}$$ (12)

Proof of (f)–(g). Assume $\varphi$ is a $\Pi^{b}_{1}(\alpha)$-formula. We modify the given construction as follows. Up to $\mathsf{S}^{1}_{2}(\alpha)$-provable equivalence we have

$$\varphi(\bar{X},\bar{x})=\forall y{\leqslant}t(\bar{x})\ g^{\bar{X}}(\bar{x},y){=}1$$

where $t(\bar{x})$ is a term and $g^{\bar{X}}(\bar{x},y)$ is a $\mathsf{PV}(\alpha)$-function. As before, we drop any reference to the set-parameters $\bar{X}$, and to the oracles $\bar{X}$, since they will stay fixed throughout the proof. We define $M_{\varphi}$ similarly as before with the role of $M_{\psi}$ played by a $\mathsf{P}$-machine checking $g(\bar{x},y){=}1$ according to Lemma 19. The only difference is in the flag bit: it is initially set to $1$, and it is set to $0$ when and if a $y$-loop rejects (meaning $\neg g(\bar{x},y){=}1$).

In this case we can choose $r$ small, i.e., equal to $|r^{\prime}|$ for some term $r^{\prime}=r^{\prime}(\bar{x})$, so there is a $\mathsf{PV}(\alpha)$-function $h(\bar{x},y)$ that computes (a number that codes) the computation of the $y$-loop of $M_{\varphi}$. Then $\mathit{C}_{\varphi}(\bar{x},w,u)$ ‘glues together’ these computations plus suitable initial and final computations. The only problem is to determine the flag $b$ stored in the states of $M_{\varphi}$. For this we need to know the minimal $w\leqslant t$ such that $\neg g(\bar{x},w){=}1$ holds, or take $w=t+1$ if $\varphi(\bar{x})$ holds. Such $w$ exists provably in $\mathsf{T}^{1}_{2}(\alpha)$. This shows (f) for $t_{\varphi}(\bar{x}):=t(\bar{x})+1$. For (g), assuming $\varphi(\bar{x})$ we can take $w=t+1$ directly since in this case the flag bit is always 1 provably in $\mathsf{S}^{1}_{2}(\alpha)$. ∎

Remark 21.

The proof shows that the quantifier complexity of $\mathit{C}_{\varphi}$ is close to that of $\varphi$. If $\varphi\in\Sigma^{b}_{0}(\alpha)$, then $\mathit{C}_{\varphi}$ is a quantifier free $\mathsf{PV}(\alpha)$-formula. If $\varphi\in\Sigma^{b}_{i}(\alpha)$ for $i>0$, then $\mathit{C}_{\varphi}$ is a Boolean combination of $\Sigma^{b}_{i}(\alpha)$-formulas. Note that if the outer quantifier in (10) is sharply bounded, i.e., $t(\bar{x})=|t^{\prime}(\bar{x})|$ for some term $t^{\prime}(\bar{x})$, then the $y$-bounded quantifiers in (12) are sharply bounded too.

3.3 Optimality remarks

This subsection offers some remarks stating that Lemma 20.6 cannot be improved in certain respects. This material is not needed in the following.

Remark 22.

For our definition of $M^{\bar{X}}_{\varphi}$, one cannot replace $\mathsf{T}^{1}_{2}(\alpha)$ by $\mathsf{S}^{1}_{2}(\alpha)$ in Lemma 20.6 unless $\mathsf{S}^{1}_{2}=\mathsf{T}^{1}_{2}$.

Proof.

Let $\varphi(x)=\exists y{\leqslant}x\ \psi(y,x)$ for $\psi$ a quantifier-free $\mathsf{PV}$-formula, and assume (6) holds for $\mathsf{S}^{1}_{2}(\alpha)$ instead of $\mathsf{T}^{1}_{2}(\alpha)$. We show $\mathsf{S}^{1}_{2}(\alpha)$ proves that, if there is $y\leqslant x$ such that $\psi(y,x)$, then there is a minimal such $y$. Argue in $\mathsf{S}^{1}_{2}(\alpha)$ and suppose $\varphi(x)$. By $\Delta^{b}_{1}(\alpha)$-comprehension and (6) there is a halting computation $Y$ of $M_{\varphi}$ on $x$. By (b) it cannot be rejecting, so is accepting. Our proof of (a) gives $\psi(y_{0},x)$ for $y_{0}\leqslant x$ such that the flag $b$ flips from 0 to 1 in loop $y_{0}$. We claim $y_{0}$ is minimal. This is clear if $y_{0}=0$. Otherwise we had $b=0$ after the loop on $y_{0}-1$ (in $Y$). For contradiction, assume there is $y_{1}<y_{0}$ with $\psi(y_{1},x)$. Then the loop on $y_{1}$ would set $b=1$. By quantifier-free induction we find a time between $y_{1}$ and $y_{0}-1$ where $b$ flips from 1 to 0. This contradicts the working of $M_{\varphi}$. ∎

Fix any machines $M_{\varphi}$ satisfying the lemma. Call a formula true if its universal closure is true in the standard model.

Remark 23.

In Lemma 20.6 the auxiliary $\exists w$ cannot be omitted. There is a $\Sigma^{b}_{1}(\alpha)$-formula $\varphi(X,x)$ such that for all quantifier-free $\mathsf{PV}(\alpha)$-formulas $C(X,x,u)$ the following is not true:

$$\textit{``$C(X,x,\cdot)$ is a halting computation of~{}$M_{\varphi}^{X}$ on $x$''}.$$

Proof.

Otherwise every $\Sigma^{b}_{1}(\alpha)$-formula $\varphi(X,x)$ is equivalent to a quantifier-free $\mathsf{PV}(\alpha)$-formula $D(X,x)$. Let $A\subseteq\mathbb{N}$ be such that $\mathsf{NP}^{A}\not\subseteq\mathsf{P}^{A}$ and choose $Q$ in $\mathsf{NP}^{A}\setminus\penalty 10000\mathsf{P}^{A}$. Choose a $\Sigma^{b}_{1}(\alpha)$-formula $\varphi(X,x)$ defining $Q$ in $(\mathbb{N},A)$, the model where $X$ is interpreted by $A$. Note $D(X,x)$ defines in $(\mathbb{N},A)$ a problem in $\mathsf{P}^{A}$. Then $(\varphi(X,x)\leftrightarrow\penalty 10000D(X,x))$ fails in $(\mathbb{N},A)$ for some $x$, and hence also in $(\mathbb{N},A^{\prime})$ for some bounded $A^{\prime}\subseteq A$ (Remark 12). Thus, this equivalence is not true. ∎

Remark 24.

Lemma 20.6 does not extend to much more complex formulas. There is a $\Pi^{b}_{2}(\alpha)$-formula $\varphi(X,x)$ such that for all terms $t$ and all quantifier-free $\mathsf{PV}(\alpha)$-formulas $C$ the following is not true:

$$\exists w{\leqslant}t(x)\textit{``$C(X,x,w,\cdot)$ is a halting computation of~{}$M_{\varphi}^{X}$ on $x$''}.$$

Proof.

Note this is a $\Sigma^{b}_{2}(\alpha)$-formula, so for every $A\subseteq\mathbb{N}$ defines in $(\mathbb{N},A)$ a problem in $(\Sigma^{\mathsf{P}}_{2})^{A}$. Choose $A$ such that $(\Pi^{\mathsf{P}}_{2})^{A}\neq(\Sigma^{\mathsf{P}}_{2})^{A}$ and argue similarly as before. ∎

3.4 Non-deterministic model-checkers

We shall also need model-checkers for $\hat{\Sigma}^{1,b}_{1}$-formulas. As a first step we prove a technical lemma showing how to convert an explicit oracle $\mathsf{PSPACE}$-machine $M^{Y}$ into an explicit $\mathsf{NEXP}$-machine $N$ that first guesses the oracle $Y$ on a guess tape, and then simulates $M^{Y}$. As usual, we need to show that $\mathsf{S}^{1}_{2}(\alpha)$ is able to prove that this construction does what is claimed.

Lemma 25.

For every explicit $\mathsf{PSPACE}$-machine $M^{Y,\bar{X}}$ that, as explicit $\mathsf{EXP}$-machine, is witnessed by term $r_{M}(\bar{x})$, there are an explicit $\mathsf{NEXP}$-machine $N^{\bar{X}}$, a term $r_{N}(\bar{x})$, a polynomial $p_{N}(m,\bar{n})$, and quantifier-free $\mathsf{PV}(\alpha)$-formulas $F,G,H$ such that

1. $\begin{array}[t]{lcl}\mathsf{S}^{1}_{2}(\alpha)&\vdash&\textit{``$Z$ is an accepting computation of~{}$M^{Y,\bar{X}}$ on $\bar{x}$''}\to\\ &&\textit{``$F(Z,Y,\bar{X},\bar{x},\cdot)$ is an accepting computation of~{}$N^{\bar{X}}$ on $\bar{x}$''}.\end{array}$

2. $\begin{array}[t]{lcl}\mathsf{S}^{1}_{2}(\alpha)&\vdash&\textit{``$Z$ is an accepting computation of~{}$N^{\bar{X}}$ on $\bar{x}$''}\to\\ &&\textit{``$G(Z,\bar{X},\bar{x},\cdot)$ is an accepting computation of~{}$M^{H(Z,\bar{X},\bar{x},\cdot),\bar{X}}$ on $\bar{x}$''}\end{array}$

3. $\mathsf{S}^{1}_{2}(\alpha)\vdash\ r_{N}(\bar{x})\leqslant p_{N}(r_{M}(\bar{x}),|\bar{x}|)$,

4. The term $r_{N}(\bar{x})$ witnesses $N^{\bar{X}}$ as explicit $\mathsf{NEXP}$-machine.

Proof.

Set $r=r_{M}(\bar{x})$. By assumption, the triple of terms $r_{M}(\bar{x}),r_{M}(\bar{x}),r_{M}(\bar{x})$ witnesses that $M^{Y,\bar{X}}$ is explicit. In particular, every query “$z\in Y$?” made by $M^{Y,\bar{X}}$ on $\bar{x}$ satisfies $|z|\leqslant|r|$ and hence $z<2^{|r|}$. The machine $N^{\bar{X}}$ on $\bar{x}$ guesses a binary string $Y$ of length $2^{|r|}$ on a guess tape and then simulates $M^{Y,\bar{X}}$ on $\bar{x}$ as follows: an oracle query “$z\in Y$?” of $M^{Y,\bar{X}}$ is answered reading cell $z{+}1$ on the guess tape. As in the proof of Lemma 20, to prove (a)–(d) we need to design the details of $N$ in a way so that the $j$-th step of the computation of $M$ is simulated by $N$ at a time easily computed from $\bar{x},j$. To reduce notation, in the following we drop any reference to the oracles $\bar{X}$ as they will remain fixed throughout the proof.

Description of $N$. The machine $N$ on $\bar{x}$ first computes $r$ and two binary clocks initialized to $0^{|r|+1}$ and $0^{|r|}$, respectively. To write $Y$ of length $2^{|r|}$ on the guess tape the machine checks whether the first clock equals $2^{|r|}$ and, if not, increases it by one and moves one cell to the right on the guess tape. This is done in exactly $2|r|+5$ steps. Once the clock equals $2^{|r|}$, the machine moves back to cell $1$ on the guess tape and non-deterministically writes $0$ or $1$ in each step, except in the step that finally rebounds on cell $0$ to cell $1$. The terms are computed with explicit $\mathsf{P}$-machines according to Lemma 19. The initial computation of terms, and initialization of clocks, takes time exactly $\mathit{ini}(\bar{x})$ for some $\mathsf{PV}$-function $\mathit{ini}(\bar{x})$. Therefore, the guess of $Y$ takes exactly $\mathit{guess}(\bar{x}):=\mathit{ini}(\bar{x})+2^{|r|}\cdot(2|r|+5)+2^{|r|}+1$ steps. Moreover, $\mathsf{S}^{1}_{2}$ proves $\mathit{guess}(\bar{x})\leqslant t_{\textit{g}}(\bar{x})$, where

$$t_{\textit{g}}(\bar{x}):=|t_{\textit{i}}(\bar{x})|+2^{|r_{M}(\bar{x})|}\cdot(2|r_{M}(\bar{x})|+5)+2^{|r_{M}(\bar{x})|}+1,$$

for a suitable term $t_{\textit{i}}(\bar{x})$ such that $\mathsf{S}^{1}_{2}$ proves $\mathit{ini}(\bar{x})\leqslant|t_{\textit{i}}(\bar{x})|$.

The machine simulates $r$ steps of $M^{Y}$ using the second clock. Comparing this clock with $r$ and updating it takes $2|r|+2$ steps. If the value of the clock is less than $r$, then a step of $M^{Y}$ is simulated by reading the $(z{+}1)$-cell of the guess tape where $z$ is the content of $M^{Y}$’s oracle tape for $Y$. This is done as follows. The machine moves forward over the guess tape, and rewinds back to cell $1$. With each step forward it increases the first clock by one and checks whether it equals $z$ or $2^{|r|}$. If and when the clock equals $z$, it stores the oracle bit read on the guess tape in its state space. Otherwise, i.e., $z{\geqslant}2^{|r|}$, the machine stores oracle bit $0$. When the clock equals $2^{|r|}$, the scan of the guess tape ends, and the rewinding to cell $1$ starts (in the next step). Doing this takes time exactly $2^{|r|}\cdot(2|r|+4)+2^{|r|}+1$ and the oracle bit is stored at time $\min\{z,2^{|r|}\}\cdot(2|r|+4)$. Thus, when the value of the second clock is less than $r$, one step of $M^{Y}$ is simulated in exactly

$$t_{\textit{s}}(\bar{x}):=(2|r_{M}(\bar{x})|+2)+2^{|r_{M}(\bar{x})|}\cdot(2|r_{M}(\bar{x})|+4)+2^{|r_{M}(\bar{x})|}+2$$

steps. Otherwise, the simulation halts in an accepting or rejecting state according to $M^{Y}$’s state. In total, the machine runs for exactly $\mathit{guess}(\bar{x})+r\cdot t_{\textit{s}}(\bar{x})+(2|r|+2)$ steps. The steps of $M^{Y}$ on $\bar{x}$ are simulated at times

$$t(\bar{x},j):=\mathit{guess}(\bar{x})+(j+1)\cdot t_{\textit{s}}(\bar{x})$$

for $j<r_{M}(x)$. The runtime is bounded by the term

$$r_{N}(\bar{x}):=t_{\textit{g}}(\bar{x})+r_{M}(\bar{x})\cdot t_{\textit{s}}(\bar{x})+(2|r_{M}(\bar{x})|+2)$$

Explicitness. We argue that this bound on the runtime of $N$ can be verified in $\mathsf{S}^{1}_{2}(\alpha)$, given a halting computation $Z$ of $N$ on $\bar{x}$. Note that, unlike the simulation in Lemma 20, a single step is simulated in possibly exponential time $t_{\textit{s}}(\bar{x})$. However, this possibly exponential time computation is simply described: Since $M^{Y}$ is an explicit $\mathsf{PSPACE}$-machine, its configurations can be coded by numbers. Now, given a number coding the configuration of $M^{Y}$ within $Z$ at time $t(j):=t(\bar{x},j)$, say with $Y$-oracle query $z$, and given a time $i<t_{\textit{s}}(\bar{x})$, we can compute the configuration of the clocks and the state of the (to-be-)stored oracle-bit at time $t(j)+i$. Now, quantifier-free induction suffices to prove that the oracle bit is stored at the desired time and equals the content of the $(z{+}1)$-cell of the guess tape (or 0 if $z\geqslant 2^{|r|}$). Quantifier-free induction proves that the configurations of $M^{Y}$ within $Z$ at times $t(j)$ for $j<r$ are successors of those preceding them. In particular, $\mathsf{S}^{1}_{2}(\alpha)$ proves that the configuration at time $r_{N}(\bar{x})$ is halting. Space and query bounds can be similarly verified, so $N$ is explicit and witnessed by $r_{N}(\bar{x})$.

Proof of (a)–(d). For (a), the quantifier-free formula $F$ concatenates an initial polynomial-time computation of the terms and clocks, a guess of $Y$, and a simulation of $Z$. Each configuration of the guess of $Y$ is computable in polynomial time. The simulation of $Z$ stretches each step of $M^{Y}$ to a time $t_{\textit{s}}(\bar{x})$ computation, each configuration of which is easily computed from $Y$ and $Z$ in polynomial time. Quantifier-free induction proves that a $Y$-query $z$ in $Z$ is answered according to the bit in the $(z{+}1)$-cell on the guess tape.

For (b), the quantifier-free formula $H$ extracts the guess $Y$ from $Z$ and the quantifier-free formula $G$ extracts the simulated computation at the times $t(\bar{x},j)$ for $j<r_{M}(\bar{x})$.

For (c) and (d), we already argued that the term $r_{N}(\bar{x})$ witnesses $N$ as an explicit $\mathsf{NEXP}$-machine. The claim that $r_{N}(\bar{x})\leqslant p_{N}(r_{M}(\bar{x}),|\bar{x}|)$ holds for a suitable polynomial $p_{N}$ follows by inspection, and $\mathsf{S}^{1}_{2}(\alpha)$ proves it. ∎

Now we can state the lemma that proves that every $\hat{\Sigma}^{1,b}_{1}$-formula has a formally verified model-checker. In its statement, the bounding term $\mathit{bt}_{\psi}(\bar{x})$ of a $\hat{\Sigma}^{1,b}_{1}$-formula $\psi=\psi(\bar{X},\bar{x})$ as in Equation (5) is defined to be the bounding term $\mathit{bt}_{\varphi}(\bar{x})$ of its maximal $\Sigma^{1,b}_{0}$ subformula $\varphi=\varphi(Y,\bar{X},\bar{x})$.

Lemma 26.

For every $\hat{\Sigma}^{1,b}_{1}$-formula $\psi=\psi(\bar{X},\bar{x})$, there exists an explicit $\mathsf{NEXP}$-machine $N^{\bar{X}}_{\psi}$, a term $r_{\psi}(\bar{x})$, and a polynomial $p_{\psi}(m,\bar{n})$, such that

1. $\mathsf{V}^{0}_{2}\vdash\ \psi(\bar{X},\bar{x})\to\exists_{2}Y\textit{``$Y$ is an accepting computation of $N^{\bar{X}}_{\psi}$ on $\bar{x}$''}.$

2. $\mathsf{S}^{1}_{2}(\alpha)\vdash\ \neg\psi(\bar{X},\bar{x})\to\neg\exists_{2}Y\textit{``$Y$ is an accepting computation of $N^{\bar{X}}_{\psi}$ on $\bar{x}$''}.$

3. $\mathsf{S}^{1}_{2}(\alpha)\vdash\ r_{\psi}(\bar{x})\leqslant p_{\psi}(\mathit{bt}_{\psi}(\bar{x}),|\bar{x}|)$,

4. the term $r_{\psi}(\bar{x})$ witnesses $N^{\bar{X}}_{\psi}$ as explicit $\mathsf{NEXP}$-machine.

Furthermore, if the maximal $\Sigma^{1,b}_{0}$-subformula of $\psi$ is a $\Pi^{b}_{1}(\alpha)$-formula, then

1. $\mathsf{S}^{1}_{2}(\alpha)\vdash\psi(\bar{X},\bar{x})\leftrightarrow\exists_{2}Y\textit{``$Y$ is an accepting computation of $N^{\bar{X}}_{\psi}$ on $\bar{x}$''}.$

Proof.

Let $\psi(\bar{X},\bar{x})=\exists_{2}Y\ \varphi(Y,\bar{X},\bar{x})$ where $\varphi=\varphi(Y,\bar{X},\bar{x})$ is a $\Sigma^{1,b}_{0}$-formula. Recall that the bounding term of $\psi$ is $\mathit{bt}_{\psi}(\bar{x})=\mathit{bt}_{\varphi}(\bar{x})$. In what follows, to lighten the notation, we drop any reference to the set parameters $\bar{X}$ in formulas, and to the oracles $\bar{X}$ in machines, since they remain fixed throughout the proof.

Let $M^{Y}_{\varphi}$ be the explicit $\mathsf{PSPACE}$-machine given by Lemma 20 applied to $\varphi$. Let $r_{\varphi}$ and $p_{\varphi}$ be the term and the polynomial also given by that lemma. By Lemma 20.e, the term $r_{\varphi}$ witnesses $M^{Y}_{\varphi}$ as explicit $\mathsf{EXP}$-machine. Therefore, Lemma 25 applies to $M^{Y}_{\varphi}$ and $r_{\varphi}$ and we get an explicit $\mathsf{NEXP}$-machine $N_{\psi}$, a term $r_{\psi}$, and a polynomial $p_{\psi}$. We prove (a)–(e) using the quantifier-free $\mathsf{PV}(\alpha)$-formulas $F,G,H$ also given by Lemma 25, and the $\Sigma^{1,b}_{0}$-formula $\mathit{C}_{\varphi}$ given by Lemma 20.

For (a), argue in $\mathsf{V}^{0}_{2}$ and assume $\psi(\bar{x})$ holds. Choose $Y$ such that $\varphi(Y,\bar{x})$ holds. By Lemma 20.c, the set $Z:=\mathit{C}_{\varphi}(Y,\bar{x},\cdot)$ is a halting computation of $M^{Y}_{\varphi}$ on $\bar{x}$. Note that $Z$ exists by $\Sigma^{1,b}_{0}$-comprehension, which defines the theory $\mathsf{V}^{0}_{2}$. By Lemma 20.b, the computation $Z$ cannot be rejecting, so it is accepting. By Lemma 25.a, the set $F:=F(Z,Y,\bar{x},\cdot)$ is an accepting computation of $N_{\psi}$ on $\bar{x}$. Note that $F$ exists by $\Delta^{b}_{1}(\alpha)$-comprehension.

For (b), argue in $\mathsf{S}^{1}_{2}(\alpha)$ and assume $Y$ is an accepting computation of $N_{\psi}$ on $\bar{x}$. By Lemma 25.b we have that $G(Y,\bar{x},\cdot)$ is an accepting computation of $M_{\varphi}^{Z}$ on $\bar{x}$, for $Z:=H(Y,\bar{x},\cdot)$. Note that $Z$ exists by $\Delta^{b}_{1}(\alpha)$-comprehension. By Lemma 20.a we get that $\varphi(Z,\bar{x},\cdot)$ holds. Thus $\psi(\bar{x})$ follows.

For (c) and (d), refer to Lemma 25.c, the choices of $r_{\psi}$ and $p_{\psi}$, and the fact that $\mathit{bt}_{\psi}(\bar{x})=\mathit{bt}_{\varphi}(\bar{x})$. This also gives the claim that $r_{\psi}(\bar{x})$ witnesses $N_{\psi}$ as explicit $\mathsf{NEXP}$-machine.

For (e), argue in $\mathsf{S}^{1}_{2}(\alpha)$. If $\neg\psi(\bar{x})$ holds, use (b). If $\psi(\bar{x})$ holds, choose $Y$ such that $\varphi(Y,\bar{x})$ holds. Then Lemma 20.7 and $\Delta^{b}_{1}(\alpha)$-comprehension imply that there exists an accepting computation $Z$ of $M_{\varphi}^{Y}$ on $\bar{x}$. Now argue as in (a). ∎

4 Consistency for $\mathsf{NEXP}$

In this section we define a suitable universal explicit $\mathsf{NEXP}$-machine $M_{0}$. We verify the claim from the introduction that both theories $\{\neg\alpha^{c}_{M_{0}}\mid c\geqslant 1\}$ and $\{\neg\beta^{c}_{M_{0}}\mid\penalty 10000c\geqslant 1\}$ formalize $\mathsf{NEXP}\not\subseteq\mathsf{P/poly}$. We finally prove that the consistency of both formalizations with the theory $\mathsf{V}^{0}_{2}$ follows from Theorem 2 and our work on formally-verified model-checkers.

4.1 A universal machine

A canonical $\mathsf{NEXP}$-complete problem called $Q_{0}$ is:

Given $\langle N,x,t\rangle$ as input, where $N$ is a (number coding a) non-deterministic machine, and $x$ and $t$ are numbers written in binary, does $N$ accept $x$ in at most $t$ steps?

A non-deterministic exponential-time machine $M_{0}$ for $Q_{0}$, on input $\langle N,x,t\rangle$, guesses and verifies a time-$t$ computation of $N$ on $x$. We ask for an implementation of this so that a weak theory can verify its correctness. This is a quite direct consequence of Lemmas 20 and 26.

Lemma 27.

There exists an explicit $\mathsf{NEXP}$-machine $M_{0}$ with one input-tape and without oracles, such that for every explicit $\mathsf{NEXP}$-machine $M$ with one input-tape and without oracles, say witnessed by the term $t_{M}(x)$, there are quantifier-free $\mathsf{PV}(\alpha)$-formulas $F(Z,x,u)$ and $G(Z,x,u)$ such that

1. $\begin{array}[t]{lcl}\mathsf{S}^{1}_{2}(\alpha)&\vdash&\textit{``$Z$ is an accepting computation of $M$ on $x$''}\to\\ &&\;\;\textit{``$F(Z,x,\cdot)$ is an accepting computation of $M_{0}$ on $\langle M,x,t_{M}(x)\rangle$''},\end{array}$

2. $\begin{array}[t]{lcl}\mathsf{S}^{1}_{2}(\alpha)&\vdash&\textit{``$Z$ is an accepting computation of $M_{0}$ on $\langle M,x,t_{M}(x)\rangle$''}\to\\ &&\;\;\textit{``$G(Z,x,\cdot)$ is an accepting computation of $M$ on $x$''}.\end{array}$

In particular,

1. $\begin{array}[t]{lcl}\mathsf{S}^{1}_{2}(\alpha)&\vdash&\exists_{2}Z\textit{``$Z$ is an accepting computation of $M_{0}$ on $\langle M,x,t_{M}(x)\rangle$''}\leftrightarrow\\ &&\;\;\exists_{2}Z\textit{``$Z$ is an accepting computation of $M$ on $x$''}.\end{array}$

Proof.

Let $\pi_{1},\pi_{2},\pi_{3}$ be $\mathsf{PV}$-functions that extract $x_{1},x_{2},x_{3}$ from $z=\langle x_{1},x_{2},x_{3}\rangle$. Define $\Pi^{b}_{1}$-formulas as follows:

$$\varphi_{1}(Z,z)\ :=\ \varphi_{2}(Z,\pi_{1}(z),\pi_{2}(z),\pi_{3}(z)),$$

$$\varphi_{2}(Z,N,x,t)\ :=\ \textit{``$Z$ is an accepting time-$t$ computation of $N$ on $x$''}.$$

Let $M_{1}^{Z}$ be the machine given by Lemma 20 applied to $\varphi_{1}=\varphi_{1}(Z,z)$, and let $r_{1}(z)$ be the corresponding term. Since $\varphi_{1}$ is a $\Pi^{b}_{1}(\alpha)$-formula, let $t_{1}(z)$ and $C_{1}(Z,z,w,u)$ be the term and the quantifier-free $\mathsf{PV}(\alpha)$-formula given by Lemma 20.7. We set $M_{0}$ to the explicit $\mathsf{NEXP}$-machine given by Lemma 25 applied to $M_{1}^{Z}$ with term $r_{1}(z)$ witnessing it as explicit $\mathsf{EXP}$-machine by Lemma 20.e. In the proof of (a)–(b) we use the quantifier-free $\mathsf{PV}(\alpha)$-formulas $F_{1},G_{1},H_{1}$ given by Lemma 25 on $M_{1}^{Z}$.

For (a) we set $F(Z,x,u):=F_{1}(C,Z,z,u)$ where $C$ abbreviates $C_{1}(Z,z,t_{1}(z),\cdot)$ and in both cases $z$ abbreviates $\langle M,x,t_{M}(x)\rangle$. Argue in $\mathsf{S}^{1}_{2}(\alpha)$ and assume $Z$ is an accepting computation of $M$ on $x$. Since $M$ is explicit and $t_{M}(x)$ is a term witnessing it, we have that $Z$ is an accepting time-$t$ computation of $M$ on $x$, for $t:=t_{M}(x)$. It follows that $\varphi_{2}(Z,M,x,t_{M}(x))$ holds, and hence $\varphi_{1}(Z,z)$ holds. Since $\varphi_{1}$ is a $\Pi^{b}_{1}(\alpha)$-formula, by Lemma 20.7 we have that the set $C:=C_{1}(Z,z,t_{1}(z),\cdot)$ is an accepting computation of $M_{1}^{Z}$ on $z$. Such a $C$ exists by $\Delta^{b}_{1}(\alpha)$-comprehension because $C_{1}$ is a quantifier-free $\mathsf{PV}(\alpha)$-formula. By Lemma 25.a we get that the set $F:=F(Z,x,\cdot)=F_{1}(C,Z,z,\cdot)$ is an accepting computation of $M_{0}$ on $z$; i.e., the right-hand side of the implication in (a) holds. Again, $F$ exists by $\Delta^{b}_{1}(\alpha)$-comprehension.

For (b) we set $G(Z,x,u):=G_{1}(Z,z,u)$ where, again, $z$ abbreviates $\langle M,x,t_{M}(x)\rangle$. Argue in $\mathsf{S}^{1}_{2}(\alpha)$ and assume $Z$ is an accepting computation of $M_{0}$ on $z$. Then, by Lemma 25.b we have that the set $G:=G(Z,x,\cdot)=G_{1}(Z,z,\cdot)$ is an accepting computation of $M_{1}^{H}$ on $z$ for $H:=H_{1}(Z,z,\cdot)$. The two sets $G$ and $H$ exist by $\Delta^{b}_{1}$-comprehension. Now, Lemma 20.a implies that $\varphi_{1}(H,z)$ holds; i.e., $H$ is an accepting time-$t$ computation of $M$ on $x$, for $t:=t_{M}(x)$, and hence also an accepting computation of $M$ on $x$. This shows that the right-hand side in the implication in (b) holds.

The final statement follows from (a) and (b) by $\Delta^{b}_{1}(\alpha)$-comprehension. ∎

4.2 Formalization

The introduction claimed that the theories $\{\neg\alpha^{c}_{M_{0}}\mid c\geqslant 1\}$ and $\{\neg\beta^{c}_{M_{0}}\mid c\geqslant 1\}$ both formalize $\mathsf{NEXP}\not\subseteq\mathsf{P/poly}$. This is easy to check:

Proposition 28.

The following are equivalent.

1. $\mathsf{NEXP}\not\subseteq\mathsf{P/poly}$.

2. $\big{\{}\neg\alpha^{c}_{M_{0}}\mid c\in\mathbb{N}\big{\}}$ is true.

3. $\big{\{}\neg\alpha^{c}_{M}\mid c\in\mathbb{N}\big{\}}$ is true for some explicit $\mathsf{NEXP}$-machine $M$.

4. $\big{\{}\neg\beta^{c}_{M_{0}}\mid c\in\mathbb{N}\big{\}}$ is true.

5. $\big{\{}\neg\beta^{c}_{M}\mid c\in\mathbb{N}\big{\}}$ is true for some explicit $\mathsf{NEXP}$-machine $M$.

Proof.

We show that (a)-(b)-(c) are equivalent, and that (a)-(d)-(e) are equivalent. To see that (a) implies (b), assume (b) fails; i.e., $\alpha^{c}_{M_{0}}$ is true for some $c\in\mathbb{N}$. Then $Q_{0}\in\mathsf{SIZE}[n^{c}]$. As $Q_{0}$ is $\mathsf{NEXP}$-complete, (a) fails. That (b) implies (c) is trivial since $M_{0}$ is an explicit $\mathsf{NEXP}$-machine. That (c) implies (a) is obvious since every explicit $\mathsf{NEXP}$-machine defines a language in $\mathsf{NEXP}$. To see that (a) implies (d) argue as in the proof that (a) implies (b) swapping $\beta$ for $\alpha$. That (d) implies (e) is trivial since $M_{0}$ is an explicit $\mathsf{NEXP}$-machine. Finally, that (e) implies (a) follows from the Easy Witness Lemma 4. ∎

It is straightforward to see that the equivalences (b)-(c) and (d)-(e) in Proposition 28 have direct proofs (i.e., proofs that do not rely on the easy witness lemma). We use Lemma 27 to prove this on the formal level, for both formalizations.

Lemma 29.

For every $c\in\mathbb{N}$ and every $1$-input explicit $\mathsf{NEXP}$-machine $M$ without oracles there is $d\in\mathbb{N}$ such that $\mathsf{S}^{1}_{2}(\alpha)$ proves $(\alpha^{c}_{M_{0}}\to\alpha^{d}_{M})$ and $(\beta^{c}_{M_{0}}\to\beta^{d}_{M})$.

Proof.

We refer to the implication between $\alpha$’s as the $\alpha$-case, and to the implication between $\beta$’s as the $\beta$-case. Both have similar proofs, so we prove them at the same time. Let $M$ be witnessed by the term $t_{M}(x)$. Let $F(Z,x,u)$ and $G(Z,x,u)$ be the formulas given by Lemma 27 on $M$. Argue in $\mathsf{S}^{1}_{2}(\alpha)$ and assume $\alpha^{c}_{M_{0}}$ or $\beta^{c}_{M_{0}}$, as appropriate. Let $n\in\mathit{Log}_{>1}$ be given. We aim to find a circuit $C$ in the $\alpha$-case, and two circuits $C,D$ in the $\beta$-case, witnessing $\alpha_{M}^{e}$ or $\beta_{M}^{e}$, respectively, for the given $n$, and for suitable $e\in\mathbb{N}$. Choose $d\in\mathbb{N}$ such that $|\langle M,x,t_{M}(x)\rangle|\ <\ n^{d}$ for all $x<2^{n}$. In the $\alpha$-case, let $C_{0}$ be a circuit with $|C_{0}|<m^{c}$ that witnesses $\alpha_{M_{0}}^{c}$ for $m:=n^{d}$. In the $\beta$-case let $C_{0},D_{0}$ be circuits with $|C_{0}|,|D_{0}|<m^{c}$ that witness $\beta_{M_{0}}^{c}$ for $m:=n^{d}$.

Choose $C$ such that $C(x)=C_{0}(\langle M,x,t_{M}(x)\rangle)$ and $e\in\mathbb{N}$ such that $C<2^{n^{e}}$. This $C$ will be the witness-circuit in the $\alpha$-case, and the first of the two witness-circuits in the $\beta$-case. For the latter, we choose the second circuit $D$ as follows. Choose formulas $F,G$ according to Lemma 27. By Lemma 14 there is a circuit $D$ such that

$$D(x,u)\leftrightarrow G(D_{0}(\langle M,x,t_{M}(x)\rangle,\cdot),x,u)$$

for all $x,u$ with $x<2^{n}$. Then $C,D<2^{n^{e}}$ for suitable $e\in\mathbb{N}$. This is the $e\in\mathbb{N}$ we choose in the $\beta$-case.

We claim that $C$ witnesses $\alpha^{e}_{M}$ for the given $n$ in the $\alpha$-case, and $C,D$ witness $\beta^{e}_{M}$ for the given $n$ in the $\beta$-case. Let $x<2^{n}$ and choose $z:=\langle x,M,t_{M}(x)\rangle$. Let $Z$ be any set and let $Y:=F(Z,x,\cdot)$, which exists by $\Delta^{b}_{1}(\alpha)$-comprehension. If $C(x)=0$, then $C_{0}(z)=0$ and both $\alpha^{c}_{M_{0}}$ and $\beta^{c}_{M_{0}}$ imply that $Y$ is not an accepting computation of $M_{0}$ on $z$. By Lemma 27.a this means that $Z$ is not an accepting computation of $M$ on $x$. In both cases, this completes one half of the verification of the witnesses. If $C(x)=1$, then $C_{0}(z)=1$ and $\alpha^{c}_{M_{0}}$ implies that there exists an accepting computation $Y$ of $M_{0}$ on $z$, and $\beta^{c}_{M_{0}}$ implies that $Y:=D_{0}(z,\cdot)$ is such an accepting computation of $M_{0}$ on $z$. But then Lemma 27.b implies that $Z:=G(Y,x,\cdot)$, which exists by $\Delta^{b}_{1}(\alpha)$-comprehension, is an accepting computation of $M$ on $x$. In both cases, this completes the other half of the verification of the witness: in the $\beta$-case, because $Z=D(x,\cdot)$. ∎

4.3 Consistency

For every explicit $\mathsf{NEXP}$-machine $M$, which by default has one input-tape and no oracles, recall that $\alpha^{c}_{M}:=\alpha^{c}_{\psi}$ for $\psi$ as in Definition 3. For a theory $\mathsf{T}$ that extends $\mathsf{S}^{1}_{2}(\alpha)$, consider the following A-statements for $\mathsf{T}$:

A:	$\mathsf{T}+\{\neg\alpha^{c}_{M}\mid c\in\mathbb{N}\}$ is consistent for some explicit $\mathsf{NEXP}$-machine $M$,
A0:	$\mathsf{T}+\{\neg\alpha^{c}_{M_{0}}\mid c\in\mathbb{N}\}$ is consistent.

Consider also the corresponding B-statements for $\mathsf{T}$:

B:	$\mathsf{T}+\{\neg\beta^{c}_{M}\mid c\in\mathbb{N}\}$ is consistent for some explicit $\mathsf{NEXP}$-machine $M$,
B0:	$\mathsf{T}+\{\neg\beta^{c}_{M_{0}}\mid c\in\mathbb{N}\}$ is consistent.

Next, recall the statement of Theorem 2, which we now state for an arbitrary theory $\mathsf{T}$ that extends $\mathsf{S}^{1}_{2}(\alpha)$. We refer to it as the C-statement, or the direct consistency statement for $\mathsf{T}$:

C:	$\mathsf{T}+\{\neg\alpha^{c}_{\psi}\mid c\in\mathbb{N}\}$ is consistent for some $\hat{\Sigma}^{1,b}_{1}$-formula $\psi(x)$.

Let us explicitly point out that the formula $\psi(x)$ of the C-statement has only one free variable of the number sort, and no free variables of the set sort.

Lemma 30.

For every $c\in\mathbb{N}$ and every explicit $\mathsf{NEXP}$-machine $M$ with one input-tape and without oracles, $\mathsf{S}^{1}_{2}(\alpha)$ proves $(\beta^{c}_{M}\to\alpha^{c}_{M})$.

Proof.

The formula $\beta^{c}_{M}$ states that the (single) existential set-quantifier in $\alpha^{c}_{M}$ is witnessed by $D_{x}(\cdot)$, and this set exists by $\Delta^{b}_{1}(\alpha)$-comprehension. ∎

We view the following proposition as justification that our formalization is faithful. It takes record of which implications in Proposition 28 hold over weak theories.

Proposition 31.

Let $\mathsf{T}$ be a theory extending $\mathsf{S}^{1}_{2}(\alpha)$ and consider the A,B,C-statements for $\mathsf{T}$. Then, the following hold: the A-statements are equivalent, the B-statements are equivalent, and both A-statements imply both B-statements as well as the C-statement.

Proof.

Lemma 30 and compactness show that each A-statement implies the corresponding B-statement. Further, Lemma 29 proves that the A-statements are equivalent, and that the B-statements are equivalent; for the back implications note that $M_{0}$ is certainly an explicit $\mathsf{NEXP}$-machine. Further, it is obvious from the definition of $\alpha^{c}_{M}$ that A implies C and hence both A-statements imply C. ∎

When $\mathsf{T}=\mathsf{V}^{0}_{2}$, we argue below that the model-checker lemmas can be used to show that the implication A-to-C in Proposition 31 can be reversed. It will follow that all A,B,C-statements for $\mathsf{V}^{0}_{2}$ are equivalent. Composing with Theorem 2 we get the following corollary, which entails Theorem 7.

Theorem 32.

For $\mathsf{T}=\mathsf{V}^{0}_{2}$ all statements C, A, A0, B, B0 are true.

Proof.

Theorem 2 states that C is true for $\mathsf{T}=\mathsf{V}^{0}_{2}$. Hence, by Proposition 31, it suffices to show that C implies A for $\mathsf{T}=\mathsf{V}^{0}_{2}$. But this follows from Lemma 26.a and 26.b. Indeed, these state that every $\hat{\Sigma}^{1,b}_{1}$-formula $\psi(x)$ is $\mathsf{V}^{0}_{2}$-provably equivalent to (3) for suitable $M$. ∎

5 Consistency for barely superpolynomial time

In this section we fix $r\in\mathsf{PV}$ such that

1. the function $x\mapsto r(x)$ is computable in time $O(r(x))$;

2. $\mathsf{S}^{1}_{2}\vdash(|x|{=}|y|\to r(x){=}r(y))$;

3. $\mathsf{S}^{1}_{2}\vdash(|x|{<}|y|\to r(x){<}r(y))$;

4. for every polynomial $p$ there is $f\in\mathsf{PV}$ such that $\mathsf{S}^{1}_{2}\vdash p(r(x))\leqslant r(f(x))$;

5. for every $c\in\mathbb{N}$ there is $n_{c}\in\mathbb{N}$ such that $\mathbb{N}\models\forall x\ (|x|{>}n_{c}\to r(x){>}|x|^{c})$.

We call a function $r$ satisfying (r4) length-superpolynomial. An explicit $\mathsf{NTIME}(\mathsf{poly}(r(x)))$-machine is an explicit $\mathsf{NEXP}$-machine $M$ that is witnessed by $p(r(x))$ for some polynomial $p$.

Here, we deviate from our convention that explicit machines are witnessed by terms and allow $\mathsf{PV}$-symbols. In the notation $\mathsf{NTIME}(\mathsf{poly}(r(x)))$, the $x$ is there to emphasize that the runtime is measured as a function of the input $x$ and not its length. If we want to measure runtime as a function of the length of the input, then we use $n$ instead of $x$. For example, $\mathsf{NP}=\mathsf{NTIME}(n^{O(1)})$ is given by the collection of explicit $\mathsf{NTIME}(\mathsf{poly}(r(x)))$-machines with $r(x)=|x|$, and the classes $\mathsf{NE}=\mathsf{NTIME}(2^{O(n)})$ and $\mathsf{NTIME}(n^{O(\log^{(k)}n)})$ are given by the collections of explicit $\mathsf{NTIME}(\mathsf{poly}(r(x)))$-machines for $r(x)=2^{|x|}$ and $r(x)=|x|^{\log^{(k)}|x|}$, respectively; the latter two satisfy (r0)-(r4), if $k\geqslant 1$ in the second.

Remark 33.

(r3) is not implied by the other conditions.

Proof.

We shall define a function $r(x)$ which consists of slow growing segments interspersed with fast growing segments. First, choose a fast growing function $R\in\mathsf{PV}$ so that $R(x)$ depends only on $|x|$ and so that $R(x)^{2}\geqslant R(x)+|x|^{\omega(1)}$. For instance $R(x)=2^{|x|}$ works. Second, define $\ell:\mathbb{N}\to\mathbb{N}$ be increasing with $\ell(c+1)>\ell(c)^{c}+1$ and with $R(x)^{2}\geqslant R(x)+|x|^{c}$ for all $x\geqslant 2^{\ell(c)-1}$. Let $x_{c}:=2^{\ell(c)-1}$ and $y_{c}:=2^{\ell(c)^{c}}-1$ be the first and last numbers of length $\ell(c)$ and $\ell(c)^{c}$, respectively. Finally, let $r(x):=R(x_{c})+|x|-|x_{c}|$ for $x_{c}\leqslant x\leqslant y_{c}$, and let $r(x):=R(x)$ for $y_{c}<x<x_{c+1}$. The slow growing segments of $r(x)$ are where $x_{c}\leqslant x\leqslant y_{c}$, and here $r(x)$ is chosen to be as slow growing as possible while satisfying (r1) and (r2).

Clearly, $\ell$ and $R$ can be chosen so that $r(x)$ is in $\mathsf{PV}$ and properties (r0), (r1), (r2), and (r4) hold for $r$. We claim (r3) fails for $p(x)=x^{2}$.

Indeed, let $f\in\mathsf{PV}$ be given and choose $c$ such that $|f(x_{c})|<|x_{c}|^{c}=|y_{c}|$. Then

$$p(r(x_{c}))=r(x_{c})^{2}=R(x_{c})^{2}\geqslant R(x_{c})+|x_{c}|^{c}=R(x_{c})+|y_{c}|>r(y_{c})>r(f(x_{c}))$$

where the last inequality follows from (r2). ∎

5.1 A more general universal machine

We start with the analogue of Lemma 27.

Lemma 34.

There is an explicit $\mathsf{NTIME}(\mathsf{poly}(r(x)))$-machine $M_{r}$ with one input-tape and without oracles such that for every explicit $\mathsf{NTIME}(\mathsf{poly}(r(x)))$-machine $M$ with one input-tape and without oracles there are $f_{M}(x)\in\mathsf{PV}$ and quantifier-free $\mathsf{PV}(\alpha)$-formulas $F_{M}$ and $G_{M}$ such that

1. $\begin{array}[t]{lcl}\mathsf{S}^{1}_{2}(\alpha)&\vdash&\textit{``$Z$ is an accepting computation of $M$ on $x$''}\to\\ &&\textit{``$F_{M}(Z,x,\cdot)$ is an accepting computation of $M_{r}$ on $\langle M,x,f_{M}(x)\rangle$''}.\end{array}$

2. $\begin{array}[t]{lcl}\mathsf{S}^{1}_{2}(\alpha)&\vdash&\textit{``$Z$ is an accepting computation of $M_{r}$ on $\langle M,x,f_{M}(x)\rangle$''}\to\\ &&\textit{``$G_{M}(Z,x,\cdot)$ is an accepting computation of $M$ on $x$''},\end{array}$

In particular,

1. $\begin{array}[t]{lcl}\mathsf{S}^{1}_{2}(\alpha)&\vdash&\exists_{2}Z\textit{``$Z$ is an accepting computation of $M_{r}$ on $\langle M,x,f_{M}(x)\rangle$''}\leftrightarrow\\ &&\exists_{2}Z\textit{``$Z$ is an accepting computation of $M$ on $x$''}\end{array}$

Proof.

Choose according to Lemma 20 a machine $M^{Z}_{\varphi}$ and a term $r_{\varphi}(N,x,t)$ for

$$\varphi(Z,N,x,t)\ :=\textit{``$Z$ is an accepting time-$t$ computation of~{}$N$ on~{}$x$''}.$$

By the comment after Equation (7), there is a polynomial $p_{1}$ so that $\mathit{bt}_{\varphi}(N,x,t){\leqslant}p_{1}(t,|N|,|x|)$ provably in $\mathsf{S}^{1}_{2}$. By Lemma 20.d, there is a polynomial $p_{2}$ so that $r_{\varphi}(N,x,t){\leqslant}p_{2}(t,|N|,|x|)$ provably in $\mathsf{S}^{1}_{2}$. For $M^{Z}_{\varphi}$ choose a machine $M_{1}$ and a term $r_{1}(N,x,t)$ according to Lemma 25. By Lemma 25.c, there is a polynomial $p_{3}$ so that $r_{1}(N,x,t)\leqslant p_{3}(t,|N|,|x|)$.

Define $M_{r}$ to compute on $z$ as follows. It first checks that $z=\langle N,x,t\rangle$ for certain $N,x,t$ and computes $\langle N,x,r(t)\rangle$; if the check fails, the machine stops. After this initial computation $M_{r}$ runs $M_{1}$ on $\langle N,x,r(t)\rangle$. The initial computation can be implemented with explicit $\mathsf{P}$-machines (Lemma 19), say with time bound $p_{4}(|z|)$ for a polynomial $p_{4}$. Then $M_{r}$ is an explicit $\mathsf{NTIME}(\mathsf{poly}(r(x)))$-machine. Indeed, it is witnessed by $p_{4}(|z|)+p_{3}(r(z),|z|,|z|)\leqslant p_{5}(r(z))$ for a polynomial $p_{5}$. Here we use that $\mathsf{S}^{1}_{2}$-provably $t,N,x$ are bounded by $z$, and $r$ is non-decreasing with $r(x)\geqslant|x|$ by (r1) and (r2).

Let $M$ be an explicit $\mathsf{NTIME}(\mathsf{poly}(r(x)))$-machine, say witnessed by $p_{M}(r(x))$ for a polynomial $p_{M}$. Choose $f_{M}$ for $p_{M}$ according to (r3).

For (a), argue in $\mathsf{S}^{1}_{2}$ and assume $Z$ is an accepting computation of $M$ on $x$. Then $Z$ is time $p_{M}(r(x))$, so by (r3) we can repeat the halting configuration to get an accepting time $r(f_{M}(x))$ computation $Z_{0}$ of $M$ on $x$, i.e., $\varphi(Z_{0},M,x,r(f_{M}(x)))$ holds. By Lemma 20.7, the set $Z_{1}:=C_{\varphi}(Z_{0},M,x,r(f_{M}(x)),t_{\varphi}(M,x,r(f_{M}(x))),\cdot)$ is an accepting computation of $M^{Z_{0}}_{\varphi}$ on the triple $M,x,r(f_{M}(x))$. By Lemma 25.a, the set $Z_{2}:=F(Z_{1},Z_{0},M,x,r(f_{M}(x)),\cdot)$ is an accepting computation of $M_{1}$ on the triple $M,x,r(f_{M}(x))$. Compose $Z_{2}$ with an initial computation of $M_{r}$ on $z:=\langle M,x,f_{M}(x)\rangle$ to get an accepting computation $Z_{3}$ of $M_{r}$ on $z$. It is clear that $Z_{3}=F_{M}(Z,x,\cdot)$ for some quantifier-free $\mathsf{PV}(\alpha)$-formula $F_{M}$.

For (b), argue in $\mathsf{S}^{1}_{2}$ and let $Z$ be an accepting computation of $M_{r}$ on $\langle M,x,f_{M}(x)\rangle$. From $Z$ extract an accepting computation $Z_{0}$ of $M_{1}$ on the triple $M,x,r(f_{M}(x))$. By Lemma 25.b,  $Z_{1}:=G(Z_{0},M,x,r(f_{M}(x)),\cdot)$ is an accepting computation of $M^{Z_{2}}_{\varphi}$ on the triple $M,x,r(f_{M}(x))$ where $Z_{2}:=H(Z_{0},M,x,r(f_{M}(x)),\cdot)$. Clearly, $Z_{0}$ can be described by a quantifier-free $\mathsf{PV}(\alpha)$-formula, so $Z_{1}$ and $Z_{2}$ exist by $\Delta^{b}_{1}(\alpha)$-comprehension. Hence, by Lemma 20.a, $\varphi(Z_{2},M,x,r(f_{M}(x)))$ holds, i.e., $Z_{2}$ is an accepting time-$r(f_{M}(x))$ computation of $M$ on $x$. By (r3) we can shrink $Z_{2}$ to time $p_{M}(r(x))$ and get an accepting computation $Z_{3}$ of $M$ on $x$. Clearly, $Z_{3}=G_{M}(Z,x,\cdot)$ for some quantifier-free $\mathsf{PV}(\alpha)$-formula $G_{M}$.

Finally, (c) follows from (a) and (b) by $\Delta^{b}_{1}(\alpha)$-comprehension. ∎

5.2 Formalization

To faithfully formalize $\mathsf{NTIME}(\mathsf{poly}(r(x)))\not\subseteq\mathsf{P/poly}$ we intend to follow the path paved in Section 4. Some modification are, however, required. First, we need an analogue of the Easy Witness Lemma. This has been achieved by Murray and Williams [27]:

Lemma 35.

Let $t(n)$ be a function that is increasing, time-constructible, and superpolynomial. If $\mathsf{NTIME}(\mathsf{poly}(t(n)))\subseteq\mathsf{P/poly}$, then every $\mathsf{NTIME}(\mathsf{poly}(t(n)))$-machine $M$ has polynomial-size witness circuits.

That $t(n)$ is superpolynomial means that for every $c\in\mathbb{N}$ there is $n_{c}\in\mathbb{N}$ such that $t(n)>n^{c}$ for all $n>n_{c}$. That $M$ has witness circuits of size $s(n)$, where $s:\mathbb{N}\to\mathbb{N}$ is a function, means that for every  $x\in\{0,1\}^{*}$ that is accepted by $M$, there exists a circuit $D$ of size at most $s(|x|)$ such that $\mathit{tt}(D)$ encodes an accepting computation of $M$ on $x$. Note that, in contrast to Lemma 4, the circuit $D$ can depend on $x$. We do not know whether Lemma 35 holds true for oblivious witness circuits as in Lemma 4.

Lemma 35 follows from the central result of [27]:

Lemma 36 (Lemma 4.1 in [27]).

There are $e,g\in\mathbb{N}$ with $e,g\geqslant 1$ such that for all increasing time-constructible functions $s(n)$ and $t(n)$, and for $s_{2}(n):=s(en)^{e}$, if $\mathsf{NTIME}(O(t(n)^{e}))\subseteq\mathsf{SIZE}(s(n))$, then every $\mathsf{NTIME}(t(n))$-machine has witness circuits of size $s_{2}(s_{2}(s_{2}(n)))^{2g}$, provided that $s(n)<2^{n/e}/n$ and $t(n)\geqslant\penalty 10000s_{2}(s_{2}(s_{2}(n)))^{d}$ for a sufficiently large $d\in\mathbb{N}$.

Proof of Lemma 35 from Lemma 36.

We start noting that there is a non-deterministic machine $U$ that decides the problem $Q_{0}$ defined in Section 4.1 in time $O(|x|+|M|\cdot t^{2})$ on input $\langle M,x,t\rangle$: after reading the input, guess the non-deterministic choices of $M$ and deterministically in time $c_{M}\cdot t^{2}$ simulate the computation path of $M$ on input $x$ as determined by those choices, where $c_{M}$ is a simulation overhead constant that depends only on $M$ and that we may assume is at most $|M|$.

Assume $\mathsf{NTIME}(\mathsf{poly}(t(n)))\subseteq\mathsf{P/poly}$. Fix $c\in\mathbb{N}$ with $c\geqslant 1$ and an $\mathsf{NTIME}(t(n)^{c})$-machine $M$. We intend to apply Lemma 36 to $M$ for a suitably chosen $s(n)$, with $t(n)^{c}$ in the role of $t(n)$. For that, we will need to show that $\mathsf{NTIME}(O(t(n)^{ce}))\subseteq\mathsf{SIZE}(s(n))$ for the chosen $s(n)$, where $e\geqslant 1$ is the first of the two constants in Lemma 36.

The restriction of $U$ to inputs of the form $\langle M,x,t(|x|)^{ce+1}\rangle$ runs in time $O(|x|+\penalty 10000|M|\cdot t(|x|)^{2ce+2})$. Therefore, the set of pairs $\langle M,x\rangle$ such that $U$ accepts on input $\langle M,x,t(|x|)^{ce+1}\rangle$ is in $\mathsf{NTIME}(\mathsf{poly}(t(n)))$, so by the assumption, it is decided by circuits of size $p(|\langle M,x\rangle|)$ for a suitable polynomial $p(n)$.

Now, choose $s(n)$ as a polynomial such that for every non-deterministic Turing machine $M$ and every $x$ that is sufficiently long with respect to $M$ it holds that $p(|\langle M,x\rangle|)<s(|x|)$. We verify that $\mathsf{NTIME}(O(t(n)^{ce}))\subseteq\mathsf{SIZE}(s(n))$: if $B$ is a set in $\mathsf{NTIME}(O(t(n)^{ce}))$ and $M$ is a non-deterministic Turing machine that witnesses this, then, for sufficiently long $x$, we have that $x$ is in $B$ if and only if $U$ accepts on $\langle M,x,t(|x|)^{ce+1}\rangle$. Hence, by the choice of $s(n)$, the set $B$ is in $\mathsf{SIZE}(s(n))$.

The requirements of Lemma 36 that $s(n)<2^{n/e}/n$ and $t(n)^{c}\geqslant s_{2}(s_{2}(s_{2}(n)))^{d}$ for a sufficiently large constant $d\in\mathbb{N}$ are obviously met because $s(n)$ is polynomially bounded and $t(n)$ is superpolynomial. Lemma 36 applied to $s(n)$ and $t(n)^{c}$ then gives that $M$ has witness circuits of size $s_{2}(s_{2}(s_{2}(n)))^{2g}$, where $g\geqslant 1$ is the second of the two constants in Lemma 36. Since $s(n)$ is polynomially bounded, also this function is polynomially bounded. Thus, $M$ has polynomial-size witness circuits. ∎

Lemma 35 enables a $\forall\Pi^{1,b}_{1}$-formalization of $\mathsf{NTIME}(\mathsf{poly}(r(x)))\not\subseteq\mathsf{P/poly}$:

Definition 37.

For an explicit $\mathsf{NTIME}(\mathsf{poly}(r(x)))$-machine $M$ with one input-tape and without oracles define

$$\begin{array}[]{lcl}\gamma_{M}^{c}&:=&\forall n{\in}\mathit{Log}_{>1}\ \exists C{<}2^{n^{c}}\ \forall x{<}2^{n}\ \exists D{<}2^{n^{c}}\ \forall_{2}Y\\ &&\quad(C(x){=}0\ \to\ \neg\textit{``$Y$ is an accepting computation of $M$ on $x$''})\ \wedge\\ &&\quad(C(x){=}1\ \to\ \textit{``$D(\cdot)$ is an accepting computation of $M$ on $x$''}).\end{array}$$

Let $M_{r}$ be the explicit $\mathsf{NTIME}(\mathsf{poly}(r(x))))$-machine of Lemma 34. Define

$$\textit{``$\mathsf{NTIME}(\mathsf{poly}(r(x)))\not\subseteq\mathsf{P/poly}$''}\ :=\ \big{\{}\neg\gamma^{c}_{M_{r}}\mid c\in\mathbb{N}\big{\}}.$$

The following is the analogue of Lemma 30 and is similarly proved.

Lemma 38.

For every $c\in\mathbb{N}$ and every explicit $\mathsf{NTIME}(\mathsf{poly}(r(x)))$-machine $M$ with one input-tape and without oracles, $\mathsf{S}^{1}_{2}(\alpha)$ proves $(\gamma^{c}_{M}\to\alpha^{c}_{M})$.

Lemma 39.

For every $c\in\mathbb{N}$ and every explicit $\mathsf{NTIME}(\mathsf{poly}(r(x)))$-machine $M$ with one input-tape and without oracles there is $d\in\mathbb{N}$ such that $\mathsf{S}^{1}_{2}(\alpha)$ proves $(\alpha^{c}_{M_{r}}\to\alpha^{d}_{M})$ and $(\gamma^{c}_{M_{r}}\to\gamma^{d}_{M})$.

Proof.

This is proved similarly as Lemma 29. We only treat the $\gamma$-case. Choose $f_{M}(x)\in\mathsf{PV}$ according to Lemma 34. Argue in $\mathsf{S}^{1}_{2}(\alpha)+\gamma^{c}_{M_{r}}$. Let $n\in\mathit{Log}_{>1}$ be given. Choose $e\in\mathbb{N}$ such that $|\langle M,x,f_{M}(x)\rangle|<n^{e}$ for all $x<2^{n}$. Choose $C_{0}$ witnessing $\gamma^{c}_{M_{r}}$ for $m:=n^{e}$. Choose a circuit $C$ such that $C(x)=C_{0}(\langle M,x,f_{M}(x)\rangle)$ for all $x<2^{n}$. We shall choose $d$ large enough such that $C\leqslant 2^{n^{d}}$ and choose $C$ to witness the first existential quantifier in $\gamma^{d}_{M}$ for $n$. To verify this choice, let $x<2^{n}$ be given.

If $C(x)=0$, then there are no accepting computations of $M_{r}$ on $\langle M,x,f_{M}(x)\rangle$. By Lemma 34.a and $\Delta^{b}_{1}(\alpha)$-comprehension, there are no accepting computations of $M$ on $x$. If $C(x)=1$, then there is a circuit $D_{0}<2^{m^{c}}$ such that $D_{0}(\cdot)$ is an accepting computation of $M_{r}$ on $\langle M,x,f_{M}(x)\rangle$. By Lemma 34.b, $G_{M}(D_{0}(\cdot),x,\cdot)$ is an accepting computation of $M$ on $x$. By Lemma 14 there is a circuit $D$ such that $\big{(}D(u)\leftrightarrow G_{M}(D_{0}(\cdot),x,u)\big{)}$ for all $u\leqslant\langle p_{M}(r(x)),p_{M}(r(x),|M|)\rangle$ where $p_{M}$ is a polynomial such that $p_{M}(r(x))$ witnesses $M$. Choose $d\in\mathbb{N}$ large enough such that $D<2^{n^{d}}$. ∎

Finally, we are in the position to verify that the formulas considered formalize the intended circuit lower bound.

Proposition 40.

The following are equivalent.

1. $\mathsf{NTIME}(\mathsf{poly}(r(x)))\not\subseteq\mathsf{P/poly}$.

2. $\big{\{}\neg\alpha^{c}_{M_{r}}\mid c\in\mathbb{N}\big{\}}$ is true.

3. $\big{\{}\neg\alpha^{c}_{M}\mid c\in\mathbb{N}\big{\}}$ is true for some explicit $\mathsf{NTIME}(\mathsf{poly}(r(x)))$-machine $M$.

4. $\big{\{}\neg\gamma^{c}_{M}\mid c\in\mathbb{N}\big{\}}$ is true for some explicit $\mathsf{NTIME}(\mathsf{poly}(r(x)))$-machine $M$.

5. $\big{\{}\neg\gamma^{c}_{M_{r}}\mid c\in\mathbb{N}\big{\}}$ is true.

Proof.

To see that (a) implies (b), assume (b) fails, so $\alpha^{c}_{M_{r}}$ is true for some $c\in\mathbb{N}$. Then the problem accepted by $M_{r}$ is in $\mathsf{SIZE}[n^{c}]$. By Lemma 34 this problem is $\mathsf{NTIME}(\mathsf{poly}(r(x)))$-hard under polynomial time reductions. Since $\mathsf{P/poly}$ is downward-closed under polynomial-time reductions, (a) fails. The claim that (b) implies (c) is trivial since $M_{r}$ is an explicit $\mathsf{NTIME}(\mathsf{poly}(r(x)))$-machine. That (c) implies (d) follows from Lemma 38. That (d) implies (e) follows from Lemma 39. That (e) implies (a) follows from Lemma 35: by (r1) there is a function $t(n)$ such that $t(|x|)=r(x)$ for every $x$; then $\mathsf{NTIME}(\mathsf{poly}(r(x)))=\mathsf{NTIME}(\mathsf{poly}(t(n)))$ where the time-bound on the left is written as a function of the input $x$ and on the right as a function of its length $n=|x|$; further, $t(n)$ is time-constructible by (r0) and (r1), increasing by (r2) and superpolynomial by (r4). ∎

5.3 Consistency

For a theory $\mathsf{T}$ that extends $\mathsf{S}^{1}_{2}(\alpha)$, the new A,B-statements are the following:

Ar:	$\mathsf{T}+\{\neg\alpha^{c}_{M}$	$\mid c\in\mathbb{N}\}$ is consistent for some explicit $\mathsf{NTIME}(\mathsf{poly}(r(x)))$-machine $M$,
Br:	$\mathsf{T}+\{\neg\gamma^{c}_{M}$	$\mid c\in\mathbb{N}\}$ is consistent for some explicit $\mathsf{NTIME}(\mathsf{poly}(r(x)))$-machine $M$,
A0r:	$\mathsf{T}+\{\neg\alpha^{c}_{M_{r}}$	$\mid c\in\mathbb{N}\}$ is consistent.
B0r:	$\mathsf{T}+\{\neg\gamma^{c}_{M_{r}}$	$\mid c\in\mathbb{N}\}$ is consistent.

To define the corresponding C-statement, we say that the bounding term of a $\hat{\Sigma}^{1,b}_{1}$-formula $\psi=\psi(x)$ is polynomial in $r(x)$ if $\mathsf{S}^{1}_{2}$ proves $\mathit{bt}(\psi)\leqslant p(r(x))$ for some polynomial $p(n)$. Then:

Cr:	$\mathsf{T}+\{\neg\alpha^{c}_{\psi}$	$\mid c\in\mathbb{N}\}$ is consistent for some $\hat{\Sigma}^{1,b}_{1}$-formula $\psi=\psi(x)$ whose
	bounding term is polynomial in $r(x)$.

Before we prove the analogue of Theorem 32 we state the proof complexity lower bound on which it is based. Recall the Pigeonhole Principle formula $\mathit{PHP}(x)$ from the proof of Theorem 2. The first strong lower bounds on the provability of $\mathit{PHP}(x)$ were due to Ajtai [1]; here we need the later quantitative improvements from [4]. This can be called the gem of proof complexity. We use it in the following form. Recall that a function is called length-superpolynomial when it satisfies (r4).

Theorem 41 (Gem Theorem).

For every length-superpolynomial $\mathsf{PV}$-function $s(x)$, the theory $\mathsf{V}^{0}_{2}$ does not prove $\mathit{PHP}(s(x))$.

Proof.

Consider the Paris-Wilkie propositional translations $F_{n}:=\langle\mathit{PHP}(s(n))\rangle_{n}$ for $n\in\mathbb{N}$; see [22, Definition 9.1.1] in the form used in [22, Corollary 9.1.4]. Assume for contradiction that $\mathit{PHP}(s(x))$ is provable in $\mathsf{V}^{0}_{2}$. Then, there exist constants $c,d\in\mathbb{N}$ such that for every sufficiently large $n\in\mathbb{N}$, the propositional formulas $F_{n}$ have Frege proofs of depth $d$ and size $2^{|n|^{c}}$: apply [22, Corollary 9.1.4] with the function $f(x)=x\#x$ and note that $\mathsf{V}^{0}_{2}$ is conservative over the theory considered there: from a model of that theory, get a model of $\mathsf{V}^{0}_{2}$ by just adding all bounded sets that are definable by bounded formulas.

Now, let $n\in\mathbb{N}$ be large enough to ensure this upper bound and at the same time such that $s(n)>|n|^{6^{d}c}$, which exists because $s(x)$ is length-superpolynomial. Setting $m:=s(n)$, this means that the propositional formula $\mathit{PHP}^{m+1}_{m}:=F_{n}$ has Frege proofs of depth $d$ and size bounded by an exponential in $m^{1/6^{d}}$. It is well-known that if $m$ is sufficiently large, then this is false; see [22, Theorem 12.5.3]. ∎

Finally we can prove the analogue of Theorem 32, which entails Theorem 9.

Theorem 42.

For $\mathsf{T}=\mathsf{V}^{0}_{2}$, all statements C_r, A_r, A0_r, B_r, B0_r are true.

Proof.

The analogue of Proposition 31 for the A_r,B_r,C_r-statements has the same proof using Lemmas 38, 39 in place of Lemmas 30, 29. Note that the claim that A_r implies C_r follows from the remark after Equation (9). As in the proof of Theorem 32, that C_r implies A_r for $\mathsf{T}=\mathsf{V}^{0}_{2}$ follows from Lemma 26.a and 26.b. We also need 26.c along with $r(x)\geqslant|x|$ by (r1) and (r2) to guarantee that the explicit $\mathsf{NEXP}$-machine is an explicit $\mathsf{NTIME}(\mathsf{poly}(r(x)))$-machine.

We are left to show that C_r holds for $\mathsf{T}=\mathsf{V}^{0}_{2}$. This is proved by tightening the choice of parameters in the argument that proved Theorem 2.

Consider the formula

$$y{\leqslant}r(x)\wedge\neg\mathit{PHP}(y)$$ (13)

and write this as $\psi=\psi(z)$, where $z=\langle x,y\rangle$; i.e., $x=\pi_{1}(z)$ and $y=\pi_{2}(z)$ with $\pi_{1}$ and $\pi_{2}$ as $\mathsf{PV}$-functions. The formula $\psi(z)$ is logically equivalent to a $\hat{\Sigma}^{1,b}_{1}$-formula whose bounding term is polynomial in $r(z)$ by (r1) and (r2). We claim that $\mathsf{V}^{0}_{2}+\{\neg\alpha^{c}_{\psi}\mid c\in\mathbb{N}\}$ is consistent, which will give C_r.

For the sake of contradiction, assume otherwise. By compactness, there exists $c\in\mathbb{N}$ such that $\mathsf{V}^{0}_{2}$ proves $\alpha^{c}_{\psi}$. As in the proof of Theorem 2, we show that this implies that $\mathsf{V}^{0}_{2}$ proves $\mathit{PHP}(r(x))$, which contradicts the Gem Theorem by (r4).

Argue in $\mathsf{V}^{0}_{2}$ and set $n:=\max\{|z|,2\}$, where $z=\langle x,r(x)\rangle$. Then $\alpha^{c}_{\psi}$ on $n$ gives a circuit $C$ such that, for all $u{\leqslant}z$ and $v{\leqslant}z$ with $\langle u,v\rangle{\leqslant}z$, we have

$$\neg C(\langle u,v\rangle)\leftrightarrow(v{\leqslant}r(u)\to\mathit{PHP}(v)).$$

Noting that $\langle x,v\rangle{\leqslant}z$ for all $v{\leqslant}r(x)$, fix $u$ to $x$ in the circuit $C(\langle u,v\rangle)$ and get a circuit $D(v)$ such that

$$\forall v{\leqslant}r(x)\ (\neg D(v)\leftrightarrow\mathit{PHP}(v)).$$

Recall that $\mathsf{V}^{0}_{2}$ proves that $\mathit{PHP}(x)$ is inductive. Hence, plugging $\neg D(v)$ for $\mathit{PHP}(v)$ gives $\mathit{PHP}(r(x))$ by quantifier-free $\mathsf{PV}(\alpha)$-induction. ∎

6 Magnification

For this section, a $\exists_{2}\Pi^{b}_{1}(\alpha)$-formula is a $\hat{\Sigma}^{1,b}_{1}$-formula as in (5) in which its maximal $\Sigma^{1,b}_{0}$-subformula $\varphi(\bar{X},Y,\bar{x})$ is a $\Pi^{b}_{1}(\alpha)$-formula.

Lemma 43.

For every $c\in\mathbb{N}$ and every $\exists_{2}\Pi^{b}_{1}(\alpha)$-formula $\psi(\bar{x},y)$ without free set variables, the theory $\mathsf{S}^{1}_{2}(\alpha)+\beta^{c}_{M_{0}}$ proves

$$\exists C\ \forall y{\leqslant}z\ \big{(}C(y){=}1\leftrightarrow\psi(\bar{x},y)\big{)}.$$ (14)

Proof.

Argue in $\mathsf{S}^{1}_{2}(\alpha)+\beta^{c}_{M_{0}}$. For simplicity assume $\bar{x}$ is empty. For $\psi=\psi(y)$ choose $M:=N_{\psi}$ according to Lemma 26. Note that since $\psi$ does not have free set variables, $M$ is without oracles. By Lemma 26.5, the formula $\psi(y)$ is equivalent to

$$\exists_{2}Y\textit{``$Y$ is an accepting computation of $M$ on $y$''}.$$

By Lemmas 30 and 29 we have $\alpha^{d}_{M}$ for some $d\in\mathbb{N}$. Let $z$ be given and choose $n\in\mathit{Log}_{>1}$ with $|z|\leqslant n$. Let $C$ witness $\alpha^{d}_{M}$ for $n$. This $C$ witnesses (14). ∎

It follows that over $\mathsf{S}^{1}_{2}(\alpha)$ the circuit upper bound statement $\beta^{c}_{M_{0}}$ implies comprehension for $\exists_{2}\Pi^{b}_{1}(\alpha)$-formulas without free set variables. For later reference, we note that allowing free set variables entails full $\hat{\Sigma}^{1,b}_{1}$-comprehension:

Lemma 44.

$\mathsf{S}^{1}_{2}(\alpha)+\exists_{2}\Pi^{b}_{1}(\alpha)$-comprehension proves $\mathsf{V}^{1}_{2}$.

Proof.

Let $\mathsf{T}$ denote $\mathsf{S}^{1}_{2}(\alpha)+\exists_{2}\Pi^{b}_{1}(\alpha)$-comprehension. Since $\mathsf{S}^{1}_{2}(\alpha)+\Sigma^{1,b}_{1}$-comprehension proves $\mathsf{V}^{1}_{2}$, it suffices to show that the set of formulas that are $\mathsf{T}$-provably equivalent to an $\exists_{2}\Pi^{b}_{1}(\alpha)$-formula is closed under $\vee$, $\wedge$, $\exists_{2}Y$, $\exists y{\leqslant}t(\bar{x})$ and $\forall y{\leqslant}t(\bar{x})$. We verify the latter: the formula

$$\forall y{\leqslant}u\ \exists_{2}Y\ \varphi(\bar{X},Y,\bar{x},u,y)$$

with $\varphi(\bar{X},Y,\bar{x},u,y)$ a $\Pi^{b}_{1}(\alpha)$-formula is $\mathsf{T}$-provably equivalent to

$$\exists_{2}Z\ \forall y{\leqslant}u\ \varphi(\bar{X},Z(y,\cdot),\bar{x},u,y),$$

where $Z(y,v)$ abbreviates the atomic formula $\langle y,v\rangle\in Z$. Indeed, assuming the former formula, the latter is proved by induction on $u$. As the latter is an $\exists_{2}\Pi^{b}_{1}(\alpha)$-formula, induction for it follows from comprehension. ∎

The following lemma makes precise the idea sketched in Section 1.3.

Lemma 45.

For every $c\in\mathbb{N}$ and every model $(M,\mathcal{X})$ of $S^{1}_{2}(\alpha)+\beta^{c}_{M_{0}}$, there exists $\mathcal{Y}\subseteq\mathcal{X}$ such that $(M,\mathcal{Y})$ is a model of $\mathsf{V}^{1}_{2}$.

Proof.

By $\Delta_{1}^{b}(\alpha)$-comprehension, for every $C\in M$ that is a circuit in the sense of $M$ there is a set $A\in\mathcal{X}$ such that

$$(M,\mathcal{X})\models\forall y\ (C(y){=}1\leftrightarrow y{\in}A).$$

By extensionality such a set $A$ is uniquely determined by $C$ and we write $\hat{C}$ for it. For these two claims we used the fact that $C(y){=}1\to y{<}2^{|C|}$ holds in every model of $\mathsf{S}^{1}_{2}$.

Let

$$\mathcal{Y}:=\big{\{}\hat{C}\in\mathcal{X}\mid C\in M\textit{ is a circuit in the sense of }M\big{\}}.$$

Since $\mathcal{Y}\subseteq\mathcal{X}$, the model $(M,\mathcal{Y})$ satisfies all $\Pi^{1,b}_{1}$-sentences which are true in $(M,\mathcal{X})$, so in particular extensionality, set boundedness, $\Sigma^{b}_{1}(\alpha)$-induction, and $\beta^{c}_{M_{0}}$.

The point of the model $(M,\mathcal{Y})$ is that it eliminates set parameters. More precisely, let $\varphi(\bar{x})$ be a $\Sigma^{1,b}_{\infty}$-formula with parameters from $(M,\mathcal{Y})$, and define $\varphi^{*}(\bar{x})$ as follows: replace every subformula of the form $t{\in}\hat{C}$ where $t$ is a term (possibly with number parameters from $M$) and $\hat{C}$ is a set parameter from $\mathcal{Y}$ by $C(t){=}1$ (i.e., by $\mathit{eval}(C,t){=}1$). Note every set parameter in $\varphi(\bar{x})$ becomes a number parameter in $\varphi^{*}(\bar{x})$, and

$$(M,\mathcal{Y})\models\forall\bar{x}\ (\varphi(\bar{x})\leftrightarrow\varphi^{*}(\bar{x})).$$ (15)

Claim: $(M,\mathcal{Y})\models\mathsf{S}^{1}_{2}(\alpha)$.

Proof of the Claim. It suffices to show that $(M,\mathcal{Y})$ models $\Delta^{b}_{1}(\alpha)$-comprehension. So let $\varphi(x)$ be a $\Delta^{b}_{1}(\alpha)$-formula with parameters from $(M,\mathcal{Y})$ and $a\in M$. Then $\varphi^{*}(x)$ is a number-sort formula, namely a $\Delta^{b}_{1}$-formula with (number) parameters from $M$. Since $M\models\mathsf{S}^{1}_{2}$, Buss’ witnessing theorem implies that $\varphi^{*}(x)$ is equivalent in $M$ to a quantifier-free $\mathsf{PV}$-formula with the same parameters. Lemma 14 applied to $n:=\max\{|a|,2\}$ gives a circuit $C$ in the sense of $M$ such that

$$M\models\forall x{<}2^{n}(C(x)=1\leftrightarrow\varphi^{*}(x)).$$

Then $\hat{C}\in\mathcal{Y}$ and $(M,\mathcal{Y})$ satisfies $\forall y{\leqslant}a(y\in\hat{C}\leftrightarrow\varphi(y))$ by (15). $\dashv$

By the Claim and Lemma 44, it suffices to show that $(M,\mathcal{Y})$ has $\exists_{2}\Pi^{b}_{1}(\alpha)$-comprehension. Let $\psi(x)$ be a $\exists_{2}\Pi^{b}_{1}(\alpha)$-formula with parameters from $(M,\mathcal{Y})$, and let $a\in M$. Then $\psi^{*}(x)$ is a $\exists_{2}\Pi^{b}_{1}(\alpha)$-formula without set parameters. We already noted that $(M,\mathcal{Y})\models\beta^{c}_{M_{0}}$. Hence, by the Claim, Lemma 43 applies and gives $C\in M$ such that

$$(M,\mathcal{Y})\models\forall x{\leqslant}a\,(C(x){=}1\leftrightarrow\psi^{*}(x)).$$

Then $\hat{C}\in\mathcal{Y}$ and $(M,\mathcal{Y})$ satisfies $\forall x{\leqslant}a\,(x{\in}\hat{C}\leftrightarrow\psi(x))$ by (15). ∎

As announced in Section 1.3 this lemma implies Theorems 10 and 11.

Proof of Theorem 10.

Assume that $\mathsf{T}$ is inconsistent with “$\mathsf{NEXP}\not\subseteq\mathsf{P/poly}$”. By compactness, $\mathsf{T}$ proves $\beta^{c}_{M_{0}}$ for some $c\in\mathbb{N}$. Let $\psi$ be a number sort consequence of $\mathsf{V}^{1}_{2}$ and $(M,\mathcal{X})$ a model of $\mathsf{T}$. We have to show that $M\models\psi$. But by Lemma 45 there exists $\mathcal{Y}\subseteq\mathcal{X}$ such that $(M,\mathcal{Y})\models\mathsf{V}^{1}_{2}$, so $(M,\mathcal{Y})\models\psi$, and $M\models\psi$. ∎

Proof of Theorem 11.

Assume $\mathsf{S}^{1}_{2}(\alpha)$ does not prove “$\mathsf{NEXP}\not\subseteq\mathsf{P/poly}$”, say, it does not prove $\neg\beta^{c}_{M_{0}}$. Then there is a model $(M,\mathcal{X})$ of $\mathsf{S}^{1}_{2}(\alpha)+\beta^{c}_{M_{0}}$. By Lemma 45 there exists $\mathcal{Y}\subseteq\mathcal{X}$ such that $(M,\mathcal{Y})\models\mathsf{V}^{1}_{2}$. Since $\beta^{c}_{M_{0}}$ is a $\Pi^{1,b}_{1}$-formula, we have $(M,\mathcal{Y})\models\beta^{c}_{M_{0}}$. Thus, $\mathsf{V}^{1}_{2}$ does not prove “$\mathsf{NEXP}\not\subseteq\mathsf{P/poly}$”. ∎

Remark 46.

The introduction mentioned that Theorem 11 might raise hopes to complete Razborov’s program by construcing a model of $\mathsf{S}^{1}_{2}(\alpha)$ satisfying some $\beta^{c}_{M_{0}}$. There are good general methods to construct models even of certain extensions of $\mathsf{T}^{1}_{2}(\alpha)$ based on forcing (see [35] and [25] for an extension). However, these methods are tailored for $\hat{\Sigma}_{1}^{1,b}(\alpha)$-statements, not $\Pi_{1}^{1,b}$ like $\beta^{c}_{M_{0}}$. By the method of feasible interpolation and assuming the existence of suitable pseudorandom generators, Razborov [33] proved that for every $\Sigma^{b}_{\infty}$-definable $t(n)=n^{\omega(1)}$ and every $\Sigma^{b}_{\infty}$-formula $\varphi(x)$ there exists a model $(M,\mathcal{X})$ of $\mathsf{S}^{2}_{2}(\alpha)$ that for some $n\in M$ contains a set $C\in\mathcal{X}$ coding a size-$t(n)$ circuit that computes $\varphi(x)$; i.e., for every $a<2^{n}$ there is $X_{a}\in\mathcal{X}$ coding a computation of $C$ on $a$ of the truth value of $\varphi(a)$. Getting a circuit (and computations) coded by a number seems to require new ideas.

The best currently known unprovability result is due to Pich [29, Corollary 6.2] and is conditional: a theory formalizing $\mathsf{NC}^{1}$-reasoning does not prove almost everywhere superpolynomial lower bounds for SAT unless subexponential-size formulas can approximate polynomial-size circuits. Reaching $\mathsf{S}^{1}_{2}$ seems to require new ideas.