On Reconstruction and Testing of Read-Once Formulas

An arithmetic read-once formula (ROF for short) is a formula (a circuit whose underlying graph is a tree) in which the operations are {+,×} and each input variable labels at most one leaf. A preprocessed ROF (PROF for short) is a ROF in which we are allowed to replace each variable xi with a univariate polynomial Ti(xi). We obtain a deterministic non-adaptive reconstruction algorithm for PROFs, that is, an algorithm that, given black-box access to a PROF, constructs a PROF computing the same polynomial. The running time of the algorithm is (nd)O(logn) for PROFs of individual degrees at most d. To the best of our knowledge our results give the first subexponential-time deterministic reconstruction algorithms for ROFs. Another question that we study is the following generalization of the polynomial identity testing (PIT) problem. Given an arithmetic circuit computing a polynomial P(x̄), decide whether there is a PROF computing P(x̄), and find one if one exists. We call this question the read-once testing problem (ROT for short). Previous (randomized) algorithms for reconstruction of ROFs imply that there exists a randomized algorithm for the ROT problem. An extended abstract appeared in the Proceedings of the 40th Annual Symposium on Theory of Computing (STOC 2008), pages 507-516 [40]. ∗Research supported by the Israel Science Foundation (grant number 339/10) and the European Community’s Seventh Framework Programme (FP7/2007-2013) under grant agreement number 257575. ACM Classification: F.2.2 AMS Classification: 68Q25

In this work we show that most previous PIT algorithms be strengthened to yield algorithms for the ROT problem.In particular we give ROT algorithms for the following circuit classes: depth-2 circuits (circuits computing sparse polynomials), depth-3 circuits with bounded top fan-in, and sum of k ROFs.The running time of the ROT algorithm is essentially the same as the running time of the corresponding PIT algorithm for the class.
The main tool in most of our results is a new connection between PIT and reconstruction of ROFs.Namely, we show that in any model that satisfies some "nice" closure properties (for example, a partial derivative of a polynomial computed by a circuit in the model, can also be computed by a circuit in the model) and that has an efficient deterministic polynomial identity testing algorithm, we can also answer the read-once testing problem.

Introduction
Let F be a field and C a class of arithmetic circuits.The reconstruction problem for the class C is defined as follows.Given black-box (i.e., oracle) access to a polynomial P ∈ F[x 1 , x 2 , . . ., x n ], computable by an arithmetic circuit from the class C, construct a circuit C ∈ C that computes P. A reconstruction algorithm is efficient if the number of queries it makes to the polynomial and its running time are polynomial in the size of the representation of P in the class C. The reconstruction problem can be considered as the algebraic analog of the learning problem.A special case of the problem is the interpolation problem, where the goal is to find the monomial representation of the circuit.This can be seen to be the reconstruction problem when C is the class of depth-2 circuits (see, e. g., [29]).
The reconstruction problem is tightly connected to the Polynomial Identity Testing (PIT for short) problem, in which we need to determine whether a given arithmetic circuit C( x) computes the zero1 polynomial.There are two common models for studying the PIT problem.In the white-box model the algorithm is given access to the circuit itself.In particular, the algorithm can take into account the underlying graph of the circuit, etc.In the black-box model, the algorithm is not given access to the circuit and instead it can only query the value of the circuit on different inputs.Thus, a deterministic black-box PIT algorithm for a circuit class C has to compute a hitting-set for that class, that is, a set of points H such that if a circuit from C evaluates to zero over H then it must compute the zero polynomial.Note that if F is a small field, e. g., F = F 2 , then a hitting set does not necessarily exist.Indeed, over F 2 we have that x2 = x, but they are not equal as polynomials.Thus, to construct a hitting set we may need to use inputs from a polynomially large extension field.One of the main properties of a hitting set H is that the values of any circuit from C on H describe the polynomial computed by that circuit uniquely, in the sense that two circuits that agree on H must compute the same polynomial since their difference 2  evaluates to zero over H. Yet, such a set does not provide us with an efficient algorithm for reconstructing circuits from C. On the other hand, it is easy to see that a deterministic reconstruction algorithm can be used as a black-box PIT algorithm.For more information on the reconstruction problem and on PIT we refer the reader to the survey [44].
Several works have shown that efficient deterministic PIT algorithms imply lower bounds for arithmetic circuits [19,21,1].Thus, the deterministic reconstruction problem is at least as hard as proving circuit lower bounds.In view of the difficulty of the problem for general arithmetic circuits, research focused on restricted models such as: sparse polynomials [29], depth-3 circuits with bounded top fanin [39,24], non-commutative formulas [6,28] and multilinear depth-4 circuits with top fan-in 2 [17].The motivation to study restricted models is two fold.One reason is that many restricted models are interesting by themselves.Another reason is that we hope to gain insight from restricted models for the general problem.
The focus of this paper is on models related to arithmetic read-once formulas.An arithmetic read-once formula (ROF for short) is a formula (a circuit in which the fan-out of every gate is at most 1) in which the operations are {+, ×} and such that every input variable labels at most one leaf.A preprocessed ROF (PROF for short) is a ROF in which we are allowed to replace each variable x i with a univariate polynomial T i (x i ).Although read-once formulas form a very restricted model of computation, they received a lot of attention in both the Boolean and the algebraic models.Over the Boolean domain, [22,4,11] gave efficient learning algorithms for several classes of Boolean read-once formulas.In the algebraic model, [18,10,8,9] gave efficient randomized reconstruction algorithms for ROFs.However, prior to this work, no deterministic sub-exponential time reconstruction algorithm for ROFs was known.This state of affairs implies that if we want to give efficient deterministic algorithms for bounded-depth multilinear circuits or for multilinear formulas then we should first try to find such algorithms for ROFs.In view of this, we focus in this work on ROFs and, as a result, give the first deterministic sub-exponential time reconstruction algorithm for PROFs.

Our results
Our results require that the underlying field is of polynomial size.In case that |F| is too small we make queries to a polynomial-sized extension field.This is common to many (all) PIT algorithms, see discussions in [29,44].The running time of our algorithms is polynomial in log |F| when F is finite, and is polynomial in the bit-size of the field elements appearing in the formula, for general fields.We now state our results formally.

Reconstruction of preprocessed read-once formulas
Theorem 1.1.There is a deterministic (nd) O(log n) time algorithm that given black-box access to a PROF Φ, on n variables and individual degrees (of the preprocessing) at most d, over a field F, reconstructs Φ, i. e., it constructs a PROF that computes the same polynomial.If |F| ≤ n 2 d then the algorithm may make queries from an extension field of F of size larger than n 2 d.
Moreover, there is an algorithm that performs this task in a non-adaptive manner, that is, when each query to the black-box is independent of the results of the previous ones, with roughly the same running time.
Theorem 1.2.There is a deterministic (nd) O(log n) time algorithm that given black-box access to a PROF Φ, on n variables and individual degrees (of the preprocessing) at most d, over a field F, reconstructs Φ.Moreover, the algorithm queries Φ on a fixed set of points of size (nd) O(log n) .If |F| ≤ n 3 d then the algorithm may make queries from an extension field of F of size larger than n 3 d.
We also re-establish the result of [10] that gives a randomized polynomial-time reconstruction algorithm for ROFs.In fact, we show that a similar approach will work for PROFs as well.
Theorem 1.3.There is a polynomial-time randomized algorithm that given black-box access to a PROF Φ, on n variable and individual degrees (of the preprocessing) at most d, reconstructs Φ with high probability.If |F| ≤ 4n 2 d then the algorithm may make queries from an extension field of F of size larger than 4n 2 d.

Read-once testing
In addition to reconstruction of preprocessed read-once formulas we are also interested in a generalization of the problem that we call the read-once testing problem (ROT for short). 3roblem 1.4 (ROT).Given a circuit C (maybe as a black-box) computing some polynomial P( x), decide whether P can be computed by a PROF, and if the answer is positive then compute a PROF for it.
Similarly to the PIT problem, there is an efficient randomized algorithm for the ROT problem.Indeed, by the results of [10] (or Theorem 1.3), there is a randomized algorithm for reconstructing a given black-box ROF.Thus, given access to the circuit C we can run the reconstruction algorithm to get a candidate PROF and then, invoking the Schwartz-Zippel randomized identity testing algorithm [46,38], we can check whether the ROF that we computed earlier, computes the same polynomial as the one in the black-box.This results in a two-sided error algorithm.A simpler, one-sided error algorithm follows for the recent result of [45], which provides a characterization of polynomials computed by ROFs.
The main question is then whether we can find an efficient deterministic algorithm for the ROT problem.Clearly, this is a generalization of the PIT problem, as the zero polynomial is computable by a ROF.We show that if we are given an efficient deterministic PIT algorithm for a circuit class C, that satisfies some "nice" closure properties, then we can also solve the ROT problem for that class efficiently.Moreover, the reduction works both in the black-box and in the white-box models, depending on the PIT algorithm at hand.
An argument similar to the above one shows that an efficient randomized reconstruction algorithm for a circuit class C implies an efficient randomized algorithm for the corresponding "C-testing" problem (i.e., checking whether a given arithmetic circuit can be implemented within the class C).Yet, no such connection is known in the deterministic setting.For example deterministic "sparsity-testing" (i.e., determining whether a given circuit C computes a sparse polynomial) is a long standing open question posed by von zur Gathen (see, e. g., [15]).
Our main result for ROT is given in the following theorem.where the C i 's are circuits from L(C) and C 2 , C 3 and C 4 are pairwise variable disjoint.Suppose that there is a deterministic PIT algorithm A that runs in time T (n, d, s), when given access (white-box or black-box) to a circuit in n-variables, of size s and degree d, that belongs to C V .Then, there is a deterministic algorithm B, that uses A as a subroutine, such that when given access (white-box or black-box) to an n-variate circuit of size s and degree d from C, solves the ROT problem in time poly(n, d, s, T (n, d, s)).If |F| ≤ nd then the algorithm may make queries from an extension field of size > nd.Similarly, if the given PIT algorithm puts an additional requirement on the size of the field (a lower bound) then we allow our algorithm to make queries from an appropriate extension field of F.
Note that C 1 may share variables with C 2 ,C 3 and C 4 .The requirement that we have a PIT for the class C V may seem odd at first, but it is explained by the way our algorithm works: it first constructs a candidate ROF and then makes several tests of the form C 1 ?= C 2 +C 3 ×C 4 , thinking of C 2 ,C 3 and C 4 as "disjoint parts" of a ROF C 1 , which is a restriction of the ROF that we constructed at the first step.For more details see the discussion in Section 6.2.
We note that for most of the circuit classes C for which we have efficient deterministic PIT algorithms, we also have such algorithms for their "closure," C V .As a corollary we get that all previous PIT algorithms can be generalized to yield algorithms for ROT.We demonstrate this point in the next theorem.
Theorem 1.6.Let F be a multilinear read-k formula (i.e., a multilinear formula in which each variable appears at most k times) over F[x 1 , x 2 , . . ., x n ].Then: • There is a deterministic algorithm that given white-box access to F solves the ROT problem for F in time n k O(k) .
• There is a deterministic algorithm that given black-box access to F solves the ROT problem for F in time n k O(k) +O(k log n) .
If |F| ≤ n 2 then the algorithm may make queries from an extension field of F of size larger than n 2 .
This result generalizes both the black-box and the white-box PIT algorithms for multilinear read-k formulas of [3].
Our next result strengthens many reconstruction algorithms that were obtained for the model of sparse polynomials ( [7,16,29] to name just a few).The result uses the black-box PIT algorithm for sparse polynomials of [29], yet any of the above algorithms can be used instead.As was communicated to us by Lisa Hellerstein [20], for the case where P is a multilinear polynomial a similar result was proved in [30].
Theorem 1.7.There is a deterministic polynomial time algorithm that given black-box access to an nvariate polynomial P, of degree d with m monomials (i.e., a polynomial computed by a depth-2 arithmetic circuit with m multiplication gates), solves the ROT problem for P. The running time of the algorithm is a polynomial in n, m and d.If |F| ≤ (nd) 6 then the algorithm may make queries from an extension field of F of size larger than (nd) 6 .
Our next result solves the ROT problem for depth-3 and depth-4 circuits, with bounded top fan-in (see formal definition in Sections 7.2 and 7.3).It generalizes the results of [12,27,26,25,33,36] and others, who gave deterministic PIT algorithms for these models.The theorem uses the black-box PIT algorithm for ΣΠΣ(k) circuits of [36].
Theorem 1.8.There is a deterministic algorithm that given black-box access to a depth-3 circuit C, of top fan-in k (i.e., a ΣΠΣ(k) circuit), solves the ROT problem for the polynomial computed by the circuit.The running time of the algorithm is poly , where n is the number of variables and d is the degree of the circuit.If |F| ≤ dnk 2 then the algorithm may make queries from an extension field of F of size larger than dnk 2 .
Our next result uses the black-box PIT algorithm for multilinear ΣΠΣΠ(k) circuits of [33] and obtains ROT algorithms for this class.Theorem 1.9.There is a deterministic algorithm that given black-box access to a multilinear depth-4 circuit C, of top fan-in k (i.e., a ΣΠΣΠ(k) circuit), solves the ROT problem.The running time of the algorithm is (ns) O(k 6 ) , where n is the number of variables and s is the size of the circuit.If |F| ≤ n 2 then the algorithm may make queries from an extension field of F of size larger than n 2 .
We can also extend our results to hold for non-commutative formulas, for which [32] gave a polynomial time white-box PIT algorithm and [14,13] gave quasi-polynomial time black-box PIT algorithms.However, extending our results to the non-commutative case requires redoing many steps of the algorithm, without introducing any new ideas, and so we omit the proof.We nevertheless write some algorithms in a way that allows one to apply them in non-commutative models as well (by making sure we do not change the order of left and right children of a multiplication gate, etc.).

Related work
Read-once arithmetic formulas were studied before in the context of learning theory and exact learning algorithms were devised for them.We shall now discuss the different models in which it was studied and highlight the differences from our work.
In [18] algorithms for learning ROFs, that use membership and equivalence queries, were given.A membership query to a ROF Φ( x) is simply a query that asks for the value of Φ( x) on a specific input.An equivalence query on the other hand, gives the oracle4 a certain hypothesis, h( x), and the oracle either answers "equal" if Φ ≡ h or returns an input ᾱ such that Φ( ᾱ) = h( ᾱ).In this language, our results use only membership queries.
In [10] a different approach was taken.They considered randomized learning algorithms that only use membership queries.It is not difficult to see that using randomness one does not need to use equivalence queries.The learning algorithm of [10] can reconstruct, with high probability, ROFs that also use division gates (and not just +, × gates).They also considered a model in which justifying assignments (a notion that we later define and use) are given in advance to the algorithm.This result was later generalized in [8] who gave a randomized reconstruction algorithm for ROFs that use addition, multiplication, division and exponentiation gates.
In this work we give deterministic reconstruction algorithms, introduce the ROT problem, show the relation between PIT and ROT and, as a result, obtain several deterministic ROT algorithms.Our reconstruction algorithms diverge from previous work in that our algorithms are deterministic, we do not need to use randomness at all. 5 We also study the more general problem of ROT.To the best of our knowledge, this is the first time that ROT is studied.The main difference between the reconstruction problem and the ROT problem is that in the reconstruction setting we are guaranteed that there exists a PROF for the given circuit, whereas in the ROT problem we first have to check whether the polynomial can be computed by a PROF and only then we can try and find such a formula.The first step is the main difficulty in designing ROT algorithms.
Finally, we discuss the relation to our previous papers [40,41].The core ideas behind this work appeared as an extended abstract in [40].There, the ROT problem was formally introduced and shown to be computationally equivalent to the PIT problem.That is, it was shown that a circuit class C, satisfying some closure properties, has an efficient deterministic ROT algorithm if and only if it has an efficient deterministic PIT algorithm.That paper also gave the first deterministic sub-exponential time PIT algorithm for sum of ROFs.Later, in [41], a more efficient deterministic PIT algorithm for sum of ROFs was obtained.That work also extended our previous results to PROFs.In conclusion, the basic ideas behind our reconstruction and ROT algorithms come from the paper [40], and the improved PIT algorithm of [41] is only used to improve the running time of the algorithms (in the black-box model).
In this paper we only consider reconstruction and testing of PROFs.We defer our results concerning PIT algorithms to another paper ([43]6 ) to make this work more focused.

Techniques
To explain our approach we first need the notion of the gate-graph of a ROF.This is a graph on the set of variables, in which two variables are connected if and only if their first common ancestor gate is a multiplication gate (see Definition 3.3).
Our reconstruction algorithms use, at a high level, the gate-by-gate reconstruction technique of [18,10].The idea is to first first learn the gate-graph of the ROF.Once we have the gate-graph, we can learn the top gate of the formula by, roughly, checking whether the graph is connected or disconnected.We can thus reconstruct the tree of the formula recursively.In the process we also learn the "fine details," namely, we reconstruct the constants in the circuit.For reconstructing PROFs, we first learn the underlying preprocessing and then proceed with the reconstruction algorithm for the underlying ROF.
Compared to the techniques of [18,10] our algorithm does not require the ability to compute square roots of field elements, which is assumed to be the case in [10].The algorithm of [10] used randomness to gain access to so called justifying assignments.Instead, we use PIT algorithms for ROF in order to deterministically compute justifying assignments.Furthermore, we introduce some new ingredients that allow us to extend the algorithm to the case of PROFs.
The second part of the paper is devoted to the ROT problem with the main idea being "Doveryai, no Proveryai." 7Given (white-box or black-box) access to an input circuit C, we first apply our reconstruction algorithm and construct a PROF Φ, that supposedly computes the same polynomial as C. Recall that our reconstruction algorithm works in the black-box model so we can pretend that C is a PROF and run the algorithm on C. If the algorithm fails then we know that the polynomial computed by C cannot be computed by a PROF.However, if the reconstruction does not fail then we are not done yet.At this point we have a PROF Φ and we have to test whether C ≡ Φ.We do so by going over Φ gate-by-gate, mimicking the reconstruction algorithm.Since we know Φ, we can set variables to constants and obtain access to sub-formulas of Φ. Making appropriate queries to the circuit C, we can compare the restricted Φ and the restricted C. We can thus check if "locally" C and Φ agree.It is at this point that we need access to a PIT algorithm for circuits of the form C 1 +C 2 +C 3 ×C 4 as in Theorem 1.5.A more detailed explanation of the verification procedure is given in Section 6.2.

Subsequent work
Recently, in [45] a simple characterization of polynomials computable by ROFs was given.Those polynomials are refereed to as read-once polynomials (ROP for short), see Definition 3.1.Roughly speaking, it is shown that a polynomial P is a ROP if and only if all its restrictions to three variables are ROPs.In other words, a polynomial P can be computed by a ROF if and only if it can be "locally" computed by ROFs.This result is obtained by borrowing and extending several techniques from the current paper.

Organization
The paper is organized as follows.In Sections 2 and 3 we give the basic definitions and notation.In Section 4 we give some basic algorithms for ROFs.Then, in Section 5 we prove Theorems 1.1, 1.2 and 1.3.Next, in Section 6 we show how to convert efficient deterministic PIT algorithms to efficient deterministic ROT algorithms and prove Theorem 1.5.We conclude the paper (Section 7) by showing some corollaries of Theorem 1.5, thus proving Theorems 1.6, 1.7, 1.8 and 1.9.

Preliminaries
For a positive integer n we denote [n] = {1, . . ., n}.Given a graph G = (V, E) we denote with G c the complement graph.
For a polynomial P(x 1 , . . ., x n ), a variable x i and a field element α we denote with P| x i =α the polynomial resulting from setting x i = α.We say that P depends on x i if there exist assignments ā, b ∈ F n , which differ only on the i-th coordinate, such that P( ā) = P( b).We denote var(P) {x i | P depends on x i } .
Given a subset I ⊆ [n] we say that P is defined on I if var(P) ⊆ I. Intuitively, P depends on x i if x i "appears" when P is listed as a sum of monomials.On the other hand, a constant function P ≡ c is defined on every subset of [n].
Definition 2.1.Given a subset I ⊆ [n] and an assignment ā ∈ F n we define P| x I = āI to be the polynomial resulting from substituting a i to x i , for every i ∈ I.In particular P| x I = āI is defined on [n] \ I.
Observation 2.2.Let J ⊆ I ⊆ var(P) be subsets of var(P).Then for every assignment ā ∈ F n it must be the case that var(P| Note that by substituting a value to a variable of P we, obviously, eliminate the dependence of P on that variable.This, however, may also eliminate the dependence of P on other variables and thus lose more information than intended.When we wish to reconstruct a formula, we cannot allow losing any information as it would affect our final answer.We now define a "lossless" type of an assignment.Similar definitions were given in [18] and [10], but we repeat the definitions here to ease the reading of the paper (we also slightly change some of the definitions).
THEORY OF COMPUTING, Volume 10 (18), 2014, pp.465-514 Definition 2.3 (Justifying assignment).We say that an assignment ā ∈ F n is a justifying assignment for a polynomial P if for every subset I ⊆ var(P) we have that var(P| x I = āI ) = var(P) \ I . (2.1) We say that a polynomial P is ā-justified if ā is a justifying assignment for P. A set J ⊆ F n is called a justifying set for a circuit class C, if it contains a justifying assignment for every polynomial P computed by a circuit from C.
The next proposition shows that in order to verify whether P is ā-justified it is enough to consider only subsets I of size |var(P)| − 1, rather than all subsets of var(P).Proof.Let J ⊆ var(P).If J = var(P) then, obviously, var(P| x J = āJ ) = / 0 = var(P) \ J. Otherwise, let x ∈ var(P) \ J. Consider the set I = var(P) \ {x}.From the definition: |I| = |var(P)| − 1 and J ⊆ I, and thus (2.1) holds for I. Combining with Observation 2.2 we obtain that Hence, x ∈ var(P| x J = āJ ).As this holds for every x ∈ var(P) \ J, it follows that var(P) \ J ⊆ var(P| x J = āJ ), and hence the two sets are equal.The second direction of the claim is trivial.
For convenience we will concentrate on 0-justified polynomials.The following lemma shows that, in a sense, we can do so w.l. o. g.Lemma 2.5.Let ā ∈ F n and let P( x) be an ā-justified polynomial.Then is a 0-justified polynomial.In addition, P( x + ā) ≡ 0 if and only if P( x) ≡ 0. Definition 2.6 ( 0-justified closure).We denote var 0 (P) That is, var 0 (P) is the maximal set of variables such that P is 0-justified with respect to this set.Clearly, var 0 (P) ⊆ var(P) and equality holds iff P is 0-justified.Lemma 2.7.A polynomial P is 0-justified iff var(P) = var 0 (P).
The Hamming weight of a vector ā ∈ F n is defined as: wt( ā) |{i | a i = 0 }|.That is, the number of non-zero coordinates.Definition 2.8.For a set 0 ∈ W ⊆ F and k ≤ t we define A t k (W ) to be the set of all vectors in W t with Hamming weight at most k.
An immediate conclusion from the definition is that for a finite set W (that contains 0), it holds that

Partial derivatives
The concept of a partial derivative of a multivariate function and its properties (for example, P depends on x i if and only if ∂ P ∂ x i ≡ 0) are well-known and well-studied for continuous domains (such as, R, C etc.).This concept can be extended to polynomials over arbitrary fields, by defining the discrete partial derivative.Discrete partial derivatives play an important role in the analysis of our algorithms.Definition 2.9.Let P ∈ F[x 1 , x 2 , . . ., x n ] be a polynomial.We define the discrete partial derivative of P, with respect to x i , as Notice that if P is a multilinear polynomial then this definition coincides with the formal definition for polynomials.The following lemma is easy to verify.Lemma 2.10.The following properties hold for a multilinear polynomial P: • P depends on x i if and only if • ā ∈ F n is a justifying assignment for P if and only if for every i ∈ var(P) it holds that Since the above properties trivially hold, we shall use them implicitly throughout the paper.We note that these basic properties do not hold for non-multilinear polynomials.For example, when P(x) = x 2 − x we get that ∂ P ∂ x ≡ 0. Thus, to handle general polynomial we need the following extension.Definition 2.11.Let P ∈ F[x 1 , x 2 , . . ., x n ] be a polynomial.The directed partial derivative of P, with respect to x i and direction α ∈ F, is defined as Definition 2.12.For a non-empty subset I ⊆ [n], I = i 1 , . . ., i |I| , we define the iterated partial derivative with respect to I in the following way:

Commutator
We now formally introduce one of our main reconstruction tools.Previously it was defined and used in [42] for the purpose of polynomial factorization.Here we define a simpler, "multilinear" version of the commutator since we are only going to apply it to multilinear polynomials.It is not hard to see that both our definition and the commutator of [42] have the same properties when restricted to multilinear polynomials.
Definition 2.13.Let P ∈ F[x 1 , x 2 , . . ., x n ] be a polynomial and let i, j ∈ [n].We define the commutator between x i and x j as We say that P is (x i , x j )separated mod c if P can be written as P = h•g+c, where x i ∈ var(h)\var(g) and x j ∈ var(g)\var(h).We say that P is (x i , x j )-separated mod F if there exists a field element c ∈ F such that P is (x i , x j )-separated mod c.
We next show that the commutator actually tells us whether a polynomial is separated or not.
Lemma 2.15 (Lemma 4.6 of [42]).Let P ∈ F[x 1 , x 2 , . . ., x n ] be a multilinear polynomial and let x i = x j ∈ var(P).Then P is (x i , x j )-separated mod 0 if and only if ∆ i j P ≡ 0.
The next observation follows from the definition of the commutator.
Observation 2.16.Let P, R ∈ F[x 1 , x 2 , . . ., x n ] be multilinear polynomials with x i , x j ∈ var(R).Then The following is an immediate corollary of Lemma 2.15 and Observation 2.16, which extends Lemma 2.15.
Corollary 2.17.Let P ∈ F[x 1 , x 2 , . . ., x n ] be a multilinear polynomial and let x i = x j ∈ var(P).Let c ∈ F be a field element.Then P is (x i , x j )-separated mod c if and only if

Polynomials and circuit classes
We shall associate with a circuit class C the set of polynomials that can be computed by circuits from C.
The following notation will be useful for us.
1. We say that the circuit class C contains the polynomial P if P can be computed by some circuit C from C. We denote it by P ∈ C.
2. We say that the circuit class C 1 contains the circuit class C 2 if it contains all its polynomials (i.e., 3. For a circuit class C we define the (discrete) directed partial derivatives of C as:

Our model
In this section we discuss our computational model.We first consider the basic model of ROFs and cover some of its main properties.Then, we introduce the model of PROFs and give the corresponding basic properties.

ROFs and ROPs
Most of the definitions that we give in this section, or small variants of them, are from [18].We start by formally defining the notions of a ROF and a ROP.
Definition 3.1.An arithmetic read-once formula (ROF for short) Φ, in the variables x = (x 1 , . . ., x n ), over a field F, is a binary tree whose leafs are labelled with the input variables and whose internal nodes are labelled with the arithmetic operations {+, ×} and with a pair of field elements8 (α, β ) ∈ F 2 .Each input variable can label at most one leaf.The computation is performed in the following way.A leaf labelled with the variable x i and with (α, β ) computes the polynomial α • x i + β .If a node v is labelled with the operation op ∈ {+, ×} and with (α, β ), and its children compute the polynomials We say that a ROF Φ is non-degenerate if the polynomial that it computes depends on all the variables appearing in it Φ.For the sake of completeness, we denote the non-degenerate ROF computing the constant field element β by the special CONST gate CN β .
A polynomial P( x) is a read-once polynomial (ROP for short) if it can be computed by a ROF.Clearly, ROPs are a subclass of multilinear polynomials.

The gate-graph of ROFs and ROPs
In this section we define the important notion of gate-graph of a ROF and a ROP.A similar notion was defined in [18], but here we define it in a slightly more general form.
Given a graph of computation of a ROF it is natural to define the first common gate of a subset of gates.A similar notion was presented in [10].Definition 3.2.Let V ⊆ var(Φ), |V | ≥ 2, be a subset of the input variables of a ROF Φ.We define the first common gate of V , fcg(V ), to be the first gate in the graph of computation of Φ common to all the paths from the inputs of V to the root of the formula.
We note that fcg(V ) is in fact the least common ancestor of the nodes in V when viewing the formula as a tree.We now define, for every ROF, several new graphs that are related to it.The notion of a t-graph of a ROF (where t is a type of a gate) was introduced and studied in [18] for various types of gates (such as threshold gates, modular gate, division gates etc.).We shall focus on + and × gates as these are the only gates appearing in our ROFs.We now give a definition of a t-graph that is slightly different from the one in [18].Definition 3.3 (t-graph).Let Φ be a ROF in the input variables var(Φ).Let t ∈ {+, ×} be a possible label of an internal node.The t-graph of the formula Φ, denoted G t Φ , is an undirected graph whose vertex set is var(Φ) and whose edges are defined as follows: (i, j) is an edge if and only if the arithmetic operation that labels the gate fcg(x i , x j ) is t.
The following simple lemma (whose basic form can be found in [18]) gives some basic properties of t-graphs.We omit the proof as it is implicit in the proof of Lemma 3 in [18].
Lemma 3.4.The following properties are satisfied by t-graphs.
1. Let P be a ROP and let Φ and Ψ be two non-degenerate ROFs computing P.
In particular, the graphs G × P G × Φ and G + P G + Φ are well defined.Consequently, the t-graph of a ROP is a well defined notion.

For every ROP P we have G
. That is, the addition and the multiplication graphs of each ROP P are simply complements to each other.
3. For every ROP P exactly one of G × P and G + P is connected.More precisely, the type of the top gate of P is t if and only if G t P is connected.We define the gate-graph of a ROF Φ as G Φ G × Φ .Similarly, we define G P to be the gate-graph of a ROP P. Lemma 3.5.Let P be a ROP.Then (i, j) is an edge in the gate-graph G P if and only if x i • x j appears in some monomial of P.Moreover, if I is a clique in G P then there is some monomial in P containing ∏ i∈I x i .
Proof.The first part is immediate from the definition.The second part is easily proved by induction on |I|.
The following is an algebraic version of the above lemma.It also provides a more algebraic definition of the gate-graph of a ROP P. The proof is similar to the proof of Lemma 3.5.Lemma 3.6.Let P(x 1 , . . ., x n ) be a ROP.Then (i, j) is an edge in the gate-graph G P if and only if Moreover, for I ⊆ [n] we have that ∂ I P ≡ 0 if and only if I is a clique in G P .
Indeed, form Lemmas 3.4 and 3.5 we get that both the +-graph and the ×-graph are connected for this polynomial.From Lemma 3.4 we get that P is not a ROP.
Example 3.8.For every n ≥ 3, the polynomial x i x j is not a ROP.Indeed, notice that G P is complete graph (a clique) while ∂ [n] P ≡ 0. Lemma 3.6 implies that P is not a ROP.
The following lemma is also an easy corollary of Lemma 3.4.
Lemma 3.9 (ROP Structural Lemma).Every ROP P( x) with |var(P)| ≥ 2 can be presented in exactly one of the following two forms: where P 1 and P 2 are non-constant variable disjoint ROPs and c is a constant.
We end this section by providing two more useful properties related to partial derivatives of ROPs.
Lemma 3.10.A partial derivative of a ROP is a ROP.Moreover, a partial derivative of a 0-justified ROP is also a 0-justified ROP.
The proof is very similar to the proof of Lemma 5.12 in [43].For completeness we give it in Appendix A. Lemma 3.11.Let P be a 0-justified ROP.Then Proof.By Lemma 3.10, ∂ P ∂ x i is a 0-justified ROP.Consequently, by the definition,

Factors of ROPs
In this section we study properties of factors of ROPs.We start by proving that every factor of a ROP is also a ROP.Although this is an easy claim to prove, our proof has the advantage that it can be used to devise a linear-time factorization algorithm for ROFs in the white-box model (see Algorithm 1 in Section 4.2.1).
Lemma 3.12.Every factor of a ROP is a ROP. Proof.
x) be a reducible ROP, where h 1 and h 2 are (not necessarily irreducible) non-constant factors.In particular, |var(P)| ≥ 2. According to Lemma 3.9 P has exactly one of the following two forms: 1. P( x) = P 1 ( x) + P 2 ( x).Notice that h 1 and h 2 are variable disjoint.Consequently, we can assume w. l. o. g. that there exist x i , x j such that x i ∈ var(h 1 ) ∩ var(P 1 ) and x j ∈ var(h 2 ) ∩ var(P 2 ).Otherwise all the variables of P will be in the same factor.Now, by considering ∂ 2 P ∂ x i ∂ x j we obtain on the one hand since P 1 and P 2 are variable-disjoint.On the other hand As ∂ h 1 ∂ x i and ∂ h 2 ∂ x j are non-zero, we get a contradiction.2. P( x) = P 1 ( x) • P 2 ( x) + c.As previously, we can assume w. l. o. g. that there exist x i , x j such that x i ∈ var(h 1 ) ∩ var(P 1 ) and x j ∈ var(h 2 ) ∩ var(P 2 ).This time we consider ∆ i j P. On the one hand ∆ i j P = ∆ i j (h 1 • h 2 ) ≡ 0. On the other hand, by Observation 2.16, This implies that c = 0.It follows that P 1 and P 2 are factors of P and that P 1 and P 2 are ROPs.A simple induction completes the proof.
As a corollary of the proof we deduce the following observation.

Commutators of ROPs
In general, a commutator ∆ i j P of a polynomial P may be a more complicated polynomial than the original P. In this section we show that a commutator of a ROP has a nice structure.For our future purposes we consider the commutator between two variables x i , x j for which Lemma 3.14.Let P( x) ∈ F[x 1 , x 2 , . . ., x n ] be a ROP and let i = j ∈ var(P) be such that Then there exist variable disjoint ROPs H( x) and R( x, y) such that: Proof.Let Φ be a ROF for P and let v = fcg(x i , x j ) in Φ.Take R ( x, y) to be the ROP computed by Φ when we replace the subtree rooted at v with a new variable y, and let H be the ROP computed by Φ v .We can write P( x) = R ( x, H ( x)).As v is a multiplication gate (by Lemma 3.6), Lemma 3.9 implies that H is of the form , where x i ∈ var(h 1 ) and x j ∈ var(h 2 ).Define Observe that ) and that H is (x i , x j )-separated mod 0. This proves items 1 and 3 of the claim.For the remaining item, observe that we can write R( x, y) = R y ( x) • y + R 0 ( x), where By Observation 2.16 and the chain rule: Unlike the partial derivative operator (see Lemma 3.10) the commutator does not preserve the property of being a 0-justified ROP.We show, however, that to some extent, the assignment 0 remains interesting when considering commutators of 0-justified ROPs.Specifically, it acts nicely on the ROP R( x, y) that was constructed in Lemma 3.14.
Then there exists k THEORY OF COMPUTING, Volume 10 (18), 2014, pp.465-514 Proof.By induction on n.Let n = 1.Clearly, k = 1.Since R is a multilinear polynomial we get that in this case Now suppose that n ≥ 2. By Lemma 3.9, R can be presented in one of the following forms: As y ∈ var(R 2 ).We have that: , where c ∈ F. We have two subcases to consider.
Case 2a: There exists x j ∈ var(R 1 ) such that ∂ R 1 ∂ x j ( x, 0) ≡ 0. In particular, |var(R 1 ) \ {y}| ≥ 1.For each x i ∈ var(R 1 ) we have that: Consequently, we can apply the induction hypothesis to R 1 and get that there exists To finish the proof of this case, observe that Case 2b: For each x j ∈ var(R 1 ) we have that Taking k = completes the proof.
THEORY OF COMPUTING, Volume 10 (18), 2014, pp.465-514 We can now show that in a 0-justified ROP the 0 assignment can, in some sense, preserve the separation property.Lemma 3.16.Let P ∈ F[x 1 , x 2 , . . ., x n ] be a 0-justified ROP with |var(P)| ≥ 3 and x i = x j ∈ var(P).Then, P is (x i , x j )-separated mod F iff for every k ∈ var(P) \ x i , x j it holds that Proof.We begin by noting that since var P| x [n]\{i, j,k} = 0[n]\{i, j,k} = x i , x j , x k , the first direction of the claim immediately follows.For the other direction, observe that Therefore, we can apply Lemma 3.14 to obtain ROPs H( x) and R( x, y) such that and Now, assume for a contradiction that P is not (x i , x j )-separated mod F. We would like to apply Lemma 3.15 to reach a contradiction.We first show that R( x, y) satisfies the condition of that lemma.Note that R( x, 0) must be a non-constant polynomial.Indeed, if it was constant then we would get that in contradiction to Corollary 2.17.Thus, there exists x ∈ var(R) such that Let x m ∈ var(R).As P is 0-justified, we have that We have thus shown that R satisfies the conditions of Lemma 3.15.Consequently, there exists x k such that THEORY OF COMPUTING, Volume 10 (18), 2014, pp.465-514 To simplify notation, assume without loss of generality that k = 1, i. e., assume that By Corollary 2.17 there must exist c ∈ F such that On the other hand, (by Lemma 3.11) it must be the case that R(x 1 , 0, 0) ≡ c in contradiction to Therefore, P must be (x i , x j )-separated mod F.

PROPs
In this subsection we extend the model of ROFs by allowing a preprocessing step of the input variables.
While the basic model is read-once in its variables, the extended model can be considered to be read-once in univariate polynomials.
Definition 3.17.A preprocessing is a transformation T ( x) : F n → F n of the form such that each T i is a non-constant univariate polynomial.We say that a preprocessing is standard if in addition each T i is monic and satisfies T i (0) = 0.
Notice that preprocessing does not affect the PIT problem in the white-box model as for every n-variate polynomial P( ȳ) it holds that P( ȳ) ≡ 0 if and only if P(T ( x)) ≡ 0. We now give a formal definition and list some simple properties of PROFs.Definition 3.18.A preprocessed arithmetic read-once formula (PROF for short), in the variables x = (x 1 , . . ., x n ), over a field F, is a binary tree whose leafs are labelled with non-constant univariate polynomials T 1 (x 1 ), T 2 (x 2 ), . . ., T n (x n ) (all together forming a preprocessing) and whose internal nodes are labelled with the arithmetic operations {+, ×} and with a pair of field elements (α, β ) ∈ F 2 .Each T i can label at most one leaf.The computation is performed in the following way.A leaf labelled with the polynomial T i (x i ) and with (α, β ) computes the polynomial α • T i (x i ) + β .If a node v is labelled with the operation op ∈ {+, ×} and with (α, β ), and its children compute the polynomials Φ v 1 and Φ v 2 , then the polynomial computed at v is THEORY OF COMPUTING, Volume 10 (18), 2014, pp.465-514 A polynomial P( x) is a Preprocessed Read-Once Polynomial (PROP for short) if it can be computed by a PROF.A decomposition of a polynomial P is a pair (Q(z), T ( x)) such that P( x) = Q(T ( x)), where Q is a ROP and T is a preprocessing.We call Q the backbone of P. We let the gate-graph of P, G P , be the gate-graph of its backbone Q.A standard decomposition is as above with the additional requirement that T is a standard preprocessing.An immediate consequence of the definition is that each PROP admits a decomposition.To provide additional intuition we start with a simple, yet important, lemma.Lemma 3.19.Every PROP P admits a standard decomposition.In addition, if (Q(z), T ( x)) and (Q (z), T ( x)) are two decompositions of a PROP P( x), then there exist two vectors ā, b ∈ F n , with a i = 0 for every i ∈ [n], such that Moreover, if (Q, T ) is a decomposition of a PROP P, then any pair (Q , T ) that satisfies the above conditions is also a decomposition of P.
Proof.Let (Q, T ) be some decomposition of P and let c i = 0 denote the leading coefficient of x i in the polynomial T i (x i ) for i ∈ [n] (c i is well-defined since T i is non-constant).Consider the shifted polynomials: T ( x) T1 (x 1 ), T2 (x 2 ), . . ., Tn (x n ) .
It is easy to verify that ( Q, T ) is a standard decomposition of P. Given the above argument, the proofs of the second and the third properties follow easily and so we omit them.
To handle the preprocessed case we will need the following definitions: x n ] be a PROP in its standard decomposition.We say that ᾱ ∈ F n is a witness for P if for every i ∈ [n] it holds that T i (α i ) = 0.
Definition 3.21.Let P ∈ F[x 1 , x 2 , . . ., x n ] be a polynomial, ᾱ ∈ F n and i, j ∈ [n].We define the α-directed commutator between x i and x j as The next two lemmas follow easily from the definition and from following the proof for the case of ROFs and so we omit their proofs.Lemma 3.22.Let P, (Q(z), T ( x)) be a PROP and its standard decomposition, respectively.Then the following properties hold for any ᾱ ∈ F[x 1 , x 2 , . . ., x n ].
In particular • P is 0-justified if and only if Q is 0-justified.More generally, P is ā-justified if and only if Q is T ( ā)-justified.
• If ᾱ is a witness for P then The following is the PROP version of Lemma 3.9.
Lemma 3.23 (PROP Structural Lemma).Every PROP P( x) such that |var(P)| ≥ 2 can be presented in exactly one of the following forms: 1. P( x) = P 1 ( x) + P 2 ( x), and where P 1 , P 2 are non-constant, variable-disjoint PROPs and c is a constant.

Auxiliary algorithms
In this section we give some auxiliary algorithms to be used later.

From PIT to justifying assignments
We now show how to compute a justifying assignment from a PIT algorithm, following Section 4 in [43].
We shall consider a circuit class C (e. g., depth-3 circuits, ROFs, etc.) for which there exists another circuit class C such that ∂ C ⊆ C (recall Definition 2.18) and C has an efficient deterministic PIT algorithm. 9emma 4.1 (Lemma 4.1 [43]).Let n, d ≥ 1. Assume |F| > nd.Let P ∈ F[x 1 , x 2 , . . ., x n ] be a polynomial, with individual degrees bounded by d, that is computed by circuits from C. Let C be another (or the same) circuit class such that ∂ C ⊆ C .Suppose C admits a deterministic PIT algorithm A. Then there exists a deterministic algorithm B that has black-box access to A and computes a justifying assignment ā for P in time O(n 3 d • t), where t is the running time of A. Lemma 4.1 gives an (adaptive) algorithm that computes a justifying assignment for any polynomial in C, given access to a PIT algorithm for the class C .In order to obtain a non-adaptive reconstruction algorithm we will need a non-adaptive version of the lemma.More precisely, we require an algorithm that computes a justifying set for PROPs, i. e., a set that contains a justifying assignment for every PROP (recall Definition 2.3).In Section 4.1 of [43] it was also shown how to convert a black-box PIT algorithm into a justifying set of roughly the same size.In addition, [43] presented a black-box PIT algorithm for PROPs (see Lemma 5.12).Combining these results we get the following lemma:

ROF graph-related algorithms
In this section we give two basic algorithms for PROFs in the white-box model.To slightly simplify the algorithms we shall assume w. l. o. g. that all the PROFs are non-degenerate.Notice that we can make this assumption since there is a trivial O(n) time white-box algorithm that can convert any ROF Φ to a non-degenerate ROF Φ such that Φ ≡ Φ .
For the analysis of the algorithms we will need the following easy observations.The first is that a non-degenerate ROF Φ computes the zero polynomial if and only if Φ is the "zero ROF," Φ = CN 0 (the graph of computation of Φ is no other than CN 0 ).Secondly, in a non-degenerate ROF, for every gate-label (α, β ), it holds that α = 0.
We will use the following notation in our algorithms.
Definition 4.3.Let G be the graph of computation of a PROF.We think of G as a planar graph (and in particular the notions "left child" and "right child" of a node are well defined).Let v be a gate in the formula.
• Φ v -denotes the formula rooted at v.
• v.α -denotes the value of α labeling v.
• v.β -denotes the value of β labeling v.
• v.Left -denotes the left child of v.
• v.Right -denotes the right child of v.

Factoring a ROF
We now give an algorithm for finding all the irreducible factors of a given ROF.The idea of the algorithm comes from the proof of Lemma 3.12.There we showed that a ROF Φ has non trivial factors if and only if its top gate is a multiplication gate and the additive constant β , of the top gate, is 0. Note that in this case Φ equals the product of the polynomials computed by its children.From this it is clear that by looking at the top gate and recursing on the left and right children we can find all the irreducible factors.Algorithm 1 computes a list S = {h i } of all irreducible factors of Φ v (the polynomial computed by the node v) and a constant α such that The following lemma gives the analysis of the algorithm.We omit the proof as it is immediate from the proof of Lemma 3.12.return (Φ , 1) 3: if v.Type = + then 4:

Counting the number of monomials in a PROP
The number of monomials in a polynomial P is the number of monomials with non-zero coefficients.We now give an efficient deterministic algorithm for counting the number of monomials computed by a given PROF.The main idea is that once a non-constant monomial appears, it cannot be canceled later.Consequently, we only have to sum the number of non-constant monomials and keep track of the behavior of the constant term.
In order to determine whether a certain value is zero or not we use an auxiliary function NZ(x) that is defined as The algorithm simply recurses on the left child and on the right child of the root and combines the results according to the different values of the constant terms.Proof.We start by proving the correctness of the algorithm.The proof is by induction on the structure of the formula.We first analyze what happens at the leaves and then move up.During the analysis we shall use the simple observation that the number of non-constant monomials is not affected by the (α, β ) labeling of the gates.We denote with (M L ,C L ) and (M R ,C R ) the results returned from the left child and the right child, respectively.We consider the different possibilities for the operation labeling v (i.e., v.Type).
• v.Type = CONST or v.Type = IN: Φ v computes a constant or a univariate polynomial.In this case we can simply count the number of non-constant monomials and set M to this value.M ← The number of non-constant monomials in Φ v 3: When v is not a leaf we recursively run the algorithm on the left child and on the right child.Denote with p L and p R the polynomials computed by the left child and the right child, respectively.We again analyze the different options for v.Type.
From our observation this is exactly the number of non-constant monomials of Φ v .The claim regarding C is trivial.
• v.Type = +: Φ v computes a sum of two functions.Φ v = v.α × (p L +p R ) + v.β and, as before, the number of non-constant monomials of p L + p R (and hence of It is clear from the above analysis that the algorithm returns the correct answer.The claim regarding the running time follows easily from the fact that the algorithm is a simple graph traversal that requires O(n) time.As the individual degrees of the polynomial are bounded by d, computing the number of non-zero monomials for the leaves requires O(d) time.In addition, note that at each step we multiply two n log d-bit numbers (since 0 ≤ M ≤ (d + 1) n ).Thus the total running time is Õ(nd + n 2 ).

Reconstruction of a PROF
In this section we discuss the problem of PROF reconstruction: given black-box access to a PROP P we wish to construct a PROF Φ such that Φ computes P. We first give a reconstruction algorithm for the case of 0-justified PROPs.As an arbitrary PROP can be made 0-justified via a proper shifting (see Lemma 2.5), we conclude the general case by giving an algorithm for computing such a shift efficiently.We give three different reconstruction algorithms: a randomized algorithm, a deterministic algorithm and a non-adaptive deterministic algorithm, with some deterioration in the running times between the different models.
Let d be a bound on the individual degrees of the PROP in question.We assume that |F| > d.If this is not the case then we allow the algorithm to make queries to the polynomial from an extension field of appropriate size.We note that such a requirement is necessary even for the simple task of univariate polynomial interpolation.Throughout this section we fix a set W ⊆ F of d + 1 distinct elements such that 0 ∈ W .

Reconstruction of a 0-justified PROF
Let P be a 0-justified PROP with individual degrees bounded by d.In [43] (Theorem 7.4 specialized to k = 2) it was shown that P is uniquely determined by its values on the set A n 6 (W ) (recall Definition 2.8).This implies that P can be reconstructed given those values.Yet, in principal, such an "informationtheoretic" reconstruction algorithm need not be efficient.In this section we give an efficient deterministic reconstruction algorithm for 0-justified PROPs, which queries the polynomial on inputs from the set A n 3 (W ).
Algorithm 3 Reconstruct 0-justified PROF Input: Black-box access to a 0-justified PROP P.
1: Learn the Preprocessing and var 0 (P) 2: Construct the gate-graph of P 3: Construct a PROF Φ by recursively constructing its sub-formulas Lemma 5.1.There exists an algorithm that given black-box access to a 0-justified PROP with individual degrees bounded by d, constructs a (non-degenerate) PROF Φ, such that Φ ≡ P. Furthermore, the algorithm only queries P on the set A n 3 (W ).The running time of the algorithm is poly(n, d).
A high level description of the algorithm is given in Algorithm 3. We now describe in depth each step of the algorithm.

Learning the preprocessing and var 0 (P)
Given access to a PROP P( x) = Q(T ( x)), the first step is to compute the standard preprocessing T ( x) and the set var 0 (P).For that purpose, for every i ∈ [n] we define P i (x i ) P(0, . . ., 0, x i , 0, . . ., 0) .THEORY OF COMPUTING, Volume 10 (18), 2014, pp.465-514 The next observation is immediate in the light of Lemma 3.19.Recall that for every 0-justified polynomial P it holds that var 0 (P) = var(P).Observation 5.2.For each i ∈ [n] it holds that P i (x i ) = a i • T i (x i ) + b i for some a i , b i ∈ F. In addition, a i = 0 iff x i ∈ var 0 (P).
For the sake of future steps we also compute a witness ᾱ for P (recall Definition 3.20).
Interpolate P i (x i ) as a univariate polynomial of degree d 3: Compute T i from P i

4:
If T i is non-constant find α i ∈ W such that T i (α i ) = 0 5: Compute var 0 (P) Lemma 5.3.Given black-box access to a 0-justified PROP P, Algorithm 4 computes a standard preprocessing T ( x) of P, the set var 0 (P) and a witness ᾱ for P. The running time of the algorithm is poly(n, d).In addition, the algorithm does so by querying P on the set A n 1 (W ) alone.
Proof.First of all note that, as the individual degrees in P i are bounded by d, the set A n 1 (W ) contains enough points to interpolate P i .It is easy to compute a standard T i from P i .From Observation 5.2, x i ∈ var 0 (P) iff the resulting T i is a non-constant polynomial, thus, for every non-constant T i there exists α i ∈ W such that T i (α i ) = 0.All the above operations can be carried out in time poly(n, d) by querying P only on inputs from the set A n 1 (W ).
As P is 0-justified we can set P P| x [n]\var 0 (P) = 0[n]\var 0 (P)   and, by renaming variables, assume w. l. o. g. that var(P) = var 0 (P) = [n].If P is constant or univariate (i.e., |var 0 (P)| ≤ 1) then we are done.Otherwise, P contains at least one (addition or multiplication) gate, and we continue to the next step of Algorithm 3.
As we have learned the preprocessing, we will, in some sense, be able to "forget" about it and reconstruct P as if it was a (non-preprocessed) ROP.In fact, the witness ᾱ and Lemma 3.22 allow us to access the backbone ROF of P.

Constructing the gate-graph
In this step we recursively unfold the structure of the backbone ROF of a given PROP.As mentioned above, after the previous step we can treat P as if there was no preprocessing involved (i.e., "assume" that T i (x i ) = x i ).Recall that the gate-graph of a PROP P is defined to be the gate-graph of its backbone ROP.
We will use Lemma 3.6 in order to construct that graph.
Output: G P .
For each pair i Lemma 5.4.Given black-box access to a 0-justified PROP P Algorithm 5 runs in time O(n 2 ) and constructs G P -the gate-graph of the P-by making queries to P from the set A n 2 (W ) alone.Proof.Let P( x) = Q(T ( x)).Since T ( x) is standard, Lemma 3.22 implies that Q is 0-justified.Therefore, by Lemmas 3.6 and 3.11: On the other hand, Lemma 3.22 implies that As T i (α i ), T j (α j ) = 0, correctness of the algorithm follows.From the definition of discrete partial derivative (Definition 2.11), for each i, j the expression can be computed by querying P on four points from A n 2 (W ).
Having the gate-graph at hand, we can recursively reconstruct the formula gate-by-gate, according to the labelling (+ or ×) of its top gate.By Lemma 3.23, every PROP P( x) that has at least one gate can be presented in exactly one of the two forms P( x) = P 1 ( x) + P 2 ( x) or P( x) = P 1 ( x) • P 2 ( x) + c, depending on the labeling of the top gate.Thus the high level view of step 3 of the reconstruction algorithm is as follows: first we find a (possible) partition of the variables L ∪ R = var(P) such that L = var(P 1 ) and R = var(P 2 ), then we recursively construct formulas Φ i ≡ P i and, finally, we "glue" them together to obtain a formula for P.

Top gate "+"
In this case a partition can be obtained by considering the connected components of G P .The idea is summarized in the following observation that follows from the definitions in Section 3.2.
Observation 5.5.Let Q( x) be a multilinear polynomial and let L ∪ R = var(Q) be a non-trivial partition of var(Q).Then, Q can be represented in the form Algorithm 7 Top Gate × Case Input: 0-justified PROP P( x), given via black-box access, and a witness ᾱ.Output: PROF Φ ≡ P.
THEORY OF COMPUTING, Volume 10 (18), 2014, pp.465-514 (⊇) Suppose Q is not (x 1 , x j )-separated mod F. Lemma 3.16 implies that there exists k ∈ var(P)\ {1, j} such that ≡ 0 then j ∈ L; otherwise, by Lemma 3.14, where g(x k ) is a univariate polynomial.By Corollary 2.17 g(x k ) must be non-constant (since we assumed that Q is not (x 1 , x j )-separated mod F) and hence The rest of the algorithm follows the same rationale as before.We first find the value of the constant c and then recursively construct the left and right subformulas.We note that since P is 0-justified, we can perform the division in the last step.

Conclusion
We can now prove Lemma 5.1.
Proof of Lemma 5.1.The proof is by induction on |var 0 (P)| = |var(P)|.By Lemma 5.3 we can learn the set var 0 (P) and handle the case |var 0 (P)| ≤ 1.Now, assume |var 0 (P)| ≥ 2. This implies that any PROF computing P must have at least one gate.Lemma 5.4 allows us to construct the gate-graph from which we can learn the labeling of the top gate (Lemma 3.4, Property 3).From this point on Lemmas 5.6 and 5.7 ensure the correctness of construction.We note that in each step we query P only on inputs from the set A n 3 (W ).The claim regarding the running time follows from previous lemmas.
The next lemma shows that Algorithm 3 gives useful information also when applied to PROFs that are not 0-justified.Lemma 5.8.Let P a PROP, with individual degrees bounded by d, given via black-box access.Algorithm 3, when given P as input, constructs a (non-degenerate) PROF Φ satisfying Φ ≡ P| x [n]\var 0 (P) = 0[n]\var 0 (P) .
Observe that var(P ) = var 0 (P) = var 0 (P ) hence P is a 0-justified PROP.To complete the proof note that the algorithm runs in the same way when given either P or P as input.

Reconstruction of a general PROF
So far we gave a reconstruction algorithm for 0-justified PROPs.By combining our algorithm with Lemma 2.5 we obtain an algorithm for reconstructing arbitrary PROPs, assuming that we know a justifying assignment for the black-box polynomial.
Theorem 5.9.Let P ∈ F[x 1 , x 2 , . . ., x n ] be a PROP, with individual degrees bounded by d, given via black-box access, and let ā ∈ F n be a justifying assignment of P. Then there exists an algorithm that constructs a (non-degenerate) PROF Φ such that Φ ≡ P by querying P on inputs from the set ā + A n 3 (W ).The running time of the algorithm is poly(n, d).
Proof.Invoke the algorithm described in Lemma 5.1 on P ( x) P( x + ā).By Lemma 2.5 P is a 0justified PROP.Therefore, the algorithm will return a PROF Φ such that Φ( x) ≡ P ( x) P( x + ā).The algorithm returns the formula Φ( x − ā).
Consequently, to extend our algorithm to handle a general PROP P, we first need to find a justifying assignment ā for P and then apply Theorem 5.9.We give a randomized algorithm, a deterministic algorithm and a non-adaptive deterministic algorithm for computing a justifying assignment, thus obtaining a reconstruction algorithm for general PROPs.

Randomized PROF reconstruction
The simplest way to get a justifying assignment is to pick one at random.This idea was used in the previous works on ROF reconstruction [18,10].We give it here for completeness.We first state the Schwartz-Zippel lemma: Lemma 5.10 ( [46,38]).Let P ∈ F[x 1 , x 2 , . . ., x n ] be a non-zero polynomial with individual degrees bounded by d.Then, Since a justifying assignment is simply a common non-zero assignment of several polynomials, we get the following corollary: Proof.Let (Q(z), T ( x)) be a standard decomposition of P and let ᾱ be a corresponding witness for P. S ← S ∪ Φ ā 6: Find Φ ∈ S with the maximal var(Φ ), denote it with Φ M 7: return Φ M Correctness of the algorithm: First of all, notice that since Algorithm 3 is non-adaptive so is Algorithm 8.By Lemma 4.2, J d contains a justifying assignment ā * of P, hence S must contain Φ ā * -the result of reconstructing P using ā * as a justifying assignment input.By Theorem 5.9 Φ ā * ≡ P. We now argue that Φ M ≡ Φ ā * ≡ P. By Lemma 5.8 var(Φ M ) ⊆ var(P).On the other hand, from the definition of Φ M , it holds that |var(Φ M )| ≥ |var(Φ ā * )| = |var(P)|.This implies that var(Φ M ) = var(P).From Lemma 5.8 we conclude that the assignment used to construct Φ M is a justifying assignment as well.Thus, Φ M ≡ P.

Read-once testing
In this section we study the relation between the PIT problem and the ROT problem and prove Theorem 1.5.We first present a generic scheme that can be used to strengthen efficient deterministic PIT algorithms to yield efficient deterministic ROT algorithms.Then we use known schemes to obtain ROT algorithms for models for which PIT algorithms are known. 12

Generic scheme
As was mentioned in Section 1.3, the main idea behind the scheme is "Doveryai, no Proveryai" (trust, but verify): Given a circuit we run a PROP reconstructing algorithm on the circuit (based on Theorem 5.9).If the algorithm encounters an error or is unable to run correctly, then we conclude that the circuit does not compute a PROP and thus we stop and report a failure.Things are more complicated in the case of success, that is, when the algorithm does construct a PROF.The problem is that we do not have any guarantee regarding the correctness of our assumption (that the circuit computes a PROP) and hence no guarantee that the PROF constructed indeed computes the same polynomial as the circuit.Moreover, for any circuit C that computes a PROP, there exist many circuits (computing different polynomials) "aliasing" C. That is, an execution of our reconstruction algorithm on each such circuit C ≡ C will succeed and yield a PROF Φ such that Φ ≡ C = C . 13Consequently, for ROT we need to verify the correctness of the output.The verification procedure is the technical core of our ROT algorithm, and is given in Algorithm 10.Algorithm 9 gives the generic scheme for ROT.The algorithm works both in the black-box and in the white-box models, depending on the PIT algorithm at hand.Algorithm 9 Generic ROT Scheme Input: (Black-box access to a) Circuit C that belongs to C. Output: A PROF Φ such that Φ ≡ C if C computes a PROP and "reject" otherwise.
1: Compute a justifying assignment ā using Lemma 4.1.2: Reconstruct a PROF Φ from C using Theorem 5.9.3: Verify that Φ ≡ C using Algorithm 10 (given in Subsection 6.2).
In Section 6.3 we give the proof of Theorem 1.5, that basically analyzes the running time of Algorithm 9, given Lemma 4.1 and Theorems 5.9 and 6.2.Then, in Section 7, we go over some circuit classes that have efficient PIT algorithms and give the corresponding ROT algorithms.

Read-once verification
Read-Once Verification is testing whether a given circuit C, from a certain circuit class C, and a given PROF Φ compute the same polynomial.This is somewhat a harder problem than PIT since it requires determining the equivalence of polynomials computed by circuits from two different circuit classes.We shall work under the assumptions that C has a PIT algorithm and that the PROF Φ is the output of the PROF reconstruction algorithm and thus is given to us explicitly (e. g., as a graph of computations).The circuit C, on the other hand, may be given to us as a black-box (depending on the assumed PIT algorithm for C).Clearly, if C − Φ ∈ C then the verification procedure is trivial (as C has a PIT algorithm).The general case however is more complicated.The idea behind the algorithm is to recursively ensure that every gate v of Φ computes the same polynomial as a corresponding restriction of C. To give a rough sketch, we first find a justifying assignment ā for Φ.Then we consider v, the root of Φ.It has two subformulas.Denote Φ = α • (Φ v 1 op Φ v 2 ) + β , where Φ v i is the PROF computed at v i and op is either + or ×.Assume that the variables of v i are S i (S 1 and S 2 are disjoint).Consider the circuit C 1 that results from C after substituting the corresponding values from ā to the variables in S 2 .Similarly we define C 2 , and the PROFs Φ 1 and Φ 2 . 14We now recursively verify that C i ≡ Φ i .The only thing left to do is to verify that indeed C ≡ α • (C 1 op C 2 ) + β .This basically reduces the verification problem to the problem of verifying that C ≡ C 1 op C 2 where C 1 and C 2 compute variable disjoint PROPs and op is either + or ×.Note that this is a PIT problem for a circuit class that is closely related to C, although slightly different (e. g., if C is the class of ΣΠΣ(k) circuits, defined in Section 7.2, then we need a PIT algorithm for ΣΠΣ(O(k 2 )) circuits).Therefore, we shall assume that a slightly larger circuit class has an efficient deterministic PIT algorithm (e. g., a class containing C −C 1 op C 2 for variable disjoint C 1 and C 2 ).For this we make the following definition of a "verifying class."The definition uses the notations given in Definition 2.18.Proof.We start by analyzing the running time.
Running time: As described above, the algorithm preforms a traversal over the tree of Φ.The PIT algorithm of C V is invoked once for every internal gate.For each input gate we interpolate a univariate polynomial using d + 1 queries.Hence the total running time is O(nd + n • t) when t is the cost of a single PIT algorithm for C V .We now prove the correctness of the algorithm.

Execution:
We show that all the PIT calls that we make are "well defined," namely, that in lines 9 and 14 we indeed have the correct input to the relevant PIT algorithm.We make the following observation: At each step of the algorithm it holds that 1. C,C L ,C R ∈ L(C) (when C L and C R are defined).This follows (recursively) from the definitions of C L and C R (both are obtained by applying a linear function to a restriction of C).

var(C) = var(Φ)
. By induction: For the base case we are guaranteed that var(C) = var(Φ).For the induction step, consider the definition of the sets L and R. As ā is a justifying assignment of C we have that var and similarly var(C R ) = var(Φ v.Right ).It is only left to notice that this is in line with the recursive invocation of the algorithm.
3. C L and C R are variable-disjoint.Indeed, From Observations 1 and 3 it follows that Hence, we can execute Lines 9 and 14 using the PIT algorithm of C V .

Correctness:
The correctness of the algorithm can be proved by a simple induction.We need to show that the algorithm accepts iff C ≡ Φ.The base case (i.e., Φ is a univariate polynomial of degree at most d) is trivial.The inductive step follows from Lemmas 6.3 and 6.4 given below (and the correctness of the PIT algorithm of C V ).This completes the proof.

Sparse polynomials
An m-sparse polynomial is a polynomial with at most m (non-zero) monomials.Equivalently, it is a polynomial computed by a depth-2 ΣΠ circuit of size m.Sparse polynomials received a lot of attention (see, e. g., [7,29,31]) and several polynomial time algorithms for both reconstruction and PIT were given, over sufficiently large fields.We now show how to solve the ROT problem for sparse polynomials.Note that in [10] it is mentioned that a polynomial time interpolation algorithm is known in the case that the given ROF is a sparse polynomial (see last sentence of paragraph 4 on page 707 of [10] that refers to [30]).We present another proof here that gives a stronger result (thus proving Theorem 1.7).We denote by ΣΠ(m, d) the class of m-sparse polynomials, in n variables, of degree d. 15 In order to apply Algorithm 9 on ΣΠ(m, d) we shall need a PIT algorithm for ΣΠ(poly(m), poly(d)).Several such results are known, see [29] and references within.Note that ΣΠ(m 2 + 4m + 3, 2d) is a verifying class for ΣΠ(m, d) (recall Definition 6.1).Hence, we can use the above lemma in conjunction with Algorithm 9 to prove Theorem 1.7.We now give an alternative proof of the theorem that follows the same lines as the scheme of Algorithm 9 albeit using a different verification procedure.
Proof of Theorem 1.7.Let P ∈ ΣΠ(m, d) be a sparse polynomial given via black-box access.We follow the scheme outlined in Algorithm 9 noting that ∂ ΣΠ(m, d) ⊆ ΣΠ(m, d).We first run the algorithms suggested by Lemma 4.1 and Theorem 5.9 to obtain a candidate PROF Φ.Of course, should any of the algorithms fail, we reject ("not PROF").We now wish to verify that Φ ≡ P. Originally, we used Algorithm 10, but here we use a different scheme instead.We first compute the degree of Φ (denoted by D) by a simple traversal, and then run Algorithm 2 to count the number of monomials in the PROP computed by Φ (denoted by M).Now, if M > m or D > d then, obviously, Φ ≡ P. Otherwise, we set P Φ − P. Note that the resulting polynomial P has at most 2m monomials and hence P ∈ ΣΠ(2m, d).Consequently, we can apply Lemma 7.1 to determine whether P ≡ 0. Note that the PIT algorithm for ΣΠ(2m, d) is polynomial in n, m, d (and is slightly more efficient than Algorithm 10 when given access to a PIT algorithm for the class ΣΠ(m 2 + 4m + 3, 2d)).

Depth-3 circuits
A depth-3 ΣΠΣ(k) circuit C computes a polynomial of the form where the L i j ( x)-s are linear functions; L i j ( x) = n ∑ t=1 a t i j x t + a 0 i j 15 As the number of variables is always n we do not mention it.
with a t i j ∈ F. We denote by ΣΠΣ(k, d) a ΣΠΣ(k) in which each F i has degree at most d (i.e., d i ≤ d).Those circuits were a subject of a long line of research [12,27,26,41,5,25,35,36,37] yielding several efficient deterministic PIT algorithms.The state of the art black-box PIT algorithm for this circuit class was given in [36].

Multilinear depth-4 circuits
A depth-4 ΣΠΣΠ(k) circuit C has four layers of alternating Σ and Π gates (the top Σ gate is at level one) and it computes a polynomial of the form where the P i j ( x)-s are polynomials computed by a ΣΠ circuit (i.e., sparse polynomials).In other words, the P i j s are being computed by the last two ΣΠ layers of the circuit and are the inputs to the Π gates at the second level.A multilinear ΣΠΣΠ(k) circuit is a ΣΠΣΠ(k) circuit in which each multiplication gate F i computes a multilinear polynomial.PIT algorithms were given for restricted classes of depth-4 circuits in [34,41,5,3,2,33,23].The state-of-the-art PIT algorithm for multilinear depth-4 circuits was given in [33].Lemma 7.3 ([33]).Let n, k, s ≥ 1. Assume |F| > n 2 .There is a deterministic black-box PIT algorithm for n-variate polynomials, computed by multilinear ΣΠΣΠ(k) circuits, of size s, that runs in time (ns) O(k 3 ) .
We can now prove Theorem 1.9.
Proof of Theorem 1.9.First, observe that the class of multilinear ΣΠΣΠ(k 2 + 4k + 3) circuits of size 4s + 4 is a verifying class for multilinear ΣΠΣΠ(k) circuits of size s.Hence, we can invoke Algorithm 9 in conjunction with Lemma 7.3.Theorem 1.5 guarantees correctness.The running time is (ns) O(k 6 ) .

Multilinear read-k formulas
Read-k formulas are formulas in which each variable appears at most k times.The study of this class of formulas was initiated in [40,41] where sums of read-once formulas were studied.Efficient deterministic PIT algorithms were given for multilinear [3] and bounded depth [2] read-k formulas.Here we only consider multilinear read-k formulas, the bounded depth case is similar.Lemma 7.4 ([3]).Let n, k ≥ 1 and assume |F| > n 2 .Let F be a multilinear read-k formula over F[x 1 , x 2 , . . ., x n ].Then: • There is a deterministic algorithm that given F explicitly decides if F ≡ 0 in time n k O(k) .
• There is a deterministic algorithm that given black-box access to F decides if F ≡ 0 in time n k O(k) +O(k log n) .
We now show a generalization of those PIT algorithms to ROT algorithms, thus proving Theorem 1.6.
Proof of Theorem 1.6.Let F be a multilinear read-k formula.We first use Lemma 4.1 to compute a justifying assignment for F. It is easy to see that this circuit class is closed under partial derivatives, thus we can use the PIT algorithms from Lemma 7.4.Next, we construct a candidate ROF Φ by applying Theorem 5.9.To complete the procedure, we need to verify that Φ = F or, in other words, that F − Φ ≡ 0. This is a case of a PIT of a multilinear read-(k + 1) formula, hence we can use Lemma 7.4 again to obtain the result.it follows that v is a multiplication gate.Let P v ( x) be the polynomial computed by v in Φ.It is not hard to see that there exist polynomials A( x) and B( x), that do not share variables with P v ( x), such that P( x) ≡ A( x) • P v ( x) + B( x).Clearly, x i , x j ∈ var(P v ) \ (var(A) ∪ var(B)).By the definition of fcg and Lemma 3.9, P v ( x) has the form P v = P 1 • P 2 + c, where x i ∈ var(P 1 ), x j ∈ var(P 2 ) and c ∈ F. We thus have that In addition, we have that This implies that x I = 0 ≡ 0 .
In particular, either ∂ P ∂ x i x I = 0 ≡ 0 or ∂ P ∂ x j x I = 0 ≡ 0 .
Proof of Lemma 3.10.Let P be a ROP and i ∈ [n].We prove the claim by induction on k = |var(P)|.For k = 0, 1 the claim is trivial.For k ≥ 2 we get by Lemma 3.9 that P can be in one of two forms.
Case 1. P( x) = P 1 ( x) + P 2 ( x).Since P 1 and P 2 are variable disjoint we can assume w. l. o. g. that In addition, |var(P 1 )| < |var(P)| and so by the induction hypothesis we get that Case 2. P( x) = P 1 ( x) • P 2 ( x) + c.Again we assume w. l. o. g. that As before, ∂ P 1 ∂ x i is a ROP.Since P 1 and P 2 are variable disjoint and P 2 is a ROP, we have that is a ROP as well.
THEORY OF COMPUTING, Volume 10 (18), 2014, pp.465-514 For the "moreover" part, assume for a contradiction that for some i ∈ [n], we have that ∂ P ∂ x i is not 0-justified.That is, there exists some j ∈ [n] such that ∂ P ∂ x i depends on x j , however, for I = var(P) \ {i, j}, the polynomial ∂ P ∂ x i x I = 0 does not depend on x j .In other words, we have that ≡ 0 and ∂ 2 P ∂ x i ∂ x j x I = 0 ≡ 0 .

Theorem 1 . 5 .
Let C be a class of arithmetic circuits.Denote by L(C) the class of all circuits of the form α •C + β for α, β ∈ F and C ∈ C (see Definition 2.18).Denote with C V the class of circuits that contains all circuits of the form C 1 +C 2 +C 3 ×C 4

Proposition 2 . 4 .
An assignment ā ∈ F n is a justifying assignment for P if and only if equation (2.1) holds for every subset I of size |var(P)| − 1.

Lemma 4 . 2 .
Let n, d ≥ 1. Assume |F| > n 3 d.Then there exists a deterministic algorithm that, given n and d, runs in time (nd) O(log n) and computes a set, J d , of size |J d | = (nd) O(log n) , which is a justifying set for PROPs, of individual degrees at most d, in F[x 1 , x 2 , . . ., x n ].

Lemma 4 . 4 . 1 :
Given a node v in the graph of computation of a non-constant ROF Φ, Algorithm 1 computes a pair (S, α), where S consists of ROFs for the irreducible factors of Φ v and α is a constant satisfyingΦ v = α • ∏ h∈S h.The running time of the algorithm is O(n).Algorithm 1 FactorROF(Φ) Input: Non-constant ROF Φ. Output: (S, α) where S is a list of the irreducible factors of Φ, α a constant in the field.if v.Type = IN then {Univariate polynomial} 2:

Lemma 4 . 5 .
Given a node v in the graph of computation of a PROF Φ, with individual degrees at most d, Algorithm 2 computes a pair (M,C), where M is the number of non-constant monomials of Φ v and C is the constant term of Φ v .The running time of the algorithm is Õ(nd + n 2 ).

Algorithm 2 1 :
CountMonomials(v) Input: The root v of a PROF.Output: (M,C) where M is the number of the non-constant monomials of Φ v , C is the constant term of Φ v .if v.Type = IN OR v.Type = CONST then {Φ v is a univariate or constant polynomial} 2:

13 :
Verify(C L , Φ v.Left ) and Verify(C R , Φ v.Right ) {Recursively} 14: Check that C ≡ v.α • (C L +C R ) + v.β {Using the PIT algorithm for C V } {Everything is OK} 15: If any of the steps failed than reject, otherwise accept.Theorem 6.2.Let C be an n-variate circuit from a circuit class C, that computes a polynomial with individual degrees at most d, and Φ a PROF, such that var(C) = var(Φ).Let C V be a verifying class of C and ā a justifying assignment for Φ and C.Then, given C, Φ and ā as input, Algorithm 10 runs in time O(nd + n • t), where t is the cost of the given PIT algorithm for C V , and accepts if and only if C ≡ Φ.

Lemma A. 1
implies that either∂ P ∂ x i x I = 0 ≡ 0 or ∂ P ∂ x j x I = 0 ≡ 0holds.On the other hand, x i , x j ⊆ var(Px I = 0), since P is a 0-justified ROP, and hence∂ P ∂ x i x I = 0 ≡ 0 and ∂ P ∂ x j x I = ō ≡ 0 , in contradiction.
RECONSTRUCTION AND TESTING OF READ-ONCE FORMULAS Next, we give two examples of family of multilinear polynomials that are not ROPs.Example 3.7.For n ≥ 4, the polynomial P(x 1 , x 2 , . . ., x n THEORY OF COMPUTING, Volume 10 (18), 2014, pp.465-514 ON Non-Adaptive PROF ReconstructionInput: A black-box access to a PROP P with individual degrees bounded by d.Output: PROF Φ such that Φ ≡ P.
3,C 4 are defined on disjoint sets of variables.Note that for most circuit classes that have efficient deterministic PIT algorithms, there exists an efficient deterministic PIT algorithm for a corresponding verifying class.Algorithm 10 solved the verification problem following the outline described above.It uses notation from Definition 4.3.Circuit C from a circuit class C, a PROF Φ, Access to a PIT algorithm for C V , and a justifying assignment ā for Φ and C. Output: "accept" if C ≡ Φ and "reject" otherwise.1: if v.Type = IN then {Φ is a univariate polynomial} 2: Check that C ≡ Φ {As two univariate polynomials of degree at most d} {Internal Gate} 3: L ← var(Φ v.Left ) 4: R ← var(Φ v.Right ) {Multiplication Gate} 5: if v.Type = × then