A hierarchy of local decision

We extend the notion of distributed decision in the framework of distributed network computing, inspired by recent results on so-called distributed graph automata. We show that, by using distributed decision mechanisms based on the interaction between a prover and a disprover, the size of the certificates distributed to the nodes for certifying a given network property can be drastically reduced. For instance, we prove that minimum spanning tree can be certified with $O(\log n)$-bit certificates in $n$-node graphs, with just one interaction between the prover and the disprover, while it is known that certifying MST requires $\Omega(\log^2 n)$-bit certificates if only the prover can act. The improvement can even be exponential for some simple graph properties. For instance, it is known that certifying the existence of a nontrivial automorphism requires $\Omega(n^2)$ bits if only the prover can act. We show that there is a protocol with two interactions between the prover and the disprover enabling to certify nontrivial automorphism with $O(\log n)$-bit certificates. These results are achieved by defining and analysing a local hierarchy of decision which generalizes the classical notions of proof-labelling schemes and locally checkable proofs.


Context and Objective
This paper is tackling the long-standing issue of characterizing the power of local computation in the framework of distributed network computing [25]. Our concern is the ability to design local algorithms, defined as distributed algorithms in which every node of a network (i.e., every computing entity in the system) can compute its output after having consulted only nodes in its vicinity. That is, communications proceed along the links of the network, and, in a local algorithm, every node must output after having exchanged information with nodes at constant distance only. A construction task consists, for the nodes of a network G = (V, E) where each node u is given an input x(u), to collectively and concurrently compute a collection y(u), u ∈ V , of individual outputs, such that (G, x, y) satisfies some property characterizing the task to be solved. For instance, the minimum-weight spanning tree (MST) task consists, given the weights x(u) of all the incident edges of every node u, in computing a subset y(u) of edges incident to u such that the set {y(u), u ∈ V } forms a MST in G. Similarly, the maximal independent set (MIS) task consists of computing y(u) ∈ {0, 1}, u ∈ V , such that the set {u ∈ V : y(u) = 1} forms an MIS. It is an easy observation that the MST task cannot be solved locally as the weights of far-away edges may impact the output of a node. In a seminal result Linial showed that the same is true for MIS [22]: there is no local algorithm for constructing an MIS, even on an n-node ring. Nevertheless, there are many construction tasks that can be solved locally, such as approximate solutions of NP-hard graph problems (see, e.g., [6,19,20,21]). In general it is Turing-undecidable whether or not a construction task can be solved locally [24].
Interestingly, the Turing-undecidability result of Naor and Stockmeyer [24] concerning the locality of construction tasks holds even if one restricts the question to properties that can be locally decided. A distributed decision task [11] consists, given an input x(u) to every node in a network G, to decide whether (G, x) satisfies some given property. An instance is accepted by a distributed algorithm if and only if every node individually accepts (i.e., every node u outputs y(u) = true). For instance, proper colouring can easily be decided locally by having each node merely comparing its colour with the ones of its neighbours. On the contrary, deciding whether a collection of edges defined by {x(u), u ∈ V } forms a MST is not possible locally (in fact, even separating paths from cycles is not possible locally). Similarly to the sequential computing setting, there are strong connections between the construction variant of a task and the ability to locally decide the legality of a given candidate solution for the same task, as illustrated by, e.g., the derandomization results in [5,24], and the approximation algorithms in [27]. These connections have motivated work focusing on the basic question: what can be decided locally? This paper is aiming at pushing further our current knowledge on this question.
Two specific lines of work have motivated our approach of local decision in this paper. The first line of research is related to the notion of proof-labelling schemes introduced by Korman et al. [18], who showed that while not all graph properties can be decided locally, they can all be verified locally, with the help of local certificates provided by a prover. Unfortunately, there are natural graph properties (e.g., the existence of a non-trivial automorphism) which require Ω(n 2 )-bit certificates to be verified by any local distributed algorithm [14]. Göös and Suomela introduced the more practical class LogLCP of all graph properties that can be verified using certificates of size O(log n) bits [14], i.e., merely the size required to store the identities of the nodes. The class LogLCP contains non locally decidable properties such as hamiltonicity and non-bipartiteness. LogLCP even contains graph properties that are not in NP. Also, all existential-MSO graph properties are shown to be in LogLCP.
The second line of research which motivated our approach is the study of distributed graph automata. In particular, [26] recently proved that an analogue of the polynomial hierarchy, where sequential polynomial-time computation is replaced by distributed local computation, turns out to coincide with MSO. However, while this result is important for our understanding of the computational power of finite automata, the model does not quite fit with the standard model of distributed computing aiming at capturing the power of large-scale computer networks (see, e.g., [25]). Indeed, on the one hand, the model in [26] is somewhat weaker than desired, by assuming a finite-state automata at each node instead of a Turing machine, and by assuming anonymous computation instead of the presence of unique node identities. On the other hand, the very same model is also stronger than the standard model, by assuming a decision-making mechanism based on an arbitrary mapping from the collection of all node states to {true, false}. Instead, the classical distributed decision mechanism is based on the logical conjunction of the individual decisions. This is crucial as this latter decision mechanism provides the ability for every node rejecting the current instance to raise an alarm, and/or to launch a recovery procedure, without having to collect all of the sindividual decisions.
In this paper, our objective is to push further the study initiated in [14] on the LogLCP class, by adopting the approach of [26]. Indeed, LogLCP can be seen as the first level Σ 1 of a local hierarchy (Σ k , Π k ) k≥0 , where Σ 0 = Π 0 = LD, the class of properties that can be locally decided [11], and, for k ≥ 1, Σ k is the class of graph properties for which there exists a local algorithm A such that, for every instance (G, x), with k alternations of quantifiers, and where Q is the universal quantifier if k is even, and the existential quantifier otherwise. (Π k is defined similarly as Σ k , but starting with a universal quantifier). The i 's are called labelling functions, assigning a label i (v) ∈ {0, 1} * to every node v, such that, for every node v, | i (v)| = O(log n) in n-node networks. Our aim is to analyze the local hierarchy in the general context of distributed network computing [25], where each node has an identity which is unique in the network, every node has the computational power of a Turing machine, and where the acceptance of an instance by an algorithm is defined as the logical conjunction of the individual decisions of the nodes.

Our Results
We study a hierarchy (Σ k , Π k ) k≥0 of local decision which represents a natural extension of proof-labelling scheme, as well as of locally checkable proof, with succinct certificates (i.e., of size O(log n) bits). In addition to its conceptual interest, this hierarchy might have some practical impact. Indeed, any level k of the hierarchy can be viewed as a game between a prover and a disprover, who play in turn by alternating k times. Roughly, on legal instances, the prover aims at assigning distributed certificates responding to any attempt of the disprover to demonstrate that the instance is illegal, and vice-versa on illegal instances. The referee judging the correctness of the collection of certificates produced by the players is a local distributed algorithm. For instance, the extensively studied class Σ 1 includes problems whose solutions are such that their legality can be certified by a prover using distributed certificates. Instead, the class Π 2 includes problems whose solutions are such that their legality can be certified by a prover against any other candidate solution provided by a disprover, both using distributed certificates.
We show that many problems have succinct proofs in the hierarchy. Actually, climbing up the hierarchy enables to reduce drastically the size of the certificates. For instance, we show a quadratic improvement for MST, which requires locally checkable proofs of Ω(log 2 n) bits, while MST stands at the second level of our hierarchy. That is, there is a Π 2 -protocol for MST using distributed certificates of O(log n) bits. For graph properties such as nontrivial automorphism, the improvement can even be exponential in term of certificate size, by relaxing the verification from locally checkable proofs with Ω(n 2 ) bits proofs to Σ 3 (with O(log n) bits proofs). More generally, many natural optimization problems are on the second level of our hierarchy. On the other hand, we also show that there are simple (Turing-computable) languages outside the local hierarchy. This latter property illustrates the impact of insisting on compact O(log n)-bits certificates: there are graph properties that cannot be locally certified via a finite number of interactions between a prover and a disprover using succinct certificates.
In addition, we prove several results regarding the structure of the hierarchy. In particular, we show that if the hierarchy collapses partially at any level, then it collapses all the way down to that level. On the other hand, we prove that the hierarchy does not collapse to the first level (i.e., the first and second levels are distinct). Distributed decision is naturally asymmetric, that is, reversing the individual decision of the algorithm at each node does not correctly reverse the global decision of the algorithm. As a consequence, it is not necessarily the case that co-Σ k = Π k , and vice-versa. However, we show that one additional level of quantifiers is always sufficient to reverse a decision (i.e., to decide the complement of a language). Finally, we show that, for every graph property at the intersection of a level-k class and the complement of this class, there is a protocol deciding that property at level k with unanimous decision, for both legal and illegal instances.

Related Work
Several forms of "local hierarchies" have been investigated in the literature, with the objective of understanding the power of local computation, or for the purpose of designing verification mechanisms for fault-tolerant computing. In particular, as we already mentioned, [26] has investigated the case of distributed graph automata, where nodes are anonymous finite automata, and where the decision function is a global interpretation of the all the individual outputs of the nodes. In this context, it was proved that the local hierarchy is exactly captured by the MSO formulas on graphs.
The picture is radically different in the framework in which the computing entities are Turing machines with pairwise distinct identities, and where the decision function is the logical conjunction of all the individual boolean outputs. In [11], the authors investigated the local hierarchy in which the certificates must not depend on the identity-assignment to the nodes. Under such identity-oblivious certificates, there are distributed languages outside Σ 1 . However, all languages are in the probabilistic version of Σ 1 , that is, in Σ 1 where the correctness of the verification is only stochastically guaranteed with constant probability. In [9], it is proved that Σ 1 is exactly captured by the set of distributed languages that are closed under lift. (A configuration (G , x ) is a t-lift of a configuration (G, x) if there is an input-preserving mapping from V (G ) to V (G) which preserves the t-neighbourhood of the nodes in these graphs). Interestingly, in the same framework as [11] but where the decision function is a global interpretation of the all the individual outputs, instead of the logical conjunction of individual boolean outputs, [2,3] proved that the local hierarchy collapses to Σ 1 . Also, in the same framework as [11], but where the certificates may depend on the identity assignment, all distributed languages are in Σ 1 (see [18]).
The literature about the local hierarchy in the context of Turing machine computation tend to show that all languages are at the very bottom of the hierarchy. However, [14] proved that, to be placed in Σ 1 , there are distributed languages on graphs (e.g., the existence of a nontrivial automorphism) which require to exchange certificates of size Ω(n 2 ) bits among neighbours, which is enough to trivially decide any problem. Similarly, [16,18] has proved that certifying Minimum-weight Spanning Tree (MST) requires to exchange certificates on Θ(log 2 n) bits, which can be costly in networks with limited bandwidth, i.e., under the CONGEST model [25]. In [17], it is proved that the size of the certificates for MST can be decreased to O(log n) bits, but to the expense of O(log n) rounds of communication. Recently, [23] has proved that the amount of communication between nodes (but not necessarily the size of the certificates) for verifying general network configurations can be exponentially decreased if using randomization, and [7] analyzed in depth the certificate size for s-t connectivity and acyclicity.
It is also worth mentioning the role of the node identities in distributed decision. For instance, after noticing that the identities are leaking information to the nodes about the size of the network (e.g., at least one node has an ID at least n−1 in n-node network), it was recently proved that restricting the algorithms to be identity-oblivious reduces the ability to decide languages locally in Σ 0 (see [8]), while this is not the case for Σ 1 (see [9]). Recently, [10] characterized the "power of the IDs" in local distributed decision. In [4], the authors discussed what can be computed in an anonymous networks, and showed that the answer to this question varies a lot depending on the commitment of the nodes to their first computed output value, i.e., whether it is revocable or not. In the context of local decision, the output is assumed to be irrevocable.
In general, we refer to [31] for a recent survey on local distributed computing, and we refer to [12,13] for distributed decision in the context of asynchronous crash-prone systems with applications to runtime verification, and to [1] for distributed decision in contexts where nodes have the ability to share non classical resources (e.g., intricate quantum bits).

Local Decision
Let G = (V, E) denote an undirected graph, where V is the set of nodes, and E is the set of edges. The subgraph induced by nodes at distance (i.e., number of hops) at most t from a node v is denoted by B G (v, t). All graphs considered in this paper are assumed to be connected (for non connected graphs, our results apply separately to each connected components). The number of nodes in the graph is denoted by n. In every graph G = (V, E), each node v ∈ V is assumed to have a name from the set {1, . . . , N }, denoted by id(v), where N is polynomial in n. In other words, all identities are stored on O(log n) bits. In a same graph, all names are supposed to be pairwise distinct.
Distributed languages. A distributed language L is a set of pairs (G, x), where G is a graph and x is a function that assigns some local input x(v) to each node v. We assume that all inputs x(v) are polynomial in n, and thus can be stored locally on O(log n) bits. The following are typical examples of distributed languages: • 3-colouring: (G, x) such that x encodes a proper 3-colouring of G; • 3-colourability: graphs that can be properly 3-coloured; • nta: graphs with a nontrivial automorphism; • planarity: planar graphs.
The complementL of a distributed language L is defined as the setL = {(G, x) : (G, x) / ∈ L}. For instance, the complement of 3-colouring is non-3-colouring, consisting of all pairs (G, x) such that x is not a proper 3-colouring of G.

Labellings.
A labelling is a function : V (G) → {0, 1} * , assigning a bit string to each node. If, for every graph G and every node v ∈ V (G), (v) ∈ {0, 1} k , we say that the labelling is of size k. In this paper, we are mostly interested in labellings of logarithmic size in the number of nodes in the input graph.
Local algorithms. We use the standard LOCAL model of distributed computing [25,22]. In this model each node v ∈ V (G) is a computational entity that has direct communication links to other nodes, represented by the edges of G. Every node runs the same algorithm. In this paper, all algorithms are deterministic. Nodes communicate with each other in synchronous communication rounds. During each round, every node is allowed to (1) send a message to each of its neighbours, (2) receive a message from each of its neighbours, and (3) perform individual computation. At some point every node has to halt and produce an individual output. The number of communication rounds until all nodes have halted is the running time of an algorithm.
A local algorithm is a distributed algorithm A for which there exists a constant t such that, for every instance (G, x), the running time of A in (G, x) is at most t. Since the most a node can do in t communication rounds is to gather all the information available in its local neighbourhood B G (v, t), a local algorithm A can be defined as a (computable) function from all possible labelled local neighbourhoods to some output set. Given an ordered set¯ = ( 1 , 2 , . . . , k ) of labellings, for some k ≥ 0, and given an instance (G, x), we denote by A(G, v, x,¯ ) the output of node v in algorithm A running in G with input function x and labelling¯ .
Local decision. In distributed decision, the output of each node v corresponds to its own individual decision. That is, each node either accepts or rejects. Globally, the instance (G, x) is accepted if and only if every node accepts individually. In other words, the global acceptance is subject to the logical conjunction of all the individual acceptances. For the sake of simplifying the presentation, A(G, v, x,¯ ) = 1 (resp., A(G, v, x,¯ ) = 0) denotes the fact that v accepts (resp., rejects) in an execution of algorithm A on (G, x) labelled with¯ . We say that A accepts if A(G, v, x,¯ ) = 1 for every node v ∈ V (G), and rejects otherwise. We will use the shorthand The first class in the local hierarchy considered in this paper is local decision, denoted by LD. A language L is in LD if there exists a local algorithm A, such that for all graphs G, and all possible inputs x on G, we have: As an example, deciding whether x is a 3-colouring of G is in LD, but deciding whether G is 3-colourable is not. Note that LD does not refer to any labellings. The algorithm A runs solely on graphs G with possible inputs to the nodes.
Finally, for sake realism, we assume that the nodes are Turing machines, and we consider only languages that are decidable in the centralized setting. This differs from previous works, in particular from the study of LogLCP by Gs and Suomela [14] where no assumption is made about the computational power of the nodes. For simplicity, as this change in the model only affects theorem 6 (where we prove that a language is not in our hierarchy), we will abuse notation and write that LogLCP is the same as the first level of the local hierarchy.
Example: certifying spanning trees. In a graph G, a spanning tree can be encoded as a distributed data-structure x such that, for every v ∈ V (G), x(v) encodes the identity of one of v's neighbours (its parent in the tree), but one node r for which x(r) = ⊥ (this node is the root of the tree). Deciding whether x is a spanning tree of G is not in LD. However, a spanning tree can be certified locally as follows (see [15]). Given a spanning tree x of G rooted at node r, a prover assigns label (v) = (id(r), d(v)) to each node v, where d(v) is the distance of v to the root r in the spanning tree x. Such a label is on O(log n) bits. The verification algorithm A at node v checks that v agrees on id(r) with all its neighbours, and that d(x(v)) = d(v) − 1. If both tests are passed, then v accepts, otherwise it rejects. It follows that Algorithm A accepts if and only if x is a spanning tree of G. Indeed, if x is not a spanning tree of G, there is no way to assign "fake" labels to the nodes so that all nodes accepts. This ability to certify spanning trees is a simple but powerful tool that will be used throughout the paper.

The Local Hierarchy
We generalize the various classes of distributed decision from previous work into a hierarchy of distributed decision classes, in a way analogous to the polynomial hierarchy. In particular, our class Σ LD 1 is equivalent to the class logLCP introduced by Göös and Suomela [14] (up to the hypothesis on the computational power of the nodes).

Definition
We first define an infinite hierarchy {(Σ LD k ) k≥0 , (Π LD k ) k≥0 } of classes. For the sake of simplifying the notation, each of these classes is now abbreviated in Σ k or Π k . Informally, each class can be defined by a game between two players, called the prover and the disprover. Both players are given a language L and an instance (G, x). In Σ k (resp., Π k ), with k > 0, the prover (resp., disprover) goes first, and assigns an O(log n)-bit label to each node. Then, the players alternate, assigning O(log n)-bit labels to each node in turn, until k labels 1 , 2 , . . . , k are assigned. A language L is in the corresponding class if there is a local algorithm A, and a prover-disprover pair such that, given (G, x), for every set of labels that the disprover assigns, the prover can always assign labels such that A accepts if and only if (G, x) ∈ L. That is, if (G, x) / ∈ L, then the disprover can always force some node to reject, whatever the prover does. Such a combination local algorithm A and prover-disprover pair is called a decision protocol for L in the corresponding class. Equivalently, we define LD = Σ 0 = Π 0 , and, for k > 0, Σ k is defined as the set of languages L for which there exists c ≥ 0, and a local algorithm A such that where Q is the existential (resp., universal) quantifier if k is odd (resp., even), and every label i is of size at most c log n. The class Π k is defined similarly, except that the acceptance condition is: Remark. For both Σ k and Π k , the equivalence should hold for every identity-assignment to the nodes with identities in [1, N ], where N is a fixed function polynomial in n. Indeed, the membership of an instance (G, x) to a language is independent of the identities given to the nodes. On the other hand, the labels given by the prover and the disprover may well depend on the actual identities of the nodes in the graph where the decision algorithm A is run. This is for instance the case of the protocol for certifying spanning trees described in the previous section, establishing that spanning-tree ∈ Σ 1 .

The odd-even collapsing, and the Λ k -hierarchy
Interestingly, the ending universal quantifier in both Σ 2k and Π 2k+1 do not help. The class Π 1 turns out to be just slightly stronger than LD. Specifically, we prove the following result.
Proof. The result follows from the fact that an existential quantification on labels of size O(log n) bit is sufficient to provide the nodes with the exact size of the graph using a spanning tree as described in Section 2.
To establish the claim, on a legal instance, let T be a spanning tree of G, and root T at node r. Let us set label (v) = (id(r), p(v), s(v)) where p(v) is the identity of the parent of v in T , and s(v) is the size of the subtree of T rooted at v. The verification proceeds as follows: each node v checks that it agrees on id(r) and x(v) with all its neighbours in the graph, and that In addition, the root r checks that s(r) = x(r). If all tests are passed, then the node accepts, otherwise it rejects. It follows that this algorithm accepts if and only if x(v) = n for all nodes v. This completes the proof of the claim.
We show how to use this mechanism in the case of Σ 2k , for k > 0. Let L ∈ Σ 2k , and let A be a t-round local algorithm such that: Recall that all labellings i , i = 1, . . . , 2k, are of size at most c log n for some c ≥ 0. We construct an algorithm A that simulates A for a protocol that does not need the last universal quantifier on 2k . The first labelling 1 consists of some correct 1 for A, with the aforementioned additional label that encodes a spanning tree x (rooted at an arbitrary node) and the value of the number of nodes in G. Regarding the remaining labellings, for each 2i−1 assigned by the disprover, the prover assigns 2i as in the protocol for A, ignoring the bits padded to 1 for creating 1 . After the labellings have been assigned, each node v gathers its radius-t neighbourhood B G (v, t). Then, it virtually assigns every possible combination of (c log n)-bit labellings 2k (u) to each node u ∈ B G (v, t), and simulates A at v to check whether it accepts or rejects with this labelling. If every simulation accepts, then A accepts at v, else it rejects. Since every nodes generate all possible 2k labellings in its neighbourhood, we get that A(G, 1 , 2 , . . . , 2k−1 ) accepts , which places L in Σ 2k−1 . The proof of Π 2k+1 = Π 2k is similar by using the first existential quantifier (which appears in second position) to certify the number of nodes in the graph. For the case of Π 1 , the nodes use the value of the number of nodes directly provided by the oracle #node.
A consequence of Theorem 1 is that only of the classes Σ k for odd k, and Π k for even k, are worth investigating. Definition 1. We define the classes (Λ k ) k≥0 as follows: In particular, Λ 0 = Π 0 = LD. By definition, we get Λ k ⊆ Λ k+1 for every k ≥ 0, as the distributed algorithm can simply ignore the first label.
Definition 2. The local hierarchy is defined as LH = ∪ k≥0 Λ k .

Complementary classes
We define the complement classes co-Λ k , for k ≥ 0, as co-Λ k = {L :L ∈ Λ k }. Note that, due to the asymmetric nature of distributed decision (unanimous acceptance, but not rejection), simply reversing the individual decision of an algorithm deciding L is generally not appropriate to decideL. Nevertheless, we show that an additional existential quantifier is sufficient to reverse any decision, implying the following theorem.
Proof. The proof uses a spanning tree certificate to reverse the decision, in a way similar to the proof that the complement of LD is contained in logLCP (i.e., according to our terminology, co-Λ 0 ⊆ Λ 1 ) due to Göös and Suomela [14]. Let L ∈ Λ k , and let A be a t-round local algorithm deciding L ∈ Λ k using labels on at most c log n bits. We construct an algorithm A which simulates A, but uses an additional label k+1 to reverse the decisions made by A. Let us assume that k is even (as it will appear clear later, the proof is essentially the same for k odd). We have that (G, x) ∈ L ⇐⇒ ∀ 1 , ∃ 2 , . . . , ∃ k , A(G, x, 1 , 2 , . . . , k ) = 1, with all labels i 's of size at most c log n for some constant c ≥ 0. In Algorithm A , the prover and the disprover essentially switch their roles. From the above, we have The prover for A always follows the disprover for A, and can always pick labellings 1 , 3 , . . . , k−1 such that there is a rejecting node if and only if (G, x) / ∈ L. In the protocol for A , the prover sets k+1 to be a spanning tree rooted at one such rejecting node v. Every other node u = v simply checks that k+1 constitutes a proper encoding of a spanning tree, and rejects if not. If all nodes u = v accept, then k+1 is indeed a proper spanning tree, and it only remains to check that v rejects in A. To this end, the node v designated as the root of the spanning tree encoded by k+1 gathers all labellings in its radius-t neighbourhood, and computes A(G, x, v, 1 , 2 , . . . , k ). If A rejects at v, we set A to accept at v, and, otherwise, we set A to reject at v.
As discussed in Section 2, the spanning tree can be encoded using O(log n) bits. All labellings 1 , 2 , . . . , k have size at most c log n, therefore all labels of A are of size at most c log n for some c ≥ c. The protocol is correct, as a rejecting node exists in A if and only if (G, x) / ∈ L, and A correctly accepts in this case. If (G, x) ∈ L, then we have that, for every choice the prover can make, the disprover can always choose its labellings so that A accepts. Thus, if the spanning tree k+1 is correct, the root of that tree will indeed detect that it is an accepting node in A, and so reject in A .
The following theorem shows that, for every k ≥ 0, and every language L in Λ k ∩ co-Λ k , there is an algorithm deciding L such that an instance (G, x) ∈ L is accepted at all nodes, and an (G, x) / ∈ L is rejected at all nodes.
Theorem 4. Let k ≥ 1, and let L ∈ Λ k ∩ co-Λ k . Then there exists a local algorithm A such that, for every instance (G, x), and for every v ∈ V (G), Proof. Assume first that k is even. Since L ∈ Λ k ∩ co-Λ k , there exist two local algorithms B and B such that and Now we construct the following protocol for deciding L in an unanimous manner. If (G, x) ∈ L, then the prover assigns the labels as in (1). Instead, if (G, x) / ∈ L, then the prover assigns the labels as in (2). In addition, the first bit of k tells which algorithm the nodes should use, with 0 for B and 1 for B . Now, the decision algorithm A proceeds as follows. For each node v, if v and all neighbours of v have the same flag B or B , then v simulates B (with the first bit of k ignored), and outputs B(G, v, x, 1 , . . . , k ). Conversely, v and all the neighbour of v have the same flag B , then v simulates B and outputs B (G, v, x, 1 , . . . , k ). Finally, if the neighbourhood of v contains both flags B and B , then that node outputs the value of its own flag (i.e., 0 or 1). In other words, any k -labelling with non-consistent flag is rejecting, though not unanimously so.
It remains to check that A behaves correctly when the flag in k is consistent. By construction, from (1) and (2), and from the way A uses B and B , we get that the left to right implication in the statement of the theorem is satisfied: there is always a way to label to graph so that yes-instances are accepted everywhere, and no-instances are rejected everywhere.
For the other direction, let f (v) denote the flag-bit of the label k at node v. We consider the two cases of whether (G, x) ∈ L or not. First, assume that (G, x) ∈ L, but f (v) = B for all nodes v. Since every node is simulating B and reversing its decision, it follows from (2) that (G, x) ∈ L ⇐⇒ ∃ 1 , ∀ 2 , . . . , ∀ k , ∃v, B (G, v, x, 1 , 2 , . . . , k ) = 0.
That is, if (G, x) ∈ L, then the disprover can force some node to accept, even if all nodes are consistently running the wrong algorithm, B .
Conversely, assume that (G, x) / ∈ L, but f (v) = B for all nodes v. Similarly to the previous case, since every node is simulating B, it follows from (1) that That is, if (G, x) / ∈ L, then the disprover can force some node to reject. The case for k odd is similar.
In Theorem 7 in the next section, we shall see several example of languages in Λ 1 ∩ co-Λ 1 , in relation with classical optimization problems on graphs. By Theorem 4, all of these languages can be decided unanimously.

Separation results
From the previous results in this section, we get that the local hierarchy LH = ∪ k≥0 Λ k has a typical "crossing ladder" as depicted on Figure 1. In addition, we can show that some of the inclusions are strict. Indeed, it is known for long that LD is strictly included in Λ 1 (for instance, 2-colourability ∈ Λ 1 \LD). Also, Λ 0 ∪co-Λ 0 is strictly included in co-Λ 1 . Indeed, for instance, non-3-colourability ∈ co-Λ 1 \(Λ 0 ∪co-Λ 0 ). Therefore, all inclusions between LD and co-LD and the classes at the first level are strict. Moreover, it is known [14] that non-3-colourability / ∈ Λ 1 , implying that 3-colourability / ∈ co-Λ 1 . On the other hand, both languages are in Λ 2 , by application of Theorem 2. As a consequence, both are also in co-Λ 2 . Therefore, all inclusions between the classes at the first and second levels are strict.
For k ≥ 2, separating the classes at the kth level from the classes at the next level appears to be not straightforward. In particular, all classical counting arguments used to separate the three first levels (i.e., levels 0, 1, and 2) fail. On the other hand, we show that if Λ k = Λ k+1 for some k, then LH collapses to the kth level.
Theorem 5. If there exists k ≥ 0 such that Λ k = Λ k+1 , then Λ i = Λ k for all i > k, that is, LH collapses at the kth level.
On the other hand, by definition, (G, x) ∈ L if and only if there exists such that (G, (x, )) ∈L. Using Algorithm B, the latter is equivalent to ∃ k , B(G, (x, ), 1 , 2 , . . . , k ) = 1. Now, the two existential quantifiers on and 1 can be combined into one to get a protocol establishing L ∈ Λ k , a contradiction.
Finally, we show that there are languages outside LH. In fact, this result holds, even if we restrict ourselves to languages with inputs 0 or 1 on oriented paths, i.e., with identity-assignment where nodes are given consecutive ID from 1 to n. The result follows from the fact that there are "only" 2 2 O(log n) different local algorithms for such n-node instances at any fixed level of LH, while there are 2 2 n different languages on such instances. Theorem 6. There exists a Turing-computable language on 0/1-labelled oriented paths that is outside LH.
Proof. The proof is in two steps. First, using a counting argument, we show that, for any fixed set of parameters, that is, for every level k, every constant c controlling the label size c log n, and every running time t, there is language that cannot be recognized by a protocol with such parameters. Then we combine these languages for various sets of parameters, for building a (Turing-computable) language that cannot be recognized by any protocol of the hierarchy. Claim 2. Let k, c, and t be non negative integers. There exists an integer n, and a language L = L(n, k, c, t) on 0/1-labelled oriented paths that cannot be recognized by a protocol for Λ k running in t rounds using labels of size at most c log n bits.
To establish the claim, notice that an algorithm is simply a mapping from all possible balls (including identifiers, inputs and labels) to binary outputs (accept or reject). On 0/1 inputs, and IDs in [1, n], The number of algorithms for Λ k running in t rounds using labels of size at most c log n bits is at most 2 2 β log(n) , where β = β(k, c, t) depends only on k, c, and t. On the other hand, the number of languages on words of size n is exactly 2 2 n . Let n be such that 2 2 β(k,c,t) log n < 2 2 n . By the pigeon-hole principle, there exists a languages that cannot be decided by any algorithm for Λ k running in t rounds using labels of size at most c log n bits. This completes the proof of the claim.
Let m be a nonnegative integer, and let S(n, m) be the set of languages on oriented paths with n nodes that cannot be recognized by a protocol with k = c = t = m. By Claim 2, for every m there exists n such that S(n, m) is not empty. We strengthen this by observing the following two points. First, if S(n, m) is non empty, then for every m < m, the set S(n, m ) is non-empty as well, since the protocol for m could be simulated with parameter m. Second, if S(n, m) is non-empty, then, for every n > n, the set S(n , m) is also non-empty. Indeed, let L ∈ S(n, m), and let us consider the language L composed of the set of words in L padded with zeros. If L has an algorithm, then we could modify this algorithm to get an algorithm recognizing L.
Let us define µ(n) as the largest integer m such that S(n, m) is non-empty, and ν(m) the smallest integer n such that S(n, m) is non-empty. Given n and m such that S(n, m) = ∅, let L(n, m) be the smallest language of S(n, m) according to the lexicographic ordering. Finally, let L = (∪ n≥1 L(n, µ(n)).
We first show that L is a distributed language, i.e., that it is Turing-computable. We describe the algorithm deciding L. The algorithm, given an n-bit string X, computes µ(n) by enumerating all m's in increasing order, by trying, for each of them, all local algorithms with parameter m, and by checking whether S(n, m) = ∅. This algorithm eventually finds m such that S(n, m) = ∅, giving µ(n) = m − 1. Then the algorithm computes L(n, µ(n)), and accepts X if and only if X ∈ L(n, µ(n)).
We complete the proof by showing that L / ∈ LH. Suppose, for the sake of contradiction, that L ∈ LH. Then there exists a local algorithm A deciding L ∈ Λ k , running in t rounds using labels of size at most c log n bits, for some k, c, and t. Let m = max{k, c, t}. We can transform A to decide L ∈ Λ m , running in m rounds using labels of size at most m log n bits.
Let us consider the restriction L of L on words of size ν(m). By definition, L = L(ν(m), µ(ν(m))), and this language cannot be recognized by a local algorithm with parameter µ(ν(m)). On the other hand, µ(ν(m)) ≥ m, and therefore L cannot be recognized by an algorithm of parameter m either. In particular, L cannot be recognized by A, a contradiction. Therefore L / ∈ LH.

Positive results
In this section, we precisely identify the position of some relevant problems for distributed computing in the local hierarchy.

Optimization problems
Given an optimization problem π on graphs (e.g., finding a minimum dominating set), one defines two distinct distributed languages: the language opt π (resp., adm π ) is composed of all configurations (G, x) such that x encodes an optimal (resp., admissible) solution for π in graph G. The minimum-weight spanning tree (MST) problem, which is one of the most studied problem in the context of network computing [16,17,18], is a typical example of optimization problems that we aim at considering in this section, but many other problems such as maximum independent set, max-cut, etc., are also of our interest. We show that, for any optimization problem π, if deciding whether a candidate solution for π is admissible is "easy", and if the objective function for π has some natural additive form, then opt π ∈ co-Λ 1 , and thus opt π ∈ Λ 2 .
Theorem 7. Let π be an optimization problem on graphs. If the following two properties are satisfied: (a) adm π ∈ Λ 1 ∩ co-Λ 1 , and (b) the value to the objective function for π is the sum, over all nodes, of an individual value at each node which can be computed locally and encoded on O(log n) bits, then opt π ∈ co-Λ 1 .
Proof. Let us first prove the following fact. Suppose that every node u of a graph G = (V, E) is given a value x u on O(log n) bits, and a value s u also on O(log n) bits. Checking whether s u = v∈V x v for every node u can be achieved by a Λ 1 -algorithm. We describe the algorithm, with, once again, certificates based on a spanning tree. Given a (rooted) spanning tree T , every node u is given the certificate for T , along with the weight v∈V (Tu) x v of its subtree T u . The node u checks that (1) the spanning tree certificates are locally correct, (2) its value s u is equal to s v for each neighbour v, and (3) that the given weight of its subtree is the sum of the weights of the subtrees rooted at its children, plus x u . The root r also checks that the weight of the entire tree is equal to the given value s r . If one of these properties does not hold at some node, then that node rejects. It follows that every node accepts if and only if s u = v∈V x v for every node u. Note that this gathering technique can be extended to functions different from the sum, such as min or max. Now, let π be an optimization problem on graphs satisfying the conditions of the theorem. To prove opt π ∈ co-Λ 1 , we show that opt π ∈ Λ 1 . We describe what certificates are assigned to the nodes by the prover, given an instance (G, x) ∈ opt π . Note that such instance may satisfy either x is not admissible in G, or x is admissible but not optimal.
• If (G, x) / ∈ adm π , then the prover flags each node with ⊥, and assigns certificates for proving that (G, x) / ∈ adm π , which is possible thanks to Condition (a).
• Otherwise, i.e., (G, x) ∈ adm π \ opt π , the prover flags each node with , and assigns certificates for proving that (G, x) ∈ adm π and (G, x ) ∈ adm π , where x is an arbitrary optimal solution. The latter two sets of certificates can be assigned thanks to Condition (a). Finally, the prover assigns certificates using the gathering technique to certify the values of the objective function for both x and x .
The nodes then check that all these certificates are consistent, and, in the case with flag , that indeed the objective function for x is better than the one for x. If any of these conditions does not hold at some node, then that node rejects. As a consequence, all the nodes accept if and only if (G, x) / ∈ opt π . Thus opt π ∈ Λ 1 .
Let us give concrete examples of problems satisfying hypotheses (a) and (b). In fact, most classical optimization problems are satisfying these hypotheses, and all the ones typically investigated in the framework of local computing (cf. the survey [31]) do satisfy (a) and (b).
Corollary 8. Let π be one of the following optimization problems: maximum independent set, minimum dominating set, maximum matching, max-cut, or min-cut. Then opt π ∈ co-Λ 1 .
Proof. In view of Theorem 7, it is sufficient to show that Conditions (a) and (b) are satisfied by each problem in this list. Each of the problems maximum independent set, minimum dominating set, and maximum matching has an easy encoding: a bit that has value 1 if the node is in the set, and zero otherwise. These problems satisfies adm π ∈ Λ 0 , because each node can check that the local condition specifying admissible solutions holds. It follows that Condition (a) is satisfied for all these three optimization problems. The two cut problems are even easier. The input is a bit that describe on which part of the cut the node is, and every input is admissible as every partition of the nodes defines a cut.
Regarding Condition (b), the objective function of maximum independent set, as well as of minimum dominating set, is just the sum of a 0-1 function at each node (0 if not in the set, and 1 otherwise). For maximum matching, as well as for both cut problems, the objective function can be defined as the sum, over all nodes, of half the number of edges adjacent to the node that are involved in the solution.
The following other corollary of Theorem 7 deals with two specific optimization problems, namely travelling salesman and MST. The former illustrates a significant difference between the local hierarchy defined from distributed graph automata in [26], and the one in this paper. Indeed, we show that travelling salesman is at the second level of our hierarchy, while it does not even belong to the graph automata hierarchy (as Hamiltonian cycle is not in MSO). Let travelling salesman be the distributed language formed of all configurations (G, x) where G is a weighted graph, and x is an Hamiltonian cycle C in G of minimum weight (i.e., at node u, x(u) is the pair of edges incident to u in C). Similarly, let mst be the distributed language formed of all configurations (G, x) where G is a weighted graph, and x is a MST T in G (i.e., at node u, x(u) is the parent of u in T ). Note that the case of MST is also particularly interesting. Indeed, mst is known to be in LCP(log 2 (n)) [16], but not in Λ 1 = LCP(log(n)) [17]. Note also that, for mst, it is possible to trade locality for the size of the certificates, as it was established in [17] that one can use logarithmic certificates to certify mst in a logarithmic number of rounds. A particular consequence of Theorem 7 is the following.
Corollary 9. mst ∈ co-Λ 1 and travelling salesman ∈ co-Λ 1 for weighted graphs with weights bounded by a polynomial in n.
Proof. As for Corollary 8, it is sufficient to prove that both languages satisfy the two conditions of Theorem 7. Condition (b) is satisfied for both as their objective function can be defined as the sum, over all nodes, of half the sum of the weights of the edges incident to the node that are involved in the solution (which can be stored on O(log n) bits as long as all weights have values polynomial in n).
To prove Condition (a), we need to show that checking whether a collection C of edges is an Hamiltonian cycle (resp., is a spanning tree) is in Λ 1 ∩ co-Λ 1 . We already noticed earlier in the paper that spanning tree ∈ Λ 1 . To prove that hamiltonian cycle ∈ Λ 1 , we describe a protocol for that language. Given an Hamiltonian cycle C, the prover elects an arbitrary node r of C as a root, picks a spanning tree T rooted at r, and orients C to form a 1-factor (each node has out-degree 1 in C). The certificate at node u is the identity of r, the distance from u to r in C traversed according to the chosen orientation, and the certificate for T . The verification algorithm at node u checks the tree T (including whether u agrees with all its neighbours on the identity of r). Node u also checks that one of its neighbours in C is one hop closer to r, while the other neighbour in C is one hop farther away from r. Node r checks that one of its neighbours in C is at distance 1 from it in C, while the other it at some distance > 1. Also, a node with distance 0 in C checks that it is the root of T . If all these tests are passed, then node u accepts, otherwise it rejects. The check of T guaranties that there is a unique node r. The check of the hop distance along C guaranties that all nodes are on the same cycle. If both checks are satisfies then C is a unique cycle, covering all nodes, and therefore C is an Hamiltonian cycle. Now, it remains to prove that spanning tree ∈ co-Λ 1 and hamiltonian cycle ∈ co-Λ 1 . Let F be a collection of edges that is not forming a spanning tree of G. The following certificates are assigned to the nodes. If F is not spanning all nodes, then let r be a node not spanned by F , and let T be a spanning tree rooted at r. The certificate of every node u is a pair (f (u), c(u)) where the flag f (u) = 0, and c(u) is the certificate for T . If F is spanning all nodes, but contains a cycle C, then let r be a node of C, let us orient the edges of C in a consistent manner, and let T be a spanning tree rooted at r. The certificate at node u is a pair (f (u), c(u)) where f (u) = 1, and c(u) is a certificate for T . In addition, if u belongs to C, then u received as part of its certificate its distance to r in the oriented cycle C. Finally, If F is spanning forest, then let F = {T 1 , . . . , T k } be the trees in F , with k ≥ 2, and root each one at an arbitrary node r i , i = 1, . . . , k. Let T (resp., T ) be a spanning tree rooted at r 1 (resp., r 2 ). For every i ∈ {1, . . . , k}, the certificate at node u of T i is a 4-tuple (f (u), index(u), c(u), c (u)) where f (u) = 2, index(u) = i, and c(u) (resp., c (u)) is the certificate for T (resp., T ).
The verification procedure is as follows. All nodes checks that they have the same flag f . A node detecting that flags differ rejects. A node with flag 0 checks the tree certificates, and the root of the tree checks that it is not spanned by F . A node with flag 1 checks the tree certificates, and the root r of the tree checks that it belongs to C (i.e., was given distance 0 on the cycle). The root r also checks that it has one neighbours in C at distance 1, and another neighbour at distance > 1. All other nodes on C check consistency of the distance counter. Finally, a node with flag 2 checks its tree certificates. The root of T checks that it is of index 1, while the root of T checks that it is of index 2. Moreover, every node checks that its incident edges in F have extremities with same index. In the three cases, if all tests are passed, the node accepts, otherwise it rejects.
By construction, if F is not a spanning tree, then all nodes accepts. Instead, if F is a spanning tree, then certificates with different flags cannot yield all nodes to accept since two adjacent nodes with different flags both reject. A flag 0 cannot yield all nodes to accept because the non spanned node does not exist. Similarly, a flag 1 cannot yield all nodes to accept because the cycle does does not exist, and a flag 2 cannot yield all nodes to accept because there are no two different connected components, and hence no two trees T and T rooted at nodes with different indexes.
The proof of hamiltonian cycle ∈ co-Λ 1 proceeds similarly. Therefore, both Conditions

Non-trivial automorphism
The graph automorphism problem is the problem of testing whether a given graph has a nontrivial automorphism (i.e., an automorphism † different from the identity). Let nontrivial automorphism be the distributed language composed of the (connected) graphs that admit such an automorphism. It is known that this language is maximally hard for locally checkable proofs, in the sense that it requires proofs with size Ω(n 2 ) bits [14]. Nevertheless, we prove that this language remains relatively low in the local hierarchy.
Proof. The first label 1 at node u is an integer that is supposed to be the identity of the image of u by a nontrivial automorphism. Let us denote by φ : V (G) → V (G) the mapping induced by 1 . We are left with proving that deciding whether a given φ is a nontrivial automorphism of G is in Λ 2 . Thanks to Theorem 2, it is sufficient to prove that this decision can be made in co-Λ 1 . Thus let us prove that checking that (G, φ) is not a nontrivial automorphism is in Λ 1 . If φ is the identity, then the certificate can just encode a flag with this information, and each node u checks that φ(u) is equal to its own ID. So assume now that φ is distinct from the identity, but is not an automorphism. To certify this, the prover assigns to each node a set of at most four spanning tree certificates, that "broadcast" to all nodes the identity of at most four nodes witnessing that φ is not an automorphism. Specifically, if φ(u) = φ(v) with u = v, then the certificates are for three spanning trees, respectively rooted at u, v, and φ(u), and if {u, v} ∈ E(G) is mapped to , then the certificates are for four spanning trees, respectively rooted at u, v, φ(u), and φ(v). Checking such certificates can be done locally, and thus checking that (G, φ) is not a nontrivial automorphism is in Λ 1 , from which it follows that nontrivial automorphism ∈ Λ 3 .

Problems from the polynomial hierarchy
As the local hierarchy LH is inspired by the polynomial hierarchy, it is natural to ask about the existence of connections between their respective levels. In this section, we show that some connections can indeed be established, for central problems in the polynomial hierarchy. For instance, let k ≥ 0, and let us consider all (connected) graphs G = (V, E) such that there exists X ⊆ V , |X| ≥ k, such that, for every S ⊆ X, there is a cycle C in G containing all vertices in S, but none in X \ S. Such graphs have Cycle-VC-dimension, VC cycle (G), at least k. Deciding whether, given G and k, we have VC cycle (G) ≥ k is Σ P 3 -complete [28,29]. Let cycle-vc-dimension be the distributed language composed of all configurations (G, k) such that all nodes of G have the same input k, and VC cycle (G) ≥ k.
Proof. The existence of the set X can be certified setting a flag at each node in X, together with a tree T X spanning X for proving that |X| ≥ k. Given S ⊆ X, the cycle C can be certified in the same way as the Hamiltonian cycle in the proof of Corollary 9.
Recall that QBF-k-SAT is the problem of whether a formula of the type ∃y 1 , ∀y 2 , ..., Qy k Φ(y 1 , ..., y k ), † Recall that φ : V (G) → V (G) is an automorphism of G if and only if φ is a bijection, and, for every two nodes u and v, we have: can be satisfied, where the y i 's are sets of literals on (distinct) boolean variables, Φ is formula from propositional logic (we can assume, w.l.o.g., that Φ is in conjunctive normal form), and Q is the universal quantifier if k is even, and the existential quantifier otherwise. The literals in y i are said to be at the ith level. This problem is complete for the kth level Σ P k of PH. It can be rephrased equivalently into a graph problem, by defining the distributed language qbf-sat k formed of all configurations (G, x) where V (G) = C ∪ L, where C is for clauses, and L is for literals, and there is edge between the positive and negative literals of a same variable, as well as an edge between each clause and all the literals appearing in the clause. More precisely, the input x(u) of a node u in G can be of the form ( , i, s) where stands for "literal", i ∈ {1, . . . , k} is the level of that literal, and s ∈ {+, −} indicates whether the literal is positive or negative, or of the form (c) where c stands for "clause". There is an edge between ( , i, s) and ( , i,s) for all literals, and there is an edge between each clause node (i.e., labelled (c)) and all the nodes ( , i, s) such that the corresponding literal appears in that clause. We set (G, x) ∈ qbf-sat k if and only if the corresponding formula is in QBF-k-SAT.
Proof. For a configuration in qbf-sat k , the certificates are given to the nodes in the natural way, assigning their values to the literals at odd levels. Each literal node can locally check that its value is the opposite of the one given to its negation, and each clause node can locally check that it is linked to at least one literal that has value true.

Connections to descriptive complexity
The notion of locality is an important subject when considering expressibility of different logics on graphs, as illustrated by the locality result of Schwentick and Barthelmann [30] for first-order logic. It is then a natural question to ask which are the logics that express properties in LH. A first answer was given by Gs and Suomela [14] who proved that all properties expressible in existential-MSO are in logLCP. One can then expect that LH contains MSO, and it is indeed the case. An easy way to prove this fact is to use the recent result of Reiter [26].
Proof. As we pointed out earlier in the text, distributed graph automata (DGA) are based on a combination of hypotheses, some weaker than the LOCAL model, and other ones stronger. On the one hand, all computation and communication steps in DGA can be simulated in the LOCAL model. On the other hand, the decision mechanism in DGA is stronger than the one typically used in local decision, as far as distributed network computing is concerned. Specifically, in our framework, the nodes output true or false (i.e., 1 or 0), and the instance is accepted if and only if all the outputs are true. That is, the decision mechanism is simply the conjunction of all the outputs, whereas, in DGA, the outputs belong to an arbitrary finite set S, and the decision mechanism is an arbitrary function f from the set O of the outputs to {accept, reject}. Note that O is a set, and therefore a same output at two different nodes appears only once in O.
Let us consider a language L at level k of the DGA hierarchy. We show that this language is at level at most k + 1 of LH. Indeed we can run exactly the same protocol as in DGA, but the decision decision mechanism. Nevertheless, the decision mechanism can be simulated with an additional existential quantifier certifying a spanning tree T that is used to gather all the outputs of the nodes produced by the DGA protocol, in a way similar to the one in Claim 1: each node checks that its set of outputs is the union of the output sets of its children in T . The root of T stores the entire set O (which can be done using O(|S| log |S|) = O(1) bits), computes f (O), and accepts or rejects accordingly.

Conclusion
In this paper, we have defined and analyzed a local hierarchy LH of decision generalizing proof-labelling schemes and locally checkable proofs. Using this hierarchy, we have defined interactive local decision protocols enabling to decrease the size of the distributed certificates. We have defined the hierarchy for O(log n)-bit size labels, mostly because this extends the class LogLCP in [14], and because this size fits with the classical CONGEST model for distributed computation [25]. However, most of our results can be extended to labels on O(B(n)) bits, for B(n) larger than log n. In particular, it is worth noticing that the existence of a language L outside LH holds as long as B = o(n).
The main open problem is whether LH has infinitely many levels, or whether it collapses at some level Λ k . We know that the latter can only happen for k ≥ 2, and thus it would be quite interesting to know whether Λ 3 = Λ 2 . In particular, all the typical counting arguments used to separate Λ 2 from Λ 1 , or, more generally, to give lower bounds on the label size in proof-labelling schemes or locally checkable proofs appear to be too weak for separating Λ 3 from Λ 2 . A separation result for Λ 3 = Λ 2 would thus probably provide new tools and concepts for the design of space lower bounds in the framework of distributed computing.