In the very easy-to-read [1], Kuperberg shows that, conditioned on the Generalized Riemann Hypothesis, knottedness is in $\mathsf{NP}$. As I understand the proof, given a knot-diagram of a knot $K$, the certificate is both a prime $p$ and a solution mod $p$ to a set of polynomial equations $S=0$ specifying a noncommutative representation of $\pi_1$ onto $SU(2)$ - that is, one $2\times 2$ matrix $M_i$ over $\mathbb{Z}/p$ for each generator $i$ of the knot group $\pi_1(S^3\setminus K)$ such that the generators don't all commute and satisfy the relations of the knot group.

Kuperberg's proof relies on the GRH only to show that the size (bit-complexity) of $p$ is polynomial in the number of generators of $\pi_1$. His proof is a combination of the algebraic topology results of [2] along with the number theory of [3]. He states in passing that because, modulo GRH, [3] puts problems involving showing the existence of solutions to systems of polynomial equations over $\mathbb{C}$ in the *Arthur-Merlin* complexity class, that also puts knottedness in $\mathsf{AM}$ as well.

Studying up on [1] and [3], I suspect that the $\mathsf{AM}$ protocol that Kuperberg has in mind entails finding a prime $p$ such that not only $S=0$ modulo $p$, but also, for some random hash $H$ onto a codomain of an appropriately large size, $H(p)=0$. This shows that there are a *lot* of primes $p$ such that $S=0$ mod $p$ (Kuperberg's $\mathsf{NP}$ certificate only needs one prime $p$.)

Such a protocol from [3] is based on the same universal hashing used in [4], which gives a *public coin* protocol for Graph Non Isomorphism based on hashing a random permutation of one of the two given adjacency matrices.

However, as addressed in a question from a sister site, it's not immediately clear how to convert the results of [3] into a interactive protocol, wherein, in order to convince the verifier, the prover is *not allowed* to see the random choices made by the verifier.

Is there a way for a (polynomially bounded) verifier to secretly flip a coin and present a (non-polynomially bounded) prover with one of two knot diagrams such that if only one of the diagrams represents the unknot whereas the other knot diagram is not the unknot, the prover can answer which coin was flipped correctly 100% of the time, but if both knot diagrams are of the unknot, the prover only has a 50% chance of answering correctly?

It is worth noting that [1] also mentions another withdrawn attempt at an interactive proof of knottedness. The withdrawn attempt also relied on keeping the verifier's choices hidden from the prover's; instead of presenting knot diagrams, the withdrawn attempt presented random triangulations of *either* a double of $S^3$ *or* of $S^3\setminus T(K_1)$ for some tubular neighborhood $T$ of the test knot $K_1$.

**References**

[1] Greg Kuperberg. Knottedness is in $\mathsf{NP}$, modulo GRH, 2011.

[2] Peter Kronheimer and Tomasz Mrowka. Dehn surgery, the Fundamental Group and $SU(2)$, 2004.

[3] Pascal Koiran. Hilbert’s Nullstellensatz is in the Polynomial Hierarchy, 1996

[4] Shafi Goldwasser and Michael Sipser. Private Coins versus Public Coins in Interactive Proof Systems, 1986.

hidingthe Verifier’s random bits from the Prover, forget the word “private-coin”, it does not mean what you are seeking. $\endgroup$4more comments