Accumulation

Introduction

The trick below was originally described in Halo, however we are going to base this post on the abstraction of “accumulation schemes” described by Bünz, Chiesa, Mishra and Spooner in Proof-Carrying Data from Accumulation Schemes, in particular the scheme in Appendix A. 2.

Relevant resources include:

• Proof-Carrying Data from Accumulation Schemes by Benedikt Bünz, Alessandro Chiesa, Pratyush Mishra and Nicholas Spooner.
• Recursive Proof Composition without a Trusted Setup (Halo) by Sean Bowe, Jack Grigg and Daira Hopwood.

This page describes the most relevant parts of these papers and how it is implemented in Pickles/Kimchi. It is not meant to document the low-level details of the code in Pickles, but to describe what the code aims to do, allowing someone reviewing / working on this part of the codebase to gain context.

Interactive Reductions Between Relations

The easiest way to understand “accumulation schemes” is as a set of interactive reductions between relations. An interactive reduction $\mathcal{R}\to {\mathcal{R}}^{\prime }$ proceeds as follows:

• The prover/verifier starts with some statement $\text{x}$, the prover additionally holds $\text{w}$.
• They then run some protocol between them.
• After which, they both obtain ${\text{x}}^{\prime }$ and the prover obtains ${\text{w}}^{\prime }$

Pictorially:

With the security/completeness guarantee that:

$$(\text{x},\text{w})\in \mathcal{R}⟺({\text{x}}^{\prime },{\text{w}}^{\prime })\in {\mathcal{R}}^{\prime }$$

Except with negligible probability.

In other words: we have reduced membership of $\mathcal{R}$ to membership of ${\mathcal{R}}^{\prime }$ using interaction between the parties: unlike a classical Karp-Levin reduction the soundness/completeness may rely on random coins and multiple rounds. Foreshadowing here is a diagram/overview of the reductions (the relations will be described as we go) used in Pickles:

As you can see from Fig. 2, we have a cycle of reductions (following the arrows) e.g. we can reduce a relation “${\mathcal{R}}_{\mathsf{Acc},\vec{G}}$” to itself by applying all 4 reductions. This may seem useless: why reduce a relation to itself?

However the crucial point is the “in-degree” (e.g. n-to-1) of these reductions: take a look at the diagram and note that any number of ${\mathcal{R}}_{\mathsf{Acc},\vec{G}}$ instances can be reduced to a single ${\mathcal{R}}_{\mathsf{PCD},d}$ instance! This ${\mathcal{R}}_{\mathsf{PCD},d}$ instance can then be converted to a single ${\mathcal{R}}_{\mathsf{Acc},\vec{G}}$ by applying the reductions (moving “around the diagram” by running one protocol after the other):

$${\mathcal{R}}_{\mathsf{PCD},d}\to {\mathcal{R}}_{\mathsf{IPA},\ell }\to {\mathcal{R}}_{\mathsf{IPA},1}\to {\mathcal{R}}_{\mathsf{Acc},\vec{G}}$$

Note: There are many examples of interactive reductions, an example familiar to the reader is PlonK itself: which reduces circuit-satisfiability ${\mathcal{R}}_C$ ($\text{x}$ is the public inputs and $\text{w}$ is the wire assignments) to openings of polynomial commitments ${\mathcal{R}}_{\mathsf{PCD},d}$ (${\text{x}}^{\prime }$ are polynomial commitments and evaluation points, $\text{w}$ is the opening of the commitment).

A Note On Fiat-Shamir: All the protocols described here are public coin and hence in implementation the Fiat-Shamir transform is applied to avoid interaction: the verifiers challenges are sampled using a hash function (e.g. Poseidon) modelled as a reprogrammable random oracle.

Polynomial Commitment Openings ${\mathcal{R}}_{\mathsf{PCD},d}$

Recall that the polynomial commitment scheme (PCS) in Kimchi is just the trivial scheme based on Pedersen commitments. For Kimchi we are interested in “accumulation for the language (${\mathcal{R}}_{\mathsf{PCS},d}$) of polynomial commitment openings”, meaning that:

$$\left(\text{x}=(C,x,y),\text{w}=(\vec{f})\right)\in {\mathcal{R}}_{\mathsf{PCS},d}⟺\left\{\begin{array}{rl}C& =⟨\vec{f},\vec{G}⟩\\ y& =\sum _{i=0}{f}_i\cdot x^i\end{array}\right\}$$

Where $\vec{f}$ is a list of coefficients for a polynomial $f(X):={\sum }_i{f}_i\cdot X^i$.

This is the language we are interested in reducing: providing a trivial proof, i.e. sending $\vec{f}$ requires linear communication and time of the verifier, we want a poly-log verifier. The communication complexity will be solved by a well-known folding argument, however to reduce computation we are going to need the “Halo trick”.

First a reduction from PCS to an inner product relation.

Reduction 1: ${\mathcal{R}}_{\mathsf{PCS},d}\to {\mathcal{R}}_{\mathsf{IPA},\ell }$

Formally the relation of the inner product argument is:

$$\left(\text{x}=(C,\vec{G},H,\vec{x}),\text{w}=(\vec{f})\right)\in {\mathcal{R}}_{\mathsf{IPA},\ell }⟺\left\{\begin{array}{rl}y& =⟨\vec{f},\vec{x}⟩\in \mathbb{F}\\ \wedge & \\ C& =⟨\vec{f},\vec{G}⟩+[y]\cdot H\in \mathbb{G}\end{array}\right\}$$

We can reduce $\left(\text{x}=(C,x,y),\text{w}=(\vec{f})\right)\in {\mathcal{R}}_{\mathsf{PCS},d}$ to ${\mathcal{R}}_{\mathsf{IPA},\ell }$ with $d=\ell$ as follows:

• Define $\vec{x}=(1,x,x^2,x^3,\dots ,x^{\ell -1})$, so that $y=f(x)=⟨\vec{f},\vec{x}⟩$,
• The verifier adds the evaluation $y$ to the commitment “in a new coordinate” as follows:
  1. Verifier picks $H\stackrel{\$}{\leftarrow }\mathbb{G}$ and sends $H$ to the prover.
  2. Verifier updates $C\leftarrow C+[y]\cdot H$

Intuitively we sample a fresh $H$ to avoid a malicious prover “putting something in the $H$-position”, because he must send $y$ before seeing $H$, hence he would need to guess $H$ before-hand. If the prover is honest, we should have a commitment of the form:

$$C=⟨\vec{f},\vec{G}⟩+[y]\cdot H=⟨\vec{f},\vec{G}⟩+[⟨\vec{x},\vec{f}⟩]\cdot H\in \mathbb{G}$$

Note: In some variants of this reduction $H$ is chosen as $[\delta ]\cdot J$ for a constant $J\in \mathbb{G}$ where $\delta \stackrel{\$}{\leftarrow }\mathbb{F}$ by the verifier, this also works, however we (in Kimchi) simply hash to the curve to sample $H$.

Reduction 2 (Incremental Step): ${\mathcal{R}}_{\mathsf{IPA},\ell }\to {\mathcal{R}}_{\mathsf{IPA},\ell /2}$

Note: The folding argument described below is the particular variant implemented in Kimchi, although some of the variable names are different.

The folding argument reduces a inner product with $\ell$ (a power of two) coefficients to an inner product relation with $\ell /2$ coefficients. To see how it works let us rewrite the inner product in terms of a first and second part:

$$⟨\vec{f},\vec{x}⟩=⟨{\vec{f}}_L,{\vec{x}}_L⟩+⟨{\vec{f}}_R,{\vec{x}}_R⟩\in \mathbb{F}$$

Where ${\vec{f}}_L=(f_1,\dots ,f_{\ell /2})$ and ${\vec{f}}_R=(f_{\ell /2+1},\dots ,f_{\ell })$, similarly for $\vec{x}$.

Now consider a “randomized version” with a challenge $\alpha \in \mathbb{F}$ of this inner product:

$$\begin{array}{rl}⟨{\vec{f}}_L+{\alpha }^{-1}\cdot {\vec{f}}_R,{\vec{x}}_L+\alpha \cdot {\vec{x}}_R⟩& ={\alpha }^{-1}\cdot ⟨{\vec{f}}_R,{\vec{x}}_L⟩\\ & +\underline{\left(⟨{\vec{f}}_R,{\vec{x}}_R⟩+⟨{\vec{f}}_L,{\vec{x}}_L⟩\right)}\\ & +\alpha \cdot ⟨{\vec{f}}_L,{\vec{x}}_R⟩\end{array}$$

The term we care about (underlined in magenta) is $⟨{\vec{f}}_R,{\vec{x}}_R⟩+⟨{\vec{f}}_L,{\vec{x}}_L⟩=v$, the other two terms are cross-term garbage. The solution is to let the prover provide commitments to the cross terms to “correct” this randomized splitting of the inner product before seeing $\alpha$: the prover commits to the three terms (one of which is already provided) and the verifier computes a commitment to the new randomized inner product. i.e.

The prover sends commitment to $⟨{\vec{f}}_R,{\vec{x}}_L⟩$ and $⟨{\vec{f}}_L,{\vec{x}}_R⟩$ cross terms:

$$L=⟨{\vec{f}}_R\Vert \vec{0},\vec{G}⟩+[⟨{\vec{f}}_R,{\vec{x}}_L⟩]\cdot H$$

$$R=⟨\vec{0}\Vert {\vec{f}}_L,\vec{G}⟩+[⟨{\vec{f}}_L,{\vec{x}}_R⟩]\cdot H$$

The verifier samples $\alpha \stackrel{\$}{\leftarrow }\mathbb{F}$ and defines:

$$\begin{array}{rl}{C}^{\prime }& =[{\alpha }^{-1}]\cdot L+C+[\alpha ]\cdot R\\ & \\ & =⟨{\alpha }^{-1}\cdot ({\vec{f}}_R\Vert \vec{0})+({\vec{f}}_L\Vert {\vec{f}}_R)+\alpha \cdot (\vec{0}\Vert {\vec{f}}_L),\vec{G}⟩\\ & +\left[{\alpha }^{-1}\cdot ⟨{\vec{f}}_R,{\vec{f}}_L⟩+⟨{\vec{f}}_L,{\vec{x}}_L⟩+⟨{\vec{f}}_R,{\vec{x}}_R⟩+\alpha \cdot ⟨{\vec{f}}_L,{\vec{x}}_R⟩\right]\cdot H\\ & \\ & =⟨\left({\vec{f}}_L+{\alpha }^{-1}{\vec{f}}_R\right)\Vert \left(\alpha \cdot {\vec{f}}_L+{\vec{f}}_R\right),\vec{G}⟩\\ & +\left[⟨{\vec{f}}_L+{\alpha }^{-1}\cdot {\vec{f}}_R,{\vec{x}}_L⟩+⟨\alpha \cdot {\vec{f}}_L+{\vec{f}}_R,{\vec{x}}_R⟩\right]\cdot H\end{array}$$

The final observation in the folding argument is simply that:

$$\alpha {\vec{f}}_L+{\vec{f}}_R=\alpha \cdot \left({\vec{f}}_L+{\alpha }^{-1}\cdot {\vec{f}}_R\right)=\alpha \cdot {\vec{f}}^{\prime }$$

Hence we can replace occurrences of $\alpha {\vec{f}}_L+{\vec{f}}_R$ by $\alpha {\vec{f}}^{\prime }$, with this look at the green term:

$$\begin{array}{rl}⟨{\vec{f}}_L+{\alpha }^{-1}\cdot {\vec{f}}_R,{\vec{x}}_L⟩+⟨\alpha \cdot {\vec{f}}_L+{\vec{f}}_R,{\vec{x}}_R⟩& =⟨{\vec{f}}^{\prime },{\vec{x}}_L⟩+⟨\alpha \cdot {\vec{f}}^{\prime },{\vec{x}}_R⟩\\ & =⟨{\vec{f}}^{\prime },{\vec{x}}_L⟩+⟨{\vec{f}}^{\prime },\alpha \cdot {\vec{x}}_R⟩\\ & =⟨{\vec{f}}^{\prime },{\vec{x}}_L+\alpha \cdot {\vec{x}}_R⟩\\ & =⟨{\vec{f}}^{\prime },{\vec{x}}^{\prime }⟩\end{array}$$

By defining ${\vec{x}}^{\prime }={\vec{x}}_L+\alpha \cdot {\vec{x}}_R$. We also rewrite the blue term in terms of ${\vec{f}}^{\prime }$ similarly: $$\begin{array}{rl}⟨\left({\vec{f}}_L+{\alpha }^{-1}\cdot {\vec{f}}_R\right)\Vert \left(\alpha \cdot {\vec{f}}_L+{\vec{f}}_R\right),\vec{G}⟩& =⟨{\vec{f}}^{\prime }\Vert (\alpha \cdot {\vec{f}}^{\prime }),\vec{G}⟩\\ & =⟨{\vec{f}}^{\prime }\Vert {\vec{f}}^{\prime },{\vec{G}}_L\Vert ([\alpha ]\cdot {\vec{G}}_R)⟩\\ & =⟨{\vec{f}}^{\prime },{\vec{G}}^{\prime }⟩\end{array}$$

By defining ${\vec{G}}^{\prime }={\vec{G}}_L+[\alpha ]\cdot {\vec{G}}_R$. In summary by computing: $$\begin{array}{rl}{C}^{\prime }& \leftarrow [{\alpha }^{-1}]\cdot L+C+[\alpha ]\cdot R\in \mathbb{G}\\ {\vec{f}}^{\prime }& \leftarrow {\vec{f}}_L+{\alpha }^{-1}\cdot {\vec{f}}_R\in {\mathbb{F}}^{\ell /2}\\ {\vec{x}}^{\prime }& \leftarrow {\vec{x}}_L+\alpha \cdot {\vec{x}}_R\in {\mathbb{F}}^{\ell /2}\\ {\vec{G}}^{\prime }& \leftarrow {\vec{G}}_L+[\alpha ]\cdot {\vec{G}}_R\in {\mathbb{G}}^{\ell /2}\\ y^{\prime }& \leftarrow ⟨\overrightarrow{f^{\prime }},{\vec{x}}^{\prime }⟩\end{array}$$

We obtain a new instance of the inner product relation (of half the size):

$$(\text{x}=(C^{\prime },{\vec{G}}^{\prime },H,{\vec{x}}^{\prime }),\text{w}=({\vec{f}}^{\prime },y^{\prime }))\in {\mathcal{R}}_{\mathsf{IPA},\ell /2}$$

At this point the prover could send ${\vec{x}}^{\prime }$, ${\vec{f}}^{\prime }$ to the verifier who could verify the claim:

1. Computing ${\vec{G}}^{\prime }$ from $\alpha$ and $\vec{G}$
2. Computing $C^{\prime }$ from ${\vec{f}}^{\prime }$, $v$ and $H$
3. Checking $y^{\prime }\stackrel{?}{=}⟨{\vec{f}}^{\prime },{\vec{x}}^{\prime }⟩$

This would require half as much communication as the naive proof. A modest improvement…

However, we can iteratively apply this transformation until we reach an instance of constant size:

Reduction 2 (Full): ${\mathcal{R}}_{\mathsf{IPA},\ell }\to \dots \to {\mathcal{R}}_{\mathsf{IPA},1}$

That the process above can simply be applied again to the new $(C^{\prime },{\vec{G}}^{\prime },H,{\vec{x}}^{\prime },v)\in {\mathcal{R}}_{\mathsf{IPA},\ell /2}$ instance as well. By doing so $k={\log }_2(\ell )$ times the total communication is brought down to $2k$ $\mathbb{G}$-elements until the instance consists of $(C,\vec{G},H,\vec{x})\in {\mathcal{R}}_{\mathsf{IPA},1}$ at which point the prover simply provides the witness ${\vec{f}}^{\prime }\in \mathbb{F}$.

Because we need to refer to the terms in the intermediate reductions we let ${\vec{G}}^{(i)}$, ${\vec{f}}^{(i)}$, ${\vec{x}}^{(i)}$ be the ${\vec{G}}^{\prime }$, ${\vec{f}}^{\prime }$, ${\vec{x}}^{\prime }$ vectors respectively after $i$ recursive applications, with ${\vec{G}}^{(0)}$, ${\vec{f}}^{(0)}$, ${\vec{x}}^{(0)}$ being the original instance. We will drop the vector arrow for ${\vec{G}}^{(k)}$ (similarly, for $f,x$), since the last step vector has size $1$, so we refer to this single value instead. We denote by ${\alpha }_i$ the challenge of the $i$’th application.

Reduction 3: ${\mathcal{R}}_{\mathsf{IPA},1}\to {\mathcal{R}}_{\mathsf{Acc},\overrightarrow{G}}$

While the proof for ${\mathcal{R}}_{\mathsf{IPA},\ell }$ above has $O(\log (\ell ))$-size, the verifiers time-complexity is $O(\ell )$:

• Computing $G^{(k)}$ from ${\vec{G}}^{(0)}$ using $\vec{\alpha }$ takes $O(\ell )$.
• Computing $x^{(k)}$ from ${\vec{x}}^{(0)}$ using $\vec{\alpha }$ takes $O(\ell )$.

The rest of the verifiers computation is only $O(\log (\ell ))$, namely computing:

• Sampling all the challenges $\alpha \stackrel{\$}{\leftarrow }\mathbb{F}$.
• Computing $C^{(i)}\leftarrow [{\alpha }_i^{-1}]\cdot L^{(i)}+C^{(i-1)}+[{\alpha }_i]\cdot R^{(i)}$ for every $i$

However, upon inspection, the more pessimistic claim that computing ${\vec{x}}^{(k)}$ takes $O(\ell )$ turns out to be false:

Claim: Define $h(X):={\prod }_{i=0}^{k-1}\left(1+{\alpha }_{k-i}\cdot X^{2^i}\right)$, then $x^{(k)}=h(x)$ for all $x$. Therefore, $x^{(k)}$ can be evaluated in $O(k)=O(\log \ell )$.

Proof: This can be verified by looking at the expansion of $h(X)$. Define $\{h_i{\}}_{i=0}^l$ to be the coefficients of $h(X)$, that is $h(X)={\sum }_{i=1}^{\ell }{h}_i\cdot X^{i-1}$. Then the claim is equivalent to $x^{(k)}={\sum }_{i=1}^{\ell }{h}_i\cdot x^{i-1}$. Let $\vec{b}(i,j)$ denote the $j$th bit in the bit-decomposition of the index $i$ and observe that: $$h_i=\prod _{j=1}^k{\vec{\alpha }}_{k-j}^{b(i,j)}\text{where}\sum _j\vec{b}(i,j)\cdot 2^j=i$$ Now, compare this with how a $k$th element of $x^{(i)}$ is constructed: $$\begin{array}{rl}{x}_k^{(1)}& =x_k^{(0)}+{\alpha }_1\cdot x_{n/2+k}^{(0)}\\ x_k^{(2)}& =x_k^{(1)}+{\alpha }_2\cdot x_{n/4+k}^{(2)}\\ & =x_k^{(0)}+{\alpha }_1\cdot x_{n/2+k}^{(0)}+{\alpha }_2\cdot (x_{n/4+k}^{(0)}+{\alpha }_1\cdot x_{n/2+n/4+k}^{(0)})\\ & =\sum _{i=0}^3{x}_{i\cdot \frac{n}{4}+k}^{(0)}\cdot \left(\prod _{j=0}^1{\alpha }_j^{b(i,j)}\right)\end{array}$$ Recalling that $x_k^{(0)}=x^k$, it is easy to see that this generalizes exactly to the expression for $h_i$ that we derived later, which concludes that evaluation through $h(X)$ is correct.

Finally, regarding evaluation complexity, it is clear that $h$ can be evaluated in $O(k=\log \ell )$ time as a product of $k$ factors. This concludes the proof.

The “Halo Trick”

The “Halo trick” resides in observing that this is also the case for ${\vec{G}}^{(k)}$: since it is folded the same way as ${\vec{x}}^{(k)}$. It is not hard to convince one-self (using the same type of argument as above) that:

$$G^{(k)}=⟨\vec{h},\vec{G}⟩$$

Where $\vec{h}$ is the coefficients of $h(X)$ (like $\vec{f}$ is the coefficients of $f(X)$), i.e. $h(X)={\sum }_{i=1}^{\ell }{h}_i{X}^{i-1}$

For notational convince (and to emphasise that they are 1 dimensional vectors), define/replace:

$$U={\vec{G}}^{(k)}\in \mathbb{G},c={\vec{f}}^{(k)}\in \mathbb{F},h(x)={\vec{x}}^{(k)}\in \mathbb{F}$$

With this we define the “accumulator language” which states that “$U$” was computed correctly:

$$\left(\text{x}=(U,\vec{\alpha }),\text{w}=ϵ\right)\in {\mathcal{R}}_{\mathsf{Acc},\vec{G}}⟺\left\{\begin{array}{rl}h(X)& :=\prod _{i=0}^{k-1}\left(1+{\alpha }_{k-i}\cdot X^{2^i}\right)\wedge U=⟨\vec{h},\vec{G}⟩\end{array}\right\}$$

Note: since there is no witness for this relation anyone can verify the relation (in $O(\ell )$ time) by simply computing $⟨\vec{h},\vec{G}⟩$ in linear time. Instances are also small: the size is dominated by $\vec{\alpha }$ which is $|\vec{\alpha }|={\log }_2\ell$.

In The Code: in the Kimchi code $\vec{\alpha }$ is called prev_challenges and $U$ is called comm, all defined in the RecursionChallenge struct.

Now, using the new notation rewrite ${\mathcal{R}}_{\mathsf{IPA},1}$ as:

$$\left(\text{x}=(C,U,H,h(x)),\text{w}=(c)\right)\in {\mathcal{R}}_{\mathsf{IPA},1}⟺\left\{\begin{array}{rl}y& =c\cdot h(x)\\ \wedge C& =[c]\cdot U+[y]\cdot H\in \mathbb{G}\end{array}\right\}$$

Note: It is the same relation, we just replaced some names ($c={\vec{f}}^{(k)}$, ${\vec{x}}^{(k)}=h(x)$) and simplified a bit: inner products between 1-dimensional vectors are just multiplications.

We now have all the components to reduce ${\mathcal{R}}_{\mathsf{IPA},1}\to {\mathcal{R}}_{\mathsf{Acc},\vec{G}}$ (with no soundness error) as follows:

1. Prover sends $c,U$ to the verifier.
2. Verifier does:
   • Compute $y\leftarrow h(x)\cdot c$
   • Checks $C\stackrel{?}{=}[c]\cdot U+[y]\cdot H$
3. Output $(\text{x}=(U,\vec{\alpha }),\text{w}=ϵ)\in {\mathcal{R}}_{\mathsf{Acc},\vec{G}}$

Note: The above can be optimized, in particular there is no need for the prover to send $U$.

Reduction 4: ${\mathcal{R}}_{\mathsf{Acc},\overrightarrow{G}}\to {\mathcal{R}}_{\mathsf{PCS},d}$

Tying the final knot in the diagram.

The expensive part in checking $(U,\vec{\alpha })\in {\mathcal{R}}_{\mathsf{Acc},\vec{G}}$ consists in computing $⟨\vec{h},\vec{G}⟩$ given the $\vec{\alpha }$ describing $h(X)$: first expanding $\vec{\alpha }$ into $\vec{h}$, then computing the MSM. However, by observing that $U=⟨\vec{h},\vec{G}⟩$ is actually a polynomial commitment to $h(X)$, which we can evaluate at any point using $O(\log \ell )$ operations, we arrive at a simple strategy for reducing any number of such claims to a single polynomial commitment opening:

1. Prover sends $U^{(1)},\dots ,U^{(n)}$ to the verifier.
2. Verifier samples $\zeta \stackrel{\$}{\leftarrow }\mathbb{F}$, $u\stackrel{\$}{\leftarrow }\mathbb{F}$ and computes:

$$\begin{array}{rl}y& =\sum _i{\alpha }^{i-1}\cdot h^{(i)}(u)\in \mathbb{F}\\ C& =\sum _i[{\alpha }^{i-1}]\cdot U^{(i)}\in \mathbb{G}\end{array}$$ Alternatively: $$\begin{array}{rl}y& =\sum _i{u}^{i-1}\cdot h^{(i)}(\zeta )\in \mathbb{F}\\ C& =\sum _i[u^{i-1}]\cdot U^{(i)}\in \mathbb{G}\end{array}$$

And outputs the following claim:

$$(C,\zeta ,y)\in {\mathcal{L}}_{\mathsf{PCS},\ell }$$

i.e. the polynomial commitment $C$ opens to $y$ at $\zeta$. The prover has the witness:

$$f(X)=\sum _i{\alpha }^{i-1}\cdot h^{(i)}(X)$$

Why is this a sound reduction: if one of the $U^{(i)}$ does not commit to $h^{(i)}$ then they disagree except on at most $\ell$ points, hence $f^{(i)}(\zeta )\ne h^{(i)}(\zeta )$ with probability $\ell /|\mathbb{F}|$. Taking a union bound over all $n$ terms leads to soundness error $\frac{n\ell }{|\mathbb{F}|}$ – negligible.

The reduction above requires $n$ $\mathbb{G}$ operations and $O(n\log \ell )$ $\mathbb{F}$ operations.

Support for Arbitrary Polynomial Relations

Additional polynomial commitments (i.e. from PlonK) can be added to the randomized sums $(C,y)$ above and opened at $\zeta$ as well: in which case the prover proves the claimed openings at $\zeta$ before sampling the challenge $u$. This is done in Kimchi/Pickles: the $\zeta$ and $u$ above is the same as in the Kimchi code. The combined $y$ (including both the $h(\cdot )$ evaluations and polynomial commitment openings at $\zeta$ and $\zeta \omega$) is called combined_inner_product in Kimchi.

This ${\mathcal{R}}_{\mathsf{PCS},\ell }$ instance reduced back into a single ${\mathcal{R}}_{\mathsf{Acc},\vec{G}}$ instance, which is included with the proof.

Multiple Accumulators (PCD Case)

From the section above it may seem like there is always going to be a single ${\mathcal{R}}_{\mathsf{Acc},\vec{G}}$ instance, this is indeed the case if the proof only verifies a single proof, “Incremental Verifiable Computation” (IVC) in the literature. If the proof verifies multiple proofs, “Proof-Carrying Data” (PCD), then there will be multiple accumulators: every “input proof” includes an accumulator (${\mathcal{R}}_{\mathsf{Acc},\vec{G}}$ instance), all these are combined into the new (single) ${\mathcal{R}}_{\mathsf{Acc},\vec{G}}$ instance included in the new proof: this way, if one of the original proofs included an invalid accumulator and therefore did not verify, the new proof will also include an invalid accumulator and not verify with overwhelming probability.

Note that the new proof contains the (single) accumulator of each “input” proof, even though the proofs themselves are part of the witness: this is because verifying each input proof results in an accumulator (which could then be checked directly – however this is expensive): the “result” of verifying a proof is an accumulator (instance of ${\mathcal{R}}_{\mathsf{Acc},\vec{G}}$) – which can be verified directly or further “accumulated”.

These accumulators are the RecursionChallenge structs included in a Kimchi proof. The verifier check the PlonK proof (which proves accumulation for each “input proof”), this results in some number of polynomial relations, these are combined with the accumulators for the “input” proofs to produce the new accumulator.

Accumulation Verifier

The section above implicitly describes the work the verifier must do, but for the sake of completeness let us explicitly describe what the verifier must do to verify a Fiat-Shamir compiled proof of the transformations above. This constitutes “the accumulation” verifier which must be implemented “in-circuit” (in addition to the “Kimchi verifier”), the section below also describes how to incorporate the additional evaluation point $\zeta \cdot \omega$ (“the step”, used by Kimchi to enforce constraints between adjacent rows). Let $\mathcal{C}\subseteq \mathbb{F}$ be the challenge space (128-bit GLV decomposed challenges):

1. PlonK verifier on $\pi$ outputs polynomial relations (in Purple in Fig. 4).

2. Checking ${\mathcal{R}}_{\mathsf{Acc},\vec{G}}$ and polynomial relations (from PlonK) to ${\mathcal{R}}_{\mathsf{PCS},d}$ (the dotted arrows):

   1. Sample $\zeta \stackrel{\$}{\leftarrow }\mathcal{C}$ (evaluation point) using the Poseidon sponge.

   2. Read claimed evaluations at $\zeta$ and $\omega \zeta$ (PointEvaluations).

   3. Sample $v\stackrel{\$}{\leftarrow }\mathcal{C}$ (commitment combination challenge, polyscale) using the Poseidon sponge.

   4. Sample $u\stackrel{\$}{\leftarrow }\mathcal{C}$ (evaluation combination challenge, evalscale) using the Poseidon sponge.

      • The $(v,u)$ notation is consistent with the Plonk paper where $v$ recombines commitments and $u$ recombines evaluations

   5. Compute $C\in \mathbb{G}$ with $v$ from:

      • $U^{(1)},\dots ,U^{(n)}$ (RecursionChallenge.comm $\in \mathbb{G}$)
      • Polynomial commitments from PlonK (ProverCommitments)

   6. Compute $y_{\zeta }$ (part of combined_inner_product) with $v$ from:

      • The evaluations of $h^{(1)}(\zeta ),\dots ,h^{(n)}(\zeta )$
      • Polynomial openings from PlonK (ProofEvaluations) at $\zeta$

   7. Compute $y_{\zeta \omega }$ (part of combined_inner_product) with $v$ from:

      • The evaluations of $h^{(1)}(\zeta \omega ),\dots ,h^{(n)}(\zeta \omega )$
      • Polynomial openings from PlonK (ProofEvaluations) at $\zeta \cdot \omega$

      At this point we have two PCS claims, these are combined in the next transform.

      At this point we have two claims: $$\begin{array}{rl}(C,\zeta ,y_{\zeta })& \in {\mathcal{L}}_{\mathsf{PCD},d}\\ (C,\zeta \omega ,y_{\zeta \omega })& \in {\mathcal{L}}_{\mathsf{PCD},d}\end{array}$$ These are combined using a random linear combination with $u$ in the inner product argument (see [Different functionalities](/plonk/inner_product_api.html) for details).

3. Checking ${\mathcal{R}}_{\mathsf{PCS},d}\to {\mathcal{R}}_{\mathsf{IPA},\ell }$.

   1. Sample $H\stackrel{\$}{\leftarrow }\mathbb{G}$ using the Poseidon sponge: hash to curve.
   2. Compute $y\leftarrow y_{\zeta }+u\cdot y_{\zeta \omega }$.
   3. Update $C^{\prime }\leftarrow C+[y]\cdot H$.

4. Checking ${\mathcal{R}}_{\mathsf{IPA},\ell }\to {\mathcal{R}}_{\mathsf{IPA},1}$:
   Check the correctness of the folding argument, for every $i=1,\dots ,k$:

   1. Receive $L^{(i)},R^{(i)}\in \mathbb{G}$ (see the vector OpeningProof.lr in Kimchi).
   2. Sample ${\alpha }_i\stackrel{\$}{\leftarrow }\mathcal{C}$ using the Poseidon sponge.
   3. Compute $C^{(i)}=[{\alpha }_i^{-1}]\cdot L+C^{(i-1)}+[{\alpha }_i]\cdot R$ (using GLV endomorphism)
      (Note: to avoid the inversion the element $P=[{\alpha }_i^{-1}]\cdot L$ is witnessed and the verifier checks $[{\alpha }_i]\cdot P=[{\alpha }_i]\cdot ([{\alpha }_i^{-1}]\cdot L)=L$. To understand why computing the field inversion would be expensive see deferred computation)

5. Checking ${\mathcal{R}}_{\mathsf{IPA},1}\to {\mathcal{R}}_{\mathsf{Acc},\vec{G}}$

   1. Receive $c$ form the prover.
   2. Define $h$ from $\vec{\alpha }$ (folding challenges, computed above).
   3. Compute a combined evaluation of the IPA challenge polynomial on two points: $b=h(\zeta )+u\cdot h(\zeta \omega )$
      • Computationally, $b$ is obtained inside bulletproof folding procedure, by folding the vector $b_{\mathsf{init}}$ such that $b_{\mathsf{init},j}={\zeta }^j+v\cdot {\zeta }^j{w}^j$ using the same standard bulletproof challenges that constitute $h(X)$. This $b_{\mathsf{init}}$ is a $v$-recombined evaluation point. The equality is by linearity of IPA recombination.
   4. Compute $y^{\prime }\leftarrow c\cdot b=c\cdot (h(\zeta )+u\cdot h(\zeta \omega ))$, this works since: $$x^{(k)}=x_{\zeta }^{(k)}+u\cdot x_{\zeta \omega }^{(k)}$$ See Different functionalities for more details or the relevant code.
   5. Compute $U\leftarrow C^{(k)}-[y^{\prime }]\cdot H$ (i.e. st. $C^{(k)}=U+[y^{\prime }]\cdot H$)

Note that the accumulator verifier must be proven (in addition to the Kimchi/PlonK verifier) for each input proof.

No Cycles of Curves?

Note that the “cycles of curves” (e.g. Pasta cycle) does not show up in this part of the code: a separate accumulator is needed for each curve and the final verifier must check both accumulators to deem the combined recursive proof valid. This takes the form of passthough data in pickles.

Note however, that the accumulation verifier makes use of both $\mathbb{G}$-operations and $\mathbb{F}$-operations, therefore it (like the Kimchi verifier) also requires deferred computation.