Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Folding Custom Gates with Verifier Input

Aard Vark, Yan X Zhang

TL;DR

The paper addresses the challenge of folding multiple constraint instances in interactive proofs by generalizing Nova-style folding to arbitrary polynomial gates and by introducing verifier input through custom gates. It develops a formal protocol for relaxed AIRs, committed relaxed AIRs, and a single-fold operation, then extends to custom gates with verifier input and applies this framework to folding Halo2 lookups via Origami. The main contributions include a complete protocol for custom gates with verifier randomness, an explicit Origami folding scheme for lookups, and a comparative analysis with Nova, Sangria, and related works. This work advances efficient, scalable verification by enabling lookups to be folded alongside other computations, improving the practicality of zero-knowledge or public-verifier proofs in lookup-heavy circuits.

Abstract

In the context of interactive proofs, a "folding scheme" (popularized by Nova) is a way to combine multiple instances of a constraint system into a single instance, so the validity of the multiple instances can statistically be reduced to the validity of a single one. We show how Nova folding can be generalized to ``custom'' gates and extra rounds of verifier randomness. As an application of this extension, we present Origami, the first (to our knowledge) known example of a folding scheme for lookups.

Folding Custom Gates with Verifier Input

TL;DR

The paper addresses the challenge of folding multiple constraint instances in interactive proofs by generalizing Nova-style folding to arbitrary polynomial gates and by introducing verifier input through custom gates. It develops a formal protocol for relaxed AIRs, committed relaxed AIRs, and a single-fold operation, then extends to custom gates with verifier input and applies this framework to folding Halo2 lookups via Origami. The main contributions include a complete protocol for custom gates with verifier randomness, an explicit Origami folding scheme for lookups, and a comparative analysis with Nova, Sangria, and related works. This work advances efficient, scalable verification by enabling lookups to be folded alongside other computations, improving the practicality of zero-knowledge or public-verifier proofs in lookup-heavy circuits.

Abstract

In the context of interactive proofs, a "folding scheme" (popularized by Nova) is a way to combine multiple instances of a constraint system into a single instance, so the validity of the multiple instances can statistically be reduced to the validity of a single one. We show how Nova folding can be generalized to ``custom'' gates and extra rounds of verifier randomness. As an application of this extension, we present Origami, the first (to our knowledge) known example of a folding scheme for lookups.
Paper Structure (21 sections, 2 theorems, 35 equations, 4 tables)

This paper contains 21 sections, 2 theorems, 35 equations, 4 tables.

Table of Contents

  1. Introduction
  2. Preliminaries
  3. Arithmetization and PAIRs
  4. Commitments
  5. Folding
  6. Homogenization
  7. The Protocol
  8. Relaxed AIR Instances
  9. Committed relaxed AIR
  10. Single Fold for Custom Gates
  11. Custom Gates with Verifier Input
  12. Origami: Folding Lookups
  13. Lookups
  14. Sketch and Example
  15. The Procedure
  16. ...and 6 more sections

Key Result

Proposition 2.1

Let $p(\mathbf{x})$ be a homogenous polynomial of degree $d$ in $n$ variables (where $\mathbf{x} = (x_1, x_2 \ldots, x_n)$). Then there are $d-1$ polynomials $\Delta^1 p, \Delta^2 p, \ldots, \Delta^{d-1} p$ of degree at most $d$ in $2n$ variables such that

Theorems & Definitions (5)

  • Proposition 2.1
  • proof
  • Remark 4.1: Zero-knowledge
  • Theorem A.1
  • proof