Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

A divide-and-conquer sumcheck protocol

Christophe Levrat, Tanguy Medevielle, Jade Nardi

TL;DR

Fold-DCS presents a sumcheck protocol for multivariate polynomials with logarithmic round complexity, achieved via divide-and-conquer folding and staged consistency checks. The approach exchanges multivariate polynomials and relies on a polynomial commitment scheme to enable practical batched evaluations, with Zeromorph (KZG-based) as a concrete instantiation. The paper provides a formal completeness and soundness analysis, analyzes ROM complexities, and details how folding preserves correctness while reducing rounds. It also discusses mixing Fold-DCS with the standard sumcheck and outlines a concrete Zeromorph-based instantiation, including mapping multivariate polynomials to multilinear forms for commitment. The work has potential impact on zk-SNARKs and IP/IOP constructions by lowering round complexity at the cost of commitment-based practicality.

Abstract

We present a new sumcheck protocol called Fold-DCS (Fold-Divide-and-Conquer-Sumcheck) for multivariate polynomials based on a divide-and-conquer strategy. Its round complexity and soundness error are logarithmic in the number of variables, whereas they are linear in the classical sumcheck protocol. This drastic improvement in number of rounds and soundness comes at the expense of exchanging multivariate polynomials, which can be alleviated using polynomial commitment schemes. We first present Fold-DCS in the PIOP model, where the prover provides oracle access to a multivariate polynomial at each round. We then replace this oracle access in practice with a multivariate polynomial commitment scheme; we illustrate this with an adapted version of the recent commitment scheme Zeromorph [KT24], which allows us to replace most of the queries made by the verifier with a single batched evaluation check.

A divide-and-conquer sumcheck protocol

TL;DR

Fold-DCS presents a sumcheck protocol for multivariate polynomials with logarithmic round complexity, achieved via divide-and-conquer folding and staged consistency checks. The approach exchanges multivariate polynomials and relies on a polynomial commitment scheme to enable practical batched evaluations, with Zeromorph (KZG-based) as a concrete instantiation. The paper provides a formal completeness and soundness analysis, analyzes ROM complexities, and details how folding preserves correctness while reducing rounds. It also discusses mixing Fold-DCS with the standard sumcheck and outlines a concrete Zeromorph-based instantiation, including mapping multivariate polynomials to multilinear forms for commitment. The work has potential impact on zk-SNARKs and IP/IOP constructions by lowering round complexity at the cost of commitment-based practicality.

Abstract

We present a new sumcheck protocol called Fold-DCS (Fold-Divide-and-Conquer-Sumcheck) for multivariate polynomials based on a divide-and-conquer strategy. Its round complexity and soundness error are logarithmic in the number of variables, whereas they are linear in the classical sumcheck protocol. This drastic improvement in number of rounds and soundness comes at the expense of exchanging multivariate polynomials, which can be alleviated using polynomial commitment schemes. We first present Fold-DCS in the PIOP model, where the prover provides oracle access to a multivariate polynomial at each round. We then replace this oracle access in practice with a multivariate polynomial commitment scheme; we illustrate this with an adapted version of the recent commitment scheme Zeromorph [KT24], which allows us to replace most of the queries made by the verifier with a single batched evaluation check.

Paper Structure

This paper contains 36 sections, 5 theorems, 42 equations, 2 figures, 2 tables.

Table of Contents

  1. Introduction
  2. Comparison with the standard sumcheck protocol
  3. Choosing a multivariate polynomial commitment scheme
  4. Mixing the standard and $\mathsf{Fold}\textsf{-}\mathsf{DCS}$ approaches
  5. Preliminaries
  6. Interactive proofs and sumcheck protocols
  7. The standard sumcheck protocol
  8. A sumcheck protocol with logarithmic round complexity
  9. A simplified version of the protocol
  10. Base case
  11. General case
  12. A few observations
  13. Intuition behind the soundness of $\mathsf{DCS}_\mu$
  14. The protocol $\mathsf{Fold}\textsf{-}\mathsf{DCS}$
  15. Folding for better complexity
  16. ...and 21 more sections

Key Result

lemma 1

Let $f\in \mathbb{F}[\boldsymbol{x}]$ be a nonzero $\mu$-variate polynomial of total degree $D$. For uniformly picked $\boldsymbol{a}\in H^\mu$,

Figures (2)

  • Figure 1: The tree of functions involved in $\mathsf{DCS}_\mu$ for $\mu\in \left\{8,4,2\right\}$. The children with dashed line from their parents are not computed by $\mathsf{P}$ and are dealt as virtual oracles in the protocol.
  • Figure 2: Tree of functions involved in the first two rounds of the protocol $\mathsf{Fold}\textsf{-}\mathsf{DCS}$.

Theorems & Definitions (23)

  • definition 1: Perfect completeness
  • definition 2: Soundness
  • definition 3
  • definition 4
  • remark 1
  • definition 5: $(\mu,d,D)$-Polynomial IOP
  • lemma 1: Schwartz-Zippel
  • proposition 1: Soundness
  • proof
  • remark 2
  • ...and 13 more