Feature/protostar ivc

plonkish_backend/Cargo.toml

@@ -35,8 +35,7 @@ pprof = { version = "0.11.0", features = ["criterion", "flamegraph"] }
 halo2_wrong_v2 = { git = "https://github.com/han0110/halo2wrong.git", branch = "feature/for-benchmark-v2", package = "halo2wrong" }
 
 [features]
-default = ["parallel", "frontend-halo2"]
-
+default = ["parallel", "frontend-halo2", "timer"]
 timer = ["dep:ark-std", "ark-std?/print-trace", "halo2_proofs?/print-trace"]
 parallel = ["dep:rayon"]
 frontend-halo2 = ["dep:halo2_proofs"]

plonkish_backend/src/accumulation/protostar.rs

@@ -1,6 +1,6 @@
 use crate::{
     accumulation::{
-        protostar::ProtostarStrategy::{Compressing, NoCompressing},
+        protostar::ProtostarStrategy::{Compressing, NoCompressing, CompressingWithSqrtPowers},
         PlonkishNark, PlonkishNarkInstance,
     },
     backend::PlonkishBackend,
@@ -22,7 +22,7 @@ pub mod hyperplonk;
 pub mod ivc;
 
 #[derive(Clone, Debug)]
-pub struct Protostar<Pb, const STRATEGY: usize = { Compressing as usize }>(PhantomData<Pb>);
+pub struct Protostar<Pb, const STRATEGY: usize = { CompressingWithSqrtPowers as usize }>(PhantomData<Pb>);
 
 #[derive(Clone, Copy, Debug, Default, Serialize, Deserialize)]
 pub enum ProtostarStrategy {
@@ -33,12 +33,12 @@ pub enum ProtostarStrategy {
     Compressing = 1,
     // TODO:
     // Compressing verification with square-root optimization applied as described in 2023/620 section 3.5
-    // CompressingWithSqrtPowers = 3,
+    CompressingWithSqrtPowers = 2,
 }
 
 impl From<usize> for ProtostarStrategy {
     fn from(strategy: usize) -> Self {
-        [NoCompressing, Compressing][strategy]
+        [NoCompressing, Compressing, CompressingWithSqrtPowers][strategy]
     }
 }
 
@@ -107,28 +107,41 @@ where
         num_witness_polys: usize,
         num_challenges: usize,
     ) -> Self {
-        let zero_poly = Pcs::Polynomial::from_evals(vec![F::ZERO; 1 << k]);
+
+        let witness_zero_poly = Pcs::Polynomial::from_evals(vec![F::ZERO; 1 << k]);
+        let error_zero_poly = match strategy {
+            NoCompressing => Pcs::Polynomial::from_evals(vec![F::ZERO; 1 << k]),
+            Compressing => Pcs::Polynomial::from_evals(vec![F::ZERO; 1 << k]),
+            CompressingWithSqrtPowers => Pcs::Polynomial::from_evals(vec![F::ZERO; 1 << (k/2 + 1)])
+        };
+
         Self {
             instance: ProtostarAccumulatorInstance::init(
                 strategy,
                 num_instances,
-                num_witness_polys,
+                num_witness_polys - 1,
                 num_challenges,
             ),
-            witness_polys: iter::repeat_with(|| zero_poly.clone())
+            witness_polys: iter::repeat_with(|| witness_zero_poly.clone())
                 .take(num_witness_polys)
                 .collect(),
-            e_poly: zero_poly,
+            e_poly: error_zero_poly,
             _marker: PhantomData,
         }
     }
 
     fn from_nark(strategy: ProtostarStrategy, k: usize, nark: PlonkishNark<F, Pcs>) -> Self {
         let witness_polys = nark.witness_polys;
+        let zero_poly = match strategy {
+            NoCompressing => Pcs::Polynomial::from_evals(vec![F::ZERO; 1 << k]),
+            Compressing => Pcs::Polynomial::from_evals(vec![F::ZERO; 1 << k]),
+            CompressingWithSqrtPowers => Pcs::Polynomial::from_evals(vec![F::ZERO; 1 << (k/2 + 1)])
+        };
+
         Self {
             instance: ProtostarAccumulatorInstance::from_nark(strategy, nark.instance),
             witness_polys,
-            e_poly: Pcs::Polynomial::from_evals(vec![F::ZERO; 1 << k]),
+            e_poly: zero_poly,
             _marker: PhantomData,
         }
     }
@@ -169,11 +182,11 @@ where
         izip_eq!(&mut self.witness_polys, &rhs.witness_polys)
             .for_each(|(lhs, rhs)| *lhs += (r, rhs));
         izip!(powers(*r).skip(1), [zeta_cross_term_poly, &rhs.e_poly])
-            .for_each(|(power_of_r, poly)| self.e_poly += (&power_of_r, poly));
+            .for_each(|(power_of_r, poly)| self.e_poly += (&power_of_r, poly));   
     }
-
+    
     pub fn instance(&self) -> &ProtostarAccumulatorInstance<F, Pcs::Commitment> {
-        &self.instance
+            &self.instance
     }
 }
 
@@ -215,6 +228,7 @@ where
             compressed_e_sum: match strategy {
                 NoCompressing => None,
                 Compressing => Some(F::ZERO),
+                CompressingWithSqrtPowers => Some(F::ZERO),
             },
         }
     }
@@ -255,6 +269,7 @@ where
             compressed_e_sum: match strategy {
                 NoCompressing => None,
                 Compressing => Some(F::ZERO),
+                CompressingWithSqrtPowers => Some(F::ZERO),
             },
         }
     }

plonkish_backend/src/accumulation/protostar/hyperplonk.rs

@@ -4,13 +4,13 @@ use crate::{
             hyperplonk::{
                 preprocessor::{batch_size, preprocess},
                 prover::{
-                    evaluate_compressed_cross_term_sums, evaluate_cross_term_polys,
-                    evaluate_zeta_cross_term_poly, lookup_h_polys, powers_of_zeta_poly,
+                    evaluate_compressed_cross_term_sums, evaluate_cross_term_polys, evaluate_zeta_root_cross_term_poly,
+                    evaluate_zeta_cross_term_poly, lookup_h_polys, powers_of_zeta_poly, powers_of_zeta_sum_check_poly_lo, powers_of_zeta_sum_check_poly_hi,
                 },
             },
             ivc::ProtostarAccumulationVerifierParam,
             Protostar, ProtostarAccumulator, ProtostarAccumulatorInstance, ProtostarProverParam,
-            ProtostarStrategy::{Compressing, NoCompressing},
+            ProtostarStrategy::{Compressing, NoCompressing, CompressingWithSqrtPowers},
             ProtostarVerifierParam,
         },
         AccumulationScheme, PlonkishNark, PlonkishNarkInstance,
@@ -27,7 +27,7 @@ use crate::{
         PlonkishBackend, PlonkishCircuit, PlonkishCircuitInfo,
     },
     pcs::{AdditiveCommitment, CommitmentChunk, PolynomialCommitmentScheme},
-    poly::multilinear::MultilinearPolynomial,
+    poly::{multilinear::MultilinearPolynomial, Polynomial},
     util::{
         arithmetic::{powers, PrimeField},
         end_timer, start_timer,
@@ -37,10 +37,10 @@ use crate::{
     Error,
 };
 use rand::RngCore;
-use std::{borrow::BorrowMut, hash::Hash, iter};
+use std::{borrow::BorrowMut, hash::Hash, iter::{self, repeat}};
 
 mod preprocessor;
-mod prover;
+pub mod prover;
 
 impl<F, Pcs, const STRATEGY: usize> AccumulationScheme<F> for Protostar<HyperPlonk<Pcs>, STRATEGY>
 where
@@ -188,8 +188,8 @@ where
 
         // Round n+2
 
-        let (zeta, powers_of_zeta_poly, powers_of_zeta_comm) = match strategy {
-            NoCompressing => (None, None, None),
+        let (zeta, zeta_pow_lsqrt,  powers_of_zeta_poly_lo, powers_of_zeta_poly_hi, powers_of_zeta_comm) = match strategy {
+            NoCompressing => (None, None, None, None, None),
             Compressing => {
                 let zeta = transcript.squeeze_challenge();
 
@@ -202,12 +202,44 @@ where
 
                 (
                     Some(zeta),
+                    None,
                     Some(powers_of_zeta_poly),
+                    None,
+                    Some(powers_of_zeta_comm),
+                )
+            },
+            CompressingWithSqrtPowers => {
+                assert_eq!(pp.num_vars % 2, 0, "L is not a perfect square");
+                let zeta = transcript.squeeze_challenge();
+                let l_sqrt = 1 << (pp.num_vars/2);
+                let zeta_pow_lsqrt = zeta.pow(&[l_sqrt as u64]);
+
+                let timer = start_timer(|| "powers_of_zeta_sqrt_poly");
+                let (powers_of_zeta_lo, powers_of_zeta_sum_check_lo) = powers_of_zeta_sum_check_poly_lo(pp.num_vars/2, zeta);
+                let (powers_of_zeta_hi, powers_of_zeta_sum_check_hi) = powers_of_zeta_sum_check_poly_hi(pp.num_vars/2, zeta_pow_lsqrt);
+                let powers_of_zeta_concat = MultilinearPolynomial::new([powers_of_zeta_lo.into_evals(), powers_of_zeta_hi.into_evals()].concat());
+                end_timer(timer);
+
+                // let powers_of_zeta_comm_lo =
+                // Pcs::commit_and_write(&pp.pcs, &powers_of_zeta_lo, transcript)?;
+
+                // let powers_of_zeta_comm_hi = 
+                // Pcs::commit_and_write(&pp.pcs, &powers_of_zeta_hi, transcript)?;
+
+
+                let powers_of_zeta_comm =
+                Pcs::commit_and_write(&pp.pcs, &powers_of_zeta_concat, transcript)?;
+
+                (
+                    Some(zeta),
+                    Some(zeta_pow_lsqrt),
+                    Some(powers_of_zeta_sum_check_lo),
+                    Some(powers_of_zeta_sum_check_hi),
                     Some(powers_of_zeta_comm),
                 )
             }
         };
-
+                               
         // Round n+3
 
         let alpha_primes = powers(transcript.squeeze_challenge())
@@ -222,19 +254,22 @@ where
                 .chain(theta_primes)
                 .chain(Some(beta_prime))
                 .chain(zeta)
+                .chain(zeta_pow_lsqrt)
                 .chain(alpha_primes)
                 .collect(),
             iter::empty()
                 .chain(witness_comms)
                 .chain(lookup_m_comms)
                 .chain(lookup_h_comms)
                 .chain(powers_of_zeta_comm)
+                //.chain(powers_of_zeta_comm_hi)
                 .collect(),
             iter::empty()
                 .chain(witness_polys)
                 .chain(lookup_m_polys)
                 .chain(lookup_h_polys.into_iter().flatten())
-                .chain(powers_of_zeta_poly)
+                .chain(powers_of_zeta_poly_lo)
+                .chain(powers_of_zeta_poly_hi)
                 .collect(),
         ))
     }
@@ -326,6 +361,47 @@ where
                 );
                 end_timer(timer);
             }
+            CompressingWithSqrtPowers => {
+                let timer = start_timer(|| "evaluate_zeta_root_cross_term_poly");
+                let zeta_cross_term_poly = evaluate_zeta_root_cross_term_poly(
+                    pp.num_vars/2,
+                    *num_alpha_primes,
+                    accumulator,
+                    incoming,
+                );
+                end_timer(timer);
+
+                let timer = start_timer(|| {
+                    let len = cross_term_expressions.len();
+                    format!("evaluate_compressed_cross_term_sums-{len}")
+                });
+                let compressed_cross_term_sums = evaluate_compressed_cross_term_sums(
+                    cross_term_expressions,
+                    pp.num_vars,
+                    &pp.preprocess_polys,
+                    accumulator,
+                    incoming,
+                );
+                end_timer(timer);
+
+                let zeta_cross_term_comm =
+                    Pcs::commit_and_write(&pp.pcs, &zeta_cross_term_poly, transcript)?;
+                transcript.write_field_elements(&compressed_cross_term_sums)?;
+
+                // Round 0
+
+                let r = transcript.squeeze_challenge();
+
+                let timer = start_timer(|| "fold_compressed_sqrt");
+                accumulator.fold_compressed(
+                    incoming,
+                    &zeta_cross_term_poly,
+                    &zeta_cross_term_comm,
+                    &compressed_cross_term_sums,
+                    &r,
+                );
+                end_timer(timer);
+            }
         }
 
         Ok(())
@@ -357,7 +433,7 @@ where
 
         // Round 0..n
 
-        let mut witness_comms = Vec::with_capacity(vp.num_witness_polys.iter().sum());
+        let mut witness_comms: Vec<<Pcs as PolynomialCommitmentScheme<F>>::Commitment> = Vec::with_capacity(vp.num_witness_polys.iter().sum());
         let mut challenges = Vec::with_capacity(vp.num_challenges.iter().sum());
         for (num_polys, num_challenges) in
             vp.num_witness_polys.iter().zip_eq(vp.num_challenges.iter())
@@ -383,14 +459,24 @@ where
 
         // Round n+2
 
-        let (zeta, powers_of_zeta_comm) = match strategy {
-            NoCompressing => (None, None),
+        let (zeta, powers_of_zeta_comm_lo, powers_of_zeta_comm_hi) = match strategy {
+            NoCompressing => (None, None, None),
             Compressing => {
                 let zeta = transcript.squeeze_challenge();
 
                 let powers_of_zeta_comm = Pcs::read_commitment(&vp.pcs, transcript)?;
 
-                (Some(zeta), Some(powers_of_zeta_comm))
+                (Some(zeta), Some(powers_of_zeta_comm), None)
+            },
+            CompressingWithSqrtPowers => {
+                let zeta = transcript.squeeze_challenge();
+
+                let powers_of_zeta_comm_lo = Pcs::read_commitment(&vp.pcs, transcript)?;
+
+                let powers_of_zeta_comm_hi = Pcs::read_commitment(&vp.pcs, transcript)?;
+
+
+                (Some(zeta), Some(powers_of_zeta_comm_lo), Some(powers_of_zeta_comm_hi))
             }
         };
 
@@ -414,7 +500,8 @@ where
                 .chain(witness_comms)
                 .chain(lookup_m_comms)
                 .chain(lookup_h_comms)
-                .chain(powers_of_zeta_comm)
+                .chain(powers_of_zeta_comm_lo)
+                .chain(powers_of_zeta_comm_hi)
                 .collect(),
         );
         let incoming = ProtostarAccumulatorInstance::from_nark(*strategy, nark);
@@ -440,6 +527,22 @@ where
 
                 let r = transcript.squeeze_challenge();
 
+                accumulator.fold_compressed(
+                    &incoming,
+                    &zeta_cross_term_comm,
+                    &compressed_cross_term_sums,
+                    &r,
+                );
+            }
+            CompressingWithSqrtPowers => {
+                let zeta_cross_term_comm = Pcs::read_commitment(&vp.pcs, transcript)?;
+                let compressed_cross_term_sums =
+                    transcript.read_field_elements(*num_cross_terms)?;
+
+                // Round n+4
+
+                let r = transcript.squeeze_challenge();
+
                 accumulator.fold_compressed(
                     &incoming,
                     &zeta_cross_term_comm,
@@ -609,6 +712,7 @@ where
             .chain(match vp.strategy {
                 NoCompressing => None,
                 Compressing => Some(1),
+                CompressingWithSqrtPowers => Some(1),
             })
             .collect();
         let num_challenges = {
@@ -623,13 +727,17 @@ where
                 .chain(match vp.strategy {
                     NoCompressing => None,
                     Compressing => Some(vec![1]),
+                    CompressingWithSqrtPowers => Some(vec![1]),
                 })
                 .chain([vec![vp.num_alpha_primes]])
                 .collect()
         };
+
+
         Self {
             vp_digest: N::ZERO,
             strategy: vp.strategy,
+            num_vars: vp.vp.num_vars,
             num_instances: vp.vp.num_instances.clone(),
             num_witness_polys,
             num_challenges,