From 402af9a91cdb3a1b5019fc857728f19e4f36528c Mon Sep 17 00:00:00 2001 From: iakovenkos Date: Fri, 7 Nov 2025 09:16:31 +0000 Subject: [PATCH 1/5] remove target sum, initial doc clean-up --- .../hypernova/hypernova_verifier.cpp | 7 +------ .../decider_recursive_verifier.cpp | 2 +- .../recursive_verifier_instance.hpp | 4 ---- .../barretenberg/ultra_honk/decider_prover.cpp | 17 ++++++----------- .../barretenberg/ultra_honk/decider_prover.hpp | 3 +-- .../ultra_honk/decider_verifier.cpp | 2 +- .../barretenberg/ultra_honk/prover_instance.hpp | 1 - .../barretenberg/ultra_honk/ultra_verifier.cpp | 1 - .../ultra_honk/verifier_instance.hpp | 5 +---- .../docs/docs/explainers/advanced/chonk.md | 8 ++++---- 10 files changed, 15 insertions(+), 35 deletions(-) diff --git a/barretenberg/cpp/src/barretenberg/hypernova/hypernova_verifier.cpp b/barretenberg/cpp/src/barretenberg/hypernova/hypernova_verifier.cpp index 23ad1c54f472..d8685e498af3 100644 --- a/barretenberg/cpp/src/barretenberg/hypernova/hypernova_verifier.cpp +++ b/barretenberg/cpp/src/barretenberg/hypernova/hypernova_verifier.cpp @@ -90,11 +90,6 @@ SumcheckOutput HypernovaFoldingVerifier::sumcheck_on_incoming_in transcript->load_proof(proof); verifier.verify(); - if constexpr (IsRecursiveFlavor) { - instance->target_sum = FF::from_witness_index(instance->builder, instance->builder->zero_idx()); - } else { - instance->target_sum = FF::zero(); - } instance->gate_challenges = transcript->template get_powers_of_challenge( "HypernovaFoldingProver:gate_challenge", Flavor::VIRTUAL_LOG_N); @@ -102,7 +97,7 @@ SumcheckOutput HypernovaFoldingVerifier::sumcheck_on_incoming_in vinfo("HypernovaFoldingVerifier: verifying Sumcheck to turn instance into an accumulator..."); std::vector padding_indicator_array(Flavor::VIRTUAL_LOG_N, 1); - SumcheckVerifier sumcheck(transcript, instance->alpha, Flavor::VIRTUAL_LOG_N, instance->target_sum); + SumcheckVerifier sumcheck(transcript, instance->alpha, Flavor::VIRTUAL_LOG_N); SumcheckOutput sumcheck_output = sumcheck.verify(instance->relation_parameters, instance->gate_challenges, padding_indicator_array); diff --git a/barretenberg/cpp/src/barretenberg/stdlib/honk_verifier/decider_recursive_verifier.cpp b/barretenberg/cpp/src/barretenberg/stdlib/honk_verifier/decider_recursive_verifier.cpp index 04415f9aa235..db4491aaa8af 100644 --- a/barretenberg/cpp/src/barretenberg/stdlib/honk_verifier/decider_recursive_verifier.cpp +++ b/barretenberg/cpp/src/barretenberg/stdlib/honk_verifier/decider_recursive_verifier.cpp @@ -47,7 +47,7 @@ DeciderRecursiveVerifier_::PairingPoints DeciderRecursiveVerifier_ padding_indicator_array(Flavor::VIRTUAL_LOG_N, 1); - Sumcheck sumcheck(transcript, accumulator->alpha, Flavor::VIRTUAL_LOG_N, accumulator->target_sum); + Sumcheck sumcheck(transcript, accumulator->alpha, Flavor::VIRTUAL_LOG_N); SumcheckOutput output = sumcheck.verify(accumulator->relation_parameters, accumulator->gate_challenges, padding_indicator_array); diff --git a/barretenberg/cpp/src/barretenberg/stdlib/honk_verifier/recursive_verifier_instance.hpp b/barretenberg/cpp/src/barretenberg/stdlib/honk_verifier/recursive_verifier_instance.hpp index cba79d644a3a..c91a2a97c7cc 100644 --- a/barretenberg/cpp/src/barretenberg/stdlib/honk_verifier/recursive_verifier_instance.hpp +++ b/barretenberg/cpp/src/barretenberg/stdlib/honk_verifier/recursive_verifier_instance.hpp @@ -44,7 +44,6 @@ template class RecursiveVerifierInstance_ { SubrelationSeparator alpha; RelationParameters relation_parameters; std::vector gate_challenges; - FF target_sum{ 0 }; WitnessCommitments witness_commitments; CommitmentLabels commitment_labels; @@ -84,7 +83,6 @@ template class RecursiveVerifierInstance_ { comm = Commitment::from_witness(builder, other_comms[comm_idx]); comm_idx++; } - target_sum = FF::from_witness(builder, verification_key->target_sum); size_t challenge_idx = 0; gate_challenges = std::vector(verification_key->gate_challenges.size()); for (auto& challenge : gate_challenges) { @@ -129,7 +127,6 @@ template class RecursiveVerifierInstance_ { zip_view(witness_commitments.get_all(), verifier_inst.witness_commitments.get_all())) { inst_comm = comm.get_value(); } - verifier_inst.target_sum = target_sum.get_value(); verifier_inst.gate_challenges = std::vector(gate_challenges.size()); for (auto [challenge, inst_challenge] : zip_view(gate_challenges, verifier_inst.gate_challenges)) { @@ -174,7 +171,6 @@ template class RecursiveVerifierInstance_ { this->relation_parameters.gamma); transcript.add_to_independent_hash_buffer(domain_separator + "verifier_inst_public_input_delta", this->relation_parameters.public_input_delta); - transcript.add_to_independent_hash_buffer(domain_separator + "verifier_inst_target_sum", this->target_sum); transcript.add_to_independent_hash_buffer(domain_separator + "verifier_inst_gate_challenges", this->gate_challenges); diff --git a/barretenberg/cpp/src/barretenberg/ultra_honk/decider_prover.cpp b/barretenberg/cpp/src/barretenberg/ultra_honk/decider_prover.cpp index e3f53bfec9ee..1784755b7d7f 100644 --- a/barretenberg/cpp/src/barretenberg/ultra_honk/decider_prover.cpp +++ b/barretenberg/cpp/src/barretenberg/ultra_honk/decider_prover.cpp @@ -12,22 +12,17 @@ namespace bb { /** - * Create DeciderProver_ from an accumulator. - * - * @param accumulator Relaxed instance (ϕ, ω, \vec{β}, e) whose proof we want to generate, produced by Protogalaxy - * folding prover - * - * @tparam a type of UltraFlavor - * */ + * Create DeciderProver_ from a prover instance. + */ template -DeciderProver_::DeciderProver_(const std::shared_ptr& prover_instance, - const std::shared_ptr& transcript) +DeciderProver_::DeciderProver_(std::shared_ptr prover_instance, + std::shared_ptr transcript) : prover_instance(std::move(prover_instance)) - , transcript(transcript) + , transcript(std::move(transcript)) {} /** - * @brief Run Sumcheck to establish that ∑_i pow(\vec{β*})f_i(ω) = e*. This results in u = (u_1,...,u_d) sumcheck round + * @brief Run Sumcheck to establish that ∑_i pow(\vec{β*})f_i(ω) = 0. This results in u = (u_1,...,u_d) sumcheck round * challenges and all evaluations at u being calculated. * */ diff --git a/barretenberg/cpp/src/barretenberg/ultra_honk/decider_prover.hpp b/barretenberg/cpp/src/barretenberg/ultra_honk/decider_prover.hpp index b943a0bc72c8..7f855bfc2303 100644 --- a/barretenberg/cpp/src/barretenberg/ultra_honk/decider_prover.hpp +++ b/barretenberg/cpp/src/barretenberg/ultra_honk/decider_prover.hpp @@ -35,8 +35,7 @@ template class DeciderProver_ { using Proof = typename Flavor::Transcript::Proof; public: - explicit DeciderProver_(const std::shared_ptr&, - const std::shared_ptr& transcript = std::make_shared()); + explicit DeciderProver_(std::shared_ptr, std::shared_ptr transcript); BB_PROFILE void execute_relation_check_rounds(); BB_PROFILE void execute_pcs_rounds(); diff --git a/barretenberg/cpp/src/barretenberg/ultra_honk/decider_verifier.cpp b/barretenberg/cpp/src/barretenberg/ultra_honk/decider_verifier.cpp index d369242559ed..7a260b0cf54f 100644 --- a/barretenberg/cpp/src/barretenberg/ultra_honk/decider_verifier.cpp +++ b/barretenberg/cpp/src/barretenberg/ultra_honk/decider_verifier.cpp @@ -57,7 +57,7 @@ template typename DeciderVerifier_::Output DeciderVeri } } - SumcheckVerifier sumcheck(transcript, accumulator->alpha, virtual_log_n, accumulator->target_sum); + SumcheckVerifier sumcheck(transcript, accumulator->alpha, virtual_log_n); // For MegaZKFlavor: receive commitments to Libra masking polynomials std::array libra_commitments = {}; if constexpr (Flavor::HasZK) { diff --git a/barretenberg/cpp/src/barretenberg/ultra_honk/prover_instance.hpp b/barretenberg/cpp/src/barretenberg/ultra_honk/prover_instance.hpp index 40cf58a1f265..542ee71bdf0d 100644 --- a/barretenberg/cpp/src/barretenberg/ultra_honk/prover_instance.hpp +++ b/barretenberg/cpp/src/barretenberg/ultra_honk/prover_instance.hpp @@ -92,7 +92,6 @@ template class ProverInstance_ { SubrelationSeparator alpha; // single challenge from which powers are computed for batching subrelations bb::RelationParameters relation_parameters; std::vector gate_challenges; - FF target_sum{ 0 }; // Sumcheck target sum HonkProof ipa_proof; // utilized only for UltraRollupFlavor diff --git a/barretenberg/cpp/src/barretenberg/ultra_honk/ultra_verifier.cpp b/barretenberg/cpp/src/barretenberg/ultra_honk/ultra_verifier.cpp index 85294fac6bfc..8198905759de 100644 --- a/barretenberg/cpp/src/barretenberg/ultra_honk/ultra_verifier.cpp +++ b/barretenberg/cpp/src/barretenberg/ultra_honk/ultra_verifier.cpp @@ -33,7 +33,6 @@ UltraVerifier_::UltraVerifierOutput UltraVerifier_::verify_proof // Determine the number of rounds in the sumcheck based on whether or not padding is employed const size_t log_n = Flavor::USE_PADDING ? Flavor::VIRTUAL_LOG_N : static_cast(verifier_instance->vk->log_circuit_size); - verifier_instance->target_sum = 0; verifier_instance->gate_challenges = transcript->template get_powers_of_challenge("Sumcheck:gate_challenge", log_n); diff --git a/barretenberg/cpp/src/barretenberg/ultra_honk/verifier_instance.hpp b/barretenberg/cpp/src/barretenberg/ultra_honk/verifier_instance.hpp index 5026911cffc7..68cf2f79619b 100644 --- a/barretenberg/cpp/src/barretenberg/ultra_honk/verifier_instance.hpp +++ b/barretenberg/cpp/src/barretenberg/ultra_honk/verifier_instance.hpp @@ -42,8 +42,6 @@ template class VerifierInstance_ { SubrelationSeparator alpha; // a challenge whose powers are used to batch subrelation contributions during Sumcheck RelationParameters relation_parameters; std::vector gate_challenges; - // The target sum, which is typically nonzero for a ProtogalaxyProver's accumulator - FF target_sum{ 0 }; WitnessCommitments witness_commitments; CommitmentLabels commitment_labels; @@ -89,14 +87,13 @@ template class VerifierInstance_ { this->relation_parameters.gamma); transcript.add_to_independent_hash_buffer(domain_separator + "verifier_inst_public_input_delta", this->relation_parameters.public_input_delta); - transcript.add_to_independent_hash_buffer(domain_separator + "verifier_inst_target_sum", this->target_sum); transcript.add_to_independent_hash_buffer(domain_separator + "verifier_inst_gate_challenges", this->gate_challenges); return transcript.hash_independent_buffer(); } - MSGPACK_FIELDS(vk, relation_parameters, alpha, is_complete, gate_challenges, target_sum, witness_commitments); + MSGPACK_FIELDS(vk, relation_parameters, alpha, is_complete, gate_challenges, witness_commitments); }; } // namespace bb diff --git a/barretenberg/docs/docs/explainers/advanced/chonk.md b/barretenberg/docs/docs/explainers/advanced/chonk.md index f354d2004238..1caa151c812e 100644 --- a/barretenberg/docs/docs/explainers/advanced/chonk.md +++ b/barretenberg/docs/docs/explainers/advanced/chonk.md @@ -1,7 +1,7 @@ --- title: CHONK - Client-side Highly Optimized ploNK description: Learn about CHONK, Aztec's specialized proving system designed for client-side proving with low memory requirements and efficient recursion for private smart contract execution. -keywords: [chonk, plonk, proving system, recursive proofs, protogalaxy, goblin plonk, zero knowledge, aztec, client-side proving, hyperplonk, sumcheck] +keywords: [chonk, plonk, proving system, recursive proofs, hypernova, goblin plonk, zero knowledge, aztec, client-side proving, hyperplonk, sumcheck] image: https://hackmd.io/_uploads/BkpsblXEgg.jpg sidebar_position: 1 --- @@ -34,13 +34,13 @@ A statement about contract execution will translate to multiple circuits - repre This eliminates FFT's and reduces prover time and memory at the expense of proof length. This approach is the main theme of the [hyperplonk paper](https://eprint.iacr.org/2022/1355). -### 3. Using the protogalaxy (PG) folding scheme +### 3. Using the Hypernova (HN) folding scheme -Folding schemes enable cheaper recursion than standard recursive proofs. They work most smoothly with elliptic-curve based proofs systems like CHONK. We specifically work with [protogalaxy](https://eprint.iacr.org/2023/1106) which is convenient and efficient for folding non-uniform PlonK circuits (i.e. not a fixed repeating circuit). +Folding schemes enable cheaper recursion than standard recursive proofs. They work most smoothly with elliptic-curve based proofs systems like CHONK. We specifically work with [HyperNova](https://eprint.iacr.org/2023/573) which is convenient and efficient for folding non-uniform PlonK circuits (i.e. not a fixed repeating circuit). ### 4. Enhancing PG with "Goblin plonk" -Though PG (as do other folding schemes) already facilitates efficient recursion, it can still be a bit heavy client-side due to the non-native elliptic curve scalar multiplications performed by the folding verifier. For this reason, we use a "lazy" version of PG where the verifier doesn't perform these operations, but rather simply adds them to a queue of EC operations that need to be performed at the final proving stage. We call this deferral mechanism [*Goblin Plonk*](https://hackmd.io/@aztec-network/BkGNaHUJn/%2FdUsu57SOTBiQ4tS9KJMkMQ) (GP) (see also [this paper](https://eprint.iacr.org/2024/1651)). +Though HN (as do other folding schemes) already facilitates efficient recursion, it can still be a bit heavy client-side due to the non-native elliptic curve scalar multiplications performed by the folding verifier. For this reason, we use a "lazy" version of HN where the verifier doesn't perform these operations, but rather simply adds them to a queue of EC operations that need to be performed at the final proving stage. We call this deferral mechanism [*Goblin Plonk*](https://hackmd.io/@aztec-network/BkGNaHUJn/%2FdUsu57SOTBiQ4tS9KJMkMQ) (GP) (see also [this paper](https://eprint.iacr.org/2024/1651)). The advantage of GP is that at this final stage we transition to another elliptic curve called Grumpkin where these operations are more efficient. This curve-switch approach was initiated by [BCTV](https://eprint.iacr.org/2014/595.pdf), and a good example of it in the modern folding context is [CycleFold](https://eprint.iacr.org/2023/1192). GP is arguably simpler than CycleFold where we switch back and forth between the curves at every iteration of the IVC. The approaches are however incomparable, and for example, CycleFold has the advantage of the final IPA verifier size not growing with the number of iterations. (Although this verifier can be run server-side once for all client proofs using the [Halo](https://eprint.iacr.org/2019/1021)/[BCMS](https://eprint.iacr.org/2020/499) accumulation mechanism.) From 0486f486136389f24a2eb8d561eedaea3e110747 Mon Sep 17 00:00:00 2001 From: iakovenkos Date: Fri, 7 Nov 2025 09:42:12 +0000 Subject: [PATCH 2/5] refactor: remove ProtoGalaxy references, update to Hypernova MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This commit completes the migration from ProtoGalaxy to Hypernova terminology throughout the codebase. Changes: - Updated code comments in prover_instance.hpp and verifier_instance.hpp to use generic folding terminology and reference Hypernova - Changed Noir circuit comments from "protogalaxy proof" to "folding proof" - Updated documentation in chonk.md to reference Hypernova paper (eprint.iacr.org/2023/573) instead of ProtoGalaxy - Added explicit BB_BENCH_NAME() calls to hypernova_prover.cpp and hypernova_verifier.cpp for better benchmarking - Updated bench_hardware_concurrency.sh to process HypernovaProver/Verifier metrics - Updated acir_format.cpp comments to use "HN" instead of "pg" - Added "hypernova" to cspell.json dictionary Note: Versioned documentation, CHANGELOGs, and security descriptions kept as-is for historical accuracy. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude --- .../cpp/scripts/bench_hardware_concurrency.sh | 8 ++-- .../dsl/acir_format/acir_format.cpp | 4 +- .../hypernova/hypernova_prover.cpp | 6 +-- .../hypernova/hypernova_verifier.cpp | 8 ++-- .../ultra_honk/prover_instance.hpp | 41 +------------------ .../ultra_honk/verifier_instance.hpp | 15 ++++--- .../docs/docs/explainers/advanced/chonk.md | 2 +- cspell.json | 1 + .../hiding-kernel-to-public/src/main.nr | 2 +- .../hiding-kernel-to-rollup/src/main.nr | 2 +- 10 files changed, 26 insertions(+), 63 deletions(-) diff --git a/barretenberg/cpp/scripts/bench_hardware_concurrency.sh b/barretenberg/cpp/scripts/bench_hardware_concurrency.sh index 941a89888acc..49eb75879812 100755 --- a/barretenberg/cpp/scripts/bench_hardware_concurrency.sh +++ b/barretenberg/cpp/scripts/bench_hardware_concurrency.sh @@ -197,8 +197,8 @@ for test_case in test_cases: # Categorize metrics based on name if "Chonk" in metric_name or "Chonk" in metric_name: components["Main"][metric_name][cpu] = time_ms - elif "ProtogalaxyProver" in metric_name: - components["ProtogalaxyProver"][metric_name][cpu] = time_ms + elif "HypernovaProver" in metric_name or "HypernovaFoldingProver" in metric_name or "HypernovaFoldingVerifier" in metric_name: + components["HypernovaProver"][metric_name][cpu] = time_ms elif "OinkProver" in metric_name: components["OinkProver"][metric_name][cpu] = time_ms elif "Decider" in metric_name: @@ -224,7 +224,7 @@ for test_case in test_cases: # Generate tables for each component sections = [ ("Main Components", "Main"), - ("ProtogalaxyProver Components", "ProtogalaxyProver"), + ("HypernovaProver Components", "HypernovaProver"), ("OinkProver", "OinkProver"), ("Decider", "Decider"), ("Goblin", "Goblin"), @@ -259,7 +259,7 @@ for test_case in test_cases: count = int(count_match.group(1)) if count_match else None # Clean up metric name - clean_name = metric_name.replace('ProtogalaxyProver::', '').replace('OinkProver::', '') + clean_name = metric_name.replace('HypernovaFoldingProver::', '').replace('HypernovaFoldingVerifier::', '').replace('HypernovaProver::', '').replace('OinkProver::', '') row = generate_table_row(clean_name, times, available_cpus, count) print("| " + row + " |") diff --git a/barretenberg/cpp/src/barretenberg/dsl/acir_format/acir_format.cpp b/barretenberg/cpp/src/barretenberg/dsl/acir_format/acir_format.cpp index c29ad54cf708..c90961ea31c0 100644 --- a/barretenberg/cpp/src/barretenberg/dsl/acir_format/acir_format.cpp +++ b/barretenberg/cpp/src/barretenberg/dsl/acir_format/acir_format.cpp @@ -274,7 +274,7 @@ void build_constraints(Builder& builder, AcirProgram& program, const ProgramMeta bool has_chonk_recursion_constraints = !constraint_system.chonk_recursion_constraints.empty(); if constexpr (IsMegaBuilder) { - // We shouldn't have both honk recursion constraints and pg recursion constraints. + // We shouldn't have both honk recursion constraints and HN recursion constraints. BB_ASSERT_EQ(!has_honk_recursion_constraints || !has_hn_recursion_constraints, true, "Invalid circuit: both honk and ivc recursion constraints present."); @@ -312,7 +312,7 @@ void build_constraints(Builder& builder, AcirProgram& program, const ProgramMeta // we return a vinfo for the case of Chonk + AVM BB_ASSERT_EQ(has_hn_recursion_constraints, false, - "Invalid circuit: pg recursion constraints are present with UltraBuilder."); + "Invalid circuit: HN recursion constraints are present with UltraBuilder."); BB_ASSERT_EQ(!(has_chonk_recursion_constraints && has_honk_recursion_constraints), true, "Invalid circuit: both honk and chonk recursion constraints are present."); diff --git a/barretenberg/cpp/src/barretenberg/hypernova/hypernova_prover.cpp b/barretenberg/cpp/src/barretenberg/hypernova/hypernova_prover.cpp index 937a40bac6fe..34729cc70075 100644 --- a/barretenberg/cpp/src/barretenberg/hypernova/hypernova_prover.cpp +++ b/barretenberg/cpp/src/barretenberg/hypernova/hypernova_prover.cpp @@ -44,7 +44,7 @@ HypernovaFoldingProver::Accumulator HypernovaFoldingProver::sumcheck_output_to_a const std::shared_ptr& instance, const std::shared_ptr& honk_vk) { - BB_BENCH(); + BB_BENCH_NAME("HypernovaFoldingProver::sumcheck_output_to_accumulator"); // Generate challenges to batch shifted and unshifted polynomials/commitments/evaluation auto [unshifted_challenges, shifted_challenges] = get_batching_challenges(); @@ -91,7 +91,7 @@ Polynomial HypernovaFoldingProver::batch_polynomials const size_t& full_batched_size, const std::vector& challenges) { - BB_BENCH(); + BB_BENCH_NAME("HypernovaFoldingProver::batch_polynomials"); BB_ASSERT_EQ(full_batched_size, polynomials_to_batch[0].virtual_size(), "The virtual size of the first polynomial is different from the full batched size."); @@ -116,7 +116,7 @@ HypernovaFoldingProver::Accumulator HypernovaFoldingProver::instance_to_accumula const std::shared_ptr& instance, const std::shared_ptr& honk_vk) { - BB_BENCH(); + BB_BENCH_NAME("HypernovaFoldingProver::instance_to_accumulator"); vinfo("HypernovaFoldingProver: converting instance to accumulator..."); diff --git a/barretenberg/cpp/src/barretenberg/hypernova/hypernova_verifier.cpp b/barretenberg/cpp/src/barretenberg/hypernova/hypernova_verifier.cpp index d8685e498af3..19774bd2b083 100644 --- a/barretenberg/cpp/src/barretenberg/hypernova/hypernova_verifier.cpp +++ b/barretenberg/cpp/src/barretenberg/hypernova/hypernova_verifier.cpp @@ -49,7 +49,7 @@ HypernovaFoldingVerifier::Accumulator HypernovaFoldingVerifier:: HypernovaFoldingVerifier::MegaSumcheckOutput& sumcheck_output, const std::shared_ptr& instance) { - BB_BENCH(); + BB_BENCH_NAME("HypernovaFoldingVerifier::sumcheck_output_to_accumulator"); // Generate challenges to batch shifted and unshifted polynomials/commitments/evaluation auto [unshifted_challenges, shifted_challenges] = get_batching_challenges(); @@ -82,7 +82,7 @@ template SumcheckOutput HypernovaFoldingVerifier::sumcheck_on_incoming_instance( const std::shared_ptr& instance, const Proof& proof) { - BB_BENCH(); + BB_BENCH_NAME("HypernovaFoldingVerifier::sumcheck_on_incoming_instance"); vinfo("HypernovaFoldingVerifier: verifying Oink proof..."); // Complete the incoming verifier instance @@ -109,7 +109,7 @@ std::pair::Accumulator> Hypernov instance_to_accumulator(const std::shared_ptr& instance, const Proof& proof) { - BB_BENCH(); + BB_BENCH_NAME("HypernovaFoldingVerifier::instance_to_accumulator"); auto sumcheck_output = sumcheck_on_incoming_instance(instance, proof); @@ -130,7 +130,7 @@ std::tuple::Accumulator> H Flavor>::verify_folding_proof(const std::shared_ptr& instance, const HypernovaFoldingVerifier::Proof& proof) { - BB_BENCH(); + BB_BENCH_NAME("HypernovaFoldingVerifier::verify_folding_proof"); vinfo("HypernovaFoldingVerifier: verifying folding proof..."); diff --git a/barretenberg/cpp/src/barretenberg/ultra_honk/prover_instance.hpp b/barretenberg/cpp/src/barretenberg/ultra_honk/prover_instance.hpp index 542ee71bdf0d..b64bac59151b 100644 --- a/barretenberg/cpp/src/barretenberg/ultra_honk/prover_instance.hpp +++ b/barretenberg/cpp/src/barretenberg/ultra_honk/prover_instance.hpp @@ -27,43 +27,7 @@ namespace bb { /** * @brief A ProverInstance is normally constructed from a finalized circuit and it contains all the information - * required by a Mega Honk prover to create a proof. A ProverInstance is also the result of running the - * Protogalaxy prover, in which case it becomes a relaxed counterpart with the folding parameters (target sum and gate - * challenges set to non-zero values). - * - * @details A ProverInstance is the equivalent of \f$\omega\f$ in the Protogalaxy paper. - * - * Our arithmetization works as follows. The Flavor defines \f$fM\f$ (Flavor::NUM_ALL_ENTITIES) and a series of - * relations - * \f$R_1, \dots, R_n\f$ (Flavor::Relations_). Each relation is made up by a series of subrelations: \f$R_i = - * (R_{i,1}, \dots, R_{i,r_i})\f$. - * - * Write \f$p_1, \dots, p_M\f$ for the prover polynomials and \f$p_{i,k}\f$ for the \f$k\f$-th coefficient of \f$p_i\f$. - * Write \f$\theta_1, \dots, \theta_6\f$ for the relation parameters. Let \f$n\f$ be the max degree of the prover - * polynomials. A pure ProverInstance is valid if for all \f$i, j, k\f$ we have \f$R_{i,j}(p_{1,k}, \dots, - * p_{M,k}, \theta_1, \dots, \theta_6) = 0\f$. - * - * Instead of checking each equality separately, we batch them using challenges that we call `alphas`. Thus, a - * ProverInstance is valid if for each \f$k = 0, \dots, n\f$. - * \f[ - * f_k(\omega) := \sum_{i, j} \alpha_{i,j} R_{i,j}(p_{1,k}, \dots, p_{M,k}, \theta_1, \dots, \theta_6) = 0 - * \f] - * - * Instead of checking each equality separately, we once again batch them using challenges. These challenges are the - * \f$pow_i(\beta)\f$ in the Protogalaxy paper, and are derived using the vector `gate_challenges` as the vector - * \f$\beta\f$. Write \f$gc\f$ for the vector `gate_challenges`. Then, a ProverInstance is valid if - * \f[ - * \sum_{k} pow_k(gc) f_k(\omega) = 0 - * \f] - * The equation is modified for a relaxed ProverInstance to - * \f[ - * \sum_{k} pow_k(gc) f_k(\omega) = ts - * \f] - * where we write \f$ts\f$ for the vector `target_sum`. - * - * Hence, the correspondence between the class below and the Protogalaxy paper is \f$\omega = (p_1, \dots, p_M, , - * \theta_1, \dots, \theta_6, \alpha_{1,1}, \dots, \alpha_{n,r_n})\f$, \f$\beta\f$ are the `gate_challenges`, and - * \f$e\f$ is `target_sum`. +Ist * required by a Mega Honk prover to create a proof. */ template class ProverInstance_ { @@ -95,8 +59,7 @@ template class ProverInstance_ { HonkProof ipa_proof; // utilized only for UltraRollupFlavor - bool is_relaxed_instance = false; // whether this instance is relaxed or not - bool is_complete = false; // whether this instance has been completely populated + bool is_complete = false; // whether this instance has been completely populated std::vector memory_read_records; std::vector memory_write_records; diff --git a/barretenberg/cpp/src/barretenberg/ultra_honk/verifier_instance.hpp b/barretenberg/cpp/src/barretenberg/ultra_honk/verifier_instance.hpp index 68cf2f79619b..cdadd3c2b2b2 100644 --- a/barretenberg/cpp/src/barretenberg/ultra_honk/verifier_instance.hpp +++ b/barretenberg/cpp/src/barretenberg/ultra_honk/verifier_instance.hpp @@ -12,15 +12,14 @@ namespace bb { /** * @brief The VerifierInstance encapsulates all the necessary information for a Mega Honk Verifier to verify a - * proof (sumcheck + Shplemini). In the context of folding, this is returned by the Protogalaxy verifier with non-zero - * target sum. + * proof (sumcheck + Shplemini). In the context of folding, this is provided to the Hypernova verifier as an incoming + * instance. * - * @details This is \f$\phi\f$ in the Protogalaxy paper. It is the committed version of a ProverInstance_. With the - * notation used in ProverInstance_, a prover instance is \f$\omega = (p_1, \dots, p_M, \theta_1, \dots, \theta_6, - * \alpha_{1,1}, \dots, \alpha_{n,r_n})\f$ where the \f$p_i\f$'s are the prover polynomials, the \f$\theta_i\f$'s are - * the relation parameters, and the \f$\alpha_{i,j}\f$'s are the subrelation batching parameters. Then, \f$\phi\f$ is - * given by \f$\omega = ([p_1], \dots, [p_M], \theta_1, \dots, \theta_6, \alpha_{1,1}, \dots, \alpha_{n,r_n})\f$m where - * [p_i] denotes the commitment to the i-th prover polynomial. + * @details This is the committed version of a ProverInstance_. With the notation used in ProverInstance_, a prover + * instance is \f$\omega = (p_1, \dots, p_M, \theta_1, \dots, \theta_6, \alpha)\f$ where the \f$p_i\f$'s are the + * prover polynomials, the \f$\theta_i\f$'s are the relation parameters, and \f$\alpha\f$ is the challenge whose powers + * are used for batching subrelations. The committed version contains \f$([p_1], \dots, [p_M], \theta_1, \dots, + * \theta_6, \alpha)\f$ where [p_i] denotes the commitment to the i-th prover polynomial. */ template class VerifierInstance_ { public: diff --git a/barretenberg/docs/docs/explainers/advanced/chonk.md b/barretenberg/docs/docs/explainers/advanced/chonk.md index 1caa151c812e..5f6d8c0020f2 100644 --- a/barretenberg/docs/docs/explainers/advanced/chonk.md +++ b/barretenberg/docs/docs/explainers/advanced/chonk.md @@ -38,7 +38,7 @@ This eliminates FFT's and reduces prover time and memory at the expense of proof Folding schemes enable cheaper recursion than standard recursive proofs. They work most smoothly with elliptic-curve based proofs systems like CHONK. We specifically work with [HyperNova](https://eprint.iacr.org/2023/573) which is convenient and efficient for folding non-uniform PlonK circuits (i.e. not a fixed repeating circuit). -### 4. Enhancing PG with "Goblin plonk" +### 4. Enhancing HN with "Goblin plonk" Though HN (as do other folding schemes) already facilitates efficient recursion, it can still be a bit heavy client-side due to the non-native elliptic curve scalar multiplications performed by the folding verifier. For this reason, we use a "lazy" version of HN where the verifier doesn't perform these operations, but rather simply adds them to a queue of EC operations that need to be performed at the final proving stage. We call this deferral mechanism [*Goblin Plonk*](https://hackmd.io/@aztec-network/BkGNaHUJn/%2FdUsu57SOTBiQ4tS9KJMkMQ) (GP) (see also [this paper](https://eprint.iacr.org/2024/1651)). diff --git a/cspell.json b/cspell.json index 929da0b01d0c..11f5be22c3b2 100644 --- a/cspell.json +++ b/cspell.json @@ -153,6 +153,7 @@ "herskind", "hevm", "homomorphic", + "hypernova", "ierc", "IGSE", "incentivized", diff --git a/noir-projects/noir-protocol-circuits/crates/hiding-kernel-to-public/src/main.nr b/noir-projects/noir-protocol-circuits/crates/hiding-kernel-to-public/src/main.nr index 729492dbfea6..5a2d34856bd1 100644 --- a/noir-projects/noir-protocol-circuits/crates/hiding-kernel-to-public/src/main.nr +++ b/noir-projects/noir-protocol-circuits/crates/hiding-kernel-to-public/src/main.nr @@ -11,7 +11,7 @@ pub struct HidingKernelToPublicPrivateInputs { impl HidingKernelToPublicPrivateInputs { pub fn execute(self) { - // Verify previous kernel, which contains a protogalaxy proof and a decider proof. + // Verify previous kernel, which contains a folding proof and a decider proof. // The associated public inputs and proofs are linked through the verification queue in the backend. // The proof type `PROOF_TYPE_HN_FINAL` designates the final proof in the client IVC sequence. if !std::runtime::is_unconstrained() { diff --git a/noir-projects/noir-protocol-circuits/crates/hiding-kernel-to-rollup/src/main.nr b/noir-projects/noir-protocol-circuits/crates/hiding-kernel-to-rollup/src/main.nr index f6f355c44ac0..84d21ee044eb 100644 --- a/noir-projects/noir-protocol-circuits/crates/hiding-kernel-to-rollup/src/main.nr +++ b/noir-projects/noir-protocol-circuits/crates/hiding-kernel-to-rollup/src/main.nr @@ -11,7 +11,7 @@ pub struct HidingKernelToRollupPrivateInputs { impl HidingKernelToRollupPrivateInputs { pub fn execute(self) { - // Verify previous kernel, which contains a protogalaxy proof and a decider proof. + // Verify previous kernel, which contains a folding proof and a decider proof. // The associated public inputs and proofs are linked through the verification queue in the backend. // The proof type `PROOF_TYPE_HN_FINAL` designates the final proof in the chonk sequence. if !std::runtime::is_unconstrained() { From ce1ec513c2fd69e743ad1ce72f6a56b57d60b2e8 Mon Sep 17 00:00:00 2001 From: iakovenkos Date: Fri, 7 Nov 2025 09:47:44 +0000 Subject: [PATCH 3/5] typo fix in prover instance --- .../cpp/src/barretenberg/ultra_honk/prover_instance.hpp | 2 +- .../cpp/src/barretenberg/ultra_honk/verifier_instance.hpp | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/barretenberg/cpp/src/barretenberg/ultra_honk/prover_instance.hpp b/barretenberg/cpp/src/barretenberg/ultra_honk/prover_instance.hpp index b64bac59151b..072ca756f61f 100644 --- a/barretenberg/cpp/src/barretenberg/ultra_honk/prover_instance.hpp +++ b/barretenberg/cpp/src/barretenberg/ultra_honk/prover_instance.hpp @@ -27,7 +27,7 @@ namespace bb { /** * @brief A ProverInstance is normally constructed from a finalized circuit and it contains all the information -Ist * required by a Mega Honk prover to create a proof. + * required by a Mega Honk prover to create a proof. */ template class ProverInstance_ { diff --git a/barretenberg/cpp/src/barretenberg/ultra_honk/verifier_instance.hpp b/barretenberg/cpp/src/barretenberg/ultra_honk/verifier_instance.hpp index cdadd3c2b2b2..e46688b710ab 100644 --- a/barretenberg/cpp/src/barretenberg/ultra_honk/verifier_instance.hpp +++ b/barretenberg/cpp/src/barretenberg/ultra_honk/verifier_instance.hpp @@ -12,7 +12,7 @@ namespace bb { /** * @brief The VerifierInstance encapsulates all the necessary information for a Mega Honk Verifier to verify a - * proof (sumcheck + Shplemini). In the context of folding, this is provided to the Hypernova verifier as an incoming +l * proof (sumcheck + Shplemini). In the context of folding, this is provided to the Hypernova verifier as an incoming * instance. * * @details This is the committed version of a ProverInstance_. With the notation used in ProverInstance_, a prover From cce826b59745ef74cca3e0c9309472df41469a3f Mon Sep 17 00:00:00 2001 From: iakovenkos Date: Fri, 7 Nov 2025 11:04:44 +0000 Subject: [PATCH 4/5] vk update --- .../cpp/scripts/test_chonk_standalone_vks_havent_changed.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/barretenberg/cpp/scripts/test_chonk_standalone_vks_havent_changed.sh b/barretenberg/cpp/scripts/test_chonk_standalone_vks_havent_changed.sh index 64056e243cfe..4dd00ee8b2ed 100755 --- a/barretenberg/cpp/scripts/test_chonk_standalone_vks_havent_changed.sh +++ b/barretenberg/cpp/scripts/test_chonk_standalone_vks_havent_changed.sh @@ -13,7 +13,7 @@ cd .. # - Generate a hash for versioning: sha256sum bb-chonk-inputs.tar.gz # - Upload the compressed results: aws s3 cp bb-chonk-inputs.tar.gz s3://aztec-ci-artifacts/protocol/bb-chonk-inputs-[hash(0:8)].tar.gz # Note: In case of the "Test suite failed to run ... Unexpected token 'with' " error, need to run: docker pull aztecprotocol/build:3.0 -pinned_short_hash="7222b532" +pinned_short_hash="6322e510" pinned_chonk_inputs_url="https://aztec-ci-artifacts.s3.us-east-2.amazonaws.com/protocol/bb-chonk-inputs-${pinned_short_hash}.tar.gz" function compress_and_upload { From 9c098c083313f79e7d7c47f425d0428011c90741 Mon Sep 17 00:00:00 2001 From: iakovenkos Date: Fri, 7 Nov 2025 11:31:45 +0000 Subject: [PATCH 5/5] fix docs --- .../cpp/src/barretenberg/ultra_honk/verifier_instance.hpp | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/barretenberg/cpp/src/barretenberg/ultra_honk/verifier_instance.hpp b/barretenberg/cpp/src/barretenberg/ultra_honk/verifier_instance.hpp index e46688b710ab..0a9954eb6667 100644 --- a/barretenberg/cpp/src/barretenberg/ultra_honk/verifier_instance.hpp +++ b/barretenberg/cpp/src/barretenberg/ultra_honk/verifier_instance.hpp @@ -12,14 +12,8 @@ namespace bb { /** * @brief The VerifierInstance encapsulates all the necessary information for a Mega Honk Verifier to verify a -l * proof (sumcheck + Shplemini). In the context of folding, this is provided to the Hypernova verifier as an incoming + * proof (sumcheck + Shplemini). In the context of folding, this is provided to the Hypernova verifier as an incoming * instance. - * - * @details This is the committed version of a ProverInstance_. With the notation used in ProverInstance_, a prover - * instance is \f$\omega = (p_1, \dots, p_M, \theta_1, \dots, \theta_6, \alpha)\f$ where the \f$p_i\f$'s are the - * prover polynomials, the \f$\theta_i\f$'s are the relation parameters, and \f$\alpha\f$ is the challenge whose powers - * are used for batching subrelations. The committed version contains \f$([p_1], \dots, [p_M], \theta_1, \dots, - * \theta_6, \alpha)\f$ where [p_i] denotes the commitment to the i-th prover polynomial. */ template class VerifierInstance_ { public: