feat: multiPCS infra for Ultra and Mega by iakovenkos · Pull Request #20230 · AztecProtocol/aztec-packages

iakovenkos · 2026-02-06T11:09:01Z

Summary

Adds parameterized polynomial interleaving to Mega and Ultra proving systems. Instead of committing to each polynomial individually (BS = 1), polynomials are grouped into interleaved commitments of size BS = 2 or BS = 4, reducing the number of commitments and shrinking the recursive verifier circuit—at the cost of additional PCS work.

Key changes

Templatize MegaFlavor_<BS> and UltraFlavor_<BS> on interleaving batch size
Add BS = 2 (DualMegaFlavor, DualUltraFlavor) and BS = 4 (MultiMegaFlavor) with full ZK and recursive flavor variants
Unified BS-agnostic OinkProver / OinkVerifier — no branching on batch size
Memory-efficient on-the-fly interleaving via strided polynomial views
commit_interleaved<BS> in commitment key for batched Pippenger
Gemini generalized for arbitrary shift exponent (G / X^k where k = BS)
Repeated commitment deduplication for all batch sizes

Prover Benchmarks (8 cores, wall time)

┌────────────────┬─────────┬──────────┬───────────┬───────────────┬───────────────┐
│     Flavor     │  2^19   │   2^20   │  vs BS=1  │ Peak RSS 2^19 │ Peak RSS 2^20 │
├────────────────┼─────────┼──────────┼───────────┼───────────────┼───────────────┤
│ Ultra BS=1     │ 3516 ms │  6423 ms │ —         │        663 MB │       1327 MB │
├────────────────┼─────────┼──────────┼───────────┼───────────────┼───────────────┤
│ DualUltra BS=2 │ 4722 ms │  8648 ms │ +34-35%   │        698 MB │       1393 MB │
├────────────────┼─────────┼──────────┼───────────┼───────────────┼───────────────┤
│ Mega BS=1      │ 3519 ms │  6420 ms │ —         │        656 MB │       1329 MB │
├────────────────┼─────────┼──────────┼───────────┼───────────────┼───────────────┤
│ DualMega BS=2  │ 4738 ms │  8795 ms │ +35-37%   │        694 MB │       1377 MB │
├────────────────┼─────────┼──────────┼───────────┼───────────────┼───────────────┤
│ MultiMega BS=4 │ 7305 ms │ 13664 ms │ +108-113% │        834 MB │       1771 MB │
└────────────────┴─────────┴──────────┴───────────┴───────────────┴───────────────┘

Prover overhead is dominated by additional Gemini fold rounds on BS * n-sized group buffers. Memory overhead is modest (~5% for BS = 2, ~27–33% for BS = 4).

Recursive Verifier Circuit Size (`UltraCircuitBuilder`, `DefaultIO`)

┌──────────────────┬─────────┬─────────┐
│      Flavor      │  Gates  │ vs BS=1 │
├──────────────────┼─────────┼─────────┤
│ Ultra BS=1       │ 694,088 │ —       │
├──────────────────┼─────────┼─────────┤
│ UltraZK BS=1     │ 737,938 │ +6%     │
├──────────────────┼─────────┼─────────┤
│ DualUltra BS=2   │ 557,821 │ -20%    │
├──────────────────┼─────────┼─────────┤
│ DualUltraZK BS=2 │ 598,136 │ -14%    │
├──────────────────┼─────────┼─────────┤
│ Mega BS=1        │ 811,478 │ —       │
├──────────────────┼─────────┼─────────┤
│ MegaZK BS=1      │ 781,918 │ -4%     │
├──────────────────┼─────────┼─────────┤
│ DualMega BS=2    │ 600,237 │ -26%    │
├──────────────────┼─────────┼─────────┤
│ DualMegaZK BS=2  │ 593,287 │ -27%    │
├──────────────────┼─────────┼─────────┤
│ MultiMega BS=4   │ 507,614 │ -37%    │
├──────────────────┼─────────┼─────────┤
│ MultiMegaZK BS=4 │ 479,366 │ -41%    │
└──────────────────┴─────────┴─────────┘

Test plan

ultra_honk_tests — DualUltra / DualUltraZK added to UltraHonkTests, lookup, and rom_ram suites
ultra_honk_tests — DualMega / DualMegaZK / MultiMega added to MegaHonkTests (prove/verify, interleaved storage, transcript manifest)
stdlib_honk_verifier_tests — recursive verification for all DualUltra / DualMega / MultiMega flavors with UltraCircuitBuilder
Repeated commitment deduplication verified for all batch sizes

ZK support via MultiMegaZKFlavor with masking polynomials, Libra commitments, and SmallSubgroupIPA. Recursive verification for both MultiMega and MultiMegaZK with Ultra and Mega outer builders, including proof_length specializations for recursive flavors. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Reorder InterleavedWitnessCommitments so unshiftable groups come first and the 3 shiftable groups (W1, W6, W9) are contiguous at the end, enabling the existing remove_repeated_commitments mechanism to merge shifted/unshifted commitment scalars. This saves 3 points from the final PCS MSM. Key changes: - Reorder InterleavedWitnessCommitments_ members and get_unshifted_groups - Enable REPEATED_COMMITMENTS in MultiMega and MultiMegaZK flavors - Update FINAL_PCS_MSM_SIZE to reflect the reduced MSM size - Alias InterleavedWitnessCommitments/PrecomputedCommitments in recursive flavor from native to avoid duplication - Simplify remove_repeated_commitments: remove has_zk parameter, use absolute indices from RepeatedCommitmentsData directly - Pre-bake Shplemini offset into REPEATED_COMMITMENTS indices across all flavors (Ultra, Mega, ECCVM, Translator, MultiMega + ZK variants) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

@claude

@claude AztecProtocol#20272 @ludamad AztecProtocol#20172 @asterite AztecProtocol#20273 @rex4539 AztecProtocol#20198 @michaelelliot AztecProtocol#20230

…i/multipcs-proto

…d translator ordering - MegaZKFlavor BS=1: HasGeminiMasking=false, no masking entities, -1 REPEATED_COMMITMENTS shift - oink prover/verifier: use flavor_has_gemini_masking gate for masking commitment - batched translator verifier: translator-first unshifted ordering, no MegaZK masking - honk_transcript test: use flavor_has_gemini_masking for manifest gate - ultra_verifier: use flavor_has_gemini_masking in build_pcs_commitments

…i/multipcs-proto

Replace persistent group buffers with on-the-fly interleaved polynomial construction. Entities are allocated individually (same memory as BS=1). Interleaved buffers are built transiently for commitment and PCS. Key changes: - Extract rho from Gemini/Shplemini into prover call sites - Add pippenger_interleaved + commit_interleaved for buffer-free MSM - BS>1 PCS: pre-batch groups into F/G with rho, free entities, manual Gemini - VK construction uses commit_interleaved (no interleaved buffers) - Remove group_buffers_, allocate_interleaved_groups, group_buffer_for Peak memory at 2^19 BS=4: 825 MiB (was 1848 MiB with group buffers).

Replace all if-constexpr BS branching in oink with unified group-based iteration using OinkWitnessRounds_<BS> descriptors and commit_interleaved<BS>. - Add OinkWitnessRounds_<1> and OinkWitnessRounds_<4> with per-round group descriptors (entity pointers + labels) for wires, lookup, inverses, z_perm - Add OinkGroupDescriptor<Ptr> as the shared descriptor type - commit_interleaved<1> delegates to commit() (no temp buffer) - Oink prover: commit_round_groups iterates groups uniformly for all BS - Oink verifier: receive_round_groups iterates groups uniformly for all BS - Remove CommitmentLabels and InterleavedCommitmentLabels from oink - Adding BS=2 requires only OinkWitnessRounds_<2> — zero oink code changes

Add MegaFlavor_<2> (DualMegaFlavor) with groups of 2 polynomials per interleaved commitment: 16 precomputed groups, 15 witness groups (4 shiftable), INTERLEAVING_LOG_K=1. Includes ZK variant, recursive flavors, all template instantiations, and test coverage.

Templatize UltraFlavor_ and UltraZKFlavor_ on BATCH_SIZE, mirroring MegaFlavor_. Add UltraFlavor_<2> (DualUltraFlavor) with 14 precomputed groups, 5 witness groups (3 shiftable), INTERLEAVING_LOG_K=1. Includes ZK variant, recursive flavors, template instantiations, and test coverage.

Review fixes: - info() → vinfo() in ultra_verifier.cpp - add DualUltra flavors to IsUltraHonk Starknet branch - fix stale comments in claim_batcher.hpp and mega_zk_flavor.hpp - add missing get_shiftable() const to BS=2/BS=4 ZK witness commitments - hoist r_inv_shift computation in gemini.hpp - restore static_assert(MAX_PARTIAL_RELATION_LENGTH == 7) Test coverage: - add DualUltraFlavor + DualUltraZKFlavor to UltraHonkTests type list (also rom_ram.test.cpp and lookup.test.cpp for consistent type lists) - remove standalone DualUltraHonkTests::Basic (now covered by shared suite) - skip ANonZeroPolynomialIsAGoodPolynomial for BS>1 (strided views)

federicobarbacovi

Looks great! A lot of comments but nothing major. Thanks for this!

federicobarbacovi · 2026-03-20T12:01:31Z

barretenberg/cpp/src/barretenberg/benchmark/goblin_bench/eccvm.bench.cpp

    }

+    // Add hiding op (required before creating the builder)
+    eccvm_test_utils::add_hiding_op_for_test(op_queue);


WHy was this not needed before?

federicobarbacovi · 2026-03-20T12:06:23Z

barretenberg/cpp/src/barretenberg/ultra_honk/oink_prover.cpp

+ */
+template <typename Flavor>
+template <typename PolyDescs, typename CommDescs>
+void OinkProver<Flavor>::commit_round_groups(const PolyDescs& poly_groups,


federicobarbacovi · 2026-03-20T12:16:40Z

barretenberg/cpp/src/barretenberg/flavor/mega_flavor.hpp

+    static constexpr size_t INTERLEAVING_LOG_K = (BATCH_SIZE_ <= 1)   ? 0
+                                                 : (BATCH_SIZE_ <= 2) ? 1
+                                                 : (BATCH_SIZE_ <= 4) ? 2
+                                                                      : 3;


Should we ever hit the 3 case?

federicobarbacovi · 2026-03-20T12:23:12Z

barretenberg/cpp/src/barretenberg/flavor/mega_interleaving_entities.hpp

+ * @brief ZK-specific masking entities, specialized per (DataType, BATCH_SIZE, HasZK).
+ *
+ * - (any BS, HasZK=false): empty
+ * - (BS=1, HasZK=true):    single gemini_masking_poly


You're missing BS=2 here and in various other places in the comments

federicobarbacovi · 2026-03-20T12:25:45Z

barretenberg/cpp/src/barretenberg/flavor/mega_interleaving_entities.hpp

+                          interleaved_precomputed_4, // P₅: [sigma_2, sigma_3, sigma_4, id_1]
+                          interleaved_precomputed_5, // P₆: [id_2, id_3, id_4, table_1]
+                          interleaved_precomputed_6, // P₇: [table_2, table_3, table_4, lagrange_first]
+                          interleaved_precomputed_7) // P₈: [lagrange_last, lagrange_ecc_op, databus_id] (3 polys)


Missing a zero at the end of this group

federicobarbacovi · 2026-03-23T09:50:25Z

barretenberg/cpp/src/barretenberg/ecc/scalar_multiplication/scalar_multiplication.cpp

+    const size_t total_size = n * batch_size;
+
+    // Build interleaved scalar array: for logical index i, place chunk_j at position batch_size*i + j.
+    std::vector<Fr> interleaved_scalars(total_size, Fr::zero());


In the function description you say you don't materialize the interleaved buffer but then you construct this vector, aren't these two statements in contradiction?

federicobarbacovi · 2026-03-23T10:00:12Z

barretenberg/cpp/src/barretenberg/stdlib/honk_verifier/honk_recursive_verifier.test.cpp

        EXPECT_EQ(cc.size(), 1);

-        // Expected variables in one gate:
+        // TODO: MultiMega oink verifier receives 4 individual ecc_op_wire commitments for merge protocol


I think this is a runaway comment. However, what is correct is that we wouldn't be able to set Flavor = DualMegaFlavor in Chonk at the moment because the Merge is not integrated with it, maybe it's worth pointing out

federicobarbacovi · 2026-03-23T11:02:05Z

barretenberg/cpp/src/barretenberg/commitment_schemes/gemini/gemini.hpp

+                batched_unshifted = std::move(extended);
+            }
+            if (!batched_shifted_tail_.is_empty()) {
+                batched_to_be_shifted += batched_shifted_tail_;


Why does this not need to be extended?

federicobarbacovi · 2026-03-23T11:07:57Z

barretenberg/cpp/src/barretenberg/commitment_schemes/gemini/gemini.hpp

+                batched_to_be_shifted *= r_inv_shift; // G = G/r^k
+
+                A_0_pos += batched_to_be_shifted; // A₀₊ += G/r^k
+                // A₀₋(X) = F(X) + (-1)^k · G(X)/r^k so that A₀₋(-r) = A₀(-r)


Suggested change

// A₀₋(X) = F(X) + (-1)^k · G(X)/r^k so that A₀₋(-r) = A₀(-r)

// A₀₋(X) = F(X) + (-1)^k · G(X)/r^k since (-r)^k = (-1)^k · r^k. For odd k: subtract. For even k: add.

federicobarbacovi · 2026-03-23T12:37:44Z

...berg/cpp/src/barretenberg/chonk/batched_honk_translator/batched_honk_translator_verifier.hpp

+                                       MEGA_ZK_ORIG,           // MegaZK original: witness start in unshifted
+                                       MEGA_ZK_DUP,            // MegaZK duplicate: mega_shifted start in shifted
+                                       S,                      // MegaZK count
+                                       2 /* shplemini_offset: Q + translator_masking_poly */);


Where is the 2 coming from?

iakovenkos and others added 14 commits February 4, 2026 00:09

add analysis

d6ddd76

add interleaved pippenger

2b87428

add benches

9ef3957

first approximation

351f0e5

next step smth

6dd3845

manifests match

6e1a58e

some ordering fixes

6f3b684

add multipcs tests and polynomial shift support

54c0cb2

rm infos

9a04119

debugging

974af8d

tests ok, cleanup

2c379d2

clean-up

f81f69b

gniumg-source added a commit to gniumg-source/aztec-packages that referenced this pull request Feb 9, 2026

Update README.md

2e4e418

@claude AztecProtocol#20272 @ludamad AztecProtocol#20172 @asterite AztecProtocol#20273 @rex4539 AztecProtocol#20198 @michaelelliot AztecProtocol#20230

gniumg-source mentioned this pull request Feb 9, 2026

Update README.md #20274

Closed

iakovenkos and others added 5 commits February 10, 2026 19:22

bench + upd md

710c642

Merge remote-tracking branch 'origin/merge-train/barretenberg' into s…

1ccbab0

…i/multipcs-proto

Merge branch 'merge-train/barretenberg' into si/multipcs-proto

e67028f

delete stale mds

6eabcf3

fixes after bad merge

5a0d701

iakovenkos changed the title ~~chore: multi-chonk prototype~~ chore: add MegaFlavor using multiPCS Feb 18, 2026

iakovenkos changed the title ~~chore: add MegaFlavor using multiPCS~~ chore: add MegaFlavors using multiPCS Feb 18, 2026

iakovenkos marked this pull request as ready for review February 18, 2026 13:26

iakovenkos requested review from IlyasRidhuan, fcarreiro and jeanmon as code owners February 18, 2026 13:26

iakovenkos added 3 commits February 19, 2026 15:58

Merge remote-tracking branch 'origin/merge-train/barretenberg' into s…

27544b2

…i/multipcs-proto

backport

cd36385

rm clutter

ac88439

iakovenkos and others added 24 commits March 16, 2026 16:25

fix build/merge issues

5d82742

test fixes

218db6a

mem efficient interleaving

4b759ac

fix megahonk<4>

87acc7f

decluttering

ed0ee73

rm dead code

866ae66

moore clean up

49f1c1e

Merge remote-tracking branch 'origin/merge-train/barretenberg' into s…

f131a2f

…i/multipcs-proto

clean up

b77cfe6

fixes and deduplication

723ada8

tests green

cca146f

format

b7c0124

rm clutter from prover polys

542de10

deduplicate proof length

30de600

fix tests

7aacfcb

Merge branch 'merge-train/barretenberg' into si/multipcs-proto

6a33240

fix docs

47be4a8

simplify

d3d63e5

rm shpl bench

a6298a7

iakovenkos changed the title ~~chore: add MegaFlavors using multiPCS~~ feat: multiPCS infra for Ultra and Mega Mar 19, 2026

iakovenkos self-assigned this Mar 19, 2026

iakovenkos requested a review from federicobarbacovi March 19, 2026 14:24

federicobarbacovi approved these changes Mar 23, 2026

View reviewed changes

Base automatically changed from merge-train/barretenberg to next March 24, 2026 00:19

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: multiPCS infra for Ultra and Mega#20230

feat: multiPCS infra for Ultra and Mega#20230
iakovenkos wants to merge 62 commits intonextfrom
si/multipcs-proto

iakovenkos commented Feb 6, 2026 •

edited

Loading

Uh oh!

federicobarbacovi left a comment

Uh oh!

federicobarbacovi Mar 20, 2026

Uh oh!

federicobarbacovi Mar 20, 2026

Uh oh!

federicobarbacovi Mar 20, 2026

Uh oh!

federicobarbacovi Mar 20, 2026

Uh oh!

federicobarbacovi Mar 20, 2026

Uh oh!

federicobarbacovi Mar 23, 2026

Uh oh!

federicobarbacovi Mar 23, 2026

Uh oh!

federicobarbacovi Mar 23, 2026

Uh oh!

federicobarbacovi Mar 23, 2026

Uh oh!

federicobarbacovi Mar 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	// A₀₋(X) = F(X) + (-1)^k · G(X)/r^k so that A₀₋(-r) = A₀(-r)
	// A₀₋(X) = F(X) + (-1)^k · G(X)/r^k since (-r)^k = (-1)^k · r^k. For odd k: subtract. For even k: add.

Conversation

iakovenkos commented Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Key changes

Prover Benchmarks (8 cores, wall time)

Recursive Verifier Circuit Size (UltraCircuitBuilder, DefaultIO)

Test plan

Uh oh!

federicobarbacovi left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

iakovenkos commented Feb 6, 2026 •

edited

Loading

Recursive Verifier Circuit Size (`UltraCircuitBuilder`, `DefaultIO`)