Sumcheck Primer

• Given a polynomial $$g: \mathbb{F}^\mu \rightarrow \mathbb{F}$$ and $$X = \{x_i\}_{i \in [\mu]}$$ compute the sum
\begin{aligned} H = \sum_{X \in B_\mu} g(x_1, x_2, \dots, x_\mu) \end{aligned}
• Naively, a verifier would require $$|B_\mu|=2^\mu$$ evaluations of $$g(.)$$
• Sumcheck protocol requires $$\mathcal{O}(\mu + \lambda)$$ verifier work
• Here $$\lambda$$ is the cost to evaluate $$g(.)$$ at some $$r \in \mathbb{F}^{\mu}$$
• Prover's work is $$\mathcal{O}(2^\mu)$$, i.e. linear in no of constraints

$$g_1(\textcolor{orange}{X_1}) := \sum_{x_2\dots}g(\textcolor{orange}{X_1},x_2, \dots, x_m)$$

$$g_2(\textcolor{orange}{X_2}) := \sum_{x_3\dots}g(\textcolor{green}{r_1}, \textcolor{orange}{X_2}, x_3, \dots, x_m)$$

$$v \stackrel{?}{=} g_1(0) + g_1(1)$$

$$g_1(\textcolor{green}{r_1}) \stackrel{?}{=} g_2(0) + g_2(1)$$

$$g_3(\textcolor{orange}{X_3}) := \sum_{x_4\dots}g(\textcolor{green}{r_1}, \textcolor{green}{r_2}, \textcolor{orange}{X_3}, x_4, \dots, x_m)$$

$$g_\mu(\textcolor{orange}{X_\mu}) := g(\textcolor{green}{r_1}, \textcolor{green}{r_2}, \dots, \textcolor{green}{r_{\mu-1}}, \textcolor{orange}{X_\mu})$$

$$g_2(\textcolor{green}{r_2}) \stackrel{?}{=} g_3(0) + g_3(1)$$

$$g_{\mu-1}(\textcolor{green}{r_{\mu-1}}) \stackrel{?}{=} g_\mu(0) + g_\mu(1)$$

$$g_{\mu}(\textcolor{green}{r_{\mu}}) \stackrel{?}{=} g(\textcolor{green}{r_1}, \textcolor{green}{r_2}, \dots, \textcolor{green}{r_\mu})$$

Prover $$\mathcal{P}$$

Verifier $$\mathcal{V}$$

$$g_1$$

$$r_1$$

$$g_2$$

$$g_3$$

$$g_\mu$$

$$r_{\mu-1}$$

$$r_2$$

$$\vdots$$

$$\vdots$$

$$\vdots$$

Sumcheck for MLE Polynomials

• Given a vector $$\vec{f}\in \mathbb{F}^{2^\mu},$$ we can write its (unique) multi-linear extension $$f(\mathbf{X})$$ as:
f(\textcolor{lightgrey}{0, 0, \dots, 0, 0}) \leftarrow \textcolor{orange}{\vec{f}[0]}
f(\textcolor{lightgrey}{0, 0, \dots, 0,} \textcolor{skyblue}{1}) \leftarrow \textcolor{orange}{\vec{f}[1]}
f(\textcolor{lightgrey}{0, 0, \dots, } \textcolor{skyblue}{1} \textcolor{lightgrey}{,0}) \leftarrow \textcolor{orange}{\vec{f}[2]}
f(\textcolor{skyblue}{1, 1, \dots, 1} \textcolor{lightgrey}{,0}) \leftarrow \textcolor{orange}{\vec{f}[2^\mu-2]}
f(\textcolor{skyblue}{1, 1, \dots, 1, 1}) \leftarrow \textcolor{orange}{\vec{f}[2^\mu-1]}
\begin{aligned} f(\mathbf{X}) := & \ \textcolor{lightgrey}{(1-X_\mu)(1-X_{\mu-1})\dots}\textcolor{lightgrey}{(1-X_2)}\textcolor{lightgrey}{(1-X_1)}\textcolor{orange}{\vec{f}[0]} \ + \\ & \ \textcolor{lightgrey}{(1-X_\mu)(1-X_{\mu-1})\dots}\textcolor{lightgrey}{(1-X_2)}\textcolor{skyblue}{X_1}\textcolor{orange}{\vec{f}[1]} \ + \\ & \ \textcolor{lightgrey}{(1-X_\mu)(1-X_{\mu-1})\dots}\textcolor{skyblue}{X_2}\textcolor{lightgrey}{(1-X_1)}\textcolor{orange}{\vec{f}[2]} \ + \\ & \ \vdots \\ & \ \textcolor{skyblue}{X_\mu X_{\mu-1} \dots}\textcolor{skyblue}{X_2}\textcolor{lightgrey}{(1-X_1)}\textcolor{orange}{\vec{f}[2^\mu-2]} \ + \\ & \ \textcolor{skyblue}{X_\mu X_{\mu-1} \dots}\textcolor{skyblue}{X_2}\textcolor{skyblue}{X_1}\textcolor{orange}{\vec{f}[2^\mu-1]}. \\ \end{aligned}
\implies
\vdots
• MLEs makes sumcheck prover's computation faster and parallelisable
• Computing round polynomials is easy
\implies
\begin{aligned} r_1(X_\mu) = (1-X_\mu) \Big( \textcolor{lightgreen}{\vec{f}[0] + \vec{f}[1] + \dots + \vec{f}[2^{\mu-1}-1]} \Big) \end{aligned}
+ \ X_\mu \Big( \textcolor{orange}{\vec{f}[2^{\mu-1}] + \dots + \vec{f}[2^{\mu}-1]} \Big)

Sums of halves $$\rightarrow$$ easy!

• Updating original polynomial with challenge $$\alpha_1$$ is tricky
f(\alpha_1\textcolor{lightgrey}{, 0, \dots, 0, 0}) \leftarrow (1-\alpha_1)\textcolor{lightgreen}{\vec{f}[0]} + \alpha_1\textcolor{orange}{\vec{f}[2^{\mu-1}]}
f(\alpha_1\textcolor{lightgrey}{, 0, \dots, 0, }\textcolor{skyblue}{1}) \leftarrow (1-\alpha_1)\textcolor{lightgreen}{\vec{f}[1]} + \alpha_1\textcolor{orange}{\vec{f}[2^{\mu-1}+1]}
f(\alpha_1\textcolor{lightgrey}{, 0, \dots, }\textcolor{skyblue}{1} \textcolor{lightgrey}{, 0}) \leftarrow (1-\alpha_1)\textcolor{lightgreen}{\vec{f}[2]} + \alpha_1\textcolor{orange}{\vec{f}[2^{\mu-1}+2]}

Sumcheck for MLE Polynomials

f(\mathbf{X})

Round computation can be parallelised

Round $$i+1$$ depends on round $$i$$ challenge

Need to process all terms to compute challenge

f_{1,o}
f_{1,e}
\sum
\sum
\textsf{hash}
\alpha_1
f_{2,o}
f_{2,e}
\sum
\sum
\textsf{hash}
\alpha_2
f_{3,o}
f_{3,e}
\sum
\sum
\textsf{hash}
\alpha_3
f_{4,o}
f_{4,e}
\textsf{hash}
\alpha_4

Sumcheck for R1CS

\begin{bmatrix} \\ & \bar{A} & \\ \\ \end{bmatrix} \hspace{-6pt} \begin{bmatrix} \\ \vec{z}\\ \\ \end{bmatrix} \circ \begin{bmatrix} \\ & \bar{B} & \\ \\ \end{bmatrix} \hspace{-6pt} \begin{bmatrix} \\ \vec{z}\\ \\ \end{bmatrix} = \begin{bmatrix} \\ & \bar{C} & \\ \\ \end{bmatrix} \hspace{-6pt} \begin{bmatrix} \\ \vec{z}\\ \\ \end{bmatrix}
\underbrace{\hspace{2.6cm}}
2^\mu
F(x) := \Bigg(\sum_{y \in \mathbb{B}_\mu}A(x,y)z(y)\Bigg)\Bigg(\sum_{y \in \mathbb{B}_\mu}B(x,y)z(y)\Bigg) - \sum_{y \in \mathbb{B}_\mu}C(x,y)z(y)
\sum_{x\in \mathbb{B}_\mu}\gamma_x F(x) = 0
\implies F(x) = 0 \quad \forall x \in \mathbb{B}_\mu

We need to prove that $$F$$ is 0 on all points of $$\mathbb{B}_\mu$$

G(x) := \left(\Bigg(\sum_{y \in \mathbb{B}_\mu}A(x,y)z(y)\Bigg)\Bigg(\sum_{y \in \mathbb{B}_\mu}B(x,y)z(y)\Bigg) - \sum_{y \in \mathbb{B}_\mu}C(x,y)z(y)\right) \textcolor{orange}{\textsf{eq}(x, \tau)}
G(x) := a(x)b(x)\textsf{eq}(x) - c(x)\textsf{eq}(x)
• We need sumcheck on sums of products of MLE polynomials
• Trivial to extend sumcheck for one polynomial to sums of products
A: \mathbb{F}^{2 \mu} \rightarrow \mathbb{F}
B: \mathbb{F}^{2 \mu} \rightarrow \mathbb{F}
C: \mathbb{F}^{2 \mu} \rightarrow \mathbb{F}
z: \mathbb{F}^{\mu} \rightarrow \mathbb{F}
\textsf{combine}_G(a,b,c,d) := abd - cd
f_1(\mathbf{X})
f_2(\mathbf{X})
f_3(\mathbf{X})
f_4(\mathbf{X})
f_5(\mathbf{X})
f_{1,o}
f_{1,e}
f_{2,o}
f_{2,e}
f_{3,o}
f_{3,e}
f_{4,o}
f_{4,e}
f_{5,o}
f_{5,e}
\sum
\sum
\sum
\sum
\sum
\sum
\sum
\sum
\sum
\sum
L(1,0)
L(0,1)
L(-1,2)
L(-2,3)
L(-3,4)
L(-4,5)
L(1,0)
L(0,1)
L(-1,2)
L(-2,3)
L(-3,4)
L(-4,5)
L(1,0)
L(0,1)
L(-1,2)
L(-2,3)
L(-3,4)
L(-4,5)
L(1,0)
L(0,1)
L(-1,2)
L(-2,3)
L(-3,4)
L(-4,5)
L(1,0)
L(0,1)
L(-1,2)
L(-2,3)
L(-3,4)
L(-4,5)
\textsf{combine}
\textsf{combine}
\textsf{combine}
\textsf{combine}
\textsf{combine}
\textsf{combine}
r_i(X)
\textsf{hash}
\alpha_i
f_1(\mathbf{X})
f_2(\mathbf{X})
f_3(\mathbf{X})
f_4(\mathbf{X})
f_5(\mathbf{X})
f_{1,o}
f_{1,e}
f_{2,o}
f_{2,e}
f_{3,o}
f_{3,e}
f_{4,o}
f_{4,e}
f_{5,o}
f_{5,e}
\sum
\sum
\sum
\sum
\sum
\sum
\sum
\sum
\sum
\sum
L(1,0)
L(0,1)
L(-1,2)
L(-2,3)
L(-3,4)
L(-4,5)
L(1,0)
L(0,1)
L(-1,2)
L(-2,3)
L(-3,4)
L(-4,5)
L(1,0)
L(0,1)
L(-1,2)
L(-2,3)
L(-3,4)
L(-4,5)
L(1,0)
L(0,1)
L(-1,2)
L(-2,3)
L(-3,4)
L(-4,5)
L(1,0)
L(0,1)
L(-1,2)
L(-2,3)
L(-3,4)
L(-4,5)
\textsf{combine}
\textsf{combine}
\textsf{combine}
\textsf{combine}
\textsf{combine}
\textsf{combine}
r_i(X)
\textsf{hash}
\alpha_i
L_{(1-\alpha, \alpha)}
L_{(1-\alpha, \alpha)}
L_{(1-\alpha, \alpha)}
L_{(1-\alpha, \alpha)}
L_{(1-\alpha, \alpha)}
(1-\alpha_i)
(\alpha_i)
+
f_1(\mathbf{X})
f_2(\mathbf{X})
f_3(\mathbf{X})
f_4(\mathbf{X})
f_5(\mathbf{X})
f_{1,o}
f_{1,e}
f_{2,o}
f_{2,e}
f_{3,o}
f_{3,e}
f_{4,o}
f_{4,e}
f_{5,o}
f_{5,e}
\sum
\sum
\sum
\sum
\sum
\sum
\sum
\sum
\sum
\sum
L(1,0)
L(0,1)
L(-1,2)
L(-2,3)
L(-3,4)
L(-4,5)
L(1,0)
L(0,1)
L(-1,2)
L(-2,3)
L(-3,4)
L(-4,5)
L(1,0)
L(0,1)
L(-1,2)
L(-2,3)
L(-3,4)
L(-4,5)
L(1,0)
L(0,1)
L(-1,2)
L(-2,3)
L(-3,4)
L(-4,5)
L(1,0)
L(0,1)
L(-1,2)
L(-2,3)
L(-3,4)
L(-4,5)
\textsf{combine}
\textsf{combine}
\textsf{combine}
\textsf{combine}
\textsf{combine}
\textsf{combine}
r_i(X)
\textsf{hash}
\alpha_i
L_{(1-\alpha, \alpha)}
L_{(1-\alpha, \alpha)}
L_{(1-\alpha, \alpha)}
L_{(1-\alpha, \alpha)}
f_1(\mathbf{X})
f_2(\mathbf{X})
f_3(\mathbf{X})
f_4(\mathbf{X})
f_5(\mathbf{X})
f_{1,o}
f_{1,e}
f_{2,o}
f_{2,e}
f_{3,o}
f_{3,e}
f_{4,o}
f_{4,e}
f_{5,o}
f_{5,e}
\sum
\sum
\sum
\sum
\sum
\sum
\sum
\sum
\sum
\sum
L(1,0)
L(0,1)
L(-1,2)
L(-2,3)
L(-3,4)
L(-4,5)
L(1,0)
L(0,1)
L(-1,2)
L(-2,3)
L(-3,4)
L(-4,5)
L(1,0)
L(0,1)
L(-1,2)
L(-2,3)
L(-3,4)
L(-4,5)
L(1,0)
L(0,1)
L(-1,2)
L(-2,3)
L(-3,4)
L(-4,5)
L(1,0)
L(0,1)
L(-1,2)
L(-2,3)
L(-3,4)
L(-4,5)
\textsf{combine}
\textsf{combine}
\textsf{combine}
\textsf{combine}
\textsf{combine}
\textsf{combine}
r_i(X)
\textsf{hash}
\alpha_i
L_{(1-\alpha, \alpha)}
L_{(1-\alpha, \alpha)}
L_{(1-\alpha, \alpha)}
f_1(\mathbf{X})
f_2(\mathbf{X})
f_3(\mathbf{X})
f_4(\mathbf{X})
f_5(\mathbf{X})
f_{1,o}
f_{1,e}
f_{2,o}
f_{2,e}
f_{3,o}
f_{3,e}
f_{4,o}
f_{4,e}
f_{5,o}
f_{5,e}
\sum
\sum
\sum
\sum
\sum
\sum
\sum
\sum
\sum
\sum
L(1,0)
L(0,1)
L(-1,2)
L(-2,3)
L(-3,4)
L(-4,5)
L(1,0)
L(0,1)
L(-1,2)
L(-2,3)
L(-3,4)
L(-4,5)
L(1,0)
L(0,1)
L(-1,2)
L(-2,3)
L(-3,4)
L(-4,5)
L(1,0)
L(0,1)
L(-1,2)
L(-2,3)
L(-3,4)
L(-4,5)
L(1,0)
L(0,1)
L(-1,2)
L(-2,3)
L(-3,4)
L(-4,5)
\textsf{combine}
\textsf{combine}
\textsf{combine}
\textsf{combine}
\textsf{combine}
\textsf{combine}
r_i(X)
\textsf{hash}
\alpha_i
f'_1(\mathbf{X})
f'_2(\mathbf{X})
f'_3(\mathbf{X})
f'_4(\mathbf{X})
f'_5(\mathbf{X})
f_{1,o}
f_{1,e}
f_{2,o}
f_{2,e}
f_{3,o}
f_{3,e}
f_{4,o}
f_{4,e}
f_{5,o}
f_{5,e}
\sum
\sum
\sum
\sum
\sum
\sum
\sum
\sum
\sum
\sum
L(1,0)
L(0,1)
L(-1,2)
L(-2,3)
L(-3,4)
L(-4,5)
L(1,0)
L(0,1)
L(-1,2)
L(-2,3)
L(-3,4)
L(-4,5)
L(1,0)
L(0,1)
L(-1,2)
L(-2,3)
L(-3,4)
L(-4,5)
L(1,0)
L(0,1)
L(-1,2)
L(-2,3)
L(-3,4)
L(-4,5)
L(1,0)
L(0,1)
L(-1,2)
L(-2,3)
L(-3,4)
L(-4,5)
\textsf{combine}
\textsf{combine}
\textsf{combine}
\textsf{combine}
\textsf{combine}
\textsf{combine}
r_i(X)
\textsf{hash}
\alpha_i
f'_1(\mathbf{X})
f'_2(\mathbf{X})
f'_3(\mathbf{X})
f'_4(\mathbf{X})
f'_5(\mathbf{X})
f_{1,o}
f_{1,e}
f_{2,o}
f_{2,e}
f_{3,o}
f_{3,e}
f_{4,o}
f_{4,e}
f_{5,o}
f_{5,e}
\sum
\sum
\sum
\sum
\sum
\sum
\sum
\sum
\sum
\sum
L(1,0)
L(0,1)
L(-1,2)
L(-2,3)
L(-3,4)
L(-4,5)
L(1,0)
L(0,1)
L(-1,2)
L(-2,3)
L(-3,4)
L(-4,5)
L(1,0)
L(0,1)
L(-1,2)
L(-2,3)
L(-3,4)
L(-4,5)
L(1,0)
L(0,1)
L(-1,2)
L(-2,3)
L(-3,4)
L(-4,5)
L(1,0)
L(0,1)
L(-1,2)
L(-2,3)
L(-3,4)
L(-4,5)
\textsf{combine}
\textsf{combine}
\textsf{combine}
\textsf{combine}
\textsf{combine}
\textsf{combine}
r_{i+1}(X)
\textsf{hash}
\alpha_{i+1}

L2 Cache

\underbrace{\hspace{4.25cm}}
\ell

Sumcheck in GPU

• Main hurdle: L2 cache size is just 96MB
• Can fit an R1CS sumcheck instance of size $$\le 2^{19}$$
• For larger instances, we need to read and write to memory to update the state
• Alternatively, we can break a large sumcheck instance into several smaller instances