GKR-based Lookups
Rational Sumcheck
\begin{aligned}
c = \sum_{x\in H} \frac{\textcolor{lightgreen}{p(X)}}{\textcolor{orange}{q(X)}}
\end{aligned}
- Polynomial functions:
- \(f(X) = c_0 + c_1X + \dots c_nX^n\)
- Rational functions:
- \(r(X) = \frac{\textcolor{lightgreen}{p(X)}}{\textcolor{orange}{q(X)}}\)
- Generally, a rational function is not a polynomial function
- Therefore, we cannot directly apply the sumcheck protocol
- There is a workaround though:
Rational Sumcheck
- Define a polynomial \(f(X)\) such that
\begin{aligned}
\forall x\in H, \quad f(x) := \frac{\textcolor{lightgreen}{p(x)}}{\textcolor{orange}{q(x)}}.
\end{aligned}
- Then we can compute \(g(X)\) and \(h(X)\) such that:
\begin{aligned}
f(X) = X\textcolor{red}{g(X)} + \frac{\sigma}{|H|}
\end{aligned}
\begin{aligned}
f(X) \cdot q(X) - p(X) = \textcolor{red}{h(X)}v_H(X)
\end{aligned}
\(\longleftarrow\) Classic Aurora sumcheck
\(\longleftarrow\) Quotient check
- Prover cost: \(\mathcal{O}(N\cdot \text{log}(N))\) where \(N = |H|\)
- Can we do better?
Sumcheck
x_1
x_2
x_3
x_1
x_2
x_3
- Round polynomial: \(r_i(X) = \textcolor{lightgreen}{f_{\text{lo}}}(1-X) + \textcolor{red}{f_{\text{hi}}}X\)
- Challenge: \(\alpha_i = H(r_i)\)
Sumcheck
x_1
x_2
x_3
x_1
x_2
- Round polynomial: \(r_i(X) = \textcolor{lightgreen}{f_{\text{lo}}}(1-X) + \textcolor{red}{f_{\text{hi}}}X\)
- Challenge: \(\alpha_i = H(r_i)\)
Sumcheck
x_1
x_2
x_3
x_1
x_2
x_1
x_2
- Round polynomial: \(r_i(X) = \textcolor{lightgreen}{f_{\text{lo}}}(1-X) + \textcolor{red}{f_{\text{hi}}}X\)
- Challenge: \(\alpha_i = H(r_i)\)
Sumcheck
x_1
x_2
x_3
x_1
x_2
x_1
- Round polynomial: \(r_i(X) = \textcolor{lightgreen}{f_{\text{lo}}}(1-X) + \textcolor{red}{f_{\text{hi}}}X\)
- Challenge: \(\alpha_i = H(r_i)\)
Sumcheck
x_1
x_2
x_3
x_1
x_2
x_1
- Round polynomial: \(r_i(X) = \textcolor{lightgreen}{f_{\text{lo}}}(1-X) + \textcolor{red}{f_{\text{hi}}}X\)
- Challenge: \(\alpha_i = H(r_i)\)
Sumcheck
x_1
x_2
x_3
x_1
x_2
x_1
- Round polynomial: \(r_i(X) = \textcolor{lightgreen}{f_{\text{lo}}}(1-X) + \textcolor{red}{f_{\text{hi}}}X\)
- Challenge: \(\alpha_i = H(r_i)\)
2^3
2^2
2^1
Dimensionality reduction!
Rethinking Rational Sumcheck
\begin{aligned}
\frac{\textcolor{orange}{p_1}}{\textcolor{lightgreen}{q_1}}
\end{aligned}
\begin{aligned}
\frac{\textcolor{orange}{p_2}}{\textcolor{lightgreen}{q_2}}
\end{aligned}
\begin{aligned}
\frac{\textcolor{orange}{p_3}}{\textcolor{lightgreen}{q_3}}
\end{aligned}
\begin{aligned}
\frac{\textcolor{orange}{p_4}}{\textcolor{lightgreen}{q_4}}
\end{aligned}
\begin{aligned}
\frac{\textcolor{orange}{p_5}}{\textcolor{lightgreen}{q_5}}
\end{aligned}
\begin{aligned}
\frac{\textcolor{orange}{p_6}}{\textcolor{lightgreen}{q_6}}
\end{aligned}
\begin{aligned}
\frac{\textcolor{orange}{p_7}}{\textcolor{lightgreen}{q_7}}
\end{aligned}
\begin{aligned}
\frac{\textcolor{orange}{p_8}}{\textcolor{lightgreen}{q_8}}
\end{aligned}
+
+
+
+
+
+
+
\begin{aligned}
\frac{\textcolor{orange}{p_1}\textcolor{lightgreen}{q_2} + \textcolor{orange}{p_2}\textcolor{lightgreen}{q_1}}{\textcolor{lightgreen}{q_1q_2}}
\end{aligned}
\begin{aligned}
\frac{\textcolor{orange}{p_3}\textcolor{lightgreen}{q_4} + \textcolor{orange}{p_4}\textcolor{lightgreen}{q_3}}{\textcolor{lightgreen}{q_3q_4}}
\end{aligned}
\begin{aligned}
\frac{\textcolor{orange}{p_5}\textcolor{lightgreen}{q_6} + \textcolor{orange}{p_6}\textcolor{lightgreen}{q_5}}{\textcolor{lightgreen}{q_5q_6}}
\end{aligned}
\begin{aligned}
\frac{\textcolor{orange}{p_7}\textcolor{lightgreen}{q_8} + \textcolor{orange}{p_8}\textcolor{lightgreen}{q_7}}{\textcolor{lightgreen}{q_7q_8}}
\end{aligned}
\begin{aligned}
\frac{\textcolor{orange}{p_1}\textcolor{lightgreen}{q_2q_3q_4} +
\textcolor{orange}{p_2}\textcolor{lightgreen}{q_1q_3q_4} +
\textcolor{orange}{p_3}\textcolor{lightgreen}{q_1q_2q_4} +
\textcolor{orange}{p_4}\textcolor{lightgreen}{q_1q_2q_3}}{
\textcolor{lightgreen}{q_1q_2q_3q_4}}
\end{aligned}
\begin{aligned}
\frac{\textcolor{orange}{p_5}\textcolor{lightgreen}{q_6q_7q_8} +
\textcolor{orange}{p_6}\textcolor{lightgreen}{q_5q_7q_8} +
\textcolor{orange}{p_7}\textcolor{lightgreen}{q_5q_6q_8} +
\textcolor{orange}{p_8}\textcolor{lightgreen}{q_5q_6q_7}}{
\textcolor{lightgreen}{q_5q_6q_7q_8}}
\end{aligned}
\begin{aligned}
\frac{
\textcolor{orange}{p_1}\textcolor{lightgreen}{q_2q_3\dots q_8} +
\textcolor{orange}{p_2}\textcolor{lightgreen}{q_1q_3 \dots q_8} +
\textcolor{orange}{p_3}\textcolor{lightgreen}{q_1q_2 \dots q_8} +
\textcolor{orange}{p_4}\textcolor{lightgreen}{q_1q_2 \dots q_8} +
\textcolor{orange}{p_5}\textcolor{lightgreen}{q_1q_2\dots q_8} +
\textcolor{orange}{p_6}\textcolor{lightgreen}{q_1q_2 \dots q_8} +
\textcolor{orange}{p_7}\textcolor{lightgreen}{q_1q_2 \dots q_8} +
\textcolor{orange}{p_8}\textcolor{lightgreen}{q_1q_2 \dots q_8}
}{
\textcolor{lightgreen}{q_1q_2q_3q_4q_5q_6q_7q_8}}
\end{aligned}
2^3
2^2
2^1
GKR Circuit
*
*
*
*
*
*
*
*
(a_1\quad b_1)
(a_2\quad b_2)
(a_3\quad b_3)
(a_4\quad b_4)
(a_5\quad b_5)
(a_6\quad b_6)
(a_7\quad b_7)
(a_8\quad b_8)
*
*
*
*
*
*
*
\(+/\times\) gates
*
: \left(
(\textcolor{orange}{p_1}, \textcolor{lightgreen}{q_1}), \
(\textcolor{orange}{p_2}, \textcolor{lightgreen}{q_2})
\right)
\longrightarrow
(\textcolor{orange}{p_1}\textcolor{lightgreen}{q_2} + \textcolor{orange}{p_2}\textcolor{lightgreen}{q_1})
\longleftarrow \text{numerator}
\#
: \left(
(\textcolor{orange}{p_1}, \textcolor{lightgreen}{q_1}), \
(\textcolor{orange}{p_2}, \textcolor{lightgreen}{q_2})
\right)
\longrightarrow
(\textcolor{lightgreen}{q_2}\textcolor{lightgreen}{q_1})
\longleftarrow \text{denominator}
Recall logUp
\begin{aligned}
\textsf{lhs} =&\ (\textcolor{brown}{\beta} + f_1)(\textcolor{brown}{\beta} + f_2)(\textcolor{brown}{\beta} + f_3)
\dots(\textcolor{brown}{\beta} + f_{18})(\textcolor{brown}{\beta} + f_{19}) \\
=&\ \prod_{i=1}^{n} (\textcolor{brown}{\beta} + f_i)
\end{aligned}
\begin{aligned}
\textsf{rhs} =&\ (\textcolor{brown}{\beta} + t_1)^4
(\textcolor{brown}{\beta} + t_2)^2
(\textcolor{brown}{\beta} + t_3)^4
(\textcolor{brown}{\beta} + t_4)^2
(\textcolor{brown}{\beta} + t_5)^1
(\textcolor{brown}{\beta} + t_6)^3
(\textcolor{brown}{\beta} + t_7)^3\\
=&\ \prod_{i=1}^{N} (\textcolor{brown}{\beta} + t_i)^{m_i}
\end{aligned}
\implies
\prod_{j=1}^{n} (\textcolor{brown}{\beta} + f_j) =
\prod_{i=1}^{N} (\textcolor{brown}{\beta} + t_i)^{m_i}
\implies
\sum_{j=1}^{n} \text{log}(\textcolor{brown}{\beta} + f_j) =
\sum_{i=1}^{N} m_i \cdot \text{log}(\textcolor{brown}{\beta} + t_i)
\implies
\begin{aligned}
\sum_{j=1}^{n} \frac{1}{(\textcolor{brown}{\beta} + f_j)} =
\sum_{i=1}^{N} \frac{m_i}{(\textcolor{brown}{\beta} + t_i)}
\end{aligned}
\underbrace{\hspace{13.4cm}}_{}
\underbrace{\hspace{4.9cm}}_{}
Table
Values
(\textcolor{brown}{\beta} + t_1)
(\textcolor{brown}{\beta} + t_2)
(\textcolor{brown}{\beta} + t_3)
(\textcolor{brown}{\beta} + t_4)
(\textcolor{brown}{\beta} + t_5)
(\textcolor{brown}{\beta} + t_6)
(\textcolor{brown}{\beta} + t_7)
(\textcolor{brown}{\beta} + f_1)
(\textcolor{brown}{\beta} + f_2)
(\textcolor{brown}{\beta} + f_3)
(\textcolor{brown}{\beta} + f_4)
(\textcolor{brown}{\beta} + f_5)
(\textcolor{brown}{\beta} + f_6)
(\textcolor{brown}{\beta} + f_7)
(\textcolor{brown}{\beta} + f_8)
(\textcolor{brown}{\beta} + f_9)
(\textcolor{brown}{\beta} + f_{10})
(\textcolor{brown}{\beta} + f_{11})
(\textcolor{brown}{\beta} + f_{12})
(\textcolor{brown}{\beta} + f_{13})
(\textcolor{brown}{\beta} + f_{14})
(\textcolor{brown}{\beta} + f_{15})
(\textcolor{brown}{\beta} + f_{16})
(\textcolor{brown}{\beta} + f_{17})
(\textcolor{brown}{\beta} + f_{18})
(\textcolor{brown}{\beta} + f_{19})
Recall logUp
\implies
\begin{aligned}
\sum_{j=1}^{n} \frac{1}{(\textcolor{brown}{\beta} + f_j)} =
\sum_{i=1}^{N} \frac{m_i}{(\textcolor{brown}{\beta} + t_i)}
\end{aligned}
Table
Values
(\textcolor{brown}{\beta} + t_1)
(\textcolor{brown}{\beta} + t_2)
(\textcolor{brown}{\beta} + t_3)
(\textcolor{brown}{\beta} + t_4)
(\textcolor{brown}{\beta} + t_5)
(\textcolor{brown}{\beta} + t_6)
(\textcolor{brown}{\beta} + t_7)
(\textcolor{brown}{\beta} + f_1)
(\textcolor{brown}{\beta} + f_2)
(\textcolor{brown}{\beta} + f_3)
(\textcolor{brown}{\beta} + f_4)
(\textcolor{brown}{\beta} + f_5)
(\textcolor{brown}{\beta} + f_6)
(\textcolor{brown}{\beta} + f_7)
(\textcolor{brown}{\beta} + f_8)
(\textcolor{brown}{\beta} + f_9)
(\textcolor{brown}{\beta} + f_{10})
(\textcolor{brown}{\beta} + f_{11})
(\textcolor{brown}{\beta} + f_{12})
(\textcolor{brown}{\beta} + f_{13})
(\textcolor{brown}{\beta} + f_{14})
(\textcolor{brown}{\beta} + f_{15})
(\textcolor{brown}{\beta} + f_{16})
(\textcolor{brown}{\beta} + f_{17})
(\textcolor{brown}{\beta} + f_{18})
(\textcolor{brown}{\beta} + f_{19})
- In most cases: \(N \gg n\), so we can write:
\implies
\begin{aligned}
\sum_{j=1}^{n} \frac{1}{(\textcolor{brown}{\beta} + f_j)} =
\sum_{j=1, m_{i_j} \neq 0}^{n} \frac{m_{i_j}}{(\textcolor{brown}{\beta} + t_{i_j})}
\end{aligned}
\implies
\begin{aligned}
\sum_{\vec{x}\in H_n} \left( \frac{m(\vec{x})}{(\textcolor{brown}{\beta} + t(\vec{x}))} - \frac{1}{(\textcolor{brown}{\beta} + f(\vec{x}))} \right) = 0
\end{aligned}
\implies
\begin{aligned}
\sum_{\vec{x}\in H_n} \left( m(\vec{x})\textcolor{red}{h(\vec{x})} - \textcolor{red}{h_1(\vec{x})} \right) = 0
\end{aligned}
- Prover has to send helpers \(h(X), h_1(X)\)
Recall logUp
Table
Values
(\textcolor{brown}{\beta} + t_1)
(\textcolor{brown}{\beta} + t_2)
(\textcolor{brown}{\beta} + t_3)
(\textcolor{brown}{\beta} + t_4)
(\textcolor{brown}{\beta} + t_5)
(\textcolor{brown}{\beta} + t_6)
(\textcolor{brown}{\beta} + t_7)
(\textcolor{brown}{\beta} + f_1)
(\textcolor{brown}{\beta} + f_2)
(\textcolor{brown}{\beta} + f_3)
(\textcolor{brown}{\beta} + f_4)
(\textcolor{brown}{\beta} + f_5)
(\textcolor{brown}{\beta} + f_6)
(\textcolor{brown}{\beta} + f_7)
(\textcolor{brown}{\beta} + f_8)
(\textcolor{brown}{\beta} + f_9)
(\textcolor{brown}{\beta} + f_{10})
(\textcolor{brown}{\beta} + f_{11})
(\textcolor{brown}{\beta} + f_{12})
(\textcolor{brown}{\beta} + f_{13})
(\textcolor{brown}{\beta} + f_{14})
(\textcolor{brown}{\beta} + f_{15})
(\textcolor{brown}{\beta} + f_{16})
(\textcolor{brown}{\beta} + f_{17})
(\textcolor{brown}{\beta} + f_{18})
(\textcolor{brown}{\beta} + f_{19})
\implies
\begin{aligned}
\sum_{\vec{x}\in H_n} \left( m(\vec{x})\textcolor{red}{h(\vec{x})} - \textcolor{red}{h_1(\vec{x})} \right) = 0
\end{aligned}
Recall logUp
Table
(\textcolor{brown}{\beta} + t_1)
(\textcolor{brown}{\beta} + t_2)
(\textcolor{brown}{\beta} + t_3)
(\textcolor{brown}{\beta} + t_4)
(\textcolor{brown}{\beta} + t_5)
(\textcolor{brown}{\beta} + t_6)
(\textcolor{brown}{\beta} + t_7)
(\textcolor{brown}{\beta} + f_1)
(\textcolor{brown}{\beta} + f_2)
(\textcolor{brown}{\beta} + f_3)
(\textcolor{brown}{\beta} + f_4)
(\textcolor{brown}{\beta} + f_5)
(\textcolor{brown}{\beta} + f_6)
(\textcolor{brown}{\beta} + f_7)
(\textcolor{brown}{\beta} + f_8)
(\textcolor{brown}{\beta} + f_9)
(\textcolor{brown}{\beta} + f_{10})
(\textcolor{brown}{\beta} + f_{11})
(\textcolor{brown}{\beta} + f_{12})
(\textcolor{brown}{\beta} + f_{13})
(\textcolor{brown}{\beta} + f_{14})
(\textcolor{brown}{\beta} + f_{15})
(\textcolor{brown}{\beta} + f_{16})
(\textcolor{brown}{\beta} + f_{17})
(\textcolor{brown}{\beta} + f_{18})
(\textcolor{brown}{\beta} + f_{19})
\implies
\begin{aligned}
\sum_{\vec{x}\in H_n} \left( m(\vec{x})\textcolor{red}{h(\vec{x})} - \textcolor{red}{h_1(\vec{x})} \right) = 0
\end{aligned}
Values
\textcolor{red}{h_1(\vec{x})} +
\textcolor{red}{h_2(\vec{x})}
\textcolor{red}{h_1(\vec{x})} +
\textcolor{red}{h_2(\vec{x})} +
\textcolor{red}{h_3(\vec{x})}
\textcolor{red}{h_1(\vec{x})}+
\textcolor{red}{h_2(\vec{x})}+
\textcolor{red}{h_3(\vec{x})}+
\textcolor{red}{h_4(\vec{x})}
\implies
\begin{aligned}
\sum_{\vec{x}\in H_n} \left( m(\vec{x})\textcolor{red}{h(\vec{x})} - \textcolor{red}{\sum_{j=1}^{M}h_j(\vec{x})} \right) = 0
\end{aligned}
- Prover has to send helpers \(m+1\) helpers
- Idea: Use GKR to do rational sumcheck!
GKR-logUp
\implies
\begin{aligned}
\sum_{\vec{x}\in H_n} \left( \frac{m(\vec{x})}{(\textcolor{brown}{\beta} + t(\vec{x}))} - \sum_{j=1}^{M} \frac{1}{(\textcolor{brown}{\beta} + f_j(\vec{x}))} \right) = 0
\end{aligned}
\implies
\begin{aligned}
\frac{m(0)}{(\textcolor{brown}{\beta} + t(0))} +
\frac{m(1)}{(\textcolor{brown}{\beta} + t(1))} +
\dots +
\frac{m(2^n-1)}{(\textcolor{brown}{\beta} + t(2^n-1))} +
\end{aligned}
\begin{aligned}
\frac{-1}{(\textcolor{brown}{\beta} + f_1(0))} +
\frac{-1}{(\textcolor{brown}{\beta} + f_1(1))} +
\dots +
\frac{-1}{(\textcolor{brown}{\beta} + f_1(2^n-1))} +
\end{aligned}
\begin{aligned}
\frac{-1}{(\textcolor{brown}{\beta} + f_2(0))} +
\frac{-1}{(\textcolor{brown}{\beta} + f_2(1))} +
\dots +
\frac{-1}{(\textcolor{brown}{\beta} + f_2(2^n-1))} +
\end{aligned}
\begin{aligned}
\frac{-1}{(\textcolor{brown}{\beta} + f_M(0))} +
\frac{-1}{(\textcolor{brown}{\beta} + f_M(1))} +
\dots +
\frac{-1}{(\textcolor{brown}{\beta} + f_M(2^n-1))}.
\end{aligned}
\vdots
\underbrace{\hspace{7cm}}{}
2^n(1 + M) \text{ terms}
2^{n+k} \text{ rational sumcheck}
\implies
Summary
- Prover has only 1 extra commitment: the multiplicities polynomial \(m(\vec{x})\)
- Cost of rational sumcheck is \(\mathcal{O}(N\cdot M)\) due to GKR trick
- Possible research directions:
- Where else do we use rational sumcheck? Marlin\(, \dots\)
- Power circuits (https://eprint.iacr.org/2023/1611.pdf)
- Plonk permutation argument with GKR-logUp
GKR-based Lookups
By Suyash Bagad
GKR-based Lookups
- 45
