add hypernova multifolding slides, udpate notes_hypernova

- add hypernova multifolding slides
- add hypernova details with colors on how the multifolding terms relate for LCCCS & CCCS

.gitignore

@@ -8,3 +8,5 @@
 *.toc
 *.bbl
 *.blg
+*.nav
+*.snm

hypernova-multifolding-slides.tex

@@ -0,0 +1,353 @@
+\documentclass{beamer}
+
+\mode<presentation>
+{
+  \usetheme{Frankfurt}
+  \usecolortheme{dove}  %% grey scale
+  \useinnertheme{circles}
+  \setbeamercovered{transparent}
+}
+
+\hypersetup{
+    colorlinks,
+    citecolor=black,
+    filecolor=black,
+    linkcolor=black,
+    urlcolor=blue
+}
+\usepackage{graphicx}
+\usepackage{pgf-umlsd} % diagrams
+
+\setbeamertemplate{itemize}{$\circ$}
+\setbeamertemplate{itemize items}{$\circ$}
+
+\beamertemplatenavigationsymbolsempty %% no navigation bar
+
+\setbeamertemplate{footline}{\hspace*{.1cm}\scriptsize{
+\hspace*{50pt} \hfill\insertframenumber/\inserttotalframenumber\hspace*{.1cm}\vspace*{.1cm}}}
+
+\setbeamertemplate{caption}[numbered]
+\setbeamerfont{caption}{size=\tiny}
+
+% message between threads. From https://tex.stackexchange.com/a/174765
+% Example:
+% \bloodymess[delay]{sender}{message content}{receiver}{DIR}{start note}{end note}
+\newcommand{\bloodymess}[7][0]{
+  \stepcounter{seqlevel}
+  \path
+  (#2)+(0,-\theseqlevel*\unitfactor-0.7*\unitfactor) node (mess from) {};
+  \addtocounter{seqlevel}{#1}
+  \path
+  (#4)+(0,-\theseqlevel*\unitfactor-0.7*\unitfactor) node (mess to) {};
+  \draw[->,>=angle 60] (mess from) -- (mess to) node[midway, above]
+  {#3};
+
+  \if R#5
+  \node (\detokenize{#3} from) at (mess from) {\llap{#6~}};
+  \node (\detokenize{#3} to) at (mess to) {\rlap{~#7}};
+  \else\if L#5
+  \node (\detokenize{#3} from) at (mess from) {\rlap{~#6}};
+  \node (\detokenize{#3} to) at (mess to) {\llap{#7~}};
+       \else
+       \node (\detokenize{#3} from) at (mess from) {#6};
+       \node (\detokenize{#3} to) at (mess to) {#7};
+       \fi
+  \fi
+}
+
+
+
+%Information to be included in the title page:
+\title{HyperNova's multifolding overview}
+\author{}
+\date{\scriptsize{2023-06-22\\\href{https://0xparc.org}{0xPARC} Novi team}}
+
+\begin{document}
+
+\frame{\titlepage}
+
+\section[Overview]{Overview}
+
+\begin{frame}{Multifolding - Overview}
+
+  \begin{tiny}
+  \begin{enumerate}
+    \item[1.] $V \rightarrow P: \gamma \in^R \mathbb{F},~ \beta \in^R \mathbb{F}^s$
+    \item[2.] $V: r_x' \in^R \mathbb{F}^s$
+    \item[3.] $V \leftrightarrow P$: sum-check protocol:
+		  $c \leftarrow \langle P, V(r_x') \rangle (g, s, d+1, \underbrace{\sum_{j \in [t]} \gamma^j \cdot v_j}_\text{T})$, where:
+		  \begin{align*}
+			  g(x) &:= \underbrace{\left( \sum_{j \in [t]} \gamma^j \cdot L_j(x) \right)}_\text{LCCCS check} + \underbrace{\gamma^{t+1} \cdot Q(x)}_\text{CCCS check}\\
+			  L_j(x) &:= \widetilde{eq}(r_x, x) \cdot \left(
+				  \underbrace{\sum_{y \in \{0,1\}^{s'}} \widetilde{M}_j(x, y) \cdot \widetilde{z}_1(y)}_\text{LCCCS check}
+			  \right)\\
+				  Q(x) := &\widetilde{eq}(\beta, x) \cdot \left(
+				  \underbrace{ \sum_{i=1}^q c_i \cdot \prod_{j \in S_i} \left( \sum_{y \in \{0, 1\}^{s'}} \widetilde{M}_j(x, y) \cdot \widetilde{z}_2(y) \right) }_\text{CCCS check}
+			  \right)
+		  \end{align*}
+  \end{enumerate}
+  \end{tiny}
+
+\end{frame}
+
+\begin{frame}{Multifolding - Overview}
+
+  \begin{tiny}
+  \begin{enumerate}
+    \item[4.] $P \rightarrow V$: $\left( (\sigma_1, \ldots, \sigma_t), (\theta_1, \ldots, \theta_t) \right)$, where $\forall j \in [t]$,
+		$$\sigma_j = \sum_{y \in \{0,1\}^{s'}} \widetilde{M}_j(r_x', y) \cdot \widetilde{z}_1(y)$$
+		$$\theta_j = \sum_{y \in \{0, 1\}^{s'}} \widetilde{M}_j(r_x', y) \cdot \widetilde{z}_2(y)$$
+	      \item[5.] V: $e_1 \leftarrow \widetilde{eq}(r_x, r_x')$, $e_2 \leftarrow \widetilde{eq}(\beta, r_x')$\\
+		check:
+		$$c = \left(\sum_{j \in [t]} \gamma^j \cdot e_1 \cdot \sigma_j \right) + \gamma^{t+1} \cdot e_2 \cdot \left( \sum_{i=1}^q c_i \cdot \prod_{j \in S_i} \theta_j \right)$$
+	      \item[6.] $V \rightarrow P: \rho \in^R \mathbb{F}$
+	      \item[7.] $V, P$: output the folded LCCCS instance $(C', u', \mathsf{x}', r_x', v_1', \ldots, v_t')$, where $\forall i \in [t]$:
+		\begin{align*}
+			C' &\leftarrow C_1 + \rho \cdot C_2\\
+			u' &\leftarrow u + \rho \cdot 1\\
+			\mathsf{x}' &\leftarrow \mathsf{x}_1 + \rho \cdot \mathsf{x}_2\\
+			v_i' &\leftarrow \sigma_i + \rho \cdot \theta_i
+		\end{align*}
+	      \item[8.] $P$: output folded witness and the folded $r_w'$:
+		\begin{align*}
+			\widetilde{w}' &\leftarrow \widetilde{w}_1 + \rho \cdot \widetilde{w}_2\\
+			r_w' &\leftarrow r_{w_1} + \rho \cdot r_{w_2}
+		\end{align*}
+  \end{enumerate}
+  \end{tiny}
+
+\end{frame}
+
+
+
+\begin{frame}{Multifolding - Overview}
+  \begin{tiny}
+\begin{center}
+	\begin{sequencediagram}
+		\newinst[1]{p}{Prover}
+		\newinst[3]{v}{Verifier}
+
+		\bloodymess[1]{v}{$\gamma,~\beta,~r_x'$}{p}{L}{
+			\shortstack{
+				$\gamma \in \mathbb{F},~ \beta \in \mathbb{F}^s$\\
+				$r_x' \in \mathbb{F}^s$
+			}
+		}{}
+		\bloodymess[1]{p}{$c,~ \pi_{SC}$}{v}{R}{sum-check prove}{sum-check verify}
+		\bloodymess[1]{p}{$\{\sigma_j\},~\{\theta_j\}$}{v}{R}{compute $\{\sigma_j\}, \{\theta_j\}~ \forall j \in [t]$}{verify $c$ with $\{\sigma_j\}, \{\theta_j\}$ relation}
+		\bloodymess[1]{v}{$\rho$}{p}{L}{$\rho \in^R \mathbb{F}$}{}
+		\callself[0]{p}{fold LCCCS instance}{p}
+		\prelevel
+		\callself[0]{v}{fold LCCCS instance}{v}
+		\callself[0]{p}{fold $\widetilde{w}, r_w$}{p}
+	\end{sequencediagram}
+\end{center}
+  \end{tiny}
+\end{frame}
+
+
+\section[Checks]{Checks}
+
+\begin{tiny}
+\begin{frame}{LCCCS checks}
+$$
+\color{gray}{g(x) :=}
+\color{black}{\underbrace{\left( \sum_{j \in [t]} \gamma^j \cdot L_j(x) \right)}_\text{LCCCS} }
+\color{gray}{+ \gamma^{t+1} \cdot Q(x)}
+$$
+$$
+L_j(x) := \widetilde{eq}(r_x, x) \cdot \left(
+\underbrace{\sum_{y \in \{0,1\}^{s'}} \widetilde{M}_j(x, y) \cdot \widetilde{z}_1(y)}_\text{LCCCS check}
+\right)
+$$
+
+
+Notice that, $v_j$ from LCCCS relation check
+
+\begin{align*}
+v_j &= \sum_{y \in \{0,1\}^{s'}} \widetilde{M}_j(r_x, y) \cdot \widetilde{z}_1(y)\\
+    &= \sum_{x \in \{0,1\}^s}
+	  \widetilde{eq}(r_x, x) \cdot \left( \sum_{y \in \{0,1\}^{s'}} \widetilde{M}_j(x, y) \cdot \widetilde{z}_1(y) \right)\\
+    &= \sum_{x \in \{0,1\}^s} L_j(x)
+\end{align*}
+  
+\end{frame}
+\begin{frame}{CCCS checks}
+  $$
+  \color{gray}{g(x) := \left( \sum_{j \in [t]} \gamma^j \cdot L_j(x) \right) +}
+  \color{black}{\underbrace{\gamma^{t+1} \cdot Q(x)}_\text{CCCS}}
+  $$
+$$Q(x) := \widetilde{eq}(\beta, x) \cdot \left(
+                    \underbrace{ \sum_{i=1}^q c_i \cdot \prod_{j \in S_i} \left( \sum_{y \in \{0, 1\}^{s'}} \widetilde{M}_j(x, y) \cdot \widetilde{z}_2(y) \right) }_\text{CCCS check}
+            \right)$$
+  
+  Recall that Spartan's $\widetilde{F}_{io}(x)$ here is $q(x)$, so we're doing the same Spartan check:
+  
+$$
+0 =G(\beta) = \sum_{x \in \{0,1\}^s} Q(x) = \sum_{x \in \{0,1\}^s} eq(\beta, x) \cdot q(x)$$
+$$= \sum_{x \in \{0,1\}^s}
+ \underbrace{\widetilde{eq}(\beta , x) \cdot
+         \overbrace{
+                \sum_{i=1}^q c_i \cdot \prod_{j \in S_i} \left( \sum_{y \in \{0, 1\}^{s'}} \widetilde{M}_j(x, y) \cdot \widetilde{z}_2(y) \right)
+        }^{q(x)}
+}_{Q(x)}
+$$
+
+\end{frame}
+
+
+\begin{frame}{Verifier checks}
+  \textcolor{gray}{
+Recall:
+$$g(x) := \left( \sum_{j \in [t]} \gamma^j \cdot L_j(x) \right) + \gamma^{t+1} \cdot Q(x)$$
+$$c = \left(\sum_{j \in [t]} \gamma^j \cdot e_1 \cdot \sigma_j \right) + \gamma^{t+1} \cdot e_2 \cdot \left( \sum_{i=1}^q c_i \cdot \prod_{j \in S_i} \theta_j \right)$$
+}
+
+We can see now that V's check in step 5,
+
+\begin{align*}
+  c &= 
+\left( \sum_{j \in [t]} \gamma^j \cdot \overbrace{e_1 \cdot \sigma_j}^{L_j(r_x')} \right) + \gamma^{t+1} \cdot \overbrace{e_2 \cdot \sum_{i \in [q]} c_i \prod_{j \in S_i} \theta_j}^{Q(x)}\\
+&= \left( \sum_{j \in [t]} \gamma^j \cdot L_j(r_x') \right) + \gamma^{t+1} \cdot Q(r_x')\\
+&= g(r_x')
+\end{align*}
+
+where $e_1 = \widetilde{eq}(r_x, r_x')$, $e_2=\widetilde{eq}(\beta, r_x')$.
+\end{frame}
+\end{tiny}
+
+\section[Multiple instances]{Multiple instances}
+
+\begin{footnotesize}
+\begin{frame}{Multifolding multiple instances}
+Hypernova paper: $\mu=1, \nu=1$ \emph{(ie. 1 LCCCS instance and 1 CCCS instance)}
+
+\vspace{1cm}
+In next slides
+\begin{itemize}
+  \item example with: $\color{orange}{LCCCS: \mu = 2},~ \color{blue}{CCCS: \nu = 2}$
+  \item generalized equations for $\mu,~\nu$
+\end{itemize}
+
+Let $z_1,~ \color{orange}{z_2}$ be the two LCCCS instances, and $z_3,~ \color{blue}{z_4}$ be the two CCCS instances
+
+\end{frame}
+\end{footnotesize}
+
+\begin{tiny}
+\begin{frame}
+  In \emph{step 3},
+
+\begin{align*}
+	g(x) &:= \left( \sum_{j \in [t]} \gamma^j \cdot L_{1,j}(x) + \textcolor{orange}{\gamma^{t+j} \cdot L_{2,j}(x)} \right)
++ \gamma^{2t+1} \cdot Q_1(x) + \textcolor{cyan}{\gamma^{2t+2} \cdot Q_2(x)} \\
+	     &L_{1,j}(x) := \widetilde{eq}(r_{1,x}, x) \cdot \left(
+	\sum_{y \in \{0,1\}^{s'}} \widetilde{M}_j(x, y) \cdot \widetilde{z}_1(y)
+\right)\\
+	     &\textcolor{orange}{L_{2,j}(x)} := \widetilde{eq}(\textcolor{orange}{r_{2,x}}, x) \cdot \left(
+	\sum_{y \in \{0,1\}^{s'}} \widetilde{M}_j(x, y) \cdot \textcolor{orange}{\widetilde{z}_2(y)}
+\right)\\
+	     &Q_1(x) := \widetilde{eq}(\beta, x) \cdot \left(
+\sum_{i=1}^q c_i \cdot \prod_{j \in S_i} \left( \sum_{y \in \{0, 1\}^{s'}} \widetilde{M}_j(x, y) \cdot \widetilde{z}_3(y) \right)\right)\\
+	     &\textcolor{cyan}{Q_2(x)} := \widetilde{eq}(\textcolor{cyan}{\beta}, x) \cdot \left(
+	\sum_{i=1}^q c_i \cdot \prod_{j \in S_i} \left( \sum_{y \in \{0, 1\}^{s'}} \widetilde{M}_j(x, y) \cdot \textcolor{cyan}{\widetilde{z}_4(y)} \right)\right)
+\end{align*}
+
+\framebox{\begin{minipage}{4.3 in}
+A generic definition of $g(x)$ for $\mu>1~\nu>1$, would be
+
+$$
+g(x) := \left( \sum_{i \in [\mu]} \left( \sum_{j \in [t]} \gamma^{i \cdot t+j} \cdot L_{i,j}(x) \right) \right)
++ \left( \sum_{i \in [\nu]} \gamma^{\mu \cdot t + i} \cdot Q_i(x) \right)
+$$
+\end{minipage}}
+
+Recall, the original $g(x)$ definition was
+$$\textcolor{gray}{g(x) := \left( \sum_{j \in [t]} \gamma^j \cdot L_j(x) \right) + \gamma^{t+1} \cdot Q(x)}$$
+
+
+\end{frame}
+
+\begin{frame}
+  In \emph{step 4}, $P \rightarrow V$: $(\{\sigma_{1,j}\}, \textcolor{orange}{\{\sigma_{2,j}\}}, \{\theta_{1,j}\}, \textcolor{cyan}{\{\theta_{2,j}\}}),~ \text{where} ~\forall j \in [t]$,
+
+$$\sigma_{1,j} = \sum_{y \in \{0,1\}^{s'}} \widetilde{M}_j(r_x', y) \cdot \widetilde{z}_1(y)$$
+$$\textcolor{orange}{\sigma_{2,j}} = \sum_{y \in \{0,1\}^{s'}} \widetilde{M}_j(r_x', y) \cdot \textcolor{orange}{\widetilde{z}_2(y)}$$
+$$\theta_{1,j} = \sum_{y \in \{0, 1\}^{s'}} \widetilde{M}_j(r_x', y) \cdot \widetilde{z}_3(y)$$
+$$\textcolor{cyan}{\theta_{2,j}} = \sum_{y \in \{0, 1\}^{s'}} \widetilde{M}_j(r_x', y) \cdot \textcolor{cyan}{\widetilde{z}_4(y)}$$
+
+\framebox{\begin{minipage}{4.3 in}
+	so in a generic way,\\
+$P \rightarrow V$:
+$(\{\sigma_{i,j}\}, \{\theta_{k,j}\}),~ \text{where} ~\forall~ j \in [t],~ \forall~ i \in [\mu],~ \forall~ k \in [\nu]$
+where
+$$\sigma_{i,j} = \sum_{y \in \{0,1\}^{s'}} \widetilde{M}_j(r_x', y) \cdot \widetilde{z}_i(y)$$
+$$\theta_{k,j} = \sum_{y \in \{0, 1\}^{s'}} \widetilde{M}_j(r_x', y) \cdot \widetilde{z}_{\mu+k}(y)$$
+\end{minipage}}
+
+\end{frame}
+
+\begin{frame}
+  And in \emph{step 5}, $V$ checks
+
+\begin{align*}
+	c &= \left(\sum_{j \in [t]} \gamma^j \cdot e_1 \cdot \sigma_{1,j}
+~\textcolor{orange}{+ \gamma^{t+j} \cdot e_2 \cdot \sigma_{2,j}}\right)
+	  + \gamma^{2t+1} \cdot e_3 \cdot \left( \sum_{i=1}^q c_i \cdot \prod_{j \in S_i} \theta_j \right)
+	  + \textcolor{cyan}{\gamma^{2t+2} \cdot e_4 \cdot \left( \sum_{i=1}^q c_i \cdot \prod_{j \in S_i} \theta_j \right)} 
+\end{align*}
+
+where
+$e_1 \leftarrow \widetilde{eq}(r_{1,x}, r_x'),~ e_2 \leftarrow \widetilde{eq}(r_{2,x}, r_x')$, $e_3, e_4 \leftarrow \widetilde{eq}(\beta, r_x')$.
+
+\vspace{0.5cm}
+
+\framebox{\begin{minipage}{4.3 in}
+A generic definition of the check would be
+$$
+c = \sum_{i \in [\mu]} \left(\sum_{j \in [t]} \gamma^{i \cdot t + j} \cdot e_i \cdot \sigma_{i,j} \right) \\
++ \sum_{k \in [\nu]} \gamma^{\mu \cdot t+k} \cdot e_k \cdot \left( \sum_{i=1}^q c_i \cdot \prod_{j \in S_i} \theta_{k,j} \right)
+$$
+\end{minipage}}
+
+where the original check was\\
+$\textcolor{gray}{c = \left(\sum_{j \in [t]} \gamma^j \cdot e_1 \cdot \sigma_j \right) + \gamma^{t+1} \cdot e_2 \cdot \left( \sum_{i=1}^q c_i \cdot \prod_{j \in S_i} \theta_j \right)}$
+
+\end{frame}
+
+\begin{frame}
+And for the \emph{step 7},
+\begin{align*}
+	C' &\leftarrow C_1 + \rho \cdot C_2 + \rho^2 C_3 + \rho^3 C_4 + \ldots = \sum_{i \in [\mu + \nu]} \rho^i \cdot C_i \\
+	u' &\leftarrow \sum_{i \in [\mu]} \rho^i \cdot u_i + \sum_{i \in [\nu]} \rho^{\mu + i-1} \cdot 1\\
+	\mathsf{x}' &\leftarrow \sum_{i \in [\mu+\nu]} \rho^i \cdot \mathsf{x}_i\\
+	v_i' &\leftarrow \sum_{i \in [\mu]} \rho^i \cdot \sigma_i + \sum_{i \in [\nu]} \rho^{\mu + i-1} \cdot \theta_i\\
+\end{align*}
+
+and \emph{step 8},
+\begin{align*}
+	\widetilde{w}' &\leftarrow \sum_{i \in [\mu+\nu]} \rho^i\cdot \widetilde{w}_i\\
+	r_w' &\leftarrow \sum_{i \in [\mu+\nu]} \rho^i \cdot r_{w_i}\\
+\end{align*}
+
+\end{frame}
+
+\end{tiny}
+
+\section[Wrappup]{Wrappup}
+
+\begin{frame}
+\frametitle{Wrappup}
+\begin{itemize}
+  \item HyperNova: \href{https://eprint.iacr.org/2023/573}{https://eprint.iacr.org/2023/573}
+  \item multifolding PoC on arkworks: \href{https://github.com/privacy-scaling-explorations/multifolding-poc}{github.com/privacy-scaling-explorations/multifolding-poc}
+\end{itemize}
+
+\vspace{2cm}
+\tiny{
+  $$\text{2023-06-22}$$
+  $$\text{\href{https://0xparc.org}{0xPARC} Novi team}$$
+}
+\end{frame}
+
+\end{document}

notes_hypernova.tex

@@ -206,40 +206,66 @@ Multifolding flow:
 
 \vspace{1cm}
 
+Recall that we are folding 2 instances:
+\begin{itemize}
+	\item[] LCCCS: $(C, u, \textcolor{orange}{x_1}, \textcolor{magenta}{r_x}, \textcolor{orange}{v_1, \ldots, v_t})$
+	\item[] CCCS: $(C, \textcolor{cyan}{x_2})$
+\end{itemize}
+
 Now, to see the verifier check from step 5, observe that in LCCCS, since $\widetilde{w}$ satisfies,
 \begin{align*}
-	v_j &= \sum_{y \in \{0,1\}^{s'}} \widetilde{M}_j(r_x, y) \cdot \widetilde{z}_1(y)\\
-	    &= \sum_{x \in \{0,1\}^s}
-		\underbrace{
-			\widetilde{eq}(r_x, x) \cdot \left( \sum_{y \in \{0,1\}^{s'}} \widetilde{M}_j(x, y) \cdot \widetilde{z}_1(y) \right)
-		}_{L_j(x)}\\
-	    &= \sum_{x \in \{0,1\}^s} L_j(x)
+	\textcolor{orange}{L_j(x)} &:= \widetilde{eq}(\textcolor{magenta}{r_x}, x) \cdot \left(
+	\sum_{y \in \{0,1\}^{s'}} \widetilde{M}_j(x, y) \cdot \textcolor{orange}{\widetilde{z}_1(y)}
+	\right)\\
+   &\textcolor{orange}{v_j}= \sum_{y\in \{0,1\}^{s'}} \widetilde{M}_j(\textcolor{magenta}{r_x}, y) \cdot \textcolor{orange}{\widetilde{z}_1(y)})\\
+   &~~=\sum_{x \in \{0,1\}^s} \widetilde{eq}(\textcolor{magenta}{r_x},y) \cdot (\sum_{y\in \{0,1\}^{s'}} \widetilde{M}_j(x,y)\cdot \textcolor{orange}{\widetilde{z}_1(y)})\\
+   &~~=\sum_{x \in \{0,1\}^s} \textcolor{orange}{L_j(x)}
 \end{align*}
 
-Observe also that in CCCS, since $\widetilde{w}$ satisfies,
-$$
-0=\underbrace{\sum_{i=1}^q c_i \cdot \prod_{j \in S_i} \left( \sum_{y \in \{0, 1\}^{s'}} \widetilde{M}_j(x, y) \cdot \widetilde{z}_2(y) \right)}_{q(x)}
-$$
 
+Observe also that in CCCS, since $\widetilde{w}$ satisfies,\\
 we have that
 $$
-G(X) = \sum_{x \in \{0,1\}^s} eq(X, x) \cdot q(x)
+G(X) = \sum_{x \in \{0,1\}^s} \widetilde{eq}(X, x) \cdot \textcolor{cyan}{q(x)}
 $$
 is multilinear, and can be seen as a Lagrange polynomial where coefficients are evaluations of $q(x)$ on the hypercube.
 
-For an honest prover, all these coefficients are zero, thus $G(X)$ must necessarily be the zero polynomial. Thus $G(\beta)=0$ for $\beta \in^R \mathbb{F}^s$.
 \begin{align*}
-	% 0&=\sum_{i=1}^q c_i \cdot \prod_{j \in S_i} \left( \sum_{y \in \{0, 1\}^{s'}} \widetilde{M}_j(\beta, y) \cdot \widetilde{z}_2(y) \right)\\
-	0&=G(\beta) = \sum_{x \in \{0,1\}^s} eq(\beta, x) \cdot q(x)\\
-	 &= \sum_{x \in \{0,1\}^s}
-	 \underbrace{\widetilde{eq}(\beta , x) \cdot
-		 \overbrace{
-			\sum_{i=1}^q c_i \cdot \prod_{j \in S_i} \left( \sum_{y \in \{0, 1\}^{s'}} \widetilde{M}_j(x, y) \cdot \widetilde{z}_2(y) \right)
-		}^{q(x)}
-	}_{Q(x)}\\
-	 &= \sum_{x \in \{0,1\}^s} Q(x)
+  \textcolor{cyan}{Q(x)} := &\widetilde{eq}(\textcolor{magenta}{\beta}, x) \cdot \left(
+    \overbrace{ \sum_{i=1}^q c_i \cdot \prod_{j \in S_i} \left( \sum_{y \in \{0, 1\}^{s'}} \widetilde{M}_j(x, y) \cdot \textcolor{cyan}{\widetilde{z}_2(y)} \right)
+    }^\textcolor{cyan}{q(x)}
+  \right)\\
+0= &\sum_{i=1}^q c_i \prod_{j\in S_i} \left( \sum_{y\in \{0,1\}^{s'}} \widetilde{M}_j(\textcolor{magenta}{\beta}, y) \cdot \textcolor{cyan}{\widetilde{z}_2(y)}\right)\\
+  =&\sum_{x \in \{0,1\}^s} \widetilde{eq}(\textcolor{magenta}{\beta}, x) \cdot \left( \sum_{i=1}^q c_i \prod_{j\in S_i} ( \sum_{y\in \{0,1\}^{s'}} \widetilde{M}_j(x, y) \cdot \textcolor{cyan}{\widetilde{z}_2(y)}) \right) \\
+  =&\sum_{x \in \{0,1\}^s} \textcolor{cyan}{Q(x)} = G(\textcolor{magenta}{\beta})
 \end{align*}
 
+%
+For an honest prover, all these coefficients are zero, thus $G(X)$ must necessarily be the zero polynomial. Thus $G(\beta)=0$ for $\beta \in^R \mathbb{F}^s$.
+
+\vspace{1cm}
+
+We can now see that
+
+$$\textcolor{orange}{\sigma_j} = \sum_{y \in \{0,1\}^{s'}} \widetilde{M}_j(\textcolor{pink}{r_x'}, y) \cdot \textcolor{orange}{\widetilde{z}_1(y)},
+~~~\textcolor{cyan}{\theta_j} = \sum_{y \in \{0, 1\}^{s'}} \widetilde{M}_j(\textcolor{pink}{r_x'}, y) \cdot \textcolor{cyan}{\widetilde{z}_2(y)}$$
+$$e_1 \leftarrow \widetilde{eq}(\textcolor{magenta}{r_x}, \textcolor{pink}{r_x'}),~ e_2 \leftarrow \widetilde{eq}(\textcolor{magenta}{\beta}, \textcolor{pink}{r_x'})$$
+
+so the Verifier's check:
+\begin{align*}
+c &= \left(
+\sum_{j \in [t]} \gamma^j \cdot \underbrace{e_1 \cdot \textcolor{orange}{\sigma_j} }_\textcolor{orange}{L_j}(\textcolor{pink}{r_x'})
+\right)
++ \gamma^{t+1} \cdot
+\underbrace{e_2 \cdot \left( \sum_{i=1}^q c_i \cdot \prod_{j \in S_i} \textcolor{cyan}{\theta_j} \right) }_\textcolor{cyan}{Q}(\textcolor{pink}{r_x'})\\
+&= \left( \sum_{j\in [t]} \gamma^j \cdot \textcolor{orange}{L_j}(\textcolor{pink}{r_x'}) \right) + \gamma^{t+1} \cdot \textcolor{cyan}{Q}(\textcolor{pink}{r_x'})\\
+&= g(\textcolor{pink}{r_x'})
+\end{align}
+$$\textcolor{gray}{(Recall,~ g(x) := \left( \sum_{j \in [t]} \gamma^j \cdot L_j(x) \right) + \gamma^{t+1} \cdot Q(x))}$$
+
+Outputed LCCCS: $(C', u', x', \textcolor{pink}{r_x'}, v_1', \ldots, v_t')$
+
+
 \framebox{\begin{minipage}{4.3 in}
 \begin{footnotesize}
 
@@ -277,18 +303,6 @@ $$0 = \sum_{x \in \{0,1\}^s} Q(x) = \sum_{x \in \{0,1\}^s} \widetilde{eq}(\beta,
 
 \vspace{1cm}
 
-Comming back to HyperNova equations, we can now see that
-
-\begin{align*}
-	c &= g(r_x')\\
-	  &= \left( \sum_{j \in [t]} \gamma^j \cdot L_j(r_x') \right) + \gamma^{t+1} \cdot Q(r_x')\\
-	  &= \left( \sum_{j \in [t]} \gamma^j \cdot \overbrace{e_1 \cdot \sigma_j}^{L_j(r_x')} \right) + \gamma^{t+1} \cdot \overbrace{e_2 \cdot \sum_{i \in [q]} c_i \prod_{j \in S_i} \theta_j}^{Q(x)}
-\end{align*}
-
-where $e_1 = \widetilde{eq}(r_x, r_x')$ and $e_2=\widetilde{eq}(\beta, r_x')$.
-
-Which is the check that $V$ performs at step $5$.
-
 \subsection{Multifolding for multiple instances}
 The multifolding of multiple LCCCS \& CCCS instances is not shown in the HyperNova paper, but Srinath Setty gave an overview in the PSE HyperNova presentation. This section unfolds it.
 
@@ -309,7 +323,7 @@ In \emph{step 3} of the multifolding with more than one LCCCS and more than one
 \right)\\
 	     &Q_1(x) := \widetilde{eq}(\beta, x) \cdot \left(
 \sum_{i=1}^q c_i \cdot \prod_{j \in S_i} \left( \sum_{y \in \{0, 1\}^{s'}} \widetilde{M}_j(x, y) \cdot \widetilde{z}_3(y) \right)\right)\\
-	     &\textcolor{cyan}{Q_2(x)} := \widetilde{eq}(\textcolor{cyan}{\beta'}, x) \cdot \left(
+	     &\textcolor{cyan}{Q_2(x)} := \widetilde{eq}(\textcolor{cyan}{\beta}, x) \cdot \left(
 	\sum_{i=1}^q c_i \cdot \prod_{j \in S_i} \left( \sum_{y \in \{0, 1\}^{s'}} \widetilde{M}_j(x, y) \cdot \textcolor{cyan}{\widetilde{z}_4(y)} \right)\right)
 \end{align*}