Browse Source
Port Espresso's VirtualPoly, MLE and SumCheck (#8)
Port Espresso/hyperplonk's `virtualpolynomial`, `multilinearpolynomial` and `sum_check` utils from https://github.com/EspressoSystems/hyperplonk/tree/main Each file contains the reference to the original file. Porting it into a subdirectory `src/utils/espresso`, to have it self-contained. In future iterations we might replace part of it but we can keep focusing on the folding schemes part for now.update-nifs-interface
GitHub
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
10 changed files with 1629 additions and 4 deletions
Split View
Diff Options
-
+17 -4Cargo.toml
-
+3 -0src/utils/espresso/mod.rs
-
+200 -0src/utils/espresso/multilinear_polynomial.rs
-
+211 -0src/utils/espresso/sum_check/mod.rs
-
+220 -0src/utils/espresso/sum_check/prover.rs
-
+59 -0src/utils/espresso/sum_check/structs.rs
-
+362 -0src/utils/espresso/sum_check/verifier.rs
-
+550 -0src/utils/espresso/virtual_polynomial.rs
-
+6 -0src/utils/mod.rs
-
+1 -0src/utils/vec.rs
@ -0,0 +1,3 @@ |
|||
pub mod multilinear_polynomial;
|
|||
pub mod sum_check;
|
|||
pub mod virtual_polynomial;
|
|||
@ -0,0 +1,200 @@ |
|||
// code forked from
|
|||
// https://github.com/EspressoSystems/hyperplonk/blob/main/arithmetic/src/multilinear_polynomial.rs
|
|||
//
|
|||
// Copyright (c) 2023 Espresso Systems (espressosys.com)
|
|||
// This file is part of the HyperPlonk library.
|
|||
|
|||
// You should have received a copy of the MIT License
|
|||
// along with the HyperPlonk library. If not, see <https://mit-license.org/>.
|
|||
|
|||
use ark_ff::Field;
|
|||
#[cfg(feature = "parallel")]
|
|||
use rayon::prelude::{IndexedParallelIterator, IntoParallelRefMutIterator, ParallelIterator};
|
|||
|
|||
pub use ark_poly::DenseMultilinearExtension;
|
|||
|
|||
pub fn fix_variables<F: Field>(
|
|||
poly: &DenseMultilinearExtension<F>,
|
|||
partial_point: &[F],
|
|||
) -> DenseMultilinearExtension<F> {
|
|||
assert!(
|
|||
partial_point.len() <= poly.num_vars,
|
|||
"invalid size of partial point"
|
|||
);
|
|||
let nv = poly.num_vars;
|
|||
let mut poly = poly.evaluations.to_vec();
|
|||
let dim = partial_point.len();
|
|||
// evaluate single variable of partial point from left to right
|
|||
for (i, point) in partial_point.iter().enumerate().take(dim) {
|
|||
poly = fix_one_variable_helper(&poly, nv - i, point);
|
|||
}
|
|||
|
|||
DenseMultilinearExtension::<F>::from_evaluations_slice(nv - dim, &poly[..(1 << (nv - dim))])
|
|||
}
|
|||
|
|||
fn fix_one_variable_helper<F: Field>(data: &[F], nv: usize, point: &F) -> Vec<F> {
|
|||
let mut res = vec![F::zero(); 1 << (nv - 1)];
|
|||
|
|||
// evaluate single variable of partial point from left to right
|
|||
#[cfg(not(feature = "parallel"))]
|
|||
for i in 0..(1 << (nv - 1)) {
|
|||
res[i] = data[i << 1] + (data[(i << 1) + 1] - data[i << 1]) * point;
|
|||
}
|
|||
|
|||
#[cfg(feature = "parallel")]
|
|||
res.par_iter_mut().enumerate().for_each(|(i, x)| {
|
|||
*x = data[i << 1] + (data[(i << 1) + 1] - data[i << 1]) * point;
|
|||
});
|
|||
|
|||
res
|
|||
}
|
|||
|
|||
pub fn evaluate_no_par<F: Field>(poly: &DenseMultilinearExtension<F>, point: &[F]) -> F {
|
|||
assert_eq!(poly.num_vars, point.len());
|
|||
fix_variables_no_par(poly, point).evaluations[0]
|
|||
}
|
|||
|
|||
fn fix_variables_no_par<F: Field>(
|
|||
poly: &DenseMultilinearExtension<F>,
|
|||
partial_point: &[F],
|
|||
) -> DenseMultilinearExtension<F> {
|
|||
assert!(
|
|||
partial_point.len() <= poly.num_vars,
|
|||
"invalid size of partial point"
|
|||
);
|
|||
let nv = poly.num_vars;
|
|||
let mut poly = poly.evaluations.to_vec();
|
|||
let dim = partial_point.len();
|
|||
// evaluate single variable of partial point from left to right
|
|||
for i in 1..dim + 1 {
|
|||
let r = partial_point[i - 1];
|
|||
for b in 0..(1 << (nv - i)) {
|
|||
poly[b] = poly[b << 1] + (poly[(b << 1) + 1] - poly[b << 1]) * r;
|
|||
}
|
|||
}
|
|||
DenseMultilinearExtension::from_evaluations_slice(nv - dim, &poly[..(1 << (nv - dim))])
|
|||
}
|
|||
|
|||
/// Given multilinear polynomial `p(x)` and s `s`, compute `s*p(x)`
|
|||
pub fn scalar_mul<F: Field>(
|
|||
poly: &DenseMultilinearExtension<F>,
|
|||
s: &F,
|
|||
) -> DenseMultilinearExtension<F> {
|
|||
DenseMultilinearExtension {
|
|||
evaluations: poly.evaluations.iter().map(|e| *e * s).collect(),
|
|||
num_vars: poly.num_vars,
|
|||
}
|
|||
}
|
|||
|
|||
/// Test-only methods used in virtual_polynomial.rs
|
|||
#[cfg(test)]
|
|||
pub mod tests {
|
|||
use super::*;
|
|||
use ark_ff::PrimeField;
|
|||
use ark_std::rand::RngCore;
|
|||
use ark_std::{end_timer, start_timer};
|
|||
use std::sync::Arc;
|
|||
|
|||
pub fn fix_last_variables<F: PrimeField>(
|
|||
poly: &DenseMultilinearExtension<F>,
|
|||
partial_point: &[F],
|
|||
) -> DenseMultilinearExtension<F> {
|
|||
assert!(
|
|||
partial_point.len() <= poly.num_vars,
|
|||
"invalid size of partial point"
|
|||
);
|
|||
let nv = poly.num_vars;
|
|||
let mut poly = poly.evaluations.to_vec();
|
|||
let dim = partial_point.len();
|
|||
// evaluate single variable of partial point from left to right
|
|||
for (i, point) in partial_point.iter().rev().enumerate().take(dim) {
|
|||
poly = fix_last_variable_helper(&poly, nv - i, point);
|
|||
}
|
|||
|
|||
DenseMultilinearExtension::<F>::from_evaluations_slice(nv - dim, &poly[..(1 << (nv - dim))])
|
|||
}
|
|||
|
|||
fn fix_last_variable_helper<F: Field>(data: &[F], nv: usize, point: &F) -> Vec<F> {
|
|||
let half_len = 1 << (nv - 1);
|
|||
let mut res = vec![F::zero(); half_len];
|
|||
|
|||
// evaluate single variable of partial point from left to right
|
|||
#[cfg(not(feature = "parallel"))]
|
|||
for b in 0..half_len {
|
|||
res[b] = data[b] + (data[b + half_len] - data[b]) * point;
|
|||
}
|
|||
|
|||
#[cfg(feature = "parallel")]
|
|||
res.par_iter_mut().enumerate().for_each(|(i, x)| {
|
|||
*x = data[i] + (data[i + half_len] - data[i]) * point;
|
|||
});
|
|||
|
|||
res
|
|||
}
|
|||
|
|||
/// Sample a random list of multilinear polynomials.
|
|||
/// Returns
|
|||
/// - the list of polynomials,
|
|||
/// - its sum of polynomial evaluations over the boolean hypercube.
|
|||
#[cfg(test)]
|
|||
pub fn random_mle_list<F: PrimeField, R: RngCore>(
|
|||
nv: usize,
|
|||
degree: usize,
|
|||
rng: &mut R,
|
|||
) -> (Vec<Arc<DenseMultilinearExtension<F>>>, F) {
|
|||
let start = start_timer!(|| "sample random mle list");
|
|||
let mut multiplicands = Vec::with_capacity(degree);
|
|||
for _ in 0..degree {
|
|||
multiplicands.push(Vec::with_capacity(1 << nv))
|
|||
}
|
|||
let mut sum = F::zero();
|
|||
|
|||
for _ in 0..(1 << nv) {
|
|||
let mut product = F::one();
|
|||
|
|||
for e in multiplicands.iter_mut() {
|
|||
let val = F::rand(rng);
|
|||
e.push(val);
|
|||
product *= val;
|
|||
}
|
|||
sum += product;
|
|||
}
|
|||
|
|||
let list = multiplicands
|
|||
.into_iter()
|
|||
.map(|x| Arc::new(DenseMultilinearExtension::from_evaluations_vec(nv, x)))
|
|||
.collect();
|
|||
|
|||
end_timer!(start);
|
|||
(list, sum)
|
|||
}
|
|||
|
|||
// Build a randomize list of mle-s whose sum is zero.
|
|||
#[cfg(test)]
|
|||
pub fn random_zero_mle_list<F: PrimeField, R: RngCore>(
|
|||
nv: usize,
|
|||
degree: usize,
|
|||
rng: &mut R,
|
|||
) -> Vec<Arc<DenseMultilinearExtension<F>>> {
|
|||
let start = start_timer!(|| "sample random zero mle list");
|
|||
|
|||
let mut multiplicands = Vec::with_capacity(degree);
|
|||
for _ in 0..degree {
|
|||
multiplicands.push(Vec::with_capacity(1 << nv))
|
|||
}
|
|||
for _ in 0..(1 << nv) {
|
|||
multiplicands[0].push(F::zero());
|
|||
for e in multiplicands.iter_mut().skip(1) {
|
|||
e.push(F::rand(rng));
|
|||
}
|
|||
}
|
|||
|
|||
let list = multiplicands
|
|||
.into_iter()
|
|||
.map(|x| Arc::new(DenseMultilinearExtension::from_evaluations_vec(nv, x)))
|
|||
.collect();
|
|||
|
|||
end_timer!(start);
|
|||
list
|
|||
}
|
|||
}
|
|||
@ -0,0 +1,211 @@ |
|||
// code forked from:
|
|||
// https://github.com/EspressoSystems/hyperplonk/tree/main/subroutines/src/poly_iop/sum_check
|
|||
//
|
|||
// Copyright (c) 2023 Espresso Systems (espressosys.com)
|
|||
// This file is part of the HyperPlonk library.
|
|||
|
|||
// You should have received a copy of the MIT License
|
|||
// along with the HyperPlonk library. If not, see <https://mit-license.org/>.
|
|||
|
|||
//! This module implements the sum check protocol.
|
|||
|
|||
use crate::utils::virtual_polynomial::{VPAuxInfo, VirtualPolynomial};
|
|||
use ark_ff::PrimeField;
|
|||
use ark_poly::DenseMultilinearExtension;
|
|||
use ark_std::{end_timer, start_timer};
|
|||
use std::{fmt::Debug, sync::Arc};
|
|||
|
|||
use espresso_subroutines::poly_iop::{prelude::PolyIOPErrors, PolyIOP};
|
|||
use espresso_transcript::IOPTranscript;
|
|||
use structs::{IOPProof, IOPProverState, IOPVerifierState};
|
|||
|
|||
mod prover;
|
|||
pub mod structs;
|
|||
pub mod verifier;
|
|||
|
|||
/// Trait for doing sum check protocols.
|
|||
pub trait SumCheck<F: PrimeField> {
|
|||
type VirtualPolynomial;
|
|||
type VPAuxInfo;
|
|||
type MultilinearExtension;
|
|||
|
|||
type SumCheckProof: Clone + Debug + Default + PartialEq;
|
|||
type Transcript;
|
|||
type SumCheckSubClaim: Clone + Debug + Default + PartialEq;
|
|||
|
|||
/// Extract sum from the proof
|
|||
fn extract_sum(proof: &Self::SumCheckProof) -> F;
|
|||
|
|||
/// Initialize the system with a transcript
|
|||
///
|
|||
/// This function is optional -- in the case where a SumCheck is
|
|||
/// an building block for a more complex protocol, the transcript
|
|||
/// may be initialized by this complex protocol, and passed to the
|
|||
/// SumCheck prover/verifier.
|
|||
fn init_transcript() -> Self::Transcript;
|
|||
|
|||
/// Generate proof of the sum of polynomial over {0,1}^`num_vars`
|
|||
///
|
|||
/// The polynomial is represented in the form of a VirtualPolynomial.
|
|||
fn prove(
|
|||
poly: &Self::VirtualPolynomial,
|
|||
transcript: &mut Self::Transcript,
|
|||
) -> Result<Self::SumCheckProof, PolyIOPErrors>;
|
|||
|
|||
/// Verify the claimed sum using the proof
|
|||
fn verify(
|
|||
sum: F,
|
|||
proof: &Self::SumCheckProof,
|
|||
aux_info: &Self::VPAuxInfo,
|
|||
transcript: &mut Self::Transcript,
|
|||
) -> Result<Self::SumCheckSubClaim, PolyIOPErrors>;
|
|||
}
|
|||
|
|||
/// Trait for sum check protocol prover side APIs.
|
|||
pub trait SumCheckProver<F: PrimeField>
|
|||
where
|
|||
Self: Sized,
|
|||
{
|
|||
type VirtualPolynomial;
|
|||
type ProverMessage;
|
|||
|
|||
/// Initialize the prover state to argue for the sum of the input polynomial
|
|||
/// over {0,1}^`num_vars`.
|
|||
fn prover_init(polynomial: &Self::VirtualPolynomial) -> Result<Self, PolyIOPErrors>;
|
|||
|
|||
/// Receive message from verifier, generate prover message, and proceed to
|
|||
/// next round.
|
|||
///
|
|||
/// Main algorithm used is from section 3.2 of [XZZPS19](https://eprint.iacr.org/2019/317.pdf#subsection.3.2).
|
|||
fn prove_round_and_update_state(
|
|||
&mut self,
|
|||
challenge: &Option<F>,
|
|||
) -> Result<Self::ProverMessage, PolyIOPErrors>;
|
|||
}
|
|||
|
|||
/// Trait for sum check protocol verifier side APIs.
|
|||
pub trait SumCheckVerifier<F: PrimeField> {
|
|||
type VPAuxInfo;
|
|||
type ProverMessage;
|
|||
type Challenge;
|
|||
type Transcript;
|
|||
type SumCheckSubClaim;
|
|||
|
|||
/// Initialize the verifier's state.
|
|||
fn verifier_init(index_info: &Self::VPAuxInfo) -> Self;
|
|||
|
|||
/// Run verifier for the current round, given a prover message.
|
|||
///
|
|||
/// Note that `verify_round_and_update_state` only samples and stores
|
|||
/// challenges; and update the verifier's state accordingly. The actual
|
|||
/// verifications are deferred (in batch) to `check_and_generate_subclaim`
|
|||
/// at the last step.
|
|||
fn verify_round_and_update_state(
|
|||
&mut self,
|
|||
prover_msg: &Self::ProverMessage,
|
|||
transcript: &mut Self::Transcript,
|
|||
) -> Result<Self::Challenge, PolyIOPErrors>;
|
|||
|
|||
/// This function verifies the deferred checks in the interactive version of
|
|||
/// the protocol; and generate the subclaim. Returns an error if the
|
|||
/// proof failed to verify.
|
|||
///
|
|||
/// If the asserted sum is correct, then the multilinear polynomial
|
|||
/// evaluated at `subclaim.point` will be `subclaim.expected_evaluation`.
|
|||
/// Otherwise, it is highly unlikely that those two will be equal.
|
|||
/// Larger field size guarantees smaller soundness error.
|
|||
fn check_and_generate_subclaim(
|
|||
&self,
|
|||
asserted_sum: &F,
|
|||
) -> Result<Self::SumCheckSubClaim, PolyIOPErrors>;
|
|||
}
|
|||
|
|||
/// A SumCheckSubClaim is a claim generated by the verifier at the end of
|
|||
/// verification when it is convinced.
|
|||
#[derive(Clone, Debug, Default, PartialEq, Eq)]
|
|||
pub struct SumCheckSubClaim<F: PrimeField> {
|
|||
/// the multi-dimensional point that this multilinear extension is evaluated
|
|||
/// to
|
|||
pub point: Vec<F>,
|
|||
/// the expected evaluation
|
|||
pub expected_evaluation: F,
|
|||
}
|
|||
|
|||
impl<F: PrimeField> SumCheck<F> for PolyIOP<F> {
|
|||
type SumCheckProof = IOPProof<F>;
|
|||
type VirtualPolynomial = VirtualPolynomial<F>;
|
|||
type VPAuxInfo = VPAuxInfo<F>;
|
|||
type MultilinearExtension = Arc<DenseMultilinearExtension<F>>;
|
|||
type SumCheckSubClaim = SumCheckSubClaim<F>;
|
|||
type Transcript = IOPTranscript<F>;
|
|||
|
|||
fn extract_sum(proof: &Self::SumCheckProof) -> F {
|
|||
let start = start_timer!(|| "extract sum");
|
|||
let res = proof.proofs[0].evaluations[0] + proof.proofs[0].evaluations[1];
|
|||
end_timer!(start);
|
|||
res
|
|||
}
|
|||
|
|||
fn init_transcript() -> Self::Transcript {
|
|||
let start = start_timer!(|| "init transcript");
|
|||
let res = IOPTranscript::<F>::new(b"Initializing SumCheck transcript");
|
|||
end_timer!(start);
|
|||
res
|
|||
}
|
|||
|
|||
fn prove(
|
|||
poly: &Self::VirtualPolynomial,
|
|||
transcript: &mut Self::Transcript,
|
|||
) -> Result<Self::SumCheckProof, PolyIOPErrors> {
|
|||
let start = start_timer!(|| "sum check prove");
|
|||
|
|||
transcript.append_serializable_element(b"aux info", &poly.aux_info)?;
|
|||
|
|||
let mut prover_state = IOPProverState::prover_init(poly)?;
|
|||
let mut challenge = None;
|
|||
let mut prover_msgs = Vec::with_capacity(poly.aux_info.num_variables);
|
|||
for _ in 0..poly.aux_info.num_variables {
|
|||
let prover_msg =
|
|||
IOPProverState::prove_round_and_update_state(&mut prover_state, &challenge)?;
|
|||
transcript.append_serializable_element(b"prover msg", &prover_msg)?;
|
|||
prover_msgs.push(prover_msg);
|
|||
challenge = Some(transcript.get_and_append_challenge(b"Internal round")?);
|
|||
}
|
|||
// pushing the last challenge point to the state
|
|||
if let Some(p) = challenge {
|
|||
prover_state.challenges.push(p)
|
|||
};
|
|||
|
|||
end_timer!(start);
|
|||
Ok(IOPProof {
|
|||
point: prover_state.challenges,
|
|||
proofs: prover_msgs,
|
|||
})
|
|||
}
|
|||
|
|||
fn verify(
|
|||
claimed_sum: F,
|
|||
proof: &Self::SumCheckProof,
|
|||
aux_info: &Self::VPAuxInfo,
|
|||
transcript: &mut Self::Transcript,
|
|||
) -> Result<Self::SumCheckSubClaim, PolyIOPErrors> {
|
|||
let start = start_timer!(|| "sum check verify");
|
|||
|
|||
transcript.append_serializable_element(b"aux info", aux_info)?;
|
|||
let mut verifier_state = IOPVerifierState::verifier_init(aux_info);
|
|||
for i in 0..aux_info.num_variables {
|
|||
let prover_msg = proof.proofs.get(i).expect("proof is incomplete");
|
|||
transcript.append_serializable_element(b"prover msg", prover_msg)?;
|
|||
IOPVerifierState::verify_round_and_update_state(
|
|||
&mut verifier_state,
|
|||
prover_msg,
|
|||
transcript,
|
|||
)?;
|
|||
}
|
|||
|
|||
let res = IOPVerifierState::check_and_generate_subclaim(&verifier_state, &claimed_sum);
|
|||
|
|||
end_timer!(start);
|
|||
res
|
|||
}
|
|||
}
|
|||
@ -0,0 +1,220 @@ |
|||
// code forked from:
|
|||
// https://github.com/EspressoSystems/hyperplonk/tree/main/subroutines/src/poly_iop/sum_check
|
|||
//
|
|||
// Copyright (c) 2023 Espresso Systems (espressosys.com)
|
|||
// This file is part of the HyperPlonk library.
|
|||
|
|||
// You should have received a copy of the MIT License
|
|||
// along with the HyperPlonk library. If not, see <https://mit-license.org/>.
|
|||
|
|||
//! Prover subroutines for a SumCheck protocol.
|
|||
|
|||
use super::SumCheckProver;
|
|||
use crate::utils::multilinear_polynomial::fix_variables;
|
|||
use crate::utils::virtual_polynomial::VirtualPolynomial;
|
|||
use ark_ff::{batch_inversion, PrimeField};
|
|||
use ark_poly::DenseMultilinearExtension;
|
|||
use ark_std::{cfg_into_iter, end_timer, start_timer, vec::Vec};
|
|||
use rayon::prelude::{IntoParallelIterator, IntoParallelRefIterator};
|
|||
use std::sync::Arc;
|
|||
|
|||
use super::structs::{IOPProverMessage, IOPProverState};
|
|||
use espresso_subroutines::poly_iop::prelude::PolyIOPErrors;
|
|||
|
|||
// #[cfg(feature = "parallel")]
|
|||
use rayon::iter::{IntoParallelRefMutIterator, ParallelIterator};
|
|||
|
|||
impl<F: PrimeField> SumCheckProver<F> for IOPProverState<F> {
|
|||
type VirtualPolynomial = VirtualPolynomial<F>;
|
|||
type ProverMessage = IOPProverMessage<F>;
|
|||
|
|||
/// Initialize the prover state to argue for the sum of the input polynomial
|
|||
/// over {0,1}^`num_vars`.
|
|||
fn prover_init(polynomial: &Self::VirtualPolynomial) -> Result<Self, PolyIOPErrors> {
|
|||
let start = start_timer!(|| "sum check prover init");
|
|||
if polynomial.aux_info.num_variables == 0 {
|
|||
return Err(PolyIOPErrors::InvalidParameters(
|
|||
"Attempt to prove a constant.".to_string(),
|
|||
));
|
|||
}
|
|||
end_timer!(start);
|
|||
|
|||
Ok(Self {
|
|||
challenges: Vec::with_capacity(polynomial.aux_info.num_variables),
|
|||
round: 0,
|
|||
poly: polynomial.clone(),
|
|||
extrapolation_aux: (1..polynomial.aux_info.max_degree)
|
|||
.map(|degree| {
|
|||
let points = (0..1 + degree as u64).map(F::from).collect::<Vec<_>>();
|
|||
let weights = barycentric_weights(&points);
|
|||
(points, weights)
|
|||
})
|
|||
.collect(),
|
|||
})
|
|||
}
|
|||
|
|||
/// Receive message from verifier, generate prover message, and proceed to
|
|||
/// next round.
|
|||
///
|
|||
/// Main algorithm used is from section 3.2 of [XZZPS19](https://eprint.iacr.org/2019/317.pdf#subsection.3.2).
|
|||
fn prove_round_and_update_state(
|
|||
&mut self,
|
|||
challenge: &Option<F>,
|
|||
) -> Result<Self::ProverMessage, PolyIOPErrors> {
|
|||
// let start =
|
|||
// start_timer!(|| format!("sum check prove {}-th round and update state",
|
|||
// self.round));
|
|||
|
|||
if self.round >= self.poly.aux_info.num_variables {
|
|||
return Err(PolyIOPErrors::InvalidProver(
|
|||
"Prover is not active".to_string(),
|
|||
));
|
|||
}
|
|||
|
|||
// let fix_argument = start_timer!(|| "fix argument");
|
|||
|
|||
// Step 1:
|
|||
// fix argument and evaluate f(x) over x_m = r; where r is the challenge
|
|||
// for the current round, and m is the round number, indexed from 1
|
|||
//
|
|||
// i.e.:
|
|||
// at round m <= n, for each mle g(x_1, ... x_n) within the flattened_mle
|
|||
// which has already been evaluated to
|
|||
//
|
|||
// g(r_1, ..., r_{m-1}, x_m ... x_n)
|
|||
//
|
|||
// eval g over r_m, and mutate g to g(r_1, ... r_m,, x_{m+1}... x_n)
|
|||
let mut flattened_ml_extensions: Vec<DenseMultilinearExtension<F>> = self
|
|||
.poly
|
|||
.flattened_ml_extensions
|
|||
.par_iter()
|
|||
.map(|x| x.as_ref().clone())
|
|||
.collect();
|
|||
|
|||
if let Some(chal) = challenge {
|
|||
if self.round == 0 {
|
|||
return Err(PolyIOPErrors::InvalidProver(
|
|||
"first round should be prover first.".to_string(),
|
|||
));
|
|||
}
|
|||
self.challenges.push(*chal);
|
|||
|
|||
let r = self.challenges[self.round - 1];
|
|||
// #[cfg(feature = "parallel")]
|
|||
flattened_ml_extensions
|
|||
.par_iter_mut()
|
|||
.for_each(|mle| *mle = fix_variables(mle, &[r]));
|
|||
// #[cfg(not(feature = "parallel"))]
|
|||
// flattened_ml_extensions
|
|||
// .iter_mut()
|
|||
// .for_each(|mle| *mle = fix_variables(mle, &[r]));
|
|||
} else if self.round > 0 {
|
|||
return Err(PolyIOPErrors::InvalidProver(
|
|||
"verifier message is empty".to_string(),
|
|||
));
|
|||
}
|
|||
// end_timer!(fix_argument);
|
|||
|
|||
self.round += 1;
|
|||
|
|||
let products_list = self.poly.products.clone();
|
|||
let mut products_sum = vec![F::zero(); self.poly.aux_info.max_degree + 1];
|
|||
|
|||
// Step 2: generate sum for the partial evaluated polynomial:
|
|||
// f(r_1, ... r_m,, x_{m+1}... x_n)
|
|||
|
|||
products_list.iter().for_each(|(coefficient, products)| {
|
|||
let mut sum = cfg_into_iter!(0..1 << (self.poly.aux_info.num_variables - self.round))
|
|||
.fold(
|
|||
|| {
|
|||
(
|
|||
vec![(F::zero(), F::zero()); products.len()],
|
|||
vec![F::zero(); products.len() + 1],
|
|||
)
|
|||
},
|
|||
|(mut buf, mut acc), b| {
|
|||
buf.iter_mut()
|
|||
.zip(products.iter())
|
|||
.for_each(|((eval, step), f)| {
|
|||
let table = &flattened_ml_extensions[*f];
|
|||
*eval = table[b << 1];
|
|||
*step = table[(b << 1) + 1] - table[b << 1];
|
|||
});
|
|||
acc[0] += buf.iter().map(|(eval, _)| eval).product::<F>();
|
|||
acc[1..].iter_mut().for_each(|acc| {
|
|||
buf.iter_mut().for_each(|(eval, step)| *eval += step as &_);
|
|||
*acc += buf.iter().map(|(eval, _)| eval).product::<F>();
|
|||
});
|
|||
(buf, acc)
|
|||
},
|
|||
)
|
|||
.map(|(_, partial)| partial)
|
|||
.reduce(
|
|||
|| vec![F::zero(); products.len() + 1],
|
|||
|mut sum, partial| {
|
|||
sum.iter_mut()
|
|||
.zip(partial.iter())
|
|||
.for_each(|(sum, partial)| *sum += partial);
|
|||
sum
|
|||
},
|
|||
);
|
|||
sum.iter_mut().for_each(|sum| *sum *= coefficient);
|
|||
let extraploation = cfg_into_iter!(0..self.poly.aux_info.max_degree - products.len())
|
|||
.map(|i| {
|
|||
let (points, weights) = &self.extrapolation_aux[products.len() - 1];
|
|||
let at = F::from((products.len() + 1 + i) as u64);
|
|||
extrapolate(points, weights, &sum, &at)
|
|||
})
|
|||
.collect::<Vec<_>>();
|
|||
products_sum
|
|||
.iter_mut()
|
|||
.zip(sum.iter().chain(extraploation.iter()))
|
|||
.for_each(|(products_sum, sum)| *products_sum += sum);
|
|||
});
|
|||
|
|||
// update prover's state to the partial evaluated polynomial
|
|||
self.poly.flattened_ml_extensions = flattened_ml_extensions
|
|||
.par_iter()
|
|||
.map(|x| Arc::new(x.clone()))
|
|||
.collect();
|
|||
|
|||
Ok(IOPProverMessage {
|
|||
evaluations: products_sum,
|
|||
})
|
|||
}
|
|||
}
|
|||
|
|||
fn barycentric_weights<F: PrimeField>(points: &[F]) -> Vec<F> {
|
|||
let mut weights = points
|
|||
.iter()
|
|||
.enumerate()
|
|||
.map(|(j, point_j)| {
|
|||
points
|
|||
.iter()
|
|||
.enumerate()
|
|||
.filter_map(|(i, point_i)| (i != j).then(|| *point_j - point_i))
|
|||
.reduce(|acc, value| acc * value)
|
|||
.unwrap_or_else(F::one)
|
|||
})
|
|||
.collect::<Vec<_>>();
|
|||
batch_inversion(&mut weights);
|
|||
weights
|
|||
}
|
|||
|
|||
fn extrapolate<F: PrimeField>(points: &[F], weights: &[F], evals: &[F], at: &F) -> F {
|
|||
let (coeffs, sum_inv) = {
|
|||
let mut coeffs = points.iter().map(|point| *at - point).collect::<Vec<_>>();
|
|||
batch_inversion(&mut coeffs);
|
|||
coeffs.iter_mut().zip(weights).for_each(|(coeff, weight)| {
|
|||
*coeff *= weight;
|
|||
});
|
|||
let sum_inv = coeffs.iter().sum::<F>().inverse().unwrap_or_default();
|
|||
(coeffs, sum_inv)
|
|||
};
|
|||
coeffs
|
|||
.iter()
|
|||
.zip(evals)
|
|||
.map(|(coeff, eval)| *coeff * eval)
|
|||
.sum::<F>()
|
|||
* sum_inv
|
|||
}
|
|||
@ -0,0 +1,59 @@ |
|||
// code forked from:
|
|||
// https://github.com/EspressoSystems/hyperplonk/tree/main/subroutines/src/poly_iop/sum_check
|
|||
//
|
|||
// Copyright (c) 2023 Espresso Systems (espressosys.com)
|
|||
// This file is part of the HyperPlonk library.
|
|||
|
|||
// You should have received a copy of the MIT License
|
|||
// along with the HyperPlonk library. If not, see <https://mit-license.org/>.
|
|||
|
|||
//! This module defines structs that are shared by all sub protocols.
|
|||
|
|||
use crate::utils::virtual_polynomial::VirtualPolynomial;
|
|||
use ark_ff::PrimeField;
|
|||
use ark_serialize::CanonicalSerialize;
|
|||
|
|||
/// An IOP proof is a collections of
|
|||
/// - messages from prover to verifier at each round through the interactive
|
|||
/// protocol.
|
|||
/// - a point that is generated by the transcript for evaluation
|
|||
#[derive(Clone, Debug, Default, PartialEq, Eq)]
|
|||
pub struct IOPProof<F: PrimeField> {
|
|||
pub point: Vec<F>,
|
|||
pub proofs: Vec<IOPProverMessage<F>>,
|
|||
}
|
|||
|
|||
/// A message from the prover to the verifier at a given round
|
|||
/// is a list of evaluations.
|
|||
#[derive(Clone, Debug, Default, PartialEq, Eq, CanonicalSerialize)]
|
|||
pub struct IOPProverMessage<F: PrimeField> {
|
|||
pub(crate) evaluations: Vec<F>,
|
|||
}
|
|||
|
|||
/// Prover State of a PolyIOP.
|
|||
#[derive(Debug)]
|
|||
pub struct IOPProverState<F: PrimeField> {
|
|||
/// sampled randomness given by the verifier
|
|||
pub challenges: Vec<F>,
|
|||
/// the current round number
|
|||
pub(crate) round: usize,
|
|||
/// pointer to the virtual polynomial
|
|||
pub(crate) poly: VirtualPolynomial<F>,
|
|||
/// points with precomputed barycentric weights for extrapolating smaller
|
|||
/// degree uni-polys to `max_degree + 1` evaluations.
|
|||
pub(crate) extrapolation_aux: Vec<(Vec<F>, Vec<F>)>,
|
|||
}
|
|||
|
|||
/// Prover State of a PolyIOP
|
|||
#[derive(Debug)]
|
|||
pub struct IOPVerifierState<F: PrimeField> {
|
|||
pub(crate) round: usize,
|
|||
pub(crate) num_vars: usize,
|
|||
pub(crate) max_degree: usize,
|
|||
pub(crate) finished: bool,
|
|||
/// a list storing the univariate polynomial in evaluation form sent by the
|
|||
/// prover at each round
|
|||
pub(crate) polynomials_received: Vec<Vec<F>>,
|
|||
/// a list storing the randomness sampled by the verifier at each round
|
|||
pub(crate) challenges: Vec<F>,
|
|||
}
|
|||
@ -0,0 +1,362 @@ |
|||
// code forked from:
|
|||
// https://github.com/EspressoSystems/hyperplonk/tree/main/subroutines/src/poly_iop/sum_check
|
|||
//
|
|||
// Copyright (c) 2023 Espresso Systems (espressosys.com)
|
|||
// This file is part of the HyperPlonk library.
|
|||
|
|||
// You should have received a copy of the MIT License
|
|||
// along with the HyperPlonk library. If not, see <https://mit-license.org/>.
|
|||
|
|||
//! Verifier subroutines for a SumCheck protocol.
|
|||
|
|||
use super::{SumCheckSubClaim, SumCheckVerifier};
|
|||
use crate::utils::virtual_polynomial::VPAuxInfo;
|
|||
use ark_ff::PrimeField;
|
|||
use ark_std::{end_timer, start_timer};
|
|||
|
|||
use super::structs::{IOPProverMessage, IOPVerifierState};
|
|||
use espresso_subroutines::poly_iop::prelude::PolyIOPErrors;
|
|||
use espresso_transcript::IOPTranscript;
|
|||
|
|||
#[cfg(feature = "parallel")]
|
|||
use rayon::iter::{IndexedParallelIterator, IntoParallelIterator, ParallelIterator};
|
|||
|
|||
impl<F: PrimeField> SumCheckVerifier<F> for IOPVerifierState<F> {
|
|||
type VPAuxInfo = VPAuxInfo<F>;
|
|||
type ProverMessage = IOPProverMessage<F>;
|
|||
type Challenge = F;
|
|||
type Transcript = IOPTranscript<F>;
|
|||
type SumCheckSubClaim = SumCheckSubClaim<F>;
|
|||
|
|||
/// Initialize the verifier's state.
|
|||
fn verifier_init(index_info: &Self::VPAuxInfo) -> Self {
|
|||
let start = start_timer!(|| "sum check verifier init");
|
|||
let res = Self {
|
|||
round: 1,
|
|||
num_vars: index_info.num_variables,
|
|||
max_degree: index_info.max_degree,
|
|||
finished: false,
|
|||
polynomials_received: Vec::with_capacity(index_info.num_variables),
|
|||
challenges: Vec::with_capacity(index_info.num_variables),
|
|||
};
|
|||
end_timer!(start);
|
|||
res
|
|||
}
|
|||
|
|||
/// Run verifier for the current round, given a prover message.
|
|||
///
|
|||
/// Note that `verify_round_and_update_state` only samples and stores
|
|||
/// challenges; and update the verifier's state accordingly. The actual
|
|||
/// verifications are deferred (in batch) to `check_and_generate_subclaim`
|
|||
/// at the last step.
|
|||
fn verify_round_and_update_state(
|
|||
&mut self,
|
|||
prover_msg: &Self::ProverMessage,
|
|||
transcript: &mut Self::Transcript,
|
|||
) -> Result<Self::Challenge, PolyIOPErrors> {
|
|||
let start =
|
|||
start_timer!(|| format!("sum check verify {}-th round and update state", self.round));
|
|||
|
|||
if self.finished {
|
|||
return Err(PolyIOPErrors::InvalidVerifier(
|
|||
"Incorrect verifier state: Verifier is already finished.".to_string(),
|
|||
));
|
|||
}
|
|||
|
|||
// In an interactive protocol, the verifier should
|
|||
//
|
|||
// 1. check if the received 'P(0) + P(1) = expected`.
|
|||
// 2. set `expected` to P(r)`
|
|||
//
|
|||
// When we turn the protocol to a non-interactive one, it is sufficient to defer
|
|||
// such checks to `check_and_generate_subclaim` after the last round.
|
|||
|
|||
let challenge = transcript.get_and_append_challenge(b"Internal round")?;
|
|||
self.challenges.push(challenge);
|
|||
self.polynomials_received
|
|||
.push(prover_msg.evaluations.to_vec());
|
|||
|
|||
if self.round == self.num_vars {
|
|||
// accept and close
|
|||
self.finished = true;
|
|||
} else {
|
|||
// proceed to the next round
|
|||
self.round += 1;
|
|||
}
|
|||
|
|||
end_timer!(start);
|
|||
Ok(challenge)
|
|||
}
|
|||
|
|||
/// This function verifies the deferred checks in the interactive version of
|
|||
/// the protocol; and generate the subclaim. Returns an error if the
|
|||
/// proof failed to verify.
|
|||
///
|
|||
/// If the asserted sum is correct, then the multilinear polynomial
|
|||
/// evaluated at `subclaim.point` will be `subclaim.expected_evaluation`.
|
|||
/// Otherwise, it is highly unlikely that those two will be equal.
|
|||
/// Larger field size guarantees smaller soundness error.
|
|||
fn check_and_generate_subclaim(
|
|||
&self,
|
|||
asserted_sum: &F,
|
|||
) -> Result<Self::SumCheckSubClaim, PolyIOPErrors> {
|
|||
let start = start_timer!(|| "sum check check and generate subclaim");
|
|||
if !self.finished {
|
|||
return Err(PolyIOPErrors::InvalidVerifier(
|
|||
"Incorrect verifier state: Verifier has not finished.".to_string(),
|
|||
));
|
|||
}
|
|||
|
|||
if self.polynomials_received.len() != self.num_vars {
|
|||
return Err(PolyIOPErrors::InvalidVerifier(
|
|||
"insufficient rounds".to_string(),
|
|||
));
|
|||
}
|
|||
|
|||
// the deferred check during the interactive phase:
|
|||
// 2. set `expected` to P(r)`
|
|||
#[cfg(feature = "parallel")]
|
|||
let mut expected_vec = self
|
|||
.polynomials_received
|
|||
.clone()
|
|||
.into_par_iter()
|
|||
.zip(self.challenges.clone().into_par_iter())
|
|||
.map(|(evaluations, challenge)| {
|
|||
if evaluations.len() != self.max_degree + 1 {
|
|||
return Err(PolyIOPErrors::InvalidVerifier(format!(
|
|||
"incorrect number of evaluations: {} vs {}",
|
|||
evaluations.len(),
|
|||
self.max_degree + 1
|
|||
)));
|
|||
}
|
|||
interpolate_uni_poly::<F>(&evaluations, challenge)
|
|||
})
|
|||
.collect::<Result<Vec<_>, PolyIOPErrors>>()?;
|
|||
|
|||
#[cfg(not(feature = "parallel"))]
|
|||
let mut expected_vec = self
|
|||
.polynomials_received
|
|||
.clone()
|
|||
.into_iter()
|
|||
.zip(self.challenges.clone().into_iter())
|
|||
.map(|(evaluations, challenge)| {
|
|||
if evaluations.len() != self.max_degree + 1 {
|
|||
return Err(PolyIOPErrors::InvalidVerifier(format!(
|
|||
"incorrect number of evaluations: {} vs {}",
|
|||
evaluations.len(),
|
|||
self.max_degree + 1
|
|||
)));
|
|||
}
|
|||
interpolate_uni_poly::<F>(&evaluations, challenge)
|
|||
})
|
|||
.collect::<Result<Vec<_>, PolyIOPErrors>>()?;
|
|||
|
|||
// insert the asserted_sum to the first position of the expected vector
|
|||
expected_vec.insert(0, *asserted_sum);
|
|||
|
|||
for (evaluations, &expected) in self
|
|||
.polynomials_received
|
|||
.iter()
|
|||
.zip(expected_vec.iter())
|
|||
.take(self.num_vars)
|
|||
{
|
|||
// the deferred check during the interactive phase:
|
|||
// 1. check if the received 'P(0) + P(1) = expected`.
|
|||
if evaluations[0] + evaluations[1] != expected {
|
|||
return Err(PolyIOPErrors::InvalidProof(
|
|||
"Prover message is not consistent with the claim.".to_string(),
|
|||
));
|
|||
}
|
|||
}
|
|||
end_timer!(start);
|
|||
Ok(SumCheckSubClaim {
|
|||
point: self.challenges.clone(),
|
|||
// the last expected value (not checked within this function) will be included in the
|
|||
// subclaim
|
|||
expected_evaluation: expected_vec[self.num_vars],
|
|||
})
|
|||
}
|
|||
}
|
|||
|
|||
/// Interpolate a uni-variate degree-`p_i.len()-1` polynomial and evaluate this
|
|||
/// polynomial at `eval_at`:
|
|||
///
|
|||
/// \sum_{i=0}^len p_i * (\prod_{j!=i} (eval_at - j)/(i-j) )
|
|||
///
|
|||
/// This implementation is linear in number of inputs in terms of field
|
|||
/// operations. It also has a quadratic term in primitive operations which is
|
|||
/// negligible compared to field operations.
|
|||
/// TODO: The quadratic term can be removed by precomputing the lagrange
|
|||
/// coefficients.
|
|||
pub fn interpolate_uni_poly<F: PrimeField>(p_i: &[F], eval_at: F) -> Result<F, PolyIOPErrors> {
|
|||
let start = start_timer!(|| "sum check interpolate uni poly opt");
|
|||
|
|||
let len = p_i.len();
|
|||
let mut evals = vec![];
|
|||
let mut prod = eval_at;
|
|||
evals.push(eval_at);
|
|||
|
|||
// `prod = \prod_{j} (eval_at - j)`
|
|||
for e in 1..len {
|
|||
let tmp = eval_at - F::from(e as u64);
|
|||
evals.push(tmp);
|
|||
prod *= tmp;
|
|||
}
|
|||
let mut res = F::zero();
|
|||
// we want to compute \prod (j!=i) (i-j) for a given i
|
|||
//
|
|||
// we start from the last step, which is
|
|||
// denom[len-1] = (len-1) * (len-2) *... * 2 * 1
|
|||
// the step before that is
|
|||
// denom[len-2] = (len-2) * (len-3) * ... * 2 * 1 * -1
|
|||
// and the step before that is
|
|||
// denom[len-3] = (len-3) * (len-4) * ... * 2 * 1 * -1 * -2
|
|||
//
|
|||
// i.e., for any i, the one before this will be derived from
|
|||
// denom[i-1] = denom[i] * (len-i) / i
|
|||
//
|
|||
// that is, we only need to store
|
|||
// - the last denom for i = len-1, and
|
|||
// - the ratio between current step and fhe last step, which is the product of
|
|||
// (len-i) / i from all previous steps and we store this product as a fraction
|
|||
// number to reduce field divisions.
|
|||
|
|||
// We know
|
|||
// - 2^61 < factorial(20) < 2^62
|
|||
// - 2^122 < factorial(33) < 2^123
|
|||
// so we will be able to compute the ratio
|
|||
// - for len <= 20 with i64
|
|||
// - for len <= 33 with i128
|
|||
// - for len > 33 with BigInt
|
|||
if p_i.len() <= 20 {
|
|||
let last_denominator = F::from(u64_factorial(len - 1));
|
|||
let mut ratio_numerator = 1i64;
|
|||
let mut ratio_denominator = 1u64;
|
|||
|
|||
for i in (0..len).rev() {
|
|||
let ratio_numerator_f = if ratio_numerator < 0 {
|
|||
-F::from((-ratio_numerator) as u64)
|
|||
} else {
|
|||
F::from(ratio_numerator as u64)
|
|||
};
|
|||
|
|||
res += p_i[i] * prod * F::from(ratio_denominator)
|
|||
/ (last_denominator * ratio_numerator_f * evals[i]);
|
|||
|
|||
// compute denom for the next step is current_denom * (len-i)/i
|
|||
if i != 0 {
|
|||
ratio_numerator *= -(len as i64 - i as i64);
|
|||
ratio_denominator *= i as u64;
|
|||
}
|
|||
}
|
|||
} else if p_i.len() <= 33 {
|
|||
let last_denominator = F::from(u128_factorial(len - 1));
|
|||
let mut ratio_numerator = 1i128;
|
|||
let mut ratio_denominator = 1u128;
|
|||
|
|||
for i in (0..len).rev() {
|
|||
let ratio_numerator_f = if ratio_numerator < 0 {
|
|||
-F::from((-ratio_numerator) as u128)
|
|||
} else {
|
|||
F::from(ratio_numerator as u128)
|
|||
};
|
|||
|
|||
res += p_i[i] * prod * F::from(ratio_denominator)
|
|||
/ (last_denominator * ratio_numerator_f * evals[i]);
|
|||
|
|||
// compute denom for the next step is current_denom * (len-i)/i
|
|||
if i != 0 {
|
|||
ratio_numerator *= -(len as i128 - i as i128);
|
|||
ratio_denominator *= i as u128;
|
|||
}
|
|||
}
|
|||
} else {
|
|||
let mut denom_up = field_factorial::<F>(len - 1);
|
|||
let mut denom_down = F::one();
|
|||
|
|||
for i in (0..len).rev() {
|
|||
res += p_i[i] * prod * denom_down / (denom_up * evals[i]);
|
|||
|
|||
// compute denom for the next step is current_denom * (len-i)/i
|
|||
if i != 0 {
|
|||
denom_up *= -F::from((len - i) as u64);
|
|||
denom_down *= F::from(i as u64);
|
|||
}
|
|||
}
|
|||
}
|
|||
end_timer!(start);
|
|||
Ok(res)
|
|||
}
|
|||
|
|||
/// compute the factorial(a) = 1 * 2 * ... * a
|
|||
#[inline]
|
|||
fn field_factorial<F: PrimeField>(a: usize) -> F {
|
|||
let mut res = F::one();
|
|||
for i in 2..=a {
|
|||
res *= F::from(i as u64);
|
|||
}
|
|||
res
|
|||
}
|
|||
|
|||
/// compute the factorial(a) = 1 * 2 * ... * a
|
|||
#[inline]
|
|||
fn u128_factorial(a: usize) -> u128 {
|
|||
let mut res = 1u128;
|
|||
for i in 2..=a {
|
|||
res *= i as u128;
|
|||
}
|
|||
res
|
|||
}
|
|||
|
|||
/// compute the factorial(a) = 1 * 2 * ... * a
|
|||
#[inline]
|
|||
fn u64_factorial(a: usize) -> u64 {
|
|||
let mut res = 1u64;
|
|||
for i in 2..=a {
|
|||
res *= i as u64;
|
|||
}
|
|||
res
|
|||
}
|
|||
|
|||
#[cfg(test)]
|
|||
mod test {
|
|||
use super::interpolate_uni_poly;
|
|||
use ark_bls12_377::Fr;
|
|||
use ark_poly::{univariate::DensePolynomial, DenseUVPolynomial, Polynomial};
|
|||
use ark_std::{vec::Vec, UniformRand};
|
|||
use espresso_subroutines::poly_iop::prelude::PolyIOPErrors;
|
|||
|
|||
#[test]
|
|||
fn test_interpolation() -> Result<(), PolyIOPErrors> {
|
|||
let mut prng = ark_std::test_rng();
|
|||
|
|||
// test a polynomial with 20 known points, i.e., with degree 19
|
|||
let poly = DensePolynomial::<Fr>::rand(20 - 1, &mut prng);
|
|||
let evals = (0..20)
|
|||
.map(|i| poly.evaluate(&Fr::from(i)))
|
|||
.collect::<Vec<Fr>>();
|
|||
let query = Fr::rand(&mut prng);
|
|||
|
|||
assert_eq!(poly.evaluate(&query), interpolate_uni_poly(&evals, query)?);
|
|||
|
|||
// test a polynomial with 33 known points, i.e., with degree 32
|
|||
let poly = DensePolynomial::<Fr>::rand(33 - 1, &mut prng);
|
|||
let evals = (0..33)
|
|||
.map(|i| poly.evaluate(&Fr::from(i)))
|
|||
.collect::<Vec<Fr>>();
|
|||
let query = Fr::rand(&mut prng);
|
|||
|
|||
assert_eq!(poly.evaluate(&query), interpolate_uni_poly(&evals, query)?);
|
|||
|
|||
// test a polynomial with 64 known points, i.e., with degree 63
|
|||
let poly = DensePolynomial::<Fr>::rand(64 - 1, &mut prng);
|
|||
let evals = (0..64)
|
|||
.map(|i| poly.evaluate(&Fr::from(i)))
|
|||
.collect::<Vec<Fr>>();
|
|||
let query = Fr::rand(&mut prng);
|
|||
|
|||
assert_eq!(poly.evaluate(&query), interpolate_uni_poly(&evals, query)?);
|
|||
|
|||
Ok(())
|
|||
}
|
|||
}
|
|||
@ -0,0 +1,550 @@ |
|||
// code forked from
|
|||
// https://github.com/privacy-scaling-explorations/multifolding-poc/blob/main/src/espresso/virtual_polynomial.rs
|
|||
//
|
|||
// Copyright (c) 2023 Espresso Systems (espressosys.com)
|
|||
// This file is part of the HyperPlonk library.
|
|||
|
|||
// You should have received a copy of the MIT License
|
|||
// along with the HyperPlonk library. If not, see <https://mit-license.org/>.
|
|||
|
|||
//! This module defines our main mathematical object `VirtualPolynomial`; and
|
|||
//! various functions associated with it.
|
|||
|
|||
use ark_ff::PrimeField;
|
|||
use ark_poly::{DenseMultilinearExtension, MultilinearExtension};
|
|||
use ark_serialize::CanonicalSerialize;
|
|||
use ark_std::{end_timer, start_timer};
|
|||
use rayon::prelude::*;
|
|||
use std::{cmp::max, collections::HashMap, marker::PhantomData, ops::Add, sync::Arc};
|
|||
use thiserror::Error;
|
|||
|
|||
use ark_std::string::String;
|
|||
|
|||
//-- aritherrors
|
|||
/// A `enum` specifying the possible failure modes of the arithmetics.
|
|||
#[derive(Error, Debug)]
|
|||
pub enum ArithErrors {
|
|||
#[error("Invalid parameters: {0}")]
|
|||
InvalidParameters(String),
|
|||
#[error("Should not arrive to this point")]
|
|||
ShouldNotArrive,
|
|||
#[error("An error during (de)serialization: {0}")]
|
|||
SerializationErrors(ark_serialize::SerializationError),
|
|||
}
|
|||
|
|||
impl From<ark_serialize::SerializationError> for ArithErrors {
|
|||
fn from(e: ark_serialize::SerializationError) -> Self {
|
|||
Self::SerializationErrors(e)
|
|||
}
|
|||
}
|
|||
//-- aritherrors
|
|||
|
|||
#[rustfmt::skip]
|
|||
/// A virtual polynomial is a sum of products of multilinear polynomials;
|
|||
/// where the multilinear polynomials are stored via their multilinear
|
|||
/// extensions: `(coefficient, DenseMultilinearExtension)`
|
|||
///
|
|||
/// * Number of products n = `polynomial.products.len()`,
|
|||
/// * Number of multiplicands of ith product m_i =
|
|||
/// `polynomial.products[i].1.len()`,
|
|||
/// * Coefficient of ith product c_i = `polynomial.products[i].0`
|
|||
///
|
|||
/// The resulting polynomial is
|
|||
///
|
|||
/// $$ \sum_{i=0}^{n} c_i \cdot \prod_{j=0}^{m_i} P_{ij} $$
|
|||
///
|
|||
/// Example:
|
|||
/// f = c0 * f0 * f1 * f2 + c1 * f3 * f4
|
|||
/// where f0 ... f4 are multilinear polynomials
|
|||
///
|
|||
/// - flattened_ml_extensions stores the multilinear extension representation of
|
|||
/// f0, f1, f2, f3 and f4
|
|||
/// - products is
|
|||
/// \[
|
|||
/// (c0, \[0, 1, 2\]),
|
|||
/// (c1, \[3, 4\])
|
|||
/// \]
|
|||
/// - raw_pointers_lookup_table maps fi to i
|
|||
///
|
|||
#[derive(Clone, Debug, Default, PartialEq)]
|
|||
pub struct VirtualPolynomial<F: PrimeField> {
|
|||
/// Aux information about the multilinear polynomial
|
|||
pub aux_info: VPAuxInfo<F>,
|
|||
/// list of reference to products (as usize) of multilinear extension
|
|||
pub products: Vec<(F, Vec<usize>)>,
|
|||
/// Stores multilinear extensions in which product multiplicand can refer
|
|||
/// to.
|
|||
pub flattened_ml_extensions: Vec<Arc<DenseMultilinearExtension<F>>>,
|
|||
/// Pointers to the above poly extensions
|
|||
raw_pointers_lookup_table: HashMap<*const DenseMultilinearExtension<F>, usize>,
|
|||
}
|
|||
|
|||
#[derive(Clone, Debug, Default, PartialEq, Eq, CanonicalSerialize)]
|
|||
/// Auxiliary information about the multilinear polynomial
|
|||
pub struct VPAuxInfo<F: PrimeField> {
|
|||
/// max number of multiplicands in each product
|
|||
pub max_degree: usize,
|
|||
/// number of variables of the polynomial
|
|||
pub num_variables: usize,
|
|||
/// Associated field
|
|||
#[doc(hidden)]
|
|||
pub phantom: PhantomData<F>,
|
|||
}
|
|||
|
|||
impl<F: PrimeField> Add for &VirtualPolynomial<F> {
|
|||
type Output = VirtualPolynomial<F>;
|
|||
fn add(self, other: &VirtualPolynomial<F>) -> Self::Output {
|
|||
let start = start_timer!(|| "virtual poly add");
|
|||
let mut res = self.clone();
|
|||
for products in other.products.iter() {
|
|||
let cur: Vec<Arc<DenseMultilinearExtension<F>>> = products
|
|||
.1
|
|||
.iter()
|
|||
.map(|&x| other.flattened_ml_extensions[x].clone())
|
|||
.collect();
|
|||
|
|||
res.add_mle_list(cur, products.0)
|
|||
.expect("add product failed");
|
|||
}
|
|||
end_timer!(start);
|
|||
res
|
|||
}
|
|||
}
|
|||
|
|||
// TODO: convert this into a trait
|
|||
impl<F: PrimeField> VirtualPolynomial<F> {
|
|||
/// Creates an empty virtual polynomial with `num_variables`.
|
|||
pub fn new(num_variables: usize) -> Self {
|
|||
VirtualPolynomial {
|
|||
aux_info: VPAuxInfo {
|
|||
max_degree: 0,
|
|||
num_variables,
|
|||
phantom: PhantomData,
|
|||
},
|
|||
products: Vec::new(),
|
|||
flattened_ml_extensions: Vec::new(),
|
|||
raw_pointers_lookup_table: HashMap::new(),
|
|||
}
|
|||
}
|
|||
|
|||
/// Creates an new virtual polynomial from a MLE and its coefficient.
|
|||
pub fn new_from_mle(mle: &Arc<DenseMultilinearExtension<F>>, coefficient: F) -> Self {
|
|||
let mle_ptr: *const DenseMultilinearExtension<F> = Arc::as_ptr(mle);
|
|||
let mut hm = HashMap::new();
|
|||
hm.insert(mle_ptr, 0);
|
|||
|
|||
VirtualPolynomial {
|
|||
aux_info: VPAuxInfo {
|
|||
// The max degree is the max degree of any individual variable
|
|||
max_degree: 1,
|
|||
num_variables: mle.num_vars,
|
|||
phantom: PhantomData,
|
|||
},
|
|||
// here `0` points to the first polynomial of `flattened_ml_extensions`
|
|||
products: vec![(coefficient, vec![0])],
|
|||
flattened_ml_extensions: vec![mle.clone()],
|
|||
raw_pointers_lookup_table: hm,
|
|||
}
|
|||
}
|
|||
|
|||
/// Add a product of list of multilinear extensions to self
|
|||
/// Returns an error if the list is empty, or the MLE has a different
|
|||
/// `num_vars` from self.
|
|||
///
|
|||
/// The MLEs will be multiplied together, and then multiplied by the scalar
|
|||
/// `coefficient`.
|
|||
pub fn add_mle_list(
|
|||
&mut self,
|
|||
mle_list: impl IntoIterator<Item = Arc<DenseMultilinearExtension<F>>>,
|
|||
coefficient: F,
|
|||
) -> Result<(), ArithErrors> {
|
|||
let mle_list: Vec<Arc<DenseMultilinearExtension<F>>> = mle_list.into_iter().collect();
|
|||
let mut indexed_product = Vec::with_capacity(mle_list.len());
|
|||
|
|||
if mle_list.is_empty() {
|
|||
return Err(ArithErrors::InvalidParameters(
|
|||
"input mle_list is empty".to_string(),
|
|||
));
|
|||
}
|
|||
|
|||
self.aux_info.max_degree = max(self.aux_info.max_degree, mle_list.len());
|
|||
|
|||
for mle in mle_list {
|
|||
if mle.num_vars != self.aux_info.num_variables {
|
|||
return Err(ArithErrors::InvalidParameters(format!(
|
|||
"product has a multiplicand with wrong number of variables {} vs {}",
|
|||
mle.num_vars, self.aux_info.num_variables
|
|||
)));
|
|||
}
|
|||
|
|||
let mle_ptr: *const DenseMultilinearExtension<F> = Arc::as_ptr(&mle);
|
|||
if let Some(index) = self.raw_pointers_lookup_table.get(&mle_ptr) {
|
|||
indexed_product.push(*index)
|
|||
} else {
|
|||
let curr_index = self.flattened_ml_extensions.len();
|
|||
self.flattened_ml_extensions.push(mle.clone());
|
|||
self.raw_pointers_lookup_table.insert(mle_ptr, curr_index);
|
|||
indexed_product.push(curr_index);
|
|||
}
|
|||
}
|
|||
self.products.push((coefficient, indexed_product));
|
|||
Ok(())
|
|||
}
|
|||
|
|||
/// Multiple the current VirtualPolynomial by an MLE:
|
|||
/// - add the MLE to the MLE list;
|
|||
/// - multiple each product by MLE and its coefficient.
|
|||
/// Returns an error if the MLE has a different `num_vars` from self.
|
|||
pub fn mul_by_mle(
|
|||
&mut self,
|
|||
mle: Arc<DenseMultilinearExtension<F>>,
|
|||
coefficient: F,
|
|||
) -> Result<(), ArithErrors> {
|
|||
let start = start_timer!(|| "mul by mle");
|
|||
|
|||
if mle.num_vars != self.aux_info.num_variables {
|
|||
return Err(ArithErrors::InvalidParameters(format!(
|
|||
"product has a multiplicand with wrong number of variables {} vs {}",
|
|||
mle.num_vars, self.aux_info.num_variables
|
|||
)));
|
|||
}
|
|||
|
|||
let mle_ptr: *const DenseMultilinearExtension<F> = Arc::as_ptr(&mle);
|
|||
|
|||
// check if this mle already exists in the virtual polynomial
|
|||
let mle_index = match self.raw_pointers_lookup_table.get(&mle_ptr) {
|
|||
Some(&p) => p,
|
|||
None => {
|
|||
self.raw_pointers_lookup_table
|
|||
.insert(mle_ptr, self.flattened_ml_extensions.len());
|
|||
self.flattened_ml_extensions.push(mle);
|
|||
self.flattened_ml_extensions.len() - 1
|
|||
}
|
|||
};
|
|||
|
|||
for (prod_coef, indices) in self.products.iter_mut() {
|
|||
// - add the MLE to the MLE list;
|
|||
// - multiple each product by MLE and its coefficient.
|
|||
indices.push(mle_index);
|
|||
*prod_coef *= coefficient;
|
|||
}
|
|||
|
|||
// increase the max degree by one as the MLE has degree 1.
|
|||
self.aux_info.max_degree += 1;
|
|||
end_timer!(start);
|
|||
Ok(())
|
|||
}
|
|||
|
|||
/// Given virtual polynomial `p(x)` and scalar `s`, compute `s*p(x)`
|
|||
pub fn scalar_mul(&mut self, s: &F) {
|
|||
for (prod_coef, _) in self.products.iter_mut() {
|
|||
*prod_coef *= s;
|
|||
}
|
|||
}
|
|||
|
|||
/// Evaluate the virtual polynomial at point `point`.
|
|||
/// Returns an error is point.len() does not match `num_variables`.
|
|||
pub fn evaluate(&self, point: &[F]) -> Result<F, ArithErrors> {
|
|||
let start = start_timer!(|| "evaluation");
|
|||
|
|||
if self.aux_info.num_variables != point.len() {
|
|||
return Err(ArithErrors::InvalidParameters(format!(
|
|||
"wrong number of variables {} vs {}",
|
|||
self.aux_info.num_variables,
|
|||
point.len()
|
|||
)));
|
|||
}
|
|||
|
|||
// Evaluate all the MLEs at `point`
|
|||
let evals: Vec<F> = self
|
|||
.flattened_ml_extensions
|
|||
.iter()
|
|||
.map(|x| {
|
|||
x.evaluate(point).unwrap() // safe unwrap here since we have
|
|||
// already checked that num_var
|
|||
// matches
|
|||
})
|
|||
.collect();
|
|||
|
|||
let res = self
|
|||
.products
|
|||
.iter()
|
|||
.map(|(c, p)| *c * p.iter().map(|&i| evals[i]).product::<F>())
|
|||
.sum();
|
|||
|
|||
end_timer!(start);
|
|||
Ok(res)
|
|||
}
|
|||
|
|||
// Input poly f(x) and a random vector r, output
|
|||
// \hat f(x) = \sum_{x_i \in eval_x} f(x_i) eq(x, r)
|
|||
// where
|
|||
// eq(x,y) = \prod_i=1^num_var (x_i * y_i + (1-x_i)*(1-y_i))
|
|||
//
|
|||
// This function is used in ZeroCheck.
|
|||
pub fn build_f_hat(&self, r: &[F]) -> Result<Self, ArithErrors> {
|
|||
let start = start_timer!(|| "zero check build hat f");
|
|||
|
|||
if self.aux_info.num_variables != r.len() {
|
|||
return Err(ArithErrors::InvalidParameters(format!(
|
|||
"r.len() is different from number of variables: {} vs {}",
|
|||
r.len(),
|
|||
self.aux_info.num_variables
|
|||
)));
|
|||
}
|
|||
|
|||
let eq_x_r = build_eq_x_r(r)?;
|
|||
let mut res = self.clone();
|
|||
res.mul_by_mle(eq_x_r, F::one())?;
|
|||
|
|||
end_timer!(start);
|
|||
Ok(res)
|
|||
}
|
|||
}
|
|||
|
|||
/// Evaluate eq polynomial.
|
|||
pub fn eq_eval<F: PrimeField>(x: &[F], y: &[F]) -> Result<F, ArithErrors> {
|
|||
if x.len() != y.len() {
|
|||
return Err(ArithErrors::InvalidParameters(
|
|||
"x and y have different length".to_string(),
|
|||
));
|
|||
}
|
|||
let start = start_timer!(|| "eq_eval");
|
|||
let mut res = F::one();
|
|||
for (&xi, &yi) in x.iter().zip(y.iter()) {
|
|||
let xi_yi = xi * yi;
|
|||
res *= xi_yi + xi_yi - xi - yi + F::one();
|
|||
}
|
|||
end_timer!(start);
|
|||
Ok(res)
|
|||
}
|
|||
|
|||
/// This function build the eq(x, r) polynomial for any given r.
|
|||
///
|
|||
/// Evaluate
|
|||
/// eq(x,y) = \prod_i=1^num_var (x_i * y_i + (1-x_i)*(1-y_i))
|
|||
/// over r, which is
|
|||
/// eq(x,y) = \prod_i=1^num_var (x_i * r_i + (1-x_i)*(1-r_i))
|
|||
fn build_eq_x_r<F: PrimeField>(r: &[F]) -> Result<Arc<DenseMultilinearExtension<F>>, ArithErrors> {
|
|||
let evals = build_eq_x_r_vec(r)?;
|
|||
let mle = DenseMultilinearExtension::from_evaluations_vec(r.len(), evals);
|
|||
|
|||
Ok(Arc::new(mle))
|
|||
}
|
|||
/// This function build the eq(x, r) polynomial for any given r, and output the
|
|||
/// evaluation of eq(x, r) in its vector form.
|
|||
///
|
|||
/// Evaluate
|
|||
/// eq(x,y) = \prod_i=1^num_var (x_i * y_i + (1-x_i)*(1-y_i))
|
|||
/// over r, which is
|
|||
/// eq(x,y) = \prod_i=1^num_var (x_i * r_i + (1-x_i)*(1-r_i))
|
|||
fn build_eq_x_r_vec<F: PrimeField>(r: &[F]) -> Result<Vec<F>, ArithErrors> {
|
|||
// we build eq(x,r) from its evaluations
|
|||
// we want to evaluate eq(x,r) over x \in {0, 1}^num_vars
|
|||
// for example, with num_vars = 4, x is a binary vector of 4, then
|
|||
// 0 0 0 0 -> (1-r0) * (1-r1) * (1-r2) * (1-r3)
|
|||
// 1 0 0 0 -> r0 * (1-r1) * (1-r2) * (1-r3)
|
|||
// 0 1 0 0 -> (1-r0) * r1 * (1-r2) * (1-r3)
|
|||
// 1 1 0 0 -> r0 * r1 * (1-r2) * (1-r3)
|
|||
// ....
|
|||
// 1 1 1 1 -> r0 * r1 * r2 * r3
|
|||
// we will need 2^num_var evaluations
|
|||
|
|||
let mut eval = Vec::new();
|
|||
build_eq_x_r_helper(r, &mut eval)?;
|
|||
|
|||
Ok(eval)
|
|||
}
|
|||
|
|||
/// A helper function to build eq(x, r) recursively.
|
|||
/// This function takes `r.len()` steps, and for each step it requires a maximum
|
|||
/// `r.len()-1` multiplications.
|
|||
fn build_eq_x_r_helper<F: PrimeField>(r: &[F], buf: &mut Vec<F>) -> Result<(), ArithErrors> {
|
|||
if r.is_empty() {
|
|||
return Err(ArithErrors::InvalidParameters("r length is 0".to_string()));
|
|||
} else if r.len() == 1 {
|
|||
// initializing the buffer with [1-r_0, r_0]
|
|||
buf.push(F::one() - r[0]);
|
|||
buf.push(r[0]);
|
|||
} else {
|
|||
build_eq_x_r_helper(&r[1..], buf)?;
|
|||
|
|||
// suppose at the previous step we received [b_1, ..., b_k]
|
|||
// for the current step we will need
|
|||
// if x_0 = 0: (1-r0) * [b_1, ..., b_k]
|
|||
// if x_0 = 1: r0 * [b_1, ..., b_k]
|
|||
// let mut res = vec![];
|
|||
// for &b_i in buf.iter() {
|
|||
// let tmp = r[0] * b_i;
|
|||
// res.push(b_i - tmp);
|
|||
// res.push(tmp);
|
|||
// }
|
|||
// *buf = res;
|
|||
|
|||
let mut res = vec![F::zero(); buf.len() << 1];
|
|||
res.par_iter_mut().enumerate().for_each(|(i, val)| {
|
|||
let bi = buf[i >> 1];
|
|||
let tmp = r[0] * bi;
|
|||
if i & 1 == 0 {
|
|||
*val = bi - tmp;
|
|||
} else {
|
|||
*val = tmp;
|
|||
}
|
|||
});
|
|||
*buf = res;
|
|||
}
|
|||
|
|||
Ok(())
|
|||
}
|
|||
|
|||
/// Decompose an integer into a binary vector in little endian.
|
|||
pub fn bit_decompose(input: u64, num_var: usize) -> Vec<bool> {
|
|||
let mut res = Vec::with_capacity(num_var);
|
|||
let mut i = input;
|
|||
for _ in 0..num_var {
|
|||
res.push(i & 1 == 1);
|
|||
i >>= 1;
|
|||
}
|
|||
res
|
|||
}
|
|||
|
|||
#[cfg(test)]
|
|||
mod test {
|
|||
use super::*;
|
|||
use crate::utils::multilinear_polynomial::tests::random_mle_list;
|
|||
use ark_bls12_377::Fr;
|
|||
use ark_ff::UniformRand;
|
|||
use ark_std::{
|
|||
rand::{Rng, RngCore},
|
|||
test_rng,
|
|||
};
|
|||
|
|||
impl<F: PrimeField> VirtualPolynomial<F> {
|
|||
/// Sample a random virtual polynomial, return the polynomial and its sum.
|
|||
fn rand<R: RngCore>(
|
|||
nv: usize,
|
|||
num_multiplicands_range: (usize, usize),
|
|||
num_products: usize,
|
|||
rng: &mut R,
|
|||
) -> Result<(Self, F), ArithErrors> {
|
|||
let start = start_timer!(|| "sample random virtual polynomial");
|
|||
|
|||
let mut sum = F::zero();
|
|||
let mut poly = VirtualPolynomial::new(nv);
|
|||
for _ in 0..num_products {
|
|||
let num_multiplicands =
|
|||
rng.gen_range(num_multiplicands_range.0..num_multiplicands_range.1);
|
|||
let (product, product_sum) = random_mle_list(nv, num_multiplicands, rng);
|
|||
let coefficient = F::rand(rng);
|
|||
poly.add_mle_list(product.into_iter(), coefficient)?;
|
|||
sum += product_sum * coefficient;
|
|||
}
|
|||
|
|||
end_timer!(start);
|
|||
Ok((poly, sum))
|
|||
}
|
|||
}
|
|||
|
|||
#[test]
|
|||
fn test_virtual_polynomial_additions() -> Result<(), ArithErrors> {
|
|||
let mut rng = test_rng();
|
|||
for nv in 2..5 {
|
|||
for num_products in 2..5 {
|
|||
let base: Vec<Fr> = (0..nv).map(|_| Fr::rand(&mut rng)).collect();
|
|||
|
|||
let (a, _a_sum) =
|
|||
VirtualPolynomial::<Fr>::rand(nv, (2, 3), num_products, &mut rng)?;
|
|||
let (b, _b_sum) =
|
|||
VirtualPolynomial::<Fr>::rand(nv, (2, 3), num_products, &mut rng)?;
|
|||
let c = &a + &b;
|
|||
|
|||
assert_eq!(
|
|||
a.evaluate(base.as_ref())? + b.evaluate(base.as_ref())?,
|
|||
c.evaluate(base.as_ref())?
|
|||
);
|
|||
}
|
|||
}
|
|||
|
|||
Ok(())
|
|||
}
|
|||
|
|||
#[test]
|
|||
fn test_virtual_polynomial_mul_by_mle() -> Result<(), ArithErrors> {
|
|||
let mut rng = test_rng();
|
|||
for nv in 2..5 {
|
|||
for num_products in 2..5 {
|
|||
let base: Vec<Fr> = (0..nv).map(|_| Fr::rand(&mut rng)).collect();
|
|||
|
|||
let (a, _a_sum) =
|
|||
VirtualPolynomial::<Fr>::rand(nv, (2, 3), num_products, &mut rng)?;
|
|||
let (b, _b_sum) = random_mle_list(nv, 1, &mut rng);
|
|||
let b_mle = b[0].clone();
|
|||
let coeff = Fr::rand(&mut rng);
|
|||
let b_vp = VirtualPolynomial::new_from_mle(&b_mle, coeff);
|
|||
|
|||
let mut c = a.clone();
|
|||
|
|||
c.mul_by_mle(b_mle, coeff)?;
|
|||
|
|||
assert_eq!(
|
|||
a.evaluate(base.as_ref())? * b_vp.evaluate(base.as_ref())?,
|
|||
c.evaluate(base.as_ref())?
|
|||
);
|
|||
}
|
|||
}
|
|||
|
|||
Ok(())
|
|||
}
|
|||
|
|||
#[test]
|
|||
fn test_eq_xr() {
|
|||
let mut rng = test_rng();
|
|||
for nv in 4..10 {
|
|||
let r: Vec<Fr> = (0..nv).map(|_| Fr::rand(&mut rng)).collect();
|
|||
let eq_x_r = build_eq_x_r(r.as_ref()).unwrap();
|
|||
let eq_x_r2 = build_eq_x_r_for_test(r.as_ref());
|
|||
assert_eq!(eq_x_r, eq_x_r2);
|
|||
}
|
|||
}
|
|||
|
|||
/// Naive method to build eq(x, r).
|
|||
/// Only used for testing purpose.
|
|||
// Evaluate
|
|||
// eq(x,y) = \prod_i=1^num_var (x_i * y_i + (1-x_i)*(1-y_i))
|
|||
// over r, which is
|
|||
// eq(x,y) = \prod_i=1^num_var (x_i * r_i + (1-x_i)*(1-r_i))
|
|||
fn build_eq_x_r_for_test<F: PrimeField>(r: &[F]) -> Arc<DenseMultilinearExtension<F>> {
|
|||
// we build eq(x,r) from its evaluations
|
|||
// we want to evaluate eq(x,r) over x \in {0, 1}^num_vars
|
|||
// for example, with num_vars = 4, x is a binary vector of 4, then
|
|||
// 0 0 0 0 -> (1-r0) * (1-r1) * (1-r2) * (1-r3)
|
|||
// 1 0 0 0 -> r0 * (1-r1) * (1-r2) * (1-r3)
|
|||
// 0 1 0 0 -> (1-r0) * r1 * (1-r2) * (1-r3)
|
|||
// 1 1 0 0 -> r0 * r1 * (1-r2) * (1-r3)
|
|||
// ....
|
|||
// 1 1 1 1 -> r0 * r1 * r2 * r3
|
|||
// we will need 2^num_var evaluations
|
|||
|
|||
// First, we build array for {1 - r_i}
|
|||
let one_minus_r: Vec<F> = r.iter().map(|ri| F::one() - ri).collect();
|
|||
|
|||
let num_var = r.len();
|
|||
let mut eval = vec![];
|
|||
|
|||
for i in 0..1 << num_var {
|
|||
let mut current_eval = F::one();
|
|||
let bit_sequence = bit_decompose(i, num_var);
|
|||
|
|||
for (&bit, (ri, one_minus_ri)) in
|
|||
bit_sequence.iter().zip(r.iter().zip(one_minus_r.iter()))
|
|||
{
|
|||
current_eval *= if bit { *ri } else { *one_minus_ri };
|
|||
}
|
|||
eval.push(current_eval);
|
|||
}
|
|||
|
|||
let mle = DenseMultilinearExtension::from_evaluations_vec(num_var, eval);
|
|||
|
|||
Arc::new(mle)
|
|||
}
|
|||
}
|
|||
@ -1 +1,7 @@ |
|||
pub mod vec;
|
|||
|
|||
// expose espresso local modules
|
|||
pub mod espresso;
|
|||
pub use crate::utils::espresso::multilinear_polynomial;
|
|||
pub use crate::utils::espresso::sum_check;
|
|||
pub use crate::utils::espresso::virtual_polynomial;
|
|||