@@ -0,0 +1,682 @@
+\documentclass[t]{beamer} \usefonttheme[onlymath]{serif}
+\mode<presentation>
+{
+  \usetheme{Frankfurt}
+  \usecolortheme{dove}  %% grey scale
+  \useinnertheme{circles}
+  \setbeamercovered{invisible}
+}
+
+\hypersetup{
+    colorlinks,
+    citecolor=black,
+    filecolor=black,
+    linkcolor=black,
+    urlcolor=blue
+}
+\usepackage{graphicx}
+
+\graphicspath{ {./imgs-zksummit12} }
+
+% \usepackage{listings} % embed code
+% \usepackage{minted} % embed code
+\usepackage{color}
+
+\setbeamertemplate{itemize}{$\circ$}
+\setbeamertemplate{itemize items}{$\circ$}
+
+\beamertemplatenavigationsymbolsempty %% no navigation bar
+
+\setbeamertemplate{footline}{\hspace*{.1cm}\scriptsize{
+\hspace*{50pt} \hfill\insertframenumber/\inserttotalframenumber\hspace*{.1cm}\vspace*{.1cm}}}
+
+\setbeamertemplate{caption}[numbered]
+\setbeamerfont{caption}{size=\tiny}
+
+
+
+\title{Sonobe, a modular folding schemes library}
+\date{
+  \includegraphics[width=3cm]{sonobe}\\
+  \vspace{0.1cm}
+  \scriptsize{2024-10-08\\0xPARC \& PSE}
+}
+
+\begin{document}
+
+\frame{\titlepage}
+
+\section{Motivation}
+
+\begin{frame}{Polynomials and SNARKs}
+  \begin{itemize}
+    \item define the 'program' that we want to be able to prove as a set of constraints
+    \item encode the constraints as polynomials
+    \\eg. R1CS: $Az \circ Bz - Cz == 0$
+    \\~~~~~~~~~~$A(X) \cdot B(X) - C(X) == 0$
+    \item and then use some scheme to prove that those polynomials satisfy the relation. eg. Groth16, Spartan, etc
+  \end{itemize}
+  \vspace{0.5cm}
+  TL;DR: want to prove polynomial relations
+\end{frame}
+
+\begin{frame}{Why folding}
+  \begin{itemize}
+    \item Repetitive computations take big circuits $\longrightarrow$ large proving time
+    \begin{itemize}
+      \item in some cases takes too much memory and can not be even computed
+      \item eg. prove a chain of 10k sha256 hashes (>600M R1CS constraints, not feasible with most traditional SNARK proving systems)
+      \item eg. zkVM opcodes
+    \end{itemize}
+
+    \pause
+    \item Traditional recursion: verify (in-circuit) a proof of the correct execution of the same circuit for the previous input
+    \begin{itemize}
+      \item issue: in-circuit proof verification is expensive (constraints)
+      \begin{itemize}
+        \item ie. verify a Groth16 proof inside a R1CS circuit
+      \end{itemize}
+    \end{itemize}
+  \end{itemize}
+
+  \includegraphics[width=\textwidth]{brute-force-recursion}
+
+\end{frame}
+
+\begin{frame}{IVC - Incremental Verifiable Computation}
+  {\tiny Valiant'08}
+  % Folding schemes efficiently achieve IVC, where the prover recursively proves the correct execution of the incremental computations.
+  %\vspace{0.5cm}
+
+  \emph{Prove that applying $n$ times the $F$ function (the circuit being folded) to the initial state ($z_0$) results in the final state ($z_n$).}
+
+  \includegraphics[width=\textwidth]{folding-main-idea-diagram}
+
+  In other words, it allows to prove efficiently that
+  $$z_n = F(...~F(F(F(F(z_0, w_0), w_1), w_2), ...), w_{n-1})$$
+\end{frame}
+
+
+\begin{frame}{Folding scheme pipeline}
+  \includegraphics[width=\textwidth]{folding-scheme-pipeline}
+
+  \vspace{0.5cm}
+  {\scriptsize
+  The IVC folds the AugmentedFCircuit, which ensures that the NIFS.Verify checks out.
+  }
+\end{frame}
+
+
+\section{Recap on folding}
+
+% TODO MAYBE REMOVE SLIDE
+\begin{frame}{RLC of homomorphic commitments}
+  \small{
+    In the initial folding schemes, we rely on homomorphic commitments, eg. Pedersen commitments\\
+  }
+
+  Let $g \in \mathbb{G}^n,~ v \in \mathbb{F}_r^n$,\\
+  $$Com(v) = \langle g, v \rangle =g_1 \cdot v_1 + g_2 \cdot v_2 + \ldots + g_n \cdot v_n \in \mathbb{G}$$
+
+  RLC:\\
+  Let $v, w \in \mathbb{F}_r^n$,
+  \\set $cm_v = Com(v),~ cm_w=Com(w) \in \mathbb{G}$.
+  \\then,
+  \begin{align*}
+    y &= v + r \cdot w\\
+    cm_{y} &=cm_v + r \cdot cm_w
+  \end{align*}
+  \\so that
+  $$cm_y = Com(y)$$
+\end{frame}
+
+% TODO MAYBE REMOVE SLIDE
+%%%%%%%%%%%%%%%%% TODO maybe get rid of the slide if not enough time
+%%%%
+\begin{frame}{Random linearly combining 2 R1CS instances}
+  \scriptsize{
+
+    R1CS instance: $(\{A, B, C\} \in \mathbb{F}^{n \times n},~ n,~ l)$, such that for $z=(1, io \in \mathbb{F}^l, w \in \mathbb{F}^{n-l-1}) \in \mathbb{F}^n$,
+
+    $$Az \circ Bz = Cz$$
+
+
+      If we try to do a RLC with two instances ($z = z_1 + r \dot z_2$):
+      \begin{align*}
+        Az \circ Bz &= A(z_1 + r z_2) \circ B(z_1 + r z_2)\\
+        &= (Az_1 \circ Bz_1) + r \cdot (A z_1 \circ B z_2 + A z_2 \circ B z_1) + r^2 \cdot (A z_2 \circ B z_2)\\
+        &\neq C z = C(z_1 + r z_2) = C z_1 + r C z_2 = (A z_1 \circ B z_1) + r \cdot (A z_2 \circ B z_2)
+      \end{align*}
+      we end up with some inequality.
+
+
+    \pause
+
+    Nova's solution, Relaxed R1CS:
+
+    $$Az \circ Bz = uCz + E$$
+
+    for $u \in \mathbb{F},~~ E \in \mathbb{F}^n$.
+
+    \vspace{0.5cm}
+
+    Witness of the instance: $WI=(E, W)$\\
+    Committed Relaxed R1CS instance: $CI = (\overline{E}, u, \overline{W}, x)$
+  }
+
+  \vspace{0.3cm}
+  \tiny{Full details at Nova's paper, pages 13-15 ("first attempt, second attempt, third attempt")}
+
+\end{frame}
+
+% TODO MAYBE REMOVE SLIDE
+% \begin{frame}{Relaxed R1CS}
+%   % \vspace{-1cm}
+%   \scriptsize{
+%         $u=u_1+r u_2,~~ z=z_1+r z_2,~~ x=x_1+r x_2$\\
+%         $E=E_1 + r (A z_1 \circ B z_2 + A z_2 \circ B z_1 - u_1 C z_2 - u_2 C z_1) + r^2 E_2$\\
+%   \text{Relaxed R1CS:} $Az \circ Bz = uCz + E,~~ with~ z=(u,~x,~W)$
+%   \begin{align*}
+%           Az \circ Bz 
+%               &= A(z_1 + r \cdot z_2) \circ B(z_1 + r \cdot z_2)\\
+%               &= A z_1 \circ B z_1 + r(A z_1 \circ B z_2 + A z_2 \circ B z_1) + r^2 (A z_2 \circ B z_2)\\
+%               &= (u_1 C z_1 + E_1) + r (A z_1 \circ B z_2 + A z_2 \circ B z_1) + r^2 (u_2 C z_2 + E_2)\\
+%               &= u_1 C z_1 + \underbrace{E_1 + r(A z_1 \circ B z_2 + A z_2 \circ B z_1) + r^2 E_2}_\text{E} + r^2 u_2 C z_2\\
+%               &= u_1 C z_1 + r^2 u_2 C z_2 + E\\
+%               &= (u_1 + r u_2) \cdot C \cdot (z_1 + r z_2) + E\\
+%               &= uCz + E
+%   \end{align*}
+% 
+%   For R1CS matrices $(A,~B,~C)$, the folded witness $W$ is a satisfying witness for the folded instance $(E,~u,~x)$, following the Relaxed R1CS relation: $Az \circ Bz - uCz - E ==0$.
+% 
+%   Since we don't want that the Verifier learning about the witness, we commit to it, and the Verifier will run the RLC on the commitment (not on the witness), obtaining the 'folded' commitment.
+% 
+%   \\\tiny{Full details at Nova's paper, pages 13-15 ("first attempt, second attempt, third attempt")}
+%   }
+% \end{frame}
+%%%%
+%%%%%%%%%%%%%%%%%
+
+\begin{frame}{NIFS: Non Interactive Folding Scheme (in Nova)}
+  {\tiny
+  Main idea:
+  \begin{itemize}
+    \item protocol between P (Prover) and V (Verifier)
+    \item where P and V obtain the 'folded' committed instance that corresponds to the 'folded' witness instance that P computes
+    \item so V does not know the witness
+  \end{itemize}
+  % We make it non-interactive with Fiat-Shamir.
+  RelaxedR1CS relation: $Az \circ Bz = uCz + E$, for $u \in \mathbb{F},~~ E \in \mathbb{F}^n$.
+  \\Witness of the instance: $WI=(E, W)$\\
+  Committed Relaxed R1CS instance: $CI = (\overline{E}, u, \overline{W}, x)$
+
+  \includegraphics[width=\textwidth]{interactive-FS-nova-diagram}
+
+  Relation check:
+  \begin{align*}
+    &z=(1,x,W)\\
+     &\begin{cases}
+    Az \circ Bz - uCz - E \stackrel{?}{=} 0\\
+    \overline{W} \stackrel{?}{=} Com(W)\\
+    \overline{E} \stackrel{?}{=} Com(E)
+  \end{cases}
+  \end{align*}
+  }
+\end{frame}
+
+\begin{frame}{NIMFS}
+  issue: the RLC with $>2$ instances makes the cross-terms grow
+  \\ie. some vectors ($T$) would get bigger and their commitments ($\overline{T}$) more expensive
+
+  \pause
+  \vspace{0.5cm}
+
+  NIMFS in HyperNova, ProtoGalaxy, etc
+  \begin{itemize}
+    \item instead of 2 RLC between 2 instances
+    \begin{itemize}
+      \item HyperNova: run SumCheck
+      \item ProtoGalaxy: protocol using Lagrange Basis (instead of random values) for the linear combinations and then the zero-check protocol
+        \\alternatively using MLE and SumCheck
+    \end{itemize}
+  \end{itemize}
+  Allowing to fold $>2$ instances at each folding step.
+\end{frame}
+
+\begin{frame}
+  \includegraphics[height=\textheight]{multifolding-idea}
+\end{frame}
+
+\begin{frame}{HyperNova NIMFS}
+  {\tiny src: \href{https://eprint.iacr.org/2023/573.pdf}{https://eprint.iacr.org/2023/573.pdf} (HyperNova paper)}
+  \vspace{-0.5cm}
+  \includegraphics[width=8cm]{./imgs/hypernova-screenshot}
+\end{frame}
+
+\begin{frame}{ProtoGalaxy Folding}
+  {\tiny src: \href{https://eprint.iacr.org/2023/1106.pdf}{https://eprint.iacr.org/2023/1106.pdf} (ProtoGalaxy paper)}
+  \includegraphics[width=8cm]{./imgs/protogalaxy-screenshot}
+\end{frame}
+
+\section{IVC}
+
+\begin{frame}{(Recall) Folding scheme pipeline}
+  \includegraphics[width=\textwidth]{folding-scheme-pipeline}
+
+  \vspace{0.5cm}
+  {\scriptsize
+  The IVC folds the AugmentedFCircuit, which ensures that the NIFS.Verify checks out.
+  }
+\end{frame}
+
+% ANNOTATION:
+% Now, we have this protocol between Prover and Verifier to 'fold', 'combine' 2 instances into a new instance, which if satisfies the relation checks, it means that the 2 original ones were satisfying it too.
+% We're going to see now how do we convert this into
+
+\begin{frame}{IVC - Incrementally Verifiable Computation}
+  \begin{itemize}
+    \item need to ensure that at each fold (IVC step), the NIFS is correctly done
+    \item want to have a construction where we fold the circuit that itself contains the checks of the Folding Scheme (NIFS.Verify)
+    \item we encode the NIFS.Verify inside a circuit (\emph{AugmentedFCircuit}), together with other checks that ensure the correct relations
+    \item and is this \emph{AugmentedFCircuit} ($F'$) the one which we actually fold
+  \end{itemize}
+
+  % TODO rm:
+  % \includegraphics[width=\textwidth]{folding-main-idea-diagram}
+  % $$z_n = F(...~F(F(F(F(z_0, w_0), w_1), w_2), ...), w_{n-1})$$
+\end{frame}
+
+\begin{frame}{Folding circuit - AugmentedFCircuit}
+    wrapper over the circuit that we want to fold
+    \begin{itemize}
+      \item contains the circuit that we want to fold
+      \item plus extra checks ensuring that the fold is being done correctly\\
+      \begin{itemize}
+        \item some hashing and values checks
+        \item run the NIFS.Verify in-circuit
+        \begin{itemize}
+          \item Nova: RLC of $\mathbb{F}$ and $\mathbb{G}$ elements
+          \item HyperNova: RLC of $\mathbb{F}$ and $\mathbb{G}$ elements + SumCheck verifier
+          \item ProtoGalaxy: linear combinations of $\mathbb{F}$ and $\mathbb{G}$ elements with the Lagrange basis and some polynomial evaluations + ... (alternatively SumCheck)
+        \end{itemize}
+      \end{itemize}
+    \end{itemize}
+  
+
+\end{frame}
+
+\begin{frame}{Cycle of curves}
+  \scriptsize{
+    NIFS.V involves $\mathbb{G}$ point operation, which are not native over $\mathbb{F}_r$ of $\mathbb{G}$.
+  \\$\longrightarrow$ delegate them into a circuit over a 2nd curve 
+  We use:
+  \begin{itemize}
+    \item $\mathbb{G}_1.\mathbb{F}_r = \mathbb{G}_2.\mathbb{F}_q$
+    \item $\mathbb{G}_1.\mathbb{F}_q = \mathbb{G}_2.\mathbb{F}_r$
+    \item eg. for Ethereum compatibility:\\
+      $\mathbb{G}_1$: BN254, $\mathbb{G}_2$: Grumpkin.
+  \end{itemize}
+
+  We 'mirror' the main $F'$ circuit into the 2nd curve\\
+  each circuit computes natively the point operations of the other curve's circuit
+  }
+  \vspace{0.3cm}
+
+  \includegraphics[width=\textwidth]{nova-cycle-of-curves-mirror}
+\end{frame}
+
+\begin{frame}{Cycle of curves}
+  \scriptsize{
+    NIFS.V involves $\mathbb{G}$ point operation, which are not native over $\mathbb{F}_r$ of $\mathbb{G}$.
+  \\$\longrightarrow$ delegate them into a circuit over a 2nd curve 
+  We use:
+  \begin{itemize}
+    \item $\mathbb{G}_1.\mathbb{F}_r = \mathbb{G}_2.\mathbb{F}_q$
+    \item $\mathbb{G}_1.\mathbb{F}_q = \mathbb{G}_2.\mathbb{F}_r$
+    \item eg. for Ethereum compatibility:\\
+      $\mathbb{G}_1$: BN254, $\mathbb{G}_2$: Grumpkin.
+  \end{itemize}
+
+  We 'mirror' the main $F'$ circuit into the 2nd curve\\
+  each circuit computes natively the point operations of the other curve's circuit
+  }
+  \vspace{0.3cm}
+
+  \includegraphics[width=\textwidth]{nova-cycle-of-curves-cyclefold}
+\end{frame}
+
+% slide with only the image:
+{
+\usebackgroundtemplate{\includegraphics[width=\paperwidth]{cyclefold-nova-diagram}}
+\begin{frame}[plain]
+  \vskip0pt plus 1fill
+  {\tiny 
+    Nova's Folding Circuit (F') + CycleFold circuit
+
+    src: \href{https://privacy-scaling-explorations.github.io/sonobe-docs/design/novacyclefold-circuit.html}{https://privacy-scaling-explorations.github.io/sonobe-docs/design/novacyclefold-circuit.html}
+  }
+\end{frame}
+}
+% \begin{frame}{Augmented F Circuit + CycleFold Circuit}
+% \begin{frame}
+% \begin{tikzpicture}
+%   \node at (current page.center) {\includegraphics[width=\paperwidth, height=\paperheight]{cyclefold-nova-diagram}}
+% \end{tikzpicture}
+%   % \includegraphics[width=\textwidth]{cyclefold-nova-diagram}
+%   % {\tiny src: \href{https://privacy-scaling-explorations.github.io/sonobe-docs/design/novacyclefold-circuit.html}{https://privacy-scaling-explorations.github.io/sonobe-docs/design/novacyclefold-circuit.html}}
+%   % mention TODO folding overhead - num constraints of overhead, so for small circuits it is not worth
+%   % TODO explain: circuit overhead.
+% \end{frame}
+
+
+\section{Decider}
+
+\begin{frame}{(Recall) Folding scheme pipeline}
+  \includegraphics[width=\textwidth]{folding-scheme-pipeline}
+
+  \vspace{0.5cm}
+  {\scriptsize
+  The IVC folds the AugmentedFCircuit, which ensures that the NIFS.Verify checks out.
+  }
+\end{frame}
+
+
+\begin{frame}{Decider (Final compressed proof)}
+  \vspace{-0.5cm}
+  \includegraphics[width=\textwidth]{decider-instances}
+
+  {\scriptsize
+  Issue: IVC proof is not succinct.
+  \begin{itemize}
+    \item Committed Instances of the AugmentedFCircuit $U_n$, $u_n$, where each one is $\{ \overline{E} \in \mathbb{G}_1, \overline{W} \in \mathbb{G}_1, u \in \mathbb{F}_r, x \in \mathbb{F}_r^{|io|} \}$
+    \item and their respective Witnesses $W_n, w_n$, each one being $\{E \in \mathbb{F}_r^n, W \in \mathbb{F}_r^n \}$
+    \item Committed instance of the CycleFold circuit $U_{EC,n}$ contains: $\{ \overline{E} \in \mathbb{G}_2, \overline{W} \in \mathbb{G}_2, u \in \mathbb{F}_q, x \in \mathbb{F}_q^{|io|} \}$
+    \item and its Witnesses $W_{EC,n}$, being $\{E \in \mathbb{F}_r^n, W \in \mathbb{F}_r^n \}$
+  \end{itemize}
+  So the idea is to 'compress' the IVC proof into a zkSNARK proof, minimizing the size and the verifier computation.
+  }
+
+\end{frame}
+
+% TODO rm
+% \begin{frame}{Decider}
+%   Original Nova: generate a zkSNARK proof with Spartan for $U_n, u_n, U_{EC, n}$\\
+%   $\longrightarrow$ 2 Spartan proofs, one on each curve\\
+%   (not EVM-friendly)
+% 
+%   \vspace{0.5cm}
+% 
+%   We need to do a bit of gymnastics to verify the folding proofs in Ethereum
+% 
+%   % TODO
+%   % DRAW of the 2 circuits over the curves, and how we generate a Spartan proof for each one
+% \end{frame}
+
+\begin{frame}{Decider checks}
+  \begin{enumerate}
+    \item[1.] check $NIFS.V(r, U_n, u_n, \overline{T}) \stackrel{?}{=} U_{n+1}$
+    \item[2.] check that $u_n.\overline{E}=0$ and $u_n.u=1$
+    \item[3.] check that $u_n.x_0 = H(n, z_0, z_n, U_n)$ and $u_n.x_1 = H(U_{EC,n})$
+    \item[4.] correct RelaxedR1CS relation of $U_{n+1}, W_{n+1}$ of the AugmentedFCircuit
+    \item[5.] check commitments of $U_{n+1}.\{ \overline{E}, \overline{W} \}$ with respect $W_{n+1}$ (where $\overline{E}, \overline{W} \in E_1$)
+    \item[6.] check the correct RelaxedR1CS relation of $U_{EC,n}, W_{EC,n}$ of the CycleFoldCircuit
+    \item[7.] check commitments of $U_{EC,n}.\{ \overline{E}, \overline{W} \}$ with respect $W_{EC,n}$ (where $\overline{E},\overline{W} \in E_2$)
+  \end{enumerate}
+\end{frame}
+
+\begin{frame}{Decider checks}
+  \begin{enumerate}
+    \item[1.] check $NIFS.V(r, U_n, u_n, \overline{T}) \stackrel{?}{=} U_{n+1}$
+    \item[2.] check that $u_n.\overline{E}=0$ and $u_n.u=1$
+    \item[3.] check that $u_n.x_0 = H(n, z_0, z_n, U_n)$ and $u_n.x_1 = H(U_{EC,n})$
+    \item[4.] correct RelaxedR1CS relation of $U_{n+1}, W_{n+1}$ of the AugmentedFCircuit
+    \item[5.] check commitments of $U_{n+1}.\{ \overline{E}, \overline{W} \}$ with respect $W_{n+1}$ (where $\overline{E}, \overline{W} \in E_1$) \textcolor{cyan}{non-native!}
+    \item[6.] check the correct RelaxedR1CS relation of $U_{EC,n}, W_{EC,n}$ of the CycleFoldCircuit \textcolor{cyan}{non-native!}
+    \item[7.] check commitments of $U_{EC,n}.\{ \overline{E}, \overline{W} \}$ with respect $W_{EC,n}$ (where $\overline{E},\overline{W} \in E_2$)
+  \end{enumerate}
+\end{frame}
+
+\begin{frame}{Original Nova Decider}
+  \begin{itemize}
+    \item Original Nova: wrap these checks in 2 Spartan (zkSNARK) proofs (one over each curve of the cycle of curves).\\
+      $\longrightarrow$ 2 Spartan proofs, one on each curve\\
+    \item In our case we were interested into verifying the proofs in Ethereum's EVM.
+  \end{itemize}
+
+  Need to do a bit of gymnastics to verify the folding proofs in Ethereum,\\
+  EVM limitations:
+  \begin{itemize}
+    \item limited to BN254 curve
+    \item constrained by gas costs
+  \end{itemize}
+\end{frame}
+
+\begin{frame}{Onchain Decider}
+{\tiny
+  \begin{enumerate}
+    \item[1.1:] check that the given NIFS challenge $r$ is indeed well computed.
+      \\This challenge is then used outside the circuit by the Verifier to compute NIFS.V obtaining $U_{i+1}$
+    \item[2:] check that $u_n.\overline{E}=0$ and $u_n.u=1$
+    \item[3:] check that $u_n.x_0 = H(n, z_0, z_n, U_n)$ and $u_n.x_1 = H(U_{EC,n})$
+    \item[4:] correct RelaxedR1CS relation of $U_{n+1}, W_{n+1}$ of the AugmentedFCircuit
+    \item[5.1:] Check correct computation of the KZG challenges
+      \\$c_E = H(\overline{E}.\{x,y\}),~~c_W = H(\overline{W}.\{x,y\})$
+      \\which we do through in-circuit Transcript.
+    \item[5.2:] check that the KZG evaluations are correct, $eval_W == p_W(c_W),~~ eval_E == p_E(c_E)$
+      \\where $p_W, p_E \in \mathbb{F}[X]$ are the interpolated polynomials from $W_{i+1}.W,~ W_{i+1}.E$ respectively.
+    \item[6:] check the correct RelaxedR1CS relation of $U_{EC,n}, W_{EC,n}$ of the CycleFoldCircuit
+      \\(this is non-native operations and with naive sparse matrix-vector product blows up the number of constraints)
+    \item[7:] Pedersen commitments verification of $U_{EC,n}.\{ \overline{E}, \overline{W} \}$ with respect $W_{EC,n}$
+      \\(the witness of the committed instance)
+  \\(where $\overline{E},\overline{W} \in E_2$, this check is native in $F_r$)
+  \end{enumerate}
+
+  \emph{The following check is done non-natively (in $F_r$):}
+  Additionally we would have to check (outside of the circuit):
+
+  \begin{enumerate}
+    \item[1.2:] check $NIFS.V(r, U_n, u_n, \overline{T}) \stackrel{?}{=} U_{n+1}$
+    \item[5.3:] Commitments verification of $U_{n+1}.\{ \overline{E}, \overline{W} \}$ with respect $W_{n+1}$ (where $\overline{E}, \overline{W} \in E_1$)
+  \end{enumerate}
+
+  {\tiny More details in Sonobe's docs: \href{https://privacy-scaling-explorations.github.io/sonobe-docs/design/novacyclefold-circuit.html}{https://privacy-scaling-explorations.github.io/sonobe-docs/design/novacyclefold-circuit.html}}
+}
+\end{frame}
+
+\begin{frame}{Onchain Decider}
+  % DRAW of the full flow: from inputting the circuit, to folding to generating the Decider proof to verifying in Ethereum
+  \includegraphics[width=8cm]{folding-scheme-pipeline-without-augmentedfcircuit}
+  \pause
+  \includegraphics[width=\textwidth]{decider-onchain-flow-diagram}
+\end{frame}
+
+
+% TODO maybe remove
+% \begin{frame}{Offchain Decider}
+%   {\tiny
+%     \textbf{Circuit1} $\in \mathbb{F}_r$ ($E_1.\mathbb{F}_r$):
+%   \begin{enumerate}
+%     \item[1.1:] check that the given NIFS challenge $r$ is indeed well computed.
+%       \\This challenge is then used outside the circuit by the Verifier to compute NIFS.V obtaining $U_{i+1}$
+%     \item[2:] check that $u_n.\overline{E}=0$ and $u_n.u=1$
+%     \item[3:] check that $u_n.x_0 = H(n, z_0, z_n, U_n)$ and $u_n.x_1 = H(U_{EC,n})$
+%     \item[4:] correct RelaxedR1CS relation of $U_{n+1}, W_{n+1}$ of the AugmentedFCircuit
+%     \item[5.1:] Check correct computation of the CommitmentScheme challenges for $U_{n+1}$
+%       \\$$c_E = H(U_{n+1}.\overline{E}.\{x,y\}),~~c_W = H(U_{n+1}.\overline{W}.\{x,y\})$$
+%       \\which we do through in-circuit Transcript.
+%     \item[5.2:] check that the CommitmentScheme evaluations for $U_{n+1}$ are correct, $eval_W == p_W(c_W),~~~ eval_E == p_E(c_E)$
+%       \\where $p_W, p_E \in \mathbb{F}[X]$ are the interpolated polynomials from $W_{i+1}.W,~ W_{i+1}.E$ respectively.
+%   \end{enumerate}
+% 
+%   \textbf{Circuit2} $\in \mathbb{F}_q$ ($E_2.\mathbb{F}_r$):
+%   \begin{enumerate}
+%     \item[6:] correct RelaxedR1CS relation of $U_{EC,d}, W_{EC,d}$
+%     \item[7.1:] Check correct computation of the CommitmentScheme challenges for $U_{EC}$
+%       \\$$c_E = H(U_{EC}.\overline{E}.\{x,y\}),~~c_W = H(U_{EC}.\overline{W}.\{x,y\})$$
+%       \\which we do through in-circuit Transcript.
+%     \item[7.2:] check that the CommitmentScheme evaluations for $U_{EC}$ are correct
+%       - $eval_W == p_W(c_W)$
+%       - $eval_E == p_E(c_E)$
+%       \\where $p_W, p_E \in \mathbb{F}[X]$ are the interpolated polynomials from $W_{i+1}.W,~ W_{i+1}.E$ respectively.
+%   \end{enumerate}
+% 
+%   \textbf{Outside the circuits}:
+%   \begin{enumerate}
+%     \item[1.2:] check $NIFS.V(r, U_d, u_d, \overline{T}) \stackrel{?}{=} U_{d+1}$
+%     \item[5.3:] Commitments verification of $U_{d+1}.\{ \overline{E}, \overline{W} \}$
+%       \\with respect $W_{d+1}$ (where $\overline{E}, \overline{W} \in E_1$)
+%     \item[7.3:] Commitments verification of $U_{EC,d}.\{ \overline{E}, \overline{W} \}$
+%       \\with respect $W_{EC,d}$ 
+%     \\(where $\overline{E},\overline{W} \in E_2$)
+%   \end{enumerate}
+% }
+% TODO fix that currently it does not fit in the slide
+
+\end{frame}
+
+
+\section{Sonobe}
+
+\begin{frame}{Sonobe}
+
+  \footnotesize{
+  Experimental folding schemes library implemented jointly by 0xPARC and PSE.\\
+  \href{https://github.com/privacy-scaling-explorations/sonobe}{https://github.com/privacy-scaling-explorations/sonobe}
+  \\Modular library,
+  \begin{itemize}
+    \item Be able to
+    \begin{itemize}
+      \item Add and test new folding schemes
+      \item Compare schemes 'apples-to-apples'
+      \item Researchers can easily add their own schemes (eg. Mova paper)
+    \end{itemize}
+    \item Make it easy for devs to use folding
+    \begin{itemize}
+      \item minimal code to fold your circuits ('plug-and-fold')
+      \item easy to switch between folding schemes and curves
+      \item support of multiple zk-circuit languages
+    \end{itemize}
+  \end{itemize}
+
+  \vspace{0.5cm}
+  \emph{Remark}: experimental and unoptimized.
+  }
+\end{frame}
+
+\begin{frame}{Sonobe - Dev experience}
+  \scriptsize{
+
+  Dev flow:
+  \begin{enumerate}
+    \item Define a circuit to be folded
+    \item Set which folding scheme to be used (eg. Nova with CycleFold)
+    \item Set a final decider to generate the final proof (eg. Groth16 over BN254 curve)
+    \item Generate the Solidity decider verifier (EVM Solidity contract)
+  \end{enumerate}
+  }
+
+  \includegraphics[width=\textwidth]{folding-scheme-pipeline-without-augmentedfcircuit}
+  Sonobe lib pipeline:
+  \includegraphics[width=\textwidth]{sonobe-lib-pipeline}
+\end{frame}
+
+
+\begin{frame}{Status of Sonobe - schemes implemented}
+  \scriptsize{
+  Implemented (fully implemented):
+  \begin{itemize}
+    \item \textbf{Nova}: Recursive Zero-Knowledge Arguments from Folding Schemes\\ \href{https://eprint.iacr.org/2021/370.pdf}{https://eprint.iacr.org/2021/370.pdf}, Abhiram Kothapalli, Srinath Setty, Ioanna Tzialla. 2021
+    \item \textbf{CycleFold}: Folding-scheme-based recursive arguments over a cycle of elliptic curves\\ \href{https://eprint.iacr.org/2023/1192.pdf}{https://eprint.iacr.org/2023/1192.pdf}, Abhiram Kothapalli, Srinath Setty. 2023
+    \item \textbf{HyperNova}: Recursive arguments for customizable constraint systems\\ \href{https://eprint.iacr.org/2023/573.pdf}{https://eprint.iacr.org/2023/573.pdf}, Abhiram Kothapalli, Srinath Setty. 2023
+    \item \textbf{ProtoGalaxy}: Efficient ProtoStar-style folding of multiple instances\\ \href{https://eprint.iacr.org/2023/1106.pdf}{https://eprint.iacr.org/2023/1106.pdf}, Liam Eagen, Ariel Gabizon. 2023
+  \end{itemize}
+  {\tiny
+    Started (NIFS implemented, next: folding circuit, IVC, Decider, etc):
+    \begin{itemize}
+     \item \textbf{Mova}: Nova folding without committing to error terms\\ \href{https://eprint.iacr.org/2024/1220.pdf}{https://eprint.iacr.org/2024/1220.pdf}, Nikolaos Dimitriou, Albert Garreta, Ignacio Manzur, Ilia Vlasov. 2024
+     \item \textbf{Ova}: Reduce the accumulation verifier in Nova from 2 to just 1 group operation\\ \href{https://eprint.iacr.org/2024/1220.pdf}{https://eprint.iacr.org/2024/1220.pdf}, Benedikt Bünz. 2024
+    \end{itemize}
+  }
+
+  Frontends - how can the dev define a circuit to be folded
+  \begin{itemize}
+    \item Arkworks \href{https://github.com/arkworks-rs}{https://github.com/arkworks-rs}
+    \item experimental: Circom, Noir, Noname.
+  % Frontends - how can the dev define a circuit to be folded
+  % \begin{itemize}
+  %   \item Arkworks \href{https://github.com/arkworks-rs/}{https://github.com/arkworks-rs/}
+  %   \item experimental:
+  %   \begin{itemize}
+  %     \item Circom \href{https://github.com/iden3/circom}{https://github.com/iden3/circom}
+  %     \item Noir \href{https://noir-lang.org/}{https://noir-lang.org/}
+  %     \item Noname \href{https://github.com/zksecurity/noname}{https://github.com/zksecurity/noname}
+  %   \end{itemize}
+  \end{itemize}
+
+  }
+\end{frame}
+
+\begin{frame}{Modularity}
+  % TODO
+  Big thanks to arkworks \href{https://github.com/arkworks-rs}{https://github.com/arkworks-rs}
+
+  \vspace{1cm}
+  [Code example in the code editor]
+
+\end{frame}
+
+\begin{frame}{Some numbers}
+  \footnotesize{
+  (code highly unoptimized)
+  \begin{itemize}
+    \item folding step $\sim 300 ms$
+      \begin{itemize}
+      \item Folding circuit (Nova+CycleFold): $\sim 50k$ R1CS constraints (overhead)
+      \end{itemize}
+    \item Offchain Decider prove: $< 1$ min
+    \item Onchain Decider Verification:
+    \begin{itemize}
+      \item DeciderEthCircuit: $\sim 10M$ R1CS constraints
+      \begin{itemize}
+        \item $<3$ minutes in a 32GB RAM 16 core laptop
+      \end{itemize}
+      \item gas costs (DeciderEthCircuit proof): $\sim 800k$ gas
+      \begin{itemize}
+        \item mostly from G16, KZG10, public inputs processing
+        \item can be reduced by hashing the public inputs \& batching the pairings check
+        \item expect to get it down to $< 500k$ gas.
+      \end{itemize}
+    \end{itemize}
+  \end{itemize}
+  }
+
+  \vspace{0.6cm}
+
+  Recall, this proof is proving that applying $n$ times the function $F$ (the circuit that we're folding) to an initial state $z_0$ results in the state $z_n$.
+\end{frame}
+
+\begin{frame}{Wrappup}
+  \small{
+  \begin{itemize}
+    \item repo: \href{https://github.com/privacy-scaling-explorations/sonobe}{https://github.com/privacy-scaling-explorations/sonobe}
+    \item docs: \href{https://privacy-scaling-explorations.github.io/sonobe-docs/}{https://privacy-scaling-explorations.github.io/sonobe-docs/}
+  \end{itemize}
+  }
+
+  \begin{center}
+    \includegraphics[width=5cm]{./imgs/sonobe-link-qrcode}
+  \end{center}
+
+\tiny{
+  $$\text{2024-10-08}$$
+  $$\text{\href{https://0xparc.org}{0xPARC}~\&~\href{https://pse.dev/}{PSE.}}$$
+}
+\end{frame}
+
+% \begin{frame}{NEWFRAME}
+% \end{frame}
+% 
+% \begin{frame}{NEWFRAME}
+% \end{frame}
+
+\end{document}

@@ -1,420 +0,0 @@
-\documentclass{beamer}
-\usefonttheme[onlymath]{serif}
-
-\mode<presentation>
-{
-  \usetheme{Frankfurt}
-  \usecolortheme{dove}  %% grey scale
-  \useinnertheme{circles}
-  % \setbeamercovered{transparent}
-}
-
-\hypersetup{
-    colorlinks,
-    citecolor=black,
-    filecolor=black,
-    linkcolor=black,
-    urlcolor=blue
-}
-\usepackage{graphicx}
-\usepackage{listings} % embed code
-
-\setbeamertemplate{itemize}{$\circ$}
-\setbeamertemplate{itemize items}{$\circ$}
-
-\beamertemplatenavigationsymbolsempty %% no navigation bar
-
-\setbeamertemplate{footline}{\hspace*{.1cm}\scriptsize{
-\hspace*{50pt} \hfill\insertframenumber/\inserttotalframenumber\hspace*{.1cm}\vspace*{.1cm}}}
-
-\setbeamertemplate{caption}[numbered]
-\setbeamerfont{caption}{size=\tiny}
-
-
-
-
-\title{HyperNova introduction}
-\author{}
-\date{\scriptsize{2023-07-25\\\href{https://0xparc.org}{0xPARC}, London}}
-
-\begin{document}
-
-\frame{\titlepage}
-
-
-% NOTE: This talk provides an overview, if people is interested we can do another session going more into the technical details of the schemes.
-
-
-\section[Preliminaries]{Preliminaries}
-
-\begin{frame}{IVC}
-
-For a function $F$, with initial input $z_0$, an IVC scheme allows a prover to produce a proof $\pi_i$ for the statement $z_i = F^{(i)}(z_0)$, given a proof $\pi_{i-1}$ for the statement $z_{i-1} = F^{(i-1)}(z_0)$
-
-TODO add draw
-TODO add reference to Valiant paper (2008)
-
-\end{frame}
-
-\begin{frame}{Recursion before folding schemes}
-We used to use recursive SNARKs to achieve IVC.
-
-  \begin{itemize}
-    \item Prove verification in circuit: inside a circuit, verify another proof
-    \begin{itemize}
-      \item eg. verifying a Groth16 proof inside a Groth16 circuit.
-    \end{itemize}
-    \item Amortized accumulation
-    \begin{itemize}
-      \item eg. Halo
-    \end{itemize}
-  \end{itemize}
-\end{frame}
-
-\begin{frame}{R1CS refresher}
-
-  R1CS instance: $(\{A, B, C\} \in \mathbb{F}^{m \times n},~ io,~ m,~ n,~ l)$, such that for $z=(io \in \mathbb{F}^l, 1, w \in \mathbb{F}^{m-l-1}) \in \mathbb{F}^m$,
-
-$$Az \circ Bz = Cz$$
-
-Typically we use some scheme to prove that the previous equation is fulfilled by some private $w$ (eg. Groth16, Marlin, Spartan, etc).
-
-\end{frame}
-
-% \begin{frame}{R1CS refresher}
-% TODO add A, B, C example from Vitalik article
-% \end{frame}
-
-\begin{frame}{Random linear combination}
-
-Combine 2 instances together through a random linear comibnation, and the outputted instance will still satisfy the relation.
-
-\begin{itemize}
-  \item Have 2 values $x_1, x_2$.
-  \item Set $r \in^R \mathbb{F}$
-  \item Compute $x_3 = x_1 + r \cdot x_2$.
-\end{itemize}
-
-\pause
-
-Combined with homomorphic commitments
-\begin{itemize}
-  \item We can do random linear combinations with the commitments and their witnesses, and the output can still be opened
-\end{itemize}
-
-% TODO check on internet if there is some more standard definition / examples.
-
-\end{frame}
-
-
-\section[Nova]{Nova}
-
-\begin{frame}{Folding schemes}
-We're not verifying the entire proof
-\begin{itemize}
-   \item Take n instances and 'batch' them together
-  \begin{itemize}
-    \item Folds $k$ (eg. 2) instances (eg. R1CS instances) and their respective witnesses into a single one
-  \end{itemize}
-   \item At the end of the chain of folds, we just prove that the last fold is correct through a SNARK
-  \begin{itemize}
-     \item Which implies that all the previous folds were correct
-  \end{itemize}
-\end{itemize}
-
-\pause
-
-In Nova: folding without a SNARK, we just reduce the satisfiability of the 2 inputted instances to the satisfiability of the single outputted one.
-
-[TODO image of multiple folding iterations]
-
-\end{frame}
-
-
-\begin{frame}{Relaxed R1CS}
-  We work with \emph{relaxed R1CS}
-
-$$Az \circ Bz = u \cdot Cz + E$$
-
-\begin{scriptsize} % TODO use the other simpler font syntax
-(= R1CS when $u=1,~ E=0$)
-\end{scriptsize}
-
-\begin{itemize}
-  \item main idea: allows us to fold, but accumulates \emph{cross terms}
-    \pause
-  \item when we do the \emph{relaxed} of higher degree equations (eg. plonkish), the cross terms grow (eg. Sangria with higher degree gates)
-\end{itemize}
-
-\end{frame}
-
-\begin{frame}{NIFS - setup}
-V and P: \emph{committed relaxed R1CS} instances
-\begin{align*}
-	\varphi_1&=(\overline{E}_1, u_1, \overline{w}_1, x_1)\\
-	\varphi_2&=(\overline{E}_2, u_2, \overline{w}_2, x_2)
-\end{align*}
-
-P: witnesses
-\begin{align*}
-	(E_1, r_{E_1}, w_1, r_{w_1})\\
-	(E_2, r_{E_2}, w_2, r_{w_2})
-\end{align*}
-
-Let $z_1 = (w_1, x_1, u_1)$ and $z_2 = (w_2, x_2, u_2)$.
-
-\end{frame}
-
-\begin{frame}{NIFS}
-\begin{footnotesize}
-% While Prover works with $w, E$, Verifier works with commitments to them (\emph{Committed Relaxed R1CS}).\\
-% To keep the relations working with the random linear combinations, we use homomorphic commitments.
-
-\begin{itemize}
-      \item V, P: folded instance $\varphi = (\overline{E}, u, \overline{w}, x)$
-	      \begin{align*}
-		      &\overline{E}=\overline{E}_1 + r \overline{T} + r^2 \overline{E}_2\\
-		      &u = u_1 + r u_2\\
-		      &\overline{w} = \overline{w}_1 + r \overline{w}_2\\
-		      &x = x_1 + r x_2
-	      \end{align*}
-      \item P: folded witness $(E, r_E, w, r_W)$
-	      \begin{align*}
-		      &E = E_1 + r T + r^2 E_2\\
-		      &r_E = r_{E_1} + r \cdot r_T + r^2 r_{E_2}\\
-		      &w=w_1 + r w_2\\
-		      &r_W = r_{w_1} + r \cdot r_{w_2}
-	      \end{align*}
-\end{itemize}
-\end{footnotesize}
-\pause
-\begin{scriptsize}
-Note: $T$ are the cross-terms coming from combining the two R1CS instances from
-\begin{align*}
-  Az \circ Bz &=A(z_1 + r \cdot z_2) \circ B(z_1 + r z_2)\\
-	      &=A z_1 \circ B z_1 + r(A z_1 \circ B z_2 + A z_2 \circ B z_1) + r^2 (A z_2 \circ B z_2) = \ldots
-\end{align*}
-\end{scriptsize}
-
-\end{frame}
-
-\begin{frame}{NIFS}
-
-\begin{small}
-$$E=E_1 + r \underbrace{ (A z_1 \circ B z_2 + A z_2 \circ B z_1 - u_1 C z_2 - u_2 C z_1) }_\text{cross-terms} + r^2 E_2$$
-\end{small}
-
-$Az \circ Bz = uCz + E$ will hold for valid $z$ (which comes from valid $z_1,~ z_2$).
-
-[TODO add image of function F' with F inside with extra checks]
-
-\end{frame}
-
-
-
-\begin{frame}{NIFS}
-
-Each fold: $2~EC_{Add} + 1~EC_{Mul} + 1~hash$
-
-20k R1CS constraints (using curve cycles)
-
-{\footnotesize
-(so folding makes sense when we have a circuit with more than $2 \cdot 20k$ constraints)
-}
-
-\pause
-After all the folding iterations, Nova generates a SNARK proving the last folding instance.
-
-In Nova implementation, they use Spartan.
-\end{frame}
-
-\begin{frame}{Benchmarks}
-
-% TODO: review names, and add links to profiles.
-Benchmarks that Oskar, Carlos, et al did during the Vietnam residency in April
-\href{https://hackmd.io/u3qM9s_YR1emHZSg3jteQA?view}{https://hackmd.io/u3qM9s\_YR1emHZSg3jteQA}
-
-\begin{center}
-\begin{tabular}{ |c|c|c| } 
- \hline
- Size & Constraints & Time\\
- \hline
- 2KB  &   883k      & 320ms\\
- 4KB  &   1.7m      & 521ms\\
- 8KB  &   3.4m      &    1s\\
- 16KB &   6.8m      &  1.9s\\
- 32KB & 13.7m       & 4.1s \\
- \hline
-\end{tabular}\\
-{\footnotesize eg. for 8kb, x100 Halo2 and Plonky2}
-\end{center}
-
-(this is for the folding, without the last snark)
-
-\end{frame}
-
-\begin{frame}{SuperNova}
-\begin{itemize}
-  \item iteration on Nova, combining \emph{different circuits} in a single one with \emph{selectors}
-  \item so we can work with a big circuit with \emph{subcircuits} without paying the whole size cost on each iteration
-  \item in IVC terms: fold multiple $F_i$ in a single $F'$ (in Nova was a single $F$ in $F'$)
-\end{itemize}
-
-This is useful for example for a VM, doing one $F_i$ for each opcode
-
-\end{frame}
-
-\section[HyperNova]{HyperNova}
-
-% \begin{frame}{CCS}
-% \begin{itemize}
-%   \item kind of a generalization of constraint systems
-%   \item can translate R1CS,Plonk,AIR to CCS
-% \end{itemize}
-% $$\sum_{i=0}^{q-1} c_i \cdot \bigcirc_{j \in S_i} M_j \cdot z ==0$$
-% \end{frame}
-
-\begin{frame}{R1CS to CCS example}
-
-\begin{scriptsize}
-\begin{itemize}
-  \item Kind of a generalization of constraint systems
-  \item Can translate R1CS,Plonk,AIR to CCS
-\end{itemize}
-\pause
-\begin{description}
-	\item[CCS instance] $S_{CCS} = (m, n, N, l, t, q, d, M, S, c)$\\
-		where we have the same parameters than in $S_{R1CS}$, but additionally:\\
-		$t=|M|$, $q = |c| = |S|$, $d$= max degree in each variable.
-	\item[R1CS-to-CCS parameters] $n=n,~ m=m,~ N=N,~ l=l,~ t=3,~ q=2,~ d=2$, $M=\{A,B,C\}$, $S=\{\{0,~1\},~ \{2\}\}$, $c=\{1,-1\}$
-\end{description}
-\pause
-
-The CCS relation check:
-\end{scriptsize}
-
-$$\sum_{i=0}^{q-1} c_i \cdot \bigcirc_{j \in S_i} M_j \cdot z ==0$$
-
-\begin{scriptsize}
-In our R1CS-to-CCS parameters is equivalent to
-\begin{align*}
-	&c_0 \cdot ( (M_0 z) \circ (M_1 z) ) + c_1 \cdot (M_2 z) ==0\\
-	\Longrightarrow &1 \cdot ( (A z) \circ (B z) ) + (-1) \cdot (C z) ==0\\
-	\Longrightarrow &( (A z) \circ (B z) ) - (C z) ==0
-\end{align*}
-\end{scriptsize}
-
-\end{frame}
-
-
-\begin{frame}{Multifolding}
-\begin{itemize}
-  \item Nova: 2-to-1 folding
-  \item HyperNova: multifolding, k-to-1 folding
-  \item We fold while through a SumCheck proving the correctness of the fold
-\end{itemize}
-
-SumCheck's polynomial work is trivial, most of the cost comes from Poseidon hash in the transcript
-
-[TODO WIP section]
-
-\end{frame}
-
-\begin{frame}{Multifolding - Overview}
-
-  \begin{tiny}
-  \begin{enumerate}
-    \item[1.] $V \rightarrow P: \gamma \in^R \mathbb{F},~ \beta \in^R \mathbb{F}^s$
-    \item[2.] $V: r_x' \in^R \mathbb{F}^s$
-    \item[3.] $V \leftrightarrow P$: sum-check protocol:
-		  $c \leftarrow \langle P, V(r_x') \rangle (g, s, d+1, \underbrace{\sum_{j \in [t]} \gamma^j \cdot v_j}_\text{T})$, where:
-		  \begin{align*}
-			  g(x) &:= \underbrace{\left( \sum_{j \in [t]} \gamma^j \cdot L_j(x) \right)}_\text{LCCCS check} + \underbrace{\gamma^{t+1} \cdot Q(x)}_\text{CCCS check}\\
-			  L_j(x) &:= \widetilde{eq}(r_x, x) \cdot \left(
-				  \underbrace{\sum_{y \in \{0,1\}^{s'}} \widetilde{M}_j(x, y) \cdot \widetilde{z}_1(y)}_\text{LCCCS check}
-			  \right)\\
-				  Q(x) := &\widetilde{eq}(\beta, x) \cdot \left(
-				  \underbrace{ \sum_{i=1}^q c_i \cdot \prod_{j \in S_i} \left( \sum_{y \in \{0, 1\}^{s'}} \widetilde{M}_j(x, y) \cdot \widetilde{z}_2(y) \right) }_\text{CCCS check}
-			  \right)
-		  \end{align*}
-  \end{enumerate}
-  \end{tiny}
-
-\end{frame}
-
-\begin{frame}{Multifolding - Overview}
-
-  \begin{tiny}
-  \begin{enumerate}
-    \item[4.] $P \rightarrow V$: $\left( (\sigma_1, \ldots, \sigma_t), (\theta_1, \ldots, \theta_t) \right)$, where $\forall j \in [t]$,
-		$$\sigma_j = \sum_{y \in \{0,1\}^{s'}} \widetilde{M}_j(r_x', y) \cdot \widetilde{z}_1(y)$$
-		$$\theta_j = \sum_{y \in \{0, 1\}^{s'}} \widetilde{M}_j(r_x', y) \cdot \widetilde{z}_2(y)$$
-	      \item[5.] V: $e_1 \leftarrow \widetilde{eq}(r_x, r_x')$, $e_2 \leftarrow \widetilde{eq}(\beta, r_x')$\\
-		check:
-		$$c = \left(\sum_{j \in [t]} \gamma^j \cdot e_1 \cdot \sigma_j \right) + \gamma^{t+1} \cdot e_2 \cdot \left( \sum_{i=1}^q c_i \cdot \prod_{j \in S_i} \theta_j \right)$$
-	      \item[6.] $V \rightarrow P: \rho \in^R \mathbb{F}$
-	      \item[7.] $V, P$: output the folded LCCCS instance $(C', u', \mathsf{x}', r_x', v_1', \ldots, v_t')$, where $\forall i \in [t]$:
-		\begin{align*}
-			C' &\leftarrow C_1 + \rho \cdot C_2\\
-			u' &\leftarrow u + \rho \cdot 1\\
-			\mathsf{x}' &\leftarrow \mathsf{x}_1 + \rho \cdot \mathsf{x}_2\\
-			v_i' &\leftarrow \sigma_i + \rho \cdot \theta_i
-		\end{align*}
-	      \item[8.] $P$: output folded witness and the folded $r_w'$:
-		\begin{align*}
-			\widetilde{w}' &\leftarrow \widetilde{w}_1 + \rho \cdot \widetilde{w}_2\\
-			r_w' &\leftarrow r_{w_1} + \rho \cdot r_{w_2}
-		\end{align*}
-  \end{enumerate}
-  \end{tiny}
-
-\end{frame}
-
-\section[Wrappup]{Wrappup}
-
-\begin{frame}{Mysteries \& unsolved things}
-\begin{itemize}
-  \item how HyperNova compares to Protostar
-  \item prover knows the full witness [TODO update/rm this]
-\end{itemize}
-
-[TODO WIP section]
-\end{frame}
-
-
-\begin{frame}
-\frametitle{Wrappup}
-\begin{itemize}
-  \item HyperNova: \href{https://eprint.iacr.org/2023/573}{https://eprint.iacr.org/2023/573}
-  \item multifolding PoC on arkworks: \href{https://github.com/privacy-scaling-explorations/multifolding-poc}{github.com/privacy-scaling-explorations/multifolding-poc}
-  \item PSE hypernova WIP \href{https://github.com/privacy-scaling-explorations/Nova}{github.com/privacy-scaling-explorations/Nova}
-\end{itemize}
-
-\vspace{2cm}
-\tiny{
-  $$\text{2023-07-25}$$
-  $$\text{\href{https://0xparc.org}{0xPARC}}$$
-}
-\end{frame}
-
-
-% from Michael
-% - Why Nova?
-% - Nova's limitations
-% - Why Hypernova
-% - Hypernova concepts explained to General Technologist (minimal ZK understanding)
-% - Final output
-
-
-
-%%%%%
-% - We used recursive SNARKs to achieve IVC
-%   - get a proof and prove that it's verification passes, inside another proof
-% - Folding: we're not verifying the entire proof
-%   - we take n proofs and 'batch' them together
-%   - at the end of the chain of folds, we just prove that the last fold is correct
-%     - which implies that all the previous folds were correct
-% - Random Linear Combination: combine 2 instances together through a random linear comibnation, and the outputted instance will still satisfy the relation
-% - Multifolding SumCheck: SumCheck's polynomial work is trivial, most of the cost comes from Poseidon hash in the transcript
-
-\end{document}