HyperNova folding prover. Folds circuit instances into accumulators, deferring PCS verification. More...

#include <hypernova_prover.hpp>

Public Types
using	Flavor = MegaFlavor

using	FF = Flavor::FF

using	Commitment = Flavor::Commitment

using	ProverInstance = ProverInstance_< Flavor >

using	Accumulator = MultilinearBatchingProverClaim

using	VerificationKey = Flavor::VerificationKey

using	VerifierCommitments = Flavor::VerifierCommitments

using	MegaOinkProver = OinkProver< Flavor >

using	MegaSumcheckProver = SumcheckProver< Flavor >

using	MegaSumcheckOutput = SumcheckOutput< Flavor >

using	Transcript = Flavor::Transcript

Public Member Functions
	HypernovaFoldingProver (std::shared_ptr< Transcript > transcript)

Accumulator	instance_to_accumulator (const std::shared_ptr< ProverInstance > &instance, const std::shared_ptr< VerificationKey > &honk_vk=nullptr)
	Turn an instance into an accumulator by running Sumcheck.

std::pair< HonkProof, Accumulator >	fold (Accumulator &&accumulator, const std::shared_ptr< ProverInstance > &instance, const std::shared_ptr< VerificationKey > &honk_vk=nullptr)
	Fold an instance into an accumulator.

HonkProof	export_proof ()
	Export the proof contained in the transcript.

Static Public Attributes
static constexpr size_t	NUM_UNSHIFTED_ENTITIES = MegaFlavor::NUM_UNSHIFTED_ENTITIES

static constexpr size_t	NUM_SHIFTED_ENTITIES = MegaFlavor::NUM_SHIFTED_ENTITIES

Private Member Functions
Accumulator	sumcheck_output_to_accumulator (MegaSumcheckOutput &sumcheck_output, const std::shared_ptr< ProverInstance > &instance, const std::shared_ptr< VerificationKey > &honk_vk)
	Convert the output of the sumcheck run on the incoming instance into an accumulator.

std::pair< std::vector< FF >, std::vector< FF > >	get_batching_challenges ()
	Generate the challenges required to batch the incoming instance with the accumulator.

template<size_t N>
Commitment	batch_mul (const RefArray< Commitment, N > &_points, const std::vector< FF > &scalars)
	Utility to perform batch mul of commitments.

Static Private Member Functions
template<size_t N>
static Polynomial< FF >	batch_polynomials (RefArray< Polynomial< FF >, N > polynomials_to_batch, const size_t &full_batched_size, const std::vector< FF > &challenges)
	Batch prover polynomials. Batching happens in place into the first polynomial in the RefArray supplied.

Private Attributes
std::shared_ptr< Transcript >	transcript

Detailed Description

HyperNova folding prover. Folds circuit instances into accumulators, deferring PCS verification.

See: chonk/README.md#hypernova-folding-details

Accumulator Concept

An Accumulator represents batched polynomial evaluation claims from one or more circuits. Instead of verifying each circuit's PCS separately, we batch claims into an accumulator and defer verification to a final "decider" proof. This enables efficient recursion.

Each accumulator contains:

challenge: The evaluation point (from Sumcheck)
non_shifted_{polynomial,commitment,evaluation}: Batched claims for standard polynomials
shifted_{polynomial,commitment,evaluation}: Batched claims for shifted polynomials

Shifted vs Unshifted Polynomials

Unshifted: Standard witness/selector polynomials evaluated at point r
Shifted: Polynomials referencing the "next row" in relations. We enforce p(0) = 0, so p(X)/X is a polynomial. The shift is p(X)/X evaluated at r, i.e., p(r)/r. Same commitment works for both p and its shift (no separate commitment needed).

The batching formula: batched = Σᵢ ρᵢ·pᵢ where ρᵢ are Fiat-Shamir challenges.

Definition at line 38 of file hypernova_prover.hpp.

Member Typedef Documentation

◆ Accumulator

using bb::HypernovaFoldingProver::Accumulator = MultilinearBatchingProverClaim

Definition at line 44 of file hypernova_prover.hpp.

◆ Commitment

using bb::HypernovaFoldingProver::Commitment = Flavor::Commitment

Definition at line 42 of file hypernova_prover.hpp.

◆ FF

using bb::HypernovaFoldingProver::FF = Flavor::FF

Definition at line 41 of file hypernova_prover.hpp.

◆ Flavor

using bb::HypernovaFoldingProver::Flavor = MegaFlavor

Definition at line 40 of file hypernova_prover.hpp.

◆ MegaOinkProver

using bb::HypernovaFoldingProver::MegaOinkProver = OinkProver<Flavor>

Definition at line 47 of file hypernova_prover.hpp.

◆ MegaSumcheckOutput

using bb::HypernovaFoldingProver::MegaSumcheckOutput = SumcheckOutput<Flavor>

Definition at line 49 of file hypernova_prover.hpp.

◆ MegaSumcheckProver

using bb::HypernovaFoldingProver::MegaSumcheckProver = SumcheckProver<Flavor>

Definition at line 48 of file hypernova_prover.hpp.

◆ ProverInstance

using bb::HypernovaFoldingProver::ProverInstance = ProverInstance_<Flavor>

Definition at line 43 of file hypernova_prover.hpp.

◆ Transcript

using bb::HypernovaFoldingProver::Transcript = Flavor::Transcript

Definition at line 50 of file hypernova_prover.hpp.

◆ VerificationKey

using bb::HypernovaFoldingProver::VerificationKey = Flavor::VerificationKey

Definition at line 45 of file hypernova_prover.hpp.

◆ VerifierCommitments

using bb::HypernovaFoldingProver::VerifierCommitments = Flavor::VerifierCommitments

Definition at line 46 of file hypernova_prover.hpp.

Constructor & Destructor Documentation

◆ HypernovaFoldingProver()

bb::HypernovaFoldingProver::HypernovaFoldingProver ( std::shared_ptr< Transcript > transcript )

inline

Definition at line 55 of file hypernova_prover.hpp.

Member Function Documentation

◆ batch_mul()

template<size_t N>

HypernovaFoldingProver::Commitment bb::HypernovaFoldingProver::batch_mul	(	const RefArray< Commitment, N > &	_points,
		const std::vector< FF > &	scalars
	)

private

Utility to perform batch mul of commitments.

Definition at line 15 of file hypernova_prover.cpp.

◆ batch_polynomials()

template<size_t N>

Polynomial< HypernovaFoldingProver::FF > bb::HypernovaFoldingProver::batch_polynomials	(	RefArray< Polynomial< FF >, N >	polynomials_to_batch,
		const size_t &	full_batched_size,
		const std::vector< FF > &	challenges
	)

staticprivate

Batch prover polynomials. Batching happens in place into the first polynomial in the RefArray supplied.

Template Parameters

N

Parameters

shiftable If it is set to true, then the polynomials are aggregated as shiftable polynomials

Definition at line 72 of file hypernova_prover.cpp.

◆ export_proof()

HonkProof bb::HypernovaFoldingProver::export_proof ( )

inline

Export the proof contained in the transcript.

Returns: HonkProof

Definition at line 85 of file hypernova_prover.hpp.

◆ fold()

std::pair< HonkProof, HypernovaFoldingProver::Accumulator > bb::HypernovaFoldingProver::fold	(	Accumulator &&	accumulator,
		const std::shared_ptr< ProverInstance > &	instance,
		const std::shared_ptr< VerificationKey > &	honk_vk = `nullptr`
	)

Fold an instance into an accumulator.

Takes ownership of accumulator via move - the old accumulator's data is consumed and a new accumulator is returned. This enables zero-copy flow through the proving pipeline.

Parameters

accumulator	Moved into the fold operation (consumed)
instance	The new instance to fold in

Returns: std::pair<HonkProof, Accumulator> The proof and new accumulator (owns the combined data)

Definition at line 124 of file hypernova_prover.cpp.

◆ get_batching_challenges()

std::pair< std::vector< FF >, std::vector< FF > > bb::HypernovaFoldingProver::get_batching_challenges ( )

private

Generate the challenges required to batch the incoming instance with the accumulator.

◆ instance_to_accumulator()

HypernovaFoldingProver::Accumulator bb::HypernovaFoldingProver::instance_to_accumulator	(	const std::shared_ptr< ProverInstance > &	instance,
		const std::shared_ptr< VerificationKey > &	honk_vk = `nullptr`
	)

Turn an instance into an accumulator by running Sumcheck.

Parameters

instance

Returns: Accumulator

Definition at line 91 of file hypernova_prover.cpp.

◆ sumcheck_output_to_accumulator()

HypernovaFoldingProver::Accumulator bb::HypernovaFoldingProver::sumcheck_output_to_accumulator	(	HypernovaFoldingProver::MegaSumcheckOutput &	sumcheck_output,
		const std::shared_ptr< ProverInstance > &	instance,
		const std::shared_ptr< VerificationKey > &	honk_vk
	)

private

Convert the output of the sumcheck run on the incoming instance into an accumulator.

Definition at line 25 of file hypernova_prover.cpp.

Member Data Documentation

◆ NUM_SHIFTED_ENTITIES

constexpr size_t bb::HypernovaFoldingProver::NUM_SHIFTED_ENTITIES = MegaFlavor::NUM_SHIFTED_ENTITIES

staticconstexpr

Definition at line 53 of file hypernova_prover.hpp.

◆ NUM_UNSHIFTED_ENTITIES

constexpr size_t bb::HypernovaFoldingProver::NUM_UNSHIFTED_ENTITIES = MegaFlavor::NUM_UNSHIFTED_ENTITIES

staticconstexpr

Definition at line 52 of file hypernova_prover.hpp.

◆ transcript

std::shared_ptr<Transcript> bb::HypernovaFoldingProver::transcript

private

Definition at line 88 of file hypernova_prover.hpp.

The documentation for this class was generated from the following files:

src/barretenberg/hypernova/hypernova_prover.hpp
src/barretenberg/hypernova/hypernova_prover.cpp

Public Types

Public Member Functions

Static Public Attributes

Private Member Functions

Static Private Member Functions

Private Attributes

Detailed Description

Accumulator Concept

Shifted vs Unshifted Polynomials

Member Typedef Documentation

◆ Accumulator

◆ Commitment

◆ FF

◆ Flavor

◆ MegaOinkProver

◆ MegaSumcheckOutput

◆ MegaSumcheckProver

◆ ProverInstance

◆ Transcript

◆ VerificationKey

◆ VerifierCommitments

Constructor & Destructor Documentation

◆ HypernovaFoldingProver()

Member Function Documentation

◆ batch_mul()

◆ batch_polynomials()

◆ export_proof()

◆ fold()

◆ get_batching_challenges()

◆ instance_to_accumulator()

◆ sumcheck_output_to_accumulator()

Member Data Documentation

◆ NUM_SHIFTED_ENTITIES

◆ NUM_UNSHIFTED_ENTITIES

◆ transcript