Feat/fri early termination#729
Open
diegokingston wants to merge 17 commits into
Open
Conversation
Collaborator
Author
|
/bench |
Benchmark — ethrex 20 transfers (median of 3)Table parallelism: auto (cores / 3)
Commit: d07779f · Baseline: cached · Runner: self-hosted bench |
Collaborator
Author
|
/bench |
FRI stops folding when the polynomial reaches degree < 2^k (k = ProofOptions.fri_final_poly_log_degree, default 7) instead of folding to a single constant. The prover sends the 2^k final-polynomial coefficients (fri_final_poly_coeffs); the verifier reconstructs the terminal codeword via a coset FFT (base-field twiddles) and checks each query against it, with a structural degree-bound check and a clamp for tiny traces. k is bound into the Fiat-Shamir statement (DOMAIN_TAG _V3). Impact (blowup 2, 219 queries): ~225 KB smaller proof, constant across trace size (~16% at 2^20, 25% at 2^16); verifier does ~6,132 fewer Keccak compressions and ~1,840 fewer Fp3 muls per proof. - Prover interpolates the terminal poly on the minimal 2^k sub-coset (no oversized iFFT, no zero-trim). - GPU FRI commit (cuda) supports early termination, mirroring the CPU path; validated on a CUDA server (proof verifies, gpu_fri_calls fires). - Soundness: tampered / over-length / under-length coeffs and cross-k all reject; terminal codeword<->coeffs roundtrip; single-fold + clamp cases.
diegokingston
force-pushed
the
feat/fri-early-termination
branch
from
c1627b1 to
be46afb
Compare
Resolve conflicts where main's continuations feature meets this branch's FRI early-termination statement binding. Both sides changed absorb_statement's signature, so the merged function takes both kind: StatementKind (continuations) and fri_final_poly_log_degree (this branch); all callers thread both. - continuation.rs: epoch_transcript now binds opts.fri_final_poly_log_degree per epoch, matching the value the epoch's FRI actually folds to (read from air.options() by both prover and verifier). - statement_tests.rs: thread fri_final_poly_log_degree through the test helpers and main's new continuation-epoch tests. - cuda_path_integration.rs: keep both newly added GPU tests (gpu_fri_commit_produces_verifiable_proof and gpu_proof_verifies_row_pair_commitment). - statement.rs: allow clippy::too_many_arguments on absorb_statement, now at 8 args after both features each added one (CI runs clippy -D warnings).
Collaborator
Author
|
/bench |
…ofOptions The main merge brought in MIN_PROOF_OPTIONS (recursion_smoke_test.rs), which constructs ProofOptions without the fri_final_poly_log_degree field this branch adds, breaking compilation of the prover lib tests (Lint, Build prover tests, Disk-spill). Set it to 7 (the default used by every other test ProofOptions).
Collaborator
|
/bench-verify |
|
⏳ Verifier benchmark started on the bench server (~4 min). The bench server is occupied until it finishes. |
Verifier benchmark —
|
…poly_log_degree can't divide-by-zero the prover
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
FRI early termination — send final-polynomial coefficients
Motivation
The FRI commit phase folded the deep-composition codeword down to a single
constant (
fri_last_value), so every fold cost a Merkle root plus one symmetricopening per query. This PR terminates folding early instead: once the codeword
encodes a polynomial of degree
< 2^k, the prover sends those2^kcoefficients directly (the standard Plonky3 / ethSTARK approach).
kis a newoption
fri_final_poly_log_degree(default7).Trade-off: we add
2^kfield elements to the proof once, but drop the lastkfold layers —
kMerkle roots andkopenings per query. For productionquery counts this shrinks the proof and cuts commit-phase work, and clamps to a
no-op for traces too small to fold that far.
Description
ProofOptions.fri_final_poly_log_degree: u8(default7).StarkProof.fri_last_value→fri_final_poly_coeffs: Vec<FieldElement<E>>.fri/terminal.rs: pure helpers converting between a terminalcodeword and its polynomial coefficients (
coeffs_from_terminal_codewordprover-side,
terminal_codeword_from_coeffsverifier-side).fri/mod.rs,gpu_lde.rs):commit_phase_from_evaluationsandthe GPU mirror commit
total_folds - 1layers, do one final fold to theterminal codeword, and append its coefficients to the transcript.
verifier.rs): afri_termination_paramshelper centralizes thefold schedule (used by the Fiat-Shamir replay and
step_3_verify_fri); theprover derives the identical schedule inline.
step_3_verify_frireconstructs the terminalcodeword and, before the query loop, checks (1) committed-layer count,
(2)
fri_final_poly_coeffs.len() == 2^expected_k, (3) every per-querydecommitment has exactly
num_committedlayers.verify_query_and_sym_openingscompares each folded query against the reconstructed terminal codeword
(no-fold / single-fold / general cases).
fri_final_poly_log_degreeis absorbed into the statement andthe coefficients replace the final value in the transcript; tags bumped
STATEMENT_V2→V3,CONTINUATION_EPOCH_V1→V2.kcan'tdivide-by-zero the prover (degrades to no early termination).
number_layersparam and unusedDomain.root_orderfield.Soundness
2^expected_kcoefficients, so it is low-degree by construction and theblowup (rate) is preserved — per-query soundness is unchanged from folding to
a constant.
transcript; check (3) pins their length before the fold loop, blocking empty
(vacuous accept) or padded (skip terminal check) decommitments.
Bench results