naive FRI #1

katat · 2023-12-06T08:05:55Z

Please feel free to comment.

mimoo · 2023-12-12T13:42:52Z

src/fri/naive.md

+
+Simply put, it is a protocol for verifier to quickly check if a polynomial has a upper degree bound claimed by prover.
+
+This post will explain the intuition of the math behind how polynomial folding works through some simple calculation examples end to end. These examples will demonstrate a naive version of FRI protocol without the the uses of commitment, which will explained in another post. 


typo: "the the"

it'd be cool to incrementally build FRI here, so first fri is naive fri and doesn't use commitments, then get rid of g and h via the optimization, then add commitments, then add commitments that group some evaluations, then show how we can choose evaluations on each layer to reduce the number of queries, etc.

mimoo · 2023-12-12T13:43:03Z

src/fri/naive.md

+## How does FRI work?
+FRI protocol relies on a fact that if a source polynomial $p_0$ can be recursively folded into a constant polynomial, then $p_0$ has an expected upper bound degree. By folding, we mean each round halves the degree of $p_0$.
+
+Simply put, it is a protocol for verifier to quickly check if a polynomial has a upper degree bound claimed by prover.


for a verifier ... by a prover

mimoo · 2023-12-12T13:49:06Z

src/fri/naive.md

@@ -0,0 +1,157 @@
+## How does FRI work?
+FRI protocol relies on a fact that if a source polynomial $p_0$ can be recursively folded into a constant polynomial, then $p_0$ has an expected upper bound degree. By folding, we mean each round halves the degree of $p_0$.


if a source polynomial $p_0$ can be recursively folded into a constant polynomial, then $p_0$ has an expected upper bound degree

I would remove the word "source" here because it's not clear what a "source polynomial" really is.

It's also not clear what that upper bound on the degree is. Perhaps rephrased like this:

The FRI protocol is an interactive protocol between a prover and a verifier in which the prover iteratively reduces the size of a (committed) polynomial via help from the verifier, until it reaches a constant degree. At the end of the protocol the verifier is convinced that the prover knows a polynomial of degree $d$ proportional to the number of reductions in the protocol. Thus, by fixing the number of rounds/reductions, a prover can convince a verifier that the polynomial they know has a specific upper bound on its degree.

mimoo · 2023-12-12T13:51:24Z

src/fri/naive.md

+p_1\text{ : } & 3 + 3y & \\
+p_2\text{ : } & 6 &
+\end{align*}
+$$


maybe use a list instead of align?

mimoo · 2023-12-12T13:52:25Z

src/fri/naive.md

+
+$p_0$ is the source polynomial. After a round of folding, it results in $p_1$. Then, the final round results in a constant polynomial $p_2$.
+
+To see how this folding algorithm works, please refer to the [code](https://github.com/katat/fri/blob/ab5aad54b8fd1e37b881ed7558d6ad22b6911442/src/poly.rs#L77).


I think an english/math explanation would be better :p

I think your explanation using the $g_i(x)$ and $h_i(x)$ makes the connection easier to understand. I will use them to explain in english/math.

mimoo · 2023-12-12T13:54:05Z

src/fri/naive.md

+
+These folded polynomials have the following relationship with their source polynomials:
+
+$$p_i\left(x^2\right)=\frac{p_{i-1}\left(x\right)+p_{i-1}\left(-x\right)}{2}+\beta_i \frac{p_{i-1}\left(x\right)-p_{i-1}\left(-x\right)}{2 x}$$


this equation sorts of fall from the sky. I think it'd be better to explain the recipe of the reduction:

if $p_i$ is of degree $d$, compute $g_i$ and $h_i$ as two degree $d/2$ polynomials, such that $p_i(x) = g_i(x^2) + x \cdot h_i(x^2)$

get a random challenge $\beta_i$ from the verifier

compute the next polynomial $p_{i+1}(x) := g_i(x^2) + \beta_i \cdot h_i(x^2)$

I agree. This is easier to explain on where the folded polynomial comes from.

The "fall from sky" equation is a step further and indeed difficult for others to reason where it is from without explaining the recipe of the reduction.

mimoo · 2023-12-12T13:59:06Z

src/fri/naive.md

+
+*For simplicity, the random number $\beta$ will be assumed as 1 in this post. We would touch the implication behind this random number in another post that explains the commitment.*
+
+$p_0$ is the original polynomial, and $p_2$ is a constant polynomial that can't be folded anymore. 


I think I should be able to fold a constant polynomial without breaking the protocol (so FRI enforces an upper bound on the degree, but not a lower bound)

mimoo · 2023-12-12T13:59:57Z

src/fri/naive.md

+
+$p_0$ is the original polynomial, and $p_2$ is a constant polynomial that can't be folded anymore. 
+
+These folded polynomials can be traced back to their source polynomials. Thus, the evaluations in a folded polynomial can be accumulated from the corresponding source polynomial. 


not sure I understand this ^

mimoo · 2023-12-12T14:00:35Z

src/fri/naive.md

+
+These folded polynomials can be traced back to their source polynomials. Thus, the evaluations in a folded polynomial can be accumulated from the corresponding source polynomial. 
+
+These relationships can serve as a proof for verifier to the consistency among the evaluations. The consistency check implies if there is a $p_0$ exists that the prover claimed.


not sure I get this one either ^

mimoo · 2023-12-12T14:01:35Z

src/fri/naive.md

+
+These relationships can serve as a proof for verifier to the consistency among the evaluations. The consistency check implies if there is a $p_0$ exists that the prover claimed.
+
+With the same folding setup, the final polynomial will be always the same value. Verifier can check against the same final value against the reduced values from different evaluation points.


what is a folding setup? you mean with the same polynomial and if the verifier sends the same randomness? I'm not sure I understand the paragraph here

mimoo · 2023-12-12T14:02:23Z

src/fri/naive.md

+
+More formally, there are two properties:
+- the number of rounds $k=log(d)$ to derive the final polynomial implies the expected upper bound degree $d$
+- the same final value can be re-used to check consistency of the evaluation claims across layers


(that second point is still not clear to me)

Because the final layer is a constant polynomial, the verifier can expect the derived value from above layers to be always that same constant value, no matter which evaluation point is used.

Take the folding example above, the derived value should equal to 6, which is the constant polynomial $p_2$.

mimoo · 2023-12-12T14:06:08Z

src/fri/naive.md

+
+for instance, $\left(a_1, w_1\right) \in \mathcal{R}$, where $a_1$ can represent a FRI query and constant value from $p_2$, while $w_1$ represents the corresponding evaluations across layers.
+
+So the problem is to do the check to see if $a_1$ is in $\mathcal{L}$. In other words, the verifier checks if the prover can provide $w_1$ satisfying the query $a_1$.


^ not sure how useful this notation is here, and also what is exactly the relation $\mathcal{R}_{\text{consistent-layers}}$

I try to remark the problem that the FRI can help resolve in a compact way.
Obviously, it seems make it more confusing here :)

I think the relation $\mathcal{R}$ could be seen a success proof for a query.

I was trying to emphasis consistent-layers, as the prover should provide corresponding evaluations for the verifier to derive the final constant value across layers. But as you pointed out in the other comments, some of the these evaluations can be deduced from evaluations at previous layers.

mimoo · 2023-12-12T14:06:33Z

src/fri/naive.md

+p_2(x_2) &= 6 \\
+p_2((1^2)^2) &= 6 \\\\
+\end{align}
+$$


a think a list would render better here as well, doesn't render super well at least on github

also I don't understand why you evaluate at 1 and -1 here? Aren't you just doing the reduction at this point? Why evaluate?

My understanding is the prover need to evaluate the full domain and then commit the evaluations. Evaluating at 1 and -1 is an example of evaluating at point 1 and its symmetric point -1. Here I try to explain how these evaluations are done at the prover side.

ah, I guess it is part of committing to the polynomial at each layer (but you were not talking about commitments so far). Grouping v and -v under the same leaf is an optimization :o

mimoo · 2023-12-12T14:10:59Z

src/fri/naive.md

+
+
+
+In this manner, the prover can keep calculating for the whole domain. Then they would response the verifier query with the evaluations across layers for checking if an instance $a_i$ corresponding to the query is in the $\mathcal{L}\left(\mathcal{R}_{\text{consistent-layers }}\right)$


keep calculating for the whole domain

what do you mean by that?

also it's the first time you talk about the verifier doing queries here. I think the typical explanations of FRI (ethstark, thaler, etc.) are usually clearer because they explain the commit phase and then the query phase, but here it's not clear what the protocol to follow is

I was trying to focus on describing how the evaluations can be done using the polynomials in different layers at the prover side, with the intention to avoid touching the commitment part for now.

Then I plan to explain on why it is necessary to incorporate the challenge by verifier and commit to these evaluations in another post or later section. I guess this arrangement might help separate the concepts between the "basic core calculations" and the security component.

Maybe I should explain this intention in this section to give a better clue on the role of this part in the protocol.

mimoo · 2023-12-12T14:17:14Z

src/fri/naive.md

+
+Based on the relationship implied from the equation of folding polynomial, the verifier can check the consistency among the evaluations between layers. Let's review and put this equation into use:
+
+$$p_i\left(x^2\right)=\frac{p_{i-1}\left(x\right)+p_{i-1}\left(-x\right)}{2}+\beta_i \frac{p_{i-1}\left(x\right)-p_{i-1}\left(-x\right)}{2 x}$$


here again the equation falls out of the sky. IMO a first naive FRI that doesn't do that, and use g and h would be easier. And then you can move to an optimized version of FRI that gets rid of g and h. For example:

Notice that if the verifier chooses the points they want to query carefully, for example $v$ and $-v$, they don't need to directly query $g$ and $h$ but can infer their evaluations instead. This is because by querying only $p_0$ at these two points the verifier just has to solve this system of equation:

$p_0(v) = g_0(v^2) + v \cdot h_0(v^2)$

$p_0(-v) = g_0(v^2) - v \cdot h_0(v^2)$

which is possible as we have 2 linearly independent equations of 2 unknowns

then the next layer can be obtained locally without any further queries by the verifier: $p_1(v) = g_0(v) + \beta \cdot h_0(v)$

IIUC, the $g_0(v^2)$ and $h_0(v^2)$ can be obtained by solving the system of equation.

Then, does it mean that, in the equation $p_1(v) = g_0(v) + \beta \cdot h_0(v)$, $g_0(v)$ and $h_0(v)$ actually represent the same values of $g_0(v^2)$ and $h_0(v^2)$ respectively? I am confused by the use of $v$ and $v^2$ between the $p_0$ and $p_1$.

Another question is, in this method, in order for the verifier to check $p_2(v)$, do they require prover to send $p_1(-v)$, so they can solve for the $g_1(v)$ and $h_1(v)$?

Yeah, the ethstark paper says the prover will send the $p_1(-v)$.

yeah at each layer you query both the evaluation at v and -v, BUT as an optimization the prover commits to both these optimization under the same leaf in the merkle tree

mimoo · 2023-12-12T14:18:01Z

src/fri/naive.md

+$$p_i\left(x^2\right)=\frac{p_{i-1}\left(x\right)+p_{i-1}\left(-x\right)}{2}+\beta_i \frac{p_{i-1}\left(x\right)-p_{i-1}\left(-x\right)}{2 x}$$
+
+
+This equation is useful for the verifier to check the consistency of the evaluations across layers. That is, $p_i$ can be evaluated using two symmetric evaluations from its source polynomial $p_{i-1}$ by connecting the source domain $x$ and folded domain $x^2$.


what is a source domain and a folded domain? These seems like elements, not domains :o

katat · 2024-09-24T07:00:38Z

Thanks a lot for the reviews @mimoo
I am closing this one for now, as it has stalled for quite a while. There are probably better ways to explain this concept.

katat requested a review from mimoo December 6, 2023 08:05

naive fri

751b7aa

katat force-pushed the naive-fri branch from cc2ced6 to 751b7aa Compare December 6, 2023 08:56

move code out

e0373f8

katat force-pushed the naive-fri branch from 0351825 to e0373f8 Compare December 8, 2023 02:03

mimoo reviewed Dec 12, 2023

View reviewed changes

src/fri/naive.md

p_1\text{ : } & 3 + 3y & \\

p_2\text{ : } & 6 &

\end{align*}

$$

Copy link

Contributor

mimoo Dec 12, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

maybe use a list instead of align?

mimoo reviewed Dec 12, 2023

View reviewed changes

katat closed this Sep 24, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

naive FRI #1

naive FRI #1

katat commented Dec 6, 2023

mimoo Dec 12, 2023

mimoo Dec 12, 2023

mimoo Dec 12, 2023

mimoo Dec 12, 2023

mimoo Dec 12, 2023

katat Dec 16, 2023

mimoo Dec 12, 2023 •

edited

Loading

katat Dec 16, 2023

mimoo Dec 12, 2023 •

edited

Loading

mimoo Dec 12, 2023

mimoo Dec 12, 2023

mimoo Dec 12, 2023

mimoo Dec 12, 2023

katat Dec 16, 2023

mimoo Dec 12, 2023

katat Dec 16, 2023

mimoo Dec 12, 2023

mimoo Dec 12, 2023

katat Dec 16, 2023

mimoo Dec 19, 2023

mimoo Dec 12, 2023

katat Dec 16, 2023

mimoo Dec 12, 2023 •

edited

Loading

katat Dec 16, 2023

katat Dec 16, 2023 •

edited

Loading

mimoo Dec 19, 2023

mimoo Dec 12, 2023

katat commented Sep 24, 2024


		Simply put, it is a protocol for verifier to quickly check if a polynomial has a upper degree bound claimed by prover.

		This post will explain the intuition of the math behind how polynomial folding works through some simple calculation examples end to end. These examples will demonstrate a naive version of FRI protocol without the the uses of commitment, which will explained in another post.

		@@ -0,0 +1,157 @@
		## How does FRI work?
		FRI protocol relies on a fact that if a source polynomial $p_0$ can be recursively folded into a constant polynomial, then $p_0$ has an expected upper bound degree. By folding, we mean each round halves the degree of $p_0$.


		$p_0$ is the source polynomial. After a round of folding, it results in $p_1$. Then, the final round results in a constant polynomial $p_2$.

		To see how this folding algorithm works, please refer to the [code](https://github.com/katat/fri/blob/ab5aad54b8fd1e37b881ed7558d6ad22b6911442/src/poly.rs#L77).


		These folded polynomials have the following relationship with their source polynomials:

		$$p_i\left(x^2\right)=\frac{p_{i-1}\left(x\right)+p_{i-1}\left(-x\right)}{2}+\beta_i \frac{p_{i-1}\left(x\right)-p_{i-1}\left(-x\right)}{2 x}$$


		For simplicity, the random number $\beta$ will be assumed as 1 in this post. We would touch the implication behind this random number in another post that explains the commitment.

		$p_0$ is the original polynomial, and $p_2$ is a constant polynomial that can't be folded anymore.


		$p_0$ is the original polynomial, and $p_2$ is a constant polynomial that can't be folded anymore.

		These folded polynomials can be traced back to their source polynomials. Thus, the evaluations in a folded polynomial can be accumulated from the corresponding source polynomial.


		These folded polynomials can be traced back to their source polynomials. Thus, the evaluations in a folded polynomial can be accumulated from the corresponding source polynomial.

		These relationships can serve as a proof for verifier to the consistency among the evaluations. The consistency check implies if there is a $p_0$ exists that the prover claimed.


		These relationships can serve as a proof for verifier to the consistency among the evaluations. The consistency check implies if there is a $p_0$ exists that the prover claimed.

		With the same folding setup, the final polynomial will be always the same value. Verifier can check against the same final value against the reduced values from different evaluation points.


		for instance, $\left(a_1, w_1\right) \in \mathcal{R}$, where $a_1$ can represent a FRI query and constant value from $p_2$, while $w_1$ represents the corresponding evaluations across layers.

		So the problem is to do the check to see if $a_1$ is in $\mathcal{L}$. In other words, the verifier checks if the prover can provide $w_1$ satisfying the query $a_1$.




		In this manner, the prover can keep calculating for the whole domain. Then they would response the verifier query with the evaluations across layers for checking if an instance $a_i$ corresponding to the query is in the $\mathcal{L}\left(\mathcal{R}_{\text{consistent-layers }}\right)$


		Based on the relationship implied from the equation of folding polynomial, the verifier can check the consistency among the evaluations between layers. Let's review and put this equation into use:

		$$p_i\left(x^2\right)=\frac{p_{i-1}\left(x\right)+p_{i-1}\left(-x\right)}{2}+\beta_i \frac{p_{i-1}\left(x\right)-p_{i-1}\left(-x\right)}{2 x}$$

		$$p_i\left(x^2\right)=\frac{p_{i-1}\left(x\right)+p_{i-1}\left(-x\right)}{2}+\beta_i \frac{p_{i-1}\left(x\right)-p_{i-1}\left(-x\right)}{2 x}$$


		This equation is useful for the verifier to check the consistency of the evaluations across layers. That is, $p_i$ can be evaluated using two symmetric evaluations from its source polynomial $p_{i-1}$ by connecting the source domain $x$ and folded domain $x^2$.

naive FRI #1

naive FRI #1

Conversation

katat commented Dec 6, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mimoo Dec 12, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mimoo Dec 12, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mimoo Dec 12, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

katat Dec 16, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

katat commented Sep 24, 2024

mimoo Dec 12, 2023 •

edited

Loading

mimoo Dec 12, 2023 •

edited

Loading

mimoo Dec 12, 2023 •

edited

Loading

katat Dec 16, 2023 •

edited

Loading