diff --git a/fri/fri-proximity-gap.md b/fri/fri-proximity-gap.md index 52bf082..7ccd324 100644 --- a/fri/fri-proximity-gap.md +++ b/fri/fri-proximity-gap.md @@ -32,7 +32,7 @@ Initially, the Prover wants to prove to the Verifier that the degree of $f(x)$ i 2. Prove that the degree of function $h(x)$ is less than $k/2$, i.e., $h(x) \in \mathrm{RS}[\mathbb{F}_q, \mathcal{D}^{(1)}, k/2]$ 3. Prove that $f(x) = g(x^2) + x \cdot h(x^2)$ -Where $|{D}^{(1)}| = n/2$. The third item is to prove that the odd-even splitting is correct. Similarly, $g(x)$ and $h(x)$ can be decomposed into odd and even terms like $f(x)$, decomposing them into two polynomials of degree less than $k/4$, so we need to prove that 4 polynomials are of degree less than $k/4$, until finally decomposing to prove constant polynomials. This process is shown in the figure below, and we can see that the polynomials to be proved are growing in the form of powers of 2. In this process, in order to prove that the odd-even splitting is not problematic, we need to send oracles about all these polynomials to the Verifier, and we can imagine that there are too many polynomials being sent, which grow explosively as $k$ increases. +where $|{D}^{(1)}| = n/2$. The third item is to prove that the odd-even splitting is correct. Similarly, $g(x)$ and $h(x)$ can be decomposed into odd and even terms like $f(x)$, decomposing them into two polynomials of degree less than $k/4$, so we need to prove that 4 polynomials are of degree less than $k/4$, until finally decomposing to prove constant polynomials. This process is shown in the figure below, and we can see that the polynomials to be proved are growing in the form of powers of 2. In this process, in order to prove that the odd-even splitting is not problematic, we need to send oracles about all these polynomials to the Verifier, and we can imagine that there are too many polynomials being sent, which grow explosively as $k$ increases. ![](./img/fri-proximity-gap-binary.svg) @@ -75,7 +75,7 @@ $$ \Pr_{a \in A}[\Delta(a, V) = 0] = 1 $$ -### Cheating Prover +### Malicious Prover If the Prover cheats, suppose one vector in the $m$ vectors $\vec{u} = (u_0, \ldots, u_{m-1})$ sent by the Prover to the Verifier is $\delta$ far from $V$, that is @@ -145,7 +145,7 @@ This probability consists of two parts, the increase of $\delta$ will lead to: It can be seen that the increase of $\delta$ causes $\epsilon$ to increase and $(1 - \delta)^{\kappa}$ to decrease. In practice, $\epsilon$ is very small, and $(1 - \delta)^{\kappa}$ accounts for a larger proportion in the whole sum, so the overall will still decrease, which means that for the entire FRI protocol, the soundness decreases, indicating that it will be more secure. -The above analysis is from the perspective of soundness. The video [Proximity Gaps & Applications to Succinct Proofs](https://www.youtube.com/watch?v=8AMiZdWA1eM) also mentions a point that the increase of $\delta$ will make the corresponding Correlated Agreement related conclusions weaker, which is not a good thing. Let's introduce the Correlated Agreement conclusion below. +The above analysis is from the perspective of soundness. The video [Proximity Gaps & Applications to Succinct Proofs](https://www.youtube.com/watch?v=8AMiZdWA1eM) also mentions a point that the increase of $\delta$ will make the corresponding Correlated Agreement related conclusions weaker. Correlated Agreement is a stronger conclusion than Proximity Gaps (so far, their equivalence has not been proven). Let's introduce the Correlated Agreement conclusion below. ## Correlated Agreement @@ -164,6 +164,18 @@ where $\epsilon$ is the $\epsilon$ given in the Proximity Gaps conclusion, then This means that if there are many elements falling into the shaded area, with a proportion larger than $\epsilon$ in the Proximity Gaps conclusion, then there exist codewords $v_0, \ldots, v_{m-1}$ in $V$, and there will be a subset $\mathcal{D}'$ in the domain $\mathcal{D}$ with a very large proportion (more than $1 - \delta$), where each $u_i$ is consistent with the corresponding $v_i$ on $\mathcal{D}'$. +According to the conclusion of Proximity Gaps, the elements in $A$ fall into two categories: + +1. $\Pr_{a \in A}[\Delta(a, V) \le \delta] \le \epsilon$ +2. $\Pr_{a \in A}[\Delta(a, V) \le \delta] = 1$ + +Now, if the proportion of elements falling into the shaded area is greater than $\epsilon$ , we can naturally exclude the first case. This leads to the conclusion that all elements in $A$ fall within the shaded area, i.e., + +$$\Pr_{a \in A}[\Delta(a, V) \le \delta] = 1 .$$ + +The correlated agreement theorem provides a more specific conclusion. It describes the relationship between the elements $u_{i}$ before folding and the codewords $v_{i}$ found in the encoding space $V$ . + + For example, if the Prover wants to prove that a polynomial $f \in \mathrm{RS}[\mathbb{F}_q, \mathcal{D}^{(0)}, k]$, let $\mathcal{D}^{(0)} = \{x_1, \ldots, x_n\}$, calculate $\{f(x_1), \ldots, f(x_n)\}$, the Prover will send the oracle of these values to the Verifier. In practice, Merkle trees are used to implement the oracle. ![](./img/fri-proximity-gap-f.svg) diff --git a/fri/fri-proximity-gap.zh.md b/fri/fri-proximity-gap.zh.md index 1408dcc..fe39394 100644 --- a/fri/fri-proximity-gap.zh.md +++ b/fri/fri-proximity-gap.zh.md @@ -75,7 +75,7 @@ $$ \Pr_{a \in A}[\Delta(a, V) = 0] = 1 $$ -### 作弊的 Prover +### 恶意的 Prover 如果 Prover 作弊,假设在 Prover 发送给 Verifier 的 $m$ 个向量 $\vec{u} = (u_0, \ldots, u_{m-1})$ 中混入了一个向量距离 $V$ 有 $\delta$ 远,即 @@ -145,7 +145,9 @@ $$ 可以看到,$\delta$ 的增加使得 $\epsilon$ 变大, $(1 - \delta)^{\kappa}$ 变小,在实际中,$\epsilon$ 是非常小的,$(1 - \delta)^{\kappa}$ 在整个和式中所占比例更大,因此整体还是会变小的,这对于整个 FRI 协议来说,soundness 变小,也说明会更加安全。 -上面是从 soundness 角度分析的,视频 [Proximity Gaps & Applications to Succinct Proofs](https://www.youtube.com/watch?v=8AMiZdWA1eM) 中还提到一点,$\delta$ 的增大会使得对应的 Correlated Agreement 相关结论变得更弱,这并不是好事。 下面就介绍下 Correlated Agreement 结论。 +上面是从 soundness 角度分析的,视频 [Proximity Gaps & Applications to Succinct Proofs](https://www.youtube.com/watch?v=8AMiZdWA1eM) 中还提到一点,$\delta$ 的增大会使得 Correlated Agreement 结论变得更弱, Correlated Agreement 是一个比 Proximity Gaps 更强的结论(到目前为止,还没有证明出它们等价)。下面就介绍下 Correlated Agreement 结论。 + + ## Correlated Agreement @@ -162,7 +164,16 @@ $$ 1. **Density** : $\frac{|\mathcal{D}'|}{|\mathcal{D}|} \ge 1 - \delta$ , 2. **Agreement** :对任意的 $i \in \{0, \ldots, m - 1\}$ ,有 $u_i|_{\mathcal{D}'} = v_i|_{\mathcal{D}'}$ 。 -意思是如果落入阴影区域的元素很多,占比比 Proximity Gaps 结论中的 $\epsilon$ 还大的话,那么在 $V$ 中存在码字 $v_0, \ldots, v_{m-1}$ ,会在区域 $\mathcal{D}$ 中存在一个占比很大(超过 $1 - \delta$ )的子集 $\mathcal{D}'$ ,在这里每个 $u_i$ 都能与对应的 $v_i$ 在 $\mathcal{D}'$ 上是一致的。 +意思是如果落入阴影区域的元素很多,占比比 Proximity Gaps 结论中的 $\epsilon$ 还大的话,那么在 $V$ 中存在码字 $v_0, \ldots, v_{m-1}$ ,会在区域 $\mathcal{D}$ 中存在一个占比很大(超过 $1 - \delta$ )的子集 $\mathcal{D}'$ ,在这里每个 $u_i$ 都能与对应的 $v_i$ 在 $\mathcal{D}'$ 上是一致的。根据 Proximity Gaps 的结论,$A$ 中的元素分为以下两种情况: + +1. $\Pr_{a \in A}[\Delta(a, V) \le \delta] \le \epsilon$ +2. $\Pr_{a \in A}[\Delta(a, V) \le \delta] = 1$ + +现在落入阴影区域的元素占比比 $\epsilon$ 还大,那么自然排除第一种情况,得出 $A$ 中所有的元素都落在阴影区域中,即 + +$$\Pr_{a \in A}[\Delta(a, V) \le \delta] = 1 .$$ + +而 Correlated Agreement 定理给出了更加具体的结论,说的是在折叠之前的元素 $u_{i}$ 与在编码空间 $V$ 中找到的码字 $v_{i}$ 之间的关系。 例如,Prover 想证明的是一个多项式 $f \in \mathrm{RS}[\mathbb{F}_q, \mathcal{D}^{(0)}, k]$ ,设 $\mathcal{D}^{(0)} = \{x_1, \ldots, x_n\}$ ,计算 $\{f(x_1), \ldots, f(x_n)\}$ ,Prover 就会将这些值的 oracle 发送给 Verifier ,实际中会采用 Merkle 树的方式来实现 oracle。