FLI: Folding Lookup Instances
摘要
We introduce two folding schemes for lookup instances: FLI and FLI+SOS. Both use a PIOP to check that a matrix has elementary basis vectors as rows, with FLI+SOS adding a twist based on Lasso’s [26] SOS-decomposability. FLI takes two lookup instances \(\{\textbf{a}_1\}, \{\textbf{a}_2\}\subseteq \{\textbf{t}\}\) , and expresses them as matrix equations \(M_i\cdot \textbf{t}^\textsf{T}=\textbf{a}_i^\textsf{T}\) for \(i=1,2\) , where each matrix \(M_i\in \mathbb {F}^{m\times N}\) has rows which are elementary basis vectors in \(\mathbb {F}^N\) . Matrices that satisfy this condition are said to be in \(\textbf{R}_{\textsf{elem}}\) . Then, a folding scheme for \(\textbf{R}_{\textsf{elem}}\) into a relaxed relation is used, which combines the matrices \(M_1, M_2\) as \(M_1+\alpha M_2\) for a random \(\alpha \in \mathbb {F}\) . Finally, the lookup equations are combined as \((M_1+\alpha M_2)\cdot \textbf{t}^\textsf{T}= (\textbf{a}_1+\alpha \textbf{a}_2)^\textsf{T}\) . In FLI, only the property that a matrix is in \(\textbf{R}_{\textsf{elem}}\) is folded, and this makes the FLI folding step the cheapest among existing solutions. The price to pay is in the cost for proving accumulated instances. FLI+SOS builds upon FLI to enable folding of large SOS-decomposable [26] tables. This is achieved through a variation of Lasso’s approach to SOS-decomposability, which fits FLI naturally. For comparison, we describe (for the first time to our knowledge) straightforward variations of Protostar [5] and Proofs for Deep Thought [7] that also benefit from SOS-decomposability. We see that for many reasonable parameter choices, and especially those arising from lookup-based zkVMs [1], FLI+SOS can concretely be the cheapest folding solution.