feat: protogalaxy combiner quotient

barretenberg/cpp/src/barretenberg/flavor/flavor.hpp

@@ -15,7 +15,7 @@
  * relationships between these. We aim for a more uniform treatment, to enfore identical and informative naming, and to
  * prevent the developer having to think very much about the ordering of protocol entities in disparate places.
  *
- * Another motivation is iterate on the polynomial manifest of plonk, which is nice in its compatness, but which feels
+ * Another motivation is iterate on the polynomial manifest of plonk, which is nice in its compactness, but which feels
  * needlessly manual and low-level. In the past, this contained even more boolean parameters, making it quite hard to
  * parse. A typical construction is to loop over the polynomial manifest by extracting a globally-defined
  * "FOO_MANIFEST_SIZE" (the use of "manifest" here is distinct from the manifests in the transcript) to loop

barretenberg/cpp/src/barretenberg/honk/composer/ultra_transcript.test.cpp

@@ -220,38 +220,3 @@ TEST_F(UltraTranscriptTests, StructureTest)
     prover.transcript.deserialize_full_transcript();
     EXPECT_EQ(static_cast<Flavor::Commitment>(prover.transcript.sorted_accum_comm), one_group_val * rand_val);
 }
-
-TEST_F(UltraTranscriptTests, FoldingManifestTest)
-{
-    using Flavor = flavor::Ultra;
-    auto composer = UltraComposer();
-
-    std::vector<std::shared_ptr<ProverInstance_<Flavor>>> insts(2);
-    std::generate(insts.begin(), insts.end(), [&]() {
-        auto builder = proof_system::UltraCircuitBuilder();
-        generate_random_test_circuit(builder);
-        return composer.create_instance(builder);
-    });
-
-    // artificially make first instance relaxed
-    auto log_instance_size = static_cast<size_t>(numeric::get_msb(insts[0]->proving_key->circuit_size));
-    std::vector<FF> betas(log_instance_size);
-    for (size_t idx = 0; idx < log_instance_size; idx++) {
-        betas[idx] = FF::random_element();
-    }
-    insts[0]->folding_parameters = { betas, FF(1) };
-
-    auto prover = composer.create_folding_prover(insts);
-    auto verifier = composer.create_folding_verifier(insts);
-
-    auto prover_res = prover.fold_instances();
-    verifier.fold_public_parameters(prover_res.folding_data);
-
-    // Check consistency between the manifests generated by the prover and verifier
-    auto prover_manifest = prover.transcript.get_manifest();
-    auto verifier_manifest = verifier.transcript.get_manifest();
-    for (size_t round = 0; round < prover_manifest.size(); ++round) {
-        ASSERT_EQ(prover_manifest[round], verifier_manifest[round])
-            << "Prover/Verifier manifest discrepency in round " << round;
-    }
-}

barretenberg/cpp/src/barretenberg/honk/proof_system/barycentric.py

@@ -0,0 +1,32 @@
+import numpy as np
+
+
+def get_A_at_z(z, xs):
+    result = 1
+    for x in xs:
+        result *= (z - x)
+    return result
+
+def get_A_deriv(i, xs):
+    result = 1
+    xi = xs[i]
+    for j in range(len(xs)):
+        if j != i:
+            result *= (xi - xs[j])
+    return result
+
+
+
+points = [2,3]
+evals = [2, 3]
+
+z = 5
+
+result = get_A_at_z(z, points)
+s = 0
+for i in range(len(evals)):
+    s += evals[i] / ((z - points[i])* get_A_deriv(i, points))
+result *= s
+print(result)
+
+

barretenberg/cpp/src/barretenberg/honk/proof_system/combiner.test.cpp

@@ -35,7 +35,7 @@ TEST(Protogalaxy, CombinerOn2Instances)
             std::vector<std::shared_ptr<ProverInstance>> instance_data(NUM_INSTANCES);
             std::array<std::array<Polynomial, Flavor::NUM_ALL_ENTITIES>, NUM_INSTANCES> storage_arrays;
             ProtoGalaxyProver prover;
-            auto pow_univariate = PowUnivariate<FF>(/*zeta_pow=*/2);
+            std::vector<FF> pow_betas = { FF(1), FF(2) };
             auto alpha = FF(0); // focus on the arithmetic relation only
 
             for (size_t idx = 0; idx < NUM_INSTANCES; idx++) {
@@ -50,27 +50,27 @@ TEST(Protogalaxy, CombinerOn2Instances)
 
             ProverInstances instances{ instance_data };
 
-            auto result = prover.compute_combiner(instances, pow_univariate, alpha);
+            auto result = prover.compute_combiner(instances, pow_betas, alpha);
             auto expected_result =
                 barretenberg::Univariate<FF, 13>(std::array<FF, 13>{ 87706,
-                                                                     27289140,
-                                                                     229355214,
-                                                                     905031784,
-                                                                     static_cast<uint64_t>(2504059650),
-                                                                     static_cast<uint64_t>(5627174556),
-                                                                     static_cast<uint64_t>(11026107190),
-                                                                     static_cast<uint64_t>(19603583184),
-                                                                     static_cast<uint64_t>(32413323114),
-                                                                     static_cast<uint64_t>(50660042500),
-                                                                     static_cast<uint64_t>(75699451806),
-                                                                     static_cast<uint64_t>(109038256440),
-                                                                     static_cast<uint64_t>(152334156754) });
+                                                                     13644570,
+                                                                     76451738,
+                                                                     226257946,
+                                                                     static_cast<uint64_t>(500811930),
+                                                                     static_cast<uint64_t>(937862426),
+                                                                     static_cast<uint64_t>(1575158170),
+                                                                     static_cast<uint64_t>(2450447898),
+                                                                     static_cast<uint64_t>(3601480346),
+                                                                     static_cast<uint64_t>(5066004250),
+                                                                     static_cast<uint64_t>(6881768346),
+                                                                     static_cast<uint64_t>(9086521370),
+                                                                     static_cast<uint64_t>(11718012058) });
             EXPECT_EQ(result, expected_result);
         } else {
             std::vector<std::shared_ptr<ProverInstance>> instance_data(NUM_INSTANCES);
             std::array<std::array<Polynomial, Flavor::NUM_ALL_ENTITIES>, NUM_INSTANCES> storage_arrays;
             ProtoGalaxyProver prover;
-            auto pow_univariate = PowUnivariate<FF>(/*zeta_pow=*/2);
+            std::vector<FF> pow_betas = { FF(1), FF(2) };
             auto alpha = FF(0); // focus on the arithmetic relation only
 
             for (size_t idx = 0; idx < NUM_INSTANCES; idx++) {
@@ -129,9 +129,10 @@ TEST(Protogalaxy, CombinerOn2Instances)
             relation value:
                       0    0    0    0    0    0    0              0    0    6   18   36   60   90      */
 
-            auto result = prover.compute_combiner(instances, pow_univariate, alpha);
+            auto result = prover.compute_combiner(instances, pow_betas, alpha);
             auto expected_result = barretenberg::Univariate<FF, 13>(
-                std::array<FF, 13>{ 0, 0, 36, 144, 360, 720, 1260, 2016, 3024, 4320, 5940, 7920, 10296 });
+                std::array<FF, 13>{ 0, 0, 12, 36, 72, 120, 180, 252, 336, 432, 540, 660, 792 });
+
             EXPECT_EQ(result, expected_result);
         }
     };
@@ -161,8 +162,8 @@ TEST(Protogalaxy, CombinerOn4Instances)
         std::vector<std::shared_ptr<ProverInstance>> instance_data(NUM_INSTANCES);
         std::array<std::array<Polynomial, Flavor::NUM_ALL_ENTITIES>, NUM_INSTANCES> storage_arrays;
         ProtoGalaxyProver prover;
-        auto pow_univariate = PowUnivariate<FF>(/*zeta_pow=*/2);
         auto alpha = FF(0); // focus on the arithmetic relation only
+        std::vector<FF> pow_betas = { FF(1), FF(2) };
 
         for (size_t idx = 0; idx < NUM_INSTANCES; idx++) {
             auto instance = std::make_shared<ProverInstance>();
@@ -180,7 +181,7 @@ TEST(Protogalaxy, CombinerOn4Instances)
         zero_all_selectors(instances[2]->prover_polynomials);
         zero_all_selectors(instances[3]->prover_polynomials);
 
-        auto result = prover.compute_combiner(instances, pow_univariate, alpha);
+        auto result = prover.compute_combiner(instances, pow_betas, alpha);
         std::array<FF, 37> zeroes;
         std::fill(zeroes.begin(), zeroes.end(), 0);
         auto expected_result = barretenberg::Univariate<FF, 37>(zeroes);

barretenberg/cpp/src/barretenberg/honk/proof_system/combiner_example_gen.py

@@ -87,6 +87,12 @@ def get_extended_univariates(instances, row_idx):
         result = np.array(extend_one_entity(result))
         return result
 
+
+def compute_lagrange(points):
+    lagrange_0 = np.array([])
+    lagrange_1 = np.array([])
+
+
 def compute_first_example():
     i0 = Instance([Row(0), Row(1)])
     i1 = Instance([Row(128), Row(129)])
@@ -104,7 +110,6 @@ def compute_first_example():
         accumulator += zeta_pow * relation_value
         zeta_pow *= zeta
 
-    accumulator *= extend_one_entity([1, 2])
     return accumulator
 
 
@@ -134,7 +139,6 @@ def compute_second_example():
         result += rel(w_l, w_r, w_o, q_m, q_l, q_r, q_o, q_c)
         result *= 2
 
-        result *= extend_one_entity([1, 2])
         return result
 
 if __name__ == "__main__":

barretenberg/cpp/src/barretenberg/honk/proof_system/folding_result.hpp

@@ -17,7 +17,7 @@ template <class Flavor> struct VerifierFoldingResult {
     using VerificationKey = typename Flavor::VerificationKey;
     using FoldingParameters = typename Flavor::FoldingParameters;
     std::vector<FF> folded_public_inputs;
-    VerificationKey folded_verification_key;
+    std::shared_ptr<VerificationKey> folded_verification_key;
     FoldingParameters parameters;
 };
 

barretenberg/cpp/src/barretenberg/honk/proof_system/protogalaxy.test.cpp

@@ -1,4 +1,5 @@
 #include "barretenberg/honk/composer/ultra_composer.hpp"
+#include "barretenberg/honk/utils/testing.hpp"
 #include "protogalaxy_prover.hpp"
 #include <gtest/gtest.h>
 
@@ -11,7 +12,9 @@ using Instances = ProverInstances_<Flavor, 2>;
 using ProtoGalaxyProver = ProtoGalaxyProver_<Instances>;
 using FF = Flavor::FF;
 using Builder = Flavor::CircuitBuilder;
+using Polynomial = typename Flavor::Polynomial;
 using ProverPolynomials = Flavor::ProverPolynomials;
+using RelationParameters = proof_system::RelationParameters<FF>;
 const size_t NUM_POLYNOMIALS = Flavor::NUM_ALL_ENTITIES;
 
 namespace protogalaxy_tests {
@@ -128,7 +131,7 @@ TEST_F(ProtoGalaxyTests, PerturbatorCoefficients)
     }
 }
 
-TEST_F(ProtoGalaxyTests, PowPerturbatorPolynomial)
+TEST_F(ProtoGalaxyTests, PerturbatorPolynomial)
 {
     const size_t log_instance_size(3);
     const size_t instance_size(1 << log_instance_size);
@@ -148,17 +151,8 @@ TEST_F(ProtoGalaxyTests, PowPerturbatorPolynomial)
         betas[idx] = FF::random_element();
     }
 
-    // Construct pow(\vec{betas}) manually as in the paper
-    std::vector<FF> pow_beta(instance_size);
-    for (size_t i = 0; i < instance_size; i++) {
-        auto res = FF(1);
-        for (size_t j = i, beta_idx = 0; j > 0; j >>= 1, beta_idx++) {
-            if ((j & 1) == 1) {
-                res *= betas[beta_idx];
-            }
-        }
-        pow_beta[i] = res;
-    }
+    // Construct pow(\vec{betas}) as in the paper
+    auto pow_beta = ProtoGalaxyProver::compute_pow_polynomial_at_values(betas, instance_size);
 
     // Compute the corresponding target sum and create a dummy accumulator
     auto target_sum = FF(0);
@@ -180,6 +174,34 @@ TEST_F(ProtoGalaxyTests, PowPerturbatorPolynomial)
     EXPECT_EQ(perturbator[0], target_sum);
 }
 
+TEST_F(ProtoGalaxyTests, CombinerQuotient)
+{
+    auto compressed_perturbator = FF(2); // F(\alpha) in the paper
+    auto combiner =
+        barretenberg::Univariate<FF, 13>(std::array<FF, 13>{ 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32 });
+    auto combiner_quotient = ProtoGalaxyProver::compute_combiner_quotient(compressed_perturbator, combiner);
+
+    // K(i) = (G(i) - ( L_0(i) * F(\alpha)) / Z(i), i = {2,.., 13} for ProverInstances::NUM = 2
+    // K(i) = (G(i) - (1 - i) * F(\alpha)) / i * (i - 1)
+    auto expected_evals = barretenberg::Univariate<FF, 13, 2>(std::array<FF, 11>{
+        (FF(22) - (FF(1) - FF(2)) * compressed_perturbator) / (FF(2) * FF(2 - 1)),
+        (FF(23) - (FF(1) - FF(3)) * compressed_perturbator) / (FF(3) * FF(3 - 1)),
+        (FF(24) - (FF(1) - FF(4)) * compressed_perturbator) / (FF(4) * FF(4 - 1)),
+        (FF(25) - (FF(1) - FF(5)) * compressed_perturbator) / (FF(5) * FF(5 - 1)),
+        (FF(26) - (FF(1) - FF(6)) * compressed_perturbator) / (FF(6) * FF(6 - 1)),
+        (FF(27) - (FF(1) - FF(7)) * compressed_perturbator) / (FF(7) * FF(7 - 1)),
+        (FF(28) - (FF(1) - FF(8)) * compressed_perturbator) / (FF(8) * FF(8 - 1)),
+        (FF(29) - (FF(1) - FF(9)) * compressed_perturbator) / (FF(9) * FF(9 - 1)),
+        (FF(30) - (FF(1) - FF(10)) * compressed_perturbator) / (FF(10) * FF(10 - 1)),
+        (FF(31) - (FF(1) - FF(11)) * compressed_perturbator) / (FF(11) * FF(11 - 1)),
+        (FF(32) - (FF(1) - FF(12)) * compressed_perturbator) / (FF(12) * FF(12 - 1)),
+    });
+
+    for (size_t idx = 2; idx < 7; idx++) {
+        EXPECT_EQ(combiner_quotient.value_at(idx), expected_evals.value_at(idx));
+    }
+}
+
 TEST_F(ProtoGalaxyTests, FoldChallenges)
 {
     using Instances = ProverInstances_<Flavor, 2>;
@@ -201,26 +223,4 @@ TEST_F(ProtoGalaxyTests, FoldChallenges)
     EXPECT_EQ(instances.relation_parameters.eta, expected_eta);
 }
 
-// namespace proof_system::honk::instance_tests {
-
-// template <class Flavor> class InstancesTests : public testing::Test {
-//     using FF = typename Flavor::FF;
-//     using Builder = typename Flavor::CircuitBuilder;
-
-//   public:
-//     static void test_parameters_to_univariates()
-//     {
-
-//     };
-// };
-
-// using FlavorTypes = testing::Types<flavor::Ultra>;
-// TYPED_TEST_SUITE(InstancesTests, FlavorTypes);
-
-// TYPED_TEST(InstancesTests, ParametersToUnivariates)
-// {
-//     TestFixture::test_parameters_to_univariates();
-// }
-
-// } // namespace proof_system::honk::instance_tests
 } // namespace protogalaxy_tests

barretenberg/cpp/src/barretenberg/honk/proof_system/protogalaxy_prover.cpp

@@ -4,7 +4,6 @@ namespace proof_system::honk {
 
 template <class ProverInstances> void ProtoGalaxyProver_<ProverInstances>::prepare_for_folding()
 {
-    // this doesnt work in the current format
     auto idx = 0;
     for (auto it = instances.begin(); it != instances.end(); it++, idx++) {
         auto instance = *it;
@@ -24,8 +23,6 @@ template <class ProverInstances> void ProtoGalaxyProver_<ProverInstances>::prepa
             transcript.send_to_verifier(domain_separator + "_public_input_" + std::to_string(i), public_input_i);
         }
 
-        // TODO(https://github.com/AztecProtocol/barretenberg/issues/752): establish whether we can use the same grand
-        // product parameters for all instances securely
         auto [eta, beta, gamma] = transcript.get_challenges(
             domain_separator + "_eta", domain_separator + "_beta", domain_separator + "_gamma");
         instance->compute_sorted_accumulator_polynomials(eta);
@@ -42,18 +39,47 @@ ProverFoldingResult<typename ProverInstances::Flavor> ProtoGalaxyProver_<ProverI
     prepare_for_folding();
     // TODO(#https://github.com/AztecProtocol/barretenberg/issues/740): Handle the case where we are folding for the
     // first time and accumulator is 0
+    // TODO(#https://github.com/AztecProtocol/barretenberg/issues/763): Fold alpha
     auto [alpha, delta] = transcript.get_challenges("alpha", "delta");
     auto accumulator = get_accumulator();
     auto instance_size = accumulator->prover_polynomials[0].size();
-    auto log_instance_size = static_cast<size_t>(numeric::get_msb(instance_size));
+    const auto log_instance_size = static_cast<size_t>(numeric::get_msb(instance_size));
     auto deltas = compute_round_challenge_pows(log_instance_size, delta);
-    auto perturbator = compute_perturbator(accumulator, deltas, alpha);
 
+    auto perturbator = compute_perturbator(accumulator, deltas, alpha);
     for (size_t idx = 0; idx <= log_instance_size; idx++) {
         transcript.send_to_verifier("perturbator_" + std::to_string(idx), perturbator[idx]);
     }
 
+    auto perturbator_challenge = transcript.get_challenge("perturbator_challenge");
+    auto compressed_perturbator = perturbator.evaluate(perturbator_challenge);
+    std::vector<FF> betas_star(log_instance_size);
+    betas_star[0] = 1;
+    auto betas = accumulator->folding_parameters.gate_separation_challenges;
+    for (size_t idx = 1; idx < log_instance_size; idx++) {
+        betas_star[idx] = betas[idx] + perturbator_challenge * deltas[idx - 1];
+    }
+
+    auto pow_betas_star = compute_pow_polynomial_at_values(betas_star, instance_size);
+
+    auto combiner = compute_combiner(instances, pow_betas_star, alpha);
+    auto combiner_quotient = compute_combiner_quotient(compressed_perturbator, combiner);
+    for (size_t idx = ProverInstances::NUM; idx < combiner.size(); idx++) {
+        transcript.send_to_verifier("combiner_quotient_" + std::to_string(idx), combiner_quotient.value_at(idx));
+    }
+    auto combiner_challenge = transcript.get_challenge("combiner_qoutient_challenge");
+    auto combiner_quotient_at_challenge = combiner_quotient.evaluate(combiner_challenge);
+
+    // TODO(https://github.com/AztecProtocol/barretenberg/issues/764): Generalise these formulas as well as computation
+    // of Lagrange basis
+    auto vanishing_polynomial_at_challenge = combiner_challenge * (combiner_challenge - FF(1));
+    auto lagrange_0_at_challenge = FF(1) - combiner_challenge;
+
+    auto new_target_sum = compressed_perturbator * lagrange_0_at_challenge +
+                          vanishing_polynomial_at_challenge * combiner_quotient_at_challenge;
+
     ProverFoldingResult<Flavor> res;
+    res.params.target_sum = new_target_sum;
     res.folding_data = transcript.proof_data;
     return res;
 }