HyperNova folding prover. Folds circuit instances into accumulators, deferring PCS verification. More...

#include <hypernova_prover.hpp>

Public Types
using	FF = MegaFlavor::FF

using	Commitment = MegaFlavor::Commitment

using	Accumulator = MultilinearBatchingProverClaim

using	Transcript = MegaFlavor::Transcript

Public Member Functions
	HypernovaFoldingProver (std::shared_ptr< Transcript > transcript)

template<typename InstanceFlavor >
Accumulator	instance_to_accumulator (const std::shared_ptr< ProverInstance_< InstanceFlavor > > &instance, const std::shared_ptr< typename InstanceFlavor::VerificationKey > &honk_vk=nullptr)
	Turn an instance into an accumulator by running Sumcheck.

template<typename InstanceFlavor >
HonkProof	accumulate_instance (const std::shared_ptr< ProverInstance_< InstanceFlavor > > &instance, const std::shared_ptr< typename InstanceFlavor::VerificationKey > &honk_vk=nullptr)
	Turn an instance into an accumulator and cache the resulting claim for the final batching.

std::pair< HonkProof, Accumulator >	finalize (std::optional< Accumulator > previous_accumulator=std::nullopt)
	Batch the previous accumulator (if any) and the cached claims into a single accumulator.

HonkProof	export_proof ()
	Export the proof contained in the transcript.

const std::vector< Accumulator > &	get_cached_claims () const

Private Member Functions
template<typename InstanceFlavor >
Accumulator	sumcheck_output_to_accumulator (SumcheckOutput< InstanceFlavor > &sumcheck_output, const std::shared_ptr< ProverInstance_< InstanceFlavor > > &instance, const std::shared_ptr< typename InstanceFlavor::VerificationKey > &honk_vk)
	Convert the output of the sumcheck run on the incoming instance into an accumulator.

Static Private Member Functions
template<size_t N>
static Polynomial< FF >	batch_polynomials (RefArray< Polynomial< FF >, N > polynomials_to_batch, const size_t &full_batched_size, const std::vector< FF > &challenges)
	Batch prover polynomials. Batching happens in place into the first polynomial in the RefArray supplied.

template<size_t N>
static Commitment	batch_mul (std::span< Commitment, N > _points, std::vector< FF > &scalars)
	Utility to perform batch mul of commitments.

Private Attributes
std::shared_ptr< Transcript >	transcript

std::vector< Accumulator >	cached_claims

Detailed Description

HyperNova folding prover. Folds circuit instances into accumulators, deferring PCS verification.

See: chonk/README.md#hypernova-folding-details

Accumulator Concept

An Accumulator represents batched polynomial evaluation claims from one or more circuits. Instead of verifying each circuit's PCS separately, we batch claims into an accumulator and defer verification to a final "decider" proof. This enables efficient recursion.

Each accumulator contains:

challenge: The evaluation point (from Sumcheck)
non_shifted_{polynomial,commitment,evaluation}: Batched claims for standard polynomials
shifted_{polynomial,commitment,evaluation}: Batched claims for shifted polynomials

Shifted vs Unshifted Polynomials

Unshifted: Standard witness/selector polynomials evaluated at point r
Shifted: Polynomials referencing the "next row" in relations. We enforce p(0) = 0, so p(X)/X is a polynomial. The shift is p(X)/X evaluated at r, i.e., p(r)/r. Same commitment works for both p and its shift (no separate commitment needed).

The batching formula: batched = Σᵢ ρᵢ·pᵢ where ρᵢ are Fiat-Shamir challenges.

Note: The class is not templated on a single flavor — its incoming-instance methods take an InstanceFlavor template parameter so circuits of different flavors (e.g. MegaAppFlavor for apps and MegaKernelFlavor for kernels) can all be folded into the same Accumulator.

Lifecycle

Construct → accumulate_instance() once per incoming circuit → finalize(previous_accumulator) exactly once, where previous_accumulator is the previously-owned accumulator. SINGLE-USE: one prover drives exactly one folding group

Definition at line 57 of file hypernova_prover.hpp.

Member Typedef Documentation

◆ Accumulator

using bb::HypernovaFoldingProver::Accumulator = MultilinearBatchingProverClaim

Definition at line 61 of file hypernova_prover.hpp.

◆ Commitment

using bb::HypernovaFoldingProver::Commitment = MegaFlavor::Commitment

Definition at line 60 of file hypernova_prover.hpp.

◆ FF

using bb::HypernovaFoldingProver::FF = MegaFlavor::FF

Definition at line 59 of file hypernova_prover.hpp.

◆ Transcript

using bb::HypernovaFoldingProver::Transcript = MegaFlavor::Transcript

Definition at line 62 of file hypernova_prover.hpp.

Constructor & Destructor Documentation

◆ HypernovaFoldingProver()

bb::HypernovaFoldingProver::HypernovaFoldingProver ( std::shared_ptr< Transcript > transcript )

inline

Definition at line 64 of file hypernova_prover.hpp.

Member Function Documentation

◆ accumulate_instance()

template<typename InstanceFlavor >

HonkProof bb::HypernovaFoldingProver::accumulate_instance	(	const std::shared_ptr< ProverInstance_< InstanceFlavor > > &	instance,
		const std::shared_ptr< typename InstanceFlavor::VerificationKey > &	honk_vk = `nullptr`
	)

inline

Turn an instance into an accumulator and cache the resulting claim for the final batching.

Returns: This instance's proof slice (Oink + Sumcheck), exported from the shared transcript.

Definition at line 115 of file hypernova_prover.hpp.

◆ batch_mul()

template<size_t N>

static Commitment bb::HypernovaFoldingProver::batch_mul	(	std::span< Commitment, N >	_points,
		std::vector< FF > &	scalars
	)

inlinestaticprivate

Utility to perform batch mul of commitments.

Definition at line 253 of file hypernova_prover.hpp.

◆ batch_polynomials()

template<size_t N>

static Polynomial< FF > bb::HypernovaFoldingProver::batch_polynomials	(	RefArray< Polynomial< FF >, N >	polynomials_to_batch,
		const size_t &	full_batched_size,
		const std::vector< FF > &	challenges
	)

inlinestaticprivate

Batch prover polynomials. Batching happens in place into the first polynomial in the RefArray supplied.

Definition at line 214 of file hypernova_prover.hpp.

◆ export_proof()

HonkProof bb::HypernovaFoldingProver::export_proof ( )

inline

Export the proof contained in the transcript.

Definition at line 155 of file hypernova_prover.hpp.

◆ finalize()

std::pair< HonkProof, Accumulator > bb::HypernovaFoldingProver::finalize ( std::optional< Accumulator > previous_accumulator = std::nullopt )

inline

Batch the previous accumulator (if any) and the cached claims into a single accumulator.

The previous accumulator is claim 0, followed by the cached per-instance claims in order. With a single assembled claim there is nothing to batch: it is returned and an empty proof is returned. With two or more, the MultilinearBatching sumcheck is run and its proof returned.

Definition at line 128 of file hypernova_prover.hpp.

◆ get_cached_claims()

const std::vector< Accumulator > & bb::HypernovaFoldingProver::get_cached_claims ( ) const

inline

Definition at line 158 of file hypernova_prover.hpp.

◆ instance_to_accumulator()

template<typename InstanceFlavor >

Accumulator bb::HypernovaFoldingProver::instance_to_accumulator	(	const std::shared_ptr< ProverInstance_< InstanceFlavor > > &	instance,
		const std::shared_ptr< typename InstanceFlavor::VerificationKey > &	honk_vk = `nullptr`
	)

inline

Turn an instance into an accumulator by running Sumcheck.

Definition at line 71 of file hypernova_prover.hpp.

◆ sumcheck_output_to_accumulator()

template<typename InstanceFlavor >

Accumulator bb::HypernovaFoldingProver::sumcheck_output_to_accumulator	(	SumcheckOutput< InstanceFlavor > &	sumcheck_output,
		const std::shared_ptr< ProverInstance_< InstanceFlavor > > &	instance,
		const std::shared_ptr< typename InstanceFlavor::VerificationKey > &	honk_vk
	)

inlineprivate

Convert the output of the sumcheck run on the incoming instance into an accumulator.

Definition at line 168 of file hypernova_prover.hpp.

Member Data Documentation

◆ cached_claims

std::vector<Accumulator> bb::HypernovaFoldingProver::cached_claims

private

Definition at line 162 of file hypernova_prover.hpp.

◆ transcript

std::shared_ptr<Transcript> bb::HypernovaFoldingProver::transcript

private

Definition at line 161 of file hypernova_prover.hpp.

The documentation for this class was generated from the following file:

src/barretenberg/hypernova/hypernova_prover.hpp

Public Types

Public Member Functions

Private Member Functions

Static Private Member Functions

Private Attributes

Detailed Description

Accumulator Concept

Shifted vs Unshifted Polynomials

Lifecycle

Member Typedef Documentation

◆ Accumulator

◆ Commitment

◆ FF

◆ Transcript

Constructor & Destructor Documentation

◆ HypernovaFoldingProver()

Member Function Documentation

◆ accumulate_instance()

◆ batch_mul()

◆ batch_polynomials()

◆ export_proof()

◆ finalize()

◆ get_cached_claims()

◆ instance_to_accumulator()

◆ sumcheck_output_to_accumulator()

Member Data Documentation

◆ cached_claims

◆ transcript