multilinear_batching.test.cpp

Go to the documentation of this file.

// === AUDIT STATUS ===
// internal:    { status: not started, auditors: [], commit: }
// external_1:  { status: not started, auditors: [], commit: }
// external_2:  { status: not started, auditors: [], commit: }
// =====================
 
#include "barretenberg/hypernova/hypernova_decider_prover.hpp"
#include "barretenberg/multilinear_batching/multilinear_batching_prover.hpp"
#include "barretenberg/multilinear_batching/multilinear_batching_verifier.hpp"
 
#include "barretenberg/circuit_checker/circuit_checker.hpp"
#include "barretenberg/commitment_schemes/commitment_key.hpp"
#include "barretenberg/common/test.hpp"
#include "barretenberg/polynomials/eq_polynomial.hpp"
#include "barretenberg/srs/global_crs.hpp"
#include "barretenberg/stdlib/proof/proof.hpp"
#include "barretenberg/stdlib_circuit_builders/mega_circuit_builder.hpp"
#include "barretenberg/transcript/transcript.hpp"
 
#include <vector>
 
using namespace bb;
 
namespace {
 
using Curve = curve::BN254;
using FF = Curve::ScalarField;
using Commitment = Curve::AffineElement;
using ProverClaim = MultilinearBatchingProverClaim;
using VerifierClaim = MultilinearBatchingVerifierClaim<Curve>;
using NativeTranscriptType = NativeTranscript;
 
// Base log-size of the slot polynomials used in the tests. To exercise the protocol's support for mixed-size inputs,
// claim i is built on 2^(LOG_N_BASE + i) points (so three claims use LOG_N 5, 6, 7). The protocol pads every
// polynomial up to 2^VIRTUAL_LOG_N virtual variables, so the actual sizes only need to be small.
constexpr size_t LOG_N_BASE = 5;
constexpr size_t VIRTUAL_LOG_N = MultilinearBatchingFlavor::VIRTUAL_LOG_N;
// Per round univariate length (the relation is degree 2, so 3 evaluations per round).
constexpr size_t UNIVARIATE_LENGTH = MultilinearBatchingFlavor::BATCHED_RELATION_PARTIAL_LENGTH;
// In production the batching transcript is shared and already holds the group's instance sumchecks, so the first
// batching challenge is never drawn from an empty transcript. The standalone tests reproduce that by sending one seed
// field element first; it occupies index 0 of every exported proof.
constexpr size_t SEED_FRS = 1;
// Offset, in field elements, of the "Sumcheck:evaluations" block within an exported batching proof: it follows the
// seed element and the VIRTUAL_LOG_N round univariates.
constexpr size_t EVALS_OFFSET = SEED_FRS + (VIRTUAL_LOG_N * UNIVARIATE_LENGTH);
 
enum class FaultMode : uint8_t {
    NONE,
    // The next six faults corrupt a verifier-held input claim so the sumcheck target / eq-consistency check is wrong.
    // Each of the three batched components (non-shifted eval, shifted eval, eq polynomial via the claim's challenge) is
    // targeted on both the first claim (batched with coefficient γ^0 = 1) and the second claim (coefficient γ^1 = γ).
    FALSE_NONSHIFTED_EVAL_FIRST,  // wrong non-shifted evaluation on claim 0
    FALSE_NONSHIFTED_EVAL_SECOND, // wrong non-shifted evaluation on claim 1
    FALSE_SHIFTED_EVAL_FIRST,     // wrong shifted evaluation on claim 0
    FALSE_SHIFTED_EVAL_SECOND,    // wrong shifted evaluation on claim 1
    FALSE_EQ_FIRST,               // wrong challenge on claim 0 -> eq polynomial mismatch
    FALSE_EQ_SECOND,              // wrong challenge on claim 1 -> eq polynomial mismatch
    // The next six faults corrupt one prover-sent claimed evaluation in the proof. The non-shifted/shifted variants
    // break the sumcheck final relation check; the eq variants break eq-consistency. Each of the three components is
    // tampered on both the first claim (idx 0) and the second claim (idx 1).
    TAMPER_NONSHIFTED_EVAL_FIRST,  // corrupt claimed non-shifted evaluation of claim 0
    TAMPER_NONSHIFTED_EVAL_SECOND, // corrupt claimed non-shifted evaluation of claim 1
    TAMPER_SHIFTED_EVAL_FIRST,     // corrupt claimed shifted evaluation of claim 0
    TAMPER_SHIFTED_EVAL_SECOND,    // corrupt claimed shifted evaluation of claim 1
    TAMPER_EQ_EVAL_FIRST,          // corrupt claimed eq evaluation of claim 0
    TAMPER_EQ_EVAL_SECOND,         // corrupt claimed eq evaluation of claim 1
    WRONG_NONSHIFTED_COMMITMENT,   // verifier holds a wrong input commitment -> output claim is not bound to it
    WRONG_SHIFTED_COMMITMENT,      // verifier holds a wrong input commitment -> output claim is not bound to it
    BREAK_EVAL_BINDING, // polynomial evaluations that keep the γ-weighted relation but break the ρ-merge binding
};
 
FF mle_padded(const Polynomial<FF>& poly, const std::vector<FF>& r, size_t log_n, bool shift = false)
{
    std::vector<FF> head(r.begin(), r.begin() + static_cast<std::ptrdiff_t>(log_n));
    FF value = poly.evaluate_mle(head, shift);
    for (size_t j = log_n; j < r.size(); ++j) {
        value *= (FF(1) - r[j]);
    }
    return value;
}
 
struct ClaimSet {
    std::vector<ProverClaim> prover_claims;
    std::vector<VerifierClaim> verifier_claims;
    // Copies of the polynomials used to recompute the honest output claim.
    std::vector<Polynomial<FF>> non_shifted_polynomials;
    std::vector<Polynomial<FF>> shifted_polynomials; // pre-shift form (start index 1)
    std::vector<size_t> log_ns;                      // per-claim log-size, needed to re-pad the MLE evaluations
};
 
ClaimSet build_honest_claims(size_t num_claims)
{
    // Claim i lives on 2^(LOG_N_BASE + i) points, so the largest claim sizes the commitment key (it can commit any
    // smaller polynomial using a prefix of the same SRS).
    const size_t max_dyadic_size = 1UL << (LOG_N_BASE + num_claims - 1);
    CommitmentKey<Curve> commitment_key(max_dyadic_size);
 
    ClaimSet set;
    for (size_t i = 0; i < num_claims; ++i) {
        const size_t log_n = LOG_N_BASE + i;
        const size_t dyadic_size = 1UL << log_n;
 
        // Independent random evaluation point per claim, of full sumcheck length.
        std::vector<FF> challenge(VIRTUAL_LOG_N);
        for (auto& c : challenge) {
            c = FF::random_element();
        }
 
        Polynomial<FF> non_shifted = Polynomial<FF>::random(dyadic_size);
        Polynomial<FF> shifted = Polynomial<FF>::random(dyadic_size - 1, dyadic_size, /*start_index=*/1);
 
        const FF non_shifted_eval = mle_padded(non_shifted, challenge, log_n);
        const FF shifted_eval = mle_padded(shifted, challenge, log_n, /*shift=*/true);
        const Commitment non_shifted_commitment = commitment_key.commit(non_shifted);
        const Commitment shifted_commitment = commitment_key.commit(shifted);
 
        set.non_shifted_polynomials.push_back(non_shifted);
        set.shifted_polynomials.push_back(shifted);
        set.log_ns.push_back(log_n);
 
        set.prover_claims.push_back(ProverClaim{ .challenge = challenge,
                                                 .non_shifted_evaluation = non_shifted_eval,
                                                 .shifted_evaluation = shifted_eval,
                                                 .non_shifted_polynomial = std::move(non_shifted),
                                                 .shifted_polynomial = std::move(shifted),
                                                 .non_shifted_commitment = non_shifted_commitment,
                                                 .shifted_commitment = shifted_commitment,
                                                 .dyadic_size = dyadic_size });
        set.verifier_claims.push_back(VerifierClaim{ .challenge = challenge,
                                                     .non_shifted_evaluation = non_shifted_eval,
                                                     .shifted_evaluation = shifted_eval,
                                                     .non_shifted_commitment = non_shifted_commitment,
                                                     .shifted_commitment = shifted_commitment });
    }
    return set;
}
 
struct DerivedChallenges {
    FF gamma;
    std::vector<FF> r;
    FF rho;
};
 
DerivedChallenges replay_challenges(const HonkProof& proof, size_t num_claims)
{
    auto transcript = std::make_shared<NativeTranscriptType>();
    transcript->load_proof(proof);
    [[maybe_unused]] FF seed = transcript->template receive_from_prover<FF>("init");
 
    DerivedChallenges out;
    out.gamma = transcript->template get_challenge<FF>("claim_batching_challenge");
    [[maybe_unused]] FF alpha = transcript->template get_challenge<FF>("Sumcheck:alpha");
    for (size_t round = 0; round < VIRTUAL_LOG_N; ++round) {
        for (size_t e = 0; e < UNIVARIATE_LENGTH; ++e) {
            [[maybe_unused]] FF _ = transcript->template receive_from_prover<FF>("u");
        }
        out.r.push_back(transcript->template get_challenge<FF>("Sumcheck:u_" + std::to_string(round)));
    }
    for (size_t e = 0; e < 3 * num_claims; ++e) {
        [[maybe_unused]] FF _ = transcript->template receive_from_prover<FF>("e");
    }
    out.rho = transcript->template get_challenge<FF>("claim_merge_challenge");
    return out;
}
 
bool output_claim_is_bound(const ClaimSet& set, const HonkProof& proof, const VerifierClaim& new_claim)
{
    auto powers = [](const FF& base, size_t count) {
        std::vector<FF> result(count);
        result[0] = FF(1);
        for (size_t i = 1; i < count; ++i) {
            result[i] = result[i - 1] * base;
        }
        return result;
    };
 
    const size_t num_claims = set.verifier_claims.size();
    const DerivedChallenges challenges = replay_challenges(proof, num_claims);
    const std::vector<FF> rho_powers = powers(challenges.rho, num_claims);
 
    FF expected_non_shifted_eval(0);
    FF expected_shifted_eval(0);
    std::vector<Commitment> non_shifted_commitments;
    std::vector<Commitment> shifted_commitments;
    for (size_t i = 0; i < num_claims; ++i) {
        expected_non_shifted_eval +=
            rho_powers[i] * mle_padded(set.non_shifted_polynomials[i], challenges.r, set.log_ns[i]);
        expected_shifted_eval +=
            rho_powers[i] * mle_padded(set.shifted_polynomials[i], challenges.r, set.log_ns[i], /*shift=*/true);
        non_shifted_commitments.push_back(set.verifier_claims[i].non_shifted_commitment);
        shifted_commitments.push_back(set.verifier_claims[i].shifted_commitment);
    }
    std::vector<FF> scalars = rho_powers;
    const Commitment expected_non_shifted_commitment = Curve::Element::batch_mul(non_shifted_commitments, scalars);
    const Commitment expected_shifted_commitment = Curve::Element::batch_mul(shifted_commitments, scalars);
 
    return new_claim.challenge == challenges.r && new_claim.non_shifted_evaluation == expected_non_shifted_eval &&
           new_claim.shifted_evaluation == expected_shifted_eval &&
           new_claim.non_shifted_commitment == expected_non_shifted_commitment &&
           new_claim.shifted_commitment == expected_shifted_commitment;
}
 
struct FaultyProof {
    ClaimSet set;
    std::vector<VerifierClaim> verifier_claims; // the verifier-held claims (some faults corrupt these)
    HonkProof proof;
};
 
FaultyProof build_faulty_proof(size_t num_claims, FaultMode fault)
{
    ClaimSet set = build_honest_claims(num_claims);
 
    // The verifier-held input claims; some faults corrupt these without touching the proof.
    std::vector<VerifierClaim> verifier_claims = set.verifier_claims;
    if (fault == FaultMode::FALSE_NONSHIFTED_EVAL_FIRST) {
        verifier_claims[0].non_shifted_evaluation += FF(1);
    } else if (fault == FaultMode::FALSE_NONSHIFTED_EVAL_SECOND) {
        verifier_claims[1].non_shifted_evaluation += FF(1);
    } else if (fault == FaultMode::FALSE_SHIFTED_EVAL_FIRST) {
        verifier_claims[0].shifted_evaluation += FF(1);
    } else if (fault == FaultMode::FALSE_SHIFTED_EVAL_SECOND) {
        verifier_claims[1].shifted_evaluation += FF(1);
    } else if (fault == FaultMode::FALSE_EQ_FIRST) {
        verifier_claims[0].challenge[0] += FF(1);
    } else if (fault == FaultMode::FALSE_EQ_SECOND) {
        verifier_claims[1].challenge[0] += FF(1);
    } else if (fault == FaultMode::WRONG_NONSHIFTED_COMMITMENT) {
        verifier_claims[0].non_shifted_commitment = verifier_claims[0].non_shifted_commitment + Commitment::one();
    } else if (fault == FaultMode::WRONG_SHIFTED_COMMITMENT) {
        verifier_claims[0].shifted_commitment = verifier_claims[0].shifted_commitment + Commitment::one();
    }
 
    auto prover_transcript = std::make_shared<NativeTranscriptType>();
    // Seed the transcript so the first batching challenge is not drawn from an empty hash buffer (see SEED_FRS).
    prover_transcript->send_to_verifier("init", FF::random_element());
    MultilinearBatchingProver prover(std::move(set.prover_claims), prover_transcript);
    HonkProof proof = prover.construct_proof();
 
    // Proof-side faults are applied after the honest proof is built; this maintains consistency of FS because the
    // prover doesn't send anything to the verifier after the claimed evaluations. The claimed-evaluation block is laid
    // out as [non_shifted(0..n-1)][shifted(0..n-1)][eq(0..n-1)] (see MultilinearBatchingFlavor::AllEntities).
    if (fault == FaultMode::TAMPER_NONSHIFTED_EVAL_FIRST) {
        proof[EVALS_OFFSET + 0] += FF(1);
    } else if (fault == FaultMode::TAMPER_NONSHIFTED_EVAL_SECOND) {
        proof[EVALS_OFFSET + 1] += FF(1);
    } else if (fault == FaultMode::TAMPER_SHIFTED_EVAL_FIRST) {
        proof[EVALS_OFFSET + num_claims + 0] += FF(1);
    } else if (fault == FaultMode::TAMPER_SHIFTED_EVAL_SECOND) {
        proof[EVALS_OFFSET + num_claims + 1] += FF(1);
    } else if (fault == FaultMode::TAMPER_EQ_EVAL_FIRST) {
        proof[EVALS_OFFSET + (2 * num_claims) + 0] += FF(1);
    } else if (fault == FaultMode::TAMPER_EQ_EVAL_SECOND) {
        proof[EVALS_OFFSET + (2 * num_claims) + 1] += FF(1);
    } else if (fault == FaultMode::BREAK_EVAL_BINDING) {
        // Perturb the first three non-shifted claimed evals by a δ that lies in the joint kernel of BOTH the sumcheck
        // final relation form (a·δ = 0, with a_i = γ^i·eq_i(r)) AND the γ-weighted merge (b·δ = 0, with b_i = γ^i),
        // Then:
        //   - the sumcheck and eq-consistency checks still pass (a·δ = 0), so `verified` stays true;
        //   - a hypothetical γ-weighted output merge would still be correct (b·δ = 0)
        //   - the fresh merge challenge ρ is drawn only after δ is committed, so Σ ρ^i δ_i ≠ 0 and the bound
        //     output claim is wrong. δ = a × b can be taken to be the cross product of the two vector a, b.
        const DerivedChallenges challenges = replay_challenges(proof, num_claims);
        std::array<FF, 3> eq;
        std::array<FF, 3> b; // b_i = γ^i
        b[0] = FF(1);
        for (size_t i = 0; i < 3; ++i) {
            eq[i] = VerifierEqPolynomial<FF>::eval(set.verifier_claims[i].challenge, challenges.r);
            if (i > 0) {
                b[i] = b[i - 1] * challenges.gamma;
            }
        }
        const std::array<FF, 3> a{ b[0] * eq[0], b[1] * eq[1], b[2] * eq[2] };
        const std::array<FF, 3> delta{ a[1] * b[2] - a[2] * b[1],
                                       a[2] * b[0] - a[0] * b[2],
                                       a[0] * b[1] - a[1] * b[0] };
        for (size_t i = 0; i < 3; ++i) {
            proof[EVALS_OFFSET + i] += delta[i];
        }
    }
 
    return { std::move(set), std::move(verifier_claims), std::move(proof) };
}
 
template <bool Recursive, size_t Claims> struct Config {
    static constexpr bool IsRecursive = Recursive;
    static constexpr size_t NumClaims = Claims;
};
 
template <typename Params> class MultilinearBatchingTests : public ::testing::Test {
  public:
    static constexpr bool IsRecursive = Params::IsRecursive;
    static constexpr size_t NumClaims = Params::NumClaims;
 
    static void SetUpTestSuite() { bb::srs::init_file_crs_factory(bb::srs::bb_crs_path()); }
 
    struct RunResult {
        bool verified;    // sumcheck + eq-consistency accepted (in-circuit value checks, for the recursive path)
        bool circuit_ok;  // recursive verifier circuit is satisfiable (always true for the native path)
        bool claim_bound; // the resulting accumulator opens to the honest batched polynomial
        bool accepted() const { return verified && circuit_ok && claim_bound; }
    };
 
    static RunResult run(FaultMode fault)
    {
        FaultyProof faulty = build_faulty_proof(NumClaims, fault);
 
        bool verified = false;
        bool circuit_ok = true;
        VerifierClaim new_claim;
 
        if constexpr (!IsRecursive) {
            auto transcript = std::make_shared<NativeTranscriptType>();
            transcript->load_proof(faulty.proof);
            [[maybe_unused]] FF seed = transcript->template receive_from_prover<FF>("init");
            MultilinearBatchingNativeVerifier verifier(transcript);
            std::tie(verified, new_claim) = verifier.verify_proof(faulty.verifier_claims);
        } else {
            using RecursiveVerifier = MultilinearBatchingRecursiveVerifier;
            using RecursiveCurve = typename RecursiveVerifier::Curve;
            using RecursiveClaim = MultilinearBatchingVerifierClaim<RecursiveCurve>;
            using RecursiveFF = typename RecursiveCurve::ScalarField;
 
            MegaCircuitBuilder builder;
            auto transcript = std::make_shared<typename RecursiveVerifier::Transcript>();
            typename RecursiveVerifier::Proof stdlib_proof(builder, faulty.proof);
            transcript->load_proof(stdlib_proof);
            [[maybe_unused]] RecursiveFF seed = transcript->template receive_from_prover<RecursiveFF>("init");
 
            std::vector<RecursiveClaim> recursive_claims;
            recursive_claims.reserve(faulty.verifier_claims.size());
            for (const auto& claim : faulty.verifier_claims) {
                RecursiveClaim recursive_claim =
                    RecursiveClaim::template stdlib_from_native<RecursiveCurve>(&builder, claim);
                // The claims stand in for values the kernel would receive already constrained; clear the free-witness
                // tags so the verifier's origin-tag mechanism does not flag them when they mix with transcript values.
                for (auto& challenge_element : recursive_claim.challenge) {
                    challenge_element.unset_free_witness_tag();
                }
                recursive_claim.non_shifted_evaluation.unset_free_witness_tag();
                recursive_claim.shifted_evaluation.unset_free_witness_tag();
                recursive_claim.non_shifted_commitment.unset_free_witness_tag();
                recursive_claim.shifted_commitment.unset_free_witness_tag();
                recursive_claims.push_back(std::move(recursive_claim));
            }
 
            RecursiveVerifier verifier(transcript);
            auto [verified_in_circuit, recursive_new_claim] = verifier.verify_proof(recursive_claims);
            verified = verified_in_circuit;
            circuit_ok = bb::CircuitChecker::check(builder);
            new_claim = recursive_new_claim.template get_value<VerifierClaim>();
        }
 
        const bool claim_bound = output_claim_is_bound(faulty.set, faulty.proof, new_claim);
        return { verified, circuit_ok, claim_bound };
    }
};
 
// Cover every supported batch width, 2 .. CHONK_MAX_CLAIMS_PER_KERNEL, in both the native and recursive verifier.
// the static_assert flags when bumping CHONK_MAX_CLAIMS_PER_KERNEL leaves a width uncovered
static_assert(CHONK_MAX_CLAIMS_PER_KERNEL == 7,
              "Update TestConfigs to cover every width in 2 .. CHONK_MAX_CLAIMS_PER_KERNEL.");
using TestConfigs = ::testing::Types<Config<false, 2>,
                                     Config<false, 3>,
                                     Config<false, 4>,
                                     Config<false, 5>,
                                     Config<false, 6>,
                                     Config<false, 7>,
                                     Config<true, 2>,
                                     Config<true, 3>,
                                     Config<true, 4>,
                                     Config<true, 5>,
                                     Config<true, 6>,
                                     Config<true, 7>>;
 
TYPED_TEST_SUITE(MultilinearBatchingTests, TestConfigs);
 
// Completeness: honest claims verify and the output claim is bound to the honest batched polynomial.
TYPED_TEST(MultilinearBatchingTests, ValidProofPasses)
{
    auto result = TestFixture::run(FaultMode::NONE);
    EXPECT_TRUE(result.verified);
    EXPECT_TRUE(result.circuit_ok);
    EXPECT_TRUE(result.claim_bound);
}
 
// A wrong non-shifted input claim makes the sumcheck target inconsistent with the polynomials. Targeted on both the
// first claim (coefficient γ^0 = 1) and the second claim (coefficient γ^1 = γ).
TYPED_TEST(MultilinearBatchingTests, FalseNonShiftedClaimFirstFails)
{
    BB_DISABLE_ASSERTS();
    EXPECT_FALSE(TestFixture::run(FaultMode::FALSE_NONSHIFTED_EVAL_FIRST).accepted());
}
 
TYPED_TEST(MultilinearBatchingTests, FalseNonShiftedClaimSecondFails)
{
    BB_DISABLE_ASSERTS();
    EXPECT_FALSE(TestFixture::run(FaultMode::FALSE_NONSHIFTED_EVAL_SECOND).accepted());
}
 
// A wrong shifted input claim makes the sumcheck target inconsistent with the polynomials. Targeted on both the first
// claim (coefficient 1) and the second claim (coefficient γ).
TYPED_TEST(MultilinearBatchingTests, FalseShiftedClaimFirstFails)
{
    BB_DISABLE_ASSERTS();
    EXPECT_FALSE(TestFixture::run(FaultMode::FALSE_SHIFTED_EVAL_FIRST).accepted());
}
 
TYPED_TEST(MultilinearBatchingTests, FalseShiftedClaimSecondFails)
{
    BB_DISABLE_ASSERTS();
    EXPECT_FALSE(TestFixture::run(FaultMode::FALSE_SHIFTED_EVAL_SECOND).accepted());
}
 
// A wrong claim challenge makes the eq polynomial evaluated by the verifier inconsistent with the one the prover
// committed to, so eq-consistency fails. Targeted on both the first claim (coefficient 1) and the second claim (γ).
TYPED_TEST(MultilinearBatchingTests, FalseEqFirstFails)
{
    BB_DISABLE_ASSERTS();
    EXPECT_FALSE(TestFixture::run(FaultMode::FALSE_EQ_FIRST).accepted());
}
 
TYPED_TEST(MultilinearBatchingTests, FalseEqSecondFails)
{
    BB_DISABLE_ASSERTS();
    EXPECT_FALSE(TestFixture::run(FaultMode::FALSE_EQ_SECOND).accepted());
}
 
// Corrupting a claimed non-shifted evaluation breaks the sumcheck final relation check. Tampered on both the first
// claim (idx 0) and the second claim (idx 1).
TYPED_TEST(MultilinearBatchingTests, TamperedNonShiftedEvalFirstFails)
{
    BB_DISABLE_ASSERTS();
    EXPECT_FALSE(TestFixture::run(FaultMode::TAMPER_NONSHIFTED_EVAL_FIRST).accepted());
}
 
TYPED_TEST(MultilinearBatchingTests, TamperedNonShiftedEvalSecondFails)
{
    BB_DISABLE_ASSERTS();
    EXPECT_FALSE(TestFixture::run(FaultMode::TAMPER_NONSHIFTED_EVAL_SECOND).accepted());
}
 
// Corrupting a claimed shifted evaluation breaks the sumcheck final relation check. Tampered on both the first claim
// (idx 0) and the second claim (idx 1).
TYPED_TEST(MultilinearBatchingTests, TamperedShiftedEvalFirstFails)
{
    BB_DISABLE_ASSERTS();
    EXPECT_FALSE(TestFixture::run(FaultMode::TAMPER_SHIFTED_EVAL_FIRST).accepted());
}
 
TYPED_TEST(MultilinearBatchingTests, TamperedShiftedEvalSecondFails)
{
    BB_DISABLE_ASSERTS();
    EXPECT_FALSE(TestFixture::run(FaultMode::TAMPER_SHIFTED_EVAL_SECOND).accepted());
}
 
// Corrupting a claimed eq evaluation breaks the eq-consistency check. Tampered on both the first claim (idx 0) and the
// second claim (idx 1).
TYPED_TEST(MultilinearBatchingTests, TamperedEqEvalFirstFails)
{
    BB_DISABLE_ASSERTS();
    EXPECT_FALSE(TestFixture::run(FaultMode::TAMPER_EQ_EVAL_FIRST).accepted());
}
 
TYPED_TEST(MultilinearBatchingTests, TamperedEqEvalSecondFails)
{
    BB_DISABLE_ASSERTS();
    EXPECT_FALSE(TestFixture::run(FaultMode::TAMPER_EQ_EVAL_SECOND).accepted());
}
 
// A wrong non shifted commitment slips past the sumcheck (which never reads commitments), but the output claim is no
// longer bound to it — the downstream PCS opening would reject it.
TYPED_TEST(MultilinearBatchingTests, WrongNonShiftedCommitment)
{
    auto result = TestFixture::run(FaultMode::WRONG_NONSHIFTED_COMMITMENT);
    EXPECT_TRUE(result.verified);
    EXPECT_TRUE(result.circuit_ok);
    EXPECT_FALSE(result.claim_bound);
}
 
// A wrong shifted commitment slips past the sumcheck (which never reads commitments), but the output claim is no longer
// bound to it — the downstream PCS opening would reject it.
TYPED_TEST(MultilinearBatchingTests, WrongShiftedCommitment)
{
    auto result = TestFixture::run(FaultMode::WRONG_SHIFTED_COMMITMENT);
    EXPECT_TRUE(result.verified);
    EXPECT_TRUE(result.circuit_ok);
    EXPECT_FALSE(result.claim_bound);
}
 
// The core soundness property of the fresh-ρ merge: polynomials evaluations crafted to satisfy the γ-weighted sumcheck
// (and eq consistency) still fail to bind, because the merge challenge ρ is drawn only after they are committed.
TYPED_TEST(MultilinearBatchingTests, BrokenEvalBindingIsCaughtByMerge)
{
    if (TestFixture::NumClaims < 3) {
        GTEST_SKIP() << "The eval-binding attack needs >= 3 claims (2 constraints, 3 unknowns) to also satisfy the "
                        "pre-fix γ-weighted merge; with 2 claims no such non-trivial perturbation exists.";
    }
    auto result = TestFixture::run(FaultMode::BREAK_EVAL_BINDING);
    EXPECT_TRUE(result.verified);
    EXPECT_TRUE(result.circuit_ok);
    EXPECT_FALSE(result.claim_bound);
}
 
bool verify_with_mismatched_claim_count(size_t prover_num_claims, size_t verifier_num_claims)
{
    const HonkProof proof = build_faulty_proof(prover_num_claims, FaultMode::NONE).proof;
    const std::vector<VerifierClaim> claims = build_honest_claims(verifier_num_claims).verifier_claims;
 
    auto transcript = std::make_shared<NativeTranscriptType>();
    transcript->load_proof(proof);
    [[maybe_unused]] FF seed = transcript->template receive_from_prover<FF>("init");
    MultilinearBatchingNativeVerifier verifier(transcript);
    return std::get<0>(verifier.verify_proof(claims));
}
 
class MultilinearBatchingClaimCountTests : public ::testing::Test {
  protected:
    static void SetUpTestSuite() { bb::srs::init_file_crs_factory(bb::srs::bb_crs_path()); }
};
 
// The verifier supplies one more claim than the prover proved. The wider verifier tries to read 3·(N+1) claimed
// evaluations from a proof that only carries 3·N, so the transcript runs out of bounds and the verifier throws.
TEST_F(MultilinearBatchingClaimCountTests, MoreClaimsThanProvedThrows)
{
    BB_DISABLE_ASSERTS();
    EXPECT_ANY_THROW(verify_with_mismatched_claim_count(/*prover_num_claims=*/2, /*verifier_num_claims=*/3));
}
 
// The verifier supplies one fewer claim than the prover proved. This produces a transcript mismatch and therefore the
// verifier rejects
TEST_F(MultilinearBatchingClaimCountTests, FewerClaimsThanProvedThrows)
{
    EXPECT_FALSE(verify_with_mismatched_claim_count(/*prover_num_claims=*/3, /*verifier_num_claims=*/2));
}
 
} // namespace