A brief history of Lookup Arguments

1 Introduction

Mainly refer to the April 2023 article "A Brief History of Lookup Arguments" by the Ingonyama team.

In recent years, the research hot spots of zk-SNARKs include:

• Make ZKP proof more succinct
• Reduce Prover time and Verifier time

However, most SNARKs are still limited by arithmetic operations that easily convert to polynomials. Arithmetic operations that are easily converted to polynomials are often called "SNARK-friendly", while other "SNARK-unfriendly" operations remain unsolved.

Until 2018, Jonathan Bootle and others published the paper "BCG+18 Nearly linear-time zero-knowledge proofs for correct program execution" , a lookup protocol was proposed to handle certain SNARK-unfriendly operations. The lookup protocol is used to prove the following statement:

• 已知table T = { t i } i = 0 , ⋯   , N − 1 T=\{t_i\}_{i=0,\cdots,N-1} T={ ti​}i=0,⋯,N−1​with distinct values ​​("rows")
• 一组lookups F = { f j } j = 0 , ⋯   , m − 1 F=\{f_j\}_{j=0,\cdots,m-1} F={ fj​}j=0,⋯,m−1​(There may be duplicate values)
• Proof: All lookups are included in the table, that is, $F\subseteq T$。

table $T$ is usually public, while lookups are usually private witnesses.
Can:

• Treat the table as all legal values ​​​​of a specific variable
• Lookups are the values ​​of the variables given by the execution of a specific program.
• Then, the above statement means that the variable maintains the legal status during the entire execution process.
• Unless explicitly stated, it is assumed$m<N$, and in most cases $m\ll N$。

This article focuses on the evolution of various lookup arguments and their variants, focusing on:

• plookup: Ariel Gabizon et al. 2020 paper plookup: A simplified polynomial protocol for lookup tables
• cq: Liam Eagen et al.’s 2022 paper cq: Cached quotients for fast lookups

2. Use of lookup argument

2.1 Scope check

When checking numbers$x$在 { 0 , 1 , ⋯   , N − 1 } \{0,1,\cdots,N-1\} { 0,1,⋯,N−1}范围内，其中$N=2^n$.
The corresponding arithmetic constraint method is:

• set义$n$Number$b_0,\cdots ,b_{n-1}$，检查对于每个$i$，有 b i ∈ { 0 , 1 } b_i\in\{0,1\} bi​∈{ 0,1}，且${\sum }_i{b}_i{2}^i=x$. Common demand$n+1$Promise.
• If necessary$Range\; check\; of\; m$ numbers requires$O\left(mn\right)=O(m\log N)$Personal promise.

With the help of lookup argument, only one lookup constraint is needed to check$m$Contains digits$\{0,1,\cdots ,N-Within\; the\; range\; of\; 1\}$. The overhead of such a lookup constraint will be introduced later. And when$When\; N$ is not power of 2, the above arithmetic constraint method will be cumbersome, and the lookup argument does not need to be concerned$N$Yes or no power of 2.

2.2 Finite field functions

The lookup argument can be used to implement an arbitrary (finite domain) function by simply defining a table with the complete input and output values ​​of the function. Can be used to implement functions with any number of variables.

as widely used in hash calculations$k$-bit XOR function. Following the logic of Section 2.1 and using arithmetic constraints, it will require $6k$ constraints. With the lookup argument, you can directly use table $T$come to fruition, inside table $T$的rows为：
$t_i=(A,B,C)$
Among them:

• 对于每个$i$， A , B ∈ { 0 , 1 , ⋯   , 2 k − 1 } A,B\in\{0,1,\cdots,2^k-1\} A,B∈{ 0,1,⋯,2k−1}为2个$k$ Different combinations of-bit numbers, and $C=A\oplus B$。
• 整个table $T$ have$2^{2k}$ rows, and each row demand exists$3k$ bits。
  • hit$k=When\; 32$ (a common value for many hash functions), such a table is completely impractical.
  • hit$k=When\; 16$, such a table requires 24GB of storage space, which is not practical for most application scenarios.

2.3 Better XOR

The 16-bit table chip for SHA-256 in Halo2 implements a better bit-wise XOR function by using zero-interleaving and lookup argument.
zero-interleaving refers to representing numbers in binary:
$A={\sum }_{l=0}^{k-1}{a}_l{2}^l$
Then add a '0' bit between any 2 original bits, so that:
$A^{\prime }={\sum }_{l=0}^{k-1}{a}_l{4}^l$
Two XOR imports$A,B$After zero-interleaving, there is$A^{\prime },B^{\prime }$。计算$C^{\prime \prime }=A^{\prime }+B^{\prime }$，则$C^{The\; bit\; in\; the\; even\; position\; of\; \prime \prime }$ is $C=A\oplus B$. C ′ ′ C'' $C^{\prime \prime }$获得$C$，Customer$C^{\prime \prime }$ is decomposed into odd bits and even bits:
$C^{\prime \prime }={\sum }_{l=0}^{k-1}{c}_l^{even}{4}^l+2{\sum }_{l=0}^{k-1}{c}_l^{odd}{4}^l$

thereby:

• 有$c_l^{even}$为$C=A\oplus Binary\; representation\; of\; B$,
• Also has by-products:$c_l^{odd}$为$D=A\wedge Binary\; representation\; of\; B$. $\wedge$表示bit-wise AND。
• 借助4次zero-interleaving table：$A,B,C,D\to A^{\prime },B^{\prime },C^{\prime },D^{\prime }$, and an arithmetic constraint:
  $A^{\prime }+B^{\prime }=C^{\prime \prime }=C^{\prime }+2D^{\prime }$
  possible time confirmation$A,The\; bit-wise\; XOR\; and\; bit-wise\; AND\; results\; of\; B$.

hit$k=When\; 32$, the above implementation is still unrealistically large, and a single table requires 48GB of storage space.
However, for $k=In\; the\; case\; of\; 16$, the lookup table corresponding to the above implementation only requires 384kB.
The number of bits can be reduced in a SNARK-friendly way through slicing, that is, the arithmetic gate is introduced - which uses two 16-bit numbers $x_0,x_1$ is the input, and then the 32-bit number is finally obtained$x=x_0\cdot 1+x_1\cdot 2^{16}$。

2.4 Finite state machine

lookup table can be used to implement finite state machines. A state machine contains a set of states and state changes that depend on the inputs. The lookup table that implements the state machine contains all legal combinations of (current state, input, next state). The execution trace of the state machine is usually expressed as:
$(state(j),input(j),next\_state(j))$

You can use the lookup argument to prove the legal execution of the state machine and prove the wiring constraints:
$next\_state(j)=state(j+1)$

The wiring constraint is SNARK-friendly.

3. Plookup

Plookup is one of the early lookup protocols and is a simplified version of the first lookup protocol.
The idea behind Plookup is:

• 已知向量$t\in {\mathbb{F}}^N,f\in F^m,s\in F^{N+m}$，和双变量多项式：
  $F(\beta ,\gamma )=(1+\beta {)}^m{\prod }_{j=1}^m(\gamma +f_j){\prod }_{i=1}^{N-1}(\gamma (1+\beta )+t_i+\beta t_{i+1})$
  $G(\beta ,\gamma )={\prod }_{k=1}^{m+N-1}\left(\gamma \right(1+\beta )+s_k+\beta s_{k+1})$
• 则有：
  F ≡ G ⇔ { { f j } ⊆ { t i } , 且 s = ( f , t )  sorted by  t F\equiv G \Leftrightarrow \left\{\begin{matrix} \{f_j\}\subseteq \{t_i\}, & 且 \\ s=(f,t) \text{ sorted by } t & \\ \end{matrix}\right. F≡G⇔{ { fj​}⊆{ ti​},s=(f,t) sorted by t​and​
  in:
  • $s=(f,t)\text{ sorted by }t$，表示$The\; order\; of\; appearance\; of\; the\; values\; in\; s$ is the same as $The\; order\; of\; occurrence\; in\; t$ is the same, because there are { f j } ⊆ { t i } \{f_j\}\subseteq \{t_i\ } { fj​}⊆{ ti​}。

若有$s=(f,t)\text{ sorted by }t$，且， { f j } ⊆ { t i } \{f_j\}\subseteq \{t_i\} { fj​}⊆{ ti​}，则对于每个$i=1,\cdots ,N-1$, all are different k ∈ { 1 , ⋯ , m + N − 1 } k\in\{1,\ cdots,m+N-1\} k∈{ 1,⋯,m+N−1}，使得：
$$\left(\gamma \right(1+\beta )+t_i+\beta t_{i+1})=\left(\gamma \right(1+\beta )+s_k+\beta s_{k+1})\text{\hspace{1em}(3.4)}$$
对于其它$s_k=s_{k+1}$Index value of $k$，存在$j\in \{1,\cdots ,m\}$, use$f_j=s_k$，且：
$$(1+\beta )(\gamma +f_j)=\left(\gamma \right(1+\beta )+s_k+\beta s_{k+1})\text{\hspace{1em}(3.5)}$$

General$\beta$ is regarded as a coefficient, then $F,G$Watch it$F\left[\gamma \right]$polynomial, thus having a unique decomposition factor. By identifying the factors in the above equations 3.4 and 3.5, we can find that the factors are about the variables $\beta$ multi-format.

3.1 Plookup definition

Plookup uses the following definition:

• 1）取$m=N-1$，Young insufficiency$N=m+1$, then the last element needs to be repeated to fill the corresponding lookups list until it satisfies $N=m+1$。
• 2） H = { g , ⋯   , g N = 1 } H=\{g,\cdots,g^N=1\} H={ g,⋯,gN=1}为$F$Middle order$N$的multiplicative subgroup。
• 3) For vectors$p={\mathbb{F}}^N$, define polynomial$p(x)\in \mathbb{F}[X{]}_{<N}$, so that the vector value is the evaluation value of the polynomial, that is, it satisfies $p_i=p(g^i)$。
• 4）令$L_i(x)\in F[X{]}_{<N}$为基于$H$'s part$i$The image of Lagrange city is full of feet$L_i(g^j)=d_{ij}$(for Kronecker delta).
• 5）$s\in F^{2N-1}$为$(f,t)$ sorted by $t$。

3.2 Plookup protocol

The final Plookup protocol is:

• 1) Prover calculates and merges 2 polynomials$h_1,h_2\in \mathbb{F}[x{]}_{<N}$ commits such that for each $i=1,\cdots ,N$, Yes: [Shu, General$s$The vector is divided into half on the left and right, and then interpolated to obtain $h_1,h_2$Multiple format. ]
  $h_1(g^i)=s_i$
  $h_2\left(g^i\right)=s_{N+i-1}$
• 2) Verifier sends random value to Prover$\beta ,\gamma$。
• 3) Prover calculates and corrects the polynomial$WITH\in F[x{]}_{<N}$Polynomial commitment, $Z$Definition$F(\beta ,\gamma )/G(\beta ,\gamma )$，有：
  $Z(g)=1$
  对于$i=2,\cdots ,N-1$，有 $$Z(g^i)=\frac{(1+\beta {)}^{i-1}{\prod }_{l=1}^{i-1}(\gamma +f_l\left)\right(\gamma (1+\beta )+t_l+\beta t_{l+1})}{{\prod }_{l=1}^{i-1}(\gamma (1+\beta )+s_l+\beta s_{l+1})(\gamma (1+\beta )+s_{N+l}+\beta s_{N+l+1})}\text{\hspace{1em}(3.9)}$$
  $Z(g^N)=1$
• 4) Verifier owns$x\in H$、Identities：
  $$L_1(x)(Z(x)-1)=0\text{\hspace{1em}(3.11)}$$
  $$L_N\left(x\right)\left(Z\right(x)-1)=0\text{\hspace{1em}(3.12)}$$
  $$L_N(x)(h_1(x)-h_2(gx))=0\text{\hspace{1em}(3.13)}$$
  $$(x-g^N)Z(x)(1+\beta )(\gamma +f(x))(\gamma (1+\beta )+t(x)+\beta t(gx))=(x-g^N)Z\left(gx\right)\left(\gamma \right(1+\beta )+h_1(x)+\beta h_1(gx))\left(\gamma 1\right(+\beta )+h_2(x)+\beta h_2(gx))\text{\hspace{1em}(3.14)}$$

Note that the constructed$Z\left(x\right)$ polynomial, in Eq. 3.9 On the basis of , the numerator and denominator are multiplied by the same multiplier term. That means, the $N$after,$F,The\; equivalence\; of\; G$ implies that all terms can be reduced, ultimately obtaining 1. Equations 3.11 and 3.12 check $Z(g)=Z(g^N)=1$, while Equation 3.14 checks that each evaluation value indeed adds the correct multiplier term - the added $(x-g^{(g\; N\; )\; ^N)}$$Z(g^N)$和$Z(g^{N+1})=The\; system\; between\; Z\left(g\right)$.

3.3 Plookup overhead

The Plookup protocol does not rely on any special commitment scheme. usually:

• Prover runtime为$O(N\log N)$ domain operations (to construct polynomials from evaluations values), and $O\left(N\right)$Personal group calculation (hereafter Construction multi-format$Z$）。
• When using the KZG commitment scheme, its proof size is 5 group elements and 9 domain elements, and the Verifier runtime is 2 pairing functions.

3.4 Plookup generalization and optimization

The Plookup protocol can be generalized to multiple witness polynomials$f_1,\cdots ,f_w\in \mathbb{F}[x{]}_{<m}$和多个tables $t_1,\cdots ,t_w\in F[x{]}_{<N}$. Verifier selects a random value $\alpha$, then these polynomials can be aggregated as:
$t={\sum }_{l=1}^w{a}^l{t}_l$
$f={\sum }_{l=1}^w{a}^l{f}_l$

Then process as before$f,t$。

If table is a set of consecutive integers, then there is$t_{l+1}=t_l+1$, then the 3.9 method in the Plookup protocol can be simplified as:
$Z(g^i)=\frac{{\prod }_{l=1}^{i-1}(\gamma +f_l)(\gamma +t_l)}{{\prod }_{l=1}^{i-1}(\gamma +s_l)(\gamma +s_{N+l})}$

The corresponding Verifier checks also need to be adjusted accordingly.

Another generalization of the Plookup protocol is the plonkup protocol, see Luke Pearson et al.'s 2022 paperPlonkup: Reconciling plonk with plookup, plonkup protocol It integrates plonk and plookup, and supports the introduction of efficient lookup tables with general plonk gates.

4. cq protocol

The main problems with the plookup protocol are:

• 对于$m\ll In\; the\; common\; scenario\; of\; N$, the plookup protocol is expensive.

Since the advent of the plookup protocol, multiple lookup protocols have been iterated. Compared with the previous protocol, each new lookup protocol is more effective $The\; dependence\; of\; N$ has been reduced. The core ideas behind these new lookup protocols are:

• Move most table calculations to precalculation.

As of April 2023, the best lookup protocol is cq, see Liam Eagen et al.'s 2022 papercq: Cached quotients for fast lookups.

4.1 Logarithmic Derivative

The cq protocol is based on the following Logarithmic Derivative trick:

• 2-piece multi-frame formula$p(x)={\prod }_{a\in A}(x+a)$和$q(x)={\prod }_{b\in B}(x+b)$ are equal if and only if the following rational functions are equal:
  $\frac{p^{\prime }(x)}{p\left(x\right)}={\sum }_{a\in A}\frac{1}{x+a}$
  $\frac{q^{\prime }\left(x\right)}{q\left(x\right)}={\sum }_{b\in B}\frac{1}{x+b}$

Same Yu$p\left(x\right)=q\left(x\right)$，Advanced< /span>$p^{\prime }(x)/p(x)=q^{\prime }\left(x\right)/q\left(x\right)$is trivial, and Rebellion, Yu$p^{\prime }\left(x\right)/p\left(x\right)=q^{\prime }(x)/q(x)$，有：
$(\frac{p(x)}{q\left(x\right)}{)}^{\prime }=\frac{p^{\prime }(x)q(x)-q^{\prime }(x)p(x)}{q^2(x)}=0$

That means, there$p(x)/q(x)=c$, inside$c$ is a constant value. However, since$p(x),q\left(x\right)$'s leading system equality 1, there is$c=1$且$p(x)=q(x)$。从而，lookups $f$包含在table $t$中，当且仅当：
$$\sum _{i=1}^N\frac{m_i}{x+t_i}=\sum _{j=1}^m\frac{1}{x+f_j}\text{\hspace{1em}(4.4)}$$
Among them:

• $m_i$为lookup $f_j$中$t_i$The number of times the value appears. Note that each $t_i$ is unique, and $f_j$values ​​support duplication, and for many$t_i$可以有$m_i$The value is 0.

The core idea of ​​the cq protocol is to test the 4.4 equation at a random point$x=The\; rational\; function\; identity\; of\; \beta$.

4.2 Adjust cq protocol identity to Sumcheck

determinable multifunction$A(x),B(x)$，使得其evaluations值为：
$$A_i=\frac{m_i}{b+t_i},i=1,\cdots ,N\text{\hspace{1em}(4.5)}$$
$B_j=\frac{1}{\beta +f_j},j=1,\cdots ,m$

To do the cq protocol identity check of equation 4.4.

Here are:

• $A_i=A(g^i)$, inside$g$order为$N$的multiplicative subgroup $IN\subset \mathbb{F}$的generator。
• $B_j=B(w^j)$, inside$w$order为$m$的multiplicative subgroup $H\subset F$的generator。

Basic point$\beta$, in order to satisfy the relationship in Equation 4.4, $A_i,B_j$Demand sufficiency${\sum }_i{A}_i={\sum }_j{B}_j$, and these polynomial evaluations based on multiplicative groups follow:
${\sum }_{i=1}^N{A}_i=N\cdot A(0)$
${\sum }_{i=j}^m{B}_j=m\cdot B(0)$

Then, Prover must prove:
$$N\cdot A(0)=m\cdot B\left(0\right)\text{\hspace{1em}(4.9)}$$

This corresponds to the univariate sumcheck problem.

4.3 quotient polynomial of cq protocol

多项式：
$p(x)=A(x)(T(x)+\beta )-m(x)$
$q(x)=B(x)(F(x)+\beta )-1$
Inside:

• $T(x),m(x),F(x)$多项式的evaluation值分别为$t_i,m_i,f_j$。
• 对于$V$，$p\left(x\right)$'s evaluation list required 0.
• 对于$H$，$q\left(x\right)$'s evaluation list required 0.

Thus, quotient polynomials can be defined$Q_A(x),Q_B(x)$为：
$$Q_A(x)=\frac{A\left(x\right)\left(T\right(x)+\beta )-m(x)}{{WITH}_V\left(x\right)}\text{\hspace{1em}(4.12)}$$
$$Q_B\left(x\right)=\frac{B\left(x\right)\left(F\right(x)+\beta )-1}{{WITH}_H\left(x\right)}\text{\hspace{1em}(4.13)}$$
Among them:

• ${WITH}_V\left(x\right),{WITH}_H\left(x\right)$Separation$V,The\; vanishing\; polynomial\; of\; H$.

Prover needs to prove 2 things:

• 1）Kichido multi-function$A,B,Q_A,Q_B,F,m$。
• 2) These polynomials satisfy the relationships of equations 4.9, 4.12, and 4.13 above.

If the KZG commitment scheme is used, it only needs to use pairing to check these equation relationships. However, these statements will be further divided next.

In the 4.4 cq protocol, prove that it knows polynomials$A$and its sum

When using KZG commitment value$[\varphi (x){]}_1$To prove that it knows polynomials$\varphi \left(x\right)$When, Prover Association Its existence$z$ points are evaluated to define a new polynomial:
$P_{\varphi }=\frac{\varphi (x)-\varphi (z)}{x-z}$
and send the promised value$[P_{\varphi }{]}_1$。Verify the pairing function:
$e([\varphi (x){]}_1-[\varphi (z){]}_1,[1{]}_2)=e([P_{\varphi }{]}_1,[x-z{]}_2)$

let it be rewritten as：
$e([\varphi \left(x\right){]}_1-\left[\varphi \right(z){]}_1+With\cdot [P_{\varphi }{]}_1,\left[1{]}_2\right)=e([P_{\varphi }{]}_1,[x{]}_2)$

makes the second parameter of the pairing function always $[1{]}_2$or$[x{]}_2$。

踺证明其道多项style$A$，对$A$existing$x=0$点进行evaluate，有：
$P_A(x)=\frac{A(x)-A(0)}{x}$
并受诺$[P_A{]}_1$, then use:
$e([A(x){]}_1-[A(0){]}_1,[1{]}_2)=e([P_A(x){]}_1,[x{]}_2)$
Come here.

4.5 cq协议中，$B$polynomial low degree testing

Know polynomials for proof$B$：

• First prove the polynomial$B$的degree确实$<m$。

Attention, no demand$A\left(x\right)$'s degree、inherited The maximum degree of support for SRS.

In the KZG commitment scheme, to prove the polynomial$B$的degree确实$<m$, can be determined:
$P_B\left(x\right)=\frac{B(x)-B(0)}{x}$
Then commit$\left[P_B\right(x)\cdot x^{N-m+1}{]}_1$，最后测试：
$e([P_B\left(x\right){]}_1,\left[x^{N-m+1}{]}_2\right)=e([P_B\left(x\right)\cdot x^{N-m+1}{]}_1,\left[1{]}_2\right)$

Attention, young$B(x)$中有degree $\ge The\; items\; of\; m$ will be included in the commitment value$[P_B(x)\cdot x^{N-m+1}{]}_1$, while SRS does not support degree $\ge Commit\; to\; items\; N$.

4.6 In the cq protocol, Cached Quotients are used to prove the equation relationship in 4.12)

可通过如下testing：
$e([A(x){]}_1,[T(x){]}_2)=e([Q_A(x){]}_1,[Z_V(x\left){]}_2\right)\cdot e([m(x){]}_1-\beta [A(x){]}_1,[1{]}_2)$

To check the relationship of equation 4.12).

in:

• $[T{]}_2,[Z_V{]}_2,[1{]}_2,[x{]}_2$All are independent of lookups and can be precalculated.
• Prover需计算：$[A(x){]}_1,[Q_A\left(x\right){]}_1,[m(x){]}_1,A(0),[\frac{A(x)-A(0)}{x}{]}_1$。
  • The computational complexity of these is$O\left(m\right)$，Because of demand Accounting lookups. Waka$t_i$ does not exist in lookups, then there are$m_i=0,A_i=0$。
  • Just exists$\left[Q_A\right(x){]}_1$计许为$O\left(N\right)$. Basic solution plan:
    • 预计算cached quotients：
      $$Q_i\left(x\right)=\frac{L_i(x)(T(x)-t_i)}{{WITH}_V\left(x\right)}=\frac{T(x)-t_i}{k^i(x-g^i)}\text{\hspace{1em}(4.22)}$$
      Among them:
      • $L_i\left(x\right)$Lagrange multi-format
      • $L_i(x)=\frac{{WITH}_V(x)}{k^i(x-g^i)}$
      • $k^i={WITH}_{IN}^{\prime }(g^i)=(x^N-1{)}^{\prime }{|}_{x=g^i}=N\cdot g_i^{N-1}=\frac{N}{g^i}$
      • 使用NTT，$Q_i\left(x\right)$'s calculation amount$O(N\log N)$。
      • 使用$Q_i(x)$，$[Q_A{]}_1$The calculation amount of is $O(m)$，有：
        $[Q_A(x){]}_1={\sum }_{A_i\ne 0}{A}_i\cdot [Q_i\left(x\right){]}_1$
        Inside$A_i$ is 4.5) Polynomial in the equation$A(x)$的evaluation值。

In 4.7 cq protocol, prove the equation relationship of 4.9) 4.13)

Introduce another random value$x=\gamma$：

• First for the polynomial:
  $P_F\left(x\right)=\frac{F(x)-F(\gamma )}{x-\gamma }$
  $P_{B,\gamma }\left(x\right)=\frac{P_B(x)-P_B(\gamma )}{x-\gamma }$
  Commitment to prove knowledge $F(\gamma ),P_B(\gamma )$。
  可通过验证：
  $$e([F(x){]}_1-[F(\gamma ){]}_1+\gamma [P_F\left(x\right){]}_1,[1{]}_2)=e([P_F\left(x\right){]}_1,[x{]}_2)\text{\hspace{1em}(4.28)}$$
  $$e([P_B(x){]}_1-[P_B(\gamma ){]}_1+\gamma [P_{B,\gamma }\left(x\right){]}_1,[1{]}_2)=e([P_{B,\gamma }\left(x\right){]}_1,\left[x{]}_2\right)\text{\hspace{1em}(4.29)}$$
  come$B(x),F(x)$确实evaluate到$B(\gamma ),F\left(\gamma \right)$, so you can use these evaluations values ​​to prove the required relationships.
• Identify:
  $$Q_{b,\gamma }=\frac{(B(\gamma )-B(0)+A(0)\cdot N/m)(F(\gamma )+\beta )-1}{{WITH}_H(\gamma )}\text{\hspace{1em}(4.30)}$$
  $P_{Q_B}(x)=\frac{Q_B(x)-Q_{b,\gamma }}{x-\gamma }$
  Then send the commitment value$[Q_{b,\gamma }{]}_1,[P_{Q_B}\left(x\right){]}_1$, which can be verified by the following pairing equation:
  $$e([Q_B\left(x\right){]}_1-[Q_{b,\gamma }{]}_1+\gamma [P_{Q_B}\left(x\right){]}_1,\left[1{]}_2\right)=e([P_{Q_B}\left(x\right){]}_1,\left[x{]}_2\right)\text{\hspace{1em}(4.32)}$$
  Note that this construction can simultaneously prove the following statements:
  $Q_B\left(\gamma \right)=\frac{(B(\gamma ))(F(\gamma )+\beta )-1}{{WITH}_H\left(x\right)}$
  $B\left(0\right)\cdot m=A\left(0\right)\cdot N$
  This ends the entire proof.

4.8 Proof batching of cq protocol

The last three proofs have similar structures, and the cq protocol can batch them into a single protocol - by introducing new random variables$\eta$，and define：
$c(x)=P_B(x)+\eta F(x)+{the}^2{Q}_B\left(x\right)$
$in=P_B(\gamma )+\eta F(\gamma )+{the}^2{Q}_{b,\gamma }$
$P_{\gamma }\left(x\right)=P_{B,\gamma }\left(x\right)+\eta P_F\left(x\right)+{the}^2{P}_{Q_B}\left(x\right)$

Then, aggregate 4.28), 4.29), and 4.32) into a single check:
$e([c(x){]}_1-[v{]}_1+\gamma [P_{\gamma }(x){]}_1,[1{]}_2)=e([P_{\gamma }\left(x\right){]}_1,[x{]}_2)$

4.9 cq complete agreement

4.9.1 Setup phase

Both Prover and Verifier have public input$t_i$，$i=1,\cdots ,N$. The following process is performed by a trusted party:

• 1) Select a random value$x\in \mathbb{F}$，输出$\{[x^i{]}_1{\}}_{i=0}^{N-1}$sum$\{[x^i{]}_2{\}}_{i=0}^N$。数字$x$required.
• 2) Calculate and output$[Z_V(x){]}_2$。
• 3）电影$T(x)={\sum }_i{t}_i{L}_i\left(x\right)$. Calculation out$[T(x){]}_2$。
• 4）对于每个$i=1,\cdots ,N$, accounting for export:
  • According to equation 4.22), calculate and output$[Q_i(x){]}_1$
  • $[L_i(x){]}_1$
  • $[\frac{L_i(x)-L_i(0)}{x}{]}_1$

The output of the setup phase forms SRS and is sent to both Prover and Verifier.

4.9.2 Proving stage

Prover obtains private witness value$f_j$，$j=1,\cdots ,m$, and what Verifier obtains is the commitment value of these inputs$[F(x){]}_1$. These inputs need to originate from the same trusted party to reach consensus on the issues to be proven.

The process of the cq protocol proof phase is:

Note that Verifier is calculated according to the equation 4.30)$Q_{b,\gamma }$, its demand$B(\gamma ),B\left(0\right)$Prover . However, Prover has sent it$P_B(\gamma )=(B(\gamma )-B(0))/$ Q b , γ = ( P B ( γ ) ⋅ γ + A ( 0 ) ⋅ N / m ) ( F ( γ ) + β ) − 1 Z H ( γ ) Q_{b,\gamma}=\frac{(P_B(\gamma)\cdot \gamma+A(0)\cdot N/m); (F(\gamma)+\beta)-1}{Z_H(\gamma)} ,And then,Verify the solution:$\gamma$
$Q_{b,\gamma }=\frac{(P_B(\gamma )\cdot \gamma +A(0)\cdot N/m)(F(\gamma )+\beta )-1}{{WITH}_H\left(\gamma \right)}$

4.10 cq protocol, further batching and aggregation

Fiat-Shamir transformation can be used to convert the above protocol to non-interactive. At this time, the proof content is:
${Pi}_{cq}=\{[m{]}_1,[A{]}_1,[Q_A{]}_1,[Q_B{]}_1,[P_A{]}_1,[P_B{]}_1,[P_B{x}^{N-m+1}{]}_1,[P_{\gamma }{]}_1,P_B(\gamma ),F(\gamma ),A(0)\}$
Among them:

• The first 8 are group elements
• The last three are field elements

The corresponding pairing equation is:
$e([P_B(x){]}_1,[x^{N-m+1}{]}_2)=e([P_B(x)\cdot x^{N-m+1}{]}_1,[1{]}_2)$
$e([A(x){]}_1,[T(x){]}_2)=e([Q_A(x){]}_1,[Z_V(x\left){]}_2\right)\cdot e([m(x){]}_1-\beta [A(x){]}_1,[1{]}_2)$
$e([A\left(x\right){]}_1-[A(0){]}_1,[1{]}_2)=e([P_A(x){]}_1,[x{]}_2)$
$e([c(x){]}_1-[v{]}_1+\gamma [P_{\gamma }\left(x\right){]}_1,\left[1{]}_2\right)=e([P_{\gamma }\left(x\right){]}_1,\left[x{]}_2\right)$

Introduce new random values$m\in F$, it is easy to batch the last two pairing equations above as:
$e([c\left(x\right){]}_1-[v{]}_1+\gamma [P_{\gamma }\left(x\right){]}_1+\mu ([A(x){]}_1-\left[A\right(0){]}_1),\left[1{]}_2\right)=e([P_{\gamma }\left(x\right){]}_1+\mu [P_A(x){]}_1,[x{]}_2)$
再引入$r\in F$, in each pairing function batch, is:
$e([P_{\gamma }\left(x\right){]}_1+\mu \left[P_A\right(x){]}_1,[x{]}_2)\cdot e(\rho [P_B(x){]}_1,[x^{N-m+1}{]}_2)=e([c(x){]}_1-[v{]}_1+\gamma \left[P_{\gamma }\right(x){]}_1+\mu ([A(x){]}_1-[A\left(0\right){]}_1)+\rho [P_B(x)\cdot x^{N-m+1}{]}_1,\left[1{]}_2\right)$

再引入$p\in F$, batch it with the second pairing equation into a single pairing equation. Definition:
$L_a=[P_{\gamma }(x){]}_1+\mu [P_A\left(x\right){]}_1$
$L_b=\rho [P_B(x){]}_1$
$L_c=\sigma [A(x){]}_1$
$L_d=-\sigma [Q_A(x){]}_1$
$R=[c(x){]}_1-[v{]}_1+\gamma [P_{\gamma }(x){]}_1+\mu ([A(x){]}_1-[A(0){]}_1)+\rho [P_B(x)\cdot x^{N-m+1}{]}_1+\sigma ([m(x){]}_1-\beta [A(x){]}_1)$

The single pairing equation of the final batch is:
$e(L_a,[x{]}_2)\cdot e(L_b,[x^{N-m+1}{]}_2)\cdot e(L_c,[T(x){]}_2)\cdot e(L_d,[Z_V(x\left){]}_2\right)=e(R,[1{]}_2)$

Since the second parameter in each pairing function above only depends on the setup, different proofs with the same setup are introduced by introducing new random parameters$h\in F$, independent proof:
$e({\sum }_k{h}^k{L}_{a,k},[x{]}_2)\cdot e({\sum }_k{h}^k{L}_{b,k},\left[x^{N-m+1}{]}_2\right)\cdot e({\sum }_k{h}^k{L}_{c,k},[T\left(x\right){]}_2)\cdot e({\sum }_k{h}^k{L}_{d,k},[Z_V(x){]}_2)=e({\sum }_k{h}^k{R}_k,[1{]}_2)$

4.11 cq protocol overhead

Different from the plookup protocol, the cq protocol is highly dependent on the KZG commitment scheme.

The overhead of the cq protocol is:

• cq protocol will be plookup protocol$O(N\log N)$The complexity is moved to the setup stage, so that these calculations only need to be done once for the same table.
• The calculation of the cq protocol proof phase completely relies on$m$, and it can be assumed that$m\ll N$. [In other words, if $m\ll If\; the\; N$ condition is not met, there is no reason to use the cq protocol, and the performance of the plookup protocol will be better. 】
• The workload of cq protocol Prover is$O(m\log m)$。
• The cq protocol proof size and Verifier workload are both constants.

5. Lookup protocol evolution

This section will briefly introduce the improvements from plookup to cq, and review other lookup protocols between the two. Note that these lookup protocols explicitly rely on the KZG commitment scheme.

5.1 Caulk

Arantxa Zapico et al.’s 2022 paper " Caulk: Lookup arguments in sublinear time" proposed the Caulk protocol.
The core idea behind the Caulk protocol is:

• (here$O\left(N\log N\right)$) 袄计衡表 encoding，用该table searchable in $O(\log N)$
• lookups also do similar encoding, so that the search complexity is $O\left(m\log N\right)$, prove that the additional complexity of this encoding is$O(m^2)$。

Caulk protocol:

• Precompute table as vanishing polynomial:
  ${WITH}_T(x)={\prod }_{i=1}^N(x-t_i)$
• Calculate lookups similarly as:
  $f(x)={\prod }_{j=1}^m(x-f_j)$
• Prover发送${WITH}_T,The\; commitment\; value\; of\; f$.
• will prove: for$S\subseteq T$，有$f={WITH}_S$
  Convert to proof:${WITH}_{T\setminus S}\left(x\right)={WITH}_T(x)/Z_S\left(x\right)$One piece multi-format.
• 对于每个$i=1,\cdots N$，caulk会预计算多项式：
  $g_i\left(x\right)={WITH}_{T\setminus t_i}\left(x\right)$
  In fact, these are cached quotients in the cq protocol.
• 若$S\subseteq T$, then there are certain numbers$c_j\in \mathbb{F}$，使得${WITH}_{T\setminus S}(x)$可分解表示为：
  ${WITH}_{T\setminus S}(x)={\sum }_{j=1}^m{c}_j{g}_{i(j)}(x)$
  Prover仅需要计算${WITH}_{T\setminus S}\left(x\right)$The committed value of the polynomial, and Verifier only needs to use pairing check:
  $e([f],[Z_{T\setminus S}])=e([Z_T],[1])$

5.2 Caulk+ Protocol

Jim Posen et al. proposed the Caulk+ protocol in the 2022 paper "Caulk+: Table-independent lookup arguments":

• The main shortcoming of the Caulk protocol is that it treats the table as a universal collection instead of encoding it as a group.
• Caulk+ protocol: By precomputing the table, the shortcomings in the Caulk protocol are improved.
  • Caulk+ treats the table as a multiplicative group, whose initial value is group generator powers.
  • Thus eliminating the pair $N$dependent, prove time仅为$O(m^2)$。

5.3 Flookup protocol

Ariel Gabizon et al.’s 2022 paper "flookup: Fractional decompositionbased lookups in quasi-linear time independent of table size" proposed the flookup protocol :

• increases preprocessing overhead to $O(N{\log }^{2}N)$
• Reduced Prover runtime to $O(m{\log }^{2}m)$
• At the same time, the homomorphic properties of the commitment scheme are sacrificed, so that merging multiple lookups and tables is not supported.

5.4 Baloo Protocol

Arantxa Zapico et al.’s 2022 paper "Baloo: Nearly optimal lookup arguments" proposed the Baloo protocol, which is an optimization of the Caulk+ protocol Edition:

• Replace lookups with a linear variant.
• Then use univariate sumcheck to prove the polynomial it promises.
• The preprocessing overhead is the same as Caulk+, which is$O(N\log N)$。
• The Prover overhead is the same as that of flookup, which is$O(m{\log }^{2}m)$。
• Since the constants in the Baloo protocol are larger, the actual overhead of the Baloo protocol is slightly higher than that of flipup. However, it retains the homomorphic properties of the commitment scheme, thereby supporting the merging of multiple lookups and tables.

lookup series blog

• PLOOKUP
• PLOOKUP code analysis
• Efficient polynomial commitment schemes for multiple points and polynomials study notes
• PLONK + PLOOKUP
• PlonKup: Reconciling PlonK with plookup
• PLONK: permutations over lagrange-bases for oecumenical noninteractive arguments of knowledge study notes
• Plonk code analysis
• RapidUp: Multi-Domain Permutation Protocol for Lookup Tables study notes
• Lookup argument overview
• Halo2 study notes - Lookup argument of design Proving system (1)
• logUp-Multivariate lookups based on logarithmic derivatives
• cq：fast lookup argument
• Lookup Argument performance optimization - Caulk
• Highlights of ZK Hack and ZK Summit in 2023
• Research Day 2023: Latest progress of Succinct ZKP
• Lasso, Jolt and Lookup Singularity - Part 1
• Lasso, Jolt, and Lookup Singularity—Part 2
• Learn more about Lasso+Jolt
• Lookup Singularity
• Halo2、Caulk+、Baloo、Cq Lookup argument细览