feat: transparent backend for VEIL frontend (#2741)

Author: rdalal

.claude/settings.json

@@ -12,7 +12,10 @@
       "Bash(xargs sed:*)",
       "Bash(for i:*)",
       "Bash(do cargo:*)",
-      "Bash(git worktree *)"
+      "Bash(git worktree *)",
+      "Bash(find /Users/rdalalsuccinct/Documents/sp1-wip/slop/crates/*/tests -maxdepth 2 -type d)",
+      "Bash(find /Users/rdalalsuccinct/Documents/sp1-wip/slop/crates/*/src -mindepth 1 -maxdepth 2 -type d)",
+      "Bash(awk -F/ '{print $NF}')"
     ]
   }
-}
+}

slop/crates/veil/benchmarking/common.rs

@@ -19,7 +19,7 @@ use slop_multilinear::{Mle, MultilinearPcsProver, Point};
 use slop_stacked::{StackedPcsProver, StackedPcsVerifier};
 use slop_sumcheck::{partially_verify_sumcheck_proof, reduce_sumcheck_to_evaluation};
 use slop_veil::compiler::{ConstraintCtx, ReadingCtx};
-use slop_veil::protocols::sumcheck::SumcheckParam;
+use slop_veil::protocols::sumcheck::{SumcheckInputClaim, SumcheckParam};
 use slop_veil::zk::stacked_pcs::{initialize_zk_prover_and_verifier, StackedPcsZkProverCtx};
 use slop_veil::zk::{compute_mask_length, ZkProverCtx, ZkVerifierCtx};
 
@@ -84,11 +84,13 @@ fn single_mle_read<C: ReadingCtx>(
 fn single_mle_build_constraints<C: ConstraintCtx>(
     ctx: &mut C,
     oracle: C::MleOracle,
+    claim: C::Extension,
     view: slop_veil::protocols::sumcheck::SumcheckView<C>,
 ) {
-    let point: Point<C::Challenge> = Point::from(view.point.clone());
-    ctx.assert_mle_eval(oracle, point, view.claimed_eval.clone());
-    view.build_constraints(ctx).unwrap();
+    let point: Point<C::Challenge> = Point::from(view.out_claim.point.clone());
+    ctx.assert_mle_eval(oracle, point, view.out_claim.claimed_eval.clone());
+    let in_claim = SumcheckInputClaim::from_value(claim);
+    view.build_constraints(&in_claim, ctx).unwrap();
 }
 
 fn run_standard_single(
@@ -188,18 +190,17 @@ fn run_zk_single(
 
         let masks_length = compute_mask_length::<GC, _>(
             |ctx| single_mle_read(ctx, num_encoding_variables, log_num_polynomials, num_variables),
-            |(oracle, view), ctx| single_mle_build_constraints(ctx, oracle, view),
+            |(oracle, view), ctx| single_mle_build_constraints(ctx, oracle, claim, view),
         );
 
         let mut ctx: StackedPcsZkProverCtx<GC, MK> =
             ZkProverCtx::initialize_with_pcs_only_lin(masks_length, pcs_prover, rng);
 
         let commit = ctx.commit_mle(original_mle.clone(), log_num_polynomials, rng).unwrap();
 
-        let view = param.prove(mle_ef.clone(), &mut ctx, claim);
-        let point: Point<EF> = Point::from(view.point.clone());
-        ctx.assert_mle_eval(commit, point, view.claimed_eval.clone());
-        view.build_constraints(&mut ctx).unwrap();
+        let in_claim = SumcheckInputClaim::from_value(claim);
+        let view = param.prove(&in_claim, mle_ef.clone(), &mut ctx);
+        single_mle_build_constraints(&mut ctx, commit, claim, view);
 
         let zkproof = ctx.prove(rng);
         (zkproof, prover_start.elapsed())
@@ -211,7 +212,7 @@ fn run_zk_single(
         let mut ctx = ZkVerifierCtx::init(zkproof, Some(zk_stacked_verifier));
         let (oracle, view) =
             single_mle_read(&mut ctx, num_encoding_variables, log_num_polynomials, num_variables);
-        single_mle_build_constraints(&mut ctx, oracle, view);
+        single_mle_build_constraints(&mut ctx, oracle, claim, view);
         ctx.verify().expect("Failed to verify");
 
         verifier_start.elapsed()
@@ -243,17 +244,23 @@ fn hadamard_read<C: ReadingCtx>(
     HadamardReadData { ci_base, ci_ext, view }
 }
 
-fn hadamard_build_constraints<C: ConstraintCtx>(ctx: &mut C, data: HadamardReadData<C>) {
-    let point: Point<C::Challenge> = Point::from(data.view.point.clone());
-    let base_eval = data.view.component_evals[0].clone();
-    let ext_eval = data.view.component_evals[1].clone();
+fn hadamard_build_constraints<C: ConstraintCtx>(
+    ctx: &mut C,
+    claim: C::Extension,
+    data: HadamardReadData<C>,
+) {
+    let point: Point<C::Challenge> = Point::from(data.view.out_claim.point.clone());
+    let base_eval = data.view.out_claim.component_evals[0][0].clone();
+    let ext_eval = data.view.out_claim.component_evals[0][1].clone();
     ctx.assert_a_times_b_equals_c(
         base_eval.clone(),
         ext_eval.clone(),
-        data.view.claimed_eval.clone(),
-    );
+        data.view.out_claim.claimed_eval.clone(),
+    )
+    .unwrap();
     ctx.assert_mle_multi_eval(vec![(data.ci_base, base_eval), (data.ci_ext, ext_eval)], point);
-    data.view.build_constraints(ctx).unwrap();
+    let in_claim = SumcheckInputClaim::from_value(claim);
+    data.view.build_constraints(&in_claim, ctx).unwrap();
 }
 
 fn run_standard_hadamard(
@@ -385,7 +392,7 @@ fn run_zk_hadamard(
 
         let masks_length = compute_mask_length::<GC, _>(
             |ctx| hadamard_read(ctx, num_encoding_variables, log_num_polynomials, num_variables),
-            |data, ctx| hadamard_build_constraints(ctx, data),
+            |data, ctx| hadamard_build_constraints(ctx, claim, data),
         );
 
         let mut ctx: StackedPcsZkProverCtx<GC, MK> =
@@ -394,9 +401,10 @@ fn run_zk_hadamard(
         let ci_base = ctx.commit_mle(mle_1.clone(), log_num_polynomials, rng).unwrap();
         let ci_ext = ctx.commit_mle(mle_2.clone(), log_num_polynomials, rng).unwrap();
 
-        let view = param.prove(hadamard_product, &mut ctx, claim);
+        let in_claim = SumcheckInputClaim::from_value(claim);
+        let view = param.prove(&in_claim, hadamard_product, &mut ctx);
         let data = HadamardReadData { ci_base, ci_ext, view };
-        hadamard_build_constraints(&mut ctx, data);
+        hadamard_build_constraints(&mut ctx, claim, data);
 
         let zkproof = ctx.prove(rng);
         (zkproof, prover_start.elapsed())
@@ -410,7 +418,7 @@ fn run_zk_hadamard(
         let mut ctx = ZkVerifierCtx::init(zkproof, Some(zk_stacked_verifier));
         let data =
             hadamard_read(&mut ctx, num_encoding_variables, log_num_polynomials, num_variables);
-        hadamard_build_constraints(&mut ctx, data);
+        hadamard_build_constraints(&mut ctx, claim, data);
         ctx.verify().expect("Failed to verify");
 
         verifier_start.elapsed()

slop/crates/veil/examples/mle_eval.rs

@@ -1,9 +1,22 @@
-//! Example: ZK sumcheck using the public VEIL interface.
+//! Example: random-opening "protocol" for a committed MLE, run against two backends.
 //!
-//! Demonstrates the full prove/verify flow:
-//! 1. Generate a random MLE and compute its hypercube sum
-//! 2. Prover sends sumcheck messages via `SendingCtx`
-//! 3. Verifier reads and checks via `ReadingCtx` + compiler `SumcheckParam`
+//! This is the degenerate terminal case of a veil protocol: nothing is really being
+//! reduced — we just commit an MLE, sample a random point, open at that point, and
+//! discharge the resulting evaluation claim via the primitive `ctx.assert_mle_eval`.
+//! Effectively a PCS smoke test.
+//!
+//! The protocol is written once, generically over `SendingCtx` / `ReadingCtx`, then
+//! run first with the zero-knowledge backend (`ZkProverCtx` / `ZkVerifierCtx`) and
+//! afterwards with the transparent backend (`TransparentProverCtx` /
+//! `TransparentVerifierCtx`).
+//!
+//! Shape:
+//!
+//! - `mle_eval_read` / `mle_eval_prove`: mirror entry points — one reads the
+//!   transcript on the verifier side, the other commits + samples + sends on the
+//!   prover side. Both return an [`MleEvalView`].
+//! - `mle_eval_build_constraints`: the shared constraint-building pass used by both
+//!   sides.
 
 use rand::SeedableRng;
 use rand_chacha::ChaCha20Rng;
@@ -12,77 +25,118 @@ use slop_koala_bear::KoalaBearDegree4Duplex;
 use slop_merkle_tree::Poseidon2KoalaBear16Prover;
 use slop_multilinear::{Mle, Point};
 use slop_veil::compiler::{ConstraintCtx, ReadingCtx, SendingCtx};
+use slop_veil::transparent::{
+    initialize_transparent_prover_and_verifier, TransparentProverCtx, TransparentVerifierCtx,
+};
 use slop_veil::zk::stacked_pcs::{initialize_zk_prover_and_verifier, StackedPcsZkProverCtx};
 use slop_veil::zk::{compute_mask_length, ZkProverCtx, ZkVerifierCtx};
 
 type GC = KoalaBearDegree4Duplex;
+type F = <GC as IopCtx>::F;
 type MK = Poseidon2KoalaBear16Prover;
 
 const LOG_NUM_POLYNOMIALS: u32 = 8;
 const NUM_ENCODING_VARIABLES: u32 = 8;
 const NUM_VARIABLES: u32 = LOG_NUM_POLYNOMIALS + NUM_ENCODING_VARIABLES;
 
-fn read<C: ReadingCtx>(ctx: &mut C) -> (C::MleOracle, Point<C::Challenge>, C::Expr) {
-    let p_oracle = ctx.read_oracle(NUM_ENCODING_VARIABLES, LOG_NUM_POLYNOMIALS).unwrap();
-    let point = ctx.sample_point(NUM_VARIABLES);
-    let eval = ctx.read_one().unwrap();
-    (p_oracle, point, eval)
-}
+// ============================================================================
+// Generic protocol code
+// ============================================================================
 
-fn build_constraints<C: ConstraintCtx>(
-    ctx: &mut C,
-    p_oracle: C::MleOracle,
+struct MleEvalView<C: ConstraintCtx> {
+    oracle: C::MleOracle,
     point: Point<C::Challenge>,
-    eval: C::Expr,
-) {
-    ctx.assert_mle_eval(p_oracle, point, eval);
+    claimed_eval: C::Expr,
 }
 
-fn main() {
-    let mut rng = ChaCha20Rng::from_entropy();
+/// Verifier-side entry point: read the committed oracle, sample the opening point,
+/// and read the prover's claimed evaluation out of the transcript.
+fn mle_eval_read<C: ReadingCtx>(ctx: &mut C) -> MleEvalView<C> {
+    let oracle = ctx.read_oracle(NUM_ENCODING_VARIABLES, LOG_NUM_POLYNOMIALS).unwrap();
+    let point = ctx.sample_point(NUM_VARIABLES);
+    let claimed_eval = ctx.read_one().unwrap();
+    MleEvalView { oracle, point, claimed_eval }
+}
 
-    // Generate a random MLE
-    let p = Mle::<<GC as IopCtx>::F>::rand(&mut rng, 1, NUM_VARIABLES);
+/// Prover-side entry point: commit `mle`, sample the opening point, compute the
+/// evaluation, send it on the transcript, and return the matching [`MleEvalView`]
+/// for the caller to feed into [`mle_eval_build_constraints`].
+fn mle_eval_prove<C, RNG>(ctx: &mut C, mle: Mle<C::Field>, rng: &mut RNG) -> MleEvalView<C>
+where
+    C: SendingCtx,
+    RNG: rand::CryptoRng + rand::Rng,
+    rand::distributions::Standard: rand::distributions::Distribution<C::Field>,
+{
+    let oracle =
+        ctx.commit_mle(mle.clone(), LOG_NUM_POLYNOMIALS, rng).expect("failed to commit mle");
+    let point = ctx.sample_point(NUM_VARIABLES);
+    let eval = mle.eval_at(&point).evaluations().as_slice()[0];
+    let claimed_eval = ctx.send_value(eval.into());
+    MleEvalView { oracle, point, claimed_eval }
+}
 
-    let mask_length = compute_mask_length::<GC, _>(read, |(p_o, point, eval), ctx| {
-        build_constraints(ctx, p_o, point, eval)
-    });
-    eprintln!("Mask length: {}", mask_length);
+/// Shared constraint-building pass used by both sides.
+fn mle_eval_build_constraints<C: ConstraintCtx>(view: MleEvalView<C>, ctx: &mut C) {
+    ctx.assert_mle_eval(view.oracle, view.point, view.claimed_eval);
+}
 
-    let (pcs_prover, verifier) = initialize_zk_prover_and_verifier(1, NUM_ENCODING_VARIABLES);
+fn main() {
+    let mut rng = ChaCha20Rng::from_entropy();
 
-    // === PROVER ===
-    eprintln!("\n=== PROVER ===");
-    let proof = {
-        eprintln!("Proving...");
-        let mut ctx: StackedPcsZkProverCtx<GC, MK> =
-            ZkProverCtx::initialize_with_pcs_only_lin(mask_length, pcs_prover, &mut rng);
+    let p = Mle::<F>::rand(&mut rng, 1, NUM_VARIABLES);
 
-        // Commit to p
-        let commit =
-            ctx.commit_mle(p.clone(), LOG_NUM_POLYNOMIALS, &mut rng).expect("failed to commit");
-        // Get a random point
-        let point = ctx.sample_point(NUM_VARIABLES);
+    // ZK backend.
+    eprintln!("\n=== ZK BACKEND ===");
+    let (zk_pcs_prover, zk_pcs_verifier) =
+        initialize_zk_prover_and_verifier(1, NUM_ENCODING_VARIABLES);
 
-        let eval = p.eval_at(&point)[0];
-        let eval = ctx.send_value(eval);
+    let zk_proof = {
+        let now = std::time::Instant::now();
+        let mask_length = compute_mask_length::<GC, _>(mle_eval_read, mle_eval_build_constraints);
+        eprintln!("Mask length: {mask_length}");
 
-        ctx.assert_mle_eval(commit, point, eval);
+        let mut pctx: StackedPcsZkProverCtx<GC, MK> =
+            ZkProverCtx::initialize_with_pcs_only_lin(mask_length, zk_pcs_prover, &mut rng);
+        let view = mle_eval_prove(&mut pctx, p.clone(), &mut rng);
+        mle_eval_build_constraints(view, &mut pctx);
+        let proof = pctx.prove(&mut rng);
 
-        let proof = ctx.prove(&mut rng);
-        eprintln!("Proving complete");
+        eprintln!("Prover time: {:?}", now.elapsed());
+        proof
+    };
+    {
+        let mut vctx = ZkVerifierCtx::init(zk_proof, Some(zk_pcs_verifier));
+        let view = mle_eval_read(&mut vctx);
+        mle_eval_build_constraints(view, &mut vctx);
+        vctx.verify().expect("zk verification failed");
+    }
+    eprintln!("ZK backend: PASSED");
+
+    // Transparent backend.
+    eprintln!("\n=== TRANSPARENT BACKEND ===");
+    let (stacked_prover, stacked_verifier) = initialize_transparent_prover_and_verifier::<GC, MK>(
+        1,
+        NUM_ENCODING_VARIABLES,
+        LOG_NUM_POLYNOMIALS,
+    );
+
+    let transparent_proof = {
+        let now = std::time::Instant::now();
+        let mut pctx: TransparentProverCtx<GC, MK> =
+            TransparentProverCtx::initialize(stacked_prover);
+        let view = mle_eval_prove(&mut pctx, p.clone(), &mut rng);
+        mle_eval_build_constraints(view, &mut pctx);
+        let proof = pctx.prove(&mut rng).expect("transparent prove failed");
+        eprintln!("Prover time: {:?}", now.elapsed());
         proof
     };
-
-    // === VERIFIER ===
-    eprintln!("\n=== VERIFIER ===");
     {
-        let mut ctx = ZkVerifierCtx::init(proof, Some(verifier));
-        // Verifier reads from transcript and builds constraints
-        let (p_oracle, point, eval) = read(&mut ctx);
-        build_constraints(&mut ctx, p_oracle, point, eval);
-        ctx.verify().expect("verification failed");
+        let mut vctx = TransparentVerifierCtx::<GC>::new(transparent_proof, Some(stacked_verifier));
+        let view = mle_eval_read(&mut vctx);
+        mle_eval_build_constraints(view, &mut vctx);
+        vctx.verify().expect("transparent verification failed");
     }
+    eprintln!("Transparent backend: PASSED");
 
-    eprintln!("\n=== PASSED ===");
+    eprintln!("\n=== ALL PASSED ===");
 }