Lecture 10: Recursive SNARKs

What this lecture covers

The lecture answers how a SNARK can prove knowledge of another proof rather than a witness, and why that idea is useful. It builds on the SNARK definitions and constructions from earlier lectures (including Groth16, Plonk, and FRI-based schemes) and on the R1CS format introduced previously.

You come away understanding what two-level and n-level proof recursion mean, why recursion needs careful bookkeeping to stay knowledge sound, why recursive proving requires special elliptic curves, and how modern folding schemes such as Nova replace expensive recursive verification with a handful of cheap operations, enabling systems used in rollups and incrementally verifiable computation.

Key ideas

• Recursive SNARK: instead of proving knowledge of a witness w for a statement x, the outer proof system proves knowledge of a valid proof pi for x, where the circuit being proved is the inner system's verifier.
• Proof compression: chaining a fast-prover/large-proof inner system with a slower-prover/short-proof outer system, applied only to the small verification circuit, yields both a fast overall prover and a short final proof.
• Knowledge soundness of recursion: extraction works by composing extractors layer by layer, but each layer multiplies the extractor's running time, so recursion depth must stay logarithmic in the security parameter to remain polynomial time.
• Random oracle instantiation: before recursing, the Fiat-Shamir random oracle in the inner verifier must be replaced with a concrete hash function (e.g., Poseidon), since a prover circuit cannot compute an actual random oracle.
• Incrementally verifiable computation (IVC): proving a long iterated computation s_i = f(s_{i-1}, w_i) step by step, where each step's proof also certifies the previous step's proof, so memory stays bounded regardless of total computation length.
• Algebraic groups and curve mismatch: a prover supporting circuits over a field F_p produces commitments in a group defined over a different field F_q, forcing the verifier to do arithmetic in F_q; matching curves (chains or cycles of curves, like the Pasta curves) avoids expensive field emulation.
• Folding scheme: a protocol that compresses two valid R1CS-style instances into one folded instance, such that a valid witness for the folded instance implies (via an extractor) valid witnesses for both originals.
• Relaxed and committed R1CS: R1CS is relaxed with a scalar and an error vector to make folding work algebraically, and the error vector is replaced by a homomorphic commitment so the folded instance stays small.

Walkthrough

Two-level recursion and proof compression (0:00)

The lecture reviews the setup/prove/verify structure of a SNARK, then defines recursion: an outer proof system takes the inner system's proof pi as its witness and proves that the inner verifier would accept it. Because the outer prover only has to process the inner verifier's circuit (not the original large circuit), pairing a fast-prover inner system with a slow-prover, short-proof outer system yields a fast overall prover with a short final proof.

Knowledge soundness and recursion depth (7:07)

The lecture walks through building an extractor for the two-level construction by composing the outer system's extractor with the inner system's extractor, and shows the combined knowledge error stays negligible. It then flags that extractor running time roughly multiplies at each level, so unbounded recursion depth breaks polynomial-time extraction; practical constructions keep the depth logarithmic and instantiate the Fiat-Shamir random oracle with a concrete hash function before recursing.

Streaming proofs and incrementally verifiable computation (16:11)

The lecture shows how recursion enables streaming proof generation for batches of transactions as they arrive, rather than waiting for the whole batch. It then introduces IVC: a long computation built by repeatedly applying a function f, where each step outputs both the new state and a proof that the state and the previous proof are both valid, so the final proof certifies the entire computation trace via iterated extraction. Applications covered include compressing an entire blockchain's validity into one proof, verifiable delay functions, and markets for distributing proving work across GPUs.

The curve-matching problem in recursion (31:22)

The lecture explains why a prover for circuits over F_p using polynomial commitments in a group of order p (defined over F_q) forces the verifier to do arithmetic in F_q, mismatching what the next level's prover supports. It covers field emulation (correct but slow), the impossibility of a group of order p defined over F_p itself, and the better solutions: chains of groups and, more efficiently, cycles of groups such as the Pasta curves used in Halo 2, which let recursion "ping-pong" between two matched curves.

Folding schemes (46:35)

The lecture introduces folding as a faster alternative to full recursive verification. It defines a folding scheme for R1CS, shows that a naive random linear combination of two valid witnesses does not itself satisfy R1CS, and motivates relaxed R1CS, which adds a scalar c and error vector E to absorb the leftover cross terms. It then works through the algebra showing that folding two relaxed R1CS instances (using a prover-sent cross-term commitment and a verifier-chosen random challenge) produces a new relaxed instance with a valid witness, provided the error term is replaced by an additively homomorphic commitment to keep instances small.

Nova, Supernova, and Sangria (1:09:54)

The lecture applies folding to build IVC without running a verifier circuit inside the prover: each step's instance is folded into a running accumulator, and an augmented R1CS program checks the step computation plus just two group multiplications to certify the folding itself was done correctly. It closes by noting Supernova's extension to multiple step functions and Sangria's generalization of folding to Plonk-style arithmetization.

Before you watch

• Review the R1CS definition and Groth16 construction from the previous lecture, since recursion is expressed in R1CS terms here.
• Recall the KZG polynomial commitment and Fiat-Shamir transform from earlier lectures, both of which reappear in the discussion of curve matching and non-interactive folding.
• Familiarity with elliptic curve groups is assumed for the section on chains and cycles of curves.

Check your understanding

1. What does it mean for an outer proof system to "prove knowledge of a proof" rather than knowledge of a witness, and why does this help when the inner proof is large?
2. Why must recursion depth be kept logarithmic in the security parameter for the knowledge-soundness extractor to remain valid?
3. Why does a prover supporting circuits over F_p end up needing a verifier that does arithmetic over a different field F_q, and how do cycles of curves solve this?
4. Why doesn't a plain random linear combination of two R1CS witnesses satisfy R1CS, and what does relaxed R1CS add to fix this?
5. In the Nova-based IVC construction, what does the augmented R1CS program check at each step, and why is that cheaper than running a full SNARK verifier circuit?