Lecture 9: SNARKs from Linear PCPs and QAPs

What this lecture covers

The lecture answers how to build a SNARK with a very short, constant-size proof, using an older technique that predates the polynomial-IOP and polynomial-commitment constructions taught earlier in the course. It builds on lecture 6's bilinear-pairing KZG commitment and contrasts with the error-correcting-code and polynomial-IOP schemes from lectures 4, 5, and 7 through 8.

By the end, you can explain how a quadratic arithmetic program (QAP) encodes circuit satisfiability as a polynomial identity, how that identity is compiled into a proof of only a few group elements using bilinear pairings, and how the same idea extends to rank-1 constraint systems (R1CS) and the Groth16 construction, including how zero knowledge is added.

Key ideas

• Linear PCP: a proof model where the prover publishes a linear function (an oracle) and the verifier queries it only with linear combinations, getting back a single inner-product value.
• Trace (transcript) for QAP: the vector of left input, right input, and output of every multiplication gate; addition gates are folded in implicitly rather than tracked separately.
• Selector polynomials (L_i(x), R_i(x), O_i(x)): public polynomials, one per trace entry, that evaluate to 1 or 0 (or a constant, for R1CS) depending on whether that entry is the left input, right input, or output of a given gate.
• Master polynomial: P(x) = L(x) * R(x) - O(x), built from the trace values and selector polynomials; it vanishes at every gate's evaluation point exactly when the trace is a valid circuit execution.
• Vanishing polynomial V(x): the minimal-degree polynomial with roots at all gate evaluation points; P(x) is zero everywhere on that set exactly when P(x) = V(x) * Q(x) for some quotient polynomial Q(x).
• Trusted, circuit-specific setup: the proving and verification keys encode the selector polynomials evaluated at a secret point, so a new setup is needed for every circuit.
• R1CS: a generalization of QAP where each constraint is a linear combination of trace values (not just 0/1 selection) multiplied together, matching another linear combination.
• Groth16: a refinement that merges several proof elements into one, giving a three-group-element proof and a single pairing check.

Walkthrough

History and context (0:01)

The lecture opens by placing linear-PCP-based SNARKs among the constructions already covered: pairing-based schemes with trusted setup, discrete-log schemes like Bulletproofs and Dory, and error-correcting-code schemes like Brakedown, Orion, and the FRI-based STARKs. It then traces the research history from Kilian and Micali's PCP-plus-Merkle-tree constructions, through Ishai-Kushilevitz-Ostrovsky's original linear PCP, Groth's 2010 pairing-based scheme, Lipmaa's progression-free-sets improvement, to the Gennaro-Gentry-Parno-Raykova breakthrough that introduced QAPs and reduced prover time from quadratic to quasi-linear.

Defining the QAP trace and selector polynomials (11:14)

Using a small example circuit, the lecture defines the extended witness vector (inputs plus multiplication-gate outputs) and shows how to build L_i(x), R_i(x), and O_i(x) by polynomial interpolation, answering "is this trace value the left/right input or output of gate j" at each of a set of evaluation points generated by roots of unity. Addition gates are handled by attributing their inputs to the multiplication gate they feed into, so no separate polynomials are needed for them.

The master polynomial and its vanishing property (19:20)

The lecture shows that evaluating the capital L(x), R(x), and O(x) polynomials (weighted sums of the selector polynomials by trace values) at each gate's point selects exactly that gate's left input, right input, and output. It follows that P(x) = L(x)R(x) - O(x) vanishes at every gate point precisely when the trace satisfies the circuit, and that this is equivalent to P(x) being divisible by the vanishing polynomial V(x).

Compiling QAP to a constant-size SNARK with pairings (49:38)

The lecture reframes QAP as an instance of the linear-PCP model, then shows how bilinear pairings replace the verifier's linear queries. The setup phase evaluates the selector polynomials at a secret point and raises them to a generator, producing a proving key; the prover combines these with the witness to produce a handful of group elements, and the verifier checks one pairing equation.

Fixing soundness gaps (1:00:48)

The initial version is shown to be insecure: a malicious prover could use arbitrary values instead of the public keys, or mix different witness vectors across the three proof terms. The lecture patches these with the knowledge-of-exponent assumption (or generic group model) to force use of the public keys, and an extra proof term and check to force consistency of the coefficients used across all three terms. A further patch separates public input/output wires from the secret witness so the verifier can compute its own contribution.

R1CS as a generalization (1:20:06)

The lecture generalizes selector polynomial evaluations from 0/1 to arbitrary public constants, yielding constraints of the form "one linear combination of the witness times another linear combination equals a third," which is R1CS. It also gives the matrix view, where the three selector tables become sparse matrices and the check reduces to a linear check plus a Hadamard-product check.

Groth16 and zero knowledge (1:28:12)

The lecture sketches how Groth16 merges three of the five proof elements into one using extra secret exponents alpha and beta, shrinking the proof to three group elements and the verification to a single pairing check. It closes by explaining that zero knowledge is added by adding random multiples of the vanishing polynomial to the proof terms, which preserves the pairing checks while hiding the witness.

Before you watch

• Review lecture 6's bilinear pairing and KZG commitment construction, since this lecture reuses both directly.
• Recall the interactive-proof and Plonk trace definitions from lectures 4 and 5 to see how the QAP trace differs from them.
• Some familiarity with polynomial interpolation and roots of unity (used for FFT-friendly evaluation points) is assumed.

Check your understanding

1. Why does the QAP trace only track multiplication-gate inputs and outputs, and how are addition gates accounted for in the selector polynomials?
2. What does it mean for P(x) to be divisible by the vanishing polynomial V(x), and why is that equivalent to circuit satisfiability?
3. Why is a single proof passing the pairing check not enough for soundness, and what two problems does the lecture patch to fix this?
4. How does R1CS generalize the QAP selector-polynomial approach to support arbitrary linear combinations?
5. What is the effect of adding random multiples of the vanishing polynomial to the proof terms in the zero-knowledge variant?