About using gnark to write circuit output signals

[yinzhenzhen]

When using gnark to write a circuit, I don't want to use assert-related interfaces in the circuit, but I hope that the final results of all verifications can be output as a public signal through an output signal. When verifying the proof, this output signal must be 1 to verify the proof. The purpose is to generate a proof for wrong data, but the proof fails. Can gnark achieve this effect?

[ivokub]

Hi @yinzhenzhen. I'm not fully understanding the question - so lets say you write a very basic circuit:

type Circuit struct {
    P, Q frontend.Variable `gnark:",secret"`
    N frontend.Variable `gnark:",public"`
}

func (c *Circuit) Define(api frontend.API) error {
    res := api.Mul(c.P, c.Q)
    api.AssertIsEqual(res, c.N)
    return nil
}

and now you would like to create a proof for some invalid inputs e.g. Circuit{P: 2, Q:3, N:5}? It is not directly possible right now as the prover internally runs the solver to compute all intermediate variables and checks the assertions and then the full trace is used to compute the proof (see https://github.com/Consensys/gnark/blob/master/backend/groth16/bn254/prove.go#L101-L107). It is possible to modify the solver and prover such that it wouldn't fail in case of incorrect inputs, in which case we would just get invalid proof.

Another approach (but maybe this is what you meant initially) is to perform instead of final assertion some other check. A la

type Circuit struct {
    P, Q frontend.Variable `gnark:",secret"`
    N frontend.Variable `gnark:",public"`
    IsInvalid frontend.Variable `gnark:",public"`
}

func (c *Circuit) Define(api frontend.API) error {
    res := api.Mul(c.P, c.Q)
    expectedResult := api.Select(c.IsInvalid, res, c.N)
    api.AssertIsEqual(expectedResult, c.N)
    return nil
}

Now, you should be able to compute the proof for Circuit{P: 2, Q:3, N:5, IsInvalid:1}, but not for Circuit{P: 2, Q:3, N:5, IsInvalid: 0}. You should also be able to compute the proof for Circuit{P: 2, Q:3, N:6, IsInvalid:0}.

For some of the primitives (for example for recursive proof verification if you are checking SNARK proof inside a circuit) we don't have a direct way to verify invalid proofs however, but we're planning to add the primitives (see #1454 for example)

[ivokub]

I created a new issue, see #1522. I don't have right now time to work on it, but would be welcoming a PR!

[ivokub]

For the recursive circuit, I think it may be because the default timeout of unit test is only 30s. I did not expect that recursive verification would take so long. I would like to know under what circumstances the recursive circuit will be used, and the curve recommended for the recursive circuit. By the way, what configuration of the server was used to generate your 78s? My local configuration may not be good enough, and it still times out after 120s.

I have AMD Ryzen 9 7940 with 96GB of memory.

The long time for running the test is probably due to the setup generation. I think the proving time itself should be a few seconds. If you want to try, then you could separate setup generation from the proving and then benchmark. In practice you anyway only generate setup once and then at proof computation would reuse it.

[yinzhenzhen]

OK, thank you for your reply. For the first question, is it not possible to realize the requirement I mentioned at present? If so, I think I may need to change other ideas. For the second question, I think it may take a long time to set up. Excluding this step, will the combination of BLS12_377 and BW6_761 curves make the time to generate proofs shorter? I see that the examples of groth16 and plonk both use these two curves.

[ivokub]

Yes, for now it is not possible. I don't think we would implement even a way to solve the circuit for invalid assignment, as in large and complex circuits it may cause unexpected side-effects.

Yes - in BLS12-377 and BW6-761 combination it should be a lot faster. These curves are compatible with each other so that there is no field arithmetic emulation overhead. See https://github.com/Consensys/gnark/blob/master/std/recursion/groth16/native_doc_test.go for an example.

[yinzhenzhen]

OK, I understand, thank you~