One article understands Jolt Zkevm launched by A16Z

Author: Michael Zhu (A16z Crypto Research Engineer), Sam Ragsdale (A16z Crypto Investment Engineer); Translation: Bitchain Vision Xiaozou

On April 9, 2024, the A16Z encryption research and engineering team released the initial Jolt’s preliminary JoltaccomplishThis is a new SNARK design method, which is twice as fast as the existing technology, and there will be more improvements.

Verifying calculation (commonly known as ZK) is a very powerful technology, which is suitable for both blockchain and non -blockchain.It enables a computer (Verifier verification person) to entrust the calculation to another more powerful computer (Prover proof) and effectively verify whether the calculation is correctly executed.

In the encryption industry, the application that can be verified (especially SNARKS) includes:

Layer 2 (L2) Blockchain uses SNARKS to ensure the integrity of its state conversion.

Cross -chain bridge uses SNARKS to prove a deposit/withdrawal transfer to another chain.
A “ZK associate processor” (defined by Axiom) uses SNARKS to prove that some data on the chain data is calculated. If the data on the smart contract on the smart contract is too high.

There are many interesting non -blockchain examples that are hardly explored.For example, cloud service providers can prove to their client that they correctly run certain calculations entrusted to their servers.Software registry like NPM or Crates.io can prove that binary files are compiled from a specific source code, which reduces the risk of software supply chain attacks.Or a person can prove that their “Super Mario Brothers” tools auxiliary racing (TAS) broke the world record (Risc Zero also described this idea).

Many of these applications have a lot of programs that are too complicated and cannot be converted into circuit DSL (specific domain language) -imagine, for example, using the Circom language to rewrite the entire compiler or NES simulator.However, if the program compiles into a instruction set supported by ZKVM, it does not need to be transformed by handwriting circuit or DSL: programmers only need to use the advanced programming language they choose to write the program to process the remaining work by ZKVM.

Then, the remaining challenge is the performance of ZKVM Prover: it needs fast enough to be useful.This is particularly important for blockchain examples, because PROVER time will affect delay and affect the user experience.

It can be verified and calculated that it has been touted as the ultimate solution that is expected to be the expansion of the blockchain for a long time, but this technology has faced three major obstacles in terms of adoption:

performance:Compared with the native execution, the execution of the proof program will introduce a few quantitative overhead.
Complexity:The complexity of Snarks has triggered concerns about its safety, as the security guarantee of the assets on the billions of dollars on the chain.
Availability:The professional knowledge required by specific domain languages like Circom is unable to obtain most software developers.

The development of zero -knowledge virtual machine (ZKVMS) overcomes the third obstacle (available), because ZKVMS allows developers to write programs using advanced programming languages such as RUST or GO without the need to prove its execution without any underlying Snark.However, the improvement of ZKVMS availability has also led to high performance overhead (8 to 9 quantitatives) and complex deployment.

Last year, a Jolt article introduced a new paradigm to ZKVMS, promising to overcome the two challenges of performance overhead and deployment complexity.Compared with Stark’s existing ideas, Jolt’s theoretical background.By using Lasso to query parameters and other Sumcheck technologies, Jolt can prove the program faster than before, and it is easier to deploy new VM instructions than before.

Today, we are glad to release a Jolt open source deployment for the RV32i instruction set, and realize the promise made in the Jolt article.

fast:Our deployment is more than 5 times faster than Risc Zero, which is twice as faster than the SP1 just released in the preliminary benchmark test.
(Relative) Simple:The entire code library is less than 25,000 lines (less than half of other ZKVMS), and a single CPU instruction can be implemented in just 50 lines.

Below, let’s look at the performance benchmark together. It can be seen that Jolt is the most advanced emerging ZKVM.We also provide some guidance for developers who are interested in developing applications using Jolt. At the same time, we also provide a road map preview for developers who have contributed to Jolt -we expect that in the next few months, JoltIt will become faster and easier to use.

The A16Z encryption engineering team is based on a firm belief in open source value.Jolt as an open source public product will accelerate ZKVM research, wider SNARK research, and the development of the entire Web3 industry.Constructing encryption technology in the islands of the closed source code (code cannot be reviewed by the public), which usually brings trust to the unbelievable system.

1,performance

Compared with native execution, ZKVMS will bring about 8 quantitative overhead, which makes many verified and computing applications unrealized.The current version of Jolt has reduced this expenses to less than 6 orders.

Although we already have the most advanced performance, Jolt’s underlying technology (based on the Sumcheck Agreement) has not received the attention of engineers like more popular technology (based FRI).This shows that Jolt still has more development space -we have set some optimization on the roadmap, and we expect that there will be no chance of discovery.

Our A16Z/ZKVM benchmark test has determined Jolt, SP1 and RISC ZERO on various different Rust programs.As a result, the relative performance is similar in many similar RV32 programs.The figure below will refer to a program that executes the SHA2 hash chain.

The results of these benchmark tests are shown below.The benchmark test runs on the AWS R7G. 16Xlarge ARM machine, with 64 CPU kernel and 512 GIB DDR5 RAM.All benchmark tests are only for the CPU.

The continuous system of Continuations faces the balance between the PROVER time and the advantages and the size of the proof -when it is proved to be divided into more “sHARD slices” (or “paragraph”), the Prover becomes faster (because the shards are between the shardsIt is parallel), but it has a larger evidence before recursion.Prove that the size of the size is shown below, the results of the SP1 are parameterized by the piece count: SP1 (Shard_count).RISC ZERO has a fixed size, so its shard counting increases hidden with the program cycle count.Risc Zero supports recursive (SP1 and Jolt have not been supported), but the benchmark test below is a performance test performed without recursion.We do not use “pre -compilation”, so the benchmark test reflects the performance of the core ZKVM proof system.

2How is itJoltDevelopment and construction

In order to make Jolt use it as easy to use as much as possible, Jolt SDK provides a simple Wrappers of Jolt core functions by the A16Z Crypto engineering partner Noah Citron).All you have to do is add jolt_sdk :: provable property to the function to be proved.

You will then be able to use the build_*function to create a provocate and Verifier.

Please check the complete Fibonacci example (and others) in the code library.

In order to learn more deeply about Jolt architecture, Jolt Book (WIP) is a design selection and real -time update document about the design selection and code library that does not record in Jolt articles.In the next few weeks, we will publish more content for developers who are interested in developing and building on Jolt or wanting to know the internal mechanism of Jolt.

3What is the next thing

Although Jolt is an important milestone in the ZKVM field, we still have a long way to go.Take a step back, our performance benchmark test shows that Jolt Prover (on the M3 Max) proves that the speed of a program is as fast as the 100kHz processor -it is the two of Apollo No. 11 manned flight boarding mission computing capacity.More than.Do a humble comparison, 150 times slower than the Ti-84 graphics calculator.

In order to achieve computer -level performance, we have a lot of work to do.We will continue to improve the performance and availability of JOLT in order to provide developers with the best development experience.The following main tasks on the roadmap make us feel excited:

BiniusTheBen Diamond and Jim Posen have recently proposed a multi -linear polynomial commitment solution. This solution is particularly useful for systems like Jolt, because the promise value is small.The combination of Binius and Justin Thaler’s Sumcheck algorithm will significantly improve the PROVER performance of Jolt (we are expected to be 5-10 times).
More instructions:Jolt code library is currently deployed RV32i, but the Jolt structure is very flexible.We plan to add RISC-V “M” extension to provide support for integer multiplication and removal method, as described in Jolt’s article.In addition, Jolt can easily support 64 -bit variants RV64IM.
Continuations Continuous System:At present, due to memory limit, Jolt cannot prove the calculation of any length.We will use Continuations to divide the long calculation into smaller calculation blocks, and each block can be proved by Jolt.This will reduce memory use and support additional parallelism when proves a single calculation.
Certificate recursive:By combining Jolt with another proof system, we further reduced the size and verification time.For example, the Jolt verification device can be implemented in the Circom language to generate the constant -sized Groth16 proof that can be effectively verified on the chain.