Introduction

In EVM circuit, ExecutionState are not well balanced, some are very complicated and require many lookups, some are not. But the cost of EVM circuit is determined by the worst case, this note shows how we strike the balance by folding the layout and improve the lookup usage efficiency.

Approach

For example, we want to perform 2 lookup (bitwise and and bitwise or) to the same table without too much overhead.

Naive Layout

$$\begin{array}{|cccc|}\hline \mathtt{\text{a1}}& \mathtt{\text{a2}}& \mathtt{\text{a3 (a1 \& a2)}}& \mathtt{\text{a4 (a1 | a2)}}\\ \mathtt{\text{0b0101}}& \mathtt{\text{0b1010}}& \mathtt{\text{0b0000}}& \mathtt{\text{0b1111}}\\ \hline\end{array}$$

The pseudo code looks like:

assert subset(
    input=rlc(Tag::BitwiseAnd, a1, a2, a3),
    table=rlc(fixed_table),
)
assert subset(
    input=rlc(Tag::BitwiseOr, a1, a2, a4),
    table=rlc(fixed_table),
)

Folded Layout

In folded layout, we try to enable the lookup by constraining the compressed input to the same column of some rotation, to reuse the same subset argument as much as possible.

This layout helps reduce the amount of lookups in EVM circuit a lot.

$$\begin{array}{|ccccc|}\hline \mathtt{\text{a1}}& \mathtt{\text{a2}}& \mathtt{\text{a3 (a1 \& a2)}}& \mathtt{\text{a4 (a1 | a2)}}& \mathtt{\text{a5 (compressed input)}}\\ \mathtt{\text{0b0101}}& \mathtt{\text{0b1010}}& \mathtt{\text{0b0000}}& \mathtt{\text{0b1111}}& \mathtt{\text{rlc(Tag::BitwiseAnd, a1, a2, a3)}}\\ & & & & \mathtt{\text{rlc(Tag::BitwiseOr, a1, a2, a4)}}\\ \hline\end{array}$$

The pseudo code looks like:

assert a5 == rlc(Tag::BitwiseAnd, a1, a2, a3)
assert a5_w == rlc(Tag::BitwiseOr, a1, a2, a4)
assert subset(
    input=a5,
    table=rlc(fixed_table),
)

Misc

Multiple inputs to same table

To argue

$n$ degree-1 inputs are all subset to the same table, the cost comparison:

	$\mathsf{plonkup}$	$\mathsf{halo}\mathsf{2}\mathsf{subset}\mathsf{argument}$
$N_{\text{point}}$	$2+n$	$1+2n$
$N_{\text{evaluation}}$	$5+n$	$2+3n$
$D$	$2+n$	$1+2n$

Obviously,

$\mathsf{plonkup}$ has more advantages in such case. With extra challenge support in halo2, we can roll our own

$\mathsf{plonkup}$.

$\mathsf{plonkup}$

$$\begin{array}{ccccc}\text{Prover}& & \text{Transcript}& & \text{Verifier}\\ \\ \begin{array}{rl}& \{[f_i{]}_1\}=\{\mathsf{com}(f_i)\}\\ & \{[t_i{]}_1\}=\{\mathsf{com}(t_i)\}\end{array}& & \stackrel{\{[f_i{]}_1\},\{[t_i{]}_1\}}{\to }\\ \\ & & \stackrel{\theta }{\leftarrow }& & \theta \stackrel{\$}{\leftarrow }\mathbb{F}\\ \\ \{[h_i{]}_1{\}}_{i\in [n+1]}=\{\mathsf{com}(h_i){\}}_{i\in [n+1]}& & \stackrel{\{[h_i{]}_1{\}}_{i\in [n+1]}}{\to }\\ \\ & & \stackrel{\beta ,\gamma }{\leftarrow }& & \beta ,\gamma \stackrel{\$}{\leftarrow }\mathbb{F}\\ \\ [z{]}_1=\mathsf{com}(z)& & \stackrel{[z{]}_1}{\to }\\ \\ & & \stackrel{x}{\leftarrow }& & x\stackrel{\$}{\leftarrow }\mathbb{F}\\ \\ \\ \begin{array}{rlrl}& \{{\overline{f}}_i\}& & =\{\mathsf{eval}(f_i,x)\}\\ & \{{\overline{t}}_i\}& & =\{\mathsf{eval}(t_i,x)\}\\ & {\overline{t}}_{\omega }^{\prime }& & =\mathsf{eval}(t^{\prime },\omega x)\\ & \{{\overline{h}}_i{\}}_{i\in [n+1]}& & =\{\mathsf{eval}(h_i,x){\}}_{i\in [n+1]}\\ & {\overline{h}}_{0\omega }& & =\mathsf{eval}(h_i,\omega x)\\ & \overline{z}& & =\mathsf{eval}(z,x)\\ & {\overline{z}}_{\omega }& & =\mathsf{eval}(z,\omega x)\end{array}& & \stackrel{\begin{array}{rl}& \{{\overline{f}}_i\},\{{\overline{t}}_i\},{\overline{t}}_{\omega }^{\prime },\{{\overline{h}}_i{\}}_{i\in [n+1]},{\overline{h}}_{0\omega },\overline{z},{\overline{z}}_{\omega }\end{array}}{\to }\\ \end{array}$$

$\mathsf{halo}\mathsf{2}\mathsf{subset}\mathsf{argument}$

$$\begin{array}{ccccc}\text{Prover}& & \text{Transcript}& & \text{Verifier}\\ \\ \begin{array}{rl}& \{[f_i{]}_1\}=\{\mathsf{com}(f_i)\}\\ & \{[t_i{]}_1\}=\{\mathsf{com}(t_i)\}\end{array}& & \stackrel{\{[f_i{]}_1\},\{[t_i{]}_1\}}{\to }\\ \\ & & \stackrel{\theta }{\leftarrow }& & \theta \stackrel{\$}{\leftarrow }\mathbb{F}\\ \\ {\left\{\begin{array}{rl}& [f_i^{\prime }{]}_1\\ & [t_i^{\prime }{]}_1\end{array}\right\}}_{i\in [n]}={\left\{\begin{array}{rl}& \mathsf{com}(f_i^{\prime })\\ & \mathsf{com}(t_i^{\prime })\end{array}\right\}}_{i\in [n]}& & \stackrel{\{[f_i^{\prime }{]}_1,[t_i^{\prime }{]}_1{\}}_{i\in [n]}}{\to }\\ \\ & & \stackrel{\beta ,\gamma }{\leftarrow }& & \beta ,\gamma \stackrel{\$}{\leftarrow }\mathbb{F}\\ \\ [z{]}_1=\mathsf{com}(z)& & \stackrel{[z{]}_1}{\to }\\ \\ & & \stackrel{x}{\leftarrow }& & x\stackrel{\$}{\leftarrow }\mathbb{F}\\ \\ \\ \begin{array}{rlrl}& \{{\overline{f}}_i\}& & =\{\mathsf{eval}(f_i,x)\}\\ & \{{\overline{t}}_i\}& & =\{\mathsf{eval}(t_i,x)\}\\ & {\left\{\begin{array}{rl}& {\overline{f}}_i^{\prime }\\ & {\overline{f}}_{i\omega }^{\prime }\\ & {\overline{t}}_i^{\prime }\end{array}\right\}}_{i\in [n]}& & ={\left\{\begin{array}{rl}& \mathsf{eval}(f_i^{\prime },x)\\ & \mathsf{eval}(f_i^{\prime },\omega x)\\ & \mathsf{eval}(t_i^{\prime },x)\end{array}\right\}}_{i\in [n]}\\ & \overline{z}& & =\mathsf{eval}(z,x)\\ & {\overline{z}}_{\omega }& & =\mathsf{eval}(z,\omega x)\end{array}& & \stackrel{\begin{array}{rl}& \{{\overline{f}}_i\},\{{\overline{t}}_i\},\{{\overline{f}}_i^{\prime },{\overline{f}}_{i\omega }^{\prime },{\overline{t}}_i^{\prime }{\}}_{i\in [n]},\overline{z},{\overline{z}}_{\omega }\end{array}}{\to }\\ \end{array}$$