# UniPlonk Notes

- UniPlonK starts from the simple observation that although two Plonk circuits C1, C2 may have unequal
sizes n1 ̸= n2, their proofs and verifying keys have the same size. - Examining the Plonk verifier protocol,
we see that if their public input lengths are equal, the C1 and C2 verifiers perform nearly identical work.

- The cost of the Universal Verifier is at least that of the most expensive verifier for any circuit in the supported family. We therefore have a trade-off between the flexibility offered by supporting a large family of circuits and the need to pay the worst-case verifier cost for any circuit in the family. However, as we discuss, this overhead is extremely small in comparison to the underlying circuit-independent verification cost and is justified by its utility in recursion-based proof aggregation.

- 

- To solve the first problem, recent works such as aPlonk [1], SnarkPack [14], and Halo Infinite [6]
partially move some of the expensive non-native arithmetic, e.g. pairing, out of the outer circuit. They
replace individual pairing checks for each proof with a single pairing check for a random linear combination of the proofs. The verifier only needs to check the accumulated pairing, which they can do out
of circuit. This results in a more efficient aggregator.

- UniPlonk could be combined with either atomic accumulation-based aggregation or folding-based
aggregation to create Universal ZK-ZK Aggregation scheme with:
• Prover Separation: The inner prover and the outer prover (aggregator) are not the same party.
• Witness Privacy: The outer prover only has access to the inner proofs, not the witnesses. This is
very useful in privacy-preserving ZK primitives such as Semaphore.
• Universality: The inner prover can support all circuits up to a certain size

## Overview

For a given circuit C, the UniPlonk Setup process produces a verification key vk which is augmented
with metadata about C that facilitates constant-time verification. The proving key for UniPlonk is the
unchanged proving key pkP from Plonk and can be used with a standard Plonk prover (where the prover
follows the conventions we give here for seeding the transcript, and shares the srs and other constants
with the UV). Given a Plonk proof π
P for a circuit C, with public inputs PI, a uniformization step
accepts π
P , PI, and augmented vk and outputs a proof π of fixed size, compatible with the universal
12
verifier. The UV then takes as inputs the augmented verification key vk, the transformed proof π, and
a commitment [PI]1 to the public inputs.

## Vanilla UniPlonk

We let C be the family of Plonk circuits defined over a common field F having at most N = 2K rows and
using some common set of public parameters (see Definition 1). Our goal is to construct a UV, a single
algorithm that uses a fixed sequence of operations to verify the proof of any circuit in the family C. This
UV may then be used to define a single recursive verifier circuit that applies to the entire family C.