An overview of 'Custom Constraints' in PLONK systems

Plonk systems are one of the most famous ZK-Snarks out there. What makes them so widely accepted and popular is their modularity i.e. both Aritmetization and commitment schemes can be separated. PLONK uses KZG committment scheme which is one of the most popular one.

Prerequistes

The reader should be familiar with the basic working of PLONK system including their arithmetization, interactive oracles proofs, committment schemes and constraint systems. There are plenty of articles covering these topics in deep.

Copy constraints

In the vanilla PLONK equation

$$q_a.a+q_b.b+q_m.(a.b)+q_p.c=0$$

to activate a gate, we use bits like

$q_a,q_b,q_m$ and

$q_p$ to turn on the addition or multiplication gate.

Now consider two equations

$$a_1\ast b_1=c_1$$

$$a_2+b_2=c_2$$
and additionally

$$c_1=a_2$$

How can we enforce the above condition?

This is done using copy constrains. These are basically used to wire two gates where the ouput of one gate is some other input of second gate. We use a permutation polynomial to generate the different possibilites of a variable

• selector polynomials

Custom constraints

Now imagine you want to use a special type of function in your constrain system. A function which is not very SNARK friendly like keccack256 hashing function. Now to overcome this what we do use selector polynomials which activate special type of constrains like in the following equation

$q_{bool}$ activates

$a_0.a_0-a_0$

Each additional variable allows more expensive custom constraints but costsadditional proof elements.

Each additional multiplier per custom constraint allows more expressive custom constraints but costs additional proof elements.

Each type of custom constraint costs additional proof system. PLOOKUP is also a type of custom constrains.

For each additional variable the cost of commitiing the polynomial is increased. So there is a tradeoff between the complexity of the custom constraint used vs increase in proof generation time.