Aggregation Day : Plonky3, Type 1, Miden

[Music] all right so we're going to go ahead and uh get to the uh next panel here we have some great uh guests and I'm G to try to add people let's see add to Stage o okay I still have the power and let's see oh there we go so bobin why are you the Grim Reaper that's it's actually it's actually U um the character from a video game so like this is this is uh his Avatar I'm just using it well it does look now that you say it it does look like a green Ripper a little bit true okay so this uh talk is going to be on plony 3 uh type one provs and miden uh we have some uh people from outside of polygon Labs here that we so excited to bring in to be in this discussion we have uh uh um Roy from cinct uh we have uh Eli Eli uh Ben sassin from uh starkware bobin threadbear from polygon Maiden Daniel uh lubero for uh polygon zero and Brendan farmer from polygon zero we're not letting Brendan leave today apparently they are uh Trapped In The Stream so we're going to go ahead and get started on that thank you all hey everyone I I think I'm also moderating this uh this panel but you get to you don't get to stop moderating too I I I I don't really have anything to contribute myself uh compared to everyone who's on the panel so I I think moderating is probably the the right role for me but um yeah just really happy to uh to welcome everyone especially Ellie and Uma um who have both uh had huge Monumental announcements and developments over the last few weeks that we can get to but um maybe uh maybe Ellie we we can start with you um starkware and polygon announced something that was sort of unusual for this space because we are nominally competitors and you know very we have a very bitter and uh and and uh like intense rivalry I I I think is is a a fair characterization but um but we actually collaborated and uh came together in a really really nice way to push the underlying math and Technology forward um through what's called uh Circle Starks and so maybe you can just give your your perspective on on collaborating with others in the space and and what this Advanced means um for the technology yeah so so thank you Brendon indeed um we are competitors I don't if bitter competitors or something as the the words I would use to describe but we are competitors and uh but we also collaborated especially when it comes to math and science and earlier this week uh uh a very exciting uh math white paper came out co-authored by olish Hab from uh your team from polygon zero and uh David levit and shahal papini from starware um which um could arguably lead to uh uh you know next generation of super fast provs uh the main thing there is that it allows to do a lot of the uh needed arithmetic to get Starks which are the most scalable fastest proving systems also the safest ones um to get them to work uh pretty pleasantly over a specific uh 32bit field known as the meren prime uh which has a lot of beautiful properties so it's it's a very exciting piece of math and it has uh some very elegant things such as use of the good old Circle that we all know from I guess kindergarten right that that shape thing but uh has also a lot of like very deep uh mathematical gems in it and uh was a pleasure to see uh the very smart folks from both teams work on it yeah I I I think it was a really exciting collaboration for us because obviously your your team is uh well known as as the pioneers of obviously Starks and a lot of the technology that we use at polygon um and so it was really cool to be able to contribute I obviously you guys invented Starks and this this technique called EC fft and so it it was really nice to be able to sort of do our our little part in in furthering the research so it wasn't so little a part but it was and yeah it was a pretty big part anyways like uh beautiful collaboration and um um I yeah hopefully this will be the standard for Next Generation uh uh Stark provs um a lot more to come there and and I think this is not the first time we're collaborating right or at least there was another paper that the log up gkr paper that also uh was you know polyon zero and starkware collaborated together so those it's really cool to see it over time yes that's a good point um and then Uma while we're on the topic of of Open Source software and contributions um cinct obviously released sp1 which is a really performant zbm that I think has a lot of people in this space really excited um to to draw some connection to polygon uh sp1 leverages planky 3 and which is a approving system library and I I'm just curious what your perspective is on um on collaboration and and developing open source software and and uh sort of like how we we can build public goods both at the proving system level and at something like a a zbm um yeah um thanks Brandon yeah as you mentioned so sp1 is this general purpose dkbm that lets people like write rust and then you can kind of get proofs and yeah it's built on top of plony 3 which Daniel and you and other people on the polygon zero team have been doing an amazing job with uh we were big users also of Pony 2 which was kind of like the previous iteration um before Pony 3 and pony 3 has been really awesome to use I think one thing that's really nice about open source is for example the circle Stark work from my understanding will be integrated into plony 3 and then that will help make things like sp1 or other projects built on top of pony 3 uh automatically faster without us having to like with us being able to take advantage of it with like a few configuration changes and things like that uh We've also contributed back Upstream to Pony 3 um in some cases I think helping out with the verifier things like that um so that's also been really fun to collaborate with Daniel and like other people at polygon zero um so yeah overall I think we're really big fans of Open Source because the progress compounds and like helps make all the projects in using that technology better um so that's been like really awesome to see awesome um well I think that's a good segue to uh to Daniel um could you talk a little bit about planky 3 where where you see it going what what you see as the the future direction for for proving system development yeah definitely uh so I'd say there were a couple motivations for plunky 3 when we look back at plunky 2 it was a nice Library that's easy to use but it it had certain limitations it had uh it it didn't have much flexibility it basically did things one way and that was it so it used um qub circuits or simple Starks and it used for example Poseidon as the hash and that was pretty baked in um it always used a fry based polinomial commitment scheme and yeah it just didn't have too much flexibility so as as we started learning about new techniques that we wanted to experiment with we couldn't really integrate them easily into plugy 3 plunky 2 so plunky 3 is much more modular we have all these all of these abstractions for things like polinomial commitment schemes low degree tests um a sort of vector commitment scheme type primitive and so forth so we we can Implement not just kind of standard Starks but also more exotic ideas for example there was the the idea of kind of taking Starks and then replacing Merle trees with a RSA based Vector commitment so we I'm not sure if that's a that you know necessarily a very useful option but but it just allows us to experiment with things like that um I think the the other really nice thing about plunky 3 is it has more powerful batching support so so in plunky 2 we we built the Z this ZK evm on top of py 2 and it really involved several Starks that get connected together and with the way we approached that in plunky 2 each St would basically get its own Merkel tree and its own fry instance so it was nice and simple but as we added more Starks to this system um we would just have more overhead from all these different Merk authentication paths That Couldn't reuse any any common nodes and these separate fry instances and in plunky 3 we we just allow allow all of that to be to be combined into one big Merkle tree and one fry instance even if the legs don't match oh awesome awesome um and then bobin uh last but not least uh polygon miden this is going to be a very big year for polygon miden maybe you could give us a little bit of a preview of what's to come and then how you think about taking sort of underlying R&D advancements like uh happened with circle Stark and implementations like py3 and kind of incorporating those into the miden road map yeah yeah definitely so uh um I'm personally like very excited about py 3 as well as right now just to State uh we're not yet using plun 3 but I'm very much looking toward like migrating M to use plun 3 because U you know Daniel mentioned a few advancements but I think one of the things I would like to highlight is that like what it allows that this different batching what it allows you to do is to have diff like Star tables or execution traces of different lengths and combine them in a much more efficient way uh and you know you only pay for what you need so for example in mid we don't currently do that uh you kind of have like a single table and uh or a single execution trace and um you know you kind of pay for the longest poll but with this new technique we would be able to kind like make it even more efficient because you um you know expensive things were not expensive but the long pole can be in its own execution Trace table and you can then combine them together so this is very exciting in terms of um overall road map M where for now we're focusing Less on the proving system stuff uh just because we're trying to get the actual rollup uh uh up and running um I think um you know we're at the point where we have our devet uh kind of running already we have like a node and you know over the next couple months we'll make this public so that people can experiment with that and the idea is to uh get to Main at later this year so that we can actually have people like you know uh use m in the more kind of real war scenario so that we can also learn from kind of use cases that people want to um uh when I use mid 4 uh at this point we have like a few ideas we like I think last week um we announced this Pioneers program where they we have like a few projects building on miden trying to use specifically some of the things that miden allows like local proving and things like that and um you know I think you know thinking into the future right now um in my mind like if you want to generate proofs on the server side um we're very close to the point where with things like py 3 you will get to a point where the proof costs are fairly small M actually wants to do it on the client side as well and this is where like further advancements like with spy and maybe even Beyond would be very interesting because on the client side you you are quite a bit more constrained frequently you want to run you know on the laptop or even a smartphone and uh taking like this is the uh kind of the next Frontier in my mind where we went to we got to a point where on the server side proofs are almost like negligible we still probably have a couple more years to go until we get to a point where the proof costs are truly negligible uh but on the client side may take a bit longer yeah that that makes sense I I I I think just to step back for context like if people are confused about you know polygon has zkv and cdk and miden and theair like polygon miden chains will be at least the way that I think about them like will sort of be an option for cdk and so there'll sort of be like units and execution environments in this broader ecosystem that's connected by the EG and so I I I think that's like a really really exciting thing because it means that you can have these amazing Innovative features on the execution environment side that are brought by miden and those can interoperate with uh uh like your zvm chains and and other chains in in the AG environment so I I I think that's a really cool uh future Direction because we ultimately want things like privacy and client side proving and all the features that are are offered by mid so yeah yeah this is a super cool thing where you can have like evm based chains and non evm based chains all kind of come together uh in a single system absolutely so Ellie uh I I'd like to go back to you I I think as someone who's been uh maybe more than anyone else in the validity rollup space like a core contributor and Pioneer of the underlying technology I'm I'm really curious while we have you here where you see the technology going from from the R&D side like like are we just going to see sort of steadily increasing um uh efficiency and and and reducing cost for for proof generation are are we going to see more of a switch to Hardware um like where where will the advancements come from in in your in your your view and and sort of how close are we so I think uh first we'll just see optimizations on existing Hardware uh CPUs and and G gpus and I think in this respect uh both uh things like you know risk zero working with the baby bear Prime 32bit and the the new proof systems you know plunky 3 and stuff uh we're working on that we use uh um Circle Stark will probably be the next Standard Generation let's call it 32-bit primes um and first of all we'll just see it optimized on the uh CPUs and hardware and um there's a long way to go there and make things just a lot more efficient uh that's probably the next step further down the line I think that uh in terms of like the math probably people will continue to explore um also binary fields and maybe smaller fields and more exotic curves you know than the circle and elliptic curves stuff like that but uh also you know once you're down to things like 32bit um primes this is already very good point to think about Hardware it's just that for Hardware you want to know that there's going to be massive demand you know in the tens to hundreds of thousands of uh uh computers that need to run it all the time at very high efficiency and yeah maybe now we're starting you know now or in a year maybe we'll start to see not get the demand but think getting ready for the the demand um and the the the last thing that I'll say is that probably we'll just see a lot more usage of of uh mostly I think star but like uh in general proving systems to do things like layer 3es and layer fours client side proving um you know maybe even a little bit we're not yet I mean privacy will come at some point it's not that it's not important just the the ux aspects of doing uh privacy right make it uh something that will come later so summarizing I think the next generation is probably going to be something around 32bit Fields probably primes but may maybe also um which means that it's really really um there's a very good fit with existing Hardware on CPUs and gpus and this will open the door to a lot more client side and just uh you know end user usage at much higher speeds um and then Hardware optimize things maybe you know we're still let's say one year out from starting to plan them or maybe two years out uh yeah but I'm very very optimistic about uh the usage of uh proving systems to boost integrity and expand the scale of blockchains uh no pun intended with the use of optimistic there obviously no pun intended I'm very about validity rollups I'm even optimistic about optimistic rollups ending up being validity rollups and I think they even say that that's their plan it really is the there's just a lot more I mean validity rollups and especially starx you know postquantum secure no trusted setup very high efficiency they really are to the best of my knowledge the the end game for for scaling Integrity so uh yeah yeah I mean certainly in in polygon's view as well because we use them uh fundamentally in in all of our followups um I need to jump off but uh great to see all of you yeah likewise um all right well I I guess Uma back to you so maybe you could I I could ask a version of the same question but instead of for the underlying proving systems we could talk about ckvm and so I'm really curious what you see is kind of the short-term and medium-term road map for zkm I think to to give people a little bit of context a general purpose zvm like you said allows anyone to take rust code and they can just compile it to run they they don't have to write circuits or sort of ZK specific languages um and I I I think it's an interesting thing because uh like when we were doing the zkm I thought to myself and I I sort of said this that like it's a mistake to ever bet against the development of Technology like like this technology is is progressing so quickly and like the the number of things that are possible with ZK is expanding so rapidly and it's a mistake to be sort of pessimistic about it and I I I I have this like sort of weird feeling looking at general purpose ckvm where I expected that they would be a little bit further off and it would take a little bit longer to achieve the performance that like sp1 has achieved and so I think it's yeah I I I it's sort of an interesting thing where the technology is developing really quickly and I think that there's this sense where looking at something like sp1 it's not the finished product like like it's something that is like at the early stage and there's a lot of room to optimize and to make it faster and so maybe you could talk a little bit about about that process and how you see it yeah I think I totally agree with your sentiment that general purpose ckvm have progressed a lot faster than maybe a lot of us thought uh I think even personally our team had ridden a lot of circuits for a lot of different bridging use cases and while we were developing sp1 which leverages Daniel and the rest of the polygon Zero's amazing work on plony 3 and as you guys have been mentioning the multi-table stuff is a lot more efficient a lot faster um so we were using that and building it and SP sp1 also has some like pre A pre-compile system that makes it um that is a lot of the performance gains I was even personally surprised at how fast it was um there's like some anecdotes from people on our team trying it out for use cases like a tender like client and actually like our performance with sp1 is within Striking Distance I would say maybe a factor of two um two or three off from our circuits which were you know took months to build and develop uh and then with the sp1 you can just write it in afternoon um and yeah Brendan as you mentioned this is still like very early days I think there's a lot of even really simple optimizations that we could do or other people can do I know the meren stuff going into plony 3 is going to be another speed up um and one interesting thing is uh we recently released sp1 WTH uh which is kind of an implementation of a ZK evm using something like sp1 and we found that the performance was maybe within a factor of five uh certainly within an order of magnitude of the plony 2 ZK evm um and you guys did like such an amazing job with that uh and I think it was like a really really big Endeavor um I've I've seen the code there's a lot of like handwritten assembly there's there's just a lot of complicated moving pieces and don't don't for for for for our own sanity don't tell us how quickly uh it you were able to okay do it but yeah it was so two people on our team spent just spent like the weekend doing it um and it was like 2,000 lines like 2,000 lines of very maintainable reasonable rust code it's took a weekend and yeah it was within like I think an order of magnitude performance and we haven't even started optimizing a lot of things and I think there's a lot of room to use like more optimized Primitives and you know get that performance even further down um so yeah that's really exciting because I think this is like hopefully the thing that will let ZK just be more used everywhere because now you don't have to worry about dep like if you're a developer using ZK you can just like write your rust code and then know all the stuff underneath is going to get faster and faster you don't have to worry that like oh I spend so much time writing all these circuits and then oh it's going to be obsolete because there will be like this new proof system like rust kind of being the UN like normal code and rust being the universal interface is something I'm like really excited about um and yeah hopefully just embeds ZK into like every single application like every single roll up every single Bridge every single Oracle every single co- processor um hopefully ends up using ZK like in this form yeah I I I I actually agree I I do think that there is like like for our type one I think that there's like a lot of lwh hanging fruit for optimization and so I I can imagine that it might be the case for like the next like year or two that you know a handwritten ckvm just kind of offers like really nice performance but like C certainly it's it's our view that in the me medium term even like this this approach of compiling to a zbm makes total sense and I I think that's been a lot of our motivation with pushing on plunky 3 and even contributing to projects like fita like we we we view this as like a really improving our ability to execute like like you said really really quickly and I think like developer velocity can Trump like performance especially if like the performance margins in absolute terms are like really pretty small um and so I I think it's like really really exciting work yeah totally but uh yeah Daniel maybe uh maybe you can talk a little bit about your views on like the future direction of uh of the polygon ZK work and uh you know ZK VMS plony 3 proving systems like how you see the the world sort of developing in the near term yeah yeah I definitely agree about these new generation ckvm such as risk zero Vita and sp1 I think think that's going to be the future for a lot of CK projects just because they're they're so easy to use and they you know out of the box the performance might not be as good as a handwritten circuit but you can kind of selectively pick the things that actually need to be optimized so I think that approach makes a lot of sense and uh yeah really looking forward to that that feature and uh also just going back to Performance for a bit I I think the kind of the reason that the we've seen such massive strides and performance of ZK software is you know I think there's just this uh cumulative effect from improvements on several different layers so there's new academic improvements like the recent Circle Stark paper that that just came out but at at the same time there's lowlevel optimizations for example some of our teammates are working on speeding up arithmetic hashes and that sort of thing um and at the same time there's work on better optimizations so for example something like sp1 uses kind of a a newer memory argument and just a lot of uh improvements compared to some of the older ZK VMS and and at the same time mors law is still chucking along as well so there's kind of improvements on these like four or five different layers that's not even considering potential acceleration from gpus or as which which is a whole other layer um and it just really compounds and adds up to this massive uh exponential speedu speed up awesome um yeah Bob and maybe we we can continue on that theme I I know that you're very interested in in hardware and uh have been uh leading a lot of our projects to look at um or at least heavily involved in in our projects to look at gpus and FBG Like where do you you see the maturity of those uh of the hardware approaches sort of being right now yeah I think I probably um would agree largely with what Ellie said like it maybe like but maybe a bit even more optimistic than that because I think um you know we especially around the Starks like we can we're at the point where um I think we can start thinking about Hardware I think maybe a couple years ago it was too early uh to start thinking about Hardware optimization uh uh but now I think it's maybe the right time or certainly within the next year is the right time in my mind to kind of think how Hardware will play into exporting this because I do think like the next uh you know 10 to 100x Improvement could come from Hardware rather than further improvements on academics I mean there's still a ton of improvements that they can do with existing system and optimize them and things like that but I think we're getting close to the boundary and you know obviously nobody has a crystal ball so maybe somebody else will come up with something that is uh like massively simpler and easier but in my mind this is more kind of like a Black Swan type of event uh where you know it could happen but probability is probably fairly well but uh if we kind of try to think of where is the next massive Improvement will come from uh beyond what we have now kind of in academic uh world and you know some software uh implementations is in my mind you know going to I would even I'm not even sure if it will be directly to gpus or will go like it will be to gpus or going directly to as6 so there is an argument to be made that if you uh care about costs primarily like you probably want to stick with CPUs because gpus at least in a um in a cloud environment it's very difficult to get like a the right instance where the costs make sense in if you're doing the gpus um but um I'm actually personally very excited about like some of the new Asic that are coming or being designed or should come to the uh to the market the next year or so and we'll see how they can uh be leveraged to improve uh you improving speeds um uh I think U you know I personally want to like look start looking at them even like you know in the next few months or something like that and then um you know it will take a while for them to get into production probably at least a year maybe two years maybe even more who knows like it other things but I think with like recent improvements things are stabilizing more we know it's going to be probably you know around 32 bit primes um you know there could be some still for like gold Delux primes and things like that but mostly it's kind of like converging uh on U you know for Starks at least around the smaller smaller primes uh now there is a something to be said about fpga there is a different way like the like I think BOS and other proving systems that rely on other like binary Fields there may be more um of like uh amendable to fpg based implementations uh maybe it's easier to do it so like it would be interesting but like I do think this is where like the next big Frontier yeah I I I would agree I I'm also uh yeah very excited about binary Fields I think the vus work from mul vatana is super super cool um so we're we're running low on time and we've been talking a lot about optimization and the future and bringing costs down but I want to like bring us a step back and I think that a very popular narrative especially from some projects that are working on optimistic rollups is ZK Tech is like a little too far out the cost isn't really where we want it to be it's like it it requires like some more development and so I want to pull each of you as to whether or not you think that that's true and whether you think that ZK technology is ready now and is sort of cost uh competitive and and offers a better experience than the optimistic side at at the risk of like maybe this being a little bit too spicy um but but UMO we can start with you is uh is ZK Tech ready now yeah I think I mean I think all of us on this panel probably a very similar opinion um but especially with things like seeing your guys's type 1 ZK evm having a proving cost of 0.002 or Point yeah 0.002 cents per transaction uh I mean currently rollups today pay 10 to 20 cents uh to ethereum for or call data for data availability what's another fraction of a penny for ZK and you get all these benefits like the withdrawal window can go down from seven days to like a couple hours or however long you want to post a ZK proof you don't have to worry about all this complicated interoperability stuff like it just kind of works um a lot of optimistic rollups still don't have working fraud proofs in production and you can just like skip those steps um and just use like ZK um yes something I like to kind of like think about and tell people is ZK is in some ways it's actually very simple because it is the simple blackbox primitive where you say hey I have this function and then I give you a proof and then you know like that state transition function happen properly like there's no interactive game there's you know there's none of this stuff um and I think like the truth of ZK is like very simple um once you kind of have like the proving system stuff out of the way everything abstracted down so um yeah I think it's like ready now and like it is kind of surprising even that more people aren't like transitioning over to it because I think it could help solve a lot of problems with a lot of their Stacks awesome I think that's a really good way to put it U and we're super short on time Daniel ZK Tech here now here today i' say definitely yes for proving blockchains it it's more or less a solved problem now um there are always a few more challenges like there there's a team that I've been talking to that's proving LM inference and that's still a hard problem but yeah for for proving blockchain execution it's uh yeah I think we're already there awesome bobin so uh I would say two things first uh it's is uh ZK Tech ready for you and it depends on one factor if right now it depends on one factor do you have a like ZK talent in house could that could develop this uh at this point I would say is ready for you if you have the ZK talent but with work with like um and zero and others are doing maybe like in a year or so it will be at the point where it is ready even if you don't have a ZK talent and that's uh that's where we're all trying to get to yeah that's a great way to put it and I I I would say just to note uh to be very very spicy uh in order to have parody in safety with Z knowledge proofs with ZK rollups optimistic rollups need permissionless fraud proofs and to my knowledge no one has permissionless fraud proofs but we do have ZK proofs so kind of leave on on that note um but yeah thank you all very much for for participating and really enjoyed [Music] it