Wyatt of NovaNet @ ZK Hack Meetup in Denver, 24 Feb 2025

Transcript

[Music] I got it okay hi my name is Wyatt Beno I am the technical founder of a project called novanet we use folding quite a lot folding scheme um so I'm going to explain kind of what those are and the coolest and most up to-date state-of-the-art Innovations in folding uh they enable client side proving they speed up zerge machine learning they shrink ckvm and they actually most recently allow you to use small Fields kind of like magic um and that's that power pro networ and leave you in Wonder we have a zkm we called the ZK engine there's so many ZK VMS out there we want a different with a different name it's based purely unfolding scheme we did Super n first we did nebula which is a

more recent folding scheme it's super performant and the cool thing is it actually supports privacy uh so most of the zvm that exist today have very big provs that you need special Hardware to run this can work in your browser or on your phone but which is very cool for a bunch of different types of use cases like local verifiable compute and privacy uh behind that we have a a PR Network that orchestrates uh these type of proofs uh so what is the folding scheme it starts actually with proof recursion you take witness in it pairs two of them and actually you can verify them as one so you're taking two things and making them uh smaller in one and before this what would happen is actually kind of like eating soup with a with a fork there's a very inefficient way before foring came out where basically you take

a snark and have a verifier circuit wrapped in the star and you do this heavy mathematics step by step by step and this is kind of the uh pre NOA uh and pre-folding type of proof of recursion um but then the KSC 22 paper came out and they said hey stop being caveman use a spoon to eat the soup uh and that's where we got the better mathematics to do these uh type of folding sces um so you can take these two instances and basically just check one at each step and this is very important for something called incremental verifiable computation uh where you can basically pece meal a proof rather than having to have everything in your head at once with a monolithic type Pro uh the bad or downside about this is the proof size is relatively large so you do eventually

need to wrap it in a snark to get it onto a blockchain uh folding in 60 seconds it's actually pretty funny because the papers are all named after like galaxies and stuff so you have Nova Supernova hypernova protostar Proto Galaxy Neutron NOA there's a bunch of papers that just go on I reserved one called gamma ray burst if I ever make a paper that's what's going to be um but basically what started very on was relaxed R1 CS um and from there we wanted to expand out of that people wanted plonk they got sangria instead um but really we got air and CCS from the first Nova paper U from there we actually moved from one uniform circuit to non-uniformity which is cool for a bunch of different types of use cases we

actually went from the smallest lowest recursion overhead verus 10K constraints and you actually get I think that's still probably relative close to lowest actually work with 2 MSM in the first NOA paper now it's down to one with the hypernova paper so really there's just been a huge flurry of work from uh this folding and with that we get a lot of really cool state-of-the-art Zer knowledge proof technology so why fold uh not being mean to any of these these companies they are all mostly started for scaling ethereum they're looking to uh basically make a very fast monolithic prover run to do the scaling problem we have a very different problem set where we want local verifiable Compu for deep in and those typ devices uh or even for browser type of browsers so with this we needed a small space Pro and with

folding seam this is the best way to do it interesting fact is jolt can actually also use folding as well to get smaller appr but right now it's around 80 gbes to run it um and that link it's just to show where how they I got this 128 uh gigabytes it's not just me you can try to run these papers by yourself as well and they're pretty heavy um another cool thing about folding is you actually add privacy just by folding in itself there's an update in the newest hypernova paper where you can actually just use folding one time on any uh proving theme and you can potentially add folding with it so you could actually take the jolt verifier turn it to a circuit fold it once and then therefore become privacy preserving uh so it's a very easy and cool way if anyone wants to look at the paper to add

privacy to things that weren't private before um guys might have heard of Nexus they're very into paralyzation and continuations folding with Hyper uh multi folding it's very good for that so you can take a big problem split it across a thousand machines and say hey run this as fast as possible without machines and you can efficiently aggregate these together and with that post eventually post to an L1 um so it's very good for that IVC if you have monolithic provs if the prover dies Midway you have to start from the beginning again but with IBC you can have a appr a network where basically have stop go stop go stop go one's flaky and disappears someone else can continue that work and this is important if you want to have like a thousand random people help prove uh and IC is what our appr network is based off of this allows

Specialists to come in so potentially jolt can join the network uh do floating Point number to some specialist task they can earn a premium kind of like an Uber black for doing the special attacks so things like uh zkl that might be very specialized circuits can actually join the Nova appr Network earn a premium all the users get the benefits of using the specialized schemes so what is the state of-the-art and a lot of the stuff I hope is new to most of you it's all relatively newer papers for zkl most people are using tees currently even though at the end they take tees and they wrap it something called ZK Decap so they use ZK to get the stuff on chain obviously T proof are too big um but really it's been pretty big like 15 minute proof for ZK llm with a lot of heavy machinery but

a recent folding paper called Mira actually showed that you can have a very or decently uh Pro cost we're actually having good memory efficiency so the green line and the red line there are folding schemes doing these Mist type problems and I think this is very cool and forward looking work in terms of ZKA ml the other are other projects and you can obviously see that the pro memory just explodes when you're doing these ml type operations so I would really say the soda state-ofthe-art of zkm ml right now is actually back to folding maybe two years ago was in folding for a little bit and then people kind of gave up on it and now people redoing it and this is a pairing based folding argument that specializes in zkl in our uh mindset they can join the pro Network

and potentially earn a premium uh for doing that um but I think it's just very cool and state of-the-art for ZK on ML I would also argue that the recursion it's sold out to have folding scheme there's something called snark pack that people use to basically aggregate snark proofs what ends up happening there is you have GT arithmetic so it doesn't eventually get posted onto a chain but you can use micronova and other folding scheme to very effectively aggregate a whole bunch of proof together and post them change cheaply we actually just posted our verification circuit 4 our work recently it's around $20 per proof so you can imagine taking a th000 different proofs from th000 different people rather it like $20 person you can just aggregate into one thing and then post it onto a

blockchain I would argue folding is soda for small space dkpm uh we did nebula and it really did Forex our speed and also uh reduce the public parameter size and this is public and we can go test this out I'm sure people in this room have already actually done benchmarks uh but it's pretty cool that you can do this you can also pick the step size which I think is a fact that people don't really know about so if you have a big machine you can pick big step size sizes if you have a little machine you pick small step sizes so you get a lot of variation um or a lot of adaptability payer use Pro cost is really important for uh VM in general but the last question and people who like this on folding scenes is like oh this uses elliptic curves like we

hate elliptic curves we like Starks and hashes um and there's a bunch of limitations which you really do need homomorphism for these folding teams to work and people have tried a few different approaches but most recently there's been really good advances on lce base buolding and this completely destroys all these issues people were complaining about for so long there small you can now use small Fields just like all the stark type companies you can also do pay for bit just like Bas and this is important for cost profiles so we can see a huge cut in costs and also a speed increase from having this these small Fields but unlike all these Starks you actually do get efficient recursion which is very hard to do with either Bas or for a lot of these circle circle St type designs um and lastly is

plausibly postquantum secure which is an important fact for going into the future so I think most of the complaints that people had in the past about folding are have all basically just been debunked by the Neo paper that recently came out and I expect that this work going to the future will probably outperform a lot of the VMS and other stuff that's just based on P Starks because we use basically the exact same tricks another interesting fact is actually people who are looking to look put and some of the work now don't need to because they get the same cost profile just by doing a simple fold the one downside to this is the evaluation proof there's still like a trick in the paper they're using for the evaluation purp that needs a little bit more work but other than that it's an extremely uh promising approach so we

went from EC now to lus space type holding which I've been on my blog ex I've been pitching for for like over two years like we need lattice holding um there's been a few works on there but I this is probably the biggest step in that direction to make it really practical and usable for everyone um the last thing I want to talk about is pro networks in general if you have a whole Pro network based on folding which uh I I think Nexus is doing and we're also based on it as well it's extremely powerful for paraliz and being able to aggregate efficiently it has the lowest recursion overhead so we can just combine these things together extremely efficiently um IVC is super cool we don't need to have model Prov we don't have proof racing you can actually use prop of game through with chly values

and people get paid out uh fairly for what they contribute but it's much more Cooperative type mindset rather than a competitive type so actually you can get a lot can join and earn as a hardware Advanced perer which I think is cool so you have a bunch of different types of provs in the background kind of working together to get proofs done most importantly you get privacy because the stuff is running on your device for the most part like the smaller proofs do run directly in your browser um and you can also do dpin so you can do things like ZK proof of location which we're doing a demo on Wednesday with iotex millions of devices running in parallel on their device actually doing proof of location under 5 seconds per device they end up efficiently aggregating within the network layer and then posting onto an

L1 all within like 3 minutes which I think is just a mindblowing thing that I wasn't possible a few years back but with folding now it is uh last thing is the fact that we're using nivc which is actually one of the only mathematical bases for being able to do this um if you have a custom improv who come to us with a their verifier circuit we actually run it so for example jolt you can turn the jolt verifier into a circuit and run it directly through novanet and with this you can get some cool traits from other projects as well and cool collaborations with them um we're actually working really closely with the jol team right now so they can actually get ZK from using our stuff and also continuations as well so with their bigger approv 80 gabes you can potentially break it down

to like 8 gigabytes using our folding stuff and vice versa we get really good benefits from having lookup tables that can do potentially floating Point numbers and a few other uh nonlinearities that we can't do just straight up with uh old school folding so there's some cool collaborations with nibc that I just don't think people are very aware of I think it's one of the best paradigms to have this kind of ad hoc peer-to-peer Pro Network which is 100% mathematically based uh based on uh cryptographic proofs as well so everything's very easily verifiable I hope that blew your mind a little bit there is a lot in a short amount of time uh but hopefully the state-of-the-art of DK is constantly uh kind of making us go oh man that's that's crazy that's coming out um but

thank you [Applause] [Music]