Score:0

The PLONK Gate constraint equation seems to designed more for accomodating adding a constant in a Gate but not multiplying with a constant

et flag

From the PLONK paper.

Page 23, 6 Constraint System


The constraint system $C = (V, Q)$ is defined as follows.

  • $V$ is of the form $V = (a, b, c)$, where $a$, $b$, $c \in [m]^n$. We think of $a$, $b$, $c$ as the left, right and output sequence of $C$ respectively.

  • $Q = (q_L, q_R, q_O, q_M, q_C) \in (\mathbb F^n)^5$ where we think of $q_L$, $q_R$, $q_O$, $q_M$, $q_C \in \mathbb F^n$ as "selector vectors".

We say $x \in \mathbb F^m$ satisfies $C$ if for each $i \in [n]$,

$(q_L)_i \cdot x_{a_i} + (q_R)_i \cdot x_{b_i} + (q_O)_i \cdot x_{c_i} + (q_M)_i \cdot (x_{a_i} x_{b_i}) + (q_C)_i = 0$


I understand how this equation works in cases where both $x_{a_i}$ $x_{b_i}$ are variables (i.e. intermediate variables or input variables).

However, I am little confused as to how it would work with constants when the Gate operation is multiplication.

First let's consider an addition gate which also has a constant

I want to represent

$x + 5 = var_1$

I can represent this with

$a = x$, $b = 0$, $c = var_1$
$q_L = 1$, $q_R = 0$, $q_O = -1$, $q_M = 0$, $q_C = 5$

So the equation becomes

$1\cdot x + 0\cdot 0 + (-1)\cdot var_1 + 0\cdot (x \star 0) + 5 = 0$

However, if I have a gate where there is a multiplication with a constant, e.g.

$x \star 5 = var_1$

I cannot use $q_C = 5$ to represent this gate alongside $b = 1$ & $q_R = 0$, which would be analogous (but not the same) as what we did for the addition gate.

I would instead have to set $b=5$ to represent the gate. And I don't get to use $q_C$ which is specifically for constants even if I have a constant in my gate.

Why is this designed with different treatment for adding a constant & multiplying with a constant? What this means is that I can use just a single gate for $x + var_1 + 5 = var_2$, whereas I will need to split $x\star var1 \star 5 = var_2$ into 2 gates.

The equation could have easily instead be designed as

$(q_L)_i \cdot x_{a_i} + (q_R)_i \cdot x_{b_i} + (q_O)_i \cdot x_{c_i} + (q_M)_i \cdot (x_{a_i} x_{b_i} q_{CM}) + (q_{CA})_i = 0$

i.e. the equation uses a separate $q$ for multiplication & addition, $q_{CM}$ & $q_{CA}$ respectively.

Now, I can have

$q_L = 0$, $q_R = 0$, $q_O = -1$, $q_M =1$, $q_{CM} = 5$, $q_{CA} = 0$

and

$a = x$, $b = 1$, $c = var_1$

Or another way to have similar approaches for both addition & multiplication would be to not have $q_C$ at all - neither for addition or multiplication. And use $b$ for the constant as done for multiplication with the constant.

i.e.

$(q_L)_i \cdot x_{a_i} + (q_R)_i \cdot x_{b_i} + (q_O)_i \cdot x_{c_i} + (q_M)_i \cdot (x_{a_i} x_{b_i}) = 0$

if I want to represent $x + 5 = var_1$, I can have

$q_L = x$, $q_R = 1$, $q_O = -1$, $q_M =0$$ and

$a = x$, $b = 5$, $c = var_1$

Am I missing any advantages in Plonk's approach where they adopt a different approach for adding a constant as compared to multiplying with a constant.

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.