Lasso, Jolt, and the Lookup Singularity, Part II with Justin Thaler | a16z crypto research talks

TL;DR

Justin Thaler discusses the workings of the Lasso family of lookup arguments and the Jolt ZK VM technique in the A16z Crypto Research Seminar. The approach aims to minimize commitment costs for the prover and offers a new perspective on data parallel computation in snarks.

Transcript

welcome to today's a16z crypto research seminar today is going to be part two again uh Justin thaler research partner here at a16z crypto and also a professor at Georgetown so yesterday we kind of heard at a high level how things work and sort of a lot of the importance of this work and today we're going to find out how it actually works under the ... Read More

Key Insights

• 💨 Lasso offers faster provers compared to prior lookup arguments by committing to fewer field elements and using small values.
• 🚰 The Lasso family can support gigantic tables, eliminating the need for the prover to commit to the table in many cases.
• 😒 Jolt, built on Lasso, minimizes commitment costs for the prover by leveraging the decomposability of tables and the use of multivariate polynomials.

Questions & Answers

Q: How does Lasso minimize commitment costs compared to prior works?

Lasso commits to fewer field elements and uses small values, which significantly reduces cryptographic commitment costs for the prover. Additionally, Lasso's use of multivariate polynomials enables further optimization.

Q: What is a distinguishing feature of the Lasso family of lookup arguments?

The Lasso family can support gigantic tables, allowing for efficient lookups in large-scale datasets. Prior lookup arguments required the prover to commit to the table, but Lasso eliminates this need in many cases.

Q: What is the main idea behind Jolt, the ZK VM technique built on Lasso?

Jolt aims to minimize commitment costs for the prover by using a property called decomposability of the table. It proves correct execution of primitive instructions through lookups into a giant table that contains the entire evaluation table of the instruction.

Q: How does Lasso offer a new perspective on data parallel computation in snarks?

Lasso treats lookups as data parallel computation and leverages the exponential amount of parallelism in the lookup table. This allows for fast and efficient computation, which is particularly beneficial for applications with large-scale data parallelism.

Summary & Key Takeaways

• Justin Thaler introduces the Lasso family of lookup arguments, which commit to fewer field elements and use small values, resulting in faster provers compared to prior works.

• He explains that Lasso is optimized for lookup Singularity, where circuits only perform lookups, making it easier to audit and verify implementations and specific tables.

• Thaler introduces Jolt, a ZK VM technique that leverages the decomposability of tables and enhances commitment costs by proving correct execution of primitive instructions through lookups in a large table.

• He discusses the challenges of designing a zkvm and highlights the benefits and downsides of different approaches, including the use of the subject check protocol to minimize commitment costs.