{"id":"3718edd5-e8b2-4663-90de-4d226222dff2","arxiv_id":"2504.12217","paper_version":1,"verdict":"REJECT","confidence":"HIGH","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":2,"one_line_summary":"zkVC reduces ZKP proving time for matrix multiplication by encoding the product as a polynomial evaluation, claiming 12x speedup and enabling verifiable Transformer models.","lead":"This paper describes zkVC, a zero-knowledge proof system that encodes matrix multiplication as a polynomial identity to cut the number of proof constraints, and applies it to verifiable Transformer inference. It reports 12x faster proof generation than vanilla SNARK baselines, but does not provide a security proof or a precise protocol specification.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"CRPC checks the matrix-multiplication identity at one evaluation point Z; every instantiation the paper allows is either trivially forgeable (public/fixed Z) or breaks the fixed-R1CS compilation (secret Z), and no soundness proof is supplied.","rationale":"The reader's weakest_assumption identifies exactly this load-bearing gap: CRPC reduces constraints by checking a polynomial identity at a single point Z, but the paper never specifies how Z is instantiated and provides no soundness argument. My independent reading of Section III.A confirms that the proposed transformation is either unsound under the natural public-constant implementation or incompatible with the fixed circuit requirement of the Groth16 and Spartan backends under a secret Z. A concrete attack for public Z shows that invalid outputs can satisfy the CRPC equation, so the reported speedups do not establish a secure zero-knowledge proof system. The empirical results are not disputed; the issue is that the constraint system no longer enforces the claimed statement. Since the reader already recommended REJECT with high confidence, no verdict adjustment is needed.","tokens_in":13482,"tokens_out":6551,"duration_ms":78447,"concrete_test":"One decisive check: determine how Z is instantiated in the released code. If Z is a fixed public constant, run the small case a=b=n=2 with Z=2 in zkVC-G. Take valid X and W, and set Y' = X*W + E with E_00 = 2 and E_01 = -1, all other E entries 0. Then E_00*Z^0 + E_01*Z^1 = 2 - 2 = 0, so the CRPC equation holds at Z, yet Y' != X*W. If the verifier accepts the proof for Y', the one-point check is forgeable and the O(n) claim is unsound. If Z is instead secret or derived per-instance, the test is to write down explicitly how the R1CS is generated without revealing Z and to prove soundness; absent that, the construction is not a valid zk-SNARK.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim of Section III.A is that the single polynomial evaluation sum_{i,j} y_{ij} Z^(i*b+j) = sum_k (sum_i x_ik Z^(i*b))(sum_j w_kj Z^j) can replace a*b*n R1CS constraints with n constraints. As a polynomial identity this is valid, but as a single evaluation it is not: equality at one point does not imply Y = X*W. The paper never states how Z is chosen. If Z is a public constant, which is the only way the R1CS matrices for Groth16/Spartan can be fixed, a malicious prover who knows Z can pick any nonzero error E with sum E_ij Z^(i*b+j) = 0 and submit Y+E; the CRPC check passes although Y != X*W. If Z is a hidden setup trapdoor, the circuit coefficients depend on the trapdoor, so the standard Groth16/Spartan compilation into a public R1CS is not justified; the paper supplies no protocol or security proof for this case. If Z is meant to be a Fiat-Shamir challenge, the relation is no longer a fixed R1CS, and no challenge-binding argument or Schwartz-Zippel analysis appears anywhere. Thus the O(n) constraint count is achieved only by removing the soundness of the reduction. The paper's own Section III.A concedes that summing all y_ij compromises soundness and claims CRPC addresses this issue, but the only difference is weighting by powers of Z; without a hidden random challenge this is still one equation, not a*b constraints.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript presents zkVC, a set of optimizations for zero-knowledge proofs of matrix multiplication and Transformer inference. The main component, Constraint-reduced Polynomial Circuit (CRPC), is introduced in Section III.A to replace the a·b·n multiplication constraints of Y = X·W with n constraints using a polynomial identity evaluated at an intermediate value Z; the second component, Prefix-Sum Query (PSQ), in Section III.B reduces the number of left-wire variables for accumulation. The authors implement the optimizations on top of Groth16 and Spartan and report about 12x faster proving for matrix multiplication and about 15x faster end-to-end ViT proving, with an ablation study and accuracy comparisons across CIFAR-10, Tiny-ImageNet, ImageNet, and GLUE tasks.","tokens_in":13746,"tokens_out":5704,"duration_ms":55615,"significance":"If the CRPC transformation were sound, this would be a significant step toward practical zero-knowledge verifiable Transformer inference, because matrix multiplication is the dominant proving cost and the reported speedups are large. The paper includes a concrete implementation, an ablation study, and comparisons against several prior systems, and it makes the code available, which are all strengths. However, the central cryptographic claim is not established. As written, CRPC verifies a single evaluation of a polynomial identity, not the a·b·n scalar products of the original matrix multiplication, and the manuscript does not specify how Z is generated or provide any Schwartz-Zippel-style soundness analysis. The claimed O(n) constraint complexity therefore does not come with a demonstrated security guarantee, and the experimental speedups are measured against a relation whose soundness is in question.","major_comments":[{"comment":"The reduction replaces a·b·n constraints by the single equation sum_{i,j} y_ij Z^{ib+j} = sum_k (sum_i x_ik Z^{ib})(sum_j w_kj Z^j), but the paper never states how Z is chosen. If Z is a public constant, a malicious prover can add any nonzero error matrix E satisfying sum_{i,j} E_ij Z^{ib+j} = 0 and submit Y = XW + E, and the CRPC check will pass although Y != XW. If Z is a secret setup value, the constraint matrices depend on Z and the standard Groth16/Spartan compilation to a fixed R1CS is not justified. If Z is intended as a Fiat-Shamir challenge, no challenge-binding protocol or commitment to the witness appears anywhere. None of the three readings yields a sound fixed-R1CS construction with the claimed O(n) complexity.","section":"Section III.A, generalized CRPC identity"},{"comment":"The paper's own text observes that summing all y_ij values compromises soundness and then claims that CRPC 'addresses this issue,' but the only difference between the naive sum and the CRPC equation is the weighting of the entries by powers of Z. A single weighted sum is still one linear equation in the a·b output entries; without a random challenge that is unknown to the prover at witness-selection time, this cannot enforce the a·b·n individual product relations. No Schwartz-Zippel argument, adversary definition, or security theorem is supplied, so the central claim of Section III.A is unsupported.","section":"Section III.A, soundness of the one-point check"},{"comment":"The manuscript uses the standard language of Gen/Prove/Verify for zk-SNARKs but never defines these algorithms for zkVC. In particular, there is no formal statement of the relation R that CRPC is supposed to prove, no completeness theorem, no soundness theorem, and no zero-knowledge claim for the optimized circuit. For a paper whose contribution is a cryptographic optimization, these are load-bearing omissions rather than presentation issues.","section":"Sections II-III (protocol specification)"}],"minor_comments":[{"comment":"In the ablation discussion, the text refers to 'CRCP' instead of 'CRPC' in the sentence 'the enhancement is more significant when PSQ is coupled with CRCP.'","section":"Section V.A"},{"comment":"The boxed example for the 'another possible transformation' uses a '≠' sign between the weighted sum and the product of row-column polynomials; if the intent is to exhibit an invalid transformation, this should be stated explicitly in the surrounding text.","section":"Section III.A"},{"comment":"The SoftMax approximation has two free parameters, the clipping threshold T and the Taylor exponent n, but the paper does not report how their values were chosen or how sensitive the accuracy and proving time are to them.","section":"Section III.C"},{"comment":"References [12] and [30] cite the same work (Wahby et al., 'Doubly-efficient zkSNARKs without trusted setup'); one duplicate should be removed.","section":"References"}],"recommendation":"reject","confidential_remarks":"The central CRPC construction appears unsound as described, and the fixes required (a properly specified random challenge, a proof of the Schwartz-Zippel bound, and a formal protocol definition) go beyond editorial revision. The paper would need a fundamentally different soundness mechanism to support its O(n) claim. I would not encourage a revision unless the authors can provide a complete protocol and security proof."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague,\n\nThe thing to know about zkVC is that the headline 12x speedup is bought by weakening the cryptographic guarantee. The CRPC encoding collapses a*b*n multiplications into n constraints, but the check is a single evaluation of a polynomial identity at a point Z. The paper never says how Z is chosen and provides no soundness proof. On inspection, every choice is a problem.\n\nWhat's genuinely new: the powers-of-Z encoding is a clean extension of vCNN's convolution trick to general matrix multiplication, and the paper is honest that the naive sum-of-all-y_ij encoding is unsound. The PSQ prefix-sum accumulation is standard, but the ablation is useful. The end-to-end Transformers-on-ImageNet numbers are a legitimate proof-of-concept: if the underlying proof were sound, this would be a meaningful step for verifiable inference.\n\nThe soft spot is not soft. A single evaluation of the polynomial identity does not imply Y = XW. If Z is a public constant, a malicious prover can add any nonzero error matrix E with weighted sum 0 and pass the check. If Z is a secret trapdoor, the R1CS matrices depend on the secret and the standard Groth16/Spartan compilation is unjustified. If Z is intended as a Fiat-Shamir challenge, the circuit is no longer fixed and no challenge-binding argument appears. The paper concedes that summing all y_ij breaks soundness and asserts CRPC fixes it, but without a hidden random evaluation point the fix is the same one-equation check with weights. There is no protocol definition, no adversary argument, no Schwartz-Zippel analysis.\n\nThe empirical methodology is okay for a systems paper (self-implemented baselines, no error bars—that's a minor issue), and the self-citation cluster is about HE, not load-bearing. The citation pattern is not a problem.\n\nWho is this for? Researchers working on practical ZKP for ML will find the encoding idea interesting and the Transformer benchmark useful, but the paper cannot be used as a sound cryptographic construction. I'd recommend rejecting it in its current form. The authors need either a proper soundness proof with an explicit random challenge and a Schwartz-Zippel bound, or a repositioned claim as an empirical study of an optimized but currently heuristic proving pipeline.\n\nNot a serious referee target yet. If the soundness gap is fixed, I'd look again.","headline":"zkVC's 12x speedup for zero-knowledge matrix multiplication comes from a single-point polynomial check with no soundness argument; the encoding trick is clever but the paper is not a sound cryptographic construction as written.","tokens_in":14370,"tokens_out":3375,"would_cite":false,"duration_ms":33168,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":false},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":null,"created_at":"2026-08-16T12:36:03.221378+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":null,"supporting_citations":[],"review_version":1}