0 reactions
Architectural trade-offs in local ZKML: Why choose GKR + Hyrax over SNARKs for mobile edge computation?
Evaluating deep neural networks inside a zero-knowledge circuit (ZKML) on consumer hardware has always been a massive computational bottleneck. Generating standard SNARKs for heavy ML workloads usually hits RAM limits on a smartphone almost instantly.
I was looking into how some large-scale identity protocols are trying to solve this client-side architecture. Tools for Humanity just open-sourced their in-house GKR prover called Remainder https://world.org/blog/engineering/world-zkgpu-for-ml-and-more, which specifically pairs the Goldwasser-Kalai-Rothblum protocol with a Hyrax polynomial commitment scheme to make this viable on mobile.
From a systems engineering perspective, the constraint driving this is actually really interesting. As their biometric recognition algorithms improve, they want to avoid forcing millions of users to physically revisit their custom hardware (the Orb) to upgrade their templates. Instead, the user's phone simply downloads the new ML model weights, runs the inference locally over their securely encrypted data enclave, and generates a verifiable proof of correct execution. (There's been some recent media https://phemex.com/news/article/worldcoin-open-sources-remainder-zeroknowledge-proof-system-61426 coverage on how this open-source release practically solves the hardware bottleneck).
While GKR is theoretically elegant for highly structured, data-parallel arithmetic circuits (like neural nets) because the prover time scales linearly, how does a GKR+Hyrax stack realistically benchmark against optimized folding schemes (like Nova) when computing non-linear activation functions? Does the lack of a trusted setup justify the potential overhead here?
#technology
Evaluating deep neural networks inside a zero-knowledge circuit (ZKML) on consumer hardware has always been a massive computational bottleneck. Generating standard SNARKs for heavy ML workloads usually hits RAM limits on a smartphone almost instantly.
I was looking into how some large-scale identity protocols are trying to solve this client-side architecture. Tools for Humanity just open-sourced their in-house GKR prover called Remainder https://world.org/blog/engineering/world-zkgpu-for-ml-and-more, which specifically pairs the Goldwasser-Kalai-Rothblum protocol with a Hyrax polynomial commitment scheme to make this viable on mobile.
From a systems engineering perspective, the constraint driving this is actually really interesting. As their biometric recognition algorithms improve, they want to avoid forcing millions of users to physically revisit their custom hardware (the Orb) to upgrade their templates. Instead, the user's phone simply downloads the new ML model weights, runs the inference locally over their securely encrypted data enclave, and generates a verifiable proof of correct execution. (There's been some recent media https://phemex.com/news/article/worldcoin-open-sources-remainder-zeroknowledge-proof-system-61426 coverage on how this open-source release practically solves the hardware bottleneck).
While GKR is theoretically elegant for highly structured, data-parallel arithmetic circuits (like neural nets) because the prover time scales linearly, how does a GKR+Hyrax stack realistically benchmark against optimized folding schemes (like Nova) when computing non-linear activation functions? Does the lack of a trusted setup justify the potential overhead here?
#technology
| 4,000 mlx | |
| 6 | |
| 0 |