Skip to content

Merging

Building large polynomials out of smaller ones

As an extremely basic example, let's say we have 2 \ell-variate things t0(X0,,X1)t_0(X_0, \ldots , X_{\ell - 1}) and t1(X0,,X1)t_1(X_0, \ldots , X_{\ell - 1}). Equivalently, we have two lists (t0,0,,t0,21)\left( t_{0, 0}, \ldots , t_{0, 2^\ell - 1} \right) and (t1,0,,t1,21)\left( t_{1, 0}, \ldots , t_{1, 2^\ell - 1} \right). What if we want the +1\ell + 1-variate polynomial—say, t(X0,,X)t^*(X_0, \ldots , X_\ell)—associated with the concatenation (t0,0,,t0,21,t1,0,,t1,21)\left( t_{0, 0}, \ldots , t_{0, 2^\ell - 1}, t_{1, 0}, \ldots , t_{1, 2^\ell - 1} \right)? To cut to the chase, we can write down the algebraic expression:

t(X0,,X)=(1X)t0(X0,,X1)+Xt1(X0,,X1).\begin{equation*}t^*(X_0, \ldots , X_\ell) = (1 - X_\ell) \cdot t_0(X_0, \ldots , X_{\ell - 1}) + X_\ell \cdot t_1(X_0, \ldots , X_{\ell - 1}).\end{equation*}

It is a basic exercise that the list representation of this polynomial t(X0,,X)t^*(X_0, \ldots , X_\ell) indeed gives us the concatenation of the two original lists that we started with.

The final thing to note is that the verifier may evaluate t(r)t^*(r) efficiently, for any point (r0,,r)Tτ+1(r_0, \ldots , r_\ell) \in \mathcal{T}_\tau^{\ell + 1}. How? To do this, the verifier should first query s0t0(r0,,r1)s_0 \coloneqq t_0(r_0, \ldots , r_{\ell - 1}) and s1t1(r0,,r1)s_1 \coloneqq t_1(r_0, \ldots , r_{\ell - 1}). Finally, the verifier should locally compute the combination (1r)s0+rs1(1 - r_\ell) \cdot s_0 + r_\ell \cdot s_1 and output it. Indeed, this evidently gives us an evaluation procedure for tt^* (entailing two sub-queries to t0t_0 and t1t_1 and a tiny bit of local math).

Finally, there is a geometrical story corresponding to this concatenation operation. As the equation above makes clear, tt^*, as a polynomial, is defined "piecewise" on the +1\ell + 1-dimensional cube. That is, we let the "bottom" \ell-subcube of that cube (i.e., where X=0X_\ell = 0) take exactly the values that t0t_0 does, and the "top" \ell-subcube (i.e., where X=1X_\ell = 1) take exactly the values that t1t_1 does. The resulting piecewise polynomial takes, as its values, the concatenation of the values that t0t_0 and t1t_1 respectively take.

Concatenating

It is not hard to generalize this basic procedure to some power-of-two number 2α2^\alpha of constituent polynomials, instead of just 2. We'll fix \ell again, and consider now \ell-variate constituent polynomials t0,,t2α1t_0, \ldots , t_{2^\alpha - 1}. To concatenate all of these things into a single, 2+α2^{\ell + \alpha}-sized list, we want the composite polynomial:

t(X0,,X+α1)vBαt{v}(X0,,X1)eq~(X,,X+α1,v0,,vα1)t^*(X_0, \ldots , X_{\ell + \alpha - 1}) \coloneqq \sum_{v \in \mathcal{B}_\alpha} t_{\{v\}}(X_0, \ldots , X_{\ell - 1}) \cdot \widetilde{\texttt{eq}}(X_\ell, \ldots , X_{\ell + \alpha - 1}, v_0, \ldots , v_{\alpha - 1}).

For straightforward reasons, the table of values of tt^* over the +α\ell + \alpha-dimensional cube yields exactly the concatenation of the polynomials t0,,t2α1t_0, \ldots , t_{2^\alpha - 1}'s respective individual tables of values. Geometrically, here were are partitioning B+α\mathcal{B}_{\ell + \alpha} into 2α2^\alpha \ell-dimensional subcubes, and defining tt^* piecewise on B+α\mathcal{B}_{\ell + \alpha} out of the t0,,t2α1t_0, \ldots , t_{2^\alpha - 1}.

The important thing here is that if 2α2^\alpha is small, then this thing is succinct for the verifier. Indeed, to evaluate tt^* at some arbitrary point (r0,,r+α1)Tτ+α(r_0, \ldots , r_{\ell + \alpha - 1}) \in \mathcal{T}_\tau^{\ell + \alpha}, the verifier may first query svt{v}(r0,,r1)s_v \coloneqq t_{\{v\}}(r_0, \ldots , r_{\ell - 1}), for each vBαv \in \mathcal{B}_\alpha. Next, the verifier must simply output the combination vBαsveq~(v0,,vα1,r,,r+α1)\sum_{v \in \mathcal{B}_\alpha} s_v \cdot \widetilde{\texttt{eq}}(v_0, \ldots , v_{\alpha - 1}, r_\ell, \ldots , r_{\ell + \alpha - 1}). By a standard algorithm, the verifier may compute the vector (eq~(v0,,vα1,r,,r+α1))vBα\left( \widetilde{\texttt{eq}}(v_0, \ldots , v_{\alpha - 1}, r_\ell, \ldots , r_{\ell + \alpha - 1}) \right)_{v \in \mathcal{B}_\alpha}—and hence the entire sum above—in Θ(2α)\Theta(2^\alpha) time.

Interleaving

By changing this story very slightly, we can also achieve a dual outcome, whereby we interleave 2α2^\alpha \ell-variate polynomials. That is, we construct an +α\ell + \alpha-variate polynomial whose (lexicographically flattened) list of evaluations is exactly the interleaving of the respective lists of 2α2^\alpha constituent polynomials t0,,t2α1t_0, \ldots , t_{2^\alpha - 1}.

To do this, we just need to switch the endianness of our combination operation—that is, we need to combine these polynomials using the low variables as "selectors", instead of the high variables. In other words, we need to use the alternate expression:

t(X0,,X+α1)vBαt{v}(Xα,,X+α1)eq~(X0,,Xα1,v0,,vα1).\begin{equation*}t^*(X_0, \ldots , X_{\ell + \alpha - 1}) \coloneqq \sum_{v \in \mathcal{B}_\alpha} t_{\{v\}}(X_\alpha, \ldots , X_{\ell + \alpha - 1}) \cdot \widetilde{\texttt{eq}}(X_0, \ldots , X_{\alpha - 1}, v_0, \ldots , v_{\alpha - 1}).\end{equation*}

This thing is also succinct for the verifier to evaluate (provided 2α2^\alpha is small), for the same reason that the concatenated polynomial was.