This study evaluates a candidate mixed-opening construction against a coherent A/A′ source-substitution test. Low-degree consistency alone does not authenticate the compact FRI round-zero oracle to the original interleaved commitment. The completed construction adds a source root and shared authentication queries, giving an explicit path from every sampled oracle symbol back to the committed columns.
Consistency is not source provenance
A polynomial commitment fixes one or more columns before their values are queried. An interleaved mixed opening uses a Fiat–Shamir challenge γ, derived from all preceding protocol messages, to answer for several such columns at once. Compact FRI—the low-degree test used here—establishes that a combined polynomial C has the claimed value at a primary point. Its oracle is the encoded table that the verifier samples instead of reading in full. The construction study deliberately separated that algebraic claim from a second requirement: this combined oracle must be derived from the columns named by the original commitment.
It proved:
The application needed the stronger statement:
A candidate with transcript-bound values but no source authentication proves the first statement, not the second. The A/A′ test below was therefore an acceptance gate for the construction, not a post-deployment discovery.
Commit to A, open from A′
The adversarial test is compact:
commit A
build all_openings and the compact FRI oracle from A′
verify using Com(A)If the opening protocol only checks the low-degree oracle and the combined claimed value, the verifier has no query-level evidence that the oracle was encoded from A. The dishonest source can be internally consistent and still be unrelated to the commitment supplied by the caller.
Absorbing more Merkle roots—or compact lists of such roots—into Fiat–Shamir does not repair this attack. Transcript binding fixes the challenge after the messages; it does not prove that one committed object was derived from another.
Commit the encoded source
The completed construction extends the interleaved commitment with a source root over the encoded columns. The experiment used a domain-separated, 128-bit Blake3-truncated Merkle root. For every committed column, each source leaf held the pair of codeword positions queried together at one FRI index:
leaf(log_rows, n_cols, index) =
H(domain || shape || index ||
col_0[pos0] || col_0[pos1] || ... || col_n[pos0] || col_n[pos1])The prover state retained both the encoded columns and the source tree. This was a deliberate storage cost: without the encoded source, the prover could not later answer shared queries that bind the FRI oracle to the commitment.
Use the same query indices
Source binding and compact FRI do not draw independent queries. The transcript absorbs compact-FRI round roots and final codeword, then the source-binding evaluations and folded roots, and only then samples one shared set of query indices. Both verifiers consume those indices.
At every sampled position, Merkle authentication opens the encoded source symbols. The protocol's tensor-folding rule combines those symbols into the value expected by compact FRI. Fold-layer roots and paired-position openings carry that relation through the FRI layers.
The exact statement
For a caller using the mixed-opening API as specified, acceptance implies—up to the declared soundness error—that every returned primary opening is the multilinear-extension (MLE) value of the column fixed by the interleaved commitment.
The scope matters. The standalone theorem is about the primary point. Secondary claims are shape-checked and transcript-bound inside the mixed opening, but their relation to other evaluation points comes from the caller's outer multipoint or slice reduction. Documentation that says the polynomial commitment scheme (PCS) alone proves arbitrary secondary openings would overstate the primitive.
Tests that distinguish binding from satisfiability
The decisive test commits to A, constructs the rest of the proof from A′, and requires rejection. Additional mutations change source symbols, folded symbols and Merkle paths. Several of those mutations leave a locally satisfiable algebraic trace; they fail only when the source opening is checked against the commitment.
That testing style is reusable. A proof system should not only mutate a constraint and observe failure. It should mutate the object on the far side of a commitment boundary while keeping the inner computation coherent. Otherwise the test may never exercise the binding theorem.
Cost under recursive composition
The completed construction adds a source root, encoded source retention and batched authentication paths. Replaying those paths inside a recursive verifier contributes several Poseidon2b authentication families to the outer relation, producing the memory experiment described in One global Poseidon walk replaces nine verifier walks. Source provenance has a measurable cost, but omitting it changes the statement being proved.
The boundary the verifier must close
A transcript can bind a prover to its messages while the messages remain unbound to the commitment the application cares about.
Every polynomial-commitment composition needs an explicit path from terminal evaluation claims, through the queried oracle, back to the original committed source. If that path is missing, additional Fiat–Shamir absorption is evidence of consistency, not provenance.