Three prototypes evaluate different boundaries of polynomial commitments. Ladder-batched FRI measures opening bytes for shifted traces. Interleaved FRI-Binius exposes a source-provenance gap through an A/A′ attack. In-trace BaseFold tests whether verifier geometry can close inside a fixed recursive class.
The evaluation question
A polynomial commitment can look efficient at the algebraic layer and still fail the system that has to use it. Three prototypes were evaluated against three different boundaries: proof bytes for shifted traces, provenance of mixed openings, and the cost of replaying the verifier inside recursion.
A polynomial commitment scheme (PCS) fixes a polynomial—or the execution column represented by it—and later proves claimed evaluations without revealing the entire column. FRI is a family of low-degree tests and opening protocols. An algebraic intermediate representation (AIR) describes an execution trace by polynomial constraints between its rows. These are the three terms used throughout the experiments below.
The workloads are not directly comparable. Each experiment isolates a different system boundary.
Experiment 1. Ladder-batched FRI
The CarryRipple benchmark encoded a 64-bit ripple-carry adder as an AIR trace: each row carries one bit position and the carry passed to the next row. One column was therefore read at a one-row shift. A ladder reduction is the algebraic step that converts such shifted-row claims into evaluation claims for the original committed column. The per-slot reductions were batched into one multipoint FRI opening instead of generating one FRI proof per slot.
| Workload | Rows | Adders | Prove | Verify | Proof |
|---|---|---|---|---|---|
| Small | 28 | 4 | 30.57 ms | 11.76 ms | 34.55 KB |
| Mid | 212 | 64 | 175.77 ms | 33.97 ms | 185.86 KB |
| Production-shaped | 216 | 1,024 | 2.05 s | 65.06 ms | 385.17 KB |
At 216 rows, commitment consumed about 70% of prover time. The multipoint FRI object consumed 381.62 KB—99.1% of proof bytes—while the ladder reduction itself used 1.53 KB.
The algebraic batching succeeded, but did not solve the dominant byte cost. Optimizing the ladder would have targeted the 0.4% component instead of the multipoint opening.
Experiment 2. Interleaved FRI-Binius
The second prototype encoded binary-field columns together, committed to the interleaved source and used compact FRI for low-degree testing. Mixed openings combined columns and evaluation claims through one Fiat–Shamir challenge.
A commit-to-A, open-from-A′ adversarial test evaluated whether the compact round-zero oracle was authenticated back to the encoded columns named by the original commitment. A consistency-only candidate did not provide that provenance edge, and additional transcript absorption could not substitute for it.
The selected construction added a source root and required compact FRI and source authentication to consume the same query indices. The complete construction and its adversarial test are recorded in Source binding for compact mixed openings.
Compact mixed openings require an explicit path from each sampled oracle value to the committed source. Fiat–Shamir binds message order; it does not prove provenance between two committed objects.
Experiment 3. BaseFold verifier replay
Native verification time is not a sufficient PCS metric for a recursive system. Transcript absorption, sumcheck checks, folds, Merkle paths and terminal consistency all become witness and constraints in the successor proof.
BaseFold is the polynomial-commitment and opening system selected for the recursive proof. Its verifier was expressed in FieldR1cs, the binary-field constraint representation used to replay native verifier operations inside a proof, and closed inside a fixed recursive class. This experiment measured a different property from the first two: whether the verifier trace, public input/output layout and authenticated matrix shape could verify a predecessor without increasing the next proof class.
The resulting same-class construction is described in The recursive verifier had to fit inside itself.
Results across the three boundaries
| Prototype | Property tested | Observed boundary | Decision |
|---|---|---|---|
| Ladder-batched FRI | Shared opening for shifted AIR claims | Multipoint opening used 99.1% of bytes | Do not optimize the 1.53 KB ladder first |
| Interleaved FRI-Binius | Compact openings over many binary-field columns | Round-zero oracle lacked source provenance | Add shared-query source authentication |
| In-trace BaseFold | PCS verification inside a successor proof | Verifier trace and memory dominate native timing | Evaluate recursive shape as a first-class cost |
Reusable conclusions
- Account for opening bytes separately from the algebra that produces opening claims.
- Test commitment provenance with a coherent A/A′ attack, not only random proof mutations.
- For recursion, benchmark the verifier trace and memory footprint—not only native verification time.
- Authenticate fixed proof geometry reproducibly once it becomes part of consensus.
The linked artifacts preserve the implementations, measurements and negative tests. They are experimental evidence for these conclusions, not claims that all three prototypes are interchangeable production PCS choices.