(a) Freivalds’ test: check a product without redoing itThe server claims C = AB over 𝔽11. Rather than recompute the product, the verifier draws a uniform r and forms Br, then A(Br), against Cr — three matrix–vector products. Press sample to watch r flow through both sides; matching coordinates glow green, a mismatch carmine. Plant an error in C and most random r expose it at once; the rare r that still passes is the 1/q slice the soundness proof allows.
–
(b) completeness, soundness, amplificationA correct product passes every single time — perfect completeness. A wrong one passes one random check with probability at most 1/q; repeating with k independent r drives the false-accept probability to q−k. The gold curve is that bound; press run to throw batches of random r at a wrong product and watch the measured false-accept fraction track it. A handful of repetitions already makes the error astronomically small.
repetitions k
–
§3–4 — sumcheck: a sum over 2m points, one round at a timeThe claim is H = Σ g(b) over all eight corners of {0,1}³, with g of degree 2 per variable over 𝔽97. Each round the prover sends a univariate qi(X); the verifier checks qi(0) + qi(1) equals the running target, then folds in a fresh random ri and keeps qi(ri) as the next target. After three rounds it evaluates g once at (r₁,r₂,r₃). Switch on the cheating prover: it must lie to match a wrong H, the lie propagates, and the final evaluation catches it — the soundness is at most md/q.
–
chaining down a layered circuitA layered circuit is verified top to bottom. The verifier holds a single claim ᶜi(r) = a about one layer at a random point. Sumcheck on that layer’s wiring identity reduces it to two evaluations on the next layer; the prover restricts them to the line through both points, the verifier checks the endpoints and samples one fresh point, collapsing back to a single claim one layer down. Step to the input layer, where the multilinear extension is evaluated directly. Verifier work is polylog in the circuit size per layer; the prover stays near-linear.
–
(a) succinct argument: commit, then open a few blocksThe computation is encoded as a PCP Π whose verifier reads only a few locations. The prover hashes Π’s blocks into a Merkle tree and sends the short root. To answer a query it reveals the block and the sibling hashes along its path; the verifier recomputes the root and compares. Collision resistance means the prover cannot open the same root two ways — tamper with a block after committing and the recomputed root no longer matches. Fiat–Shamir derives the query index from a hash of the transcript, removing interaction.
–
(b) zero knowledge: 3-coloring, one edge at a timeTo prove a graph is 3-colorable without revealing the coloring, the prover randomly permutes the three colors, commits to every vertex’s color under lock, and lets the verifier open the two endpoints of one random edge — which must differ. One round catches a bad coloring with probability at least 1/|E|; many rounds make cheating hopeless, while each round leaks only that one edge’s two colors, freshly permuted. The simulator view shows why it is zero knowledge: guess the edge first, colour just those two endpoints differently, and the transcript is identical without any real coloring.