Replace Fixed Randomness with Halo2 Fiat Shamir Transformation

.gitignore

@@ -27,3 +27,5 @@ params_ipa
 examples
 testing/data
 *.diff
+
+ignore/*

Cargo.toml

@@ -20,10 +20,12 @@ opt-level = 3
 opt-level = 3
 
 [dependencies]
+ark-std = { version = "^0.4.0", default-features = false}
 bitvec = "1.0.1"
-halo2 = { git="https://github.com/privacy-scaling-explorations/halo2", package="halo2", rev="17e9765c199670534c0299c96128d0464a188d0b" }
-halo2_gadgets = { git="https://github.com/privacy-scaling-explorations/halo2", package="halo2_gadgets", rev="17e9765c199670534c0299c96128d0464a188d0b", features = ["circuit-params"] }
-halo2_proofs = { git="https://github.com/privacy-scaling-explorations/halo2", package="halo2_proofs", rev="17e9765c199670534c0299c96128d0464a188d0b", features = ["circuit-params"] }
+halo2 = { git="https://github.com/span14/halo2", package="halo2", branch="benchmark" }
+halo2_gadgets = { git="https://github.com/span14/halo2", package="halo2_gadgets", branch="benchmark", features = ["circuit-params"]}
+halo2_proofs = { git="https://github.com/span14/halo2", package="halo2_proofs", branch="benchmark", features = ["circuit-params", "zkml"]}
+halo2_curves = { git = "https://github.com/privacy-scaling-explorations/halo2curves", tag = "0.3.2", package = "halo2curves"}
 lazy_static = "1.4.0"
 ndarray = "0.15.6"
 num-bigint = "0.4.3"
@@ -37,3 +39,6 @@ serde_derive = "1.0.152"
 serde_json = "1.0.85"
 wav = "1.0.0"
 
+[features]
+print-trace=["ark-std/print-trace", "halo2_proofs/print-trace"]
+stats=["halo2_proofs/stats"]

python/converter.py

@@ -315,9 +315,6 @@ def to_dict(self, start_layer, end_layer):
       elif op_code == tflite.BuiltinOperator.SHAPE:
         layer_type = 'Noop'
         params = [0]
-      elif op_code == tflite.BuiltinOperator.GATHER:
-        layer_type = 'Noop'
-        params = [0]
       elif op_code == tflite.BuiltinOperator.REDUCE_PROD:
         # TODO: not sure if this is in general a no-op
         layer_type = 'Noop'
@@ -334,6 +331,10 @@ def to_dict(self, start_layer, end_layer):
         params = [0]
 
       ## Shape
+      elif op_code == tflite.BuiltinOperator.GATHER:
+        pos = interpreter.get_tensor(op.Inputs(1)).flatten().astype(np.int64)
+        layer_type = 'Gather'
+        params = pos.tolist()
       elif op_code == tflite.BuiltinOperator.RESHAPE:
         layer_type = 'Reshape'
         params = []

src/bin/bench_circuit.rs

@@ -0,0 +1,13 @@
+use halo2_proofs::halo2curves::bn256::Fr;
+use zkml::{
+  model::ModelCircuit,
+  utils::bench_kzg::bench_kzg,
+};
+
+fn main() {
+  let config_fname = std::env::args().nth(1).expect("config file path");
+  let inp_fname = std::env::args().nth(2).expect("input file path");
+  let step = std::env::args().nth(3).expect("step");
+  let circuit = ModelCircuit::<Fr>::generate_from_file(&config_fname, &inp_fname);
+  bench_kzg(step, circuit);
+}

src/bin/breakdown_circuit.rs

@@ -0,0 +1,85 @@
+use ark_std::{end_timer, start_timer};
+use halo2_proofs::{
+    dev::MockProver,
+    halo2curves::bn256::{Bn256, Fr, G1Affine},
+    plonk::{create_proof, keygen_pk, keygen_vk},
+    poly::kzg::{
+        commitment::KZGCommitmentScheme,
+        multiopen::ProverSHPLONK,
+        strategy::SingleStrategy,
+    },
+    transcript::{
+      Blake2bRead, Blake2bWrite, Challenge255, TranscriptReadBuffer, TranscriptWriterBuffer,
+    },
+};
+
+use zkml::{
+    model::ModelCircuit,
+    utils::{
+        proving_kzg::{get_kzg_params, verify_kzg},
+        helpers::get_public_values,
+    }
+
+};
+
+fn main() {
+    let config_fname = std::env::args().nth(1).expect("config file path");
+    let inp_fname = std::env::args().nth(2).expect("input file path");
+    let circuit = ModelCircuit::<Fr>::generate_from_file(&config_fname, &inp_fname);
+
+
+    let rng = rand::thread_rng();
+
+    let timer = start_timer!(|| "Setup");
+    let degree = circuit.k as u32;
+    let params = get_kzg_params("./params_kzg", degree);
+    end_timer!(timer);
+
+    let timer = start_timer!(|| "Preprocess");
+    let vk_circuit = circuit.clone();
+    let vk = keygen_vk(&params, &vk_circuit).unwrap();
+    drop(vk_circuit);
+
+    let pk_circuit = circuit.clone();
+    let pk = keygen_pk(&params, vk, &pk_circuit).unwrap();
+    drop(pk_circuit);
+    end_timer!(timer);
+
+    let proof_circuit = circuit.clone();
+    let _prover = MockProver::run(degree, &proof_circuit, vec![vec![]]).unwrap();
+    let public_vals = get_public_values();
+
+    let timer = start_timer!(|| "Prove");
+    let mut transcript = Blake2bWrite::<_, G1Affine, Challenge255<_>>::init(vec![]);
+    create_proof::<
+      KZGCommitmentScheme<Bn256>,
+      ProverSHPLONK<'_, Bn256>,
+      Challenge255<G1Affine>,
+      _,
+      Blake2bWrite<Vec<u8>, G1Affine, Challenge255<G1Affine>>,
+      ModelCircuit<Fr>,
+    >(
+      &params,
+      &pk,
+      &[proof_circuit],
+      &[&[&public_vals]],
+      rng,
+      &mut transcript,
+    )
+    .unwrap();
+    let proof = transcript.finalize();
+    end_timer!(timer);
+
+    let timer = start_timer!(|| "Verify");
+    let strategy = SingleStrategy::new(&params);
+    let transcript_read = Blake2bRead::<_, _, Challenge255<_>>::init(&proof[..]);
+    verify_kzg(
+      &params,
+      &pk.get_vk(),
+      strategy,
+      &public_vals,
+      transcript_read,
+    );
+    end_timer!(timer);
+
+}

src/bin/verify_circuit.rs

@@ -14,7 +14,6 @@ fn main() {
   if kzg_or_ipa != "kzg" && kzg_or_ipa != "ipa" {
     panic!("Must specify kzg or ipa");
   }
-
   if kzg_or_ipa == "kzg" {
     let config = load_config_msgpack(&config_fname);
     let circuit = ModelCircuit::<Fr>::generate_from_msgpack(config, false);

src/commitments/packer.rs

@@ -51,16 +51,16 @@ impl<F: PrimeField> PackerChip<F> {
       // TODO: for many columns, pack many in a single row
       NUM_BITS_PER_FIELD_ELEM / num_bits_per_elem
     };
-    println!("column len: {}", columns.len());
-    println!("num_bits_per_elem: {}", num_bits_per_elem);
-    println!("NUM_BITS_PER_FIELD_ELEM: {}", NUM_BITS_PER_FIELD_ELEM);
-    println!("num_elem_per_packed: {}", num_elem_per_packed);
+    // println!("column len: {}", columns.len());
+    // println!("num_bits_per_elem: {}", num_bits_per_elem);
+    // println!("NUM_BITS_PER_FIELD_ELEM: {}", NUM_BITS_PER_FIELD_ELEM);
+    // println!("num_elem_per_packed: {}", num_elem_per_packed);
 
     let num_packed_per_row = max(
       1,
       columns.len() / (num_elem_per_packed * (num_bits_per_elem + 1)),
     );
-    println!("num_packed_per_row: {}", num_packed_per_row);
+    // println!("num_packed_per_row: {}", num_packed_per_row);
 
     let exponents = Self::get_exponents(num_bits_per_elem, num_elem_per_packed);
 
@@ -143,7 +143,7 @@ impl<F: PrimeField> PackerChip<F> {
     &self,
     mut layouter: impl Layouter<F>,
     gadget_config: Rc<GadgetConfig>,
-    cells: Vec<CellRc<F>>,
+    cells: Vec<(CellRc<F>, F)>,
     zero: &AssignedCell<F, F>,
   ) -> Result<Vec<CellRc<F>>, Error> {
     let columns = &gadget_config.columns;
@@ -170,9 +170,9 @@ impl<F: PrimeField> PackerChip<F> {
             .iter()
             .enumerate()
             .map(|(i, x)| {
-              x.copy_advice(|| "", &mut region, columns[col_offset + i], 0)
+              x.0.copy_advice(|| "", &mut region, columns[col_offset + i], 0)
                 .unwrap();
-              x.value().copied()
+              x.0.value().copied()
             })
             .collect::<Vec<_>>();
 
@@ -216,7 +216,7 @@ impl<F: PrimeField> PackerChip<F> {
     gadget_config: Rc<GadgetConfig>,
     values: Vec<&F>,
     zero: &AssignedCell<F, F>,
-  ) -> Result<(Vec<CellRc<F>>, Vec<CellRc<F>>), Error> {
+  ) -> Result<(Vec<CellRc<F>>, Vec<(CellRc<F>, F)>), Error> {
     let columns = &gadget_config.columns;
     let selector = gadget_config.selectors.get(&GadgetType::Packer).unwrap()[0];
 
@@ -249,7 +249,7 @@ impl<F: PrimeField> PackerChip<F> {
               let tmp = region
                 .assign_advice(|| "", columns[col_offset + i], 0, || Value::known(*x))
                 .unwrap();
-              Rc::new(tmp)
+              (Rc::new(tmp), *x)
             })
             .collect::<Vec<_>>();
           assigned.extend(vals);

src/gadgets/add_pairs.rs

@@ -1,7 +1,7 @@
 use std::{marker::PhantomData, rc::Rc};
 
 use halo2_proofs::{
-  circuit::{AssignedCell, Layouter, Region},
+  circuit::{AssignedCell, Layouter, Region, Value},
   halo2curves::ff::PrimeField,
   plonk::{ConstraintSystem, Error},
   poly::Rotation,
@@ -80,9 +80,9 @@ impl<F: PrimeField> Gadget<F> for AddPairsChip<F> {
     &self,
     region: &mut Region<F>,
     row_offset: usize,
-    vec_inputs: &Vec<Vec<&AssignedCell<F, F>>>,
-    _single_inputs: &Vec<&AssignedCell<F, F>>,
-  ) -> Result<Vec<AssignedCell<F, F>>, Error> {
+    vec_inputs: &Vec<Vec<(&AssignedCell<F, F>, F)>>,
+    _single_inputs: &Vec<(&AssignedCell<F, F>, F)>,
+  ) -> Result<Vec<(AssignedCell<F, F>, F)>, Error> {
     let inp1 = &vec_inputs[0];
     let inp2 = &vec_inputs[1];
     assert_eq!(inp1.len(), inp2.len());
@@ -97,30 +97,30 @@ impl<F: PrimeField> Gadget<F> for AddPairsChip<F> {
     let mut outps = vec![];
     for i in 0..inp1.len() {
       let offset = i * self.num_cols_per_op();
-      let inp1 = inp1[i].copy_advice(|| "", region, columns[offset + 0], row_offset)?;
-      let inp2 = inp2[i].copy_advice(|| "", region, columns[offset + 1], row_offset)?;
-      let outp = inp1.value().map(|x: &F| x.to_owned()) + inp2.value().map(|x: &F| x.to_owned());
+      inp1[i].0.copy_advice(|| "", region, columns[offset + 0], row_offset)?;
+      inp2[i].0.copy_advice(|| "", region, columns[offset + 1], row_offset)?;
+      let outp = inp1[i].1 + inp2[i].1;
 
-      let outp = region.assign_advice(|| "", columns[offset + 2], row_offset, || outp)?;
-      outps.push(outp);
+      let outpc = region.assign_advice(|| "", columns[offset + 2], row_offset, || Value::known(outp))?;
+      outps.push((outpc, outp));
     }
     Ok(outps)
   }
 
   fn forward(
     &self,
     mut layouter: impl Layouter<F>,
-    vec_inputs: &Vec<Vec<&AssignedCell<F, F>>>,
-    single_inputs: &Vec<&AssignedCell<F, F>>,
-  ) -> Result<Vec<AssignedCell<F, F>>, Error> {
+    vec_inputs: &Vec<Vec<(&AssignedCell<F, F>, F)>>,
+    single_inputs: &Vec<(&AssignedCell<F, F>, F)>,
+  ) -> Result<Vec<(AssignedCell<F, F>, F)>, Error> {
     let zero = &single_inputs[0];
 
     let mut inp1 = vec_inputs[0].clone();
     let mut inp2 = vec_inputs[1].clone();
     let initial_len = inp1.len();
     while inp1.len() % self.num_inputs_per_row() != 0 {
-      inp1.push(zero);
-      inp2.push(zero);
+      inp1.push(*zero);
+      inp2.push(*zero);
     }
 
     let vec_inputs = vec![inp1, inp2];

src/gadgets/adder.rs

@@ -76,9 +76,9 @@ impl<F: PrimeField> Gadget<F> for AdderChip<F> {
     &self,
     region: &mut Region<F>,
     row_offset: usize,
-    vec_inputs: &Vec<Vec<&AssignedCell<F, F>>>,
-    _single_inputs: &Vec<&AssignedCell<F, F>>,
-  ) -> Result<Vec<AssignedCell<F, F>>, Error> {
+    vec_inputs: &Vec<Vec<(&AssignedCell<F, F>, F)>>,
+    _single_inputs: &Vec<(&AssignedCell<F, F>, F)>,
+  ) -> Result<Vec<(AssignedCell<F, F>, F)>, Error> {
     assert_eq!(vec_inputs.len(), 1);
     let inp = &vec_inputs[0];
 
@@ -90,35 +90,35 @@ impl<F: PrimeField> Gadget<F> for AdderChip<F> {
     inp
       .iter()
       .enumerate()
-      .map(|(i, cell)| cell.copy_advice(|| "", region, self.config.columns[i], row_offset))
+      .map(|(i, cell)| cell.0.copy_advice(|| "", region, self.config.columns[i], row_offset))
       .collect::<Result<Vec<_>, _>>()?;
 
-    let e = inp.iter().fold(Value::known(F::ZERO), |a, b| {
-      a + b.value().map(|x: &F| x.to_owned())
+    let e = inp.iter().fold(F::ZERO, |a, b| {
+      a + b.1
     });
     let res = region.assign_advice(
       || "",
       *self.config.columns.last().unwrap(),
       row_offset,
-      || e,
+      || Value::known(e),
     )?;
 
-    Ok(vec![res])
+    Ok(vec![(res, e)])
   }
 
   fn forward(
     &self,
     mut layouter: impl Layouter<F>,
-    vec_inputs: &Vec<Vec<&AssignedCell<F, F>>>,
-    single_inputs: &Vec<&AssignedCell<F, F>>,
-  ) -> Result<Vec<AssignedCell<F, F>>, Error> {
+    vec_inputs: &Vec<Vec<(&AssignedCell<F, F>, F)>>,
+    single_inputs: &Vec<(&AssignedCell<F, F>, F)>,
+  ) -> Result<Vec<(AssignedCell<F, F>, F)>, Error> {
     assert_eq!(single_inputs.len(), 1);
 
     let mut inputs = vec_inputs[0].clone();
     let zero = single_inputs[0].clone();
 
     while inputs.len() % self.num_inputs_per_row() != 0 {
-      inputs.push(&zero);
+      inputs.push(zero);
     }
 
     let mut outputs = self.op_aligned_rows(
@@ -128,9 +128,9 @@ impl<F: PrimeField> Gadget<F> for AdderChip<F> {
     )?;
     while outputs.len() != 1 {
       while outputs.len() % self.num_inputs_per_row() != 0 {
-        outputs.push(zero.clone());
+        outputs.push((zero.0.clone(), zero.1));
       }
-      let tmp = outputs.iter().map(|x| x).collect::<Vec<_>>();
+      let tmp = outputs.iter().map(|x| (&x.0, x.1)).collect::<Vec<_>>();
       outputs = self.op_aligned_rows(
         layouter.namespace(|| "adder forward"),
         &vec![tmp],