perf(sumcheck): use narrow fp32 digit accumulators - #435
Conversation
Accumulate FpExt4 by small scalar products in the existing exact u128 coefficient slots and reduce once per sum. Add direct differential coverage and a focused Criterion benchmark.
PR SummaryMedium Risk Overview
Compact kernels (direct range, fused relation/range-image, two-round prefix) now use Proof protocol, planner, transcripts, and verifier are unchanged. Adds a differential small-accum test and a Criterion kernel bench. Reviewed by Cursor Bugbot for commit fc78c71. Bugbot is set up for automated code reviews on this repo. Configure here. |
Documentation blast radius (advisory)These regions may need doc/spec/book updates based on changed paths. Changed files in this PR: 23
|
PCS Profile Benchmark
13 of 13 profiles passed. Times are medians of Each sample verifies the same proof first with the configured multi-threaded pool and then with one thread. Both timings reuse the same verifier setup. Merge-base comparisons are available for Benchmark shards
Public opening statements
One-hot profiles generate deterministic witnesses with one Direct evaluates the public setup contribution during Stage 2. Recursive carries the same check through a Stage 3 setup-product sumcheck. Both modes execute the complete fold schedule and terminal verification. The chunked profiles Generated profiles may select different A, B, and D ring dimensions at different fold levels. The short profile names omit those dimensions. Each sample generates deterministic witnesses and opening points, prepares setup, commits, proves, serializes the proof, checks its size, prepares verifier setup, and verifies the claimed openings. It does not test malformed proofs. Phase time
Proof size and protocol shape
Grinding retries are rejected attempts at each fold, listed in measured-run order. Zero means the first sampled nonce was accepted. Memory and setup size
Deltas are shown only for profiles with a matching merge-base case. Negative is smaller or faster. The uploaded |
Add a dedicated small-scalar accumulator that keeps FpExt4<Fp32> coefficient sums in u64 slots and folds only on carry. Route compact digit-range and range-image kernels through it while preserving the unrestricted multiplication path.
quangvdao
changed the title
CI test timing
Run summary
Wall time spans 2 parallel nextest slice shards. Slowest tests
Regressions vs mainNo per-test regressions above the threshold. New slow testsNo new tests ≥30s vs main baseline. |
Delay exact relation-polynomial reductions to worker boundaries across the folded Stage 2 kernels. Factor the compact prefix norm along its tensor boundary for fields where small-scalar accumulation is cheaper, while preserving the direct fp64 path. Add differential coverage for fp32 and fp64 relation accumulation.
|
Warning This PR has more than 500 changed lines and does not include a spec. Large features and architectural changes benefit from a short spec before implementation review. If this PR is a bug fix, small cleanup, or otherwise does not warrant a spec, feel free to ignore this message. |
1 participant
Summary
This PR gives compact fp32 digit sum-check kernels a dedicated narrow accumulator.
FpExt4<Fp32>now sums each extension coefficient in oneu64slot and reduces only at the end or when a slot carries.The new path covers:
The proof protocol does not change. The planner, generated schedules, transcript, proof bytes, verifier, fp64 arithmetic, and fp128 arithmetic also do not change.
Diff metadata
6918a2018da6061d6399c74b542017027a7b74b8onmain3984e5272e3b08231e6f7db85c581391e347e895specs/packed-sumcheck.mdMotivation
The compact kernels multiply random fp32 extension field values by small integer coefficients derived from balanced digits. The old implementation reduced all four base field products after every multiplication. The first draft of this PR delayed those reductions in four
u128slots. That removed the repeated reductions, but it used twice the accumulator storage and wider arithmetic than these small products need.The final implementation gives small integer products their own accumulator. Full extension products keep the existing
u128accumulator. Unrestricted one off multiplication keeps its ordinary reduced path.Data flow
flowchart LR A[Compact signed digit term] --> B[mul_small_unreduced] B --> C[Positive or negative accumulator] C --> D[Four u64 coefficient slots] D --> E[Fold modulo p only on carry] E --> F[reduce_small_accum at the round boundary]Change surface
u64productsu128slots in the first draftu64slotsponly when a slot carriesNarrow accumulator arithmetic
HasUnreducedOpsnow distinguishes small integer accumulation from unrestrictedu64multiplication and full field multiplication. The new associated type isSmallMulAccum.For
FpExt4<Fp32<P>>,FpExt4Fp32SmallMulAccum<P>stores fouru64values. Each input coefficient and the scalar are canonical values belowP, so one product is belowP²and fits inu64.Most additions are one native
u64addition. If an addition carries past 64 bits, the accumulator corrects the wrapped sum by2^64 mod P. For a modulusP = 2^32 - c, this correction isc² mod P. The implementation uses the field's existingSHIFT64_MOD_Pconstant, so it also works for every supportedFp32<P>modulus.The carry correction means correctness does not depend on the number of variables, the Rayon partition size, or a fixed batch length. Small balanced digit sums normally avoid the carry path. Long sums remain correct when they reach it.
The compact kernels keep positive and negative contributions in separate accumulators. They reduce each side once at the existing round boundary and then subtract the canonical field values.
Performance evidence
On an Apple Silicon development machine, the direct Criterion comparison measured:
u64accumulatorAt 64 and 256 terms, the narrow implementation is about 33 to 35 percent faster than the first draft's
u128accumulator.Two local fp32 nv26 dense runs proved in 0.55 and 0.57 seconds and both verification modes passed. These runs confirm correctness but are not an exact comparison with
main. The hosted interleaved profile report remains the acceptance evidence for the full proving effect.Correctness and compatibility
The differential test compares ordinary field arithmetic with 1,024 accumulated products. It includes zero,
u64::MAX, and random scalars. This also exercises repeated carry correction.The
HasUnreducedOpsRust trait gains one associated type and two methods. Custom implementations must provide the small accumulator operations. Akita's field implementations and the test field are updated in this PR.There is no wire, transcript, serialization, schedule, planner, setup, or verifier change. No verifier input handling or panic behavior changes.
Commit map
075a96a82adds the differential test and focused benchmark.3984e5272adds the narrow accumulator and routes all compact digit kernels through it.Validation completed at
3984e5272The following passed locally:
cargo fmt --allandgit diff --check;cargo test -p akita-field --lib, with 158 tests passed;cargo test -p akita-sumcheck --lib, with 3 tests passed;akita-field,akita-sumcheck, andakita-proverwith warnings denied;Hosted CI and the profile matrix are running at this head. No failure is currently reported.
Acceptance question
Keep this change if the hosted report shows a useful fp32 proving gain without regressions in the other field families. Revise or close the draft if the kernel gain does not transfer to full proving.
Reviewer map
Suggested review order:
crates/akita-field/src/unreduced/accum.rscrates/akita-field/src/unreduced/mod.rscrates/akita-field/src/ext/fp_ext4.rscrates/akita-prover/src/protocol/sumcheck/digit_range/direct_range_leaf.rscrates/akita-prover/src/protocol/sumcheck/relation_range_image/mod.rscrates/akita-prover/src/protocol/sumcheck/two_round_prefix/common.rscrates/akita-field/src/ext/tests.rscrates/akita-pcs/benches/field_arith/kernel.rs