feat: fold proving key polys instead of prover polys

[lucasxia01]

The prover folds the proving key polynomials instead of the prover polynomials, where the difference is only in the shifted polynomials. The prover will derive the shifted polynomials from the proving key polynomials instead. This results in a ~200ms improvement in Client IVC Bench, with the vast majority coming from the 20% reduction (55 to 44 polynomials) in polynomials that the prover folds while computing the next accumulator.

High level differences in benchmark:
Total time: 23750->23573ms
accumulator_update_round: 724ms->570ms

--------------------------------------------------------------------------------
Benchmark                      Time             CPU   Iterations UserCounters...
--------------------------------------------------------------------------------
ClientIVCBench/Full/6      23573 ms        18649 ms            1 Decider::construct_proof=1 Decider::construct_proof(t)=750.843M ECCVMComposer::compute_commitment_key=1 ECCVMComposer::compute_commitment_key(t)=3.68625M ECCVMComposer::compute_witness=1 ECCVMComposer::compute_witness(t)=128.974M ECCVMComposer::create_prover=1 ECCVMComposer::create_prover(t)=148.813M ECCVMComposer::create_proving_key=1 ECCVMComposer::create_proving_key(t)=15.9237M ECCVMProver::construct_proof=1 ECCVMProver::construct_proof(t)=1.75397G Goblin::merge=11 Goblin::merge(t)=135.218M GoblinTranslatorCircuitBuilder::constructor=1 GoblinTranslatorCircuitBuilder::constructor(t)=57.2252M GoblinTranslatorProver=1 GoblinTranslatorProver(t)=120.492M GoblinTranslatorProver::construct_proof=1 GoblinTranslatorProver::construct_proof(t)=944.363M ProtoGalaxyProver_::accumulator_update_round=10 ProtoGalaxyProver_::accumulator_update_round(t)=570.325M ProtoGalaxyProver_::combiner_quotient_round=10 ProtoGalaxyProver_::combiner_quotient_round(t)=7.19019G ProtoGalaxyProver_::perturbator_round=10 ProtoGalaxyProver_::perturbator_round(t)=1.31137G ProtoGalaxyProver_::preparation_round=10 ProtoGalaxyProver_::preparation_round(t)=4.13424G ProtogalaxyProver::fold_instances=10 ProtogalaxyProver::fold_instances(t)=13.2061G ProverInstance(Circuit&)=11 ProverInstance(Circuit&)(t)=1.95959G batch_mul_with_endomorphism=30 batch_mul_with_endomorphism(t)=563.661M commit=426 commit(t)=4.00095G compute_combiner=10 compute_combiner(t)=7.18806G compute_perturbator=9 compute_perturbator(t)=1.31106G compute_univariate=48 compute_univariate(t)=1.41724G construct_circuits=6 construct_circuits(t)=4.47437G
Benchmarking lock deleted.
client_ivc_bench.json                                              100% 3993   122.1KB/s   00:00    
function                                        ms     % sum
construct_circuits(t)                         4474    19.14%
ProverInstance(Circuit&)(t)                   1960     8.38%
ProtogalaxyProver::fold_instances(t)         13206    56.50%
Decider::construct_proof(t)                    751     3.21%
ECCVMComposer::create_prover(t)                149     0.64%
ECCVMProver::construct_proof(t)               1754     7.50%
GoblinTranslatorProver::construct_proof(t)     944     4.04%
Goblin::merge(t)                               135     0.58%

Total time accounted for: 23373ms/23573ms = 99.15%

Major contributors:
function                                        ms    % sum
commit(t)                                     4001   17.12%
compute_combiner(t)                           7188   30.75%
compute_perturbator(t)                        1311    5.61%
compute_univariate(t)                         1417    6.06%

Breakdown of ProtogalaxyProver::fold_instances:
ProtoGalaxyProver_::preparation_round(t)           4134    31.31%
ProtoGalaxyProver_::perturbator_round(t)           1311     9.93%
ProtoGalaxyProver_::combiner_quotient_round(t)     7190    54.45%
ProtoGalaxyProver_::accumulator_update_round(t)     570     4.32%

Please read contributing guidelines and remove this line.

[lucasxia01]

new NUM_FOLDED_ENTITIES variable in goblin_ultra_flavor/ultra_flavor.hpp

[lucasxia01]

key change: we fold proving key polys

[lucasxia01]

have to move only the polynomials since the rest of the proving key is irrelevant here. This function (compute_next_accumulator) is definitely need of a refactor (see issue 881 in this function).

[lucasxia01]

derive the prover_polynomials from proving_key (very cheap step of .share() and .shifted() calls)

[maramihali]

can you add a comment above explaining why this is happening?

[maramihali]

why do you have to loop here?

[lucasxia01]

Proving key has some other stuff like circuit_size and evaluation_domain and whatever. This loop is to move just the polynomials

[maramihali]

yeah it's kinda ugh that we create an incomplete proving key :-?

[maramihali]

but i guess it's just an intermediary object because we carry over the prover polynomials

[lucasxia01]

yeah, it's ugly but I think I can handle the refactoring of this function in a future PR by setting the next accumulator to just be instances[0] and then folding in the rest of the instances instead of creating empty stuff and doing the folding.

[maramihali]

sounds good!! I approved anyways

[AztecBot]

Benchmark results

No metrics with a significant change found.

Detailed results

All benchmarks are run on txs on the Benchmarking contract on the repository. Each tx consists of a batch call to create_note and increment_balance, which guarantees that each tx has a private call, a nested private call, a public call, and a nested public call, as well as an emitted private note, an unencrypted log, and public storage read and write.

This benchmark source data is available in JSON format on S3 here.

Values are compared against data from master at commit 933145e8 and shown if the difference exceeds 1%.

L2 block published to L1

Each column represents the number of txs on an L2 block published to L1.

Metric	8 txs	32 txs	64 txs
l1_rollup_calldata_size_in_bytes	676	676	676
l1_rollup_calldata_gas	6,424	6,400	6,412
l1_rollup_execution_gas	585,757	585,733	585,745
l2_block_processing_time_in_ms	1,306	4,679 (-1%)	9,143 (-1%)
note_successful_decrypting_time_in_ms	170 (-8%)	509 (-2%)	983 (+2%)
note_trial_decrypting_time_in_ms	74.7 (-18%)	25.6 (-35%)	111 (+17%)
l2_block_building_time_in_ms	13,942	51,782 (+1%)	102,568 (+1%)
l2_block_rollup_simulation_time_in_ms	7,967	28,250	55,602
l2_block_public_tx_process_time_in_ms	5,952 (+1%)	23,482 (+1%)	46,870 (+1%)

L2 chain processing

Each column represents the number of blocks on the L2 chain where each block has 16 txs.

Metric	5 blocks	10 blocks
node_history_sync_time_in_ms	13,983	26,669
note_history_successful_decrypting_time_in_ms	1,220 (-3%)	2,523 (+4%)
note_history_trial_decrypting_time_in_ms	63.4 (-30%)	164 (+39%)
node_database_size_in_bytes	18,661,456	34,881,616
pxe_database_size_in_bytes	29,859	59,414

Circuits stats

Stats on running time and I/O sizes collected for every circuit run across all benchmarks.

Circuit	circuit_simulation_time_in_ms	circuit_input_size_in_bytes	circuit_output_size_in_bytes
private-kernel-init	238 (+1%)	44,377	28,214
private-kernel-ordering	209 (+1%)	52,880	14,296
base-parity	4,675 (-2%)	128	311
root-parity	1,706 (+6%)	1,244	311
base-rollup	18,014	165,760	861
root-rollup	49.6	4,359	725
private-kernel-inner	311 (+2%)	73,794	28,214
public-kernel-app-logic	126 (+1%)	35,251	28,217
public-kernel-tail	171 (+1%)	40,928	28,217
merge-rollup	8.58 (-7%)	2,568	861

Tree insertion stats

The duration to insert a fixed batch of leaves into each tree type.

Metric	1 leaves	16 leaves	64 leaves	128 leaves	512 leaves	1024 leaves	2048 leaves	4096 leaves	32 leaves
batch_insert_into_append_only_tree_16_depth_ms	10.0	15.9 (-1%)	N/A	N/A	N/A	N/A	N/A	N/A	N/A
batch_insert_into_append_only_tree_16_depth_hash_count	16.8	31.6	N/A	N/A	N/A	N/A	N/A	N/A	N/A
batch_insert_into_append_only_tree_16_depth_hash_ms	0.583	0.492 (-1%)	N/A	N/A	N/A	N/A	N/A	N/A	N/A
batch_insert_into_append_only_tree_32_depth_ms	N/A	N/A	46.3	72.5	231	443	862	1,721	N/A
batch_insert_into_append_only_tree_32_depth_hash_count	N/A	N/A	96.0	159	543	1,055	2,079	4,127	N/A
batch_insert_into_append_only_tree_32_depth_hash_ms	N/A	N/A	0.475 (-1%)	0.447	0.420	0.415	0.411	0.413	N/A
batch_insert_into_indexed_tree_20_depth_ms	N/A	N/A	53.6 (-2%)	106	333 (-2%)	658	1,303	2,603	N/A
batch_insert_into_indexed_tree_20_depth_hash_count	N/A	N/A	104	207	691	1,363	2,707	5,395	N/A
batch_insert_into_indexed_tree_20_depth_hash_ms	N/A	N/A	0.477 (-2%)	0.479	0.455 (-2%)	0.453	0.452	0.452	N/A
batch_insert_into_indexed_tree_40_depth_ms	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	61.6 (+1%)
batch_insert_into_indexed_tree_40_depth_hash_count	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	109
batch_insert_into_indexed_tree_40_depth_hash_ms	N/A	N/A	N/A	N/A	N/A	N/A	N/A	N/A	0.539 (+1%)

Miscellaneous

Transaction sizes based on how many contract classes are registered in the tx.

Metric	0 registered classes	1 registered classes
tx_size_in_bytes	14,966	494,914

Transaction processing duration by data writes.

Metric	0 new note hashes	1 new note hashes
tx_pxe_processing_time_ms	2,403 (+2%)	1,408 (+1%)

Metric	0 public data writes	1 public data writes
tx_sequencer_processing_time_ms	16.4	734 (+1%)