Fix FRI folded layers domain

[plafer]

Fixes the (implied) FRI layer domains.

For example, let

• domain_size = 16,
• folding_factor = 2,
• $\omega$ be the generator of group size 16,
• $h$ be the domain offset,

then the FRI domains are

• $[h, h\omega, h \omega^2, h\omega^3, \dots, h\omega^{15}]$,
• $[h^2, h^2\omega^2, h^2 \omega^4, h^2\omega^6, h^2\omega^8, h^2\omega^{10}, h^2\omega^{12}, h^2\omega^{14}]$,
• $[h^4, h^4\omega^4, h^4 \omega^8, h^4\omega^{12}]$,
• $[h^8, h^8\omega^8]$.

Noticeably, the domain offset is also squared - which the previous implementation did not do. The Miden VM's recursive verifier will probably need to be updated accordingly as well.

cc @Al-Kindi-0

[Al-Kindi-0]

Unless there is a strong reason for this, I would keep it as is. I agree that it is probably more natural to define the folded domains using a "pure" square map in the case of folding factor 2, but the current implementation is equally valid and can be expressed using the same framework.

Noticeably, the domain offset is also squared - which the previous implementation did not do. The Miden VM's recursive verifier will probably need to be updated accordingly as well.

This is one of the reasons why I would like to keep it as is :). However, we can comeback to this once we have some spare capacity to update things on the VM side.

[plafer]

but the current implementation is equally valid and can be expressed using the same framework.

I can't find the right way to explain what's going on though. For example, for a folding factor of 2, we have

$$ f^{(d-1)}(x) = \frac{1}{2} (f^{(d)}(x^{1/2}) + f^{(d)}(-x^{1/2})) + \frac{\alpha}{2 x^{1/2}} (f^{(d)}(x^{1/2}) - f^{(d)}(-x^{1/2})) $$

If the domain of $f^{(d-1)}$ is $[h, h\omega^{2}, h\omega^{4}, \dots, h\omega^{14}]$ (as currently implemented), then e.g. $f^{(d)}(x^{1/2})$ over this domain is $[f^{(d)}(h^{1/2}), f^{(d)}(h^{1/2} \omega), f^{(d)}(h^{1/2} \omega^2), \dots]$, which are not evaluations committed to in the first layer.

What am I missing?

[Al-Kindi-0]

I think you can just define the projection map to be, instead of a pure square, $\pi_d\left(\{h\cdot \omega^i, h\cdot\omega^{i + \frac{N}{2}}\} \right) = h \cdot \omega^{2i}$.
We can now define the evaluations of the folded polynomial at the points of the next domain to be
$$P^{d + 1}\left( h \cdot \omega^{2i} \right) := \frac{1}{2} \cdot \left(P^d\left(h\cdot\omega^i\right) + P^d\left(-h\cdot\omega^i\right)\right) + \alpha \cdot \frac{P^d\left(h\cdot\omega^i\right) - P^d\left(-h\cdot\omega^i\right)}{h\cdot\omega^i - (-h\cdot\omega^i)}$$
where we used $\omega^{i + \frac{N}{2}} = -\omega^i$.

In more details, take the polynomial in the $0$-th layer hence dropping some of the super-indices, and let's look at its evaluations over the domain $L^0 := \{h \cdot \omega^i, 0 \leq n \}$, where $\rho := \frac{k}{n}$. Let $g = \omega^j$ for some $j$ in $0..(n-1)$.

$$\begin{aligned} P\left(h\cdot g\right) &= \sum_{i = 0}^{k - 1} a_i \cdot (h\cdot g)^i \\\ &= \sum_{i = 0}^{\frac{k}{2} - 1} a_{2i} \cdot (h\cdot g)^{2i} + \sum_{i = 0}^{\frac{k}{2} - 1} a_{2i + 1} \cdot (h\cdot g)^{2i + 1} \\\ &= \sum_{i = 0}^{\frac{k}{2} - 1} a_{2i} \cdot h^i \cdot (h\cdot g^2)^{i} + h\cdot g \cdot \sum_{i = 0}^{\frac{k}{2} - 1} a_{2i + 1} \cdot h^i \cdot (h\cdot g^2)^{i} \\\ &= P_e\left(h \cdot g^2\right) + h \cdot g \cdot P_o\left(h \cdot g^2\right) \end{aligned}$$

where $$P_e\left(X\right) := \sum_{i = 0}^{\frac{k}{2} - 1} a_{2i} \cdot h^i \cdot X$$

and $$P_o\left(X\right) := \sum_{i = 0}^{\frac{k}{2} - 1} a_{2i + 1} \cdot h^i \cdot X$$

So we have in some sense a scaled even-odd decomposition of the original polynomial, but the crucial point here is that the degree bounds on both polynomials is half that of the one on the original polynomial, and moreover we have a relation linking the original evaluations to the evaluations of the two decomposition polynomials in the spirit of butterflys in FFTs.

Now we can build the folded code-word as $$P_{\alpha}\left(h\cdot g^2\right) = P_e\left(h \cdot g^2\right) + \alpha \cdot P_o\left(h \cdot g^2\right)$$. Note that $$P_{\alpha}\left(h\cdot g^2\right) = P_e\left(h \cdot g^2\right) + h \cdot \alpha \cdot P_o\left(h \cdot g^2\right)$$ would work too but we would get a different final expression.

Now using the relation $P\left(h\cdot g\right) = P_e\left(h \cdot g^2\right) + h \cdot g \cdot P_o\left(h \cdot g^2\right)$ we get that
$$P_e\left(h \cdot g^2\right) = \frac{1}{2} \cdot \left(P\left(h\cdot g\right) + P\left(-h\cdot g\right)\right)$$
and
$$P_o\left(h \cdot g^2\right) = \frac{1}{2\cdot h \cdot g} \cdot \left(P\left(h\cdot g\right) - P\left(-h\cdot g\right)\right)$$

Putting everything together we get $$P_{\alpha}\left(h\cdot g^2\right) = \frac{1}{2} \cdot \left(P\left(h\cdot g\right) + P\left(-h\cdot g\right)\right) + \frac{\alpha}{2\cdot h \cdot g} \cdot \left(P\left(h\cdot g\right) - P\left(-h\cdot g\right)\right)$$

[plafer]

Awesome, thank you for the detailed explanation, that clears things up!