Field-to-ring evaluation reduction

This page explains the first correctness obligation of an Akita opening: given the partial evaluations produced by the scheduled opening method, how do public weights recombine them into the scalar claim carried by the protocol?

Start with the base-field specialization

$$f:\{0,1{\}}^n\to F,r\in F^n,\tilde{f}(r)=v.$$

Here both the polynomial table and the opening point are defined over the base field $F$. Akita commits the table through the cyclotomic ring

$$R=F[X]/(X^D+1).$$

The schedule chooses one of two opening methods. EvaluationTrace keeps one full element $E_b(X)\in R$ per live block and finishes the inner contraction with TraceOpen. SubringCoefficientPacking contracts part of the inner axis earlier and keeps a shorter polynomial $e_b(U)$ over the opening field. In both cases the result is a field-valued linear relation on the committed opening digits:

For a proper extension-field point, EvaluationTrace first uses extension-opening reduction, or EOR, and the derivation below applies to the reduced trace target. Coefficient packing instead binds the original extension-valued opening directly. The fold-path overview states where the schedule uses each method.

The evaluation problem

Choose a ring dimension $D=2^d$ and a power-of-two number of positions per block. Re-index the polynomial table as

$$f[\ell ,p,b],$$

where:

• $\ell \in [D]$ is an inner index that will become a ring coefficient;
• $p$ is a position inside a block; and
• $b$ is a block index.

Missing entries in a partial final block are public zeros.

Split the opening point in the same order:

$$r=(r_{\mathrm{in}},r_{\mathrm{pos}},r_{\mathrm{blk}}).$$

Write the corresponding interpolation weights as

$$I_{\ell },Q_p,B_b.$$

For a multilinear opening in the Lagrange basis, these are equality weights:

$$I_{\ell }=\mathrm{eq}(r_{\mathrm{in}},\ell ),Q_p=\mathrm{eq}(r_{\mathrm{pos}},p),B_b=\mathrm{eq}(r_{\mathrm{blk}},b).$$

The evaluation claim is therefore

$$\tilde{f}(r)=\sum _{\ell ,p,b}{I}_{\ell }{Q}_p{B}_{b}f[\ell ,p,b].\text{\hspace{1em}(1)}$$

Akita evaluates the three axes in the order

$$\text{position}⟶\text{block}⟶\text{inner}.$$

Reduce to a ring-valued evaluation

Pack the inner axis into ring coefficients

For each position $p$ and block $b$, pack the inner slice into a ring:

$$F_{p,b}(X)=\sum _{\ell =0}^{D-1}f[\ell ,p,b]X^{\ell }\in R.\text{\hspace{1em}(2)}$$

This is only a change of representation. The table entry $f[\ell ,p,b]$ becomes the coefficient of $X^{\ell }$.

Equivalently, the values $F_{p,b}$ form a ring-valued multilinear table

$$f_R:\{0,1{\}}^{n-d}\to R,f_R[p,b]:=F_{p,b}.$$

This is the same underlying table under a lossless coefficient packing, not a new witness. The ring polynomial has $d={\log }_{2}D$ fewer variables and is opened at

$$r_R=(r_{\mathrm{pos}},r_{\mathrm{blk}}),$$

whose base-field coordinates act as constant elements of $R$.

Evaluate the ring polynomial

First evaluate the position coordinate independently inside every block:

$$E_b(X)=\sum _p{Q}_p{F}_{p,b}(X).\text{\hspace{1em}(3)}$$

The coefficient of $X^{\ell }$ in $E_b$ is

$$[E_b{]}_{\ell }=\sum _p{Q}_{p}f[\ell ,p,b].$$

Next evaluate the block coordinate:

$$Y(X)=\sum _b{B}_b{E}_b(X).\text{\hspace{1em}(4)}$$

Thus Equation (4) is the ring-based evaluation claim

$$\boxed{{\tilde{f}}_R(r_R)=Y.}$$

Now

$$[Y{]}_{\ell }=\sum _{p,b}{Q}_p{B}_{b}f[\ell ,p,b].\text{\hspace{1em}(5)}$$

Thus $Y$ contains the polynomial after evaluating the position and block parts of $r$. Only the inner coordinate remains.

Pack the inner opening weights

Pack the remaining weights into a second ring:

$$P(X)=\sum _{\ell =0}^{D-1}{I}_{\ell }{X}^{\ell }.\text{\hspace{1em}(6)}$$

The two rings have different sources:

Using Equation (5), the original evaluation can already be written as

$$\tilde{f}(r)=\sum _{\ell =0}^{D-1}{I}_{\ell }[Y{]}_{\ell }.\text{\hspace{1em}(7)}$$

Recover the evaluation with TraceOpen

Let ${\sigma }_{-1}$ be the ring automorphism

$${\sigma }_{-1}(X)=X^{-1}.$$

For any $Z\in R$, define

$$\boxed{{\mathrm{TraceOpen}}_P(Z):={\left[Z(X){\sigma }_{-1}(P(X))\right]}_0,}\text{\hspace{1em}(8)}$$

where $[\cdot {]}_0$ denotes the constant coefficient in $F[X]/(X^D+1)$.

If

$$Z(X)=\sum _{\ell }[Z{]}_{\ell }{X}^{\ell },$$

then the matching terms in $Z{\sigma }_{-1}(P)$ are

$$[Z{]}_{\ell }{X}^{\ell }\cdot I_{\ell }{X}^{-\ell }=[Z{]}_{\ell }{I}_{\ell }.$$

They contribute to the constant coefficient, giving

$${\mathrm{TraceOpen}}_P(Z)=\sum _{\ell =0}^{D-1}[Z{]}_{\ell }{I}_{\ell }.\text{\hspace{1em}(9)}$$

Applying this definition to $Y$ and using Equation (7),

$${\mathrm{TraceOpen}}_P(Y)=\sum _{\ell }[Y{]}_{\ell }{I}_{\ell }=\tilde{f}(r).\text{\hspace{1em}(10)}$$

Therefore:

$$\boxed{\tilde{f}(r)=v⟺{\mathrm{TraceOpen}}_P(Y)=v.}\text{\hspace{1em}(11)}$$

TraceOpen is a coefficient pairing. It is not the univariate evaluation $Y(\alpha )$ used to reduce ring-valued relations to the field.

Eliminate the intermediate ring evaluation $Y$

Hachi: expose $Y$

The baseline Hachi protocol exposes $Y$ and checks two statements:

$$Y=\sum _b{B}_b{E}_b,\text{\hspace{1em}(12)}$$

and

$${\mathrm{TraceOpen}}_P(Y)=v.\text{\hspace{1em}(13)}$$

The first statement proves that $Y$ is the correct evaluation of the ring-valued polynomial. In this fold, each $E_b(X)$ is digit-decomposed into the committed partial-evaluation witness:

$$E_b(X)=\sum _h{G}_h{\hat{e}}_{b,h}(X),\text{\hspace{1em}(14)}$$

where ${\hat{e}}_{b,h}$ are the digit rings and $G_h$ are public gadget weights. Substituting this decomposition into Equation (12) gives

$$\boxed{Y(X)=\sum _{b,h}{B}_b{G}_h{\hat{e}}_{b,h}(X).}\text{\hspace{1em}(15)}$$

Equation (15) is a relation over the ring that enforces consistency between the ring element $Y$ and the witness polynomials ${\hat{e}}_{b,h}(X)$. Hachi sends $Y$ to the verifier, which checks Equation (13) directly. The prover then proves Equation (15) using the same ring-relation machinery as the other constraints that bind the previous witness to the next witness, as described in Semantic relations in an Akita fold.

Akita: compose the two checks

Akita's crucial observation is that $Y$ is already determined linearly by the committed partial-evaluation witness and that ${\mathrm{TraceOpen}}_P$ is itself a linear map. Sending $Y$ would therefore introduce a redundant ring element, an extra interface between the two checks, and additional verifier work. Akita instead composes the two linear maps and applies TraceOpen directly to Equation (15):

$$\begin{array}{rl}v& ={\mathrm{TraceOpen}}_P(Y)\\ & =\sum _{b,h}{B}_b{G}_h{\mathrm{TraceOpen}}_P({\hat{e}}_{b,h}).\end{array}\text{\hspace{1em}(16)}$$

Write each digit ring as

$${\hat{e}}_{b,h}(X)=\sum _{\ell =0}^{D-1}{\hat{e}}_{b,h,\ell }{X}^{\ell }$$

and define the public inner trace weight

$$J_{\ell }:={\mathrm{TraceOpen}}_P(X^{\ell }).\text{\hspace{1em}(17)}$$

By linearity,

$${\mathrm{TraceOpen}}_P({\hat{e}}_{b,h})=\sum _{\ell }{\hat{e}}_{b,h,\ell }{J}_{\ell }.$$

Equation (16) becomes the direct evaluation-consistency relation

$$\boxed{v=\sum _{b,h,\ell }{\hat{e}}_{b,h,\ell }{B}_b{G}_h{J}_{\ell }.}\text{\hspace{1em}(18)}$$

In the base-field setting, Equation (9) gives

$$J_{\ell }={\mathrm{TraceOpen}}_P(X^{\ell })=I_{\ell }.\text{\hspace{1em}(19)}$$

Thus every factor in Equation (18) has a simple role:

• $G_h$ recomposes the digit planes;
• $B_b$ evaluates across blocks; and
• $J_{\ell }=I_{\ell }$ evaluates inside the packed ring.

This row acts on the committed partial-evaluation digits $\hat{e}$. The other fold relations bind those digits back to the original committed polynomial.

The two possible protocol views are:

Expose Y:

committed ê  ──recompose──>  E_b  ──block fold──>  Y
                                                    │
                                                 TraceOpen
                                                    │
                                                    v

Eliminate Y:

committed ê  ───────composed public linear map──────>  v

Express the direct relation as a sumcheck claim

The committed fold witness is stored as one flat table $w$. Flatten the indices $(b,h,\ell )$ into a Boolean address $x$, and define the public weight function

$$T(x)=\{\begin{array}{ll}{B}_b{G}_h{J}_{\ell },& \text{if }x\text{ addresses the coefficient }{\hat{e}}_{b,h,\ell },\\ 0,& \text{if }x\text{ lies outside the }\hat{e}\text{ segment.}\end{array}\text{\hspace{1em}(20)}$$

Then Equation (18) is

$$\boxed{v=\sum _{x\in \{0,1{\}}^{\mu }}w(x)T(x).}\text{\hspace{1em}(21)}$$

This is the evaluation-correctness relation consumed by the later sumcheck protocol. It is already a field-valued linear relation on the committed witness. It therefore needs neither evaluation at $\alpha$ nor a ring-switch quotient. This fact concerns only the scalar opening row. Quotient-free ring checking is a separate method for converting the physical ring equations into field claims. Those equations must still bind the partials to the committed source.

Subring coefficient packing: shorter partials

The evaluation-trace partial $E_b(X)$ retains all $D$ inner coefficients. Subring coefficient packing shortens this partial by contracting one part of the inner axis before the opening digits are formed.

Return now to the general case in which the opening point lies in a field $E$ containing $F$; the interpolation weights $I$, $Q$, and $B$ are then $E$-valued. The case $E=F$ is included. Let

$$k=[E:F].$$

Choose a retained-axis dimension $s$—later also the challenge-subring dimension—and write

$$D=k\eta s.\text{\hspace{1em}(22)}$$

Here $\eta$ is the packing factor. The implementation and specification call this value $h$; this page uses $\eta$ so that it cannot be confused with the opening-digit index already used in the evaluation-trace derivation. Every inner coefficient index has a unique form

$$\ell =u+k\eta j,u\in [k\eta ],j\in [s].\text{\hspace{1em}(23)}$$

Split the inner opening point in the same order:

$$r_{\mathrm{in}}=(r_{\mathrm{pack}},r_{\mathrm{tail}}).$$

The tensor-product interpolation weight therefore factors as

$$I_{u+k\eta j}=I_u^{\mathrm{pack}}{I}_j^{\mathrm{tail}}.\text{\hspace{1em}(24)}$$

The index $u$ is contracted now; $j$ remains explicit. It helps to see this as a two-dimensional coefficient table rather than one flat list. For a fixed block $b$, first apply the position weights and write

$${\varphi }_{b,j,u}:=\sum _p{Q}_{p}f[u+k\eta j,p,b]\in E.$$

The rows are indexed by the coefficient $j$ that will remain in the packed partial. The columns are indexed by $u$, which is consumed now:

The table is not a new witness. It is only a view of the position-folded source coefficients. Contracting one row gives

$$e_{b,j}=\sum _u{I}_u^{\mathrm{pack}}{\varphi }_{b,j,u}=\sum _{p,u}{Q}_p{I}_u^{\mathrm{pack}}f[u+k\eta j,p,b]\in E.\text{\hspace{1em}(25)}$$

For example, take $D=8$, $k=2$, $\eta =2$, and $s=2$. Then $k\eta =4$, so the flat inner coefficients become two rows:

        j = 0:  ell = 0  1  2  3  -> e[b,0]
        j = 1:  ell = 4  5  6  7  -> e[b,1]

Each row is contracted to one element of the degree-two field $E$. The packed partial therefore contains two elements of $E$, or four base-field coordinates, instead of all eight source coefficients.

Substituting Equations (24) and (25) into the original multilinear evaluation gives

$$\begin{array}{rl}v& =\sum _{u,j,p,b}{I}_u^{\mathrm{pack}}{I}_j^{\mathrm{tail}}{Q}_p{B}_{b}f[u+k\eta j,p,b]\\ & =\sum _{b,j}{B}_b{I}_j^{\mathrm{tail}}{e}_{b,j}.\end{array}\text{\hspace{1em}(26)}$$

Thus the early contraction loses no part of the claimed evaluation. It only splits the old inner contraction into two stages: $u$ is consumed while the partial is formed, and $j$ is consumed in the final scalar relation.

Package the retained coefficients as

$$e_b(U)=\sum _{j=0}^{s-1}{e}_{b,j}{U}^j\in C:=E[U]/(U^s+1).\text{\hspace{1em}(27)}$$

The ring $C$ has $s$ coefficients in $E$. Fix the canonical $F$-basis ${\beta }_0,\dots ,{\beta }_{k-1}$ of $E$ and write

$$e_{b,j}=\sum _{t=0}^{k-1}{\beta }_t{e}_{b,t,j},e_{b,t,j}\in F.\text{\hspace{1em}(28)}$$

Consequently one packed partial has $ks=D/\eta$ base-field coordinates, rather than the $D$ coordinates of $E_b(X)$. The basis elements ${\beta }_t$ are fixed by the canonical extension-field representation; they are not transcript challenges or schedule choices.

The next witness stores balanced digits of these base-field coordinates. Use $d$ for the opening-digit index:

$$e_{b,t,j}=\sum _d{G}_d^{\mathrm{open}}{\hat{e}}_{b,d,t,j}.\text{\hspace{1em}(29)}$$

Substituting Equations (28) and (29) into Equation (26) gives the direct packed opening relation

$$\boxed{v=\sum _b{B}_b\sum _j{I}_j^{\mathrm{tail}}\sum _t{\beta }_t\sum _d{G}_d^{\mathrm{open}}{\hat{e}}_{b,d,t,j}.}\text{\hspace{1em}(30)}$$

Read Equation (30) from the inside out. The opening gadget weights rebuild each base-field coordinate $e_{b,t,j}$ from its digits. The basis elements ${\beta }_t$ rebuild the extension-field coefficient $e_{b,j}$. The tail weights consume the retained $j$ rows, and the block weights combine the live blocks. The result is the original scalar opening $v$.

This is an $E$-valued virtual row on the committed digit witness. It is not a ring-matrix row and has no cyclotomic quotient. Claim batching and Stage-2 row batching multiply the displayed weights by additional public scalars, without changing the single-claim identity.

At this scalar layer, the two methods have the same high-level output: a public linear map from the method-selected opening digits to the scalar target. They use different digit geometries and different public maps.

What scalar correctness does not prove

Equations (21) and (30) answer the scalar question under one assumption: the partials $E_b$ or $e_b$ are the correct partial evaluations of the incoming committed polynomial. The equations do not establish that assumption. A prover could otherwise choose unrelated partials that satisfy the scalar equation.

The next chapter supplies the missing source-consistency statement. Rather than check every block independently, Akita samples random fold challenges and batches the blockwise equations into one relation on the folded response $\mathbf{z}$. The two method-dependent shapes are

$$\text{EvaluationTrace:}\sum _b{c}_b{E}_b=\mathrm{Eval}(\mathbf{z}),$$

and

$$\text{SubringCoefficientPacking:}\sum _b{c}_b{e}_b=L(\mathbf{z}).$$

Semantic relations in an Akita fold derives both relations. In particular, it explains why the packing challenges must act only on the retained $j$ axis. Checking ring relations over a field comes later, after this semantic relation and its physical rows are established. Sumcheck stages explains how the method-selected scalar relation is row-batched and fused with the other Stage-2 terms.

Opening-method code reference

Evaluation trace

This subsection applies when the schedule selects EvaluationTrace. A fold that selects SubringCoefficientPacking uses the coefficient-packing flow in the following subsection instead.

The CPU backend performs the private opening arithmetic. The base-field path follows the reduction above:

1. Prepare the opening weights. prepare_opening_point constructs $Q_p$, $B_b$, and $P$.
2. Evaluate the ring polynomial. evaluate_claims_at_prepared_point returns the position-folded rings $E_b$ and the temporary ring $Y$.
3. Recover the scalar evaluation. scalar_opening_from_folded_ring computes ${\mathrm{TraceOpen}}_P(Y)$.
4. Prepare the trace factors. prepare_evaluation_trace_group_parameters prepares the block point underlying $B_b$, the gadget weights $G_h$, and the inner trace weights $J_{\ell }$.
5. Construct the trace weights. build_evaluation_trace_weights combines those factors with the claim coefficients and physical $\hat{e}$ locations to construct $T(x)$.
6. Fuse the Stage-2 relation. accumulate_fused_relation_linear_signed adds the prepared linear relation to the fused Stage-2 sumcheck.

PreparedFold::relation_groups retains one method-selected point and the scalar openings for each group as PreparedRelationGroupPublic metadata. For evaluation trace, PreparedRelationGroupPublic::kind() gives the prepared $P$, $Q$, and $B$ factors. PreparedFold::witness_handle is an opaque handle to the backend-owned digit witness. Protocol orchestration can use the public weights but cannot inspect the private opening digits through that handle.

The main data flow is:

opening point r
      |
      v
PreparedOpeningPoint: weights Q_p, B_b, P
      |
      v
OpeningFoldOutput
|-- folded: [E_b] -- digit decomposition --> e_hat in witness w
`-- eval: Y ------- TraceOpen_P ----------> v_tr
                                                  |
                                                  v
PreparedFold
|-- evaluation_trace_claim: v_tr
|-- relation_groups: method-selected points and scalar openings
|-- evaluation_trace_claim_coefficients: c_q
`-- witness_handle: opaque backend-owned digit witness
      |
      v
prepare_evaluation_trace_group_parameters
      |
      `-- public factors B_b, G_h, J_l
                         |
                         v
build_evaluation_trace_weights
      |
      `-- T(x) on the committed e_hat segment
                         |
                         v
accumulate_fused_relation_linear
      |
      `-- Stage 2 proves v_tr = sum_x w(x) T(x)

In the base-field case, calling as_base() on PreparedOpeningPoint::ring_multiplier_point returns Some(base_point). The table uses base_point for the contained RingOpeningPoint reference.

The main values are:

The temporary ring $Y$ is used only to compute $v_{\mathrm{tr}}$; it is not stored in PreparedFold or sent to the verifier. Stage 2 instead proves

$$v_{\mathrm{tr}}=\sum _{x}w(x)T(x)$$

directly from the committed digit witness.

Subring coefficient packing

The implementation follows the same derivation in three stages:

1. Prepare the point. PreparedSubringCoefficientPackingPoint checks $D=k\eta s$ and prepares the packing, tail, position, and block weights.
2. Pack and bind the partials. The prover contracts the $p$ and $u$ axes to obtain the coordinates $e_{b,t,j}$ in [block][extension coordinate][subring coefficient] order. It recombines those coordinates as in Equation (30), then binds their digit decompositions before sampling the fold challenges.
3. Fold and verify. fold_coefficient_packing_group folds the packed partials and produces $Q_{\mathrm{pack}}$. Stage 2 then checks both the packing relation and the direct scalar opening, using ${\beta }_t{I}_j^{\mathrm{tail}}$ to rebuild each extension-valued coefficient.

The reference tests in coefficient_packing_fold_tests.rs compare the direct partial and scalar formulas with the flat factorization. The Stage-2 tests in coefficient_packing_relation_tests.rs check the expanded prover terms and that every extension-coordinate plane is bound. The verifier tests in coefficient_packing_relation/tests.rs compare the compact evaluation with dense oracles built from those expanded terms.

Base-field polynomial at an extension-field point

The scheduled opening method determines this case.

With EvaluationTrace, Akita does not treat a base-field multilinear polynomial as an ordinary extension-valued opening of the same arity. It first runs the extension-opening reduction. The low ${\log }_2[\mathbb{E}:\mathbb{F}]$ variables are packed into extension-field coefficients, and one degree-two tensor sumcheck reduces the original claim to a claim on that packed polynomial with fewer variables. The reduced claim then enters the evaluation trace. The trace represents its extension weights by canonical subfield coordinates, and the verifier rejects invalid shapes, coordinate counts, and noncanonical images before using them. Configurations with $[\mathbb{E}:\mathbb{F}]=1$ skip this reduction.

With SubringCoefficientPacking, Akita keeps one coefficient axis in the challenge subring, contracts the other axes over the extension field, and binds the original scalar opening directly in Stage 2 without EOR. The derivation is in Subring coefficient packing: shorter partials; Fold path and field geometry states the schedule boundary.