Verifier profiling

.circleci/config.yml

@@ -1285,6 +1285,7 @@ workflows:
       or pipeline.git.branch == "canary"
       or pipeline.git.branch == "testnet"
       or pipeline.git.branch == "mainnet"
+      or pipeline.git.branch == "profile_verifier_multirecord"
     jobs:
       - check-unused-dependencies # This can be cleaned up before releases
       - check-cargo-semver-checks # This can be cleaned up before releases

.gitignore

@@ -5,7 +5,9 @@
 **storage_db
 **/*.prover.*
 **/*.verifier.*
+**/varuna_verifier_artifacts/
 *.usrs
+flamegraph.svg
 !**/powers-of-beta-15.usrs*
 !**/shifted-powers-of-beta-15.usrs*
 !**/powers-of-beta-16.usrs*

Cargo.toml

@@ -171,6 +171,7 @@ dev-print = [
   "snarkvm-utilities/dev-print",
   "snarkvm-algorithms/dev-print",
   "snarkvm-circuit/dev-print",
+  "snarkvm-console/dev-print",
   "snarkvm-curves/dev-print",
   "snarkvm-fields/dev-print",
   "snarkvm-parameters/dev-print",

algorithms/Cargo.toml

@@ -45,6 +45,12 @@ path = "benches/snark/varuna.rs"
 harness = false
 required-features = [ "test" ]
 
+[[bench]]
+name = "varuna_verifier"
+path = "benches/snark/varuna_verifier.rs"
+harness = false
+required-features = [ "test" ]
+
 [dependencies.snarkvm-curves]
 workspace = true
 

algorithms/benches/snark/varuna.rs

@@ -229,6 +229,86 @@ fn snark_batch_verify(c: &mut Criterion) {
     });
 }
 
+fn snark_batch_verify_scaling(c: &mut Criterion) {
+    let rng = &mut TestRng::default();
+
+    let batch_specs = vec![
+        // [many x (batch_size, num_constraints, num_variables, num_public_inputs)])
+        vec![(1, 10_000, 5_000, 16)],
+        vec![(1, 50_000, 25_000, 64)],
+        vec![(30, 50_000, 25_000, 64)],
+        vec![(30, 50_000, 25_000, 64), (1, 5_000_000, 5_000_000, 1024)],
+    ];
+
+    let max_vars = *batch_specs
+        .iter()
+        .map(|batches| batches.iter().map(|(_, _, num_variables, _)| num_variables).max().unwrap())
+        .max()
+        .unwrap();
+    let max_constraints = *batch_specs
+        .iter()
+        .map(|batches| batches.iter().map(|(_, num_constraints, _, _)| num_constraints).max().unwrap())
+        .max()
+        .unwrap();
+    let max_density = 2 * max_constraints;
+
+    let max_degree = AHPForR1CS::<Fr, VarunaHidingMode>::max_degree(max_constraints, max_vars, max_density).unwrap();
+    let universal_srs = VarunaInst::universal_setup(max_degree).unwrap();
+    let universal_prover = &universal_srs.to_universal_prover().unwrap();
+    let universal_verifier = &universal_srs.to_universal_verifier().unwrap();
+    let fs_parameters = FS::sample_parameters();
+
+    let varuna_version = VarunaVersion::V3;
+
+    for batch_spec in batch_specs {
+        let batch_str = batch_spec
+            .iter()
+            .map(|(batch_size, num_constraints, _, num_public_inputs)| {
+                format!("({batch_size} x [{num_public_inputs}, {num_constraints}])")
+            })
+            .collect::<Vec<_>>()
+            .join(" + ");
+
+        let circuits_and_inputs = batch_spec
+            .iter()
+            .map(|&batch| {
+                let (batch_size, num_constraints, num_variables, num_public_inputs) = batch;
+                let (circuit, public_inputs) =
+                    TestCircuit::gen_rand(num_public_inputs, num_constraints, num_variables, rng);
+                (
+                    VarunaInst::circuit_setup(&universal_srs, &circuit).unwrap(),
+                    vec![circuit; batch_size],
+                    vec![public_inputs; batch_size],
+                )
+            })
+            .collect::<Vec<_>>();
+
+        let pks_to_circuits = circuits_and_inputs
+            .iter()
+            .map(|((pk, _), circuits, _)| (pk, circuits.as_slice()))
+            .collect::<BTreeMap<_, _>>();
+        let vks_to_inputs =
+            circuits_and_inputs.iter().map(|((_, vk), _, inputs)| (vk, inputs.as_slice())).collect::<BTreeMap<_, _>>();
+
+        let proof =
+            VarunaInst::prove_batch(universal_prover, &fs_parameters, varuna_version, &pks_to_circuits, rng).unwrap();
+
+        c.bench_function(&format!("snark_batch_verify_scaling/{batch_str}"), |b| {
+            b.iter(|| {
+                let verification = VarunaInst::verify_batch(
+                    universal_verifier,
+                    &fs_parameters,
+                    varuna_version,
+                    &vks_to_inputs,
+                    &proof,
+                )
+                .unwrap();
+                assert!(verification);
+            });
+        });
+    }
+}
+
 fn snark_vk_serialize(c: &mut Criterion) {
     use snarkvm_utilities::serialize::Compress;
     let mut group = c.benchmark_group("snark_vk_serialize");
@@ -344,7 +424,7 @@ fn snark_certificate_verify(c: &mut Criterion) {
 criterion_group! {
     name = varuna_snark;
     config = Criterion::default().measurement_time(Duration::from_secs(10));
-    targets = snark_universal_setup, snark_circuit_setup, snark_prove, snark_verify, snark_batch_prove, snark_batch_verify, snark_vk_serialize, snark_vk_deserialize, snark_certificate_prove, snark_certificate_verify,
+    targets = snark_universal_setup, snark_circuit_setup, snark_prove, snark_verify, snark_batch_prove, snark_batch_verify, snark_batch_verify_scaling, snark_vk_serialize, snark_vk_deserialize, snark_certificate_prove, snark_certificate_verify,
 }
 
 criterion_main!(varuna_snark);

algorithms/benches/snark/varuna_verifier.rs

@@ -0,0 +1,187 @@
+// Copyright (c) 2019-2026 Provable Inc.
+// This file is part of the snarkVM library.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at:
+
+// http://www.apache.org/licenses/LICENSE-2.0
+
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+/*
+Performs time measurements on the verification of test circuits with selected batch sizes and parameters.
+ - Generate artifacts with:
+   cargo bench --bench varuna_verifier --features test -- --generate
+ - Artifacts are ignored by git. To clean them, run:
+   cargo bench --bench varuna_verifier --features test -- --clean
+ - Obtain time measurements (using previously generated artifacts) with:
+   cargo bench --bench varuna_verifier --features test
+   The --serial feature can be added to deactivate parallelism.
+ - Flamegraph (on previously generated artifacts) with:
+   cargo flamegraph --bench varuna_verifier --features="test, serial"
+*/
+
+use snarkvm_algorithms::{
+    AlgebraicSponge,
+    SNARK,
+    crypto_hash::PoseidonSponge,
+    snark::varuna::{
+        CircuitVerifyingKey,
+        Proof,
+        TestCircuit,
+        VarunaHidingMode,
+        VarunaSNARK,
+        VarunaVersion,
+        ahp::AHPForR1CS,
+    },
+};
+use snarkvm_curves::bls12_377::{Bls12_377, Fq, Fr};
+use snarkvm_utilities::{CanonicalDeserialize, CanonicalSerialize, FromBytes, TestRng, ToBytes};
+
+use std::{collections::BTreeMap, env, path::Path, time::Instant};
+
+type VarunaInst = VarunaSNARK<Bls12_377, FS, VarunaHidingMode>;
+type FS = PoseidonSponge<Fq, 2, 1>;
+
+fn main() {
+    /////////////////////////// User defined
+
+    // How many times `verify_batch` runs when not using `--generate`. Larger values
+    // help flamegraph / timing stability.
+    let n_samples = 10;
+
+    // Each tuple is: (batch_size, num_constraints, num_variables,
+    // num_public_inputs)
+    let batches = [(30, 50_000, 25_000, 64), (1, 5_000_000, 5_000_000, 1024)];
+
+    ///////////////////////////
+
+    let generate = env::args().any(|arg| arg == "--generate");
+    let clean = env::args().any(|arg| arg == "--clean");
+    let artifact_path = Path::new(env!("CARGO_MANIFEST_DIR")).join("benches/snark/varuna_verifier_artifacts");
+
+    if clean {
+        if generate {
+            panic!(
+                "--clean and --generate cannot be used together. Use --generate to generate\\
+                the artifacts, --clean to delete them (and end), and neither to use the existing artifacts."
+            );
+        }
+        std::fs::remove_dir_all(&artifact_path).unwrap();
+        println!("Artifacts deleted.");
+        return;
+    }
+
+    if !artifact_path.exists() {
+        if !generate {
+            panic!("--generate was not passed, but artifacts were not found.");
+        }
+        std::fs::create_dir(&artifact_path).unwrap();
+    }
+
+    let rng = &mut TestRng::default();
+
+    let max_vars = *batches.iter().map(|(_, _, num_variables, _)| num_variables).max().unwrap();
+    let max_constraints = *batches.iter().map(|(_, num_constraints, _, _)| num_constraints).max().unwrap();
+    let max_density = 2 * max_constraints;
+
+    let max_degree = AHPForR1CS::<Fr, VarunaHidingMode>::max_degree(max_constraints, max_vars, max_density).unwrap();
+    let universal_srs = VarunaInst::universal_setup(max_degree).unwrap();
+    let universal_prover = &universal_srs.to_universal_prover().unwrap();
+    let universal_verifier = &universal_srs.to_universal_verifier().unwrap();
+    let fs_parameters = FS::sample_parameters();
+
+    let varuna_version = VarunaVersion::V3;
+
+    let batch_str = batches
+        .iter()
+        .map(|(batch_size, num_constraints, _, num_public_inputs)| {
+            format!("({batch_size} x [{num_public_inputs}, {num_constraints}])")
+        })
+        .collect::<Vec<_>>()
+        .join(" + ");
+
+    println!("Batches: {batch_str}");
+
+    let sanitized_batch_str = batch_str.replace(' ', "_");
+
+    let vk_path = artifact_path.join(format!("vk_{sanitized_batch_str}.bin"));
+    let inputs_path = artifact_path.join(format!("inputs_{sanitized_batch_str}.bin"));
+    let proof_path = artifact_path.join(format!("proof_{sanitized_batch_str}.bin"));
+
+    if generate {
+        println!("Generating artifacts for {batch_str}...");
+
+        let circuits_and_inputs: Vec<_> = batches
+            .iter()
+            .map(|&batch| {
+                let (batch_size, num_constraints, num_variables, num_public_inputs) = batch;
+                let (circuit, public_inputs) =
+                    TestCircuit::gen_rand(num_public_inputs, num_constraints, num_variables, rng);
+                (
+                    VarunaInst::circuit_setup(&universal_srs, &circuit).unwrap(),
+                    vec![circuit; batch_size],
+                    vec![public_inputs; batch_size],
+                )
+            })
+            .collect();
+
+        let pks_to_circuits = circuits_and_inputs
+            .iter()
+            .map(|((pk, _), circuits, _)| (pk, circuits.as_slice()))
+            .collect::<BTreeMap<_, _>>();
+        let vks_to_inputs =
+            circuits_and_inputs.iter().map(|((_, vk), _, inputs)| (vk, inputs.as_slice())).collect::<BTreeMap<_, _>>();
+
+        let proof =
+            VarunaInst::prove_batch(universal_prover, &fs_parameters, varuna_version, &pks_to_circuits, rng).unwrap();
+
+        let vks = vks_to_inputs.keys().map(|vk| (*vk).clone()).collect::<Vec<_>>();
+        let inputs = vks_to_inputs.values().cloned().collect::<Vec<_>>();
+
+        let mut vk_buf = Vec::new();
+        CanonicalSerialize::serialize_uncompressed(&vks, &mut vk_buf).unwrap();
+        std::fs::write(&vk_path, vk_buf).expect("Failed to write verifying keys");
+        let mut inputs_buf = Vec::new();
+        CanonicalSerialize::serialize_uncompressed(&inputs, &mut inputs_buf).unwrap();
+        std::fs::write(&inputs_path, inputs_buf).expect("Failed to write inputs");
+        std::fs::write(&proof_path, proof.to_bytes_le().unwrap()).expect("Failed to write proof");
+    }
+
+    // Reload from disk so serialization and verification paths are exercised.
+    let vks: Vec<CircuitVerifyingKey<Bls12_377>> = CanonicalDeserialize::deserialize_uncompressed(
+        &*std::fs::read(&vk_path).expect("Failed to read verifying keys"),
+    )
+    .unwrap();
+    let inputs: Vec<Vec<Vec<Fr>>> =
+        CanonicalDeserialize::deserialize_uncompressed(&*std::fs::read(&inputs_path).expect("Failed to read inputs"))
+            .unwrap();
+    let proof = Proof::<Bls12_377>::read_le(&*std::fs::read(&proof_path).expect("Failed to read proof")).unwrap();
+    let vks_to_inputs: BTreeMap<_, _> = vks.iter().zip(inputs.iter()).map(|(vk, inp)| (vk, inp.as_slice())).collect();
+
+    if generate {
+        println!("Verifying generated proof for {batch_str}...");
+        assert!(
+            VarunaInst::verify_batch(universal_verifier, &fs_parameters, varuna_version, &vks_to_inputs, &proof)
+                .unwrap()
+        );
+        println!("Verification successful");
+    } else {
+        println!("Verifying proof for {batch_str} {n_samples} times...");
+        let timer = Instant::now();
+        for _ in 0..n_samples {
+            assert!(
+                VarunaInst::verify_batch(universal_verifier, &fs_parameters, varuna_version, &vks_to_inputs, &proof)
+                    .unwrap()
+            );
+        }
+        let elapsed = timer.elapsed().as_micros() as f64 / 1000.0;
+        let elapsed_avg = elapsed / n_samples as f64;
+        println!("Verification successful in {elapsed:.2} ms ({elapsed_avg:.2} ms per sample)");
+    }
+}

algorithms/src/crypto_hash/poseidon.rs

@@ -219,14 +219,17 @@ impl<F: PrimeField, const RATE: usize> PoseidonSponge<F, RATE, 1> {
 
     #[inline]
     fn apply_s_box(&mut self, is_full_round: bool) {
+        let pow_alpha_in_place: fn(&mut F) = match self.parameters.alpha {
+            3 => pow_3_in_place,
+            5 => pow_5_in_place,
+            17 => pow_17_in_place,
+            alpha => panic!("No optimized S-box for alpha = {alpha}"),
+        };
+
         if is_full_round {
-            // Full rounds apply the S Box (x^alpha) to every element of state
-            for elem in self.state.iter_mut() {
-                *elem = elem.pow([self.parameters.alpha]);
-            }
+            self.state.iter_mut().for_each(pow_alpha_in_place);
         } else {
-            // Partial rounds apply the S Box (x^alpha) to just the first element of state
-            self.state[0] = self.state[0].pow([self.parameters.alpha]);
+            pow_alpha_in_place(&mut self.state[0]);
         }
     }
 
@@ -501,3 +504,31 @@ impl<F: PrimeField, const RATE: usize> PoseidonSponge<F, RATE, 1> {
         dest_elements
     }
 }
+
+// S-box functions to raise state elements to the values of alpha present in the
+// codebase: 3, 5 and 17. These are more performant than the general pow
+// function.
+#[inline]
+fn pow_3_in_place<F: PrimeField>(val: &mut F) {
+    let val_copy = *val;
+    val.square_in_place();
+    val.mul_assign(val_copy);
+}
+
+#[inline]
+fn pow_5_in_place<F: PrimeField>(val: &mut F) {
+    let val_copy = *val;
+    val.square_in_place();
+    val.square_in_place();
+    val.mul_assign(val_copy);
+}
+
+#[inline]
+fn pow_17_in_place<F: PrimeField>(val: &mut F) {
+    let val_copy = *val;
+    val.square_in_place();
+    val.square_in_place();
+    val.square_in_place();
+    val.square_in_place();
+    val.mul_assign(val_copy);
+}