Block-dependent folding order for recurring per-block costs

Construct a variant of the keyed preprocessing approach in which the folding order depends on the block, and establish whether this restores a recurring per-block proving cost proportional to the trace length rather than shifting the non-amortizable cost to registration.

Background

The main TRACE construction folds the execution trace against a shared all-ones vector, while a proposed preprocessing variant derives the folded vector from each registered identity’s key. Because that vector is fixed at registration, an operator can precompute the block-independent portions of the proof for each identity.

This preprocessing reduces recurring secret-side work to approximately $\tilde O(N^{2/3})$ per block while imposing a one-time per-identity charge of approximately $\tilde O(N^{4/3})$. The paper leaves unresolved whether making the folding order depend on the block can prevent this preprocessing and recover a recurring cost tied more closely to the trace length.