Polynomial Multiproofs: Multi-Claim Verification

• Polynomial Multiproofs (PMP) are proof systems that aggregate multiple claims into one concise verification protocol, with applications in quantum complexity, batch evaluation, and blockchain data availability.
• A key insight is that PMP constructions compress many outputs into a single univariate polynomial proof, reducing verification complexity and lowering computational and communication overhead.
• The research highlights trade-offs and open questions regarding soundness, proof-length efficiency, and the potential for multiprover advantages across diverse application domains.

Searching arXiv for recent and foundational papers on “Polynomial Multiproofs” and closely related usages. Polynomial Multiproofs (PMP) is a term used in several technically distinct lines of research to denote proof-system constructions that handle multiple claims in a single formal framework. In one usage, PMP refers to the landscape of quantum Merlin–Arthur variants with polynomially many unentangled proofs, as studied under the heading of “polynomially many provers” and summarized as “QMA variants with polynomially many Merlins” (Gharibian et al., 2011). In a second usage, PMP denotes a non-interactive Merlin–Arthur proof for batch evaluation of an arithmetic circuit on many inputs, where a single univariate polynomial “sketch” certifies $K$ evaluations at once (Williams, 2016). In a third usage, PMP designates aggregated polynomial-opening proofs for Kate–Zaverucha–Goldberg commitments in blockchain light clients, where multiple sampled cell evaluations are verified using a single aggregated proof over a shared evaluation micro-domain (Srivastava et al., 17 Apr 2026). The common theme is multiplicity: many witnesses, many evaluation claims, or many data-availability samples are compressed into a verifier-efficient proof structure.

1. Terminological scope and research contexts

The term does not denote a single universally standardized primitive. Rather, the arXiv literature represented here uses it in at least three settings: complexity theory of unentangled quantum proofs, Merlin–Arthur proofs for multipoint arithmetic circuit evaluation, and polynomial-commitment aggregation for data availability sampling (Gharibian et al., 2011, Williams, 2016, Srivastava et al., 17 Apr 2026).

In the quantum-complexity setting, the central object is the class $QMA(poly)=\bigcup_{m\in poly}QMA(m)$, where a verifier receives polynomially many unentangled quantum proofs. The terminology “polynomial multiproofs” is used to organize subclasses such as $QMA_{log}(poly)$, $BellQMA(poly)$, and $SepQMA(m)$, together with collapse and repetition theorems that delimit their expressive power (Gharibian et al., 2011).

In the batch-evaluation setting, PMP is explicitly formulated as a one-message protocol for Multipoint Arithmetic Circuit Evaluation. Merlin sends a proof string $\pi$ of length $\widetilde O(K\cdot d)$, and Arthur verifies all $K$ claimed evaluations in time $\widetilde O(K\cdot(n+d)+s)$ with soundness error at most $\varepsilon$ (Williams, 2016). Here “multiproof” means that one proof string certifies many outputs.

In the blockchain setting, PMP is a mechanism for reducing the cost of attaching one proof to each sampled cell in data availability sampling. The construction replaces many independent KZG openings by one aggregated proof $QMA(poly)=\bigcup_{m\in poly}QMA(m)$0 over a shared micro-domain, with the stated goal of lowering proof bytes, verifier CPU and memory usage, and deployment-level infrastructure cost (Srivastava et al., 17 Apr 2026).

A common misconception is that PMP always refers to cryptographic polynomial-opening aggregation. The literature here shows that the same phrase also names a complexity-theoretic program around polynomially many Merlins and an unconditional MA proof system for batch evaluation. This suggests that the most precise interpretation of PMP is context-dependent rather than canonical.

2. Polynomially many quantum proofs

The quantum-complexity formulation begins with promise problems $QMA(poly)=\bigcup_{m\in poly}QMA(m)$1 and completeness–soundness parameters $QMA(poly)=\bigcup_{m\in poly}QMA(m)$2 such that $QMA(poly)=\bigcup_{m\in poly}QMA(m)$3. For functions $QMA(poly)=\bigcup_{m\in poly}QMA(m)$4, a promise problem lies in $QMA(poly)=\bigcup_{m\in poly}QMA(m)$5 if there is a uniform family of quantum circuits $QMA(poly)=\bigcup_{m\in poly}QMA(m)$6 such that $QMA(poly)=\bigcup_{m\in poly}QMA(m)$7 takes input $QMA(poly)=\bigcup_{m\in poly}QMA(m)$8 together with $QMA(poly)=\bigcup_{m\in poly}QMA(m)$9 unentangled quantum proofs $QMA_{log}(poly)$0, each on $QMA_{log}(poly)$1 qubits, and satisfies the usual completeness and soundness conditions. Writing $QMA_{log}(poly)$2, one has $QMA_{log}(poly)$3 (Gharibian et al., 2011).

Several subclasses are singled out. $QMA_{log}(poly)$4 (also called $QMA_{log}(poly)$5) replaces the quantum witness by a single classical string $QMA_{log}(poly)$6. $QMA_{log}(poly)$7 restricts each of the polynomially many proofs to length $QMA_{log}(poly)$8 qubits. $QMA_{log}(poly)$9 is defined by a verifier that first performs local, nonadaptive POVMs $BellQMA(poly)$0, one per proof register, obtaining classical outcomes $BellQMA(poly)$1, and then runs an efficient quantum circuit on $BellQMA(poly)$2. $BellQMA(poly)$3 is the subclass in which the verifier’s accept-POVM element $BellQMA(poly)$4 is fully separable across the $BellQMA(poly)$5 proof registers (Gharibian et al., 2011).

Three structural theorems organize this PMP landscape. First, $BellQMA(poly)$6. The proof sketch states that a classical proof can be embedded bitwise into one-qubit states, while in the reverse direction a classical witness can describe each $BellQMA(poly)$7-qubit state to inverse-exponential precision, after which the verifier uses Solovay–Kitaev to prepare the states and relies on trace-norm continuity to preserve the $BellQMA(poly)$8 completeness–soundness gap (Gharibian et al., 2011). The key continuity lemma is

$BellQMA(poly)$9

Second, for polynomially bounded $SepQMA(m)$0 and $SepQMA(m)$1, $SepQMA(m)$2, and since $SepQMA(m)$3, one concludes $SepQMA(m)$4. The stated simulation uses a single-prover QMA witness composed of a classical consistency-check register $SepQMA(m)$5, encoding the alleged measurement distributions $SepQMA(m)$6, together with a quantum register $SepQMA(m)$7 holding polynomially many copies of each original proof $SepQMA(m)$8. The verifier measures $SepQMA(m)$9 in the computational basis, checks normalization, performs random local checks against the empirical frequencies in $\pi$0 using a Chernoff bound, and then simulates Stage 2 of the original BellQMA protocol (Gharibian et al., 2011).

Third, $\pi$1 satisfies perfect parallel repetition: if a protocol has accept-probability $\pi$2, then its $\pi$3-fold parallel repetition has acceptance probability exactly $\pi$4, even if the proofs across the $\pi$5 copies are globally entangled. The argument is presented via cone programming duality. The primal optimization is

$\pi$6

with dual

$\pi$7

The proof uses strong duality and the tensor-product closure property

$\pi$8

to show multiplicativity of the optimum under repetition (Gharibian et al., 2011).

The complexity-theoretic significance is stated explicitly: short quantum proofs collapse to the classical-proof class $\pi$9; Bell-style local unentangled measurements with polynomially many outcomes do not exceed $\widetilde O(K\cdot d)$0; and separable-accept protocols admit exact multiplicative repetition (Gharibian et al., 2011). A plausible implication is that any genuine multiprover advantage inside $\widetilde O(K\cdot d)$1 must lie outside these natural subclasses.

3. Non-interactive batch-evaluation PMP

In the Merlin–Arthur setting, PMP is formulated for Multipoint Arithmetic Circuit Evaluation. Let $\widetilde O(K\cdot d)$2 be a finite field, let

$\widetilde O(K\cdot d)$3

be an arithmetic circuit of size $\widetilde O(K\cdot d)$4 and total degree at most $\widetilde O(K\cdot d)$5, and let $\widetilde O(K\cdot d)$6. The main theorem states that there is a one-message protocol in which Merlin sends a proof string of length $\widetilde O(K\cdot d)$7, Arthur tosses $\widetilde O(K\cdot d)$8 coins, runs in time $\widetilde O(K\cdot d)$9, and outputs the vector $K$0 with completeness $K$1 and soundness error at most $K$2 (Williams, 2016).

The prover’s construction begins by choosing an extension field $K$3, where

$K$4

A set $K$5 of size $K$6 is fixed and put in bijection with the evaluation points $K$7, written $K$8. For each coordinate $K$9, Merlin interpolates a univariate polynomial $\widetilde O(K\cdot(n+d)+s)$0 of degree at most $\widetilde O(K\cdot(n+d)+s)$1 such that $\widetilde O(K\cdot(n+d)+s)$2. He then defines

$\widetilde O(K\cdot(n+d)+s)$3

Because $\widetilde O(K\cdot(n+d)+s)$4 and each $\widetilde O(K\cdot(n+d)+s)$5 has degree at most $\widetilde O(K\cdot(n+d)+s)$6, the resulting degree bound is $\widetilde O(K\cdot(n+d)+s)$7, and by construction $\widetilde O(K\cdot(n+d)+s)$8 for all $\widetilde O(K\cdot(n+d)+s)$9. Merlin sends the coefficient vector of a polynomial

$\varepsilon$0

claimed to equal $\varepsilon$1, so the proof string is

$\varepsilon$2

This is why the protocol is characterized as a non-interactive PMP: a single polynomial of degree $\varepsilon$3 certifies $\varepsilon$4 output claims at once (Williams, 2016).

Arthur reconstructs the extension field, recomputes the interpolants $\varepsilon$5, samples a random $\varepsilon$6, evaluates $\varepsilon$7 by Horner’s method, evaluates $\varepsilon$8, and rejects if the two values differ. If the test passes, Arthur outputs $\varepsilon$9 by fast multipoint evaluation. Soundness follows from polynomial identity testing: if $QMA(poly)=\bigcup_{m\in poly}QMA(m)$00, then $QMA(poly)=\bigcup_{m\in poly}QMA(m)$01, so

$QMA(poly)=\bigcup_{m\in poly}QMA(m)$02

The cost breakdown listed for verification is: interpolating $QMA(poly)=\bigcup_{m\in poly}QMA(m)$03 in $QMA(poly)=\bigcup_{m\in poly}QMA(m)$04, evaluating the $QMA(poly)=\bigcup_{m\in poly}QMA(m)$05 in $QMA(poly)=\bigcup_{m\in poly}QMA(m)$06, evaluating the circuit in $QMA(poly)=\bigcup_{m\in poly}QMA(m)$07, Horner evaluation of $QMA(poly)=\bigcup_{m\in poly}QMA(m)$08 in $QMA(poly)=\bigcup_{m\in poly}QMA(m)$09, and multipoint evaluation in $QMA(poly)=\bigcup_{m\in poly}QMA(m)$10, yielding overall $QMA(poly)=\bigcup_{m\in poly}QMA(m)$11 (Williams, 2016).

The authors contrast this PMP with several prior directions: classical multipoint evaluation algorithms for restricted circuit classes, multi-round sum-check interactive proofs, Aaronson–Wigderson protocols for inner products, and cryptographic verifiable computation using heavy PCP machinery or cryptographic assumptions. The stated distinguishing features are that the protocol is unconditionally secure, one-round, applies to all low-degree arithmetic circuits, and attains proof length $QMA(poly)=\bigcup_{m\in poly}QMA(m)$12 with verification time $QMA(poly)=\bigcup_{m\in poly}QMA(m)$13 (Williams, 2016).

The same framework is then applied to the Permanent, $QMA(poly)=\bigcup_{m\in poly}QMA(m)$14Circuit-SAT, counting Hamiltonian cycles, orthogonal vectors, Hamming nearest neighbors, and $QMA(poly)=\bigcup_{m\in poly}QMA(m)$15-cliques, using standard arithmetization or inclusion–exclusion reductions spelled out in the source summary (Williams, 2016). This suggests that, in this usage, PMP functions less as a standalone cryptographic primitive than as a general-purpose certification method for batch algebraic computation.

4. KZG-based polynomial multiproofs for data availability sampling

In blockchain light clients, PMP is studied as an optimization for data availability sampling based on Kate–Zaverucha–Goldberg polynomial commitments. The underlying KZG commitment scheme is specified by an SRS generated from a secret $QMA(poly)=\bigcup_{m\in poly}QMA(m)$16, publishing

$QMA(poly)=\bigcup_{m\in poly}QMA(m)$17

For a polynomial $QMA(poly)=\bigcup_{m\in poly}QMA(m)$18 of degree at most $QMA(poly)=\bigcup_{m\in poly}QMA(m)$19, the commitment is

$QMA(poly)=\bigcup_{m\in poly}QMA(m)$20

A single-point opening at $QMA(poly)=\bigcup_{m\in poly}QMA(m)$21 with claimed value $QMA(poly)=\bigcup_{m\in poly}QMA(m)$22 uses witness polynomial

$QMA(poly)=\bigcup_{m\in poly}QMA(m)$23

proof $QMA(poly)=\bigcup_{m\in poly}QMA(m)$24, and verification equation

$QMA(poly)=\bigcup_{m\in poly}QMA(m)$25

These details provide the baseline against which PMP is introduced (Srivastava et al., 17 Apr 2026).

The stated bottleneck is that in data availability sampling, a client samples $QMA(poly)=\bigcup_{m\in poly}QMA(m)$26 random cells from an erasure-coded $QMA(poly)=\bigcup_{m\in poly}QMA(m)$27 grid to gain at least $QMA(poly)=\bigcup_{m\in poly}QMA(m)$28 assurance that the full block is available, and modern schemes attach one KZG proof per sampled cell. If $QMA(poly)=\bigcup_{m\in poly}QMA(m)$29–$QMA(poly)=\bigcup_{m\in poly}QMA(m)$30, this yields $QMA(poly)=\bigcup_{m\in poly}QMA(m)$31–$QMA(poly)=\bigcup_{m\in poly}QMA(m)$32 independent proofs per block, with costs summarized as bandwidth and storage $QMA(poly)=\bigcup_{m\in poly}QMA(m)$33 bytes$QMA(poly)=\bigcup_{m\in poly}QMA(m)$34, verification cost $QMA(poly)=\bigcup_{m\in poly}QMA(m)$35 pairings and scalar multiplications, and DHT object explosion from many small objects (Srivastava et al., 17 Apr 2026).

The PMP construction aggregates multiple opening claims $QMA(poly)=\bigcup_{m\in poly}QMA(m)$36 into a single proof $QMA(poly)=\bigcup_{m\in poly}QMA(m)$37. In the random-linear-combination approach, a challenge

$QMA(poly)=\bigcup_{m\in poly}QMA(m)$38

is derived via Fiat–Shamir, and the aggregate witness polynomial is defined as

$QMA(poly)=\bigcup_{m\in poly}QMA(m)$39

The aggregated proof is

$QMA(poly)=\bigcup_{m\in poly}QMA(m)$40

The description then gives a corresponding aggregated verification equation and notes an equivalent derivation using bilinearity and linearity of exponents (Srivastava et al., 17 Apr 2026).

For data availability sampling, the critical specialization is the evaluation micro-domain $QMA(poly)=\bigcup_{m\in poly}QMA(m)$41, a small subset of row or column positions. Its vanishing polynomial is

$QMA(poly)=\bigcup_{m\in poly}QMA(m)$42

Under the “shared-point specialization (Boneh et al. first scheme),” all openings use $QMA(poly)=\bigcup_{m\in poly}QMA(m)$43, causing the denominators to collapse to $QMA(poly)=\bigcup_{m\in poly}QMA(m)$44. If $QMA(poly)=\bigcup_{m\in poly}QMA(m)$45 interpolates the $QMA(poly)=\bigcup_{m\in poly}QMA(m)$46 evaluations of $QMA(poly)=\bigcup_{m\in poly}QMA(m)$47 in block $QMA(poly)=\bigcup_{m\in poly}QMA(m)$48 over $QMA(poly)=\bigcup_{m\in poly}QMA(m)$49, then the specialized witness is

$QMA(poly)=\bigcup_{m\in poly}QMA(m)$50

The source emphasizes that this avoids per-row interpolation at the prover: compute a weighted sum of commitments minus weighted evaluations, then divide once by $QMA(poly)=\bigcup_{m\in poly}QMA(m)$51 (Srivastava et al., 17 Apr 2026).

The light-client verification algorithm takes as input commitment identifiers $QMA(poly)=\bigcup_{m\in poly}QMA(m)$52, an $QMA(poly)=\bigcup_{m\in poly}QMA(m)$53, the micro-domain $QMA(poly)=\bigcup_{m\in poly}QMA(m)$54, and sampled coordinates $QMA(poly)=\bigcup_{m\in poly}QMA(m)$55. The verifier derives $QMA(poly)=\bigcup_{m\in poly}QMA(m)$56, interpolates each row polynomial $QMA(poly)=\bigcup_{m\in poly}QMA(m)$57 of degree $QMA(poly)=\bigcup_{m\in poly}QMA(m)$58, computes

$QMA(poly)=\bigcup_{m\in poly}QMA(m)$59

forms

$QMA(poly)=\bigcup_{m\in poly}QMA(m)$60

and checks whether

$QMA(poly)=\bigcup_{m\in poly}QMA(m)$61

satisfies $QMA(poly)=\bigcup_{m\in poly}QMA(m)$62. The reported verification cost per block is one interpolation of degree $QMA(poly)=\bigcup_{m\in poly}QMA(m)$63, $QMA(poly)=\bigcup_{m\in poly}QMA(m)$64 scalar multiplications in $QMA(poly)=\bigcup_{m\in poly}QMA(m)$65, and $QMA(poly)=\bigcup_{m\in poly}QMA(m)$66 pairings (Srivastava et al., 17 Apr 2026).

5. Systems architecture, complexity, and empirical trade-offs

The system design in the blockchain use case is described end-to-end. Full nodes choose a micro-domain size $QMA(poly)=\bigcup_{m\in poly}QMA(m)$67 such as $QMA(poly)=\bigcup_{m\in poly}QMA(m)$68, partition each row or column domain into blocks $QMA(poly)=\bigcup_{m\in poly}QMA(m)$69, compute the $QMA(poly)=\bigcup_{m\in poly}QMA(m)$70 evaluation values $QMA(poly)=\bigcup_{m\in poly}QMA(m)$71 for each of $QMA(poly)=\bigcup_{m\in poly}QMA(m)$72 nearby rows, form the proof transcript

$QMA(poly)=\bigcup_{m\in poly}QMA(m)$73

derive $QMA(poly)=\bigcup_{m\in poly}QMA(m)$74 via Fiat–Shamir, compute

$QMA(poly)=\bigcup_{m\in poly}QMA(m)$75

and exponentiate via multiexp on the SRS to obtain $QMA(poly)=\bigcup_{m\in poly}QMA(m)$76 (Srivastava et al., 17 Apr 2026).

On the dissemination side, the baseline stores each sampled cell under a DHT key equal to its coordinate, with value $QMA(poly)=\bigcup_{m\in poly}QMA(m)$77, or approximately $QMA(poly)=\bigcup_{m\in poly}QMA(m)$78 bytes per object. The PMP design introduces two structures:

• $QMA(poly)=\bigcup_{m\in poly}QMA(m)$79
• $QMA(poly)=\bigcup_{m\in poly}QMA(m)$80

A fat client constructs an $QMA(poly)=\bigcup_{m\in poly}QMA(m)$81 for each block $QMA(poly)=\bigcup_{m\in poly}QMA(m)$82 and republishes it under one DHT key per block. A light client maps each sampled coordinate to its $QMA(poly)=\bigcup_{m\in poly}QMA(m)$83, fetches one $QMA(poly)=\bigcup_{m\in poly}QMA(m)$84, and extracts the relevant scalar or scalars together with the single aggregated proof $QMA(poly)=\bigcup_{m\in poly}QMA(m)$85 (Srivastava et al., 17 Apr 2026).

The theoretical comparison between the baseline and PMP is concise and explicit.

Scheme	Proof size	Verifier cost
Per-cell proofs	$QMA(poly)=\bigcup_{m\in poly}QMA(m)$86 group elements $QMA(poly)=\bigcup_{m\in poly}QMA(m)$87 bytes	$QMA(poly)=\bigcup_{m\in poly}QMA(m)$88 pairings + $QMA(poly)=\bigcup_{m\in poly}QMA(m)$89 scalar muls
PMP with blocks of size $QMA(poly)=\bigcup_{m\in poly}QMA(m)$90	$QMA(poly)=\bigcup_{m\in poly}QMA(m)$91 group elements $QMA(poly)=\bigcup_{m\in poly}QMA(m)$92 bytes	$QMA(poly)=\bigcup_{m\in poly}QMA(m)$93 scalar ops + $QMA(poly)=\bigcup_{m\in poly}QMA(m)$94 pairings

The same section states that PMP memory usage is “store $QMA(poly)=\bigcup_{m\in poly}QMA(m)$95 proofs + interpolation buffers,” whereas the baseline stores $QMA(poly)=\bigcup_{m\in poly}QMA(m)$96 proofs (Srivastava et al., 17 Apr 2026).

The empirical case study in Avail reports the following values.

Metric	Vanilla	PMP
Verifier CPU @1 000	110 units	60 units
Peak memory (GB)	1.2	0.7
DHT hit rate (1 KB)	78%	100%
DHT hit rate (1.5–2 MB)	12%	98%
Fats to meet SLO (1 KB)	40	10
Capacity @2 MB (B/fat)	16	80

The “Relative” column in the source gives $QMA(poly)=\bigcup_{m\in poly}QMA(m)$97 verifier CPU, $QMA(poly)=\bigcup_{m\in poly}QMA(m)$98 peak memory, $QMA(poly)=\bigcup_{m\in poly}QMA(m)$99 DHT hit rate at $QMA_{log}(poly)$00 KB, $QMA_{log}(poly)$01 DHT hit rate at $QMA_{log}(poly)$02–$QMA_{log}(poly)$03 MB, $QMA_{log}(poly)$04 “Fats to meet SLO (1 KB),” $QMA_{log}(poly)$05 capacity at $QMA_{log}(poly)$06 MB, and infrastructure compute cost reduction “$QMA_{log}(poly)$07” (Srivastava et al., 17 Apr 2026).

The paper also states several trade-offs. Grouping introduces soundness considerations because worst-case correlation inside groups of size $QMA_{log}(poly)$08 reduces effectively independent events by $QMA_{log}(poly)$09; preserving a target failure probability may therefore require sampling $QMA_{log}(poly)$10 more blocks or ensuring $QMA_{log}(poly)$11 distinct groups. Grouping also affects privacy or unlinkability because per-cell retrieval hides the exact neighborhood, whereas grouped retrieval leaks the full $QMA_{log}(poly)$12-block region to peers. Larger group objects improve DHT hit rates and lower latency, but a failed block forces re-request of all $QMA_{log}(poly)$13 scalars. The stated engineering conclusion is that Avail found $QMA_{log}(poly)$14 minimized end-to-end latency under their workload (Srivastava et al., 17 Apr 2026).

6. Comparative interpretation and open questions

Across these three usages, PMP has a shared structural motif but different formal semantics. In $QMA_{log}(poly)$15, multiplicity lies in the witness space: there are polynomially many unentangled Merlins, and the question is how verifier restrictions change expressive power (Gharibian et al., 2011). In the MA batch-evaluation protocol, multiplicity lies in the claim set: one proof polynomial certifies $QMA_{log}(poly)$16 outputs of an arithmetic circuit (Williams, 2016). In the KZG setting, multiplicity lies in the opening set: one aggregated proof certifies several sampled evaluations under a shared micro-domain (Srivastava et al., 17 Apr 2026). This suggests that “multiproof” is best understood operationally—as a proof artifact for many claims—rather than as a single syntactic object common to all subfields.

The three settings also differ sharply in what counts as efficiency. In the quantum-complexity paper, the key outcomes are class collapses and exact repetition theorems, not concrete runtime benchmarks. In the MA batch-evaluation paper, efficiency is measured by proof length, verifier randomness, and nearly linear-time algebraic verification. In the blockchain paper, efficiency is measured both asymptotically and at the deployment level, including proof bytes, verifier CPU, peak memory, DHT hit rates, and infrastructure cost (Gharibian et al., 2011, Williams, 2016, Srivastava et al., 17 Apr 2026).

The most explicit open question appears in the complexity-theoretic PMP literature: “whether $QMA_{log}(poly)$17 strictly contains $QMA_{log}(poly)$18” remains unresolved (Gharibian et al., 2011). The same source states that its theorems suggest any genuine “multiprover advantage” must either employ longer proofs than $QMA_{log}(poly)$19 or exploit richer joint measurements beyond the $QMA_{log}(poly)$20 style. In the MA batch-evaluation line, the authors ask whether proof length or verification time can be reduced below $QMA_{log}(poly)$21 by using more interaction or more randomness, and specifically whether there is an $QMA_{log}(poly)$22-time MA protocol for $QMA_{log}(poly)$23 (Williams, 2016). In the blockchain line, the unresolved issues are not posed as a single theorem-level open problem, but the trade-off analysis identifies tension among proof amortization, verifier interpolation cost, soundness under grouped retrieval, latency, and privacy leakage (Srivastava et al., 17 Apr 2026).

A recurring misconception is that aggregation automatically yields an unconditional advantage. The sources are more precise. In the quantum setting, several natural polynomial-multiproof classes collapse to already known classes. In the MA setting, the benefit depends on low degree and batch structure. In the blockchain setting, proof aggregation lowers proof bytes and verifier cost but introduces grouped-retrieval trade-offs. The literature therefore supports a narrower conclusion: PMP is a family of techniques for organizing many claims under one verification framework, and its value depends on the exact proof model, verifier restrictions, and application-level cost structure.