--- title: 'Polynomial Multiproofs: Multi-Claim Verification' url: https://www.emergentmind.com/topics/polynomial-multiproofs-pmp type: topic --- # Polynomial Multiproofs: Multi-Claim Verification Searching arXiv for recent and foundational papers on “Polynomial Multiproofs” and closely related usages. Polynomial Multiproofs (PMP) is a term used in several technically distinct lines of research to denote proof-system constructions that handle multiple claims in a single formal framework. In one usage, PMP refers to the landscape of quantum Merlin–Arthur variants with polynomially many unentangled proofs, as studied under the heading of “polynomially many provers” and summarized as “QMA variants with polynomially many Merlins” [1108.0617]. In a second usage, PMP denotes a non-interactive Merlin–Arthur proof for batch evaluation of an arithmetic circuit on many inputs, where a single univariate polynomial “sketch” certifies \(K\) evaluations at once [1601.04743]. In a third usage, PMP designates aggregated polynomial-opening proofs for Kate–Zaverucha–Goldberg commitments in blockchain light clients, where multiple sampled cell evaluations are verified using a single aggregated proof over a shared evaluation micro-domain [2604.16559]. The common theme is multiplicity: many witnesses, many evaluation claims, or many data-availability samples are compressed into a verifier-efficient proof structure. ## 1. Terminological scope and research contexts The term does not denote a single universally standardized primitive. Rather, the arXiv literature represented here uses it in at least three settings: complexity theory of unentangled quantum proofs, Merlin–Arthur proofs for multipoint arithmetic circuit evaluation, and polynomial-commitment aggregation for data availability sampling [1108.0617] [1601.04743] [2604.16559]. In the quantum-complexity setting, the central object is the class \(QMA(poly)=\bigcup_{m\in poly}QMA(m)\), where a verifier receives polynomially many unentangled quantum proofs. The terminology “polynomial multiproofs” is used to organize subclasses such as \(QMA_{log}(poly)\), \(BellQMA(poly)\), and \(SepQMA(m)\), together with collapse and repetition theorems that delimit their expressive power [1108.0617]. In the batch-evaluation setting, PMP is explicitly formulated as a one-message protocol for Multipoint Arithmetic Circuit Evaluation. Merlin sends a proof string \(\pi\) of length \(\widetilde O(K\cdot d)\), and Arthur verifies all \(K\) claimed evaluations in time \(\widetilde O(K\cdot(n+d)+s)\) with soundness error at most \(\varepsilon\) [1601.04743]. Here “multiproof” means that one proof string certifies many outputs. In the blockchain setting, PMP is a mechanism for reducing the cost of attaching one proof to each sampled cell in data availability sampling. The construction replaces many independent KZG openings by one aggregated proof \(\pi_{agg}\) over a shared micro-domain, with the stated goal of lowering proof bytes, verifier CPU and memory usage, and deployment-level infrastructure cost [2604.16559]. A common misconception is that PMP always refers to cryptographic polynomial-opening aggregation. The literature here shows that the same phrase also names a complexity-theoretic program around polynomially many Merlins and an unconditional MA proof system for batch evaluation. This suggests that the most precise interpretation of PMP is context-dependent rather than canonical. ## 2. Polynomially many quantum proofs The quantum-complexity formulation begins with promise problems \(A=(A_{yes},A_{no})\) and completeness–soundness parameters \(c,s\) such that \(c-s \ge 1/poly(n)\). For functions \(p,m:\mathbb{N}\to\mathbb{N}\), a promise problem lies in \(QMA(m)\) if there is a uniform family of quantum circuits \(\{V_n\}\) such that \(V_n\) takes input \(x\in\{0,1\}^n\) together with \(m(n)\) unentangled quantum proofs \(|\psi_1\rangle,\dots,|\psi_m\rangle\), each on \(p(n)\) qubits, and satisfies the usual completeness and soundness conditions. Writing \(QMA(poly)=\bigcup_{m\in poly}QMA(m)\), one has \(QMA \equiv QMA(1)\) [1108.0617]. Several subclasses are singled out. \(MQA\) (also called \(QCMA\)) replaces the quantum witness by a single classical string \(y\in\{0,1\}^{poly(n)}\). \(QMA_{log}(poly)\) restricts each of the polynomially many proofs to length \(O(\log n)\) qubits. \(BellQMA[r,m]\) is defined by a verifier that first performs local, nonadaptive POVMs \(\{\Pi_j(i):i\in[r]\}\), one per proof register, obtaining classical outcomes \(y_j\in[r]\), and then runs an efficient quantum circuit on \((x,y_1,\dots,y_m)\). \(SepQMA(m)\) is the subclass in which the verifier’s accept-POVM element \(C\) is fully separable across the \(m\) proof registers [1108.0617]. Three structural theorems organize this PMP landscape. First, \(QMA_{log}(poly)=MQA\). The proof sketch states that a classical proof can be embedded bitwise into one-qubit states, while in the reverse direction a classical witness can describe each \(O(\log n)\)-qubit state to inverse-exponential precision, after which the verifier uses Solovay–Kitaev to prepare the states and relies on trace-norm continuity to preserve the \(1/poly(n)\) completeness–soundness gap [1108.0617]. The key continuity lemma is \[ \left\|\bigotimes_{i=1}^k \rho_i-\bigotimes_{i=1}^k \sigma_i\right\|_{tr} \le \sum_{i=1}^k \|\rho_i-\sigma_i\|_{tr}. \] Second, for polynomially bounded \(r(n)\) and \(m(n)\), \(BellQMA[r,m]\subseteq QMA\), and since \(QMA=BellQMA[2,1]\), one concludes \(BellQMA(poly)=QMA\). The stated simulation uses a single-prover QMA witness composed of a classical consistency-check register \(X\), encoding the alleged measurement distributions \(p_j(i)=Tr[\Pi_j(i)\rho_j]\), together with a quantum register \(Y\) holding polynomially many copies of each original proof \(\rho_j\). The verifier measures \(X\) in the computational basis, checks normalization, performs random local checks against the empirical frequencies in \(Y\) using a Chernoff bound, and then simulates Stage 2 of the original BellQMA protocol [1108.0617]. Third, \(SepQMA(m)\) satisfies perfect parallel repetition: if a protocol has accept-probability \(p_{acc}(x)\), then its \(k\)-fold parallel repetition has acceptance probability exactly \(p_{acc}(x)^k\), even if the proofs across the \(k\) copies are globally entangled. The argument is presented via cone programming duality. The primal optimization is \[ (P)\qquad \max \ Tr[C\rho] \quad \text{subject to} \quad Tr(\rho)=1,\ \rho\in Sep(X_1,\dots,X_m), \] with dual \[ (D)\qquad \min \ t \quad \text{subject to} \quad t\cdot I = C + W,\ W\in Sep(X_1,\dots,X_m)^*. \] The proof uses strong duality and the tensor-product closure property \[ Sep(X)^*\otimes Sep(Y)\subseteq Sep(X\otimes Y)^*, \qquad Sep(X)\otimes Sep(Y)^*\subseteq Sep(X\otimes Y)^*, \] to show multiplicativity of the optimum under repetition [1108.0617]. The complexity-theoretic significance is stated explicitly: short quantum proofs collapse to the classical-proof class \(MQA\); Bell-style local unentangled measurements with polynomially many outcomes do not exceed \(QMA\); and separable-accept protocols admit exact multiplicative repetition [1108.0617]. A plausible implication is that any genuine multiprover advantage inside \(QMA(poly)\) must lie outside these natural subclasses. ## 3. Non-interactive batch-evaluation PMP In the Merlin–Arthur setting, PMP is formulated for Multipoint Arithmetic Circuit Evaluation. Let \(\mathbb{F}\) be a finite field, let \[ C(x_1,\dots,x_n)\in \mathbb{F}[x_1,\dots,x_n] \] be an arithmetic circuit of size \(s\) and total degree at most \(d\), and let \(a_1,\dots,a_K\in \mathbb{F}^n\). The main theorem states that there is a one-message protocol in which Merlin sends a proof string of length \(\widetilde O(K\cdot d)\), Arthur tosses \(\mathrm{poly}(\log(dK|\mathbb{F}|/\varepsilon))\) coins, runs in time \(\widetilde O(K\cdot(n+d)+s)\), and outputs the vector \((C(a_1),\dots,C(a_K))\) with completeness \(1\) and soundness error at most \(\varepsilon\) [1601.04743]. The prover’s construction begins by choosing an extension field \(F=\mathbb{F}_{q^\ell}\), where \[ \ell=\min\{\ell: |\mathbb{F}|^\ell > dK/\varepsilon\}. \] A set \(S\subseteq F\) of size \(K\) is fixed and put in bijection with the evaluation points \(a_1,\dots,a_K\), written \(\alpha_i\mapsto a_i\). For each coordinate \(j=1,\dots,n\), Merlin interpolates a univariate polynomial \(\Psi_j(x)\in F[x]\) of degree at most \(K\) such that \(\Psi_j(\alpha_i)=a_i[j]\). He then defines \[ R(x)=C(\Psi_1(x),\dots,\Psi_n(x))\in F[x]. \] Because \(\deg(C)\le d\) and each \(\Psi_j\) has degree at most \(K\), the resulting degree bound is \(\deg(R)\le d\cdot K\), and by construction \(R(\alpha_i)=C(a_i)\) for all \(i\in[K]\). Merlin sends the coefficient vector of a polynomial \[ Q(x)=\sum_{t=0}^{dK} q_t x^t \] claimed to equal \(R(x)\), so the proof string is \[ \pi=(q_0,q_1,\dots,q_{dK})\in F^{dK+1}. \] This is why the protocol is characterized as a non-interactive PMP: a single polynomial of degree \(dK\) certifies \(K\) output claims at once [1601.04743]. Arthur reconstructs the extension field, recomputes the interpolants \(\Psi_j\), samples a random \(r\in F\), evaluates \(Q(r)\) by Horner’s method, evaluates \(R(r)=C(\Psi_1(r),\dots,\Psi_n(r))\), and rejects if the two values differ. If the test passes, Arthur outputs \([Q(\alpha_1),\dots,Q(\alpha_K)]\) by fast multipoint evaluation. Soundness follows from polynomial identity testing: if \(Q\neq R\), then \(\deg(Q-R)\le dK\), so \[ \Pr_r[Q(r)=R(r)] < dK/|F| \le \varepsilon. \] The cost breakdown listed for verification is: interpolating \(\Psi_j\) in \(O(n\,K\,mult(K)\log K)\), evaluating the \(\Psi_j(r)\) in \(O(n\,K)\), evaluating the circuit in \(O(s\cdot polylog\, s)\), Horner evaluation of \(Q(r)\) in \(O(dK)\), and multipoint evaluation in \(\widetilde O(dK)\), yielding overall \(\widetilde O(K(n+d)+s)\) [1601.04743]. The authors contrast this PMP with several prior directions: classical multipoint evaluation algorithms for restricted circuit classes, multi-round sum-check interactive proofs, Aaronson–Wigderson protocols for inner products, and cryptographic verifiable computation using heavy PCP machinery or cryptographic assumptions. The stated distinguishing features are that the protocol is unconditionally secure, one-round, applies to all low-degree arithmetic circuits, and attains proof length \(\widetilde O(Kd)\) with verification time \(\widetilde O(K(n+d)+s)\) [1601.04743]. The same framework is then applied to the Permanent, \(\#\)Circuit-SAT, counting Hamiltonian cycles, orthogonal vectors, Hamming nearest neighbors, and \(k\)-cliques, using standard arithmetization or inclusion–exclusion reductions spelled out in the source summary [1601.04743]. This suggests that, in this usage, PMP functions less as a standalone cryptographic primitive than as a general-purpose certification method for batch algebraic computation. ## 4. KZG-based polynomial multiproofs for data availability sampling In blockchain light clients, PMP is studied as an optimization for data availability sampling based on Kate–Zaverucha–Goldberg polynomial commitments. The underlying KZG commitment scheme is specified by an SRS generated from a secret \(\tau\in\mathbb{F}\), publishing \[ g_1,g_2,g_1^\tau,\dots,g_1^{\tau^d}\in \mathbb{G}_1 \quad \text{and} \quad g_2,g_2^\tau \in \mathbb{G}_2. \] For a polynomial \(f(X)=\sum_{j=0}^d a_jX^j\) of degree at most \(d\), the commitment is \[ C=com(f)=g_1^{f(\tau)}=g_1^{\sum_{j=0}^d a_j\tau^j}\in \mathbb{G}_1. \] A single-point opening at \(x\in\mathbb{F}\) with claimed value \(y=f(x)\) uses witness polynomial \[ w(X)=\frac{f(X)-y}{X-x}, \] proof \(\pi=g_1^{w(\tau)}\), and verification equation \[ e(C/g_1^y,g_2)\ ?=\ e(\pi,g_2^{\tau-x}). \] These details provide the baseline against which PMP is introduced [2604.16559]. The stated bottleneck is that in data availability sampling, a client samples \(s\) random cells from an erasure-coded \(2D\) grid to gain at least \(99.9\%\) assurance that the full block is available, and modern schemes attach one KZG proof per sampled cell. If \(s\approx 100\)–\(200\), this yields \(100\)–\(200\) independent proofs per block, with costs summarized as bandwidth and storage \(\sim 48\) bytes\(\cdot s\), verification cost \(\sim s\) pairings and scalar multiplications, and DHT object explosion from many small objects [2604.16559]. The PMP construction aggregates multiple opening claims \(\{(x_i,y_i)\}_{i=1}^n\) into a single proof \(\pi_{agg}\). In the random-linear-combination approach, a challenge \[ \gamma = H(domain \parallel srs\_id \parallel C \parallel \{x_i\parallel y_i\}_{i=1}^n)\in \mathbb{F} \] is derived via Fiat–Shamir, and the aggregate witness polynomial is defined as \[ W(X)=\sum_{i=1}^n \gamma^{\,i-1}\cdot \frac{f(X)-y_i}{x_i-x}. \] The aggregated proof is \[ \pi_{agg}=g_1^{W(\tau)}\in \mathbb{G}_1. \] The description then gives a corresponding aggregated verification equation and notes an equivalent derivation using bilinearity and linearity of exponents [2604.16559]. For data availability sampling, the critical specialization is the evaluation micro-domain \(H=\{z_1,\dots,z_g\}\), a small subset of row or column positions. Its vanishing polynomial is \[ Z_H(X)=\prod_{z\in H}(X-z). \] Under the “shared-point specialization (Boneh et al. first scheme),” all openings use \(U_i=H\), causing the denominators to collapse to \(Z_H(X)\). If \(r_i(X)\) interpolates the \(g\) evaluations of \(f\) in block \(i\) over \(H\), then the specialized witness is \[ h(X)=\frac{\sum_{i=1}^k \gamma^{i-1}(f_i(X)-r_i(X))}{Z_H(X)}, \qquad \pi_{agg}=g_1^{h(\tau)}. \] The source emphasizes that this avoids per-row interpolation at the prover: compute a weighted sum of commitments minus weighted evaluations, then divide once by \(Z_H\) [2604.16559]. The light-client verification algorithm takes as input commitment identifiers \(\{cm_r\}\), an \(MCell=(\pi,GCellBlock,scalars\ y_{rj})\), the micro-domain \(H\), and sampled coordinates \(S\subseteq H\). The verifier derives \(\gamma\), interpolates each row polynomial \(r_r(X)\) of degree \( \}\) A fat client constructs an \(MCell\) for each block \(H\times \{k\ rows\}\) and republishes it under one DHT key per block. A light client maps each sampled coordinate to its \(GCellBlock\), fetches one \(MCell\), and extracts the relevant scalar or scalars together with the single aggregated proof \(\pi_{agg}\) [2604.16559]. The theoretical comparison between the baseline and PMP is concise and explicit. | Scheme | Proof size | Verifier cost | |---|---|---| | Per-cell proofs | \(O(s)\) group elements \(\to 48\cdot s\) bytes | \(O(s)\) pairings + \(O(s)\) scalar muls | | PMP with blocks of size \(g\) | \(O(s/g)\) group elements \(\to 48\cdot (s/g)\) bytes | \(O(s/g+g)\) scalar ops + \(O(s/g)\) pairings | The same section states that PMP memory usage is “store \(s/g\) proofs + interpolation buffers,” whereas the baseline stores \(s\) proofs [2604.16559]. The empirical case study in Avail reports the following values. | Metric | Vanilla | PMP | |---|---:|---:| | Verifier CPU @1 000 | 110 units | 60 units | | Peak memory (GB) | 1.2 | 0.7 | | DHT hit rate (1 KB) | 78% | 100% | | DHT hit rate (1.5–2 MB) | 12% | 98% | | Fats to meet SLO (1 KB) | 40 | 10 | | Capacity @2 MB (B/fat) | 16 | 80 | The “Relative” column in the source gives \(\downarrow 45\%\) verifier CPU, \(\downarrow 42\%\) peak memory, \(\times 1.28\) DHT hit rate at \(1\) KB, \(\times 8.17\) DHT hit rate at \(1.5\)–\(2\) MB, \(\downarrow 75\%\) “Fats to meet SLO (1 KB),” \(\times 5\) capacity at \(2\) MB, and infrastructure compute cost reduction “\(\downarrow \le 45\%\)” [2604.16559]. The paper also states several trade-offs. Grouping introduces soundness considerations because worst-case correlation inside groups of size \(g\) reduces effectively independent events by \(\sim g\); preserving a target failure probability may therefore require sampling \(\sim g\times\) more blocks or ensuring \(\gtrsim s/g\) distinct groups. Grouping also affects privacy or unlinkability because per-cell retrieval hides the exact neighborhood, whereas grouped retrieval leaks the full \(g\)-block region to peers. Larger group objects improve DHT hit rates and lower latency, but a failed block forces re-request of all \(g\) scalars. The stated engineering conclusion is that Avail found \(g=16\) minimized end-to-end latency under their workload [2604.16559]. ## 6. Comparative interpretation and open questions Across these three usages, PMP has a shared structural motif but different formal semantics. In \(QMA(poly)\), multiplicity lies in the witness space: there are polynomially many unentangled Merlins, and the question is how verifier restrictions change expressive power [1108.0617]. In the MA batch-evaluation protocol, multiplicity lies in the claim set: one proof polynomial certifies \(K\) outputs of an arithmetic circuit [1601.04743]. In the KZG setting, multiplicity lies in the opening set: one aggregated proof certifies several sampled evaluations under a shared micro-domain [2604.16559]. This suggests that “multiproof” is best understood operationally—as a proof artifact for many claims—rather than as a single syntactic object common to all subfields. The three settings also differ sharply in what counts as efficiency. In the quantum-complexity paper, the key outcomes are class collapses and exact repetition theorems, not concrete runtime benchmarks. In the MA batch-evaluation paper, efficiency is measured by proof length, verifier randomness, and nearly linear-time algebraic verification. In the blockchain paper, efficiency is measured both asymptotically and at the deployment level, including proof bytes, verifier CPU, peak memory, DHT hit rates, and infrastructure cost [1108.0617] [1601.04743] [2604.16559]. The most explicit open question appears in the complexity-theoretic PMP literature: “whether \(QMA(poly)\) strictly contains \(QMA\)” remains unresolved [1108.0617]. The same source states that its theorems suggest any genuine “multiprover advantage” must either employ longer proofs than \(O(\log n)\) or exploit richer joint measurements beyond the \(BellQMA[poly,poly]\) style. In the MA batch-evaluation line, the authors ask whether proof length or verification time can be reduced below \(O(Kd)\) by using more interaction or more randomness, and specifically whether there is an \(O^*(2^{n/3})\)-time MA protocol for \(UNSAT\) [1601.04743]. In the blockchain line, the unresolved issues are not posed as a single theorem-level open problem, but the trade-off analysis identifies tension among proof amortization, verifier interpolation cost, soundness under grouped retrieval, latency, and privacy leakage [2604.16559]. A recurring misconception is that aggregation automatically yields an unconditional advantage. The sources are more precise. In the quantum setting, several natural polynomial-multiproof classes collapse to already known classes. In the MA setting, the benefit depends on low degree and batch structure. In the blockchain setting, proof aggregation lowers proof bytes and verifier cost but introduces grouped-retrieval trade-offs. The literature therefore supports a narrower conclusion: PMP is a family of techniques for organizing many claims under one verification framework, and its value depends on the exact proof model, verifier restrictions, and application-level cost structure. Source: https://www.emergentmind.com/topics/polynomial-multiproofs-pmp