Vitalik: The core of ZK-Provers enabling efficient computation lies in the fact that there is no need to commit to any intermediate layer data.

[Vitalik: The core of efficient computation for ZK-Provers lies in not needing to commit to any intermediate layer data] Vitalik Buterin stated, "If you have been following the cryptography direction in the crypto assets field, then you have likely heard about the ultra-fast ZK provers: for example, the ZK-EVM prover for Ethereum L1 can achieve real-time proofs using only about 50 consumer-grade GPUs; proving 2 million Poseidon hashes per second on a regular laptop; and the zk-ML system continuously improving the proof speed for large language model (LLM) inference. In this article, I will explain in detail a family of protocols used in these high-speed proof systems: GKR. I will focus on the implementation of GKR in proving Poseidon hash (and other computations with similar structures). If you want to understand the background of GKR in general circuit computations, you can refer to Justin Thaler's notes and this article from Lambdaclass. What is GKR, and why is it so fast? Imagine you have a computation that is “large in both dimensions”: it needs to handle at least a moderate number of (low-degree) “layers” while repeatedly applying the same function to a large amount of input. Like this: It has been proven that many of the large computations we perform conform to this pattern. Cryptography engineers will notice that many computation-intensive proof tasks involve a large number of hash operations, and the internal structure of each hash conforms to this pattern. AI researchers will also notice that neural networks (the basic building blocks of LLMs) have exactly this structure (they can both parallelly prove the reasoning of multiple tokens and, because each token is composed of element-wise neural layers and global matrix multiplication layers – although matrix operations do not completely conform to the “cross-input independence” structure shown above, they can actually be easily embedded into the GKR system). GKR is a cryptographic protocol specifically designed for this model. Its efficiency comes from avoiding commitments to all intermediate layers: you only need to commit to the inputs and outputs. Here, “commitment” refers to placing data into some kind of encrypted data structure (like KZG or a Merkle tree), allowing you to prove content related to certain queries about that data. The cheapest way to commit is by using a Merkle tree after error correction (i.e., the method in STARK), but it also requires you to perform 4–16 bytes of hash for each byte submitted—which means hundreds of addition and multiplication operations, while the operation you actually want to prove might just be a multiplication. GKR avoids these operations, except for the initial and final steps. It is important to note that GKR is not “zero-knowledge”: it only guarantees succinctness and does not provide privacy. If you need zero-knowledge, you can encapsulate the GKR proof within ZK-SNARK or ZK-STARK.