Skip to content

research: Poseidon2 vs current Poseidon — constraint/proving-time delta (PARK) - #53

Open
alexandre-mrt wants to merge 3 commits into
mainfrom
research/2026-09-04-poseidon2-constraints
Open

research: Poseidon2 vs current Poseidon — constraint/proving-time delta (PARK)#53
alexandre-mrt wants to merge 3 commits into
mainfrom
research/2026-09-04-poseidon2-constraints

Conversation

@alexandre-mrt

@alexandre-mrt alexandre-mrt commented Sep 4, 2026

Copy link
Copy Markdown
Owner

Summary

One night of the nightly research loop — see docs/research/NIGHTLY_PROMPT.md for the standing brief.

  • Re-attempted queue item feat: Veil privacy payment protocol — full stack MVP #1 (on-chain gas per entry point) first, per the queue's own note. Re-confirmed BLOCKED, this time with harder evidence: a direct curl retry against fullnode.testnet.sui.io and a control domain (example.com) both hard-fail identically against this session's egress proxy — a confirmed organization-level allowlist (only npm/jsr/pypi/crates-index/golang-proxy/Anthropic-API hosts reachable), not a retryable denial. Demoted in the queue accordingly.
  • Fell through to queue item feat: Tier 3 — KYC compliance circuit + ElGamal auditor pattern #2: Poseidon2 vs current Poseidon (constraint-count and proving-time delta), using TACEO's audited @taceo/circom-lib/@taceo/poseidon2 (no round constants hand-derived this session).
  • Built six isolated "hash-only skeleton" bench circuits under circuits/bench/ — one pair (circomlib Poseidon vs Poseidon2/SAFE) per production circuit shape (transfer, compliance, withdraw) — plus a reusable compile script and two bench scripts under scripts/bench/.
  • Real, measured, half-confirms-the-hypothesis result: total R1CS constraints rose 11.5–16.4% (linear-constraint growth from the Poseidon2 sponge's matrix-multiply decomposition, plus a forced width jump for the one hash shape needing 4 non-tag values — Poseidon2 has no t=5/6 parameters). But Groth16 proving time dropped 4.4–14.9% across all three shapes (clean 10-run measurements, low variance) — non-linear constraints, which fell in every shape, tracked real proving time far better than the total-constraint number did.
  • 11/11 malicious-witness rejection tests pass (tampered Merkle sibling, non-boolean pathIndices, mismatched public/private hash values — all rejected by witness calculation).
  • Verdict: PARK, not KEEP — no production circuit was touched on purpose (a real swap breaks already-issued testnet commitments; that's a migration, not a one-night change), and the domain-tag derivation used is a simplified research stand-in for the full SAFE spec. Promoted to queue item feat: Veil privacy payment protocol — full stack MVP #1 for a future night to finish.
  • Re-ranked EXPERIMENTS.md and removed the "chained npm test hang" item — already fixed outside this loop by a human commit (f942fca, 2026-07-28).

Full writeup with raw command output: docs/research/2026-09-04-poseidon2-constraints.md.

What changed

  • circuits/bench/ — six new bench circuits + shared Poseidon2 wrapper templates (no production circuit touched)
  • circuits/scripts/compile-poseidon2-bench.sh — reusable compile + dev Groth16 setup
  • scripts/bench/poseidon2-{sponge,bench-witnesses,prove-latency,negative-tests}.mjs — reusable benchmark/test scripts
  • docs/research/2026-09-04-poseidon2-constraints.md — full report
  • docs/research/LEDGER.md, docs/research/EXPERIMENTS.md — ledger row + re-ranked queue
  • circuits/package.json, scripts/bench/package.json — new devDependencies (circom2, @taceo/circom-lib, @taceo/poseidon2) — none touch the production dependencies/build scripts
  • .gitignore — added build-bench/

Test plan

  • circom2 validated against BASELINE.md before use: compiling the real transfer.circom reproduces the exact documented constraint counts (6,470 non-linear / 7,141 linear)
  • All 6 bench circuits compiled, real Groth16 setup (dev-only, local Powers of Tau — same trust level as the existing baseline's), real proving via snarkjs.groth16.fullProve
  • node scripts/bench/poseidon2-negative-tests.mjs — 11/11 pass
  • cd scripts && bun run src/test-converter.ts — 109/109 pass (unaffected by this PR, run as a sanity check)
  • cd scripts && bun run src/test-compliance-utils.ts — 67/67 pass (unaffected by this PR, run as a sanity check)
  • Production circuit suite (circuits/test/*.test.mjs) and sui move test — not run this session: neither is touched by this PR's changes (all new code is additive, under circuits/bench/ and new scripts/bench/poseidon2-* files), the Move suite hits the same blocked sui CLI as queue item feat: Veil privacy payment protocol — full stack MVP #1, and the circuit suite would need the same slow circom2+local-ptau setup this session already validated for the bench circuits, deprioritized for time. See the report's "Test suite" section for the reproduction command.

🤖 Generated with Claude Code

https://claude.ai/code/session_019NksxTdzTtq2TPiBUCpRaY

Generated by Claude Code

@claude
research(circuits): Poseidon2 vs current Poseidon constraint/proving-…
a87ef74 
…time bench (WIP)

Isolated hash-only bench circuits replicating transfer/compliance/withdraw's exact
Poseidon call patterns, compiled against both circomlib Poseidon (current) and
TACEO's Poseidon2 (SAFE-style, domain tag folded into the sponge capacity). R1CS
constraint counts are measured and real for all six circuits; proving-time and
negative-test numbers are still being gathered (large-circuit Groth16 setup is slow
in this sandbox's pure-JS snarkjs) — report has TBD placeholders to be filled in
before this becomes a normal PR.

Toolchain note: this session's GitHub/general-internet egress is blocked (verified,
not just missing a package), so native circom and the hosted Powers of Tau ceremony
file were unreachable. Used circom2 (WASM circom, npm) — validated against
BASELINE.md's exact transfer.circom constraint counts first — and a locally
generated dev-only Powers of Tau instead.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019NksxTdzTtq2TPiBUCpRaY
@claude
research(circuits): add withdraw-shape zkey sizes to Poseidon2 bench …
4ec1e2c 
…report (WIP)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019NksxTdzTtq2TPiBUCpRaY
@claude
research(circuits): finalize Poseidon2 constraint/proving-time experi…
99af4de 
…ment — PARK

Real, measured result: swapping circomlib Poseidon for Poseidon2 (SAFE-style
domain tag) in Veil's exact hash shapes raises total R1CS constraints 11.5-16.4%
(linear-constraint growth from the sponge's matrix-multiply decomposition, plus
a forced width jump for the one hash shape needing 4 non-tag values) but drops
Groth16 proving time 4.4-14.9% across all three shapes — non-linear constraints,
which fell in every shape, tracked proving time far better than the total
constraint count did. 11/11 malicious-witness rejection tests pass.

PARK, not KEEP: no production circuit was touched (a real swap breaks
already-issued testnet commitments — a migration, not a one-night change), and
the domain-tag derivation used is a simplified research stand-in for the full
SAFE spec. Re-confirmed on-chain gas (queue item #1) is hard-blocked by this
session's egress policy, with harder evidence than the prior run. Re-ranked
the queue: Poseidon2 production port promoted to #1, gas demoted to #11,
removed the chained-npm-test-hang item (already fixed by a human commit
outside this loop).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019NksxTdzTtq2TPiBUCpRaY
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@alexandre-mrt @claude