feat: Bound a LuminAIR proof to public inputs

[raphaelDkhn]

Feature Request

Describe the Feature Request

Currently, all inputs to a LuminAIR computation are treated as private inputs, meaning their values are committed to within the STARK proof's trace. This is suitable for proving the integrity of a computation on private data, but it lacks the ability to bind the proof to specific, publicly known data.

This feature request is to introduce the concept of "public inputs" to LuminAIR. A user should be able to designate certain input tensors as public, which means their values are known to both the prover and the verifier. The resulting proof should then be a statement of knowledge: "I (the prover) know a set of private inputs (the witness) that, when combined with these specific public inputs, result in a valid computation."

Describe Preferred Solution

The preferred solution involves changes across the API, AIR, prover, and verifier to natively support public inputs.

1. API Modification:

   • Introduce a method on GraphTensor in the luminal graph construction phase to mark a tensor as a public input. For example:

     let public_data = cx.tensor((1, 28, 28)).set(my_public_image).as_public();
     let private_weights = cx.tensor((10, 784)).set(my_private_weights);

2. Prover and AIR Changes:

   • Claim Update: The LuminairClaim struct in crates/air/src/lib.rs should be updated to include a field for public inputs, for instance: pub public_inputs: Vec<(u32, Vec<M31>)>, where u32 is the node ID and the Vec<M31> contains the public data.
   • Fiat-Shamir Transcript: The public inputs must be mixed into the Fiat-Shamir transcript (Blake2sChannel) at the beginning of the proving process, before any commitments are made. This binds the entire proof to these specific values. This would happen in the prove function in crates/prover/src/prover.rs.
   • Trace Generation: The Inputs component (crates/air/src/components/inputs/) and the CopyToStwo operator should be modified. When processing a public input, it should not generate trace rows in the same way as a private input. The values will be passed directly to the verifier and mixed into the channel, so they don't need to be committed in the trace. However, the connection to the rest of the computation graph must be maintained.

3. Verifier Changes:

   • The verify function signature in crates/verifiers/rust/src/verifier.rs must be updated to accept the public inputs, for example: verify(proof: LuminairProof, settings: CircuitSettings, public_inputs: &[&[f32]]).
   • The verifier must perform the exact same hashing/mixing of the provided public inputs into its own channel instance at the same point in the protocol as the prover.
   • The verifier should check that the public inputs provided to it match the ones included in the LuminairClaim within the proof.

[hakymulla]

can i take this?

[NehharShah]

@raphaelDkhn can I work on this issue?