Module multipoint_eval 

Multi-point evaluation subprotocol.

Reduces two sets of MLE evaluation claims at a shared point r’ - the “up” evaluations v_j(r') and the “down” (shifted) evaluations v_j^{down}(r') - to a single set of standard MLE evaluation claims v_j(r_0) at a new random point r_0 via one sumcheck.

The trace column MLEs are precombined into a single MLE precombined(b) = \sum_j \gamma_j * v_j(b) before entering the sumcheck, so the prover works with only 3 MLEs (eq, next, precombined) regardless of the number of columns. The sumcheck proves:

\sum_b [eq(b, r') * \sum_j \gamma_j * v_j(b)
        + \sum_k \alpha_k * next_{c_k}(r', b) * v_{src_k}(b)]
  = \sum_j \gamma_j * up_eval_j + \sum_k \alpha_k * down_eval_k

where \alpha_k batch the per-shift evaluation kernels and \gamma_j batch across columns. After the sumcheck reduces to point r_0, the verifier calls MultipointEval::verify_subclaim with the open_evals (the F_q-valued MLE evaluations at r_0, typically derived from polynomial-valued lifted_evals via \psi_a) to check the final consistency equation.

This corresponds to the T=2 case of Pi_{BMLE} in the paper. Following the paper, the prover sends only the polynomial-valued lifted evaluations (alpha’_j in F_q[X]); the scalar open_evals are derived by the verifier via \psi_a rather than being sent as a separate proof element.

Structs

MultipointEval

Proof

Proof for the multi-point evaluation protocol.

ProverState

Prover state after the multi-point evaluation protocol.

Subclaim

Verifier subclaim after the multi-point evaluation sumcheck.

Enums

MultipointEvalError