diff --git a/SumcheckProtocol/Properties/Theorems/Soundness.lean b/SumcheckProtocol/Properties/Theorems/Soundness.lean index deb0612..705146d 100644 --- a/SumcheckProtocol/Properties/Theorems/Soundness.lean +++ b/SumcheckProtocol/Properties/Theorems/Soundness.lean @@ -407,12 +407,148 @@ theorem soundness_k {๐”ฝ : Type _} {n : โ„•} [Field ๐”ฝ] [Fintype ๐”ฝ] [Decid -/-- **Partial-run dishonest-claim soundness.** K-parameterized version of -`soundness_dishonest`: when the claimed sum is wrong, no partial-run prover -convinces the verifier with probability more than `soundnessErrorK k`. -Same reduction-to-`soundness_k` structure as the full-run case; helpers -needed: a k-version of `accepts_on_challenges_dishonest_implies_bad` in -`SumcheckProtocol/Properties/Lemmas/SoundnessLemmas.lean`. -/ +theorem all_rounds_honest_of_not_bad_k_aux {๐”ฝ : Type _} {n : โ„•} [Field ๐”ฝ] [Fintype ๐”ฝ] [DecidableEq ๐”ฝ] + (k : Fin (n + 1)) + (p : CPoly.CMvPolynomial n ๐”ฝ) + (t : Transcript ๐”ฝ k.val) + (domain : List ๐”ฝ) + (hNoBad : ยฌ BadTranscriptEvent k domain p t) : + โˆ€ i : Fin k.val, + t.roundPolys i = honestRoundPolyAtK k domain p t.challenges i := by + intro i + by_contra hneq + apply hNoBad + refine โŸจi, ?_โŸฉ + simpa [BadRound] using hneq + +theorem honest_round0_atK_domain_sum_eq_honest_claim_aux {๐”ฝ : Type _} {n' : โ„•} [Field ๐”ฝ] [Fintype ๐”ฝ] [DecidableEq ๐”ฝ] + (k : Fin (Nat.succ n' + 1)) + (domain : List ๐”ฝ) + (p : CPoly.CMvPolynomial (Nat.succ n') ๐”ฝ) + (r : Fin k.val โ†’ ๐”ฝ) + (hkpos : 0 < k.val) : + let i0 : Fin k.val := โŸจ0, hkposโŸฉ + domain.foldl (fun acc a => + acc + CPoly.CMvPolynomial.eval (fun _ : Fin 1 => a) + (honestRoundPolyAtK k domain p r i0)) 0 + = honestClaim domain (p := p) := by + dsimp + let rExt : Fin (Nat.succ n') โ†’ ๐”ฝ := fun _ => 0 + have hbridge : + honestRoundPolyAtK k domain p r โŸจ0, hkposโŸฉ = + honestRoundPoly domain p rExt โŸจ0, Nat.succ_pos n'โŸฉ := by + apply honestRoundPolyAtK_eq_honestRoundPoly_of_extend + intro j + exact Fin.elim0 j + rw [hbridge] + simpa [rExt] using honest_round0_domain_sum_eq_honest_claim (domain := domain) (p := p) (r := rExt) + +theorem claim_eq_honest_claim_of_accepts_and_all_rounds_honest_k_aux {๐”ฝ : Type _} {n : โ„•} [Field ๐”ฝ] [Fintype ๐”ฝ] [DecidableEq ๐”ฝ] + (k : Fin (n + 1)) + (st : SumcheckProtocolStatement ๐”ฝ n) + (P : Prover (sumcheckProtocol (๐”ฝ := ๐”ฝ) (n := n) k)) + (r : Fin k.val โ†’ ๐”ฝ) + (hall : + โˆ€ i : Fin k.val, + (proverTranscript k st P r).roundPolys i + = honestRoundPolyAtK k st.domain st.polynomial r i) + (hAcc : AcceptsEvent k st.domain st.polynomial st.claim (proverTranscript k st P r)) : + st.claim = honestClaim st.domain (p := st.polynomial) := by + classical + let t : Transcript ๐”ฝ k.val := proverTranscript k st P r + cases hk : k.val with + | zero => + have hk0 : k = 0 := by + apply Fin.ext + simp [hk] + subst hk0 + have hfinal : + t.claims st.claim (Fin.last 0) = + residualSum (๐”ฝ := ๐”ฝ) st.domain t.challenges st.polynomial (Nat.zero_le n) := by + exact decide_eq_true_eq.mp + (acceptsEvent_final_ok_k (k := 0) st.domain (p := st.polynomial) (claim := st.claim) (t := t) hAcc) + have hclaim0 : t.claims st.claim (Fin.last 0) = st.claim := by + simpa [Transcript.claims] using + (generate_honest_claims_zero st.claim t.roundPolys t.challenges) + have hchal0 : t.challenges = (fun i : Fin 0 => i.elim0) := by + funext i + exact i.elim0 + have hhonest0 : + residualSum (๐”ฝ := ๐”ฝ) st.domain t.challenges st.polynomial (Nat.zero_le n) + = honestClaim st.domain (p := st.polynomial) := by + simpa [honestClaim, hchal0] + calc + st.claim = t.claims st.claim (Fin.last 0) := by simpa using hclaim0.symm + _ = residualSum (๐”ฝ := ๐”ฝ) st.domain t.challenges st.polynomial (Nat.zero_le n) := hfinal + _ = honestClaim st.domain (p := st.polynomial) := hhonest0 + | succ m => + have hkpos : 0 < k.val := by + simpa [hk] + let i0 : Fin k.val := โŸจ0, hkposโŸฉ + have hsum0 : + st.domain.foldl (fun acc a => + acc + CPoly.CMvPolynomial.eval (fun _ : Fin 1 => a) (t.roundPolys i0)) 0 + = + t.claims st.claim (Fin.castSucc i0) := by + exact acceptsEvent_domain_sum_eq_claim_k k st.domain (p := st.polynomial) (claim := st.claim) (t := t) (i := i0) hAcc + have hi0 : t.roundPolys i0 = honestRoundPolyAtK k st.domain st.polynomial r i0 := by + simpa [t] using hall i0 + have hcast0 : Fin.castSucc i0 = 0 := by + apply Fin.ext + simp [i0] + have hclaim0 : t.claims st.claim (Fin.castSucc i0) = st.claim := by + rw [hcast0] + simpa [Transcript.claims] using + (generate_honest_claims_zero st.claim t.roundPolys t.challenges) + have hn_pos : 0 < n := by + omega + obtain โŸจn', hn'โŸฉ : โˆƒ n' : โ„•, n = Nat.succ n' := + Nat.exists_eq_succ_of_ne_zero (Nat.pos_iff_ne_zero.mp hn_pos) + subst hn' + have htrue : + st.domain.foldl (fun acc a => + acc + CPoly.CMvPolynomial.eval (fun _ : Fin 1 => a) + (honestRoundPolyAtK k st.domain st.polynomial r i0)) 0 + = honestClaim st.domain (p := st.polynomial) := by + simpa [i0] using + (honest_round0_atK_domain_sum_eq_honest_claim_aux (k := k) (domain := st.domain) + (p := st.polynomial) (r := r) hkpos) + calc + st.claim = t.claims st.claim (Fin.castSucc i0) := by simpa using hclaim0.symm + _ = st.domain.foldl (fun acc a => + acc + CPoly.CMvPolynomial.eval (fun _ : Fin 1 => a) (t.roundPolys i0)) 0 := by + symm + exact hsum0 + _ = st.domain.foldl (fun acc a => + acc + CPoly.CMvPolynomial.eval (fun _ : Fin 1 => a) + (honestRoundPolyAtK k st.domain st.polynomial r i0)) 0 := by + simp [hi0] + _ = honestClaim st.domain (p := st.polynomial) := htrue + +theorem accepts_on_challenges_dishonest_implies_bad_k_aux {๐”ฝ : Type _} {n : โ„•} [Field ๐”ฝ] [Fintype ๐”ฝ] [DecidableEq ๐”ฝ] + (k : Fin (n + 1)) + (st : SumcheckProtocolStatement ๐”ฝ n) + (P : Prover (sumcheckProtocol (๐”ฝ := ๐”ฝ) (n := n) k)) + (r : Fin k.val โ†’ ๐”ฝ) + (hDish : st.claim โ‰  honestClaim st.domain (p := st.polynomial)) + (hAcc : AcceptsEvent k st.domain st.polynomial st.claim (proverTranscript k st P r)) : + BadTranscriptEvent k st.domain st.polynomial (proverTranscript k st P r) := by + classical + let t := proverTranscript k st P r + by_contra hNoBad + have hall : + โˆ€ i : Fin k.val, + t.roundPolys i = honestRoundPolyAtK k st.domain st.polynomial t.challenges i := + all_rounds_honest_of_not_bad_k_aux k st.polynomial t st.domain hNoBad + have hall' : + โˆ€ i : Fin k.val, + (proverTranscript k st P r).roundPolys i = honestRoundPolyAtK k st.domain st.polynomial r i := by + intro i + simpa [t] using hall i + have hEq : st.claim = honestClaim st.domain (p := st.polynomial) := + claim_eq_honest_claim_of_accepts_and_all_rounds_honest_k_aux k st P r hall' hAcc + exact hDish hEq + theorem soundness_dishonest_k {๐”ฝ : Type _} {n : โ„•} [Field ๐”ฝ] [Fintype ๐”ฝ] [DecidableEq ๐”ฝ] (k : Fin (n + 1)) (st : SumcheckProtocolStatement ๐”ฝ n) @@ -420,7 +556,20 @@ theorem soundness_dishonest_k {๐”ฝ : Type _} {n : โ„•} [Field ๐”ฝ] [Fintype (h : st.claim โ‰  honestClaim st.domain (p := st.polynomial)) : probOverChallenges (E := AcceptsOnChallenges k st P) โ‰ค soundnessErrorK k st.polynomial := by - sorry + let hImp : โˆ€ r, AcceptsOnChallenges k st P r โ†’ AcceptsAndBadTranscriptOnChallenges k st P r := by + intro r hAcc + refine โŸจ?_, ?_โŸฉ + ยท simpa [AcceptsOnChallenges, AcceptsAndBadTranscriptOnChallenges] using hAcc + ยท + have hAcc' : AcceptsEvent k st.domain st.polynomial st.claim (proverTranscript k st P r) := by + simpa [AcceptsOnChallenges] using hAcc + exact accepts_on_challenges_dishonest_implies_bad_k_aux k st P r h hAcc' + have hMono : + probOverChallenges (E := AcceptsOnChallenges k st P) โ‰ค + probOverChallenges (E := AcceptsAndBadTranscriptOnChallenges k st P) := by + exact prob_over_challenges_mono hImp + exact le_trans hMono (soundness_k k st P) + -- Prob verifier accepts transcript when claim is not honest claim theorem soundness_dishonest {๐”ฝ : Type _} {n : โ„•} [Field ๐”ฝ] [Fintype ๐”ฝ] [DecidableEq ๐”ฝ]