Cirrus: Performant and Accountable Distributed SNARK

Cirrus: Performant and Accountable Distributed SNARK

Speakers: Wenhao Wang

Conference: NDSS Symposium 2026

YouTube: https://www.youtube.com/watch?v=Q40NrBkGbkk

Overview

This talk introduces Cirrus, the first distributed SNARK (Succinct Non-interactive Argument of Knowledge) protocol that simultaneously achieves three critical properties: linear scalability with low overhead, accountability for detecting faulty workers, and universal trusted setup that supports multiple applications without per-circuit ceremonies. As zero-knowledge proof workloads grow to support applications like ZK rollups, ZK machine learning, and ZK virtual machines, single-machine proving hits hard memory and time limits. Cirrus distributes the proving workload across multiple machines while keeping per-worker communication logarithmic in circuit size.

The results are compelling: Cirrus proves 33 million gate circuits in under 40 seconds using 32 machines, compared to the baseline HyperPlonk which takes over 100 seconds for just 4 million gates before hitting memory bounds. Per-worker communication is only 40 kilobytes, proof size matches standard HyperPlonk at a few kilobytes, and the accountability protocol completes in just a few seconds even for large circuits. Cirrus achieves over 7x faster proof generation than the prior accountable system Hecaton on Plonk-friendly tasks like Poseidon hash.

Background

▶ Watch: Why SNARKs need distribution: memory and time limits (0:00)

SNARKs are cryptographic proofs that allow a prover to convince a verifier that a computation was performed correctly without the verifier needing to re-execute the computation. They are foundational to blockchain scaling solutions (ZK rollups), privacy-preserving computation, and verifiable outsourced computation. However, generating SNARK proofs is computationally expensive -- large circuits require enormous memory and extended proving times.

The natural solution is distribution: partition a large circuit into chunks and assign each chunk to a separate worker machine. But prior distributed SNARK protocols failed to achieve all three desirable properties simultaneously. Some had high communication overhead (super-linear in circuit size), others lacked accountability (no way to identify which worker produced incorrect proofs), and many required circuit-specific trusted setup ceremonies that are cumbersome in practice.

Accountability is particularly important for proof outsourcing markets, where organizations pay external workers to generate proofs. Without accountability, a malicious worker can submit garbage proofs, and the coordinator has no efficient way to identify the culprit. Universal setup (as opposed to circuit-specific setup) is critical for real-world deployments where the same infrastructure needs to support multiple applications and varying numbers of workers.

Prior work like Hecaton achieved accountability but used R1CS arithmetization with circuit-specific setup, making deployment difficult. Collaborative SNARKs (e.g., ZKSaaS) used MPC frameworks to protect witness privacy but at the cost of each worker essentially generating a proof for the entire circuit, resulting in much higher per-worker computational costs.

Key Findings

▶ Watch: Distributed multilinear KZG polynomial commitment scheme (4:00)

First to achieve all three properties: Cirrus is the first distributed SNARK protocol to simultaneously achieve linear worker scalability, accountability, and universal trusted setup. Prior work always missed at least one of these properties.

Near-linear scaling: Per-worker workload is linear only in the size of the assigned chunk, not the global circuit. Per-worker communication is logarithmic in the polynomial (circuit chunk) size. Coordinator overhead remains below one second even with thousands or tens of thousands of workers.

Fast accountability: The two-stage fault localization protocol completes in just a few seconds even for very large circuits. Stage one checks individual multilinear KZG opening proofs; stage two re-evaluates witness polynomials at a shared random point using field operations already held in coordinator memory.

Dramatic performance improvement: 33 million gates proved in under 40 seconds with 32 workers versus 100+ seconds for 4 million gates on a single machine with HyperPlonk. Over 7x faster than Hecaton on Plonk-friendly benchmarks with the same number of workers.

Simple circuit partitioning: The circuit is written as an array and divided evenly into chunks -- no gate-type analysis, wiring considerations, or complex partitioning algorithms required.

Technical Deep Dive

▶ Watch: Benchmarks: 33M gates in 40 seconds with 32 workers (10:00)

Cirrus builds on a layered construction of cryptographic building blocks.

Distributed Multilinear KZG Polynomial Commitment Scheme: The global polynomial f is partitioned into sub-polynomials, each assigned to a worker. For commitment, each worker commits to its local chunk using vanilla multilinear KZG, and the coordinator aggregates by multiplying commitments to form the global commitment. Critically, this uses the same KZG parameters as the original setup -- no additional parameter generation needed. For opening, workers compute local opening proofs and send them to the coordinator, who aggregates evaluations by summation and proofs by product with minimal additional work. Each worker sends only log-tier group elements per opening, keeping communication logarithmic.

Distributed Sum-Check Protocol: Sum-check proves that the sum of a multilinear polynomial over the Boolean hypercube {0,1}^n equals a target value. In the distributed version, each worker proves a sum-check claim about its local chunk individually, and results are aggregated by the coordinator. A key challenge arises: at the end of sum-check, workers must open the polynomial at the same random point, but the polynomial being checked may have degree higher than one, while KZG only supports degree-one (multilinear) commitments.

Polynomial Splitting Compatibility Trick: This is the core mathematical innovation. A higher-degree polynomial is decomposed into multiple degree-one (multilinear) polynomials, and each is committed separately. The correctness guarantee is that polynomial splitting preserves equality over the Boolean hypercube. This trick enables smooth composition of distributed sum-check with distributed multilinear KZG.

Two-Stage Accountability Protocol: The protocol is optimistic -- if the final proof verifies, all workers behaved correctly by the soundness of the SNARK. Fault localization only runs when verification fails:

• Stage 1: Check each worker's multilinear KZG opening proof individually to identify workers with invalid proofs.
• Stage 2: Re-evaluate each worker's witness polynomial at a shared random point using field operations held in coordinator memory.

The threat model assumes any worker can be malicious, but the coordinator is always honest. Witness privacy is explicitly out of scope -- all workers receive the full witness.

Arithmetization: Cirrus uses Plonk arithmetization (as opposed to Hecaton's R1CS), which enables the universal setup property and better performance on Plonk-friendly workloads like Poseidon hash.

Demo / Proof of Concept

▶ Watch: Comparison with Hecaton: 7x faster on Poseidon hash (12:00)

No live demo was performed. Benchmarks were presented comparing Cirrus against HyperPlonk (single-machine baseline) and Hecaton (prior accountable distributed SNARK). Key numbers: 33 million gates in under 40 seconds with 32 workers, 40 KB per-worker communication, proof size of a few kilobytes matching HyperPlonk, accountability protocol completing in seconds, coordinator cost below one second even at thousands of workers, and 7x+ speedup over Hecaton on Poseidon hash benchmarks.

Defensive Implications

▶ Watch: Q&A: real-world applications in proof outsourcing markets (16:00)

Cirrus's primary impact is on the zero-knowledge proof infrastructure that underpins blockchain security and privacy-preserving computation. By enabling efficient distributed proof generation with accountability, it directly supports:

ZK rollup scaling: Layer 2 blockchain solutions rely on timely proof generation. Cirrus enables proof outsourcing to distributed worker markets with cryptographic accountability, reducing centralization risk in proof generation infrastructure.

Verifiable computation outsourcing: Organizations outsourcing computation to untrusted cloud providers can use Cirrus to verify correctness without re-executing the work, with accountability ensuring individual faulty workers are identified.

Proof market integrity: The accountability property enables economic incentive design in proof markets -- workers who submit faulty proofs can be identified and penalized, creating trustworthy marketplaces for proof generation.

From a security perspective, the honest coordinator assumption is a meaningful limitation. If the coordinator is compromised, the accountability guarantees break down. Future work extending accountability to scenarios with untrusted coordinators or fully decentralized coordination would strengthen the security model.

Key Takeaways

• Cirrus is the first distributed SNARK achieving linear scalability, accountability, and universal setup simultaneously
• 33 million gate circuits proved in under 40 seconds with 32 workers, with only 40 KB per-worker communication
• The polynomial splitting compatibility trick enables smooth composition of distributed sum-check with distributed multilinear KZG
• Two-stage fault localization completes in seconds, enabling practical proof outsourcing with accountability
• Over 7x faster than Hecaton on Plonk-friendly tasks with the same worker count
• Circuit partitioning is trivially simple -- even array splitting with no wiring analysis required
• Future directions include distributing post-quantum secure SNARK protocols like BaseFold and FRI

About the Speaker(s)

Wenhao Wang presented this work, which was conducted in collaboration with researchers including Feiyu, Danny, and Fan. Wang demonstrated strong knowledge of the zero-knowledge proof ecosystem, distributed systems design, and the practical deployment requirements for proof outsourcing markets. The research sits at the intersection of theoretical cryptography and systems engineering for blockchain infrastructure.