Zero-knowledge proof circuit solving method and computing device
By splitting the circuit constraint set into sub-constraint sets and solving them sequentially, the problem of large circuit constraint sets being unable to be solved directly is solved, enabling effective review of zero-knowledge proof circuits and improving the efficiency and accuracy of circuit correctness review.
Patent Information
- Authority / Receiving Office
- WO · WO
- Patent Type
- Applications
- Current Assignee / Owner
- ANT BLOCKCHAIN TECHNOLOGY (SHANGHAI) CO LTD
- Filing Date
- 2025-10-30
- Publication Date
- 2026-07-02
Smart Images
Figure CN2025131178_02072026_PF_FP_ABST
Abstract
Description
Zero-knowledge proof circuit solution methods and computing devices
[0001] This application claims priority to Chinese Patent Application No. 2024119691556, filed on December 27, 2024, entitled “Method and Computational Device for Solving Zero-Knowledge Proof Circuits”, the entire contents of which are incorporated herein by reference. Technical Field
[0002] The embodiments in this specification belong to the field of privacy computing technology, and in particular relate to methods and computing devices for solving zero-knowledge proof circuits. Background Technology
[0003] Zero-knowledge proof (ZKP) is a key cryptographic technique that has been widely applied in fields such as blockchain, digital identity authentication, and privacy computing. Its core characteristic is that it allows the prover to demonstrate the correctness of a proposition to the verifier without revealing any additional information. This feature makes it a crucial pillar for building trustworthy and privacy-preserving systems.
[0004] For example, in machine learning applications, there are two parties involved: the data holder and the model holder. The data holder sends the data to be predicted to the model holder, who then uses its proprietary model to make the prediction and returns the result to the data holder. However, since the model is usually the private asset of the model holder, the data holder cannot directly understand the specific details of the prediction process and therefore cannot confirm whether the prediction result was generated by the model.
[0005] At this point, the model holder can act as a prover, using zero-knowledge proof techniques to demonstrate the correctness of the prediction process to the data holder, including that the correct model was used to make the correct prediction, without disclosing the model details or the details of the prediction process. The data holder, acting as a verifier, can verify the proof provided by the model holder to ascertain the correctness of the prediction process.
[0006] The security of a zero-knowledge proof system largely depends on the correctness of its underlying zero-knowledge proof circuit (hereinafter referred to as "the circuit"). When the prover transforms the proposition to be proved into a zero-knowledge proof circuit, vulnerabilities may exist within that circuit. As the core architecture of the system, any vulnerabilities or defects in the circuit will pose serious security risks. Malicious attackers may exploit these vulnerabilities to construct false proofs, thereby bypassing the verification system and interfering with or manipulating it, resulting in serious consequences such as financial losses and data tampering. Therefore, before using the circuit to generate a zero-knowledge proof, it is necessary to review the circuit's correctness and check for any circuit defects.
[0007] For circuits with constraints, such as R1CS (Rank-1 Constraint Systems), PLONK circuits, Halo2 circuits, etc., these circuits have a set of constraints, each containing circuit variables. Proofreaders generate zero-knowledge proofs based on this set of constraints. Circuit constraints can contain equality and inequality expressions related to circuit variables. By solving this set of constraints and counting the number of feasible solutions, it can be determined whether the constraints are correctly applied, serving as part of the correctness check for this type of circuit. When the number of feasible solutions is 0, the circuit is overconstrained; when there is exactly one feasible solution, the circuit is correctly constrained; when there are more than one feasible solution, the circuit is underconstrained. Overconstraints and underconstraints are not correct constraints and indicate circuit defects.
[0008] Solving circuit constraint sets can be accomplished using constraint solvers. However, for the constraint sets of some large circuits, current constraint solvers often cannot solve them directly due to the large number of constraints and variables in the circuit. Therefore, a method is needed to solve the circuit constraint sets of large circuits in order to achieve correctness verification of large circuits. Summary of the Invention
[0009] The purpose of this specification is to provide a method and computing device for solving zero-knowledge proof circuits, which are designed to solve circuit constraint sets in order to verify the correctness of zero-knowledge proof circuits.
[0010] This specification provides a method for solving zero-knowledge proof circuits, wherein the zero-knowledge proof circuit includes a first set of circuit constraints, the variables in the circuit constraints corresponding to parameters in a target model; the target model is used to make predictions based on input data; the values of specific variables in the first set of circuit constraints are determined by the input data; the method includes:
[0011] The first circuit constraint group is divided into a plurality of sequentially arranged sub-constraint groups; in the plurality of sub-constraint groups, the i-th sub-constraint group includes a first variable and a second variable, wherein the first i-1 sub-constraint groups include the first variable but do not include the second variable;
[0012] The constraint solver is used to solve each sub-constraint group sequentially according to the arrangement order of the plurality of sub-constraint groups to obtain the solution of the first circuit constraint group; wherein, when solving the i-th sub-constraint group, the solutions of the first i-1 sub-constraint groups are used as circuit constraints and added to the i-th sub-constraint group; the solutions of the first i-1 sub-constraint groups include the value of the first variable.
[0013] In some possible implementations, the target model is a tree model, and each circuit constraint in the first circuit constraint group corresponds to a split node in the tree model.
[0014] In some possible implementations, the input data is text data.
[0015] In some possible implementations, the zero-knowledge proof circuit includes multiple circuit constraints; the method further includes:
[0016] The multiple circuit constraints are divided into several circuit constraint groups, including the first circuit constraint group; each variable in any circuit constraint group does not belong to any other circuit constraint group.
[0017] In some possible implementations, the plurality of circuit constraints are divided into several groups of circuit constraints, including:
[0018] For each variable in the multiple circuit constraints, generate corresponding graph nodes;
[0019] Traverse each circuit constraint and connect the graph nodes corresponding to the variables belonging to the same circuit constraint to obtain several subgraphs.
[0020] Based on the variables corresponding to the graph nodes in each subgraph, generate the corresponding circuit constraint groups.
[0021] In some possible implementations, corresponding circuit constraint groups are generated based on the variables corresponding to the graph nodes in each subgraph, including:
[0022] For any subgraph, determine a number of circuit constraints that contain the variables corresponding to each graph node in the subgraph, and add the number of circuit constraints to the circuit constraint group corresponding to the subgraph.
[0023] In some possible implementations, solving the i-th sub-constraint set includes:
[0024] Determine whether the number of solutions has reached the preset second threshold; if not, add the solutions of the first i-1 sub-constraint groups as the second circuit constraints to the i-th sub-constraint group, and use the constraint solver to solve the i-th sub-constraint group; if there is a solution, increase the number of solutions by 1, and start solving the (i+1)-th sub-constraint group.
[0025] In some possible implementations, solving the i-th sub-constraint set further includes:
[0026] If the number of solutions reaches the second threshold and i = 1, then the first circuit constraint group has no solution;
[0027] If the number of solutions reaches the second threshold and i>1, then the number of solutions is cleared, the solution of the (i-1)th sub-constraint group is set as infeasible, and the solution of the (i-1)th sub-constraint group is started.
[0028] In some possible implementations, the solution to the (i-1)th sub-constraint group is set as infeasible, including:
[0029] Add a third circuit constraint to the (i-1)th sub-constraint group. The third circuit constraint is used to ensure that each variable in the (i-1)th sub-constraint group is not equal to the value in the solution of the (i-1)th sub-constraint group.
[0030] A second aspect of this specification provides a method for solving zero-knowledge proof circuits, wherein the zero-knowledge proof circuit includes a first set of circuit constraints; the method includes:
[0031] The first circuit constraint group is divided into a plurality of sequentially arranged sub-constraint groups; in the plurality of sub-constraint groups, the i-th sub-constraint group includes a first variable and a second variable, wherein the first i-1 sub-constraint groups include the first variable but do not include the second variable;
[0032] The constraint solver is used to solve each sub-constraint group sequentially according to the arrangement order of the plurality of sub-constraint groups to obtain the solution of the first circuit constraint group; wherein, when solving the i-th sub-constraint group, the solutions of the first i-1 sub-constraint groups are used as circuit constraints and added to the i-th sub-constraint group; the solutions of the first i-1 sub-constraint groups include the value of the first variable.
[0033] In some possible implementations, the zero-knowledge proof circuit includes multiple circuit constraints; the method further includes:
[0034] The multiple circuit constraints are divided into several circuit constraint groups, including the first circuit constraint group; each variable in any circuit constraint group does not belong to any other circuit constraint group.
[0035] In some possible implementations, it also includes:
[0036] The solutions of each circuit constraint group are summarized to obtain the solution of the zero-knowledge proof circuit; wherein, when each circuit constraint group has a solution, the set of solutions of each circuit constraint group is taken as the solution of the zero-knowledge proof circuit; when any circuit constraint group has no solution, the zero-knowledge proof circuit has no solution.
[0037] In some possible implementations, solving the i-th sub-constraint set includes:
[0038] Determine whether the number of solutions has reached the preset second threshold; if not, add the solutions of the first i-1 sub-constraint groups as the second circuit constraints to the i-th sub-constraint group, and use the constraint solver to solve the i-th sub-constraint group; if there is a solution, increase the number of solutions by 1, and start solving the (i+1)-th sub-constraint group.
[0039] In some possible implementations, solving the i-th sub-constraint set further includes:
[0040] If the i-th sub-constraint group has no solution, then set the number of times it is solved to the second threshold, and start solving the i-th sub-constraint group.
[0041] In some possible implementations, solving the i-th sub-constraint set further includes:
[0042] If the number of solutions reaches the second threshold and i = 1, then the first circuit constraint group has no solution;
[0043] If the number of solutions reaches the second threshold and i>1, then the number of solutions is cleared, the solution of the (i-1)th sub-constraint group is set as infeasible, and the solution of the (i-1)th sub-constraint group is started.
[0044] In some possible implementations, the solution to the (i-1)th sub-constraint group is set as infeasible, including:
[0045] Add a third circuit constraint to the (i-1)th sub-constraint group. The third circuit constraint is used to ensure that each variable in the (i-1)th sub-constraint group is not equal to the value in the solution of the (i-1)th sub-constraint group.
[0046] In some possible implementations, the second circuit constraint is used to make each variable in the first i-1 sub-constraint groups equal to the value in the solution of the first i-1 sub-constraint groups.
[0047] A third aspect of this specification provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the methods described in the first or second aspect.
[0048] A fourth aspect of this specification provides a computing device, including a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method described in the first or second aspect.
[0049] This specification provides a computer program product in a fifth aspect, including a computer program / instructions that, when executed by a processor, implement the steps of the method described in the first or second aspect.
[0050] The zero-knowledge proof circuit solving method and computing device proposed in the embodiments of this specification involve splitting a circuit constraint set into multiple sub-constraint sets, solving each sub-constraint set sequentially using a constraint solver, and substituting the solutions of previously solved sub-constraint sets as circuit constraints into the solution process of subsequent sub-constraint sets. By splitting a large circuit constraint set into multiple smaller sub-constraint sets and solving them sequentially, the embodiments of this specification expand the range of solvable circuit constraint sets, enabling the verification of the correctness of more zero-knowledge proof circuits. Attached Figure Description
[0051] To more clearly illustrate the technical solutions of the embodiments in this specification, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0052] Figure 1 is a schematic flowchart of a zero-knowledge proof circuit solution method in one embodiment of this specification;
[0053] Figure 2 is a flowchart of a zero-knowledge proof circuit solution method in one embodiment of this specification;
[0054] Figure 3 is a flowchart illustrating the zero-knowledge proof circuit solution method in one example of this specification;
[0055] Figure 4 is a flowchart of solving the i-th sub-constraint group in one embodiment of this specification;
[0056] Figure 5 is a schematic diagram of the generation of a subgraph in one example of this specification;
[0057] Figure 6 is a schematic block diagram of a zero-knowledge proof circuit solving device in one embodiment of this specification. Detailed Implementation
[0058] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this specification.
[0059] Figure 1 is a flowchart illustrating a zero-knowledge proof circuit solving method in one embodiment of this specification. In the example in Figure 1, the circuit constraint group M to be solved contains several constraints, each constraint including one or more circuit constraint variables. First, the circuit constraint group M is divided into n mutually exclusive sub-constraint groups, namely sub-constraint groups M1, M2, ..., Mn. n The union of all sub-constraint groups forms the circuit constraint group M. Then, starting with sub-constraint group M1, the constraint solver is used to solve each sub-constraint group M sequentially. i And obtain the solutions V for each sub-constraint group. i Among them, in solving the i-th sub-constraint group M i When the solution of the first i-1 sub-constraint groups is used as a circuit constraint, it is added to the i-th sub-constraint group M. i In the middle, then apply the sub-constraint group M i Solve to obtain the i-th sub-constraint group M i Solution V i Then, summarize and merge the various sub-constraint groups M. i Solution V i Thus, the solution V of the circuit constraint group M is obtained.
[0060] The solutions of the first i-1 sub-constraint groups are used as circuit constraints and added to the i-th sub-constraint group M. i Specifically, this includes: using the solutions of the first i-1 sub-constraint groups as circuit constraints, and assigning the variables in each solution to the i-th sub-constraint group M. i Set it to a constant, and then add it to the i-th sub-constant group M. i middle.
[0061] For example, a circuit constraint group M has three sub-constraint groups: M1, M2, and M3. M1 contains variables a1 and a2, M2 contains variables a2 and a3, and M3 contains variables a2, a3, and a4. First, the constraint solver is used to solve M1, yielding the corresponding solution V1, for example, a1 = 0 and a2 = 1. Then, the solution a1 = 0 and a2 = 1 from V1 is added as a constraint to M2, and a1 and a2 are set as constants in M2 (at this point, M2 only contains the variable a3). The constraint solver is then used to solve M2, yielding the corresponding solution V2, for example, a3 = 3. Next, the solution a1 = 0, a2 = 1, and a3 = 3 from V1 and V2 is added as a constraint to M3, and a1, a2, and a3 are set as constants in M2 (at this point, M3 only contains the variable a4). The constraint solver is then used to solve M3, yielding the corresponding solution V3, for example, a4 = 0. Finally, by summing up V1, V2, and V3, we obtain the solution V of the circuit constraint group M, namely a1 = 0, a2 = 1, a3 = 3, and a4 = 0.
[0062] It should be noted that when solving a certain sub-constraint group, there may be a situation where there is no solution. The specific handling method for the situation where there is no solution for a sub-constraint group will be described in detail in subsequent embodiments.
[0063] The following describes the specific implementation steps of the above-mentioned zero-knowledge proof circuit solution method with reference to specific embodiments.
[0064] Figure 2 is a flowchart of a zero-knowledge proof circuit solution method in one embodiment of this specification. The execution subject of the method can be any platform, server, or device cluster with computing and processing capabilities. As shown in Figure 2, the zero-knowledge proof circuit includes a first circuit constraint group, where the variables in the circuit constraints correspond to the parameters in the target model. The target model is used to make predictions based on input data. The values of specific variables in the first circuit constraint group are determined by the input data. The method includes: step 204, splitting the first circuit constraint group into multiple sequentially arranged sub-constraint groups; in the multiple sub-constraint groups, the i-th sub-constraint group includes a first variable and a second variable, wherein the first i-1 sub-constraint groups include the first variable but do not include the second variable; step 206, using a constraint solver to solve each sub-constraint group sequentially according to the arrangement order of the multiple sub-constraint groups to obtain the solution of the first circuit constraint group; wherein, when solving the i-th sub-constraint group, the solutions of the first i-1 sub-constraint groups are added to the i-th sub-constraint group as circuit constraints; the solutions of the first i-1 sub-constraint groups include the values of the first variable.
[0065] The target model can be a predictive model, which makes predictions based on the input data to obtain the prediction result. The circuit constraint set in the zero-knowledge proof circuit is used to generate a zero-knowledge proof that demonstrates the correctness of the above prediction process.
[0066] The first set of circuit constraints can be obtained by transforming the prediction process of the target model, wherein the variables in each circuit constraint correspond to the parameters in the target model. Specific variables in the first set of circuit constraints may include relevant variables in the input circuit, which correspond to the input parameters of the target model, and their specific values are determined by the input data.
[0067] In one embodiment, the target model is a tree model. The input data to the tree model can correspond to the input circuit of a zero-knowledge proof circuit, and the prediction result can correspond to the output circuit of the zero-knowledge proof circuit. Each circuit constraint in the first circuit constraint group corresponds to the splitting node (decision node) and leaf node in the tree model.
[0068] Specifically, some constraints in the first circuit constraint group can be gate constraints, used to constrain the structure of the tree, including the hash value of the leaf nodes; the other part of the constraints are lookup table constraints, corresponding to the threshold on the split nodes.
[0069] Tree models can be used for prediction in various scenarios. For example, in one embodiment, a tree model can be used in an anti-fraud scenario to predict whether a user and / or transaction is a risky user and / or a risky transaction. In this case, the input data may include at least one of user characteristics and transaction information, and the prediction result may be the tree model's prediction of whether the input user / transaction is risky.
[0070] In another embodiment, the input data is text data. For example, it could be information related to users and / or transactions in an anti-fraud scenario.
[0071] The specific execution process of each of the above steps is described below.
[0072] First, in step 204, the first circuit constraint group is split into a plurality of sequentially arranged sub-constraint groups; in the plurality of sub-constraint groups, the i-th sub-constraint group includes a first variable and a second variable, wherein the first i-1 sub-constraint groups include the first variable but do not include the second variable.
[0073] The first circuit constraint group can be denoted as M, and the total number of sub-constraint groups can be n. The splitting can be done in any way. Each sub-constraint group is mutually exclusive, and the union of all sub-constraint groups constitutes the first circuit constraint group. That is, any circuit constraint in the first circuit constraint group is assigned to one and only one sub-constraint group. The multiple sub-constraint groups can be denoted as M1, M2, ..., M n .
[0074] In one embodiment, the first circuit constraint group can be divided into n groups on average, and the circuit constraints can be assigned to the respective sub-constraint groups according to their order within the first circuit constraint group. Alternatively, in another embodiment, the circuit constraints in the first circuit constraint group can be randomly assigned to the n groups. No limitation is imposed here.
[0075] The order arrangement in step 204 can be any order, as long as the order is determined and then kept unchanged in subsequent steps.
[0076] For example, a first circuit constraint group with 10,000 circuit constraints can be divided into 10 sub-constraint groups, each containing 1,000 circuit constraints. The first sub-constraint group contains circuit constraints 1-1000 from the first circuit constraint group, the second sub-constraint group contains circuit constraints 1001-2000 from the first circuit constraint group, and so on.
[0077] In one embodiment, the number of constraints in any one of the plurality of sub-constraint groups is less than or equal to a preset first threshold. The first threshold may be related to the maximum number of constraints that the constraint solver can solve. For example, the first threshold may be the maximum number of constraints that the constraint solver can solve, or 0.8 times the maximum number of constraints that the constraint solver can solve, etc.
[0078] After determining the first threshold, the number of multiple sub-constraint groups is the total number of circuit constraints in the first circuit constraint group, divided by the first threshold and rounded up.
[0079] Then, in step 206, the constraint solver is used to solve each sub-constraint group in the order of the arrangement of the plurality of sub-constraint groups to obtain the solution of the first circuit constraint group; wherein, when solving the i-th sub-constraint group, the solutions of the first i-1 sub-constraint groups are added to the i-th sub-constraint group as circuit constraints; the solutions of the first i-1 sub-constraint groups include the value of the first variable.
[0080] Use the constraint solver to solve the sub-constraint groups M1, M2, ..., M in sequence. n The solution to the first circuit constraint group M is obtained. Any constraint solver can be used for solving, such as the CVC5 constraint solver, the Z3 constraint solver, etc., without limitation.
[0081] In one embodiment, the solutions of the first i-1 sub-constraint groups are used as circuit constraints and added to the i-th sub-constraint group, specifically including:
[0082] The solutions of the first i-1 sub-constraint groups are used as circuit constraints and added to the i-th sub-constraint group. In the i-th sub-constraint group, the variables in the first i-1 sub-constraint groups are declared as constants.
[0083] Since step 204 describes the i-th sub-constraint group as including a first variable and a second variable, wherein the first i-1 sub-constraint groups include the first variable but do not include the second variable, in this embodiment, the i-th sub-constraint group includes the value of the first variable as a constraint, and the first variable is declared as a constant in the i-th sub-constraint group; in addition, the second variable is still declared as a variable in the i-th constraint group.
[0084] By solving each sub-constraint group M in sequence i And summarize the solutions V of each sub-constraint group i The solution V of the first circuit constraint group M can be obtained. The i-th sub-constraint group M i Solution V i Including the i-th sub-constraint group M i The values of the variables that are still declared as variables in the table.
[0085] In some possible implementations, since the first circuit constraint group M is split into multiple smaller sub-constraint groups and solved separately, the solutions for each sub-constraint group may not be unique due to the reduced number of constraints. In fact, the number of feasible solutions may be infinite, and only a small number of these feasible solutions may be the true solutions for the first circuit constraint group. When using a constraint solver to solve a sub-constraint group, the solver typically only outputs the first solution it finds that satisfies that sub-constraint group. This solution may not be the solution for the first circuit constraint group. Specifically, when the solution of this sub-constraint group is added as a constraint to subsequent sub-constraint groups and solved, some subsequent sub-constraint groups may have no solution, thus preventing further solving.
[0086] To address this issue, the embodiments in this specification employ a method similar to depth-first search. After obtaining a solution for each sub-constraint group, this solution is added as a constraint to the subsequent sub-constraint groups, and the process continues to solve the next sub-constraint group. This continues until a sub-constraint group has no solution, indicating that the solution of a previous sub-constraint group was not a correct solution for the first circuit constraint group. At this point, the process backtracks to the previous sub-constraint group and sets the solution of that sub-constraint group as infeasible. Specifically, in that sub-constraint group, each variable in the solution is set to be non-equal to its value, and the relationship between the non-equalities is "OR". Then, the sub-constraint group is solved again. If a solution is found, the process continues to solve the next sub-constraint group; if no solution is found, the process continues backtracking. This process is repeated.
[0087] The process described above is first illustrated with a simple example, and then the specific implementation of the depth-first search used in step 206 to solve each sub-constraint group is described.
[0088] In one example, the first circuit constraint group M includes four circuit constraints, as shown below: a0(a1-1)=0 a1(a1-1)=0 a2(a2-1)=0 a0+2a1+4a2-7=0
[0089] Here, a0, a1, and a2 are variables. They are divided into two sub-constraint groups: the first sub-constraint group M1 contains the first two circuit constraints, and the second sub-constraint group M2 contains the last two circuit constraints. The process of solving the sub-constraint groups sequentially is shown in Figure 3. Figure 3 is a flowchart illustrating the zero-knowledge proof circuit solution method in an example from this specification.
[0090] First, the constraint solver is used to solve sub-constraint group M1, obtaining a solution a0 = 0, a1 = 0. This solution is added as a constraint to sub-constraint group M2, and a0 and a1 are declared as constants in sub-constraint group M2. At this point, only a2 is a variable in sub-constraint group M2. Then, the constrained sub-constraint group M2 is solved. If no solution is found, the process returns to sub-constraint group M1, and the constraint a0 ≠ 0 or a1 ≠ 0 is added to it.
[0091] Then, the sub-constraint group M1 is solved again, and another solution a0 = 0, a1 = 1 is obtained. This solution is added as a constraint to the sub-constraint group M2, and a0 and a1 are declared as constants in the sub-constraint group M2. The sub-constraint group M2 with the added constraints is then solved. If no solution is found, the solution is returned to the sub-constraint group M1, and the constraint a0 ≠ 0 or a1 ≠ 1 is added to it.
[0092] Then, sub-constraint group M1 is solved again, yielding another solution a0 = 1, a1 = 1. This solution is added as a constraint to sub-constraint group M2, and a0 and a1 are declared as constants in sub-constraint group M2. Sub-constraint group M2 with the added constraints is then solved, yielding a2 = 1. The solutions from sub-constraint groups M1 and M2 are then combined to obtain the solution for the first circuit constraint group M: a0 = 1, a1 = 1, a2 = 1.
[0093] The above describes a specific example of solving for each sub-constraint group based on depth-first search. The following describes the specific steps of the depth-first search in step 206.
[0094] In one embodiment, solving the i-th sub-constraint group in step 206 includes:
[0095] Determine whether the number of solutions has reached the preset second threshold; if not, add the solutions of the first i-1 sub-constraint groups as the second circuit constraints to the i-th sub-constraint group, and use the constraint solver to solve the i-th sub-constraint group; if there is a solution, increase the number of solutions by 1, and start solving the (i+1)-th sub-constraint group.
[0096] The i-th sub-constraint group M i The number of solutions can be c. i The second threshold can be max_iter. Since there may be multiple or even an infinite number of feasible solutions for a certain sub-constraint group (for example, when a certain sub-constraint group is a system of Diophantine equations), in order to avoid the solution process taking too long or failing to terminate, a second threshold is set to control the total number of solution attempts and avoid consuming too many computational resources.
[0097] When the i-th sub-constraint group M i The number of solutions c iThe second threshold is not reached, i.e., c i <When it is less than max_iter, it means that the solution of M can be continued to be solved i . At this time, first take the solutions V1 to V of the first i - 1 sub - constraint groups i-1 as the second circuit constraint and add it to the i - th sub - constraint group M i . The second circuit constraint is used to make each variable in the first i - 1 sub - constraint groups equal to the value in the solution of the first i - 1 sub - constraint groups. Then, use the constraint solver to solve the i - th sub - constraint group M i . If there is a solution, then add 1 to c i and start to solve the subsequent (i + 1) - th sub - constraint group M i+1 . It can be understood that the process of solving the (i + 1) - th sub - constraint group M i+1 will also follow the process of step 206, except that i is replaced by i + 1.
[0098] If the i - th sub - constraint group M i has no solution, then set its number of solution attempts c i to the second threshold max_iter, that is, make c i = max_iter and start to solve the i - th sub - constraint group M i . That is, return to the previous step of "judging whether its number of solution attempts reaches the preset second threshold" and continue.
[0099] At this time, judge again whether its number of solution attempts c i reaches the preset second threshold max_iter. At this time, it is found that the second threshold max_iter is reached. Then continue to judge whether i is equal to 1. If i = 1, it means that there is no way to go back, so the first circuit constraint group M has no solution as a whole.
[0100] If the number of solution attempts c i reaches the second threshold max_iter and i > 1, then clear its number of solution attempts, that is, make c i = 0, set the solution of the (i - 1) - th sub - constraint group to be infeasible, and start to solve the (i - 1) - th sub - constraint group M i-1 . It can be understood that the process of solving the (i - 1) - th sub - constraint group M i-1 will also follow the process of step 206, except that i is replaced by i - 1.
[0101] Specifically, setting the solution of the (i - 1) - th sub - constraint group to be infeasible includes: adding a third circuit constraint to the (i - 1) - th sub - constraint group M i-1 . The third circuit constraint is used to make each variable in the (i - 1) - th sub - constraint group M i-1 not equal to the value in the solution V i-1 of the (i - 1) - th sub - constraint group.
[0102] Through the above steps, each sub-constraint group is solved sequentially using a depth-first search approach. The solutions from previous sub-constraint groups are added as constraints to subsequent sub-constraint groups for further solving. If a sub-constraint group has no solution, the process backtracks. This allows for the solution of each sub-constraint group, or the determination that the overall first circuit constraint group M has no solution. When the last sub-constraint group M... n If a solution exists, it means that the first circuit constraint group M of the whole system has a solution. Then, the individual sub-constraint groups M are... i Solution V i The solutions are summarized to obtain the solution V for the first circuit constraint group M. When the overall size of the first circuit constraint group M exceeds the maximum size that the constraint solver can support, the method described in this specification can also be used for solving.
[0103] The above steps can also be illustrated in Figure 4, which is a flowchart of solving the i-th sub-constraint group in one embodiment of this specification. It should be noted that the steps within the middle box of Figure 4 are for solving M... i The specific steps are as follows. Therefore, the solution to M is shown in Figure 4 below. i+1 And the solution M on the right side of Figure 4 i-1 It can also be expanded into specific steps similar to those in the middle box of Figure 4, except that they are not shown in Figure 4.
[0104] In some possible implementations, the zero-knowledge proof circuit includes multiple circuit constraints; the method further includes:
[0105] Step 202: Divide the multiple circuit constraints into several circuit constraint groups, including the first circuit constraint group; each variable in any circuit constraint group does not belong to any other circuit constraint group.
[0106] When there are some unrelated circuit constraints among the multiple circuit constraints included in the original zero-knowledge proof circuit, these circuit constraints can be divided into different circuit constraint groups so that each variable in any circuit constraint group does not belong to any other circuit constraint group. Then, each circuit constraint group can be solved using the methods in steps 204 to 206.
[0107] For example, multiple circuit constraints can be as follows: b0-b1=0 b1-1=0 b2×b3=0 b2+b4=0
[0108] It can be observed that if the circuit constraint is divided into two groups, the first group includes the first two circuit constraints, and the second group includes the last two circuit constraints. In this case, variables b0 and b1 in the first group do not belong to the second group, and variables b2, b3, and b4 in the second group do not belong to the first group. Therefore, the values of the variables in the two groups do not affect each other in the solution process, and the two groups can be solved separately.
[0109] A graph can be used to record the constraints between variables in each circuit constraint. For any circuit constraint, the variables within it are mutually constrained, corresponding to connections between their respective nodes in the graph. Therefore, by traversing each circuit constraint and connecting the graph nodes corresponding to the variables belonging to the same circuit constraint, and then examining the connection results, variables belonging to the same subgraph belong to the same circuit constraint group. By adding all circuit constraints containing these variables to the same circuit constraint group, multiple circuit constraints can be divided into several circuit constraint groups.
[0110] In one embodiment, step 202 specifically includes:
[0111] Step 2022: Generate corresponding graph nodes for each variable in the multiple circuit constraints.
[0112] Step 2024: Traverse each circuit constraint and connect the graph nodes corresponding to each variable belonging to the same circuit constraint to obtain several subgraphs.
[0113] Step 2026: Generate the corresponding circuit constraint group based on the variables corresponding to the graph nodes in each subgraph.
[0114] In one specific embodiment, step 2026 includes:
[0115] For any subgraph, determine a number of circuit constraints that contain the variables corresponding to each graph node in the subgraph, and add the number of circuit constraints to the circuit constraint group corresponding to the subgraph.
[0116] Following the specific steps of step 202, the sub-graphs drawn based on the circuit constraint groups in the above example can be shown in Figure 5. Figure 5 is a schematic diagram of generating sub-graphs in an example of this specification. As shown in Figure 5, variables b0 and b1 belong to the same circuit constraint group, and the first two circuit constraints containing variables b0 and b1 are added to the first circuit constraint group. At the same time, variables b2, b3, and b4 belong to the same circuit constraint group, and the last two circuit constraints containing variables b2, b3, and b4 are added to the second circuit constraint group.
[0117] After dividing the multiple circuit constraints into several circuit constraint groups in step 202, since the variables in each circuit constraint group are not constrained by each other, the methods in steps 204 to 206 can be used to solve each circuit constraint group in parallel to improve the overall solution efficiency.
[0118] In some possible implementations, the method further includes:
[0119] The solutions of each circuit constraint group obtained in step 202 are summarized to obtain the solution of the zero-knowledge proof circuit; wherein, when each circuit constraint group has a solution, the set of solutions of each circuit constraint group is taken as the solution of the zero-knowledge proof circuit; when any circuit constraint group has no solution, the zero-knowledge proof circuit has no solution.
[0120] According to the embodiments of this specification, the zero-knowledge proof circuit is divided into multiple independent circuit constraint groups. The solutions to these circuit constraint groups do not interfere with each other, thus allowing for parallel solutions to improve efficiency and shorten solution time. Furthermore, for individual circuit constraint groups that the constraint solver cannot directly solve, according to the embodiments of this specification, they are split into multiple sub-constraint groups and solved sequentially based on a depth-first search approach, effectively broadening the solvable range.
[0121] Based on the same inventive concept, embodiments of this specification also provide a method for solving zero-knowledge proof circuits, wherein the zero-knowledge proof circuit includes a first circuit constraint group; the method includes:
[0122] The first circuit constraint group is divided into a plurality of sequentially arranged sub-constraint groups; in the plurality of sub-constraint groups, the i-th sub-constraint group includes a first variable and a second variable, wherein the first i-1 sub-constraint groups include the first variable but do not include the second variable;
[0123] The constraint solver is used to solve each sub-constraint group sequentially according to the arrangement order of the plurality of sub-constraint groups to obtain the solution of the first circuit constraint group; wherein, when solving the i-th sub-constraint group, the solutions of the first i-1 sub-constraint groups are used as circuit constraints and added to the i-th sub-constraint group; the solutions of the first i-1 sub-constraint groups include the value of the first variable.
[0124] In some possible implementations, the zero-knowledge proof circuit includes multiple circuit constraints; the method further includes:
[0125] The multiple circuit constraints are divided into several circuit constraint groups, including the first circuit constraint group; each variable in any circuit constraint group does not belong to any other circuit constraint group.
[0126] In some possible implementations, the method further includes:
[0127] The solutions of each circuit constraint group are summarized to obtain the solution of the zero-knowledge proof circuit; wherein, when each circuit constraint group has a solution, the set of solutions of each circuit constraint group is taken as the solution of the zero-knowledge proof circuit; when any circuit constraint group has no solution, the zero-knowledge proof circuit has no solution.
[0128] In one embodiment, solving the i-th sub-constraint set includes:
[0129] Determine whether the number of solutions has reached the preset second threshold; if not, add the solutions of the first i-1 sub-constraint groups as the second circuit constraints to the i-th sub-constraint group, and use the constraint solver to solve the i-th sub-constraint group; if there is a solution, increase the number of solutions by 1, and start solving the (i+1)-th sub-constraint group.
[0130] In one embodiment, solving the i-th sub-constraint set further includes:
[0131] If the i-th sub-constraint group has no solution, then set the number of times it is solved to the second threshold, and start solving the i-th sub-constraint group.
[0132] In one embodiment, solving the i-th sub-constraint set further includes:
[0133] If the number of solutions reaches the second threshold and i = 1, then the first circuit constraint group has no solution;
[0134] If the number of solutions reaches the second threshold and i>1, then the number of solutions is cleared, the solution of the (i-1)th sub-constraint group is set as infeasible, and the solution of the (i-1)th sub-constraint group is started.
[0135] In one embodiment, setting the solution of the (i-1)th sub-constraint group as infeasible includes:
[0136] Add a third circuit constraint to the (i-1)th sub-constraint group. The third circuit constraint is used to ensure that each variable in the (i-1)th sub-constraint group is not equal to the value in the solution of the (i-1)th sub-constraint group.
[0137] In one embodiment, the second circuit constraint is used to make each variable in the first i-1 sub-constraint groups equal to the value in the solution of the first i-1 sub-constraint groups.
[0138] According to another embodiment, a zero-knowledge proof circuit solving apparatus is also provided. Figure 6 is a schematic block diagram of a zero-knowledge proof circuit solving apparatus according to an embodiment of this specification. This apparatus can be deployed in any device, platform, or device cluster with computing and processing capabilities. As shown in Figure 6, the zero-knowledge proof circuit includes a first set of circuit constraints, wherein the variables in the circuit constraints correspond to the parameters in the target model; the target model is used to make predictions based on input data; the values of specific variables in the first set of circuit constraints are determined by the input data; the apparatus 600 includes:
[0139] The splitting unit 604 is configured to split the first circuit constraint group into a plurality of sequentially arranged sub-constraint groups; in the plurality of sub-constraint groups, the i-th sub-constraint group includes a first variable and a second variable, wherein the first i-1 sub-constraint groups include the first variable but do not include the second variable;
[0140] The solving unit 606 is configured to use a constraint solver to solve each sub-constraint group sequentially according to the arrangement order of the plurality of sub-constraint groups to obtain the solution of the first circuit constraint group; wherein, when solving the i-th sub-constraint group, the solutions of the first i-1 sub-constraint groups are added to the i-th sub-constraint group as circuit constraints; the solutions of the first i-1 sub-constraint groups include the value of the first variable.
[0141] In some possible implementations, the zero-knowledge proof circuit includes multiple circuit constraints; the device 600 further includes:
[0142] The partitioning unit 602 is configured to divide the plurality of circuit constraints into several circuit constraint groups, including the first circuit constraint group; each variable in any circuit constraint group does not belong to any other circuit constraint group.
[0143] In some possible implementations, the device 600 further includes:
[0144] The summarizing unit 608 is configured to summarize the solutions of each circuit constraint group to obtain the solution of the zero-knowledge proof circuit; wherein, when each circuit constraint group has a solution, the set of solutions of each circuit constraint group is taken as the solution of the zero-knowledge proof circuit; when any circuit constraint group has no solution, the zero-knowledge proof circuit has no solution.
[0145] According to another embodiment, a computer program product is also provided, including a computer program / instructions that, when executed by a processor, implement the steps of the method described in any of the above embodiments.
[0146] According to another embodiment, a computing device is also provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, it implements the method described in any of the above embodiments.
[0147] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many methodological improvements today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that a methodological improvement cannot be implemented using hardware physical modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program and "integrate" a digital system onto a PLD themselves, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must also be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also understand that by simply performing some logic programming on the method flow using one of these hardware description languages and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.
[0148] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.
[0149] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or physical entities, or by products with certain functions. A typical implementation device is a server system. Of course, this application does not exclude the possibility that, with the future development of computer technology, the computer implementing the functions of the above embodiments can be, for example, a personal computer, a laptop computer, an in-vehicle human-machine interaction device, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or any combination of these devices.
[0150] While one or more embodiments of this specification provide the operational steps of the methods described in the embodiments or flowcharts, more or fewer operational steps may be included based on conventional or non-inventive means. The order of steps listed in the embodiments is merely one possible order of execution among many steps and does not represent the only possible order. In actual device or end product execution, the methods shown in the embodiments or drawings may be executed sequentially or in parallel (e.g., in a parallel processor or multi-threaded processing environment, or even a distributed data processing environment). The terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, product, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, product, or apparatus. Without further limitations, the presence of other identical or equivalent elements in the process, method, product, or apparatus that includes the elements is not excluded. For example, the use of terms such as "first," "second," etc., is to denote names and does not indicate any particular order.
[0151] For ease of description, the above devices are described in terms of function, divided into various modules. Of course, when implementing one or more of these specifications, the functions of each module can be implemented in one or more software and / or hardware components, or a module that performs the same function can be implemented by a combination of multiple sub-modules or sub-units. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection between devices or units, and may be electrical, mechanical, or other forms.
[0152] This specification is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this specification. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in one or more flowchart illustrations and / or one or more block diagrams.
[0153] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means that implement the functions specified in one or more flowcharts and / or one or more block diagrams.
[0154] These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, such that the instructions, which execute on the computer or other programmable apparatus, provide steps for implementing the functions specified in one or more flowcharts and / or one or more block diagrams.
[0155] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.
[0156] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.
[0157] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage, graphene storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.
[0158] Those skilled in the art will understand that one or more embodiments of this specification can be provided as a method, system, or computer program product. Therefore, one or more embodiments of this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.
[0159] One or more embodiments of this specification can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a particular task or implement a particular abstract data type. One or more embodiments of this specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.
[0160] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, system embodiments are basically similar to method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments. In the description of this specification, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of this specification. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described can be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification and the features of different embodiments or examples.
[0161] The above description is merely an embodiment of one or more embodiments of this specification and is not intended to limit the scope of these embodiments. Various modifications and variations can be made to these embodiments by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims.
Claims
1. A method for solving zero-knowledge proof circuits, wherein the zero-knowledge proof circuit includes a first set of circuit constraints, and the variables in the circuit constraints correspond to the parameters in the target model; The target model is used to make predictions based on the input data; The values of specific variables in the first circuit constraint group are determined by the input data; the method includes: The first circuit constraint group is divided into a plurality of sequentially arranged sub-constraint groups; in the plurality of sub-constraint groups, the i-th sub-constraint group includes a first variable and a second variable, wherein the first i-1 sub-constraint groups include the first variable but do not include the second variable; The constraint solver is used to solve each sub-constraint group sequentially according to the arrangement order of the plurality of sub-constraint groups to obtain the solution of the first circuit constraint group; wherein, when solving the i-th sub-constraint group, the solutions of the first i-1 sub-constraint groups are used as circuit constraints and added to the i-th sub-constraint group; the solutions of the first i-1 sub-constraint groups include the value of the first variable.
2. The method according to claim 1, wherein, The zero-knowledge proof circuit includes multiple circuit constraints; the method further includes: The multiple circuit constraints are divided into several circuit constraint groups, including the first circuit constraint group; each variable in any circuit constraint group does not belong to any other circuit constraint group.
3. The method according to claim 2, wherein, The multiple circuit constraints are divided into several circuit constraint groups, including: For each variable in the multiple circuit constraints, generate corresponding graph nodes; Traverse each circuit constraint and connect the graph nodes corresponding to the variables belonging to the same circuit constraint to obtain several subgraphs. Based on the variables corresponding to the graph nodes in each subgraph, generate the corresponding circuit constraint groups.
4. The method according to claim 2, further comprising: The solutions of each circuit constraint group are summarized to obtain the solution of the zero-knowledge proof circuit; wherein, when each circuit constraint group has a solution, the set of solutions of each circuit constraint group is taken as the solution of the zero-knowledge proof circuit; when any circuit constraint group has no solution, the zero-knowledge proof circuit has no solution.
5. The method according to claim 1, wherein, Solving the i-th sub-constraint set includes: Determine whether the number of solutions has reached the preset second threshold; if not, add the solutions of the first i-1 sub-constraint groups as the second circuit constraints to the i-th sub-constraint group, and use the constraint solver to solve the i-th sub-constraint group; if there is a solution, increase the number of solutions by 1, and start solving the (i+1)-th sub-constraint group.
6. The method according to claim 5, wherein, Solving the i-th sub-constraint set also includes: If the i-th sub-constraint group has no solution, then set the number of times it is solved to the second threshold, and start solving the i-th sub-constraint group.
7. The method according to claim 5, wherein, Solving the i-th sub-constraint set also includes: If the number of solutions reaches the second threshold and i = 1, then the first circuit constraint group has no solution; If the number of solutions reaches the second threshold and i>1, then the number of solutions is cleared, the solution of the (i-1)th sub-constraint group is set as infeasible, and the solution of the (i-1)th sub-constraint group is started.
8. The method according to claim 5, wherein, The second circuit constraint is used to make each variable in the first i-1 sub-constraint groups equal to the value taken in the solution of the first i-1 sub-constraint groups.
9. A method for solving zero-knowledge proof circuits, wherein the zero-knowledge proof circuit includes a first set of circuit constraints; the method includes: The first circuit constraint group is divided into multiple sub-constraint groups arranged in sequence; In the plurality of sub-constraint groups, the i-th sub-constraint group includes a first variable and a second variable, wherein the first i-1 sub-constraint groups include the first variable but do not include the second variable; The constraint solver is used to solve each sub-constraint group sequentially according to the arrangement order of the plurality of sub-constraint groups to obtain the solution of the first circuit constraint group; wherein, when solving the i-th sub-constraint group, the solutions of the first i-1 sub-constraint groups are used as circuit constraints and added to the i-th sub-constraint group; the solutions of the first i-1 sub-constraint groups include the value of the first variable.
10. A computing device comprising a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method of any one of claims 1-9.