{
  "type": "option",
  "name": "GKR-based systems",
  "slug": "gkr",
  "section": {
    "id": "proof-systems",
    "number": "01",
    "title": "Choosing a proof system",
    "url": "https://zkpick.com/proof-systems/"
  },
  "url": "https://zkpick.com/proof-systems/gkr/",
  "markdown": "https://zkpick.com/md/proof-systems/gkr.md",
  "category": "Sumcheck / interactive proofs",
  "summary": "GKR-based systems: Sumcheck / interactive proofs. Setup: None (commitment-dependent). Proof size: Grows with circuit depth. On-chain verification: Wrapper needed. PQ: Commitment-dependent. Recursion: Developing. Maturity: Production via at least one major zkVM. Prover cost profile: Linear-time; commits only to the input layer. Peak prover memory: Low relative to trace size. Off-chain verifier: Grows with circuit depth. Implementations and maintainers: Expander (Polyhedra), Ceno (Scroll), SP1 Hypercube's sumcheck design (Succinct). Where it is measured: ethproofs.org for the zkVMs built on it; Polyhedra's published figures. Choose it when: Wide, shallow, highly parallel workloads — bulk hashing, signature aggregation, inference — and zkVMs using a multilinear arithmetisation.",
  "description": "The GKR protocol proves layered-circuit evaluation using sumcheck, with prover time linear in circuit size. Modern systems combine it with an error-correcting-code commitment, or use GKR to run the lookup argument itself.",
  "notes": [],
  "sections": [],
  "strengths": [
    "Linear-time prover with very low commitment cost — GKR commits only to the input layer, not every intermediate wire",
    "Extremely high throughput on parallel hardware for wide, uniform workloads",
    "Now production-proven via at least one major zkVM"
  ],
  "tradeoffs": [
    "Requires the computation to be expressed as a layered circuit or sumcheck-friendly relation; irregular computation is awkward",
    "Proof size and verifier cost grow with circuit depth — deep circuits are the failure mode",
    "Not EVM-cheap; a wrapper is still needed for settlement",
    "Fewer mature general-purpose frontends"
  ],
  "bestFit": "Wide, shallow, highly parallel workloads — bulk hashing, signature aggregation, inference — and zkVMs using a multilinear arithmetisation.",
  "maintainers": "Goldwasser, Kalai and Rothblum (2008); linear-time prover by Xie et al. (Libra, 2019). Implementations: Expander (Polyhedra), Ceno (Scroll), sumcheck-based zkVM designs at Succinct",
  "maturity": "Production as of 2026",
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "source": "https://eprint.iacr.org/2019/317",
  "facts": [
    {
      "table": "Proof system selection matrix",
      "url": "https://zkpick.com/proof-systems/#proof-systems-matrix-gkr-sumcheck-systems",
      "name": "GKR / sumcheck systems",
      "setup": "None (commitment-dependent)",
      "size": "Grows with circuit depth",
      "verify": "Wrapper needed",
      "pq": "Commitment-dependent",
      "recursion": "Developing",
      "maturity": "Production via at least one major zkVM"
    },
    {
      "table": "Prover profile, implementations and benchmarks",
      "url": "https://zkpick.com/proof-systems/#proof-systems-matrix-2-gkr-sumcheck-systems",
      "name": "GKR / sumcheck systems",
      "prover": "Linear-time; commits only to the input layer",
      "memory": "Low relative to trace size",
      "offchain": "Grows with circuit depth",
      "impls": "Expander (Polyhedra), Ceno (Scroll), SP1 Hypercube's sumcheck design (Succinct)",
      "bench": "ethproofs.org for the zkVMs built on it; Polyhedra's published figures"
    }
  ],
  "relatedFailureModes": [],
  "sources": [
    {
      "title": "Libra — succinct zero-knowledge proofs with optimal prover computation (GKR)",
      "url": "https://eprint.iacr.org/2019/317",
      "kind": "paper"
    }
  ],
  "updated": "2026-09-12",
  "version": "1.3",
  "canonical": "https://zkpick.com/proof-systems/gkr/",
  "authors": [
    "MarketComp"
  ]
}