← → Print all
01 — Proof system · Proof system

GKR-based systems

Sumcheck / interactive proofs

In one paragraph

GKR-based systems: Sumcheck / interactive proofs. Setup: None (commitment-dependent). Proof size: Grows with circuit depth. On-chain verification: Wrapper needed. PQ: Commitment-dependent. Recursion: Developing. Maturity: Production via at least one major zkVM. Prover cost profile: Linear-time; commits only to the input layer. Peak prover memory: Low relative to trace size. Off-chain verifier: Grows with circuit depth. Implementations and maintainers: Expander (Polyhedra), Ceno (Scroll), SP1 Hypercube's sumcheck design (Succinct). Where it is measured: ethproofs.org for the zkVMs built on it; Polyhedra's published figures. Choose it when: Wide, shallow, highly parallel workloads — bulk hashing, signature aggregation, inference — and zkVMs using a multilinear arithmetisation.

By MarketComp Updated v1.3 About the authors Changelog
Setup
None (commitment-dependent)
Proof size
Grows with circuit depth
On-chain verification
Wrapper needed
PQ
Commitment-dependent
Recursion
Developing
Maturity
Production via at least one major zkVM
Selection matrix · as GKR / sumcheck systems · see the row in context
Prover cost profile
Linear-time; commits only to the input layer
Peak prover memory
Low relative to trace size
Off-chain verifier
Grows with circuit depth
Implementations and maintainers
Expander (Polyhedra), Ceno (Scroll), SP1 Hypercube's sumcheck design (Succinct)
Where it is measured
ethproofs.org for the zkVMs built on it; Polyhedra's published figures
Prover profile · as GKR / sumcheck systems · see the row in context

What it is

The GKR protocol proves layered-circuit evaluation using sumcheck, with prover time linear in circuit size. Modern systems combine it with an error-correcting-code commitment, or use GKR to run the lookup argument itself.

Strengths and tradeoffs

Strengths
  • Linear-time prover with very low commitment cost — GKR commits only to the input layer, not every intermediate wire
  • Extremely high throughput on parallel hardware for wide, uniform workloads
  • Now production-proven via at least one major zkVM
Tradeoffs
  • Requires the computation to be expressed as a layered circuit or sumcheck-friendly relation; irregular computation is awkward
  • Proof size and verifier cost grow with circuit depth — deep circuits are the failure mode
  • Not EVM-cheap; a wrapper is still needed for settlement
  • Fewer mature general-purpose frontends

Choose it whenWide, shallow, highly parallel workloads — bulk hashing, signature aggregation, inference — and zkVMs using a multilinear arithmetisation.

Maintained implementations

Goldwasser, Kalai and Rothblum (2008); linear-time prover by Xie et al. (Libra, 2019). Implementations: Expander (Polyhedra), Ceno (Scroll), sumcheck-based zkVM designs at Succinct

Maturity: Production as of 2026 · License: n/a (construction) · eprint.iacr.org ↗

How to decide
Other proof systems in §01
Groth16PLONK and the PLONKish familyFRI-based STARKsHalo2 with IPA, and Halo2 with KZGNova, SuperNova and HyperNovaBinius and binary-field systemsSTIR and WHIRSpartanBulletproofsLookup arguments: Plookup, LogUp, cq, Lasso/Shout/Twist

Sources cited on this page · 1

  1. Libra — succinct zero-knowledge proofs with optimal prover computation (GKR)paper

All 40 sources for §01 are listed on the section page →

Cite this page 
MarketComp (2026). GKR-based systems. The ZK Field Manual (Version 1.3). MarketComp. https://zkpick.com/proof-systems/gkr/
@misc{zkfieldmanual-gkr-based-systems,
  title        = {GKR-based systems — The ZK Field Manual},
  author       = {MarketComp},
  year         = {2026},
  version      = {1.3},
  howpublished = {\url{https://zkpick.com/proof-systems/gkr/}},
  note         = {Accessed: YYYY-MM-DD}
}