Paper 2023/1946

SnarkMux: Streaming SNARK Aggregation with Constant Online Verification

Abstract

SNARKs let a verifier check an expensive computation via a succinct proof, without re-executing the computation. However, many applications still verify proofs individually, creating verifier load and high fees in replicated or constrained-verifier settings. Existing proof aggregation schemes largely follow the generalized inner product argument (GIPA) line, achieving $O(\log n)$ proof size and verifier work for aggregating $n$ proofs, but remaining costly in practice and operating in batch mode. Rather than batching until a full window is available, we present SNARKMux, a streaming SNARK aggregation scheme that maintains a constant-size aggregate and requires $O(1)$ online verifier work per window of size $n$. Motivated by incremental verifiability, SNARKMux directly folds the Groth16 and Plonk verification relations and composes these proof-system-specific folds with Nova's circuit-layer fold; this defers expensive target-verifier logic (e.g., pairings) to the final check while keeping constant aggregator state. As part of public-input aggregation, we propose a generic instance-delegation technique: the prover aggregates instances, and the verifier performs a simple binding preprocessing costing only $O(n)$ hashes per window, after which online verification is constant-cost. Notably, our Groth16 and Plonk instantiations cover both circuit-specific and universal-setup SNARKs, with preprocessing that makes Plonk challenges folding-compatible, leading to a 0.7 KB Groth16 aggregate with 18 ms verification and a 0.5 KB Plonk one with 2 ms verification for 256 proofs.