Paper 2026/1388

Chimera: A Hybrid GPU Backend for Sumcheck Acceleration in Zero Knowledge Provers

Abstract

Zero-knowledge proof systems are increasingly relying on the Sumcheck protocol to avoid the FFT-heavy structure of earlier SNARK designs. Sumcheck is well suited for GPU acceleration; it consists of sequential rounds where each round performs regular, parallelizable operations over large multilinear evaluation tables. The focus is on how to organize this work across rounds: intuitively, the active polynomial state should remain close to the device that processes it, the CPU-GPU boundary should only expose values that are needed to transition, and various cryptographic settings should be kept stable. This paper presents Chimera, a GPU-CPU framework for accelerating Sumcheck in Spartan-style SNARK provers. Chimera uses a hybrid execution model: large polynomial evaluation and folding work runs on the GPU, active polynomial state remains resident on GPU across profitable rounds, compact round messages return to Spartan's host transcript, and small domains fall back to CPU execution. Chimera also specializes the wrappers around Spartan's small round-polynomial commitments and proof objects, and introduces a memory-aware chunking path. On BN254 Spartan R1CS instances, Chimera demonstrates a \(7.96\times\) improvement of the committed-Sumcheck region at \(N=2^{17}\), relative to clean Spartan. Across full Spartan proving runs from \(2^{12}\) to \(2^{27}\) constraints, Chimera improves end-to-end prover time for all measured sizes, reaching \(1.27\times\)-\(1.64\times\) speedup for sizes \(2^{24}\)-\(2^{27}\). Ablation studies show that Chimera's gains come from choosing the right execution boundary rather than from any single optimization. The GPU handles the large, regular Sumcheck work, while Spartan keeps the protocol state needed for transcript and verifier compatibility. This reduces movement of polynomial data without disrupting the proof system. The remaining gap between Sumcheck-region and end-to-end speedup shows that, after Sumcheck is accelerated, polynomial commitment and proof-wrapper costs become the next bottleneck.