Lattice-Based Polynomial Commitment Schemes: Greyhound, Hachi, Akita, Grand Danois, Maltese, Jindo and Serval

In a hash-based polynomial commitment the proof is mostly Merkle paths. The prover commits to an encoded vector by a Merkle root; every query the verifier makes costs one leaf plus one sibling hash per tree level, and the soundness analysis needs many queries. WHIR, the most compact of the family, reports arguments between 123 KiB and 544 KiB for a polynomial with 2³⁰ coefficients at 100-bit security and rate 1/2, the lower figure under a conjecture about list decoding and the higher under unique decoding only^[1]. None of those paths can be combined with any other: a hash has no algebra.

A lattice commitment has algebra. It is a linear map, t = A·s mod q, applied to a vector s with small entries. Commitments to many chunks of a polynomial can be combined with challenge coefficients, and the combination can be opened by a single vector that the verifier checks against the combined commitment. The Merkle paths disappear. What takes their place is a constraint with no analogue in hashing: the commitment is binding only for short vectors, every combination makes the vector longer, and the prover has to prove that it is still short enough. Almost every design decision in this literature is a way of paying that one price.

The results, as of this writing, look like this. Under Module-SIS, the same assumption family as the NIST signature standard, evaluation proofs for 2³⁰ coefficients are 53–72 KB (Greyhound, Hachi, Akita)^[2][3][4]. Verification took 2.8 seconds in Greyhound's 2024 implementation and takes 8–16 milliseconds in Akita's 2026 one^[4]. Polylogarithmic verifiers exist under a newer structured assumption, at roughly 200 KB by RoKoko's own abstract (109–115 KB as measured by Akita at a lower soundness target) and at an estimated 80–90 KB for Grand Danois, and at 335 KB, computed rather than measured, under Module-SIS (Maltese)^[5][6][7]. A zero-knowledge variant over a 256-bit field runs a prover an order of magnitude faster than the other evaluation-hiding post-quantum commitments it is benchmarked against, at megabyte proof sizes (Jindo)^[8]. The table below names the fact each scheme runs on; the rest of the article explains them.

1 · What a Merkle opening costs, and what a homomorphism buys

Start from what the reader already does. A FRI, Basefold or WHIR prover^[9][10][1] encodes its polynomial, commits to the codeword by a Merkle tree, and then folds: each round shrinks the codeword by a random linear combination of paired positions, f(x) with f(−x), by a factor of two or more, and the verifier checks the folding at randomly chosen positions by opening the leaves on both sides. Every opened leaf costs its authentication path, roughly 32 bytes per tree level, and the number of queries is fixed by the soundness analysis. At 128 bits of provable security with rate 1/2 the count runs well above a hundred, which is why the proofs are hundreds of kilobytes, and why the capacity conjecture, which lets the verifier query less, buys a factor of four at WHIR's 100-bit setting^[1]. The structure of a hash tree forbids any shortcut: H(x) and H(y) say nothing about H(x + y), so a query at a folded position cannot be answered from queries at the unfolded ones without opening both.

The reader also knows the alternative from the pre-quantum world. A Pedersen or KZG commitment is a homomorphism of the message space: Com(x) + Com(y) = Com(x + y). That is why Bulletproofs can fold a committed vector without any queries, and why a KZG opening is one group element. The lattice commitment is the post-quantum member of that family. Fix a public matrix A with entries modulo q and define

t = A·s mod q,   s short,Ajtai commitment

so that A·(c₁s₁ + c₂s₂) = c₁t₁ + c₂t₂ for any coefficients. The difference from Pedersen is the word "short". The map is binding only on vectors whose entries are small compared with q; on the whole space it is many-to-one and openings can be found by linear algebra. A fold c₁s₁ + c₂s₂ is a legitimate opening of the folded commitment only while it is still short, and the verifier has no way to read the length of a vector it never sees. So where FRI pays queries and paths, a lattice scheme pays norm bookkeeping: challenges are chosen small, witnesses are re-expressed in small digits after each fold, and a separate argument certifies the bound. Figure 1 draws the two openings side by side.

The analogy to carry through the article is this. In FRI the proximity test certifies that a folded oracle still lies near a codeword; in a lattice scheme the norm proof certifies that a folded witness still lies in the short set where the commitment binds. Both are the part of the protocol that costs the most thought, and both are where the schemes differ. The folding itself is cheaper on the lattice side because the verifier performs it on commitments with arithmetic instead of sampling it with queries.

2 · The lattice facts the schemes rest on

2.1 Short integer solutions and the Ajtai hash

The short integer solution problem, SIS, is stated with a uniformly random matrix A ∈ ℤ_q^n×m, m larger than n: find a nonzero integer vector z with A·z ≡ 0 (mod q) and ‖z‖ ≤ β. Without the norm bound the kernel is a lattice with plenty of vectors and Gaussian elimination finds one; with it, the problem is as hard as approximating short vectors in every lattice of dimension n, which is Ajtai's 1996 theorem and the reason the assumption is trusted^[11]. The function s ↦ A·s on short inputs is then collision-resistant: two short inputs with the same image give a short kernel vector, their difference.

A toy makes the shape visible. Take q = 13, one row A = (3, 7, 11, 2, 5), and inputs with entries in {−1, 0, 1}. The inputs s = (1, 0, 0, 1, 0) and s′ = (0, 0, 0, 0, 1) both hash to 5, since 3 + 2 = 5, and their difference z = (1, 0, 0, 1, −1) satisfies 3 + 2 − 5 = 0: a SIS solution with ‖z‖_∞ = 1. The toy is breakable because 243 inputs map into 13 outputs; real parameters have inputs of tens of thousands to millions of small coordinates mapping into about a thousand coordinates modulo a 32-bit q (Greyhound: 18 ring rows of dimension 64; Hachi: one row of dimension 1024), and the best known attacks are lattice reduction at cost estimated by the usual tools. The output is not short, and that is the point: the hash compresses many small numbers into a few large ones, and nothing short maps to zero.

The commitment of §1 is this hash. It is binding for openings of norm at most β whenever SIS at norm 2β is hard, since two such openings differ by a kernel vector of norm at most 2β. It is not hiding; schemes that need hiding (Jindo, §9) add a second short random vector under a second matrix, which is a Module-LWE sample. And it is linear, which the toy also shows: (1, 0, −1, 1, 0) hashes to 7, (0, 1, 1, 0, −1) hashes to 0, and their sum hashes to 7.

2.2 Rings and Module-SIS

Every practical scheme replaces the integers by the ring

R_q = ℤ_q[X] / (X^d + 1),   d a power of two,power-of-two cyclotomic ring

whose elements are polynomials of degree below d with coefficients modulo q, multiplied with the rule X^d = −1. In the toy ring with d = 4 and q = 13, X³·X² = X⁵ = −X, and (1 + 2X − X³)(X + X²) = 1 + 2X + 3X² + 2X³, the two wrapped terms −X⁴ − X⁵ having become 1 + X. Module-SIS is SIS with the matrix and the vector over R_q: A ∈ R_q^n×m, z ∈ R^m short, A·z = 0. It has its own worst-case reduction, over module lattices^[12], and it is, together with Module-LWE and a self-target variant, the assumption family under ML-DSA with d = 256^[13]. The reasons to use it are cost and size: a ring product is a negacyclic convolution of two length-d vectors, computed in O(d log d) by a number-theoretic transform whenever X^d + 1 factors suitably modulo q, and the key A has nm ring entries instead of nd·md integers.

Norms are taken over the coefficient vector of a ring element, and the fact that governs every fold is how multiplication grows them: a product c·s has infinity norm at most ‖c‖₁·‖s‖_∞, because each output coefficient is a signed sum of products of one coefficient of c with one of s. A challenge with ten nonzero ±1 coefficients therefore multiplies the norm by at most ten, and folding r columns with such challenges multiplies it by at most 10r.

2.3 Making an arbitrary polynomial short

The coefficients of the polynomial to be committed are arbitrary elements of ℤ_q, which are not short. The standard repair is gadget decomposition: write each coefficient in base b with δ = ⌈log_b q⌉ digits, commit to the digit vector, and let the verifier recompose with the public gadget matrix G = I ⊗ (1, b, b², …, b^δ−1):

s = G⁻¹(f),   f = G·s,   ‖s‖_∞ < b.digits

In the toy with base 4 the coefficient 9 becomes the digits (1, 2) since 9 = 1 + 2·4, and 12 becomes (0, 3). Papers use either digits in {0, …, b − 1} or balanced digits in {−b/2, …, b/2 − 1}, which Greyhound, Hachi and Akita do; the toy uses the former for readability and the norm proofs of §2.5 the latter. The witness grows by the factor δ (Greyhound uses δ = 5 to 8, Hachi δ = 8) and every linear relation on f becomes a linear relation on s with G absorbed into the public side. The same operation is what makes two-tier commitments possible: a commitment t = A·s is a vector modulo q, hence not short, but G⁻¹(t) is, and can itself be committed under a second matrix. Every scheme below publishes such an outer commitment and keeps the inner ones as part of the witness.

2.4 Challenges one can divide by, and the slack they leave

Soundness proofs for these protocols rewind the prover and subtract two transcripts. If the prover answered challenge vectors c and c′ that differ only in coordinate i with responses z and z′, then A·(z − z′) = (c_i − c′_i)·t_i. To turn that into an opening of t_i one divides by the challenge difference, which must be invertible in R_q. Lyubashevsky and Seiler showed that for a prime q ≡ 5 (mod 8), which makes X^d + 1 split into exactly two factors, every nonzero ring element with coefficients below √(q/2) in absolute value is invertible^[14]. The toy ring satisfies the hypothesis, and the bound √6.5 ≈ 2.55 admits coefficients in {−2, …, 2}: all 624 nonzero such elements are units, checked exhaustively. Short differences of short challenges are therefore always invertible. Invertibility alone is enough once relaxed openings are accepted, as the next paragraph does, so a challenge set of 2¹²⁸ or more short elements can be used without repetition. The lattice Bulletproofs of 2020 needed the inverse itself to be short, which restricts the challenges to the 2d monomials and forces repetition; that is the single most important practical difference^[15].

What the inverse looks like is the other half of the lesson. In the toy, (1 + X)⁻¹ = −6 + 6X − 6X² + 6X³, with coefficients at half the modulus. The extracted vector s̄ = (z − z′)/(c_i − c′_i) is a correct opening but not a short one. The literature therefore works with relaxed openings: a pair (c̄, z̄) of short elements with A·z̄ = c̄·t, and a binding argument that cross-multiplies two such pairs for different messages into a short kernel vector c̄′z̄ − c̄z̄′^[16]. The commitment matrix is then sized for that larger norm. The ratio between the norm the honest prover has and the norm the extractor can guarantee is the slack, and it compounds across recursion levels. It is harmless for binding as long as the parameters absorb it, which is how Greyhound and Hachi proceed; it is the thing Serval, Maltese and Akita's exact norm checks set out to remove (§6, §8, §10).

The congruence q ≡ 5 (mod 8) has a cost of its own. The fastest NTTs want X^d + 1 to split completely, which needs q ≡ 1 (mod 2d) and leaves residue fields too small for short elements to be invertible. Greyhound and LaBRADOR accept the slower partially-splitting arithmetic at d = 64; Jindo moves the invertibility requirement to a different ring (§9) and LaBinius to a composite modulus (§11) to get fully splitting arithmetic back.

2.5 Norm proofs are the lattice analogue of proximity testing

After one fold the response z is short only up to the growth factor of §2.2, and the verifier can see that only if z is sent in full, which is the √N communication every scheme wants to avoid. Once z is itself committed rather than sent, its shortness has to be proven, and the next fold needs a witness that is short again. Three families of norm proof appear in this article.

Subtractive sets. Choose challenges whose pairwise differences have short inverses, so that extraction loses no norm at all. Such sets exist in the ring: {0, 1} is one, since its only difference is ±1, and {−1, 0, 1} is one up to a factor of 2, which is what CMNW24's binary challenges and the monomial challenges of the lattice Bulletproofs rely on. But Albrecht and Lai proved that in a power-of-two cyclotomic ring no subtractive set has more than two elements, and that even the weaker sets whose differences have short scaled inverses are at most polynomial in size^[17], so the soundness error per round is inverse-polynomial and the protocol must be repeated. SLAP and the polylogarithmic variant of Cini, Malavolta, Nguyen and Wee go this way and pay for it in megabytes^[18][19].

Random projections. Let the verifier choose a random matrix Π with entries in {−1, 0, 1} and 256 rows, and let the prover send p = Π·s. By the Johnson–Lindenstrauss lemma in the modular form of Gentry, Halevi and Lyubashevsky^[20], ‖p‖ is at least √30·‖s‖ with overwhelming probability and at most √128·‖s‖ with probability about one half, so a short p certifies a short s with slack √(128/30) ≈ 2.07, and the prover proves p well-formed as 256 extra linear constraints^[21]. The cost is that each of Π's 256 rows is as long as the witness, so forming the projection constraints is linear work for the verifier, on top of LaBRADOR's linear aggregation of its statement; Greyhound keeps the whole LaBRADOR statement at size √N, which is why its verifier is √N. RoK and Roll gives Π a tensor structure that a succinct verifier can process^[22], and Grand Danois builds on that (§7).

Sumcheck. Treat the coefficient vector of the witness as a multilinear polynomial over the field and prove the bound as a polynomial identity: every digit lies in the alphabet Λ = {−b/2, …, b/2 − 1} if and only if Π_ξ∈Λ(s̃ − ξ) vanishes on the hypercube, s̃ being the multilinear extension of the digit vector, which is one zero-check sumcheck of degree b plus one for the equality polynomial; or the exact squared norm ⟨s, s⟩ equals a claimed small integer, with a side condition that stops it from wrapping modulo q. The verifier's cost is logarithmic in the witness, plus one evaluation of the committed polynomial, which is exactly the kind of claim the commitment scheme was built to discharge. Hachi, Akita, Maltese and Serval do this, following LatticeFold+ and Neo^[23][24].

Whichever family a scheme uses, the recursion has the same three-beat rhythm, which Maltese's authors name explicitly and which Figure 2 draws: a norm check on the current witness, a fold that shrinks it and inflates its norm, and a decomposition back into small digits that resets the norm for the next round^[7]. The resetting is not free: re-digiting multiplies the length by δ again, so each round must shrink by more than that factor, and the recommitted digits must themselves be proven well formed.

3 · The engine every scheme shares

3.1 An evaluation is a bilinear form

Write the N = mr coefficients of a polynomial as an m × r matrix F, column j holding one contiguous chunk. For a univariate polynomial evaluated at x,

f(x) = a^⊤Fb,   a = (1, x, …, x^m−1),  b = (1, x^m, x^2m, …, x^(r−1)m).univariate

For a multilinear polynomial in ℓ variables evaluated at (x₁, …, x_ℓ), index the coefficients by bit strings, let the low log m bits pick the row and the high log r bits the column, and the same identity holds with a = ⊗ (1, x_k) over the low variables and b = ⊗ (1, x_k) over the high ones; in the Lagrange basis the factors are (1 − x_k, x_k) instead. The protocol below never looks inside a and b. It needs them to be public vectors the verifier can form, and that is all. The distinction between "univariate" and "multilinear" schemes in this literature is therefore mostly about what the surrounding paper chose to write down; Greyhound is stated for univariate polynomials and Hachi observes that its own embedding makes Greyhound a multilinear scheme "out of the box"^[3].

The toy: f = 9 + 4x + 12x² + 7x³ over ℤ₁₃, evaluated at x = 3, where f(3) = 9 + 12 + 108 + 189 = 318 ≡ 6. Split into two columns of two: f₁ = (9, 4), f₂ = (12, 7), a = (1, 3), b = (1, 9). The partial evaluations are w = a^⊤F = (9 + 12, 12 + 21) ≡ (8, 7), and ⟨w, b⟩ = 8 + 63 = 71 ≡ 6. Read as the multilinear polynomial 9 + 4x₁ + 12x₂ + 7x₁x₂ at (3, 9), the same matrix gives the same w and the same 6, with a = (1, x₁) and b = (1, x₂).

3.2 The three-round protocol

The protocol is from Baum, Bootle, Cerulli, del Pino, Groth and Lyubashevsky in 2018^[25], and Greyhound, Hachi, Akita, Grand Danois and Jindo all begin with it. The prover has committed to every column: s_j = G⁻¹(f_j), t_j = A·s_j, and an outer commitment u = B·G⁻¹(t₁, …, t_r) is the published value. The evaluation claim is a^⊤Fb = y, where a^⊤f_j = (a^⊤G)·s_j.

Greyhound sends the short decompositions t̂_j of the inner commitments in the last round next to z and checks their norm; moving them to the first message, as Hachi's restatement of the 2018 protocol does, changes nothing in the analysis because u binds them. Figure 3 draws the matrix view.

In the toy, with base-4 digits, s₁ = (1, 2, 0, 1) and s₂ = (0, 3, 3, 1), the recomposing row is a^⊤G = (1, 4, 3, 12), and a two-row commitment matrix A with rows (2, 11, 6, 3) and (8, 1, 10, 5) gives t₁ = (1, 2) and t₂ = (2, 12). For the challenge c = (1, −1) the response is z = s₁ − s₂ = (1, −1, −3, 0), and the checks read

Why it is sound. The first message fixes w and the t_j before c is known. Suppose some w_j is not the partial evaluation of the committed column. Then ⟨w, c⟩ − (a^⊤G)·z = Σ_j c_j·(w_j − ⟨a, f_j⟩) is a nonzero linear form in the challenges, and it vanishes for a random c only by accident. The rewinding argument is the coordinate-wise special soundness of Fenzi, Moghaddas and Nguyen^[26]: from r + 1 accepting transcripts that differ one coordinate at a time, each column is extracted as (z − z′)/(c_j − c′_j), with the slack of §2.4, and the knowledge error is r/|C|. The toy shows the first half with the honest fold: a prover who replaces w by (8, 8), which would claim y = 2, and still sends the honest z passes the fold check for exactly 3 of the 9 challenges in {−1, 0, 1}², those with c₂ = 0. It cannot show more, because with q = 13 the norm bound of 6 admits every residue vector, so a prover free to choose z would pass all nine; at real parameters the norm bound and the binding of A remove that freedom. The extraction half it does show: the honest transcripts for c = (1, −1) and c′ = (0, −1) have z − z′ = (1, 2, 0, 1) = s₁.

What it costs. The prover sends r partials, r inner commitments of n ring elements each, and one folded column of mδ ring elements; the verifier does O(r + m) ring operations. At r ≈ m ≈ √(N/d) both are square-root in the size of the polynomial. That is already a usable commitment scheme; CELPC stops here, and Jindo adds one more level of the same split to reach N^1/3. Two things stand between it and the 50 KB proofs: the transcript is still √N long, and the norm of z is checked by eye, which stops being possible the moment z is no longer sent.

3.3 From a field to a ring

The protocol is stated over R_q, while the polynomial lives over a field. Packing d consecutive coefficients into one ring element, F_i = Σ_j<d f_id+jX^j, turns the field evaluation into a ring evaluation followed by one public linear map. Write x̄ = Σ_j x^jX^j and let σ₋₁ be the automorphism X ↦ X⁻¹ = −X^d−1. The constant term of σ₋₁(u)·v is the inner product of the coefficient vectors of u and v, because the only products that land on X⁰ are X^−j·X^j[27], and so

f(x) = ct( σ₋₁(x̄) · F(x^d) ),   F(Z) = Σ_i F_iZⁱ ∈ R_q[Z].packing

The prover sends the ring element F(x^d); the verifier checks that its inner product with x̄, which is the constant term of σ₋₁(x̄)·F(x^d), equals y, at the cost of d field multiplications (Greyhound sends the product σ₋₁(x̄)·F(x^d) instead and lets LaBRADOR divide; the two are interchangeable); and the commitment scheme proves the ring evaluation, now of a polynomial with N/d ring coefficients at the scalar point x^d[18][2]. In the toy with eight coefficients (5, 1, 8, 12, 3, 0, 7, 9) and x = 2, where f(2) = 2, one has x⁴ = 16 ≡ 3, F(3) = F₀ + 3F₁ = 1 + X + 3X², and σ₋₁(x̄)·F(3) = 2 + 12X + 4X² + 9X³, whose constant term is 2. For multilinear polynomials and evaluation points in an extension field 𝔽_q^k, Hachi proves the same identity with the subring of R_q fixed by a group of automorphisms standing in for the field and a trace in place of the constant term (§5). The practical consequence is the same in every scheme: the committed object is a vector of N/d ring elements, and the modulus of the field is tied to the modulus of the commitment unless a scheme does extra work to separate them.

4 · Greyhound: a √N statement handed to LaBRADOR

Greyhound, by Nguyen and Seiler at CRYPTO 2024, is the first lattice polynomial commitment its authors could call concretely practical, with proofs three orders of magnitude below the hash-based schemes of the time, and Hachi, Akita, Grand Danois and Jindo all descend from it^[2]. Its contribution to the protocol of §3.2 is to send nothing long. The partials w are decomposed into digits ŵ and committed with a third matrix, v = D·ŵ, before the challenge; afterwards the prover does not reveal ŵ, the inner commitments t̂ or the fold z at all. Instead it proves knowledge of short vectors satisfying the four linear checks of §3.2 together with the new commitment to the partials, which together are one linear system over the ring:

D·ŵ = v,   B·t̂ = u,   b^⊤G·ŵ = y,   c^⊤G·ŵ − a^⊤G·z = 0,   (c^⊤ ⊗ G)·t̂ − A·z = 0.one relation

The system has a constant number of block rows but O((rn + m)δ) columns, so the public instance and the witness (ŵ, t̂, z) are both square-root in N. The fold z is first split into two digit vectors of a small base, so that the whole witness is uniformly short. At N = 2³⁰ the parameters are d = 64, q ≈ 2³² with q ≡ 5 (mod 8), m = 12625 and r = 1329, inner commitments of rank 18 and outer of rank 7, coefficients decomposed into eight 4-bit digits and the LaBRADOR witness into 6-bit digits^[2]. Greyhound's own messages, v and the final outer commitments, come to about 4 KB; everything else in the proof is the argument of knowledge for the relation above, and that argument is LaBRADOR.

LaBRADOR in one paragraph. LaBRADOR, by Beullens and Seiler at CRYPTO 2023, proves knowledge of short vectors satisfying a system of dot-product constraints over R_q, which is a superset of the linear system above^[21]. One level of it is the engine of §3 applied to the witness itself: split the witness into r parts, commit to each, fold them with short challenges, and prove that the openings satisfy the constraints at the cost of O(r²) "garbage" cross terms. The norm is proven by a random projection: the verifier draws a 256-row ternary matrix Π, the prover sends Π·s and adds its 256 coordinates to the constraint list, and the modular Johnson–Lindenstrauss bound of §2.5 turns a short projection into a norm bound with slack 2.07. The commitments and the garbage terms are not sent either; they are committed by an outer commitment and moved into the next level's witness, which is how the level ends with a witness about the 2/3 power of the size it started with. Six or seven levels later the witness is about 30 KB and is sent in the clear; it is over half of the proof, the rest being the 3–4 KB of commitments and projections sent at each level. The proof is dominated by that last witness, so it is close to constant across the sizes that matter: 47 KB at 2¹⁰ R1CS constraints and 58 KB at 2²⁰. The verifier, however, has to apply Π and recompute every folded constraint, and is linear in the statement. Greyhound's observation is that a linear verifier on a √N statement is a √N verifier for the polynomial.

Numbers. With the AVX-512 implementation the authors report, for 2²⁶, 2²⁸ and 2³⁰ coefficients over a 32-bit field at 128 bits of security: proofs of 46, 53 and 53 KB; commitment in 4.4, 21 and 132 seconds; opening in 2.0, 8.2 and 41 seconds; verification in 0.49, 1.15 and 2.8 seconds, all on one core^[2]. The paper's own comparison puts the proof at three orders of magnitude below Ligero and Brakedown and four below SLAP, with verification comparable to Brakedown and twice as slow as Ligero. Zero knowledge is described, by adding Module-LWE randomness to the outer commitments and masking y, but not implemented; Jindo's authors note that no measurement of its overhead exists^[8].

Two caveats are recorded by later work. Akita's authors re-ran Greyhound after calibrating both schemes to the same 128-bit quantum target under Euclidean collision bounds, correcting the distribution of the projection matrix to the one the Johnson–Lindenstrauss bound actually requires (the released code used a dense-sign matrix with a slack of 2 where the paper's analysis gives 2.07; the corrected sparse-ternary projection carries √(128/29) ≈ 2.10), and adding challenge grinding so that honest folds that exceed the norm bound can be retried; under that accounting Greyhound's proofs are 60–67 KB and its verifier takes 75 ms to 1.4 s from 2²⁷ to 2³⁵ committed bits, that is 2²² to 2³⁰ 32-bit coefficients^[4]. They also report that the released LaBRADOR and Greyhound code computes commitments as a product in an extension ring and keeps only the first n coordinates of the result, n the commitment rank, a map they call truncated-output Ring-SIS; no attack on it is known, but the papers' Module-SIS theorems do not cover it. The algorithm the paper analyses and the one the repository runs are not quite the same object.

5 · Hachi: multilinear, extension fields, and a verifier that never multiplies in the ring

Hachi, by Nguyen, O'Rourke and Zhang in January 2026, keeps Greyhound's commitment and three-round protocol and changes two things: the polynomial is multilinear over an extension field 𝔽_q^k, and the relation of §4 is proven by a sumcheck over that field instead of by LaBRADOR^[3]. The second change is what the paper is about. A lattice verifier spends its time on ring multiplications, each a convolution of length d; Hachi's verifier performs none, and the authors report 227 ms, one measured round plus an estimated Greyhound tail, against Greyhound's 2.8 s at 30 variables, with the proof at 55 KB.

Putting a field evaluation inside the ring. The constant-term identity of §3.3 handles a prime field. For 𝔽_q^k Hachi finds the field inside the ring: for q ≡ 5 (mod 8) and k dividing d/2, the elements of R_q fixed by the automorphisms X ↦ X⁻¹ and X ↦ X^4k+1 form a subring isomorphic to 𝔽_q^k, and there is a packing map ψ from d/k field elements to one ring element such that

Tr_H( ψ(a) · σ₋₁(ψ(b)) ) = (d/k) · ⟨a, b⟩,Hachi, Theorem 1

the trace being the sum over the fixing automorphisms. With k = 1 the subring is ℤ_q and the identity is the constant-term trick times d. The ℓ-variate evaluation claim then becomes: the prover sends a single ring element, the verifier checks that its trace against the packed evaluation point equals (d/k)·y, and what remains is an evaluation claim for a polynomial in ℓ − log d + log k variables with ring coefficients, which the bilinear form and the three-round protocol handle as before. The authors note that this transformation on its own already makes Greyhound a multilinear scheme over extension fields.

Ring switching. After the three rounds the prover holds short vectors (ŵ, t̂, ẑ) and must convince the verifier of a linear relation M·z = w over R_q, where z and w now stand for the stacked witness and the public right-hand side and M is public and structured. Sumcheck wants a field. The technique Hachi borrows from Huang, Mao and Zhang is to write each ring equation as what it is, a polynomial identity with the discarded multiples of X^d + 1 made explicit^[28]:

Σ_i M_i(X)·z_i(X) = w(X) + (X^d + 1)·h(X),   deg h < d − 1,lift

an equation in ℤ_q[X] that the prover can satisfy by computing the quotient h. The prover commits to the field coefficients of z and h together as one multilinear polynomial P; the verifier draws α from 𝔽_q^k; substituting X = α turns the identity into an inner product between the committed coefficient vector and a public vector of powers of α, that is, a claim Σ_i P(i)Q(i) = V over the hypercube with Q public. A false identity of degree below 2d survives a random α with probability at most 2d/q^k, which is why k = 4 is used with a 32-bit q. The sumcheck runs in logarithmically many rounds of field arithmetic and ends with one evaluation of P at a random point. Shortness is now a statement about field elements: the entries of z are digits, and a range proof over the field, itself a sumcheck, certifies them. Figure 4 draws the chain.

The remaining evaluation claim has the same shape as the one the round started with, so the protocol recurses, and a small identity on the equality polynomial, eq(i‖j, x₀‖x₁) = eq(i, x₀)·eq(j, x₁), lets the next round work directly on the committed digits of z without re-decomposing them. What the verifier evaluates at the end of a round is the public Q, which inherits the tensor structure of the Greyhound relation together with the public commitment matrices; that evaluation is the square-root cost Akita later attacks (§6).

Numbers. The implemented protocol runs one Hachi round and hands the remainder to Greyhound. With d = 1024, q = 4294967197, all three commitment matrices of a single row (nd ≥ 2¹⁰ is what the security estimate needs), a 2¹⁰ × 2¹⁰ split of 2²⁰ ring elements, base-16 digits and challenges with 16 nonzero coefficients, the first round shrinks a 30-variable polynomial with 32-bit coefficients to a 26-variable one with 4-bit coefficients, a factor of 128. Its cost is about 4 KB for the embedding, 4 KB for the commitment to the partials and 7.3 KB for the sumcheck over 𝔽_q⁴; adapting the residue to Greyhound's ring of dimension 64 costs 4.8 KB, and the Greyhound tail about 43 KB. The paper's total of 55.1 KB sums the last three terms only; with the 8 KB of embedding and partials commitment it also lists, the components come to about 63 KB. Verification is the measured first round plus an estimated 130 ms for the tail, 227 ms together. The prover is slow in this prototype, about 270 s in total, without SIMD; commitment, on the other hand, is 3–5 times faster than Greyhound's algorithm at the same security because the larger ring needs far fewer multiplications and each is an NTT^[3].

One correction should be read with the paper. Akita's authors report that Hachi's shortcut for the common case of a base-field polynomial evaluated at an extension-field point does not bind the k partial evaluations it has the prover send: for k > 2 the two displayed checks leave a nontrivial kernel, so a prover can shift the partials and the claimed value together. They replace the shortcut by the tensor-algebra ring-switching reduction of Diamond and Posen^[4][29]. The main protocol and the generic embedding are not affected, and Akita's authors add that Hachi's authors are aware of the issue and have corrected later, not yet public, versions.

6 · Akita: offloading the setup and folding to completion

Akita, from LayerZero Labs, a16z crypto, CMU, USC and Georgetown in 2026, is the engineering descendant of Hachi, built to replace Dory, the curve-based commitment in the Jolt zkVM^[4][30]. The authors state three requirements they say no earlier lattice scheme meets at once: proofs of tens of kilobytes, verification in tens of milliseconds, and security from plain Module-SIS. Greyhound and Hachi have the first and third with square-root verifiers; the vanishing-SIS line (§7, §11) has the first two under a newer assumption; the asymptotically succinct Module-SIS schemes have the second and third but either give no concrete parameters or carry proofs in the megabytes.

Where the square root comes from. At the end of a Hachi round the verifier must evaluate the public relation polynomial at the sumcheck's final point. The paper separates that cost into two parts: rows that depend on the r folding challenges cost Õ(r), and rows that carry the public commitment matrices cost Õ(m + r), where the witness was split into r blocks of length m (the paper's B and M). The total Õ(r + N/r) is minimised at r ≈ √N, and choosing fewer blocks to cut the challenge work only lengthens the matrix scan^[4].

Setup offloading. The commitment matrices are public and fixed before any polynomial exists, so their contribution can be committed once and proven rather than recomputed. Akita expands the whole setup from one seed as a single flat sequence (S_p) that every matrix reads a prefix of, so the setup's contribution to the final evaluation is one inner product Σ_p S_p·ω(p) with public weights. During preprocessing, which is transparent and costs about N^1−1/K work, the setup prefixes are committed with Akita itself. At opening time the prover states the value of the inner product, a degree-two sumcheck reduces it to one evaluation of the committed setup polynomial, and that evaluation claim is passed to the next fold and opened there beside the recursive witness, against its own commitment. Repeating this in later folds until it stops paying gives a verifier that does Õ(N^1/K) work for any fixed K ≥ 2 with the same asymptotic prover time and proof size as before. The offloading does not remove the challenge-dependent work, which is why the exponent is a constant root rather than a logarithm; what it removes is the matrix scan that forced the balance.

Folding to completion. Hachi runs one round and delegates to Greyhound. Akita iterates its own fold from the root to a small terminal witness and tunes every level: the digit range check is restructured, each relation gets its own ring dimension and a challenge family drawn from a subring, ring equations are checked either with Hachi's quotient lift or without it (through the transpose-convolution form of ring multiplication) depending on which is cheaper at that level, commitments are compressed to 128 bytes, and the ℓ₂ norm of the response is certified exactly rather than through its digits, which tightens the Module-SIS parameters. Around the core protocol are the parts a zkVM needs: batched openings of polynomials committed at different times with parameters fixed in advance, distributed proving with the response split into chunks, and an offline planner that chooses a schedule of parameters under a cost objective and validates it.

Numbers. Single-threaded, over a 32-bit field, at 2³⁵ committed bits (2³⁰ coefficients): commitment 24.4 s, opening 18.4 s, verification 15.9 ms, proof 67.3 KB, peak memory 4.7 GiB with offloading; 32.5 ms and 64.6 KB without it. The recalibrated Greyhound on the same inputs: 52.3 s, 19.2 s, 1423 ms, 67.2 KB, 92.6 GiB. Across the four offloaded sizes from 2²⁹ to 2³⁵ bits, Akita verifies in 8.1–15.9 ms against Greyhound's 155–1423 ms, 19–90 times faster, at 61–67 KB against 60–67 KB; at 2²⁷, where only the direct configuration runs, it is 7.5 ms against 75 ms^[4]. RoKoko (§11), measured in the same harness, verifies in 4–7 ms but with 109–115 KB proofs and a 100-bit statistical soundness target. Against hash-based implementations at 2³⁵ bits with eight prover threads, Akita's proofs of 65–72 KB compare with 234–1441 KB for Plonky3 STIR and FRI, two WHIR implementations, Binius64 and SP1 Basefold, and Ligerito; every hash baseline except SP1's verifies faster than Akita, in 1–11 ms, and several open faster, while Akita's commitment of 2.9–3.8 s is at the fast end of the range. Inside Jolt, on SHA-256 chains up to 2²⁷ padded trace rows, Akita proves 1.3–2.2× faster and verifies 2.2–7.4× faster than Dory with complete proofs of 86–98 KB.

On the security side the commitments are full-width Module-SIS with a 128-bit quantum target, the knowledge-soundness proof is in the classical random-oracle model with the quantum case left open, and the authors flag that the response model used to plan later folds is heuristic and that zero knowledge is future work^[4].

7 · Grand Danois: a structured key for a polylogarithmic verifier

Grand Danois, by Kallesøe and Khoshakhlagh at Aarhus in 2026, takes Hachi's design and asks what it would take to make the verifier polylogarithmic rather than a root^[6]. The answer it gives is to change the commitment. Instead of a uniformly random Ajtai matrix, the key is an iterated row-tensor product of small random matrices, drawn from what the paper calls a vanishing-SIS-friendly distribution adapted from the 2023 construction of Cini, Lai and Malavolta, whose original form is the sequence of powers of one random ring element v, so that committing to a short vector s means evaluating it as a polynomial, Σ_i s_ivⁱ. Finding two short openings of the same value means finding a short nonzero polynomial that vanishes at the key's points, which is the vanishing-SIS problem, studied further since^[31][32]. The structure is what the verifier needs: the parts of the key that survive a fold have a closed form a verifier can compute in time logarithmic in the key's length, in the way that a Bulletproofs verifier folds its generators, but without the linear work. Akita reaches a similar effect by committing to the random key and proving against the commitment; Grand Danois gets it from the algebra and pays with an assumption that has had far less cryptanalysis than Module-SIS, a point its authors and Akita's both make.

The second change is how ring equations are turned into field statements. Rather than Hachi's quotient lift, Grand Danois uses the rotation matrix of a ring element: multiplication by a fixed a ∈ R_q is the d × d matrix over 𝔽_q whose columns are the coefficient vector of a and its successive negacyclic shifts, the same device Neo uses to run sumchecks over the field^[24]. Every row of the relation is then a matrix-vector product with rotation blocks, and because each block is determined by one vector, the sumcheck verifier's work per row is linear in d rather than quadratic. Akita observes that this check produces the same coefficients as its own quotient-free transpose-convolution and uses it selectively; Grand Danois uses it throughout, since its fixed-dimension relation is set up for it^[4].

The third change is the norm proof. Hachi proves the infinity norm through a range check on every digit, whose communication grows with the decomposition. Grand Danois returns to random projections, in the structured form of RoK and Roll that a succinct verifier can process^[22], and tightens the structure further: two small independent projections J and J′ are applied in two tensor-structured layers, the first to blocks of the witness and the second across the results, which shrinks the witness aggressively at each level without the verifier having to sample much randomness. The projection of the witness is then checked probabilistically through the same fold, Ĵ·z = c^⊤·p, so the projected vector p̂ and the partials ŵ share one commitment and the norm bound and the evaluation are proven in a single protocol. The relation of §4 gains one block row and loses a separate norm argument.

Numbers. The verifier is O(λℓ) for an ℓ-variate polynomial, and the proof size the same. The paper gives an estimate rather than a measurement: for a 32-bit q, k = 4, an Ajtai commitment costed at 4 KB and a sumcheck witness of at most 2³² field elements, each invocation of the evaluation protocol costs about 8 KB of commitments and 1.5 KB of sumcheck messages, and the total for a 2³²-size evaluation is placed between 80 and 90 KB, which the authors call conservative^[6]. There is no implementation. Two things are given up relative to Hachi: the verifier performs ring operations again, and polynomials over 𝔽_q^k are not supported directly, though the authors note Hachi's embedding would restore them at a cost.

8 · Maltese: a Merkle tree of Ajtai hashes

Maltese, by Cheng, Nguyen and Tyagi at the University of Washington and Microsoft Research in 2026, reaches a polylogarithmic verifier without leaving Module-SIS, at 335 KB computed for 2³⁰ coefficients^[7]. The construction will look familiar to a FRI reader, because it is a Merkle tree, with one change: the hash at every node is the Ajtai map applied to the digits of the node's input, A·G⁻¹(·), rather than a bit-oriented function, so each layer of the tree is a lattice commitment and can be folded like one.

The tree. The leaves are the digit decomposition of the data. Each internal node commits to the decomposed commitments of its children, and the root t is the published commitment. Opening the root to the data means revealing the digit vector of every layer, s₁ at the top down to s_ℓ at the leaves, and the verifier checks that each layer recomposes to the layer above, t = A·s₁ and (I ⊗ A)·s_i+1 = G·s_i, and that every layer is short. The tree is homomorphic layer by layer: openings of two subtrees can be combined with a challenge into an opening of the combined root. This is the commitment of Cini, Malavolta, Nguyen and Wee, who also gave the FRI-style evaluation protocol on it^[19]: the prover reveals the top layer, which is the two children of the root; the multilinear extension splits as f̃ = (1 − X₁)·f̃₀ + X₁·f̃₁; the prover sends the two children's evaluations at the remaining coordinates, the verifier checks their combination against the claim and sends a challenge c, and both fold the two subtrees and the two claims into one half-size instance, t′ = t′₀ + c·t′₁, v′ = v′₀ + c·v′₁. After ℓ rounds the claim is on a single small polynomial that is opened directly.

What stopped that protocol from being practical is the norm. Each round grows the norm of every remaining layer by a factor 1 + T, T the expansion factor of the challenge, so Cini et al. either took binary challenges (C = {0, 1}; Maltese's telling says {−1, 0, 1}) and amplified by repetition, or took a large challenge set and could afford only a constant number of folds, two folds and a direct opening, which gives the cube-root variant with 5.2 MB proofs. Maltese keeps the large challenge set and runs the norm-check, fold, decompose cycle of §2.5 over the tree, with each step a sumcheck.

The cycle over the tree. The norm check proves ‖s_i‖_∞ < b for every layer at once, by sumcheck, together with the original evaluation claim; what comes out is an evaluation claim on the multilinear extension of each layer's opening, a relation the paper calls a tree evaluation. The fold opens h layers at a time and combines 2^h subtrees, which a plain linear combination can no longer express because the claims now live on concatenated openings, so a sumcheck separates the claim on the top h layers from the claim on the subtrees before the latter are folded; the top-layer claim is set aside. The decomposition re-digits every layer of the folded tree and recommits all of the digit vectors as the leaves of a new tree, because decomposition does not commute with the layers, and a sumcheck proves that the new leaves recompose to the old layers. Then the cycle repeats on a tree h − log log β′ − 1 levels shorter, β′ the norm after the fold: the fold removes h levels and the re-digiting adds about log log β′ + 1 back, so h must exceed that for progress. The leftover claims are gathered at the end and discharged by a modified Greyhound, so LaBRADOR appears once, at the base. The sumchecks run over the ring through its isomorphism with a product of extension fields, which is also how the paper obtains a large challenge set with invertible differences.

Numbers. The verifier performs O(log³ N) ring operations and O(log² N) extension-field operations for the sumchecks; the proof is O(log² N) ring elements; the prover is O(N) ring operations. The headline parameter set uses a 32-bit q, d = 64 splitting into factors of degree 8 so that sumchecks run over 𝔽_q⁸, a tree of rank 32 with binary digits, a sparse challenge set of 2¹²⁴ elements, h = 7 layers folded per round (128 subtrees), and a Module-SIS estimate of 240 bits; it gives 335 KB at 2³⁰, with other sets from 224 KB to 863 KB at lower security margins or wider fields^[7]. The sizes are accounted from the protocol, not measured, and no running times are reported. Extraction is slack-free, the public parameters are one Ajtai matrix, polynomials over small fields encode efficiently with evaluation points in an extension, and zero rows cost nothing to commit, which the authors note matters for the sparse polynomials of memory-checking arguments. Their own placement of the result: about 300 times smaller than earlier polylogarithmic-verifier schemes under Module-SIS, and two to six times larger than the root-verifier schemes or the vanishing-SIS ones.

9 · Jindo: large fields and zero knowledge for client-side proving

Jindo, by Hwang, Lee, Seo and Song at Seoul National University in January 2026, is built for a different customer than the zkVM: a client proving a statement about its own ciphertext, key or credential, who needs a fast prover, evaluation hiding, and a field matching the statement, which for lattice-based encryption and signatures means primes of 128 to 1024 bits^[8]. The authors start from two CRYPTO 2024 schemes with complementary limitations. CELPC had the field flexibility through an encoding of large primes into short ring elements, but a polynomial-size challenge set, so its proofs needed repetition and reached 8.9 MB at 2²⁰ with zero knowledge in Jindo's measurement^[33][8]. Greyhound had the exponentially large challenge set, but tied the field to its commitment modulus, a 32-bit prime congruent to 5 modulo 8 with the slower partially-splitting NTT.

The encoding. For a prime of the form p = b^d/γ + 1 with γ dividing d, the ring R modulo X^γ − b is isomorphic to ℤ_p^γ. A vector of γ field elements is encoded by writing each in base b and placing the j-th digit of the i-th element at X^i+γj, which gives a ring element with coefficients below b, hence short, hence committable under any modulus q; and the encoding respects the arithmetic, Ecd(α)·Ecd(a) + Ecd(c) ≡ Ecd(αa + c) modulo X^γ − b. The field modulus is p, the commitment modulus is q, and they no longer have anything to do with each other. Jindo's implementation uses digits of about 32 bits and chooses q with 2d dividing q − 1, the fully splitting case that gives the fastest NTT and that LaBRADOR and Greyhound cannot use.

The evaluation. The claim is again a quadratic form, now over encoded vectors: â^⊤F̂b̂ = ŷ modulo X^γ − b, with F̂ the matrix of encoded coefficient chunks and â, b̂ the encodings of the public weight vectors of §3.1. The commitment has Greyhound's two tiers with two additions: each inner commitment carries Module-LWE randomness, t = A·f̂ + B·e with e a short random vector, which makes it hiding, and both tiers are rounded before being committed again, which shrinks them. The three-round protocol is as in §3.2, with the response carrying the folded randomness as well as the folded columns. The new point is extraction: the challenge difference must be invertible in the message ring R modulo X^γ − b, not in R_q, which is what frees q; the authors analyse their challenge set's spread over that ring with a heuristic from earlier work, a point Akita's survey also notes^[4].

The cube root. Several quadratic forms with separate outer commitments can be batched: the verifier sends random coefficients, both sides form the combination of the matrices, commitments and claimed values, and one evaluation protocol serves all of them, at cost Õ(m + r + t) for t forms over an m × r split, instead of t times the cost of one. Jindo exploits the batching by splitting the polynomial into m₀ subpolynomials, each committed as its own matrix; the evaluation is the weighted sum of the subpolynomials' evaluations, the prover sends those, the verifier checks the weighted sum, and the batched protocol proves them together. With m₀ ≈ N^1/3 the three sides balance and communication and verification are Õ(N^1/3). The same split carries the zero knowledge: each subpolynomial is augmented with a random one, f_i + X*·g_i, committed together, and after the verifier chooses X* the revealed partial evaluations are masked by the random part, with a Schwartz–Zippel argument over the large field for soundness; the final response is masked by a Gaussian-sampled commitment with rejection sampling, as in lattice signatures. The masking overhead is O(N/m₀) rather than the O(N) of masking the whole witness, which is what keeps the prover fast.

Numbers. Single-threaded on a laptop, over a field of about 256 bits, at 2²⁰ coefficients: zero-knowledge Jindo proves in 273 ms, verifies in 14 ms, and produces a 1.2 MB proof. The paper's comparison at the same size has zero-knowledge CELPC at 3.7 s, 168 ms and 8.9 MB, the zero-knowledge code-based DeepFold and PIP-FRI at 6.6 s and 2.9 s with 0.9–1.6 MB proofs, WHIR without zero knowledge at 1.8 s, 1.4 ms and 291 KB, and Greyhound without zero knowledge, run over its 32-bit field on a polynomial eight times longer to equalise the witness in bits, at 695 ms, 96 ms and 46 KB^[8]. Jindo supports univariate polynomials by the same construction and extension fields in a later section. The proof is a megabyte because the protocol folds once and sends the fold; there is no LaBRADOR or sumcheck compression behind it. For the client-side setting the authors argue that prover time is the metric that decides deployment, and there it leads by an order of magnitude.

10 · HyperWolf and Serval: slack-free norms

HyperWolf was posted to ePrint in May 2025 by Zhang, Gao and Xiao at Hong Kong Polytechnic University. Its abstract generalises Greyhound's two-dimensional split to a k-dimensional hypercube with a k-round recursive protocol of overall cost O(k·N^1/k), and at k = log N proof size and verifier time of O(log N), for univariate and multilinear polynomials alike^[34]. The paper was withdrawn by its authors on October 3, 2025. The archive records a metadata-only update on that date and gives no reason, and the PDF is no longer served. Nine days later the same group, with Chow, posted Serval, whose ePrint listing describes it as an optimisation of the withdrawn work with implementations, norm proofs and enhancements added^[35]. A reader who meets HyperWolf in a citation list should read Serval.

Serval's title names its contribution: slack-free ℓ₂ soundness. Recall from §2.4 that extraction divides by a challenge difference whose inverse is not short, so the extractor can only guarantee a bound that is a multiple of the honest one, the factor growing with the number of rounds. Serval's extractor returns a witness satisfying the same bound the relation states. The method follows a 2022 paradigm of Lyubashevsky and collaborators: prove the quadratic statement ⟨s, s⟩ ≡ β′ (mod q) for a claimed integer β′ ≤ β², and separately a coefficient bound strong enough that the integer inner product cannot wrap around q; then the residue is the true squared norm and ‖s‖₂ ≤ β holds exactly. Serval takes the coefficient bound to its extreme by decomposing the witness in base 2, so that the bound is binarity: s ∘ (s − 1) = 0 on every coordinate, and with n_s binary coordinates in all, the inner product is at most n_s < q/2 and never wraps. Binarity is then reduced to one randomised inner-product check, ⟨s ∘ ρ, s⟩ = ⟨s, ρ⟩ for a verifier-chosen vector ρ, which has the same algebraic shape as the evaluation constraint and the commitment-consistency constraint. One divide-and-conquer split-and-fold protocol therefore proves all four constraints together in log N rounds, over a log N-level Ajtai commitment, and the transcript is compressed by Fiat–Shamir and LaBRADOR.

Numbers. The paper's optimised sizes, computed from LaBRADOR's formulas rather than measured, are 259 KB at 2¹⁵ and 436 KB at 2²⁰, rising to 2.0 MB at 2²² and 3.6 MB at 2³⁰; the moduli are large, 84 to 128 bits, with d = 64 and a challenge set of 2¹²⁴ elements with 24 zero, 32 unit and 8 double coefficients^[35]. At 2²⁰ the authors place this 8 times below Fenzi–Moghaddas–Nguyen and 85 times below SLAP, and above Greyhound, which they attribute to the structural limit of the leveled commitment and the cost of exact range enforcement; the verifier, they argue, scales better at large sizes. The prototype implements the interactive protocol without the LaBRADOR compaction, because the available LaBRADOR code was not stable on their platform, and its microbenchmarks run at 90-bit security with two parallel repetitions and a fixed 100-bit modulus, so the paper compares ring-operation counts against Greyhound rather than wall-clock times. The construction is stated to be compatible with the transparent tree commitment of Cini et al.

11 · The rest of the field

The seven schemes above sit inside a larger literature that the comparison in §12 draws on. In rough chronological order:

LaBRADOR (2023) is a proof system, not a commitment, and the compressor under Greyhound, Serval and LaBinius: 47–58 KB for R1CS instances of 2¹⁰–2²⁰ constraints, with a verifier linear in the statement^[21]. The LaZer toolkit that integrates it with a linear-size zero-knowledge proof is, in Akita's judgement, the lattice system closest to deployment, with verification above a second on large instances^[4]. Its ancestors are the lattice Bulletproofs of Bootle, Lyubashevsky, Nguyen and Seiler, which folded in logarithmically many rounds with an inverse-polynomial soundness error per round^[15], and the sumcheck-based arguments of Bootle, Chiesa and Sotiraki^[36].

FMN23, SLAP and CMNW24 (2023–24) are the asymptotically succinct line: polylogarithmic proofs and verification, the first two with a trusted setup at 8.3 MB and 767 MB for 2³⁰ coefficients, and the last transparent, with a knowledge-soundness proof against quantum adversaries for its basic polylogarithmic variant, which is above 100 MB; its practical cube-root variant is 5.2 MB^[26][18][19]. CELPC (2024) contributed the large-field encoding Jindo uses^[33].

The vanishing-SIS line from Klooß, Lai, Nguyen, Osadnik and coauthors, so classified by Maltese's survey table and Akita's related-work discussion, builds polylogarithmic verifiers on structured commitments: RoK, Paper, SISsors is the toolkit of reductions with exact norm bounds^[37]; RoK and Roll adds the structured projections and reaches Õ(λ) proof size, at 3.2 MB for 2³⁰ in Maltese's table^[22]; SALSAA adds sumcheck for a linear-time prover, at 1.1 MB^[38]; and RoKoko commits the folding cross terms instead of sending them, which permits large folding arity, and reports proofs of roughly 200 KB with verification about 100 times faster than Greyhound^[5]. Akita measured RoKoko at 109–115 KB and 4–7 ms with a 100-bit statistical soundness target over a 50-bit field^[4].

LaBinius (2026), by Osadnik and Seiler, separates the commitment arithmetic from the evaluation arithmetic: the commitment runs over a composite modulus whose prime factors are all NTT-friendly, and the evaluation claim lives in a binary extension field, so binary computations are proven without bitness checks^[39]. Connected to the Binius and Flock front ends it proves Keccak-256, SHA-256 and BLAKE3 at no more than 1.2 times the time of each system's hash-based prover, and with LaBRADOR as compressor its proofs are below 100 KiB, which the authors describe as the smallest quantum-safe proofs of a standard hash evaluation to date.

Orthus (2026) gives square-root batch verification of lattice relations from standard assumptions^[40]. The folding schemes, LatticeFold and LatticeFold+ by Boneh and Chen and Neo and SuperNeo by Nguyen and Setty, are accumulation schemes rather than commitments, but the sumcheck-based range proofs over the ring and the rotation-matrix trick that several schemes above use come from them^[23][24].

12 · Side by side

Figure 5 plots the sizes of the table on one axis.

13 · Reading the numbers from the hash-based side

Proof size is the settled advantage. At 2³⁰ coefficients the Module-SIS schemes with root verifiers sit at 53–72 KB, and the gap to hash-based proofs is a factor of two to twenty depending on which hash-based figure is chosen: WHIR's 123 KiB under the capacity conjecture, its 544 KiB under unique decoding, and the 234–1441 KB that Akita measured across seven deployed implementations at 2³⁵ bits^[1][4]. The polylogarithmic lattice verifiers cost more, about 200 KB under vanishing SIS and 335 KB computed under Module-SIS. The floor under the small numbers is the LaBRADOR tail, about 43 KB in Hachi's accounting^[3], and a smaller tail is the first item on Akita's own list of future work^[4].

Verification caught up in 2026. Greyhound's 2.8 seconds was the number that kept lattice commitments out of production; Hachi cut it to 227 ms, and Akita and RoKoko to 8–16 ms and 4–7 ms. Hash-based verifiers remain faster, at 1–11 ms for most implementations in the same harness, but the two are now within an order of magnitude^[4].

The prover is mixed, and committing is where lattices win. An Ajtai commitment is a linear map on digits, computed with NTTs, and it skips zero rows, so it is cheap and pay-per-nonzero; Akita commits 2³⁵ bits in 2.9–3.8 s on eight threads where the hash-based implementations take 2.4 to 68 s. Opening is the other way round at small sizes: several hash-based schemes open faster than Akita, and the older lattice provers are slow and hungry, Greyhound at 173 s single-threaded at 2³⁰ in its own paper and at 72 s with 93 GiB of peak memory in Akita's recalibrated run, Hachi's prototype at 270 s^[2][4][3].

Assumptions come in two grades, and the fine print matters. Module-SIS and Module-LWE are the assumption family under ML-DSA and ML-KEM, with worst-case reductions and decades of cryptanalysis; vanishing SIS is from 2023. But a comparison of assumptions has to include what the code does: the released LaBRADOR and Greyhound commitments are a truncated extension-ring product that the Module-SIS theorems do not cover; RoKoko's and Jindo's challenge sets are analysed heuristically; and the papers use different concrete-security conventions, which is why Akita recalibrated its baselines before measuring them^[4]. None of this is an attack. It is the same situation the hash-based side has with its proximity-gap conjectures, and a fair comparison fixes the conjectures on both sides before reading the sizes.

Soundness has lattice-specific fine print. Extraction with slack means the extracted polynomial's digits are only guaranteed short up to a factor, which is harmless once the parameters absorb it but which complicates composition with a PIOP that wants an exact opening; Serval, Maltese and Akita's exact norm check remove it. Every scheme is many-round, LaBRADOR with its six or seven levels and the sumcheck-based ones with log N rounds per level, so the Fiat–Shamir analysis goes through coordinate-wise special soundness and round-by-round arguments; Akita's proof is in the classical random-oracle model, and among the schemes here only CMNW24 has a knowledge-soundness proof against quantum adversaries, for its basic polylogarithmic variant in the interactive setting rather than for the cube-root instantiation; no scheme here has a Fiat–Shamir proof in the quantum random-oracle model^[19][4].

Fields are the practical constraint. Greyhound, Hachi and Akita's main profile work over a 32-bit prime that is also the commitment modulus, with evaluation points in a degree-4 extension, which fits a small-field PIOP and does not fit a 256-bit one; Akita adds 64- and 128-bit profiles. Jindo's encoding covers primes of 128–1024 bits at megabyte proof sizes, and LaBinius covers binary fields. Every scheme except Greyhound as written is multilinear; Greyhound becomes multilinear by Hachi's embedding, since the engine of §3 only needs two public weight vectors.

Zero knowledge is rare. Jindo designs for it and measures it; Greyhound describes it; Akita lists it as future work; Hachi, Grand Danois and Maltese do not have it, and Serval has only a one-sentence remark. A sumcheck-based PIOP that needs a hiding commitment has one lattice option today.

Maturity. Greyhound has an optimised C implementation inside the LaBRADOR repository; Akita has a Rust implementation with a parameter planner, distributed proving and a Jolt integration; Jindo and LaBinius have released code; Hachi and Serval have prototypes that stop short of the full protocol; Grand Danois has none, and Maltese reports sizes without times. What remains open across the field, in the authors' own lists: smaller tails under the 40 KB floor, faster provers, proofs in the quantum random-oracle model, zero knowledge at low overhead, more cryptanalysis of the structured assumptions, and a shared convention for concrete security so that the next comparison table does not have to recalibrate its rows.

For a reader who builds on FRI, Basefold or WHIR today, the practical reading is this. A multilinear PIOP over a 32-bit field has, in Akita, a lattice commitment with proofs a third to a twentieth the size of the hash-based proofs measured in the same harness and about half of WHIR's conjectured 123 KiB, verification within an order of magnitude, a cheaper commitment, and the caveats above on heuristics and the random-oracle model. Client-side proving over a large field with hiding has Jindo, at megabyte proofs. Polylogarithmic verification has RoKoko under vanishing SIS now and Maltese under Module-SIS on paper. And every one of these runs the same three-round engine on the same bilinear form; what the reader already knows about folding transfers, with the proximity test replaced by a norm proof.

References

Preprints are cited by ePrint number with the section, figure or table the claim comes from; published versions by venue and DOI. Repository links are to the projects' default branches as of October 2, 2026.

1. G. Arnon, A. Chiesa, G. Fenzi, E. Yogev, "WHIR: Reed–Solomon Proximity Testing with Super-Fast Verification," EUROCRYPT 2025; ePrint 2024/1586 — eprint.iacr.org/2024/1586. Argument-size ranges in §1.1 (rate 1/2: 76–123 KiB at 100-bit and 120–187 KiB at 128-bit security for 2¹⁸–2³⁰); the Basefold comparison with 7.95–9.26 MiB for an unoptimised implementation (§6.3.1, Table 2 for the 2³⁰ figures 544 and 123 KiB); FRI 306–430 KiB and STIR 160–189 KiB at 2²⁴–2²⁸, 128-bit, 192-bit field (§6.3.2); unique-decoding versus capacity-bound variants (§6.3.4).
2. N. K. Nguyen, G. Seiler, "Greyhound: Fast Polynomial Commitments from Lattices," CRYPTO 2024; ePrint 2024/1293 — eprint.iacr.org/2024/1293. The three-round protocol and the LaBRADOR relation: §1.2; sizes and single-core timings: Tables 1–2; the field-to-ring transformation with the constant-term identity: §4.1; concrete parameters (d = 64, q ≈ 2³²): Table 4; the hiding variant: §4.5, with its parameters discussed in §5. Implementation in the LaBRADOR repository, github.com/lattice-dogs/labrador.
3. N. K. Nguyen, G. O'Rourke, J. Zhang, "Hachi: Efficient Lattice-Based Multilinear Polynomial Commitments over Extension Fields," ePrint 2026/156 — eprint.iacr.org/2026/156. Headline comparison (55 KB, 227 ms against Greyhound's 53 KB, 2.8 s at ℓ = 30): Fig. 1; the subfield lemma and trace identity: §1.3 (Lemma 1, Theorem 1); ring switching and the field range proof: §1.3 and §4.3; parameters (Fig. 9: d = 1024, q = 4294967197, k = 4, 16-nonzero challenges) and the 7.3 + 4.8 + 43 KB accounting with a Greyhound tail, prover time about 270 s: §5.1–5.2. Code: github.com/georgeorourke/hachi-pcs.
4. Q. Dao, O. Bodaghi, A. Khajehpour, G. Vitto, M. Badakhshan, M. Georghiades, F. Liu, J. Zhang, J. Thaler, "Akita: A High-Performance Lattice-Based Polynomial Commitment Scheme," ePrint 2026/1983 — eprint.iacr.org/2026/1983. The Hachi fold and setup offloading: §2.1–2.2 (the verifier accounting is eq. 13); lattice comparison including the recalibrated Greyhound: §13.2 and Table 8; hash-based comparison: Table 9; Jolt end-to-end: Table 10; soundness in the classical ROM only, QROM open: §1.1 and §14; corrections to Hachi's base-field shortcut and the truncated-output Ring-SIS map in the LaBRADOR and Greyhound code: Appendix F. Code: github.com/LayerZero-Labs/akita.
5. M. Klooß, R. W. F. Lai, N. K. Nguyen, M. Osadnik, L. Tucci, "RoKoko: Lattice-Based Succinct Arguments, a Committed Refinement," ePrint 2026/575, received March 23, 2026, last revised September 9, 2026 — eprint.iacr.org/2026/575. Abstract: proofs of roughly 200 KB with verification about 100× faster than Greyhound; measured by Akita (Table 8) at 109–115 KB and 4.0–7.2 ms with a 100-bit statistical-soundness target.
6. A. Kallesøe, H. Khoshakhlagh, "Grand Danois: Succinct Multilinear Polynomial Commitments over Lattices," ePrint 2026/1196 — eprint.iacr.org/2026/1196. The Greyhound relation it starts from: §1.1, eq. (1); the structured projection (I_r ⊗ J′)(I_rȷ ⊗ J) folded into the relation, and multiplication by rotation matrices: §1.3, eqs. (3)–(7); the 80–90 KB estimate for 2³²-size evaluations, stated without an implementation: §3.3.
7. K. Cheng, W. Nguyen, N. Tyagi, "Maltese: Succinct Polynomial Commitment from Lattices," ASIACRYPT 2026 per its ePrint listing; ePrint 2026/2067 — eprint.iacr.org/2026/2067. The survey table of lattice PCS sizes at 2³⁰ (Fig. 1); the homomorphic tree commitment and the norm-check / fold / decompose cycle: §2.1–2.2; candidate parameter sets P1–P11 with security estimates and proof sizes (P3: 32-bit q, d = 64, 335 KB): Fig. 5; proof-size accounting: §6.2. Runtimes are not reported.
8. I. Hwang, H. Lee, J. Seo, Y. Song, "Jindo: Practical Lattice-Based Polynomial Commitments for Client-Side Proving," ePrint 2026/044 — eprint.iacr.org/2026/044. The CELPC encoding (ℤ_p^γ ≅ R/(X^γ − b) for p = b^d/γ + 1): §2.1; quadratic-form evaluation, batching and the cube-root split: §2.2–2.3; evaluation hiding with augmented subpolynomials and rejection sampling: §2.4; NTT-friendly moduli and the heuristic challenge-set analysis: §5.1; benchmarks at log N = 14–20 over a 256-bit field (Table 1). Code: github.com/sp301415/ringo-snark.
9. E. Ben-Sasson, I. Bentov, Y. Horesh, M. Riabzev, "Fast Reed–Solomon Interactive Oracle Proofs of Proximity," ICALP 2018 — doi.org/10.4230/LIPIcs.ICALP.2018.14.
10. H. Zeilberger, B. Chen, B. Fisch, "BaseFold: Efficient Field-Agnostic Polynomial Commitment Schemes from Foldable Codes," CRYPTO 2024; ePrint 2023/1705 — eprint.iacr.org/2023/1705.
11. M. Ajtai, "Generating Hard Instances of Lattice Problems," STOC 1996 — doi.org/10.1145/237814.237838. The short-integer-solution problem, its worst-case hardness, and the hash function s ↦ As.
12. A. Langlois, D. Stehlé, "Worst-Case to Average-Case Reductions for Module Lattices," Designs, Codes and Cryptography 75(3), 2015 — doi.org/10.1007/s10623-014-9938-4. Module-SIS and Module-LWE with worst-case reductions over module lattices.
13. NIST, FIPS 204: Module-Lattice-Based Digital Signature Standard, August 13, 2024 — nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.204.pdf. Cited only for the fact that ML-DSA rests on Module-LWE and a self-target variant of Module-SIS over ℤ_q[X]/(X²⁵⁶ + 1).
14. V. Lyubashevsky, G. Seiler, "Short, Invertible Elements in Partially Splitting Cyclotomic Rings and Applications to Lattice-Based Zero-Knowledge Proofs," EUROCRYPT 2018; ePrint 2017/523 — eprint.iacr.org/2017/523. The invertibility bound is quoted here in the form of Greyhound's Lemma 2.1: for prime q ≡ 5 (mod 8), any f with 0 < ‖f‖_∞ < q^1/2/√2 or 0 < ‖f‖₂ < q^1/2 is invertible.
15. J. Bootle, V. Lyubashevsky, N. K. Nguyen, G. Seiler, "A Non-PCP Approach to Succinct Quantum-Safe Zero-Knowledge," CRYPTO 2020; ePrint 2020/737 — eprint.iacr.org/2020/737. The lattice Bulletproofs that first folded a committed vector in logarithmically many rounds, with the inverse-polynomial soundness error per round that later designs avoid.
16. T. Attema, V. Lyubashevsky, G. Seiler, "Practical Product Proofs for Lattice Commitments," CRYPTO 2020; ePrint 2020/517 — eprint.iacr.org/2020/517. Weak (relaxed) openings and the cross-multiplication argument that makes them binding, reused by Greyhound (Lemma 2.11) and Hachi (Lemma 7).
17. M. R. Albrecht, R. W. F. Lai, "Subtractive Sets over Cyclotomic Rings: Limits of Schnorr-like Arguments over Lattices," CRYPTO 2021 — doi.org/10.1007/978-3-030-84245-1_18. Subtractive sets are at most polynomial in size, which is why that route needs repetition.
18. M. R. Albrecht, G. Fenzi, O. Lapiha, N. K. Nguyen, "SLAP: Succinct Lattice-Based Polynomial Commitments from Standard Assumptions," EUROCRYPT 2024; ePrint 2023/1469 — eprint.iacr.org/2023/1469. Polylogarithmic proofs and verification from Module-SIS with a trusted setup; 767 MB at 2³⁰ as tabulated by CMNW24 and Maltese (785,408 KB in Greyhound's Table 1); also the source of the field-to-ring transformation (§5.5) used by Greyhound.
19. V. Cini, G. Malavolta, N. K. Nguyen, H. Wee, "Polynomial Commitments from Lattices: Post-Quantum Security, Fast Verification and Transparent Setup," CRYPTO 2024; ePrint 2024/281 — eprint.iacr.org/2024/281. Tree Ajtai commitment with FRI-style folding, transparent setup, knowledge soundness against quantum adversaries for its basic polylogarithmic variant; concrete sizes in the megabytes (5.17 MB at 2³⁰ for the cube-root variant, as tabulated by Serval and Maltese).
20. C. Gentry, S. Halevi, V. Lyubashevsky, "Practical Non-interactive Publicly Verifiable Secret Sharing with Thousands of Parties," EUROCRYPT 2022; ePrint 2021/1397 — eprint.iacr.org/2021/1397. The modular Johnson–Lindenstrauss lemma behind projection-based norm proofs.
21. W. Beullens, G. Seiler, "LaBRADOR: Compact Proofs for R1CS from Module-SIS," CRYPTO 2023; ePrint 2022/1341 — eprint.iacr.org/2022/1341. Technical overview in §1.1: dot-product constraints, amortised openings, the modular Johnson–Lindenstrauss projection to 256 coordinates (the honest norm lands between √30 and √128 times the witness norm, slack about 2.07), inner and outer commitments, witness shrinking to about the 2/3 power per level, six or seven levels in practice; 47–58 KB for R1CS with 2¹⁰–2²⁰ constraints, linear verifier.
22. M. Klooß, R. W. F. Lai, N. K. Nguyen, M. Osadnik, "RoK and Roll: Verifier-Efficient Random Projection for Õ(λ)-size Lattice Arguments," ASIACRYPT 2025; ePrint 2025/1220 — eprint.iacr.org/2025/1220. Structured random projections that a succinct verifier can process; vanishing-SIS commitments; 3152 KB at 2³⁰ as tabulated by Maltese.
23. D. Boneh, B. Chen, "LatticeFold: A Lattice-Based Folding Scheme and Its Applications to Succinct Proof Systems," ASIACRYPT 2025; ePrint 2024/257 — eprint.iacr.org/2024/257; and "LatticeFold+: Faster, Simpler, Shorter Lattice-Based Folding for Succinct Proof Systems," CRYPTO 2025; ePrint 2025/247 — eprint.iacr.org/2025/247. Sumcheck-based range proofs over the ring; folding schemes rather than polynomial commitments.
24. W. Nguyen, S. Setty, "Neo: Lattice-Based Folding Scheme for CCS over Small Fields and Pay-Per-Bit Commitments," ePrint 2025/294 — eprint.iacr.org/2025/294; and "Neo and SuperNeo: Post-Quantum Folding with Pay-Per-Bit Costs over Small Fields," CRYPTO 2026; ePrint 2026/242 — eprint.iacr.org/2026/242. Rotation matrices (Neo, Definition 7) that turn multiplication by a ring element into a matrix over the field.
25. C. Baum, J. Bootle, A. Cerulli, R. del Pino, J. Groth, V. Lyubashevsky, "Sub-linear Lattice-Based Zero-Knowledge Arguments for Arithmetic Circuits," CRYPTO 2018 — doi.org/10.1007/978-3-319-96881-0_23. The original split-and-fold protocol of §3, as restated in Hachi §1.1.
26. G. Fenzi, H. Moghaddas, N. K. Nguyen, "Lattice-Based Polynomial Commitments: Towards Asymptotic and Concrete Efficiency," Journal of Cryptology 37(3), 2024; ePrint 2023/846 — eprint.iacr.org/2023/846. Coordinate-wise special soundness (Lemma 2.31 there, Lemma 2.6 in Greyhound); the Power-BASIS construction with 8.3 MB proofs at 2³⁰.
27. V. Lyubashevsky, N. K. Nguyen, M. Plançon, "Lattice-Based Zero-Knowledge Proofs and Applications: Shorter, Simpler, and More General," CRYPTO 2022; ePrint 2022/284 — eprint.iacr.org/2022/284. The constant-term inner-product identity ct(σ₋₁(u)·v) = ⟨u, v⟩ and the subfield lemma (Lemma 2.6) that Hachi generalises.
28. M.-Y. Huang, X. Mao, J. Zhang, "Sublinear Proofs over Polynomial Rings," ePrint 2025/199 — eprint.iacr.org/2025/199. Ring switching: lift a ring relation to a polynomial identity with an explicit quotient and evaluate it at a random extension-field point.
29. B. E. Diamond, J. Posen, "Polylogarithmic Proofs for Multilinears over Binary Towers," EUROCRYPT 2026; ePrint 2024/504 — eprint.iacr.org/2024/504. The tensor-algebra ring-switching reduction (Theorem 3.5) that Akita uses to authenticate partial evaluations of a base-field polynomial at an extension-field point.
30. S. Setty, J. Thaler, "Twist and Shout: Faster Memory Checking Arguments via One-Hot Addressing and Increments," ePrint 2025/105 — eprint.iacr.org/2025/105; and A. Arun, S. Setty, J. Thaler, "Jolt: SNARKs for Virtual Machines via Lookups," EUROCRYPT 2024; ePrint 2023/1217 — eprint.iacr.org/2023/1217. The one-hot polynomials whose sparsity makes pay-per-nonzero commitment matter.
31. V. Cini, R. W. F. Lai, G. Malavolta, "Lattice-Based Succinct Arguments from Vanishing Polynomials," CRYPTO 2023; ePrint 2023/1405 — eprint.iacr.org/2023/1405. The vanishing-SIS assumption and commitments to short polynomials by evaluation at public points.
32. K. Jyrkinen, R. W. F. Lai, "Vanishing Short Integer Solution, Revisited: Reductions, Trapdoors, Homomorphic Signatures for Low-Degree Polynomials," PKC 2025 — doi.org/10.1007/978-3-031-91823-0_9.
33. I. Hwang, J. Seo, Y. Song, "Concretely Efficient Lattice-Based Polynomial Commitment from Standard Assumptions," CRYPTO 2024; ePrint 2024/306 — eprint.iacr.org/2024/306. The encoding of large prime fields into short ring elements that Jindo inherits; polynomial-size challenge set with repetition.
34. L. Zhang, S. Gao, B. Xiao, "HyperWolf: Efficient Polynomial Commitment Schemes from Lattices," ePrint 2025/922, received May 22, 2025, withdrawn October 3, 2025 — eprint.iacr.org/2025/922. The archive's version list shows a PDF of May 22 and a metadata-only update on the withdrawal date; no reason is given. The abstract claims a k-dimensional hypercube generalisation of Greyhound's two-dimensional split with a k-round recursive protocol, O(k·N^1/k) cost, and O(log N) proof size and verifier time at k = log N.
35. L. Zhang, S. S. M. Chow, S. Gao, B. Xiao, "Serval: Slack-Free ℓ₂-Sound Polynomial Commitments from Lattices," ePrint 2025/1903, received October 12, 2025, last revised March 7, 2026 — eprint.iacr.org/2025/1903. The ePrint listing describes it as an optimisation of ePrint 2025/922 with implementations and norm proofs added. Comparison table (Table 1), the self-inner-product and binarity reduction (§1.2–1.3), concrete sizes (Table 4: 436 KB at 2²⁰, 3.59 MB at 2³⁰, moduli of 84–128 bits) and the prototype without LaBRADOR compaction (§5.2). Code: gitlab.com/LatticePCSReview/servalPCS.
36. J. Bootle, A. Chiesa, K. Sotiraki, "Lattice-Based Succinct Arguments for NP with Polylogarithmic-Time Verification," CRYPTO 2023; ePrint 2023/930 — eprint.iacr.org/2023/930. Sumcheck inside lattice arguments; Bulletproofs-style evaluation with verifier delegation.
37. M. Klooß, R. W. F. Lai, N. K. Nguyen, M. Osadnik, "RoK, Paper, SISsors: Toolkit for Lattice-Based Succinct Arguments," ASIACRYPT 2024; ePrint 2024/1972 — eprint.iacr.org/2024/1972.
38. S. Kuriyama, R. W. F. Lai, M. Osadnik, L. Tucci, "SALSAA: Sumcheck-Aided Lattice-Based Succinct Arguments and Applications," ePrint 2025/2124 — eprint.iacr.org/2025/2124. Linear-time prover in the vanishing-SIS line; 1123 KB at 2³⁰ as tabulated by Maltese.
39. M. Osadnik, G. Seiler, "LaBinius: Fast Lattice-Based Binary Polynomial Commitment Scheme," ePrint 2026/2103 — eprint.iacr.org/2026/2103. Commitment over a composite NTT-friendly modulus, evaluation in a binary extension field; proofs below 100 KiB with LaBRADOR as compressor; Keccak-256, SHA-256 and BLAKE3 proving through the Binius and Flock front ends. Code: github.com/osdnk/labinius.
40. M. Bolboceanu, J. Bootle, V. Lyubashevsky, A. Merino-Gallardo, G. Seiler, "Orthus: Practical Sublinear Batch-Verification of Lattice Relations from Standard Assumptions," CRYPTO 2026; ePrint 2026/398 — eprint.iacr.org/2026/398.