# Recursive proof aggregation

**URL:** <https://forum.anoma.net/t/recursive-proof-aggregation/1643>\
**Category:** Proof aggregation\
**Created:** [June 20, 2025, 3:12pm UTC](https://forum.anoma.net/t/recursive-proof-aggregation/1643 "2025-06-20T15:12:27Z")\
**Posts on this page:** 1\
**Showing post:** 7

<div class="post-metadata">

**Author:** ![kike](https://dub1.discourse-cdn.com/flex013/user_avatar/forum.anoma.net/kike/32/745_2.png) [@kike](https://forum.anoma.net/u/kike)\
**Post date:** [June 27, 2025, 1:10pm UTC](https://forum.anoma.net/t/recursive-proof-aggregation/1643/7 "2025-06-27T13:10:17Z")

</div>

Here there is a bit more of detail. Hope it helps.

### Aggregating proofs inside actions

Let n\_c be the number of compliance units in the action. Let n\_r be the total number of resources (consumed and created) in the action.

There are n\_c compliance proofs, and n\_r logic proofs in the action.

**Aggregate compliance and logic proofs:**

- Inputs:

- Output:

**Steps** :

1. Set the initial aggregated instance to two zero-bytes arrays h\_0,d\_0, and the initial aggregated proof to a dummy value \pi\_{a,0}.

2. Let avk the verifying key of the universal aggregator program/circuit \mathsf{P}\_{ua}. (See first post.)

3. For j \in 1,\ldots n\_c: // First aggregate the compliance proofs

4. Reset h\_0 = h\_{n\_{c}}, d\_0 = d\_{n\_{c}}, \pi\_{a,0}= \pi\_{a,n\_c}

5. For j \in 1,\ldots, n\_r: // Now aggregate the logic proofs

6. Output \pi\_{a,{n\_c+n\_r}}

**Verify aggregation of compliance and logic proofs:**

- Inputs:
  - cvk: The verifying key of the compliance circuit.
  - (cst\_{j})\_{j\in \leq n\_c}: The n\_c instances of the compliance circuit.
  - (lvk\_j,lst\_{j})\_{j\leq n\_r}: The n\_r verifying keys and instances of the resource logic circuits.
  - \pi\_a: The aggregated proof for the action.

- Output: b\in\{true,false\}

**Steps**

1. Derive the action instance from compliance and logic instances of the action:

2. Output verify(avk,ast,\pi\_a)

### Aggregate proofs in transactions (aggregate all compliance and logic proofs)

The same way as aggregating/verifying them within actions (see above). One first collects compliance and logic instances and proofs from all the actions in the transaction.

### Aggregate proofs in transactions (aggregate action proofs)

This assumes actions come with their compliance and logic proofs already aggregated. Let n\_a be the number of actions in transaction T. There are n\_a action proofs generated as explained above.

**Aggregate actions proofs:**

- Inputs:

- Output:

**Steps** :

1. Set the initial aggregated instance to two zero-bytes arrays h\_0,d\_0, and the initial aggregated proof to a dummy value \pi\_{t,0}.

2. Let avk the verifying key of the universal aggregator program/circuit \mathsf{P}\_{ua}. (See first post.)

3. For j \in 1,\ldots n\_a:

4. Output \pi\_{t,{n\_a}}

**Verify aggregation of action proofs**

- Inputs:
  - avk: The verifying key of the compliance circuit.
  - (ast\_{j})\_{j\in \leq n\_a}: The n\_a action instances of the transaction.
  - \pi\_t: The aggregated proof for the action.

- Output: b\in\{true,false\}

**Steps**

1. Derive the transaction instance:

2. Output verify(avk,tst,\pi\_t)

### Parallelizing provers

The universal aggregator program \mathsf{P}\_{ua} can be modified so it accepts as input 2 aggregated instances and proofs (instead of one).  
To aggregate a total of N = \sum\_{l=0}^d n/{2^l} proofs, the N incremental proofs produced by the prover can be arranged into d layers. In the l-th layer, n/{2^l} proofs are generated in parallel and fed as input to the next layer.

**Instance generation.** The chained hashes h\_j,d\_j are computed accordingly: use the two input pair of hashes at each incremental step.

### Mixing aggregation strategies

Sequential and parallel provers via binary tree transcripts are two examples of aggregation strategies. Most likely the ones we will want to use the most (sequential for few aggregations, parallel for many aggregations).

Each transaction (or each action within a transaction) can aggregate with their own strategy. Aggregating two proofs resulting from different strategies is possible.

---

_[View the full topic](https://forum.anoma.net/t/recursive-proof-aggregation/1643)._