Sonobe

A folding/accumulation schemes library implemented jointly by 0xPARC and PSE.

"The Sonobe module is one of the many units used to build modular origami. The popularity of Sonobe modular origami models derives from the simplicity of folding the modules, the sturdy and easy assembly, and the flexibility of the system."

About

TL;DR:

• What: Sonobe implements folding/accumulation schemes and higher level primitives such as folding-based IVC, allowing users to prove repetitive computations efficiently.
• Why: There are many folding libraries, but Sonobe's goal is to be modular, secure, performant, and easy to use. Choose Sonobe if you think they matter to your use case.

What is Sonobe?

Sonobe focuses on a special type of (zero-knowledge) proof systems that are tailored for repetitive computations, e.g., a for loop.

Let's first consider a naive way to prove such repetitive computations, where we express all of them as a monolithic circuit. This approach has an obvious drawback: the number of iterations determines the circuit size and consequently the consumption of RAM, which is hard to scale (and expensive :D).

Incremental Verifiable Computation (IVC) is proposed to efficiently handle this task. Instead of proving in a single step with a circuit that encodes all iterations, IVC proves in many steps with a step circuit that only encodes a single iteration. In each step, we update a running proof using the evidence that the current invocation of the step circuit is honestly done. Now, the prover's RAM usage no longer depends on the number of iterations.

One extension of IVC is Proof-Carrying Data (PCD). The former only supports a linear execution model, while the latter also allows repetitive computations that form a tree/graph.

Nevertheless, the RAM reduction of IVC and PCD is not free, because the update of a proof requires additional work. For example, a classic realization of IVC is via bruteforce SNARK recursion, where the update requires proving that the previous SNARK proof is correct. This means we need to (1) prove with a SNARK the circuit execution, where the circuit (2) additionally encodes the SNARK verification algorithm for the previous step, both of which are expensive and thus suboptimal.

Folding/accumulation schemes aim to minimize the cost of proof updates. They can "fold" multiple instances of a computation into a single instance, and the validity of the folded instance implies the validity of all input instances. With folding schemes, we (1') fold the circuit execution into the running one, where the circuit instead (2') encodes the folding verification algorithm for the previous step. Now, the overheads are much smaller, as folding's proof generation and verification algorithms are very cheap compared to a fully fledged SNARK.

What Sonobe provides are exactly these folding/accumulation schemes, as well as higher level primitives built on top of folding.

Why Sonobe?

Our philosophy is to make the library modular, secure, performant, and easy to use. Since 2025, efforts have been made to improve these properties.

• Modularity: As our main priority, Sonobe features universal traits of folding schemes, commitment schemes, deciders (a.k.a. proof compression SNARKs), and frontends/DSLs. This modularity allows us to (1) provide multiple instantiations of these schemes, and (2) build compilers that can convert folding schemes into higher level primitives (e.g., IVC and PCD).
• Security: We believe folding will be a crucial component of many applications, and we want to make Sonobe a secure foundation of them. The code shipped in this branch has gone through three rounds of review, one by human auditors and two by AI auditors, and their findings have been addressed. We intend to keep this bar as the library grows.
• Performance: Everyone likes fast and cheap code. The rewrite behind Sonobe brings many optimizations in both running time and memory usage, and we will continue improving Sonobe's performance in the future by porting techniques such as GPU acceleration and lookup arguments.
• User experience: We aim for simple and intuitive APIs. Our traits follow the definitions of the cryptographic schemes themselves, so there is no second, code-specific vocabulary to learn on top of the papers. Together with modularity, this lets you pick the schemes that best fit your needs and switch between them with ease.

Support Matrix

Folding Schemes	Folding-to-IVC Compilers	Deciders	Commitment Schemes	Frontends
Nova1 (stable)	CycleFold2 (stable)	LegoGroth163 (to be merged)	Pedersen4 (stable)	arkworks (stable)
HyperNova5 (to be merged)	Field-only (planned)		KZG6 (to be revamped)	Circom (to be revamped)
ProtoGalaxy7 (to be merged)			Ajtai8 (WIP)	Noir (WIP)
Ova9 (to be merged)				Noname (to be revamped)
Mova10 (to be merged)
SuperNeo11 (WIP)

Quickstart

Warning: Pre-release code, use with caution.

0.1.0-alpha.1 is an early preview. The public API will change without notice between alpha releases. Docs are still to be polished, and examples cover only the core flows.

Declare the library as a dependency in your Cargo.toml:

[dependencies]
sonobe = "0.1.0-alpha.1"

Then you can start building your application with folding schemes or IVC.

Usually you only need to use IVC without caring about the low level details of folding schemes. In this case, you can refer to crates/ivc/examples/hash_chain.rs for an end-to-end example, which proves a chain of Poseidon hashes with IVC.

If you really need raw access to folding schemes, you can have a look at crates/fs/examples/aggregate_solutions.rs, which folds independent claims about solutions to an equation into a single accumulator. However, be careful if you are going to construct your own high level cryptographic protocol via folding. We can only ensure the scheme itself works securely, while nothing prevents you from using a secure building block in an insecure way.

sonobe re-exports the packages below, which can also be depended on individually:

• sonobe-primitives: algebra, arithmetizations, commitment schemes and transcripts, together with their in-circuit gadgets.
• sonobe-fs: folding scheme traits implementations.
• sonobe-ivc: IVC traits and folding-to-IVC compilers.

Available features:

• parallel enables some parallelization optimizations available in the crates. It is not enabled by default.

Supported targets (other targets may work but are not tested):

• x86_64-unknown-linux-gnu
• wasm32-unknown-unknown
• wasm32-wasip2

MSRV: Rust 1.85.1 or newer (edition 2024).

Documentation

API documentation is published on docs.rs:

• sonobe
• sonobe-primitives
• sonobe-fs
• sonobe-ivc

A handbook covering the design of the library and how to use it is a work in progress.

License

Sonobe is MIT Licensed.

Acknowledgments

This project builds on top of multiple arkworks libraries.

In addition to the direct code contributors who make this repository possible, this project has been improved and refined by many conversations with Srinath Setty, Lev Soukhanov, Matej Penciak, Adrian Hamelink, François Garillot, Daniel Marin, Han Jian, Wyatt Benno, Niсolas Gailly and Nalin Bhardwaj, to whom we are grateful.

Citations

Footnotes

1. "Nova: Recursive Zero-Knowledge Arguments from Folding Schemes", Abhiram Kothapalli, Srinath Setty, Ioanna Tzialla, CRYPTO, 2022. ↩

2. "CycleFold: Folding-scheme-based recursive arguments over a cycle of elliptic curves", Abhiram Kothapalli, Srinath Setty, IACR ePrint, 2023. ↩

3. "LegoSNARK: Modular Design and Composition of Succinct Zero-Knowledge Proofs", Matteo Campanelli, Dario Fiore, Anaïs Querol, ACM CCS, 2019. ↩

4. "Non-Interactive and Information-Theoretic Secure Verifiable Secret Sharing", Torben Pryds Pedersen, CRYPTO, 1991. ↩

5. "HyperNova: Recursive arguments for customizable constraint systems", Abhiram Kothapalli, Srinath Setty, CRYPTO, 2024. ↩

6. "Constant-Size Commitments to Polynomials and Their Applications", Aniket Kate, Gregory M. Zaverucha, Ian Goldberg, ASIACRYPT, 2010. ↩

7. "ProtoGalaxy: Efficient ProtoStar-style folding of multiple instances", Liam Eagen, Ariel Gabizon, IACR ePrint, 2023. ↩

8. "Generating hard instances of lattice problems", Miklós Ajtai, STOC, 1996. ↩

9. "Ova: A slightly better Nova", Benedikt Bünz, HackMD note, 2024. ↩

10. "Mova: Nova folding without committing to error terms", Nikolaos Dimitriou, Albert Garreta, Ignacio Manzur, Ilia Vlasov, IACR ePrint, 2024. ↩

11. "Neo and SuperNeo: Post-quantum folding with pay-per-bit costs over small fields", Wilson Nguyen, Srinath Setty, CRYPTO, 2026. ↩