Enabling AI ASICs for Zero Knowledge Proof

The Thesis

Zero-knowledge proofs (ZKPs) — cryptographic techniques that let one party prove a fact to another without revealing the underlying data — are increasingly used in blockchain scaling and privacy applications, but generating them is expensive. The two most compute-intensive operations inside a ZKP prover are multi-scalar multiplication (MSM) and number-theoretic transforms (NTTs), both of which demand high-precision modular arithmetic that GPUs handle awkwardly. MORPH reformulates these operations so they can run on AI accelerators like Google's TPUs, which are optimized for dense, low-precision matrix math. The core trick is converting modular arithmetic into a form that fits naturally into the matrix multiply units (MXUs) at the heart of a TPU. On one key operation (NTT), TPUv6e8 running MORPH achieves up to 10x higher throughput than GZKP, a dedicated GPU-based ZKP framework, though MSM performance is only comparable rather than superior.

Catalyst

Google's TPUv6e (codenamed Trillium) is the first TPU generation with both the raw matrix throughput and the memory bandwidth profile that makes this reformulation practical. JAX, Google's numerical computing framework, now has mature primitives for the kind of sharding and layout control MORPH relies on. Prior attempts to run ZKP on non-GPU hardware stalled because no clean mapping existed between modular arithmetic and tensor operations — this paper proposes one.

What's New

Prior ZKP acceleration work, including GZKP and various FPGA-based designs, treated GPU or FPGA as the natural target and optimized within those paradigms. Those approaches kept modular arithmetic in its native high-precision, carry-chain form, which is fine for GPUs but does not fit the low-precision matrix units that dominate modern AI chips. MORPH introduces an extended-RNS (Residue Number System) lazy reduction scheme — a way of representing large integers as sets of smaller remainders — that converts the arithmetic into standard low-precision matrix multiplications, plus a layout-stationary dataflow that avoids the expensive memory shuffles that would otherwise negate TPU throughput gains.

The Counter

The 10x NTT speedup is real but narrow. NTT is the smaller of the two main ZKP bottlenecks; MSM typically dominates total proving time, and on MSM MORPH is only 'comparable' to the GPU baseline — which is not a win for a purpose-built framework. The comparison baseline, GZKP, is also not the strongest available: dedicated GPU libraries from teams actively optimizing for ZKP (such as Icicle from Ingonyama) are not benchmarked. TPUs are also not neutral infrastructure — they are Google hardware, not available as spot compute, and their accessibility to the ZKP ecosystem, which runs heavily on permissionless commodity cloud, is genuinely limited. Finally, the ZKP field is moving fast toward proof systems that reduce or eliminate MSM entirely; a framework that optimizes for today's dominant kernels may be targeting a shrinking problem.

The Paper