Folding Meet Lattices
Binyi Chen on LatticeFold, Symphony, and building post-quantum snarks
In this week’s episode, Nico and I spoke with Binyi Chen, postdoctoral researcher at Stanford University, about his work on LatticeFold, LatticeFold+, and his newest project, Symphony.
It was fun to revisit the crossover between lattices and zk, and get an update on what has happened since he published LatticeFold and LatticeFold+. I also had a chance to ask some of the questions that came up for me while watching his recent ZK Whiteboard Sessions module on LatticeFold (which I highly recommend if you want a visual deep dive into this topic).
We also spent a good amount of time mapping the history of folding in snarks, from its emergence in initial proposals like Nova in 2022 to the way folding techniques are used today. Binyi had mentioned the last time he was on the show that a big open problem in folding was how to combine folding with lattices, and it was pretty cool to see that this problem has clearly now been tackled!
Key takeaways from Episode 385
The first generation of folding schemes (Nova, Halo, ProtoStar) relied on Pedersen commitments, which are not post-quantum secure.
Lattices emerged as a promising replacement, providing post-quantum security via assumptions like SIS (Shortest Integer Solution) — problems believed to remain hard even for quantum machines.
The shift from elliptic-curve to lattice-based commitments required solving new challenges, such as controlling norm-blow-up and proving low-norm openings — which led to the LatticeFold and LatticeFold+ designs.
LatticeFold aims to make folding post-quantum while keeping verifier costs low — a balance that many hash- or curve-based folding schemes struggle with.
Binyi’s latest work, Symphony, builds on this by removing the need for Fiat–Shamir circuits within the verifier — improving efficiency and eliminating a potential attack surface exposed in recent research.
Symphony proposes high-arity folding, allowing thousands of statements to be folded together in one or two steps, making recursive snarks faster and more secure.
The paper also introduces a new lattice-based range proof, combining ideas from projection and monomial encoding to simplify the prover’s work dramatically.
While elliptic-curve-based schemes are still faster today, lattice-based folding is closing the gap.
Binyi’s open question for the future: Can we build a succinct, lattice-based snark with solid foundations that doesn’t rely on random-oracle assumptions?
It was fun to check back in on the folding work and get a peek into the state-of-the-art combination of folding and lattices.
Be sure to check out Episode 385: the full episode page is here, or follow this thread for commentary.
Talk soon,
Anna
ECOSYSTEM ANNOUNCEMENT
We want to hear from you!
We’re trying to learn more about what topics you’d like us to cover, where our blind spots might be, and a bit about who our listeners are. We’ve put together a short form you can fill out anonymously. We’d love to hear from you and how you think we can make the Zero Knowledge Podcast better!