bench(whir): FRI vs WHIR Pareto frontier (prover cost vs argument size)

[camofu]

Summary

Extends PR Plonky3#1607 (Plonky3/Plonky3)'s single-point FRI-vs-WHIR benchmark into a parameter sweep that traces each scheme's full prover-cost-vs-argument-size trade-off, on an identical proof claim (the §1.1 univariate↔multilinear bridge: 2^m elements as 256 polynomials of size 2^(m−8), opened at one common point; 100-bit capacity-regime soundness; KoalaBear + Poseidon1).

Plot hosted on the pareto-frontier-assets branch (not part of this PR's changeset). Regenerate locally by running the example below.

What's swept

• WHIR — randomized grid search over its full knob space: arbitrary per-round folding strategies (FoldingFactor::PerRound, entries 1..=10, ≤4 intermediate rounds), the starting inverse-rate, and per-round inverse-rate schedules (any legal sequence — the only rule is next_rate ≤ prev_rate + folding_i, otherwise the RS domain would grow), plus constant-folding baselines. Configurable via PARETO_WHIR_SAMPLES, PARETO_WHIR_MAX_FOLDING, PARETO_WHIR_MAX_ROUNDS, PARETO_WHIR_FIRST_FOLDING, PARETO_WHIR_STARTS. (Earlier revisions only swept constant folding with affine rate schedules; the randomized search reaches the non-constant foldings where WHIR's best region often lives.)
• FRI — log_blowup (rate) × max_log_arity; num_queries derived as the minimum reaching 100 bits.

Axes & metrics (both panels share the y-axis = postcard argument size)

• Left, "theoretical proxy": total committed oracle length, in base-field elements — an analytic, noise-free proxy for prover work (LDE FFTs + Merkle hashing). Extension-field oracles (WHIR's per-round codewords, FRI's commit-phase codewords) are counted ×4, since they live in EF.
• Right, "measured (all cores)": real prover wall-clock (commit + open), min of 3 runs.
• Argument size counts the opened values on both sides (WHIR's PcsProof bundles them; FRI returns them separately), so the comparison is apples-to-apples.
• Each panel shows the full sample cloud plus one solid Pareto frontier per protocol (lower-left is better). ◯ marks the PR-bench(whir): head-to-head FRI vs WHIR PCS comparison across Poseidon1 / Poseidon2 / Blake3 Plonky3/Plonky3#1607 default.

Findings

• Theoretical proxy: WHIR's frontier sits below FRI's across the range — for a given prover-cost budget it yields a smaller proof, and it reaches sizes FRI's two knobs can't.
• Measured wall-clock: FRI owns the cheap-prover corner (its commit is embarrassingly parallel and it runs no sumcheck), while WHIR reaches the smallest proofs but at higher wall-clock (its per-round sumchecks are sequential). The gap between the two panels is exactly that sumcheck + parallelism cost.
• High WHIR folding inflates argument size via wide query leaves (Σ queries · 2^folding) — the upper cloud — which is why the best region uses moderate folding.

Workload note

The "256 openings at one common point" models a width-256 trace opened at the verifier's challenge — batch-FRI's native mode, and a valid (batched) WHIR mode. The 256 openings collapse into a single combined constraint, so neither prover pays a 256× cost. This is one realistic use case, not the only one; a single-/few-opening workload would showcase WHIR's other sweet spot (one large multilinear, one point).

How to run

cargo run -p p3-whir --release --features parallel --example pareto_frontier
# Tune via PARETO_WHIR_SAMPLES / _MAX_FOLDING / _MAX_ROUNDS / _FIRST_FOLDING / _STARTS, and PARETO_M.

Notes

• Analysis branch; helpers are lifted from benches/fri_vs_whir.rs, no production code touched (one example + a dev [[example]] entry).
• The randomized grid search, the base-field oracle-length normalization, and the apples-to-apples argument-size counting were contributed by @WizardOfMenlo (merged via WHIR randomized grid search #2).