Folding Schemes with Selective Verification

In settings such as delegation of computation where a prover is doing computation as a service for many verifiers, it is important to amortize the prover's costs without increasing those of the verifier. We introduce folding schemes with selective verification. Such a scheme allows a prover to aggregate m NP statements x(i) is an element of L in a single statement x is an element of L. Knowledge of a witness for x implies knowledge of witnesses for all m statements. Furthermore, each statement can be individually verified by asserting the validity of the aggregated statement and an individual proof pi with size sublinear in the number of aggregated statements. In particular, verification of statement xi does not require reading (or even knowing) all the statements aggregated. We demonstrate natural folding schemes for various languages: inner product relations, vector and polynomial commitment openings and relaxed R1CS of NOVA. All these constructions incur a minimal overhead for the prover, comparable to simply reading the statements.