zkCraft: Prompt-Guided LLM as a Zero-Shot Mutation Pattern Oracle for TCCT-Powered ZK Fuzzing

2026-01-31

AI Summary

This work addresses the challenge of semantic inconsistency errors in zero-knowledge (ZK) circuits, which arise from the tight coupling between witness computation and constraint definitions. To enable efficient debugging, the authors propose a novel method that combines R1CS-aware localization with Row-Vortex polynomial encoding to identify and edit candidate constraints. Instead of repeatedly invoking expensive constraint solvers, the approach leverages a Violation Interactive Oracle Proof (IOP) to verify constraint violations. Notably, it introduces a prompt-guided large language model (LLM) as a zero-shot oracle for mutation patterns, generating algebraically verifiable fault templates. Evaluated on real-world Circom circuits, the method effectively detects both under-constrained and over-constrained errors, significantly reducing solver invocation overhead and false positive rates, thereby enhancing the scalability and reliability of ZK circuit debugging.

Technology Category

• Constraint Satisfaction and Optimization: Satisfiability Modulo Theories
• Reasoning under Uncertainty: Stochastic Optimization
• Knowledge Representation and Reasoning: Diagnosis and Abductive Reasoning

Application Category

• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs
• Security and Privacy: Data transparency and provenance
• Search and Retrieval-Augmented AI: Web learning to rank, online learning, and counterfactual learning for ranking

Abstract

Zero-knowledge circuits enable privacy-preserving and scalable systems but are difficult to implement correctly due to the tight coupling between witness computation and circuit constraints. We present zkCraft, a practical framework that combines deterministic, R1CS-aware localization with proof-bearing search to detect semantic inconsistencies. zkCraft encodes candidate constraint edits into a single Row-Vortex polynomial and replaces repeated solver queries with a Violation IOP that certifies the existence of edits together with a succinct proof. Deterministic LLM-driven mutation templates bias exploration toward edge cases while preserving auditable algebraic verification. Evaluation on real Circom code shows that proof-bearing localization detects diverse under- and over-constrained faults with low false positives and reduces costly solver interaction. Our approach bridges formal verification and automated debugging, offering a scalable path for robust ZK circuit development.

Problem

• zero-knowledge circuits
• semantic inconsistencies
• constraint faults
• witness computation
• circuit constraints

Innovation

• zero-knowledge circuits
• proof-bearing search
• Row-Vortex polynomial
• LLM-guided mutation
• Violation IOP