ZK/SEC Research notes from zkSecurity
All posts
Sum-Check as an Algebraic Tensor Reduction · Part 3 of 3

Sum-Check as an Algebraic Tensor Reduction: Part III

Algebraic tensor reductions

This article is the third in a series. The previous two chapters are required reading for this post and can be found here (Part I) and here (Part II).

In Part II, we introduced rings and modules as the first pieces of mathematical vocabulary needed to view sum-check through the lens of algebraic tensor reductions. In this post, we continue building that toolkit by studying maps between modules: linear maps, isomorphisms, and bilinear maps. As promised, the goal is not to make you memorize every definition, but to build a useful reference for the later parts of the series. Let’s dive right in, shall we?

Linear Maps

Definition

Consider a ring $R$ and two $R$-modules $M$ and $N$. A linear map (or $R$-linear map, or module homomorphism) from $M$ to $N$ is a function $f:M\to N$ that satisfies the following conditions for all $m,m^\prime\in M$ and all $r\in R$:

  1. $f(m+m^\prime)=f(m)+f(m^\prime)$.

  2. $f(r\cdot m)=r\cdot f(m)$.

If $f:M\to N$ is a linear map between $R$-modules $M$ and $N$, we also write $f\in \text{hom}_R(M,N)$ or simply $f\in \text{hom}(M,N)$.

Note

One can show that the set $\text{hom}(M,N)$ of $R$-linear maps from $M$ to $N$ itself forms a module over $R$. Proving this is actually quite simple, but beyond the scope of this blog post series.

Examples

  1. The identity map $\text{id}_M:M\to M,\hspace{5pt}m\mapsto m$ is an $R$-linear map for every $R$-module $M$.

  2. The zero map $0:M\to N, \hspace{5pt}m\mapsto 0$ is an $R$-linear map for any two $R$-modules $M$ and $N$.

  3. Consider the $R$-module $R^n$. For any fixed scalars $a_1,...,a_n\in R$, the map $$ f:R^n\to R, \hspace{5pt} (x_1,...,x_n)\mapsto a_1x_1+\cdots+a_nx_n $$ is an $R$-linear map. Notice that this linear map can also be viewed as matrix-multiplying a $(1\times n)$-matrix $A=(a_1,...,a_n)$ with a given vector $(x_1,...,x_n)^\top$ (viewed as an $(n\times 1)$-matrix).

  4. More generally, any $(m\times n)$-matrix $A\in \mathcal{M}_{m\times n}(R)$ defines an $R$-linear map $f_A:R^n\to R^{m}, \hspace{5pt}x\mapsto Ax$. Conversely, every $R$-linear map $f\in \text{hom}(R^n,R^m)$ can be represented via an $(m\times n)$-matrix.

  5. The differentiation map $D:R[x]\to R[x], \hspace{5pt} f(x)\mapsto f^\prime(x)$ for univariate polynomials is an $R$-linear map. Indeed, differentiation is additive and satisfies $(r\cdot f)^\prime=r\cdot f^\prime$ for all $r\in R$ and all $f\in R[x]$.

  6. A univariate polynomial $p(x)=ax\in R[x]$ of degree $1$ and without constant term defines a linear map $p:R\to R,\hspace{5pt}x\mapsto ax$, where $a\in R$ is $p$’s only coefficient.

  7. On the contrary, the univariate degree-$1$ polynomial $p(x)=x+1$, which we can also write as $p:R\to R,\hspace{5pt}x\mapsto x+1$, does not define a linear map. In particular, “linear” polynomials (in the sense that they are degree-$1$) do generally not define linear maps. To see this in the example $p(x)=x+1$, consider the second condition of our definition above. Fix $m=0$ and let $r\in R$ be an arbitrary element of $R$ with the only restriction that $r\neq 1$. Then, we have $p(r\cdot m)\neq r\cdot p(m)$ because $$ p(r\cdot m)=p(r\cdot 0)=p(0)=1\neq r =r\cdot (0+1)=r\cdot p(0)=r\cdot p(m), $$ violating the second condition of our definition of linear maps.

Intuition

A linear map is a function that preserves the module structure in the sense that it respects the two basic operations that make a module a module: addition of elements and multiplication by scalars.

Notice that our definition here is almost equivalent to the definition of linear maps between vector spaces. The only difference is that we now allow scalars to come from a ring rather than a field.

Of all the above examples, keep Example 3 in mind, as it is the linear map that will be most relevant throughout the rest of this blog post series.

Isomorphisms

Definition

Consider a ring $R$ and two $R$-modules $M$ and $N$. An isomorphism from $M$ to $N$ is a linear map $f:M\to N$ for which there exists another linear map $g:N\to M$ such that the two equations

  1. $g\circ f=\text{id}_M$
  2. $f\circ g=\text{id}_N$

hold, where $\text{id}_X$ denotes the identity map on a given $R$-module $X$. In other words, applying $f$ and then $g$ gives us back the original element of $M$, and applying $g$ and then $f$ gives us back the original element of $N$.

If there exists an isomorphism $f:M\to N$, we say that $M$ and $N$ are isomorphic and write $M\cong N$.

The map $g:N\to M$ is called the inverse of $f$, usually denoted by $f^{-1}$.

Equivalently, an isomorphism is a linear map that is bijective, meaning that it is both injective and surjective.

Examples

  1. The identity map $\text{id}_M:M\to M,\hspace{5pt}m\mapsto m$ is an isomorphism for every $R$-module $M$. Its inverse is itself.

  2. Consider the $R$-module $R^2$. The map$f:R^2\to R^2,\hspace{5pt}(x,y)\mapsto(y,x)$ is an isomorphism. Indeed, it is linear, and applying it twice gives back the original input: $f(f(x,y))=f(y,x)=(x,y)$. In particular, we have $f^{-1}=f$.

  3. More generally, every invertible $(n\times n)$-matrix $A\in \mathcal{M}_{n\times n}(R)$ defines an isomorphism $f_A:R^n\to R^n, x\mapsto Ax$. Its inverse is the linear map defined by the inverse matrix $A^{-1}$.

  4. The map $f:R\to R,\hspace{5pt}x\mapsto ax$ is an isomorphism if and only if $a\in R$ is invertible. In that case, the inverse map is $f^{-1}:R\to R,\hspace{5pt}x\mapsto a^{-1}x$.

  5. The map $f:R\to R^2,\hspace{5pt}x\mapsto (x,0)$ is linear, but not an isomorphism. It is injective, but not surjective, since elements such as $(0,1)\in R^2$ are not in its image.

  6. The map $f:R^2\to R,\hspace{5pt}, (x,y)\mapsto x$ is linear, but not an isomorphism. It is surjective, but not injective, since for example both $(0,0)$ and $(0,1)$ are mapped to $0$.

  7. The map $f:R\to R, \hspace{5pt}x\mapsto x+1$ is not an isomorphism of $R$-modules. Even though it may be bijective in many familiar cases (depending on which ring $R$ we’re looking at), it is not linear, as we’ve seen in Example 7 of the previous section on linear maps.

Intuition

An isomorphism is a linear map that perfectly preserves the module structure without losing any information. In particular, it does not collapse distinct elements into the same element, and it does not miss any elements in the target module.

So, if two $R$-modules are isomorphic, they may look different at first, but they are structurally the same (when viewed as $R$-modules). Anything we can do in one of them can be translated into the other one and back again using linear maps.

Consider, for instance, the $R$-module $\mathcal{M}_{2\times 2}(R)$ of $(2\times 2)$-matrices and the $R$-module $R^4$ of length-$4$ vectors with entries in $R$: These spaces are clearly not equal as sets since their elements are written in completely different forms. In other words, we have $\mathcal{M}_{2\times 2}(R)\neq R^4$ when viewing $\mathcal{M}_{2\times 2}(R)$ and $R^4$ merely as sets without further structure. But, when viewing $\mathcal{M}_{2\times 2}(R)$ and $R^4$ from a module-theoretic perspective, they are isomorphic as $R$-modules via the map

$$ \begin{bmatrix}a&b\\ c&d\end{bmatrix}\mapsto (a,b,c,d), $$

whose inverse is trivially given by

$$ (a,b,c,d)\mapsto \begin{bmatrix}a&b\\ c&d\end{bmatrix}. $$

Therefore, we write $\mathcal{M}_{2\times 2}(R)\cong R^4$ and say that “they are the same” or that “they are equal” from the perspective of module theory (even though they are, strictly speaking, different sets).

Bilinear Maps

Definition

Consider a ring $R$ and three $R$-modules $L$, $M$, and $N$. A bilinear map is a function $b:L\times M\to N$ that is linear in each argument separately. More precisely, for all $\ell\in L$, $m\in M$, and $r\in R$, we require that:

  1. For fixed $m\in M$, the map $L\to N,\hspace{3pt}\ell\mapsto b(\ell,m)$ is $R$-linear.

  2. For fixed $\ell\in L$, the map $M\to N,\hspace{3pt}m\mapsto b(\ell,m)$ is $R$-linear.

Equivalently, a function $b:L\times M\to N$ is bilinear if, for all $\ell,\ell^\prime\in L$, all $m,m^\prime\in M$, and all $r\in R$, we have:

  1. $b(\ell+\ell^\prime,m)=b(\ell,m)+b(\ell^\prime,m)$.

  2. $b(\ell,m+m^\prime)=b(\ell,m)+b(\ell,m^\prime)$.

  3. $b(r\cdot \ell,m)=r\cdot b(\ell,m)$.

  4. $b(\ell,r\cdot m)=r\cdot b(\ell,m)$.

A map that is linear in three or more arguments is called a multilinear map.

Examples

  1. The multiplication map $\mu :R\times R\to R,\hspace{5pt}(a,b)\mapsto ab$ is a bilinear map, since multiplication in a ring is additive and compatible with scalar multiplication in each argument.

  2. More generally, if $R[x_1,...,x_n]$ denotes the polynomial ring over $R$, then the polynomial multiplication map $$ R[x_1,...,x_n]\times R[x_1,...,x_n]\to R[x_1,...,x_n],\hspace{10pt}(f,g)\mapsto fg $$ is bilinear.

  3. Consider the $R$-module $R^n$. The dot product $$ \langle\cdot ,\cdot \rangle:R^n\times R^n\to R,\hspace{10pt}((x_1,...,x_n)^\top,(y_1,...,y_n)^\top)\mapsto \sum_{i=1}^nx_iy_i $$ is a bilinear map, where $\top$ indicates that we transpose, which is just saying that we interpret elements of $R^n$ as vertical vectors, and not as horizontal ones.

  4. Matrix multiplication defines a bilinear map. More precisely, for positive integers $m$, $n$, and $k$, the map $$ \mathcal{M}_{m\times n}(R)\times \mathcal{M}_{n\times k}(R)\to \mathcal{M}_{m\times k}(R), \hspace{10pt}(A,B)\mapsto A\cdot B $$ is bilinear.

  5. If $L$ and $M$ are $R$-modules, then the zero map $b:L\times M\to N,\hspace{5pt}(\ell,m)\mapsto 0$ is bilinear for every $R$-module $N$.

  6. The map $b:R\times R\to R,\hspace{5pt}(a,b)\mapsto a+b$ is not bilinear. For instance, fixing $b=1$, the map $a\mapsto a+1$ is not linear, as we have already discussed in Example 7 of the section on linear maps.

  7. The map $b:R\times R\to R,\hspace{5pt}(a,b)\mapsto ab+1$ is not bilinear. As before, we can see this by fixing $b=1$ to obtain the map $a\mapsto a+1$, which we know is not linear.

Intuition

A bilinear map is simply a function of two variables that behaves linearly in each variable separately. Think of bilinear maps as the “two-input version” of linear maps. They give us a way to map in a module-structure-preserving manner (i.e., in a manner that respects the module’s addition and scalar multiplication) whenever elements of two modules are involved simultaneously.

This is precisely why bilinear maps are so important for tensor products: As we will see in the next post, tensor products are designed to encode bilinear maps as ordinary linear maps. In that sense, bilinear maps are the motivating object, and tensor products are the tool that lets us handle them using linear algebra.

Now that we know about rings, modules, linear maps, isomorphisms, and bilinear maps, we’re finally ready to introduce the tensor product, which will be the main topic of the next post.

Acknowledgements

Special thanks to Nicolas Mohnblatt, Jason Park, Varun Thakore, Khaled Suliman, and Youssef23 for taking the time to help me polish this post.

Keep reading
Recommended

Sum-Check as an Algebraic Tensor Reduction: Part I

This post introduces algebraic tensor reductions as a unifying framework for understanding recursive proof protocols, using sum-check as the main motivating example. It walks through one recursive step of sum-check, showing how the prover sends a univariate summary, the verifier checks sum consistency, and the original claim is reduced to a smaller claim with one fewer variable. A small bivariate example illustrates how this “peel off one variable, check, then fold with randomness” pattern works concretely. The post sets up the rest of the series, which will introduce the tensor language needed to recover classical sum-check as an algebraic tensor reduction.

Marco Besier · April 27, 2026

Sum-Check as an Algebraic Tensor Reduction: Part II

In this part of our series, we start introducing the algebraic language needed to formalize sum-check as a tensor reduction. We start with the basics of rings and modules. Rings generalize fields by dropping the requirement that every non-zero element has a multiplicative inverse. Modules then generalize vector spaces by allowing scalars to come from a ring instead of a field. In this post, we’ll use plenty of examples to make these ideas concrete and build intuition along the way.

Marco Besier · May 10, 2026

Learn Sumcheck, MLE, and HyperPlonk: An Interactive Tutorial with SageMath

A new interactive tutorial on Sumcheck, Multilinear Extensions, and HyperPlonk with complete SageMath implementations and exercises. Go beyond the theory and understand how these protocols actually work by implementing them yourself.

Marco Gaglianese · November 22, 2025
More to explore

Proofs On A Leash: Post-Quantum Lattice SNARK With Greyhound

In this engaging blog post, we dive into the future of cryptography by exploring how lattice-based proof systems could fend off the quantum threat. We break down Greyhound, a promising lattice-based solution, explaining its transparent nature, efficient construction, and adaptability with today's systems. Along the way, you'll get a glimpse of key concepts like lattices, Ajtai commitments, and how Greyhound cleverly ensures security and efficiency. Whether you’re curious about the cutting-edge of cryptographic research or just want to understand the basics of quantum-resistant solutions, this post offers both depth and clarity.

David Wong · June 03, 2025

Optimizing Barrett Reduction: Tighter Bounds Eliminate Redundant Subtractions

In this blog post, we explore an optimization for Barrett reduction, a popular method for modular arithmetic. We discovered that the error bound can be tighter than traditionally thought, meaning you often only need a single subtraction instead of two. This tweak can speed up cryptographic operations like those in the RustCrypto library by 14% when applied to NIST curves, which is a game changer for both encryption and performance. Dive into the details to see how this simple change can lead to significant improvements in real-world applications!

Suneal Gong · May 01, 2025

Notes and Proofs for Divisor Techniques

Notes and proofs for the divisor-based ECIP protocol of Eagen, written with Diego F. Aranha and supported by MAGIC Grants. The document is self-contained: it works through the necessary algebraic geometry, the interactive proof and its soundness, the composition with a simulation-extractable NIZK, and the R1CS verifier circuit used by Parker's gadget in Monero's FCMP++.

Mathias Hall-Andersen · May 08, 2026