ZK/SEC Research notes from zkSecurity
All posts
Sum-Check as an Algebraic Tensor Reduction · Part 3 of 3

Sum-Check as an Algebraic Tensor Reduction: Part III

Algebraic tensor reductions

This article is the third in a series. The previous two chapters are required reading for this post and can be found here (Part I) and here (Part II).

In Part II, we introduced rings and modules as the first pieces of mathematical vocabulary needed to view sum-check through the lens of algebraic tensor reductions. In this post, we continue building that toolkit by studying maps between modules: linear maps, isomorphisms, and bilinear maps. As promised, the goal is not to make you memorize every definition, but to build a useful reference for the later parts of the series. Let’s dive right in, shall we?

Linear Maps

Definition

Consider a ring $R$ and two $R$-modules $M$ and $N$. A linear map (or $R$-linear map, or module homomorphism) from $M$ to $N$ is a function $f:M\to N$ that satisfies the following conditions for all $m,m^\prime\in M$ and all $r\in R$:

  1. $f(m+m^\prime)=f(m)+f(m^\prime)$.

  2. $f(r\cdot m)=r\cdot f(m)$.

If $f:M\to N$ is a linear map between $R$-modules $M$ and $N$, we also write $f\in \text{hom}_R(M,N)$ or simply $f\in \text{hom}(M,N)$.

Note

One can show that the set $\text{hom}(M,N)$ of $R$-linear maps from $M$ to $N$ itself forms a module over $R$. Proving this is actually quite simple, but beyond the scope of this blog post series.

Examples

  1. The identity map $\text{id}_M:M\to M,\hspace{5pt}m\mapsto m$ is an $R$-linear map for every $R$-module $M$.

  2. The zero map $0:M\to N, \hspace{5pt}m\mapsto 0$ is an $R$-linear map for any two $R$-modules $M$ and $N$.

  3. Consider the $R$-module $R^n$. For any fixed scalars $a_1,...,a_n\in R$, the map $$ f:R^n\to R, \hspace{5pt} (x_1,...,x_n)\mapsto a_1x_1+\cdots+a_nx_n $$ is an $R$-linear map. Notice that this linear map can also be viewed as matrix-multiplying a $(1\times n)$-matrix $A=(a_1,...,a_n)$ with a given vector $(x_1,...,x_n)^\top$ (viewed as an $(n\times 1)$-matrix).

  4. More generally, any $(m\times n)$-matrix $A\in \mathcal{M}_{m\times n}(R)$ defines an $R$-linear map $f_A:R^n\to R^{m}, \hspace{5pt}x\mapsto Ax$. Conversely, every $R$-linear map $f\in \text{hom}(R^n,R^m)$ can be represented via an $(m\times n)$-matrix.

  5. The differentiation map $D:R[x]\to R[x], \hspace{5pt} f(x)\mapsto f^\prime(x)$ for univariate polynomials is an $R$-linear map. Indeed, differentiation is additive and satisfies $(r\cdot f)^\prime=r\cdot f^\prime$ for all $r\in R$ and all $f\in R[x]$.

  6. A univariate polynomial $p(x)=ax\in R[x]$ of degree $1$ and without constant term defines a linear map $p:R\to R,\hspace{5pt}x\mapsto ax$, where $a\in R$ is $p$’s only coefficient.

  7. On the contrary, the univariate degree-$1$ polynomial $p(x)=x+1$, which we can also write as $p:R\to R,\hspace{5pt}x\mapsto x+1$, does not define a linear map. In particular, “linear” polynomials (in the sense that they are degree-$1$) do generally not define linear maps. To see this in the example $p(x)=x+1$, consider the second condition of our definition above. Fix $m=0$ and let $r\in R$ be an arbitrary element of $R$ with the only restriction that $r\neq 1$. Then, we have $p(r\cdot m)\neq r\cdot p(m)$ because $$ p(r\cdot m)=p(r\cdot 0)=p(0)=1\neq r =r\cdot (0+1)=r\cdot p(0)=r\cdot p(m), $$ violating the second condition of our definition of linear maps.

Intuition

A linear map is a function that preserves the module structure in the sense that it respects the two basic operations that make a module a module: addition of elements and multiplication by scalars.

Notice that our definition here is almost equivalent to the definition of linear maps between vector spaces. The only difference is that we now allow scalars to come from a ring rather than a field.

Of all the above examples, keep Example 3 in mind, as it is the linear map that will be most relevant throughout the rest of this blog post series.

Isomorphisms

Definition

Consider a ring $R$ and two $R$-modules $M$ and $N$. An isomorphism from $M$ to $N$ is a linear map $f:M\to N$ for which there exists another linear map $g:N\to M$ such that the two equations

  1. $g\circ f=\text{id}_M$
  2. $f\circ g=\text{id}_N$

hold, where $\text{id}_X$ denotes the identity map on a given $R$-module $X$. In other words, applying $f$ and then $g$ gives us back the original element of $M$, and applying $g$ and then $f$ gives us back the original element of $N$.

If there exists an isomorphism $f:M\to N$, we say that $M$ and $N$ are isomorphic and write $M\cong N$.

The map $g:N\to M$ is called the inverse of $f$, usually denoted by $f^{-1}$.

Equivalently, an isomorphism is a linear map that is bijective, meaning that it is both injective and surjective.

Examples

  1. The identity map $\text{id}_M:M\to M,\hspace{5pt}m\mapsto m$ is an isomorphism for every $R$-module $M$. Its inverse is itself.

  2. Consider the $R$-module $R^2$. The map$f:R^2\to R^2,\hspace{5pt}(x,y)\mapsto(y,x)$ is an isomorphism. Indeed, it is linear, and applying it twice gives back the original input: $f(f(x,y))=f(y,x)=(x,y)$. In particular, we have $f^{-1}=f$.

  3. More generally, every invertible $(n\times n)$-matrix $A\in \mathcal{M}_{n\times n}(R)$ defines an isomorphism $f_A:R^n\to R^n, x\mapsto Ax$. Its inverse is the linear map defined by the inverse matrix $A^{-1}$.

  4. The map $f:R\to R,\hspace{5pt}x\mapsto ax$ is an isomorphism if and only if $a\in R$ is invertible. In that case, the inverse map is $f^{-1}:R\to R,\hspace{5pt}x\mapsto a^{-1}x$.

  5. The map $f:R\to R^2,\hspace{5pt}x\mapsto (x,0)$ is linear, but not an isomorphism. It is injective, but not surjective, since elements such as $(0,1)\in R^2$ are not in its image.

  6. The map $f:R^2\to R,\hspace{5pt}, (x,y)\mapsto x$ is linear, but not an isomorphism. It is surjective, but not injective, since for example both $(0,0)$ and $(0,1)$ are mapped to $0$.

  7. The map $f:R\to R, \hspace{5pt}x\mapsto x+1$ is not an isomorphism of $R$-modules. Even though it may be bijective in many familiar cases (depending on which ring $R$ we’re looking at), it is not linear, as we’ve seen in Example 7 of the previous section on linear maps.

Intuition

An isomorphism is a linear map that perfectly preserves the module structure without losing any information. In particular, it does not collapse distinct elements into the same element, and it does not miss any elements in the target module.

So, if two $R$-modules are isomorphic, they may look different at first, but they are structurally the same (when viewed as $R$-modules). Anything we can do in one of them can be translated into the other one and back again using linear maps.

Consider, for instance, the $R$-module $\mathcal{M}_{2\times 2}(R)$ of $(2\times 2)$-matrices and the $R$-module $R^4$ of length-$4$ vectors with entries in $R$: These spaces are clearly not equal as sets since their elements are written in completely different forms. In other words, we have $\mathcal{M}_{2\times 2}(R)\neq R^4$ when viewing $\mathcal{M}_{2\times 2}(R)$ and $R^4$ merely as sets without further structure. But, when viewing $\mathcal{M}_{2\times 2}(R)$ and $R^4$ from a module-theoretic perspective, they are isomorphic as $R$-modules via the map

$$ \begin{bmatrix}a&b\\ c&d\end{bmatrix}\mapsto (a,b,c,d), $$

whose inverse is trivially given by

$$ (a,b,c,d)\mapsto \begin{bmatrix}a&b\\ c&d\end{bmatrix}. $$

Therefore, we write $\mathcal{M}_{2\times 2}(R)\cong R^4$ and say that “they are the same” or that “they are equal” from the perspective of module theory (even though they are, strictly speaking, different sets).

Bilinear Maps

Definition

Consider a ring $R$ and three $R$-modules $L$, $M$, and $N$. A bilinear map is a function $b:L\times M\to N$ that is linear in each argument separately. More precisely, for all $\ell\in L$, $m\in M$, and $r\in R$, we require that:

  1. For fixed $m\in M$, the map $L\to N,\hspace{3pt}\ell\mapsto b(\ell,m)$ is $R$-linear.

  2. For fixed $\ell\in L$, the map $M\to N,\hspace{3pt}m\mapsto b(\ell,m)$ is $R$-linear.

Equivalently, a function $b:L\times M\to N$ is bilinear if, for all $\ell,\ell^\prime\in L$, all $m,m^\prime\in M$, and all $r\in R$, we have:

  1. $b(\ell+\ell^\prime,m)=b(\ell,m)+b(\ell^\prime,m)$.

  2. $b(\ell,m+m^\prime)=b(\ell,m)+b(\ell,m^\prime)$.

  3. $b(r\cdot \ell,m)=r\cdot b(\ell,m)$.

  4. $b(\ell,r\cdot m)=r\cdot b(\ell,m)$.

A map that is linear in three or more arguments is called a multilinear map.

Examples

  1. The multiplication map $\mu :R\times R\to R,\hspace{5pt}(a,b)\mapsto ab$ is a bilinear map, since multiplication in a ring is additive and compatible with scalar multiplication in each argument.

  2. More generally, if $R[x_1,...,x_n]$ denotes the polynomial ring over $R$, then the polynomial multiplication map $$ R[x_1,...,x_n]\times R[x_1,...,x_n]\to R[x_1,...,x_n],\hspace{10pt}(f,g)\mapsto fg $$ is bilinear.

  3. Consider the $R$-module $R^n$. The dot product $$ \langle\cdot ,\cdot \rangle:R^n\times R^n\to R,\hspace{10pt}((x_1,...,x_n)^\top,(y_1,...,y_n)^\top)\mapsto \sum_{i=1}^nx_iy_i $$ is a bilinear map, where $\top$ indicates that we transpose, which is just saying that we interpret elements of $R^n$ as vertical vectors, and not as horizontal ones.

  4. Matrix multiplication defines a bilinear map. More precisely, for positive integers $m$, $n$, and $k$, the map $$ \mathcal{M}_{m\times n}(R)\times \mathcal{M}_{n\times k}(R)\to \mathcal{M}_{m\times k}(R), \hspace{10pt}(A,B)\mapsto A\cdot B $$ is bilinear.

  5. If $L$ and $M$ are $R$-modules, then the zero map $b:L\times M\to N,\hspace{5pt}(\ell,m)\mapsto 0$ is bilinear for every $R$-module $N$.

  6. The map $b:R\times R\to R,\hspace{5pt}(a,b)\mapsto a+b$ is not bilinear. For instance, fixing $b=1$, the map $a\mapsto a+1$ is not linear, as we have already discussed in Example 7 of the section on linear maps.

  7. The map $b:R\times R\to R,\hspace{5pt}(a,b)\mapsto ab+1$ is not bilinear. As before, we can see this by fixing $b=1$ to obtain the map $a\mapsto a+1$, which we know is not linear.

Intuition

A bilinear map is simply a function of two variables that behaves linearly in each variable separately. Think of bilinear maps as the “two-input version” of linear maps. They give us a way to map in a module-structure-preserving manner (i.e., in a manner that respects the module’s addition and scalar multiplication) whenever elements of two modules are involved simultaneously.

This is precisely why bilinear maps are so important for tensor products: As we will see in the next post, tensor products are designed to encode bilinear maps as ordinary linear maps. In that sense, bilinear maps are the motivating object, and tensor products are the tool that lets us handle them using linear algebra.

Now that we know about rings, modules, linear maps, isomorphisms, and bilinear maps, we’re finally ready to introduce the tensor product, which will be the main topic of the next post.

Acknowledgements

Special thanks to Nicolas Mohnblatt, Jason ParkVarun Thakore, Khaled Suliman, and Youssef23 for taking the time to help me polish this post.

Keep reading
Recommended

Sum-Check as an Algebraic Tensor Reduction: Part I

This post introduces algebraic tensor reductions as a unifying framework for understanding recursive proof protocols, using sum-check as the main motivating example. It walks through one recursive step of sum-check, showing how the prover sends a univariate summary, the verifier checks sum consistency, and the original claim is reduced to a smaller claim with one fewer variable. A small bivariate example illustrates how this “peel off one variable, check, then fold with randomness” pattern works concretely. The post sets up the rest of the series, which will introduce the tensor language needed to recover classical sum-check as an algebraic tensor reduction.

Marco Besier · April 27, 2026

Sum-Check as an Algebraic Tensor Reduction: Part II

In this part of our series, we start introducing the algebraic language needed to formalize sum-check as a tensor reduction. We start with the basics of rings and modules. Rings generalize fields by dropping the requirement that every non-zero element has a multiplicative inverse. Modules then generalize vector spaces by allowing scalars to come from a ring instead of a field. In this post, we’ll use plenty of examples to make these ideas concrete and build intuition along the way.

Marco Besier · May 10, 2026

Learn Sumcheck, MLE, and HyperPlonk: An Interactive Tutorial with SageMath

A new interactive tutorial on Sumcheck, Multilinear Extensions, and HyperPlonk with complete SageMath implementations and exercises. Go beyond the theory and understand how these protocols actually work by implementing them yourself.

Marco Gaglianese · November 22, 2025
More to explore

Soundness Failures in LaBRADOR Implementations from NTT -Friendly Rings

Post-quantum cryptography is making its way into production libraries, and correct implementation is far from trivial. We reviewed several LaBRADOR implementations on GitHub and found three of them broken, with soundness collapsing as far as a single bit, because of parameter choices that look perfectly reasonable in many lattice-based protocols; a power-of-2 modulus, a composite modulus, or NTT-friendly rings for efficient ring multiplication. The post goes through how each of those choices undermines the protocol's soundness argument, and why NTT-friendliness, of all things, turns out to be the wrong instinct if not handled carefully.

Georgios Raikos · April 30, 2026

AI meets Cryptography 1: What AI Found in Cloudflare's CIRCL

We pointed our AI audit pipeline at Cloudflare's CIRCL experimental cryptography library and confirmed seven real bugs, from a critical float64 precision loss in threshold RSA to a complete access-control break in attribute-based encryption. All seven are now fixed upstream. This is the first post in a series on bugs our agents found across open source cryptography.

Stefanos Chaliasos, Hao Pham, False Witness team · July 07, 2026

Detecting boomerang values in zero-knowledge circuits using tag analysis

Ever wonder how zkApps ensure their execution is spot-on? This post digs into the idea of *boomerang values*, sneaky bugs that can crop up when zkApps mix in-circuit and out-of-circuit logic. We explore how these values disrupt your circuit's trustworthiness, especially when variables are reintegrated unverified. Plus, we share how tools like MIRAI's tag analysis can help spot these issues, making your zkApps more secure. Perfect for anyone into zero-knowledge applications or budding Rust enthusiasts looking for insights on taming complex bugs!

ZK/SEC · August 25, 2023