{"slug": "zk-golf-fearless-and-collaborative-optimization-of-circuits", "title": "zk.golf: Fearless and Collaborative Optimization of Circuits", "summary": "ZkSecurity released zk.golf, a platform for competitive optimization of zero-knowledge circuits using formal verification and AI. The platform combines Clean, a tool for machine-checkable proofs of circuit correctness, with frontier AI models to generate deeply optimized circuits in days. This approach enables 'fearless optimization' by leveraging LLMs for optimization and theorem provers for trust, reducing formalization efforts from years to days.", "body_md": "Today we are releasing [zk.golf](https://zk.golf), a platform where people can compete on creating the most efficient zk circuits for specific problems. It is the blend of two powerful ideas:\n\n- With\n[Clean](https://github.com/Verified-zkEVM/clean)we are able to certify correctness of circuits using machine-checkable proofs. - With frontier AI models, we are able to obtain deeply optimized circuits with accompanying proofs in days.\n\nWe call it **fearless optimization** of zk circuits.\n\n## How We Got Here\n\nOver the last months, we have been experimenting with letting LLMs write circuits, as long as they could prove that their implementation was correct. It started with [SHA-256](https://github.com/Verified-zkEVM/clean/tree/main/Clean/Gadgets/SHA256): we hand wrote a specification in Lean for SHA-256 compression, and then we asked LLMs to write the circuit, targeting R1CS arithmetization and large fields. It took a couple of nights of work for Opus 4.7, and some light steering into the right direction, but in the end the model came up with a reasonable implementation.\n\nThe amazing thing is that **we did not really have to check if the circuit was correct**. Since it was implemented in Clean, Opus 4.7 provided both the soundness and completeness proofs with respect to the hand-written specification we wrote and we trusted.\n\nAfter some time, we asked LLMs to aggressively optimize the circuits, given a target cost metric. We immediately got [very promising results](https://github.com/Verified-zkEVM/clean/pull/395), just by asking to come up with optimization ideas, implement them and prove that the new circuit still satisfies soundness and completeness. Sometimes, it came up with unsound optimizations, however, since it could not prove them,\nit backtracked and got itself back on to the right approach.\n\nThe Lean kernel and the Clean theorems were happy, we were happy.\n\n## A Natural Asymmetry\n\nThink for a moment about RSA signature verification. The algorithm can be written out in a few lines of code: it is just an integer modular exponentiation, with some simple checks for padding on top. However, circuits implementing this functionality tend to be extremely complex, mainly due to how big integer arithmetic is implemented, and the various tricks for doing it efficiently.\n\nAt zkSecurity we have reviewed many of such circuits: it can be really hard for humans to keep track of ranges, assumptions and relations between different components. However, most of the time, **the correctness reasoning is boring and uninteresting**: it involves simple equation rewritings, range analysis and sometimes polynomial evaluation reasoning.\n\nThese are exactly the kinds of proofs LLMs are really good at:\nthey will happily work through boring bounds analysis and equation rewritings for us,\nand because they cannot fool the theorem prover we can trust them to do this work flawlessly.\nThis is what makes the *combination of formal verification and LLMs is incredibly powerful*,\nbecause they compliment each other just right:\nLLMs *cannot be trusted*, but are very eager to do any amount of work,\non the other hand, the theorem prover *can be trusted*, but demands a huge amount of work.\nThe result is that a formalization effort that *previously took years*, now can be *done in days*.\n\n## Just the Right Circuit, Please!\n\nIn the early days of Clean, we had a distinguishing feature with respect to other zk formal frameworks:\nwe wanted to prove **completeness** alongside soundness.\nAt the time we did not realize it, but it turns out that this is *exactly the feature* that allows us to let *untrusted users*,\nand in particular LLMs, write and optimize circuits for us.\n\nIf we ask an LLM to optimize any circuit, and we required only soundness, the output would be surprising: it would be the cheapest *unsatisfiable* circuit.\nIn R1CS this would probably be the circuit with just one linear constraint, enforcing that the constant `1`\n\nwire is equal to zero.\nThis is because **the unsatisfiable circuit is sound for any specification**:\nthe prover will never be able to convince the verifier of a false claim, simply because they will not be able to convince them of anything!\n\nBy requiring soundness and completeness, we exactly pin down the *right* circuit, from the correct opposing directions.\n\n## What About Compilers?\n\nOne may say that we already have tools for automated circuit optimization: they are called optimizing compilers. For example, the Circom compiler performs a number of useful optimizations, it removes redundant variables and optimizes away linear constraints.\n\nAs similarly noted in [\"The final form of software development\"](https://blog.zksecurity.xyz/posts/end-coding/),\nwriting directly in the low-level language is much more powerful:\n\n- We are able to\n**remove the trust assumption of the compiler correctness**, and instead rely on the*tiny*semantical core of constraint satisfaction. - Even if the compiler is formally verified, we are able to do\n**specific optimizations tailored to the problem**. Compilers can only do generic optimizations, which, especially in zk circuits, tend to be insufficient if we are aiming for aggressive optimization.\n\nIn a sense, LLMs + an interactive theorem prover *is* a very clever and very expensive optimizing compiler:\nconverting a high-level specification (like a simple program verifying an RSA signature) into a complex low-level description (like a zk circuit).\n\n## Specifications, Not Circuits.\n\nWe increasingly believe that no one should even look at constraints ever again: constraints are the lowest level possible for writing zk circuits, and while they exactly describe the assertions made by the underlying proof system, they are not the best language for human auditability. Using the approach described in this post we can skip the review of constraints, and directly review the Lean specification.\n\nOf course, specifications, like all code, can have bugs, however reviewing specifications is *much* easier:\nthe specification is not an optimized implementation and\ncan be written in the *most natural way* to express the computation e.g. modular arithmetic using integers with arbitrary precision.\nThis greatly increases the confidence in the circuits we write and deploy,\nit also significantly lowers the barrier to entry:\npractitioners can write specifications as easily as they write programs in any regular programming language\nand then ask an LLM to convert it to an optimized circuit implementation with confidence using Clean.\n\n## What Is zk.golf\n\nThis post so far has been a random collection of thoughts and opinions. What did we build?\n\n[zk.golf](https://zk.golf) is a platform that allows users to compete in creating the most efficient circuit possible for a given \"formal interface\".\nThe interface of a circuit defines all the interesting properties of a circuit, and is composed of:\n\n- The\n**input and output types**. - The\n**assumptions** on the inputs, that have to be checked elsewhere, for example by the caller of the circuit (sometimes this is called the precondition). - The\n**specification**, which is the guarantee that the circuit provides (sometimes this is called the postcondition).\n\nFor each challenge, we wrote a formal interface, which we believe represents an interesting, real-world problem. People can submit arbitrary circuits, as long as they provide a machine-checkable Lean proof that their circuit satisfies the interface. We verify the Lean proofs using [comparator](https://github.com/leanprover/comparator).\n\nSince Clean supports lookups and high-degree constraints, users additionally have to prove that their circuit is R1CS, and they have to provide cost proofs for the circuit. The two cost metrics are the number of allocations and the number of constraints. Currently we score submissions based on the sum of allocations and constraints, and we target the BN254 prime field.\n\n## Get Involved\n\nIf you think you can beat the state of the art for zk circuits, go to [zk.golf](https://zk.golf), pick a challenge and start optimizing. We have also written some guidance for LLMs to autonomously perform the optimization and submissions for you: just create an API key and point your agent to [llms.txt](https://zk.golf/llms.txt).\nEven if you have never played with formal verification or Clean before, this is a very easy way to get started and\nto look at some simple, yet real-world examples of what specifications/formal verification looks like.\nYou can optimize circuits by simply guiding your agents towards the right techniques and tools.\n\nWe will be adding more challenges in the coming weeks and our goal is to ultimately provide a library of highly optimized, formally verified, zk circuits for the whole community to use.\n\nWe look forward to seeing you all on the leaderboard!", "url": "https://wpnews.pro/news/zk-golf-fearless-and-collaborative-optimization-of-circuits", "canonical_source": "https://blog.zksecurity.xyz/posts/zkgolf/", "published_at": "2026-07-02 00:00:00+00:00", "updated_at": "2026-07-07 19:32:56.846365+00:00", "lang": "en", "topics": ["ai-tools", "ai-research", "ai-agents"], "entities": ["zk.golf", "Clean", "zkSecurity", "Lean", "R1CS", "SHA-256", "Opus 4.7"], "alternates": {"html": "https://wpnews.pro/news/zk-golf-fearless-and-collaborative-optimization-of-circuits", "markdown": "https://wpnews.pro/news/zk-golf-fearless-and-collaborative-optimization-of-circuits.md", "text": "https://wpnews.pro/news/zk-golf-fearless-and-collaborative-optimization-of-circuits.txt", "jsonld": "https://wpnews.pro/news/zk-golf-fearless-and-collaborative-optimization-of-circuits.jsonld"}}