---
title: "GKR-based systems"
description: "GKR-based systems: Sumcheck / interactive proofs. Setup: None (commitment-dependent). Proof size: Grows with circuit depth."
type: "option"
url: "https://zkpick.com/proof-systems/gkr/"
section: "01 Choosing a proof system"
authors:
  - "MarketComp"
publisher: "MarketComp"
version: "1.3"
updated: "2026-09-12"
license: "CC-BY-4.0"
json: "https://zkpick.com/data/proof-systems/gkr.json"
---

*By MarketComp. Updated 2026-09-12. Version 1.3. CC BY 4.0.*

# GKR-based systems — *Sumcheck / interactive proofs*

> GKR-based systems: Sumcheck / interactive proofs. Setup: None (commitment-dependent). Proof size: Grows with circuit depth. On-chain verification: Wrapper needed. PQ: Commitment-dependent. Recursion: Developing. Maturity: Production via at least one major zkVM. Prover cost profile: Linear-time; commits only to the input layer. Peak prover memory: Low relative to trace size. Off-chain verifier: Grows with circuit depth. Implementations and maintainers: Expander (Polyhedra), Ceno (Scroll), SP1 Hypercube's sumcheck design (Succinct). Where it is measured: ethproofs.org for the zkVMs built on it; Polyhedra's published figures. Choose it when: Wide, shallow, highly parallel workloads — bulk hashing, signature aggregation, inference — and zkVMs using a multilinear arithmetisation.

The GKR protocol proves layered-circuit evaluation using sumcheck, with prover time linear in circuit size. Modern systems combine it with an error-correcting-code commitment, or use GKR to run the lookup argument itself.

**Strengths**

- Linear-time prover with very low commitment cost — GKR commits only to the input layer, not every intermediate wire
- Extremely high throughput on parallel hardware for wide, uniform workloads
- Now production-proven via at least one major zkVM

**Tradeoffs**

- Requires the computation to be expressed as a layered circuit or sumcheck-friendly relation; irregular computation is awkward
- Proof size and verifier cost grow with circuit depth — deep circuits are the failure mode
- Not EVM-cheap; a wrapper is still needed for settlement
- Fewer mature general-purpose frontends

**Choose it when:** Wide, shallow, highly parallel workloads — bulk hashing, signature aggregation, inference — and zkVMs using a multilinear arithmetisation.

Maintained by: Goldwasser, Kalai and Rothblum (2008); linear-time prover by Xie et al. (Libra, 2019). Implementations: Expander (Polyhedra), Ceno (Scroll), sumcheck-based zkVM designs at Succinct · Maturity: Production as of 2026 · License: n/a (construction) · Source: https://eprint.iacr.org/2019/317

**In the proof system selection matrix** (https://zkpick.com/proof-systems/#proof-systems-matrix-gkr-sumcheck-systems)

| Family | Setup | Proof size | On-chain verification | PQ | Recursion | Maturity |
| --- | --- | --- | --- | --- | --- | --- |
| GKR / sumcheck systems | None (commitment-dependent) | Grows with circuit depth | Wrapper needed | Commitment-dependent | Developing | Production via at least one major zkVM |

**In the prover profile, implementations and benchmarks** (https://zkpick.com/proof-systems/#proof-systems-matrix-2-gkr-sumcheck-systems)

| Family | Prover cost profile | Peak prover memory | Off-chain verifier | Implementations and maintainers | Where it is measured |
| --- | --- | --- | --- | --- | --- |
| GKR / sumcheck systems | Linear-time; commits only to the input layer | Low relative to trace size | Grows with circuit depth | Expander (Polyhedra), Ceno (Scroll), SP1 Hypercube's sumcheck design (Succinct) | ethproofs.org for the zkVMs built on it; Polyhedra's published figures |