# Zero-Integral and Sum-Check

Let $T$ be a table of 1 column and $∣H∣$ rows, and let $f^ (X)$ be any polynomial that agrees with $T$ when evaluated on $H=(ο_{i})_{i}$, where $ο$ is a generator of the subgroup of order $2_{k}$ $H$. Group theory lets us prove and efficiently verify if $∑T=0$.

Decompose $f^ (X)$ into $f^ (X)=g^ (X)+Z_{H}(X)⋅h^(X)$, where $Z_{H}(X)$ is the zerofier over $H$, and where $g^ (X)$ has degree at most $∣H∣−1$. The table sums to zero if and only if $g^ (X)$ integrates to zero over $H$ because

$h∈H∑ f^ (h)=h∈H∑ (g^ (h)+Z_{H}(h)⋅h^(h))=h∈H∑ g^ (h)$

and this latter proposition is true if and only if the constant term of $g^ (X)$ is zero.

**Theorem.** $∑_{h∈H}f^ (h)=0⇔X∣g^ (X)$ for a subgroup $H⊆F_{∗}$ of order $2_{k}$.

$Proof.$ Let $K$ be a subgroup of $H$. If $K={1}$ then $−1∈K$ and also $∑_{k∈K}k=0$ because the elements of $K$ come in pairs: $k∈K⇔−k∈K$. Therefore $∑_{h∈H}h=0$.

The map $H→K,h↦h_{α}$ is a morphism of groups with $∣H∣≥∣K∣≥1$. Therefore we have:

$h∈H∑ h_{α}={∣H∣0 ⇐α=0mod∣H∣.⇐α=0mod∣H∣. $

The polynomial $g^ (X)$ has only one term whose exponent is $0mod∣H∣$, which is the constant term. $□$

This observation gives rise to the following Polynomial IOP for verifying that a polynomial oracle $[f^ (X)]$ integrates to 0 on a subgroup $H$ of order some power of 2.

**Protocol Zero-Integral**

- Prover computes $g^ (X)←f^ (X)modZ_{H}(X)$ and $h^(X)←Z_{H}(X)f^ (X)−g^ (X) $.
- Prover computes $g^ _{⋆}(X)=Xg^ (X) $.
- Prover sends $g^ _{⋆}(X)$, of degree at most $∣H∣−2$, and $h^(X)$, of degree at most $deg(f^ (X))−∣H∣$ to Verifier.
- Verifier queries $[f^ (X)]$, $[g^ _{⋆}(X)]$, $[h^(X)]$ in z \xleftarrow{$} \mathbb{F} and receives $y_{f},y_{g_{⋆}},y_{h}$.
- Verifier tests $y_{f}=?z⋅y_{g_{⋆}}+y_{h}⋅Z_{H}(z)$.

This protocol can be adapted to show instead that a given polynomial oracle integrates to $a=0$ on the subgroup $H$, giving rise to the well-known **Sum-Check** protocol. The adaptation follows from the Verifier's capacity to simulate $[f^ _{⋆}(X)]$ from $[f^ (X)]$, where $f^ _{⋆}(X)=f^ (X)−∣H∣a $. This simulated polynomial is useful because

$h∈H∑ f^ _{⋆}(h)=h∈H∑ (f^ (h)−∣H∣a )=a−Ha h∈H∑ 1=0.$

In other words, $f^ (X)$ integrates to $a$ on $H$ iff $f^ _{⋆}(X)$ integrates to $0$ on $H$, and we already a protocol to establish the latter claim.