The Rosetta Stone

How One Table Over One Field Unifies Cryptography, Intelligence, and Encrypted Computation

The Object

A function table $T_f$ over the Goldilocks field is a finite map:

$$T_f : \{0, 1, \ldots, D-1\} \to \mathbb{F}_p, \qquad p = 2^{64} - 2^{32} + 1$$

It stores $D$ pairs $(i, f(i))$ where both input and output are elements of $\mathbb{F}_p$. Nothing more. A list of numbers indexed by numbers.

This object — this simple table — is simultaneously:

A cryptographic S-box that provides security
A neural network activation that provides intelligence
An FHE bootstrap function that provides privacy
A STARK lookup entry that provides verifiability

Four roles. One table. One field. This is not a metaphor. It is a mathematical identity — four systems reading the same data structure, each interpreting it through its own algebra, all producing compatible results because they share the same ground field.

Why Tables Exist at All

Every interesting computation requires nonlinearity. Linear functions (addition, scalar multiplication, matrix products) are easy to compute, easy to prove, easy to encrypt — but they cannot distinguish, classify, decide, or protect. A purely linear system has no secrets and no intelligence.

The fundamental problem of field arithmetic is that $\mathbb{F}_p$ only natively provides linear and low-degree polynomial operations. The field gives you $+$, $\times$, and $x^k$ for free. But:

Comparison ($a < b$?) is not a polynomial over $\mathbb{F}_p$
ReLU ($\max(0, x)$) is not a polynomial over $\mathbb{F}_p$
Bit extraction ($\lfloor x/2^k \rfloor \bmod 2$) is not a polynomial over $\mathbb{F}_p$
The modular inverse ($x^{-1}$, degree $p-2$) is technically polynomial but requires $O(\log p)$ multiplications

The universal solution: precompute the function and store it as a table. For a function $f$ over a bounded domain, define $T_f[i] = f(i)$ for all valid inputs. Evaluation becomes a single lookup: $y = T_f[x]$.

This is not an optimization trick. It is the only way to introduce arbitrary nonlinearity into field-arithmetic systems. And each domain that operates over $\mathbb{F}_p$ has independently discovered that it needs exactly this mechanism — arriving at the same mathematical object from four different directions.

The Four Readings

Reading 1: Cryptographic S-box

A hash function over $\mathbb{F}_p$ needs a nonlinear component to resist algebraic attacks. Without it, the hash is a linear map — invertible by Gaussian elimination, providing zero security.

Poseidon2 uses the power map $S(x) = x^7$ as its S-box. This is a low-degree polynomial, not a table lookup — but its security comes from the same principle: the S-box introduces sufficient algebraic degree to prevent equation-solving attacks. Each round applies $S$ to the state, then mixes with a linear layer (MDS matrix). After 22 rounds, the algebraic degree exceeds any feasible attack.

Tip5 (the alternative hash in Triton VM) takes the table approach directly: its S-box is $S(x) = x^{p-2}$ (the modular inverse), implemented as a lookup table. The lookup argument in the STARK proves that the prover actually evaluated the correct function — it checks that each $(x, y)$ pair in the execution trace appears in the precomputed table $T_{\text{inv}}$.

In both cases, the mechanism is: a nonlinear function $\mathbb{F}_p \to \mathbb{F}_p$ provides the security margin. Whether implemented as a power map or a table, the role is identical — inject nonlinearity that resists algebraic inversion.

What the table provides: Collision resistance. Preimage resistance. Pseudorandomness. Security.

Reading 2: Neural Network Activation

A neural network layer computes $y = \sigma(Wx + b)$ where $W$ is a weight matrix, $b$ is a bias, and $\sigma$ is the activation function. The linear part ($Wx + b$) is matrix multiplication over $\mathbb{F}_p$ — native field arithmetic. But without the nonlinear activation $\sigma$, stacking layers is pointless: $W_2(W_1 x + b_1) + b_2 = W_2 W_1 x + W_2 b_1 + b_2$ is still linear. Depth without nonlinearity provides no expressiveness.

In conventional ML, activations are float functions: $\text{ReLU}(x) = \max(0, x)$, $\text{GELU}(x) = x \cdot \Phi(x)$, $\text{sigmoid}(x) = 1/(1+e^{-x})$. None of these are polynomials over $\mathbb{F}_p$. To run neural networks in field arithmetic (for STARK-provable inference), we represent activations as lookup tables:

$$T_{\text{relu}}[i] = \begin{cases} i & \text{if } i \leq (p-1)/2 \\ 0 & \text{if } i > (p-1)/2 \end{cases}$$

(using the convention that the upper half of $\mathbb{F}_p$ represents negative numbers in balanced representation)

The STARK proves that the network's inference is correct by checking — via the same lookup argument used for the hash S-box — that every activation evaluation $(x, \sigma(x))$ appears in the precomputed table $T_\sigma$.

What the table provides: Universal approximation. Classification. Pattern recognition. Intelligence.

Reading 3: FHE Programmable Bootstrapping

In TFHE (Fully Homomorphic Encryption over the Torus), the fundamental operation is Programmable Bootstrapping (PBS). PBS simultaneously refreshes ciphertext noise AND evaluates an arbitrary function on the encrypted plaintext. The function is encoded as a test polynomial:

$$v(X) = \sum_{i=0}^{N-1} f\!\left(\left\lfloor \frac{i \cdot t}{N} \right\rfloor\right) \cdot X^i$$

where $f$ is the function to evaluate, $t$ is the plaintext modulus, and $N$ is the polynomial ring degree.

PBS works by blind-rotating this polynomial: the encrypted input $\text{Enc}(m)$ controls a sequence of polynomial multiplications that effectively shift $v(X)$ by $m$ positions. After sample extraction, the result is $\text{Enc}(f(m))$ — the function applied to encrypted data without ever decrypting it.

The critical observation: the test polynomial $v$ is constructed from the same function values as the lookup table $T_f$. The function $f: \{0, \ldots, t-1\} \to \mathbb{F}_p$ is identical — only the encoding differs (polynomial coefficients vs. indexed entries).

When TFHE operates over the Goldilocks field ($q = p$), the polynomial ring is $R_p = \mathbb{F}_p[X]/(X^N + 1)$ — polynomials with coefficients in $\mathbb{F}_p$. The test polynomial $v \in R_p$ has coefficients that are elements of $\mathbb{F}_p$. The lookup table $T_f$ has entries that are elements of $\mathbb{F}_p$. They contain the same values.

What the table provides: Function evaluation on encrypted data. Noise refresh. Privacy-preserving computation.

Reading 4: STARK Lookup Argument

A STARK proves that an execution trace satisfies algebraic constraints. Most constraints are polynomial — transition from row $i$ to row $i+1$ follows a degree-$d$ equation. But some operations (hash S-boxes, activations, comparisons) are not efficiently expressed as polynomials. For these, the STARK uses a lookup argument.

The lookup argument works as follows: the prover commits to a table $T$ of valid $(x, y)$ pairs. For each operation in the trace that evaluates $y = f(x)$, the prover demonstrates that $(x, y) \in T$. The algebraic mechanism (logarithmic derivative / LogUp) reduces this to a grand-sum equation over $\mathbb{F}_p$:

$$\sum_{i \in \text{trace}} \frac{1}{\alpha - (x_i + \beta \cdot y_i)} = \sum_{j \in T} \frac{m_j}{\alpha - (a_j + \beta \cdot b_j)}$$

where $\alpha, \beta$ are random challenges, $m_j$ is the multiplicity of table entry $j$, and $(a_j, b_j) = (j, T[j])$.

This equation is satisfied if and only if the multiset of trace lookups is a sub-multiset of the table — meaning every claimed function evaluation is correct. The verifier checks this with $O(|T| + |\text{trace}|)$ field operations. No re-execution of the function. No knowledge of the function's implementation. Just: "every $(x, y)$ pair is in the table."

What the table provides: Succinct verification. Proof correctness. Trust elimination.

The Unification

Now place all four readings side by side:

Domain	Function $f$	Encoding	Authentication	Purpose
Crypto	$x^{p-2}$ (inverse)	S-box permutation	STARK lookup argument	Hash security
Neural net	$\text{ReLU}(x)$	Precomputed table	STARK lookup argument	NN expressiveness
FHE	$\text{ReLU}(x)$	Test polynomial coefficients in $R_p$	Blind rotation	Encrypted evaluation
STARK	any $f: \mathbb{F}_p \to \mathbb{F}_p$	$(x, f(x))$ pairs	LogUp grand sum	Proof correctness

When all four systems operate over $\mathbb{F}_p$, these are not four similar mechanisms — they are four views of the same data. The function table $T_f$ exists once. Each system reads it differently:

                    T_f : {0, ..., D-1} → F_p
                    ╔══════════════════════╗
                    ║  0 → f(0)            ║
                    ║  1 → f(1)            ║
                    ║  2 → f(2)            ║
                    ║  ...                 ║
                    ║  D-1 → f(D-1)        ║
                    ╚══════════╦═══════════╝
                               │
              ┌────────────────┼────────────────┐
              │                │                │
     ┌────────┴────────┐ ┌────┴────┐ ┌─────────┴─────────┐
     │  STARK reads:    │ │ NN reads│ │  FHE reads:        │
     │  lookup table    │ │ activ-  │ │  test polynomial   │
     │  for LogUp proof │ │ ation   │ │  v(X) = Σ f(i)·X^i│
     │                  │ │ layer   │ │  for PBS            │
     │  Checks (x,y)∈T │ │ y=T[x]  │ │  Blind-rotates by  │
     │  via grand sum   │ │ per     │ │  encrypted input   │
     └─────────────────┘ │ neuron  │ └────────────────────┘
                         └─────────┘
                              │
                     ┌────────┴─────────┐
                     │  Crypto reads:    │
                     │  S-box for hash   │
                     │  permutation      │
                     │  round function   │
                     └──────────────────┘

One table. Four purposes. Zero redundancy.

A program that performs neural network inference on FHE-encrypted data with a STARK correctness proof uses the same ReLU table for:

The activation function (NN layer)
The test polynomial (FHE bootstrapping)
The lookup entry (STARK authentication)

Three roles served by a single array of field elements.

Why This Cannot Exist Outside Goldilocks Unification

The trilateral identity requires five conditions, all simultaneously:

Neural networks in $\mathbb{F}_p$: No float-to-field quantization. Weights and activations are natively field elements. This requires a field large enough for meaningful arithmetic (Goldilocks field: 64 bits, sufficient for 16-bit fixed-point with headroom).
FHE ciphertext ring = $R_p = \mathbb{F}_p[X]/(X^N+1)$: The FHE modulus $q$ equals the field characteristic $p$. This requires $p-1$ to have large powers of 2 for NTT support. Goldilocks: $p - 1 = 2^{32}(2^{32}-1)$ — supports NTT up to size $2^{32}$.
STARK proofs over $\mathbb{F}_p$: The proof system's native field is the same Goldilocks field. FRI folding, polynomial commitment, constraint evaluation — all natively $\mathbb{F}_p$ arithmetic.
Lookup argument over $\mathbb{F}_p$: The LogUp mechanism operates in the same field as the table entries, the FHE ciphertexts, and the neural network weights.
Shared execution environment: A single language (trident) compiles programs that use all four systems, generating a unified execution trace over $\mathbb{F}_p$.

If any of these conditions fails — if the FHE uses a different modulus, if the STARK uses a different field, if the neural network requires float conversion — the table identity breaks. You get four separate tables with four separate encodings, requiring cross-domain translation at every boundary.

Conventional systems fail at condition 2. Standard TFHE uses power-of-two moduli ($q = 2^{32}$ or $q = 2^{64}$) which are not prime fields. Standard SNARKs use BN254 or BLS12-381, not Goldilocks. Standard neural networks use IEEE 754 float. Three different algebraic worlds. Three different tables. No unification possible.

The Goldilocks field makes all five conditions true simultaneously. This is not coincidence — it is a consequence of choosing a field that is simultaneously:

Large enough for ML precision (64-bit)
FFT-friendly for FHE and STARK ($2^{32}$ roots of unity)
CPU-native for efficiency (fits in one register)
Prime for proper field structure (unlike $2^{64}$)

The Deeper Pattern: Nonlinearity Is the Bottleneck

Why does this unification matter? Because in every domain, the lookup table is the bottleneck operation — the most expensive, most critical, and most frequently executed nonlinear step:

Domain	Linear part	Cost	Nonlinear part (table)	Cost	Ratio
STARK	Constraint evaluation	$O(n)$	Lookup argument	$O(n \log n)$	Lookup dominates
Neural net	Matrix multiply $Wx+b$	$O(d^2)$	Activation $\sigma(x)$	$O(d)$ per layer	Matrix dominates in compute, but activation determines expressiveness
FHE	Homomorphic add/sub	$O(n)$	PBS (bootstrapping)	$O(n \cdot N \log N)$	PBS dominates by 100-1000x
Hash	MDS matrix multiply	$O(t^2)$	S-box $x \mapsto x^7$	$O(1)$ per element	S-box determines security

In every case, the table is either the computational bottleneck (FHE PBS, STARK lookup) or the functional bottleneck (NN activation determines expressiveness, S-box determines security). Optimizing the table optimizes everything.

This is why the GFP has a dedicated Lookup Engine as one of its four primitive units. The LUT hardware doesn't just serve one domain — it accelerates the critical path of all four domains simultaneously, because that critical path goes through the same mathematical object.

Concrete Example: ReLU

Define the function:

$$\text{relu}(x) = \begin{cases} x & \text{if } x \in [0, (p-1)/2] \\ 0 & \text{if } x \in ((p-1)/2, p-1] \end{cases}$$

(Balanced representation: upper half of $\mathbb{F}_p$ treated as negative.)

As neural network activation (std.nn.activation.relu):

// During field-native inference
let pre_activation = matrix_mul(weights, input) + bias;  // F_p matmul
let activated = T_relu[pre_activation];                   // single table lookup
// Cost: 1 lookup per neuron per layer

As STARK lookup (std.crypto.lookup.standard):

// During STARK proof generation
// Prover claims: activated = relu(pre_activation)
// Verifier checks: (pre_activation, activated) ∈ T_relu
// Via LogUp: Σ 1/(α - (x_i + β·y_i)) = Σ m_j/(α - (a_j + β·b_j))
// Cost: ~50 constraints per lookup (LogUp overhead)

As FHE test polynomial (std.fhe.bootstrap.test_polynomial):

// Construct test polynomial from the same table values
v_relu(X) = Σ_{i=0}^{N-1} relu(⌊i·t/N⌋) · X^i

// During Programmable Bootstrapping on Enc(m):
// 1. Blind rotate: ACC = X^{-b} · v_relu(X) · Π CMUX(ACC, ACC·X^{a_i·s_i})
// 2. Sample extract: Enc(relu(m)) = coefficient_0(ACC)
// Cost: n · N log N field operations (≈ 20ms on CPU, ≈ 0.4ms on GFP)

As hash component (if relu were used as S-box — illustrative):

// Poseidon-like hash using relu as nonlinearity
// (In practice, x^7 is used — but the mechanism is identical)
state[i] = T_sbox[state[i]]  for each element in the state
// The STARK proves this via the same lookup argument

Four uses. Same array of $(i, \text{relu}(i))$ pairs. Same field elements. Same hardware lookup unit.

What the Rosetta Stone Enables

Verifiable Private AI in One Proof

The holy grail: prove that a neural network was correctly evaluated on encrypted data, without revealing the data or the intermediate computations.

Without the Rosetta Stone, this requires three separate mechanisms:

FHE evaluation (PBS with test polynomials in one ring)
NN activation tables (in float or a different field)
STARK proof (lookup argument in yet another field)
Cross-domain bridges at each boundary (expensive, error-prone)

With the Rosetta Stone:

FHE PBS, NN activation, and STARK lookup use the same table
No cross-domain bridges
One proof covers everything
The lookup argument authenticates both the FHE bootstrapping function AND the neural network activation in a single pass

Dual-Use Functions

A function designed for one domain automatically works in all others:

Design a new activation function for better ML accuracy → it automatically becomes an FHE-bootstrappable function and a STARK-provable operation.
Design a new cryptographic S-box for better hash security → it automatically becomes a STARK-efficient nonlinearity and a potential NN activation.
Optimize a test polynomial for faster FHE bootstrapping → the same optimization speeds up the STARK lookup and the NN evaluation.

Research in any one domain propagates to all three. An advance in ML activation function design is simultaneously an advance in cryptographic circuit design and FHE efficiency. The Rosetta Stone turns four separate research fields into one.

Hardware Unification

The GFP's lookup engine serves all four domains with a single circuit:

Lookup Engine Hardware:
  4 tables × 64K entries × 8 bytes = 2 MB on-die SRAM
  256 parallel lookups per cycle
  LogUp accumulator (running sum) in hardware
  
  Mode 1: NN activation — direct table read
  Mode 2: STARK authentication — table read + LogUp accumulate
  Mode 3: FHE PBS — table values feed NTT as polynomial coefficients
  Mode 4: Hash S-box — table read within Poseidon2 pipeline
  
  Same silicon. Same power. Same cooling.
  Four workloads. One unit.

The Rosetta Stone Metaphor, Precisely

The original Rosetta Stone bore the same decree in three scripts — hieroglyphic, demotic, and Greek. The decree was one; the encodings were three. The stone enabled translation because it demonstrated that different-looking texts expressed identical meaning.

The lookup table over $\mathbb{F}_p$ bears the same function in four encodings:

Encoding	Script	Who reads it
$(i, f(i))$ pairs	Hieroglyphic	STARK verifier (lookup argument)
$v(X) = \sum f(i) \cdot X^i$	Demotic	FHE engine (blind rotation)
Layer activation $\sigma$	Greek	Neural network (forward pass)
S-box permutation	Cuneiform	Hash function (round function)

The function $f$ is the decree. The field $\mathbb{F}_p$ is the common language. The table is the stone.

Before Champollion, hieroglyphs and Greek were separate worlds. Before Goldilocks unification, cryptography and ML and FHE were separate worlds. The Rosetta Stone reveals that they were always saying the same thing — they just needed a common medium to make it visible.

The medium is the Goldilocks field. The stone is the lookup table. And once you can read all four scripts, you realize they are not four theories of nonlinearity. They are one theory, viewed from four angles.

$$\boxed{T_f : \{0, \ldots, D{-}1\} \to \mathbb{F}_p \quad = \quad \text{Security} + \text{Intelligence} + \text{Privacy} + \text{Proof}}$$

One function. One field. One table. Four readings. Everything else is commentary.

Cross-references

See gfp-spec for the hardware lookup engine that accelerates all four domains. See goldilocks-fhe-construction for the full FHE construction over Goldilocks. See privacy-trilateral for how the lookup table connects to the privacy stack. See trinity for the three-pillar architecture that the Rosetta Stone unifies.

rosetta-stone