 We'll be presenting NOVA, Recursive Zero Knowledge Arguments from a new notion known as Folding Schemes. Our goal is to design practical proofs for recursive computation. What I mean by this is that we wanna design a proof system that allows us to prove that a non-deterministic function F applied N times to an initial input C zero results in an output ZN. And I say non-deterministic because we wanna allow F to take arbitrary witnesses along the way. Now there are various cryptographic applications where this could be useful. For instance, if F is a delay function, then such a proof system allows us to build verifiable delay functions. If F is a step of a virtual machine, then we can use such a proof system to verifiably execute virtual machines potentially in zero knowledge. And finally, if F validates blockchain transactions, then we can use such a proof system to very quickly and very efficiently prove many updates to the blockchain. In fact, such a system is being used today in practice and it's known as ZK rollups. Now the naive approach to building such a proof system is to use a snark to monolithically prove an unrolled statement. That is we can take N copies of F, squeeze it all into an arithmetic circuit and then prove satisfiability of this circuit. While this approach predominantly works, there are several drawbacks. First, this fixes N ahead of time, which makes it not very useful for many practical applications. For instance, in the case of virtual machines, the number of iterations N might actually depend on the input program. Moreover, the proven memory and the verifier pre-processing time are dependent on F, the size of F, times N. And moreover, the verifier time might also depend on N, depending on the snark that we're using. To get around these sorts of issues, Valiant introduces the notion of incrementally verifiable computation in which we can write a proof for a single iteration of F. We can also increment this proof over time to capture more and more iterations of F. Eventually we want to be able to keep incrementing these proofs until we can get a proof for all and iterations of F. The two design challenges when designing an IVC proof system, specifically we wanna make sure these proofs can handle any arbitrary N, that means we can increment to any level that we want to. And moreover, we wanna make sure that these proofs do not grow in size in terms of N. Nonova is one of the most efficient ZK snarks for recursive computation. And the way we do it is to design the most efficient IVC scheme to date using a new notion known as folding schemes. A folding scheme reduces the task of checking two instances in a relation to the task of checking a single instance in that relation. Specifically, we show that a folding scheme for NP relations implies IVC. We designed a new characterization of NP called relaxed R1CS, which is specifically amenable for folding. The proofs resulting for our IVC scheme are linear in the size of the function F. In the case that we want even more efficiency guarantees, we introduce a layer of both succinctness and zero knowledge. Specifically, we introduce a zero-knowledge proof system for relaxed R1CS, and we use this zero-knowledge proof system to design efficient ZK snarks that prove the existence of IVC proofs. Now, these asymptotically and concretely reduce the size of our IVC proofs to make a very efficient recursive proof system. All in all, Nova represents the fastest proof system for recursive computation. Specifically, Nova is implemented in Rust in about 6,000 lines of code. Nova features the smallest per step proofer time that's dominated per step by just two multi-exponentiations, where the size of each multi-exponentiation depends on the size of F plus some small constant C. In practice, to prove a function representable as one million gates, it takes roughly 1.1 seconds per recursion step. The recursion overhead itself is also incredibly small. Roughly, it's dominated by two scalar multiplications and translated to arithmetic circuit constraints, this translates to 20,000 gates. Moreover, adding the layer of succinctness, our proofs end up being logarithmic in the size of the original function F, specifically is compressed proofs for million gates circuits are roughly eight kilobytes. And this is independent of the number of iterations N. In the full talk, we will be talking about how we derive a characterization of NP, relaxed R1CS, that is amenable to folding. We then talk about how to design a folding scheme for relaxed R1CS, and then show how such a folding scheme can be used to construct IBC. Thank you.