zkDuel: Characterizing SumCheck Prover Kernels across GPU Programming Models

Abstract

Zero-knowledge proofs have attracted growing interest from the hardware acceleration community, driven by their use in verifiable computation, privacy-preserving systems, and blockchain applications. A key prover kernel in many such systems is SumCheck, whose table-parallel structure makes it a natural target for GPU acceleration. Practical SumCheck kernels over cryptographic fields, however, are shaped not by bandwidth but by multi-limb arithmetic, Montgomery reduction, expression specialization, reduction structure, and launch overhead. We present zkDuel, an open-source benchmark that isolates SumCheck as a standalone GPU kernel through matched Triton and CUDA implementations. zkDuel pairs diagnostic microbenchmark polynomials for controlled analysis with zkPHIRE-derived constraints for prover-style stress testing, sweeps 32/64/128/256-bit prime fields, and validates both backends against a CPU reference before any performance measurement. Across 800 attempted configurations on an NVIDIA H100, 758 complete with matching Triton and CUDA checksums, and both backends reproduce the CPU reference on every reported workload and field width. On these configurations, we find that the cost of programming-model abstraction reduces with arithmetic width. CUDA holds a 3.5 × median advantage over Triton at 32 bits but only 1.4 × at 256 bits, where 30 of 171 validated configurations finish within 1.1 × of CUDA, including 19 large-table configurations on which Triton is faster. An A100 exhibits the same width-dependent convergence, from 4.4 × at 32 bits to 1.6 × at 256 bits. This convergence comes from fixed overheads being amortized as per-element arithmetic grows. In particular, host-side launch costs dominate short-running Triton kernels, while Triton’s original block-reduction implementation performs redundant modular additions across threads. Replacing that reduction with tl.reduce brings Triton’s median kernel time to within 8% of CUDA’s on both A100 and H100. Specialized point interpolation accelerates 256-bit evaluation kernels by 1.55–1.75 × on both backends. At large cryptographic field widths, a Python-embedded DSL is therefore a compelling choice for prover kernels. The remaining performance gap depends strongly on reduction and launch structure, while arithmetic specialization benefits both programming models.