Abstract

Choosing a zero-knowledge proof system is not a single-axis decision. Groth16 still dominates high-throughput production deployments, PLONK’s universal trusted setup has become the default for teams that cannot afford per-circuit ceremonies, and HyperPlonk’s multilinear extensions are shaping where the field moves next. Each system involves concrete tradeoffs in prover time, verifier cost, setup assumptions, and constraint expressibility that vary significantly depending on the circuit workload. This post maps those tradeoffs against practical deployment scenarios.

Groth16 - Still the Throughput King

Groth16 produces the smallest proofs and the cheapest on-chain verification of any widely deployed system. A Groth16 proof is three group elements, verifiable on Ethereum for roughly 200,000 gas. That cost profile explains why protocols like Zcash, Loopring, and the older zkSync v1 design built their production stacks on it. The catch is the circuit-specific trusted setup: each new circuit requires a fresh Powers of Tau ceremony or a derived phase-two, which is operationally expensive. Teams running a fixed, stable circuit (a payment circuit, a membership proof) find this acceptable. Teams that iterate on circuit logic frequently do not. The constraint system used, Rank-1 Constraint Systems (R1CS), also tends to produce large circuits for arithmetic operations that are natural in other representations.

PLONK and the Universal Setup

PLONK introduced a universal and updatable trusted setup, meaning one ceremony can support any circuit up to a given size, and new participants can extend trust incrementally after the fact. This eliminated the per-circuit ceremony burden and opened the door to rapid circuit development. Circom and Halo2, two of the most active circuit-writing ecosystems as of early 2026, both support PLONK-family arithmetization. Aztec’s barretenberg library and the Matter Labs Boojum prover are both PLONK-derived systems deployed in production rollups. PLONK proofs are larger than Groth16 and verifier gas cost is higher, but the development velocity advantage and the ability to use custom gates for non-native operations (range checks, elliptic curve operations, SHA-256) often outweighs the overhead for teams building complex application circuits.

HyperPlonk and Multilinear Extensions

HyperPlonk, introduced in academic literature in 2022 and gaining implementation traction through 2025, replaces PLONK’s univariate polynomial commitments with multilinear ones. The main practical consequence is that prover time scales nearly linearly with circuit size rather than quasi-linearly, because the sumcheck protocol used for the multilinear IOP avoids the FFT bottleneck that dominates Groth16 and PLONK provers at large constraint counts. For circuits above roughly 2^25 constraints, the prover time savings become significant. The Lasso and Jolt lookup argument systems, which are seeing active deployment interest in early 2026, are built on multilinear commitments and inherit these properties. The tradeoff is that proof sizes and verifier costs are higher, which pushes HyperPlonk toward use cases where proving cost dominates and verification happens off-chain or in an aggregation layer.

Matching System to Workload

The practical decision tree looks roughly like this. Fixed stable circuit with high verification volume: Groth16. Circuit under active development or supporting multiple application types: PLONK-family. Very large constraint counts where prover time is the bottleneck: HyperPlonk or multilinear systems. In all cases, recursion and aggregation patterns matter: Groth16 proofs can be verified inside a PLONK circuit for aggregation, and the combination is used in some rollup designs to get cheap final verification without sacrificing prover flexibility. Benchmarking on real hardware with realistic circuit sizes remains essential before committing to a system for production.