Strong Batching for Non-interactive Statistical Zero-Knowledge

A zero-knowledge proof enables a prover to convince a verifier that x is an element of S, without revealing anything beyond this fact. By running a zero-knowledge proof k times, it is possible to prove (still in zero-knowledge) that k separate instances x(1),..., x(k) are all in S. However, this increases the communication by a factor of k. Can one do better? In other words, is (non-trivial) zero-knowledge batch verification for S possible? Recent works by Kaslasi et al. (TCC 2020, Eurocrypt 2021) show that any problem possessing a non-interactive statistical zero-knowledge proof (NISZK) has a non-trivial statistical zero-knowledge batch verification protocol. Their results had two major limitations: (1) to batch verify k inputs of size n each, the communication in their batch protocol is roughly poly(n, log k) + O(k), which is better than the naive cost of k.poly(n) but still scales linearly with k, and, (2) the batch protocol requires O(k) rounds of interaction. In this work we remove both of these limitations by showing that any problem in NISZK has a non-interactive statistical zero-knowledge batch verification protocol with communication poly(n, log k).