What Is Lattice Jolt? Why a16z Crypto Is Moving zkVMs Toward Post-Quantum Cryptography

What Is Lattice Jolt? Why a16z Crypto Is Moving zkVMs Toward Post-Quantum Cryptography

Custom Image

Lattice Cryptography Brings Post-Quantum Security to zkVMs

Zero-knowledge virtual machines have become an essential infrastructure for scaling blockchains and enabling privacy-preserving computation. On September 9, 2026, a16z crypto released Lattice Jolt, an upgraded open-source version of its Jolt zkVM that replaces elliptic-curve cryptography with lattice-based cryptography. The change delivers post-quantum security while simultaneously improving prover and verifier performance by a factor of two to three and producing the shortest proofs among post-quantum zkVMs.
 
This development arrives as the broader digital infrastructure migrates toward lattice assumptions already standardized by NIST for signatures and key establishment. Lattice Jolt demonstrates that lattice-based SNARKs can outperform both prior elliptic-curve designs and existing hash-based post-quantum alternatives on key metrics of speed, size, and memory. Lattice Jolt shows that moving zkVMs to lattice cryptography simultaneously solves the quantum threat and delivers measurable performance gains that make post-quantum proofs practical for on-chain and mobile use.

Lattice Jolt Replaces Dory with the Akita Commitment Scheme

Jolt’s original architecture relied on the Dory polynomial commitment scheme, the sole component that depended on elliptic-curve cryptography. Lattice Jolt swaps Dory for Akita, a new polynomial commitment scheme grounded in the Module-SIS lattice assumption. Akita was developed under the leadership of LayerZero researchers and engineers working with teams from Carnegie Mellon University, the University of Southern California, and a16z crypto. The scheme targets a full 128 bits of security under a standard, well-studied assumption that belongs to the same family as Module-LWE. These assumptions already underwrite NIST’s ML-DSA digital signature standard and the widely deployed ML-KEM key-establishment standard.
 
Because the remainder of the Jolt stack is information-theoretically secure, replacing only the commitment layer renders the entire proving system post-quantum. Akita is released as an open-source, standalone primitive that any proof system can adopt. Its first production deployment occurs inside Jolt, which underpins LayerZero’s Zero blockchain. The integration preserves Jolt’s existing high-level architecture while changing only the cryptographic substrate, allowing developers to continue writing ordinary RISC-V programs rather than specialized circuits. This replacement is not merely defensive. Working over 128-bit fields instead of the 256-bit fields required by elliptic curves reduces the cost of the field multiplications that dominate prover work.
 
The result is both quantum resistance and concrete speed improvements. Proofs generated with Akita currently fall in the 65–80 KB range and remain under 100 KB overall, substantially smaller than the 200 KB to 600 KB proofs typical of other post-quantum zkVMs. Memory consumption also drops from roughly 300 bytes per cycle to about 200 bytes per cycle, enabling proofs of millions of RISC-V cycles on mobile devices. These metrics position Lattice Jolt as the first production-grade post-quantum zkVM that simultaneously improves rather than sacrifices performance.

Why Lattice Assumptions Align with Global Cryptographic Migration

The world’s digital infrastructure is already shifting toward lattice-based primitives. ML-KEM has become the most widely deployed post-quantum key-establishment mechanism and is used by default in major browsers, messaging applications, and a large fraction of TLS connections. ML-DSA signatures, typically a few kilobytes in size, are preferred over the larger hash-based SLH-DSA alternative for most practical deployments. Lattice Jolt places zkVMs on the same cryptographic footing. Digital signatures can be viewed as proofs of knowledge of a secret key for a specific message; SNARKs generalize that paradigm to arbitrary computation. It would be surprising if the long-term landscape for SNARKs diverged sharply from the landscape already established for signatures and encryption.
 
Hash-based SNARKs have dominated production post-quantum deployments because they appear conservative. Yet many practical systems rely on algebraic hash functions such as Poseidon, whose cryptanalysis is less mature than that of standard hash functions. Some also depend on conjectured proximity-gap bounds that have later been shown false, or they target security levels below 128 bits to avoid performance penalties. Lattice Jolt’s soundness error scales with the logarithm of the statement size rather than linearly, preserving nearly the full 128-bit security even over a 128-bit field. The combination of standardized assumptions, smaller proofs, and higher speed makes lattices a natural next step for high-performance zkVMs rather than a niche alternative.

Performance Gains from Smaller Fields and Codebase Rewrite

Elliptic-curve constraints forced Jolt to operate over 256-bit fields. Lattice cryptography achieves equivalent security over 128-bit fields, and the prover’s dominant cost is multiplication of field elements. Halving the bit length of those elements produces a several-fold reduction in arithmetic cost. Curve-based Jolt had already reached more than one million RV64IMAC cycles per second on a laptop CPU after successive optimizations. Lattice Jolt exceeds two million cycles per second on the same hardware. A complete rewrite of the Jolt codebase accompanied the cryptographic change. The rewrite simplifies GPU implementations and yields an Apple Metal backend that pushes performance above ten million cycles per second on a MacBook.
 
Even the curve-based version now reaches approximately four million cycles per second with Metal acceleration. In a single release, the system moved from roughly one million cycles per second (CPU-only, curve-based) to more than ten million (lattice-based with GPU). Prover overhead relative to native execution has fallen to approximately 10,000×, a dramatic improvement over the millions-fold overheads common only a few years earlier. Clear engineering and protocol optimizations remain available, indicating further gains are expected.

Compact Proofs Reduce On-Chain and Network Costs

The size of proofs is equally as important as the speed of the prover, primarily because these proofs need to be posted on-chain and transmitted across various networks. The proofs generated by Lattice Jolt are impressively compact, measuring under 100 KB, with most typically falling within the range of 65 KB to 80 KB. In contrast, competing post-quantum zkVMs produce proofs that can range from over 200 KB to approximately 600 KB or even larger. This significant size reduction, which can be anywhere from two to eight times smaller depending on the specific application, directly contributes to lowering both verification costs and the bandwidth requirements necessary for transmission.
 
Moreover, smaller proofs facilitate easier recursive composition and the construction of light clients. The Akita system employs a sub-linear memory model that goes beyond merely storing the polynomial itself, allowing the system to effectively scale to accommodate very large program sizes without the need for mandatory recursive wrapping. The combination of these compact proofs and a reduced memory footprint renders Lattice Jolt not only practical but also highly efficient for both high-throughput GPU provers that are capable of handling billions of cycles and for resource-constrained devices that are tasked with proving millions of cycles. This efficiency is crucial in expanding the usability and accessibility of zkVM technology across a variety of applications and devices.

Memory Efficiency Enables Mobile and Edge Proving

Previous iterations of Jolt have consistently been recognized as some of the most memory-efficient zkVMs available in the market. With the recent transition to lattice-based structures, there has been a significant reduction in space utilization, decreasing from approximately 300 bytes per cycle down to an impressive 200 bytes per cycle. This notable enhancement implies that even a standard mobile phone is now capable of generating cryptographic proofs for millions of RISC-V cycles, which is a remarkable feat. This expanded capability broadens the spectrum of devices that can engage in verifiable computation, effectively lowering the barriers for privacy-preserving applications that are required to operate in proximity to the user.
 
The reduction in memory pressure not only simplifies the process of concurrent proving but also diminishes the hardware requirements necessary for large-scale prover fleets. As a result, developers are now able to deploy the same zkVM across a much wider array of environments without the need to rewrite existing applications or compromise on performance through severe trade-offs. This flexibility is crucial for fostering innovation and ensuring that a diverse range of devices can participate in the growing space of verifiable computation.

Integration with LayerZero’s Zero Blockchain

Lattice Jolt’s inaugural and significant production deployment takes place within the Jolt system, which serves as the foundational framework for LayerZero’s innovative Zero blockchain. This strategic partnership guarantees that the highly anticipated post-quantum upgrade will be accessible from the very first day of the newly established commitment scheme. As a result, Zero is positioned to provide quantum-resistant proofs, all while reaping the benefits of the associated enhancements in both speed and size.
 
Given that Akita is thoughtfully designed as a modular primitive, the same security and performance improvements can subsequently be adopted by other proof systems that opt to integrate the lattice commitment layer into their architectures. This deployment serves as a compelling demonstration that lattice-based SNARKs are indeed prepared for real-world blockchain workloads, rather than merely existing as theoretical constructs within academic circles. The ongoing testing and evaluation on the Zero blockchain yield concrete and actionable feedback, which will play a crucial role in guiding further refinements and enhancements of both the Akita framework and the broader Jolt architecture that supports it.

Soundness Properties Favor Lattice Constructions over Certain Hash-Based Designs

Hash-based SNARKs are known to frequently encounter soundness errors that tend to scale linearly with the size of the statement being processed. In practical terms, when working within a 128-bit field, attempting to prove a computation that involves a billion steps can result in a loss of approximately 30 bits of security, which is significant. In contrast, Lattice Jolt’s soundness error exhibits a much more favorable scaling behavior, as it only scales logarithmically with the size of the statement. This characteristic allows it to preserve nearly the entire 128-bit security target, which is crucial for maintaining robust security standards. Standard techniques are available that can effectively restore any residual logarithmic loss that may occur.
 
This distinction is particularly important for applications that demand strong and quantifiable security guarantees. Such applications should not be forced to rely on much larger fields or the implementation of additional recursive layers, which can complicate the design and deployment of cryptographic systems. The transparent setup of Akita plays a vital role in further eliminating the need for trusted ceremonies, which are still a requirement for some alternative systems. This transparency enhances the overall trustworthiness and usability of the system, making it more appealing for developers and users alike.

Results for SNARK Design Philosophy

a16z crypto has consistently maintained that Jolt should not be confined to a singular cryptographic foundation. There are mature and high-performing implementations that utilize elliptic curves, hashes, and lattices, each of which caters to different threat models and possesses distinct performance profiles. Lattice Jolt fulfills that overarching vision by providing a high-performance lattice option that is already competitive across every significant axis of evaluation.
 
If we consider the direction of digital signatures as a guiding principle, it is likely that lattice-based SNARKs will emerge as the predominant choice for post-quantum applications in most practical deployments. The simultaneous advancements in speed, size, and security effectively eliminate the historical performance penalties that have previously discouraged the adoption of lattice-based solutions in production systems.

Practical Benefits for Blockchain Scalability and Privacy

Faster proving reduces the cost of generating validity proofs for rollups, bridges, and other scaling solutions. Smaller proofs lower the gas cost of on-chain verification and the bandwidth cost of propagating proofs across peer-to-peer networks. The combination makes it economical to prove larger computations more frequently.
 
Privacy applications will benefit once the forthcoming companion paper adds native zero-knowledge support to Lattice Jolt. Earlier work on Jolt already demonstrated that zero-knowledge can be added with only a few kilobytes of proof-size overhead and essentially no increase in prover time. Extending that property to the lattice setting will enable private computation under post-quantum assumptions without the expensive wrapping procedures required by many other systems.

Remaining Engineering and Research Opportunities

While Lattice Jolt has already made significant strides in enhancing its performance compared to its predecessor across a variety of important metrics, the teams involved in its development have observed that there are still numerous opportunities for further protocol and implementation optimizations that can be pursued. Ongoing efforts focused on GPU backends, particularly those that extend beyond the capabilities of Apple Metal, as well as additional improvements in field-arithmetic techniques, and a more integrated approach with recursive proof systems, represent logical and promising next steps in this journey.
 
The recent open-source release of both Jolt and Akita not only showcases the commitment to transparency and collaboration but also actively invites contributions from external developers and researchers, which can significantly accelerate the pace of these improvements. In addition, a separate technical paper that will delve into the integration of zero-knowledge capabilities into Lattice Jolt is anticipated to be released in the near future. This forthcoming work is expected to complete the comprehensive set of properties that are essential for enabling the broadest range of applications that prioritize privacy preservation and scalability in their design and implementation.

Industry Context and Competitive Space

Currently, the majority of production post-quantum SNARKs are still primarily based on hash functions. However, Lattice Jolt stands out as the pioneering system that successfully demonstrates the capability of a lattice commitment layer to provide both robust quantum resistance and exceptional concrete performance within the framework of a fully featured zkVM. This groundbreaking achievement challenges the widely held assumption that achieving post-quantum security necessarily entails incurring a significant performance penalty.
 
Recent benchmarks reveal that Lattice Jolt can achieve more than two million cycles per second when running on a CPU, and it surpasses ten million cycles per second with the aid of Metal acceleration. These impressive performance metrics position Lattice Jolt ahead of earlier versions that relied on curve-based approaches, making it competitive with, or even superior to, other post-quantum alternatives in terms of proof size and memory efficiency. Such remarkable figures establish a new and valuable reference point for assessing and evaluating the designs of future zkVM systems.

The Future of Post-Quantum Verifiable Computation

As quantum-capable adversaries increasingly emerge as a significant and realistic concern in the space of cybersecurity, it becomes evident that systems that are already designed to operate under standardized lattice assumptions will necessitate fewer disruptive migrations to adapt to these growing threats. Lattice Jolt strategically positions both Jolt and the various applications that are built upon it to actively participate in this critical transition towards enhanced security without sacrificing the substantial performance gains that have been meticulously accumulated over the past two years of dedicated development.
 
The remarkable ability to prove ordinary RISC-V programs under post-quantum assumptions, at impressive speeds that effectively support both large-scale GPU provers and mobile devices, significantly expands the practical reach and applicability of verifiable computation. This advancement allows developers to concentrate their efforts on application logic and functionality rather than getting bogged down in the complexities of cryptographic engineering. At the same time, infrastructure providers benefit from a clearer and more defined path towards achieving quantum-resistant security, which is increasingly vital in today’s technological ecosystem.

🔥 Beyond the Headlines: What KuCoin 5.0 Means for You

Market news moves fast — but where you act on it matters just as much. This October, KuCoin launches KuCoin 5.0, transforming KuCoin into a rebuilt platform. Here's what actually changes for you:
  • One account for everything. Older platforms split your money across separate "spot," "margin," and "futures" accounts and expected you to understand why. KuCoin 5.0's unified account removes that entirely — deposit once, and everything is simply there.
  • Stocks, indices, and commodities. KuCoin 5.0 expands beyond crypto into global markets. When crypto chops sideways and equities rally (or the reverse), you rotate in minutes instead of opening a brokerage account and waiting days for fiat rails.
  • Real-world assets (RWA). Tokenized exposure to traditional assets like commodities, right inside your crypto account. One of the fastest-growing segments in global finance is no longer reserved for institutions — you access it from the same balance you trade with.
  • Earn while you learn. Not ready to trade? KCUSD lets your stablecoins earn daily, auto-compounding interest. The lowest-stress way to put your idle deposit to work for 4% yield.
  • An AI assistant in plain language. Ask questions, get market context, understand what you're looking at — built into the platform, no jargon required.
  • An app that doesn't overwhelm. Faster, cleaner, and consistent — intuitive from the first tap, not after a tutorial.
  • Safety you can check, not just trust. A MiCAR-licensed EU entity, Proof of Reserves you can verify yourself, and internationally certified security (SOC 2 Type II, ISO 27001:2022).
 
Create your account in minutes — and start on the platform built for where crypto is going, not where it's been.

FAQs

What exactly is Lattice Jolt?

Lattice Jolt is the September 2026 release of a16z crypto’s open-source Jolt zkVM in which the elliptic-curve polynomial commitment scheme Dory has been replaced by the lattice-based scheme Akita. The high-level architecture that made Jolt simple and fast remains unchanged; only the cryptographic foundation is updated. The result is a system that is simultaneously post-quantum secure, two to three times faster, and capable of producing proofs under 100 KB.
 

How does Akita provide post-quantum security?

Akita relies on the Module-SIS lattice assumption, which is believed to remain hard even for quantum computers. This assumption belongs to the same family already standardized by NIST for ML-DSA signatures and ML-KEM key establishment. Because the rest of the Jolt proving stack is information-theoretically secure, securing the commitment layer is sufficient to make the entire system post-quantum.
 

By how much does Lattice Jolt improve proving speed?

On a laptop CPU, Lattice Jolt exceeds two million RV64IMAC cycles per second, roughly double or triple the performance of the prior curve-based version. With Apple Metal GPU acceleration, the same machine exceeds ten million cycles per second. The primary source of the speedup is the move from 256-bit to 128-bit fields, which makes the dominant field multiplications substantially cheaper.
 

How small are the proofs produced by Lattice Jolt?

Proofs measure under 100 KB and typically fall in the 65–80 KB range. Competing post-quantum zkVMs generally produce proofs between 200 KB and 600 KB. The reduction lowers on-chain verification costs and network bandwidth requirements.
 

Does Lattice Jolt support zero knowledge?

A companion paper that adds native zero-knowledge support is expected shortly. Prior work on curve-based Jolt demonstrated that zero-knowledge can be achieved with only a few kilobytes of additional proof size and negligible prover-time overhead. The same techniques are being extended to the lattice setting.
 

Why prefer lattices over hash-based post-quantum SNARKs?

Lattice constructions can produce smaller proofs, achieve higher concrete speed, and operate under assumptions already widely deployed for signatures and encryption. Many practical hash-based systems rely on less mature algebraic hash functions or target security levels below 128 bits. Lattice Jolt’s logarithmic soundness-error scaling preserves nearly full 128-bit security over a 128-bit field.
 
Disclaimer: This content is for informational purposes only and does not constitute investment advice. Cryptocurrency investments carry risk. Please do your own research (DYOR).