papers/lp-203-gpu-native-verify/sections/05-projections.tex

\section{Projections (Tagged ``Projected, Not Measured'')}
\label{sec:projections}

Every entry in this section is a projection from the on-disk
kernels plus the measured primitive throughput from
\S\ref{sec:measured}. \textbf{Nothing in this section is a
measurement.} Each table is explicitly tagged so downstream LPs
do not promote a projection to a measurement by accident.

\subsection{Composite verify, projected from measured primitives}

The composite signature-verify wrappers (Ed25519, sr25519,
ML-DSA, SLH-DSA) compose primitives that ARE measured on the
GB10 bench: NTT (via the lattice GPU kernels once
\texttt{lux-lattice.pc} ships), keccak256, sha3\_256, blake3,
and the Magnetar SLH-DSA 4 primitives. The arithmetic cost of
each wrapper is the sum of its primitive costs plus a single
launch-overhead amortized over the batch.

\begin{table}[h]
\centering
\small
\begin{tabular}{@{}p{3.6cm}rrp{4.5cm}@{}}
\toprule
\textbf{Operation (\emph{projected, not measured})}
  & \textbf{Batch} & \textbf{Per-op}
  & \textbf{Composition} \\
\midrule
ML-DSA verify (FIPS 204) & $N{=}64$
  & \SI{50}{\micro\second}--\SI{80}{\micro\second}
  & NTT GPU + finalizer GPU + 1 launch \\
SLH-DSA verify (FIPS 205, 192f)
  & $N{=}64$ & $\sim$\SI{2}{\milli\second}
  & \texttt{hmsg\_prfmsg} + \texttt{fors\_subtree} +
    \texttt{wotsplus\_chain} + \texttt{xmss\_subtree} \\
SLH-DSA verify (FIPS 205, 192s)
  & $N{=}64$ & $\sim$\SI{45}{\milli\second}
  & same 4 primitives, larger subtree count \\
Ed25519 verify & $N{=}256$ & \SI{2}{\micro\second}--\SI{4}{\micro\second}
  & coalesced curve op + hash; same launch \\
sr25519 verify & $N{=}256$ & \SI{2.5}{\micro\second}--\SI{5}{\micro\second}
  & Ristretto curve op + hash; same launch \\
Pulsar verify (composite) & $N{=}64$
  & \SI{50}{\micro\second}--\SI{100}{\micro\second}
  & FIPS 204 verify on aggregator (one per cert) \\
\bottomrule
\end{tabular}
\caption{\textbf{Projected} composite-verify costs from
measured primitive costs. Each cell is a derivation from
\S\ref{sec:measured} plus the LP markdown's kernel parallelism
strategy; nothing here is a measurement. Once the composite
wrappers ship (\S\ref{sec:gaps}), these cells become measurable
on the same GB10 bench.}
\label{tab:projections}
\end{table}

\paragraph{Magnetar parameter-set caveat.} The two SLH-DSA-192
parameter sets have radically different per-op costs:

\begin{itemize}[leftmargin=2em,nosep]
\item \emph{192s} (small, \SI{16}{KB} sigs) projects to
  $\sim$\SI{45}{\milli\second} per verify at $N{=}64$ on GB10 --
  acceptable only for batched non-hot-path uses.
\item \emph{192f} (fast, \SI{35}{KB} sigs) projects to
  $\sim$\SI{2}{\milli\second} per verify at $N{=}64$ on GB10 --
  acceptable for the consensus hot path.
\end{itemize}

LP-217 \cite{lp217} locked 192f as the production parameter
set for PQ-heavy. The projection above respects that lock.

\subsection{End-to-end block finality, projected}

\begin{table}[h]
\centering
\small
\begin{tabular}{@{}p{4.2cm}p{2.4cm}p{3cm}p{3cm}@{}}
\toprule
\textbf{Pipeline stage (\emph{projected})}
  & \textbf{CPU only} & \textbf{GB10 sm\_120}
  & \textbf{H100 (rooflined)} \\
\midrule
NIC ingest (kernel socket) & $\sim$\SI{50}{\micro\second}
  & $\sim$\SI{50}{\micro\second} & --- \\
NIC ingest (DPDK) & --- & $\sim$\SI{5}{\micro\second}
  & $\sim$\SI{5}{\micro\second} \\
NIC ingest (GPUDirect RDMA) & ---
  & $\sim$\SI{1}{\micro\second} & $\sim$\SI{1}{\micro\second} \\
Scheme dispatch (CPU) & \SI{50}{\nano\second}/tx
  & \SI{50}{\nano\second}/tx & \SI{50}{\nano\second}/tx \\
1000 BLS verifies (batched)
  & \SI{1.2}{\second}--\SI{1.5}{\second}
  & $\sim$\SI{20}{\milli\second}
  & \SI{8}{\milli\second}--\SI{15}{\milli\second} \\
Corona aggregate, 64 vals
  & $\sim$\SI{350}{\milli\second}
  & $\sim$\SI{50}{\milli\second}
  & \SI{15}{\milli\second}--\SI{30}{\milli\second} \\
Merkle root (\SI{100}{kilo} leaves)
  & $\sim$\SI{80}{\milli\second}
  & \SI{8}{\milli\second}--\SI{10}{\milli\second}
  & \SI{0.8}{\milli\second}--\SI{2}{\milli\second} \\
ZapDB commit & \SI{3}{\milli\second}
  & \SI{3}{\milli\second} & \SI{3}{\milli\second} \\
\midrule
\textbf{End-to-end (1000-tx)}
  & \SI{1.5}{\second}--\SI{1.8}{\second}
  & \SI{100}{\milli\second}--\SI{150}{\milli\second}
  & \SI{30}{\milli\second}--\SI{60}{\milli\second} \\
\bottomrule
\end{tabular}
\caption{\textbf{Projected} end-to-end pipeline cost for a
1000-transaction block. CPU column is the pre-Quasar Edition
baseline. GB10 column derives from \S\ref{sec:measured} plus
the kernel parallelism strategy. H100 column rooflines from
the GB10 measurement, not from FP64 peak FLOPS -- the prior
arithmetic-intensity projection (\SI{0.5}{\micro\second} per
BLS verify on H100) was $\sim 40\times$ optimistic against
measured GB10 silicon.}
\label{tab:e2e-projected}
\end{table}

\paragraph{Note on H100 figures.} The H100 column is intentionally
\emph{not} re-derived from the H100 FP64 roofline. The GB10
measurement (\SI{19}{\micro\second} per BLS pair on sm\_120)
disproved the FP64-roofline approach -- real Miller-loop cost on
silicon is dominated by non-FP64 op cost (point addition,
doubling, line evaluation) that does not scale with peak FP64
throughput. The H100 column above rooflines from the GB10
measurement scaled by H100's tensor-core-adjacent paths
(estimated $2\times$--$3\times$ on the Miller loop), not from
peak FLOPS.

\subsection{PQ-strict end-to-end on GPU, projected}

The PQ-strict cert mode requires Pulsar plus Corona in the cert.
LP-217 measured PQ-strict at $N{=}64$ on Spark CPU at
\SI{595}{\milli\second}. The GPU-dispatch projection composes
the four primitive kernels:

\begin{table}[h]
\centering
\small
\begin{tabular}{@{}lr@{}}
\toprule
\textbf{Phase (\emph{projected, not measured})}
  & \textbf{GB10 sm\_120 time} \\
\midrule
Pulsar Round 1 (per validator, parallel) &
  $\sim$\SI{1}{\milli\second} \\
Pulsar aggregate (CPU; reconstruct sk; one FIPS 204 sign) &
  $\sim$\SI{200}{\micro\second}--\SI{1}{\milli\second} \\
Corona Round 1 (per validator, parallel via NTT GPU) &
  $\sim$\SI{2}{\milli\second}--\SI{5}{\milli\second} \\
Corona Round 2 (per validator) & $\sim$\SI{2}{\milli\second}--\SI{5}{\milli\second} \\
Corona aggregate (collector) & $\sim$\SI{5}{\milli\second}--\SI{15}{\milli\second} \\
BLS aggregate verify (fast-path leg) & $\sim$\SI{1}{\milli\second}--\SI{2}{\milli\second} \\
\midrule
\textbf{PQ-strict wall-clock @ $N{=}64$}
  & $\sim$\SI{15}{\milli\second}--\SI{30}{\milli\second} \\
\bottomrule
\end{tabular}
\caption{\textbf{Projected} PQ-strict end-to-end on GB10 with
the composite-verify wrappers landed. Compare to LP-217's
measured CPU wall-clock of \SI{595}{\milli\second} at $N{=}64$
on Spark. The projection delivers a $\sim 20\times$--$\sim 40\times$
wall-clock improvement once GPU dispatch is live.}
\label{tab:pqstrict-projected}
\end{table}

\paragraph{Why this is a projection.} The matrix bench
\cite{matrixbench} measured CPU-only wall-clock; the GPU was
idle at \SI{11.9}{\percent} mean SM\%. The above numbers
assume the composite-verify wrappers ship and the matrix bench
re-runs with active GPU dispatch.

\subsection{The contract for downstream LPs}

LPs depending on LP-203 numbers should follow the rule:

\begin{enumerate}[leftmargin=2em,nosep]
\item \textbf{Use the measured GB10 numbers}
  (\S\ref{sec:measured}) wherever the operation is in the
  measured set: BLS12-381 EIP-2537 pairing, keccak256,
  sha3\_256, Corona combine.
\item \textbf{Tag projections explicitly} for any operation
  in this section's tables.
\item \textbf{Do not re-derive from FP64 roofline.} The
  GB10 measurement showed that Miller-loop silicon cost
  dominates FP64 arithmetic-intensity projections by
  $\sim 40\times$.
\item \textbf{Quote the gap.} If the LP cites a GPU number
  for ML-DSA or SLH-DSA verify, the LP should cite the
  measurement when it lands and mark the current cell
  ``projected, not measured.''
\end{enumerate}