Security, Zero Knowledge Proofs, Snark, Cryptography, Research.
proof for special soundness. For the extraction to work, E runs two instances of the prover, denoted as P and P*. During the simulation the extractor acts as the verifier V for the two instances and computes the witness through the following strategy: Extractor E feeds the first prover instance P