How does `d-KCA` help secure the zcash protocol?
Two points:


Bob does not know $P$ which is partly the point of the protocol.
Alice could respond with the $\alpha$-pair $(a',b') = (\beta g, \alpha\beta g)$, there is nothing wrong with that. This implies that her coefficients are $c_0=\beta, c_i=0$ for $i&gt;1$.


However, this will only do her any good if her coefficients $(c_0, \cdots, c_d)$ actually present a solution to the QAP.