Verification of Pinocchio (verifiable computation) I am reading the Pinocchio paper. The calculated result $y$ is a part of the verification input, but it seems to me, the verification procedure does not utilize the result $y$. Can anyone can help me to understand this?
$y$ is the values of the output wires, so it is used to compute $g_v^{v_{io}(s)}$, $g_w^{w_{io}(s)}$, and $g_y^{y_{io}(s)}$. (Remember that $c_k$ is the value of the wire with index $k$.)