Proof of Zero Knowledge Groth16

Question

I understand that in the non-interactive linear form (page 15 of Groth16: https://eprint.iacr.org/2016/260.pdf), given $A$ and $B$ in the proof $(A,B,C)$, the simulator can compute the $C$ by: $C =\frac{AB-\alpha\beta-D}{\delta} $ where $D = \sum^{l}_{i=0} {a_i(\beta u_i(x) + \alpha v_i(x) + w_i(x))} $.

However, I don't get how the simulator would work when the scheme is compiled to SNARK.Here, when all keys are raised to power form, we have: $e(A,B) = e(C, g^\delta) e(g^\alpha, g^\beta) e(D, g)$. I see that $e(C, g^\delta) = e(A,B)/(e(g^\alpha, g^\beta) e(D, g))$, but how could the simulator extract the $G_1$ element $C$ from the $G_t$ element $e(C, g^\delta)$?

Answer 1

The simulator would not generate random elements of $\mathbb G_T$, but would as before generate uniform random values $A,B\in\mathbb Z/p\mathbb Z$ and compute $C$ per your equation. They would then SNARK-ify these numbers by $[A]=g^A\in\mathbb G_1$, $[B]=h^B\in\mathbb G_2$ and $[C]=g^C\in\mathbb G_1$ per the bottom of page 6 (note that these SNARK-ified elements are all uniformly distributed in their respective groups).

The equation $e([A],[B])=e([C],h^\delta) e(g^\alpha,h^\beta)e(g,h)^D$ would then automatically be true by the bilinearity property of $e$.