I am looking at Unruh's transform (ePrint 2014/587) and in particular the definition in §2.2 for computational special soundness in sigma protocols. Let $\cal{R} \subset \cal{X} \times \cal{Y}$ be some relation, with statements $x \in \cal{X}$ and witnesses $w \in \cal{Y}$, and $\cal{L}_{\cal{R}}$ the associated language.
For fun I have been thinking about building sigma protocols that do not satisfy (the ordinary notion of) special soundness – i.e. if given, from the ether, some statement $x$ and two accepting transcripts $(com, ch, resp), (com, ch', resp')$ with $ch \neq ch'$, I can efficiently extract a witness $w$ such that $(x, w) \in \cal{R}$ – and what conditions may still be satisfied.
What is not clear to me in Unruh's definition is whether the QPT adversary $A$ (with no input, it is written $A()$ in the probability) knows a priori witness statement pairs $(x, w)$.
The reason I am unsure is because in the definitions of completeness (above) and HVZK (below), we have $(x, w) \leftarrow A()$.
Trying to resolve this issue by finding a definition of computational special soundness elsewhere led me to the book of Boneh–Shoup, which defines it in §20.9, Question 20.3. In particular it is defined as no efficient adversary $A$ being able to generate two accepting transcripts with different challenges for some $x \not\in \cal{L}_{\cal{R}}$ (NB their statements are called $y$) with non negligible probability.
The two seem quantitatively different, as Unruh's definition allows for $x \in \cal{L}_{\cal{R}}$ and refers to the existence of an extractor.
What am I missing? Thanks.
