Model. We work in the Algebraic Group Model (Fuchsbauer–Kiltz–Loss, CRYPTO 2018). An algebraic adversary that produces a group element Y must also output an explicit representation expressing Y as a known linear combination of the group elements it has previously received. In our setting the inputs are the CRS group elements, so every (A, B, C) an AGM adversary outputs comes with coefficients over the CRS — the representation is the witness candidate.
Strategy. Substitute the adversary's algebraic representations into the verifier pairing equation and pass to discrete logs. The resulting identity is a polynomial equation in the trapdoor indeterminates that evaluates to zero at the random trapdoor sampled by Setup. Under the q-DLOG assumption (which Groth16's CRS already demands), a polynomial of bounded degree that vanishes at a uniform random point must be identically zero; otherwise the adversary could solve q-DLOG. So the polynomial is the zero polynomial — every monomial's coefficient vanishes. The walkthrough then peels off monomials one by one, each forcing another constraint on the representation, until the constraints collectively exhibit a valid QAP witness.
Extractor. The extractor is purely algebraic: it reads the coefficients Cℓ+1, …, Cm off the adversary's own representation of C and returns (aℓ+1, …, am). No rewinding, no programmable random oracle — the AGM hands us the witness directly once the 11 coefficient equalities pin down the shape of A, B, C.
Omissions. The ZK randomizers r, s honest provers add to A, B do not appear here: an algebraic adversary can set its representation coefficients however it likes, and any r, s contribution is already absorbed into the generic Aδ, Bδ terms.