desilo / liberate-fhe Goto Github PK

Key switching renders the following additions unstable. Improve stability, and remove reduce_error in sum/mean utility functions.

For example, the following code snippet breaks the cipher text ca.

sk = engine.create_secret_key()
pk = engine.create_public_key(sk)
evk = engine.create_evk(sk)
gk = engine.create_galois_key(sk)

a = engine.example(0, 10)

ca = engine.encorypt(a, pk)

print("Encorypted")

total_it = 10
rot = 1

# Rotate test.
for i in range(total_it):
    ca = engine.galois_rotate(ca, gk, rot)
    a = np.roll(a, rot)
    err = np.abs(engine.absmax_error(a, engine.decrode(ca, sk, final_round=True)))
    print(f"{i}: {err}")


print('\n-------------------\n')

total_it = 40

# ca = engine.reduce_error(ca)
for i in range(total_it):
    ca = engine.add(ca, ca)
    a = a + a
    err = np.abs(engine.absmax_error(a, engine.decrode(ca, sk, final_round=True)).real)
    print(f"{i}: {err}")

Liberate.FHE

• set fhe
• set csprng
• set ntt
• set cuda build
• examples
• readme
• LICENSE

In src/liberate/ntt/rns_partition.py, from line 46 to 50, is wrong and never used.

• Removed dead code
• Rationalized CSPRNG APIs.

Albeit decrypt and decode uses the by-the-book approach in recovering the message by using only the base channel, the fused version decrode does bias-guarding when an extra channel is available. However, the bias-guard only fixes the overflow of the first (DC) overflow. The bias guard consumes one level. That results in confinement of the recovered message into $-2^{60} < . < 2^{60}$ range. However, in the presence of yet another level (consuming one more level) after all the homomorphic operations, we can use 2 channels to recover the message and overcome the range limit.

If the base channel was denoted as b, and the extra channel e, we can convert the RNS representation $(e, b)$ to a Mixed Radix System (MRS) $(e', b)$, and then apply decrypt/decode (also may apply bias-guard) to each channel. Then sum them by $m = m_e * q_b +m_ b$, where m_e is the recovered message from $e'$, $m_{b}$ is from $b$, and $q_{b}$ is the base channel prime.

Additional computational cost will be minimal, since the MRS conversion is for only 2 channels. Also, it should be selectively performed according to the number of channels remaining after evaluating the homomorphic circuit, whatever that is.

Remove lines 52--56. Bias guarding has nothing to do with the number of special primes.

https://github.com/Desilo/liberate-fhe/blob/main/src/liberate/fhe/ckks_engine.py

The length specifies the new length of the target state, i.e., a different polynomial length. That will result in striding of the state tensor and make the contiguous test fail. The length parameter is never used anyway.

There is currently a CPU based implementation, but its speed is not optimal to say the least.

Probably, use the threadpool at https://github.com/juwhankim/another_cpp_thread, and make an equivalent to CUDA-like implementation?

cov doesn't need rescale_every as an input parameter.