feat: add AGR16 key-homomorphic evaluation module#60
feat: add AGR16 key-homomorphic evaluation module#60SoraSuegami wants to merge 23 commits intomainfrom
Conversation
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 74c4dd2d4d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if self.plaintext.is_none() { | ||
| panic!("Unknown plaintext for the left-hand AGR16 multiplication input"); | ||
| } |
There was a problem hiding this comment.
Remove left-plaintext panic from AGR16 multiplication
AGR16EncodingSampler::sample sets plaintext=None whenever reveal_plaintext is false, but Agr16Encoding::mul immediately panics if the left operand has None even though the multiplication formula below does not use plaintext to compute vector/pubkey/c_times_s. This makes valid private-evaluation flows crash whenever a hidden wire appears on the left side of a Mul gate, instead of producing a ciphertext with plaintext=None.
Useful? React with 👍 / 👎.
| let scalar_gadget = M::gadget_matrix(params, row_size) * &scalar; | ||
| Self { | ||
| matrix: self.matrix.mul_decompose(&scalar_gadget), |
There was a problem hiding this comment.
Fix AGR16 large-scalar multiplication shape mismatch
AGR16 samplers construct 1x1 matrices per wire (slice_columns(idx, idx + 1)), but this path builds gadget_matrix(params, row_size) and calls mul_decompose, whose contract requires self.ncol == other.nrow * modulus_digits. For AGR16, that becomes 1 == modulus_digits, which is false in normal parameter sets, so LargeScalarMul on AGR16 values can panic in debug builds (or silently compute with mismatched dimensions in release). The same pattern is repeated in Agr16Encoding::large_scalar_mul.
Useful? React with 👍 / 👎.
|
Review result: changes requested. Findings
Checks executed
No benchmark run was needed for this PR because the change introduces a new module path and does not modify existing benchmarked hot paths. |
|
Addressed the review findings in commit 6170f55. Changes:
Verification:
|
|
Review result for new commits ( Findings
Checks executed
The newly added test for empty |
|
The operations on Agr16Encoding should not depend on the secret key because its homomorphic evaluation is public operation. |
|
Follow-up addressed: Agr16Encoding homomorphic operations are now secret-independent. Included in commit 1e1c380:
Verification:
|
|
Review result for latest commits ( Findings
Checks executed
The intermittent crash may be pre-existing flakiness, but it is worth tracking because it appeared in the impacted scope check. |
|
Addressed the latest review findings in commit 5f02777. Changes:
Verification:
|
|
Review result for latest commits ( Findings
Notes on latest fixes
Checks executed
Please treat the intermittent SIGSEGV as a blocker for this PR unless we can either eliminate it or isolate it as an unrelated pre-existing issue with clear evidence and an explicit follow-up plan. |
|
Follow-up request: Please implement the recursive evaluation procedure described in the paper (for multiplication-depth extension), not just the current bounded-depth auxiliary update. Acceptance criteria for this PR:
Until recursion-based handling is implemented and depth >= 3 tests pass, this PR should remain in changes-requested state. |
|
Scope note for this PR: disk-feature test instability is out of scope for the AGR16 review-fix track. This PR focuses on the AGR16 correctness findings that were raised earlier (public-eval secret independence, nested Verification kept for this PR scope:
A separate follow-up can track intermittent |
|
Addressed the recursion/depth-extension review request from #60 (comment). Implemented changes:
Verification run:
|
|
Review result for latest commits ( Findings
However,
This means persisted keys for depth > 2 cannot be reconstructed through this API, and the file-loading path is now out of sync with the recursive design introduced in this PR. Checks executed
The new depth>=3/depth>=4 tests are substantive and aligned with the recursion request. |
|
Re-review update on latest PR head ( Result remains changes requested. Outstanding finding (unchanged):
Checks re-run in this re-review:
|
|
Addressed the review finding from #60 (comment). What changed:
Verification:
|
|
Could you add a test that evaluates a complete binary-tree multiplication circuit at depth d>=3 (e.g., d=3 or d=4) and verifies the Equation 5.1 consistency on the output? The current tests cover recursive depth, but a full binary tree stresses fan-out/fan-in composition and can catch auxiliary-level accounting bugs that do not appear on single-path chains. |
|
Re-review update on latest PR head (ce2f5d7): no new commits since the previous review comment. Result remains changes requested due to an outstanding test-coverage gap. Findings
Current AGR16 depth tests cover:
But there is still no test for a complete binary-tree multiplication circuit (fan-out/fan-in shape) at depth >= 3 with Eq. 5.1 output consistency checks. This topology stresses auxiliary-level accounting differently from single-path chains/composed cases. Notes on latest code changes
Checks executed
|
|
Addressed the test-coverage request from #60 (comment). Added a complete binary-tree multiplication topology test at depth 3:
Verification:
|
|
Review result for latest commits ( Findings
What I checked
Residual risk / gap
|
|
Added a benchmark equivalent to Changes:
Requested parameter set is used in the benchmark:
Verification:
|
|
Implemented GPU variant benchmark for the env-probe complete binary-tree AGR16 flow. Added:
Details:
Verification:
|
|
The implementation is not yet aligned with the paper specification. |
Summary
Verification