GASP Codes for Secure Distributed Matrix Multiplication

TL;DR

This paper introduces GASP Codes, a new class of polynomial codes for secure distributed matrix multiplication, which outperform previous codes in download efficiency by leveraging combinatorial structures called degree tables.

Contribution

The paper develops GASP Codes based on arithmetic progressions and degree tables, providing a novel approach that improves download rate in secure distributed matrix multiplication.

Findings

GASP Codes outperform previous polynomial codes in download rate.

GASP Codes are based on arithmetic progressions and degree tables.

The codes enhance efficiency in secure distributed matrix multiplication.

Abstract

We consider the problem of secure distributed matrix multiplication (SDMM) in which a user wishes to compute the product of two matrices with the assistance of honest but curious servers. We construct polynomial codes for SDMM by studying a combinatorial problem on a special type of addition table, which we call the degree table. The codes are based on arithmetic progressions, and are thus named GASP (Gap Additive Secure Polynomial) Codes. GASP Codes are shown to outperform all previously known polynomial codes for secure distributed matrix multiplication in terms of download rate.

Figures

Tables

Table 1. TABLE I : The download rate of GASP codes.

Download Rate	Regions
$\frac{KL}{KL+K+L}$
$\frac{KL}{KL+K+L+T^2+T-3}$
$\frac{KL}{\left(K+T\right)\left(L+1\right)-1}$
$\frac{KL}{2KL+2T-1}$	$L\le K\le T$

	${\beta }_1$	${\beta }_2$	${\beta }_3$	${\beta }_4$	${\beta }_5$
${\alpha }_1$	${\alpha }_1+{\beta }_1$	${\alpha }_1+{\beta }_2$	${\alpha }_1+{\beta }_3$	${\alpha }_1$ + ${\beta }_4$	${\alpha }_1$ + ${\beta }_5$
${\alpha }_2$	${\alpha }_2+{\beta }_1$	${\alpha }_2+{\beta }_2$	${\alpha }_2+{\beta }_3$	${\alpha }_2$ + ${\beta }_4$	${\alpha }_2$ + ${\beta }_5$
${\alpha }_3$	${\alpha }_3+{\beta }_1$	${\alpha }_3+{\beta }_2$	${\alpha }_3+{\beta }_3$	${\alpha }_3$ + ${\beta }_4$	${\alpha }_3$ + ${\beta }_5$
${\alpha }_4$	${\alpha }_4+{\beta }_1$	${\alpha }_4+{\beta }_2$	${\alpha }_4+{\beta }_3$	${\alpha }_4$ + ${\beta }_4$	${\alpha }_4$ + ${\beta }_5$
${\alpha }_5$	${\alpha }_5+{\beta }_1$	${\alpha }_5+{\beta }_2$	${\alpha }_5+{\beta }_3$	${\alpha }_5$ + ${\beta }_4$	${\alpha }_5$ + ${\beta }_5$

	${\beta }_1=0$	${\beta }_2=3$	${\beta }_3=6$	${\beta }_4=9$	${\beta }_5=10$
${\alpha }_1=0$	$0$	$3$	$6$	$9$	$10$
${\alpha }_2=1$	$1$	$4$	$7$	$10$	$11$
${\alpha }_3=2$	$2$	$5$	$8$	$11$	$12$
${\alpha }_4=9$	$9$	$12$	$15$	$18$	$19$
${\alpha }_5=12$	$12$	$15$	$18$	$21$	$22$

Table 4. TABLE II : The combinatorial problem of constructing α 𝛼 \alpha and β 𝛽 \beta so that α ⊕ β direct-sum 𝛼 𝛽 \alpha\oplus\beta is decodable and T 𝑇 T -secure.

	${\beta }_1$	$\cdots$	${\beta }_L$	${\beta }_{L+1}$	$\cdots$	${\beta }_{L+T}$
${\alpha }_1$	${\alpha }_1+{\beta }_1$	$\cdots$	${\alpha }_1+{\beta }_L$	${\alpha }_1+{\beta }_{L+1}$	$\cdots$	${\alpha }_1+{\beta }_{L+T}$
$⋮$	$⋮$	$\ddots$	$⋮$	$⋮$	$\ddots$	$⋮$
${\alpha }_K$	${\alpha }_K+{\beta }_1$	$\cdots$	${\alpha }_K+{\beta }_L$	${\alpha }_K+{\beta }_{L+1}$	$\cdots$	${\alpha }_K+{\beta }_{L+T}$
${\alpha }_{K+1}$	${\alpha }_{K+1}+{\beta }_1$	$\cdots$	${\alpha }_{K+1}+{\beta }_L$	${\alpha }_{K+1}+{\beta }_{L+1}$	$\cdots$	${\alpha }_{K+1}+{\beta }_{L+T}$
$⋮$	$⋮$	$\ddots$	$⋮$	$⋮$	$\ddots$	$⋮$
${\alpha }_{K+T}$	${\alpha }_{K+T}+{\beta }_1$	$\cdots$	${\alpha }_{K+T}+{\beta }_L$	${\alpha }_{K+T}+{\beta }_{L+1}$	$\cdots$	${\alpha }_{K+T}+{\beta }_{L+T}$

Table 5. TABLE III : The degree table, α ⊕ β direct-sum 𝛼 𝛽 \alpha\oplus\beta , for the vectors α 𝛼 \alpha and β 𝛽 \beta as per ( 6 ).

	${\beta }_1=0$	$\cdots$	${\beta }_L=K\left(L-1\right)$	${\beta }_{L+1}=KL$	${\beta }_{L+2}=KL+1$	$\cdots$	${\beta }_{L+T}=KL+T-1$
${\alpha }_1=0$	$0$	$\cdots$	$K\left(L-1\right)$	$KL$	$KL+1$	$\cdots$	$KL+T-1$
$⋮$	$⋮$	$\ddots$	$⋮$	$⋮$	$⋮$	$\ddots$	$⋮$
${\alpha }_K=K-1$	$K-1$	$\cdots$	$KL-1$	$KL+K-1$	$KL+K$	$\cdots$	$KL+K+T-2$
${\alpha }_{K+1}=KL$	$KL$	$\cdots$	$2KL-K$	$2KL$	$2KL+1$	$\cdots$	$2KL+T-1$
${\alpha }_{K+2}=KL+1$	$KL+1$	$\cdots$	$2KL-K+1$	$2KL+1$	$2KL+2$	$\cdots$	$2KL+T$
$⋮$	$⋮$	$\ddots$	$⋮$	$⋮$	$⋮$	$\ddots$	$⋮$
${\alpha }_{K+T}=KL+T-1$	$KL+T-1$	$\cdots$	$2KL-K+T-1$	$2KL+T-1$	$2KL+T$	$\cdots$	$2KL+2T-2$

Table 6. TABLE IV : The degree table, α ⊕ β direct-sum 𝛼 𝛽 \alpha\oplus\beta , of the vectors α 𝛼 \alpha and β 𝛽 \beta as per Definition 8 .

	${\beta }_1=0$	$\cdots$	${\beta }_L=K\left(L-1\right)$	${\beta }_{L+1}=KL$	${\beta }_{L+2}=KL+1$	$\cdots$	${\beta }_{L+T}=KL+T-1$
${\alpha }_1=0$	$0$	$\cdots$	$K\left(L-1\right)$	$KL$	$KL+1$	$\cdots$	$KL+T-1$
$⋮$	$⋮$	$\ddots$	$⋮$	$⋮$	$⋮$	$\ddots$	$⋮$
${\alpha }_K=K-1$	$K-1$	$\cdots$	$KL-1$	$KL+K-1$	$KL+K$	$\cdots$	$KL+K+T-2$
${\alpha }_{K+1}=KL$	$KL$	$\cdots$	$2KL-K$	$2KL$	$2KL+1$	$\cdots$	$2KL+T-1$
${\alpha }_{K+2}=KL+K$	$KL+K$	$\cdots$	$2KL$	$2KL+K$	$2KL+K+1$	$\cdots$	$2KL+K+T-1$
$⋮$	$⋮$	$\ddots$	$⋮$	$⋮$	$⋮$	$\ddots$	$⋮$
${\alpha }_{K+T}=KL+K\left(T-1\right)$	$KL+K\left(T-1\right)$	$\cdots$	$2KL+K\left(T-2\right)$	$2KL+K\left(T-1\right)$	$2KL+K\left(T-1\right)+1$	$\cdots$	$2KL+\left(K+1\right)\left(T-1\right)$

Equations

$$A=\left[\begin{array}{c}{A}_1\\ ⋮\\ A_K\end{array}\right],B=\left[\begin{array}{ccc}{B}_1& \cdots & B_L\end{array}\right],\text{so that}AB=\left[\begin{array}{ccc}{A}_1{B}_1& \cdots & A_1{B}_L\\ ⋮& \ddots & ⋮\\ A_K{B}_1& \cdots & A_K{B}_L\end{array}\right],$$

$${\mathcal{R}}_1=\frac{K^2}{(K+T{)}^2},\text{or equivalently}{\mathcal{R}}_1=\frac{{\left(\lceil \sqrt{N}-T\rceil \right)}^2}{{\left(\lceil \sqrt{N}-T\rceil +T\right)}^2}.$$

$${\mathcal{R}}_2=\frac{KL}{(K+T)(L+1)-1},$$

$$A=\left[\begin{array}{c}{A}_1\\ A_2\\ A_3\end{array}\right],B=\left[\begin{array}{ccc}{B}_1& B_2& B_3\end{array}\right]$$

$$AB=\left[\begin{array}{ccc}{A}_1{B}_1& A_1{B}_2& A_1{B}_3\\ A_2{B}_1& A_2{B}_2& A_2{B}_3\\ A_3{B}_1& A_3{B}_2& A_3{B}_3\end{array}\right]$$

$$f(x)$$

$$g(x)$$

$$h(x)=\sum _{1\le k,\ell \le 3}{A}_k{B}_{\ell }{x}^{{\alpha }_k+{\beta }_{\ell }}+\sum _{\begin{array}{c}1\le k\le 3\\ 4\le \ell \le 5\end{array}}{A}_k{S}_{\ell }{x}^{{\alpha }_k+{\beta }_{\ell }}+\sum _{\begin{array}{c}4\le k\le 5\\ 1\le \ell \le 3\end{array}}{B}_{\ell }{R}_k{x}^{{\alpha }_k+{\beta }_{\ell }}+\sum _{4\le k,\ell \le 5}{R}_k{S}_{\ell }{x}^{{\alpha }_k+{\beta }_{\ell }}$$

$${\alpha }_k+{\beta }_{\ell }\ne {\alpha }_{k^{\prime }}+{\beta }_{{\ell }^{\prime }}\text{for all (k,ℓ)∈[3]×[3] and all (k′,ℓ′)∈[5]×[5] such that (k,ℓ)=(k′,ℓ′).}$$

$${\alpha }_1=0,{\alpha }_2=1,{\alpha }_3=2,{\alpha }_4=9,{\alpha }_5=12\text{and}{\beta }_1=0,{\beta }_2=3,{\beta }_3=6,{\beta }_4=9,{\beta }_5=10,$$

$$h(x)=A_1{B}_1+\cdots +A_3{B}_3{x}^8+C_9{x}^9+C_{10}{x}^{10}+C_{11}{x}^{11}+C_{12}{x}^{12}+C_{15}{x}^{15}+C_{18}{x}^{18}+C_{19}{x}^{19}+C_{21}{x}^{21}+C_{22}{x}^{22}$$

$$\mathcal{J}=\{0,\dots ,8,9,10,11,12,15,18,19,21,22\}$$

$$GV(\mathbf{a},\mathcal{J})=\left[\begin{array}{c}{a}_n^j\end{array}\right],1\le n\le 18,j\in \mathcal{J}$$

$$P_{n,m}=\left[\begin{array}{cc}{a}_n^9& a_n^{12}\\ a_m^9& a_m^{12}\end{array}\right],Q_{n,m}=\left[\begin{array}{cc}{a}_n^9& a_n^{10}\\ a_m^9& a_m^{10}\end{array}\right]$$

$$\det (Q_{n,m})=a_n^9{a}_m^9(a_m-a_n)\text{and}\det (P_{n,m})=a_n^9{a}_m^9(a_m^3-a_n^3)$$

$${\mathcal{R}}_1=\frac{K^2}{(K+T)(K+1)-1}=\frac{9}{19}\text{and}{\mathcal{R}}_2=\frac{K^2}{(K+T{)}^2}=\frac{9}{25}$$

$$\mathcal{R}=\frac{K^2}{K^2+2K+T^2+T-3}=\frac{9}{18}=\frac{1}{2}.$$

$$f(x)=\sum _{k=1}^K{A}_k{x}^{{\alpha }_k}+\sum _{t=1}^T{R}_t{x}^{{\alpha }_{K+t}}\text{and}g(x)=\sum _{\ell =1}^L{B}_{\ell }{x}^{{\beta }_{\ell }}+\sum _{t=1}^T{S}_t{x}^{{\beta }_{L+t}}$$

$$h(x)=f(x)g(x).$$

$$I(f(a_{n_1}),g(a_{n_1}),\dots ,f(a_{n_T}),g(a_{n_T});A,B)=0.$$

$$\mathcal{R}=\frac{KL}{N}.$$

$$\alpha \oplus \beta =\left[\begin{array}{ccc}{\alpha }_1+{\beta }_1& \cdots & {\alpha }_1+{\beta }_{L+T}\\ ⋮& \ddots & ⋮\\ {\alpha }_{K+T}+{\beta }_1& \cdots & {\alpha }_{K+T}+{\beta }_{L+T}\end{array}\right].$$

$$\mathrm{terms}A=\{n\in \mathbb{N}:\exists (i,j),A_{ij}=n\}.$$

$$f(x)=\sum _{k=1}^K{A}_k{x}^{{\alpha }_k}\text{and}g(x)=\sum _{\ell =1}^L{B}_{\ell }{x}^{{\beta }_{\ell }}.$$

$$h(x)=f(x)g(x)=\sum _{j\in \mathcal{J}}{C}_j{x}^j$$

$$\alpha_{k}=\left\{\begin{array}[]{ll}k-1&\text{if }1\leq k\leq K\\ KL+t-1&\text{if }k=K+t,\ 1\leq t\leq T\end{array}\right.,\quad\beta_{\ell}=\left\{\begin{array}[]{ll}K(\ell-1)&\text{if }1\leq\ell\leq L\\ KL+t-1&\text{if }\ell=L+t,\ 1\leq t\leq T\end{array}\right.$$

$$\alpha_{\ell}=\left\{\begin{array}[]{ll}K(\ell-1)&\text{if }1\leq\ell\leq L\\ KL+t-1&\text{if }\ell=L+t,\ 1\leq t\leq T\end{array}\right.,\quad\beta_{k}=\left\{\begin{array}[]{ll}k-1&\text{if }1\leq k\leq K\\ KL+t-1&\text{if }k=K+t,\ 1\leq t\leq T\end{array}\right.$$

$$N=\left\{\begin{array}[]{ll}(K+T)(L+1)-1&\text{if }T<K\\ 2KL+2T-1&\text{if }T\geq K\end{array}\right.$$

$$N=\left\{\begin{array}[]{ll}(L+T)(K+1)-1&\text{if }T<L\\ 2KL+2T-1&\text{if }T\geq L\end{array}\right.$$

$$\mathrm{terms}(\mathrm{UL})$$

$$\mathrm{terms}(\mathrm{UR})$$

Full text

I Introduction

We consider the problem of secure distributed matrix multiplication (SDMM), in which a user has two matrices $A$ and $B$ and wishes to compute their product $AB$ with the assistance of $N$ servers, without leaking any information about $A$ or $B$ to any server. We assume that all servers are honest and responsive, but that they are curious, in that any $T$ of them may collude to try to deduce information about either $A$ or $B$.

When considering the problem of SDMM from an information-theoretic perspective, the primary performance metric used in the literature is that of the download rate, or simply rate, which we denote by $\mathcal{R}$. In our scenario, the user queries the servers to perform various matrix mulitplications, and the servers respond with answers that the user can use to piece together the final desired result $AB$. In this admittedly heuristic description, the rate $\mathcal{R}$ is the ratio of the size of the desired result $AB$ (in bits) to the total amount of information (in bits) the user downloads to obtain the answers from the servers. The goal is to construct a SDMM scheme with rate $\mathcal{R}$ as large as possible.

The problem of constructing polynomial codes for SDMM can be summarized as follows. We partition the matrices $A$ and $B$ as follows:

[TABLE]

making sure that all products $A_{k}B_{\ell}$ are well-defined and of the same size. Clearly, computing the product $AB$ is equivalent to computing all subproducts $A_{k}B_{\ell}$. One then constructs a polynomial $h(x)$ whose coefficients encode the submatrices $A_{k}B_{\ell}$, and has $N$ servers compute evaluations $h(a_{1}),\ldots,h(a_{N})$. The polynomial $h$ is constructed so that every $T$-subset of evaluations reveals no information about $A$ or $B$, but so that the user can reconstruct all of $AB$ given all $N$ evaluations. This follows the general mantra of evaluation codes and, in particular, polynomial codes as originally introduced in [8] and [9].

One can view the parameters $K$ and $L$ as controlling the complexity of the matrix multiplication operations the servers must perform. Imagine a scenario in which one may hire as many servers $N$ as one wants to assist in the SDMM computation, but the computational capacity of each server is limited. In this scenario, one may have fixed values of $K$ and $L$, and then maximizing the rate $\mathcal{R}$ becomes a question of minimizing $N$. This is the general perspective we adopt in the SDMM problem.

I-A Related Work

Let $A$ and $B$ be partitioned as in (1), and consider the problem of SDMM with $N$ servers and $T$-security. In [1], a distributed matrix multiplication scheme is presented for the case $K=L$ which achieves a download rate of

[TABLE]

In [2], this is improved to

[TABLE]

where the polynomial code uses $N=(K+T)(L+1)-1$ servers. Given some fixed $N$ and $T$, the authors of [2] then find a near-optimal solution to the problem of finding $K$ and $L$ such that $(K+T)(L+1)-1\leq N$ and that the rate $\mathcal{R}_{2}$ as above is maximized. In [5], the authors study the case of $T=1$ and obtain a download rate of $\mathcal{R}=KL/(KL+K+L)$, which is the rate of [2] in this case. As far as the present authors are aware, [1, 2, 5] are the only works currently in the literature which study SDMM from the information-theoretic perspective.

We distinguish the SDMM problem from the case where only one of the matrices must be kept secure. In this case, one can use methods like Shamir’s secret sharing [3] or Staircase codes [4], if one is also interested in straggler mitigation.

Polynomial codes were originally introduced in [8] in a slightly different setting, namely to mitigate stragglers in distributed matrix multiplication. This work was followed up by [9] which studied fundamental limits of this problem, introduced a generalization of polynomial codes known as entangled polynomial codes, and applied similar ideas to other problems in distributed computing. In [10], the authors develop MatDot and PolyDot codes for distributed matrix multiplication with stragglers, and show that while the communication cost is higher than that of the polynomial codes of [8], the recovery threshold, defined to be the minimum number of workers which need to respond to guarantee successful decoding, is much smaller than that of [8]. The MatDot codes of [10] were then applied to the problem of nearest neighbor estimation in [11]. More fundamental questions about the trade-off in computation cost and communication cost in distributed computing were previously addressed in [12]. However, the polynomial codes in these aforementioned works are not designed to ensure security, making them not applicable to settings where there are privacy concerns related to the data being used. This type of setting could range from training neural networks on personal devices to computations on medical data, where legislation requires that certain privacy conditions are met.

Another line of work is Lagrange Coded Computing, a polynomial coding strategy introduced in [6] to mitigate stragglers and adversaries in distributed polynomial coded computation. The results in [6] focus on minimizing the number of required servers for the computation subject to privacy, robustness, and polynomial degree constraints. However, applying the ideas of [6] to the current scenario yields only one-sided privacy, wherein either $A$ or $B$ is kept private, but not both. More related to the current work is that of Private Polynomial Computation [7], which does provide two-sided privacy, but focuses on generic strategies which work for all polynomials of a given degree, rather than polynomial coding strategies tailored for the problem of matrix multiplication. Lastly, it seems that concerns related to data partitioning and block length make the results of the present paper (and generally results on using polynomnial codes for SDMM) incomparable with those of [6] or [7].

I-B Main Contribution

The main contributions of this work are as follows.

• •

In Section II we introduce our polynomial code $\mathsf{GASP}$ via an explicit example, in order to demonstrate all of the subtleties of the scheme construction. In Section III we formalize the notion of a polynomial code and introduce basic definitions.

• •

In Section IV we introduce the key notion of this paper, the degree table of a polynomial code. We prove, in Theorem 1, that to every degree table corresponds a secure distributed matrix multiplication scheme.

• •

In Section V, we present a secure distributed matrix multiplication scheme, $\mathsf{GASP}_{\text{big}}$. We show that $\mathsf{GASP}_{\text{big}}$ outperforms, for almost all parameters, all previously known schemes in the literature, in terms of the download rate.

• •

In Section VI, we present a secure distributed matrix multiplication scheme, $\mathsf{GASP}_{\text{small}}$. We show that $\mathsf{GASP}_{\text{small}}$ outperforms $\mathsf{GASP}_{\text{big}}$ when $T<\min\{K,L\}$.

• •

In Section VII, we present a secure distributed matrix multiplication scheme, $\mathsf{GASP}$, by combining both $\mathsf{GASP}_{\text{small}}$ and $\mathsf{GASP}_{\text{big}}$. $\mathsf{GASP}$ outperforms all previously known schemes, for almost all parameters, in terms of the download rate.

The rate of $\mathsf{GASP}$, for $L\leq K$, is given in Table I. For $K<L$, the rate is given by interchanging $K$ and $L$.

We plot in Fig. 1 the rates obtained by GASP against those obtained by the polynomial code SDMM strategies of [1, 2]. Before launching into the construction of GASP, let us offer some intuitive explanation as to the large improvement in rate offered by GASP over [1, 2]. The polynomial codes of [1, 2], as well as those of the current work, all have the user decode the necessary blocks of $AB$ by interpolating a polynomial $h(x)$, and obtaining the $A_{k}B_{\ell}$ as coefficients of this polynomial. The rate of all three strategies is completely determined by how many evaluations $h(x)$ requires to be interpolated completely, as this is the number of servers employed by the user. The strategies of [1, 2] force every coefficient of $h(x)$ to be potentially non-zero, and therefore interpolating $h(x)$ requires $\deg(h(x))+1$ evaluations. In contrast, GASP codes purposefully rig up $h(x)$ so that it has as many zero coefficients as possible, and that the user knows where these zero coefficients are located. This allows the user to interpolate $h(x)$ with substantially fewer than the expected number $\deg(h(x))+1$ of evaluations. While the polynomials $h(x)$ from the current work and those of [1, 2] have different degrees for the same parameters $K$, $L$, and $T$, this extra flexibility still allows us to generally use substantially fewer servers than the polynomial codes of [1, 2].

II A Motivating Example: $K=L=3$ and $T=2$

We begin our scheme description with the following example, which we present in as much detail as possible to showcase the essential ingredients of the scheme. In this example a user wishes to multiply two matrices $A$ and $B$ over a finite field $\mathbb{F}_{q}$, which are selected independently and uniformly at random from their respective ambient spaces. The user partitions the matrices as:

[TABLE]

so that all products $A_{k}B_{\ell}$ are well-defined and of the same size. The product $AB$ is given by

[TABLE]

We construct a scheme which computes each term $A_{k}B_{\ell}$, and therefore all of $AB$, via polynomial interpolation. The scheme is private against any $T=2$ servers colluding to deduce the identities of $A$ and $B$, and uses a total of $N=18$ servers.

Let $R_{1}$ and $R_{2}$ be two matrices picked independently and uniformly at random with entries in $\mathbb{F}_{q}$, both of size equal to the $A_{k}$. Similarly, pick $S_{1}$ and $S_{2}$ independently and uniformly at random of size equal to that of the $B_{\ell}$. Define polynomials

[TABLE]

where the $\alpha_{k}$ and $\beta_{\ell}$ are natural numbers that will be determined shortly.

As in [1], we will recover the products $A_{k}B_{\ell}$ by interpolating the product $h(x)=f(x)g(x)$. Specifically, for some evaluation points $a_{n}\in\mathbb{F}_{q}$, we will send $f(a_{n})$ and $g(a_{n})$ to server $n=1,\ldots,N$, who then responds with $h(a_{n})=f(a_{n})g(a_{n})$. These evaluations will suffice to interpolate all of $h(x)$. In particular, we will be able to retrieve the coefficients of $h(x)$, which in turn will allow us to decode all the $A_{k}B_{\ell}$.

The product $h(x)=f(x)g(x)$ is given by

[TABLE]

We wish to assign the exponents $\alpha_{k}$ and $\beta_{\ell}$ to guarantee decodability. Consider the following condition on the exponents:

[TABLE]

That is, all of the exponents corresponding to the terms we wish to decode must be distinct from all the other exponents appearing in $h(x)$. This guarantees that each product $A_{k}B_{\ell}$ appears as the unique coefficient of a unique power of $x$. The immediate goal is to minimize the number of distinct powers of $x$ appearing in $h(x)$, subject to the above condition. This will allow us to minimize the number of servers used by the scheme, thereby maximizing the rate.

The problem of assigning the $\alpha_{k}$ and $\beta_{\ell}$ can alternately be phrased as the following combinatorial problem. Consider the following addition table:

We call this table the degree table since it encodes the degrees that appear in $h(x)=f(x)g(x)$. With this in mind, we wish to pick $\alpha_{k},\beta_{\ell}\in\mathbb{N}$ such that every term in the upper-left $3\times 3$ block is distinct from every other number in the table. Outside this block, we wish to minimize the number of distinct integers that appear, in order to minimize the number of non-zero coefficients of $h(x)$ and therefore the number of required evaluation points.

Consider the assignment

[TABLE]

for which the degree table becomes

which satisfies our decodability condition. Concretely, the polynomial $h(x)$ is now of the form

[TABLE]

which has $N=18$ potentially non-zero coefficients. Here each $C_{j}$ is a sum of products of matrices where each summand has either $R_{k}$ or $S_{\ell}$ as a factor, and thus their precise nature is not important for decoding. We now show that over a suitable field $\mathbb{F}_{q}$, we can find $N=18$ evaluation points $a_{n}$ which suffice to interpolate $h(x)$, even though $\deg(h(x))=22$. This difference is subtle but crucial: the user knows exactly which coefficients of $h(x)$ are zero, and can thus interpolate the entire polynomial with fewer than the $\deg(h(x))+1$ evaluations one would normally need. This is in stark contrast with the strategies of [1, 2], where $f(x)$ and $g(x)$ are constructed so that every coefficient of $h(x)$ is non-zero (though for the same parameters $K$, $L$, and $T$, the polynomials $h(x)$ from [1, 2] are of a different degree than the $h(x)$ we obtain).

Let $\mathcal{J}$ be the set of exponents which occur in the above expression for $h(x)$, that is,

[TABLE]

so that $|\mathcal{J}|=18$. We wish to find an evaluation vector ${\bf a}=(a_{1},\ldots,a_{N})\in\mathbb{F}_{q}^{N}$ such that the $18\times 18$ generalized Vandermonde matrix

[TABLE]

is invertible. One can easily check that for $q=29$, the assignment $a_{n}=n\pmod{29}$ for $n=1,\ldots,18$ results in ${\det(GV({\bf a},\mathcal{J}))=20\neq 0\pmod{29}}$. Thus the coefficients of $h(x)$, in particular the $A_{k}B_{\ell}$, are uniquely decodable in the current scheme.

It is perhaps not obvious that the scheme we have described satisfies the $2$-privacy condition. Let us show that this is indeed the case. As in Example 1 in [1], the $2$-privacy condition will be satisfied provided that the matrices

[TABLE]

are invertible for any pair $1\leq n\neq m\leq 18$. We compute

[TABLE]

thus provided that $a_{n}^{3}\neq a_{m}^{3}$ for all $n\neq m$, and none of the $a_{n}$ are zero, these matrices will all be invertible. However, we have $\gcd(3,q-1)=1$, thus the map $x\mapsto x^{3}$ is a bijection from $\mathbb{F}_{29}$ to itself. Thus $a_{n}\neq a_{m}$ implies that $a_{n}^{3}\neq a_{m}^{3}$ for all $n\neq m$, and we see that the determinants of the above matrices are all non-zero and hence the $2$-privacy condition is satisfied.

For $K=L=3$ and $T=2$, let $\mathcal{R}_{1}$ denote the download rate of [2] and $\mathcal{R}_{2}$ that of [1]. We have

[TABLE]

whereas the scheme we have presented above improves on these constructions to achieve a rate of

[TABLE]

While this improvement in this example is marginal, we will see later that for large parameters we achieve significant gains over the polynomial codes of [1, 2].

III Polynomial Codes

Let $A$ and $B$ be matrices over a finite field $\mathbb{F}_{q}$, selected by a user independently and uniformly at random from the set of all matrices of their respective sizes, and partitioned as in equation (1) so that all products $A_{k}B_{\ell}$ are well-defined and of the same size. Then $AB$ is the block matrix $AB=\left(A_{k}B_{\ell}\right)_{1\leq k\leq K,1\leq\ell\leq L}$. A polynomial code is a tool for computing the product $AB$ in a distributed manner, by computing each block $A_{k}B_{\ell}$. Formally, we define a polynomial code as follows.

Definition 1**.**

The polynomial code $\mathsf{PC}(K,L,T,N,\alpha,\beta)$ consists of the following data:

• (i)

positive integers $K$, $L$, $T$, and $N$,

• (ii)

$\alpha=(\alpha_{1},\ldots,\alpha_{K+T})\in\mathbb{N}^{K+T}$, and

• (iii)

$\beta=(\beta_{1},\ldots,\beta_{L+T})\in\mathbb{N}^{L+T}$.

A polynomial code $\mathsf{PC}(K,L,T,N,\alpha,\beta)$ is used to securely compute the product $AB$ as follows. A user chooses $T$ matrices $R_{t}$ over $\mathbb{F}_{q}$ of the same size as the $A_{k}$ independently and uniformly at random, and $T$ matrices $S_{t}$ of the same size as the $B_{\ell}$ independently and uniformly at random. They define polynomials $f(x)$ and $g(x)$ by

[TABLE]

and let

[TABLE]

Given $N$ servers, a user chooses evaluation points $a_{1},\ldots,a_{N}\in\mathbb{F}_{q^{r}}$ in some finite extension $\mathbb{F}_{q^{r}}$ of $\mathbb{F}_{q}$. They then send $f(a_{n})$ and $g(a_{n})$ to server $n=1,\ldots,N$, who computes the product $f(a_{n})g(a_{n})=h(a_{n})$ and transmits it back to the user. The user then interpolates the polynomial $h(x)$ given all of the evaluations $h(a_{n})$, and attempts to recover all products $A_{k}B_{\ell}$ from the coefficients of $h(x)$. We omit the evaluation vector ${\bf a}$ from the notation $\mathsf{PC}(K,L,T,N,\alpha,\beta)$ because as we will shortly show, it does not really affect any important analysis of the polynomial code.

Definition 2**.**

A polynomial code $\mathsf{PC}(K,L,T,N,\alpha,\beta)$ is decodable and $T$-secure if there exists some evaluation vector ${\bf a}=(a_{1},\ldots,a_{N})\in\mathbb{F}_{q^{r}}^{N}$ for some $r>0$ such that for any $A$ and $B$ as above, the following two conditions hold.

• (i)

(Decodability) All products $A_{k}B_{\ell}$ for $k=1,\ldots,K$ and $\ell=1,\ldots,L$ are completely determined by the evaluations $h(a_{n})$ for $n=1,\ldots,N$.

• (ii)

($T$-security) For any $T$-tuple $\{n_{1},\ldots,n_{T}\}\subseteq[N]$, we have

[TABLE]

where $I(\cdot;\cdot)$ denotes mutual information between two random variables.

Definition 3**.**

Suppose that the polynomial code $\mathsf{PC}(K,L,T,N,\alpha,\beta)$ is decodable and $T$-secure. The download rate, or simply the rate, of this polynomial code is defined to be

[TABLE]

Given parameters $K$, $L$, and $T$, the goal of polynomial coding is to construct a decodable and $T$-secure polynomial code $\mathsf{PC}(K,L,T,\alpha,\beta)$ with download rate as large as possible. This is equivalent to minimizing the number of servers $N$, or equivalently, the number of evaluation points needed by the code.

IV The Degree Table

In this section we relate the construction of polynomial codes for SDMM with a certain combinatorial problem. This connection will guide our constructions and aid us in proving that our polynomial codes are decodable and $T$-secure.

Definition 4**.**

Let $\alpha\in\mathbb{N}^{K+T}$ and $\beta\in\mathbb{N}^{L+T}$. The outer sum $\alpha\oplus\beta\in\mathbb{N}^{(K+T)\times(L+T)}$ of $\alpha$ and $\beta$ is defined to be the matrix

[TABLE]

Definition 5**.**

Let $\alpha\in\mathbb{N}^{K+T}$ and $\beta\in\mathbb{N}^{L+T}$. We say that the outer sum $\alpha\oplus\beta$ is decodable and $T$-secure if the following two conditions hold:

• (i)

(Decodability) $(\alpha\oplus\beta)_{k,\ell}\neq(\alpha\oplus\beta)_{k^{\prime},\ell^{\prime}}$ for all $(k,\ell)\in[K]\times[L]$ and all $(k^{\prime},\ell^{\prime})\in[K+T]\times[L+T]$.

• (ii)

($T$-security) $\alpha_{K+t}\neq\alpha_{K+t^{\prime}}$ and $\beta_{L+t}\neq\beta_{L+t^{\prime}}$ for every $t\neq t^{\prime}\in[T]$.

Constructing $\alpha$ and $\beta$ so that $\alpha\oplus\beta$ is decodable and $T$-secure can be realized as the following combinatorial problem, displayed in Table II. The condition of decodability from Definition 5 simply states that each $\alpha_{k}+\beta_{\ell}$ in the red block must be distinct from every other entry in $\alpha\oplus\beta$. The condition of $T$-security states that all $\alpha_{K+t}$ in the green block must be pairwise distinct, and all $\beta_{L+t}$ in the blue block must be pairwise distinct. We refer to this table as the degree table.

Definition 6**.**

Let $A$ be a matrix with entries in $\mathbb{N}$. We define the terms of $A$ to be the set

[TABLE]

The next lemma and theorem allow us to reduce the construction of Polynomial Codes for SDMM to the combinatorial problem of constructing $\alpha$ and $\beta$ such that the degree table, $\alpha\oplus\beta$, is decodable and $T$-secure. The proof of the lemma is straightforward and thus omitted.

Lemma 1**.**

Consider the polynomial code $\mathsf{PC}(K,L,T,N,\alpha,\beta)$, with associated polynomials

[TABLE]

Then we can express the product $h(x)$ of $f(x)$ and $g(x)$ as

[TABLE]

for some matrices $C_{j}$, where $\mathcal{J}=\operatorname{terms}(\alpha\oplus\beta)$.

Thus, the terms in the outer sum $\alpha\oplus\beta$ correspond to the terms in the polynomial $h(x)=f(x)g(x)$. Because of this, we refer to the table representation of $\alpha\oplus\beta$ in Table II as the degree table of the polynomial code $\mathsf{PC}(K,L,T,N,\alpha,\beta)$. The following theorem allows us to reduce the construction of polynomial codes to the construction of degree tables which are decodable and $T$-secure.

Theorem 1**.**

Let $\mathsf{PC}(K,L,T,N,\alpha,\beta)$ be a polynomial code, where $N=|\operatorname{terms}(\alpha\oplus\beta)|$. Suppose that the degree table, $\alpha\oplus\beta$, satisfies the decodability and $T$-security conditions of Definition 5. Then the polynomial code $\mathsf{PC}(K,L,T,N,\alpha,\beta)$ is decodable and $T$-secure.

Proof:

The proof is an application of the Schwarz-Zippel Lemma. One finds sufficient conditions for decodability and $T$-security that reduce to the simultaneous non-vanishing of $2\binom{N}{T}+1$ determinants. One can find a point ${\bf a}\in\mathbb{F}_{q^{r}}^{N}$ for some $r>0$ at which none of these polynomials is zero. We relegate a detailed proof to the Appendix. ∎

Thanks to Theorem 1, constructing a polynomial code scheme for secure distributed matrix multiplication can be done by constructing $\alpha$ and $\beta$ such that the degree table, $\alpha\oplus\beta$, is decodable and $T$-secure. For this reason, the visualization in Table II is extremely useful, both as a guide for constructing polynomial codes for SDMM and as a method for calculating the corresponding download rate. In this context, maximizing the download rate is equivalent to minimizing $|\operatorname{terms}(\alpha\oplus\beta)|$, the number of distinct integers in the degree table shown in Table II, subject to decodability and $T$-security.

Remark 1**.**

Suppose that the degree table, $\alpha\oplus\beta$, is decodable and $T$-secure, and let $\mathbb{K}$ be an algebraic closure of $\mathbb{F}_{q}$. One can show that the set of all ${\bf a}=(a_{1},\ldots,a_{N})$ such that $\mathsf{PC}(K,L,T,N,\alpha,\beta)$ is decodable and $T$-secure is a Zariski open subset of $\mathbb{K}^{N}$. In practice, this means that given $K,L,T,\alpha,\beta$, if we choose ${\bf a}\in\mathbb{F}_{q^{r}}^{N}$ uniformly at random, then the probability that the polynomial code $\mathsf{PC}(K,L,T,N,\alpha,\beta)$ is decodable and $T$-secure goes to $1$ as $r\rightarrow\infty$. Thus, finding such evaluation vectors is not a difficult task.

V A Polynomial Code for Big $T$

In this section, we construct a polynomial code, $\mathsf{GASP}_{\text{big}}$, which has better rate than all previous schemes in the literature. The scheme construction chooses $\alpha$ and $\beta$ to attempt to minimize the number of distinct integers in the degree table, $\alpha\oplus\beta$. The scheme construction proceeds by choosing $\alpha_{k}$ and $\beta_{\ell}$ to belong to certain arithmetic progressions, and minimizes the number of terms in the lower-right $T\times T$ block of the degree table, $\alpha\oplus\beta$, shown in Table III.

Definition 7**.**

Given $K$, $L$, and $T$, define the polynomial code $\mathsf{GASP}_{\text{big}}$ as follows. Let $\alpha$ and $\beta$ be given by

[TABLE]

if $L\leq K$ and

[TABLE]

if $K<L$.

Lastly, define $N=|\operatorname{terms}(\alpha\oplus\beta)|$. Then $\mathsf{GASP}_{\text{big}}$ is defined to be the polynomial code $\mathsf{PC}(K,L,T,N,\alpha,\beta)$.

V-A Decodability and $T$-security

Theorem 2**.**

The polynomial code $\mathsf{GASP}_{\text{big}}$ is decodable and $T$-secure.

Proof:

We show that $\alpha\oplus\beta$ is decodable and $T$-secure, and the result then follows from Theorem 1. If $L\leq K$, then $\alpha$ and $\beta$ are as in (6). Suppose that $k\in[K]$ and $\ell\in[L]$, so that $\alpha_{k}+\beta_{\ell}=k-1+K(\ell-1)$. As $k$ and $\ell$ range over all of $[K]$ and $[L]$, respectively, each such number gives a unique integer in the interval $[0,KL-1]$. As every other term in the outer sum $\alpha\oplus\beta$ is greater than or equal to $KL$, we see that the decodability condition of Definition 5 is satisfied. As for $T$-security, it is clear that all $\alpha_{K+t}$ for $t\in[T]$ are distinct, and all $\beta_{L+t}$ for $t\in[T]$ are distinct. Therefore the $T$-security condition of Definition 5 is satisfied. If $K<L$ then the same argument holds by interchanging $\alpha$ and $\beta$. ∎

V-B Download Rate

To compute the number of terms in the degree table of $\mathsf{GASP}_{\text{big}}$, we divide the table into four regions.

• •

Upper Left: $\mathrm{UL}=\{(\alpha\oplus\beta)_{ij}:1\leq i\leq K,1\leq j\leq L\}.$

• •

Upper Right: $\mathrm{UR}=\{(\alpha\oplus\beta)_{ij}:1\leq i\leq K,L+1\leq j\leq L+T\}.$

• •

Lower Left: $\mathrm{LL}=\{(\alpha\oplus\beta)_{ij}:K+1\leq i\leq K+T,1\leq j\leq L\}.$

• •

Lower Right: $\mathrm{LR}=\{(\alpha\oplus\beta)_{ij}:K+1\leq i\leq K+T,L+1\leq j\leq L+T\}.$

Then, we compute the number of terms in each of these regions and use the inclusion-exclusion principle to obtain the number of terms in the whole table.

Theorem 3**.**

Let $N=|\operatorname{terms}(\alpha\oplus\beta)|$, where $\alpha$ and $\beta$ are as in Definition 7. Then $N$ is given by

[TABLE]

if $L\leq K$, and

[TABLE]

if $K<L$.

Consequently, the polynomial code $\mathsf{GASP}_{\text{big}}(K,L,T)$ has rate $\mathcal{R}=KL/N$, where $N$ is as in (8) or (9).

Proof:

The degree table, $\alpha\oplus\beta$, is shown in Table III. We first prove for the case where $L\leq K$. We denote by $[A:B]$ the set of all integers in the interval $[A,B]$. We can describe the terms of the four blocks of $\alpha\oplus\beta$ as follows:

[TABLE]

The sizes of these sets is given by

[TABLE]

Since the largest term in $\mathrm{UL}$ is smaller than any term on the other blocks, $\operatorname{terms}(\mathrm{UL})$ is disjoint from the terms of the other blocks. One then observes that the pairwise intersections of the sets of terms of the blocks are given by

[TABLE]

The sizes of these pairwise intersections are now calculated to be

[TABLE]

Finally, the triple intersection is given by

[TABLE]

We have $2KL-K+T-1\leq KL+K+T-2$ if and only if $L=1$. One now computes that

[TABLE]

We can now compute $N=|\operatorname{terms}(\alpha\oplus\beta)|$ by using the inclusion-exclusion principle, as

[TABLE]

For $K<L$, the proof is analogous by interchanging $\alpha$ and $\beta$. ∎

Remark 2**.**

If we take $K=L=1$, then the polynomial code $\mathsf{GASP}_{\text{big}}(1,1,T)$ uses $N=2T+1$ servers. Thus for any $N$ we can construct a polynomial code for any $T\leq\left\lfloor\frac{N-1}{2}\right\rfloor$, which is the same range of allowable $T$ as in [2].

V-C Performance

We now compare $\mathsf{GASP}_{\text{big}}$ with the polynomial codes of [1] and [2]. Indeed, we show that it outperforms them for most parameters. To do this it suffices, because of (3), to show that $N$, as defined in Theorem 3, is smaller than $(K+T)(L+1)-1$.

Theorem 4**.**

Let $N$ be defined as in Theorem 3. Then, $N\leq(K+T)(L+1)-1$.

Proof:

Suppose $L\leq K$. Then $N$ is as in (8). We will analyze each case.

• •

If $T<K$: then $(K+T)(L+1)-1=N$.

• •

If $T\geq K$: then $0\leq(L-1)(T-K)=((K+T)(L+1)-1)-(2KL+2T-1)$.

Thus, $(K+T)(L+1)-1\geq 2KL+2T-1=N$.

The result for $K<L$ follows by switching the roles of $K$ and $L$ in the above calculation.

∎

VI A Polynomial Code for Small $T$

In this section, we construct a polynomial code $\mathsf{GASP}_{\text{small}}$ which outperforms $\mathsf{GASP}_{\text{big}}$ when $T<\min\{K,L\}$. This is done by choosing the $\alpha_{k}$ and $\beta_{\ell}$ to lie in certain arithmetic progressions so that the columns of the upper-right block of $\alpha\oplus\beta$, shown in Table IV, overlap as much as possible, and similarly for the columns of the lower-left block. For $T$ small relative to $K$ and $L$, these two blocks are much bigger than the lower-right block, which the scheme construction essentially ignores.

Definition 8**.**

Given $K$, $L$, and $T$, define the polynomial code $\mathsf{GASP}_{\text{small}}$ as follows. Let $\alpha$ and $\beta$ be given by

[TABLE]

if $K\leq L$, and

[TABLE]

if $L<K$.

Lastly, define $N=|\operatorname{terms}(\alpha\oplus\beta)|$. Then $\mathsf{GASP}_{\text{small}}$ is defined to be the polynomial code $\mathsf{PC}(K,L,T,N,\alpha,\beta)$.

The example in Section II is exactly the polynomial code $\mathsf{GASP}_{\text{small}}$ when $K=L=3$ and $T=2$. In what follows we show that $\mathsf{GASP}_{\text{small}}$ is decodable and $T$-secure, and compute its download rate. Throughout this section, $\alpha$ and $\beta$ will be as in Definition 8.

VI-A Decodability and $T$-security

Theorem 5**.**

The polynomial code $\mathsf{GASP}_{\text{small}}(K,L,T)$ is decodable and $T$-secure.

Proof:

Analogous to Theorem 2. ∎

VI-B Download Rate

We now find the download rate of $\mathsf{GASP}_{\text{small}}$ by computing $N=|\operatorname{terms}(\alpha\oplus\beta)|$.

Theorem 6**.**

Let $N=|\operatorname{terms}(\alpha\oplus\beta)|$, where $\alpha$ and $\beta$ are as in Definition 8. Then $N$ is given by

[TABLE]

if $K\leq L$, and

[TABLE]

if $L<K$.

Consequently, the polynomial code $\mathsf{GASP}_{\text{small}}$ has rate $\mathcal{R}=KL/N$, where $N$ is as in (15) or (16).

Proof:

The proof is in Appendix -B. ∎

Remark 3**.**

The above construction for small $T$ is from where the name GASP (Gap Additive Secure Polynomial) is derived. The construction allows for gaps in the degrees of monomials appearing as summands of $h(x)$, as was observed in the example in Section II. Allowing for these gaps gives one more flexibility in how the vectors $\alpha$ and $\beta$ are chosen to attempt to minimize $N=|\operatorname{terms}(\alpha\oplus\beta)|$. Note that for very large $T$, the inequality $T\geq K(L-1)+1$ has forced the outer sum $\alpha\oplus\beta$ to contain every integer from [math] to $2KL+(K+1)(T-1)$, with no gaps.

VI-C Performance

We now show that $\mathsf{GASP}_{\text{small}}$ outperforms $\mathsf{GASP}_{\text{big}}$ when $T<\min\{K,L\}$.

Theorem 7**.**

Let $T<\min\{K,L\}$. Then $N_{\text{small}}\leq N_{\text{big}}$.

Proof:

We will analyze each case.

• •

If $T=1$: then $N_{\text{big}}=KL+K+L=N_{\text{small}}$.

• •

If $T\geq 2$: then $0\leq(T+1)(T-1)-T^{2}+2\leq L(T-1)-T^{2}+2=N_{\text{big}}-N_{\text{small}}$.

Thus, $N_{\text{big}}\geq N_{\text{small}}$.

∎

VII Combining Both Schemes

In this section, we construct a polynomial, $\mathsf{GASP}$, by combining both $\mathsf{GASP}_{\text{small}}$ and $\mathsf{GASP}_{\text{big}}$. By construction, $\mathsf{GASP}$ has a better rate than all previous schemes.

Definition 9**.**

Given $K$, $L$, and $T$, we define the polynomial code $\mathsf{GASP}$ to be

[TABLE]

Theorem 8**.**

For $L\leq K$, the polynomial code $\mathsf{GASP}$ has rate,

[TABLE]

For $K<L$, the rate is given by interchanging $K$ and $L$.

Proof:

Follows immediately from Theorems 3, 6, and 7. ∎

VII-A Fixed Computation Load

We now compare the rate of $\mathsf{GASP}$ with those of [1] and [2] when $K$ and $L$ are fixed. Throughout this section, we let

[TABLE]

Here $\mathcal{R}_{1}$ and $\mathcal{R}_{2}$ are the rates of the polynomial codes in [1] and [2], respectively.

VII-B Fixed number of workers

To deepen the comparison with [2], we plot the download rates $\mathcal{R}$ and $\mathcal{R}_{2}$ as functions of the total number $N$ of servers and the security level $T$. For $\mathsf{GASP}$ and the polynomial code of [2], given some $N$ and $T$, we must calculate a $K$ and $L$ for which the expression for the required number of servers is less than the given $N$, and which ideally maximizes the rate function. In [2, Theorem 1], the authors propose the solution

[TABLE]

which, for a given $N$ and $T$, is shown to satisfy $(\hat{K}+T)(\hat{L}+1)-1\leq N$ and nearly maximize the rate function $\mathcal{R}_{1}$.

For a given $N$ and $T$, optimizing the rate of $\mathsf{GASP}$ presents one with the following optimization problem:

[TABLE]

Due to the complicated nature of the expressions for $N_{\text{small}}$ and $N_{\text{big}}$, we will not attempt to solve this optimization problem analytically. Instead, for the purposes of the present comparison with [2], we simply solve (20) by brute force for each specific value of $N$ and $T$.

In Fig. 5 we plot the download rate of $\mathsf{GASP}$ versus the download rate of the polynomial code of [2], for $N=50$ and $N=100$ servers. The optimal values of $K$ and $L$ for $\mathsf{GASP}$ were computed by solving (20) by brute force. The values of $K$ and $L$ for the scheme of [2] were those of (19).

The apparent equality in rate of the two schemes outside of the ‘small $T$’ regime can be explained as follows. One can show easily that when $T>N/6$ we have $\hat{L}=1$, and hence the rate from [2] is given by $\mathcal{R}_{2}=\frac{\hat{K}}{2\hat{K}+2T-1}$, where $\hat{K}=\left\lfloor\frac{N+1}{2}-T\right\rfloor$. Now the rate of $\mathsf{GASP}$ in this regime is that of $\mathsf{GASP}_{\text{big}}$, so $\mathcal{R}=\frac{KL}{2KL+2T-1}$. Optimizing the rate of $\mathsf{GASP}_{\text{big}}$ for fixed $N$ is now simply a matter of picking the optimal value of $KL$. Whatever this optimal value happens to be, it only depends on the product $KL$ and not the individual values of $K$ and $L$. So when optimizing the rate of $\mathsf{GASP}_{\text{big}}$ for fixed $N$ and $T$, one is free to set $L=1$ without loss of generality. The rates of the $\mathsf{GASP}_{\text{big}}$ and the scheme of [2] are then easily seen to agree.

VIII Acknowledgements

We kindly thank the authors of [2] for pointing out errors in the plots of Fig. 5 in the original version of this paper. These plots have since been corrected.

-A Proof of Theorem 1

We will require the following definition throughout the proof of Theorem 1.

Definition 10**.**

Let $\mathbb{F}_{q}$ be a finite field, let ${\bf a}=(a_{1},\ldots,a_{N})\in\mathbb{F}_{q}^{N}$, and let $\mathcal{J}$ be a set of non-negative integers of size $|\mathcal{J}|=N$. We define the Generalized Vandermonde Matrix $GV({\bf a},\mathcal{J})\in\mathbb{F}_{q}^{N\times N}$ to be

[TABLE]

Note that if $\mathcal{J}=\{0,1,\ldots,N-1\}$ and the $a_{n}$ are all chosen distinct, then $GV({\bf a},\mathcal{J})$ is the familiar $N\times N$ Vandermonde matrix associated with the $a_{n}$, and is invertible if and only if the $a_{n}$ are distinct.

We begin proving Theorem 1 by stating the following useful Lemma. For all practical purposes, this reduces checking decodability and $T$-security to checking polynomial conditions. We say a matrix has the MDS property if every maximal minor has non-zero determinant. Equivalently, the matrix is the generator matrix of an MDS code.

Lemma 2**.**

Let $\mathsf{PC}(K,L,T,\alpha,\beta)$ be a polynomial code, such that $\alpha\oplus\beta$ is decodable and $T$-secure. Suppose that there is an evaluation vector ${\bf a}=(a_{1},\ldots,a_{N})\in\mathbb{F}_{q^{r}}^{N}$ such that the following properties hold:

• (i)

(Decodability) The Generalized Vandermonde Matrix $GV({\bf a},\mathcal{J})$ is invertible.

• (ii)

($T$-privacy) The $T\times N$ matrices

[TABLE]

where $1\leq t\leq T$ and $1\leq n\leq N$, have the MDS property.

Then $\mathsf{PC}(K,L,T,\alpha,\beta)$ is decodable and $T$-secure.

Proof:

Since the matrix $GV({\bf a},\mathcal{J})$ is invertible, the polynomial $h(x)=\sum_{j\in\mathcal{J}}C_{j}x^{j}$ can be interpolated from the evaluations $h(a_{n})$, for $n=1,\ldots,N$. Thus the user can recover all of the coefficients of $h(x)$. By the decodability condition of the outer sum $\alpha\oplus\beta$, the user can then recover all products $A_{k}B_{\ell}$.

The argument for $T$-privacy is familiar and follows the proof of $T$-security in Equation (28) in the proof of Theorem 2 in [1]. One shows that, given the above condition, any $T$-tuple of matrices $f(a_{n_{1}}),\ldots,f(a_{n_{T}})$ is uniform random on the space of all $T$-tuples of matrices of the appropriate size, and is independent of $A$. The same argument works for $B$. ∎

Let us now finish the proof of Theorem 1. Let ${\bf X}=(X_{1},\ldots,X_{N})$ be a vector of variables and consider the polynomial

[TABLE]

Additionally, if $\mathcal{T}=\{n_{1},\ldots,n_{T}\}\subseteq[N]$ is any set of size $T$, define

[TABLE]

By Lemma 2, it suffices to find an evaluation vector ${\bf a}\in\mathbb{F}_{q^{r}}^{N}$ such that $D({\bf a})\neq 0$, $P_{\mathcal{T}}({\bf a})\neq 0$, and $Q_{\mathcal{T}}({\bf a})\neq 0$ for all $\mathcal{T}\subseteq[N]$ of size $T$. By the assumption that $\alpha\oplus\beta$ is decodable and $T$-secure, none of the polynomials $D({\bf X})$, $P_{\mathcal{T}}({\bf X})$, and $Q_{\mathcal{T}}({\bf X})$ are zero, and all have degree bounded by $J:=\sum_{j\in\mathcal{J}}j$.

Now consider a finite extension $\mathbb{F}_{q^{r}}$ of $\mathbb{F}_{q}$ and a subset $G\subseteq\mathbb{F}_{q^{r}}$ of size $G>\left(2\binom{N}{T}+1\right)J$. Sample each entry $a_{n}$ of ${\bf a}$ uniformly at random from $G$. Let $\mathsf{E}$ be the union of the events $D({\bf a})=0$, $P_{\mathcal{T}}({\bf a})=0$, and $Q_{\mathcal{T}}({\bf a})=0$ for all $\mathcal{T}\subseteq[N]$ of size $T$. To finish the proof, it suffices to show that $\text{Pr}(\mathsf{E})<1$. By the union bound and the Schwarz-Zippel Lemma, we have

[TABLE]

This completes the proof of the Theorem. $\blacksquare$

-B Proof of Theorem 6.

The degree table, $\alpha\oplus\beta$, is is shown in Table IV. We first prove for the case where $L\leq K$. As in section V-B, we let $\mathrm{UL}$, $\mathrm{UR}$, $\mathrm{LL}$, and $\mathrm{LR}$ be the upper-left, upper-right, lower-left, and lower-right blocks, respectively, of $\alpha\oplus\beta$. We first count the number in each block, and then study the intersections of the blocks.

It will be convenient to adopt the following notation. For integers $A$, $B$, and $C$, let $[A:B~{}|~{}C]$ be the set of all multiples of $C$ in the interval $[A,B]$. If $A=DC$ is a multiple of $C$, we have

[TABLE]

where $x^{+}=\max\{x,0\}$. If $C=1$ then we write $[A:B]$ instead of $[A:B~{}|~{}1]$, so that $[A:B]$ denotes all the integers in the interval $[A,B]$.

The sets $\operatorname{terms}(\mathrm{UL})$, $\operatorname{terms}(\mathrm{UR})$, $\operatorname{terms}(\mathrm{LL})$, and $\operatorname{terms}(\mathrm{LR})$ are given by

[TABLE]

From these expressions, one can count the sizes of the above sets to be

[TABLE]

To understand the last expression above, note that the intervals in the union expression for $\operatorname{terms}(\mathrm{LR})$ consist of all integers from $2KL$ to $2KL+(K+1)(T-1)$ exactly when $T\geq K$.

As for intersections, clearly $\operatorname{terms}(\mathrm{UL})$ intersects none of the sets of terms from the other blocks. Thus it suffices to understand the pairwise intersections among the other three blocks, and the triple intersection of the other three blocks. Two of these pairwise intersections and their sizes are easily understood:

[TABLE]

Understanding the intersection $\operatorname{terms}(\mathrm{UR})\cap\operatorname{terms}(\mathrm{LR})$ is a bit more subtle, and we break the problem into two cases. If $T\geq K$, then $\operatorname{terms}(\mathrm{LR})=[2KL:2KL+(K+1)(T-1)]$. Since $\operatorname{terms}(\mathrm{UR})=[KL:KL+K+T-2]$, we see that $\operatorname{terms}(\mathrm{UR})\cap\operatorname{terms}(\mathrm{LR})=[2KL:KL+K+T-2]$. In the case $T<K$ we have $2KL>KL+K+T-2$ and thus the intersection is empty, unless $L=1$, in which case $\operatorname{terms}(\mathrm{UR})\cap\operatorname{terms}(\mathrm{LR})=[2K:2K+T-2]$. It follows that

[TABLE]

It remains to count the size of the triple intersection. First suppose that $T<K$, which we break into two subcases: (i) $L=1$ and (ii) $L\geq 2$. If $L=1$ and $T=1$, then the triple intersection is empty, but if $T>1$ then all three blocks intersect in the lone terms $2K$. If $L\geq 2$, then the triple intersection is again empty by the above paragraph. Now suppose that $T\geq K$. In this case the intersection is the set $[2KL:KL+K+T-2~{}|~{}K]$, which has size $\left(\left\lfloor\frac{T-2}{K}\right\rfloor-L+2\right)^{+}$. We therefore have

[TABLE]

We can now compute $N=|\operatorname{terms}(\alpha\oplus\beta)|$ by using the inclusion-exclusion principle, as

[TABLE]

The above computation is straightforward given that we have already calculated the sizes of each of the individual sets. The only subtlety in deriving the formula (15) for $N$ arises in the case that $L\geq 2$ and $K(L-1)+1\leq T$. In this case, one uses the fact that

[TABLE]

From this equivalence and equations (26) and (27) one can use inclusion-exclusion to compute the value of $N$.

For $K<L$, the proof is analogous by interchanging $\alpha$ and $\beta$.

This completes the proof of the Theorem.

-C A Note on the Communication Rate

The results in this paper were presented in terms of the download rate, not accounting for the upload rate and, therefore, the total communication rate of the scheme. This was done since the previous literature on this subject, [1], [2], and [5], all used the download rate as their measure of performance. We will now see that both the download rate and the upload rate for polynomial codes both depend on the number, $N$, of servers.

Let $A\in\mathbb{F}_{q}^{r\times s}$ and $B\in\mathbb{F}_{q}^{s\times t}$. As in (1), partition them as follows:

[TABLE]

Thus, each $A_{i}\in\mathbb{F}_{q}^{\frac{r}{K}\times s}$ and each $B_{i}\in\mathbb{F}_{q}^{s\times\frac{t}{L}}$. The random matrices will also belong, respectively, to these spaces.

Using a polynomial code a user will send a linear combination of the $A$’s and $R$’s and another one of the $B$’s and $S$’s to each server, requiring an upload of $rs/K+st/L$ symbols per server, for a total upload cost of $N(rs/K+st/L)$ symbols. Each server will then multiply the two matrices they received and send the user a matrix of dimensions $r/K\times t/L$, for a total download cost of $Nrt/KL$. Thus, under our framework, minimizing the download, upload, or total communication costs are all equivalent to minimizing the number of servers, $N$.

A more thorough analysis on the communication and computational costs in SDMM can be found in [13].

Let us conclude by briefly discussing the difference in total communication cost between $\mathsf{GASP}$ and the scheme of [2]. As we saw in Section VII-B, for fixed $N$ and $T$ satisfying $T>N/6$ the download rates of these schemes are the same. The scheme of [2] achieves this rate by setting $L=1$, while $\mathsf{GASP}$ achieves this rate by calculating the optimal value of $KL$, and choosing any values of $K$ and $L$ that yield this product. For fixed values of $N$, $T$, and $KL$, minimizing the communication cost is equivalent to minimizing the upload cost $N(rs/K+st/L)$. This is accomplished by choosing $K$ and $L$ to be as close to each other as possible, which $\mathsf{GASP}$ allows for. In contrast, the scheme of [2] which sets $L=1$ ends up maximizing the upload cost subject to the given conditions. For example, when $N=20$ and $T=6$, the scheme of [2] sets $K=4$ and $L=1$, while $\mathsf{GASP}$ sets $K=L=2$. This results in a $20\%$ decrease in upload cost when $r=s=t$.