Lifted multiplicity codes and the disjoint repair group property

TL;DR

This paper introduces lifted multiplicity codes, a generalization of lifted Reed Solomon codes, demonstrating they achieve superior redundancy-locality trade-offs and disjoint repair group properties, advancing error correction code efficiency.

Contribution

It presents lifted multiplicity codes with improved redundancy and locality trade-offs, and provides a new analysis of lifted Reed Solomon codes via dual codes.

Findings

Lifted multiplicity codes achieve redundancy $O(t^{0.585} \, \sqrt{N})$ with disjoint repair groups.

They offer the best known trade-off for redundancy and locality for super-constant $t < \sqrt{N}$.

Alternative analysis of lifted Reed Solomon codes using dual codes is provided.

Abstract

Lifted Reed Solomon Codes (Guo, Kopparty, Sudan 2013) were introduced in the context of locally correctable and testable codes. They are multivariate polynomials whose restriction to any line is a codeword of a Reed-Solomon code. We consider a generalization of their construction, which we call lifted multiplicity codes. These are multivariate polynomial codes whose restriction to any line is a codeword of a multiplicity code (Kopparty, Saraf, Yekhanin 2014). We show that lifted multiplicity codes have a better trade-off between redundancy and a notion of locality called the $t$-disjoint-repair-group property than previously known constructions. More precisely, we show that lifted multiplicity codes with length $N$ and redundancy $O(t^{0.585} \sqrt{N})$ have the property that any symbol of a codeword can be reconstructed in $t$ different ways, each using a disjoint subset of the other coordinates. This gives the best known trade-off for this problem for any super-constant $t < \sqrt{N}$. We also give an alternative analysis of lifted Reed Solomon codes using dual codes, which may be of independent interest.

Equations

$$O\left(t^{{\log }_2(3)-1}\sqrt{N}\right)\approx O\left(t^{0.585}\sqrt{N}\right).$$

$${\mathsf{RS}}_{d,q}=\left\{(f(x_1),\dots ,f(x_q)):f\in {\mathbb{F}}_q[X],\mathrm{deg}(f)<d\right\},$$

$${\mathsf{RM}}_{d,q,m}=\left\{(f({\mathbf{x}}_1),\dots ,f({\mathbf{x}}_{q^m})):f\in {\mathbb{F}}_q[X_1,\dots ,X_m],\mathrm{deg}(f)<d\right\},$$

$${\mathsf{Mult}}_{d,q,m,r}=\left\{(f^{(<r)}({\mathbf{x}}_1),\dots ,f^{(<r)}({\mathbf{x}}_{q^m})):f\in {\mathbb{F}}_q[X_1,\dots ,X_m],\mathrm{deg}(f)<d\right\},$$

$$1-\frac{3r^{{\log }_2(8/3)}{q}^{{\log }_2(3)}}{\left(\genfrac{}{}{0ex}{}{r+1}{2}\right)q^2},$$

$$\frac{3r^{{\log }_2(8/3)}{q}^{{\log }_2(3)}}{\left(\genfrac{}{}{0ex}{}{r+1}{2}\right)}.$$

$$6N^{{\log }_4(3)-\gamma (1-{\log }_4(8/3))}$$

$$\left(\genfrac{}{}{0ex}{}{a}{b}\right)\equiv \prod _{i=0}^{\ell -1}\left(\genfrac{}{}{0ex}{}{a_i}{b_i}\right)\mathrm{mod}p$$

$$P(\text{X}+\text{Z})=\sum _{\text{i}}{P}^{(\text{i})}(\text{X}){\text{Z}}^i.$$

$$P^{(i)}(X)=\{\begin{array}{cc}\left(\genfrac{}{}{0ex}{}{r}{i}\right)(X^q-X{)}^{r-i}& 0\le i\le r\\ 0& i>r\end{array}$$

$$\displaystyle\begin{bmatrix}P^{(i)}_{L_{1}}(\gamma)\\ P^{(i)}_{L_{2}}(\gamma)\\ \vdots\\ P^{(i)}_{L_{i+1}}(\gamma)\end{bmatrix}\$$

$${\text{eval}}_{q,r}(P):=(P^{(<r)}(\mathbf{x}){)}_{\mathbf{x}\in {\mathbb{F}}_q^2},$$

$$\displaystyle P^{(i,j)}(X,Y)\$$

$$\mathcal{C}=\left\{\textnormal{eval}_{q,r}(P)\,:\,\text{ \begin{minipage}{227.62204pt} \begin{center} $P\in\mathbb{F}_{q}[X,Y]$ and, for any $L(T)\in\mathcal{L}$, $P(L(T))\equiv_{r}Q(T)$ for some $Q\in\mathbb{F}_{q}[T]$ of degree less than $d$. \end{center} \end{minipage}}\right\}$$

$$1-\frac{6}{r}{\left(r-\frac{d}{q}\right)}^{{\log }_2(4/3)}.$$

$$\displaystyle q-1-a_{1}\$$

$$\displaystyle q-2-a_{1}\$$

$$\displaystyle\vdots\$$

$$\displaystyle q-s-a_{1}\$$

$$M_{a,b,\alpha ,\beta }(T)\stackrel{\mathrm{def}}{=}{T}^a(\alpha T+\beta {)}^b=\sum _{i=0}^b{\alpha }^i{\beta }^{b-i}{T}^{a+i}(\genfrac{}{}{0ex}{}{b}{i}).$$

$$((r+1)q-2)-(qr-r)=r+q-2<qr-s$$

$$qr-s\le c\le qr.$$

$$\displaystyle\alpha^{rq-s^{\prime}-a}\beta^{b-rq+s^{\prime}+a}\binom{b}{rq-s^{\prime}-a}\$$

$$P^{(i)}(X)=\sum _{j_1+\cdots +j_r=i}\prod _{k=1}^r{D}^{(j_k)}(X^q-X).$$

$$\displaystyle P_{L_{k}}(T+Z)\$$

$$=\sum _{\text{i}\in {\mathbb{N}}^2}{P}^{(\text{i})}({\text{a}}_{k}T+{\text{b}}_k)\cdot ({\text{a}}_{k}Z{)}^{\text{i}}$$

$$=\sum _{\text{i}\in {\mathbb{N}}^2}{P}^{(\text{i})}({\text{a}}_{k}T+{\text{b}}_k)\cdot {\text{a}}_k^{\text{i}}{Z}^{\text{wt}(\text{i})}$$

$$\displaystyle P_{L_{k}}(T+Z)\$$

$$\displaystyle P_{L_{k}}^{(i)}(T)\$$

$$\displaystyle P_{L_{k}}^{(i)}(\gamma)\$$

$$\displaystyle(c^{\perp}_{L})_{ij}\stackrel{{\scriptstyle\rm def}}{{=}}\left\{\begin{tabular}[]{ll}1&$(i,j)=L(t)$ for some $t\in\mathbb{F}_{q}$\\ 0&\text{o/w}\\ \end{tabular}\right.$$

$$\displaystyle V_{\mathcal{L}}\$$

$$\displaystyle P_{L}(X,Y)\$$

Full text

1 Introduction

In this work we study lifted multiplicity codes, and show how they provide improved constructions of codes with the $t$-disjoint repair group property ($t$-DRGP), a notion of locality in error correcting codes.

An *error correcting code *of length $N$ over an alphabet $\Sigma$ is a set $\mathcal{C}\subseteq\Sigma^{N}$. There are several desirable properties in error correcting codes, and in this paper we study the trade-off between two of them. The first is the size of $\mathcal{C}$, which we would like to be as big as possible given $N$. The second desirable property is *locality. *Informally, a code $\mathcal{C}$ exhibits locality if, given (noisy) access to $c\in\mathcal{C}$, one can learn the $i$’th symbol $c_{i}$ of $c$ in sublinear time. As we discuss more below, locality arises in a number of areas, from distributed storage to complexity theory.

Two constructions of codes with locality are lifted codes [GKS13] and multiplicity codes [KSY14]; in fact, both of these constructions were among the first known high-rate Locally Correctable Codes. In this work, we consider a combination of the two ideas in *lifted multiplicity codes, *and we show that these codes exhibit locality beyond what’s known for either lifted codes or for multiplicity codes.

More precisely, we study a particular notion of locality called the $t$*-disjoint-repair-group property *($t$-DRGP). Informally, we say that $\mathcal{C}$ has the $t$-DRGP if any symbol $c_{i}$ of $c\in\mathcal{C}$ can be obtained in $t$ different ways, each of which involves a disjoint set of coordinates of $c$. Formally, we have the following definition.

Definition 1.1**.**

A code $\mathcal{C}\subseteq\Sigma^{N}$ has the $t$-disjoint repair property if for every $i\in[N]$, there is a collection of $t$ disjoint subsets $S_{1},\ldots,S_{t}\subseteq[N]\setminus\{i\}$, and functions $f_{1},\ldots,f_{t}$ so that for all $c\in\mathcal{C}$ and for all $j\in[t]$, $f_{j}(c|_{S_{j}})=c_{i}$. The sets $S_{1},\ldots,S_{t}$ are called repair groups.

As discussed more in Section 1.1 below, the $t$-DRGP naturally interpolates between many different notions of locality. The $t$-DRGP is well-studied both when $t=O(1)$ is small (where it is related to Locally Repairable Codes and nearly equivalently to Private Information Retrieval Codes) and $t=\Omega(N)$ is large (where it is equivalent to Locally Correctable Codes). For this reason, it is natural to study the $t$-DRGP when $t$ is intermediate; for example, when $t=N^{a}$ for $a\in(0,1)$. In this case, it is possible for the size of the code $|\mathcal{C}|$ to be quite large: more precisely, it is possible for the rate $R=\frac{\log_{|\Sigma|}|\mathcal{C}|}{N}$ to approach $1$ (notice that we always have $|\mathcal{C}|\leq|\Sigma|^{N}$, hence we always have $R\leq 1$). Thus, the goal is to understand exactly how quickly the rate can approach $1$. That is, given $t$, how small can the redundancy $N-RN$ be?

Several works have tackled this question, and we illustrate previous results in Figure 1. Our main result is that lifted multiplicity codes improve on the best-known trade-offs for all super-constant $t\leq\sqrt{N}$.

Contributions.

We summarize the main contributions of this work below.

For $t\leq\sqrt{N}$, we construct codes with the $t$-DRGP and redundancy at most

[TABLE]

This gives the best known construction for all $t$ with $t=\omega(1)$ and $t<\sqrt{N}$; the only previous result that held non-trivially for a range of $t$ was redundancy $O(t\sqrt{N})$ [FVY15, BE16, AY19] and our result also surpasses the specialized bound for $t=N^{1/4}$ of [FGW17].

We note, however, that our construction has a large alphabet size, $N^{\Theta(N/t^{2})}$. In contrast, the works [GKS13, FVY15, FGW17] have alphabet size at most polynomial in $N$. However, we can follow the approach of [AY19] and make our code binary by replacing each symbol with an (uncoded) binary string. This yields *binary *codes with $t$-DRGP, that have the best known trade-offs between $t$ and the redundancy when $N^{1/4}<t<N^{1/2}$ among all known codes with alphabet size $\mathrm{poly}(N)$. 2. 2.

We give a new analysis of bivariate lifts of multiplicity codes. Both multiplicity codes and lifted codes have been studied before (even in the context of the $t$-DRGP), but to the best of our knowledge the only work to consider lifted multiplicity codes is [Wu15]. That work studies $m$-variate lifts of multiplicity codes, where $m$ is large; its goal is to obtain new constructions of high-rate locally correctable codes. In the context of our discussion, this corresponds to the $t$-DRGP when $t=N^{0.99}$. In contrast, for bivariate lifts, we are able to obtain more refined bounds which lead to improved results for the $t$-DRGP when $t\leq\sqrt{N}$.

Organization.

In the remainder of the introduction, we survey related work and give an overview of our approach. In Section 2, we give the formal definitions about polynomials and derivatives that we need. In Section 3, we formally define lifted multiplicity codes. In Section 4, we prove that lifted multiplicity codes have high rate, and in Section 5, we prove that they have the $t$-DRGP, which gives rise to our main theorem, Theorem 1.2.

1.1 Background and Related Work

1.1.1 Disjoint Repair Groups

The $t$-DRGP and related notions have been studied both implicitly and explicitly across several communities. When $t=O(1)$ is small, several notions related to the $t$-DRGP have been studied, motivated primarily by distributed storage. These include Locally Repairable Codes (LRCs) with availability [WZ14, RPDV14, TB14, TBF16], codes for Private Information Retrieval (PIR) [FVY15, BE16, AY19] (all codes with the $t$-DRGP are $t$-PIR codes) and batch codes [IKOS04, RSDG16, AY19]; we refer the reader to [Ska18] for a survey of these notions.111In many (but not all) of these notions, we also care about the size of the repair groups but in this work we focus on the simpler problem of the $t$-DRGP.

To see why the $t$-DRGP might be relevant for distributed storage, consider a setting where some data is encoded as $c\in\mathcal{C}$, and then each $c_{i}$ is sent to a separate server. If server $i$ is later unavailable, we might want to reconstruct $c_{i}$ without contacting too many other servers. This can be done if each symbol has one small repair group; this is the defining property of LRCs. Now suppose that several (say, $t-1$) servers are unavailable. If $\mathcal{C}$ has the $t$-DRGP then all $t-1$ unavailable symbols can be locally reconstructed: each node has at least $t$ disjoint repair groups and at most $t-1$ of them have been compromised.

On the other hand, when $t=\Omega(N)$ is large, the $t$-DRGP has been studied in the context of Locally Decodable Codes and Locally Correctable Codes (LDCs/LCCs). In fact, the $\Omega(N)$-DRGP is equivalent to a constant-query LCC, and the notion has been used to prove impossibility results for such codes [KT00, Woo10].

Because of these motivations, there are several constructions of $t$-DRGP codes for a wide range of $t$; we illustrate the relevant ones in Figure 1. In the context of coded PIR, [FVY15, BE16, AY19] give constructions of $t$-DRGP codes with redundancy $O(t\sqrt{N})$. This is known to be tight for $t=2$ [RV16, Woo16], but no better lower bound is known.222When the size $s$ of the repair groups is bounded, it is known that the redundancy must be at least $\Omega(N\ln(t)/s)$ [TBF16]. When $t=\Omega(N)$ is very large, constructing codes with the $t$-DRGP is equivalent to constructing constant-query LCCs, and it is known that the rate of the code must tend to zero [Woo10]. On the other hand, for any $\epsilon>0$, when $t=O(N^{1-\epsilon})$ is just slightly smaller, then work on high-rate LCCs [KSY14, GKS13, HOW15, KMRS16] (see also [AY19]) imply that there are codes with rate $0.99$ (or any constant less than $1$) with the $t$-DRGP.333In fact we may even take $\epsilon$ slightly sub-constant using the construction of [KMRS16].

When $t=\sqrt{N}$, there are a few constructions known that beat the $O(t\sqrt{N})$ bound mentioned above, including difference-set codes (see, e.g., [LC01]) and, relevant for us, lifted parity-check codes [GKS13]. These constructions achieve redundancy $N^{\log_{4}(3)}\approx N^{0.79}$ when $t=\sqrt{N}$. In Appendix B, we include a new proof of the fact that the lifted codes of [GKS13] have this redundancy using a dual view of lifted codes.

When $t<\sqrt{N}$, there is only one construction known which beats the $O(t\sqrt{N})$ bound, due to [FGW17]. For the special case of $t=N^{1/4}$, they give a construction based on “partially lifted codes” which has redundancy $O(N^{0.72})=O(t^{0.88}\sqrt{N})$.

1.1.2 Lifting and multiplicity codes

Lifted multiplicity codes are based on lifted codes and multiplicity codes, both of which have a long history in the study of locality in error correcting codes.

Lifted Codes.

Lifting was introduced by Guo, Kopparty and Sudan in [GKS13]. The basic idea can be illustrated by Reed-Solomon (RS) codes. An RS code of degree $d$ over $\mathbb{F}_{q}$ is the code

[TABLE]

where $x_{1},\ldots,x_{q}$ are the elements of $\mathbb{F}_{q}$. There is a natural multi-variate version of RS codes, known as Reed-Muller codes:

[TABLE]

where $\mathbf{x}_{1},\ldots,\mathbf{x}_{q^{m}}$ are the elements of $\mathbb{F}_{q}^{m}$. Reed-Muller codes have a very nice locality property, which is that the restriction of a RM codeword to a line in $\mathbb{F}_{q}^{m}$ yields an RS codeword. This fact has been taken advantage of extensively in applications like local decoding, local list-decoding and property testing. However, RM codes have a downside, which is that if $d<q$ (required for the above property to kick in), they have very low rate. With this inspiration, we could ask for the set $\mathcal{C}$ which contains evaluations of all $m$-variate polynomials which restrict to low-degree univariate polynomials on every line. Surprisingly, [GKS13] showed that this set $\mathcal{C}$ can be much larger than the corresponding RM code! This code $\mathcal{C}$ is called a *lifted *Reed-Solomon code, and the main structural result of [GKS13] is that $\mathcal{C}$ is the span of the monomials whose restrictions to lines are low-degree. This property is key when analyzing the rate of these codes. Moreover [GKS13] showed that this is the case when we begin with *any *affine-invariant code, not just RS codes.

The original motivation for lifted codes was to construct LCCs, but [GKS13] actually also give a code with the $\sqrt{N}$-DRGP, mentioned above; we give an alternate proof that this construction has the $\sqrt{N}$-DRGP in Appendix B. A variant of lifting was also used in [FGW17] to construct $N^{1/4}$-DRGP codes; however, the analysis of this construction is quite brittle and seems difficult to extend to non-trivial constructions for $t\neq N^{1/4}$.

Multiplicity Codes.

Multiplicity codes were introduced by Kopparty, Saraf and Yekhanin [KSY14] with the goal of constructing high-rate LCCs. The basic idea of multiplicity codes is to get around the low rate of RM codes discussed above in a different way, by appending derivative information to allow for higher-degree polynomials. That is, it is not useful to have an RS code with degree $d>q$, since $x^{q}=x$ for any $x\in\mathbb{F}_{q}$. However, if we replace the single evaluation $f(x)$ with a vector of evaluations $(f(x),f^{(1)}(x),\ldots,f^{(r-1)}(x))$, where $f^{(i)}$ denotes the $i$’th derivative, then it does make sense to take $d>q$. The $m$-variate multiplicity code $\mathsf{Mult}_{d,q,m,r}$ of degree $d$ and order $r$ over $\mathbb{F}_{q}$ is then defined similarly to $\mathsf{RM}_{d,q,m}$:

[TABLE]

where $f^{(<r)}(\mathbf{x})\in\mathbb{F}_{q}^{{m+r-1\choose m}}$ is a vector containing all of the partial derivatives of $f$ of order less than $r$, evaluated at $\mathbf{x}$. Since their introduction, multiplicity codes have found several uses beyond LCCs, including list-decoding [Kop15a, GW13], and have even been used to explicitly construct codes with the $t$-DRGP [AY19].

Lifted Multiplicity Codes.

To the best of our knowledge, the only work to study lifted multiplicity codes is the work of Wu [Wu15]. The goal of that work is to obtain versions of multiplicity codes which are still high-rate LCCs but which require lower-order derivatives than the construction of [KSY14]. The main result in [Wu15] is that lifted multiplicity codes of rate $1-\alpha$ are LCCs with locality $N^{\epsilon}$ (this corresponds roughly to having the $t$-DRGP with $t=O(N^{1-\epsilon})$). However, since the number of variables in the lift is large, it is hard to get a very precise handle on the codimension.

In comparison, in our work, we focus on the $t$-DRGP for $t\leq\sqrt{N}$, but where our goal is to get much tighter bound on the codimension of the code. We address the quantitative comparison between our bound on the rate and that obtainable by the techniques of [Wu15] in Remark 4.5.

We note that the construction in [Wu15] is similar to the construction presented here. Since this construction is somewhat non-trivial (for reasons discussed below), we include the details.

Why only bivariate lifts?

In contrast to [Wu15], we study *bivariate *lifts of multiplicity codes. By focusing only on bivariate lifts (as was also done in [FGW17]), we obtain a more precise handle on the codimension of lifted multiplicity codes, which gives results for the $t$-DRGP for $t\leq\sqrt{N}$. (See Remark 4.6 for more on why bivariate lifts make it much easier to analyze the codimension.) We believe that this wide range of $t$ is interesting, and thus we think that bivariate lifts are worth focusing on.

We expect that lifted multiplicity codes can be analyzed over more variables. However, we expect that this will not improve the tradeoff between the redundancy and $t$ (the number of repair groups) for the setting $t\leq\sqrt{N}$. Indeed, this tradeoff becomes worse for ordinary multiplicity codes [AY19]: for these codes, a larger number of variables yields better bounds only for larger values of $t$. In general, $m$-variable lifted multiplicity codes can have up to $q^{m-1}=N^{(m-1)/m}$ disjoint repair groups, so $\lceil{1/\varepsilon}\rceil$ variables are needed for $N^{1-\varepsilon}$ repair groups. For $N^{(m-2)/(m-1)}\leq t\leq N^{(m-1)/m}$, we expect that the number of variables that gives the best rate for lifted multiplicity codes is $m$. We leave the analysis for more variables $m$ this for future work (see Section 6).

1.2 Our approach

We study lifted multiplicity codes to obtain improved constructions of codes with the $t$-DRGP. We focus on bivariate lifts in this paper in order to obtain codes with $t$-DRGP for $t\leq\sqrt{N}$. We expect that lifted multiplicity codes in more than two variables also give better codes for the $t$-DRGP when $t>\sqrt{N}$.

1.2.1 Definition of lifted multiplicity codes

It is not immediately obvious how to apply lifting (and in particular, the nice characterization of it developed in [GKS13] as the span of “good” monomials) to univariate multiplicity codes. We first note that the univariate multiplicity code $\mathsf{Mult}_{d,q,1,r}\subseteq\left(\mathbb{F}_{q}^{r}\right)^{q}$ does not fit the affine-invariant framework of [GKS13], so their results do not immediately apply. Instead, we might try to define the bivariate lift of $\mathsf{Mult}_{d,q,1,r}$ as the set of vectors $(f^{(<r)}(\mathbf{x}_{1}),\ldots,f^{(<r)}(\mathbf{x}_{q^{2}}))$ for all polynomials $f$ so that every restriction of $f$ to a line agrees with some polynomial of degree less than $d$ on its first $r-1$ derivatives; that is, the restriction of $f$ is *equivalent up to order $r$ *to a polynomial of degree less than $d$. This works, but there are two non-trivial things to deal with.

First, in order to get a handle on the rate of the code, as in [GKS13] we show that the set of valid polynomials $f$ includes the span of a large set of “good” monomials. In contrast to [GKS13], the good monomials in this work do not span the entire code. However, lower bounding the number of good monomials, which in turns gives a lower bound on the rate of the code, turns out to be enough for our results. 2. 2.

Second, we need to take some care about what monomials we allow. With lifted RS codes, one only allows monomials $X^{a}Y^{b}$ with individual degrees $a,b<q$; otherwise, we could have multiple monomials which correspond to the same codeword which leads to problems if we are counting monomials in order to understand the dimension of the code. As we show in Lemma 3.5, it turns out that with multiplicity codes, we should only allow monomials $X^{a}Y^{b}$ with $\lfloor a/q\rfloor+\lfloor b/q\rfloor<r$; otherwise, we would have multiple monomials the correspond to the same codeword and this would create similar problems.

Dealing with these issues leads us to the final code and rate analysis, where we define the lifted multiplicity code to be all polynomials spanned by monomials $X^{a}Y^{b}$ with $\lfloor a/q\rfloor+\lfloor b/q\rfloor<r$, such that the restriction of the polynomial to a line is equivalent up to order $r$ to some univariate polynomial of degree less than $d$. We then lower bound the number of evaluations of monomials in this code, giving a lower bound on the rate. We note that the work [Wu15] considers a similar construction.

1.2.2 Lifted multiplicity codes have the $t$-DRGP

In Corollary 4.3 we give a lower bound on the number of $(q,r,d)$-good monomials, and this leads to a lower bound on the dimension of the lifted multiplicity code; crucially, this can be quite a bit bigger than the dimension of the corresponding multivariate multiplicity code.

Finally, we observe that lifted multiplicity codes have the $t$-DRGP for a range of values of $t$. Similarly to previous constructions based on multivariate polynomial codes, the disjoint repair groups to recover the symbol $f^{(<r)}(\mathbf{x})$ are given by disjoint collections of lines through $\mathbf{x}$. More precisely, the values $f^{(<r)}(\mathbf{y})$ for the set of $\mathbf{y}$ that lie on $r$ distinct lines through $\mathbf{x}$ can be used to recover $f^{(<r)}(\mathbf{x})$. Thus, the number of disjoint repair groups is $q/r=\sqrt{N}/r$. By adjusting $r$, we obtain the trade-off shown in Figure 1. Our main theorem is as follows.

Theorem 1.2**.**

For $q=2^{\ell}$ and $r=2^{\ell^{\prime}}$ with $1\leq\ell^{\prime}\leq\ell$, there exists a code $\mathcal{C}$ over $\mathbb{F}^{\binom{r+1}{2}}_{q}$ with the following properties.

• •

The length of the code is $q^{2}$.

• •

The rate of the code is at least

[TABLE]

so that the redundancy is at most

[TABLE]

• •

The code has the $q/r$-disjoint repair group property.

As a remark, our techniques can also recover any symbol from any one of its repair groups in polynomial time. For any $\gamma\in[0,1]$, choosing $q=2^{\ell}$ and $r=2^{\ell^{\prime}}$ with $\gamma\approx\ell^{\prime}/\ell$ gives a code with length $N=q^{2}$ and redundancy at most

[TABLE]

with the $N^{(1-\gamma)/2}$-DRGP. This is made formal in the following corollary.

Corollary 1.3**.**

For any $\epsilon\in(0,\frac{1}{2})$, there are infinitely many $N$ so that, for $t=\left\lfloor N^{\epsilon}\right\rfloor$, there exists a code of length $N$ which has the $t$-DRGP and redundancy at most $6t^{\log_{2}(3)-1}\sqrt{N}.$

We note that Theorem 1.2 also yields results for constant $t$, not just for $t=N^{\epsilon}$ as presented in Corollary 1.3. For example, by setting $r=q/2$ we obtain a code with the $2$-DRGP and redundancy at most $9\sqrt{N}$. The constant $9$ is not optimal here (the optimal constant for $t=2$ is known to be $\sqrt{2}$ [RV16]), but to the best of our knowledge, Theorem 1.2 does yield the best known bounds for any super-constant $t$.

The codes in Theorem 1.2 and Corollary 1.3 have the disadvantage of having a large alphabet size. Indeed, we have $r=q/t$, and so the alphabet size is $Q=q^{\binom{r+1}{2}}=N^{\Theta(N/t^{2})}$, which is very large. It is an interesting question to obtain the results of Corollary 1.3 with a code over a smaller alphabet (see open questions in Section 6). Among the existing work in Figure 1, [GKS13, FVY15, FGW17] all have $\mathrm{poly}(N)$ or smaller sized alphabets.

For now, we observe as in [AY19] that, if $\mathcal{C}$ is a code with the $t$-DRGP, then replacing $\mathcal{C}$ with a binary code $\mathcal{C}^{\prime}$, where each symbol in each codeword is replaced with $\log(Q)$ binary bits, yields a code that also has the $t$-DRGP. As a result, applying this to the code in Corollary 1.3 yields a code with length $N_{bin}=N\log(Q)=N^{2-2\varepsilon}$ and redundancy $O(t^{\log_{2}(3/2)}\sqrt{N}\log(Q))=O(N^{3/2+\varepsilon\log_{2}(3/8)}\log N)$.

Corollary 1.4**.**

For any $\epsilon\in(0,\frac{1}{2})$, there are infinitely many $N$ so that, for $t=\left\lfloor N^{\frac{\epsilon}{2-2\varepsilon}}\right\rfloor$, there exists a binary code of length $N$ which has the $t$-DRGP and redundancy at most $\tilde{O}(N^{\frac{3/2+\varepsilon\log_{2}(3/8)}{2-2\varepsilon}})$.

Among codes with alphabet size $\mathrm{poly}(N)$ or smaller, our binary codes give the best known tradeoff between $t$ and redundancy when $N^{1/4}<t<N^{1/2}$ (at $t=N^{1/4}$ [FGW17] gives a better redundancy).

2 Preliminaries

In this section, we introduce the background we need on polynomials and derivatives over finite fields. Throughout this paper, we assume that $q$ is a power of 2. Let $\mathbb{F}_{q}$ denote the finite field of order $q$, and let $\mathbb{F}_{q}^{*}$ denote its multiplicative subgroup.

If $a$ and $b$ are nonnegative integers with binary representations $a=\overline{a_{\ell-1}\cdots a_{0}}$ and $b=\overline{b_{\ell-1}\cdots b_{0}}$, then we write $a\leq_{2}b$ if $a_{i}\leq b_{i}$ for $i=0,\dots,\ell-1$. If $a$ is an integer, let $(a\mod c)$ denote the element of $\{0,\dots,c-1\}$ congruent to $a$ mod $c$. We write $a\leq_{2}^{\ell}b$ if $(a\mod 2^{\ell})\leq_{2}(b\mod 2^{\ell})$.

As in [GKS13], we use Lucas’s theorem.

Proposition 2.1** (Lucas’s theorem).**

Let $p$ be a prime and $a=\overline{a_{\ell-1}\cdots a_{0}},b=\overline{b_{\ell-1}\cdots b_{0}}$ be written in base $p$. Then

[TABLE]

In particular, if $p=2$, then $\binom{a}{b}\equiv 1\mod p$ if and only if $b\leq_{2}a$.

2.1 Polynomials and derivatives

For a vector $\textnormal{{i}}=(i_{1},\dots,i_{m})$ of nonnegative integers, its weight, denoted $\textnormal{wt}(\textnormal{{i}})$, equals $\sum_{k=1}^{m}i_{k}$. For a field $\mathbb{F}$, let $\mathbb{F}[X_{1},\dots,X_{m}]=\mathbb{F}[\textnormal{{X}}]$ be the ring of polynomials in the variables $X_{1},\dots,X_{m}$ with coefficients in $\mathbb{F}$. For a vector of nonnegative integers $\textnormal{{i}}=(i_{1},\dots,i_{m})$ and a vector $\textnormal{{X}}=(X_{1},\dots,X_{m})$ of variables, let $\textnormal{{X}}^{\textnormal{{i}}}$ denote the monomial $\prod_{j=1}^{m}X_{j}^{i_{j}}\in\mathbb{F}[\textnormal{{X}}]$, and for a vector $\textnormal{{a}}=(\alpha_{1},\dots,\alpha_{m})\in\mathbb{F}^{m}$, let $\textnormal{{a}}^{\textnormal{{i}}}$ denote the value $\prod_{j=1}^{m}\alpha_{j}^{i_{j}}$, where $0^{0}\stackrel{{\scriptstyle\rm def}}{{=}}1$. For nonnegative vectors $\textnormal{{i}}=(i_{1},\dots,i_{m})$ and $\textnormal{{j}}=(j_{1},\dots,j_{m})$, we write $\textnormal{{i}}\leq\textnormal{{j}}$ if $i_{k}\leq j_{k}$ for all $k$. We also write $\binom{\textnormal{{i}}+\textnormal{{j}}}{\textnormal{{i}}}$ to denote $\prod_{k=1}^{m}\binom{i_{k}+j_{k}}{i_{k}}$. For nonnegative vector i, we let $[\textnormal{{X}}^{\textnormal{{i}}}]P(\textnormal{{X}})$ denote the coefficient of $\textnormal{{X}}^{\textnormal{{i}}}$ in the polynomial $P(\textnormal{{X}})$.

We will use Hasse derivatives, a notion of derivatives over finite fields:

Definition 2.2** (Hasse derivatives).**

For $P(\textnormal{{X}})\in\mathbb{F}[\textnormal{{X}}]$ and a nonnegative vector i, the i-th (Hasse) derivative of $P$, denoted $P^{(\textnormal{{i}})}(\textnormal{{X}})$ or $D^{(\textnormal{{i}})}P(\textnormal{{X}})$, is the coefficient of $\textnormal{{Z}}^{\textnormal{{i}}}$ in the polynomial $\tilde{P}(\textnormal{{X}},\textnormal{{Z}})\stackrel{{\scriptstyle\rm def}}{{=}}P(\textnormal{{X}}+\textnormal{{Z}})\in\mathbb{F}[\textnormal{{X}},\textnormal{{Z}}]$. Thus,

[TABLE]

For $\mathbf{x}\in\mathbb{F}_{q}^{m}$ and $P(X)\in\mathbb{F}_{q}[\textnormal{{X}}]$, we use the notation $P^{(<r)}(\mathbf{x})\in\mathbb{F}_{q}^{{m+r-1\choose m}}$ to denote the vector containing $P^{(\mathbf{i})}(\mathbf{x})$ for all $\mathbf{i}$ so that $\textnormal{wt}(\mathbf{i})<r$. We record a few useful (well-known) properties of Hasse derivatives below (see [HKT08]).

Proposition 2.3** (Properties of Hasse derivatives).**

Let $P(\textnormal{{X}}),Q(\textnormal{{X}})\in\mathbb{F}[\textnormal{{X}}]$ and let $\textnormal{{i}},\textnormal{{j}}$ be vectors of nonnegative integers. Then

$P^{(\textnormal{{i}})}(\textnormal{{X}})+Q^{(\textnormal{{i}})}(\textnormal{{X}})=(P+Q)^{(\textnormal{{i}})}(\textnormal{{X}})$. 2. 2.

$(P\cdot Q)^{(\textnormal{{i}})}(\textnormal{{X}})=\sum_{0\leq\textnormal{{e}}\leq\textnormal{{i}}}P^{(\textnormal{{e}})}(\textnormal{{X}})\cdot Q^{(\textnormal{{i}}-\textnormal{{e}})}(\textnormal{{X}})$. 3. 3.

$(P^{(\textnormal{{i}})})^{(\textnormal{{j}})}(\textnormal{{X}})=\binom{\textnormal{{i}}+\textnormal{{j}}}{\textnormal{{i}}}P^{(\textnormal{{i}}+\textnormal{{j}})}(\textnormal{{X}})$.

Using the above, we obtain the following useful derivative computation, and we provide a proof in Appendix A for completeness.

Proposition 2.4**.**

Let $1\leq r<q$ with $q$ a power of 2, and let $P(X)=(X^{q}-X)^{r}$. Then,

[TABLE]

2.2 Polynomial local recovery

A key property exploited by earlier work on multiplicity codes [KSY14, Kop15b] is that $f^{(<r)}(\mathbf{x})$ can be recovered from $f^{(<q)}(\mathbf{y})$ for $\mathbf{y}$ that lie on a collection of lines through $\mathbf{x}$. More precisely, let $\mathcal{L}_{m}$ be the set of lines $L(T)$ of the form $\textnormal{{a}}T+\textnormal{{b}}$ with $\textnormal{{a}},\textnormal{{b}}\in\mathbb{F}_{q}^{m}$. Given a multivariate polynomial $P(\textnormal{{X}})\in\mathbb{F}_{q}[X_{1},\dots,X_{m}]$, if $L$ is the line $\textnormal{{a}}T+\textnormal{{b}}$, let $P_{L}(T)\in\mathbb{F}_{q}[T]$ denote the univariate polynomial $P(\textnormal{{a}}T+\textnormal{{b}})$. Let $\mathcal{L}$ be the set of lines in $\mathbb{F}_{q}^{2}$ of the form $L(T)=(T,\alpha T+\beta)$ for $\alpha,\beta\in\mathbb{F}_{q}$.

For simplicity—and because it is enough for our application to the $t$-DRGP—we will consider only bivariate polynomials in this paper, although (see for example [Kop15b]) the same basic idea works for any $m$. We will further specialize to lines in $\mathcal{L}$—that is, lines of the form $L(T)=(T,\alpha T+\beta)$—because it will simplify some computations later in the paper. With these restrictions, we can specialize Equation (4) of [Kop15b] to obtain the following relationship between the derivatives of $P_{L}(T)$ and the derivatives of $P(X,Y)$.

Lemma 2.5** (Follows from, e.g., [KSY14, Kop15b]).**

Suppose that $L_{1},\dots,L_{r}$ are $r$ lines in $\mathcal{L}$ all passing through a point $(\gamma,\delta)$, with $L_{i}$ being the line $(T,\alpha_{i}T+\beta_{i})$. Then, for all polynomials $P(X,Y)\in\mathbb{F}_{q}[X,Y]$, the following matrix equality holds for all $i=0,\dots,r-1$.

[TABLE]

When lines $L_{1},\ldots,L_{i}$ are distinct, the middle matrix in (4) is a Vandermonde matrix, and Vandermonde matrices are invertible in polynomial time. Hence, we immediately have the following corollary.

Corollary 2.6**.**

Suppose that $L_{1},\dots,L_{r}$ are $r$ distinct lines of the form $L_{k}(T)=(T,\alpha_{k}T+\beta_{k})$ all passing through a point $(\gamma,\delta)\in\mathbb{F}_{q}^{2}$. For a polynomial $P(X,Y)\in\mathbb{F}_{q}[X,Y]$, given the polynomials $P_{L_{1}}(T),\dots,P_{L_{k}}(T)$, the derivatives $P^{(\textnormal{{i}})}(\gamma,\delta)$ are uniquely determined and computable efficiently for all i such that $\textnormal{wt}(\textnormal{{i}})<r$.

3 Lifted multiplicity codes

In this section, we define lifted multiplicity codes. As noted in the introduction, we restrict our attention to bivariate codes because this is enough for our application to the $t$-DRGP. However, everything in this section extends to general $m$-variate codes. We define bivariate lifted multiplicity codes as the vectors $(f^{(<r)}(\mathbf{x}))_{\mathbf{x}\in\mathbb{F}_{q}^{2}}$ for polynomials $f(X)$ that live in the span of “good” monomials. In order to define these “good” monomials, we need a few more definitions.

3.1 Polynomial equivalence

We first define a notion of polynomial equivalence.

Definition 3.1**.**

We say that two univariate polynomials $A(X),B(X)\in\mathbb{F}_{q}[X]$ are equivalent up to order $r$, written $A\equiv_{r}B$, if $A^{(i)}(\gamma)=B^{(i)}(\gamma)$ for all $i=0,\dots,r-1$ and $\gamma\in\mathbb{F}_{q}$.

It is easy to see that the above definition does in fact give an equivalence relation. We now present two standard results regarding this equivalence relation. The first is a characterization of this equivalence.

Lemma 3.2**.**

For $A(X),B(X)\in\mathbb{F}_{q}[X]$ we have $A(X)\equiv_{r}B(X)$ if and only if $(X^{q}-X)^{r}|A(X)-B(X)$.

Proof.

By considering the polynomial $A(X)-B(X)$, it suffices to prove $A(X)$ is equivalent to the zero polynomial up to order $r$ if and only if $(X^{q}-X)^{r}|A(X)$. If $A(X)=(X^{q}-X)^{r}C(X)$ for some polynomial $C(X)\in\mathbb{F}_{q}[X]$, then, by part 2 of Proposition 2.3 and Proposition 2.4, for $0\leq i<r$, we have $X^{q}-X|A^{(i)}(X)$, so $A^{(i)}(\gamma)=0$ for all $0\leq i<r$ and all $\gamma\in\mathbb{F}_{q}$, so $A(X)\equiv_{r}0$.

Conversely, suppose that $A(X)\equiv_{r}0$. By the definition of Hasse derivatives, we have $A(X)=A(\gamma+(X-\gamma))=\sum_{i}A^{(i)}(\gamma)(X-\gamma)^{i}$. Since $A^{(i)}(\gamma)=0$ for $i=0,\dots,r-1$, we have $(X-\gamma)^{r}|A(X)$. Thus is true for all $\gamma$, so $\prod_{\gamma}(X-\gamma)^{r}|A(X)$, so $(X^{q}-X)^{r}|A(X)$. ∎

Lemma 3.2 gives the following corollary.

Lemma 3.3**.**

Let $q$ be a power of 2 and $r\geq 1$. For every univariate polynomial $A(X)$, there exists a unique degree-at-most $rq-1$ polynomial $B(X)$ such that $A(X)\equiv_{r}B(X)$. Furthermore, if $r$ is a power of 2, then for all $a$ such that $\deg A-(qr-r)<a<qr$, we have $[X^{a}]A(X)=[X^{a}]B(X)$.

Proof.

For existence of $B(X)$, note that, by Lemma 3.2, we can take $B(X)$ to be the remainder when $A(X)$ is divided by $(X^{q}-X)^{r}$. For uniqueness of $B(X)$, suppose that $B_{1}(X)$ and $B_{2}(X)$ are equivalent to $A(X)$ up to order $r$ and are of degree at most $rq-1$. By Lemma 3.2, we have $(X^{q}-X)^{r}|B_{1}(X)-B_{2}(X)$. Additionally, $B_{1}(X)-B_{2}(X)$ has degree at most $rq-1$, so $B_{1}(X)-B_{2}(X)=0$.

Now suppose $r$ is a power of 2. Then $(X^{q}-X)^{r}=X^{rq}+X^{r}$. Above, to obtain $B(X)$ from $A(X)$, we need only to subtract terms of the form $X^{qr}+X^{r},X^{qr+1}+X^{r+1},\dots,X^{\deg A}+X^{\deg A-qr+r}$. Thus, for $a$ such that $\deg A-qr+r<a<qr$, the coefficients of $X^{a}$ in $A(X)$ and $B(X)$ are equal. ∎

3.2 Type-$r$ polynomials

Define the order-$r$ evaluation map $\textnormal{eval}_{q,r}:\mathbb{F}_{q}[X,Y]\to\left(\mathbb{F}_{q}^{\binom{r+1}{2}}\right)^{q^{2}}$ by

[TABLE]

We will want to restrict our attention to a subset of monomials $M(X,Y)=X^{a}Y^{b}$ whose order-$r$ evaluations $\textnormal{eval}_{q,r}(M)$ form a basis for the space $\{\textnormal{eval}_{q,r}(P)\,:\,P\in\mathbb{F}_{q}[X,Y]\}$. To that end, we introduce the following definition.

Definition 3.4** (Type-$r$ monomials).**

Call a monomial $X^{a}Y^{b}$ type-$r$ if $\lfloor{a/q}\rfloor+\lfloor{b/q}\rfloor\leq r-1$. Let $\mathcal{F}_{q,r}$ be the family of polynomials $P\in\mathbb{F}_{q}[X,Y]$ that are spanned by type-$r$ monomials.

It is easy to see that $\mathcal{F}_{q,r}$ is a dimension $\binom{r+1}{2}q^{2}$ vector space over $\mathbb{F}_{q}$. We now show that the type-$r$ polynomials form a basis for bivariate polynomials, up to order $r$ equivalence. We note that Lemma III.1 of [Wu15] claims a similar statement, with a different argument.

Lemma 3.5**.**

The evaluation map $\textnormal{eval}_{q,r}:\mathcal{F}_{q,r}\to\left(\mathbb{F}_{q}^{\binom{r+1}{2}}\right)^{q^{2}}$ is a bijection.

Proof of Lemma 3.5.

Since $\textnormal{eval}_{q,r}$ is a linear map and $\mathcal{F}_{q,r}$ and $\mathbb{F}_{q}^{\binom{r+1}{2}q^{2}}$ have the same $\mathbb{F}_{q}$ dimension, it suffices to prove the map has trivial kernel. We prove by induction.

Base Case: $r=1$. Suppose $P\in\mathcal{F}_{q,1}$ and $\textnormal{eval}_{q,1}(P)$ is the 0-vector. Then $P(X,Y)=0$ for all $X,Y$. For any $\delta\in\mathbb{F}_{q}$, the polynomial $P(X,\delta)\in\mathbb{F}_{q}[X]$ has degree at most $q-1$ but has $q$ roots, so the polynomial must be 0. Hence, $(Y-\delta)|P(X,Y)$ for all $\delta$, so $(Y^{q}-Y)|P(X,Y)$, which implies $P=0$. This proves that $\textnormal{eval}_{q,1}$ has trivial kernel.

Inductive step: Assume $r\geq 1$ and $\textnormal{eval}_{q,r}$ has trivial kernel. We prove that $\textnormal{eval}_{q,r+1}$ has trivial kernel.

Assume $P(X,Y)$ is a polynomial spanned by type-$(r+1)$ monomials with all ith derivatives equal to 0 for $\textnormal{wt}(\textnormal{{i}})<r+1$. Let $\delta\in\mathbb{F}_{q}$ and $B_{\delta}(X)\stackrel{{\scriptstyle\rm def}}{{=}}P(X,\delta)$. Then, for $0\leq i<r$, we have $B_{\delta}^{(i)}(\gamma)=P^{(i,0)}(\gamma,\delta)=0$ for all $\gamma\in\mathbb{F}_{q}$. Hence, for all $\gamma\in\mathbb{F}_{q}$, we have $(X-\gamma)^{r}|B_{\delta}(X)$. Hence, $(X^{q}-X)^{r}|B_{\delta}(X)$. Since $\deg B_{\delta}(X)\leq\deg_{X}P(X,Y)<qr$ for all $\delta$, we have $B_{\delta}(X)=0$. Thus, $P(X,\delta)$ is the 0 polynomial for all $\delta$, so $(Y-\delta)|P(X,Y)$ for all $\delta$, so $(Y^{q}-Y)|P(X,Y)$. Hence, we may write $P(X,Y)=(Y^{q}-Y)Q(X,Y)$ for some polynomial $Q(X,Y)\in\mathbb{F}_{q}[X,Y]$.

As polynomial $P$ is type-$(r+1)$, polynomial $Q$ is type-$r$: if $Q$ had a nonzero coefficient for $X^{a}Y^{b}$ with $\lfloor{a/q}\rfloor+\lfloor{b/q}\rfloor>r-1$, then the coefficient $X^{a}Y^{b+q}$ is nonzero in $P$, which is a contradiction. For all $i,j$ with $i\geq 0,j\geq 1$ and $i+j\leq r$, we have

[TABLE]

Here we applied part 2 of Proposition 2.3 and the $r=1$ case of Proposition 2.4. At every $X$ and $Y$, the left side is 0 by assumption on $P$ and the right side $Q^{(i,j-1)}(X,Y)$. We conclude that $Q^{(i^{\prime},j^{\prime})}$ evaluates to 0 everywhere for every nonnegative $i^{\prime}$ and $j^{\prime}$ satisfying $i^{\prime}+j^{\prime}\leq r-1$. Since $Q$ is type-$r$, we have $Q=0$ by the induction hypothesis, so $P=0$. This completes the induction, completing the proof. ∎

3.3 Definition of lifted multiplicity codes

Finally we are ready to define lifted multiplicity codes, which we define as the set of evaluations $\textnormal{eval}_{q,r}(P)$ of polynomials whose restrictions to lines444To simplify calculations, we consider restrictions to lines of the form $L(T)=(T,\alpha T+\beta)$. That is, we do not include lines of the form $L(T)=(\alpha,T)$. are equivalent, up to order $r$, to a low degree polynomial:

Definition 3.6** (Lifted multiplicity codes, first definition).**

The $(q,r,d)$ (bivariate) lifted multiplicity code is a code $\mathcal{C}$ over alphabet $\Sigma=\mathbb{F}_{q}^{\binom{r+1}{2}}$ of length $q^{2}$ given by

[TABLE]

Definition 3.6 is natural but difficult to get a handle on directly. Following the approach of previous work [GKS13, FGW17], we show that lifted multiplicity code contains the set of vectors $\textnormal{eval}_{q,r}(P)$ for $P$ that lie in the span of a set of “good” monomials, which makes it easier to bound the rate. Informally, a monomial is $(q,r,d)$-good if its restriction along every line is equivalent, up to order $r$, to a polynomial of degree less than $d$.

Definition 3.7** ($(q,r,d)$-good monomials).**

Call a monomial $M_{a,b}(X,Y)=X^{a}Y^{b}\in\mathbb{F}_{q}[X,Y]$ $(q,r,d)$-good (or simply good, when $r$ and $d$ are understood) if it is type-$r$ and for every line $(T,\alpha T+\beta)\in\mathcal{L}$, the univariate polynomial $M_{a,b}(T,\alpha T+\beta)$ is equivalent, up to order $r$, to polynomial of degree less than $d$, and call it $(q,r,d)$-bad otherwise.

By definition all good monomials lie in our lifted multiplicity code, so to lower bound the rate of the code it suffices to lower bound the number of good monomials.

Lemma 3.8**.**

Let $\mathcal{C}$ be the bivariate $(q,r,d)$ lifted multiplicity code. Then, for every $(q,r,d)$-good monomial $M(X,Y)$, $\textnormal{eval}_{q,r}(M)\in\mathcal{C}$, and the rate of $\mathcal{C}$ is at least \frac{\#\text{(q,r,d)-good monomials}}{\binom{r+1}{2}q^{2}}.

Proof.

The first part follows from the definition of good monomial. For the second part, $\mathcal{C}$ is linear and the $\mathbb{F}_{q}$-span of all good monomials have pairwise distinct evaluations by Lemma 3.5, so |\mathcal{C}|\geq q^{(\#\text{(q,r,d)-good monomials})}. As $\mathcal{C}$ is a length $q^{2}$ code over an alphabet of size $|\Sigma|=q^{\binom{r+1}{2}}$, the rate is at least \frac{\log|\mathcal{C}|}{q^{2}\log|\Sigma|}=\frac{\#\text{(q,r,d)-good monomials}}{\binom{r+1}{2}q^{2}}. ∎

Remark 3.9**.**

A previous version of this paper incorrectly asserted that every codeword of the lifted multiplicity code is spanned by good monomials. As observed by Nikita Polianskii, this is in fact not true. For example, when $r=2$ and $d=2q-1$, the monomials $X^{2q-2}Y$ and $X^{q-1}Y^{q}$ are not $(q,r,d)$-good as verified by the line $(T,T)$, but their sum $X^{2q-2}Y+X^{q-1}Y^{q}$ is in the $(q,r,d)$-lifted multiplicity code: the restriction of the sum to a line $(T,\alpha T+\beta)\in\mathcal{L}$ has a $T^{2q-1}$ coefficient of $\alpha+\alpha^{q}=0$ and hence has degree strictly less than $d=2q-1$.

4 The rate of lifted multiplicity codes

In this section, we bound the rate (and hence, the redundancy) of lifted multiplicity codes. Our final result on the rate is Corollary 4.3 below, which implies that for $r,q$ and $d$ of an appropriate form, the lifted multiplicity code over order $r$ and degree $d$ over $\mathbb{F}_{q}$ has rate at least

[TABLE]

In the next section, we choose $d=qr-r$, which will yield a code of rate $1-\frac{6}{r}\left(\frac{r}{q}\right)^{\log_{2}(4/3)}$ and will give us Theorem 1.2.

Before we prove this result, we briefly compare our approach to more straightforward ones, and discuss why we are able to do better.

First, we discuss what might be a first strategy building on the analysis of [GKS13] for lifted Reed-Solomon codes. Similarly to that work, we want to show there are few bad monomials. We can show (after checking some conditions) that a monomial is bad if, restricted to some line, in the resulting univariate polynomial, one of the coefficients of $T^{qr-s},T^{qr-s+1},\dots,T^{qr-1}$ is nonzero. This corresponds to the analysis of lifted Reed-Solomon codes when $r=s=1$. For each $s^{\prime}=1,\dots,s$, similar to the analysis of the lifted Reed-Solomon code, we can bound the number of monomials that could cause the coefficient of $T^{rq-s^{\prime}}$ to be nonzero by $rq^{\log_{2}(3)}$. Using the union bound and summing these bounds gives a bound $rsq^{\log_{2}(3)}$ on the number of bad monomials for the lifted multiplicity code. However, when $r=s$ (the setting we will consider), this gives a rate of $1-q^{\log_{2}(3/4)}$. Thus, this yields a code with the same redundancy of $N^{\log_{4}(3)}$ as the lifted Reed-Solomon code, and we have made no improvement.

In order to do better, the key to our analysis is to observe that monomials that are bad for some $s^{\prime}$ are likely to be bad for another $s^{\prime\prime}$, so the union bound is wasteful. Instead, using some tricks with binary arithmetic (captured in Lemma 4.1), we are able to analyze together all the monomials that make any of the coefficients of $T^{rq-s},\dots,T^{rq-1}$ nonzero, giving a better bound.

Second, we compare our approach to the analysis of [Wu15], which also studies lifted multiplicity codes, but focuses on a different parameter regime (one where $t$ is much larger). As described more in Remark 4.5, the approach of [Wu15] does not yield anything better in the parameter regime that we consider ($t\leq\sqrt{N}$) than does the approach described above (or indeed even any better than standard (not lifted) multiplicity codes when $r\gg q^{1/23}$). The reason that we are able to do better than the straightforward argument above while the approach of [Wu15] does not is that [Wu15] uses a stricter requirement for a monomial to be good in [Wu15, Lemma III.3] than we do in our Lemma 4.2. Thus, the approach of [Wu15] counts a smaller number of good monomials and ends up with a weaker bound on the rate.

Now, we prove our result. We begin with a lemma that will be useful.

Lemma 4.1**.**

Let $s=2^{\ell_{s}}$ and $q=2^{\ell}$ with $\ell_{s}\leq\ell$. The number of $a_{1},b_{1}\in\{0,1,\dots,q-1\}$ such that at least one of the following is true

[TABLE]

is at most $2\cdot 3^{\ell}\cdot\left(4/3\right)^{\ell_{s}}=2\cdot 3^{\ell}\cdot s^{\log_{2}(4/3)}$.

Proof.

Suppose we write the numbers $(q-1-a_{1}\mod q),(q-2-a_{1}\mod q),\dots,(q-s-a_{1}\mod q)$ in binary with $\ell$ digits (possibly with leading zeros). As these number span $2^{\ell_{s}}$ consecutive integers mod $q$, when written in this binary form, their most significant $\ell-\ell_{s}$ coordinates take on at most 2 values. Let $a_{2}=\lfloor{\frac{(q-1-a_{1}\mod q)}{2^{\ell_{s}}}}\rfloor$ and $b_{2}=\lfloor{\frac{b_{1}}{2^{\ell_{s}}}}\rfloor$ so that $a_{2},b_{2}\in\{0,\dots,2^{\ell-\ell_{s}}-1\}$, and $a_{2}$ and $b_{2}$ are the most significant $\ell-\ell_{s}$ coordinates of $(q-1-a_{1}\mod q)$ and $b_{1}$, respectively, when written in $\ell$-digit binary. Then if one of the equations of (7) is true, then we must have either $a_{2}\leq_{2}b_{2}$ or $a_{2}-1\leq_{2}b_{2}$. This gives at most $2\cdot 3^{\ell-\ell_{s}}$ choices for the pair $(a_{2},b_{2})$. Given $a_{2}$ and $b_{2}$, there are $2^{\ell_{s}}$ choices for each of $a_{1}$ and $b_{1}$, for a total of at most $2\cdot 3^{\ell-\ell_{s}}\cdot 4^{\ell_{s}}$ solutions to (7). ∎

Lemma 4.2**.**

Let $r=2^{\ell_{r}}$, $s=2^{\ell_{s}}$ and $q=2^{\ell}$ with $\ell_{r},\ell_{s}\in\{1,\dots,\ell-1\}$. The number of $(q,r,rq-s)$-good monomials is at least $\binom{r+1}{2}4^{\ell}-3rs^{\log_{2}(4/3)}\cdot 3^{\ell}$.

Proof.

The number of type-$r$ monomials is $\binom{r+1}{2}q^{2}=\binom{r+1}{2}4^{\ell}$. A monomial $M_{a,b}$ is $(q,r,rq-s)$-good if, for every $\alpha,\beta\in\mathbb{F}_{q}$, we have

[TABLE]

can be represented as a polynomial of degree less than $rq-s$. Next, we apply Lemma 3.3, which says that there is a unique polynomial $B(T)$ so that $\deg(B)\leq rq-1$ so that $B(T)\equiv_{r}M_{a,b,\alpha,\beta}(T)$, and further that all of the coefficients $[T^{c}]B(T)$ for $\deg(M_{a,b,\alpha,\beta})-(qr-r)<c<qr$ are equal to the corresponding coefficient of $B(T)$. As $M_{a,b}$ is type $r$, we have $\lfloor{a/q}\rfloor+\lfloor{b/q}\rfloor<r$, so the degree of the polynomial $M_{a,b,\alpha,\beta}$ is at most $a+b\leq(r+1)q-2$, and

[TABLE]

for any allowed choice of $q,r,s$, so $[T^{c}]B(T)=[T^{c}]M_{a,b,\alpha,\beta}(T)$ for all $c$ so that

[TABLE]

Thus, to show that $B(T)$ has degree less than $qr-s$, it suffices to show that the coefficients of $T^{qr-s},T^{qr-s+1},\dots,T^{qr-1}$ in $M_{a,b,\alpha,\beta}$ are all zero.

Write $a=a_{0}q+a_{1}$ and $b=b_{0}q+b_{1}$ where $a_{0}+b_{0}\leq r-1$ and $0\leq a_{1},b_{1}\leq q-1$. Note that if $a_{0}+b_{0}<r-1$, then for $s^{\prime}=1,\dots,s$ coefficient $[T^{rq-s^{\prime}}]M_{a,b,\alpha,\beta}$ is always zero except possibly when $a_{0}+b_{0}=r-2$ and $a_{1}+b_{1}\geq 2q-s$. This can happen for at most $\frac{rs^{2}}{2}$ pairs $(a,b)$. Hence, for $a_{0}+b_{0}<r-1$, there are $\leq\frac{rs^{2}}{2}$ bad monomials $(a,b)$.

Now assume $a_{0}+b_{0}=r-1$. For $s^{\prime}=1,\dots,s$, the coefficient of $T^{rq-s^{\prime}}$ in $T^{a}(\alpha T+\beta)^{b}$ is 0 if $rq-s^{\prime}<a$ or $a+b<rq-s^{\prime}$. Otherwise, the coefficient is

[TABLE]

By Proposition 2.1, the binomial coefficient is nonzero (mod 2) if and only if $b_{0}q+q-s^{\prime}-a_{1}\leq_{2}b_{0}q+b_{1}$, which, as $q$ is a power of 2, happens only if $q-s^{\prime}-a_{1}\leq_{2}^{\ell}b_{1}$. Hence, if $a_{0}+b_{0}=r-1$, the monomial $M_{a,b}$ is $(r,rq-s)$-bad only if some $s^{\prime}=1,\dots,s$ satisfies $q-s^{\prime}-a_{1}\leq_{2}^{\ell}b_{1}$. Hence, by Lemma 4.1, for a fixed $a_{0},b_{0}$ with $a_{0}+b_{0}=r-1$, there are at most $2s^{\log_{2}(4/3)}3^{\ell}$ bad monomials $M_{a,b}$, so there are at most $r\cdot s^{\log_{2}(4/3)}3^{\ell}$ bad monomials $M_{a,b}$ over all $a_{0},b_{0}$ with $a_{0}+b_{0}=r-1$. As we showed, there are at most $\frac{rs^{2}}{2}$ bad monomials when $a_{0}+b_{0}<r-1$. Hence, there are at least $\binom{r+1}{2}4^{\ell}-2rs^{\log_{2}(4/3)}3^{\ell}-\frac{rs^{2}}{2}\geq\binom{r+1}{2}q^{2}-3rs^{\log_{2}(4/3)}q^{\log_{2}(3)}$ good monomials, as desired. ∎

Lemma 4.2 and Lemma 3.8 together imply Corollary 4.3, which in turn implies the informal result stated at the beginning of the section.

Corollary 4.3**.**

Let $r=2^{\ell_{r}}$, $s=2^{\ell_{s}}$ and $q=2^{\ell}$ with $\ell_{r},\ell_{s}\in\{1,\dots,\ell-1\}$. A $(q,r,rq-s)$ lifted multiplicity code has rate at least $1-6r^{-1}s^{\log_{2}(4/3)}q^{\log_{2}(3/4)}$.

Remark 4.4**.**

We apply Corollary 4.3 for $r=s\leq q$, giving that a lifted multiplicity code of rate at least $1-6r^{\log_{2}(2/3)}q^{\log_{2}(3/4)}$. By comparison [KSY14], a 2-variate multiplicity code of order $r$ evaluations of degree at most $rq-r$ polynomials over $\mathbb{F}_{q}$ has rate $\frac{\binom{rq-r+2}{2}}{\binom{r+1}{2}q^{2}}\leq 1-\Omega(\frac{1}{r})$, which is smaller than the rate of lifted multiplicity codes for $r\ll q$.

Remark 4.5** (Quantitative comparison to [Wu15]).**

The work [Wu15] also studies lifted multiplicity codes, but focuses on a different parameter regime than we focus on here (where $t$ is large, rather than $t\leq\sqrt{N}$). Perhaps because they focus on a different parameter regime, the approach of [Wu15] does not yield any nontrivial results in our parameter regime, and consequently our analysis of lifted multiplicity codes is much stronger.

For example, for degree $d=rq-r$ codes, [Wu15] bounds555 The details are as follows: using some notation from [Wu15], for a rate $1-\alpha$ code in our parameter regime, $n=2$ variables, a prime $p=2$, a parameter $b=\lceil{\log_{p}n}\rceil+1=2$, $q=p^{\ell}$, $r=p^{\ell_{r}}$ (they use $m$ for $r$, $s$ for $\ell$, and $t$ for $\ell_{r}$), $\alpha_{t}=\frac{\alpha}{1-\frac{N_{n}(p^{{\ell_{r}}-2})}{N_{n}(p^{\ell_{r}})}}=\frac{\alpha}{1-\frac{N_{2}(r/4)}{N_{2}(r)}}\approx\frac{\alpha}{1-1/16}=\Theta(\alpha)$ (here $N_{2}(r)\stackrel{{\scriptstyle\rm def}}{{=}}\binom{r+1}{2}$, and we assume $r\gg 1$), $c=bp^{bn}\ln\frac{1}{\alpha_{t}}+{\ell_{r}}=32\ln\frac{1}{\alpha_{t}}+\ell_{r}$, $d=(1-p^{-c})rq$. In our setting, we choose $d=rq-r$, which requires $p^{c}=q$, so $c=\ell$, so $\ell-\ell_{r}=32\ln\frac{1}{\alpha_{t}}=32\ln 2\cdot\log\frac{1}{\alpha}-O(1)$. Thus, $\alpha=\Theta(2^{(\ell_{r}-\ell)/(32\ln 2)})=(\frac{r}{q})^{1/(32\ln 2)}$.

the rate of the code below by $1-\Theta(\frac{r}{q})^{1/(32\ln 2)}$. This is a weaker bound than the straightforward bound of $1-q^{\log_{2}(3/4)}$ sketched at the beginning of this section, and significantly weaker than our bound in Corollary 4.3 of $1-6r^{\log_{2}(2/3)}q^{\log_{2}(3/4)}$ for all $r$ and $q$. Moreover, for $r\gg q^{1/23}$, the bound of [Wu15] is even weaker than the lower bound on the rate of (non-lifted) multiplicity codes, which is $1-\Omega(1/r)$.

Remark 4.6** (The value of bivariate lifts).**

In addition to likely giving better bounds than $m$-variate lifts (see Why only bivariate lifts? in Section 1.1), another reason that we study only bivariate lifts in this paper is that it makes the computations much more tractable. In the proof of Lemma 4.2, we study $M_{a,b,\alpha,\beta}(T)=(T^{a})(\alpha T+\beta)^{b}$, and expand out the terms to apply Lucas’s theorem. If we were to consider, say, trivariate lifts, we would have to expand expressions of the form $(T^{a})(\alpha T+\beta)^{b}(\gamma T+\delta)^{c}$, and it would become more complicated to keep track of the coefficients on various powers. Analyzing $m$-variate lifts would become more complicated still. In particular, it seems harder to get as tight a bound on the codimension of the code for $m$-variate lifts for $m>2$ as we are able to get for $m=2$. Given that we are already able to obtain good codes for bivariate lifts, we restrict our attention to this simpler case.

5 Disjoint repair groups of lifted multiplicity codes

Finally, we prove Theorem 1.2, which we repeat below.

Theorem** (Theorem 1.2, restated).**

Let $r=2^{\ell_{r}}$ and $q=2^{\ell}$ with $\ell_{r}<\ell$ and $\mathcal{C}$ be the $(q,r,rq-r)$ lifted multiplicity code.

• •

The length of the code is $q^{2}$.

• •

The rate of the code is at least $1-6r^{\log_{2}(2/3)}q^{\log_{2}(3/4)}$.

• •

The code has the $q/r$-disjoint repair group property.

Proof.

The first item follows from the definition of $\mathcal{C}$, and the second item is by Corollary 4.3. To see the third item, we observe that, given a point $(\gamma,\delta)\in\mathbb{F}_{q}^{2}$, lines $L_{1},\dots,L_{r}$ passing through $(\gamma,\delta)$, and $P^{(<r)}(\mathbf{y})$ at all points $\mathbf{y}$ on the lines $L_{1},\dots,L_{r}$ except $(\gamma,\delta)$ itself, we can (efficiently) recover $P^{(<r)}(\gamma,\delta)$. This guarantees the $q/r$-disjoint repair group property, because we can group the $q$ lines of $\mathcal{L}$ of the form $L(T)=(T,\alpha T+\beta)$ passing through $(\gamma,\delta)$ arbitrarily into groups of $r$, giving $q/r$ disjoint repair groups. For any line $L_{k}$, the polynomial $P_{L_{k}}(T)$ has degree at most $rq-r-1$, as $P$ is $(q,r,qr-r)$-good. By taking linear combinations of directional derivatives (Lemma 2.5), we can efficiently compute $P^{(i)}_{L_{k}}(\gamma^{\prime})$ for every $i=0,\dots,r-1$, every $k=1,\dots,r$, and every $\gamma^{\prime}\neq\gamma$. We can compute $P_{L_{k}}(T)$ using a generalization of polynomial interpolation. This can be done in $O(D\log D)$ time, where $D<rq$ is the degree of the polynomial (see e.g. [Chi76]) Hence, by Corollary 2.6, from $P_{L_{1}}(T),\dots,P_{L_{k}}(T)$, we can efficiently compute $P^{(i,j)}(\gamma,\delta)$ for all $i,j$ with $0\leq i+j\leq r-1$. ∎

6 Conclusion

We conclude with some open questions.

We have shown that lifted multiplicity codes with redundancy $O(t^{0.585}\sqrt{N})$ have the $t$-DRGP for a range of $t\leq\sqrt{N}$. However, we do not know of any general lower bounds when $t\in(1,\sqrt{N})$ beyond the lower bound for $t=2$, which implies that the redundancy must be at least $\Omega(\sqrt{N})$ for any $t$. When $t\geq\sqrt{N}$, there is a stronger redundancy lower bound of $\Omega(t)$, which holds simply because a code with the $t$-DRGP must have Hamming distance at least $t$. Thus, it is an open question whether or not our bound is tight or whether one can do better. 2. 2.

Lifted multiplicity codes display better locality for the $t$-DRGP problem for $t\leq\sqrt{N}$; it is a natural question to ask whether they can be used for larger $t$, and in particular whether they could lead to improved constructions of locally correctable codes. In particular, it would be interesting if lifted multiplicity codes could qualitatively out-perform (un-lifted) multiplicity codes as high-rate LCCs, for example by maintaining the high rate while achieving sub-polynomial query complexity.666As noted in the introduction, the work [Wu15] showed the lifted multiplicity codes are good LCCs with lower-order derivatives than were required by the (un-lifted) multiplicity codes of [KSY14], but it does not show how to improve the query complexity to sub-polynomial. We note that for the LCC problem, one typically does not care about pinning down the rate, so long as it is close to $1$, instead focusing on the query complexity. In contrast, in this work, we have focused on pinning down the rate much more precisely. 3. 3.

Related to the above, it would be natural to understand the rate and locality of lifted multiplicity codes over more than two variables. 4. 4.

The alphabet size of lifted multiplicity codes is $q^{\binom{r+1}{2}}$, which, if the multiplicity is $r=q^{\alpha}$ for a constant $\alpha>0$, is exponential type in the code length $q^{2}$. In practical applications, a smaller alphabet size is desirable. It would be interesting to achieve the results of Corollary 1.3 with a code whose length grows independently of the alphabet size. 5. 5.

In this paper, we studied the $t$-DRGP locality property, which requires that each symbol has many disjoint repair groups. Another common notion of locality is an Locally Recoverable Code (LRC) with locality $d$, which requires that each symbol has one repair group of size at most $d$. These two notions are combined in the notion of an LRC with locality $d$ and availability $t$ (see, e.g. [TB14, WZ14, RPDV14]), combines these two notions. This requires that each symbol have $t$ disjoint repair groups, each of size at most $d$. The techniques in this paper yield codes with locality $rq$ and availability $q/r$, where $r$ is the multiplicity. It would be interesting to construct codes with a better trade-off between locality and availability, possibly using lifting and/or multiplicity techniques.

Acknowledgements

We thank Eitan Yaakobi for helpful conversations. We thank Julien Lavauzelle for pointing out the reference [Wu15], for pointing out an error in an earlier version of this paper, and for suggesting the fourth open question. We thank Nikita Polianskii for pointing out an error in an earlier version of this paper. A previous version claimed that a lifted code is exactly the span of all good monomials, but in fact the span of all good monomials only forms a subset of the lifted code (see Remark 3.9). This does not change our main result, as our lower bound on the number of good monomials still gives the same lower bound on the rate of the lifted code. We thank anonymous reviewers for helpful comments on an earlier draft of this paper.

Appendix A Proofs of polynomial facts

Proof of Proposition 2.4.

By part 2 of Proposition 2.3,

[TABLE]

We have $D^{(1)}(X^{q}-X)=1$ (the field has characteristic 2). For $2\leq i<q$, the $i$th derivative of $X^{q}-X$ is $\binom{q}{i}X^{q-i}$, which is 0, as $\binom{q}{i}$ is even by Proposition 2.1. The summand above is nonzero if and only if $j_{1},j_{2},\dots,j_{r}\leq 1$. When $i\leq r$, this happens when $i$ of the $j_{k}$’s are 1 and $r-i$ are 0, which happens for $\binom{r}{i}$ choices of $(j_{1},\dots,j_{r})$. This gives $P^{(i)}(X)=\binom{r}{i}(X^{q}-X)^{r-i}$ for $0\leq i\leq r$. When $i>r$, some $j_{k}$ is at least 2, in which case $P^{(r)}(X)=0$ for $r<i<q$. ∎

Proof of Lemma 2.5.

Let $\textnormal{{a}}_{k}$ denote the vector $(1,\alpha_{k})$, and let $\textnormal{{b}}_{k}$ denote the vector $(0,\beta_{k})$. By assumption, we have that $\textnormal{{a}}_{k}\gamma+\textnormal{{b}}_{k}=(\gamma,\delta)$. By the definition of Hasse derivatives, we have, for all $k=1,\dots,r$

[TABLE]

Hence, for all $i\geq 0$ and $k=1,\dots,r$, we have

[TABLE]

By plugging in $T=\gamma$, we have for all $i\geq 0$ and $k=1,\dots,r$,

[TABLE]

Rewriting this in matrix form gives the desired result. ∎

Appendix B Lifted codes via dual codes

It was shown in [GKS13] that bivariate lifted parity-check codes over $\mathbb{F}_{q}$, where $q=2^{\ell}$, have co-dimension $3^{\ell}$. Here, we give an alternative proof using dual codes. The techniques in this proof are not directly related to the techniques that we used in the main body of the paper, but we found this alternative proof illuminating so we include it.

Let $q=2^{\ell}$. Recall $\mathcal{L}$ is the set of lines expressible as $L(T)=(T,\alpha T+\beta)$ where $\alpha,\beta\in\mathbb{F}_{q}$. One way to think about codes with locality is by considering their dual code. If the code is a subset of $\mathbb{F}_{q}^{q\times q}$, then the dual code corresponds to lines of repair groups. Given a line $L(T)$ in $\mathcal{L}$, define the corresponding dual codeword:

[TABLE]

Let

[TABLE]

Note that $V_{\mathcal{L}}$ is spanned by $4^{\ell}$ elements, so the trivial bound on the dimension is $4^{\ell}$. We give the following improved bound, matching the analysis of [GKS13].

Lemma B.1**.**

The subspace $V_{\mathcal{L}}$ has dimension at most $3^{\ell}$.

Proof.

A codeword $c^{\perp}_{L}$ is the evaluation of the following polynomial on $\mathbb{F}_{q}^{q\times q}$:

[TABLE]

If $(X,Y)\notin L$, then the polynomial evaluates to 0 as $Y-\alpha_{L}X\neq\beta_{L}$, and otherwise it evaluates to

[TABLE]

For $a+b\geq q$, the coefficient of $X^{a}Y^{b}$ in $P_{L}(X,Y)$ is 0. For $a+b\leq q$, the coefficient of $X^{a}Y^{b}$ in $P_{L}(X,Y)$ is

[TABLE]

This is because we first chose $a+b$ terms that contain $X$ or $Y$, then choose which terms are $X$ and which terms are $Y$, and this gives us $a$ many $\alpha_{L}$’s and $b$ many $-1$’s, and we sum over the choices of the $\beta$ terms that we choose. Hence, the only $a,b$ such that $[X^{a}Y^{b}]P_{L}(X,Y)\neq 0$ for any $L$ are the pairs $(a,b)$ such that $a+b\leq q-1$ and $\binom{a+b}{a}\equiv 1\mod 2$. There are at most $3^{\ell}$ pairs by Proposition 2.1. It follows that the polynomials $P_{L}(X,Y)$ are spanned by $3^{\ell}$ monomials $X^{a}Y^{b}$ with $\binom{a+b}{a}\equiv 1\mod 2$. Hence, the vector space $V_{\mathcal{L}}$ is spanned by $3^{\ell}$ dual codewords in $\mathbb{F}_{q}^{q\times q}$ and thus has dimension at most $3^{\ell}$. ∎