Polynomial Linear System Solving with Errors by Simultaneous Polynomial Reconstruction of Interleaved Reed-Solomon Codes

TL;DR

This paper introduces a novel algorithm for solving polynomial linear systems with errors during evaluation, enhancing error correction bounds by leveraging decoding techniques from Interleaved Reed-Solomon Codes.

Contribution

The paper presents a new algorithm that improves error correction bounds in polynomial linear system solving by applying decoding methods from interleaved Reed-Solomon codes.

Findings

Enhanced error correction bounds achieved

Algorithm effectively handles errors in evaluation step

Inspired by Reed-Solomon decoding techniques

Abstract

In this paper we present a new algorithm for Polynomial Linear System Solving (via evaluation/interpolation) with errors. In this scenario, errors can occur in the black box evaluation step. We improve the bound on the number of errors that we can correct, using techniques inspired by the decoding procedure of Interleaved Reed-Solomon Codes.

Equations

$$A(x)\mathbf{y}(x)=\mathbf{b}(x)$$

$$\mathbf{y}(x)=\frac{\mathbf{f}(x)}{g(x)}=\left(\frac{f_1(x)}{g(x)},\dots ,\frac{f_n(x)}{g(x)}\right)$$

$$\text{GCD}(\mathbf{f},g)=\text{GCD}({\text{GCD}}_i(f_i),g)=1.$$

$$L\ge L_{BK}:=df+dg+2e+t+1$$

$$E:=\{l\mid A_l\mathbf{f}({\alpha }_l)\ne g({\alpha }_l){\mathbf{b}}_l\}$$

$$R:=\{l\mid A_l\mathbf{f}({\alpha }_l)=g({\alpha }_l){\mathbf{b}}_l\text{ and }\text{rank}(A_l)<n\}$$

$${\left[A_l\left(\begin{array}{c}{\phi }_1({\alpha }_l)\\ {\phi }_2({\alpha }_l)\\ ⋮\\ {\phi }_n({\alpha }_l)\end{array}\right)-\psi ({\alpha }_l){\mathbf{b}}_l=0\right]}_{l\in \{1,\dots ,L\}}$$

$$\begin{array}[]{ll}\boldsymbol{\varphi}_{min}=\Lambda\boldsymbol{f},&\psi_{min}=\Lambda g\\ \end{array}$$

$$\Lambda (x)=\prod _{l\in E}(x-{\alpha }_l)$$

$$\{\begin{array}{ll}{b}_l=f({\alpha }_l)& l\notin E,\\ b_l\ne f({\alpha }_l)& l\in E.\end{array}$$

$$y_{ij}=f_i({\alpha }_j),j\notin E$$

$$\{\begin{array}{ll}{\mathbf{b}}_l=\mathbf{f}({\alpha }_l)& l\notin E,\\ {\mathbf{b}}_l\ne \mathbf{f}({\alpha }_l)& l\in E.\end{array}$$

$$\{\begin{array}{l}[m_1({\alpha }_j)=y_{1j}E({\alpha }_j){]}_{1\le j\le n}\\ \dots \\ [m_r({\alpha }_j)=y_{rj}E({\alpha }_j){]}_{1\le j\le n}\end{array}$$

$$e:=|E|\le \frac{r(n-k)}{r+1}$$

$$\frac{r(n-k)}{r+1}\ge \frac{n-k}{2},$$

$$e:=|E|=\frac{r(n-k)}{r+1}$$

$$L\ge L_{GLZ}:=\lceil \frac{n(df+e+1+dg)+e}{n}\rceil$$

$$\begin{gathered} E=\{l\mid A_l\mathbf{f}({\alpha }_l)\ne g({\alpha }_l){\mathbf{b}}_l \\ \text{ and }\text{rank}(A_l)=n\}. \end{gathered}$$

$$L_{GLZ}\le L_{BK}.$$

$$A_l{\mathbf{\gamma }}_l-{\sigma }_l{\mathbf{b}}_l=0.$$

$$C_l=[A_l|-{\mathbf{b}}_l].$$

$$\begin{array}[]{ll}\frac{\boldsymbol{\gamma}_{l}}{\sigma_{l}}=\frac{\boldsymbol{f}(\alpha_{l})}{g(\alpha_{l})}&\forall l\notin E.\end{array}$$

$${\mathbf{y}}_l=\frac{\mathbf{f}({\alpha }_l)}{g({\alpha }_l)},l\notin E$$

$$\{\begin{array}{l}\mathbf{\phi }({\alpha }_1)={\mathbf{y}}_1\psi ({\alpha }_1)\\ \dots \\ \mathbf{\phi }({\alpha }_L)={\mathbf{y}}_L\psi ({\alpha }_L)\end{array}$$

$$\{\begin{array}{l}[{\phi }_1({\alpha }_l)=y_{l1}\psi ({\alpha }_l){]}_{1\le l\le L}\\ \dots \\ [{\phi }_n({\alpha }_l)=y_{ln}\psi ({\alpha }_l){]}_{1\le l\le L}\end{array}$$

$$M_{\boldsymbol{y}}:=\left(\begin{array}[]{lllc}V_{df+e+1}&&&-D_{1}V_{dg+e+1}\\ &\ddots&&\vdots\\ &&V_{df+e+1}&-D_{n}V_{dg+e+1}\end{array}\right)$$

$$\frac{\mathbf{f}}{g}=\frac{\mathbf{\phi }}{\psi }$$

$$R({\alpha }_l)[f_i({\alpha }_l)-y_{li}g({\alpha }_l)]=0$$

$$L=\lceil \frac{n(df+e+1)+dg+e}{n}\rceil .$$

Full text

I Introduction

The problem of decoding a Reed-Solomon code (shortly RS), also known as the Polynomial Reconstruction Problem (PR) has been largely studied in Coding Theory [1, 2, 3]. In [7], Bleichenbacher et al. proposed a new scenario of the PR problem, called Simultaneous Polynomial Reconstruction (SPR). This problem was associated to the decoding of Interleaved Reed-Solomon codes. Instead of the separate reconstruction of each interleaved codeword, the main idea was to correct several codewords simultaneously in order to gain an error correction capability which depends also on the amount of messages received (interleaving parameter). They proposed an algorithm that, under some hypotheses on the error distribution, allows to correctly decode Interleaved RS codewords, beyond the unique decoding bound, with a certain probability. This probability depends on the number of errors and on the order of the field of the coefficients. Interleaved Reed Solomon codes (IRS) are widely studied in the last 20 years. In the original work [7] the key equations for recovering the codewords are a generalization of Berlekamp-Welch decoding method for RS. A more general scenario is due to [10] (improved by [11]) where codewords are issue of differents RS codes ( namely Heterogeneous IRS ) and the decoding method is based on Berlekamp-Massey algorithm as for the classical BCH codes. Recently, in [9] by applying Power Decoding method for generating independent key equations [12], the IRS decoding radius is significantly improved.

The purpose of the present work is to introduce a new algorithm, inspired by SPR problem, to solve a full rank consistent linear system $A(x)\boldsymbol{y}=\boldsymbol{b}(x)$ where erroneous evaluations occur.

In order to solve this system, a classical technique (see for example [4]) consists in evaluating in a certain number of points, solving the evaluated system and then interpolating these evaluated solutions. The solution is a vector of rational functions $\frac{\boldsymbol{f}(x)}{g(x)}$, where $\boldsymbol{f}$ is a vector of polynomials and $g(x)$ is the least common denominator.

In [5, 6], authors studied the problem in a scenario where some evaluations can be erroneous. They introduced an algorithm that recovers the solution by fixing a certain number $L_{BK}$ of evaluation points. This method is a generalization of the Berlekamp-Welch algorithm for PR. Thus, the error correction capability coincides with the unique decoding bound.

In this work, we generalize the SPR problem to the Simultaneous Rational Function Reconstruction (SRFR) in order to solve a polynomial linear system with errors. In the special case where the matrix $A$ is the identity matrix, we observe that our problem reduces to the SPR, or equivalently, to the problem of decoding an Interleaved RS code. Still in this special case, we can apply the decoding technique of Interleaved RS codes and correct more errors than [5] under the probabilistic hypotheses of [8]. In order to generalize this, we reexamine the scenario of [5, 6] with a probabilistic assumption. In this context, we introduce a new algorithm that can be seen as the generalization of the decoding algorithm of Interleaved RS codes. Our algorithm can correctly reconstruct the vector solution of our system with a smaller number of points $L_{GLZ}\leq L_{BK}$. However it can fail for a small fraction of possible errors as in [8]. In our case, the fraction is at most $\frac{dg+e}{q}$ where $dg$ is the degree of the common denominator of the rational function vector, $e$ is the number of errors and $q$ the order of the field.

II Polynomial linear system solving with errors

In [5] and [6], authors studied the problem of solving a consistent linear system

[TABLE]

where,

• •

$A(x)$ is a full rank $m\times n$ matrix whose entries are polynomials in $\mathbb{K}[x]$, $\mathbb{K}$ is a field and $m\geq n\geq 1$;

• •

$\boldsymbol{b}(x)$ is an $m$-th vector of polynomials in $\mathbb{K}[x]$.

The system admits a solution whose coordinates are rational functions and, since the matrix is full rank, there is a unique solution

[TABLE]

where $g$ is the monic least common denominator, and

[TABLE]

In general, this solution can be found by evaluating the system at a certain number, say $L$, of distinct points $\alpha_{l}\in\mathbb{K}$ with $l\in\{1,\ldots,L\}$, solving the evaluated system and then interpolating the parametric solution from the evaluated solution [4]. The authors in [5] proved that it is possible to reconstruct the solution even if some evaluations are erroneous. They focused on a model where there is a black box that, for any evaluation point $\alpha_{l}$, provides $A_{l}\in\mathbb{K}^{m\times n}$ and $\boldsymbol{b}_{l}\in\mathbb{K}^{m}$ which may not be equal to $A(\alpha_{l})$ and $\boldsymbol{b}(\alpha_{l})$. More specifically, the resulting evaluations $A_{l}$ and $\boldsymbol{b}_{l}$ are considered erroneous if $A_{l}\boldsymbol{f}(\alpha_{l})\neq g(\alpha_{l})\boldsymbol{b}_{l}$. In this scenario they proved that with

[TABLE]

number of points, it is possible to uniquely reconstruct the solution of the linear system (1), where

• •

$df\geq\deg{(\boldsymbol{f})}:=\max_{1\leq i\leq n}\deg{(f_{i})}$,

• •

$dg\geq\deg{(g)}$,

• •

$e\geq|E|$ is a bound on the erroneous evaluations where

[TABLE]

• •

$t\geq|R|$ is a bound on the rank drops where

[TABLE]

Their method consists in solving the homogeneous linear system

[TABLE]

where

• •

$\boldsymbol{\varphi}=(\varphi_{1},\ldots,\varphi_{n})\in(\mathbb{K}[x])^{n}$ and for any $1\leq i\leq n$, $\deg(\varphi_{i})\leq df+e$,

• •

$\psi\in\mathbb{K}[x]$, $\deg(\psi)\leq dg+e$.

The unknowns of the linear system (4) are the coefficients of $\varphi_{i}$ and $\psi$. In particular, they proved the following:

Theorem 1** ([5]).**

Under previous assumptions, let $(\boldsymbol{\varphi}_{min},\psi_{min})$ be the solution of (4) of minimal degree and $\psi_{min}$ monic. Then

[TABLE]

where

[TABLE]

is the error locator polynomial.

From now on we omit the rank drops study and we assume $t=0$.

This method is a generalization of the Berlekamp-Welch decoding algorithm for Reed-Solomon codes [1]. In fact, if $\mathbb{K}=\mathbb{F}_{q}$, $m=n=1$, $A_{l}=I_{1}$ and $g$ is the constant polynomial $1$, then

[TABLE]

Hence, in this case, the problem of recovering the solution of the linear system (1) with errors, coincides with the problem of decoding of RS code and the linear system (4) is exactly the key equation of the classical Berlekamp-Welch method.

We now define the Interleaving RS encoding procedure.

Let $\mathcal{C}$ be an $[n,k]_{q}$ RS code.

• •

we consider $r$ codewords $c_{i}\in\mathcal{C}$. For any $i\in\{1,\ldots,r\}$, $c_{i}=(f_{i}(\alpha_{1}),\ldots,f_{i}(\alpha_{n}))$ where $f_{i}\in\mathbb{F}_{q}[x]$ has degree $\deg(f_{i})\leq k-1$ and $\{\alpha_{1},\ldots,\alpha_{n}\}$ is the set of distinct evaluation points;

• •

we arrange these codewords row-wise and we obtain the $r\times n$ matrix $(c_{i})_{1\leq i\leq r}=(f_{i}(\alpha_{j}))_{\begin{subarray}{c}1\leq i\leq r\\ 1\leq j\leq n\end{subarray}}$;

• •

by interpreting this matrix as a row vector $(\boldsymbol{f}(\alpha_{j}))_{1\leq j\leq n}\in(\mathbb{F}_{q^{r}})^{n}$, we obtain a codeword of an Interleaved RS code of length $n$, dimension $k$ over $\mathbb{F}_{q^{r}}$. The number of codewords $r$ is the amount of interleaving.

Definition 1** (Simultaneous polynomial reconstruction [7]).**

Let $n,k,e\in\mathbb{N}$ and $\alpha_{1},\ldots,\alpha_{n}$ distinct points in $\mathbb{F}_{q}$. An instance of the SPR is $(y_{ij})_{\begin{subarray}{c}1\leq i\leq r\\ 1\leq j\leq n\end{subarray}}$, that verifies the following. There exists

• •

$E\subset\{1,\ldots,n\}$* with $|E|\leq e$,*

• •

polynomials $(f_{1},\ldots,f_{r})$, with $\deg(f_{i})\leq k-1$

such that

[TABLE]

The solution of the SPR is the tuple $(f_{1},\ldots,f_{r})$.

The SPR problem is exactly the problem of decoding an Interleaved RS code with length $n$, dimension $k$ and amount of interleaving $r$.

We can now observe that,

Remark 1**.**

If $\mathbb{K}=\mathbb{F}_{q}$, $m=n$, $A_{l}=I_{n}$ and $g$ is the constant polynomial $1$, then the linear system (1) becomes

[TABLE]

Hence, the problem of solving the linear system (1) with errors coincides with the problem of decoding an Interleaved RS code (SPR [7]) with length $L$, dimension $df+1$ and amount of interleaving $n$.

In [7], the authors proposed an algorithm that, under some hypotheses on the error distribution, allows to decode an Interleaved RS code with a certain probability. In particular, they introduced key equations,

[TABLE]

The unknowns of this linear system are the coefficients of $m_{i}$ and $E$, polynomials of degrees at most respectively $k+e$ and $e$. This linear system (5) has $rn$ equations and $r(k+e)+e+1$ unknowns. Moreover,

Theorem 2** ([7]).**

Let $(y_{ij})_{{\begin{subarray}{c}1\leq i\leq r\\ 1\leq j\leq n\end{subarray}}}$ the received word of an Interleaved RS code, or equivalently an instance of the SPR problem, where

[TABLE]

and for each $i\in\{1,\ldots,r\}$,

1. (i)

if $j\in E$, $y_{ij}$ are uniformly distributed over $\mathbb{F}_{q}$ 2. (ii)

if $j\notin E$, $y_{ij}=f_{i}(\alpha_{j})$ and $f_{1},\ldots,f_{r}$ are uniformly distributed over the vector space of polynomials of $\mathbb{F}_{q}[x]$ of degree at most $k-1$;

then the linear system (5) admits at most one solution with probability at least $1-e/q$.

Since if $r\geq 1$,

[TABLE]

then they proved that, under the probabilistic assumptions (i) and (ii), it is possible to correctly decode the received word beyond the unique decoding bound. The failing probability, i.e. the probability that the algorithm fails, is then upper bounded by $e/q$.

In a following paper [8], the probabilistic assumptions are reduced and it was proved that the failing probability is $\mathcal{O}(1/q)$ which is independent of the number of errors. In detail,

Theorem 3** ([8]).**

Given $(y_{ij})_{{\begin{subarray}{c}1\leq i\leq r\\ 1\leq j\leq n\end{subarray}}}$ the received word of an Interleaved RS code, where

[TABLE]

and for each $i\in\{1,\ldots,r\}$,

1. (i)

if $j\in E$, $y_{ij}$ are uniformly distributed over $\mathbb{F}_{q}$ 2. (ii)

if $j\notin E$, $y_{ij}=f_{i}(\alpha_{j})$,

then the linear system (5) admits at most one solution with probability at least $1-\frac{exp(1/(q^{r-2}))}{q-1}$.

In this paper, starting from Remark 1 we reexamine the problem of solving the linear system (1) with errors as a generalization of the decoding of an Interleaved RS code under some hypotheses on the error distribution. In particular, following the [7] approach, we prove that the failing probability is at most $\frac{dg+e}{q}$ (where $dg$ is the degree of the common denominator of the vector of rational functions). We stress out that, in our scenario, we relax the hypotheses on the error distribution as in [8]. However we are not able to prove a bound on the failing probability as tight as [8] (see Section IV for more comments).

III Generalization of decoding of Interleaved RS codes

We study the problem of solving a consistent, full rank, linear system (1), $A(x)\boldsymbol{y}(x)=\boldsymbol{b}(x)$ with polynomial entries over a finite field $\mathbb{F}_{q}$.

In a first instance, we focus on the square case, i.e. $n=m$. Let $\boldsymbol{y}=\frac{\boldsymbol{f}(x)}{g(x)}$ be the reduced unique solution as in (2).

We fix $L$ evaluation points with

[TABLE]

where

• •

$df\geq\deg{(\boldsymbol{f})}:=\max_{1\leq i\leq n}\deg{(f_{i})}$,

• •

$dg=\deg{(g)}$,

• •

$g(\alpha_{l})\neq 0$ for $1\leq l\leq L$,

• •

$e=|E|$ is the number of erroneous evaluations where

[TABLE]

Remark 2**.**

In this way, since $n\geq 1$, we reduce the number of evaluation points,

[TABLE]

We slightly modify the black box scenario described in the previous section, by introducing a probabilistic assumption. More specifically, we assume that for any erroneous evaluation, $l\in E$, the entries of $A_{l}$ and $\boldsymbol{b}_{l}$ are uniformly random elements of $\mathbb{F}_{q}$. Moreover, since we skip the rank drops study, we also suppose that all the $A_{l}$ are always full rank.

We study, for any $l\in\{1,\ldots,L\}$, the homogeneous linear systems

[TABLE]

Remark 3**.**

Let $C_{l}$ be the coefficients matrix of any of these linear systems,

[TABLE]

Since any system have $n$ equations and $n+1$ unknowns and $A_{l}$ is full rank, the rank of $C_{l}$ is $n$ and in particular, the kernel of any $C_{l}$ is one dimensional.

Proposition 1**.**

Let $(\boldsymbol{\gamma}_{l},\sigma_{l})=(\gamma_{l1},\ldots,\gamma_{ln},\sigma_{l})$ be the vector that generates the right kernel of $C_{l}$, with $l\in\{1,\ldots,L\}$. Then,

[TABLE]

Proof.

By our assumptions, $g(\alpha_{l})\neq 0$ for any $l\notin E$. Now, since the right kernel is one dimensional, its generator $(\boldsymbol{\gamma}_{l},\sigma_{l})=(\gamma_{l1},\ldots,\gamma_{ln},\sigma_{l})$ is a nonzero vector, and also $\sigma_{l}\neq 0$. Let $l\notin E$, be a correct evaluation. Since $A_{l}\boldsymbol{\gamma}_{l}-\sigma_{l}\boldsymbol{b}_{l}=0$ and $A_{l}\boldsymbol{f}(\alpha_{l})=g(\alpha_{l})\boldsymbol{b}_{l}$, then $A_{l}(\boldsymbol{f}(\alpha_{l})\sigma_{l}-g(\alpha_{l})\boldsymbol{\gamma}_{l})=0$. The matrix $A_{l}$ is full rank, hence $\boldsymbol{f}(\alpha_{l})\sigma_{l}-g(\alpha_{l})\boldsymbol{\gamma}_{l}=0$. Then we can conclude that $\frac{\boldsymbol{\gamma_{l}}}{\sigma_{l}}=\frac{\boldsymbol{f}(\alpha_{l})}{g(\alpha_{l})}$. ∎

Following the previous notations, if we denote by $\boldsymbol{y}_{l}:=\frac{\boldsymbol{\gamma}_{l}}{\sigma_{l}}=\frac{1}{\sigma_{l}}(\gamma_{l1},\ldots,\gamma_{ln})\in(\mathbb{F}_{q})^{n}$, for any $l\in\{1,\ldots,L\}$ we have that

[TABLE]

Remark 4**.**

By our probabilistic assumption, $(y_{li})_{l\in E}$ are uniformly random elements of $\mathbb{F}_{q}$.

In this way, we reduce the problem of solving the linear system (1) to the reconstruction of a vector of rational functions with errors. In particular, we observe that if $g$ is the constant polynomial $1$, our problem coincides exactly with the decoding of an Interleaved RS code, with length $L$, dimension $df+1$ and amount of interleaving $n$. This is why we can consider our problem as a generalization of the decoding of Interleaved RS codes.

Now, we study the key equations

[TABLE]

or, in other terms, if we denote $\boldsymbol{y}_{l}=(y_{l1},\ldots,y_{ln})$ for $l\in\{1,\ldots,L\}$,

[TABLE]

where

• •

$\boldsymbol{\varphi}=(\varphi_{1},\ldots,\varphi_{n})\in(\mathbb{F}_{q}[x])^{n}$ and $\deg(\varphi_{i})\leq df+e$,

• •

$\psi\in\mathbb{F}_{q}[x]$ has degree at most $dg+e$ .

The linear system (9) has $nL$ equations and $n(df+e+1)+dg+e+1$ unknowns, which are the coefficients of $\boldsymbol{\varphi}$ and $\psi$.

The coefficient matrix of the system $(\ref{ourKeyEqu})$ is

[TABLE]

where,

• •

$V_{t}=(\alpha_{l}^{i-1})_{\begin{subarray}{c}1\leq l\leq L\\ 1\leq i\leq t\end{subarray}}$ is the $L\times t$ Vandermonde matrix,

• •

for $i\in\{1,\ldots,n\}$, $D_{i}$ is the diagonal matrix with $y_{1i},\ldots,y_{Li}$ on the diagonal.

Recall that the error locator polynomial $\Lambda(x)=\prod_{l\in E}(x-\alpha_{l})$ is monic and has degree $e$. We observe that $(\Lambda\boldsymbol{f},\Lambda g)=(\Lambda f_{1},\ldots,\Lambda f_{n},\Lambda g)$ is a solution of the system. Therefore, if the kernel of $M_{\boldsymbol{y}}$ has dimension 1, the non-zero solutions are collinear to $(\Lambda\boldsymbol{f},\Lambda g)$, meaning that we can correctly reconstruct the fraction $\boldsymbol{f}/g=\Lambda\boldsymbol{f}/\Lambda g$.

We do not have a priori any other information about this kernel. In our following main result, we adapt the approaches of [7, 8] to prove that this favorable situation happens with high probability.

Theorem 4**.**

Under the previous assumptions, the dimension of the (right) kernel of $M_{\boldsymbol{y}}$ is one with probability at least $1-\frac{(dg+e)}{q}$.

The cornerstone of the proof is the following lemma.

Lemma 1**.**

There exists a random draw of $(\boldsymbol{y}_{l})_{l\in E}$ such that the dimension of the right kernel of $M_{\boldsymbol{y}}$ is one.

Proof.

We can partition $E=\bigcup_{1\leq i\leq n}I_{i}$ with sets $I_{i}\subset E$ such that $|I_{i}|\leq L-(df+dg+e+1)$ for $1\leq i\leq n$ since $n(L-(df+dg+e+1))\geq e$. We start by fixing a part of the random variables $(\boldsymbol{y}_{l})_{l\in E}$ : for all $1\leq i\leq n$ and $l\in E\setminus I_{i}$, we set $y_{li}=\frac{f_{i}(\alpha_{l})}{g(\alpha_{l})}$ while $y_{li}$ for $l\in I_{i}$ remain free variables for now, for a total of $e$ free variables.

Now, we study the equations (9). Fixed $1\leq i\leq n$, for $l\notin I_{i}$, $\varphi_{i}(\alpha_{l})g(\alpha_{i})=f_{i}(\alpha_{l})\psi(\alpha_{l})$. Therefore, since the polynomial $\varphi_{i}g-f_{i}\psi$ has degree at most $df+dg+e$ and at least $df+dg+e+1$ roots, it is the zero polynomial. Hence, the two fractions are equals,

[TABLE]

Moreover, since the fraction $\frac{\boldsymbol{f}}{g}$ is reduced, there exists a polynomial $R$ such that $f_{1}R=\varphi_{1}$, $gR=\psi$ and $\deg(R)\leq e$.

Hence for $1\leq i\leq n$, $f_{i}R=\varphi_{i}$ and $gR=\psi$ and so by replacing in (9) we have

[TABLE]

We observe that for any $l\in E$, there exists $1\leq i\leq n$ such that $l\in I_{i}$, so $y_{li}$ is still a free variable and we can give it a value so that $f_{i}(\alpha_{l})\neq y_{li}g(\alpha_{l})$ since $g(\alpha_{l})\neq 0$. Therefore $R(\alpha_{l})=0$ for $l\in E$ and $deg(R)\leq e$ and so $R$ is a scalar multiple of $\Lambda$. We have proved that for some values of $\boldsymbol{y}_{l}$ the kernel is spanned by $(\Lambda\boldsymbol{f},\Lambda g)$ and has dimension 1.

∎

Proof of Theorem 4.

We recall that $(\Lambda f_{1},\ldots,\Lambda f_{n},\Lambda g)$ is a solution of the linear system (9) so it has kernel dimension at least 1. Since $\Lambda g$ is a monic polynomial of degree $dg+e$, the last column of $M_{\boldsymbol{y}}$ is linearly dependent on the previous ones. As a consequence, the kernel of $M_{\boldsymbol{y}}$ has dimension $1$ iff the rank of $M_{\boldsymbol{y}}$ is $\rho:=n(df+e+1)+dg+e$ iff there exists a non-zero minor of $M_{\boldsymbol{y}}$ of size $\rho$ that avoids the last column. Considering the minors as polynomials in the variables $(\boldsymbol{y}_{l})_{l\in E}$, we have shown in Lemma 1 that one of these $\rho$-minors is not the zero polynomial because it does not vanish on some value of $(\boldsymbol{y}_{l})_{l\in E}$. Finally, since this $\rho$-minor has degree at most $dg+e$, by Schwartz-Zippel Lemma, it cannot be zero in more than a $\frac{dg+e}{q}$-fraction of its domain. Therefore, we can conclude that the kernel has dimension 1 with probability at least $1-\frac{dg+e}{q}$. ∎

Summing up, working under our probabilistic assumptions, we are able to recover the correct solution with a failing probability upper bounded by $\frac{dg+e}{q}$.

Up to this point, we have assumed that the linear system (1) is square, i.e. $n=m$. With our method it is possible to recover the solution with the same probability also in the general case by considering random $y_{li}$, for any $l$ such that $\text{rank}(C_{l})=n+1$ (see Remark 3).

IV Experiments and Conclusions

In this work we prove that, in our probabilistic scenario, by using the evaluation interpolation technique [4] with $L\geq L_{GLZ}$ evaluation points, we can reconstruct the vector solution of the linear system (1). Recall that $L_{BK}$ is the number of points that guarantees to uniquely reconstruct the solution for every error. In our case since $L_{GLZ}<L_{BK}$, we cannot reconstruct the solution for every error, but for almost all of them.

We implement our algorithm in SageMath (http://www.sagemath.org). In particular, we solve $20$ different linear systems with polynomial coefficients, of size $3$. For every system we apply our algorithm $1000$ times, with $e=5$ errors and $dg=2$. We compute the percentage $p$ of the number of times the algorithm fails. We compare our experimental results with $p_{GLZ}$, i.e. the failing probability of Theorem 4, and with $p_{BMS}$, i.e. the failing probability of [8]. We recall that the last one is linked to a related problem, the decoding of Interleaved RS, but not to our problem. We obtain the following results:

[TABLE]

First of all, these experiments suggest that the failing probability is very small and that it decreases when the cardinality of the field grows. Moreover, since experiments are significantly under our theoretical bound, our bound could be strongly improved, which we leave to future work. This may also suggest that our bound $L_{GLZ}$ is not optimal. Therefore, we have done some experiments using an inferior number of evaluation points

[TABLE]

and we note $p^{\ast}$ the corresponding probability. This new $L$ is chosen in such a way that the coefficient matrix $M_{y}$ has now $nL$ equations and $nL-1$ unknowns so that its kernel might have dimension 1. We can observe that also in this case, we have a very high probability to reconstruct the correct vector rational solution in practice. Therefore future work could try to extend our results to this new number of evaluation points.

Finally we can remark that, since we use an evaluation interpolation technique, there exist finitely many evaluation points $\alpha_{l}$ such that the evaluated matrix $A(\alpha_{l})$ is not full rank anymore. In this work, we have chosen the evaluation points such that the evaluated matrix is full rank, thus omitting the rank drop analysis, which we leave again to future work.

V Acknowledgements

This work has been supported by Occitanie Region through the ARPE HPAC project. We would also like to thank Daniel Augot and Bruno Grenet for useful discussions.