Cyclic-Addition Degree Tables (CAT)

• CAT is a degree table construction in private distributed matrix multiplication that uses cyclic (modular) addition to assign unique polynomial degrees.
• It reduces communication overhead and worker count by exploiting root-of-unity evaluation points and modular arithmetic, achieving up to 5–15% worker savings in low-privacy regimes.
• The framework extends to quantum protocols using entanglement-assisted super-dense coding, doubling the effective transmission rate.

Cyclic-Addition Degree Tables (CAT) are a family of degree table constructions used in coding schemes for private distributed matrix multiplication (PDMM), particularly designed to reduce communication overhead and worker count while preserving information-theoretic privacy. The CAT framework exploits cyclic (modular) addition of degree exponents together with root-of-unity evaluation points in finite fields, enabling more efficient polynomial code construction than classical integer-addition-based schemes, especially in the low-privacy regime where the number of colluding adversaries is small relative to the number of matrix partitions (Nomeir et al., 28 Nov 2025, Hofmeister et al., 21 Jan 2025).

1. Formulation and Definition

The CAT approach encodes two private input matrices, $A \in \mathbb{F}_q^{m \times \kappa}$ and $B \in \mathbb{F}_q^{\kappa \times \ell}$, for distributed matrix multiplication across $N$ servers, in such a way that any $T$ colluding servers do not learn anything about $A$ or $B$. The matrices are partitioned into $K$ row blocks and $L$ column blocks respectively, yielding $K \times L$ block products $A_i B_j$ that must be recovered.

CAT codes assign integer degree vectors $r = (r_1, \ldots, r_K) \in \mathbb{Z}_M^K$ and $s = (s_1, \ldots, s_L) \in \mathbb{Z}_M^L$ for the polynomial encoding of $A$ and $B$, forming a degree table $D$:

$$d(i,j) := (r_i + s_j) \bmod M,\quad i = 1,\ldots,K,\ j = 1,\ldots,L$$

Each entry $d(i,j)$ uniquely designates the polynomial degree corresponding to the block product $A_i B_j$. The cyclic addition modulo $M$ is the critical innovation, enabling the mapping of all possible sums into a smaller index set and facilitating efficient Vandermonde interpolation.

2. Encoding, Evaluation, and Decoding Procedures

The user defines two polynomials for encoding:

• $$f(x) = \sum_{i=1}^K A_i x^{r_i} + \sum_{t=1}^T R_t x^{u_t}$$
• $$g(x) = \sum_{j=1}^L B_j x^{s_j} + \sum_{t=1}^T S_t x^{v_t}$$

Random matrices $R_t$, $S_t$ with degree exponents $u_t$, $v_t$ (chosen from the interference set $\mathrm{IS}$ disjoint from the block-product degrees) serve as privacy masks. The user chooses $N = M$ field elements $\{\alpha_n\}_{n=1}^N \subset \mathbb{F}_q^*$ as evaluation points, commonly chosen as distinct roots of unity of order $M$.

Each server $n$ receives the tuple $(f(\alpha_n), g(\alpha_n))$ and returns $h(\alpha_n) = f(\alpha_n)g(\alpha_n)$. The user collects all $N$ responses and interpolates the univariate polynomial $h(x) = f(x)g(x)$, extracting the coefficients at the degrees $d(i,j)$ to recover the block products $A_iB_j$.

3. Privacy and Feasibility Conditions

CAT codes guarantee $T$-privacy: any $T$ colluding servers, even with access to all their $(f(\alpha_n), g(\alpha_n))$ values, obtain no information about $A$ or $B$. This security is derived from the random mask terms spanning a $T$-dimensional subspace that completely obscures any possible combination revealed to the adversaries.

For correct matrix recovery (decodability), the $K \cdot L$ message degrees $\{d(i,j)\}$ must be pairwise distinct. Privacy demands that the interference set size satisfies $|\mathrm{IS}| \geq 2T$, and the noise exponents are distinct from the message degrees as well as from each other. For the quantum setting, a further feasibility requirement is imposed: the longest consecutive chain $|\mathrm{LCC}(\mathrm{IS})| \geq \lceil N/2 \rceil$ to support super-dense coding for quantum rates (Nomeir et al., 28 Nov 2025).

4. Parameter Selection and Structural Distinctions

To satisfy all constraints, the modulus $M$ is set as

$M = K^* L^* + (T-1)^2$

with $K^* = K + 1 + \kappa$ and $L^* = L + 1 + \lambda$, such that $K^*, L^*$ are coprime to $T-1$. The auxiliary variables $\kappa, \lambda \geq 0$ are chosen to meet these coprimality requirements.

Exponents $r$ and $s$ are constructed via selectable parameters $x$ and $y$ (with $x$ coprime to $M$ and $y$ such that $x + yK^* \equiv 0 \pmod{M}$) to ensure both non-collision in $D$ and invertibility of the evaluation/interpolation matrix. This explicit construction enables tight worker counts in contrast to GASP or DOG schemes (Hofmeister et al., 21 Jan 2025).

5. Comparative Performance and Asymptotics

CAT coding schemes are advantageous in the low-privacy regime ($T \ll K, L$), where the number of colluding servers is much less than the block partitioning. The worker count and rate for the CAT scheme are:

$$N_{\mathrm{CAT}} = K^* L^* + (T-1)^2,\quad R_{\mathrm{CAT}} = \frac{K L}{K^* L^* + (T-1)^2}$$

For comparison, the GASP and DOG coding schemes yield:

Scheme	Worker Count $N$	Rate $R$
GASP	$KL + 2K + 3T - 2$	$KL/(KL+2K+3T-2)$
DOG	$KL + K + T$	$KL/(KL+K+T)$
CAT	$K^*L^* + (T-1)^2$	$KL/(K^*L^* + (T-1)^2)$

Numerical results demonstrate that for small $T$, CAT can save up to $5$–$15\%$ in the number of workers relative to GASP, and may also outperform DOG for moderate $K, L$ (Hofmeister et al., 21 Jan 2025). In the high-privacy regime ($T \geq L$), CAT becomes suboptimal due to diminished interference dimensions, in which case GASP or multivariate schemes are preferable (Nomeir et al., 28 Nov 2025).

6. Quantum Adaptation and Super-Dense Coding

Cyclic-addition degree tables admit a natural extension to quantum protocols. When the feasibility condition on the interference set’s longest consecutive chain is satisfied, CAT codes enable an entanglement-assisted protocol where servers, sharing an $N$-partite entangled state, perform Pauli operations parameterized by the encoded messages and masks. The user then recovers two classical symbols per quantum transmission via super-dense coding, doubling the download rate:

$R_{\mathrm{QCAT}} = 2\,R_{\mathrm{CAT}}$

This quantum extension leverages the SSO-generator matrix for the dual GRS code on CAT exponents, with the key property that the interference set structure supports the required stabilizer measurements (Nomeir et al., 28 Nov 2025).

7. Extensions, Optimizations, and Example

Potential optimizations to the baseline CAT design include:

• Enlarged Modulus: Replacing $M$ by a larger divisor of $\mathbb{F}_q^*$ can reduce collisions in $D$ and enhance flexibility.
• Discretely Optimized Parameters (DOG): Allowing “gaps” in degree assignments interpolates between CAT and GASP, optimizing performance for intermediate $T$.
• Explicit CATx Construction: The paper "CAT and DOG: Improved Codes for Private Distributed Matrix Multiplication" introduces CATx, realizing these improvements in practical settings (Hofmeister et al., 21 Jan 2025).

Illustrative Example (for $K = L = T = 2$):

• $K^* = L^* = 3$, $T-1 = 1$, $M = 10$
• Degree vectors: $r = [0,7]$, $s = [0,3]$ mod $10$
• Degree table: $D = \{0, 3, 7, 0\}$; interference set $IS = \{1,2,4,5,6,8,9\}$
• Classical rate: $4/10 = 0.4$; Quantum rate (via super-dense coding): $0.8$

A plausible implication is that such parameter choices yield practical schemes with reduced worker requirements and strong privacy guarantees for distributed matrix multiplication in both classical and quantum-augmented regimes (Nomeir et al., 28 Nov 2025, Hofmeister et al., 21 Jan 2025).

• "Quantum Private Distributed Matrix Multiplication With Degree Tables" (Nomeir et al., 28 Nov 2025)
• "CAT and DOG: Improved Codes for Private Distributed Matrix Multiplication" (Hofmeister et al., 21 Jan 2025)