Cyclic Addition Tables in PDMM

• Cyclic Addition Tables (CAT) are structured degree-table codes that use cyclic group operations and modulo addition to enhance private distributed matrix multiplication.
• Their construction partitions the addition table into disjoint quadrants, ensuring perfect T-privacy and exact decodability in encoding and decoding processes.
• Quantum extensions of CAT achieve rate-doubling by leveraging interference criteria and cyclical exponent packing, outperforming conventional schemes in low-privacy regimes.

Cyclic Addition Tables (CAT) are a family of degree-table codes for private distributed matrix multiplication (PDMM), extending conventional integer-based degree-table frameworks by implementing a cyclic group structure on polynomial exponents. CATs utilize modulo addition (over $\mathbb{Z}_q$ for suitable $q$) and roots of unity as evaluation points, achieving improved worker-efficiency through denser packing of sum exponents. The framework enables perfect $T$-privacy and exact decodability, particularly benefiting low-privacy regimes (i.e., $T \ll \min(K,L)$), and has quantum extensions that admit rate-doubling via feasibility criteria that depend on the distribution of "interference" exponents (Hofmeister et al., 21 Jan 2025, Nomeir et al., 28 Nov 2025).

1. Formal Definition and Structural Properties

Given integers $K,L,T\geq 1$, a Cyclic Addition Table for parameters $(K,L,T)$ with $N$ unique entries is a tuple $$(q, \alpha^{(p)}, \alpha^{(s)}, \beta^{(p)}, \beta^{(s)})$$ where

• $\alpha^{(p)} \in \mathbb{Z}^K$ and $\alpha^{(s)} \in \mathbb{Z}^T$ encode the "product" and "secret" exponents for $q$0,
• $q$1 and $q$2 are analogous for $q$3,
• $q$4 is the modulus,
• All additions are over $q$5.

The combined set of all possible sums,

$q$6

with $q$7 denoting the vector of residues in increasing order, partitions the $q$8 addition table into four quadrants. The structural requirements are:

1. All four quadrants collectively produce exactly $q$9 distinct residues modulo $T$0.
2. The top-left quadrant defines $T$1 distinct residues, with each representing a desired outer block-product.
3. Off-diagonal quadrants (top-right, bottom-left, bottom-right) must be disjoint from each other and from the top-left (i.e., product terms never mix with noise/randomization terms).
4. A field $T$2 is chosen so that $T$3, ensuring the existence of a primitive $T$4-th root of unity $T$5. Evaluation at $T$6 for $T$7 yields invertibility in the corresponding Vandermonde matrices for both decoding (entire degree table) and for $T$8-privacy (any $T$9 submatrix in $T \ll \min(K,L)$0 or $T \ll \min(K,L)$1).

This structure ensures that decoding via polynomial interpolation is unambiguous, and that $T \ll \min(K,L)$2-privacy is information-theoretically enforced (Hofmeister et al., 21 Jan 2025).

2. Explicit CAT Construction and Parameter Computation

The canonical construction, denoted CAT$T \ll \min(K,L)$3, is defined as follows for $T \ll \min(K,L)$4:

• Define $T \ll \min(K,L)$5;
• Find the smallest nonnegative integers $T \ll \min(K,L)$6, $T \ll \min(K,L)$7 such that $T \ll \min(K,L)$8 and $T \ll \min(K,L)$9 are co-prime with $K,L,T\geq 1$0;
• Set $K,L,T\geq 1$1;
• Choose $K,L,T\geq 1$2 coprime to $K,L,T\geq 1$3, then solve $K,L,T\geq 1$4 for $K,L,T\geq 1$5;
• Set exponents:
  • $K,L,T\geq 1$6,
  • $K,L,T\geq 1$7,
  • $K,L,T\geq 1$8,
  • $K,L,T\geq 1$9,
  • all modulo $(K,L,T)$0.

The degree table defines the exponents for encoding polynomials. Each entry in the block-product quadrant maps uniquely to one of $(K,L,T)$1 mod $(K,L,T)$2, with noise and cross terms mapped to disjoint intervals according to the combinatorial construction, ensuring the separation properties (Hofmeister et al., 21 Jan 2025, Nomeir et al., 28 Nov 2025).

3. Encoding, Evaluation, Decoding, and Privacy

For PDMM applications, let $(K,L,T)$3 and $(K,L,T)$4 over $(K,L,T)$5 be partitioned into outer-product blocks:

$(K,L,T)$6

with $(K,L,T)$7 random masks $(K,L,T)$8 for $(K,L,T)$9 and $N$0 for $N$1. Encoding polynomials are formed as:

$N$2

Each worker $N$3 evaluates $N$4. The exponents in $N$5 are segregated by the CAT table. The coefficients indexed by the top-left quadrant $N$6 recover $N$7. Upon collecting $N$8 responses, the system in the worker evaluation points is invertible, guaranteeing perfect recovery.

$N$9-privacy is achieved since any $$(q, \alpha^{(p)}, \alpha^{(s)}, \beta^{(p)}, \beta^{(s)})$$0 workers only see $$(q, \alpha^{(p)}, \alpha^{(s)}, \beta^{(p)}, \beta^{(s)})$$1 masked evaluations, and the mask randomness is protected by the invertibility property of the $$(q, \alpha^{(p)}, \alpha^{(s)}, \beta^{(p)}, \beta^{(s)})$$2 submatrices, thus leaking no information about $$(q, \alpha^{(p)}, \alpha^{(s)}, \beta^{(p)}, \beta^{(s)})$$3 (Hofmeister et al., 21 Jan 2025).

4. Worker Count and Comparisons with Conventional Schemes

The number of workers required, denoted $$(q, \alpha^{(p)}, \alpha^{(s)}, \beta^{(p)}, \beta^{(s)})$$4, is given by:

$$(q, \alpha^{(p)}, \alpha^{(s)}, \beta^{(p)}, \beta^{(s)})$$5

where $$(q, \alpha^{(p)}, \alpha^{(s)}, \beta^{(p)}, \beta^{(s)})$$6 and $$(q, \alpha^{(p)}, \alpha^{(s)}, \beta^{(p)}, \beta^{(s)})$$7 are as previously defined.

Comparison with GASP and DOG codes:

• GASP requires $$(q, \alpha^{(p)}, \alpha^{(s)}, \beta^{(p)}, \beta^{(s)})$$8 workers.
• CAT reduces worker count by $$(q, \alpha^{(p)}, \alpha^{(s)}, \beta^{(p)}, \beta^{(s)})$$9 (numerically up to $\alpha^{(p)} \in \mathbb{Z}^K$0 when $\alpha^{(p)} \in \mathbb{Z}^K$1), particularly when $\alpha^{(p)} \in \mathbb{Z}^K$2.
• When $\alpha^{(p)} \in \mathbb{Z}^K$3 becomes comparable to $\alpha^{(p)} \in \mathbb{Z}^K$4 or $\alpha^{(p)} \in \mathbb{Z}^K$5, conventional schemes may regain the advantage.

Asymptotically, for fixed $\alpha^{(p)} \in \mathbb{Z}^K$6:

• $\alpha^{(p)} \in \mathbb{Z}^K$7
• $\alpha^{(p)} \in \mathbb{Z}^K$8 CAT achieves its efficiency in the low-privacy regime by efficiently exploiting the cyclic structure of the exponents to compress noise terms (Hofmeister et al., 21 Jan 2025, Nomeir et al., 28 Nov 2025).

5. Field Requirements and Evaluation Points

The CAT scheme necessitates a field $\alpha^{(p)} \in \mathbb{Z}^K$9 such that $\alpha^{(s)} \in \mathbb{Z}^T$0 is divisible by $\alpha^{(s)} \in \mathbb{Z}^T$1, ensuring the existence of a primitive $\alpha^{(s)} \in \mathbb{Z}^T$2-th root of unity $\alpha^{(s)} \in \mathbb{Z}^T$3. Worker $\alpha^{(s)} \in \mathbb{Z}^T$4 is assigned the evaluation point $\alpha^{(s)} \in \mathbb{Z}^T$5. For any exponent $\alpha^{(s)} \in \mathbb{Z}^T$6,

$\alpha^{(s)} \in \mathbb{Z}^T$7

Thus, exponent addition for encoded polynomial terms is performed modulo $\alpha^{(s)} \in \mathbb{Z}^T$8, not over the integers, permitting “wrap-around” and greater flexibility in assignment and separation of noise and product terms.

In practice, selection of $\alpha^{(s)} \in \mathbb{Z}^T$9 occurs via a short search for a prime $q$00 (Hofmeister et al., 21 Jan 2025).

6. Quantum Extensions and Feasibility Conditions

CAT codes extend to the quantum PDMM context. The feasibility of such an extension is controlled via the structure of the "interference subspace" $q$01, where $q$02 is the set of exponents corresponding to valid block-products. The quantum extension, enabling two independent $q$03 decodings via super-dense coding, is available if the longest consecutive chain in $q$04, $q$05, satisfies $q$06.

Upload/download rates in the quantum regime are doubled (i.e., $q$07) when the feasibility test holds. This feasibility criterion unifies that for all rank-based OPP codes (GASP, DOG, CAT), and is especially notable as CAT$q$08 codes provide the first known nontrivial low-privacy example passing this test. When feasibility fails, quantum-native PDMM schemes may still exist but will typically require increased server randomness or dimensional embedding (Nomeir et al., 28 Nov 2025).

7. Use Cases, Applications, and Limitations

CATs are optimally suited for PDMM and SDMM scenarios where:

• The privacy threshold $q$09 is strictly smaller than both $q$10 and $q$11 (low-privacy regime).
• Worker minimization is desired, as the modulo structure can result in smaller $q$12 than non-cyclic schemes.
• Quantum communication infrastructure is available, and feasibility for rate-doubling is satisfied.

When $q$13 approaches $q$14 or $q$15, or when the field-size constraint is prohibitive, conventional schemes such as GASP, rs/GASP$q$16, or PoleGap may outperform CATs.

A phase diagram of applicable regimes and numerical evaluations of cross-over points are given in the literature (Hofmeister et al., 21 Jan 2025, Nomeir et al., 28 Nov 2025).

---

References

• CAT and DOG: Improved Codes for Private Distributed Matrix Multiplication (Hofmeister et al., 21 Jan 2025)
• Quantum Private Distributed Matrix Multiplication With Degree Tables (Nomeir et al., 28 Nov 2025)