---
title: Cyclic Addition Tables in PDMM
url: https://www.emergentmind.com/topics/cyclic-addition-tables-cat
type: topic
---

# Cyclic Addition Tables in PDMM

Cyclic Addition Tables (CAT) are a family of degree-table codes for private distributed matrix multiplication (PDMM), extending conventional integer-based degree-table frameworks by implementing a cyclic group structure on polynomial exponents. CATs utilize modulo addition (over $\mathbb{Z}_q$ for suitable $q$) and roots of unity as evaluation points, achieving improved worker-efficiency through denser packing of sum exponents. The framework enables perfect $T$-privacy and exact decodability, particularly benefiting low-privacy regimes (i.e., $T \ll \min(K,L)$), and has quantum extensions that admit rate-doubling via feasibility criteria that depend on the distribution of "interference" exponents [2501.12371][2511.23406].

## 1. Formal Definition and Structural Properties

Given integers $K,L,T\geq 1$, a Cyclic Addition Table for parameters $(K,L,T)$ with $N$ unique entries is a tuple  
$(q, \alpha^{(p)}, \alpha^{(s)}, \beta^{(p)}, \beta^{(s)})$  
where
- $\alpha^{(p)} \in \mathbb{Z}^K$ and $\alpha^{(s)} \in \mathbb{Z}^T$ encode the "product" and "secret" exponents for $A$,
- $\beta^{(p)} \in \mathbb{Z}^L$ and $\beta^{(s)} \in \mathbb{Z}^T$ are analogous for $B$,
- $q \geq N$ is the modulus,
- All additions are over $\mathbb{Z}_q$.

The combined set of all possible sums,
$$
\Gamma = \mathrm{vec}\left( \{ \alpha^{(p)}_i \}_{i=1}^K \cup \{ \alpha^{(s)}_i \}_{i=1}^T +_{\mathbb{Z}_q} \{ \beta^{(p)}_j \}_{j=1}^L \cup \{ \beta^{(s)}_j \}_{j=1}^T \right)
$$
with $\mathrm{vec}(\cdot)$ denoting the vector of residues in increasing order, partitions the $q\times q$ addition table into four quadrants. The structural requirements are:
1. All four quadrants collectively produce exactly $N$ distinct residues modulo $q$.
2. The top-left quadrant defines $K \cdot L$ distinct residues, with each representing a desired outer block-product.
3. Off-diagonal quadrants (top-right, bottom-left, bottom-right) must be disjoint from each other and from the top-left (i.e., product terms never mix with noise/randomization terms).
4. A field $\mathbb{F}_p$ is chosen so that $q \mid (p-1)$, ensuring the existence of a primitive $q$-th root of unity $\omega$. Evaluation at $\rho_k = \omega^{k-1}$ for $k=1,\ldots,N$ yields invertibility in the corresponding Vandermonde matrices for both decoding (entire degree table) and for $T$-privacy (any $T\times T$ submatrix in $\alpha^{(s)}$ or $\beta^{(s)}$).

This structure ensures that decoding via polynomial interpolation is unambiguous, and that $T$-privacy is information-theoretically enforced [2501.12371].

## 2. Explicit CAT Construction and Parameter Computation

The canonical construction, denoted CAT$_x$, is defined as follows for $K \geq L \geq T \geq 2$:
- Define $\overline{T}=T-1$;
- Find the smallest nonnegative integers $\kappa$, $\lambda$ such that $K^*=K+1+\kappa$ and $L^*=L+1+\lambda$ are co-prime with $\overline{T}$;
- Set $q=K^*L^* + (\overline{T})^2$;
- Choose $x$ coprime to $q$, then solve $x+\overline{T}y \equiv 0 \pmod{q}$ for $y$;
- Set exponents:
  - $\alpha^{(p)} = y \cdot [0,\ldots,K-1]$,
  - $\alpha^{(s)} = x \cdot [0,\ldots,\overline{T}] + K^* y$,
  - $\beta^{(p)} = x \cdot [0,\ldots,L-1]$,
  - $\beta^{(s)} = y \cdot [0,\ldots,\overline{T}] - x$,
  all modulo $q$.

The degree table defines the exponents for encoding polynomials. Each entry in the block-product quadrant maps uniquely to one of $\{0,1,\ldots,KL-1\}$ mod $q$, with noise and cross terms mapped to disjoint intervals according to the combinatorial construction, ensuring the separation properties [2501.12371][2511.23406].

## 3. Encoding, Evaluation, Decoding, and Privacy

For PDMM applications, let $A$ and $B$ over $\mathbb{F}_p$ be partitioned into outer-product blocks:
$$
A = \begin{pmatrix} A_1 \\ \vdots \\ A_K \end{pmatrix}, \quad 
B = \begin{pmatrix} B_1\\ \vdots \\ B_L \end{pmatrix}
$$
with $T$ random masks $R_1,\ldots,R_T$ for $A$ and $S_1,\ldots,S_T$ for $B$. Encoding polynomials are formed as:
$$
A(x) = \sum_{i=1}^K A_i x^{\alpha^{(p)}_i} + \sum_{r=1}^T R_r x^{\alpha^{(s)}_r}, \\
B(x) = \sum_{j=1}^L B_j x^{\beta^{(p)}_j} + \sum_{r=1}^T S_r x^{\beta^{(s)}_r}
$$
Each worker $k \in \{1,\ldots,N\}$ evaluates $C_k = A(\rho_k) B(\rho_k)$. The exponents in $C(x) = A(x)B(x)$ are segregated by the CAT table. The coefficients indexed by the top-left quadrant $(\alpha^{(p)}_i+\beta^{(p)}_j)$ recover $A_i B_j$. Upon collecting $N$ responses, the system in the worker evaluation points is invertible, guaranteeing perfect recovery.

$T$-privacy is achieved since any $T$ workers only see $T$ masked evaluations, and the mask randomness is protected by the invertibility property of the $T\times T$ submatrices, thus leaking no information about $(A,B)$ [2501.12371].

## 4. Worker Count and Comparisons with Conventional Schemes

The number of workers required, denoted $N_{\mathrm{CAT}}(K,L,T)$, is given by:
$$
N_{\mathrm{CAT}}(K,L,T) = (K+1)(L+1) + (T-1)^2 + \kappa(K,T) + \lambda(L,T)
$$
where $\kappa$ and $\lambda$ are as previously defined.

Comparison with GASP and DOG codes:
- GASP requires $N_{\mathrm{GASP}}(K,L,T)\approx (K+1)(L+1) + 2T + K + L - 3$ workers.
- CAT reduces worker count by $K+L-2T+O(1)$ (numerically up to $3T-5$ when $\kappa = \lambda = 0$), particularly when $T\ll K,L$.
- When $T$ becomes comparable to $K$ or $L$, conventional schemes may regain the advantage.

Asymptotically, for fixed $T\ll K \approx L \sim N^{1/2}$:
- $N_{\mathrm{CAT}} \sim K^2 + 2K + T^2$
- $N_{\mathrm{GASP}} \sim K^2 + 2K + 2KT$
CAT achieves its efficiency in the low-privacy regime by efficiently exploiting the cyclic structure of the exponents to compress noise terms [2501.12371][2511.23406].

## 5. Field Requirements and Evaluation Points

The CAT scheme necessitates a field $\mathbb{F}_p$ such that $p-1$ is divisible by $q$, ensuring the existence of a primitive $q$-th root of unity $\omega \in \mathbb{F}_p^\times$. Worker $k$ is assigned the evaluation point $\rho_k = \omega^{k-1}$. For any exponent $d \in \{0,1,\ldots,q-1\}$,
$$
\rho_k^d = \omega^{(k-1)d} = \omega^{(k-1)(d \bmod q)}
$$
Thus, exponent addition for encoded polynomial terms is performed modulo $q$, not over the integers, permitting “wrap-around” and greater flexibility in assignment and separation of noise and product terms.

In practice, selection of $p$ occurs via a short search for a prime $p \equiv 1 \pmod{q}$ [2501.12371].

## 6. Quantum Extensions and Feasibility Conditions

CAT codes extend to the quantum PDMM context. The feasibility of such an extension is controlled via the structure of the "interference subspace" $IS = \mathrm{Set}(PM)\setminus UL$, where $UL$ is the set of exponents corresponding to valid block-products. The quantum extension, enabling two independent $AB$ decodings via super-dense coding, is available if the longest consecutive chain in $IS$, $|LCC(IS)|$, satisfies $|LCC(IS)| \geq \lceil N/2 \rceil$.

Upload/download rates in the quantum regime are doubled (i.e., $R_Q(K,L,T) = 2 KL/N$) when the feasibility test holds. This feasibility criterion unifies that for all rank-based OPP codes (GASP, DOG, CAT), and is especially notable as CAT$_x$ codes provide the first known nontrivial low-privacy example passing this test. When feasibility fails, quantum-native PDMM schemes may still exist but will typically require increased server randomness or dimensional embedding [2511.23406].

## 7. Use Cases, Applications, and Limitations

CATs are optimally suited for PDMM and SDMM scenarios where:
- The privacy threshold $T$ is strictly smaller than both $K$ and $L$ (low-privacy regime).
- Worker minimization is desired, as the modulo structure can result in smaller $N$ than non-cyclic schemes.
- Quantum communication infrastructure is available, and feasibility for rate-doubling is satisfied.

When $T$ approaches $K$ or $L$, or when the field-size constraint is prohibitive, conventional schemes such as GASP, rs/GASP$_r$, or PoleGap may outperform CATs.

A phase diagram of applicable regimes and numerical evaluations of cross-over points are given in the literature [2501.12371][2511.23406].

---

**References**

- CAT and DOG: Improved Codes for Private Distributed Matrix Multiplication [2501.12371]
- Quantum Private Distributed Matrix Multiplication With Degree Tables [2511.23406]

Source: https://www.emergentmind.com/topics/cyclic-addition-tables-cat