Modular Pipelined NTT Accelerators

• Modular pipelined NTT accelerators are specialized hardware implementations that decompose the number theoretic transform into reusable modular units and pipelined stages.
• They integrate techniques like unified butterfly units, digit-serial arithmetic, and constant-specialized multipliers to optimize throughput, reduce latency, and lower power consumption.
• Targeted for cryptographic applications such as homomorphic encryption and lattice-based PQC, these accelerators balance scalability, unification, and verifiability across heterogeneous platforms.

Modular pipelined NTT accelerators are hardware realizations of the Number Theoretic Transform in which butterfly arithmetic, modular reduction, buffering, and stage scheduling are organized as reusable modules and executed through a staged datapath. In contemporary hardware literature, “modular” refers both to arithmetic modularity—such as homogeneous digit-serial modulo units, unified butterflies, or constant-specialized multipliers—and to architectural modularity—such as reusable processing elements, stage macros, or NTT tiles—while “pipelined” spans radix-2 SDF and MDC pipelines, parallel iterative PE arrays, partial stage pipelines, memory-centric in-place pipelines, and matrix-systolic realizations. The principal target domains are fully homomorphic encryption, lattice-based PQC, and hybrid homomorphic encryption, where large transform sizes, large or multi-precision moduli, memory-bandwidth limits, and masking composability are the dominant constraints (Alexakis et al., 16 Jul 2025, Gu et al., 2 Mar 2026, Iskander et al., 4 May 2026).

1. Architectural meaning of modularity and pipelining

In this design class, modularity is not limited to modular arithmetic. One line of work defines three simultaneous forms: digit modularity, where any digit width $d$ may be selected; pipeline modularity, where each stage is a copy of the same digit-serial BFU-plus-multiplier block; and path modularity, where the number of parallel paths $P$ scales independently of stage logic (Alexakis et al., 16 Jul 2025). A closely related formulation uses a reusable unified butterfly microarchitecture as the atomic PE and replicates it across a configurable $w \times d$ array with conflict-free memory mapping, so that the same PE array computes all stages of the NTT or INTT iteratively (Alexakis et al., 1 Jul 2026).

Pipelining is equally heterogeneous. In some architectures, every transform stage is a dedicated spatial stage; in others, only a partial stage pipeline is instantiated and the remaining stages are covered by iteration. SFQ work makes this explicit by instantiating one PE per radix-2 stage for $N=128$, with each PE containing a butterfly unit, dual coefficient memories in ping-pong mode, and twiddle buffers, so that the entire transform becomes a constant-geometry streaming pipeline (Razmkhah et al., 28 Aug 2025). Other designs retain a single or two-parallel butterfly datapath and use delay-switch-delay structures or banked memories to preserve a feed-forward schedule (Tan et al., 2023).

A recurrent misconception is that pipelined NTT acceleration is equivalent to full-stage spatial unrolling. The literature instead includes single-path delay-feedback pipelines, multipath delay-commutator pipelines, iterative PE arrays with fixed on-chip banking, partial pipelines for multi-length support, SRAM- and DRAM-centric in-place pipelines, and systolic mappings onto AI matrix engines (Alexakis et al., 16 Jul 2025, Gu et al., 2 Mar 2026, Alexakis et al., 18 Jun 2026). Another misconception is that digit-serial arithmetic is useful only inside a multiplier. Homogeneous digit-serial designs explicitly reject that pattern by keeping every operation—add, subtract, multiply, and integrated reduction—in the digit domain from input to final correction, without intermediate wide-word reduction or (de)serialization (Alexakis et al., 16 Jul 2025).

2. Arithmetic kernels, representations, and reduction strategies

A major line of development is homogeneous digit-serial modular arithmetic. Let $W = \lceil \log_2 Q \rceil$ and represent a word as

$$x = \sum_{i=0}^{W/d - 1} x_i \cdot 2^{i d},\quad x_i \in [0,2^d - 1].$$

The corresponding NTT datapath processes one $d$-bit digit per cycle and realizes all butterfly operations with digit-serial adders, subtractors, constant adders, and Montgomery multipliers (Alexakis et al., 16 Jul 2025). The crucial range device is a redundant Montgomery representation over $[0,2Q-1]$. With inputs and twiddles in Montgomery form, subtraction is aligned with addition by injecting a fixed offset: $$t_{\text{sub}} = (a_i - a_j + 2Q)\,\omega^k \bmod Q.$$ If the Montgomery radix satisfies $R > 8Q$, the output of the digit-serial Montgomery multiplier remains in $P$0, so per-stage conditional subtraction is eliminated and the same range is preserved across all stages (Alexakis et al., 16 Jul 2025).

A closely related FPGA line generalizes this redundant arithmetic to a unified butterfly supporting both NTT and INTT. There, all persistent values remain in $P$1, selected internal values may reach $P$2, and the datapath width is

$P$3

With $P$4, the architecture removes the correction after Montgomery multiplication and the correction after subtract-before-multiply in the INTT path; it also integrates one divide-by-2 by pre-scaling INTT twiddles and merges the other divide-by-2 with the adder’s range correction. The Montgomery multiplier uses 6 pipeline stages, and the total unified butterfly latency is 8 cycles (Alexakis et al., 1 Jul 2026).

A different arithmetic specialization treats all algorithm parameters as synthesis-time constants. In that approach, fixed values such as $P$5, $P$6, twiddle factors $P$7, and $P$8 are absorbed into shift-and-add or shift-and-sub constant multipliers. The resulting fully unrolled radix-2 network can deliver one full $P$9-point NTT per clock once the pipeline is full, while avoiding stored twiddle tables and generic multipliers in the butterfly datapath (Nabeel et al., 25 Jan 2026).

Reduction strategy varies with platform. FPGA-centric unified butterflies and constant-specialized engines use Montgomery or Barrett-style modular multiplication with fixed-width DSP-oriented pipelines (Alexakis et al., 1 Jul 2026, Nabeel et al., 25 Jan 2026). Memory-centric designs prefer in-place reduction patterns aligned with their substrate. MeNTT uses bit-serial modular multiplication with on-the-fly reduction in SRAM, maintaining the partial sum in $w \times d$0 by subtracting $w \times d$1, $w \times d$2, or $w \times d$3 during accumulation; this avoids a separate Barrett or Montgomery pass and matches per-column bit-serial execution (Li et al., 2022). TPU-like multi-precision systolic arrays push full-precision reconstruction into the array itself and leave the final modular reduction to the vector unit, because the main bottleneck is not modular reduction but digit reconstruction after low-precision matrix multiplication (Alexakis et al., 18 Jun 2026).

3. Pipeline organizations and memory/dataflow schemes

The baseline streaming template remains the radix-2 pipelined NTT. In a digit-serial single-path design, each stage follows the SDF pattern: a local buffer of size $w \times d$4, a move phase, and a compute phase. The buffer stores digits rather than full words, the butterfly unit emits digit-serial sums and subtractions plus $w \times d$5, and the systolic Montgomery multiplier—composed of $w \times d$6 PEs—accepts and emits one digit per cycle once warm. The multipath extension sets $w \times d$7 paths, each executing an $w \times d$8-point pipelined NTT, with a final $w \times d$9-point parallel NTT across digit lanes; this is how the architecture preserves aggregate bandwidth while shrinking $N=128$0 (Alexakis et al., 16 Jul 2025).

Feed-forward folded pipelines represent a second major organization. PaReNTT uses two-parallel low-complexity DIT NTT and DIF iNTT stages, folded onto $N=128$1 physical PEs with $N=128$2 delay-switch-delay blocks. The architecture is fully feed-forward and can be pipelined at arbitrary levels. It also eliminates the conventional permutation between NTT and iNTT, reducing latency by $N=128$3 clock cycles and removing one delay-switch-delay circuit of size $N=128$4 (Tan et al., 2023).

Hybrid partial pipelines combine stage-spatial and data-temporal unfolding. Hermes fixes $N=128$5, $N=128$6, and $N=128$7, instantiates a partial stage pipeline of NTTUs, and completes larger transforms by $N=128$8 iterations. Each NTTU contains a control unit, a read unit, and two BUs. The BUs can operate in Butterfly Mode or Swap Mode, which allows the same partial pipeline to implement both computation and required permutations. The associated on-chip fragmentation algorithm,

$N=128$9

guarantees conflict-free URAM accesses and enables burst HBM transfers despite heterogeneous butterfly strides (Gu et al., 2 Mar 2026).

Memory-centric pipelines replace explicit butterfly networks with the memory fabric itself. MeNTT maps an $W = \lceil \log_2 Q \rceil$0-point radix-2 Cooley–Tukey NTT onto a single 6T-SRAM bank: each column acts as a butterfly lane, operands and twiddles are stored vertically, modular multiplication and add/sub are performed by per-column bit-serial peripherals, and inter-stage movement is reduced to a unique, stage-independent routing pattern (Li et al., 2022). NTT-PIM adopts an analogous row-centric strategy in DRAM PIM. It divides execution into intra-atom, intra-row, and inter-row regimes, uses Montgomery multiplication in the near-bank CU, and overlaps load, compute, and write-back through multiple atom buffers. Its C1 and C2 commands implement in-place butterfly phases while minimizing ACT/PRE penalties (Park et al., 2023).

At the opposite end of the technology spectrum, SFQ designs realize the pipeline spatially at the stage level. SCE-NTT instantiates 7 PEs for an NTT-128, one PE per radix-2 stage, with each PE containing a fully pipelined butterfly unit, coefficient memories implemented as FIFO/shift-register memory, and twiddle memories. Once the global pipeline is full, one completed NTT result is produced every 64 cycles (Razmkhah et al., 28 Aug 2025).

4. Scalability, unification, and heterogeneous platforms

Scalability appears in several forms. One is arithmetic and path scaling. In the homogeneous digit-serial architecture, smaller $W = \lceil \log_2 Q \rceil$1 simplifies each PE and raises clock frequency, while $W = \lceil \log_2 Q \rceil$2 is increased to preserve the same external bandwidth, for example 256 bits/cycle (Alexakis et al., 16 Jul 2025). Another is width scaling around FPGA DSP structure. The unified redundant-butterfly design provides a 17-bit Montgomery multiplier using 3 DSP blocks and a 34-bit version using 11 DSP blocks, allowing the same architectural template to cover ML-KEM-, Falcon-, NewHope-, and ML-DSA-class moduli (Alexakis et al., 1 Jul 2026).

A second form is multi-length support. Hermes keeps one bitstream and switches among $W = \lceil \log_2 Q \rceil$3, $W = \lceil \log_2 Q \rceil$4, through iteration count, stage mode patterns, and twiddle tables, specifically to support both CKKS and TFHE in HHE workflows (Gu et al., 2 Mar 2026). Unified FFT/NTT hardware reaches the same goal from the opposite direction: a 9-stage butterfly pipeline, 8-bank data RAM, and shared arithmetic are configured by a 2-bit mode input to execute a 512-point complex FFT, a 256-point Dilithium NTT, or a Kyber NTT realized as 128 coefficient pairs. In that organization, one butterfly pipeline computes either 1 FFT butterfly, 2 parallel Dilithium NTT butterflies, or 4 parallel Kyber NTT butterflies (Shrivastava et al., 15 Apr 2025).

A third form is workload-level unification. KyberMat is not a standalone NTT core, but it couples $W = \lceil \log_2 Q \rceil$5 independent 128-point R2MDC NTT engines, a fully parallel NTT-domain matrix–vector multiplication datapath, and $W = \lceil \log_2 Q \rceil$6 R2MDC iNTT engines in a strict feed-forward pipeline. Polyphase decomposition and sub-structure sharing reduce modular multiplications with $W = \lceil \log_2 Q \rceil$7 from $W = \lceil \log_2 Q \rceil$8 down to $W = \lceil \log_2 Q \rceil$9, and the same framework extends from $$x = \sum_{i=0}^{W/d - 1} x_i \cdot 2^{i d},\quad x_i \in [0,2^d - 1].$$0 to $$x = \sum_{i=0}^{W/d - 1} x_i \cdot 2^{i d},\quad x_i \in [0,2^d - 1].$$1 and further to $$x = \sum_{i=0}^{W/d - 1} x_i \cdot 2^{i d},\quad x_i \in [0,2^d - 1].$$2 (Tan et al., 2023).

A fourth form is platform adaptation. Multi-precision systolic arrays for AI ASICs keep standard 8-bit multipliers and weight-stationary dataflow, but replace only the last row with Reconstruction PEs so that full-precision reconstruction occurs inside the array. The NTT is then mapped through the 4-step algorithm and BAT matrix representation, keeping matrix multiplication and reconstruction under one uniform systolic dataflow (Alexakis et al., 18 Jun 2026). This suggests that modular pipelined NTT acceleration can be embedded into general-purpose matrix engines without abandoning pipeline regularity.

5. Performance landscape

The reported results span ASICs, FPGAs, AI ASICs, PIM substrates, and SFQ logic, so they document multiple optimization regimes rather than a single normalized frontier.

Design	Platform or setting	Reported result
Homogeneous digit-serial NTT (Alexakis et al., 16 Jul 2025)	ASAP 7 nm, $$x = \sum_{i=0}^{W/d - 1} x_i \cdot 2^{i d},\quad x_i \in [0,2^d - 1].$$3, same I/O bandwidth $$x = \sum_{i=0}^{W/d - 1} x_i \cdot 2^{i d},\quad x_i \in [0,2^d - 1].$$4 bits/cycle	~600 MHz, ~33% higher maximum clock frequency than Proteus, ~8% area reduction, ~30% average power reduction
Unified redundant butterfly (Alexakis et al., 1 Jul 2026)	Virtex-7	17-bit BFU: 437 MHz; 34-bit BFU: 391 MHz; $$x = \sum_{i=0}^{W/d - 1} x_i \cdot 2^{i d},\quad x_i \in [0,2^d - 1].$$5, $$x = \sum_{i=0}^{W/d - 1} x_i \cdot 2^{i d},\quad x_i \in [0,2^d - 1].$$6, 14+3 bits: 336 cycles at 270 MHz, $$x = \sum_{i=0}^{W/d - 1} x_i \cdot 2^{i d},\quad x_i \in [0,2^d - 1].$$7
Constant-optimized full unroll (Nabeel et al., 25 Jan 2026)	TSMC 28 nm / FPGA	1.0 GHz with area 1.45 mm$$x = \sum_{i=0}^{W/d - 1} x_i \cdot 2^{i d},\quad x_i \in [0,2^d - 1].$$8 for Dilithium NTT; throughput-per-LUT 5.2x higher than the state-of-the-art implementation
Hermes hybrid dataflow (Gu et al., 2 Mar 2026)	Alveo U280	$$x = \sum_{i=0}^{W/d - 1} x_i \cdot 2^{i d},\quad x_i \in [0,2^d - 1].$$9: 64,172 OPS; up to 13.6x and 1.3x higher throughput than state-of-the-art GPU and FPGA accelerators
Multi-precision systolic array (Alexakis et al., 18 Jun 2026)	128×128 MXU, 7 nm	at least 1.33x speedup; 0.17% area overhead and 0.34% power overhead for a 128×128 MXU
SCE-NTT (Razmkhah et al., 28 Aug 2025)	RSFQ, 34 GHz	531 million NTT/sec, over 100x faster than state-of-the-art CMOS equivalents
KyberMat (Tan et al., 2023)	Artix-7	approximate reduction of 90% in execution time and 66 times improvement in throughput performance

Within CMOS and FPGA arithmetic pipelines, the dominant trend is that reduction elimination and shorter local critical paths matter as much as raw parallelism. In the homogeneous digit-serial ASIC, decreasing $d$0 from 128 bits to 16 bits roughly doubles maximum clock frequency, increases area by about 33%, and decreases power (Alexakis et al., 16 Jul 2025). In the unified redundant-butterfly FPGA architecture, the main gain over prior work comes from eliminating per-operator correction chains while keeping BFU latency at 8 cycles, which yields execution-time reductions of about 34–55% against comparable configurable accelerators, depending on $d$1, modulus width, and PE count (Alexakis et al., 1 Jul 2026). In constant-optimized full-unroll designs, the central result is not merely frequency but the combination of one NTT per cycle steady-state throughput and compact constant-multiplier logic (Nabeel et al., 25 Jan 2026).

Memory-centric and platform-adapted accelerators show different bottlenecks. NTT-PIM reports 1.7 ~ 17 times runtime improvement over previous best PIM-based NTT accelerators while keeping negligible area and power overhead, indicating that buffering and mapping can dominate arithmetic cost in DRAM PIM (Park et al., 2023). MeNTT, by contrast, shows that in SRAM PIM the limiting term is bit-serial modular multiplication, so architecture and mapping focus on on-the-fly reduction and stage-independent routing rather than high-radix arithmetic (Li et al., 2022). On AI matrix engines, cycle-accurate simulations show that integrating reconstruction into the array removes the vector-processor bottleneck created by shift-and-add reconstruction, which is why the modified systolic array reaches the reported speedup with negligible hardware overhead (Alexakis et al., 18 Jun 2026).

6. Verification, masking, and composability

For masked modular pipelined NTT accelerators, recent work has shifted from isolated gadget analysis to pipeline-level composability. A machine-checked Lean 4 development proves that a Cooley–Tukey butterfly with a fresh output mask has per-context uniformity: for each output wire and any fixed context, exactly one mask value produces each output value. The same work proves that a $d$2-stage NTT pipeline with fresh per-stage masking satisfies per-context uniformity at every stage under the ISW first-order probing model, while explicitly documenting that pointwise value-independence is false for butterfly outputs (Iskander et al., 22 Apr 2026). A common misconception is therefore that “secure stages compose automatically”; the formal result is narrower and requires fresh output masks and fresh re-masking between stages.

A more general compositional theorem is available for masked modular reductions. For a $d$3-stage masked pipeline with fresh inter-stage masking and per-stage PF-PINI($d$4) gadgets, the preimage bound is

$d$5

and the standard probabilistic interpretation yields a per-observation conditional probability bound of $d$6, independent of pipeline depth $d$7. The same paper proves that Montgomery reduction satisfies PF-PINI(2) with tight max multiplicity 2, placing masked Barrett and Montgomery reductions in the same first-order compositional class (Iskander et al., 4 May 2026). This directly concerns modular pipelined NTT accelerators because their performance-critical butterfly and reduction pipelines are often 2–8 stages deep.

At the netlist level, structural dependency analysis has been scaled to production masked NTT hardware. Applied to the 1.17-million-cell Adams Bridge ML-DSA/ML-KEM accelerator, structural analysis completes in seconds across all 30 masked submodules, while a multi-cycle extension reclassifies 12 modules from structurally clean to structurally flagged. On the 5,543-cell ML-KEM Barrett reduction module, the verification hierarchy machine-verifies 198 of 363 structurally flagged wires as first-order secure, reports 165 as candidate insecure for designer triage, and leaves 0 indeterminate; Z3 and CVC5 disagree on none of the 363 wires (Iskander et al., 16 Apr 2026). This result is particularly relevant for deep pipelines, because multi-cycle share reconvergence can be invisible to single-cycle analysis yet still appear after crossing many pipeline registers.

These guarantees remain conditional. The formal pipeline results assume a first-order probing model, ideal masking and RNG, no glitches, no timing leakage, and linear pipeline topology (Iskander et al., 4 May 2026, Iskander et al., 22 Apr 2026). Structural verification likewise gives a sound upper bound under its model, not a physical side-channel proof (Iskander et al., 16 Apr 2026). A plausible implication is that future modular pipelined NTT accelerators will increasingly be co-designed with verification: redundant arithmetic and conflict-free dataflow for performance, plus fresh-mask renewal, carefully aligned pipeline registers, and small share-combining gadgets for verifiability.

The main open directions already identified in the literature are mechanizing the probability interpretation of the cardinality bounds, extending PF-PINI and pipeline theorems to higher-order probing, handling branching or feedback pipelines, and combining gadget-level arithmetic proofs with gate-level tools for glitches and physical defaults (Iskander et al., 4 May 2026, Iskander et al., 22 Apr 2026). On the architectural side, the unresolved tension remains the same across substrates: the highest-performance modular pipelined NTT accelerators are those that make arithmetic regular, dataflow local, and stage interfaces explicit enough that both synthesis and verification can exploit the regularity.