Recomputation with Shifted Operand (RESO)

• Recomputation with Shifted Operand (RESO) is a fault detection method that employs deliberate operand shifts and algebraic redundancy to verify arithmetic results.
• It is applied in FPGA implementations of Barrett reduction for post-quantum cryptography, achieving nearly 100% fault detection with minimal hardware overhead.
• RESO also inspires broader systems for repairing shifted contexts, influencing approaches in cache reuse and shift-XOR coding techniques.

Searching arXiv for papers explicitly mentioning RESO and closely related shifted-operand recomputation work. Recomputation with Shifted Operand (RESO) is a recomputation-based checking paradigm in which an operation is re-executed on deliberately shifted operands and then mapped back to the original computational domain so that the recomputed result should coincide with the baseline result under fault-free execution. In the arXiv literature, the term is used explicitly as an existing fault-detection method in FPGA implementations of post-quantum cryptographic datapaths, and more broadly as a useful lens for analyzing reuse-and-repair problems in which a precomputed object becomes invalid after a positional or contextual shift (Baidya et al., 4 Sep 2025, Chen et al., 14 Apr 2026). Its core rationale is algebraic redundancy: if the transformation induced by shifting is deterministic and invertible in the relevant arithmetic setting, then faults are unlikely to preserve both the original computation and the shifted recomputation relation simultaneously.

1. Conceptual definition and operating principle

In the explicit PQC-hardware usage, RESO is defined through prior multiply-accumulate work as

$$ACC_{reso} = \text{shift}_{2r}(\text{shift}_l(A) \times \text{shift}_l(B) + \text{shift}_{2l}(C)),$$

and is treated as an existing recomputation idea rather than as a new invention (Baidya et al., 4 Sep 2025). The defining pattern is that the recomputation path does not reuse the original operands verbatim. Instead, it applies a controlled shift transformation, performs the recomputation in the transformed domain, and then applies the inverse compensation so that the recomputed output should equal the baseline output.

The Barrett-reduction adaptation makes this principle concrete. Both multiplicand operands are shifted left by one bit, which implies

$$\text{shift}_l(\alpha)=2\alpha,\qquad \text{shift}_l(\beta)=2\beta,$$

and therefore

$$c^f = \text{shift}_l(\alpha)\times \text{shift}_l(\beta)=4\alpha\beta.$$

Because the product is scaled by $2^2$, the recomputation path compensates by extracting a different bit slice from the Barrett quotient approximation and then right-shifting the final recomputed remainder by two bits. Under correct execution, the intended relation is

$r^f=r,$

which yields the fault-detection rule

$$r = r^f \ \Longrightarrow\ \text{no fault},\qquad r \ne r^f \ \Longrightarrow\ \text{fault}.$$

This places RESO in the general class of arithmetic consistency checks built from structured operand transforms rather than exact duplication (Baidya et al., 4 Sep 2025).

A broader interpretation appears in later systems work. In "KV Packet," the authors describe the same underlying failure mode as one in which a previously computed object is reused under a shifted left context, making the reused state stale unless repaired (Chen et al., 14 Apr 2026). That paper does not present itself as a classical fault-detection RESO scheme, but it explicitly situates its problem as “recomputation under shifted context / shifted operand reuse.” This suggests that RESO can be understood at two levels: narrowly, as a checker based on shifted arithmetic operands; and more generally, as a reuse-plus-repair pattern in which a shifted environment invalidates a precomputed intermediate state.

2. RESO in Barrett reduction and the Cooley–Tukey Butterfly Unit

The most direct arXiv treatment of RESO is "Error Detection Schemes for Barrett Reduction of CT-BU on FPGA in Post Quantum Cryptography" (Baidya et al., 4 Sep 2025). That work studies the Cooley–Tukey Butterfly Unit (CT-BU) used in Kyber-style number-theoretic transform hardware and proposes three lightweight recomputation-based fault-detection methods for Barrett Reduction: RESWO, RENO, and RESO. The paper is explicit that RESO itself is not new; the novelty is its application to Barrett Reduction inside CT-BU, reportedly for the first time (Baidya et al., 4 Sep 2025).

The protected modular multiplication is embedded in the butterfly as

$$U \gets \boldsymbol{\alpha}[j], \qquad V \gets MBRFD(\boldsymbol{\alpha}[j+t], r, q),$$

where

$r \gets \omega[m+i],$

followed by

$$\overline{\alpha}[j] \gets (U+V)\bmod q,\qquad \overline{\alpha}[j+t] \gets (U-V)\bmod q.$$

The Barrett-reduction block therefore computes the modular multiplication inside the butterfly datapath, and the recomputation unit acts as a parallel checker for that reduction result (Baidya et al., 4 Sep 2025).

The baseline word-wise modified Barrett reduction uses $l$-bit inputs divided into $$\text{shift}_l(\alpha)=2\alpha,\qquad \text{shift}_l(\beta)=2\beta,$$0-bit words and defines

$$\text{shift}_l(\alpha)=2\alpha,\qquad \text{shift}_l(\beta)=2\beta,$$1

For each word pair,

$$\text{shift}_l(\alpha)=2\alpha,\qquad \text{shift}_l(\beta)=2\beta,$$2

followed by positional padding,

$$\text{shift}_l(\alpha)=2\alpha,\qquad \text{shift}_l(\beta)=2\beta,$$3

and the reduction step

$$\text{shift}_l(\alpha)=2\alpha,\qquad \text{shift}_l(\beta)=2\beta,$$4

The top-level protected algorithm then invokes a recomputation block $$\text{shift}_l(\alpha)=2\alpha,\qquad \text{shift}_l(\beta)=2\beta,$$5 and compares $$\text{shift}_l(\alpha)=2\alpha,\qquad \text{shift}_l(\beta)=2\beta,$$6 and $$\text{shift}_l(\alpha)=2\alpha,\qquad \text{shift}_l(\beta)=2\beta,$$7 (Baidya et al., 4 Sep 2025).

In RESO, the recomputation algorithm is:

$$\text{shift}_l(\alpha)=2\alpha,\qquad \text{shift}_l(\beta)=2\beta,$$8

$$\text{shift}_l(\alpha)=2\alpha,\qquad \text{shift}_l(\beta)=2\beta,$$9

$$c^f = \text{shift}_l(\alpha)\times \text{shift}_l(\beta)=4\alpha\beta.$$0

$$c^f = \text{shift}_l(\alpha)\times \text{shift}_l(\beta)=4\alpha\beta.$$1

$$c^f = \text{shift}_l(\alpha)\times \text{shift}_l(\beta)=4\alpha\beta.$$2

The paper’s explanation of line 3 is operationally important. Since the shifted operands scale the product by $$c^f = \text{shift}_l(\alpha)\times \text{shift}_l(\beta)=4\alpha\beta.$$3, the Barrett quotient extraction window is shifted from $$c^f = \text{shift}_l(\alpha)\times \text{shift}_l(\beta)=4\alpha\beta.$$4 to $$c^f = \text{shift}_l(\alpha)\times \text{shift}_l(\beta)=4\alpha\beta.$$5, and the final remainder is then shifted right by two bits. The paper does not provide a theorem-proof derivation for RESO, but it does provide this scale-invariance-based rationale (Baidya et al., 4 Sep 2025).

3. Hardware architecture and implementation characteristics

The RESO architecture is described as a parallel recomputation unit rather than as a lightweight post hoc checker. In the Barrett-reduction implementation, the relevant datapath contains two multipliers $$c^f = \text{shift}_l(\alpha)\times \text{shift}_l(\beta)=4\alpha\beta.$$6 and $$c^f = \text{shift}_l(\alpha)\times \text{shift}_l(\beta)=4\alpha\beta.$$7, two left shifters $$c^f = \text{shift}_l(\alpha)\times \text{shift}_l(\beta)=4\alpha\beta.$$8 and $$c^f = \text{shift}_l(\alpha)\times \text{shift}_l(\beta)=4\alpha\beta.$$9, one right shifter $2^2$0, and one subtractor $2^2$1. The left shifters move $2^2$2 and $2^2$3 left by one bit and pad a $2^2$4 at the least significant position; the recomputed multiplication generates $2^2$5; a Barrett-style quotient path based on $2^2$6 extracts the shifted bit range $2^2$7; the subtractor computes the shifted-domain remainder; the right shifter undoes the scale by shifting by two bits; and a comparator checks $2^2$8 against $2^2$9 (Baidya et al., 4 Sep 2025).

At CT-BU level, the paper describes a baseline Barrett Reduction block producing $r^f=r,$0, a ReComp block producing $r^f=r,$1, and a comparator block producing the fault indication. If $r^f=r,$2, the butterfly proceeds with the accepted value $r^f=r,$3; if $r^f=r,$4, the fault is signaled. The scheme therefore duplicates the necessary reduction-side hardware for recomputation, but not the entire butterfly datapath (Baidya et al., 4 Sep 2025).

The reported FPGA platform is a Xilinx Artix-7, device $r^f=r,$5, implemented in Vivado 22.02 using VHDL at 100 MHz. For the Kyber CT-BU comparison, the parameters are $r^f=r,$6, $r^f=r,$7, $r^f=r,$8, and $r^f=r,$9. The baseline CT-BU uses 573 slices, 972 / 239 LUTs/FFs, 2 / 1 DSPs/BRAMs, 131 mW, and 9.39 ns delay. The Barrett block alone uses 76 slices, 254 / 89 LUTs/FFs, 0 / 0 DSPs/BRAMs, 101 mW, and 7.177 ns delay. The RESO block uses 51 slices, 182 / 42 LUTs/FFs, 0 / 0 DSPs/BRAMs, 2 mW, and 9.61 ns delay (Baidya et al., 4 Sep 2025).

4. Quantitative comparison with RENO and RESWO

The Barrett-reduction study compares RESO with Recomputation with Negated Operand (RENO) and the paper’s new Recomputation with Swapped Operand (RESWO). At recomputation-block level, the reported figures are as follows (Baidya et al., 4 Sep 2025):

Scheme	Block metrics	CT-BU overhead / coverage
RESWO	52 slices, 190 / 38 LUTs/FFs, 2 mW, 9.51 ns	9.07% area, 2.02% delay, 1.52% energy, $$r = r^f \ \Longrightarrow\ \text{no fault},\qquad r \ne r^f \ \Longrightarrow\ \text{fault}.$$0
RENO	56 slices, 197 / 48 LUTs/FFs, 2 mW, 9.67 ns	9.77% area, 2.98% delay, 1.52% energy, $$r = r^f \ \Longrightarrow\ \text{no fault},\qquad r \ne r^f \ \Longrightarrow\ \text{fault}.$$1
RESO	51 slices, 182 / 42 LUTs/FFs, 2 mW, 9.61 ns	8.9% area, 2.34% delay, 1.52% energy, $$r = r^f \ \Longrightarrow\ \text{no fault},\qquad r \ne r^f \ \Longrightarrow\ \text{fault}.$$2

These numbers support a specific placement of RESO within the three-way design space. RESO has the smallest slice count among the three recomputation units. It improves on RENO in both slices and delay, while remaining slightly slower than RESWO. At CT-BU level, the paper identifies RESO as having the best area overhead, RESWO as having the best delay overhead, and all three as having the same reported energy overhead and essentially the same overall detection level (Baidya et al., 4 Sep 2025).

The fault-injection methodology is software-based rather than exhaustive internal RTL or gate-level injection. The authors implemented the schemes in Python on Ubuntu 24.04 with an Intel i5 processor and 8 GB RAM and used 1.5 million samples. Faults were injected as random or burst flips into $$r = r^f \ \Longrightarrow\ \text{no fault},\qquad r \ne r^f \ \Longrightarrow\ \text{fault}.$$3, $$r = r^f \ \Longrightarrow\ \text{no fault},\qquad r \ne r^f \ \Longrightarrow\ \text{fault}.$$4, or both operands. For the RESO-specific table, the parameters are $$r = r^f \ \Longrightarrow\ \text{no fault},\qquad r \ne r^f \ \Longrightarrow\ \text{fault}.$$5, $$r = r^f \ \Longrightarrow\ \text{no fault},\qquad r \ne r^f \ \Longrightarrow\ \text{fault}.$$6, and $$r = r^f \ \Longrightarrow\ \text{no fault},\qquad r \ne r^f \ \Longrightarrow\ \text{fault}.$$7 flipped bits. The reported RESO detection efficiencies range from about 99.95% to 99.97% across these conditions (Baidya et al., 4 Sep 2025).

The paper therefore presents RESO as a lightweight but not perfect checker. It repeatedly reports “nearly 100%” efficiency, yet the tabulated values remain below exact 100%. This is significant because it indicates empirically strong but not formal full coverage, and the paper does not characterize the false negatives in detail (Baidya et al., 4 Sep 2025).

5. Broader research interpretations of shifted-operand recomputation

Outside PQC fault detection, several arXiv papers illuminate the broader computational motif behind RESO: reuse of a precomputed object under shifted placement, alignment, or context, followed by selective repair or reformulation.

In "KV Packet," the shifted object is a cached document KV block for a LLM. Standard KV caching is described as prefix-dependent: cached states depend on token identity, position, and the entire preceding context. RoPE misalignment can be corrected cheaply via

$$r = r^f \ \Longrightarrow\ \text{no fault},\qquad r \ne r^f \ \Longrightarrow\ \text{fault}.$$8

but contextual staleness remains the central issue (Chen et al., 14 Apr 2026). Existing methods such as CacheBlend, EPIC, A3, and SAM-KV are characterized as recomputation-based repairs that selectively recompute tokens. KV Packet instead replaces the reusable unit by a wrapped packet

$$r = r^f \ \Longrightarrow\ \text{no fault},\qquad r \ne r^f \ \Longrightarrow\ \text{fault}.$$9

with global document-independent header and trailer soft tokens, thereby attempting to make the reused operand more context-tolerant offline (Chen et al., 14 Apr 2026). Under a broad reading, this is a shifted-context variant of the same family: a previously computed operand is reused under changed surroundings, and the central question is whether repair should occur online by recomputation or offline by representation design.

"ProphetKV" occupies the complementary point in that design space. It addresses long-context RAG inference where precomputed chunk-wise KV caches are reused in a new prompt composition and a subset of tokens is recomputed to recover query-relevant cross-attention (Wang et al., 31 Jan 2026). The paper explicitly states that it is related to, but not identical with, a narrow “shifted operand” notion: position-independent cache reuse is assumed from prior work, while ProphetKV focuses on query-aware token selection after reuse. Its key scoring proxy is

$$U \gets \boldsymbol{\alpha}[j], \qquad V \gets MBRFD(\boldsymbol{\alpha}[j+t], r, q),$$0

derived from query-to-context attention, and the recomputation objective is framed through a residual semantic-loss formulation

$$U \gets \boldsymbol{\alpha}[j], \qquad V \gets MBRFD(\boldsymbol{\alpha}[j+t], r, q),$$1

This suggests a generalization of RESO from arithmetic redundancy to budgeted semantic repair: the shifted operand is a reused KV cache, and recomputation is targeted only where the shifted context most damages answer-relevant computation (Wang et al., 31 Jan 2026).

A different but structurally related line appears in "Decoding and Repair Schemes for Shift-XOR Regenerating Codes." That paper does not use the term RESO, but its central object is the shift-XOR equation

$$U \gets \boldsymbol{\alpha}[j], \qquad V \gets MBRFD(\boldsymbol{\alpha}[j+t], r, q),$$2

where $$U \gets \boldsymbol{\alpha}[j], \qquad V \gets MBRFD(\boldsymbol{\alpha}[j+t], r, q),$$3 denotes zero-padded shifts and addition is XOR (Fu et al., 2019). The contribution is an in-place “shift-XOR elimination” algorithm for solving systems of such equations without the bandwidth overhead of earlier zigzag methods. Under a broad interpretation, this is recomputation from shifted operands in a linear coding setting rather than a fault-detection setting (Fu et al., 2019).

6. Related substrates, limitations, and unresolved issues

A hardware substrate for shifted-operand generation appears in "Shifting in-DRAM" (Tegge et al., 27 Feb 2026). That work is not a RESO proposal, but it is directly relevant to any architecture that repeatedly materializes shifted variants of wide operands. Using migration cells in open-bitline DRAM, it implements a one-bit left or right shift of an entire horizontally stored row through four AAP sequences. In the evaluated DDR3 setup, one shift processes an entire 8 KB row, or 65,536 bits, by one bit position; the reported cost is 31.321 nJ and 208.7 ns for a single shift, with 0 nJ burst energy, and larger workloads show energy per shift of 31.85 nJ, 32.236 nJ, and 32.333 nJ for 50, 100, and 512 shifts, respectively (Tegge et al., 27 Feb 2026). For a RESO-style arithmetic pipeline, this provides a possible low-overhead operand-shift generator close to memory, although the paper notes important constraints: only open-bitline architectures are supported, only single-bit shifts are native, and boundary semantics are not formally specified (Tegge et al., 27 Feb 2026).

The explicit RESO literature also has clear limitations. In the Barrett-reduction paper, RESO does not receive a formal theorem or lemma analogous to the RESWO proof. Its justification is architectural and arithmetic rather than fully formal. The paper reports high empirical coverage, but not perfect coverage, and does not present a false-positive analysis. It also notes notation inconsistencies in the modified Barrett description, including mixed use of $$U \gets \boldsymbol{\alpha}[j], \qquad V \gets MBRFD(\boldsymbol{\alpha}[j+t], r, q),$$4 and $$U \gets \boldsymbol{\alpha}[j], \qquad V \gets MBRFD(\boldsymbol{\alpha}[j+t], r, q),$$5, which require careful reconstruction of the intended arithmetic (Baidya et al., 4 Sep 2025).

The broader reinterpretations likewise have scope limits. KV Packet targets models with RoPE positional encoding and scenarios in which retrieved documents are largely independent rather than tightly interdependent chains (Chen et al., 14 Apr 2026). ProphetKV assumes a query-conditioned RAG structure with the user query placed at the end of the prompt and relies on precomputed chunk-wise KV caches plus existing position-independent reuse machinery (Wang et al., 31 Jan 2026). Shift-XOR elimination depends on the refined increasing difference (RID) property and on product-matrix code structure for its decoding and repair decompositions (Fu et al., 2019). Taken together, these limits indicate that RESO is best viewed not as a single universal algorithm but as a recurring computational strategy whose concrete realization depends strongly on algebraic structure, positional semantics, and the type of state being recomputed.

In that sense, the most stable encyclopedia-level characterization is narrow but precise. RESO, in its explicit arXiv usage, is a recomputation-based checker that applies deliberate operand shifts, recomputes in the transformed domain, compensates for the induced scale change, and compares the recomputed output with the baseline result to detect faults (Baidya et al., 4 Sep 2025). Under broader systems interpretations, the same idea extends to reused caches, shifted contexts, and shifted linear combinations, where the central problem is no longer only fault detection but the recovery of correctness after operand relocation, context movement, or alignment change (Chen et al., 14 Apr 2026, Wang et al., 31 Jan 2026, Fu et al., 2019).