Succinct Oblivious Tensor Evaluation (OTE)

• Succinct OTE is defined as a non-interactive protocol that allows two parties to compute additive secret shares of tensor products with communication independent or only polylogarithmic in one large input dimension.
• The construction leverages lattice-based cryptography and the standard LWE assumption to achieve half-succinct and fully succinct protocols, ensuring correctness and encoder privacy via carefully designed digest and encoding procedures.
• OTE serves as a foundational component for advanced cryptographic primitives such as laconic function evaluation, reverse trapdoor hashing, and homomorphic secret sharing by compressing adaptive lattice encodings.

Succinct oblivious tensor evaluation (OTE) is a non-interactive primitive in which two parties compute an additive secret sharing of a tensor product $\mathbf{x}\otimes \mathbf{y}$ using two simultaneous messages, with the defining succinctness requirement that communication and common reference string (CRS) size be independent of, or only polylogarithmic in, one large input dimension. In the formulation introduced for lattice-based cryptography, OTE is the intermediate bilinear mechanism that supports adaptively secure laconic function evaluation, reverse trapdoor hashing, succinct homomorphic secret sharing, and rate-optimal batch oblivious transfer under the standard learning with errors (LWE) assumption (Abram et al., 13 Aug 2025). In a distinct but related tensor-algorithmic sense, recent work on tensor-train sketching also supports a succinct oblivious evaluation paradigm by designing structured random maps that are applied through recursive tensor contractions rather than explicit dense sketch formation (Cazeaux et al., 11 Mar 2026).

1. Formal model of non-interactive OTE

The basic object is non-interactive oblivious tensor evaluation (NI-OTE) for the functionality $Z_q^m \otimes Z_q^\ell$. Alice, or the hasher, holds $\mathbf{x}\in Z_q^m$; Bob, or the encoder, holds $\mathbf{y}\in Z_q^\ell$; after one round of simultaneous messages, each obtains a share of the tensor product. A NI-OTE scheme consists of the PPT algorithms

$(\Setup,\Hash,\Enc,\HashEval,\EncEval),$

with interface

$\Setup(1^\lambda)\to \mathrm{pp},\quad \Hash(\mathrm{pp},\mathbf{x})\to (d,\psi),\quad \Enc(\mathrm{pp},\mathbf{y})\to (E,\phi),$

$\HashEval(\mathrm{pp},E,\psi)\to \mathbf{v}\in Z_q^{m\cdot \ell},\qquad \EncEval(\mathrm{pp},d,\phi)\to \mathbf{w}\in Z_q^{m\cdot \ell}.$

Correctness requires that

$$\mathbf{v}+\mathbf{w}\approx \mathbf{x}\otimes \mathbf{y}.$$

The paper formalizes $\alpha$-correctness by

$\Pr\left[\|\mathbf{v}+\mathbf{w}-\mathbf{x}\otimes \mathbf{y}\|_\infty>\alpha\cdot \|\mathbf{x}\|_\infty\right]\le \negl(\lambda).$

If $Z_q^m \otimes Z_q^\ell$0, the scheme is perfectly correct. It also records the standard rounding trick: if $Z_q^m \otimes Z_q^\ell$1 and $Z_q^m \otimes Z_q^\ell$2 is negligible, one can encode $Z_q^m \otimes Z_q^\ell$3, compute shares over $Z_q^m \otimes Z_q^\ell$4, and round back to obtain an exact secret sharing modulo $Z_q^m \otimes Z_q^\ell$5 (Abram et al., 13 Aug 2025).

Privacy is encoder privacy: the encoding $Z_q^m \otimes Z_q^\ell$6 should be simulatable without knowing $Z_q^m \otimes Z_q^\ell$7. Succinctness is stratified into half-succinct, where only the digest is sublinear in the hasher’s input, and succinct or fully succinct, where both the hash and the encoding are sublinear in that input. The fully succinct construction described in the paper has CRS and digest size independent of the large input size, and encoding size polylogarithmic in the large dimension. A central point is that this notion does not compress the output itself: the resulting shares still live in $Z_q^m \otimes Z_q^\ell$8, so succinctness concerns the transmitted summaries and CRS rather than the size of the tensor product.

2. Construction from standard LWE and optimality claims

The first construction is a half-succinct NI-OTE from standard LWE. At a high level, the hasher samples a random binary matrix $Z_q^m \otimes Z_q^\ell$9 and computes the digest

$\mathbf{x}\in Z_q^m$0

The encoder samples secret randomness $\mathbf{x}\in Z_q^m$1 and noise matrices and vectors, and forms an LWE-style matrix

$\mathbf{x}\in Z_q^m$2

with $\mathbf{x}\in Z_q^m$3 the gadget vector and the $\mathbf{x}\in Z_q^m$4 term embedding the plaintext. Alice computes

$\mathbf{x}\in Z_q^m$5

while Bob computes

$\mathbf{x}\in Z_q^m$6

These satisfy

$\mathbf{x}\in Z_q^m$7

The privacy proof is described as an LWE hybrid argument: $\mathbf{x}\in Z_q^m$8 can be replaced by a random matrix because it is an LWE sample hidden under the public matrix $\mathbf{x}\in Z_q^m$9, and the proof uses the standard fact that LWE remains hard even when the public matrix is binary (NLWE) (Abram et al., 13 Aug 2025).

The theorem-level succinctness statement is explicit. If the LWE problem is hard, then there exists an NI-OTE protocol for $\mathbf{y}\in Z_q^\ell$0 and $\mathbf{y}\in Z_q^\ell$1 with communication complexity

$\mathbf{y}\in Z_q^\ell$2

and CRS of size

$\mathbf{y}\in Z_q^\ell$3

The digest size is poly$\mathbf{y}\in Z_q^\ell$4, independent of $\mathbf{y}\in Z_q^\ell$5, while the encoding size is $\mathbf{y}\in Z_q^\ell$6. The paper emphasizes that this is essentially optimal because the output itself has size $\mathbf{y}\in Z_q^\ell$7, because one cannot do better than linear in $\mathbf{y}\in Z_q^\ell$8 in the encoder’s input/output dimension, and because polylogarithmic dependence on the large dimension $\mathbf{y}\in Z_q^\ell$9 is the best one can hope for in the succinct setting.

3. Adaptive lattice encodings and OTE-based compression

A major technical development tied to OTE is the introduction of adaptive lattice encodings. The motivating problem is that standard $(\Setup,\Hash,\Enc,\HashEval,\EncEval),$0-style encodings,

$(\Setup,\Hash,\Enc,\HashEval,\EncEval),$1

are only selectively secure. The paper describes an explicit adaptive attack: by choosing $(\Setup,\Hash,\Enc,\HashEval,\EncEval),$2 after seeing $(\Setup,\Hash,\Enc,\HashEval,\EncEval),$3, an adversary can recover $(\Setup,\Hash,\Enc,\HashEval,\EncEval),$4, especially when the input length is large enough relative to the matrix dimensions. It further states that this directly shows that the adaptive LWE assumption of Quach–Wee–Wichs fails in the optimistic parameter regime (Abram et al., 13 Aug 2025).

The replacement encoding introduces two secrets: $(\Setup,\Hash,\Enc,\HashEval,\EncEval),$5 Here $(\Setup,\Hash,\Enc,\HashEval,\EncEval),$6 is the encryption key and $(\Setup,\Hash,\Enc,\HashEval,\EncEval),$7 is the authentication key. The stated significance is that adaptive security under standard LWE becomes possible because the adversary no longer gets the exploitable relation $(\Setup,\Hash,\Enc,\HashEval,\EncEval),$8 that exists in the $(\Setup,\Hash,\Enc,\HashEval,\EncEval),$9 form. Multiplication is more constrained, but it is preserved in a correlated-key regime: given

$\Setup(1^\lambda)\to \mathrm{pp},\quad \Hash(\mathrm{pp},\mathbf{x})\to (d,\psi),\quad \Enc(\mathrm{pp},\mathbf{y})\to (E,\phi),$0

one can compute an encoding of $\Setup(1^\lambda)\to \mathrm{pp},\quad \Hash(\mathrm{pp},\mathbf{x})\to (d,\psi),\quad \Enc(\mathrm{pp},\mathbf{y})\to (E,\phi),$1 with keys $\Setup(1^\lambda)\to \mathrm{pp},\quad \Hash(\mathrm{pp},\mathbf{x})\to (d,\psi),\quad \Enc(\mathrm{pp},\mathbf{y})\to (E,\phi),$2 via

$\Setup(1^\lambda)\to \mathrm{pp},\quad \Hash(\mathrm{pp},\mathbf{x})\to (d,\psi),\quad \Enc(\mathrm{pp},\mathbf{y})\to (E,\phi),$3

$\Setup(1^\lambda)\to \mathrm{pp},\quad \Hash(\mathrm{pp},\mathbf{x})\to (d,\psi),\quad \Enc(\mathrm{pp},\mathbf{y})\to (E,\phi),$4

OTE then acts as a compression mechanism for these encodings. A compressed encoding has two parts $\Setup(1^\lambda)\to \mathrm{pp},\quad \Hash(\mathrm{pp},\mathbf{x})\to (d,\psi),\quad \Enc(\mathrm{pp},\mathbf{y})\to (E,\phi),$5, where $\Setup(1^\lambda)\to \mathrm{pp},\quad \Hash(\mathrm{pp},\mathbf{x})\to (d,\psi),\quad \Enc(\mathrm{pp},\mathbf{y})\to (E,\phi),$6 is an adaptive lattice encoding of the OTE digest $\Setup(1^\lambda)\to \mathrm{pp},\quad \Hash(\mathrm{pp},\mathbf{x})\to (d,\psi),\quad \Enc(\mathrm{pp},\mathbf{y})\to (E,\phi),$7, and $\Setup(1^\lambda)\to \mathrm{pp},\quad \Hash(\mathrm{pp},\mathbf{x})\to (d,\psi),\quad \Enc(\mathrm{pp},\mathbf{y})\to (E,\phi),$8 is an OTE encoding of a fresh authentication key $\Setup(1^\lambda)\to \mathrm{pp},\quad \Hash(\mathrm{pp},\mathbf{x})\to (d,\psi),\quad \Enc(\mathrm{pp},\mathbf{y})\to (E,\phi),$9, using the old authentication key $\HashEval(\mathrm{pp},E,\psi)\to \mathbf{v}\in Z_q^{m\cdot \ell},\qquad \EncEval(\mathrm{pp},d,\phi)\to \mathbf{w}\in Z_q^{m\cdot \ell}.$0 as randomness. Expansion uses the OTE evaluation algorithms to recover a normal adaptive encoding of $\HashEval(\mathrm{pp},E,\psi)\to \mathbf{v}\in Z_q^{m\cdot \ell},\qquad \EncEval(\mathrm{pp},d,\phi)\to \mathbf{w}\in Z_q^{m\cdot \ell}.$1. The paper proves a simulatability theorem for the compressed encoding under LWE and OTE encoder privacy. This makes OTE not merely a tensor-product protocol but the compression layer that connects lattice encodings to higher-level adaptive constructions.

4. Derived cryptographic primitives

The principal downstream application is adaptively secure laconic function evaluation (LFE) for depth-$\HashEval(\mathrm{pp},E,\psi)\to \mathbf{v}\in Z_q^{m\cdot \ell},\qquad \EncEval(\mathrm{pp},d,\phi)\to \mathbf{w}\in Z_q^{m\cdot \ell}.$2 functions

$\HashEval(\mathrm{pp},E,\psi)\to \mathbf{v}\in Z_q^{m\cdot \ell},\qquad \EncEval(\mathrm{pp},d,\phi)\to \mathbf{w}\in Z_q^{m\cdot \ell}.$3

The proved communication bound is

$\HashEval(\mathrm{pp},E,\psi)\to \mathbf{v}\in Z_q^{m\cdot \ell},\qquad \EncEval(\mathrm{pp},d,\phi)\to \mathbf{w}\in Z_q^{m\cdot \ell}.$4

Here depth $\HashEval(\mathrm{pp},E,\psi)\to \mathbf{v}\in Z_q^{m\cdot \ell},\qquad \EncEval(\mathrm{pp},d,\phi)\to \mathbf{w}\in Z_q^{m\cdot \ell}.$5 is the multiplicative depth of the boolean or arithmetic circuit computing $\HashEval(\mathrm{pp},E,\psi)\to \mathbf{v}\in Z_q^{m\cdot \ell},\qquad \EncEval(\mathrm{pp},d,\phi)\to \mathbf{w}\in Z_q^{m\cdot \ell}.$6. The construction decomposes $\HashEval(\mathrm{pp},E,\psi)\to \mathbf{v}\in Z_q^{m\cdot \ell},\qquad \EncEval(\mathrm{pp},d,\phi)\to \mathbf{w}\in Z_q^{m\cdot \ell}.$7 into a sequence of lower-depth pieces and evaluates them iteratively; more precisely, the paper decomposes $\HashEval(\mathrm{pp},E,\psi)\to \mathbf{v}\in Z_q^{m\cdot \ell},\qquad \EncEval(\mathrm{pp},d,\phi)\to \mathbf{w}\in Z_q^{m\cdot \ell}.$8 into $\HashEval(\mathrm{pp},E,\psi)\to \mathbf{v}\in Z_q^{m\cdot \ell},\qquad \EncEval(\mathrm{pp},d,\phi)\to \mathbf{w}\in Z_q^{m\cdot \ell}.$9 stages of bounded depth $$\mathbf{v}+\mathbf{w}\approx \mathbf{x}\otimes \mathbf{y}.$$0, so each stage incurs only poly$$\mathbf{v}+\mathbf{w}\approx \mathbf{x}\otimes \mathbf{y}.$$1 overhead. The paper highlights three points: this is the first adaptively secure LFE from standard LWE, it is rate-1 in both input and output up to additive $$\mathbf{v}+\mathbf{w}\approx \mathbf{x}\otimes \mathbf{y}.$$2, and it improves upon previous work that relied on adaptive LWE or $$\mathbf{v}+\mathbf{w}\approx \mathbf{x}\otimes \mathbf{y}.$$3-succinct LWE (Abram et al., 13 Aug 2025).

The same OTE-based architecture yields several additional primitives. The paper introduces reverse trapdoor hashing (RTDH), where the hasher hashes the function $$\mathbf{v}+\mathbf{w}\approx \mathbf{x}\otimes \mathbf{y}.$$4 and the generator or encoder handles the input $$\mathbf{v}+\mathbf{w}\approx \mathbf{x}\otimes \mathbf{y}.$$5. It proves reverse TDH for all functions via the LFE-with-pre-encoding framework plus NI-MOLE. The resulting construction has constant-size hash and encoding key size essentially

$$\mathbf{v}+\mathbf{w}\approx \mathbf{x}\otimes \mathbf{y}.$$6

and by applying universal circuits, reverse TDH implies a standard TDH for all functions with the same encoding-key asymptotics and constant-size hash.

The paper then observes that reverse TDH immediately gives 2-party homomorphic secret sharing: Alice hashes the function $$\mathbf{v}+\mathbf{w}\approx \mathbf{x}\otimes \mathbf{y}.$$7, Bob encodes $$\mathbf{v}+\mathbf{w}\approx \mathbf{x}\otimes \mathbf{y}.$$8, and both obtain additive shares of the output. This yields succinct HSS with communication

$$\mathbf{v}+\mathbf{w}\approx \mathbf{x}\otimes \mathbf{y}.$$9

which is logarithmic in the long input. Finally, using reverse TDH for RAM programs, the paper obtains a batch laconic OT protocol with rate $\alpha$0, stated to be best possible. The communication rate is justified by the observation that each chosen bit can convey one of two messages.

5. Tensor-train sketching as a distinct succinct oblivious evaluation paradigm

A separate line of work uses the phrase in a tensor-algorithmic sense. The paper on Block Sparse Tensor Train (BSTT) sketching contributes to succinct oblivious tensor evaluation in the sense that it designs a structured random projection for TT-format tensors whose application can be done by recursive tensor contractions rather than by explicitly forming a huge dense sketch (Cazeaux et al., 11 Mar 2026). The BSTT sketch is defined as a stack of $\alpha$1 independent TT-style random projections, each of TT rank $\alpha$2: $\alpha$3 Its parameters have complementary roles: $\alpha$4 is the TT rank of each random block, while $\alpha$5 is the number of independent blocks stacked vertically. The family interpolates between two known sketches: $\alpha$6 gives the Khatri–Rao sketch, and $\alpha$7 gives the Gaussian TT sketch.

Theoretical guarantees are phrased as oblivious subspace embedding (OSE) and oblivious subspace injection (OSI) results. The BSTT sketch is an $\alpha$8-OSE provided

$\alpha$9

and it is a $\Pr\left[\|\mathbf{v}+\mathbf{w}-\mathbf{x}\otimes \mathbf{y}\|_\infty>\alpha\cdot \|\mathbf{x}\|_\infty\right]\le \negl(\lambda).$0-OSI provided

$\Pr\left[\|\mathbf{v}+\mathbf{w}-\mathbf{x}\otimes \mathbf{y}\|_\infty>\alpha\cdot \|\mathbf{x}\|_\infty\right]\le \negl(\lambda).$1

with $\Pr\left[\|\mathbf{v}+\mathbf{w}-\mathbf{x}\otimes \mathbf{y}\|_\infty>\alpha\cdot \|\mathbf{x}\|_\infty\right]\le \negl(\lambda).$2 for $\Pr\left[\|\mathbf{v}+\mathbf{w}-\mathbf{x}\otimes \mathbf{y}\|_\infty>\alpha\cdot \|\mathbf{x}\|_\infty\right]\le \negl(\lambda).$3 and $\Pr\left[\|\mathbf{v}+\mathbf{w}-\mathbf{x}\otimes \mathbf{y}\|_\infty>\alpha\cdot \|\mathbf{x}\|_\infty\right]\le \negl(\lambda).$4 for $\Pr\left[\|\mathbf{v}+\mathbf{w}-\mathbf{x}\otimes \mathbf{y}\|_\infty>\alpha\cdot \|\mathbf{x}\|_\infty\right]\le \negl(\lambda).$5. The stated significance is that both guarantees depend only linearly on the tensor order $\Pr\left[\|\mathbf{v}+\mathbf{w}-\mathbf{x}\otimes \mathbf{y}\|_\infty>\alpha\cdot \|\mathbf{x}\|_\infty\right]\le \negl(\lambda).$6 and on the subspace dimension $\Pr\left[\|\mathbf{v}+\mathbf{w}-\mathbf{x}\otimes \mathbf{y}\|_\infty>\alpha\cdot \|\mathbf{x}\|_\infty\right]\le \negl(\lambda).$7, in contrast to prior constructions whose provable sample complexity grows exponentially in $\Pr\left[\|\mathbf{v}+\mathbf{w}-\mathbf{x}\otimes \mathbf{y}\|_\infty>\alpha\cdot \|\mathbf{x}\|_\infty\right]\le \negl(\lambda).$8.

For TT tensors, the sketch is applied efficiently through recursive contraction from the last core to the first: $\Pr\left[\|\mathbf{v}+\mathbf{w}-\mathbf{x}\otimes \mathbf{y}\|_\infty>\alpha\cdot \|\mathbf{x}\|_\infty\right]\le \negl(\lambda).$9 with $Z_q^m \otimes Z_q^\ell$00 computed backwards for $Z_q^m \otimes Z_q^\ell$01, and then the final sketched vector obtained from the first core. The sketch is never formed as a dense $Z_q^m \otimes Z_q^\ell$02 matrix. The paper states that this permits sketching linear combinations of TT tensors, Hadamard products of TT tensors, and TT matrix-vector products without explicitly assembling the full intermediate tensor. Its core application cost on a TT tensor of maximum TT-rank $Z_q^m \otimes Z_q^\ell$03 and mode size $Z_q^m \otimes Z_q^\ell$04 is

$Z_q^m \otimes Z_q^\ell$05

In this literature, succinctness therefore refers to low-rank tensor-network evaluation rather than dimension-independent communication.

6. Conceptual scope, distinctions, and common misunderstandings

The cryptographic OTE notion is narrowly specified. It is not a generic protocol for arbitrary multilinear tensor operations, but a functionality for additive secret sharing of $Z_q^m \otimes Z_q^\ell$06 with one round of simultaneous messages and encoder privacy. The importance of the primitive comes from what the paper repeatedly exploits: a noisy linear share of a tensor product can be transformed by local linear algebra into a share of a more complex object. This is why the architectural summary takes the form

$Z_q^m \otimes Z_q^\ell$07

rather than treating OTE as an endpoint (Abram et al., 13 Aug 2025).

A second common misunderstanding concerns the meaning of “fully succinct.” In the cryptographic construction, fully succinct means that both the hash and the encoding are sublinear in the hasher’s input, with the final scheme achieving CRS and digest size independent of the large input size and encoding size polylogarithmic in the large dimension. It does not mean that the tensor-product output itself becomes sublinear. The paper’s own optimality discussion is framed against the unavoidable $Z_q^m \otimes Z_q^\ell$08 output size and the impossibility of improving the linear dependence on $Z_q^m \otimes Z_q^\ell$09.

A third point is that the tensor-train sketching work uses closely related language but addresses a different problem class. There, “succinct oblivious evaluation” is supported by structured random projections whose rows are TT contractions and whose application proceeds through recursive partial contractions rather than dense multiplication (Cazeaux et al., 11 Mar 2026). This suggests a family resemblance between the two usages—both exploit hidden tensor structure to avoid explicit materialization of a large object—but the underlying objectives differ: communication succinctness and adaptive security in the LWE setting on one side, and structured low-rank sketching with linear scaling in tensor order on the other.