 안녕하세요. 제 이름은 준우 리입니다. 이 비디오의 소식은 RMS-CKK의 호모오피 그립션의 하이프리스전 프로트 스트레칭입니다. 옵티머 미니맥스 폴리넘멸 아플럭시메이션과 인벌사인 функ션을 사용합니다. 그리고 이건 윤상리, 용울리, 용식힘, 종선호와 함께 작업합니다. 여기가 저희의 소식입니다. 시작합니다. RMS-CKK의 호모오피 그립션의 하이프리스전 프로트 스트레칭입니다. 이 프로트 스트레칭은 우리의 작업에 대략 흔들리지 않습니다. 그럼 RMS-CKK의 호모오피 그립션의 하이프리스전 프로트 스트레칭을 다음 섹션에 추천합니다. 다음 두 섹션은 두 새로운 기능을 설명할 수 있습니다. 제작한 영어 공개, 동일한 창조의 파악기, 호당을 제작한 방식은 임 بال사인의 형태의 방식을 설명할 수 있습니다. 그럼 저희는 이번 슬라이드에 우리의 작업을 설명할 수 있습니다. 중요한 질문은 RMS-CKK의 호모오피 스트레칭을 해서 하이프리스전 프로트 스트레칭을 더욱 긴 수 있을까요? RMS-CKK의 호모오피 스트레칭을 더욱 긴 수 있는 옵티머 미니맥스 폴리넘멸 아플럭시�에 세 번의 피스와 전통 럭시시의 로봇, 에피션트, high precision variant of multi-interval rematch algorithm can be used practically. To increase the capacity of the NSKK's bootstrapping precision, we propose the composite function approximation by inverse function. While previous techniques can reach 10.7.2 to 30.3 bit precision of the bootstrapping, new techniques can reach 32.6 to 45.5 bit precision of the bootstrapping, which is 5.4 to 10.2 bit precision improvement. So let me introduce the NSKK's FH scheme. Fully homomorphic encryption scheme is an encryption scheme supporting arbitrary circuits or arbitrary arithmetic circuits on encrypted data. With the FH scheme, users having public keys can perform any operations on encrypted data, but they cannot access any information about the data. So FH scheme enables the clients to securely outsource the arbitrary computation about their private data. So among the FH schemes, the NSKK's homomorphic encryption scheme is one of the most useful FH schemes now. Unlike other FH schemes for Boolean or integer data, the NSKK's is optimized to deal with the real number data. The NSKK's scheme supports various arithmetic operations on encrypted data, such as addition, multiplication, rotation, and complex conjugation. Since many practical systems use real numbers to represent data instead of integers or booleans, including machine learning systems, the NSKK's FH scheme is an appropriate choice for this case. There is an essential homomorphic operation called bootstrapping. In the process of homomorphic multiplication, the number of modally related side-protects is reduced by 1. In other words, each homomorphic multiplication consumes one RNS modulus. If we keep performing homomorphic multiplication, there is a moment when the ciphertext modulus is only one RNS modulus, where we cannot perform further homomorphic multiplication. In this situation, the bootstrapping is the solution. The bootstrapping operation refreshes this level zero side-protect by raising modulus without changing messages. Since the modulus is raised, the further homomorphic multiplication can be performed. Especially for the advanced circuits having large multiplicative tests, the bootstrapping is even helpful. Now in this section, we suggest the main research problem of the conventional RNS-CKS homo-bootstrapping. Our main focus is the bootstrapping precision. Previous works regarding the RNS-CKS bootstrapping only report 15 to 20-bit precision of the bootstrapping. This precision is not sufficiently high in many practical situations. For example, Chonera showed that when they used 16-bit fixed point precision system in training machine learning model for MNIST dataset, the model failed to converge. Although there have been many techniques to use low precision fixed point system in machine learning now, it is pretty difficult to apply the techniques on homomorphically encrypted data. Further, only the fixed point system is supported by the RNS-CKS scheme rather than the floating point system that is generally used in many applications. And the fixed point system is generally less precise than the floating point system. So more precise RNS-CKS bootstrapping is needed in various applications. But previous works did not focus on the capacity of the bootstrapping precision. Thus, our key question is how high precision can be supported by RNS-CKS scheme and are there any further techniques to improve the bootstrapping precision? There are four main thought processes in the RNS-CKS bootstrapping. Modulase and subsam, coiff to slot, homomorphic modular reduction and slot to coiff. Since the main obstacle for the bootstrapping precision is the homomorphic modular reduction, we focus on the homomorphic modular reduction in this paper. Before going to the next slide, note that by modulase and subsam procedure, the plain text in the ciphertext is changed from delta-zero m to delta-zero m plus q-zero i, where delta-zero m is far less than q-zero. The homomorphic modular reduction plays a role of removing q-zero i part. The function to be evaluated in homomorphic modular reduction process can be represented like the blue graph. Since the messages are far less than q-zero, the domain of the target function is the neighborhood of multiples of q-zero. Previous works regard the target function as a part of a sine function and evaluate the approximate polynomial for sine function. We should note that regarding the target function as a sine function is also an approximation step. So there are two approximation steps in the homomorphic modular reduction process. In this work, we propose two new techniques to improve each approximation step. polynomial approximation step is improved by improved multi-interval Ramez algorithm, and sine approximation step is improved by composite function approximation by inverse sine function. Now we will explain them in the next two sections. The first solution is the improved multi-interval Ramez algorithm, which is now described in this section. To approximate the piecewise modular reduction function, there has been several approximation techniques in previous works. Choneda used the Taylor approximation with double-angle formulas, and Choneda used the Chebyshev interpolation method, and Haneda proposed a new Chebyshev interpolation method for the piecewise function. Although they all aimed at respect approximation in minimax aspect, which minimizes the maximum error, there are actually not the optimal solutions. So we raise a question. Is there any optimal solution? It is desirable to efficiently find the theoretically optimal minimax approximate polynomial for piecewise continuous function. So we found that there is a multi-interval Ramez algorithm for optimal minimax approximate polynomial of piecewise function. In the multi-interval Ramez algorithm, we obtained the polynomial alternating at the sum d plus 2 reference points from a system of linear equations. After all local extreme points for error function are searched, we choose new d plus 2 reference points among these points, satisfying local extreme value condition, alternating condition, and global extreme inclusion condition. Then these processes are repeated until we find the optimal polynomial. Then is it finished if we just applied the Ramez algorithm? Practically not yet. Unlike the ordinary cases, our target function is rather extreme case. The length of the interval is very tiny, there are tens or even hundreds of approximation intervals. And the polynomial degree is somewhat high, and we need very high precision approximation. So we actually need a robust, efficient and high precision variant of Ramez algorithm from the well even for this extreme case. And this is a non-trivial problem. So the first point to be considered is when all local extreme points are found. The problem is that local extreme points are very dense, pretty dense, because of tiny intervals and high degree, and should be found with high precision for convergence of the Ramez algorithm. Even one extreme point should not be missed, so not only is efficiency considered, but robustness for finding all local extreme points is also heavily considered. We propose efficient and robust two-mode search method for finding extreme points, which is a combination of scanning and binary search. So there are simple brute force scanning method is highly robust method, but it is extremely inefficient for high precision output. On the other hand, there is a kind of binary search method where each iteration choose the maximum point among three points and the step size is halved for the next iteration. This algorithm is linear algorithm with the required precision, but it is robust only when the initial point is sufficiently close. Thus, we combine two methods. At first, we scan with a big step for rough local extreme point, and then we perform the binary search algorithm with high precision. We verify its robustness and efficiency even for high precision output. The second point to be considered is the global extremum inclusion condition for selection of the new reference point for next iteration. Global extremum inclusion condition means that a global extremum point should be included in the new reference point for each iteration. But the global extremum inclusion condition cannot effectively filter a good candidate of new reference points. So there are yet pretty many subsets of D plus 2 reference points satisfying these three conditions. For the best choice of new reference points for each iteration, we modify this condition to selecting D plus 2 reference points maximizing the absolute sum errors called the maximum absolute sum condition. This table is the number of iterations when approximating the modular reduction function with uniformly detached initial reference points. As the table shows, it is numerically confirmed that the number of iterations is reduced when the maximum absolute sum condition is used. In the practical use, we use the initialization method similar to Harnet-Arles method, and this leads to only 4 to 10 iterations. And we also propose a quasi-linear systematic elimination algorithm for robustly finding the new reference points satisfying the maximum absolute sum condition. So this graph shows the simulation results comparing Harnet-Arles method and improved multi-interval remesh algorithm. Note that the red graph is not only the result of our work but also the theoretical bound for the approximation. We also showed that Harnet-Arles approximation method is practically useful in that their results are rather close to the bound. But there are yet 2 to 5 bits of precision gap. And the improved multi-interval remesh algorithm takes only less than 10 seconds. So it is more desirable to use the optimal minimax approximate polynomial when the improved multi-interval remesh algorithm is implemented. The second solution is the composite function approximation if inverse sign function is now described in this section. So let's look at the Harnet-Arles approximation method. The modular reduction function is regarded as a part of a sine function. To use the sub-double angle formula of cosine function, they regard the sine function as a shifted cosine function. And H1 is the scaled cosine function and H2 is the double angle formula of cosine function. The composition of H1 and L times double angle formula consists of the target sine function. The scaled cosine function is approximated by the polynomial. So we wanted to know the maximum precision supported by this method. So we tried to maximize the put-to-strapping precision by adjusting parameters. So there are 3 parameters that affect the put-to-strapping precision. Degree of approximate polynomial and ratio between the scaling factor and the LVL0 modulus and put-to-strapping scaling factor. We said that this degree of approximate polynomial is as high as possible and the put-to-strapping scale factor is 60, which is the maximum bit length of the RNS modulus in 64 bit computing system. And let's look at the second parameter in the next slide. So B is the ratio between scaling factor and LVL0 modulus and delta D is the log of B. We analyzed the effect of B to the put-to-strapping precision. The error E is the approximation error generated in homomorphic model reduction. And this error is amplified with B when the scaling factor is reverted from Q0 to original scaling factor. So we can regard B times E as the resultant precision error of the put-to-strapping. Since we set the degree of polynomial as high as possible, the error E is generated in the sign approximation for the model reduction. So let's look at the tendency of the precision error when we change the value of log B, that is the delta D. If delta D is small enough, the error E is determined by the difference between the sign function and the model reduction function. Since the sign X and minus X is proportional to X cubic for small X, E is proportional to 1 over B cubic and B times E is proportional to 1 over B squared. If delta D is large enough, the error is determined by the approximation error from the homomorphic operations, which is somewhat constant. Thus B times E is proportional to B. The graph between B precision and log B can be represented as the figure. Thus we have to set the delta D as the threshold delta T to maximize put-to-strapping precision. So reflecting these analysis, we measure the maximum put-to-strapping precision by adjusting the parameters. Since the number of slots also affect the put-to-strapping precision, we measure the precision for various number of slots. Then we found that 27.2 to 30.3B precision can be reached when Haneda's approximation is used. Then the natural question is is there any further technique to increase the maximum precision? In other words, the capacity of the put-to-strapping precision. Our answer to the question is use inverse sine function. So this shows the sine function approximating the modular reduction function, which cannot exactly evaluate the modular reduction function. We propose to compose this sine function with the inverse sine function. If we compose the inverse sine function, the composite function is like this graph. This composite function exactly evaluates the modular reduction function in the approximate domain, approximation domain. And thus the approximation error between the modular reduction function and the sine function is completely removed even when the approximation region is rather large. Further, note that the domain of the inverse sine function to be composed is only one interval. The required degree is rather small. So we formally show the composite function approximation by inverse sine function in this slide. So we additionally approximate the inverse sine function in one interval. So we add the parameter of the degree of the approximate polynomial of the inverse sine function. So let's analyze the effect of the ratio between scaling vector and level 0 modulus in the new situation. Unlike the previous case the error E is always determined by the approximation error from the homo-hopping operations E0, even with the small delta dip. So B times E is always proportional to B. The graph is changed to the right diagram. Since the smallest delta dip is 3 because of the shape of the inverse sine function the maximum precision is reached when delta dip is 3 which is higher than previous maximum precision without inverse sine. The table show the comparison between the maximum precision without inverse sine and the maximum precision with inverse sine. The maximum precision of the bootstrapping is 32.6 to 40.5 which is improved by 5.4 to 10.2 bits compared to the previous bootstrapping. In other words, the precision error of the bootstrapping is reduced by 1 over 42 to 1 over 1176 times. So we could significantly enlarge the capacity of the bootstrapping precision of the RMSHKK scheme which makes the RMSHKK scheme more appropriate to various situations requiring high precision. We conclude this talk in this slide. For our quick question of how to reach high precision for the RMSHKK bootstrapping we answer to the question by proposing the improved multi-interval image algorithm and the composite function approximation by inverse sine function and thereby the new techniques significantly improve the precision of the bootstrapping. Thanks for listening to our talk.