ptAdd, ptSub

[carlostriste]

Thanks! I can now confirm that this problem is solved.

Among the stuff I did with Claude, there are:

1. a possible but in ptAdd/ptSub;
2. iterative bootstrapping;
3. ciphertexts offloading (i.e., "unload" a ciphertext from GPU VRAM but keep it in RAM, useful when you want to cache some result but the space on the VRAM is limited)

If this can interest you I can draft issues with this stuff.

Originally posted by @AlexMV12 in #27

Would you care to ellaborate on point 1?

[AlexMV12]

Sure! I meant "bug" obviously:

EvalAdd / EvalSub with a plaintext give wrong results under FLEXIBLEAUTO when the ciphertext carries deferred (level-2) noise

Summary

Two correctness bugs in Ciphertext::addPt / Ciphertext::subPt (src/CKKS/Ciphertext.cpp) on the FLEXIBLE* / FIXEDAUTO rescale techniques:

1. Noise-degree mismatch is not adjusted. The scaling-factor adjustment only fired when ciphertext and plaintext sat at different levels (b.c0.getLevel() != this->getLevel()). Under FLEXIBLEAUTO lazy rescaling, a ciphertext can sit at NoiseLevel 2 on the same level as a fresh plaintext at NoiseLevel 1 (e.g. right after an EvalMult, before the deferred rescale). The old gate misses this and falls through to a raw add/sub of operands with mismatched scaling factors, corrupting the result.
2. subPt silently becomes addPt. When the adjust branch was taken, subPt recursed into addPt(b_) instead of subPt(b_) — a sign flip turning subtraction into addition.

Affected: FLEXIBLEAUTO, FLEXIBLEAUTOEXT, FIXEDAUTO (not FIXEDMANUAL).

Root cause

if (b.c0.getLevel() != this->getLevel()) {   // too narrow
    ...
    addPt(b_);                                // subPt wrongly called addPt here
    return;
}

Fix

if (b.c0.getLevel() != this->getLevel() || b.NoiseLevel != NoiseLevel) {
    ...
    addPt(b_);   // subPt: call subPt(b_)
    return;
}

Reproducer

Test code:

#include <gtest/gtest.h>
#include <fideslib.hpp>
#include <cmath>
using namespace fideslib;

TEST(Bug, AddSubPtNoiseDegreeMismatch) {
    const uint32_t batchSize = 8;

    CCParams<CryptoContextCKKSRNS> parameters;
    parameters.SetMultiplicativeDepth(4);
    parameters.SetFirstModSize(60);
    parameters.SetScalingModSize(59);
    parameters.SetBatchSize(batchSize);
    parameters.SetScalingTechnique(FLEXIBLEAUTO);   // triggers lazy rescale
    parameters.SetDevices({ 0 });

    CryptoContext<DCRTPoly> cc = GenCryptoContext(parameters);
    cc->Enable(PKE);
    cc->Enable(KEYSWITCH);
    cc->Enable(LEVELEDSHE);

    auto keys = cc->KeyGen();
    cc->EvalMultKeyGen(keys.secretKey);
    cc->LoadContext(keys.publicKey);

    std::vector<double> x = { 0.25, 0.5, 0.75, 1.0, 1.5, 2.0, 2.5, 3.0 };
    std::vector<double> y = { 1.0, 2.0, 3.0, 4.0, 5.0, 6.0, 7.0, 8.0 };

    Plaintext x_pt = cc->MakeCKKSPackedPlaintext(x);
    Plaintext y_pt = cc->MakeCKKSPackedPlaintext(y);
    auto ct        = cc->Encrypt(keys.publicKey, x_pt);

    // ct*ct leaves the product at NoiseLevel 2 (deferred rescale), same level
    // as the fresh plaintext y_pt at NoiseLevel 1 -> the buggy code path.
    auto prod = cc->EvalMult(ct, ct);          // x^2

    auto addRes = cc->EvalAdd(prod, y_pt);     // expect x^2 + y
    auto subRes = cc->EvalSub(prod, y_pt);     // expect x^2 - y

    Plaintext addOut, subOut;
    cc->Decrypt(keys.secretKey, addRes, &addOut);
    cc->Decrypt(keys.secretKey, subRes, &subOut);
    addOut->SetLength(batchSize);
    subOut->SetLength(batchSize);

    const double tol = 1e-2;
    for (uint32_t i = 0; i < batchSize; ++i) {
        double expAdd = x[i] * x[i] + y[i];
        double expSub = x[i] * x[i] - y[i];
        EXPECT_NEAR(addOut->GetRealPackedValue().at(i), expAdd, tol) << "addPt slot " << i;
        EXPECT_NEAR(subOut->GetRealPackedValue().at(i), expSub, tol) << "subPt slot " << i;
    }
}

Run: ./build/ --gtest_filter='Bug.AddSubPtNoiseDegreeMismatch'