Rotation-Optimal Noncommutative Prefix Scans in Bit-Reversed Homomorphic Layouts

2026-07-03

AI Summary

This work addresses the inefficiency of frequent cyclic rotations required by non-commutative prefix scans within slot-wise bit-reversed permutations in homomorphic encryption. The authors propose a replication-aggregation invariant mechanism that, under a bit-reversed data layout, completes a depth-$m$ prefix scan using only $m$ global rotations—achieving a tight lower bound matching rotation count to computational depth. By integrating the CKKS scheme, bit-reversed layout, and modulus chain management, this approach provides the first rigorous characterization of the 2-adic valuation structure underlying rotation offsets. Experimental results demonstrate that for $m=7$, the number of rotations drops from 28 to 7, key storage decreases by 70.0%, peak memory usage is reduced by 63.9%, standalone scan latency improves by 19.9%, and downstream pipeline throughput achieves an average speedup of 4.31$\times$.

Abstract

Packed homomorphic encryption evaluates slotwise operations in parallel, but nonlocal communication is realized by cyclic rotations whose cost depends on the physical slot layout. We study ordered prefix computation on $n=2^m$ elements of an associative, possibly noncommutative monoid stored in bit-reversed order. A direct transported-predecessor scan uses $m\cdot(m+1)/2$ rotations because one logical shift decomposes into several cyclic displacement classes. We introduce a replicated-aggregate invariant: every slot of an aligned logical block stores the same complete block aggregate. Since these copies are semantically interchangeable, one global rotation per level supplies each slot with a valid sibling aggregate, without reaching the exact logical partner. The resulting inclusive or exclusive scan uses $m$ rotations, depth $m$, two live state vectors, and at most $2\cdot m-1$ packed monoid compositions. In a model where all non-routing operations are slotwise and every cyclic rotation invocation is counted, these bounds are exact: $D^\star(m)=R^\star(m)=m$. Equality is rigid: the $m$ offsets contain exactly one representative of each $2$-adic valuation. With at most $K$ directly keyed offsets, we prove a product lower bound and an exact frontier $K\cdot(2^{m/K}-1)$ whenever $K$ divides $m$. We instantiate the exclusive scan for radix carry and borrow in bit-reversed \CKKS slots, avoiding layout restoration and the final logical-predecessor shift. In our implementation at $m=7$, the replicated scan reduces the direct bit-reversed baseline from $28$ to $7$ rotations, lowers evaluation-key storage by $70.0\%$, lowers peak heap usage by $63.9\%$, and improves isolated scan latency by $19.9\%$. In a depth-$5$ downstream pipeline, retaining six additional modulus levels avoids one bootstrap and gives a mean paired speedup of $4.31\times$ with $95\%$ confidence interval $[3.69,4.92]$.

Problem

• homomorphic encryption
• prefix scan
• noncommutative monoid
• bit-reversed layout
• cyclic rotations

Innovation

• homomorphic encryption
• prefix scan
• bit-reversed layout
• replicated-aggregate invariant
• noncommutative monoid