fhelium.ir.dialects.ckks

Cheon-Kim-Kim-Song (CKKS) evaluator operations and value state.

A two-component ciphertext (CT2) has phase $c_0+c_{1}s$; a three-component ciphertext (CT3) has phase $c_0+c_{1}s+c_2{s}^2$ for secret polynomial $s$. The residue number system (RNS) stores each polynomial modulo active ciphertext primes Q; QP appends special P primes used during key switching. The number-theoretic transform (NTT) changes negacyclic polynomial multiplication into pointwise multiplication. Every plaintext and ciphertext may carry its own actual scale $\mathrm{\Delta }$.

AddOp

class View source

AddOp()

Bases: _BinaryCiphertextOp

Add two state-compatible ciphertexts component by component.

For each component $j$, active prime $q_i$, and coefficient, the operation computes $c_j^{\prime }=c_j^{(a)}+c_j^{(b)}(\mathrm{mod}{q}_i)$. Inputs have the same component count, depth, prime rows, polynomial domain, residue representation, and actual scale. The result retains that state and represents the sum of the decoded slot values.

Attributes

Name	Type	Default/value
name		'fhelium_ckks.add'

dependencies

method

def dependencies() -> OperationDependencies: ...

Describe result reads in this operation's value coordinates.

SumBatchOp

class View source

SumBatchOp(value: SSAValue | Operation, result_type: Attribute, *, axis: int | IntegerAttr, parameters: Sequence[SSAValue | Operation]=())

Bases: IRDLOperation

Reduce one ciphertext batch axis by modular addition.

For components $c_j^{(k)}$ over the selected axis of length $n$, the result is $c_j^{\prime }=\sum _{k<n}{c}_j^{(k)}modQ$ with every partial sum evaluated modulo the active primes. The operation removes the selected logical batch axis from the value shape; depth, actual scale, prime rows, component count, polynomial domain, and residue representation are unchanged.

Attributes

Name	Type	Default/value
name		'fhelium_ckks.sum_batch'
value		operand_def(CiphertextType)
parameters		var_operand_def()
result		result_def(CiphertextType)
axis		attr_def(IntegerAttr)
traits		traits_def(Pure())

dependencies

method

def dependencies() -> OperationDependencies: ...

Describe result reads in this operation's value coordinates.

AddScalarOp

class View source

AddScalarOp()

Bases: _RealScalarCiphertextOp

Add a stochastically quantized real constant to component zero.

The input uses coefficient-domain standard residues. For scalar $u$ and scalar_scale $\delta$, the implementation samples $k=\mathrm{RandRound}(u\delta )$, reduces $k$ into each active prime, and adds it to the constant coefficient of $c_0$. Other coefficients and components do not change. The ciphertext actual scale $\mathrm{\Delta }$ is retained, so the decoded increment is approximately $k/\mathrm{\Delta }$; choosing $\delta =\mathrm{\Delta }$ represents addition by $u$.

Attributes

Name	Type	Default/value
name		'fhelium_ckks.add_scalar'

dependencies

method

def dependencies() -> OperationDependencies: ...

Describe result reads in this operation's value coordinates.

AddPlaintextOp

class View source

AddPlaintextOp()

Bases: _CiphertextPlaintextOp

Add a prepared plaintext polynomial to ciphertext component zero.

For ciphertext $(c_0,\dots ,c_{k-1})$ and plaintext $p$, the result is $(c_0+p,c_1,\dots ,c_{k-1})$ modulo each active prime. Matching depth, prime rows, and actual scale make this a slotwise message addition. Component count and ciphertext representation remain unchanged.

Attributes

Name	Type	Default/value
name		'fhelium_ckks.add_plaintext'

dependencies

method

def dependencies() -> OperationDependencies: ...

Describe result reads in this operation's value coordinates.

AddCompressedPlaintextOp

class View source

AddCompressedPlaintextOp()

Bases: _CiphertextCompressedPlaintextOp

Add a compact plaintext to component zero without expanding its rows.

Coefficient/standard ciphertext and coefficient/Montgomery plaintext give c'_0=c_0+REDC(pR). NTT/Montgomery operands give c'_0=c_0+pR. Other components, depth, scale, prime rows and representation are preserved. Sparse layouts supply a separate [*batch, limb, 1] implicit-value Tensor.

Attributes

Name	Type	Default/value
name		'fhelium_ckks.add_compressed_plaintext'

dependencies

method

def dependencies() -> OperationDependencies: ...

Describe direct ciphertext reads and compact plaintext expansion.

CiphertextType

class View source

CiphertextType()

Bases: OpenStateType

CKKS ciphertext with partial depth, scale, basis, and domain state.

Attributes

Name	Type	Default/value
name		'fhelium_ckks.ciphertext'
ROLE	ClassVar[ValueRole]	'encrypted'

CompressedPlaintextType

class View source

CompressedPlaintextType()

Bases: OpenStateType

Represent operation-ready compressed RNS plaintext storage.

Attributes

Name	Type	Default/value
name		'fhelium_ckks.compressed_plaintext'
ROLE	ClassVar[ValueRole]	'plaintext'

ConjugateOp

class View source

ConjugateOp()

Bases: _OutputDomainCiphertextOp

Apply complex conjugation to every encoded CKKS slot.

The input is a coefficient-domain standard-Q CT2 ciphertext. The ring automorphism ${\sigma }_{2N-1}:X\mapsto X^{-1}$ maps the CKKS embedding to slotwise complex conjugation. It also changes the secret relation to ${\sigma }_{2N-1}(s)$, so a conjugation key switches the result back to $s$. output_domain selects coefficient/standard or NTT/Montgomery output. CT2 shape, depth, actual scale, and active Q rows are preserved.

Attributes

Name	Type	Default/value
name		'fhelium_ckks.conjugate'

dependencies

method

def dependencies() -> OperationDependencies: ...

Describe result reads in this operation's value coordinates.

DecodeOp

class View source

DecodeOp()

Bases: IRDLOperation

Decode a scaled coefficient polynomial into ordered CKKS slots.

For coefficient data $a$ with actual scale $\mathrm{\Delta }$, the operation returns $m^{\prime }=\sigma (a/\mathrm{\Delta })$, truncated to the configured slot count and ordered by the configured Galois generator. is_real selects the real part after the complex embedding. The input may be freshly encoded integers or bounded approximate coefficients reconstructed by decryption.

Attributes

Name	Type	Default/value
name		'fhelium_ckks.decode'
plaintext		operand_def(PlaintextType)
parameters		var_operand_def()
result		result_def(MessageType)
is_real		attr_def(IntegerAttr)
traits		traits_def(Pure())

dependencies

method

def dependencies() -> OperationDependencies: ...

Describe result reads in this operation's value coordinates.

DecryptOp

class View source

DecryptOp()

Bases: IRDLOperation

Evaluate a ciphertext phase and reconstruct coefficient data.

For CT2 $(c_0,c_1)$, the phase is $c_0+c_{1}s$; for CT3 it is $c_0+c_{1}s+c_2{s}^2$, computed modulo each active prime. The registered decryption implementation converts products to coefficient-domain standard RNS, then reconstructs the centered integer class from all active Q rows. The result is an approximate coefficient plaintext at the ciphertext's depth and actual scale. input_domain records whether the ciphertext payload arrives in coefficient/standard or NTT/Montgomery form, and the second operand supplies the secret-key Tensor.

Attributes

Name	Type	Default/value
name		'fhelium_ckks.decrypt'
ciphertext		operand_def(CiphertextType)
key		operand_def()
parameters		var_operand_def()
result		result_def(PlaintextType)
input_domain		attr_def(StringAttr)
traits		traits_def(Pure())

dependencies

method

def dependencies() -> OperationDependencies: ...

Describe result reads in this operation's value coordinates.

PrepareCompressedPlaintextOp

class View source

PrepareCompressedPlaintextOp()

Bases: IRDLOperation

Prepare compressed NTT rows from a periodic slot message.

For U=2r (at least four for generator 3), R=N/U and a period-r message, the encoded polynomial has the form p(X)=a(X^R). The operation performs the U-point inverse embedding, stochastic rounding at the corresponding full-ring random-stream positions, RNS reduction and a U-point NTT with roots psi_N^R for NTT output. Coefficient output omits the transform and returns strided-sparse compact data plus zero implicit rows; NTT output uses contiguous repetition. Both use Montgomery residues and preserve the supplied depth, prime rows and actual scale.

Attributes

Name	Type	Default/value
name		'fhelium_ckks.prepare_compressed_plaintext'
message		operand_def(MessageType)
parameters		var_operand_def()
results_		var_result_def()
traits		traits_def()

dependencies

method

def dependencies() -> OperationDependencies: ...

Describe result reads in this operation's value coordinates.

EncodeOp

class View source

EncodeOp()

Bases: IRDLOperation

Encode ordered complex slots as a scaled integer polynomial.

For ring $R=\mathbb{Z}[X]/(X^N+1)$, let $\sigma$ be the configured CKKS embedding in the configured generator's slot order. Given slots $m$ and actual scale $\mathrm{\Delta }$, the operation returns $a=\mathrm{RandRound}(\mathrm{\Delta }{\sigma }^{-1}(m))\in R$. depth records the later modulus-chain placement but does not reduce the integer coefficients. The registered native-ckks-encode implementation performs the embedding and stochastic rounding.

Attributes

Name	Type	Default/value
name		'fhelium_ckks.encode'
message		operand_def(MessageType)
parameters		var_operand_def()
result		result_def(PlaintextType)
depth		attr_def(IntegerAttr)
scale		attr_def(FloatAttr)

dependencies

method

def dependencies() -> OperationDependencies: ...

Describe result reads in this operation's value coordinates.

EncryptOp

class View source

EncryptOp()

Bases: IRDLOperation

Encrypt an integer plaintext polynomial as a CT2 ciphertext.

Let the public key be $(k_0,k_1)$, satisfying $k_0+k_{1}s\approx 0$, let $v$ be a sampled binary polynomial, and let $e_0,e_1$ be sampled error polynomials. For plaintext $a$, the result is $c_0=k_{0}v+a+e_0$ and $c_1=k_{1}v+e_1$ modulo every active prime. The output has two components and keeps the plaintext depth and actual scale. output_domain selects coefficient/standard or NTT/Montgomery Q or QP residues. The second operand supplies the public-key Tensor.

Attributes

Name	Type	Default/value
name		'fhelium_ckks.encrypt'
plaintext		operand_def(PlaintextType)
key		operand_def()
parameters		var_operand_def()
result		result_def(CiphertextType)
output_domain		attr_def(StringAttr, default_value=StringAttr('coefficient'))

dependencies

method

def dependencies() -> OperationDependencies: ...

Describe plaintext addition and multiplication by the public key.

EvaluationKeyType

class View source

EvaluationKeyType()

Bases: OpenStateType

Evaluation-key Tensor with partial digit, row, and polynomial state.

Attributes

Name	Type	Default/value
name		'fhelium_ckks.evaluation_key'

FHEliumCkks

data View source

FHEliumCkks = Dialect('fhelium_ckks', [PrepareCompressedPlaintextOp, EncodeOp, DecodeOp, IntegerCoefficientsToRnsOp, EncryptOp, DecryptOp, NegateOp, RotateOp, RotateManyOp, GroupedRotationWeightedSumOp, ToNttOp, FromNttOp, ToMontgomeryResiduesOp, ToStandardResiduesOp, AddOp, SumBatchOp, SubtractOp, MultiplyOp, AddScalarOp, MultiplyScalarOp, MultiplyIntegerScalarOp, AddPlaintextOp, MultiplyPlaintextOp, AddCompressedPlaintextOp, MultiplyCompressedPlaintextOp, RelinearizeOp, SwitchKeyOp, ConjugateOp, RescaleOp, ModSwitchOp, ReinterpretScaleOp, PrepareAddMessageOp, PrepareAddPlaintextOp, PrepareAddStaticOp, PrepareMultiplyMessageOp, PrepareMultiplyPlaintextOp, PrepareMultiplyStaticOp], [CiphertextType, PlaintextType, CompressedPlaintextType, EvaluationKeyType])

FromNttOp

class View source

FromNttOp()

Bases: _RepresentationOp

Transform CKKS NTT/Montgomery polynomials to coefficient form.

An inverse negacyclic transform is applied independently to every component and prime row. Ciphertexts end in standard residues; plaintext lowering may retain Montgomery residues. The represented ring element, component count, prime rows, depth, basis, and actual scale are unchanged.

Attributes

Name	Type	Default/value
name		'fhelium_ckks.from_ntt'

dependencies

method

def dependencies() -> OperationDependencies: ...

Describe result reads in this operation's value coordinates.

GroupedRotationWeightedSumOp

class View source

GroupedRotationWeightedSumOp(value: SSAValue | Operation, keys: tuple[SSAValue | Operation, ...], plaintexts: tuple[SSAValue | Operation, ...], result_type: CiphertextType, *, baby_steps: tuple[int, ...], group_count: int, parameters: Sequence[SSAValue | Operation]=())

Bases: IRDLOperation

Apply plaintext rows to one caller-supplied direct rotation group.

For baby steps $b_t$, ciphertext $c$, and a group-major matrix of prepared plaintexts $p_{g,t}$, the result batch is

$$y_g=\sum _{t=0}^{T-1}{p}_{g,t}{\mathrm{Rot}}_{b_t}(c).$$

baby_steps lists $T$ distinct steps including at most one zero. Each nonzero step has one matching key operand; zero denotes the unrotated ciphertext. group_count and term_count describe the plaintext matrix. Every rotation completes its own hybrid ModDown before plaintext multiplication, preserving ordinary key-switch rounding. The output adds the group as the first batch axis and is NTT/Montgomery Q at the input depth with scale ${\mathrm{\Delta }}_c{\mathrm{\Delta }}_p$.

Attributes

Name	Type	Default/value
name		'fhelium_ckks.grouped_rotation_weighted_sum'
value		operand_def(CiphertextType)
keys		var_operand_def(EvaluationKeyType)
plaintexts		var_operand_def(PlaintextType)
parameters		var_operand_def()
result		result_def(CiphertextType)
baby_steps		attr_def(ArrayAttr[IntegerAttr])
term_count		attr_def(IntegerAttr)
group_count		attr_def(IntegerAttr)
traits		traits_def(Pure())
irdl_options		(AttrSizedOperandSegments(as_property=True),)

dependencies

method

def dependencies() -> OperationDependencies: ...

Describe the rotated input, evaluation keys and plaintext weights.

verify_

method

def verify_() -> None: ...

ModSwitchOp

class View source

ModSwitchOp()

Bases: _UnaryCiphertextOp

Restrict a ciphertext to the Q rows at target_depth.

Rows removed before the target depth are discarded without dividing or rounding any coefficient. Surviving residue values and the ciphertext actual scale are unchanged. The operation therefore changes the modulus and depth, not the scale; component count, polynomial domain, and residue representation are preserved.

Attributes

Name	Type	Default/value
name		'fhelium_ckks.mod_switch'
target_depth		attr_def(IntegerAttr)

dependencies

method

def dependencies() -> OperationDependencies: ...

Describe result reads in this operation's value coordinates.

MultiplyOp

class View source

MultiplyOp()

Bases: _BinaryCiphertextOp

Multiply two CT2 ciphertexts by polynomial convolution.

For $a=(a_0,a_1)$ and $b=(b_0,b_1)$, the CT3 result is $(a_0{b}_0,a_0{b}_1+a_1{b}_0,a_1{b}_1)$. Products are computed pointwise in NTT/Montgomery form modulo every active prime and correspond to negacyclic polynomial products. If input actual scales are ${\mathrm{\Delta }}_a$ and ${\mathrm{\Delta }}_b$, the result scale is ${\mathrm{\Delta }}_a{\mathrm{\Delta }}_b$; no rescale or relinearization is implicit.

Attributes

Name	Type	Default/value
name		'fhelium_ckks.multiply'

dependencies

method

def dependencies() -> OperationDependencies: ...

Describe result reads in this operation's value coordinates.

MultiplyIntegerScalarOp

class View source

MultiplyIntegerScalarOp(ciphertext: SSAValue | Operation, result_type: Attribute | None=None, *, parameters: Sequence[SSAValue | Operation]=(), scalar: IntegerAttr, attributes: Mapping[str, Attribute] | None=None)

Bases: IRDLOperation

Multiply every ciphertext component by an integer scalar.

For integer $k$, each polynomial becomes $c_j^{\prime }=k{c}_j$ modulo every active prime. Because $k$ is not a newly scaled encoding, the ciphertext actual scale, depth, component count, prime rows, polynomial domain, and Montgomery state remain unchanged.

Attributes

Name	Type	Default/value
name		'fhelium_ckks.multiply_integer_scalar'
ciphertext		operand_def(CiphertextType)
parameters		var_operand_def()
result		result_def(CiphertextType)
scalar		attr_def(IntegerAttr)
traits		traits_def(Pure())

dependencies

method

def dependencies() -> OperationDependencies: ...

Describe result reads in this operation's value coordinates.

MultiplyScalarOp

class View source

MultiplyScalarOp()

Bases: _RealScalarCiphertextOp

Multiply all ciphertext components by a quantized real constant.

For scalar $u$ at scalar scale $\delta$, the implementation samples $k=\mathrm{RandRound}(u\delta )$ and computes $c_j^{\prime }=k{c}_j$ modulo every active prime. The output actual scale is $\mathrm{\Delta }\delta$ for input scale $\mathrm{\Delta }$, so it represents multiplication by approximately $u$. Depth, component count, prime rows, and polynomial representation are preserved; rescaling is separate.

Attributes

Name	Type	Default/value
name		'fhelium_ckks.multiply_scalar'

dependencies

method

def dependencies() -> OperationDependencies: ...

Describe result reads in this operation's value coordinates.

MultiplyPlaintextOp

class View source

MultiplyPlaintextOp()

Bases: _CiphertextPlaintextOp

Multiply each ciphertext component by a prepared plaintext polynomial.

For ciphertext components $c_j$ and plaintext $p$, the result components are $c_j^{\prime }=c_{j}p$ in every active-prime negacyclic ring. Operands use NTT/Montgomery form so execution is pointwise. The depth and component count remain unchanged, while output actual scale is ${\mathrm{\Delta }}_c{\mathrm{\Delta }}_p$; no rescale is implicit.

Attributes

Name	Type	Default/value
name		'fhelium_ckks.multiply_plaintext'

dependencies

method

def dependencies() -> OperationDependencies: ...

Describe result reads in this operation's value coordinates.

MultiplyCompressedPlaintextOp

class View source

MultiplyCompressedPlaintextOp()

Bases: _CiphertextCompressedPlaintextOp

Multiply ciphertext components by compressed NTT plaintext data.

The compressed layout expands logically to a prepared NTT/Montgomery plaintext $p$. Cyclic, contiguous and strided-sparse layouts are supported; sparse implicit rows enter as separate Tensor operands. Each result component represents $c_{j}p$ modulo every active prime, computed without materializing that expansion. Component count and depth remain; output actual scale is ${\mathrm{\Delta }}_c{\mathrm{\Delta }}_p$.

Attributes

Name	Type	Default/value
name		'fhelium_ckks.multiply_compressed_plaintext'

dependencies

method

def dependencies() -> OperationDependencies: ...

Describe direct ciphertext reads and compact plaintext expansion.

NegateOp

class View source

NegateOp()

Bases: _UnaryCiphertextOp

Negate every component of a CKKS ciphertext.

For $c=(c_0,\dots ,c_{k-1})$, the result is $(-c_0,\dots ,-c_{k-1})$ modulo each active prime and therefore decrypts to the negated message. Component count, depth, actual scale, prime rows, polynomial domain, and Montgomery state are unchanged.

Attributes

Name	Type	Default/value
name		'fhelium_ckks.negate'

dependencies

method

def dependencies() -> OperationDependencies: ...

Describe result reads in this operation's value coordinates.

PlaintextType

class View source

PlaintextType()

Bases: OpenStateType

CKKS plaintext with partial encoding and RNS representation state.

Attributes

Name	Type	Default/value
name		'fhelium_ckks.plaintext'
ROLE	ClassVar[ValueRole]	'plaintext'

OPERATION_SPECS

constant View source

OPERATION_SPECS: tuple[OperationSpec, ...] = (registered_operation_spec(PrepareCompressedPlaintextOp, 'ckks', effect='rng-write', validator=flat_with_attributes('depth', 'scale', 'ring_dimension', 'min_modulus', 'polynomial_domain')), registered_operation_spec(EncodeOp, 'ckks', effect='rng-write', validator=flat_with_attributes('depth', 'scale')), registered_operation_spec(DecodeOp, 'ckks', validator=flat_with_attributes('is_real')), registered_operation_spec(IntegerCoefficientsToRnsOp, 'ckks', validator=flat_with_attributes('modulus_basis', 'depth')), registered_operation_spec(EncryptOp, 'ckks', effect='rng-write', validator=lambda operation: (*flat_with_attributes('output_domain')(operation), *_rotation_output_state_diagnostics(cast(EncryptOp, operation)))), registered_operation_spec(DecryptOp, 'ckks', validator=_decrypt_specification), registered_operation_spec(SumBatchOp, 'ckks', validator=flat_with_attributes('axis')), *(registered_operation_spec(op, 'ckks', validator=flat_operation) for op in (NegateOp, ToNttOp, FromNttOp, ToMontgomeryResiduesOp, ToStandardResiduesOp, AddOp, SubtractOp, AddPlaintextOp, MultiplyPlaintextOp)), registered_operation_spec(RotateOp, 'ckks', validator=_with_ciphertext_components(_rotate_specification, operands=((0, 2),), results=((0, 2),))), registered_operation_spec(RotateManyOp, 'ckks', validator=_with_ciphertext_components(_hoisted_rotate_many_specification, operands=((0, 2),), every_result=2)), registered_operation_spec(GroupedRotationWeightedSumOp, 'ckks', validator=_with_ciphertext_components(flat_with_attributes('baby_steps', 'term_count', 'group_count'), operands=((0, 2),), results=((0, 2),))), registered_operation_spec(MultiplyOp, 'ckks', validator=_with_ciphertext_components(flat_operation, operands=((0, 2), (1, 2)), results=((0, 3),))), registered_operation_spec(AddCompressedPlaintextOp, 'ckks', validator=flat_with_attributes('inplace', 'compression_layout', 'polynomial_domain')), registered_operation_spec(MultiplyCompressedPlaintextOp, 'ckks', validator=flat_with_attributes('inplace', 'compression_layout')), registered_operation_spec(RelinearizeOp, 'ckks', validator=_with_ciphertext_components(lambda operation: (*flat_with_attributes('output_domain')(operation), *_rotation_output_state_diagnostics(cast(RelinearizeOp, operation))), operands=((0, 3),), results=((0, 2),))), registered_operation_spec(SwitchKeyOp, 'ckks', validator=_with_ciphertext_components(lambda operation: (*flat_with_attributes('output_domain')(operation), *_rotation_output_state_diagnostics(cast(SwitchKeyOp, operation))), operands=((0, 2),), results=((0, 2),))), registered_operation_spec(ConjugateOp, 'ckks', validator=_with_ciphertext_components(lambda operation: (*flat_with_attributes('output_domain')(operation), *_rotation_output_state_diagnostics(cast(ConjugateOp, operation))), operands=((0, 2),), results=((0, 2),))), registered_operation_spec(RescaleOp, 'ckks', validator=_rescale_specification), registered_operation_spec(ModSwitchOp, 'ckks', validator=flat_with_attributes('target_depth')), registered_operation_spec(ReinterpretScaleOp, 'ckks', validator=flat_with_attributes('scale')), *(registered_operation_spec(operation_type, 'ckks', effect='rng-write', validator=_prepare_specification(operation, role)) for operation, role, operation_type in (('add', 'message', PrepareAddMessageOp), ('add', 'plaintext', PrepareAddPlaintextOp), ('add', 'static', PrepareAddStaticOp), ('multiply', 'message', PrepareMultiplyMessageOp), ('multiply', 'plaintext', PrepareMultiplyPlaintextOp), ('multiply', 'static', PrepareMultiplyStaticOp))), *(registered_operation_spec(operation_type, 'ckks', effect='rng-write', validator=flat_with_attributes('scalar', 'scalar_scale')) for operation_type in (AddScalarOp, MultiplyScalarOp)), registered_operation_spec(MultiplyIntegerScalarOp, 'ckks', validator=flat_with_attributes('scalar')))

PrepareAddMessageOp

class View source

PrepareAddMessageOp()

Bases: _PrepareOp

Encode a public message for ciphertext addition.

The message is encoded at the ciphertext depth and actual scale, reduced into the ciphertext's Q or QP rows, and converted to coefficient-domain Montgomery residues. The prepared polynomial can then be added to component zero by AddPlaintextOp without changing ciphertext depth or scale.

Attributes

Name	Type	Default/value
name		'fhelium_ckks.prepare.add.message'

dependencies

method

def dependencies() -> OperationDependencies: ...

Describe result reads in this operation's value coordinates.

PrepareAddPlaintextOp

class View source

PrepareAddPlaintextOp()

Bases: _PrepareOp

Convert a caller-owned plaintext to addition-ready RNS state.

The plaintext already supplies its actual scale and depth; both must match the ciphertext. Encoding or residue conversion as needed produces coefficient-domain Montgomery rows in the ciphertext's Q or QP basis. No message arithmetic is performed before AddPlaintextOp.

Attributes

Name	Type	Default/value
name		'fhelium_ckks.prepare.add.plaintext'

dependencies

method

def dependencies() -> OperationDependencies: ...

Describe result reads in this operation's value coordinates.

PrepareAddStaticOp

class View source

PrepareAddStaticOp()

Bases: _PrepareOp

Encode a statically known public value for ciphertext addition.

The value is encoded at the ciphertext actual scale and depth, reduced to the same Q or QP rows, and converted to coefficient-domain Montgomery form. The result has the state required by AddPlaintextOp.

Attributes

Name	Type	Default/value
name		'fhelium_ckks.prepare.add.static'

PrepareMultiplyMessageOp

class View source

PrepareMultiplyMessageOp()

Bases: _PrepareOp

Encode a public message for ciphertext multiplication.

The message is encoded at the selected default actual scale, placed at the ciphertext depth, reduced into matching Q or QP rows, and transformed to NTT/Montgomery form. MultiplyPlaintextOp then produces scale ${\mathrm{\Delta }}_c{\mathrm{\Delta }}_p$.

Attributes

Name	Type	Default/value
name		'fhelium_ckks.prepare.multiply.message'

dependencies

method

def dependencies() -> OperationDependencies: ...

Describe result reads in this operation's value coordinates.

PrepareMultiplyPlaintextOp

class View source

PrepareMultiplyPlaintextOp()

Bases: _PrepareOp

Convert a caller-owned plaintext to multiplication-ready state.

The plaintext retains its own actual scale and must share the ciphertext depth and Q or QP rows. Encoding, residue conversion, and a forward NTT as needed produce NTT/Montgomery data for MultiplyPlaintextOp. Preparation itself does not multiply or rescale.

Attributes

Name	Type	Default/value
name		'fhelium_ckks.prepare.multiply.plaintext'

dependencies

method

def dependencies() -> OperationDependencies: ...

Describe result reads in this operation's value coordinates.

PrepareMultiplyStaticOp

class View source

PrepareMultiplyStaticOp()

Bases: _PrepareOp

Encode a statically known public value for ciphertext multiplication.

The value is encoded at the selected default actual scale and ciphertext depth, reduced into matching Q or QP rows, and transformed to NTT/Montgomery form. Its scale later multiplies the ciphertext scale in MultiplyPlaintextOp.

Attributes

Name	Type	Default/value
name		'fhelium_ckks.prepare.multiply.static'

IntegerCoefficientsToRnsOp

class View source

IntegerCoefficientsToRnsOp()

Bases: IRDLOperation

Reduce integer polynomial coefficients into active RNS rows.

RNS means residue number system. At depth $\ell$, every coefficient $a_j$ is mapped to $a_{j}mod{q}_i$ for each active Q prime and, for basis QP, to $a_{j}mod{p}_i$ for each special P prime. The result is coefficient-domain standard-residue data. Scale and polynomial meaning do not change.

Attributes

Name	Type	Default/value
name		'fhelium_ckks.integer_coefficients_to_rns'
plaintext		operand_def(PlaintextType)
parameters		var_operand_def()
result		result_def(PlaintextType)
modulus_basis		attr_def(StringAttr)
depth		attr_def(IntegerAttr)
traits		traits_def(Pure())

dependencies

method

def dependencies() -> OperationDependencies: ...

Describe result reads in this operation's value coordinates.

RelinearizeOp

class View source

RelinearizeOp()

Bases: _OutputDomainCiphertextOp

Convert a three-component product ciphertext to two components.

The input is an NTT/Montgomery CT3 product. For phase $c_0+c_{1}s+c_2{s}^2$, hybrid key switching maps the $c_2{s}^2$ term to correction polynomials $(d_0,d_1)$ under secret $s$. The result $(c_0+d_0,c_1+d_1)$ preserves the phase up to key-switch error. Depth, actual scale, and active Q rows remain unchanged. output_domain selects coefficient/standard or NTT/Montgomery output.

Attributes

Name	Type	Default/value
name		'fhelium_ckks.relinearize'

dependencies

method

def dependencies() -> OperationDependencies: ...

Describe result reads in this operation's value coordinates.

ReinterpretScaleOp

class View source

ReinterpretScaleOp()

Bases: _UnaryCiphertextOp

Replace ciphertext scale metadata while preserving all residues.

The recorded actual scale becomes the supplied ${\mathrm{\Delta }}^{\prime }$, but ciphertext components, prime rows, depth, polynomial domain, and Montgomery state do not change. The represented decoded value is consequently interpreted relative to ${\mathrm{\Delta }}^{\prime }$. This operation performs no multiplication, rescaling, or modulus switch.

Attributes

Name	Type	Default/value
name		'fhelium_ckks.reinterpret_scale'
scale		attr_def(FloatAttr)

dependencies

method

def dependencies() -> OperationDependencies: ...

Describe result reads in this operation's value coordinates.

RescaleOp

class View source

RescaleOp(value: SSAValue | Operation, result_type: Attribute | None=None, *, parameters: Sequence[SSAValue | Operation]=(), rounding: str | StringAttr='nearest', polynomial_domain: Literal['coefficient', 'ntt']='coefficient', attributes: Mapping[str, Attribute] | None=None)

Bases: IRDLOperation

Divide a ciphertext by its leading Q depth-group product.

For group $G_d$, every component coefficient is quotient-rounded by $M_d=\prod _{q\in G_d}q$ and represented on the surviving Q rows. All rows in $G_d$ are removed, depth advances once, and actual scale changes from $\mathrm{\Delta }$ to $\mathrm{\Delta }/M_d$. Component count is unchanged. Coefficient/standard input uses coefficient quotient arithmetic; NTT/Montgomery input retains surviving evaluations by transforming only the rounding correction. rounding selects the quotient rule.

Attributes

Name	Type	Default/value
name		'fhelium_ckks.rescale'
value		operand_def(CiphertextType)
parameters		var_operand_def()
result		result_def(CiphertextType)
rounding		opt_attr_def(StringAttr)
input_domain		attr_def(StringAttr, default_value=StringAttr('coefficient'))
output_domain		attr_def(StringAttr, default_value=StringAttr('coefficient'))
traits		traits_def(Pure())

dependencies

method

def dependencies() -> OperationDependencies: ...

Describe the rounded quotient in its represented polynomial domain.

verify_

method

def verify_() -> None: ...

Accept only represented CKKS quotient-rounding rules when present.

RotateOp

class View source

RotateOp(value: SSAValue | Operation, key: SSAValue | Operation, result_type: Attribute | None=None, *, parameters: Sequence[SSAValue | Operation]=(), attributes: Mapping[str, Attribute] | None=None)

Bases: IRDLOperation

Rotate CKKS slots through a Galois automorphism and key switch.

The input is a CT2 ciphertext in coefficient/standard or NTT/Montgomery Q state. A rotation key records a signed slot displacement $r$ and its odd Galois element $g$. Applying ${\sigma }_g:X\mapsto X^g$ rotates the encoded slots and changes the secret relation from $s$ to ${\sigma }_g(s)$; the key-switch stage returns that relation to $s$. The result is a CT2 ciphertext with depth, actual scale, and active Q rows preserved. output_domain selects coefficient/standard or NTT/Montgomery output; the NTT choice equals a coefficient rotation followed by ToNttOp.

Attributes

Name	Type	Default/value
name		'fhelium_ckks.rotate'
value		operand_def(CiphertextType)
key		operand_def(EvaluationKeyType)
parameters		var_operand_def()
result		result_def(CiphertextType)
output_domain		attr_def(StringAttr, default_value=StringAttr('coefficient'))
input_domain		attr_def(StringAttr, default_value=StringAttr('coefficient'))
traits		traits_def(Pure())

dependencies

method

def dependencies() -> OperationDependencies: ...

Describe result reads in this operation's value coordinates.

RotateManyOp

class View source

RotateManyOp(value: SSAValue | Operation, keys: tuple[SSAValue | Operation, ...], result_types: tuple[CiphertextType, ...], *, output_domain: Literal['coefficient', 'ntt']='coefficient', parameters: Sequence[SSAValue | Operation]=(), attributes: Mapping[str, Attribute] | None=None)

Bases: IRDLOperation

Produce several slot rotations from one shared key-switch preparation.

The input is a coefficient-domain standard-Q CT2 ciphertext. Each key operand defines one Galois automorphism and signed slot displacement. For every key the mathematical result equals an independent RotateOp of the same input. Hoisting shares hybrid digit decomposition and Q-to-QP basis-extension work across outputs but does not change their order or values. Every result preserves the input depth, actual scale, and active Q rows. output_domain selects coefficient/standard (the default) or NTT/Montgomery output. The latter equals applying ToNttOp to each coefficient result and permits ModDown to retain Q evaluations.

Attributes

Name	Type	Default/value
name		'fhelium_ckks.hoisted_rotate_many'
value		operand_def(CiphertextType)
keys		var_operand_def(EvaluationKeyType)
parameters		var_operand_def()
outputs		var_result_def(CiphertextType)
irdl_options		(AttrSizedOperandSegments(as_property=True),)
output_domain		attr_def(StringAttr, default_value=StringAttr('coefficient'))
traits		traits_def(Pure())

dependencies

method

def dependencies() -> OperationDependencies: ...

Describe each rotation's reads from the ciphertext and its key.

verify_

method

def verify_() -> None: ...

SubtractOp

class View source

SubtractOp()

Bases: _BinaryCiphertextOp

Subtract ciphertexts component by component.

For each component $j$ and active prime $q_i$, the operation computes $c_j^{\prime }=c_j^{(a)}-c_j^{(b)}(\mathrm{mod}{q}_i)$. Compatible depth, prime rows, representation, component count, and actual scale are preserved, and the result represents the slotwise difference.

Attributes

Name	Type	Default/value
name		'fhelium_ckks.subtract'

dependencies

method

def dependencies() -> OperationDependencies: ...

Describe result reads in this operation's value coordinates.

SwitchKeyOp

class View source

SwitchKeyOp()

Bases: _OutputDomainCiphertextOp

Change the secret-key relation of a CT2 ciphertext.

The input is a coefficient-domain standard-Q CT2 ciphertext. For phase $c_0+c_1{s}_{\mathrm{src}}$, the supplied key Tensor maps the $c_1{s}_{\mathrm{src}}$ term to corrections $(d_0,d_1)$ satisfying the destination relation. The result $(c_0+d_0,d_1)$ decrypts under $s_{\mathrm{dst}}$ to the same approximate message, apart from key-switch error. output_domain selects coefficient/standard or NTT/Montgomery output. Depth, actual scale, active Q rows, and component count are preserved.

Attributes

Name	Type	Default/value
name		'fhelium_ckks.switch_key'

dependencies

method

def dependencies() -> OperationDependencies: ...

Describe result reads in this operation's value coordinates.

ToNttOp

class View source

ToNttOp()

Bases: _RepresentationOp

Transform CKKS residue polynomials to NTT/Montgomery form.

For each component and active prime $q_i$, coefficient residues are mapped to ${\mathrm{NTT}}_{q_i}(c_j)R_{i}mod{q}_i$. The represented ring element, component count, prime rows, depth, basis, and actual scale remain unchanged. Lowering selects the corresponding operation from the NTT dialect according to the input residue representation.

Attributes

Name	Type	Default/value
name		'fhelium_ckks.to_ntt'

dependencies

method

def dependencies() -> OperationDependencies: ...

Describe result reads in this operation's value coordinates.

ToMontgomeryResiduesOp

class View source

ToMontgomeryResiduesOp()

Bases: _RepresentationOp

Multiply coefficient-domain plaintext residues by the Montgomery radix.

For each active prime $q_i$, the stored row changes from $x_i$ to $x_i{R}_{i}mod{q}_i$. This representation transition preserves the plaintext polynomial, Q or QP rows, depth, and actual scale.

Attributes

Name	Type	Default/value
name		'fhelium_ckks.to_montgomery_residues'

dependencies

method

def dependencies() -> OperationDependencies: ...

Describe result reads in this operation's value coordinates.

ToStandardResiduesOp

class View source

ToStandardResiduesOp()

Bases: _RepresentationOp

Remove the Montgomery factor from coefficient-domain plaintext rows.

For each active prime $q_i$, Montgomery reduction maps $x_i{R}_i$ to $x_{i}mod{q}_i$. The plaintext polynomial, Q or QP rows, depth, and actual scale are preserved.

Attributes

Name	Type	Default/value
name		'fhelium_ckks.to_standard_residues'

dependencies

method

def dependencies() -> OperationDependencies: ...

Describe result reads in this operation's value coordinates.