\documentclass[a4paper]{book}
\usepackage{alltt}
\usepackage{makeidx}
\usepackage{hyperref}
\usepackage{url}
\usepackage{mdframed}
\usepackage{amsmath}
\usepackage{varioref}
\usepackage{synttree, proof, centernot}
\usepackage[firstpage]{draftwatermark}
\usepackage{verbatim}
\usepackage[note]{marginote}
\usepackage{amsmath}
\usepackage{amsfonts}
\usepackage{mathtools}
\usepackage{dsfont}
\usepackage{float}
\usepackage{threeparttable}
\setcounter{tocdepth}{1}
\input{coqmacros}

\author{Pierre Castéran\\ LaBRI, Univ. Bordeaux, CNRS UMR 5800, Bordeaux-INP\\with contributions by Yves Bertot, \'Evelyne Contejean,  Florian Hatat and Pascal Manoury}
\date{\today}
\title{Hydra Battles and Cie}
\makeindex
\begin{document}
\maketitle

\cleardoublepage

% \mbox{~}
% \clearpage
% \newpage
% \mbox{~}
\vspace{10cm}
\begin{quote}
{ \Large {\it
``I start from one point and go as far as possible.'' }

John Coltrane.}
\end{quote}

% \begin{verse}
% Hydra hydra hydram \\

% Hydrae hydrae hydra \\

% Hydrae hydrae hydras \\

% Hydrarum hydris hydris\\
% \end{verse}

\tableofcontents

%-------------------------------------------------------------------

\chapter{Introduction}

\vspace{16pt}

Proof assistants are excellent tools for exploring the structure of mathematical proofs,
studying  which hypotheses are really needed, and which proof patterns are useful and/or
necessary. Since the development of a theory is represented as a bunch of computer files,
everyone is able to read the proofs with an arbitrary level of detail, or to play with the theory by writing alternate proofs or definitions.

Among all the theorems proved with the help of proof assistants like \coq{}, \isabelle{}~\cite{isabelle}, \hol{}~\cite{HOL}, etc.,
several statements and proofs  share some interesting features:
\begin{itemize}
\item Their statements are easy to understand, even by non-mathematicians
\item Their proof requires some non-trivial mathematical tools
\item Their mechanization on computer presents some methodological interest.
\end{itemize}

This is obviously the case of the four-color theorem~\cite{fourcolors}  and the Kepler conjecture~\cite{flyspeck2015}. We do not mention impressive works like the proof of the odd-order theorem ~\cite{oddorderthm}, since understanding its statement requires a quite good mathematical culture.

In this document, we present two examples which seem to have the above properties.

\begin{itemize}
\item Hydra games (a.k.a. \emph{Hydra battles}) appear in an article published in 1982 by two mathematicians:
L. Kirby and J. Paris~\cite{KP82}: \emph{Accessible Independence Results for Peano Arithmetic}.
Although the mathematical contents of this
paper are quite advanced, the rules of hydra battles are very easy to understand. There are now several sites on Internet where you can find tutorials on hydra games, together with simulators you can play with. See, for instance, the page written by Andrej Bauer~\cite{bauer2008}.

Hydra battles, as well as Goodstein Sequences~\cite{goodstein_1944, KP82}
are a nice way to present complex termination problems.
The article by Kirby and Paris presents a proof of termination
based on ordinal numbers, as well as a proof that this termination is not
provable in Peano arithmetic. In the book dedicated to
J.P. ~Jouannaud \cite{HommageJPJ}, N.~Dershowitz and G.~Moser  give a thorough survey on this topic~\cite{Dershowitz2007}.

\item In the second part, we are interested in computing $x^n$ with the least number of multiplications as possible. We use the notion of \emph{addition chains}~\cite{brauer1939,DBLP:journals/ipl/BerstelB87}, to generate efficient certified exponentiation functions.
\end{itemize}

%%%%% ICI

\subsection{Trust in our Proofs}
\label{sect:trust-in-proofs}

Unlike mathematical literature, where definitions and proofs are spread over many articles and books,
the whole proof is now inside your computer. It is composed of the \texttt{.v} files you downloaded and
parts of \coq's standard library. Thus, there is no ambiguity in our definitions and the premises of the theorems. Furthermore, you will be able to navigate through the development, using your favourite text editor or IDE, and some commands like \texttt{Search}, \texttt{Locate},  etc.

\subsection{Assumed Redundancy}

It may often happen that several definitions of a given concept, or several proofs of a given theorem are possible. If all the versions present some interest, we will make them available, since each one may be of some methodological
interest (by illustrating some tactic of proof pattern, for instance).
We may use \coq's module system to make several proofs of a given theorem co-exist in our libraries (see also Sect~\vref{sect:alt-proofs}).
After some discussions of the pros and cons of each solution, we develop only one of them, leaving the others  as exercises or projects (i.e., big or difficult exercises).
In order to discuss which assumptions are really needed for proving a theorem, we will also present
several aborted proofs.
Of course, do not hesitate to contribute nice proofs or alternative definitions !

It may also happen that some proof looks to be useless, because the proven theorem is a trivial consequence of another (proven too) result.
For instance, let us consider the three following statements:
\begin{enumerate}
\item There is no measure into $\mathbb{N}$ for proving the termination of all hydra battles (Sect~\vref{omega-case}).
\item There is no measure into $[0,\omega^2)$ for proving the termination of all hydra battle (Sect~\vref{omega2-case}).
\item There is no measure into $[0,\mu)$ for proving the termination of all hydra battles, for any $\mu<\epsilon_0$ (Sect\vref{sec:free-battles-case}).
\end{enumerate}

Obviously, the third theorem implies the second one, which implies the first one. So, theoretically, a library would contain only a proof of $(3)$ and remarks for $(2)$ and $(1)$. But we found it interesting to make all the three proofs available, allowing the reader to compare their common structure and notice their technical differences.
In particular, the proof of $(3)$ uses several non-trivial combinatorial properties of ordinal numbers up to $\epsilon_0$~\cite{KS81}, whilst $(1)$ and $(2)$ use simple properties of $\mathbb{N}$ and $\mathbb{N}^2$.

\subsection{About Logic}

Most of the proofs we present are \emph{constructive}. Whenever possible, we provide the user with an associated function, which she or he can apply in \gallina{} or \ocaml{} in order to get a ``concrete'' feeling of the meaning of the considered theorem.
For instance, in Chapter~\vref{chap:ketonen}, the notion of \emph{limit ordinal} is
made more ``concrete'' thanks to a function \texttt{canon} which computes every item of a sequence which converges on a given limit ordinal $\alpha$. This simply typed function allows the user/reader to make her/his own experimentations.
For instance, one can very easily compute the $42$-nd item of a sequence which converges towards $\omega^{\omega^\omega}$.

Except in the \texttt{Schutte} library, dedicated to an axiomatic presentation of the set of countable ordinal numbers, all our development is axiom-free, and respects the rules of intuitionistic logic. Note that we also use the \texttt{Equations} plug-in~\cite{sozeau:hal-01671777} in the definitition of  several rapidly growing hierarchy of functions, in Chap.~\ref{chap:alpha-large}. This plug-in imports several known-as-harmless  axioms.

% \begin{Coqsrc}
% FunctionalExtensionality.functional_extensionality_dep :
% forall (A : Type) (B : A -> Type) (f g : forall x : A, B x),
% (forall x : A, f x = g x) -> f = g
% \end{Coqsrc}

\index{Coq!Commands!Print Assumptions}

At any place of our development, you may use the  \texttt{Print Assumptions {\it ident}} command in order to verify on which axiom the theorem {\it ident} may depend. The following example is extracted from
Library~\href{../theories/html/hydras.Epsilon0.F_alpha.html}{hydras.Epsilon0.F\_alpha}, where we use the \texttt{coq-equations} plug-in (see Sect.~\vref{sect:wainer}).

\begin{Coqsrc}
About F_zero_eqn.
\end{Coqsrc}

\begin{Coqanswer}
F_zero_eqn : forall i : nat, F_ Zero i = S i
\end{Coqanswer}

\begin{Coqsrc}
Print Assumptions F_zero_eqn.
\end{Coqsrc}

\begin{Coqanswer}
Axioms:
FunctionalExtensionality.functional_extensionality_dep
  : forall (A : Type) (B : A -> Type) (f g : forall x : A, B x),
    (forall x : A, f x = g x) -> f = g
Eqdep.Eq_rect_eq.eq_rect_eq
  : forall (U : Type) (p : U) (Q : U -> Type) (x : Q p) (h : p = p),
    x = eq_rect p Q x p h
\end{Coqanswer}

\paragraph*{Warning:}

This document is \emph{not} an introductory text for \coq{}, and there are many aspects of this proof assistant that are not covered.
 The reader should already have some basic experience with the \coq{} system. The Reference Manual and several tutorials are available on \coq{} page~\cite{Coq}.  First chapters of textbooks like \emph{Interactive Theorem Proving and Program Development}~\cite{BC04}, \emph{Software Foundations}~\cite{SF} or  \emph{Certified Programming with Dependent Types} ~\cite{chlipalacpdt2011} will give you the right background.

\subsection{Contributions}
Many thanks to Yves Bertot,
\'Evelyne Contejean,  Florian Hatat and Pascal Manoury  for their contribution.
Yves made nice optimizations  to algorithms presented in Chapter~\ref{chapter-powers}.
\'Evelyne contributed libraries on the recursive path ordering (\emph{rpo}) for proving the well-foundedness of our representation of $\epsilon_0$ and $\Gamma_0$.
Florian Hatat proved many useful lemmas on countable sets, which we used in our adaptation of Schütte's formalization of countable ordinals. Pascal Manoury is integrating the ordinal $\omega^\omega$ into our hierarchy of ordinal notations.

\label{sec:orgheadline2}

Any form of contribution  is welcome: correction of errors (typos and more serious mistakes), improvement of
Coq scripts, proposition of inclusion of new chapters, and generally any
comment or proposition that would help us. The text contains several \emph{projects} which, when completed, may improve the present work.
Please do not hesitate to bring your contribution!

\subsection{Typographical Conventions}

Quotations from our  \coq{} source are displayed as follows:

  \begin{Coqsrc}
 Require Import Arith.

 Definition square (n:nat) := n * n.

 Lemma square_double : exists n:nat, n + n = square n.
 Proof.
    exists 2.
  \end{Coqsrc}

Answers from \coq{} (including sub-goals, error messages, etc.) are displayed in slanted style
with a different background color.

 \begin{Coqanswer}
 1 subgoal, subgoal 1 (ID 5)

  ============================
   2 + 2 = square 2

 \end{Coqanswer}

 \begin{Coqsrc}
   reflexivity.
Qed.
 \end{Coqsrc}

\subsection{Active Links}
The  links which appear in this pdf  document lead are of three possible kinds of destination:
\begin{itemize}
\item Local links to the document itself,
\item External links, mainly to \coq's page,
\item Local links to pages generated by \texttt{coqdoc}. According to the current makefile (through the commands \texttt{make html} and \texttt{make pdf}),
  we assume that the page generated from a library \texttt{XXX/YYY.v} is stored as
the relative address \texttt{../theories/html/hydras.XXX.YYY.html} (from the location of the pdf)
Thus,  active links towards our \coq{} modules may be incorrect if you got this \texttt{pdf} document otherwise than by compiling the distribution available in
\url{https://github.com/coq-community/hydra-battles}.

\end{itemize}

\subsection{Alternative or Bad Definitions}
\label{sect:alt-proofs}
Finally, we decided to include definitions or lemma statements, as well as tactics,  that lead to
dead-ends or too complex developments, with the following coloring.
Bad definitions
 and encapsulation in modules called \texttt{Bad}, \texttt{Bad1}, etc.

\begin{Coqbad}
Require Import Lia.

Module Bad.

Definition double (n:nat)  := n + 2.

Lemma lt_double : forall n:nat, n < double  n.
Proof.
   unfold double; lia.
Qed.

End Bad.
\end{Coqbad}

Likewise, alternative, but still unexplored definitions will be presented in modules
\texttt{Alt}, \texttt{Alt1}, etc. Using these definitions is left as an implicit exercise.

\begin{Coqalt}
Require Import Arith Lia Iterates.
Module Alt.
  Definition double (n : nat) := iterate S n n.
End Alt.
\end{Coqalt}

\begin{Coqsrc}
Lemma alt_double_ok n : Nat.double n = Alt.double n.
Proof.
  unfold Alt.double, Nat.double; induction n; cbn.
  -  trivial.
  -  rewrite <- iterate_rw, iterate_S_eqn, <- IHn; lia.
Qed.
\end{Coqsrc}

\section{Acknowledgements}
\label{sec:orgheadline5}
    Many thanks to Yves Bertot, David Ilcinkas, Karl Palmskog, Sylvain Salvati, Alan Schmitt and Théo Zimmerman for their help on the elaboration of this document, and to the
 members of the \emph{Formal Methods} team at laBRI for their helpful comments
on an oral presentation of this work.

Many thanks also to the Coq development team, Yves Bertot, and members of the \emph{Coq Club} for interesting discussions about the \coq{} system and the Calculus of Inductive Constructions.

The author of the present document wishes to express his gratitude to the late Patrick Dehornoy, whose talk  was determinant for our desire to work on this topic.

I owe my interest in discrete mathematics and their relation to formal proofs and functional programming  to Srecko Brlek.  Equally, there is W. H. Burge's book ``\emph{Recursive Programming Techniques}'' ~\cite{burge} which was a great  source of inspiration.

\section{How to Install the Libraries}
\label{sec:orgheadline4}
\begin{itemize}
\item The present distribution has been checked with version 8.12.0 of the Coq proof assistant, with the plug-ins \texttt{coq-paramcoq}, \texttt{coq-equations}
and \texttt{coq-mathcomp-algebra}.

\item Just go into the root directory, and type "\texttt{make}" ("\texttt{make -k}"  in case of an incomplete installation).
\end{itemize}

\section{Comments on Exercises and Projects}

Although we do not plan to include complete solutions to the exercises,
we think it would be useful to include comments and hints, and questions/answers from the users. In constrast, ``projects'' are supposed, once completed, to be included in the repository.

% \subsubsection{Links to the Coq source}

\part{Hydras and Ordinals}

\include{part-hydras}

\part{Some Funny Algorithms}

\include{chapter-powers}

\part{Appendices}

\bibliographystyle{alpha}
\bibliography{thebib}

\chapter*{Index and tables}

\begin{todo}
 Still very incomplete!
\end{todo}

\printindex

\section{Hydras and Ordinals}

\begin{table}[H]
  \centering
  \begin{threeparttable}
    \caption{Main types and type classes}
\begin{tabular}{|c|c|c|l|}
\hline
Name & Description& Page \\\hline
Battle & type class of battle types & \pageref{types:Battle} \\
E0 & (well formed) ordinals below $\epsilon_0$ & \pageref{types:E0}\\
Hvariant & variants for proving termination of hydra battles & \pageref{sect:hvariant-def} \\
Hydra & tree-like representation of hydras & \pageref{types:Hydra} \\
Hydrae & finite sequences of hydras & \pageref{types:Hydrae} \\
ON & ordinal  notations & \pageref{types:ON} \\
ON\_for & comparison of an ordinal notation with Schütte's model &  \pageref{types:ON-for}\\
ON\_iso & isomorphism of ordinal notations  & \pageref{types:ON-iso}\\

Ord & countable ordinals (after Schütte) & \pageref{types:Ord} \\
ppT1 & pretty printed version of T1 & \pageref{types:ppT1} \\
SubON & comparison of ordinal notations & \pageref{types:SubON} \\
T1 & ordinal terms below $\epsilon_0$ & \pageref{types:T1} \\
T2 & ordinal terms below $\Gamma_0$ & \pageref{types:T2} \\
WO & well orders (Schütte's definition) & \pageref{types:WO} \\
\hline
\end{tabular}
\end{threeparttable}
\end{table}

\begin{table}[H]
  \centering
  \begin{threeparttable}
    \caption{Main functions and constants}
\begin{tabular}{|r | c|c|c|c|l|}
\hline
Name & Gallina & Math & Description & Page \\ \hline
canon & canon alpha i & $\canonseq{\alpha}{i}$& Canonical sequence & \pageref{Functions:canon}\\
canonS & canonS alpha i & $\canonseq{\alpha}{i+1}$& Helper for canon & \pageref{Functions:canonS}\\
F\_ & F\_ alpha n & $F_\alpha(n)$ & Wainer's \texttt{F} fast growing hierarchy & \pageref{Functions:F-alpha} \\
H\_ & H\_ alpha n & $H_\alpha(n)$ & Hardy's \texttt{H} fast growing hierarchy & \pageref{Functions:H-alpha} \\
iterate & iterate $f$ $n$ $x$ & $f^{(n)}(x)$ & Functional iteration & \pageref{Functions:iterate} \\
L\_ & L\_ alpha k & $L_\alpha(k)$ & final step of a standard path & \pageref{Functions:L-alpha} \\
succ & succ alpha & & Successor & \pageref{Functions:succ-T1}, \pageref{Functions:succ-sch} \dots \\
zero:Ord & & $0$ & The least ordinal (Schütte's model) & \pageref{Constants:zero:Ord} \\

\hline
\end{tabular}
\end{threeparttable}
\end{table}

\begin{table}[H]
  \centering
  \begin{threeparttable}
    \caption{Main predicates}
\begin{tabular}{|r | c|c|c|c|l|}
\hline
Name & Gallina&Math& Description& Page \\\hline
\texttt{lt : T1->T1->Prop}& lt alpha beta & $\alpha < \beta$& strict order on type \texttt{T1} \tnote{1} & \pageref{Predicates:lt-T1}\\
\texttt{LT: T1->T1->Prop}& alpha o< beta & $\alpha < \beta$& strict order on type \texttt{T1}   \tnote{2} & \pageref{Predicates:LT-T1}\\
\texttt{Lt : E0->E0->Prop} & alpha o< beta & $\alpha < \beta$& strict order on type \texttt{E0} \tnote{3} & \pageref{Predicates:Lt-E0} \\
\texttt{nf: T1->Prop} & \texttt{nf alpha} && alpha is in Cantor normal form & \pageref{Predicates:nf-T1}\\
\hline
\end{tabular}
\begin{tablenotes}
  \item[1] This order is total, but not well-founded, because of not well formed terms.
\item[2] Restriction of \texttt{lt} to terms in normal form; this order is partial, but well-founded.
\item[3] This order is total \emph{and} well-founded.
\end{tablenotes}
\end{threeparttable}
\end{table}

\vspace{4pt}
\begin{table}[H]
  \centering
  \begin{threeparttable}
    \caption{Infix notations}
\begin{tabular}{|c|c|c|c|l|}
\hline
Name & Gallina&Math& Description& Page \\\hline
 \texttt{on\_lt} & \texttt{alpha o< beta}&$\alpha<\beta$& ordinal inequality \tnote{1} & \pageref{sect:on-lt-notation}\\
 \texttt{on\_le} & \texttt{alpha o<= beta}&$\alpha\leq\beta$& ordinal inequality & \pageref{sect:on-lt-notation}\\
\texttt{plus} & \texttt{alpha + beta} & $\alpha + \beta$ & ordinal addition & \pageref{sect:infix-plus-T1}, \dots\\
\texttt{oplus} & \texttt{alpha o+ beta} & $\alpha \oplus \beta$ & Hessenberg sum & \pageref{sect:infix-oplus} \\
\texttt{round} & \texttt{h -1-> h'} & & one round of a battle & \pageref{sect:infix-round} \\
\texttt{rounds} & \texttt{h -+-> h'} & & one or more  rounds of a battle & \pageref{sect:infix-rounds} \\
\texttt{round\_star} & \texttt{h -*-> h'} & & any number of rounds of a battle & \pageref{sect:infix-rounds} \\

\hline
\end{tabular}

\begin{tablenotes}
 \item [1]
Some notations may belong to several scopes. For instance, ``\texttt{o<}'' is
bound in \texttt{ON\_scope}, \texttt{E0\_scope}, \texttt{t1\_scope}, etc., and locally in several libraries.
\end{tablenotes}
\end{threeparttable}
\end{table}

\begin{table}[H]
  \centering
  \begin{threeparttable}
    \caption{Other notations}
\begin{tabular}{|c|c|c|c|l|}
\hline
Name & Gallina&Math& Description& Page \\\hline
F & \texttt{F $n$} & $n$ & The $n$-th finite ordinal &
\pageref{sect:notation-F}, \pageref{sect:notation-F-sch}\\
FS & \texttt{FS $n$} & $n+1$ & The $n+1$-th finite ordinal  \tnote{2} &
\pageref{sect:notation-FS}\\
omega & \texttt{omega} & $\omega$ &   the first infinite ordinal   & \pageref{sect:notation-omega}, \pageref{sect:omega-T1}, \pageref{sect:omega-notation2}, \dots\\
phi0     & \texttt{phi0 alpha} & $\phi_0(\alpha),\; \omega^\alpha$&exponential of base $\omega$ & \pageref{sect:notation-phi0}\\

\hline
\end{tabular}

\begin{tablenotes}
  \item [2] Note that there exist also various coercions from \texttt{nat} to types of ordinal. Depending on the current scope and  \coq's syntactic analysis algorithm, \texttt{F} may be left implicit.
\end{tablenotes}
  \end{threeparttable}

\end{table}

\section{Addition Chains}

\begin{todo}
\end{todo}

\end{document}


\problemname{Expeditious Cubing}
\illustration{0.32}{rubik}{The classic Rubik's cube.\\
\href{https://commons.wikimedia.org/wiki/File:Rubiks_cube_by_keqs.jpg}{Picture} by Keqs on Wikimedia Commons, cc-by sa}%
Your friend Claire has dragged you along to a speedcubing event that
is happening in Eindhoven. These events are all about solving the
Rubik's cube and similar twisty puzzles as quickly as possible.
The attendants of the event can enter into various competitions based
on the type and size of the puzzle, and there are even special
competitions where the puzzles need to be solved one-handed or
blindfolded.

Claire is competing in the most popular competition: speedsolving the
$3\times3\times3$ Rubik's cube, pictured on the right. Each contestant
needs to solve the cube five times, each time with a different random
scramble. After all solves are completed, the best and the worst times
are discarded and the final score is the average of the remaining
three times. The contestant with the smallest final score wins.
% Claire explains that this rule ensures that the competition is
% not decided by a single lucky solve, for instance the current world
% record time for a single solve is 3.47 seconds, while the world
% record average is ``only'' a time of 5.69 seconds.

Claire has done well in the competition so far and is among the
contenders for the overall victory. All the other contestants have
already finished their five solves, but Claire has one solve remaining.
By looking at the final scores of the other contestants, she has deduced her
own target final score. As long as her final score is less than or equal to
this target score, she will be declared the overall winner.
Is it possible for her to win the competition, and if so, what is the
worst time she can have on her last solve in order to do so?

\section*{Input}

The input consists of:

\begin{itemize}
  \item One line with four real numbers $t_1$, $t_2$, $t_3$ and $t_4$, the times
    Claire got on her first four solves.
  \item One line with a real number $t$, Claire's target final score, the worst
      final score she can have in order to be declared the overall winner.
\end{itemize}

Each number is between $1$ and $20$, inclusive, and is given
with exactly two decimal places.

\section*{Output}

If it is not possible for Claire to win the event, output
``\texttt{impossible}''. If she will win regardless of the time she gets
on her last solve, output ``\texttt{infinite}''. Otherwise, output the
worst time she can have on her last solve in order to be declared the
overall winner. Output the number to \emph{exactly} two decimal places.


    \filetitle{user}{User-supplied prior dummy observations for BVARs}{BVAR/user}

	\paragraph{Syntax}\label{syntax}

\begin{verbatim}
O = BVAR.user(Y0,K0,Y1,G1)
\end{verbatim}

\paragraph{Input arguments}\label{input-arguments}

\begin{itemize}
\item
  \texttt{Y0} {[} numeric {]} - Column-wise prior dummy observations on
  the LHS.
\item
  \texttt{K0} {[} numeric {]} - Column-wise prior dummy observations on
  the RHS constant.
\item
  \texttt{Y1} {[} numeric {]} - Column-wise prior dummy observations on
  the RHS lagged variables.
\item
  \texttt{G1} {[} numeric {]} - Column-wise prior dummy observations on
  the RHS coefficients on the co-integrating vector.
\end{itemize}

\paragraph{Output arguments}\label{output-arguments}

\begin{itemize}
\itemsep1pt\parskip0pt\parsep0pt
\item
  \texttt{O} {[} bvarobj {]} - BVAR object that can be passed into the
  \href{VAR/estimate}{\texttt{VAR/estimate}} function.
\end{itemize}

\paragraph{Description}\label{description}

\paragraph{Example}\label{example}


\section{Introduction}

Self-organizing map \citep{Kohonen:1982} (SOM) is a vector quantization method that maps data onto a grid, usually two-dimensional and regular. After learning has converged, the codebook is self-organized such that the prototypes associated with two nearby nodes are similar. This is a direct consequence of the underlying topology of the map as well as the learning algorithm that, when presented with a new sample, modifies the code word of the best matching unit (BMU, the unit with the closest to the input code word) as well as the code word of units in its vicinity (neighborhood). SOMs have been used in a vast number of applications \citep{Kaski:1998,Oja:2003,Polla:2009} and today there exist several variants of the original algorithm \citep{Kohonen:2001}. However, according to the survey of \citep{Astudillo:2014}, only a few of these variants consider an alternative topology for the map, the regular Cartesian and the hexagonal grid being by far the most common used ones. Among the alternatives, the growing neural gas \citep{Fritzke:1994} is worth to be mentioned since it relies on a dynamic set of units and builds the topology {\em a posteriori} as it is also the case for the incremental grid growing neural network \citep{Blackmore:1995} and the controlled growth self organizing map \citep{Alahakoon:2000}. However, this {\em a posteriori} topology is built in the data space as opposed to the neural space. This means that the neighborhood property is lost and two neurons that are close to each other on the map may end with totally different prototypes in the data space. The impact of the network topology on the self-organization has also been studied by \citep{Jiang:2009} using the MNIST database. In the direct problem (evaluating influence of topology on performance), these authors consider SOMs whose neighborhood is defined by a regular, small world or random network and show a weak influence of the topology on the performance of the underlying model. In the inverse problem (searching for the best topology), authors try to optimize the topology of the network using evolutionary algorithms \citep{Eiben:2003} in order to minimize the classification error. Their results indicate a weak correlation between the topology and the performances in this specific case. However, \citep{Burguillo:2013} reported contradictory results to \citep{Eiben:2003}, when they studied the use of self-organizing map for time series predictions and considered different topologies (spatial, small-world, random and scale-free). They concluded that the classical spatial topology remains the best while the scale-free topology seems inadequate for the time series prediction task. But for the two others (random and small-world), the difference was not so large and topology does not seem to dramatically impact performance.

In this work, we are interested in exploring an alternative topology in order to specifically handle cases where the intrinsic dimension of the data is higher than the dimension of the map.
Most of the time, the topology of the SOM is one dimensional (linear network) or two dimensional (regular or hexagonal grid) and this may not correspond to the intrinsic dimension of the data, especially in the high dimensional case. This may result in the non-preservation of the topology \citep{Villmann:1999} with potentially multiple foldings of the map. The problem is even harder considering the data are unknown at the time of construction of the network. To overcome this topological constraint, we propose a variation of the self organizing map algorithm by considering the random placement of neurons on a two-dimensional manifold, following a blue noise distribution from which various topologies can be derived. These topologies possess random discontinuities that allow for a more flexible self-organization, especially with high-dimensional data. After introducing the methods, the model will be illustrated and analyzed using several classical examples and its properties will be more finely introduced. Finally, we'll explain how this model can be made resilient to neural gain or loss by reorganizing the neural sheet using the centroidal Voronoi tesselation.

A constant issue with self-organizing maps is how can we measure the quality of a map. In SOM's literature, there is neither one measure to rule them all nor a single general recipe on how to measure the quality of the map. Some of the usual measures are the distortion \cite{rynkiewicz:2008}, the $\delta x - \delta y$ representation \citep{Demartines:1992}, and many other specialized measures for rectangular grids or specific types of SOMs \citep{Polani2002}. However, most of those measures cannot be used in this work since we do not use a standard grid for laying over the neural space, instead we use a randomly distributed graph (see supplementary material for standard measures). This and the fact that the neural space is discrete introduce a significant challenge on deciding what will be a good measure for our comparisons \citep{Polani2002} (i.e., to compare the neural spaces of RSOM and regular SOM with the input space). According to \citep{Polani2002}, the quality of the map's organization can be considered equivalent to topology preservation. Therefore, a topological tool such as the persistent homology can help in comparing the input space with the neural one. Topological Data Analysis (TDA) is a relatively new field of applied mathematics and offers a great deal of topological and geometrical tools to analyze point cloud data \citep{Carlsson:2009,HerculanoHouzel:2013}. Such TDA methods have been proposed in \citep{Polani2002}, however TDA wasn't that advanced and popular back then. Therefore, in this work we use the persistent homology and barcodes to analyze our results and compare the neural spaces generated by the SOM algorithms with the input spaces. We provide more details about TDA and persistent homology later in the corresponding section.

To avoid confusion between the original SOM proposed by Teuvo Kohonen and the newly randomized SOM, we'll refer to the original as \textbf{SOM} and the newly randomized one as \textbf{RSOM}.

% \gid{[``In the present review, we wish to point out that the structure introduced in that papers on the discrete space can be interpreted as a complex, a structure known from algebraic topology (Henle 1979). A complex can be seen as a generalization of the notion of a graph. However, no invocation of metric structures is required for its definition, thus the method and the measures derived from it can be regarded as a truly pure topological notions.'']}

% Self-organizing map (SOM) \citep{Kohonen:1982} is a vector quantization method that maps high dimensional data on a low-dimensional grid (usually two-dimensional) through an unsupervised learning process. The low-dimensional discrete map, usually called codebook, consists of code words (vectors) that represent a part of the input space. Two neighboring code words represent similar input samples (prototypes). This is a direct consequence of the underlying topology of the map as well as the learning algorithm. When a new sample is given then the learning algorithm modifies the prototype of  the best matching unit (BMU) as well as the units in its vicinity (neighborhood). SOM have been used in a variety of applications \citep{Kaski:1998,Oja:2003,Polla:2009} and several variations of the original algorithm have been proposed over time \citep{Polla:2009}.

% However, most SOM algorithms assume a fixed neural space (\emph{i.e.}, the space defined by the nodes of the SOM network -- code words)  topology,  which usually is either a rectangular or a hexagonal Cartesian  grid \citep{Astudillo:2014}. This sort of predefined topology of neural space  enforces a rigidity on the neural map and this can lead to a \emph{dimension mismatch} between the input and neural space. This often results in neural representations that are ill-formed and do not cover properly the entire data space. For instance, if the topology of the SOM is one dimensional or  two-dimensional (regular or hexagonal grid) and the intrinsic dimension of the  data is higher than the topology may not be preserved \citep{Villmann:1999}, leading some times to multiple foldings of the map. One of the roots of this problem is the lack of knowledge of the underlying topology of the data space.

% One way to overcome this limitation is to introduce dynamic set of units (neurons) that learn the topology \emph{a posteriori}. Such algorithms are the (i) growing neural gas \citep{Fritzke:1994}, (ii) the incremental grid growing neural network \citep{Blackmore:1995}, and the controlled growth map \citep{Alahakoon:2000}. Nonetheless, the topology in these cases, is built in the data space as opposed to the neural space. This means that the neighborhood property is lost and two nearby neurons on the map may end up with totally different prototypes in the data space. Consequently, these dynamic units do not really solve the problem of preserving the topology and the topological relations between neurons. One solution is to use an alternative topology that allows for more flexibility in the neural space without loosing  performance. We therefore propose in this work a variation of the SOM algorithm by considering the random placement of neurons on a two-dimensional manifold, following a blue noise distribution from which one can derive various different topologies. These topologies possess random but controllable discontinuities that allow for a more flexible self-organization, especially with high-dimensional data.

% We are not the first to explore alternative topologies for training a SOM and the impact of the network topology on self-organization has been studied  before. For instance, \citep{Jiang:2009} consider SOMs whose neighborhood is defined by a regular, small world or random network trained  on the MNIST data set, showing a weak influence of the topology on the performance of the SOM learning algorithm. Furthermore, they optimized the topology of the network using evolutionary algorithms~\citep{Eiben:2003} minimizing the classification error. In this case, their results indicate again a weak correlation between the topology and the performance of the SOM. Another study conducted by \citep{Burguillo:2013} found that the standard Cartesian grid topology was the best over non-conventional topologies (small world, random, and scale-free) for SOMs solving time series prediction problems.

% This paper is organized as follows: first we introduce the necessary terminology and notation. Then we present the model and the learning algorithm as well as the tools to asses the performance of the proposed algorithm. After introducing the model, we conduct several experiments to test the  performance of the algorithm and examine the final topology of the neural space. Finally, we tested the ability of the learning algorithm to cope with situations where reorganization of the neural space is necessary. More precisely,  (i) we perform an ablation study by removing units from the neural space, and (ii) we add extra neurons on the map increasing the capacity of the neural space. In both cases, we show that the topology of the neural space can be preserved.


We implemented the lexicographic order algorithm ($\LT$, Eq.~\ref{eq:general_lex_order}) using the BGV scheme~\cite{BGV12}.
The code is written in the HElib library~\cite{HElib}.
For a fair comparison with the prior work, we also implemented the algorithm of Tan et al.~\cite{TLWRK20}.
The code is publicly available via \url{https://github.com/iliailia/comparison-circuit-over-fq}.
In all the experiments, we used an average commodity laptop equipped with an Intel Dual-Core i5-7267U CPU (running at 3.1 GHz) and 8 GB of RAM.
Multi-threading was turned off.

In the results presented below, the following notation is used:
\begin{description}
  \item[$p:$] the plaintext modulus of the BGV scheme;
  \item[$q:$] the initial ciphertext modulus of the BGV scheme;
  \item[$m:$] the cyclotomic order of the ring $\intring$;
  \item[$n:$] the degree of the ring $\intring$ ($n = \phi(m)$);
  \item[$\ell:$] the number of SIMD slots;
  \item[$d:$] the dimension of a slot subspace used for digit encoding ($d'$ in Eq.~\ref{eq:general_lex_order});
  \item[$l:$] the dimension of digit vectors encoding input integers over $\F_p^d$;
  \item[$k:$] the number of input integers encoded in one ciphertext ($k = \floor{\ell/l}$).
\end{description}

In all the experiments, the encryption parameters of BGV are chosen according to the following strategy.
The plaintext modulus $p$ is a prime number such that SIMD slots are isomorphic to a finite field.
Next, we choose the order $m$ of $\intring$ with large enough $n$ to support our homomorphic algorithms ($n > 12000$).
The order of $p$ modulo $m$ should be as small as possible, which maximizes the number of SIMD slots, thus reducing the amortized running time of our algorithms.
In addition, $m$ is chosen to be a prime number or a product of a few primes.
This constraint makes sure that the slot permutation group is cyclic or a product of a few cyclic groups, which results in a better performance (for more details, see \cite[Appendix C.3]{GHS12}).

Every input integer is encoded into exactly one ciphertext.
First, it is decomposed into a vector of $l$ digits over $\F_p^d$ (see Section~\ref{sec:comparison_of_large_integers}).
Then each digit embedded into one SIMD slot.
Thus, each ciphertext encrypts exactly $k = \ell/l$ integers.

Note that although our algorithms save some homomorphic multiplications as compared to \cite{TLWRK20}, the depth of the circuits remains unchanged. Since the ciphertext size depends mainly on the depth of the circuit one wants to evaluate and the desired level of security, we obtain similar bandwidth requirements than previous works.

To compare our algorithms with the state of the art, we ran the lexicographic order algorithm ($\LT$) to compute the less-than function on 64-bit integers.
The results of these experiments are presented in Table~\ref{table:comparison_circuit_results}.
In addition, we ran the direct sorting and the array minimum algorithms from Section~\ref{sec:applications}; see Tables~\ref{table:sorting_circuit_results} and~\ref{table:minimum_circuit_results}, respectively.

We ran our algorithms with $p \in [3,659]$.
However, Table~\ref{table:comparison_circuit_results} contains the best results for small $p$'s, where the bivariate and the univariate comparison circuits have a comparable running time.
Table~\ref{table:univariate_circuit_results} contains the results with the best observed amortized running time.
For the sorting and the array minimum applications (Tables~\ref{table:sorting_circuit_results} and~\ref{table:minimum_circuit_results}), we showed only the results with $p$ and $m$ supporting reasonable security levels and giving the best running time for arrays of length $N=64$.

\ifeprint
\begin{table}[h!]
  \centering
  \begin{tabular*}{\textwidth}{@{\extracolsep{\fill} } p{2.5cm} p{1.0cm} p{1.0cm} p{1.0cm} p{0.9cm} p{0.9cm} p{1.5cm} p{2.5cm}}
    \toprule
    $(p,m,n)$ & Type & $(d,l)$   &  $\log_2 q$ & $\lambda$    & $k$ & Total time, s & Amortized time per integer, ms \\
    \cmidrule(lr){1-1}\cmidrule(lr){2-8}
    %$(3,34511,34510)$  & \cite{TLWRK20}  & $(1,41)$  & $>320$ & $49$   & 7.10   & 145 \\
    %$(3,34511,34510)$  & \cite{TLWRK20}  & $(2,21)$  & $>320$ & $96$   & 14.80  & 154 \\
    %$(3,34511,34510)$  & \cite{TLWRK20}  & $(4,11)$  & $>320$ & $184$  & 20.60  & 112 \\
    %$(3,34511,34510)$  & \cite{TLWRK20}  & $(5,9)$   & $>320$ & $225$  & 23.67  & 105 \\
    \multirow{3}{*}{$(3,34511,34510)$}  & \cite{TLWRK20}  & $(6,7)$   & $324$ & $298$ & $290$  & 26.24  & 90 \\
    %$(3,34511,34510)$  & \cite{TLWRK20}  & $(11,4)$  & $>380$ & $507$  & 48.25  & 95 \\
    %$(3,34511,34510)$  & B               & $(1,41)$  & $>320$ & $49$   & 6.36   & 130 \\
    %$(3,34511,34510)$  & B               & $(2,21)$  & $>310$ & $96$   & 12.33  & 128 \\
    %$(3,34511,34510)$  & B               & $(4,11)$  & $>310$ & $184$  & 16.69  & 91 \\
    %$(3,34511,34510)$  & B               & $(5,9)$   & $>320$ & $225$  & 18.57  & 83 \\
    %$(3,34511,34510)$  & B               & $(6,7)$   & $>310$ & $290$  & 20.51  & 71 \\
      & B               & $(6,7)$   & $324$ & $298$ & $290$  & 20.17  & 70 \\
    %$(3,34511,34510)$  & B               & $(11,4)$  & $385$ & $226$ & $507$  & 35.45  & 70 \\
    %$(3,34511,34510)$  & U               & $(1,64)$  & $>320$ & $31$   & 5.18   & 167 \\
    %$(3,34511,34510)$  & U               & $(2,32)$  & $>310$ & $63$   & 7.84   & 124 \\
    %$(3,34511,34510)$  & U               & $(4,16)$  & $>310$ & $126$  & 10.11  & 80 \\
    %$(3,34511,34510)$  & U               & $(8,8)$   & $>360$ & $253$  & 16.43  & 65 \\
      & U               & $(16,4)$  & $472$ & $189$ & $507$  & 28.45  & 56 \\
    \cmidrule(lr){1-1}\cmidrule(lr){2-8}
    %$(5,19531,19530)$  & \cite{TLWRK20}  & $(1,28)$  & $>290$ & $99$   & 4.68   & 47 \\
    %$(5,19531,19530)$  & \cite{TLWRK20}  & $(4,7)$   & $>295$ & $398$  & 14.33  & 36 \\
    \multirow{3}{*}{$(5,19531,19530)$}  & \cite{TLWRK20}  & $(7,4)$   & $324$ & $155$ & $697$  & 24.97  & 36 \\
    %$(5,19531,19530)$  & B               & $(1,28)$  & $>290$ & $99$   & 3.09   & 31 \\
    %$(5,19531,19530)$  & B               & $(2,14)$  & $>290$ & $199$  & 5.72   & 29 \\
    %$(5,19531,19530)$  & B               & $(4,7)$   & $>295$ & $398$  & 8.98   & 23 \\
      & B               & $(7,4)$   & $324$ & $155$ & $697$  & 14.50  & 21 \\
    %$(5,19531,19530)$  & U               & $(1,41)$  & $>330$ & $68$   & 3.04   & 45 \\
    %$(5,19531,19530)$  & U               & $(2,21)$  & $>330$ & $132$  & 4.38   & 33 \\
    %$(5,19531,19530)$  & U               & $(3,14)$  & $>320$ & $199$  & 5.17   & 26 \\
    %$(5,19531,19530)$  & U               & $(4,11)$  & $>320$ & $253$  & 6.11   & 24 \\
    %$(5,19531,19530)$  & U               & $(6,7)$   & $>340$ & $398$  & 8.71   & 22 \\
      & U               & $(7,6)$   & $354$ & $141$ & $465$  & 9.89  & 21 \\
    \cmidrule(lr){1-1}\cmidrule(lr){2-8}
    %$(7,14009,14008)$  & U               & $(1,32)$  & $>330$ & $25$   & 1.88   & 75 \\
    %$(7,14009,14008)$  & U               & $(2,16)$  & $>330$ & $51$   & 3.69   & 72 \\
    %$(7,14009,14008)$  & U               & $(4,8)$   & $>310$ & $103$  & 5.21   & 51 \\
    %$(7,14009,14008)$  & U               & $(8,4)$   & $342$ & $102$ & $206$  & 9.11   & 44 \\
    %$(7,14009,14008)$  & B               & $(1,23)$  & $>330$ & $35$   & 1.88   & 54 \\
    %$(7,14009,14008)$  & B               & $(2,12)$  & $>330$ & $68$   & 3.67   & 54 \\
    %$(7,14009,14008)$  & B               & $(4,6)$   & $>320$ & $137$  & 5.34   & 39 \\
    %$(7,14009,14008)$  & B               & $(6,4)$   & $>310$ & $206$  & 6.91   & 34 \\
    %$(7,14009,14008)$  & B               & $(8,3)$   & $354$  & ?  & $274$ & ?19.30   & ?71 \\
    %$(7,14009,14008)$  & \cite{TLWRK20}  & $(6,4)$   & $324$  & $206$  & ? & ?26.24   & ?128 \\
    %$(7,14009,14008)$  & \cite{TLWRK20}  & $(8,3)$   & $354$  & ?  & $274$ & ?32.30   & ?118 \\
    %$(7,14009,14008)$  & \cite{TLWRK20}  & $(12,2)$  & $384$  & $412$  & ? & ?50.93   & ?124 \\
    \multirow{3}{*}{$(7,20197,19116)$}  & \cite{TLWRK20}  & $(6,4)$   & $354$ & $137$ & $531$  & 37.50  & 71 \\
    %$(7,20197,19116)$  & B               & $(1,23)$  & $>350$ & $92$   & 6.55   & 71 \\
    %$(7,20197,19116)$  & B               & $(2,12)$  & $>320$ & $177$  & 10.11  & 57 \\
    %$(7,20197,19116)$  & B               & $(3,8)$   & $>320$ & $265$  & 12.33  & 47 \\
    %$(7,20197,19116)$  & B               & $(4,6)$   & $>320$ & $354$  & 15.37  & 43 \\
      & B               & $(6,4)$   & $354$ & $137$ & $531$  & 21.35  & 40 \\
    %$(7,20197,19116)$  & B               & $(8,3)$   & $>380$ & $708$  & 29.67  & 42 \\
    %$(7,20197,19116)$  & U               & $(1,32)$  & $>350$ & $66$   & 5.22   & 79 \\
    %$(7,20197,19116)$  & U               & $(2,16)$  & $>350$ & $132$  & 6.81   & 52 \\
    %$(7,20197,19116)$  & U               & $(4,8)$   & $>350$ & $265$  & 9.27   & 35 \\
      & U               & $(8,4)$   & $406$ & $110$ & $531$  & 16.53  & 31 \\

    \cmidrule(lr){1-1}\cmidrule(lr){2-8}
    %$(11,15797,15796)$ & \cite{TLWRK20}  & $(1,19)$   & $360$  & ? & $75$  & 8.25  & 110 \\
    %$(11,15797,15796)$ & \cite{TLWRK20}  & $(2,10)$   & $360$  & ? & $143$ & 16.96 & 119 \\
    %$(11,15797,15796)$ & \cite{TLWRK20}  & $(4,5)$    & $360$  & ? & $287$ & 29.29 & 103 \\
    \multirow{3}{*}{$(11,15797,15796)$} & \cite{TLWRK20}  & $(5,4)$    & $342$  & $162$ & $359$ & 35.20 & 99 \\
    %$(11,15797,15796)$ & \cite{TLWRK20}  & $(10,2)$   & $378$  & ? & $718$ & 76.39 & 107 \\

     & B               & $(5,4)$    & $342$  & $162$ & $359$ & 22.76 & 64 \\

    %$(11,15797,15796)$ & U               & $(1,25)$  & $378$ & ?     & $57$   & ?2.94   & ?52 \\
    %$(11,15797,15796)$ & U               & $(2,13)$  & $354$ & ?     & $110$  & ?4.62   & ?42 \\
    %$(11,15797,15796)$ & U               & $(3,9)$   & $378$ & ?     & $159$  & ?6.72   & ?43 \\
    %$(11,15797,15796)$ & U               & $(4,7)$   & $354$ & ?     & $205$  & ?7.62   & ?38 \\
     & U               & $(5,5)$   & $378$ & $145$     & $287$  & 9.79   & 35 \\
    %$(11,15797,15796)$ & U               & $(7,4)$   & $385$ & ?     & $359$  & ?12.72  & ?36 \\
    %$(11,15797,15796)$ & U               & $(9,3)$   & $>410$ & $478$  & ?  & ? \\

    \cmidrule(lr){1-1}\cmidrule(lr){2-8}
    %$(11,21963,14640)$ & U               & $(1,25)$  & $>360$ & $73$   & 4.59   & 63 \\
    %$(11,21963,14640)$ & U               & $(2,13)$  & $>360$ & $140$  & 6.64   & 47 \\
    %$(11,21963,14640)$ & U               & $(3,9)$   & $>360$ & $203$  & 8.70   & 43 \\
    %$(11,21963,14640)$ & U               & $(4,7)$   & $>350$ & $261$  & 9.67   & 37 \\
    %$(11,21963,14640)$ & U               & $(5,5)$   & $>360$ & $366$  & 12.43  & 34 \\

    %$(11,21963,14640)$ & \cite{TLWRK20}  & $(5,4)$    & $354$  & ? & $457$ & 47.84 & 105 \\

    %$(13,30941,30940)$ & \cite{TLWRK20}   & $(4,5)$   & $378$   & ? & $1237$ & 73.22 & 60 \\
    \multirow{3}{*}{$(13,30941,30940)$} & \cite{TLWRK20}   & $(5,4)$   & $354$   & $338$ & $1547$ & 82.02 & 54 \\

     & B                & $(5,4)$   & $354$   & $338$ & $1547$ & 54.05 & 35 \\

    %$(13,30941,30940)$ & U                & $(1,23)$  & $378$   & ? & $269$  & ?6.17  & ?23 \\
    %$(13,30941,30940)$ & U                & $(2,12)$  & $378$   & ? & $515$  & ?9.80  & ?20 \\
     & U                & $(4,6)$   & $378$   & $313$ & $1031$ & 15.56 & 16 \\
    %$(13,30941,30940)$ & U                & $(5,5)$   & $385$   & ? & $1237$ & ?18.96 & ?16 \\

    \cmidrule(lr){1-1}\cmidrule(lr){2-8}
    %$(17,41761,41760)$ & \cite{TLWRK20}   & $(1,16)$   & $486$   & ? & $326$  & ?39.95 & ?123 \\
    %$(17,41761,41760)$ & \cite{TLWRK20}   & $(2,8)$    & $456$   & ? & $652$  & ?73.75  & ?114 \\
    \multirow{3}{*}{$(17,41761,41760)$} & \cite{TLWRK20}   & $(4,4)$    & $413$   & $402$ & $1305$ & 130.81 & 101 \\
    %$(17,41761,41760)$ & \cite{TLWRK20}   & $(8,2)$    & $432$   & ? & $2610$ & ?276.25 & ?106 \\

     & B                & $(4,4)$    & $413$   & $402$ & $1305$ & 91.14  & 70 \\

    %$(17,41761,41760)$ & U                & $(2,11)$   & $521$   & ? & $474$ & ?21.70 & ?46 \\
    %$(17,41761,41760)$ & U                & $(3,7)$    & $472$   & ? & $745$  & ?23.55 & ?32 \\
    %$(17,41761,41760)$ & U                & $(6,4)$    & $472$   & ? & $1305$ & ?39.96 & ?31 \\
     & U                & $(7,3)$    & $472$   & $344$ & $1740$ & 45.29 & 27 \\

    \cmidrule(lr){1-1}\cmidrule(lr){2-8}
    %$(19,29989,29988)$ & \cite{TLWRK20}   & $(1,16)$   & $373$   & ? & $208$  & ?25.96  & ?125 \\
    %$(19,29989,29988)$ & \cite{TLWRK20}   & $(2,8)$    & $373$   & ? & $416$  & ?55.49  & ?134 \\
    \multirow{3}{*}{$(19,29989,29988)$} & \cite{TLWRK20}   & $(4,4)$    & $378$   & $302$ & $833$  & 101.75 & 123 \\
    %$(19,29989,29988)$ & \cite{TLWRK20}   & $(8,2)$    & $413$   & ? & $1666$  & ?205.44 & ?124 \\

    & B                 & $(4,4)$    & $378$   & $302$ & $833$  & 69.92 & 84 \\

    & U                 & $(5,4)$    & $385$   & $296$ & $833$  & 20.76 & 25 \\
    %& U                 & $(7,3)$    & $440$   & ? & $1110$  & ?32.44 & ?30 \\

    \cmidrule(lr){1-1}\cmidrule(lr){2-8}
    %\multirow{3}{*}{$(23,37745,30192)$} & \cite{TLWRK20}   & $(1,15)$    & $385$   & ? & $167$  & ?38.61 & ?232 \\
    %\multirow{3}{*}{$(23,37745,30192)$} & \cite{TLWRK20}   & $(2,8)$     & $385$   & ? & $314$  & ?82.38 & ?263 \\
    %\multirow{3}{*}{$(23,37745,30192)$} & \cite{TLWRK20}   & $(3,5)$     & $385$   & ? & $503$  & ?120.37 & ?240 \\
    \multirow{3}{*}{$(23,37745,30192)$} & \cite{TLWRK20}   & $(5,3)$     & $413$   & $275$ & $838$  & 194.41 & 232 \\
    %\multirow{3}{*}{$(23,37745,30192)$} & \cite{TLWRK20}   & $(8,2)$     & $431$   & ? & $1258$  & ?329.64 & ?263 \\

    & B                 & $(5,3)$    & $413$   & $275$ & $838$  & 135.40 & 162 \\

    %& U                 & $(3,6)$    & $431$   & ? & $419$  & ?25.77 & ?62 \\
    %& U                 & $(5,4)$    & $431$   & ? & $629$  & ?37.90 & ?61 \\
    %& U                 & $(6,3)$    & $431$   & ? & $838$   & ?39.26 & ?47 \\
    & U                 & $(9,2)$    & $456$   & $245$ & $1258$  & 56.49 & 45 \\

    \cmidrule(lr){1-1}\cmidrule(lr){2-8}
    %\multirow{3}{*}{$(29,18157,17820)$} & \cite{TLWRK20}   & $(1,14)$    & $378$   & ? & $212$  & ?25.96 & ?123 \\
    %\multirow{3}{*}{$(29,18157,17820)$} & \cite{TLWRK20}   & $(2,7)$    & $378$   & ? & $424$  & ?50.09 & ?119 \\
    %\multirow{3}{*}{$(29,18157,17820)$} & \cite{TLWRK20}   & $(3,5)$    & $378$   & ? & $594$  & ?74.92 & ?127 \\
    %\multirow{3}{*}{$(29,18157,17820)$} & \cite{TLWRK20}   & $(4,4)$    & $378$   & ? & $742$  & ?98.71 & ?134 \\
    \multirow{3}{*}{$(29,18157,17820)$} & \cite{TLWRK20}   & $(5,3)$    & $360$   & $175$ & $990$  & 103.28 & 105 \\

    & B                 & $(5,3)$    & $360$   & $175$ & $990$  & 70.82 & 72 \\

    %& U                 & $(5,4)$    & $413$   & ? & $742$   & ?23.28 & ?24 \\
    & U                 & $(6,3)$    & $413$   & $150$ & $990$   & 19.98 & 21 \\

    \cmidrule(lr){1-1}\cmidrule(lr){2-8}
    %\multirow{3}{*}{$(31,52053,34700)$} & \cite{TLWRK20}   & $(1,13)$    & $559$   & ? & $533$  & ?104.26 & ?196 \\
    %\multirow{3}{*}{$(31,52053,34700)$} & \cite{TLWRK20}   & $(2,7)$     & $522$   & ? & $991$  & ?179.53 & ?182 \\
    %\multirow{3}{*}{$(31,52053,34700)$} & \cite{TLWRK20}   & $(3,5)$     & $522$   & ? & $1388$  & ?271.72 & ?196 \\
    \multirow{3}{*}{$(31,52053,34700)$} & \cite{TLWRK20}   & $(5,3)$     & $512$   & $252$ & $2313$  & 437.11 & 189 \\

    & B                 & $(5,3)$     & $512$   & $252$ & $2313$  & 293.27 & 127 \\

    & U                 & $(4,4)$     & $512$   & $252$ & $1735$  & 46.58 & 27 \\
    \bottomrule
  \end{tabular*}
  \caption{\textbf{Less-than function via different methods.} The running time of our lexicographic order algorithms and the algorithm of Tan et al.~\cite{TLWRK20} to compare 64-bit integers with encryption parameters supporting $\lambda$ bits of security. The second column (Type) indicates which comparison circuit is used: the univariate (U), bivariate from this work (B) or bivariate one from~\cite{TLWRK20}. The total time is averaged over 50 trials.}
  \label{table:comparison_circuit_results}
\end{table}
\else
\begin{table*}[h]
  \centering
  \begin{tabular*}{.9\textwidth}{@{\extracolsep{\fill} } p{3.0cm} p{0.5cm} p{1.0cm} p{1.0cm} p{1.0cm} p{1.0cm} p{2.0cm} p{2.0cm}}
    \toprule
    $(p,m,n)$ & Type & $(d,l)$   &  $\log_2 q$ & $\lambda$    & $k$ & Total time, s & Amortized time per integer, ms \\
    \cmidrule(lr){1-1}\cmidrule(lr){2-8}
    %$(3,34511,34510)$  & \cite{TLWRK20}  & $(1,41)$  & $>320$ & $49$   & 7.10   & 145 \\
    %$(3,34511,34510)$  & \cite{TLWRK20}  & $(2,21)$  & $>320$ & $96$   & 14.80  & 154 \\
    %$(3,34511,34510)$  & \cite{TLWRK20}  & $(4,11)$  & $>320$ & $184$  & 20.60  & 112 \\
    %$(3,34511,34510)$  & \cite{TLWRK20}  & $(5,9)$   & $>320$ & $225$  & 23.67  & 105 \\
    \multirow{3}{*}{$(3,34511,34510)$}  & \cite{TLWRK20}  & $(6,7)$   & $324$ & $298$ & $290$  & 26.24  & 90 \\
    %$(3,34511,34510)$  & \cite{TLWRK20}  & $(11,4)$  & $>380$ & $507$  & 48.25  & 95 \\
    %$(3,34511,34510)$  & B               & $(1,41)$  & $>320$ & $49$   & 6.36   & 130 \\
    %$(3,34511,34510)$  & B               & $(2,21)$  & $>310$ & $96$   & 12.33  & 128 \\
    %$(3,34511,34510)$  & B               & $(4,11)$  & $>310$ & $184$  & 16.69  & 91 \\
    %$(3,34511,34510)$  & B               & $(5,9)$   & $>320$ & $225$  & 18.57  & 83 \\
    %$(3,34511,34510)$  & B               & $(6,7)$   & $>310$ & $290$  & 20.51  & 71 \\
      & B               & $(6,7)$   & $324$ & $298$ & $290$  & 20.17  & 70 \\
    %$(3,34511,34510)$  & B               & $(11,4)$  & $385$ & $226$ & $507$  & 35.45  & 70 \\
    %$(3,34511,34510)$  & U               & $(1,64)$  & $>320$ & $31$   & 5.18   & 167 \\
    %$(3,34511,34510)$  & U               & $(2,32)$  & $>310$ & $63$   & 7.84   & 124 \\
    %$(3,34511,34510)$  & U               & $(4,16)$  & $>310$ & $126$  & 10.11  & 80 \\
    %$(3,34511,34510)$  & U               & $(8,8)$   & $>360$ & $253$  & 16.43  & 65 \\
      & U               & $(16,4)$  & $472$ & $189$ & $507$  & 28.45  & 56 \\
    \cmidrule(lr){1-1}\cmidrule(lr){2-8}
    %$(5,19531,19530)$  & \cite{TLWRK20}  & $(1,28)$  & $>290$ & $99$   & 4.68   & 47 \\
    %$(5,19531,19530)$  & \cite{TLWRK20}  & $(4,7)$   & $>295$ & $398$  & 14.33  & 36 \\
    \multirow{3}{*}{$(5,19531,19530)$}  & \cite{TLWRK20}  & $(7,4)$   & $324$ & $155$ & $697$  & 24.97  & 36 \\
    %$(5,19531,19530)$  & B               & $(1,28)$  & $>290$ & $99$   & 3.09   & 31 \\
    %$(5,19531,19530)$  & B               & $(2,14)$  & $>290$ & $199$  & 5.72   & 29 \\
    %$(5,19531,19530)$  & B               & $(4,7)$   & $>295$ & $398$  & 8.98   & 23 \\
      & B               & $(7,4)$   & $324$ & $155$ & $697$  & 14.50  & 21 \\
    %$(5,19531,19530)$  & U               & $(1,41)$  & $>330$ & $68$   & 3.04   & 45 \\
    %$(5,19531,19530)$  & U               & $(2,21)$  & $>330$ & $132$  & 4.38   & 33 \\
    %$(5,19531,19530)$  & U               & $(3,14)$  & $>320$ & $199$  & 5.17   & 26 \\
    %$(5,19531,19530)$  & U               & $(4,11)$  & $>320$ & $253$  & 6.11   & 24 \\
    %$(5,19531,19530)$  & U               & $(6,7)$   & $>340$ & $398$  & 8.71   & 22 \\
      & U               & $(7,6)$   & $354$ & $141$ & $465$  & 9.89  & 21 \\
    \cmidrule(lr){1-1}\cmidrule(lr){2-8}
    %$(7,14009,14008)$  & U               & $(1,32)$  & $>330$ & $25$   & 1.88   & 75 \\
    %$(7,14009,14008)$  & U               & $(2,16)$  & $>330$ & $51$   & 3.69   & 72 \\
    %$(7,14009,14008)$  & U               & $(4,8)$   & $>310$ & $103$  & 5.21   & 51 \\
    %$(7,14009,14008)$  & U               & $(8,4)$   & $342$ & $102$ & $206$  & 9.11   & 44 \\
    %$(7,14009,14008)$  & B               & $(1,23)$  & $>330$ & $35$   & 1.88   & 54 \\
    %$(7,14009,14008)$  & B               & $(2,12)$  & $>330$ & $68$   & 3.67   & 54 \\
    %$(7,14009,14008)$  & B               & $(4,6)$   & $>320$ & $137$  & 5.34   & 39 \\
    %$(7,14009,14008)$  & B               & $(6,4)$   & $>310$ & $206$  & 6.91   & 34 \\
    %$(7,14009,14008)$  & B               & $(8,3)$   & $354$  & ?  & $274$ & ?19.30   & ?71 \\
    %$(7,14009,14008)$  & \cite{TLWRK20}  & $(6,4)$   & $324$  & $206$  & ? & ?26.24   & ?128 \\
    %$(7,14009,14008)$  & \cite{TLWRK20}  & $(8,3)$   & $354$  & ?  & $274$ & ?32.30   & ?118 \\
    %$(7,14009,14008)$  & \cite{TLWRK20}  & $(12,2)$  & $384$  & $412$  & ? & ?50.93   & ?124 \\
    \multirow{3}{*}{$(7,20197,19116)$}  & \cite{TLWRK20}  & $(6,4)$   & $354$ & $137$ & $531$  & 37.50  & 71 \\
    %$(7,20197,19116)$  & B               & $(1,23)$  & $>350$ & $92$   & 6.55   & 71 \\
    %$(7,20197,19116)$  & B               & $(2,12)$  & $>320$ & $177$  & 10.11  & 57 \\
    %$(7,20197,19116)$  & B               & $(3,8)$   & $>320$ & $265$  & 12.33  & 47 \\
    %$(7,20197,19116)$  & B               & $(4,6)$   & $>320$ & $354$  & 15.37  & 43 \\
      & B               & $(6,4)$   & $354$ & $137$ & $531$  & 21.35  & 40 \\
    %$(7,20197,19116)$  & B               & $(8,3)$   & $>380$ & $708$  & 29.67  & 42 \\
    %$(7,20197,19116)$  & U               & $(1,32)$  & $>350$ & $66$   & 5.22   & 79 \\
    %$(7,20197,19116)$  & U               & $(2,16)$  & $>350$ & $132$  & 6.81   & 52 \\
    %$(7,20197,19116)$  & U               & $(4,8)$   & $>350$ & $265$  & 9.27   & 35 \\
      & U               & $(8,4)$   & $406$ & $110$ & $531$  & 16.53  & 31 \\

    \cmidrule(lr){1-1}\cmidrule(lr){2-8}
    %$(11,15797,15796)$ & \cite{TLWRK20}  & $(1,19)$   & $360$  & ? & $75$  & 8.25  & 110 \\
    %$(11,15797,15796)$ & \cite{TLWRK20}  & $(2,10)$   & $360$  & ? & $143$ & 16.96 & 119 \\
    %$(11,15797,15796)$ & \cite{TLWRK20}  & $(4,5)$    & $360$  & ? & $287$ & 29.29 & 103 \\
    \multirow{3}{*}{$(11,15797,15796)$} & \cite{TLWRK20}  & $(5,4)$    & $342$  & $162$ & $359$ & 35.20 & 99 \\
    %$(11,15797,15796)$ & \cite{TLWRK20}  & $(10,2)$   & $378$  & ? & $718$ & 76.39 & 107 \\

     & B               & $(5,4)$    & $342$  & $162$ & $359$ & 22.76 & 64 \\

    %$(11,15797,15796)$ & U               & $(1,25)$  & $378$ & ?     & $57$   & ?2.94   & ?52 \\
    %$(11,15797,15796)$ & U               & $(2,13)$  & $354$ & ?     & $110$  & ?4.62   & ?42 \\
    %$(11,15797,15796)$ & U               & $(3,9)$   & $378$ & ?     & $159$  & ?6.72   & ?43 \\
    %$(11,15797,15796)$ & U               & $(4,7)$   & $354$ & ?     & $205$  & ?7.62   & ?38 \\
     & U               & $(5,5)$   & $378$ & $145$     & $287$  & 9.79   & 35 \\
    %$(11,15797,15796)$ & U               & $(7,4)$   & $385$ & ?     & $359$  & ?12.72  & ?36 \\
    %$(11,15797,15796)$ & U               & $(9,3)$   & $>410$ & $478$  & ?  & ? \\

    \cmidrule(lr){1-1}\cmidrule(lr){2-8}
    %$(11,21963,14640)$ & U               & $(1,25)$  & $>360$ & $73$   & 4.59   & 63 \\
    %$(11,21963,14640)$ & U               & $(2,13)$  & $>360$ & $140$  & 6.64   & 47 \\
    %$(11,21963,14640)$ & U               & $(3,9)$   & $>360$ & $203$  & 8.70   & 43 \\
    %$(11,21963,14640)$ & U               & $(4,7)$   & $>350$ & $261$  & 9.67   & 37 \\
    %$(11,21963,14640)$ & U               & $(5,5)$   & $>360$ & $366$  & 12.43  & 34 \\

    %$(11,21963,14640)$ & \cite{TLWRK20}  & $(5,4)$    & $354$  & ? & $457$ & 47.84 & 105 \\

    %$(13,30941,30940)$ & \cite{TLWRK20}   & $(4,5)$   & $378$   & ? & $1237$ & 73.22 & 60 \\
    \multirow{3}{*}{$(13,30941,30940)$} & \cite{TLWRK20}   & $(5,4)$   & $354$   & $338$ & $1547$ & 82.02 & 54 \\

     & B                & $(5,4)$   & $354$   & $338$ & $1547$ & 54.05 & 35 \\

    %$(13,30941,30940)$ & U                & $(1,23)$  & $378$   & ? & $269$  & ?6.17  & ?23 \\
    %$(13,30941,30940)$ & U                & $(2,12)$  & $378$   & ? & $515$  & ?9.80  & ?20 \\
     & U                & $(4,6)$   & $378$   & $313$ & $1031$ & 15.56 & 16 \\
    %$(13,30941,30940)$ & U                & $(5,5)$   & $385$   & ? & $1237$ & ?18.96 & ?16 \\

    \cmidrule(lr){1-1}\cmidrule(lr){2-8}
    %$(17,41761,41760)$ & \cite{TLWRK20}   & $(1,16)$   & $486$   & ? & $326$  & ?39.95 & ?123 \\
    %$(17,41761,41760)$ & \cite{TLWRK20}   & $(2,8)$    & $456$   & ? & $652$  & ?73.75  & ?114 \\
    \multirow{3}{*}{$(17,41761,41760)$} & \cite{TLWRK20}   & $(4,4)$    & $413$   & $402$ & $1305$ & 130.81 & 101 \\
    %$(17,41761,41760)$ & \cite{TLWRK20}   & $(8,2)$    & $432$   & ? & $2610$ & ?276.25 & ?106 \\

     & B                & $(4,4)$    & $413$   & $402$ & $1305$ & 91.14  & 70 \\

    %$(17,41761,41760)$ & U                & $(2,11)$   & $521$   & ? & $474$ & ?21.70 & ?46 \\
    %$(17,41761,41760)$ & U                & $(3,7)$    & $472$   & ? & $745$  & ?23.55 & ?32 \\
    %$(17,41761,41760)$ & U                & $(6,4)$    & $472$   & ? & $1305$ & ?39.96 & ?31 \\
     & U                & $(7,3)$    & $472$   & $344$ & $1740$ & 45.29 & 27 \\

    \cmidrule(lr){1-1}\cmidrule(lr){2-8}
    %$(19,29989,29988)$ & \cite{TLWRK20}   & $(1,16)$   & $373$   & ? & $208$  & ?25.96  & ?125 \\
    %$(19,29989,29988)$ & \cite{TLWRK20}   & $(2,8)$    & $373$   & ? & $416$  & ?55.49  & ?134 \\
    \multirow{3}{*}{$(19,29989,29988)$} & \cite{TLWRK20}   & $(4,4)$    & $378$   & $302$ & $833$  & 101.75 & 123 \\
    %$(19,29989,29988)$ & \cite{TLWRK20}   & $(8,2)$    & $413$   & ? & $1666$  & ?205.44 & ?124 \\

    & B                 & $(4,4)$    & $378$   & $302$ & $833$  & 69.92 & 84 \\

    & U                 & $(5,4)$    & $385$   & $296$ & $833$  & 20.76 & 25 \\
    %& U                 & $(7,3)$    & $440$   & ? & $1110$  & ?32.44 & ?30 \\

    \cmidrule(lr){1-1}\cmidrule(lr){2-8}
    %\multirow{3}{*}{$(23,37745,30192)$} & \cite{TLWRK20}   & $(1,15)$    & $385$   & ? & $167$  & ?38.61 & ?232 \\
    %\multirow{3}{*}{$(23,37745,30192)$} & \cite{TLWRK20}   & $(2,8)$     & $385$   & ? & $314$  & ?82.38 & ?263 \\
    %\multirow{3}{*}{$(23,37745,30192)$} & \cite{TLWRK20}   & $(3,5)$     & $385$   & ? & $503$  & ?120.37 & ?240 \\
    \multirow{3}{*}{$(23,37745,30192)$} & \cite{TLWRK20}   & $(5,3)$     & $413$   & $275$ & $838$  & 194.41 & 232 \\
    %\multirow{3}{*}{$(23,37745,30192)$} & \cite{TLWRK20}   & $(8,2)$     & $431$   & ? & $1258$  & ?329.64 & ?263 \\

    & B                 & $(5,3)$    & $413$   & $275$ & $838$  & 135.40 & 162 \\

    %& U                 & $(3,6)$    & $431$   & ? & $419$  & ?25.77 & ?62 \\
    %& U                 & $(5,4)$    & $431$   & ? & $629$  & ?37.90 & ?61 \\
    %& U                 & $(6,3)$    & $431$   & ? & $838$   & ?39.26 & ?47 \\
    & U                 & $(9,2)$    & $456$   & $245$ & $1258$  & 56.49 & 45 \\

    \cmidrule(lr){1-1}\cmidrule(lr){2-8}
    %\multirow{3}{*}{$(29,18157,17820)$} & \cite{TLWRK20}   & $(1,14)$    & $378$   & ? & $212$  & ?25.96 & ?123 \\
    %\multirow{3}{*}{$(29,18157,17820)$} & \cite{TLWRK20}   & $(2,7)$    & $378$   & ? & $424$  & ?50.09 & ?119 \\
    %\multirow{3}{*}{$(29,18157,17820)$} & \cite{TLWRK20}   & $(3,5)$    & $378$   & ? & $594$  & ?74.92 & ?127 \\
    %\multirow{3}{*}{$(29,18157,17820)$} & \cite{TLWRK20}   & $(4,4)$    & $378$   & ? & $742$  & ?98.71 & ?134 \\
    \multirow{3}{*}{$(29,18157,17820)$} & \cite{TLWRK20}   & $(5,3)$    & $360$   & $175$ & $990$  & 103.28 & 105 \\

    & B                 & $(5,3)$    & $360$   & $175$ & $990$  & 70.82 & 72 \\

    %& U                 & $(5,4)$    & $413$   & ? & $742$   & ?23.28 & ?24 \\
    & U                 & $(6,3)$    & $413$   & $150$ & $990$   & 19.98 & 21 \\

    \cmidrule(lr){1-1}\cmidrule(lr){2-8}
    %\multirow{3}{*}{$(31,52053,34700)$} & \cite{TLWRK20}   & $(1,13)$    & $559$   & ? & $533$  & ?104.26 & ?196 \\
    %\multirow{3}{*}{$(31,52053,34700)$} & \cite{TLWRK20}   & $(2,7)$     & $522$   & ? & $991$  & ?179.53 & ?182 \\
    %\multirow{3}{*}{$(31,52053,34700)$} & \cite{TLWRK20}   & $(3,5)$     & $522$   & ? & $1388$  & ?271.72 & ?196 \\
    \multirow{3}{*}{$(31,52053,34700)$} & \cite{TLWRK20}   & $(5,3)$     & $512$   & $252$ & $2313$  & 437.11 & 189 \\

    & B                 & $(5,3)$     & $512$   & $252$ & $2313$  & 293.27 & 127 \\

    & U                 & $(4,4)$     & $512$   & $252$ & $1735$  & 46.58 & 27 \\
    \bottomrule
  \end{tabular*}
  \caption{\textbf{Less-than function via different methods.} The running time of our lexicographic order algorithms and the algorithm of Tan et al.~\cite{TLWRK20} to compare 64-bit integers with encryption parameters supporting $\lambda$ bits of security. The second column (Type) indicates which comparison circuit is used: the univariate (U), bivariate from this work (B) or bivariate one from~\cite{TLWRK20}. The total time is averaged over 50 trials.}
  \label{table:comparison_circuit_results}
\end{table*}
\fi

\ifeprint
\begin{table}[h!]
  \centering
  \begin{tabular*}{\textwidth}{@{\extracolsep{\fill} } p{3.0cm} p{1.0cm} p{1.0cm} p{1.0cm} p{1.0cm} p{2.0cm} p{2.5cm}}
    \toprule
    $(p,m,n)$ & $(d,l)$   &  $\log_2 q$ & $\lambda$    & $k$ & Total time, s & Amortized time per integer, ms \\
    \cmidrule(lr){1-1}\cmidrule(lr){2-7}
    %$(67,26881,26880)$ & U               & $(1,13)$  & $>460$ & $413$  & 8.21   & 20 \\
    %$(67,26881,26880)$ & U               & $(2,7)$   & $>460$ & $768$  & 14.57  & 19 \\
    %$(67,26881,26880)$ & U               & $(4,4)$   & $>460$ & $1344$ & 26.63  & 20 \\
    %$(67,26881,26880)$ & U               & $(5,3)$   & $>480$ & $1792$ & 35.37  & 19 \\

    %$(109,24061,24060)$ & U              & $(1,12)$  & $>480$ & $401$  & 8.99   & 22 \\
    %$(109,24061,24060)$ & U              & $(2,6)$   & $>460$ & $802$  & 16.11  & 20 \\
    %$(109,24061,24060)$ & U              & $(3,4)$   & $>440$ & $1203$ & 21.22  & 18 \\
    %$(109,24061,24060)$ & U              & $(4,3)$   & $>440$ & $1604$ & 29.89  & 19 \\

    %$(131,17293,17292)$ & U              & $(1,11)$  & $>465$ & $524$  & 6.57   & 13 \\
    %$(131,17293,17292)$ & U              & $(2,6)$   & $>465$ & $960$  & 11.81  & 12 \\
    $(131,17293,17292)$               & $(3,4)$   & $431$ & $96$ & $1441$ & 16.07  & 11 \\

    %$(167,28057,28056)$ & U              & $(1,11)$  & $>520$ & $850$  & 12.38  & 15 \\
    %$(167,28057,28056)$ & U              & $(2,6)$   & $>520$ & $1558$ & 22.36  & 14 \\
    $(167,28057,28056)$              & $(3,4)$   & $494$ & $146$ & $2338$ & 30.69  & 13 \\

    %$(173,30103,30102)$ & U              & $(1,10)$  & $>520$ & $1003$ & 13.36  & 13 \\
    $(173,30103,30102)$               & $(2,5)$   & $521$ & $148$ & $2006$ & 24.57  & 12 \\
    %$(173,30103,30102)$ & U              & $(3,4)$   & $>490$ & $2508$ & 32.60  & 13 \\

    %$(401,23029,23028)$ & U              & $(1,9)$   & $>570$ & $852$  & 14.50  & 17 \\
    %$(401,23029,23028)$ & U              & $(3,3)$   & $>540$ & $2558$ & 35.15  & 14 \\
    \bottomrule
  \end{tabular*}
  \caption{\textbf{Less-than function via the univariate circuit.} The best empirical running time of our lexicographic order algorithm to compare 64-bit integers with encryption parameters supporting $\lambda$ bits of security. The algorithm is based on the univariate circuit. The total time is averaged over 50 trials.}
  \label{table:univariate_circuit_results}
\end{table}
\else
\begin{table*}[h]
  \centering
  \begin{tabular*}{.9\textwidth}{@{\extracolsep{\fill} } p{3.0cm} p{1.0cm} p{1.0cm} p{1.0cm} p{1.0cm} p{2.0cm} p{2.0cm}}
    \toprule
    $(p,m,n)$ & $(d,l)$   &  $\log_2 q$ & $\lambda$    & $k$ & Total time, s & Amortized time per integer, ms \\
    \cmidrule(lr){1-1}\cmidrule(lr){2-7}
    %$(67,26881,26880)$ & U               & $(1,13)$  & $>460$ & $413$  & 8.21   & 20 \\
    %$(67,26881,26880)$ & U               & $(2,7)$   & $>460$ & $768$  & 14.57  & 19 \\
    %$(67,26881,26880)$ & U               & $(4,4)$   & $>460$ & $1344$ & 26.63  & 20 \\
    %$(67,26881,26880)$ & U               & $(5,3)$   & $>480$ & $1792$ & 35.37  & 19 \\

    %$(109,24061,24060)$ & U              & $(1,12)$  & $>480$ & $401$  & 8.99   & 22 \\
    %$(109,24061,24060)$ & U              & $(2,6)$   & $>460$ & $802$  & 16.11  & 20 \\
    %$(109,24061,24060)$ & U              & $(3,4)$   & $>440$ & $1203$ & 21.22  & 18 \\
    %$(109,24061,24060)$ & U              & $(4,3)$   & $>440$ & $1604$ & 29.89  & 19 \\

    %$(131,17293,17292)$ & U              & $(1,11)$  & $>465$ & $524$  & 6.57   & 13 \\
    %$(131,17293,17292)$ & U              & $(2,6)$   & $>465$ & $960$  & 11.81  & 12 \\
    $(131,17293,17292)$               & $(3,4)$   & $431$ & $96$ & $1441$ & 16.07  & 11 \\

    %$(167,28057,28056)$ & U              & $(1,11)$  & $>520$ & $850$  & 12.38  & 15 \\
    %$(167,28057,28056)$ & U              & $(2,6)$   & $>520$ & $1558$ & 22.36  & 14 \\
    $(167,28057,28056)$              & $(3,4)$   & $494$ & $146$ & $2338$ & 30.69  & 13 \\

    %$(173,30103,30102)$ & U              & $(1,10)$  & $>520$ & $1003$ & 13.36  & 13 \\
    $(173,30103,30102)$               & $(2,5)$   & $521$ & $148$ & $2006$ & 24.57  & 12 \\
    %$(173,30103,30102)$ & U              & $(3,4)$   & $>490$ & $2508$ & 32.60  & 13 \\

    %$(401,23029,23028)$ & U              & $(1,9)$   & $>570$ & $852$  & 14.50  & 17 \\
    %$(401,23029,23028)$ & U              & $(3,3)$   & $>540$ & $2558$ & 35.15  & 14 \\
    \bottomrule
  \end{tabular*}
  \caption{\textbf{Less-than function via the univariate circuit.} The best empirical running time of our lexicographic order algorithm to compare 64-bit integers with encryption parameters supporting $\lambda$ bits of security. The algorithm is based on the univariate circuit. The total time is averaged over 50 trials.}
  \label{table:univariate_circuit_results}
\end{table*}
\fi

\ifeprint
\begin{figure}
    \centering
    \begin{tikzpicture}
        \begin{axis}[
            width=11.0cm,
            height=8.5cm,
            %ymin=0, ymax=240,
            ymin=1, ymax=7.5,
            xmin=0, xmax=11,
            axis y line = left, axis x line = bottom,
            x axis line style = {draw=none},
            xtick = {1,2,3,4,5,6,7,8,9,10},
            xticklabels = {3,5,7,11,13,17,19,23,29,31},
            ylabel = {Speedup factor over \cite{TLWRK20}},
            xlabel = {plaintext modulus $p$},
            ytick = \empty,
            legend pos = north west,
            font = \small
            ]
                %\addplot[ybar, ybar legend, fill=white, bar width = 15pt, nodes near coords] coordinates {(1, 90) (2, 36) (3,71) (4,99) (5,54) (6,101) (7,123) (8,232) (9,105) (10,189)};
                %\addlegendentry{\cite{TLWRK20}}
                %\addplot[ybar, ybar legend, fill=gray, bar width = 10pt, nodes near coords] coordinates {(1, 70) (2, 21) (3,40) (4,64) (5,35) (6,70) (7,84) (8,162) (9,72) (10,127)};
                %\addlegendentry{Bivariate circuit}
                %\addplot[ybar, ybar legend, fill=black, bar width = 5pt, nodes near coords] coordinates {(1, 56) (2, 21) (3,31) (4,35) (5,16) (6,27) (7,25) (8,45) (9,22) (10,27)};
                %\addlegendentry{Univariate circuit}
                \addplot[ybar, ybar legend, fill=gray, draw=none, bar width = 18pt, nodes near coords] coordinates {(1, 1.61) (2, 1.71) (3,2.29) (4,2.83) (5,3.38) (6,3.74) (7,4.92) (8,5.16) (9,5) (10,7)};
                \addlegendentry{Univariate circuit}
                \addplot[ybar, ybar legend, fill=black, bar width = 7pt, nodes near coords] coordinates {(1, 1.29) (2, 1.71) (3,1.78) (4,1.55) (5,1.54) (6,1.44) (7,1.46) (8,1.43) (9,1.46) (10,1.49)};
                \addlegendentry{Bivariate circuit}

            \end{axis}
    \end{tikzpicture}
    \caption{\textbf{Less-than function via different methods.} The running time speedup factor of our lexicographic order algorithms over the algorithm of Tan et al.~\cite{TLWRK20}. These factors are computed using the data from Table~\ref{table:comparison_circuit_results}.}
    \label{fig:comparison_circuit_results}
\end{figure}
\else
\begin{figure}
    \centering
    \begin{tikzpicture}
        \begin{axis}[
            width=9.0cm,
            height=7cm,
            %ymin=0, ymax=240,
            ymin=1, ymax=7.5,
            xmin=0, xmax=11,
            axis y line = left, axis x line = bottom,
            x axis line style = {draw=none},
            xtick = {1,2,3,4,5,6,7,8,9,10},
            xticklabels = {3,5,7,11,13,17,19,23,29,31},
            ylabel = {Speedup factor over \cite{TLWRK20}},
            xlabel = {plaintext modulus $p$},
            ytick = \empty,
            legend pos = north west,
            font = \small
            ]
                %\addplot[ybar, ybar legend, fill=white, bar width = 15pt, nodes near coords] coordinates {(1, 90) (2, 36) (3,71) (4,99) (5,54) (6,101) (7,123) (8,232) (9,105) (10,189)};
                %\addlegendentry{\cite{TLWRK20}}
                %\addplot[ybar, ybar legend, fill=gray, bar width = 10pt, nodes near coords] coordinates {(1, 70) (2, 21) (3,40) (4,64) (5,35) (6,70) (7,84) (8,162) (9,72) (10,127)};
                %\addlegendentry{Bivariate circuit}
                %\addplot[ybar, ybar legend, fill=black, bar width = 5pt, nodes near coords] coordinates {(1, 56) (2, 21) (3,31) (4,35) (5,16) (6,27) (7,25) (8,45) (9,22) (10,27)};
                %\addlegendentry{Univariate circuit}
                \addplot[ybar, ybar legend, fill=gray, draw=none, bar width = 14pt, nodes near coords] coordinates {(1, 1.61) (2, 1.71) (3,2.29) (4,2.83) (5,3.38) (6,3.74) (7,4.92) (8,5.16) (9,5) (10,7)};
                \addlegendentry{Univariate circuit}
                \addplot[ybar, ybar legend, fill=black, bar width = 7pt, nodes near coords] coordinates {(1, 1.29) (2, 1.71) (3,1.78) (4,1.55) (5,1.54) (6,1.44) (7,1.46) (8,1.43) (9,1.46) (10,1.49)};
                \addlegendentry{Bivariate circuit}

            \end{axis}
    \end{tikzpicture}
    \caption{\textbf{Less-than function via different methods.} The running time speedup factor of our lexicographic order algorithms over the algorithm of Tan et al.~\cite{TLWRK20}. These factors are computed using the data from Table~\ref{table:comparison_circuit_results}.}
    \label{fig:comparison_circuit_results}
\end{figure}
\fi

As shown in Table~\ref{table:comparison_circuit_results} and Figure~\ref{fig:comparison_circuit_results}, our lexicographic order circuits have a better running time than the prior work of Tan et al.~\cite{TLWRK20} even for small plaintext moduli.
In particular, using our bivariate circuit, the less-than function is 1.71 times faster than with the circuit of Tan et al. on their fastest set of parameters ($(p,d,l) = (5,7,4)$).
The best running time per integer was achieved by our univariate circuit, which outperforms any bivariate circuit for any $p > 5$ at the cost of larger encryption parameters.
As shown in Figure~\ref{fig:comparison_circuit_results}, the speedup factor of the lexicographic order with the univariate circuit over~\cite{TLWRK20} is increasing with the plaintext modulus.
This trend is perturbed when $p=23$ and $29$ because the structure of the related slot permutation groups introduces additional computational overhead and ciphertext noise, thus leading to larger encryption parameters.

Table~\ref{table:univariate_circuit_results} shows that for $p=131$, the univariate circuit takes only 11 milliseconds to compare two 64-bit integers, which is more than 3 times faster than the best running time achieved by the circuit of Tan et al.

\ifeprint
\begin{table}[h!]
  \centering
  \begin{tabular*}{.9\textwidth}{@{\extracolsep{\fill}} p{0.3cm} p{0.7cm} p{0.8cm} p{2.0cm} p{2.5cm} p{2.5cm}}
    \toprule
    $N$     & $\log_2 q$    & \#Trials  & Average total time, s & Amortized time per integer, ms & Amortized time per integer, ms~\cite{CDSS15} \\
    \midrule
    \multicolumn{6}{l}{8-bit integers ($d=2$, $l=1$, $k=9352$)} \\
    \cmidrule(lr){1-6}
    4       & 589     & 32        & 186.28       & 20    & 140 \\
    8       & 599     & 20        & 867.46       & 93    & 690 \\
    16      & 599     & 20        & 3652.23      & 391   & 3140\\
    32      & 599     & 20        & 14769.23     & 1579  & 13900 \\
    64      & 604     & 10        & 60351.02     & 6453  & 60000 \\
    \midrule
    \multicolumn{6}{l}{32-bit integers ($d=3$, $l=2$, $k=4676$)} \\
    \cmidrule(lr){1-6}
    4       & 659     & 20        & 299.17       & 64    & 200 \\
    8       & 671     & 20        & 1356.19      & 290   & 944 \\
    16      & 671     & 20        & 5700.12      & 1219  & 4280 \\
    32      & 684     & 20        & 23017.03     & 4922  & 18600 \\
    64      & 684     & 10        & 89972.27     & 19241 & 49700 \\
    \bottomrule
  \end{tabular*}
  \caption{\textbf{Sorting.} The running time needed to sort $N$ 8-bit or 32-bit integers with $p=167$, $m=28057$ and $n=28056$. The minimal security level is 92 bits according to the LWE estimator~\cite{lwe_estimator}. Note that the amortized timing per integer from~\cite{CDSS15} is obtained with the LTV scheme~\cite{STOC:LopTroVai12}, which was attacked by Albrecht et al.~\cite{C:AlbBaiDuc16}.}
  \label{table:sorting_circuit_results}
\end{table}
\else
\begin{table}[h]
  \centering
  \begin{tabular*}{.45\textwidth}{ p{0.3cm} p{0.7cm} p{0.8cm} p{1cm} p{1.3cm} p{1.5cm}}
    \toprule
    $N$     & $\log_2 q$    & \#Trials  & Average total time, s & Amortized time per integer, ms & Amortized time per integer, ms~\cite{CDSS15} \\
    \midrule
    \multicolumn{6}{l}{8-bit integers ($d=2$, $l=1$, $k=9352$)} \\
    \cmidrule(lr){1-6}
    4       & 589     & 32        & 186.28       & 20    & 140 \\
    8       & 599     & 20        & 867.46       & 93    & 690 \\
    16      & 599     & 20        & 3652.23      & 391   & 3140\\
    32      & 599     & 20        & 14769.23     & 1579  & 13900 \\
    64      & 604     & 10        & 60351.02     & 6453  & 60000 \\
    \midrule
    \multicolumn{6}{l}{32-bit integers ($d=3$, $l=2$, $k=4676$)} \\
    \cmidrule(lr){1-6}
    4       & 659     & 20        & 299.17       & 64    & 200 \\
    8       & 671     & 20        & 1356.19      & 290   & 944 \\
    16      & 671     & 20        & 5700.12      & 1219  & 4280 \\
    32      & 684     & 20        & 23017.03     & 4922  & 18600 \\
    64      & 684     & 10        & 89972.27     & 19241 & 49700 \\
    \bottomrule
  \end{tabular*}
  \caption{\textbf{Sorting.} The running time needed to sort $N$ 8-bit or 32-bit integers with $p=167$, $m=28057$ and $n=28056$. The minimal security level is 92 bits according to the LWE estimator~\cite{lwe_estimator}. Note that the amortized timing per integer from~\cite{CDSS15} is obtained with the LTV scheme~\cite{STOC:LopTroVai12}, which was attacked by Albrecht et al.~\cite{C:AlbBaiDuc16}.}
  \label{table:sorting_circuit_results}
\end{table}
\fi

Table~\ref{table:sorting_circuit_results} illustrates that our homomorphic sorting implementation achieves the best running time in the existing literature.
Note that the best result~\cite{CDSS15} in this area is based on an SHE scheme that was successfully attacked by Albrecht et al.~\cite{C:AlbBaiDuc16}.
Hence, this result is hard to compare directly to our work.

\ifeprint
\begin{table}[h!]
  \centering
  \begin{tabular*}{.8\textwidth}{@{\extracolsep{\fill}} p{0.8cm} p{0.8cm} p{1.0cm} p{1.5cm} p{2.0cm} p{2.5cm}}
    \toprule
    $N$     & $T$   & $\log_2 q$    & \#Trials  & Average total time, s    & Amortized time per integer, ms \\
    \midrule
    \multicolumn{6}{l}{8-bit integers ($d=3$, $l=1$, $k=5220$)} \\
    \cmidrule(lr){1-6}
    2       & 1     & 232           & 20        & 12.35     & 2.37 \\
    4       & 2     & 406           & 20        & 50.55     & 9.68 \\
    8       & 3     & 579           & 20        & 151.75    & 29.07 \\
    16      & 4     & 766           & 20        & 386.87    & 74.11 \\
    32      & 3     & 825           & 20        & 883.68    & 169.29 \\
    64      & 3     & 854           & 20        & 2111.56   & 404.51 \\
    \midrule
    \multicolumn{6}{l}{32-bit integers ($d=6$, $l=2$, $k=2610$)} \\
    \cmidrule(lr){1-6}
    2       & 1     & 406           & 20        & 37.71     & 14.54 \\
    4       & 2     & 753           & 20        & 157.80    & 60.46 \\
    8       & 1     & 825           & 20        & 506.24    & 193.96 \\
    16      & 1     & 839           & 20        & 1694.15   & 649.10 \\
    32      & 1     & 854           & 20        & 6440.27   & 2467.54 \\
    64      & 1     & 884           & 20        & 24986.04  & 9573.20 \\
    \bottomrule
  \end{tabular*}
  \caption{\textbf{Array minimum.} The running time needed to find the minimum of $N$ 8-bit or 32-bit integers with $p=17$, $m=41761$ and $n=41760$. The parameter $T$ denotes the number of the tournament method stages. The minimal security level is 121 bits according to the LWE estimator~\cite{lwe_estimator}.}
  \label{table:minimum_circuit_results}
\end{table}
\else
\begin{table}[h]
  \centering
  \begin{tabular*}{.45\textwidth}{ p{0.2cm} p{0.2cm} p{0.8cm} p{0.9cm} p{1.5cm} p{2.0cm}}
    \toprule
    $N$     & $T$   & $\log_2 q$    & \#Trials  & Average total time, s    & Amortized time per integer, ms \\
    \midrule
    \multicolumn{6}{l}{8-bit integers ($d=3$, $l=1$, $k=5220$)} \\
    \cmidrule(lr){1-6}
    2       & 1     & 232           & 20        & 12.35     & 2.37 \\
    4       & 2     & 406           & 20        & 50.55     & 9.68 \\
    8       & 3     & 579           & 20        & 151.75    & 29.07 \\
    16      & 4     & 766           & 20        & 386.87    & 74.11 \\
    32      & 3     & 825           & 20        & 883.68    & 169.29 \\
    64      & 3     & 854           & 20        & 2111.56   & 404.51 \\
    \midrule
    \multicolumn{6}{l}{32-bit integers ($d=6$, $l=2$, $k=2610$)} \\
    \cmidrule(lr){1-6}
    2       & 1     & 406           & 20        & 37.71     & 14.54 \\
    4       & 2     & 753           & 20        & 157.80    & 60.46 \\
    8       & 1     & 825           & 20        & 506.24    & 193.96 \\
    16      & 1     & 839           & 20        & 1694.15   & 649.10 \\
    32      & 1     & 854           & 20        & 6440.27   & 2467.54 \\
    64      & 1     & 884           & 20        & 24986.04  & 9573.20 \\
    \bottomrule
  \end{tabular*}
  \caption{\textbf{Array minimum.} The running time needed to find the minimum of $N$ 8-bit or 32-bit integers with $p=17$, $m=41761$ and $n=41760$. The parameter $T$ denotes the number of the tournament method stages. The minimal security level is 121 bits according to the LWE estimator~\cite{lwe_estimator}.}
  \label{table:minimum_circuit_results}
\end{table}
\fi

The existing literature on homomorphic array minimum/maximum algorithms~\cite{TMP15,PoPETS:SFR20} is based on the techniques described in Section~\ref{sec:min/max}.
Hence, our improvement of comparison circuits automatically results in a better performance over these works.
For example, Togan et al.~\cite{TMP15} needed 346.9 seconds to find maximal elements of 960 arrays of 16 8-bit integers, which is 361 milliseconds per array.
Our work can perform this task in 74 milliseconds, see Table~\ref{table:minimum_circuit_results}.
To find the minimum of 64 32-bit integers, our array minimum algorithm requires about 9.5 seconds.

\subsection{Comparison to other HE schemes}
    As mentioned in the introduction, there are three types of HE schemes suitable in different use cases including TFHE, CKKS and BGV/BFV.
    Our algorithms are designed for BGV/BFV, which support SIMD packing and are the most efficient FHE schemes for exact computation in arithmetic circuits.
    However, the amortized running time per data value of our comparison algorithms is comparable to efficient FHE schemes for binary circuits (TFHE) and HE supporting approximate arithmetic over complex numbers (CKKS).

    In Table~\ref{table:other_he_schemes}, our implementation of the less-than function is compared to the implementations of this function in TFHE \cite{AC:CGGI17,JC:CGGI20} and CKKS \cite{EPRINT:CheKimKim19}.

    Chilloti et al.~\cite{AC:CGGI17,JC:CGGI20} constructed a deterministic weighted automata that can compute the maximum function using the TFHE scheme.
    The same automata can compute the less-than function without any performance loss.
    In this case, the running time of the less-than function of two $b$-bit integers takes $170 b$ microseconds on a hardware similar to ours and with the encryption parameters supporting at least 152 bits of security.
    This security level might be lowered by a recent attack of Espitau et al.~\cite{EPRINT:EJK20}.
    Note that this running time is achieved in the leveled mode of TFHE, i.e. without bootstrapping.
    Unfortunately, we could not manage to run the code of this implementation on our machine.

    Cheon et al. \cite{EPRINT:CheKimKim19} designed a polynomial approximation of the less-than function over real numbers.
    Since the precision of this approximation depends on the ciphertext noise which cannot be reduced in CKKS, only a few consecutive comparisons are possible to perform correctly unlike in TFHE and BGV/BFV.
    Nevertheless, the number of SIMD slots in CKKS is always half of the ring dimension ($n/2$), which significantly reduces the amortized running time per value.

    We ran the comparison method of Cheon et al. on our machine with multi-threading turned off.
    Since the implementation in~\cite{EPRINT:CheKimKim19} uses parallelization with 8 cores, our running time of this method presented in Table~\ref{table:other_he_schemes} is significantly larger than in~\cite{EPRINT:CheKimKim19}.
    The encryption parameters of the CKKS scheme are set to support a security level of at least 128 bits.

    Our implementation runs with $p=131$, $m=17293$ ($n=17292$), which corresponds to 5764 integers of 8-16 bits or 2882 20-bit integers encoded into one ciphertext.
    The encryption parameters corresponds to a security level of at least 126 bits.

    \ifeprint
    \begin{table}[h!]
      \centering
      \begin{tabular*}{.8\textwidth}{ p{1.8cm} p{3.1cm} p{2.0cm} p{2.3cm}}
        \toprule
        Bit length  & FHE scheme & Total time, s    & Amortized time per integer, ms \\
        \midrule
        \multirow{3}{*}{8}  & TFHE              & 0.001*     & 1.36* \\
                            & CKKS              & 89.61     & 1.37 \\
                            & BGV(this paper)   & 7.09      & 1.23 \\
        \midrule
        \multirow{3}{*}{12}  & TFHE             & 0.002*     & 2.04* \\
                             & CKKS             & 127.54    & 1.95 \\
                             & BGV(this paper)  & 7.09      & 1.23 \\
        \midrule
        \multirow{3}{*}{16}  & TFHE            & 0.003*     & 2.72* \\
                             & CKKS            & 296.96     & 4.53 \\
                             & BGV(this paper)  & 12.11      & 2.10 \\
        \midrule
        \multirow{3}{*}{20}  & TFHE            & 0.003*      & 3.4* \\
                             & CKKS            & 373.76     & 5.70 \\
                             & BGV(this paper)   & 8.66     &  3.01\\
        \bottomrule
      \end{tabular*}
      \caption{\textbf{Comparison with other HE schemes.} Total and amortized running time of the less-than function implemented with different HE schemes including TFHE, CKKS and BGV. Note that TFHE does not support SIMD packing, which implies that the total and amortized running time of this scheme are the same. The encryption parameters of each scheme are set to support the following security levels: 152 bits for TFHE (might be smaller due to~\cite{EPRINT:EJK20}), 128 bits for CKKS and 126 bits for BGV.
      \newline *TFHE timings are estimated from~\cite{JC:CGGI20}.}
      \label{table:other_he_schemes}
    \end{table}
    \else
    \begin{table}[h]
      \centering
      \begin{tabular*}{.45\textwidth}{ p{1.2cm} p{2.1cm} p{1.0cm} p{2cm}}
        \toprule
        Bit length  & FHE scheme & Total time, s    & Amortized time per integer, ms \\
        \midrule
        \multirow{3}{*}{8}  & TFHE              & 0.001*     & 1.36* \\
                            & CKKS              & 89.61     & 1.37 \\
                            & BGV(this paper)   & 7.09      & 1.23 \\
        \midrule
        \multirow{3}{*}{12}  & TFHE             & 0.002*     & 2.04* \\
                             & CKKS             & 127.54    & 1.95 \\
                             & BGV(this paper)  & 7.09      & 1.23 \\
        \midrule
        \multirow{3}{*}{16}  & TFHE            & 0.003*     & 2.72* \\
                             & CKKS            & 296.96     & 4.53 \\
                             & BGV(this paper)  & 12.11      & 2.10 \\
        \midrule
        \multirow{3}{*}{20}  & TFHE            & 0.003*      & 3.4* \\
                             & CKKS            & 373.76     & 5.70 \\
                             & BGV(this paper)   & 8.66     &  3.01\\
        \bottomrule
      \end{tabular*}
      \caption{\textbf{Comparison with other HE schemes.} Total and amortized running time of the less-than function implemented with different HE schemes including TFHE, CKKS and BGV. Note that TFHE does not support SIMD packing, which implies that the total and amortized running time of this scheme are the same. The encryption parameters of each scheme are set to support the following security levels: 152 bits for TFHE (might be smaller due to~\cite{EPRINT:EJK20}), 128 bits for CKKS and 126 bits for BGV.
      \newline *TFHE timings are estimated from~\cite{JC:CGGI20}.}
      \label{table:other_he_schemes}
    \end{table}
    \fi

    As shown in Table~\ref{table:other_he_schemes}, our algorithm for the less-than function demonstrates a similar performance as the TFHE-based implementation and is up to 2 times faster than the CKKS-based work.
    This means that in use cases that involve arithmetic and non-arithmetic functions (e.g. artificial neural networks) one might resort to only an HE scheme supporting exact arithmetic circuits (i.e. BGV/BFV) instead of combining it with an HE scheme efficient for a non-arithmetic part of the computation (i.e. TFHE).

%%% Local Variables:
%%% mode: latex
%%% TeX-master: "main_pets"
%%% End:


\documentclass{article}
\usepackage[utf8]{inputenc}

\title{MAT257 Notes}
\author{Jad Elkhaleq Ghalayini}
\date{March 8 2019}

\usepackage{amsmath}
\usepackage{amssymb}
\usepackage{amsthm}
\usepackage{mathtools}
\usepackage{enumitem}
\usepackage{graphicx}
\usepackage{cancel}

\usepackage[margin=1in]{geometry}

\newtheorem{theorem}{Theorem}
\newtheorem{lemma}{Lemma}
\newtheorem{definition}{Definition}
\newtheorem*{corollary}{Corollary}
\newtheorem{exercise}{Exercise}
\newtheorem{claim}{Claim}
\newtheorem{proposition}{Proposition}

\DeclareMathOperator{\Int}{Int}
\DeclareMathOperator{\grad}{grad}
\DeclareMathOperator{\Div}{div}
\DeclareMathOperator{\curl}{curl}
\DeclareMathOperator{\Ker}{Ker}
\DeclareMathOperator{\Ima}{Im}
\DeclareMathOperator{\Vol}{vol}
\DeclareMathOperator{\D}{D}

\newcommand{\reals}[0]{\mathbb{R}}
\newcommand{\nats}[0]{\mathbb{N}}
\newcommand{\ints}[0]{\mathbb{Z}}
\newcommand{\rationals}[0]{\mathbb{Q}}
\newcommand{\brac}[1]{\left(#1\right)}
\newcommand{\sbrac}[1]{\left[#1\right]}
\newcommand{\mc}[1]{\mathcal{#1}}
\newcommand{\eval}[3]{\left.#3\right|_{#1}^{#2}}
\newcommand{\ip}[2]{\left\langle#1,#2\right\rangle}
\newcommand{\prt}[2]{\frac{\partial #1}{\partial #2}}
\newcommand{\mb}[1]{\mathbf{#1}}
\newcommand{\hlfspc}[0]{\mathbb{H}}
\newcommand{\loint}[0]{\operatorname{L}\int}
\newcommand{\hiint}[0]{\operatorname{U}\int}
\newcommand{\indic}[1]{\chi_{#1}}

\begin{document}

\maketitle

Talking about Stoke's theorem, what we're really interested in is not Stoke's theorem on \(k\)-cubes or on chains but on \textit{manifolds}, where we're going to be comparing the integral on a manifold to the integral on it's boundary. To do that, we're going to have to adapt all our machinery for differential forms to work with manifolds. But first, let's cover an important point I left off last time.

\section{Independence of Parametrization}

Let's say \(c\) is a \(\mc{C}^1\) singular \(k\)-cube in \(\reals^n\), and we want to look at a re-parametrization, i.e. a map
\begin{equation}
  p : [0, 1]^k \to [0, 1]^k
\end{equation}
which is \(\mc{C}^1\), one-to-one, onto, and \(\det p'(x) \geq 0\), i.e. the Jacobian does not reverse orientations.
If \(\omega\) is a \(k\)-form then
\begin{equation}
  \int_c\omega = \int_{c \circ p}\omega
\end{equation}
You should compare this with the situation with functions: what if we were integrating a function over \(p([0, 1]^k) = [0, 1]^k\). You'd have to say there's a change of variable formula
\begin{equation}
  \int_{[0, 1]^k}f \circ p|\det p'| = \int_{p([0, 1]^k)}f
\end{equation}
This is clearly a very different case, and indeed why differential forms are the ``natural'' thing to integrate over: the forumla for change of variables is ``built in'' to the definition. Let's see how:
\begin{proof}
  By definition,
  \begin{equation}
    \int_{c \circ p}\omega = \int_{[0, 1]^k}(c \circ p)^*\omega = \int_{[0, 1]^k}p^*(c^*\omega)
    \label{intdef}
  \end{equation}
  \(c^*\omega\) is a \(k\)-form on \([0, 1]^k\), so we know it looks like
  \begin{equation}
    c^*\omega = f(x)\bigwedge_{i = 1}^kdx_i \implies p^*(c^*\omega) = (f \circ p)\det p' \bigwedge_{i = 1}^k dx_i
  \end{equation}
  So we can rewrite equation \ref{intdef} as
  \begin{equation}
    \int_{[0, 1]^k}(f \circ p)\det p'dx_1 \wedge ... dx_k = \int_{[0, 1]^k}(f \circ p)\det p'
  \end{equation}
  Since \(\det p' \geq 0\), the above becomes
  \begin{equation}
    \int_{[0, 1]^k}(f \circ p)|\det p'| = \int_{p([0, 1]^k)}f = \int_{[0, 1]^k}fdx_1 \wedge ... \wedge dx_k = \int_{[0, 1]^k}c^*\omega = \int_c\omega
  \end{equation}

\end{proof}

\section{Vector Fields and Differential Forms on a submanifold \(M\) of \(\reals^n\)}

We haven't talked about manifolds in a while, since differential calculus, and now we want to talk about them in terms of integral calculus. So let's start off with the definitions:
\begin{definition}
  A \underline{vector field \(F\) on \(M\)} is a function \(F\) defined on \(M\) such that
  \begin{equation}
    \forall x \in M, F(x) \in TM_x
  \end{equation}
\end{definition}
Recall the definition of a \(\mc{C}^r\) coordinate chart \(\varphi: W \subset \reals^k \to M \subset \reals^n\), where \(M\) has dimension \(k\). The derivative gives an isomorphism of vector spaces
\begin{equation}
  \varphi_{*a} : \reals_a^k \to TM_{\varphi(a)}
\end{equation}
If \(\varphi\) is a coordinate chart for \(M\) then there is a vector field \(G\) on \(W\) such that
\begin{equation}
  \varphi_{*a}(G(a)) = F(\varphi(a))
\end{equation}
With this in mind, how should we say what it means for \(F\) to be \(\mc{C}^r\)? We know what it means for \(G\) to be \(\mc{C}^r\), so we'll say that \(F\) is \(\mc{C}^r\) if \(G\) is \(\mc{C}^r\) for any coordinate chart \(\varphi: W \to M\). Note that this definition is independent of the choice of coordinate chart: suppose we have two \(\mc{C}^r\) coordinate charts \(\varphi: W \to M\), \(\psi : V \to M\) such that
\begin{equation}
  \varphi(a) = \psi(b)
\end{equation}
We can say that there are vector fields \(G\) on \(W\) and \(H\) on \(V\) such that
\begin{equation}
  \varphi_{*\xi}(G(\xi)) = F(\varphi(\xi)), \psi_{*\eta}(H(\eta)) = F(\psi(\eta))
\end{equation}
If \(\varphi(a) = \psi(b)\) then we have that
\begin{equation}
  \varphi_{*a}(G(a) = F(\varphi(a))) = F(\psi(b)) = \psi_{*b}(H(b))
\end{equation}
So
\begin{equation}
  H(b) = \psi_{*b}^{-1}(F(\psi(b)))
\end{equation}
But \(\psi = \varphi \circ \varphi^{-1} \circ \psi\), giving
\begin{equation}
  \psi_{*b} = \varphi_{*a} \circ (\varphi^{-1} \circ \psi)_{*b}
\end{equation}
Hence,
\begin{equation}
  H(b) = \psi_{*b}^{-1}(F(\psi(b))) = ((\varphi^{-1} \circ \psi)_{*b})^{-1} \circ \varphi^{-1}_{*a}(F(\psi(b))) = (\psi^{-1} \circ \varphi)_{*a}(G(a))
\end{equation}
It's better not to try to write this down in complete detail (this was about the third attempt)...

\end{document}