Limitations to Computing Quadratic Functions on Reed-Solomon Encoded Data

TL;DR

This work establishes fundamental limits on computing non-linear functions from Reed-Solomon encoded data under a low-bandwidth leakage model. By focusing on quadratic monomials g_{i,j}(f)=f_i f_j and reducing to the k=2 case, the authors derive explicit lower bounds on the download budget that nearly match the cost of recovering the two involved message symbols, with t ≥ 2 log_2(q−1)−3p for odd p (and t ≥ 2 log_2(q−2)−4 for p=2). The analysis introduces a restricted parameter regime with symmetry (Ω_q) and a projection QM framework (pQM) that converts the problem into distinguishability tasks in 𝔽_q, enabling tractable lower-bound arguments via bucket maps and Weil-type character sum bounds. The results sharply contrast with the linear-case literature, showing non-linear QM cannot achieve significant bandwidth reductions in general, even when leveraging regenerating-code or secret-sharing perspectives. The paper also outlines open questions about higher-degree monomials, potential achievability of the bounds for k>2, and extensions to arbitrary quadratic functions, highlighting a clear direction for future work in coded computation and leakage-resilient data processing.

Abstract

We study the problem of low-bandwidth non-linear computation on Reed-Solomon encoded data. Given an $[n,k]$ Reed-Solomon encoding of a message vector $\mathbf{f} \in \mathbb{F}_q^k$, and a polynomial $g \in \mathbb{F}_q[X_1, X_2, \ldots, X_k]$, a user wishing to evaluate $g(\mathbf{f})$ is given local query access to each codeword symbol. The query response is allowed to be the output of an arbitrary function evaluated locally on the codeword symbol, and the user's aim is to minimize the total information downloaded in order to compute $g(\mathbf{f})$. This problem has been studied before for \emph{linear} functions $g$; in this work we initiate the study of non-linear functions by starting with quadratic monomials. For $q = p^e$ and distinct $i,j \in [k]$, we show that any scheme evaluating the quadratic monomial $g_{i,j} := X_i X_j$ must download at least $2 \log_2(q-1) - 3$ bits of information when $p$ is an odd prime, and at least $2\log_2(q-2) -4$ bits when $p=2$. When $k=2$, our result shows that one cannot do significantly better than the naive bound of $k \log_2(q)$ bits, which is enough to recover all of $\mathbf{f}$. This contrasts sharply with prior work for low-bandwidth evaluation of \emph{linear} functions $g(\mathbf{f})$ over Reed-Solomon encoded data, for which prior work has shown it is possible to substantially improve upon this bound.

Figures (1)

• Figure 1: Images of $B_\gamma \subseteq \mathbb{F}_7[x]$ at an evaluation point $\alpha \in \mathbb{F}_7$: given a row indexed by $\alpha \in \mathbb{F}_7$ and a column indexed by $B_\gamma$, the table entry at $(\alpha, B_\gamma)$ is $B_\gamma(\alpha)\subseteq \mathbb{F}_q$.

Theorems & Definitions (87)

• Definition 1: Reed-Solomon (RS) codes of dimension $k$ RS60
• Definition 2: Leakage Function
• Definition 3: Quadratic monomial recovery
• Theorem 4
• Theorem 5: Informal; see Theorem \ref{['thm: linear eval impossible']}
• Lemma 6: Informal; see Lemma \ref{['lemma: bucket rescaling']}
• Theorem 7: Informal; see Theorem \ref{['thm: output list size 2']}
• Definition 9: $\gamma$-Bucket
• Definition 10: $\gamma$-Bucket Evaluation
• proof