The Oral Exam
Try answering these out loud before you reveal the answer. Your explanation should make perfect sense to a software engineer who only understands the basics of Chapter 1 and 2, without needing to look at any source code.
1. State the problem we solved in one precise sentence.
We compute dot-product similarity scores between a private query embedding and a massive corpus of embeddings, without revealing the protected values to the server, and we rank the results securely on the client.
2. Derive our vector reversal trick in three equations.
First, pick a target tap: tⱼ = Dj + D − 1. Second, demand that query index plus corpus index equals the target: i + p(j, i) = tⱼ. Third, solve for the corpus physical position: p(j, i) = Dj + D − 1 − i.
3. Give the two proofs that guarantee our math is safe.
Isolation proof: because the query only spans 0…D−1, the terms that hit tⱼ are forced to come exactly from block j. Wrap proof: the maximum degree our multiplication can reach is N + D − 2, which safely stops just before the lowest possible wrapped target at N + D − 1.
4. State exactly what complexity we saved, and what we still have to pay for.
We completely eliminated expensive encrypted rotations and massive reduction trees from the scoring path. But we still pay heavily for massive polynomial multiplications, NTT transforms, massive memory bandwidth, and the network traffic to send the results back.
5. Explain the hardware pipeline without using any code syntax.
We park the query components on-chip. 16 parallel multipliers chew through streaming corpus data. In plaintext mode, they spit out two products per clock tick. In encrypted mode, they take two ticks (phases) to generate three products. If there's a traffic jam, backpressure instantly freezes the entire pipeline in place so data doesn't crash.
6. Trace the life of a single score through every representation.
It starts as a real float, scales into an integer by Δ, packs into a polynomial coefficient, splits into residue limbs, transforms into NTT frequency data, gets encrypted into ciphertext components, gets multiplied in hardware, inverse transforms back to coefficients, gets decrypted into a target tap, and finally divides by Δ² to become a float again.
7. How do you fix a bug that only happens when the hardware stalls between ciphertext phases?
You check the enable wires. If the phase bit, row address, the stash register, and the multipliers aren't all tied to the exact same valid/ready freeze signal, the hardware will lose its place in time and scramble the cross terms.
8. Why can a tiny numerical error in FHE ruin the whole application?
Because we're building a search engine. If the top-k search results are incredibly close in score, a tiny bit of FHE noise can swap their order. The numbers might look fine in absolute terms, but the user gets the wrong top result.
The Capstone Design Exercise
Pick a block dimension D and a corpus size that leaves the final polynomial partially empty. Map it out on paper or in Python: calculate the vectors-per-polynomial, pinpoint every target coefficient in one product, find the exact index for the last real corpus item, count how many padded garbage taps to throw away, state the Δ² decode rule, and draw a valid/ready timeline with a stall right in the middle of a ciphertext phase. If you can do this, you truly understand how the math, metadata, and hardware timing all interlock.
Design review checklist
Final gate
What is the deepest, most reusable lesson from this entire design?
Course complete
From four boxes to a streaming encrypted scorer
We took the long road: array positions, convolution buckets, polynomial wrap limits, privacy boundaries, index reversal, hardware signals, valid/ready handshakes, and parallel lanes. The immense complexity of this system is no longer just arbitrary magic to you. It's the logical, inevitable consequence of combining math, security, and physical hardware constraints. You are ready to build.
Repository layer · second pass
Can you defend correctness, cost, privacy, and implementation as one coherent design?
A final defense begins with the problem contract, derives the mapping from relations, proves block and wrap isolation, separates CKKS approximation from exact index structure, explains the hardware schedule, and presents measured evidence. Each claim should name assumptions and a test or proof artifact.
Also present alternatives and failure modes. The strongest design review does not claim universal superiority; it explains the workload under which the representation wins, what it gives up, and which parameter or trust changes require reevaluation.
Reasoning chain
- 1
State problem and adversary.
- 2
Derive rather than announce the layout.
- 3
Present two contamination proofs.
- 4
Account for operations and bytes.
- 5
Trace source and RTL contracts.
- 6
Show layered validation.
- 7
Name limitations and next experiments.
Worked trace
A defensible one-minute summary
- We need private dot-product scores.
- Convolution groups constant position sums.
- Reversal maps logical equality to one constant sum per block.
- Support and degree bounds protect taps; CKKS approximates values; hardware streams the same product.
Result. The summary is compact because the detailed evidence exists behind every sentence.
Executable lens · Python
Make the hidden state visible
def design_gate(evidence):
required={"contract","derivation","proof","cost","privacy","rtl","tests"}
missing=required-set(evidence)
if missing: raise ValueError(f"missing evidence: {sorted(missing)}")Retype this example, predict each intermediate value, and then change one input that touches a boundary.
Misconception clinic
Tempting mistakes
- Leading with benchmark numbers before defining equal work.
- Hiding limitations behind cryptographic vocabulary.
Retrieval and transfer
Close the book first
- Prepare a ten-slide design defense.
- Answer the strongest rotation-based alternative.
- List parameter changes that invalidate current proofs or measurements.