BGV: Populate Moduli Chain from Noise Analysis

[ZenithalHourlyRate]

Depends on #1343. Implements part of #1168.

For dot_product.mlir, it will generate the following parameter:

ringDim: 8192
plaintextModulus: 65537
level: 2
logqi: 25 40 47 
qi: 33832961 1099511922689 140737488486401 
dnum: 2
logpi: 47 47 
pi: 140737488928769 140737489256449 

Idea

The idea behind the parameter generation is simple: For each level, the mod reduce should be able to decrease the noise by that amount (e.g. from 69.5 to 23), so the modulus for that level should be at least 47 bit.

For special modulus, the selection is conservative in that we only make sure P > Q / dnum and make no other optimization. We default to the HYBRID key switching technique for now.

I understand there are implementation using optimizers like KPZ21 and MML+23. This PR is meant for making the pipeline aware of concrete parameters, like LWE dialect and backend. Further PR could optimize the selection process.

Current status / Discussion

• The parameter selection procedure lives in --validate-noise pass for simplicity. It should be separated into another pass use some attribute to communicate with other passes (e.g. bgv.schemeParam attribute). Need design discussion.
• LWE dialect (secret-to-bgv) has not been touched. I now directly pass the generated parameter to attr, then backend will pick it up somewhere; further design should pass the information in LWE Types and backend will get information there.
• For the prime generation part, I directly use utility functions from @openfhe//nbtheory.h. It is quite crude for now.
• We need a way for user to specify the plaintext modulus. The current default modulus 4295294977 is too large, though when set it to smaller one the box_blur test (iirc) will fail.

Example

The noise analysis for the generated param

Noise Bound: 29.27 Budget: 81 Total: 112 for value: <block argument> of type 'tensor<8xi16>' at index: 0 
Noise Bound: 29.27 Budget: 81 Total: 112 for value: <block argument> of type 'tensor<8xi16>' at index: 1 
Noise Bound: 66.53 Budget: 44 Total: 112 for value: %1 = arith.muli %input0, %input1 {mgmt.mgmt = #mgmt.mgmt<level = 2, dimension = 3>} : tensor<8xi16> 
Noise Bound: 66.53 Budget: 44 Total: 112 for value: %2 = mgmt.relinearize %1 {mgmt.mgmt = #mgmt.mgmt<level = 2>} : tensor<8xi16> 
Noise Bound: 66.53 Budget: 44 Total: 112 for value: %3 = tensor_ext.rotate %2, %c4 {mgmt.mgmt = #mgmt.mgmt<level = 2>} : tensor<8xi16>, index 
Noise Bound: 67.53 Budget: 43 Total: 112 for value: %4 = arith.addi %2, %3 {mgmt.mgmt = #mgmt.mgmt<level = 2>} : tensor<8xi16> 
Noise Bound: 67.53 Budget: 43 Total: 112 for value: %5 = tensor_ext.rotate %4, %c2 {mgmt.mgmt = #mgmt.mgmt<level = 2>} : tensor<8xi16>, index 
Noise Bound: 68.53 Budget: 42 Total: 112 for value: %6 = arith.addi %4, %5 {mgmt.mgmt = #mgmt.mgmt<level = 2>} : tensor<8xi16> 
Noise Bound: 68.53 Budget: 42 Total: 112 for value: %7 = tensor_ext.rotate %6, %c1 {mgmt.mgmt = #mgmt.mgmt<level = 2>} : tensor<8xi16>, index 
Noise Bound: 69.53 Budget: 41 Total: 112 for value: %8 = arith.addi %6, %7 {mgmt.mgmt = #mgmt.mgmt<level = 2>} : tensor<8xi16> 
Noise Bound: 23.01 Budget: 40 Total: 65 for value: %9 = mgmt.modreduce %8 {mgmt.mgmt = #mgmt.mgmt<level = 1>} : tensor<8xi16> 
Noise Bound: 63.01 Budget: 0 Total: 65 for value: %extracted = tensor.extract %9[%c7] {mgmt.mgmt = #mgmt.mgmt<level = 1>} : tensor<8xi16> 
Noise Bound: 23.01 Budget: 0 Total: 25 for value: %10 = mgmt.modreduce %extracted {mgmt.mgmt = #mgmt.mgmt<level = 0>} : i16 

Note that there is nealy no budget given current param generation process. It is OK if we do have a correct bound.

Lattigo Output (using #1374). Though for the last line it seems to indicate the error exceeds the allowed range, yet its decryption is correct. I will investigate more on the Lattigo rlwe.Norm function to understand what happened. Resolved by #1374 (comment), check the correct trace there.

``` [1 2 3 4 5 6 7 8] Noise: 22.71 Total 112 [2 3 4 5 6 7 8 9] Noise: 22.36 Total 112 [2 6 12 20 30 42 56 72] Noise: 49.76 Total 112 [2 6 12 20 30 42 56 72] Noise: 49.76 Total 112 [30 42 56 72 2 6 12 20] Noise: 49.76 Total 112 [32 48 68 92 32 48 68 92] Noise: 50.46 Total 112 [68 92 32 48 68 92 32 48] Noise: 50.46 Total 112 [100 140 100 140 100 140 100 140] Noise: 50.84 Total 112 [140 100 140 100 140 100 140 100] Noise: 50.84 Total 112 [240 240 240 240 240 240 240 240] Noise: 51.84 Total 112 [240 240 240 240 240 240 240 240] Noise: 23.96 Total 65 [0 0 0 0 0 0 0 240] Noise: 41.30 Total 65 [240 0 0 0 0 0 0 0] Noise: 41.30 Total 65 [240 0 0 0 0 0 0 0] Noise: 41.30 Total 65 [240 0 0 0 0 0 0 0] Noise: 29.07 Total 25 ```

[j2kun]

I think attaching this to the module op is a good idea for now. Maybe @AlexanderViand-Intel might be able to better review the generation step, but otherwise I'm happy to merge it in after the noise model PR is merged in and this is rebased.

[ZenithalHourlyRate]

Ready for review.

• --validate-noise now generates parameter for BGV and annotate bgv.schemeParam to the ModuleOp
• --secret-to-bgv is aware of this parameter and use it to populate the lwe moduli chain, yet not all information is used so the attribute is reserved.
• Later pass like configure-crypto-context is responsible for clean the attribute.

[ZenithalHourlyRate]

Changed optimize-relinearize to linearize input for mgmt.modreduce due to noise model reason, see #1398. Should be optimized later.

[j2kun]

LGTM!