Diamond iO Update We are excited to share that we have introduced several new optimization techniques for Diamond iO, implemented the full end-to-end pipeline with realistic lattice parameters, and produced concrete performance estimates. Latest paper: Latest implementation: Last year’s initial Diamond iO implementation deliberately left out one crucial component: FHE evaluation over BGG+ encodings. The reason was simple: the noise growth was too large to support realistic lattice parameters. This component is not specific to Diamond iO. FHE evaluation over BGG+ encodings has been used as a theoretical building block in advanced lattice-based cryptography for more than a decade, but there has been very little work on making it actually implementable. In the latest update, we make this component concrete. We introduce several techniques that substantially reduce noise growth, including native lookup-table evaluation, constant-depth arithmetic circuits, and specialized noise refreshing. The new implementation also runs all major lattice operations on GPUs. Together, these optimizations allow us to instantiate the full Diamond iO pipeline with realistic lattice parameters: a modulus size of at most 1540 bits and lattice dimension 2^{16}, comparable to large parameter sets used in CKKS-style FHE implementations. The total running time is still far beyond practical use, but we can now estimate the end-to-end cost rather than leaving a major component abstract. What improves? Our estimates suggest that Diamond iO reduces the overhead of the main bottleneck in most modern iO schemes: the transformation from functional encryption (FE) to iO. Compared with prior FE-to-iO transformations, Diamond iO reduces this overhead by at least a factor of 2^118, making the transformation almost as efficient as the underlying FE scheme itself. In other words, Diamond iO appears to largely remove the FE-to-iO transformation as the dominant cost. What remains? Diamond iO is still very far from practical. Once the FE-to-iO overhead is reduced, the bottleneck shifts to the final FE decryption step, which requires FHE evaluation over BGG+ encodings. Our current estimate is that this step would still take about 10^36 hours. As explained in Vitalik’s recent post, much of the inefficiency in modern iO comes from the need to stack a complicated tower of cryptographic primitives: FHE × ABE × GC × XiO × ... Diamond iO significantly simplifies this picture: the construction is essentially simple matrix operations plus an FHE × ABE layer, where the ABE component is essentially BGG+ encodings. In our view, this gives a much clearer roadmap toward practical iO: further simplify the remaining FHE × ABE layer, and the gap to practicality could shrink dramatically.

I was really lucky to come across a very interesting phenomenon in complex neural networks, so I wanted to share it with you. It’s called the Phase Coherent Transformer. Under specific conditions, complex-valued neural networks (CvNNs) exhibit significantly better generalization and superior performance across multiple tasks. I’ve written a detailed experimental report in the paper.Until now, CvNNs were thought to be good mainly in a narrow range of tasks like signal analysis and phase information processing. After Transformers and attention mechanisms came along, the gap with real-valued networks only kept widening. In fact, in this experiment as well, turning a standard Transformer into a complex version mostly just led to performance degradation (except for phase-related tasks). But now, This transformer seems really suited for complex neural networks, unlike before, and it’s showing completely unexpected behaviors and impressive benchmark results. I suspected that “the softmax in Transformers might be causing the loss of phase information in complex weights across multiple layers.” So I looked for attention structures that can preserve phase information, and ran experiments. Approaches like Sigmoid attention and the recently announced Multiscreen have this kind of structure. After complexifying them and tuning for better multi-layer phase control, I named the resulting model the Phase Coherent Transformer (PCT).The experimental results showed that it greatly outperforms many real-valued NNs on tasks where complex NNs had traditionally struggled, while still retaining its advantage on phase-related tasks. Paper preprint: It’s not yet clear how this will impact AI overall, but I think it’s a pretty significant development for the field of complex neural networks at least.This naturally brings up one important question: Q: Should today’s AI stay based on real numbers? In my field, circuit-style cryptography (ZKP, WE), the algebraic structures used as function inputs have naturally expanded into extension fields when necessary. It wouldn’t be surprising if AI follows a similar natural path. Moreover, CvNNs can likely associate and infer from data (=responses and signals from circuits or functions) under the assumption that phase information is hidden inside them. This feels incredibly powerful, because it could allow much more sophisticated handling not only of circuit outputs but also of intermediate state traces.

The Stanford, a16z, Mysten & Sui code for batch threshold encryption from partial fractions is now public: The paper is also updated with shorter ciphertexts:

I’m excited about a future where running many AI models in parallel on cryptanalysis for one year could provide confidence in new cryptographic assumptions comparable to a decade of human scrutiny. In other words, AI may turn the test of time into a test of computational effort.

I still clearly remember the day after last year’s Devcon when you suggested creating an iO research team within PSE! I’ve really enjoyed working with you! I hope you’ll find something new that excites you again! Grazie di tutto fino ad ora

PeerDAS in Fusaka is significant because it literally is sharding. Ethereum is coming to consensus on blocks without requiring any single node to see more than a tiny fraction of the data. And this is robust to 51% attacks - it's client-side probabilistic verification, not validator voting. Sharding has been a dream for Ethereum since 2015 , and data availability sampling since 2017 ( ), and now we have it. That said, there are three ways that the sharding in Fusaka is incomplete: * We can process O(c^2) transactions (where c is the per-node compute) on L2s, but not on the ethereum L1. If we want to scaling to benefit the ethereum L1 as well, beyond what we can get by constant-factor upgrades like BAL and ePBS, we need mature ZK-EVMs. * The proposer/builder bottleneck. Today, the builder needs to have the whole data and build the whole block. It would be amazing to have distributed block building. * We don't have a sharded mempool. We still need that. But even still, this is a fundamental step forward in blockchain design. The next two years will give us time to refine the PeerDAS mechanism, carefully increase its scale while we continue to ensure its stability, use it to scale L2s, and then when ZK-EVMs are mature, turn it inwards to scale ethereum L1 gas as well. Big congrats to the Ethereum researchers and core devs who worked hard for years to make this happen.

I believe practical iO is not a distant dream or a purely theoretical concept, but rather a concrete collection of technical challenges! Please come to Obfuscation day tomorrow!

Thank you for your work. I’ve also researched pairing-based WE before. As far as I know, building WE for constraints beyond linear equations with pairings alone seems impossible. Does the article below explain your construction and security proof?

We had a few creative workarounds for this: - email keys rotate every 6mo, so you could have the og wallet just approve rotations (or other guardians) - we also had time locks on the rotation updates to prevent malicious oracles from stealing funds for N days - jwt keys rotate weekly, so that's annoying - DNSSEC is on for proton mail which is nice, no oracle

Excited to share our new paper! Inspired by the impact of lookup tables in programmable cryptography (ZKPs, FHE), we introduce lookup-table (LUT) evaluation over BGG+ encodings. We see this as an important step toward practical iO!