Research proof index

The k-th coefficient (k < deg φ) of a gadget-decomposition block is exactly the corresponding digit of the corresponding input coefficient.

Each gadget-decomposition block is ℓ₂²-short: its centered squared-ℓ₂ norm is at most (deg φ)·(b-1)² (each of the deg φ coefficients contributes at most (b-1)²).

ℓ₂² shortness of G⁻¹. The full gadget decomposition has centered squared-ℓ₂ norm at most (rows·digits)·(deg φ)·(b-1)².

Core recomposition coefficient bound. Each centered coefficient of an entry of the gadget product G_{b,rows} ·ᵥ v is at most (∑_{u<digits} bᵘ) · γ whenever ‖v‖∞ ≤ γ. The wraparound of the ZMod q powers bᵘ is immaterial: the integer ∑ₑ bᵉ·valMinAbs(vₑ.coeff k) is an explicit representative of the output coefficient, and the centered represe...

The J-recomposition ℓ₂² chain. From the range check ‖ẑ‖∞ ≤ γ (Eq. (20)'s ẑ ∈ S_b, symmetric model), the recomposed z = J·ẑ satisfies ‖z‖₂² ≤ zRecomposeL2SqBound γ b τ (deg φ) rows , no primitive ‖z‖₂² verifier check is needed.

Core digit bound. Each base-b digit of zmodDigitDecomposition, viewed as a centered residue, has absolute value at most b - 1 , provided b - 1 ≤ q/2, so the digit (a natural number < b) does not wrap to a negative centered representative.