I see this term accumulator bit-width mentioned in a lot of places. Is this restricted by the underlying TFHE precision? I read somewhere that under common security parameters, TFHE is limited to around 6 bits of precision. In concrete-ML, the max supported bitwidth is 16. Is this achieved by decomposing large numbers into individual bits and compute the circuit of adds/multiplies for each bit? This way you techinically only need 1 bit of precision.
In general I would like to read more about what’s going on under the hood, which docs should I refer to?
Yes, the accumulator bitwidth that we spoke about in the doc or papers is related to the precision of TFHE. More or less, we compute y, which is the dot product of the inputs x and the weights, and then, we apply the activation on y:
y = sum w_i x_i
z = Activation(y)
y is what we call the accumulator, and its bitwidth is how many bits y has. TFHE is not limited to 6 bits: currently, we support up to 16 bits, and we’ll add more and more precision. Under the hood, there is a maximal block size (which is about 8b, depending on some other parameters) and yes, 16 bit numbers are split in blocks of small sizes, and recombined when needed.
If you are a user: just keep as a take away that Concrete-ML (and other Zama’s products) supports up to 16b
If you are a curious cryptographer: you may have a look to Parameter Optimization & Larger Precision for (T)FHE, which is highly technical, where they explain how this split technique is done in the compiler, below Concrete-Numpy and Concrete-ML.