C-4.3 Discussion

Reduced Distance between $m$ and $e$: After modulus switching of an LWE ciphertext from $q\to \widehat{q}$, the underlying plaintext (containing a noise) $\mathrm{\Delta }m+e$ gets shrunk to $\widehat{\mathrm{\Delta }}m+\widehat{e}$, as illustrated in Figure 12. Note that after the modulus switch from $q\to \widehat{q}$, $\mathrm{\Delta }m$ is down-scaled to $\widehat{\mathrm{\Delta }}m$ without losing its bit data. Notably, the plaintext value $m$ stays the same after the modulus switch, while its scaling factor $\mathrm{\Delta }$ gets reduced to $\widehat{\mathrm{\Delta }}$ and the noise $e$ gets reduced to $\widehat{e}$. However, after the modulus switch, the distance between $\widehat{e}$’s MSB and $\widehat{\mathrm{\Delta }}m$’s LSB gets reduced compared to the distance between $e$’s MSB and $\mathrm{\Delta }m$’s LSB.