D-3.1 Encoding and Decoding

CKKS’s encoding and decoding is fundamentally very similar to BFV’s batch encoding scheme. BFV designs its batch encoding scheme (Summary D-2.3 in §D-2.3) based on the updated $\tilde{W}$ and ${\tilde{W}}^{\ast }$ matrices (Summary D-2.9.3 in §D-2.9). That is, BFV decodes a polynomial into an input slot vector by evaluating the polynomial at each root of $X^n+1$, which is the primitive $(\mu =2n)$-th root of unity (i.e., $\overrightarrow{v}={\tilde{W}}^{\ast }\cdot \overrightarrow{m}$), and encodes an input slot vector into a polynomial by inversing this operation (i.e., $\overrightarrow{m}=n^{-1}\cdot \tilde{W}\cdot I_n^R\cdot \overrightarrow{v}$). This encoding and decoding scheme is designed based on Summary A-10.7 (§A-10.7) which designs the isomorphic mapping between $n$-dimensional vectors in a ring (finite field) and $(n-1)$-degree (or lesser degree) polynomials as follows:

$\sigma :f(x)\in {\mathbb{Z}}_t[X]∕F(X)\to (f({\omega }^1),f({\omega }^3)),\cdots ,f({\omega }^{2n-1}))\in {\mathbb{Z}}_t^n$

, where $\omega =g^{\frac{t-1}{2n}}$ is a root of (i.e., primitive $(\mu =2n)$-th root of unity) of the $(\mu =2n)$-th cyclotomic polynomial $X^n+1$ defined over a prime modulo $t$ ring.

CKKS’s batch encoding scheme uses exactly the same formula for encoding and decoding (i.e., $\overrightarrow{v}=W^T\cdot \overrightarrow{m}$ and $\overrightarrow{m}={\displaystyle \frac{W\cdot I_n^R\cdot \overrightarrow{v}}{n}}$), but the $n$-dimensional input slot vector comprises not in a ring (i.e., ${\mathbb{Z}}_p^n$), but complex numbers (i.e., ${\widehat{ℂ}}^n$). In Summary A-10.7 (§A-10.7), we also designed the mapping ${\sigma }_c$ between polynomials and vectors over complex numbers as follows:

${\sigma }_c:f(X)\in ℝ[X]∕(X^n+1)\to (f(\omega ),f({\omega }^3),f({\omega }^5),\cdots ,f({\omega }^{2n-1}))\in {\widehat{ℂ}}^n(\to {ℂ}^{\frac{n}{2}})$

, where $\omega =e^{\mathit{𝑖𝜋}∕n}$ is a root (i.e., the primitive $(\mu =2n)$-th root) of the $(\mu =2n)$-th cyclotomic polynomial $X^n+1$ defined over complex numbers, and ${\widehat{ℂ}}^n$ is $n$-dimensional complex special vector space whose second-half elements are reverse-ordered conjugates of the first-half elements. And ${\widehat{ℂ}}^n$ is isomorphic to ${ℂ}^{\frac{n}{2}}$, because the second-half elements of ${\widehat{ℂ}}^n$ are automatically determined by its first-half elements. Therefore, the ${\sigma }_c$ mapping is essentially an isomorphism between ${\displaystyle \frac{n}{2}}$-dimensional complex vectors $\overrightarrow{v}\in {ℂ}^{\frac{n}{2}}$ and $(n-1)$-degree (or lesser degree) real-number polynomials $ℝ[X]∕(X^n+1)$. Therefore, CKKS’ batch encoding scheme encodes an ${\displaystyle \frac{n}{2}}$-dimensional complex input slot vector into an $(n-1)$-degree (or lesser degree) real-number polynomial, and the decoding process is a reverse of this.

In addition, remember that in BFV, we updated $W$ and $W^T$ to $\tilde{W}$ and ${\tilde{W}}^{\ast }$ (Summary D-2.9.3 in §D-2.9.3) to support homomorphic rotation of input vector slots. Likewise, the CKKS batch encoding scheme uses $\tilde{W}$ and ${\tilde{W}}^{\ast }$ instead of $W$ and $W^T$ in order to support homomorphic rotation. Therefore, the CKKS batch encoding scheme’s isomorphic mapping is updated as follows:

${\sigma }_c:f(X)\in ℝ[X]∕(X^n+1)\to (f({\omega }^{J(0)}),f({\omega }^{J(1)}),f({\omega }^{J(2)}),\cdots ,f({\omega }^{J(\frac{n}{2}-1)}),$

$f(X)\in ℝ[X]∕(X^n+1)\to ($ $\cdots ,f({\omega }^{J_{\ast }(0)}),f({\omega }^{J_{\ast }(1)}),f({\omega }^{J_{\ast }(2)}),\cdots ,f({\omega }^{J_{\ast }(\frac{n}{2}-1)}))\in {\widehat{ℂ}}^n(\to {ℂ}^{\frac{n}{2}})$

, where $J(h)=5^{h}mod2n$, a rotation helper formula.

The encoding schemes of BFV and CKKS have the following differences:

• Type of Input Slot Values: BFV’s input slot values are $n$-dimensional integer modulo $t$, which are encoded into $n$-dimensional polynomial coefficients (i.e., modulo-$t$ integers). On the other hand, CKKS’s input slot values are ${\displaystyle \frac{n}{2}}$-dimensional complex numbers, which are encoded into $n$-dimensional polynomial coefficients (i.e., real numbers).
• Type of Polynomial Coefficients: BFV’s encoded polynomial coefficients are integer moduli, whereas CKKS’s encoded polynomial coefficients are real numbers.
• Scaling Factor: Both BFV and CKKS scales their encoded polynomial coefficients $\overrightarrow{m}$ by $\mathrm{\Delta }$ to $\lceil \mathrm{\Delta }\cdot \overrightarrow{m}\rfloor$. BFV’s suggested scaling factor is $\mathrm{\Delta }=\lfloor {\displaystyle \frac{q_0}{t}}\rfloor$, but CKKS’s scaling factor $\mathrm{\Delta }$ has no suggested formula because its polynomial coefficients are real numbers not bound by modulus, and thus it can be any value provided that the scaled coefficients do not overflow or underflow the range $[1,q_0-1]$ (or $\left[-{\displaystyle \frac{q_0}{2}},{\displaystyle \frac{q_0}{2}}\right)$).
• Encoding Precision: In the case of BFV, during its decoding process, BFV’s down-scaled polynomial coefficients ${\displaystyle \frac{\mathrm{\Delta }\cdot \overrightarrow{m}}{\mathrm{\Delta }}}$ preserve the precision of input values . On the other hand, CKKS’s down-scaled polynomial coefficients may lose their precision if their original input values have too many decimal digits so that the scaling factor cannot left-shift all of them to make them part of the integer domain, which means that some lower decimal digits of the input value may be rounded off, which loses precision of the original input. For example, suppose the polynomial coefficient $m_i={\displaystyle \frac{1}{3}}=0.33333\cdots$, and the scaling factor $\mathrm{\Delta }=100$. Then, the scaled coefficient $\lceil \mathrm{\Delta }{m}_i\rfloor =33$, and down-scaling it gives ${\displaystyle \frac{33}{100}}=0.33$. Since $0.33\ne 0.33333\cdots$, CKKS’s encoding and decoding process does not always guarantee exact precision. Due to this encoding error, CKKS is called an approximate encryption scheme. The impact of this encoding error can grow over homomorphic operations which increases the magnitude of error and the decoded result would gradually become more deviated from the expected exact value. One way to reduce CKKS’s encoding error is to increase $\mathrm{\Delta }$, and thereby left-shift more decimal digits to make them part of the scaled integer digits.

Structure of ${\overrightarrow{v}}_{{}^{\prime }}\in {\widehat{ℂ}}^n$: Note that the original decoding scheme for ${\overrightarrow{v}}_{{}^{\prime }}$ described in Summary A-10.7 (§A-10.7) was:

${\overrightarrow{v}}_{{}^{\prime }}=(M(\omega ),M({\omega }^3),M({\omega }^5),\cdots ,M({\omega }^{2n-3}),M({\omega }^{2n-1}))$

, which decodes to a Hermitian vector:

${\overrightarrow{v}}_{{}^{\prime }}=(v_0,v_1,\cdots ,v_{\frac{n}{2}-1},{\overline{v}}_{\frac{n}{2}-1},\cdots ,{\overline{v}}_1,{\overline{v}}_0)$

, whose second-half elements are reverse-ordered conjugates of the first-half elements.

However, by replacing $W$ and $W^T$ with $\tilde{W}$ and ${\tilde{W}}^{\ast }$, we changed the above decoding scheme to the following that supports homomorphic rotation:

${\overrightarrow{v}}_{{}^{\prime }}=(M({\omega }^{J(0)}),M({\omega }^{J(1)}),M({\omega }^{J(2)}),\cdots ,M({\omega }^{J(\frac{n}{2}-1)}),M({\omega }^{J_{\ast }(0)}),M({\omega }^{J_{\ast }(1)}),\cdots ,M({\omega }^{J_{\ast }(\frac{n}{2}-1)}))$

${\overrightarrow{v}}_{{}^{\prime }}=(M({\omega }^{J(0)}),M({\omega }^{J(1)}),M({\omega }^{J(2)}),\cdots ,M({\omega }^{J(\frac{n}{2}-1)}),M({\overline{\omega }}^{J(0)}),M({\overline{\omega }}^{J(1)}),\cdots ,M({\overline{\omega }}^{J(\frac{n}{2}-1)}))$

# because ${\omega }^{-1}={(e^{\frac{\mathit{𝑖𝜋}}{n}})}^{-1}=e^{\frac{-\mathit{𝑖𝜋}}{n}}=\overline{\omega }$

, which decodes to a forward-ordered (not reverse-ordered) Hermitian vector as follows:

${\overrightarrow{v}}_{{}^{\prime }}=(v_0,v_1,\cdots ,v_{\frac{n}{2}-1},{\overline{v}}_0,{\overline{v}}_1,\cdots ,{\overline{v}}_{\frac{n}{2}-1},)$

, whose second-half elements are conjugates of the first-half elements with the same order. Upon homomorphic rotation (which will be explained in §D-3.9), just like in BFV’s homomorphic rotation, the first-half elements and the second-half elements of ${\overrightarrow{v}}_{{}^{\prime }}$ rotate within their own group in a wrapping manner.

We summarize CKKS’s encoding and decoding procedure as follows, which is similar to BFV’s encoding and decoding procedure (described in Summary D-2.2.5 in §D-2.2.5):

CKKS’s Approximation Property: In the encoding process, when we convert ${\overrightarrow{v}}_{{}^{\prime }}\to \overrightarrow{m}\to \mathrm{\Delta }\overrightarrow{m}$, we multiply ${\overrightarrow{v}}_{{}^{\prime }}$ by $\tilde{W}$ which contains real numbers with infinite decimals (e.g., $\sqrt{2}$) coming from Euler’s formula, which we should round to the nearest integer by computing $\lceil \mathrm{\Delta }m\rfloor$ (which we will denote as $\mathrm{\Delta }m$ throughout this section for simplicity) and thus we lose some precision. This implies that if we later decode $\mathrm{\Delta }\overrightarrow{m}$ into ${\overrightarrow{v}}_{{}^{\prime }d}$, this value would be slightly different from the original input vector ${\overrightarrow{v}}_{{}^{\prime }}$. As CKKS’s encoding scheme is subject to such a small rounding error, the decryption does not perfectly match the original input vector. Such errors also propagate across homomorphic computations, because those computations are done based on approximately encoded plaintext $\lceil \mathrm{\Delta }\overrightarrow{m}\rfloor$. As these errors are caused by throwing away the infinitely long decimal digits, they can be corrected during the decoding process only if we use an infinitely big scaling factor $\mathrm{\Delta }$, which is impossible because $\mathrm{\Delta }{m}_i$ should not overflow the ciphertext modulus $q_0$ of the lowest multiplicative level. Due to this limitation, CKKS is considered an approximate homomorphic encryption.

D-3.1.1 Example

Suppose our input complex vector’s dimension ${\displaystyle \frac{n}{2}}=2$, the bounding polynomial degree $n$ = 4, and the scaling factor $\mathrm{\Delta }=1024$.

Our basis of the $n$-dimensional vector space

$\tilde{W}=\left[\begin{array}{cccc}\hfill 1\hfill & \hfill 1\hfill & \hfill 1\hfill & \hfill 1\hfill \\ \hfill {\omega }^{J(1)}\hfill & \hfill {\omega }^{J(0)}\hfill & \hfill {\overline{\omega }}^{J(1)}\hfill & \hfill {\overline{\omega }}^{J(0)}\hfill \\ \hfill {({\omega }^{J(1)})}^2\hfill & \hfill {({\omega }^{J(0)})}^2\hfill & \hfill {({\overline{\omega }}^{J(1)})}^2\hfill & \hfill {({\overline{\omega }}^{J(0)})}^2\hfill \\ \hfill {({\omega }^{J(1)})}^3\hfill & \hfill {({\omega }^{J(0)})}^3\hfill & \hfill {({\overline{\omega }}^{J(1)})}^3\hfill & \hfill {({\overline{\omega }}^{J(0)})}^3\hfill \end{array}\right]$ $=\left[\begin{array}{cccc}\hfill 1\hfill & \hfill 1\hfill & \hfill 1\hfill & \hfill 1\hfill \\ \hfill {\omega }^5\hfill & \hfill \omega \hfill & \hfill {\overline{\omega }}^5\hfill & \hfill \overline{\omega }\hfill \\ \hfill {\omega }^2\hfill & \hfill {\omega }^2\hfill & \hfill \overline{{\omega }^2}\hfill & \hfill {\overline{\omega }}^2\hfill \\ \hfill {\omega }^7\hfill & \hfill {\omega }^3\hfill & \hfill {\overline{\omega }}^7\hfill & \hfill {\overline{\omega }}^3\hfill \end{array}\right]$

, where $\omega =e^{\mathit{𝑖𝜋}∕n}=\cos <!--\; FUNCTION\; APPLICATION\; -->\left({\displaystyle \frac{\pi }{n}}\right)+i\sin <!--\; FUNCTION\; APPLICATION\; -->\left({\displaystyle \frac{\pi }{n}}\right)$

Given this setup, suppose we have the input complex vector $\overrightarrow{v}=(1.1+4.3i,3.5-1.4i)$ to encode.

First, construct the forward-ordered Hermitian vector ${\overrightarrow{v}}_{{}^{\prime }}=(1.1+4.3i,3.5-1.4i,1.1-4.3i,3.5+1.4i)$.

Next, convert the complex vector ${\overrightarrow{v}}_{{}^{\prime }}$ into a real number vector $\overrightarrow{m}$ by applying the transformation:

$\overrightarrow{m}={\displaystyle \frac{\tilde{W}\cdot I_n^R\cdot {\overrightarrow{v}}_{{}^{\prime }}}{n}}={\displaystyle \frac{1}{4}}\cdot \left[\begin{array}{cccc}\hfill 1\hfill & \hfill 1\hfill & \hfill 1\hfill & \hfill 1\hfill \\ \hfill {\omega }^5\hfill & \hfill \omega \hfill & \hfill {\overline{\omega }}^5\hfill & \hfill \overline{\omega }\hfill \\ \hfill {\omega }^2\hfill & \hfill {\omega }^2\hfill & \hfill {\overline{\omega }}^2\hfill & \hfill {\overline{\omega }}^2\hfill \\ \hfill {\omega }^7\hfill & \hfill {\omega }^3\hfill & \hfill {\overline{\omega }}^7\hfill & \hfill {\overline{\omega }}^3\hfill \end{array}\right]\cdot \left[\begin{array}{cccc}\hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 1\hfill \\ \hfill 0\hfill & \hfill 0\hfill & \hfill 1\hfill & \hfill 0\hfill \\ \hfill 0\hfill & \hfill 1\hfill & \hfill 0\hfill & \hfill 0\hfill \\ \hfill 1\hfill & \hfill 0\hfill & \hfill 0\hfill & \hfill 0\hfill \end{array}\right]\cdot \left[\begin{array}{c}\hfill 1.1+4.3i\hfill \\ \hfill 3.5-1.4i\hfill \\ \hfill 1.1-4.3i\hfill \\ \hfill 3.5+1.4i\hfill \end{array}\right]$

$={\displaystyle \frac{W\cdot I_n^R\cdot {\overrightarrow{v}}_{{}^{\prime }}}{n}}={\displaystyle \frac{1}{4}}\cdot \left[\begin{array}{cccc}\hfill 1\hfill & \hfill 1\hfill & \hfill 1\hfill & \hfill 1\hfill \\ \hfill \overline{\omega }\hfill & \hfill {\overline{\omega }}^5\hfill & \hfill \omega \hfill & \hfill {\omega }^5\hfill \\ \hfill {\overline{\omega }}^2\hfill & \hfill {\overline{\omega }}^2\hfill & \hfill {\omega }^2\hfill & \hfill {\omega }^2\hfill \\ \hfill {\overline{\omega }}^3\hfill & \hfill {\overline{\omega }}^7\hfill & \hfill {\omega }^3\hfill & \hfill {\omega }^7\hfill \end{array}\right]\cdot \left[\begin{array}{c}\hfill 1.1+4.3i\hfill \\ \hfill 3.5-1.4i\hfill \\ \hfill 1.1-4.3i\hfill \\ \hfill 3.5+1.4i\hfill \end{array}\right]$

$={\displaystyle \frac{1}{4}}\cdot \left[\begin{array}{c}\hfill (1.1+4.3i)+(3.5-1.4i)+(1.1-4.3i)+(3.5+1.4i)\hfill \\ \hfill (1.1+4.3i)\overline{\omega }+(3.5-1.4i){\overline{\omega }}^5+(1.1-4.3i)\omega +(3.5+1.4i){\omega }^5\hfill \\ \hfill (1.1+4.3i)\overline{{\omega }^2}+(3.5-1.4i)\overline{{\omega }^2}+(1.1-4.3i){\omega }^2+(3.5+1.4i){\omega }^2\hfill \\ \hfill (1.1+4.3i){\overline{\omega }}^3+(3.5-1.4i){\overline{\omega }}^7+(1.1-4.3i){\omega }^3+(3.5+1.4i){\omega }^7\hfill \end{array}\right]$

$={\displaystyle \frac{1}{4}}\cdot \left[\begin{array}{c}\hfill (1.1+4.3i)+(3.5-1.4i)+(1.1-4.3i)+(3.5+1.4i)\hfill \\ \hfill (1.1+4.3i)+(3.5-1.4i){\overline{\omega }}^5+(1.1-4.3i)\omega +(3.5+1.4i){\omega }^5\hfill \\ \hfill (1.1+4.3i)\overline{{\omega }^2}+(3.5-1.4i)\overline{{\omega }^2}+(1.1-4.3i){\omega }^2+(3.5+1.4i){\omega }^2\hfill \\ \hfill (1.1+4.3i){\overline{\omega }}^3+(3.5-1.4i){\overline{\omega }}^7+(1.1-4.3i){\omega }^3+(3.5+1.4i){\omega }^7\hfill \end{array}\right]$

$={\displaystyle \frac{1}{4}}\cdot \left[\begin{array}{c}\hfill 9.2\hfill \\ \hfill 1.1(\overline{\omega }+\omega )+4.3i(\overline{\omega }-\omega )+3.5({\overline{\omega }}^5+{\omega }^5)-1.4i({\overline{\omega }}^5-{\omega }^5)\hfill \\ \hfill 1.1({\overline{\omega }}^2+{\omega }^2)+4.3i({\overline{\omega }}^2-{\omega }^2)+3.5({\overline{\omega }}^2+{\omega }^2)-1.4i({\overline{\omega }}^2-{\omega }^2)\hfill \\ \hfill 1.1({\overline{\omega }}^3+{\overline{\omega }}^3)+4.3i({\overline{\omega }}^3-{\overline{\omega }}^3)+3.5({\overline{\omega }}^7+{\overline{\omega }}^7)-1.4i({\overline{\omega }}^7-{\overline{\omega }}^7)\hfill \end{array}\right]$

$={\displaystyle \frac{1}{4}}\cdot \left[\begin{array}{c}\hfill 9.2\hfill \\ \hfill 1.1\left(2\cos <!--\; FUNCTION\; APPLICATION\; -->{\displaystyle \frac{\pi }{4}}\right)-4.3i\left(2i\sin <!--\; FUNCTION\; APPLICATION\; -->{\displaystyle \frac{\pi }{4}}\right)+3.5\left(2\cos <!--\; FUNCTION\; APPLICATION\; -->{\displaystyle \frac{5\pi }{4}}\right)+1.4i\left(2i\sin <!--\; FUNCTION\; APPLICATION\; -->{\displaystyle \frac{5\pi }{4}}\right)\hfill \\ \hfill 1.1\left(2\cos <!--\; FUNCTION\; APPLICATION\; -->{\displaystyle \frac{\pi }{2}}\right)-4.3i\left(2i\sin <!--\; FUNCTION\; APPLICATION\; -->{\displaystyle \frac{\pi }{2}}\right)+3.5\left(2\cos <!--\; FUNCTION\; APPLICATION\; -->{\displaystyle \frac{\pi }{2}}\right)+1.4i\left(2i\sin <!--\; FUNCTION\; APPLICATION\; -->{\displaystyle \frac{\pi }{2}}\right)\hfill \\ \hfill 1.1\left(2\cos <!--\; FUNCTION\; APPLICATION\; -->{\displaystyle \frac{3\pi }{4}}\right)-4.3i\left(2i\sin <!--\; FUNCTION\; APPLICATION\; -->{\displaystyle \frac{3\pi }{4}}\right)+3.5\left(2\cos <!--\; FUNCTION\; APPLICATION\; -->{\displaystyle \frac{7\pi }{4}}\right)+1.4i\left(2i\sin <!--\; FUNCTION\; APPLICATION\; -->{\displaystyle \frac{7\pi }{4}}\right)\hfill \end{array}\right]$

$={\displaystyle \frac{1}{4}}\cdot \left[\begin{array}{c}\hfill 9.2\hfill \\ \hfill 1.1\left(2{\displaystyle \frac{\sqrt{2}}{2}}\right)+4.3\left(2{\displaystyle \frac{\sqrt{2}}{2}}\right)+3.5\left(-2{\displaystyle \frac{\sqrt{2}}{2}}\right)-1.4\left(-2{\displaystyle \frac{\sqrt{2}}{2}}\right)\hfill \\ \hfill 1.1(2\cdot 0)+4.3(2\cdot 1)+3.5(2\cdot 0)-1.4(2\cdot 1)\hfill \\ \hfill 1.1\left(2-{\displaystyle \frac{\sqrt{2}}{2}}\right)+4.3\left(2{\displaystyle \frac{\sqrt{2}}{2}}\right)+3.5\left(2{\displaystyle \frac{\sqrt{2}}{2}}\right)-1.4\left(-2{\displaystyle \frac{\sqrt{2}}{2}}\right)\hfill \end{array}\right]$

$=0.25\cdot \left[\begin{array}{c}\hfill 9.2\hfill \\ \hfill 1.1\sqrt{2}+4.3\sqrt{2}-3.5\sqrt{2}+1.4\sqrt{2}\hfill \\ \hfill 1.1(0)+4.3(2)-3.5(0)-1.4(2)\hfill \\ \hfill -1.1\sqrt{2}+4.3\sqrt{2}+3.5\sqrt{2}+1.4\sqrt{2}\hfill \end{array}\right]=\left[\begin{array}{c}\hfill 2.3\hfill \\ \hfill 0.825\sqrt{2}\hfill \\ \hfill 1.45\hfill \\ \hfill 2.025\sqrt{2}\hfill \end{array}\right]\approx (2.3,1.1657,1.45,2.8638)$

Convert the real number vector $\overrightarrow{m}$ into a scaled integer vector $\mathrm{\Delta }\overrightarrow{m}$ by $\mathrm{\Delta }$-scaling and rounding as follows:

$\mathrm{\Delta }\overrightarrow{m}\approx \lceil \mathrm{\Delta }\overrightarrow{m}\rfloor =\lceil 1024\cdot (2.3,1.1657,1.45,2.8638)\rfloor =(2355,1195,1485,2933)$

Finally, $\overrightarrow{v}=(1.1+4.3i,3.5-1.4i)$ has been encoded into the plaintext polynomial $M(X)$ as follows:

$\mathrm{\Delta }M(X)=2355+1195X+1485X^2+2933X^3\in R_{⟨4⟩}$

To decode $\overrightarrow{m}$, we compute:

${\overrightarrow{v}}_{{}^{\prime }}={\displaystyle \frac{W^T\cdot \mathrm{\Delta }\overrightarrow{m}}{\mathrm{\Delta }}}=\left[\begin{array}{c}\hfill 1,\omega ,{\omega }^2,{\omega }^3\hfill \\ \hfill 1,{\omega }^3,{\omega }^6,\omega \hfill \\ \hfill 1,\overline{\omega },\overline{{\omega }^2},\overline{{\omega }^3}\hfill \\ \hfill 1,\overline{{\omega }^3},\overline{{\omega }^6},\overline{\omega }\hfill \end{array}\right]$ $\cdot \left[\begin{array}{c}\hfill 2355\hfill \\ \hfill 1195\hfill \\ \hfill 1485\hfill \\ \hfill 2933\hfill \end{array}\right]\cdot {\displaystyle \frac{1}{1024}}$

$=\left[\begin{array}{c}\hfill 1,{\displaystyle \frac{\sqrt{2}}{2}}+{\displaystyle \frac{i\sqrt{2}}{2}},i,-{\displaystyle \frac{\sqrt{2}}{2}}+{\displaystyle \frac{i\sqrt{2}}{2}}\hfill \\ \hfill 1,-{\displaystyle \frac{\sqrt{2}}{2}}+{\displaystyle \frac{i\sqrt{2}}{2}},-i,{\displaystyle \frac{\sqrt{2}}{2}}+{\displaystyle \frac{i\sqrt{2}}{2}}\hfill \\ \hfill 1,{\displaystyle \frac{\sqrt{2}}{2}}-{\displaystyle \frac{i\sqrt{2}}{2}},-i,-{\displaystyle \frac{\sqrt{2}}{2}}-{\displaystyle \frac{i\sqrt{2}}{2}}\hfill \\ \hfill 1,-{\displaystyle \frac{\sqrt{2}}{2}}-{\displaystyle \frac{i\sqrt{2}}{2}},i,{\displaystyle \frac{\sqrt{2}}{2}}-{\displaystyle \frac{i\sqrt{2}}{2}}\hfill \end{array}\right]$ $\cdot \left[\begin{array}{c}\hfill 2.2998046875\hfill \\ \hfill 1.1669921875\hfill \\ \hfill 1.4501953125\hfill \\ \hfill 2.8642578125\hfill \end{array}\right]$

$\approx (1.0997+4.3007i,3.5000-1.4003i,1.0997-4.3007i,3.5000+1.4003i)$

Extract the first ${\displaystyle \frac{n}{2}}=2$ elements in the Hermitian vector ${\overrightarrow{v}}_{{}^{\prime }}$ to recover the input vector:

$(1.0997+4.3007i,3.5000-1.4003i)$

$\approx (1.1+4.3i,3.5-1.4i)=\overrightarrow{v}$ # The original input vector

Because of the rounding drifts for converting square roots into integers, the decoded value is slightly different from the original input complex values. This is why CKKS is called an approximate homomorphic encryption.

Source Code: Examples of CKKS encoding can be executed by running this Python script.