PaperlayerView exact revision on arXiv

Source-linked AI summary

NOMAI: Scalable Federated Learning with Private Weights

Yiyi Sun, Mushtari Sadia, Amrita Roy Chowdhury

arXiv:2610.21059v1cs.CR

TL;DR

Federated learning must protect user data, server-held model weights, and integrity while operating with one coordinator and millions of users, a combination prior work had not fully achieved. NOMAI combines committee-based MPC, packed Shamir secret sharing, and ML-aware cryptographic optimizations. It reports per-user MNIST iteration costs below 350 ms in the semi-honest setting and below 700 ms in the malicious setting, supporting populations over 10^6 users.

  • Problem

    Providing data privacy, model-weight privacy, and integrity in single-server federated learning at millions-of-users scale remains an open challenge.

    Source: §1 · p. 1

  • Method

    NOMAI uses committee-based MPC with packed Shamir secret sharing, alongside ML-aware optimizations and new cryptographic primitives.

    Source: §1 · p. 2

  • Results

    <350 ms (semi-honest) and <700 ms (malicious) per user per MNIST training iteration, with populations over 10^6 users.

    Source: §1 · p. 2

  • Takeaways & Limitations

    NOMAI is presented as a scalable single-server FL system that provides data privacy, weight privacy, and integrity.

    Source: §1 · p. 2, §9 · p. 13

    The guarantees depend on the stated threat model, including an honest-majority assumption and the malicious-with-abort setting.

    Source: Ethical Considerations · p. 14

Abstract

from arXiv · show

The twin goals of privacy-preserving federated learning (FL) -- harnessing distributed data while protecting the parties who contribute it -- demands three properties: model privacy, data privacy, and integrity. Achieving all three in a realistic deployment -- with a single coordinator and millions of users -- remains an open challenge that prior work has yet to fully resolve. We present NOMAI, the first scalable MPC-based FL system to provide all three guarantees simultaneously. NOMAI operates under an honest-majority assumption in the semi-honest model, with an extension to the malicious-with-abort setting. At its core, NOMAI combines a multi-committee MPC architecture with packed Shamir secret sharing, enabling SIMD-style secure computation that scales far beyond what monolithic n-party protocols can support. We further introduce ML-aware optimizations and new cryptographic primitives that substantially reduce per-user overhead. Our evaluation shows NOMAI is practically deployable at unprecedented scale: it reduces per-user computation to just <350 ms (semi-honest) and <700 ms (malicious) for per iteration of training MNIST, achieving three orders-of-magnitude improvements over prior work while seamlessly supporting populations of over 106 users. This demonstrates, for the first time, that MPC-based FL can meet the scale demands of real-world systems without compromising on privacy or integrity.

1 Introduction

NOMAI addresses the challenge of providing data privacy, model-weight privacy, and integrity in single-server federated learning that scales to millions of users. It combines committee-based MPC and packed secret sharing with ML-aware and cryptographic optimizations.

1 Introduction

  • Prior work had not resolved how to provide all three guarantees at scale in a single-server deployment; POSEIDON lacks integrity and supports only semi-honest security.Other scalable single-server approaches reveal model weights to users, while protocols with all three guarantees assume multiple non-colluding servers.Source: §1 · p. 1
  • NOMAI uses small, disjoint user committees as MPC helpers, with parallel computation and packed Shamir secret sharing to reduce per-helper workload.The architecture retains one coordinating server and is designed for commodity user hardware.Source: §1 · p. 2
  • For linear layers, NOMAI reduces MPC overhead with convolution transformations and packing strategies for convolutional and fully connected layers under PSS.The authors describe these as the first such optimizations for PSS in ML training.Source: §1 · p. 2
  • NOMAI adds protocols to reduce secure-exponentiation rounds, support degree-reduction repacking across layouts, and perform truncation.The exponentiation protocol accelerates polynomial evaluation, especially for nonlinear layers approximated by high-degree polynomials.Source: §1 · p. 2
  • <350 ms (semi-honest) and <700 ms (malicious) per user per MNIST training iteration, with populations over 10^6 users.The introduction reports 10^3 orders-of-magnitude improvement over prior work.Source: §1 · p. 2

2 Background

The background introduces secret-sharing primitives used for secure computation and describes neural-network training operations, including Winograd convolution.

2.1 Cryptographic Primitives

  • Shamir secret sharing distributes a secret through polynomial evaluations: t shares reveal nothing, while t + 1 reconstruct the secret.The scheme supports local addition and multiplication by public constants; multiplying sharings increases the polynomial degree and requires degree reduction.Source: §2.1 · p. 2
  • Packed secret sharing encodes multiple secrets in one polynomial sharing, enabling slot-wise SIMD computation while t shares reveal nothing.The sharing degree is t + l − 1 for l packed values; multiplication increases the degree and requires reduction.Source: §2.1 · p. 2
  • Additive sharing represents a value as the sum of local contributions held across parties.Source: §2.1 · p. 2

2.2 Machine Learning Primitives

  • Neural-network training alternates forward and backward passes; forward computation includes convolution or fully connected layers, activation, and loss.Winograd convolution transforms input tiles and kernels, multiplies them element-wise, then maps the result back to output tiles.Source: §2.2 · pp. 2–3

3 Problem Setting

The problem setting specifies the single-server federated-learning task, its security goals, and deployment constraints for NOMAI.

3 Problem Setting

  • N users each hold private data, and a single coordinating server trains a global model by aggregating their local gradients each round.Source: §3 · p. 3

3.1 Security Goals

  • The goals are to protect user data and server-held model weights, and, in the malicious setting, validate that individual gradients are well formed.The setting allows an η fraction of adversarial users; selected users are assumed to remain online through an iteration, with dropout tolerance described separately.Source: §3.1 · p. 3

3.2 Design Goals

  • NOMAI must retain one coordinating server, avoid requiring user pre-processing, and keep user-side computation efficient.Lightweight helpers are permitted, but additional non-colluding servers are not; users may do independent local pre-computation.Source: §3.2 · p. 3

4 Technical Overview

NOMAI addresses the cost of secure training in a single-coordinator FL setting by splitting users across parallel MPC committees and using packed Shamir sharing. It combines this architecture with ML-specific and protocol optimizations, including an integrity-aware route to malicious security.

Single Coordinator Deployment

  • Parallel committees reduce secure computation from an N-party to an n-party protocol, while packed Shamir sharing encodes l values per share for SIMD computation.Each user’s data is assigned to a committee; committees compute local gradient aggregates that are combined into the global aggregate.Source: §4 · pp. 3–4

Eliminating pre-processing

  • NOMAI eliminates correlated randomness for multiplications and avoids non-linear-operation overhead using Mersenne primes and user-supplied randomness under packed Shamir sharing.Degree reduction remains a bottleneck, so NOMAI targets both its number and cost.Source: §4 · p. 4

Efficient Linear Layers

  • Winograd convolution reduces multiplication counts, while packing strategies tailored to packed Shamir sharing align data layout with computation across convolutional and fully connected layers.The strategies reduce non-scalar multiplications and costly degree-reduction steps.Source: §4 · p. 4

Efficient Secure Exponentiation

  • NOMAI’s exponentiation approach converts a packed Shamir sharing of x into q additive shares and computes x^k with logq rounds of degree reduction.The reduced sequential depth helps when logq is less than logk, as with realistic corruption levels and high-degree polynomials.Source: §4 · p. 4

Efficient Malicious Security

  • NOMAI runs expensive gradient computation with a semi-honest protocol, then checks gradient validity and securely aggregates only well-formed gradients.The authors state that malicious behavior is detected unless it is restricted to manipulations that pass the validity check.Source: §4 · p. 5

5 Protocol Details

NOMAI’s building blocks adapt linear layers, exponentiation, degree reduction, and truncation to packed Shamir secret sharing (PSS). Their design reduces expensive secure operations while allowing packed layouts to change across layers.

5.1.1 Convolutional Layers

  • Winograd reduces an m×m output block with an r×r kernel from m^2r^2 multiplications to T^2, and packing the same coordinate across tiles keeps transform coefficients uniform across slots.This makes the transforms local operations under PSS, avoiding secret-sharing public coefficients and extra secret-secret multiplication rounds.Source: §5.1.1 · p. 5

5.1.2 Fully Connected Layers

  • Fully connected layers use diagonal matrix multiplication and chunk each length-n2 diagonal into PSS-sized pieces while preserving the diagonal structure.The rotation is applied to the full logical diagonal before chunking; arbitrary dimensions are handled in row blocks using h = gcd(n1,n2).Source: §5.1.2 · p. 6

5.2 Efficient Secure Exponentiation

  • Exponentiation uses a multinomial decomposition so local powers leave only a product requiring O(logq) degree-reduction rounds, independent of k.The approach is beneficial when 2+logq < logk; for q = 2 it needs one degree-reduction round.Source: §5.2 · p. 7

5.3 Efficient Degree Reduction

  • Degree reduction converts degree-2d shares back to fresh degree-d PSS by recovering the secret slots, re-encoding them, and randomizing the remaining degrees of freedom.The resharing protocol takes one communication round.Source: §5.3 · pp. 7–8

5.3.1 Degree Reduction with Repacking

  • Repacking can be fused into degree reduction by applying a public linear map to secret slots before encoding the new degree-d sharing.Slot permutations and more general repacking across one or more PSSs require no extra interaction cost.Source: §5.3.1 · p. 8

5.3.2 Cost and Comparison

  • One online round and O(n) communication suffice for DegRed-Repack, while DIK is preferable when communication dominates and NOMAI when layout changes and computation matter.Basic degree reduction uses O(n) online computation; with repacking, each message costs 2s+logn field operations when an output depends on s inputs.Source: §5.3.2 · p. 8

5.4 Truncation

  • Truncation adapts masked fixed-point truncation to PSS with packed randomness and slot-specific sparse corrections, preventing corrections from affecting unintended slots.The construction extends to fixed-point multiplication with degree-2d inputs and a degree-d output sharing.Source: §5.4 · pp. 8–9

6 NOMAI Description

NOMAI assigns users to committees that share data, compute packed gradient shares, and aggregate them into a global result. Its malicious extension adds gradient validation and consistency checks while retaining semi-honest computation for the expensive gradient work.

6.1 Data Sharing Phase

  • Users first share masked data before committee assignment; after election, targeted unmasking lets committees assemble packed inputs locally without additional communication.A public-randomness-derived permutation determines committee membership, user assignments, and packed-vector slots.Source: §6.1 · p. 9, §6.1.1 · p. 9

6.2.1 Forward Pass

  • Committees independently compute packed gradients using secure layer primitives, with PolyReLU approximations and ML-aware optimizations in the forward pass.Different layer layouts are repacked at transitions through degree reduction; truncation may be delayed for bounded multiplications when range analysis rules out wraparound.Source: §6.2 · p. 10, §6.2.1 · p. 10

6.2.2 Backward Pass

  • The backward pass reuses packed Winograd computation and chunked diagonal representations, keeping fully connected weight gradients aligned by retaining lower-diagonal gradients and using rotated input copies.This increases computation but preserves the forward protocol’s communication-round structure.Source: §6.2.2 · p. 10

6.3 Aggregation Phase

  • For aggregation, committees skip the final degree reduction, rerandomize the degree-2d shares, and transfer them to a primary committee for summation and reconstruction.The degree-2d sharing hides the l secrets against up to 2t+l−1 shares, so t shares from each of two committees reveal only 2t shares.Source: §6.3 · p. 11

6.4 Extension to Malicious Threat Model

  • Malicious security requires validity checks because secure aggregation alone cannot prevent users from submitting malformed data; NOMAI runs expensive gradient computation semi-honestly and applies malicious security during validation and aggregation.This design slightly relaxes the threat model.Source: §6.4 · p. 11

6.4.1 Weight Consistency

  • Committees check that all received model weights match by combining randomized differences and testing the result without revealing the weights.SCRAPE checks that transmitted shares and packed slots lie on one degree-(d+t) polynomial, with soundness error at most 1/|Fp|.Source: §6.4.1 · p. 11

6.4.2 Gradient Validation and Aggregation

  • Committees evaluate a validity predicate on each user’s gradient and aggregate only accepted gradients.A norm bound is one example; validation can use secure comparison and multiplication protocols.Source: §6.4.2 · p. 11
  • The relaxed approach does not eliminate protocol deviations, but constrains their effect to perturbations that leave a gradient valid; private predicate parameters and rejection-rate monitoring further limit influence.The primary committee also checks degree-2t shares before aggregation, with the stated condition t < l.Source: §6.4.2 · p. 11, Table 2 · p. 12

7 Security Analysis

NOMAI’s security analysis states its ideal functionality and claims realization against a static malicious adversary corrupting one server and up to an η fraction of users.

7 Security Analysis

  • The ideal functionality aborts if committee safety is insufficient or server-distributed weights differ, and outputs the aggregate of valid gradients with specified adversarial perturbations.It also returns each committee’s number of rejected gradients.Source: §7 · p. 12
  • The stated protocol allows only additive adversarial errors for honest users.Source: §7 · p. 12
  • Theorem 2 states that NOMAI achieves the ideal functionality against a static malicious adversary corrupting one server and up to an η fraction of users.The paper says the proof is in Appendix D.Source: §7 · p. 12

8 Evaluation

NOMAI is evaluated across six datasets and workloads against secure-training baselines, then tested for scaling with user population, model architecture, and corruption rate. Its per-machine costs remain low against prior systems and are nearly independent of user count in the semi-honest setting.

8 Evaluation

  • The evaluation uses six public datasets, fully connected models for BCW, Credit, and CIFAR-10, and compact CNNs for MNIST, FashionMNIST, and SVHN.Experiments span N = 1K–1M users, c = 1–25,000 committees, and l = 10–50.Source: §8 · p. 12

8.1 Comparison with Prior Work (EQ1)

  • 102–108× lower per-machine compute against FALCON and 20×–107× bandwidth improvements are reported for NOMAI (SH).The compute gains range from 420× on MNIST-CNN at N = 1K to 108× on CIFAR-MLP-4K at N = 1M.Source: Figure 4 · p. 13, §8.1 · p. 13
  • 2.11s for CIFAR-MLP-4K at N = 10^6 compares with 86.4 hours for POSEIDON and 6 years for FALCON.The paper attributes the gains to eliminating prior-work bottlenecks.Source: §8.1 · p. 13

8.2 Scalability (EQ2)

  • Across N = 1K to 1M, semi-honest compute and bandwidth each vary by less than 4×, while malicious-setting bandwidth increases by at most 3.5×.At N = 1M, compute ranges from 289 ms for BCW-MLP to 5.18 s for CIFAR-MLP-4K.Source: §8.2 · p. 13
  • At N = 100K, compute grows from 0.33s to 78.7s with depth and from 0.41s to 21.0s with width; bandwidth follows the same trend.The relative overhead of malicious security decreases for larger models; POSEIDON is 200–3,600× slower and FALCON 3,700–22,000× slower.Source: §8.2 · p. 13, Figure 5 · p. 13
  • For MNIST-CNN, per-machine time rises from 283ms at η = 0.01 to 1.35s at η = 0.10 and 11.7s at η = 0.25.Higher corruption rates require larger committees and increase both committee size and per-committee workload.Source: Table 3 · p. 12, §8.2 · p. 13

9 Conclusion

NOMAI combines data privacy, weight privacy, and integrity for scalable federated learning in a single-server setting.

9 Conclusion

  • NOMAI is presented as the first scalable FL system to achieve data privacy, weight privacy, and integrity in the single-server setting.Its design introduces cryptographic and ML-aware techniques for efficient secure training.Source: §9 · p. 13

Ethical Considerations

The ethical discussion identifies misuse, dual use, and deployment outside the stated threat model as concerns, while noting that the evaluation used public datasets and no human subjects. The appendix describes NOMAI's end-to-end protocol and supporting secure-computation procedures.

Ethical Considerations

  • Risks include misuse, dual use, overstated guarantees outside the threat model, and models that may be biased, unfair, or unsafe; evaluation used public datasets without human subjects.The stated mitigations include secret-sharing user data, protecting model weights, and integrity checks for malformed or adversarial updates.Source: Ethical Considerations · p. 14

A Protocol Details

  • The appendix provides an extended description of the protocols used in the paper, building on Section 5.Source: A Protocol Details · p. 17

A.2 Discussion

  • Polynomial approximations make nonlinearities more amenable to packed computation, while ML-aware optimizations stabilize training; exact nonlinear protocols remain substitutable.The authors note that these choices are orthogonal to their core linear-layer and system-level contributions.Source: §A.2 · p. 17

A.3 Efficient Linear Layers

  • The full multi-channel packed Winograd protocol adds input-channel accumulation and produces packed output tiles for all output channels.The main text presents only the single-input, single-output channel case for clarity.Source: §A.3 · p. 17

A.4 Efficient Secure Exponentiation

  • Secure exponentiation converts PSS to additive shares, repartitions them, computes powers locally, and recombines them using the multinomial expansion.Correctness and security are proved in Appendix D.Source: §A.4 · p. 17

A.5 Efficient Degree Reduction

  • Basic degree reduction maps degree-2d PSS to fresh degree-d PSS with the same slots; repacking applies a public linear map before producing fresh degree-d PSS.Correctness and security are proved in Appendix D.3.Source: §A.5 · p. 17

A.6 Truncation

  • Packed truncation adapts masked opening to apply signed right-shift truncation independently to each slot, preserving sign in the Mersenne-field representation.Users supply slot-aligned truncation randomness during data sharing, avoiding additional communication.Source: §A.6 · pp. 18–19

A.1 NOMAI: End-to-end Protocol

  • The end-to-end protocol shares user inputs and truncation randomness, shares server-held weights with committees, then has committees evaluate the model.Committees produce packed gradient shares for aggregation.Source: §A.1 · p. 17, §A.6 · p. 20

B NOMAI Description: Training

NOMAI computes gradients through packing-aware backpropagation, then validates complete user gradients before aggregating accepted contributions. In the malicious setting, it preserves per-user terms until validation and checks source-committee shares before combining them.

B.1 Backward Pass

  • Packed backpropagation computes activation and weight gradients using layer-specific layouts, including diagonal chunked matrix multiplication for fully connected layers and Winograd transforms for convolutional layers.The fully connected construction is blockwise for arbitrary dimensions; convolutional backward propagation uses the reverse of the forward Winograd pipeline.Source: §B.1 · pp. 20–21
  • In the malicious setting, per-user weight-gradient terms remain separable until validation; only gradients with Valid(g_u)=1 contribute to the aggregate.In the semi-honest setting, the committee aggregates per-user contributions immediately.Source: §B.1 · p. 21

B.2 Gradient Validation

  • Committees evaluate a validity predicate on each complete user gradient, using a norm bound in the implementation, and include only accepted gradients in local aggregates.The protocol permits any validity predicate expressible as an arithmetic circuit over the field.Source: §B.2 · pp. 21–22
  • Before combining committee aggregates, the primary committee checks each source sharing for degree-2t consistency; the final server check detects an inconsistent outgoing aggregate and aborts.The per-source check prevents deviations from different committees from accumulating across share positions before verification.Source: §B.2 · p. 22

C Proof of Committee Safety Lemma

The appendix proves committee safety by counting assignments under random committee partitioning, then establishes correctness and privacy for packed truncation, exponentiation, degree reduction, and repacking.

C Proof of Committee Safety Lemma

  • The safety proof models committee formation as sampling without replacement and counts corrupted-user assignments in which every committee contains at most t corrupted users.It fixes a partition into c committees and a remaining user set, then selects the ηN corrupted users uniformly.Source: C Proof of Committee Safety Lemma · pp. 22–23

D.1 Truncation

  • Packed truncation applies the scalar correction separately to each slot, preserving slot-wise correctness; independently sampled masks keep an honest user's opened masked value private.The privacy claim holds even when the other l−1 slot owners are corrupted, provided the committee has at most t corrupted parties.Source: §D.1 · pp. 23–24

D.2 Secure Exponentiation

  • Secure exponentiation computes the required powers in each output slot, while randomized repartitioning and fresh packed sharings protect intermediate values.The stated security setting is semi-honest adversaries controlling up to t parties.Source: §D.2 · p. 24

D.3 Degree Reduction and Repacking

  • Degree reduction preserves the packed secret vector while refreshing its sharing, and degree reduction with repacking first routes values through a public map.The zero encoding leaves slot values unchanged while randomizing the remaining degrees of freedom.Source: §D.3 · p. 25

D.4 Proof of Theorem 2

The proof establishes NOMAI's security by simulation when committees remain within their corruption threshold, with the ideal functionality aborting otherwise. The dropout extension provisions larger committees and reports the resulting workload overheads.

D.4 Proof of Theorem 2

  • Conditioned on no unsafe committee, the simulated and real views are indistinguishable, and the probability of an unsafe event is at most 2^-κ.The proof concludes that NOMAI securely realizes the ideal functionality, with executions differing only with negligible probability.Source: §D.4 · p. 25

D.5 Dropout Tolerance

  • For dropout tolerance D, committees require 2d+1+D members in the semi-honest setting and 2d+1+2D in the malicious-with-abort setting.The malicious setting provisions an additional D members to handle cross-committee transfers under differing dropout patterns.Source: §D.5 · p. 26
  • At N=100K, optimized configurations with D=20 incur 1.8%–74.2% additional computation and 12.6%–63.0% additional communication versus D=0.The overhead varies with feasible committee configurations and workload.Source: §D.5 · p. 27

E Average Pool Implementation

The appendix describes local evaluation of global average pooling and implementation choices, then compares NOMAI with POSEIDON and explains how protocol parameters and accuracy are assessed.

E Average Pool Implementation

  • Global average pooling is linear on secret shares, so each party can compute it locally without interaction.The public scaling constant corresponds to a modular inverse in the field.Source: E Average Pool Implementation · p. 27

F.1 Setup (cntd.)

  • Random projection reduces the 4096-input layer's update dimension to d′=10,000 before aggregation, using Walsh–Hadamard transforms to reduce computation and communication.The passage identifies malicious-setting gradient validation as a source of runtime and communication cost.Source: §F.1 · p. 27

F.2.1 The POSEIDON Crossover: When can it win?

  • POSEIDON's three WAN rounds come with heavy homomorphic-encryption computation, while NOMAI uses approximately 36–38 rounds with negligible computation; the stated crossover requires unrealistically high latency for CIFAR-MLP-4K.The passage gives a required round-trip latency of approximately 3 minutes for that workload and concludes NOMAI strictly outperforms POSEIDON in practical regimes.Source: §F.2.1 · pp. 27–28

F.2.2 Parameter Design Space

  • The parameter search chooses safe feasible (c,l) configurations and selects a Pareto-knee operating point, balancing per-machine computation against communication.Committee count and packing factor trade per-committee workload and packed-object count against committee and interactive protocol costs; neither packing factor direction is universally optimal.Source: §F.2.2 · p. 28

F.2.3 Accuracy

  • Test accuracy is reported across datasets, with learning parameters selected by grid search and 3-fold cross-validation on plaintext data.The text notes that participating parties can jointly determine these parameters using secure statistics protocols.Source: §F.2.3 · p. 28, Table 7 · p. 28

F.2.4 Comparison with Single Server Secure Aggregation

Unlike secure-aggregation baselines that protect locally computed updates, NOMAI runs the full forward and backward pass under MPC while keeping model weights secret shared. Its per-machine costs compare favorably as user populations grow, with large gains over prior MPC work and manageable WAN latency.

F.2.4 Comparison with Single Server Secure Aggregation

  • NOMAI's dominant per-committee-member training workload is primarily independent of N, while baseline helper costs grow with N, explaining the change in relative performance as populations increase.In NOMAI, N affects mainly malicious-security mechanisms; FLAMINGO decryptor work grows approximately linearly with N, and WILLOW verifier work also grows with N.Source: §F.2.4 · p. 29
  • At N = 10M, NOMAI is faster than FLAMINGO and WILLOW across all workloads, gaining roughly 920× over WILLOW on CIFAR-MLP-4K despite performing the complete secure forward and backward pass.At N = 100K, FLAMINGO remains faster for larger workloads.Source: §F.2.4 · p. 29, Table 8 · p. 30

F.2.5 Comparison with Prior Work [35]

  • Against HMMPC, NOMAI reduces bandwidth by 5.8×–12.3× for FC models, 3,619× for MNIST-CNN, and 29,258× for SVHN-CNN; runtime gains are 445×–619× for FC and ∼104–105× for CNN models.NOMAI uses packing factors l=20 for FC and l=50 for CNN architectures.Source: Table 9 · p. 30, §F.2.5 · p. 30

F.2.6 WAN End-to-End Latency

  • At RTT = 100 ms, per-iteration latency is about 1.4 s (SH) / 3.4 s (Mal) for FC architectures, under 4 s (SH) / 7.4 s (Mal) for CNN architectures, and 5.5 s (SH) / 9.3 s (Mal) for CIFAR-MLP-4K.Total latency combines per-machine compute with the cost of MPC communication rounds.Source: Table 10 · p. 30, §F.2.6 · p. 30

Related papers

Loading 2610.21059v1…