A Supplementary Materials

Its value also depends on the bitwidth of the machine as well as the dimension of the dataset. In particular, in order to speed up the running time of matrix-matrix multiplication, we do a modular operation after the inner product of vectors instead of doing a modular operation per product of each element. A.2 Proof of Theorem 1 First, we show that the minimum number of clients needed for our decoding operation to be successful, i.e., the recovery threshold of COPML, is equal to (2r +1)(K +T 1)+1. To do so, we demonstrate in the following that the decoding process will be successful as long as N (2r +1)(K +T 1)+1. As described in Section 3, given the polynomial approximation of the sigmoid function in (5), the degree of h(z) in (8) is at most (2r + 1)(K + T 1).