Fast Decoding of Lifted Interleaved Linearized Reed-Solomon Codes for Multishot Network Coding

Mart{\'\i}nez-Pe{\~n}as and Kschischang (IEEE Trans.\ Inf.\ Theory, 2019) proposed lifted linearized Reed--Solomon codes as suitable codes for error control in multishot network coding. We show how to construct and decode \ac{LILRS} codes. Compared to the construction by Mart{\'\i}nez-Pe{\~n}as--Kschischang, interleaving allows to increase the decoding region significantly and decreases the overhead due to the lifting (i.e., increases the code rate), at the cost of an increased packet size. We propose two decoding schemes for \ac{LILRS} that are both capable of correcting insertions and deletions beyond half the minimum distance of the code by either allowing a list or a small decoding failure probability. We propose a probabilistic unique {\LOlike} decoder for \ac{LILRS} codes and an efficient interpolation-based decoding scheme that can be either used as a list decoder (with exponential worst-case list size) or as a probabilistic unique decoder. We derive upper bounds on the decoding failure probability of the probabilistic-unique decoders which show that the decoding failure probability is very small for most channel realizations up to the maximal decoding radius. The tightness of the bounds is verified by Monte Carlo simulations.


Introduction
Network coding [1] is a powerful approach to achieve the capacity of multicast networks.Unlike the classical routing schemes, network coding allows to mix (e.g.linearly combine) incoming packets at intermediate nodes.Kötter and Kschischang proposed codes in the subpsace metric as a suitable tool for error correction in (random) linear network coding [2] and defined the corresponding operator channel model.In an operator channel two type of errors, namely insertions and deletions, can occur.Insertions correspond to additional dimensions that are not contained in the transmitted space whereas deletions correspond to dimensions that are removed from the transmitted space.
The single-shot scenario from [2] was extended to the multishot case, i.e. the transmission over several instances of the operator channel, in [3].It was shown in [4] that lifted linearized Reed-Solomon (LLRS) codes provide reliable and secure coding schemes for noncoherent multishot network coding, a scenario where the in-network linear combinations are not known or used at the receiver, under an adversarial model in the sum-subspace metric.
An s-interleaved code is a direct sum of s codes of the same length (called constituent codes).This means that if the constituent codes are over F q , then the interleaved code can be viewed as a (not necessarily linear) code over F q s .In the Hamming and rank metric, there are various decoders that can significantly increase the decoding radius of a constituent code by collaboratively decoding in an interleaved variant thereof.Such decoders are known in the Hamming metric for Reed-Solomon [5][6][7][8][9][10][11][12][13][14][15][16][17] and in general algebraic geometry codes [18][19][20], and in the rank metric for Gabidulin codes [21][22][23][24][25][26][27][28].All of these decoders have in common that they are either list decoders with exponential worst-case and small average-case list size, or probabilistic unique decoders that fail with a very small probability.
Interleaving was suggested in [29] as a method to decrease the overhead in lifted Gabidulin codes for error correction in noncoherent (single-shot) network coding, at the cost of a larger packet size while preserving a low decoding complexity.It was later shown [23,25,30] that it can also increase the error-correction capability of the code using suitable decoders for interleaved Gabidulin codes.

Our Contributions
In this paper, we define and analyze LILRS codes that are obtained by lifting interleaved linearized Reed-Solomon (ILRS) codes as considered in [31].We propose and analyze two decoding schemes that both allow for decoding insertions and deletions beyond the unique decoding region by allowing a (potentially exponential) list or a small decoding failure probability.
First, we propose a Loidreau-Overbeck-like probabilistic unique decoder and derive an upper bound on the decoding failure probability.The upper bound shows the the decoder succeeds with an overwhelming probability close to one for random realizations of the multishot operator channel that stay within the decoding region.
The second decoding approach is a novel interpolation-based list decoder that is based on the list decoder by Wachter-Zeh and Zeh [25] for interleaved Gabidulin codes.We derive a decoding region for the codes in the sum-subspace metric, analyze the complexity of the decoder and give an exponential upper bound on the list size.We derive an upper bound on the decoding failure probability of the interpretation as a probabilistic-unique decoder by relating the success conditions to the Loidreau-Overbeck-like decoder.
Compared to [4], we decrease the relative overhead introduced by lifting (or equivalently, increase the rate for the same code length and block size) and at the same time extend the decoding region, especially for insertions, significantly.These advantages come at the cost of a larger packet size of the packets within the network and a supposedly small failure probability.By considering the decoding problem in the complementary code, we show how the proposed LILRS coding schemes can be used to improve the decoding region w.r.t.deletions significantly.
Moreover, for the case s = 1 (no interleaving), our algorithm does not require the assumption from [4, Sec.V.H] that n r ≤ n t , where n t and n r denotes the sum of the dimensions of the transmitted and received subspaces, respectively.Hence, the proposed decoder works in cases in which [4] does not work.
Compared to the conference version [32] this work contains several new results, such as e.g. the Loidreau-Overbeck-like decoder, the strict upper bound on the decoding failure probability as well as the improved deletion-correction capability from complementary codes.
The main results of this paper, in particular the improvements upon the existing noninterleaved variants, are illustrated in Table 1.
Table 1 Overview of new decoding regions and computational complexities.Parameters: interleaving parameter s (usually s ≪ nt), nt resp.nr is the dimension of the transmitted resp.received subspace, γ and δ the overall number of insertions resp.deletions.M(n) ∈ O n 1.635  is the cost (in operations in F q m ) of multiplying two skew-polynomials of degree at most n and ω < 2.373 is the matrix multiplication exponent.LILRS Codes (list) γ +sδ < s(n t −k+1) |L| ≤ q m(k(s−1)) O(s ω M(nr)) Thm. 5 Sec. 4. 3.3 LILRS Codes (prob.unique) γ +sδ ≤ s(n t −k) P f ≤ 3.5 ℓ+1 q −m O(s ω M(nr)) Thms. 3 & 6 Sec.4.2 / 4.3 a The decoder from [4] has the restriction that nt = nr .Therefore, the proposed decoder for s = 1 is a more general decoder for LLRS codes compared to the decoder in [4].

Structure of the paper:
In Section 2 the notation as well as basic definitions on vector spaces and skew polynomials are introduced.Section 3 is dedicated to a brief introduction to multishot network coding.In Section 4 we consider decoding of LILRS codes in the sum-subspace metric for error-control in noncoherent multishot network coding.In particular, we derive a Loidreau-Overbeck-like and an interpolation-based decoding scheme for LILRS codes, that can correct errors beyond the unique decoding radius in the sum-subspace metric.Section 5 concludes the paper.

Preliminaries
We now give some definitions and notation related to multishot network coding and LLRS codes.Since the notation for multishot network coding is quite involved, we tried to stick to common notation as much as possible such that readers familiar with the topic can skip parts of this section.

Notation
A set is a collection of distinct elements and is denoted by S = {s 1 , s 2 , . . ., s r }.The cardinality of S, i.e. the number of elements in S, is denoted by |S|.By [i, j] with i < j we denote the set of integers {i, i + 1, . . ., j}.We denote the set of nonnegative integers by Z ≥0 = {0, 1, 2, . . .}.
Let F q be a finite field of order q and denote by F q m the extension field of F q of degree m with primitive element α.The multiplicative group F q m \ {0} of F q m is denoted by F * q m .Matrices and vectors are denoted by bold uppercase and lowercase letters like A and a, respectively, and indexed starting from one.Under a fixed basis of F q m over F q any element a ∈ F q m can be represented by a corresponding column vector a ∈ F m×1 q .For a matrix A ∈ F M×N q m we denote by rk q (A) the rank of the matrix A q ∈ F Mm×N q obtained by column-wise expanding the elements in A over F q .Let σ : F q m → F q m be a finite field automorphism given by σ(a) = a q r for all a ∈ F q m , where we assume that 1 ≤ r ≤ m and gcd(r, m) = 1.For a matrix A and a vector a we use the notation σ(A) and σ(a) to denote the element-wise application of the automorphism σ, respectively.For A ∈ F M×N q m we denote by A q the F q -linear rowspace of the matrix A q ∈ F M×N m q obtained by row-wise expanding the elements in A over F q .The left and right kernel of a matrix A ∈ F M×N q m is denoted by ker l (A) and ker r (A), respectively.
For a set I ⊂ Z >0 we denote by [A] I (respectively [a] I ) the matrix (vector) consisting of the columns (entries) of the matrix A (vector a) indexed by I.

Vector Spaces & Subspace Metrics
Vector spaces are denoted by calligraphic letters such as e.g.V.By P q (N ) we denote the set of all subspaces of F N q .The Grassmannian is the set of all l-dimensional subspaces in P q (N ) and is denoted by G q (N, l).The cardinality of the Grassmannian |G q (a, b)|, i.e. the number of l-dimensional subspace of F N q is given by the Gaussian binomial N l q which is defined as The Gaussian binomial satisfies (see e.g.[2]) where Note that κ q is monotonically decreasing in q with a limit of 1, and e.g.κ 2 ≈ 3.463, κ 3 ≈ 1.785, and κ 4 ≈ 1.452.
We extend fundamental operators on subspaces to tuples of subspaces by considering their application in an element-wise manner, i.e. for V, U ∈ P q (N , l) we define We conclude this subsection considering the extension of the subspace distance to the multishot case [3].

Skew Polynomials
Skew polynomials are a special class of non-commutative polynomials that were introduced by Ore [34].A skew polynomial is a polynomial of the form with a finite number of coefficients f i ∈ F q m being nonzero.The degree deg(f ) of a skew polynomial f is defined as max{i : The set of skew polynomials with coefficients in F q m together with ordinary polynomial addition and the multiplication rule The set of skew polynomials in F q m [x; σ] of degree less than k is denoted by F q m [x; σ] <k .For any a, b ∈ F q m we define the operator For an integer i ≥ 0, we define (see [35,Proposition 32]) where D 0 a (b) = b and N i (a) = σ i−1 (a)σ i−2 (a) . . .σ(a)a is the generalized power function (see [36]).The generalized operator evaluation of a skew polynomial f ∈ F q m [x; σ] at an element b w.r.t.a, where a, b ∈ F q m , is defined as (see [35, 37]) For any fixed evaluation parameter a ∈ F q m the generalized operator evaluation forms an F q -linear map, i.e. for any f ∈ F q m [x; σ], β, γ ∈ F q and b, c ∈ F q m we have that For two skew polynomials f, g ∈ F q m [x; σ] and elements a, b ∈ F q m the generalized operator evaluation of the product f • g at b w.r.t a is given by (see [38]) An important notion for the generalized operator evaluation is the concept of conjugacy, which is defined as follows.Definition 2 (Conjugacy [39]).For any two elements a ∈ F q m and c ∈ F * q m define a c := σ(c)ac −1 .
• Two elements a, b ∈ F q m are called σ-conjugates, if there exists an element c ∈ F * q m such that b = a c .• Two elements that are not σ-conjugates are called σ-distinct.
The notion of σ-conjugacy defines an equivalence relation on F q m and thus a partition of F q m into conjugacy classes [36].The set is called conjugacy class of a.A finite field F q m has at most ℓ ≤ q − 1 distinct conjugacy classes.For ℓ ≤ q − 1 the elements 1, α, α 2 , . . ., α ℓ−2 are representatives of all (nontrivial) disjoint conjugacy classes of F q m .Let a 1 , . . ., a ℓ be representatives be from conjugacy classes of F q m and let b ni be elements from F q m for all i = 1, . . . ,ℓ.Then for any nonzero f ∈ F q m [x; σ] satisfying f (b are F q -linearly independent for each i = 1, . . ., ℓ (i.e. for each evaluation parameter a i , see [40]).
The existence of a (generalized operator evaluation) interpolation polynomial is considered in Lemma 1 (see e.g.[40]).Lemma 1 (Lagrange Interpolation (Generalized Operator Evaluation)).Let b ni be F q -linearly independent elements from F q m for all i = 1, . . ., ℓ.Let c ni be elements from F q m and let a 1 , . . . ,a ℓ be representatives for different conjugacy classes of F q m .Define the set of tuples B := {(b Then there exists a unique interpolation polynomial and The set of all skew polynomials of the form where Q j ∈ F q m [x; σ] for all j = 0, . . . ,ℓ is denoted by F q m [x, y 1 , . . . ,y s ; σ].Definition 3 (w-weighted Degree).Given a vector w ∈ Z s+1 ≥0 , the w-weighted degree of a multivariate skew polynomial from Q ∈ F q m [x, y 1 , . . . ,y s ; σ] is defined as For an element a ∈ F q m and a vector b = (b 1 , b 2 , . . . ,b n ) ∈ F n q m we define the vector and the matrix ≥0 such that ℓ i=1 n i = n and a vector a = (a 1 , a 2 , . . ., a ℓ ) ∈ F ℓ q m we define the vector 1 By the properties of the operator D i a (•), we have that and To simplify the notation we omit the length partition n from the vector operator D i a (x) since it will be always clear from the context (i.e. as the length partition of the vector x).
and integer j and a vector a = (a 1 , a 2 , . . ., a ℓ ) ∈ F ℓ q m we define D j a (•) applied to X as The element-wise application of the operator to matrices does not affect the rank, i.e. we have that rk q m (D j a (X)) = rk q m (X) (see [31,Lemma 3]).Definition 4 (σ-Generalized Moore Matrix).For an integer d ∈ Z >0 , a length partition n = (n 1 , n 2 , . . ., n ℓ ) ∈ Z ℓ ≥0 such that ℓ i=1 n i = n and the vectors a = (a 1 , a 2 , . . . ,a ℓ ) ∈ F ℓ q m and x q m for all i = 1, . . ., ℓ, the σ-Generalized Moore matrix is defined as Similar as for ordinary polynomials and Vandermonde matrices, there is a relation between the generalized operator evaluation and the product with a σ-Generalized Moore matrix.In particular, for a skew polynomial f The rank of a σ-Generalized Moore matrix satisfies rk q m (Λ d (x) a ) = min{d, n} if and only if wt ΣR (x) = n (see e.g.[36,Theorem 4.5]).Remark 1.To simplify the notation we omit the rank partition n in Λ j (•) a since it will be always clear from the context (i.e. the length partition of the considered vector).

Multishot Network Coding
As a channel model we consider the multishot operator channel from [3] which consists of multiple independent channel uses of the operator channel from [2].The operator channel is a discrete channel that relates the input V ∈ P q (N ) with n t := dim(V) to the output U ∈ P q (N ) by where H nt−δ (V) is an erasure operator that returns an (n t − δ)-dimensional subspace of V and E ∈ G q (N, γ) is a γ-dimensional subspace with V ∩ E = {0}.The dimension of the received space n r := dim(U) is then where δ is called the number of deletions and γ is called the number of insertions.Observe, that the subspace distance between the input V and the output U is d S (V, U) = γ + δ.
The output U of the multishot operator channel has sum-dimension The multishot operator channel is illustrated in Figure 1.In [4,33] a sum-rank-metric representation of the multishot operator channel in the spirit of [29,41] was considered.This equivalent channel representation is more suitable for decoding of LILRS codes in the sum-rank metric.In this work, we consider the interpretation as a multishot operator channel that is more closely related to the sum-subspace metric.Remark 2. By the term "random instance of the ℓ-shot operator channel with overall γ insertions and δ deletions" we mean, that we draw uniformly at random an instance from all instances of the ℓ-shot operator channel (3), i.e. we dram uniformly at random form all partitions of the insertions γ and deletions δ, and for fixed V, γ and δ, the error space is chosen uniformly at random from the set In Appendix C we propose an efficient procedure to implement random instances of the multishot operator channel for parameters N = (N , . . ., N ) and n t = (n t , . . ., n t ) by adapting the dynamic-programming routine in [42,Appendix A] for drawing an error of given sum-rank weight uniformly at random to the sum-subspace case (see Algorithm 5).
We now extend the definition of (γ, δ) reachability for the operator channel [28] to the multishot operator channel.Definition 5 ((γ, δ) Reachability).Given two tuples of subspaces U , V ∈ P q (N ) we say that V is (γ, δ)-reachable from U if there exists a realization of the multishot operator channel (3) with γ insertions and δ deletions that transforms the input V to the output U.
Next, we relate the (γ, δ)-reachability with the sum-subspace distance.Proposition 1.Consider U ∈ P q (N ) and Similar as in [2] we now define normalized parameters for codes in the sum-subspace metric.The normalized weight λ, the code rate R and the normalized minimum distance η of a sum-subspace code C with parameters respectively.The normalized parameters λ, R and η defined in ( 6) lie naturally within the interval [0, 1].Define n t := n t /ℓ.For n (i) t = n t for all i = 1, . . ., ℓ we can write the code rate as A sum-subspace code C is a non-empty subset of P q (N ), and has minimum subspace distance d ΣS (C) when all subspaces in the code have distance at least d ΣS (C) and there is at least one pair of subspaces with distance exactly d ΣS (C).In the following we consider constant-shot-dimension codes2 , i.e. codes that inject the same number of (linearly independent) packets n (i) t in a given shot.In this setup, we transmit a tuple of subspaces V = V (1) , V (2) , . . ., V (ℓ) ∈ G q (N , n t ) and receive a tuple of subspaces where for all i = 1, . . ., ℓ.
Similar as for subspace codes in [2] we now define complementary sum-subspace codes.For any V ∈ P q (N ) the dual space V ⊥ is defined as For a tuple V = (V (1) , V (2) , . . ., V (ℓ) ) ∈ P q (N ) we define the dual tuple as Note, that if V ∈ G q (N , n t ), then we have that V ⊥ ∈ G q (N , N − n t ).By applying [2, Equation 4] to the subspace distance between each component space of two tuples U , V ∈ P q (N ) in ( 1) we get that Consider a constant-shot-dimension sum-subspace code C ⊆ G q (N , n t ).Then the complementary constant-shot-dimension sum-subspace code C ⊥ is defined as

Lifted Linearized Reed-Solomon Codes
Lifted linearized Reed-Solomon (LRS) codes [4] are constant-shot-dimension multishot network codes for error-control in noncoherent multishot network coding.The main idea behind the construction of LLRS codes is to lift codewords of an LRS code in a block-wise manner by augmenting each (transposed) codeword block by the corresponding F q -linearly independent code locators.For the special case of ℓ = 1 the construction coincides with the Kötter-Kschischang subspace codes [2].
Let a = (a 1 , a 2 , . . ., a ℓ ) be a vector containing representatives from different conjugacy classes of F q m .Let the vectors q m contain F q -linearly independent elements from F q m for all i = 1, . . . ,ℓ and define t , . . ., n t , sum-dimension partition n t and dimension k ≤ n t is defined as t + m, and, for f ∈ F q m [x; σ] <k , we have The lifting operation corresponds to augmenting each transposed codeword block of an LRS codeword by the corresponding (transposed) code locators and considering the F q -linear rowspace thereof (see [4, 29, 33]).The lifting operation causes a rate- loss since the code locators do not carry information since they are common for all codewords.
The minimum sum-subspace distance of LLRS[β, a, ℓ; n t , k] equals (see [4]) and the code rate is .
In [4] and efficient interpolation-based decoding algorithm that can correct an overall number of γ insertions and δ deletions up to γ + δ < n t − k + 1 was presented.However, the decoder from [4] has the restriction that the dimension of the received spaces and the dimension of the transmitted spaces must be the same (c.f.[4, Section V.H]).

Decoding of Lifted Interleaved LRS Codes for Error-Control in Multishot Network Coding
In this section, we consider the application of lifted ILRS codes for error control in multishot network coding.In particular, we focus on noncoherent transmissions, where the network topology and/or the coefficients of the in-network linear combinations at the intermediate nodes are not known (or used) at the transmitter and the receiver.Therefore, we define and analyze lifted interleaved linearized Reed-Solomon (LILRS) codes.
We derive a Loidreau-Overbeck-like decoder [21,43,44] for LILRS codes which is capable of correcting insertions and deletions beyond the unique decoding region at the cost of a (very) small decoding failure probability.Although the Loidreau-Overbecklike decoder is not the most efficient decoder in terms of computational complexity, it allows to analyze the decoding failure probability and gives insights about the decoding procedure.We derive a tight upper bound on the decoding failure probability of the Loidreau-Overbeck-like decoder for LILRS codes, which, unlike simple heuristic bounds, considers the distribution of the error spaces caused by insertions.
We propose an efficient interpolation-based decoding scheme, which can correct insertions and deletions beyond the unique decoding region and which be used as a list decoder or as a probabilistic unique decoder.We derive upper bounds on the worst-case list size and use the relation between the interpolation-based decoder and the Loidreau-Overbeck-like decoder to derive an upper bound on the decoding failure probability for the interpolation-based probabilistic unique decoding approach.Unlike the interpolation-based decoder in [4, Section V.H], the proposed decoding schemes do not have the restriction that the dimension of the received spaces and the dimension of the transmitted spaces must be the same.

Lifted Interleaved Linearized Reed-Solomon Codes
In this section we consider LILRS codes for transmission over a multishot operator channel (3).We generalize the ideas from [4] to obtain multishot subspace codes by lifting the ILRS codes defined in [31].Definition 6 (Lifted Interleaved Linearized Reed-Solomon Code).Let a = (a 1 , a 2 , . . ., a ℓ ) be a vector containing representatives from different conjugacy classes of F q m .Let the vectors q m contain F q -linearly independent elements from F q m for all i = 1, . . . ,ℓ and define and dimension k ≤ n t is defined as where t + sm, and, for f = (f 1 , . . ., f s ), we have Observe, that compared to LLRS codes the relative overhead due to lifting decreases in s since the evaluations are performed at the same code locators and thus have to be appended only once.The reduction of the relative overhead comes at the cost of an increased packet size N i for each shot i = 1, . . ., ℓ.
The definition of LILRS codes generalizes several code families.For s = 1 we obtain the lifted linearized Reed-Solomon codes from [4, Section V.III].For ℓ = 1 we obtain lifted interleaved Gabidulin codes as considered in e.g.[25,30] with Kötter-Kschischang codes [2] as special case for s = 1.
Proposition 2 shows that interleaving does not increase the minimum sum-subspace distance of the code.Proposition 2 (Minimum Distance).The minimum sum-subspace distance of a LILRS code LILRS[β, a, ℓ, s; n t , k] as in Definition 6 is a, ℓ; n t , k] be two subspaces having the minimum distance to each other, i.e. we have that d S (V 1 , V 2 ) = 2(n t −δ+1).Define the subspaces and consider without loss of generality the tuples . ℓ) do not contribute to the sum-subspace distance and thus we have that

By definition we have
For a LILRS code C = LILRS[β, a, ℓ, s; n t , k] we have that N i = n (i) t + sm for all i = 1, . . ., ℓ and therefore the code rate is Note, that there exist other definitions of the code rate for multishot codes that are not considered in this paper (see e.g.[3, Section IV.A]).
The normalized weight λ and the normalized distance η of an LILRS code LILRS[β, a, ℓ, s; For n (i) t = n t for all i = 1, . . ., ℓ the code rate of an LILRS code LILRS[β, a, ℓ, s; For n (i) t = n t for all i = 1, . . ., ℓ the Singleton-like upper bound for constant-shotdimension sum-subspace codes [4, Theorem 7] evaluated for the parameters of LILRS codes becomes |C| ≤ κ ℓ q q sm(nt−(dΣS(C)/2−1)) = κ ℓ q q smk which shows, that a Singleton-like bound achieving code can be at most κ ℓ q < 3.5 ℓ times larger than the corresponding LILRS code.Equivalently, the code rate is therefore upper-bounded by R ≤ ℓ(log q (κ q ) + smk) n t N .
The benefit of the decreased relative overhead due to interleaving is illustrated in Figure 2. The figure shows, that the rate loss due to the overhead introduced by the lifting is reduced significantly, even for small interleaving orders.Further, we see that LILRS codes approach the Singleton-like bound for sum-subspace codes (see [4]) with increasing interleaving order while preserving the extension field degree m3 .

Loidreau-Overbeck-like Decoder for LILRS Codes
Loidreau and Overbeck proposed the first efficient decoder for interleaved Gabidulin codes in the rank metric [21,43,44].The main idea behind the Loidreau-Overbeck decoder is to compute an F q -linear transformation matrix from a decoding matrix (which depends on the code and the received word) that allows to transform the received word into a corrupted part and a noncorrupted part.The noncorrupted part is then used to recover the message polynomials e.g.via Lagrange interpolation.
The concept of the Loidreau-Overbeck decoder was generalized to decoding ILRS codes in the sum-rank metric [31].In the sum-rank-metric case an F q -linear transformation matrix is obtained for each block.
Based on the previous decoders for the rank and sum-rank metric, we derive a Loidreau-Overbeck-like decoder for LILRS codes.Similar to the original decoder and its sum-rank-metric analogue we set up a decoding matrix that allows to compute F q -linear transformation matrices for each shot U (i) .The obtained transformation matrices allow to compute particular bases for the received subspaces U (i) that can be split into a basis for the corrupted part (corresponding to the error space E (i) ) and a noncurrupted part (i.e. a basis for V (i) ∩ U (i) ) for each shot.The noncorrupted part is then used to reconstruct the message polynomials via Lagrange interpolation.The qualitative structure of the tuple Û = ( Û (1) , Û (2) , . . ., Û (ℓ) ) containing transformed basis matrices is illustrated in Figure 3.The main motivation to derive the Loidreau-Overbeck-like decoder is to obtain an upper bound on the decoding failure probability that incorporates the distribution of the error spaces in E. In Section 4.3 we will reduce the interpolation-based decoder for LILRS codes to the Loidreau-Overbeck-like decoder in order to obtain an upper bound on the decoding failure probability of the interpolation-based probabilistic unique decoder.
Up to our knowledge, this is the first Loidreau-Overbeck-like decoding scheme in the (sum-) subspace metric.It includes lifted interleaved Gabidulin (or interleaved Kötter-Kschischang) codes [30,45] as special case for ℓ = 1.Hence, the results give a strict upper bound4 on the decoding failure probability of the decoders in [30,45].
Suppose we transmit the tuple of subspaces over an ℓ-shot operator channel with overall γ insertions and δ deletions and receive the tuple of subspaces where the received subspaces U (i) are as defined in (7) and n r = n t + γ − δ (see ( 4)).Define the vectors for all j = 1, . . ., s and consider the matrix Lemma 2 (Transformed of Decoding Matrix).Consider the transmission of a tuple of subspaces V(f ) ∈ LILRS[β, a, ℓ, s; n t , k] over an ℓ-shot operator channel with overall γ insertions and δ deletions and receive the tuple of subspaces U .Let L be as in (10).Then there exist invertible matrices such that for W = diag(W (1) , W (2) , . . ., W (ℓ) ) we have that consists of component matrices of the form where ξ for all i = 1, . . ., ℓ such that rk q m (L) = rk q m (L).The proof of Lemma 2 is based on particular bases for the received spaces in U and properties of the intersection and error spaces in V ∩ U and E, respectively, and can be found in Appendix A. 1. Lemma 3 (Properties of Decoding Matrix).Consider the notation and definitions as in Lemma 2 and define the vectors and the matrix q m for all i = 1, . . ., ℓ be a nonzero vector in the right kernel of the decoding matrix L and suppose that Z has F q m -rank γ.Then: 1.We have rk q m (L) = n r − 1.

There are invertible matrices
, for all i = 1, . . ., ℓ, such that the last (rightmost) γ (i) positions of h (i) T (i) are zero.

The first (upper) n
form a basis for the non-corrupted received space U (i) ∩ V (i) for all i = 1, . . ., ℓ. 5.The l-th message polynomial f l can be uniquely reconstructed from the transformed basis Û (i) for the received space U (i) by Lagrange interpolation on the first n (i) t −δ (i) rows of Û (i) for all l = 1, . . ., s and i = 1, . . ., ℓ.
We now provide a sketch of the proof.The full proof of Lemma 3 can be found in Appendix A. 2. Sketch of the Proof.
-Ad 1): The matrix L can be rearranged into an upper block-triangular matrix whose rank is determined by the two blocks on the diagonal, which have rank n t −δ −1 and γ and thus imply that the F q m -rank of the whole matrix equals n t −δ−1+γ = n r −1.
The statement follows since by Lemma 2 we have that rk q m (L) = rk q m (L).
-Ad 2): By assumption the F q m -rank of Z equals γ which implies that rk q m (Z (i) ) = γ (i) for all i = 1, . . ., ℓ.Thus, for any h ∈ ker r (L) \ {0} the γ (i) rightmost entries of h (i) must be zero which implies that rk q (h t − δ (i) for all i = 1, . . ., ℓ.On the other hand h is contained in a code with minimum sum-rank distance n t − δ which is the dual of the code spanned by the first n t −δ −1 rows of L. The statement follows by combining these two facts.
-Ad 3): By 2) the F q -rank of h (i) ∈ F n (i) r q m equals n (i) t − δ (i) for all i = 1, . . ., ℓ. Hence there exist matrices -Ad 4): Define the matrices D (i) = T (i)−1 ⊤ for all i = 1, . . ., ℓ and observe that hT ∈ ker r (L • diag(D (1) , . . ., D (ℓ) )).By using the F q m -rank condition on Z one can show that the span of the γ (i) rightmost columns of the matrices L (i) and L (i) D (i) coincides.These columns correspond to the insertions which in turn implies that the last γ (i) rows of Û (i) = (D (i) ) ⊤ U (i) form a basis for E (i) .The statement follows since by the definition of the operator channel we have that V (i) ∩ E (i) = {0} for all i = 1, . . ., ℓ. -Ad 5): By 4) the first n (i) t − δ (i) rows of the transformed basis Û (i) form a basis for the noncorrupted intersection space V (i) ∩ U (i) for all i = 1, . . ., ℓ. Due to the F q -linearity of the generalized operator evaluation for a fixed evaluation parameter (i.e. per shot), the message polynomials can be reconstructed by constructing the corresponding Lagrange interpolation polynomials (see Figure 4).
The complete procedure for the Loidreau-Overbeck-like decoder for LILRS codes is given in Algorithm 1.The structure of the transformed basis matrices Û (i) for all i = 1, . . ., ℓ is illustrated in Figure 4.
Fig. 4 Illustration of the structure of the transformed basis matrices Û (i) .The green part forms a basis for the non-corrupted space U (i) ∩ V (i) whereas the red part forms a basis for the error space E (i) .
Lemma 4 (Decoding Failure Probability).Suppose that a tuple of subspaces is transmitted over a random instance of the ℓ-shot operator channel (see Remark 2) with overall γ insertions and δ deletions, where γ and δ satisfy γ ≤ γ max := s(n t −δ−k).
Theorem 3 (Loidreau-Overbeck-like Decoder for LILRS Codes).Suppose we transmit the tuple of subspaces over a random instance of the ℓ-shot operator channel (see Remark 2) with overall γ insertions and δ deletions, where Then, Algorithm 1 with input V(f ) returns the correct message polynomial vector f with success probability at least Pr(success) ≥ 1 − κ ℓ+1 q q −m(γmax−γ+1) .
Furthermore, the algorithm has complexity O(sn ω r ) operations in F q m plus O(mn ω−1 r ) operations in F q .
Proof.Due to Proposition 3, the algorithm returns the correct message polynomial vector f if the F q m -rank of Λ nt−δ−k (Z) a is at least γ.Hence, the success probability is lower bounded by the probability that rk q m (Λ nt−δ−k (Z) a ) = γ, which is given in Lemma 4.
The lines of the algorithm have the following complexities: • Lines 3 and 6: This can be done by solving the linear system of equations Lh ⊤ = 0.
• Line 8 can be implemented by transforming the matrix representation of h (i) , which is an m × n (i) r matrix over F q , into column echelon form.For each i, operations in F q .In total, all ℓ calls of this line cost operations in F q .
• Line 9 can be implemented by transforming the matrix representation of h (i) into column echelon form, which was already accomplished in Line 8.
• Line 10 requires O sn multiplications over F q m and thus O s i n O sn 2 r operations in F q m in total.• Line 13 computes s interpolation polynomials of degree less than k ≤ n t point tuples.This costs in total O(sM(n t )) operations in F q m (c.f. [46,47]).
This proves the complexity statement.
The decoding region of the Loidreau-Overbeck-like decoder for LILRS codes is illustrated in Figure 5.

An Interpolation-Based Decoding Approach
We now derive an interpolation-based decoding approach for LILRS codes.The decoding principle consists of an interpolation step and a root-finding step.In [4], (lifted) linearized Reed-Solomon codes are decoded using the isometry between the sum-rank and the skew metric.In this work we consider an interpolation-based decoding scheme in the generalized operator evaluation domain.The new decoder is a generalization of [25] (interleaved Gabidulin codes in the rank metric) and [30] (lifted interleaved Gabidulin codes in the subspace metric).Compared to the Loidreau-Overbeck-like decoder from Section 4.2, which requires O s ω n 2 r operations in F q m , the proposed interpolation based decoder has a reduced computational complexity in the order of O(s ω M(n r )) operations in F q m .

Interpolation Step
Suppose we transmit the tuple of subspaces over an ℓ-shot operator channel (3) with γ insertions and δ deletions and receive the tuple of subspaces U = U (1) , U (2) , . . ., where the received subspaces U (i) are represented as in (7).We describe U by the tuple containing the basis matrices of the received subspaces as q for all i = 1, . . ., ℓ. Remark 3. In contrast to [4, Section V.H] we do not need the assumption that the F q -rank of ξ (i) equals n (i) r for all i = 1, . . ., ℓ, which is not the case in general (see also [41,Section 5.1.2]).

Define the skew polynomials
and the vectors and u j = u (1) for all j = 1, . . ., s.Then a solution of Problem 1 can be found by solving the F q m -linear system R I q = 0 (16) for q = (q 0,0 , q 0,1 , . . ., q 0,D−1 | q 1,0 , q 1,1 , . . ., q where the interpolation matrix is given by Problem 1 can be solved by the skew Kötter interpolation [48] with the generalized operator evaluation maps E (i) j as defined in (15) requiring O s 2 n 2 r operations in F q m .A solution of Problem 1 can be found efficiently requiring only O(s ω M(n r )) operations in F q m using a variant of the minimal approximant bases approach from [31].Another approach yielding the same computational complexity of O(s ω M(n r )) operations in F q m is given by the fast divide-and-conquer Kötter interpolation from [49]. .
Proof.Problem 1 corresponds to a system of n r F q m -linear equations in D(s + 1) − s(k − 1) unknowns (see ( 16)) which has a nonzero solution if the number of equations is less than the number of unknowns, i.e. if The F q m -linear solution space Q of Problem 1 is defined as denotes the coefficient vector of Q as defined in (17).The dimension of the F q m -linear solution space Q of Problem 1 (i.e. the dimension of the right kernel of R I in (18)) is denoted by

Root-Finding Step
The goal of the root-finding step is to recover the message polynomials f 1 , . . ., f s ∈ F q m [x; σ] <k from the multivariate polynomial constructed in the interpolation step.We now derive a condition for the recovery of the message polynomials.Lemma 6 (Roots of Polynomial).Let The decoding region in (20) shows and improved insertion-correction performance due to interleaving.The resulting improvement is illustrated in Figure 5.
In the root-finding step, all polynomials f 1 , . . ., f s ∈ F q m [x; σ] <k that satisfy (21) need to be found.Instead of using only one solution of Problem 1 to set up the root-finding system we use a basis for the d I -dimensional F q m -linear solution space Q (see also [25,45].Alternatively, a degree-restricted subset of a Gröbner basis for the interpolation module of cardinality at most s can be used to set up the root-finding system and find the minimal number of solutions (see [31]).
To set up the root-finding system set up with a basis for Q define the matrices .

List Decoding
In general, the root-finding matrix Q R in (24) can be rank deficient.In this case we obtain a list of potential message polynomials f 1 , . . ., f s .By [31, Proposition 4] the root-finding system in (21) has at most q m(k(s−1)) solutions f , . . ., f s ∈ F q m [x; σ] <k .In general, we have that k ≤ n t , where n t ≤ ℓm.Hence, for m ≈ n t /ℓ we get a worst-case list size of q n t ℓ (k(s−1)) .

Algorithm 2 List Decoding of LILRS Codes
Input: A tuple containing the basis matrices U = (U (1) , U (2) , . . ., for the output U = (U (1) , U (2) , . . ., U (ℓ) ) ∈ G q (N , n r ) of an ℓshot operator channel with overall γ insertions and δ deletions for input <k that satisfy (21) 3: return L Theorem 5 (List Decoding of LILRS Codes).Let U ∈ G q (N , n r ) be a tuple of received subspaces of a transmission of a codeword V ∈ LILRS[β, a, ℓ, s; n t , k] over an ℓ-shot operator channel with overall γ insertions and δ deletions.If the number of overall insertions γ and deletions δ satisfy containing all message polynomial vectors f ∈ F q m [x; σ] s <k corresponding to codewords V(f ) ∈ LILRS[β, a, ℓ, s; n t , k] that are (γ, δ)-reachable from U can be found requiring at most O(s ω M(n r )) operations in F q m .Proof.The proof follows directly from Lemma 6, Theorem 4 and the discussion above.

Probabilistic Unique Decoding
We now consider the interpolation-based decoder from Section 4.3 as a probabilistic unique decoder which either returns a unique solution (if the list size is equal to one) or a decoding failure.The main idea is to use a basis for the d I -dimensional F q m -linear solution space Q of the interpolation system (16) to set up the root-finding matrix (23) which in turn facilitates that the root-finding matrix Q R can have full rank.
Using similar arguments as in [30,31,45] we can lower bound the dimension d I of the F q m -linear solution space Q of Problem 1. Lemma 7 (Dimension of Solution Space).Let γ and δ satisfy (20).Then the dimension d I = dim(Q) of the F q m -linear solution space Q of Problem 1 satisfies be a basis for each non-corrupted intersection space U (i) ∩V (i) where t −δ (i)   are (n t − δ (i) ) F q -linearly independent elements from F q m for all i = 1, . . . ,ℓ. Define the vector ] be a basis for the error space E (i) for all i = 1, . . ., ℓ and define Then the matrix has the same column space as the matrix R I in (18).Since wt ΣR (ζ) = n t − δ and D ≤ n t − δ (see (22)) we have that the matrix Λ D (ζ) ⊤ a has F q m -rank D. The last γ rows of R I can increase the F q m -rank of R I by at most γ.Thus we have that rk q m (R I ) = rk q m ( R I ) ≤ D + γ.Hence, the dimension d I of the F q m -linear solution space Q of Problem 1 satisfies The rank of the root-finding matrix Q R can be full if and only if the dimension of the solution space of the interpolation problem d I is at least s, i.e. if The probabilistic unique decoding region in (25) is only sightly smaller than the list decoding region in (20).The improved decoding region for LILRS codes is illustrated in Figure 5. Recall from Remark 3 that unlike the proposed decoder, the decoder in [4] has the restriction that n r = n t , which corresponds to the case that γ = δ.Combining ( 22) and ( 25) we get the degree constraint for the probabilistic unique decoder (see [45]) In order to get an estimate of the probability of successful decoding, we use similar assumptions as in [25,45] to derive a heuristic upper bound on the decoding failure probability P f .
The root-finding matrix Q R in ( 23) contains a lower block-diagonal matrix with Under the assumption that the coefficients q (r) i,j are uniformly distributed over F q m (see [25, 45, Lemma 9]), we can upper bound the decoding failure probability P f := Pr(rk q m (Q R ) < sk) by the probability that the (d I × s) matrix Q 0 with uniformly distributed elements from F q m has F q m -rank less than s and get Note, that for D = n t − δ (see (22)) we get Note, that the assumption that the coefficients q (r) i,j are uniformly distributed over F q m does not reflect the distribution of the error space tuple E.Although there is evidence that this assumption is reasonable (see e.g.[50] for folded LRS codes), it does not reflect the actual error model of the multishot operator channel.
Similar as in [25,Lemma 8] for interleaved Gabidulin codes and [31,Theorem 4] for ILRS codes, the conditions of successful decoding of the interpolation-based decoder can be reduced to the conditions of the Loidreau-Overbeck-like decoder from Section 4.2.This reduction allows to obtain an upper bound on the decoding failure probability since the distribution of the error space tuple E is considered in the derivation.The results of the interpolation-based probabilistic unique decoder are summarized in Algorithm 3 and Theorem 6.

Algorithm 3 Probabilistic Unique Decoding of LILRS Codes
Input: A tuple containing the basis matrices U = (U (1) , U (2) , . . ., for the output U = (U (1) , U (2) , . . ., U (ℓ) ) ∈ G q (N , n r ) of an ℓshot operator channel with overall γ insertions and δ deletions for input V(f ) ∈ LILRS[β, a, ℓ, s; n t , k] Output: Message polynomial vector f = (f 1 , . . ., f s ) ∈ F q m [x; σ] s <k or "decoding failure" 1: Define the generalized operator evaluation maps as in (15) 2: Find left F q m [x; σ]-linearly independent Q (1) , . . . ,Q (s ′ ) ∈ Q \ {0} whose left F q m [x; σ]-span contains the F q m -linear solution space Q of Problem 1 3: if s ′ = s then 4: Use Q (1) , . . ., Q (s) to find the unique vector f = (f 1 , . . ., f s ) ∈ F q m [x; σ] s <k that satisfies (21) 5: else 6: return "decoding failure" 7: end if 8: return Message polynomial vector f = (f 1 , . . ., f s ) ∈ F q m [x; σ] s <k Theorem 6 (Probabilistic Unique Decoding of LILRS Codes).Let U ∈ G q (N , n r ) be a tuple of received subspaces of a transmission of a codeword V ∈ LILRS[β, a, ℓ, s; n t , k] over random instance of the ℓ-shot operator channel (see Remark 2) with overall γ insertions and δ deletions.If the number of overall insertions γ and deletions δ satisfy γ + sδ ≤ s(n t − k), then a the unique message polynomial vector f ∈ F q m [x; σ] s <k corresponding to the codeword V(f ) ∈ LILRS[β, a, ℓ, s; n t , k] satisfying d ΣS (V(f ), U ) = γ + δ can be found with probability at least requiring at most O(s ω M(n r )) operations in F q m .Proof.For the purpose of the proof (but not algorithmically), we consider the rootfinding problem set up with an F q m -basis Q (1) , . . . ,Q (dI ) of Q.The unique decoder fails if there are at least two distinct roots f and f ′ .In this case, the F q m -linear system Q R • f R = −q 0 in (24) set up with the F q m -basis Q (r) ∈ Q for r = 1, . . . ,d I has at least two solutions.This means that Q R ∈ F DdI ×sk q must have rank < sk.The matrix Q R contains a lower block triangular matrix with matrices Q 0 , σ −1 (Q 0 ), . . . ,σ −(k−1) (Q 0 ) on the upper diagonal, which have all F q m -rank rk q m (Q 0 ) (see [31]).Thus, if rk q m (Q 0 ) = s the matrix Q R has full F q m -rank sk.Therefore, rk q m (Q R ) < sk implies that Q 0 has rank < s.
Since the root-finding system (24) has at least one solution f R , there is a vector f 0 ∈ F s q m such that Q 0 f 0 = −q ⊤ 0,0 .Thus, the matrix has rank rk q m (Q 0 ) = rk q m (Q 0 ) < s.Hence, there are at least d I − s + 1 F q m -linearly independent polynomials Q (1) , . . ., Q (dI −s+1) ∈ Q such that their zeroth coefficients q (1) l,0 , . . ., q are zero for all l = 0, . . ., s (obtained by suitable) F q m -linear combi- nations of the original basis polynomials Q (1) , . . ., Q (dI ) , such that the corresponding F q m -linear row operations on Q 0 give a (d I − s + 1) × (s + 1) zero matrix (recall that Q 0 has d I rows, but rank at most s − 1).
The d I − s + 1 F q m -linearly independent coefficient vectors of Q (1) , . . . ,Q (dI −s+1) of the form (17) are in the left kernel of the matrix Since the zeroth components q (r) l,0 of all Q (r) are zero for all l = 0, . . ., s and r = 1, . . ., d I − s + 1, this means that the left kernel of the matrix has dimension at least d I − s + 1.The maximum decoding region corresponds to the degree constraint D = n r − γ max = n t − δ (see (22)) and thus Therefore, we have that Observe, that for D = n t − δ we have that where L is the Loidreau-Overbeck decoding matrix from (10).By [31, Lemma 3] the F q m -rank of L and D a (L) is the same and thus we have that rk q m (L) = rk q m ( R I ) < n r − 1 which shows that in this case the Loidreau-Overbeck-like decoder fails as well.Therefore, we conclude that and thus the lower bound on the probability of successful decoding follows from Theorem 3 The lower bound on the probability of successful decoding in ( 27) yields an upper bound on the decoding failure probability P f , i.e. we have that The simulations results in Section 4.5 show that the upper bound on the decoding failure probability in (28) gives a good estimate of the performance of the probabilistic unique decoder.

Insertion/Deletion-Correction with the Complementary Code
In [30,Section 4.4] it was shown, that the complementary of an interleaved (singleshot) subspace code is capable of correcting more deletions than insertions.We will now briefly describe how to extend the concept from [30] to the multishot scenario.In particular, we show that the complementary code of a LILRS code is more resilient against deletions than insertions.By using the arguments from [30, Lemma 14] and [30,Theorem 4] on each of the components of U ⊥ (and U ) we obtain the following result.Proposition 7. Consider a LILRS code C = LILRS[β, a, ℓ, s; n t , k] and the corresponding complementary code C ⊥ .Suppose we transmit a tuple V ⊥ ∈ C ⊥ over a multishot operator channel (3) with overall γ insertions and δ deletions and receive The proof of Proposition 7 can be found in Appendix B. 1. Proposition 7 shows, that the dual of the received tuple U ⊥ , which is U , is a codeword V ∈ C that is corrupted by δ insertions and γ deletions.Therefore we can use the decoder from Section 4.3.3 on U to perform list decoding of γ insertions and δ deletions up to δ + sγ < s(n t − k + 1) or the decoders from Sections 4.2 & 4. 3.4 to perform probabilistic unique decoding up to δ + sγ ≤ s(n t − k).The decoding steps can be summarized as follows: 1. Transmit a tuple V ⊥ ∈ C ⊥ over a multishot operator channel with overall γ insertions and δ deletions.
The channel realization is chosen uniformly at random from all possible realizations of the multishot operator channel with exactly this number of deletions and insertions (see Remark 2).The drawing procedure was implemented using the adapted dynamicprogramming routine in Appendix C.
The results in Figure 6 show, that the upper bound in (27) gives a good estimate of the decoding failure probability.Although the heuristic upper bound from (26) looks tighter for the considered parameters, it is not a strict upper bound for the considered multishot operator channel.For the same parameters a (non-interleaved) lifted linearized Reed-Solomon code [4] (i.e.s = 1) can only correct γ insertions and δ deletions up to γ + δ < 4.

Summary
We considered lifted s-interleaved linearized Reed-Solomon (LILRS) codes for errorcontrol in noncoherent multishot network coding and showed, that the relative overhead due to lifting can be reduced significantly compared to the construction by Martínez-Peñas-Kschischang.We proposed two decoding schemes for the multishot operator channel that are capable of correcting insertions and deletions beyond the unique decoding region in the sum-subspace metric.
We proposed an efficient interpolation-based decoding scheme for LILRS codes, which can be used as a list decoder or as a probabilistic unique decoder and can  correct a total number of γ insertions and δ deletions up to γ + sδ < s(n t − k + 1) and γ + sδ ≤ s(n t − k), respectively, where s is the interleaving order, n t the sum of the dimensions of the transmitted spaces and k the dimension of the code.We derived a Loidreau-Overbeck-like decoder for LILRS codes, which provides arguments to upper bound on the decoding failure probability for the interpolation-based probabilistic unique decoder.
We showed how to construct and decode lifted s-interleaved linearized Reed-Solomon codes for error control in random linear multishot network coding.Compared to the construction by Martínez-Peñas-Kschischang, interleaving allows to increase the decoding region significantly (especially w.r.t. the number of insertions) and decreases the overhead due to the lifting (i.e., increases the code rate), at the cost of an increased packet size.
Up to our knowledge, the proposed decoding schemes are the first being able to correct errors beyond the unique decoding region in the sum-subspace metric efficiently.The tightness of the upper bounds on the decoding failure probability of the proposed decoding schemes for LILRS codes were validated via Monte Carlo simulations.

Remarks on Generality
In this paper, we considered codes constructed by skew polynomials with zero derivations, i.e. polynomials from F q m [x; σ], only.The main reason for this is that for operations in F q m [x; σ] we can give complexity bounds, which are of interest in the implementation point of view.However, the complexity analysis has to be performed w.r.t.this setup (computational complexity may be larger).
We considered decoding of homogeneous LILRS codes, respectively, i.e. interleaved codes where the component codes have the same code dimension.We consider these simpler code classes in order to not further complicate the quite involved notation.The decoding schemes proposed in this paper can be generalized to heterogeneous interleaved codes, where each component code may have a different dimension, in a straight-forward manner like e.g. in [45,51].Denote by k 1 , . . ., k s the dimensions of the component codes and define k := 1 s s l=1 k l .The resulting decoding regions are then γ + sδ < s(n t − k + 1) for list decoding and γ + sδ ≤ s(n t − k) for probabilistic unique decoding.

Outlook & Future Work
For future work it would be interesting to see of the considered concepts applied to interleaved LILRS codes that are based on the construction of linearized Reed-Solomon (LRS) codes over smaller fields.
So far, no results on the list-decodability of random sum-subspace-metric codes, like e.g. for single-shot subspace codes [52], are available.Once such results are available it would be interesting to compare the list-decodability of random sum-subspace-metric codes with constructive results proposed in this paper.The component matrices are then of the form 2 ) ai 0 0 V nt−δ−k ( e where x 1 ) ai = 0 (yielding the zero matrices in the leftmost block) and e (i) 2 ) ai for all l = 1, . . ., s and i = 1, . . ., ℓ. Define the matrices q m for all i = 1, . . ., ℓ. Suppose that the F q -rank of E (i) is less than t (i) .Then there exist a nontrivial F q -linear combination of the columns of the matrix 2 ) ai V nt−δ−k ( e such that the first (upper) (n t −δ−1) rows are nonzero and the last (lower) s(n t −δ−k) rows are all zero.This contradicts that V (i) ∩ E (i) = {0} since each L (i) is obtained by subtracting the evaluations of each f l at the corresponding values in ξ (i) 1 and ξ (i) 2 (and the corresponding row-operator powers thereof).Now assume that rk q ( E (i) | Ê(i) ) < γ (i) for some i ∈ {1, . . ., ℓ}.Then there exist nontrivial F q -linear combinations of the t (i) + κ (i) = γ (i) rightmost columns of L (i) such that the s(n t − δ − k) rows are all zero and the upper n t − δ − 1 rows are nonzero.This contradicts that V (i) ∩ E (i) = {0} by the same argument as above.
Since L is obtained from L via F q m -elementary row operations and F q -elementary column operations, we have that rk q m (L) = rk q m (L).

Fig. 3
Fig. 3  Qualitative illustration of the structure of the tuple Û containing transformed basis matrices.The green parts form a basis for the non-corrupted spaces whereas the red parts indicate a basis for the erroneous spaces.The green part is used to reconstruct the message polynomials. .

2 .
Compute the dual of the received tuple (U ⊥ ) ⊥ = U . 3. Use a decoder from Sections 4.3.3,4.2 & 4.3.4 to recover the tuple V ∈ C. 4. Compute the dual tuple of V to obtain V ⊥ .

f
Upper bound on P f (28) Heuristic upper bound on P f (26) Simulation δ = 1