Functional Converses for Private Matrix-Product Retrieval under Library-Wide Decoder-Side Correlation
We consider private retrieval of the matrix product $A^\top B^{(θ)}$ from replicated $P_c$-colluding servers when $B^{(\ell)}=A+N^{(\ell)}$, with the innovations mutually independent and independent of the user-held $A\in\mathbb{F}_q^{m\times m}$. The servers store the full library, correlated with $A$, which changes both the communication problem and the security definition: a secrecy condition including the stored library cannot hold, as the library itself partly reveals $A$. We therefore measure only additional leakage and require index privacy conditioned on $A$; both reduce to classical notions under independence. For $A$ of rank $k<m$ we prove, with no structural hypothesis on the map, $D^*\geq H(A^\top B^{(θ)}\mid A)/C_{\mathrm{PIR}}(N,P_c,L)-o(km)$, where $C_{\mathrm{PIR}}(N,P_c,L)$ is the replicated $P_c$-colluding private-information-retrieval capacity. The proof rests on a colluding converse for servers storing arbitrary refinements of the demanded messages, whose answers need not be measurable functions of the functional-message library, and a privacy-transfer characterization. Publishing a canonical row-space representative makes the bound achievable for arbitrary independent and identically distributed innovations under a public-setup measure. Under a strengthened observational model (exact correctness, common conditional library support, and full-transcript security), concealment forces $D\geq H(G_m N^{(θ)})/C_{\mathrm{PIR}}$, where $G_m$ spans the linear join of all row spaces in the support of the operand distribution; this extends to vanishing error under a simultaneous-decodability assumption. In the full-rank case product recovery reduces to innovation recovery: $D^*=H(N^{(θ)})/C_{\mathrm{PIR}}+o(m^2)$.