# All-charm tetraquark mass and possible quantum numbers of $X(6900)$

Morgan Kuchta
University of Wrocław, Institute of Theoretical Physics, pl. Maxa Borna 9
Wrocław, 50-204, Poland<EMAIL_ADDRESS>
###### Abstract

In this work we propose possible quantum numbers of $X(6900)$ and suggest a
model for it internal structure that explains its unusually high mass. We
solve the Schrö- dinger Equation with Mathematica 12, first for charmonium
spectrum, then for all-charm tetraquark spectrum which is understood as a pair
of two-particle states, mesons or diquark-antidiquark states. The obtained
candidates for all-charm te-traquark will be separated into contributors to
various resonances and structures that are visible in the experiments then an
explanation for the prominence of $X(6900)$ will be proposed.

##  1 Introduction

In June 2020 in LHCb experiment found in proton-proton collisions exotic meson
originally named $X(6900)$ along with it a broad structure between $6200-6800\
\text{MeV}$ and a smaller peak around $7200\ \text{MeV}$ were found [1]. Until
now, the parity and the charge symmetry, as well as the total angular momentum
of any of the states mentioned here were not identified. The mass of $X(6900)$
was surprisingly high, as before its discovery the expected mass of the ground
state was placed around $6200\ \text{MeV}$, which means that it should have
been found within the region of the broad structure. In 2022, the ATLAS
collaboration searched for potential all-charm tetraquark ($cc\bar{c}\bar{c}$)
states in two different decay channels [2]. Results of the search also feature
a peak around $6900\ \text{MeV}$ and the broad structure visible in results
archived in the previous experiment. The experiment differs from the one
conducted in 2020 by investigating the $J/\psi+\Psi(2S)$ invariant mass
spectrum, where the two significant peaks were found, one supposedly
corresponding to the peak around $6900\ \text{MeV}$ found in LHCb, another
around $7200\ \text{MeV}$, both of them have statistical significance lesser
than $5\sigma$. Other significant results were presented by the CMS
collaboration [3] that suggests three peaks in the $di-J/\psi$ spectrum. A
summary of the results can be found in the Table 1.

Table 1: Summary of estimated masses (in MeV) and widths of four resonances
from three different sources. If the source includes several estimations they
are included with brief descriptions. More detailed explanations can be found
in the sources. Marker "NA" suggests that resonance was either not identified
or its mass was not estimated by the model.
|  | $X(6200)$ | $X(6500)$ | $X(6900)$ | $X(7200)$
---|---|---|---|---|---
LHCb [1] | No interference | Observed | Observed |  $m=6905$ MeV | Observed
$\Gamma=80$ MeV
NRSPS interference | Observed | Observed |  $m=6886$ MeV | Observed
|  |  $\Gamma=168$ MeV |
ATLAS [2] | Model A |  $m=6.22$ GeV |  $m=6.62$ GeV |  $m=6.87$ GeV |  $m=7.22$ GeV
$\Gamma=0.31$ GeV |  $\Gamma=0.31$ GeV |  $\Gamma=0.12$ GeV |  $\Gamma=0.10$ GeV
Model B | NA | NA | NA |  $m=6.78$ GeV
NA | NA | NA |  $\Gamma=0.39$ GeV
CMS [3] | NA |  $m=6552$ MeV |  $m=6927$ MeV |  $m=7287$ MeV
NA |  $\Gamma=124$ MeV |  $\Gamma=122$ MeV |  $\Gamma=95$ MeV

In this work we will suggest possible quantum numbers for the $X(6900)$
together with its quark structure that explains seemingly lacking prominent
ground state and create tables of possible masses of other all-charm and all-
bottom tetraquarks applying a compact tetraquark framework. The discussion
will not involve in-medium effects. Numerical calculations have been performed
using Wolfram Language and Mathematica 13 and the base code by F. Schöberl and
W. Lucha [4] which had been modified and adjusted to its application in the
present work. The code can be found in the supplemental file 1. In this work
we will use new notation for exotic hadrons suggested in reference [5].

##  2 Charmonia and bottomonia

The charmonium spectrum can be obtained through solving the time-independent
Schrödinger equation with Fermi-Breit Hamiltonian [6] with reduced mass
$\mu_{12}=\frac{m_{1}m_{2}}{m_{1}+m_{2}}$,

$\begin{split}\big{[}m_{1}+m_{2}+\frac{1}{2\mu_{12}}\big{(}-\frac{d^{2}}{dr^{2}}+\frac{l(l+1)}{r^{2}}\big{)}+\\\
+V^{S}_{12}+V^{SS}_{12}+V^{LS}_{12}+V^{T}_{12}\big{]}\Psi=E^{n,l}_{12}\Psi.\end{split}$
(1a) The Hamiltonian includes kinetic energy and the contribution of strong
interaction between the quark-antiquark pair. The pair interaction includes
the one gluon exchange (OGE). For the charmonium and the bottomonium spectrum
Cornell potential applies,
$V^{G}_{ij}(r_{ij})=\kappa_{s}\frac{\alpha_{s}}{r_{12}}+\sigma r_{12},$ (1b)
along with three spin dependent terms; spin-spin term $(V_{ij}^{SS})$, spin-
orbit term $(V_{ij}^{SL})$ and tensor term $(V_{ij}^{T})$ ;
$V_{ij}^{SS}(r_{ij})=-\frac{8\kappa_{s}\alpha_{s}\pi}{3m^{2}}(\frac{\sigma_{ss}}{\sqrt{\pi}})^{3}e^{-\sigma_{ss}^{2}r_{ij}^{2}}S_{i}S_{j},$
(1c)
$V_{ij}^{LS}(r_{ij})=\big{[}-\frac{3\kappa_{s}\alpha_{s}}{2m^{2}}\frac{1}{r_{ij}^{3}}-\frac{b}{2m^{2}}\frac{1}{r_{ij}}\big{]}LS,$
(1d)
$V_{ij}^{T}(r_{ij})=-\frac{12\kappa_{s}\alpha_{s}}{4m^{2}}\frac{1}{r_{ij}^{3}}\big{(}\frac{(S_{i}r_{ij})(S_{j}r_{ij})}{r_{ij}^{2}}-\frac{S_{i}S_{j}}{3}\big{)}.$
(1e)

In the equation (1b) there are three parameters to be set. The first one is
the Casimir coefficient $\kappa_{s}$ that can be obtained by calculating
scattering amplitude for the quark-antiquark pair that form a colour-singlet:

$\begin{split}\kappa_{s}^{1}=-f_{1}=\frac{1}{4}\Sigma_{\alpha}(c_{3}^{\dagger}\lambda^{\alpha}c_{1})(c_{2}^{\dagger}\lambda^{\alpha}c_{4})=\\\
=\frac{1}{4}\big{(}\frac{1}{\sqrt{3}}\big{)}^{2}Tr(\lambda^{\alpha}\lambda^{\alpha})=\frac{-4}{3}.\end{split}$
(2)

The other two parameters, strong coupling constant $\alpha_{s}$ and string
tension $\sigma$ are obtained from a fit to the charmonium and bottomonium
spectra and radiative decays [7]. Spin dependent terms include one additional
parameter $\sigma_{ss}$ which is also impossible to determine empirically.
Mesons are formed from two quarks with spin $\frac{1}{2}$ that can either form
spin singlets ($S=0$) or spin triplets ($S=3$):

$2\otimes 2=1\oplus 3.$ (3)

The contribution of the spin-spin internation in the $V^{SS}$ is evaluated
using:

$\langle S_{i}S_{j}\rangle=\frac{1}{2}\langle
S^{2}-S_{1}^{2}-S_{2}^{2}\rangle=\begin{cases}\frac{-3}{4},\quad
S=|0\rangle\\\ \frac{1}{4},\quad S=|1\rangle,\end{cases}$ (4)

where $S_{1},S_{2}$ are the spins of each quark and $S$ is the total spin. In
$V^{SL}$ for $L\neq 0$:

$\langle LS\rangle_{S=|1\rangle}=\begin{cases}-(l-1),\quad J=L-1\\\ -1,\quad
J=L\\\ l,\quad J=L+1.\end{cases}$ (5)

The tensor dependent part of the potential (1e) ought to be transformed with
the usage of the identity (6) [8] to remove $r_{ij}$ dependency and include
$J$ and $L$ instead (7).

$\begin{split}(a\cdot b)r^{2}-3(a\cdot r)(b\cdot
r)=\frac{r^{2}}{(2l+3)(2l+1)}\times\\\ \times(k^{2}(a\cdot b)-3(a\cdot
k)(b\cdot k)-3(b\cdot k)(a\cdot k))\end{split}$ (6) $\begin{split}\langle
T_{ij}\rangle=12\big{\langle}\frac{(S_{i}r_{ij})(S_{j}r_{ij})}{r_{ij}^{2}}-\frac{S_{i}S_{j}}{3}\big{\rangle}=\\\
=\frac{4}{(2l+3)(2l-1)}\big{\langle}S^{2}L^{2}+\frac{3}{2}(LS)+3(LS)^{2}\big{\rangle}\end{split}.$
(7)

Therefore $V^{T}\neq 0$ for $S\neq 0$ and $L\neq 0$:

$\langle T_{ij}\rangle=\begin{cases}2,\quad J=L\\\ \frac{-2(l+1)}{2l-1},\quad
J=L-1\\\ \frac{-2l}{2l+3},\quad J=L+1.\end{cases}$ (8)

We made appropriate choice of the parameters for charmonia (9a) and bottomonia
(9b):

$\begin{split}\alpha_{0}=0.198,\quad\sigma=0.177\ \text{GeV}^{2},\\\
\sigma_{ss}=1.08,\quad m_{c}=1.263\ \text{GeV},\end{split}$ (9a)
$\begin{split}\alpha_{0}=0.164,\quad\sigma=0.177\ \text{GeV}^{2},\\\
\sigma_{ss}=1.08,\quad m_{b}=4.581\ \text{GeV}.\end{split}$ (9b)

Masses and widths of the resonances were sourced from PDG [9].

Table 2: The $c\bar{c}$ mesons and their respective masses ($M_{exp}$) compared to the masses calculated in this work ($M_{cal}$) using parameters (9a). The last column incudes the comparison of $M_{exp}$ with $M_{calc}$ in percentages. |  |  |  |  |  |
---|---|---|---|---|---|---
Name | $N^{2S+1}l_{J}$ | $J^{PC}$ | $M_{exp}(\text{MeV})$ | $\Gamma(\text{MeV})$ | $M_{cal}(\text{MeV})$ | $\frac{M_{cal}-M_{exp}}{M_{exp}}(\%)$
|  |  |  |  |  |
$\eta_{c}(1S)$ | $1^{1}S_{0}$ | $1^{-+}$ | $2983.9\pm 0.5$ | $32.0\pm 0.7$ | 2983.8 | $<0.1$
|  |  |  |  |  |
$J/\psi$ | $1^{3}S_{1}$ | $1^{--}$ | $3096.900\pm 0.006$ | $92.9\pm 2.8$ | 3094.7 | $<0.1$
|  |  |  |  |  |
$h_{c}(1P)$ | $1^{1}P_{1}$ | $1^{+-}$ | $3525.38\pm 0.11$ | $0.7\pm 0.4$ | 3576.1 | 1.4
|  |  |  |  |  |
$\chi_{c0}(1P)$ | $1^{3}P_{0}$ | $0^{++}$ | $3414.71\pm 0.30$ | $10.8\pm 0.6$ | 3286.5 | 3.8
|  |  |  |  |  |
$\chi_{c1}(1P)$ | $1^{3}P_{1}$ | $1^{++}$ | $3510.67\pm 0.05$ | $0.84\pm 0.04$ | 3580.9 | 1.9
|  |  |  |  |  |
$\chi_{c2}(1P)$ | $1^{3}P_{2}$ | $2^{++}$ | $3556.17\pm 0.07$ | $1.97\pm 0.09$ | 3365.6 | 5.4
|  |  |  |  |  |
$\eta_{c}(2S)$ | $2^{1}S_{0}$ | $1^{-+}$ | $3637.5\pm 1.1$ | $11.3\pm 3.2$ | 3576.4 | 1.6
|  |  |  |  |  |
$\psi(2S)$ | $2^{3}S_{1}$ | $1^{--}$ | $3686.10\pm 0.06$ | $294\pm 8$ | 3641.9 | 1.2
|  |  |  |  |  |
$\psi(3770)$ | $1^{3}D_{1}$ | $1^{--}$ | $3773.7\pm 0.4$ | $27.2\pm 1.0$ | 3758.5 | 0.4
|  |  |  |  |  |
$\psi_{2}(3823)*$ | $1^{3}D_{2}$ | $2^{--}$ | $3823.7\pm 0.5$ | $<5.2$ | 3816.4 | 0.4
|  |  |  |  |  |
$\psi_{3}(3842)*$ | $1^{3}D_{3}$ | $3^{--}$ | $3842.71\pm 0.20$ | $2.8\pm 0.6$ | 3602.8 | 6.2
|  |  |  |  |  |
$Z_{c}(3900)$ | $2^{1}P_{1}$ | $1^{+-}$ | $3887.1\pm 2.6$ | $28.4\pm 2.6$ | 4108.3 | 5.7
|  |  |  |  |  |
$\chi_{c0}(3915)$ | $2^{3}P_{0}$ | $0^{++}$ | $3921.7\pm 1.9$ | $18.8\pm 3.5$ | 3561.7 | 9.2
|  |  |  |  |  |
$\chi_{c1}(3872)$ | $2^{3}P_{1}$ | $1^{++}$ | $3871.65\pm 0.06$ | $1.19\pm 0.21$ | 4120.9 | 6.4
Table 3: The $b\bar{b}$ mesons and their respective masses ($M_{exp}$) compared to the masses calculated in this paper ($M_{cal}$) using parameters (9b). The last column incudes the comparison of $M_{exp}$ with $M_{cal}$ in percentages. |  |  |  |  |  |
---|---|---|---|---|---|---
Name | $N^{2S+1}l_{J}$ | $J^{PC}$ | $M_{exp}(\text{MeV})$ | $\Gamma(\text{MeV})$ | $M_{cal}(\text{MeV})$ | $\frac{M_{cal}-M_{exp}}{M_{exp}}(\%)$
|  |  |  |  |  |
$\eta_{b}(1S)$ | $1^{1}S_{0}$ | $1^{-+}$ | $9398.7\pm 2.0$ | $10\pm 5$ | 9417.1 | 0.2
|  |  |  |  |  |
$\Upsilon(1S)$ | $1^{3}S_{1}$ | $1^{--}$ | $9460.30\pm 0.26$ | $\approx 0.054\pm 0.001$ | 9397.4 | 0.7
|  |  |  |  |  |
$\chi_{b0}(1P)$ | $1^{3}P_{0}$ | $0^{++}$ | $9859.44\pm 0.26$ | NA | 9417.1 | 4.4
|  |  |  |  |  |
$\chi_{b1}(1P)$ | $1^{3}P_{1}$ | $1^{++}$ | $9892.78\pm 0.05$ | NA | 9708.2 | 1.9
|  |  |  |  |  |
$\chi_{b2}(1P)$ | $1^{3}P_{2}$ | $2^{++}$ | $9912.21\pm 0.26$ | NA | 9674.6 | 2.3
|  |  |  |  |  |
$\Upsilon(2S)$ | $2^{3}S_{1}$ | $1^{--}$ | $10023.26\pm 0.31$ | $\approx 0.031\pm 0.003$ | 9814.6 | 2.1
|  |  |  |  |  |
$\Upsilon(3S)$ | $2^{3}S_{1}$ | $1^{--}$ | $10355.2\pm 0.56$ | $\approx 0.020\pm 0.002$ | 10102.4 | 2.4
|  |  |  |  |  |
$\Upsilon(4S)$ | $2^{3}S_{1}$ | $1^{--}$ | $10579.4\pm 1.2$ | $20.5\pm 2.5$ | 10358.4 | 1.3
|  |  |  |  |  |
$\Upsilon_{2}(1D)$ | $1^{3}D_{2}$ | $2^{--}$ | $10163.7\pm 1.4$ | NA | 10062.4 | 1.0
|  |  |  |  |  |
$h_{b}(1P)$ | $1^{1}P_{1}$ | $1^{+-}$ | $9899.3\pm 0.8$ | NA | 9713.0 | 1.9

##  3 Tetraquarks

The tools that were first used to properly describe non-exotic hadrons
[10][11] may be applied to the tetraquarks and other exotic hadrons [12][13].
The discussion of potential tetraquark states predates the discovery of the
first exotic hadron candidate $\chi_{c1}(3872)$, previously known as
$X(3872)$, in 2003 [14]. In terms of the fundamental representation, a quark
and an antiquark could form a colour-singlet meson that can be observed in the
resonances or a colour octet (10a). Non-singlet colour states have not been
observed [9] due to the colour confinement, however we can treat newly build
colour octets as our new "building blocks" that may be combined into a colour
singlet and multiple non-singlets (10b).

$3\otimes\bar{3}=1\oplus 8$ (10a) $8\otimes 8=1\oplus 8\oplus 8\oplus
10\oplus\bar{10}\oplus 27$ (10b) The concept of a diquark has been frequently
used to describe exotic hadrons since the conception of the quark model [15].
Compact tetraquarks are usually described as bound states of a diquark and an
antidiquark forming an exotic meson [16]. In this work we will call this
configuration "diquark-antidiquark configuration" or "DA". In addition to the
diquark picture we will also consider combination of two colour octets,
referred to as "meson-meson configuration" or "MM". To obtain masses of the
tetraquarks we use the parameters calculated in the previous section to
calculate masses of colour non-singlet states. $3\otimes 3=\bar{3}\oplus
6,\quad\bar{3}\otimes\bar{3}=3\oplus\bar{6}$ (10c) $6\otimes\bar{6}=1\oplus
8\oplus 27$ (10d) We can see that there are several possible methods of
"composing" tetraquaks. Using the same method as in Eq. (2) to obtain Casimir
Coefficient for colour singlet, we archive the results displayed in the Table
4 and Table 5. The parameters used in the Cornell Potential Eq. (1b) for
interactions between the pairs are identical for those used to obtain
charmonium and bottomonium spectra, modified by the Casimir scaling (11)
[17][18]. A transition from the DA to the MM configuration could be performed
unless the distance between the diquark and the antidiquark is sufficiently
larger than the distance between their constituents [19], therefore the
parameters $\alpha_{s}$ and $\sigma$ need to be scaled accordingly.

Table 4: The Casimir coefficients for the various colour structures of two
partons.
| $q\bar{q}$ |  | $qq$
---|---|---|---
Colour state | $1$ | $8$ |  | $\bar{3}$ | $6$
$\kappa_{s}$ | $-4/3$ | $1/6$ |  | $-2/3$ | $1/3$
Table 5: Casimir coefficients for the two cluster interaction.
| $MM$ |  | $D\bar{D}$
---|---|---|---
Colour state | $MM_{11}$ | $MM_{88}$ |  | $DA_{3\bar{3}}$ | $DA_{6\bar{6}}$
$\kappa_{s}$ | $-4/3$ | $-3$ |  | $-4/3$ | $-10/3$

$\frac{V_{1}(r)}{V_{r}(2)}=\frac{\kappa_{s1}}{\kappa_{s2}}$ (11)

The compact tetraquark picture is a description in which interaction between a
diquark and an antidiquark is treated similarly to interaction between a quark
and an antiquark in a non-exotic meson [20]. The method of using diquarks in
the description of hadronic bound states is not unique to tetraquarks as it
can be used for baryons [21][22] and pentaquarks [23][24]. Using the numerical
method described in previous section we will calculate masses of the diquarks
and the non-singlet quark-antiquark states and use the obtained result to
calculate masses of the tetraquarks composed of those pairs, or in other
words, we treat the problem like a set of three different two-body problems.
In this work we will use Columb-like potential to describe boson exchange
between clusters.

Table 6: Masses of colour sextet diquarks for possible combinations of their quantum numbers. $\kappa_{s}$=$\frac{1}{3}$ |  | S=0 |  | S=1
---|---|---|---|---
| L=0 | L=1 |  | L=0 | L=1
| J=0 | J=1 |  | J=1 | J=0 | J=1 | J=2
N=1 |  | 2819.4 | 2929.4 |  | 2815.1 | 2997.3 | 2929.2 | 2912.0
N=2 |  | 3016.0 | 3100.7 |  | 3011.9 | 3188.6 | 3100.3 | 3084.1
Table 7: Masses of colour triplet diquarks for possible combinations of their quantum numbers. $\kappa_{s}$=$-\frac{2}{3}$ |  | S=0 |  | S=1
---|---|---|---|---
| L=0 | L=1 |  | L=0 | L=1
| J=0 | J=1 |  | J=1 | J=0 | J=1 | J=2
N=1 |  | 2882.3 | 3172.6 |  | 2908.8 | 3072.3 | 3173.8 | 3083.6
N=2 |  | 3226.2 | 3503.8 |  | 3245.6 | 3263.1 | 3503.2 | 3363.5
Table 8: Masses of colour octet quark-antiquark states for possible combinations of their quantum numbers. $\kappa_{s}$=$\frac{1}{6}$ |  | S=0 |  | S=1
---|---|---|---|---
| L=0 | L=1 |  | L=0 | L=1
| J=0 | J=1 |  | J=1 | J=0 | J=1 | J=2
N=1 |  | 2705.2 | 2777.3 |  | 2704.0 | 2808.8 | 2777.2 | 2768.6
N=2 |  | 2830.4 | 2886.9 |  | 2829.3 | 2922.4 | 2886.8 | 2878.3

The Hamiltonian used to calculate masses of the tetraquarks is presented in
Eq. (12a) with $H_{T}$ representing contribution of kinetic energy and
$(V_{ij})$ representing all the potential contributions including the spin
contributions.

$\begin{split}H=H_{T}+V_{(12)(34)}+\\\
+(m_{1}+m_{2}+V_{12})+(m_{3}+m_{4}+V_{34})\end{split}$ (12a)
$H_{T}=\frac{\hat{p}_{12}^{2}}{2\mu_{12}}+\frac{\hat{p}_{34}^{2}}{2\mu_{34}}+\frac{\hat{p}_{1234}^{2}}{2\mu_{1234}}$
(12b)
$\begin{split}\mu_{12}=\frac{m_{1}m_{2}}{m_{1}+m_{2}},\quad\mu_{34}=\frac{m_{3}m_{4}}{m_{3}+m_{4}}\\\
\mu_{1234}=\frac{\mu_{12}\mu_{34}}{\mu_{12}+\mu_{34}}\end{split}$ (12c)
$\begin{split}\vec{r}_{12}=\vec{r}_{1}-\vec{r}_{2},\quad\vec{r}_{34}=\vec{r}_{3}-\vec{r}_{4}\\\
\vec{r}_{1234}=\vec{r}_{34}-\vec{r}_{12}\end{split}$ (12d)
$\begin{split}\vec{R}_{12}=\frac{m_{1}r_{1}}{m_{1}+m_{2}}+\frac{m_{2}r_{2}}{m_{1}+m_{2}},\\\
\vec{R}_{34}=\frac{m_{3}r_{3}}{m_{3}+m_{4}}+\frac{m_{4}r_{4}}{m_{3}+m_{4}}\end{split}$
(12e)
$\vec{R}_{1234}=\frac{\mu_{12}r_{12}}{\mu_{12}+\mu_{34}}+\frac{\mu_{34}r_{34}}{\mu_{12}+\mu_{34}}$
(12f)

One of the significant differences between classic meson and compact
tetraquark is the fact that pairs are bosons, therefore we cannot use identity
found in Eq. (6). Complete representation can be written as:

$(2\otimes 2)\otimes(2\otimes 2)=(1\oplus 3)\otimes(1\oplus 3)=1\oplus 3\oplus
3\oplus 1\oplus 3\oplus 5,$ (13)

therefore for the pair-pair interaction in (1c):

$\begin{split}\langle S_{12}S_{34}\rangle=\frac{1}{2}\langle
S^{2}-S_{1}^{2}-S_{2}^{2}\rangle=\\\ =\begin{cases}0,\quad
S=|0\rangle,S_{12}=S_{34}=|0\rangle\\\ 0,\quad S=|1\rangle,S_{12}\neq
S_{34}\\\ -2,\quad S=|0\rangle,S_{12}=S_{34}=|1\rangle\\\ -1,\quad
S=|1\rangle,S_{12}=S_{34}=|1\rangle\\\ 1,\quad
S=|2\rangle,S_{12}=S_{34}=|1\rangle\\\ \end{cases}.\end{split}$ (14)

Because all of the resonances were identified in $di-J/\psi$ channel (except
for $X(7200)$ which was additionally identified in $J/\psi+\Psi(2S)$ [2]) we
will assume that total angular momentum is $L=0$, so $V^{SL}$ (1d) and $V^{T}$
(1e) can be neglected. Additional adjustment should be made to the
$\alpha_{s}$ to include its scale dependence. Relation (15a) [25][26] with
parameters (15b) and $\mu$ as the reduced mass of the system.

$\alpha_{s}(\mu)=\frac{\alpha_{0}}{ln(\frac{\mu^{2}+\mu_{0}^{2}}{\Lambda_{0}^{2}})}$
(15a) $\mu_{0}\approx 0\ \text{MeV},\quad\Lambda_{0}=0.112\
\text{MeV},\quad\alpha_{0}=3.2524$ (15b)

For the purposes of this work we will use following naming scheme for
potential tetraquark candidates that includes two-letter code, "$MM$" or
"$DA$", with subscript denting possible colour configuration and three sets of
quantum terms; one for total system, two for the pairs. An example of the
usage this naming scheme can be found in Eq. (16.) The naming scheme can
potentially be used to label wave functions for those states.

$DA_{3\bar{3}}(2^{3}S_{1}\leftarrow 1^{1}L_{1}+1^{1}L_{0}).$ (16)

Results with masses of the diquarks have been calculated with use of the code
and placed in the Tables 6-8. Masses of the tetraquarks were calculated by
choosing quantum numbers of the components, quantum numbers of their product
and possible colour combination. The code allows to consider other types of
interaction than the Cornell potential or to consider massive force carriers,
however, we want to stay on safe ground concerning the heavy quarkonia
spectroscopy. The exact results for the ground state ($N=0$) and the first
orbitral excitation ($N=1$) can be for in the tables and energy level diagrams
can be found in Figs 1-3.

##  4 Discussion of the results

We can clearly see that regardless of the composition of the tetraquark there
are multiple candidates for for $X(6900)$. All of the possible candidates are
$N=2$ states. Only sextet-antisextet states have suitable $X(7200)$ candidates
and all the suitable $X(6900)$ candidates in that configuration have
components with $L=0$. Due to the use of a simple model one definite
configuration cannot be suggested with certainty, however the closest lying
candidate is $DA_{6\bar{6}}(2^{3}S_{1}\leftarrow 1^{3}S_{1}+1^{3}S_{1})$. In
the previous section the subject of the wave function was omitted, as it held
no significant impact on the calculation. However, we have to consider
influence of the Pauli exclusion principle on the possibility of the existence
of several resonances. Using the example shown in the Eq. (16) we will show
the use of the notation we introduced to write down the wave function of the
tetraquark:

$\begin{split}|DA_{3\bar{3}}(2^{3}S_{1}\leftarrow
1^{1}L_{1}+1^{1}L_{0})\rangle=|D_{\bar{3}}(1^{1}L_{1})\rangle\langle
A_{3}(1^{1}L_{1})|,\\\ |X_{c}(N^{2S+1}l_{J})\rangle=|Y^{m}_{l}\times
X^{\sigma}\times\ X^{c}\times X^{f}\rangle,\end{split}$ (17)

The four parts of the wave wave function are the spherical harmonics
$Y^{m}_{l}$, the spin wave function $X^{\sigma}$, the colour wave function
$X^{c}$ and the flavour wave function $X^{f}$. The flavour wave functions
$X^{f}$ of a diquark $|D\rangle$ or antiquark $|A\rangle$ is symmetric, unlike
the the wave function for a meson or a meson-like state $|M\rangle$;

$\begin{split}|X^{f}_{D}\rangle=|cc\rangle,\quad|X^{f}_{A}\rangle=|\bar{c}\bar{c}\rangle,\quad|X^{f}_{M}\rangle=|c\bar{c}\rangle.\end{split}$
(18a) The spin wave function is identical for any pair and the total spin wave
function $X^{\sigma}_{S,S_{z}}$ is dependent on the spin wave functions of the
pairs:
$\begin{split}|X^{\sigma}_{0,0}\rangle=\frac{1}{\sqrt{2}}(|\uparrow\downarrow\rangle-|\downarrow\uparrow\rangle),\\\
|X^{\sigma}_{1,0}\rangle=\frac{1}{\sqrt{2}}(|\uparrow\downarrow\rangle+|\downarrow\uparrow\rangle),\\\
|X^{\sigma}_{1,1}\rangle=|\uparrow\uparrow\rangle,\qquad|X^{\sigma}_{1,-1}\rangle=|\downarrow\downarrow\rangle.\end{split}$
(18b) For the pairs only the $|X_{0,0}\rangle$ is antisymmetric. The colour
wave functions for the pairs will not be shown explicitly for the sake of
brevity, however it needs to be explicitly stated that $|X^{c}_{3}\rangle$ is
fully antisymmetric while $|X^{c}_{6}\rangle$ is fully symmetric.

The wave function for the colour antisextet $1^{3}S_{1}$ diquark would have a
wave function that would violate the Pauli exclusion principle, therefore any
state with that subsystem is marked as forbidden.

We have only two possible flavour wave functions for the tetraquark:
$\begin{split}|X^{f}_{MM}\rangle=|X^{f}_{M}\rangle\langle
X^{f}_{M}|=|c\bar{c}c\bar{c}\rangle,\\\
|X^{f}_{DA}\rangle=|X^{f}_{D}\rangle\langle
X^{f}_{A}|=|cc\bar{c}\bar{c}\rangle.\end{split}$ (19a) Assuming that the total
spin of the tetraquark is known as well as the spin of the both pairs we can
obtain the total of six possible total spin wave functions:
$\begin{split}|X_{0,0}^{\sigma_{1}}\rangle=|X^{\sigma}_{0,0}\rangle\langle
X^{\sigma}_{0,0}|\\\
|X_{0,0}^{\sigma_{2}}\rangle=\frac{1}{\sqrt{3}}(|X^{\sigma}_{1,1}\rangle\langle
X^{\sigma}_{1,-1}|+|X^{\sigma}_{1-,1}\rangle\langle X^{\sigma}_{1,1}|\\\
-|X^{\sigma}_{1,0}\rangle\langle X^{\sigma}_{1,0}|)\\\
|X_{1,1}^{\sigma_{3}}\rangle=|X^{\sigma}_{1,1}\rangle\langle
X^{\sigma}_{0,0}|\\\
|X_{1,1}^{\sigma_{4}}\rangle=|X^{\sigma}_{0,0}\rangle\langle
X^{\sigma}_{1,1}|\\\
|X_{1,1}^{\sigma_{5}}\rangle=\frac{1}{\sqrt{2}}(|X^{\sigma}_{1,1}\rangle\langle
X^{\sigma}_{1,0}|+|X^{\sigma}_{1,0}\rangle\langle X^{\sigma}_{1,1}|)\\\
|X_{2,2}^{\sigma_{6}}\rangle=|X^{\sigma}_{1,1}\rangle\langle
X^{\sigma}_{1,1}|.\end{split}$ (19b) There are only three total colour wave
functions that we need to consider:
$\begin{split}|X^{c}_{88}\rangle=|X^{c}_{8}\rangle\langle X^{c}_{8}|,\\\
|X^{c}_{3\bar{3}}\rangle=|X^{c}_{\bar{3}}\rangle\langle
X^{c}_{3}|,\quad|X^{c}_{6\bar{6}}\rangle=|X^{c}_{6}\rangle\langle
X^{c}_{\bar{6}}|.\end{split}$ (19c)

For the $L=0$ the spherical harmonic $Y^{0}_{0}$ is symmetric therefore
$X^{\sigma}\times\ X^{c}\times X^{f}$ must be antisymmetric, therefore we can
mark $DA_{3\bar{3}}(1^{1}S_{0}\leftarrow 1^{1}S_{0}+1^{1}S_{0})$ as forbidden.

Figure 1: Energy level diagram for $DA_{3\bar{3}}$ all-charm tetraquark
structure. Numerical data can be found in Table 9 and Table 10. Masses and
widths of the resonances $X(6900)$ and $X(7200)$ were obtained by ATLAS with
model A [2]. Figure 2: Energy level diagram for $DA_{6\bar{6}}$ all-charm
tetraquark structure. Numerical data can be found in Table 9 and Table 10.
Masses and widths of the resonances $X(6900)$ and $X(7200)$ were obtained by
ATLAS with model A [2]. Figure 3: Energy level diagram for $MM_{88}$ all-charm
tetraquark structure. Numerical data can be found in Table 9 and Table 10.
Masses and widths of the resonances $X(6900)$ and $X(7200)$ were obtained by
ATLAS with model A [2].

One of the problems that we are attempting to solve in this work is finding
the reason of the high mass of the $X(6900)$ and the lack of more prominent
lighter ground state. If we assume that the resonance has $DA_{6\bar{6}}$
structure we could easily explain lack of a prominent resonances closer to
$di-J/\psi$ and $di-\eta_{c}$ mass threshold could be explained by them
violating Pauli exclusion principle, while states with $N=2$ could possibly be
observed.

Figure 4: Energy level diagram for $DA_{6\bar{6}}$ and $N=2$ separated by
orbital angular momentum of the substructures. Masses and widths of the
resonances $X(6900)$ and $X(7200)$ were obtained by ATLAS with model A [2].

Further inspection of the data suggest that $X(6900)$ most likely is either
$0^{-+}$ or $1^{--}$ state that have substructures with orbital angular
momentum $L_{12}=L_{34}=0$. No suggestion for $X(7200)$ can be made, however
if we assume that it has the same colour composition as $X(6900)$ we could
assume that it state with $N=2$ and $L_{12}=L_{34}=1$. The possibility of
$X(7200)$ being a $N=3$ state was not evaluated due to a lack of precision
during the calculation. The other possible compositions of all-charm
tetraquarks might be contributing to the broad structure. Since the background
consists of multiple components and is possibly composed of several all-charm
states with different quantum numbers, the confirmation of quantum numbers of
$X(6900)$ and the other structures would require extraordinary precision and
the ability to separate data from multiple hadrons with identical content.

Assuming that the $bb\bar{b}\bar{b}$ would behave in the same manner as
$cc\bar{c}\bar{c}$, we can calculate potential mass of all-bottom tetraquark.
Assuming that the composition of $DA_{6\bar{6}}(2^{3}S_{1}\leftarrow
1^{3}S_{1}+1^{3}S_{1})$ we archive:

$m(bb\bar{b}\bar{b})\approx 19.23\ \text{GeV}.$ (20)

Due to the high mass, it might be unlikely to confirm the existence of the
resonance in the next few years.

Investigation of the additional decay channels may be prolific, in particular
investigation of channel involving another exotic hadron and/or D mesons.
Despite the lack of significant data about some of the XYZ states, we have
hypotheses regarding their internal dynamics, therefore gaining more
information about possibility of the investigation of intermediate decays may
possibly bring more information about tetraquark structure. Possible
candidates for decay channels are $X(6900)\rightarrow\chi_{c1}(3872)+J/\psi$
or $X(6900)\rightarrow\chi_{c1}(3872)+\eta_{c}$. State $\chi_{c1}(3872)$ is
one of the lowest-lying exotic states and potential identification of it in
the decays may help with obtaining the threshold from sharp all-charm
resonances, since mass of $X(6900)$ is approximately equal to the sum of
masses of the ground state charmonium and $\chi_{c1}(3872)$.

##  5 Conclusions

Assuming $L=0$, the $X(6900)$ might have sextet-antisextet colour structure
with $N=1$ and possible terms $0^{-+}$ or $1^{--}$, possibly a mixed state of
both. The lack of a more prominent resonance with lower energy could be
explained by Pauli exclusion principle. Some of the low-lying $DA_{6\bar{6}}$
resonances do not appear as sharp peaks due to the impact of the non-zero
angular momenta and due to the large number of the states with similar
energies, instead they contribute to the broad structures around 6200 MeV and
6500 MeV.

The octet-octet and triplet-antitriplet structures contribute to the
background and to the low-lying broad structures. One could consider the
possibility that the $DA_{3\bar{3}}$ structure is less prominent than
$DA_{6\bar{6}}$ due to a higher likelihood of the formation of a doubly-
charmed baryon and and its antiparticle instead of tightly bound tetraquark.
More experimental data is needed to determine the quantum numbers of $X(6900)$
and investigating the $J/\psi+\Psi(2S)$ invariant mass spectrum to more
precisely determine the mass of $X(7200)$ and the quantum numbers of the
resonances. Additional decay channels involving the XYZ states, in particular
$\chi_{c1}(3872)$ should be considered.

###  5.1 Acknowledgement

I would like to express my gratitude to my supervisor, prof. dr hab. David
Blaschke for the support during my thesis research and writing of this paper.

## References

  * [1] R. Aaij, et al., Sci. Bull. 65(23), 1983 (2020).  DOI 10.1016/j.scib.2020.08.032
  * [2] G. Aad, et al.  Observation of an excess of di-charmonium events in the four-muon final state with the ATLAS detector (2022)
  * [3] J. Zhang, K. Yi, PoS ICHEP2022, 775 (2022).  DOI 10.22323/1.414.0775
  * [4] W. Lucha, F.F. Schoberl, Int. J. Mod. Phys. C 10, 607 (1999).  DOI 10.1142/S0129183199000450
  * [5] T. Gershon.  Exotic hadron naming convention (2022)
  * [6] W. Lucha, F.F. Schoberl, D. Gromes, Phys. Rept. 200, 127 (1991).  DOI 10.1016/0370-1573(91)90001-3
  * [7] K.G. Wilson, Phys. Rev. D 10, 2445 (1974).  DOI 10.1103/PhysRevD.10.2445
  * [8] H.A. Bethe, E.E. Salpeter, _Quantum Mechanics of One- and Two-Electron Atoms_ (Springer Berlin, 1957).  DOI 10.1007/978-3-662-12869-5
  * [9] R.L. Workman, et al., PTEP 2022, 083C01 (2022).  DOI 10.1093/ptep/ptac097
  * [10] M. Gell-Mann, Phys. Lett. 8, 214 (1964).  DOI 10.1016/S0031-9163(64)92001-3
  * [11] M. Gell-Mann.  The Eightfold Way: A Theory of strong interaction symmetry (1961).  DOI 10.2172/4008239
  * [12] R.L. Jaffe, Phys. Rev. D 15, 267 (1977).  DOI 10.1103/PhysRevD.15.267
  * [13] R.L. Jaffe, Phys. Rev. D 15, 281 (1977).  DOI 10.1103/PhysRevD.15.281
  * [14] S.K. Choi, et al., Phys. Rev. Lett. 91, 262001 (2003).  DOI 10.1103/PhysRevLett.91.262001
  * [15] M. Anselmino, E. Predazzi, S. Ekelin, S. Fredriksson, D.B. Lichtenberg, Rev. Mod. Phys. 65, 1199 (1993).  DOI 10.1103/RevModPhys.65.1199
  * [16] A. Ali, L. Maiani, A.D. Polosa, _Multiquark Hadrons_ , 1st edn. (Cambridge University Press, 2019).  DOI 10.1017/9781316761465
  * [17] G.S. Bali, Phys. Rev. D 62, 114503 (2000).  DOI 10.1103/PhysRevD.62.114503
  * [18] S. Deldar, Phys. Rev. D 62, 034509 (2000).  DOI 10.1103/PhysRevD.62.034509
  * [19] D. Gromes, Z. Phys. C 41, 427 (1988).  DOI 10.1007/BF01585627
  * [20] Progress in Particle and Nuclear Physics 116, 103835 (2021).  DOI https://doi.org/10.1016/j.ppnp.2020.103835.
  * [21] D. Blaschke, A.S. Dubinin, D. Zablocki, PoS BaldinISHEPPXXII, 083 (2015).  DOI 10.22323/1.225.0083
  * [22] J.L. Basdevant, S. Boukraa, Z. Phys. C 30, 103 (1986).  DOI 10.1007/BF01560683
  * [23] R.L. Jaffe, F. Wilczek, Phys. Rev. Lett. 91, 232003 (2003).  DOI 10.1103/PhysRevLett.91.232003
  * [24] H.X. Chen, W. Chen, X. Liu, S.L. Zhu, Phys. Rept. 639, 1 (2016).  DOI 10.1016/j.physrep.2016.05.004
  * [25] A. Deur, S.J. Brodsky, G.F. de Téramond, Progress in Particle and Nuclear Physics 90, 1 (2016).  DOI https://doi.org/10.1016/j.ppnp.2016.04.003
  * [26] W. Buchmuller, S.H.H. Tye, Phys. Rev. D 24, 132 (1981).  DOI 10.1103/PhysRevD.24.132

Table 9: Possible masses of the all-charm tetraquark for $N=1$. States marked with * are forbidden by the Pauli exclusion principle. |  |  |  $M_{12,34}$ (MeV)
---|---|---|---
$(N^{2S+1}l_{J})_{12}$ | $(N^{2S+1}l_{J})_{34}$ | $(N^{2S+1}l_{J})_{12,34}$ | $MM_{88}$ | $DA_{6\bar{6}}$ | $DA_{3\bar{3}}$
$1^{1}S_{0}$ | $1^{1}S_{0}$ | $1^{1}S_{0}$ | 5794.3 | 5980.8 | 6114.0*
$1^{1}S_{0}$ | $1^{3}S_{1}$ | $1^{3}S_{1}$ | 5793.2 | 5977.1* | 6139.3
$1^{3}S_{1}$ | $1^{3}S_{1}$ | $1^{1}S_{0}$ | 5395.0 | 5530.2* | 6085.0
$1^{3}S_{1}$ | $1^{3}S_{1}$ | $1^{3}S_{1}$ | 5607.5 | 5765.4* | 6127.4
$1^{3}S_{1}$ | $1^{3}S_{1}$ | $1^{5}S_{2}$ | 5946.2 | 6150.1* | 6197.0
$1^{1}L_{1}$ | $1^{1}L_{1}$ | $1^{1}S_{0}$ | 5924.2 | 6182.0 | 6673.8
$1^{1}L_{1}$ | $1^{3}L_{0}$ | $1^{3}S_{1}$ | 5956.4 | 6243.0 | 6577.4
$1^{1}L_{1}$ | $1^{3}L_{1}$ | $1^{3}S_{1}$ | 5924.2 | 6177.4 | 6674.9
$1^{1}L_{1}$ | $1^{3}L_{2}$ | $1^{3}S_{1}$ | 5916.3 | 6162.0 | 6617.8
$1^{3}L_{0}$ | $1^{3}L_{0}$ | $1^{1}S_{0}$ | 5613.4 | 5904.9 | 6406.3
$1^{3}L_{0}$ | $1^{3}L_{0}$ | $1^{3}S_{1}$ | 5811.3 | 6115.2 | 6445.2
$1^{3}L_{0}$ | $1^{3}L_{0}$ | $1^{5}S_{2}$ | 6131.8 | 6467.8 | 6510.1
$1^{3}L_{1}$ | $1^{3}L_{1}$ | $1^{1}S_{0}$ | 5542.9 | 5760.2 | 6606.4
$1^{3}L_{1}$ | $1^{3}L_{1}$ | $1^{3}S_{1}$ | 5746.2 | 5980.6 | 6643.2
$1^{3}L_{1}$ | $1^{3}L_{1}$ | $1^{5}S_{2}$ | 6074.1 | 6346.6 | 6705.6
$1^{3}L_{2}$ | $1^{3}L_{2}$ | $1^{1}S_{0}$ | 5525.4 | 5725.7 | 6428.4
$1^{3}L_{2}$ | $1^{3}L_{2}$ | $1^{3}S_{1}$ | 5729.8 | 5948.2 | 6467.1
$1^{3}L_{2}$ | $1^{3}L_{2}$ | $1^{5}S_{2}$ | 6058.9 | 6316.9 | 6531.7
$1^{3}L_{0}$ | $1^{3}L_{1}$ | $1^{3}S_{1}$ | 5781.3 | 6051.0 | 6507.3
$1^{3}L_{0}$ | $1^{3}L_{2}$ | $1^{5}S_{2}$ | 6096.6 | 6393.9 | 6456.2
$1^{3}L_{1}$ | $1^{3}L_{2}$ | $1^{3}S_{1}$ | 5738.0 | 5964.4 | 6555.9
$1^{3}L_{1}$ | $1^{3}L_{2}$ | $1^{5}S_{2}$ | 6066.5 | 6331.7 | 6618.9
Table 10: Possible masses of the all-charm tetraquark for $N=2$. |  |  |  $M_{12,34}$ (MeV)
---|---|---|---
$(N^{2S+1}l_{J})_{12}$ | $(N^{2S+1}l_{J})_{34}$ | $(N^{2S+1}l_{J})_{12,34}$ | $MM_{88}$ | $DA_{6\bar{6}}$ | $DA_{3\bar{3}}$
$1^{1}S_{0}$ | $1^{1}S_{0}$ | $2^{1}S_{0}$ | 6666.5 | 6931.5 | 6558.9
$1^{1}S_{0}$ | $1^{3}S_{1}$ | $2^{3}S_{1}$ | 6665.5 | 6927.8 | 6583.7
$1^{3}S_{1}$ | $1^{3}S_{1}$ | $2^{1}S_{0}$ | 6550.2 | 6801.5 | 6573.7
$1^{3}S_{1}$ | $1^{3}S_{1}$ | $2^{3}S_{1}$ | 6605.0 | 6860.6 | 6591.0
$1^{3}S_{1}$ | $1^{3}S_{1}$ | $2^{5}S_{2}$ | 6728.6 | 6992.9 | 6626.1
$1^{1}L_{1}$ | $1^{1}L_{1}$ | $2^{1}S_{0}$ | 6793.5 | 7127.0 | 7108.4
$1^{1}L_{1}$ | $1^{3}L_{0}$ | $2^{3}S_{1}$ | 6823.4 | 7187.0 | 7013.5
$1^{1}L_{1}$ | $1^{3}L_{1}$ | $2^{3}S_{1}$ | 6793.4 | 7124.4 | 7109.5
$1^{1}L_{1}$ | $1^{3}L_{2}$ | $2^{3}S_{1}$ | 6785.8 | 7109.2 | 7110.0
$1^{3}L_{0}$ | $1^{3}L_{0}$ | $2^{1}S_{0}$ | 6744.3 | 7136.0 | 6885.9
$1^{3}L_{0}$ | $1^{3}L_{0}$ | $2^{3}S_{1}$ | 6795.8 | 7189.8 | 6901.8
$1^{3}L_{0}$ | $1^{3}L_{0}$ | $2^{5}S_{2}$ | 6911.2 | 7308.1 | 6933.9
$1^{3}L_{1}$ | $1^{3}L_{1}$ | $2^{1}S_{0}$ | 6683.8 | 7008.6 | 7080.5
$1^{3}L_{1}$ | $1^{3}L_{1}$ | $2^{3}S_{1}$ | 6736.5 | 7064.6 | 7095.4
$1^{3}L_{1}$ | $1^{3}L_{1}$ | $2^{5}S_{2}$ | 6854.8 | 7188.4 | 7125.8
$1^{3}L_{2}$ | $1^{3}L_{2}$ | $2^{1}S_{0}$ | 6668.0 | 6977.4 | 6907.5
$1^{3}L_{2}$ | $1^{3}L_{2}$ | $2^{3}S_{1}$ | 6720.9 | 7033.8 | 6923.2
$1^{3}L_{2}$ | $1^{3}L_{2}$ | $2^{5}S_{2}$ | 6839.7 | 7158.8 | 6955.2
$1^{3}L_{0}$ | $1^{3}L_{1}$ | $2^{3}S_{1}$ | 6767.3 | 7128.6 | 6983.7
$1^{3}L_{0}$ | $1^{3}L_{2}$ | $2^{5}S_{2}$ | 6876.3 | 7234.5 | 6912.5
$1^{3}L_{1}$ | $1^{3}L_{2}$ | $2^{3}S_{1}$ | 6728.7 | 7049.2 | 7009.8
$1^{3}L_{1}$ | $1^{3}L_{2}$ | $2^{5}S_{2}$ | 6847.3 | 7173.6 | 7040.8


$\prot{\piecewise} \left( \{ \shrB{\bitb_i}, \shr{\vl{v}_i} \}_{i=1}^{m} \right)$Piecewise polynomial evaluation protocolfig:piecewise
Let $\vl{u}_i = \arval{\pd{\bitb_i}}$ and $\mu_i = \arval{\pd{\bitb_i}} \pd{\vl{v}_i} $.

Input(s): $ \{ \shrB{\bitb_i}, \shr{\vl{v}_i} \}_{i=1}^{m} $.

Output: $\shr{\vl{z}} = \shr{\sum_{i=1}^{m} \bitb_i \cdot \vl{v}_i}$.

Preprocessing: For $i \in [m]$, perform the following:

* Parties proceed similar to $\prot{\bitA}$ to generate $\sgr{\vl{u}_i}$ (fig:piBitA).

* Generation of $\sgr{\mu_i}$: Invoke $\piMultsgr(\vl{u}_i, \pd{\vl{v}_i})$.

* Parties locally compute the following:

\begin{align*}
P_1, P_3 : \vl{z}_i^1 &= \arval{\mk{\bitb_i}} \mk{\vl{v}_i} - \arval{\mk{\bitb_i}} \pad{\vl{v}_i}{1}  + (2 \arval{\mk{\bitb_i}} - 1) (\mu_i^{1} -  \mk{\vl{v}_i} \vl{u}_i^{1})\\
P_2, P_3 : \vl{z}_i^2 &= ~~~~~~~~~~~~~- \arval{\mk{\bitb_i}} \pad{\vl{v}_i}{2}  + (2 \arval{\mk{\bitb_i}} - 1) (\mu_i^{2} -  \mk{\vl{v}_i} \vl{u}_i^{2})\\
P_1, P_2 : \vl{z}_i^3 &= ~~~~~~~~~~~~~- \arval{\mk{\bitb_i}} \pad{\vl{v}_i}{3}  + (2 \arval{\mk{\bitb_i}} - 1) (\mu_i^{3} -  \mk{\vl{v}_i} \vl{u}_i^{3})
\end{align*}

* Set $\vl{z}^1 = \sum_{i=1}^{m} \vl{z}_i^1$,  $\vl{z}^2 = \sum_{i=1}^{m} \vl{z}_i^2$,  $\vl{z}^3 = \sum_{i=1}^{m} \vl{z}_i^3$

* $(P_1, P_3), (P_2, P_3), (P_1, P_2)$ execute $\prot{\JSh}$ on $\vl{z}^1, \vl{z}^2, \vl{z}^3$ to generate the respective $\shr{\cdot}$-shares.

* Compute $\shr{\vl{z}} = \shr{\vl{z}^1} + \shr{\vl{z}^2} + \shr{\vl{z}^3}$.

Non-Linear Activation functions

We discuss two widely used activation functions, (i) Rectified Linear Unit ($\relu$) and (ii) Sigmoid (Sig). These functions can be viewed as piece-wise polynomial functions and can thus be evaluated using the protocol mentioned above ($\prot{\piecewise}$, fig:piecewise).

(i) ReLU:

The $\relu$ function, $\relu(\vl{v}) = \max(0, \vl{v})$, can be written as a piece-wise polynomial function as follows.

\begin{align*}
\relu(\vl{v}) =
\begin{cases}
0, & \vl{v} <0 \\
\vl{v} & 0 \leq \vl{v}
\end{cases}
\end{align*}

(ii) Sig:

We use the MPC-friendly variant of the Sigmoid function <cit.> which is given below:

\begin{align*}
\sig(\vl{v}) = \left\{
\begin{array}{lll}
0                  & \quad \vl{v} < -\frac{1}{2} \\
\vl{v} + \frac{1}{2} & \quad - \frac{1}{2} \leq \vl{v} \leq \frac{1}{2} \\
1                  & \quad \frac{1}{2} < \vl{v}
\end{array}
\right.
\end{align*}

ArgMin/ ArgMax

The formal protocol appears in fig:piargmin. Here, $\pibitextf(\shr{\vl{x}_1}, \shr{\vl{x}_2})$ computes the boolean sharing corresponding to the $\msb$ of $\vl{x}_1 - \vl{x}_2$.

$\piargmin (\shr{\vct{x}})$Protocol to find index of smallest element in $\vct{x}$fig:piargmin
Let $\vct{b}$ be the bit vector of size $m$, where $m$ equals the size of $\vct{x}$. Parties execute the following steps in the respective preprocessing and online phases.

* If $m = 2$, do the following.

– $\shrB{\vl{d}_1} = \pibitextf(\shr{\vl{x}_1}, \shr{\vl{x}_2})$ and $\shrB{\vl{d}_2} = 1 \xor \shrB{\vl{d}_1}$.

– $\shr{\vl{y}} = \piobv(\shr{\vl{x}_2}, \shr{\vl{x}_1}, \shrB{\vl{d}_1})$.

– Return $(\shrB{\vl{d}_1}, \shrB{\vl{d}_2}, \shr{\vl{y}})$.

* Else, if $m = 3$, do the following

– $\shrB{\vl{d}_1^{\prime}} = \pibitextf(\shr{\vl{x}_1}, \shr{\vl{x}_2})$.

– $\shr{\vl{y}^{\prime}} = \piobv(\shr{\vl{x}_2}, \shr{\vl{x}_1}, \shrB{\vl{d}_1^{\prime}})$.

– $\shrB{\vl{d}_2^{\prime}} = \pibitextf(\shr{\vl{y}^{\prime}}, \shr{\vl{x}_3})$.

– $\shr{\vl{y}} = \piobv(\shr{\vl{x}_3}, \shr{\vl{y}^{\prime}},\shrB{\vl{d}_2^{\prime}})$.

– $\shrB{\vl{d}_1} = \piMult(\shrB{\vl{d}_1^{\prime}}, \shrB{\vl{d}_2^{\prime}})$, $\shrB{\vl{d}_2} = \shrB{\vl{d}_2^{\prime}} \xor \shrB{\vl{d}_1}$.

– $\shrB{\vl{d}_3} = 1 \xor \shrB{\vl{d}_1^{\prime}} \xor \shrB{\vl{d}_2^{\prime}}$.

– Return $(\shrB{\vl{d}_1}, \shrB{\vl{d}_2}, \shrB{\vl{d}_3}, \shr{\vl{y}})$.

* Else, let $\vct{x_1} = (\vl{x}_1, \ldots, \vl{x}_{\lfloor m/2 \rfloor})$ and $\vct{x_2} = (\vl{x}_{\lfloor m/2 \rfloor + 1}, \ldots, \vl{x}_m)$.

–  $\big(\shrB{\vl{d}_1}, \ldots, \shrB{\vl{d}_{\lfloor m/2 \rfloor}}, \shr{\vl{y}_1} \big) = \piargmin(\shr{\vct{x_1}})$.

–  $\big(\shrB{\vl{d}_{\lfloor m/2 \rfloor + 1}}, \ldots, \shrB{\vl{d}_m}, \shr{\vl{y}_2} \big) = \piargmin(\shr{\vct{x_2}})$.

–  $\shrB{\vl{d}} = \pibitextf(\shr{\vl{y}_1}, \shr{\vl{y}_2})$.

–  $\shr{\vl{y}} = \piobv(\shr{\vl{y}_2}, \shr{\vl{y}_1}, \shrB{\vl{d}})$.

– $\shrB{\bitb_j} = \piMult(\shrB{\vl{d}}, \shrB{\vl{d}_j})$ ; $j \in \{1, \ldots, \lfloor m/2 \rfloor \}$.

– $\shrB{\bitb_j} = \piMult(1 \xor \shrB{\vl{d}}, \shrB{\vl{d}_j})$ ; $j \in \{ \lfloor m/2 \rfloor + 1, \ldots, m \}$.

– Return $\big( \shrB{\bitb_1},  \ldots, \shrB{\bitb_m}, \shr{\vl{y}} \big)$.

To begin with, parties initialize $\bitb_j = 1$ for $\bitb_j \in \vct{b}$ by locally setting $\mk{{\bitb}_j} = 1$ and $\pad{{\bitb}_j}{1} = \pad{{\bitb}_j}{2} = \pad{{\bitb}_j}{3} = 0$. The minimum, $\vl{y}_{ij}$, of two elements, $\vl{x}_i,\vl{x}_j$ can be computed as: one invocation of bit extraction protocol to obtain $\shrB{\cdot}$-sharing of $\bitb_{ij}$, where $\bitb_{ij} = 1$ if $\vl{x}_i < \vl{x}_j$, and $\bitb_{ij} = 0$ otherwise; one invocation of oblivious selection protocol $\piobv(\vl{x}_j, \vl{x}_i, \bitb_{ij})$, which outputs $\shr{\cdot}$-shares of $\vl{y}_{ij} = \vl{x}_j$ if $\bitb_{ij} = 0$, and $\vl{y}_{ij} = \vl{x}_i$, otherwise.

To update $\vct{b}$ to reflect the pairwise minimums, we view the elements $\vl{x}_j \in \vct{x}$ as the leaves of a binary tree, in a bottom-up manner. For two elements in a pair, say $(\vl{x}_i, \vl{x}_j)$, whose pairwise minimum is $\vl{y}_{ij}$, we let $\vl{y}_{ij}$ be the root node with $\vl{x}_i$ as its left child and $\vl{x}_j$ as its right child. Now, to update $\vct{b}$, parties multiply $\bitb_{ij}$ with the bits in $\vct{b}$ associated with the left-reachable leaf nodes, which comprise of all the leaf nodes (elements of $\vct{x}$) that are reachable through the left child of the root.

Similarly, parties multiply $1 \xor \bitb_{ij}$ with the bits in $\vct{b}$ associated with the right-reachable leaf nodes, which comprise of all the leaf nodes (elements of $\vct{x}$) that are reachable through the right child of the root. Thus, if $\bitb_{ij} = 1$ indicating that $\vl{x}_i < \vl{x}_j$, $\bitb_i$ remains $1$ as it gets multiplied by $\bitb_{ij} = 1$ while $\bitb_j$ gets reset to $0$ as it gets multiplied by $1 \xor \bitb_{ij} = 0$. The case for $\bitb_{ij} = 0$ holds for similar reasons.

Given the values $\vl{y}_{ij}$ for the next level, and the updated $\vct{b}$, the steps are applied recursively until the minimum element is obtained.

The protocol $\piargmax$ which allows the parties to compute the index of the largest element in a $\shr{\cdot}$-shared vector $\vct{x} = (\vl{x}_1, \ldots, \vl{x}_m)$, is similar to $\piargmin$ with the following difference. To find the maximum among two elements $(\shr{\vl{x}_i}, \shr{\vl{x}_j})$, parties run the bit extraction protocol to obtain $\shrB{\bitb_{ij}}$ as before, followed by $\piobv(\vl{x}_i, \vl{x}_j, \bitb_{ij})$, which outputs $\shr{\cdot}$-shares of $\vl{y}_{ij} = \vl{x}_i$ if $\bitb_{ij} = 0$, and $\vl{y}_{ij} = \vl{x}_j$, otherwise. Now, $\vct{b}$ is updated in each level by multiplying $1 \xor \bitb_{ij}$ with the bits in $\vct{b}$ associated with the left-reachable leaf nodes (as described before) and multiplying $\bitb_{ij}$ with the bits in $\vct{b}$ associated with the right-reachable leaf nodes.

§ GARBLED WORLD

§.§ Garbling scheme and properties

As per Yao's garbling circuit paradigm <cit.>, every wire in the circuit is assigned two $\csec$-bit strings, called “keys”, one each for bit value $0$ and $1$ on that wire. Let $(\key{\vl{x}}{0},\key{\vl{x}}{1})$ denote the zero-key and one-key, respectively, on wire $\vl{x}$ in the circuit.
For simplicity, the same notation is used for wire identity as well as the value on the wire. For instance,  the key-pair for wire $\vl{x}$ is denoted as $(\key{\vl{x}}{0},\key{\vl{x}}{1})$, while the key corresponding to bit  $\vl{x}$ on the wire is denoted as $\key{\vl{x}}{\vl{x}}$.
Then, each gate is constructed by encrypting the output-wire key with the appropriate input-wire keys. For example, for an AND gate with input wires $\vl{x}, \vl{y}$ and output wire $\vl{z}$, $\key{\vl{z}}{0}$ is double encrypted with keys $\key{\vl{x}}{0}, \key{\vl{y}}{0}$, with $\key{\vl{x}}{0}, \key{\vl{y}}{1}$, and with $\key{\vl{x}}{1}, \key{\vl{y}}{0}$, while $\key{\vl{z}}{1}$ is double encrypted with $\key{\vl{x}}{1}, \key{\vl{y}}{1}$. Given one key on each input wire, the output wire key can be obtained by decrypting the ciphertext which was encrypted using the corresponding input wire keys. These ciphertexts are provided in a permuted order so that the evaluating party does not learn which key, $\key{\vl{z}}{0}$ or $\key{\vl{z}}{1}$, it obtains after decryption.

Formally, a garbling scheme $\GS$, consists of four algorithms $(\Gb, \En, \allowbreak \Ev, \De)$ defined as follows:

* $\Gb(\onesec,\Ckt) \rightarrow (\GC,e,d)$: $\Gb$ takes as input the security parameter $\kappa$ and the circuit $\Ckt$ to be garbled, and outputs a garbled circuit $\GC$, encoding information $e$ and decoding information $d$.

* $\En(x,e) \rightarrow \X$: $\En$ encodes input $x$ using $e$ to output encoded input $\X$. $\X$ is referred to as encoded input or encoded keys interchangeably.

* $\Ev(\GC,\X) \rightarrow \Y$:  $\Ev$ evaluates the garbled circuit $\GC$ on the encoded input $\X$ and produces the encoded output $\Y$.

* $\De(\Y,d) \rightarrow y$: The encoded output $\Y$ is decoded into the clear output $y$ by running the $\De$ algorithm on $\Y$ and $d$.

We rely on the following properties of garbling scheme <cit.> in our constructions.

* A garbling scheme $\GS = (\Gb, \En, \Ev, \De)$ is correct if for all input lengths $n \leq \poly(\csec)$, circuits $C: \{0,1\}^{n} \rightarrow \{0,1\}^{m}$ and inputs $x \in \{0,1\}^{n}$, the following holds.

\begin{align*}
\Prob[\De(\Ev(\GC, \En(x, e)), d) \neq C(x) : \\~~~(\GC, e, d) \leftarrow \Gb(\onesec, C)] < \negl(\csec)
\end{align*}

* A garbling scheme $\GS$ is said to be private if for all $n \leq \poly(\csec)$, circuit $C: \{0,1\}^{n} \rightarrow \{0,1\}^{m}$, there exists a $\ppt$ simulator $\Sim_{\priv}$ such that for all $x \in \{0,1\}^{n}$, for all $\ppt$ adversary $\Adv$ the following distributions are computationally indistinguishable.

- $\Real(C, x)$: run $(\GC, e, d) \leftarrow \Gb(\onesec, C)$ and output $(\GC, \En(x, e), d)$.

- $\Ideal(C, C(x))$: run $(\GC^{\prime}, \textbf{X}, d^{\prime}) \leftarrow \Sim_{\priv}(\onesec, C, C(x))$ and output $(\GC^{\prime}, \textbf{X}, d^{\prime})$.

* A garbling scheme $\GS$ is authentic if for all $n \leq \poly(\csec)$, circuit $C: \{0,1\}^{n} \rightarrow \{0,1\}^{m}$, input $x \in \{0,1\}^{n}$ and for all $\ppt$ adversary $\Adv$, the following probability is $\negl(\csec)$.

\begin{align*}
\Prob \Bigg(
\begin{aligned}
&\hat{\textbf{Y}} \neq \Ev(\GC, \textbf{X}) \\
&\wedge \De(\hat{\textbf{Y}}, d) \neq \bot
\end{aligned}
\!
\begin{aligned}
\textbf{X} = \En(x, e), &(\GC, e, d) \leftarrow \Gb(\csec, \Ckt), \\
&\hat{\textbf{Y}} \leftarrow \Adv(\GC, \textbf{X})
\end{aligned}
\Bigg)
\end{align*}

§.§ 2GC Variant

We begin with the details of the evaluation and output phases.

Let $f(\vl{x})$ be the function to be evaluated. At this point, the function input is $\shrC{\cdot}$-shared. This renders $\shrG{\cdot}$-sharing for the input of the GC that corresponds to the function $f'\big({\mk{\vl{x}}}, {\av{\vl{x}}}, {\pad{\vl{x}}{3}} \big)$ which first combines the given boolean-shares to compute the actual input and then applies $f$ on it. Let $\GC_j$ denote the garbled circuit to be sent to $P_j \in \{P_1, P_2\}$ by garblers in $\PlSet{j}$. Sending of $\GC_j$ is overlapped  with the key transfer (during generation of $\shrC{\vl{x}}$), to save rounds, where garblers in $\{P_0, P_3\}$ $\jsend$ $\GC_j$ to $P_j$. On receiving the $\GC$, evaluators evaluate their respective GCs and obtain the key corresponding to the output, say $\vl{z}$. This generates $\shrG{\vl{z}}$.

Output phase

The goal of output computation is to compute the output $\vl{z}$ from $\shrG{\vl{z}}$.
To reconstruct $\vl{z}$ towards $P_j \in \{P_1, P_2\}$, two garblers in $\PlSet{j}$ send the least significant bit $\vl{p}^j$ of $\key{\vl{z}}{0, j}$, referred to as the decoding information, to $P_j$. If the received values are consistent, $P_j$ uses the received $\vl{p}^j$ to reconstruct $\vl{z}$ as $\vl{z} = \vl{p}^j \xor \vl{q}^j$, where $\vl{q}^j$ denotes the least significant bit of $\key{\vl{z}}{\vl{z}, j}$; else $P_j$ aborts.

To reconstruct $\vl{z}$ towards the garblers $P_g \in \{P_0, P_3\}$, one evaluator, say $P_1$ sends the least significant bit, $\vl{q}^1$, of $\key{{\vl{z}}}{\vl{z}, 1}$ along with $\h = \Hash(\key{{\vl{z}}}{\vl{z}, 1})$ to $P_g$, where $\Hash$ is a collision-resistant hash function. If a garbler received a consistent $(\vl{q}^1, \h)$ pair from $P_1$ such that there exists a $K \in \{\key{{\vl{z}}}{{0, 1}}, \key{{\vl{z}}}{{1, 1}}\}$ whose least significant bit is $\vl{q}^1$ and $\Hash(K) = \h$, then it uses $\vl{q}^1$ for reconstructing $\vl{z}$; else the garbler aborts the computation.
Note that a corrupt evaluator $P_1$ cannot create confusion among garblers in $\{P_0, P_3\}$ by sending the key that was not output by the GC owing to the authenticity of the garbling scheme. Reconstruction is lightweight and requires a single round for garblers while reconstruction towards evaluators can be overlapped with key transfer and does not incur extra rounds.
The protocol appears in fig:pirec.

$\pigrec(\Partyset, \shrG{\vl{z}})$Output computation: reconstruction of $\vl{z}$fig:pirec

* For an output wire $\vl{z}$, let $\vl{p}^j$ denote the least significant bit of $\key{{\vl{z}}}{0,j}$ and $\vl{q}^j$ denote the least significant bit of $\key{{\vl{z}}}{\vl{z},j}$for $j \in \{1, 2\}$.

* Reconstruction towards $P_j \in \{P_1, P_2\}$: Garblers $P_0, P_3$ in $\PlSet{j}$ $\jsend$ $\vl{p}^j$ to $P_j$. If $P_j$ received consistent values from $P_0, P_3$, it reconstructs $\vl{z}$ as $\vl{z} = \vl{p}^j \xor \vl{q}^j$.

* Reconstruction towards $P_g \in \{P_0, P_3\}$: $P_1$ sends $\vl{q}^1$ and $\h = \Hash(\key{{\vl{z}}}{\vl{z},1})$ to $P_g$, where $\Hash$ is a collision-resistant hash function.
$P_g$ uses the $\vl{q}^1$ received from $P_1$ for reconstructing $\vl{z}$ as $\vl{z} = \vl{p}^1 \xor \vl{q}^1$ if there exists a $K \in \{\key{{\vl{z}}}{{0,1}}, \key{{\vl{z}}}{{1,1}}\}$ whose least significant bit is $\vl{q}^1$ and $\Hash(K) = \h$.

Optimizations when deployed in mixed framework

Working in the preprocessing model enables transfer of the (communication-intensive) GC and generating $\shrG{\cdot}$-shares of the input-independent shares of $\vl{x}$ (i.e. $ {\av{\vl{x}}}, {\pad{\vl{x}}{3}}$) in the preprocessing phase. Thus, the online phase is very light and only requires one round to generate $\shrG{\cdot}$-shares  for the input-dependent data (i.e. ${\mk{\vl{x}}}$). Since evaluation is local, evaluators obtain $\shrG{\cdot}$-sharing of the GC output at the end of $1$ round.

Achieving fairness and robustness

To ensure fairness, we require a fair reconstruction protocol which proceeds as follows. As described in <ref>, parties first ensure that all parties are alive.
If so, they proceed similar to the protocol in fig:pirec, except with the following differences. For reconstruction towards evaluators, all three respective garblers send it the decoding information. The evaluator selects the value appearing in majority for reconstruction. For reconstruction towards garblers $P_0, P_3$, both the evaluators send the least significant bit of the output key together with its hash to the garbler. The presence of at least one honest evaluator guarantees that both garblers will be on the same page.

To achieve robustness, the main difference from its fair counterpart is use of a robust $\jsend$ primitive. This guarantees that in the event that a misbehaviour is detected, a $\TTP$ is identified which can take the computation to completion and deliver the output to all.

§.§ 1 GC Variant

The input $\vl{x} = \vl{x}_1 \xor \vl{x}_2 \xor \vl{x}_3$ for this variant consists of the shares, $\vl{x}_1 = \mk{\vl{x}} \xor \pad{\vl{x}}{2}$ and $\vl{x}_2 = \pad{\vl{x}}{3}, \vl{x}_3 = \pad{\vl{x}}{1}$, where $\mk{\vl{x}}, \pad{\vl{x}}{1}, \pad{\vl{x}}{2}, \pad{\vl{x}}{3}$ are as defined in $\shrB{\vl{x}}$. While keys for the GC are sampled by all three garblers $P_0, P_2, P_3$, it suffices for only $P_0, P_3$ to generate and $\jsend$ the GC to evaluator $P_1$, and $P_2$ assists only in the key transfer. Elaborately, the common input $\vl{x}_3$ held by $P_0, P_3$ is hard-coded in the circuit before being garbled by them. This necessitates a key transfer only for inputs $\vl{x}_1$ and $\vl{x}_2$. Garblers $P_0, P_2, P_3$ generate keys for the inputs following a similar procedure as in the 2GC variant. Then, $P_2, P_3$ $\jsend$ the key for $\vl{x}_1$ to $P_1$ while garblers $P_0, P_2$ $\jsend$ the key for $\vl{x}_2$.

The evaluation and output phases are similar to the 2GC variant except that now there exists only a single garbling instance. Looking ahead, in the mixed protocol framework, the output has to be reconstructed towards $P_1, P_2$. Reconstruction towards $P_1$ does not incur additional rounds since sending of decoding information can be overlapped with key transfer. However, unlike in the 2GC variant where reconstruction towards $P_2$ can be done similar to reconstruction towards $P_1$, in the 1GC variant an additional round is required as $P_2$ is no longer an evaluator. This incurs one extra round as opposed to the 2GC variant.

Achieving fairness

To ensure fair reconstruction (<ref>), parties first perform an aliveness check. Following this, they proceed towards fair reconstruction of $\vl{z}$ from $\shrG{\vl{z}}$ as follows. First, reconstruction of $\vl{z}$ is carried out towards the garblers $P_g \in \PlSet{1}$. For this, $P_1$ sends $\vl{q}$ (least significant bit of zz) and $\h = \Hash(\key{{\vl{z}}}{\vl{z}})$ to $P_g$ as before. Now, if a garbler received a consistent $(\vl{q}, \h)$ pair from $P_1$ such that there exists a $K \in \{\key{{\vl{z}}}{{0}}, \key{{\vl{z}}}{{1}}\}$ whose least significant bit is $\vl{q}$ and $\Hash(K) = \h$, then it uses $\vl{q}$ for reconstructing $\vl{z}$, and sends $\vl{z}$ to its co-garblers. Else, a garbler accepts a $\vl{z}$ received from a co-garbler as the output. Thus, further dissemination of the output by garblers ensures that all parties are on the same page.
If garblers receive the output, reconstruction of $\vl{z}$ is carried out towards $P_1$. For this, all garblers (who received the output) send the decoding information to $P_1$ who selects the majority value to reconstruct $\vl{z}$.

Achieving robustness

To attain robustness, we list below the differences from the fair protocol that have to be carried out. The first difference is use of a robust variant of $\jsend$. Second, in input sharing protocol, where $\vl{x}_1$ is held by only garbler $P_0$, a corrupt $P_0$ may refrain from providing $P_1$ with the correct key (sent as the opening information for the commitment). To ensure robustness, in the event that $P_1$ fails to receive the correct key from $P_0$, we let $P_1$ complain to all parties about this inconsistency by sending an inconsistency bit. All parties exchange this inconsistency bit among themselves, and agree on the majority value. If all parties agree on the presence of an inconsistency, then $P_0, P_1$ are identified to be in conflict and $\TTP = P_2$ is set to carry out the rest of the computation.
Finally, to ensure a robust reconstruction, the following approach is taken. Observe that the fair reconstruction provides robustness as long as evaluator $P_1$ is honest. In the event when none of the garblers obtain the output in the fair protocol, it is guaranteed that evaluator $P_1$ is corrupt. Thus, in such a scenario, all parties take $P_1$ to be corrupt, and proceed with $P_0$ as the $\TTP$.

§ MIXED FRAMEWORK

Arithmetic to Boolean Conversion

The protocol for arithmetic to boolean conversion appears in fig:piab.

$\piab$Arithmetic to Boolean Conversionfig:piab
Preprocessing: $P_0, P_3$ execute joint boolean sharing to generate $\shrB{\vl{v}_2}$,  where $\vl{v}_2 =-(\pad{\vl{v}}{1} + \pad{\vl{v}}{2})$.

* $P_1, P_2$ execute joint boolean sharing to generate $\shrB{\vl{v}_1}$, where $\vl{v}_1 = \mk{\vl{v}} - \pad{\vl{v}}{3}$.

* Parties obtain $\shrB{\vl{v}} = \shrB{\vl{v}_1} + \shrB{\vl{v}_2}$ using addition circuit.

Boolean to Arithmetic Conversion

The protocol for arithmetic to boolean conversion appears in fig:piba. We remark that the protocol $\piba$ can be used to efficiently generate edaBits <cit.> in our setting. For this, the parties non-interactively generate the boolean sharing for $\ell$-bits and perform the $\piba$ conversion to obtain the equivalent arithmetic value.

$\piba(\Partyset, \shrB{\vl{v}})$Boolean to Arithmetic Conversionfig:piba
Let $\vl{v}_i$ denote the $i$th bit of $\vl{v}$. Let ${\pd{\vl{v}}}_i = \pad{\vl{v}_i}{1} \xor \pad{\vl{v}_i}{2} \xor \pad{\vl{v}_i}{3}$, $\vl{p}_i = \arval{({{\mk{\vl{v}}}}_i)}$, and $\vl{q} = \arval{({{\pd{\vl{v}}}}_i)}$

* For $i \in \{0, 1, \ldots, \ell-1 \} $, parties execute the preprocessing of $\prot{\bitA}$ (fig:piBitA) for each bit $\vl{v}_i$ of $\vl{v}$, to generate $\sgr{{\vl{q}_i}} = (\vl{q}_i^1, \vl{q}_i^2, \vl{q}_i^3)$.

Online: Let $\vl{y}_i = \arval{\vl{v}_i}$ and $\vl{y}$ denotes the arithmetic equivalent of $\vl{v}$.

* Parties locally compute the following:

\begin{align*}
P_1, P_3: \vl{y}^1 = \sum_{i=0}^{\ell-1} 2^i \vl{y}_i^1  &=  \sum_{i=0}^{\ell-1} 2^i (\vl{p}_i + \vl{q}_i^1 (1 - 2\vl{p}_i)) \\
P_2, P_3: \vl{y}^2 = \sum_{i=0}^{\ell-1} 2^i \vl{y}_i^2 &=  \sum_{i=0}^{\ell-1} 2^i (\vl{q}_i^2 (1 - 2\vl{p}_i))  \\
P_1, P_2: \vl{y}^3 = \sum_{i=0}^{\ell-1} 2^i \vl{y}_i^3  &=  \sum_{i=0}^{\ell-1} 2^i (\vl{q}_i^3 (1 - 2\vl{p}_i))
\end{align*}

* $(P_1, P_3), (P_2, P_3), (P_1, P_2)$ execute $\prot{\JSh}$ on $\vl{y}^1, \vl{y}^2, \vl{y}^3$ to generate the respective $\shr{\cdot}$-shares.

* Parties locally compute $\shr{\vl{y}} = \shr{\vl{y}^1} + \shr{\vl{y}^2} + \shr{\vl{y}^3}$.

End-to-end Conversions

4PCConvM2, 4PCConvM1 compare our sharing conversions with Trident <cit.>.
The cost for the 2GC variant of Trident is computed by incorporating a parallel execution, where $P_3$ is additionally made an evaluator together with $P_0$.

For uniformity, we consider a function, F, to be computed on an $\ell$-bit inputs $\vl{x}, \vl{y}$ using a garbled circuit (GC) in the mixed framework, which gives an $\ell$-bit output $\vl{z} = \mathsf{F(\vl{x}, \vl{y})}$, where $\ell$ denotes the ring size in bits. Let  $\Grb{F}$  denote the corresponding GC. In the table, $\Grb{S2}$ denotes a 2-input garbled subtraction circuit; $\GrbD{}$ denotes the garbled circuit with decoding information; $\Grb{n_1\times1,\ldots,n_m \times m}$ denotes ${\sf n_i}$ instances of GC $\Grb{i}$ for $i \in \{1,\dots,{\sf m}\}$ and $\Size{\Grb{n_1\times1,\ldots,n_m \times m}}$ denotes the collective size.

ProtocolA: arithmetic, B: boolean, G: garbled
[r]CommunicationNotations: $\ell$ - size of ring in bits, $\kappa$ - computational security parameter.

Trident              [r]2-1$2\Size{\GrbD{2 \times S2,F}} + 6\ell \kappa + \ell$
$2$     $4\ell \kappa + 2\ell$

$1$     $4\ell \kappa + \ell$

Trident              [r]2-1$2\Size{\Grb{S2,F}} + 6\ell \kappa + \ell$
$2$     $4\ell \kappa + 2\ell$

$1$     $4\ell \kappa + \ell$

Trident              [r]2-1$2\Size{\GrbD{S2,F}} + 6\ell\kappa + \ell$
$2$     $4\ell \kappa + 2\ell$

$1$     $4\ell \kappa + \ell$

Trident              [r]2-1$2\Size{\Grb{F}} + 6\ell\kappa + \ell$
$2$     $4\ell \kappa + 2\ell$

$1$     $4\ell \kappa + \ell$

Conversions (2GC variant):  Trident <cit.> and $\this$.

ProtocolA: arithmetic, B: boolean, G: garbled
[r]CommunicationNotations: $\ell$ - size of ring in bits, $\kappa$ - computational security parameter.

Trident              [r]2-1$\Size{\GrbD{2 \times S2,F}} + 3\ell \kappa + \ell$
$2$     $2\ell \kappa + 3\ell$

$2$     $2\ell \kappa + 2\ell$

Trident              [r]2-1$\Size{\Grb{S2,F}} + 3\ell \kappa + \ell$
$2$     $2\ell \kappa + 3\ell$

$2$     $2\ell \kappa + 2\ell$

Trident              [r]2-1$\Size{\GrbD{S2,F}} + 3\ell\kappa + \ell$
$2$     $2\ell \kappa + 3\ell$

$2$     $2\ell \kappa + 2\ell$

Trident              [r]2-1$\Size{\Grb{F}} + 3\ell\kappa + \ell$
$2$     $2\ell \kappa + 3\ell$

$2$     $2\ell \kappa + 2\ell$

Conversions (1GC variant):  Trident <cit.> and $\this$.

§ ML ALGORITHMS

Training and Inference of NN

An NN can be divided into various layers, where each layer contains a predefined number of nodes. These nodes are a linear function composed of a non-linear "activation" function.

The nodes at the input layer are evaluated on the input features to evaluate a neural network. The outputs from these nodes are fed as inputs to the nodes in the next layer. This process is repeated for all the layers to obtain the output. The underlying operation involved is a computation of activation matrices for all the layers. This constitutes the forward propagation phase.

The backward propagation involves adjusting model parameters according to the difference in the computed output and the actual output and comprises computing error matrices.

Concretely, each layer comprises matrix multiplications followed by an application of the ReLU function. The maxpool layer additionally follows convolutional layers after the ReLU layer. After evaluating the layers in a sequential manner, at the output layer, we use the MPC friendly variant of the softmax activation function, $\sftmx(u_i) = \frac{\relu(u_i)}{\sum_{j = 1}^{\vl{n}} \relu(u_j)}$, proposed by SecureML <cit.>. To perform the division, we switch from arithmetic to garbled world and then use a division garbled circuit <cit.> followed by a switch back to the arithmetic world.

For training, we use Gradient Descent, where the forward propagation comprises computing activation matrices for all the layers in the network.  The backward propagation comprises computing error matrices involving matrix multiplications with derivative of maxpool and derivative of $\relu$, depending on the network architecture. We refer readers to <cit.> for formal details.

Inference of SVM

SVM is a function which takes as input an $n$-dimensional feature vector, $\vct{x}$, and outputs the category to which the feature vector belongs. SVM is implemented as a matrix $\Mat{F}$, of dimension $q \times n$ where each row of $\Mat{F}$ is called the support vector and a vector $\vct{b} = (b_1, \ldots, b_q)$, is called the bias. Each element of $\Mat{F}$ and $\vct{b}$ lies in $\Z{\ell}$. Each support vector along with a scalar from the bias can classify the input $\vct{x}$ into a specific category. More precisely, let $\Mat{F}_i$ denote the $i^{\text{th}}$ row of matrix $\Mat{F}$. Then, the value $\Mat{F}_i \cdot \vct{x} + b_i$ specifies how likely $\vct{x}$ is to be in category $i$. To find the most likely category, we compute argmax over these values, i.e. $\text{category}(\vct{x}) = \text{argmax}_{i \in \{1, \ldots, q\}} \Mat{F}_i \cdot \vct{x} + b_i$. We refer the readers to <cit.> for more details.

§ SECURITY PROOFS

Without loss of generality, we prove the security of our robust framework. The case for fairness follows similarly, and we omit its details. We provide proofs in the $\FSETUP, \Func[\jsend]$-hybrid model, where $\FSETUP$ (fig:FSETUP), $\Func[\jsend]$ (fig:JsendFunc) denote the ideal functionality for the shared-key setup and $\jsend$, respectively.

The strategy for simulating the computation of function $f$ (represented by a circuit $\Ckt$) is as follows: Simulation begins with the simulator emulating the shared-key setup ($\FSETUP$) functionality and giving the respective keys to the adversary. This is followed by the input sharing phase in which $\Sim$ computes the input of $\Adv$, using the known keys, and sets the inputs of the honest parties, to be used in the simulation, to $0$. $\Sim$ invokes the ideal functionality $\Func[Robust]$ on behalf of $\Adv$ using the extracted input and obtains the output $\vl{y}$. $\Sim$ now knows the inputs of $\Adv$ and can compute all the intermediate values for each of the building blocks. $\Sim$ proceeds with simulating each of the building blocks in the topological order.

For modularity, we provide the simulation steps for each building block (arithmetic/garbled) separately. Carrying out these blocks in the topological order yields the simulation for the entire computation. If a $\TTP$ is identified during the simulation, the simulator stops and returns the function output to the adversary on behalf of the $\TTP$ as per $\Func[\jsend]$.

Ideal $\jsend$ Functionality

The ideal $\jsend$ functionality for fairness security appears in fig:JsendFFunc and that for the robust setting appears in fig:JsendFunc.

$\Func[\jsend]$ (for fair security)Ideal functionality for $\jsend$ in $\this$fig:JsendFFunc
$\Func[\jsend]$ interacts with the parties in $\Partyset$ and the adversary $\Sim$.

Step 1: $\Func[\jsend]$ receives $(\INPUT,\vl{v}_s)$ from senders $P_s$ for $s \in \{i,j\}$, $(\INPUT,\bot)$ from receiver $P_k$ and fourth party $P_l$. While sending the inputs, the adversary is also allowed to send a special $\abort$ command.

Step 2: Set $\msg_i = \msg_j = \msg_l = \bot$.

Step 3: If $\vl{v}_i = \vl{v}_j$, set $\msg_k = \vl{v}_i$. Else, set $\msg_k = \abort$.

Step 4: Send $(\OUTPUT, \msg_s)$ to $P_s$ for $s \in \{0,1,2, 3\}$.

$\Func[\jsend]$ (for robust security)Ideal functionality for robust $\jsend$ <cit.>fig:JsendFunc
$\Func[\jsend]$ interacts with the parties in $\Partyset$ and the adversary $\Sim$.

Step 1: $\Func[\jsend]$ receives $(\INPUT,\vl{v}_s)$ from senders $P_s$ for $s \in \{i,j\}$, $(\INPUT,\bot)$ from receiver $P_k$ and fourth party $P_l$, while it receives $(\SELECT,\ttp)$ from $\Sim$. Here $\ttp$ is a boolean value, with a $1$ indicating that $\TTP = P_l$ should be established.

Step 2: If $\vl{v}_i =\vl{v}_j$ and $\ttp = 0$, or  if $\Sim$ has corrupted $P_l$[This condition is used to capture the fact that a corrupt $P_l$ cannot create an inconsistency in $\Func[\jsend]$ since the parties actively involved in $\Func[\jsend]$ would be honest], set $\msg_i = \msg_j = \msg_l = \bot, \msg_k = \vl{v}_i$ and go to Step 4.

Step 3: Else, set $\msg_i = \msg_j = \msg_k = \msg_l = P_l$.

Step 4: Send $(\OUTPUT, \msg_s)$ to $P_s$ for $s \in \{0,1,2, 3\}$.

§.§ Arithmetic/Boolean World

We provide the simulation for the case for corrupt $P_0, P_1$ and $P_3$. The case for corrupt $P_2$ is similar to that of $P_1$.

Sharing Protocol ($\prot{\Sh}$, fig:piSh)

During the preprocessing, $\Sim_{\prot{\Sh}}^{P_0}$ emulates $\FSETUP$ and gives the respective keys to $\Adv$. The values commonly held with $\Adv$ are sampled using the respective keys, while others are sampled randomly. The details for the online phase are provided next. We omit the simulation for corrupt $P_3$ as it is similar to that of $P_1,P_2$.

$\Sim_{\prot{\Sh}}^{P_0}$Simulator $\Sim_{\prot{\Sh}}^{P_0}$ for corrupt $P_0$ fig:ShFSim0

– If dealer is $\Adv$, $\Sim_{\prot{\Sh}}^{P_0}$ receives $\mk{\vl{v}}$ from $\Adv$ on behalf of $P_1, P_2, P_3$. If the received values are consistent, $\Sim_{\prot{\Sh}}^{P_0}$ computes $\Adv$'s input $\vl{v}$ as $\vl{v} = \mk{\vl{v}} - \sqr{\pd{\vl{v}}}_1 - \sqr{\pd{\vl{v}}}_2 - \sqr{\pd{\vl{v}}}_3$, else sets $\vl{v}$ as the default value. It invokes $\Func[Robust]$ on $(\INPUT, \vl{v})$ to obtain the function output $\vl{y}$.

– If dealer is $P_1, P_2$ or $P_3$, there is nothing to simulate as $P_0$ doesn't receive any value during the protocol.

$\Sim_{\prot{\Sh}}^{P_1}$Simulator $\Sim_{\prot{\Sh}}^{P_1}$ for corrupt $P_1$ fig:ShFSim1

– If dealer is $\Adv$, $\Sim_{\prot{\Sh}}^{P_1}$ receives $\mk{\vl{v}}$ from $\Adv$ on behalf of $P_2, P_3$. If the received values are consistent, $\Sim_{\prot{\Sh}}^{P_1}$ computes $\Adv$'s input $\vl{v}$ as $\vl{v} = \mk{\vl{v}} - \sqr{\pd{\vl{v}}}_1 - \sqr{\pd{\vl{v}}}_2 - \sqr{\pd{\vl{v}}}_3$, else sets $\vl{v}$ as the default value. It invokes $\Func[Robust]$ on $(\INPUT, \vl{v})$ to obtain the function output $\vl{y}$.

– If dealer is $P_0, P_2$ or $P_3$, $\Sim_{\prot{\Sh}}^{P_1}$ sets $\vl{v} = 0$ and performs the protocol steps honestly.

Shares unknown to $\Adv$ are sampled randomly in the simulation, whereas in the real protocol, they are sampled using the pseudorandom function (PRF). The indistinguishability of the simulation thus follows by a reduction to the security of the PRF. The same holds for the rest of the blocks.

The simulation for the joint sharing protocol ($\prot{\JSh}$) is similar to that of the sharing protocol. The protocol's design is such that the simulator will always know the value to be sent as part of the joint sharing protocol. The communication is constituted by $\jsend$ calls and is emulated according to the simulation of $\Func[\jsend]$.

Multiplication Protocol ($\piMult$)

$\Sim_{\piMult}^{P_0}$Simulator $\Sim_{\piMult}^{P_0}$ for corrupt $P_0$ fig:MulFSim0

–  Computes $\gm{\vl{a}\vl{b}}{1}, \gm{\vl{a}\vl{b}}{2}$, and $\gm{\vl{a}\vl{b}}{3}$ on behalf of $P_1, P_2, P_3$.

– Samples $\vl{u}^1, \vl{u}^2$ using the respective keys with $\Adv$ and computes $\vl{r}$. The joint sharing of $\vl{q}$ is simulated as discussed earlier.

– Receives $\vl{w}$ from $\Adv$ on behalf of $P_3$.

– Simulating $\piVrfyP$: Joint sharing of $\vl{e_1}, \vl{e_2}, \vl{e}$ is simulated as discussed earlier. The rest of the steps are simulated honestly. This is possible since $\Sim_{\piMult}^{P_0}$ knows the randomness and inputs that should be used by $\Adv$.

$P_0$ has no communication in the online phase except the $\jsend$ instances which are emulated by $\Sim_{\piMult}^{P_0}$.

$\Sim_{\piMult}^{P_1}$Simulator $\Sim_{\piMult}^{P_1}$ for corrupt $P_1$ fig:MulFSim1

–  Computes $\gm{\vl{a}\vl{b}}{1}, \gm{\vl{a}\vl{b}}{2}$, and $\gm{\vl{a}\vl{b}}{3}$ on behalf of $P_0, P_2, P_3$.

– Samples $\vl{u}^1$ using the respective keys with $\Adv$. Samples a random $\vl{u}^2$ and computes $\vl{r}$. The joint sharing of $\vl{q}$ is simulated as discussed earlier.

– Simulate the steps of $\piVrfyP$ honestly.

– Computes $\vl{y}_1 + \vl{s}_1, \vl{y}_2 + \vl{s}_2, \vl{y}_3$ honestly.

– Emulates two instances of $\Func[\jsend]$ – i) $\Adv$ as sender to send $\vl{y}_1 + \vl{s}_1$ to $P_2$, and ii) $\Adv$ as receiver to obtain $\vl{y}_2 + \vl{s}_2$ from $P_2$.

– Simulates joint sharing as discussed earlier.

$\Sim_{\piMult}^{P_3}$Simulator $\Sim_{\piMult}^{P_3}$ for corrupt $P_3$ fig:MulFSim3

–  Computes $\gm{\vl{a}\vl{b}}{1}, \gm{\vl{a}\vl{b}}{2}$, and $\gm{\vl{a}\vl{b}}{3}$ on behalf of $P_0, P_1, P_2$.

– Samples $\vl{u}^1, \vl{u}^2$ using the respective keys with $\Adv$ and computes $\vl{r}$. The joint sharing of $\vl{q}$ is simulated as discussed earlier.

– Honestly computes and sends $\vl{w}$ to $\Adv$.

– Simulate the steps of $\piVrfyP$ honestly.

– Computes $\vl{y}_1 + \vl{s}_1, \vl{y}_2 + \vl{s}_2, \vl{y}_3$ honestly.

– Emulates two instances of $\Func[\jsend]$ with $\Adv$ as sender to exchange $\vl{y}_1 + \vl{s}_1, \vl{y}_2 + \vl{s}_2$ among $P_1, P_2$.

– Simulates joint sharing as discussed earlier.

Reconstruction Protocol ($\prot{\Rec}$, fig:piRec)

Using the input of $\Adv$ obtained during simulation of sharing protocol, $\Sim_{\prot{\Rec}}$ invokes $\Func[Robust]$ on behalf of $\Adv$ and obtains the function output $\vl{y}$ in clear. $\Sim_{\prot{\Rec}}$ calculates the missing share of $\Adv$ using $\vl{y}$ and the other shares. The missing share is then communicated to $\Adv$ by emulating the $\Func[\jsend]$ functionality.

§.§ Security Proof for Garbled World

In this section, we present the proof of security for our robust GC protocol with 2GCs. The case for 1 GC is similar, and we omit the details. For completeness, we provide the simulation assuming function evaluation entirely through the GC. However, as in the previous section, simulation steps are provided for the different phases separately. Thus, the simulation for the appropriate phase can be used while simulating the entire protocol in the mixed framework.

The simulation begins with the simulator emulating the shared-key setup ($\FSETUP$) functionality and giving the respective keys to the adversary. This is followed by the input sharing phase in which $\Sim$ computes the input of $\Adv$, using the known keys, and sets the inputs of the honest parties, to be used in the simulation, to $0$. $\Sim$ invokes the ideal functionality $\Func[Robust]$ on behalf of $\Adv$ using the extracted input and obtains the output $\vl{y}$.
$\Sim$ proceeds with simulating the GC computation phase using the output $\vl{y}$ by invoking the privacy simulator for the GC. The reconstruction phase follows this.

We provide the simulation steps in the following order:

– Generation of boolean shares for the input.

– Transfer of keys and GC to the evaluator.

– Output computation.

We give the proof with respect to a corrupt $P_0$ and a corrupt $P_1$. Proofs for corrupt $P_3$ and corrupt $P_2$ follow similar to proof for corrupt $P_0$ and $P_1$, respectively.

Generation of boolean shares for the input

This simulation proceeds as per the simulation of the boolean world mentioned in <ref>.

Key, GC transfer and  evaluation

The simulation for $\pigsh$ coupled with the GC transfer for a corrupt $P_1$ and corrupt $P_0$ are provided here. Cases for corrupt $P_2, P_3$ follow.

$\Sim_{\Ev}^{P_0}$Simulator $\Sim_{\Ev}^{P_0}$ for corrupt $P_0$ fig:gshFSim0

– With respect to the $j^{\text{th}}$ garbling instance for $j \in \{1, 2\}$, $\Sim_{\Ev}^{P_0}$ generates the keys $\{\key{{\mk{\vl{x}}}}{\bitb, j}, \key{{\av{\vl{x}}}}{\bitb, j}, \key{ {\lambda_{\vl{x}}^{3}} }{\bitb, j}\}_{\bitb \in \{0, 1\}}$ for each function input $\vl{x}$ and the GC as per the honest execution.

– Sends the keys for $\key{{\mk{\vl{x}}}}{\mk{\vl{x}}, j}, \key{{\av{\vl{x}}}}{\av{\vl{x}}, j}$ and $\GC_j$ to $P_j$ for $j \in \{1, 2\}$ by emulating $\Func[\jsend]$ with $\Adv$ as the sender.

$\Sim_{\Ev}^{P_1}$Simulator $\Sim_{\Ev}^{P_1}$ for corrupt $P_1$ fig:gshFSim1

– With respect to the first garbling instance, $\Sim_{\Ev}^{P_1}$ runs $(\GC_1, \textbf{X}_1, d_1) \leftarrow \Sim_{\priv}(\onesec, \Ckt, \vl{y})$ where $\vl{y}$ is obtained via invoking $\Func[Robust]$ on $\Adv$'s input.
With respect to the second garbling instance, $\Sim_{\Ev}^{P_1}$ generates the keys $\{\key{{\mk{\vl{x}}}}{\bitb, 2}, \key{{\av{\vl{x}}}}{\bitb, 2}, \key{{\lambda_{\vl{x}}^{3}}}{\bitb, 2}\}_{\bitb \in \{0, 1\}}$ for each function input $\vl{x}$ and $\GC_2$ as per the honest execution.

– $\Sim_{\Ev}^{P_1}$ sends the keys for each input $\vl{v}$ to the GC, and $\GC_1$ by emulating $\Func[\jsend]$ with $\Adv$ as the receiver.

– $\Sim_{\Ev}^{P_1}$ emulates $\Func[\jsend]$ together with $\Adv$ as the sender to send $\key{{\mk{\vl{x}}}}{\mk{\vl{x}}, 2}, \key{{\lambda_{\vl{x}}^{3}}}{\lambda_{\vl{x}}^{3}, 2}$ to $P_2$.

Output computation

$\Sim_{\Rec}^{P_0}$Simulator $\Sim_{\Rec}^{P_0}$ for corrupt $P_0$fig:srec0

– Let $\lsb(\vl{v})$ denote the least significant bit of $\vl{v}$.

– $\Sim_{\Rec}^{P_0}$ sends $\vl{q}^J = \vl{y} \xor \lsb(\key{{\vl{y}}}{0, j})$ and $\h^j = \Hash(\key{}{})$ to $\Adv$ on behalf of honest $P_j \in \SetE$ such that $\key{}{} \in \{\key{\vl{y}}{0, j}, \key{\vl{y}}{1, j}\}$ and $\vl{q}^j = \lsb({\key{}{}})$, where $\vl{y}$ is obtained via invoking $\Func[Robust]$.

$\Sim_{\Rec}^{P_1}$Simulator $\Sim_{\Rec}^{P_1}$ for corrupt $P_1$fig:srec1

– Let $\lsb(\vl{v})$ denote the least significant bit of $\vl{v}$.

– $\Sim_{\Rec}^{P_1}$ sends $\vl{p}^1 = \lsb(\key{{\vl{y}}}{0, 1})$ to $\Adv$ on behalf of honest garblers in $\PlSet{1}$ where $\vl{y}$ is obtained via invoking $\Func[Robust]$.

Indistinguishability argument

We argue that $\Ideal_{\calF, \Sim_{\mathrm{\Pi}}} \overset{c}{\approx} \Real_{\mathrm{\Pi}, \Adv}$ when $\Adv$ corrupts $P_1$ based on the following series of intermediate hybrids.

$\Hyb_0$: Same as $ \Real_{\mathrm{\Pi}, \Adv}$.

$\Hyb_1$: Same as $\Hyb_0$, except that $P_0$, $P_2, P_3$ use uniform randomness instead of pseudo-randomness to sample values not known to $P_1$.

$\Hyb_2$: Same as $\Hyb_1$ except that $\GC_1$ is created as $(\GC_1, \textbf{X}_1, d_1) \leftarrow \Sim_\prv(1^\kappa, \Ckt, \vl{y})$.

Since $\Hyb_2 := \Ideal_{\calF, \Sim_{\mathrm{\Pi}}}$, to conclude the proof we show that every two consecutive hybrids are indistinguishable.

$\Hyb_0 \overset{c}{\approx} \Hyb_1$ :  The difference between the hybrids is that $P_0, P_2, P_3$ use uniform randomness in $\Hyb_1$ rather than pseudo-randomness as in $\Hyb_0$ (for sampling $\sqr{\av{}}_2$). The indistinguishability follows via reduction to the security of the PRF.

$\Hyb_1 \stackrel{c}{\approx} \Hyb_2$: The difference between the hybrids is in the way $(\GC_1, \textbf{X}_1, d_1)$ is generated. In $\Hyb_1$, $(\GC_1, e_1, d_1) \leftarrow \Gb(1^\kappa, \Ckt)$ is run. In $\Hyb_2$, it is generated as $(\GC_1, \textbf{X}_1, d_1) \leftarrow \Sim_\prv(1^\kappa, \Ckt, \vl{y})$. Indistinguishability follows via reduction to the privacy of the garbling scheme.

We argue that $\Ideal_{\calF, \Sim_{\mathrm{\Pi}}} \overset{c}{\approx} \Real_{\mathrm{\Pi}, \Adv}$ when $\Adv$ corrupts $P_0$ based on the following series of intermediate hybrids.

$\Hyb_0$: Same as $ \Real_{\mathrm{\Pi}, \Adv}$.

$\Hyb_1$: Same as $\Hyb_0$, except that $P_1$, $P_2, P_3$ use uniform randomness instead of pseudo-randomness to sample values not known to $P_0$.

$\Hyb_2$: Same as $\Hyb_1$ except that hash of the key $\key{}{}$ where $\key{}{} \in \{\key{\vl{y}}{0, j}, \key{\vl{y}}{1, j}\}$ to be sent to $\Adv$ is computed such that $\lsb(\key{}{}) \xor \lsb(\key{{\vl{y}}}{0, j}) = \vl{y}$,  for $j \in \{1,2\}$ instead of obtaining it as output of GC evaluation.

Since $\Hyb_2 := \Ideal_{\calF, \Sim_{\mathrm{\Pi}}}$, to conclude the proof we show that every two consecutive hybrids are indistinguishable.

$\Hyb_0 \overset{c}{\approx} \Hyb_1$ :  The difference between the hybrids is that $P_1, P_2, P_3$ use uniform randomness in $\Hyb_1$ rather than pseudo-randomness as in $\Hyb_0$ (for sampling $\pd{}{3}$). The indistinguishability follows via reduction to the security of the PRF.

$\Hyb_1 \stackrel{c}{\approx} \Hyb_2$: The difference between the hybrids is that in $\Hyb_1$, key $\key{}{}$ where $\key{}{} \in \{\key{\vl{y}}{0, j}, \key{\vl{y}}{1, j}\}$ for $j \in \{1,2\}$ is computed as output of the GC evaluation while in $\Hyb_2$, it is computed such that $\lsb(\key{}{}) \xor \lsb(\key{{\vl{y}}}{0, j}) = \vl{y}$. Due to the correctness of the garbling scheme, the equivalence of $\key{}{}$ computed in both the hybrids holds.