I am wondering whether we can use technique of gadget decomposition in decryption to replace degree 2 PRNG in your paper (I believe the PRNG is there to add smudging noise).

Let's say user provides

${\beta }^k{s}^{\prime }$ where

${\beta }^k{s}^{\prime }[i]={\beta }^{k}s[i]+e_{i,k}$ for

$k\in [0,l)$, where

$i\in [0,n)$,

$n$ being the LWE dimension. We can assume

$e_{i,k}$ to be bounded by some bound

$B$.

To decrypt LWE ciphertext

$$LW{E}_s(m)=(b,a)=(b=a\cdot s+e+\mathrm{\Delta }m,a)$$

decompose vector

$a$ in multiple limbs,

$a_0,..,a_{l-1}$ s.t.

$a[i]=\sum {\beta }^k{a}_j[i]$. Then calculate inner product,

$$b-a\cdot s+E=b-\sum _{k\in [0,l)}{a}_k\cdot {\beta }^k{s}^{\prime }$$

where

$E$ is bounded by

$l\beta B$.

This is same as gadget decomposition technique in FHE and

$E$ acts as smudging noise.