FHE: What is the difference between multiplicative depth and multiplicative level? I have seen the terms multiplicative depth and multiplicative level while reading  


Faster homomorphic encryption is not enough: improved heuristic for multiplicative depth minimization of Boolean circuits by Aubry et. al, 2019.


Is there a difference between the term multiplicative depth and multiplicative level?
In Fully Homomorphic Encryption (in short FHE), we have a noise that increased with every operation, and it is almost doubled with the multiplication. When preparing the circuit $\mathcal{C}$ to $\texttt{EVAL}$ on the cloud we have to consider various parameters to deal with the noise of which the FHE scheme provides. Minimizing boothstrapping calls, which is very costly, number of modulus switching and linearization, etc. According to parameters, the FHE scheme may provide more than 1 multiplication without bootstrapping.

Multiplicative depth (From your reference) :


  The multiplicative depth is the maximal number of sequential homomorphic multiplications which can be performed on
  fresh ciphertexts such that once decrypted we retrieve the result of these multiplications.


What is multiplicative level?

This cannot be easily understood if you don't implement some problems. Here is a simple explanation from Efficient Fully Homomorphic Encryption from (Standard) LWE


  During the homomorphic evaluation, we will generate ciphertexts of the form $c = ((v, w), \ell)$, where the tag $\ell$ indicates the multiplicative level at which the ciphertext has been generated (hence fresh ciphertexts are tagged with 0). The requirement that $f$ is layered will make sure that throughout the homomorphic evaluation all inputs to a gate have the same tag.


Here is the trick, if you need to add a fresh ciphertext $c_i$ into a level $l$ (that can be quite common as encryption of 1 or 0 1), you need to increase the level of $c_i$ to $l$. Otherwise, the operations will fail.  

Example: Let we want to multiply $p_1,p_2, p_3$ with FHE. Let $c_i = Enc_{k_{pub}}(p_i)$, and clearly they have 0 multiplication level. You need to send $$\texttt{EVAL}(\mathcal{C},k_{pub},c_1,c_2,c_3)$$ The server first calculates3 $$c_4 = c_1 \cdot c_2.$$ Now, the $c_4$ has multiplication level 1. To multiply $c_4 \cdot c_3$ we need to increase the multiplication level of $c_3$ to 1. Once they are equal, we can multiply.



In short: multiplicative depth is how much multiplication can be performed and multiplicative level is how many multiplication is performed on a ciphertext2.

For the comment: While implementation we want to keep track of the current level of the ciphertexts so that if the scheme doesn't allow multiplications of different ciphertext we can adjust or we make sure that the level on any ciphertext doesn't exceed the depth. So, it is a quite useful definition for a variable.



1 The Private Information Retrieval article Bandwidth Efficient PIR from NTRU is implemented as Mux and the selector bits needs to have the same multiplicative level.

2Multiplcative level cannot exceed the multiplicative depth, otherwise you cannot decrypt.

3The calculation performed according to your circuit $\mathcal{C}$.