That means, in our garble table we'll have our outputs encrypted with different keys
corresponding to inputs that corresponds to that output value.
Of course, we can't send that whole table. That would reveal the values of a0 and b0.
We need to remove this part of the table.
Then we need to randomly permute the order of these entries.
The other thing will do is add some padding.
That means after the garbling we'll have a table that's looks like this.
Because each of these values is encrypted with a different key,
the evaluator can't tell which one is which.
The evaluator still needs to be able to decrypt these to produce the right output.
The question is how does the evaluator know what the output of that truth table is?
The evaluator could try decrypting all the entries and pick the one that seems correct.
The evaluator could try decrypting all the entries using the input value keys known to the evaluator,
and use the one that decrypts to something of the form pad concatenated with x,
and then use this value as the output, or it is not possible
based on what the evaluator knows.
