On the Quantitative Hardness of CVP

TL;DR

This paper establishes strong conditional lower bounds on the time complexity of solving the Closest Vector Problem (CVP) in various $oldsymbol{ extit{l}_p}$ norms, showing it cannot be done in subexponential time unless widely believed complexity hypotheses fail.

Contribution

It proves SETH-based hardness for $ ext{CVP}_p$ for odd $p eq 2$, extending to almost all $p eq 2$, and provides related hardness results for $ ext{SVP}_ ext{infinity}$ and approximation problems.

Findings

$ ext{CVP}_p$ cannot be solved in $2^{(1- ext{eps})n}$ time for odd $p eq 2$ unless SETH fails.

Hardness results extend to almost all $p eq 2$, approaching the Euclidean case.

Additional hardness results for $ ext{SVP}_ ext{infinity}$ and approximation variants under different hypotheses.

Abstract

$ \newcommand{\eps}{\varepsilon} \newcommand{\problem}[1]{\ensuremath{\mathrm{#1}} } \newcommand{\CVP}{\problem{CVP}} \newcommand{\SVP}{\problem{SVP}} \newcommand{\CVPP}{\problem{CVPP}} \newcommand{\ensuremath}[1]{#1} $For odd integers $p \geq 1$ (and $p = \infty$), we show that the Closest Vector Problem in the $\ell_p$ norm ($\CVP_p$) over rank $n$ lattices cannot be solved in $2^{(1-\eps) n}$ time for any constant $\eps > 0$ unless the Strong Exponential Time Hypothesis (SETH) fails. We then extend this result to "almost all" values of $p \geq 1$, not including the even integers. This comes tantalizingly close to settling the quantitative time complexity of the important special case of $\CVP_2$ (i.e., $\CVP$ in the Euclidean norm), for which a $2^{n +o(n)}$-time algorithm is known. In particular, our result applies for any $p = p(n) \neq 2$ that approaches $2$ as $n \to \infty$. We also show a similar SETH-hardness result for $\SVP_\infty$; hardness of approximating $\CVP_p$ to within some constant factor under the so-called Gap-ETH assumption; and other quantitative hardness results for $\CVP_p$ and $\CVPP_p$ for any $1 \leq p < \infty$ under different assumptions.

Figures

Tables

Table 1. Table 1: Summary of known quantitative upper and lower bounds, with new results in blue . Upper bounds in parentheses hold for any constant approximation factor strictly greater than one, and lower bounds with a ∗ * apply for some constant approximation factor strictly greater than one. ω 𝜔 \omega is the matrix multiplication exponent, satisfying 2 ≤ ω < 2.373 2 𝜔 2.373 2\leq\omega<2.373 . We have suppressed smaller factors.

Problem	Upper Bound	Lower Bounds				Notes
		SETH	Max-$2$-SAT	ETH	Gap-ETH
${\mathrm{CVP}}_p$	$n^{O\left(n\right)}$ ($2^{O\left(n\right)}$)	$2^n$	$2^{\omega n/3}$	$2^{\Omega \left(n\right)}$	$2^{\Omega \left(n\right)}$*	“almost all” $p\notin 2\mathbb{Z}$
${\mathrm{CVP}}_2$	$2^n$	—	$2^{\omega n/3}$	$2^{\Omega \left(n\right)}$	$2^{\Omega \left(n\right)}$*
${\mathrm{CVP}}_{\infty }$/${\mathrm{SVP}}_{\infty }$	$2^{O\left(n\right)}$	$2^n$*	—	$2^{\Omega \left(n\right)}$	$2^{\Omega \left(n\right)}$*
${\mathrm{CVPP}}_p$	$n^{O\left(n\right)}$ ($2^{O\left(n\right)}$)	—	$2^{\Omega \left(\sqrt{n}\right)}$	$2^{\Omega \left(\sqrt{n}\right)}$	—

Table 2. Table 2: A basis B 𝐵 B and target vector 𝒕 𝒕 \boldsymbol{t} output by the reduction from Theorem  3.2 with some ( p , 3 ) 𝑝 3 (p,3) -isolating parallelepiped given by V = ( 𝒗 1 , 𝒗 2 , 𝒗 3 ) ∈ ℝ d ∗ × 3 𝑉 subscript 𝒗 1 subscript 𝒗 2 subscript 𝒗 3 superscript ℝ superscript 𝑑 3 V=(\boldsymbol{v}_{1},\boldsymbol{v}_{2},\boldsymbol{v}_{3})\in\mathbb{R}^{d^{*}\times 3} and 𝒕 ∗ ∈ ℝ d ∗ superscript 𝒕 superscript ℝ superscript 𝑑 \boldsymbol{t}^{*}\in\mathbb{R}^{d^{*}} . In this example, the first clause is C 1 ≡ x 1 ∨ x 2 ∨ ¬ x n subscript 𝐶 1 subscript 𝑥 1 subscript 𝑥 2 subscript 𝑥 𝑛 C_{1}\equiv x_{1}\lor x_{2}\lor\lnot x_{n} and the m 𝑚 m th clause is C m ≡ ¬ x 2 ∨ x n − 1 ∨ x n subscript 𝐶 𝑚 subscript 𝑥 2 subscript 𝑥 𝑛 1 subscript 𝑥 𝑛 C_{m}\equiv\lnot x_{2}\lor x_{n-1}\lor x_{n} . By the definition of an isolating parallelepiped (Definition  3.1 ), the contribution of the first d 𝑑 d coordinates to the distance ‖ B ​ 𝒛 − 𝒕 ‖ p p superscript subscript norm 𝐵 𝒛 𝒕 𝑝 𝑝 \|B\boldsymbol{z}-\boldsymbol{t}\|_{p}^{p} will be 1 1 1 for any assignment 𝒛 ∈ { 0 , 1 } n 𝒛 superscript 0 1 𝑛 \boldsymbol{z}\in\{0,1\}^{n} satisfying C 1 subscript 𝐶 1 C_{1} , while non-satisfying assignments contribute ( 1 + δ ) 1 𝛿 (1+\delta) for some δ > 0 𝛿 0 \delta>0 . For example, if z 1 = 1 , z 2 = 0 , z n = 1 formulae-sequence subscript 𝑧 1 1 formulae-sequence subscript 𝑧 2 0 subscript 𝑧 𝑛 1 z_{1}=1,z_{2}=0,z_{n}=1 , the clause C 1 subscript 𝐶 1 C_{1} is satisfied, and the first d 𝑑 d coordinates will contribute ‖ 𝒗 1 − 𝒗 3 − ( 𝒕 ∗ − 𝒗 3 ) ‖ p p = ‖ 𝒗 1 − 𝒕 ∗ ‖ p p = 1 superscript subscript norm subscript 𝒗 1 subscript 𝒗 3 superscript 𝒕 subscript 𝒗 3 𝑝 𝑝 superscript subscript norm subscript 𝒗 1 superscript 𝒕 𝑝 𝑝 1 \|\boldsymbol{v}_{1}-\boldsymbol{v}_{3}-(\boldsymbol{t}^{*}-\boldsymbol{v}_{3})\|_{p}^{p}=\|\boldsymbol{v}_{1}-\boldsymbol{t}^{*}\|_{p}^{p}=1 . On the other hand, if z 1 = 0 , z 2 = 0 , z n = 1 formulae-sequence subscript 𝑧 1 0 formulae-sequence subscript 𝑧 2 0 subscript 𝑧 𝑛 1 z_{1}=0,z_{2}=0,z_{n}=1 , then C 1 subscript 𝐶 1 C_{1} is not satisfied, and ‖ − 𝒗 3 − ( 𝒕 ∗ − 𝒗 3 ) ‖ p p = ‖ 𝒕 ∗ ‖ p p = 1 + δ superscript subscript norm subscript 𝒗 3 superscript 𝒕 subscript 𝒗 3 𝑝 𝑝 superscript subscript norm superscript 𝒕 𝑝 𝑝 1 𝛿 \|-\boldsymbol{v}_{3}-(\boldsymbol{t}^{*}-\boldsymbol{v}_{3})\|_{p}^{p}=\|\boldsymbol{t}^{*}\|_{p}^{p}=1+\delta .

$x_1$ $x_2$ $\cdots$ $x_{n-1}$ $x_n$ $C_1${ ${𝒗}_1$ ${𝒗}_2$ $\cdots$ ${\mathrm{𝟎}}_{d^{\ast }}$ $-{𝒗}_3$ ⋮ $⋮$ $\cdots$ $\ddots$ $⋮$ $⋮$ $C_m\{$ ${\mathrm{𝟎}}_{d^{\ast }}$ $-{𝒗}_1$ $\cdots$ ${𝒗}_2$ ${𝒗}_3$ $x_1$ $2{\alpha }^{1/p}$ $0$ $\cdots$ $0$ $0$ $x_2$ $0$ $2{\alpha }^{1/p}$ $\cdots$ $0$ $0$ $⋮$ $⋮$ $⋮$ $\ddots$ $⋮$ $⋮$ $x_{n-1}$ $0$ $0$ $\cdots$ $2{\alpha }^{1/p}$ $0$ $x_n$ $0$ $0$ $\cdots$ $0$ $2{\alpha }^{1/p}$

${𝒕}^{\ast }-{𝒗}_3$ $⋮$ ${𝒕}^{\ast }-{𝒗}_1$ ${\alpha }^{1/p}$ ${\alpha }^{1/p}$ $⋮$ ${\alpha }^{1/p}$ ${\alpha }^{1/p}$

$B$

$𝒕$

Equations

$$\mathcal{L}=\mathcal{L}(\boldsymbol{b}_{1},\ldots,\boldsymbol{b}_{n}):=\Big{\{}\sum_{i=1}^{n}z_{i}\boldsymbol{b}_{i}\ :\ z_{i}\in\mathbb{Z}\Big{\}}\;.$$

$$\Vert \mathbf{x}{\Vert }_p:=(|x_1{|}^p+|x_2{|}^p+\cdots +|x_d{|}^p{)}^{1/p}$$

$$\Vert \mathbf{x}{\Vert }_{\infty }:=\underset{1\le i\le d}{\max }|x_i|.$$

$$B:=\left(\begin{array}{c}\bar{\Phi }\\ 2\alpha I_n\end{array}\right),$$

$$\bar{\Phi}_{i,j}:=\left\{\begin{array}[]{rl}2&\text{ if the $i$th clause contains $x_{j}$,}\\ -2&\text{ if the $i$th clause contains $\lnot x_{j}$,}\\ 0&\text{ otherwise}\;.\end{array}\right.$$

$$\mathbf{t}:=(t_1,t_2,\dots ,t_m,\alpha ,\alpha ,\dots ,\alpha {)}^T,$$

$$t_i:=3-2{\eta }_i,$$

$$\bar{\Phi}_{i,j}:=\left\{\begin{array}[]{rl}\boldsymbol{v}_{s}&\text{ if $x_{j}$ is the $s$th literal in the $i$th clause},\\ -\boldsymbol{v}_{s}&\text{ if $\lnot x_{j}$ is the $s$th literal in the $i$th clause},\\ \boldsymbol{0}_{d}&\text{ otherwise}\;,\end{array}\right.$$

$${\mathbf{t}}_i:={\mathbf{t}}^{\ast }-\sum {\mathbf{v}}_s\in {\mathbb{R}}^{d^{\ast }},$$

$$V:=\frac{1}{2\cdot 12^{1/3}}\cdot\left(\begin{array}[]{rrr}12^{1/3}&12^{1/3}&12^{1/3}\\ 1&1&-1\\ 1&-1&1\\ 1&-1&-1\\ -1&1&1\\ -1&1&-1\\ -1&-1&1\end{array}\right),\qquad\boldsymbol{t}^{*}:=\frac{1}{2\cdot 12^{1/3}}\cdot\begin{pmatrix}2\cdot 12^{1/3}\\ 2\\ 2\\ 2\\ 2\\ 2\\ 2\end{pmatrix}\;.$$

$$\mathrm{Pr}[\sum _{i=1}^n{X}_i<(1-\alpha )\mu ]<e^{-\mu {\alpha }^2/2},$$

$$\mathrm{Pr}[\sum _{i=1}^n{X}_i>(1+\alpha )\mu ]<e^{-\mu {\alpha }^2/4}.$$

$$\mathrm{Pr}[\text{Number of clauses in Φ′}\le (1-\alpha )pm]\le e^{-{\alpha }^{2}pm/2}\le e^{-2n}.$$

$$\mathrm{Pr}[\text{Number of clauses in Φ′ sat. by a}\ge (1+\alpha )\delta pm]\le e^{-{\alpha }^2\delta pm/4}\le e^{-2n}.$$

$$\text{val}({\Phi }^{\prime })\le \frac{(1+\alpha )pm}{(1-\alpha )pm}\cdot \delta <{\delta }^{\prime }$$

$$B=\left(\begin{array}[]{c}B_{1}\\ \vdots\\ B_{m}\\ 2\alpha^{1/p}\cdot I_{n}\end{array}\right),\qquad\boldsymbol{t}=\left(\begin{array}[]{c}\boldsymbol{t}_{1}\\ \vdots\\ \boldsymbol{t}_{m}\\ \alpha^{1/p}\cdot\boldsymbol{1}_{n}\end{array}\right),$$

$$(B_{i})_{j}:=\left\{\begin{array}[]{rl}\boldsymbol{v}_{s}&\textrm{if $x_{j}$ is the $s$th literal of clause $i$},\\ -\boldsymbol{v}_{s}&\textrm{if $\lnot x_{j}$ is the $s$th literal of clause $i$},\\ \boldsymbol{0}_{d^{*}}&\textrm{otherwise},\end{array}\right.$$

$$\Vert B\mathbf{y}-\mathbf{t}{\Vert }_p^p\ge \Vert 2{\alpha }^{1/p}{I}_n\mathbf{y}-{\alpha }^{1/p}{1}_n{\Vert }_p^p\ge \alpha (n+2)>r^p,$$

$$\Vert B_i\mathbf{y}-{\mathbf{t}}_i{\Vert }_p$$

$$\displaystyle=\Big{\|}\sum_{s\in P_{i}}y_{\textrm{ind}(\ell_{i,s})}\cdot\boldsymbol{v}_{s}+\sum_{s\in N_{i}}\big{(}1-y_{\textrm{ind}(\ell_{i,s})}\big{)}\cdot\boldsymbol{v}_{s}-\boldsymbol{t}^{*}\Big{\|}_{p}$$

$$\displaystyle=\Big{\|}\sum_{s\in S_{i}(\boldsymbol{a})}\boldsymbol{v}_{s}-\boldsymbol{t}^{*}\Big{\|}_{p}.$$

$$\|B\boldsymbol{y}-\boldsymbol{t}\|_{p}^{p}=\Big{(}\sum_{i=1}^{m}\|B_{i}\boldsymbol{y}-\boldsymbol{t}_{i}\|_{p}^{p}\Big{)}+\alpha n=m+(m-m^{+}(\boldsymbol{y}))\delta+\alpha n\;.$$

$$\|V^{\prime}\boldsymbol{x}-(\boldsymbol{t}^{*})^{\prime}\|_{p}=\Big{\|}V^{\prime}\frac{\boldsymbol{y}+\boldsymbol{1}_{k}}{2}-(\boldsymbol{t}^{*})^{\prime}\Big{\|}_{p}=\Big{\|}V^{\prime}\frac{\boldsymbol{y}}{2}+V^{\prime}\frac{\boldsymbol{1}_{k}}{2}-(\boldsymbol{t}^{*})^{\prime}\Big{\|}_{p}=\|V\boldsymbol{y}-\boldsymbol{t}^{*}\|_{p}\;,$$

$$|\mathbf{v}|:=\{\#\text{ of positive entries in v}\}$$

$$\|V\boldsymbol{y}-\boldsymbol{t}^{*}\|_{p}^{p}=\sum_{j=0}^{k}\alpha_{k-j}\sum_{\ell=0}^{k}\binom{|\boldsymbol{y}|}{\ell}\binom{k-|\boldsymbol{y}|}{j-\ell}\cdot\big{|}2|\boldsymbol{y}|+2j-k-4\ell-t^{*}\big{|}^{p}\;,$$

$$\boldsymbol{w}=M_{k}(p,t^{*})\left(\begin{array}[]{c}\alpha_{0}\\ \alpha_{1}\\ \vdots\\ \alpha_{k}\end{array}\right)\;,$$

$$M_{k}(p,t^{*})_{i,j}:=\sum_{\ell=0}^{k}\binom{i}{\ell}\binom{k-i}{j-\ell}\cdot\big{|}2i+2j-k-4\ell-t^{*}\big{|}^{p}\;.$$

$$\|V\boldsymbol{y}-\boldsymbol{t}^{*}\|_{p}^{p}=\sum_{j=0}^{k}\alpha_{j}\sum_{|\boldsymbol{v}|=k-j}\big{|}\langle\boldsymbol{v},\boldsymbol{y}\rangle-t^{*}\big{|}^{p}\;.$$

$$\displaystyle\sum_{|\boldsymbol{v}|=k-j}\big{|}\langle\boldsymbol{v},\boldsymbol{y}\rangle-t^{*}\big{|}^{p}$$

$$\displaystyle=\sum_{\ell=0}^{k}\binom{|\boldsymbol{y}|}{\ell}\binom{k-|\boldsymbol{y}|}{j-\ell}\cdot\big{|}2|\boldsymbol{y}|+2j-k-4\ell-t^{*}\big{|}^{p}\;,$$

$$\displaystyle\sum_{j=0}^{k}\sum_{\ell=0}^{k}\binom{i}{\ell}\binom{k-i}{j-\ell}\cdot\big{|}2i+2j-k-4\ell-t^{*}\big{|}^{p}$$

$$=\sum _r|4r-k-t^{\ast }{|}^p\sum _{j=0}^k\left(\genfrac{}{}{0ex}{}{i}{r+(i-j)/2}\right)\left(\genfrac{}{}{0ex}{}{k-i}{r+(j-i)/2}\right).$$

Full text

We also show a similar SETH-hardness result for $\mathrm{SVP}_{\infty}$; hardness of approximating $\mathrm{CVP}_{p}$ to within some constant factor under the so-called Gap-ETH assumption; and other quantitative hardness results for $\mathrm{CVP}_{p}$ and $\mathrm{CVPP}_{p}$ for any $1\leq p<\infty$ under different assumptions.

1 Introduction

A lattice $\mathcal{L}$ is the set of all integer combinations of linearly independent basis vectors $\boldsymbol{b}_{1},\dots,\boldsymbol{b}_{n}\in\mathbb{R}^{d}$,

[TABLE]

We call $n$ the rank of the lattice $\mathcal{L}$ and $d$ the dimension or the ambient dimension.

The two most important computational problems on lattices are the Shortest Vector Problem ($\mathrm{SVP}$) and the Closest Vector Problem ($\mathrm{CVP}$). Given a basis for a lattice $\mathcal{L}\subset\mathbb{R}^{d}$, $\mathrm{SVP}$ asks us to compute the minimal length of a non-zero vector in $\mathcal{L}$, and $\mathrm{CVP}$ asks us to compute the distance from some target point $\boldsymbol{t}\in\mathbb{R}^{d}$ to the lattice. Typically, we define length and distance in terms of the $\ell_{p}$ norm for some $1\leq p\leq\infty$, given by

[TABLE]

for finite $p$ and

[TABLE]

In particular, the $\ell_{2}$ norm is the familiar Euclidean norm, and it is by far the best studied in this context. We write $\mathrm{SVP}_{p}$ and $\mathrm{CVP}_{p}$ for the respective problems in the $\ell_{p}$ norm. $\mathrm{CVP}$ is known to be at least as hard as $\mathrm{SVP}$ (in any norm, under an efficient reduction that preserves the rank and approximation factor) [GMSS99] and appears to be strictly harder.

Starting with the breakthrough work of Lenstra, Lenstra, and Lovász in 1982 [LLL82], algorithms for solving these problems in both their exact and approximate forms have found innumerable applications, including factoring polynomials over the rationals [LLL82], integer programming [Len83, Kan87, DPV11], cryptanalysis [Sha84, Odl90, JS98, NS01], etc. More recently, many cryptographic primitives have been constructed whose security is based on the worst-case hardness of these or closely related lattice problems [Ajt04, Reg09, GPV08, Pei08, Pei16]. Given the obvious importance of these problems, their complexity is quite well studied. Below, we survey some of these results. We focus on algorithms for the exact and near-exact problems since these are most relevant to our work and because the best known algorithms for the approximate variants of these problems typically use algorithms for the exact problems as subroutines [Sch87, GN08, MW16]. (Many of the results described below are also summarized in Table 1.)

1.1 Algorithms for SVP and CVP

The AKS algorithm and its descendants.

The current fastest known algorithms for solving $\mathrm{SVP}_{p}$ all use the celebrated randomized sieving technique due to Ajtai, Kumar, and Sivakumar [AKS01]. The original algorithm from [AKS01] was the first $2^{O(n)}$-time algorithm for $\mathrm{SVP}$, and it worked for both $p=2$ and $p=\infty$.

In the $p=2$ case, a sequence of works improved upon the constant in the exponent [NV08, PS09, MV10, LWXZ11], and the current fastest running time of an algorithm that provably solves $\mathrm{SVP}_{2}$ exactly is $2^{n+o(n)}$ [ADRS15].111The algorithm in [ADRS15] is quite a bit different than the other algorithms in this class, but it can still be thought of as a sieving algorithm. While progress has slowed, this seems unlikely to be the end of the story. Indeed, there are heuristic sieving algorithms that run in time $(3/2)^{n/2+o(n)}$ [NV08, WLTB11, Laa15, BDGL16], and there is some reason to believe that the provably correct [ADRS15] algorithm can be improved. In particular, there is a provably correct $2^{n/2+o(n)}$-time algorithm that approximates $\mathrm{SVP}_{2}$ up to a small constant approximation factor [ADRS15].

A different line of work extended the randomized sieving approach of [AKS01] to obtain $2^{O(n)}$-time algorithms for $\mathrm{SVP}$ in additional norms. In particular, Blömer and Naewe extended it to all $\ell_{p}$ norms [BN09]. Subsequent work extended this further, first to arbitrary symmetric norms [AJ08] and then to the “near-symmetric norms” that arise in integer programming [Dad12].

Finally, a third line of work extended the [AKS01] approach to approximate $\mathrm{CVP}$. Ajtai, Kumar, and Sivakumar themselves showed a $2^{O(n)}$-time algorithm for approximating $\mathrm{CVP}_{2}$ to within any constant approximation factor strictly greater than one [AKS02]. Blömer and Naewe obtained the same result for all $\ell_{p}$ norms [BN09], and Dadush extended it further to arbitrary symmetric norms and again to “near-symmetric norms” [Dad12]. We stress, however, that none of these results apply to exact $\mathrm{CVP}$, and indeed, there are some barriers to extending these algorithms to exact $\mathrm{CVP}$. (See, e.g., [ADS15].)

Exact algorithms for $\mathrm{CVP}$.

Exact $\mathrm{CVP}$ appears to be a much more subtle problem than exact $\mathrm{SVP}$.222In particular, there can be arbitrarily many lattice points that are approximate closest vectors, which makes sieving techniques seemingly useless for solving exact $\mathrm{CVP}$. (See, e.g., [ADS15] for a discussion of this issue.) We note, however, that hardness results (including ours) tend to produce $\mathrm{CVP}$ instances with a bounded number of approximate closest vectors (e.g., $2^{O(n)})$. Indeed, progress on exact $\mathrm{CVP}$ has been much slower than the progress on exact $\mathrm{SVP}$. Over a decade after [AKS01], Micciancio and Voulgaris presented the first $2^{O(n)}$-time algorithm for exact $\mathrm{CVP}_{2}$ [MV13], using elegant new techniques built upon the approach of Sommer, Feder, and Shalvi [SFS09]. Specifically, they achieved a running time of $4^{n+o(n)}$, and subsequent work even showed a running time of $2^{n+o(n)}$ for $\mathrm{CVP}_{2}$ with Preprocessing (in which the algorithm is allowed access to arbitrary advice that depends on the lattice but not the target vector; see Section 2.1) [BD15]. Later, [ADS15] showed a $2^{n+o(n)}$-time algorithm for $\mathrm{CVP}_{2}$, so that the current best known asymptotic running time is actually the same for $\mathrm{SVP}_{2}$ and $\mathrm{CVP}_{2}$.

However, for $p\neq 2$, progress for exact $\mathrm{CVP}_{p}$ has been minimal. Indeed, the fastest known algorithms for exact $\mathrm{CVP}_{p}$ with $p\neq 2$ are still the $n^{O(n)}$-time enumeration algorithms first developed by Kannan in 1987 [Kan87, DPV11, MW15]. Both algorithms for exact $\mathrm{CVP}_{2}$ mentioned in the previous paragraph use many special properties of the $\ell_{2}$ norm, and it seems that substantial new ideas would be required to extend them to arbitrary $\ell_{p}$ norms.

1.2 Hardness of SVP and CVP

Van Emde Boas showed the NP-hardness of $\mathrm{CVP}_{p}$ for any $p$ and $\mathrm{SVP}_{\infty}$ in 1981 [vEB81]. Extending this to $\mathrm{SVP}_{p}$ for finite $p$ was a major open problem until it was proven (via a randomized reduction) for all $1\leq p\leq\infty$ by Ajtai in 1998 [Ajt98]. There has since been much follow-up work, showing the hardness of these problems for progressively larger approximation factors, culminating in NP-hardness of approximating $\mathrm{CVP}_{p}$ up to a factor of $n^{c/\log\log n}$ for some constant $c>0$ [ABSS93, DKRS03] and hardness of $\mathrm{SVP}_{p}$ with the same approximation factor under plausible complexity-theoretic assumptions [CN98, Mic01b, Kho05, HR12]. These results are nearly the best possible under plausible assumptions, since approximating either problem up to a factor of $\sqrt{n}$ is known to be in $\mathrm{NP}\cap\mathrm{coNP}$ [GG00, AR05, Pei08].

However, such results only rule out the possibility of polynomial-time algorithms (under reasonable complexity-theoretic assumptions). They say very little about the quantitative hardness of these problems for a fixed lattice rank $n$.333 One can derive certain quantitative hardness results from known hardness proofs, but in most cases the resulting lower bounds are quite weak. The only true quantitative hardness results known prior to this work were a folklore ETH-hardness result for $\mathrm{CVP}$ and an unpublished result due to Samuel Yeom, showing that $\mathrm{CVP}$ cannot be solved in time $2^{10^{-4}n}$ under plausible complexity-theoretic assumptions [Vai15]. (In Section 6.2, we present a similar proof of a stronger statement.)

This state of affairs is quite frustrating for two reasons. First, in the specific case of $\mathrm{CVP}_{2}$, algorithmic progress has reached an apparent barrier. In particular, both known techniques for solving exact $\mathrm{CVP}_{2}$ in singly exponential time are fundamentally unable to produce algorithms whose running time is asymptotically better than the current best of $2^{n+o(n)}$ [MV13, ADS15].444 Both techniques require short vectors in each of the $2^{n}$ cosets of $\mathcal{L}$ mod $2\mathcal{L}$ (though for apparently different reasons).

Second, some lattice-based cryptographic constructions are close to deployment [ADPS16, BCD*+*16, NIS16]. In order to be practically secure, these constructions require the quantitative hardness of certain lattice problems, and so their designers rely on quantitative hardness assumptions [APS15]. If, for example, there existed a $2^{n/20}$-time algorithm for $\mathrm{SVP}_{p}$ or $\mathrm{CVP}_{p}$, then these cryptographic schemes would be insecure in practice.

We therefore move in a different direction. Rather than trying to extend non-quantitative hardness results to larger approximation factors, we show quantitative hardness results for exact (or nearly exact) problems. To do this, we use the tools of fine-grained complexity.

1.3 Fine-grained complexity

Impagliazzo and Paturi [IP99] introduced the Exponential Time Hypothesis (ETH) and the Strong Exponential Time Hypothesis (SETH) to help understand the precise hardness of $k$-SAT. Informally, ETH asserts that $3$-SAT takes $2^{\Omega(n)}$-time to solve in the worst case, and SETH asserts that $k$-SAT takes essentially $2^{n}$-time to solve for unbounded $k$. I.e., SETH asserts that brute-force search is essentially optimal for solving $k$-SAT for large $k$.

Recently, the study of fine-grained complexity has leveraged ETH, SETH, and several other assumptions to prove quantitative hardness results about a wide range of problems. These include both problems in $\mathsf{P}$ (see, e.g., [CLR*+*14, BI15, ABW15] and the survey by Vassilevska Williams [Wil15]), and $\mathsf{NP}$-hard problems (see, e.g., [PW10, CDL*+*12, CFK*+*15]). Although these results are all conditional, they help to explain why making further algorithmic progress on these problems is difficult—and suggest that it might be impossible. Namely, any non-trivial algorithmic improvement would disprove a very well-studied hypothesis.

One proves quantitative hardness results using fine-grained reductions (see [Wil15] for a formal definition). For example, there is an efficient mapping from $k$-SAT formulas on $n$ variables to Hitting Set instances with universes of $n$ elements [CDL*+*12]. This reduction is fine-grained in the sense that for any constant $\varepsilon>0$, a $2^{(1-\varepsilon)n}$-time algorithm for Hitting Set implies a $2^{(1-\varepsilon)n}$-time algorithm for $k$-SAT, breaking SETH.

Despite extensive effort, no faster-than-$2^{n}$-time algorithm for $k$-SAT with unbounded $k$ has been found. Nevertheless, there is no consensus on whether SETH is true or not, and recently, Williams [Wil16] refuted a very strong variant of SETH. This makes it desirable to base quantitative hardness results on weaker assumptions when possible, and indeed our main result holds even assuming a weaker variant of SETH based on the hardness of Weighted Max-$k$-SAT (except for the case of $p=\infty$).

1.4 Our contribution

We now enumerate our results. See also Table 1.

SETH-hardness of $\mathrm{CVP}_{p}$.

Our main result is the SETH-hardness of $\mathrm{CVP}_{p}$ for any odd integer $p\geq 1$ and $p=\infty$ (and $\mathrm{SVP}_{\infty}$). Formally, we prove the following. (See Sections 3 and 4 for finite $p$ and Section 6.3 for $p=\infty$.)

Theorem 1.1**.**

For any constant integer $k\geq 2$ and any odd integer $p\geq 1$ or $p=\infty$, there is an efficient reduction from $k$-SAT with $n$ variables and $m$ clauses to $\mathrm{CVP}_{p}$ (or $\mathrm{SVP}_{\infty}$) on a lattice of rank $n$ (with ambient dimension $n+O(m)$).

In particular, there is no $2^{(1-\varepsilon)n}$-time algorithm for $\mathrm{CVP}_{p}$ for any odd integer $p\geq 1$ or $p=\infty$ (or $\mathrm{SVP}_{\infty}$) and any constant $\varepsilon>0$ unless SETH is false.

Unfortunately, we are unable to extend this result to even integers $p$, and in particular, to the important special case of $p=2$. In fact, this is inherent, as we show that our approach necessarily fails for even integers $p\leq k-1$. In spite of this, we actually prove the following result that generalizes Theorem 1.1 to “almost all” $p\geq 1$ (including non-integer $p$).

Theorem 1.2**.**

For any constant integer $k\geq 2$, there is an efficient reduction from $k$-SAT with $n$ variables and $m$ clauses to $\mathrm{CVP}_{p}$ on a lattice of rank $n$ (with ambient dimension $n+O(m)$) for any $p\geq 1$ such that

$p$* is an odd integer or $p=\infty$;* 2. 2.

$p\notin S_{k}$, where $S_{k}$ is some finite set (containing all even integers $p\leq k-1$); or 3. 3.

$p=p_{0}+\delta(n)$* for any $p_{0}\geq 1$ and any $\delta(n)\neq 0$ that converges to zero as $n\to\infty$.*

In particular, if SETH holds then for any constant $\varepsilon>0$, there is no $2^{(1-\varepsilon)n}$-time algorithm for $\mathrm{CVP}_{p}$ for any $p\geq 1$ such that

$p$* is an odd integer or $p=\infty$;* 2. 2.

$p\notin S_{k}$* for some sufficiently large $k$ (depending on $\varepsilon$); or* 3. 3.

$p=p_{0}+\delta(n)$.

Notice that this lower bound (Theorem 1.2) comes tantalizingly close to resolving the quantitative complexity of $\mathrm{CVP}_{2}$. In particular, we obtain a $2^{n}$-time lower bound on $\mathrm{CVP}_{2+\delta}$ for any $0\neq\delta(n)=o(1)$, and the fastest algorithm for $\mathrm{CVP}_{2}$ run in time $2^{n+o(n)}$. But, formally, Theorems 1.1 and 1.2 say nothing about $\mathrm{CVP}_{2}$. (Indeed, there is at least some reason to believe that $\mathrm{CVP}_{2}$ is easier than $\mathrm{CVP}_{p}$ for $p\neq 2$ [RR06].)

We note that our reductions actually work for Weighted Max-$k$-SAT for all finite $p\neq\infty$, so that our hardness result holds under a weaker assumption than SETH, namely, the corresponding hypothesis for Weighted Max-$k$-SAT.

Finally, we note that in the special case of $p=\infty$, our reduction works even for approximate $\mathrm{CVP}_{\infty}$, or even approximate $\mathrm{SVP}_{\infty}$, with an approximation factor of $\gamma:=1+2/(k-1)$. In particular, $\gamma$ is constant for fixed $k$. This implies that for every constant $\varepsilon>0$, there is a constant $\gamma_{\varepsilon}>1$ such that no $2^{(1-\varepsilon)n}$-time algorithm approximates $\mathrm{SVP}_{\infty}$ or $\mathrm{CVP}_{\infty}$ to within a factor of $\gamma_{\varepsilon}$ unless SETH fails.

Quantitative hardness of approximate $\mathrm{CVP}$.

As we discussed above, many $2^{O(n)}$-time algorithms for $\mathrm{CVP}_{p}$ only work for $\gamma$-approximate $\mathrm{CVP}_{p}$ for constant approximation factors $\gamma>1$. However, the reduction described above only works for exact $\mathrm{CVP}_{p}$ (except when $p=\infty$).555One can likely show that our “exact” reductions actually work for $\gamma$-approximate $\mathrm{CVP}_{p}$ with some approximation factor $\gamma=1+o(1)$. But, this is not very interesting because standard techniques for “boosting” the approximation factor are useless for us. (They increase the rank far too much.)

So, it would be preferable to show hardness for some constant approximation factor $\gamma>1$. One way to show such a hardness result is via a fine-grained reduction from the problem of approximating Max-$k$-SAT to within a constant factor. Indeed, in the $k=2$ case, we show that such a reduction exists, so that there is no $2^{o(n)}$-time algorithm for approximating $\mathrm{CVP}_{p}$ to within some constant factor unless a $2^{o(n)}$-time algorithm exists for approximating Max-$2$-SAT. We also note that a $2^{o(n)}$-time algorithm for approximating Max-$2$-SAT to within a constant factor would imply one for Max-$3$-SAT as well. (See Proposition 2.12.)

We present this result informally here (without worrying about specific parameters and the exact definition of approximate Max-$2$-SAT). See Section 5 for the formal statement.

Theorem 1.3**.**

There is an efficient reduction from approximating Max-$2$-SAT with $n$ variables and $m$ clauses to within a constant factor to approximating $\mathrm{CVP}_{p}$ to within a constant factor on a lattice of rank $n$ (with ambient dimension $n+O(m)$) for any finite $p\geq 1$.

Quantitative hardness of $\mathrm{CVP}$ with Preprocessing.

$\mathrm{CVP}$ with Preprocessing ($\mathrm{CVPP}$) is the variant of $\mathrm{CVP}$ in which we are allowed arbitrary advice that depends on the lattice, but not the target vector. $\mathrm{CVPP}$ and its variants have potential applications in both cryptography (e.g., [GPV08]) and cryptanalysis. And, an algorithm for $\mathrm{CVPP}_{2}$ is used as a subroutine in the celebrated Micciancio-Voulgaris algorithm for $\mathrm{CVP}_{2}$ [MV13, BD15]. The complexity of $\mathrm{CVPP}_{p}$ is well studied, with both hardness of approximation results [Mic01a, FM04, Reg04, AKKV11, KPV14], and efficient approximation algorithms [AR05, DRS14].

We prove the following quantitative hardness result for $\mathrm{CVPP}_{p}$. (See Section 6.1.)

Theorem 1.4**.**

For any $1\leq p<\infty$, there is no $2^{o(\sqrt{n})}$-time algorithm for $\mathrm{CVPP}$ unless there is a (non-uniform) $2^{o(n)}$-time algorithm for Max-$2$-SAT. In particular, no such algorithm exists unless (non-uniform) ETH fails.

Additional quantitative hardness results for $\mathrm{CVP}_{p}$.

We also observe the following weaker hardness result for $\mathrm{CVP}_{p}$ for any $1\leq p<\infty$ based on different assumptions. The ETH-hardness of $\mathrm{CVP}_{p}$ was already known in folklore, and even written down by Samuel Yeom in unpublished work [Vai15]. We present a slightly stronger theorem than what was previously known, showing a reduction from Max-$2$-SAT on $n$ variables to $\mathrm{CVP}_{p}$ on a lattice of rank $n$. (Prior to this work, we were only aware of reductions from $3$-SAT on $n$ variables to $\mathrm{CVP}_{p}$ on a lattice of rank $Cn$ for some very large constant $C>1000$.)

Theorem 1.5**.**

For any $1\leq p<\infty$, there is an efficient reduction from Max-$2$-SAT with $n$ variables to $\mathrm{CVP}_{p}$ on a lattice of rank $n$ (and dimension $n+m$, where $m$ is the number of clauses).

In particular, for any constant $c>0$, there is no $(\mathrm{poly}(n)\cdot 2^{cn})$-time algorithm for $\mathrm{CVP}_{p}$ unless there is a $2^{cn}$-time algorithm for Max-$2$-SAT, and there is no $2^{o(n)}$-time algorithm for $\mathrm{CVP}_{p}$ unless ETH fails.

The fastest known algorithm for the Max-$2$-SAT problem is the $\mathrm{poly}(n)\cdot 2^{\omega n/3}$-time algorithm due to Williams [Wil05], where $2\leq\omega<2.373$ is the matrix multiplication exponent [Wil12, LG14]. This implies that a faster than $2^{\omega n/3}$-time algorithm for $\mathrm{CVP}_{p}$ (and $\mathrm{CVP}_{2}$ in particular) would yield a faster algorithm for Max-$2$-SAT. (See, e.g., [Woe08] Open Problem 4.7 and the preceding discussion.)

1.5 Techniques

Max-$2$-SAT.

We first show a straightforward reduction from Max-$2$-SAT to $\mathrm{CVP}_{p}$ for any $1\leq p<\infty$. I.e., we prove Theorem 1.5. This simple reduction will introduce some of the high-level ideas needed for our more difficult reductions.

Given a Max-$2$-SAT instance $\Phi$ with $n$ variables and $m$ clauses, we construct the lattice basis

[TABLE]

where $\alpha>0$ is some very large number and $\bar{\Phi}\in\mathbb{R}^{m\times n}$ is given by

[TABLE]

I.e., the rows of $\bar{\Phi}$ correspond to clauses and the columns correspond to variables. Each entry encodes whether the relevant variable is included in the relevant clause unnegated, negated, or not at all, using $2$, $-2$, and [math] respectively. (We assume without loss of generality that no clause contains repeated literals or a literal and its negation simultaneously.) The target $\boldsymbol{t}\in\mathbb{R}^{m+n}$ is given by

[TABLE]

where

[TABLE]

where $\eta_{i}$ is the number of negated variables in the $i$th clause.

Notice that the copy of $2\alpha I_{n}$ at the bottom of $B$ together with the sequence of $\alpha$’s in the last coordinates of $\boldsymbol{t}$ guarantee that any lattice vector $B\boldsymbol{z}$ with $\boldsymbol{z}\in\mathbb{Z}^{n}$ is at distance at least $\alpha n^{1/p}$ away from $\boldsymbol{t}$. Furthermore, if $\boldsymbol{z}\notin\{0,1\}^{n}$, then this distance increases to at least $\alpha(n-1+3^{p})^{1/p}$. This is a standard gadget, which will allow us to ignore the case $\boldsymbol{z}\notin\{0,1\}^{n}$ (as long as $\alpha$ is large enough). I.e., we can view $\boldsymbol{z}$ as an assignment to the $n$ variables of $\Phi$.

Now, suppose $\boldsymbol{z}$ does not satisfy the $i$th clause. Then, notice that the $i$th coordinate of $B\boldsymbol{z}$ will be exactly $-2\eta_{i}$, so that $(B\boldsymbol{z}-\boldsymbol{t})_{i}=0-3=-3$. If, on the other hand, exactly one literal in the $i$th clause is satisfied, then the $i$th coordinate of $B\boldsymbol{z}$ will be $2-2\eta_{i}$, so that $(B\boldsymbol{z}-\boldsymbol{t})_{i}=2-3=-1$. Finally, if both literals are satisfied, then the $i$th coordinate will be $4-2\eta_{i}$, so that $(B\boldsymbol{z}-\boldsymbol{t})_{i}=4-3=1$. In particular, if the $i$th clause is not satisfied, then $|(B\boldsymbol{z}-\boldsymbol{t})_{i}|=3$. Otherwise, $|(B\boldsymbol{z}-\boldsymbol{t})_{i}|=1$.

It follows that the distance to the target is exactly $\operatorname{dist}_{p}(\boldsymbol{t},\mathcal{L})^{p}=\alpha^{p}n+S+3^{p}(m-S)=\alpha^{p}n-(3^{p}-1)S+3^{p}m$, where $S$ is the maximal number of satisfied clauses of $\Phi$. So, the distance $\operatorname{dist}_{p}(\boldsymbol{t},\mathcal{L})$ tells us exactly the maximum number of satisfiable clauses, which is what we needed.

Difficulties extending this to $k$-SAT.

The above reduction relied on one very important fact: that $|4-3|=|2-3|<|0-3|$. In particular, a $2$-SAT clause can be satisfied in two different ways; either one variable is satisfied or two variables are satisfied. We designed our $\mathrm{CVP}$ instance above so that the $i$th coordinate of $B\boldsymbol{z}-\boldsymbol{t}$ is $4-3$ if two literals in the $i$th clause are satisfied by $\boldsymbol{z}\in\{0,1\}^{n}$, $2-3$ if one literal is satisfied, and $0-3$ if the clause is unsatisfied. Since $|4-3|=|2-3|$, the “contribution” of this $i$th coordinate to the distance $\|B\boldsymbol{z}-\boldsymbol{t}\|_{p}^{p}$ is the same for any satisfied clause. Since $|0-3|>|4-3|$, the contribution to the $i$th coordinate is larger for unsatisfied clauses than satisfied clauses.

Suppose we tried the same construction for a $k$-SAT instance. I.e., suppose we take $\bar{\Phi}\in\mathbb{R}^{m\times n}$ to encode the literals in each clause as in Eq. (2) and construct our lattice basis $B$ as in Eq. (1) and target $\boldsymbol{t}$ as in Eq. (3), perhaps with the number $3$ in the definition of $\boldsymbol{t}$ replaced by an arbitrary $t^{*}\in\mathbb{R}$. Then, the $i$th coordinate of $B\boldsymbol{z}-\boldsymbol{t}$ would be $2S_{i}-t^{*}$, where $S_{i}$ is the number of literals satisfied in the $i$th clause.

No matter how cleverly we choose $t^{*}\in\mathbb{R}$, some satisfied clauses will contribute more to the distance than others as long as $k\geq 3$. I.e., there will always be some “imbalance” in this contribution. As a result, we will not be able to distinguish between, e.g., an assignment that satisfies all clauses but has $S_{i}$ far from $t^{*}/2$ for all $i$ and an assignment that satisfies fewer clauses but has $S_{i}\approx t^{*}/2$ whenever $i$ corresponds to a satisfying clause.

In short, for $k\geq 3$, we run into trouble because satisfying assignments to a clause may satisfy anywhere between $1$ and $k$ literals, but $k$ distinct numbers obviously cannot all be equidistant from some number $t^{*}$. (See Section 6.2 for a simple way to get around this issue by adding to the rank of the lattice. Below, we show a more technical way to do this without adding to the rank of the lattice, which allows us to prove SETH-hardness.)

A solution via isolating parallelepipeds.

To get around the issue described above for $k\geq 3$, we first observe that, while many distinct numbers cannot all be equidistant from some number $t^{*}$, it is trivial to find many distinct vectors in $\mathbb{R}^{d^{*}}$ that are equidistant from some vector $\boldsymbol{t}^{*}\in\mathbb{R}^{d^{*}}$.

We therefore consider modifying the reduction from above by replacing the scalar $\pm 2$ values in our matrix $\bar{\Phi}$ with vectors in $\mathbb{R}^{d^{*}}$ for some $d^{*}$. In particular, for some vectors $V=(\boldsymbol{v}_{1},\ldots,\boldsymbol{v}_{k})\in\mathbb{R}^{d^{*}\times k}$, we define $\bar{\Phi}\in\mathbb{R}^{d^{*}m\times n}$ as

[TABLE]

where we have abused notation and taken $\bar{\Phi}_{i,j}$ to be a column vector in $d^{*}$ dimensions. By defining $\boldsymbol{t}\in\mathbb{R}^{d^{*}m+n}$ appropriately,666In particular, we replace the scalars $t_{i}$ in Eq. (4) with vectors

$\boldsymbol{t}_{i}:=\boldsymbol{t}^{*}-\sum\boldsymbol{v}_{s}\in\mathbb{R}^{d^{*}}\;,$

where the sum is over $s$ such that the $s$th literal in the $i$th clause is negated.

we will get that the “contribution of the $i$th clause to the distance” $\|B\boldsymbol{z}-\boldsymbol{t}\|_{p}^{p}$ is exactly $\|V\boldsymbol{y}-\boldsymbol{t}^{*}\|_{p}^{p}$ for some $\boldsymbol{t}^{*}\in\mathbb{R}^{d^{*}}$, where $\boldsymbol{y}\in\{0,1\}^{k}$ such that $y_{s}=1$ if and only if $\boldsymbol{z}$ satisfies the $s$th literal of the relevant clause. (See Table 2 for a diagram showing the output of the reduction and Theorem 3.2 for the formal statement.) We stress that, while we have increased the ambient dimension by nearly a factor of $d^{*}$, the rank of the lattice is still $n$.

This motivates the introduction of our primary technical tool, which we call isolating parallelepipeds. For $1\leq p\leq\infty$, a $(p,k)$-isolating parallelepiped is represented by a matrix $V\in\mathbb{R}^{d^{*}\times k}$ and a shift vector $\boldsymbol{t}^{*}\in\mathbb{R}^{d^{*}}$ with the special property that one vertex of the parallelepiped $V\{0,1\}^{k}-\boldsymbol{t}^{*}$ is “isolated.” (Here, $V\{0,1\}^{k}-\boldsymbol{t}^{*}$ is an affine transformation of the hypercube, i.e., a parallelepiped.) In particular, every vertex of the parallelepiped, $V\boldsymbol{y}-\boldsymbol{t}^{*}$ for $\boldsymbol{y}\in\{0,1\}^{k}$ has unit length $\|V\boldsymbol{y}-\boldsymbol{t}^{*}\|_{p}=1$ except for the vertex $-\boldsymbol{t}^{*}$, which is longer, i.e., $\|\boldsymbol{t}^{*}\|_{p}>1$. (See Figure 1.)

In terms of the reduction above, an isolating parallelepiped is exactly what we need. In particular, if we plug $V$ and $\boldsymbol{t}^{*}$ into the above reduction, then all satisfied clauses (which correspond to non-zero $\boldsymbol{y}$ in the above description) will “contribute” $1$ to the distance $\|B\boldsymbol{z}-\boldsymbol{t}\|_{p}^{p}$, while unsatisfied clauses (which correspond to $\boldsymbol{y}=\boldsymbol{0}$) will contribute $1+\delta$ for some $\delta>0$. Therefore, the total distance will be exactly $\|B\boldsymbol{z}-\boldsymbol{t}\|_{p}^{p}=\alpha^{p}n+m^{+}(\boldsymbol{z})+(m-m^{+}(\boldsymbol{z}))(1+\delta)=\alpha^{p}n-\delta m^{+}(\boldsymbol{z})+(1+\delta)m$, where $m^{+}(\boldsymbol{z})$ is the number of clauses satisfied by $\boldsymbol{z}$. So, the distance $\operatorname{dist}_{p}(\boldsymbol{t},\mathcal{L})$ exactly corresponds to the maximal number of satisfied clauses, as needed.

Constructing isolating parallelepipeds.

Of course, in order for the above to be useful, we must show how to construct these $(p,k)$-isolating parallelepipeds. Indeed, it is not hard to find constructions for all $p\geq 1$ when $k=2$, and even for all $k$ in the special case when $p=1$ (see Figure 1). Some other fairly nice examples can also be found for small $k$, as shown in Figure 2. For $p>1$ and large $k$, these objects seem to be much harder to find. (In fact, in Section 4.2, we show that there is no $(p,k)$-isolating parallelepiped for any even integer $p\leq k-1$.) Our solution is therefore a bit technical.

At a high level, in Section 4, we consider a natural class of parallelepipeds $V\in\mathbb{R}^{2^{k}\times k},\boldsymbol{t}^{*}\in\mathbb{R}^{2^{k}}$ parametrized by some weights $\alpha_{0},\alpha_{1},\ldots,\alpha_{k}\geq 0$ and a scalar shift $t^{*}\in\mathbb{R}$. These parallelepipeds are constructed so that the length of the vertex $\|V\boldsymbol{y}-\boldsymbol{t}^{*}\|_{p}^{p}$ for $\boldsymbol{y}\in\{0,1\}^{k}$ depends only on the Hamming weight of $\boldsymbol{y}$ and is linear in the $\alpha_{i}$ for fixed $t^{*}$. In other words, there is a matrix $M_{k}(p,t^{*})\in\mathbb{R}^{(k+1)\times(k+1)}$ such that $M_{k}(p,t^{*})(\alpha_{0},\ldots,\alpha_{k})^{T}$ encodes the value of $\|V\boldsymbol{y}-\boldsymbol{t}^{*}\|_{p}^{p}$ for each possible Hamming weight of $\boldsymbol{y}\in\{0,1\}^{k}$. (See Lemma 4.2.)

We show that, in order to find weights $\alpha_{0},\ldots,\alpha_{k}\geq 0$ such that $V$ and $\boldsymbol{t}^{*}$ define a $(p,k)$-isolating parallelepiped, it suffices to find a $t^{*}$ such that $M_{k}(p,t^{*})$ is invertible. For each odd integer $p\geq 1$ and each $k\geq 2$, we show an algorithm that finds such a $t^{*}$. (See Section 4.1.)

To extend this result to other $p\geq 1$, we consider the determinant of $M_{k}(p,t^{*})$ for fixed $k$ and $t^{*}$, viewed as a function of $p$. We observe that this function has a rather nice form—it is a Dirichlet polynomial. I.e., for fixed $t^{*}$ and $k$, the determinant can be written as $\sum\exp(a_{i}p)$ for some $a_{i}\in\mathbb{R}$. Such a function has finitely many roots unless it is identically zero. So, we take the value of $t^{*}$ from above such that, say, $M_{k}(1,t^{*})$ is invertible. Since $M_{k}(1,t^{*})$ does not have zero determinant, the Dirichlet polynomial corresponding to $\det(M_{k}(p,t^{*}))$ cannot be identically zero and therefore has finitely many roots. This is how we prove Theorem 1.2. (See Section 4.3.)

Extension to constant-factor approximation.

In order to extend our hardness results to approximate $\mathrm{CVP}_{p}$ for finite $p$, we can try simply using the same reduction with $k$-SAT replaced by approximate Max-$k$-SAT. Unfortunately, this does not quite work. Indeed, it is easy to see that the “identity matrix gadget” that we use to restrict our attention to lattice vectors whose coordinates are in $\{0,1\}$ (Eq. (1)) cannot tolerate an approximation factor larger than $1+O(1/n)$ (for finite $p$).

However, we observe that when $k=2$, this identity matrix gadget is actually unnecessary. In particular, even without this gadget, it “never helps” to consider a lattice vector whose coordinates are not all in $\{0,1\}$. It then follows immediately from the analysis above that Gap-$2$-SAT reduces to approximate $\mathrm{CVP}_{p}$ with a constant approximation factor strictly greater than one. We note that we do not know how to extend this result to larger $k>2$ (except when $p=1$, see Theorem 5.3). We show that the case $k=2$ is sufficient for proving Gap-ETH-hardness (see Proposition 2.12), but we suspect that one can just “remove the identity matrix gadget” from all of our reductions for finite $p$. If this were true, it would show Gap-ETH-hardness of approximation for slightly larger constant approximation factors and imply even stronger hardness results under less common assumptions.

1.6 Open questions

The most important question that we leave open is the extension of our SETH-hardness result to arbitrary $p\geq 1$. In particular, while our result applies to $p=p(n)\neq 2$ that approaches $2$ asymptotically, it does not apply to the specific case $p=2$. An extension to $p=2$ would settle the time complexity of $\mathrm{CVP}_{2}$ up to a factor of $2^{o(n)}$ (assuming SETH). However, we know that our technique does not work in this case (in that $(2,k)$-parallelepipeds do not exist for $k\geq 3$), so substantial new ideas might be needed to resolve this issue.

Another direction would be to strengthen our hardness of approximation results in one of two possible directions. First, one could try to increase the approximation factor. (Prior techniques for amplifying the approximation factor increase the rank of the lattice quite a bit, so they do not yield very interesting quantitative hardness results.) Second, one could try to show a reduction from Gap-$k$-SAT to approximate $\mathrm{CVP}_{p}$ for $k\geq 3$. For $p\in\{1,\infty\}$, we already have such a reduction, and as we mentioned above, we suspect that we can simply “remove the identity matrix gadget” in our current reduction to achieve this for $1<p<\infty$. But, we do not know how to prove that this works.

Finally, we note that our main reduction constructs lattices of rank $n$, but the ambient dimension $d$ can be significantly larger. (Specifically, $d=n+O(m)$, where $m$ is the number of clauses in the relevant SAT instance, and where the hidden constant depends on $k$ and can be very large.) Lattice problems are typically parameterized in terms of the rank of the lattice (and for the $\ell_{2}$ norm, one can assume without loss of generality that $d=n$), but it is still interesting to ask whether we can reduce the ambient dimension $d$.

Organization

In Section 2, we review some necessary background knowledge. In Section 3, we show how to use a $(p,k)$-isolating parallelepiped (for finite $p$) to reduce any $n$-variable instance of $k$-SAT to a $\mathrm{CVP}_{p}$ instance with rank $n$, and we show that this immediately gives SETH-hardness for $p=1$. In Section 4, we show how to construct $(p,k)$-isolating parallelepipeds, first for odd integers $p\geq 1$ and then for “almost all” $p$. In Section 5, we show $2^{\Omega(n)}$-hardness of approximating $\mathrm{CVP}_{p}$ up to a constant factor. In Section 6, we prove a number of additional hardness results: $2^{\Omega(\sqrt{n})}$ ETH- and Max-$2$-SAT-hardness of $\mathrm{CVPP}_{p}$ (Section 6.1), ETH- and Max-$2$-SAT-hardness of $\mathrm{CVP}_{p}$ (Section 6.2), and SETH-hardness of $\mathrm{CVP}_{\infty}$ and $\mathrm{SVP}_{\infty}$ (Section 6.3).

2 Preliminaries

Throughout this paper, we work with lattice problems over $\mathbb{R}^{d}$ for convenience. Formally, we must pick a suitable representation of real numbers and consider both the size of the representation and the efficiency of arithmetic operations in the given representation. But, we omit such details throughout to ease readability.

2.1 Computational lattice problems

Let $\operatorname{dist}_{p}(\mathcal{L},\boldsymbol{t}):=\min_{\boldsymbol{x}\in\mathcal{L}}\|\boldsymbol{x}-\boldsymbol{t}\|_{p}$ denote the $\ell_{p}$ distance of $\boldsymbol{t}$ to $\mathcal{L}$. In addition to SVP and CVP, we also consider a variant of CVP called the Closest Vector Problem with Preprocessing (CVPP), which allows arbitrary preprocessing of a lattice.

Definition 2.1**.**

For any $\gamma\geq 1$ and $1\leq p\leq\infty$, the $\gamma$-approximate Shortest Vector Problem with respect to the $\ell_{p}$ norm ($\gamma$-$\mathrm{SVP}_{p}$) is the promise problem defined as follows. Given a lattice $\mathcal{L}$ (specified by a basis $B\in\mathbb{R}^{d\times n}$) and a number $r>0$, distinguish between a ‘YES’ instance where there exists a non-zero vector $\boldsymbol{v}\in\mathcal{L}$ such that $\|\boldsymbol{v}\|_{p}\leq r$, and a ‘NO’ instance where $\|\boldsymbol{v}\|_{p}>\gamma r$ for all non-zero $v\in\mathcal{L}$.

Definition 2.2**.**

For any $\gamma\geq 1$ and $1\leq p\leq\infty$, the $\gamma$-approximate Closest Vector Problem with respect to the $\ell_{p}$ norm ($\gamma$-$\mathrm{CVP}_{p}$) is the promise problem defined as follows. Given a lattice $\mathcal{L}$ (specified by a basis $B\in\mathbb{R}^{d\times n}$), a target vector $\boldsymbol{t}\in\mathbb{R}^{d}$, and a number $r>0$, distinguish between a ‘YES’ instance where $\operatorname{dist}_{p}(\mathcal{L},\boldsymbol{t})\leq r$, and a ‘NO’ instance where $\operatorname{dist}_{p}(\mathcal{L},\boldsymbol{t})>\gamma r$.

When $\gamma=1$, we refer to the problems simply as $\mathrm{SVP}_{p}$ and $\mathrm{CVP}_{p}$, respectively.

Definition 2.3**.**

The Closest Vector Problem with Preprocessing with respect to the $\ell_{p}$ norm ($\mathrm{CVPP}_{p})$ is the problem of finding a preprocessing function $P$ and an algorithm $Q$ which work as follows. Given a lattice $\mathcal{L}$ (specified by a basis $B\in\mathbb{R}^{d\times n}$), $P$ outputs a new description of $\mathcal{L}$. Given $P(\mathcal{L})$, a target vector $\boldsymbol{t}\in\mathbb{R}^{d}$, and a number $r>0$, $Q$ decides whether $\operatorname{dist}_{p}(\mathcal{L},\boldsymbol{t})\leq r$.

When we measure the running time of a $\mathrm{CVPP}$ algorithm, we only count the running time of $Q$, and not of the preprocessing algorithm $P$.

2.2 Satisfiability problems and the Max-Cut problem

A $k$-SAT formula $\Phi$ on $n$ Boolean variables $x_{1},\ldots,x_{n}$ and $m$ clauses $C_{1},\ldots,C_{m}$ is a conjunction $\Phi=\land_{i=1}^{m}C_{i}$ of clauses $C_{i}=\lor_{s=1}^{k}\ell_{i,s}$, where the literals $\ell_{i,s}$ denote a variable $x_{j}$ or its negation $\lnot x_{j}$. The goal is to decide whether there exists an assignment $\boldsymbol{a}\in\{0,1\}^{n}$ to the variables of $\Phi$ such that all clauses have at least one “true” literal, i.e., so that all clauses are satisfied.

The value of a $k$-SAT formula $\Phi$, denoted $\textrm{val}(\Phi)$, is the maximum fraction of clauses satisfied by an assignment to $\Phi$.

Definition 2.4**.**

Given a $k$-SAT formula $\Phi$ and constants $0\leq\delta<\varepsilon\leq 1$, the $(\delta,\varepsilon)$-Gap-$k$-SAT problem is the promise problem defined as follows. The goal is to distinguish between a ‘YES’ instance in which $\textrm{val}(\Phi)\geq\varepsilon$, and a ‘NO’ instance in which $\textrm{val}(\Phi)<\delta$.

Definition 2.5**.**

Given a $k$-SAT formula $\Phi$ with clauses $\mathcal{C}=\{C_{1},\ldots,C_{m}\}$, a clause weight function $w:\mathcal{C}\to\mathbb{Z}^{+}$, and a weight threshold $W$, the Weighted Max-$k$-SAT problem is to decide whether there exists an assignment $\boldsymbol{a}$ to the variables of $\Phi$ such that \sum_{\textrm{C_{i}$is sat. by$\boldsymbol{a}}}w(C_{i})\geq W.

Definition 2.6**.**

Given an undirected graph $G=(V,E)$, an edge weight function $w:E\to\mathbb{Z}^{+}$, and a weight threshold $W$, the Weighted Max-CUT problem is defined as follows. The goal is to decide whether $V$ can be partitioned into sets $V_{1}$ and $V_{2}$ such that $\sum_{e_{ij}\in E:v_{i}\in V_{1},v_{j}\in V_{2}}w(e_{ij})\geq W$.

There exists a folklore reduction from an instance of Weighted Max-Cut on a graph with $n$ vertices to an instance of Weighted Max 2-SAT on a formula with $n$ variables. See, e.g., [GHNR03].

2.3 Exponential Time Hypotheses

Impagliazzo and Paturi [IP99] introduced the following two hypotheses (ETH and SETH), which are now widely used to study the quantitative hardness of computational problems.

Definition 2.7**.**

The Exponential Time Hypothesis (ETH) is the hypothesis defined as follows. For every $k\geq 3$ there exists a constant $\varepsilon>0$ such that no algorithm solves $k$-SAT formulas with $n$ variables in $2^{\varepsilon n}$-time. In particular, there is no $2^{o(n)}$-time algorithm for 3-SAT.

Definition 2.8**.**

The Strong Exponential Time Hypothesis (SETH) is the hypothesis defined as follows. For every constant $\varepsilon>0$ there exists $k$ such that no algorithm solves $k$-SAT formulas with $n$ variables in $2^{(1-\varepsilon)n}$-time.

An important tool in the study of the exact complexity of $k$-SAT is the Sparisification Lemma of Impagliazzo, Paturi, and Zane [IPZ01] which roughly says that any $k$-SAT formula can be replaced with $2^{\varepsilon n}$ formulas each with $O(n)$ clauses for some $\varepsilon>0$.

Proposition 2.9** (Sparsification Lemma, [IPZ01]).**

For every $k\in\mathbb{Z}^{+}$ and $\varepsilon>0$ there exists a constant $c=c(k,\varepsilon)$ such that any $k$-SAT formula $\Phi$ with $n$ variables can be expressed as $\Phi=\lor_{i=1}^{r}\Psi_{i}$ where $r\leq 2^{\varepsilon n}$ and each $\Psi_{i}$ is a $k$-SAT formula with at most $cn$ clauses. Moreover, this disjunction can be computed in $2^{\varepsilon n}$-time.

In this paper we also consider the W-Max-SAT-SETH hypothesis, which corresponds to SETH but with Weighted Max-$k$-SAT in place of $k$-SAT. Our main result only relies on this weaker variant of SETH, and is therefore more robust.

Dinur [Din16] and Manurangsi and Raghavendra [MR17] recently introduced a “gap” version of ETH, which asserts that Gap-$3$-SAT takes $2^{\Omega(n)}$-time.

Definition 2.10**.**

The (randomized) Gap-Exponential Time Hypothesis ((randomized) Gap-ETH) is the hypothesis that there exist constants $\delta<1$ and $\varepsilon>0$ such that no (randomized) algorithm solves $(\delta,1)$-Gap-$3$-SAT instances with $n$ variables in $2^{\varepsilon n}$-time.

As Dinur [Din16] notes, one can sparsify a Gap-SAT instance simply by sampling clauses. Therefore, we can assume (almost) without loss of generality that Gap-ETH applies only to formulas with $O(n)$ clauses. The caveat is that the sampling is randomized, so finding a $2^{o(n)}$-time algorithm for sparse Gap-$3$-SAT only implies a randomized $2^{o(n)}$-time algorithm for general Gap-$3$-SAT.

We give a variant of Dinur’s sampling argument in Proposition 2.11. The idea is to show that both the total number of sampled clauses and the number of sampled clauses that are satisfied by any given assignment are highly concentrated around their expectation by using the Chernoff bound, and then to take a union bound over the bad events where these quantities deviate substantially from their expectation.

We will use the following multiplicative Chernoff bounds (see, e.g., [HP]). Let $X_{1},\ldots,X_{n}$ be independent identically distributed Bernoulli random variables with expectation $p$, so that the expectation of $\sum_{i=1}^{n}X_{i}$ is $\mu=pn$. Then:

[TABLE]

[TABLE]

Proposition 2.11** (Sparsification for Gap-SAT).**

For any $0<\delta<\delta^{\prime}<1$, there is a polynomial-time randomized reduction from a $(\delta,1)$-Gap-$k$-SAT instance $\Phi$ with $n$ variables and $m$ clauses to a $(\delta^{\prime},1)$-Gap-$k$-SAT instance $\Phi^{\prime}$ with $n$ variables and $O(n)$ clauses.

Proof.

Let $\Phi^{\prime}$ be the formula obtained by sampling each clause of $\Phi$ independently with probability $p:=\min\{1,10/(\delta\alpha^{2})\cdot n/m\}$, where $\alpha$ is fixed so that $-(1-\delta^{\prime}/\delta)/(1+\delta^{\prime}/\delta)<\alpha<1$. Clearly, if $\textrm{val}(\Phi)=1$ then $\textrm{val}(\Phi^{\prime})=1$ as well. We analyze the case where $\textrm{val}(\Phi)<\delta$.

In expectation $\Phi^{\prime}$ has $pm$ clauses. Furthermore, because $\textrm{val}(\Phi^{\prime})<\delta$, in expectation any fixed assignment will satisfy fewer than $\delta pm$ clauses of $\Phi^{\prime}$. Therefore by Equation (6),

[TABLE]

Furthermore, by Equation (7), we have that for each fixed assignment $\boldsymbol{a}$,

[TABLE]

By applying Equations (8) and (9), and taking a union bound we get that the probability that $\Phi^{\prime}$ has at least $(1-\alpha)pm$ clauses and that no assignment to $\Phi^{\prime}$ satisfies more than $(1+\alpha)\delta pm$ clauses is at least $1-(e^{-2n}+2^{n}e^{-2n})\geq 1-2e^{-n}$. Therefore,

[TABLE]

with high probability. ∎

Additionally, we will use a reduction of Garey et al. [GJS76] from $3$-SAT to Max-$2$-SAT which also works as a reduction from Gap-$3$-SAT to Gap-$2$-SAT. The reduction works by outputting ten $1$- and $2$-clauses for each $3$-clause in the original formula. Any assignment which satisfies the original clause corresponds to an assignment which satisfies $7$ of the output clauses, and any assignment which does not satisfy the original clause corresponds to an assignment which satisfies $6$ of the output clauses.

Proposition 2.12** ([GJS76, Theorem 1.1]).**

For every $0\leq\delta<\varepsilon\leq 1$, there is a polynomial-time reduction from every instance of $(\delta,\varepsilon)$-Gap-$3$-SAT with $n$ variables and $m$ clauses to an instance of $((6+\delta)/10,(6+\varepsilon)/10)$-Gap-$2$-SAT with $n+m$ variables and $10m$ clauses.

3 SETH-hardness from isolating parallelepipeds

We start by giving a reduction from instances of weighted Max-$k$-SAT on formulas with $n$ variables to instances of $\mathrm{CVP}_{p}$ with rank $n$ for all $p$ that uses a certain geometric object, which we define next. Let $\boldsymbol{1}_{n}$ and $\boldsymbol{0}_{n}$ denote the all 1s and all 0s vectors of length $n$ respectively, and let $I_{n}$ denote the $n\times n$ identity matrix.

Definition 3.1**.**

For any $1\leq p\leq\infty$ and integer $k\geq 2$, we say that $V\in\mathbb{R}^{d^{*}\times k}$ and $\boldsymbol{t}^{*}\in\mathbb{R}^{d^{*}}$ define a $(p,k)$-isolating parallelepiped if $\|\boldsymbol{t}\|_{p}>1$ and $\|V\boldsymbol{x}-\boldsymbol{t}^{*}\|_{p}=1$ for all $\boldsymbol{x}\in\{0,1\}^{k}\setminus\{\boldsymbol{0}_{k}\}$.

In order to give the reduction, we first introduce some notation related to SAT. Let $\Phi$ be a $k$-SAT formula on $n$ variables $x_{1},\ldots,x_{n}$ and $m$ clauses $C_{1},\ldots,C_{m}$. Let $\textrm{ind}(\ell)$ denote the index of the variable underlying a literal $\ell$. I.e., $\textrm{ind}(\ell)=j$ if $\ell=x_{j}$ or $\ell=\lnot x_{j}$. Call a literal $\ell$ positive if $\ell=x_{j}$ and negative if $\ell=\lnot x_{j}$ for some variable $x_{j}$. Given a clause $C_{i}=\lor_{s=1}^{k}\ell_{i,s}$, let $P_{i}:=\{s\in[k]:\ell_{i,s}\textrm{ is positive}\}$ and let $N_{i}:=\{s\in[k]:\ell_{i,s}\textrm{ is negative}\}$ denote the indices of positive and negative literals in $C_{i}$ respectively. Given an assignment $\boldsymbol{a}\in\{0,1\}^{n}$ to the variables of $\Phi$, let $S_{i}(\boldsymbol{a})$ denote the indices of literals in $C_{i}$ satisfied by $\boldsymbol{a}$. I.e., $S_{i}(\boldsymbol{a}):=\{s\in P_{i}:a_{\textrm{ind}(\ell_{i,s})}=1\}\cup\{s\in N_{i}:a_{\textrm{ind}(\ell_{i,s})}=0\}$. Finally, let $m^{+}(\boldsymbol{a})$ denote the number of clauses of $\Phi$ satisfied by the assignment $\boldsymbol{a}$, i.e., the number of clauses $i$ for which $|S_{i}(\boldsymbol{a})|\geq 1$.

Theorem 3.2**.**

If there exists a computable $(p,k)$-isolating parallelepiped for some $p=p(n)\in[1,\infty)$ and integer $k\geq 2$, then there exists a polynomial-time reduction from any (weighted-)Max-$k$-SAT instance with $n$ variables to a $\mathrm{CVP}_{p}$ instance of rank $n$.

Proof.

For simplicity, we give a reduction from unweighted Max-$k$-SAT, and afterwards sketch how to modify our reduction to handle the weighted case as well. Namely, we give a reduction from any Max-$k$-SAT instance $(\Phi,W)$ to an instance $(B,\boldsymbol{t}^{*},r)$ of $\mathrm{CVP}_{p}$. Here, the formula $\Phi$ is on $n$ variables $x_{1},\ldots,x_{n}$ and $m$ clauses $C_{1},\ldots,C_{m}$. $(\Phi,W)$ is a ‘YES’ instance if there exists an assignment $\boldsymbol{a}$ such that $m^{+}(\boldsymbol{a})\geq W$.

By assumption, there exist computable $d^{*}=d^{*}(p,k)\in\mathbb{Z}^{+}$, $V=[\boldsymbol{v}_{1},\ldots,\boldsymbol{v}_{k}]\in\mathbb{R}^{d^{*}\times k}$, and $\boldsymbol{t}^{*}\in\mathbb{R}^{d^{*}}$ such that $\|\boldsymbol{t}^{*}\|_{p}=(1+\delta)^{1/p}$ for some $\delta>0$ and $\|V\boldsymbol{z}-\boldsymbol{t}^{*}\|_{p}=1$ for all $\boldsymbol{z}\in\{0,1\}^{k}\setminus\{\boldsymbol{0}_{k}\}$.

We define the output $\mathrm{CVP}_{p}$ instance as follows. Let $d:=md^{*}+n$. The basis $B\in\mathbb{R}^{d\times n}$ and target vector $\boldsymbol{t}\in\mathbb{R}^{d}$ in the output instance have the form

[TABLE]

with blocks $B_{i}\in\mathbb{R}^{d^{*}\times n}$ and $\boldsymbol{t}_{i}\in\mathbb{R}^{d^{*}}$ for $1\leq i\leq m$ and $\alpha:=m+(m-W)\delta$. Note that $\alpha$ is the maximum possible contribution of the clauses $C_{1},\ldots,C_{m}$ to $\|B\boldsymbol{y}-\boldsymbol{t}\|_{p}^{p}$ when $(\Phi,W)$ is a ‘YES’ instance. For every $1\leq i\leq m$ and $1\leq j\leq n$, set the $j$th column $(B_{i})_{j}$ of block $B_{i}$ (corresponding to the clause $C_{i}=\lor_{s=1}^{k}\ell_{i,s}$) as

[TABLE]

and set $\boldsymbol{t}_{i}:=\boldsymbol{t}^{*}-\sum_{s\in N_{i}}\boldsymbol{v}_{s}$. Set $r:=(\alpha(n+1))^{1/p}$.

Clearly, the reduction runs in polynomial time. We next analyze for which $\boldsymbol{y}\in\mathbb{Z}^{n}$ it holds that $\|B\boldsymbol{y}-\boldsymbol{t}\|_{p}\leq r$. Given $\boldsymbol{y}\notin\{0,1\}^{n}$,

[TABLE]

so we only need to analyze the case when $\boldsymbol{y}\in\{0,1\}^{n}$. Consider an assignment $\boldsymbol{y}\in\{0,1\}^{n}$ to the variables of $\Phi$. Then,

[TABLE]

By assumption, the last quantity is equal to $1$ if $|S_{i}(\boldsymbol{y})|\geq 1$, and is equal to $(1+\delta)^{1/p}$ otherwise. Because $|S_{i}(\boldsymbol{y})|\geq 1$ if and only if $C_{i}$ is satisfied, it follows that

[TABLE]

Therefore, $\|B\boldsymbol{y}-\boldsymbol{t}\|_{p}\leq r$ if and only if $m^{+}(\boldsymbol{y})\geq W$, and therefore there exists $\boldsymbol{y}$ such that $\|B\boldsymbol{y}-\boldsymbol{t}\|_{p}\leq r$ if and only if $(\Phi,W)$ is a ‘YES’ instance of Max-$k$-SAT, as needed.

To extend this to a reduction from weighted Max-$k$-SAT to $\mathrm{CVP}_{p}$, simply multiply each block $B_{i}$ and the corresponding target vector $\boldsymbol{t}_{i}$ by $w(C_{i})^{1/p}$, where $w(C_{i})$ denotes the weight of the clause $C_{i}$. Then, by adjusting $\alpha$ to depend on the weights $w(C_{i})$ we obtain the desire reduction. ∎

Because the rank $n$ of the output $\mathrm{CVP}_{p}$ instance matches the number of variables in the input SAT formula, we immediately get the following corollary.

Corollary 3.3**.**

For any efficiently computable $p=p(n)\in[1,\infty)$ if there exists a computable $(p,k)$-isolating parallelepiped for infinitely many $k\in\mathbb{Z}^{+}$, then, for every constant $\varepsilon>0$ there is no $2^{(1-\varepsilon)n}$-time algorithm for $\mathrm{CVP}_{p}$ assuming W-Max-SAT-SETH. In particular there is no $2^{(1-\varepsilon)n}$-time algorithm for $\mathrm{CVP}_{p}$ assuming SETH.

It is easy to construct a (degenerate) family of isolating parallelepipeds for $p=1$, and therefore we get hardness of $\mathrm{CVP}_{1}$ as a simple corollary. (See Figure 1.)

Corollary 3.4**.**

For every constant $\varepsilon>0$ there is no $2^{(1-\varepsilon)n}$-time algorithm for $\mathrm{CVP}_{1}$ assuming W-Max-SAT-SETH, and in particular there is no $2^{(1-\varepsilon)n}$-time algorithm for $\mathrm{CVP}_{1}$ assuming SETH.

Proof.

Let $k\in\mathbb{Z}^{+}$, let $V=[\boldsymbol{v}_{1},\ldots,\boldsymbol{v}_{k}]$ with $\boldsymbol{v}_{1}=\cdots=\boldsymbol{v}_{k}:=\frac{1}{k-1}(1,1)^{T}\in\mathbb{R}^{2}$, and let $\boldsymbol{t}^{*}:=\frac{1}{k-1}(k,1)^{T}\in\mathbb{R}^{2}$. Then, $\|V\boldsymbol{x}-\boldsymbol{t}^{*}\|_{1}=1$ for every $\boldsymbol{x}\in\{0,1\}^{k}\setminus\{\boldsymbol{0}_{k}\}$, and $\|\boldsymbol{t}^{*}\|_{1}=(k+1)/(k-1)>1$. The result follows by Corollary 3.3. ∎

4 Finding isolating parallelepipeds

We now show how to find a $(p,k)$-isolating parallelepiped given by $V\in\mathbb{R}^{d^{*}\times k}$ and $\boldsymbol{t}^{*}\in\mathbb{R}^{d^{*}}$ as in Definition 3.1. We will first show a general strategy for trying to find such an object for any $p\geq 1$ and integer $k\geq 2$. In Section 4.1, we will show how to successfully implement this strategy in the case when $p$ is an odd integer. In Section 4.2, we show that $(p,k)$-isolating parallelepipeds do not exist for even integers $p\leq k-1$. Finally, in Section 4.3 we show how to mostly get around this issue in order to find $(p,k)$-isolating parallelepipeds for “almost all” $p\geq 1$.

It will actually be convenient to find a slightly different object that “works with $\{\pm 1\}^{k}$ instead of $\{0,1\}^{k}$.” We observe below that this suffices.

Lemma 4.1**.**

There is an efficient algorithm that takes as input a matrix $V\in\mathbb{R}^{d^{*}\times k}$ and vector $\boldsymbol{t}^{*}\in\mathbb{R}^{d^{*}}$ such that $\|V\boldsymbol{y}-\boldsymbol{t}^{*}\|_{p}=1$ for any $\boldsymbol{y}\in\{\pm 1\}^{k}\setminus\{-\boldsymbol{1}_{k}\}$ and $\|-V\boldsymbol{1}_{k}-\boldsymbol{t}^{*}\|_{p}>1\;,$ and outputs a matrix $V^{\prime}\in\mathbb{R}^{d^{*}\times k}$ and vector $(\boldsymbol{t}^{*})^{\prime}\in\mathbb{R}^{d^{*}}$ that form a $(p,k)$-isolating parallelepiped.

Proof.

Define $V^{\prime}:=2V$ and $(\boldsymbol{t}^{*})^{\prime}=V\boldsymbol{1}_{k}+\boldsymbol{t}^{*}$. Now consider the affine transformation $f\colon\mathbb{R}^{k}\to\mathbb{R}^{k}$ defined by $f(\boldsymbol{x}):=(2\boldsymbol{x}-\boldsymbol{1}_{k})$, which maps $\{0,1\}^{k}$ to $\{\pm 1\}^{k}$ and $\boldsymbol{0}_{k}$ to $-\boldsymbol{1}_{k}$. Then, for $\boldsymbol{x}\in\{0,1\}^{k}$ and $\boldsymbol{y}=f(\boldsymbol{x})=2\boldsymbol{x}-\boldsymbol{1}_{k}\in\{\pm 1\}^{k}$, we have

[TABLE]

as needed. ∎

Intuitively, a “reasonable” matrix $V$ should act symmetrically on bit strings. I.e., if $\boldsymbol{y},\boldsymbol{y}^{\prime}\in\{\pm 1\}^{k}$ have the same number of positive entries, then $V\boldsymbol{y}$ should be a permutation of $V\boldsymbol{y}^{\prime}$. This implies that any row of $V$ must be accompanied by all possible permutations of this row. If we further require that each row in $V$ is $\alpha\cdot\boldsymbol{v}$ for some $\boldsymbol{v}\in\{\pm 1\}^{k}$ and $\alpha\in\mathbb{R}$, then we arrive at a very general construction that is still possible to analyze.

For weights $\alpha_{0},\ldots,\alpha_{k}\geq 0$, we define $V:=V(\alpha_{0},\ldots,\alpha_{k})\in\mathbb{R}^{2^{k}\times k}$ as follows. The rows of $V$ are indexed by the strings $\{\pm 1\}^{k}$, and row $\boldsymbol{v}$ is $\alpha_{k-|\boldsymbol{v}|}^{1/p}\boldsymbol{v}^{T}$, where

[TABLE]

is the number of positive entries in $\boldsymbol{v}$. For a shift $t^{*}\in\mathbb{R}$, we set $\boldsymbol{t}^{*}:=\boldsymbol{t}^{*}(\alpha_{0},\ldots,\alpha_{k},t^{*})\in\mathbb{R}^{2^{k}}$ such that the coordinate of $\boldsymbol{t}^{*}$ corresponding to $\boldsymbol{v}$ is $\alpha_{k-|\boldsymbol{v}|}^{1/p}t^{*}$. (Figure 2 is an example of this construction. In particular, it shows $V(\alpha_{0},\alpha_{1},\alpha_{2},\alpha_{3})$ with $\alpha_{0}=12$, $\alpha_{1}=\alpha_{2}=1$ and $\alpha_{3}=0$ and $\boldsymbol{t}^{*}(\alpha_{0},\alpha_{1},\alpha_{2},\alpha_{3},t^{*})$ with $t^{*}=2$, where we have omitted the last row, whose weight is zero.)

In what follows, we will use the binomial coefficient $\binom{i}{j}$ extensively, and we adopt the convention that $\binom{i}{j}=0$ if $j>i$ or $j<0$ or $j\notin\mathbb{Z}$.

Lemma 4.2**.**

For any $\boldsymbol{y}\in\{\pm 1\}^{k}$, weights $\alpha_{0},\ldots,\alpha_{k}\geq 0$, and shift $t^{*}\in\mathbb{R}$,

[TABLE]

where $V:=V(\alpha_{0},\ldots,\alpha_{k})\in\mathbb{R}^{2^{k}\times k}$ and $\boldsymbol{t}^{*}:=\boldsymbol{t}^{*}(\alpha_{0},\ldots,\alpha_{k},t^{*})$ as above.

In other words, $\|V\boldsymbol{y}-\boldsymbol{t}^{*}\|_{p}^{p}$ depends only on $|\boldsymbol{y}|$, and if $\boldsymbol{w}\in(\mathbb{R}^{\geq 0})^{k+1}$ is the vector such that $w_{j}=\|V\boldsymbol{y}^{\prime}-\boldsymbol{t}^{*}\|_{p}^{p}$ for all $\boldsymbol{y}^{\prime}\in\{\pm 1\}$ with $|\boldsymbol{y}^{\prime}|=j$, then

[TABLE]

where $M_{k}(p,t^{*})\in\mathbb{R}^{(k+1)\times(k+1)}$ is given by

[TABLE]

Proof.

We have

[TABLE]

Notice that $\langle\boldsymbol{v},\boldsymbol{y}\rangle$ depends only on how many of the $j$ negative entries of $\boldsymbol{v}$ align with the positive entries of $\boldsymbol{y}$. In particular,

[TABLE]

as needed. ∎

Lemma 4.3**.**

For any $t^{*}\in\mathbb{R}$, the matrix $M_{k}(p,t^{*})$ defined in Eq. (10) is stochastic. I.e., $M_{k}(p,t^{*})\boldsymbol{1}_{k+1}=\lambda(t^{*})\boldsymbol{1}_{k+1}$ for some $\lambda(t^{*})\in\mathbb{R}$. Furthermore, $\lambda(t^{*})>0$.

Proof.

We rearrange the sum corresponding to the $i$th entry of $M_{k}(p,t^{*})\boldsymbol{1}_{k+1}$, setting $r:=(i+j)/2-\ell$ to obtain

[TABLE]

Finally, we recall Vandermonde’s identity, which says that

[TABLE]

Therefore, the summation does not depend on $i$ (and is clearly positive), as needed. ∎

Lemma 4.3 tells us that for any $t^{*}\in\mathbb{R}$, $M_{k}(p,t^{*})(\boldsymbol{1}_{k+1})/\lambda=\boldsymbol{1}_{k+1}$ for some $\lambda>0$. We wish to show that, for some $t^{*}\in\mathbb{R}$, we can find $\alpha_{0},\ldots,\alpha_{k}\geq 0$ such that $M_{k}(p,t^{*})(\alpha_{0},\alpha_{1},\ldots,\alpha_{k})^{T}=\boldsymbol{1}_{k+1}+\varepsilon\boldsymbol{e}_{0}$ for some $\varepsilon>0$, where $\boldsymbol{e}_{0}:=(1,0,\ldots,0)^{T}$. In order to do this, it suffices to show that $M_{k}(p,t^{*})$ is invertible. Then, we can take

[TABLE]

If $\varepsilon:=(\lambda\cdot\|M_{k}(p,t^{*})^{-1}\boldsymbol{e}_{0}\|_{\infty})^{-1}>0$, then the $\alpha_{i}$ must be non-negative. We make this formal in the next proposition.

Proposition 4.4**.**

There is an efficient algorithm that takes as input any $p\geq 1$, an integer $k\geq 2$, and $t^{*}\in\mathbb{R}$ such that $\det(M_{k}(p,t^{*}))\neq 0$, where $M_{k}(p,t^{*})$ is defined as in Eq. (10) and outputs $V\in\mathbb{R}^{2^{k}\times k}$ and $\boldsymbol{t}^{*}\in\mathbb{R}^{2^{k}}$ that define a $(p,k)$-isolating parallelepiped.

Proof.

By Lemma 4.1, it suffices to construct a matrix that works for $\boldsymbol{y}\in\{\pm 1\}^{k}$. The algorithm behaves as follows on input $k\geq 2$ and $p\geq 1$ and $t^{*}\in\mathbb{R}$. By Lemma 4.3, $M_{k}(p,t^{*})\boldsymbol{1}_{k+1}=\lambda\boldsymbol{1}_{k+1}$ for some $\lambda>0$. Since we are promised that $\det(M_{k}(p,t^{*}))\neq 0$, we see that $M_{k}(p,t^{*})$ is invertible. The algorithm therefore sets

[TABLE]

where $\varepsilon:=(\lambda\cdot\|M_{k}(p,t^{*})^{-1}\boldsymbol{e}_{0}\|_{\infty})^{-1}>0$ is chosen to be small enough such that the $\alpha_{i}$ are all non-negative. Finally, it outputs $V:=V(\alpha_{0},\ldots,\alpha_{k})$ and $\boldsymbol{t}^{*}:=\boldsymbol{t}^{*}(\alpha_{0},\ldots,\alpha_{k},t^{*})$ as defined above.

To prove correctness, we note that $V$ and $\boldsymbol{t}^{*}$ have the desired property. Indeed, it follows from the definition of $M_{k}(p,t^{*})$ in Lemma 4.2 that $\|V\boldsymbol{y}-\boldsymbol{t}^{*}\|_{p}^{p}$ is the $j$th coordinate of $\boldsymbol{w}:=M_{k}(p,t^{*})(\alpha_{0},\ldots,\alpha_{k})^{T}$, where $j:=|\boldsymbol{y}|$. But, by Eq. (11), we see that the $j$th coordinate of $\boldsymbol{w}$ is $1+\varepsilon$ if $j=0$ and is $1$ otherwise, as needed. ∎

4.1 Finishing the proof for odd integer $p$

We now handle the case when $p\geq 1$ is an odd integer. Notice that, if $p\geq 1$ is an integer, then $\det(M_{k}(p,t^{*}))$ is some piecewise combination of polynomials of degree at most $(k+1)p$ in $t^{*}$. In particular, it is a polynomial in $t^{*}$ if we restrict our attention to the interval $t^{*}\in[-k,-k+2]$. We wish to argue that this is not the zero polynomial when $p$ is odd. To prove this, it suffices to show that the coefficient of $(t^{*})^{(k+1)p}$ is non-zero, which we do below by studying a matrix whose determinant is this coefficient (when $p$ is odd).

We first show an easy claim concerning matrices that can be written as sums of the identity plus a certain kind of rank-one matrix.

Claim 4.5**.**

For any matrix $A\in\mathbb{R}^{d\times d}$ with constant columns given by $A_{i,j}=a_{j}$ for some $a_{0},\ldots,a_{d-1}\in\mathbb{R}$ and any $\lambda\in\mathbb{R}$,

[TABLE]

Proof.

Notice that $A$ is a rank-one stochastic matrix with one non-zero eigenvalue given by $\sum a_{j}$. Therefore, the characteristic polynomial of $A$ is $\det(A-\lambda I_{d})=(-\lambda)^{d-1}(\sum a_{j}-\lambda)$, as needed. ∎

Lemma 4.6**.**

For an integer $k\geq 1$ and an odd integer $p\geq 1$, the function $t^{*}\mapsto\det(M_{k}(p,t^{*}))$, where $M_{k}(p,t^{*})$ is defined as in Eq. (10), is a polynomial of degree at most $(k+1)p$ when restricted to the interval $t^{*}\in[-k,-k+2]$. Furthermore, the coefficient of $(t^{*})^{(k+1)p}$ of this polynomial is exactly $2^{k}(2-2^{k})$.

In particular, $t^{*}\mapsto\det(M_{k}(p,t^{*}))$ is a non-zero polynomial of degree $(k+1)p$ on the interval $t^{*}\in[-k,-k+2]$ for $k\geq 2$.

Proof.

For any $t^{*}\in[-k,-k+2]$, the matrix $M_{k}(p,t^{*})$ is given by

[TABLE]

where $\delta_{r}=-1$ if $r=0$ and $1$ otherwise. (Here, we have used the fact that $\binom{i}{\ell}\binom{k-i}{j-\ell}$ is only non-zero when $\ell\leq\min(i,j)$. Therefore, $2i+2j\geq 4\ell$, so that $2i+2j-k-4\ell-t^{*}\geq 2i+2j-4\ell-2\geq 0$ unless $2i-2j-4\ell=0$.)

The coefficient of $(t^{*})^{(k+1)p}$ in the polynomial $t^{*}\mapsto\det(M_{k}(p,t^{*}))$ is therefore given by $\det(M^{\prime})$, where $M^{\prime}$ is defined as

[TABLE]

where we have again applied Vandermonde’s identity. Notice that the first term is non-zero if and only if $i=j$, in which case it is equal to $2$. In other words, $M^{\prime}=A+2I_{k+1}$, where $A_{i,j}:=-\binom{k}{j}$. The result then follows from Claim 4.5. ∎

Corollary 4.7**.**

There is an efficient algorithm that takes as input an integer $k\geq 2$ and odd integer $p\geq 1$ and outputs $t^{*}\in\mathbb{Q}$ such that $\det(M_{k}(p,t^{*}))\neq 0$, with $M_{k}(p,t^{*})$ defined as in Eq. (10).

Proof.

The algorithm works as follows. It chooses $(k+1)p+1$ distinct points $t_{0},\ldots,t_{(k+1)p}\in[-k,-k+2]$ arbitrarily. (E.g., it chooses $t_{i}=-k+2i/((k+1)p)$.) For each $t_{i}$, it computes $\det(M_{k}(p,t_{i}))$. It outputs the first $t_{i}$ such that the determinant is non-zero.

We claim that $\det(M_{k}(p,t_{i}))\neq 0$ for at least one index $i$. Indeed, by Lemma 4.6, $t^{*}\mapsto\det(M_{k}(p,t^{*}))$ is a non-zero polynomial of degree $(k+1)p$. The result then follows from the fact that such a polynomial can have at most $(k+1)p$ roots. ∎

Theorem 1.1 for finite $p$ now follows immediately from Theorems 3.2 together with Proposition 4.4, and Corollary 4.7.

4.2 Limitations of the approach

In the previous section, we showed that for every odd $p\geq 1$ and every integer $k\geq 2$, there exists a $(p,k)$-isolating parallelepiped. This allowed us to conclude that $\mathrm{CVP}_{p}$ is SETH-hard for odd values of $p$. Now, we show that this approach necessarily fails for even $p\geq 2$. Namely, we show that for every even $p$, there is no $(p,k)$-isolating parallelepiped for any $k>p$.777When $k\leq p$, it is possible to construct $(p,k)$-isolating parallelepiped for even $p$. See, e.g., Figure 1. For simplicity, we show this for $p=2$, but a straightforward generalization works for all even $p$.

Lemma 4.8**.**

For any integer $k\geq 3$ and vectors $\boldsymbol{v}_{1},\ldots,\boldsymbol{v}_{k},\boldsymbol{t}^{*}\in\mathbb{R}^{d^{*}}$, we have

[TABLE]

Proof.

We have

[TABLE]

where the penultimate equality uses the fact that

[TABLE]

for $n\geq 1$. ∎

Corollary 4.9**.**

There is no $(2,k)$-isolating parallelepiped for any integer $k\geq 3$.

Proof.

Assume $V=[\boldsymbol{v}_{1},\ldots,\boldsymbol{v}_{k}]\in\mathbb{R}^{d^{*}\times k}$ and $\boldsymbol{t}^{*}\in\mathbb{R}^{d}$ form a $(2,k)$-isolating parallelepiped. For any $S\neq\emptyset$, $\|\boldsymbol{t}^{*}-\sum_{i\in S}\boldsymbol{v}_{i}\|_{2}^{2}=1$ by the definition of an isolating parallelepiped. Thus, applying Lemma 4.8, we have

[TABLE]

which contradicts the assumption that $V$ and $\boldsymbol{t}^{*}$ form an isolating parallelepiped. ∎

4.3 Extending our result to almost all $p$

We now wish to extend Theorem 1.1 to arbitrary $p\geq 1$. Unfortunately, we know that we cannot do this for all $p$, since we showed in Section 4.2 that no such construction is possible when $p$ is an even integer. However, we show a construction that works for “almost all values of $p$.” In particular, for any fixed $k$, the construction works for all but finitely many choices of $p$. We also observe that this implies that, for every fixed $p_{0},k$, there is an $\varepsilon>0$ such that the construction works for every $p\in(p_{0}-\varepsilon)$ or $p\in(p_{0}+\varepsilon)$. In particular, for any non-zero $\delta=\delta(n)=o(1)$, the construction works for $p=p_{0}+\delta(n)$ for sufficiently large integers $n$.

In Section 4.1, we observed that the function $t^{*}\mapsto\det(M_{k}(p,t^{*}))$ is a piecewise polynomial when $p$ is an integer. This is what allowed us to analyze this case relatively easily (in both Section 4.1 and in Section 4.2). For non-integer $p$, the function $t^{*}\mapsto\det(M_{k}(p,t^{*}))$ is much less nice. So, instead of holding $p$ fixed and varying $t^{*}$, we will be interested in studying the function $f_{k,t^{*}}(p):=\det(M_{k}(p,t^{*}))$ for fixed $t^{*}$ and $k$. We first observe that this function has a fairly nice structure.

Lemma 4.10**.**

For any $t^{*}\in\mathbb{R}$, integer $k\geq 1$, and $p\geq 1$, let

[TABLE]

where $M_{k}(p,t^{*})$ is as defined in Eq. (10). Then, for fixed $k,t^{*}$, $f_{k,t^{*}}(p)$ is a Dirichlet polynomial. I.e., there are some real numbers $b_{0},\ldots,b_{r},c_{0},\ldots,c_{r}\in\mathbb{R}$ (depending on $t^{*}$ and $k$) such that

[TABLE]

for some finite $r$.

Proof.

To see that $f_{k,t^{*}}(p)$ is a Dirichlet polynomial for fixed $t^{*},k$, it suffices to note that (1) each entry of $M_{k}(p,t^{*})$ is a Dirichlet polynomial; (2) the determinant of a matrix can be written as a polynomial in the coordinates; and (3) a polynomial of Dirichlet polynomials is itself a Dirichlet polynomial. ∎

Corollary 4.11**.**

There is an efficient algorithm that takes as input $k\geq 2$ and any $p\geq 1$ and either fails or outputs $V\in\mathbb{R}^{2^{k}\times k}$ and $\boldsymbol{t}^{*}\in\mathbb{R}^{2^{k}}$ that define a $(p,k)$-isolating parallelepiped. Furthermore, for any fixed $k\geq 2$, the algorithm only fails for finitely many choices of $p\geq 1$.

Proof.

By Corollary 4.7, for any $k\geq 2$, we can find a $t^{*}\in\mathbb{Q}$ such that, say, $f_{k,t^{*}}(1)\neq 0$, where $f_{k,t^{*}}(p)$ is defined as in Eq. (12). Clearly, $f_{k,t^{*}}(p)$ is non-zero as a function of $p$ for these values of $t^{*},k$. Furthermore, by Lemma 4.10, $f_{k,t^{*}}(p)$ is a Dirichlet polynomial. The result follows by the fact that any non-zero Dirichlet polynomial has finitely many roots (see, e.g., Theorem 3.1 in [Jam06]). ∎

Theorem 4.12**.**

There is an efficient algorithm that takes as input an integer $k\geq 2$ and any $p\geq 1$ and either fails or outputs $V\in\mathbb{R}^{2^{k}\times k}$ and $\boldsymbol{t}^{*}\in\mathbb{R}^{2^{k}}$ that define a $(p,k)$-isolating parallelepiped. Furthermore, for any fixed $k\geq 2$, the algorithm only fails on finitely many values of $p\geq 1$.888As we observed in Section 4.2, the set of failure points necessarily includes all even integers $p\leq k-1$.

Proof.

The result follows immediately from Proposition 4.4 and Corollary 4.11. ∎

Item 2 of Theorem 1.2 now follows immediately from Theorem 3.2 and Theorem 4.12.

We now provide what amounts to a different interpretation of the above.

Lemma 4.13**.**

There is an efficient algorithm that takes as input any $p_{0}\geq 1$ and an integer $k\geq 2$ and outputs a value $t^{*}$ such that $f_{k,t^{*}}(p_{0}+\delta)$ and $f_{k,t^{*}}(p_{0}-\delta)$ are non-zero for sufficiently small $\delta>0$, where $f_{k,t^{*}}(p)$ is as defined in Eq. (12).

Proof.

The algorithm simply calls the procedure from Corollary 4.7 with, say, $p=1$ and outputs the result. I.e., it suffices to choose any $t^{*}$ such that $f_{k,t^{*}}(1)\neq 0$. As in the proof of Corollary 4.11, we observe that the function $f_{k,t^{*}}(p)$ is zero on a finite set of values $X$. The result then follows by taking $\delta:=\min_{x\in X\setminus\{p_{0}\}}|x-p_{0}|/2$ if $X\setminus\{p_{0}\}$ is non-empty, and $\delta:=c$ for any $c>0$ otherwise.

∎

Finally, we derive the main theorem of this section.

Theorem 4.14**.**

For any efficiently computable $\delta(n)\neq 0$ that converges to zero as $n\to\infty$ and $p_{0}\geq 1$, there is an efficient algorithm that takes as input an integer $k\geq 2$ and sufficiently large positive integer $n$ and outputs a matrix $V\in\mathbb{R}^{2^{k}\times k}$ and vector $\boldsymbol{t}^{*}\in\mathbb{R}^{2^{k}}$ that define a $(p_{0}+\delta(n),k)$-isolating parallelepiped.

Proof.

The result follows immediately from Proposition 4.4 and Lemma 4.13. In particular, the algorithm runs the procedure from Lemma 4.13, receiving as output some $t^{*}\in\mathbb{R}$ such that $f_{k,t^{*}}(p_{0}\pm\varepsilon)$ is non-zero for sufficiently small $\varepsilon>0$. In particular, if $n$ is sufficiently large, then $f_{k,t^{*}}(p_{0}+\delta(n))$ will be non-zero. The result then follows from Proposition 4.4. ∎

Item 3 of Theorem 1.2 now follows from Theorem 3.2 and Theorem 4.14.

5 Gap-ETH-based Hardness of Approximation

In this section we prove Gap-ETH-based hardness of approximation for $\mathrm{CVP}_{p}$ for every $p\in[1,\infty)$. We also show a stronger hardness of approximation result for $\mathrm{CVP}_{1}$. (In Section 6.3, we additionally show a stronger result for $p=\infty$.) The main idea behind our proof is to use the reduction from Max-$2$-SAT to $\mathrm{CVP}$ described in Section 1.5 without the “identity matrix gadget” that we used to force any closest vector to be a 0-1 combination of basis vectors. We will show that this is permissible because the resulting CVP instance always has a 0-1 combination of basis vectors that is at least as close to the target as any other lattice vector.

Theorem 5.1**.**

For every $0\leq\delta<\varepsilon\leq 1$ and every $p\in[1,\infty)$, there is a polynomial-time reduction from any $(\delta,\varepsilon)$-Gap-$2$-SAT instance with $n$ variables to an instance of $\gamma$-$\mathrm{CVP}_{p}$ of rank $n$, where

[TABLE]

In particular, when $\varepsilon=1$, the corresponding approximation factor is $(\delta+(1-\delta)\cdot 3^{p})^{1/p}$.

Proof.

Given a $(\delta,\varepsilon)$-Gap-$2$-SAT instance with $n$ variables $x_{1},\ldots,x_{n}$ and $m$ clauses $C_{1},\ldots,C_{m}$, we construct a $\mathrm{CVP}_{p}$ instance $(B,\boldsymbol{t},r)$ for some fixed $p\in[1,\infty)$ as follows. Let $B\in\mathbb{Z}^{m\times n}$ be the basis defined by

[TABLE]

Let $\boldsymbol{t}\in\mathbb{R}^{m}$ be the target vector defined by $t_{i}:=3-2|N_{i}|$, and let $r:=(\varepsilon m+(1-\varepsilon)m\cdot 3^{p})^{1/p}$.

We claim that there is always a 0-1 combination of basis vectors which is a closest vector to $\boldsymbol{t}$. Assuming this claim, we analyze $\|B\boldsymbol{y}-\boldsymbol{t}\|_{p}$ only for $\boldsymbol{y}\in\{0,1\}^{n}$ without loss of generality, while deferring the proof of the claim until the end.

Let $\boldsymbol{y}\in\{0,1\}^{n}$ be an assignment to the variables of $\Phi$. For every $1\leq i\leq m$,

[TABLE]

The last expression is equal to $1$ if $\boldsymbol{y}$ satisfies $C_{i}$ (i.e. if $|S_{i}(\boldsymbol{y})|\geq 1$) and $3$ if not. We therefore have

[TABLE]

Therefore, if $\textrm{val}(\Phi)\geq\varepsilon$ then there exists $\boldsymbol{y}\in\{0,1\}^{n}$ such that $\|B\boldsymbol{y}-\boldsymbol{t}\|_{p}^{p}\leq\varepsilon m+(1-\varepsilon)m\cdot 3^{p}=r^{p}$, and if $\textrm{val}(\Phi)<\delta$, then for every $\boldsymbol{y}\in\{0,1\}^{n}$, it holds that $\|B\boldsymbol{y}-\boldsymbol{t}\|_{p}^{p}>\delta m+(1-\delta)m\cdot 3^{p}=\gamma^{p}r^{p}$. It follows that the reduction achieves the claimed approximation factor of $\gamma$.

It remains to prove the claim that there is always a 0-1 combination of basis vectors which is a closest vector to $\boldsymbol{t}$. We show this by demonstrating that for every $\boldsymbol{y}\in\mathbb{Z}^{n}$ there exists $\chi(\boldsymbol{y})\in\{0,1\}^{n}$ such that $\|B\cdot\chi(\boldsymbol{y})-\boldsymbol{t}\|_{p}\leq\|B\boldsymbol{y}-\boldsymbol{t}\|_{p}$. Given $\boldsymbol{y}\in\mathbb{Z}^{n}$, let $\chi(\boldsymbol{y})\in\{0,1\}^{n}$ denote the vector whose $i$th coordinate is set to 1 if $y_{i}\geq 1$ and is set to 0 otherwise.

Fix $\boldsymbol{y}\in\mathbb{Z}^{n}$ and $1\leq i\leq n$, and refer to Equation (14). If $\chi(\boldsymbol{y})$ satisfies $C_{i}$ then $|(B\boldsymbol{y}-\boldsymbol{t})_{i}|\geq|(B\cdot\chi(\boldsymbol{y})-\boldsymbol{t})_{i}|=1$. On the other hand, if $\chi(\boldsymbol{y})$ does not satisify $C_{i}$, then $y_{\textrm{ind}(\ell_{i,s})}\leq 0$ for all $s\in P_{i}$ and $1-y_{\textrm{ind}(\ell_{i,s})}\leq 0$ for all $s\in N_{i}$ so that $|(B\boldsymbol{y}-\boldsymbol{t})_{i}|\geq 3$ and therefore $|(B\boldsymbol{y}-\boldsymbol{t})_{i}|\geq|(B\cdot\chi(\boldsymbol{y})-\boldsymbol{t})_{i}|=3$. Combining these cases it follows that for all $\boldsymbol{y}\in\mathbb{Z}^{n}$ and $1\leq i\leq n$, $|(B\cdot\chi(\boldsymbol{y})-\boldsymbol{t})_{i}|\leq|(B\boldsymbol{y}-\boldsymbol{t})_{i}|$, and therefore $\|B\cdot\chi(\boldsymbol{y})-\boldsymbol{t}\|_{p}\leq\|B\boldsymbol{y}-\boldsymbol{t}\|_{p}$, proving the claim. ∎

Corollary 5.2**.**

For every $p\in[1,\infty)$ and $0<\delta<\delta^{\prime}<1$, there is no $2^{o(n)}$-time algorithm for $\gamma$-$\mathrm{CVP}_{p}$ with

[TABLE]

unless randomized Gap-ETH (with respect to $(\delta,1)$-Gap-$3$-SAT) fails.

Proof.

Concatenate the reductions described in Proposition 2.11, Proposition 2.12, and Theorem 5.1.999Note that the Gap-2-SAT instance output by Proposition 2.12 contains $1$-clauses as well as $2$-clauses. We therefore stress that the reduction described in Theorem 5.1 works for this case as well. ∎

5.1 A stronger result for $\ell_{1}$

In Theorem 5.1 we showed that there was no need to use the identity matrix gadget in our reduction from Gap-$2$-SAT to $\mathrm{CVP}$. An interesting question is whether the identity matrix gadget is also unnecessary in our reduction in Theorem 3.2 from Gap-$k$-SAT to $\mathrm{CVP}_{p}$ using $(p,k)$-isolating parallelepipeds. If so, then we get stronger “Gap-SETH-hardness” for $\mathrm{CVP}_{p}$ for all $p$ for which there exist $(p,k)$-isolating parallelepipeds for infinitely many $k\in\mathbb{Z}^{+}$.

Although we do not know how to show this in general, we are able to get stronger hardness of approximation for $\mathrm{CVP}_{1}$ in this way by using the family of $(1,k)$-isolating parallelepipeds described in Corollary 3.4. The analysis is similar to the analysis in Theorem 5.1. In particular, a 0-1 combination of basis vectors will always be at least as close to the target vector as any other lattice vector will.

Theorem 5.3**.**

For every $0\leq\delta<\varepsilon\leq 1$, there is a polynomial-time reduction from any $(\delta,\varepsilon)$-Gap-$k$-SAT instance with $n$ variables to an instance of $\gamma$-$\mathrm{CVP}_{1}$ of rank $n$, where

[TABLE]

Proof.

Given a $(\delta,\varepsilon)$-Gap-$k$-SAT instance with $n$ variables $x_{1},\ldots,x_{n}$ and $m$ clauses $C_{1},\ldots,C_{m}$, we construct a $\mathrm{CVP}_{1}$ instance $(B,\boldsymbol{t},r)$ as follows. The basis $B\in\mathbb{Z}^{(2m)\times n}$ and target vector $\boldsymbol{t}\in\mathbb{Z}^{2m}$ in the output instance have the form

[TABLE]

with blocks $B_{i}\in\mathbb{Z}^{2\times n}$ and $\boldsymbol{t}_{i}\in\mathbb{Z}^{2}$ for $1\leq i\leq m$. For every $1\leq i\leq m$ and $1\leq j\leq n$, set the $j$th column $(B_{i})_{j}$ of block $B_{i}$ (corresponding to the clause $C_{i}=\lor_{s=1}^{k}\ell_{i,s}$) as

[TABLE]

and set $\boldsymbol{t}_{i}:=(k,1)^{T}-|N_{i}|\cdot(1,1)^{T}$. Set $r:=\varepsilon m(k-1)+(1-\varepsilon)\cdot m(k+1)$.

We claim that there is always a 0-1 combination of basis vectors that is closest to $\boldsymbol{t}$. Assuming the claim, we analyze $\|B\boldsymbol{y}-\boldsymbol{t}\|$ only for $\boldsymbol{y}\in\{0,1\}^{n}$ without loss of generality, while deferring the proof of the claim until the end.

Let $\boldsymbol{y}\in\{0,1\}^{n}$ be an assignment to the variables of $\Phi$. For every $1\leq i\leq m$,

[TABLE]

The last expression is equal to $k-1$ if $\boldsymbol{y}$ satisfies $C_{i}$ (i.e. if $|S_{i}(\boldsymbol{y})|\geq 1$) and $k+1$ if not. We therefore have

[TABLE]

Therefore, if $\textrm{val}(\Phi)\geq\varepsilon$ then there exists $\boldsymbol{y}\in\{0,1\}^{n}$ such that $\|B\boldsymbol{y}-\boldsymbol{t}\|_{1}\leq\varepsilon m(k-1)+(1-\varepsilon)\cdot m(k+1)=r$, and if $\textrm{val}(\Phi)<\delta$ then for every $\boldsymbol{y}\in\{0,1\}^{n}$, it holds that $\|B\boldsymbol{y}-\boldsymbol{t}\|_{1}>\delta m(k-1)+(1-\delta)m(k+1)=\gamma r$. It follows that the reduction achieves the claimed approximation factor of $\gamma$.

It remains to prove the claim that there is always a 0-1 combination of basis vectors that is a closest vector to $\boldsymbol{t}$. We show this by demonstrating that for every $\boldsymbol{y}\in\mathbb{Z}^{n}$ there exists $\chi(\boldsymbol{y})\in\{0,1\}^{n}$ such that $\|B\chi(\boldsymbol{y})-\boldsymbol{t}\|_{1}\leq\|B\boldsymbol{y}-\boldsymbol{t}\|_{1}$. Given $\boldsymbol{y}\in\mathbb{Z}^{n}$, let $\chi(\boldsymbol{y})\in\{0,1\}^{n}$ denote the vector whose coordinate is set to $1$ if $y_{i}\geq 1$ and is set to [math] otherwise.

Note that $\|c(1,1)^{T}-(k,1)^{T}\|_{1}=k-1$ for all $c\in[k]$, and $\|c(1,1)^{T}-(k,1)^{T}\|_{1}\geq k+1$ for all $c\in\mathbb{Z}\setminus[k]$. Fix $\boldsymbol{y}\in\mathbb{Z}^{n}$ and $1\leq i\leq n$, and refer to Equation (15). If $\chi(\boldsymbol{y})$ satisfies $C_{i}$ then $\|B_{i}\cdot\boldsymbol{y}-\boldsymbol{t}_{i}\|_{1}\geq\|B_{i}\cdot\chi(\boldsymbol{y})-\boldsymbol{t}_{i}\|_{1}=k-1$. On the other hand, if $\chi(\boldsymbol{y})$ does not satisfy $C_{i}$, then $y_{\textrm{ind}(\ell_{i,s})}\leq 0$ for all $s\in P_{i}$ and $1-y_{\textrm{ind}(\ell_{i,s})}\leq 0$ for all $s\in N_{i}$ so that $\|B_{i}\cdot\boldsymbol{y}-\boldsymbol{t}_{i}\|_{1}\geq\|B_{i}\cdot\chi(\boldsymbol{y})-\boldsymbol{t}_{i}\|_{1}=k+1$. Combining these cases it follows that for all $\boldsymbol{y}\in\mathbb{Z}^{n}$ and $1\leq i\leq n$, $\|B_{i}\cdot\chi(\boldsymbol{y})-\boldsymbol{t}_{i}\|_{1}\leq\|B_{i}\cdot\boldsymbol{y}-\boldsymbol{t}_{i}\|_{1}$, and therefore $\|B\cdot\chi(\boldsymbol{y})-\boldsymbol{t}\|_{1}\leq\|B\boldsymbol{y}-\boldsymbol{t}\|_{1}$, proving the claim.

∎

6 Additional hardness results

In this section we prove a number of additional results about the quantitative hardness of $\mathrm{CVP}$ and related problems. In Section 6.1, we give a reduction from Max-$2$-SAT to $\mathrm{CVPP}_{p}$ for all $p\in[1,\infty)$, proving Theorem 1.4. In Section 6.2, we give a reduction from Max-$k$-SAT (and in particular Max-$2$-SAT) to $\mathrm{CVP}_{p}$ for all $p\in[1,\infty)$, proving Theorem 1.5. Finally, in Section 6.3 we give a reduction from $k$-SAT to $\mathrm{CVP}_{\infty}$ and $\mathrm{SVP}_{\infty}$, proving the special case of Theorem 1.1 for $p=\infty$.

Our reductions all use the same high-level idea as the reduction given in Theorem 3.2, but each uses new ideas as well. Throughout this section we adopt the notation from Section 3.

6.1 Hardness of $\mathrm{CVPP}_{p}$

In this section, we prove ETH-hardness of $\mathrm{CVPP}$. To do this, for every $n$, we construct a single lattice $\mathcal{L}_{n}\subset\mathbb{R}^{d}$ of rank $O(n^{2})$, such that for every $n$-variable instance of Max-$2$-SAT, there exists an efficiently computable $\boldsymbol{t}\in\mathbb{R}^{d}$ that is close to the lattice if and only if $\Phi$ is satisfiable. Clearly, any efficient algorithm for $\mathrm{CVPP}$ on this lattice would imply a similarly efficient algorithm for Max-$2$-SAT (and also $3$-SAT, as described below).

Our basis $B_{n}$ for $\mathcal{L}_{n}$ will encode all possible $O(n^{2})$ clauses of a Max-$2$-SAT instance on $n$ variables, together with a gadget that will allow us to “switch on or off” each clause by only changing the coordinates of the target vector $\boldsymbol{t}$. (This gadget costs us a quadratic blow-up in the lattice rank.) Then, given an instance $(\Phi,W)$ of Max-$2$-SAT, we define the target vector $\boldsymbol{t}$ such that it “switches on” all clauses from $\Phi$ and “switches off” all the remaining clauses.

Lemma 6.1**.**

For every $p\in[1,\infty)$, there is a pair of polynomial-time algorithms $(P,Q)$ (in analogy to the definition of $\mathrm{CVPP}$) that behave as follows.

On input an integer $n\geq 1$, $P$ outputs a basis $B_{n}\in\mathbb{R}^{d\times N}$ of a rank $N$ lattice $\mathcal{L}_{n}\subset\mathbb{R}^{d}$, where $d=d(n)=O(n^{2})$ and $N=N(n)=O(n^{2})$. 2. 2.

On input a Max-$2$-SAT instance with $n$ variables, $Q$ outputs a target vector $\boldsymbol{t}\in\mathbb{R}^{d}$ and a distance bound $r\geq 0$ such that $\operatorname{dist}_{p}(\boldsymbol{t},\mathcal{L}_{n})\leq r$ if and only if the input is a ‘YES’ instance.

Proof.

Let $M=4\binom{n}{2}=O(n^{2})$ be the total possible number of $2$-clauses on $n$ variables, and let $C_{1},\ldots,C_{M}$ denote those clauses.

The algorithm $P$ constructs the basis $B_{n}\in\mathbb{R}^{d\times N}$, where $d:=n+2M,N:=n+M$, as

[TABLE]

with rows $(\boldsymbol{b}_{i}^{T},\boldsymbol{c}_{i}^{T})$ of $B$ satisfying $\boldsymbol{b}_{i}\in\mathbb{R}^{n}$ and $\boldsymbol{c}_{i}\in\mathbb{R}^{M}$ for $1\leq i\leq M$, and where $\alpha:=2^{p}M$. For every $1\leq i\leq M$ and $1\leq j\leq n$, set the $j$th coordinate of $\boldsymbol{b}_{i}$ (corresponding to the clause $C_{i}=\ell_{i,1}\lor\ell_{i,2}$) as

[TABLE]

For every $1\leq i\leq M$, set $\boldsymbol{c}_{i}^{T}:=(\boldsymbol{0}_{(i-1)}^{T},1,\boldsymbol{0}_{(M-i)}^{T})$, i.e., set $(\boldsymbol{c}_{1},\ldots,\boldsymbol{c}_{M})=I_{M}$.

Given an instance $(\Phi,W)$ of Max-$2$-SAT with $m$ clauses, the algorithm $Q$ outputs

[TABLE]

and $\boldsymbol{t}\in\mathbb{R}^{d}$ defined as

[TABLE]

where for $1\leq i\leq M$, $u_{i}=3/2-|N_{i}|$, and $v_{i}=0$ if the clause $C_{i}$ appears in the formula $\Phi$ and $v_{i}=\alpha^{1/p}$ otherwise.

Clearly both algorithms are efficient. We now analyze for which $\boldsymbol{y}\in\mathbb{Z}^{N}$ we have $\|B\boldsymbol{y}-\boldsymbol{t}\|_{p}\leq r$. Note that the vector $\boldsymbol{v}=(v_{1},\ldots,v_{M})^{T}$ has exactly $m$ coordinates equal to zero, and $M-m$ coordinates equal to $\alpha^{1/p}$. Given $\boldsymbol{y}\notin\{0,1\}^{N}$, we have

[TABLE]

Furthermore, if $\boldsymbol{y}\in\{0,1\}^{N}$ has a non-zero coordinate $y_{n+M+i}$ (for $1\leq i\leq M$) at a position corresponding to a $t_{n+M+i}=0$ in $\boldsymbol{t}$ (i.e., $C_{i}\in\Phi$), then again $\|B\boldsymbol{y}-\boldsymbol{t}\|_{p}^{p}\geq\alpha(n+M-m+1)>r^{p}$. So, we can restrict our attention to $\boldsymbol{y}\in\{0,1\}^{N}$ with $y_{n+M+i}=0$ whenever $C_{i}\in\Phi$.

Consider an assignment $\boldsymbol{a}\in\{0,1\}^{n}$ to the $n$ variables of $\Phi$. Take $(\boldsymbol{y}^{\prime})^{T}=(y^{\prime}_{1},\ldots y^{\prime}_{M})^{T}\in\{0,1\}^{M}$, and set $\boldsymbol{y}:=(\boldsymbol{a}^{T},(\boldsymbol{y}^{\prime})^{T})^{T}$. Then, for $1\leq i\leq M$,

[TABLE]

If $C_{i}\notin\Phi$, then there exists $y^{\prime}_{i}\in\{0,1\}$, such that $|\langle(\boldsymbol{b}_{i}^{T},\boldsymbol{c}_{i}^{T})^{T},\boldsymbol{y}\rangle-t_{i}|=1/2$. Moreover, the choice of $y^{\prime}_{i}$ does not affect $|\langle(\boldsymbol{b}_{i}^{T},\boldsymbol{c}_{i}^{T})^{T},\boldsymbol{y}\rangle-t_{i^{\prime}}|$ for $i^{\prime}\neq i$. If $C_{i}\in\Phi$ and $|S_{i}(\boldsymbol{a})|>0$ for $y^{\prime}_{i}=0$, then $|\langle(\boldsymbol{b}_{i}^{T},\boldsymbol{c}_{i}^{T})^{T},\boldsymbol{y}\rangle-t_{i}|=1/2$. On the other hand, if $C_{i}\in\Phi$ and $|S_{i}(\boldsymbol{a})|=0$, then $y^{\prime}_{i}=0$ implies $|\langle(\boldsymbol{b}_{i}^{T},\boldsymbol{c}_{i}^{T})^{T},\boldsymbol{y}\rangle-t_{i}|\geq 3/2$.

Because $|S_{i}(\boldsymbol{a})|\geq 1$ if and only if $C_{i}$ is satisfied, we see that the following holds if and only if the number of satisfied clauses $m^{+}(\boldsymbol{a})$ is at least $W$:

There exists a $\boldsymbol{y}^{\prime}$ such that, setting $\boldsymbol{y}:=(\boldsymbol{a},\boldsymbol{y}^{\prime})$, we have

[TABLE]

Therefore, there exists $\boldsymbol{y}$ with $\|B\boldsymbol{y}-\boldsymbol{t}\|_{p}\leq r$ if and only if $(\Phi,W)$ is a ‘YES’ instance of Max-$2$-SAT. ∎

Proof of Theorem 1.4.

The main statement follows from Lemma 6.1. The “in particular” part follows from Lemma 6.1 and the existence of a reduction from $3$-SAT with $n$ variables clauses to (many) Max-$2$-SAT instances with $O(n)$ variables. Indeed, such a reduction follows by applying the Sparsification Lemma (Proposition 2.9), and then reducing each sparse $3$-SAT instance to a Max-$2$-SAT instance with only a linear blow-up in the number of variables (see, e.g., the reduction in [GJS76, Theorem 1.1]). ∎

6.2 ETH- and Max-$2$-SAT-hardness for all $p\in[1,\infty)$

Theorem 6.2**.**

For every $p=p(n)\in[1,\infty)$ and $k\geq 2$ there is a polynomial-time reduction from any (Weighted-)Max-$k$-SAT instance with $n$ variables and $m$ clauses to a $\mathrm{CVP}_{p}$ instance of rank $n+(k-2)m$.

Proof.

For simplicity we give a reduction from unweighted Max-$k$-SAT. The modification sketched for reducing from Weighted Max-$k$-SAT in Theorem 3.2 works here as well. Namely, we give a reduction from a Max-$k$-SAT instance $(\Phi,W)$ to an instance $(B,\boldsymbol{t},r)$ of $\mathrm{CVP}_{p}$. Here the formula $\Phi$ is on $n$ variables $x_{1},\ldots,x_{n}$ and $m$ clauses $C_{1},\ldots,C_{m}$. $(\Phi,W)$ is a ‘YES’ instance if there exists an assignment $\boldsymbol{a}$ such that $m^{+}\geq W$. We assume without loss of generality that each variable appears at most once per clause. We define the output $\mathrm{CVP}_{p}$ instance as follows. Let $d:=n+(k-1)m$ and let $N:=n+(k-2)m$. The basis $B\in\mathbb{R}^{d\times N}$ in the output instance has the form

[TABLE]

with rows $(\boldsymbol{b}_{i}^{T},\boldsymbol{c}_{i}^{T})$ of $B$ satisfying $\boldsymbol{b}_{i}\in\mathbb{R}^{n}$ and $\boldsymbol{c}_{i}\in\mathbb{R}^{m(k-2)}$ for $1\leq i\leq m$, and where $\alpha:=W\cdot(\frac{1}{2})^{p}+(m-W)\cdot(\frac{3}{2})^{p}$. For every $1\leq i\leq m$ and $1\leq j\leq n$, set the $j$th coordinate of $\boldsymbol{b}_{i}$ (corresponding to the clause $C_{i}=\lor_{s=1}^{k}\ell_{i,s}$) as

[TABLE]

For every $1\leq i\leq m$, set $\boldsymbol{c}_{i}^{T}:=(\boldsymbol{0}_{(i-1)(k-2)}^{T},-\boldsymbol{1}_{k-2}^{T},\boldsymbol{0}_{(m-i)(k-2)}^{T})$. I.e., each $\boldsymbol{c}_{i}$ has a block of $-1$s of length $k-2$, and $\boldsymbol{c}_{i}$, $\boldsymbol{c}_{i^{\prime}}$ are coordinate-wise disjoint for $i\neq i^{\prime}$. For every $1\leq i\leq m$ set $t_{i}:=3/2-|N_{i}|$. Finally, set $r:=(\alpha(N+1))^{1/p}$.

We next analyze for which $\boldsymbol{y}\in\mathbb{Z}^{N}$ it holds that $\|B\boldsymbol{y}-\boldsymbol{t}\|_{p}\leq r$. Given $\boldsymbol{y}\notin\{0,1\}^{N}$, $\|B\boldsymbol{y}-\boldsymbol{t}\|_{p}^{p}\geq\|2\alpha^{1/p}I_{N}\boldsymbol{y}-\alpha^{1/p}\boldsymbol{1}_{N}\|_{p}^{p}\geq\alpha(N+2)>r^{p}$, so we only need to analyze the case when $\boldsymbol{y}\in\{0,1\}^{n}$.

Consider an assignment $\boldsymbol{a}\in\{0,1\}^{n}$ to the variables of $\Phi$, take $(\boldsymbol{y}^{\prime})^{T}=((\boldsymbol{y}_{1}^{\prime})^{T},\ldots,(\boldsymbol{y}_{m}^{\prime})^{T})\in\{0,1\}^{(k-2)m}$ with $\boldsymbol{y}_{i}^{\prime}\in\{0,1\}^{k-2}$ for $1\leq i\leq m$, and set $\boldsymbol{y}^{T}:=(\boldsymbol{a}^{T},(\boldsymbol{y}^{\prime})^{T})$. Then, for $1\leq i\leq m$,

[TABLE]

It follows that if $|S_{i}(\boldsymbol{a})|=0$ then $|\langle(\boldsymbol{b}_{i}^{T},\boldsymbol{c}_{i}^{T})^{T},\boldsymbol{y}\rangle-t_{i}|\geq\frac{3}{2}$. On the other hand, if $|S_{i}(\boldsymbol{a})|\geq 1$, then there exists $\boldsymbol{y}_{i}^{\prime}\in\{0,1\}^{k-2}$ such that $|\langle(\boldsymbol{b}_{i}^{T},\boldsymbol{c}_{i}^{T})^{T},\boldsymbol{y}\rangle-t_{i}|=\frac{1}{2}$. Indeed, picking any $\boldsymbol{y}_{i}^{\prime}$ with Hamming weight $|S_{i}(\boldsymbol{a})|-2$ or $|S_{i}(\boldsymbol{a})|-1$ achieves this. Moreover, the choice of $\boldsymbol{y}_{i}^{\prime}$ does not affect $|\langle(\boldsymbol{b}_{i}^{T},\boldsymbol{c}_{i}^{T})^{T},\boldsymbol{y}\rangle-t_{i^{\prime}}|$ for $i^{\prime}\neq i$.

Because $|S_{i}(\boldsymbol{a})|\geq 1$ if and only if $C_{i}$ is satisfied, we see that the following holds if and only if the number of satisfied clauses $m^{+}(\boldsymbol{a})$ is at least $W$:

There exists a $\boldsymbol{y}^{\prime}$ such that, setting $\boldsymbol{y}:=(\boldsymbol{a},\boldsymbol{y}^{\prime})$, we have

[TABLE]

Therefore, there exists $\boldsymbol{y}$ such that $\|B\boldsymbol{y}-\boldsymbol{t}\|_{p}\leq r$ if and only if $(\Phi,W)$ is a ‘YES’ instance of Max-$k$-SAT. ∎

We remark that a straightforward modification of the preceding reduction gives a reduction from an instance of Max-$k$-SAT with $k\geq 3$ on $n$ variables and $m$ clauses to a $\mathrm{CVP}_{p}$ instance of rank $n+(\lfloor\log_{2}(k-2)\rfloor+1)m$ (as opposed to rank $n+(k-2)m$). The idea is to encode the value $k-2$ (corresponding to the row-specific blocks $-\boldsymbol{1}_{k-2}$ used in the reduction) in binary rather than unary.

Corollary 6.3**.**

For every $p\in[1,\infty)$ there is no $2^{o(n)}$-time algorithm for $\mathrm{CVP}_{p}$ assuming ETH.

Proof.

The claim follows by combining the Sparsification Lemma (Proposition 2.9) with the reduction in Theorem 6.2.101010As a technical point, we must reduce from $k$-SAT rather than Max-$k$-SAT to show hardness under ETH because the Sparsification Lemma works for $k$-SAT. ∎

When $k=2$, the rank of the $\mathrm{CVP}_{p}$ instance output by the reduction in Theorem 6.2 is $n$. Therefore, we get the following corollary.

Corollary 6.4**.**

If there exists a $2^{(\omega/3-\varepsilon)n}$-time (resp. $2^{(1-\varepsilon)n}$-time and polynomial space) algorithm for $\mathrm{CVP}_{p}$ for any $p\in[1,\infty)$ and for any constant $\varepsilon>0$, then there exists a $2^{(\omega/3-\varepsilon)n}$-time (resp. $2^{(1-\varepsilon)n}$-time and polynomial space) algorithm for (Weighted-)Max-2-SAT and (Weighted-)Max-Cut.

6.3 The hardness of $\mathrm{SVP}_{\infty}$ and $\mathrm{CVP}_{\infty}$

Theorem 6.5**.**

There is a polynomial-time reduction from a $k$-SAT instance with $n$ variables to a $\mathrm{CVP}_{\infty}$ instance of rank $n$.

Proof.

We give a reduction from a $k$-SAT formula $\Phi$ with $n$ variables $x_{1},\ldots,x_{n}$ and $m$ clauses $C_{1},\ldots,C_{m}$ to an instance $(B,\boldsymbol{t},r)$ of $\mathrm{CVP}_{\infty}$. We assume without loss of generality that each variable appears at most once per clause. We define the output $\mathrm{CVP}_{\infty}$ instance as follows. Let $d:=m+n$. The basis $B\in\mathbb{R}^{d\times n}$ in the output instance has the form

[TABLE]

with rows $\boldsymbol{b}_{i}$ of $B$ satisfying $\boldsymbol{b}_{i}\in\mathbb{R}^{n}$ for $1\leq i\leq m$. For every $1\leq i\leq m$, set $\boldsymbol{b}_{i}$ as in the proof of Theorem 6.2 and set $t_{i}:=(k+1)/2-|N_{i}|$. Set $r:=(k-1)/2$.

We next analyze for which $\boldsymbol{y}\in\mathbb{Z}^{n}$ it holds that $\|B\boldsymbol{y}-\boldsymbol{t}\|_{\infty}\leq r$. Given $\boldsymbol{y}\notin\{0,1\}^{n}$, $\|B\boldsymbol{y}-\boldsymbol{t}\|_{\infty}\geq\|(k-1)\cdot I_{n}\boldsymbol{y}-(k-1)/2\cdot\boldsymbol{1}_{n}\|_{\infty}\geq 3(k-1)/2>r$, so we only need to analyze the case when $\boldsymbol{y}\in\{0,1\}^{n}$. Consider an assignment $\boldsymbol{y}\in\{0,1\}^{n}$ to the variables of $\Phi$. Then

[TABLE]

It follows that if $|S_{i}(\boldsymbol{a})|=0$ then $|\langle\boldsymbol{b}_{i},\boldsymbol{y}\rangle-t_{i}|=(k+1)/2$, and otherwise $|\langle\boldsymbol{b}_{i},\boldsymbol{y}\rangle-t_{i}|\leq(k-1)/2$. Because $|S_{i}(\boldsymbol{a})|\geq 1$ if and only if $C_{i}$ is satisfied, we then have that $\|B\boldsymbol{y}-\boldsymbol{t}\|_{\infty}=\max\{|\langle\boldsymbol{b}_{1},\boldsymbol{y}\rangle-t_{1}|,\ldots,|\langle\boldsymbol{b}_{m},\boldsymbol{y}\rangle-t_{m}|,(k-1)/2\}=(k-1)/2=r$ if $\boldsymbol{y}$ satisfies $\Phi$, and $\|B\boldsymbol{y}-\boldsymbol{t}\|_{\infty}=(k+1)/2>r$ otherwise. Therefore there exists $\boldsymbol{y}$ such that $\|B\boldsymbol{y}-\boldsymbol{t}\|_{\infty}\leq r$ if and only if $\Phi$ is satisfiable. ∎

Lemma 6.6**.**

There is a polynomial-time reduction from a $k$-SAT instance with $n$ variables to an $\mathrm{SVP}_{\infty}$ instance of rank $n+1$.

Proof.

We give a reduction from a $k$-SAT formula $\Phi$ with $n$ variables $x_{1},\ldots,x_{n}$ and $m$ clauses $C_{1},\ldots,C_{m}$ to an instance $(B^{\prime},r)$ of $\mathrm{SVP}_{\infty}$. Define the basis $B^{\prime}\in\mathbb{R}^{(m+n+1)\times(n+1)}$ as

[TABLE]

where $B$ and $\boldsymbol{t}$ are as defined in the proof of Theorem 6.5, and set $r:=(k-1)/2$. We consider for which $\boldsymbol{y}\in\mathbb{Z}^{n+1}\setminus\{\boldsymbol{0}_{n+1}\}$ it holds that $\|B\boldsymbol{y}\|_{\infty}\leq r$. It is not hard to check that if $|y_{i}|\geq 2$ for some $1\leq i\leq n+1$, or if the signs of $y_{i}$ and $y_{n+1}$ differ for some $1\leq i\leq n$, then $\|B\boldsymbol{y}\|_{\infty}>r$. Therefore we need only consider $\boldsymbol{y}$ of the form $\boldsymbol{y}=\pm(\boldsymbol{a}^{T},1)^{T}$ where $\boldsymbol{a}\in\{0,1\}^{n}$. But for such a $\boldsymbol{y}$ we have that $\|B^{\prime}\boldsymbol{y}\|_{\infty}=\|B\boldsymbol{a}-\boldsymbol{t}\|_{\infty}$, and $\|B\boldsymbol{a}-\boldsymbol{t}\|_{\infty}\leq(k-1)/2$ if and only if $\boldsymbol{a}$ is a satisfying assignment to $\Phi$ by the analysis in the proof of Theorem 6.5. ∎

Corollary 6.7**.**

For any constant $\varepsilon>0$ there is no $2^{(1-\varepsilon)n}$-time algorithm for $\mathrm{SVP}_{\infty}$ or $\mathrm{CVP}_{\infty}$ assuming SETH, and there is no $2^{o(n)}$-time algorithm for $\mathrm{SVP}_{\infty}$ or $\mathrm{CVP}_{\infty}$ assuming ETH.

Proof.

Combine Theorem 6.5 and Lemma 6.6. ∎

Note that the preceding reduction in fact achieves an approximation factor of $\gamma=\gamma(k):=1+2/(k-1)$. This implies that for every constant $\varepsilon>0$, there is a $\gamma_{\varepsilon}>1$ such that no $2^{(1-\varepsilon)n}$-time algorithm that approximates $\mathrm{SVP}_{\infty}$ or $\mathrm{CVP}_{\infty}$ to within a factor of $\gamma_{\varepsilon}$ unless SETH fails.

Finally, we remark that the reduction given in Theorem 6.2 is parsimonious when used as a reduction from $2$-SAT. I.e., there is a one-to-one correspondence between satisfying assignments in the input instance and close vectors in the output instance. The reductions given in Theorem 6.5 and Lemma 6.6 are also parsimonious.111111Actually, in the case of $\mathrm{SVP}_{\infty}$, each satisfying assignment to the SAT formula corresponds to a pair $\pm\boldsymbol{v}$ of shortest non-zero vectors, so that there are exactly twice as many such vectors as there are satisfying assignments.

Because $\#2$-SAT is $\mathsf{\#P}$-hard, our reductions therefore show that the counting version of $\mathrm{CVP}_{p}$ (called the Vector Counting Problem) is $\mathsf{\#P}$-hard for all $1\leq p\leq\infty$, and that the counting version of $\mathrm{SVP}_{\infty}$ is $\mathsf{\#P}$-hard. This improves (and arguably simplifies the proof of) a result of Charles [Cha07], which showed that the counting version of $\mathrm{CVP}_{2}$ is $\mathsf{\#P}$-hard.

Acknowledgments

We would like to thank Oded Regev for many fruitful discussions and for helpful comments on an earlier draft of this work. We also thank Vinod Vaikuntanathan for recommending that we consider Gap-ETH.