A time-distance trade-off for GDD with preprocessing---Instantiating the DLW heuristic

TL;DR

This paper presents a non-heuristic preprocessing method for a lattice-based algorithm that improves the reliability of solving approximate closest vector problems, with implications for cryptographic algorithms like IdealSVP.

Contribution

It introduces a specific preprocessing approach that guarantees correctness of the DLW heuristic algorithm without heuristic assumptions, enhancing its applicability.

Findings

Preprocessing enables heuristic-free correctness proof.

The approach reduces heuristic assumptions in IdealSVP algorithms.

A new lemma on Gaussian projections over lattices may be of independent interest.

Abstract

For $0 \leq \alpha \leq 1/2$, we show an algorithm that does the following. Given appropriate preprocessing $P(\mathcal{L})$ consisting of $N_\alpha := 2^{O(n^{1-2\alpha} + \log n)}$ vectors in some lattice $\mathcal{L} \subset \mathbb{R}^n$ and a target vector $\boldsymbol{t}\in \mathbb{R}^n$, the algorithm finds $\boldsymbol{y} \in \mathcal{L}$ such that $\|\boldsymbol{y}- \boldsymbol{t}\| \leq n^{1/2 + \alpha} \eta(\mathcal{L})$ in time $\mathrm{poly}(n) \cdot N_\alpha$, where $\eta(\mathcal{L})$ is the smoothing parameter of the lattice. The algorithm itself is very simple and was originally studied by Doulgerakis, Laarhoven, and de Weger (to appear in PQCrypto, 2019), who proved its correctness under certain reasonable heuristic assumptions on the preprocessing $P(\mathcal{L})$ and target $\boldsymbol{t}$. Our primary contribution is a choice of preprocessing that allows us to prove correctness without any heuristic assumptions. Our main motivation for studying this is the recent breakthrough algorithm for IdealSVP due to Hanrot, Pellet--Mary, and Stehl\'e (to appear in Eurocrypt, 2019), which uses the DLW algorithm as a key subprocedure. In particular, our result implies that the HPS IdealSVP algorithm can be made to work with fewer heuristic assumptions. Our only technical tool is the discrete Gaussian distribution over $\mathcal{L}$, and in particular, a lemma showing that the one-dimensional projections of this distribution behave very similarly to the continuous Gaussian. This lemma might be of independent interest.

Equations

$$\mathcal{L}:=\{z_1{\mathbf{b}}_1+\cdots +z_n{\mathbf{b}}_n:z_i\in \mathbb{Z}\}$$

$${\rho }_s(\mathcal{L}-\mathbf{t}):=\sum _{\mathbf{y}\in \mathcal{L}}{\rho }_s(\mathbf{y}-\mathbf{t})$$

$$\underset{\mathbf{X}\sim D_{\mathcal{L},s}}{\mathrm{Pr}}[\mathbf{X}=\mathbf{y}]=\frac{{\rho }_s(\mathbf{y})}{{\rho }_s(\mathcal{L})}$$

$${\mathcal{L}}^{\ast }:=\{\mathbf{w}\in {\mathbb{R}}^n:\forall \mathbf{y}\in \mathcal{L},⟨\mathbf{w},\mathbf{y}⟩\in \mathbb{Z}\}.$$

$$\frac{1}{3}\le \frac{{\rho }_s(\mathcal{L}-\mathbf{t})}{{\rho }_s(\mathcal{L})}\le 1.$$

$$\underset{\mathbf{X}\sim D_{\mathcal{L},s}}{\mathrm{Pr}}[\Vert \mathbf{X}\Vert \ge \sqrt{n}s]\le 2^{-n}.$$

$$\frac{\|\beta\boldsymbol{t}-k\boldsymbol{y}_{i}\|^{2}}{\|\beta\boldsymbol{t}\|^{2}}=1-\frac{k^{2}}{\beta^{2}}\cdot\big{(}1-\|\boldsymbol{t}-\boldsymbol{y}_{i}\|^{2}\big{)}-\Big{(}\frac{2k}{\beta}-\frac{2k^{2}}{\beta^{2}}\Big{)}\cdot\langle\boldsymbol{y}_{i},\boldsymbol{t}\rangle\leq 1-\frac{k^{2}}{\beta^{2}}\cdot\frac{4}{n^{2}}\leq 1-\frac{1}{n^{2}}\;.$$

$$\displaystyle\Pr\big{[}\|\boldsymbol{v}_{j}-\boldsymbol{y}_{i}\|^{2}\leq 1-5/n^{2}\big{]}$$

$$\ge \exp (-(n^{1/2-\alpha }+4{)}^2)$$

$$=n^2/N_{\alpha }.$$

$$\exp(-\pi(r_{0}/s+2)^{2})<\Pr_{\boldsymbol{X}\sim D_{\mathcal{L},s}}\big{[}\langle\boldsymbol{X},\boldsymbol{v}\rangle\geq r_{0}\big{]}\leq\exp(-\pi r_{0}^{2}/s^{2})\;.$$

$$E[\exp (2\pi \beta ⟨\mathbf{X},\mathbf{v}⟩)]=\exp (\pi {\beta }^2)\cdot \frac{{\rho }_1(\mathcal{L}-\beta \mathbf{v})}{{\rho }_1(\mathcal{L})}.$$

$$\frac{1}{3}\le \exp (-\pi {\beta }^2)\cdot E[\exp (2\pi \beta ⟨\mathbf{X},\mathbf{v}⟩)]\le 1.$$

$$f(r):=\exp(2\pi\beta r)\cdot\big{(}1-\exp(2\pi(r_{0}-r))-\exp(2\pi(r-r_{0}-2))\big{)}\;.$$

$$\operatorname*{\mathbb{E}}\big{[}f(\langle\boldsymbol{X},\boldsymbol{v}\rangle)\big{]}<\exp(2\pi\beta(r_{0}+2))\cdot\Pr\big{[}\langle\boldsymbol{X},\boldsymbol{v}\rangle\geq r_{0}\big{]}\;.$$

$$\displaystyle\operatorname*{\mathbb{E}}\big{[}f(\langle\boldsymbol{X},\boldsymbol{v}\rangle)\big{]}$$

$$=\exp (\pi r_0^2+2\pi r_0)\cdot (e^{\pi }/3-2)$$

$$>\exp (\pi r_0^2+2\pi r_0).$$

$$\Pr\big{[}\langle\boldsymbol{X},\boldsymbol{v}\rangle\geq r_{0}\big{]}>\exp(\pi r_{0}^{2}+2\pi r_{0}-2\pi\beta(r_{0}+2))=\exp(-\pi(r_{0}+2)^{2})\;,$$

$$\Pr_{\boldsymbol{X}\sim D_{\mathcal{L},s}}\big{[}\|\boldsymbol{v}-\boldsymbol{X}\|^{2}\leq 1-r\big{]}>\exp(-\pi(r/s+ns+4)^{2}/4)-2^{-n}\;.$$

$$\mathrm{Pr}[⟨\mathbf{v},\mathbf{X}⟩\ge (n{s}^2+r)/2]>\exp (-\pi (r/s+ns+4{)}^2/4).$$

Full text

The algorithm itself is very simple and was originally studied by Doulgerakis, Laarhoven, and de Weger (to appear in PQCrypto, 2019), who proved its correctness under certain reasonable heuristic assumptions on the preprocessing $P(\mathcal{L})$ and target $\boldsymbol{t}$. Our primary contribution is a choice of preprocessing that allows us to prove correctness without any heuristic assumptions.

Our main motivation for studying this is the recent breakthrough algorithm for IdealSVP due to Hanrot, Pellet–Mary, and Stehlé (to appear in Eurocrypt, 2019), which uses the DLW algorithm as a key subprocedure. In particular, our result implies that the HPS IdealSVP algorithm can be made to work with fewer heuristic assumptions.

Our only technical tool is the discrete Gaussian distribution over $\mathcal{L}$, and in particular, a lemma showing that the one-dimensional projections of this distribution behave very similarly to the continuous Gaussian. This lemma might be of independent interest.

1 Introduction

A lattice $\mathcal{L}\subset\mathbb{R}^{n}$ is the set of all integer linear combinations

[TABLE]

of linearly independent basis vectors $\boldsymbol{b}_{1},\ldots,\boldsymbol{b}_{n}\in\mathbb{R}^{n}$. For a lattice $\mathcal{L}\subset\mathbb{R}^{n}$ and target vector $\boldsymbol{t}\in\mathbb{R}^{n}$, the $d$-Guaranteed Distance Decoding problem ($d$-GDD, or just GDD) asks us to find $\boldsymbol{y}\in\mathcal{L}$ such that $\|\boldsymbol{y}-\boldsymbol{t}\|\leq d$ for some distance $d:=d(\mathcal{L})$ that depends only on $\mathcal{L}$. In particular, we must have $d\geq\mu(\mathcal{L})$, where $\mu(\mathcal{L}):=\max\operatorname{dist}(\boldsymbol{t},\mathcal{L})$ is the covering radius of the lattice.

GDD with preprocessing (GDDP) is the variant of this problem in which we are allowed to perform arbitrary preprocessing on the lattice (but not on $\boldsymbol{t}$). I.e., formally an “algorithm” for GDDP is really a pair of algorithms, a preprocessing algorithm, which takes as input (a basis for) a lattice $\mathcal{L}\subset\mathbb{R}^{n}$ and outputs some preprocessing $P(\mathcal{L})$, and a query algorithm which takes as input $P(\mathcal{L})$ and a target $\boldsymbol{t}$ and outputs a valid solution to the GDD instance $(\mathcal{L},\boldsymbol{t})$. The complexity measure that interests us for such algorithms is the running time of the query algorithm.

In [DLdW19], Doulgerakis, Laarhoven, and de Weger (DLW) gave an elegant algorithm for GDDP whose correctness relies on certain heuristic assumptions. (Our presentation here differs quite a bit from DLW’s. See Section 1.2.) In fact, [DLdW19] gave a family of algorithms parameterized by $0\leq\alpha\leq 1/2$ whose preprocessing consists of $N_{\alpha}\approx 2^{n^{1-2\alpha}}$ lattice vectors in $\mathcal{L}$ whose length is roughly $r$. Given a target $\boldsymbol{t}$, the query algorithm starts by setting $\boldsymbol{t}^{\prime}=\boldsymbol{t}$. The algorithm then simply searches for a vector $\boldsymbol{y}$ in the preprocessing list and an integer $k$ such that $\|k\boldsymbol{y}-\boldsymbol{t}^{\prime}\|<\|\boldsymbol{t}^{\prime}\|$. If it finds one, it replaces $\boldsymbol{t}^{\prime}$ by $\boldsymbol{t}^{\prime}-k\boldsymbol{y}$ and repeats this procedure. Finally, it outputs $\boldsymbol{y}^{\prime}:=\boldsymbol{t}-\boldsymbol{t}^{\prime}\in\mathcal{L}$. Under certain heuristic assumptions that in particular imply that the preprocessing is nicely distributed, [DLdW19] showed that this algorithm terminates with $\|\boldsymbol{y}^{\prime}-\boldsymbol{t}\|=\|\boldsymbol{t}^{\prime}\|\lesssim n^{\alpha}\cdot r$ in time $\mathrm{poly}(n)\cdot N_{\alpha}$.

DLW’s algorithm is the first to provide a smooth trade-off between the running time and the distance $d$. (Such trade-offs are known for other lattice problems. E.g., without preprocessing, block reduction [Sch87, GN08] algorithms accomplish this for many lattice problems, and with preprocessing, such trade-offs are known for Bounded Distance Decoding and the Closest Vector Problem [LLM06, DRS14].) This recently found an exciting application discovered by Pellet–Mary, Hanrot, and Stehlé [PHS19]. [PHS19] showed the best known time-approximation-factor trade-off for the very important problem of finding short non-zero vectors in ideal lattices (given suitable preprocessing on the underlying number field). Their algorithm uses the DLW algorithm as a key subprocedure. However, since DLW’s algorithm relies on certain heuristic assumptions, their application crucially relies on the (reasonable but unproven) assumption that these heuristics apply in their particular use case.

1.1 Removing the heuristic in DLW’s GDDP algorithm

We show how to instantiate DLW’s heuristic algorithm in a provably correct way. In particular, we show an explicit distribution over the lattice such that, when the preprocessing consists of independent samples from this distribution, the above algorithm provably succeeds with high probability. Indeed, there is a very natural choice for this distribution: the discrete Gaussian over the lattice, $D_{\mathcal{L},s}$. This is the distribution that assigns probability to each lattice vector $\boldsymbol{y}\in\mathcal{L}$ proportional to its Gaussian mass $\exp(-\pi\|\boldsymbol{y}\|^{2}/s^{2})$, and it is a ubiquitous tool in lattice algorithms and the study of lattices more generally. (See, e.g., [Ste17].) When the width parameter $s>0$ is at least as large as the smoothing parameter $\eta(\mathcal{L})$, the discrete Gaussian distribution $D_{\mathcal{L},s}$ provably behaves quite similarly to the continuous Gaussian in many ways [MR07]. (E.g., its moments are close to those of a continuous Gaussian.) So, one might expect that it will be distributed nicely enough to work for DLW’s use case.

We show that for $s=\eta(\mathcal{L})$, the discrete Gaussian $D_{\mathcal{L},s}$ does in fact suffice to provably instantiate DLW’s heuristic algorithm with $r\approx\sqrt{n}\cdot\eta(\mathcal{L})$. (This is essentially the same value of $r$ used in [DLdW19]. See Section 1.2 for more discussion.) I.e., we prove the following theorem.

Theorem 1.1**.**

For any $0\leq\alpha\leq 1/2$, there is an algorithm that solves $d$-GDDP in time $2^{O(n^{1-2\alpha}+\log n)}$ where $d(\mathcal{L}):=n^{1/2+\alpha}\cdot\eta(\mathcal{L})$.

Theorem 1.1 is primarily interesting for $\alpha$ strictly between zero and $1/2$. For $\alpha=0$, Theorem 1.1 is outperformed by existing $2^{O(n)}$-time algorithms for CVP [MV13, ADS15]. These algorithms do not require preprocessing and are actually guaranteed to find a closest vector to the target $\boldsymbol{t}$, so our algorithm is trounced by the competition in this regime. Similarly, for $\alpha=1/2$, Babai’s celebrated polynomial-time algorithm [Bab86] always matches or outperforms Theorem 1.1 when instantiated with an appropriate basis as preprocessing.

However, for parameters $\alpha$ satisfying $C/\log n\leq\alpha\leq 1/2-C/\log n$ for a sufficiently large constant $C>0$, Theorem 1.1 is the best known algorithm and the first non-trivial result whose correctness has been proven.111Formally, Babai’s algorithm can be used to solve $d$-GDDP in polynomial time for a function $d(\mathcal{L})$ satisfying $\eta(\mathcal{L})\lesssim d(\mathcal{L})\lesssim n\cdot\eta(\mathcal{L})$. (This function is given by $d(\mathcal{L})^{2}=\min\sum\|\widetilde{\boldsymbol{\boldsymbol{b}}}_{i}\|^{2}/4$, where the minimum is over all (ordered) lattice bases $\boldsymbol{b}_{1},\ldots,\boldsymbol{b}_{n}$ and $\widetilde{\boldsymbol{\boldsymbol{b}}}_{i}$ represents the Gram-Schmidt orthogonalization.) So, the distance $n^{1/2+\alpha}\eta(\mathcal{L})$ that we achieve is incomparable with Babai’s for $\alpha<1/2$. Indeed, for some rather degenerate lattices—such as the lattice generated by $2^{n}\boldsymbol{e}_{1},\boldsymbol{e}_{2},\ldots,\boldsymbol{e}_{n}$—we have $d(\mathcal{L})\approx\eta(\mathcal{L})$. I.e., Babai’s algorithm outperforms Theorem 1.1 by a factor of roughly $n^{1/2+\alpha}$ in the distance for such lattices. We can of course always combine the two algorithms to achieve the best of both worlds, a distance of $\min\{d(\mathcal{L}),n^{1/2+\alpha}\eta(\mathcal{L})\}$. However, for “typical” lattices that interest us, like those that satisfy the heuristics in [DLdW19] or those that arise in cryptography, we have $d(\mathcal{L})\approx n\cdot\eta(\mathcal{L})$, so that our algorithm strictly outperforms Babai’s for $\alpha\leq 1/2-C/\log n$. In particular, Theorem 1.1 removes [PHS19]’s reliance on certain heuristic assumptions. ([PHS19] also requires additional unrelated heuristic assumptions, which our result does not remove. We refer the reader to [PHS19] for more information.)

Behind this result is a geometric lemma concerning the discrete Gaussian distribution that, to the author’s knowledge, is novel. The lemma shows that one-dimensional projections of the discrete Gaussian look very much like a continuous Gaussian for parameters above smoothing. (See Lemma 3.2.)

1.2 Relation to DLW

Our presentation here is quite different from the presentation in [DLdW19]. (See also an earlier version of the same paper [Laa16a] and a closely related paper [Laa16b].) We attempt to clarify some of the differences here to avoid confusion.

First of all, DLW described their algorithm as a solution to the Closest Vector Problem (CVP), in which the goal is to output a vector $\boldsymbol{y}\in\mathcal{L}$ with $\|\boldsymbol{y}-\boldsymbol{t}\|\leq\gamma\cdot\operatorname{dist}(\boldsymbol{t},\mathcal{L})$ for some approximation factor $\gamma\geq 1$. In contrast, we call the same algorithm a GDD(P) algorithm. This discrepancy arises when one moves from heuristic algorithms to provably correct algorithms. Since $\operatorname{dist}(\boldsymbol{t},\mathcal{L})$ is nearly maximal for “most” $\boldsymbol{t}$ [HLR09], DLW’s heuristics quite reasonably imply that $\operatorname{dist}(\boldsymbol{t},\mathcal{L})$ is nearly maximal, i.e., $\operatorname{dist}(\boldsymbol{t},\mathcal{L})\approx\mu(\mathcal{L})$. With this assumption, $\gamma$-CVP is essentially equivalent to $(\gamma\mu(\mathcal{L}))$-GDD. However, without such a heuristic, the two problems seem to be quite different, so that the distinction is unfortunately necessary here.

Second, since [DLdW19] describe their results in terms of CVP and do not mention the smoothing parameter $\eta(\mathcal{L})$, their results are formally incomparable with Theorem 1.1. However, we note that the heuristics in [DLdW19] imply that $\eta(\mathcal{L})\approx\lambda_{1}(\mathcal{L})/\sqrt{n}\approx\mu(\mathcal{L})/\sqrt{n}$, and the DLW algorithm finds vectors within distance roughly $n^{\alpha}\lambda_{1}(\mathcal{L})$ of the target. Since we obtain vectors within distance $n^{1/2+\alpha}\eta(\mathcal{L})$, our result essentially matches theirs when their heuristics apply.

Third, while we match DLW’s algorithm asymptotically, we do not claim to match the constants. Indeed, in the language of this paper, much of [DLdW19] is devoted to finding vectors within distance $c_{1}\sqrt{n}\cdot\eta(\mathcal{L})$ in time $2^{c_{2}n+o(n)}$ for small constants $0<c_{1},c_{2}<1$. In contrast, we are mostly interested in what appears as a secondary result in that paper: the time-distance trade-off achievable for distance $n^{1/2+\alpha}\eta(\mathcal{L})$ and time $2^{O(n^{1-2\alpha}+\log n)}$ for $0<\alpha<1/2$. And, we make very little effort to optimize the constants. For example, [DLdW19] uses nearest neighbor data structures to let the query algorithm avoid reading the entire preprocessing, which we do not attempt to replicate here. Similarly, while [DLdW19] proposed specific techniques for computing the preprocessing in $2^{cn+o(n)}$ time, we ignore this. (We do note, however, that [ADRS15] shows how to sample the preprocessing in time $2^{n+o(n)}$.)

Acknowledgments

I thank Guillaume Hanrot, Thijs Laarhoven, Alice Pellet–Mary, Oded Regev, and Damien Stehlé for helpful discussions. I also thank Alice Pellet–Mary, Guillaume Hanrot, and Damien Stehlé for sharing early versions of their work with me.

2 Preliminaries

Throughout this work, we adopt the common convention of expressing the running times of lattice algorithms in terms of the dimension $n$ only, ignoring any dependence on the bit length of the input $B$. Formally, we should specify a particular input format for the (basis of the) lattice (e.g., by restricting our attention to rational numbers and using the natural binary representation of a rational matrix to represent a basis for the lattice), and our running time should of course have some dependence on $B$. Consideration of the bit length would simply add a $\mathrm{poly}(B)$ factor to the running time for the algorithm(s) considered in this paper, provided that the input format allows for efficient arithmetic operations.

2.1 The discrete Gaussian

For a vector $\boldsymbol{x}\in\mathbb{R}^{n}$ and parameter $s>0$, we write $\rho_{s}(\boldsymbol{x}):=\exp(-\pi\|\boldsymbol{x}\|^{2}/s^{2})$ for the Gaussian mass of $\boldsymbol{x}$ with parameter $s$. For a lattice $\mathcal{L}\subset\mathbb{R}^{n}$ and shift vector $\boldsymbol{t}\in\mathbb{R}^{n}$, we write

[TABLE]

for the Gaussian mass of $\mathcal{L}-\boldsymbol{t}$ with parameter $s$. We write $D_{\mathcal{L},s}$ for the probability distribution over $\mathcal{L}$ defined by

[TABLE]

for $\boldsymbol{y}\in\mathcal{L}$.

The dual lattice $\mathcal{L}^{*}\subset\mathbb{R}^{n}$ is the set of vectors that have integer inner product with all lattice vectors,

[TABLE]

Micciancio and Regev defined the smoothing parameter $\eta(\mathcal{L})$ as the unique parameter $s$ such that $\rho_{1/s}(\mathcal{L}^{*})=3/2$ [MR07].222This is more commonly referred to as $\eta_{1/2}(\mathcal{L})$, where $\eta_{\varepsilon}(\mathcal{L})$ is the unique parameter $s$ such that $\rho_{1/s}(\mathcal{L}^{*})=1+\varepsilon$. Since we will always take $\varepsilon=1/2$, we simply omit it. Our results remain essentially unchanged if we take $\varepsilon$ to be any constant strictly between zero and one. The following claim justifies the name “smoothing parameter,” and it is the only fact about the smoothing parameter that we will need.

Claim 2.1**.**

For any lattice $\mathcal{L}\subset\mathbb{R}^{n}$, parameter $s\geq\eta(\mathcal{L})$, and shift $\boldsymbol{t}\in\mathbb{R}^{n}$,

[TABLE]

We will also need a simplified version of Banaszczyk’s celebrated tail bound for the discrete Gaussian [Ban93].

Theorem 2.2**.**

For any lattice $\mathcal{L}\subset\mathbb{R}^{n}$ and parameter $s>0$,

[TABLE]

Finally, we will need the following rather weak consequence of Babai’s algorithm [Bab86].

Theorem 2.3**.**

There is a polynomial-time algorithm for $(2^{n}\eta(\mathcal{L}))$-GDD.

2.2 $\varepsilon$-nets

For $\varepsilon>0$, we say that a set $\{\boldsymbol{v}_{1},\ldots,\boldsymbol{v}_{M}\}\subset\mathbb{R}^{n}$ of unit vectors with $\|\boldsymbol{v}_{i}\|=1$ is an $\varepsilon$-net of the unit sphere if for any $\boldsymbol{t}\in\mathbb{R}^{n}$ with $\|\boldsymbol{t}\|=1$, there exists $\boldsymbol{v}_{i}$ such that $\|\boldsymbol{v}_{i}-\boldsymbol{t}\|\leq\varepsilon$. We will use a simple bound on the size of such a net, which can be proven via a simple packing argument. See [Ver12, Lemma 5.2], for example.

Lemma 2.4**.**

For any $\varepsilon>0$, there exists an $\varepsilon$-net of the unit sphere in $\mathbb{R}^{n}$ with $(1+2/\varepsilon)^{n}$ points.

3 The algorithm

We consider the following algorithm for GDDP. For an input lattice $\mathcal{L}\subset\mathbb{R}^{n}$ with $n\geq 40$, the preprocessing consists of $N$ lattice vectors $\boldsymbol{y}_{1},\ldots,\boldsymbol{y}_{N}\in\mathcal{L}$. On input $\boldsymbol{t}\in\mathbb{R}^{n}$, the query algorithm behaves as follows. It first uses Theorem 2.3 to find $\boldsymbol{t}_{0}\in\mathcal{L}+\boldsymbol{t}$ such that $\|\boldsymbol{t}_{0}\|\leq 2^{n}\eta(\mathcal{L})$ and sets $j=0$. The algorithm then does the following repeatedly. It finds an index $i$ and integer $k$ such that $\|\boldsymbol{t}_{j}-k\boldsymbol{y}_{i}\|^{2}\leq(1-1/n^{2})\cdot\|\boldsymbol{t}_{j}\|^{2}$, sets $\boldsymbol{t}_{j+1}:=\boldsymbol{t}_{j}-k\boldsymbol{y}_{i}$, and increments $j$. Once the algorithm fails to find such a vector, it outputs $\boldsymbol{t}_{j}-\boldsymbol{t}\in\mathcal{L}$.333To guarantee a running time of $\mathrm{poly}(n)\cdot N$, we can also assume that the algorithm halts and outputs $\boldsymbol{t}_{j}-\boldsymbol{t}\in\mathcal{L}$ if $j$ reaches, say, $100n^{3}$. This is not strictly necessary, since we will have $\|\boldsymbol{y}_{i}\|\approx\sqrt{n}\cdot\eta(\mathcal{L})$ with very high probability.

Our main theorem shows that this algorithm will succeed when the preprocessing is chosen from the right distribution. We emphasize the order of quantifiers: with high probability over the preprocessing, the algorithm works for all targets $\boldsymbol{t}\in\mathbb{R}^{n}$. In particular, there exists fixed preprocessing that works for all targets $\boldsymbol{t}$.

Theorem 3.1**.**

For any $\alpha$ with $\frac{2}{\log n}\leq\alpha\leq\frac{1}{2}$, when the preprocessing of the above algorithm consists of $N_{\alpha}:=n^{2}e^{(n^{1/2-\alpha}+4)^{2}}=2^{O(n^{1-2\alpha}+\log n)}$ samples from $D_{\mathcal{L},s}$ for $s:=\eta(\mathcal{L})$, it yields a solution to $d$-GDDP in time $\mathrm{poly}(n)\cdot N_{\alpha}$ with high probability, where $d:=n^{1/2+\alpha}\cdot\eta(\mathcal{L})$.

Proof.

By scaling appropriately, we may assume without loss of generality that $d=1$, and therefore $s=n^{-1/2-\alpha}$. Let $\boldsymbol{y}_{1},\ldots,\boldsymbol{y}_{N_{\alpha}}\sim D_{\mathcal{L},s}$. To prove correctness, we must show that, with high probability over the $\boldsymbol{y}_{i}$, for every $\boldsymbol{t}\in\mathbb{R}^{n}$ with $\|\boldsymbol{t}\|\geq 1$, there exists an index $i$ and integer $k$ such that $\|\boldsymbol{t}-k\boldsymbol{y}_{i}\|^{2}\leq(1-1/n^{2})\cdot\|\boldsymbol{t}\|^{2}$. It suffices to prove that for $\|\boldsymbol{t}\|=1$, there exists an $i$ with $\|\boldsymbol{t}-\boldsymbol{y}_{i}\|^{2}\leq 1-4/n^{2}$.444Indeed, suppose that $\|\boldsymbol{t}-\boldsymbol{y}_{i}\|^{2}\leq 1-4/n^{2}$ and $\|\boldsymbol{t}\|=1$, so that in particular $\langle\boldsymbol{y}_{i},\boldsymbol{t}\rangle\geq 0$. Then for any $\beta/2\leq k\leq\beta$,

\frac{\|\beta\boldsymbol{t}-k\boldsymbol{y}_{i}\|^{2}}{\|\beta\boldsymbol{t}\|^{2}}=1-\frac{k^{2}}{\beta^{2}}\cdot\big{(}1-\|\boldsymbol{t}-\boldsymbol{y}_{i}\|^{2}\big{)}-\Big{(}\frac{2k}{\beta}-\frac{2k^{2}}{\beta^{2}}\Big{)}\cdot\langle\boldsymbol{y}_{i},\boldsymbol{t}\rangle\leq 1-\frac{k^{2}}{\beta^{2}}\cdot\frac{4}{n^{2}}\leq 1-\frac{1}{n^{2}}\;.

Finally, to prove this, it suffices to take a $(1/n^{3})$-net of the unit sphere, $\boldsymbol{v}_{1},\ldots,\boldsymbol{v}_{M}$, and to show that for each $j$, there exists an $i$ such that $\|\boldsymbol{v}_{j}-\boldsymbol{y}_{i}\|^{2}\leq 1-5/n^{2}$.

By Lemma 2.4, there exists such a net of cardinality $M=(3n)^{3n}$. For each $\boldsymbol{v}_{j}$ in this net and each index $i$, we have by Corollary 3.3 (proven below) that

[TABLE]

Since the $\boldsymbol{y}_{i}$ are sampled independently, the probability that no such $i$ exists is at most $(1-n^{2}/N_{\alpha})^{N_{\alpha}}<2^{-n}/M$. The result then follows by taking a union bound over the $\boldsymbol{v}_{j}$. ∎

3.1 One-dimensional projections of the discrete Gaussian

We are interested in the lower bound in the following lemma (whose proof uses an idea from [MO90]). The upper bound (i.e., the subgaussianity of the discrete Gaussian) applies for all parameters $s>0$ and was first proven in [MP12, Lemma 2.8]. We include the upper bound for comparison.

Lemma 3.2**.**

For any lattice $\mathcal{L}\subset\mathbb{R}^{n}$, parameter $s\geq\eta(\mathcal{L})$, unit vector $\boldsymbol{v}\in\mathbb{R}^{n}$ with $\|\boldsymbol{v}\|=1$, and $r_{0}>0$, we have

[TABLE]

Proof.

By scaling appropriately, we may assume that $s=1$. Let $\beta>0$ to be chosen later. By completing the square in the exponent, we see that

[TABLE]

Therefore, by Claim 2.1,

[TABLE]

I.e., we know the moment generating function of $\langle\boldsymbol{X},\boldsymbol{v}\rangle$ to within a multiplicative constant. The upper bound in Eq. (1) then follows from taking $\beta=r_{0}$ and applying Markov’s inequality. (This proof of the upper bound is identical to the proof in [MP12]. See their Lemma 2.8 and their discussion above it.)

Turning to the lower bound, for $r\in\mathbb{R}$, let

[TABLE]

Notice that $f(r)<0$ unless $r_{0}<r<r_{0}+2$. And, $f(r)<\exp(2\pi\beta(r_{0}+2))$ for all $r$. Therefore,

[TABLE]

By applying Eq. (2) term-wise and taking $\beta=r_{0}+1$, we have

[TABLE]

Combining Eqs. (3) and (4) and rearranging, we have

[TABLE]

as needed. ∎

Corollary 3.3**.**

For any $0<r<1$, lattice $\mathcal{L}\subset\mathbb{R}^{n}$, unit vector $\boldsymbol{v}\in\mathbb{R}^{n}$ with $\|\boldsymbol{v}\|=1$, and $s\geq\eta(\mathcal{L})$, we have

[TABLE]

Proof.

Notice that $\|\boldsymbol{v}-\boldsymbol{X}\|^{2}=1+\|\boldsymbol{X}\|^{2}-2\langle\boldsymbol{v},\boldsymbol{X}\rangle$. By Theorem 2.2, we have that $\|\boldsymbol{X}\|\leq ns^{2}$ except with probability at most $2^{-n}$. By Lemma 3.2, we see that

[TABLE]

The result follows from union bound. ∎