Quantum algorithm based on the $\varepsilon$-random linear disequations for the continuous hidden shift problem

TL;DR

This paper introduces a quantum algorithm for the continuous hidden shift problem on real vector spaces, extending previous discrete group results, and demonstrates its polynomial-time solvability.

Contribution

It defines the continuous hidden shift problem and the $ ext{ extsterling}$-random linear disequations, and presents a quantum algorithm solving the problem efficiently.

Findings

Quantum algorithm solves the continuous hidden shift problem in polynomial time.

Extension of hidden shift problem to $ ext{ extsterling}$-random linear disequations.

Provides a new framework for quantum algorithms on continuous domains.

Abstract

There have been several research works on the hidden shift problem, quantum algorithms for the problem, and their applications. However, all the results have focused on discrete groups with discrete oracle functions. In this paper, we define the continuous hidden shift problem on $\mathbb{R}^n$ with a continuous oracle function as an extension of the hidden shift problem, and also define the $\varepsilon$-random linear disequations which is a generalization of the random linear disequations. By employing the newly defined concepts, we show that there exists a quantum computational algorithm which solves this problem in time polynomial in $n$.

Equations

$$\frac{1}{2^{qn+1}}\left(3-{\left(1-2^{-\frac{q}{4}}\right)}^n\right)$$

$$\frac{1}{3\cdot 2^{qn}}\left({\left(1-2^{-\frac{q}{4}}\right)}^n\left(1-\frac{{\alpha }^2}{2^{q+3}}\right)-A_0{\left({\left(1-2^{-\frac{q}{4}}\right)}^n\left(1-\frac{{\alpha }^2}{2^{q+3}}\right)\right)}^{\frac{|A_0|+A_0}{2A_0}}\right),$$

$$\{\begin{array}{ll}\mathrm{Pr}(x)\le \epsilon & \text{if x∈S∖S′},\\ \frac{1}{c|S^{\prime }|}\le \mathrm{Pr}(x)\le \frac{c}{|S^{\prime }|}& \text{if x∈S′}.\end{array}$$

$$\frac{1}{\sqrt{2^{qn+1}}}\sum _{\tilde{x}\in {\mathbb{Z}}_{2^q}^n}\sum _{c\in {\mathbb{Z}}_2}|\tilde{x}⟩|c⟩|0⟩.$$

$$|{\psi }_{\delta }⟩=\frac{1}{\sqrt{2^{qn+1}}}\sum _{\tilde{x}\in {\mathbb{Z}}_{2^q}^n}\sum _{c\in {\mathbb{Z}}_2}|\tilde{x}⟩|c⟩|f(\delta \tilde{x},c)⟩.$$

$$U_f:|\tilde{x}⟩|c⟩|k⟩\to |\tilde{x}⟩|c⟩|f_k(\delta \tilde{x},c)⟩$$

$$\frac{1}{2^{qn+1}}\sum _{\tilde{x},\tilde{y}\in {\mathbb{Z}}_{2^q}^n}\sum _{c,d\in {\mathbb{Z}}_2}{e}^{2\pi i⟨\tilde{x},\tilde{y}⟩/2^q}{e}^{2\pi ic\cdot d/2}|\tilde{y}⟩|d⟩|f(\delta \tilde{x},c)⟩.$$

$$p_{\delta }(\tilde{y},1)$$

$$|\widehat{{\psi }_{\delta }}(\tilde{y},1)⟩=\frac{1}{2^{qn+1}}\sum _{\tilde{x}\in {\mathbb{Z}}_{2^q}^n}\sum _{c\in {\mathbb{Z}}_2}{e}^{2\pi i⟨\tilde{x},\tilde{y}⟩/2^q}(-1{)}^c|\tilde{y}⟩|1⟩|f(\delta \tilde{x},c)⟩.$$

$$⟨f(\delta {\tilde{x}}^{\prime },1)|f(\delta \tilde{x},1)⟩$$

$$⟨f(\delta {\tilde{x}}^{\prime },0)|f(\delta \tilde{x},1)⟩$$

$$⟨f(\delta {\tilde{x}}^{\prime },1)|f(\delta \tilde{x},0)⟩$$

$$p_{\delta }(\tilde{y},1)$$

$$\epsilon =\frac{1-{\left(1-2^{-\frac{q}{4}}\right)}^n\left(1-\frac{{\alpha }^2}{2^{q+3}}\right)+2^{qn+1}\xi }{4\cdot 2^{qn}}.$$

$$\frac{4\cdot 2^{qn}}{|S^{\prime }|\left(1-A{\left({\left(1-2^{-\frac{q}{4}}\right)}^n\left(1-\frac{{\alpha }^2}{2^{q+3}}\right)\right)}^{\frac{|A|+A}{A}}-2^{qn}\xi \right)}$$

$$\frac{4\cdot 2^{qn}}{|S^{\prime }|\left(1-{\left(1-2^{-\frac{q}{4}}\right)}^n\left(1-\frac{{\alpha }^2}{2^{q+3}}\right)+2^{qn+1}\xi \right)}.$$

$$0<\xi <\frac{{\left(1-2^{-\frac{q}{4}}\right)}^n\left(1-\frac{{\alpha }^2}{2^{q+3}}\right)-A{\left({\left(1-2^{-\frac{q}{4}}\right)}^n\left(1-\frac{{\alpha }^2}{2^{q+3}}\right)\right)}^{\frac{|A|+A}{A}}}{3\cdot 2^{qn}},$$

$$3\cdot 2^{qn}\xi <{\left(1-2^{-\frac{q}{4}}\right)}^n\left(1-\frac{{\alpha }^2}{2^{q+3}}\right)-A{\left({\left(1-2^{-\frac{q}{4}}\right)}^n\left(1-\frac{{\alpha }^2}{2^{q+3}}\right)\right)}^{\frac{|A|+A}{A}}.$$

$$1$$

$$c$$

$$\frac{1}{c|S^{\prime }|}$$

$$p_{\delta }(\tilde{y},1)$$

$$A{\left(1-\frac{{\alpha }^2}{2^{q+3}}\right)}^{\frac{|A|+A}{2A}}+1>0.$$

$$\frac{1}{c|S^{\prime }|}\le p_{\delta }(\tilde{y},1)\le \frac{c}{|S^{\prime }|}$$

$$\epsilon =\frac{1-{\left(1-2^{-\frac{q}{4}}\right)}^n\left(1-\frac{{\alpha }^2}{2^{q+3}}\right)+2^{qn+1}\xi }{4\cdot 2^{qn}}.$$

$$p_{\delta }(\tilde{y},1)=\frac{1}{4\cdot 2^{qn}}\left(1-(1-2^{-\frac{q}{4}}{)}^n\left(1-\frac{{\alpha }^2}{2^{q+3}}\right)\right)\le \epsilon .$$

$$\epsilon <\frac{1}{c|S^{\prime }|}$$

$$c<\frac{4\cdot 2^{qn}}{|S^{\prime }|\left(1-{\left(1-2^{-\frac{q}{4}}\right)}^n\left(1-\frac{{\alpha }^2}{2^{q+3}}\right)+2^{qn+1}\xi \right)}=\frac{1}{\epsilon |S^{\prime }|}.$$

Full text

I Introduction

Quantum computers can solve certain problems exponentially faster than classical computers by taking advantage of the quantum mechanical properties such as quantum interference and superposition. Many researchers have been studying algebraic problems which can be solved more efficiently on a quantum computer than a classical computer, for instance, hidden subgroup problem Simon (1997); Shor (1997); Ettinger and Høyer (2000); Ettinger et al. (2004); Kuperberg (2005); Hallgren (2005); Schmidt and Vollmer (2005); Kuperberg (2013), hidden shift problem Friedl et al. (2003); van Dam et al. (2006); Childs and van Dam (2007); Ivanyos (2008), hidden polynomial problem Childs and Wocjan (2007); Decker et al. (2009, 2014), and hidden symmetry subgroup problem Decker et al. (2013); Kim et al. . In particular, the hidden shift problem has provided a framework to solve various problems such as the shift Legendre symbol problem van Dam et al. (2006), Gauss sum estimation van Dam and Seroussi , and the stabilizer problem Friedl et al. (2003). It has been shown that several interesting and important problems have been related to the hidden shift problem. For example, it was proved that the hidden shift problem for the abelian group $\mathbb{Z}_{N}$ can be used to solve some lattice problem over $\mathbb{Z}_{N}$ Ettinger and Høyer (2000); Regev (2002), and it was also discovered that an efficient algorithm of the hidden shift problem for the symmetric group $S_{n}$ would yield an efficient algorithm for the graph isomorphic problem Childs and Wocjan (2007).

The hidden shift problem can be cast in the following terms: Let $f_{0}$ and $f_{1}$ be two injective functions from a finite group $G$ to a finite set satisfying that there exists an element $u$ in $G$ such that the equality $f_{0}(x)=f_{1}(xu)$ holds for all $x$ in $G$. The task is to find the hidden shift $u$. Although there is no general algorithm to solve the hidden shift problem even for abelian groups, it has been known that there are efficient quantum algorithms to solve the problem for some groups while no classical algorithm for solving this problem in time $O(\text{poly}(n))$ is known van Dam et al. (2006); Gavinsky et al. (2011); Roetteler (2016, 2009). Friedl et al. Friedl et al. (2003) found an efficient quantum algorithm for the hidden shift problem over $\mathbb{Z}_{p}^{n}$ for any fixed prime number $p$, and a similar work for the problem over the group $\mathbb{Z}_{p^{k}}^{n}$ has been done by Ivanyos Ivanyos (2008), where $p^{k}$ is any fixed prime power. The hidden shift problem over $\mathbb{Z}_{p^{k}}^{n}$ can be solved in time polynomial in $n$ with a small error by using a quantum computer. However, when $m$ is not a prime power, the hidden shift problem for the group $\mathbb{Z}_{m}^{n}$ still remains unsolved.

All known results on the hidden shift problem have been concerned with only discrete groups with discrete oracle functions. Thus, it is natural to ask whether there exists an efficient quantum algorithm for solving the continuous hidden shift problem, which is the hidden shift problem on a group with a continuous oracle function. Considering a continuous version of an algebraic problem can be helpful to solve unsolved problems as in the results of Eisenträger et al. Eisenträger et al. (2014). They found an efficient quantum algorithm for solving a continuous hidden subgroup problem on $\mathbb{R}^{n}$ with a continuous oracle function hiding a hidden subgroup to compute the unit group of an arbitrary degree number field. It was also shown that the algorithm can pose a threat to certain lattice-based cryptosystems Eisenträger et al. (2014); Biasse and Song (2016).

In this paper, we present the continuous hidden shift problem for $\mathbb{R}^{n}$ with a continuous oracle function hiding a hidden shift. To deal with the continuous inputs, we truncate the domain using a large enough number $2^{q}$ and discretize the inputs coordinatewise. So, the oracle inputs considered as the elements in $\mathbb{Z}_{2^{q}}^{n}$. Remark that the author in Ref. Ivanyos (2008) had used the random linear disequations to solve the hidden shift problem over $\mathbb{Z}_{p^{k}}^{n}$. However, we cannot apply the same method directly to the discretized inputs of the continuous hidden shift problem since we differently use a continuous oracle function instead of a discrete oracle function. Thus, we newly define the $\varepsilon$-random linear disequations which is a generalization of the random linear disequations, and we construct a quantum algorithm for solving the continuous hidden shift problem on $\mathbb{R}^{n}$ by employing the method.

Our paper is organized as follows. In Sec. II, we give the definition of the continuous hidden shift problem on $\mathbb{R}^{n}$, and introduce our main result. In Sec. III, we define two types of the $\varepsilon$-random linear disequations problem, which are the search version and the decision version, and show that we can efficiently solve the decision version of this problem. In Sec. IV, we present our algorithm to solve the continuous hidden shift problem on $\mathbb{R}^{n}$ by reducing the problem to the decision version of the $\varepsilon$-random linear disequations problem on $\mathbb{R}^{n}$. In Sec. V, we analyze the efficiency of our algorithm, and conclude with discussion on our results in Sec. VI.

II Continuous hidden shift problem on $\mathbb{R}^{n}$

To deal with the continuous hidden shift problem on $\mathbb{R}^{n}$, we need a suitable definition. The following definition can be considered as a continuous version of the original hidden shift problem.

Definition 1** (Continuous hidden shift problem over $\mathbb{R}^{n}$).**

Let $S$ be the set of unit vectors in a Hilbert space $\mathcal{H}$. For two injective functions $f_{0}$ and $f_{1}$ from $\mathbb{R}^{n}$ to $S$, let $f:\mathbb{R}^{n}\times\mathbb{Z}_{2}\rightarrow S$ be defined by $f(x,a):=f_{a}(x)$ with the following promises:

$f(x,0)=f(x+u,1)$* for all $x\in\mathbb{R}^{n}$ and for some $u\in\mathbb{R}^{n}$.* 2. 2.

There exists $\alpha>0$ such that \left\Arrowvert\ket{f(x,a)}-\ket{f(y,b)}\right\Arrowvert_{\mathcal{H}}\leq\alpha\cdot\left\Arrowvert x-y-(a-b)u\right\Arrowvert for all $x,y\in\mathbb{R}^{n}$ and $a,b\in\mathbb{Z}_{2}$, where $\ket{f(\cdot,\cdot)}$ is a real coefficient pure state corresponding to $f(\cdot,\cdot)$, \left\Arrowvert\cdot\right\Arrowvert_{\mathcal{H}} is the norm induced by the inner product $\left\langle{\cdot}|{\cdot}\right\rangle$ on $\mathcal{H}$, and \left\Arrowvert\cdot\right\Arrowvert is the Euclidean norm on $\mathbb{R}^{n}$. 3. 3.

If \left\Arrowvert x-y-(a-b)u\right\Arrowvert\geq r, then $\left|\left\langle{f(x,a)}|{f(y,b)}\right\rangle\right|\leq\xi$.

The continuous hidden shift problem over $\mathbb{R}^{n}$ with positive real parameters $(\alpha,r,\xi)$ is to find an $\eta$-approximation $u_{a}$ of the hidden shift $u$ such that \left\Arrowvert u_{a}-u\right\Arrowvert<\eta.

Note that the positive constant $\alpha$ in the condition 2 of Definition 1 is called a Lipschitz constant of the function $f$. We can reformulate the condition 2 by using the inner product instead of the norm as follows:

There exists $\alpha>0$ such that 1-\left\langle{f(x,a)}|{f(y,b)}\right\rangle\leq\frac{\alpha^{2}}{2}\left\Arrowvert x-y-(a-b)u\right\Arrowvert^{2} for all $x,y\in\mathbb{R}^{n}$ and $a,b\in\mathbb{Z}_{2}$.

The algorithm to find an approximation of $u$ with high probability in time polynomial in $n$ should require certain conditions of the parameters $\alpha,r$, and $\xi$ with respect to an assumption of the hidden shift $u$ which is not too large. The detailed statement of our main theorem is as follows.

Theorem 2**.**

Suppose that $u=(u_{1},u_{2},\ldots,u_{n})\in\mathbb{R}^{n}$ satisfies $u_{i}^{2}\leq\sqrt{2^{q}}$ for all $i$ and for some positive integer $q$. Let $\delta=\frac{1}{\sqrt{2^{q}}}$. Then there exists a quantum algorithm to find the $\frac{\delta}{2}$-approximation $\delta\tilde{u}$ of the hidden shift $u$ in $\mathbb{R}^{n}$ in time polynomial in $n$ with a small constant error if the parameters $(\alpha,r,\xi)$ of the oracle function are chosen as $\alpha^{2}<2^{q+3}$, $r=\frac{\delta}{2}$, and $\xi$ is less than both

[TABLE]

and

[TABLE]

where $\tilde{u}\in\mathbb{Z}_{2^{q}}^{n}$ and $A_{0}=\cos{(2\pi/2^{q})}$.

To prove the above main theorem, we need to define a computational problem called the $\varepsilon$-random linear disequations problem. This problem plays an important role for finding the approximation of the hidden shift from the discretized inputs of the oracle function.

III $\varepsilon$-random linear disequations problem

In this section, we first define the $\varepsilon$-nearly uniform distribution and two types of the $\varepsilon$-random linear disequations problem. This problem is a generalization of the random linear disequations problem in Ref. Ivanyos (2008) which is the same as the problem in the case when $\varepsilon=0$. Furthermore, we will show that the problem on $\mathbb{Z}^{n}_{2^{q}}$ can be solved in time polynomial in $n$ with a small constant error.

Let $G$ be a finite abelian group, and let $\chi:G\rightarrow\mathbb{C}\setminus\{0\}$ be a character of $G$, that is, $\chi$ is a group homomorphism from $G$ to $(\mathbb{C},\times)$. A set of characters forms an abelian group $G*$ under pointwise multiplication. Note that $G*$ is isomorphic to $G$, and the kernel of $\chi$ is the set of group elements on which $\chi$ has value $1$.

Definition 3** ($\varepsilon$-nearly uniform).**

A distribution over a finite set $S$ is said to be $\varepsilon$-nearly uniform with a real tolerance parameter $c\geq 1$ over a subset $S^{\prime}\subset S$ for a small enough number $0\leq\varepsilon<\frac{1}{c|S^{\prime}|}$ if

[TABLE]

Note that when $\varepsilon=0$, an $\varepsilon$-nearly uniform distribution over $S^{\prime}\in S$ is nearly uniform over $S^{\prime}$. For any $\varepsilon\geq 0$, $\varepsilon$-near uniformity over the whole set $S$ is exactly same with near uniformity over the whole set $S$.

Definition 4**.**

$\varepsilon$-Random Linear Disequations$(G,c)$ - search version

• $\bullet$

Oracle Input*: Sample from a distribution over $G*$ which is $\varepsilon$-nearly uniform with $c$ on $\{\chi\in$ $G*$ $|$ $u$ $\notin\ker\chi\}$ for a fixed element $u$.*

• $\bullet$

Task*: Find the set of such elements $u$.*

Definition 5**.**

$\varepsilon$-Random Linear Disequations$(G,c)$ - decision version

• $\bullet$

Oracle Input*: Sample from a distribution over $G*$ which is*

either $\varepsilon$-nearly uniform over $\{\chi\in$ $G*$ $|$ $u$ $\notin\ker\chi\}$ for a fixed element $u$

• -

or $\varepsilon$-nearly uniform over the whole $G$.

• $\bullet$

Task*: Decide which is the case.*

For simplicity, we denote the search version and the decision version of the $\varepsilon$-Random Linear Disequations$(G,c)$ by $\varepsilon$-$\mathrm{RLD}_{s}(G,c)$ and $\varepsilon$-$\mathrm{RLD}_{d}(G,c)$, respectively.

We now take $G=\mathbb{Z}_{2^{q}}^{n}$ for integers $q$ and $n$, and recall that $\varepsilon$-near uniformity and near uniformity are equivalent over the whole group $\mathbb{Z}^{n}_{2^{q}}$. If we can solve $\varepsilon$-$\mathrm{RLD}_{d}(H,2c)$ over subgroups $H$ of $\mathbb{Z}^{n}_{2^{q}}$, we decide which subgroup of $\mathbb{Z}^{n}_{2^{q}}$ contains the hidden shift $u$ by using $\varepsilon$-$\mathrm{RLD}_{d}(H_{i},2c)$ for all maximal subgroups $H_{i}$ of $\mathbb{Z}^{n}_{2^{q}}$. Thus, we can apply the same argument in Ref. Ivanyos (2008) except we use $\varepsilon$-near uniformity instead of near uniformity to obtain the following proposition.

Proposition 6**.**

The search version of the $\varepsilon$-Random Linear Disequations over $\mathbb{Z}^{n}_{2^{q}}$ with tolerance parameter $c$, $\varepsilon$-$\mathrm{RLD}_{s}(\mathbb{Z}^{n}_{2^{q}},c)$, can be reduced to $O(\mathrm{poly}(qn))$ instances of the decision version of the $\varepsilon$-Random Linear Disequations over subgroups $H$ of $\mathbb{Z}^{n}_{2^{q}}$ with tolerance parameter $2c$, $\varepsilon$-$\mathrm{RLD}_{d}(H,2c)$, in time $\mathrm{poly}(qn)$.

Now, it remains to prove that $\varepsilon$-$\mathrm{RLD}_{d}(\mathbb{Z}^{n}_{2^{q}},c)$ can be solved in time polynomial in $n$. With the same observation in Ref. Ivanyos (2008), it can be shown that deciding either a nearly uniform distribution on the whole group $\mathbb{Z}^{n}_{2^{q}}$ or on the subgroup consisting of all the elements which occur with probability at least $\varepsilon$ is equivalent to decide the existence of a polynomial with certain total degree which has the input samples as its zeros. If the distribution is the former case, we can always find such polynomial while the latter case is decidable in time polynomial in $n$ with a small constant error. Hence we have the following proposition which is almost the same as that in Ref. Ivanyos (2008).

Proposition 7**.**

$\varepsilon$-$\mathrm{RLD}_{d}(\mathbb{Z}^{n}_{2^{q}},c)$ can be solved in time $c(2nq)^{O(4^{q})}$ with one-sided error $1/3$. If $q$ and $c$ are fixed, $\varepsilon$-$\mathrm{RLD}_{d}(\mathbb{Z}^{n}_{2^{q}},c)$ can be solved in time polynomial in $n$.

IV Quantum algorithm for the continuous hidden shift problem on $\mathbb{R}^{n}$

For convenience, we assume that $\Delta=\sqrt{2^{q}}$ and $\delta=\Delta^{-1}$ for sufficiently large $q$ with $u_{i}^{2}\leq\Delta$ for all $i$ when $u=(u_{1},u_{2},\ldots,u_{n})\in\mathbb{R}^{n}$ is the hidden shift in Definition 1. Now, we are ready to construct our algorithm for solving the continuous hidden shift problem as follows.

Algorithm 8** (Continuous hidden shift problem on $\mathbb{R}^{n}$).**

Input: The oracle function $f:\mathbb{R}^{n}\times\mathbb{Z}_{2}\rightarrow S$ with the parameters $(\alpha,r,\xi)$ that hides the shift $u=(u_{1},\dots,u_{n})$ in $\mathbb{R}^{n}$.*

If $f(0,0)=f(0,1)$, then output [math]. 2. 1.

Prepare the initial state

[TABLE] 3. 2.

Apply the unitary operation corresponding to evaluation of the oracle function $f$ to the state. Then the resulting state becomes

[TABLE] 4. 3.

Perform the quantum Fourier transform, $QFT_{{\mathbb{Z}^{n}_{2^{q}}}\times\mathbb{Z}_{2}}$, and measure on the first two registers. 5. 4.

Consider the samples $(\tilde{y},1)$. 6. 5.

Use the values of $\tilde{y}$ which are non-orthogonal to $\tilde{u}$ among the samples $(\tilde{y},1)$ to find $\tilde{u}$. 7. 6.

Approximate $u$ with $\delta\tilde{u}$.

Output*: $\delta\tilde{u}\approx u$*

Remark 9**.**

We give explanations about each step in the above algorithm as follows.

• $\bullet$

In Step 2, the unitary operator $U_{f}$ can be defined as follows. For all $\tilde{x}\in\mathbb{Z}^{n}$ and $c\in\mathbb{Z}_{2}$,

[TABLE]

with $f_{0}(x,c)=f(x,c)$ and $\left\langle{f_{k}(x,c))}|{f_{l}(x,c)}\right\rangle=\delta_{kl}$. We can easily see that $U_{f}$ is unitary.

• $\bullet$

In Step 3, $QFT_{\mathbb{Z}^{n}_{2^{q}}\times\mathbb{Z}_{2}}$ means the quantum Fourier transform performing over the group $\mathbb{Z}^{n}_{2^{q}}\times\mathbb{Z}_{2}$. After applying $QFT_{\mathbb{Z}^{n}_{2^{q}}\times\mathbb{Z}_{2}}$, the state becomes

[TABLE]

• $\bullet$

In Step 5, we apply the similar method in Ref. Ivanyos (2008)* to solve the $\varepsilon$-random-linear-disequations problem and find $\tilde{u}$ such that \left\Arrowvert\delta\tilde{u}-u\right\Arrowvert\leq\delta/2.*

V Analysis of our algorithm

In this section, we analyze our quantum algorithm presented in the above section. We can precisely estimate the following $p_{\delta}$ which is from the Fourier transform of $\psi_{\delta}$:

[TABLE]

where

[TABLE]

Since by the promises of the oracle function $f$, the following three equalities hold,

[TABLE]

the probability $p_{\delta}(\tilde{y},1)$ becomes

[TABLE]

By using $\tilde{u}\in\mathbb{Z}^{n}_{2^{qn}}$ with \left\Arrowvert\delta\tilde{u}-u\right\Arrowvert\leq\delta/2, the probability $p_{\delta}(\tilde{y},1)$ can be rewritten as

[TABLE]

For the convenience of calculation, let $A=\cos{(2\pi\langle\tilde{u},\tilde{y}\rangle/2^{q})}.$ It follows from the triangle inequality and the properties of the oracle function $f$ that

[TABLE]

We obtain the first inequality by the condition 2 and 3 of the oracle function $f$ in Definition 1. The last inequality follows from the condition of $u$ and $\tilde{u}$, that is, $u\leq\Delta$ and \left\Arrowvert\delta\tilde{u}-u\right\Arrowvert\leq\delta/2. Note that we define the value $A\left(1-\frac{\alpha^{2}}{2^{q+3}}\right)^{\frac{|A|+A}{2A}}$ as zero when $A$ is zero.

Similarly, we also have

[TABLE]

Here, we also define the value $A\left(\left(1-2^{-\frac{q}{4}}\right)^{n}\left(1-\frac{\alpha^{2}}{2^{q+3}}\right)\right)^{\frac{|A|+A}{2A}}$ as zero when $A$ is zero.

Note that the probability that a sample $\tilde{y}$ is orthogonal to $\tilde{u}$ is not zero, which is different from the original hidden shift problem. However, it can be shown that the probability is small by exploiting the Lipschitz condition of the oracle function $f$. In particular, we can also prove that the samples $(\tilde{y},1)$ after the Fourier sampling subroutine are mostly non-orthogonal to $\tilde{u}$ when $q$ is a multiple of 4 (See Appendix A for the details).

In our algorithm, the samples $\tilde{y}$ are elements in the finite abelian group $\mathbb{Z}^{n}_{2^{q}}$, and the probability that a sample $\tilde{y}$ is orthogonal to $\tilde{u}$ is not zero even though it is negligible. This causes an obstacle to apply the method used in Ref. Ivanyos (2008) directly to our algorithm. In order to handle this difficulty, we have introduced the concept of the $\varepsilon$-nearly uniform distribution in Sec. III, and we now show that the sample distribution is $\varepsilon$-nearly uniform with a certain tolerance $c$ if the parameters $(\alpha,r,\xi)$ of the oracle function $f$ satisfy the following conditions.

Let $q$ be an integer such that $\alpha^{2}<2^{q+3}$. Then it can be shown that the values in Eq. (3) and Eq. (4) are positive. Suppose that the oracle function has the parameters $(\alpha,r,\xi)$ such that $r\leq\frac{\delta}{2}=\frac{1}{\sqrt{2^{q+2}}}$ and $\xi$ be a non-negative number less than both of the values in Eq. (1) and Eq. (2). Then we obtain the following theorem.

Theorem 10**.**

Let $q$ be an integer such that $\alpha^{2}<2^{q+3}$, where $\alpha$ is the Lipschitz constant of the oracle function $f$ with the parameters $(\alpha,r,\xi)$, and let $\delta=\frac{1}{\sqrt{2^{q}}}$. Let $S^{\prime}$ be the subset of $\mathbb{Z}^{n}_{2^{q}}$ consisting of all the elements which are not orthogonal to the specific element $\tilde{u}\in\mathbb{Z}^{n}_{2^{q}}$ with \left\Arrowvert\delta\tilde{u}-u\right\Arrowvert\leq\delta/2. Assume that $r=\frac{\delta}{2}$ and $\xi$ is a positive number less than both of the values in Eq. (1) and Eq. (2). Then there exists a real number $c>1$ such that the distribution of the samples $\tilde{y}$ in our algorithm is $\varepsilon$-nearly uniform over $S^{\prime}$ with tolerance $c$, where

[TABLE]

Proof.

Let $A=\cos({2\pi\langle\tilde{u},\tilde{y}\rangle/2^{q}}).$ Then $-1\leq A\leq 1$. If $\langle\tilde{u},\tilde{y}\rangle\neq 0$, by the assumption of $\xi$, we can show that

[TABLE]

is less than

[TABLE]

Indeed, since $\xi$ is less than or equal to the value in Eq. (2) which is non-zero when $\langle\tilde{u},\tilde{y}\rangle\neq 0$, we have

[TABLE]

or, equivalently,

[TABLE]

This inequality is also equivalent to

[TABLE]

which directly leads to the inequality we want to show. Hence, we can choose any real number $c$ between those two values in Eq. (5) and Eq. (6).

Note that $c$ is greater than $1$ because

[TABLE]

Now, we want to show that the distribution of the samples $\tilde{y}$ in our algorithm is $\varepsilon$-nearly uniform over $S^{\prime}$ with such $c$ for some $\varepsilon$.

Since $c$ is greater than the value in Eq. (5), it follows from the inequality in Eq. (3) that

[TABLE]

On the other hand, since $\xi$ is less than the value in Eq. (1), by combining the inequality in Eq. (4), we also obtain that

[TABLE]

where the second inequality comes from Eq. (1) and the inequality

[TABLE]

Thus,

[TABLE]

for $\tilde{y}\in S^{\prime}$. Now, let us consider

[TABLE]

Then $\varepsilon$ is clearly positive. Note that $A=\cos({2\pi\langle\tilde{u},\tilde{y}\rangle/2^{q}})=1$ for $\tilde{y}\in S-S^{\prime}$, that is, $\left<\tilde{u},\tilde{y}\right>=0$. So, the value in Eq. (2) must be zero which implies that $\xi=0$. Hence, in this case, the inequalities in Eq. (3) and Eq. (4) are saturated.

[TABLE]

Moreover, from the second inequality in Eq. (6), we also have

[TABLE]

since

[TABLE]

Therefore, it follows from the inequalities in Eqs. (10), (11) and (12) that the distribution of the samples $\tilde{y}$ in our algorithm is $\varepsilon$-nearly uniform over $S^{\prime}$ with tolerance $c$. $\square$

We can now prove the main theorem as follows.

Proof of Theorem 2 We can perform $QFT_{\mathbb{Z}^{n}_{2^{q}}\times\mathbb{Z}_{2}}$ in time $O(n^{2})$ and obtain the Fourier samples $\tilde{y}$. By Theorem 10, the distribution of the samples $\tilde{y}$ in our algorithm is $\varepsilon$-nearly uniform with a certain tolerance $c$ over the subset consisting of all the samples that are non-orthogonal to $\tilde{u}$. Thus, we obtain an instance of $\varepsilon$-$\mathrm{RLD}_{s}(\mathbb{Z}^{n}_{2^{q}},c)$ from the samples in the algorithm and we get $\tilde{u}$ as the solution of $\varepsilon$-$\mathrm{RLD}_{s}(\mathbb{Z}^{n}_{2^{q}},c)$. Since $q$ and $c$ are fixed in our algorithm, it follows from Proposition 6 and Proposition 7 that $\varepsilon$-$\mathrm{RLD}_{s}(\mathbb{Z}^{n}_{2^{q}},c)$ is reducible to $\varepsilon$-$\mathrm{RLD}_{d}(\mathbb{Z}^{n}_{2^{q}},2c)$ which can be solved in time polynomial in $n$. Thus, we can find the approximation $\delta\tilde{u}$ of the hidden shift $u$ in time polynomial in $n$ by solving $\varepsilon$-$\mathrm{RLD}_{d}(\mathbb{Z}^{n}_{2^{q}},2c)$ for the tolerance $c$. $\square$

Remark 11**.**

If $u$ lies on the $\delta$-grid, that is, $u=\delta\tilde{u}$, then $1-\frac{\alpha^{2}}{2^{q+3}}$ in the above all equations and all inequalities can be replaced by $1$. So, we can more briefly prove that the distribution of the samples $\tilde{y}$ in our algorithm is $\varepsilon$-nearly uniform over $S^{\prime}$ with tolerance $c$. Then we have an instance of the search version of $\varepsilon$-$\mathrm{RLD}(\mathbb{Z}^{n}_{2^{q}},c)$ and $\tilde{u}$ can be obtained by solving this problem. It follows from Proposition 6 that we can reduce the search version of $\varepsilon$-$\mathrm{RLD}(\mathbb{Z}^{n}_{2^{q}},c)$ to the decision version of $\varepsilon$-$\mathrm{RLD}(\mathbb{Z}^{n}_{2^{q}},2c)$ in time polynomial in $n$. Moreover, since $q$ and $c$ are fixed, by Proposition 7, $\varepsilon$-$\mathrm{RLD}_{d}(\mathbb{Z}^{n}_{2^{q}},2c)$ can be solved in time polynomial in $n$. Thus, we can efficiently find the $\frac{\delta}{2}$-approximation $\tilde{u}$ of $u$ by solving $\varepsilon$-$\mathrm{RLD}_{d}(\mathbb{Z}^{n}_{2^{q}},2c)$. Obviously, Theorem 2 and Theorem 10 can be considered as general versions of this case.

VI Conclusion and discussion

In this work, we have presented the continuous hidden shift problem over the continuous group $\mathbb{R}^{n}$, and have defined two types of the $\varepsilon$-random linear disequations problem, $\varepsilon$-$\mathrm{RLD}_{s}(G,c)$ and $\varepsilon$-$\mathrm{RLD}_{d}(G,c)$, in order to employ the similar approach in Ref. Ivanyos (2008) for finding the hidden shift in $\mathbb{Z}_{p^{k}}^{n}$. We have also shown that a quantum computer can efficiently solve the problem in time polynomial in $n$ by solving $\varepsilon$-$\mathrm{RLD}_{d}(\mathbb{Z}^{n}_{2^{q}},2c)$.

It has been known that the hidden shift problem over discrete groups can affect cryptosystems Alagic and Russell (2017); Bonnetain and Naya-Plasencia (2018). In particular, Bonnetain and Naya-Plasencia Bonnetain and Naya-Plasencia (2018) recently constructed an efficient quantum algorithm to solve the hidden shift problem over the abelian group $\mathbb{Z}_{2^{p}}^{w}$, and proved that the algorithm can be used to establish a quantum attack in a cryptosystem claimed to be secure quantumly. Thus, it is natural to consider the question about whether the continuous version of the hidden shift problem can also have any crypto-related applications. In fact, a similar consideration has been involved in the previous results. In Refs. Eisenträger et al. (2014); Biasse and Song (2016), it has been shown that an efficient quantum algorithm for the continuous hidden subgroup problem on $\mathbb{R}^{n}$ induces a quantum attack on cryptosystems based on the hardness of finding a short generator of a principal ideal, although the original hidden subgroup problem on $\mathbb{R}^{n}$ cannot provide such an attack to break them Hallgren (2005, 2007). Inspired by these results, we expect that our result could have applications related to cryptography.

Furthermore, we can also try to consider continuous versions of other algebraic problems with hidden structure such as hidden symmetry subgroup problem, hidden polynomial problem, and so on.

Acknowledgements.

We would like to thank Fang Song for fruitful discussion. This research was supported by the National Research Foundation of Korea grant funded by the Ministry of Science and ICT (MSIT) (Grant no. NRF-2019R1A2C1006337) and (Grant no. NRF-2020M3E4A1079678). E.B. acknowledges support from the National Research Foundation of Korea grant funded by the MSIT (Grant no. NRF-2019K1A3A1A12071493), and S.L. acknowledges support from the MSIT, under the Information Technology Research Center support program (IITP-2021-2018-0-01402) supervised by the Institute for Information & Communications Technology Planning & Evaluation, and the Quantum Information Science and Technologies program of the National Research Foundation of Korea funded by the MSIT (Grant no. NRF-2020M3H3A1105796).

Appendix A The sample $\tilde{y}$ is mostly orthogonal to $\tilde{u}$

In this section, we show that the probability that a sample $\tilde{y}$ is orthogonal to $\tilde{u}$ is small enough when $q$ is a sufficiently large multiple of 4. In order to do that, we consider the case when the number of $\tilde{y}$’s satisfying the equation $\left<\tilde{u},\tilde{y}\right>=0$ attains a maximum value. Note that we get an approximation value $\delta\tilde{u}$ of $u$ with \left\Arrowvert\delta\tilde{u}-u\right\Arrowvert\leq\delta/2 by means of our algorithm in Sec. IV.

Proposition 12**.**

Let $q=4k$ for a positive integer $k$ and let $\Delta=\sqrt{2^{q}}$ such that $u_{i}^{2}\leq\Delta$ for all $i$. Then $\tilde{u}=(\tilde{u}_{1},\tilde{u}_{2},\ldots,\tilde{u}_{n})\in\mathbb{Z}_{2^{q}}^{n}$ satisfies $\tilde{u}_{i}\leq 2^{3k}$ for all $i$. The number of $\tilde{y}$’s which are orthogonal to $\tilde{u}$ in $\mathbb{Z}_{2^{q}}^{n}$ has the maximum value, $2^{k(4n-1)}$, when $\tilde{u}=(2^{3k},2^{3k},\dots,2^{3k})$. Moreover, the probability that $\tilde{y}\in\mathbb{Z}_{2^{q}}^{n}$ is orthogonal to $\tilde{u}$ is at most $1/2^{k}$ in our algorithm.

In order to prove Proposition 12, we first show that if $\tilde{u}$ has the same coordinates, then the number of $\tilde{y}$’s satisfying the equation $\left<\tilde{u},\tilde{y}\right>=0$ in $\mathbb{Z}_{2^{q}}^{n}$ becomes less than or equal to the number in the case that we make one of the same coordinates of $\tilde{u}$ twice.

Lemma 13**.**

For any positive integers $n$ and $k$, let $q=4k$. The number of $\tilde{y}$’s which are orthogonal to $\tilde{u}=(\tilde{u}_{1},\dots,\tilde{u}_{n})$ with $\tilde{u}_{i}=\tilde{u}_{j}$ for some $i\neq j$, is less than or equal to the number of $\tilde{y}$’s which are orthogonal to $\tilde{u}^{\prime}=(\tilde{u}_{1},\dots,2\tilde{u}_{i},\dots,\tilde{u}_{n})$ or $(\tilde{u}_{1},\dots,2\tilde{u}_{j},\dots,\tilde{u}_{n})$.

Proof.

Without loss of generality, we may assume that $\tilde{u}_{1}=\tilde{u}_{2}$. We want to show that the number of $\tilde{y}$ satisfying $\left<\tilde{u},\tilde{y}\right>\equiv 0\pmod{2^{q}}$ for $\tilde{u}=(\tilde{u}_{1},\tilde{u}_{1},\tilde{u}_{3},\dots,\tilde{u}_{n})$ is less than or equal to the number of $\tilde{y}$ satisfying $\left<\tilde{u}^{\prime},\tilde{y}\right>\equiv 0\pmod{2^{q}}$ for $\tilde{u}^{\prime}=(2\tilde{u}_{1},\tilde{u}_{1},\tilde{u}_{3},\dots,\tilde{u}_{n})$. We can establish an injective function from the solutions $\tilde{y}=(\tilde{y}_{1},\dots,\tilde{y}_{n})$ of the equation $\left<\tilde{u},\tilde{y}\right>=\sum_{i=1}^{n}\tilde{u}_{i}\tilde{y}_{i}\equiv 0\pmod{2^{q}}$ to the solutions $\tilde{y}^{\prime}=(\tilde{y}_{1}^{\prime},\dots,\tilde{y}_{n}^{\prime})$ of the equation $\left<\tilde{u}^{\prime},\tilde{y}^{\prime}\right>\equiv 0\pmod{2^{q}}$ as follows.

[TABLE]

Then it can be easily shown that $\left<\tilde{u},\tilde{y}\right>=\left<\tilde{u}^{\prime},\tilde{y}^{\prime}\right>$. In fact, if $\tilde{y}_{1}=2m_{1}$, then

[TABLE]

Similary, if $\tilde{y}_{1}=2m_{1}-1$, then

[TABLE]

$\square$

For the next step, we show that if all coordinates of $\tilde{u}$ have the form of $2^{t}$, the number of $\tilde{y}$’s which are orthogonal to $\tilde{u}$ becomes less than or equal to the number in the case that we change the smallest coordinates of $\tilde{u}$ to the second smallest one as in the following lemma.

Lemma 14**.**

For any positive integers $n$ and $k$, let $q=4k$ and $\tilde{u}=(2^{t_{1}},\dots,2^{t_{n}})$ such that $t_{i}\leq 3k$ for all $i$ and $t_{i}$’s are all distinct, say $t_{i_{1}}<\cdots<t_{i_{n}}$ with $i_{j}\in[n]:=\{1,2,\ldots,n\}$. The number of $\tilde{y}$’s which are orthogonal to $\tilde{u}=(2^{t_{1}},\dots,2^{t_{n}})$ in $\mathbb{Z}_{2^{q}}^{n}$ is less than or equal to the number of $\tilde{y}$’s which are orthogonal to $\tilde{u}^{\prime}=(\tilde{u}_{1}^{\prime},\dots,\tilde{u}_{n}^{\prime})$ in $\mathbb{Z}_{2^{q}}^{n}$ with

[TABLE]

Proof.

Suppose that $\tilde{u}_{i}^{\prime}$’s are all distinct. Without loss of generality, assume that $t_{1}<t_{2}<\cdots<t_{n}$, where $t_{i}\leq 3k$ for all $i$. Then we can construct an injective functions from the solutions $\tilde{y}=(\tilde{y}_{1},\dots,\tilde{y}_{n})$ of the equation $\left<\tilde{u},\tilde{y}\right>\equiv 0\pmod{2^{q}}$ for $\tilde{u}=(2^{t_{1}},\dots,2^{t_{n}})$ to the solutions $\tilde{y}^{\prime}=(\tilde{y}_{1}^{\prime},\dots,\tilde{y}_{n}^{\prime})$ of the equation $\left<\tilde{u}^{\prime},\tilde{y}^{\prime}\right>\equiv 0\pmod{2^{q}}$ for $\tilde{u}^{\prime}=(2^{t_{2}},2^{t_{2}},\dots,2^{t_{n}})$ as follows.

[TABLE]

Note that $\tilde{y}_{1}$ is a multiple of $2^{t_{2}-t_{1}}$. Indeed, since the condition $\left<\tilde{u},\tilde{y}\right>=0\pmod{2^{q}}$ implies that

[TABLE]

for $l=0,1,\ldots,\sum_{i=1}^{n}\tilde{u}_{i}-1$, it is clear that $\tilde{y}_{1}=2^{t_{2}-t_{1}}\mu$ for some positive integer $\mu$. Hence, we can see that $\tilde{y}_{1}^{\prime}=2^{t_{1}-t_{2}}\tilde{y}_{1}$ must be a positive integer.

In addition, we have

[TABLE]

$\square$

On the other hand, we can also consider the case that $\tilde{u}$ has at least one coordinate which cannot be written as the form of $2^{t}$. In this case, we have the following lemma.

Lemma 15**.**

For any positive integers $n$ and $k$, let $q=4k$ and $\tilde{u}\in\mathbb{Z}_{2^{q}}^{n}$. If there is $j\in[n]$ such that $\tilde{u}_{j}=v2^{t}$ with $\mathrm{gcd}(v,2)=1$ and $t\geq 0$, the number of $\tilde{y}$ orthogonal to $\tilde{u}$ in $\mathbb{Z}_{2^{q}}^{n}$ is exactly the same as the number of $\tilde{y}$’s which are orthogonal to $\tilde{u}^{\prime}=(\tilde{u}_{1}^{\prime},\dots,\tilde{u}_{n}^{\prime})$ in $\mathbb{Z}_{2^{q}}^{n}$ with

[TABLE]

Proof.

Without loss of generality, we may assume that $\tilde{u}_{1}=v2^{t}$ for some $v$ coprime with 2 and non-negative integer $t$. Then we can construct a one-to-one correspondence between the solutions $\tilde{y}=(\tilde{y}_{1},\dots,\tilde{y}_{n})$ of the equation $\left<\tilde{u},\tilde{y}\right>\equiv 0\pmod{2^{q}}$ for $\tilde{u}=(v2^{t},\tilde{u}_{2},\dots,\tilde{u}_{n})$ to the solutions $\tilde{y}^{\prime}=(\tilde{y}_{1}^{\prime},\dots,\tilde{y}_{n}^{\prime})$ of the equation $\left<\tilde{u}^{\prime},\tilde{y}^{\prime}\right>\equiv 0\pmod{2^{q}}$ for $\tilde{u}^{\prime}=(2^{t},\tilde{u}_{2},\dots,\tilde{u}_{n})$ as follows.

[TABLE]

Since $v$ is invertible in $\mathbb{Z}_{2^{q}}^{n}$, the above map is a bijection. In addition, we clearly have

[TABLE]

This completes the proof. $\square$

Combining the above lemmas, we finally prove that the number of $\tilde{y}$’s orthogonal to $\tilde{u}$ attains a maximum value when all coordinates of $\tilde{u}$ are $2^{3k}$, which is the maximum of its each coordinate. Thus we can get an upper bound on the probability that $\tilde{y}$ is orthogonal to $\tilde{u}$.

A.1 Proof of Proposition 12

We first note that for any $\tilde{u}=(\tilde{u}_{1},\tilde{u}_{2},\ldots,\tilde{u}_{n})\in\mathbb{Z}_{2^{q}}^{n}$, each coordinate $\tilde{u}_{j}$ can be expressed as $v_{j}2^{t_{j}}$ for some $v_{j}$ comprime to 2 and non-negative integer $t_{j}$. Thus by repeatedly using Lemma 15, we can know that the number of solutions $\tilde{y}$ of the equation $\left<\tilde{u},\tilde{y}\right>\equiv 0\pmod{2^{q}}$ is the same as the number in the case that $\tilde{u}=(2^{t_{1}},2^{t_{2}},\ldots,2^{t_{n}})$. Furthermore, $u_{i}\leq 2^{k}$ for all $i\in[n]$ by the assumption, and

[TABLE]

since $\delta=1/2^{2k}$ and $\delta\tilde{u}$ is a $\frac{\delta}{2}$-approximation of $u$. Thus it is clear that $\tilde{u}_{i}\leq 2^{3k}$ for all $i\in[n]$.

Now, let us consider the case that $\tilde{u}=(2^{t_{1}},2^{t_{2}},\ldots,2^{t_{n}})$ with $t_{i}\leq 3k$ for all $i$. Without loss of generality, we may assume that $t_{1}\leq\cdots\leq t_{n}$. If $t_{i}$’s are all distinct, it follows from Lemma 14 that the number of the solutions $\tilde{y}$ of the equation $\left<\tilde{u},\tilde{y}\right>\equiv 0\pmod{2^{q}}$ is less than or equal to the number of the solutions in the case that $\tilde{u}=(2^{t_{2}},2^{t_{2}},2^{t_{3}}\ldots,2^{t_{n}})$. Therefore, by exploiting Lemma 13 and Lemma 14 repeatedly, it can be shown that the number of $\tilde{y}$’s which are orthogonal to $\tilde{u}$ in $\mathbb{Z}_{2^{q}}^{n}$ has the maximum value when $\tilde{u}=(2^{3k},\dots,2^{3k})$.

For the next step, we want to calculate the exact number of $\tilde{y}$’s satisfying $\left<\tilde{u},\tilde{y}\right>\equiv 0\pmod{2^{q}}$ when $\tilde{u}=(2^{3k},\dots,2^{3k})$. As a matter of fact, we can prove that the number of integer solutions $\tilde{y}$ of the equation $2^{3k}\tilde{y}_{1}+\cdots+2^{3k}\tilde{y}_{n}\equiv 0\pmod{2^{q}}$ is equal to

[TABLE]

for any $i$ by induction on $n\geq 1$. To do this, we need to show the following two claims.

Claim 1**.**

Let $n\geq 0$, $L$, and $l$ any fixed positive integers. Then

[TABLE]

Proof of Claim 1 We use the induction on $n$. If $n=0$, the statement is obviously true. Now we suppose that Eq. (14) holds for a certain $n\geq 0$. From the Pascal’s relation, we observe that

[TABLE]

and hence Eq. (14) holds for $n+1$ as well. Here, the last equality holds since

[TABLE]

by employing the induction hypothesis $l$ times. $\square$

This claim implies that for any fixed positive integers, $n\geq 0$, $L$, $L^{\prime}$, and $l$,

[TABLE]

By Claim 1, we can prove the following claim, which can be directly used to prove the Eq. (13).

Claim 2**.**

For each $i\in\{0,1,\ldots,2^{3k}-1\}$ and $n\geq 1$,

[TABLE]

Proof of Claim 2 We prove this claim by induction on $n\geq 1$. It is easy to check that the statement is true for $n=1$. Now, suppose that it is true for a fixed $n\geq 1$. It follows from the Pascal’s relation that

[TABLE]

Applying the Pascal’s relation to the second binomial coefficient term in the first summation, we obtain from tedious but straightforward calculations that

[TABLE]

where the second and the last equalities come from the induction hypothesis and Claim 1. Continuing this procedure $2^{4k}$ times, we can show that

[TABLE]

which completes the proof. $\square$

Now, we show that the number of $\tilde{y}$’s satisfying $2^{3k}\tilde{y}_{1}+\cdots+2^{3k}\tilde{y}_{n}\equiv 0\pmod{2^{4k}}$ is

[TABLE]

which equals $2^{3k}2^{4k(n-1)}$, or equivalently, $2^{k(4n-1)}$ by Claim 2.

Let us choose a sufficiently large number $q=4k$ such that $n<2^{k}$, let

[TABLE]

for each $l\in[n\cdot 2^{3k}-1]\cup\{0\}$, and let

[TABLE]

for each $i=1,\dots,n$. Then the number of integer solutions $\tilde{y}\in\mathbb{Z}_{2^{4k}}^{n}$ of the equation $2^{3k}\tilde{y}_{1}+\cdots+2^{3k}\tilde{y}_{n}\equiv 0\pmod{2^{4k}}$ is

[TABLE]

which can be exactly calculated as follows.

For each $t\cdot 2^{3k}\leq l\leq(t+1)\cdot 2^{3k}-1$ ($t=0,1,\ldots,n-1$), by the inclusion-exclusion principle, we have

[TABLE]

where the last inequality is due to the fact that for $l<j2^{3k}$,

[TABLE]

Let

[TABLE]

We now show that

[TABLE]

where the second equality is due to Claim 2.

Observe that

[TABLE]

where the second equality comes from the Pascal’s relation. It follows from Claim 1 (or Eq.  (15)) and Claim 2 that

[TABLE]

Since the number of all possible $\tilde{y}$ is $2^{4kn}$, the probability that $\tilde{y}\in\mathbb{Z}_{2^{4k}}^{n}$ is orthogonal to $\tilde{u}$ is at most $2^{k(4n-1)}/2^{4kn}$ which is equal to $1/2^{k}$.