Gap SVP n and Gap CVP n NP

Gap. SVP n and Gap. CVP n NP ∩ co. NP are in Dorit Aharonov Oded Regev 1

Lattices • Basis: v 1, …, vn vectors in Rn • The lattice L is 2 v 1 v 1+v 2 v 1 L={a 1 v 1+…+anvn| ai integers} 2 v 2 -v 1 2 v 2 -2 v 1 0 2

Shortest Vector Problem (SVP) v 2 v 1 0 • Gap. SVPb: Given a lattice, decide if the length of the shortest vector is: – YES: less than 1 – NO: more than b 3

Closest Vector Problem (CVP) v v 2 v 1 0 • Gap. CVPb: Given a lattice and a point v, decide if the distance of v from the lattice is: – YES: less than 1 – NO: more than b 4 • Gap. SVPb is easier than Gap. CVPb [Goldreich. Micciancio. Safra. Seifert 99]

Known Results • Polytime algorithms for gap 2 n loglogn/logn [LLL 82, Schnorr 87, Ajtai. Kumar. Sivakumar 02] • NP-hardness is known for: – Gap. CVP: 2^(log 1 -en) [Dinur. Kindler. Safra 03] – Gap. SVP: 2 [Micciancio 98] 1 2^(log 1 -en) NP-hard ? n Cryptography [Ajtai 96, Ajtai. Dwork 97…] 2 n loglogn/logn P 5

Known Results Limits on Inapproximability • Gap. CVPn 2 NP∩co. NP [Lagarias. Lenstra. Schnorr 90, Banaszczyk 93] • Gap. CVP n 2 NP∩co. AM [Goldreich. Goldwasser 98] • Gap. SVP n 2 NP∩co. QMA [Aharonov. Regev 03] 1 2^(log 1 -en) NP-hard n n NP∩co. NP NP∩co. AM NP∩co. QMA 2 n loglogn/logn P 6

Main Result Theorem: Gap. CVP n 2 NP∩co. NP 2^(log 1 -en) NP-hard n n NP∩co. NP NP∩co. AM NP∩co. QMA 2 n loglogn/logn P NP∩co. NP 7

Proof of Gap. CVP n in co. NP 8

Our Goal Given: - Lattice L (by v 1, v 2, …, vn) - Point v We want: A witness for the fact that v is far from L 9

Overview Step 1: Define f • Its value depends on the distance from L: – Almost zero if distance > √n – More than zero if distance < √log Step 2: Encode f Show that the function f has a short description Step 3: Verify f Verify that the function is non-negligible close to L Pointwise approximation lemma CVPP approximation algorithm 10

Step 1: Define f 11

The function f Consider the Gaussian: Periodize over L: Normalize by g(0): 12

The function f (pictorially) 13

f distinguishes between far and close vectors (a) d(x, L)≥√n f(x)≤ 2 -Ω(n) (b) d(x, L)≤√logn f(x)>n-5 Proof: (a) Banaszczyk 93 (simple for one Gaussian) (b) Suffices to show 14

Step 2: Encode f 15

The function f (again) Let’s consider its Fourier transform ! 16

is a probability measure Claim: f is a probability measure on L* Proof: g is a convolution of a Gaussian and δL 17

f is an expectation In fact, it is an expectation of a real variable between -1 and 1: Che rnof f 18

Encoding f Pick W=(w 1, w 2, …, w. N) with N=poly(n) according to the f distribution on L* (Chernoff) This is true even pointwise! 19

A Pointwise Approximation Lemma: Let f be a function on an Abelian group. If f is a probability measure then In fact, it is enough that f¸ 0 and ∑f(w) < poly. Note the difference between this and truncating the small Fourier coefficients [Kushilevitz. Mansour 91] 20

Back to Lattices: the Approximating Function (with N=1000 dual vectors) 21

This concludes Step 2: Encode f The encoding is a list W of vectors in L* f. W(x) ≈ f(x) 22

Interlude: An Immediate Corollary Gap. CVPP Solve Gap. CVP on a preprocessed lattice (allowed infinite computational power, but before seeing v) Algorithm for Gap. CVPP: Prepare the function f. W in advance; When given v, calculate f. W(v). √(n/logn) approximation algorithm, improving the previous n-approximation [Regev 03] 23

Back to Gap. CVP√n in co. NP The input is L and v The witness is a list of vectors W = (w 1 , … , w. N) Verify that f. W is non-negligible near L 24

Step 3: Verify f. W 25

The Verifier (First Attempt) Accepts iff 1 1. f. W (v) < n-10, and 0. 0 2. f. W(x) > n-5 for all x within distance √logn from L • Completeness and soundness would follow • But: how to check (2) ? - First check that f. W is periodic over L (true if W in L*) - Then check non-negligibility around origin • We don’t know how to do this for distance √logn • We do this for distance 0. 01 26

The Verifier (Second Attempt) Accepts iff 1. f. W (v) < n-10, and 2. w 1, …, w. N L*, and 3. 2 implies that f. W is periodic on L: 27

The Verifier (Second Attempt) Accepts iff 1. f. W (v) < n-10, and 2. w 1, …, w. N L*, and 3. f. W(x) 3 implies that f. W is at least. 8 within distance. 01 of the origin: -. 01 0 . 01 28

The Final Verifier Accepts iff 1. f. W (v) < n-10, and 2. w 1, …, w. N L*, and 3. ||WWT||<N where 3 checks that in any direction the w’s are not too long: 29

The Final Verifier Accepts iff 1. f. W (v) < n-10, and 2. w 1, …, w. N L*, and 3. ||WWT||<N where 30

Soundness If d(v, L)<0. 01 then any W fails one of the tests 1. f. W (v) < n-10 2. w 1, …, w. N 2 L* 3. ||WWT||<N Proof: 2 & 3 not 1 ||WWT||<N f. W(x) > 0. 8 for |x|<0. 01 31

Completeness If d(v, L)>√n there exists a witness W s. t. : 1. 2. 3. f. W (v) < n-10 w 1, …, w. N L* ||WWT||<N Proof: Pick W=w 1, …, wn from L* according to the f distrib. 1, 2 3 follows from: [Banaszczyk 93] 32

Conclusion • Main result: Gap. CVP n 2 NP ∩ co. NP • An algorithm for Gap. CVPP√(n/logn) • An interesting lemma about point-wise approximation by Fourier Sparse functions 33

Open Problems • Can the containment in NP∩co. NP be improved to √(n/logn)? • Can it be improved beyond? (seems that this requires ‘looking into the lattice’) • Can we extend this method to other problems, like Graph Isomorphism ? • Other uses for the pointwise approximation lemma? • Other ‘quantum inspired’ results ? 34

Thanks !! 35