Finding dense sub-lattices as low-energy states of a Hamiltonian

TL;DR

A classical polynomial-time algorithm that takes an arbitrary input basis and preprocesses it into inputs suited to quantum algorithms, and demonstrates the performance of a Quantum Approximate Optimization Algorithm for low dimensions, highlighting the influence of a good preprocessed input basis.

Abstract

Lattice-based cryptography has emerged as one of the most prominent candidates for post-quantum cryptography, projected to be secure against the imminent threat of large-scale fault-tolerant quantum computers. The Shortest Vector Problem (SVP) is to find the shortest non-zero vector in a given lattice. It is fundamental to lattice-based cryptography and believed to be hard even for quantum computers. We study a natural generalization of the SVP known as the $K$-Densest Sub-lattice Problem ($K$-DSP): to find the densest $K$-dimensional sub-lattice of a given lattice. We formulate $K$-DSP as finding the first excited state of a Z-basis Hamiltonian, making $K$-DSP amenable to investigation via an array of quantum algorithms, including Grover search, quantum Gibbs sampling, adiabatic, and Variational Quantum Algorithms. The complexity of the algorithms depends on the basis through which the input lattice is presented. We present a classical polynomial-time algorithm that takes an arbitrary input basis and preprocesses it into inputs suited to quantum algorithms. With preprocessing, we prove that $O(KN^2)$ qubits suffice for solving $K$-DSP for $N$ dimensional input lattices. We empirically demonstrate the performance of a Quantum Approximate Optimization Algorithm $K$-DSP solver for low dimensions, highlighting the influence of a good preprocessed input basis. We then discuss the hardness of $K$-DSP in relation to the SVP, to see if there is reason to build post-quantum cryptography on $K$-DSP. We devise a quantum algorithm that solves $K$-DSP with run-time exponent $(5KN\log{N})/2$. Therefore, for fixed $K$, $K$-DSP is no more than polynomially harder than the SVP.

Figures (8)

• Figure 1: The 3D lattice consists of sheets of stacked hexagonal honeycombs. The intersection of the red plane with the lattice defines a sub-lattice. The horizontal plane on the left carves a denser sub-lattice compared to the vertical plane on the right, evident from the larger number of intersection points in the red disk.
• Figure 2: Representation of the 2-Densest Sub-lattice Problem for $N =3$. The red arrows represent a 3D input bad basis. One solution to the problem for $K = 2$ is given by the blue short vectors that span a 2D square lattice. The axis points in the positive direction.
• Figure 3: Representation of the quantum circuit for the QAOA. The initial state is a superposition of all possible configurations. Then, $p$ layers are applied, each of them composed of the cost Hamiltonian $H$, which separates the states by their phase, and the rotation operator with the mixer Hamiltonian ($H_M$) in the exponent, transforming the phase into amplitude. In the end, the states of the qubits are measured, the output is post-processed, and the cost function is calculated using the initial parameters $(\boldsymbol{\gamma}, \boldsymbol{\beta})$. The angles are then updated, and the process repeats until a predefined stopping criterion, such as a target approximation ratio or stability in parameter updates, is satisfied.
• Figure 4: Diagram representing two $4\times N$ dimensional grids of qubits. Each of them is associated with one of the vectors that span the sub-lattice of dimension $K$. The columns of the 2D array represent the integer values that can take each of the coefficients $x_i$ and $y_j$. The columns, each of which represents a qudit, are composed of four qubits.
• Figure 5: The number of occurrences (left y-axis) and probability (right y-axis) represented by the blue bars for each eigenvalue of the Hamiltonian in Eq. (\ref{['eq:ham_pen']}) for a 3D lattice. The number of layers increases from left to right with values set to $p = 0,1,3,5$. The figures include the average energy calculated from $10,000$ samples. The red dashed line points out the location of the solution of the $K$-DSP equivalent to the densest sub-lattice. (a) uses the 3D good basis as input, while (b) uses a worse basis achieved by multiplying the good basis by a unimodular matrix.

Theorems & Definitions (24)

• Definition 1
• Definition 2
• Example 1
• Definition 3
• Lemma 1: Gap-free-LLL
• proof
• Lemma 2: Dual of sub-lattice
• proof
• Lemma 3: Gap-dimension-reduction
• proof