Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Quantum-Classical Hybrid Algorithm for Solving the Learning-With-Errors Problem on NISQ Devices

Muxi Zheng, Jinfeng Zeng, Wentao Yang, Pei-Jie Chang, Quanfeng Lu, Bao Yan, Haoran Zhang, Min Wang, Shijie Wei, Gui-Lu Long

TL;DR

This work addresses the hardness of the LWE-decision problem for post-quantum cryptography by proposing a quantum-classical hybrid (HAWI) that maps LWE to the SVP via an SIS-based lattice reduction and encodes lattice vectors into an Ising Hamiltonian. Short vectors correspond to low-energy eigenstates, enabling extraction on NISQ devices with a theoretical qubit bound of $N \le m(m+1)$ and runtime that hinges on the chosen quantum eigensolver (e.g., QAOA). The authors provide complexity bounds, analyze the potential quantum advantage over classical BKZ, and demonstrate both numerical simulations and a 5-qubit IBM device experiment solving a small 2D-LWE instance, along with heuristic parameter strategies to improve QAOA performance. While the results illustrate feasibility on near-term hardware and offer practical guidance for resource estimation and parameter design, they also acknowledge that large-scale threat to post-quantum cryptography remains uncertain and highlight future directions including alternative quantum solvers and related lattice techniques. Overall, the paper contributes a concrete, resource-bounded quantum framework for lattice-based LWE tasks and lays groundwork for scalable exploration on future quantum devices.

Abstract

The Learning-With-Errors (LWE) problem is a fundamental computational challenge with implications for post-quantum cryptography and computational learning theory. Here we propose a quantum-classical hybrid algorithm with Ising model to address LWE, transforming it into the Shortest Vector Problem and using variable qubits to encode lattice vectors into an Ising Hamiltonian. By identifying low-energy Hamiltonian levels, the solution is extracted, making the method suitable for noisy intermediate-scale quantum devices. The required number of qubits is less than $m(m+1)$, where $m$ is the number of samples. Our heuristic algorithm's time complexity depends on the specific quantum eigensolver used to find low-energy levels, and the performance when using the Quantum Approximate Optimization Algorithm is investigated. We validate the algorithm by solving a $2$-dimensional LWE problem on a $5$-qubit quantum device, demonstrating its potential for solving meaningful LWE instances on near-term quantum devices.

Quantum-Classical Hybrid Algorithm for Solving the Learning-With-Errors Problem on NISQ Devices

TL;DR

This work addresses the hardness of the LWE-decision problem for post-quantum cryptography by proposing a quantum-classical hybrid (HAWI) that maps LWE to the SVP via an SIS-based lattice reduction and encodes lattice vectors into an Ising Hamiltonian. Short vectors correspond to low-energy eigenstates, enabling extraction on NISQ devices with a theoretical qubit bound of and runtime that hinges on the chosen quantum eigensolver (e.g., QAOA). The authors provide complexity bounds, analyze the potential quantum advantage over classical BKZ, and demonstrate both numerical simulations and a 5-qubit IBM device experiment solving a small 2D-LWE instance, along with heuristic parameter strategies to improve QAOA performance. While the results illustrate feasibility on near-term hardware and offer practical guidance for resource estimation and parameter design, they also acknowledge that large-scale threat to post-quantum cryptography remains uncertain and highlight future directions including alternative quantum solvers and related lattice techniques. Overall, the paper contributes a concrete, resource-bounded quantum framework for lattice-based LWE tasks and lays groundwork for scalable exploration on future quantum devices.

Abstract

The Learning-With-Errors (LWE) problem is a fundamental computational challenge with implications for post-quantum cryptography and computational learning theory. Here we propose a quantum-classical hybrid algorithm with Ising model to address LWE, transforming it into the Shortest Vector Problem and using variable qubits to encode lattice vectors into an Ising Hamiltonian. By identifying low-energy Hamiltonian levels, the solution is extracted, making the method suitable for noisy intermediate-scale quantum devices. The required number of qubits is less than , where is the number of samples. Our heuristic algorithm's time complexity depends on the specific quantum eigensolver used to find low-energy levels, and the performance when using the Quantum Approximate Optimization Algorithm is investigated. We validate the algorithm by solving a -dimensional LWE problem on a -qubit quantum device, demonstrating its potential for solving meaningful LWE instances on near-term quantum devices.
Paper Structure (12 sections, 1 theorem, 40 equations, 6 figures, 5 tables, 1 algorithm)

This paper contains 12 sections, 1 theorem, 40 equations, 6 figures, 5 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Results
  3. The framework of the algorithm
  4. Complexity Analysis
  5. Performance of HAWI
  6. Numerical and experimental results of QAOA
  7. Discussion
  8. methods
  9. The LWE problem
  10. Solving the LWE-decision problem via SIS approach
  11. LLL algorithm and BKZ algorithm
  12. Strategy for initializing parameters

Key Result

Theorem 1

If we use qubits to encode $(m-i)$-th LLL basis, where $i=0,1, ... , m-1$, and $\alpha_i$ satisfies the following recursive equation with initial condition $\alpha_0=1$, then the Hamiltonian in Eq. (eq4) is capable of including the shortest non-zero vector in the lattice, where $\delta\in(1/4, 1)$ is the parameter in the LLL algorithm.

Figures (6)

  • Figure 1: The workflow of the HAWI algorithm for the LWE-decision problem. Firstly, we use classical techniques to transfer the LWE samples into LLL reduction basis. Secondly, we construct the Ising Hamiltonian of the LWE problem and utilize quantum optimization algorithm (such as QAOA) to find the shorter vector which is closer to the solution. Finally, we use the shorter vector to calculate the inner product of the vectors and determine which distribution it satisfies to output the decision result of the LWE problem.
  • Figure 2: Numerical results regarding the performance of our algorithm. (a) Probability distribution of inner product $I_p = \braket{\mathbf{v}, \mathbf{c}}_q$ on $M$ instances. Green line represents the results from the instances sampled according to $L_{s,\chi}$, while the red line represents the results from the instances following uniform distribution. Parameters: $n=18$, $m=36$, $\sigma=3$, $q=331$. (b) The success probability of finding the shortest vector in the lattice when we use $z$ qubits to encode each LLL basis. In the simulation process, we discard the instances that the shortest vector in the lattice is already contained in the LLL basis. We compare this result with the BKZ algorithm with different block $k$. Parameters: $n=15$, $m=30$, $q=101$. (c) Upper: With the growth of the problem size $n$, the proportion of instances that $\mathbf{v}_0$ is shorter than $\mathbf{b}_0$. Lower: With the growth of $n$ ($m$), the success probability of finding the shortest vector in the lattice when we use $z$ qubits to encode each LLL basis. (d) The success probability of QAOA with different problem size $n$. The green line represents the result by utilizing our heuristic strategy for parameters initialization, while the dotted blue line represents the results by randomly choosing the initial parameters. The number of qubits is $n_{\text{q}} = m-1 = 2n-1$, and layers of QAOA are chosen as $p=n_{\text{q}}$. The error bar on each data point $(n_i,P_i)$ extends from $(n_i,P_{i}^{\min} )$ to $(n_i, P_i^{\max})$, where $P_i^{\min}$ and $P_i^{\max}$ are the minimum and maximum value among $R$ simulation results $P_{ij}$, $j=1,2, ... , R$ for each point.
  • Figure 3: Numerical simulation and experimental results. (a) Quantum circuit of HAWI-QAOA. (b) The energy surface formed by $E(\beta, \gamma)=\braket{\phi_0|U^\dagger(\beta,\gamma) HU(\beta,\gamma)|\phi_0}$. (c) Probability distribution of each computational basis, $\beta=3.88$, $\gamma=6.19$, where Hamiltonian reaches minimum. The white block represents 0 and colored block represents 1 in $x$-tick labels. $\ket{01000}$ corresponds the shortest vector in the lattice. (d) Optimization process shown in parameter space, corresponding to that in (b). The red curve and the blue curve represent experimental results and numerical simulation results respectively. The initial parameters are $\beta=4.40, \gamma=6.12$ with expected $E=25.44$. After iterations, $E=14.15$ with $\beta=4.00, \gamma=6.18$. (e) Expectation value of Hamiltonian for each iteration. The red curve and the blue curve represent experimental results and numerical simulation results respectively. (f) The experimental results of probability distribution of each computation basis. The probability of the target state is 0.37. The error bar in (e) and (f) on each data point $(x_i, P_i)$ extends from $(x_i, P_i - \sigma_i)$ to $(x_i, P_i + \sigma_i)$, where $\sigma_i =\sqrt{ \frac{1}{R} \sum_{j=1}^R(P_{ij}- \frac{1}{R} \sum_{k=1}^RP_{ik})^2}$ for $R$ repeated measurement results $P_{ij}$, $j=1,2, ... , R$.
  • Figure 4: The architecture of ibm_kyotokyotoroy2024simulating
  • Figure 5: The parameterized circuit for the experiment. The number of qubits is 5, and the layer of QAOA is 1.
  • ...and 1 more figures

Theorems & Definitions (2)

  • Theorem 1
  • Definition 1: LWE problem