Beating Meet-in-the-Middle for Subset Balancing Problems
Tim Randolph, Karol Węgrzycki
TL;DR
The first algorithms that break the Meet-in-the-Middle barrier for these coefficient sets in the worst case are presented, and the representation technique of Howgrave-Graham and Joux is brought from average-case to worst-case inputs for many $C.
Abstract
We consider exact algorithms for Subset Balancing, a family of related problems that generalizes Subset Sum, Partition, and Equal Subset Sum. Specifically, given as input an integer vector $\vec{x} \in \mathbb{Z}^n$ and a constant-size coefficient set $C \subset \mathbb{Z}$, we seek a nonzero solution vector $\vec{c} \in C^n$ satisfying $\vec{c} \cdot \vec{x} = 0$. For $C = \{-d,\ldots,d\}$, $d > 1$ and $C = \{-d,\ldots,d\}\setminus\{0\}$, $d > 2$, we present algorithms that run in time $O(|C|^{(0.5 - ε)n})$ for a constant $ε> 0$ that depends only on $C$. These are the first algorithms that break the $O(|C|^{n/2})$-time ``Meet-in-the-Middle barrier'' for these coefficient sets in the worst case. This improves on the result of Chen, Jin, Randolph and Servedio (SODA 2022), who broke the Meet-in-the-Middle barrier on these coefficient sets in the average-case setting. We also improve the best exact algorithm for Equal Subset Sum (Subset Balancing with $C = \{-1,0,1\}$), due to Mucha, Nederlof, Pawlewicz, and Węgrzycki (ESA 2019), by an exponential margin. This positively answers an open question of Jin, Williams, and Zhang (ESA 2025). Our results leave two natural cases in which we cannot yet break the Meet-in-the-Middle barrier: $C = \{-2, -1, 1, 2\}$ and $C = \{-1, 1\}$ (Partition). Our results bring the representation technique of Howgrave-Graham and Joux (CRYPTO 2010) from average-case to worst-case inputs for many $C$. This requires a variety of new techniques: we present strategies for (1) achieving good ``mixing'' with worst-case inputs, (2) creating flexible input representations for coefficient sets without 0, and (3) quickly recovering compatible solution pairs from sets of vectors containing ``pseudosolution pairs''. These techniques may find application to other algorithmic problems on integer sums or be of independent interest.