Tel Aviv University, Fall 2004 Lattices in Computer Science

Lecture 11 Transference Theorems

Lecturer: Oded Regev Scribe: Elad Verbin

In the last two lectures we have seen the concept of a dual lattice and Fourier analysis on lattices. In this lecture we will prove an interesting theorem about the connection between a lattice and its dual. In the process, we will develop tools that will prove valuable in the next lecture. In 1993, Banaszczyk proved the following theorem: T HEOREM 1 (BANASZCZYK 93 [2]) For any rank-n lattice it holds that 1 1 () n ( ) n. The lower bound 1 () n ( ) 1 follows from the denition of a dual lattice and was already proven in a previous lecture. Hence, in this lecture we concentrate on the upper bound. R EMARK 1 Recall that from Minkowskis bound we can obtain that 1 () 1 ( ) n. Theorem 1 is a considerable strengthening of this bound. Considerably weaker bounds were known prior to the work of Banaszczyk. This includes an upper bound of (n!)2 given by Mahler in 1939 [5], an upper bound of n! given by Cassels in 1959 [3], and an upper bound of n2 given by Lagarias, Lenstra and Schnorr in 1990 [4]. The upper bound given in Theorem 1 is tight up to a constant. This follows immediately from the fact that there exist self-dual lattices (i.e., lattices that are equal to their own dual) that satisfy 1 () = ( n). Indeed, for such a lattice 1 () n ( ) 1 () 1 ( ) = (n). The fact that such lattices exist is not trivial and was shown by Conway and Thompson. In [2], Banaszczyk proves some other transference theorems, such as the bound 1 i ()ni+1 ( ) n that holds for any 1 i n. He also notes that by following the same proofs, one can improve the upper bound to roughly n/(2 ). One application of Theorem 1 is the following. C OROLLARY 1 GapSVPn coNP P ROOF : Recall that the input to GapSVPn consists of a lattice and a number d. It is a YES instance if 1 () d and a NO instance if 1 () > nd. In order to show containment in coNP, we need to show a verier such that when 1 () > nd there exists a witness that makes the verier accept, and when 1 () d no witness makes the verier accept. Our verier expects as a witness a set of n vectors. It checks that the given vectors are contained in , that they are linearly independent, and that they are all of length less than 1/d. If all three conditions hold then it accepts, otherwise it rejects. It is easy to see that this can be done in polynomial time. It remains to prove that such a witness exists in the case of a NO instance, and does not exist in the case of a YES instance. So rst consider the case 1 () > nd. By Theorem 1, n ( ) < 1/d, so there are indeed n such vectors. Now assume that 1 () d. By Theorem 1, n ( ) 1/d, so there are no n such vectors. 2 Using a different transference theorem [2], one can also prove GapCVPn coNP. Let us mention that both these results have since been improved, and it is now known that GapSVPn and GapCVPn are in coNP [1]. Interestingly, the proof of these containments, while not directly based on transference theorems, uses techniques similar to those applied in the proof of Theorem 1. 1

The Covering Radius

() = max dist(x, ). n
xR

D EFINITION 2 For a full-rank lattice , dene the covering radius of as

In other words, the covering radius of a lattice is the minimal r such that any point in space is within distance at most r from the lattice. E XAMPLE 1 (Zn ) =
n 2 , 1 and this is realized by the point ( 1 2 , . . . , 2 ).

C LAIM 3 () 1 2 n () P ROOF : By the denition of n , all lattice points inside the open ball B (0, n ) are contained in some n (n 1)-dimensional hyperplane. Now take a point x of distance 2 from the origin perpendicular to this n hyperplane. Then, as illustrated in Fig. 1, x must be at distance at least 2 from any lattice point inside the n ball, as well as from any lattice point outside the ball. We thus obtain 2 , as required.

n 2

x
B(0, n )

Figure 1: () 1 2 n () 2 Hence, to prove Theorem 1 it sufces to show 1 () ( ) slightly weaker: T HEOREM 4 1 () ( ) n.

n 2.

In this lecture we prove something

Proof of Theorem 4

First, let us recall some of the things we saw in the previous lecture. For any s > 0 we dene s (x) = 2 e x/s and for the special case s = 1 we denote 1 . As we saw in the previous class, the Fourier transform of s is given by s (x) = sn 1/s (x). Moreover, by a property of the Fourier transform, the Fourier transform of the function mapping x to s (x + u) is sn 1/s (x) e2i u,x . Hence, from the Poisson summation formula we get s () = det( ) sn 1/s ( ) s ( + u) = det( ) s
y n

(1)
2i y,u

1/s (y ) e

(2)

We next prove several useful lemmas. Our rst lemma shows that s of a shifted lattice is upper bounded by s of the lattice itself. 2

L EMMA 5 For any s > 0 and any u Rn it holds that s ( + u) s (). As an example, consider the one-dimensional lattice = k Z for some k > 0 and dene fk (u) =
xkZ

e(x+u) .

Using the lemma with s = 1 we obtain that fk is maximized when u = 0. See Figure 2 for some illustrations.
2 2

1.5

1.5

0.5

0.5

4 2

4 2

1.5

1.5

0.5

0.5

Figure 2: fk (u) for k = 0.5 (top left), 0.75 (top right), 1.5 (bottom left), and 3 (bottom right) P ROOF : Using Eq. (2) and Eq. (1), s ( + u) = det( ) sn
y

1/s (y ) e2i 1/s (y )

y

y,u

det( ) sn

= det( ) sn 1/s ( ) = s () where the inequality follows from the triangle inequality together with the fact that 1/s is a positive function. 2 Our second lemma upper bounds s (for s 1) by 1 times a multiplicative factor. L EMMA 6 For any s 1 and any u Rn it holds that s ( + u) sn () Before we present the proof, let us see two examples. Consider the lemma for the case u = 0 and take to be a very sparse lattice, say, M Zn for some large M . Then it can be seen that () 1 and also 3

s () 1, since both sums are dominated by 0 . In this case the inequality holds, but is far from being tight. Next, let us take to be a very dense lattice, say Zn for some small > 0. Then () while s () 1 n s (x)dx = sn . n 1 n (x)dx =
Rn

1 n

Rn

Hence, in this case the lemma is close to being tight. P ROOF : By Lemma 5 we know that s ( + u) s (), so it is enough to prove that s () sn (). Using Eq. (1) we can write s () = det( ) sn 1/s ( ) = det( ) sn
y

1/s (y ).

It is easy to see that for any s 1 and any y it holds that 1/s (y ) (y ) and so we get s () det( ) sn
y

(y ) = sn ()

where we have used (1) again. 2 Our third lemma states that for any lattice , almost all the contribution to () comes from a ball of radius n around the origin. L EMMA 7 For any u Rn it holds that ( + u) \ B(0, n) 2n (). As before, let us consider two examples. First, consider the case that u = 0 and = M Zn for some very large M . In this case, the left hand side is essentially 0 while () is essentially 1 so the lemma holds. A more interesting example is when is a dense lattice, say, Zn for some small > 0. Then, () n
Rn

dx = n

while

( \ B(0, n)) n

Rn \B(0, n)

dx.

In this case, the lemma tells us that the latter integral is at most 2n . Let us verify this by computing the integral. Instead of computing it directly (which is not too difcult), we compute it by using a nice trick, 2 which will later be used in the proof of Lemma 7. The idea is to consider the integral Rn e x/2 dx. On one hand, by a change of variable, we see that e
Rn x/2
2

dx = 2n .

On the other hand, e

Rn x/2
2

dx =

Rn \B(0, n) Rn \B(0, n)
3

e e4
3

x/2

dx
x
2

e
x

dx

e 4 n

Rn \B(0, n)

dx.
3

We obtain the required bound by combining the two inequalities and using e 4 > 4. P ROOF : The proof idea is similar to that used in bounding the integral above. Namely, we notice that lattice points that are far from the origin contribute to 2 () much more than they contribute to 1 (). But by Lemma 6, 2 () can only be larger than 1 () by 2n and so we obtain a bound on the number of such points. More specically, we consider the expression 2 ( + u). On one hand, using Lemma 6, we see that 2 ( + u) 2n (). On the other hand, 2 ( + u) 2 ( + u) \ B(0, n) = =
y +u s.t. y n y +u s.t. y n
3

e e4
3

y/2

e
y

e 4 n

3 = e 4 n ( + u) \ B (0, n) . We complete the proof by noting that e 4 > 4. 2 One useful corollary of Lemma 7 is the following. C OROLLARY 8 Let be a lattice satisfying 1 () > n. Then,
3

y +u s.t. y n

( \ {0}) 2n /(1 2n ) 2 2n . P ROOF : By applying Lemma 7 with u = 0 we obtain \ B(0, n) 2n (). By our assumption, \ B (0, n) = \ {0} so we obtain ( \ {0}) 2n () = 2n 1 + ( \ {0}) . The corollary follows by rearranging terms. 2 Our last lemma says that if 1 () > n, then ( + u) is nearly constant as a function of u. Intuitively, this happens because is dense and so ( + u) is not affected much by the shift u. A similar behavior can be seen in Figure 2 where f0.5 is essentially constant. L EMMA 9 Let be a lattice satisfying 1 () > n. Then, for any u Rn , ( + u) (1 2(n) ) det(). 5

P ROOF : Using the Poisson summation formula (Eq. (2)) we can write ( + u) = det()
y

(y ) e2i

y,u

In the sum here, the point y = 0 contributes 1, and the contribution of all other points is at most ( \ {0}) in absolute value. So we obtain that ( + u) 1 ( \ {0}) det(). But by Corollary 8, ( \ {0}) 2(n) so we are done. 2 We nally present the proof of Theorem 4. P ROOF :(of Theorem 4) Assume by contradiction that there exists a lattice for which 1 () ( ) > n. By scaling , we can assume without loss of generality that both 1 () > n and ( ) > n. On one hand, Lemma 9, together with the bound on 1 (), implies that ( + u) is essentially constant as a function of u. On the other hand, ( ) > n implies that there exists a point v Rn for which dist(v, ) > n. This is the same as saying that all points in v are at distance more than n from the origin. Using Lemma 7, ( v ) = ( v ) \ B(0, n) < 2n ( ). But this contradicts the fact that ( + u) is almost constant as a function of u. 2

References
[1] D. Aharonov and O. Regev. Lattice problems in NP intersect coNP. In Proc. 45th Annual IEEE Symp. on Foundations of Computer Science (FOCS), pages 362371, 2004. [2] W. Banaszczyk. New bounds in some transference theorems in the geometry of numbers. Mathematische Annalen, 296(4):625635, 1993. [3] J. Cassels. An Introduction to the Geometry of Numbers. Springer, Berlin, Gttingen Heidelberg, 1959. [4] J. C. Lagarias, H. W. Lenstra, Jr., and C.-P. Schnorr. Korkin-Zolotarev bases and successive minima of a lattice and its reciprocal lattice. Combinatorica, 10(4):333348, 1990. [5] K. Mahler. Ein Ubertragungsprinzip f ur konvexe K orper. Casopis P est. Mat. Fys., 68:93102, 1939.