Solving the Shortest Vector Problem in $2^{0.6039n}$ Time via Mid-Point Hessian

# Solving the Shortest Vector Problem in 2 ⁢ 0.6039 n Time via Mid-point Hessian
Source: [https://arxiv.org/html/2608.02478](https://arxiv.org/html/2608.02478)
###### Abstract

We present randomized algorithms for the shortest vector problem \(SVP\)\. For thenn\-dimensional latticeℒ\\mathcal\{L\}, our algorithms solve SVP in time20\.6039​n\+o⁡\(n\)2^\{0\.6039n\+o\(n\)\}classically and20\.5411​n\+o⁡\(n\)2^\{0\.5411n\+o\(n\)\}quantumly and space20\.5​n\+o⁡\(n\)2^\{0\.5n\+o\(n\)\}, improving the previous best algorithm running in2n\+o⁡\(n\)2^\{n\+o\(n\)\}time and space of Aggarwal, Dadush, Regev, and Stephens\-Davidowitz \[STOC’15\]\.

Our algorithms heavily use the property of the Hessian of the periodic Gaussian function at the half shortest vector: For a shortest vectorv∈ℒv\\in\\mathcal\{L\}, the Hessian atv/2v/2has the eigenvector close tovv, which can be used to recovervvusing the \(preprocessing\) bounded distance decoding algorithm\. Given the periodicity moduloℒ\\mathcal\{L\}, the candidate midpoints are indexed by the parity classes inℒ/2​ℒ\\mathcal\{L\}/2\\mathcal\{L\}\. Our algorithm searches for the class of a shortest vector by estimating the corresponding Hessians using discrete Gaussian samples\.

We optimize the algorithm using random sublattice cosets and various sampling technique, achieving the final complexity\. The optimization techniques may be of independent interest\.

#### AI use disclosure\.

Most results of this paper are discovered with the assistance of ChatGPT 5\.5 Pro and ChatGPT 5\.6 Sol Ultra\. While the author suggested several directions and optimizations, all the technical details are discovered by AI, and verified by the author\. The manuscript is written by the author based on the initial draft generated by AI\. The author takes full responsibility for the content\. All errors in the manuscript are likely due to the author’s human errors\.

###### Contents

1. [1Introduction](https://arxiv.org/html/2608.02478#S1)1. [1\.1Technical overview](https://arxiv.org/html/2608.02478#S1.SS1)
2. [2Preliminaries](https://arxiv.org/html/2608.02478#S2)1. [2\.1Lattices and decoding](https://arxiv.org/html/2608.02478#S2.SS1) 2. [2\.2Discrete Gaussians](https://arxiv.org/html/2608.02478#S2.SS2) 3. [2\.3Useful inequalities](https://arxiv.org/html/2608.02478#S2.SS3)
3. [3Recovering Shortest Vector from Hessian](https://arxiv.org/html/2608.02478#S3)1. [3\.1Scale and Gaussian mass bounds](https://arxiv.org/html/2608.02478#S3.SS1) 2. [3\.2The periodic Gaussian and the shortest parity class](https://arxiv.org/html/2608.02478#S3.SS2) 3. [3\.3Estimating the Hessians and recovering a shortest vector](https://arxiv.org/html/2608.02478#S3.SS3)
4. [4Batch Hessian Estimation](https://arxiv.org/html/2608.02478#S4)
5. [5Random Sublattice Coset Hessian](https://arxiv.org/html/2608.02478#S5)1. [5\.1Gaussian and Hessian sums](https://arxiv.org/html/2608.02478#S5.SS1) 2. [5\.2A random coset Hessian](https://arxiv.org/html/2608.02478#S5.SS2) 3. [5\.3Estimating the coset Hessian](https://arxiv.org/html/2608.02478#S5.SS3) 4. [5\.4Coset Hessians and shortest vectors](https://arxiv.org/html/2608.02478#S5.SS4) 5. [5\.5The affine\-coset algorithm](https://arxiv.org/html/2608.02478#S5.SS5)
6. [6Importance Sampling on an Affine Lattice Coset](https://arxiv.org/html/2608.02478#S6)1. [6\.1Lattice points in a shortest parity class](https://arxiv.org/html/2608.02478#S6.SS1) 2. [6\.2Sampling \(wider\) discrete Gaussian from an affine lattice coset](https://arxiv.org/html/2608.02478#S6.SS2) 3. [6\.3Estimating the Hessian by importance sampling](https://arxiv.org/html/2608.02478#S6.SS3) 4. [6\.4Recovering a shortest vector](https://arxiv.org/html/2608.02478#S6.SS4) 5. [6\.5The importance\-sampling algorithm](https://arxiv.org/html/2608.02478#S6.SS5) 6. [6\.6Reducing the space by sparsification](https://arxiv.org/html/2608.02478#S6.SS6) 7. [6\.7Space\-efficient implementation](https://arxiv.org/html/2608.02478#S6.SS7) 8. [6\.8Quantum algorithm](https://arxiv.org/html/2608.02478#S6.SS8)
7. [References](https://arxiv.org/html/2608.02478#bib)

## 1Introduction

Annn\-dimensional latticeℒ=ℒ⁡\(b1,…,bn\)\\mathcal\{L\}=\\mathcal\{L\}\(b\_\{1\},\\ldots,b\_\{n\}\)is the set of all integer combinations of linearly independent vectorsb1,…,bk∈ℝnb\_\{1\},\\ldots,b\_\{k\}\\in\\mathbb\{R\}^\{n\}\. For the sake of simplicity, we only consider the full rank lattice satisfiesk=nk=n\. The \(search\) shortest vector problem \(𝖲𝖵𝖯\\mathsf\{SVP\}\) asks to find a nonzero vector of minimum norm, given a basis ofℒ\\mathcal\{L\}\.

There are two faces of lattice problems including𝖲𝖵𝖯\\mathsf\{SVP\}\. Approximate variants of𝖲𝖵𝖯\\mathsf\{SVP\}have long served as algorithmic tools in computational number theory, integer programming, and cryptanalysis\[[25](https://arxiv.org/html/2608.02478#bib.bib26),[21](https://arxiv.org/html/2608.02478#bib.bib28),[26](https://arxiv.org/html/2608.02478#bib.bib31),[39](https://arxiv.org/html/2608.02478#bib.bib6),[24](https://arxiv.org/html/2608.02478#bib.bib30)\]\. On the other hand, the exact problem and its small approximation factor version are known to be hard\[[9](https://arxiv.org/html/2608.02478#bib.bib18),[11](https://arxiv.org/html/2608.02478#bib.bib10),[4](https://arxiv.org/html/2608.02478#bib.bib11),[22](https://arxiv.org/html/2608.02478#bib.bib32),[19](https://arxiv.org/html/2608.02478#bib.bib16)\]\. Given the close relation between the lattice problems and many recent cryptographic primitives\[[38](https://arxiv.org/html/2608.02478#bib.bib22),[12](https://arxiv.org/html/2608.02478#bib.bib13),[29](https://arxiv.org/html/2608.02478#bib.bib5),[37](https://arxiv.org/html/2608.02478#bib.bib2),[7](https://arxiv.org/html/2608.02478#bib.bib19),[17](https://arxiv.org/html/2608.02478#bib.bib15)\], lattice problems have become one of the most promising foundations for post\-quantum cryptography\.

𝖲𝖵𝖯\\mathsf\{SVP\}remains a fundamental benchmark for our understanding of the complexity of lattice problems\. Researchers have discovered various worst\-case algorithms\[[18](https://arxiv.org/html/2608.02478#bib.bib1),[30](https://arxiv.org/html/2608.02478#bib.bib14),[8](https://arxiv.org/html/2608.02478#bib.bib17),[21](https://arxiv.org/html/2608.02478#bib.bib28),[32](https://arxiv.org/html/2608.02478#bib.bib34),[35](https://arxiv.org/html/2608.02478#bib.bib20),[31](https://arxiv.org/html/2608.02478#bib.bib9),[13](https://arxiv.org/html/2608.02478#bib.bib37)\]and heuristic or average\-case algorithms\[[32](https://arxiv.org/html/2608.02478#bib.bib34),[34](https://arxiv.org/html/2608.02478#bib.bib33),[10](https://arxiv.org/html/2608.02478#bib.bib7)\]\. To date, however, the best provable worst\-case running time was2n\+o⁡\(n\)2^\{n\+o\(n\)\}, with the same space complexity\[[2](https://arxiv.org/html/2608.02478#bib.bib12)\]using a new efficient discrete Gaussian sampling algorithm\. Later,\[[1](https://arxiv.org/html/2608.02478#bib.bib21)\]gave several time\-space tradeoffs and quantum speedup, including21\.669​n\+o⁡\(n\)2^\{1\.669n\+o\(n\)\}time and2n/2\+o⁡\(n\)2^\{n/2\+o\(n\)\}space and20\.950​n\+o⁡\(n\)2^\{0\.950n\+o\(n\)\}and20\.835​n\+o⁡\(n\)2^\{0\.835n\+o\(n\)\}quantum time without and with quantum random access memory \(QRAM\), respectively\.

We give a new class of worst\-case algorithms for𝖲𝖵𝖯\\mathsf\{SVP\}, significantly improving the previous classical and quantum algorithms\[[2](https://arxiv.org/html/2608.02478#bib.bib12),[1](https://arxiv.org/html/2608.02478#bib.bib21)\]\. Our main results are summarized as follows\.

###### Theorem 1\.1\.

There are randomized classical and quantum algorithms that solve Search\-𝖲𝖵𝖯\\mathsf\{SVP\}with probability at least2/32/3in expected time20\.603867​n\+o⁡\(n\)2^\{0\.603867n\+o\(n\)\}classically and20\.541051​n\+o⁡\(n\)2^\{0\.541051n\+o\(n\)\}quantumly and space20\.5​n\+o⁡\(n\),2^\{0\.5n\+o\(n\)\},up to factors polynomial in the input length\. The quantum algorithm requires a QRAM of size20\.36036​n\+o⁡\(n\)2^\{0\.36036n\+o\(n\)\}\.

We discuss some direct applications of[Theorem1\.1](https://arxiv.org/html/2608.02478#S1.Thmtheorem1)\. Obviously, our algorithm solves the approximate or unique𝖲𝖵𝖯\\mathsf\{SVP\}as well as its gap version in the same time and space complexity\. Our algorithm beats the previous best time records\[[41](https://arxiv.org/html/2608.02478#bib.bib3),[3](https://arxiv.org/html/2608.02478#bib.bib4),[27](https://arxiv.org/html/2608.02478#bib.bib41)\]20\.802​n\+o⁡\(n\)2^\{0\.802n\+o\(n\)\}time and20\.401​n\+o⁡\(n\)2^\{0\.401n\+o\(n\)\}space for the approximate𝖲𝖵𝖯\\mathsf\{SVP\}with a constant factor, although they use less space\.

This improvement can be readily used in other applications\. For example, the best\-known polynomial factor approximate𝖲𝖵𝖯\\mathsf\{SVP\}\[[3](https://arxiv.org/html/2608.02478#bib.bib4), Theorems 5\.3\]uses one call to a constant\-factor𝖲𝖵𝖯\\mathsf\{SVP\}oracle in a small dimension\. Originally the proof uses the oracle from\[[27](https://arxiv.org/html/2608.02478#bib.bib41)\]with an exponent0\.802​n0\.802n\. Replacing this to ours, we improve the time complexity for solvingO~​\(nc\)\\widetilde\{O\}\(n^\{c\}\)\-𝖲𝖵𝖯\\mathsf\{SVP\}from2n2​c\+1\.242^\{\\frac\{n\}\{2c\+1\.24\}\}to2n2​c\+1\.652^\{\\frac\{n\}\{2c\+1\.65\}\}\.

Another direct application is𝖡𝖣𝖣\\mathsf\{BDD\}or exact𝖢𝖵𝖯\\mathsf\{CVP\}with the distance promise\. Using Kannan’s embedding,𝖢𝖵𝖯\\mathsf\{CVP\}for\(t,ℒ\)\(t,\\mathcal\{L\}\)with the promisedist⁡\(t,ℒ\)<3​λ1​\(ℒ\)/2\\operatorname\{dist\}\(t,\\mathcal\{L\}\)<\\sqrt\{3\}\\lambda\_\{1\}\(\\mathcal\{L\}\)/2can be reduced to𝖲𝖵𝖯\\mathsf\{SVP\}with one additional dimension \(see e\.g\.,\[[28](https://arxiv.org/html/2608.02478#bib.bib27)\]\)\. Thus𝖡𝖣𝖣\\mathsf\{BDD\}and the𝖢𝖵𝖯\\mathsf\{CVP\}with the above promise can be solved in the same time and space using our algorithm\. Previously,\[[14](https://arxiv.org/html/2608.02478#bib.bib23),[2](https://arxiv.org/html/2608.02478#bib.bib12)\]give2n/2\+o⁡\(n\)2^\{n/2\+o\(n\)\}time algorithm forα<0\.422\\alpha<0\.422\.

Lastly, using the dimension\-preserving reduction from centered𝖣𝖦𝖲\\mathsf\{DGS\}to𝖲𝖵𝖯\\mathsf\{SVP\}\[[40](https://arxiv.org/html/2608.02478#bib.bib8)\], we can sample one \(or polynomially many\) discrete Gaussian sample with an arbitrary parameter in the same time\. This partly answers the open question in\[[2](https://arxiv.org/html/2608.02478#bib.bib12)\]for the centered discrete Gaussian sampling below smoothing, albeit with a worse time complexity than2n/2\+o⁡\(n\)2^\{n/2\+o\(n\)\}\. A concurrent work\[[23](https://arxiv.org/html/2608.02478#bib.bib40)\]gives a2n/2\+o⁡\(n\)2^\{n/2\+o\(n\)\}time discrete Gaussian sampling algorithm for arbitrary parameters\.

### 1\.1Technical overview

Letℒ\\mathcal\{L\}be ann\-dimensional full\-rank lattice with basisBBands\>0s\>0be a width parameter\. Its dual latticeℒ∗=\{y:⟨y,x⟩∈ℤ​for every​x∈ℒ\}\\mathcal\{L\}^\{\*\}=\\\{y:\\left\\langle y,x\\right\\rangle\\in\\mathbb\{Z\}\\text\{ for every \}x\\in\\mathcal\{L\}\\\}has the basisB−T\.B^\{\-T\}\.Defineρs​\(x\):=exp⁡\(−π​‖x‖2s2\)\\rho\_\{s\}\(x\):=\\exp\\\!\\left\(\-\\pi\\frac\{\\norm\{x\}^\{2\}\}\{s^\{2\}\}\\right\)and letρs​\(A\):=∑x∈Aρs​\(x\)\.\\rho\_\{s\}\(A\):=\\sum\_\{x\\in A\}\\rho\_\{s\}\(x\)\.We define the \(centered\) discrete Gaussian distributionDℒ,s​\(x\):=ρs​\(x\)ρs​\(ℒ\)\.D\_\{\\mathcal\{L\},s\}\(x\):=\\frac\{\\rho\_\{s\}\(x\)\}\{\\rho\_\{s\}\(\\mathcal\{L\}\)\}\.The periodic Gaussian function\[[6](https://arxiv.org/html/2608.02478#bib.bib35)\]Fs:ℝn→ℝF\_\{s\}:\\mathbb\{R\}^\{n\}\\to\\mathbb\{R\}is defined by

Fs​\(z\):=ρs​\(ℒ\+z\)ρs​\(ℒ\)=𝔼X∼Dℒ∗,1/s​\[e2​π​i​⟨X,z⟩\]F\_\{s\}\(z\):=\\frac\{\\rho\_\{s\}\(\\mathcal\{L\}\+z\)\}\{\\rho\_\{s\}\(\\mathcal\{L\}\)\}=\\mathbb\{E\}\_\{X\\sim D\_\{\\mathcal\{L\}^\{\*\},1/s\}\}\\left\[e^\{2\\pi i\\langle X,z\\rangle\}\\right\]where the last equality is due to the Poisson summation formula\. It is clear thatFsF\_\{s\}isℒ\\mathcal\{L\}\-periodic, i\.e\.,Fs​\(z\)=Fs​\(z\+v\)F\_\{s\}\(z\)=F\_\{s\}\(z\+v\)forv∈ℒv\\in\\mathcal\{L\}\.

#### At the midpoint, the Hessian points the way\.

Our algorithm starts with studying its Hessian\[[36](https://arxiv.org/html/2608.02478#bib.bib36),[14](https://arxiv.org/html/2608.02478#bib.bib23)\], which also has two representations

∇2Fs\(z\)\+2​πs2Fs\(z\)In=4​π2s4​ρs​\(ℒ\)∑y∈ℒ\(y−z\)\(y−z\)Te−π‖y−z‖2/s2\\displaystyle\\nabla^\{2\}F\_\{s\}\(z\)\+\\frac\{2\\pi\}\{s^\{2\}\}F\_\{s\}\(z\)I\_\{n\}=\\frac\{4\\pi^\{2\}\}\{s^\{4\}\\rho\_\{s\}\(\\mathcal\{L\}\)\}\\sum\_\{y\\in\\mathcal\{L\}\}\(y\-z\)\(y\-z\)^\{T\}e^\{\-\\pi\\norm\{y\-z\}^\{2\}/s^\{2\}\}\(1\)by differentiating the first representation, and by differentiating the second representation

∇2Fs​\(z\)=−4​π2​𝔼X∼Dℒ∗,1/s​\[X​XT​e2​π​i​⟨X,z⟩\]\.\\displaystyle\\nabla^\{2\}F\_\{s\}\(z\)=\-4\\pi^\{2\}\\mathbb\{E\}\_\{X\\sim D\_\{\\mathcal\{L\}^\{\*\},1/s\}\}\\left\[XX^\{T\}e^\{2\\pi i\\left\\langle X,z\\right\\rangle\}\\right\]\.\(2\)From these two representations, we observe the following two properties\. First, letvvbe a shortest vector with‖v‖=λ\\norm\{v\}=\\lambdaand evaluate∇2Fs​\(v/2\)\\nabla^\{2\}F\_\{s\}\(v/2\)in[Eq\.1](https://arxiv.org/html/2608.02478#S1.E1), we can see that

∇2Fs\(v/2\)\+aI=4​π2s4​ρs​\(ℒ\)\(v​vT2e−πλ2/4s2\+∑y∈ℒ∖\{0,v\}\(y−v/2\)\(y−v/2\)Te−π‖y−v/2‖2/s2\)\\nabla^\{2\}F\_\{s\}\(v/2\)\+aI=\\frac\{4\\pi^\{2\}\}\{s^\{4\}\\rho\_\{s\}\(\\mathcal\{L\}\)\}\\left\(\\frac\{vv^\{T\}\}\{2\}e^\{\-\\pi\\lambda^\{2\}/4s^\{2\}\}\+\\sum\_\{y\\in\\mathcal\{L\}\\setminus\\\{0,v\\\}\}\(y\-v/2\)\(y\-v/2\)^\{T\}e^\{\-\\pi\\norm\{y\-v/2\}^\{2\}/s^\{2\}\}\\right\)wherea:=2​π​Fs​\(v/2\)/s2a:=2\\pi F\_\{s\}\(v/2\)/s^\{2\}which is unimportant in the spectral analysis\. Noting that‖y−v/2‖\\norm\{y\-v/2\}fory≠0,vy\\neq 0,vis much larger than‖v/2‖=λ/2\\norm\{v/2\}=\\lambda/2, we can expect that∇2Fs​\(v/2\)\+a​I\\nabla^\{2\}F\_\{s\}\(v/2\)\+aIis close to a multiple ofv​vTvv^\{T\}\. For appropriately chosenss, this intuition can be formalized by the following statement for the normalized eigenvectorv~\\tilde\{v\}of∇2Fs​\(v/2\)\\nabla^\{2\}F\_\{s\}\(v/2\)corresponding to the largest eigenvalue:

v~\\tilde\{v\}is*inverse polynomially close*tov/‖v‖v/\\norm\{v\}\.

Then, givenv~\\tilde\{v\}, we guessλ\\lambda\(which only takes polynomial iterations\) and solve the bounded distance decoding \(𝖡𝖣𝖣\\mathsf\{BDD\}\) problem for the target vectorλ​v~\\lambda\\tilde\{v\}\. This𝖡𝖣𝖣\\mathsf\{BDD\}step can be relatively quick, thanks to the preprocessing BDD algorithm in\[[1](https://arxiv.org/html/2608.02478#bib.bib21)\], which solves each BDD instance with inverse polynomial distances in time2o⁡\(n\)2^\{o\(n\)\}after20\.5​n\+o⁡\(n\)2^\{0\.5n\+o\(n\)\}time preprocessing\.

#### One Hessian is enough if we know where to look\.

This gives our very first result \([Theorem3\.7](https://arxiv.org/html/2608.02478#S3.Thmtheorem7)\) with time complexity21\.463​n\+o⁡\(n\)2^\{1\.463n\+o\(n\)\}and space complexity20\.5​n\+o⁡\(n\)2^\{0\.5n\+o\(n\)\}\. Suppose that for a shortest vectorvv, we know a representativewwof the parity classv\+2​ℒv\+2\\mathcal\{L\}\. We*compute*the eigenvectorw~\\tilde\{w\}of∇2Fs​\(w/2\)\\nabla^\{2\}F\_\{s\}\(w/2\), and solve the BDD problem for it using \(preprocessing\) BDD\. But, how to compute∇2Fs​\(w/2\)\\nabla^\{2\}F\_\{s\}\(w/2\)?

Here the second representation[Eq\.2](https://arxiv.org/html/2608.02478#S1.E2)comes in\. We use the algorithm in\[[2](https://arxiv.org/html/2608.02478#bib.bib12)\]that samplesN=2n/2N=2^\{n/2\}elements, sayX1,…,XNX\_\{1\},\.\.\.,X\_\{N\}, from the discrete Gaussian distribution in time2n/2\+o⁡\(n\)2^\{n/2\+o\(n\)\}onℒ∗\\mathcal\{L\}^\{\*\}\. Then, givenw/2w/2, we use the estimator

∇2Fs^​\(w/2\)=−4​π2N​∑i=1NXi​XiT​e2​π​i​⟨Xi,w/2⟩\.\\widehat\{\\nabla^\{2\}F\_\{s\}\}\(w/2\)=\\frac\{\-4\\pi^\{2\}\}\{N\}\\sum\_\{i=1\}^\{N\}X\_\{i\}X\_\{i\}^\{T\}e^\{2\\pi i\\left\\langle X\_\{i\},w/2\\right\\rangle\}\.Concentration inequalities and results from lattice literature show that about22​t0​n\+o⁡\(n\)2^\{2t\_\{0\}n\+o\(n\)\}samples fort0=20\.802/4​e​ln⁡2=0\.2314t\_\{0\}=2^\{0\.802\}/4e\\ln 2=0\.2314suffice to accurately estimate the actual∇2Fs​\(w/2\)\\nabla^\{2\}F\_\{s\}\(w/2\)as well as its eigenvectors\. This leads to the time complexity\|ℒ/2​ℒ\|⋅22​t0​n=21\.463​n\+o⁡\(n\)\|\\mathcal\{L\}/2\\mathcal\{L\}\|\\cdot 2^\{2t\_\{0\}n\}=2^\{1\.463n\+o\(n\)\}by enumerating all the parity class inℒ/2​ℒ\\mathcal\{L\}/2\\mathcal\{L\}\. The2n/2\+o⁡\(n\)2^\{n/2\+o\(n\)\}space is required in the discrete Gaussian sampling\.

#### Walsh\-Hadamard looks everywhere at once\.

The time can be reduced further\. Writew=B​uw=Bu\. SinceBT​X∈ℤnB^\{T\}X\\in\\mathbb\{Z\}^\{n\},

e2​π​i​⟨X,B​u/2⟩=eπ​i​uT​BT​X=\(−1\)uT​\(BT​Xmod2\)\.e^\{2\\pi i\\left\\langle X,Bu/2\\right\\rangle\}=e^\{\\pi iu^\{T\}B^\{T\}X\}=\(\-1\)^\{u^\{T\}\(B^\{T\}X\\bmod 2\)\}\.With some work, the fast Walsh\-Hadamard transform can be applied to compute∇2Fs^​\(B​u/2\)\\widehat\{\\nabla^\{2\}F\_\{s\}\}\(Bu/2\)simultaneously for differentuu’s\. Carefully choosing the coordinates leads to2n\+o⁡\(n\)2^\{n\+o\(n\)\}time algorithm in[Theorem4\.2](https://arxiv.org/html/2608.02478#S4.Thmtheorem2)while preserving20\.5​n\+o⁡\(n\)2^\{0\.5n\+o\(n\)\}space\.

#### A random coset narrows the view\.

The bottleneck2n2^\{n\}of the above strategy is the size of the search spaceℒ/2​ℒ\\mathcal\{L\}/2\\mathcal\{L\}\. LetX∈ℒ∗X\\in\\mathcal\{L\}^\{\*\}\. Choose a random invertible linear mapP∈GLn⁡\(𝔽2\)P\\in\\GL\_\{n\}\(\\mathbb\{F\}\_\{2\}\)and divide

P⁡\(BT​Xmod2\)∈𝔽2nP\(B^\{T\}X\\bmod 2\)\\in\\mathbb\{F\}\_\{2\}^\{n\}intohhfixed coordinates andℓ=n−h\\ell=n\-hremaining coordinates\. We then choose a random valuej∈𝔽2hj\\in\\mathbb\{F\}\_\{2\}^\{h\}for the firsthhcoordinates, and use the discrete Gaussian samplesXXthat agree to this value\. These samples belong to an affine coset of an index\-2h2^\{h\}sublattice ofℒ∗\\mathcal\{L\}^\{\*\}\. It turns out that the discrete Gaussian samples \(for an appropriate width\) are almost uniformly distributed over different cosets, thus this collective sampling adds2h2^\{h\}multiplicative factor in the time complexity in sampling\. That is, the estimation can be anyway done\.

At first sight, it may seem that choosing one random coset could lose the spectral property of Hessian\. This is not the case\. Conditioning the firsthhcoordinates of the samples on the dual lattice side corresponds to*summing*over the correspondinghhcoordinates ofuuas shown in[Eq\.21](https://arxiv.org/html/2608.02478#S5.E21)\. Thus, the shortest\-vector contribution still appears in one of the2ℓ2^\{\\ell\}coset Hessians\! Given this intuition, we can indeed apply almost the same strategy to find a shortest vector\. The overall time complexity becomes

22​t0​n\+h\+o⁡\(n\)\+2ℓ\+o⁡\(n\)2^\{2t\_\{0\}n\+h\+o\(n\)\}\+2^\{\\ell\+o\(n\)\}where the first term is to sample22​t0​n2^\{2t\_\{0\}n\}discrete Gaussian samples in the target coset \(as we get roughly one coset Gaussian sample out of2h2^\{h\}lattice Gaussian samples\), and2ℓ2^\{\\ell\}is the number of outputs to be checked\. Balancing these costs gives20\.73147​n\+o⁡\(n\)2^\{0\.73147n\+o\(n\)\}algorithm as shown in[Theorem5\.8](https://arxiv.org/html/2608.02478#S5.Thmtheorem8)\.

#### May the fourth weigh what matters\.

The main loss in the above algorithm is due to the inefficient rejection step in the discrete Gaussian sampling over the sublattice coset\. The last algorithm uses the following observation: For two probabilistic distributionsDDandEE, where we know how to sample only fromEEand know their probabilistic density functionsppandqq, then we have

𝔼X∼D​\[f⁡\(X\)\]=∑Xp⁡\(X\)​f​\(X\)=∑Xq⁡\(X\)⋅p⁡\(X\)q⁡\(X\)​f​\(X\)=𝔼X∼E​\[p⁡\(X\)q⁡\(X\)​f​\(X\)\]\\mathbb\{E\}\_\{X\\sim D\}\[f\(X\)\]=\\sum\_\{X\}p\(X\)f\(X\)=\\sum\_\{X\}q\(X\)\\cdot\\frac\{p\(X\)\}\{q\(X\)\}f\(X\)=\\mathbb\{E\}\_\{X\\sim E\}\\left\[\\frac\{p\(X\)\}\{q\(X\)\}f\(X\)\\right\]so that we can estimate the statistics regardingDDonly using samples fromEE\. We use this idea\.

We first show that for a slightly wider widthsRs\_\{R\}than original, we can sample discrete Gaussian directly on the target sublattice cosetΛ\\Lambda\. Of course, samples from the discrete Gaussian with a wider widthsRs\_\{R\}do not have exactly the distribution required for Hessian estimation\. We therefore use the above idea and assign each sampleXXthe importance weight for the narrower target widthsr<sRs\_\{r\}<s\_\{R\}

w⁡\(X\):=ρsr​\(X\)ρsR​\(X\)=PrDΛ,sr⁡\[X\]​ρsr​\(Λ\)PrDΛ,sR⁡\[X\]​ρsR​\(Λ\)∝PrDΛ,sr⁡\[X\]PrDΛ,sR⁡\[X\],w\(X\):=\\frac\{\\rho\_\{s\_\{r\}\}\(X\)\}\{\\rho\_\{s\_\{R\}\}\(X\)\}=\\frac\{\\Pr\_\{D\_\{\\Lambda,s\_\{r\}\}\}\[X\]\\rho\_\{s\_\{r\}\}\(\\Lambda\)\}\{\\Pr\_\{D\_\{\\Lambda,s\_\{R\}\}\}\[X\]\\rho\_\{s\_\{R\}\}\(\\Lambda\)\}\\propto\\frac\{\\Pr\_\{D\_\{\\Lambda,s\_\{r\}\}\}\[X\]\}\{\\Pr\_\{D\_\{\\Lambda,s\_\{R\}\}\}\[X\]\},which is easily computable\. Similarly to the above, we have

𝔼X∼DΛ,sr​\[f⁡\(X\)\]=𝔼X∼DΛ,sR​\[w​\(X\)​f​\(X\)\]𝔼X∼DΛ,sR​\[w​\(X\)\]\\mathbb\{E\}\_\{X\\sim D\_\{\\Lambda,s\_\{r\}\}\}\[f\(X\)\]=\\frac\{\\mathbb\{E\}\_\{X\\sim D\_\{\\Lambda,s\_\{R\}\}\}\\left\[w\(X\)f\(X\)\\right\]\}\{\\mathbb\{E\}\_\{X\\sim D\_\{\\Lambda,s\_\{R\}\}\}\\left\[w\(X\)\\right\]\}for a functionff\. Thus the wider Gaussian with widthRRis used only to generate the samples, while the weights recover the Hessian corresponding to the narrower target Gaussian with widthrr\.

The loss caused by importance sampling isι=12​log2​\(R2r⁡\(2​R−r\)\)\\iota=\\frac\{1\}\{2\}\\log\_\{2\}\\left\(\\frac\{R^\{2\}\}\{r\(2R\-r\)\}\\right\)in the exponent of the variance \([Lemma6\.7](https://arxiv.org/html/2608.02478#S6.Thmtheorem7)\), forcing us to sample2ι​n2^\{\\iota n\}more samples\. This turns22​t0​n\+h2^\{2t\_\{0\}n\+h\}time in the previous algorithm to2\(2​r\+ι\)​n2^\{\(2r\+\\iota\)n\}, and balancing the parameters gives20\.60387​n\+o⁡\(n\)2^\{0\.60387n\+o\(n\)\}time complexity in[Theorem6\.11](https://arxiv.org/html/2608.02478#S6.Thmtheorem11)\.111Note that since we do not even sample from the discrete Gaussian with widthrr, we can setrrsmaller than the limit of the original discrete Gaussian sampler\[[2](https://arxiv.org/html/2608.02478#bib.bib12)\]\. We actually choose so, and extend several lemmas forr<t0r<t\_\{0\}\.

#### Sparsity makes space for quantum\.

A careful reader may notice that the above algorithm requires2\(2​r\+ι\)​n2^\{\(2r\+\\iota\)n\}Gaussian samples, thus its space complexity is also20\.60387​n\+o⁡\(n\)2^\{0\.60387n\+o\(n\)\}\. We observe that the valuew⁡\(X\)w\(X\)heavily depends on the norm ofXX, and in particular for most ofXXit is very close to00\. We can sparsify the Gaussian samples by employing a binary variableZZsuch that, conditioned on each sampleXX, chooseZ∈\{0,1\}Z\\in\\\{0,1\\\}such thatPr⁡\[Z=1∣X\]=π⁡\(X\)\\Pr\[Z=1\\mid X\]=\\pi\(X\)andPr⁡\[Z=0∣X\]=1−π⁡\(X\)\\Pr\[Z=0\\mid X\]=1\-\\pi\(X\)for someπ⁡\(X\)∝w⁡\(X\)\\pi\(X\)\\propto w\(X\)\. We use the following: For every functionff,

𝔼X,Z\[Z​f​\(X\)π⁡\(X\)\]=𝔼X\[𝔼\[Z​f​\(X\)π⁡\(X\)\|X\]\]=𝔼X\[f\(X\)\]\\displaystyle\\mathbb\{E\}\_\{X,Z\}\\left\[\\frac\{Zf\(X\)\}\{\\pi\(X\)\}\\right\]=\\mathbb\{E\}\_\{X\}\\left\[\\mathbb\{E\}\\left\[\\left\.\\frac\{Zf\(X\)\}\{\\pi\(X\)\}\\right\|X\\right\]\\right\]=\\mathbb\{E\}\_\{X\}\[f\(X\)\]thus we can compute the statistics with a smaller number ofXX’s for whichZ=1Z=1, which is about𝔼⁡\[π⁡\(X\)\]⋅2\(2​r\+ι\)​n\\mathbb\{E\}\[\\pi\(X\)\]\\cdot 2^\{\(2r\+\\iota\)n\}\. This gives a20\.5​n\+o⁡\(n\)2^\{0\.5n\+o\(n\)\}space version of the above algorithm, showing[Theorem6\.14](https://arxiv.org/html/2608.02478#S6.Thmtheorem14)\. Note that we anyway need to sample2\(2​r\+ι\)​n2^\{\(2r\+\\iota\)n\}Gaussian samples, thus the time complexity remains unchanged\.

This reduced space actually allows us to use the quantum minimum finding algorithm\[[15](https://arxiv.org/html/2608.02478#bib.bib29)\]\. The number of effective samples can be reduced to22​r​n2^\{2rn\}while ensuring the accuracy of the estimation at best\. In this case, we chooseb≈2​r​nb\\approx 2rnand write𝔽2ℓ=𝔽2b×𝔽2ℓ−b\\mathbb\{F\}\_\{2\}^\{\\ell\}=\\mathbb\{F\}\_\{2\}^\{b\}\\times\\mathbb\{F\}\_\{2\}^\{\\ell\-b\}\. For each fixed value of the lastℓ−b\\ell\-bcoordinates, the fast Walsh\-Hadamard transform computes the corresponding2b=22​r​n\+o⁡\(n\)2^\{b\}=2^\{2rn\+o\(n\)\}coset Hessians at once\. Classically this is repeated2ℓ−b2^\{\\ell\-b\}times, while quantum minimum finding reduces the number of repetitions to2\(ℓ−b\)/22^\{\(\\ell\-b\)/2\}, which is2ι​n\+o⁡\(n\)2^\{\\iota n\+o\(n\)\}for the optimized parameters\. Balancing the parameter gives20\.5411​n\+o⁡\(n\)2^\{0\.5411n\+o\(n\)\}quantum time and20\.5​n\+o⁡\(n\)2^\{0\.5n\+o\(n\)\}space in[Theorem6\.15](https://arxiv.org/html/2608.02478#S6.Thmtheorem15)\. The QRAM only stores the BDD preprocessing data and22​r​n2^\{2rn\}samples, which is20\.3604​n\+o⁡\(n\)2^\{0\.3604n\+o\(n\)\}in the balanced parameters\.

#### Acknowledgment\.

The author is grateful to Yixin Shen for helpful discussions about an early version of this work, and to Jiseung Kim for kindly sharing a preliminary draft of his ongoing work\[[23](https://arxiv.org/html/2608.02478#bib.bib40)\]\.

## 2Preliminaries

The sets of integers, positive integers, and real numbers are denoted byℤ\\mathbb\{Z\},ℕ\\mathbb\{N\}, andℝ\\mathbb\{R\}\.𝔽2\\mathbb\{F\}\_\{2\}denotes the field of two elements\{0,1\}\\\{0,1\\\}\. We write\[m\]=\{1,…,m\}\[m\]=\\\{1,\\ldots,m\\\}form∈ℕm\\in\\mathbb\{N\}\. The Euclidean, operator, and Frobenius norms are denoted by‖⋅‖\\norm\{\\cdot\},‖⋅‖op\\left\\lVert\\cdot\\right\\rVert\_\{\\mathrm\{op\}\}, and‖⋅‖F\\left\\lVert\\cdot\\right\\rVert\_\{\\mathrm\{F\}\}, respectively\. The closed Euclidean ball of radiusRRisB2n​\(R\)=\{x∈ℝn:‖x‖≤R\}B\_\{2\}^\{n\}\(R\)=\\\{x\\in\\mathbb\{R\}^\{n\}:\\norm\{x\}\\leq R\\\}\. For an eventEE, its indicator function is𝟏E\\mathbf\{1\}\_\{E\}\. All logarithms are natural unless a base is specified\. We writedist⁡\(t,S\):=infx∈S‖t−x‖\\operatorname\{dist\}\(t,S\):=\\inf\_\{x\\in S\}\\norm\{t\-x\}for a setSSand a vectortt\.

The dimensionnntends to infinity when discussing the asymptotic behavior\. Unless specified otherwise, everyo⁡\(1\)o\(1\)term is uniform over the lattices and the fixed parameters in the stated ranges\. A negligible function, denoted bynegl⁡\(n\)\\operatorname\{negl\}\(n\), is smaller thann−cn^\{\-c\}for everyc\>0c\>0for all sufficiently largenn\. We write⟨B⟩\\langle B\\ranglefor the bit length of the input basisBBand assume that it is polynomial innn\.

### 2\.1Lattices and decoding

We only consider the full\-rank lattice defined as follows\.222It is well\-known that the full\-rank case implies to the general case\.LetB=\(b1,…,bn\)∈ℝn×nB=\(b\_\{1\},\.\.\.,b\_\{n\}\)\\in\\mathbb\{R\}^\{n\\times n\}be a matrix with independent columns\. A full\-rank lattice generated byBBis a setℒ=ℒ⁡\(B\):=B​ℤn\\mathcal\{L\}=\\mathcal\{L\}\(B\):=B\\mathbb\{Z\}^\{n\}, i\.e\., integer linear combinations of column vectors ofBB\. We define its dual lattice by

ℒ∗:=\{y∈span⁡\(ℒ\):⟨y,x⟩∈ℤ​for every​x∈ℒ\}\\mathcal\{L\}^\{\*\}:=\\\{y\\in\{\\rm span\}\(\\mathcal\{L\}\):\\left\\langle y,x\\right\\rangle\\in\\mathbb\{Z\}\\text\{ for every \}x\\in\\mathcal\{L\}\\\}which also satisfiesℒ∗=B−T​ℤn\\mathcal\{L\}^\{\*\}=B^\{\-T\}\\mathbb\{Z\}^\{n\}whenℒ\\mathcal\{L\}is full\-rank\.

A latticeℒ′\\mathcal\{L\}^\{\\prime\}is called a sublattice ofℒ\\mathcal\{L\}ifℒ′⊆ℒ\\mathcal\{L\}^\{\\prime\}\\subseteq\\mathcal\{L\}\. Ifℒ′\\mathcal\{L\}^\{\\prime\}is a full\-rank sublattice,ℒ/ℒ′\\mathcal\{L\}/\\mathcal\{L\}^\{\\prime\}is the finite abelian group of cosetsx\+ℒ′x\+\\mathcal\{L\}^\{\\prime\}\. In particular, it holds that

ℒ/2​ℒ≅𝔽2n,ℒ∗/2​ℒ∗≅𝔽2n\.\\mathcal\{L\}/2\\mathcal\{L\}\\cong\\mathbb\{F\}\_\{2\}^\{n\},\\qquad\\mathcal\{L\}^\{\*\}/2\\mathcal\{L\}^\{\*\}\\cong\\mathbb\{F\}\_\{2\}^\{n\}\.For cosetsa\+2​ℒa\+2\\mathcal\{L\}andx\+2​ℒ∗x\+2\\mathcal\{L\}^\{\*\}, we can writea=B​u∈ℒa=Bu\\in\\mathcal\{L\}andx=B−T​z∈ℒ∗x=B^\{\-T\}z\\in\\mathcal\{L\}^\{\*\}foru,z∈𝔽2nu,z\\in\\mathbb\{F\}\_\{2\}^\{n\}\. We calluuis the parity class\. The following is well\-defined

χa​\(x\):=\(−1\)⟨x,a⟩=\(−1\)zT​u\\chi\_\{a\}\(x\):=\(\-1\)^\{\\left\\langle x,a\\right\\rangle\}=\(\-1\)^\{z^\{T\}u\}and independent of the representatives\. In the remainder of the paper, we use arbitrary representative of the coset which does not change any results\.

The first minimumλ=λ1​\(ℒ\)\\lambda=\\lambda\_\{1\}\(\\mathcal\{L\}\)isλ1​\(ℒ\):=minx∈ℒ∖\{0\}⁡‖x‖\.\\lambda\_\{1\}\(\\mathcal\{L\}\):=\\min\_\{x\\in\\mathcal\{L\}\\setminus\\\{0\\\}\}\\norm\{x\}\.ForR≥0R\\geq 0, define the counting function for the lattice points inside a ballNℒ​\(R\):=\|\(ℒ∖\{0\}\)∩B2n​\(R\)\|\.N\_\{\\mathcal\{L\}\}\(R\):=\\left\|\(\\mathcal\{L\}\\setminus\\\{0\\\}\)\\cap B\_\{2\}^\{n\}\(R\)\\right\|\.We use the following bound\[[35](https://arxiv.org/html/2608.02478#bib.bib20), Lemma 3\], based on the spherical\-code bound of\[[20](https://arxiv.org/html/2608.02478#bib.bib24)\]\.

###### Lemma 2\.1\.

Uniformly for full\-ranknn\-dimensional latticesℒ\\mathcal\{L\}andx≥1x\\geq 1, it holds forβ=20\.4014​…\\beta=2^\{0\.4014\\ldots\}

Nℒ​\(x​λ1​\(ℒ\)\)≤βn\+o⁡\(n\)​xn\.N\_\{\\mathcal\{L\}\}\(x\\lambda\_\{1\}\(\\mathcal\{L\}\)\)\\leq\\beta^\{n\+o\(n\)\}x^\{n\}\.

###### Definition 2\.2\(Search\-𝖲𝖵𝖯\\mathsf\{SVP\}\)\.

Given a basis of a full\-rank latticeℒ\\mathcal\{L\}, Search\-𝖲𝖵𝖯\\mathsf\{SVP\}asks to find a nonzerov∈ℒv\\in\\mathcal\{L\}with‖v‖=λ1​\(ℒ\)\\norm\{v\}=\\lambda\_\{1\}\(\\mathcal\{L\}\)\.

###### Definition 2\.3\(𝖡𝖣𝖣\\mathsf\{BDD\}\)\.

For0<α<1/20<\\alpha<1/2,α\\alpha\-𝖡𝖣𝖣\\mathsf\{BDD\}takes a latticeℒ\\mathcal\{L\}and a target vectorttpromised to satisfydist⁡\(t,ℒ\)<α​λ1​\(ℒ\)\\operatorname\{dist\}\(t,\\mathcal\{L\}\)<\\alpha\\lambda\_\{1\}\(\\mathcal\{L\}\)as input, and returns the unique closest lattice vector tott\.

We use the following result for preprocessing𝖡𝖣𝖣\\mathsf\{BDD\}from\[[1](https://arxiv.org/html/2608.02478#bib.bib21)\]\.

###### Theorem 2\.4\.

There is a randomized classical preprocessing algorithm for then−1/3n^\{\-1/3\}\-𝖡𝖣𝖣\\mathsf\{BDD\}problem such that:

- •its preprocessing runs in expected time and worst\-case space2n/2\+o⁡\(n\)2^\{n/2\+o\(n\)\}and succeeds with a constant probability\. After running, the size of advice is2o⁡\(n\)2^\{o\(n\)\}\.
- •given the successful preprocessing output, any instance of then−1/3n^\{\-1/3\}\-𝖡𝖣𝖣\\mathsf\{BDD\}problem can be deterministically solved in time2o⁡\(n\)2^\{o\(n\)\}and polynomial additional space\.

###### Proof\.

Plugε=exp⁡\(−n\)\\varepsilon=\\exp\(\-\\sqrt\{n\}\)in\[[1](https://arxiv.org/html/2608.02478#bib.bib21), Theorem 56\]withα=1/2\\alpha=1/2, which gives\(ϕ⁡\(ℒ\)/λ1​\(ℒ\)\)\(\\phi\(\\mathcal\{L\}\)/\\lambda\_\{1\}\(\\mathcal\{L\}\)\)\-BDD oracle inm​poly⁡\(n\)m\\operatorname\{poly\}\(n\)time and space after the DGS preprocessingϕ⁡\(ℒ\)=ln⁡\(1/ε\)/π−o⁡\(1\)2​ηε​\(ℒ∗\)\\phi\(\\mathcal\{L\}\)=\\frac\{\\sqrt\{\\ln\(1/\\eps\)/\\pi\-o\(1\)\}\}\{2\\eta\_\{\\varepsilon\}\(\\mathcal\{L\}^\{\*\}\)\}andm=O⁡\(n​ln⁡\(1/ε\)/ε\)=2o⁡\(n\)m=O\(n\\ln\(1/\\eps\)/\\sqrt\{\\varepsilon\}\)=2^\{o\(n\)\}\. An asymptotic calculation givesϕ\(ℒ\)/λ1\(ℒ\)=Ω\(n−1/4\)\\phi\(\\mathcal\{L\}\)/\\lambda\_\{1\}\(\\mathcal\{L\}\)=\\Omega\(n^\{\-1/4\}\)usingλ1​\(ℒ\)​ηε​\(ℒ∗\)≤ln⁡\(\(1\+ε\)/ε\)π\+n2​π\\lambda\_\{1\}\(\\mathcal\{L\}\)\\eta\_\{\\varepsilon\}\(\\mathcal\{L\}^\{\*\}\)\\leq\\sqrt\{\\frac\{\\ln\(\(1\+\\eps\)/\\eps\)\}\{\\pi\}\}\+\\sqrt\{\\frac\{n\}\{2\\pi\}\}\. This makes the query inm​poly⁡\(n\)=2o⁡\(n\)m\\operatorname\{poly\}\(n\)=2^\{o\(n\)\}time and space\. The preprocessing is only the discrete Gaussian samples, which can be sampled in time2n/2\+o⁡\(n\)2^\{n/2\+o\(n\)\}and space2n/2\+o⁡\(n\)\.2^\{n/2\+o\(n\)\}\.∎

We consider a time\-truncated variant that returns⊥\\botand aborts if the time is exceeded\. For an input that does not meet the promise ofn−1/3n^\{\-1/3\}\-𝖡𝖣𝖣\\mathsf\{BDD\}, there is no correctness guarantee; we use an output only after exact lattice\-membership verification\. Whenever an algorithm is repeated, every trial uses independent preprocessing and fresh randomness, and we return the shortest exactly verified nonzero vector over all trials\. Every𝖣𝖦𝖲\\mathsf\{DGS\}call is time\-truncated at its stated budget\. If the call exceeds the budget or returns too few samples, the current scale is aborted\.

### 2\.2Discrete Gaussians

Fors\>0s\>0,x∈ℝnx\\in\\mathbb\{R\}^\{n\}, and a countable setAA, define

ρs​\(x\):=exp⁡\(−π​‖x‖2s2\),ρs​\(A\):=∑x∈Aρs​\(x\)\\rho\_\{s\}\(x\):=\\exp\\\!\\left\(\-\\pi\\frac\{\\norm\{x\}^\{2\}\}\{s^\{2\}\}\\right\),\\qquad\\rho\_\{s\}\(A\):=\\sum\_\{x\\in A\}\\rho\_\{s\}\(x\)For a full\-rank latticeℒ⊂ℝn\\mathcal\{L\}\\subset\\mathbb\{R\}^\{n\}and a vectort∈ℝnt\\in\\mathbb\{R\}^\{n\}, the discrete Gaussian on a lattice cosetℒ\+t\\mathcal\{L\}\+tis

Dℒ\+t,s​\(x\):=ρs​\(x\)ρs​\(ℒ\+t\),x∈ℒ\+t\.D\_\{\\mathcal\{L\}\+t,s\}\(x\):=\\frac\{\\rho\_\{s\}\(x\)\}\{\\rho\_\{s\}\(\\mathcal\{L\}\+t\)\},\\qquad x\\in\\mathcal\{L\}\+t\.In particular,Dℒ,sD\_\{\\mathcal\{L\},s\}denotes the central caset=0\.t=0\.

###### Definition 2\.5\(Smoothing parameter\[[29](https://arxiv.org/html/2608.02478#bib.bib5),[38](https://arxiv.org/html/2608.02478#bib.bib22)\]\)\.

Forε∈\(0,1\)\\varepsilon\\in\(0,1\), the smoothing parameter is the unique positive numberηε​\(ℒ\)\\eta\_\{\\varepsilon\}\(\\mathcal\{L\}\)satisfyingρ1/ηε​\(ℒ\)​\(ℒ∗∖\{0\}\)=ε\.\\rho\_\{1/\\eta\_\{\\varepsilon\}\(\\mathcal\{L\}\)\}\(\\mathcal\{L\}^\{\*\}\\setminus\\\{0\\\}\)=\\varepsilon\.

###### Lemma 2\.6\(\[[2](https://arxiv.org/html/2608.02478#bib.bib12), Lemma 6\.1\]\)\.

Letβ\\betabe the constant in[Lemma2\.1](https://arxiv.org/html/2608.02478#S2.Thmtheorem1)\. For any full\-rank latticeℒ⊂ℝn\\mathcal\{L\}\\subset\\mathbb\{R\}^\{n\}, it holds that

η1/2​\(ℒ∗\)≤\(β2​π​e\+o⁡\(1\)\)​nλ1​\(ℒ\)\.\\eta\_\{1/2\}\(\\mathcal\{L\}^\{\*\}\)\\leq\\left\(\\frac\{\\beta\}\{\\sqrt\{2\\pi e\}\}\+o\(1\)\\right\)\\frac\{\\sqrt\{n\}\}\{\\lambda\_\{1\}\(\\mathcal\{L\}\)\}\.

###### Theorem 2\.7\(\[[2](https://arxiv.org/html/2608.02478#bib.bib12), Theorem 5\.11\]\)\.

Letℒ⊂ℝn\\mathcal\{L\}\\subset\\mathbb\{R\}^\{n\}be a full\-rank lattice,s\>0s\>0, andκ=Ω⁡\(n\)\\kappa=\\Omega\(n\)\. There is a classical algorithm𝖣𝖦𝖲\\mathsf\{DGS\}that outputs at mostM=2n/2M=2^\{n/2\}lattice vectors in time2n/2\+polylog⁡\(κ\)\+o⁡\(n\)2^\{n/2\+\\operatorname\{polylog\}\(\\kappa\)\+o\(n\)\}and space2n/2\+o⁡\(n\)2^\{n/2\+o\(n\)\}\. Its output distribution isexp⁡\(−Ω⁡\(κ\)\)\\exp\(\-\\Omega\(\\kappa\)\)\-close to the following distribution: chooseM′∈\{0,…,M\}M^\{\\prime\}\\in\\\{0,\\ldots,M\\\}, drawX1,…,XMX\_\{1\},\\ldots,X\_\{M\}independently fromDℒ,sD\_\{\\mathcal\{L\},s\}and independently ofM′M^\{\\prime\}, and outputX1,…,XM′X\_\{1\},\\ldots,X\_\{M^\{\\prime\}\}\. Ifs\>2​η1/2​\(ℒ\)s\>\\sqrt\{2\}\\eta\_\{1/2\}\(\\mathcal\{L\}\), thenM′=MM^\{\\prime\}=M\.

###### Lemma 2\.8\.

For everyc\>0c\>0, there is a constantCc\>0C\_\{c\}\>0such that, for every latticeℒ\\mathcal\{L\}, everys\>0s\>0, andX∼Dℒ,sX\\sim D\_\{\\mathcal\{L\},s\},

ℙ\[‖X‖\>Ccsn\]≤2−2​c​nand𝔼\[‖X‖2𝟏\{‖X‖\>Ccsn\}\]≤s2n2−c​n\.\\mathbb\{P\}\[\\norm\{X\}\>C\_\{c\}s\\sqrt\{n\}\]\\leq 2^\{\-2cn\}\\qquad\\text\{and\}\\qquad\\mathbb\{E\}\\left\[\\norm\{X\}^\{2\}\\mathbf\{1\}\_\{\\\{\\norm\{X\}\>C\_\{c\}s\\sqrt\{n\}\\\}\}\\right\]\\leq s^\{2\}n\\,2^\{\-cn\}\.

###### Proof\.

The discrete\-Gaussian tail inequality\[[2](https://arxiv.org/html/2608.02478#bib.bib12), Lemma 2\.4\]gives, for all sufficiently large constantstt,

ℙ\[‖X‖\>tsn\]≤\(2​π​e⋅te−π​t2\)n\.\\mathbb\{P\}\[\\norm\{X\}\>ts\\sqrt\{n\}\]\\leq\\left\(\\sqrt\{2\\pi e\}\\cdot te^\{\-\\pi t^\{2\}\}\\right\)^\{n\}\.Chooset=Cct=C\_\{c\}sufficiently large \(which only depends oncc\) so that

2​π​e⋅t​e−π​t2≤e−π​t22≤2−2​c\\sqrt\{2\\pi e\}\\cdot te^\{\-\\pi t^\{2\}\}\\leq e^\{\\frac\{\-\\pi t^\{2\}\}\{2\}\}\\leq 2^\{\-2c\}holds, which proves the first part\. For the second part, the tail integration formula forY=‖X‖Y=\\norm\{X\}gives

𝔼\[Y2𝟏\{Y\>u\}\]=u2ℙ\[Y\>u\]\+∫u∞2zℙ\[Y\>z\]dz\.\\mathbb\{E\}\[Y^\{2\}\\mathbf\{1\}\_\{\\\{Y\>u\\\}\}\]=u^\{2\}\\mathbb\{P\}\[Y\>u\]\+\\int\_\{u\}^\{\\infty\}2z\\mathbb\{P\}\[Y\>z\]dz\.Takingu=Cc​s​nu=C\_\{c\}s\\sqrt\{n\}andz=t​s​nz=ts\\sqrt\{n\}, we have

𝔼\[Y2𝟏\{Y\>Ccsn\}\]\\displaystyle\\mathbb\{E\}\[Y^\{2\}\\mathbf\{1\}\_\{\\\{Y\>C\_\{c\}s\\sqrt\{n\}\\\}\}\]≤Cc2s2n2−2​c​n\+s2n∫Cc∞2t⋅ℙ\[‖X‖\>tsn\]dt\\displaystyle\\leq C\_\{c\}^\{2\}s^\{2\}n2^\{\-2cn\}\+s^\{2\}n\\int\_\{C\_\{c\}\}^\{\\infty\}2t\\cdot\\mathbb\{P\}\[\\norm\{X\}\>ts\\sqrt\{n\}\]dt≤Cc2​s2​n​2−2​c​n\+s2​n​∫Cc∞2​t⋅exp⁡\(−n​π​t22\)​𝑑t\\displaystyle\\leq C\_\{c\}^\{2\}s^\{2\}n2^\{\-2cn\}\+s^\{2\}n\\int\_\{C\_\{c\}\}^\{\\infty\}2t\\cdot\\exp\\left\(\\frac\{\-n\\pi t^\{2\}\}\{2\}\\right\)dt=Cc2​s2​n​2−2​c​n\+s2​n⋅2​e−π​n​Cc22π​n\\displaystyle=C\_\{c\}^\{2\}s^\{2\}n2^\{\-2cn\}\+s^\{2\}n\\cdot\\frac\{2e^\{\\frac\{\-\\pi nC\_\{c\}^\{2\}\}\{2\}\}\}\{\\pi n\}≤s2​n​\(Cc2\+2π​n\)​2−2​c​n\\displaystyle\\leq s^\{2\}n\\left\(C\_\{c\}^\{2\}\+\\frac\{2\}\{\\pi n\}\\right\)2^\{\-2cn\}where the last term is smaller thans2​n​2−c​ns^\{2\}n2^\{\-cn\}for sufficiently largenn\. ∎

### 2\.3Useful inequalities

We use the following standard probability bounds\.

###### Lemma 2\.9\(Markov’s inequality\)\.

For a random variableY≥0Y\\geq 0anda\>0a\>0,ℙ\[Y≥a\]≤𝔼\[Y\]/a\.\\mathbb\{P\}\[Y\\geq a\]\\leq\{\\mathbb\{E\}\[Y\]\}/a\.

###### Lemma 2\.10\(Chebyshev’s inequality\)\.

IfYYhas finite variance anda\>0a\>0,ℙ\[\|Y−𝔼\[Y\]\|≥a\]≤Var\(Y\)/a2\.\\mathbb\{P\}\[\|Y\-\\mathbb\{E\}\[Y\]\|\\geq a\]\\leq\{\\operatorname\{Var\}\(Y\)\}/\{a^\{2\}\}\.

###### Lemma 2\.11\(Hoeffding’s inequality\)\.

IfY1,…,YNY\_\{1\},\\ldots,Y\_\{N\}are independent andai≤Yi≤bia\_\{i\}\\leq Y\_\{i\}\\leq b\_\{i\}andδ\>0\\delta\>0,ℙ\[\|1N∑i=1N\(Yi−𝔼\[Yi\]\)\|≥δ\]≤2exp\(−2​N2​δ2∑i=1N\(bi−ai\)2\)\.\\mathbb\{P\}\\left\[\\left\|\\frac\{1\}\{N\}\\sum\_\{i=1\}^\{N\}\(Y\_\{i\}\-\\mathbb\{E\}\[Y\_\{i\}\]\)\\right\|\\geq\\delta\\right\]\\leq 2\\exp\\left\(\-\\frac\{2N^\{2\}\\delta^\{2\}\}\{\\sum\_\{i=1\}^\{N\}\(b\_\{i\}\-a\_\{i\}\)^\{2\}\}\\right\)\.

###### Lemma 2\.12\(Chernoff bound\)\.

IfY1,…,YNY\_\{1\},\\ldots,Y\_\{N\}are independent Bernoulli random variables and0<δ≤10<\\delta\\leq 1, then

ℙ\[\|∑i=1NYi−∑i=1N𝔼\[Yi\]\|≥δ∑i=1N𝔼\[Yi\]\]≤2exp\(−δ23∑i=1N𝔼\[Yi\]\)\.\\mathbb\{P\}\\left\[\\left\|\\sum\_\{i=1\}^\{N\}Y\_\{i\}\-\\sum\_\{i=1\}^\{N\}\\mathbb\{E\}\[Y\_\{i\}\]\\right\|\\geq\\delta\\sum\_\{i=1\}^\{N\}\\mathbb\{E\}\[Y\_\{i\}\]\\right\]\\leq 2\\exp\\left\(\-\\frac\{\\delta^\{2\}\}\{3\}\\sum\_\{i=1\}^\{N\}\\mathbb\{E\}\[Y\_\{i\}\]\\right\)\.

###### Lemma 2\.13\.

IfE1,…,EmE\_\{1\},\\ldots,E\_\{m\}are independent events withℙ⁡\[Ei\]≤p<1/4\\mathbb\{P\}\[E\_\{i\}\]\\leq p<1/4, then

ℙ\[∑i=1m𝟏Ei≥m2\]≤2mpm/2\.\\mathbb\{P\}\\left\[\\sum\_\{i=1\}^\{m\}\\mathbf\{1\}\_\{E\_\{i\}\}\\geq\\frac\{m\}\{2\}\\right\]\\leq 2^\{m\}p^\{m/2\}\.

## 3Recovering Shortest Vector from Hessian

We assume that an approximate shortest\-vector lengthddsatisfying

λ1​\(ℒ\)≤d≤\(1\+1/n\)​λ1​\(ℒ\)\\displaystyle\\lambda\_\{1\}\(\\mathcal\{L\}\)\\leq d\\leq\(1\+1/n\)\\lambda\_\{1\}\(\\mathcal\{L\}\)\(3\)is known\. This can be assumed by applying LLL\[[25](https://arxiv.org/html/2608.02478#bib.bib26)\]and guessingddfrom\{\(1\+1/n\)−j​‖x‖\}j=0,…,n2\\\{\(1\+1/n\)^\{\-j\}\\norm\{x\}\\\}\_\{j=0,\\ldots,n^\{2\}\}, wherexxis the resulting nonzero vector\. We formalize this in the final algorithm\.

It will be convenient to define the following parameters:

ξt=ξt​\(d\):=4​n​t​ln⁡2π​d2,t0:=β24​e​ln⁡2=0\.23147​…\\displaystyle\\xi\_\{t\}=\\xi\_\{t\}\(d\):=\\sqrt\{\\frac\{4nt\\ln 2\}\{\\pi d^\{2\}\}\},\\qquad t\_\{0\}:=\\frac\{\\beta^\{2\}\}\{4e\\ln 2\}=0\.23147\\ldots\(4\)These choices give the Gaussian\-mass estimates in[Corollary3\.2](https://arxiv.org/html/2608.02478#S3.Thmtheorem2)\. It will be convenient to note that for most of our interested case the following holds for most choices oftt:

ξt2=Θ⁡\(n/d2\)=Θ⁡\(n/λ2\)\.\\displaystyle\\xi\_\{t\}^\{2\}=\\Theta\(n/d^\{2\}\)=\\Theta\(n/\\lambda^\{2\}\)\.\(5\)
### 3\.1Scale and Gaussian mass bounds

###### Lemma 3\.1\.

Letℒ\\mathcal\{L\}be annn\-dimensional full\-rank lattice and letλ=λ1​\(ℒ\)\\lambda=\\lambda\_\{1\}\(\\mathcal\{L\}\)\. Lets=Θ⁡\(λ/n\)s=\\Theta\(\\lambda/\\sqrt\{n\}\)and letk≥0k\\geq 0be a constant\. Then

∑x∈ℒ∖\{0\}\(1\+‖x‖λ\)k​ρs​\(x\)≤2o⁡\(n\)​\(β2​n​s22​π​e​λ2\)n/2\.\\sum\_\{x\\in\\mathcal\{L\}\\setminus\\\{0\\\}\}\\left\(1\+\\frac\{\\norm\{x\}\}\{\\lambda\}\\right\)^\{k\}\\rho\_\{s\}\(x\)\\leq 2^\{o\(n\)\}\\left\(\\frac\{\\beta^\{2\}ns^\{2\}\}\{2\\pi e\\lambda^\{2\}\}\\right\)^\{n/2\}\.

###### Proof\.

The casek=0k=0is essentially\[[2](https://arxiv.org/html/2608.02478#bib.bib12), Lemma 4\.2\]\. The same shell argument gives

∑x∈ℒ∖\{0\}\(1\+‖x‖λ\)kρs\(x\)≤2kβn\+o⁡\(n\)maxy≥0yn\+ke−πλ2y2/s2≤βn\+o⁡\(n\)maxy\>0yn\+ke−πλ2y2/s2\.\\sum\_\{x\\in\\mathcal\{L\}\\setminus\\\{0\\\}\}\\left\(1\+\\frac\{\\norm\{x\}\}\{\\lambda\}\\right\)^\{k\}\\rho\_\{s\}\(x\)\\leq 2^\{k\}\\beta^\{n\+o\(n\)\}\\max\_\{y\\geq 0\}y^\{n\+k\}e^\{\-\\pi\\lambda^\{2\}y^\{2\}/s^\{2\}\}\\leq\\beta^\{n\+o\(n\)\}\\max\_\{y\>0\}y^\{n\+k\}e^\{\-\\pi\\lambda^\{2\}y^\{2\}/s^\{2\}\}\.Here we used‖x‖≥λ\\norm\{x\}\\geq\\lambdaand hence

\(1\+‖x‖λ\)k≤2k​\(‖x‖λ\)k\.\\left\(1\+\\frac\{\\norm\{x\}\}\{\\lambda\}\\right\)^\{k\}\\leq 2^\{k\}\\left\(\\frac\{\\norm\{x\}\}\{\\lambda\}\\right\)^\{k\}\.The maximum is attained aty2=\(n\+k\)​s22​π​λ2,y^\{2\}=\\frac\{\(n\+k\)s^\{2\}\}\{2\\pi\\lambda^\{2\}\},and its value is\(\(n\+k\)​s22​π​e​λ2\)\(n\+k\)/2\.\\left\(\\frac\{\(n\+k\)s^\{2\}\}\{2\\pi e\\lambda^\{2\}\}\\right\)^\{\(n\+k\)/2\}\.Sinces=Θ⁡\(λ/n\)s=\\Theta\(\\lambda/\\sqrt\{n\}\)andkkis fixed, replacingn\+kn\+kbynnchanges the expression by only2o⁡\(n\)2^\{o\(n\)\}\. The fixed factor2k2^\{k\}and the subexponential shell\-summation factor are absorbed into the same term\. ∎

###### Corollary 3\.2\.

Letλ=λ1​\(ℒ\)\\lambda=\\lambda\_\{1\}\(\\mathcal\{L\}\)andλ≤d≤\(1\+1/n\)​λ\\lambda\\leq d\\leq\(1\+1/n\)\\lambda\. For every fixeda\>0a\>0andk≥0k\\geq 0,

∑x∈ℒ∖\{0\}\(1\+‖x‖λ1​\(ℒ\)\)k​ρa/ξt​\(x\)≤2\(12​log2​a2​t02​t\+o⁡\(1\)\)​n\.\\sum\_\{x\\in\\mathcal\{L\}\\setminus\\\{0\\\}\}\\left\(1\+\\frac\{\\norm\{x\}\}\{\\lambda\_\{1\}\(\\mathcal\{L\}\)\}\\right\)^\{k\}\\rho\_\{a/\\xi\_\{t\}\}\(x\)\\leq 2^\{\\left\(\\frac\{1\}\{2\}\\log\_\{2\}\\frac\{a^\{2\}t\_\{0\}\}\{2t\}\+o\(1\)\\right\)n\}\.Consequently, for every fixeda\>0a\>0andk\>0k\>0,

∑x∈ℒ‖x‖k​ρa/ξt​\(x\)≤λk​2\(12​log2​a2​t02​t\+o⁡\(1\)\)​n\\displaystyle\\sum\_\{x\\in\\mathcal\{L\}\}\\norm\{x\}^\{k\}\\rho\_\{a/\\xi\_\{t\}\}\(x\)\\leq\\lambda^\{k\}2^\{\(\\frac\{1\}\{2\}\\log\_\{2\}\\frac\{a^\{2\}t\_\{0\}\}\{2t\}\+o\(1\)\)n\}\(6\)In particular, the following hold:

- •For a \(possibly negative\) constantcc, it holds thatρ21\+c/ξt​\(ℒ\)≤1\+2\(c/2−12​log2​tt0\+o⁡\(1\)\)​n\.\\rho\_\{\\sqrt\{2^\{1\+c\}\}/\\xi\_\{t\}\}\(\\mathcal\{L\}\)\\leq 1\+2^\{\(c/2\-\\frac\{1\}\{2\}\\log\_\{2\}\\frac\{t\}\{t\_\{0\}\}\+o\(1\)\)n\}\.
- •Ift\>t0/2t\>t\_\{0\}/2, thenρ1/ξt​\(ℒ\)=1\+2−Ω⁡\(n\)\.\\rho\_\{1/\\xi\_\{t\}\}\(\\mathcal\{L\}\)=1\+2^\{\-\\Omega\(n\)\}\.
- •Ift\>t0t\>t\_\{0\}, thenξt\>2​η1/2​\(ℒ∗\),\\xi\_\{t\}\>\\sqrt\{2\}\\,\\eta\_\{1/2\}\(\\mathcal\{L\}^\{\*\}\),and[Theorem2\.7](https://arxiv.org/html/2608.02478#S2.Thmtheorem7)applies toℒ∗\\mathcal\{L\}^\{\*\}at parameterξt\\xi\_\{t\}\.

###### Proof\.

Fors=a/ξts=a/\\xi\_\{t\}, we haveβ2​n​s22​π​e​λ2=a2​t02​t​d2λ2\.\\frac\{\\beta^\{2\}ns^\{2\}\}\{2\\pi e\\lambda^\{2\}\}=\\frac\{a^\{2\}t\_\{0\}\}\{2t\}\\frac\{d^\{2\}\}\{\\lambda^\{2\}\}\.The first claim follows from[Lemma3\.1](https://arxiv.org/html/2608.02478#S3.Thmtheorem1), sinced/λ≤1\+1/nd/\\lambda\\leq 1\+1/n\. The second claim follows from the first because its term atx=0x=0vanishes and‖x‖k≤λk​\(1\+‖x‖/λ\)k\\norm\{x\}^\{k\}\\leq\\lambda^\{k\}\(1\+\\norm\{x\}/\\lambda\)^\{k\}forx≠0x\\neq 0\. The first bound follows by takinga=2c\+1a=\\sqrt\{2^\{c\+1\}\}for givenccandk=0k=0\. Pluggingt\>t0/2t\>t\_\{0\}/2gives the second bound\. Ift\>t0t\>t\_\{0\}, then the bound gives

ρ2/ξt​\(ℒ∖\{0\}\)<12\\rho\_\{\\sqrt\{2\}/\\xi\_\{t\}\}\(\\mathcal\{L\}\\setminus\\\{0\\\}\)<\\frac\{1\}\{2\}for all sufficiently largenn\. The definition and monotonicity of the smoothing parameter give the last claim\. ∎

### 3\.2The periodic Gaussian and the shortest parity class

Fors\>0s\>0, define the periodic Gaussian function\[[5](https://arxiv.org/html/2608.02478#bib.bib25),[14](https://arxiv.org/html/2608.02478#bib.bib23)\]by

Fs​\(z\):=ρs​\(ℒ\+z\)ρs​\(ℒ\),z∈ℝn\.\\displaystyle F\_\{s\}\(z\):=\\frac\{\\rho\_\{s\}\(\\mathcal\{L\}\+z\)\}\{\\rho\_\{s\}\(\\mathcal\{L\}\)\},\\qquad z\\in\\mathbb\{R\}^\{n\}\.\(7\)The following is the Poisson representation ofFsF\_\{s\}\.

Fs​\(z\)=𝔼X∼Dℒ∗,1/s​\[e2​π​i​⟨X,z⟩\]\.\\displaystyle F\_\{s\}\(z\)=\\mathbb\{E\}\_\{X\\sim D\_\{\\mathcal\{L\}^\{\*\},1/s\}\}\\left\[e^\{2\\pi i\\left\\langle X,z\\right\\rangle\}\\right\]\.\(8\)
Foru∈𝔽2nu\\in\\mathbb\{F\}\_\{2\}^\{n\}, define the Hessian

𝒢t,d​\(u\):=∇2F1/ξt​\(B​u/2\)\.\\mathcal\{G\}\_\{t,d\}\(u\):=\\nabla^\{2\}F\_\{1/\\xi\_\{t\}\}\(Bu/2\)\.We also define

𝒜t,d​\(u\):=𝒢t,d​\(u\)\+2​π​ξt2​F1/ξt​\(B​u/2\)​In\.\\displaystyle\\mathcal\{A\}\_\{t,d\}\(u\):=\\mathcal\{G\}\_\{t,d\}\(u\)\+2\\pi\\xi\_\{t\}^\{2\}F\_\{1/\\xi\_\{t\}\}\(Bu/2\)I\_\{n\}\.\(9\)For fixeduu,𝒜t,d​\(u\)\\mathcal\{A\}\_\{t,d\}\(u\)and𝒢t,d​\(u\)\\mathcal\{G\}\_\{t,d\}\(u\)differ by2​π​ξt2​F1/ξt​\(B​u/2\)​In2\\pi\\xi\_\{t\}^\{2\}F\_\{1/\\xi\_\{t\}\}\(Bu/2\)I\_\{n\}, a constant multiple ofInI\_\{n\}\. Hence the two matrices have the same eigenvectors and eigengaps\. We will use the following alternative formula\.

###### Lemma 3\.3\.

For everyu∈𝔽2nu\\in\\mathbb\{F\}\_\{2\}^\{n\},

𝒢t,d​\(u\)=−4​π2​𝔼X∼Dℒ∗,ξt​\[X​XT​\(−1\)uT​\(BT​Xmod2\)\]\.\\displaystyle\\mathcal\{G\}\_\{t,d\}\(u\)=\-4\\pi^\{2\}\\mathbb\{E\}\_\{X\\sim D\_\{\\mathcal\{L\}^\{\*\},\\xi\_\{t\}\}\}\\left\[XX^\{T\}\(\-1\)^\{u^\{T\}\(B^\{T\}X\\bmod 2\)\}\\right\]\.\(10\)Moreover, the following equality holds thus𝒜t,d​\(u\)\\mathcal\{A\}\_\{t,d\}\(u\)is positive semidefinite:

𝒜t,d\(u\)=π2​ξt4ρ1/ξt​\(ℒ\)∑w∈B​u\+2​ℒwwTe−πξt2‖w‖2/4\.\\displaystyle\\mathcal\{A\}\_\{t,d\}\(u\)=\\frac\{\\pi^\{2\}\\xi\_\{t\}^\{4\}\}\{\\rho\_\{1/\\xi\_\{t\}\}\(\\mathcal\{L\}\)\}\\sum\_\{w\\in Bu\+2\\mathcal\{L\}\}ww^\{T\}e^\{\-\\pi\\xi\_\{t\}^\{2\}\\norm\{w\}^\{2\}/4\}\.\(11\)

###### Proof\.

Differentiating the expression in[Eq\.8](https://arxiv.org/html/2608.02478#S3.E8)gives

∇2Fs​\(z\)=−4​π2​𝔼X∼Dℒ∗,1/s​\[X​XT​e2​π​i​⟨X,z⟩\]\.\\nabla^\{2\}F\_\{s\}\(z\)=\-4\\pi^\{2\}\\mathbb\{E\}\_\{X\\sim D\_\{\\mathcal\{L\}^\{\*\},1/s\}\}\\left\[XX^\{T\}e^\{2\\pi i\\left\\langle X,z\\right\\rangle\}\\right\]\.Sets=1/ξts=1/\\xi\_\{t\}andz=B​u/2z=Bu/2\. SinceBT​X∈ℤnB^\{T\}X\\in\\mathbb\{Z\}^\{n\},

e2​π​i​⟨X,B​u/2⟩=eπ​i​uT​BT​X=\(−1\)uT​\(BT​Xmod2\)\.e^\{2\\pi i\\left\\langle X,Bu/2\\right\\rangle\}=e^\{\\pi iu^\{T\}B^\{T\}X\}=\(\-1\)^\{u^\{T\}\(B^\{T\}X\\bmod 2\)\}\.This proves the first identity\.

Differentiating the expression in[Eq\.7](https://arxiv.org/html/2608.02478#S3.E7)and usingℒ=−ℒ\\mathcal\{L\}=\-\\mathcal\{L\}gives

∇2Fs\(z\)=1ρs​\(ℒ\)∑y∈ℒ\(4​π2s4\(y−z\)\(y−z\)T−2​πs2In\)⋅e−π‖y−z‖2/s2\.\\nabla^\{2\}F\_\{s\}\(z\)=\\frac\{1\}\{\\rho\_\{s\}\(\\mathcal\{L\}\)\}\\sum\_\{y\\in\\mathcal\{L\}\}\\left\(\\frac\{4\\pi^\{2\}\}\{s^\{4\}\}\(y\-z\)\(y\-z\)^\{T\}\-\\frac\{2\\pi\}\{s^\{2\}\}I\_\{n\}\\right\)\\cdot e^\{\-\\pi\\norm\{y\-z\}^\{2\}/s^\{2\}\}\.It follows that

∇2Fs\(z\)\+2​πs2Fs\(z\)In=4​π2s4​ρs​\(ℒ\)∑y∈ℒ\(y−z\)\(y−z\)Te−π‖y−z‖2/s2\.\\nabla^\{2\}F\_\{s\}\(z\)\+\\frac\{2\\pi\}\{s^\{2\}\}F\_\{s\}\(z\)I\_\{n\}=\\frac\{4\\pi^\{2\}\}\{s^\{4\}\\rho\_\{s\}\(\\mathcal\{L\}\)\}\\sum\_\{y\\in\\mathcal\{L\}\}\(y\-z\)\(y\-z\)^\{T\}e^\{\-\\pi\\norm\{y\-z\}^\{2\}/s^\{2\}\}\.Again sets=1/ξts=1/\\xi\_\{t\},z=B​u/2z=Bu/2, and reindex byw=2​y−B​uw=2y\-Bu\. The second identity follows from−B​u\+2​ℒ=B​u\+2​ℒ\-Bu\+2\\mathcal\{L\}=Bu\+2\\mathcal\{L\}\. ∎

The following lemma shows that, if a shortest vectorvvis included in the cosetB​u\+2​ℒBu\+2\\mathcal\{L\}, the matrix𝒜t,d​\(u\)\\mathcal\{A\}\_\{t,d\}\(u\)is approximately proportional to the matrixv​vTvv^\{T\}\.

###### Lemma 3\.4\.

Lett\>t0t\>t\_\{0\}andλ=λ1​\(ℒ\)≤d≤\(1\+1/n\)​λ\.\\lambda=\\lambda\_\{1\}\(\\mathcal\{L\}\)\\leq d\\leq\(1\+1/n\)\\lambda\.Letv∈ℒv\\in\\mathcal\{L\}satisfy‖v‖=λ\\norm\{v\}=\\lambdaandu∈𝔽2nu\\in\\mathbb\{F\}\_\{2\}^\{n\}satisfyv∈B​u\+2​ℒ\.v\\in Bu\+2\\mathcal\{L\}\.For the normalized vectorv^=v/λ\\widehat\{v\}=v/\\lambda, it holds that

𝒜t,d\(u\)=μt,dv^v^T\+ℛt,d\(u\)forμt,d:=2​π2​ξt4​λ2ρ1/ξt​\(ℒ\)e−πξt2λ2/4=ξt4λ22−t​n\+O⁡\(1\),\\displaystyle\\mathcal\{A\}\_\{t,d\}\(u\)=\\mu\_\{t,d\}\\widehat\{v\}\\widehat\{v\}^\{T\}\+\\mathcal\{R\}\_\{t,d\}\(u\)\\qquad\\text\{ for \}\\quad\\mu\_\{t,d\}:=\\frac\{2\\pi^\{2\}\\xi\_\{t\}^\{4\}\\lambda^\{2\}\}\{\\rho\_\{1/\\xi\_\{t\}\}\(\\mathcal\{L\}\)\}e^\{\-\\pi\\xi\_\{t\}^\{2\}\\lambda^\{2\}/4\}=\\xi\_\{t\}^\{4\}\\lambda^\{2\}2^\{\-tn\+O\(1\)\},\(12\)whereℛt,d​\(u\)\\mathcal\{R\}\_\{t,d\}\(u\)is positive semidefinite such that‖ℛt,d​\(u\)‖op≤μt,d⋅2\(−12​log2​tt0\+o⁡\(1\)\)​n\.\\norm\{\\cR\_\{t,d\}\(u\)\}\_\{\\mathrm\{op\}\}\\leq\\mu\_\{t,d\}\\cdot 2^\{\\left\(\-\\frac\{1\}\{2\}\\log\_\{2\}\\frac\{t\}\{t\_\{0\}\}\+o\(1\)\\right\)n\}\.

###### Proof\.

SinceB​u\+2​ℒ=v\+2​ℒ,Bu\+2\\mathcal\{L\}=v\+2\\mathcal\{L\},the termsw=vw=vandw=−vw=\-vin[Eq\.11](https://arxiv.org/html/2608.02478#S3.E11)contribute

2​π2​ξt4ρ1/ξt​\(ℒ\)vvTe−πξt2λ2/4=μt,dv^v^T\.\\frac\{2\\pi^\{2\}\\xi\_\{t\}^\{4\}\}\{\\rho\_\{1/\\xi\_\{t\}\}\(\\mathcal\{L\}\)\}vv^\{T\}e^\{\-\\pi\\xi\_\{t\}^\{2\}\\lambda^\{2\}/4\}=\\mu\_\{t,d\}\\widehat\{v\}\\widehat\{v\}^\{T\}\.Letℛt,d​\(u\)\\mathcal\{R\}\_\{t,d\}\(u\)be the sum of the remaining terms\. It is positive semidefinite\.

Write every element ofv\+2​ℒv\+2\\mathcal\{L\}asw=−v\+2​yw=\-v\+2yfory∈ℒy\\in\\mathcal\{L\}\. The two removed terms correspond toy=0y=0andy=vy=v\. Sinceℛt,d​\(u\)\\mathcal\{R\}\_\{t,d\}\(u\)is positive semidefinite, we have‖ℛt,d​\(u\)‖op≤Tr⁡\(ℛt,d​\(u\)\)\.\\norm\{\\cR\_\{t,d\}\(u\)\}\_\{\\mathrm\{op\}\}\\leq\\operatorname\{Tr\}\\left\(\\mathcal\{R\}\_\{t,d\}\(u\)\\right\)\.This gives

‖ℛt,d​\(u\)‖opμt,d≤2​∑y∈ℒ∖\{0,v\}‖y−v/2‖2λ2​e−π​ξt2​\(‖y−v/2‖2−λ2/4\)\.\\begin\{split\}\\frac\{\\norm\{\\cR\_\{t,d\}\(u\)\}\_\{\\mathrm\{op\}\}\}\{\\mu\_\{t,d\}\}&\\leq 2\\sum\_\{y\\in\\mathcal\{L\}\\setminus\\\{0,v\\\}\}\\frac\{\\norm\{y\-v/2\}^\{2\}\}\{\\lambda^\{2\}\}e^\{\-\\pi\\xi\_\{t\}^\{2\}\\left\(\\norm\{y\-v/2\}^\{2\}\-\\lambda^\{2\}/4\\right\)\}\.\\end\{split\}Fory∉\{0,v\}y\\notin\\\{0,v\\\}, bothyyandy−vy\-vare nonzero lattice vectors\. Hence

‖y−v/2‖2−λ24=‖y‖2\+‖y−v‖2−λ22≥‖y‖22\.\\norm\{y\-v/2\}^\{2\}\-\\frac\{\\lambda^\{2\}\}\{4\}=\\frac\{\\norm\{y\}^\{2\}\+\\norm\{y\-v\}^\{2\}\-\\lambda^\{2\}\}\{2\}\\geq\\frac\{\\norm\{y\}^\{2\}\}\{2\}\.Moreover,

‖y−v/2‖λ≤‖y‖λ\+‖v‖2​λ≤‖y‖λ\+1\\frac\{\\norm\{y\-v/2\}\}\{\\lambda\}\\leq\\frac\{\\norm\{y\}\}\{\\lambda\}\+\\frac\{\\norm\{v\}\}\{2\\lambda\}\\leq\\frac\{\\norm\{y\}\}\{\\lambda\}\+1Combining these two bounds and[Corollary3\.2](https://arxiv.org/html/2608.02478#S3.Thmtheorem2)witha=2a=\\sqrt\{2\}andk=2k=2gives

‖ℛt,d​\(u\)‖opμt,d≤2​∑y∈ℒ∖\{0\}\(1\+‖y‖λ\)2​ρ2/ξt​\(y\)≤2\(−12​log2​tt0\+o⁡\(1\)\)​n\.\\frac\{\\norm\{\\cR\_\{t,d\}\(u\)\}\_\{\\mathrm\{op\}\}\}\{\\mu\_\{t,d\}\}\\leq 2\\sum\_\{y\\in\\mathcal\{L\}\\setminus\\\{0\\\}\}\\left\(1\+\\frac\{\\norm\{y\}\}\{\\lambda\}\\right\)^\{2\}\\rho\_\{\\sqrt\{2\}/\\xi\_\{t\}\}\(y\)\\leq 2^\{\\left\(\-\\frac\{1\}\{2\}\\log\_\{2\}\\frac\{t\}\{t\_\{0\}\}\+o\(1\)\\right\)n\}\.
Finally, the asymptotic ofμt,d\\mu\_\{t,d\}follows from the choice ofξt\\xi\_\{t\}in[Eq\.4](https://arxiv.org/html/2608.02478#S3.E4)andλ≤d≤\(1\+1/n\)​λ\\lambda\\leq d\\leq\(1\+1/n\)\\lambda, as well asρ1/ξt​\(ℒ\)=1\+2−Ω⁡\(n\)\\rho\_\{1/\\xi\_\{t\}\}\(\\mathcal\{L\}\)=1\+2^\{\-\\Omega\(n\)\}by[Corollary3\.2](https://arxiv.org/html/2608.02478#S3.Thmtheorem2)\. ∎

### 3\.3Estimating the Hessians and recovering a shortest vector

By[Lemma3\.4](https://arxiv.org/html/2608.02478#S3.Thmtheorem4), the exact Hessian at the parity class of a shortest vectorvvcontains some information aboutvv\. In this section, we show how to actually recovervvusing this property\. As discussed in the overview, this can be done by the three steps; 1\) compute an estimation of Hessian, 2\) compute a unit vector close to the direction ofvv, and 3\) recover the vectorvvusing \(preprocessing\)𝖡𝖣𝖣\\mathsf\{BDD\}oracle from[Theorem2\.4](https://arxiv.org/html/2608.02478#S2.Thmtheorem4)\.

Fix0<t<1/40<t<1/4and letNt=⌈n5​log⁡n⋅22​t​n⌉N\_\{t\}=\\lceil n^\{5\}\\log n\\cdot 2^\{2tn\}\\rceil\.333Throughout this paper, we do not try to optimize the polynomial factors\.For independentX1,…,XNt∼Dℒ∗,ξtX\_\{1\},\\ldots,X\_\{N\_\{t\}\}\\sim D\_\{\\mathcal\{L\}^\{\*\},\\xi\_\{t\}\}andu∈𝔽2nu\\in\\mathbb\{F\}\_\{2\}^\{n\}, define

𝒢^t,d\(u\):=−4​π2Nt∑i=1NtXiXiT\(−1\)uT​\(BT​Ximod2\)𝟏\{‖Xi‖≤C1ξtn\},\\displaystyle\\widehat\{\\mathcal\{G\}\}\_\{t,d\}\(u\):=\-\\frac\{4\\pi^\{2\}\}\{N\_\{t\}\}\\sum\_\{i=1\}^\{N\_\{t\}\}X\_\{i\}X\_\{i\}^\{T\}\(\-1\)^\{u^\{T\}\(B^\{T\}X\_\{i\}\\bmod 2\)\}\\mathbf\{1\}\_\{\\\{\\norm\{X\_i\}\\leq C\_\{1\}\\xi\_\{t\}\\sqrt\{n\}\\\}\},\(13\)whereC1C\_\{1\}is the constant in[Lemma2\.8](https://arxiv.org/html/2608.02478#S2.Thmtheorem8)forc=1c=1\. The parameters will be chosen so that we can use the𝖣𝖦𝖲\\mathsf\{DGS\}algorithm in[Theorem2\.7](https://arxiv.org/html/2608.02478#S2.Thmtheorem7)\.

The following lemma shows that𝒢^\\widehat\{\\mathcal\{G\}\}approximate𝒢\\mathcal\{G\}accurately\.

###### Lemma 3\.5\.

For every fixed0<t<1/40<t<1/4, with probability1−2−Ω⁡\(n​log⁡n\)1\-2^\{\-\\Omega\(n\\log n\)\}, it holds for allu∈𝔽2nu\\in\\mathbb\{F\}\_\{2\}^\{n\}that

maxu∈𝔽2n⁡‖𝒢^t,d​\(u\)−𝒢t,d​\(u\)‖op≤2​ξt2​2−t​n\.\\max\_\{u\\in\\mathbb\{F\}\_\{2\}^\{n\}\}\\left\\lVert\\widehat\{\\mathcal\{G\}\}\_\{t,d\}\(u\)\-\\mathcal\{G\}\_\{t,d\}\(u\)\\right\\rVert\_\{\\mathrm\{op\}\}\\leq 2\\xi\_\{t\}^\{2\}2^\{\-tn\}\.

###### Proof\.

LetX∼Dℒ∗,ξtX\\sim D\_\{\\mathcal\{L\}^\{\*\},\\xi\_\{t\}\}\. Noting that‖X‖\>C1​ξt​n\\norm\{X\}\>C\_\{1\}\\xi\_\{t\}\\sqrt\{n\}is truncated in𝒢^\\widehat\{\\mathcal\{G\}\},

𝔼\[𝒢^t,d\(u\)\]−𝒢t,d\(u\)=4π2𝔼\[XXT\(−1\)uT​\(BT​Xmod2\)𝟏\{‖X‖\>C1ξtn\}\]\.\\mathbb\{E\}\[\\widehat\{\\mathcal\{G\}\}\_\{t,d\}\(u\)\]\-\\mathcal\{G\}\_\{t,d\}\(u\)=4\\pi^\{2\}\\mathbb\{E\}\\left\[XX^\{T\}\(\-1\)^\{u^\{T\}\(B^\{T\}X\\bmod 2\)\}\\mathbf\{1\}\_\{\\\{\\norm\{X\}\>C\_\{1\}\\xi\_\{t\}\\sqrt\{n\}\\\}\}\\right\]\.Using‖𝔼⁡\[M\]‖op≤𝔼⁡\[‖M‖op\]\\left\\lVert\\mathbb\{E\}\[M\]\\right\\rVert\_\{\\mathrm\{op\}\}\\leq\\mathbb\{E\}\[\\left\\lVert M\\right\\rVert\_\{\\mathrm\{op\}\}\]and‖X​XT‖op=‖X‖2\\left\\lVert XX^\{T\}\\right\\rVert\_\{\\mathrm\{op\}\}=\\norm\{X\}^\{2\}, Lemma[2\.8](https://arxiv.org/html/2608.02478#S2.Thmtheorem8)withc=1c=1gives for sufficiently largenn

‖𝔼\[𝒢^t,d\(u\)\]−𝒢t,d\(u\)‖op≤4π2𝔼\[‖X‖2𝟏\{‖X‖\>C1ξtn\}\]≤4π2ξt2n2−n≤ξt22−t​n\.\\displaystyle\\left\\lVert\\mathbb\{E\}\[\\widehat\{\\mathcal\{G\}\}\_\{t,d\}\(u\)\]\-\\mathcal\{G\}\_\{t,d\}\(u\)\\right\\rVert\_\{\\mathrm\{op\}\}\\leq 4\\pi^\{2\}\\mathbb\{E\}\\left\[\\norm\{X\}^\{2\}\\mathbf\{1\}\_\{\\\{\\norm\{X\}\>C\_\{1\}\\xi\_\{t\}\\sqrt\{n\}\\\}\}\\right\]\\leq 4\\pi^\{2\}\\xi\_\{t\}^\{2\}n2^\{\-n\}\\leq\\xi\_\{t\}^\{2\}2^\{\-tn\}\.\(14\)
We next bound the probability that the estimation𝒢^\\widehat\{\\mathcal\{G\}\}is far from𝒢\\mathcal\{G\}\. Fixu∈𝔽2nu\\in\\mathbb\{F\}\_\{2\}^\{n\}anda,b∈\{1,…,n\}a,b\\in\\\{1,\\ldots,n\\\}\. The absolute value of the\(a,b\)\(a,b\)\-entry of each summand in[Eq\.13](https://arxiv.org/html/2608.02478#S3.E13)is at most

4π2\|\(Xi\)a\(Xi\)b\|𝟏\{‖Xi‖≤C1ξtn\}≤4π2C12ξt2n\.4\\pi^\{2\}\|\(X\_\{i\}\)\_\{a\}\(X\_\{i\}\)\_\{b\}\|\\mathbf\{1\}\_\{\\\{\\norm\{X\_i\}\\leq C\_\{1\}\\xi\_\{t\}\\sqrt\{n\}\\\}\}\\leq 4\\pi^\{2\}C\_\{1\}^\{2\}\\xi\_\{t\}^\{2\}n\.Therefore, Hoeffding’s inequality gives, usingNt=⌈n5​log⁡n⋅22​t​n⌉N\_\{t\}=\\lceil n^\{5\}\\log n\\cdot 2^\{2tn\}\\rceil,

ℙ\[\|\(𝒢^t,d\(u\)−𝔼\[𝒢^t,d\(u\)\]\)a,b\|\>ξt2n2−t​n\]≤2exp\(−Ω\(Ntn42−2​t​n\)\)=2e−Ω⁡\(n​log⁡n\)\.\\mathbb\{P\}\\left\[\\left\|\\left\(\\widehat\{\\mathcal\{G\}\}\_\{t,d\}\(u\)\-\\mathbb\{E\}\[\\widehat\{\\mathcal\{G\}\}\_\{t,d\}\(u\)\]\\right\)\_\{a,b\}\\right\|\>\\frac\{\\xi\_\{t\}^\{2\}\}\{n\}2^\{\-tn\}\\right\]\\leq 2\\exp\\left\(\-\\Omega\\left\(\\frac\{N\_\{t\}\}\{n^\{4\}\}2^\{\-2tn\}\\right\)\\right\)=2e^\{\-\\Omega\(n\\log n\)\}\.By the union bound over all2n​n22^\{n\}n^\{2\}choices ofu∈𝔽2nu\\in\\mathbb\{F\}\_\{2\}^\{n\}anda,b∈\{1,…,n\}a,b\\in\\\{1,\\ldots,n\\\}, with probability1−2−Ω⁡\(n​log⁡n\)1\-2^\{\-\\Omega\(n\\log n\)\}, every entry of every difference𝒢^t,d​\(u\)−𝔼⁡\[𝒢^t,d​\(u\)\]\\widehat\{\\mathcal\{G\}\}\_\{t,d\}\(u\)\-\\mathbb\{E\}\[\\widehat\{\\mathcal\{G\}\}\_\{t,d\}\(u\)\]has absolute value at mostξt2​2−t​n/n\\xi\_\{t\}^\{2\}2^\{\-tn\}/n\. Since‖M‖op≤n​maxa,b​\|Ma,b\|,\\left\\lVert M\\right\\rVert\_\{\\mathrm\{op\}\}\\leq n\\max\_\{a,b\}\|M\_\{a,b\}\|,the operator norm of every difference is at mostξt2​2−t​n\\xi\_\{t\}^\{2\}2^\{\-tn\}\. Together with[Eq\.14](https://arxiv.org/html/2608.02478#S3.E14), this concludes the proof\. ∎

Given that𝒢^t,d​\(u\)≈𝒢t,d​\(u\)≈μt,d​v^​v^T\\widehat\{\\mathcal\{G\}\}\_\{t,d\}\(u\)\\approx\{\\mathcal\{G\}\}\_\{t,d\}\(u\)\\approx\\mu\_\{t,d\}\\widehat\{v\}\\widehat\{v\}^\{T\}due to[Lemmas3\.4](https://arxiv.org/html/2608.02478#S3.Thmtheorem4)and[3\.5](https://arxiv.org/html/2608.02478#S3.Thmtheorem5), the eigenvector of𝒢^t,d​\(u\)\\widehat\{\\mathcal\{G\}\}\_\{t,d\}\(u\)must be close to the direction ofvv\. The following lemma formalize this intuition\.

###### Lemma 3\.6\.

Lett0<t<1/4t\_\{0\}<t<1/4be fixed and letλ=λ1​\(ℒ\)≤d≤\(1\+1/n\)​λ\\lambda=\\lambda\_\{1\}\(\\mathcal\{L\}\)\\leq d\\leq\(1\+1/n\)\\lambda\. Letv∈ℒv\\in\\mathcal\{L\}satisfy‖v‖=λ\\norm\{v\}=\\lambda, and letu∈𝔽2nu\\in\\mathbb\{F\}\_\{2\}^\{n\}satisfyv∈B​u\+2​ℒv\\in Bu\+2\\mathcal\{L\}\. Suppose that the conclusion of[Lemma3\.5](https://arxiv.org/html/2608.02478#S3.Thmtheorem5)holds\. Ifqqis a unit eigenvector corresponding to the largest eigenvalue of𝒢^t,d​\(u\)\\widehat\{\\mathcal\{G\}\}\_\{t,d\}\(u\), then

minσ∈\{−1,1\}‖q−σ​v/λ‖=O\(n−1/2\)\.\\min\_\{\\sigma\\in\\\{\-1,1\\\}\}\\norm\{q\-\\sigma v/\\lambda\}=O\(n^\{\-1/2\}\)\.Consequently, then−1/3n^\{\-1/3\}\-𝖡𝖣𝖣\\mathsf\{BDD\}query atd​qdqreturns one of±v\\pm vfor all sufficiently largenn\.

###### Proof\.

Letv^=v/λ\\widehat\{v\}=v/\\lambda\. By[Lemma3\.4](https://arxiv.org/html/2608.02478#S3.Thmtheorem4)and the definition of𝒜t,d​\(u\)\\mathcal\{A\}\_\{t,d\}\(u\)in[Eq\.9](https://arxiv.org/html/2608.02478#S3.E9),

𝒢^t,d​\(u\)=−2​π​ξt2​F1/ξt​\(B​u/2\)​In\+μt,d​v^​v^T\+E,\\displaystyle\\widehat\{\\mathcal\{G\}\}\_\{t,d\}\(u\)=\-2\\pi\\xi\_\{t\}^\{2\}F\_\{1/\\xi\_\{t\}\}\(Bu/2\)I\_\{n\}\+\\mu\_\{t,d\}\\widehat\{v\}\\widehat\{v\}^\{T\}\+E,\(15\)whereE=ℛt,d​\(u\)\+𝒢^t,d​\(u\)−𝒢t,d​\(u\)E=\\mathcal\{R\}\_\{t,d\}\(u\)\+\\widehat\{\\mathcal\{G\}\}\_\{t,d\}\(u\)\-\\mathcal\{G\}\_\{t,d\}\(u\)and‖ℛt,d​\(u\)‖op/μt,d=2−Ω⁡\(n\)\\left\\lVert\\mathcal\{R\}\_\{t,d\}\(u\)\\right\\rVert\_\{\\mathrm\{op\}\}/\\mu\_\{t,d\}=2^\{\-\\Omega\(n\)\}\.

Sinceλ≤d≤\(1\+1/n\)​λ\\lambda\\leq d\\leq\(1\+1/n\)\\lambda,ξt2​λ2=Θ⁡\(n\)\\xi\_\{t\}^\{2\}\\lambda^\{2\}=\\Theta\(n\)\. Also,μt,d=Θ⁡\(ξt4​λ2​2−t​n\)\\mu\_\{t,d\}=\\Theta\(\\xi\_\{t\}^\{4\}\\lambda^\{2\}2^\{\-tn\}\)by[Lemma3\.4](https://arxiv.org/html/2608.02478#S3.Thmtheorem4)\.[Lemma3\.5](https://arxiv.org/html/2608.02478#S3.Thmtheorem5)gives

‖𝒢^t,d​\(u\)−𝒢t,d​\(u\)‖opμt,d=O⁡\(1ξt2​λ2\)=O⁡\(n−1\)\.\\frac\{\\left\\lVert\\widehat\{\\mathcal\{G\}\}\_\{t,d\}\(u\)\-\\mathcal\{G\}\_\{t,d\}\(u\)\\right\\rVert\_\{\\mathrm\{op\}\}\}\{\\mu\_\{t,d\}\}=O\\left\(\\frac\{1\}\{\\xi\_\{t\}^\{2\}\\lambda^\{2\}\}\\right\)=O\(n^\{\-1\}\)\.Together with‖ℛt,d​\(u\)‖op/μt,d=2−Ω⁡\(n\)\\left\\lVert\\mathcal\{R\}\_\{t,d\}\(u\)\\right\\rVert\_\{\\mathrm\{op\}\}/\\mu\_\{t,d\}=2^\{\-\\Omega\(n\)\}, this gives‖E‖op=O⁡\(μt,d​n−1\)\\left\\lVert E\\right\\rVert\_\{\\mathrm\{op\}\}=O\(\\mu\_\{t,d\}n^\{\-1\}\)\.

Sinceqqis a eigenvector corresponding to the largest eigenvalue of𝒢^t,d​\(u\)\\widehat\{\\mathcal\{G\}\}\_\{t,d\}\(u\), we haveqT​𝒢^t,d​\(u\)​q≥v^T​𝒢^t,d​\(u\)​v^q^\{T\}\\widehat\{\\mathcal\{G\}\}\_\{t,d\}\(u\)q\\geq\\widehat\{v\}^\{T\}\\widehat\{\\mathcal\{G\}\}\_\{t,d\}\(u\)\\widehat\{v\}\. Substituting the expression for𝒢^t,d​\(u\)\\widehat\{\\mathcal\{G\}\}\_\{t,d\}\(u\)using[Eq\.15](https://arxiv.org/html/2608.02478#S3.E15), the multiple ofInI\_\{n\}has the same value on both sides because‖q‖=‖v^‖=1\\norm\{q\}=\\norm\{\\widehat v\}=1\. The remaining inequality isμt,d​⟨q,v^⟩2\+qT​E​q≥μt,d\+v^T​E​v^\\mu\_\{t,d\}\\left\\langle q,\\widehat\{v\}\\right\\rangle^\{2\}\+q^\{T\}Eq\\geq\\mu\_\{t,d\}\+\\widehat\{v\}^\{T\}E\\widehat\{v\}\. Since\|qT​E​q\|≤‖E‖op\|q^\{T\}Eq\|\\leq\\left\\lVert E\\right\\rVert\_\{\\mathrm\{op\}\}and\|v^T​E​v^\|≤‖E‖op\|\\widehat\{v\}^\{T\}E\\widehat\{v\}\|\\leq\\left\\lVert E\\right\\rVert\_\{\\mathrm\{op\}\}, it follows that

μt,d​\(1−⟨q,v^⟩2\)≤qT​E​q−v^T​E​v^≤2​‖E‖op=O⁡\(μt,d​n−1\)\.\\mu\_\{t,d\}\\left\(1\-\\left\\langle q,\\widehat\{v\}\\right\\rangle^\{2\}\\right\)\\leq q^\{T\}Eq\-\\widehat\{v\}^\{T\}E\\widehat\{v\}\\leq 2\\left\\lVert E\\right\\rVert\_\{\\mathrm\{op\}\}=O\(\\mu\_\{t,d\}n^\{\-1\}\)\.
Chooseσ∈\{−1,1\}\\sigma\\in\\\{\-1,1\\\}such that⟨q,σ​v^⟩≥0\\left\\langle q,\\sigma\\widehat\{v\}\\right\\rangle\\geq 0\. It follows that‖q−σ​v^‖2≤2​\(1−⟨q,v^⟩2\)=O⁡\(n−1\)\\norm\{q\-\\sigma\\widehat v\}^\{2\}\\leq 2\(1\-\\left\\langle q,\\widehat\{v\}\\right\\rangle^\{2\}\)=O\(n^\{\-1\}\)\.

Finally,‖d​q−σ​v‖≤d‖q−σ​v^‖\+d−λ=O\(λn−1/2\)<λn−1/3\\norm\{dq\-\\sigma v\}\\leq d\\norm\{q\-\\sigma\\widehat v\}\+d\-\\lambda=O\(\\lambda n^\{\-1/2\}\)<\\lambda n^\{\-1/3\}for all sufficiently largenn\. The last claim follows from[Theorem2\.4](https://arxiv.org/html/2608.02478#S2.Thmtheorem4)\. ∎

Combining the estimate and the recovery argument gives the direct algorithm\.

Algorithm 1: Direct Hessian𝖲𝖵𝖯\\mathsf\{SVP\}

1. 1\.Apply LLL reduction to obtain a nonzerox∈ℒx\\in\\mathcal\{L\}and use the scalesdj=\(1\+1/n\)−j​‖x‖d\_\{j\}=\(1\+1/n\)^\{\-j\}\\norm\{x\}for0≤j≤n20\\leq j\\leq n^\{2\}\. Construct the preprocessingn−1/3n^\{\-1/3\}\-𝖡𝖣𝖣\\mathsf\{BDD\}data\.
2. 2\.Fixt0<t<1/4t\_\{0\}<t<1/4\. At every scaledjd\_\{j\}, call𝖣𝖦𝖲\\mathsf\{DGS\}from[Theorem2\.7](https://arxiv.org/html/2608.02478#S2.Thmtheorem7)withκ=n2\\kappa=n^\{2\}and keepNtN\_\{t\}samples fromDℒ∗,ξt​\(dj\)D\_\{\\mathcal\{L\}^\{\*\},\\xi\_\{t\}\(d\_\{j\}\)\}\. Abort the scale if fewer thanNtN\_\{t\}samples are returned\.
3. 3\.For everyu∈𝔽2nu\\in\\mathbb\{F\}\_\{2\}^\{n\}, evaluate𝒢^t,dj​\(u\)\\widehat\{\\mathcal\{G\}\}\_\{t,d\_\{j\}\}\(u\)directly and compute a unit eigenvectorquq\_\{u\}corresponding to its largest eigenvalue\. Query𝖡𝖣𝖣\\mathsf\{BDD\}atdj​qud\_\{j\}q\_\{u\}and retain the output only after exact lattice\-membership verification\.
4. 4\.Return the shortest verified nonzero vector over all scales and alluu\.

###### Theorem 3\.7\.

[Section3\.3](https://arxiv.org/html/2608.02478#S3.SS3)solves Search\-𝖲𝖵𝖯\\mathsf\{SVP\}with constant probability in time21\.46295​n\+o⁡\(n\)2^\{1\.46295n\+o\(n\)\}and space2n/2\+o⁡\(n\)\.2^\{n/2\+o\(n\)\}\.

###### Proof\.

The correctness follows from the previous lemmas\.[Lemma3\.5](https://arxiv.org/html/2608.02478#S3.Thmtheorem5)shows that𝒢^\\widehat\{\\mathcal\{G\}\}estimate𝒢\\mathcal\{G\}for all inputs with overwhelming probability, and in that case[Lemma3\.6](https://arxiv.org/html/2608.02478#S3.Thmtheorem6)and[Theorem2\.4](https://arxiv.org/html/2608.02478#S2.Thmtheorem4)show the correctness of the final outcome\.

We explain the time and space complexity below\. There are polynomially many choices ofdjd\_\{j\}because of the property of LLL\-reduced vectors\. For eachdjd\_\{j\}, the algorithm considers all2n2^\{n\}values ofu∈𝔽2nu\\in\\mathbb\{F\}\_\{2\}^\{n\}, and evaluating𝒢^t,dj​\(u\)\\widehat\{\\mathcal\{G\}\}\_\{t,d\_\{j\}\}\(u\)takesNt​poly⁡\(n\)N\_\{t\}\\operatorname\{poly\}\(n\)time forNt=poly⁡\(n\)​22​t​nN\_\{t\}=\\operatorname\{poly\}\(n\)2^\{2tn\}\. Hence the total time is2\(1\+2​t\)​n\+o⁡\(n\)\.2^\{\(1\+2t\)n\+o\(n\)\}\.Because of[Lemma3\.4](https://arxiv.org/html/2608.02478#S3.Thmtheorem4), we have1\+2​t\>1\+2​t0=1\.4629​…,1\+2t\>1\+2t\_\{0\}=1\.4629\\ldots,thus choosingt→t0t\\to t\_\{0\}gives the desired time complexity\. All remaining steps take less time and do not affect the overall time complexity\. The space complexity is due to𝖣𝖦𝖲\\mathsf\{DGS\}in[Theorem2\.7](https://arxiv.org/html/2608.02478#S2.Thmtheorem7)\. ∎

## 4Batch Hessian Estimation

The factor2n2^\{n\}in the21\.4629​n\+o⁡\(n\)2^\{1\.4629n\+o\(n\)\}running time of the previous section comes from evaluating𝒢^t,d​\(u\)\\widehat\{\\mathcal\{G\}\}\_\{t,d\}\(u\)separately for everyu∈𝔽2nu\\in\\mathbb\{F\}\_\{2\}^\{n\}\. The definition of𝒢^t,d​\(u\)\\widehat\{\\mathcal\{G\}\}\_\{t,d\}\(u\)uses the same samples for alluu, and[Lemma3\.5](https://arxiv.org/html/2608.02478#S3.Thmtheorem5)proves that all these estimators are simultaneously accurate\. This section optimizes the algorithm by batching the Hessian estimations\. The main idea is to use the Walsh\-Hadamard transform in the following lemma\.

###### Lemma 4\.1\.

LetA:𝔽2ℓ→ℝn×nA:\\mathbb\{F\}\_\{2\}^\{\\ell\}\\to\\mathbb\{R\}^\{n\\times n\}\. GivenA⁡\(x\)A\(x\)for everyx∈𝔽2ℓx\\in\\mathbb\{F\}\_\{2\}^\{\\ell\}, the matrices

∑x∈𝔽2ℓ\(−1\)θ⋅x​A​\(x\),θ∈𝔽2ℓ,\\sum\_\{x\\in\\mathbb\{F\}\_\{2\}^\{\\ell\}\}\(\-1\)^\{\\theta\\cdot x\}A\(x\),\\qquad\\theta\\in\\mathbb\{F\}\_\{2\}^\{\\ell\},can be computed in time2ℓ​poly⁡\(n\)2^\{\\ell\}\\operatorname\{poly\}\(n\)and space2ℓ​poly⁡\(n\)2^\{\\ell\}\\operatorname\{poly\}\(n\)\.

###### Proof\.

Store the matricesA⁡\(x\)A\(x\)in an array indexed by𝔽2ℓ\\mathbb\{F\}\_\{2\}^\{\\ell\}\. For everyj∈\{1,…,ℓ\}j\\in\\\{1,\\ldots,\\ell\\\}and everyx∈𝔽2ℓx\\in\\mathbb\{F\}\_\{2\}^\{\\ell\}withxj=0x\_\{j\}=0, replace

\(A⁡\(x\),A⁡\(x\+ej\)\)by\(A⁡\(x\)\+A⁡\(x\+ej\),A⁡\(x\)−A⁡\(x\+ej\)\),\\bigl\(A\(x\),A\(x\+e\_\{j\}\)\\bigr\)\\quad\\text\{by\}\\quad\\bigl\(A\(x\)\+A\(x\+e\_\{j\}\),A\(x\)\-A\(x\+e\_\{j\}\)\\bigr\),whereeje\_\{j\}is thejjth standard basis vector\. After processing allℓ\\ellcoordinates, the entry indexed byθ\\thetaequals∑x\(−1\)θ⋅x​A​\(x\)\\sum\_\{x\}\(\-1\)^\{\\theta\\cdot x\}A\(x\)\. There areℓ​2ℓ−1\\ell 2^\{\\ell\-1\}replacements, and the array contains2ℓ2^\{\\ell\}matrices\. ∎

Algorithm 2: Walsh\-Hadamard Hessian𝖲𝖵𝖯\\mathsf\{SVP\}

1. 1\.Construct the preprocessing𝖡𝖣𝖣\\mathsf\{BDD\}data and the scale grid, choosett, and obtain the Discrete Gaussian samples at every scaledjd\_\{j\}as in[Section3\.3](https://arxiv.org/html/2608.02478#S3.SS3)\. Setℓ=⌊n/2⌋\\ell=\\lfloor n/2\\rfloor\.
2. 2\.At each scaledjd\_\{j\}that was not aborted, define, for every sampleXiX\_\{i\}, ki:=BTXimod2,Wi:=−4​π2NtXiXiT𝟏\{‖Xi‖≤C1ξt\(dj\)n\}\.k\_\{i\}:=B^\{T\}X\_\{i\}\\bmod 2,\\qquad W\_\{i\}:=\-\\frac\{4\\pi^\{2\}\}\{N\_\{t\}\}X\_\{i\}X\_\{i\}^\{T\}\\mathbf\{1\}\_\{\\\{\\norm\{X\_i\}\\leq C\_\{1\}\\xi\_\{t\}\(d\_\{j\}\)\\sqrt\{n\}\\\}\}\.Writeki=\(ki′,ki′′\)∈𝔽2ℓ×𝔽2n−ℓk\_\{i\}=\(k\_\{i\}^\{\\prime\},k\_\{i\}^\{\\prime\\prime\}\)\\in\\mathbb\{F\}\_\{2\}^\{\\ell\}\\times\\mathbb\{F\}\_\{2\}^\{n\-\\ell\}\.
3. 3\.For everyθ′′∈𝔽2n−ℓ\\theta^\{\\prime\\prime\}\\in\\mathbb\{F\}\_\{2\}^\{n\-\\ell\}, construct the arrayAθ′′:𝔽2ℓ→ℝn×nA\_\{\\theta^\{\\prime\\prime\}\}:\\mathbb\{F\}\_\{2\}^\{\\ell\}\\to\\mathbb\{R\}^\{n\\times n\}given by Aθ′′​\(x\):=∑1≤i≤Ntki′=x\(−1\)θ′′⋅ki′′​Wi\.A\_\{\\theta^\{\\prime\\prime\}\}\(x\):=\\sum\_\{\\begin\{subarray\}\{c\}1\\leq i\\leq N\_\{t\}\\\\ k\_\{i\}^\{\\prime\}=x\\end\{subarray\}\}\(\-1\)^\{\\theta^\{\\prime\\prime\}\\cdot k\_\{i\}^\{\\prime\\prime\}\}W\_\{i\}\.Apply[Lemma4\.1](https://arxiv.org/html/2608.02478#S4.Thmtheorem1)toAθ′′A\_\{\\theta^\{\\prime\\prime\}\}\. The matrix indexed byθ′∈𝔽2ℓ\\theta^\{\\prime\}\\in\\mathbb\{F\}\_\{2\}^\{\\ell\}is𝒢^t,dj​\(θ′,θ′′\)\\widehat\{\\mathcal\{G\}\}\_\{t,d\_\{j\}\}\(\\theta^\{\\prime\},\\theta^\{\\prime\\prime\}\)\. For each such matrix, compute a unit eigenvectorqqcorresponding to its largest eigenvalue, query𝖡𝖣𝖣\\mathsf\{BDD\}atdj​qd\_\{j\}q, and retain the output if it is a nonzero lattice vector\.
4. 4\.Return the shortest retained vector over all scales\.

###### Theorem 4\.2\.

[Section4](https://arxiv.org/html/2608.02478#S4)solves Search\-𝖲𝖵𝖯\\mathsf\{SVP\}in time2n\+o⁡\(n\)2^\{n\+o\(n\)\}and2n/2\+o⁡\(n\)2^\{n/2\+o\(n\)\}space with constant success probability\.

###### Proof\.

Foru=\(θ′,θ′′\)u=\(\\theta^\{\\prime\},\\theta^\{\\prime\\prime\}\), the matrix produced by the transform is

∑x∈𝔽2ℓ\(−1\)θ′⋅x​Aθ′′​\(x\)=∑i=1Nt\(−1\)θ′⋅ki′\+θ′′⋅ki′′​Wi=𝒢^t,dj​\(u\)\.\\sum\_\{x\\in\\mathbb\{F\}\_\{2\}^\{\\ell\}\}\(\-1\)^\{\\theta^\{\\prime\}\\cdot x\}A\_\{\\theta^\{\\prime\\prime\}\}\(x\)=\\sum\_\{i=1\}^\{N\_\{t\}\}\(\-1\)^\{\\theta^\{\\prime\}\\cdot k\_\{i\}^\{\\prime\}\+\\theta^\{\\prime\\prime\}\\cdot k\_\{i\}^\{\\prime\\prime\}\}W\_\{i\}=\\widehat\{\\mathcal\{G\}\}\_\{t,d\_\{j\}\}\(u\)\.Thus the algorithm evaluates exactly the estimators defined in[Eq\.13](https://arxiv.org/html/2608.02478#S3.E13)\. The correctness then follows the same argument as in[Theorem3\.7](https://arxiv.org/html/2608.02478#S3.Thmtheorem7)\.

Now we discuss the space and time complexity\. In the algorithm, only one arrayAθ′′A\_\{\\theta^\{\\prime\\prime\}\}is stored at a time\. The array contains2ℓ2^\{\\ell\}matrices, while the number of Discrete Gaussian samples isNt<2n/2N\_\{t\}<2^\{n/2\}\. Together with the preprocessing𝖡𝖣𝖣\\mathsf\{BDD\}data, this gives space2n/2\+o⁡\(n\)2^\{n/2\+o\(n\)\}\.

For each fixedθ′′\\theta^\{\\prime\\prime\}, constructing the arrayAθ′′A\_\{\\theta^\{\\prime\\prime\}\}takesNt​poly⁡\(n\)N\_\{t\}\\operatorname\{poly\}\(n\)time and the following Hadamard\-Walsh transform take2ℓ\+o⁡\(n\)2^\{\\ell\+o\(n\)\}time by[Lemma4\.1](https://arxiv.org/html/2608.02478#S4.Thmtheorem1)\. Since there are2n−ℓ2^\{n\-\\ell\}choices ofθ′′\\theta^\{\\prime\\prime\}, the total time for eachdjd\_\{j\}is2n−ℓ​\(Nt\+2ℓ\)​2o⁡\(n\)2^\{n\-\\ell\}\(N\_\{t\}\+2^\{\\ell\}\)2^\{o\(n\)\}\. Hereℓ=⌊n/2⌋\\ell=\\lfloor n/2\\rfloorandNt=22​t​n\+o⁡\(n\)<2n/2N\_\{t\}=2^\{2tn\+o\(n\)\}<2^\{n/2\}becauset<1/4t<1/4\. Therefore, the total time over the polynomially many scales is2n\+o⁡\(n\)2^\{n\+o\(n\)\}\. ∎

## 5Random Sublattice Coset Hessian

The algorithm in[Section4](https://arxiv.org/html/2608.02478#S4)computes𝒢^​\(u\)\\widehat\{\\mathcal\{G\}\}\(u\)for allu∈𝔽2nu\\in\\mathbb\{F\}\_\{2\}^\{n\}, resulting in the complexity2n\+o⁡\(n\)2^\{n\+o\(n\)\}\. This section shows that the same strategy works by estimating the Hessians using vectors in a sublattice cosets\.

As always, we mainly focus on the caseλ≤d≤\(1\+1/n\)​λ\\lambda\\leq d\\leq\(1\+1/n\)\\lambdaforλ=λ1​\(ℒ\)\\lambda=\\lambda\_\{1\}\(\\mathcal\{L\}\)\. We writeg⁡\(t\):=12​log2⁡\(t/t0\)g\(t\):=\\frac\{1\}\{2\}\\log\_\{2\}\(t/t\_\{0\}\)fort\>0t\>0\. For our main interested parameterdd,[Corollary3\.2](https://arxiv.org/html/2608.02478#S3.Thmtheorem2)gives, for every fixedccand positive integerkk,

∑x∈ℒ‖x‖k​ρ21\+c/ξt​\(x\)≤λk​2\(c/2−g⁡\(t\)\+o⁡\(1\)\)​n,andρ21\+c/ξt​\(ℒ\)≤1\+2\(c/2−g⁡\(t\)\+o⁡\(1\)\)​n\.\\displaystyle\\sum\_\{x\\in\\mathcal\{L\}\}\\norm\{x\}^\{k\}\\rho\_\{\\sqrt\{2^\{1\+c\}\}/\\xi\_\{t\}\}\(x\)\\leq\\lambda^\{k\}2^\{\(c/2\-g\(t\)\+o\(1\)\)n\},\\qquad\\text\{and\}\\qquad\\rho\_\{\\sqrt\{2^\{1\+c\}\}/\\xi\_\{t\}\}\(\\mathcal\{L\}\)\\leq 1\+2^\{\(c/2\-g\(t\)\+o\(1\)\)n\}\.\(16\)
The following term from[Lemma3\.4](https://arxiv.org/html/2608.02478#S3.Thmtheorem4)is convenient for us\.

μt,d=ξt4​λ2​2−t​n\+O⁡\(1\)=ξt4​d2​2−t​n\+O⁡\(1\)forλ≤d≤\(1\+1/n\)​λ\.\\displaystyle\\mu\_\{t,d\}=\\xi\_\{t\}^\{4\}\\lambda^\{2\}2^\{\-tn\+O\(1\)\}=\\xi\_\{t\}^\{4\}d^\{2\}2^\{\-tn\+O\(1\)\}\\qquad\\text\{for\}\\quad\\lambda\\leq d\\leq\(1\+1/n\)\\lambda\.\(17\)
### 5\.1Gaussian and Hessian sums

The following periodic Gaussian and Hessian mass bounds will be used in this section\.

###### Lemma 5\.1\.

For everys\>0s\>0,

∑u∈𝔽2nFs​\(B​u/2\)=ρ2​s​\(ℒ\)ρs​\(ℒ\)\.\\sum\_\{u\\in\\mathbb\{F\}\_\{2\}^\{n\}\}F\_\{s\}\(Bu/2\)=\\frac\{\\rho\_\{2s\}\(\\mathcal\{L\}\)\}\{\\rho\_\{s\}\(\\mathcal\{L\}\)\}\.Ifλ≤d≤\(1\+1/n\)​λ\\lambda\\leq d\\leq\(1\+1/n\)\\lambda, it holds that∑u≠0F1/ξt​\(B​u/2\)≤2\(1/2−g⁡\(t\)\+o⁡\(1\)\)​n\.\\sum\_\{u\\neq 0\}F\_\{1/\\xi\_\{t\}\}\(Bu/2\)\\leq 2^\{\(1/2\-g\(t\)\+o\(1\)\)n\}\.

###### Proof\.

The cosetsB​u/2\+ℒBu/2\+\\mathcal\{L\}foru∈𝔽2nu\\in\\mathbb\{F\}\_\{2\}^\{n\}partition12​ℒ\\frac\{1\}\{2\}\\mathcal\{L\}\. Hence,

∑u∈𝔽2nFs​\(B​u/2\)=∑u∈𝔽2nρs​\(B​u/2\+ℒ\)ρs​\(ℒ\)=ρs​\(12​ℒ\)ρs​\(ℒ\)=ρ2​s​\(ℒ\)ρs​\(ℒ\)\.\\sum\_\{u\\in\\mathbb\{F\}\_\{2\}^\{n\}\}F\_\{s\}\(Bu/2\)=\\sum\_\{u\\in\\mathbb\{F\}\_\{2\}^\{n\}\}\\frac\{\\rho\_\{s\}\(Bu/2\+\\mathcal\{L\}\)\}\{\\rho\_\{s\}\(\\mathcal\{L\}\)\}=\\frac\{\\rho\_\{s\}\(\\frac\{1\}\{2\}\\mathcal\{L\}\)\}\{\\rho\_\{s\}\(\\mathcal\{L\}\)\}=\\frac\{\\rho\_\{2s\}\(\\mathcal\{L\}\)\}\{\\rho\_\{s\}\(\\mathcal\{L\}\)\}\.The final statement follows from[Eq\.16](https://arxiv.org/html/2608.02478#S5.E16)withc=1c=1\. ∎

###### Lemma 5\.2\.

Letλ≤d≤\(1\+1/n\)​λ\\lambda\\leq d\\leq\(1\+1/n\)\\lambdaandt\>t0/2t\>t\_\{0\}/2\. Then

∑u∈𝔽2n‖𝒜t,d​\(u\)‖F2≤μt,d2​2\(2​t−min⁡\{g⁡\(t\),2​g​\(t\)\}\+o⁡\(1\)\)​n\.\\sum\_\{u\\in\\mathbb\{F\}\_\{2\}^\{n\}\}\\left\\lVert\\mathcal\{A\}\_\{t,d\}\(u\)\\right\\rVert\_\{\\mathrm\{F\}\}^\{2\}\\leq\\mu\_\{t,d\}^\{2\}2^\{\(2t\-\\min\\\{g\(t\),2g\(t\)\\\}\+o\(1\)\)n\}\.

###### Proof\.

We use‖X‖F2=Tr⁡\(XT​X\)\\left\\lVert X\\right\\rVert\_\{\\mathrm\{F\}\}^\{2\}=\\operatorname\{Tr\}\(X^\{T\}X\)for the real matrixXX\. Applying this to[Eq\.11](https://arxiv.org/html/2608.02478#S3.E11), the left\-hand side becomes

\(π2​ξt4ρ1/ξt​\(ℒ\)\)2∑u∈𝔽2n∑z,z′∈B​u\+2​ℒTr\(zzTz′z′T\)e−πξt2\(‖z‖2\+‖z′‖2\)/4\.\\left\(\\frac\{\\pi^\{2\}\\xi\_\{t\}^\{4\}\}\{\\rho\_\{1/\\xi\_\{t\}\}\(\\mathcal\{L\}\)\}\\right\)^\{2\}\\sum\_\{u\\in\\mathbb\{F\}\_\{2\}^\{n\}\}\\sum\_\{z,z^\{\\prime\}\\in Bu\+2\\mathcal\{L\}\}\\operatorname\{Tr\}\(zz^\{T\}z^\{\\prime\}z^\{\\prime T\}\)e^\{\-\\pi\\xi\_\{t\}^\{2\}\(\\norm\{z\}^\{2\}\+\\norm\{z'\}^\{2\}\)/4\}\.Asuuvaries, the map from\(z,z′\)∈\(B​u\+2​ℒ\)2\(z,z^\{\\prime\}\)\\in\(Bu\+2\\mathcal\{L\}\)^\{2\}defined by\(z,z′\)↦\(p=z\+z′2,q=z−z′2\)\(z,z^\{\\prime\}\)\\mapsto\(p=\\frac\{z\+z^\{\\prime\}\}\{2\},q=\\frac\{z\-z^\{\\prime\}\}\{2\}\)is a bijection toℒ2\\mathcal\{L\}^\{2\}, and it satisfies

Tr⁡\(z​zT​z′​z′T\)=\(zT​z′\)2=\(‖p‖2−‖q‖2\)2,‖z‖2\+‖z′‖2=2​\(‖p‖2\+‖q‖2\)\.\\operatorname\{Tr\}\(zz^\{T\}z^\{\\prime\}z^\{\\prime T\}\)=\(z^\{T\}z^\{\\prime\}\)^\{2\}=\(\\norm\{p\}^\{2\}\-\\norm\{q\}^\{2\}\)^\{2\},\\qquad\\norm\{z\}^\{2\}\+\\norm\{z'\}^\{2\}=2\(\\norm\{p\}^\{2\}\+\\norm\{q\}^\{2\}\)\.Therefore,

∑u∈𝔽2n‖𝒜t,d\(u\)‖F2=π4​ξt8ρ1/ξt​\(ℒ\)2∑p,q∈ℒ\(‖p‖2−‖q‖2\)2e−πξt2\(‖p‖2\+‖q‖2\)/2\.\\sum\_\{u\\in\\mathbb\{F\}\_\{2\}^\{n\}\}\\left\\lVert\\mathcal\{A\}\_\{t,d\}\(u\)\\right\\rVert\_\{\\mathrm\{F\}\}^\{2\}=\\frac\{\\pi^\{4\}\\xi\_\{t\}^\{8\}\}\{\\rho\_\{1/\\xi\_\{t\}\}\(\\mathcal\{L\}\)^\{2\}\}\\sum\_\{p,q\\in\\mathcal\{L\}\}\(\\norm\{p\}^\{2\}\-\\norm\{q\}^\{2\}\)^\{2\}e^\{\-\\pi\\xi\_\{t\}^\{2\}\(\\norm\{p\}^\{2\}\+\\norm\{q\}^\{2\}\)/2\}\.Letw\(x\)=e−πξt2‖x‖2/2=ρ2/ξt\(x\)w\(x\)=e^\{\-\\pi\\xi\_\{t\}^\{2\}\\norm\{x\}^\{2\}/2\}=\\rho\_\{\\sqrt\{2\}/\\xi\_\{t\}\}\(x\)\. Using\(‖p‖2−‖q‖2\)2≤2​\(‖p‖4\+‖q‖4\)\(\\norm\{p\}^\{2\}\-\\norm\{q\}^\{2\}\)^\{2\}\\leq 2\(\\norm\{p\}^\{4\}\+\\norm\{q\}^\{4\}\), the sum overp,q∈ℒp,q\\in\\mathcal\{L\}is at most

4​\(∑p∈ℒ‖p‖4​w​\(p\)\)​\(∑q∈ℒw⁡\(q\)\)\.4\\left\(\\sum\_\{p\\in\\mathcal\{L\}\}\\norm\{p\}^\{4\}w\(p\)\\right\)\\left\(\\sum\_\{q\\in\\mathcal\{L\}\}w\(q\)\\right\)\.Indeed, the Gaussian weight factors asw⁡\(p\)​w​\(q\)w\(p\)w\(q\), and the two terms obtained from‖p‖4\+‖q‖4\\norm\{p\}^\{4\}\+\\norm\{q\}^\{4\}are equal\. Applying the first inequality withk=4k=4andc=0c=0of[Eq\.16](https://arxiv.org/html/2608.02478#S5.E16)to the first term and the second inequality withc=0c=0to the second term, we have an upper bound

λ4​2\(−g⁡\(t\)\+o⁡\(1\)\)​n⋅\(1\+2\(−g⁡\(t\)\+o⁡\(1\)\)​n\)=λ4​2\(−min⁡\{g⁡\(t\),2​g​\(t\)\}\+o⁡\(1\)\)​n\.\\lambda^\{4\}2^\{\(\-g\(t\)\+o\(1\)\)n\}\\cdot\(1\+2^\{\(\-g\(t\)\+o\(1\)\)n\}\)=\\lambda^\{4\}2^\{\(\-\\min\\\{g\(t\),2g\(t\)\\\}\+o\(1\)\)n\}\.The resulting exponent is−g⁡\(t\)\-g\(t\)ifg⁡\(t\)≥0g\(t\)\\geq 0and−2​g​\(t\)\-2g\(t\)otherwise\. The fixed constants andρ1/ξt​\(ℒ\)−2≤1\\rho\_\{1/\\xi\_\{t\}\}\(\\mathcal\{L\}\)^\{\-2\}\\leq 1are absorbed into2o⁡\(n\)2^\{o\(n\)\}\. The final result is obtained using[Eq\.17](https://arxiv.org/html/2608.02478#S5.E17)\. ∎

### 5\.2A random coset Hessian

Fix0≤χ≤1/20\\leq\\chi\\leq 1/2\. We split each parity classu∈𝔽2nu\\in\\mathbb\{F\}\_\{2\}^\{n\}intoh=⌊χ​n⌋h=\\lfloor\\chi n\\rfloorandℓ=n−h\\ell=n\-hbits in random basis\. ForP∈GLn⁡\(𝔽2\)P\\in\\GL\_\{n\}\(\\mathbb\{F\}\_\{2\}\),u∈𝔽2nu\\in\\mathbb\{F\}\_\{2\}^\{n\}, andX∈ℒ∗X\\in\\mathcal\{L\}^\{\*\}, define

P​u=\(α,θ\)∈𝔽2h×𝔽2ℓ,P−T​BT​Xmod2=\(JP​\(X\),VP​\(X\)\)∈𝔽2h×𝔽2ℓ\.Pu=\(\\alpha,\\theta\)\\in\\mathbb\{F\}\_\{2\}^\{h\}\\times\\mathbb\{F\}\_\{2\}^\{\\ell\},\\qquad P^\{\-T\}B^\{T\}X\\bmod 2=\(J\_\{P\}\(X\),V\_\{P\}\(X\)\)\\in\\mathbb\{F\}\_\{2\}^\{h\}\\times\\mathbb\{F\}\_\{2\}^\{\\ell\}\.DefineΛj:=\{X∈ℒ∗:JP​\(X\)=j\}\\Lambda\_\{j\}:=\\\{X\\in\\mathcal\{L\}^\{\*\}:J\_\{P\}\(X\)=j\\\}\. The setΛ0\\Lambda\_\{0\}is a sublattice ofℒ∗\\mathcal\{L\}^\{\*\}, and eachΛj\\Lambda\_\{j\}forj∈𝔽2hj\\in\\mathbb\{F\}\_\{2\}^\{h\}is one of its cosets\. Note that everyΛj\\Lambda\_\{j\}is nonempty because the mapX↦P−T​\(BT​Xmod2\)X\\mapsto P^\{\-T\}\(B^\{T\}X\\bmod 2\)fromℒ∗\\mathcal\{L\}^\{\*\}to𝔽2n\\mathbb\{F\}\_\{2\}^\{n\}is surjective\. Therefore,Λj\\Lambda\_\{j\}can be written asΛ0\+vj\\Lambda\_\{0\}\+v\_\{j\}for somevj∈Λjv\_\{j\}\\in\\Lambda\_\{j\}thus the discrete GaussianDΛj,sD\_\{\\Lambda\_\{j\},s\}is well\-defined\.

Forθ∈𝔽2ℓ\\theta\\in\\mathbb\{F\}\_\{2\}^\{\\ell\}, we define the \(sublattice\) coset Hessian alongΛj\\Lambda\_\{j\}analogous to[Lemma3\.3](https://arxiv.org/html/2608.02478#S3.Thmtheorem3)by

𝒢t,d,j​\(θ\):=−4​π2​𝔼X∼DΛj,ξt​\[X​XT​\(−1\)θT​VP​\(X\)\]\\displaystyle\\mathcal\{G\}\_\{t,d,j\}\(\\theta\):=\-4\\pi^\{2\}\\mathbb\{E\}\_\{X\\sim D\_\{\\Lambda\_\{j\},\\xi\_\{t\}\}\}\\left\[XX^\{T\}\(\-1\)^\{\\theta^\{T\}V\_\{P\}\(X\)\}\\right\]\(18\)based on the identity forX∈ΛjX\\in\\Lambda\_\{j\}

uT​\(BT​Xmod2\)=\(P​u\)T​\(P−T​BT​Xmod2\)=αT​JP​\(X\)\+θT​VP​\(X\)=αT​j\+θT​VP​\(X\)\(mod2\)\\displaystyle u^\{T\}\(B^\{T\}X\\bmod 2\)=\(Pu\)^\{T\}\(P^\{\-T\}B^\{T\}X\\bmod 2\)=\\alpha^\{T\}J\_\{P\}\(X\)\+\\theta^\{T\}V\_\{P\}\(X\)=\\alpha^\{T\}j\+\\theta^\{T\}V\_\{P\}\(X\)\\pmod\{2\}\(19\)Foru=P−1​\(α,θ\)u=P^\{\-1\}\(\\alpha,\\theta\),[Eq\.18](https://arxiv.org/html/2608.02478#S5.E18)omits the factor\(−1\)αT​j\(\-1\)^\{\\alpha^\{T\}j\}\. This omission allows𝒢t,d,j\\mathcal\{G\}\_\{t,d,j\}is defined independent ofα\\alpha, yet we should be careful about that factor\.

Letζt,j:=2hℙX∼Dℒ∗,ξt\[JP\(X\)=j\]\\zeta\_\{t,j\}:=2^\{h\}\\mathbb\{P\}\_\{X\\sim D\_\{\\mathcal\{L\}^\{\*\},\\xi\_\{t\}\}\}\[J\_\{P\}\(X\)=j\]be the probability, normalized by the uniform probability2−h2^\{\-h\}, that a discrete Gaussian sample of widthξt\\xi\_\{t\}belongs to the affine lattice cosetΛj\\Lambda\_\{j\}\. The following lemma shows thatζt,j\\zeta\_\{t,j\}is near 1, i\.e\., the distribution ofJP​\(X\)J\_\{P\}\(X\)for the Discrete Gaussian sampleXXis pointwise exponentially close to uniform\. The parameter condition of this lemma is intentionally general for the later application\.

###### Lemma 5\.3\.

Ifλ=λ1​\(ℒ\)≤d≤\(1\+1/n\)​λ\\lambda=\\lambda\_\{1\}\(\\mathcal\{L\}\)\\leq d\\leq\(1\+1/n\)\\lambda,t\>t0/2t\>t\_\{0\}/2, and0≤χ≤1/20\\leq\\chi\\leq 1/2andχ<1/2\+g⁡\(t\)\\chi<1/2\+g\(t\), then, with probability1−2−Ω⁡\(n\)1\-2^\{\-\\Omega\(n\)\}over the uniform randomP∈GLn⁡\(𝔽2\)P\\in\\GL\_\{n\}\(\\mathbb\{F\}\_\{2\}\),ζt,j=1\+O⁡\(2−Ω⁡\(n\)\)\\zeta\_\{t,j\}=1\+O\(2^\{\-\\Omega\(n\)\}\)for everyj∈𝔽2hj\\in\\mathbb\{F\}\_\{2\}^\{h\}\.

###### Proof\.

Recall2h𝟏\{y=j\}=∑α∈𝔽2h\(−1\)α⋅\(y\+j\)2^\{h\}\\mathbf\{1\}\_\{\\\{y=j\\\}\}=\\sum\_\{\\alpha\\in\\mathbb\{F\}\_\{2\}^\{h\}\}\(\-1\)^\{\\alpha\\cdot\(y\+j\)\}fory,j∈𝔽2hy,j\\in\\mathbb\{F\}\_\{2\}^\{h\}\. Applying the identity withy=JP​\(X\)y=J\_\{P\}\(X\)and taking the expectation overX∼Dℒ∗,ξtX\\sim D\_\{\\mathcal\{L\}^\{\*\},\\xi\_\{t\}\}gives

ζt,j=∑α∈𝔽2h\(−1\)α⋅j​𝔼​\[\(−1\)α⋅JP​\(X\)\]\.\\zeta\_\{t,j\}=\\sum\_\{\\alpha\\in\\mathbb\{F\}\_\{2\}^\{h\}\}\(\-1\)^\{\\alpha\\cdot j\}\\mathbb\{E\}\[\(\-1\)^\{\\alpha\\cdot J\_\{P\}\(X\)\}\]\.Let𝒦P:=P−1​\(𝔽2h×\{0\}\)\\mathcal\{K\}\_\{P\}:=P^\{\-1\}\(\\mathbb\{F\}\_\{2\}^\{h\}\\times\\\{0\\\}\)andκ=P−1​\(α,0\)∈𝒦P\\kappa=P^\{\-1\}\(\\alpha,0\)\\in\\mathcal\{K\}\_\{P\}forα∈𝔽2h\\alpha\\in\\mathbb\{F\}\_\{2\}^\{h\}\. The Poisson representation in[Eq\.8](https://arxiv.org/html/2608.02478#S3.E8)gives

F1/ξt​\(B​κ/2\)=𝔼X∼Dℒ∗,ξt​\[e2​π​i​⟨X,B​κ/2⟩\]=𝔼X∼Dℒ∗,ξt​\[\(−1\)κT​\(BT​Xmod2\)\]=𝔼X∼Dℒ∗,ξt​\[\(−1\)α⋅JP​\(X\)\]\.F\_\{1/\\xi\_\{t\}\}\(B\\kappa/2\)=\\mathbb\{E\}\_\{X\\sim D\_\{\\mathcal\{L\}^\{\*\},\\xi\_\{t\}\}\}\[e^\{2\\pi i\\left\\langle X,B\\kappa/2\\right\\rangle\}\]=\\mathbb\{E\}\_\{X\\sim D\_\{\\mathcal\{L\}^\{\*\},\\xi\_\{t\}\}\}\[\(\-1\)^\{\\kappa^\{T\}\(B^\{T\}X\\bmod 2\)\}\]=\\mathbb\{E\}\_\{X\\sim D\_\{\\mathcal\{L\}^\{\*\},\\xi\_\{t\}\}\}\[\(\-1\)^\{\\alpha\\cdot J\_\{P\}\(X\)\}\]\.Plugging this equation to the summand inζt,j\\zeta\_\{t,j\}above, we have

ζt,j=∑α∈𝔽2h\(−1\)α⋅j​F1/ξt​\(B​P−1​\(α,0\)/2\)=1\+∑α≠0\(−1\)α⋅j​F1/ξt​\(B​P−1​\(α,0\)/2\)\.\\zeta\_\{t,j\}=\\sum\_\{\\alpha\\in\\mathbb\{F\}\_\{2\}^\{h\}\}\(\-1\)^\{\\alpha\\cdot j\}F\_\{1/\\xi\_\{t\}\}\\left\(BP^\{\-1\}\(\\alpha,0\)/2\\right\)=1\+\\sum\_\{\\alpha\\neq 0\}\(\-1\)^\{\\alpha\\cdot j\}F\_\{1/\\xi\_\{t\}\}\\left\(BP^\{\-1\}\(\\alpha,0\)/2\\right\)\.By substitutingκ=P−1​\(α,0\)\\kappa=P^\{\-1\}\(\\alpha,0\), we have\|ζt,j−1\|≤∑κ∈𝒦Pκ≠0F1/ξt​\(B​κ/2\)\|\\zeta\_\{t,j\}\-1\|\\leq\\sum\_\{\\begin\{subarray\}\{c\}\\kappa\\in\\mathcal\{K\}\_\{P\}\\\\ \\kappa\\neq 0\\end\{subarray\}\}F\_\{1/\\xi\_\{t\}\}\(B\\kappa/2\)for alljj\. We bound this term using[Lemma5\.1](https://arxiv.org/html/2608.02478#S5.Thmtheorem1)\. For each nonzeroκ∈𝔽2n\\kappa\\in\\mathbb\{F\}\_\{2\}^\{n\}, the space𝒦P\\mathcal\{K\}\_\{P\}for randomPPis a uniform randomhh\-dimensional subspace so thatℙP\[κ∈𝒦P\]=\(2h−1\)/\(2n−1\)=2\(χ−1\+o⁡\(1\)\)​n\\mathbb\{P\}\_\{P\}\[\\kappa\\in\\mathcal\{K\}\_\{P\}\]=\(2^\{h\}\-1\)/\(2^\{n\}\-1\)=2^\{\(\\chi\-1\+o\(1\)\)n\}\. This gives

𝔼P​∑κ∈𝒦P,κ≠0F1/ξt​\(B​κ/2\)≤2\(χ−1/2−g⁡\(t\)\+o⁡\(1\)\)​n\.\\mathbb\{E\}\_\{P\}\\sum\_\{\{\\kappa\\in\\mathcal\{K\}\_\{P\},\\kappa\\neq 0\}\}F\_\{1/\\xi\_\{t\}\}\(B\\kappa/2\)\\leq 2^\{\(\\chi\-1/2\-g\(t\)\+o\(1\)\)n\}\.The exponent is a negative constant by the assumptionχ<1/2\+g⁡\(t\)\\chi<1/2\+g\(t\)\. Markov’s inequality shows that, except with probability2−Ω⁡\(n\)2^\{\-\\Omega\(n\)\}overPP,

∑κ∈𝒦P,κ≠0F1/ξt​\(B​κ/2\)≤2−Ω⁡\(n\)\.\\sum\_\{\{\\kappa\\in\\mathcal\{K\}\_\{P\},\\kappa\\neq 0\}\}F\_\{1/\\xi\_\{t\}\}\(B\\kappa/2\)\\leq 2^\{\-\\Omega\(n\)\}\.This proves the lemma, as the upper bound of\|ζt,j−1\|\|\\zeta\_\{t,j\}\-1\|holds simultaneously for allj\.j\.∎

The following lemma shows the sampling fromDΛj,ξtD\_\{\\Lambda\_\{j\},\\xi\_\{t\}\}can be done by sampling from the entireDℒ∗,ξtD\_\{\\mathcal\{L\}^\{\*\},\\xi\_\{t\}\}and then collecting the samples withJP​\(X\)=jJ\_\{P\}\(X\)=jthanks to the almost uniformity\.

###### Lemma 5\.4\.

Ifλ≤d≤\(1\+1/n\)​λ\\lambda\\leq d\\leq\(1\+1/n\)\\lambda,t0<t<1/4t\_\{0\}<t<1/4, and0≤χ≤1/20\\leq\\chi\\leq 1/2, there is a classical algorithm that for independent uniformP∈GLn⁡\(𝔽2\)P\\in\\GL\_\{n\}\(\\mathbb\{F\}\_\{2\}\)andj∈𝔽2hj\\in\\mathbb\{F\}\_\{2\}^\{h\}, outputsNt=⌈n5​log⁡n⋅22​t​n⌉N\_\{t\}=\\lceil n^\{5\}\\log n\\cdot 2^\{2tn\}\\rceillattice vectors or aborts in time2\(max⁡\{1/2,χ\+2​t\}\+o⁡\(1\)\)​n2^\{\(\\max\\\{1/2,\\chi\+2t\\\}\+o\(1\)\)n\}and space2n/2\+o⁡\(n\)2^\{n/2\+o\(n\)\}\. It does not abort with probability1−2−Ω⁡\(n\)1\-2^\{\-\\Omega\(n\)\}overPPand the sampler randomness, and in that case, the joint distribution of its outputs has statistical distance at mostexp⁡\(−Ω⁡\(n2\)\)\\exp\(\-\\Omega\(n^2\)\)fromDΛj,ξtNtD\_\{\\Lambda\_\{j\},\\xi\_\{t\}\}^\{N\_\{t\}\}\.

###### Proof\.

We use[Theorem2\.7](https://arxiv.org/html/2608.02478#S2.Thmtheorem7)⌈4​Nt​2h−n/2⌉\\lceil 4N\_\{t\}2^\{h\-n/2\}\\rceiltimes sequentially, collect the samples satisfyingJP​\(X\)=jJ\_\{P\}\(X\)=j, and discard the others\. By[Lemma5\.3](https://arxiv.org/html/2608.02478#S5.Thmtheorem3), except with probability2−Ω⁡\(n\)2^\{\-\\Omega\(n\)\}overPP,ℙX∼Dℒ∗,ξt\[JP\(X\)=j\]=2−h\(1\+O\(2−Ω⁡\(n\)\)\)\\mathbb\{P\}\_\{X\\sim D\_\{\\mathcal\{L\}^\{\*\},\\xi\_\{t\}\}\}\[J\_\{P\}\(X\)=j\]=2^\{\-h\}\\left\(1\+O\(2^\{\-\\Omega\(n\)\}\)\\right\)simultaneously for everyj∈𝔽2hj\\in\\mathbb\{F\}\_\{2\}^\{h\}\. For every suchPPand everyjj, the Chernoff bound in[Lemma2\.12](https://arxiv.org/html/2608.02478#S2.Thmtheorem12)shows that fewer thanNtN\_\{t\}samples are accepted among4​Nt​2h4N\_\{t\}2^\{h\}independent samples with probability2−Ω⁡\(Nt\)2^\{\-\\Omega\(N\_\{t\}\)\}\. The statistical distance from independentDℒ∗,ξtD\_\{\\mathcal\{L\}^\{\*\},\\xi\_\{t\}\}samples changes this probability by at mostexp⁡\(−Ω⁡\(n2\)\)\\exp\(\-\\Omega\(n^2\)\)\. Therefore, the procedure aborts with probability2−Ω⁡\(n\)2^\{\-\\Omega\(n\)\}\. The time and space complexity is clear\. ∎

### 5\.3Estimating the coset Hessian

Fixt0=0\.23147​…<t<1/4t\_\{0\}=0\.23147\\ldots<t<1/4andNt=⌈n5​log⁡n⋅22​t​n⌉N\_\{t\}=\\lceil n^\{5\}\\log n\\cdot 2^\{2tn\}\\rceil\. For independent samples from the coset discrete Gaussian distributionX1,…,XNt∼DΛj,ξtX\_\{1\},\\ldots,X\_\{N\_\{t\}\}\\sim D\_\{\\Lambda\_\{j\},\\xi\_\{t\}\}, define an estimation of[Eq\.18](https://arxiv.org/html/2608.02478#S5.E18)analogous to[Eq\.13](https://arxiv.org/html/2608.02478#S3.E13)by

𝒢^t,d,j\(θ\):=−4​π2Nt∑i=1NtXiXiT\(−1\)θ⋅VP​\(Xi\)𝟏\{‖Xi‖≤C1ξtn\}\\displaystyle\\widehat\{\\mathcal\{G\}\}\_\{t,d,j\}\(\\theta\):=\-\\frac\{4\\pi^\{2\}\}\{N\_\{t\}\}\\sum\_\{i=1\}^\{N\_\{t\}\}X\_\{i\}X\_\{i\}^\{T\}\(\-1\)^\{\\theta\\cdot V\_\{P\}\(X\_\{i\}\)\}\\mathbf\{1\}\_\{\\\{\\norm\{X\_i\}\\leq C\_\{1\}\\xi\_\{t\}\\sqrt\{n\}\\\}\}\(20\)which can be computed using[Lemma5\.4](https://arxiv.org/html/2608.02478#S5.Thmtheorem4)\. We show that𝒢^t,d,j\\widehat\{\\mathcal\{G\}\}\_\{t,d,j\}approximates𝒢t,d,j\{\\mathcal\{G\}\}\_\{t,d,j\}similar to[Lemma3\.5](https://arxiv.org/html/2608.02478#S3.Thmtheorem5)\.

###### Lemma 5\.5\.

Letλ=λ1​\(ℒ\)\\lambda=\\lambda\_\{1\}\(\\mathcal\{L\}\)andλ≤d≤\(1\+1/n\)​λ\\lambda\\leq d\\leq\(1\+1/n\)\\lambda\. Choose independent uniformP∈GLn⁡\(𝔽2\)P\\in\\GL\_\{n\}\(\\mathbb\{F\}\_\{2\}\)andj∈𝔽2hj\\in\\mathbb\{F\}\_\{2\}^\{h\}\. For independentX1,…,XNt∼DΛj,ξtX\_\{1\},\\ldots,X\_\{N\_\{t\}\}\\sim D\_\{\\Lambda\_\{j\},\\xi\_\{t\}\}, with probability1−2−Ω⁡\(n\)1\-2^\{\-\\Omega\(n\)\}overP,j,X1,…,XNtP,j,X\_\{1\},\\ldots,X\_\{N\_\{t\}\},

maxθ∈𝔽2ℓ⁡‖𝒢^t,d,j​\(θ\)−𝒢t,d,j​\(θ\)‖op=O⁡\(μt,dn\)\.\\max\_\{\\theta\\in\\mathbb\{F\}\_\{2\}^\{\\ell\}\}\\left\\lVert\\widehat\{\\mathcal\{G\}\}\_\{t,d,j\}\(\\theta\)\-\\mathcal\{G\}\_\{t,d,j\}\(\\theta\)\\right\\rVert\_\{\\mathrm\{op\}\}=O\\left\(\\frac\{\\mu\_\{t,d\}\}\{n\}\\right\)\.

###### Proof\.

By[Lemma5\.3](https://arxiv.org/html/2608.02478#S5.Thmtheorem3), except with probability2−Ω⁡\(n\)2^\{\-\\Omega\(n\)\}overPP, we haveζt,j≥1/2\\zeta\_\{t,j\}\\geq 1/2for everyj∈𝔽2hj\\in\\mathbb\{F\}\_\{2\}^\{h\}\. Fix such a matrixPP\. LetY∼Dℒ∗,ξtY\\sim D\_\{\\mathcal\{L\}^\{\*\},\\xi\_\{t\}\}andX∼DΛj,ξtX\\sim D\_\{\\Lambda\_\{j\},\\xi\_\{t\}\}\. Byℙ\[JP\(Y\)=j\]=2−hζt,j\\mathbb\{P\}\[J\_\{P\}\(Y\)=j\]=2^\{\-h\}\\zeta\_\{t,j\}and[Lemma2\.8](https://arxiv.org/html/2608.02478#S2.Thmtheorem8)withc=1c=1, we have

𝔼\[‖X‖2𝟏\{‖X‖\>C1ξtn\}\]≤2hζt,j𝔼\[‖Y‖2𝟏\{‖Y‖\>C1ξtn\}\]≤2h\+1ξt2n2−n\.\\mathbb\{E\}\\left\[\\norm\{X\}^\{2\}\\mathbf\{1\}\_\{\\\{\\norm\{X\}\>C\_\{1\}\\xi\_\{t\}\\sqrt\{n\}\\\}\}\\right\]\\leq\\frac\{2^\{h\}\}\{\\zeta\_\{t,j\}\}\\mathbb\{E\}\\left\[\\norm\{Y\}^\{2\}\\mathbf\{1\}\_\{\\\{\\norm\{Y\}\>C\_\{1\}\\xi\_\{t\}\\sqrt\{n\}\\\}\}\\right\]\\leq 2^\{h\+1\}\\xi\_\{t\}^\{2\}n2^\{\-n\}\.With the same argument for[Eq\.14](https://arxiv.org/html/2608.02478#S3.E14), we have

‖𝔼⁡\[𝒢^t,d,j​\(θ\)\]−𝒢t,d,j​\(θ\)‖op≤8​π2​ξt2​n​2−ℓ≤ξt4​d2n​2−t​n\\left\\lVert\\mathbb\{E\}\[\\widehat\{\\mathcal\{G\}\}\_\{t,d,j\}\(\\theta\)\]\-\\mathcal\{G\}\_\{t,d,j\}\(\\theta\)\\right\\rVert\_\{\\mathrm\{op\}\}\\leq 8\\pi^\{2\}\\xi\_\{t\}^\{2\}n2^\{\-\\ell\}\\leq\\frac\{\\xi\_\{t\}^\{4\}d^\{2\}\}\{n\}2^\{\-tn\}for all sufficiently largenn, where we usedℓ≥n/2\\ell\\geq n/2,t<1/4t<1/4, andξt2​d2=4​n​t​ln⁡2/π\\xi\_\{t\}^\{2\}d^\{2\}=4nt\\ln 2/\\pi\.

Each entry of the random matrix in[Eq\.20](https://arxiv.org/html/2608.02478#S5.E20)has absolute value at most4​π2​C12​ξt2​n4\\pi^\{2\}C\_\{1\}^\{2\}\\xi\_\{t\}^\{2\}n\. Hence, for fixedθ∈𝔽2ℓ\\theta\\in\\mathbb\{F\}\_\{2\}^\{\\ell\}anda,b∈\{1,…,n\}a,b\\in\\\{1,\\ldots,n\\\}, Hoeffding’s inequality gives

ℙ\[\|\(𝒢^t,d,j\(θ\)−𝔼\[𝒢^t,d,j\(θ\)\]\)a,b\|\>ξt4​d2n22−t​n\]≤2exp\(−Ω\(Nt​ξt4​d4n62−2​t​n\)\)=2e−Ω⁡\(n​log⁡n\)\.\\mathbb\{P\}\\left\[\\left\|\\left\(\\widehat\{\\mathcal\{G\}\}\_\{t,d,j\}\(\\theta\)\-\\mathbb\{E\}\[\\widehat\{\\mathcal\{G\}\}\_\{t,d,j\}\(\\theta\)\]\\right\)\_\{a,b\}\\right\|\>\\frac\{\\xi\_\{t\}^\{4\}d^\{2\}\}\{n^\{2\}\}2^\{\-tn\}\\right\]\\leq 2\\exp\\left\(\-\\Omega\\left\(\\frac\{N\_\{t\}\\xi\_\{t\}^\{4\}d^\{4\}\}\{n^\{6\}\}2^\{\-2tn\}\\right\)\\right\)=2e^\{\-\\Omega\(n\\log n\)\}\.Here we usedNt=⌈n5​log⁡n⋅22​t​n⌉N\_\{t\}=\\lceil n^\{5\}\\log n\\cdot 2^\{2tn\}\\rceilandξt2​d2=4​n​t​ln⁡2/π\\xi\_\{t\}^\{2\}d^\{2\}=4nt\\ln 2/\\pi\. A union bound over the2ℓ​n22^\{\\ell\}n^\{2\}choices ofθ,a,b\\theta,a,bshows that, with probability1−2−Ω⁡\(n​log⁡n\)1\-2^\{\-\\Omega\(n\\log n\)\}over the samples,

maxθ∈𝔽2ℓ⁡‖𝒢^t,d,j​\(θ\)−𝔼⁡\[𝒢^t,d,j​\(θ\)\]‖op≤ξt4​d2n​2−t​n\\max\_\{\\theta\\in\\mathbb\{F\}\_\{2\}^\{\\ell\}\}\\left\\lVert\\widehat\{\\mathcal\{G\}\}\_\{t,d,j\}\(\\theta\)\-\\mathbb\{E\}\[\\widehat\{\\mathcal\{G\}\}\_\{t,d,j\}\(\\theta\)\]\\right\\rVert\_\{\\mathrm\{op\}\}\\leq\\frac\{\\xi\_\{t\}^\{4\}d^\{2\}\}\{n\}2^\{\-tn\}The triangle inequality applied to𝒢^t,d,j​\(θ\)−𝔼⁡\[𝒢^t,d,j​\(θ\)\]\\widehat\{\\mathcal\{G\}\}\_\{t,d,j\}\(\\theta\)\-\\mathbb\{E\}\[\\widehat\{\\mathcal\{G\}\}\_\{t,d,j\}\(\\theta\)\]and𝔼⁡\[𝒢^t,d,j​\(θ\)\]−𝒢t,d,j​\(θ\)\\mathbb\{E\}\[\\widehat\{\\mathcal\{G\}\}\_\{t,d,j\}\(\\theta\)\]\-\\mathcal\{G\}\_\{t,d,j\}\(\\theta\)proves the lemma, after usingμt,d=ξt4​d2​2−t​n\+O⁡\(1\)\\mu\_\{t,d\}=\\xi\_\{t\}^\{4\}d^\{2\}2^\{\-tn\+O\(1\)\}\. ∎

### 5\.4Coset Hessians and shortest vectors

It remains to show how to relate the coset Hessians and the \(direction\) of shortest vectors as in[Lemma3\.4](https://arxiv.org/html/2608.02478#S3.Thmtheorem4)\. The following lemma extends[Eq\.9](https://arxiv.org/html/2608.02478#S3.E9)to the coset Hessian\.

###### Lemma 5\.6\.

𝒢t,d,j​\(θ\)−1ζt,j​∑α∈𝔽2h\(−1\)α⋅j​𝒜t,d​\(P−1​\(α,θ\)\)∈span⁡\{In\}\.\\mathcal\{G\}\_\{t,d,j\}\(\\theta\)\-\\frac\{1\}\{\\zeta\_\{t,j\}\}\\sum\_\{\\alpha\\in\\mathbb\{F\}\_\{2\}^\{h\}\}\(\-1\)^\{\\alpha\\cdot j\}\\mathcal\{A\}\_\{t,d\}\\left\(P^\{\-1\}\(\\alpha,\\theta\)\\right\)\\in\\operatorname\{span\}\\\{I\_\{n\}\\\}\.

###### Proof\.

Sinceℙ\[JP\(X\)=j\]=2−hζt,j\\mathbb\{P\}\[J\_\{P\}\(X\)=j\]=2^\{\-h\}\\zeta\_\{t,j\}, the definition of𝒢t,d,j​\(θ\)\\mathcal\{G\}\_\{t,d,j\}\(\\theta\)gives

𝒢t,d,j\(θ\)=−4​π2​2hζt,j𝔼X∼Dℒ∗,ξt\[XXT\(−1\)θ⋅VP​\(X\)𝟏\{JP\(X\)=j\}\]\.\\mathcal\{G\}\_\{t,d,j\}\(\\theta\)=\-\\frac\{4\\pi^\{2\}2^\{h\}\}\{\\zeta\_\{t,j\}\}\\mathbb\{E\}\_\{X\\sim D\_\{\\mathcal\{L\}^\{\*\},\\xi\_\{t\}\}\}\\left\[XX^\{T\}\(\-1\)^\{\\theta\\cdot V\_\{P\}\(X\)\}\\mathbf\{1\}\_\{\\\{J\_\{P\}\(X\)=j\\\}\}\\right\]\.Observe that2h𝟏\{y=j\}=∑α∈𝔽2h\(−1\)α⋅\(y\+j\)2^\{h\}\\mathbf\{1\}\_\{\\\{y=j\\\}\}=\\sum\_\{\\alpha\\in\\mathbb\{F\}\_\{2\}^\{h\}\}\(\-1\)^\{\\alpha\\cdot\(y\+j\)\}for everyy,j∈𝔽2hy,j\\in\\mathbb\{F\}\_\{2\}^\{h\}\. Indeed, ify=jy=j, every summand is one; otherwise, the summands can be paired with opposite signs\. Applying this identity withy=JP​\(X\)y=J\_\{P\}\(X\)and interchanging the finite sum and expectation gives

𝒢t,d,j​\(θ\)=1ζt,j​∑α∈𝔽2h\(−1\)α⋅j​𝒢t,d​\(P−1​\(α,θ\)\)\\displaystyle\\mathcal\{G\}\_\{t,d,j\}\(\\theta\)=\\frac\{1\}\{\\zeta\_\{t,j\}\}\\sum\_\{\\alpha\\in\\mathbb\{F\}\_\{2\}^\{h\}\}\(\-1\)^\{\\alpha\\cdot j\}\\mathcal\{G\}\_\{t,d\}\\left\(P^\{\-1\}\(\\alpha,\\theta\)\\right\)\(21\)where we putu=P−1​\(α,θ\)u=P^\{\-1\}\(\\alpha,\\theta\)and use[Eq\.19](https://arxiv.org/html/2608.02478#S5.E19)to derive

\(−1\)θ⋅VP​\(X\)⋅\(−1\)α⋅JP​\(X\)\+α⋅j=\(−1\)α⋅j⋅\(−1\)α⋅JP​\(X\)\+θ⋅VP​\(X\)=\(−1\)α⋅j⋅\(−1\)uT​\(BT​Xmod2\)\.\(\-1\)^\{\\theta\\cdot V\_\{P\}\(X\)\}\\cdot\(\-1\)^\{\\alpha\\cdot J\_\{P\}\(X\)\+\\alpha\\cdot j\}=\(\-1\)^\{\\alpha\\cdot j\}\\cdot\(\-1\)^\{\\alpha\\cdot J\_\{P\}\(X\)\+\\theta\\cdot V\_\{P\}\(X\)\}=\(\-1\)^\{\\alpha\\cdot j\}\\cdot\(\-1\)^\{u^\{T\}\(B^\{T\}X\\bmod 2\)\}\.The term\(−1\)uT​\(BT​Xmod2\)\(\-1\)^\{u^\{T\}\(B^\{T\}X\\bmod 2\)\}is exactly the term in[Lemma3\.3](https://arxiv.org/html/2608.02478#S3.Thmtheorem3), proving[Eq\.21](https://arxiv.org/html/2608.02478#S5.E21)\. The final inclusion is proven by using[Lemma3\.3](https://arxiv.org/html/2608.02478#S3.Thmtheorem3)on𝒢t,d​\(P−1​\(α,θ\)\)−𝒜t,d​\(P−1​\(α,θ\)\)∈span⁡\{In\}\\mathcal\{G\}\_\{t,d\}\(P^\{\-1\}\(\\alpha,\\theta\)\)\-\\mathcal\{A\}\_\{t,d\}\(P^\{\-1\}\(\\alpha,\\theta\)\)\\in\\operatorname\{span\}\\\{I\_\{n\}\\\}for eachα\.\\alpha\.∎

This lemma gives some intuition why the approach in this section works\. If one ofP−1​\(α,θ\)=uP^\{\-1\}\(\\alpha,\\theta\)=uis such thatB​u\+2​ℒBu\+2\\mathcal\{L\}contains a shortest vectorvv, the corresponding𝒜t,d​\(P−1​\(α,θ\)\)\\mathcal\{A\}\_\{t,d\}\(P^\{\-1\}\(\\alpha,\\theta\)\)must be approximately proportional tov​vTvv^\{T\}\. We will prove that the sum of the remaining terms is exponentially smaller with high probability overPPandjj\. Therefore, some eigenvector of𝒢t,d,j​\(θ\)\\mathcal\{G\}\_\{t,d,j\}\(\\theta\)must be approximately proportional tovv, as the multiple ofInI\_\{n\}does not affect the eigen vectors and the order of eigenvalues\.

The coefficient of the first term is\(−1\)α∗⋅j\(\-1\)^\{\\alpha\_\{\*\}\\cdot j\}, so it may determine either the largest or the smallest eigenvalue\. We therefore consider both extreme eigenvalues\. Similarly to[Lemma3\.6](https://arxiv.org/html/2608.02478#S3.Thmtheorem6), we obtain the following lemma\.

###### Lemma 5\.7\.

Lett0<t<1/4t\_\{0\}<t<1/4be fixed, let0≤χ≤1/20\\leq\\chi\\leq 1/2, and letλ=λ1​\(ℒ\)≤d≤\(1\+1/n\)​λ\\lambda=\\lambda\_\{1\}\(\\mathcal\{L\}\)\\leq d\\leq\(1\+1/n\)\\lambda\. Letv∈ℒv\\in\\mathcal\{L\}satisfy‖v‖=λ\\norm\{v\}=\\lambda, and letu∗∈𝔽2nu\_\{\*\}\\in\\mathbb\{F\}\_\{2\}^\{n\}satisfyv∈B​u∗\+2​ℒv\\in Bu\_\{\*\}\+2\\mathcal\{L\}\. Choose independent uniformP∈GLn⁡\(𝔽2\)P\\in\\GL\_\{n\}\(\\mathbb\{F\}\_\{2\}\)andj∈𝔽2hj\\in\\mathbb\{F\}\_\{2\}^\{h\}, and writeP​u∗=\(α∗,θ∗\)Pu\_\{\*\}=\(\\alpha\_\{\*\},\\theta\_\{\*\}\)\. With probability1−2−Ω⁡\(n\)1\-2^\{\-\\Omega\(n\)\}overPPandjj, the following holds\. Suppose that the conclusion of[Lemma5\.5](https://arxiv.org/html/2608.02478#S5.Thmtheorem5)holds\. Letq\+q\_\{\+\}andq−q\_\{\-\}be unit eigenvectors corresponding to the largest and smallest eigenvalues of𝒢^t,d,j​\(θ∗\)\\widehat\{\\mathcal\{G\}\}\_\{t,d,j\}\(\\theta\_\{\*\}\), respectively\. Then there ares∈\{\+,−\}s\\in\\\{\+,\-\\\}andτ∈\{−1,1\}\\tau\\in\\\{\-1,1\\\}such that

‖qs−τ​v/λ‖=O\(n−1/2\)\.\\norm\{q\_s\-\\tau v/\\lambda\}=O\(n^\{\-1/2\}\)\.Consequently, then−1/3n^\{\-1/3\}\-𝖡𝖣𝖣\\mathsf\{BDD\}query atd​qsdq\_\{s\}returnsτ​v\\tau vfor all sufficiently largenn\.

###### Proof\.

Letv^=v/λ\\widehat\{v\}=v/\\lambdaand recall[Lemma3\.4](https://arxiv.org/html/2608.02478#S3.Thmtheorem4)stating that𝒜t,d​\(u∗\)=μt,d​v^​v^T\+ℛt,d​\(u∗\)\\mathcal\{A\}\_\{t,d\}\(u\_\{\*\}\)=\\mu\_\{t,d\}\\widehat\{v\}\\widehat\{v\}^\{T\}\+\\mathcal\{R\}\_\{t,d\}\(u\_\{\*\}\)for‖ℛt,d​\(u∗\)‖op/μt,d=2−Ω⁡\(n\)\{\\left\\lVert\\mathcal\{R\}\_\{t,d\}\(u\_\{\*\}\)\\right\\rVert\_\{\\mathrm\{op\}\}\}/\{\\mu\_\{t,d\}\}=2^\{\-\\Omega\(n\)\}, whereμt,d=ξt4​λ2​2−t​n\+O⁡\(1\)\\mu\_\{t,d\}=\\xi\_\{t\}^\{4\}\\lambda^\{2\}2^\{\-tn\+O\(1\)\}\.

We first bound the contribution fromα≠α∗\\alpha\\neq\\alpha\_\{\*\}\. For fixedPP, expanding the squared Frobenius norm using‖X‖F2=Tr⁡\(XT​X\)\\left\\lVert X\\right\\rVert\_\{\\mathrm\{F\}\}^\{2\}=\\operatorname\{Tr\}\(X^\{T\}X\)for the real matrixXX,

‖∑α≠α∗\(−1\)j⋅\(α−α∗\)​𝒜t,d​\(P−1​\(α,θ∗\)\)‖F2=∑α,α′≠α∗\(−1\)j⋅\(α−α′\)​Tr⁡\(𝒜t,d​\(P−1​\(α′,θ∗\)\)T​𝒜t,d​\(P−1​\(α,θ∗\)\)\)\\displaystyle\\left\\lVert\\sum\_\{\\alpha\\neq\\alpha\_\{\*\}\}\(\-1\)^\{j\\cdot\(\\alpha\-\\alpha\_\{\*\}\)\}\\mathcal\{A\}\_\{t,d\}\\left\(P^\{\-1\}\(\\alpha,\\theta\_\{\*\}\)\\right\)\\right\\rVert\_\{\\mathrm\{F\}\}^\{2\}=\\sum\_\{\\alpha,\\alpha^\{\\prime\}\\neq\\alpha\_\{\*\}\}\(\-1\)^\{j\\cdot\(\\alpha\-\\alpha^\{\\prime\}\)\}\\operatorname\{Tr\}\\left\(\\mathcal\{A\}\_\{t,d\}\\left\(P^\{\-1\}\(\\alpha^\{\\prime\},\\theta\_\{\*\}\)\\right\)^\{T\}\\mathcal\{A\}\_\{t,d\}\\left\(P^\{\-1\}\(\\alpha,\\theta\_\{\*\}\)\\right\)\\right\)and taking the expectation over uniformjjusing𝔼j​\[\(−1\)j⋅\(α−α′\)\]=0\\mathbb\{E\}\_\{j\}\[\(\-1\)^\{j\\cdot\(\\alpha\-\\alpha^\{\\prime\}\)\}\]=0forα≠α′\\alpha\\neq\\alpha^\{\\prime\}gives

𝔼j​‖∑α≠α∗\(−1\)j⋅\(α−α∗\)​𝒜t,d​\(P−1​\(α,θ∗\)\)‖F2=∑α≠α∗‖𝒜t,d​\(P−1​\(α,θ∗\)\)‖F2\.\\mathbb\{E\}\_\{j\}\\left\\lVert\\sum\_\{\\alpha\\neq\\alpha\_\{\*\}\}\(\-1\)^\{j\\cdot\(\\alpha\-\\alpha\_\{\*\}\)\}\\mathcal\{A\}\_\{t,d\}\\left\(P^\{\-1\}\(\\alpha,\\theta\_\{\*\}\)\\right\)\\right\\rVert\_\{\\mathrm\{F\}\}^\{2\}=\\sum\_\{\\alpha\\neq\\alpha\_\{\*\}\}\\left\\lVert\\mathcal\{A\}\_\{t,d\}\\left\(P^\{\-1\}\(\\alpha,\\theta\_\{\*\}\)\\right\)\\right\\rVert\_\{\\mathrm\{F\}\}^\{2\}\.
Now we are taking the expectation overPP\. For each fixedu≠u∗u\\neq u\_\{\*\}, the matrix𝒜t,d​\(u\)\\mathcal\{A\}\_\{t,d\}\(u\)occurs in the sum on exactly whenP⁡\(u−u∗\)∈𝔽2h×\{0\}P\(u\-u\_\{\*\}\)\\in\\mathbb\{F\}\_\{2\}^\{h\}\\times\\\{0\\\}\. SinceP⁡\(u−u∗\)P\(u\-u\_\{\*\}\)is uniform over𝔽2n∖\{0\}\\mathbb\{F\}\_\{2\}^\{n\}\\setminus\\\{0\\\}, the probability thatP⁡\(u−u∗\)P\(u\-u\_\{\*\}\)is included in𝔽2h×\{0\}\\mathbb\{F\}\_\{2\}^\{h\}\\times\\\{0\\\}is exactly\(2h−1\)/\(2n−1\)\(2^\{h\}\-1\)/\(2^\{n\}\-1\)\. Consequently,[Lemma5\.2](https://arxiv.org/html/2608.02478#S5.Thmtheorem2)gives

𝔼P,j​‖∑α≠α∗\(−1\)j⋅\(α−α∗\)​𝒜t,d​\(P−1​\(α,θ∗\)\)‖F2≤2h−n⋅\(μt,d2​22​t​n−g⁡\(t\)​n\+o⁡\(n\)\)=μt,d2​2\(χ−1−g⁡\(t\)\+2​t\+o⁡\(1\)\)​n\\mathbb\{E\}\_\{P,j\}\\left\\lVert\\sum\_\{\\alpha\\neq\\alpha\_\{\*\}\}\(\-1\)^\{j\\cdot\(\\alpha\-\\alpha\_\{\*\}\)\}\\mathcal\{A\}\_\{t,d\}\\left\(P^\{\-1\}\(\\alpha,\\theta\_\{\*\}\)\\right\)\\right\\rVert\_\{\\mathrm\{F\}\}^\{2\}\\leq 2^\{h\-n\}\\cdot\(\\mu\_\{t,d\}^\{2\}2^\{2tn\-g\(t\)n\+o\(n\)\}\)=\\mu\_\{t,d\}^\{2\}2^\{\(\\chi\-1\-g\(t\)\+2t\+o\(1\)\)n\}where we useh=⌊χ​n⌋h=\\lfloor\\chi n\\rfloor\. Sinceχ≤1/2\\chi\\leq 1/2,t<1/4t<1/4, andg⁡\(t\)\>0g\(t\)\>0, the exponent satisfiesχ−1−g⁡\(t\)\+2​t<0\\chi\-1\-g\(t\)\+2t<0\. Markov’s inequality shows that

‖∑α≠α∗\(−1\)j⋅\(α−α∗\)​𝒜t,d​\(P−1​\(α,θ∗\)\)‖F≤μt,d​2−Ω⁡\(n\)\\displaystyle\\left\\lVert\\sum\_\{\\alpha\\neq\\alpha\_\{\*\}\}\(\-1\)^\{j\\cdot\(\\alpha\-\\alpha\_\{\*\}\)\}\\mathcal\{A\}\_\{t,d\}\\left\(P^\{\-1\}\(\\alpha,\\theta\_\{\*\}\)\\right\)\\right\\rVert\_\{\\mathrm\{F\}\}\\leq\\mu\_\{t,d\}2^\{\-\\Omega\(n\)\}\(22\)holds except with probability2−Ω⁡\(n\)2^\{\-\\Omega\(n\)\}overPPandjj, and the same bound holds for the operator norm as well\.

For the hidden signσ=\(−1\)α∗⋅j\\sigma=\(\-1\)^\{\\alpha\_\{\*\}\\cdot j\}, we can decomposeE:=σ​𝒢^t,d,j​\(θ∗\)−μt,dζt,j​v^​v^T−a​InE:=\\sigma\\widehat\{\\mathcal\{G\}\}\_\{t,d,j\}\(\\theta\_\{\*\}\)\-\\frac\{\\mu\_\{t,d\}\}\{\\zeta\_\{t,j\}\}\\widehat\{v\}\\widehat\{v\}^\{T\}\-aI\_\{n\}using[Lemma5\.6](https://arxiv.org/html/2608.02478#S5.Thmtheorem6)for someaaand bound its operator norm by

‖𝒢^t,d,j​\(θ∗\)−𝒢t,d,j​\(θ∗\)‖op\+1ζt,j​\(‖∑α≠α∗\(−1\)j⋅\(α−α∗\)​𝒜t,d​\(P−1​\(α,θ∗\)\)‖op\+‖ℛt,d​\(u∗\)‖op\)=O⁡\(μt,d​n−1\)\\left\\lVert\\widehat\{\\mathcal\{G\}\}\_\{t,d,j\}\(\\theta\_\{\*\}\)\-\{\\mathcal\{G\}\}\_\{t,d,j\}\(\\theta\_\{\*\}\)\\right\\rVert\_\{\\mathrm\{op\}\}\+\\frac\{1\}\{\\zeta\_\{t,j\}\}\\left\(\\left\\lVert\\sum\_\{\\alpha\\neq\\alpha\_\{\*\}\}\(\-1\)^\{j\\cdot\(\\alpha\-\\alpha\_\{\*\}\)\}\\mathcal\{A\}\_\{t,d\}\\left\(P^\{\-1\}\(\\alpha,\\theta\_\{\*\}\)\\right\)\\right\\rVert\_\{\\mathrm\{op\}\}\+\\left\\lVert\\mathcal\{R\}\_\{t,d\}\(u\_\{\*\}\)\\right\\rVert\_\{\\mathrm\{op\}\}\\right\)=O\\left\(\\mu\_\{t,d\}n^\{\-1\}\\right\)where we use[Lemma5\.5](https://arxiv.org/html/2608.02478#S5.Thmtheorem5)and[Eq\.22](https://arxiv.org/html/2608.02478#S5.E22)together withζt,j=1\+O⁡\(2−Ω⁡\(n\)\)\\zeta\_\{t,j\}=1\+O\(2^\{\-\\Omega\(n\)\}\)from[Lemma5\.3](https://arxiv.org/html/2608.02478#S5.Thmtheorem3)\.

Letqqbe the unit eigenvector corresponding to the largest eigenvalue ofσ​𝒢^t,d,j​\(θ∗\)\\sigma\\widehat\{\\mathcal\{G\}\}\_\{t,d,j\}\(\\theta\_\{\*\}\), which must be one ofq\+q\_\{\+\}\(ifσ=1\\sigma=1\) orq−q\_\{\-\}\(ifσ=−1\\sigma=\-1\)\. HenceqT​σ​𝒢^t,d,j​\(θ∗\)​q≥v^T​σ​𝒢^t,d,j​\(θ∗\)​v^q^\{T\}\\sigma\\widehat\{\\mathcal\{G\}\}\_\{t,d,j\}\(\\theta\_\{\*\}\)q\\geq\\widehat\{v\}^\{T\}\\sigma\\widehat\{\\mathcal\{G\}\}\_\{t,d,j\}\(\\theta\_\{\*\}\)\\widehat\{v\}\. Pluggingσ​𝒢^t,d,j​\(θ∗\)=μt,dζt,j​v^​v^T\+a​In\+E\\sigma\\widehat\{\\mathcal\{G\}\}\_\{t,d,j\}\(\\theta\_\{\*\}\)=\\frac\{\\mu\_\{t,d\}\}\{\\zeta\_\{t,j\}\}\\widehat\{v\}\\widehat\{v\}^\{T\}\+aI\_\{n\}\+E, we obtain the following inequality

μt,dζt,j​\(1−⟨q,v^⟩2\)≤2​‖E‖op=O⁡\(μt,d​n−1\)\.\\frac\{\\mu\_\{t,d\}\}\{\\zeta\_\{t,j\}\}\\left\(1\-\\left\\langle q,\\widehat\{v\}\\right\\rangle^\{2\}\\right\)\\leq 2\\left\\lVert E\\right\\rVert\_\{\\mathrm\{op\}\}=O\\left\(\\mu\_\{t,d\}n^\{\-1\}\\right\)\.Thus1−⟨q,v^⟩2=O⁡\(n−1\)1\-\\left\\langle q,\\widehat\{v\}\\right\\rangle^\{2\}=O\(n^\{\-1\}\)\. Choosingτ∈\{−1,1\}\\tau\\in\\\{\-1,1\\\}such that⟨q,τ​v^⟩≥0\\left\\langle q,\\tau\\widehat\{v\}\\right\\rangle\\geq 0gives‖q−τ​v^‖=O\(n−1/2\)\\norm\{q\-\\tau\\widehat v\}=O\(n^\{\-1/2\}\)\.

Finally,‖d​q−τ​v‖≤d‖q−τ​v^‖\+d−λ=O\(λn−1/2\)<λn−1/3\\norm\{dq\-\\tau v\}\\leq d\\norm\{q\-\\tau\\widehat v\}\+d\-\\lambda=O\(\\lambda n^\{\-1/2\}\)<\\lambda n^\{\-1/3\}for all sufficiently largenn\. The final claim follows from[Theorem2\.4](https://arxiv.org/html/2608.02478#S2.Thmtheorem4)\. ∎

### 5\.5The affine\-coset algorithm

This section presents the algorithm using the affine cosets\. The overall time complexity is20\.7314​n≈2\(0\.5\+t\)​n\+o⁡\(n\)2^\{0\.7314n\}\\approx 2^\{\(0\.5\+t\)n\+o\(n\)\}by balancing2max⁡\(0\.5,χ\+2​t\)​n\+o⁡\(n\)2^\{\\max\(0\.5,\\chi\+2t\)n\+o\(n\)\}of the DGS sampling from[Lemma5\.4](https://arxiv.org/html/2608.02478#S5.Thmtheorem4)and2ℓ\+o⁡\(n\)=2\(1−χ\)​n\+o⁡\(n\)2^\{\\ell\+o\(n\)\}=2^\{\(1\-\\chi\)n\+o\(n\)\}of the number ofθ∈𝔽2ℓ\\theta\\in\\mathbb\{F\}\_\{2\}^\{\\ell\}, whereh=⌊χ​n⌋h=\\lfloor\\chi n\\rfloor,t0=0\.2314​…<t<1/4t\_\{0\}=0\.2314\\ldots<t<1/4andNt=2\(2​t\+o⁡\(1\)\)​nN\_\{t\}=2^\{\(2t\+o\(1\)\)n\}\. This can be obtained using the Walsh\-Hadamard transform as before, and the other steps take much smaller time\.

Algorithm 3: Affine\-coset Hessian𝖲𝖵𝖯\\mathsf\{SVP\}

1. 1\.Construct the preprocessingn−1/3n^\{\-1/3\}\-𝖡𝖣𝖣\\mathsf\{BDD\}data and the scale grid from[Section3\.3](https://arxiv.org/html/2608.02478#S3.SS3)\. Chooset0<t<1/4t\_\{0\}<t<1/4, and putχ=1/2−t\\chi=1/2\-t\.
2. 2\.At every scaledd, choose independent uniformP∈GLn⁡\(𝔽2\)P\\in\\GL\_\{n\}\(\\mathbb\{F\}\_\{2\}\)andj∈𝔽2hj\\in\\mathbb\{F\}\_\{2\}^\{h\}\. Apply the sampling algorithm from[Lemma5\.4](https://arxiv.org/html/2608.02478#S5.Thmtheorem4)\. Abort the scaleddunlessNtN\_\{t\}samples fromDΛj,ξtD\_\{\\Lambda\_\{j\},\\xi\_\{t\}\}are obtained\.
3. 3\.Letb=⌊n/2⌋b=\\lfloor n/2\\rfloor\. For every accepted sampleXiX\_\{i\}, define VP\(Xi\)=\(ki′,ki′′\)∈𝔽2b×𝔽2ℓ−b,Wi:=−4​π2NtXiXiT𝟏\{‖Xi‖≤C1ξtn\}\.V\_\{P\}\(X\_\{i\}\)=\(k\_\{i\}^\{\\prime\},k\_\{i\}^\{\\prime\\prime\}\)\\in\\mathbb\{F\}\_\{2\}^\{b\}\\times\\mathbb\{F\}\_\{2\}^\{\\ell\-b\},\\qquad W\_\{i\}:=\-\\frac\{4\\pi^\{2\}\}\{N\_\{t\}\}X\_\{i\}X\_\{i\}^\{T\}\\mathbf\{1\}\_\{\\\{\\norm\{X\_i\}\\leq C\_\{1\}\\xi\_\{t\}\\sqrt\{n\}\\\}\}\.For eachθ′′∈𝔽2ℓ−b\\theta^\{\\prime\\prime\}\\in\\mathbb\{F\}\_\{2\}^\{\\ell\-b\}, do the following: 1. \(a\)Construct the arrayAθ′′​\(x\):=∑1≤i≤Ntki′=x\(−1\)θ′′⋅ki′′​WiA\_\{\\theta^\{\\prime\\prime\}\}\(x\):=\\sum\_\{\\begin\{subarray\}\{c\}1\\leq i\\leq N\_\{t\}\\\\ k\_\{i\}^\{\\prime\}=x\\end\{subarray\}\}\(\-1\)^\{\\theta^\{\\prime\\prime\}\\cdot k\_\{i\}^\{\\prime\\prime\}\}W\_\{i\}for allx∈𝔽2bx\\in\\mathbb\{F\}\_\{2\}^\{b\}\. 2. \(b\)Apply the matrix\-valued Walsh\-Hadamard transform to obtain for everyθ′∈𝔽2b\\theta^\{\\prime\}\\in\\mathbb\{F\}\_\{2\}^\{b\}: ∑x∈𝔽2b\(−1\)θ′⋅x​Aθ′′​\(x\)=∑i=1Nt\(−1\)θ′⋅ki′\+θ′′⋅ki′′​Wi=𝒢^t,d,j​\(θ′,θ′′\)\.\\displaystyle\\sum\_\{x\\in\\mathbb\{F\}\_\{2\}^\{b\}\}\(\-1\)^\{\\theta^\{\\prime\}\\cdot x\}A\_\{\\theta^\{\\prime\\prime\}\}\(x\)=\\sum\_\{i=1\}^\{N\_\{t\}\}\(\-1\)^\{\\theta^\{\\prime\}\\cdot k\_\{i\}^\{\\prime\}\+\\theta^\{\\prime\\prime\}\\cdot k\_\{i\}^\{\\prime\\prime\}\}W\_\{i\}=\\widehat\{\\mathcal\{G\}\}\_\{t,d,j\}\(\\theta^\{\\prime\},\\theta^\{\\prime\\prime\}\)\.\(23\) 3. \(c\)For each output in[Eq\.23](https://arxiv.org/html/2608.02478#S5.E23), compute unit eigenvectorsq\+q\_\{\+\}andq−q\_\{\-\}corresponding to its largest and smallest eigenvalues and query𝖡𝖣𝖣\\mathsf\{BDD\}atd​q±dq\_\{\\pm\}\. Store a nonzero output inℒ\\mathcal\{L\}\. Keep only the shortest vector found, and discard the other vectors and temporal data\.
4. 4\.Return the shortest vector over all scales\.

###### Theorem 5\.8\.

[Section5\.5](https://arxiv.org/html/2608.02478#S5.SS5)solves Search\-𝖲𝖵𝖯\\mathsf\{SVP\}with constant success probability in time20\.7314​n\+o⁡\(n\)2^\{0\.7314n\+o\(n\)\}and space2n/2\+o⁡\(n\)2^\{n/2\+o\(n\)\}\.

###### Proof\.

Supposeλ1​\(ℒ\)≤d≤\(1\+1/n\)​λ1​\(ℒ\)\\lambda\_\{1\}\(\\mathcal\{L\}\)\\leq d\\leq\(1\+1/n\)\\lambda\_\{1\}\(\\mathcal\{L\}\)and letvva shortest vector\. Chooseu∗∈𝔽2nu\_\{\*\}\\in\\mathbb\{F\}\_\{2\}^\{n\}such thatv∈B​u∗\+2​ℒv\\in Bu\_\{\*\}\+2\\mathcal\{L\}, writeP​u∗=\(α∗,θ∗\)Pu\_\{\*\}=\(\\alpha\_\{\*\},\\theta\_\{\*\}\), and writeθ∗=\(θ∗′,θ∗′′\)∈𝔽2b×𝔽2ℓ−b\\theta\_\{\*\}=\(\\theta\_\{\*\}^\{\\prime\},\\theta\_\{\*\}^\{\\prime\\prime\}\)\\in\\mathbb\{F\}\_\{2\}^\{b\}\\times\\mathbb\{F\}\_\{2\}^\{\\ell\-b\}\.

By[Lemma5\.4](https://arxiv.org/html/2608.02478#S5.Thmtheorem4), the algorithm obtains the specified samples fromDΛj,ξtD\_\{\\Lambda\_\{j\},\\xi\_\{t\}\}\. By[Eq\.23](https://arxiv.org/html/2608.02478#S5.E23), the iteration indexed byθ∗′′\\theta\_\{\*\}^\{\\prime\\prime\}computes𝒢^t,d,j​\(θ∗′,θ∗′′\)=𝒢^t,d,j​\(θ∗\)\\widehat\{\\mathcal\{G\}\}\_\{t,d,j\}\(\\theta\_\{\*\}^\{\\prime\},\\theta\_\{\*\}^\{\\prime\\prime\}\)=\\widehat\{\\mathcal\{G\}\}\_\{t,d,j\}\(\\theta\_\{\*\}\)\. The conclusion of[Lemma5\.5](https://arxiv.org/html/2608.02478#S5.Thmtheorem5)holds simultaneously for everyθ∈𝔽2ℓ\\theta\\in\\mathbb\{F\}\_\{2\}^\{\\ell\}, and[Lemma5\.7](https://arxiv.org/html/2608.02478#S5.Thmtheorem7)shows the correctness\. The statistical distance in[Lemma5\.4](https://arxiv.org/html/2608.02478#S5.Thmtheorem4)only changes the success probability byexp⁡\(−Ω⁡\(n2\)\)\\exp\(\-\\Omega\(n^2\)\)\.

We analyze the time and space complexity\. Sampling takes2\(max⁡\{1/2,χ\+2​t\}\+o⁡\(1\)\)​n2^\{\(\\max\\\{1/2,\\chi\+2t\\\}\+o\(1\)\)n\}time by[Lemma5\.4](https://arxiv.org/html/2608.02478#S5.Thmtheorem4)\. There are2ℓ−b2^\{\\ell\-b\}sequential iterations\. In each iteration, constructing the array takesNt​poly⁡\(n\)N\_\{t\}\\operatorname\{poly\}\(n\)time, and its Walsh\-Hadamard transform, eigenvector computations, and2b\+12^\{b\+1\}𝖡𝖣𝖣\\mathsf\{BDD\}queries take2b\+o⁡\(n\)2^\{b\+o\(n\)\}time\. SinceNt=2\(2​t\+o⁡\(1\)\)​n<2b\+o⁡\(n\)=20\.5​n\+o⁡\(n\)N\_\{t\}=2^\{\(2t\+o\(1\)\)n\}<2^\{b\+o\(n\)\}=2^\{0\.5n\+o\(n\)\}, their total time is2ℓ\+o⁡\(n\)2^\{\\ell\+o\(n\)\}\. Sinceℓ=\(1−χ\)​n\+O⁡\(1\)\\ell=\(1\-\\chi\)n\+O\(1\)andχ=1/2−t\\chi=1/2\-t, the time exponent ismax⁡\{χ\+2​t,1−χ\}=1/2\+t→0\.7314\\max\\\{\\chi\+2t,1\-\\chi\\\}=1/2\+t\\to 0\.7314fort→t0t\\to t\_\{0\}\. The space complexity is dominated by the number of accepted samples and the preprocessing𝖡𝖣𝖣\\mathsf\{BDD\}data, which is2n/2\+o⁡\(n\)2^\{n/2\+o\(n\)\}\. ∎

## 6Importance Sampling on an Affine Lattice Coset

This section improves the algorithm in[Section5](https://arxiv.org/html/2608.02478#S5)by sampling fromDΛj,ξRD\_\{\\Lambda\_\{j\},\\xi\_\{R\}\}and estimating the Hessian defined using the smaller widthξr\\xi\_\{r\}\.

Fix constants0<r<R0<r<Rwithr<1/4r<1/4and0<χ<1/20<\\chi<1/2\. Leth=⌊χ​n⌋h=\\lfloor\\chi n\\rfloorandℓ=n−h\\ell=n\-has in[Section5\.2](https://arxiv.org/html/2608.02478#S5.SS2)\. Recallg⁡\(t\)=12​log2⁡\(t/t0\)g\(t\)=\\frac\{1\}\{2\}\\log\_\{2\}\(t/t\_\{0\}\)\. We use the parametersRRandrrfor the source and target widths, respectively\.

### 6\.1Lattice points in a shortest parity class

We first study the number of lattice points in the parity classes to improve some inequalities and conditions in some lemmas\. For0<φ<π/20<\\varphi<\\pi/2, define the Kabatiansky\-Levenshtein constant

BKL​\(φ\):=1\+sin⁡φ2​sin⁡φ​log2​1\+sin⁡φ2​sin⁡φ−1−sin⁡φ2​sin⁡φ​log2​1−sin⁡φ2​sin⁡φ\.B\_\{\\rm KL\}\(\\varphi\):=\\frac\{1\+\\sin\\varphi\}\{2\\sin\\varphi\}\\log\_\{2\}\\frac\{1\+\\sin\\varphi\}\{2\\sin\\varphi\}\-\\frac\{1\-\\sin\\varphi\}\{2\\sin\\varphi\}\\log\_\{2\}\\frac\{1\-\\sin\\varphi\}\{2\\sin\\varphi\}\.Note thatβ\\betain[Lemma2\.1](https://arxiv.org/html/2608.02478#S2.Thmtheorem1)is such thatlog2​β=BKL​\(π/3\)\\log\_\{2\}\\beta=B\_\{\\rm KL\}\(\\pi/3\)as shown in\[[35](https://arxiv.org/html/2608.02478#bib.bib20)\]\. We use the following bound\[[20](https://arxiv.org/html/2608.02478#bib.bib24)\]\.

###### Theorem 6\.1\.

Let0<φ<π/20<\\varphi<\\pi/2be fixed\. IfS⊆\{x∈ℝn:‖x‖=1\}S\\subseteq\\\{x\\in\\mathbb\{R\}^\{n\}:\\norm\{x\}=1\\\}and the angle between every two distinct vectors inSSis at leastφ\\varphi, then\|S\|≤2\(BKL​\(φ\)\+o⁡\(1\)\)​n\|S\|\\leq 2^\{\(B\_\{\\rm KL\}\(\\varphi\)\+o\(1\)\)n\}\. Theo⁡\(1\)o\(1\)term is uniform whenφ\\varphiranges over a compact subinterval of\(0,π/2\)\(0,\\pi/2\)\.

The counting argument in the following lemma is a variant of\[[35](https://arxiv.org/html/2608.02478#bib.bib20), Lemma 3\]\. The restriction tov\+2​ℒv\+2\\mathcal\{L\}gives the stronger separation used below\.

###### Lemma 6\.2\.

Letvvbe a shortest vector and putλ=‖v‖\\lambda=\\norm\{v\}\. Everyw∈v\+2​ℒ∖\{±v\}w\\in v\+2\\mathcal\{L\}\\setminus\\\{\\pm v\\\}satisfies‖w‖≥3​λ\\norm\{w\}\\geq\\sqrt\{3\}\\lambda\. Moreover, for every fixedC≥3C\\geq\\sqrt\{3\}, uniformly for3≤x≤C\\sqrt\{3\}\\leq x\\leq C,

\|\{w∈v\+2​ℒ∖\{±v\}:‖w‖≤x​λ\}\|≤2\(BKL​\(arccos⁡\(1−2/x2\)\)\+o⁡\(1\)\)​n\.\\left\|\\left\\\{w\\in v\+2\\mathcal\{L\}\\setminus\\\{\\pm v\\\}:\\norm\{w\}\\leq x\\lambda\\right\\\}\\right\|\\leq 2^\{\(B\_\{\\rm KL\}\(\\arccos\(1\-2/x^2\)\)\+o\(1\)\)n\}\.

###### Proof\.

Writew=2​y−vw=2y\-v\. Ifw≠±vw\\neq\\pm v, thenyyandy−vy\-vare nonzero lattice vectors\. The parallelogram identity gives‖w‖2\+λ2=2​‖y‖2\+2​‖y−v‖2≥4​λ2\\norm\{w\}^\{2\}\+\\lambda^\{2\}=2\\norm\{y\}^\{2\}\+2\\norm\{y\-v\}^\{2\}\\geq 4\\lambda^\{2\}\.

For distinctw,w′∈v\+2​ℒw,w^\{\\prime\}\\in v\+2\\mathcal\{L\}, the vector\(w−w′\)/2\(w\-w^\{\\prime\}\)/2is a nonzero lattice vector, and hence‖w−w′‖≥2​λ\\norm\{w\-w'\}\\geq 2\\lambda\. For each vector with‖w‖≤x​λ\\norm\{w\}\\leq x\\lambda, append the coordinatex2​λ2−‖w‖2\\sqrt\{x^\{2\}\\lambda^\{2\}\-\\norm\{w\}^\{2\}\}\. The resulting vectors inℝn\+1\\mathbb\{R\}^\{n\+1\}have normx​λx\\lambdaand pairwise distance at least2​λ2\\lambda\. After normalization, their pairwise angles are at leastarccos⁡\(1−2/x2\)\\arccos\(1\-2/x^2\)\. The result follows from[Theorem6\.1](https://arxiv.org/html/2608.02478#S6.Thmtheorem1)\. ∎

We improve the bound onρ2​2/ξt​\(ℒ\)≤1\+2\(1−g⁡\(t\)\+o⁡\(1\)\)​n\\rho\_\{2\\sqrt\{2\}/\\xi\_\{t\}\}\(\\mathcal\{L\}\)\\leq 1\+2^\{\(1\-g\(t\)\+o\(1\)\)n\}in[Corollary3\.2](https://arxiv.org/html/2608.02478#S3.Thmtheorem2)\(i\.e\.[Eq\.16](https://arxiv.org/html/2608.02478#S5.E16)\) using a more fine\-grained counting argument with the vectors in each coset modulo2​ℒ2\\mathcal\{L\}\. Forx≥1x\\geq 1, define

K2​\(x\):=\{0,1≤x≤2,BKL​\(arccos⁡\(1−2/x2\)\),x\>2,K\_\{2\}\(x\):=\\begin\{cases\}0,&1\\leq x\\leq\\sqrt\{2\},\\\\ B\_\{\\rm KL\}\(\\arccos\(1\-2/x^2\)\),&x\>\\sqrt\{2\},\\end\{cases\}Combining[Theorem6\.1](https://arxiv.org/html/2608.02478#S6.Thmtheorem1)with[Lemma2\.1](https://arxiv.org/html/2608.02478#S2.Thmtheorem1), the number of nonzero vectors inℒ\\mathcal\{L\}of norm at mostx​λx\\lambdais

Nℒ​\(x​λ1​\(ℒ\)\)≤2\(min⁡\{log2​β\+log2​x,1\+K2​\(x\)\}\+o⁡\(1\)\)​n\.N\_\{\\mathcal\{L\}\}\(x\\lambda\_\{1\}\(\\mathcal\{L\}\)\)\\leq 2^\{\\left\(\\min\\\{\\log\_\{2\}\\beta\+\\log\_\{2\}x,1\+K\_\{2\}\(x\)\\\}\+o\(1\)\\right\)n\}\.
Recallg⁡\(t\)=12​log2⁡\(t/t0\)g\(t\)=\\frac\{1\}\{2\}\\log\_\{2\}\(t/t\_\{0\}\)fort0=0\.23147​…\.t\_\{0\}=0\.23147\\ldots\.Define444The inequality is not obvious\. We sketch the proof forR<1/ln⁡2R<1/\\ln 2which is only relevant to our analysis\. In this case, dropping the second term from the minimum givesg2​\(R\)≥1−supx≥1\(log2​β\+log2​x−R​x2/2\)g\_\{2\}\(R\)\\geq 1\-\\sup\_\{x\\geq 1\}\(\\log\_\{2\}\\beta\+\\log\_\{2\}x\-Rx^\{2\}/2\)\. The supremum is attained atx=1/R​ln⁡2x=1/\\sqrt\{R\\ln 2\}, and the resulting lower bound equalsg⁡\(R\)g\(R\)\.

g2​\(R\):=1−supx≥1\(min⁡\{log2​β\+log2​x,1\+K2​\(x\)\}−R2​x2\)≥g⁡\(R\)\.\\displaystyle g\_\{2\}\(R\):=1\-\\sup\_\{x\\geq 1\}\\left\(\\min\\left\\\{\\log\_\{2\}\\beta\+\\log\_\{2\}x,1\+K\_\{2\}\(x\)\\right\\\}\-\\frac\{R\}\{2\}x^\{2\}\\right\)\\geq g\(R\)\.\(24\)
###### Lemma 6\.3\.

Letλ=λ1​\(ℒ\)≤d≤\(1\+1/n\)​λ\\lambda=\\lambda\_\{1\}\(\\mathcal\{L\}\)\\leq d\\leq\(1\+1/n\)\\lambda\. For every fixedR\>0R\>0,ρ2​2/ξR​\(ℒ∖\{0\}\)≤2\(1−g2​\(R\)\+o⁡\(1\)\)​n\.\\rho\_\{2\\sqrt\{2\}/\\xi\_\{R\}\}\(\\mathcal\{L\}\\setminus\\\{0\\\}\)\\leq 2^\{\(1\-g\_\{2\}\(R\)\+o\(1\)\)n\}\.

Note that the proof of this lemma is rather complicated and somewhat independent to the other arguments\. The readers may use a simpler bound withgg\. All arguments in this section works well by usingggin place ofg2g\_\{2\}, which gives a only slightly bad complexity of20\.6040​n\+o⁡\(n\)2^\{0\.6040n\+o\(n\)\}time and space\. See[Remark6\.10](https://arxiv.org/html/2608.02478#S6.Thmtheorem10)\.

###### Proof\.

We first bound the number of short vectors in one coset modulo2​ℒ2\\mathcal\{L\}\. Fix a cosetC∈ℒ/2​ℒC\\in\\mathcal\{L\}/2\\mathcal\{L\}and put

SC​\(x\):=\{w∈C∖\{0\}:‖w‖≤x​λ\},m:=\|SC​\(x\)\|\.S\_\{C\}\(x\):=\\left\\\{w\\in C\\setminus\\\{0\\\}:\\norm\{w\}\\leq x\\lambda\\right\\\},\\qquad m:=\|S\_\{C\}\(x\)\|\.For everyw∈SC​\(x\)w\\in S\_\{C\}\(x\), defineuw:=1x​λ​\(w,x2​λ2−‖w‖2\)∈ℝn\+1\.u\_\{w\}:=\\frac\{1\}\{x\\lambda\}\\left\(w,\\sqrt\{x^\{2\}\\lambda^\{2\}\-\\norm\{w\}^\{2\}\}\\right\)\\in\\mathbb\{R\}^\{n\+1\}\.Then‖uw‖=1\\norm\{u\_w\}=1\. Ifw,w′∈SC​\(x\)w,w^\{\\prime\}\\in S\_\{C\}\(x\)are distinct, then\(w−w′\)/2\(w\-w^\{\\prime\}\)/2is a nonzero vector inℒ\\mathcal\{L\}, and hence‖w−w′‖≥2​λ\\norm\{w\-w'\}\\geq 2\\lambda\. It follows that

‖uw−uw′‖≥‖w−w′‖x​λ≥2x⟹⟨uw,uw′⟩=1−12​‖uw−uw′‖2≤1−2x2\.\\norm\{u\_w\-u\_\{w'\}\}\\geq\\frac\{\\norm\{w\-w'\}\}\{x\\lambda\}\\geq\\frac\{2\}\{x\}\\quad\\Longrightarrow\\quad\\left\\langle u\_\{w\},u\_\{w^\{\\prime\}\}\\right\\rangle=1\-\\frac\{1\}\{2\}\\norm\{u\_w\-u\_\{w'\}\}^\{2\}\\leq 1\-\\frac\{2\}\{x^\{2\}\}\.
Suppose first that1≤x≤21\\leq x\\leq\\sqrt\{2\}\. Then⟨uw,uw′⟩≤0\\left\\langle u\_\{w\},u\_\{w^\{\\prime\}\}\\right\\rangle\\leq 0for distinctw,w′w,w^\{\\prime\}\. LetG=\(⟨uw,uw′⟩\)w,w′∈SC​\(x\)G=\(\\left\\langle u\_\{w\},u\_\{w^\{\\prime\}\}\\right\\rangle\)\_\{w,w^\{\\prime\}\\in S\_\{C\}\(x\)\}be the Gram matrix of these unit vectors\. Sincerank⁡\(G\)≤n\+1\\operatorname\{rank\}\(G\)\\leq n\+1andtr⁡\(G\)=m\\operatorname\{tr\}\(G\)=m, the Cauchy\-Schwarz inequality for the eigenvalues ofGGgives

‖G‖F2≥tr⁡\(G\)2rank⁡\(G\)≥m2n\+1\.\\left\\lVert G\\right\\rVert\_\{\\mathrm\{F\}\}^\{2\}\\geq\\frac\{\\operatorname\{tr\}\(G\)^\{2\}\}\{\\operatorname\{rank\}\(G\)\}\\geq\\frac\{m^\{2\}\}\{n\+1\}\.On the other hand,−1≤⟨uw,uw′⟩≤0\-1\\leq\\left\\langle u\_\{w\},u\_\{w^\{\\prime\}\}\\right\\rangle\\leq 0forw≠w′w\\neq w^\{\\prime\}, and hence⟨uw,uw′⟩2≤−⟨uw,uw′⟩\\left\\langle u\_\{w\},u\_\{w^\{\\prime\}\}\\right\\rangle^\{2\}\\leq\-\\left\\langle u\_\{w\},u\_\{w^\{\\prime\}\}\\right\\rangle\. Moreover,

0≤‖∑w∈SC​\(x\)uw‖2=m\+∑w,w′∈SC​\(x\)w≠w′⟨uw,uw′⟩\.0\\leq\\norm\{\\sum\_\{w\\in S\_C\(x\)\}u\_w\}^\{2\}=m\+\\sum\_\{\\begin\{subarray\}\{c\}w,w^\{\\prime\}\\in S\_\{C\}\(x\)\\\\ w\\neq w^\{\\prime\}\\end\{subarray\}\}\\left\\langle u\_\{w\},u\_\{w^\{\\prime\}\}\\right\\rangle\.Consequently,

‖G‖F2=m\+∑w,w′∈SC​\(x\)w≠w′⟨uw,uw′⟩2≤m−∑w,w′∈SC​\(x\)w≠w′⟨uw,uw′⟩≤2​m\.\\left\\lVert G\\right\\rVert\_\{\\mathrm\{F\}\}^\{2\}=m\+\\sum\_\{\\begin\{subarray\}\{c\}w,w^\{\\prime\}\\in S\_\{C\}\(x\)\\\\ w\\neq w^\{\\prime\}\\end\{subarray\}\}\\left\\langle u\_\{w\},u\_\{w^\{\\prime\}\}\\right\\rangle^\{2\}\\leq m\-\\sum\_\{\\begin\{subarray\}\{c\}w,w^\{\\prime\}\\in S\_\{C\}\(x\)\\\\ w\\neq w^\{\\prime\}\\end\{subarray\}\}\\left\\langle u\_\{w\},u\_\{w^\{\\prime\}\}\\right\\rangle\\leq 2m\.Combining the two bounds on‖G‖F2\\left\\lVert G\\right\\rVert\_\{\\mathrm\{F\}\}^\{2\}givesm≤2​\(n\+1\)=2o⁡\(n\)m\\leq 2\(n\+1\)=2^\{o\(n\)\}\.

Now considerx\>2x\>\\sqrt\{2\}\. The preceding inner\-product bound shows that the angle between every two distinct vectorsuw,uw′u\_\{w\},u\_\{w^\{\\prime\}\}is at leastarccos⁡\(1−2/x2\)\\arccos\(1\-2/x^2\)\. Applying[Theorem6\.1](https://arxiv.org/html/2608.02478#S6.Thmtheorem1)in dimensionn\+1n\+1gives

\|SC​\(x\)\|≤2\(K2​\(x\)\+o⁡\(1\)\)​n\.\|S\_\{C\}\(x\)\|\\leq 2^\{\(K\_\{2\}\(x\)\+o\(1\)\)n\}\.Combining two cases, each coset modulo2​ℒ2\\mathcal\{L\}contains2\(K2​\(x\)\+o⁡\(1\)\)​n2^\{\(K\_\{2\}\(x\)\+o\(1\)\)n\}vectors of norm≤x​λ\\leq x\\lambdafor every fixedx≥1x\\geq 1\. Summing over2n2^\{n\}cosets modulo2​ℒ2\\mathcal\{L\}, giving2\(1\+K2​\(x\)\+o⁡\(1\)\)​n2^\{\(1\+K\_\{2\}\(x\)\+o\(1\)\)n\}\. Together with[Lemma2\.1](https://arxiv.org/html/2608.02478#S2.Thmtheorem1), we have

Nℒ​\(x​λ\)≤2\(min⁡\{log2​β\+log2​x,1\+K2​\(x\)\}\+o⁡\(1\)\)​n=2A⁡\(x\)​n\+o⁡\(n\)N\_\{\\mathcal\{L\}\}\(x\\lambda\)\\leq 2^\{\\left\(\\min\\\{\\log\_\{2\}\\beta\+\\log\_\{2\}x,1\+K\_\{2\}\(x\)\\\}\+o\(1\)\\right\)n\}=2^\{A\(x\)n\+o\(n\)\}forA⁡\(x\)=min⁡\{log2​β\+log2​x,1\+K2​\(x\)\}A\(x\)=\\min\\\{\\log\_\{2\}\\beta\+\\log\_\{2\}x,1\+K\_\{2\}\(x\)\\\}\. We now estimate the Gaussian mass\. Putxk=\(1\+1/n\)kx\_\{k\}=\(1\+1/n\)^\{k\}andSk:=\{w∈ℒ:xk​λ≤‖w‖<xk\+1​λ\}\.S\_\{k\}:=\\left\\\{w\\in\\mathcal\{L\}:x\_\{k\}\\lambda\\leq\\norm\{w\}<x\_\{k\+1\}\\lambda\\right\\\}\.Usingρ2​2/ξR\(w\)=2−\(R/2\)n‖w‖2/d2,\\rho\_\{2\\sqrt\{2\}/\\xi\_\{R\}\}\(w\)=2^\{\-\(R/2\)n\\norm\{w\}^\{2\}/d^\{2\}\},we have

ρ2​2/ξR​\(ℒ∖\{0\}\)≤∑k≥0Nℒ​\(xk\+1​λ\)​2−\(R/2\)​n​\(λ2/d2\)​xk2\.\\rho\_\{2\\sqrt\{2\}/\\xi\_\{R\}\}\(\\mathcal\{L\}\\setminus\\\{0\\\}\)\\leq\\sum\_\{k\\geq 0\}N\_\{\\mathcal\{L\}\}\(x\_\{k\+1\}\\lambda\)2^\{\-\(R/2\)n\(\\lambda^\{2\}/d^\{2\}\)x\_\{k\}^\{2\}\}\.
Fixδ\>0\\delta\>0and a constantX0\>1X\_\{0\}\>1\. Partition\[1,X0\]\[1,X\_\{0\}\]into finitely many intervals\[a,b\]\[a,b\]such thatR⁡\(b2−a2\)/2≤δR\(b^\{2\}\-a^\{2\}\)/2\\leq\\delta\. For each interval, considerw∈ℒw\\in\\mathcal\{L\}satisfyinga​λ≤‖w‖<b​λa\\lambda\\leq\\norm\{w\}<b\\lambda\. Their number is at most2\(A⁡\(b\)\+o⁡\(1\)\)​n2^\{\(A\(b\)\+o\(1\)\)n\}, while each of their Gaussian weights is at most2−\(R/2\)​n​\(λ2/d2\)​a22^\{\-\(R/2\)n\(\\lambda^\{2\}/d^\{2\}\)a^\{2\}\}\. Hence their total contribution is at most

2\(A⁡\(b\)−R​a2/2\+o⁡\(1\)\)​n≤2\(supx≥1FR​\(x\)\+δ\+o⁡\(1\)\)​n2^\{\\left\(A\(b\)\-Ra^\{2\}/2\+o\(1\)\\right\)n\}\\leq 2^\{\\left\(\\sup\_\{x\\geq 1\}F\_\{R\}\(x\)\+\\delta\+o\(1\)\\right\)n\}whereFR​\(x\):=A⁡\(x\)−R2​x2F\_\{R\}\(x\):=A\(x\)\-\\frac\{R\}\{2\}x^\{2\}\. The last upper bound is independent of the interval, and the number of intervals in the decomposition of\[1,X0\]\[1,X\_\{0\}\]is independent ofnn, so their total contribution satisfies the same bound\.

It remains to considerxk\>X0x\_\{k\}\>X\_\{0\}\. Here we use only[Lemma2\.1](https://arxiv.org/html/2608.02478#S2.Thmtheorem1)\. Apart from its uniform2o⁡\(n\)2^\{o\(n\)\}factor, the upper bound for thekk\-th shell is

Uk:=βn​xk\+1n​2−\(R/2\)​n​\(λ2/d2\)​xk2⟹Uk\+1Uk≤e​2−R⁡\(λ2/d2\)​xk2​\(1\+1/\(2​n\)\)U\_\{k\}:=\\beta^\{n\}x\_\{k\+1\}^\{n\}2^\{\-\(R/2\)n\(\\lambda^\{2\}/d^\{2\}\)x\_\{k\}^\{2\}\}\\quad\\Longrightarrow\\quad\\frac\{U\_\{k\+1\}\}\{U\_\{k\}\}\\leq e\\,2^\{\-R\(\\lambda^\{2\}/d^\{2\}\)x\_\{k\}^\{2\}\(1\+1/\(2n\)\)\}sincexk\+1=\(1\+1/n\)​xkx\_\{k\+1\}=\(1\+1/n\)x\_\{k\}\. ChooseX0X\_\{0\}sufficiently so large that this ratio is at most1/21/2for all sufficiently largennand simultaneously the first such shell is bounded by2\(supx≥1FR​\(x\)\+δ\+o⁡\(1\)\)​n2^\{\(\\sup\_\{x\\geq 1\}F\_\{R\}\(x\)\+\\delta\+o\(1\)\)n\}, which is possible becauselog2​β\+log2​x−R​x2/2\\log\_\{2\}\\beta\+\\log\_\{2\}x\-Rx^\{2\}/2tends to−∞\-\\inftyasx→∞x\\to\\infty\. The bounds for the remaining shells form a geometric series and hence have the same total upper bound\.

Lettingδ\\deltatend to zero gives

ρ2​2/ξR​\(ℒ∖\{0\}\)≤2\(supx≥1FR​\(x\)\+o⁡\(1\)\)​n=2\(1−g2​\(R\)\+o⁡\(1\)\)​n,\\rho\_\{2\\sqrt\{2\}/\\xi\_\{R\}\}\(\\mathcal\{L\}\\setminus\\\{0\\\}\)\\leq 2^\{\(\\sup\_\{x\\geq 1\}F\_\{R\}\(x\)\+o\(1\)\)n\}=2^\{\(1\-g\_\{2\}\(R\)\+o\(1\)\)n\},where the last equality follows from[Eq\.24](https://arxiv.org/html/2608.02478#S6.E24)\. ∎

The following lemma shows a spectral phenomena for the Hessian, or more precisely its translated version𝒜\\mathcal\{A\}in[Eq\.11](https://arxiv.org/html/2608.02478#S3.E11), similar to[Lemma3\.4](https://arxiv.org/html/2608.02478#S3.Thmtheorem4)even ifr<t0=0\.23147​…r<t\_\{0\}=0\.23147\\ldots\. We choose the lower bound9/50=0\.189/50=0\.18only to ensure

supx≥3\{BKL​\(arccos⁡\(1−2/x2\)\)−r⁡\(x2−1\)\}<−110,\\displaystyle\\sup\_\{x\\geq\\sqrt\{3\}\}\\left\\\{B\_\{\\rm KL\}\(\\arccos\(1\-2/x^2\)\)\-r\(x^\{2\}\-1\)\\right\\\}<\-\\frac\{1\}\{10\},\(25\)which follows by standard calculus\. Also note thatBKL​\(arccos⁡\(1−2/x2\)\)B\_\{\\rm KL\}\(\\arccos\(1\-2/x^2\)\)is Lipschitz in the interval\[3,7\]\[\\sqrt\{3\},7\]\. We defineμr,d=2​π2​ξr4​λ2ρ1/ξr​\(ℒ\)e−πξr2λ2/4\\mu\_\{r,d\}=\\frac\{2\\pi^\{2\}\\xi\_\{r\}^\{4\}\\lambda^\{2\}\}\{\\rho\_\{1/\\xi\_\{r\}\}\(\\mathcal\{L\}\)\}e^\{\-\\pi\\xi\_\{r\}^\{2\}\\lambda^\{2\}/4\}for anyrr\.

###### Lemma 6\.4\.

Letλ=λ1​\(ℒ\)≤d≤\(1\+1/n\)​λ\\lambda=\\lambda\_\{1\}\(\\mathcal\{L\}\)\\leq d\\leq\(1\+1/n\)\\lambda\. Letv∈ℒv\\in\\mathcal\{L\}satisfy‖v‖=λ\\norm\{v\}=\\lambda, letu∈𝔽2nu\\in\\mathbb\{F\}\_\{2\}^\{n\}satisfyv∈B​u\+2​ℒv\\in Bu\+2\\mathcal\{L\}, and putv^=v/λ\\widehat\{v\}=v/\\lambda\. Ifr≥9/50r\\geq 9/50, then

‖𝒜r,d​\(u\)−μr,d​v^​v^T‖F≤μr,d​2−Ω⁡\(n\)\.\\left\\lVert\\mathcal\{A\}\_\{r,d\}\(u\)\-\\mu\_\{r,d\}\\widehat\{v\}\\widehat\{v\}^\{T\}\\right\\rVert\_\{\\mathrm\{F\}\}\\leq\\mu\_\{r,d\}2^\{\-\\Omega\(n\)\}\.

###### Proof\.

The termsw=±vw=\\pm vin[Eq\.11](https://arxiv.org/html/2608.02478#S3.E11)giveμr,d​v^​v^T\\mu\_\{r,d\}\\widehat\{v\}\\widehat\{v\}^\{T\}\. The sum of the other terms is positive semidefinite, so its Frobenius norm is at most its trace\. Consequently,

‖𝒜r,d​\(u\)−μr,d​v^​v^T‖Fμr,d≤12​∑w∈v\+2​ℒw≠±v\(‖w‖λ\)2​2−r​n​\(λ2/d2\)​\(\(‖w‖/λ\)2−1\)\.\\frac\{\\left\\lVert\\mathcal\{A\}\_\{r,d\}\(u\)\-\\mu\_\{r,d\}\\widehat\{v\}\\widehat\{v\}^\{T\}\\right\\rVert\_\{\\mathrm\{F\}\}\}\{\\mu\_\{r,d\}\}\\leq\\frac\{1\}\{2\}\\sum\_\{\\begin\{subarray\}\{c\}w\\in v\+2\\mathcal\{L\}\\\\ w\\neq\\pm v\\end\{subarray\}\}\\left\(\\frac\{\\norm\{w\}\}\{\\lambda\}\\right\)^\{2\}2^\{\-rn\(\\lambda^\{2\}/d^\{2\}\)\(\(\{\\norm\{w\}\}/\\lambda\)^\{2\}\-1\)\}\.
Putxk:=3​\(1\+1/n\)kx\_\{k\}:=\\sqrt\{3\}\(1\+1/n\)^\{k\}and letSk:=\{w∈v\+2​ℒ∖\{±v\}:xk≤‖w‖λ<xk\+1\}\.S\_\{k\}:=\\left\\\{w\\in v\+2\\mathcal\{L\}\\setminus\\\{\\pm v\\\}:x\_\{k\}\\leq\\frac\{\\norm\{w\}\}\{\\lambda\}<x\_\{k\+1\}\\right\\\}\.Then

12​∑w∈v\+2​ℒw≠±v\(‖w‖λ\)2​2−r​n​\(λ2/d2\)​\(\(‖w‖/λ\)2−1\)≤12​∑k≥0\|Sk\|​xk\+12​2−r​n​\(λ2/d2\)​\(xk2−1\)\.\\frac\{1\}\{2\}\\sum\_\{\\begin\{subarray\}\{c\}w\\in v\+2\\mathcal\{L\}\\\\ w\\neq\\pm v\\end\{subarray\}\}\\left\(\\frac\{\\norm\{w\}\}\{\\lambda\}\\right\)^\{2\}2^\{\-rn\(\\lambda^\{2\}/d^\{2\}\)\(\(\{\\norm\{w\}\}/\\lambda\)^\{2\}\-1\)\}\\leq\\frac\{1\}\{2\}\\sum\_\{k\\geq 0\}\|S\_\{k\}\|x\_\{k\+1\}^\{2\}2^\{\-rn\(\\lambda^\{2\}/d^\{2\}\)\(x\_\{k\}^\{2\}\-1\)\}\.We will show that the summations forxk<7x\_\{k\}<7andxk≥7x\_\{k\}\\geq 7both are bounded above by2−Ω⁡\(n\)\.2^\{\-\\Omega\(n\)\}\.

First, ifxk<7x\_\{k\}<7,[Lemma6\.2](https://arxiv.org/html/2608.02478#S6.Thmtheorem2)gives the bound

1n​log2⁡\(\|Sk\|​xk\+12​2−r​n​\(λ2/d2\)​\(xk2−1\)\)≤\(BKL​\(arccos⁡\(1−2/xk\+12\)\)\+o⁡\(1\)\)−r​λ2​\(xk2−1\)d2\\frac\{1\}\{n\}\\log\_\{2\}\\left\(\|S\_\{k\}\|x\_\{k\+1\}^\{2\}2^\{\-rn\(\\lambda^\{2\}/d^\{2\}\)\(x\_\{k\}^\{2\}\-1\)\}\\right\)\\leq\(B\_\{\\rm KL\}\(\\arccos\(1\-2/x\_\{k\+1\}^2\)\)\+o\(1\)\)\-\\frac\{r\\lambda^\{2\}\(x\_\{k\}^\{2\}\-1\)\}\{d^\{2\}\}and using the fact thatBKL​\(arccos⁡\(1−2/x2\)\)B\_\{\\rm KL\}\(\\arccos\(1\-2/x^2\)\)is Lipschitz,xk\+1=xk\+xk/n=xk\+O⁡\(1/n\)x\_\{k\+1\}=x\_\{k\}\+x\_\{k\}/n=x\_\{k\}\+O\(1/n\)forxk<7x\_\{k\}<7, andd/λ=1\+O⁡\(1/n\)d/\\lambda=1\+O\(1/n\)gives an upper bound

BKL​\(arccos⁡\(1−2/xk2\)\)−r⁡\(xk2−1\)\+o⁡\(1\)≤−17\+o⁡\(1\)B\_\{\\rm KL\}\(\\arccos\(1\-2/x\_k^2\)\)\-r\(x\_\{k\}^\{2\}\-1\)\+o\(1\)\\leq\-\\frac\{1\}\{7\}\+o\(1\)where we use[Eq\.25](https://arxiv.org/html/2608.02478#S6.E25), proving12\|Sk\|xk\+122−r​n​\(λ2/d2\)​\(xk2−1\)≤2\(−1/7\+o\(1\)\)n\.\\frac\{1\}\{2\}\|S\_\{k\}\|x\_\{k\+1\}^\{2\}2^\{\-rn\(\\lambda^\{2\}/d^\{2\}\)\(x\_\{k\}^\{2\}\-1\)\}\\leq 2^\{\(\-1/7\+o\(1\)\)n\}\.Since there are at mostO⁡\(n\)O\(n\)kk’s such thatxk<7x\_\{k\}<7, it gives the desire bound for the first summand overxk<7x\_\{k\}<7\.

Now considerxk≥7x\_\{k\}\\geq 7\. Sinced≤\(1\+1/n\)​λd\\leq\(1\+1/n\)\\lambda,r​λ2/d2≥1/6r\\lambda^\{2\}/d^\{2\}\\geq 1/6for sufficiently largen\.n\.[Lemma2\.1](https://arxiv.org/html/2608.02478#S2.Thmtheorem1)on\|Sk\|\|S\_\{k\}\|gives

1n​log2⁡\(\|Sk\|​2−r​n​\(λ2/d2\)​\(xk2−1\)\)≤log2​β\+log2​xk\+1−xk2−16\+o⁡\(1\)\\frac\{1\}\{n\}\\log\_\{2\}\\left\(\|S\_\{k\}\|2^\{\-rn\(\\lambda^\{2\}/d^\{2\}\)\(x\_\{k\}^\{2\}\-1\)\}\\right\)\\leq\\log\_\{2\}\\beta\+\\log\_\{2\}x\_\{k\+1\}\-\\frac\{x\_\{k\}^\{2\}\-1\}\{6\}\+o\(1\)Sincexk\+1=\(1\+1/n\)​xk≤2​xkx\_\{k\+1\}=\(1\+1/n\)x\_\{k\}\\leq 2x\_\{k\}, the exponent is at most

log2​β\+log2⁡\(2​xk\)−16​\(xk2−1\)\+o⁡\(1\)≤−xk214\+o⁡\(1\)\\log\_\{2\}\\beta\+\\log\_\{2\}\(2x\_\{k\}\)\-\\frac\{1\}\{6\}\(x\_\{k\}^\{2\}\-1\)\+o\(1\)\\leq\-\\frac\{x\_\{k\}^\{2\}\}\{14\}\+o\(1\)which holds forxk≥7\.x\_\{k\}\\geq 7\.Applying this inequality withx=xkx=x\_\{k\}proves

12\|Sk\|xk\+122−r​n​\(λ2/d2\)​\(xk2−1\)≤xk\+1222−nxk2/14\+o\(n\)\.\\frac\{1\}\{2\}\|S\_\{k\}\|x\_\{k\+1\}^\{2\}2^\{\-rn\(\\lambda^\{2\}/d^\{2\}\)\(x\_\{k\}^\{2\}\-1\)\}\\leq\\frac\{x\_\{k\+1\}^\{2\}\}\{2\}2^\{\-nx\_\{k\}^\{2\}/14\+o\(n\)\}\.This term \(ignoring the uniformo⁡\(1\)o\(1\)factor\) decays \(super\-\)exponentially fast,555In particular, forxk≥7x\_\{k\}\\geq 7,\(xk\+222−nxk\+12/14\)/\(xk\+122−nxk2/14\)=\(1\+1/n\)22−nxk\+12\(2/n−1/n2\)/14≤1/2\(x\_\{k\+2\}^\{2\}2^\{\-nx\_\{k\+1\}^\{2\}/14\}\)/\(x\_\{k\+1\}^\{2\}2^\{\-nx\_\{k\}^\{2\}/14\}\)=\(1\+1/n\)^\{2\}2^\{\-nx\_\{k\+1\}^\{2\}\(2/n\-1/n^\{2\}\)/14\}\\leq 1/2holds\.thus the asymptotic bound of the summation of the above term forkksuch thatxk≥7x\_\{k\}\\geq 7becomes2−Ω⁡\(n\)2^\{\-\\Omega\(n\)\}\. ∎

### 6\.2Sampling \(wider\) discrete Gaussian from an affine lattice coset

This section shows that sampling from the discrete GaussianDΛj,ξRD\_\{\\Lambda\_\{j\},\\xi\_\{R\}\}for a largeξR\\xi\_\{R\}is more efficient than the one in[Lemma5\.4](https://arxiv.org/html/2608.02478#S5.Thmtheorem4)by removing the multiplicative factor2χ2^\{\\chi\}in the time complexity\.

For the fixedddandRR, recall thatξR=4​n​R​ln⁡2/\(π​d2\)\\xi\_\{R\}=\\sqrt\{4nR\\ln 2/\(\\pi d^\{2\}\)\}\. ForP∈GLn⁡\(𝔽2\)P\\in\\GL\_\{n\}\(\\mathbb\{F\}\_\{2\}\)andj∈𝔽2hj\\in\\mathbb\{F\}\_\{2\}^\{h\}, recall from[Section5\.2](https://arxiv.org/html/2608.02478#S5.SS2)thatΛj:=\{X∈ℒ∗:JP​\(X\)=j\}\.\\Lambda\_\{j\}:=\\\{X\\in\\mathcal\{L\}^\{\*\}:J\_\{P\}\(X\)=j\\\}\.In particular,Λ0\\Lambda\_\{0\}is a sublattice ofℒ∗\\mathcal\{L\}^\{\*\}andΛj\\Lambda\_\{j\}is a coset ofΛ0\\Lambda\_\{0\}\. The following lemma shows some Gaussian mass bound from[Corollary3\.2](https://arxiv.org/html/2608.02478#S3.Thmtheorem2)works forΛ0\\Lambda\_\{0\}in expectation\.

###### Lemma 6\.5\.

Letλ=λ1​\(ℒ\)\\lambda=\\lambda\_\{1\}\(\\mathcal\{L\}\)andλ≤d≤\(1\+1/n\)​λ\\lambda\\leq d\\leq\(1\+1/n\)\\lambda\. IfR\>t0R\>t\_\{0\}andχ<g2​\(R\)\\chi<g\_\{2\}\(R\), thenρ2/ξR​\(Λ0∗∖\{0\}\)≤2−Ω⁡\(n\)\\rho\_\{\\sqrt\{2\}/\\xi\_\{R\}\}\(\\Lambda\_\{0\}^\{\*\}\\setminus\\\{0\\\}\)\\leq 2^\{\-\\Omega\(n\)\}with probability1−2−Ω⁡\(n\)1\-2^\{\-\\Omega\(n\)\}over uniformP∈GLn⁡\(𝔽2\)P\\in\\GL\_\{n\}\(\\mathbb\{F\}\_\{2\}\)\. Consequently,ξR\>2​η1/2​\(Λ0\)\\xi\_\{R\}\>\\sqrt\{2\}\\,\\eta\_\{1/2\}\(\\Lambda\_\{0\}\)\.

###### Proof\.

Let𝒦P=P−1​\(𝔽2h×\{0\}\)\\mathcal\{K\}\_\{P\}=P^\{\-1\}\(\\mathbb\{F\}\_\{2\}^\{h\}\\times\\\{0\\\}\)\. We first observe thatΛ0∗=ℒ\+B​𝒦P/2\\Lambda\_\{0\}^\{\*\}=\\mathcal\{L\}\+B\\mathcal\{K\}\_\{P\}/2\. For every nonzeroκ∈𝔽2n\\kappa\\in\\mathbb\{F\}\_\{2\}^\{n\}, it is easy to see thatℙP\[κ∈𝒦P\]=\(2h−1\)/\(2n−1\)\\mathbb\{P\}\_\{P\}\[\\kappa\\in\\mathcal\{K\}\_\{P\}\]=\(2^\{h\}\-1\)/\(2^\{n\}\-1\)\. Since the cosetsℒ\+B​κ/2\\mathcal\{L\}\+B\\kappa/2forκ∈𝔽2n\\kappa\\in\\mathbb\{F\}\_\{2\}^\{n\}partitionℒ/2\\mathcal\{L\}/2, we have

𝔼P​ρ2/ξR​\(Λ0∗∖\{0\}\)\\displaystyle\\mathbb\{E\}\_\{P\}\\rho\_\{\\sqrt\{2\}/\\xi\_\{R\}\}\(\\Lambda\_\{0\}^\{\*\}\\setminus\\\{0\\\}\)≤ρ2/ξR​\(ℒ∖\{0\}\)\+2h−n\+o⁡\(n\)​\(ρ2​2/ξR​\(ℒ\)−ρ2/ξR​\(ℒ\)\)\\displaystyle\\leq\\rho\_\{\\sqrt\{2\}/\\xi\_\{R\}\}\(\\mathcal\{L\}\\setminus\\\{0\\\}\)\+2^\{h\-n\+o\(n\)\}\\left\(\\rho\_\{2\\sqrt\{2\}/\\xi\_\{R\}\}\(\\mathcal\{L\}\)\-\\rho\_\{\\sqrt\{2\}/\\xi\_\{R\}\}\(\\mathcal\{L\}\)\\right\)≤2\(−g⁡\(R\)\+o⁡\(1\)\)​n\+2\(χ−g2​\(R\)\+o⁡\(1\)\)​n\.\\displaystyle\\leq 2^\{\(\-g\(R\)\+o\(1\)\)n\}\+2^\{\(\\chi\-g\_\{2\}\(R\)\+o\(1\)\)n\}\.The last inequality follows from[Eq\.16](https://arxiv.org/html/2608.02478#S5.E16)withc=0c=0and[Lemma6\.3](https://arxiv.org/html/2608.02478#S6.Thmtheorem3)\. Sinceχ<g2​\(R\)\\chi<g\_\{2\}\(R\)andR\>t0R\>t\_\{0\}, Markov’s inequality in[Lemma2\.9](https://arxiv.org/html/2608.02478#S2.Thmtheorem9)givesρ2/ξR​\(Λ0∗∖\{0\}\)=2−Ω⁡\(n\)<1/2\\rho\_\{\\sqrt\{2\}/\\xi\_\{R\}\}\(\\Lambda\_\{0\}^\{\*\}\\setminus\\\{0\\\}\)=2^\{\-\\Omega\(n\)\}<1/2except with probability2−Ω⁡\(n\)2^\{\-\\Omega\(n\)\}\. The last claim follows from the definition and monotonicity of the smoothing parameter\. ∎

Given this lemma, we can apply[Theorem2\.7](https://arxiv.org/html/2608.02478#S2.Thmtheorem7)to sample the discrete Gaussian onΛj\\Lambda\_\{j\}\. More precisely, we defineΓ:=Λ0\+ℤ​x=Λ0⊔Λj\\Gamma:=\\Lambda\_\{0\}\+\\mathbb\{Z\}x=\\Lambda\_\{0\}\\sqcup\\Lambda\_\{j\}forj≠0j\\neq 0andx∈Λjx\\in\\Lambda\_\{j\}, and run the algorithm from[Theorem2\.7](https://arxiv.org/html/2608.02478#S2.Thmtheorem7)onΓ\\Gamma\. Collecting the samples inΛj\\Lambda\_\{j\}works well\. This gives the following lemma\.

###### Lemma 6\.6\.

Letλ=λ1​\(ℒ\)\\lambda=\\lambda\_\{1\}\(\\mathcal\{L\}\),λ≤d≤\(1\+1/n\)​λ\\lambda\\leq d\\leq\(1\+1/n\)\\lambda,χ<g2​\(R\)\\chi<g\_\{2\}\(R\),R\>t0R\>t\_\{0\}, andM=2O⁡\(n\)M=2^\{O\(n\)\}\. With probability1−2−Ω⁡\(n\)1\-2^\{\-\\Omega\(n\)\}over uniformP∈GLn⁡\(𝔽2\)P\\in\\GL\_\{n\}\(\\mathbb\{F\}\_\{2\}\), the following holds for everyj∈𝔽2hj\\in\\mathbb\{F\}\_\{2\}^\{h\}\. There is an algorithm that outputsMMvectors or aborts, and its abort probability is at most2−Ω⁡\(n\)2^\{\-\\Omega\(n\)\}\. If it does not abort, the joint distribution of its outputs has statistical distance at mostexp⁡\(−Ω⁡\(n2\)\)\\exp\(\-\\Omega\(n^2\)\)fromDΛj,ξRMD\_\{\\Lambda\_\{j\},\\xi\_\{R\}\}^\{M\}\. The algorithm takes time\(M\+2n/2\)​2o⁡\(n\)\(M\+2^\{n/2\}\)2^\{o\(n\)\}and space2n/2\+o⁡\(n\)2^\{n/2\+o\(n\)\}\.

###### Proof\.

Note thatρ2/ξR​\(Λ0∗∖\{0\}\)≤2−Ω⁡\(n\)\\rho\_\{\\sqrt\{2\}/\\xi\_\{R\}\}\\left\(\\Lambda\_\{0\}^\{\*\}\\setminus\\\{0\\\}\\right\)\\leq 2^\{\-\\Omega\(n\)\}andξR\>2​η1/2​\(Λ0\)\\xi\_\{R\}\>\\sqrt\{2\}\\,\\eta\_\{1/2\}\(\\Lambda\_\{0\}\)holds except with probability2−Ω⁡\(n\)2^\{\-\\Omega\(n\)\}overPPbecause of[Lemma6\.5](https://arxiv.org/html/2608.02478#S6.Thmtheorem5)\. Fix any suchPP\.

Forj=0j=0, we can directly use[Theorem2\.7](https://arxiv.org/html/2608.02478#S2.Thmtheorem7)⌈M/2n/2⌉\\lceil M/2^\{n/2\}\\rceiltimes toΛ0\\Lambda\_\{0\}with parameterξR\\xi\_\{R\}andκ=n2\\kappa=n^\{2\}\. Suppose thatj≠0j\\neq 0\. Solve the linear equationsJP​\(x\)=jJ\_\{P\}\(x\)=jover𝔽2\\mathbb\{F\}\_\{2\}and lift a solution to obtainx∈ℒ∗x\\in\\mathcal\{L\}^\{\*\}satisfyingx∈Λjx\\in\\Lambda\_\{j\}\. LetΓ:=Λ0\+ℤ​x=Λ0⊔Λj\.\\Gamma:=\\Lambda\_\{0\}\+\\mathbb\{Z\}x=\\Lambda\_\{0\}\\sqcup\\Lambda\_\{j\}\.SinceΓ∗⊆Λ0∗\\Gamma^\{\*\}\\subseteq\\Lambda\_\{0\}^\{\*\}, we haveρ2/ξR​\(Γ∗∖\{0\}\)≤2−Ω⁡\(n\),\\rho\_\{\\sqrt\{2\}/\\xi\_\{R\}\}\\left\(\\Gamma^\{\*\}\\setminus\\\{0\\\}\\right\)\\leq 2^\{\-\\Omega\(n\)\},and henceξR\>2​η1/2​\(Γ\)\\xi\_\{R\}\>\\sqrt\{2\}\\,\\eta\_\{1/2\}\(\\Gamma\)for largenn\.

Choose arbitraryy∈Λ0∗∖Γ∗y\\in\\Lambda\_\{0\}^\{\*\}\\setminus\\Gamma^\{\*\}\. Poisson summation formula gives

\|𝔼X∼DΓ,ξR​e2​π​i​⟨X,y⟩\|=ρ1/ξR​\(Γ∗−y\)ρ1/ξR​\(Γ∗\)≤ρ2/ξR​\(Λ0∗∖\{0\}\)=2−Ω⁡\(n\)\.\\left\|\\mathbb\{E\}\_\{X\\sim D\_\{\\Gamma,\\xi\_\{R\}\}\}e^\{2\\pi i\\left\\langle X,y\\right\\rangle\}\\right\|=\\frac\{\\rho\_\{1/\\xi\_\{R\}\}\(\\Gamma^\{\*\}\-y\)\}\{\\rho\_\{1/\\xi\_\{R\}\}\(\\Gamma^\{\*\}\)\}\\leq\\rho\_\{\\sqrt\{2\}/\\xi\_\{R\}\}\\left\(\\Lambda\_\{0\}^\{\*\}\\setminus\\\{0\\\}\\right\)=2^\{\-\\Omega\(n\)\}\.The charactere2​π​i​⟨X,y⟩e^\{2\\pi i\\left\\langle X,y\\right\\rangle\}equals11for everyX∈Λ0X\\in\\Lambda\_\{0\}\. Moreover,2​x∈Λ02x\\in\\Lambda\_\{0\}, whiley∉Γ∗y\\notin\\Gamma^\{\*\}, so⟨x,y⟩∈ℤ\+1/2\\left\\langle x,y\\right\\rangle\\in\\mathbb\{Z\}\+1/2\. Hence the character equals−1\-1for everyX∈x\+Λ0=ΛjX\\in x\+\\Lambda\_\{0\}=\\Lambda\_\{j\}\. The above inequality gives\|1−2​p\|≤2−Ω⁡\(n\)\|1\-2p\|\\leq 2^\{\-\\Omega\(n\)\}, wherep=ℙX∼DΓ,ξR\[X∈Λj\]p=\\mathbb\{P\}\_\{X\\sim D\_\{\\Gamma,\\xi\_\{R\}\}\}\[X\\in\\Lambda\_\{j\}\]\. It follows thatp=1/2\+O⁡\(2−Ω⁡\(n\)\)p=1/2\+O\(2^\{\-\\Omega\(n\)\}\)\.

We obtain the following sampling algorithm: Use[Theorem2\.7](https://arxiv.org/html/2608.02478#S2.Thmtheorem7)onΓ\\Gammato generate4​\(M\+n\)4\(M\+n\)candidates, with parameterξR\\xi\_\{R\}andκ=n2\\kappa=n^\{2\}\. Collect the firstMMcandidates inΛj\\Lambda\_\{j\}and abort if fewer thanMMare obtained\. The Chernoff bound in[Lemma2\.12](https://arxiv.org/html/2608.02478#S2.Thmtheorem12)gives abort probability2−Ω⁡\(n\)2^\{\-\\Omega\(n\)\}\.

For exact samples fromDΓ,ξRD\_\{\\Gamma,\\xi\_\{R\}\}, conditioning onX∈ΛjX\\in\\Lambda\_\{j\}gives exactlyDΛj,ξRD\_\{\\Lambda\_\{j\},\\xi\_\{R\}\}\. There are at most2O⁡\(n\)2^\{O\(n\)\}calls to[Theorem2\.7](https://arxiv.org/html/2608.02478#S2.Thmtheorem7), so their total statistical distance is stillexp⁡\(−Ω⁡\(n2\)\)\\exp\(\-\\Omega\(n^2\)\)\. Applying the collection algorithm does not increase statistical distance, and conditioning on its non\-abort event changes it by at most a factor1\+2−Ω⁡\(n\)1\+2^\{\-\\Omega\(n\)\}\. Finally, the calls can be made sequentially, giving time\(M\+2n/2\)​2o⁡\(n\)\(M\+2^\{n/2\}\)2^\{o\(n\)\}and space2n/2\+o⁡\(n\)2^\{n/2\+o\(n\)\}\. ∎

### 6\.3Estimating the Hessian by importance sampling

Importance sampling estimates an expectation under a target distribution using samples from another distribution\. Here we sample fromDΛj,ξRD\_\{\\Lambda\_\{j\},\\xi\_\{R\}\}for largeξR\\xi\_\{R\}and estimate the Hessian defined usingDΛj,ξrD\_\{\\Lambda\_\{j\},\\xi\_\{r\}\}for the smaller targetξr\\xi\_\{r\}\. ForX∈ΛjX\\in\\Lambda\_\{j\}, letw⁡\(X\):=ρξr​\(X\)/ρξR​\(X\)w\(X\):=\\rho\_\{\\xi\_\{r\}\}\(X\)/\\rho\_\{\\xi\_\{R\}\}\(X\)andw¯j:=𝔼X∼DΛj,ξR​\[w⁡\(X\)\]=ρξr​\(Λj\)/ρξR​\(Λj\)\\overline\{w\}\_\{j\}:=\\mathbb\{E\}\_\{X\\sim D\_\{\\Lambda\_\{j\},\\xi\_\{R\}\}\}\[w\(X\)\]=\\rho\_\{\\xi\_\{r\}\}\(\\Lambda\_\{j\}\)/\\rho\_\{\\xi\_\{R\}\}\(\\Lambda\_\{j\}\)\. For every matrix\-valued functionHHfor which the expectations exist,

𝔼X∼DΛj,ξR​\[w⁡\(X\)​H​\(X\)\]=∑X∈ΛjρξR​\(X\)ρξR​\(Λj\)​ρξr​\(X\)ρξR​\(X\)​H​\(X\)=w¯j​𝔼X∼DΛj,ξr​\[H⁡\(X\)\]\.\\displaystyle\\mathbb\{E\}\_\{X\\sim D\_\{\\Lambda\_\{j\},\\xi\_\{R\}\}\}\[w\(X\)H\(X\)\]=\\sum\_\{X\\in\\Lambda\_\{j\}\}\\frac\{\\rho\_\{\\xi\_\{R\}\}\(X\)\}\{\\rho\_\{\\xi\_\{R\}\}\(\\Lambda\_\{j\}\)\}\\frac\{\\rho\_\{\\xi\_\{r\}\}\(X\)\}\{\\rho\_\{\\xi\_\{R\}\}\(X\)\}H\(X\)=\\overline\{w\}\_\{j\}\\mathbb\{E\}\_\{X\\sim D\_\{\\Lambda\_\{j\},\\xi\_\{r\}\}\}\[H\(X\)\]\.\(26\)Thus the weighted expectation isw¯j​𝒢r,d,j​\(θ\)\\overline\{w\}\_\{j\}\\mathcal\{G\}\_\{r,d,j\}\(\\theta\)whenH⁡\(X\)=−4​π2​X​XT​\(−1\)θ⋅VP​\(X\)H\(X\)=\-4\\pi^\{2\}XX^\{T\}\(\-1\)^\{\\theta\\cdot V\_\{P\}\(X\)\}\.

LetMMbe the number of sample to be determined later\. Considernnindependent families\{Xa,1,…,Xa,M\}\\\{X\_\{a,1\},\\ldots,X\_\{a,M\}\\\}of samples fromDΛj,ξRD\_\{\\Lambda\_\{j\},\\xi\_\{R\}\}fora∈\[n\]a\\in\[n\]\. Define the importance\-sampling Hessian estimator

𝒩^a,j​\(θ\)\\displaystyle\\widehat\{\\mathcal\{N\}\}\_\{a,j\}\(\\theta\):=−4​π2M∑i=1Mw\(Xa,i\)Xa,iXa,iT\(−1\)θ⋅VP​\(Xa,i\)𝟏\{‖Xa,i‖≤C1ξRn\}\.\\displaystyle:=\-\\frac\{4\\pi^\{2\}\}\{M\}\\sum\_\{i=1\}^\{M\}w\(X\_\{a,i\}\)X\_\{a,i\}X\_\{a,i\}^\{T\}\(\-1\)^\{\\theta\\cdot V\_\{P\}\(X\_\{a,i\}\)\}\\mathbf\{1\}\_\{\\\{\\norm\{X\_\{a,i\}\}\\leq C\_\{1\}\\xi\_\{R\}\\sqrt\{n\}\\\}\}\.\(27\)Forp,q∈\[n\]p,q\\in\[n\], define the\(p,q\)\(p,q\)\-entry of𝒩^j​\(θ\)\\widehat\{\\mathcal\{N\}\}\_\{j\}\(\\theta\)to be the median \(i\.e\.,\(⌊n/2⌋\+1\)\(\\lfloor n/2\\rfloor\+1\)\-st smallest\) among the corresponding entries of𝒩^1,j​\(θ\),…,𝒩^n,j​\(θ\)\\widehat\{\\mathcal\{N\}\}\_\{1,j\}\(\\theta\),\\ldots,\\widehat\{\\mathcal\{N\}\}\_\{n,j\}\(\\theta\)\. We will show the median estimator𝒩^j​\(θ\)\\widehat\{\\mathcal\{N\}\}\_\{j\}\(\\theta\)approximatesw¯j​𝒢r,d,j​\(θ\)\\overline\{w\}\_\{j\}\\mathcal\{G\}\_\{r,d,j\}\(\\theta\)well for uniform randomPPandjj\.

We need some notations\. Defines\>0s\>0by1/s=2/r−1/R1/s=2/r\-1/R\. Then

1ξs2=2ξr2−1ξR2,ρξr​\(X\)2ρξR​\(X\)=ρξs​\(X\),s=r​R2​R−r<r<R\.\\displaystyle\\frac\{1\}\{\\xi\_\{s\}^\{2\}\}=\\frac\{2\}\{\\xi\_\{r\}^\{2\}\}\-\\frac\{1\}\{\\xi\_\{R\}^\{2\}\},\\qquad\\frac\{\\rho\_\{\\xi\_\{r\}\}\(X\)^\{2\}\}\{\\rho\_\{\\xi\_\{R\}\}\(X\)\}=\\rho\_\{\\xi\_\{s\}\}\(X\),\\qquad s=\\frac\{rR\}\{2R\-r\}<r<R\.\(28\)
We also recallμ\\mufrom[Eq\.12](https://arxiv.org/html/2608.02478#S3.E12), and choose the number of samplesMMusingι\\iotadefined below:

μr,d=2​π2​ξr4​λ2ρ1/ξr​\(ℒ\)e−πξr2λ2/4,M=⌈n62\(ι⁡\(r,R\)\+2​r\)​n⌉forι\(r,R\)\\displaystyle\\mu\_\{r,d\}=\\frac\{2\\pi^\{2\}\\xi\_\{r\}^\{4\}\\lambda^\{2\}\}\{\\rho\_\{1/\\xi\_\{r\}\}\(\\mathcal\{L\}\)\}e^\{\-\\pi\\xi\_\{r\}^\{2\}\\lambda^\{2\}/4\},\\qquad M=\\lceil n^\{6\}2^\{\(\\iota\(r,R\)\+2r\)n\}\\rceil\\quad\\text\{for\}\\quad\\iota\(r,R\):=12​log2​R2r⁡\(2​R−r\)\\displaystyle:=\\frac\{1\}\{2\}\\log\_\{2\}\\frac\{R^\{2\}\}\{r\(2R\-r\)\}\(29\)whereμr,d=Θ⁡\(ξr4​λ2​2−r​n\)\\mu\_\{r,d\}=\\Theta\(\\xi\_\{r\}^\{4\}\\lambda^\{2\}2^\{\-rn\}\)ifλ≤d≤\(1\+1/n\)​λ\\lambda\\leq d\\leq\(1\+1/n\)\\lambdaands\>t0/2s\>t\_\{0\}/2\.

###### Lemma 6\.7\.

Letλ=λ1​\(ℒ\)\\lambda=\\lambda\_\{1\}\(\\mathcal\{L\}\)andλ≤d≤\(1\+1/n\)​λ\\lambda\\leq d\\leq\(1\+1/n\)\\lambda\. Ifs\>t0/2s\>t\_\{0\}/2andχ<1/2\+g⁡\(r\)\\chi<1/2\+g\(r\), then, the following hold with probability1−O⁡\(n−1\)1\-O\(n^\{\-1\}\)over uniform randomP∈GLn⁡\(𝔽2\)P\\in\\GL\_\{n\}\(\\mathbb\{F\}\_\{2\}\)andj∈𝔽2hj\\in\\mathbb\{F\}\_\{2\}^\{h\}:

ζr,j≥12,w¯j=\(rR\)n/2​\(1\+O⁡\(2−Ω⁡\(n\)\)\),𝔼X∼DΛj,ξR​\[w​\(X\)2\]w¯j2≤2​n​2ι⁡\(r,R\)​n\.\\zeta\_\{r,j\}\\geq\\frac\{1\}\{2\},\\qquad\\overline\{w\}\_\{j\}=\\left\(\\frac\{r\}\{R\}\\right\)^\{n/2\}\\left\(1\+O\(2^\{\-\\Omega\(n\)\}\)\\right\),\\qquad\\frac\{\\mathbb\{E\}\_\{X\\sim D\_\{\\Lambda\_\{j\},\\xi\_\{R\}\}\}\[w\(X\)^\{2\}\]\}\{\\overline\{w\}\_\{j\}^\{2\}\}\\leq 2n2^\{\\iota\(r,R\)n\}\.

###### Proof\.

Sinces\>t0/2s\>t\_\{0\}/2ands<r<Rs<r<R,[Corollary3\.2](https://arxiv.org/html/2608.02478#S3.Thmtheorem2)givesρ1/ξs​\(ℒ\),ρ1/ξr​\(ℒ\),ρ1/ξR​\(ℒ\)=1\+2−Ω⁡\(n\)\\rho\_\{1/\\xi\_\{s\}\}\(\\mathcal\{L\}\),\\rho\_\{1/\\xi\_\{r\}\}\(\\mathcal\{L\}\),\\rho\_\{1/\\xi\_\{R\}\}\(\\mathcal\{L\}\)=1\+2^\{\-\\Omega\(n\)\}\. Sinceggis increasing,[Lemma5\.3](https://arxiv.org/html/2608.02478#S5.Thmtheorem3)givesζr,j,ζR,j=1\+O⁡\(2−Ω⁡\(n\)\)\\zeta\_\{r,j\},\\zeta\_\{R,j\}=1\+O\(2^\{\-\\Omega\(n\)\}\)simultaneously for everyjj, except with probability2−Ω⁡\(n\)2^\{\-\\Omega\(n\)\}overPP\. In particular,ζr,j≥1/2\\zeta\_\{r,j\}\\geq 1/2for all sufficiently largenn\.

By the definitions ofw¯j\\overline\{w\}\_\{j\}andζt,j\\zeta\_\{t,j\}, and by applying the Poisson summation formula toℒ∗\\mathcal\{L\}^\{\*\}, we have

w¯j=ζr,jζR,j​ρξr​\(ℒ∗\)ρξR​\(ℒ∗\)=\(rR\)n/2​ρ1/ξr​\(ℒ\)ρ1/ξR​\(ℒ\)​ζr,jζR,j=\(rR\)n/2​\(1\+O⁡\(2−Ω⁡\(n\)\)\)\\overline\{w\}\_\{j\}=\\frac\{\\zeta\_\{r,j\}\}\{\\zeta\_\{R,j\}\}\\frac\{\\rho\_\{\\xi\_\{r\}\}\(\\mathcal\{L\}^\{\*\}\)\}\{\\rho\_\{\\xi\_\{R\}\}\(\\mathcal\{L\}^\{\*\}\)\}=\\left\(\\frac\{r\}\{R\}\\right\)^\{n/2\}\\frac\{\\rho\_\{1/\\xi\_\{r\}\}\(\\mathcal\{L\}\)\}\{\\rho\_\{1/\\xi\_\{R\}\}\(\\mathcal\{L\}\)\}\\frac\{\\zeta\_\{r,j\}\}\{\\zeta\_\{R,j\}\}=\\left\(\\frac\{r\}\{R\}\\right\)^\{n/2\}\\left\(1\+O\(2^\{\-\\Omega\(n\)\}\)\\right\)where we use the approximations ofρ\\rhoandζ\\zetaabove\. This proves the estimate ofw¯j\\overline\{w\}\_\{j\}in the statement\.

Fix a choice ofPPsatisfying the preceding conclusions\. Since2−h​∑jζs,j=12^\{\-h\}\\sum\_\{j\}\\zeta\_\{s,j\}=1andζR,j/ζr,j2=1\+2−Ω⁡\(n\)\\zeta\_\{R,j\}/\\zeta\_\{r,j\}^\{2\}=1\+2^\{\-\\Omega\(n\)\}uniformly injj, the expectation over uniformjjofζs,j​ζR,j/ζr,j2\\zeta\_\{s,j\}\\zeta\_\{R,j\}/\\zeta\_\{r,j\}^\{2\}is1\+2−Ω⁡\(n\)1\+2^\{\-\\Omega\(n\)\}\. Markov’s inequality gives

ζs,j​ζR,jζr,j2≤n\\frac\{\\zeta\_\{s,j\}\\zeta\_\{R,j\}\}\{\\zeta\_\{r,j\}^\{2\}\}\\leq nexcept with probabilityO⁡\(n−1\)O\(n^\{\-1\}\)over uniformjj\.

The definitions ofw⁡\(X\)w\(X\)andDΛj,ξRD\_\{\\Lambda\_\{j\},\\xi\_\{R\}\}, together with[Eq\.28](https://arxiv.org/html/2608.02478#S6.E28), give

𝔼X∼DΛj,ξR​\[w​\(X\)2\]=1ρξR​\(Λj\)​∑X∈Λjρξr​\(X\)2ρξR​\(X\)=ρξs​\(Λj\)ρξR​\(Λj\)\.\\mathbb\{E\}\_\{X\\sim D\_\{\\Lambda\_\{j\},\\xi\_\{R\}\}\}\[w\(X\)^\{2\}\]=\\frac\{1\}\{\\rho\_\{\\xi\_\{R\}\}\(\\Lambda\_\{j\}\)\}\\sum\_\{X\\in\\Lambda\_\{j\}\}\\frac\{\\rho\_\{\\xi\_\{r\}\}\(X\)^\{2\}\}\{\\rho\_\{\\xi\_\{R\}\}\(X\)\}=\\frac\{\\rho\_\{\\xi\_\{s\}\}\(\\Lambda\_\{j\}\)\}\{\\rho\_\{\\xi\_\{R\}\}\(\\Lambda\_\{j\}\)\}\.
Also,w¯j=ρξr​\(Λj\)/ρξR​\(Λj\)\\overline\{w\}\_\{j\}=\\rho\_\{\\xi\_\{r\}\}\(\\Lambda\_\{j\}\)/\\rho\_\{\\xi\_\{R\}\}\(\\Lambda\_\{j\}\)\. Consequently, we can compute𝔼X∼DΛj,ξR​\[w​\(X\)2\]/w¯j2\{\\mathbb\{E\}\_\{X\\sim D\_\{\\Lambda\_\{j\},\\xi\_\{R\}\}\}\[w\(X\)^\{2\}\]\}/\{\\overline\{w\}\_\{j\}^\{2\}\}as follows:

ρξs​\(Λj\)​ρξR​\(Λj\)ρξr​\(Λj\)2=ρξs​\(ℒ∗\)​ρξR​\(ℒ∗\)ρξr​\(ℒ∗\)2​ζs,j​ζR,jζr,j2=\(s​Rr2\)n/2​ρ1/ξs​\(ℒ\)​ρ1/ξR​\(ℒ\)ρ1/ξr​\(ℒ\)2​ζs,j​ζR,jζr,j2\.\\frac\{\\rho\_\{\\xi\_\{s\}\}\(\\Lambda\_\{j\}\)\\rho\_\{\\xi\_\{R\}\}\(\\Lambda\_\{j\}\)\}\{\\rho\_\{\\xi\_\{r\}\}\(\\Lambda\_\{j\}\)^\{2\}\}=\\frac\{\\rho\_\{\\xi\_\{s\}\}\(\\mathcal\{L\}^\{\*\}\)\\rho\_\{\\xi\_\{R\}\}\(\\mathcal\{L\}^\{\*\}\)\}\{\\rho\_\{\\xi\_\{r\}\}\(\\mathcal\{L\}^\{\*\}\)^\{2\}\}\\frac\{\\zeta\_\{s,j\}\\zeta\_\{R,j\}\}\{\\zeta\_\{r,j\}^\{2\}\}=\\left\(\\frac\{sR\}\{r^\{2\}\}\\right\)^\{n/2\}\\frac\{\\rho\_\{1/\\xi\_\{s\}\}\(\\mathcal\{L\}\)\\rho\_\{1/\\xi\_\{R\}\}\(\\mathcal\{L\}\)\}\{\\rho\_\{1/\\xi\_\{r\}\}\(\\mathcal\{L\}\)^\{2\}\}\\frac\{\\zeta\_\{s,j\}\\zeta\_\{R,j\}\}\{\\zeta\_\{r,j\}^\{2\}\}\.Here the first equality follows by writingρξt​\(Λj\)=2−h​ζt,j​ρξt​\(ℒ∗\)\\rho\_\{\\xi\_\{t\}\}\(\\Lambda\_\{j\}\)=2^\{\-h\}\\zeta\_\{t,j\}\\rho\_\{\\xi\_\{t\}\}\(\\mathcal\{L\}^\{\*\}\), and the second equality is obtained by applying Poisson summation toℒ∗\\mathcal\{L\}^\{\*\}\. Pluggings=r​R/\(2​R−r\)s=rR/\(2R\-r\)andR/r⁡\(2​R−r\)=2ι⁡\(r,R\)R/\\sqrt\{r\(2R\-r\)\}=2^\{\\iota\(r,R\)\}gives the multiplicative factor2ι⁡\(r,R\)​n2^\{\\iota\(r,R\)n\}\. The last two factors are at most22andnn, respectively, for all sufficiently largenn\. This proves the result\. ∎

###### Lemma 6\.8\.

Letλ=λ1​\(ℒ\)\\lambda=\\lambda\_\{1\}\(\\mathcal\{L\}\)andλ≤d≤\(1\+1/n\)​λ\\lambda\\leq d\\leq\(1\+1/n\)\\lambda\. Ifs\>t0/2s\>t\_\{0\}/2andχ<1/2\+g⁡\(r\)\\chi<1/2\+g\(r\), then it holds simultaneously for everyθ∈𝔽2ℓ\\theta\\in\\mathbb\{F\}\_\{2\}^\{\\ell\}:

maxθ∈𝔽2ℓ⁡‖𝒩^j​\(θ\)−w¯j​𝒢r,d,j​\(θ\)‖op=O⁡\(w¯j​μr,dn\)\\max\_\{\\theta\\in\\mathbb\{F\}\_\{2\}^\{\\ell\}\}\\left\\lVert\\widehat\{\\mathcal\{N\}\}\_\{j\}\(\\theta\)\-\\overline\{w\}\_\{j\}\\mathcal\{G\}\_\{r,d,j\}\(\\theta\)\\right\\rVert\_\{\\mathrm\{op\}\}=O\\left\(\\frac\{\\overline\{w\}\_\{j\}\\mu\_\{r,d\}\}\{n\}\\right\)with probability1−O⁡\(n−1\)1\-O\(n^\{\-1\}\)overP,jP,j, and the choices ofXa,iX\_\{a,i\}\.

###### Proof\.

Suppose that the conclusions of[Lemma6\.7](https://arxiv.org/html/2608.02478#S6.Thmtheorem7)hold, and fix the corresponding pairP,jP,j\. For everyaa, the expectation of𝒩^a,j​\(θ\)\\widehat\{\\mathcal\{N\}\}\_\{a,j\}\(\\theta\)is independent ofaa\. From[Eqs\.27](https://arxiv.org/html/2608.02478#S6.E27)and[26](https://arxiv.org/html/2608.02478#S6.E26), we have

𝔼\[𝒩^a,j\(θ\)\]=−4π2w¯j𝔼X∼DΛj,ξr\[XXT\(−1\)θ⋅VP​\(X\)𝟏\{‖X‖≤C1ξRn\}\]\.\\mathbb\{E\}\[\\widehat\{\\mathcal\{N\}\}\_\{a,j\}\(\\theta\)\]=\-4\\pi^\{2\}\\overline\{w\}\_\{j\}\\mathbb\{E\}\_\{X\\sim D\_\{\\Lambda\_\{j\},\\xi\_\{r\}\}\}\\left\[XX^\{T\}\(\-1\)^\{\\theta\\cdot V\_\{P\}\(X\)\}\\mathbf\{1\}\_\{\\\{\\norm\{X\}\\leq C\_\{1\}\\xi\_\{R\}\\sqrt\{n\}\\\}\}\\right\]\.Consequently,

𝒩^j​\(θ\)−w¯j​𝒢r,d,j​\(θ\)\\displaystyle\\widehat\{\\mathcal\{N\}\}\_\{j\}\(\\theta\)\-\\overline\{w\}\_\{j\}\\mathcal\{G\}\_\{r,d,j\}\(\\theta\)=\(𝒩^j\(θ\)−𝔼\[𝒩^a,j\(θ\)\]\)\+4π2w¯j𝔼X∼DΛj,ξr\[XXT\(−1\)θ⋅VP​\(X\)𝟏\{‖X‖\>C1ξRn\}\]\.\\displaystyle=\\left\(\\widehat\{\\mathcal\{N\}\}\_\{j\}\(\\theta\)\-\\mathbb\{E\}\[\\widehat\{\\mathcal\{N\}\}\_\{a,j\}\(\\theta\)\]\\right\)\+4\\pi^\{2\}\\overline\{w\}\_\{j\}\\mathbb\{E\}\_\{X\\sim D\_\{\\Lambda\_\{j\},\\xi\_\{r\}\}\}\\left\[XX^\{T\}\(\-1\)^\{\\theta\\cdot V\_\{P\}\(X\)\}\\mathbf\{1\}\_\{\\\{\\norm\{X\}\>C\_\{1\}\\xi\_\{R\}\\sqrt\{n\}\\\}\}\\right\]\.We bound the two terms separately\.

We first bound the first term by applying Chebyshev’s inequality to each entry\. Fixa,θa,\\thetaand the entry indicesp,qp,q\. Write\(𝒩^a,j​\(θ\)\)p,q=M−1​∑i=1MYi\(\\widehat\{\\mathcal\{N\}\}\_\{a,j\}\(\\theta\)\)\_\{p,q\}=M^\{\-1\}\\sum\_\{i=1\}^\{M\}Y\_\{i\}by defining

Yi:=−4π2w\(Xa,i\)\(Xa,i\)p\(Xa,i\)q\(−1\)θ⋅VP​\(Xa,i\)𝟏\{‖Xa,i‖≤C1ξRn\}\.Y\_\{i\}:=\-4\\pi^\{2\}w\(X\_\{a,i\}\)\(X\_\{a,i\}\)\_\{p\}\(X\_\{a,i\}\)\_\{q\}\(\-1\)^\{\\theta\\cdot V\_\{P\}\(X\_\{a,i\}\)\}\\mathbf\{1\}\_\{\\\{\\norm\{X\_\{a,i\}\}\\leq C\_\{1\}\\xi\_\{R\}\\sqrt\{n\}\\\}\}\.This gives the following upper bound

𝔼⁡\[\(𝒩^a,j​\(θ\)−𝔼⁡\[𝒩^a,j​\(θ\)\]\)p,q2\]=1M2​∑i=1M𝔼⁡\[\(Yi−𝔼⁡\[Yi\]\)2\]≤1M​𝔼​\[Y12\]\.\\mathbb\{E\}\\left\[\\left\(\\widehat\{\\mathcal\{N\}\}\_\{a,j\}\(\\theta\)\-\\mathbb\{E\}\[\\widehat\{\\mathcal\{N\}\}\_\{a,j\}\(\\theta\)\]\\right\)\_\{p,q\}^\{2\}\\right\]=\\frac\{1\}\{M^\{2\}\}\\sum\_\{i=1\}^\{M\}\\mathbb\{E\}\\left\[\(Y\_\{i\}\-\\mathbb\{E\}\[Y\_\{i\}\]\)^\{2\}\\right\]\\leq\\frac\{1\}\{M\}\\mathbb\{E\}\[Y\_\{1\}^\{2\}\]\.where the cross terms betweenYi−𝔼⁡\[Yi\]Y\_\{i\}\-\\mathbb\{E\}\[Y\_\{i\}\]andYk−𝔼⁡\[Yk\]Y\_\{k\}\-\\mathbb\{E\}\[Y\_\{k\}\]vanish fori≠ki\\neq ksince theYiY\_\{i\}are independent\. Consequently,

𝔼\[\(𝒩^a,j\(θ\)−𝔼\[𝒩^a,j\(θ\)\]\)p,q2\]≤1M𝔼X∼DΛj,ξR\[w\(X\)2\(4π2XpXq\)2𝟏\{‖X‖≤C1ξRn\}\]\.\\mathbb\{E\}\\left\[\\left\(\\widehat\{\\mathcal\{N\}\}\_\{a,j\}\(\\theta\)\-\\mathbb\{E\}\[\\widehat\{\\mathcal\{N\}\}\_\{a,j\}\(\\theta\)\]\\right\)\_\{p,q\}^\{2\}\\right\]\\leq\\frac\{1\}\{M\}\\mathbb\{E\}\_\{X\\sim D\_\{\\Lambda\_\{j\},\\xi\_\{R\}\}\}\\left\[w\(X\)^\{2\}\(4\\pi^\{2\}X\_\{p\}X\_\{q\}\)^\{2\}\\mathbf\{1\}\_\{\\\{\\norm\{X\}\\leq C\_\{1\}\\xi\_\{R\}\\sqrt\{n\}\\\}\}\\right\]\.When the indicator is nonzero,\(4​π2​Xp​Xq\)2=O⁡\(ξR4​n2\)=O⁡\(ξr8​λ4\)\(4\\pi^\{2\}X\_\{p\}X\_\{q\}\)^\{2\}=O\(\\xi\_\{R\}^\{4\}n^\{2\}\)=O\(\\xi\_\{r\}^\{8\}\\lambda^\{4\}\)\. Hence

𝔼⁡\[\(𝒩^a,j​\(θ\)−𝔼⁡\[𝒩^a,j​\(θ\)\]\)p,q2\]=O⁡\(ξr8​λ4M​𝔼X∼DΛj,ξR​\[w​\(X\)2\]\)=O⁡\(n​w¯j2​ξr8​λ4​2ι⁡\(r,R\)​nM\)=O⁡\(w¯j2​μr,d2n5\)\\mathbb\{E\}\\left\[\\left\(\\widehat\{\\mathcal\{N\}\}\_\{a,j\}\(\\theta\)\-\\mathbb\{E\}\[\\widehat\{\\mathcal\{N\}\}\_\{a,j\}\(\\theta\)\]\\right\)\_\{p,q\}^\{2\}\\right\]=O\\left\(\\frac\{\\xi\_\{r\}^\{8\}\\lambda^\{4\}\}\{M\}\\mathbb\{E\}\_\{X\\sim D\_\{\\Lambda\_\{j\},\\xi\_\{R\}\}\}\[w\(X\)^\{2\}\]\\right\)=O\\left\(\\frac\{n\\overline\{w\}\_\{j\}^\{2\}\\xi\_\{r\}^\{8\}\\lambda^\{4\}2^\{\\iota\(r,R\)n\}\}\{M\}\\right\)=O\\left\(\\frac\{\\overline\{w\}\_\{j\}^\{2\}\\mu\_\{r,d\}^\{2\}\}\{n^\{5\}\}\\right\)where we use𝔼⁡\[w​\(X\)2\]≤2​n​w¯j2​2ι⁡\(r,R\)​n\\mathbb\{E\}\[w\(X\)^\{2\}\]\\leq 2n\\overline\{w\}\_\{j\}^\{2\}2^\{\\iota\(r,R\)n\}from[Lemma6\.7](https://arxiv.org/html/2608.02478#S6.Thmtheorem7)and the definition ofμr,d\\mu\_\{r,d\}andMMfrom[Eq\.29](https://arxiv.org/html/2608.02478#S6.E29)\.

Chebyshev’s inequality now gives

ℙ\[\|\(𝒩^a,j\(θ\)−𝔼\[𝒩^a,j\(θ\)\]\)p,q\|\>w¯j​μr,dn2\]=O\(n−1\)\.\\mathbb\{P\}\\left\[\\left\|\\left\(\\widehat\{\\mathcal\{N\}\}\_\{a,j\}\(\\theta\)\-\\mathbb\{E\}\[\\widehat\{\\mathcal\{N\}\}\_\{a,j\}\(\\theta\)\]\\right\)\_\{p,q\}\\right\|\>\\frac\{\\overline\{w\}\_\{j\}\\mu\_\{r,d\}\}\{n^\{2\}\}\\right\]=O\(n^\{\-1\}\)\.Thus each of thennindependent estimates of the\(p,q\)\(p,q\)\-entry has the required accuracy with probability1−O⁡\(n−1\)1\-O\(n^\{\-1\}\)\. If more than half of them have this accuracy, then their median has the same accuracy\. By[Lemma2\.13](https://arxiv.org/html/2608.02478#S2.Thmtheorem13), the probability that the median does not have this accuracy is2−Ω⁡\(n​log⁡n\)2^\{\-\\Omega\(n\\log n\)\}\. A union bound overθ∈𝔽2ℓ\\theta\\in\\mathbb\{F\}\_\{2\}^\{\\ell\}andp,q∈\[n\]p,q\\in\[n\], together with‖A‖op≤n​maxp,q​\|Ap,q\|\\left\\lVert A\\right\\rVert\_\{\\mathrm\{op\}\}\\leq n\\max\_\{p,q\}\|A\_\{p,q\}\|, therefore gives

maxθ∈𝔽2ℓ⁡‖𝒩^j​\(θ\)−𝔼⁡\[𝒩^a,j​\(θ\)\]‖op=O⁡\(w¯j​μr,dn\)\\max\_\{\\theta\\in\\mathbb\{F\}\_\{2\}^\{\\ell\}\}\\left\\lVert\\widehat\{\\mathcal\{N\}\}\_\{j\}\(\\theta\)\-\\mathbb\{E\}\[\\widehat\{\\mathcal\{N\}\}\_\{a,j\}\(\\theta\)\]\\right\\rVert\_\{\\mathrm\{op\}\}=O\\left\(\\frac\{\\overline\{w\}\_\{j\}\\mu\_\{r,d\}\}\{n\}\\right\)except with probability2−Ω⁡\(n​log⁡n\)2^\{\-\\Omega\(n\\log n\)\}\.

It remains to bound the second term\. Sinceζr,j≥1/2\\zeta\_\{r,j\}\\geq 1/2and its definitionζr,j=2h​ρξr​\(Λj\)/ρξr​\(ℒ∗\)\\zeta\_\{r,j\}=2^\{h\}\\rho\_\{\\xi\_\{r\}\}\(\\Lambda\_\{j\}\)/\\rho\_\{\\xi\_\{r\}\}\(\\mathcal\{L\}^\{\*\}\), we haveρξr​\(Λj\)≥2−h−1​ρξr​\(ℒ∗\)\\rho\_\{\\xi\_\{r\}\}\(\\Lambda\_\{j\}\)\\geq 2^\{\-h\-1\}\\rho\_\{\\xi\_\{r\}\}\(\\mathcal\{L\}^\{\*\}\)\. SinceξR\>ξr\\xi\_\{R\}\>\\xi\_\{r\},[Lemma2\.8](https://arxiv.org/html/2608.02478#S2.Thmtheorem8)shows that the operator norm of the second term in the decomposition is at most4​π2​w¯j​2h\+1​ξr2​n​2−n4\\pi^\{2\}\\overline\{w\}\_\{j\}2^\{h\+1\}\\xi\_\{r\}^\{2\}n2^\{\-n\}\. Dividing this bound byw¯j​μr,d/n\\overline\{w\}\_\{j\}\\mu\_\{r,d\}/ngives an upper boundO⁡\(n​2h−\(1−r\)​n\)=2−Ω⁡\(n\)O\(n2^\{h\-\(1\-r\)n\}\)=2^\{\-\\Omega\(n\)\}, becauseh≤n/2h\\leq n/2andr<1/4r<1/4\. Therefore, the second term is much smaller:

4π2w¯j‖𝔼X∼DΛj,ξr\[XXT\(−1\)θ⋅VP​\(X\)𝟏\{‖X‖\>C1ξRn\}\]‖op=o\(w¯jμr,d/n\)\.4\\pi^\{2\}\\overline\{w\}\_\{j\}\\left\\lVert\\mathbb\{E\}\_\{X\\sim D\_\{\\Lambda\_\{j\},\\xi\_\{r\}\}\}\\left\[XX^\{T\}\(\-1\)^\{\\theta\\cdot V\_\{P\}\(X\)\}\\mathbf\{1\}\_\{\\\{\\norm\{X\}\>C\_\{1\}\\xi\_\{R\}\\sqrt\{n\}\\\}\}\\right\]\\right\\rVert\_\{\\mathrm\{op\}\}=o\(\\overline\{w\}\_\{j\}\\mu\_\{r,d\}/n\)\.
Combining the two terms proves the lemma\. The total failure probability is the summand ofO⁡\(n−1\)O\(n^\{\-1\}\)from[Lemma6\.7](https://arxiv.org/html/2608.02478#S6.Thmtheorem7)and the additional failure probability2−Ω⁡\(n​log⁡n\)2^\{\-\\Omega\(n\\log n\)\}\. ∎

### 6\.4Recovering a shortest vector

The following lemma is almost identical to[Lemma5\.7](https://arxiv.org/html/2608.02478#S5.Thmtheorem7), except that we have a normalizing factorw¯j\\overline\{w\}\_\{j\}and we use[Lemma6\.4](https://arxiv.org/html/2608.02478#S6.Thmtheorem4)instead of[Lemma3\.4](https://arxiv.org/html/2608.02478#S3.Thmtheorem4)\.

###### Lemma 6\.9\.

Letλ=λ1​\(ℒ\)≤d≤\(1\+1/n\)​λ\\lambda=\\lambda\_\{1\}\(\\mathcal\{L\}\)\\leq d\\leq\(1\+1/n\)\\lambda\. Letv∈ℒv\\in\\mathcal\{L\}satisfy‖v‖=λ\\norm\{v\}=\\lambda, and letu∗∈𝔽2nu\_\{\*\}\\in\\mathbb\{F\}\_\{2\}^\{n\}satisfyv∈B​u∗\+2​ℒv\\in Bu\_\{\*\}\+2\\mathcal\{L\}\. Choose independent uniformP∈GLn⁡\(𝔽2\)P\\in\\GL\_\{n\}\(\\mathbb\{F\}\_\{2\}\)andj∈𝔽2hj\\in\\mathbb\{F\}\_\{2\}^\{h\}, and writeP​u∗=\(α∗,θ∗\)Pu\_\{\*\}=\(\\alpha\_\{\*\},\\theta\_\{\*\}\)\. Assume thatr≥9/50r\\geq 9/50,χ<1/2\+g⁡\(r\)\\chi<1/2\+g\(r\),χ−1−min⁡\{g⁡\(r\),2​g​\(r\)\}\+2​r<0\\chi\-1\-\\min\\\{g\(r\),2g\(r\)\\\}\+2r<0and that the conclusion of[Lemma6\.8](https://arxiv.org/html/2608.02478#S6.Thmtheorem8)holds\. The following holds with probability1−O⁡\(n−1\)1\-O\(n^\{\-1\}\)overPPandjj: Letq\+q\_\{\+\}andq−q\_\{\-\}be unit eigenvectors corresponding to the largest and smallest eigenvalues of𝒩^j​\(θ∗\)\\widehat\{\\mathcal\{N\}\}\_\{j\}\(\\theta\_\{\*\}\), respectively\. Then there ares∈\{\+,−\}s\\in\\\{\+,\-\\\}andτ∈\{−1,1\}\\tau\\in\\\{\-1,1\\\}such that

‖qs−τ​v/λ‖=O\(n−1/2\)\.\\norm\{q\_s\-\\tau v/\\lambda\}=O\(n^\{\-1/2\}\)\.Consequently, then−1/3n^\{\-1/3\}\-𝖡𝖣𝖣\\mathsf\{BDD\}query atd​qsdq\_\{s\}returnsτ​v\\tau vfor all sufficiently largenn\.

###### Proof\.

Putv^=v/λ\\widehat\{v\}=v/\\lambdaandσ=\(−1\)α∗⋅j\\sigma=\(\-1\)^\{\\alpha\_\{\*\}\\cdot j\}\. By[Lemma6\.4](https://arxiv.org/html/2608.02478#S6.Thmtheorem4),𝒜r,d​\(u∗\)=μr,d​v^​v^T\+ℛ\\mathcal\{A\}\_\{r,d\}\(u\_\{\*\}\)=\\mu\_\{r,d\}\\widehat\{v\}\\widehat\{v\}^\{T\}\+\\mathcal\{R\}, where‖ℛ‖F≤μr,d​2−Ω⁡\(n\)\\left\\lVert\\mathcal\{R\}\\right\\rVert\_\{\\mathrm\{F\}\}\\leq\\mu\_\{r,d\}2^\{\-\\Omega\(n\)\}\. LetSP,j:=∑α≠α∗\(−1\)j⋅\(α−α∗\)​𝒜r,d​\(P−1​\(α,θ∗\)\)S\_\{P,j\}:=\\sum\_\{\\alpha\\neq\\alpha\_\{\*\}\}\(\-1\)^\{j\\cdot\(\\alpha\-\\alpha\_\{\*\}\)\}\\mathcal\{A\}\_\{r,d\}\(P^\{\-1\}\(\\alpha,\\theta\_\{\*\}\)\)\. The calculation in the proof of[Lemma5\.7](https://arxiv.org/html/2608.02478#S5.Thmtheorem7), withttreplaced byrr, together with[Lemma5\.2](https://arxiv.org/html/2608.02478#S5.Thmtheorem2), gives

𝔼P,j​‖SP,j‖F2≤μr,d2​2\(χ−1−min⁡\{g⁡\(r\),2​g​\(r\)\}\+2​r\+o⁡\(1\)\)​n\.\\mathbb\{E\}\_\{P,j\}\\left\\lVert S\_\{P,j\}\\right\\rVert\_\{\\mathrm\{F\}\}^\{2\}\\leq\\mu\_\{r,d\}^\{2\}2^\{\(\\chi\-1\-\\min\\\{g\(r\),2g\(r\)\\\}\+2r\+o\(1\)\)n\}\.The exponent is negative by assumption\. Hence Markov’s inequality gives‖SP,j‖F≤μr,d​2−Ω⁡\(n\)\\left\\lVert S\_\{P,j\}\\right\\rVert\_\{\\mathrm\{F\}\}\\leq\\mu\_\{r,d\}2^\{\-\\Omega\(n\)\}, except with probability2−Ω⁡\(n\)2^\{\-\\Omega\(n\)\}overP,jP,j\.

By[Lemma5\.3](https://arxiv.org/html/2608.02478#S5.Thmtheorem3),ζr,j=1\+O⁡\(2−Ω⁡\(n\)\)\\zeta\_\{r,j\}=1\+O\(2^\{\-\\Omega\(n\)\}\), except with probability2−Ω⁡\(n\)2^\{\-\\Omega\(n\)\}overPP\. Applying[Lemma5\.6](https://arxiv.org/html/2608.02478#S5.Thmtheorem6)and substituting the expressions for𝒜r,d​\(u∗\)\\mathcal\{A\}\_\{r,d\}\(u\_\{\*\}\)andSP,jS\_\{P,j\}, and then applying[Lemma6\.8](https://arxiv.org/html/2608.02478#S6.Thmtheorem8), gives, for somea∈ℝa\\in\\mathbb\{R\},

σ​𝒩^j​\(θ∗\)=a​In\+w¯j​μr,dζr,j​v^​v^T\+E,‖E‖op=O⁡\(w¯j​μr,dn\)\.\\sigma\\widehat\{\\mathcal\{N\}\}\_\{j\}\(\\theta\_\{\*\}\)=aI\_\{n\}\+\\frac\{\\overline\{w\}\_\{j\}\\mu\_\{r,d\}\}\{\\zeta\_\{r,j\}\}\\widehat\{v\}\\widehat\{v\}^\{T\}\+E,\\qquad\\left\\lVert E\\right\\rVert\_\{\\mathrm\{op\}\}=O\\left\(\\frac\{\\overline\{w\}\_\{j\}\\mu\_\{r,d\}\}\{n\}\\right\)\.
Ifσ=1\\sigma=1, letq=q\+q=q\_\{\+\}, and otherwise letq=q−q=q\_\{\-\}\. The remainder proof is identical to[Lemma5\.7](https://arxiv.org/html/2608.02478#S5.Thmtheorem7)except that we usew¯j​μr,d/ζr,j\\overline\{w\}\_\{j\}\\mu\_\{r,d\}/\\zeta\_\{r,j\}instead ofμt,d/ζt,j\\mu\_\{t,d\}/\\zeta\_\{t,j\}\. ∎

### 6\.5The importance\-sampling algorithm

This section presents the algorithm using importance sampling\. The time complexity is determined by the2\(ι⁡\(r,R\)\+2​r\)​n\+o⁡\(n\)2^\{\(\\iota\(r,R\)\+2r\)n\+o\(n\)\}samples used in[Lemma6\.8](https://arxiv.org/html/2608.02478#S6.Thmtheorem8)and the2ℓ\+o⁡\(n\)=2\(1−χ\)​n\+o⁡\(n\)2^\{\\ell\+o\(n\)\}=2^\{\(1\-\\chi\)n\+o\(n\)\}matrices, e\.g\.,𝒩^j​\(θ\)\\widehat\{\\mathcal\{N\}\}\_\{j\}\(\\theta\), indexed byθ∈𝔽2ℓ\\theta\\in\\mathbb\{F\}\_\{2\}^\{\\ell\}\. The space complexity is determined by the samples and these matrices\.

We choose the following parameters

r=0\.2222355,R=0\.400613,χ=0\.3961331,r=0\.2222355,\\qquad R=0\.400613,\\qquad\\chi=0\.3961331,which givess=r​R2​R−r=0\.1537683785​…s=\\frac\{rR\}\{2R\-r\}=0\.1537683785\\ldotsandι⁡\(r,R\)=12​log2​R2r⁡\(2​R−r\)=0\.1593947534​…\\iota\(r,R\)=\\frac\{1\}\{2\}\\log\_\{2\}\\frac\{R^\{2\}\}\{r\(2R\-r\)\}=0\.1593947534\\ldots\. A direct numerical calculation shows that all the conditions of[Lemmas6\.6](https://arxiv.org/html/2608.02478#S6.Thmtheorem6),[6\.8](https://arxiv.org/html/2608.02478#S6.Thmtheorem8),[6\.4](https://arxiv.org/html/2608.02478#S6.Thmtheorem4)and[6\.9](https://arxiv.org/html/2608.02478#S6.Thmtheorem9), and

max⁡\{12,ι⁡\(r,R\)\+2​r,1−χ\}<0\.603867\.\\displaystyle\\max\\left\\\{\\frac\{1\}\{2\},\\iota\(r,R\)\+2r,1\-\\chi\\right\\\}<0\.603867\.\(30\)
Algorithm 4: Importance\-sampling affine\-coset Hessian𝖲𝖵𝖯\\mathsf\{SVP\}

1. 1\.Construct the preprocessingn−1/3n^\{\-1/3\}\-𝖡𝖣𝖣\\mathsf\{BDD\}data and the scale grid from[Section3\.3](https://arxiv.org/html/2608.02478#S3.SS3)\.
2. 2\.At every scaledd, choose independent uniformP∈GLn⁡\(𝔽2\)P\\in\\GL\_\{n\}\(\\mathbb\{F\}\_\{2\}\)andj∈𝔽2hj\\in\\mathbb\{F\}\_\{2\}^\{h\}\. PutM=⌈n6​2\(ι⁡\(r,R\)\+2​r\)​n⌉M=\\lceil n^\{6\}2^\{\(\\iota\(r,R\)\+2r\)n\}\\rceiland apply the sampling algorithm from[Lemma6\.6](https://arxiv.org/html/2608.02478#S6.Thmtheorem6)\. Abort the scale unlessn​MnMsamples fromDΛj,ξRD\_\{\\Lambda\_\{j\},\\xi\_\{R\}\}are obtained, and divide them intonnfamilies\{Xa,1,…,Xa,M\}\\\{X\_\{a,1\},\\ldots,X\_\{a,M\}\\\},a∈\[n\]a\\in\[n\]\.
3. 3\.For everya∈\[n\]a\\in\[n\], construct the matrix\-valued array Aa\(y\):=−4​π2M∑1≤i≤MVP​\(Xa,i\)=yw\(Xa,i\)Xa,iXa,iT𝟏\{‖Xa,i‖≤C1ξRn\},y∈𝔽2ℓ\.A\_\{a\}\(y\):=\-\\frac\{4\\pi^\{2\}\}\{M\}\\sum\_\{\\begin\{subarray\}\{c\}1\\leq i\\leq M\\\\ V\_\{P\}\(X\_\{a,i\}\)=y\\end\{subarray\}\}w\(X\_\{a,i\}\)X\_\{a,i\}X\_\{a,i\}^\{T\}\\mathbf\{1\}\_\{\\\{\\norm\{X\_\{a,i\}\}\\leq C\_\{1\}\\xi\_\{R\}\\sqrt\{n\}\\\}\},\\qquad y\\in\\mathbb\{F\}\_\{2\}^\{\\ell\}\.
4. 4\.Apply the matrix\-valued Walsh\-Hadamard transform to eachAaA\_\{a\}\. For everyθ∈𝔽2ℓ\\theta\\in\\mathbb\{F\}\_\{2\}^\{\\ell\}, the output satisfies ∑y∈𝔽2ℓ\(−1\)θ⋅y​Aa​\(y\)=𝒩^a,j​\(θ\)\.\\displaystyle\\sum\_\{y\\in\\mathbb\{F\}\_\{2\}^\{\\ell\}\}\(\-1\)^\{\\theta\\cdot y\}A\_\{a\}\(y\)=\\widehat\{\\mathcal\{N\}\}\_\{a,j\}\(\\theta\)\.\(31\)Define𝒩^j​\(θ\)\\widehat\{\\mathcal\{N\}\}\_\{j\}\(\\theta\)by taking the median of the corresponding entries of𝒩^1,j​\(θ\),…,𝒩^n,j​\(θ\)\\widehat\{\\mathcal\{N\}\}\_\{1,j\}\(\\theta\),\\ldots,\\widehat\{\\mathcal\{N\}\}\_\{n,j\}\(\\theta\)\.
5. 5\.For everyθ∈𝔽2ℓ\\theta\\in\\mathbb\{F\}\_\{2\}^\{\\ell\}, compute unit eigenvectorsq\+q\_\{\+\}andq−q\_\{\-\}corresponding to the largest and smallest eigenvalues of𝒩^j​\(θ\)\\widehat\{\\mathcal\{N\}\}\_\{j\}\(\\theta\)and query𝖡𝖣𝖣\\mathsf\{BDD\}atd​q±dq\_\{\\pm\}\. Store a nonzero output inℒ\\mathcal\{L\}\. Keep only the shortest vector found and discard the other vectors and temporary data\.
6. 6\.Return the shortest vector over all scales\.

###### Theorem 6\.11\.

[Section6\.5](https://arxiv.org/html/2608.02478#S6.SS5)solves Search\-𝖲𝖵𝖯\\mathsf\{SVP\}with constant success probability in time20\.60387​n\+o⁡\(n\)2^\{0\.60387n\+o\(n\)\}and space20\.60387​n\+o⁡\(n\)2^\{0\.60387n\+o\(n\)\}\.

###### Proof\.

Supposeλ1​\(ℒ\)≤d≤\(1\+1/n\)​λ1​\(ℒ\)\\lambda\_\{1\}\(\\mathcal\{L\}\)\\leq d\\leq\(1\+1/n\)\\lambda\_\{1\}\(\\mathcal\{L\}\)and letvvbe a shortest vector\. We can ignore the otherdd’s as before\. Chooseu∗∈𝔽2nu\_\{\*\}\\in\\mathbb\{F\}\_\{2\}^\{n\}such thatv∈B​u∗\+2​ℒv\\in Bu\_\{\*\}\+2\\mathcal\{L\}, and writeP​u∗=\(α∗,θ∗\)Pu\_\{\*\}=\(\\alpha\_\{\*\},\\theta\_\{\*\}\)\.

By[Lemma6\.6](https://arxiv.org/html/2608.02478#S6.Thmtheorem6), the algorithm obtains samples whose joint distribution isexp⁡\(−Ω⁡\(n2\)\)\\exp\(\-\\Omega\(n^2\)\)\-close to independent samples fromDΛj,ξRD\_\{\\Lambda\_\{j\},\\xi\_\{R\}\}\. By[Eq\.31](https://arxiv.org/html/2608.02478#S6.E31), the Walsh\-Hadamard transforms compute𝒩^a,j​\(θ\)\\widehat\{\\mathcal\{N\}\}\_\{a,j\}\(\\theta\)for everya∈\[n\]a\\in\[n\]andθ∈𝔽2ℓ\\theta\\in\\mathbb\{F\}\_\{2\}^\{\\ell\}\. Their entrywise medians are therefore the matrices𝒩^j​\(θ\)\\widehat\{\\mathcal\{N\}\}\_\{j\}\(\\theta\)defined in[Section6\.3](https://arxiv.org/html/2608.02478#S6.SS3)\.

The conclusion of[Lemma6\.8](https://arxiv.org/html/2608.02478#S6.Thmtheorem8)holds simultaneously for everyθ∈𝔽2ℓ\\theta\\in\\mathbb\{F\}\_\{2\}^\{\\ell\}, and[Lemma6\.9](https://arxiv.org/html/2608.02478#S6.Thmtheorem9)shows that one of the two𝖡𝖣𝖣\\mathsf\{BDD\}queries corresponding toθ∗\\theta\_\{\*\}returns one of±v\\pm v\. The statistical distance in[Lemma6\.6](https://arxiv.org/html/2608.02478#S6.Thmtheorem6)changes the success probability by at mostexp⁡\(−Ω⁡\(n2\)\)\\exp\(\-\\Omega\(n^2\)\)\. Since every stored vector is verified to be a nonzero vector inℒ\\mathcal\{L\}, the shortest stored vector has normλ1​\(ℒ\)\\lambda\_\{1\}\(\\mathcal\{L\}\)\.

We analyze the complexity\. Generating and processing the samples takes2\(max⁡\{1/2,ι⁡\(r,R\)\+2​r\}\+o⁡\(1\)\)​n2^\{\(\\max\\\{1/2,\\iota\(r,R\)\+2r\\\}\+o\(1\)\)n\}time by[Lemma6\.6](https://arxiv.org/html/2608.02478#S6.Thmtheorem6)\. Constructing the arrays takesn​M​poly⁡\(n\)nM\\operatorname\{poly\}\(n\)time\. Their Walsh\-Hadamard transforms \([Lemma4\.1](https://arxiv.org/html/2608.02478#S4.Thmtheorem1)\), the entrywise medians, the eigenvector computations, and the𝖡𝖣𝖣\\mathsf\{BDD\}queries take2ℓ\+o⁡\(n\)=2\(1−χ\)​n\+o⁡\(n\)2^\{\\ell\+o\(n\)\}=2^\{\(1\-\\chi\)n\+o\(n\)\}time\. Hence the time exponent is0\.603870\.60387as in[Eq\.30](https://arxiv.org/html/2608.02478#S6.E30)\.

The Gaussian samples use2\(ι⁡\(r,R\)\+2​r\)​n\+o⁡\(n\)2^\{\(\\iota\(r,R\)\+2r\)n\+o\(n\)\}space, the arrays and their transforms use2\(1−χ\)​n\+o⁡\(n\)2^\{\(1\-\\chi\)n\+o\(n\)\}space, and the sampling algorithm uses2n/2\+o⁡\(n\)2^\{n/2\+o\(n\)\}space\. Thus the space exponent is bounded by the same maximum in[Eq\.30](https://arxiv.org/html/2608.02478#S6.E30)\. This proves the claimed time and space bounds\. ∎

### 6\.6Reducing the space by sparsification

We use the same parameters as in the previous section\. Choose independent uniformP∈GLn⁡\(𝔽2\)P\\in\\GL\_\{n\}\(\\mathbb\{F\}\_\{2\}\)andj∈𝔽2hj\\in\\mathbb\{F\}\_\{2\}^\{h\}\. The algorithm in[Section6\.5](https://arxiv.org/html/2608.02478#S6.SS5)storesnnarrays indexed by𝔽2ℓ\\mathbb\{F\}\_\{2\}^\{\\ell\}of size2ℓ=20\.60387​n\+o⁡\(n\)2^\{\\ell\}=2^\{0\.60387n\+o\(n\)\}\. To reduce the space, we randomly and sparsely select some of the samples before applying the Walsh\-Hadamard transform, and they are only used in the later steps\.

More precisely, we do the following\. ForX∈ΛjX\\in\\Lambda\_\{j\}, define

π⁡\(X\):=min⁡\{1,w⁡\(X\)2ι⁡\(r,R\)​n​\(r/R\)n/2\}\.\\displaystyle\\pi\(X\):=\\min\\left\\\{1,\\frac\{w\(X\)\}\{2^\{\\iota\(r,R\)n\}\(r/R\)^\{n/2\}\}\\right\\\}\.\(32\)Note that all terms are efficiently computable\. Conditional on each sampledXX, independently chooseZ∈\{0,1\}Z\\in\\\{0,1\\\}such thatPr⁡\[Z=1∣X\]=π⁡\(X\)\\Pr\[Z=1\\mid X\]=\\pi\(X\)andPr⁡\[Z=0∣X\]=1−π⁡\(X\)\\Pr\[Z=0\\mid X\]=1\-\\pi\(X\)\. We use the following: For every functionfffor which the expectation exists,

𝔼X,Z\[Z​f​\(X\)π⁡\(X\)\]=𝔼X\[𝔼\[Z​f​\(X\)π⁡\(X\)\|X\]\]=𝔼X\[f\(X\)\]\.\\displaystyle\\mathbb\{E\}\_\{X,Z\}\\left\[\\frac\{Zf\(X\)\}\{\\pi\(X\)\}\\right\]=\\mathbb\{E\}\_\{X\}\\left\[\\mathbb\{E\}\\left\[\\left\.\\frac\{Zf\(X\)\}\{\\pi\(X\)\}\\right\|X\\right\]\\right\]=\\mathbb\{E\}\_\{X\}\[f\(X\)\]\.\(33\)
LetM=⌈n6​2\(ι⁡\(r,R\)\+2​r\)​n⌉M=\\lceil n^\{6\}2^\{\(\\iota\(r,R\)\+2r\)n\}\\rceil, and takennindependent families\{Xa,1,…,Xa,M\}\\\{X\_\{a,1\},\\ldots,X\_\{a,M\}\\\},a∈\[n\]a\\in\[n\], of samples fromDΛj,ξRD\_\{\\Lambda\_\{j\},\\xi\_\{R\}\}\. Conditional on these samples, let theZa,iZ\_\{a,i\}be independent random variables such thatZa,i=1Z\_\{a,i\}=1with probabilityπ⁡\(Xa,i\)\\pi\(X\_\{a,i\}\)andZa,i=0Z\_\{a,i\}=0otherwise\. Define the sparsified estimator

𝒩^a,jsp\(θ\):=−4​π2M∑i=1MZa,i​w​\(Xa,i\)π⁡\(Xa,i\)Xa,iXa,iT\(−1\)θ⋅VP​\(Xa,i\)𝟏\{‖Xa,i‖≤C1ξRn\}\.\\displaystyle\\widehat\{\\mathcal\{N\}\}^\{\\rm sp\}\_\{a,j\}\(\\theta\):=\-\\frac\{4\\pi^\{2\}\}\{M\}\\sum\_\{i=1\}^\{M\}\\frac\{Z\_\{a,i\}w\(X\_\{a,i\}\)\}\{\\pi\(X\_\{a,i\}\)\}X\_\{a,i\}X\_\{a,i\}^\{T\}\(\-1\)^\{\\theta\\cdot V\_\{P\}\(X\_\{a,i\}\)\}\\mathbf\{1\}\_\{\\\{\\norm\{X\_\{a,i\}\}\\leq C\_\{1\}\\xi\_\{R\}\\sqrt\{n\}\\\}\}\.\(34\)Because of[Eq\.33](https://arxiv.org/html/2608.02478#S6.E33), the expectation of this sparsification is the same as the expectation of the original[Eq\.27](https://arxiv.org/html/2608.02478#S6.E27)\. For each matrix entry, define𝒩^jsp​\(θ\)\\widehat\{\\mathcal\{N\}\}^\{\\rm sp\}\_\{j\}\(\\theta\)by taking the median among the corresponding entries of𝒩^1,jsp​\(θ\),…,𝒩^n,jsp​\(θ\)\\widehat\{\\mathcal\{N\}\}^\{\\rm sp\}\_\{1,j\}\(\\theta\),\\ldots,\\widehat\{\\mathcal\{N\}\}^\{\\rm sp\}\_\{n,j\}\(\\theta\)\.

The factor1/π⁡\(Xa,i\)1/\\pi\(X\_\{a,i\}\)compensates for selecting a sample with probabilityπ⁡\(Xa,i\)\\pi\(X\_\{a,i\}\): conditional onXa,iX\_\{a,i\}, the expectation ofZa,i​w​\(Xa,i\)/π⁡\(Xa,i\)Z\_\{a,i\}w\(X\_\{a,i\}\)/\\pi\(X\_\{a,i\}\)isw⁡\(Xa,i\)w\(X\_\{a,i\}\)\.

###### Lemma 6\.12\.

Letλ=λ1​\(ℒ\)\\lambda=\\lambda\_\{1\}\(\\mathcal\{L\}\)andλ≤d≤\(1\+1/n\)​λ\\lambda\\leq d\\leq\(1\+1/n\)\\lambda\. Then, the following holds for allθ∈𝔽2ℓ\\theta\\in\\mathbb\{F\}\_\{2\}^\{\\ell\}:

maxθ∈𝔽2ℓ⁡‖𝒩^jsp​\(θ\)−w¯j​𝒢r,d,j​\(θ\)‖op=O⁡\(w¯j​μr,dn\)\\max\_\{\\theta\\in\\mathbb\{F\}\_\{2\}^\{\\ell\}\}\\left\\lVert\\widehat\{\\mathcal\{N\}\}^\{\\rm sp\}\_\{j\}\(\\theta\)\-\\overline\{w\}\_\{j\}\\mathcal\{G\}\_\{r,d,j\}\(\\theta\)\\right\\rVert\_\{\\mathrm\{op\}\}=O\\left\(\\frac\{\\overline\{w\}\_\{j\}\\mu\_\{r,d\}\}\{n\}\\right\)with probability1−O⁡\(n−1\)1\-O\(n^\{\-1\}\)overP,jP,j, the samplesXa,iX\_\{a,i\}, and the variablesZa,iZ\_\{a,i\}\.

###### Proof\.

FixP,jP,jfor which the conclusion of[Lemma6\.7](https://arxiv.org/html/2608.02478#S6.Thmtheorem7)holds, which happens with probability1−O⁡\(n−1\)1\-O\(n^\{\-1\}\)\. For fixedaa, let𝔼Xa\\mathbb\{E\}\_\{X\_\{a\}\}denote expectation over the independent samplesXa,1,…,Xa,M∼DΛj,ξRX\_\{a,1\},\\ldots,X\_\{a,M\}\\sim D\_\{\\Lambda\_\{j\},\\xi\_\{R\}\}\. Let𝔼Xa,Za\\mathbb\{E\}\_\{X\_\{a\},Z\_\{a\}\}additionally include the conditionally independent choicesZa,i\|Xa,i∼Bernoulli⁡\(π⁡\(Xa,i\)\)Z\_\{a,i\}\\mid X\_\{a,i\}\\sim\\operatorname\{Bernoulli\}\(\\pi\(X\_\{a,i\}\)\)\.

By[Eq\.33](https://arxiv.org/html/2608.02478#S6.E33),𝔼Xa,Za​\[𝒩^a,jsp​\(θ\)\]=𝔼Xa​\[𝒩^a,j​\(θ\)\]\\mathbb\{E\}\_\{X\_\{a\},Z\_\{a\}\}\[\\widehat\{\\mathcal\{N\}\}^\{\\rm sp\}\_\{a,j\}\(\\theta\)\]=\\mathbb\{E\}\_\{X\_\{a\}\}\[\\widehat\{\\mathcal\{N\}\}\_\{a,j\}\(\\theta\)\]\. Consequently,

𝒩^jsp​\(θ\)−w¯j​𝒢r,d,j​\(θ\)=𝒩^jsp​\(θ\)−𝔼Xa,Za​\[𝒩^a,jsp​\(θ\)\]\+𝔼Xa​\[𝒩^a,j​\(θ\)\]−w¯j​𝒢r,d,j​\(θ\)\.\\widehat\{\\mathcal\{N\}\}^\{\\rm sp\}\_\{j\}\(\\theta\)\-\\overline\{w\}\_\{j\}\\mathcal\{G\}\_\{r,d,j\}\(\\theta\)=\\widehat\{\\mathcal\{N\}\}^\{\\rm sp\}\_\{j\}\(\\theta\)\-\\mathbb\{E\}\_\{X\_\{a\},Z\_\{a\}\}\[\\widehat\{\\mathcal\{N\}\}^\{\\rm sp\}\_\{a,j\}\(\\theta\)\]\+\\mathbb\{E\}\_\{X\_\{a\}\}\[\\widehat\{\\mathcal\{N\}\}\_\{a,j\}\(\\theta\)\]\-\\overline\{w\}\_\{j\}\\mathcal\{G\}\_\{r,d,j\}\(\\theta\)\.The proof of[Lemma6\.8](https://arxiv.org/html/2608.02478#S6.Thmtheorem8)shows that the operator norm of𝔼Xa​\[𝒩^a,j​\(θ\)\]−w¯j​𝒢r,d,j​\(θ\)\\mathbb\{E\}\_\{X\_\{a\}\}\[\\widehat\{\\mathcal\{N\}\}\_\{a,j\}\(\\theta\)\]\-\\overline\{w\}\_\{j\}\\mathcal\{G\}\_\{r,d,j\}\(\\theta\)iso⁡\(w¯j​μr,d/n\)o\(\\overline\{w\}\_\{j\}\\mu\_\{r,d\}/n\)\. We bound the first difference using the same concentration argument\.

By the definition ofπ⁡\(X\)\\pi\(X\)and1/π⁡\(X\)=max⁡\(1,2ι⁡\(r,R\)​n​\(r/R\)n/2/w⁡\(X\)\)≤1\+2ι⁡\(r,R\)​n​\(r/R\)n/2/w⁡\(X\)1/\\pi\(X\)=\\max\(1,2^\{\\iota\(r,R\)n\}\(r/R\)^\{n/2\}/w\(X\)\)\\leq 1\+2^\{\\iota\(r,R\)n\}\(r/R\)^\{n/2\}/w\(X\),

𝔼Z\|X​\[\(Z​w​\(X\)π⁡\(X\)\)2\]=w​\(X\)2π⁡\(X\)≤w​\(X\)2\+2ι⁡\(r,R\)​n​\(r/R\)n/2​w​\(X\),\\mathbb\{E\}\_\{Z\\mid X\}\\left\[\\left\(\\frac\{Zw\(X\)\}\{\\pi\(X\)\}\\right\)^\{2\}\\right\]=\\frac\{w\(X\)^\{2\}\}\{\\pi\(X\)\}\\leq w\(X\)^\{2\}\+2^\{\\iota\(r,R\)n\}\(r/R\)^\{n/2\}w\(X\),whereZ\|X∼Bernoulli⁡\(π⁡\(X\)\)Z\\mid X\\sim\\operatorname\{Bernoulli\}\(\\pi\(X\)\)\. In the proof of[Lemma6\.8](https://arxiv.org/html/2608.02478#S6.Thmtheorem8), we proved that‖4​π2​X​XT‖F=O⁡\(ξr4​λ2\)\\left\\lVert 4\\pi^\{2\}XX^\{T\}\\right\\rVert\_\{\\mathrm\{F\}\}=O\(\\xi\_\{r\}^\{4\}\\lambda^\{2\}\)if\{‖X‖≤C1ξRn\}\\\{\\norm\{X\}\\leq C\_\{1\}\\xi\_\{R\}\\sqrt\{n\}\\\}\. Hence[Lemma6\.7](https://arxiv.org/html/2608.02478#S6.Thmtheorem7), together with𝔼X∼DΛj,ξR​\[w⁡\(X\)\]=w¯j=\(r/R\)n/2​\(1\+O⁡\(2−Ω⁡\(n\)\)\)\\mathbb\{E\}\_\{X\\sim D\_\{\\Lambda\_\{j\},\\xi\_\{R\}\}\}\[w\(X\)\]=\\overline\{w\}\_\{j\}=\(r/R\)^\{n/2\}\(1\+O\(2^\{\-\\Omega\(n\)\}\)\), gives

𝔼X∼DΛj,ξRZ\|X∼Bernoulli⁡\(π⁡\(X\)\)\[\(Z​w​\(X\)π⁡\(X\)\)2‖4π2XXT‖F2𝟏\{‖X‖≤C1ξRn\}\]=O\(nw¯j2ξr8λ42ι⁡\(r,R\)​n\)\.\\mathbb\{E\}\_\{\\begin\{subarray\}\{c\}X\\sim D\_\{\\Lambda\_\{j\},\\xi\_\{R\}\}\\\\ Z\\mid X\\sim\\operatorname\{Bernoulli\}\(\\pi\(X\)\)\\end\{subarray\}\}\\left\[\\left\(\\frac\{Zw\(X\)\}\{\\pi\(X\)\}\\right\)^\{2\}\\left\\lVert 4\\pi^\{2\}XX^\{T\}\\right\\rVert\_\{\\mathrm\{F\}\}^\{2\}\\mathbf\{1\}\_\{\\\{\\norm\{X\}\\leq C\_\{1\}\\xi\_\{R\}\\sqrt\{n\}\\\}\}\\right\]=O\\left\(n\\overline\{w\}\_\{j\}^\{2\}\\xi\_\{r\}^\{8\}\\lambda^\{4\}2^\{\\iota\(r,R\)n\}\\right\)\.
For fixeda,θ,p,qa,\\theta,p,q, the estimator entry is the average ofMMindependent summands\. Therefore,

𝔼Xa,Za​\[\(𝒩^a,jsp​\(θ\)−𝔼Xa,Za​\[𝒩^a,jsp​\(θ\)\]\)p,q2\]=O⁡\(w¯j2​μr,d2n5\)\\mathbb\{E\}\_\{X\_\{a\},Z\_\{a\}\}\\left\[\\left\(\\widehat\{\\mathcal\{N\}\}^\{\\rm sp\}\_\{a,j\}\(\\theta\)\-\\mathbb\{E\}\_\{X\_\{a\},Z\_\{a\}\}\[\\widehat\{\\mathcal\{N\}\}^\{\\rm sp\}\_\{a,j\}\(\\theta\)\]\\right\)\_\{p,q\}^\{2\}\\right\]=O\\left\(\\frac\{\\overline\{w\}\_\{j\}^\{2\}\\mu\_\{r,d\}^\{2\}\}\{n^\{5\}\}\\right\)by the definitions ofMMandμr,d\\mu\_\{r,d\}in[Eq\.29](https://arxiv.org/html/2608.02478#S6.E29)\. This is the same bound used in the proof of[Lemma6\.8](https://arxiv.org/html/2608.02478#S6.Thmtheorem8)\. Applying its Chebyshev, median, and union\-bound arguments proves the required operator\-norm bound simultaneously for everyθ∈𝔽2ℓ\\theta\\in\\mathbb\{F\}\_\{2\}^\{\\ell\}\. The failure probability in[Lemma6\.7](https://arxiv.org/html/2608.02478#S6.Thmtheorem7)isO⁡\(n−1\)O\(n^\{\-1\}\)\. ∎

The next lemma bounds the number of samples for whichZa,i=1Z\_\{a,i\}=1\.

###### Lemma 6\.13\.

Under the hypotheses of[Lemma6\.12](https://arxiv.org/html/2608.02478#S6.Thmtheorem12), with probability1−O⁡\(n−1\)1\-O\(n^\{\-1\}\)overP,jP,j, the samplesXa,iX\_\{a,i\}, and the variablesZa,iZ\_\{a,i\}, the number of pairs\(a,i\)\(a,i\)satisfyingZa,i=1Z\_\{a,i\}=1and‖Xa,i‖≤C1​ξR​n\\norm\{X\_\{a,i\}\}\\leq C\_\{1\}\\xi\_\{R\}\\sqrt\{n\}is at mostn8​22​r​nn^\{8\}2^\{2rn\}\.

###### Proof\.

Sinceπ⁡\(X\)≤w⁡\(X\)/\(2ι⁡\(r,R\)​n​\(r/R\)n/2\)\\pi\(X\)\\leq w\(X\)/\(2^\{\\iota\(r,R\)n\}\(r/R\)^\{n/2\}\),[Lemma6\.7](https://arxiv.org/html/2608.02478#S6.Thmtheorem7)gives

𝔼X∼DΛj,ξR​\[π⁡\(X\)\]≤w¯j2ι⁡\(r,R\)​n​\(r/R\)n/2=2−ι⁡\(r,R\)​n​\(1\+O⁡\(2−Ω⁡\(n\)\)\)\.\\mathbb\{E\}\_\{X\\sim D\_\{\\Lambda\_\{j\},\\xi\_\{R\}\}\}\[\\pi\(X\)\]\\leq\\frac\{\\overline\{w\}\_\{j\}\}\{2^\{\\iota\(r,R\)n\}\(r/R\)^\{n/2\}\}=2^\{\-\\iota\(r,R\)n\}\\left\(1\+O\(2^\{\-\\Omega\(n\)\}\)\\right\)\.The expected number of pairs satisfyingZa,i=1Z\_\{a,i\}=1is thereforeO⁡\(n​M​2−ι⁡\(r,R\)​n\)=O⁡\(n7​22​r​n\)O\(nM2^\{\-\\iota\(r,R\)n\}\)=O\(n^\{7\}2^\{2rn\}\)\. The norm condition can only decrease this number\. Markov’s inequality proves the lemma\. ∎

### 6\.7Space\-efficient implementation

Now we introduce an algorithm with the reduced space complexity\. For every importance\-weighted sample, we choose the random variableZZusing[Eq\.32](https://arxiv.org/html/2608.02478#S6.E32)and store the sample only ifZ=1Z=1\. The division byπ⁡\(X\)\\pi\(X\)preserves the expectation of its contribution\. By[Lemma6\.13](https://arxiv.org/html/2608.02478#S6.Thmtheorem13), the number of stored samples is22​r​n\+o⁡\(n\)2^\{2rn\+o\(n\)\}\.

We choose the same parametersr,R,χr,R,\\chias before, satisfying the conditions of all the lemmas and[Eq\.30](https://arxiv.org/html/2608.02478#S6.E30)\. The time complexity remains20\.60387​n\+o⁡\(n\)2^\{0\.60387n\+o\(n\)\}\. Generating and selecting the samples takes2\(ι⁡\(r,R\)\+2​r\)​n\+o⁡\(n\)2^\{\(\\iota\(r,R\)\+2r\)n\+o\(n\)\}time, and all the Walsh\-Hadamard transforms and the examination of all matrices take2ℓ\+o⁡\(n\)=2\(1−χ\)​n\+o⁡\(n\)2^\{\\ell\+o\(n\)\}=2^\{\(1\-\\chi\)n\+o\(n\)\}time\. The space complexity becomes2n/2\+o⁡\(n\)2^\{n/2\+o\(n\)\}, because the stored samples use22​r​n\+o⁡\(n\)2^\{2rn\+o\(n\)\}space for2​r<1/22r<1/2, and only2⌊n/2⌋2^\{\\lfloor n/2\\rfloor\}matrices are processed at a time\.

Algorithm 5: Space\-efficient importance\-sampling𝖲𝖵𝖯\\mathsf\{SVP\}

1. 1\.Follow the first two steps of[Section6\.5](https://arxiv.org/html/2608.02478#S6.SS5), but process each sampleXa,iX\_\{a,i\}immediately and then discard it\. If‖Xa,i‖≤C1​ξR​n\\norm\{X\_\{a,i\}\}\\leq C\_\{1\}\\xi\_\{R\}\\sqrt\{n\}, chooseZa,iZ\_\{a,i\}as in[Eq\.32](https://arxiv.org/html/2608.02478#S6.E32)\. WhenZa,i=1Z\_\{a,i\}=1, write VP​\(Xa,i\)=\(ka,i′,ka,i′′\)∈𝔽2b×𝔽2ℓ−b,b=⌊n/2⌋,V\_\{P\}\(X\_\{a,i\}\)=\(k^\{\\prime\}\_\{a,i\},k^\{\\prime\\prime\}\_\{a,i\}\)\\in\\mathbb\{F\}\_\{2\}^\{b\}\\times\\mathbb\{F\}\_\{2\}^\{\\ell\-b\},\\qquad b=\\lfloor n/2\\rfloor,and store\(a,ka,i′,ka,i′′,Wa,i\)\(a,k^\{\\prime\}\_\{a,i\},k^\{\\prime\\prime\}\_\{a,i\},W\_\{a,i\}\), whereWa,i:=−4​π2​w​\(Xa,i\)M​π​\(Xa,i\)​Xa,i​Xa,iT\.W\_\{a,i\}:=\-\\frac\{4\\pi^\{2\}w\(X\_\{a,i\}\)\}\{M\\pi\(X\_\{a,i\}\)\}X\_\{a,i\}X\_\{a,i\}^\{T\}\.Abort the scale if more thann8​22​r​nn^\{8\}2^\{2rn\}tuples are stored\.
2. 2\.For everyθ′′∈𝔽2ℓ−b\\theta^\{\\prime\\prime\}\\in\\mathbb\{F\}\_\{2\}^\{\\ell\-b\}anda∈\[n\]a\\in\[n\], form Aa,θ′′​\(x\):=∑\(a,k′,k′′,W\)​storedk′=x\(−1\)θ′′⋅k′′​W,x∈𝔽2b\.A\_\{a,\\theta^\{\\prime\\prime\}\}\(x\):=\\sum\_\{\\begin\{subarray\}\{c\}\(a,k^\{\\prime\},k^\{\\prime\\prime\},W\)\\text\{ stored\}\\\\ k^\{\\prime\}=x\\end\{subarray\}\}\(\-1\)^\{\\theta^\{\\prime\\prime\}\\cdot k^\{\\prime\\prime\}\}W,\\qquad x\\in\\mathbb\{F\}\_\{2\}^\{b\}\.Apply the matrix\-valued Walsh\-Hadamard transform and take the entrywise median of thennoutputs for eachθ′∈𝔽2b\\theta^\{\\prime\}\\in\\mathbb\{F\}\_\{2\}^\{b\}\. Perform the eigenvector and𝖡𝖣𝖣\\mathsf\{BDD\}steps of[Section6\.5](https://arxiv.org/html/2608.02478#S6.SS5), and discard the arrays before proceeding to the nextθ′′\\theta^\{\\prime\\prime\}\.
3. 3\.Keep the shortest verified vector over all scales\. Repeat a sufficiently large constant number of times and return the shortest vector found\.

###### Theorem 6\.14\.

[Section6\.7](https://arxiv.org/html/2608.02478#S6.SS7)solves Search\-𝖲𝖵𝖯\\mathsf\{SVP\}with success probability at least2/32/3in expected time20\.60387​n\+o⁡\(n\)2^\{0\.60387n\+o\(n\)\}and space2n/2\+o⁡\(n\)2^\{n/2\+o\(n\)\}\.

###### Proof\.

The correctness follows from the proof of[Theorem6\.11](https://arxiv.org/html/2608.02478#S6.Thmtheorem11), replacing[Lemma6\.8](https://arxiv.org/html/2608.02478#S6.Thmtheorem8)by[Lemma6\.12](https://arxiv.org/html/2608.02478#S6.Thmtheorem12)\. The additional abort probability isO⁡\(n−1\)O\(n^\{\-1\}\)by[Lemma6\.13](https://arxiv.org/html/2608.02478#S6.Thmtheorem13)\.

The samples are discarded after the selection step, so only22​r​n\+o⁡\(n\)2^\{2rn\+o\(n\)\}tuples are stored\. For each fixedθ′′\\theta^\{\\prime\\prime\}, the algorithm takes\(22​r​n\+2b\)​2o⁡\(n\)\\left\(2^\{2rn\}\+2^\{b\}\\right\)2^\{o\(n\)\}time and2b\+o⁡\(n\)2^\{b\+o\(n\)\}space\. Therefore, since2​r<1/22r<1/2andb=⌊n/2⌋b=\\lfloor n/2\\rfloor, the total time is2ℓ−b​\(22​r​n\+2b\)​2o⁡\(n\)=2\(1−χ\)​n\+o⁡\(n\)\.2^\{\\ell\-b\}\\left\(2^\{2rn\}\+2^\{b\}\\right\)2^\{o\(n\)\}=2^\{\(1\-\\chi\)n\+o\(n\)\}\.Together with the sampling time, this is20\.60387​n\+o⁡\(n\)2^\{0\.60387n\+o\(n\)\}\. The selected tuples, the arrays for one fixedθ′′\\theta^\{\\prime\\prime\}, the discrete Gaussian sampler, and the preprocessing𝖡𝖣𝖣\\mathsf\{BDD\}data use2n/2\+o⁡\(n\)2^\{n/2\+o\(n\)\}space\. A constant number of repetitions gives success probability at least2/32/3\. ∎

### 6\.8Quantum algorithm

We describe the quantum version of[Section6\.7](https://arxiv.org/html/2608.02478#S6.SS7)based on the quantum minimum finding algorithm\[[15](https://arxiv.org/html/2608.02478#bib.bib29)\]\. The application is rather straightforward: We search forθ′′∈𝔽2ℓ−b\\theta^\{\\prime\\prime\}\\in\\mathbb\{F\}\_\{2\}^\{\\ell\-b\}that minimizes the shortest vector found by the preprocessing BDD algorithm\. This reduces the complexity from2ℓ−b\+o⁡\(n\)​\(22​r​n\+2b\)2^\{\\ell\-b\+o\(n\)\}\(2^\{2rn\}\+2^\{b\}\)to2\(ℓ−b\)/2\+o⁡\(n\)​\(22​r​n\+2b\)2^\{\(\\ell\-b\)/2\+o\(n\)\}\(2^\{2rn\}\+2^\{b\}\)\.

In the quantum version, the collected tuples \(of size22​r​n\+o⁡\(n\)2^\{2rn\+o\(n\)\}\) and the preprocessing BDD advice \(of size2o⁡\(n\)2^\{o\(n\)\}\) are stored in QRAM, which will be of size22​r​n\+o⁡\(n\)2^\{2rn\+o\(n\)\}at total\. The overall steps for the Hessian estimation, eigenvector evaluations, and the BDD queries can be done reversibly\. This gives the coherent oracle required by quantum minimum finding with only a2o⁡\(n\)2^\{o\(n\)\}multiplicative overhead\.

To maximize the speedup, we also chooseb=⌊2​r​n⌋b=\\lfloor 2rn\\rfloorand other parameters by

r=0\.180182,R=0\.340429,χ=0\.278262\.r=0\.180182,\\qquad R=0\.340429,\\qquad\\chi=0\.278262\.giving20\.54106​n\+o⁡\(n\)2^\{0\.54106n\+o\(n\)\}time and20\.5​n\+o⁡\(n\)2^\{0\.5n\+o\(n\)\}space\.

###### Theorem 6\.15\.

There is a quantum algorithm that solves Search\-𝖲𝖵𝖯\\mathsf\{SVP\}with success probability at least2/32/3in expected time20\.54106​n\+o⁡\(n\)2^\{0\.54106n\+o\(n\)\}and space2n/2\+o⁡\(n\)\.2^\{n/2\+o\(n\)\}\.The QRAM size is20\.36036​n\+o⁡\(n\)2^\{0\.36036n\+o\(n\)\}and20\.36036​n\+o⁡\(n\)2^\{0\.36036n\+o\(n\)\}qubits\.

## References

- \[1\]D\. Aggarwal, Y\. Chen, R\. Kumar, and Y\. Shen\(2025\)Improved classical and quantum algorithms for the shortest vector problem via bounded distance decoding\.SIAM Journal on Computing54\(2\),pp\. 233–278\.External Links:[Document](https://dx.doi.org/10.1137/22M1486959),[Link](https://doi.org/10.1137/22M1486959),https://doi\.org/10\.1137/22M1486959Cited by:[§1\.1](https://arxiv.org/html/2608.02478#S1.SS1.SSS0.Px1.p1.6),[§1](https://arxiv.org/html/2608.02478#S1.p3.1),[§1](https://arxiv.org/html/2608.02478#S1.p4.1),[§2\.1](https://arxiv.org/html/2608.02478#S2.SS1.p4.1),[§2\.1](https://arxiv.org/html/2608.02478#S2.SS1.p5.1.1)\.
- \[2\]D\. Aggarwal, D\. Dadush, O\. Regev, and N\. Stephens\-Davidowitz\(2015\)Solving the shortest vector problem in2n2^\{n\}time using discrete Gaussian sampling: extended abstract\.In47thACM STOC,R\. A\. Servedio and R\. Rubinfeld \(Eds\.\),Portland, OR, USA,pp\. 733–742\.External Links:[Document](https://dx.doi.org/10.1145/2746539.2746606)Cited by:[§1\.1](https://arxiv.org/html/2608.02478#S1.SS1.SSS0.Px2.p2.1),[§1](https://arxiv.org/html/2608.02478#S1.p3.1),[§1](https://arxiv.org/html/2608.02478#S1.p4.1),[§1](https://arxiv.org/html/2608.02478#S1.p7.1),[§1](https://arxiv.org/html/2608.02478#S1.p8.1),[§2\.2](https://arxiv.org/html/2608.02478#S2.SS2.p2.1.1),[Lemma 2\.6](https://arxiv.org/html/2608.02478#S2.Thmtheorem6),[Theorem 2\.7](https://arxiv.org/html/2608.02478#S2.Thmtheorem7),[§3\.1](https://arxiv.org/html/2608.02478#S3.SS1.p1.1.1),[footnote 1](https://arxiv.org/html/2608.02478#footnote1)\.
- \[3\]D\. Aggarwal, Z\. Li, and N\. Stephens\-Davidowitz\(2021\)A2n/22^\{n/2\}\-time algorithm forn\\sqrt\{n\}\-SVP andn\\sqrt\{n\}\-Hermite SVP, and an improved time\-approximation tradeoff for \(H\)SVP\.InEUROCRYPT 2021, Part I,A\. Canteaut and F\. Standaert \(Eds\.\),LNCS, Vol\.12696,Zagreb, Croatia,pp\. 467–497\.External Links:[Document](https://dx.doi.org/10.1007/978-3-030-77870-5%5F17)Cited by:[§1](https://arxiv.org/html/2608.02478#S1.p5.1),[§1](https://arxiv.org/html/2608.02478#S1.p6.1)\.
- \[4\]D\. Aggarwal and N\. Stephens\-Davidowitz\(2018\)\(Gap/S\)ETH hardness of SVP\.In50thACM STOC,I\. Diakonikolas, D\. Kempe, and M\. Henzinger \(Eds\.\),Los Angeles, CA, USA,pp\. 228–238\.External Links:[Document](https://dx.doi.org/10.1145/3188745.3188840)Cited by:[§1](https://arxiv.org/html/2608.02478#S1.p2.1)\.
- \[5\]D\. Aharonov and O\. Regev\(2005\)Lattice problems in NP intersect coNP\.Journal of the ACM52\(5\),pp\. 749–765\.External Links:[Document](https://dx.doi.org/10.1145/1089023.1089025)Cited by:[§3\.2](https://arxiv.org/html/2608.02478#S3.SS2.p1.1)\.
- \[6\]D\. Aharonov and O\. Regev\(2005\)Lattice problems in np∩\\capconp\.J\. ACM52\(5\),pp\. 749–765\.External Links:ISSN 0004\-5411,[Link](https://doi.org/10.1145/1089023.1089025),[Document](https://dx.doi.org/10.1145/1089023.1089025)Cited by:[§1\.1](https://arxiv.org/html/2608.02478#S1.SS1.p1.1)\.
- \[7\]M\. Ajtai and C\. Dwork\(1997\)A public\-key cryptosystem with worst\-case/average\-case equivalence\.In29thACM STOC,El Paso, TX, USA,pp\. 284–293\.External Links:[Document](https://dx.doi.org/10.1145/258533.258604)Cited by:[§1](https://arxiv.org/html/2608.02478#S1.p2.1)\.
- \[8\]M\. Ajtai, R\. Kumar, and D\. Sivakumar\(2001\)A sieve algorithm for the shortest lattice vector problem\.In33rdACM STOC,Crete, Greece,pp\. 601–610\.External Links:[Document](https://dx.doi.org/10.1145/380752.380857)Cited by:[§1](https://arxiv.org/html/2608.02478#S1.p3.1)\.
- \[9\]M\. Ajtai\(1998\)The shortest vector problem in L2 is NP\-hard for randomized reductions \(extended abstract\)\.In30thACM STOC,Dallas, TX, USA,pp\. 10–19\.External Links:[Document](https://dx.doi.org/10.1145/276698.276705)Cited by:[§1](https://arxiv.org/html/2608.02478#S1.p2.1)\.
- \[10\]A\. Becker, L\. Ducas, N\. Gama, and T\. Laarhoven\(2016\)New directions in nearest neighbor searching with applications to lattice sieving\.In27thSODA,R\. Krauthgamer \(Ed\.\),Arlington, VA, USA,pp\. 10–24\.External Links:[Document](https://dx.doi.org/10.1137/1.9781611974331.ch2)Cited by:[§1](https://arxiv.org/html/2608.02478#S1.p3.1)\.
- \[11\]H\. Bennett, M\. Cheraghchi, V\. Guruswami, and J\. Ribeiro\(2023\)Parameterized inapproximability of the minimum distance problem over all fields and the shortest vector problem in allℓp\{\\ell\}\_\{p\}norms\.In55thACM STOC,B\. Saha and R\. A\. Servedio \(Eds\.\),Orlando, FL, USA,pp\. 553–566\.External Links:[Document](https://dx.doi.org/10.1145/3564246.3585214)Cited by:[§1](https://arxiv.org/html/2608.02478#S1.p2.1)\.
- \[12\]Z\. Brakerski, A\. Langlois, C\. Peikert, O\. Regev, and D\. Stehlé\(2013\)Classical hardness of learning with errors\.In45thACM STOC,D\. Boneh, T\. Roughgarden, and J\. Feigenbaum \(Eds\.\),Palo Alto, CA, USA,pp\. 575–584\.External Links:[Document](https://dx.doi.org/10.1145/2488608.2488680)Cited by:[§1](https://arxiv.org/html/2608.02478#S1.p2.1)\.
- \[13\]Y\. Chen, K\. Chung, and C\. Lai\(2018\)Space\-efficient classical and quantum algorithms for the shortest vector problem\.Quantum Info\. Comput\.18\(3–4\),pp\. 283–305\.External Links:ISSN 1533\-7146Cited by:[§1](https://arxiv.org/html/2608.02478#S1.p3.1)\.
- \[14\]D\. Dadush, O\. Regev, and N\. Stephens\-Davidowitz\(2014\)On the closest vector problem with a distance guarantee\.In2014 IEEE 29th Conference on Computational Complexity \(CCC\),Vol\.,pp\. 98–109\.External Links:[Document](https://dx.doi.org/10.1109/CCC.2014.18)Cited by:[§1\.1](https://arxiv.org/html/2608.02478#S1.SS1.SSS0.Px1.p1.1),[§1](https://arxiv.org/html/2608.02478#S1.p7.1),[§3\.2](https://arxiv.org/html/2608.02478#S3.SS2.p1.1)\.
- \[15\]C\. Durr and P\. Hoyer\(1999\)A quantum algorithm for finding the minimum\.External Links:quant\-ph/9607014,[Link](https://arxiv.org/abs/quant-ph/9607014)Cited by:[§1\.1](https://arxiv.org/html/2608.02478#S1.SS1.SSS0.Px6.p2.1),[§6\.8](https://arxiv.org/html/2608.02478#S6.SS8.p1.1)\.
- \[16\]Y\. Gao, Y\. Feng, and H\. Hu\(2026\)Solving the shortest vector problem in20\.7314​n\+o⁡\(n\)2^\{0\.7314n\+o\(n\)\}time via discrete gaussian sampling on superlattices\.Note:Cryptology ePrint Archive, Paper 2026/1587External Links:[Link](https://eprint.iacr.org/2026/1587)Cited by:[Remark 1\.2](https://arxiv.org/html/2608.02478#S1.Thmtheorem2.p1.1)\.
- \[17\]C\. Gentry, C\. Peikert, and V\. Vaikuntanathan\(2008\)Trapdoors for hard lattices and new cryptographic constructions\.In40thACM STOC,R\. E\. Ladner and C\. Dwork \(Eds\.\),Victoria, BC, Canada,pp\. 197–206\.External Links:[Document](https://dx.doi.org/10.1145/1374376.1374407)Cited by:[§1](https://arxiv.org/html/2608.02478#S1.p2.1)\.
- \[18\]G\. Hanrot and D\. Stehlé\(2007\)Improved analysis of kannan’s shortest lattice vector algorithm\.InCRYPTO 2007,A\. Menezes \(Ed\.\),LNCS, Vol\.4622,Santa Barbara, CA, USA,pp\. 170–186\.External Links:[Document](https://dx.doi.org/10.1007/978-3-540-74143-5%5F10)Cited by:[§1](https://arxiv.org/html/2608.02478#S1.p3.1)\.
- \[19\]I\. Haviv and O\. Regev\(2007\)Tensor\-based hardness of the shortest vector problem to within almost polynomial factors\.In39thACM STOC,D\. S\. Johnson and U\. Feige \(Eds\.\),San Diego, CA, USA,pp\. 469–477\.External Links:[Document](https://dx.doi.org/10.1145/1250790.1250859)Cited by:[§1](https://arxiv.org/html/2608.02478#S1.p2.1)\.
- \[20\]G\. A\. Kabatiansky and V\. I\. Levenshtein\(1978\)On bounds for packings on a sphere and in space\.Problemy peredachi informatsii14\(1\),pp\. 3–25\.Cited by:[§2\.1](https://arxiv.org/html/2608.02478#S2.SS1.p3.1),[§6\.1](https://arxiv.org/html/2608.02478#S6.SS1.p1.2)\.
- \[21\]R\. Kannan\(1983\)Improved algorithms for integer programming and related lattice problems\.InProceedings of the Fifteenth Annual ACM Symposium on Theory of Computing,pp\. 193–206\.External Links:[Document](https://dx.doi.org/10.1145/800061.808749)Cited by:[§1](https://arxiv.org/html/2608.02478#S1.p2.1),[§1](https://arxiv.org/html/2608.02478#S1.p3.1)\.
- \[22\]S\. Khot\(2005\)Hardness of approximating the shortest vector problem in lattices\.J\. ACM52\(5\),pp\. 789–808\.External Links:ISSN 0004\-5411,[Link](https://doi.org/10.1145/1089023.1089027),[Document](https://dx.doi.org/10.1145/1089023.1089027)Cited by:[§1](https://arxiv.org/html/2608.02478#S1.p2.1)\.
- \[23\]J\. Kim\(2026\)Note:Personal communicationCited by:[§1\.1](https://arxiv.org/html/2608.02478#S1.SS1.SSS0.Px7.p1.1),[Remark 1\.2](https://arxiv.org/html/2608.02478#S1.Thmtheorem2.p1.1),[§1](https://arxiv.org/html/2608.02478#S1.p8.1)\.
- \[24\]J\. C\. Lagarias and A\. M\. Odlyzko\(1985\)Solving low\-density subset sum problems\.J\. ACM32\(1\),pp\. 229–246\.External Links:ISSN 0004\-5411,[Link](https://doi.org/10.1145/2455.2461),[Document](https://dx.doi.org/10.1145/2455.2461)Cited by:[§1](https://arxiv.org/html/2608.02478#S1.p2.1)\.
- \[25\]A\. K\. Lenstra, Jr\. Lenstra, and L\. Lovász\(1982\)Factoring polynomials with rational coefficients\.Mathematische Annalen261,pp\. 515–534\.External Links:[Document](https://dx.doi.org/10.1007/BF01457454)Cited by:[§1](https://arxiv.org/html/2608.02478#S1.p2.1),[§3](https://arxiv.org/html/2608.02478#S3.p1.2)\.
- \[26\]H\. W\. Lenstra Jr\(1983\)Integer programming with a fixed number of variables\.Mathematics of operations research8\(4\),pp\. 538–548\.Cited by:[§1](https://arxiv.org/html/2608.02478#S1.p2.1)\.
- \[27\]M\. Liu, X\. Wang, G\. Xu, and X\. Zheng\(2011\)Shortest lattice vectors in the presence of gaps\.Note:Cryptology ePrint Archive, Paper 2011/139External Links:[Link](https://eprint.iacr.org/2011/139)Cited by:[§1](https://arxiv.org/html/2608.02478#S1.p5.1),[§1](https://arxiv.org/html/2608.02478#S1.p6.1)\.
- \[28\]M\. Liu, X\. Wang, G\. Xu, and X\. Zheng\(2014\)A note on BDD problems withλ2\\lambda\_\{2\}\-gap\.Information Processing Letters114\(1–2\),pp\. 9–12\.External Links:[Document](https://dx.doi.org/10.1016/j.ipl.2013.10.004)Cited by:[§1](https://arxiv.org/html/2608.02478#S1.p7.1)\.
- \[29\]D\. Micciancio and O\. Regev\(2004\)Worst\-case to average\-case reductions based on Gaussian measures\.In45thFOCS,Rome, Italy,pp\. 372–381\.External Links:[Document](https://dx.doi.org/10.1109/FOCS.2004.72)Cited by:[§1](https://arxiv.org/html/2608.02478#S1.p2.1),[Definition 2\.5](https://arxiv.org/html/2608.02478#S2.Thmtheorem5)\.
- \[30\]D\. Micciancio and P\. Voulgaris\(2010\)A deterministic single exponential time algorithm for most lattice problems based on voronoi cell computations\.In42ndACM STOC,L\. J\. Schulman \(Ed\.\),Cambridge, MA, USA,pp\. 351–358\.External Links:[Document](https://dx.doi.org/10.1145/1806689.1806738)Cited by:[§1](https://arxiv.org/html/2608.02478#S1.p3.1)\.
- \[31\]D\. Micciancio and P\. Voulgaris\(2010\)Faster exponential time algorithms for the shortest vector problem\.In21stSODA,M\. Charika \(Ed\.\),Austin, TX, USA,pp\. 1468–1480\.External Links:[Document](https://dx.doi.org/10.1137/1.9781611973075.119)Cited by:[§1](https://arxiv.org/html/2608.02478#S1.p3.1)\.
- \[32\]P\. Q\. Nguyen and T\. Vidick\(2008\)Sieve algorithms for the shortest vector problem are practicalSieve algorithms for the shortest vector problem are practical\.Journal of Mathematical Cryptology2\(2\),pp\. 181–207\.External Links:[Link](https://doi.org/10.1515/JMC.2008.009),[Document](https://dx.doi.org/doi%3A10.1515/JMC.2008.009)Cited by:[§1](https://arxiv.org/html/2608.02478#S1.p3.1)\.
- \[33\]OpenAI\(2026\)Ten advances in mathematics and theoretical computer science\.Technical reportOpenAI\.Note:Published August 1, 2026External Links:[Link](https://cdn.openai.com/pdf/ten-proofs-oai.pdf)Cited by:[Remark 1\.2](https://arxiv.org/html/2608.02478#S1.Thmtheorem2.p1.1)\.
- \[34\]A\. Pouly and Y\. Shen\(2026\)Solving the shortest vector problem in20\.63269​n\+o⁡\(n\)2^\{0\.63269n\+o\(n\)\}time on random lattices\.InAdvances in Cryptology – EUROCRYPT 2026,J\. Daemen and E\. Thomé \(Eds\.\),Cham,pp\. 92–123\.External Links:ISBN 978\-3\-032\-25327\-9Cited by:[§1](https://arxiv.org/html/2608.02478#S1.p3.1)\.
- \[35\]X\. Pujol and D\. Stehlé\(2009\)Solving the shortest lattice vector problem in time22\.465​n2^\{2\.465n\}\.Note:Cryptology ePrint Archive, Report 2009/605External Links:[Link](https://eprint.iacr.org/2009/605)Cited by:[§1](https://arxiv.org/html/2608.02478#S1.p3.1),[§2\.1](https://arxiv.org/html/2608.02478#S2.SS1.p3.1),[§6\.1](https://arxiv.org/html/2608.02478#S6.SS1.p1.2),[§6\.1](https://arxiv.org/html/2608.02478#S6.SS1.p2.1)\.
- \[36\]O\. Regev and N\. Stephens\-Davidowitz\(2017\)An inequality for gaussians on lattices\.SIAM Journal on Discrete Mathematics31\(2\),pp\. 749–757\.External Links:[Document](https://dx.doi.org/10.1137/15M1052226),[Link](https://doi.org/10.1137/15M1052226),https://doi\.org/10\.1137/15M1052226Cited by:[§1\.1](https://arxiv.org/html/2608.02478#S1.SS1.SSS0.Px1.p1.1)\.
- \[37\]O\. Regev\(2006\)Lattice\-based cryptography \(invited talk\)\.InCRYPTO 2006,C\. Dwork \(Ed\.\),LNCS, Vol\.4117,Santa Barbara, CA, USA,pp\. 131–141\.External Links:[Document](https://dx.doi.org/10.1007/11818175%5F8)Cited by:[§1](https://arxiv.org/html/2608.02478#S1.p2.1)\.
- \[38\]O\. Regev\(2009\)On lattices, learning with errors, random linear codes, and cryptography\.J\. ACM56\(6\)\.External Links:ISSN 0004\-5411,[Link](https://doi.org/10.1145/1568318.1568324),[Document](https://dx.doi.org/10.1145/1568318.1568324)Cited by:[§1](https://arxiv.org/html/2608.02478#S1.p2.1),[Definition 2\.5](https://arxiv.org/html/2608.02478#S2.Thmtheorem5)\.
- \[39\]A\. Shamir\(1982\)A polynomial time algorithm for breaking the basic Merkle\-Hellman cryptosystem\.In23rdFOCS,Chicago, Illinois,pp\. 145–152\.External Links:[Document](https://dx.doi.org/10.1109/SFCS.1982.5)Cited by:[§1](https://arxiv.org/html/2608.02478#S1.p2.1)\.
- \[40\]N\. Stephens\-Davidowitz\(2016\)Discrete Gaussian sampling reduces to CVP and SVP\.In27thSODA,R\. Krauthgamer \(Ed\.\),Arlington, VA, USA,pp\. 1748–1764\.External Links:[Document](https://dx.doi.org/10.1137/1.9781611974331.ch121)Cited by:[§1](https://arxiv.org/html/2608.02478#S1.p8.1)\.
- \[41\]W\. Wei, M\. Liu, and X\. Wang\(2015\)Finding shortest lattice vectors in the presence of gaps\.InCT\-RSA 2015,K\. Nyberg \(Ed\.\),LNCS, Vol\.9048,San Francisco, CA, USA,pp\. 239–257\.External Links:[Document](https://dx.doi.org/10.1007/978-3-319-16715-2%5F13)Cited by:[§1](https://arxiv.org/html/2608.02478#S1.p5.1)\.