Tensor-based Hardness of the Shortest Vector Problem to within Almost Polynomial Factors

$ \newcommand{\SVP}{\mathsf{SVP}} \newcommand{\NP}{\mathsf{NP}} \newcommand{\RTIME}{\mathsf{RTIME}} \newcommand{\RSUBEXP}{\mathsf{RSUBEXP}} \newcommand{\eps}{\epsilon} \newcommand{\poly}{\mathop{\mathrm{poly}}} $We show that unless $\NP \subseteq \RTIME (2^{\poly(\log{n})})$, there is no polynomial-time algorithm approximating the Shortest Vector Problem ($\SVP$) on $n$-dimensional lattices in the $\ell_p$ norm ($1 \leq p<\infty$) to within a factor of $2^{(\log{n})^{1-\eps}}$ for any $\eps>0$. This improves the previous best factor of $2^{(\log{n})^{1/2-\eps}}$ under the same complexity assumption due to Khot (J. ACM, 2005). Under the stronger assumption $\NP \nsubseteq \RSUBEXP$, we obtain a hardness factor of $n^{c/\log\log{n}}$ for some $c>0$. Our proof starts with Khot's $\SVP$ instances that are hard to approximate to within some constant. To boost the hardness factor we simply apply the standard tensor product of lattices. The main novelty is in the analysis, where we show that the lattices of Khot behave nicely under tensorization. At the heart of the analysis is a certain matrix inequality which was first used in the context of lattices by de Shalit and Parzanchevski (2006).


Introduction
A lattice is a periodic geometric object defined as the set of all integer combinations of some linearly independent vectors in R n . The interesting combinatorial structure of lattices has been investigated by mathematicians over the last two centuries, and for at least three decades it has also been studied from an asymptotic algorithmic point of view. Roughly speaking, most fundamental problems on lattices are not known to be efficiently solvable. Moreover, there are hardness results showing that such problems cannot be solved by polynomial-time algorithms unless the polynomial-time hierarchy collapses. One of the main motivations for research on the hardness of lattice problems is their applications in cryptography, as was demonstrated by Ajtai [3], who came up with a construction of cryptographic primitives whose security relies on the worst-case hardness of certain lattice problems.
Two main computational problems associated with lattices are the Shortest Vector Problem (SVP) and the Closest Vector Problem (CVP). In the former, for a lattice given by some basis we are supposed to find (the length of) a shortest nonzero vector in the lattice. The problem CVP is an inhomogeneous variant of SVP, in which given a lattice and some target point one has to find (its distance from) the closest lattice point. The hardness of lattice problems partly comes from the fact that there are many possible bases for the same lattice.
In this paper we improve the best hardness result known for SVP. Before presenting our results let us start with an overview of related work.

Related work
In the early 1980s, Lenstra, Lenstra, and Lovász (LLL) [20] presented the first polynomial-time approximation algorithm for SVP. Their algorithm achieves an approximation factor of 2 O(n) , where n is the dimension of the lattice. Using their algorithm, Babai [7] gave an approximation algorithm for CVP achieving the same approximation factor. A few years later, improved algorithms were presented for both problems, obtaining a slightly sub-exponential approximation factor, namely 2 O(n(log log n) 2 / log n) [31], and this has since been improved slightly [4,26]. The best algorithm known for solving SVP exactly requires exponential running time in n [18,4,26]. All the above results hold with respect to any p norm (1 ≤ p ≤ ∞).
On the hardness side, it was proven in 1981 by van Emde Boas [32] that it is NP-hard to solve SVP exactly in the ∞ norm. The question of extending this result to other norms, and in particular to the Euclidean norm 2 , remained open until the breakthrough result by Ajtai [2] showing that exact SVP in the 2 norm is NP-hard under randomized reductions. Then, Cai and Nerurkar [10] obtained hardness of approximation to within 1 + n −ε for any ε > 0. The first inapproximability result of SVP to within a factor bounded away from 1 is that of Micciancio [21], who showed that under randomized reductions SVP in the p norm is NP-hard to approximate to within any factor smaller than p √ 2. For the ∞ norm, a considerably stronger result is known: Dinur [14] showed that SVP is NP-hard to approximate in the ∞ norm to within a factor of n c/ log log n for some constant c > 0.
To date, the strongest hardness result known for SVP in the p norm is due to Khot [19] who showed NP-hardness of approximation to within arbitrarily large constants under randomized reductions for any 1 < p < ∞. Furthermore, under randomized quasipolynomial-time reductions (i. e., reductions that run in time 2 poly(log n) ), the hardness factor becomes 2 (log n) 1/2−ε for any ε > 0. Khot speculated there that it might be possible to improve this to 2 (log n) 1−ε , as this is the hardness factor known for the analogous problem in linear codes [16].
Khot's proof does not work for the 1 norm. However, it was shown in [30] that for lattice problems, the 2 norm is the easiest in the following sense: for any 1 ≤ p ≤ ∞, there exists a randomized reduction from lattice problems such as SVP and CVP in the 2 norm to the respective problem in the p norm with essentially the same approximation factor. In particular, this implies that Khot's results also hold for the 1 norm.
Finally, we mention that a considerably stronger result is known for CVP, namely that for any 1 ≤ p ≤ ∞, it is NP-hard to approximate CVP in the p norm to within n c/ log log n for some constant c > 0 [15]. We also mention that in contrast to the above hardness results, it is known that for any c > 0, SVP and CVP are unlikely to be NP-hard to approximate to within a cn/ log n factor, as this would imply the collapse of the polynomial-time hierarchy [17,1].

Our results
The main result of this paper improves the best NP-hardness factor known for SVP under randomized quasipolynomial-time reductions. This and two additional hardness results are stated in the following theorem. Here, RTIME is the randomized one-sided error analogue of DTIME. Namely, for a function f we denote by RTIME( f (n)) the class of problems having a probabilistic algorithm running in time O( f (n)) on inputs of size n that accepts YES inputs with probability at least 2/3, and rejects NO inputs with certainty. Theorem 1.1. For every 1 ≤ p ≤ ∞ the following holds.
1. For every constant c ≥ 1, there is no polynomial-time algorithm that approximates SVP in the p norm to within a factor of c unless NP ⊆ RP = c≥1 RTIME(n c ) .
2. For every ε > 0, there is no polynomial-time algorithm that approximates SVP on n-dimensional lattices in the p norm to within a factor of 2 (log n) 1−ε unless NP ⊆ RTIME(2 poly(log n) ) .
3. There exists a c > 0 such that there is no polynomial-time algorithm that approximates SVP on n-dimensional lattices in the p norm to within a factor of n c/ log log n unless Theorem 1.1 improves on the best known hardness result for any p < ∞. For p = ∞, a better hardness result is already known, namely that for some c > 0, approximating to within n c/ log log n is NP-hard [14]. Moreover, item 1 was already proved by Khot [19] and we provide an alternative proof. We remark that all three items follow from a more general statement (see Theorem 3.1).

Techniques
A standard method to prove hardness of approximation for large constant or super-constant factors is to first prove hardness for some fixed constant factor, and then amplify the constant using some polynomialtime (or quasipolynomial-time) transformation. For example, the tensor product of linear codes is used to amplify the NP-hardness of approximating the minimum distance in a linear code of block length n to arbitrarily large constants under polynomial-time reductions and to 2 (log n) 1−ε (for any ε > 0) under quasipolynomial-time reductions [16]. This example motivates one to use the tensor product of lattices to increase the hardness factor known for approximating SVP. However, whereas the minimum distance of the k-fold tensor product of a code C is simply the kth power of the minimum distance of C, the behavior of the length of a shortest nonzero vector in a tensor product of lattices is more complicated and not so well understood.
Khot's approach in [19] was to prove a constant hardness factor for SVP instances that have some "code-like" properties. The rationale is that such lattices might behave in a more predictable way under the tensor product. The construction of these "basic" SVP instances is ingenious, and is based on BCH codes as well as a restriction into a random sublattice. However, even for these code-like lattices, the behavior of the tensor product was not clear. To resolve this issue, Khot introduced a variant of the tensor product, which he called augmented tensor product, and using it he showed the hardness factor of 2 (log n) 1/2−ε . This unusual hardness factor can be seen as a result of the augmented tensor product. In more detail, for the augmented tensor product to work, the dimension of Khot's basic SVP instances grows to n Θ(k) , where k denotes the number of times we intend to apply the augmented tensor product. After applying it, the dimension grows to n Θ(k 2 ) and the hardness factor becomes 2 Θ(k) . This limits the hardness factor as a function of the dimension n to 2 (log n) 1/2−ε .
Our main contribution is showing that Khot's basic SVP instances do behave well under the (standard) tensor product. The proof of this fact uses a new method to analyze vectors in the tensor product of lattices, and is related to a technique used by de Shalit and Parzanchevski [13]. Theorem 1.1 now follows easily: we start with (a minor modification of) Khot's basic SVP instances, which are known to be hard to approximate to within some constant. We then apply the k-fold tensor product for appropriately chosen values of k and obtain instances of dimension n O(k) with hardness 2 Ω(k) .

Open questions
Some open problems remain. The most obvious is proving that SVP is hard to approximate to within factors greater than n c/ log log n under some plausible complexity assumption. Such a result, however, is not known for CVP nor for the minimum distance problem in linear codes, and most likely proving it there first would be easier. An alternative goal is to improve on the O( n/ log n) upper bound beyond which SVP is not believed to be NP-hard [17,1].
A second open question is whether our complexity assumptions can be weakened. For instance, our n c/ log log n hardness result is based on the assumption that NP RSUBEXP. For CVP, such a hardness factor is known based solely on the assumption P = NP [15]. Showing something similar for SVP would be very interesting. In fact, coming up with a deterministic reduction (even for constant approximation factors) already seems very challenging; all known hardness proofs for SVP in p norms, p < ∞, use randomized reductions. (We note, though, that [21] does describe a deterministic reduction based on a certain number-theoretic conjecture.) Ideas appearing in the recent NP-hardness proofs of the minimum distance problem in linear codes [11,6] might be useful. Finally, we mention that a significant step towards derandomization was recently made by Micciancio [23]: he strengthened our results by showing reductions with only one-sided error.

Outline
The rest of the paper is organized as follows. In Section 2 we gather some background on lattices and on the central tool in this paper-the tensor product of lattices. In Section 3 we prove Theorem 1.1. For the sake of completeness, Section 4 provides a summary of Khot's work [19] together with the minor modifications that we need to introduce.

Lattices
A lattice is a discrete additive subgroup of R n . Equivalently, it is the set of all integer combinations If the rank m equals the dimension n, then we say that the lattice is full-rank. The set {b 1 , . . . , b m } is called a basis of the lattice. Note that a lattice has many possible bases. We often represent a basis by an n × m matrix B having the basis vectors as columns, and we say that the basis B generates the lattice L. In such case we write L = L(B). It is well known and easy to verify that two bases B 1 and B 2 generate the same lattice if and only if B 1 = B 2 U for some unimodular matrix U ∈ Z m×m (i. e., a matrix whose entries are all integers and whose determinant is ±1). The determinant of a lattice generated by a basis B is det(L(B)) = det (B T B). It is easy to show that the determinant of a lattice is independent of the choice of basis and is thus well-defined. A sublattice of L is a lattice L(S) ⊆ L generated by some linearly independent lattice vectors S = {s 1 , . . . , s r } ⊆ L. It is known that any integer matrix B can be written as [H 0]U where H has full column rank and U is unimodular. One way to achieve this is by using the Hermite Normal Form (see, e. g., [12, Page 67]).
For any 1 ≤ p < ∞, the p norm of a vector x ∈ R n is defined as is the minimum p distance between two distinct points in the lattice L. This definition can be generalized to define the ith successive minimum as the smallest r such that B p (r) contains i linearly independent lattice points, where B p (r) denotes the p ball of radius r centered at the origin. More formally, for any 1 ≤ p ≤ ∞, we define We often omit the superscript in λ In 1896, Hermann Minkowski [28] proved the following classical result, known as Minkowski's First Theorem. We consider here the 2 norm, although the result has an easy extension to other norms. For a simple proof the reader is referred to [24, Chapter 1, Section 1.3].
Theorem 2.1 (Minkowski's First Theorem). For any rank-r lattice L, Our hardness of approximation results will be shown through the promise version GapSVP p γ , defined for any 1 ≤ p ≤ ∞ and for any approximation factor γ ≤ 1 as follows.

Tensor product of lattices
A central tool in the proof of our results is the tensor product of lattices. Let us first recall some basic definitions. For two column vectors u and v of dimensions n 1 and n 2 respectively, we define their tensor product u ⊗ v as the n 1 n 2 -dimensional column vector If we think of the coordinates of u⊗v as arranged in an n 1 ×n 2 matrix, we obtain the equivalent description of u ⊗ v as the matrix u · v T . More generally, any n 1 n 2 -dimensional vector w can be written as an n 1 × n 2 matrix W . To illustrate the use of this notation, notice that if W is the matrix corresponding to w then Finally, for an n 1 × m 1 matrix A and an n 2 × m 2 matrix B, one defines their tensor product A ⊗ B as the Let L 1 be a lattice generated by the n 1 × m 1 matrix B 1 and L 2 be a lattice generated by the n 2 × m 2 matrix B 2 . Then the tensor product of L 1 and L 2 is defined as the n 1 n 2 -dimensional lattice generated by the n 1 n 2 × m 1 m 2 matrix B 1 ⊗ B 2 , and is denoted by L = L 1 ⊗ L 2 . Equivalently, L is generated by the m 1 m 2 vectors obtained by taking the tensor product of two column vectors, one from B 1 and one from B 2 . If we think of the vectors in L as n 1 × n 2 matrices, then we can also define it as with each entry in X corresponding to one of the m 1 m 2 generating vectors. We will mainly use this definition in the proof of the main result.
As alluded to before, in the present paper we are interested in the behavior of the shortest nonzero vector in a tensor product of lattices. It is easy to see that for any 1 ≤ p ≤ ∞ and any two lattices L 1 and L 2 , we have Applying this to shortest nonzero vectors of L 1 and L 2 implies inequality (2.2). Inequality (2.2) has an analogue for linear codes, with λ (p) 1 replaced by the minimum distance of the code under the Hamming metric. There, it is not too hard to show that the inequality is in fact an equality: the minimal distance of the tensor product of two linear codes always equals to the product of their minimal distances. However, contrary to what one might expect, there exist lattices for which inequality (2.2) is strict. More precisely, for any sufficiently large n there exist n-dimensional lattices L 1 and L 2 satisfying The following lemma due to Steinberg shows this fact. Although we do not use this fact later on, the proof is instructive and helps motivate the need for a careful analysis of tensor products. To present this proof we need the notion of a dual lattice. For a full-rank lattice L ⊆ R n , its dual lattice L * is defined as L * = {x ∈ R n : x, y ∈ Z for all y ∈ L} .
A self-dual lattice is one that satisfies L = L * . It can be seen that for a full-rank lattice L generated by a basis B, the basis (B −1 ) T generates the lattice L * . Proof. We first show that for any full-rank n-dimensional lattice L, λ 1 (L ⊗ L * ) ≤ √ n. Let L be a lattice generated by a basis B = (b 1 , . . . , b n ). Let (B −1 ) T = (b 1 , . . . ,b n ) be the basis generating its dual lattice L * . Now consider the vector ∑ n i=1 b i ⊗b i ∈ L ⊗ L * . Using our matrix notation, this vector can be written as and clearly has 2 norm √ n. To complete the proof, we need to use the (non-trivial) fact that for any n ≥ 1 there exists a full-rank, n-dimensional and self-dual lattice with shortest nonzero vector of norm Ω( √ n). This fact is due to Conway and Thompson; see [27, Page 46] for details.

Proof of results
The following is our main technical result. As we will show later, Theorem 1.1 follows easily by plugging in appropriate values of k.
Theorem 3.1. For any 1 ≤ p ≤ ∞ there exist c,C > 0 such that the following holds. There exists a randomized reduction that takes as input a SAT instance and an integer k ≥ 1 and outputs a GapSVP p γ instance of dimension n Ck with gap γ = 2 −ck , where n denotes the size of the SAT instance. The reduction runs in time polynomial in n Ck and has two-sided error, namely, given a YES (resp., NO) instance it outputs a YES (resp., NO) instance with probability 9/10.
In fact, we will only need to prove this theorem for the case p = 2 since, as is easy to see, the general case follows from the following theorem (applied with, say, ε = 1/2). 1

Basic SVP
As already mentioned, our reduction is crucially based on a hardness result of a variant of SVP stemming from Khot's work [19]. Instances of this variant have properties that make it possible to amplify the gap using the tensor product. The following theorem summarizes the hardness result on which our proof is based. For a proof the reader is referred to Section 4.

Theorem 3.3 ([19]
). There are a constant γ < 1 and a polynomial-time randomized reduction from SAT to SVP outputting a lattice basis B, satisfying L(B) ⊆ Z n for some integer n, and an integer d, such that: 1. For any YES instance of SAT, with probability at least 9/10, λ 1 (L(B)) ≤ γ · √ d.
2. For any NO instance of SAT, with probability at least 9/10, for every nonzero vector v ∈ L(B), • v has at least d nonzero coordinates, or • all coordinates of v are even and at least d/4 of them are nonzero, or • all coordinates of v are even and v 2 ≥ d.

Boosting the SVP hardness factor
As mentioned before, we boost the hardness factor using the tensor product of lattices. For a lattice L we denote by L ⊗k the k-fold tensor product of L. An immediate corollary of inequality (2.2) is that if (B, d) is a YES instance of the SVP variant in Theorem 3.3, and L = L(B), then For the case in which (B, d) is a NO instance we will show that any nonzero vector of L ⊗k has norm at least d k/2 , i. e., This yields a gap of γ k between the two cases. Inequality (3.2) easily follows by induction from the central lemma below, which shows that NO instances "tensor nicely." The proof of this lemma is based on some properties of sublattices of NO instances which are established in the following claim. 1. Every basis matrix of L has at least d nonzero rows (i. e., rows that are not all zero).

Every basis matrix of L contains only even entries and has at least d/4 nonzero rows.
3. det(L) ≥ d r/2 .
Proof. Assume that L does not have either of the first two properties. Our goal is to show that the third property holds. Since the first property does not hold, we have r < d and also that any vector in L has fewer than d nonzero coordinates. By Theorem 3.3, this implies that L ⊆ 2 · Z n . By the assumption that the second property does not hold, there must exist a basis of L that has fewer than d/4 nonzero rows. Therefore, all nonzero vectors in L have fewer than d/4 nonzero coordinates, and hence have norm at least d, again by Theorem 3.3. We conclude that λ 1 (L) ≥ d, and by Minkowski's First Theorem (Theorem 2.1) and r < d we have

Proof of Lemma 3.4.
Let v be an arbitrary nonzero vector in L 1 ⊗ L 2 . Our goal is to show that v 2 ≥ √ d · λ 1 (L 2 ). We can write v in matrix notation as B 1 XB 2 T , where the integer matrix B 1 is a basis of L 1 , B 2 is a basis of L 2 , and X is an integer matrix of coefficients. Let U be a unimodular matrix for which X = [H 0]U, where H is a matrix with full column rank. Thus, the vector v can be written as B 1 [H 0](B 2 U T ) T . Since U T is also unimodular, the matrices B 2 and B 2 U T generate the same lattice. Now remove from B 2 U T the columns corresponding to the zero columns in [H 0] and denote the resulting matrix by B 2 . Furthermore, denote the matrix B 1 H by B 1 . Observe that both of the matrices B 1 and B 2 are bases of the lattices they generate, i. e., they have full column rank. The vector v equals B 1 B 2 T , where L 1 := L(B 1 ) ⊆ L 1 and L 2 := L(B 2 ) ⊆ L 2 . Claim 3.5 guarantees that the lattice L 1 defined above has at least one of the three properties mentioned in the claim. We show that v 2 ≥ √ d · λ 1 (L 2 ) in each of these three cases. Then, by the fact that λ 1 (L 2 ) ≥ λ 1 (L 2 ), the lemma will follow.  Therefore, every such row has 2 norm at least 2 · λ 1 (L 2 ), and it follows that The third case is based on the following central claim, which is similar to Proposition 1.1 in [13]. The proof is based on an elementary matrix inequality relating the trace and the determinant of a symmetric positive semidefinite matrix (see, e. g., [9, Page 47]). Claim 3.6. Let L 1 and L 2 be two rank-r lattices generated by the bases U = (u 1 , . . . , u r ) and W = (w 1 , . . . , w r ) respectively. Consider the vector v = ∑ r i=1 u i ⊗ w i in L 1 ⊗ L 2 , which can be written as UI r W T = UW T in matrix notation. Then, Proof. Define the two r × r symmetric positive definite matrices G 1 = U T U and G 2 = W T W (known as the Gram matrices of U and W ). By the fact that tr(AB) = tr(BA) for any matrices A and B and by equation (2.1), where G 1/2 2 is the positive square root of G 2 . The matrix G = G 1/2 2 is also symmetric and positive definite, and as such it has r real and positive eigenvalues. We can thus apply the inequality of arithmetic and geometric means on these eigenvalues to get v 2 2 = tr(G) ≥ r det(G) 1/r = r · det(G 1 ) · det(G 2 ) 1/r .
Taking the square root of both sides of this equation completes the proof.
Equipped with Claim 3.6 we turn to deal with the third case. In order to bound from below the norm of v, we apply the claim to its matrix form B 1 B 2 T with the lattices L 1 and L 2 as above.
Case 3: Assume that the lattice L 1 satisfies det(L 1 ) ≥ d r/2 , where r denotes its rank. Combining Claim 3.6 and Minkowski's First Theorem we have that and this completes the proof of the lemma.

Proof of the main theorem
Proof of Theorem 3.1. Recall that it suffices to prove the theorem for p = 2. Given a SAT instance of size n, we apply the reduction from Theorem 3.3 and obtain in time poly(n) a pair (B, d) where B is a basis of a poly(n)-dimensional lattice. We then output (B ⊗k , d k ), where B ⊗k is the k-fold tensor product of B, i. e., a basis of the lattice L(B) ⊗k . The dimension of this lattice is poly(n k ), and combining inequalities (3.1) and (3.2) we infer a gap of 2 −ck .
Proof of Theorem 1.1. For item 1, choose k to be a sufficiently large constant and apply Theorem 3.1. This shows that any constant factor approximation algorithm to SVP implies a two-sided error algorithm for SAT. Using known self-reducibility properties of SAT (see, e. g., [29,Chapter 11]), this also implies a one-sided error polynomial-time algorithm for SAT. For item 2, apply Theorem 3.1 with k = (log n) 1/ε (where n is the size of the input SAT instance) and let N = n Ck be the dimension of the output lattice. Since the gap we obtain as a function of the dimension N is 2 Ω((log N) 1−ε ) . Therefore, an algorithm that approximates SVP better than this gap implies a randomized SAT algorithm running in time 2 poly(log n) , and hence the desired containment NP ⊆ RTIME(2 poly(log n) ). Item 3 follows similarly by applying Theorem 3.1 with k = n δ for all δ > 0.

Proof of Theorem 3.3
In this section we prove Theorem 3.3. The proof is essentially the same as the one in [19] with minor modifications.

Comparison with Khot's theorem
For the reader familiar with Khot's proof, we now describe how Theorem 3.3 differs from the one in [19]. First, our theorem is only stated for the 2 norm (since we use Theorem 3.2 to extend the result to other norms). Second, the YES instances of Khot had another property that we do not need here (namely, that the coefficient vector of the short lattice vector is also short). Third, as a result of the augmented tensor product, Khot's theorem includes an extra parameter k that specifies the number of times the lattice is supposed to be tensored with itself. Since we do not use the augmented tensor product, we simply fix k to be some constant. In more detail, we choose the number of columns in the BCH code to be d O (1) , as opposed to d O(k) . This eventually leads to our improved hardness factor. Finally, the third possibility in our NO case is different from the one in Khot's theorem (which says that there exists a coordinate with absolute value at least d O(k) ). We note that coordinates with huge values are used several times in Khot's construction in order to effectively restrict a lattice to a subspace. We instead work directly with the restricted lattice, making the reduction somewhat cleaner.

The proof
The proof of Theorem 3.3 proceeds in three steps. In the first, a variant of the Exact Set Cover problem, which is known to be NP-hard, is reduced to a gap variant of CVP. In the second step we construct a basis B int of a lattice which, informally, contains many short vectors in the YES case, and few short vectors in the NO case. Finally, in the third step we complete the reduction by taking a random sublattice.

Step 1
First, consider the following variant of Exact Set Cover. Let η > 0 be an arbitrarily small constant. An instance of the problem is a pair (S, d), where S = {S 1 , . . . , S n } is a collection of subsets of some universe [n ] = {1, . . . , n }, and d is a positive integer. In YES instances, there exists S ⊆ S of size ηd that covers each element of the universe exactly once. In NO instances, there is no S ⊆ S of size less than d that covers all elements of the universe. This problem is known to be NP-hard for an arbitrarily small 0 < η < 1 and for n = O(d) [8]. Moreover, it is easy to see that the problem remains NP-hard if we fix η to be any negative power of 2 and restrict d to be a power of 2. Thus, to prove Theorem 3.3, it suffices to reduce from this problem.
In the first step we use a well-known reduction from the above variant of Exact Set Cover to a variant of CVP. For an instance (S, d) we identify S with the n × n matrix over {0, 1} whose columns are the characteristic vectors of the sets in S. The reduction outputs an instance (B CVP ,t), where B CVP is a basis generating the lattice {y ∈ Z n : Sy = 0} and t is some integer vector satisfying St = −(1, 1, . . . , 1). (If no such t exists, the reduction outputs an arbitrary NO instance.) We note that given S the basis B CVP can be constructed in polynomial time (see, e. g., [22,Lemma 3.1]). Lemma 4.1. If (S, d) is a YES instance of the above variant of Exact Set Cover, then there is a lattice vector z ∈ L(B CVP ) such that z − t is a {0, 1} vector and has exactly ηd coordinates equal to 1. If (S, d) is a NO instance, then for any lattice vector z ∈ L(B CVP ) and any nonzero integer j 0 , the vector z + j 0 t has at least d nonzero coordinates.
Proof. If (S, d) is a YES instance then there exists a vector y ∈ {0, 1} n with exactly ηd coordinates equal to 1 for which Sy = (1, 1, . . . , 1). This implies that S(y+t) = 0, so z = y+t is the required lattice vector. On the other hand, if (S, d) is a NO instance, then for any z ∈ L(B CVP ) we have S(z + j 0 t) = − j 0 · (1, 1, . . . , 1). This implies that the nonzero coordinates of z + j 0 t correspond to a cover S ⊆ S of all elements in [n ], and hence their number must be at least d.

Step 2
The second step of the reduction is based on BCH codes, as described in the following theorem. Let B BCH be a basis of the lattice {y ∈ Z N : (P BCH )y ≡ 0 (mod 2)}. Such a basis can be easily constructed in polynomial time by duality (see the preliminaries in [25]). The next lemma states some properties of this lattice. Proof. Let y ∈ L(B BCH ) be a nonzero lattice vector. Observe that if y has an odd coordinate then its odd coordinates correspond to column vectors of P BCH that sum to the zero vector over GF (2). Therefore, their number must be at least d. This proves the first statement.
We now prove the second statement. Consider the set L(B BCH ) ∩ {0, 1} N whose size is 2 N−h (since as a subset of GF(2) N it is the kernel of P BCH whose dimension is N − h). In order to choose s we first uniformly pick a vector in this set and then we uniformly pick r of its coordinates and flip them. For a vector s ∈ {0, 1} N let A s denote the number of ways in the above process to obtain s among the 2 N−h · N r possible ways. The probability that the chosen s satisfies thus with probability at least 99/100 we obtain an s that satisfies It remains to notice that such an s also satisfies the requirement in the statement of the lemma (since from each vector in {0, 1} N of Hamming distance r from s we can obtain z ∈ L(B BCH ) as in the statement by simply adding 2 to a subset of its coordinates).
We now construct the intermediate lattice generated by a basis matrix B int (see Figure 1). Let η be a sufficiently small constant, say 1/128. Let r = (3/4 + η)d and choose s as in Lemma 4.3. We choose the parameters of B BCH to be N = d 2/η , d, and h = (d/2) log 2 N. Consider a matrix whose upper left block is 2 · B CVP , whose lower right block is B BCH , and whose other entries are zeros. Adding to this matrix the column given by the concatenation of 2 · t and s, we obtain the basis matrix B int of the intermediate lattice.
The following two lemmas describe the properties of L(B int ). The first one states that if the CVP instance is a YES instance then L(B int ) contains many short vectors. Define γ = (3/4 + 5η) 1/2 < 1. A nonzero lattice vector of L(B int ) is called good if it has 2 norm at most γ · √ d, has {0, 1, 2} coordinates, and has at least one coordinate equal to 1.
The second lemma shows that if the CVP instance is a NO instance then L(B int ) contains few vectors that do not have the property from Theorem 3.3, Item 2. We call such vectors annoying. In more detail, a lattice vector of L(B int ) is annoying if it satisfies all of the following: • The number of its nonzero coordinates is smaller than d.
• Either it contains an odd coordinate or the number of its nonzero coordinates is smaller than d/4.
• Either it contains an odd coordinate or it has norm smaller than d. Proof. Assume that the CVP instance is a NO instance and let B int x be an annoying vector with coefficient vector x = y • z • ( j 0 ). We have By Lemma 4.1, if j 0 = 0 then the vector B CVP y + j 0 t has at least d nonzero coordinates, so it is not an annoying vector. Thus we can assume that j 0 = 0 and therefore B int x = 2(B CVP y) • (B BCH z).
Since B int x is annoying we know that it has fewer than d nonzero coordinates, so by Lemma 4.3 we get that all coordinates of B int x are even. Again by the definition of an annoying vector, we conclude that fewer than d/4 of the coordinates of B int x are nonzero and all of them have absolute value smaller than d. Thus, we get a bound of d d/4 · N+n d/4 on the number of possible choices for B int x, and this completes the proof of the lemma.

Step 3
In the third step we construct the final SVP instance as claimed in Choose a prime q in the interval [100A, G/100] and let w ∈ Z n +N be a vector whose coordinates are chosen randomly and uniformly from the range {0, . . . , q − 1}. The final output of the reduction is a basis B of the lattice {x ∈ L(B int ) : w, x ≡ 0 (mod q)}. Proof. If the CVP instance is a YES instance and s has the property from Lemma 4.3, then by Lemma 4.4 there are at least G good vectors in L(B int ), i. e., vectors with 2 norm at most γ · √ d, coordinates from {0, 1, 2}, and at least one coordinate equal to 1. For each good vector x, consider the event that w, x ≡ 0 (mod q). Since a good vector is nonzero, we clearly have that each such event occurs with probability 1/q. Moreover, observe that these vectors are pairwise linearly independent modulo q and therefore these events are pairwise independent. Therefore, using Chebyshev's Inequality, with probability at least 1 − q/G ≥ 99/100, at least one of these events happens, and we are done.
Lemma 4.7. If the CVP instance is a NO instance, then with probability at least 99/100 over the choice of the vector w, for every nonzero lattice vector v ∈ L(B), • v has at least d nonzero coordinates, or • all coordinates of v are even and at least d/4 of them are nonzero, or • all coordinates of v are even and v 2 ≥ d.
Proof. The probability that a nonzero lattice vector x ∈ L(B int ) satisfies w, x ≡ 0 (mod q) is 1/q. By the union bound, the probability that at least one of the annoying vectors of L(B int ) belongs to L(B) is at most A/q ≤ 1/100. Therefore, with probability at least 99/100, no lattice vector in L(B) is annoying, and the lemma follows.