Lecture 2 — Discrete vs. Continuous Assumptions

(a)  Solve for the secret sA live instance with n = 6, q = 97, 40 samples b = a⊤s + e (mod q). Two attacks run on whatever data the toggles produce: Gaussian elimination over ℤq, which needs exact equations, and least-squares regression, which needs unwrapped magnitudes. Turn the noise off and elimination wins; turn the modulus off and regression wins; leave both on and each attack sees only a band of middle bits — the modulus discards the high bits, the noise drowns the low ones — and both fail. That combination is LWE.

the data
noise width σ 3.0

(b)  Fresh samples without the secretChoose r ← {0,1}m and form a′ = Ar, b′ = b⊤r (mod q): a valid pair under the same secret, with noise widened by about √(m/2). The leftover hash lemma makes it genuinely fresh: once m ≥ n log2 q, the vector a′ is ε-close to uniform even given A, with the exact bound ε ≤ ½√(qn/2m) plotted below. Each press mints another sample, appended below as a new row of the dataset — it grows without the secret ever being learned. This is the engine of public-key encryption from LWE: publish samples, encrypt 0 as a generated fresh sample and 1 as a uniform pair; the secret key s tells them apart. Reference: Impagliazzo, Levin & Luby, STOC 1989.

samples m 45

(a)  CLWE: the sample cloud, colored by its labelsEvery sample is one dot in a 3-dimensional slice of ℝ24 that contains the secret w; drag to rotate the cloud, and note the two panels share one camera. The color is the label, drawn on the torus: carmine at b ≈ 0, blue at b ≈ ½, back to carmine at 1 — no seam, because b wraps. From almost every angle the colors are scrambled confetti. Rotate until w lies edge-on and the law b = γ⟨a,w⟩ + e (mod 1) sorts them into parallel bands of period 1/γ, blurred by β. Under the null the labels carry no direction and no angle ever produces bands. The same caveat as (b): in ℝ24 rotation would never find the direction — that is the point.

distribution
γ 3.0
β 0.08

(b)  Reject, drop the labels → hunt for the pancakesThe reduction from CLWE to homogeneous CLWE, performed on the samples from (a): keep only those whose label lies within δ of 0 (mod 1), then throw the labels away. Under the null this leaves a standard Gaussian; under the planted distribution the survivors concentrate on parallel sheets orthogonal to w, spaced 1/γ apart with width β/γ. Drag the cloud and look for the viewing angle where the sheets line up as stripes — that angle is the secret direction, seen edge-on. The two panels share the same camera, so a direction found in one is found in both. One honest caveat: the display is a 3-dimensional slice chosen to contain w; in ℝ24 the sphere of candidate directions is so large that stumbling on w by rotating is hopeless, and that is exactly the hCLWE problem. This unlabeled mixture is the object that hides the backdoor key in Lecture 4.

kept –