Hardness of Euclidean Closest Vector Within n^1/2−ϵ and Binary Nearest Codeword Within n^1−ϵ

1. Introduction

The gap version of the closest vector problem provides the standard decision formulation for studying approximation hardness. Let $B\in {\mathbb{Z}}^{n\times n}$ be nonsingular. Its columns generate the full-rank lattice $\mathcal{L}\left(B\right):=B{\mathbb{Z}}^n$, whose rank is n. Given a target $t\in {\mathbb{Q}}^n$ and a norm $\parallel ·\parallel$, the optimization version of the closest vector problem asks for $z\in {\mathbb{Z}}^n$ minimizing $\parallel t-Bz\parallel$; see Micciancio and Goldwasser [MG02, Chapter 3] for standard background.

For an approximation factor $\gamma :\mathbb{N}\to [1,\infty )$ and a positive rational radius r, the promise problem ${GapCVP}_{\gamma }^{\parallel ·\parallel }$ asks one to distinguish

$${dist}_{\parallel ·\parallel }(t,\mathcal{L}\left(B\right))\le r\mathrm{from}{dist}_{\parallel ·\parallel }(t,\mathcal{L}\left(B\right))>\gamma \left(n\right)r,$$

where ${dist}_{\parallel ·\parallel }(t,\mathcal{L}\left(B\right)):={min}_{z\in {\mathbb{Z}}^n}\parallel t-Bz\parallel$. Instances whose optimum lies between the two thresholds are outside the promise. A $\gamma \left(n\right)$-approximation algorithm for the optimization problem solves this promise problem by comparing the distance of its output with $\gamma \left(n\right)r$. Thus NP-hardness of ${GapCVP}_{\gamma }^{\parallel ·\parallel }$ rules out such an approximation algorithm unless $\mathrm{P}=\mathrm{NP}$.

The Euclidean closest vector problem is the specialization to the ${\ell }_2$ norm. We write

$${dist}_2(t,\mathcal{L}\left(B\right)):=\underset{z\in {\mathbb{Z}}^n}{min}{\parallel t-Bz\parallel }_2$$

and denote its gap version by ${GapCVP}_{\gamma }^{\left(2\right)}$. Van Emde Boas [vEB81] proved NP-hardness of exact Euclidean CVP. Arora, Babai, Stern, and Sweedyk [ABSS97] established hardness within every fixed constant. For every fixed $ϵ>0$, they also proved hardness within $2^{{(logn)}^{1-ϵ}}$ under the assumption $\mathrm{NP}\neg \subseteq \mathrm{DTIME}\left(2^{{(logn)}^{O\left(1\right)}}\right)$ [ABSS97]. Dinur, Kindler, and Safra [DKS98], in work subsequently refined by Dinur, Kindler, Raz, and Safra [DKRS03], strengthened this to $n^{a/loglogn}$ for some absolute constant $a>0$. Although this factor dominates every fixed power of $logn$, its exponent tends to zero and hence does not give $n^c$ hardness for any fixed $c>0$. The OpenAI report [Ope26, Chapter 7] subsequently obtained the fixed polynomial factor $n^{1/400}$ by a deterministic reduction from 3SAT. Fixed-polynomial lattice inapproximability had previously been obtained conditionally on the Projection Games Conjecture by Moshkovitz [Mos15, Section 5.1] and Mukhopadhyay [Muk22]. Those conditional results are qualitatively different from the unconditional deterministic reduction from ordinary 3SAT proved here. The Exponential Time Hypothesis (ETH), introduced by Impagliazzo and Paturi [IP01], has also served as the basis for recent fine-grained lower bounds for constant-factor approximations of CVP and related problems [AGMZ26,HKW26]. These results concern the running time of constant-factor approximation rather than unconditional NP-hardness for polynomial approximation factors.

The square-root scale forms a complexity-theoretic barrier. Goldreich and Goldwasser [GG00] established interactive-proof upper bounds that constrain the nonapproximability of lattice problems. Aharonov and Regev [AR05] subsequently proved that, for some absolute constant $C>0$,

$${GapCVP}_{C\sqrt{n}}^{\left(2\right)}\in \mathrm{NP}\cap \mathrm{coNP}.$$

Consequently, NP-hardness at that scale under deterministic polynomial-time many-one reductions would imply $\mathrm{NP}=\mathrm{coNP}$. The reduction given here achieves every fixed exponent below $1/2$.

Binary nearest codeword is an optimization problem over ${\mathbb{F}}_2$. Given a k-dimensional binary linear code $C\subseteq {\mathbb{F}}_2^n$ and a target word $y\in {\mathbb{F}}_2^n$, the task is to find a codeword in C minimizing its Hamming distance from y [BMT78]. Binary syndrome decoding takes as input a binary parity-check matrix H and a syndrome $s\in imH$, and asks for a minimum-weight binary vector e satisfying $He=s$ [BMT78]. The two formulations are equivalent. Indeed, if $C=kerH$ and $s=Hy$, then the map $c\mapsto y-c$ identifies codewords $c\in C$ with vectors e satisfying $He=s$. Consequently, the two instances have the same optimum value, and the correspondence preserves approximation ratios. Conversely, given a consistent syndrome instance $(H,s)$, Gaussian elimination finds y with $Hy=s$, and the same correspondence reduces it to nearest codeword for $kerH$.

Berlekamp, McEliece, and van Tilborg [BMT78] proved that binary syndrome decoding is NP-complete. For binary nearest codeword, Arora, Babai, Stern, and Sweedyk [ABSS97] proved unconditional NP-hardness of approximation within every constant factor. For every fixed $ϵ>0$, they also proved hardness within $2^{{(logn)}^{1-ϵ}}$ under the assumption that NP has no quasipolynomial-time algorithms, namely $\mathrm{NP}\neg \subseteq \mathrm{DTIME}\left(2^{{(logn)}^{O\left(1\right)}}\right)$. Arora’s thesis [Aro94, Section 6.4] gives a contemporaneous account and explicitly records the stronger $1-ϵ$ exponent for nearest codeword. For nearest codeword with preprocessing, Alekhnovich, Khot, Kindler, and Vishnoi [AKKV05] proved hardness within ${(logn)}^{1-ϵ}$ under the same quasipolynomial-time assumption. Khot, Popat, and Vishnoi [KPV14] strengthened the factor to $2^{{(logn)}^{1-ϵ}}$ under $\mathrm{NP}\neg \subseteq \mathrm{DTIME}\left(2^{{(logn)}^{O(1/ϵ)}}\right)$. For ordinary nearest codeword, Bhattiprolu, Guruswami, and Ren [BGR25] subsequently gave a PCP-free proof of the same two bounds: unconditional NP-hardness within every constant factor and $2^{{(logn)}^{1-ϵ}}=n^{o\left(1\right)}$ hardness under the assumption that NP has no quasipolynomial-time algorithms. Their contribution is a new proof rather than a stronger approximation factor. Bhattiprolu, Guruswami, Lee, and Ren [BGLR25] subsequently studied the inapproximability of finding sparse vectors in codes, subspaces, and lattices via randomized reductions; their lattice result does not yield deterministic fixed-polynomial hardness for Euclidean CVP. Methodologically, Bennett and Peikert [BP23] also combine Reed–Solomon codes [RS60] with an integer-lattice lift to obtain randomized hardness for approximate SVP and identify derandomization as a central obstacle.

Bitansky, Harsha, Ishai, Rothblum, and Wu [BHI+24] showed that ETH rules out $2^{o\left(n\right)}$-time approximation within a certain constant factor, using the equivalent formulation that minimizes the number of unsatisfied linear equations. Subsequently, Corollary 15 of the OpenAI report [Ope26] established, without an additional complexity assumption, NP-hardness of approximation within $n^{1/200}$ for binary nearest codeword and binary syndrome decoding under deterministic polynomial-time many-one reductions. The result proved here uses the same unconditional reduction model and improves the approximation factor to $n^{1-ϵ}$ for every fixed $0<ϵ<1$.

On the algorithmic side, Alon, Panigrahy, and Yekhanin gave several deterministic approximation algorithms and time–ratio tradeoffs [APY10]. Their general polynomial-time algorithm achieves an $O(n/logn)$ approximation. Berman and Karpinski gave, for every fixed constant $c>0$, a deterministic algorithm with approximation factor $O(k/c)$ and a randomized algorithm with factor $O(k/logk)$ [BK02]. Alon, Panigrahy, and Yekhanin observed that the latter analysis yields approximation factor $O(k/logn)$ [APY10].

1.1. Our Results

We first record the two Euclidean lattice problems used below.

Definition 

(Euclidean closest vector). An instance consists of a nonsingular matrix $B\in {\mathbb{Z}}^{n\times n}$ and a target $t\in {\mathbb{Q}}^n$. The matrix B generates the full-rank lattice $\mathcal{L}\left(B\right):=B{\mathbb{Z}}^n$. The objective is to output a vector $z\in {\mathbb{Z}}^n$ minimizing ${\parallel t-Bz\parallel }_2$. Its optimum value is ${dist}_2(t,\mathcal{L}\left(B\right)):={min}_{z\in {\mathbb{Z}}^n}{\parallel t-Bz\parallel }_2$.

Definition 

(Euclidean GapCVP). Let $\gamma :\mathbb{N}\to [1,\infty )$. An instance of ${GapCVP}_{\gamma }^{\left(2\right)}$ consists of a nonsingular matrix $B\in {\mathbb{Z}}^{n\times n}$, a target $t\in {\mathbb{Q}}^n$, and a radius $r\in {\mathbb{Q}}_{>0}$. It is promised that either ${dist}_2(t,\mathcal{L}\left(B\right))\le r$, which is the YES case, or ${dist}_2(t,\mathcal{L}\left(B\right))>\gamma \left(n\right)r$, which is the NO case. The task is to distinguish the two cases.

We now state our main Euclidean result. It improves the $n^{1/400}$ hardness factor in Theorem 1 on page 184 of the OpenAI report [Ope26].

Theorem 1.3

(Euclidean closest vector, informal version of Theorem 8.1). For every fixed $0<ϵ<1/2$, there is a deterministic polynomial-time mapping that assigns to each 3SAT formula φ a nonsingular matrix $B\in {\mathbb{Z}}^{n\times n}$, a target $t\in {\mathbb{Z}}^n$, and a radius $r\in {\mathbb{Q}}_{>0}$ such that

$$\begin{array}{cc}\hfill \phi \mathrm{satisfiable}& \Rightarrow {dist}_2(t,\mathcal{L}\left(B\right))\le r,\hfill \\ \hfill \phi \mathrm{unsatisfiable}& \Rightarrow {dist}_2(t,\mathcal{L}\left(B\right))>n^{1/2-ϵ}r.\hfill \end{array}$$

Consequently, ${GapCVP}_{n^{1/2-ϵ}}^{\left(2\right)}$ is NP-hard under deterministic polynomial-time many-one reductions.

Remark 1.4.

Our Theorem improves the $n^{1/400}$ Euclidean closest-vector hardness factor established in Theorem 1 of the OpenAI report [Ope26] to $n^{1/2-ϵ}$. Aharonov and Regev proved that ${GapCVP}_{C\sqrt{n}}^{\left(2\right)}$ lies in $\mathrm{NP}\cap \mathrm{coNP}$ for an absolute constant $C>0$ [AR05]. No NP-hardness result under deterministic polynomial-time many-one reductions can reach that scale unless $\mathrm{NP}=\mathrm{coNP}$.

We next formally define the two binary problems.

Definition 

(Binary nearest codeword). An instance consists of a binary linear code $C\subseteq {\mathbb{F}}_2^n$, given by a generator matrix, and a target word $y\in {\mathbb{F}}_2^n$. The objective is to output a codeword $c\in C$ minimizing $wt(y-c)$. We denote the optimum value by ${opt}_{\mathrm{nc}}(C,y):={min}_{c\in C}wt(y-c).$

Definition 

(Binary syndrome decoding). An instance consists of a binary matrix $H\in {\mathbb{F}}_2^{r\times n}$ and a syndrome $s\in imH$. The objective is to output a vector $e\in {\mathbb{F}}_2^n$ of minimum Hamming weight subject to $He=s$. We denote the optimum value by ${opt}_{\mathrm{sd}}(H,s):=min\{wt\left(e\right):e\in {\mathbb{F}}_2^n,He=s\}.$

To state approximation hardness, we use the gap versions of these two optimization problems. Both are promise problems parameterized by a radius and an approximation factor.

Definition 

(Binary gap nearest codeword and gap syndrome decoding). Let $\gamma :\mathbb{N}\to [1,\infty )$. An instance of ${GapNCP}_{\gamma }$ is a binary nearest-codeword instance $(C,y)$ together with a positive integer radius R; it is promised that either ${opt}_{\mathrm{nc}}(C,y)\le R$ or ${opt}_{\mathrm{nc}}(C,y)>\gamma \left(n\right)R$. An instance of ${GapSD}_{\gamma }$ is a binary syndrome-decoding instance $(H,s)$ together with a positive integer radius R and the analogous promise ${opt}_{\mathrm{sd}}(H,s)\le R$ or ${opt}_{\mathrm{sd}}(H,s)>\gamma \left(n\right)R$. In both cases n is the binary block length, and the task is to distinguish the two promised cases.

The following theorem improves the $n^{1/200}$ hardness factor established by Corollary 15 on page 213 of the OpenAI report [Ope26].

Theorem 1.8

(Main result, informal version of Theorem 7.1). For every fixed $0<ϵ<1$, ${GapNCP}_{n^{1-ϵ}}$ and ${GapSD}_{n^{1-ϵ}}$ are NP-hard under deterministic polynomial-time many-one reductions, where n is the binary block length. Consequently, binary nearest codeword (Definition 1.5) and binary syndrome decoding (Definition 1.6) are NP-hard to approximate within $n^{1-ϵ}$.

Remark 1.9.

The general polynomial-time algorithm of Alon, Panigrahy, and Yekhanin [APY10] approximates binary nearest codeword within $O(n/logn)$, so the factor $n^{1-ϵ}$ is optimal up to $n^{ϵ}$. This improves the $n^{1/200}$ hardness factor established in Corollary 15 of Chapter 7 of the OpenAI report [Ope26].

2. Technique Overview

This section compares the mechanism behind the OpenAI reduction [Ope26] with the two quadratic estimates that permit a sharper choice of parameters. We focus on the reduction to binary nearest codeword and syndrome decoding (Theorem 1.8). The Euclidean closest-vector result (Theorem 1.3) then follows from the dimension-preserving parity-lift reduction, which converts a binary weight gap into the square root of that gap in Euclidean distance. Section 2.1 reviews the approach in the OpenAI report, whereas Section 2.2 explains how our sharper analysis improves the resulting hardness factors.

2.1. Overview of the OpenAI Approach

Chapter 7 of the OpenAI report [Ope26] factors the reduction as

$$3\mathrm{SAT}⟶\mathrm{binary}\mathrm{affine}\mathrm{decoding}⟶\mathrm{binary}\mathrm{nearest}\mathrm{codeword}⟶\mathrm{Euclidean}\mathrm{CVP}.$$

The first arrow contains the main algebraic construction. Let $\phi$ be the input formula, let s be its encoding length, and let m and ℓ be its numbers of variables and clauses. We define $N:=100+s+m+\ell$ and $D_{\mathrm{RS}}:=m$. The variables are indexed by $\left[m\right]:=\{1,\dots ,m\}$ and represented by distinct anchors $a_1,\dots ,a_m$ in a characteristic-two field ${\mathbb{F}}_q$. A Boolean assignment $\sigma \in {\{0,1\}}^m$ determines the unique polynomial $Q_{\sigma }\in {\mathbb{F}}_q\left[X\right]$ of degree less than m satisfying $Q_{\sigma }\left(a_i\right)={\sigma }_i$, where ${\sigma }_i$ is the bit assigned to variable i. The reduction evaluates this polynomial on $P:={\mathbb{F}}_q\setminus \{a_1,\dots ,a_m\}$.

The binary variables are arranged into evaluation tables. For a clause C, let $I_C\subseteq \left[m\right]$ be the set of its variable indices and let $B_C\subseteq {\{0,1\}}^{I_C}$ be its satisfying local assignments. The table types are $\Theta :=\left\{0\right\}\cup \{(C,\beta ):\beta \in B_C\}$: type 0 is the global table, and $(C,\beta )$ is the subtype asserting that clause C receives the local assignment $\beta$. Write $x_{\tau ,p,w}$ for the binary coordinate selecting the field value $w\in {\mathbb{F}}_q$ in table $\tau \in \Theta$ at $p\in P$, and define its fiber by $S_{\tau }\left(p\right):=\{w\in {\mathbb{F}}_q:x_{\tau ,p,w}=1\}$.

Fix a moment budget T. For $0\le j\le T$, the ordinary power sum of table $\tau$ at p is

$${\mu }_{\tau ,j}\left(p\right):=\sum _{w\in S_{\tau }\left(p\right)}{w}^j.$$

For $\tau =(C,\beta )$, $i\in I_C$, and $0\le j\le T$, the shifted power sum is

$${\eta }_{\tau ,i,j}\left(p\right):=\sum _{w\in S_{\tau }\left(p\right)}{\left({\displaystyle \frac{w-{\beta }_i}{p-a_i}}\right)}^j,$$

where ${\beta }_i$ is the bit assigned to variable i by $\beta$. The affine constraints require these pointwise quantities to be evaluations of low-degree polynomials and require the clause tables to reproduce the global table modulo two. Let $Hx=b$ denote the resulting binary affine system, let $M:=\left|\Theta \right|\left|P\right|q$ be its number of binary coordinates, and, when the system is consistent, define $W(H,b):=min\{wt(x):Hx=b\}.$ If $\sigma$ satisfies the formula, each active fiber is the singleton $\left\{Q_{\sigma }\left(p\right)\right\}$, exactly one subtype is active for every clause, and the resulting binary solution has weight $R_1:=(\ell +1)\left|P\right|$.

For soundness, start with a low-weight binary solution. For a fiber cutoff $\kappa$, define the good evaluation set of table $\tau$ by $P_{\tau }:=\{p\in P:|S_{\tau }\left(p\right)|\le \kappa \}$. Markov’s inequality shows that $P_{\tau }$ contains all but a small set of evaluation points. Reed–Solomon interpolation turns the pointwise moments into polynomials ${\mu }_{\tau ,j}\left(X\right)$ in the indeterminate X. Lemma 10 of the OpenAI report [Ope26] uses the associated Hankel matrix to construct a monic separable polynomial $G_{\tau }\in {\mathbb{F}}_q\left(X\right)\left[Y\right]$. Its roots in a common splitting field have the prescribed power sums. The shifted moments are then examined using a valuation above $X-a_i$. They force every root associated with subtype $(C,\beta )$ to reduce to the bit ${\beta }_i$ at the anchor $a_i$. Finally, the clause decomposition and a Vandermonde argument match a global root with a satisfying subtype for every clause. Using the same valuation for a variable wherever it occurs makes these local assignments consistent, producing a global satisfying assignment.

The three parameters $\kappa$, T, and q serve different purposes, but the soundness proof couples them. The cutoff $\kappa$ must be large enough that a low-weight solution has few heavy fibers: if $wt\left(x\right)\le 4M^{1/200}{R}_1$, then

$$|P\setminus P_{\tau }|\le {\displaystyle \frac{4M^{1/200}{R}_1}{\kappa }}.$$

Increasing $\kappa$ improves this estimate, but it makes both algebraic steps more expensive. Thus one cannot choose the cutoff, the moment budget, and the field size independently.

Lemma 12 of the OpenAI report [Ope26] uses a large moment budget because of its local valuation argument. For a reconstructed polynomial of degree $h\le \kappa$, it first bounds the coefficients of an inverse Vandermonde matrix. In the notation of that argument, the successive bounds are

$$D_0:=D_{\mathrm{RS}}{h}^2+h,U_h:=h^2{D}_0+D_{\mathrm{RS}}{h}^2+1,z:=h{U}_h+1.$$

With $D_{\mathrm{RS}}\le N$ and $h\le \kappa =N^4$, these quantities have scales $N^9$, $N^{17}$, and $N^{21}$, respectively. The proof uses the moments with indices from z through $z+h-1$ to isolate one root at a time. Consequently, the moment budget must be larger than this range; the choice $T=N^{30}$ provides ample slack. This is the local-valuation moment cost; it does not come from the Reed–Solomon encoding itself.

Lemma 10 of the OpenAI report [Ope26] imposes two further costs, both quadratic in the fiber cutoff. Its Hankel determinant ${\Delta }_h$ has degree at most $D_{\mathrm{RS}}h(h-1)$; hence, uniformly for $h\le \kappa$, as many as $D_{\mathrm{RS}}\kappa (\kappa -1)$ retained sample points may fail to have maximum fiber size. Moreover, after clearing the common denominator ${\Delta }_h$, the j-th root-moment discrepancy has degree at most $2D_{\mathrm{RS}}{h}^{2}j$, which is bounded by $2D_{\mathrm{RS}}{\kappa }^{2}T$ for $j\le T$. Thus the reconstruction lemma requires

$$|P_{\tau }|-D_{\mathrm{RS}}\kappa (\kappa -1)>2D_{\mathrm{RS}}{\kappa }^{2}T.$$

(1)

We call the subtractive term the determinant-zero cost and the right-hand term the denominator-clearing cost. For $D_{\mathrm{RS}}\le N$, $\kappa =N^4$, and $T=N^{30}$, the right-hand side is of order $N^{39}$. Hence the field must be substantially larger than $N^{39}$. Moreover, it must remain large after the heavy fibers are discarded. Taking $q=\Theta \left(N^{200}\right)$ makes both requirements hold with considerable uniform slack: since $M=O\left(N{q}^2\right)$ and $R_1=O\left(Nq\right)$, the preceding discarded-point bound is $o\left(q\right)$ for the target factor $M^{1/200}$. The exact exponents 30 and 200 are therefore deliberately generous choices, but the original proof genuinely requires a large separation among these scales.

Finally, $q=\Theta \left(N^{200}\right)$ gives $M=O\left(N{q}^2\right)=O\left(N^{401}\right)$. Soundness against solutions of weight $O\left(M^{1/200}{R}_1\right)$ yields the $M^{1/200}$ coding gap. The standard parity lift outputs a lattice basis B and a target t satisfying ${dist}_2{(t,\mathcal{L}\left(B\right))}^2=W(H,b)$, so this becomes the $M^{1/400}$ Euclidean gap.

2.2. Overview of Our Approach

We retain the outer reduction through a sparse binary affine system, but replace its inner encoding and soundness mechanism. Multi-axis exponent reconstruction replaces anchor-based interpolation, and soundness is proved by a high-rank/low-rank dichotomy combining rank charging with short-recurrence atomization.

Sparse quadratic encoding and assignment compression. Instead of interpolating an assignment by a polynomial through anchors, we first replace the formula by a system of homogeneous quadratic forms in which each form has at most five monomials (Lemma 3.2), and we then compress an assignment into one field element, $enc\left(x\right):={\sum }_{i=1}^n{y}_i{x}_i\in \mathbb{E}$ where the $y_i$ are independent over ${\mathbb{F}}_2$, so that $x\mapsto enc\left(x\right)$ is injective. Consistency between occurrences of a variable is enforced by linear equations in the quadratic encoding rather than by a valuation at an anchor, so no local analysis at anchors is needed at any point below.

Axis-wise interpolation and multi-axis exponent reconstruction. Fix a power of two d and a number of axes r, and put $\kappa :=d^r$. For each axis j the reduction uses the polynomial $P_{x,j}$ of degree less than $[\mathbb{E}:{\mathbb{F}}_q]$ with $P_{x,j}\left(\zeta \right)=enc{\left(x\right)}^{d^j}$, which exists because $\{1,\zeta ,\dots \}$ is a basis, and whose coefficients are ${\mathbb{F}}_2$-linear in x because $d^j$ is a power of two and the Frobenius map is additive (Lemma 3.3). Writing an exponent in base d as $k={\sum }_{h=0}^{r-1}{p}_h{d}^h$ gives ${\prod }_{h=0}^{r-1}{P}_{x,h}{\left(\zeta \right)}^{p_h}=enc{\left(x\right)}^k$ by Lemma 3.4. This is the quantitative heart of the construction: r axis polynomials represent $\kappa =d^r$ consecutive powers of the assignment encoding, while the interpolation degree needed to carry them grows only linearly in d. Thus the construction represents $d^r$ consecutive powers while the interpolation-degree dependence on the radix remains linear in d.

The table has one block ${\mathcal{T}}_{i,j,\ell ,s}$ for every pair $0\le i,j\le n$, every label ℓ in the label set $\mathcal{L}:={\mathbb{F}}_q^r$, and every sample point s in the sample set $\mathcal{S}:={\mathbb{F}}_q$; for fixed ℓ and s these form a block ${\mathcal{T}}_{\ell ,s}\in {\mathbb{F}}_2^{(n+1)\times (n+1)}$.

Definitions 3.7 and 3.9 introduce the derived quantities f, F, and u.

From interpolants to exponent-indexed moments. Definition 3.8 controls how the table is converted into scalar moments. The degree bound keeps interpolation within the available budget, while the consistency condition ensures that $F_{i,j,p}\left(\zeta \right)$ depends only on the scalar exponent $ind\left(p\right)={\sum }_{h=0}^{r-1}{p}_h{d}^h$. Thus the exponent-indexed moments $u_{i,j,k}$ are well defined.

Algebraic identities of honest moments. Definition 3.10 imposes the three algebraic identities satisfied by honest moments. Doubling an exponent squares the moment, the linear-combination identity advances the exponent through the assignment encoding, and matrix-inner-product vanishing enforces every quadratic encoding form. These constraints are affine over ${\mathbb{F}}_2$; in particular, squaring is affine because it is the Frobenius automorphism (Lemma 3.12).

Direct constraints on table blocks. Definition 3.11 acts directly on the table blocks. Symmetry makes each block behave like a matrix of pairwise products, while anchor normalization fixes the homogenizing coordinate and removes the scaling ambiguity. Accordingly, the completeness witness places one rank-one block $z{z}^{\top }$ at the honest label of each sample point (Lemma 3.13).

Charging rank instead of discarding a discriminant. Soundness splits on the rank of the polynomial moment matrix $\mathbf{U}\left(X\right)$ over $\mathbb{K}\left(X\right)$. If that rank is at least $\kappa$, we do not ask any determinant to be nonzero at any particular sample point. Instead we choose one $\kappa \times \kappa$ minor with nonzero determinant $\Delta$, note that the rank lost at a sample point s divides $\Delta$ to that order, and sum:

$$\sum _{s\in \mathcal{S}}{\delta }_s\le deg\Delta \le \kappa W_{\mathrm{deg}},wt\left(\mathcal{T}\right)\ge \sum _{s\in \mathcal{S}}rank\mathbf{U}\left(s\right)\ge \kappa (q-W_{\mathrm{deg}}),$$

Here the Kronecker factorization $\mathbf{U}\left(s\right)={\sum }_{\ell \in \mathcal{L}}{\mathcal{T}}_{\ell ,s}\otimes w_{\ell }{\left(w_{\ell }^{\prime }\right)}^{\top }$ gives the first inequality (Lemma 4.1). Determinantal divisibility gives the second: if ${\delta }_s:=\kappa -rankC\left(s\right)$, then ${(X-s)}^{{\delta }_s}\mid \Delta$, and therefore ${\sum }_s{\delta }_s\le deg\Delta \le \kappa W_{\mathrm{deg}}$ (Lemma 4.3). For fixed r, $W_{\mathrm{deg}}=2r(n+2)(d-1)(c-1)$ is linear in the radix d, equivalently proportional to ${\kappa }^{1/r}$ up to the displayed $n,c,r$ factors; in particular, no quadratic $\kappa$-factor appears. Thus the high-rank branch replaces the determinant-zero cost $D_{\mathrm{RS}}\kappa (\kappa -1)$ in Eq. (1). Rather than discarding every sample point where a maximal-fiber Hankel determinant vanishes, it charges each pointwise rank deficit to the vanishing order of one fixed nonzero minor.

Atomization instead of local valuation. In the complementary case the rank is below $\kappa$, so every scalar moment sequence obeys a short linear recurrence (Lemma 5.2). View the sequence as a functional g on the finite-dimensional recurrence algebra it generates. Before passing to the reduced algebra, generalized nilpotent components may still occur, while arbitrary coefficients could permit cancellation between candidate assignments. The doubling-is-squaring identity in Definition 3.10-(a) removes exactly these freedoms: the identity $g\left({\psi }^2\right)=g{\left(\psi \right)}^2$ makes g vanish on the nilradical and forces the idempotent values to satisfy $c^2=c$, hence to lie in $\{0,1\}$. So every moment sequence is a plain sum ${\sum }_{\xi \in {\Xi }_{i,j}}{\xi }^k$ over an entrywise set of distinct atoms with all coefficients equal to one (Lemma 5.3). Constraint-local Vandermonde isolation then synchronizes these entrywise atom sets and decodes a satisfying assignment (Lemma 6.2). This low-rank branch avoids the denominator-clearing cost $2D_{\mathrm{RS}}{\kappa }^{2}T$ in Eq. (1): the atom identities are proved inside the recurrence algebra and synchronized by a constraint-local Vandermonde system, rather than by inverse-Vandermonde local valuation followed by interpolation of a denominator-cleared global root identity.

Nearest codeword and syndrome decoding. A light table therefore yields a satisfying assignment, so an unsatisfiable formula forces weight at least $R_0=\kappa (q-W_{\mathrm{deg}})$, whereas completeness costs only $R_1=q{(n+1)}^2$. The block length is $M={(n+1)}^2{q}^{r+1}$, because the table has one sample coordinate, r label coordinates, and one matrix block. The actual gap satisfies $R_0/R_1\ge 3\kappa /\left[4{(n+1)}^2\right]$. With $d=\Theta \left(n^B\right)$ and $q=\Theta \left(rd{n}^2\right)$, the block length is $M=n^{B(r+1)+2r+4+o\left(1\right)}$, whereas $R_0/R_1=n^{Br-2+o\left(1\right)}$. Thus the gap exponent is ${\delta }_{r,B}=(Br-2)/(B(r+1)+2r+4)$, which approaches $r/(r+1)$ as $B\to \infty$ for fixed r and then can be made arbitrarily close to 1 by choosing r large. Consequently, for every fixed $0<ϵ<1$, the reduction gives an $M^{1-ϵ}$ gap for binary nearest codeword and syndrome decoding (Theorem 7.1).

Euclidean GapCVP. The parity-kernel lattice lift identifies Hamming weight with squared Euclidean distance exactly, through ${dist}_2{(t,\mathcal{L}\left(B\right))}^2=W(H,b)$. Taking square roots halves the binary gap exponent. Because the binary theorem permits arbitrary slack, reserving part of it for radius rounding yields an $M^{1/2-ϵ}$ hardness factor for Euclidean GapCVP for every fixed $0<ϵ<1/2$ (Theorem 8.1). That endpoint is the square-root scale of Aharonov and Regev [AR05], which no reduction of this kind can reach unless $\mathrm{NP}=\mathrm{coNP}$.

2.2.0.1. Roadmap.

Section 3 defines basic notation, reduces 3SAT to a sparse quadratic system, introduces the assignment encoding and the folded axis polynomials, defines the binary affine system, and proves completeness. Section 4 proves the rank-charging bound for tables whose moment matrix has large rank. Section 5 proves that in the complementary case the moment sequences are sums over entrywise sets of fewer than $\kappa$ atoms with unit coefficients. Section 6 combines the two cases and decodes an atom into a satisfying assignment. Section 7 chooses the parameters and proves the $n^{1-ϵ}$ hardness result for binary nearest codeword and binary syndrome decoding. Section 8 lifts the binary instance to a full-rank integer lattice while preserving the optimum as a squared Euclidean distance, which gives the $n^{1/2-ϵ}$ hardness result for Euclidean GapCVP.

3. Preliminaries and The Binary Affine System

Section 3.1 defines basic notation and field conventions. Section 3.2 introduces index maps and bounded lifts; Section 3.3 converts 3SAT into a sparse quadratic encoding; Section 3.4 develops axis-wise interpolation and multi-axis exponent reconstruction; and Section 3.5 assembles these ingredients into the binary affine system and establishes its completeness properties.

3.1. Notation

For a positive integer n, we define $\left[n\right]:=\{1,\dots ,n\}$. We write $\mathbb{Z}$ for the integers and $\mathbb{R}$ for the real numbers. For a matrix A, $A^{\top }$ denotes its transpose and $rank\left(A\right)$ its rank. If A is square, $det\left(A\right)$ denotes its determinant. For matrices A and B, $A\otimes B$ denotes their Kronecker product, so that ${(A\otimes B)}_{(i,a),(j,b)}=A_{i,j}{B}_{a,b}$.

For a vector $x=(x_1,\dots ,x_n)$, its Hamming weight is $wt\left(x\right):=\left|\right\{i\in \left[n\right]:x_i\ne 0\left\}\right|$, and the same notation is used for the number of nonzero entries of a matrix. For binary vectors $x,y\in {\mathbb{F}}_2^n$, their Hamming distance is ${dist}_H(x,y):=wt(x-y)$. For a nonempty set $C\subseteq {\mathbb{F}}_2^n$, we define ${dist}_H(x,C):={min}_{y\in C}{dist}_H(x,y)$. For $x\in {\mathbb{R}}^n$, its Euclidean norm is ${\parallel x\parallel }_2:=\sqrt{{\sum }_{i=1}^n{x}_i^2}$, and for $t\in {\mathbb{R}}^n$ and a nonempty $V\subseteq {\mathbb{R}}^n$ we define ${dist}_2(t,V):={inf}_{v\in V}{\parallel t-v\parallel }_2$. In every application below, V is a lattice or a finite set, so the infimum is attained.

Throughout, q is a power of two and $\mathbb{K}:={\mathbb{F}}_q$. We write $\mathbb{K}\left[X\right]$ and $\mathbb{K}\left(X\right)$ for the polynomial ring and the rational-function field over $\mathbb{K}$. For a nonzero $\psi \in \mathbb{K}\left[X\right]$, $deg\psi$ denotes its degree, and we set $deg0:=-\infty$. defines basic notation and field conventionsFor $\psi \in \mathbb{K}\left[X\right]$, ${ord}_{X-s}\left(\psi \right)$ denotes the order of vanishing of $\psi$ at $X=s$.

3.2. Index Maps and Bounded Lifts

To formulate the affine system, we need to translate bounded multi-indices into scalar exponents and back. The following index and lift maps provide this translation while respecting the prescribed coordinate range.

Definition 

(Index map and bounded lift). Fix a power of two $d\ge 2$, an integer $r\ge 1$, and an integer $J\ge 1$. For a multi-index $p\in {\mathbb{Z}}_{\ge 0}^r$, its exponent index is

$$ind\left(p\right):={\displaystyle \sum _{h=0}^{r-1}}{p}_h{d}^h.$$

For every integer $0\le a\le J(d^r-1)$, the bounded lift

$${lift}_J\left(a\right)\in {\{0,\dots ,J(d-1)\}}^r$$

is the multi-index obtained by greedily expanding a from the highest base-d position to the lowest. It is chosen so that

$$ind\left({lift}_J\left(a\right)\right)=a.$$

Thus ind converts a multi-index into its scalar exponent, while ${lift}_J$ selects a bounded multi-index representing a given scalar exponent.

The bounded lift exists throughout the stated range. Indeed, the largest attainable index is $J(d-1){\sum }_{h=0}^{r-1}{d}^h=J(d^r-1)$. Set $a_{r-1}:=a$ and process $h=r-1,r-2,\dots ,0$, maintaining $0\le a_h\le J(d^{h+1}-1)$. At position h, choose

$$p_h:=min\{J(d-1),\lfloor a_h/d^h\rfloor \},a_{h-1}:=a_h-p_h{d}^h.$$

If the cap is inactive, then $a_{h-1}\le d^h-1\le J(d^h-1)$. If it is active, then $a_{h-1}\le J(d^{h+1}-1)-J(d-1)d^h=J(d^h-1)$. Thus the invariant propagates, and at $h=0$ it gives $a_{-1}=0$. When $J=1$, this is the ordinary base-d expansion. Moreover, linearity of the index map gives

$$ind({lift}_J\left(a\right)+{lift}_J\left(b\right))=a+b$$

whenever both bounded lifts are defined.

3.3. Sparse Quadratic Encoding

Let $\phi$ be a 3SAT formula of encoding length N. Delete tautological clauses, repeated literals, and unused variables. If deleting repeated literals leaves a clause with fewer than three literals, repeat one of the survivors until it has exactly three; this changes neither the truth value of the clause nor the analysis below, in which two of the three falsity bits then coincide. The cases of an empty clause and of no remaining clauses are handled by fixed promise instances.

Give every occurrence of a variable its own bit, and tie the occurrences of one global variable to its lexicographically first occurrence by equalities. This keeps the number of equalities linear in the number of occurrences, rather than quadratic. For a clause with falsity bits ${\beta }_0,{\beta }_1,{\beta }_2$, introduce one auxiliary bit y and impose $y+{\beta }_0{\beta }_1=0$ and $y{\beta }_2=0$. Adjoin one homogenizing coordinate and let $z=(z_0,z_1,\dots ,z_n)$ collect it together with all occurrence and auxiliary bits, where $z_0$ is the homogenizing coordinate. For each falsity bit ${\beta }_t$, let ${\tilde{\beta }}_t$ be $z_a$ or $z_a+z_0$, according as the corresponding literal is negated or unnegated. The clause equations become $y{z}_0+{\tilde{\beta }}_0{\tilde{\beta }}_1=0$ and $y{\tilde{\beta }}_2=0$, while an occurrence equality becomes $z_0(z_a+z_b)=0$. Thus every constraint above becomes a homogeneous quadratic form $h\left(z\right):={\sum }_{i=0}^n{\sum }_{j=0}^n{h}_{i,j}{z}_i{z}_j$ with at most five nonzero coefficients, since each falsity bit is either a coordinate or the sum of a coordinate and $z_0$. Let $h^{\left(1\right)},\dots ,h^{\left(L\right)}$ be the encoding forms. Both n and L are $O\left(N\right)$.

Lemma 

(Sparse quadratic encoding). The formula φ is satisfiable if and only if there is $x\in {\mathbb{F}}_2^n$ such that $z:=(1,x)$ satisfies $h^{\left(m\right)}\left(z\right)=0$ for every $m\in \left[L\right]$.

Proof. 

Set $z_0=1$. The equalities force all occurrences of one global variable to agree, so the occurrence bits define a Boolean assignment, and conversely. Fix a clause and its falsity bits. If ${\beta }_0{\beta }_1=0$, then the first equation forces $y=0$ and the second holds for every ${\beta }_2$. If ${\beta }_0={\beta }_1=1$, then the first equation forces $y=1$ and the second forces ${\beta }_2=0$, so the third literal is true. If ${\beta }_0={\beta }_1={\beta }_2=1$, the two equations are inconsistent. Hence the pair is solvable in y exactly when ${\beta }_0{\beta }_1{\beta }_2=0$, which is exactly the condition that the clause is satisfied. □

3.4. Axis-Wise Interpolation and Multi-Axis Exponent Reconstruction

Let $\mathbb{E}$ be an extension of $\mathbb{K}$ of degree $c:=[\mathbb{E}:\mathbb{K}]$, generated by $\zeta$, and chosen so that $c{log}_{2}q\ge n$. Fix $y_1,\dots ,y_n\in \mathbb{E}$ that are linearly independent over ${\mathbb{F}}_2$; such elements exist because $[\mathbb{E}:{\mathbb{F}}_2]=c{log}_{2}q\ge n$. For $x\in {\mathbb{F}}_2^n$, we define the assignment encoding

$$enc\left(x\right):={\displaystyle \sum _{i=1}^n}{y}_i{x}_i\in \mathbb{E}.$$

Since the $y_i$ are independent over ${\mathbb{F}}_2$, the map $x\mapsto enc\left(x\right)$ is injective.

We define the moment threshold $\kappa :=d^r$. The point of the reconstruction is that $\kappa$ consecutive powers of $enc\left(x\right)$ are carried by r axis polynomials whose degrees grow only with d.

Lemma 

(Axis-wise interpolation). For every $x\in {\mathbb{F}}_2^n$ and every $0\le j<r$ there is a unique $P_{x,j}\in \mathbb{K}\left[X\right]$ with $deg{P}_{x,j}<c$ and $P_{x,j}\left(\zeta \right)=enc{\left(x\right)}^{d^j}$. Its coefficients are ${\mathbb{F}}_2$-linear functions of x.

Proof. 

The set $\{1,\zeta ,\dots ,{\zeta }^{c-1}\}$ is a $\mathbb{K}$-basis of $\mathbb{E}$, so every element of $\mathbb{E}$ is $\psi \left(\zeta \right)$ for a unique $\psi \in \mathbb{K}\left[X\right]$ of degree less than c, which gives existence and uniqueness. Since $d^j$ is a power of two and $x_i^{d^j}=x_i$, the Frobenius map gives

$$enc{\left(x\right)}^{d^j}={\displaystyle \sum _{i=1}^n}{y}_i^{d^j}{x}_i.$$

Writing $y_i^{d^j}={\sum }_{l=0}^{c-1}{\gamma }_{i,j,l}{\zeta }^l$ with ${\gamma }_{i,j,l}\in \mathbb{K}$ gives $P_{x,j}\left(X\right)={\sum }_{l=0}^{c-1}\left({\sum }_{i=1}^n{\gamma }_{i,j,l}{x}_i\right)X^l$, whose coefficients are ${\mathbb{F}}_2$-linear in x. □

Lemma 

(Multi-axis exponent reconstruction). For every $x\in {\mathbb{F}}_2^n$ and every $p\in {\mathbb{Z}}_{\ge 0}^r$,

$${\displaystyle \prod _{h=0}^{r-1}}{P}_{x,h}{\left(\zeta \right)}^{p_h}=enc{\left(x\right)}^{ind\left(p\right)}.$$

Proof. 

By Lemma 3.3, the h-th factor contributes exponent $p_h{d}^h$ to $enc\left(x\right)$. The total exponent is therefore ${\sum }_{h=0}^{r-1}{p}_h{d}^h=ind\left(p\right)$, proving the claim. □

3.5. The Binary Affine System

We define the sample set $\mathcal{S}:=\mathbb{K}$ and the label set $\mathcal{L}:={\mathbb{K}}^r$. The synchronization step of Section 6 isolates atoms against a union of at most $n+1$ atom sets, so the moment window has to be wider than $(n+1)\kappa$. We collect the resulting budgets in one definition.

Definition 

(Window and degree parameters). We use four named budgets because different stages of the proof require different ranges.

First, define the synchronization factor by

$$W_{\mathrm{syn}}:=n+2.$$

It provides enough slack to combine the atom sets arising from the at most $n+1$ matrix entries in a linear-combination equation.

Second, define the isolation-window length by

$$W_{\mathrm{iso}}:=W_{\mathrm{syn}}(\kappa -1)+1.$$

This is the number of Hankel rows. The soundness proof uses the consecutive moments with indices $0\le k<W_{\mathrm{iso}}$ for recurrence propagation and Vandermonde isolation.

Third, define the largest exposed moment index by

$$W_{\mathrm{ind}}:=2W_{\mathrm{syn}}(\kappa -1).$$

The affine system exposes moments with indices $0\le k\le W_{\mathrm{ind}}$. Thus $W_{\mathrm{ind}}$ is an endpoint, rather than the length of an isolation window.

Finally, define the degree budget by

$$W_{\mathrm{deg}}:=2r{W}_{\mathrm{syn}}(d-1)(c-1).$$

It bounds the degrees of the interpolants obtained from products of the r axis polynomials: each admissible exponent is at most $2W_{\mathrm{syn}}(d-1)$ and each axis polynomial has degree less than c.

We require $q>2W_{\mathrm{deg}}$ and $\kappa \ge n+1$. The latter condition gives $(n+1)\kappa \le W_{\mathrm{iso}}$.

These four budgets determine both the allowed digit range and the moment indices exposed by the affine system. We now collect the multi-indices whose coordinates respect that range.

Definition 

(Admissible multi-indices). The admissible multi-index set is

$$\mathcal{P}:=\{p\in {\mathbb{Z}}_{\ge 0}^r:p_h\le 2W_{\mathrm{syn}}(d-1)\mathrm{for}\mathrm{all}h\}.$$

For every $p\in \mathcal{P}$, we have $ind\left(p\right)\le W_{\mathrm{ind}}$, so every admissible exponent lies in the exposed moment range.

For the row and column indices used below, we abbreviate $lift\left(a\right):={lift}_{W_{\mathrm{syn}}}\left(a\right)$ for $0\le a<W_{\mathrm{iso}}$.

For every $\ell \in \mathcal{L}$ and $s\in \mathcal{S}$ the system has one binary variable

$${\mathcal{T}}_{i,j,\ell ,s}\in {\mathbb{F}}_2(0\le i,j\le n),$$

so a coordinate of the system is named by a row index i, a column index j, a label ℓ, and a sample point s. For fixed ℓ and s these variables form the block ${\mathcal{T}}_{\ell ,s}\in {\mathbb{F}}_2^{(n+1)\times (n+1)}$ whose $(i,j)$ entry is ${\mathcal{T}}_{i,j,\ell ,s}$, and the whole table is denoted $\mathcal{T}$. The number of binary coordinates is therefore

$$M:={(n+1)}^2{q}^{r+1}.$$

(2)

Definition 

(Weighted interpolants).

The following quantities are derived linearly from the table $\mathcal{T}$. For $0\le i,j\le n$, $p\in \mathcal{P}$, and $s\in \mathcal{S}$, the table is read through

$$f_{i,j,p}\left(s\right):=\sum _{\ell \in \mathcal{L}}{\mathcal{T}}_{i,j,\ell ,s}{\displaystyle \prod _{h=0}^{r-1}}{\ell }_h^{p_h}\in \mathbb{K}.$$

For every $i,j$ and every $p\in \mathcal{P}$, let $F_{i,j,p}\in \mathbb{K}\left[X\right]$ be the unique polynomial of degree less than q satisfying $F_{i,j,p}\left(s\right)=f_{i,j,p}\left(s\right)$ for every $s\in \mathcal{S}$. Such a polynomial exists and is unique because $\mathcal{S}=\mathbb{K}$ has q distinct points.

These interpolants package the dependence on the sample point s into the polynomial variable X. We next bound their degrees and require that evaluation at $\zeta$ depend only on the exponent encoded by the multi-index.

Definition 

(Degree and exponent consistency). The following two families constrain the interpolants.

(a)

Bounded degree. For every $i,j$ and every $p\in \mathcal{P}$,

$$deg{F}_{i,j,p}\le W_{\mathrm{deg}}.$$

(b)

Index-fiber consistency. For every $0\le i,j\le n$ and all $p,p^{\prime }\in \mathcal{P}$ with $ind\left(p\right)=ind\left(p^{\prime }\right)$,

$$F_{i,j,p}\left(\zeta \right)=F_{i,j,p^{\prime }}\left(\zeta \right).$$

When these constraints hold, any two multi-indices with the same ind give the same value at $\zeta$. This allows us to replace the multi-indexed evaluations by a single sequence indexed by the scalar exponent k.

Definition 

(Exponent-indexed moments). For each $0\le k\le W_{\mathrm{ind}}$, fix once and for all a representative $p^{\left(k\right)}\in \mathcal{P}$ with $ind\left(p^{\left(k\right)}\right)=k$; such representatives exist by the greedy construction above with $J=2W_{\mathrm{syn}}$. For every $0\le i,j\le n$, we define

$$u_{i,j,k}:=F_{i,j,p^{\left(k\right)}}\left(\zeta \right).$$

Whenever the index-fiber consistency constraint holds, this equals $F_{i,j,p}\left(\zeta \right)$ for every $p\in \mathcal{P}$ with $ind\left(p\right)=k$.

The quantities $u_{i,j,k}$ are the scalar moments used in the soundness argument. We now impose the algebraic identities satisfied by the honest moments, coming from the doubling-is-squaring identity, the linear-combination identity, and the quadratic encoding.

Definition 

(Algebraic moment constraints). These three families constrain the moments. Let $W_{\mathrm{ind}}$ be the index budget defined in Definition 3.5.

(a)

Doubling is squaring. For every $0\le i,j\le n$ and every k with $2k\le W_{\mathrm{ind}}$,

$$u_{i,j,2k}=u_{i,j,k}^2.$$

(b)

Linear combination. For every $0\le j\le n$ and every k with $k+1\le W_{\mathrm{ind}}$,

$$u_{0,j,k+1}={\displaystyle \sum _{i=1}^n}{y}_i{u}_{i,j,k}.$$

(c)

Matrix inner product is zero. For every $m\in \left[L\right]$ and every $k\le W_{\mathrm{ind}}$,

$${\displaystyle \sum _{i=0}^n}{\displaystyle \sum _{j=0}^n}{h}_{i,j}^{\left(m\right)}{u}_{i,j,k}=0.$$

The preceding conditions constrain the table only through its derived moments. Two final conditions act directly on the table blocks, enforcing symmetry and normalizing the anchor entry.

Definition 

(Table symmetry and normalization). The following two families constrain the entries of the table $\mathcal{T}$ directly, without passing through the moments.

(a)

Symmetry in the matrix indices. ${\mathcal{T}}_{i,j,\ell ,s}={\mathcal{T}}_{j,i,\ell ,s}$ for all i, j, $\ell \in \mathcal{L}$ and $s\in \mathcal{S}$.

(b)

Row summation in $\mathcal{L}$ is one. ${\sum }_{\ell \in \mathcal{L}}{\mathcal{T}}_{0,0,\ell ,s}=1$ for every $s\in \mathcal{S}$.

The binary affine system $H\theta =b$ consists of the two families of Definition 3.8, the three families of Definition 3.10, and the two families of Definition 3.11.

Lemma 

(The system is affine). Every condition in Definitions 3.8, 3.10, and 3.11 is an affine condition over ${\mathbb{F}}_2$ on the table bits.

Proof. 

Each $f_{i,j,p}\left(s\right)$ is a fixed $\mathbb{K}$-linear combination of table bits, hence an ${\mathbb{F}}_2$-linear function of them; interpolation on $\mathcal{S}$ and evaluation at $\zeta$ are $\mathbb{K}$-linear and therefore ${\mathbb{F}}_2$-linear. Writing

$$F_{i,j,p}\left(X\right)={\displaystyle \sum _{a=0}^{q-1}}{\widehat{F}}_{i,j,p,a}{X}^a,$$

each coefficient ${\widehat{F}}_{i,j,p,a}\in \mathbb{K}$ is an ${\mathbb{F}}_2$-linear function of the table bits. Family Definition 3.8-[item:degree](a) is precisely the vanishing of these coefficients for $W_{\mathrm{deg}}<a<q$. Evaluation also shows that every $u_{i,j,k}$ is an ${\mathbb{F}}_2$-linear function of the table bits. The remaining families Definition 3.8-[item:folding](b), Definition 3.10-[item:identifier](b), Definition 3.10-[item:source](c), Definition 3.11-[item:symmetry](a), and Definition 3.11-[item:anchor](b) are then ${\mathbb{F}}_2$-linear or affine by inspection. For Definition 3.10-[item:frobenius](a), the map $\lambda \mapsto {\lambda }^2$ is the Frobenius automorphism of $\mathbb{E}$, which is ${\mathbb{F}}_2$-linear, so $u_{i,j,k}^2$ is an ${\mathbb{F}}_2$-linear function of the table bits as well. Expanding each $\mathbb{E}$-valued equation in an ${\mathbb{F}}_2$-basis of $\mathbb{E}$ turns every family into binary affine equations. □

Let $H\theta =b$ denote the resulting binary affine system, where $\theta$ collects the table bits.

Lemma 

(Completeness). If φ is satisfiable, then $H\theta =b$ has a binary solution of weight at most

$$R_1:=q{(n+1)}^2.$$

(3)

Proof. 

Let $x\in {\mathbb{F}}_2^n$ be as in Lemma 3.2 and put $z:=(1,x)$. At each sample point s, we define the honest label

$${\ell }_x\left(s\right):=(P_{x,0}\left(s\right),\dots ,P_{x,r-1}\left(s\right))\in \mathcal{L},$$

and we set ${\mathcal{T}}_{{\ell }_x\left(s\right),s}:=z{z}^{\top }$ and ${\mathcal{T}}_{\ell ,s}:=0$ for $\ell \ne {\ell }_x\left(s\right)$. Exactly one block is nonzero at each sample point, so the weight is $qwt{\left(z\right)}^2\le R_1$, which gives Eq. (3).

We verify the seven families. For every $p\in \mathcal{P}$,

$$f_{i,j,p}\left(s\right)=z_i{z}_j{\displaystyle \prod _{h=0}^{r-1}}{P}_{x,h}{\left(s\right)}^{p_h},$$

and the polynomial $z_i{z}_j{\prod }_{h=0}^{r-1}{P}_{x,h}^{p_h}$ has degree at most $\left({\sum }_{h=0}^{r-1}{p}_h\right)(c-1)\le 2r{W}_{\mathrm{syn}}(d-1)(c-1)=W_{\mathrm{deg}}$ by Lemma 3.3, so it is the unique interpolant of Definition 3.7, so $F_{i,j,p}=z_i{z}_j{\prod }_{h=0}^{r-1}{P}_{x,h}^{p_h}$; in particular, Definition 3.8-[item:degree](a) holds. Evaluating at $\zeta$ and applying Lemma 3.4 gives

$$u_{i,j,k}=z_i{z}_{j}enc{\left(x\right)}^k(0\le k\le W_{\mathrm{ind}}),$$

(4)

which depends only on $ind\left(p\right)=k$ and hence gives Definition 3.8-[item:folding](b). For Definition 3.10-[item:frobenius](a),

$$u_{i,j,2k}=z_i{z}_{j}enc{\left(x\right)}^{2k}={(z_i{z}_{j}enc{\left(x\right)}^k)}^2=u_{i,j,k}^2,$$

where the first step follows from Eq. (4), the second step follows from $z_i^2=z_i$ and $z_j^2=z_j$ together with the fact that squaring is additive in characteristic two, and the third step follows again from Eq. (4). For Definition 3.10-[item:identifier](b),

$${\displaystyle \sum _{i=1}^n}{y}_i{u}_{i,j,k}=z_{j}enc{\left(x\right)}^k{\displaystyle \sum _{i=1}^n}{y}_i{x}_i=z_{j}enc{\left(x\right)}^{k+1}=u_{0,j,k+1},$$

where the first step follows from Eq. (4) and $z_i=x_i$ for $i\ge 1$, the second step follows from the definition of $enc\left(x\right)$, and the third step follows from Eq. (4) and $z_0=1$. For Definition 3.10-[item:source](c), ${\sum }_{i=0}^n{\sum }_{j=0}^n{h}_{i,j}^{\left(m\right)}{u}_{i,j,k}=enc{\left(x\right)}^k{h}^{\left(m\right)}\left(z\right)=0$ by Lemma 3.2. Family Definition 3.11-[item:symmetry](a) holds because $z{z}^{\top }$ is symmetric, and Definition 3.11-[item:anchor](b) holds because $z_0^2=1$. □

4. Rank Loss and Determinantal Charging

A low-weight table cannot support a moment matrix of large rank. The reason is that rank is subadditive and is bounded by the number of nonzero bits, while a determinant of a large minor cannot vanish to high order at too many sample points. Charging the amount of rank lost at each sample point, rather than merely whether rank is lost there, is what keeps the estimate linear in the moment threshold.

We define the polynomial block matrix $\mathbf{U}\left(X\right)$, with rows indexed by $(i,a)$ and columns by $(j,b)$ for $0\le i,j\le n$, $0\le a<W_{\mathrm{iso}}$, and $0\le b<\kappa$, by

$$\mathbf{U}{\left(X\right)}_{(i,a),(j,b)}:=F_{i,j,lift\left(a\right)+lift\left(b\right)}\left(X\right).$$

This is well defined: the entries of $lift\left(a\right)+lift\left(b\right)$ are at most $2W_{\mathrm{syn}}(d-1)$, so $lift\left(a\right)+lift\left(b\right)\in \mathcal{P}$, and $ind(lift(a)+lift(b\left)\right)=a+b$. Consequently, whenever the index-fiber consistency family Definition 3.8-[item:folding](b) holds, $\mathbf{U}{\left(\zeta \right)}_{(i,a),(j,b)}=u_{i,j,a+b}$. The row window is wider than the column window, which is what the synchronization step of Section 6 consumes.

Lemma 

(Specialization). For every $\ell \in \mathcal{L}$, define $w_{\ell }\in {\mathbb{K}}^{W_{\mathrm{iso}}}$ and $w_{\ell }^{\prime }\in {\mathbb{K}}^{\kappa }$ by ${\left(w_{\ell }\right)}_a:={\prod }_{h=0}^{r-1}{\ell }_h^{lift{\left(a\right)}_h}$ and ${\left(w_{\ell }^{\prime }\right)}_b:={\prod }_{h=0}^{r-1}{\ell }_h^{lift{\left(b\right)}_h}$. Then, for every $s\in \mathcal{S}$,

$$\mathbf{U}\left(s\right)=\sum _{\ell \in \mathcal{L}}{\mathcal{T}}_{\ell ,s}\otimes w_{\ell }{\left(w_{\ell }^{\prime }\right)}^{\top },\mathrm{and}\mathrm{hence}rank\mathbf{U}\left(s\right)\le \sum _{\ell \in \mathcal{L}}wt\left({\mathcal{T}}_{\ell ,s}\right).$$

Proof. 

By Definition 3.7, the polynomial $F_{i,j,p}$ agrees with $f_{i,j,p}$ at every $s\in \mathcal{S}$, so

$$\mathbf{U}{\left(s\right)}_{(i,a),(j,b)}=\sum _{\ell \in \mathcal{L}}{\mathcal{T}}_{i,j,\ell ,s}{\displaystyle \prod _{h=0}^{r-1}}{\ell }_h^{lift{\left(a\right)}_h+lift{\left(b\right)}_h}=\sum _{\ell \in \mathcal{L}}{\mathcal{T}}_{i,j,\ell ,s}{\left(w_{\ell }\right)}_a{\left(w_{\ell }^{\prime }\right)}_b,$$

where the first step follows from the definition of $f_{i,j,p}$ applied to $p=lift\left(a\right)+lift\left(b\right)$, and the second step follows from the definitions of $w_{\ell }$ and $w_{\ell }^{\prime }$. This is the asserted Kronecker decomposition. Taking ranks,

$$rank\mathbf{U}\left(s\right)\le \sum _{\ell \in \mathcal{L}}rank({\mathcal{T}}_{\ell ,s}\otimes w_{\ell }{\left(w_{\ell }^{\prime }\right)}^{\top })\le \sum _{\ell \in \mathcal{L}}rank\left({\mathcal{T}}_{\ell ,s}\right)\le \sum _{\ell \in \mathcal{L}}wt\left({\mathcal{T}}_{\ell ,s}\right),$$

where the first step follows from subadditivity of rank, the second step follows because a Kronecker product with a rank-one matrix does not increase rank, and the third step follows because every matrix is the sum of as many rank-one matrices as it has nonzero entries. □

To aggregate rank losses across the sample points, we need a local connection between specialization rank and determinant vanishing. The next lemma provides this connection: a rank deficit ${\delta }_s$ forces the determinant to vanish to order at least ${\delta }_s$ at $X=s$.

Lemma 

(Determinantal divisor). Let $C\in \mathbb{K}{\left[X\right]}^{\kappa \times \kappa }$ and $s\in \mathbb{K}$, and define ${\delta }_s:=\kappa -rankC\left(s\right)$. If $detC\ne 0$, then ${(X-s)}^{{\delta }_s}$ divides $detC$.

Proof. 

Localize at $X-s$. The ring $\mathbb{K}{\left[X\right]}_{(X-s)}$ is a discrete valuation ring, so C admits a Smith normal form $C=E_1\Lambda E_2$ with $E_1,E_2$ invertible over that ring and $\Lambda$ diagonal with entries ${(X-s)}^{e_1},\dots ,{(X-s)}^{e_{\kappa }}$. Specializing at $X=s$ gives $rankC\left(s\right)=|\{t:e_t=0\}|$, so at least ${\delta }_s$ of the exponents are positive, and therefore ${ord}_{X-s}(detC)={\sum }_{t=1}^{\kappa }{e}_t\ge {\delta }_s$. □

The preceding lemma measures the rank lost at a sample point by the zero multiplicity of a nonzero minor. Summing these multiplicities over all sample points charges the total rank deficit to the degree of that minor, yielding the global weight bound below.

Lemma 

(Rank charging). Suppose the table satisfies Definition 3.8-[item:degree](a) and ${rank}_{\mathbb{K}\left(X\right)}\mathbf{U}\left(X\right)\ge \kappa$. Define $R_0:=\kappa (q-W_{\mathrm{deg}})$. Then

$$wt\left(\mathcal{T}\right)\ge R_0.$$

(5)

Proof. 

Since the rank is at least $\kappa$, there is a $\kappa \times \kappa$ submatrix $C\left(X\right)$ of $\mathbf{U}\left(X\right)$ with $\Delta :=detC\ne 0$. Every entry of $\mathbf{U}\left(X\right)$ has degree at most $W_{\mathrm{deg}}$ by Definition 3.8-[item:degree](a), so $deg\Delta \le \kappa W_{\mathrm{deg}}$. Setting ${\delta }_s:=\kappa -rankC\left(s\right)$, Lemma 4.2 gives ${(X-s)}^{{\delta }_s}\mid \Delta$ for every $s\in \mathcal{S}$, and distinct sample points give coprime factors, so

$$\sum _{s\in \mathcal{S}}{\delta }_s\le deg\Delta \le \kappa W_{\mathrm{deg}}.$$

Therefore

$$wt\left(\mathcal{T}\right)=\sum _{s\in \mathcal{S}}\sum _{\ell \in \mathcal{L}}wt\left({\mathcal{T}}_{\ell ,s}\right)\ge \sum _{s\in \mathcal{S}}rank\mathbf{U}\left(s\right)\ge \sum _{s\in \mathcal{S}}rankC\left(s\right)=\kappa q-\sum _{s\in \mathcal{S}}{\delta }_s\ge \kappa (q-W_{\mathrm{deg}}),$$

where the first step is the definition of the total weight, the second step follows from Lemma 4.1, the third step follows because $C\left(s\right)$ is a submatrix of $\mathbf{U}\left(s\right)$, the fourth step follows from the definition of ${\delta }_s$ and $\left|\mathcal{S}\right|=q$, and the fifth step follows from the displayed bound on ${\sum }_{s\in \mathcal{S}}{\delta }_s$. □

5. Short Recurrences and Atomic Moments

We now treat the complementary case, in which the moment matrix has rank below $\kappa$. A short recurrence gives a finite-dimensional recurrence algebra, which may initially contain generalized nilpotent components and arbitrary coefficient weights. The doubling-is-squaring condition in Definition 3.10-[item:frobenius](a) kills the nilradical and forces every surviving coefficient to be one, so each entrywise sequence is the plain sum over a set of fewer than $\kappa$ atoms. No bound on the global union is needed; synchronization later uses only constraint-local unions.

Lemma 

(Atomization). Let $\mathbb{E}$ have characteristic two and let ${\left(u_k\right)}_{k\ge 0}$ be a sequence in $\mathbb{E}$ satisfying a monic linear recurrence with characteristic polynomial $\chi \in \mathbb{E}\left[T\right]$ of degree $\rho \ge 1$, and suppose $u_{2k}=u_k^2$ for every $k<\rho$. Then there is a set Ξ of at most ρ distinct roots of χ in a splitting field with

$$u_k=\sum _{\xi \in \Xi }{\xi }^k(k\ge 0).$$

Proof. 

Let $\overline{\mathbb{E}}$ be a splitting field of $\chi$ and put $\mathcal{B}:=\overline{\mathbb{E}}\left[T\right]/\left(\chi \right)$. Define $g:\mathcal{B}\to \overline{\mathbb{E}}$ by $g(T^{k}mod\chi ):=u_k$. This is well defined, because the map $\overline{\mathbb{E}}\left[T\right]\to \overline{\mathbb{E}}$ sending $T^k$ to $u_k$ annihilates every multiple of $\chi$, which is precisely the recurrence at every shift.

We first show $g\left({\psi }^2\right)=g{\left(\psi \right)}^2$ for every $\psi \in \mathcal{B}$. Writing $\psi ={\sum }_{i=0}^{\rho -1}{a}_i{T}^i$ and using that squaring is additive in characteristic two, ${\psi }^2={\sum }_{i=0}^{\rho -1}{a}_i^2{T}^{2i}$, so

$$g\left({\psi }^2\right)={\displaystyle \sum _{i=0}^{\rho -1}}{a}_i^2{u}_{2i}={\displaystyle \sum _{i=0}^{\rho -1}}{a}_i^2{u}_i^2={\left({\displaystyle \sum _{i=0}^{\rho -1}}{a}_i{u}_i\right)}^2=g{\left(\psi \right)}^2,$$

where the first step follows from the definition of g, the second step follows from the hypothesis $u_{2i}=u_i^2$, available because $i<\rho$, the third step follows again from additivity of squaring, and the fourth step follows from the definition of g.

Next, g vanishes on the nilradical of $\mathcal{B}$. Indeed, let $\psi \in \mathcal{B}$ be nilpotent. Some power ${\psi }^{2^a}$ with $a\ge 0$ vanishes, and iterating the previous paragraph gives $g{\left(\psi \right)}^{2^a}=g\left({\psi }^{2^a}\right)=0$, so $g\left(\psi \right)=0$ because $\overline{\mathbb{E}}$ is a field.

Consequently g factors through ${\mathcal{B}}_{\mathrm{red}}:=\mathcal{B}/\mathrm{nil}\left(\mathcal{B}\right)$, where $\mathrm{nil}\left(\mathcal{B}\right)$ denotes the ideal of nilpotent elements of $\mathcal{B}$. By the Chinese remainder theorem, ${\mathcal{B}}_{\mathrm{red}}$ is a product of t copies of $\overline{\mathbb{E}}$, one for each of the t distinct roots ${\xi }_1,\dots ,{\xi }_t$ of $\chi$, where $t\le \rho$. Let ${\epsilon }_1,\dots ,{\epsilon }_t$ be the primitive idempotents and $c_{\nu }:=g\left({\epsilon }_{\nu }\right)$ for $1\le \nu \le t$. From ${\epsilon }_{\nu }^2={\epsilon }_{\nu }$ we get $c_{\nu }^2=c_{\nu }$, and in a field this forces $c_{\nu }\in \{0,1\}$.

Finally, the image of T in ${\mathcal{B}}_{\mathrm{red}}$ is ${\sum }_{\nu =1}^t{\xi }_{\nu }{\epsilon }_{\nu }$, so $T^k$ maps to ${\sum }_{\nu =1}^t{\xi }_{\nu }^k{\epsilon }_{\nu }$ and $u_k=g\left(T^k\right)={\sum }_{\nu =1}^t{c}_{\nu }{\xi }_{\nu }^k$. Taking $\Xi :=\{{\xi }_{\nu }:c_{\nu }=1\}$ completes the proof, and $\left|\Xi \right|\le t\le \rho$. □

When the polynomial moment matrix has rank $\rho <\kappa$, its entries satisfy algebraic dependencies of bounded order. The next lemma converts this rank deficiency into a short linear recurrence for each scalar moment sequence, providing the starting point for the atomization argument.

Lemma 

(Short recurrence). Suppose the table satisfies the index-fiber consistency family Definition 3.8-[item:folding](b) and $\rho :={rank}_{\mathbb{K}\left(X\right)}\mathbf{U}\left(X\right)<\kappa$. Then for every $i,j$ there is a monic linear recurrence of order ${\rho }_{i,j}\le \rho$ (where order zero means that the sequence vanishes) satisfied by ${\left(u_{i,j,k}\right)}_k$ at every index

$${\rho }_{i,j}\le k<{\rho }_{i,j}+W_{\mathrm{iso}}.$$

Proof. 

All minors of $\mathbf{U}\left(X\right)$ of size $\rho +1$ vanish identically, hence also after substituting $X=\zeta$, so ${rank}_{\mathbb{E}}\mathbf{U}\left(\zeta \right)\le \rho$. By the folding hypothesis, fixing i and j and letting $a<W_{\mathrm{iso}}$ and $b<\kappa$ range gives the Hankel submatrix $\left(u_{i,j,a+b}\right)$ of $\mathbf{U}\left(\zeta \right)$, whose rank is therefore at most $\rho$. Hence its first $\rho +1$ columns are linearly dependent. Let ${\rho }_{i,j}\le \rho$ be minimal such that its columns $c_0,\dots ,c_{{\rho }_{i,j}}$ are linearly dependent; such an index exists because the rank is at most $\rho <\kappa$. By minimality $c_0,\dots ,c_{{\rho }_{i,j}-1}$ are independent, so $c_{{\rho }_{i,j}}$ is a combination of them, which is a monic recurrence of order ${\rho }_{i,j}$ holding at every row index $a<W_{\mathrm{iso}}$, that is, at every index $k=a+{\rho }_{i,j}$ with $a<W_{\mathrm{iso}}$. □

Because the recurrence of Lemma 5.2 is verified at every row index below $W_{\mathrm{iso}}$, the sequence it extends agrees with the true moments on the whole window $0\le k<W_{\mathrm{iso}}$, and Lemma 5.1 applies with ${\rho }_{i,j}\le \rho <\kappa \le W_{\mathrm{iso}}$. This gives the following form of the moments. The atom sets are indexed entrywise, and no claim is made that one set serves all entries; the synchronization is carried out constraint by constraint in Section 6, where each constraint couples at most $n+1$ entries.

Lemma 5.2 gives a short recurrence for each moment sequence, but a recurrence alone may still involve arbitrary coefficients and repeated roots. The Frobenius identity removes this ambiguity by forcing the sequence to be a sum of pure exponentials with distinct atoms and unit coefficients, as formalized next.

Lemma 

(Atomic moments). Suppose the table satisfies Definition 3.8-[item:folding](b) and Definition 3.10-[item:frobenius](a), and suppose $\rho :={rank}_{\mathbb{K}\left(X\right)}\mathbf{U}\left(X\right)<\kappa$. Then for every $i,j$ there is a set ${\Xi }_{i,j}$ of at most ρ distinct elements of a fixed algebraic closure of $\mathbb{E}$ with

$$u_{i,j,k}=\sum _{\xi \in {\Xi }_{i,j}}{\xi }^k(0\le k<W_{\mathrm{iso}}).$$

(6)

Consequently, for any set $\mathcal{F}$ of at most $n+1$ index pairs, the union ${\Xi }_{\mathcal{F}}:={\bigcup }_{(i,j)\in \mathcal{F}}{\Xi }_{i,j}$ satisfies $|{\Xi }_{\mathcal{F}}|\le (n+1)\rho <(n+1)\kappa \le W_{\mathrm{iso}}$.

Proof. 

Fix $i,j$ and let ${\rho }_{i,j}$ be the order supplied by Lemma 5.2. If ${\rho }_{i,j}=0$, then the relation produced there reads $u_{i,j,k}=0$ for every $k<W_{\mathrm{iso}}$, and ${\Xi }_{i,j}:=\varnothing$ satisfies Eq. (6) on the whole window, so we may assume ${\rho }_{i,j}\ge 1$ below. Its characteristic polynomial is called ${\chi }_{i,j}$, and the recurrence is valid at every index ${\rho }_{i,j}\le k<{\rho }_{i,j}+W_{\mathrm{iso}}$. Let ${\left({\tilde{u}}_k\right)}_{k\ge 0}$ be the sequence determined by the first ${\rho }_{i,j}$ moments and by that recurrence. By induction on k, ${\tilde{u}}_k=u_{i,j,k}$ for every $k<W_{\mathrm{iso}}+{\rho }_{i,j}$, and in particular on the window $0\le k<W_{\mathrm{iso}}$: the two agree below ${\rho }_{i,j}$ by construction, and for ${\rho }_{i,j}\le k<W_{\mathrm{iso}}+{\rho }_{i,j}$ the recurrence expresses both in the same way from earlier terms.

Since ${\rho }_{i,j}\le \kappa -1$ and $W_{\mathrm{syn}}\ge 1$, $W_{\mathrm{iso}}+{\rho }_{i,j}-1\le (W_{\mathrm{syn}}+1)(\kappa -1)\le W_{\mathrm{ind}}$. Moreover, whenever $0\le k<{\rho }_{i,j}$, $2k\le 2{\rho }_{i,j}-2\le 2(\kappa -2)\le W_{\mathrm{ind}}$.

For every $0\le k<{\rho }_{i,j}$, both k and $2k$ lie in the range on which $\tilde{u}$ agrees with $u_{i,j,·}$, and $2k\le W_{\mathrm{ind}}$. Hence the doubling-is-squaring condition gives

$${\tilde{u}}_{2k}=u_{i,j,2k}=u_{i,j,k}^2={\tilde{u}}_k^2.$$

Thus Lemma 5.1 applies to $\tilde{u}$ and produces a set ${\Xi }_{i,j}$ of at most ${\rho }_{i,j}$ distinct roots of ${\chi }_{i,j}$ with ${\tilde{u}}_k={\sum }_{\xi \in {\Xi }_{i,j}}{\xi }^k$ for every $k\ge 0$, which is Eq. (6) on the window where $\tilde{u}$ and $u_{i,j,·}$ agree.

The final bound is immediate: a union of at most $n+1$ sets of size at most $\rho$ has at most $(n+1)\rho$ elements, and $(n+1)\kappa \le W_{\mathrm{iso}}$ holds by the choice of $W_{\mathrm{iso}}$ and the requirement $\kappa \ge n+1$. □

Remark 5.4.

It is tempting to shorten the argument by writing the block Hankel matrix as $\mathbf{U}\left(\zeta \right)={\sum }_{\xi \in \Xi }{\mathbb{1}}_{\xi }\otimes v_{\xi }{v}_{\xi }^{\top }$ with $v_{\xi }={\left({\xi }^a\right)}_a$ and concluding $rank\mathbf{U}\left(\zeta \right)={\sum }_{\xi \in \Xi }rank{\mathbb{1}}_{\xi }$, which would bound the total number of atoms by $\rho$ and make the synchronization immediate. The standard factorization proving that identity uses linear independence of the vectors $v_{\xi }$. Without this hypothesis the identity need not hold. Over ${\mathbb{F}}_4$, take the atoms 0, 1, and p with $p^2+p+1=0$, two moment coordinates $v_{\xi }={(1,\xi )}^{\top }$, and ${\mathbb{1}}_{\xi }=\left[1\right]$ for each of the three atoms. Then ${\sum }_{\xi \in \{0,1,p\}}rank{\mathbb{1}}_{\xi }=3$, whereas

$$\sum _{\xi \in \{0,1,p\}}{v}_{\xi }{v}_{\xi }^{\top }=\left(\begin{array}{cc}1& p^2\\ p^2& p\end{array}\right)$$

has determinant $p+p^4=0$ and hence rank one. This is why the argument above keeps the atom sets entrywise and pays for the union with the synchronization factor $W_{\mathrm{syn}}$.

6. Soundness Criterion

We now combine the two cases. If the table is light, rank charging forces the moment matrix to have rank below $\kappa$. Atomization then represents every matrix entry through its own set of fewer than $\kappa$ atoms, and constraint-local Vandermonde isolation synchronizes precisely the entries in each linear-combination, symmetry, encoding, or anchor equation and recovers a satisfying assignment.

Lemma 

(Isolation). Let $\mathbb{L}$ be a field, let $\Xi \subseteq \mathbb{L}$ be finite with distinct elements, and let ${\left(c_{\xi }\right)}_{\xi \in \Xi }\subseteq \mathbb{L}$ satisfy ${\sum }_{\xi \in \Xi }{c}_{\xi }{\xi }^k=0$ for every $0\le k<\left|\Xi \right|$. Then $c_{\xi }=0$ for every ξ.

Proof. 

The system has coefficient matrix ${\left({\xi }^k\right)}_{\xi \in \Xi ,0\le k<\left|\Xi \right|}$, which is a Vandermonde matrix on the distinct elements of $\Xi$ and hence invertible. □

The preceding lemmas provide two complementary tools: rank charging rules out low-weight solutions in the high-rank case, while atomization and Vandermonde isolation decode a satisfying assignment in the low-rank case. The next lemma combines these two branches. It shows that every solution lighter than $R_0$ must arise from a satisfiable formula.

Lemma 

(Soundness criterion). Assume $n\ge 4$. Suppose a binary solution of $H\theta =b$ has weight less than $R_0=\kappa (q-W_{\mathrm{deg}})$. Then φ is satisfiable.

Proof. 

Because the binary vector solves $H\theta =b$, it satisfies Definition 3.8-[item:degree](a). Lemma 4.3 in contrapositive form therefore gives $\rho :={rank}_{\mathbb{K}\left(X\right)}\mathbf{U}\left(X\right)<\kappa$. The solution also satisfies Definition 3.8-[item:folding](b) and Definition 3.10-[item:frobenius](a), so Lemma 5.3 gives entrywise atom sets ${\Xi }_{i,j}$ of size at most $\rho$ with Eq. (6) valid for $0\le k<W_{\mathrm{iso}}$. We define

$${\mathbb{1}}_{\xi }(i,j):=1\mathrm{if}\xi \in {\Xi }_{i,j}\mathrm{and}{\mathbb{1}}_{\xi }(i,j):=0\mathrm{otherwise},$$

and we let $\Xi :={\bigcup }_{0\le i,j\le n}{\Xi }_{i,j}$, so that $u_{i,j,k}={\sum }_{\xi \in \Xi }{\mathbb{1}}_{\xi }(i,j){\xi }^k$ for $0\le k<W_{\mathrm{iso}}$. No bound on the total number of atoms is claimed. Each constraint below couples at most $n+1$ entries, so by Lemma 5.3 the union ${\Xi }_{\mathcal{F}}$ of the atom sets it involves has fewer than $W_{\mathrm{iso}}$ elements, and Lemma 6.1 applies to it on the window $0\le k<W_{\mathrm{iso}}$.

Symmetry. By Definition 3.11-[item:symmetry](a), $f_{i,j,p}\left(s\right)=f_{j,i,p}\left(s\right)$ for every $p\in \mathcal{P}$ and $s\in \mathcal{S}$. Uniqueness of interpolation gives $F_{i,j,p}=F_{j,i,p}$, and Definition 3.9 hence gives $u_{i,j,k}=u_{j,i,k}$ for every $k<W_{\mathrm{iso}}$. The two entries involve at most $2\rho <W_{\mathrm{iso}}$ atoms, so Lemma 6.1 applied to the differences gives ${\mathbb{1}}_{\xi }(i,j)={\mathbb{1}}_{\xi }(j,i)$ for every $\xi$.

Linear combination. By Definition 3.10-[item:identifier](b), for every j and every $0\le k<W_{\mathrm{iso}}-1$,

$$\sum _{\xi \in \Xi }({\mathbb{1}}_{\xi }(0,j)\xi +{\displaystyle \sum _{i=1}^n}{y}_i{\mathbb{1}}_{\xi }(i,j)){\xi }^k=0,$$

where we used Eq. (6) on both sides of Definition 3.10-[item:identifier](b) and collected the coefficient of ${\xi }^k$. This relation involves the $n+1$ entries $(0,j)$ and $(i,j)$ for $1\le i\le n$, whose atom sets have union of size at most $(n+1)\rho \le (n+1)(\kappa -1)\le W_{\mathrm{iso}}-1$. Thus the $W_{\mathrm{iso}}-1$ moments indexed by $0\le k<W_{\mathrm{iso}}-1$ suffice, and Lemma 6.1 gives

$${\mathbb{1}}_{\xi }(0,j)\xi ={\displaystyle \sum _{i=1}^n}{y}_i{\mathbb{1}}_{\xi }(i,j)(\xi \in \Xi ,0\le j\le n).$$

(7)

Structure of the coefficient matrices. Fix $\xi$ with ${\mathbb{1}}_{\xi }\ne 0$. If ${\mathbb{1}}_{\xi }(0,j)=0$, then Eq. (7) gives ${\sum }_{i=1}^n{y}_i{\mathbb{1}}_{\xi }(i,j)=0$, and the $y_i$ are independent over ${\mathbb{F}}_2$, so the whole column j vanishes. Hence there is some j with ${\mathbb{1}}_{\xi }(0,j)=1$, and for every such j Eq. (7) gives $\xi ={\sum }_{i=1}^n{y}_i{\mathbb{1}}_{\xi }(i,j)=enc\left(x\right)$ with $x_i:={\mathbb{1}}_{\xi }(i,j)$. Since $x\mapsto enc\left(x\right)$ is injective, this vector is the same for all such j; call it $x_{\xi }$ and put $z_{\xi }:=(1,x_{\xi })$. Every column of ${\mathbb{1}}_{\xi }$ is therefore ${\mathbb{1}}_{\xi }(0,j)z_{\xi }$, that is, ${\mathbb{1}}_{\xi }=z_{\xi }{a}_{\xi }^{\top }$ with ${\left(a_{\xi }\right)}_j:={\mathbb{1}}_{\xi }(0,j)$. Symmetry gives ${\left(a_{\xi }\right)}_j={\mathbb{1}}_{\xi }(0,j)={\mathbb{1}}_{\xi }(j,0)={\left(z_{\xi }\right)}_j{\left(a_{\xi }\right)}_0$. If ${\left(a_{\xi }\right)}_0=0$ then $a_{\xi }=0$ and ${\mathbb{1}}_{\xi }=0$, contrary to assumption, so ${\left(a_{\xi }\right)}_0=1$ and

$${\mathbb{1}}_{\xi }=z_{\xi }{z}_{\xi }^{\top },\xi =enc\left(x_{\xi }\right),{\mathbb{1}}_{\xi }(0,0)=1.$$

(8)

Encoding equations. By Definition 3.10-[item:source](c), for every encoding form $h^{\left(m\right)}$ and every $0\le k<W_{\mathrm{iso}}$, using that $h^{\left(m\right)}$ has at most five nonzero coefficients and hence involves at most five entries, ${\sum }_{\xi \in \Xi }\left({\sum }_{i=0}^n{\sum }_{j=0}^n{h}_{i,j}^{\left(m\right)}{\mathbb{1}}_{\xi }(i,j)\right){\xi }^k=0$ with at most $5\rho <W_{\mathrm{iso}}$ atoms involved, so Lemma 6.1 gives ${\sum }_{i=0}^n{\sum }_{j=0}^n{h}_{i,j}^{\left(m\right)}{\mathbb{1}}_{\xi }(i,j)=0$ for every $\xi \in \Xi$. Substituting Eq. (8) turns this into $h^{\left(m\right)}\left(z_{\xi }\right)=0$.

Nonemptiness. By Definition 3.11-[item:anchor](b), $f_{0,0,0}\left(s\right)=1$ for every s, so the interpolant of Definition 3.7 is the constant polynomial 1 and Definition 3.9 gives $u_{0,0,0}=1$. By Eq. (6) and Eq. (8), $u_{0,0,0}={\sum }_{\xi \in \Xi }{\mathbb{1}}_{\xi }(0,0)$ counts modulo two the atoms with ${\mathbb{1}}_{\xi }\ne 0$, so that number is odd and in particular nonzero.

Pick any $\xi$ with ${\mathbb{1}}_{\xi }\ne 0$. Then $z_{\xi }=(1,x_{\xi })$ satisfies every encoding form, so $\phi$ is satisfiable by Lemma 3.2. □

7. Hardness of Binary Nearest Codeword and Syndrome Decoding

It remains to choose the parameters. The radix d controls both the moment threshold $\kappa =d^r$ and the degree budget $W_{\mathrm{deg}}$, but it enters them very differently: $\kappa$ grows like $d^r$, whereas $W_{\mathrm{deg}}$ grows only linearly in d. Since the sample field is taken greater than $2W_{\mathrm{deg}}$, the gap $\kappa$ can be made almost as large as $q^r$, and the block length pays $q^{r+1}$. The ratio of these two exponents is what produces $r/(r+1)$.

Theorem 

(Main result, formal version of Theorem 1.8). Fix an integer $r\ge 1$ and a real $0<ϵ<r/(r+1)$. Then ${GapNCP}_{M^{{\displaystyle \frac{r}{r+1}}-ϵ}}$ and ${GapSD}_{M^{{\displaystyle \frac{r}{r+1}}-ϵ}}$ are NP-hard under deterministic polynomial-time many-one reductions, where M is the binary block length. Consequently, binary nearest codeword and binary syndrome decoding are NP-hard to approximate within $M^{{\displaystyle \frac{r}{r+1}}-ϵ}$. For every fixed $0<ϵ<1$, their corresponding gap problems are NP-hard with factor $M^{1-ϵ}$, and the optimization problems are NP-hard to approximate within the same factor.

Proof. 

Because r and $ϵ$ are fixed rather than part of the input, all constants depending on them are hardwired into the reduction. If $ϵ$ is irrational, choose a rational $0<{ϵ}^{\prime }<ϵ$; hardness for the larger factor obtained with ${ϵ}^{\prime }$ implies the claimed factor by monotonicity.

Let $\phi$ have encoding length N, and let n and L be as in Lemma 3.2, so $n,L=O\left(N\right)$. Fix an integer $B\ge 3$, depending only on the fixed r and $ϵ$, as chosen below. All sufficiently-large-n thresholds below are therefore constants. By adjoining unused Boolean variables before fixing the remaining parameters, we may assume that $n\ge 8$ and that n exceeds all these thresholds. This preserves satisfiability and the sparsity of the encoding forms, and still gives $n=O\left(N\right)$. Every parameter below is a function of n alone, and the exponent is measured against M, so no lower bound on n in terms of N is needed. We define d to be the least power of two with $d\ge n^B$, and

$$\kappa :=d^r,q:=\mathrm{the}\mathrm{least}\mathrm{power}\mathrm{of}\mathrm{two}\mathrm{with}q\ge 12rd{n}^2,c:=\lceil n/{log}_{2}q\rceil .$$

Then $d\ge 2$ and $\kappa \ge n+1$, as Section 3 requires. We let $\mathbb{E}$ be the field with $q^c$ elements, which contains $\mathbb{K}={\mathbb{F}}_q$, we let $\zeta$ generate $\mathbb{E}$ over $\mathbb{K}$, and we let $y_1,\dots ,y_n$ be the first n members of an ${\mathbb{F}}_2$-basis of $\mathbb{E}$, which exist because $[\mathbb{E}:{\mathbb{F}}_2]=c{log}_{2}q\ge n$.

The parameter inequalities. We first check $q>2W_{\mathrm{deg}}$. Indeed

$$W_{\mathrm{deg}}=2r{W}_{\mathrm{syn}}(d-1)(c-1)<{\displaystyle \frac{4rd{n}^2}{{log}_{2}q}}\le {\displaystyle \frac{q}{3{log}_{2}q}}\le {\displaystyle \frac{q}{12}}<{\displaystyle \frac{q}{4}},$$

where the first step follows from Definition 3.5, together with $W_{\mathrm{syn}}=n+2\le 2n$, $d-1\le d$, and $c-1<n/{log}_{2}q$, the second step follows from $q\ge 12rd{n}^2$, and the third step follows from ${log}_{2}q\ge 4$. Hence $q-W_{\mathrm{deg}}\ge 3q/4$, and by Eq. (5)

$$R_0=\kappa (q-W_{\mathrm{deg}})\ge {\displaystyle \frac{3\kappa q}{4}}.$$

The gap. By Eq. (2) and Eq. (3),

$$M={(n+1)}^2{q}^{r+1},R_1=q{(n+1)}^2,{\displaystyle \frac{R_0}{R_1}}\ge {\displaystyle \frac{3\kappa }{4{(n+1)}^2}}.$$

Since $d=\Theta \left(n^B\right)$ and $q=\Theta \left(rd{n}^2\right)$ up to one factor of two, taking logarithms base n gives

$${log}_{n}M=(r+1)(B+2)+2+o\left(1\right),{log}_n{\displaystyle \frac{R_0}{R_1}}=Br-2+o\left(1\right),$$

where r and B are constants and the $o\left(1\right)$ terms tend to zero as n grows. We define the fixed exponent

$${\delta }_{r,B}:={\displaystyle \frac{Br-2}{B(r+1)+2r+4}},$$

(9)

which is the ratio of the two displayed quantities in the limit. As B tends to infinity ${\delta }_{r,B}$ tends to $r/(r+1)$, so we may fix B with ${\delta }_{r,B}>r/(r+1)-ϵ/2$. Writing $\delta :=r/(r+1)-ϵ$ for the target exponent, the strict inequality $\delta <{\delta }_{r,B}$ leaves positive slack, so

$${\displaystyle \frac{R_0}{R_1}}\ge 2M^{\delta }$$

once n exceeds a fixed threshold. By the preceding padding, every instance entering the construction satisfies this threshold.

Completeness and soundness. Lemma 3.13 gives a solution of weight at most $R_1$ whenever $\phi$ is satisfiable, and Lemma 6.2 gives, in contrapositive form, that if $\phi$ is unsatisfiable then every solution has weight at least $R_0$. Writing $W(H,b):=min\{wt(\theta ):H\theta =b\}$ for a consistent system,

$$\begin{array}{cc}\hfill \phi \mathrm{satisfiable}& \Rightarrow W(H,b)\le R_1,\hfill \\ \hfill \phi \mathrm{unsatisfiable}\mathrm{and}H\theta =b\mathrm{consistent}& \Rightarrow W(H,b)\ge 2M^{\delta }{R}_1>M^{\delta }{R}_1.\hfill \end{array}$$

Conversion. Gaussian elimination computes a solution ℓ of $H\ell =b$ and a generator matrix of the binary linear code $\mathcal{C}:={ker}_{{\mathbb{F}}_2}H$. The solution set of $H\theta =b$ is the coset $\ell +\mathcal{C}$, so

$${dist}_H(\ell ,\mathcal{C})=\underset{c\in \mathcal{C}}{min}wt(\ell +c)=min\{wt\left(\theta \right):H\theta =b\}=W(H,b),$$

where the first step follows from the definition of Hamming distance together with $\ell -c=\ell +c$ over ${\mathbb{F}}_2$, the second step follows because the solution set is $\ell +\mathcal{C}$, and the third step follows from the definition of $W(H,b)$. Output $\mathcal{C}$, the target ℓ, and the radius $R_1$; its block length is M. For syndrome decoding, output H, the syndrome b, and the radius $R_1$, whose optimum is $W(H,b)$ and whose block length is again M.

Exceptional branches. If preprocessing finds an empty clause, or if $H\theta =b$ is inconsistent, then $\phi$ is unsatisfiable, the second case because a satisfiable formula produces a solution by Lemma 3.13. For nearest codeword output the fixed code $\left\{00\right\}$, the target 11, and the radius 1, whose distance is 2; for syndrome decoding output $H:=I_2$, the syndrome $b:=11$, and the radius 1, whose optimum is also 2. If no clauses remain, then $\phi$ is satisfiable; output the code $\left\{00\right\}$ with target 00 and radius 1, or the syndrome instance $H:=I_2$ with $b:=00$ and radius 1, both of optimum zero.

Running time. For fixed r and B we have $d,q=n^{O\left(1\right)}$ and $c=O\left(n\right)$, so $M={(n+1)}^2{q}^{r+1}=n^{O\left(1\right)}$, which is $N^{O\left(1\right)}$ because $n=O\left(N\right)$. Write $q=2^m$. By Shoup’s deterministic construction [28], first over ${\mathbb{F}}_2$ in degree m and then over the resulting representation of ${\mathbb{F}}_q$ in degree c, we can construct ${\mathbb{F}}_q$ and a monic irreducible polynomial $h\in {\mathbb{F}}_q\left[T\right]$ of degree c in time polynomial in $logq$ and c; the small-characteristic guarantee applies because the characteristic is two. Any polynomial-factorization steps over the fixed prime field ${\mathbb{F}}_2$ are deterministic and polynomial-time, so this construction introduces no randomized subroutine. Set $\mathbb{E}:={\mathbb{F}}_q\left[T\right]/\left(h\right)$ and $\zeta :=Tmodh$. The product of the standard bases of ${\mathbb{F}}_q$ over ${\mathbb{F}}_2$ and of $\mathbb{E}$ over ${\mathbb{F}}_q$ gives the explicit ${\mathbb{F}}_2$-basis from which $y_1,\dots ,y_n$ are selected, and elements of $\mathbb{E}$ are stored as c-tuples over ${\mathbb{F}}_q$. The interpolation matrix on $\mathcal{S}=\mathbb{K}$ and its inverse are computed over $\mathbb{K}$, so all coefficients ${\widehat{F}}_{i,j,p,a}$ are explicit linear forms. We impose ${\widehat{F}}_{i,j,p,a}=0$ for $a>W_{\mathrm{deg}}$. There are $O\left({(n+1)}^2\right|\mathcal{P}\left|q\right)$ coefficient conditions, $O\left({(n+1)}^2\right|\mathcal{P}{|}^2)$ equal-exponent conditions, $O\left({(n+1)}^2{W}_{\mathrm{ind}}\right)$ Frobenius conditions, $O\left(n{W}_{\mathrm{ind}}\right)$ linear-combination conditions, $O\left(L{W}_{\mathrm{ind}}\right)$ encoding conditions, and $O\left(M\right)$ direct table conditions. A $\mathbb{K}$-valued condition expands into ${log}_{2}q$ binary equations, and an $\mathbb{E}$-valued condition expands into $c{log}_{2}q$ binary equations. Since $L=O\left(N\right)$ and $\left|\mathcal{P}\right|,q,W_{\mathrm{ind}},M=N^{O\left(1\right)}$, all conditions can be enumerated in polynomial time. Gaussian elimination is polynomial. Hence the whole mapping is deterministic polynomial time.

Conclusion. An $M^{\delta }$-approximation algorithm for either problem would compare its returned cost with $M^{\delta }{R}_1$ and thereby distinguish the two cases, so no such algorithm exists unless $\mathrm{P}=\mathrm{NP}$. Since $\delta =r/(r+1)-ϵ$, this proves the first claim. For the second, given $0<ϵ<1$ choose $r\ge 2/ϵ$ and apply the first claim with $ϵ/2$. Then ${\displaystyle \frac{r}{r+1}}-{\displaystyle \frac{ϵ}{2}}=1-{\displaystyle \frac{1}{r+1}}-{\displaystyle \frac{ϵ}{2}}\ge 1-ϵ.$ Therefore an $M^{1-ϵ}$-approximation would also be an $M^{r/(r+1)-ϵ/2}$-approximation, contradicting the first claim. □

8. Hardness of Euclidean GapCVP

The preceding section produces a gap in the minimum Hamming weight of a binary affine system. To obtain a Euclidean closest-vector instance, we realize the kernel code as the residue modulo two of a full-rank integer lattice and use a representative of the affine coset as the target. The minimum squared Euclidean distance to this lattice is exactly the minimum Hamming weight in the coset: odd coordinates cost at least one, and a minimum-weight binary representative attains equality. Consequently, a Hamming gap of $M^{\delta }$ becomes a Euclidean-distance gap of $M^{\delta /2}$, which explains the exponent in this section.

Theorem 

(Euclidean closest vector, formal version of Theorem 1.3). Fix a real $0<ϵ<1/2$. There is a deterministic polynomial-time mapping that assigns to each 3SAT formula φ a nonsingular matrix $B\in {\mathbb{Z}}^{n\times n}$, a target $t\in {\mathbb{Z}}^n$, and a radius $r\in {\mathbb{Q}}_{>0}$ such that

$$\begin{array}{cc}\hfill \phi \mathrm{satisfiable}& \Rightarrow {dist}_2(t,\mathcal{L}\left(B\right))\le r,\hfill \\ \hfill \phi \mathrm{unsatisfiable}& \Rightarrow {dist}_2(t,\mathcal{L}\left(B\right))>n^{1/2-ϵ}r.\hfill \end{array}$$

Consequently, ${GapCVP}_{n^{1/2-ϵ}}^{\left(2\right)}$ is NP-hard under deterministic polynomial-time many-one reductions.

Proof. 

Fix the theorem’s $ϵ$. The squared-distance identity below halves a binary gap exponent. We apply Theorem 7.1 with

$$\delta :=1-ϵ,$$

which that theorem supplies for every fixed $0<ϵ<1$. The target exponent $1/2-ϵ$ is weaker than $\delta /2=1/2-ϵ/2$, leaving the slack needed to absorb the rounding of the radius. We use the binary affine system constructed in the proof of Theorem 7.1. Before its conversion to nearest codeword, that proof deterministically produces a binary matrix $H\in {\mathbb{F}}_2^{\rho \times M}$, a syndrome $b\in {\mathbb{F}}_2^{\rho }$, and an integer $R_1\ge 1$, where $\rho$ is the number of binary constraints. For a consistent system, write

$$W(H,b):=min\{wt\left(x\right):x\in {\mathbb{F}}_2^M,Hx=b\}.$$

We use the unused-variable padding in that proof with one additional fixed threshold, depending only on $ϵ$, so that $M>4^{1/ϵ}$. This preserves satisfiability and polynomial output size, and ensures $4M^{-ϵ}<1$. Lemma 3.13 supplies the completeness guarantee. For soundness, we apply Lemma 6.2 and reuse the parameter verification from the proof of Theorem 7.1. These completeness and soundness conclusions are

$$\begin{array}{cc}\hfill \phi \mathrm{satisfiable}& \Rightarrow Hx=b\mathrm{is}\mathrm{consistent}\mathrm{and}W(H,b)\le R_1,\hfill \\ \hfill \phi \mathrm{unsatisfiable}\mathrm{and}Hx=b\mathrm{consistent}& \Rightarrow W(H,b)\ge M^{\delta }{R}_1.\hfill \end{array}$$

We convert every consistent affine system to a full-rank integer lattice without changing the dimension.

Let $C:={ker}_{{\mathbb{F}}_2}H$ and compute a solution $u\in {\mathbb{F}}_2^M$ of $Hu=b$. Gaussian elimination computes u and a basis for C. We define $h:=dimC$. Choose h linearly independent coordinate columns of a generator matrix, move them to the first h positions, and use invertible row operations to put the generator into systematic form $\left[I_{h}A\right]$ for some $A\in {\mathbb{F}}_2^{h\times (M-h)}$. The row operations only change the chosen basis of C, while the coordinate permutation preserves Hamming weight. The permuted code is therefore

$$C^{\prime }:=\{(y,A^{\top }y):y\in {\mathbb{F}}_2^h\}.$$

All entries of A are henceforth represented by their lifts in $\{0,1\}$. The block form of B is chosen so that reduction modulo two remembers exactly the code $C^{\prime }$, while the factor $2I_{M-h}$ makes the lattice full rank and ensures that it contains $2{\mathbb{Z}}^M$. Consequently, parity records the Hamming support of a coset representative, and the squared Euclidean norm charges at least one for each nonzero binary coordinate.

Define

$$B:=\left(\begin{array}{cc}{I}_h& 0\\ A^{\top }& 2I_{M-h}\end{array}\right)\in {\mathbb{Z}}^{M\times M}.$$

We use the usual block-matrix conventions when $h=0$ or $h=M$. The determinant of B is $2^{M-h}$, so B is nonsingular.

We next identify its lattice. The first h columns of B, reduced modulo 2, generate $C^{\prime }$, and the remaining columns reduce to zero. Moreover, $2e_j$ is a column of B for $h<j\le M$. If $1\le i\le h$ and $g_i$ is the i-th column of B, then

$$2e_i=2g_i-{\displaystyle \sum _{j=1}^{M-h}}{A}_{i,j}\left(2e_{h+j}\right).$$

Hence $2{\mathbb{Z}}^M\subseteq \mathcal{L}\left(B\right)$. Every column of B reduces modulo 2 to an element of $C^{\prime }$, so $\mathcal{L}\left(B\right)\subseteq \{z\in {\mathbb{Z}}^M:zmod2\in C^{\prime }\}$. For the reverse containment, let $z\in {\mathbb{Z}}^M$ satisfy $zmod2\in C^{\prime }$. The first h columns reduce to a basis of $C^{\prime }$, so there is ${\lambda }_0\in \mathcal{L}\left(B\right)$ with ${\lambda }_{0}mod2=zmod2$. Then $z-{\lambda }_0\in 2{\mathbb{Z}}^M\subseteq \mathcal{L}\left(B\right)$, and hence $z\in \mathcal{L}\left(B\right)$. Therefore

$$\mathcal{L}\left(B\right)=\{z\in {\mathbb{Z}}^M:zmod2\in C^{\prime }\}.$$

Let $t\in {\{0,1\}}^M$ be the integer vector obtained by applying the same coordinate permutation to u. The affine coset $t+C^{\prime }$ is the permuted solution set of $Hx=b$.

For any $\lambda \in \mathcal{L}\left(B\right)$, we define $x^{\prime }:=(t-\lambda )mod2$. Then $x^{\prime }\in t+C^{\prime }$, so $x^{\prime }$ is the coordinate permutation of a solution to $Hx=b$. Since the permutation preserves Hamming weight, $wt\left(x^{\prime }\right)\ge W(H,b)$. Every nonzero coordinate of $x^{\prime }$ comes from an odd integer coordinate of $t-\lambda$, whose absolute value is at least one. Therefore

$${\parallel t-\lambda \parallel }_2^2\ge wt\left(x^{\prime }\right)\ge W(H,b),$$

where the first step follows because every coordinate on which $x^{\prime }$ is nonzero corresponds to an odd integer coordinate of $t-\lambda$, and the second step follows because $x^{\prime }$ represents a solution of $Hx=b$. Conversely, let x attain $W(H,b)$ and let $x^{\prime }$ be its coordinate permutation. Write $x^{\prime }=t+c$ for some $c\in C^{\prime }$. We define $\lambda :=t-x^{\prime }$. Then $\lambda mod2=c\in C^{\prime }$, so the lattice characterization above gives $\lambda \in \mathcal{L}\left(B\right)$. Moreover, we can show

$${\parallel t-\lambda \parallel }_2^2={\parallel x^{\prime }\parallel }_2^2=wt\left(x^{\prime }\right)=wt\left(x\right)=W(H,b),$$

where the first step follows from $t-\lambda =x^{\prime }$, the second step follows because $x^{\prime }$ is binary, the third step follows because the coordinate permutation preserves Hamming weight, and the fourth step follows from the choice of x as a minimum-weight solution. We have proved the exact identity

$${dist}_2{(t,\mathcal{L}\left(B\right))}^2=W(H,b).$$

(10)

The natural completeness radius is ${\sqrt{R}}_1$, which need not be rational. We round it up to the integer r so that the reduction has a valid rational output. This loses at most a factor two in distance, or a factor four after squaring. The padding condition $4M^{-ϵ}<1$ above ensures that the unused exponent slack absorbs this factor.

Set $r:=\lceil {\sqrt{R}}_1\rceil .$ This is a positive integer and can be computed by deterministic integer binary search. We can show

$${\sqrt{R}}_1\le r\le {\sqrt{R}}_1+1\le 2{\sqrt{R}}_1,$$

(11)

where the first step follows from $r=\lceil {\sqrt{R}}_1\rceil$, the second step follows from the defining property of the ceiling function, the third step follows from $R_1\ge 1$.

If $\phi$ is satisfiable, we have

$${dist}_2(t,\mathcal{L}\left(B\right))=\sqrt{W(H,b)}\le {\sqrt{R}}_1\le r,$$

where the first step follows from Eq. (10), the second step follows from completeness, and the third step follows from the definition of r.

Suppose that $\phi$ is unsatisfiable and $Hx=b$ is consistent. If

$${dist}_2(t,\mathcal{L}\left(B\right))\le M^{1/2-ϵ}r,$$

then we can show

$$W(H,b)\le M^{1-2ϵ}{r}^2\le 4M^{1-2ϵ}{R}_1<M^{\delta }{R}_1,$$

where the first step follows from the assumed upper bound on the Euclidean distance and Eq. (10), the second step follows from $r^2\le 4R_1$ (Eq. (11)), and the third step follows from $\delta =1-ϵ$ and the padding guarantee $4M^{-ϵ}<1$.

This contradicts soundness. Thus

$${dist}_2(t,\mathcal{L}\left(B\right))>M^{1/2-ϵ}r.$$

The lattice rank is M, which is denoted by n in the theorem statement, so this is precisely the claimed NO threshold.

It remains to specify the exceptional branches. If preprocessing finds an empty clause, or if $Hx=b$ is inconsistent, output

$$B=\left(2\right),t=\left(1\right),r={\displaystyle \frac{1}{2}}.$$

This is a one-dimensional NO instance: its rank is $n=1$, so $n^{1/2-ϵ}r=1/2$, whereas ${dist}_2(1,2\mathbb{Z})=1$. A satisfiable formula never reaches the inconsistent branch by completeness. If no clauses remain after preprocessing, output

$$B=\left(2\right),t=\left(0\right),r={\displaystyle \frac{1}{2}},$$

which is a YES instance.

For fixed $ϵ$, Theorem 7.1 constructs H, b, and $R_1$ in deterministic polynomial time. Gaussian elimination, the coordinate permutation, construction of B, and integer square-root computation are also deterministic polynomial-time operations. The basis has dimension exactly M and entries in $\{0,1,2\}$, while t is binary. Equations (3) and (2) give $R_1\le M$, and hence the bit length of r is $O(log(r+1))=O(log(R_1+1))=O(log(M+1))$. Hence the complete mapping has polynomial output size. A polynomial-time algorithm for ${GapCVP}_{n^{1/2-ϵ}}^{\left(2\right)}$ composed with this mapping would decide 3SAT in polynomial time, proving the stated NP-hardness. □