Subset Balancing and Generalized Subset Sum via Lattices

Abstract: We study the \emph{Subset Balancing} problem: given $\mathbf{x} \in \mathbb{Z}^n$ and a coefficient set $C \subseteq \mathbb{Z}$, find a nonzero vector $\mathbf{c} \in C^n$ such that $\mathbf{c}\cdot\mathbf{x} = 0$. The standard meet-in-the-middle algorithm runs in time $\tilde{O}(|C|^{n/2})=\tilde{O}(2^{n\log |C|/2})$, and recent improvements (SODA~2022, Chen, Jin, Randolph, and Servedio; STOC~2026, Randolph and Węgrzycki) beyond this barrier apply mainly when $d$ is constant. We give a reduction from Subset Balancing with $C = {-d, \dots, d}$ to a single instance of $\mathrm{SVP}{\infty}$ in dimension $n+1$, which yields a deterministic algorithm with running time $\tilde{O}((6\sqrt{2πe})^n) \approx \tilde{O}(2^{4.632n})$, and a randomized algorithm with running time $\tilde{O}(2^{2.443n})$ (here $\tilde{O}$ suppresses $\operatorname{poly}(n)$ factors). We also show that for sufficiently large $d$, Subset Balancing is solvable in polynomial time. More generally, we extend the box constraint $[-d,d]^n$ to an arbitrary centrally symmetric convex body $K \subseteq \mathbb{R}^n$ with a deterministic $\tilde{O}(2^{c_K n})$-time algorithm, where $c_K$ depends only on the shape of $K$. We further study the \emph{Generalized Subset Sum} problem of finding $\mathbf{c} \in C^n$ such that $\mathbf{c} \cdot \mathbf{x} = τ$. For $C = {-d, \dots, d}$, we reduce the worst-case problem to a single instance of $\mathrm{CVP}{\infty}$. Although no general single exponential time algorithm is known for exact $\mathrm{CVP}_{\infty}$, we show that in the average-case setting, for both $C = {-d, \dots, d}$ and $C = {-d, \dots, d} \setminus {0}$, the embedded instance satisfies a bounded-distance promise with high probability. This yields a deterministic algorithm running in time $\tilde{O}((18\sqrt{2πe})^n) \approx \tilde{O}(2^{6.217n})$.

• The paper presents a lattice reduction framework that decouples algorithmic complexity from the coefficient set size, achieving deterministic single-exponential time algorithms.
• It reduces Subset Balancing to the shortest vector problem and Generalized Subset Sum to the closest vector problem in the ℓ∞ norm via explicit basis constructions.
• The work provides both worst-case and average-case algorithms with provable guarantees, enhancing cryptanalytic and optimization approaches.

Subset Balancing and Generalized Subset Sum: Lattice-Based Algorithms and Complexity

Problem Overview and Motivations

The paper "Subset Balancing and Generalized Subset Sum via Lattices" (2604.04656) addresses algorithmic advances for the Subset Balancing problem and its generalization, the Generalized Subset Sum (GSS). These problems extend the classic Subset Sum NP-complete problem, where, given a vector $\mathbf{x} \in \mathbb{Z}^n$ and a coefficient set $C \subseteq \mathbb{Z}$, the task is to find a nonzero vector $\mathbf{c} \in C^n$ such that $\mathbf{c} \cdot \mathbf{x} = 0$ (Subset Balancing), or more generally, $\mathbf{c} \cdot \mathbf{x} = \tau$ for a target $\tau$ (GSS).

Previous approaches have been limited by the meet-in-the-middle (MitM) exponent, which scales as $\tilde{O}(|C|^{n/2})$. Representation-based methods, while breaking this barrier for fixed, small $|C|$, fail to improve the exponent for large $|C|$, as the $\log |C|$ factor in the exponent remains.

The key challenge tackled is twofold: (1) can one decouple algorithmic complexity from the coefficient set size $C \subseteq \mathbb{Z}$0 (when $C \subseteq \mathbb{Z}$1), and (2) can one design deterministic algorithms with strong guarantees across all parameter regimes, particularly for large $C \subseteq \mathbb{Z}$2? The manuscript demonstrates that a lattice-theoretic framework not only achieves this separation but yields algorithms with complexity solely dependent on $C \subseteq \mathbb{Z}$3, regardless of $C \subseteq \mathbb{Z}$4.

Lattice Reductions and Algorithmic Framework

The central contribution is the reduction of Subset Balancing and GSS to fundamental lattice problems:

Subset Balancing over $C \subseteq \mathbb{Z}$5 is reduced to $C \subseteq \mathbb{Z}$6 (Shortest Vector Problem in the $C \subseteq \mathbb{Z}$7 norm) in dimension $C \subseteq \mathbb{Z}$8. Given $C \subseteq \mathbb{Z}$9, the set of integer vectors $\mathbf{c} \in C^n$0 with $\mathbf{c} \in C^n$1 forms a lattice of rank $\mathbf{c} \in C^n$2. Standard embeddings are used to construct a full-rank lattice in $\mathbf{c} \in C^n$3, wherein each solution vector corresponds to a lattice point of $\mathbf{c} \in C^n$4-norm at most $\mathbf{c} \in C^n$5.

Generalized Subset Sum (GSS), seeking $\mathbf{c} \in C^n$6 with $\mathbf{c} \in C^n$7, is similarly reduced to a $\mathbf{c} \in C^n$8 (Closest Vector Problem). The embedding is adapted to encode the offset $\mathbf{c} \in C^n$9 in the first coordinate, so that lattice points within $\mathbf{c} \cdot \mathbf{x} = 0$0-distance $\mathbf{c} \cdot \mathbf{x} = 0$1 of a given 'target' vector correspond to GSS solutions.

Algorithmic Results and Complexity Analysis

Deterministic and Randomized Algorithms for Subset Balancing

By leveraging state-of-the-art deterministic SVP algorithms in the $\mathbf{c} \cdot \mathbf{x} = 0$2 norm (Dadush, Peikert, Vempala framework) and explicit basis constructions, the paper establishes:

• A deterministic algorithm for worst-case Subset Balancing with $\mathbf{c} \cdot \mathbf{x} = 0$3 in time

$\mathbf{c} \cdot \mathbf{x} = 0$4

independent of $\mathbf{c} \cdot \mathbf{x} = 0$5.

• A randomized algorithm (applying Mukhopadhyay's sieving SVP) with running time

$\mathbf{c} \cdot \mathbf{x} = 0$6

outperforming MitM when $\mathbf{c} \cdot \mathbf{x} = 0$7.

Crucially, the exponents do not scale with $\mathbf{c} \cdot \mathbf{x} = 0$8, removing this factor entirely from the complexity, which is in contrast with earlier MitM- and representation-based approaches.

Polynomial-Time Regime and Structural Results

The work identifies a polynomial-time regime: for sufficiently large $\mathbf{c} \cdot \mathbf{x} = 0$9 (quantified via bounds involving the determinant of the associated lattice and Minkowski's Theorem), Subset Balancing can be solved in polynomial time by using the LLL algorithm for lattice reduction.

Generalization to Arbitrary Convex Constraints

The box constraint $\mathbf{c} \cdot \mathbf{x} = \tau$0 is generalized to arbitrary centrally symmetric convex bodies $\mathbf{c} \cdot \mathbf{x} = \tau$1, by reducing to SVP in the corresponding gauge norm. The result is a deterministic algorithm with running time $\mathbf{c} \cdot \mathbf{x} = \tau$2, where $\mathbf{c} \cdot \mathbf{x} = \tau$3 depends only on the body’s shape, not size, further underscoring the geometric generality of the lattice approach.

Algorithms for Generalized Subset Sum (GSS)

• For worst-case GSS, no single-exponential algorithm for exact $\mathbf{c} \cdot \mathbf{x} = \tau$4 exists unless the minimal distance between the target and lattice is bounded.
• In the average-case regime (random $\mathbf{c} \cdot \mathbf{x} = \tau$5, $\mathbf{c} \cdot \mathbf{x} = \tau$6), the paper shows with high probability that the bounded distance condition is satisfied for both $\mathbf{c} \cdot \mathbf{x} = \tau$7 and $\mathbf{c} \cdot \mathbf{x} = \tau$8.
• This enables, via deterministic exact CVP algorithms for bounded-distance promise, a deterministic algorithm (for $\mathbf{c} \cdot \mathbf{x} = \tau$9, and $\tau$0 with minor loss in failure probability) with runtime

$\tau$1

Comparative and Regime Analysis

In contrast to prior state-of-the-art results, which excel for small constant $\tau$2 but degrade with increasing $\tau$3, the lattice-based algorithms here yield constant exponents in $\tau$4 (for any fixed convex constraint), breaking the bottleneck associated with $\tau$5 scaling. Importantly, deterministic guarantees apply in regimes where randomized hashing and representations are less effective or undesirable.

Technical Contributions and Key Claims

• Dimension-Preserving Direct Reductions: All reductions to SVP and CVP problems preserve dimension up to an increment (to $\tau$6).
• Explicit Construction and Analysis: The authors provide precise basis constructions for the required lattices, aligning the solution set exactly with vectors satisfying the desired constraint in $\tau$7.
• Deterministic Guarantees: The algorithms are fully deterministic (randomized only in certain average-case embeddings), facilitating reproducible and robust applications.
• Parameter-Independence of Exponent: The technical achievement of decoupling running time from $\tau$8 is highlighted, and the assertion is boldly made that for large $\tau$9 (or for arbitrary symmetric convex $\tilde{O}(|C|^{n/2})$0), the main exponents remain independent of the size or volume parameter.

Practical and Theoretical Implications

From a practical cryptanalytic perspective, the results enable efficient deterministic enumeration of subset sums and partitions (for large coefficient sets)—environments common in cryptographic constructions. The generic extension to arbitrary convex sets hints at utility in broader integer programming and integer optimization contexts.

Theoretically, this work bridges parameter regimes left open by representation techniques, and sharpens understanding of complexity thresholds for exact solutions to these structured subset problems. The reduction of both Subset Balancing and GSS to foundational lattice problems tightly couples complexity-theoretic and geometric perspectives.

Directions for Future Work

• Tighter Exponents for GSS: There is potential to further improve the exponent $\tilde{O}(|C|^{n/2})$1 for GSS (currently limited by bounds from covering arguments) to the lower exponent achievable for SVP.
• Heuristic and Practical Algorithmics: Exploration of heuristic SVP/CVP solvers (such as improved sieving) in this framework may yield superior constants practically, especially for cryptographic parameter sizes.
• Further Decoupling and Generalization: The extension to other combinatorial constraints on $\tilde{O}(|C|^{n/2})$2, and their relation to further classes of normed lattice problems, remains an intriguing line for investigation.
• Complexity-theoretic Tightness: Closing the gap between the $\tilde{O}(|C|^{n/2})$3 norm for SVP and CVP in worst-case (rather than average-case) settings remains open, with implications for fine-grained complexity.

Conclusion

This work establishes a new regime for exact algorithms for Subset Balancing and Generalized Subset Sum, using a geometric reduction to SVP/CVP and removing dependence on the coefficient set size from the exponential base of the running time. The approach yields deterministic single-exponential time algorithms for both worst- and average-case instances and lays groundwork for further bridging of lattice-based and combinatorial approaches to classic discrete optimization problems.