When the Learning With Errors Problem Meets the Coherent Ising Machine: A Penalty-Free Algorithm-Hardware Co-Design

Abstract: The Learning With Errors (LWE) problem constitutes the mathematical foundation of modern Post-Quantum Cryptography (PQC). Cryptanalysis of LWE ranges from classical lattice reduction to machine learning and quantum-classical hybrids. We propose CIM-BDD, a hybrid Bounded-Distance-Decoding solver that reduces LWE to a Quadratic Unconstrained Binary Optimization (QUBO) problem through a strictly \emph{penalty-free} mapping. An algebraic elimination of the secret embeds LWE into a $q$-ary lattice, absorbing the modular arithmetic and recasting the problem as a Closest Vector Problem (CVP). The squared error norm is then used \emph{directly} as the QUBO energy, so the cryptographic noise is the objective to be minimized rather than a penalized constraint. To realize this general model on current Noisy Intermediate-Scale Quantum (NISQ) devices, we design a special encoding method: a Continuous Relaxed Babai's Nearest Plane (CR-BNP) projection drives an adaptive mixed-radix encoder that greatly reduces both the qubit count and the QUBO coefficient range, so that a single batched hardware submission suffices. We further derive a statistically bounded early-stopping threshold ($T_{\text{early}}$) that acts as a one-sided certificate and doubles as a Decision-LWE distinguisher. We validate the framework on the TU Darmstadt LWE Challenge, giving an end-to-end demonstration for both Search- and Decision-LWE of a $40$-dimensional instance on the Coherent Ising Machine CPQC-550. This work establishes a new algorithm-hardware co-design paradigm for quantum-classical hybrid cryptanalysis.

• The paper introduces a penalty-free QUBO formulation converting the LWE problem to CVP by eliminating slack variables, which improves the hardware mapping process.
• It employs a hybrid Bounded-Distance-Decoding solver with a Continuous Relaxed Babai’s Nearest Plane projection and adaptive mixed-radix encoding to efficiently reduce problem dimensionality.
• Experimental validation on the TU Darmstadt LWE Challenge shows secret recovery rates and energy thresholds closely matching theoretical predictions, confirming superior hardware efficiency.

Penalty-Free Algorithm-Hardware Co-Design for LWE via Coherent Ising Machines

Background and Motivation

Learning With Errors (LWE) forms the foundational hardness assumption for post-quantum cryptographic schemes, notably ML-KEM (FIPS 203), ML-DSA (FIPS 204), and FHE. LWE’s average-case hardness is inherited from worst-case lattice problems—SVP and CVP—making concrete cryptanalysis a pivotal research direction. Previous approaches leverage classical lattice reduction (BKZ, LLL), heuristic enumeration/sieving, and emerging ML-based attacks, yet scalability to cryptographic dimensions remains constrained. Quantum–classical hybrid solvers, particularly leveraging NISQ devices and Ising architectures, have recently emerged, but standard QUBO mappings for LWE rely on auxiliary slack variables and penalty terms, distorting the optimization landscape and impeding efficient hardware realization.

Algorithmic Contributions

This paper introduces CIM-BDD, a hybrid Bounded-Distance-Decoding (BDD) solver targeting LWE, architected for Coherent Ising Machines (CIMs). The key mathematical innovation is a strictly penalty-free QUBO formulation derived from a reduction of LWE to CVP via elimination of the secret and absorption of modular arithmetic into a $q$-ary lattice. The squared residual error of the LWE instance is directly encoded as the QUBO energy, rendering cryptographic noise as the optimization objective rather than a penalized constraint. Babai’s Nearest Plane algorithm recenters the search space, bounding the integer displacement to a localized neighborhood, which is then encoded adaptively based on the continuous fractional ambiguity identified through a Continuous Relaxed Babai’s Nearest Plane (CR-BNP) projection.

The pipeline comprises five stages: global algebraic reduction and basis extraction, Gram-Schmidt orthogonalization and target projection, CR-BNP-based subspace identification, adaptive mixed-radix encoding to compress the variable/bit mapping, and deterministic post-processing correction layer combined with a statistically justified early-stopping threshold.

Hardware Mapping and Precision-Aware Embedding

Mapping LWE instances of dimension $n=40$ to current NISQ-scale CIM hardware necessitates significant dimensionality reduction and coefficient range compression. The CR-BNP-driven adaptive mixed-radix encoder restricts exploration to variable neighborhoods ($\Delta y_i \in \{-1,0,1\}$), dynamically assigning bit-width per coordinate; empirical thresholds prune insignificant directions to constants, low-ambiguity directions to binary biases, and only ambiguous coordinates receive ternary encoding. Logical partitioning and block-diagonal packing enable efficient single-shot batched submission on CIM hardware, reducing variable count to $N_\text{log}\leq 19$ in the $n=40$ experiment.

Upon hardware output, bounded neighborhood correction ($R\le2$) is invoked to repair rounding artifacts induced by limited precision and approximate QUBO relaxation, ensuring that the true lattice point is recovered whenever it lies in the $R\le2$ neighborhood of any low-energy configuration returned.

One-Sided Cryptographic Certificates and Decision-LWE Distinguishing

Statistically bounded early-stopping thresholds are rigorously derived from the $\chi^2$ distribution of Gaussian noise, yielding $T_\text{early} = m'\sigma^2 + 4\sigma^2\sqrt{2m'}$. Crossing this threshold certifies recovery of the LWE secret without further algebraic validation and simultaneously provides a robust Decision-LWE distinguisher. Empirical analysis demonstrates absolute distinguishing advantage equal to the algorithmic recovery rate ($0.18$ for BKZ-20, $n=40$0 for progressive BKZ-20$n=40$130), with null hypothesis tests on uniform instances yielding zero false acceptances over 220 experiments.

Figure 1: Decision-LWE on LWE_40_005: residual energies measured after correction, showing threshold-crossing for true-LWE solutions and strict separation from uniform instances.

Theoretical Justification and Exploration Subspace Reliability

The penalty-free QUBO formulation enjoys statistical optimality via Maximum Likelihood Estimation under independent discrete Gaussian noise. Orthogonal decomposition of the lattice enables additive separation of exploration and frozen subspaces. Comprehensive coverage analysis in the exploration zone, leveraging ternary widening, yields cumulative coverage estimates $n=40$2 for $n=40$3, with the main bottleneck attributable to classical frozen-subspace rounding. Empirical recovery rates align tightly with theoretical predictions computed from per-seed analytic success probabilities.

Figure 2: Trend of theoretical Gram-Schmidt vector norms as a function of sub-dimension; vertical marker indicates chosen $n=40$4, capturing the hard-decision region for Babai’s algorithm.

Experimental Validation and Comparative Analysis

Benchmarked on the TU Darmstadt LWE Challenge, the CIM-BDD framework achieves secret recovery for $n=40$5, $n=40$6, $n=40$7, and $n=40$8 in $n=40$9 ($\Delta y_i \in \{-1,0,1\}$0) out of $\Delta y_i \in \{-1,0,1\}$1 row-selection seeds under baseline BKZ-20 and in $\Delta y_i \in \{-1,0,1\}$2 ($\Delta y_i \in \{-1,0,1\}$3) hits under progressive BKZ-20$\Delta y_i \in \{-1,0,1\}$430. All successful recoveries exhibit post-corrector residual energies tightly clustered around the theoretical mean, strictly below $\Delta y_i \in \{-1,0,1\}$5, confirming cryptographic validity. Hardware wall-clock execution per batched submission remains constant ($\Delta y_i \in \{-1,0,1\}$6–$\Delta y_i \in \{-1,0,1\}$7 ms), far below classical BKZ reduction time.

Comparative resource analysis positions CIM-BDD favorably relative to prior quantum-assisted algorithms: the qubit count and call complexity scale sublinearly compared to HAWI, Qayyum, Joseph, and Dable-Heath frameworks. For $\Delta y_i \in \{-1,0,1\}$8, CIM-BDD requires fewer than $\Delta y_i \in \{-1,0,1\}$9 logical qubits and a single hardware submission, with empirical recovery rates matching analytic expectations.

Scalability and Complexity

Algorithmic complexity is dominated by classical BKZ preprocessing, scaling as $N_\text{log}\leq 19$0. Exploration subspace enumeration ($N_\text{log}\leq 19$1) and bounded correction ($N_\text{log}\leq 19$2 for $N_\text{log}\leq 19$3) are negligible. Hardware-side evaluation is constant-time per batch. While current experiments are fixed at $N_\text{log}\leq 19$4, theoretical and practical scalability to cryptographic dimensions is plausible with adjustments to exploration subspace size, mixed-radix expansion, and adoption of advanced enumeration in frozen zones.

Conclusion

CIM-BDD constitutes a novel penalty-free algorithm-hardware co-design for LWE cryptanalysis, leveraging a mathematically precise QUBO formulation and hardware-centric encoding strategies to realize efficient hybrid attacks. The framework, validated on physical Ising architectures, delivers robust recovery and distinguishing mechanisms via certified energy thresholds and ensemble sampling. While the asymptotic hardness of LWE persists, CIM-BDD reliably enables practical benchmarking of LWE-based cryptosystems against quantum–classical hardware and offers a scalable template for future post-quantum security evaluation.