GPV Trapdoor Sampling in Lattices

• GPV trapdoor sampling is a lattice-based primitive that uses a secret short basis to generate discrete Gaussian samples for hash-and-sign signatures and related trapdoor constructions.
• The method combines classical Klein sampling, MCMC convergence improvements, and quantum rejection sampling to achieve near-ideal lattice Gaussian distributions.
• Its advancements reduce runtime and improve security benchmarks in lattice cryptography and dual lattice attacks, balancing classical and quantum performance.

GPV trapdoor sampling is the lattice-sampling primitive underlying the Gentry–Peikert–Vaikuntanathan framework for hash-and-sign signatures and related trapdoor constructions. In this setting, a trapdoor is a short basis $B$ of a lattice $\mathcal L$, while the public description is a hard basis $A$ for the same lattice. Given a message $m$, signing hashes $m$ to a lattice coset shift $c$ and samples a short vector from the discrete Gaussian $\mathcal D_{\mathcal L+c,s}$. The central requirement is distributional: the output must look like a pure lattice-Gaussian sample independent of which short basis was used, because the GPV security reduction depends on basis-independence and on the Gaussian width parameter (Ling et al., 24 May 2026). Subsequent work has treated the sampling step itself as the main algorithmic object, first via Markov chain Monte Carlo methods (Wang et al., 2017) and, more recently, via quantum rejection sampling for a quadratic speedup in the dominant complexity term (Ling et al., 24 May 2026).

1. Lattice-Gaussian trapdoor sampling in the GPV framework

In the GPV framework, a trapdoor for a lattice is a short basis $B$ of a lattice $\mathcal L$, together with a corresponding hard public basis $A$ for the same lattice. In GPV signatures, key generation publishes the hard basis and keeps the short basis secret. Signing hashes a message to a lattice coset, represented by a shift $\mathcal L$0, and samples from the discrete Gaussian over that coset,

$\mathcal L$1

For $\mathcal L$2, the target distribution is

$\mathcal L$3

Security requires that signatures be distributed as pure lattice-Gaussian samples and therefore not reveal the secret basis. In the normalization used in the quantum treatment, GPV security reduces to ISIS with approximation factor $\mathcal L$4 (Ling et al., 24 May 2026).

A closely related setting is sampling on dual $\mathcal L$5-ary lattices. For $\mathcal L$6,

$\mathcal L$7

and

$\mathcal L$8

Formally,

$\mathcal L$9

This dual-lattice formulation is important because the same lattice-Gaussian primitive appears both in GPV trapdoor sampling and in dual LWE attacks (Ling et al., 24 May 2026).

A second notation appears in the MCMC literature. There, the Gaussian parameter is written $A$0 rather than $A$1, and the discrete Gaussian over $A$2 centered at $A$3 is

$A$4

In that normalization, the GPV signing reduction is stated with approximation factor $A$5 (Wang et al., 2017).

2. Classical samplers and the spectral-gap bottleneck

The classical starting point is Klein’s algorithm, a randomized nearest-plane procedure. Writing $A$6 with $A$7 orthonormal and $A$8 upper triangular, and setting $A$9, one defines

$m$0

Klein’s proposal distribution over coefficient vectors $m$1 is

$m$2

GPV uses this distribution as an efficient approximate sampler when the Gaussian width is sufficiently larger than the Gram–Schmidt norms (Ling et al., 24 May 2026).

Wang and Ling recast trapdoor sampling as Markov chain Monte Carlo, using Klein’s distribution as an independent Metropolis–Hastings proposal. Their independent MHK chain targets the exact lattice Gaussian and admits an explicit spectral-gap analysis. They prove a uniform lower bound

$m$3

where

$m$4

This yields

$m$5

and therefore

$m$6

In the trapdoor setting, the overall effort is thus governed by $m$7 (Wang et al., 2017).

The same bottleneck is expressed in the later quantum treatment by a parameter $m$8, with running time approximately

$m$9

where $m$0 is essentially the inverse spectral gap up to polynomial factors. If

$m$1

then a basis-independent upper bound is

$m$2

with

$m$3

This identifies lattice Gaussian sampling as the dominant runtime bottleneck in GPV trapdoor sampling and in dual attacks (Ling et al., 24 May 2026).

The MCMC formulation is important because it relaxes the direct-sampling threshold. Wang and Ling emphasize a security–complexity trade-off: instead of requiring $m$4 as in the classical GPV/Klein regime, one can target smaller $m$5 and pay a moderate number of MCMC iterations. For $m$6, they report $m$7, so for $m$8, $m$9; they interpret this as roughly $c$0 iterations to reduce the parameter from $c$1 to $c$2 (Wang et al., 2017).

3. Quantum rejection sampling and the truncated Klein construction

The quantum acceleration is built on quantum rejection sampling. Given a proposal distribution $c$3 and a target $c$4 on a finite set $c$5, if there exists $c$6 such that

$c$7

then classical rejection sampling uses $c$8 proposals per accepted sample. In the quantum setting, if one has a unitary $c$9 preparing

$\mathcal D_{\mathcal L+c,s}$0

and a controlled rotation encoding

$\mathcal D_{\mathcal L+c,s}$1

then amplitude amplification prepares the target q-sample with query complexity

$\mathcal D_{\mathcal L+c,s}$2

(Ling et al., 24 May 2026).

The technical obstacle is that lattice Gaussians have infinite support, so the quantum construction uses truncation. For

$\mathcal D_{\mathcal L+c,s}$3

the truncated target and truncated Klein proposal are

$\mathcal D_{\mathcal L+c,s}$4

The key observation is a pointwise domination inequality: $\mathcal D_{\mathcal L+c,s}$5 where

$\mathcal D_{\mathcal L+c,s}$6

This is obtained from the one-dimensional bound

$\mathcal D_{\mathcal L+c,s}$7

so Wang–Ling’s lower-bound machinery becomes exactly the domination condition needed by quantum rejection sampling (Ling et al., 24 May 2026).

The truncation is chosen so that the truncated Gaussian is negligibly close to the full Gaussian. If

$\mathcal D_{\mathcal L+c,s}$8

then the Gaussian tail outside the ball is at most $\mathcal D_{\mathcal L+c,s}$9 times the total mass. Writing

$B$0

one gets

$B$1

The same argument extends by a union bound to multiple independent samples (Ling et al., 24 May 2026).

4. Complexity consequences for signing and dual-lattice sampling

With the truncated proposal $B$2, the target $B$3, a Klein oracle

$B$4

and the controlled rotation

$B$5

quantum rejection sampling prepares

$B$6

using

$B$7

queries. By contrast, the classical IMHK cost for a single sample is roughly $B$8. When $B$9 is large enough that almost all mass lies inside the truncation ball, $\mathcal L$0, and the dependence on the hard sampling term improves from $\mathcal L$1 to $\mathcal L$2 (Ling et al., 24 May 2026).

In the worst-case Wang–Ling bound, the same transition appears as

$\mathcal L$3

The paper gives a concrete FALCON-512 example with dimension $\mathcal L$4 and $\mathcal L$5. For $\mathcal L$6, corresponding to $\mathcal L$7, the classical bound is approximately $\mathcal L$8, while the quantum bound is approximately $\mathcal L$9 (Ling et al., 24 May 2026).

The same sampler modifies modern dual LWE attack cost estimates because those attacks also require lattice-Gaussian sampling on a dual $A$0-ary lattice after BKZ reduction. Using the same parameters as Pouly–Shen, the QRS-based replacement reduces the overall attack cost from $A$1 to $A$2 bits for Kyber-512, from $A$3 to $A$4 bits for Kyber-768, and from $A$5 to $A$6 bits for Kyber-1024 without modulus switching. With modulus switching, the reported changes are $A$7 bits, $A$8 bits, and $A$9 bits, respectively. The measured quantity is the base-2 logarithm of the overall time (Ling et al., 24 May 2026).

These attack results do not change the definition of GPV trapdoor sampling, but they clarify its algorithmic status: lattice-Gaussian sampling is the shared primitive on both the constructive and the cryptanalytic sides.

5. Correctness, security, and comparison of sampling paradigms

The correctness condition in GPV is distributional rather than merely geometric. It is not enough to output a short preimage; the sampler must output a distribution negligibly close to the intended lattice Gaussian and independent of the particular trapdoor basis. The truncated quantum sampler preserves this property because the total variation distance between the full and truncated Gaussian can be made negligible by the tail bound, and the truncated distribution itself is sampled exactly by the QRS procedure (Ling et al., 24 May 2026).

This places three samplers in a clear hierarchy. Direct Klein sampling is efficient but only approximate, and its bias becomes problematic when the Gaussian width is too small relative to the Gram–Schmidt norms. Independent MHK sampling can converge to the exact target distribution, or an arbitrarily close approximation, even for smaller widths, but its cost is governed by the spectral-gap term $\mathcal L$00 or $\mathcal L$01. The QRS-based sampler uses the same Klein proposal but replaces mixing-time analysis by state preparation plus amplitude amplification, yielding an exact truncated target distribution with complexity dominated by $\mathcal L$02 (Ling et al., 24 May 2026).

The MCMC literature also identifies a practical refinement: the independent multiple-try Metropolis–Klein algorithm. If $\mathcal L$03 independent proposals are drawn at each step, the spectral-gap lower bound becomes

$\mathcal L$04

which is approximately $\mathcal L$05 when $\mathcal L$06 is small. This improves convergence by about a factor of $\mathcal L$07 and supports parallel implementation, which Wang and Ling emphasize as beneficial for practical applications (Wang et al., 2017).

Several caveats remain explicit. The quantum work assumes coherent oracle access to a truncated Klein proposal distribution and to the controlled rotation; it analyzes query complexity rather than a complete low-level circuit. It also notes that if $\mathcal L$08 is extremely close to the smoothing parameter, or if the dimension is very large, then $\mathcal L$09 itself may be so small that even $\mathcal L$10 remains large. Likewise, low-level leakage from approximate oracles or incomplete amplitude amplification is outside the theory model (Ling et al., 24 May 2026).

6. Related GPV-style preimage sampling beyond lattice Gaussians

Later work places GPV trapdoor sampling inside a broader theory of trapdoor preimage sampleable functions. In Wave, the GPV strategy is transferred to codes by replacing discrete Gaussians with the uniform distribution on vectors of prescribed Hamming weight. The public function is

$\mathcal L$11

and the trapdoor is a generalized $\mathcal L$12-code structure. Domain sampling is justified by a variant of the leftover hash lemma, while rejection sampling is used to ensure that the trapdoor inverse output has the proper distribution, namely essentially uniform over all weight-$\mathcal L$13 preimages of a syndrome (Debris-Alazard et al., 2018).

Miranda develops the same GPV/FDH paradigm in the rank metric through the notion of an Average Trapdoor Preimage Sampleable Function. Its trapdoor is a subcode of a decodable code in a unique decoding regime, built by an Add-and-Remove construction. The signing algorithm samples a small number of uniform bits, solves an extended linear system, and then uses deterministic unique decoding. Proposition 5.4 states that conditioned on success the output is uniformly distributed over the solution set for the target syndrome, and the scheme is designed so that signatures do not leak information on the underlying trapdoor without using rejection sampling (Couvreur et al., 8 Oct 2025).

These code-based analogues do not replace lattice GPV sampling, but they show that the GPV principle is more general than discrete Gaussian generation alone. In lattices, the reference distribution is Gaussian over a coset; in Wave it is uniform over fixed-weight preimages; in Miranda it is uniform over rank-bounded preimages. This suggests a broader interpretation of GPV trapdoor sampling as the problem of efficiently generating trapdoor-independent samples from a high-entropy conditional distribution, with lattice Gaussian sampling as the Euclidean-metric instantiation most directly tied to SIS, ISIS, and dual $\mathcal L$14-ary lattice techniques (Debris-Alazard et al., 2018, Couvreur et al., 8 Oct 2025).