---
title: GPV Trapdoor Sampling in Lattices
url: https://www.emergentmind.com/topics/gpv-trapdoor-sampling
type: topic
---

# GPV Trapdoor Sampling in Lattices

GPV trapdoor sampling is the lattice-sampling primitive underlying the Gentry–Peikert–Vaikuntanathan framework for hash-and-sign signatures and related trapdoor constructions. In this setting, a trapdoor is a short basis \(B\) of a lattice \(\mathcal L\), while the public description is a hard basis \(A\) for the same lattice. Given a message \(m\), signing hashes \(m\) to a lattice coset shift \(c\) and samples a short vector from the discrete Gaussian \(\mathcal D_{\mathcal L+c,s}\). The central requirement is distributional: the output must look like a pure lattice-Gaussian sample independent of which short basis was used, because the GPV security reduction depends on basis-independence and on the Gaussian width parameter [2605.24798]. Subsequent work has treated the sampling step itself as the main algorithmic object, first via Markov chain Monte Carlo methods [1704.02673] and, more recently, via quantum rejection sampling for a quadratic speedup in the dominant complexity term [2605.24798].

## 1. Lattice-Gaussian trapdoor sampling in the GPV framework

In the GPV framework, a trapdoor for a lattice is a short basis \(B\) of a lattice \(\mathcal L\), together with a corresponding hard public basis \(A\) for the same lattice. In GPV signatures, key generation publishes the hard basis and keeps the short basis secret. Signing hashes a message to a lattice coset, represented by a shift \(c\), and samples from the discrete Gaussian over that coset,
\[
\mathcal D_{\mathcal L+c,s}.
\]
For \(x\in \mathcal L+c\), the target distribution is
\[
\mathcal D_{\mathcal L+c,s}(x)=\frac{\rho_{s,c}(x)}{\rho_{s,c}(\mathcal L)},
\qquad
\rho_{s,c}(x)=\exp\!\left(-\pi\frac{\|x-c\|^2}{s^2}\right).
\]
Security requires that signatures be distributed as pure lattice-Gaussian samples and therefore not reveal the secret basis. In the normalization used in the quantum treatment, GPV security reduces to ISIS with approximation factor \(\sqrt{n/(2\pi)}\,s\) [2605.24798].

A closely related setting is sampling on dual \(q\)-ary lattices. For \(A\in \mathbb Z^{m\times n}\),
\[
\mathcal L_q(A)=\{z\in\mathbb Z^m:\exists x\in\mathbb Z^n,\ z\equiv Ax \pmod q\},
\]
and
\[
\mathcal L_q^\perp(A)=\{z\in\mathbb Z^m:A^\top z\equiv 0 \pmod q\}.
\]
Formally,
\[
\mathcal L_q(A)^*=\frac{1}{q}\mathcal L_q^\perp(A).
\]
This dual-lattice formulation is important because the same lattice-Gaussian primitive appears both in GPV trapdoor sampling and in dual LWE attacks [2605.24798].

A second notation appears in the MCMC literature. There, the Gaussian parameter is written \(\sigma\) rather than \(s=\sqrt{2\pi}\sigma\), and the discrete Gaussian over \(\Lambda=B\mathbb Z^n\) centered at \(\mathbf c\) is
\[
D_{\Lambda,\sigma,\mathbf c}(\mathbf x)
=
\frac{\exp\!\left(-\frac{\|B\mathbf x-\mathbf c\|^2}{2\sigma^2}\right)}
{\sum_{\mathbf y\in\mathbb Z^n}\exp\!\left(-\frac{\|B\mathbf y-\mathbf c\|^2}{2\sigma^2}\right)}.
\]
In that normalization, the GPV signing reduction is stated with approximation factor \(\sqrt n\,\sigma\) [1704.02673].

## 2. Classical samplers and the spectral-gap bottleneck

The classical starting point is Klein’s algorithm, a randomized nearest-plane procedure. Writing \(B=QR\) with \(Q\) orthonormal and \(R\) upper triangular, and setting \(c'=Q^\top c\), one defines
\[
s_i=\frac{s}{|r_{ii}|},
\qquad
\mu_i(x_{>i})=\frac{c_i'-\sum_{j>i}r_{ij}x_j}{r_{ii}}.
\]
Klein’s proposal distribution over coefficient vectors \(x\in\mathbb Z^n\) is
\[
Q(x)
=
\prod_{i=1}^n
\frac{\rho_{s_i,\mu_i(x_{>i})}(x_i)}
{\rho_{s_i,\mu_i(x_{>i})}(\mathbb Z)}
=
\frac{\rho_{s,c}(Bx)}
{\prod_{i=1}^n \rho_{s_i,\mu_i(x_{>i})}(\mathbb Z)}.
\]
GPV uses this distribution as an efficient approximate sampler when the Gaussian width is sufficiently larger than the Gram–Schmidt norms [2605.24798].

Wang and Ling recast trapdoor sampling as Markov chain Monte Carlo, using Klein’s distribution as an independent Metropolis–Hastings proposal. Their independent MHK chain targets the exact lattice Gaussian and admits an explicit spectral-gap analysis. They prove a uniform lower bound
\[
\frac{q(\mathbf x)}{\pi(\mathbf x)}\ge \delta
\qquad\forall \mathbf x\in\mathbb Z^n,
\]
where
\[
\delta=\frac{\rho_{\sigma,\mathbf c}(\Lambda)}
{\prod_{i=1}^n \rho_{\sigma_i}(\mathbb Z)}.
\]
This yields
\[
\|P^t(\mathbf x,\cdot)-D_{\Lambda,\sigma,\mathbf c}\|_{TV}\le (1-\delta)^t,
\]
and therefore
\[
t_{\mathrm{mix}}(\varepsilon)<\frac{\log(1/\varepsilon)}{\delta}.
\]
In the trapdoor setting, the overall effort is thus governed by \(\tilde O(1/\delta)\) [1704.02673].

The same bottleneck is expressed in the later quantum treatment by a parameter \(\Delta\), with running time approximately
\[
\ln\!\left(\frac{1}{\varepsilon}\right)\cdot \frac{1}{\Delta}\cdot \mathrm{poly}(n),
\]
where \(1/\Delta\) is essentially the inverse spectral gap up to polynomial factors. If
\[
B_{\max}=\max_i\|\hat b_i\|,
\qquad
s\ge \sqrt{\gamma}\,B_{\max},
\]
then a basis-independent upper bound is
\[
T_{\mathrm{MCMC}}\le \vartheta_3(\gamma)^n(1+2\varepsilon),
\]
with
\[
\vartheta_3(\gamma)=\sum_{k\in\mathbb Z} e^{-\pi \gamma k^2}.
\]
This identifies lattice Gaussian sampling as the dominant runtime bottleneck in GPV trapdoor sampling and in dual attacks [2605.24798].

The MCMC formulation is important because it relaxes the direct-sampling threshold. Wang and Ling emphasize a security–complexity trade-off: instead of requiring \(\sigma=\sqrt{\omega(\log n)}\max_i\|\widehat{\mathbf b_i}\|\) as in the classical GPV/Klein regime, one can target smaller \(\sigma\) and pay a moderate number of MCMC iterations. For \(\alpha=2\), they report \(\vartheta_3(2)\approx 1.0039\), so for \(n=1000\), \(\vartheta_3(2)^n\approx 49\); they interpret this as roughly \(49\) iterations to reduce the parameter from \(\sqrt{\omega(\log n)}\max_i\|\widehat{\mathbf b_i}\|\) to \(\frac{1}{\sqrt{\pi}}\max_i\|\widehat{\mathbf b_i}\|\) [1704.02673].

## 3. Quantum rejection sampling and the truncated Klein construction

The quantum acceleration is built on quantum rejection sampling. Given a proposal distribution \(\nu\) and a target \(\pi\) on a finite set \(\Omega\), if there exists \(p>0\) such that
\[
\nu(x)\ge p\,\pi(x)\qquad \forall x\in\Omega,
\]
then classical rejection sampling uses \(\Theta(1/p)\) proposals per accepted sample. In the quantum setting, if one has a unitary \(O_\nu\) preparing
\[
|\nu\rangle=\sum_{x\in\Omega}\sqrt{\nu(x)}\,|x\rangle
\]
and a controlled rotation encoding
\[
a(x)=p\,\frac{\pi(x)}{\nu(x)},
\]
then amplitude amplification prepares the target q-sample with query complexity
\[
\mathcal O\!\left(\frac{1}{\sqrt p}\right)
\]
[2605.24798].

The technical obstacle is that lattice Gaussians have infinite support, so the quantum construction uses truncation. For
\[
\mathcal X_{\mathcal R}=\{x\in\mathbb Z^n:\|Bx-c\|\le \mathcal R\},
\]
the truncated target and truncated Klein proposal are
\[
\pi_{\mathcal R}(x)=\frac{\rho_{s,c}(Bx)}{\rho_{s,c}(B\mathcal X_{\mathcal R})},
\qquad
Q_{\mathcal R}(x)=\frac{Q(x)}{Q(\mathcal X_{\mathcal R})}.
\]
The key observation is a pointwise domination inequality:
\[
Q_{\mathcal R}(x)\ge p_{\mathcal R}\,\pi_{\mathcal R}(x),
\qquad
p_{\mathcal R}=\frac{\Delta_{\mathcal R}}{Q(\mathcal X_{\mathcal R})}\in (0,1],
\]
where
\[
\Delta_{\mathcal R}
=
\frac{\rho_{s,c}(B\mathcal X_{\mathcal R})}
{\prod_{i=1}^n \rho_{s_i}(\mathbb Z)}.
\]
This is obtained from the one-dimensional bound
\[
\rho_{s_i,\mu_i}(\mathbb Z)\le \rho_{s_i}(\mathbb Z),
\]
so Wang–Ling’s lower-bound machinery becomes exactly the domination condition needed by quantum rejection sampling [2605.24798].

The truncation is chosen so that the truncated Gaussian is negligibly close to the full Gaussian. If
\[
\mathcal R \ge s\left(\sqrt{\frac{m}{2\pi}}+\sqrt{\frac{\log(1/\varepsilon_{\mathrm{tail}})}{\pi}}\right),
\]
then the Gaussian tail outside the ball is at most \(\varepsilon_{\mathrm{tail}}\) times the total mass. Writing
\[
\alpha_{\mathcal R}=\frac{\rho_{s,c}(B\mathcal X_{\mathcal R})}{\rho_{s,c}(\mathcal L)},
\]
one gets
\[
d_{TV}(\pi,\pi_{\mathcal R})=1-\alpha_{\mathcal R}\le \varepsilon_{\mathrm{tail}}.
\]
The same argument extends by a union bound to multiple independent samples [2605.24798].

## 4. Complexity consequences for signing and dual-lattice sampling

With the truncated proposal \(Q_{\mathcal R}\), the target \(\pi_{\mathcal R}\), a Klein oracle
\[
O_{Q_{\mathcal R}}:|0\rangle\mapsto \sum_{x\in\mathcal X_{\mathcal R}}\sqrt{Q_{\mathcal R}(x)}\,|x\rangle,
\]
and the controlled rotation
\[
a(x)=p_{\mathcal R}\frac{\pi_{\mathcal R}(x)}{Q_{\mathcal R}(x)},
\]
quantum rejection sampling prepares
\[
|\pi_{\mathcal R}\rangle
=
\sum_{x\in\mathcal X_{\mathcal R}}\sqrt{\pi_{\mathcal R}(x)}\,|x\rangle
\]
using
\[
\mathcal O\!\left(\frac{1}{\sqrt{p_{\mathcal R}}}\right)
\le
\mathcal O\!\left(\frac{1}{\sqrt{\Delta_{\mathcal R}}}\right)
\]
queries. By contrast, the classical IMHK cost for a single sample is roughly \(\Theta(1/\Delta)\). When \(\mathcal R\) is large enough that almost all mass lies inside the truncation ball, \(\Delta_{\mathcal R}\approx \Delta\), and the dependence on the hard sampling term improves from \(1/\Delta\) to \(1/\sqrt{\Delta}\) [2605.24798].

In the worst-case Wang–Ling bound, the same transition appears as
\[
T_{\mathrm{MCMC}}\lesssim \vartheta_3(\gamma)^n(1+2\varepsilon)
\quad\longrightarrow\quad
T_{\mathrm{QRS}}\lesssim \vartheta_3(\gamma)^{n/2}\sqrt{1+2\varepsilon}.
\]
The paper gives a concrete FALCON-512 example with dimension \(n=2d=1024\) and \(B_{\max}\approx 127\). For \(\gamma=2\), corresponding to \(s\approx 1.414\,B_{\max}\), the classical bound is approximately \(45.49\), while the quantum bound is approximately \(6.74\) [2605.24798].

The same sampler modifies modern dual LWE attack cost estimates because those attacks also require lattice-Gaussian sampling on a dual \(q\)-ary lattice after BKZ reduction. Using the same parameters as Pouly–Shen, the QRS-based replacement reduces the overall attack cost from \(185\) to \(176\) bits for Kyber-512, from \(273\) to \(269\) bits for Kyber-768, and from \(376\) to \(363\) bits for Kyber-1024 without modulus switching. With modulus switching, the reported changes are \(141\to 141\) bits, \(202\to 201\) bits, and \(279\to 261\) bits, respectively. The measured quantity is the base-2 logarithm of the overall time [2605.24798].

These attack results do not change the definition of GPV trapdoor sampling, but they clarify its algorithmic status: lattice-Gaussian sampling is the shared primitive on both the constructive and the cryptanalytic sides.

## 5. Correctness, security, and comparison of sampling paradigms

The correctness condition in GPV is distributional rather than merely geometric. It is not enough to output a short preimage; the sampler must output a distribution negligibly close to the intended lattice Gaussian and independent of the particular trapdoor basis. The truncated quantum sampler preserves this property because the total variation distance between the full and truncated Gaussian can be made negligible by the tail bound, and the truncated distribution itself is sampled exactly by the QRS procedure [2605.24798].

This places three samplers in a clear hierarchy. Direct Klein sampling is efficient but only approximate, and its bias becomes problematic when the Gaussian width is too small relative to the Gram–Schmidt norms. Independent MHK sampling can converge to the exact target distribution, or an arbitrarily close approximation, even for smaller widths, but its cost is governed by the spectral-gap term \(1/\Delta\) or \(1/\delta\). The QRS-based sampler uses the same Klein proposal but replaces mixing-time analysis by state preparation plus amplitude amplification, yielding an exact truncated target distribution with complexity dominated by \(1/\sqrt{\Delta_{\mathcal R}}\,\) [2605.24798].

The MCMC literature also identifies a practical refinement: the independent multiple-try Metropolis–Klein algorithm. If \(k\) independent proposals are drawn at each step, the spectral-gap lower bound becomes
\[
\delta_{\mathrm{MTM}}=\frac{k}{k-1+\frac{1}{\delta}},
\]
which is approximately \(k\delta\) when \(\delta\) is small. This improves convergence by about a factor of \(k\) and supports parallel implementation, which Wang and Ling emphasize as beneficial for practical applications [1704.02673].

Several caveats remain explicit. The quantum work assumes coherent oracle access to a truncated Klein proposal distribution and to the controlled rotation; it analyzes query complexity rather than a complete low-level circuit. It also notes that if \(s\) is extremely close to the smoothing parameter, or if the dimension is very large, then \(\Delta\) itself may be so small that even \(1/\sqrt{\Delta}\) remains large. Likewise, low-level leakage from approximate oracles or incomplete amplitude amplification is outside the theory model [2605.24798].

## 6. Related GPV-style preimage sampling beyond lattice Gaussians

Later work places GPV trapdoor sampling inside a broader theory of trapdoor preimage sampleable functions. In Wave, the GPV strategy is transferred to codes by replacing discrete Gaussians with the uniform distribution on vectors of prescribed Hamming weight. The public function is
\[
f_{w,H}: e\in S_{w,n}\longmapsto H e^\top\in \mathbb F_3^{n-k},
\]
and the trapdoor is a generalized \((U,U+V)\)-code structure. Domain sampling is justified by a variant of the leftover hash lemma, while rejection sampling is used to ensure that the trapdoor inverse output has the proper distribution, namely essentially uniform over all weight-\(w\) preimages of a syndrome [1810.07554].

Miranda develops the same GPV/FDH paradigm in the rank metric through the notion of an Average Trapdoor Preimage Sampleable Function. Its trapdoor is a subcode of a decodable code in a unique decoding regime, built by an Add-and-Remove construction. The signing algorithm samples a small number of uniform bits, solves an extended linear system, and then uses deterministic unique decoding. Proposition 5.4 states that conditioned on success the output is uniformly distributed over the solution set for the target syndrome, and the scheme is designed so that signatures do not leak information on the underlying trapdoor without using rejection sampling [2510.07479].

These code-based analogues do not replace lattice GPV sampling, but they show that the GPV principle is more general than discrete Gaussian generation alone. In lattices, the reference distribution is Gaussian over a coset; in Wave it is uniform over fixed-weight preimages; in Miranda it is uniform over rank-bounded preimages. This suggests a broader interpretation of GPV trapdoor sampling as the problem of efficiently generating trapdoor-independent samples from a high-entropy conditional distribution, with lattice Gaussian sampling as the Euclidean-metric instantiation most directly tied to SIS, ISIS, and dual \(q\)-ary lattice techniques [1810.07554][2510.07479].

Source: https://www.emergentmind.com/topics/gpv-trapdoor-sampling