Paper 2026/1550

Algorithms for Sparse LWE and LPN with Small Secrets

Abstract

We present new sample-runtime tradeoffs for the decisional sparse Learning With Errors (LWE) and sparse Learning Parity with Noise (LPN) problems over $\mathbb{Z}_q$, specifically in regimes where the secret vector is constrained by a small $l_{\infty}$ norm. While small-secret constraints are useful for the practical efficiency of lattice-based cryptography—such as homomorphic encryption and zero-knowledge proofs—the extent to which an adversary can exploit these bounds when the coefficient matrix is sparse is an open question. We address this by reducing the distinguishing task to a relaxed variant of the Short Integer Solution (SIS) problem, where the strict $A^\text{T} \mathbf{c} = 0$ requirement is replaced with an $l_1$-norm bound on $A^\text{T} \mathbf{c}$. To solve this relaxed SIS problem, we design an algorithm that samples distinct, non-trivial walks on a Kikuchi graph having close end points. For LWE, this approach directly separates planted from random instances. For LPN, where the noise is uniformly distributed over non-zero elements, the proof is more involved. We first derive a different reduction from LPN to (relaxed) SIS and then extend the anti-concentration framework given by Gupta, He, O'Donnell, and Singer (SODA 2026).