Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Tangible Quantum Speedup in Learning-With-Errors Problem

Wooyeong Song, Youngrong Lim, Kabgyun Jeong, Yun-Seong Ji, Jinhyoung Lee, Jaewan Kim, Jeongho Bang

Published Aug 17, 2019• 0 citations
OpenAlex

Abstract

Very recently, one of the most biggest agenda issues is to provide the proof of quantum computational speedup, particularly with a prospect for near-term uses. However, many quantum algorithms are beyond the reach of noisy intermediate-scale quantum (NISQ) realization. This is mainly because of the requirement of excessively large superposition and massive quantum circuit. Hence, we propose a (say) ``NISQ-compatible'' algorithm for one of the crucial problems in computation and modern cryptography, the learning-with-errors (LWE) problem. We base an approach on the divide-and-conquer, wherein a large core process is subdivided into smaller subprocesses. For a specific error distribution and problem condition, it is shown that the proposed quantum LWE algorithm allows the use of exponentially less-superposed quantum samples and operation overheads are reduced, while achieving polynomial sample complexity.

Related papers

Quantum solvability of noisy linear systems of equations by divide-and-conquer strategy.

Wooyeong Song, Youngrong Lim, Kabgyun Jeong +5 more

Noisy linear problems have been studied in various science and engineering disciplines. A class of hard noisy linear problems can be formulated as follows: Given a matrix $\hat{A}$ and a vector $\mathbf{b}$ constructed using a finite set of samples, a hidden vector or structure involved in $\mathbf{b}$ is obtained by solving a noise-corrupted linear equation $\hat{A}\mathbf{x} \approx \mathbf{b} + \boldsymbol\eta$, where $\boldsymbol\eta$ is a noise vector that cannot be identified. For solving such a noisy linear problem, we consider a quantum algorithm based on a divide-and-conquer strategy, wherein a large core process is divided into smaller subprocesses. The algorithm appropriately reduces both the computational complexities and size of a quantum sample. More specifically, if a quantum computer can access a particular reduced form of the quantum samples, polynomial quantum-sample and time complexities are achieved in the main computation. The size of a quantum sample and its executing system can be reduced, e.g., from exponential to sub-exponential with respect to the problem length, which is better than other results we are aware. We analyse the noise model conditions for such a quantum advantage, and show when the divide-and-conquer strategy can be beneficial for quantum noisy linear problems.

•Aug 17, 2019•0 citations

Quantum solvability of noisy linear problems by divide-and-conquer strategy

Wooyeong Song, Youngrong Lim, Kabgyun Jeong +5 more

Abstract Noisy linear problems have been studied in various science and engineering disciplines. A class of ‘hard’ noisy linear problems can be formulated as follows: Given a matrix A ^ and a vector b constructed using a finite set of samples, a hidden vector or structure involved in b is obtained by solving a noise-corrupted linear equation A ^ x ≈ b + η , where η is a noise vector that cannot be identified. For solving such a noisy linear problem, we consider a quantum algorithm based on a divide-and-conquer strategy, wherein a large core process is divided into smaller subprocesses. The algorithm appropriately reduces both the computational complexities and size of a quantum sample. More specifically, if a quantum computer can access a particular reduced form of the quantum samples, polynomial quantum-sample and time complexities are achieved in the main computation. The size of a quantum sample and its executing system can be reduced, e.g., from exponential to sub-exponential with respect to the problem length, which is better than other results we are aware. We analyse the noise model conditions for such a quantum advantage, and show when the divide-and-conquer strategy can be beneficial for quantum noisy linear problems.

arXiv:1908.06229•Quantum Science and Technology•Feb 3, 2022•6 citations

Quantum Search-to-Decision Reduction for the LWE Problem

Kyohei Sudo, Keisuke Hara, Masayuki Tezuka +1 more

The learning with errors (LWE) problem is one of the fundamental problems in cryptography and it has many applications in post-quantum cryptography. There are two variants of the problem, the decisional-LWE problem, and the search-LWE problem. LWE search-to-decision reduction shows that the hardness of the search-LWE problem can be reduced to the hardness of the decisional-LWE problem. The efficiency of the reduction can be regarded as the gap in difficulty between the problems. We initiate a study of quantum search-to-decision reduction for the LWE problem and propose a reduction that satisfies sample-preserving. In sample-preserving reduction, it preserves all parameters even the number of instances. Especially, our quantum reduction invokes the distinguisher only 2 times to solve the search-LWE problem, while classical reductions require a polynomial number of invocations. Furthermore, we give a way to amplify the success probability of the reduction algorithm. Our amplified reduction is incomparable to the classical reduction in terms of sample complexity and query complexity. Our reduction algorithm supports a wide class of error distributions and also provides a search-to-decision reduction for the learning parity with noise problem. In the process of constructing the search-to-decision reduction, we give a quantum Goldreich-Levin theorem over ℤq where q is a prime. In short, this theorem states that, if a hardcore predicate a・s (mod q) can be predicted with probability distinctly greater than (1/q) with respect to a uniformly random a ∈ ℤqn, then it is possible to determine s ∈ ℤqn.

IEICE Transactions on Fundamentals of Electronics Communications and Computer Sciences•Aug 15, 2024•0 citations

Quantum-classical hybrid algorithm for solving the learning-with-errors problem on NISQ devices

Muxi Zheng, Jinfeng Zeng, Wentao Yang +7 more

The Learning-With-Errors (LWE) problem is a fundamental computational challenge with implications for post-quantum cryptography and computational learning theory. Here we propose a quantum-classical hybrid algorithm with Ising model to address LWE, transforming it into the Shortest Vector Problem and using variable qubits to encode lattice vectors into an Ising Hamiltonian. By identifying low-energy Hamiltonian levels, the solution is extracted, making the method suitable for noisy intermediate-scale quantum devices. The required number of qubits is less than m(m + 1), where m is the number of samples. Our heuristic algorithm’s time complexity depends on the specific quantum eigensolver used to find low-energy levels, and the performance when using the Quantum Approximate Optimization Algorithm is investigated. We validate the algorithm by solving a 2-dimensional LWE problem on a 5-qubit quantum device, demonstrating its potential for solving meaningful LWE instances on near-term quantum devices. Evaluating the security of post-quantum cryptography is critically important to ensure resilience against quantum attacks. In this paper, the authors study a complex computational task at the heart of post-quantum cryptography with a hybrid quantum-classical algorithm, heuristically finding some advantages.

arXiv:2408.07936•Communications Physics•May 20, 2025•6 citations

Verifiable quantum advantage in extremely low depth

Alexandru Gheorghiu

We give a sampling problem that is solvable by shallow quantum circuits, hard for polynomial-time classical algorithms under lattice-based assumptions, and efficiently verifiable by a classical computer. The quantum sampler admits two implementations: one uses log-logarithmic-depth quantum circuits with one- and two-qubit gates, i.e., $\mathsf{QNC}^0[\log\log]$ circuits, while the other uses constant-depth quantum circuits with unbounded fan-in gates, i.e., $\mathsf{QAC}^0$ circuits. Our construction can be seen as compiling the Learning with Errors (LWE)-based single-round proof of quantumness of Arabadjieva et al. (2025) to very low depth. The price paid for this compilation is the reliance on less standard, though well-motivated, assumptions: in addition to the lattice knowledge assumption used by Arabadjieva et al. (2025), we require a strengthened variant of the adaptive-hardcore-bit property of LWE, for which we provide supporting evidence. Unlike previous low-depth proofs of quantumness, the quantum computation here requires no mid-circuit measurements or feed-forward: it consists only of running a shallow circuit and sampling from its output distribution. This shows that shallow quantum circuits have sufficient structure to solve certain classically hard tasks whose solutions can be verified efficiently.

quant-pharXiv:2609.01448•Sep 2, 2026•0 citations

Design and Analysis of a Scalable and Efficient Quantum Circuit for LWE Matrix Arithmetic

Chao Lu, Utsav Banerjee, Kanad Basu

Quantum computing furnishes exponential speed up over classical computing in specific areas. For example, Shor’s algorithm can factor two numbers in a polynomial time complexity. Thus, many encryption algorithms that rely on large number factorization are potentially vulnerable to quantum computers. In order to address this, the National Institute of Standard and Test (NIST) has organized a competition to evaluate several post quantum cryptography (PQC) algorithms, that are secure from the attacks from quantum computers. Several of these lattice-based PQC encryption algorithms are based on Learning With Errors (LWE) computation. Conversely, LWE is the heaviest computation in a classical computer, which incurs significant portion of the latency overhead for the entire encryption algorithm. In this paper, we design an optimized quantum circuit for LWE computation. The proposed quantum circuit does not need any ancillary qubits and scales efficiently and easily if there are more qubits available on a higher qubit quantum computer.

IEEE International Conference on Computer Design: VLSI in Computers and Processors (ICCD)•Oct 1, 2022•3 citations
Very recently, one of the most biggest agenda issues is to provide the proof of quantum computational speedup, particularly with a prospect for near-term uses. However, many quantum algorithms are beyond the reach of noisy intermediate-scale quantum (NISQ) realization. This is mainly because of the requirement of excessively large superposition and massive quantum circuit. Hence, we propose a (say) ``NISQ-compatible'' algorithm for one of the crucial problems in computation and modern cryptography, the learning-with-errors (LWE) problem. We base an approach on the divide-and-conquer, wherein a large core process is subdivided into smaller subprocesses. For a specific error distribution and problem condition, it is shown that the proposed quantum LWE algorithm allows the use of exponentially less-superposed quantum samples and operation overheads are reduced, while achieving polynomial sample complexity.
Noisy linear problems have been studied in various science and engineering disciplines. A class of hard noisy linear problems can be formulated as follows: Given a matrix A^\hat{A}A^ and a vector b\mathbf{b}b constructed using a finite set of samples, a hidden vector or structure involved in b\mathbf{b}b is obtained by solving a noise-corrupted linear equation A^x≈b+η\hat{A}\mathbf{x} \approx \mathbf{b} + \boldsymbol\etaA^x≈b+η, where η\boldsymbol\etaη is a noise vector that cannot be identified. For solving such a noisy linear problem, we consider a quantum algorithm based on a divide-and-conquer strategy, wherein a large core process is divided into smaller subprocesses. The algorithm appropriately reduces both the computational complexities and size of a quantum sample. More specifically, if a quantum computer can access a particular reduced form of the quantum samples, polynomial quantum-sample and time complexities are achieved in the main computation. The size of a quantum sample and its executing system can be reduced, e.g., from exponential to sub-exponential with respect to the problem length, which is better than other results we are aware. We analyse the noise model conditions for such a quantum advantage, and show when the divide-and-conquer strategy can be beneficial for quantum noisy linear problems.
Abstract Noisy linear problems have been studied in various science and engineering disciplines. A class of ‘hard’ noisy linear problems can be formulated as follows: Given a matrix A ^ and a vector b constructed using a finite set of samples, a hidden vector or structure involved in b is obtained by solving a noise-corrupted linear equation A ^ x ≈ b + η , where η is a noise vector that cannot be identified. For solving such a noisy linear problem, we consider a quantum algorithm based on a divide-and-conquer strategy, wherein a large core process is divided into smaller subprocesses. The algorithm appropriately reduces both the computational complexities and size of a quantum sample. More specifically, if a quantum computer can access a particular reduced form of the quantum samples, polynomial quantum-sample and time complexities are achieved in the main computation. The size of a quantum sample and its executing system can be reduced, e.g., from exponential to sub-exponential with respect to the problem length, which is better than other results we are aware. We analyse the noise model conditions for such a quantum advantage, and show when the divide-and-conquer strategy can be beneficial for quantum noisy linear problems.
The learning with errors (LWE) problem is one of the fundamental problems in cryptography and it has many applications in post-quantum cryptography. There are two variants of the problem, the decisional-LWE problem, and the search-LWE problem. LWE search-to-decision reduction shows that the hardness of the search-LWE problem can be reduced to the hardness of the decisional-LWE problem. The efficiency of the reduction can be regarded as the gap in difficulty between the problems. We initiate a study of quantum search-to-decision reduction for the LWE problem and propose a reduction that satisfies sample-preserving. In sample-preserving reduction, it preserves all parameters even the number of instances. Especially, our quantum reduction invokes the distinguisher only 2 times to solve the search-LWE problem, while classical reductions require a polynomial number of invocations. Furthermore, we give a way to amplify the success probability of the reduction algorithm. Our amplified reduction is incomparable to the classical reduction in terms of sample complexity and query complexity. Our reduction algorithm supports a wide class of error distributions and also provides a search-to-decision reduction for the learning parity with noise problem. In the process of constructing the search-to-decision reduction, we give a quantum Goldreich-Levin theorem over ℤq where q is a prime. In short, this theorem states that, if a hardcore predicate a・s (mod q) can be predicted with probability distinctly greater than (1/q) with respect to a uniformly random a ∈ ℤqn, then it is possible to determine s ∈ ℤqn.
The Learning-With-Errors (LWE) problem is a fundamental computational challenge with implications for post-quantum cryptography and computational learning theory. Here we propose a quantum-classical hybrid algorithm with Ising model to address LWE, transforming it into the Shortest Vector Problem and using variable qubits to encode lattice vectors into an Ising Hamiltonian. By identifying low-energy Hamiltonian levels, the solution is extracted, making the method suitable for noisy intermediate-scale quantum devices. The required number of qubits is less than m(m + 1), where m is the number of samples. Our heuristic algorithm’s time complexity depends on the specific quantum eigensolver used to find low-energy levels, and the performance when using the Quantum Approximate Optimization Algorithm is investigated. We validate the algorithm by solving a 2-dimensional LWE problem on a 5-qubit quantum device, demonstrating its potential for solving meaningful LWE instances on near-term quantum devices. Evaluating the security of post-quantum cryptography is critically important to ensure resilience against quantum attacks. In this paper, the authors study a complex computational task at the heart of post-quantum cryptography with a hybrid quantum-classical algorithm, heuristically finding some advantages.
We give a sampling problem that is solvable by shallow quantum circuits, hard for polynomial-time classical algorithms under lattice-based assumptions, and efficiently verifiable by a classical computer. The quantum sampler admits two implementations: one uses log-logarithmic-depth quantum circuits with one- and two-qubit gates, i.e., QNC0[log⁡log⁡]\mathsf{QNC}^0[\log\log]QNC0[loglog] circuits, while the other uses constant-depth quantum circuits with unbounded fan-in gates, i.e., QAC0\mathsf{QAC}^0QAC0 circuits. Our construction can be seen as compiling the Learning with Errors (LWE)-based single-round proof of quantumness of Arabadjieva et al. (2025) to very low depth. The price paid for this compilation is the reliance on less standard, though well-motivated, assumptions: in addition to the lattice knowledge assumption used by Arabadjieva et al. (2025), we require a strengthened variant of the adaptive-hardcore-bit property of LWE, for which we provide supporting evidence. Unlike previous low-depth proofs of quantumness, the quantum computation here requires no mid-circuit measurements or feed-forward: it consists only of running a shallow circuit and sampling from its output distribution. This shows that shallow quantum circuits have sufficient structure to solve certain classically hard tasks whose solutions can be verified efficiently.
Quantum computing furnishes exponential speed up over classical computing in specific areas. For example, Shor’s algorithm can factor two numbers in a polynomial time complexity. Thus, many encryption algorithms that rely on large number factorization are potentially vulnerable to quantum computers. In order to address this, the National Institute of Standard and Test (NIST) has organized a competition to evaluate several post quantum cryptography (PQC) algorithms, that are secure from the attacks from quantum computers. Several of these lattice-based PQC encryption algorithms are based on Learning With Errors (LWE) computation. Conversely, LWE is the heaviest computation in a classical computer, which incurs significant portion of the latency overhead for the entire encryption algorithm. In this paper, we design an optimized quantum circuit for LWE computation. The proposed quantum circuit does not need any ancillary qubits and scales efficiently and easily if there are more qubits available on a higher qubit quantum computer.