Continuous LWE is as Hard as LWE & Applications to Learning Gaussian Mixtures

Abstract

We show direct and conceptually simple reductions between the classical learning with errors (LWE) problem and its continuous analog, CLWE (Bruna, Regev, Song and Tang, STOC 2021). This allows us to bring to bear the powerful machinery of LWE-based cryptography to the applications of CLWE. For example, we obtain the hardness of CLWE under the classical worst-case hardness of the gap shortest vector problem. Previously, this was known only under quantum worst-case hardness of lattice problems. More broadly, with our reductions between the two problems, any future developments to LWE will also apply to CLWE and its downstream applications.As a concrete application, we show an improved hardness result for density estimation for mixtures of Gaussians. In this computational problem, given sample access to a mixture of Gaussians, the goal is to output a function that estimates the density function of the mixture. Under the (plausible and widely believed) exponential hardness of the classical LWE problem, we show that Gaussian mixture density estimation in R n with roughly log n Gaussian components given poly(n) samples requires time quasi-polynomial in n. Under the (conservative) polynomial hardness of LWE, we show hardness of density estimation for n ǫ Gaussians for any constant ǫ > 0, which improves on Bruna, Regev, Song and Tang (STOC 2021), who show hardness for at least √ n Gaussians under polynomial (quantum) hardness assumptions. Our key technical tool is a reduction from classical LWE to LWE with k-sparse secrets where the multiplicative increase in the noise is only O( √ k), independent of the ambient dimension n.

Learning (Very) Simple Generative Models Is Hard

“…Finally, we remark that the family of hard distributions we construct can be thought of as a close cousin of the "parallel pancakes" construction of [DKS17]. This and slight modifications thereof are mixtures of Gaussians which are known to be computationally hard to known both in the SQ model [DKS17,BLPR19] and under cryptographic assumptions [BRST21,GVV22].…”

Cryptographic Hardness of Learning Halfspaces with Massart Noise

“…In particular, we consider the problem where the x samples are taken uniformly from R n /Z n , y is either taken to be an independent random element of R/Z or is taken to be x, s mod 1 plus a small amount of (continuous) Gaussian noise, where s is some unknown vector in {±1} n . The reduction between these problems follows from existing techniques [Mic18a,GVV22].…”

“…Specifically, [BRST21] defined a continuous version of LWE (whose hardness they established) and reduced it to the problem of learning GMMs. More recently, [GVV22] obtained a direct reduction from LWE to a (different) continuous version of LWE; and leveraged this connection to obtain quantitatively stronger hardness for learning GMMs. It is worth noting that for the purposes of our reduction, we require as a starting point a continuous version of LWE that differs from the one defined in [BRST21].…”

“…Specifically, we require that the distribution on x is uniform on [0, 1] n (instead of a Gaussian, as in [BRST21]) and the secret vector is binary. The hardness of this continuous version essentially follows from [Mic18b,GVV22].…”

“…Thus, refuting the conjecture would be a major breakthrough. A similar assumption was also used in [GVV22] to establish computational hardness of learning Gaussian mixtures. Our use of a sub-exponential hardness of LWE is not a coincidence; see Section 4.…”