Lattice Gaussian Sampling with Markov Chain Monte Carlo (MCMC)

Transcription

1 Lattice Gaussian Sampling with Markov Chain Monte Carlo (MCMC) Cong Ling Imperial College London aaa joint work with Zheng Wang (Huawei Technologies Shanghai) aaa September 20, 2016 Cong Ling (ICL) MCMC September 20, / 23

2 Outline 1 Background 2 Markov Chain Monte Carlo (MCMC) 3 Convergence Analysis 4 Open Questions Cong Ling (ICL) MCMC September 20, / 23

3 Lattice Gaussian Distribution Lattice Λ = L(B) = {Bx : x Z n } Continuous Gaussian distribution ρ σ,c(z) = 1 z c 2 ( 2πσ) n e 2σ 2 D Z 2,σ (λ) Discrete Gaussian distribution over lattice Λ D Λ,σ,c (x) = ρσ,c(bx) ρ σ,c(λ) = where ρ σ,c(λ) Bx Λ ρσ,c(bx) e 1 2σ 2 Bx c 2 x Z n e 1 2σ 2 Bx c λ Fig. 1. Discrete Gaussian distribution over Z λ Cong Ling (ICL) MCMC September 20, / 23

4 Why Does It Matter? Decoding The shape of D Λ,σ,c (x) suggests that a lattice point Bx closer to c will be sampled with a higher probability solve the CVP and SVP problems [Aggarwal et al. 2015, Stephens-Davidowitz 2016] decoding of MIMO systems [Liu, Ling and Stehlé 2011] Closest Vector Problem (CVP) Given a lattice basis B R n n and a target point c R n, find the closest lattice point Bx to c Shortest Vector Problem (SVP) Given a lattice basis B R n n, find the shortest nonzero vector of B Cong Ling (ICL) MCMC September 20, / 23

5 Why Does It Matter? Mathematics prove the transference theorem of lattices [Banaszczyk 1993] Coding obtain the full shaping gain in lattice coding [Forney, Wei 1989, Kschischang, Pasupathy 1993] capacity achieving distribution in information theory: Gaussian channel [Ling, Belfiore 2013], Gaussian wiretap channel [Ling, Luzzi, Belfiore and Stehlé 2013], fading and MIMO channels [Campello, Ling, Belfiore 2016]... Cryptography propose lattice-based cryptosystems based on the worst-case hardness assumptions [Micciancio, Regev 2004] underpin the fully-homomorphic encryption for cloud computing [Gentry 2009] How to sample from lattice Gaussian distribution? The problem that lattice Gaussian sampling aims to solve Cong Ling (ICL) MCMC September 20, / 23

6 State of the Art Klein s algorithm [Klein 2000]: works if σ ω( log n) max 1 i n b i where b i s are Gram-Schmidt vectors [Gentry, Peikert, Vaikuntanathan 2008]. Aggarwal et al. 2015: works for arbitrary σ, exponential time, exponential space. Markov chain Monte Carlo [Wang, Ling 2014]: arbitrary σ, polynomial space, how much time? For special lattices: Construction A, B etc., very fast [Campeloo, Belfiore 2016]; polar lattices, quasilinear complexity [Yan et al. 14]. Cong Ling (ICL) MCMC September 20, / 23

7 Klein Sampling By sequentially sampling from the 1-dimension conditional Gaussian distribution D Z,σi, x i in a backward order from x n to x 1, the probability of Klein is n P Klein (x) = D Z,σi, x i (x i ) = ρ σ,c(bx) ni=1 (1) ρ σi, x i (Z) i=1 Klein s Algorithm Input: B, σ, c Output: Bx Λ 1 let B = QR and c = Q T c 2 for i = n,..., 1 do 3 let x i = c i n j=i+1 r i,j x j σ i = σ r i,i r i,i, 4 sample x i from D Z,σi, x i 5 end for 6 return Bx P Klein (x) has been demonstrated in [GPV,2008] to be close to D Λ,σ,c (x) within a negligible statistical distance if σ ω( log n) max 1 i n bi The operation of Klein s algroithm has polynomial complexity O(n 2 ) excluding QR decomposition Cong Ling (ICL) MCMC September 20, / 23

8 Markov Chain Monte Carlo (MCMC) Markov chain Monte Carlo (MCMC) methods were introduced into lattice Gaussian sampling for the range of σ beyond the reach of Klein s algorithm [Wang, Ling and Hanrot, 2014]. MCMC methods attempt to sample from an intractable target distribution of interest by building a Markov chain, which randomly generates the next sample conditioned on the previous sample. Cong Ling (ICL) MCMC September 20, / 23

9 Gibbs Sampling Gibbs Sampling At each Markov move, perform sampling over a single component of x P (x t+1 i where x t [ i] = (xt 1,..., xt i 1, xt i+1,..., xt n ). x t [ i] ) = e 1 2σ 2 Bxt+1 c 2 1 x t+1 Z e 2σ 2 Bxt+1 c 2 i Gibbs-Klein Sampling Algorithm [Wang, Ling and Hanrot, 2014] At each Markov move, perform the sampling over a block of components of x, while keeping the complexity at the same level as that of componentwise sampling 1 P (x t+1 block xt [ block] ) = e 2σ 2 Bxt+1 c 2 1 x t+1 block Zm e 2σ 2 Bxt+1 c 2 Cong Ling (ICL) MCMC September 20, / 23

10 Metropolis-Hastings Sampling In 1970 s, the original Metropolis sampling was extended to a more general scheme known as the Metropolis-Hastings (MH) sampling, which can be summarized as: Given the current state x for Markov chain X t, a state candidate y for the next Markov move X t+1 is generated from the proposal distribution q(x, y) Then the acceptance decision ratio α about y is computed { } π(y)q(y, x) α(x, y) = min 1,, (2) π(x)q(x, y) where π(x) is the target invariant distribution y and x will be accepted as the state by X t+1 with probability α and 1 α, respectively In MH sampling, q(x, y) can be any fixed distribution. However, as the dimension goes up, finding a suitable q(x, y) could be difficult Cong Ling (ICL) MCMC September 20, / 23

11 Independent Metropolis-Hastings-Klein Sampling In [Wang, Ling 2015], Klein s sampling is used to generate the state candidate y for the Markov move X t+1, namely, q(x, y) = P Klein (y) The generation of y for X t+1 does not depend on the previous state X t q(x, y) = q(y) is a special case of MH sampling known as independent MH sampling [Tierney, 1991] Independent MHK sampling algorithm Sample from the independent proposal distribution through Klein s algorithm to obtain the candidate state y for X t+1 ρ σ,c(by) q(x, y) = q(y) = P Klein (y) = n i=1 ρ, σi,ỹi(z) where y Z n Calculate the acceptance ratio α(x, y) { } { } α(x, y) = min π(y)q(y, x) 1, = min 1, π(y)q(x) π(x)q(x, y) π(x)q(y), where π = D Λ,σ,c Make a decision for X t+1 based on α(x, y) to accept X t+1 = y or not Cong Ling (ICL) MCMC September 20, / 23

12 Ergodicity A Markov chain is ergodic if there exists a limiting distribution π( ) such that lim P t (x; ) π( ) T V = 0 t where T V is the total variation distance All the afore-mentioned Markov chains are ergodic Modes of ergodicity Polynomial Ergodicity P t (x; ) π( ) T V = M 1 f(t) Uniform Ergodicity P t (x; ) π( ) T V = M(1 δ) t Geometric Ergodicity f(t) is a polynomial function of t, M <, 0 < δ < 1 P t (x; ) π( ) T V = M(x)(1 δ) t Mixing Time of a Markov Chain t mix (ɛ) = min{t : max P t (x, ) π( ) T V ɛ}. Cong Ling (ICL) MCMC September 20, / 23

13 Ergodicity of Independent MHK The transition probability P (x, y) of the independent MHK algorithm is { } min q(y), π(y)q(x) if y x, π(x) P (x,y)=q(x, y) α(x, y)= { } q(x)+ 0,q(z) z xmax π(z)q(x) if y= x. π(x) (3) Lemma 1 Given the invariant distribution D Λ,σ,c, the Markov chain induced by the independent MHK algorithm is ergodic lim P t (x; ) D Λ,σ,c T V = 0 t for all states x Z n. Proof: For a countably infinite state space Markov chain, ergodicity is achieved by irreducibility, aperiodicity and reversibility The Markov chain produced by the proposed algorithm is inherently reversible (x y) π(x)p (x, y) = π(x)q(x, y)α(x, y) = min{π(x)q(y), π(y)q(x)} = π(y)p (y, x) (4) Cong Ling (ICL) MCMC September 20, / 23

14 Uniform Ergodicity Lemma 2 In the independent MHK algorithm for lattice Gaussian sampling, there exists a constant δ > 0 such that q(x) π(x) δ for all x Z n. Proof: q(x) π(x) = = ρ σ,c(bx) n i=1 ρ ρ σ,c(λ) σi, xi(z) ρ σ,c(bx) ρ σ,c(λ) n i=1 ρ (Z) σi, xi ρ σ,c(λ) n, (5) i=1 ρσ i (Z) where the right-hand side (RHS) of (5) is completely independent of x Cong Ling (ICL) MCMC September 20, / 23

15 Uniform Ergodicity Theorem 1 Given the invariant lattice Gaussian distribution D Λ,σ,c, the Markov chain induced by the independent MHK algorithm is uniformly ergodic: for all x Z n, where δ is given in Lemma 2. P t (x, ) D Λ,σ,c ( ) T V (1 δ) t Proof: Based on Lemma 2, we have P (x, y) δπ(y). (6) According to coupling technique, every Markov move gives probability at least δ of making X and X equal, P (X = X ) δ. (7) Therefore, during t consecutive Markov moves, the probability of X and X not equaling each other can be derived as P (X t X t) = (1 P (X = X )) t (1 δ) t (8) By invoking the coupling inequality, we have P t (x, ) π( ) T V P (X t X t) (1 δ) t (9) Cong Ling (ICL) MCMC September 20, / 23

16 Convergence Parameter δ (when c = 0) Analysis of the Convergence Parameter δ In the case of c = 0, δ can be expressed by Theta series Θ Λ and Jacobi theta function ϑ 3 as q(x) ρ σ,0 (Λ) = n π(x) i=1 ρ (Z) σi, xi = x Z n e 1 2σ 2 Bx 2 n i=1 ρσ i (Z) 1 Θ Λ ( n i=1 ϑ 3( 2πσ 2 ) 1 2πσ 2 i ) = δ (10) Theta series Θ Λ and Jacobi theta function ϑ 3 are Θ Λ (τ) = e πτ λ 2, (11) λ Λ + ϑ 3 (τ) = e πτn2 (12) n= with Θ Z = ϑ 3 Cong Ling (ICL) MCMC September 20, / 23

17 Convergence Parameter δ (when c = 0) Given the lattice basis B, the value of δ can be calculated 1.5 1/δ in D 4 lattice /δ πσ 2 (db) Fig. 2. The value of 1 δ of the D 4 lattice in the case of c = 0. Therefore, the mixing time of the Markov chain can be estimated by ( ) lnɛ 1 t mix (ɛ) = ln(1 δ) < ( lnɛ), ɛ < 1 δ Cong Ling (ICL) MCMC September 20, / 23

18 Convergence Parameter δ (when c = 0) Lemma 3 In the case of c = 0, the coefficient δ for an isodual lattice has a multiplicative symmetry point at σ = 1, and converges to 1 on both sides asymptotically when σ goes to 0 and. 2π 2.5 1/δ in E 8 lattice 80 1/δ in Leech lattice /δ 1/δ πσ 2 (db) Fig. 3. The value of 1 δ of the E 8 lattice in the case of c = πσ 2 (db) Fig. 4. The value of δ 1 of the Leech lattice in the case of c = 0. Cong Ling (ICL) MCMC September 20, / 23

19 Metropolis-Hastings Sampling How MH algorithm works? Firstly, sample from the proposal density T (x; y) to get a candidate. Then, make a decision based on the quantity { α to decide } whether to accept this candidate as x t+1 π(y)t (y; x) or not α = min 1, (13) π(x)t (x; y) where π( ) denotes the target distribution. The art of MH algorithm lies in choosing an appropriate proposal density. One can use Klein s algorithm to generate the proposal density, which turns out to be symmetric: T (x; y) = T (y; x). Here, where ρ σ,c(z) = e z c 2 2σ 2 α = min T (x t ; x 1 ) = n e 1 σ 2 Bxt Bx 2, (14) i=1 ρ σ i,x t (Z) i is a symmetrical Gaussian function. Then the acceptance ratio α { 1, π(x ) π(x t ) } = min {1, e 1 2σ 2 ( c Bx 2 c Bx t 2 ) }. (15) Cong Ling (ICL) MCMC September 20, / 23

20 Geometric Ergodicity Definition A Markov chain having stationary distribution π( ) is geometrically ergodic if there exists 0 < δ < 1 and M(x) < such that for all x P t (x, ) π( ) T V M(x)(1 δ) t. In MCMC, the drift condition is the usual way to prove the geometric ergodicity [Roberts and Tweedie 1996] Definition A Markov chain with discrete state space Ω satisfies the drift condition if there are constants 0 < λ < 1 and b <, and a function V : Ω [1, ], such that P (x, y)v (y) λv (x) + b1 C (x) Ω for all x Ω, where C is a small set, 1 C (x) equals to 1 when x C and 0 otherwise. Cong Ling (ICL) MCMC September 20, / 23

21 Geometric Ergodicity Theorem Given the invariant lattice Gaussian distribution D Λ,σ,c, the Markov chain established by the symmetric Metropolis-Hastings algorithm satisfies the drift condition. Therefore, it is geometrically ergodic. Overall, exponential convergence can be interpreted in two folds when x i / C, the Markov chain shrinks geometrically towards the small set C when x i C, the Markov chain converges exponentially fast to the stationary there is a trade-off between these two convergence rates depending on the size of C However, as C is determined artificially, such a tradeoff is hard to analyze The small set C means that there exist k > 0, 1 > δ > 0 and a probability measure v on Ω such that P k (x, B) δv(b), x C for all measurable subsets B Ω For independent MHK, the entire state space Ω is small. Cong Ling (ICL) MCMC September 20, / 23

22 Open Questions Fast convergence requires strong lattice reduction. How to integrate MCMC and lattice reduction? Is the complexity of MCMC exponential or super-exponential? It would be a breakthrough even if it is exponential. What about other MCMC algorithms? How to design fast-mixing MCMC for discrete Gaussian sampling? What about quantum algorithms? Cong Ling (ICL) MCMC September 20, / 23

23 Cong Ling (ICL) MCMC September 20, / 23