Deciding whether a Lattice has an Orthonormal Basis is in co-NP

We show that the problem of deciding whether a given Euclidean lattice L has an orthonormal basis is in NP and co-NP. Since this is equivalent to saying that L is isomorphic to the standard integer lattice, this problem is a special form of the Lattice Isomorphism Problem, which is known to be in the complexity class SZK.


Introduction
Let B ∈ R n×n be a non-singular matrix generating a full-dimensional Euclidean lattice Λ(B) = {Bz | z ∈ Z n }.Several problems in the algorithmic theory of lattices, such as the covering radius problem, or the shortest or closest vector problem, become easy if the columns of B form an orthonormal basis.However, if B is any basis and we want to decide whether there is an orthonormal basis of Λ(B), not much is known.As this is equivalent to Λ(B) being a rotation of Z n , we call this decision problem the Rotated Standard Lattice Problem (RSLP), which is the main concern of the work at hand.The goal of this article is twofold.For one, we want to show that the RSLP is in NP ∩ co-NP.We will use a result of Elkies on characteristic vectors [5], which appear in analytic number theory.It seems that characteristic vectors are rather unknown in the algorithmic lattice theory, mayhap because it is unclear how they can be used.The second attempt of this paper is thus to introduce Elkies' result and characteristic vectors to a wider audience.

Related work
In [11], Lenstra and Silverberg show that RSLP can be decided in polynomial time, provided that additional information on the automorphism group of the lattice is part of the input.However, they do not discuss the complexity of this problem in general, though their results might allow for a co-NP certificate for the general case as well.When the input lattice is a construction-A lattice, Chandrasekaran, Gandikota and Grigorescu show that existence of an orthogonal basis can be decided in polynomial time [2].If it exists, they also find one.
The RSLP can be seen as a special case of the Lattice Isomorphism Problem, which, given two lattices Λ 1 , Λ 2 , asks whether there is an isomorphism ϕ : Λ 1 → Λ 2 between the two lattices that preserves the Euclidean structure ( x, y = ϕ(x), ϕ(y) ).That is, x, y = n i=1 x i y i for x, y ∈ R n .
The Lattice Isomorphism Problem was first introduced by Plesken and Souvignier [13], solving it in small dimension for specific lattices of interest.In [4], Dutour Sikirić, Schürmann and Vallentin show that this problem is at least as hard as the more famous Graph Isomorphism Problem.The best algorithm for the Lattice Isomorphism Problem the author is aware of is due to Haviv and Regev, and has a running time of n O(n) [8].They solve the problem by computing all orthogonal linear transformations between the two given lattices Λ 1 , Λ 2 .On the complexity side, they show that the problem is in the complexity class SZK (Statistical Zero Knowledge), which already suggests that it is not NP-hard.
Sufficient background for the topic is provided in the next section, where we also introduce characteristic vectors and show some easy properties.Then, we show that RSLP is in NP ∩ co-NP, and conclude with open questions.

Preliminaries
In the following, we will provide sufficient background on lattices.For more details and proofs, we refer to the textbook of Gruber & Lekkerkerker [7].
For linearly independent vectors b We are interested in the following problem, which is a special case of the Lattice Isomorphism Problem.

Rotated Standard Lattice Problem
Instance: A lattice Λ ⊆ R n , given by a basis B ∈ R n×n .Task: Decide whether Λ ∼ = Z n .
The attentive reader might notice that an isomorphism refers to an orthogonal matrix Q, whereas a rotation usually refers to an orthogonal matrix with positive determinant, det(Q) = 1.However, in our setting, i.e. one of the lattices in consideration is fixed to Z n , the terms turn out to be equivalent for the following reason.A matrix B generates Z n , if and only if B is unimodular.Given an isomorphic lattice with basis QB, we can multiply the first column of Q and the first row of B by −1, without changing the basis QB.This flips the sign of det(Q), while B remains unimodular.Hence, Λ(QB) is indeed a rotation of Z n .
Though a lattice is usually specified by a basis matrix B, we will see that another representation is preferable for this problem.
The Gram matrix G of a basis B is defined as An advantage of the Gram matrix is that it "forgets" the embedding of a lattice Λ into the Euclidean space, and only carries the information of the isomorphism class of Λ, as implied by the following lemma.
Proof.If there is an isomorphism Λ(B 1 ) = QΛ(B 2 ), then QB 2 is a basis of Λ 1 .This implies that there is a unimodular matrix U ∈ Z n×n such that B 1 = QB 2 U , and we obtain 2 , and verify Hence, we find Clearly, a Gram matrix is always symmetric and positive definite.Since every symmetric and positive definite matrix has a Cholesky decomposition, we can consider every symmetric and positive definite matrix as a Gram matrix of some lattice basis.Moreover, the lattice Z n is generated by the identity, whose Gram matrix is in addition unimodular.This grants a reduction to the following problem.

Unimodular Decomposition Problem (UDP)
Instance: A symmetric, positive definite, unimodular matrix G ∈ Z n×n .Task: Decide whether there exists a unimodular matrix Clearly, UDP is in NP.A certificate is simply given by the matrix U , whose entries are bounded by max{ In the following, we will discuss a paper of Elkies [5] and apply his results to show that the problem is also in co-NP.
To this end, let us recall some terminology for a full-dimensional lattice Λ ⊆ R n .The dual of Λ, denoted by Λ ⋆ , is defined as Self-dual lattices are also called unimodular lattices for the following reason.This also implies that in a self-dual lattice, the scalar product of any two vectors is an integer.

Definition 3.
A vector w ∈ Λ of a self-dual lattice Λ is said to be characteristic, if For x ≡ y mod k, we will also write x ≡ k y for short.
It is known that for dimensions n ≤ 7, the lattice Z n is the unique self-dual lattice (up to isomorphism) [3].In dimension 8, the lattice is self-dual, but not isomorphic to Z 8 .Here 1 = (1, . . ., 1) ⊺ denotes the all-one vector.Before we turn our attention to the main result, let us show some basic properties of characteristic vectors.

Lemma 4.
The following are true for every self-dual lattice Λ = Λ ⋆ ⊆ R n .i) There exists a characteristic vector w ∈ Λ.
ii) The set of characteristic vectors is precisely a co-set w + 2Λ, where w ∈ Λ is any characteristic vector.
iv) If we are given a Gram matrix G of Λ, we can compute a vector z ∈ Z n such that for all y ∈ Z n , we have y ⊺ Gz ≡ 2 y ⊺ Gy in polynomial time.
Thus, w is a characteristic vector and i) is shown.
ii) Now let w be as in the first part, and w ′ be any characteristic vector.Since for any y ∈ Λ, we have w ′ + 2y, v = w ′ , v + 2 y, v ≡ 2 w ′ , v , the whole co-set w ′ + 2Λ consists of characteristic vectors.
If w ′ has the representation for every coefficient γ k shows that w ′ ∈ w + 2Λ, finishing the proof of point ii).
iii) Let w = Bc be a characteristic vector.It suffices to show that we have ||w|| 2 − ||w + 2b k || 2 ≡ 8 0 for k = 1, . . ., n.The claim then follows by repeatedly adding or subtracting twice a basis vector.Let G = B ⊺ B, and compute where the emphasized equivalence follows from w being a characteristic vector.Since G kk ∈ Z, we are done.
v) Choosing the identity matrix as lattice basis, it follows that all characteristic vectors of Z n must have odd entries only, hence point v) follows.
The computations carried out in part ii) are already discussed in [6].Point iii) can also be found in [14, Chap.V].Both sources are written in terms of quadratic forms.

The Unimodular Decomposition Problem is in NP and co-NP
We are now able to provide the main result of this article.The crucial argument we are using will be Elkies' theorem, which reads as follows.
Theorem 5 (Elkies [5]).Let Λ be a unimodular lattice in R n with no characteristic vector such that w 2 < n.Then Λ ∼ = Z n .
Our result can now be proven as follows.Assume we are given a Gram matrix G such that there is no unimodular matrix U with G = U ⊺ U .We can interpret G as the Gram matrix of some lattice, for instance by considering the Cholesky decomposition and by Elkies, there is a characteristic vector w ∈ Λ(L) with w 2 < n.Our certificate will be the coefficient vector of w, i.e. the vector z such that w = Lz.In Lemma 6, we will show that z is independent of the matrix L, and it suffices to check the parity condition of a characteristic vector on the n vectors of an arbitrary basis B, instead of all lattice vectors.In Lemma 7, we will show that the coefficients of w appearing in z cannot be too large, i.e. the bit complexity of the certificate is polynomially bounded by the input size.

Lemma 6.
Let G ∈ Z n×n be a symmetric, positive definite, and unimodular matrix.We have if and only if for every matrix B with B ⊺ B = G, the vector w = Bz is a characteristic vector in the lattice Λ(B).
showing that w is indeed a characteristic vector.

Lemma 7.
Let G ∈ Z n×n be a symmetric, positive definite, and unimodular matrix, and z ∈ Z n such that z ⊺ Gz ≤ n and Then the bit complexity of z is polynomially bounded by the bit complexity of G.
Proof.Let M ∈ Z be a bound on the entries of G, i.e. |G i,j | ≤ M for all i, j in range, and let v 1 , . . ., v n be an orthonormal basis of eigenvectors with eigenvalues 0 , and since z ∈ Z n , its bit-complexity is bounded by O(n(log(n) + log(M ))).

Theorem 8. The Unimodular Decomposition Problem (and thus the Rotated Standard Lattice Problem) is in NP
, where U i is the i-th column, all entries in U are bounded by max{ √ G ii | i = 1, . . ., n}, hence the encoding size is polynomial in the input, and verifying the certificate takes polynomial time.
If G is a no-instance, by Elkies' Theorem and Lemma 6, there exists a vector z ∈ Z n corresponding to a short characteristic vector.By Lemmas 6 and 7, we can verify that z is a certificate in polynomial time.

Conclusion
We have seen that characteristic vectors are well suited as a certificate for the RSLP, and their coefficient vectors for the UDP.If Λ is given by its basis, it follows from the discussions that the problem at hand can be solved by computing the co-set of characteristic vectors, together with a single call to an oracle for the Closest Vector Problem (CVP), computing the shortest among all characteristic vectors.However, CVP is NP-hard, and the best known running time using this reduction we are aware of is 2 O(n) (see e.g.[1]).
Another easy approach to the RSLP is the following.If a lattice admits an orthogonal basis {b 1 , . . ., b n }, then any basis reduced in the sense of Hermite, Korkine and Zolotareff [10,9] is an orthogonal basis.Due to the recursive structure of those bases, n calls to an oracle for the Shortest Vector Problem (SVP) are sufficient to find this basis.Hence the best known running time using this reduction is 2 O(n) (see e.g.[1]), but allows to find general orthogonal bases.
However, as this problem is -from a complexity point of view -supposedly easier than SVP or CVP, it is of great interest to see a smarter algorithm.It seems to be a reappearing phenomenon that if a class C of lattices allows to solve lattice problems such as SV P or CV P fast, a certain representation is needed.For instance, if Λ is a lattice of Voronoi's first kind, we still need to know an obtuse superbasis before using the polynomial time algorithm in [12].The only exception the author is aware of are construction-A lattices [2].Therefore, being able to detect orthonormal, or even orthogonal bases is an interesting open problem.

Lemma 2 .
A matrix B ∈ R n×n generates a self-dual lattice Λ(B) if and only if the corresponding Gram matrix G = B ⊺ B is unimodular.Proof.Let B be the basis of a self-dual lattice.Then B −⊺ is a basis as well, and there exists a unimodular matrix G such that B −⊺ G = B, which is equivalent to G = B ⊺ B. Let G = B ⊺ B be unimodular, and x = Bz 1 and y = Bz 2 be any two lattice vectors.Since x ⊺ y = z ⊺ 1 Gz 2 , we have Λ(B) ⊆ Λ(B) ⋆ .Since det(Λ(B)) 2 = det(B) 2 = det(G) = 1, they have to be the same already.

v)
The shortest characteristic vectors of the lattice Z n are the vectors {−1, 1} n .Proof.i) Let B = (b 1 , . . ., b n ) be a basis of Λ, and D = (d 1 , . . ., d n ) = B −⊺ the corresponding dual basis, also spanning Λ. Represented in the primal basis, define a vector w = n i=1 ||d i || 2 b i ∈ Λ, and let v = n i=1 α i d i ∈ Λ be any lattice vector, represented in the dual basis D. Using x 2 ≡ 2 x for x ∈ Z, we obtain

Proof.
Let x = n i=1 α i b i ∈ Λ be any vector, and w = Bz ∈ Λ.If w is a characteristic vector, we have e ⊺ k Ge k = b k , b k ≡ 2 b k , w = e ⊺ k z.For the other direction, we find x, w − x = n i=1 α i b i , w − n i=1 is known that two bases B 1 , B 2 generate the same lattice, if and only if there exists a unimodular matrix U