The Geometry of SIS: Why Short Integer Solutions Are Hard to Find, and How n, m, q and β Set the Cost

Most lattice-based polynomial commitments start from the same line. The commitment to a vector s with small entries is t = As mod q for a public random matrix A, and it binds because two short openings of one t would hand over their difference z = s − s′: a short nonzero integer vector with Az ≡ 0. Finding such a vector is the short integer solution problem, and the binding of the Module-SIS schemes among them, Greyhound, Hachi and Akita included, rests on that problem at the parameters they choose.

It is an odd thing to rest on. The equation is linear, Gaussian elimination solves it at once, and short solutions exist in astronomical numbers; the only obstacle is the word short. What follows shows, mostly in pictures, why that metric condition costs an attacker time exponential in the dimension, how n, m, q and β enter through one combination, why random instances are as hard as the hardest lattice, and why quantum computers change only a constant.

1 · The problem, and the two ways it becomes trivial

Given a uniformly random A ∈ ℤ_q^n×m with m > n, find a nonzero z ∈ ℤ^m with

Az ≡ 0 (mod q),    ‖z‖ ≤ β.SIS_n,m,q,β

This is Ajtai's problem as Peikert's survey states it^[1][4], in the Euclidean norm unless said otherwise. Without the norm the solutions form a lattice,

Λ^⊥(A) = { z ∈ ℤ^m : Az ≡ 0 (mod q) } ⊇ qℤ^m.

For prime q and A of rank n, which fails with probability below q^n−m/(q − 1), the map z ↦ Az mod q takes ℤ^m onto ℤ_qⁿ with kernel Λ^⊥, so the lattice has index and determinant qⁿ. The solution set is the integer grid thinned to one point in qⁿ: each row of A keeps one point in q.

Two observations bracket the problem^[4]. Gaussian elimination writes A as [I_n | Ā] and hands over a basis at once: qe₁, …, qe_n and the vectors (−Āe_j, e_j), whose first n entries are uniform in (−q/2, q/2], giving length about q√(n/12). And with β ≥ q the problem is trivial, because qe₁ is a solution. SIS lives in between. In the regimes that matter the lattice contains vectors far shorter than q (§2), and the task is to find one when the algebra provides only long ones.

drag to rotate

modulus q11

rows n2

radius β3.6

tilt

spin

new A

lattice points in the cube lattice points in the ball, and a shortest vector basis from Gaussian elimination; rings mark qe_i ball of radius β

integer points kept by A

1 in 121

lattice points in the cube

—

shortest length λ₁

—

Gaussian heuristic (3qⁿ/4π)^1/3

—

integer points in the ball N(β)

—

solutions in the ball vs (N − 1)/qⁿ

—

2 · Existence: a ball against a determinant

How small can β be before solutions stop existing? A nonzero z with every entry below q in absolute value has an entry z_i that is a unit modulo the prime q, so Az = Σ_j z_ja_j is uniform on ℤ_qⁿ when A is. With N(β) the number of integer points in the closed ball of radius β < q, linearity of expectation gives an identity, not an estimate:

𝔼_A #{ z ≠ 0 : ‖z‖ ≤ β, Az ≡ 0 } = (N(β) − 1) / qⁿ.

The ball holds about V_mβ^m integer points (V_m the volume of the unit ball), so the expected count passes 1 where the ball's volume meets the determinant,

β* = (qⁿ/V_m)^1/m ≈ √(m/2πe) · q^n/m,Gaussian heuristic

the estimate of λ₁(Λ^⊥) that Micciancio and Regev use, reliable when m is neither close to n nor very large^[3]. A second-moment argument turns the expectation into a sharp threshold.

Where N(β) tracks the ball's volume, log N(β) grows like m log β, and the probability climbs from ε to 1 − ε within a factor 1 + O((log β + log 1/ε)/m) in β: a random q-ary lattice of high dimension with β* < q/2 has its shortest vector at β*, up to a vanishing relative error. For very wide matrices the ball holds far more integer points than its volume, and the threshold falls below β*.

move q, n and m

modulus q127

rows n6

columns m20

enumerated exactly: 13, 1, 3 11, 1, 3 11, 1, 4 7, 1, 6 5, 2, 4 3, 2, 6

Gaussian heuristic β*

—

smallest β with expected count ≥ 1

—

Pr ≤ 5% up to β =

—

Pr ≥ 95% from β =

—

exact enumeration

—

Each row multiplies the determinant by q; each column multiplies the ball's volume by about β√(2π/m), so columns win quickly. Once m > n log₂ q, two of the 2^m vectors in {0, 1}^m collide under A, and their difference is a {0, ±1} solution of norm at most √(n log₂ q + 1)^[4]. Commitment matrices are far wider. Short solutions exist in enormous numbers; whatever makes SIS hard, it is not scarcity.

3 · Why search is exponential: the sphere in high dimension

In the plane, Lagrange and Gauss's reduction finds a shortest vector in a few steps. The difficulty is dimension, and its source is a fact about spheres. Two independent uniform directions on S^d−1 meet at an angle θ with density proportional to sin^d−2 θ, so in high dimension almost every pair is nearly orthogonal, and a cap of angle θ ≤ 90° holds (sin θ)^{d + o(d)} of the sphere^[5]. The angle that matters is 60°: two vectors of equal length have a difference shorter than either exactly when their angle is below 60°, and that cap holds (√3/2)^{d + o(d)} = 2^{−0.2075d + o(d)} of the sphere.

The fastest known algorithms for the shortest vector problem in high dimension are sieves, and this cap is their cost. A sieve keeps a list of lattice vectors of about equal length and replaces pairs by their differences, which are shorter only for pairs within 60°. If list vectors point in random directions, the standard heuristic, each finds a partner only when the list holds about the reciprocal of the cap, (4/3)^d/2 = 2^0.2075d vectors, and comparing all pairs costs 2^0.415d[6]. Faster sieves search the pairs more cleverly: locality-sensitive filtering reaches 2^0.292d[7], quantum search inside the filters 2^0.2653d[5] and quantum random walks 2^0.2570d[8]. None goes below the list. The Dilithium designers call 2^0.2075d the paranoid floor, since the best solvers cover the sphere with that many cones of half-angle π/3^[9].

The constants are base-2 logarithms of √(4/3), √(3/2) and √(13/9), numbers of spherical geometry rather than of any implementation. Enumeration needs only polynomial memory but 2^{Θ(d log d)} time, and no known algorithm, classical or quantum, approximates shortest vectors in arbitrary lattices within polynomial factors in time 2^o(d)[4].

drag the sphere

cap angle θ60°

dimension d400

cap's share of the sphere at d

—

directions per useful partner

—

60° floor 2^0.2075d

—

all pairs 2^0.415d

—

filtered sieve 2^0.292d

—

quantum sieve 2^0.2653d

—

4 · Reduction is a slope, the determinant is an area

An attacker does not solve the shortest vector problem in dimension m. BKZ with block size b runs an exact solver in dimension b on projected blocks and leaves a basis whose Gram–Schmidt log-lengths ℓ_i = log₂ ‖b_i*‖ fall almost linearly, the geometric series assumption, with slope

2 log₂ δ_b,    δ_b ≈ ( b/(2πe) · (πb)^1/b )^1/(2(b−1)).root-Hermite factor

The formula is the Dilithium specification's^[9]; at b = 85 to 286 it reproduces Chen and Nguyen's simulations, δ₈₅ = 1.0100 and δ₂₈₆ = 1.0050^[10], while LLL alone reaches about 1.0219^[11]. Two more facts decide everything.

The area is conserved. Σ_i ℓ_i = log₂ det Λ^⊥ = n log₂ q for every basis. Reduction moves length from the front of the profile to the back, never creating or destroying any.

The attacker chooses the base. Columns of A can be ignored by fixing their coordinates to zero^[4], so an attacker may reduce the lattice of any w ≤ m columns, whose determinant is still qⁿ for w > n.

The reduced profile on w columns is therefore a line of fixed slope and fixed area, and the attacker wants its first value ℓ₁, the log-length of the vector it gets, as small as possible. At a given height, a line that stops exactly at zero encloses the most area, so the best profile is a right triangle of height h, base h/(2 log₂ δ_b) and area h²/(4 log₂ δ_b). Setting the area to n log₂ q,

h = 2 √(n log₂ q · log₂ δ_b)  at  w* = √(n log₂ q / log₂ δ_b) columns,

which is Micciancio and Regev's estimate^[3]. Fewer columns force the line to start higher; more buy nothing, and an attacker drops them, as Chen and Nguyen did on Darmstadt's SIS challenges of dimension 525 to 800, reducing sublattices of dimension 180 to 230^[10]. Run on the q-ary basis, the profile also never rises above log₂ q, since the qe_i stay available: when h would exceed log₂ q they stay in front, the Z-shaped profile of the Dilithium analysis^[9], and nothing shorter than q is found.

move the parameters and the block size

rows n64

log₂ q16

log₂ β6.0

columns m1,024

block size b150

root-Hermite factor δ_b

—

slope per vector (bits)

—

best width w*

—

length reached vs β

—

BKZ-b on this instance

—

smallest b that breaks it

—

its cost, bits classical / quantum

—

5 · How n, m, q and β set the price

Squaring the condition puts the parameter story in one inequality. With m ≥ w* and β < q, BKZ-b breaks SIS_n,m,q,β when

(log₂ β)² ≥ 4n · log₂ q · log₂ δ_b.

The exponential shows in numbers. At q = 2³² and β = 2¹⁶ the attack needs block size 252 at n = 256, 685 at n = 512 and 1,703 at n = 1,024: about 74, 200 and 497 bits of classical core-SVP. Each doubling of n about doubles b/log₂(b/2πe), which the condition makes roughly proportional to n log₂ q/(log₂ β)².

The modulus cuts both ways. At fixed β a larger q enlarges the area: with n = 512 and β = 2¹² the block size needed is 583, 1,465 and 3,497 at q = 2¹⁶, 2³² and 2⁶⁴. At β = √q a larger q makes the problem easier, 1,703, 685 and 252, because the target grows faster than the square root of the area. Hardness is log β against √(n log q), never q alone. Figure 5 lays out the plane of parameters.

click the upper plot to probe a point

log₂ q32

columns m∞

budget (bits)128

classical 0.292bquantum 0.265b

breakable within the budget secure at the budget under one solution expected (finite m) Akita table, ring degree 32 ring degree 64

probe

—

block size needed

—

bits, classical / quantum

—

rows needed for the budget

—

6 · Why a random instance is as hard as the worst case

The case that random matrices hide no shortcut rests on a theorem with a geometric engine.

The reduction must turn an arbitrary lattice L into a uniformly random matrix, and it does so by blurring. Sample lattice vectors v_i with a wide Gaussian spread, reduce them modulo qL and read their coordinates modulo q as the columns a_i. Once the spread exceeds the smoothing parameter of qL, defined below, the residues are within statistical distance 2ε of uniform^[13]. The reason is Poisson summation: a Gaussian of width s summed over a lattice has Fourier coefficient e^{−πs2‖w‖2} at each dual lattice point w, so

η_ε(L) = min { s : Σ_{w ∈ L* ∖ {0}} e^{−πs2‖w‖2} ≤ ε }smoothing parameter

is the blur at which all the nonzero frequencies together carry weight ε. A continuous blur is then within a factor 1 ± ε of uniform at every point and within statistical distance ε/2 of it^[2]: the lattice has disappeared. Micciancio and Regev bound η_ε(L) by √(ln(2n(1 + 1/ε))/π) · λ_n(L)^[2]; for ℤ² the bound is nearly exact, 1.3821 against a true η_0.01 of 1.3813.

blur the lattice

width s0.80

latticeℤ²

ε = nonzero dual weight

—

largest |density − 1| on screen

—

distance from uniform ≤ ε/2

—

η_0.01 of this lattice

—

s / η_0.01

—

The reduction keeps a set S of lattice vectors and uses it to sample the v_i, with spread ‖S‖ · poly(n). The oracle sees a uniform A and returns a short z; then Σ z_iv_i lies in qL, so v = Σ z_iv_i/q is a vector of L of length at most ‖S‖ · β · poly(n)/q, below ‖S‖/2 once q ≥ β · poly(n). Repeating shrinks S to within γ of λ_n(L)^[4]. A random SIS instance is a blurred photograph of an arbitrary lattice, and an algorithm that solves the photographs sharpens every lattice.

What this buys is qualitative: no noticeable share of weak instances short of an algorithm for worst-case lattice problems within polynomial factors, which the best known algorithms, classical or quantum, take time 2^Θ(n) to solve^[4]. It does not buy parameters; the reduction loses polynomial factors, so concrete security comes from §3 to §5.

7 · A quantum computer changes a constant, not the exponent

Shor's algorithm breaks factoring and discrete logarithms by finding a hidden period in an abelian group^[15], and Regev observed that almost all known super-polynomial quantum speed-ups solve abelian cases of that hidden-subgroup problem^[16]. SIS offers no period: its solution lattice is public, and what is hidden is a short element, a metric search. For general lattices the known bridge to hidden subgroups runs through the dihedral group, which is not abelian: Regev reduced poly(n)-unique-SVP to a dihedral coset problem^[16], for which no polynomial-time quantum algorithm is known.

What quantum computers do provide is search. The quantum sieves of §3 lower the exponent from 0.292b to 0.2653b or 0.2570b (both assuming quantum RAM), a smaller constant in a cost still exponential in the block size. The reduction of §6 is classical and black-box, so it holds for quantum solvers too: a quantum algorithm for random SIS would be one for worst-case SIVP within polynomial factors, and none is known. A 2024 preprint claimed such an algorithm by way of the learning-with-errors problem; its author's update reports a bug in Step 9 of the algorithm and states that the claim does not hold^[17].

Ideal lattices have one documented soft spot, and abelian structure is its source: quantum class-group and principal-ideal computations find vectors within a factor exp(Õ(√n)) of the shortest in ideals of cyclotomic fields in polynomial time, under a number-theoretic hypothesis^[18]. That factor is subexponential, far above the polynomial factors in the worst-case reductions for Ring- and Module-SIS^[4][19], and the Dilithium analysis notes that moving from rings to modules of rank above one takes a scheme further from those lattices^[9].

8 · What a lattice commitment pays: the norm budget

Binding is SIS at the collision norm. Two openings s ≠ s′ of one commitment, each of norm at most β_o, give the solution s − s′ of norm at most 2β_o. The schemes of the companion article accept relaxed openings and folded responses, so their collision norm also carries the challenges; Akita's security notes give its Euclidean form as 8γ√S, with γ bounding multiplication by a challenge and S the proved squared norm of the response^[20]. Whatever the slack, it lands in log β, and the condition of §5 prices it:

n ≥ (log₂ β)² / (4 log₂ q · log₂ δ_b).the quadratic law

With the modulus fixed by the proof system's field, the scalar rank grows with the square of the number of bits in the collision norm, so each extra bit of slack costs more rank than the last; the table gives the rows at q = 2³² − 99 and 128-bit quantum security, b = 128/0.265 ≈ 483. This is why every scheme re-decomposes its witness into small digits after each fold, and why the slack-free norm proofs of Serval, Maltese and Akita are worth their complexity.

The rule is two lines; production estimators are not. Akita's estimator prices every table cell offline, searching attack parameters under the ADPS16 core-SVP model at 0.265b and certifying, for each collision norm, ring degree and module rank, the widest matrix that keeps 128-bit quantum security^[20]. Its checked-in Euclidean table for q = 2³² − 99 has 6,100 cells: ring degrees 32 to 512, collision norms 2^0.5 to 2^30.5 in half-bit steps, ranks 1 to 20. Call a rank secure at every width when the valley floor of §4 stays above the target, and otherwise allow widths up to the valley's left crossing. The two-line rule then reproduces 5,994 cells exactly. Of the other 106, 95 allow one or two ring elements less width than the table, ten allow one more, and one is a rank the rule calls secure at every width where the table caps it at 36 ring elements; the rule's bound there is 223.9 rows against a boundary of 224.

Two qualifications travel with it. Like the rule, the estimator treats a Module-SIS matrix of rank r over a ring of degree D as unstructured SIS with n = rD; Akita's notes state that it “does not price attacks that exploit ring or module structure”^[20], the position of §7. And it searches the same core-SVP and geometric-series model, so the agreement confirms the closed form, not the model: both stand or fall with the heuristics of §4.

9 · Provenance

10 · What to keep

• Existence is cheap and sharp. (N(β) − 1)/qⁿ is exact, the threshold sits where N(β) reaches qⁿ, and wide matrices have solutions to spare; only finding them is hard.
• Search is expensive because of spheres. In dimension d a useful partner lies in a cap of measure 2^{−0.2075d + o(d)}, and every known sieve pays a power of that.
• The attack is a triangle. Reduction fixes the slope and the determinant fixes the area, so log₂(reachable length) ≈ 2√(n log₂ q · log₂ δ_b): n buys exponential cost, β is paid quadratically in bits, q cuts both ways, m stops mattering past w*.
• Random instances are blurred worst cases, and quantum computers improve only the constant in the exponent.
• For a commitment, the binding norm is the budget: rank grows with the square of the collision norm's bit length, which is why the schemes re-decompose after each fold.

References

Published versions are cited by venue with a DOI or an author copy; preprints by ePrint or arXiv number. Each entry names the definition, lemma, table or figure the text relies on.

1. M. Ajtai, "Generating Hard Instances of Lattice Problems," STOC 1996, 99–108 — doi.org/10.1145/237814.237838. The short integer solution problem, the function z ↦ Az, and the first worst-case to average-case connection.
2. D. Micciancio, O. Regev, "Worst-Case to Average-Case Reductions Based on Gaussian Measures," SIAM Journal on Computing 37(1):267–302, 2007 (FOCS 2004) — cims.nyu.edu/~regev/papers/average.pdf. Definition 3.1 (the smoothing parameter), Lemma 3.3 (η_ε(Λ) ≤ √(ln(2n(1 + 1/ε))/π) · λ_n(Λ)), Lemma 4.1 (statistical distance at most ½ρ_1/s(L* ∖ {0})) and footnote 12 (the pointwise 1 ± ε form); the reduction with γ = β · Õ(√n), as summarised in Peikert's survey §4.1.2.
3. D. Micciancio, O. Regev, "Lattice-based Cryptography," in D. J. Bernstein, J. Buchmann, E. Dahmen (eds.), Post-Quantum Cryptography, Springer, 2009, 147–191 — cims.nyu.edu/~regev/papers/pqc.pdf. Section 3: the estimate λ₁(Λ^⊥) ≈ q^n/m√(m/2πe), the length min{q, q^n/mδ^m} reached by lattice reduction (eq. 1), its minimum 2^{2√(n log q log δ)} at m = √(n log q/log δ) (eq. 2) and Figure 2.
4. C. Peikert, "A Decade of Lattice Cryptography," Foundations and Trends in Theoretical Computer Science 10(4):283–424, 2016; ePrint 2015/939 — eprint.iacr.org/2015/939. Definition 4.1.1 and the observations after it (Gaussian elimination, β < q, monotonicity in m and n, the pigeonhole bound); Theorem 4.1.2, the improvements of MR04, GPV08 and MP13, and the overview of the reduction (§4.1.2); the state of classical and quantum algorithms (§2.2.2).
5. T. Laarhoven, Search Problems in Cryptography: From Fingerprinting to Lattice Sieving, PhD thesis, Eindhoven University of Technology, 2016 — thijs.com/docs/phd-final.pdf. The angle density (sin θ)^d−2 between random directions (eq. 10.13) and the cap measure poly(d) · (sin θ)^d (Lemma 13.2); the Nguyen–Vidick list of (4/3)^d/2 vectors and time 2^0.415d (§8.2.1); hypercone filtering at 2^0.292d classically and 2^0.2653d quantumly (§14.2.10).
6. P. Q. Nguyen, T. Vidick, "Sieve Algorithms for the Shortest Vector Problem Are Practical," Journal of Mathematical Cryptology 2(2):181–207, 2008 — doi.org/10.1515/JMC.2008.009.
7. A. Becker, L. Ducas, N. Gama, T. Laarhoven, "New Directions in Nearest Neighbor Searching with Applications to Lattice Sieving," SODA 2016, 10–24; ePrint 2015/1128 — eprint.iacr.org/2015/1128. Locality-sensitive filtering; heuristic time 2^{0.292d + o(d)}.
8. A. Chailloux, J. Loyer, "Lattice Sieving via Quantum Random Walks," ASIACRYPT 2021, 63–91; ePrint 2021/570 — eprint.iacr.org/2021/570. Heuristic time 2^{0.2570d + o(d)} in the QRAM model, against Laarhoven's 2^{0.2653d + o(d)} in the same model.
9. S. Bai, L. Ducas, E. Kiltz, T. Lepoint, V. Lyubashevsky, P. Schwabe, G. Seiler, D. Stehlé, CRYSTALS-Dilithium: Algorithm Specifications and Supporting Documentation, version 3.1, 2021 — pq-crystals.org/dilithium/data/dilithium-specification-round3-20210208.pdf. Appendix C.1: the constants log₂√(3/2), log₂√(13/9) and the “paranoid” log₂√(4/3) with its cone-covering argument, the slope formula, and Figure 11 (the three-zone profile); Table 1 (b = 423 against SIS: 123 classical and 112 quantum core-SVP bits); Appendix C.4 (algebraic attacks, and module rank above one); Appendix C.5 (why the sign of the o(b) term in core-SVP is unclear).
10. Y. Chen, P. Q. Nguyen, "BKZ 2.0: Better Lattice Security Estimates," ASIACRYPT 2011, 1–20 — doi.org/10.1007/978-3-642-25385-0_1. Table 2 (block sizes 85, 106, 133, 168, 216 and 286 for root-Hermite factors 1.010 down to 1.005); §5.1 and Table 1 (Darmstadt lattice challenges of dimension 525–800, solved or improved through sublattices of dimension 180–230).
11. N. Gama, P. Q. Nguyen, "Predicting Lattice Reduction," EUROCRYPT 2008, 31–51 — doi.org/10.1007/978-3-540-78967-3_3. Table 1: average root-Hermite factors 1.0219 for LLL and 1.0128 for BKZ-20 on random lattices.
12. E. Alkim, L. Ducas, T. Pöppelmann, P. Schwabe, "Post-quantum Key Exchange — A New Hope," USENIX Security 2016, 327–343; ePrint 2015/1092 — eprint.iacr.org/2015/1092. The core-SVP hardness measure.
13. C. Gentry, C. Peikert, V. Vaikuntanathan, "Trapdoors for Hard Lattices and New Cryptographic Constructions," STOC 2008, 197–206; ePrint 2007/432 — eprint.iacr.org/2007/432. Corollary 2.8: a discrete Gaussian on Λ reduced modulo a sublattice Λ′ is within statistical distance 2ε of uniform once s ≥ η_ε(Λ′).
14. D. Micciancio, C. Peikert, "Hardness of SIS and LWE with Small Parameters," CRYPTO 2013, 21–39; ePrint 2013/069 — eprint.iacr.org/2013/069.
15. P. W. Shor, "Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer," SIAM Journal on Computing 26(5):1484–1509, 1997 — doi.org/10.1137/S0097539795293172.
16. O. Regev, "Quantum Computation and Lattice Problems," SIAM Journal on Computing 33(3):738–760, 2004 (FOCS 2002); arXiv cs/0304005 — arxiv.org/abs/cs/0304005. The reduction from unique-SVP to the dihedral hidden subgroup problem, and the remark (§1) that almost all known super-polynomial quantum speed-ups solve abelian hidden subgroup problems.
17. Y. Chen, "Quantum Algorithms for Lattice Problems," ePrint 2024/555 — eprint.iacr.org/2024/555. The author's note on the ePrint page: Step 9 of the algorithm contains a bug, and the claimed polynomial-time quantum algorithm for LWE does not hold.
18. R. Cramer, L. Ducas, B. Wesolowski, "Short Stickelberger Class Relations and Application to Ideal-SVP," EUROCRYPT 2017, 324–348; ePrint 2016/885 — eprint.iacr.org/2016/885. Ideal-SVP in cyclotomic fields within exp(Õ(√n)) in quantum polynomial time under a number-theoretic hypothesis; the abstract notes that Ring-LWE-based systems do not seem directly affected.
19. A. Langlois, D. Stehlé, "Worst-Case to Average-Case Reductions for Module Lattices," Designs, Codes and Cryptography 75(3):565–599, 2015 — doi.org/10.1007/s10623-014-9938-4. Module-SIS and Module-LWE with worst-case reductions over module lattices.
20. Q. Dao, O. Bodaghi, A. Khajehpour, G. Vitto, M. Badakhshan, M. Georghiades, F. Liu, J. Zhang, J. Thaler, "Akita: A High-Performance Lattice-Based Polynomial Commitment Scheme," ePrint 2026/1983 — eprint.iacr.org/2026/1983; and the Akita repository at commit 3a45521 — github.com/LayerZero-Labs/akita: book chapters “Lattices and Module-SIS” and “Security model” (the ADPS16 quantum policy at 0.2650b, the collision bounds 8κ₁Z_∞ and 64γ²S, and the statement that the estimator does not price ring or module structure), and the generated table crates/akita-params/src/sis/generated_l2_sis_table/q32.rs.