The Learning With Errors ($\mathsf{LWE}$) problem asks to find $\mathbf{s}$ from an input of the form $(\mathbf{A}, \mathbf{b} = \mathbf{A}\mathbf{s}+\mathbf{e}) \in (\mathbb{Z}/q\mathbb{Z})^{m \times n} \times (\mathbb{Z}/q\mathbb{Z})^{m}$, for a vector $\mathbf{e}$ that has small-magnitude entries. In this work, we do not focus on solving $\mathsf{LWE}$ but on the task of sampling instances. As these are extremely sparse in their range, it may seem plausible that the only way to proceed is to first create $\mathbf{s}$ and $\mathbf{e}$ and then set $\mathbf{b} = \mathbf{A}\mathbf{s}+\mathbf{e}$. In particular, such an instance sampler knows the solution. This raises the question whether it is possible to obliviously sample $(\mathbf{A}, \mathbf{A}\mathbf{s}+\mathbf{e})$, namely, without knowing the underlying $\mathbf{s}$. A variant of the assumption that oblivious $\mathsf{LWE}$ sampling is hard has been used in a series of works constructing Succinct Non-interactive Arguments of Knowledge (SNARKs) in the standard model. As the assumption is related to $\mathsf{LWE}$, these SNARKs have been conjectured to be secure in the presence of quantum adversaries. Our main result is a quantum polynomial-time algorithm that samples well-distributed $\mathsf{LWE}$ instances while provably not knowing the solution, under the assumption that $\mathsf{LWE}$ is hard. Moreover, the approach works for a vast range of $\mathsf{LWE}$ parametrizations, including those used in the above-mentioned SNARKs.

翻译：带错误学习问题（$\mathsf{LWE}$）要求从形如 $(\mathbf{A}, \mathbf{b} = \mathbf{A}\mathbf{s}+\mathbf{e}) \in (\mathbb{Z}/q\mathbb{Z})^{m \times n} \times (\mathbb{Z}/q\mathbb{Z})^{m}$ 的输入中寻找 $\mathbf{s}$，其中向量 $\mathbf{e}$ 的各个分量幅值较小。本文不聚焦于求解 $\mathsf{LWE}$ 问题，而是关注实例采样任务。由于这些实例在其值域中极为稀疏，似乎合理的唯一途径是先构造 $\mathbf{s}$ 和 $\mathbf{e}$，再设定 $\mathbf{b} = \mathbf{A}\mathbf{s}+\mathbf{e}$。特别地，此类实例采样器已知解。这引发了一个问题：能否在不掌握底层 $\mathbf{s}$ 的前提下，以不经意方式采样 $(\mathbf{A}, \mathbf{A}\mathbf{s}+\mathbf{e})$？不经意 $\mathsf{LWE}$ 采样难解的假设变体已被一系列构造标准模型下简洁非交互式知识论证（SNARKs）的工作所采用。由于该假设与 $\mathsf{LWE}$ 相关，这些 SNARKs 被推测在量子敌手面前具有安全性。我们的主要成果是在 $\mathsf{LWE}$ 难解的假设下，提出一种量子多项式时间算法，该算法能采样分布良好的 $\mathsf{LWE}$ 实例，同时可证明其并不知晓解。此外，该方法适用于广泛的 $\mathsf{LWE}$ 参数化范围，包括上述 SNARKs 所采用的参数设置。