 The VJ stars are the vectors that come out of Gram-Schmidt. The VJ stars, keep in mind, are orthogonal to one another, but they're not in lattice. Anyway, at the point at which Gram-Schmidt doesn't help anymore, this size condition will be true. All these quantities will be less than a half. So rounding doesn't, you know, your rounds to zero doesn't help. So now we're stuck. Well, not entirely, because this process, the Gram-Schmidt process, if you think about it, it's very much iterative. It depends on the order that I handed you the vectors. The first vector in the Gram-Schmidt basis is the first vector I gave you. Suppose I randomize the vectors and give you a different one first, then you'll get a different basis. So I have the possibility of moving the vectors, the order of the vectors around, permuting them, and trying to make things better that way. So what I want to do is try to, well, eventually, with this sort of Gram-Schmidt, followed by swaps, followed by Gram-Schmidt, followed by swaps, get all the vectors reasonably orthogonal to one another. And instead of writing the orthogonality sort of in terms of the angle, I've written it in terms of length, turns out that getting the I plus first Gram-Schmidt vector, somewhat reasonably larger than the previous one like this, will give you some orthogonality. OK? So the goal is to find a basis that satisfies the size condition and the quasi-orthogonality condition for all I. I didn't put it there, but yeah. And lo and behold, we can do that. Hermit proved that there was always a basis satisfying the size condition and the quasi-orthogonality condition. And this is actually a pretty good basis. Unfortunately, we don't actually know how to find them. Surprise, surprise. So I have to assume this came about after some experimentation and stuff. Lovash suggested that we replace the quasi-orthogonality condition by something just a wee bit weaker. Now, this looks horrible. I will grant you. But first, if you throw this term away, that's just the quasi-orthogonality condition on the previous page. Remember that the I plus first Gram-Schmidt vector is bigger than square root of 3 over 2 times the previous one. OK? So just a little modification. Geometrically, what it says, and again, I'm going to leave this for you to try to think about, depending how good your geometry is in n dimensions, that this condition on the I plus first and I's Gram-Schmidt vectors says that if you take the I plus first vector, well, actually, let me go back. If you take the first I minus 1 vectors and look at the plane that they span, the hyperplane, and look at its orthogonal complement, and if you project the I plus first vector onto that orthogonal complement, it's at least 3 quarters the length of the projection of V sub I onto that orthogonal complement. And now I'm wondering if I left a square root on the 3 quarters. This is either 3 quarters or a square root of 3 quarters. And it turns out, well, since Hermit says we can find a basis satisfying the size and quasi-orthogonality condition, and quasi-orthogonality is stronger than the Lovash condition, there certainly exists a basis that satisfies the size condition and the Lovash condition. But the amazing thing is we can find that basis in polynomial time. And this is the algorithm that Lenscher-Lenscher and Lovash published in 1982. There's a polynomial time algorithm, polynomial in the dimension. And in fact, as we'll see, hopefully, if there's time, quadratic time in the dimension that we'll find a basis satisfying the size condition and the Lovash condition. And that's too much of a mouthful, so that's usually called an LLL reduced basis, or an L cubed reduced basis. And here's the algorithm in brief. I'm going to give an expanded version in a minute, but let's try to understand what it's doing. And actually, the next slide says, here's what step one doing, here's what step two doing. I'm basically going to flip over to the next slide, because I'm going to explain the words for you now. But I put that slide in so when you're looking at it, if you download it, it's there. So we start with k equals to what's k? That's how many vectors we're currently looking at. So we're going to start by looking at v1 and v2, the first two vectors in the basis. And we're going to keep looping until, well, we'll loop while k is less than the dimension. So we're looking at fewer than n vectors. And look down here, wonderful. k goes to k plus 1. And after n iterations, k will be the dimension. We have n vectors. We have a whole basis. Glorious. But there's a catch. So that's our loop. So I'm looking at the first k vectors in my current basis. I'm going to modify it. But I currently have k vectors. And basically, I do grant Schmidt on them, but rounding the coefficients. And if I do that a few times, I'll end up with replacing those by another k vectors that span the same space where the size condition is true. This doesn't take very much time. It's a Gram-Schmidt type process. So rather than saying you have k arbitrary vectors in the basis, I now have k vectors that satisfy the size condition. That's good. They're pretty good. But remember, I also want the low-vash condition. So I check to see if the low-vash condition is true. If it's true, I increment k and I consider yet another vector in my basis. And I keep expanding my basis. Wonderful. But the low-vash condition may well fail. And at that point, what I do is I take the k vector in my list, and the k minus first vector in my list, and I swap them. And now I decrement k. I make k one less. So now I'm considering one fewer vectors. And then I go back to the beginning. So what will happen here is I start with two vectors. Maybe low-vash is true and I have three vectors. And low-vash is true and I have four vectors. But now those four vectors, low-vash is false. So now I swap the third and fourth vectors. And I'm back to studying three vectors. And I do it again. So what happens is k goes up and down and up and down and up and down. And if eventually k gets up to n, the dimension, I have my good basis. OK. There is no indication here why this algorithm should terminate. Because I can keep k gets one bigger, k gets one smaller, k gets one bigger, k gets one smaller. So to show the determinates, I have to show that the swap step only gets done finitely many times. And what we're going to do, again, I'm going fourth time, is to show that the swap step only gets executed roughly n squared time. Well, at most n squared times, or n's the dimension. So that's why the algorithm terminates in polynomial time. OK. All right. This is everything I just said. This is an expanded version of the algorithm that I was just explaining, same algorithm. But I wrote it in more expanded pseudocode. If you want to try implementing it yourself, this is not terribly efficient. But it works. And it's fun to do. And if you do it, for example, you can then put in a print statement like here, print k. And you can see the k going up and down. So what this is here, start with two vectors. So input the your n vectors. Start with the first two vectors. This loop is doing Gram-Schmidt with the rounding. I'll tell you what the mu is on the next slide, but it's the Gram-Schmidt coefficient. Then if the Lovash condition is true, you increment k and take another vector. If the Lovash condition is false, you swap the two vectors and you have to reduce k. You never want to go down all the way to k equals 1. So there's that. And that's it. It's not that complicated to implement. So I guess it depends whether you're the kind of person who likes using a built-in package and experimenting with it, or whether you like getting under the hood and tinkering with the carburetors. If you like the second, then it's really fun to implement this and play with it. This slide is what I just finished saying, except for the one thing, the mu ij I didn't have room in the previous slide for. Those are the coefficients that appear in the Gram-Schmidt. The thing is, when you implement this, you're going to also have to implement Gram-Schmidt as a subroutine, because you need to compute the vj stars. So here is a proof sketch that L cubed actually works as advertised. And I apologize, again, as I said at the beginning. This is fairly messy, complicated mathematics. My guess, and you can ask Hendrik whether this is true, is that the low-vash condition came about, not because low-vash brilliant said, oh, let's put this vector in here. It's they were trying to find a proof that if they relaxed the orthogonality condition, how much would they have to relax it by so that the proof would give polynomial time? And right. OK. So the idea, beautiful idea of the proof, is that you want to measure the complexity of your basis. And you want to show that, well, basically what it does is that if you do the swap step, the complexity of the basis decreases, gets smaller. And if there's a lower limit on the complexity, then that'll give you a bound on how many swap steps there are. OK. So the idea is to define a function that measures how complex the basis is, where the complexity will be a real number that's at least one. And so that if the low-vash condition is false, that's when we do the swap step. That's when k gets reduced. That's the bad thing. Then the complexity of the basis after we do the swap is less than the complexity before the swap. Square root of 3 over 2 is less than 1, right? What is it, 0.866, I guess, something like that. OK. Well, suppose that things are so bad that I actually do the swap step. I probably shouldn't have used k here again. Anyway, I do the swap step k times. Well, then the complexity will have been reduced by square root of 3 over 2 to the k-th power. That's going down exponentially. But remember, this complexity is always greater than or equal to 1. So this says you can't do very many swap steps. Well, depending how big these numbers are. So since the complexity of any basis is at least 1, well, I haven't told you how to define this, I will in a second, the number of swap steps, the number of bad times you have to decrement k is bounded by the log of the complexity of the original basis divided by log 2 over square root of 3. This tells you nothing yet because I haven't told you what this d function is. But the key is, I'll tell you what it is, and then we need to compute the complexity of the original basis as a function of n, a function of the dimension. And it'll turn out the complexity of the original basis will look like a constant, the n squared. There's a log there. That's the important thing. So the number of swap steps is roughly n squared. OK. Here was the LLL beautiful idea for how you should measure the complexity of a basis to make this descent argument essentially work. So given a basis, let me take the first vector and then take the first two vectors and then take the first three vectors. So here, I'll use little l, take the first little l vectors. They span some smaller lattice, right? I just take all the z linear combinations. So imagine, even in three space, I'm taking two vectors, one there, one there. That will span a two-dimensional lattice sitting in three-dimensional space, OK? But that two-dimensional lattice will have a volume. It'll have a fundamental domain. It's a parallelogram. And its volume is its two-dimensional volume, not its three-dimensional volume, because it's sitting in two-dimensions. So they measure the complexity of the basis by taking the volume of just the one-dimensional lattice spanned by the first vector multiplied by the volume of the two-dimensional lattice spanned by the first two vectors times the volume of the three-dimensional lattice spanned by the first three vectors, and so on, up to the entire thing. And if you let v1 star through vn star be the actual orthogonal vectors that come out of Gram-Schmidt, which remember, are not in the basis, but they're related to the basis vectors, then you can check that the volume of this l sublattice is just the product of the first l Gram-Schmidt vectors. So that's how big the lattice is if you just use the first l vectors, and then I multiply all of them. Multiply all these determinant vl so you get a double product. And if you just rearrange the double product, you'll find the complexity, the way they're measuring the complexity of a basis is the product from i equals 1 to n. You take the output from Gram-Schmidt, just take the length of those Gram-Schmidt vectors, but raise to certain powers. And I could have just defined the complexity to be that, but I think that's not very intuitive. But it is intuitive to take these sublattices that are getting bigger and bigger, and take their volumes and multiply the volumes. Yeah, I did say at the beginning, I'm going to assume my lattice, well, the vectors have integer coordinates. Otherwise, there's another scaling factor. And if you do that, then you can check that this d of b is greater than or equal to 1. That's one of the exercises, in fact. So d of b is what's this product, which is certainly less than or equal to the length of the longest vector raised to the sum of the exponents. Just replace each vi star by the longest vi star. So you get something bigger. These logs, I crossed out because those are typos. And if you just multiply this out, you're summing what you recognize as the sum of the first n integers, it turns out. The exponents nn plus 1 over 2. And if you go back and look at the Graham-Schmidt process, remember you're feeding in your original basis. Each time you create a vi star, it will be smaller than the vi that you fed in. Because you're taking the vi, and you're subtracting off the projection, OK? So in fact, this max will be smaller than the maximum of the original basis vectors. And if you just take log of both sides, remember, that log of this has appeared in the running time. How many swap steps there are? It's the logarithm of that. This n squared essentially comes down because I'm taking the log. And that's L cubed terminates in n squared steps multiplied by the log of how big the original basis vectors were. And that is the proof that L cubed runs in polynomial time, in fact, quadratic time. And by the way, if you are in the applied computational number theory community, and someone says, ooh, I have a polynomial time algorithm, that doesn't mean practical. I've seen lots of papers where we have a polynomial time algorithm. It runs in time no more than n to the 10,000th, right? An exponential algorithm is probably faster than that for any n that you're likely to use. But n squared is really honest to God practical. Actually, I've never tried to run L cubed in dimension 10,000, but it wouldn't surprise me if you could do that. I've certainly run it in dimension 100, 200, 300. Yeah, it works. All right. There's now a whole bunch of messy algebra computations to check the other parts of L cubed works as advertised. So for example, we need to show that if you do the swap step, because the low-vash condition is false, that actually reduces the complexity by a factor of square root of 3 over 2, like I said earlier. So I'm going to do this a little quickly, but you can look. So suppose low-vash is false. That means that the kth Gram-Schmidt vector is actually kth Gram-Schmidt vector is actually smaller than this multiple of the k minus first one. That's the definition of the low-vash condition. And that's less than or equal to this, because the squared thing is positive. So this is a trivial inequality. And now we check what happens when you swap vk and vk minus 1. And the formulas are messy. I want to try to talk you through to get the idea of it. So we have vk minus 1 and vk, and we're just going to swap them. And what is that due to this complexity measure? Remember, the complexity measure is the product of the volumes of the sublattices as you progressively throw in one more vector. So swapping two of the vectors means that these sublattices are pretty much all the same, except right where I've thrown in the k minus first vector, and now I've thrown in the kth vector instead. And that's what this first line is. The new basis order, rather than having the k minus first vector here, I have the kth vector, because I've swapped them. I kind of like the k minus first vector here for comparison purposes, so I put it in and cancel it out, standard math trick. Now this quantity, the product up to the k minus first, that is the volume of the old k minus first sublattice. And there's this other thing at the end that's still there. But the low best condition being false tells me that this factor on the end here, just take this and divide by that. And look, there's my square root of 3 over 2.