Solving subset sum via the LLL algorithm

Question

I wrote code that solves the subset sum problem via the LLL algorithm, as given in chapter three of the Handbook of Applied Cryptography https://cacr.uwaterloo.ca/hac/

I ran the code on ten random sets, each with positive integers from one to $2^n$, each with a random subset adding up to a target integer. The code found the solution ten out of ten times when $n=10$.

However when I ran the code on ten random sets, each with positive integers from one to $4^n$, each with a random subset adding up to a target integer, the code found the solution only one time out of ten times when $n=10$.

My question is shouldn’t it be the other way around, since the sets with positive integers from one to $4^n$ have a lower density than those with positive integers from one to $2^n$ and the algorithm is supposed to have a higher probability of finding a solution for lower density instances?

What might explain this output?

Answer 1

Caveat: I'm not an expert on these types of attacks.

If a subset-sum instance is of the form $\sum_{i=1}^n a_i x_i = t$, i.e. $n$ is the length of the sum, then density is defined to be $n / \max_i\log a_i$. It follows that

1. the density of your first subset-sum is $\approx 10/n$
2. the density of your second subset-sum is $\approx 5/n$.

This is lower density (as you claim). That being said, both are actually higher density than is typically required for LLL to solve things. These notes of Peikert state that density $2/n$ is typically the threshold for things to start working.

So based on the theory I believe neither should (guaranteed to) work with high probability, and instead the threshold for things to work well should be somewhere around $2^{5n}\approx 32^n$ (for your parameterization of things).