Lattice Notation: Λ, det, λ₁, gh, δ₀, Λ*, Λq⊥ Explained

Each row gives the symbol as it is rendered and as TeX, a way to read it aloud, its meaning on this site, a small example and the chapters that use it. When two chapters write the same object differently, or the same letter for different objects, the row says so. Other notation (vectors, rings, probability) is collected on the other pages of the math reference.

Lattices and bases

Symbol	Read as	Meaning on this site	Example	Used in
$\Lambda,\ L$ `\Lambda, L`	“lambda”, “L”	A lattice: every integer combination of a set of linearly independent basis vectors. Chapters 1–6 write $\Lambda$ ; the embedding guides (7.x) write $L$ . Same object.	$\Lambda = \mathbb{Z}^2$	1.3, 1.4, 1.6, 2.2, 7.4, 7.5
$\Lambda(B) = \{Bx : x \in \mathbb{Z}^n\}$ `\Lambda(B)`	“the lattice generated by B”	Basis vectors are the columns of $B$ . Used in 1.1, 1.2, 2.1, 2.2 and 6.1.	$B = \begin{pmatrix}2&1\\0&3\end{pmatrix}$	1.1, 1.2, 2.1, 2.2, 6.1
$L(B) = \{xB : x \in \mathbb{Z}^n\}$ `L(B)`	“L of B”	Basis vectors are the rows of $B$ , as in g6k-rs and fplll. Used in the embedding guides. Convert by transposing: $\Lambda(B) = L(B^\top)$ .	$x = (1,-1) \Rightarrow xB = b_1 - b_2$	7.1, 7.4, 4.6
$b_i,\ B$ `b_i, B`	“b sub i”, “B”	The $i$ -th basis vector and the matrix that holds all of them (as columns or rows, see above).	$B = [b_1 \mid b_2 \mid \cdots \mid b_n]$	1.2, 4.1, 2.2, 7.1
$n,\ m,\ d$ `n, m, d`	“n”, “m”, “d”	$n$ is usually the rank (number of basis vectors). A lattice is full-rank when $n$ equals the ambient dimension. For SIS and q-ary lattices $n$ counts the rows of $A$ and $m$ its columns. 7.5 uses $d$ for the working dimension.	$A \in \mathbb{Z}_q^{n \times m}$	1.2, 2.4, 1.6, 7.5
$\mathbb{Z}^n$ `\mathbb{Z}^n`	“Z n”	The integer lattice: all vectors with integer coordinates. Its basis is the identity matrix.	$\det(\mathbb{Z}^n) = 1$	1.6, 1.2, 7.5, 1.1
$\mathcal{P}(B)$ `\mathcal{P}(B)`	“the fundamental parallelepiped of B”	The half-open box $\{\sum t_i b_i : 0 \le t_i < 1\}$ . Its translates by lattice points tile space, and its volume is $\det(\Lambda)$ .	For $\mathbb{Z}^2$ it is the unit square.	1.3
$\det(\Lambda),\ \mathrm{vol}(\Lambda)$ `\det(\Lambda), \mathrm{vol}(\Lambda)`	“determinant” or “volume” (also “covolume”) of the lattice	Volume of $\mathcal{P}(B)$ ; the same for every basis. Full rank: $\|\det B\|$ . In general $\sqrt{\det(B^\top B)}$ for columns, $\sqrt{\det(BB^\top)}$ for rows. It is a positive number, not the signed determinant of one basis.	$\mathrm{vol}(c\Lambda) = c^n\,\mathrm{vol}(\Lambda)$	1.3, 1.4, 1.5, 7.5, 1.2, 7.4
$\Lambda + t$ `\Lambda + t`	“the coset of Λ shifted by t”	Every lattice point moved by the same vector $t$ . Not a lattice unless $t \in \Lambda$ . Signatures sample from cosets such as $\Lambda_q^\perp(A) + t_u$ .	$\mathbb{Z}^2 + (\tfrac12, 0)$	4.5, 2.5

Lengths and invariants

These numbers belong to the lattice itself: they do not change when you switch to another basis.

Symbol	Read as	Meaning on this site	Example	Used in
$\lambda_1,\ \lambda_k$ `\lambda_1, \lambda_k`	“lambda one”, “the k-th successive minimum”	$\lambda_1$ is the length of a shortest nonzero lattice vector. $\lambda_k$ is the smallest radius $r$ such that the ball $B(0,r)$ contains $k$ linearly independent lattice vectors, so $\lambda_1 \le \cdots \le \lambda_n$ .	$\lambda_1(E_8) = \sqrt2$ ; all $\lambda_k(\mathbb{Z}^n) = 1$	1.3, 1.4, 1.6, 2.2, 2.1, 1.5
$B(0,r),\ V_n$ `B(0,r), V_n`	“the ball of radius r”, “V n”	The Euclidean ball around the origin, and the volume of the unit ball in dimension $n$ : $V_n = \pi^{n/2}/\Gamma(n/2+1)$ . Not to be confused with a basis $B$ .	$V_2 = \pi$	1.3, 1.4
$\mathcal{K}$ `\mathcal{K}`	“K”	A convex body that is symmetric about the origin, as in Minkowski’s theorem: if $\mathrm{vol}(\mathcal{K}) > 2^n \det(\Lambda)$ then $\mathcal{K}$ contains a nonzero lattice point.	$\mathcal{K} = \{x : \\|x\\| \le r\}$	1.3
$\mathrm{gh}(L)$ `\mathrm{gh}(L)`	“the Gaussian heuristic of L”	The length a shortest vector would have in a random lattice of the same dimension and volume. Exact form $(\det L / V_n)^{1/n}$ ; the site mostly uses the approximation $\sqrt{n/(2\pi e)}\,\det(L)^{1/n}$ . It is a heuristic, not a bound.	For $\det L = 1$ , $n = 100$ : 2.490 (exact form) vs 2.420 (approximation)	7.4, 7.5, 7.2, 7.3, 4.6, 7.1
$\gamma_n$ `\gamma_n`	“Hermite’s constant in dimension n”	$\gamma_n = \sup_\Lambda \lambda_1(\Lambda)^2 / \det(\Lambda)^{2/n}$ , so every $n$ -dimensional lattice has $\lambda_1 \le \sqrt{\gamma_n}\,\det(\Lambda)^{1/n}$ . Grows roughly like $n/(2\pi e)$ .	$\gamma_2 = 2/\sqrt3$ , $\gamma_8 = 2$ , $\gamma_{24} = 4$	1.3, 1.4, 1.6
$\rho$ `\rho`	“rho”, the packing radius	$\rho = \lambda_1/2$ : balls of this radius around lattice points do not overlap. With a subscript, $\rho_s$ is the Gaussian function instead (see 8.5 Probability and sampling).	$\rho(\mathbb{Z}^n) = 1/2$	1.4, 1.3
$\mu(\Lambda)$ `\mu(\Lambda)`	“mu of Lambda”, the covering radius	$\mu(\Lambda) = \max_t \min_{v \in \Lambda} \\|t - v\\|$ : every point of space is within $\mu$ of the lattice. With two indices, $\mu_{ij}$ means Gram–Schmidt coefficients instead.	$\mu(\mathbb{Z}^n) = \sqrt n/2$	1.4, 1.3, 1.6
$\mathrm{dist}(t, \Lambda)$ `\mathrm{dist}(t, \Lambda)`	“the distance from t to Lambda”	$\min_{v \in \Lambda} \\|t - v\\|$ , the quantity CVP asks you to achieve.	$\mathrm{dist}((0.4, 0.9), \mathbb{Z}^2) = \sqrt{0.17}$	2.2
$\Delta(\Lambda)$ `\Delta(\Lambda)`	“packing density of Lambda”	Fraction of space covered by the non-overlapping balls of radius $\rho$ : $\Delta = V_n \rho^n / \det(\Lambda)$ . In FHE (3.2), $\Delta$ is an unrelated scaling factor.	$\Delta(A_2) \approx 0.9069$ , $\Delta(E_8) \approx 0.2537$	1.4, 1.6

The kissing number, the count of shortest nonzero vectors, is always written in words on this site. The letter $\tau$ appears only in 3.3, where it counts the nonzero entries of the challenge polynomial.

Gram–Schmidt and reduction

These symbols depend on the basis. Reduction algorithms change them while the determinant stays fixed.

Symbol	Read as	Meaning on this site	Example	Used in
$\tilde b_i$ `\tilde{b}_i`	“b tilde i”	The Gram–Schmidt vectors of the basis: $b_i$ minus its projections onto the earlier ones. Many papers write $b_i^*$ instead; this site uses the tilde so that a star always means the dual.	$\textstyle\prod_i \\|\tilde b_i\\| = \det(\Lambda)$	2.2, 4.1, 4.2, 1.5, 1.2, 4.6
$\mu_{ij},\ \mu_{i,j}$ `\mu_{ij}`	“mu i j”	Gram–Schmidt coefficient $\langle b_i, \tilde b_j\rangle / \\|\tilde b_j\\|^2$ for $j < i$ . Size reduction makes $\|\mu_{ij}\| \le 1/2$ .	$b_i \leftarrow b_i - \lfloor \mu_{ij} \rceil b_j$	4.1, 1.5
$(\\|\tilde b_1\\|, \dots, \\|\tilde b_n\\|)$ `\\|\tilde{b}_i\\|`	“the Gram–Schmidt profile”	The list of Gram–Schmidt lengths. A well-reduced basis has a slowly decreasing profile; its product is always $\det(\Lambda)$ .	BKZ flattens the profile as $\beta$ grows	4.2, 1.2, 2.2
$\delta$ `\delta`	“delta”, the LLL (Lovász) parameter	In LLL, $\delta \in (1/4, 1)$ sets how strict the Lovász condition $\delta \\|\tilde b_{i-1}\\|^2 \le \\|\tilde b_i\\|^2 + \mu_{i,i-1}^2 \\|\tilde b_{i-1}\\|^2$ is.	$\delta = 3/4$ (original), $0.99$ (g6k-rs default)	4.1, 1.5, 4.6
$\eta$ `\eta`	“eta”, the size-reduction parameter	In g6k-rs, LLL enforces $\|\mu_{ij}\| \le \eta$ with $\eta$ slightly above $1/2$ to tolerate rounding. 4.1 also uses $\eta$ for floating-point precision in bits. Elsewhere $\eta$ is a secret bound or the smoothing parameter.	$\eta = 0.501$	4.6, 4.1
$\delta_0$ `\delta_0`	“delta zero”, the root-Hermite factor	Quality of a reduced basis: $\\|b_1\\| = \delta_0^{\,n} \det(\Lambda)^{1/n}$ . Smaller is better.	$\delta_0 \approx 1.022$ for LLL in practice	1.5, 4.2, 1.4
$\beta,\ \text{BKZ-}\beta$ `\beta`	“beta”, the block size	BKZ solves SVP exactly in blocks of $\beta$ consecutive projected vectors. Larger $\beta$ gives shorter vectors at exponential cost. $\beta = 2$ is essentially LLL.	$T_{\mathrm{SVP}}(\beta) \approx 2^{0.292\beta}$	3.4, 4.2, 1.5, 2.1

The root-Hermite estimate used in 1.4, 1.5, 3.4 and 4.2 is Chen's, $\delta_0(\beta) \approx \bigl(\tfrac{\beta}{2\pi e}(\pi\beta)^{1/\beta}\bigr)^{1/(2(\beta-1))}$ . Some sources drop the $(\pi\beta)^{1/\beta}$ factor; the two agree for large $\beta$ (1.00540 vs 1.00546 at $\beta = 250$ ) but differ at small block sizes (1.0110 vs 1.0121 at $\beta = 50$ ). Both are heuristics that are only meaningful for $\beta$ of about 50 and above.

Dual and q-ary lattices

Symbol	Read as	Meaning on this site	Example	Used in
$\Lambda^$ `\Lambda^`	“Lambda dual”	The dual lattice $\{y \in \mathrm{span}(\Lambda) : \langle y, x\rangle \in \mathbb{Z} \text{ for all } x \in \Lambda\}$ . Some papers, especially on ring lattices, write $\Lambda^\vee$ for the same object. For a full-rank square basis the dual basis is $B^{-\top}$ in either convention.	$\det(\Lambda^*) = 1/\det(\Lambda)$	1.2, 1.4, 1.6, 6.1, 1.3, 3.6
$\Lambda_q^\perp(A)$ `\Lambda_q^\perp(A)`	“Lambda q perp of A”	The modular kernel lattice $\{x \in \mathbb{Z}^m : Ax \equiv 0 \pmod q\}$ for $A \in \mathbb{Z}_q^{n \times m}$ (6.2 names the row count $k$ ). SIS asks for a short vector in it. When $A$ has rank $n$ modulo a prime $q$ , its determinant is $q^n$ .	$q\mathbb{Z}^m \subseteq \Lambda_q^\perp(A) \subseteq \mathbb{Z}^m$	1.6, 2.4, 6.2, 2.5, 4.5
$\Lambda_q(A)$ `\Lambda_q(A)`	“Lambda q of A”	The image lattice $\{A^\top s + qz : s \in \mathbb{Z}^n,\ z \in \mathbb{Z}^m\}$ , the lattice behind LWE. Determinant $q^{m-n}$ under the same rank assumption. The two q-ary lattices are dual up to scaling.	$\Lambda_q(A)^* = \tfrac1q\,\Lambda_q^\perp(A)$	1.6, 2.4, 6.2

Problem names

A subscript $\gamma$ on a problem name is an approximation factor. It is unrelated to Hermite’s constant $\gamma_n$ and to the Dilithium parameters $\gamma_1, \gamma_2$ .

Symbol	Read as	Meaning on this site	Example	Used in
$\gamma\text{-SVP}$ `\mathrm{SVP}_\gamma`	“approximate SVP with factor gamma”	Find a nonzero $v \in \Lambda$ with $\\|v\\| \le \gamma \lambda_1$ . Exact SVP is $\gamma = 1$ . See 2.1.	LLL solves it for $\gamma = 2^{(n-1)/2}$	2.1, 2.4, 2.3
$\mathrm{GapSVP}_\gamma$ `\mathrm{GapSVP}_\gamma`	“gap SVP”	Decision version: given $d$ , tell whether $\lambda_1 \le d$ or $\lambda_1 > \gamma d$ . The form used in hardness proofs for LWE.	Regev: worst-case GapSVP → LWE	2.1, 2.4, 1.4
$\mathrm{uSVP}_\gamma$ `\mathrm{uSVP}_\gamma`	“unique SVP”	SVP with the promise $\lambda_2 > \gamma \lambda_1$ : the shortest vector stands out. Embeddings (7.x) try to create exactly this situation.	Kannan embedding of a BDD instance	2.2, 7.5, 3.4
$\mathrm{SIVP}_\gamma$ `\mathrm{SIVP}_\gamma`	“shortest independent vectors problem”	Find $n$ linearly independent lattice vectors, each of length at most $\gamma \lambda_n$ . Ajtai’s and Regev’s worst-case reductions start from it.	SIS hardness rests on worst-case SIVP	2.4, 2.1
$\gamma\text{-CVP},\ \mathrm{BDD}$ `\mathrm{CVP}_\gamma, \mathrm{BDD}`	“approximate CVP”, “bounded distance decoding”	CVP: given $t$ , find $v$ with $\\|t - v\\| \le \gamma\,\mathrm{dist}(t, \Lambda)$ . BDD adds the promise that $t$ is unusually close; 2.2 states it as $\mathrm{dist}(t,\Lambda) < \lambda_1/2$ , which makes the answer unique.	Babai: $\gamma = 2^{(n-1)/2}$ after LLL	2.2, 7.4, SVP & CVP
$\mathrm{SIS}(n, m, q, \beta)$ `\mathrm{SIS}`	“short integer solution”	Find a nonzero $x$ with $Ax \equiv 0 \pmod q$ and $\\|x\\| \le \beta$ , that is, a short vector of $\Lambda_q^\perp(A)$ . Here $\beta$ is a norm bound, not a block size.	$\beta \ge \sqrt m\, q^{n/m}$	2.4, 2.5
$\mathrm{LWE}(n, q, \chi)$ `\mathrm{LWE}`	“learning with errors”	Recover $s$ from samples $(a, \langle a, s\rangle + e \bmod q)$ with $e$ drawn from the error distribution $\chi$ . A BDD instance in $\Lambda_q(A)$ .	$e \leftarrow \chi$	2.3, 3.4

Specific lattices

Symbol	Read as	Meaning on this site	Example	Used in
$A_2$ `A_2`	“A two”, the hexagonal lattice	$\{x \in \mathbb{Z}^3 : x_0 + x_1 + x_2 = 0\}$ , the densest packing in the plane.	$\det = \sqrt3$ , $\lambda_1 = \sqrt2$ , kissing number 6	1.6, 1.4, 1.3
$D_n$ `D_n`	“D n”, the checkerboard lattice	Integer vectors with an even coordinate sum. $D_{\Lambda,s}$ or $D_{\mathbb{Z},\sigma}$ with a subscript is a discrete Gaussian distribution instead.	$\det(D_n) = 2$ , $\lambda_1 = \sqrt2$	1.6
$E_8$ `E_8`	“E eight”	The densest lattice packing in dimension 8; self-dual.	$\det = 1$ , $\lambda_1 = \sqrt2$ , kissing number 240	1.6, 1.4, 1.3
$\Lambda_{24}$ `\Lambda_{24}`	“the Leech lattice”	The densest lattice packing in dimension 24; even and unimodular.	$\det = 1$ , $\lambda_1 = 2$ , kissing number 196,560	1.6, 1.4, 1.3

Same symbol, different meaning

Symbol	Meanings on this site	How to tell them apart
$\beta$	BKZ block size (4.2, 3.4); SIS norm bound (2.4); Dilithium bound $\beta = \tau\eta$ (3.3)	“BKZ- $\beta$ ” and costs like $2^{0.292\beta}$ mean block size; $\\|x\\| \le \beta$ means a norm bound.
$\gamma$	Hermite constant $\gamma_n$ (1.3, 1.4); approximation factor in $\mathrm{SVP}_\gamma$ (2.1, 2.2); Dilithium $\gamma_1, \gamma_2$ (3.3)	Subscript $n$ is the dimension; a subscript on a problem name is a factor; $\gamma_1 = 2^{17}$ is a parameter.
$\delta$	LLL parameter (4.1, 4.6); root-Hermite factor $\delta_0$ (1.4, 1.5, 4.2), always with the subscript	The LLL parameter is below 1 (0.75, 0.99); the root-Hermite factor is just above 1 (1.005 to 1.022).
$\eta$	Size-reduction parameter (4.6); precision in bits (4.1); secret bound in Kyber and Dilithium (3.1, 3.3); smoothing parameter $\eta_\varepsilon$ (1.4)	0.501 is size reduction; 2 or 4 is a secret bound; a subscript $\varepsilon$ is smoothing.
$\mu$	Covering radius $\mu(\Lambda)$ (1.3, 1.4); Gram–Schmidt coefficient $\mu_{ij}$ (4.1, 1.5); a message bit or signed message (2.3, 2.5, 3.3)	Argument $(\Lambda)$ is a radius; two indices are Gram–Schmidt.
$\rho$	Packing radius $\lambda_1/2$ (1.3, 1.4); Gaussian function $\rho_s$ (1.4)	The Gaussian function always carries a width subscript $s$ .
${}^*$	Dual lattice $\Lambda^$ ; conjugate transpose $B^$ in Falcon (3.6); the closest vector $v^*$ in 2.2	On a lattice it is the dual. Gram–Schmidt vectors are always written with a tilde, $\tilde b_i$ .
$\Delta$	Packing density (1.4, 1.6); FHE scaling factor (3.2)	Density is below 1; the FHE factor is a large power of 2 such as $2^{40}$ .
$D$	Checkerboard lattice $D_n$ (1.6); discrete Gaussian $D_{\Lambda,s}$ (1.4, 2.3, 2.5)	A lattice and a width in the subscript mean a distribution.

Conventions we follow

Norms are Euclidean unless marked: $\|x\|$ is the 2-norm, $\|x\|_\infty$ the largest coordinate.
Chapters 1–6 put basis vectors in columns; the embedding guides and g6k-rs recipes put them in rows. Transpose when you move a formula between them.
$\det(\Lambda)$ always means the positive covolume of the lattice.
The dual lattice is $\Lambda^*$ ; Gram–Schmidt vectors are $\tilde b_i$ . Papers that write $\Lambda^\vee$ or $b_i^*$ mean the same things.
The Gaussian heuristic and root-Hermite estimates are heuristics for random-looking lattices, not bounds.

8.3 Lattice notation